# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Oct 15 2019 14:44:06 # Log Creation Date: 18.10.2019 13:04:27.931 Process: id = "1" image_name = "32.exe.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\32.exe.exe" page_root = "0x4fac4000" os_pid = "0x97c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x980 [0029.104] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0029.105] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableW") returned 0x76c31b48 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0029.106] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="WinExec") returned 0x76cb2c21 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="RemoveDirectoryW") returned 0x76cb44cf [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0029.107] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="ResetEvent") returned 0x76c316dd [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="UnregisterWaitEx") returned 0x76c5b921 [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="QueryDepthSList") returned 0x7716471c [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedPopEntrySList") returned 0x77164770 [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseSemaphore") returned 0x76c4d3ab [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0029.108] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="DuplicateHandle") returned 0x76c31886 [0029.109] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObjectEx") returned 0x76c31151 [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="SwitchToThread") returned 0x76c4efec [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeThread") returned 0x76c4d5b5 [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="GetNativeSystemInfo") returned 0x76c410b5 [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0029.110] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="TryEnterCriticalSection") returned 0x77162500 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0029.111] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadTimes") returned 0x76cb53eb [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedPushEntrySList") returned 0x77164757 [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedFlushSList") returned 0x77162775 [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0029.112] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="ExitThread") returned 0x7718d598 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryAndExitThread") returned 0x76c4d582 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0029.113] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="CreateTimerQueue") returned 0x76c5b020 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="SetEvent") returned 0x76c316c5 [0029.114] GetProcAddress (hModule=0x76c20000, lpProcName="SignalObjectAndWait") returned 0x76c4f8a4 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadPriority") returned 0x76c332bb [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadPriority") returned 0x76c343bf [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="CreateTimerQueueTimer") returned 0x76c4f7eb [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="ChangeTimerQueueTimer") returned 0x76cb40eb [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteTimerQueueTimer") returned 0x76c4f7d3 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetNumaHighestNodeNumber") returned 0x76cb20b2 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessAffinityMask") returned 0x76c3a871 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadAffinityMask") returned 0x76c505a0 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="RegisterWaitForSingleObject") returned 0x76c5cb05 [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="UnregisterWait") returned 0x76cbe6ab [0029.115] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0029.116] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExW") returned 0x76c31ae5 [0029.116] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0029.116] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextA") returned 0x74d491dd [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyKey") returned 0x74d4c51a [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0029.116] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0029.117] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0029.117] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0029.117] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0029.117] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGenRandom") returned 0x74d4dfc8 [0029.117] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b50000 [0029.117] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0029.117] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0029.117] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0029.117] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0029.117] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteW") returned 0x75fe3c71 [0029.117] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0029.117] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0029.118] GetProcAddress (hModule=0x75340000, lpProcName="StrStrW") returned 0x7534e52d [0029.118] GetProcAddress (hModule=0x75340000, lpProcName="wnsprintfW") returned 0x7536ef87 [0029.118] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0029.138] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0029.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xa217adf0, dwHighDateTime=0x1d585b4)) [0029.139] GetCurrentThreadId () returned 0x980 [0029.139] GetCurrentProcessId () returned 0x97c [0029.139] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=14913988873) returned 1 [0029.139] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.139] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.139] GetLastError () returned 0x57 [0029.139] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.139] GetLastError () returned 0x57 [0029.139] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0029.139] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0029.139] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.139] GetLastError () returned 0x57 [0029.139] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.140] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.140] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.140] GetLastError () returned 0x57 [0029.140] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.140] GetLastError () returned 0x57 [0029.140] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0029.140] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0029.140] GetProcessHeap () returned 0x260000 [0029.140] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.140] GetLastError () returned 0x57 [0029.140] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.141] GetLastError () returned 0x57 [0029.141] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0029.141] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x364) returned 0x2746c0 [0029.141] SetLastError (dwErrCode=0x57) [0029.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xc00) returned 0x274a30 [0029.143] GetStartupInfoW (in: lpStartupInfo=0x18fea0 | out: lpStartupInfo=0x18fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x42b370, hStdOutput=0xdb6ced56, hStdError=0xfffffffe)) [0029.143] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0029.143] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.143] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0029.143] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe\" " [0029.143] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe\" " [0029.143] GetACP () returned 0x4e4 [0029.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x220) returned 0x275e38 [0029.144] IsValidCodePage (CodePage=0x4e4) returned 1 [0029.144] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fec0 | out: lpCPInfo=0x18fec0) returned 1 [0029.144] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f788 | out: lpCPInfo=0x18f788) returned 1 [0029.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x18f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.144] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f79c | out: lpCharType=0x18f79c) returned 1 [0029.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x18f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿCĀ") returned 256 [0029.144] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.144] GetLastError () returned 0x57 [0029.144] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0029.144] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿCĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0029.144] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿCĀ", cchSrc=256, lpDestStr=0x18f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0029.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fc9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿf@3ÛØþ\x18", lpUsedDefaultChar=0x0) returned 256 [0029.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.145] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0029.145] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0029.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fb9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿf@3ÛØþ\x18", lpUsedDefaultChar=0x0) returned 256 [0029.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x276060 [0029.145] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fce4, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\32.exe.exe")) returned 0x30 [0029.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x39) returned 0x2760e8 [0029.145] RtlInitializeSListHead (in: ListHead=0x480870 | out: ListHead=0x480870) [0029.145] GetLastError () returned 0x0 [0029.145] SetLastError (dwErrCode=0x0) [0029.145] GetEnvironmentStringsW () returned 0x276130* [0029.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0029.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x565) returned 0x276c08 [0029.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x276c08, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0029.145] FreeEnvironmentStringsW (penv=0x276130) returned 1 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x98) returned 0x276130 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1f) returned 0x275da8 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x36) returned 0x2761d0 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x37) returned 0x276210 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3c) returned 0x276250 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x31) returned 0x276298 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x17) returned 0x2762d8 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x24) returned 0x2762f8 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x14) returned 0x276328 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xd) returned 0x26f000 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x25) returned 0x276348 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x39) returned 0x276378 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x18) returned 0x2763c0 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x17) returned 0x2763e0 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xe) returned 0x26f018 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x69) returned 0x276400 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3e) returned 0x276478 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1b) returned 0x275dd0 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1d) returned 0x275df8 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x48) returned 0x2764c0 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x12) returned 0x276510 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x18) returned 0x276530 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1b) returned 0x277190 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x24) returned 0x277978 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x29) returned 0x2779a8 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1e) returned 0x2771b8 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x41) returned 0x2779e0 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x17) returned 0x277a30 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xf) returned 0x26f030 [0029.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x16) returned 0x277a50 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2a) returned 0x277a70 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x29) returned 0x277aa8 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x15) returned 0x277ae0 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1e) returned 0x2771e0 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2a) returned 0x277b00 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x12) returned 0x277b38 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x18) returned 0x277b58 [0029.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x46) returned 0x277b78 [0029.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x276c08 | out: hHeap=0x260000) returned 1 [0029.147] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0029.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0029.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0029.147] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.147] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0029.147] GetProcAddress (hModule=0x76c20000, lpProcName="InitOnceExecuteOnce") returned 0x76c4d627 [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0029.148] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleEx") returned 0x76c4c78f [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandle") returned 0x76c5cbfc [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0029.149] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="WakeConditionVariable") returned 0x771d7de4 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSRWLock") returned 0x77168456 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="AcquireSRWLockExclusive") returned 0x771629f1 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77174892 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseSRWLockExclusive") returned 0x771629ab [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableSRW") returned 0x76cb4b74 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWork") returned 0x76c4ee45 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="SubmitThreadpoolWork") returned 0x771a8491 [0029.150] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWork") returned 0x7719d8e2 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0029.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x800) returned 0x276550 [0029.151] QueryPerformanceFrequency (in: lpFrequency=0x18ff28 | out: lpFrequency=0x18ff28*=100000000) returned 1 [0029.151] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff20 | out: lpPerformanceCount=0x18ff20*=14915209758) returned 1 [0029.151] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.151] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x0 [0029.151] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0029.151] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0029.152] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0029.152] RtlInitializeConditionVariable () returned 0x4827ec [0029.152] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40ddb2) returned 0x0 [0029.153] GetCurrentThread () returned 0xfffffffe [0029.153] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18ff14, lpExitTime=0x18ff1c, lpKernelTime=0x18ff1c, lpUserTime=0x18ff1c | out: lpCreationTime=0x18ff14, lpExitTime=0x18ff1c, lpKernelTime=0x18ff1c, lpUserTime=0x18ff1c) returned 1 [0029.153] RtlInitializeSListHead (in: ListHead=0x482740 | out: ListHead=0x482740) [0029.154] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x276060) returned 0x80 [0029.155] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x276060, Size=0x100) returned 0x276d58 [0029.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x2773e8 [0029.156] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0029.159] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17f628, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\32.exe.exe")) returned 0x30 [0029.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\32.EXE.exe") returned 48 [0029.159] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.160] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x405e10, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80 [0029.162] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2777d0 [0029.167] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmickvpexchange", dwDesiredAccess=0x20) returned 0x0 [0029.167] lstrlenW (lpString="vmickvpexchange") returned 15 [0029.167] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmicguestinterface", dwDesiredAccess=0x20) returned 0x0 [0029.167] lstrlenW (lpString="vmicguestinterface") returned 18 [0029.167] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmicshutdown", dwDesiredAccess=0x20) returned 0x0 [0029.167] lstrlenW (lpString="vmicshutdown") returned 12 [0029.168] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmicheartbeat", dwDesiredAccess=0x20) returned 0x0 [0029.168] lstrlenW (lpString="vmicheartbeat") returned 13 [0029.168] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmicrdv", dwDesiredAccess=0x20) returned 0x0 [0029.168] lstrlenW (lpString="vmicrdv") returned 7 [0029.168] OpenServiceW (hSCManager=0x2777d0, lpServiceName="storflt", dwDesiredAccess=0x20) returned 0x277730 [0029.169] ControlService (in: hService=0x277730, dwControl=0x1, lpServiceStatus=0x16f558 | out: lpServiceStatus=0x16f558*(dwServiceType=0x1, dwCurrentState=0x4, dwControlsAccepted=0x1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0029.176] CloseServiceHandle (hSCObject=0x277730) returned 1 [0029.176] lstrlenW (lpString="storflt") returned 7 [0029.176] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmictimesync", dwDesiredAccess=0x20) returned 0x0 [0029.176] lstrlenW (lpString="vmictimesync") returned 12 [0029.176] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmicvss", dwDesiredAccess=0x20) returned 0x0 [0029.177] lstrlenW (lpString="vmicvss") returned 7 [0029.177] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0x20) returned 0x0 [0029.177] lstrlenW (lpString="MSSQLFDLauncher") returned 15 [0029.177] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MSSQLSERVER", dwDesiredAccess=0x20) returned 0x0 [0029.177] lstrlenW (lpString="MSSQLSERVER") returned 11 [0029.177] OpenServiceW (hSCManager=0x2777d0, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0x20) returned 0x0 [0029.177] lstrlenW (lpString="SQLSERVERAGENT") returned 14 [0029.177] OpenServiceW (hSCManager=0x2777d0, lpServiceName="SQLBrowser", dwDesiredAccess=0x20) returned 0x0 [0029.178] lstrlenW (lpString="SQLBrowser") returned 10 [0029.178] OpenServiceW (hSCManager=0x2777d0, lpServiceName="SQLTELEMETRY", dwDesiredAccess=0x20) returned 0x0 [0029.178] lstrlenW (lpString="SQLTELEMETRY") returned 12 [0029.178] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MsDtsServer130", dwDesiredAccess=0x20) returned 0x0 [0029.178] lstrlenW (lpString="MsDtsServer130") returned 14 [0029.178] OpenServiceW (hSCManager=0x2777d0, lpServiceName="SSISTELEMETRY130", dwDesiredAccess=0x20) returned 0x0 [0029.178] lstrlenW (lpString="SSISTELEMETRY130") returned 16 [0029.178] OpenServiceW (hSCManager=0x2777d0, lpServiceName="SQLWriter", dwDesiredAccess=0x20) returned 0x0 [0029.179] lstrlenW (lpString="SQLWriter") returned 9 [0029.179] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MSSQL", dwDesiredAccess=0x20) returned 0x0 [0029.179] lstrlenW (lpString="MSSQL") returned 5 [0029.179] OpenServiceW (hSCManager=0x2777d0, lpServiceName="SQLAgent", dwDesiredAccess=0x20) returned 0x0 [0029.179] lstrlenW (lpString="SQLAgent") returned 8 [0029.179] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MSSQLServerADHelper100", dwDesiredAccess=0x20) returned 0x0 [0029.179] lstrlenW (lpString="MSSQLServerADHelper100") returned 22 [0029.179] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MSSQLServerOLAPService", dwDesiredAccess=0x20) returned 0x0 [0029.180] lstrlenW (lpString="MSSQLServerOLAPService") returned 22 [0029.180] OpenServiceW (hSCManager=0x2777d0, lpServiceName="MsDtsServer100", dwDesiredAccess=0x20) returned 0x0 [0029.180] lstrlenW (lpString="MsDtsServer100") returned 14 [0029.180] OpenServiceW (hSCManager=0x2777d0, lpServiceName="ReportServer", dwDesiredAccess=0x20) returned 0x0 [0029.180] lstrlenW (lpString="ReportServer") returned 12 [0029.180] OpenServiceW (hSCManager=0x2777d0, lpServiceName="TMBMServer", dwDesiredAccess=0x20) returned 0x0 [0029.180] lstrlenW (lpString="TMBMServer") returned 10 [0029.180] OpenServiceW (hSCManager=0x2777d0, lpServiceName="postgresql-x64-9.4", dwDesiredAccess=0x20) returned 0x0 [0029.181] lstrlenW (lpString="postgresql-x64-9.4") returned 18 [0029.181] OpenServiceW (hSCManager=0x2777d0, lpServiceName="UniFi", dwDesiredAccess=0x20) returned 0x0 [0029.181] lstrlenW (lpString="UniFi") returned 5 [0029.181] OpenServiceW (hSCManager=0x2777d0, lpServiceName="vmms", dwDesiredAccess=0x20) returned 0x0 [0029.181] lstrlenW (lpString="vmms") returned 4 [0029.181] OpenServiceW (hSCManager=0x2777d0, lpServiceName="sql-x64-9.4\r\nUniFi\r\nvmms", dwDesiredAccess=0x20) returned 0x0 [0029.181] lstrlenW (lpString="sql-x64-9.4\r\nUniFi\r\nvmms") returned 24 [0029.181] CloseServiceHandle (hSCObject=0x2777d0) returned 1 [0029.185] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.186] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.186] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc8 [0029.190] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0029.191] lstrcmpW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0029.193] lstrlenW (lpString="sqlbrowser.exe") returned 14 [0029.193] lstrcmpW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0029.193] lstrlenW (lpString="sqlwriter.exe") returned 13 [0029.193] lstrcmpW (lpString1="[System Process]", lpString2="sqlservr.exe") returned -1 [0029.193] lstrlenW (lpString="sqlservr.exe") returned 12 [0029.193] lstrcmpW (lpString1="[System Process]", lpString2="msmdsrv.exe") returned -1 [0029.193] lstrlenW (lpString="msmdsrv.exe") returned 11 [0029.193] lstrcmpW (lpString1="[System Process]", lpString2="MsDtsSrvr.exe") returned -1 [0029.193] lstrlenW (lpString="MsDtsSrvr.exe") returned 13 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="sqlceip.exe") returned -1 [0029.194] lstrlenW (lpString="sqlceip.exe") returned 11 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="fdlauncher.exe") returned -1 [0029.194] lstrlenW (lpString="fdlauncher.exe") returned 14 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="Ssms.exe") returned -1 [0029.194] lstrlenW (lpString="Ssms.exe") returned 8 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="sqlserv.exe") returned -1 [0029.194] lstrlenW (lpString="sqlserv.exe") returned 11 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0029.194] lstrlenW (lpString="oracle.exe") returned 10 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="ntdbsmgr.exe") returned -1 [0029.194] lstrlenW (lpString="ntdbsmgr.exe") returned 12 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="ReportingServecesService.exe") returned -1 [0029.194] lstrlenW (lpString="ReportingServecesService.exe") returned 28 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="fdhost.exe") returned -1 [0029.194] lstrlenW (lpString="fdhost.exe") returned 10 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="SQLAGENT.EXE") returned -1 [0029.194] lstrlenW (lpString="SQLAGENT.EXE") returned 12 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="ReportingServicesService.exe") returned -1 [0029.194] lstrlenW (lpString="ReportingServicesService.exe") returned 28 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0029.194] lstrlenW (lpString="msftesql.exe") returned 12 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="pg_ctl.exe") returned -1 [0029.194] lstrlenW (lpString="pg_ctl.exe") returned 10 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="postgres.exe") returned -1 [0029.194] lstrlenW (lpString="postgres.exe") returned 12 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="UniFi.exe") returned -1 [0029.194] lstrlenW (lpString="UniFi.exe") returned 9 [0029.194] lstrcmpW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0029.195] lstrlenW (lpString="sqlagent.exe") returned 12 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0029.195] lstrlenW (lpString="ocssd.exe") returned 9 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0029.195] lstrlenW (lpString="dbsnmp.exe") returned 10 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0029.195] lstrlenW (lpString="synctime.exe") returned 12 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="mydesctopservice.exe") returned -1 [0029.195] lstrlenW (lpString="mydesctopservice.exe") returned 20 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0029.195] lstrlenW (lpString="ocautoupds.exe") returned 14 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="agntsvc.exeagntsvc.exe") returned -1 [0029.195] lstrlenW (lpString="agntsvc.exeagntsvc.exe") returned 22 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="agntsvc.exeencsvc.exe") returned -1 [0029.195] lstrlenW (lpString="agntsvc.exeencsvc.exe") returned 21 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0029.195] lstrlenW (lpString="firefoxconfig.exe") returned 17 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0029.195] lstrlenW (lpString="tbirdconfig.exe") returned 15 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0029.195] lstrlenW (lpString="ocomm.exe") returned 9 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0029.195] lstrlenW (lpString="mysqld.exe") returned 10 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="mysqld-nt.exe") returned -1 [0029.195] lstrlenW (lpString="mysqld-nt.exe") returned 13 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="mysqld-opt.exe") returned -1 [0029.195] lstrlenW (lpString="mysqld-opt.exe") returned 14 [0029.195] lstrcmpW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0029.196] lstrlenW (lpString="dbeng50.exe") returned 11 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0029.196] lstrlenW (lpString="sqbcoreservice.exe") returned 18 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0029.196] lstrlenW (lpString="excel.exe") returned 9 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0029.196] lstrlenW (lpString="infopath.exe") returned 12 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0029.196] lstrlenW (lpString="msaccess.exe") returned 12 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0029.196] lstrlenW (lpString="mspub.exe") returned 9 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0029.196] lstrlenW (lpString="onenote.exe") returned 11 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0029.196] lstrlenW (lpString="outlook.exe") returned 11 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0029.196] lstrlenW (lpString="powerpnt.exe") returned 12 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="steam.exe") returned -1 [0029.196] lstrlenW (lpString="steam.exe") returned 9 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0029.196] lstrlenW (lpString="thebat.exe") returned 10 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0029.196] lstrlenW (lpString="thebat64.exe") returned 12 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="thunderbird.exe") returned -1 [0029.196] lstrlenW (lpString="thunderbird.exe") returned 15 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0029.196] lstrlenW (lpString="visio.exe") returned 9 [0029.196] lstrcmpW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0029.196] lstrlenW (lpString="winword.exe") returned 11 [0029.197] lstrcmpW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0029.197] lstrlenW (lpString="wordpad.exe") returned 11 [0029.197] lstrcmpW (lpString1="[System Process]", lpString2="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned -1 [0029.197] lstrlenW (lpString="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned 47 [0029.197] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0029.197] lstrcmpW (lpString1="System", lpString2="sqlbrowser.exe") returned 1 [0029.197] lstrlenW (lpString="sqlbrowser.exe") returned 14 [0029.197] lstrcmpW (lpString1="System", lpString2="sqlwriter.exe") returned 1 [0029.197] lstrlenW (lpString="sqlwriter.exe") returned 13 [0029.197] lstrcmpW (lpString1="System", lpString2="sqlservr.exe") returned 1 [0029.197] lstrlenW (lpString="sqlservr.exe") returned 12 [0029.198] lstrcmpW (lpString1="System", lpString2="msmdsrv.exe") returned 1 [0029.198] lstrlenW (lpString="msmdsrv.exe") returned 11 [0029.198] lstrcmpW (lpString1="System", lpString2="MsDtsSrvr.exe") returned 1 [0029.198] lstrlenW (lpString="MsDtsSrvr.exe") returned 13 [0029.198] lstrcmpW (lpString1="System", lpString2="sqlceip.exe") returned 1 [0029.198] lstrlenW (lpString="sqlceip.exe") returned 11 [0029.198] lstrcmpW (lpString1="System", lpString2="fdlauncher.exe") returned 1 [0029.198] lstrlenW (lpString="fdlauncher.exe") returned 14 [0029.198] lstrcmpW (lpString1="System", lpString2="Ssms.exe") returned 1 [0029.198] lstrlenW (lpString="Ssms.exe") returned 8 [0029.198] lstrcmpW (lpString1="System", lpString2="sqlserv.exe") returned 1 [0029.198] lstrlenW (lpString="sqlserv.exe") returned 11 [0029.198] lstrcmpW (lpString1="System", lpString2="oracle.exe") returned 1 [0029.198] lstrlenW (lpString="oracle.exe") returned 10 [0029.198] lstrcmpW (lpString1="System", lpString2="ntdbsmgr.exe") returned 1 [0029.198] lstrlenW (lpString="ntdbsmgr.exe") returned 12 [0029.198] lstrcmpW (lpString1="System", lpString2="ReportingServecesService.exe") returned 1 [0029.198] lstrlenW (lpString="ReportingServecesService.exe") returned 28 [0029.198] lstrcmpW (lpString1="System", lpString2="fdhost.exe") returned 1 [0029.198] lstrlenW (lpString="fdhost.exe") returned 10 [0029.198] lstrcmpW (lpString1="System", lpString2="SQLAGENT.EXE") returned 1 [0029.198] lstrlenW (lpString="SQLAGENT.EXE") returned 12 [0029.198] lstrcmpW (lpString1="System", lpString2="ReportingServicesService.exe") returned 1 [0029.198] lstrlenW (lpString="ReportingServicesService.exe") returned 28 [0029.198] lstrcmpW (lpString1="System", lpString2="msftesql.exe") returned 1 [0029.198] lstrlenW (lpString="msftesql.exe") returned 12 [0029.198] lstrcmpW (lpString1="System", lpString2="pg_ctl.exe") returned 1 [0029.198] lstrlenW (lpString="pg_ctl.exe") returned 10 [0029.198] lstrcmpW (lpString1="System", lpString2="postgres.exe") returned 1 [0029.199] lstrlenW (lpString="postgres.exe") returned 12 [0029.199] lstrcmpW (lpString1="System", lpString2="UniFi.exe") returned -1 [0029.199] lstrlenW (lpString="UniFi.exe") returned 9 [0029.199] lstrcmpW (lpString1="System", lpString2="sqlagent.exe") returned 1 [0029.199] lstrlenW (lpString="sqlagent.exe") returned 12 [0029.199] lstrcmpW (lpString1="System", lpString2="ocssd.exe") returned 1 [0029.199] lstrlenW (lpString="ocssd.exe") returned 9 [0029.199] lstrcmpW (lpString1="System", lpString2="dbsnmp.exe") returned 1 [0029.199] lstrlenW (lpString="dbsnmp.exe") returned 10 [0029.199] lstrcmpW (lpString1="System", lpString2="synctime.exe") returned 1 [0029.199] lstrlenW (lpString="synctime.exe") returned 12 [0029.199] lstrcmpW (lpString1="System", lpString2="mydesctopservice.exe") returned 1 [0029.199] lstrlenW (lpString="mydesctopservice.exe") returned 20 [0029.199] lstrcmpW (lpString1="System", lpString2="ocautoupds.exe") returned 1 [0029.199] lstrlenW (lpString="ocautoupds.exe") returned 14 [0029.199] lstrcmpW (lpString1="System", lpString2="agntsvc.exeagntsvc.exe") returned 1 [0029.199] lstrlenW (lpString="agntsvc.exeagntsvc.exe") returned 22 [0029.199] lstrcmpW (lpString1="System", lpString2="agntsvc.exeencsvc.exe") returned 1 [0029.199] lstrlenW (lpString="agntsvc.exeencsvc.exe") returned 21 [0029.199] lstrcmpW (lpString1="System", lpString2="firefoxconfig.exe") returned 1 [0029.199] lstrlenW (lpString="firefoxconfig.exe") returned 17 [0029.199] lstrcmpW (lpString1="System", lpString2="tbirdconfig.exe") returned -1 [0029.199] lstrlenW (lpString="tbirdconfig.exe") returned 15 [0029.199] lstrcmpW (lpString1="System", lpString2="ocomm.exe") returned 1 [0029.199] lstrlenW (lpString="ocomm.exe") returned 9 [0029.199] lstrcmpW (lpString1="System", lpString2="mysqld.exe") returned 1 [0029.199] lstrlenW (lpString="mysqld.exe") returned 10 [0029.199] lstrcmpW (lpString1="System", lpString2="mysqld-nt.exe") returned 1 [0029.200] lstrlenW (lpString="mysqld-nt.exe") returned 13 [0029.200] lstrcmpW (lpString1="System", lpString2="mysqld-opt.exe") returned 1 [0029.200] lstrlenW (lpString="mysqld-opt.exe") returned 14 [0029.200] lstrcmpW (lpString1="System", lpString2="dbeng50.exe") returned 1 [0029.200] lstrlenW (lpString="dbeng50.exe") returned 11 [0029.200] lstrcmpW (lpString1="System", lpString2="sqbcoreservice.exe") returned 1 [0029.200] lstrlenW (lpString="sqbcoreservice.exe") returned 18 [0029.200] lstrcmpW (lpString1="System", lpString2="excel.exe") returned 1 [0029.200] lstrlenW (lpString="excel.exe") returned 9 [0029.200] lstrcmpW (lpString1="System", lpString2="infopath.exe") returned 1 [0029.200] lstrlenW (lpString="infopath.exe") returned 12 [0029.200] lstrcmpW (lpString1="System", lpString2="msaccess.exe") returned 1 [0029.200] lstrlenW (lpString="msaccess.exe") returned 12 [0029.200] lstrcmpW (lpString1="System", lpString2="mspub.exe") returned 1 [0029.200] lstrlenW (lpString="mspub.exe") returned 9 [0029.200] lstrcmpW (lpString1="System", lpString2="onenote.exe") returned 1 [0029.200] lstrlenW (lpString="onenote.exe") returned 11 [0029.200] lstrcmpW (lpString1="System", lpString2="outlook.exe") returned 1 [0029.200] lstrlenW (lpString="outlook.exe") returned 11 [0029.200] lstrcmpW (lpString1="System", lpString2="powerpnt.exe") returned 1 [0029.200] lstrlenW (lpString="powerpnt.exe") returned 12 [0029.200] lstrcmpW (lpString1="System", lpString2="steam.exe") returned 1 [0029.200] lstrlenW (lpString="steam.exe") returned 9 [0029.200] lstrcmpW (lpString1="System", lpString2="thebat.exe") returned -1 [0029.200] lstrlenW (lpString="thebat.exe") returned 10 [0029.200] lstrcmpW (lpString1="System", lpString2="thebat64.exe") returned -1 [0029.200] lstrlenW (lpString="thebat64.exe") returned 12 [0029.200] lstrcmpW (lpString1="System", lpString2="thunderbird.exe") returned -1 [0029.200] lstrlenW (lpString="thunderbird.exe") returned 15 [0029.201] lstrcmpW (lpString1="System", lpString2="visio.exe") returned -1 [0029.201] lstrlenW (lpString="visio.exe") returned 9 [0029.201] lstrcmpW (lpString1="System", lpString2="winword.exe") returned -1 [0029.201] lstrlenW (lpString="winword.exe") returned 11 [0029.201] lstrcmpW (lpString1="System", lpString2="wordpad.exe") returned -1 [0029.201] lstrlenW (lpString="wordpad.exe") returned 11 [0029.201] lstrcmpW (lpString1="System", lpString2="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned 1 [0029.201] lstrlenW (lpString="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned 47 [0029.201] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0029.201] lstrcmpW (lpString1="smss.exe", lpString2="sqlbrowser.exe") returned -1 [0029.201] lstrlenW (lpString="sqlbrowser.exe") returned 14 [0029.201] lstrcmpW (lpString1="smss.exe", lpString2="sqlwriter.exe") returned -1 [0029.201] lstrlenW (lpString="sqlwriter.exe") returned 13 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="sqlservr.exe") returned -1 [0029.202] lstrlenW (lpString="sqlservr.exe") returned 12 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="msmdsrv.exe") returned 1 [0029.202] lstrlenW (lpString="msmdsrv.exe") returned 11 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="MsDtsSrvr.exe") returned 1 [0029.202] lstrlenW (lpString="MsDtsSrvr.exe") returned 13 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="sqlceip.exe") returned -1 [0029.202] lstrlenW (lpString="sqlceip.exe") returned 11 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="fdlauncher.exe") returned 1 [0029.202] lstrlenW (lpString="fdlauncher.exe") returned 14 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="Ssms.exe") returned -1 [0029.202] lstrlenW (lpString="Ssms.exe") returned 8 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="sqlserv.exe") returned -1 [0029.202] lstrlenW (lpString="sqlserv.exe") returned 11 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="oracle.exe") returned 1 [0029.202] lstrlenW (lpString="oracle.exe") returned 10 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="ntdbsmgr.exe") returned 1 [0029.202] lstrlenW (lpString="ntdbsmgr.exe") returned 12 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="ReportingServecesService.exe") returned 1 [0029.202] lstrlenW (lpString="ReportingServecesService.exe") returned 28 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="fdhost.exe") returned 1 [0029.202] lstrlenW (lpString="fdhost.exe") returned 10 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="SQLAGENT.EXE") returned -1 [0029.202] lstrlenW (lpString="SQLAGENT.EXE") returned 12 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="ReportingServicesService.exe") returned 1 [0029.202] lstrlenW (lpString="ReportingServicesService.exe") returned 28 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="msftesql.exe") returned 1 [0029.202] lstrlenW (lpString="msftesql.exe") returned 12 [0029.202] lstrcmpW (lpString1="smss.exe", lpString2="pg_ctl.exe") returned 1 [0029.203] lstrlenW (lpString="pg_ctl.exe") returned 10 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="postgres.exe") returned 1 [0029.203] lstrlenW (lpString="postgres.exe") returned 12 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="UniFi.exe") returned -1 [0029.203] lstrlenW (lpString="UniFi.exe") returned 9 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="sqlagent.exe") returned -1 [0029.203] lstrlenW (lpString="sqlagent.exe") returned 12 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="ocssd.exe") returned 1 [0029.203] lstrlenW (lpString="ocssd.exe") returned 9 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="dbsnmp.exe") returned 1 [0029.203] lstrlenW (lpString="dbsnmp.exe") returned 10 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="synctime.exe") returned -1 [0029.203] lstrlenW (lpString="synctime.exe") returned 12 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="mydesctopservice.exe") returned 1 [0029.203] lstrlenW (lpString="mydesctopservice.exe") returned 20 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="ocautoupds.exe") returned 1 [0029.203] lstrlenW (lpString="ocautoupds.exe") returned 14 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="agntsvc.exeagntsvc.exe") returned 1 [0029.203] lstrlenW (lpString="agntsvc.exeagntsvc.exe") returned 22 [0029.203] lstrcmpW (lpString1="smss.exe", lpString2="agntsvc.exeencsvc.exe") returned 1 [0029.204] lstrlenW (lpString="agntsvc.exeencsvc.exe") returned 21 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="firefoxconfig.exe") returned 1 [0029.204] lstrlenW (lpString="firefoxconfig.exe") returned 17 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="tbirdconfig.exe") returned -1 [0029.204] lstrlenW (lpString="tbirdconfig.exe") returned 15 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="ocomm.exe") returned 1 [0029.204] lstrlenW (lpString="ocomm.exe") returned 9 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="mysqld.exe") returned 1 [0029.204] lstrlenW (lpString="mysqld.exe") returned 10 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="mysqld-nt.exe") returned 1 [0029.204] lstrlenW (lpString="mysqld-nt.exe") returned 13 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="mysqld-opt.exe") returned 1 [0029.204] lstrlenW (lpString="mysqld-opt.exe") returned 14 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="dbeng50.exe") returned 1 [0029.204] lstrlenW (lpString="dbeng50.exe") returned 11 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="sqbcoreservice.exe") returned -1 [0029.204] lstrlenW (lpString="sqbcoreservice.exe") returned 18 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="excel.exe") returned 1 [0029.204] lstrlenW (lpString="excel.exe") returned 9 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="infopath.exe") returned 1 [0029.204] lstrlenW (lpString="infopath.exe") returned 12 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="msaccess.exe") returned 1 [0029.204] lstrlenW (lpString="msaccess.exe") returned 12 [0029.204] lstrcmpW (lpString1="smss.exe", lpString2="mspub.exe") returned 1 [0029.205] lstrlenW (lpString="mspub.exe") returned 9 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="onenote.exe") returned 1 [0029.205] lstrlenW (lpString="onenote.exe") returned 11 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="outlook.exe") returned 1 [0029.205] lstrlenW (lpString="outlook.exe") returned 11 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="powerpnt.exe") returned 1 [0029.205] lstrlenW (lpString="powerpnt.exe") returned 12 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="steam.exe") returned -1 [0029.205] lstrlenW (lpString="steam.exe") returned 9 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="thebat.exe") returned -1 [0029.205] lstrlenW (lpString="thebat.exe") returned 10 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="thebat64.exe") returned -1 [0029.205] lstrlenW (lpString="thebat64.exe") returned 12 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="thunderbird.exe") returned -1 [0029.205] lstrlenW (lpString="thunderbird.exe") returned 15 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="visio.exe") returned -1 [0029.205] lstrlenW (lpString="visio.exe") returned 9 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="winword.exe") returned -1 [0029.205] lstrlenW (lpString="winword.exe") returned 11 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="wordpad.exe") returned -1 [0029.205] lstrlenW (lpString="wordpad.exe") returned 11 [0029.205] lstrcmpW (lpString1="smss.exe", lpString2="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned 1 [0029.205] lstrlenW (lpString="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned 47 [0029.205] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="sqlbrowser.exe") returned -1 [0029.206] lstrlenW (lpString="sqlbrowser.exe") returned 14 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="sqlwriter.exe") returned -1 [0029.206] lstrlenW (lpString="sqlwriter.exe") returned 13 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="sqlservr.exe") returned -1 [0029.206] lstrlenW (lpString="sqlservr.exe") returned 12 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="msmdsrv.exe") returned -1 [0029.206] lstrlenW (lpString="msmdsrv.exe") returned 11 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="MsDtsSrvr.exe") returned -1 [0029.206] lstrlenW (lpString="MsDtsSrvr.exe") returned 13 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="sqlceip.exe") returned -1 [0029.206] lstrlenW (lpString="sqlceip.exe") returned 11 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="fdlauncher.exe") returned -1 [0029.206] lstrlenW (lpString="fdlauncher.exe") returned 14 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="Ssms.exe") returned -1 [0029.206] lstrlenW (lpString="Ssms.exe") returned 8 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="sqlserv.exe") returned -1 [0029.206] lstrlenW (lpString="sqlserv.exe") returned 11 [0029.206] lstrcmpW (lpString1="csrss.exe", lpString2="oracle.exe") returned -1 [0029.207] lstrlenW (lpString="oracle.exe") returned 10 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="ntdbsmgr.exe") returned -1 [0029.207] lstrlenW (lpString="ntdbsmgr.exe") returned 12 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="ReportingServecesService.exe") returned -1 [0029.207] lstrlenW (lpString="ReportingServecesService.exe") returned 28 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="fdhost.exe") returned -1 [0029.207] lstrlenW (lpString="fdhost.exe") returned 10 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="SQLAGENT.EXE") returned -1 [0029.207] lstrlenW (lpString="SQLAGENT.EXE") returned 12 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="ReportingServicesService.exe") returned -1 [0029.207] lstrlenW (lpString="ReportingServicesService.exe") returned 28 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="msftesql.exe") returned -1 [0029.207] lstrlenW (lpString="msftesql.exe") returned 12 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="pg_ctl.exe") returned -1 [0029.207] lstrlenW (lpString="pg_ctl.exe") returned 10 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="postgres.exe") returned -1 [0029.207] lstrlenW (lpString="postgres.exe") returned 12 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="UniFi.exe") returned -1 [0029.207] lstrlenW (lpString="UniFi.exe") returned 9 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="sqlagent.exe") returned -1 [0029.207] lstrlenW (lpString="sqlagent.exe") returned 12 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="ocssd.exe") returned -1 [0029.207] lstrlenW (lpString="ocssd.exe") returned 9 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="dbsnmp.exe") returned -1 [0029.207] lstrlenW (lpString="dbsnmp.exe") returned 10 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="synctime.exe") returned -1 [0029.207] lstrlenW (lpString="synctime.exe") returned 12 [0029.207] lstrcmpW (lpString1="csrss.exe", lpString2="mydesctopservice.exe") returned -1 [0029.207] lstrlenW (lpString="mydesctopservice.exe") returned 20 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="ocautoupds.exe") returned -1 [0029.208] lstrlenW (lpString="ocautoupds.exe") returned 14 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="agntsvc.exeagntsvc.exe") returned 1 [0029.208] lstrlenW (lpString="agntsvc.exeagntsvc.exe") returned 22 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="agntsvc.exeencsvc.exe") returned 1 [0029.208] lstrlenW (lpString="agntsvc.exeencsvc.exe") returned 21 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="firefoxconfig.exe") returned -1 [0029.208] lstrlenW (lpString="firefoxconfig.exe") returned 17 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="tbirdconfig.exe") returned -1 [0029.208] lstrlenW (lpString="tbirdconfig.exe") returned 15 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="ocomm.exe") returned -1 [0029.208] lstrlenW (lpString="ocomm.exe") returned 9 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="mysqld.exe") returned -1 [0029.208] lstrlenW (lpString="mysqld.exe") returned 10 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="mysqld-nt.exe") returned -1 [0029.208] lstrlenW (lpString="mysqld-nt.exe") returned 13 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="mysqld-opt.exe") returned -1 [0029.208] lstrlenW (lpString="mysqld-opt.exe") returned 14 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="dbeng50.exe") returned -1 [0029.208] lstrlenW (lpString="dbeng50.exe") returned 11 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="sqbcoreservice.exe") returned -1 [0029.208] lstrlenW (lpString="sqbcoreservice.exe") returned 18 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="excel.exe") returned -1 [0029.208] lstrlenW (lpString="excel.exe") returned 9 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="infopath.exe") returned -1 [0029.208] lstrlenW (lpString="infopath.exe") returned 12 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="msaccess.exe") returned -1 [0029.208] lstrlenW (lpString="msaccess.exe") returned 12 [0029.208] lstrcmpW (lpString1="csrss.exe", lpString2="mspub.exe") returned -1 [0029.209] lstrlenW (lpString="mspub.exe") returned 9 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="onenote.exe") returned -1 [0029.209] lstrlenW (lpString="onenote.exe") returned 11 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="outlook.exe") returned -1 [0029.209] lstrlenW (lpString="outlook.exe") returned 11 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="powerpnt.exe") returned -1 [0029.209] lstrlenW (lpString="powerpnt.exe") returned 12 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="steam.exe") returned -1 [0029.209] lstrlenW (lpString="steam.exe") returned 9 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="thebat.exe") returned -1 [0029.209] lstrlenW (lpString="thebat.exe") returned 10 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="thebat64.exe") returned -1 [0029.209] lstrlenW (lpString="thebat64.exe") returned 12 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="thunderbird.exe") returned -1 [0029.209] lstrlenW (lpString="thunderbird.exe") returned 15 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="visio.exe") returned -1 [0029.209] lstrlenW (lpString="visio.exe") returned 9 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="winword.exe") returned -1 [0029.209] lstrlenW (lpString="winword.exe") returned 11 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="wordpad.exe") returned -1 [0029.209] lstrlenW (lpString="wordpad.exe") returned 11 [0029.209] lstrcmpW (lpString1="csrss.exe", lpString2="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned -1 [0029.209] lstrlenW (lpString="erbird.exe\r\nvisio.exe\r\nwinword.exe\r\nwordpad.exe") returned 47 [0029.209] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="sqlbrowser.exe") returned 1 [0029.210] lstrlenW (lpString="sqlbrowser.exe") returned 14 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="sqlwriter.exe") returned 1 [0029.210] lstrlenW (lpString="sqlwriter.exe") returned 13 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="sqlservr.exe") returned 1 [0029.210] lstrlenW (lpString="sqlservr.exe") returned 12 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="msmdsrv.exe") returned 1 [0029.210] lstrlenW (lpString="msmdsrv.exe") returned 11 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="MsDtsSrvr.exe") returned 1 [0029.210] lstrlenW (lpString="MsDtsSrvr.exe") returned 13 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="sqlceip.exe") returned 1 [0029.210] lstrlenW (lpString="sqlceip.exe") returned 11 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="fdlauncher.exe") returned 1 [0029.210] lstrlenW (lpString="fdlauncher.exe") returned 14 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="Ssms.exe") returned 1 [0029.210] lstrlenW (lpString="Ssms.exe") returned 8 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="sqlserv.exe") returned 1 [0029.210] lstrlenW (lpString="sqlserv.exe") returned 11 [0029.210] lstrcmpW (lpString1="wininit.exe", lpString2="oracle.exe") returned 1 [0029.211] lstrlenW (lpString="oracle.exe") returned 10 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="ntdbsmgr.exe") returned 1 [0029.211] lstrlenW (lpString="ntdbsmgr.exe") returned 12 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="ReportingServecesService.exe") returned 1 [0029.211] lstrlenW (lpString="ReportingServecesService.exe") returned 28 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="fdhost.exe") returned 1 [0029.211] lstrlenW (lpString="fdhost.exe") returned 10 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="SQLAGENT.EXE") returned 1 [0029.211] lstrlenW (lpString="SQLAGENT.EXE") returned 12 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="ReportingServicesService.exe") returned 1 [0029.211] lstrlenW (lpString="ReportingServicesService.exe") returned 28 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="msftesql.exe") returned 1 [0029.211] lstrlenW (lpString="msftesql.exe") returned 12 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="pg_ctl.exe") returned 1 [0029.211] lstrlenW (lpString="pg_ctl.exe") returned 10 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="postgres.exe") returned 1 [0029.211] lstrlenW (lpString="postgres.exe") returned 12 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="UniFi.exe") returned 1 [0029.211] lstrlenW (lpString="UniFi.exe") returned 9 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="sqlagent.exe") returned 1 [0029.211] lstrlenW (lpString="sqlagent.exe") returned 12 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="ocssd.exe") returned 1 [0029.211] lstrlenW (lpString="ocssd.exe") returned 9 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="dbsnmp.exe") returned 1 [0029.211] lstrlenW (lpString="dbsnmp.exe") returned 10 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="synctime.exe") returned 1 [0029.211] lstrlenW (lpString="synctime.exe") returned 12 [0029.211] lstrcmpW (lpString1="wininit.exe", lpString2="mydesctopservice.exe") returned 1 [0029.212] lstrlenW (lpString="mydesctopservice.exe") returned 20 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="ocautoupds.exe") returned 1 [0029.212] lstrlenW (lpString="ocautoupds.exe") returned 14 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="agntsvc.exeagntsvc.exe") returned 1 [0029.212] lstrlenW (lpString="agntsvc.exeagntsvc.exe") returned 22 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="agntsvc.exeencsvc.exe") returned 1 [0029.212] lstrlenW (lpString="agntsvc.exeencsvc.exe") returned 21 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="firefoxconfig.exe") returned 1 [0029.212] lstrlenW (lpString="firefoxconfig.exe") returned 17 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="tbirdconfig.exe") returned 1 [0029.212] lstrlenW (lpString="tbirdconfig.exe") returned 15 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="ocomm.exe") returned 1 [0029.212] lstrlenW (lpString="ocomm.exe") returned 9 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="mysqld.exe") returned 1 [0029.212] lstrlenW (lpString="mysqld.exe") returned 10 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="mysqld-nt.exe") returned 1 [0029.212] lstrlenW (lpString="mysqld-nt.exe") returned 13 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="mysqld-opt.exe") returned 1 [0029.212] lstrlenW (lpString="mysqld-opt.exe") returned 14 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="dbeng50.exe") returned 1 [0029.212] lstrlenW (lpString="dbeng50.exe") returned 11 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="sqbcoreservice.exe") returned 1 [0029.212] lstrlenW (lpString="sqbcoreservice.exe") returned 18 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="excel.exe") returned 1 [0029.212] lstrlenW (lpString="excel.exe") returned 9 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="infopath.exe") returned 1 [0029.212] lstrlenW (lpString="infopath.exe") returned 12 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="msaccess.exe") returned 1 [0029.212] lstrlenW (lpString="msaccess.exe") returned 12 [0029.212] lstrcmpW (lpString1="wininit.exe", lpString2="mspub.exe") returned 1 [0029.213] lstrlenW (lpString="mspub.exe") returned 9 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="onenote.exe") returned 1 [0029.213] lstrlenW (lpString="onenote.exe") returned 11 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="outlook.exe") returned 1 [0029.213] lstrlenW (lpString="outlook.exe") returned 11 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="powerpnt.exe") returned 1 [0029.213] lstrlenW (lpString="powerpnt.exe") returned 12 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="steam.exe") returned 1 [0029.213] lstrlenW (lpString="steam.exe") returned 9 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="thebat.exe") returned 1 [0029.213] lstrlenW (lpString="thebat.exe") returned 10 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="thebat64.exe") returned 1 [0029.213] lstrlenW (lpString="thebat64.exe") returned 12 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="thunderbird.exe") returned 1 [0029.213] lstrlenW (lpString="thunderbird.exe") returned 15 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="visio.exe") returned 1 [0029.213] lstrlenW (lpString="visio.exe") returned 9 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="winword.exe") returned -1 [0029.213] lstrlenW (lpString="winword.exe") returned 11 [0029.213] lstrcmpW (lpString1="wininit.exe", lpString2="wordpad.exe") returned -1 [0029.213] lstrlenW (lpString="wordpad.exe") returned 11 [0029.213] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0029.214] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0029.215] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0029.215] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0029.216] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0029.217] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.217] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.218] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.218] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.219] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.220] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0029.220] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.221] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.221] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0029.222] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0029.222] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0029.223] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0029.224] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0029.224] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0029.225] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wish.exe")) returned 1 [0029.225] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="maiden_method.exe")) returned 1 [0029.226] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="inns.exe")) returned 1 [0029.226] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="calendars-wooden.exe")) returned 1 [0029.227] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="slope.exe")) returned 1 [0029.228] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit.exe")) returned 1 [0029.228] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="targeted-ohio.exe")) returned 1 [0029.229] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridges.exe")) returned 1 [0029.229] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="breakdown.exe")) returned 1 [0029.230] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gardenslot.exe")) returned 1 [0029.231] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ending.exe")) returned 1 [0029.231] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="weirdhydrocodonephrase.exe")) returned 1 [0029.232] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hall.exe")) returned 1 [0029.232] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditioning.exe")) returned 1 [0029.233] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough film passive.exe")) returned 1 [0029.233] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guinea.exe")) returned 1 [0029.234] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="staff-warren-booking.exe")) returned 1 [0029.234] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue investing say.exe")) returned 1 [0029.235] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alerts-nhl.exe")) returned 1 [0029.238] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="countersprotest.exe")) returned 1 [0029.238] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ja_albania.exe")) returned 1 [0029.239] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0029.240] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0029.240] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0029.241] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0029.241] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0029.242] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="32.EXE.exe")) returned 1 [0029.242] Process32NextW (in: hSnapshot=0xc8, lppe=0x16f348 | out: lppe=0x16f348*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="32.EXE.exe")) returned 0 [0029.243] CloseHandle (hObject=0xc8) returned 1 [0029.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27b478 [0029.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x277820 [0029.243] CryptAcquireContextA (in: phProv=0x16f4f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x16f4f4*=0x279f80) returned 1 [0029.470] RtlWakeAllConditionVariable () returned 0x0 [0029.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x4) returned 0x27cfa8 [0029.471] CryptAcquireContextA (in: phProv=0x27cfa8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x27cfa8*=0x27e5b8) returned 1 [0029.471] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x277820 | out: pbBuffer=0x277820) returned 1 [0029.471] CryptReleaseContext (hProv=0x279f80, dwFlags=0x0) returned 1 [0029.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277820 | out: hHeap=0x260000) returned 1 [0029.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x27f7c8 [0029.471] QueryPerformanceCounter (in: lpPerformanceCount=0x16f484 | out: lpPerformanceCount=0x16f484*=14947259451) returned 1 [0029.472] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.472] GetLastError () returned 0x57 [0029.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f4c4 | out: lpSystemTimeAsFileTime=0x16f4c4*(dwLowDateTime=0xa231dd10, dwHighDateTime=0x1d585b4)) [0029.472] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.472] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.472] CryptAcquireContextW (in: phProv=0x16f368, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x16f368*=0x279f80) returned 1 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.473] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.474] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.475] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.476] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.477] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.478] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.479] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] lstrlenA (lpString="0602000000a4000052534131000800000100010069abfd1a358746c07312e7421c25bc53f54716c52d41fbe9772ff5111e8ae38dcc91a62d9e653fe55521f08782549128c5194fb63221145ae75e507b9862c15710363e22a83247e2d2422d47de080636a6c98481fdaed04c34b67c7c904432470537140e73e20339880fdd0a54ebb8142d2df6753a93f0af649c173f78b944f4070ddebb1c4ced64e668a0c3fcdffeb3f3abc9b1fff9149f06d8de703a41b7089d8a4c24f0449d31a41f31f3dd6ebb15b5e4f0a16705927dd46b112eb43ce2bf9d68c6b3b85defdd54838e81bb4b8f3b79237c7c3115e5ca1a62a8bfa6424ce021297fa17fb941871fae36a7e0a30613c8319ca09f2a5642790e8081bfac8fa2") returned 552 [0029.480] CryptImportKey (in: hProv=0x279f80, pbData=0x18f628, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x16f61c | out: phKey=0x16f61c*=0x27e7e0) returned 1 [0029.481] CryptEncrypt (in: hKey=0x27e7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18fe28*, pdwDataLen=0x16f620*=0x20, dwBufLen=0x100 | out: pbData=0x18fe28*, pdwDataLen=0x16f620*=0x100) returned 1 [0029.482] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.482] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="", lpString2="af" | out: lpString1="af") returned="af" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af", lpString2="1b" | out: lpString1="af1b") returned="af1b" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1b", lpString2="b1" | out: lpString1="af1bb1") returned="af1bb1" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1bb1", lpString2="d6" | out: lpString1="af1bb1d6") returned="af1bb1d6" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1bb1d6", lpString2="b4" | out: lpString1="af1bb1d6b4") returned="af1bb1d6b4" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1bb1d6b4", lpString2="94" | out: lpString1="af1bb1d6b494") returned="af1bb1d6b494" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1bb1d6b494", lpString2="08" | out: lpString1="af1bb1d6b49408") returned="af1bb1d6b49408" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1bb1d6b49408", lpString2="03" | out: lpString1="af1bb1d6b4940803") returned="af1bb1d6b4940803" [0029.483] GetLastError () returned 0x0 [0029.483] SetLastError (dwErrCode=0x0) [0029.483] lstrcatA (in: lpString1="af1bb1d6b4940803", lpString2="cf" | out: lpString1="af1bb1d6b4940803cf") returned="af1bb1d6b4940803cf" [0029.484] GetLastError () returned 0x0 [0029.484] SetLastError (dwErrCode=0x0) [0029.484] lstrcatA (in: lpString1="af1bb1d6b4940803cf", lpString2="a2" | out: lpString1="af1bb1d6b4940803cfa2") returned="af1bb1d6b4940803cfa2" [0029.484] GetLastError () returned 0x0 [0029.484] SetLastError (dwErrCode=0x0) [0029.484] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2", lpString2="b4" | out: lpString1="af1bb1d6b4940803cfa2b4") returned="af1bb1d6b4940803cfa2b4" [0029.484] GetLastError () returned 0x0 [0029.484] SetLastError (dwErrCode=0x0) [0029.484] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4", lpString2="a3" | out: lpString1="af1bb1d6b4940803cfa2b4a3") returned="af1bb1d6b4940803cfa2b4a3" [0029.484] GetLastError () returned 0x0 [0029.484] SetLastError (dwErrCode=0x0) [0029.484] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a3", lpString2="48" | out: lpString1="af1bb1d6b4940803cfa2b4a348") returned="af1bb1d6b4940803cfa2b4a348" [0029.484] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a348", lpString2="04" | out: lpString1="af1bb1d6b4940803cfa2b4a34804") returned="af1bb1d6b4940803cfa2b4a34804" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804", lpString2="bb" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb") returned="af1bb1d6b4940803cfa2b4a34804bb" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb", lpString2="65" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65") returned="af1bb1d6b4940803cfa2b4a34804bb65" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65", lpString2="dd" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd") returned="af1bb1d6b4940803cfa2b4a34804bb65dd" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd", lpString2="55" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd55") returned="af1bb1d6b4940803cfa2b4a34804bb65dd55" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd55", lpString2="1d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551d" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551d", lpString2="d1" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd1") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd1" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd1", lpString2="0e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e" [0029.485] GetLastError () returned 0x0 [0029.485] SetLastError (dwErrCode=0x0) [0029.485] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e", lpString2="1f" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1f") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1f" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1f", lpString2="c2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2", lpString2="58" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc258") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc258" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc258", lpString2="7d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d", lpString2="45" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d45") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d45" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d45", lpString2="20" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520", lpString2="c9" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9", lpString2="73" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c973") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c973" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c973", lpString2="4a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734a" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.486] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734a", lpString2="f6" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6" [0029.486] GetLastError () returned 0x0 [0029.486] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6", lpString2="92" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af692") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af692" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af692", lpString2="8f" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f", lpString2="8c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c", lpString2="21" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c21") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c21" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c21", lpString2="1e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211e" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211e", lpString2="dd" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd", lpString2="02" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02", lpString2="f2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2", lpString2="b8" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b8") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b8" [0029.487] GetLastError () returned 0x0 [0029.487] SetLastError (dwErrCode=0x0) [0029.487] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b8", lpString2="2e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e" [0029.487] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e", lpString2="88" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88", lpString2="d5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5", lpString2="87" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d587") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d587" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d587", lpString2="12" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d58712") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d58712" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d58712", lpString2="41" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241", lpString2="dd" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd", lpString2="62" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62", lpString2="c9" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9", lpString2="39" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c939") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c939" [0029.488] GetLastError () returned 0x0 [0029.488] SetLastError (dwErrCode=0x0) [0029.488] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c939", lpString2="4b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b", lpString2="1a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a", lpString2="3a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3a" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3a", lpString2="bf" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf", lpString2="89" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf89") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf89" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf89", lpString2="50" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950", lpString2="ca" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca", lpString2="6f" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6f") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6f" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6f", lpString2="f0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0" [0029.489] GetLastError () returned 0x0 [0029.489] SetLastError (dwErrCode=0x0) [0029.489] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0", lpString2="ff" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff" [0029.489] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff", lpString2="89" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89", lpString2="e3" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e3") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e3" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e3", lpString2="28" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328", lpString2="b6" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b6") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b6" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b6", lpString2="30" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630", lpString2="ae" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630ae") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630ae" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630ae", lpString2="c0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0", lpString2="a6" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a6") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a6" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a6", lpString2="1a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a" [0029.490] GetLastError () returned 0x0 [0029.490] SetLastError (dwErrCode=0x0) [0029.490] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a", lpString2="67" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67", lpString2="e5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e5" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e5", lpString2="60" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e560") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e560" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e560", lpString2="10" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010", lpString2="b4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4", lpString2="b4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b4" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b4", lpString2="6b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46b" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46b", lpString2="bd" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd", lpString2="7f" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7f") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7f" [0029.491] GetLastError () returned 0x0 [0029.491] SetLastError (dwErrCode=0x0) [0029.491] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7f", lpString2="a7" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa7") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa7" [0029.491] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa7", lpString2="81" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781", lpString2="81" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa78181") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa78181" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa78181", lpString2="4d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d", lpString2="9d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d", lpString2="35" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d35") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d35" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d35", lpString2="0d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d", lpString2="6b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b", lpString2="45" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b45") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b45" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.492] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b45", lpString2="7d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457d" [0029.492] GetLastError () returned 0x0 [0029.492] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457d", lpString2="e1" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1", lpString2="c4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4", lpString2="cb" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb", lpString2="41" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41", lpString2="00" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb4100") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb4100" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb4100", lpString2="30" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb410030") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb410030" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb410030", lpString2="40" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040", lpString2="f8" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8", lpString2="b0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0" [0029.493] GetLastError () returned 0x0 [0029.493] SetLastError (dwErrCode=0x0) [0029.493] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0", lpString2="92" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b092") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b092" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b092", lpString2="0c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c", lpString2="41" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c41") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c41" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c41", lpString2="6a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416a" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416a", lpString2="a3" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3", lpString2="c4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4", lpString2="eb" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb", lpString2="88" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88", lpString2="ce" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce" [0029.494] GetLastError () returned 0x0 [0029.494] SetLastError (dwErrCode=0x0) [0029.494] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce", lpString2="01" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce01") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce01" [0029.494] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce01", lpString2="44" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144", lpString2="b9" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9", lpString2="d0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0", lpString2="31" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d031") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d031" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d031", lpString2="1c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311c" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311c", lpString2="b6" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6", lpString2="e1" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1", lpString2="e7" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.495] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7", lpString2="c8" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8" [0029.495] GetLastError () returned 0x0 [0029.495] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8", lpString2="a5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a5" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a5", lpString2="8a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a", lpString2="54" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54", lpString2="e7" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e7") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e7" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e7", lpString2="9d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d", lpString2="03" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03", lpString2="09" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d0309") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d0309" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d0309", lpString2="1a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a", lpString2="76" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76" [0029.496] GetLastError () returned 0x0 [0029.496] SetLastError (dwErrCode=0x0) [0029.496] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76", lpString2="c2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2", lpString2="f2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2", lpString2="f4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f4" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f4", lpString2="08" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f408") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f408" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f408", lpString2="17" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817", lpString2="e2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e2" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e2", lpString2="6b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b", lpString2="28" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b28") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b28" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b28", lpString2="9d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289d" [0029.497] GetLastError () returned 0x0 [0029.497] SetLastError (dwErrCode=0x0) [0029.497] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289d", lpString2="fa" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa" [0029.497] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa", lpString2="27" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa27") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa27" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa27", lpString2="13" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713", lpString2="ab" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab", lpString2="3d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d", lpString2="0c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c", lpString2="85" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85", lpString2="e0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e0" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e0", lpString2="60" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.498] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060", lpString2="e8" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8" [0029.498] GetLastError () returned 0x0 [0029.498] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8", lpString2="00" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e800") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e800" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e800", lpString2="9e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009e" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009e", lpString2="b9" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb9") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb9" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb9", lpString2="4c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94c" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94c", lpString2="e1" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce1") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce1" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce1", lpString2="9b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19b" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19b", lpString2="cc" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc", lpString2="94" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94" [0029.499] GetLastError () returned 0x0 [0029.499] SetLastError (dwErrCode=0x0) [0029.499] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94", lpString2="e1" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1" [0029.499] GetLastError () returned 0x0 [0029.503] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1", lpString2="d8" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d8") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d8" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d8", lpString2="58" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d858") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d858" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d858", lpString2="70" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870", lpString2="c2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2", lpString2="53" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c253") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c253" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c253", lpString2="6b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b", lpString2="7c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c" [0029.504] GetLastError () returned 0x0 [0029.504] SetLastError (dwErrCode=0x0) [0029.504] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c", lpString2="35" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c35") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c35" [0029.504] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c35", lpString2="5b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b", lpString2="5a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a", lpString2="04" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04", lpString2="15" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a0415") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a0415" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a0415", lpString2="4c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c", lpString2="28" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c28") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c28" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c28", lpString2="3b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283b" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283b", lpString2="ae" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae" [0029.505] GetLastError () returned 0x0 [0029.505] SetLastError (dwErrCode=0x0) [0029.505] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae", lpString2="8e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8e" [0029.505] GetLastError () returned 0x0 [0029.506] SetLastError (dwErrCode=0x0) [0029.507] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8e", lpString2="c9" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec9") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec9" [0029.508] GetLastError () returned 0x0 [0029.508] SetLastError (dwErrCode=0x0) [0029.508] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec9", lpString2="8b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98b" [0029.508] GetLastError () returned 0x0 [0029.508] SetLastError (dwErrCode=0x0) [0029.508] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98b", lpString2="a3" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3" [0029.508] GetLastError () returned 0x0 [0029.508] SetLastError (dwErrCode=0x0) [0029.508] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3", lpString2="a3" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a3") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a3" [0029.508] GetLastError () returned 0x0 [0029.508] SetLastError (dwErrCode=0x0) [0029.508] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a3", lpString2="9a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39a" [0029.508] GetLastError () returned 0x0 [0029.508] SetLastError (dwErrCode=0x0) [0029.508] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39a", lpString2="c5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac5" [0029.508] GetLastError () returned 0x0 [0029.508] SetLastError (dwErrCode=0x0) [0029.508] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac5", lpString2="51" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551" [0029.508] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551", lpString2="d5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5", lpString2="b3" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3", lpString2="41" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b341") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b341" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b341", lpString2="0a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a", lpString2="92" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92", lpString2="c5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c5" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c5", lpString2="9b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59b" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59b", lpString2="ef" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef" [0029.509] GetLastError () returned 0x0 [0029.509] SetLastError (dwErrCode=0x0) [0029.509] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef", lpString2="55" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef55") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef55" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef55", lpString2="4e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e", lpString2="67" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67", lpString2="cb" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cb") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cb" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cb", lpString2="c6" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6", lpString2="e3" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e3") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e3" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e3", lpString2="66" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366", lpString2="fe" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe", lpString2="5d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5d" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.510] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5d", lpString2="b7" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db7") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db7" [0029.510] GetLastError () returned 0x0 [0029.510] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db7", lpString2="9e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79e" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79e", lpString2="de" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede", lpString2="52" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede52") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede52" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede52", lpString2="9a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a", lpString2="27" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a27") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a27" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a27", lpString2="10" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710", lpString2="e4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e4" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e4", lpString2="98" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e498") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e498" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e498", lpString2="54" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854" [0029.511] GetLastError () returned 0x0 [0029.511] SetLastError (dwErrCode=0x0) [0029.511] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854", lpString2="15" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e4985415") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e4985415" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e4985415", lpString2="3c" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c", lpString2="5d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5d" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5d", lpString2="ef" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def", lpString2="5e" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e", lpString2="80" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e80") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e80" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e80", lpString2="9a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a", lpString2="4d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4d" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4d", lpString2="d4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd4" [0029.512] GetLastError () returned 0x0 [0029.512] SetLastError (dwErrCode=0x0) [0029.512] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd4", lpString2="7d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d" [0029.512] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d", lpString2="7d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d", lpString2="1b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b", lpString2="8d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d", lpString2="81" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81", lpString2="fc" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc", lpString2="86" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86", lpString2="e2" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2", lpString2="ce" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2ce") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2ce" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.513] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2ce", lpString2="e5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5" [0029.513] GetLastError () returned 0x0 [0029.513] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5", lpString2="e5" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5", lpString2="f0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f0" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f0", lpString2="2d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02d" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02d", lpString2="ad" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad", lpString2="92" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92", lpString2="91" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad9291") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad9291" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad9291", lpString2="9d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919d" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919d", lpString2="f7" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df7") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df7" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df7", lpString2="2d" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d" [0029.514] GetLastError () returned 0x0 [0029.514] SetLastError (dwErrCode=0x0) [0029.514] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d", lpString2="8a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a" [0029.514] GetLastError () returned 0x0 [0029.515] SetLastError (dwErrCode=0x0) [0029.515] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a", lpString2="94" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94" [0029.515] GetLastError () returned 0x0 [0029.515] SetLastError (dwErrCode=0x0) [0029.515] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94", lpString2="a0" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0" [0029.515] GetLastError () returned 0x0 [0029.515] SetLastError (dwErrCode=0x0) [0029.515] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0", lpString2="cf" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf" [0029.515] GetLastError () returned 0x0 [0029.515] SetLastError (dwErrCode=0x0) [0029.515] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf", lpString2="96" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96" [0029.515] GetLastError () returned 0x0 [0029.515] SetLastError (dwErrCode=0x0) [0029.515] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96", lpString2="46" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf9646") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf9646" [0029.515] GetLastError () returned 0x0 [0029.515] SetLastError (dwErrCode=0x0) [0029.515] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf9646", lpString2="19" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf964619") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf964619" [0029.515] GetLastError () returned 0x0 [0029.516] SetLastError (dwErrCode=0x0) [0029.516] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf964619", lpString2="81" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981" [0029.516] GetLastError () returned 0x0 [0029.516] SetLastError (dwErrCode=0x0) [0029.516] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981", lpString2="d4" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d4") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d4" [0029.516] GetLastError () returned 0x0 [0029.516] SetLastError (dwErrCode=0x0) [0029.516] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d4", lpString2="3a" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a" [0029.516] GetLastError () returned 0x0 [0029.516] SetLastError (dwErrCode=0x0) [0029.516] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a", lpString2="66" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66" [0029.516] GetLastError () returned 0x0 [0029.516] SetLastError (dwErrCode=0x0) [0029.516] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66", lpString2="ff" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ff") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ff" [0029.517] GetLastError () returned 0x0 [0029.517] SetLastError (dwErrCode=0x0) [0029.517] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ff", lpString2="b6" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb6") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb6" [0029.517] GetLastError () returned 0x0 [0029.517] SetLastError (dwErrCode=0x0) [0029.517] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb6", lpString2="08" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608" [0029.517] GetLastError () returned 0x0 [0029.517] SetLastError (dwErrCode=0x0) [0029.517] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608", lpString2="c1" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c1") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c1" [0029.517] GetLastError () returned 0x0 [0029.517] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c1", lpString2="8b" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b" [0029.517] GetLastError () returned 0x0 [0029.517] lstrcatA (in: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b", lpString2="2f" | out: lpString1="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f") returned="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f" [0029.517] CryptDestroyKey (hKey=0x27e7e0) returned 1 [0029.517] CryptReleaseContext (hProv=0x279f80, dwFlags=0x0) returned 1 [0029.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x279f80 [0029.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc8 [0029.521] lstrcpyW (in: lpString1=0x16e548, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.521] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.521] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.521] WriteFile (in: hFile=0xc8, lpBuffer=0x16e548*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x16e544, lpOverlapped=0x0 | out: lpBuffer=0x16e548*, lpNumberOfBytesWritten=0x16e544*=0x7fe, lpOverlapped=0x0) returned 1 [0029.523] CloseHandle (hObject=0xc8) returned 1 [0029.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279f80 | out: hHeap=0x260000) returned 1 [0029.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27e7e0 [0029.525] GetNativeSystemInfo (in: lpSystemInfo=0x16f480 | out: lpSystemInfo=0x16f480*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0029.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e580 [0029.525] RtlInitializeConditionVariable () returned 0x27e800 [0029.525] RtlInitializeConditionVariable () returned 0x27e828 [0029.525] RtlInitializeConditionVariable () returned 0x27e854 [0029.525] RtlInitializeConditionVariable () returned 0x27e884 [0029.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x4) returned 0x27a160 [0029.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x279d58 [0029.525] RtlInitializeConditionVariable () returned 0x279d5c [0029.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27b620 [0029.525] RtlInitializeConditionVariable () returned 0x27b628 [0029.525] GetCurrentThreadId () returned 0x980 [0029.525] GetCurrentThreadId () returned 0x980 [0029.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x14) returned 0x279148 [0029.525] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x403080, phModule=0x279154 | out: phModule=0x279154*=0x400000) returned 1 [0029.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x437c72, lpParameter=0x279148, dwCreationFlags=0x0, lpThreadId=0x16f3ac | out: lpThreadId=0x16f3ac*=0x98c) returned 0xc8 [0029.526] SleepConditionVariableSRW (in: ConditionVariable=0x279d5c, SRWLock=0x27b628, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x279d5c, SRWLock=0x27b628) returned 1 [0029.538] GetCurrentThreadId () returned 0x980 [0029.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b620 | out: hHeap=0x260000) returned 1 [0029.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279d58 | out: hHeap=0x260000) returned 1 [0029.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x276070 [0029.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x4) returned 0x27bf70 [0029.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x279d58 [0029.538] RtlInitializeConditionVariable () returned 0x279d5c [0029.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27b620 [0029.538] RtlInitializeConditionVariable () returned 0x27b628 [0029.538] GetCurrentThreadId () returned 0x980 [0029.538] GetCurrentThreadId () returned 0x980 [0029.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x14) returned 0x2791e8 [0029.538] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x403080, phModule=0x2791f4 | out: phModule=0x2791f4*=0x400000) returned 1 [0029.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x437c72, lpParameter=0x2791e8, dwCreationFlags=0x0, lpThreadId=0x16f3ac | out: lpThreadId=0x16f3ac*=0x998) returned 0xdc [0029.539] SleepConditionVariableSRW (in: ConditionVariable=0x279d5c, SRWLock=0x27b628, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x279d5c, SRWLock=0x27b628) returned 1 [0029.678] GetCurrentThreadId () returned 0x980 [0029.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b620 | out: hHeap=0x260000) returned 1 [0029.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279d58 | out: hHeap=0x260000) returned 1 [0029.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x27e1e0 [0029.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x276070 | out: hHeap=0x260000) returned 1 [0029.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x4) returned 0x276070 [0029.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x279d58 [0029.678] RtlInitializeConditionVariable () returned 0x279d5c [0029.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27b620 [0029.678] RtlInitializeConditionVariable () returned 0x27b628 [0029.678] GetCurrentThreadId () returned 0x980 [0029.678] GetCurrentThreadId () returned 0x980 [0029.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x14) returned 0x279228 [0029.679] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x403080, phModule=0x279234 | out: phModule=0x279234*=0x400000) returned 1 [0029.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x437c72, lpParameter=0x279228, dwCreationFlags=0x0, lpThreadId=0x16f3ac | out: lpThreadId=0x16f3ac*=0x99c) returned 0xcc [0029.680] SleepConditionVariableSRW (in: ConditionVariable=0x279d5c, SRWLock=0x27b628, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x279d5c, SRWLock=0x27b628) returned 1 [0029.713] GetCurrentThreadId () returned 0x980 [0029.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b620 | out: hHeap=0x260000) returned 1 [0029.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279d58 | out: hHeap=0x260000) returned 1 [0029.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x18) returned 0x279268 [0029.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1e0 | out: hHeap=0x260000) returned 1 [0029.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x4) returned 0x2809f8 [0029.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x279d58 [0029.713] RtlInitializeConditionVariable () returned 0x279d5c [0029.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27b620 [0029.713] RtlInitializeConditionVariable () returned 0x27b628 [0029.713] GetCurrentThreadId () returned 0x980 [0029.713] GetCurrentThreadId () returned 0x980 [0029.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x14) returned 0x279288 [0029.714] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x403080, phModule=0x279294 | out: phModule=0x279294*=0x400000) returned 1 [0029.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x437c72, lpParameter=0x279288, dwCreationFlags=0x0, lpThreadId=0x16f3ac | out: lpThreadId=0x16f3ac*=0x9ac) returned 0xd4 [0029.715] SleepConditionVariableSRW (in: ConditionVariable=0x279d5c, SRWLock=0x27b628, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x279d5c, SRWLock=0x27b628) returned 1 [0029.738] GetCurrentThreadId () returned 0x980 [0029.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b620 | out: hHeap=0x260000) returned 1 [0029.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279d58 | out: hHeap=0x260000) returned 1 [0029.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x277820 [0029.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279268 | out: hHeap=0x260000) returned 1 [0029.738] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft SQL Server") returned 43 [0029.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27ba70 [0029.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files (x86)\\Microsoft SQL Server", lpSrch="AppData") returned 0x0 [0029.738] lstrcmpiW (lpString1="C:\\Program Files (x86)\\Microsoft SQL Server", lpString2="C:\\Windows") returned -1 [0029.738] lstrlenW (lpString="C:\\Windows") returned 10 [0029.738] lstrcmpiW (lpString1="C:\\Program Files (x86)\\Microsoft SQL Server", lpString2="C:\\System Volume Information") returned -1 [0029.738] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281150 [0029.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft SQL Server\\*", lpFindFileData=0x16f248 | out: lpFindFileData=0x16f248*(dwFileAttributes=0xd, ftCreationTime.dwLowDateTime=0x27ba68, ftCreationTime.dwHighDateTime=0x260000, ftLastAccessTime.dwLowDateTime=0x27baf8, ftLastAccessTime.dwHighDateTime=0x260000, ftLastWriteTime.dwLowDateTime=0x260000, ftLastWriteTime.dwHighDateTime=0x30, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x16f358, dwReserved1=0xd, cFileName="", cAlternateFileName="\x16聹@며'며'\x16\x16淵@䩮?\x16쿆E￿￿\x16圗@며'䮾?")) returned 0xffffffff [0029.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281150 | out: hHeap=0x260000) returned 1 [0029.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ba70 | out: hHeap=0x260000) returned 1 [0029.740] lstrlenW (lpString="C:\\Program Files\\Microsoft SQL Server") returned 37 [0029.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27ba70 [0029.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x76) returned 0x2711d0 [0029.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ba70 | out: hHeap=0x260000) returned 1 [0029.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft SQL Server", lpSrch="AppData") returned 0x0 [0029.740] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft SQL Server", lpString2="C:\\Windows") returned -1 [0029.740] lstrlenW (lpString="C:\\Windows") returned 10 [0029.740] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft SQL Server", lpString2="C:\\System Volume Information") returned -1 [0029.740] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281150 [0029.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server\\*", lpFindFileData=0x16f248 | out: lpFindFileData=0x16f248*(dwFileAttributes=0xb, ftCreationTime.dwLowDateTime=0x27ba68, ftCreationTime.dwHighDateTime=0x260000, ftLastAccessTime.dwLowDateTime=0x27baf8, ftLastAccessTime.dwHighDateTime=0x260000, ftLastWriteTime.dwLowDateTime=0x27ba68, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x7000007, nFileSizeLow=0x7, dwReserved0=0x27bac8, dwReserved1=0x27b620, cFileName="ꅰ'8", cAlternateFileName="\x16聹@ᇐ'ᇐ'\x16\x16淵@䩮?\x16쿆E￿￿\x16圗@ᇐ'䮾?")) returned 0xffffffff [0029.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281150 | out: hHeap=0x260000) returned 1 [0029.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2711d0 | out: hHeap=0x260000) returned 1 [0029.740] lstrlenW (lpString="C:\\Program Files(x86)\\Intuit") returned 28 [0029.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0029.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x5e) returned 0x27ba70 [0029.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0029.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files(x86)\\Intuit", lpSrch="AppData") returned 0x0 [0029.740] lstrcmpiW (lpString1="C:\\Program Files(x86)\\Intuit", lpString2="C:\\Windows") returned -1 [0029.740] lstrlenW (lpString="C:\\Windows") returned 10 [0029.741] lstrcmpiW (lpString1="C:\\Program Files(x86)\\Intuit", lpString2="C:\\System Volume Information") returned -1 [0029.741] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281150 [0029.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files(x86)\\Intuit\\*", lpFindFileData=0x16f248 | out: lpFindFileData=0x16f248*(dwFileAttributes=0x16f334, ftCreationTime.dwLowDateTime=0xd, ftCreationTime.dwHighDateTime=0x260000, ftLastAccessTime.dwLowDateTime=0x27ba68, ftLastAccessTime.dwHighDateTime=0x16f334, ftLastWriteTime.dwLowDateTime=0x77163c74, ftLastWriteTime.dwHighDateTime=0x77163ca3, nFileSizeHigh=0x7734ac05, nFileSizeLow=0x0, dwReserved0=0x2601ec, dwReserved1=0x260000, cFileName="Ő&8", cAlternateFileName="\x16聹@며'며'\x16\x16淵@䩮?\x16쿆E￿￿\x16圗@며'䮾?")) returned 0xffffffff [0029.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281150 | out: hHeap=0x260000) returned 1 [0029.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ba70 | out: hHeap=0x260000) returned 1 [0029.741] lstrlenW (lpString="C:\\Program Files(x86)\\MYOB") returned 26 [0029.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0029.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files(x86)\\MYOB", lpSrch="AppData") returned 0x0 [0029.741] lstrcmpiW (lpString1="C:\\Program Files(x86)\\MYOB", lpString2="C:\\Windows") returned -1 [0029.741] lstrlenW (lpString="C:\\Windows") returned 10 [0029.741] lstrcmpiW (lpString1="C:\\Program Files(x86)\\MYOB", lpString2="C:\\System Volume Information") returned -1 [0029.741] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281150 [0029.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files(x86)\\MYOB\\*", lpFindFileData=0x16f248 | out: lpFindFileData=0x16f248*(dwFileAttributes=0x16f334, ftCreationTime.dwLowDateTime=0xd, ftCreationTime.dwHighDateTime=0x260000, ftLastAccessTime.dwLowDateTime=0x27ba68, ftLastAccessTime.dwHighDateTime=0x16f334, ftLastWriteTime.dwLowDateTime=0x77163c74, ftLastWriteTime.dwHighDateTime=0x77163ca3, nFileSizeHigh=0x7734ac05, nFileSizeLow=0x0, dwReserved0=0x2601ec, dwReserved1=0x260000, cFileName="Ő&8", cAlternateFileName="\x16聹@緘'緘'\x16\x16淵@䩮?\x16쿆E￿￿\x16圗@緘'䮾?")) returned 0xffffffff [0029.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281150 | out: hHeap=0x260000) returned 1 [0029.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0029.741] lstrlenW (lpString="C:\\Windows\\WID") returned 14 [0029.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x2777d0 [0029.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27b620 [0029.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0029.741] StrStrW (lpFirst="\\\\?\\C:\\Windows\\WID", lpSrch="AppData") returned 0x0 [0029.742] lstrcmpiW (lpString1="C:\\Windows\\WID", lpString2="C:\\Windows") returned 1 [0029.742] lstrlenW (lpString="C:\\Windows") returned 10 [0029.742] lstrcmpiW (lpString1="C:\\Windows\\WID", lpString2="C:\\System Volume Information") returned 1 [0029.742] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281150 [0029.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\WID\\*", lpFindFileData=0x16f248 | out: lpFindFileData=0x16f248*(dwFileAttributes=0x16f334, ftCreationTime.dwLowDateTime=0x7, ftCreationTime.dwHighDateTime=0x260000, ftLastAccessTime.dwLowDateTime=0x27b618, ftLastAccessTime.dwHighDateTime=0x16f334, ftLastWriteTime.dwLowDateTime=0x77163c74, ftLastWriteTime.dwHighDateTime=0x77163ca3, nFileSizeHigh=0x7734ac05, nFileSizeLow=0x0, dwReserved0=0x2601bc, dwReserved1=0x260000, cFileName="Ő&8", cAlternateFileName="\x16聹@똠'똠'\x16\x16淵@䩮?\x16쿆E￿￿\x16圗@똠'䮾?")) returned 0xffffffff [0029.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281150 | out: hHeap=0x260000) returned 1 [0029.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b620 | out: hHeap=0x260000) returned 1 [0029.742] lstrlenW (lpString="WID") returned 3 [0029.742] StrStrW (lpFirst="\\\\?\\WID", lpSrch="AppData") returned 0x0 [0029.742] lstrcmpiW (lpString1="WID", lpString2="C:\\Windows") returned 1 [0029.742] lstrlenW (lpString="C:\\Windows") returned 10 [0029.742] lstrcmpiW (lpString1="WID", lpString2="C:\\System Volume Information") returned 1 [0029.742] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281150 [0029.742] FindFirstFileW (in: lpFileName="\\\\?\\WID\\*", lpFindFileData=0x16f248 | out: lpFindFileData=0x16f248*(dwFileAttributes=0x16f334, ftCreationTime.dwLowDateTime=0x7, ftCreationTime.dwHighDateTime=0x260000, ftLastAccessTime.dwLowDateTime=0x27b618, ftLastAccessTime.dwHighDateTime=0x16f334, ftLastWriteTime.dwLowDateTime=0x77163c74, ftLastWriteTime.dwHighDateTime=0x77163ca3, nFileSizeHigh=0x7734ac05, nFileSizeLow=0x0, dwReserved0=0x2601bc, dwReserved1=0x260000, cFileName="Ő&8", cAlternateFileName="")) returned 0xffffffff [0029.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281150 | out: hHeap=0x260000) returned 1 [0029.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x27e1e0 [0029.742] GetLogicalDrives () returned 0x4 [0029.742] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.743] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x208) returned 0x281150 [0029.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4051b0, lpParameter=0x281150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8 [0029.744] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.744] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.745] WaitForMultipleObjects (nCount=0x1, lpHandles=0x27e1e0*=0xd8, bWaitAll=1, dwMilliseconds=0xffffffff) [0075.808] CloseHandle (hObject=0xd8) returned 1 [0075.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1e0 | out: hHeap=0x260000) returned 1 [0075.808] GetCurrentThreadId () returned 0x980 [0075.808] GetCurrentThreadId () returned 0x980 [0075.808] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.856] GetCurrentThreadId () returned 0x980 [0075.857] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.869] GetCurrentThreadId () returned 0x980 [0075.869] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.875] GetCurrentThreadId () returned 0x980 [0075.875] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.880] GetCurrentThreadId () returned 0x980 [0075.880] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.895] GetCurrentThreadId () returned 0x980 [0075.895] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.896] GetCurrentThreadId () returned 0x980 [0075.896] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.902] GetCurrentThreadId () returned 0x980 [0075.902] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.934] GetCurrentThreadId () returned 0x980 [0075.934] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.950] GetCurrentThreadId () returned 0x980 [0075.950] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.982] GetCurrentThreadId () returned 0x980 [0075.982] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0075.992] GetCurrentThreadId () returned 0x980 [0075.992] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.008] GetCurrentThreadId () returned 0x980 [0076.008] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.010] GetCurrentThreadId () returned 0x980 [0076.010] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.013] GetCurrentThreadId () returned 0x980 [0076.013] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.021] GetCurrentThreadId () returned 0x980 [0076.021] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.054] GetCurrentThreadId () returned 0x980 [0076.055] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.062] GetCurrentThreadId () returned 0x980 [0076.062] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.071] GetCurrentThreadId () returned 0x980 [0076.071] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.077] GetCurrentThreadId () returned 0x980 [0076.077] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.094] GetCurrentThreadId () returned 0x980 [0076.094] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.103] GetCurrentThreadId () returned 0x980 [0076.103] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.112] GetCurrentThreadId () returned 0x980 [0076.113] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.121] GetCurrentThreadId () returned 0x980 [0076.121] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.134] GetCurrentThreadId () returned 0x980 [0076.134] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.142] GetCurrentThreadId () returned 0x980 [0076.143] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.147] GetCurrentThreadId () returned 0x980 [0076.147] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.165] GetCurrentThreadId () returned 0x980 [0076.165] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.181] GetCurrentThreadId () returned 0x980 [0076.181] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.190] GetCurrentThreadId () returned 0x980 [0076.190] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.203] GetCurrentThreadId () returned 0x980 [0076.203] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.212] GetCurrentThreadId () returned 0x980 [0076.212] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.220] GetCurrentThreadId () returned 0x980 [0076.220] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.225] GetCurrentThreadId () returned 0x980 [0076.225] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.226] GetCurrentThreadId () returned 0x980 [0076.226] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.241] GetCurrentThreadId () returned 0x980 [0076.241] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.250] GetCurrentThreadId () returned 0x980 [0076.250] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.256] GetCurrentThreadId () returned 0x980 [0076.256] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.268] GetCurrentThreadId () returned 0x980 [0076.268] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.270] GetCurrentThreadId () returned 0x980 [0076.270] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.283] GetCurrentThreadId () returned 0x980 [0076.283] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.288] GetCurrentThreadId () returned 0x980 [0076.288] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.300] GetCurrentThreadId () returned 0x980 [0076.300] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.313] GetCurrentThreadId () returned 0x980 [0076.314] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.322] GetCurrentThreadId () returned 0x980 [0076.322] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.332] GetCurrentThreadId () returned 0x980 [0076.332] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.355] GetCurrentThreadId () returned 0x980 [0076.355] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.363] GetCurrentThreadId () returned 0x980 [0076.363] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.368] GetCurrentThreadId () returned 0x980 [0076.368] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.429] GetCurrentThreadId () returned 0x980 [0076.429] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.438] GetCurrentThreadId () returned 0x980 [0076.438] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.447] GetCurrentThreadId () returned 0x980 [0076.447] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.456] GetCurrentThreadId () returned 0x980 [0076.456] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.456] GetCurrentThreadId () returned 0x980 [0076.456] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.469] GetCurrentThreadId () returned 0x980 [0076.469] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.478] GetCurrentThreadId () returned 0x980 [0076.478] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.484] GetCurrentThreadId () returned 0x980 [0076.484] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.499] GetCurrentThreadId () returned 0x980 [0076.499] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.512] GetCurrentThreadId () returned 0x980 [0076.512] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.521] GetCurrentThreadId () returned 0x980 [0076.521] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.527] GetCurrentThreadId () returned 0x980 [0076.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.527] GetCurrentThreadId () returned 0x980 [0076.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.543] GetCurrentThreadId () returned 0x980 [0076.544] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.555] GetCurrentThreadId () returned 0x980 [0076.555] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.561] GetCurrentThreadId () returned 0x980 [0076.562] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.636] GetCurrentThreadId () returned 0x980 [0076.637] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.647] GetCurrentThreadId () returned 0x980 [0076.647] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.657] GetCurrentThreadId () returned 0x980 [0076.657] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.662] GetCurrentThreadId () returned 0x980 [0076.662] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.685] GetCurrentThreadId () returned 0x980 [0076.685] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.694] GetCurrentThreadId () returned 0x980 [0076.695] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.705] GetCurrentThreadId () returned 0x980 [0076.705] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.719] GetCurrentThreadId () returned 0x980 [0076.719] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.735] GetCurrentThreadId () returned 0x980 [0076.735] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.745] GetCurrentThreadId () returned 0x980 [0076.745] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.757] GetCurrentThreadId () returned 0x980 [0076.757] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.774] GetCurrentThreadId () returned 0x980 [0076.774] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.794] GetCurrentThreadId () returned 0x980 [0076.794] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.796] GetCurrentThreadId () returned 0x980 [0076.796] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.815] GetCurrentThreadId () returned 0x980 [0076.815] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.834] GetCurrentThreadId () returned 0x980 [0076.834] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.854] GetCurrentThreadId () returned 0x980 [0076.854] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.861] GetCurrentThreadId () returned 0x980 [0076.861] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.912] GetCurrentThreadId () returned 0x980 [0076.912] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.917] GetCurrentThreadId () returned 0x980 [0076.917] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0076.938] GetCurrentThreadId () returned 0x980 [0076.938] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.046] GetCurrentThreadId () returned 0x980 [0077.046] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.058] GetCurrentThreadId () returned 0x980 [0077.058] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.071] GetCurrentThreadId () returned 0x980 [0077.071] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.072] GetCurrentThreadId () returned 0x980 [0077.072] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.092] GetCurrentThreadId () returned 0x980 [0077.092] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.096] GetCurrentThreadId () returned 0x980 [0077.096] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.111] GetCurrentThreadId () returned 0x980 [0077.111] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.189] GetCurrentThreadId () returned 0x980 [0077.190] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.210] GetCurrentThreadId () returned 0x980 [0077.210] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.227] GetCurrentThreadId () returned 0x980 [0077.228] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.229] GetCurrentThreadId () returned 0x980 [0077.229] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.251] GetCurrentThreadId () returned 0x980 [0077.251] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.256] GetCurrentThreadId () returned 0x980 [0077.256] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.265] GetCurrentThreadId () returned 0x980 [0077.265] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.282] GetCurrentThreadId () returned 0x980 [0077.282] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.292] GetCurrentThreadId () returned 0x980 [0077.292] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.296] GetCurrentThreadId () returned 0x980 [0077.296] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.415] GetCurrentThreadId () returned 0x980 [0077.415] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.425] GetCurrentThreadId () returned 0x980 [0077.426] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.436] GetCurrentThreadId () returned 0x980 [0077.436] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.438] GetCurrentThreadId () returned 0x980 [0077.438] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.451] GetCurrentThreadId () returned 0x980 [0077.451] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.461] GetCurrentThreadId () returned 0x980 [0077.461] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.471] GetCurrentThreadId () returned 0x980 [0077.471] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.475] GetCurrentThreadId () returned 0x980 [0077.475] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.497] GetCurrentThreadId () returned 0x980 [0077.497] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.507] GetCurrentThreadId () returned 0x980 [0077.507] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.516] GetCurrentThreadId () returned 0x980 [0077.516] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.526] GetCurrentThreadId () returned 0x980 [0077.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.542] GetCurrentThreadId () returned 0x980 [0077.542] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.552] GetCurrentThreadId () returned 0x980 [0077.552] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.568] GetCurrentThreadId () returned 0x980 [0077.568] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.573] GetCurrentThreadId () returned 0x980 [0077.573] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.596] GetCurrentThreadId () returned 0x980 [0077.596] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.605] GetCurrentThreadId () returned 0x980 [0077.605] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.615] GetCurrentThreadId () returned 0x980 [0077.615] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.617] GetCurrentThreadId () returned 0x980 [0077.617] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.678] GetCurrentThreadId () returned 0x980 [0077.678] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.688] GetCurrentThreadId () returned 0x980 [0077.688] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.699] GetCurrentThreadId () returned 0x980 [0077.699] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.704] GetCurrentThreadId () returned 0x980 [0077.704] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.704] GetCurrentThreadId () returned 0x980 [0077.704] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.741] GetCurrentThreadId () returned 0x980 [0077.742] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.752] GetCurrentThreadId () returned 0x980 [0077.752] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.756] GetCurrentThreadId () returned 0x980 [0077.756] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.774] GetCurrentThreadId () returned 0x980 [0077.774] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.784] GetCurrentThreadId () returned 0x980 [0077.784] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.793] GetCurrentThreadId () returned 0x980 [0077.793] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.800] GetCurrentThreadId () returned 0x980 [0077.800] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.804] GetCurrentThreadId () returned 0x980 [0077.804] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.820] GetCurrentThreadId () returned 0x980 [0077.820] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.825] GetCurrentThreadId () returned 0x980 [0077.826] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.858] GetCurrentThreadId () returned 0x980 [0077.858] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.877] GetCurrentThreadId () returned 0x980 [0077.877] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.887] GetCurrentThreadId () returned 0x980 [0077.887] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.890] GetCurrentThreadId () returned 0x980 [0077.890] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.948] GetCurrentThreadId () returned 0x980 [0077.948] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.960] GetCurrentThreadId () returned 0x980 [0077.960] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.966] GetCurrentThreadId () returned 0x980 [0077.966] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.967] GetCurrentThreadId () returned 0x980 [0077.967] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.985] GetCurrentThreadId () returned 0x980 [0077.985] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0077.994] GetCurrentThreadId () returned 0x980 [0077.994] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.000] GetCurrentThreadId () returned 0x980 [0078.000] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.015] GetCurrentThreadId () returned 0x980 [0078.015] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.021] GetCurrentThreadId () returned 0x980 [0078.021] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.031] GetCurrentThreadId () returned 0x980 [0078.031] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.033] GetCurrentThreadId () returned 0x980 [0078.033] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.046] GetCurrentThreadId () returned 0x980 [0078.046] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.065] GetCurrentThreadId () returned 0x980 [0078.065] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.091] GetCurrentThreadId () returned 0x980 [0078.091] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.105] GetCurrentThreadId () returned 0x980 [0078.105] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.115] GetCurrentThreadId () returned 0x980 [0078.115] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.134] GetCurrentThreadId () returned 0x980 [0078.134] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.145] GetCurrentThreadId () returned 0x980 [0078.145] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.158] GetCurrentThreadId () returned 0x980 [0078.158] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.175] GetCurrentThreadId () returned 0x980 [0078.175] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.181] GetCurrentThreadId () returned 0x980 [0078.181] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.190] GetCurrentThreadId () returned 0x980 [0078.190] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.221] GetCurrentThreadId () returned 0x980 [0078.221] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.258] GetCurrentThreadId () returned 0x980 [0078.259] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.263] GetCurrentThreadId () returned 0x980 [0078.263] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.281] GetCurrentThreadId () returned 0x980 [0078.281] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.290] GetCurrentThreadId () returned 0x980 [0078.290] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.295] GetCurrentThreadId () returned 0x980 [0078.295] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.304] GetCurrentThreadId () returned 0x980 [0078.304] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.308] GetCurrentThreadId () returned 0x980 [0078.308] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.320] GetCurrentThreadId () returned 0x980 [0078.320] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.339] GetCurrentThreadId () returned 0x980 [0078.339] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.350] GetCurrentThreadId () returned 0x980 [0078.350] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.366] GetCurrentThreadId () returned 0x980 [0078.366] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.370] GetCurrentThreadId () returned 0x980 [0078.370] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.375] GetCurrentThreadId () returned 0x980 [0078.375] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.398] GetCurrentThreadId () returned 0x980 [0078.398] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.398] GetCurrentThreadId () returned 0x980 [0078.398] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.410] GetCurrentThreadId () returned 0x980 [0078.410] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.424] GetCurrentThreadId () returned 0x980 [0078.424] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.435] GetCurrentThreadId () returned 0x980 [0078.435] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.444] GetCurrentThreadId () returned 0x980 [0078.444] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.457] GetCurrentThreadId () returned 0x980 [0078.458] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.557] GetCurrentThreadId () returned 0x980 [0078.557] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.576] GetCurrentThreadId () returned 0x980 [0078.576] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.586] GetCurrentThreadId () returned 0x980 [0078.586] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.588] GetCurrentThreadId () returned 0x980 [0078.588] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.686] GetCurrentThreadId () returned 0x980 [0078.686] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.730] GetCurrentThreadId () returned 0x980 [0078.730] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.758] GetCurrentThreadId () returned 0x980 [0078.758] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.795] GetCurrentThreadId () returned 0x980 [0078.795] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.836] GetCurrentThreadId () returned 0x980 [0078.836] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.889] GetCurrentThreadId () returned 0x980 [0078.889] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.898] GetCurrentThreadId () returned 0x980 [0078.898] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.927] GetCurrentThreadId () returned 0x980 [0078.927] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.940] GetCurrentThreadId () returned 0x980 [0078.940] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.954] GetCurrentThreadId () returned 0x980 [0078.954] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.963] GetCurrentThreadId () returned 0x980 [0078.963] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.990] GetCurrentThreadId () returned 0x980 [0078.991] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0078.999] GetCurrentThreadId () returned 0x980 [0078.999] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.193] GetCurrentThreadId () returned 0x980 [0079.193] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.203] GetCurrentThreadId () returned 0x980 [0079.203] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.217] GetCurrentThreadId () returned 0x980 [0079.217] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.365] GetCurrentThreadId () returned 0x980 [0079.365] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.389] GetCurrentThreadId () returned 0x980 [0079.389] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.399] GetCurrentThreadId () returned 0x980 [0079.399] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.402] GetCurrentThreadId () returned 0x980 [0079.402] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.497] GetCurrentThreadId () returned 0x980 [0079.497] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.512] GetCurrentThreadId () returned 0x980 [0079.512] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.545] GetCurrentThreadId () returned 0x980 [0079.545] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.613] GetCurrentThreadId () returned 0x980 [0079.613] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.638] GetCurrentThreadId () returned 0x980 [0079.638] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.641] GetCurrentThreadId () returned 0x980 [0079.641] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.671] GetCurrentThreadId () returned 0x980 [0079.671] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.679] GetCurrentThreadId () returned 0x980 [0079.679] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.706] GetCurrentThreadId () returned 0x980 [0079.706] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.714] GetCurrentThreadId () returned 0x980 [0079.714] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.952] GetCurrentThreadId () returned 0x980 [0079.952] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.958] GetCurrentThreadId () returned 0x980 [0079.958] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0079.988] GetCurrentThreadId () returned 0x980 [0079.988] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.002] GetCurrentThreadId () returned 0x980 [0080.002] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.006] GetCurrentThreadId () returned 0x980 [0080.006] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.065] GetCurrentThreadId () returned 0x980 [0080.065] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.069] GetCurrentThreadId () returned 0x980 [0080.069] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.070] GetCurrentThreadId () returned 0x980 [0080.070] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.082] GetCurrentThreadId () returned 0x980 [0080.082] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.089] GetCurrentThreadId () returned 0x980 [0080.089] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.119] GetCurrentThreadId () returned 0x980 [0080.119] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.140] GetCurrentThreadId () returned 0x980 [0080.140] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.167] GetCurrentThreadId () returned 0x980 [0080.167] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.182] GetCurrentThreadId () returned 0x980 [0080.182] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.185] GetCurrentThreadId () returned 0x980 [0080.185] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.215] GetCurrentThreadId () returned 0x980 [0080.215] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.220] GetCurrentThreadId () returned 0x980 [0080.220] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.241] GetCurrentThreadId () returned 0x980 [0080.241] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.262] GetCurrentThreadId () returned 0x980 [0080.262] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.265] GetCurrentThreadId () returned 0x980 [0080.265] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.290] GetCurrentThreadId () returned 0x980 [0080.290] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.307] GetCurrentThreadId () returned 0x980 [0080.307] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.312] GetCurrentThreadId () returned 0x980 [0080.312] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.315] GetCurrentThreadId () returned 0x980 [0080.315] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.373] GetCurrentThreadId () returned 0x980 [0080.373] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.403] GetCurrentThreadId () returned 0x980 [0080.403] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.415] GetCurrentThreadId () returned 0x980 [0080.415] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.418] GetCurrentThreadId () returned 0x980 [0080.418] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.440] GetCurrentThreadId () returned 0x980 [0080.440] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.450] GetCurrentThreadId () returned 0x980 [0080.450] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.456] GetCurrentThreadId () returned 0x980 [0080.456] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.499] GetCurrentThreadId () returned 0x980 [0080.499] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.522] GetCurrentThreadId () returned 0x980 [0080.522] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.523] GetCurrentThreadId () returned 0x980 [0080.523] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.535] GetCurrentThreadId () returned 0x980 [0080.535] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.546] GetCurrentThreadId () returned 0x980 [0080.546] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.560] GetCurrentThreadId () returned 0x980 [0080.560] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.602] GetCurrentThreadId () returned 0x980 [0080.602] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.621] GetCurrentThreadId () returned 0x980 [0080.621] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.643] GetCurrentThreadId () returned 0x980 [0080.643] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.652] GetCurrentThreadId () returned 0x980 [0080.652] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.652] GetCurrentThreadId () returned 0x980 [0080.652] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.664] GetCurrentThreadId () returned 0x980 [0080.664] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.680] GetCurrentThreadId () returned 0x980 [0080.680] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.683] GetCurrentThreadId () returned 0x980 [0080.683] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.762] GetCurrentThreadId () returned 0x980 [0080.762] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.778] GetCurrentThreadId () returned 0x980 [0080.778] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.794] GetCurrentThreadId () returned 0x980 [0080.794] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.799] GetCurrentThreadId () returned 0x980 [0080.799] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.861] GetCurrentThreadId () returned 0x980 [0080.861] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.888] GetCurrentThreadId () returned 0x980 [0080.888] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.909] GetCurrentThreadId () returned 0x980 [0080.909] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.923] GetCurrentThreadId () returned 0x980 [0080.923] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.925] GetCurrentThreadId () returned 0x980 [0080.926] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0080.933] GetCurrentThreadId () returned 0x980 [0080.933] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.110] GetCurrentThreadId () returned 0x980 [0081.110] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.540] GetCurrentThreadId () returned 0x980 [0081.540] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.554] GetCurrentThreadId () returned 0x980 [0081.554] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.569] GetCurrentThreadId () returned 0x980 [0081.569] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.589] GetCurrentThreadId () returned 0x980 [0081.589] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.596] GetCurrentThreadId () returned 0x980 [0081.596] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.605] GetCurrentThreadId () returned 0x980 [0081.605] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.607] GetCurrentThreadId () returned 0x980 [0081.607] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.618] GetCurrentThreadId () returned 0x980 [0081.618] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.625] GetCurrentThreadId () returned 0x980 [0081.631] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.644] GetCurrentThreadId () returned 0x980 [0081.644] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.659] GetCurrentThreadId () returned 0x980 [0081.659] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.682] GetCurrentThreadId () returned 0x980 [0081.682] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.699] GetCurrentThreadId () returned 0x980 [0081.699] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.703] GetCurrentThreadId () returned 0x980 [0081.704] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.733] GetCurrentThreadId () returned 0x980 [0081.733] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.752] GetCurrentThreadId () returned 0x980 [0081.752] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.764] GetCurrentThreadId () returned 0x980 [0081.764] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.767] GetCurrentThreadId () returned 0x980 [0081.767] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.785] GetCurrentThreadId () returned 0x980 [0081.785] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.790] GetCurrentThreadId () returned 0x980 [0081.790] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.806] GetCurrentThreadId () returned 0x980 [0081.806] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.825] GetCurrentThreadId () returned 0x980 [0081.825] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.835] GetCurrentThreadId () returned 0x980 [0081.836] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.846] GetCurrentThreadId () returned 0x980 [0081.846] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.849] GetCurrentThreadId () returned 0x980 [0081.850] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.867] GetCurrentThreadId () returned 0x980 [0081.867] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.883] GetCurrentThreadId () returned 0x980 [0081.883] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.886] GetCurrentThreadId () returned 0x980 [0081.886] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.908] GetCurrentThreadId () returned 0x980 [0081.908] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.931] GetCurrentThreadId () returned 0x980 [0081.931] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.949] GetCurrentThreadId () returned 0x980 [0081.949] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.960] GetCurrentThreadId () returned 0x980 [0081.960] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.968] GetCurrentThreadId () returned 0x980 [0081.968] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.977] GetCurrentThreadId () returned 0x980 [0081.978] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0081.990] GetCurrentThreadId () returned 0x980 [0081.990] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.000] GetCurrentThreadId () returned 0x980 [0082.000] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.006] GetCurrentThreadId () returned 0x980 [0082.006] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.017] GetCurrentThreadId () returned 0x980 [0082.017] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.031] GetCurrentThreadId () returned 0x980 [0082.031] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.063] GetCurrentThreadId () returned 0x980 [0082.063] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.072] GetCurrentThreadId () returned 0x980 [0082.072] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.082] GetCurrentThreadId () returned 0x980 [0082.082] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.100] GetCurrentThreadId () returned 0x980 [0082.100] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.111] GetCurrentThreadId () returned 0x980 [0082.111] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.119] GetCurrentThreadId () returned 0x980 [0082.119] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.119] GetCurrentThreadId () returned 0x980 [0082.119] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.141] GetCurrentThreadId () returned 0x980 [0082.141] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.150] GetCurrentThreadId () returned 0x980 [0082.150] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.158] GetCurrentThreadId () returned 0x980 [0082.158] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.176] GetCurrentThreadId () returned 0x980 [0082.176] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.187] GetCurrentThreadId () returned 0x980 [0082.188] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.190] GetCurrentThreadId () returned 0x980 [0082.190] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.198] GetCurrentThreadId () returned 0x980 [0082.198] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.207] GetCurrentThreadId () returned 0x980 [0082.207] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.226] GetCurrentThreadId () returned 0x980 [0082.226] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.236] GetCurrentThreadId () returned 0x980 [0082.236] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.294] GetCurrentThreadId () returned 0x980 [0082.294] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.298] GetCurrentThreadId () returned 0x980 [0082.298] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.306] GetCurrentThreadId () returned 0x980 [0082.306] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.354] GetCurrentThreadId () returned 0x980 [0082.354] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.369] GetCurrentThreadId () returned 0x980 [0082.369] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.382] GetCurrentThreadId () returned 0x980 [0082.382] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.383] GetCurrentThreadId () returned 0x980 [0082.383] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.436] GetCurrentThreadId () returned 0x980 [0082.436] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.457] GetCurrentThreadId () returned 0x980 [0082.457] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.488] GetCurrentThreadId () returned 0x980 [0082.488] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.555] GetCurrentThreadId () returned 0x980 [0082.555] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.573] GetCurrentThreadId () returned 0x980 [0082.573] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.584] GetCurrentThreadId () returned 0x980 [0082.585] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.599] GetCurrentThreadId () returned 0x980 [0082.599] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.618] GetCurrentThreadId () returned 0x980 [0082.618] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.636] GetCurrentThreadId () returned 0x980 [0082.636] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.650] GetCurrentThreadId () returned 0x980 [0082.650] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.662] GetCurrentThreadId () returned 0x980 [0082.662] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.688] GetCurrentThreadId () returned 0x980 [0082.688] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.696] GetCurrentThreadId () returned 0x980 [0082.696] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.702] GetCurrentThreadId () returned 0x980 [0082.702] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.758] GetCurrentThreadId () returned 0x980 [0082.758] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.785] GetCurrentThreadId () returned 0x980 [0082.785] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.788] GetCurrentThreadId () returned 0x980 [0082.788] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.800] GetCurrentThreadId () returned 0x980 [0082.800] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.821] GetCurrentThreadId () returned 0x980 [0082.821] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.821] GetCurrentThreadId () returned 0x980 [0082.821] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.834] GetCurrentThreadId () returned 0x980 [0082.834] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.852] GetCurrentThreadId () returned 0x980 [0082.852] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.859] GetCurrentThreadId () returned 0x980 [0082.859] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.896] GetCurrentThreadId () returned 0x980 [0082.896] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.914] GetCurrentThreadId () returned 0x980 [0082.914] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.923] GetCurrentThreadId () returned 0x980 [0082.923] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.941] GetCurrentThreadId () returned 0x980 [0082.941] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.957] GetCurrentThreadId () returned 0x980 [0082.957] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.968] GetCurrentThreadId () returned 0x980 [0082.968] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.973] GetCurrentThreadId () returned 0x980 [0082.973] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0082.997] GetCurrentThreadId () returned 0x980 [0082.997] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.016] GetCurrentThreadId () returned 0x980 [0083.016] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.018] GetCurrentThreadId () returned 0x980 [0083.018] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.116] GetCurrentThreadId () returned 0x980 [0083.116] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.134] GetCurrentThreadId () returned 0x980 [0083.134] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.145] GetCurrentThreadId () returned 0x980 [0083.145] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.146] GetCurrentThreadId () returned 0x980 [0083.146] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.158] GetCurrentThreadId () returned 0x980 [0083.158] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.177] GetCurrentThreadId () returned 0x980 [0083.177] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.177] GetCurrentThreadId () returned 0x980 [0083.178] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.194] GetCurrentThreadId () returned 0x980 [0083.194] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.214] GetCurrentThreadId () returned 0x980 [0083.214] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.233] GetCurrentThreadId () returned 0x980 [0083.233] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.324] GetCurrentThreadId () returned 0x980 [0083.324] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.342] GetCurrentThreadId () returned 0x980 [0083.342] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.346] GetCurrentThreadId () returned 0x980 [0083.346] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.358] GetCurrentThreadId () returned 0x980 [0083.358] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.374] GetCurrentThreadId () returned 0x980 [0083.374] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.382] GetCurrentThreadId () returned 0x980 [0083.382] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.385] GetCurrentThreadId () returned 0x980 [0083.385] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.396] GetCurrentThreadId () returned 0x980 [0083.396] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.412] GetCurrentThreadId () returned 0x980 [0083.412] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.423] GetCurrentThreadId () returned 0x980 [0083.423] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.426] GetCurrentThreadId () returned 0x980 [0083.426] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.437] GetCurrentThreadId () returned 0x980 [0083.437] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.453] GetCurrentThreadId () returned 0x980 [0083.453] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.460] GetCurrentThreadId () returned 0x980 [0083.460] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.644] GetCurrentThreadId () returned 0x980 [0083.645] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.654] GetCurrentThreadId () returned 0x980 [0083.654] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.657] GetCurrentThreadId () returned 0x980 [0083.657] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.673] GetCurrentThreadId () returned 0x980 [0083.673] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0083.683] GetCurrentThreadId () returned 0x980 [0083.683] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.017] GetCurrentThreadId () returned 0x980 [0084.017] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.046] GetCurrentThreadId () returned 0x980 [0084.046] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.063] GetCurrentThreadId () returned 0x980 [0084.063] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.073] GetCurrentThreadId () returned 0x980 [0084.073] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.081] GetCurrentThreadId () returned 0x980 [0084.081] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.146] GetCurrentThreadId () returned 0x980 [0084.146] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.187] GetCurrentThreadId () returned 0x980 [0084.187] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.253] GetCurrentThreadId () returned 0x980 [0084.253] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.259] GetCurrentThreadId () returned 0x980 [0084.259] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.295] GetCurrentThreadId () returned 0x980 [0084.296] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.301] GetCurrentThreadId () returned 0x980 [0084.301] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.332] GetCurrentThreadId () returned 0x980 [0084.332] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.345] GetCurrentThreadId () returned 0x980 [0084.345] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.360] GetCurrentThreadId () returned 0x980 [0084.360] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.381] GetCurrentThreadId () returned 0x980 [0084.381] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.432] GetCurrentThreadId () returned 0x980 [0084.432] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.471] GetCurrentThreadId () returned 0x980 [0084.472] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.476] GetCurrentThreadId () returned 0x980 [0084.476] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.485] GetCurrentThreadId () returned 0x980 [0084.485] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.497] GetCurrentThreadId () returned 0x980 [0084.497] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.515] GetCurrentThreadId () returned 0x980 [0084.515] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.527] GetCurrentThreadId () returned 0x980 [0084.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.551] GetCurrentThreadId () returned 0x980 [0084.552] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.562] GetCurrentThreadId () returned 0x980 [0084.562] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.572] GetCurrentThreadId () returned 0x980 [0084.572] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.576] GetCurrentThreadId () returned 0x980 [0084.576] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.592] GetCurrentThreadId () returned 0x980 [0084.592] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.594] GetCurrentThreadId () returned 0x980 [0084.594] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.613] GetCurrentThreadId () returned 0x980 [0084.614] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.630] GetCurrentThreadId () returned 0x980 [0084.630] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.633] GetCurrentThreadId () returned 0x980 [0084.633] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.644] GetCurrentThreadId () returned 0x980 [0084.644] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.661] GetCurrentThreadId () returned 0x980 [0084.661] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.671] GetCurrentThreadId () returned 0x980 [0084.671] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.674] GetCurrentThreadId () returned 0x980 [0084.674] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.686] GetCurrentThreadId () returned 0x980 [0084.686] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.703] GetCurrentThreadId () returned 0x980 [0084.703] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.715] GetCurrentThreadId () returned 0x980 [0084.715] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.719] GetCurrentThreadId () returned 0x980 [0084.719] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.730] GetCurrentThreadId () returned 0x980 [0084.730] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.746] GetCurrentThreadId () returned 0x980 [0084.746] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.755] GetCurrentThreadId () returned 0x980 [0084.755] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.758] GetCurrentThreadId () returned 0x980 [0084.758] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.797] GetCurrentThreadId () returned 0x980 [0084.797] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.820] GetCurrentThreadId () returned 0x980 [0084.820] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.832] GetCurrentThreadId () returned 0x980 [0084.832] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.855] GetCurrentThreadId () returned 0x980 [0084.855] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.866] GetCurrentThreadId () returned 0x980 [0084.866] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.887] GetCurrentThreadId () returned 0x980 [0084.887] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.907] GetCurrentThreadId () returned 0x980 [0084.907] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.927] GetCurrentThreadId () returned 0x980 [0084.927] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.948] GetCurrentThreadId () returned 0x980 [0084.948] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.961] GetCurrentThreadId () returned 0x980 [0084.961] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.972] GetCurrentThreadId () returned 0x980 [0084.972] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.974] GetCurrentThreadId () returned 0x980 [0084.974] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.977] GetCurrentThreadId () returned 0x980 [0084.977] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0084.989] GetCurrentThreadId () returned 0x980 [0084.989] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.010] GetCurrentThreadId () returned 0x980 [0085.010] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.020] GetCurrentThreadId () returned 0x980 [0085.020] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.041] GetCurrentThreadId () returned 0x980 [0085.041] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.051] GetCurrentThreadId () returned 0x980 [0085.051] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.064] GetCurrentThreadId () returned 0x980 [0085.065] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.068] GetCurrentThreadId () returned 0x980 [0085.068] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.091] GetCurrentThreadId () returned 0x980 [0085.091] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.098] GetCurrentThreadId () returned 0x980 [0085.098] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.270] GetCurrentThreadId () returned 0x980 [0085.270] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.274] GetCurrentThreadId () returned 0x980 [0085.274] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.336] GetCurrentThreadId () returned 0x980 [0085.336] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.347] GetCurrentThreadId () returned 0x980 [0085.347] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.357] GetCurrentThreadId () returned 0x980 [0085.357] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.359] GetCurrentThreadId () returned 0x980 [0085.359] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.362] GetCurrentThreadId () returned 0x980 [0085.362] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.396] GetCurrentThreadId () returned 0x980 [0085.397] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.407] GetCurrentThreadId () returned 0x980 [0085.407] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.418] GetCurrentThreadId () returned 0x980 [0085.418] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.420] GetCurrentThreadId () returned 0x980 [0085.420] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.434] GetCurrentThreadId () returned 0x980 [0085.434] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.444] GetCurrentThreadId () returned 0x980 [0085.444] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.493] GetCurrentThreadId () returned 0x980 [0085.493] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.515] GetCurrentThreadId () returned 0x980 [0085.515] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.517] GetCurrentThreadId () returned 0x980 [0085.517] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.535] GetCurrentThreadId () returned 0x980 [0085.535] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.545] GetCurrentThreadId () returned 0x980 [0085.545] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.551] GetCurrentThreadId () returned 0x980 [0085.551] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.553] GetCurrentThreadId () returned 0x980 [0085.553] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.565] GetCurrentThreadId () returned 0x980 [0085.565] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.591] GetCurrentThreadId () returned 0x980 [0085.591] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.606] GetCurrentThreadId () returned 0x980 [0085.606] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.649] GetCurrentThreadId () returned 0x980 [0085.649] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.660] GetCurrentThreadId () returned 0x980 [0085.661] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.679] GetCurrentThreadId () returned 0x980 [0085.680] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.690] GetCurrentThreadId () returned 0x980 [0085.690] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.703] GetCurrentThreadId () returned 0x980 [0085.703] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.733] GetCurrentThreadId () returned 0x980 [0085.733] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.738] GetCurrentThreadId () returned 0x980 [0085.738] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.739] GetCurrentThreadId () returned 0x980 [0085.739] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.808] GetCurrentThreadId () returned 0x980 [0085.808] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.816] GetCurrentThreadId () returned 0x980 [0085.816] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.819] GetCurrentThreadId () returned 0x980 [0085.819] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.873] GetCurrentThreadId () returned 0x980 [0085.873] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.887] GetCurrentThreadId () returned 0x980 [0085.887] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.891] GetCurrentThreadId () returned 0x980 [0085.891] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.966] GetCurrentThreadId () returned 0x980 [0085.966] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.977] GetCurrentThreadId () returned 0x980 [0085.977] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.979] GetCurrentThreadId () returned 0x980 [0085.979] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0085.989] GetCurrentThreadId () returned 0x980 [0085.989] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.008] GetCurrentThreadId () returned 0x980 [0086.008] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.018] GetCurrentThreadId () returned 0x980 [0086.018] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.019] GetCurrentThreadId () returned 0x980 [0086.019] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.033] GetCurrentThreadId () returned 0x980 [0086.033] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.050] GetCurrentThreadId () returned 0x980 [0086.050] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.066] GetCurrentThreadId () returned 0x980 [0086.067] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.077] GetCurrentThreadId () returned 0x980 [0086.077] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.087] GetCurrentThreadId () returned 0x980 [0086.087] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.090] GetCurrentThreadId () returned 0x980 [0086.090] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.107] GetCurrentThreadId () returned 0x980 [0086.107] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.112] GetCurrentThreadId () returned 0x980 [0086.112] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.123] GetCurrentThreadId () returned 0x980 [0086.123] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.138] GetCurrentThreadId () returned 0x980 [0086.139] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.151] GetCurrentThreadId () returned 0x980 [0086.151] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.159] GetCurrentThreadId () returned 0x980 [0086.159] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.160] GetCurrentThreadId () returned 0x980 [0086.160] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.177] GetCurrentThreadId () returned 0x980 [0086.177] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.186] GetCurrentThreadId () returned 0x980 [0086.186] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.187] GetCurrentThreadId () returned 0x980 [0086.188] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.204] GetCurrentThreadId () returned 0x980 [0086.205] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.219] GetCurrentThreadId () returned 0x980 [0086.219] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.229] GetCurrentThreadId () returned 0x980 [0086.229] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.233] GetCurrentThreadId () returned 0x980 [0086.233] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.299] GetCurrentThreadId () returned 0x980 [0086.299] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.310] GetCurrentThreadId () returned 0x980 [0086.310] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.336] GetCurrentThreadId () returned 0x980 [0086.336] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.346] GetCurrentThreadId () returned 0x980 [0086.346] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.348] GetCurrentThreadId () returned 0x980 [0086.348] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.358] GetCurrentThreadId () returned 0x980 [0086.358] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.422] GetCurrentThreadId () returned 0x980 [0086.422] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.436] GetCurrentThreadId () returned 0x980 [0086.436] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.461] GetCurrentThreadId () returned 0x980 [0086.462] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.471] GetCurrentThreadId () returned 0x980 [0086.471] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.472] GetCurrentThreadId () returned 0x980 [0086.473] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.491] GetCurrentThreadId () returned 0x980 [0086.491] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.500] GetCurrentThreadId () returned 0x980 [0086.500] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.510] GetCurrentThreadId () returned 0x980 [0086.510] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.568] GetCurrentThreadId () returned 0x980 [0086.568] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.580] GetCurrentThreadId () returned 0x980 [0086.580] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.591] GetCurrentThreadId () returned 0x980 [0086.591] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.602] GetCurrentThreadId () returned 0x980 [0086.602] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.613] GetCurrentThreadId () returned 0x980 [0086.613] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.623] GetCurrentThreadId () returned 0x980 [0086.623] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.627] GetCurrentThreadId () returned 0x980 [0086.627] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.628] GetCurrentThreadId () returned 0x980 [0086.628] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.631] GetCurrentThreadId () returned 0x980 [0086.631] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.635] GetCurrentThreadId () returned 0x980 [0086.635] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.637] GetCurrentThreadId () returned 0x980 [0086.637] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.665] GetCurrentThreadId () returned 0x980 [0086.665] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.692] GetCurrentThreadId () returned 0x980 [0086.692] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.703] GetCurrentThreadId () returned 0x980 [0086.703] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.729] GetCurrentThreadId () returned 0x980 [0086.729] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.739] GetCurrentThreadId () returned 0x980 [0086.739] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.742] GetCurrentThreadId () returned 0x980 [0086.742] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.755] GetCurrentThreadId () returned 0x980 [0086.755] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.765] GetCurrentThreadId () returned 0x980 [0086.765] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.783] GetCurrentThreadId () returned 0x980 [0086.783] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.794] GetCurrentThreadId () returned 0x980 [0086.794] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.798] GetCurrentThreadId () returned 0x980 [0086.798] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.814] GetCurrentThreadId () returned 0x980 [0086.814] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.818] GetCurrentThreadId () returned 0x980 [0086.818] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.823] GetCurrentThreadId () returned 0x980 [0086.823] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.831] GetCurrentThreadId () returned 0x980 [0086.831] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.865] GetCurrentThreadId () returned 0x980 [0086.865] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.892] GetCurrentThreadId () returned 0x980 [0086.892] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.909] GetCurrentThreadId () returned 0x980 [0086.909] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.913] GetCurrentThreadId () returned 0x980 [0086.914] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.937] GetCurrentThreadId () returned 0x980 [0086.937] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.951] GetCurrentThreadId () returned 0x980 [0086.951] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.957] GetCurrentThreadId () returned 0x980 [0086.957] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.968] GetCurrentThreadId () returned 0x980 [0086.969] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0086.988] GetCurrentThreadId () returned 0x980 [0086.988] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.099] GetCurrentThreadId () returned 0x980 [0087.099] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.126] GetCurrentThreadId () returned 0x980 [0087.126] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.137] GetCurrentThreadId () returned 0x980 [0087.137] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.155] GetCurrentThreadId () returned 0x980 [0087.156] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.167] GetCurrentThreadId () returned 0x980 [0087.167] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.173] GetCurrentThreadId () returned 0x980 [0087.173] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.184] GetCurrentThreadId () returned 0x980 [0087.184] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.204] GetCurrentThreadId () returned 0x980 [0087.204] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.218] GetCurrentThreadId () returned 0x980 [0087.218] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.221] GetCurrentThreadId () returned 0x980 [0087.221] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.240] GetCurrentThreadId () returned 0x980 [0087.240] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.251] GetCurrentThreadId () returned 0x980 [0087.251] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.254] GetCurrentThreadId () returned 0x980 [0087.254] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.272] GetCurrentThreadId () returned 0x980 [0087.272] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.283] GetCurrentThreadId () returned 0x980 [0087.283] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.295] GetCurrentThreadId () returned 0x980 [0087.295] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.306] GetCurrentThreadId () returned 0x980 [0087.306] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.319] GetCurrentThreadId () returned 0x980 [0087.319] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.338] GetCurrentThreadId () returned 0x980 [0087.338] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.350] GetCurrentThreadId () returned 0x980 [0087.350] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.370] GetCurrentThreadId () returned 0x980 [0087.370] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.384] GetCurrentThreadId () returned 0x980 [0087.384] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.387] GetCurrentThreadId () returned 0x980 [0087.388] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.391] GetCurrentThreadId () returned 0x980 [0087.391] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.401] GetCurrentThreadId () returned 0x980 [0087.401] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.406] GetCurrentThreadId () returned 0x980 [0087.406] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.410] GetCurrentThreadId () returned 0x980 [0087.410] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.431] GetCurrentThreadId () returned 0x980 [0087.431] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.455] GetCurrentThreadId () returned 0x980 [0087.456] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.466] GetCurrentThreadId () returned 0x980 [0087.466] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.484] GetCurrentThreadId () returned 0x980 [0087.484] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.495] GetCurrentThreadId () returned 0x980 [0087.495] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.541] GetCurrentThreadId () returned 0x980 [0087.541] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.547] GetCurrentThreadId () returned 0x980 [0087.547] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.548] GetCurrentThreadId () returned 0x980 [0087.548] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.568] GetCurrentThreadId () returned 0x980 [0087.568] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.579] GetCurrentThreadId () returned 0x980 [0087.579] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.584] GetCurrentThreadId () returned 0x980 [0087.585] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.601] GetCurrentThreadId () returned 0x980 [0087.601] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.612] GetCurrentThreadId () returned 0x980 [0087.612] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.623] GetCurrentThreadId () returned 0x980 [0087.623] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.636] GetCurrentThreadId () returned 0x980 [0087.636] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.666] GetCurrentThreadId () returned 0x980 [0087.666] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.670] GetCurrentThreadId () returned 0x980 [0087.670] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.681] GetCurrentThreadId () returned 0x980 [0087.681] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.686] GetCurrentThreadId () returned 0x980 [0087.686] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.750] GetCurrentThreadId () returned 0x980 [0087.750] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.789] GetCurrentThreadId () returned 0x980 [0087.789] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.797] GetCurrentThreadId () returned 0x980 [0087.797] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.833] GetCurrentThreadId () returned 0x980 [0087.833] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.835] GetCurrentThreadId () returned 0x980 [0087.835] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.845] GetCurrentThreadId () returned 0x980 [0087.845] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.867] GetCurrentThreadId () returned 0x980 [0087.867] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.899] GetCurrentThreadId () returned 0x980 [0087.899] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.909] GetCurrentThreadId () returned 0x980 [0087.909] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.927] GetCurrentThreadId () returned 0x980 [0087.928] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.937] GetCurrentThreadId () returned 0x980 [0087.937] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.939] GetCurrentThreadId () returned 0x980 [0087.939] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.957] GetCurrentThreadId () returned 0x980 [0087.957] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.967] GetCurrentThreadId () returned 0x980 [0087.967] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0087.984] GetCurrentThreadId () returned 0x980 [0087.984] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.009] GetCurrentThreadId () returned 0x980 [0088.009] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.020] GetCurrentThreadId () returned 0x980 [0088.020] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.030] GetCurrentThreadId () returned 0x980 [0088.030] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.039] GetCurrentThreadId () returned 0x980 [0088.039] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.041] GetCurrentThreadId () returned 0x980 [0088.041] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.051] GetCurrentThreadId () returned 0x980 [0088.051] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.069] GetCurrentThreadId () returned 0x980 [0088.069] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.078] GetCurrentThreadId () returned 0x980 [0088.078] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.080] GetCurrentThreadId () returned 0x980 [0088.080] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.097] GetCurrentThreadId () returned 0x980 [0088.097] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.101] GetCurrentThreadId () returned 0x980 [0088.101] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.117] GetCurrentThreadId () returned 0x980 [0088.117] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.141] GetCurrentThreadId () returned 0x980 [0088.141] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.156] GetCurrentThreadId () returned 0x980 [0088.156] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.156] GetCurrentThreadId () returned 0x980 [0088.156] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.171] GetCurrentThreadId () returned 0x980 [0088.172] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.176] GetCurrentThreadId () returned 0x980 [0088.176] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.266] GetCurrentThreadId () returned 0x980 [0088.266] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.288] GetCurrentThreadId () returned 0x980 [0088.288] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.308] GetCurrentThreadId () returned 0x980 [0088.308] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.312] GetCurrentThreadId () returned 0x980 [0088.312] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.313] GetCurrentThreadId () returned 0x980 [0088.313] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.331] GetCurrentThreadId () returned 0x980 [0088.332] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.343] GetCurrentThreadId () returned 0x980 [0088.343] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.354] GetCurrentThreadId () returned 0x980 [0088.354] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.364] GetCurrentThreadId () returned 0x980 [0088.364] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.375] GetCurrentThreadId () returned 0x980 [0088.375] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.385] GetCurrentThreadId () returned 0x980 [0088.385] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.397] GetCurrentThreadId () returned 0x980 [0088.397] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.418] GetCurrentThreadId () returned 0x980 [0088.418] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.434] GetCurrentThreadId () returned 0x980 [0088.434] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.453] GetCurrentThreadId () returned 0x980 [0088.453] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.456] GetCurrentThreadId () returned 0x980 [0088.456] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.459] GetCurrentThreadId () returned 0x980 [0088.459] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.485] GetCurrentThreadId () returned 0x980 [0088.485] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.496] GetCurrentThreadId () returned 0x980 [0088.496] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.527] GetCurrentThreadId () returned 0x980 [0088.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.534] GetCurrentThreadId () returned 0x980 [0088.534] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.542] GetCurrentThreadId () returned 0x980 [0088.542] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.554] GetCurrentThreadId () returned 0x980 [0088.554] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.557] GetCurrentThreadId () returned 0x980 [0088.557] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.611] GetCurrentThreadId () returned 0x980 [0088.611] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.619] GetCurrentThreadId () returned 0x980 [0088.619] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.629] GetCurrentThreadId () returned 0x980 [0088.629] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.643] GetCurrentThreadId () returned 0x980 [0088.643] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.653] GetCurrentThreadId () returned 0x980 [0088.653] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.691] GetCurrentThreadId () returned 0x980 [0088.692] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.938] GetCurrentThreadId () returned 0x980 [0088.938] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.942] GetCurrentThreadId () returned 0x980 [0088.942] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.955] GetCurrentThreadId () returned 0x980 [0088.955] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.960] GetCurrentThreadId () returned 0x980 [0088.960] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.979] GetCurrentThreadId () returned 0x980 [0088.979] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0088.993] GetCurrentThreadId () returned 0x980 [0088.993] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.021] GetCurrentThreadId () returned 0x980 [0089.021] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.039] GetCurrentThreadId () returned 0x980 [0089.039] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.059] GetCurrentThreadId () returned 0x980 [0089.059] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.069] GetCurrentThreadId () returned 0x980 [0089.069] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.089] GetCurrentThreadId () returned 0x980 [0089.089] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.091] GetCurrentThreadId () returned 0x980 [0089.091] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.159] GetCurrentThreadId () returned 0x980 [0089.159] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.183] GetCurrentThreadId () returned 0x980 [0089.183] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.193] GetCurrentThreadId () returned 0x980 [0089.194] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.211] GetCurrentThreadId () returned 0x980 [0089.211] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.224] GetCurrentThreadId () returned 0x980 [0089.224] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.234] GetCurrentThreadId () returned 0x980 [0089.234] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.237] GetCurrentThreadId () returned 0x980 [0089.237] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.256] GetCurrentThreadId () returned 0x980 [0089.256] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.258] GetCurrentThreadId () returned 0x980 [0089.258] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.271] GetCurrentThreadId () returned 0x980 [0089.271] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.290] GetCurrentThreadId () returned 0x980 [0089.290] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.304] GetCurrentThreadId () returned 0x980 [0089.304] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.324] GetCurrentThreadId () returned 0x980 [0089.324] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.328] GetCurrentThreadId () returned 0x980 [0089.328] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.330] GetCurrentThreadId () returned 0x980 [0089.330] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.342] GetCurrentThreadId () returned 0x980 [0089.342] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.351] GetCurrentThreadId () returned 0x980 [0089.351] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.374] GetCurrentThreadId () returned 0x980 [0089.374] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.396] GetCurrentThreadId () returned 0x980 [0089.396] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.403] GetCurrentThreadId () returned 0x980 [0089.403] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.406] GetCurrentThreadId () returned 0x980 [0089.406] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.415] GetCurrentThreadId () returned 0x980 [0089.415] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.425] GetCurrentThreadId () returned 0x980 [0089.425] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.436] GetCurrentThreadId () returned 0x980 [0089.436] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.447] GetCurrentThreadId () returned 0x980 [0089.447] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.468] GetCurrentThreadId () returned 0x980 [0089.468] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.469] GetCurrentThreadId () returned 0x980 [0089.469] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.473] GetCurrentThreadId () returned 0x980 [0089.473] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.499] GetCurrentThreadId () returned 0x980 [0089.499] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.502] GetCurrentThreadId () returned 0x980 [0089.503] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.506] GetCurrentThreadId () returned 0x980 [0089.506] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.523] GetCurrentThreadId () returned 0x980 [0089.524] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.534] GetCurrentThreadId () returned 0x980 [0089.534] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.542] GetCurrentThreadId () returned 0x980 [0089.542] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.557] GetCurrentThreadId () returned 0x980 [0089.557] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.579] GetCurrentThreadId () returned 0x980 [0089.579] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.579] GetCurrentThreadId () returned 0x980 [0089.579] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.606] GetCurrentThreadId () returned 0x980 [0089.606] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.618] GetCurrentThreadId () returned 0x980 [0089.618] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.635] GetCurrentThreadId () returned 0x980 [0089.636] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.654] GetCurrentThreadId () returned 0x980 [0089.654] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.665] GetCurrentThreadId () returned 0x980 [0089.665] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.682] GetCurrentThreadId () returned 0x980 [0089.682] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.700] GetCurrentThreadId () returned 0x980 [0089.700] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.701] GetCurrentThreadId () returned 0x980 [0089.701] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.764] GetCurrentThreadId () returned 0x980 [0089.764] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.943] GetCurrentThreadId () returned 0x980 [0089.947] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.964] GetCurrentThreadId () returned 0x980 [0089.964] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.966] GetCurrentThreadId () returned 0x980 [0089.966] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.980] GetCurrentThreadId () returned 0x980 [0089.980] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0089.999] GetCurrentThreadId () returned 0x980 [0089.999] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.002] GetCurrentThreadId () returned 0x980 [0090.002] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.014] GetCurrentThreadId () returned 0x980 [0090.014] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.022] GetCurrentThreadId () returned 0x980 [0090.022] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.031] GetCurrentThreadId () returned 0x980 [0090.031] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.059] GetCurrentThreadId () returned 0x980 [0090.059] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.071] GetCurrentThreadId () returned 0x980 [0090.071] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.073] GetCurrentThreadId () returned 0x980 [0090.073] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.076] GetCurrentThreadId () returned 0x980 [0090.076] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.086] GetCurrentThreadId () returned 0x980 [0090.086] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.103] GetCurrentThreadId () returned 0x980 [0090.103] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.106] GetCurrentThreadId () returned 0x980 [0090.106] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.108] GetCurrentThreadId () returned 0x980 [0090.108] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.126] GetCurrentThreadId () returned 0x980 [0090.126] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.130] GetCurrentThreadId () returned 0x980 [0090.130] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.172] GetCurrentThreadId () returned 0x980 [0090.172] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.206] GetCurrentThreadId () returned 0x980 [0090.206] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.231] GetCurrentThreadId () returned 0x980 [0090.231] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.243] GetCurrentThreadId () returned 0x980 [0090.243] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.253] GetCurrentThreadId () returned 0x980 [0090.254] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.269] GetCurrentThreadId () returned 0x980 [0090.270] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.280] GetCurrentThreadId () returned 0x980 [0090.280] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.290] GetCurrentThreadId () returned 0x980 [0090.290] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.323] GetCurrentThreadId () returned 0x980 [0090.323] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.343] GetCurrentThreadId () returned 0x980 [0090.343] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.356] GetCurrentThreadId () returned 0x980 [0090.356] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.359] GetCurrentThreadId () returned 0x980 [0090.359] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.371] GetCurrentThreadId () returned 0x980 [0090.371] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.382] GetCurrentThreadId () returned 0x980 [0090.382] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.401] GetCurrentThreadId () returned 0x980 [0090.401] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.406] GetCurrentThreadId () returned 0x980 [0090.406] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.415] GetCurrentThreadId () returned 0x980 [0090.415] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.435] GetCurrentThreadId () returned 0x980 [0090.435] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.445] GetCurrentThreadId () returned 0x980 [0090.445] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.447] GetCurrentThreadId () returned 0x980 [0090.447] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.466] GetCurrentThreadId () returned 0x980 [0090.466] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.476] GetCurrentThreadId () returned 0x980 [0090.476] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.480] GetCurrentThreadId () returned 0x980 [0090.480] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.496] GetCurrentThreadId () returned 0x980 [0090.496] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.499] GetCurrentThreadId () returned 0x980 [0090.499] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.516] GetCurrentThreadId () returned 0x980 [0090.516] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.527] GetCurrentThreadId () returned 0x980 [0090.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.543] GetCurrentThreadId () returned 0x980 [0090.543] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.543] GetCurrentThreadId () returned 0x980 [0090.543] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.554] GetCurrentThreadId () returned 0x980 [0090.554] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.564] GetCurrentThreadId () returned 0x980 [0090.564] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.584] GetCurrentThreadId () returned 0x980 [0090.584] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.595] GetCurrentThreadId () returned 0x980 [0090.595] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.599] GetCurrentThreadId () returned 0x980 [0090.599] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.602] GetCurrentThreadId () returned 0x980 [0090.602] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.608] GetCurrentThreadId () returned 0x980 [0090.608] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.611] GetCurrentThreadId () returned 0x980 [0090.611] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.646] GetCurrentThreadId () returned 0x980 [0090.646] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.652] GetCurrentThreadId () returned 0x980 [0090.652] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.660] GetCurrentThreadId () returned 0x980 [0090.660] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.679] GetCurrentThreadId () returned 0x980 [0090.679] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.688] GetCurrentThreadId () returned 0x980 [0090.688] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.698] GetCurrentThreadId () returned 0x980 [0090.698] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.776] GetCurrentThreadId () returned 0x980 [0090.776] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.791] GetCurrentThreadId () returned 0x980 [0090.791] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.801] GetCurrentThreadId () returned 0x980 [0090.801] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.812] GetCurrentThreadId () returned 0x980 [0090.812] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.820] GetCurrentThreadId () returned 0x980 [0090.820] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.834] GetCurrentThreadId () returned 0x980 [0090.834] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.836] GetCurrentThreadId () returned 0x980 [0090.837] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.841] GetCurrentThreadId () returned 0x980 [0090.841] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.859] GetCurrentThreadId () returned 0x980 [0090.860] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.876] GetCurrentThreadId () returned 0x980 [0090.877] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.897] GetCurrentThreadId () returned 0x980 [0090.897] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.934] GetCurrentThreadId () returned 0x980 [0090.934] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.939] GetCurrentThreadId () returned 0x980 [0090.939] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.960] GetCurrentThreadId () returned 0x980 [0090.960] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.970] GetCurrentThreadId () returned 0x980 [0090.971] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.983] GetCurrentThreadId () returned 0x980 [0090.983] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0090.993] GetCurrentThreadId () returned 0x980 [0090.993] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.004] GetCurrentThreadId () returned 0x980 [0091.004] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.004] GetCurrentThreadId () returned 0x980 [0091.004] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.026] GetCurrentThreadId () returned 0x980 [0091.026] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.029] GetCurrentThreadId () returned 0x980 [0091.029] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.042] GetCurrentThreadId () returned 0x980 [0091.042] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.053] GetCurrentThreadId () returned 0x980 [0091.053] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.067] GetCurrentThreadId () returned 0x980 [0091.067] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.070] GetCurrentThreadId () returned 0x980 [0091.070] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.246] GetCurrentThreadId () returned 0x980 [0091.246] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.257] GetCurrentThreadId () returned 0x980 [0091.257] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.259] GetCurrentThreadId () returned 0x980 [0091.259] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.269] GetCurrentThreadId () returned 0x980 [0091.269] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.292] GetCurrentThreadId () returned 0x980 [0091.292] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.349] GetCurrentThreadId () returned 0x980 [0091.349] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.352] GetCurrentThreadId () returned 0x980 [0091.352] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.382] GetCurrentThreadId () returned 0x980 [0091.382] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.523] GetCurrentThreadId () returned 0x980 [0091.523] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.537] GetCurrentThreadId () returned 0x980 [0091.537] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.540] GetCurrentThreadId () returned 0x980 [0091.540] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.568] GetCurrentThreadId () returned 0x980 [0091.568] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.590] GetCurrentThreadId () returned 0x980 [0091.590] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.613] GetCurrentThreadId () returned 0x980 [0091.613] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.630] GetCurrentThreadId () returned 0x980 [0091.630] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.641] GetCurrentThreadId () returned 0x980 [0091.641] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.650] GetCurrentThreadId () returned 0x980 [0091.650] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.654] GetCurrentThreadId () returned 0x980 [0091.654] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.666] GetCurrentThreadId () returned 0x980 [0091.666] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.669] GetCurrentThreadId () returned 0x980 [0091.669] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.686] GetCurrentThreadId () returned 0x980 [0091.687] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.691] GetCurrentThreadId () returned 0x980 [0091.691] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.704] GetCurrentThreadId () returned 0x980 [0091.704] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.735] GetCurrentThreadId () returned 0x980 [0091.736] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.744] GetCurrentThreadId () returned 0x980 [0091.744] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.751] GetCurrentThreadId () returned 0x980 [0091.751] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.770] GetCurrentThreadId () returned 0x980 [0091.770] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.781] GetCurrentThreadId () returned 0x980 [0091.781] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.784] GetCurrentThreadId () returned 0x980 [0091.784] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.805] GetCurrentThreadId () returned 0x980 [0091.805] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.811] GetCurrentThreadId () returned 0x980 [0091.812] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.828] GetCurrentThreadId () returned 0x980 [0091.828] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.838] GetCurrentThreadId () returned 0x980 [0091.838] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.849] GetCurrentThreadId () returned 0x980 [0091.849] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.853] GetCurrentThreadId () returned 0x980 [0091.853] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.854] GetCurrentThreadId () returned 0x980 [0091.854] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.871] GetCurrentThreadId () returned 0x980 [0091.871] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.882] GetCurrentThreadId () returned 0x980 [0091.882] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.899] GetCurrentThreadId () returned 0x980 [0091.899] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.909] GetCurrentThreadId () returned 0x980 [0091.909] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.919] GetCurrentThreadId () returned 0x980 [0091.919] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.934] GetCurrentThreadId () returned 0x980 [0091.934] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.948] GetCurrentThreadId () returned 0x980 [0091.948] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.972] GetCurrentThreadId () returned 0x980 [0091.972] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0091.991] GetCurrentThreadId () returned 0x980 [0091.991] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.001] GetCurrentThreadId () returned 0x980 [0092.001] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.009] GetCurrentThreadId () returned 0x980 [0092.009] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.010] GetCurrentThreadId () returned 0x980 [0092.010] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.037] GetCurrentThreadId () returned 0x980 [0092.038] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.048] GetCurrentThreadId () returned 0x980 [0092.048] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.051] GetCurrentThreadId () returned 0x980 [0092.051] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.079] GetCurrentThreadId () returned 0x980 [0092.079] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.087] GetCurrentThreadId () returned 0x980 [0092.087] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.092] GetCurrentThreadId () returned 0x980 [0092.092] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.094] GetCurrentThreadId () returned 0x980 [0092.094] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.106] GetCurrentThreadId () returned 0x980 [0092.106] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.123] GetCurrentThreadId () returned 0x980 [0092.123] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.136] GetCurrentThreadId () returned 0x980 [0092.136] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.147] GetCurrentThreadId () returned 0x980 [0092.147] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.165] GetCurrentThreadId () returned 0x980 [0092.165] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.175] GetCurrentThreadId () returned 0x980 [0092.175] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.186] GetCurrentThreadId () returned 0x980 [0092.186] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.196] GetCurrentThreadId () returned 0x980 [0092.196] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.206] GetCurrentThreadId () returned 0x980 [0092.206] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.212] GetCurrentThreadId () returned 0x980 [0092.212] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.214] GetCurrentThreadId () returned 0x980 [0092.214] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.230] GetCurrentThreadId () returned 0x980 [0092.230] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.241] GetCurrentThreadId () returned 0x980 [0092.241] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.253] GetCurrentThreadId () returned 0x980 [0092.253] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.253] GetCurrentThreadId () returned 0x980 [0092.253] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.273] GetCurrentThreadId () returned 0x980 [0092.273] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.283] GetCurrentThreadId () returned 0x980 [0092.283] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.286] GetCurrentThreadId () returned 0x980 [0092.286] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.303] GetCurrentThreadId () returned 0x980 [0092.303] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.314] GetCurrentThreadId () returned 0x980 [0092.315] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.321] GetCurrentThreadId () returned 0x980 [0092.321] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.335] GetCurrentThreadId () returned 0x980 [0092.335] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.341] GetCurrentThreadId () returned 0x980 [0092.342] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.357] GetCurrentThreadId () returned 0x980 [0092.357] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.360] GetCurrentThreadId () returned 0x980 [0092.360] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.378] GetCurrentThreadId () returned 0x980 [0092.378] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.389] GetCurrentThreadId () returned 0x980 [0092.389] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.399] GetCurrentThreadId () returned 0x980 [0092.399] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.401] GetCurrentThreadId () returned 0x980 [0092.402] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.428] GetCurrentThreadId () returned 0x980 [0092.428] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.440] GetCurrentThreadId () returned 0x980 [0092.443] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.451] GetCurrentThreadId () returned 0x980 [0092.451] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.478] GetCurrentThreadId () returned 0x980 [0092.478] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.481] GetCurrentThreadId () returned 0x980 [0092.481] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.511] GetCurrentThreadId () returned 0x980 [0092.511] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.526] GetCurrentThreadId () returned 0x980 [0092.527] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.553] GetCurrentThreadId () returned 0x980 [0092.553] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.557] GetCurrentThreadId () returned 0x980 [0092.557] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.568] GetCurrentThreadId () returned 0x980 [0092.568] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.586] GetCurrentThreadId () returned 0x980 [0092.586] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.597] GetCurrentThreadId () returned 0x980 [0092.598] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.610] GetCurrentThreadId () returned 0x980 [0092.610] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.621] GetCurrentThreadId () returned 0x980 [0092.621] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.633] GetCurrentThreadId () returned 0x980 [0092.633] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.635] GetCurrentThreadId () returned 0x980 [0092.635] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.653] GetCurrentThreadId () returned 0x980 [0092.653] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.663] GetCurrentThreadId () returned 0x980 [0092.663] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.674] GetCurrentThreadId () returned 0x980 [0092.674] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.676] GetCurrentThreadId () returned 0x980 [0092.676] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.679] GetCurrentThreadId () returned 0x980 [0092.679] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.681] GetCurrentThreadId () returned 0x980 [0092.681] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.684] GetCurrentThreadId () returned 0x980 [0092.684] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.704] GetCurrentThreadId () returned 0x980 [0092.704] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.718] GetCurrentThreadId () returned 0x980 [0092.718] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.721] GetCurrentThreadId () returned 0x980 [0092.721] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.748] GetCurrentThreadId () returned 0x980 [0092.748] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.758] GetCurrentThreadId () returned 0x980 [0092.758] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.771] GetCurrentThreadId () returned 0x980 [0092.771] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.782] GetCurrentThreadId () returned 0x980 [0092.782] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.796] GetCurrentThreadId () returned 0x980 [0092.796] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.799] GetCurrentThreadId () returned 0x980 [0092.799] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.822] GetCurrentThreadId () returned 0x980 [0092.822] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.834] GetCurrentThreadId () returned 0x980 [0092.834] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.843] GetCurrentThreadId () returned 0x980 [0092.843] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.861] GetCurrentThreadId () returned 0x980 [0092.862] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.883] GetCurrentThreadId () returned 0x980 [0092.883] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.893] GetCurrentThreadId () returned 0x980 [0092.893] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.899] GetCurrentThreadId () returned 0x980 [0092.899] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.909] GetCurrentThreadId () returned 0x980 [0092.909] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.939] GetCurrentThreadId () returned 0x980 [0092.939] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.943] GetCurrentThreadId () returned 0x980 [0092.944] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.973] GetCurrentThreadId () returned 0x980 [0092.973] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.976] GetCurrentThreadId () returned 0x980 [0092.976] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0092.987] GetCurrentThreadId () returned 0x980 [0092.987] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.009] GetCurrentThreadId () returned 0x980 [0093.009] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.012] GetCurrentThreadId () returned 0x980 [0093.012] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.089] GetCurrentThreadId () returned 0x980 [0093.089] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.101] GetCurrentThreadId () returned 0x980 [0093.101] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.106] GetCurrentThreadId () returned 0x980 [0093.106] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.121] GetCurrentThreadId () returned 0x980 [0093.121] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.138] GetCurrentThreadId () returned 0x980 [0093.138] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.142] GetCurrentThreadId () returned 0x980 [0093.142] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.302] GetCurrentThreadId () returned 0x980 [0093.303] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.323] GetCurrentThreadId () returned 0x980 [0093.323] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.325] GetCurrentThreadId () returned 0x980 [0093.325] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.345] GetCurrentThreadId () returned 0x980 [0093.346] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.356] GetCurrentThreadId () returned 0x980 [0093.356] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.358] GetCurrentThreadId () returned 0x980 [0093.358] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.377] GetCurrentThreadId () returned 0x980 [0093.377] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.382] GetCurrentThreadId () returned 0x980 [0093.382] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.382] GetCurrentThreadId () returned 0x980 [0093.382] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.401] GetCurrentThreadId () returned 0x980 [0093.401] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.412] GetCurrentThreadId () returned 0x980 [0093.412] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.414] GetCurrentThreadId () returned 0x980 [0093.415] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.417] GetCurrentThreadId () returned 0x980 [0093.417] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.424] GetCurrentThreadId () returned 0x980 [0093.424] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.436] GetCurrentThreadId () returned 0x980 [0093.436] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.441] GetCurrentThreadId () returned 0x980 [0093.441] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.473] GetCurrentThreadId () returned 0x980 [0093.473] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.507] GetCurrentThreadId () returned 0x980 [0093.507] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.526] GetCurrentThreadId () returned 0x980 [0093.526] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.538] GetCurrentThreadId () returned 0x980 [0093.538] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.556] GetCurrentThreadId () returned 0x980 [0093.556] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.560] GetCurrentThreadId () returned 0x980 [0093.560] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.569] GetCurrentThreadId () returned 0x980 [0093.569] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.591] GetCurrentThreadId () returned 0x980 [0093.591] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.601] GetCurrentThreadId () returned 0x980 [0093.601] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.614] GetCurrentThreadId () returned 0x980 [0093.614] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.657] GetCurrentThreadId () returned 0x980 [0093.657] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.668] GetCurrentThreadId () returned 0x980 [0093.668] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.719] GetCurrentThreadId () returned 0x980 [0093.719] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.727] GetCurrentThreadId () returned 0x980 [0093.728] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.748] GetCurrentThreadId () returned 0x980 [0093.748] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.751] GetCurrentThreadId () returned 0x980 [0093.751] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.754] GetCurrentThreadId () returned 0x980 [0093.754] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.772] GetCurrentThreadId () returned 0x980 [0093.772] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.788] GetCurrentThreadId () returned 0x980 [0093.788] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.803] GetCurrentThreadId () returned 0x980 [0093.803] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.814] GetCurrentThreadId () returned 0x980 [0093.814] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.824] GetCurrentThreadId () returned 0x980 [0093.824] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.851] GetCurrentThreadId () returned 0x980 [0093.851] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.866] GetCurrentThreadId () returned 0x980 [0093.866] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.869] GetCurrentThreadId () returned 0x980 [0093.869] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.878] GetCurrentThreadId () returned 0x980 [0093.878] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.890] GetCurrentThreadId () returned 0x980 [0093.890] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.905] GetCurrentThreadId () returned 0x980 [0093.905] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.923] GetCurrentThreadId () returned 0x980 [0093.923] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.963] GetCurrentThreadId () returned 0x980 [0093.963] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.976] GetCurrentThreadId () returned 0x980 [0093.976] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.985] GetCurrentThreadId () returned 0x980 [0093.985] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0093.992] GetCurrentThreadId () returned 0x980 [0093.992] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.010] GetCurrentThreadId () returned 0x980 [0094.010] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.023] GetCurrentThreadId () returned 0x980 [0094.023] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.026] GetCurrentThreadId () returned 0x980 [0094.026] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.046] GetCurrentThreadId () returned 0x980 [0094.046] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.063] GetCurrentThreadId () returned 0x980 [0094.063] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.065] GetCurrentThreadId () returned 0x980 [0094.065] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.088] GetCurrentThreadId () returned 0x980 [0094.088] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.099] GetCurrentThreadId () returned 0x980 [0094.099] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.113] GetCurrentThreadId () returned 0x980 [0094.113] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.124] GetCurrentThreadId () returned 0x980 [0094.124] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.135] GetCurrentThreadId () returned 0x980 [0094.136] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.142] GetCurrentThreadId () returned 0x980 [0094.142] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.145] GetCurrentThreadId () returned 0x980 [0094.145] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.172] GetCurrentThreadId () returned 0x980 [0094.172] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.186] GetCurrentThreadId () returned 0x980 [0094.186] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.191] GetCurrentThreadId () returned 0x980 [0094.191] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.194] GetCurrentThreadId () returned 0x980 [0094.194] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.199] GetCurrentThreadId () returned 0x980 [0094.199] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.221] GetCurrentThreadId () returned 0x980 [0094.221] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.235] GetCurrentThreadId () returned 0x980 [0094.235] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.246] GetCurrentThreadId () returned 0x980 [0094.246] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.250] GetCurrentThreadId () returned 0x980 [0094.250] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.254] GetCurrentThreadId () returned 0x980 [0094.254] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.267] GetCurrentThreadId () returned 0x980 [0094.267] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.274] GetCurrentThreadId () returned 0x980 [0094.274] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.289] GetCurrentThreadId () returned 0x980 [0094.290] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.303] GetCurrentThreadId () returned 0x980 [0094.303] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.333] GetCurrentThreadId () returned 0x980 [0094.333] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.349] GetCurrentThreadId () returned 0x980 [0094.349] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.359] GetCurrentThreadId () returned 0x980 [0094.359] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.501] GetCurrentThreadId () returned 0x980 [0094.501] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.535] GetCurrentThreadId () returned 0x980 [0094.535] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.570] GetCurrentThreadId () returned 0x980 [0094.570] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.573] GetCurrentThreadId () returned 0x980 [0094.573] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.584] GetCurrentThreadId () returned 0x980 [0094.584] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.594] GetCurrentThreadId () returned 0x980 [0094.594] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.598] GetCurrentThreadId () returned 0x980 [0094.598] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.635] GetCurrentThreadId () returned 0x980 [0094.635] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.647] GetCurrentThreadId () returned 0x980 [0094.647] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.658] GetCurrentThreadId () returned 0x980 [0094.658] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.658] GetCurrentThreadId () returned 0x980 [0094.658] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.679] GetCurrentThreadId () returned 0x980 [0094.679] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.690] GetCurrentThreadId () returned 0x980 [0094.690] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.721] GetCurrentThreadId () returned 0x980 [0094.721] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.722] GetCurrentThreadId () returned 0x980 [0094.722] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.734] GetCurrentThreadId () returned 0x980 [0094.734] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.750] GetCurrentThreadId () returned 0x980 [0094.750] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.756] GetCurrentThreadId () returned 0x980 [0094.756] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.772] GetCurrentThreadId () returned 0x980 [0094.772] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.785] GetCurrentThreadId () returned 0x980 [0094.785] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.811] GetCurrentThreadId () returned 0x980 [0094.811] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.821] GetCurrentThreadId () returned 0x980 [0094.822] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.829] GetCurrentThreadId () returned 0x980 [0094.829] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.844] GetCurrentThreadId () returned 0x980 [0094.844] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.861] GetCurrentThreadId () returned 0x980 [0094.861] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.894] GetCurrentThreadId () returned 0x980 [0094.894] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.959] GetCurrentThreadId () returned 0x980 [0094.960] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0094.984] GetCurrentThreadId () returned 0x980 [0094.984] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.003] GetCurrentThreadId () returned 0x980 [0095.003] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.016] GetCurrentThreadId () returned 0x980 [0095.016] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.035] GetCurrentThreadId () returned 0x980 [0095.035] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.037] GetCurrentThreadId () returned 0x980 [0095.037] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.061] GetCurrentThreadId () returned 0x980 [0095.061] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.093] GetCurrentThreadId () returned 0x980 [0095.093] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.136] GetCurrentThreadId () returned 0x980 [0095.136] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.165] GetCurrentThreadId () returned 0x980 [0095.165] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.172] GetCurrentThreadId () returned 0x980 [0095.172] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.197] GetCurrentThreadId () returned 0x980 [0095.197] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.206] GetCurrentThreadId () returned 0x980 [0095.206] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.227] GetCurrentThreadId () returned 0x980 [0095.227] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.257] GetCurrentThreadId () returned 0x980 [0095.257] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.266] GetCurrentThreadId () returned 0x980 [0095.266] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.314] GetCurrentThreadId () returned 0x980 [0095.325] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.345] GetCurrentThreadId () returned 0x980 [0095.345] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.345] GetCurrentThreadId () returned 0x980 [0095.345] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.374] GetCurrentThreadId () returned 0x980 [0095.374] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.417] GetCurrentThreadId () returned 0x980 [0095.417] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.435] GetCurrentThreadId () returned 0x980 [0095.435] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.466] GetCurrentThreadId () returned 0x980 [0095.466] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.480] GetCurrentThreadId () returned 0x980 [0095.480] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.500] GetCurrentThreadId () returned 0x980 [0095.500] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.513] GetCurrentThreadId () returned 0x980 [0095.513] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.524] GetCurrentThreadId () returned 0x980 [0095.524] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.560] GetCurrentThreadId () returned 0x980 [0095.560] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.597] GetCurrentThreadId () returned 0x980 [0095.597] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.628] GetCurrentThreadId () returned 0x980 [0095.628] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.666] GetCurrentThreadId () returned 0x980 [0095.667] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.692] GetCurrentThreadId () returned 0x980 [0095.692] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.702] GetCurrentThreadId () returned 0x980 [0095.702] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.733] GetCurrentThreadId () returned 0x980 [0095.733] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.749] GetCurrentThreadId () returned 0x980 [0095.749] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.768] GetCurrentThreadId () returned 0x980 [0095.768] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.774] GetCurrentThreadId () returned 0x980 [0095.774] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.830] GetCurrentThreadId () returned 0x980 [0095.830] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.860] GetCurrentThreadId () returned 0x980 [0095.860] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.902] GetCurrentThreadId () returned 0x980 [0095.902] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.988] GetCurrentThreadId () returned 0x980 [0095.988] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0095.991] GetCurrentThreadId () returned 0x980 [0095.991] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.032] GetCurrentThreadId () returned 0x980 [0096.032] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.044] GetCurrentThreadId () returned 0x980 [0096.044] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.072] GetCurrentThreadId () returned 0x980 [0096.072] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.086] GetCurrentThreadId () returned 0x980 [0096.086] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.098] GetCurrentThreadId () returned 0x980 [0096.098] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.104] GetCurrentThreadId () returned 0x980 [0096.104] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.120] GetCurrentThreadId () returned 0x980 [0096.120] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.148] GetCurrentThreadId () returned 0x980 [0096.148] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.176] GetCurrentThreadId () returned 0x980 [0096.176] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.194] GetCurrentThreadId () returned 0x980 [0096.194] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.206] GetCurrentThreadId () returned 0x980 [0096.206] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.206] GetCurrentThreadId () returned 0x980 [0096.206] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.242] GetCurrentThreadId () returned 0x980 [0096.242] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.283] GetCurrentThreadId () returned 0x980 [0096.283] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.293] GetCurrentThreadId () returned 0x980 [0096.293] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.303] GetCurrentThreadId () returned 0x980 [0096.303] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.307] GetCurrentThreadId () returned 0x980 [0096.307] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.326] GetCurrentThreadId () returned 0x980 [0096.326] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.338] GetCurrentThreadId () returned 0x980 [0096.338] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.358] GetCurrentThreadId () returned 0x980 [0096.358] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.360] GetCurrentThreadId () returned 0x980 [0096.360] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.418] GetCurrentThreadId () returned 0x980 [0096.418] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.423] GetCurrentThreadId () returned 0x980 [0096.423] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.460] GetCurrentThreadId () returned 0x980 [0096.460] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.471] GetCurrentThreadId () returned 0x980 [0096.471] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.471] GetCurrentThreadId () returned 0x980 [0096.471] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.490] GetCurrentThreadId () returned 0x980 [0096.490] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.490] GetCurrentThreadId () returned 0x980 [0096.490] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.497] GetCurrentThreadId () returned 0x980 [0096.498] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.540] GetCurrentThreadId () returned 0x980 [0096.540] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.552] GetCurrentThreadId () returned 0x980 [0096.552] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.575] GetCurrentThreadId () returned 0x980 [0096.575] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.591] GetCurrentThreadId () returned 0x980 [0096.591] SleepConditionVariableSRW (in: ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e828, SRWLock=0x27e854) returned 1 [0096.598] GetCurrentThreadId () returned 0x980 [0096.598] SleepConditionVariableSRW (ConditionVariable=0x27e828, SRWLock=0x27e854, dwMilliseconds=0xffffffff, Flags=0x0) Thread: id = 2 os_tid = 0x984 [0029.172] VirtualAlloc (lpAddress=0x0, dwSize=0x60e, flAllocationType=0x3000, flProtect=0x40) returned 0x1a0000 [0029.172] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0029.173] WinExec (lpCmdLine="vssadmin delete shadows /all /quiet", uCmdShow=0x0) returned 0x21 Thread: id = 3 os_tid = 0x988 Thread: id = 4 os_tid = 0x98c [0029.537] GetLastError () returned 0x57 [0029.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x364) returned 0x27b658 [0029.537] SetLastError (dwErrCode=0x57) [0029.537] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.537] GetLastError () returned 0x57 [0029.538] GetCurrentThreadId () returned 0x98c [0029.538] GetCurrentThreadId () returned 0x98c [0029.538] RtlWakeConditionVariable () returned 0x1 [0029.539] GetCurrentThreadId () returned 0x98c [0029.539] GetCurrentThreadId () returned 0x98c [0029.539] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.766] GetCurrentThreadId () returned 0x98c [0029.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a15d0 [0029.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f8 | out: hHeap=0x260000) returned 1 [0029.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.767] lstrlenW (lpString=".ldf") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".ldf") returned 0x0 [0029.767] lstrlenW (lpString=".vhd") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".vhd") returned 0x0 [0029.767] lstrlenW (lpString=".vhdx") returned 5 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".vhdx") returned 0x0 [0029.767] lstrlenW (lpString=".pst") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".pst") returned 0x0 [0029.767] lstrlenW (lpString=".ost") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".ost") returned 0x0 [0029.767] lstrlenW (lpString=".bak") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".bak") returned 0x0 [0029.767] lstrlenW (lpString=".bac") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".bac") returned 0x0 [0029.767] lstrlenW (lpString=".sys") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".sys") returned 0x0 [0029.767] lstrlenW (lpString=".v2i") returned 4 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch=".v2i") returned 0x0 [0029.767] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.767] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\.", lpSrch="s\r\n.v2i") returned 0x0 [0029.767] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\." (normalized: "c:\\$recycle.bin\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a15d0 | out: hHeap=0x260000) returned 1 [0029.768] RtlWakeConditionVariable () returned 0x27e828 [0029.768] GetCurrentThreadId () returned 0x98c [0029.768] GetCurrentThreadId () returned 0x98c [0029.768] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.776] GetCurrentThreadId () returned 0x98c [0029.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3e40 [0029.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3d98 | out: hHeap=0x260000) returned 1 [0029.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a15d0 | out: hHeap=0x260000) returned 1 [0029.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3d98 [0029.776] lstrlenW (lpString=".ldf") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".ldf") returned 0x0 [0029.776] lstrlenW (lpString=".vhd") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".vhd") returned 0x0 [0029.776] lstrlenW (lpString=".vhdx") returned 5 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".vhdx") returned 0x0 [0029.776] lstrlenW (lpString=".pst") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".pst") returned 0x0 [0029.776] lstrlenW (lpString=".ost") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".ost") returned 0x0 [0029.776] lstrlenW (lpString=".bak") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".bak") returned 0x0 [0029.776] lstrlenW (lpString=".bac") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".bac") returned 0x0 [0029.776] lstrlenW (lpString=".sys") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".sys") returned 0x0 [0029.776] lstrlenW (lpString=".v2i") returned 4 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".v2i") returned 0x0 [0029.776] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.776] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch="s\r\n.v2i") returned 0x0 [0029.776] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0029.777] lstrlenW (lpString=".sql") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".sql") returned 0x0 [0029.777] lstrlenW (lpString=".mdf") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".mdf") returned 0x0 [0029.777] lstrlenW (lpString=".txt") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".txt") returned 0x0 [0029.777] lstrlenW (lpString=".dbf") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".dbf") returned 0x0 [0029.777] lstrlenW (lpString=".ckp") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".ckp") returned 0x0 [0029.777] lstrlenW (lpString=".dacpac") returned 7 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".dacpac") returned 0x0 [0029.777] lstrlenW (lpString=".db3") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".db3") returned 0x0 [0029.777] lstrlenW (lpString=".dtxs") returned 5 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".dtxs") returned 0x0 [0029.777] lstrlenW (lpString=".mdt") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".mdt") returned 0x0 [0029.777] lstrlenW (lpString=".sdf") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".sdf") returned 0x0 [0029.777] lstrlenW (lpString=".MDF") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".MDF") returned 0x0 [0029.777] lstrlenW (lpString=".DBF") returned 4 [0029.777] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".DBF") returned 0x0 [0029.778] lstrlenW (lpString=".DB") returned 3 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".DB") returned 0x0 [0029.778] lstrlenW (lpString=".db") returned 3 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".db") returned 0x0 [0029.778] lstrlenW (lpString=".ndf") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".ndf") returned 0x0 [0029.778] lstrlenW (lpString=".NDF") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".NDF") returned 0x0 [0029.778] lstrlenW (lpString=".Mdf") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".Mdf") returned 0x0 [0029.778] lstrlenW (lpString=".dat") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".dat") returned 0x0 [0029.778] lstrlenW (lpString=".DAT") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".DAT") returned 0x0 [0029.778] lstrlenW (lpString=".ldf") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".ldf") returned 0x0 [0029.778] lstrlenW (lpString=".LDF") returned 4 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch=".LDF") returned 0x0 [0029.778] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0029.778] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0029.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3ee8 [0029.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef48 [0029.778] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d118) returned 1 [0029.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef48 | out: pbBuffer=0x27ef48) returned 1 [0029.780] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0029.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef48 | out: hHeap=0x260000) returned 1 [0029.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0029.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2b4238 [0029.780] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=14978133537) returned 1 [0029.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa24c0c30, dwHighDateTime=0x1d585b4)) [0029.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0029.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a15d0 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e100 [0029.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a15d0 | out: hHeap=0x260000) returned 1 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x1008) returned 0x2b5450 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x18) returned 0x279308 [0029.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5450 | out: hHeap=0x260000) returned 1 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x1a) returned 0x27ef48 [0029.781] RtlInterlockedPushEntrySList (in: ListHead=0x480870, ListEntry=0x27ef48 | out: ListHead=0x480870, ListEntry=0x27ef48) returned 0x0 [0029.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d118 [0029.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e100 | out: hHeap=0x260000) returned 1 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x1008) returned 0x2b5450 [0029.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x28) returned 0x279d58 [0029.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5450 | out: hHeap=0x260000) returned 1 [0029.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x2c) returned 0x2a15d0 [0029.782] RtlInterlockedPushEntrySList (in: ListHead=0x480870, ListEntry=0x2a15d0 | out: ListHead=0x480870, ListEntry=0x2a15d0) returned 0x27ef48 [0029.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279d58 | out: hHeap=0x260000) returned 1 [0029.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b4020 [0029.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0029.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0029.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4020 | out: hHeap=0x260000) returned 1 [0029.782] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0029.784] GetLastError () returned 0x0 [0029.785] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0029.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x279d58 [0029.785] SetLastError (dwErrCode=0x0) [0029.785] GetLastError () returned 0x0 [0029.785] SetLastError (dwErrCode=0x0) [0029.785] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0029.785] GetLastError () returned 0x0 [0029.785] SetLastError (dwErrCode=0x0) [0029.785] GetLastError () returned 0x0 [0029.785] SetLastError (dwErrCode=0x0) [0029.785] GetLastError () returned 0x0 [0029.785] SetLastError (dwErrCode=0x0) [0029.785] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.786] SetLastError (dwErrCode=0x0) [0029.786] GetLastError () returned 0x0 [0029.787] SetLastError (dwErrCode=0x0) [0029.787] GetLastError () returned 0x0 [0029.787] SetLastError (dwErrCode=0x0) [0029.787] GetLastError () returned 0x0 [0029.787] SetLastError (dwErrCode=0x0) [0029.787] GetLastError () returned 0x0 [0029.787] SetLastError (dwErrCode=0x0) [0029.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0029.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2b5450 [0029.787] ReadFile (in: hFile=0xf0, lpBuffer=0x2b5450, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b5450*, lpNumberOfBytesRead=0x224fdb0*=0x81, lpOverlapped=0x0) returned 1 [0029.789] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0029.789] WriteFile (in: hFile=0xf0, lpBuffer=0x2b5450*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b5450*, lpNumberOfBytesWritten=0x224fdb0*=0x81, lpOverlapped=0x0) returned 1 [0029.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5450 | out: hHeap=0x260000) returned 1 [0029.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.790] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0029.790] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0029.790] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0029.790] CloseHandle (hObject=0xf0) returned 1 [0029.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b4020 [0029.791] MoveFileW (lpExistingFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), lpNewFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.[deadmin@cock.li].deadmin")) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4020 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0029.812] GetLastError () returned 0x0 [0029.812] SetLastError (dwErrCode=0x0) [0029.812] GetLastError () returned 0x0 [0029.812] SetLastError (dwErrCode=0x0) [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ee8 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3d98 | out: hHeap=0x260000) returned 1 [0029.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e40 | out: hHeap=0x260000) returned 1 [0029.812] RtlWakeConditionVariable () returned 0x27e828 [0029.812] GetCurrentThreadId () returned 0x98c [0029.812] GetCurrentThreadId () returned 0x98c [0029.812] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.826] GetCurrentThreadId () returned 0x98c [0029.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0029.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efe8 | out: hHeap=0x260000) returned 1 [0029.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efe8 [0029.827] lstrlenW (lpString=".ldf") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".ldf") returned 0x0 [0029.827] lstrlenW (lpString=".vhd") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".vhd") returned 0x0 [0029.827] lstrlenW (lpString=".vhdx") returned 5 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".vhdx") returned 0x0 [0029.827] lstrlenW (lpString=".pst") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".pst") returned 0x0 [0029.827] lstrlenW (lpString=".ost") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".ost") returned 0x0 [0029.827] lstrlenW (lpString=".bak") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".bak") returned 0x0 [0029.827] lstrlenW (lpString=".bac") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".bac") returned 0x0 [0029.827] lstrlenW (lpString=".sys") returned 4 [0029.827] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".sys") returned 0x0 [0029.827] lstrlenW (lpString=".v2i") returned 4 [0029.828] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch=".v2i") returned 0x0 [0029.828] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.828] StrStrW (lpFirst="\\\\?\\C:\\Boot\\..", lpSrch="s\r\n.v2i") returned 0x0 [0029.828] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efe8 | out: hHeap=0x260000) returned 1 [0029.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0029.828] RtlWakeConditionVariable () returned 0x27e828 [0029.828] GetCurrentThreadId () returned 0x98c [0029.828] GetCurrentThreadId () returned 0x98c [0029.828] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.845] GetCurrentThreadId () returned 0x98c [0029.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0029.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0029.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0029.845] lstrlenW (lpString=".ldf") returned 4 [0029.845] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".ldf") returned 0x0 [0029.845] lstrlenW (lpString=".vhd") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".vhd") returned 0x0 [0029.846] lstrlenW (lpString=".vhdx") returned 5 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".vhdx") returned 0x0 [0029.846] lstrlenW (lpString=".pst") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".pst") returned 0x0 [0029.846] lstrlenW (lpString=".ost") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".ost") returned 0x0 [0029.846] lstrlenW (lpString=".bak") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".bak") returned 0x0 [0029.846] lstrlenW (lpString=".bac") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".bac") returned 0x0 [0029.846] lstrlenW (lpString=".sys") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".sys") returned 0x0 [0029.846] lstrlenW (lpString=".v2i") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".v2i") returned 0x0 [0029.846] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch="s\r\n.v2i") returned 0x0 [0029.846] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.846] lstrlenW (lpString=".sql") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".sql") returned 0x0 [0029.846] lstrlenW (lpString=".mdf") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".mdf") returned 0x0 [0029.846] lstrlenW (lpString=".txt") returned 4 [0029.846] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".txt") returned 0x0 [0029.846] lstrlenW (lpString=".dbf") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".dbf") returned 0x0 [0029.847] lstrlenW (lpString=".ckp") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".ckp") returned 0x0 [0029.847] lstrlenW (lpString=".dacpac") returned 7 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".dacpac") returned 0x0 [0029.847] lstrlenW (lpString=".db3") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".db3") returned 0x0 [0029.847] lstrlenW (lpString=".dtxs") returned 5 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".dtxs") returned 0x0 [0029.847] lstrlenW (lpString=".mdt") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".mdt") returned 0x0 [0029.847] lstrlenW (lpString=".sdf") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".sdf") returned 0x0 [0029.847] lstrlenW (lpString=".MDF") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".MDF") returned 0x0 [0029.847] lstrlenW (lpString=".DBF") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".DBF") returned 0x0 [0029.847] lstrlenW (lpString=".DB") returned 3 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".DB") returned 0x0 [0029.847] lstrlenW (lpString=".db") returned 3 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".db") returned 0x0 [0029.847] lstrlenW (lpString=".ndf") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".ndf") returned 0x0 [0029.847] lstrlenW (lpString=".NDF") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".NDF") returned 0x0 [0029.847] lstrlenW (lpString=".Mdf") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".Mdf") returned 0x0 [0029.847] lstrlenW (lpString=".dat") returned 4 [0029.847] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".dat") returned 0x0 [0029.848] lstrlenW (lpString=".DAT") returned 4 [0029.848] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".DAT") returned 0x0 [0029.848] lstrlenW (lpString=".ldf") returned 4 [0029.848] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".ldf") returned 0x0 [0029.848] lstrlenW (lpString=".LDF") returned 4 [0029.848] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch=".LDF") returned 0x0 [0029.848] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0029.848] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG2", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0029.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0029.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0029.848] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e0c0) returned 1 [0029.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0029.849] CryptReleaseContext (hProv=0x27e0c0, dwFlags=0x0) returned 1 [0029.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0029.849] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=14985021353) returned 1 [0029.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa257f310, dwHighDateTime=0x1d585b4)) [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e0c0 [0029.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b2d90 [0029.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27e0c0 [0029.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b2d90 [0029.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0029.850] GetLastError () returned 0x0 [0029.850] SetLastError (dwErrCode=0x0) [0029.850] GetLastError () returned 0x0 [0029.850] SetLastError (dwErrCode=0x0) [0029.850] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0029.850] GetLastError () returned 0x0 [0029.850] SetLastError (dwErrCode=0x0) [0029.850] GetLastError () returned 0x0 [0029.850] SetLastError (dwErrCode=0x0) [0029.850] GetLastError () returned 0x0 [0029.850] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.851] SetLastError (dwErrCode=0x0) [0029.851] GetLastError () returned 0x0 [0029.852] SetLastError (dwErrCode=0x0) [0029.852] GetLastError () returned 0x0 [0029.852] SetLastError (dwErrCode=0x0) [0029.852] GetLastError () returned 0x0 [0029.852] SetLastError (dwErrCode=0x0) [0029.852] GetLastError () returned 0x0 [0029.852] SetLastError (dwErrCode=0x0) [0029.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2b4238 [0029.852] ReadFile (in: hFile=0xec, lpBuffer=0x2b4238, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesRead=0x224fdb0*=0x0, lpOverlapped=0x0) returned 1 [0029.852] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.852] WriteFile (in: hFile=0xec, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x0, lpOverlapped=0x0) returned 1 [0029.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.852] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.852] WriteFile (in: hFile=0xec, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0029.853] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0029.853] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0029.854] CloseHandle (hObject=0xec) returned 1 [0029.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0c0 [0029.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG2.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\boot\\bcd.log2.[deadmin@cock.li].deadmin")) returned 1 [0029.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0029.855] GetLastError () returned 0x0 [0029.855] SetLastError (dwErrCode=0x0) [0029.855] GetLastError () returned 0x0 [0029.856] SetLastError (dwErrCode=0x0) [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.856] RtlWakeConditionVariable () returned 0x27e828 [0029.856] GetCurrentThreadId () returned 0x98c [0029.856] GetCurrentThreadId () returned 0x98c [0029.856] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.881] GetCurrentThreadId () returned 0x98c [0029.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.881] lstrlenW (lpString=".ldf") returned 4 [0029.881] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.881] lstrlenW (lpString=".vhd") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.882] lstrlenW (lpString=".vhdx") returned 5 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.882] lstrlenW (lpString=".pst") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.882] lstrlenW (lpString=".ost") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.882] lstrlenW (lpString=".bak") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.882] lstrlenW (lpString=".bac") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.882] lstrlenW (lpString=".sys") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.882] lstrlenW (lpString=".v2i") returned 4 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.882] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.882] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.883] RtlWakeConditionVariable () returned 0x27e828 [0029.883] GetCurrentThreadId () returned 0x98c [0029.883] GetCurrentThreadId () returned 0x98c [0029.883] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.897] GetCurrentThreadId () returned 0x98c [0029.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.897] lstrlenW (lpString=".ldf") returned 4 [0029.897] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.897] lstrlenW (lpString=".vhd") returned 4 [0029.897] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.897] lstrlenW (lpString=".vhdx") returned 5 [0029.897] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.897] lstrlenW (lpString=".pst") returned 4 [0029.897] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.897] lstrlenW (lpString=".ost") returned 4 [0029.898] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.898] lstrlenW (lpString=".bak") returned 4 [0029.898] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.898] lstrlenW (lpString=".bac") returned 4 [0029.898] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.898] lstrlenW (lpString=".sys") returned 4 [0029.898] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.898] lstrlenW (lpString=".v2i") returned 4 [0029.898] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.898] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.898] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.898] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.899] RtlWakeConditionVariable () returned 0x27e828 [0029.899] GetCurrentThreadId () returned 0x98c [0029.899] GetCurrentThreadId () returned 0x98c [0029.899] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.908] GetCurrentThreadId () returned 0x98c [0029.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.908] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.910] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.910] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.910] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.911] WriteFile (in: hFile=0xec, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.912] CloseHandle (hObject=0xec) returned 1 [0029.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.912] RtlWakeConditionVariable () returned 0x27e828 [0029.912] GetCurrentThreadId () returned 0x98c [0029.912] GetCurrentThreadId () returned 0x98c [0029.912] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.992] GetCurrentThreadId () returned 0x98c [0029.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.993] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\fi-fi\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.993] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.993] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.993] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.993] WriteFile (in: hFile=0xec, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.994] CloseHandle (hObject=0xec) returned 1 [0029.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.995] RtlWakeConditionVariable () returned 0x27e828 [0029.995] GetCurrentThreadId () returned 0x98c [0029.995] GetCurrentThreadId () returned 0x98c [0029.995] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.005] GetCurrentThreadId () returned 0x98c [0030.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.005] lstrlenW (lpString=".ldf") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".ldf") returned 0x0 [0030.006] lstrlenW (lpString=".vhd") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".vhd") returned 0x0 [0030.006] lstrlenW (lpString=".vhdx") returned 5 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".vhdx") returned 0x0 [0030.006] lstrlenW (lpString=".pst") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".pst") returned 0x0 [0030.006] lstrlenW (lpString=".ost") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".ost") returned 0x0 [0030.006] lstrlenW (lpString=".bak") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".bak") returned 0x0 [0030.006] lstrlenW (lpString=".bac") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".bac") returned 0x0 [0030.006] lstrlenW (lpString=".sys") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".sys") returned 0x0 [0030.006] lstrlenW (lpString=".v2i") returned 4 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch=".v2i") returned 0x0 [0030.006] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.006] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf", lpSrch="s\r\n.v2i") returned 0x0 [0030.006] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.006] RtlWakeConditionVariable () returned 0x27e828 [0030.006] GetCurrentThreadId () returned 0x98c [0030.006] GetCurrentThreadId () returned 0x98c [0030.006] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.067] GetCurrentThreadId () returned 0x98c [0030.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.067] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\fr-fr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.067] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.068] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.068] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.068] WriteFile (in: hFile=0xec, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.068] CloseHandle (hObject=0xec) returned 1 [0030.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.069] RtlWakeConditionVariable () returned 0x27e828 [0030.069] GetCurrentThreadId () returned 0x98c [0030.069] GetCurrentThreadId () returned 0x98c [0030.069] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.079] GetCurrentThreadId () returned 0x98c [0030.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.080] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\it-it\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.080] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.080] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.080] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.080] WriteFile (in: hFile=0xec, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.081] CloseHandle (hObject=0xec) returned 1 [0030.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.081] RtlWakeConditionVariable () returned 0x27e828 [0030.081] GetCurrentThreadId () returned 0x98c [0030.081] GetCurrentThreadId () returned 0x98c [0030.081] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.100] GetCurrentThreadId () returned 0x98c [0030.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.100] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\ko-kr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.101] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.101] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.101] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.101] WriteFile (in: hFile=0xec, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.102] CloseHandle (hObject=0xec) returned 1 [0030.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.102] RtlWakeConditionVariable () returned 0x27e828 [0030.102] GetCurrentThreadId () returned 0x98c [0030.102] GetCurrentThreadId () returned 0x98c [0030.102] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.110] GetCurrentThreadId () returned 0x98c [0030.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.111] lstrlenW (lpString=".ldf") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.111] lstrlenW (lpString=".vhd") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.111] lstrlenW (lpString=".vhdx") returned 5 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.111] lstrlenW (lpString=".pst") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.111] lstrlenW (lpString=".ost") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.111] lstrlenW (lpString=".bak") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.111] lstrlenW (lpString=".bac") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.111] lstrlenW (lpString=".sys") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.111] lstrlenW (lpString=".v2i") returned 4 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.111] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.111] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.111] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.111] RtlWakeConditionVariable () returned 0x27e828 [0030.111] GetCurrentThreadId () returned 0x98c [0030.111] GetCurrentThreadId () returned 0x98c [0030.111] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.123] GetCurrentThreadId () returned 0x98c [0030.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.123] lstrlenW (lpString=".ldf") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.123] lstrlenW (lpString=".vhd") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.123] lstrlenW (lpString=".vhdx") returned 5 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.123] lstrlenW (lpString=".pst") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.123] lstrlenW (lpString=".ost") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.123] lstrlenW (lpString=".bak") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.123] lstrlenW (lpString=".bac") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.123] lstrlenW (lpString=".sys") returned 4 [0030.123] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.123] lstrlenW (lpString=".v2i") returned 4 [0030.124] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.124] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.124] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.124] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.124] RtlWakeConditionVariable () returned 0x27e828 [0030.124] GetCurrentThreadId () returned 0x98c [0030.124] GetCurrentThreadId () returned 0x98c [0030.124] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.133] GetCurrentThreadId () returned 0x98c [0030.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.133] lstrlenW (lpString=".ldf") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.133] lstrlenW (lpString=".vhd") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.133] lstrlenW (lpString=".vhdx") returned 5 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.133] lstrlenW (lpString=".pst") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.133] lstrlenW (lpString=".ost") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.133] lstrlenW (lpString=".bak") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.133] lstrlenW (lpString=".bac") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.133] lstrlenW (lpString=".sys") returned 4 [0030.133] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.134] lstrlenW (lpString=".v2i") returned 4 [0030.134] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.134] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.134] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.134] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.134] RtlWakeConditionVariable () returned 0x27e828 [0030.134] GetCurrentThreadId () returned 0x98c [0030.134] GetCurrentThreadId () returned 0x98c [0030.134] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.145] GetCurrentThreadId () returned 0x98c [0030.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.145] lstrlenW (lpString=".ldf") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.145] lstrlenW (lpString=".vhd") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.145] lstrlenW (lpString=".vhdx") returned 5 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.145] lstrlenW (lpString=".pst") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.145] lstrlenW (lpString=".ost") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.145] lstrlenW (lpString=".bak") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.145] lstrlenW (lpString=".bac") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.145] lstrlenW (lpString=".sys") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.145] lstrlenW (lpString=".v2i") returned 4 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.145] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.145] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.145] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.146] RtlWakeConditionVariable () returned 0x27e828 [0030.146] GetCurrentThreadId () returned 0x98c [0030.146] GetCurrentThreadId () returned 0x98c [0030.146] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.156] GetCurrentThreadId () returned 0x98c [0030.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.156] lstrlenW (lpString=".ldf") returned 4 [0030.156] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.156] lstrlenW (lpString=".vhd") returned 4 [0030.156] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.156] lstrlenW (lpString=".vhdx") returned 5 [0030.156] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.156] lstrlenW (lpString=".pst") returned 4 [0030.156] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.156] lstrlenW (lpString=".ost") returned 4 [0030.157] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.157] lstrlenW (lpString=".bak") returned 4 [0030.157] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.157] lstrlenW (lpString=".bac") returned 4 [0030.157] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.157] lstrlenW (lpString=".sys") returned 4 [0030.157] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.157] lstrlenW (lpString=".v2i") returned 4 [0030.157] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.157] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.157] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.157] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.157] RtlWakeConditionVariable () returned 0x27e828 [0030.157] GetCurrentThreadId () returned 0x98c [0030.157] GetCurrentThreadId () returned 0x98c [0030.157] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.164] GetCurrentThreadId () returned 0x98c [0030.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.165] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0030.165] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.165] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.165] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.165] WriteFile (in: hFile=0xe8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.166] CloseHandle (hObject=0xe8) returned 1 [0030.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.166] RtlWakeConditionVariable () returned 0x27e828 [0030.166] GetCurrentThreadId () returned 0x98c [0030.166] GetCurrentThreadId () returned 0x98c [0030.166] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.173] GetCurrentThreadId () returned 0x98c [0030.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.173] lstrlenW (lpString=".ldf") returned 4 [0030.173] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".ldf") returned 0x0 [0030.173] lstrlenW (lpString=".vhd") returned 4 [0030.173] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".vhd") returned 0x0 [0030.173] lstrlenW (lpString=".vhdx") returned 5 [0030.173] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".vhdx") returned 0x0 [0030.173] lstrlenW (lpString=".pst") returned 4 [0030.173] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".pst") returned 0x0 [0030.173] lstrlenW (lpString=".ost") returned 4 [0030.173] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".ost") returned 0x0 [0030.173] lstrlenW (lpString=".bak") returned 4 [0030.174] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".bak") returned 0x0 [0030.174] lstrlenW (lpString=".bac") returned 4 [0030.174] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".bac") returned 0x0 [0030.174] lstrlenW (lpString=".sys") returned 4 [0030.174] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".sys") returned 0x0 [0030.174] lstrlenW (lpString=".v2i") returned 4 [0030.174] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch=".v2i") returned 0x0 [0030.174] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.174] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\..", lpSrch="s\r\n.v2i") returned 0x0 [0030.174] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.174] RtlWakeConditionVariable () returned 0x27e828 [0030.174] GetCurrentThreadId () returned 0x98c [0030.174] GetCurrentThreadId () returned 0x98c [0030.174] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.181] GetCurrentThreadId () returned 0x98c [0030.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.181] lstrlenW (lpString=".ldf") returned 4 [0030.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".ldf") returned 0x0 [0030.181] lstrlenW (lpString=".vhd") returned 4 [0030.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".vhd") returned 0x0 [0030.181] lstrlenW (lpString=".vhdx") returned 5 [0030.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".vhdx") returned 0x0 [0030.181] lstrlenW (lpString=".pst") returned 4 [0030.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".pst") returned 0x0 [0030.181] lstrlenW (lpString=".ost") returned 4 [0030.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".ost") returned 0x0 [0030.181] lstrlenW (lpString=".bak") returned 4 [0030.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".bak") returned 0x0 [0030.182] lstrlenW (lpString=".bac") returned 4 [0030.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".bac") returned 0x0 [0030.182] lstrlenW (lpString=".sys") returned 4 [0030.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".sys") returned 0x0 [0030.182] lstrlenW (lpString=".v2i") returned 4 [0030.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch=".v2i") returned 0x0 [0030.182] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\..", lpSrch="s\r\n.v2i") returned 0x0 [0030.182] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.182] RtlWakeConditionVariable () returned 0x27e828 [0030.182] GetCurrentThreadId () returned 0x98c [0030.182] GetCurrentThreadId () returned 0x98c [0030.182] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.197] GetCurrentThreadId () returned 0x98c [0030.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b2d90 [0030.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.197] lstrlenW (lpString=".ldf") returned 4 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0030.197] lstrlenW (lpString=".vhd") returned 4 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0030.197] lstrlenW (lpString=".vhdx") returned 5 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0030.197] lstrlenW (lpString=".pst") returned 4 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0030.197] lstrlenW (lpString=".ost") returned 4 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0030.197] lstrlenW (lpString=".bak") returned 4 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0030.197] lstrlenW (lpString=".bac") returned 4 [0030.197] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0030.197] lstrlenW (lpString=".sys") returned 4 [0030.198] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0030.198] lstrlenW (lpString=".v2i") returned 4 [0030.198] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0030.198] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.198] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0030.198] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0030.198] RtlWakeConditionVariable () returned 0x27e828 [0030.198] GetCurrentThreadId () returned 0x98c [0030.198] GetCurrentThreadId () returned 0x98c [0030.198] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.297] GetCurrentThreadId () returned 0x98c [0030.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3ca0 [0030.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3bf8 [0030.297] lstrlenW (lpString=".ldf") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0030.297] lstrlenW (lpString=".vhd") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0030.297] lstrlenW (lpString=".vhdx") returned 5 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0030.297] lstrlenW (lpString=".pst") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0030.297] lstrlenW (lpString=".ost") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0030.297] lstrlenW (lpString=".bak") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0030.297] lstrlenW (lpString=".bac") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0030.297] lstrlenW (lpString=".sys") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0030.297] lstrlenW (lpString=".v2i") returned 4 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0030.297] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0030.297] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.298] lstrlenW (lpString=".sql") returned 4 [0030.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0030.298] lstrlenW (lpString=".mdf") returned 4 [0030.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0030.298] lstrlenW (lpString=".txt") returned 4 [0030.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0030.298] lstrlenW (lpString=".dbf") returned 4 [0030.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0030.298] lstrlenW (lpString=".ckp") returned 4 [0030.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0030.298] lstrlenW (lpString=".dacpac") returned 7 [0030.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0030.298] lstrlenW (lpString=".db3") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0030.299] lstrlenW (lpString=".dtxs") returned 5 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0030.299] lstrlenW (lpString=".mdt") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0030.299] lstrlenW (lpString=".sdf") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0030.299] lstrlenW (lpString=".MDF") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0030.299] lstrlenW (lpString=".DBF") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0030.299] lstrlenW (lpString=".DB") returned 3 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0030.299] lstrlenW (lpString=".db") returned 3 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0030.299] lstrlenW (lpString=".ndf") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0030.299] lstrlenW (lpString=".NDF") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0030.299] lstrlenW (lpString=".Mdf") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0030.299] lstrlenW (lpString=".dat") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0030.299] lstrlenW (lpString=".DAT") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0030.299] lstrlenW (lpString=".ldf") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0030.299] lstrlenW (lpString=".LDF") returned 4 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0030.299] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0030.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.299] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d118) returned 1 [0030.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.300] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0030.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0030.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x293798 [0030.300] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15030153319) returned 1 [0030.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa29cfaf0, dwHighDateTime=0x1d585b4)) [0030.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d118 [0030.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3f48 [0030.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3fc0 [0030.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f48 | out: hHeap=0x260000) returned 1 [0030.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0030.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fc0 | out: hHeap=0x260000) returned 1 [0030.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0030.301] GetLastError () returned 0x0 [0030.301] SetLastError (dwErrCode=0x0) [0030.301] GetLastError () returned 0x0 [0030.301] SetLastError (dwErrCode=0x0) [0030.301] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0030.301] GetLastError () returned 0x0 [0030.301] SetLastError (dwErrCode=0x0) [0030.301] GetLastError () returned 0x0 [0030.301] SetLastError (dwErrCode=0x0) [0030.301] GetLastError () returned 0x0 [0030.301] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.302] SetLastError (dwErrCode=0x0) [0030.302] GetLastError () returned 0x0 [0030.303] SetLastError (dwErrCode=0x0) [0030.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.303] ReadFile (in: hFile=0xfc, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x224fdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0030.306] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.306] WriteFile (in: hFile=0xfc, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x224fdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0030.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.306] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.306] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.306] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.306] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.306] CloseHandle (hObject=0xfc) returned 1 [0030.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27d070 [0030.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.309] GetLastError () returned 0x0 [0030.309] SetLastError (dwErrCode=0x0) [0030.309] GetLastError () returned 0x0 [0030.309] SetLastError (dwErrCode=0x0) [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293798 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ca0 | out: hHeap=0x260000) returned 1 [0030.309] RtlWakeConditionVariable () returned 0x27e828 [0030.309] GetCurrentThreadId () returned 0x98c [0030.309] GetCurrentThreadId () returned 0x98c [0030.309] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.717] GetCurrentThreadId () returned 0x98c [0030.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3e10 [0030.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.718] lstrlenW (lpString=".ldf") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0030.718] lstrlenW (lpString=".vhd") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0030.718] lstrlenW (lpString=".vhdx") returned 5 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0030.718] lstrlenW (lpString=".pst") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0030.718] lstrlenW (lpString=".ost") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0030.718] lstrlenW (lpString=".bak") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0030.718] lstrlenW (lpString=".bac") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0030.718] lstrlenW (lpString=".sys") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0030.718] lstrlenW (lpString=".v2i") returned 4 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0030.718] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.718] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0030.718] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.718] RtlWakeConditionVariable () returned 0x27e828 [0030.718] GetCurrentThreadId () returned 0x98c [0030.718] GetCurrentThreadId () returned 0x98c [0030.718] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.788] GetCurrentThreadId () returned 0x98c [0030.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3970 [0030.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x27d070 [0030.789] lstrlenW (lpString=".ldf") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".ldf") returned 0x0 [0030.789] lstrlenW (lpString=".vhd") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".vhd") returned 0x0 [0030.789] lstrlenW (lpString=".vhdx") returned 5 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".vhdx") returned 0x0 [0030.789] lstrlenW (lpString=".pst") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".pst") returned 0x0 [0030.789] lstrlenW (lpString=".ost") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".ost") returned 0x0 [0030.789] lstrlenW (lpString=".bak") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".bak") returned 0x0 [0030.789] lstrlenW (lpString=".bac") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".bac") returned 0x0 [0030.789] lstrlenW (lpString=".sys") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".sys") returned 0x0 [0030.789] lstrlenW (lpString=".v2i") returned 4 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".v2i") returned 0x0 [0030.789] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.789] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0030.789] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.790] lstrlenW (lpString=".sql") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".sql") returned 0x0 [0030.790] lstrlenW (lpString=".mdf") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".mdf") returned 0x0 [0030.790] lstrlenW (lpString=".txt") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".txt") returned 0x0 [0030.790] lstrlenW (lpString=".dbf") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".dbf") returned 0x0 [0030.790] lstrlenW (lpString=".ckp") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".ckp") returned 0x0 [0030.790] lstrlenW (lpString=".dacpac") returned 7 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".dacpac") returned 0x0 [0030.790] lstrlenW (lpString=".db3") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".db3") returned 0x0 [0030.790] lstrlenW (lpString=".dtxs") returned 5 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".dtxs") returned 0x0 [0030.790] lstrlenW (lpString=".mdt") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".mdt") returned 0x0 [0030.790] lstrlenW (lpString=".sdf") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".sdf") returned 0x0 [0030.790] lstrlenW (lpString=".MDF") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".MDF") returned 0x0 [0030.790] lstrlenW (lpString=".DBF") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".DBF") returned 0x0 [0030.790] lstrlenW (lpString=".DB") returned 3 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".DB") returned 0x0 [0030.790] lstrlenW (lpString=".db") returned 3 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".db") returned 0x0 [0030.790] lstrlenW (lpString=".ndf") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".ndf") returned 0x0 [0030.790] lstrlenW (lpString=".NDF") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".NDF") returned 0x0 [0030.790] lstrlenW (lpString=".Mdf") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".Mdf") returned 0x0 [0030.790] lstrlenW (lpString=".dat") returned 4 [0030.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".dat") returned 0x0 [0030.791] lstrlenW (lpString=".DAT") returned 4 [0030.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".DAT") returned 0x0 [0030.791] lstrlenW (lpString=".ldf") returned 4 [0030.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".ldf") returned 0x0 [0030.791] lstrlenW (lpString=".LDF") returned 4 [0030.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch=".LDF") returned 0x0 [0030.791] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3a28 [0030.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.791] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d128) returned 1 [0030.792] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.792] CryptReleaseContext (hProv=0x27d128, dwFlags=0x0) returned 1 [0030.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x293798 [0030.792] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15079288945) returned 1 [0030.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa2c0af90, dwHighDateTime=0x1d585b4)) [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d128 [0030.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3b60 [0030.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d128 | out: hHeap=0x260000) returned 1 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3bd8 [0030.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b60 | out: hHeap=0x260000) returned 1 [0030.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3c80 [0030.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bd8 | out: hHeap=0x260000) returned 1 [0030.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0030.792] GetLastError () returned 0x0 [0030.792] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.793] GetLastError () returned 0x0 [0030.793] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] GetLastError () returned 0x0 [0030.794] SetLastError (dwErrCode=0x0) [0030.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c80 | out: hHeap=0x260000) returned 1 [0030.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.794] ReadFile (in: hFile=0xfc, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x224fdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0030.796] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.796] WriteFile (in: hFile=0xfc, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x224fdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0030.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.796] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.796] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.796] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.796] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.796] CloseHandle (hObject=0xfc) returned 1 [0030.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3b60 [0030.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b60 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.799] GetLastError () returned 0x0 [0030.799] SetLastError (dwErrCode=0x0) [0030.799] GetLastError () returned 0x0 [0030.799] SetLastError (dwErrCode=0x0) [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293798 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a28 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0030.799] RtlWakeConditionVariable () returned 0x27e828 [0030.799] GetCurrentThreadId () returned 0x98c [0030.799] GetCurrentThreadId () returned 0x98c [0030.800] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.998] GetCurrentThreadId () returned 0x98c [0030.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3ca0 [0030.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3bf8 [0030.998] lstrlenW (lpString=".ldf") returned 4 [0030.998] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0030.998] lstrlenW (lpString=".vhd") returned 4 [0030.998] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0030.998] lstrlenW (lpString=".vhdx") returned 5 [0030.998] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0030.998] lstrlenW (lpString=".pst") returned 4 [0030.998] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0030.998] lstrlenW (lpString=".ost") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0030.999] lstrlenW (lpString=".bak") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0030.999] lstrlenW (lpString=".bac") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0030.999] lstrlenW (lpString=".sys") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0030.999] lstrlenW (lpString=".v2i") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0030.999] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0030.999] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0030.999] lstrlenW (lpString=".sql") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0030.999] lstrlenW (lpString=".mdf") returned 4 [0030.999] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0030.999] lstrlenW (lpString=".txt") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0031.000] lstrlenW (lpString=".dbf") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0031.000] lstrlenW (lpString=".ckp") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0031.000] lstrlenW (lpString=".dacpac") returned 7 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0031.000] lstrlenW (lpString=".db3") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0031.000] lstrlenW (lpString=".dtxs") returned 5 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0031.000] lstrlenW (lpString=".mdt") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0031.000] lstrlenW (lpString=".sdf") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0031.000] lstrlenW (lpString=".MDF") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0031.000] lstrlenW (lpString=".DBF") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0031.000] lstrlenW (lpString=".DB") returned 3 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0031.000] lstrlenW (lpString=".db") returned 3 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0031.000] lstrlenW (lpString=".ndf") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0031.000] lstrlenW (lpString=".NDF") returned 4 [0031.000] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0031.000] lstrlenW (lpString=".Mdf") returned 4 [0031.001] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0031.001] lstrlenW (lpString=".dat") returned 4 [0031.001] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0031.001] lstrlenW (lpString=".DAT") returned 4 [0031.001] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0031.001] lstrlenW (lpString=".ldf") returned 4 [0031.001] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0031.001] lstrlenW (lpString=".LDF") returned 4 [0031.001] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0031.001] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0031.001] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0031.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0031.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0031.001] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d118) returned 1 [0031.002] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0031.002] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0031.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0031.002] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15100332418) returned 1 [0031.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa2e202d0, dwHighDateTime=0x1d585b4)) [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0031.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d118 [0031.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0031.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3f48 [0031.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3fc0 [0031.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f48 | out: hHeap=0x260000) returned 1 [0031.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0031.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fc0 | out: hHeap=0x260000) returned 1 [0031.003] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0031.003] GetLastError () returned 0x0 [0031.003] SetLastError (dwErrCode=0x0) [0031.003] GetLastError () returned 0x0 [0031.003] SetLastError (dwErrCode=0x0) [0031.003] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0031.003] GetLastError () returned 0x0 [0031.003] SetLastError (dwErrCode=0x0) [0031.003] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.004] SetLastError (dwErrCode=0x0) [0031.004] GetLastError () returned 0x0 [0031.005] SetLastError (dwErrCode=0x0) [0031.005] GetLastError () returned 0x0 [0031.005] SetLastError (dwErrCode=0x0) [0031.005] GetLastError () returned 0x0 [0031.005] SetLastError (dwErrCode=0x0) [0031.005] GetLastError () returned 0x0 [0031.005] SetLastError (dwErrCode=0x0) [0031.005] GetLastError () returned 0x0 [0031.005] SetLastError (dwErrCode=0x0) [0031.005] GetLastError () returned 0x0 [0031.005] SetLastError (dwErrCode=0x0) [0031.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0031.006] ReadFile (in: hFile=0xf0, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x224fdb0*=0x75e, lpOverlapped=0x0) returned 1 [0031.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.009] WriteFile (in: hFile=0xf0, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x224fdb0*=0x75e, lpOverlapped=0x0) returned 1 [0031.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0031.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.009] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0031.009] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0031.009] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0031.009] CloseHandle (hObject=0xf0) returned 1 [0031.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b3f48 [0031.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0031.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f48 | out: hHeap=0x260000) returned 1 [0031.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0031.012] GetLastError () returned 0x0 [0031.012] SetLastError (dwErrCode=0x0) [0031.012] GetLastError () returned 0x0 [0031.013] SetLastError (dwErrCode=0x0) [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0031.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ca0 | out: hHeap=0x260000) returned 1 [0031.013] RtlWakeConditionVariable () returned 0x27e828 [0031.013] GetCurrentThreadId () returned 0x98c [0031.013] GetCurrentThreadId () returned 0x98c [0031.013] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0031.653] GetCurrentThreadId () returned 0x98c [0031.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b40d0 [0031.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0031.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3b50 [0031.654] lstrlenW (lpString=".ldf") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0031.654] lstrlenW (lpString=".vhd") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0031.654] lstrlenW (lpString=".vhdx") returned 5 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0031.654] lstrlenW (lpString=".pst") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0031.654] lstrlenW (lpString=".ost") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0031.654] lstrlenW (lpString=".bak") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0031.654] lstrlenW (lpString=".bac") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0031.654] lstrlenW (lpString=".sys") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0031.654] lstrlenW (lpString=".v2i") returned 4 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0031.654] lstrlenW (lpString="s\r\n.v2i") returned 7 [0031.654] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0031.654] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0031.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40d0 | out: hHeap=0x260000) returned 1 [0031.655] RtlWakeConditionVariable () returned 0x27e828 [0031.655] GetCurrentThreadId () returned 0x98c [0031.655] GetCurrentThreadId () returned 0x98c [0031.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3b50 [0031.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3be8 | out: hHeap=0x260000) returned 1 [0031.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0031.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3be8 [0031.655] lstrlenW (lpString=".ldf") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0031.655] lstrlenW (lpString=".vhd") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0031.655] lstrlenW (lpString=".vhdx") returned 5 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0031.655] lstrlenW (lpString=".pst") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0031.655] lstrlenW (lpString=".ost") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0031.655] lstrlenW (lpString=".bak") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0031.655] lstrlenW (lpString=".bac") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0031.655] lstrlenW (lpString=".sys") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0031.655] lstrlenW (lpString=".v2i") returned 4 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0031.655] lstrlenW (lpString="s\r\n.v2i") returned 7 [0031.655] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0031.655] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0031.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3be8 | out: hHeap=0x260000) returned 1 [0031.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.656] RtlWakeConditionVariable () returned 0x27e828 [0031.656] GetCurrentThreadId () returned 0x98c [0031.656] GetCurrentThreadId () returned 0x98c [0031.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b40d0 [0031.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0031.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0031.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3e10 [0031.656] lstrlenW (lpString=".ldf") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".ldf") returned 0x0 [0031.656] lstrlenW (lpString=".vhd") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".vhd") returned 0x0 [0031.656] lstrlenW (lpString=".vhdx") returned 5 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".vhdx") returned 0x0 [0031.656] lstrlenW (lpString=".pst") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".pst") returned 0x0 [0031.656] lstrlenW (lpString=".ost") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".ost") returned 0x0 [0031.656] lstrlenW (lpString=".bak") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".bak") returned 0x0 [0031.656] lstrlenW (lpString=".bac") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".bac") returned 0x0 [0031.656] lstrlenW (lpString=".sys") returned 4 [0031.656] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".sys") returned 0x0 [0031.656] lstrlenW (lpString=".v2i") returned 4 [0031.657] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".v2i") returned 0x0 [0031.657] lstrlenW (lpString="s\r\n.v2i") returned 7 [0031.657] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0031.657] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0031.666] lstrlenW (lpString=".sql") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".sql") returned 0x0 [0031.666] lstrlenW (lpString=".mdf") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".mdf") returned 0x0 [0031.666] lstrlenW (lpString=".txt") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".txt") returned 0x0 [0031.666] lstrlenW (lpString=".dbf") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".dbf") returned 0x0 [0031.666] lstrlenW (lpString=".ckp") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".ckp") returned 0x0 [0031.666] lstrlenW (lpString=".dacpac") returned 7 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".dacpac") returned 0x0 [0031.666] lstrlenW (lpString=".db3") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".db3") returned 0x0 [0031.666] lstrlenW (lpString=".dtxs") returned 5 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".dtxs") returned 0x0 [0031.666] lstrlenW (lpString=".mdt") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".mdt") returned 0x0 [0031.666] lstrlenW (lpString=".sdf") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".sdf") returned 0x0 [0031.666] lstrlenW (lpString=".MDF") returned 4 [0031.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".MDF") returned 0x0 [0031.666] lstrlenW (lpString=".DBF") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".DBF") returned 0x0 [0031.667] lstrlenW (lpString=".DB") returned 3 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".DB") returned 0x0 [0031.667] lstrlenW (lpString=".db") returned 3 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".db") returned 0x0 [0031.667] lstrlenW (lpString=".ndf") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".ndf") returned 0x0 [0031.667] lstrlenW (lpString=".NDF") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".NDF") returned 0x0 [0031.667] lstrlenW (lpString=".Mdf") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".Mdf") returned 0x0 [0031.667] lstrlenW (lpString=".dat") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".dat") returned 0x0 [0031.667] lstrlenW (lpString=".DAT") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".DAT") returned 0x0 [0031.667] lstrlenW (lpString=".ldf") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".ldf") returned 0x0 [0031.667] lstrlenW (lpString=".LDF") returned 4 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch=".LDF") returned 0x0 [0031.667] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0031.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0031.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d53b8 [0031.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0031.667] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3b50) returned 1 [0031.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0031.669] CryptReleaseContext (hProv=0x2b3b50, dwFlags=0x0) returned 1 [0031.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0031.669] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15166983696) returned 1 [0031.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa31d8530, dwHighDateTime=0x1d585b4)) [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0031.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3b50 [0031.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3bc8 [0031.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2d54f0 [0031.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bc8 | out: hHeap=0x260000) returned 1 [0031.669] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0031.669] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.670] GetLastError () returned 0x0 [0031.670] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] GetLastError () returned 0x0 [0031.671] SetLastError (dwErrCode=0x0) [0031.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0031.672] ReadFile (in: hFile=0xf0, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0031.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.678] WriteFile (in: hFile=0xf0, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0031.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0031.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.679] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0031.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0031.680] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0031.680] CloseHandle (hObject=0xf0) returned 1 [0031.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x299188 [0031.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.[deadmin@cock.li].deadmin")) returned 1 [0031.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299188 | out: hHeap=0x260000) returned 1 [0031.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0031.993] GetLastError () returned 0x0 [0031.994] SetLastError (dwErrCode=0x0) [0031.994] GetLastError () returned 0x0 [0031.994] SetLastError (dwErrCode=0x0) [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53b8 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40d0 | out: hHeap=0x260000) returned 1 [0031.994] RtlWakeConditionVariable () returned 0x27e828 [0031.994] GetCurrentThreadId () returned 0x98c [0031.994] GetCurrentThreadId () returned 0x98c [0031.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4028 | out: hHeap=0x260000) returned 1 [0031.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0031.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0031.994] lstrlenW (lpString=".ldf") returned 4 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0031.994] lstrlenW (lpString=".vhd") returned 4 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0031.994] lstrlenW (lpString=".vhdx") returned 5 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0031.994] lstrlenW (lpString=".pst") returned 4 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0031.994] lstrlenW (lpString=".ost") returned 4 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0031.994] lstrlenW (lpString=".bak") returned 4 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0031.994] lstrlenW (lpString=".bac") returned 4 [0031.994] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0031.995] lstrlenW (lpString=".sys") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0031.995] lstrlenW (lpString=".v2i") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0031.995] lstrlenW (lpString="s\r\n.v2i") returned 7 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0031.995] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0031.995] lstrlenW (lpString=".sql") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0031.995] lstrlenW (lpString=".mdf") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0031.995] lstrlenW (lpString=".txt") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0031.995] lstrlenW (lpString=".dbf") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0031.995] lstrlenW (lpString=".ckp") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0031.995] lstrlenW (lpString=".dacpac") returned 7 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0031.995] lstrlenW (lpString=".db3") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0031.995] lstrlenW (lpString=".dtxs") returned 5 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0031.995] lstrlenW (lpString=".mdt") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0031.995] lstrlenW (lpString=".sdf") returned 4 [0031.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0031.996] lstrlenW (lpString=".MDF") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0031.996] lstrlenW (lpString=".DBF") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0031.996] lstrlenW (lpString=".DB") returned 3 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0031.996] lstrlenW (lpString=".db") returned 3 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0031.996] lstrlenW (lpString=".ndf") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0031.996] lstrlenW (lpString=".NDF") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0031.996] lstrlenW (lpString=".Mdf") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0031.996] lstrlenW (lpString=".dat") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0031.996] lstrlenW (lpString=".DAT") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0031.996] lstrlenW (lpString=".ldf") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0031.996] lstrlenW (lpString=".LDF") returned 4 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0031.996] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0031.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0031.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b4000 [0031.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0031.996] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d5640) returned 1 [0031.997] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0031.997] CryptReleaseContext (hProv=0x2d5640, dwFlags=0x0) returned 1 [0031.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0031.997] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15199835287) returned 1 [0031.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa34abf50, dwHighDateTime=0x1d585b4)) [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0031.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0031.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0031.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2d5640 [0031.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0031.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d028 [0031.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5640 | out: hHeap=0x260000) returned 1 [0031.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0031.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0031.998] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0031.998] GetLastError () returned 0x0 [0031.998] SetLastError (dwErrCode=0x0) [0031.998] GetLastError () returned 0x0 [0031.998] SetLastError (dwErrCode=0x0) [0031.998] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0031.998] GetLastError () returned 0x0 [0031.998] SetLastError (dwErrCode=0x0) [0031.998] GetLastError () returned 0x0 [0031.998] SetLastError (dwErrCode=0x0) [0031.998] GetLastError () returned 0x0 [0031.998] SetLastError (dwErrCode=0x0) [0031.998] GetLastError () returned 0x0 [0031.998] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0031.999] SetLastError (dwErrCode=0x0) [0031.999] GetLastError () returned 0x0 [0032.000] SetLastError (dwErrCode=0x0) [0032.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0032.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2f0478 [0032.000] ReadFile (in: hFile=0xf0, lpBuffer=0x2f0478, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f0478*, lpNumberOfBytesRead=0x224fdb0*=0x648, lpOverlapped=0x0) returned 1 [0032.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.003] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0478*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f0478*, lpNumberOfBytesWritten=0x224fdb0*=0x648, lpOverlapped=0x0) returned 1 [0032.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0478 | out: hHeap=0x260000) returned 1 [0032.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.003] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.003] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.003] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.003] CloseHandle (hObject=0xf0) returned 1 [0032.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x298f10 [0032.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298f10 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0032.005] GetLastError () returned 0x0 [0032.005] SetLastError (dwErrCode=0x0) [0032.005] GetLastError () returned 0x0 [0032.005] SetLastError (dwErrCode=0x0) [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4000 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0032.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0032.005] RtlWakeConditionVariable () returned 0x27e828 [0032.006] GetCurrentThreadId () returned 0x98c [0032.006] GetCurrentThreadId () returned 0x98c [0032.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x298f10 [0032.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c80 | out: hHeap=0x260000) returned 1 [0032.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0032.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3be8 [0032.006] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0032.006] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0032.006] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0032.006] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0032.006] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0032.007] CloseHandle (hObject=0xf0) returned 1 [0032.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3be8 | out: hHeap=0x260000) returned 1 [0032.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298f10 | out: hHeap=0x260000) returned 1 [0032.007] RtlWakeConditionVariable () returned 0x27e828 [0032.008] GetCurrentThreadId () returned 0x98c [0032.008] GetCurrentThreadId () returned 0x98c [0032.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0032.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5308 | out: hHeap=0x260000) returned 1 [0032.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0032.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295f70 [0032.008] lstrlenW (lpString=".ldf") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0032.008] lstrlenW (lpString=".vhd") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0032.008] lstrlenW (lpString=".vhdx") returned 5 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0032.008] lstrlenW (lpString=".pst") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0032.008] lstrlenW (lpString=".ost") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0032.008] lstrlenW (lpString=".bak") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0032.008] lstrlenW (lpString=".bac") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0032.008] lstrlenW (lpString=".sys") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0032.008] lstrlenW (lpString=".v2i") returned 4 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0032.008] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0032.008] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295f70 | out: hHeap=0x260000) returned 1 [0032.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0032.009] RtlWakeConditionVariable () returned 0x27e828 [0032.009] GetCurrentThreadId () returned 0x98c [0032.009] GetCurrentThreadId () returned 0x98c [0032.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0032.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0032.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0032.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295f70 [0032.009] lstrlenW (lpString=".ldf") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0032.009] lstrlenW (lpString=".vhd") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0032.009] lstrlenW (lpString=".vhdx") returned 5 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0032.009] lstrlenW (lpString=".pst") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0032.009] lstrlenW (lpString=".ost") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0032.009] lstrlenW (lpString=".bak") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0032.009] lstrlenW (lpString=".bac") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0032.009] lstrlenW (lpString=".sys") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0032.009] lstrlenW (lpString=".v2i") returned 4 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0032.009] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0032.009] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295f70 | out: hHeap=0x260000) returned 1 [0032.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0032.010] RtlWakeConditionVariable () returned 0x27e828 [0032.010] GetCurrentThreadId () returned 0x98c [0032.010] GetCurrentThreadId () returned 0x98c [0032.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0032.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d56d0 | out: hHeap=0x260000) returned 1 [0032.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0032.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0032.010] lstrlenW (lpString=".ldf") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".ldf") returned 0x0 [0032.010] lstrlenW (lpString=".vhd") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".vhd") returned 0x0 [0032.010] lstrlenW (lpString=".vhdx") returned 5 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".vhdx") returned 0x0 [0032.010] lstrlenW (lpString=".pst") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".pst") returned 0x0 [0032.010] lstrlenW (lpString=".ost") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".ost") returned 0x0 [0032.010] lstrlenW (lpString=".bak") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".bak") returned 0x0 [0032.010] lstrlenW (lpString=".bac") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".bac") returned 0x0 [0032.010] lstrlenW (lpString=".sys") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".sys") returned 0x0 [0032.010] lstrlenW (lpString=".v2i") returned 4 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".v2i") returned 0x0 [0032.010] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.010] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0032.010] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.332] lstrlenW (lpString=".sql") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".sql") returned 0x0 [0032.332] lstrlenW (lpString=".mdf") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".mdf") returned 0x0 [0032.332] lstrlenW (lpString=".txt") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".txt") returned 0x0 [0032.332] lstrlenW (lpString=".dbf") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".dbf") returned 0x0 [0032.332] lstrlenW (lpString=".ckp") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".ckp") returned 0x0 [0032.332] lstrlenW (lpString=".dacpac") returned 7 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".dacpac") returned 0x0 [0032.332] lstrlenW (lpString=".db3") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".db3") returned 0x0 [0032.332] lstrlenW (lpString=".dtxs") returned 5 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".dtxs") returned 0x0 [0032.332] lstrlenW (lpString=".mdt") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".mdt") returned 0x0 [0032.332] lstrlenW (lpString=".sdf") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".sdf") returned 0x0 [0032.332] lstrlenW (lpString=".MDF") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".MDF") returned 0x0 [0032.332] lstrlenW (lpString=".DBF") returned 4 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".DBF") returned 0x0 [0032.332] lstrlenW (lpString=".DB") returned 3 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".DB") returned 0x0 [0032.332] lstrlenW (lpString=".db") returned 3 [0032.332] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".db") returned 0x0 [0032.333] lstrlenW (lpString=".ndf") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".ndf") returned 0x0 [0032.333] lstrlenW (lpString=".NDF") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".NDF") returned 0x0 [0032.333] lstrlenW (lpString=".Mdf") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".Mdf") returned 0x0 [0032.333] lstrlenW (lpString=".dat") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".dat") returned 0x0 [0032.333] lstrlenW (lpString=".DAT") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".DAT") returned 0x0 [0032.333] lstrlenW (lpString=".ldf") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".ldf") returned 0x0 [0032.333] lstrlenW (lpString=".LDF") returned 4 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch=".LDF") returned 0x0 [0032.333] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.333] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0032.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.333] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d54f8) returned 1 [0032.334] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.334] CryptReleaseContext (hProv=0x2d54f8, dwFlags=0x0) returned 1 [0032.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8688 [0032.334] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15233526791) returned 1 [0032.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa377f970, dwHighDateTime=0x1d585b4)) [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1530 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0032.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d028 [0032.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0032.335] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0032.335] GetLastError () returned 0x0 [0032.335] SetLastError (dwErrCode=0x0) [0032.335] GetLastError () returned 0x0 [0032.335] SetLastError (dwErrCode=0x0) [0032.335] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0032.335] GetLastError () returned 0x0 [0032.335] SetLastError (dwErrCode=0x0) [0032.335] GetLastError () returned 0x0 [0032.335] SetLastError (dwErrCode=0x0) [0032.335] GetLastError () returned 0x0 [0032.335] SetLastError (dwErrCode=0x0) [0032.335] GetLastError () returned 0x0 [0032.335] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.336] SetLastError (dwErrCode=0x0) [0032.336] GetLastError () returned 0x0 [0032.337] SetLastError (dwErrCode=0x0) [0032.337] GetLastError () returned 0x0 [0032.337] SetLastError (dwErrCode=0x0) [0032.337] GetLastError () returned 0x0 [0032.337] SetLastError (dwErrCode=0x0) [0032.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d98a0 [0032.337] ReadFile (in: hFile=0xf8, lpBuffer=0x2d98a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.340] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.340] WriteFile (in: hFile=0xf8, lpBuffer=0x2d98a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0032.341] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.341] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.342] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.342] CloseHandle (hObject=0xf8) returned 1 [0033.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d60a8 [0033.723] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.[deadmin@cock.li].deadmin")) returned 1 [0033.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60a8 | out: hHeap=0x260000) returned 1 [0033.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0033.723] GetLastError () returned 0x0 [0033.723] SetLastError (dwErrCode=0x0) [0033.723] GetLastError () returned 0x0 [0033.723] SetLastError (dwErrCode=0x0) [0033.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0033.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8688 | out: hHeap=0x260000) returned 1 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0033.724] RtlWakeConditionVariable () returned 0x27e828 [0033.724] GetCurrentThreadId () returned 0x98c [0033.724] GetCurrentThreadId () returned 0x98c [0033.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5d28 | out: hHeap=0x260000) returned 1 [0033.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0033.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0033.724] lstrlenW (lpString=".ldf") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".ldf") returned 0x0 [0033.724] lstrlenW (lpString=".vhd") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".vhd") returned 0x0 [0033.724] lstrlenW (lpString=".vhdx") returned 5 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".vhdx") returned 0x0 [0033.724] lstrlenW (lpString=".pst") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".pst") returned 0x0 [0033.724] lstrlenW (lpString=".ost") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".ost") returned 0x0 [0033.724] lstrlenW (lpString=".bak") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".bak") returned 0x0 [0033.724] lstrlenW (lpString=".bac") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".bac") returned 0x0 [0033.724] lstrlenW (lpString=".sys") returned 4 [0033.724] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".sys") returned 0x0 [0033.724] lstrlenW (lpString=".v2i") returned 4 [0033.725] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".v2i") returned 0x0 [0033.725] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.725] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch="s\r\n.v2i") returned 0x0 [0033.725] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.915] lstrlenW (lpString=".sql") returned 4 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".sql") returned 0x0 [0033.915] lstrlenW (lpString=".mdf") returned 4 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".mdf") returned 0x0 [0033.915] lstrlenW (lpString=".txt") returned 4 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".txt") returned 0x0 [0033.915] lstrlenW (lpString=".dbf") returned 4 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".dbf") returned 0x0 [0033.915] lstrlenW (lpString=".ckp") returned 4 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".ckp") returned 0x0 [0033.915] lstrlenW (lpString=".dacpac") returned 7 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".dacpac") returned 0x0 [0033.915] lstrlenW (lpString=".db3") returned 4 [0033.915] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".db3") returned 0x0 [0033.916] lstrlenW (lpString=".dtxs") returned 5 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".dtxs") returned 0x0 [0033.916] lstrlenW (lpString=".mdt") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".mdt") returned 0x0 [0033.916] lstrlenW (lpString=".sdf") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".sdf") returned 0x0 [0033.916] lstrlenW (lpString=".MDF") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".MDF") returned 0x0 [0033.916] lstrlenW (lpString=".DBF") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".DBF") returned 0x0 [0033.916] lstrlenW (lpString=".DB") returned 3 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".DB") returned 0x0 [0033.916] lstrlenW (lpString=".db") returned 3 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".db") returned 0x0 [0033.916] lstrlenW (lpString=".ndf") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".ndf") returned 0x0 [0033.916] lstrlenW (lpString=".NDF") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".NDF") returned 0x0 [0033.916] lstrlenW (lpString=".Mdf") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".Mdf") returned 0x0 [0033.916] lstrlenW (lpString=".dat") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".dat") returned 0x0 [0033.916] lstrlenW (lpString=".DAT") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".DAT") returned 0x0 [0033.916] lstrlenW (lpString=".ldf") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".ldf") returned 0x0 [0033.916] lstrlenW (lpString=".LDF") returned 4 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch=".LDF") returned 0x0 [0033.916] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.916] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0033.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.917] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d5250) returned 1 [0033.917] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.917] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0033.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2db8a0 [0033.917] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15391861343) returned 1 [0033.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa45c7d70, dwHighDateTime=0x1d585b4)) [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cd88 [0033.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0033.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0033.918] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0033.918] GetLastError () returned 0x0 [0033.918] SetLastError (dwErrCode=0x0) [0033.918] GetLastError () returned 0x0 [0033.918] SetLastError (dwErrCode=0x0) [0033.918] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0033.918] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.919] GetLastError () returned 0x0 [0033.919] SetLastError (dwErrCode=0x0) [0033.920] GetLastError () returned 0x0 [0033.920] SetLastError (dwErrCode=0x0) [0033.920] GetLastError () returned 0x0 [0033.920] SetLastError (dwErrCode=0x0) [0033.920] GetLastError () returned 0x0 [0033.920] SetLastError (dwErrCode=0x0) [0033.920] GetLastError () returned 0x0 [0033.920] SetLastError (dwErrCode=0x0) [0033.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296858 | out: hHeap=0x260000) returned 1 [0033.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2dcab8 [0033.920] ReadFile (in: hFile=0xfc, lpBuffer=0x2dcab8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2dcab8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.926] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.926] WriteFile (in: hFile=0xfc, lpBuffer=0x2dcab8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2dcab8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dcab8 | out: hHeap=0x260000) returned 1 [0033.927] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.927] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0033.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0033.928] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0033.928] CloseHandle (hObject=0xfc) returned 1 [0033.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d60a8 [0033.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.[deadmin@cock.li].deadmin")) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60a8 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0033.949] GetLastError () returned 0x0 [0033.949] SetLastError (dwErrCode=0x0) [0033.949] GetLastError () returned 0x0 [0033.949] SetLastError (dwErrCode=0x0) [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0033.949] RtlWakeConditionVariable () returned 0x27e828 [0033.949] GetCurrentThreadId () returned 0x98c [0033.949] GetCurrentThreadId () returned 0x98c [0033.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299cb0 | out: hHeap=0x260000) returned 1 [0033.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0033.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0033.949] lstrlenW (lpString=".ldf") returned 4 [0033.949] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".ldf") returned 0x0 [0033.949] lstrlenW (lpString=".vhd") returned 4 [0033.949] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".vhd") returned 0x0 [0033.949] lstrlenW (lpString=".vhdx") returned 5 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".vhdx") returned 0x0 [0033.950] lstrlenW (lpString=".pst") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".pst") returned 0x0 [0033.950] lstrlenW (lpString=".ost") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".ost") returned 0x0 [0033.950] lstrlenW (lpString=".bak") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".bak") returned 0x0 [0033.950] lstrlenW (lpString=".bac") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".bac") returned 0x0 [0033.950] lstrlenW (lpString=".sys") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".sys") returned 0x0 [0033.950] lstrlenW (lpString=".v2i") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".v2i") returned 0x0 [0033.950] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch="s\r\n.v2i") returned 0x0 [0033.950] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.950] lstrlenW (lpString=".sql") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".sql") returned 0x0 [0033.950] lstrlenW (lpString=".mdf") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".mdf") returned 0x0 [0033.950] lstrlenW (lpString=".txt") returned 4 [0033.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".txt") returned 0x0 [0033.950] lstrlenW (lpString=".dbf") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".dbf") returned 0x0 [0033.951] lstrlenW (lpString=".ckp") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".ckp") returned 0x0 [0033.951] lstrlenW (lpString=".dacpac") returned 7 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".dacpac") returned 0x0 [0033.951] lstrlenW (lpString=".db3") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".db3") returned 0x0 [0033.951] lstrlenW (lpString=".dtxs") returned 5 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".dtxs") returned 0x0 [0033.951] lstrlenW (lpString=".mdt") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".mdt") returned 0x0 [0033.951] lstrlenW (lpString=".sdf") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".sdf") returned 0x0 [0033.951] lstrlenW (lpString=".MDF") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".MDF") returned 0x0 [0033.951] lstrlenW (lpString=".DBF") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".DBF") returned 0x0 [0033.951] lstrlenW (lpString=".DB") returned 3 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".DB") returned 0x0 [0033.951] lstrlenW (lpString=".db") returned 3 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".db") returned 0x0 [0033.951] lstrlenW (lpString=".ndf") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".ndf") returned 0x0 [0033.951] lstrlenW (lpString=".NDF") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".NDF") returned 0x0 [0033.951] lstrlenW (lpString=".Mdf") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".Mdf") returned 0x0 [0033.951] lstrlenW (lpString=".dat") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".dat") returned 0x0 [0033.951] lstrlenW (lpString=".DAT") returned 4 [0033.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".DAT") returned 0x0 [0033.952] lstrlenW (lpString=".ldf") returned 4 [0033.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".ldf") returned 0x0 [0033.952] lstrlenW (lpString=".LDF") returned 4 [0033.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch=".LDF") returned 0x0 [0033.952] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0033.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.952] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d5250) returned 1 [0033.953] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.953] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2db8a0 [0033.953] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15395388748) returned 1 [0033.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa4614030, dwHighDateTime=0x1d585b4)) [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b10 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cd88 [0033.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0033.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0033.953] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0033.953] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.954] SetLastError (dwErrCode=0x0) [0033.954] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] GetLastError () returned 0x0 [0033.955] SetLastError (dwErrCode=0x0) [0033.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296858 | out: hHeap=0x260000) returned 1 [0033.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2dcab8 [0033.955] ReadFile (in: hFile=0xfc, lpBuffer=0x2dcab8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2dcab8*, lpNumberOfBytesRead=0x224fdb0*=0x5b1, lpOverlapped=0x0) returned 1 [0034.210] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.210] WriteFile (in: hFile=0xfc, lpBuffer=0x2dcab8*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2dcab8*, lpNumberOfBytesWritten=0x224fdb0*=0x5b1, lpOverlapped=0x0) returned 1 [0034.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dcab8 | out: hHeap=0x260000) returned 1 [0034.210] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.210] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0034.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0034.211] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0034.211] CloseHandle (hObject=0xfc) returned 1 [0034.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d60a8 [0034.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.[deadmin@cock.li].deadmin")) returned 1 [0034.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60a8 | out: hHeap=0x260000) returned 1 [0034.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0034.634] GetLastError () returned 0x0 [0034.634] SetLastError (dwErrCode=0x0) [0034.634] GetLastError () returned 0x0 [0034.634] SetLastError (dwErrCode=0x0) [0034.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0034.635] RtlWakeConditionVariable () returned 0x27e828 [0034.635] GetCurrentThreadId () returned 0x98c [0034.635] GetCurrentThreadId () returned 0x98c [0034.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298e58 | out: hHeap=0x260000) returned 1 [0034.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0034.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0034.635] lstrlenW (lpString=".ldf") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".ldf") returned 0x0 [0034.635] lstrlenW (lpString=".vhd") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".vhd") returned 0x0 [0034.635] lstrlenW (lpString=".vhdx") returned 5 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".vhdx") returned 0x0 [0034.635] lstrlenW (lpString=".pst") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".pst") returned 0x0 [0034.635] lstrlenW (lpString=".ost") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".ost") returned 0x0 [0034.635] lstrlenW (lpString=".bak") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".bak") returned 0x0 [0034.635] lstrlenW (lpString=".bac") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".bac") returned 0x0 [0034.635] lstrlenW (lpString=".sys") returned 4 [0034.635] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".sys") returned 0x0 [0034.636] lstrlenW (lpString=".v2i") returned 4 [0034.636] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".v2i") returned 0x0 [0034.636] lstrlenW (lpString="s\r\n.v2i") returned 7 [0034.636] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch="s\r\n.v2i") returned 0x0 [0034.636] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.644] lstrlenW (lpString=".sql") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".sql") returned 0x0 [0034.644] lstrlenW (lpString=".mdf") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".mdf") returned 0x0 [0034.644] lstrlenW (lpString=".txt") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".txt") returned 0x0 [0034.644] lstrlenW (lpString=".dbf") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".dbf") returned 0x0 [0034.644] lstrlenW (lpString=".ckp") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".ckp") returned 0x0 [0034.644] lstrlenW (lpString=".dacpac") returned 7 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".dacpac") returned 0x0 [0034.644] lstrlenW (lpString=".db3") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".db3") returned 0x0 [0034.644] lstrlenW (lpString=".dtxs") returned 5 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".dtxs") returned 0x0 [0034.644] lstrlenW (lpString=".mdt") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".mdt") returned 0x0 [0034.644] lstrlenW (lpString=".sdf") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".sdf") returned 0x0 [0034.644] lstrlenW (lpString=".MDF") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".MDF") returned 0x0 [0034.644] lstrlenW (lpString=".DBF") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".DBF") returned 0x0 [0034.644] lstrlenW (lpString=".DB") returned 3 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".DB") returned 0x0 [0034.644] lstrlenW (lpString=".db") returned 3 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".db") returned 0x0 [0034.644] lstrlenW (lpString=".ndf") returned 4 [0034.644] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".ndf") returned 0x0 [0034.645] lstrlenW (lpString=".NDF") returned 4 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".NDF") returned 0x0 [0034.645] lstrlenW (lpString=".Mdf") returned 4 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".Mdf") returned 0x0 [0034.645] lstrlenW (lpString=".dat") returned 4 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".dat") returned 0x0 [0034.645] lstrlenW (lpString=".DAT") returned 4 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".DAT") returned 0x0 [0034.645] lstrlenW (lpString=".ldf") returned 4 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".ldf") returned 0x0 [0034.645] lstrlenW (lpString=".LDF") returned 4 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch=".LDF") returned 0x0 [0034.645] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0034.645] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0034.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0034.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0034.645] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d5250) returned 1 [0034.646] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0034.646] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0034.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2eb8a8 [0034.646] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15464713022) returned 1 [0034.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa4c07730, dwHighDateTime=0x1d585b4)) [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f20 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0034.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0034.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0034.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0034.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0034.646] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.647] SetLastError (dwErrCode=0x0) [0034.647] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.648] GetLastError () returned 0x0 [0034.648] SetLastError (dwErrCode=0x0) [0034.649] GetLastError () returned 0x0 [0034.649] SetLastError (dwErrCode=0x0) [0034.649] GetLastError () returned 0x0 [0034.649] SetLastError (dwErrCode=0x0) [0034.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0034.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2f8ac8 [0034.649] ReadFile (in: hFile=0xfc, lpBuffer=0x2f8ac8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0034.655] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.655] WriteFile (in: hFile=0xfc, lpBuffer=0x2f8ac8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0034.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ac8 | out: hHeap=0x260000) returned 1 [0034.656] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.656] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0034.661] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0034.661] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0034.661] CloseHandle (hObject=0xfc) returned 1 [0034.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d60a8 [0034.673] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.[deadmin@cock.li].deadmin")) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60a8 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0034.674] GetLastError () returned 0x0 [0034.674] SetLastError (dwErrCode=0x0) [0034.674] GetLastError () returned 0x0 [0034.674] SetLastError (dwErrCode=0x0) [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eb8a8 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0034.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0034.675] RtlWakeConditionVariable () returned 0x27e828 [0034.675] GetCurrentThreadId () returned 0x98c [0034.675] GetCurrentThreadId () returned 0x98c [0034.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0034.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0034.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0034.675] lstrlenW (lpString=".ldf") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".ldf") returned 0x0 [0034.675] lstrlenW (lpString=".vhd") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".vhd") returned 0x0 [0034.675] lstrlenW (lpString=".vhdx") returned 5 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".vhdx") returned 0x0 [0034.675] lstrlenW (lpString=".pst") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".pst") returned 0x0 [0034.675] lstrlenW (lpString=".ost") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".ost") returned 0x0 [0034.675] lstrlenW (lpString=".bak") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".bak") returned 0x0 [0034.675] lstrlenW (lpString=".bac") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".bac") returned 0x0 [0034.675] lstrlenW (lpString=".sys") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".sys") returned 0x0 [0034.675] lstrlenW (lpString=".v2i") returned 4 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".v2i") returned 0x0 [0034.675] lstrlenW (lpString="s\r\n.v2i") returned 7 [0034.675] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch="s\r\n.v2i") returned 0x0 [0034.675] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.676] lstrlenW (lpString=".sql") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".sql") returned 0x0 [0034.676] lstrlenW (lpString=".mdf") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".mdf") returned 0x0 [0034.676] lstrlenW (lpString=".txt") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".txt") returned 0x0 [0034.676] lstrlenW (lpString=".dbf") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".dbf") returned 0x0 [0034.676] lstrlenW (lpString=".ckp") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".ckp") returned 0x0 [0034.676] lstrlenW (lpString=".dacpac") returned 7 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".dacpac") returned 0x0 [0034.676] lstrlenW (lpString=".db3") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".db3") returned 0x0 [0034.676] lstrlenW (lpString=".dtxs") returned 5 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".dtxs") returned 0x0 [0034.676] lstrlenW (lpString=".mdt") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".mdt") returned 0x0 [0034.676] lstrlenW (lpString=".sdf") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".sdf") returned 0x0 [0034.676] lstrlenW (lpString=".MDF") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".MDF") returned 0x0 [0034.676] lstrlenW (lpString=".DBF") returned 4 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".DBF") returned 0x0 [0034.676] lstrlenW (lpString=".DB") returned 3 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".DB") returned 0x0 [0034.676] lstrlenW (lpString=".db") returned 3 [0034.676] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".db") returned 0x0 [0034.677] lstrlenW (lpString=".ndf") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".ndf") returned 0x0 [0034.677] lstrlenW (lpString=".NDF") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".NDF") returned 0x0 [0034.677] lstrlenW (lpString=".Mdf") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".Mdf") returned 0x0 [0034.677] lstrlenW (lpString=".dat") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".dat") returned 0x0 [0034.677] lstrlenW (lpString=".DAT") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".DAT") returned 0x0 [0034.677] lstrlenW (lpString=".ldf") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".ldf") returned 0x0 [0034.677] lstrlenW (lpString=".LDF") returned 4 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch=".LDF") returned 0x0 [0034.677] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0034.677] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0034.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0034.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0034.677] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0034.678] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0034.678] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0034.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2eb8a8 [0034.678] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15467915986) returned 1 [0034.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa4c539f0, dwHighDateTime=0x1d585b4)) [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bf0 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0034.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0034.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0034.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0034.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0034.679] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0034.679] GetLastError () returned 0x0 [0034.679] SetLastError (dwErrCode=0x0) [0034.679] GetLastError () returned 0x0 [0034.679] SetLastError (dwErrCode=0x0) [0034.679] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0034.679] GetLastError () returned 0x0 [0034.679] SetLastError (dwErrCode=0x0) [0034.679] GetLastError () returned 0x0 [0034.679] SetLastError (dwErrCode=0x0) [0034.679] GetLastError () returned 0x0 [0034.680] SetLastError (dwErrCode=0x0) [0034.680] GetLastError () returned 0x0 [0034.680] SetLastError (dwErrCode=0x0) [0034.680] GetLastError () returned 0x0 [0034.680] SetLastError (dwErrCode=0x0) [0034.680] GetLastError () returned 0x0 [0034.680] ReadFile (in: hFile=0xfc, lpBuffer=0x2f8ac8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac8*, lpNumberOfBytesRead=0x224fdb0*=0x5b2, lpOverlapped=0x0) returned 1 [0034.684] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.684] WriteFile (in: hFile=0xfc, lpBuffer=0x2f8ac8*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac8*, lpNumberOfBytesWritten=0x224fdb0*=0x5b2, lpOverlapped=0x0) returned 1 [0034.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ac8 | out: hHeap=0x260000) returned 1 [0034.684] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.684] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0034.684] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0034.685] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0034.685] CloseHandle (hObject=0xfc) returned 1 [0034.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d60a8 [0034.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.[deadmin@cock.li].deadmin")) returned 1 [0034.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60a8 | out: hHeap=0x260000) returned 1 [0034.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0034.686] GetLastError () returned 0x0 [0034.686] RtlWakeConditionVariable () returned 0x27e828 [0034.686] GetCurrentThreadId () returned 0x98c [0034.686] GetCurrentThreadId () returned 0x98c [0034.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0034.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fe8 | out: hHeap=0x260000) returned 1 [0034.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0034.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ee60 [0034.686] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.061] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0035.061] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0035.061] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0035.061] WriteFile (in: hFile=0x108, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0035.062] CloseHandle (hObject=0x108) returned 1 [0035.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee60 | out: hHeap=0x260000) returned 1 [0035.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0035.062] RtlWakeConditionVariable () returned 0x27e828 [0035.062] GetCurrentThreadId () returned 0x98c [0035.062] GetCurrentThreadId () returned 0x98c [0035.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0035.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0035.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0035.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.062] lstrlenW (lpString=".ldf") returned 4 [0035.062] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".ldf") returned 0x0 [0035.062] lstrlenW (lpString=".vhd") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".vhd") returned 0x0 [0035.063] lstrlenW (lpString=".vhdx") returned 5 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".vhdx") returned 0x0 [0035.063] lstrlenW (lpString=".pst") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".pst") returned 0x0 [0035.063] lstrlenW (lpString=".ost") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".ost") returned 0x0 [0035.063] lstrlenW (lpString=".bak") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".bak") returned 0x0 [0035.063] lstrlenW (lpString=".bac") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".bac") returned 0x0 [0035.063] lstrlenW (lpString=".sys") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".sys") returned 0x0 [0035.063] lstrlenW (lpString=".v2i") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".v2i") returned 0x0 [0035.063] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch="s\r\n.v2i") returned 0x0 [0035.063] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.063] lstrlenW (lpString=".sql") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".sql") returned 0x0 [0035.063] lstrlenW (lpString=".mdf") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".mdf") returned 0x0 [0035.063] lstrlenW (lpString=".txt") returned 4 [0035.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".txt") returned 0x0 [0035.063] lstrlenW (lpString=".dbf") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".dbf") returned 0x0 [0035.064] lstrlenW (lpString=".ckp") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".ckp") returned 0x0 [0035.064] lstrlenW (lpString=".dacpac") returned 7 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".dacpac") returned 0x0 [0035.064] lstrlenW (lpString=".db3") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".db3") returned 0x0 [0035.064] lstrlenW (lpString=".dtxs") returned 5 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".dtxs") returned 0x0 [0035.064] lstrlenW (lpString=".mdt") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".mdt") returned 0x0 [0035.064] lstrlenW (lpString=".sdf") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".sdf") returned 0x0 [0035.064] lstrlenW (lpString=".MDF") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".MDF") returned 0x0 [0035.064] lstrlenW (lpString=".DBF") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".DBF") returned 0x0 [0035.064] lstrlenW (lpString=".DB") returned 3 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".DB") returned 0x0 [0035.064] lstrlenW (lpString=".db") returned 3 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".db") returned 0x0 [0035.064] lstrlenW (lpString=".ndf") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".ndf") returned 0x0 [0035.064] lstrlenW (lpString=".NDF") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".NDF") returned 0x0 [0035.064] lstrlenW (lpString=".Mdf") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".Mdf") returned 0x0 [0035.064] lstrlenW (lpString=".dat") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".dat") returned 0x0 [0035.064] lstrlenW (lpString=".DAT") returned 4 [0035.064] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".DAT") returned 0x0 [0035.064] lstrlenW (lpString=".ldf") returned 4 [0035.065] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".ldf") returned 0x0 [0035.065] lstrlenW (lpString=".LDF") returned 4 [0035.065] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch=".LDF") returned 0x0 [0035.065] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.065] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ec8b0 [0035.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.065] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0035.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.066] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f0ef0 [0035.066] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15506685922) returned 1 [0035.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa500bc50, dwHighDateTime=0x1d585b4)) [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c98 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d53c0 [0035.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6558 [0035.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6558 | out: hHeap=0x260000) returned 1 [0035.066] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0035.066] GetLastError () returned 0x0 [0035.067] GetLastError () returned 0x0 [0035.067] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0035.067] GetLastError () returned 0x0 [0035.067] GetLastError () returned 0x0 [0035.067] ReadFile (in: hFile=0x108, lpBuffer=0x321ad8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x321ad8*, lpNumberOfBytesRead=0x224fdb0*=0x32b, lpOverlapped=0x0) returned 1 [0035.089] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.089] WriteFile (in: hFile=0x108, lpBuffer=0x321ad8*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x321ad8*, lpNumberOfBytesWritten=0x224fdb0*=0x32b, lpOverlapped=0x0) returned 1 [0035.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x321ad8 | out: hHeap=0x260000) returned 1 [0035.089] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.089] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.090] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.090] CloseHandle (hObject=0x108) returned 1 [0035.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.[deadmin@cock.li].deadmin")) returned 1 [0035.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0035.095] GetLastError () returned 0x0 [0035.095] RtlWakeConditionVariable () returned 0x27e828 [0035.095] GetCurrentThreadId () returned 0x98c [0035.095] GetCurrentThreadId () returned 0x98c [0035.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0035.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0035.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0035.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0035.095] lstrlenW (lpString=".ldf") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0035.095] lstrlenW (lpString=".vhd") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0035.095] lstrlenW (lpString=".vhdx") returned 5 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0035.095] lstrlenW (lpString=".pst") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0035.095] lstrlenW (lpString=".ost") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0035.095] lstrlenW (lpString=".bak") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0035.095] lstrlenW (lpString=".bac") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0035.095] lstrlenW (lpString=".sys") returned 4 [0035.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0035.095] lstrlenW (lpString=".v2i") returned 4 [0035.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0035.096] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0035.096] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.098] lstrlenW (lpString=".sql") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0035.098] lstrlenW (lpString=".mdf") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0035.098] lstrlenW (lpString=".txt") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0035.098] lstrlenW (lpString=".dbf") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0035.098] lstrlenW (lpString=".ckp") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0035.098] lstrlenW (lpString=".dacpac") returned 7 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0035.098] lstrlenW (lpString=".db3") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0035.098] lstrlenW (lpString=".dtxs") returned 5 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0035.098] lstrlenW (lpString=".mdt") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0035.098] lstrlenW (lpString=".sdf") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0035.098] lstrlenW (lpString=".MDF") returned 4 [0035.098] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0035.099] lstrlenW (lpString=".DBF") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0035.099] lstrlenW (lpString=".DB") returned 3 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0035.099] lstrlenW (lpString=".db") returned 3 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0035.099] lstrlenW (lpString=".ndf") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0035.099] lstrlenW (lpString=".NDF") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0035.099] lstrlenW (lpString=".Mdf") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0035.099] lstrlenW (lpString=".dat") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0035.099] lstrlenW (lpString=".DAT") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0035.099] lstrlenW (lpString=".ldf") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0035.099] lstrlenW (lpString=".LDF") returned 4 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0035.099] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.099] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ec8b0 [0035.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.099] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0035.356] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.356] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0035.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f0ce0 [0035.357] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15535825164) returned 1 [0035.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa52933b0, dwHighDateTime=0x1d585b4)) [0035.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0035.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0035.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0035.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1cd0 [0035.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d53c0 [0035.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0035.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0035.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f75c0 [0035.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f75c0 | out: hHeap=0x260000) returned 1 [0035.358] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0035.358] GetLastError () returned 0x0 [0035.359] GetLastError () returned 0x0 [0035.359] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0035.359] GetLastError () returned 0x0 [0035.359] GetLastError () returned 0x0 [0035.359] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x16fc, lpOverlapped=0x0) returned 1 [0035.363] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe904, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.363] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x16fc, lpOverlapped=0x0) returned 1 [0035.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0035.363] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.363] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.363] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.364] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.364] CloseHandle (hObject=0x108) returned 1 [0035.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0035.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0035.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0035.367] GetLastError () returned 0x0 [0035.367] RtlWakeConditionVariable () returned 0x27e828 [0035.367] GetCurrentThreadId () returned 0x98c [0035.367] GetCurrentThreadId () returned 0x98c [0035.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b120 | out: hHeap=0x260000) returned 1 [0035.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0035.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b120 [0035.367] lstrlenW (lpString=".ldf") returned 4 [0035.367] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".ldf") returned 0x0 [0035.368] lstrlenW (lpString=".vhd") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".vhd") returned 0x0 [0035.368] lstrlenW (lpString=".vhdx") returned 5 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".vhdx") returned 0x0 [0035.368] lstrlenW (lpString=".pst") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".pst") returned 0x0 [0035.368] lstrlenW (lpString=".ost") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".ost") returned 0x0 [0035.368] lstrlenW (lpString=".bak") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".bak") returned 0x0 [0035.368] lstrlenW (lpString=".bac") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".bac") returned 0x0 [0035.368] lstrlenW (lpString=".sys") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".sys") returned 0x0 [0035.368] lstrlenW (lpString=".v2i") returned 4 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".v2i") returned 0x0 [0035.368] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.368] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0035.368] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.369] lstrlenW (lpString=".sql") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".sql") returned 0x0 [0035.369] lstrlenW (lpString=".mdf") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".mdf") returned 0x0 [0035.369] lstrlenW (lpString=".txt") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".txt") returned 0x0 [0035.369] lstrlenW (lpString=".dbf") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".dbf") returned 0x0 [0035.369] lstrlenW (lpString=".ckp") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".ckp") returned 0x0 [0035.369] lstrlenW (lpString=".dacpac") returned 7 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".dacpac") returned 0x0 [0035.369] lstrlenW (lpString=".db3") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".db3") returned 0x0 [0035.369] lstrlenW (lpString=".dtxs") returned 5 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".dtxs") returned 0x0 [0035.369] lstrlenW (lpString=".mdt") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".mdt") returned 0x0 [0035.369] lstrlenW (lpString=".sdf") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".sdf") returned 0x0 [0035.369] lstrlenW (lpString=".MDF") returned 4 [0035.369] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".MDF") returned 0x0 [0035.369] lstrlenW (lpString=".DBF") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".DBF") returned 0x0 [0035.370] lstrlenW (lpString=".DB") returned 3 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".DB") returned 0x0 [0035.370] lstrlenW (lpString=".db") returned 3 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".db") returned 0x0 [0035.370] lstrlenW (lpString=".ndf") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".ndf") returned 0x0 [0035.370] lstrlenW (lpString=".NDF") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".NDF") returned 0x0 [0035.370] lstrlenW (lpString=".Mdf") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".Mdf") returned 0x0 [0035.370] lstrlenW (lpString=".dat") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".dat") returned 0x0 [0035.370] lstrlenW (lpString=".DAT") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".DAT") returned 0x0 [0035.370] lstrlenW (lpString=".ldf") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".ldf") returned 0x0 [0035.370] lstrlenW (lpString=".LDF") returned 4 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch=".LDF") returned 0x0 [0035.370] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.370] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd8 [0035.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.370] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0035.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.372] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f0ce0 [0035.372] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15537283910) returned 1 [0035.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa52b9510, dwHighDateTime=0x1d585b4)) [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299110 [0035.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299110 | out: hHeap=0x260000) returned 1 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0035.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0035.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0035.373] GetLastError () returned 0x0 [0035.373] GetLastError () returned 0x0 [0035.373] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0035.373] GetLastError () returned 0x0 [0035.373] GetLastError () returned 0x0 [0035.373] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x567, lpOverlapped=0x0) returned 1 [0035.375] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.375] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x567, lpOverlapped=0x0) returned 1 [0035.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0035.375] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.375] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.375] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.375] CloseHandle (hObject=0x108) returned 1 [0035.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.[deadmin@cock.li].deadmin")) returned 1 [0035.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0035.377] GetLastError () returned 0x0 [0035.377] RtlWakeConditionVariable () returned 0x27e828 [0035.377] GetCurrentThreadId () returned 0x98c [0035.377] GetCurrentThreadId () returned 0x98c [0035.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0035.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0035.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0035.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0035.377] lstrlenW (lpString=".ldf") returned 4 [0035.377] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".ldf") returned 0x0 [0035.377] lstrlenW (lpString=".vhd") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".vhd") returned 0x0 [0035.378] lstrlenW (lpString=".vhdx") returned 5 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".vhdx") returned 0x0 [0035.378] lstrlenW (lpString=".pst") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".pst") returned 0x0 [0035.378] lstrlenW (lpString=".ost") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".ost") returned 0x0 [0035.378] lstrlenW (lpString=".bak") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".bak") returned 0x0 [0035.378] lstrlenW (lpString=".bac") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".bac") returned 0x0 [0035.378] lstrlenW (lpString=".sys") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".sys") returned 0x0 [0035.378] lstrlenW (lpString=".v2i") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".v2i") returned 0x0 [0035.378] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0035.378] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.378] lstrlenW (lpString=".sql") returned 4 [0035.378] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".sql") returned 0x0 [0035.379] lstrlenW (lpString=".mdf") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".mdf") returned 0x0 [0035.379] lstrlenW (lpString=".txt") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".txt") returned 0x0 [0035.379] lstrlenW (lpString=".dbf") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".dbf") returned 0x0 [0035.379] lstrlenW (lpString=".ckp") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".ckp") returned 0x0 [0035.379] lstrlenW (lpString=".dacpac") returned 7 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".dacpac") returned 0x0 [0035.379] lstrlenW (lpString=".db3") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".db3") returned 0x0 [0035.379] lstrlenW (lpString=".dtxs") returned 5 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".dtxs") returned 0x0 [0035.379] lstrlenW (lpString=".mdt") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".mdt") returned 0x0 [0035.379] lstrlenW (lpString=".sdf") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".sdf") returned 0x0 [0035.379] lstrlenW (lpString=".MDF") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".MDF") returned 0x0 [0035.379] lstrlenW (lpString=".DBF") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".DBF") returned 0x0 [0035.379] lstrlenW (lpString=".DB") returned 3 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".DB") returned 0x0 [0035.379] lstrlenW (lpString=".db") returned 3 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".db") returned 0x0 [0035.379] lstrlenW (lpString=".ndf") returned 4 [0035.379] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".ndf") returned 0x0 [0035.380] lstrlenW (lpString=".NDF") returned 4 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".NDF") returned 0x0 [0035.380] lstrlenW (lpString=".Mdf") returned 4 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".Mdf") returned 0x0 [0035.380] lstrlenW (lpString=".dat") returned 4 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".dat") returned 0x0 [0035.380] lstrlenW (lpString=".DAT") returned 4 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".DAT") returned 0x0 [0035.380] lstrlenW (lpString=".ldf") returned 4 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".ldf") returned 0x0 [0035.380] lstrlenW (lpString=".LDF") returned 4 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch=".LDF") returned 0x0 [0035.380] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.380] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd8 [0035.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.380] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0035.381] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.381] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0035.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f0ce0 [0035.381] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15538258901) returned 1 [0035.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa52df670, dwHighDateTime=0x1d585b4)) [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1720 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299110 [0035.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299110 | out: hHeap=0x260000) returned 1 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ced8 [0035.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0035.382] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0035.382] GetLastError () returned 0x0 [0035.382] GetLastError () returned 0x0 [0035.382] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0035.382] GetLastError () returned 0x0 [0035.383] GetLastError () returned 0x0 [0035.383] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.386] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.386] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0035.387] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.387] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.388] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.388] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.389] CloseHandle (hObject=0x108) returned 1 [0035.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.[deadmin@cock.li].deadmin")) returned 1 [0035.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0035.973] GetLastError () returned 0x0 [0035.973] RtlWakeConditionVariable () returned 0x27e828 [0035.973] GetCurrentThreadId () returned 0x98c [0035.973] GetCurrentThreadId () returned 0x98c [0035.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b290 | out: hHeap=0x260000) returned 1 [0035.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0035.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b290 [0035.973] lstrlenW (lpString=".ldf") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".ldf") returned 0x0 [0035.974] lstrlenW (lpString=".vhd") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".vhd") returned 0x0 [0035.974] lstrlenW (lpString=".vhdx") returned 5 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".vhdx") returned 0x0 [0035.974] lstrlenW (lpString=".pst") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".pst") returned 0x0 [0035.974] lstrlenW (lpString=".ost") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".ost") returned 0x0 [0035.974] lstrlenW (lpString=".bak") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".bak") returned 0x0 [0035.974] lstrlenW (lpString=".bac") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".bac") returned 0x0 [0035.974] lstrlenW (lpString=".sys") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".sys") returned 0x0 [0035.974] lstrlenW (lpString=".v2i") returned 4 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".v2i") returned 0x0 [0035.974] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0035.974] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.975] lstrlenW (lpString=".sql") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".sql") returned 0x0 [0035.975] lstrlenW (lpString=".mdf") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".mdf") returned 0x0 [0035.975] lstrlenW (lpString=".txt") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".txt") returned 0x0 [0035.975] lstrlenW (lpString=".dbf") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".dbf") returned 0x0 [0035.975] lstrlenW (lpString=".ckp") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".ckp") returned 0x0 [0035.975] lstrlenW (lpString=".dacpac") returned 7 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".dacpac") returned 0x0 [0035.975] lstrlenW (lpString=".db3") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".db3") returned 0x0 [0035.975] lstrlenW (lpString=".dtxs") returned 5 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".dtxs") returned 0x0 [0035.975] lstrlenW (lpString=".mdt") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".mdt") returned 0x0 [0035.975] lstrlenW (lpString=".sdf") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".sdf") returned 0x0 [0035.975] lstrlenW (lpString=".MDF") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".MDF") returned 0x0 [0035.975] lstrlenW (lpString=".DBF") returned 4 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".DBF") returned 0x0 [0035.975] lstrlenW (lpString=".DB") returned 3 [0035.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".DB") returned 0x0 [0035.975] lstrlenW (lpString=".db") returned 3 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".db") returned 0x0 [0035.976] lstrlenW (lpString=".ndf") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".ndf") returned 0x0 [0035.976] lstrlenW (lpString=".NDF") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".NDF") returned 0x0 [0035.976] lstrlenW (lpString=".Mdf") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".Mdf") returned 0x0 [0035.976] lstrlenW (lpString=".dat") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".dat") returned 0x0 [0035.976] lstrlenW (lpString=".DAT") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".DAT") returned 0x0 [0035.976] lstrlenW (lpString=".ldf") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".ldf") returned 0x0 [0035.976] lstrlenW (lpString=".LDF") returned 4 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch=".LDF") returned 0x0 [0035.976] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.976] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ec8b0 [0035.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.976] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0035.977] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.977] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0035.977] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15597817162) returned 1 [0035.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa5886ab0, dwHighDateTime=0x1d585b4)) [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e68 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d53c0 [0035.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0035.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0035.978] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0035.978] GetLastError () returned 0x0 [0035.978] GetLastError () returned 0x0 [0035.978] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0035.978] GetLastError () returned 0x0 [0035.978] GetLastError () returned 0x0 [0035.978] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x4cf, lpOverlapped=0x0) returned 1 [0035.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.981] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x4cf, lpOverlapped=0x0) returned 1 [0035.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0035.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.981] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.981] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.981] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.981] CloseHandle (hObject=0x108) returned 1 [0035.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0035.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0035.983] GetLastError () returned 0x0 [0035.983] RtlWakeConditionVariable () returned 0x27e828 [0035.983] GetCurrentThreadId () returned 0x98c [0035.983] GetCurrentThreadId () returned 0x98c [0035.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0035.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d370 | out: hHeap=0x260000) returned 1 [0035.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ea0 | out: hHeap=0x260000) returned 1 [0035.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0035.983] lstrlenW (lpString=".ldf") returned 4 [0035.983] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0035.983] lstrlenW (lpString=".vhd") returned 4 [0035.983] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0035.983] lstrlenW (lpString=".vhdx") returned 5 [0035.983] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0035.983] lstrlenW (lpString=".pst") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0035.984] lstrlenW (lpString=".ost") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0035.984] lstrlenW (lpString=".bak") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0035.984] lstrlenW (lpString=".bac") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0035.984] lstrlenW (lpString=".sys") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0035.984] lstrlenW (lpString=".v2i") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0035.984] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0035.984] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.984] lstrlenW (lpString=".sql") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0035.984] lstrlenW (lpString=".mdf") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0035.984] lstrlenW (lpString=".txt") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0035.984] lstrlenW (lpString=".dbf") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0035.984] lstrlenW (lpString=".ckp") returned 4 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0035.984] lstrlenW (lpString=".dacpac") returned 7 [0035.984] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0035.984] lstrlenW (lpString=".db3") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0035.985] lstrlenW (lpString=".dtxs") returned 5 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0035.985] lstrlenW (lpString=".mdt") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0035.985] lstrlenW (lpString=".sdf") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0035.985] lstrlenW (lpString=".MDF") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0035.985] lstrlenW (lpString=".DBF") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0035.985] lstrlenW (lpString=".DB") returned 3 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0035.985] lstrlenW (lpString=".db") returned 3 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0035.985] lstrlenW (lpString=".ndf") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0035.985] lstrlenW (lpString=".NDF") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0035.985] lstrlenW (lpString=".Mdf") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0035.985] lstrlenW (lpString=".dat") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0035.985] lstrlenW (lpString=".DAT") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0035.985] lstrlenW (lpString=".ldf") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0035.985] lstrlenW (lpString=".LDF") returned 4 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0035.985] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ec8b0 [0035.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.986] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d53c0) returned 1 [0035.986] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.986] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0035.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0035.986] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15598757925) returned 1 [0035.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa5886ab0, dwHighDateTime=0x1d585b4)) [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ea0 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d53c0 [0035.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ea0 | out: hHeap=0x260000) returned 1 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d178 [0035.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0035.987] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0035.987] GetLastError () returned 0x0 [0035.987] GetLastError () returned 0x0 [0035.987] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0035.987] GetLastError () returned 0x0 [0035.987] GetLastError () returned 0x0 [0035.987] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x73c, lpOverlapped=0x0) returned 1 [0036.231] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.231] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x73c, lpOverlapped=0x0) returned 1 [0036.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.232] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.232] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.232] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.232] CloseHandle (hObject=0x108) returned 1 [0036.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0036.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0036.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0036.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.240] GetLastError () returned 0x0 [0036.240] RtlWakeConditionVariable () returned 0x27e828 [0036.240] GetCurrentThreadId () returned 0x98c [0036.240] GetCurrentThreadId () returned 0x98c [0036.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0036.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d4c0 | out: hHeap=0x260000) returned 1 [0036.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0fb8 | out: hHeap=0x260000) returned 1 [0036.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d4c0 [0036.240] lstrlenW (lpString=".ldf") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".ldf") returned 0x0 [0036.240] lstrlenW (lpString=".vhd") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".vhd") returned 0x0 [0036.240] lstrlenW (lpString=".vhdx") returned 5 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".vhdx") returned 0x0 [0036.240] lstrlenW (lpString=".pst") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".pst") returned 0x0 [0036.240] lstrlenW (lpString=".ost") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".ost") returned 0x0 [0036.240] lstrlenW (lpString=".bak") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".bak") returned 0x0 [0036.240] lstrlenW (lpString=".bac") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".bac") returned 0x0 [0036.240] lstrlenW (lpString=".sys") returned 4 [0036.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".sys") returned 0x0 [0036.240] lstrlenW (lpString=".v2i") returned 4 [0036.241] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".v2i") returned 0x0 [0036.241] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.241] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0036.241] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.360] lstrlenW (lpString=".sql") returned 4 [0036.360] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".sql") returned 0x0 [0036.360] lstrlenW (lpString=".mdf") returned 4 [0036.360] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".mdf") returned 0x0 [0036.360] lstrlenW (lpString=".txt") returned 4 [0036.360] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".txt") returned 0x0 [0036.360] lstrlenW (lpString=".dbf") returned 4 [0036.360] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".dbf") returned 0x0 [0036.361] lstrlenW (lpString=".ckp") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".ckp") returned 0x0 [0036.361] lstrlenW (lpString=".dacpac") returned 7 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".dacpac") returned 0x0 [0036.361] lstrlenW (lpString=".db3") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".db3") returned 0x0 [0036.361] lstrlenW (lpString=".dtxs") returned 5 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".dtxs") returned 0x0 [0036.361] lstrlenW (lpString=".mdt") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".mdt") returned 0x0 [0036.361] lstrlenW (lpString=".sdf") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".sdf") returned 0x0 [0036.361] lstrlenW (lpString=".MDF") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".MDF") returned 0x0 [0036.361] lstrlenW (lpString=".DBF") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".DBF") returned 0x0 [0036.361] lstrlenW (lpString=".DB") returned 3 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".DB") returned 0x0 [0036.361] lstrlenW (lpString=".db") returned 3 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".db") returned 0x0 [0036.361] lstrlenW (lpString=".ndf") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".ndf") returned 0x0 [0036.361] lstrlenW (lpString=".NDF") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".NDF") returned 0x0 [0036.361] lstrlenW (lpString=".Mdf") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".Mdf") returned 0x0 [0036.361] lstrlenW (lpString=".dat") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".dat") returned 0x0 [0036.361] lstrlenW (lpString=".DAT") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".DAT") returned 0x0 [0036.361] lstrlenW (lpString=".ldf") returned 4 [0036.361] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".ldf") returned 0x0 [0036.362] lstrlenW (lpString=".LDF") returned 4 [0036.362] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch=".LDF") returned 0x0 [0036.362] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.362] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0036.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.362] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d7370) returned 1 [0036.363] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.363] CryptReleaseContext (hProv=0x2d7370, dwFlags=0x0) returned 1 [0036.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0036.363] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15636403656) returned 1 [0036.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa5c18bb0, dwHighDateTime=0x1d585b4)) [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb20 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb20 | out: hHeap=0x260000) returned 1 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d370 [0036.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d370 | out: hHeap=0x260000) returned 1 [0036.363] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0036.364] GetLastError () returned 0x0 [0036.364] GetLastError () returned 0x0 [0036.364] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0036.364] GetLastError () returned 0x0 [0036.364] GetLastError () returned 0x0 [0036.364] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.369] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.369] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.369] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.369] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.371] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.371] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.371] CloseHandle (hObject=0x100) returned 1 [0036.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.[deadmin@cock.li].deadmin")) returned 1 [0036.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0036.956] GetLastError () returned 0x0 [0036.956] RtlWakeConditionVariable () returned 0x27e828 [0036.956] GetCurrentThreadId () returned 0x98c [0036.956] GetCurrentThreadId () returned 0x98c [0036.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0036.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0036.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1338 | out: hHeap=0x260000) returned 1 [0036.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d8b0 [0036.957] lstrlenW (lpString=".ldf") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0036.957] lstrlenW (lpString=".vhd") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0036.957] lstrlenW (lpString=".vhdx") returned 5 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0036.957] lstrlenW (lpString=".pst") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0036.957] lstrlenW (lpString=".ost") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0036.957] lstrlenW (lpString=".bak") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0036.957] lstrlenW (lpString=".bac") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0036.957] lstrlenW (lpString=".sys") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0036.957] lstrlenW (lpString=".v2i") returned 4 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0036.957] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0036.957] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.257] lstrlenW (lpString=".sql") returned 4 [0039.257] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0039.257] lstrlenW (lpString=".mdf") returned 4 [0039.257] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0039.257] lstrlenW (lpString=".txt") returned 4 [0039.257] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0039.257] lstrlenW (lpString=".dbf") returned 4 [0039.257] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0039.257] lstrlenW (lpString=".ckp") returned 4 [0039.257] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0039.257] lstrlenW (lpString=".dacpac") returned 7 [0039.257] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0039.258] lstrlenW (lpString=".db3") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0039.258] lstrlenW (lpString=".dtxs") returned 5 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0039.258] lstrlenW (lpString=".mdt") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0039.258] lstrlenW (lpString=".sdf") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0039.258] lstrlenW (lpString=".MDF") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0039.258] lstrlenW (lpString=".DBF") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0039.258] lstrlenW (lpString=".DB") returned 3 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0039.258] lstrlenW (lpString=".db") returned 3 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0039.258] lstrlenW (lpString=".ndf") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0039.258] lstrlenW (lpString=".NDF") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0039.258] lstrlenW (lpString=".Mdf") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0039.258] lstrlenW (lpString=".dat") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0039.258] lstrlenW (lpString=".DAT") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0039.258] lstrlenW (lpString=".ldf") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.258] lstrlenW (lpString=".LDF") returned 4 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0039.258] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.258] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.259] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d070) returned 1 [0039.259] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.259] CryptReleaseContext (hProv=0x27d070, dwFlags=0x0) returned 1 [0039.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0039.259] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15926060956) returned 1 [0039.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa63fb490, dwHighDateTime=0x1d585b4)) [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a17c8 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d070 [0039.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a17c8 | out: hHeap=0x260000) returned 1 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d4c0 [0039.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312d58 [0039.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d4c0 | out: hHeap=0x260000) returned 1 [0039.260] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.260] GetLastError () returned 0x0 [0039.260] GetLastError () returned 0x0 [0039.260] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.260] GetLastError () returned 0x0 [0039.260] GetLastError () returned 0x0 [0039.261] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x750, lpOverlapped=0x0) returned 1 [0039.263] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.263] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x750, lpOverlapped=0x0) returned 1 [0039.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.263] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.263] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.264] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.264] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.264] CloseHandle (hObject=0xfc) returned 1 [0039.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.264] GetLastError () returned 0x0 [0039.264] RtlWakeConditionVariable () returned 0x27e828 [0039.265] GetCurrentThreadId () returned 0x98c [0039.265] GetCurrentThreadId () returned 0x98c [0039.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0039.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ddf0 | out: hHeap=0x260000) returned 1 [0039.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1790 | out: hHeap=0x260000) returned 1 [0039.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ddf0 [0039.265] lstrlenW (lpString=".ldf") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".ldf") returned 0x0 [0039.265] lstrlenW (lpString=".vhd") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".vhd") returned 0x0 [0039.265] lstrlenW (lpString=".vhdx") returned 5 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".vhdx") returned 0x0 [0039.265] lstrlenW (lpString=".pst") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".pst") returned 0x0 [0039.265] lstrlenW (lpString=".ost") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".ost") returned 0x0 [0039.265] lstrlenW (lpString=".bak") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".bak") returned 0x0 [0039.265] lstrlenW (lpString=".bac") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".bac") returned 0x0 [0039.265] lstrlenW (lpString=".sys") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".sys") returned 0x0 [0039.265] lstrlenW (lpString=".v2i") returned 4 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".v2i") returned 0x0 [0039.265] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.265] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0039.265] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.461] lstrlenW (lpString=".sql") returned 4 [0039.481] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".sql") returned 0x0 [0039.484] lstrlenW (lpString=".mdf") returned 4 [0039.491] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".mdf") returned 0x0 [0039.491] lstrlenW (lpString=".txt") returned 4 [0039.491] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".txt") returned 0x0 [0039.491] lstrlenW (lpString=".dbf") returned 4 [0039.491] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".dbf") returned 0x0 [0039.491] lstrlenW (lpString=".ckp") returned 4 [0039.491] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".ckp") returned 0x0 [0039.491] lstrlenW (lpString=".dacpac") returned 7 [0039.491] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".dacpac") returned 0x0 [0039.491] lstrlenW (lpString=".db3") returned 4 [0039.491] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".db3") returned 0x0 [0039.492] lstrlenW (lpString=".dtxs") returned 5 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".dtxs") returned 0x0 [0039.492] lstrlenW (lpString=".mdt") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".mdt") returned 0x0 [0039.492] lstrlenW (lpString=".sdf") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".sdf") returned 0x0 [0039.492] lstrlenW (lpString=".MDF") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".MDF") returned 0x0 [0039.492] lstrlenW (lpString=".DBF") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".DBF") returned 0x0 [0039.492] lstrlenW (lpString=".DB") returned 3 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".DB") returned 0x0 [0039.492] lstrlenW (lpString=".db") returned 3 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".db") returned 0x0 [0039.492] lstrlenW (lpString=".ndf") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".ndf") returned 0x0 [0039.492] lstrlenW (lpString=".NDF") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".NDF") returned 0x0 [0039.492] lstrlenW (lpString=".Mdf") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".Mdf") returned 0x0 [0039.492] lstrlenW (lpString=".dat") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".dat") returned 0x0 [0039.492] lstrlenW (lpString=".DAT") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".DAT") returned 0x0 [0039.492] lstrlenW (lpString=".ldf") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".ldf") returned 0x0 [0039.492] lstrlenW (lpString=".LDF") returned 4 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch=".LDF") returned 0x0 [0039.492] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.492] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.492] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.493] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.494] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15949480210) returned 1 [0039.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa659e3b0, dwHighDateTime=0x1d585b4)) [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992f0 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992f0 | out: hHeap=0x260000) returned 1 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d8b0 [0039.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0039.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.494] GetLastError () returned 0x0 [0039.494] GetLastError () returned 0x0 [0039.494] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.494] GetLastError () returned 0x0 [0039.495] GetLastError () returned 0x0 [0039.495] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.499] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.499] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.499] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.499] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.501] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.501] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.501] CloseHandle (hObject=0x108) returned 1 [0039.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.[deadmin@cock.li].deadmin")) returned 1 [0039.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.502] GetLastError () returned 0x0 [0039.502] RtlWakeConditionVariable () returned 0x27e828 [0039.502] GetCurrentThreadId () returned 0x98c [0039.502] GetCurrentThreadId () returned 0x98c [0039.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0039.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e138 | out: hHeap=0x260000) returned 1 [0039.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299328 | out: hHeap=0x260000) returned 1 [0039.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e138 [0039.502] lstrlenW (lpString=".ldf") returned 4 [0039.502] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".ldf") returned 0x0 [0039.503] lstrlenW (lpString=".vhd") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".vhd") returned 0x0 [0039.503] lstrlenW (lpString=".vhdx") returned 5 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".vhdx") returned 0x0 [0039.503] lstrlenW (lpString=".pst") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".pst") returned 0x0 [0039.503] lstrlenW (lpString=".ost") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".ost") returned 0x0 [0039.503] lstrlenW (lpString=".bak") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".bak") returned 0x0 [0039.503] lstrlenW (lpString=".bac") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".bac") returned 0x0 [0039.503] lstrlenW (lpString=".sys") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".sys") returned 0x0 [0039.503] lstrlenW (lpString=".v2i") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".v2i") returned 0x0 [0039.503] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.503] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.503] lstrlenW (lpString=".sql") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".sql") returned 0x0 [0039.503] lstrlenW (lpString=".mdf") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".mdf") returned 0x0 [0039.503] lstrlenW (lpString=".txt") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".txt") returned 0x0 [0039.503] lstrlenW (lpString=".dbf") returned 4 [0039.503] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".dbf") returned 0x0 [0039.504] lstrlenW (lpString=".ckp") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".ckp") returned 0x0 [0039.504] lstrlenW (lpString=".dacpac") returned 7 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".dacpac") returned 0x0 [0039.504] lstrlenW (lpString=".db3") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".db3") returned 0x0 [0039.504] lstrlenW (lpString=".dtxs") returned 5 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".dtxs") returned 0x0 [0039.504] lstrlenW (lpString=".mdt") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".mdt") returned 0x0 [0039.504] lstrlenW (lpString=".sdf") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".sdf") returned 0x0 [0039.504] lstrlenW (lpString=".MDF") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".MDF") returned 0x0 [0039.504] lstrlenW (lpString=".DBF") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".DBF") returned 0x0 [0039.504] lstrlenW (lpString=".DB") returned 3 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".DB") returned 0x0 [0039.504] lstrlenW (lpString=".db") returned 3 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".db") returned 0x0 [0039.504] lstrlenW (lpString=".ndf") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".ndf") returned 0x0 [0039.504] lstrlenW (lpString=".NDF") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".NDF") returned 0x0 [0039.504] lstrlenW (lpString=".Mdf") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".Mdf") returned 0x0 [0039.504] lstrlenW (lpString=".dat") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".dat") returned 0x0 [0039.504] lstrlenW (lpString=".DAT") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".DAT") returned 0x0 [0039.504] lstrlenW (lpString=".ldf") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".ldf") returned 0x0 [0039.504] lstrlenW (lpString=".LDF") returned 4 [0039.504] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch=".LDF") returned 0x0 [0039.505] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.505] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.505] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.505] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.506] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15950691954) returned 1 [0039.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa65c4510, dwHighDateTime=0x1d585b4)) [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299328 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299328 | out: hHeap=0x260000) returned 1 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ddf0 [0039.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ddf0 | out: hHeap=0x260000) returned 1 [0039.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.506] GetLastError () returned 0x0 [0039.506] GetLastError () returned 0x0 [0039.507] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.507] GetLastError () returned 0x0 [0039.507] GetLastError () returned 0x0 [0039.507] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.510] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.511] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.511] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.511] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.511] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.511] CloseHandle (hObject=0x108) returned 1 [0039.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.[deadmin@cock.li].deadmin")) returned 1 [0039.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.512] GetLastError () returned 0x0 [0039.513] RtlWakeConditionVariable () returned 0x27e828 [0039.513] GetCurrentThreadId () returned 0x98c [0039.513] GetCurrentThreadId () returned 0x98c [0039.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0039.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e1e0 | out: hHeap=0x260000) returned 1 [0039.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299360 | out: hHeap=0x260000) returned 1 [0039.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e1e0 [0039.513] lstrlenW (lpString=".ldf") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".ldf") returned 0x0 [0039.513] lstrlenW (lpString=".vhd") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".vhd") returned 0x0 [0039.513] lstrlenW (lpString=".vhdx") returned 5 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".vhdx") returned 0x0 [0039.513] lstrlenW (lpString=".pst") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".pst") returned 0x0 [0039.513] lstrlenW (lpString=".ost") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".ost") returned 0x0 [0039.513] lstrlenW (lpString=".bak") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".bak") returned 0x0 [0039.513] lstrlenW (lpString=".bac") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".bac") returned 0x0 [0039.513] lstrlenW (lpString=".sys") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".sys") returned 0x0 [0039.513] lstrlenW (lpString=".v2i") returned 4 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".v2i") returned 0x0 [0039.513] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.513] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch="s\r\n.v2i") returned 0x0 [0039.513] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.514] lstrlenW (lpString=".sql") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".sql") returned 0x0 [0039.514] lstrlenW (lpString=".mdf") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".mdf") returned 0x0 [0039.514] lstrlenW (lpString=".txt") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".txt") returned 0x0 [0039.514] lstrlenW (lpString=".dbf") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".dbf") returned 0x0 [0039.514] lstrlenW (lpString=".ckp") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".ckp") returned 0x0 [0039.514] lstrlenW (lpString=".dacpac") returned 7 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".dacpac") returned 0x0 [0039.514] lstrlenW (lpString=".db3") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".db3") returned 0x0 [0039.514] lstrlenW (lpString=".dtxs") returned 5 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".dtxs") returned 0x0 [0039.514] lstrlenW (lpString=".mdt") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".mdt") returned 0x0 [0039.514] lstrlenW (lpString=".sdf") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".sdf") returned 0x0 [0039.514] lstrlenW (lpString=".MDF") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".MDF") returned 0x0 [0039.514] lstrlenW (lpString=".DBF") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".DBF") returned 0x0 [0039.514] lstrlenW (lpString=".DB") returned 3 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".DB") returned 0x0 [0039.514] lstrlenW (lpString=".db") returned 3 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".db") returned 0x0 [0039.514] lstrlenW (lpString=".ndf") returned 4 [0039.514] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".ndf") returned 0x0 [0039.515] lstrlenW (lpString=".NDF") returned 4 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".NDF") returned 0x0 [0039.515] lstrlenW (lpString=".Mdf") returned 4 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".Mdf") returned 0x0 [0039.515] lstrlenW (lpString=".dat") returned 4 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".dat") returned 0x0 [0039.515] lstrlenW (lpString=".DAT") returned 4 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".DAT") returned 0x0 [0039.515] lstrlenW (lpString=".ldf") returned 4 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".ldf") returned 0x0 [0039.515] lstrlenW (lpString=".LDF") returned 4 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch=".LDF") returned 0x0 [0039.515] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.515] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.515] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.516] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.516] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.516] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15951726012) returned 1 [0039.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa65ea670, dwHighDateTime=0x1d585b4)) [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299360 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299360 | out: hHeap=0x260000) returned 1 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e138 [0039.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e138 | out: hHeap=0x260000) returned 1 [0039.517] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.517] GetLastError () returned 0x0 [0039.517] GetLastError () returned 0x0 [0039.517] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.517] GetLastError () returned 0x0 [0039.517] GetLastError () returned 0x0 [0039.517] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x6a3b, lpOverlapped=0x0) returned 1 [0039.520] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff95c5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.520] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x6a3b, lpOverlapped=0x0) returned 1 [0039.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.520] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.520] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.520] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.520] CloseHandle (hObject=0x108) returned 1 [0039.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.[deadmin@cock.li].deadmin")) returned 1 [0039.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.521] GetLastError () returned 0x0 [0039.522] RtlWakeConditionVariable () returned 0x27e828 [0039.522] GetCurrentThreadId () returned 0x98c [0039.522] GetCurrentThreadId () returned 0x98c [0039.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0039.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299398 | out: hHeap=0x260000) returned 1 [0039.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.522] lstrlenW (lpString=".ldf") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".ldf") returned 0x0 [0039.522] lstrlenW (lpString=".vhd") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".vhd") returned 0x0 [0039.522] lstrlenW (lpString=".vhdx") returned 5 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".vhdx") returned 0x0 [0039.522] lstrlenW (lpString=".pst") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".pst") returned 0x0 [0039.522] lstrlenW (lpString=".ost") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".ost") returned 0x0 [0039.522] lstrlenW (lpString=".bak") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".bak") returned 0x0 [0039.522] lstrlenW (lpString=".bac") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".bac") returned 0x0 [0039.522] lstrlenW (lpString=".sys") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".sys") returned 0x0 [0039.522] lstrlenW (lpString=".v2i") returned 4 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".v2i") returned 0x0 [0039.522] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.522] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch="s\r\n.v2i") returned 0x0 [0039.523] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.523] lstrlenW (lpString=".sql") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".sql") returned 0x0 [0039.523] lstrlenW (lpString=".mdf") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".mdf") returned 0x0 [0039.523] lstrlenW (lpString=".txt") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".txt") returned 0x0 [0039.523] lstrlenW (lpString=".dbf") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".dbf") returned 0x0 [0039.523] lstrlenW (lpString=".ckp") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".ckp") returned 0x0 [0039.523] lstrlenW (lpString=".dacpac") returned 7 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".dacpac") returned 0x0 [0039.523] lstrlenW (lpString=".db3") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".db3") returned 0x0 [0039.523] lstrlenW (lpString=".dtxs") returned 5 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".dtxs") returned 0x0 [0039.523] lstrlenW (lpString=".mdt") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".mdt") returned 0x0 [0039.523] lstrlenW (lpString=".sdf") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".sdf") returned 0x0 [0039.523] lstrlenW (lpString=".MDF") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".MDF") returned 0x0 [0039.523] lstrlenW (lpString=".DBF") returned 4 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".DBF") returned 0x0 [0039.523] lstrlenW (lpString=".DB") returned 3 [0039.523] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".DB") returned 0x0 [0039.524] lstrlenW (lpString=".db") returned 3 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".db") returned 0x0 [0039.524] lstrlenW (lpString=".ndf") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".ndf") returned 0x0 [0039.524] lstrlenW (lpString=".NDF") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".NDF") returned 0x0 [0039.524] lstrlenW (lpString=".Mdf") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".Mdf") returned 0x0 [0039.524] lstrlenW (lpString=".dat") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".dat") returned 0x0 [0039.524] lstrlenW (lpString=".DAT") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".DAT") returned 0x0 [0039.524] lstrlenW (lpString=".ldf") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".ldf") returned 0x0 [0039.524] lstrlenW (lpString=".LDF") returned 4 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch=".LDF") returned 0x0 [0039.524] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.524] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.524] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.525] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.525] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15952631822) returned 1 [0039.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa65ea670, dwHighDateTime=0x1d585b4)) [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299398 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299398 | out: hHeap=0x260000) returned 1 [0039.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e1e0 [0039.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e1e0 | out: hHeap=0x260000) returned 1 [0039.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.526] GetLastError () returned 0x0 [0039.526] GetLastError () returned 0x0 [0039.526] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.526] GetLastError () returned 0x0 [0039.526] GetLastError () returned 0x0 [0039.526] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x10676, lpOverlapped=0x0) returned 1 [0039.626] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffef98a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.626] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x10676, lpOverlapped=0x0) returned 1 [0039.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.626] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.626] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.627] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.627] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.627] CloseHandle (hObject=0x108) returned 1 [0039.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.[deadmin@cock.li].deadmin")) returned 1 [0039.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.627] GetLastError () returned 0x0 [0039.628] RtlWakeConditionVariable () returned 0x27e828 [0039.628] GetCurrentThreadId () returned 0x98c [0039.628] GetCurrentThreadId () returned 0x98c [0039.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db280 [0039.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5de0 | out: hHeap=0x260000) returned 1 [0039.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0039.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db348 [0039.628] lstrlenW (lpString=".ldf") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".ldf") returned 0x0 [0039.629] lstrlenW (lpString=".vhd") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".vhd") returned 0x0 [0039.629] lstrlenW (lpString=".vhdx") returned 5 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".vhdx") returned 0x0 [0039.629] lstrlenW (lpString=".pst") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".pst") returned 0x0 [0039.629] lstrlenW (lpString=".ost") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".ost") returned 0x0 [0039.629] lstrlenW (lpString=".bak") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".bak") returned 0x0 [0039.629] lstrlenW (lpString=".bac") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".bac") returned 0x0 [0039.629] lstrlenW (lpString=".sys") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".sys") returned 0x0 [0039.629] lstrlenW (lpString=".v2i") returned 4 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".v2i") returned 0x0 [0039.629] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.629] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.629] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.741] lstrlenW (lpString=".sql") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".sql") returned 0x0 [0039.741] lstrlenW (lpString=".mdf") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".mdf") returned 0x0 [0039.741] lstrlenW (lpString=".txt") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".txt") returned 0x0 [0039.741] lstrlenW (lpString=".dbf") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".dbf") returned 0x0 [0039.741] lstrlenW (lpString=".ckp") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".ckp") returned 0x0 [0039.741] lstrlenW (lpString=".dacpac") returned 7 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".dacpac") returned 0x0 [0039.741] lstrlenW (lpString=".db3") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".db3") returned 0x0 [0039.741] lstrlenW (lpString=".dtxs") returned 5 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".dtxs") returned 0x0 [0039.741] lstrlenW (lpString=".mdt") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".mdt") returned 0x0 [0039.741] lstrlenW (lpString=".sdf") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".sdf") returned 0x0 [0039.741] lstrlenW (lpString=".MDF") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".MDF") returned 0x0 [0039.741] lstrlenW (lpString=".DBF") returned 4 [0039.741] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".DBF") returned 0x0 [0039.741] lstrlenW (lpString=".DB") returned 3 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".DB") returned 0x0 [0039.742] lstrlenW (lpString=".db") returned 3 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".db") returned 0x0 [0039.742] lstrlenW (lpString=".ndf") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".ndf") returned 0x0 [0039.742] lstrlenW (lpString=".NDF") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".NDF") returned 0x0 [0039.742] lstrlenW (lpString=".Mdf") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".Mdf") returned 0x0 [0039.742] lstrlenW (lpString=".dat") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".dat") returned 0x0 [0039.742] lstrlenW (lpString=".DAT") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".DAT") returned 0x0 [0039.742] lstrlenW (lpString=".ldf") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".ldf") returned 0x0 [0039.742] lstrlenW (lpString=".LDF") returned 4 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch=".LDF") returned 0x0 [0039.742] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.742] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.742] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.743] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.743] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2779058 [0039.743] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15974418383) returned 1 [0039.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa67ff9b0, dwHighDateTime=0x1d585b4)) [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299478 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3f48 [0039.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f48 | out: hHeap=0x260000) returned 1 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0039.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.744] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.744] GetLastError () returned 0x0 [0039.744] GetLastError () returned 0x0 [0039.744] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.744] GetLastError () returned 0x0 [0039.744] GetLastError () returned 0x0 [0039.744] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.748] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.748] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.749] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.749] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.750] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.750] CloseHandle (hObject=0x108) returned 1 [0039.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d9568 [0039.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9568 | out: hHeap=0x260000) returned 1 [0039.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.754] GetLastError () returned 0x0 [0039.754] RtlWakeConditionVariable () returned 0x27e828 [0039.754] GetCurrentThreadId () returned 0x98c [0039.754] GetCurrentThreadId () returned 0x98c [0039.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0039.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0039.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dbf8 [0039.754] lstrlenW (lpString=".ldf") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ldf") returned 0x0 [0039.754] lstrlenW (lpString=".vhd") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".vhd") returned 0x0 [0039.754] lstrlenW (lpString=".vhdx") returned 5 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".vhdx") returned 0x0 [0039.754] lstrlenW (lpString=".pst") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".pst") returned 0x0 [0039.754] lstrlenW (lpString=".ost") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ost") returned 0x0 [0039.754] lstrlenW (lpString=".bak") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".bak") returned 0x0 [0039.754] lstrlenW (lpString=".bac") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".bac") returned 0x0 [0039.754] lstrlenW (lpString=".sys") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sys") returned 0x0 [0039.754] lstrlenW (lpString=".v2i") returned 4 [0039.754] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".v2i") returned 0x0 [0039.754] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch="s\r\n.v2i") returned 0x0 [0039.755] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.755] lstrlenW (lpString=".sql") returned 4 [0039.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sql") returned 0x0 [0039.755] lstrlenW (lpString=".mdf") returned 4 [0039.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".mdf") returned 0x0 [0039.755] lstrlenW (lpString=".txt") returned 4 [0039.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".txt") returned 0x0 [0039.755] lstrlenW (lpString=".dbf") returned 4 [0039.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dbf") returned 0x0 [0039.755] lstrlenW (lpString=".ckp") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ckp") returned 0x0 [0039.756] lstrlenW (lpString=".dacpac") returned 7 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dacpac") returned 0x0 [0039.756] lstrlenW (lpString=".db3") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".db3") returned 0x0 [0039.756] lstrlenW (lpString=".dtxs") returned 5 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dtxs") returned 0x0 [0039.756] lstrlenW (lpString=".mdt") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".mdt") returned 0x0 [0039.756] lstrlenW (lpString=".sdf") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sdf") returned 0x0 [0039.756] lstrlenW (lpString=".MDF") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".MDF") returned 0x0 [0039.756] lstrlenW (lpString=".DBF") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DBF") returned 0x0 [0039.756] lstrlenW (lpString=".DB") returned 3 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DB") returned 0x0 [0039.756] lstrlenW (lpString=".db") returned 3 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".db") returned 0x0 [0039.756] lstrlenW (lpString=".ndf") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ndf") returned 0x0 [0039.756] lstrlenW (lpString=".NDF") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".NDF") returned 0x0 [0039.756] lstrlenW (lpString=".Mdf") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".Mdf") returned 0x0 [0039.756] lstrlenW (lpString=".dat") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dat") returned 0x0 [0039.756] lstrlenW (lpString=".DAT") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DAT") returned 0x0 [0039.756] lstrlenW (lpString=".ldf") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ldf") returned 0x0 [0039.756] lstrlenW (lpString=".LDF") returned 4 [0039.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".LDF") returned 0x0 [0039.756] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.757] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.757] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.757] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277a058 [0039.758] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15975864662) returned 1 [0039.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6825b10, dwHighDateTime=0x1d585b4)) [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d178 [0039.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0039.758] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.758] GetLastError () returned 0x0 [0039.758] GetLastError () returned 0x0 [0039.758] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.758] GetLastError () returned 0x0 [0039.758] GetLastError () returned 0x0 [0039.759] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.761] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.761] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.761] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.761] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.762] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.762] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.762] CloseHandle (hObject=0x108) returned 1 [0039.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.[deadmin@cock.li].deadmin")) returned 1 [0039.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.763] GetLastError () returned 0x0 [0039.763] RtlWakeConditionVariable () returned 0x27e828 [0039.763] GetCurrentThreadId () returned 0x98c [0039.763] GetCurrentThreadId () returned 0x98c [0039.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0039.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0039.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0039.763] lstrlenW (lpString=".ldf") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ldf") returned 0x0 [0039.763] lstrlenW (lpString=".vhd") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".vhd") returned 0x0 [0039.763] lstrlenW (lpString=".vhdx") returned 5 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".vhdx") returned 0x0 [0039.763] lstrlenW (lpString=".pst") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".pst") returned 0x0 [0039.763] lstrlenW (lpString=".ost") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ost") returned 0x0 [0039.763] lstrlenW (lpString=".bak") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".bak") returned 0x0 [0039.763] lstrlenW (lpString=".bac") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".bac") returned 0x0 [0039.763] lstrlenW (lpString=".sys") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sys") returned 0x0 [0039.763] lstrlenW (lpString=".v2i") returned 4 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".v2i") returned 0x0 [0039.763] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.763] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.763] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.764] lstrlenW (lpString=".sql") returned 4 [0039.764] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sql") returned 0x0 [0039.764] lstrlenW (lpString=".mdf") returned 4 [0039.764] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".mdf") returned 0x0 [0039.764] lstrlenW (lpString=".txt") returned 4 [0039.764] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".txt") returned 0x0 [0039.764] lstrlenW (lpString=".dbf") returned 4 [0039.764] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dbf") returned 0x0 [0039.764] lstrlenW (lpString=".ckp") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ckp") returned 0x0 [0039.765] lstrlenW (lpString=".dacpac") returned 7 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dacpac") returned 0x0 [0039.765] lstrlenW (lpString=".db3") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".db3") returned 0x0 [0039.765] lstrlenW (lpString=".dtxs") returned 5 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dtxs") returned 0x0 [0039.765] lstrlenW (lpString=".mdt") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".mdt") returned 0x0 [0039.765] lstrlenW (lpString=".sdf") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sdf") returned 0x0 [0039.765] lstrlenW (lpString=".MDF") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".MDF") returned 0x0 [0039.765] lstrlenW (lpString=".DBF") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DBF") returned 0x0 [0039.765] lstrlenW (lpString=".DB") returned 3 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DB") returned 0x0 [0039.765] lstrlenW (lpString=".db") returned 3 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".db") returned 0x0 [0039.765] lstrlenW (lpString=".ndf") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ndf") returned 0x0 [0039.765] lstrlenW (lpString=".NDF") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".NDF") returned 0x0 [0039.765] lstrlenW (lpString=".Mdf") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".Mdf") returned 0x0 [0039.765] lstrlenW (lpString=".dat") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dat") returned 0x0 [0039.765] lstrlenW (lpString=".DAT") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DAT") returned 0x0 [0039.765] lstrlenW (lpString=".ldf") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ldf") returned 0x0 [0039.765] lstrlenW (lpString=".LDF") returned 4 [0039.765] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".LDF") returned 0x0 [0039.765] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.766] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.766] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.766] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.766] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277a058 [0039.767] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15976765146) returned 1 [0039.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa684bc70, dwHighDateTime=0x1d585b4)) [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0039.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0039.767] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.767] GetLastError () returned 0x0 [0039.767] GetLastError () returned 0x0 [0039.767] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.767] GetLastError () returned 0x0 [0039.767] GetLastError () returned 0x0 [0039.767] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.770] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.770] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.771] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.771] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.774] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.774] CloseHandle (hObject=0x108) returned 1 [0039.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.[deadmin@cock.li].deadmin")) returned 1 [0039.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.775] GetLastError () returned 0x0 [0039.775] RtlWakeConditionVariable () returned 0x27e828 [0039.775] GetCurrentThreadId () returned 0x98c [0039.775] GetCurrentThreadId () returned 0x98c [0039.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e480 | out: hHeap=0x260000) returned 1 [0039.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0039.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e480 [0039.775] lstrlenW (lpString=".ldf") returned 4 [0039.775] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ldf") returned 0x0 [0039.775] lstrlenW (lpString=".vhd") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".vhd") returned 0x0 [0039.776] lstrlenW (lpString=".vhdx") returned 5 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".vhdx") returned 0x0 [0039.776] lstrlenW (lpString=".pst") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".pst") returned 0x0 [0039.776] lstrlenW (lpString=".ost") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ost") returned 0x0 [0039.776] lstrlenW (lpString=".bak") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".bak") returned 0x0 [0039.776] lstrlenW (lpString=".bac") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".bac") returned 0x0 [0039.776] lstrlenW (lpString=".sys") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sys") returned 0x0 [0039.776] lstrlenW (lpString=".v2i") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".v2i") returned 0x0 [0039.776] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch="s\r\n.v2i") returned 0x0 [0039.776] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.776] lstrlenW (lpString=".sql") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sql") returned 0x0 [0039.776] lstrlenW (lpString=".mdf") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".mdf") returned 0x0 [0039.776] lstrlenW (lpString=".txt") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".txt") returned 0x0 [0039.776] lstrlenW (lpString=".dbf") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dbf") returned 0x0 [0039.776] lstrlenW (lpString=".ckp") returned 4 [0039.776] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ckp") returned 0x0 [0039.777] lstrlenW (lpString=".dacpac") returned 7 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dacpac") returned 0x0 [0039.777] lstrlenW (lpString=".db3") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".db3") returned 0x0 [0039.777] lstrlenW (lpString=".dtxs") returned 5 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dtxs") returned 0x0 [0039.777] lstrlenW (lpString=".mdt") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".mdt") returned 0x0 [0039.777] lstrlenW (lpString=".sdf") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sdf") returned 0x0 [0039.777] lstrlenW (lpString=".MDF") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".MDF") returned 0x0 [0039.777] lstrlenW (lpString=".DBF") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DBF") returned 0x0 [0039.777] lstrlenW (lpString=".DB") returned 3 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DB") returned 0x0 [0039.777] lstrlenW (lpString=".db") returned 3 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".db") returned 0x0 [0039.777] lstrlenW (lpString=".ndf") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ndf") returned 0x0 [0039.777] lstrlenW (lpString=".NDF") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".NDF") returned 0x0 [0039.777] lstrlenW (lpString=".Mdf") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".Mdf") returned 0x0 [0039.777] lstrlenW (lpString=".dat") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dat") returned 0x0 [0039.777] lstrlenW (lpString=".DAT") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DAT") returned 0x0 [0039.777] lstrlenW (lpString=".ldf") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ldf") returned 0x0 [0039.777] lstrlenW (lpString=".LDF") returned 4 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".LDF") returned 0x0 [0039.777] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.777] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.778] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.778] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.778] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277a058 [0039.778] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15977959471) returned 1 [0039.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa684bc70, dwHighDateTime=0x1d585b4)) [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dca0 [0039.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0039.779] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.779] GetLastError () returned 0x0 [0039.779] GetLastError () returned 0x0 [0039.779] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.779] GetLastError () returned 0x0 [0039.779] GetLastError () returned 0x0 [0039.779] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.865] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.865] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.866] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.866] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.867] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.868] CloseHandle (hObject=0x108) returned 1 [0039.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[deadmin@cock.li].deadmin")) returned 1 [0039.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee260 | out: hHeap=0x260000) returned 1 [0039.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.877] GetLastError () returned 0x0 [0039.877] RtlWakeConditionVariable () returned 0x27e828 [0039.877] GetCurrentThreadId () returned 0x98c [0039.877] GetCurrentThreadId () returned 0x98c [0039.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bec8 [0039.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c1a8 | out: hHeap=0x260000) returned 1 [0039.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0039.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c1a8 [0039.878] lstrlenW (lpString=".ldf") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".ldf") returned 0x0 [0039.878] lstrlenW (lpString=".vhd") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".vhd") returned 0x0 [0039.878] lstrlenW (lpString=".vhdx") returned 5 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".vhdx") returned 0x0 [0039.878] lstrlenW (lpString=".pst") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".pst") returned 0x0 [0039.878] lstrlenW (lpString=".ost") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".ost") returned 0x0 [0039.878] lstrlenW (lpString=".bak") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".bak") returned 0x0 [0039.878] lstrlenW (lpString=".bac") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".bac") returned 0x0 [0039.878] lstrlenW (lpString=".sys") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".sys") returned 0x0 [0039.878] lstrlenW (lpString=".v2i") returned 4 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".v2i") returned 0x0 [0039.878] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.878] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.878] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.879] lstrlenW (lpString=".sql") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".sql") returned 0x0 [0039.879] lstrlenW (lpString=".mdf") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".mdf") returned 0x0 [0039.879] lstrlenW (lpString=".txt") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".txt") returned 0x0 [0039.879] lstrlenW (lpString=".dbf") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".dbf") returned 0x0 [0039.879] lstrlenW (lpString=".ckp") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".ckp") returned 0x0 [0039.879] lstrlenW (lpString=".dacpac") returned 7 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".dacpac") returned 0x0 [0039.879] lstrlenW (lpString=".db3") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".db3") returned 0x0 [0039.879] lstrlenW (lpString=".dtxs") returned 5 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".dtxs") returned 0x0 [0039.879] lstrlenW (lpString=".mdt") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".mdt") returned 0x0 [0039.879] lstrlenW (lpString=".sdf") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".sdf") returned 0x0 [0039.879] lstrlenW (lpString=".MDF") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".MDF") returned 0x0 [0039.879] lstrlenW (lpString=".DBF") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".DBF") returned 0x0 [0039.879] lstrlenW (lpString=".DB") returned 3 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".DB") returned 0x0 [0039.879] lstrlenW (lpString=".db") returned 3 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".db") returned 0x0 [0039.879] lstrlenW (lpString=".ndf") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".ndf") returned 0x0 [0039.879] lstrlenW (lpString=".NDF") returned 4 [0039.879] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".NDF") returned 0x0 [0039.879] lstrlenW (lpString=".Mdf") returned 4 [0039.880] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".Mdf") returned 0x0 [0039.880] lstrlenW (lpString=".dat") returned 4 [0039.880] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".dat") returned 0x0 [0039.880] lstrlenW (lpString=".DAT") returned 4 [0039.880] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".DAT") returned 0x0 [0039.880] lstrlenW (lpString=".ldf") returned 4 [0039.880] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".ldf") returned 0x0 [0039.880] lstrlenW (lpString=".LDF") returned 4 [0039.880] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch=".LDF") returned 0x0 [0039.880] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.880] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.880] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.881] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.881] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15988193893) returned 1 [0039.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6956610, dwHighDateTime=0x1d585b4)) [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299788 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0039.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.881] GetLastError () returned 0x0 [0039.882] GetLastError () returned 0x0 [0039.882] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.882] GetLastError () returned 0x0 [0039.882] GetLastError () returned 0x0 [0039.882] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x41d4, lpOverlapped=0x0) returned 1 [0039.884] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.884] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x41d4, lpOverlapped=0x0) returned 1 [0039.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0039.884] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.884] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.885] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.885] CloseHandle (hObject=0x108) returned 1 [0039.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.885] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee260 | out: hHeap=0x260000) returned 1 [0039.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.886] GetLastError () returned 0x0 [0039.886] RtlWakeConditionVariable () returned 0x27e828 [0039.886] GetCurrentThreadId () returned 0x98c [0039.886] GetCurrentThreadId () returned 0x98c [0039.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0039.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0039.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0039.886] lstrlenW (lpString=".ldf") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".ldf") returned 0x0 [0039.886] lstrlenW (lpString=".vhd") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".vhd") returned 0x0 [0039.886] lstrlenW (lpString=".vhdx") returned 5 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".vhdx") returned 0x0 [0039.886] lstrlenW (lpString=".pst") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".pst") returned 0x0 [0039.886] lstrlenW (lpString=".ost") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".ost") returned 0x0 [0039.886] lstrlenW (lpString=".bak") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".bak") returned 0x0 [0039.886] lstrlenW (lpString=".bac") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".bac") returned 0x0 [0039.886] lstrlenW (lpString=".sys") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".sys") returned 0x0 [0039.886] lstrlenW (lpString=".v2i") returned 4 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".v2i") returned 0x0 [0039.886] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.886] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch="s\r\n.v2i") returned 0x0 [0039.886] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.887] lstrlenW (lpString=".sql") returned 4 [0039.887] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".sql") returned 0x0 [0039.887] lstrlenW (lpString=".mdf") returned 4 [0039.887] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".mdf") returned 0x0 [0039.887] lstrlenW (lpString=".txt") returned 4 [0039.887] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".txt") returned 0x0 [0039.887] lstrlenW (lpString=".dbf") returned 4 [0039.887] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".dbf") returned 0x0 [0039.887] lstrlenW (lpString=".ckp") returned 4 [0039.887] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".ckp") returned 0x0 [0039.887] lstrlenW (lpString=".dacpac") returned 7 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".dacpac") returned 0x0 [0039.888] lstrlenW (lpString=".db3") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".db3") returned 0x0 [0039.888] lstrlenW (lpString=".dtxs") returned 5 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".dtxs") returned 0x0 [0039.888] lstrlenW (lpString=".mdt") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".mdt") returned 0x0 [0039.888] lstrlenW (lpString=".sdf") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".sdf") returned 0x0 [0039.888] lstrlenW (lpString=".MDF") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".MDF") returned 0x0 [0039.888] lstrlenW (lpString=".DBF") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".DBF") returned 0x0 [0039.888] lstrlenW (lpString=".DB") returned 3 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".DB") returned 0x0 [0039.888] lstrlenW (lpString=".db") returned 3 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".db") returned 0x0 [0039.888] lstrlenW (lpString=".ndf") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".ndf") returned 0x0 [0039.888] lstrlenW (lpString=".NDF") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".NDF") returned 0x0 [0039.888] lstrlenW (lpString=".Mdf") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".Mdf") returned 0x0 [0039.888] lstrlenW (lpString=".dat") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".dat") returned 0x0 [0039.888] lstrlenW (lpString=".DAT") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".DAT") returned 0x0 [0039.888] lstrlenW (lpString=".ldf") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".ldf") returned 0x0 [0039.888] lstrlenW (lpString=".LDF") returned 4 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch=".LDF") returned 0x0 [0039.888] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.888] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.889] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.889] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.889] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.889] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15989057490) returned 1 [0039.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa697c770, dwHighDateTime=0x1d585b4)) [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e480 [0039.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e480 | out: hHeap=0x260000) returned 1 [0039.890] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.890] GetLastError () returned 0x0 [0039.890] GetLastError () returned 0x0 [0039.890] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.890] GetLastError () returned 0x0 [0039.890] GetLastError () returned 0x0 [0039.890] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.895] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0039.896] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.896] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.897] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.897] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.897] CloseHandle (hObject=0x108) returned 1 [0039.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.[deadmin@cock.li].deadmin")) returned 1 [0039.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee260 | out: hHeap=0x260000) returned 1 [0039.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.898] GetLastError () returned 0x0 [0039.898] RtlWakeConditionVariable () returned 0x27e828 [0039.898] GetCurrentThreadId () returned 0x98c [0039.898] GetCurrentThreadId () returned 0x98c [0039.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e678 | out: hHeap=0x260000) returned 1 [0039.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0039.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e678 [0039.898] lstrlenW (lpString=".ldf") returned 4 [0039.898] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".ldf") returned 0x0 [0039.899] lstrlenW (lpString=".vhd") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".vhd") returned 0x0 [0039.899] lstrlenW (lpString=".vhdx") returned 5 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".vhdx") returned 0x0 [0039.899] lstrlenW (lpString=".pst") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".pst") returned 0x0 [0039.899] lstrlenW (lpString=".ost") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".ost") returned 0x0 [0039.899] lstrlenW (lpString=".bak") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".bak") returned 0x0 [0039.899] lstrlenW (lpString=".bac") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".bac") returned 0x0 [0039.899] lstrlenW (lpString=".sys") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".sys") returned 0x0 [0039.899] lstrlenW (lpString=".v2i") returned 4 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".v2i") returned 0x0 [0039.899] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.899] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch="s\r\n.v2i") returned 0x0 [0039.899] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0039.900] lstrlenW (lpString=".sql") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".sql") returned 0x0 [0039.900] lstrlenW (lpString=".mdf") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".mdf") returned 0x0 [0039.900] lstrlenW (lpString=".txt") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".txt") returned 0x0 [0039.900] lstrlenW (lpString=".dbf") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".dbf") returned 0x0 [0039.900] lstrlenW (lpString=".ckp") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".ckp") returned 0x0 [0039.900] lstrlenW (lpString=".dacpac") returned 7 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".dacpac") returned 0x0 [0039.900] lstrlenW (lpString=".db3") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".db3") returned 0x0 [0039.900] lstrlenW (lpString=".dtxs") returned 5 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".dtxs") returned 0x0 [0039.900] lstrlenW (lpString=".mdt") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".mdt") returned 0x0 [0039.900] lstrlenW (lpString=".sdf") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".sdf") returned 0x0 [0039.900] lstrlenW (lpString=".MDF") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".MDF") returned 0x0 [0039.900] lstrlenW (lpString=".DBF") returned 4 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".DBF") returned 0x0 [0039.900] lstrlenW (lpString=".DB") returned 3 [0039.900] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".DB") returned 0x0 [0039.901] lstrlenW (lpString=".db") returned 3 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".db") returned 0x0 [0039.901] lstrlenW (lpString=".ndf") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".ndf") returned 0x0 [0039.901] lstrlenW (lpString=".NDF") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".NDF") returned 0x0 [0039.901] lstrlenW (lpString=".Mdf") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".Mdf") returned 0x0 [0039.901] lstrlenW (lpString=".dat") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".dat") returned 0x0 [0039.901] lstrlenW (lpString=".DAT") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".DAT") returned 0x0 [0039.901] lstrlenW (lpString=".ldf") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".ldf") returned 0x0 [0039.901] lstrlenW (lpString=".LDF") returned 4 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch=".LDF") returned 0x0 [0039.901] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.901] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0039.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.901] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27d0b0) returned 1 [0039.902] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.902] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.902] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=15990315337) returned 1 [0039.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa697c770, dwHighDateTime=0x1d585b4)) [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997f8 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0039.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0039.902] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0039.903] GetLastError () returned 0x0 [0039.903] GetLastError () returned 0x0 [0039.903] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0039.903] GetLastError () returned 0x0 [0039.903] GetLastError () returned 0x0 [0039.903] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.960] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0039.961] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.961] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.968] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.968] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.969] CloseHandle (hObject=0x108) returned 1 [0039.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee8b8 [0039.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.[deadmin@cock.li].deadmin")) returned 1 [0039.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee8b8 | out: hHeap=0x260000) returned 1 [0039.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.969] GetLastError () returned 0x0 [0039.969] RtlWakeConditionVariable () returned 0x27e828 [0039.969] GetCurrentThreadId () returned 0x98c [0039.970] GetCurrentThreadId () returned 0x98c [0039.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0039.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e918 | out: hHeap=0x260000) returned 1 [0039.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0039.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e918 [0039.970] lstrlenW (lpString=".ldf") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ldf") returned 0x0 [0039.970] lstrlenW (lpString=".vhd") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".vhd") returned 0x0 [0039.970] lstrlenW (lpString=".vhdx") returned 5 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".vhdx") returned 0x0 [0039.970] lstrlenW (lpString=".pst") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".pst") returned 0x0 [0039.970] lstrlenW (lpString=".ost") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ost") returned 0x0 [0039.970] lstrlenW (lpString=".bak") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".bak") returned 0x0 [0039.970] lstrlenW (lpString=".bac") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".bac") returned 0x0 [0039.970] lstrlenW (lpString=".sys") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sys") returned 0x0 [0039.970] lstrlenW (lpString=".v2i") returned 4 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".v2i") returned 0x0 [0039.970] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.970] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.021] lstrlenW (lpString=".sql") returned 4 [0040.032] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sql") returned 0x0 [0040.032] lstrlenW (lpString=".mdf") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".mdf") returned 0x0 [0040.037] lstrlenW (lpString=".txt") returned 4 [0040.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".txt") returned 0x0 [0040.042] lstrlenW (lpString=".dbf") returned 4 [0040.045] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dbf") returned 0x0 [0040.045] lstrlenW (lpString=".ckp") returned 4 [0040.045] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ckp") returned 0x0 [0040.045] lstrlenW (lpString=".dacpac") returned 7 [0040.045] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dacpac") returned 0x0 [0040.045] lstrlenW (lpString=".db3") returned 4 [0040.045] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".db3") returned 0x0 [0040.045] lstrlenW (lpString=".dtxs") returned 5 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dtxs") returned 0x0 [0040.046] lstrlenW (lpString=".mdt") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".mdt") returned 0x0 [0040.046] lstrlenW (lpString=".sdf") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sdf") returned 0x0 [0040.046] lstrlenW (lpString=".MDF") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".MDF") returned 0x0 [0040.046] lstrlenW (lpString=".DBF") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DBF") returned 0x0 [0040.046] lstrlenW (lpString=".DB") returned 3 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DB") returned 0x0 [0040.046] lstrlenW (lpString=".db") returned 3 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".db") returned 0x0 [0040.046] lstrlenW (lpString=".ndf") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ndf") returned 0x0 [0040.046] lstrlenW (lpString=".NDF") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".NDF") returned 0x0 [0040.046] lstrlenW (lpString=".Mdf") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".Mdf") returned 0x0 [0040.046] lstrlenW (lpString=".dat") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dat") returned 0x0 [0040.046] lstrlenW (lpString=".DAT") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DAT") returned 0x0 [0040.046] lstrlenW (lpString=".ldf") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ldf") returned 0x0 [0040.046] lstrlenW (lpString=".LDF") returned 4 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".LDF") returned 0x0 [0040.046] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.046] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.046] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.047] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.047] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.047] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16004846056) returned 1 [0040.047] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6af9530, dwHighDateTime=0x1d585b4)) [0040.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294608 [0040.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294608 | out: hHeap=0x260000) returned 1 [0040.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0040.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0040.048] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.048] GetLastError () returned 0x0 [0040.048] GetLastError () returned 0x0 [0040.048] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.048] GetLastError () returned 0x0 [0040.048] GetLastError () returned 0x0 [0040.048] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.051] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.051] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.051] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.051] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.056] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.056] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.056] CloseHandle (hObject=0x108) returned 1 [0040.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0040.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0040.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.057] GetLastError () returned 0x0 [0040.057] RtlWakeConditionVariable () returned 0x27e828 [0040.057] GetCurrentThreadId () returned 0x98c [0040.057] GetCurrentThreadId () returned 0x98c [0040.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c0f0 [0040.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c318 | out: hHeap=0x260000) returned 1 [0040.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294640 | out: hHeap=0x260000) returned 1 [0040.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c318 [0040.057] lstrlenW (lpString=".ldf") returned 4 [0040.057] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".ldf") returned 0x0 [0040.057] lstrlenW (lpString=".vhd") returned 4 [0040.057] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".vhd") returned 0x0 [0040.057] lstrlenW (lpString=".vhdx") returned 5 [0040.057] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".vhdx") returned 0x0 [0040.057] lstrlenW (lpString=".pst") returned 4 [0040.057] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".pst") returned 0x0 [0040.058] lstrlenW (lpString=".ost") returned 4 [0040.058] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".ost") returned 0x0 [0040.058] lstrlenW (lpString=".bak") returned 4 [0040.058] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".bak") returned 0x0 [0040.058] lstrlenW (lpString=".bac") returned 4 [0040.058] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".bac") returned 0x0 [0040.058] lstrlenW (lpString=".sys") returned 4 [0040.058] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".sys") returned 0x0 [0040.058] lstrlenW (lpString=".v2i") returned 4 [0040.058] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".v2i") returned 0x0 [0040.058] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.058] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch="s\r\n.v2i") returned 0x0 [0040.058] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.059] lstrlenW (lpString=".sql") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".sql") returned 0x0 [0040.059] lstrlenW (lpString=".mdf") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".mdf") returned 0x0 [0040.059] lstrlenW (lpString=".txt") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".txt") returned 0x0 [0040.059] lstrlenW (lpString=".dbf") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".dbf") returned 0x0 [0040.059] lstrlenW (lpString=".ckp") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".ckp") returned 0x0 [0040.059] lstrlenW (lpString=".dacpac") returned 7 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".dacpac") returned 0x0 [0040.059] lstrlenW (lpString=".db3") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".db3") returned 0x0 [0040.059] lstrlenW (lpString=".dtxs") returned 5 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".dtxs") returned 0x0 [0040.059] lstrlenW (lpString=".mdt") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".mdt") returned 0x0 [0040.059] lstrlenW (lpString=".sdf") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".sdf") returned 0x0 [0040.059] lstrlenW (lpString=".MDF") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".MDF") returned 0x0 [0040.059] lstrlenW (lpString=".DBF") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".DBF") returned 0x0 [0040.059] lstrlenW (lpString=".DB") returned 3 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".DB") returned 0x0 [0040.059] lstrlenW (lpString=".db") returned 3 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".db") returned 0x0 [0040.059] lstrlenW (lpString=".ndf") returned 4 [0040.059] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".ndf") returned 0x0 [0040.059] lstrlenW (lpString=".NDF") returned 4 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".NDF") returned 0x0 [0040.060] lstrlenW (lpString=".Mdf") returned 4 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".Mdf") returned 0x0 [0040.060] lstrlenW (lpString=".dat") returned 4 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".dat") returned 0x0 [0040.060] lstrlenW (lpString=".DAT") returned 4 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".DAT") returned 0x0 [0040.060] lstrlenW (lpString=".ldf") returned 4 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".ldf") returned 0x0 [0040.060] lstrlenW (lpString=".LDF") returned 4 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch=".LDF") returned 0x0 [0040.060] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.060] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.060] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.061] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.061] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.061] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16006220275) returned 1 [0040.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6b1f690, dwHighDateTime=0x1d585b4)) [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294640 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294640 | out: hHeap=0x260000) returned 1 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.062] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.062] GetLastError () returned 0x0 [0040.062] GetLastError () returned 0x0 [0040.062] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.062] GetLastError () returned 0x0 [0040.062] GetLastError () returned 0x0 [0040.062] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.065] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.065] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.065] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.065] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.067] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.067] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.067] CloseHandle (hObject=0x108) returned 1 [0040.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.[deadmin@cock.li].deadmin")) returned 1 [0040.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.068] GetLastError () returned 0x0 [0040.068] RtlWakeConditionVariable () returned 0x27e828 [0040.068] GetCurrentThreadId () returned 0x98c [0040.068] GetCurrentThreadId () returned 0x98c [0040.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c0f0 [0040.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c3d0 | out: hHeap=0x260000) returned 1 [0040.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294678 | out: hHeap=0x260000) returned 1 [0040.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c3d0 [0040.068] lstrlenW (lpString=".ldf") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".ldf") returned 0x0 [0040.068] lstrlenW (lpString=".vhd") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".vhd") returned 0x0 [0040.068] lstrlenW (lpString=".vhdx") returned 5 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".vhdx") returned 0x0 [0040.068] lstrlenW (lpString=".pst") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".pst") returned 0x0 [0040.068] lstrlenW (lpString=".ost") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".ost") returned 0x0 [0040.068] lstrlenW (lpString=".bak") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".bak") returned 0x0 [0040.068] lstrlenW (lpString=".bac") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".bac") returned 0x0 [0040.068] lstrlenW (lpString=".sys") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".sys") returned 0x0 [0040.068] lstrlenW (lpString=".v2i") returned 4 [0040.068] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".v2i") returned 0x0 [0040.068] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.069] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.069] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.069] lstrlenW (lpString=".sql") returned 4 [0040.069] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".sql") returned 0x0 [0040.069] lstrlenW (lpString=".mdf") returned 4 [0040.069] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".mdf") returned 0x0 [0040.069] lstrlenW (lpString=".txt") returned 4 [0040.069] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".txt") returned 0x0 [0040.069] lstrlenW (lpString=".dbf") returned 4 [0040.069] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".dbf") returned 0x0 [0040.070] lstrlenW (lpString=".ckp") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".ckp") returned 0x0 [0040.070] lstrlenW (lpString=".dacpac") returned 7 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".dacpac") returned 0x0 [0040.070] lstrlenW (lpString=".db3") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".db3") returned 0x0 [0040.070] lstrlenW (lpString=".dtxs") returned 5 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".dtxs") returned 0x0 [0040.070] lstrlenW (lpString=".mdt") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".mdt") returned 0x0 [0040.070] lstrlenW (lpString=".sdf") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".sdf") returned 0x0 [0040.070] lstrlenW (lpString=".MDF") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".MDF") returned 0x0 [0040.070] lstrlenW (lpString=".DBF") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".DBF") returned 0x0 [0040.070] lstrlenW (lpString=".DB") returned 3 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".DB") returned 0x0 [0040.070] lstrlenW (lpString=".db") returned 3 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".db") returned 0x0 [0040.070] lstrlenW (lpString=".ndf") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".ndf") returned 0x0 [0040.070] lstrlenW (lpString=".NDF") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".NDF") returned 0x0 [0040.070] lstrlenW (lpString=".Mdf") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".Mdf") returned 0x0 [0040.070] lstrlenW (lpString=".dat") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".dat") returned 0x0 [0040.070] lstrlenW (lpString=".DAT") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".DAT") returned 0x0 [0040.070] lstrlenW (lpString=".ldf") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".ldf") returned 0x0 [0040.070] lstrlenW (lpString=".LDF") returned 4 [0040.070] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch=".LDF") returned 0x0 [0040.071] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.071] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.071] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.071] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.071] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.072] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16007264409) returned 1 [0040.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6b1f690, dwHighDateTime=0x1d585b4)) [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294678 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294678 | out: hHeap=0x260000) returned 1 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.072] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.072] GetLastError () returned 0x0 [0040.072] GetLastError () returned 0x0 [0040.072] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.072] GetLastError () returned 0x0 [0040.072] GetLastError () returned 0x0 [0040.072] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x1915, lpOverlapped=0x0) returned 1 [0040.074] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe6eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.074] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x1915, lpOverlapped=0x0) returned 1 [0040.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.074] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.074] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.074] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.074] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.074] CloseHandle (hObject=0x108) returned 1 [0040.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.[deadmin@cock.li].deadmin")) returned 1 [0040.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.075] GetLastError () returned 0x0 [0040.075] RtlWakeConditionVariable () returned 0x27e828 [0040.075] GetCurrentThreadId () returned 0x98c [0040.075] GetCurrentThreadId () returned 0x98c [0040.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0040.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946b0 | out: hHeap=0x260000) returned 1 [0040.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29eb10 [0040.076] lstrlenW (lpString=".ldf") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".ldf") returned 0x0 [0040.076] lstrlenW (lpString=".vhd") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".vhd") returned 0x0 [0040.076] lstrlenW (lpString=".vhdx") returned 5 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".vhdx") returned 0x0 [0040.076] lstrlenW (lpString=".pst") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".pst") returned 0x0 [0040.076] lstrlenW (lpString=".ost") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".ost") returned 0x0 [0040.076] lstrlenW (lpString=".bak") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".bak") returned 0x0 [0040.076] lstrlenW (lpString=".bac") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".bac") returned 0x0 [0040.076] lstrlenW (lpString=".sys") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".sys") returned 0x0 [0040.076] lstrlenW (lpString=".v2i") returned 4 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".v2i") returned 0x0 [0040.076] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.076] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch="s\r\n.v2i") returned 0x0 [0040.076] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.207] lstrlenW (lpString=".sql") returned 4 [0040.226] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".sql") returned 0x0 [0040.236] lstrlenW (lpString=".mdf") returned 4 [0040.236] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".mdf") returned 0x0 [0040.237] lstrlenW (lpString=".txt") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".txt") returned 0x0 [0040.237] lstrlenW (lpString=".dbf") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".dbf") returned 0x0 [0040.237] lstrlenW (lpString=".ckp") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".ckp") returned 0x0 [0040.237] lstrlenW (lpString=".dacpac") returned 7 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".dacpac") returned 0x0 [0040.237] lstrlenW (lpString=".db3") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".db3") returned 0x0 [0040.237] lstrlenW (lpString=".dtxs") returned 5 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".dtxs") returned 0x0 [0040.237] lstrlenW (lpString=".mdt") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".mdt") returned 0x0 [0040.237] lstrlenW (lpString=".sdf") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".sdf") returned 0x0 [0040.237] lstrlenW (lpString=".MDF") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".MDF") returned 0x0 [0040.237] lstrlenW (lpString=".DBF") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".DBF") returned 0x0 [0040.237] lstrlenW (lpString=".DB") returned 3 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".DB") returned 0x0 [0040.237] lstrlenW (lpString=".db") returned 3 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".db") returned 0x0 [0040.237] lstrlenW (lpString=".ndf") returned 4 [0040.237] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".ndf") returned 0x0 [0040.238] lstrlenW (lpString=".NDF") returned 4 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".NDF") returned 0x0 [0040.238] lstrlenW (lpString=".Mdf") returned 4 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".Mdf") returned 0x0 [0040.238] lstrlenW (lpString=".dat") returned 4 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".dat") returned 0x0 [0040.238] lstrlenW (lpString=".DAT") returned 4 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".DAT") returned 0x0 [0040.238] lstrlenW (lpString=".ldf") returned 4 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".ldf") returned 0x0 [0040.238] lstrlenW (lpString=".LDF") returned 4 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch=".LDF") returned 0x0 [0040.238] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.238] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.238] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.239] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0040.239] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16023999620) returned 1 [0040.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6cc25b0, dwHighDateTime=0x1d585b4)) [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294918 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294918 | out: hHeap=0x260000) returned 1 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0040.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0040.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.239] GetLastError () returned 0x0 [0040.240] GetLastError () returned 0x0 [0040.240] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.240] GetLastError () returned 0x0 [0040.240] GetLastError () returned 0x0 [0040.240] ReadFile (in: hFile=0x10c, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.246] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.246] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0040.246] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.246] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.250] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.250] CloseHandle (hObject=0x10c) returned 1 [0040.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.[deadmin@cock.li].deadmin")) returned 1 [0040.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.251] GetLastError () returned 0x0 [0040.251] RtlWakeConditionVariable () returned 0x27e828 [0040.251] GetCurrentThreadId () returned 0x98c [0040.251] GetCurrentThreadId () returned 0x98c [0040.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5cd0 | out: hHeap=0x260000) returned 1 [0040.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294950 | out: hHeap=0x260000) returned 1 [0040.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5cd0 [0040.251] lstrlenW (lpString=".ldf") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0040.252] lstrlenW (lpString=".vhd") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0040.252] lstrlenW (lpString=".vhdx") returned 5 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0040.252] lstrlenW (lpString=".pst") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0040.252] lstrlenW (lpString=".ost") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0040.252] lstrlenW (lpString=".bak") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0040.252] lstrlenW (lpString=".bac") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0040.252] lstrlenW (lpString=".sys") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0040.252] lstrlenW (lpString=".v2i") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0040.252] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.252] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.252] lstrlenW (lpString=".sql") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0040.252] lstrlenW (lpString=".mdf") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0040.252] lstrlenW (lpString=".txt") returned 4 [0040.252] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0040.253] lstrlenW (lpString=".dbf") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0040.253] lstrlenW (lpString=".ckp") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0040.253] lstrlenW (lpString=".dacpac") returned 7 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0040.253] lstrlenW (lpString=".db3") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0040.253] lstrlenW (lpString=".dtxs") returned 5 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0040.253] lstrlenW (lpString=".mdt") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0040.253] lstrlenW (lpString=".sdf") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0040.253] lstrlenW (lpString=".MDF") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0040.253] lstrlenW (lpString=".DBF") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0040.253] lstrlenW (lpString=".DB") returned 3 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0040.253] lstrlenW (lpString=".db") returned 3 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0040.253] lstrlenW (lpString=".ndf") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0040.253] lstrlenW (lpString=".NDF") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0040.253] lstrlenW (lpString=".Mdf") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0040.253] lstrlenW (lpString=".dat") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0040.253] lstrlenW (lpString=".DAT") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0040.253] lstrlenW (lpString=".ldf") returned 4 [0040.253] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0040.254] lstrlenW (lpString=".LDF") returned 4 [0040.254] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0040.254] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.254] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.254] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.254] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0040.255] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16025568019) returned 1 [0040.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6ce8710, dwHighDateTime=0x1d585b4)) [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294950 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294950 | out: hHeap=0x260000) returned 1 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0040.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0040.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.255] GetLastError () returned 0x0 [0040.255] GetLastError () returned 0x0 [0040.255] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.255] GetLastError () returned 0x0 [0040.255] GetLastError () returned 0x0 [0040.255] ReadFile (in: hFile=0x10c, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x5061, lpOverlapped=0x0) returned 1 [0040.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffaf9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.258] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x5061, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x5061, lpOverlapped=0x0) returned 1 [0040.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0040.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.258] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.259] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.259] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.259] CloseHandle (hObject=0x10c) returned 1 [0040.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0040.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.259] GetLastError () returned 0x0 [0040.260] RtlWakeConditionVariable () returned 0x27e828 [0040.260] GetCurrentThreadId () returned 0x98c [0040.260] GetCurrentThreadId () returned 0x98c [0040.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5d78 | out: hHeap=0x260000) returned 1 [0040.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294988 | out: hHeap=0x260000) returned 1 [0040.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5d78 [0040.260] lstrlenW (lpString=".ldf") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".ldf") returned 0x0 [0040.260] lstrlenW (lpString=".vhd") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".vhd") returned 0x0 [0040.260] lstrlenW (lpString=".vhdx") returned 5 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".vhdx") returned 0x0 [0040.260] lstrlenW (lpString=".pst") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".pst") returned 0x0 [0040.260] lstrlenW (lpString=".ost") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".ost") returned 0x0 [0040.260] lstrlenW (lpString=".bak") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".bak") returned 0x0 [0040.260] lstrlenW (lpString=".bac") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".bac") returned 0x0 [0040.260] lstrlenW (lpString=".sys") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".sys") returned 0x0 [0040.260] lstrlenW (lpString=".v2i") returned 4 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".v2i") returned 0x0 [0040.260] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.260] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch="s\r\n.v2i") returned 0x0 [0040.260] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.261] lstrlenW (lpString=".sql") returned 4 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".sql") returned 0x0 [0040.261] lstrlenW (lpString=".mdf") returned 4 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".mdf") returned 0x0 [0040.261] lstrlenW (lpString=".txt") returned 4 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".txt") returned 0x0 [0040.261] lstrlenW (lpString=".dbf") returned 4 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".dbf") returned 0x0 [0040.261] lstrlenW (lpString=".ckp") returned 4 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".ckp") returned 0x0 [0040.261] lstrlenW (lpString=".dacpac") returned 7 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".dacpac") returned 0x0 [0040.261] lstrlenW (lpString=".db3") returned 4 [0040.261] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".db3") returned 0x0 [0040.262] lstrlenW (lpString=".dtxs") returned 5 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".dtxs") returned 0x0 [0040.262] lstrlenW (lpString=".mdt") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".mdt") returned 0x0 [0040.262] lstrlenW (lpString=".sdf") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".sdf") returned 0x0 [0040.262] lstrlenW (lpString=".MDF") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".MDF") returned 0x0 [0040.262] lstrlenW (lpString=".DBF") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".DBF") returned 0x0 [0040.262] lstrlenW (lpString=".DB") returned 3 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".DB") returned 0x0 [0040.262] lstrlenW (lpString=".db") returned 3 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".db") returned 0x0 [0040.262] lstrlenW (lpString=".ndf") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".ndf") returned 0x0 [0040.262] lstrlenW (lpString=".NDF") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".NDF") returned 0x0 [0040.262] lstrlenW (lpString=".Mdf") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".Mdf") returned 0x0 [0040.262] lstrlenW (lpString=".dat") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".dat") returned 0x0 [0040.262] lstrlenW (lpString=".DAT") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".DAT") returned 0x0 [0040.262] lstrlenW (lpString=".ldf") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".ldf") returned 0x0 [0040.262] lstrlenW (lpString=".LDF") returned 4 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch=".LDF") returned 0x0 [0040.262] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.262] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.263] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0040.263] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16026446007) returned 1 [0040.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6ce8710, dwHighDateTime=0x1d585b4)) [0040.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294988 [0040.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294988 | out: hHeap=0x260000) returned 1 [0040.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5cd0 [0040.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5cd0 | out: hHeap=0x260000) returned 1 [0040.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.264] GetLastError () returned 0x0 [0040.264] GetLastError () returned 0x0 [0040.264] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.264] GetLastError () returned 0x0 [0040.264] GetLastError () returned 0x0 [0040.264] ReadFile (in: hFile=0x10c, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.270] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.270] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0040.270] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.270] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.272] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.272] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.272] CloseHandle (hObject=0x10c) returned 1 [0040.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.272] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.[deadmin@cock.li].deadmin")) returned 1 [0040.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.273] GetLastError () returned 0x0 [0040.273] RtlWakeConditionVariable () returned 0x27e828 [0040.273] GetCurrentThreadId () returned 0x98c [0040.273] GetCurrentThreadId () returned 0x98c [0040.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0040.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0040.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5e20 [0040.273] lstrlenW (lpString=".ldf") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".ldf") returned 0x0 [0040.273] lstrlenW (lpString=".vhd") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".vhd") returned 0x0 [0040.273] lstrlenW (lpString=".vhdx") returned 5 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".vhdx") returned 0x0 [0040.273] lstrlenW (lpString=".pst") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".pst") returned 0x0 [0040.273] lstrlenW (lpString=".ost") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".ost") returned 0x0 [0040.273] lstrlenW (lpString=".bak") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".bak") returned 0x0 [0040.273] lstrlenW (lpString=".bac") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".bac") returned 0x0 [0040.273] lstrlenW (lpString=".sys") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".sys") returned 0x0 [0040.273] lstrlenW (lpString=".v2i") returned 4 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".v2i") returned 0x0 [0040.273] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.273] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch="s\r\n.v2i") returned 0x0 [0040.273] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.274] lstrlenW (lpString=".sql") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".sql") returned 0x0 [0040.274] lstrlenW (lpString=".mdf") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".mdf") returned 0x0 [0040.274] lstrlenW (lpString=".txt") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".txt") returned 0x0 [0040.274] lstrlenW (lpString=".dbf") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".dbf") returned 0x0 [0040.274] lstrlenW (lpString=".ckp") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".ckp") returned 0x0 [0040.274] lstrlenW (lpString=".dacpac") returned 7 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".dacpac") returned 0x0 [0040.274] lstrlenW (lpString=".db3") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".db3") returned 0x0 [0040.274] lstrlenW (lpString=".dtxs") returned 5 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".dtxs") returned 0x0 [0040.274] lstrlenW (lpString=".mdt") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".mdt") returned 0x0 [0040.274] lstrlenW (lpString=".sdf") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".sdf") returned 0x0 [0040.274] lstrlenW (lpString=".MDF") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".MDF") returned 0x0 [0040.274] lstrlenW (lpString=".DBF") returned 4 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".DBF") returned 0x0 [0040.274] lstrlenW (lpString=".DB") returned 3 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".DB") returned 0x0 [0040.274] lstrlenW (lpString=".db") returned 3 [0040.274] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".db") returned 0x0 [0040.275] lstrlenW (lpString=".ndf") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".ndf") returned 0x0 [0040.275] lstrlenW (lpString=".NDF") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".NDF") returned 0x0 [0040.275] lstrlenW (lpString=".Mdf") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".Mdf") returned 0x0 [0040.275] lstrlenW (lpString=".dat") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".dat") returned 0x0 [0040.275] lstrlenW (lpString=".DAT") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".DAT") returned 0x0 [0040.275] lstrlenW (lpString=".ldf") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".ldf") returned 0x0 [0040.275] lstrlenW (lpString=".LDF") returned 4 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch=".LDF") returned 0x0 [0040.275] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.275] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.275] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.276] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.276] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0040.276] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16027704421) returned 1 [0040.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6d0e870, dwHighDateTime=0x1d585b4)) [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949c0 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5d78 [0040.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5d78 | out: hHeap=0x260000) returned 1 [0040.276] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.277] GetLastError () returned 0x0 [0040.277] GetLastError () returned 0x0 [0040.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.277] GetLastError () returned 0x0 [0040.277] GetLastError () returned 0x0 [0040.277] ReadFile (in: hFile=0x10c, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.330] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.331] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0040.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.333] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.346] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.346] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.347] CloseHandle (hObject=0x10c) returned 1 [0040.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.[deadmin@cock.li].deadmin")) returned 1 [0040.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.347] GetLastError () returned 0x0 [0040.347] RtlWakeConditionVariable () returned 0x27e828 [0040.347] GetCurrentThreadId () returned 0x98c [0040.347] GetCurrentThreadId () returned 0x98c [0040.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x2b3f18 [0040.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3cc8 | out: hHeap=0x260000) returned 1 [0040.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0040.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x299cc0 [0040.348] lstrlenW (lpString=".ldf") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".ldf") returned 0x0 [0040.348] lstrlenW (lpString=".vhd") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".vhd") returned 0x0 [0040.348] lstrlenW (lpString=".vhdx") returned 5 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".vhdx") returned 0x0 [0040.348] lstrlenW (lpString=".pst") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".pst") returned 0x0 [0040.348] lstrlenW (lpString=".ost") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".ost") returned 0x0 [0040.348] lstrlenW (lpString=".bak") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".bak") returned 0x0 [0040.348] lstrlenW (lpString=".bac") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".bac") returned 0x0 [0040.348] lstrlenW (lpString=".sys") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".sys") returned 0x0 [0040.348] lstrlenW (lpString=".v2i") returned 4 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".v2i") returned 0x0 [0040.348] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0040.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.386] lstrlenW (lpString=".sql") returned 4 [0040.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".sql") returned 0x0 [0040.386] lstrlenW (lpString=".mdf") returned 4 [0040.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".mdf") returned 0x0 [0040.386] lstrlenW (lpString=".txt") returned 4 [0040.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".txt") returned 0x0 [0040.386] lstrlenW (lpString=".dbf") returned 4 [0040.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".dbf") returned 0x0 [0040.387] lstrlenW (lpString=".ckp") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".ckp") returned 0x0 [0040.387] lstrlenW (lpString=".dacpac") returned 7 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".dacpac") returned 0x0 [0040.387] lstrlenW (lpString=".db3") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".db3") returned 0x0 [0040.387] lstrlenW (lpString=".dtxs") returned 5 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".dtxs") returned 0x0 [0040.387] lstrlenW (lpString=".mdt") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".mdt") returned 0x0 [0040.387] lstrlenW (lpString=".sdf") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".sdf") returned 0x0 [0040.387] lstrlenW (lpString=".MDF") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".MDF") returned 0x0 [0040.387] lstrlenW (lpString=".DBF") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".DBF") returned 0x0 [0040.387] lstrlenW (lpString=".DB") returned 3 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".DB") returned 0x0 [0040.387] lstrlenW (lpString=".db") returned 3 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".db") returned 0x0 [0040.387] lstrlenW (lpString=".ndf") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".ndf") returned 0x0 [0040.387] lstrlenW (lpString=".NDF") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".NDF") returned 0x0 [0040.387] lstrlenW (lpString=".Mdf") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".Mdf") returned 0x0 [0040.387] lstrlenW (lpString=".dat") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".dat") returned 0x0 [0040.387] lstrlenW (lpString=".DAT") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".DAT") returned 0x0 [0040.387] lstrlenW (lpString=".ldf") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".ldf") returned 0x0 [0040.387] lstrlenW (lpString=".LDF") returned 4 [0040.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch=".LDF") returned 0x0 [0040.387] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.388] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e0f0) returned 1 [0040.388] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.388] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0040.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.389] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16038966073) returned 1 [0040.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6e3f370, dwHighDateTime=0x1d585b4)) [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b80 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.389] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.389] GetLastError () returned 0x0 [0040.389] GetLastError () returned 0x0 [0040.389] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.389] GetLastError () returned 0x0 [0040.389] GetLastError () returned 0x0 [0040.390] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.395] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.395] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.395] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.396] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.402] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.402] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.402] CloseHandle (hObject=0x10c) returned 1 [0040.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.403] GetLastError () returned 0x0 [0040.403] RtlWakeConditionVariable () returned 0x27e828 [0040.403] GetCurrentThreadId () returned 0x98c [0040.403] GetCurrentThreadId () returned 0x98c [0040.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0040.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5f70 | out: hHeap=0x260000) returned 1 [0040.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0040.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5f70 [0040.403] lstrlenW (lpString=".ldf") returned 4 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".ldf") returned 0x0 [0040.403] lstrlenW (lpString=".vhd") returned 4 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".vhd") returned 0x0 [0040.403] lstrlenW (lpString=".vhdx") returned 5 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".vhdx") returned 0x0 [0040.403] lstrlenW (lpString=".pst") returned 4 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".pst") returned 0x0 [0040.403] lstrlenW (lpString=".ost") returned 4 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".ost") returned 0x0 [0040.403] lstrlenW (lpString=".bak") returned 4 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".bak") returned 0x0 [0040.403] lstrlenW (lpString=".bac") returned 4 [0040.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".bac") returned 0x0 [0040.404] lstrlenW (lpString=".sys") returned 4 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".sys") returned 0x0 [0040.404] lstrlenW (lpString=".v2i") returned 4 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".v2i") returned 0x0 [0040.404] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0040.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.404] lstrlenW (lpString=".sql") returned 4 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".sql") returned 0x0 [0040.404] lstrlenW (lpString=".mdf") returned 4 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".mdf") returned 0x0 [0040.404] lstrlenW (lpString=".txt") returned 4 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".txt") returned 0x0 [0040.404] lstrlenW (lpString=".dbf") returned 4 [0040.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".dbf") returned 0x0 [0040.405] lstrlenW (lpString=".ckp") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".ckp") returned 0x0 [0040.405] lstrlenW (lpString=".dacpac") returned 7 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".dacpac") returned 0x0 [0040.405] lstrlenW (lpString=".db3") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".db3") returned 0x0 [0040.405] lstrlenW (lpString=".dtxs") returned 5 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".dtxs") returned 0x0 [0040.405] lstrlenW (lpString=".mdt") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".mdt") returned 0x0 [0040.405] lstrlenW (lpString=".sdf") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".sdf") returned 0x0 [0040.405] lstrlenW (lpString=".MDF") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".MDF") returned 0x0 [0040.405] lstrlenW (lpString=".DBF") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".DBF") returned 0x0 [0040.405] lstrlenW (lpString=".DB") returned 3 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".DB") returned 0x0 [0040.405] lstrlenW (lpString=".db") returned 3 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".db") returned 0x0 [0040.405] lstrlenW (lpString=".ndf") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".ndf") returned 0x0 [0040.405] lstrlenW (lpString=".NDF") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".NDF") returned 0x0 [0040.405] lstrlenW (lpString=".Mdf") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".Mdf") returned 0x0 [0040.405] lstrlenW (lpString=".dat") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".dat") returned 0x0 [0040.405] lstrlenW (lpString=".DAT") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".DAT") returned 0x0 [0040.405] lstrlenW (lpString=".ldf") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".ldf") returned 0x0 [0040.405] lstrlenW (lpString=".LDF") returned 4 [0040.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch=".LDF") returned 0x0 [0040.406] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.406] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.406] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.406] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.407] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16040764516) returned 1 [0040.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6e654d0, dwHighDateTime=0x1d585b4)) [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e08 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5e20 [0040.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0040.407] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.407] GetLastError () returned 0x0 [0040.407] GetLastError () returned 0x0 [0040.407] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.407] GetLastError () returned 0x0 [0040.407] GetLastError () returned 0x0 [0040.408] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.414] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.414] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.415] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.415] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.430] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.430] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.430] CloseHandle (hObject=0x10c) returned 1 [0040.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0040.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f7a8 | out: hHeap=0x260000) returned 1 [0040.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.431] GetLastError () returned 0x0 [0040.431] RtlWakeConditionVariable () returned 0x27e828 [0040.431] GetCurrentThreadId () returned 0x98c [0040.431] GetCurrentThreadId () returned 0x98c [0040.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296b50 | out: hHeap=0x260000) returned 1 [0040.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0040.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.431] lstrlenW (lpString=".ldf") returned 4 [0040.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".ldf") returned 0x0 [0040.431] lstrlenW (lpString=".vhd") returned 4 [0040.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".vhd") returned 0x0 [0040.431] lstrlenW (lpString=".vhdx") returned 5 [0040.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".vhdx") returned 0x0 [0040.431] lstrlenW (lpString=".pst") returned 4 [0040.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".pst") returned 0x0 [0040.432] lstrlenW (lpString=".ost") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".ost") returned 0x0 [0040.432] lstrlenW (lpString=".bak") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".bak") returned 0x0 [0040.432] lstrlenW (lpString=".bac") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".bac") returned 0x0 [0040.432] lstrlenW (lpString=".sys") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".sys") returned 0x0 [0040.432] lstrlenW (lpString=".v2i") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".v2i") returned 0x0 [0040.432] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch="s\r\n.v2i") returned 0x0 [0040.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.432] lstrlenW (lpString=".sql") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".sql") returned 0x0 [0040.432] lstrlenW (lpString=".mdf") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".mdf") returned 0x0 [0040.432] lstrlenW (lpString=".txt") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".txt") returned 0x0 [0040.432] lstrlenW (lpString=".dbf") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".dbf") returned 0x0 [0040.432] lstrlenW (lpString=".ckp") returned 4 [0040.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".ckp") returned 0x0 [0040.432] lstrlenW (lpString=".dacpac") returned 7 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".dacpac") returned 0x0 [0040.433] lstrlenW (lpString=".db3") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".db3") returned 0x0 [0040.433] lstrlenW (lpString=".dtxs") returned 5 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".dtxs") returned 0x0 [0040.433] lstrlenW (lpString=".mdt") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".mdt") returned 0x0 [0040.433] lstrlenW (lpString=".sdf") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".sdf") returned 0x0 [0040.433] lstrlenW (lpString=".MDF") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".MDF") returned 0x0 [0040.433] lstrlenW (lpString=".DBF") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".DBF") returned 0x0 [0040.433] lstrlenW (lpString=".DB") returned 3 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".DB") returned 0x0 [0040.433] lstrlenW (lpString=".db") returned 3 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".db") returned 0x0 [0040.433] lstrlenW (lpString=".ndf") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".ndf") returned 0x0 [0040.433] lstrlenW (lpString=".NDF") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".NDF") returned 0x0 [0040.433] lstrlenW (lpString=".Mdf") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".Mdf") returned 0x0 [0040.433] lstrlenW (lpString=".dat") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".dat") returned 0x0 [0040.433] lstrlenW (lpString=".DAT") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".DAT") returned 0x0 [0040.433] lstrlenW (lpString=".ldf") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".ldf") returned 0x0 [0040.433] lstrlenW (lpString=".LDF") returned 4 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch=".LDF") returned 0x0 [0040.433] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.434] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.434] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.434] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.434] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16043555828) returned 1 [0040.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6e8b630, dwHighDateTime=0x1d585b4)) [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294eb0 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0040.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0040.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0040.435] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.435] GetLastError () returned 0x0 [0040.435] GetLastError () returned 0x0 [0040.435] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.436] GetLastError () returned 0x0 [0040.436] GetLastError () returned 0x0 [0040.436] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x1de8, lpOverlapped=0x0) returned 1 [0040.438] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe218, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.438] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1de8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1de8, lpOverlapped=0x0) returned 1 [0040.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.438] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.439] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.439] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.439] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.439] CloseHandle (hObject=0x10c) returned 1 [0040.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0040.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.[deadmin@cock.li].deadmin")) returned 1 [0040.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f7a8 | out: hHeap=0x260000) returned 1 [0040.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.440] GetLastError () returned 0x0 [0040.440] RtlWakeConditionVariable () returned 0x27e828 [0040.440] GetCurrentThreadId () returned 0x98c [0040.440] GetCurrentThreadId () returned 0x98c [0040.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ca48 | out: hHeap=0x260000) returned 1 [0040.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ee8 | out: hHeap=0x260000) returned 1 [0040.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ca48 [0040.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.440] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.440] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.440] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.440] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.441] CloseHandle (hObject=0x10c) returned 1 [0040.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ca48 | out: hHeap=0x260000) returned 1 [0040.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.442] RtlWakeConditionVariable () returned 0x27e828 [0040.442] GetCurrentThreadId () returned 0x98c [0040.442] GetCurrentThreadId () returned 0x98c [0040.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296be8 | out: hHeap=0x260000) returned 1 [0040.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0040.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296be8 [0040.442] lstrlenW (lpString=".ldf") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".ldf") returned 0x0 [0040.442] lstrlenW (lpString=".vhd") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".vhd") returned 0x0 [0040.442] lstrlenW (lpString=".vhdx") returned 5 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".vhdx") returned 0x0 [0040.442] lstrlenW (lpString=".pst") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".pst") returned 0x0 [0040.442] lstrlenW (lpString=".ost") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".ost") returned 0x0 [0040.442] lstrlenW (lpString=".bak") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".bak") returned 0x0 [0040.442] lstrlenW (lpString=".bac") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".bac") returned 0x0 [0040.442] lstrlenW (lpString=".sys") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".sys") returned 0x0 [0040.442] lstrlenW (lpString=".v2i") returned 4 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".v2i") returned 0x0 [0040.442] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0040.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.443] lstrlenW (lpString=".sql") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".sql") returned 0x0 [0040.443] lstrlenW (lpString=".mdf") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".mdf") returned 0x0 [0040.443] lstrlenW (lpString=".txt") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".txt") returned 0x0 [0040.443] lstrlenW (lpString=".dbf") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".dbf") returned 0x0 [0040.443] lstrlenW (lpString=".ckp") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".ckp") returned 0x0 [0040.443] lstrlenW (lpString=".dacpac") returned 7 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".dacpac") returned 0x0 [0040.443] lstrlenW (lpString=".db3") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".db3") returned 0x0 [0040.443] lstrlenW (lpString=".dtxs") returned 5 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".dtxs") returned 0x0 [0040.443] lstrlenW (lpString=".mdt") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".mdt") returned 0x0 [0040.443] lstrlenW (lpString=".sdf") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".sdf") returned 0x0 [0040.443] lstrlenW (lpString=".MDF") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".MDF") returned 0x0 [0040.443] lstrlenW (lpString=".DBF") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".DBF") returned 0x0 [0040.443] lstrlenW (lpString=".DB") returned 3 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".DB") returned 0x0 [0040.443] lstrlenW (lpString=".db") returned 3 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".db") returned 0x0 [0040.443] lstrlenW (lpString=".ndf") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".ndf") returned 0x0 [0040.443] lstrlenW (lpString=".NDF") returned 4 [0040.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".NDF") returned 0x0 [0040.443] lstrlenW (lpString=".Mdf") returned 4 [0040.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".Mdf") returned 0x0 [0040.444] lstrlenW (lpString=".dat") returned 4 [0040.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".dat") returned 0x0 [0040.444] lstrlenW (lpString=".DAT") returned 4 [0040.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".DAT") returned 0x0 [0040.444] lstrlenW (lpString=".ldf") returned 4 [0040.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".ldf") returned 0x0 [0040.444] lstrlenW (lpString=".LDF") returned 4 [0040.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch=".LDF") returned 0x0 [0040.444] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.444] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.445] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.445] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16044592296) returned 1 [0040.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa6eb1790, dwHighDateTime=0x1d585b4)) [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f20 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0040.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0040.445] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.445] GetLastError () returned 0x0 [0040.446] GetLastError () returned 0x0 [0040.446] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.446] GetLastError () returned 0x0 [0040.446] GetLastError () returned 0x0 [0040.446] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x7980, lpOverlapped=0x0) returned 1 [0040.512] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.512] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x7980, lpOverlapped=0x0) returned 1 [0040.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.512] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.513] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.513] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.513] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.513] CloseHandle (hObject=0x10c) returned 1 [0040.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.592] GetLastError () returned 0x0 [0040.592] RtlWakeConditionVariable () returned 0x27e828 [0040.592] GetCurrentThreadId () returned 0x98c [0040.593] GetCurrentThreadId () returned 0x98c [0040.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297140 | out: hHeap=0x260000) returned 1 [0040.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0040.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297140 [0040.593] lstrlenW (lpString=".ldf") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.593] lstrlenW (lpString=".vhd") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".vhd") returned 0x0 [0040.593] lstrlenW (lpString=".vhdx") returned 5 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".vhdx") returned 0x0 [0040.593] lstrlenW (lpString=".pst") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".pst") returned 0x0 [0040.593] lstrlenW (lpString=".ost") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".ost") returned 0x0 [0040.593] lstrlenW (lpString=".bak") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".bak") returned 0x0 [0040.593] lstrlenW (lpString=".bac") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".bac") returned 0x0 [0040.593] lstrlenW (lpString=".sys") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".sys") returned 0x0 [0040.593] lstrlenW (lpString=".v2i") returned 4 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".v2i") returned 0x0 [0040.593] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.625] lstrlenW (lpString=".sql") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".sql") returned 0x0 [0040.625] lstrlenW (lpString=".mdf") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".mdf") returned 0x0 [0040.625] lstrlenW (lpString=".txt") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".txt") returned 0x0 [0040.625] lstrlenW (lpString=".dbf") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".dbf") returned 0x0 [0040.625] lstrlenW (lpString=".ckp") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".ckp") returned 0x0 [0040.625] lstrlenW (lpString=".dacpac") returned 7 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".dacpac") returned 0x0 [0040.625] lstrlenW (lpString=".db3") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".db3") returned 0x0 [0040.625] lstrlenW (lpString=".dtxs") returned 5 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".dtxs") returned 0x0 [0040.625] lstrlenW (lpString=".mdt") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".mdt") returned 0x0 [0040.625] lstrlenW (lpString=".sdf") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".sdf") returned 0x0 [0040.625] lstrlenW (lpString=".MDF") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".MDF") returned 0x0 [0040.625] lstrlenW (lpString=".DBF") returned 4 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".DBF") returned 0x0 [0040.625] lstrlenW (lpString=".DB") returned 3 [0040.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".DB") returned 0x0 [0040.625] lstrlenW (lpString=".db") returned 3 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".db") returned 0x0 [0040.626] lstrlenW (lpString=".ndf") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".ndf") returned 0x0 [0040.626] lstrlenW (lpString=".NDF") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".NDF") returned 0x0 [0040.626] lstrlenW (lpString=".Mdf") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".Mdf") returned 0x0 [0040.626] lstrlenW (lpString=".dat") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".dat") returned 0x0 [0040.626] lstrlenW (lpString=".DAT") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".DAT") returned 0x0 [0040.626] lstrlenW (lpString=".ldf") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.626] lstrlenW (lpString=".LDF") returned 4 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch=".LDF") returned 0x0 [0040.626] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0040.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.626] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.627] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.627] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.627] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16062836180) returned 1 [0040.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa707a810, dwHighDateTime=0x1d585b4)) [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295150 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0040.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296be8 [0040.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.628] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.628] GetLastError () returned 0x0 [0040.628] GetLastError () returned 0x0 [0040.628] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.628] GetLastError () returned 0x0 [0040.628] GetLastError () returned 0x0 [0040.628] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.632] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.632] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.632] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.632] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.634] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.634] CloseHandle (hObject=0x108) returned 1 [0040.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.635] GetLastError () returned 0x0 [0040.636] RtlWakeConditionVariable () returned 0x27e828 [0040.636] GetCurrentThreadId () returned 0x98c [0040.636] GetCurrentThreadId () returned 0x98c [0040.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0040.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0040.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0040.636] lstrlenW (lpString=".ldf") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".ldf") returned 0x0 [0040.636] lstrlenW (lpString=".vhd") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".vhd") returned 0x0 [0040.636] lstrlenW (lpString=".vhdx") returned 5 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".vhdx") returned 0x0 [0040.636] lstrlenW (lpString=".pst") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".pst") returned 0x0 [0040.636] lstrlenW (lpString=".ost") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".ost") returned 0x0 [0040.636] lstrlenW (lpString=".bak") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".bak") returned 0x0 [0040.636] lstrlenW (lpString=".bac") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".bac") returned 0x0 [0040.636] lstrlenW (lpString=".sys") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".sys") returned 0x0 [0040.636] lstrlenW (lpString=".v2i") returned 4 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".v2i") returned 0x0 [0040.636] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch="s\r\n.v2i") returned 0x0 [0040.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.640] lstrlenW (lpString=".sql") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".sql") returned 0x0 [0040.640] lstrlenW (lpString=".mdf") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".mdf") returned 0x0 [0040.640] lstrlenW (lpString=".txt") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".txt") returned 0x0 [0040.640] lstrlenW (lpString=".dbf") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".dbf") returned 0x0 [0040.640] lstrlenW (lpString=".ckp") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".ckp") returned 0x0 [0040.640] lstrlenW (lpString=".dacpac") returned 7 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".dacpac") returned 0x0 [0040.640] lstrlenW (lpString=".db3") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".db3") returned 0x0 [0040.640] lstrlenW (lpString=".dtxs") returned 5 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".dtxs") returned 0x0 [0040.640] lstrlenW (lpString=".mdt") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".mdt") returned 0x0 [0040.640] lstrlenW (lpString=".sdf") returned 4 [0040.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".sdf") returned 0x0 [0040.641] lstrlenW (lpString=".MDF") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".MDF") returned 0x0 [0040.641] lstrlenW (lpString=".DBF") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".DBF") returned 0x0 [0040.641] lstrlenW (lpString=".DB") returned 3 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".DB") returned 0x0 [0040.641] lstrlenW (lpString=".db") returned 3 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".db") returned 0x0 [0040.641] lstrlenW (lpString=".ndf") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".ndf") returned 0x0 [0040.641] lstrlenW (lpString=".NDF") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".NDF") returned 0x0 [0040.641] lstrlenW (lpString=".Mdf") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".Mdf") returned 0x0 [0040.641] lstrlenW (lpString=".dat") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".dat") returned 0x0 [0040.641] lstrlenW (lpString=".DAT") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".DAT") returned 0x0 [0040.641] lstrlenW (lpString=".ldf") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".ldf") returned 0x0 [0040.641] lstrlenW (lpString=".LDF") returned 4 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch=".LDF") returned 0x0 [0040.641] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0040.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.642] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.642] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.642] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.643] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16064414335) returned 1 [0040.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa70a0970, dwHighDateTime=0x1d585b4)) [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295188 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297140 [0040.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.644] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.644] GetLastError () returned 0x0 [0040.644] GetLastError () returned 0x0 [0040.644] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.644] GetLastError () returned 0x0 [0040.644] GetLastError () returned 0x0 [0040.644] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x774, lpOverlapped=0x0) returned 1 [0040.647] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff88c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.647] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x774, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x774, lpOverlapped=0x0) returned 1 [0040.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.647] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.647] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.647] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.647] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.647] CloseHandle (hObject=0x108) returned 1 [0040.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.[deadmin@cock.li].deadmin")) returned 1 [0040.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.648] GetLastError () returned 0x0 [0040.649] RtlWakeConditionVariable () returned 0x27e828 [0040.649] GetCurrentThreadId () returned 0x98c [0040.649] GetCurrentThreadId () returned 0x98c [0040.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297308 | out: hHeap=0x260000) returned 1 [0040.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951c0 | out: hHeap=0x260000) returned 1 [0040.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0040.649] lstrlenW (lpString=".ldf") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".ldf") returned 0x0 [0040.649] lstrlenW (lpString=".vhd") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".vhd") returned 0x0 [0040.649] lstrlenW (lpString=".vhdx") returned 5 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".vhdx") returned 0x0 [0040.649] lstrlenW (lpString=".pst") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".pst") returned 0x0 [0040.649] lstrlenW (lpString=".ost") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".ost") returned 0x0 [0040.649] lstrlenW (lpString=".bak") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".bak") returned 0x0 [0040.649] lstrlenW (lpString=".bac") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".bac") returned 0x0 [0040.649] lstrlenW (lpString=".sys") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".sys") returned 0x0 [0040.649] lstrlenW (lpString=".v2i") returned 4 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".v2i") returned 0x0 [0040.649] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch="s\r\n.v2i") returned 0x0 [0040.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.650] lstrlenW (lpString=".sql") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".sql") returned 0x0 [0040.650] lstrlenW (lpString=".mdf") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".mdf") returned 0x0 [0040.650] lstrlenW (lpString=".txt") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".txt") returned 0x0 [0040.650] lstrlenW (lpString=".dbf") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".dbf") returned 0x0 [0040.650] lstrlenW (lpString=".ckp") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".ckp") returned 0x0 [0040.650] lstrlenW (lpString=".dacpac") returned 7 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".dacpac") returned 0x0 [0040.650] lstrlenW (lpString=".db3") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".db3") returned 0x0 [0040.650] lstrlenW (lpString=".dtxs") returned 5 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".dtxs") returned 0x0 [0040.650] lstrlenW (lpString=".mdt") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".mdt") returned 0x0 [0040.650] lstrlenW (lpString=".sdf") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".sdf") returned 0x0 [0040.650] lstrlenW (lpString=".MDF") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".MDF") returned 0x0 [0040.650] lstrlenW (lpString=".DBF") returned 4 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".DBF") returned 0x0 [0040.650] lstrlenW (lpString=".DB") returned 3 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".DB") returned 0x0 [0040.650] lstrlenW (lpString=".db") returned 3 [0040.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".db") returned 0x0 [0040.651] lstrlenW (lpString=".ndf") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".ndf") returned 0x0 [0040.651] lstrlenW (lpString=".NDF") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".NDF") returned 0x0 [0040.651] lstrlenW (lpString=".Mdf") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".Mdf") returned 0x0 [0040.651] lstrlenW (lpString=".dat") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".dat") returned 0x0 [0040.651] lstrlenW (lpString=".DAT") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".DAT") returned 0x0 [0040.651] lstrlenW (lpString=".ldf") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".ldf") returned 0x0 [0040.651] lstrlenW (lpString=".LDF") returned 4 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch=".LDF") returned 0x0 [0040.651] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0040.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.651] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.652] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.652] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.652] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16065333767) returned 1 [0040.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa70a0970, dwHighDateTime=0x1d585b4)) [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951c0 [0040.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951c0 | out: hHeap=0x260000) returned 1 [0040.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0040.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.653] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.653] GetLastError () returned 0x0 [0040.653] GetLastError () returned 0x0 [0040.653] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.653] GetLastError () returned 0x0 [0040.653] GetLastError () returned 0x0 [0040.654] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x3adb, lpOverlapped=0x0) returned 1 [0040.656] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc525, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.656] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x3adb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x3adb, lpOverlapped=0x0) returned 1 [0040.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.656] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.656] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.656] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.656] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.657] CloseHandle (hObject=0x108) returned 1 [0040.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.[deadmin@cock.li].deadmin")) returned 1 [0040.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.657] GetLastError () returned 0x0 [0040.658] RtlWakeConditionVariable () returned 0x27e828 [0040.658] GetCurrentThreadId () returned 0x98c [0040.658] GetCurrentThreadId () returned 0x98c [0040.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2973a0 | out: hHeap=0x260000) returned 1 [0040.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0040.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2973a0 [0040.658] lstrlenW (lpString=".ldf") returned 4 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".ldf") returned 0x0 [0040.658] lstrlenW (lpString=".vhd") returned 4 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".vhd") returned 0x0 [0040.658] lstrlenW (lpString=".vhdx") returned 5 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".vhdx") returned 0x0 [0040.658] lstrlenW (lpString=".pst") returned 4 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".pst") returned 0x0 [0040.658] lstrlenW (lpString=".ost") returned 4 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".ost") returned 0x0 [0040.658] lstrlenW (lpString=".bak") returned 4 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".bak") returned 0x0 [0040.658] lstrlenW (lpString=".bac") returned 4 [0040.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".bac") returned 0x0 [0040.659] lstrlenW (lpString=".sys") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".sys") returned 0x0 [0040.659] lstrlenW (lpString=".v2i") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".v2i") returned 0x0 [0040.659] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0040.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.659] lstrlenW (lpString=".sql") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".sql") returned 0x0 [0040.659] lstrlenW (lpString=".mdf") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".mdf") returned 0x0 [0040.659] lstrlenW (lpString=".txt") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".txt") returned 0x0 [0040.659] lstrlenW (lpString=".dbf") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".dbf") returned 0x0 [0040.659] lstrlenW (lpString=".ckp") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".ckp") returned 0x0 [0040.659] lstrlenW (lpString=".dacpac") returned 7 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".dacpac") returned 0x0 [0040.659] lstrlenW (lpString=".db3") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".db3") returned 0x0 [0040.659] lstrlenW (lpString=".dtxs") returned 5 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".dtxs") returned 0x0 [0040.659] lstrlenW (lpString=".mdt") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".mdt") returned 0x0 [0040.659] lstrlenW (lpString=".sdf") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".sdf") returned 0x0 [0040.659] lstrlenW (lpString=".MDF") returned 4 [0040.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".MDF") returned 0x0 [0040.660] lstrlenW (lpString=".DBF") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".DBF") returned 0x0 [0040.660] lstrlenW (lpString=".DB") returned 3 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".DB") returned 0x0 [0040.660] lstrlenW (lpString=".db") returned 3 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".db") returned 0x0 [0040.660] lstrlenW (lpString=".ndf") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".ndf") returned 0x0 [0040.660] lstrlenW (lpString=".NDF") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".NDF") returned 0x0 [0040.660] lstrlenW (lpString=".Mdf") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".Mdf") returned 0x0 [0040.660] lstrlenW (lpString=".dat") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".dat") returned 0x0 [0040.660] lstrlenW (lpString=".DAT") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".DAT") returned 0x0 [0040.660] lstrlenW (lpString=".ldf") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".ldf") returned 0x0 [0040.660] lstrlenW (lpString=".LDF") returned 4 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch=".LDF") returned 0x0 [0040.660] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0040.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.660] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.661] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.661] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16066251446) returned 1 [0040.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa70c6ad0, dwHighDateTime=0x1d585b4)) [0040.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951f8 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0040.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.662] GetLastError () returned 0x0 [0040.662] GetLastError () returned 0x0 [0040.662] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.662] GetLastError () returned 0x0 [0040.662] GetLastError () returned 0x0 [0040.663] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x42d, lpOverlapped=0x0) returned 1 [0040.671] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffbd3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.671] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x42d, lpOverlapped=0x0) returned 1 [0040.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.672] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.672] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.672] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.672] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.672] CloseHandle (hObject=0x108) returned 1 [0040.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.[deadmin@cock.li].deadmin")) returned 1 [0040.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.728] GetLastError () returned 0x0 [0040.729] RtlWakeConditionVariable () returned 0x27e828 [0040.729] GetCurrentThreadId () returned 0x98c [0040.729] GetCurrentThreadId () returned 0x98c [0040.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297730 | out: hHeap=0x260000) returned 1 [0040.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295348 | out: hHeap=0x260000) returned 1 [0040.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0040.729] lstrlenW (lpString=".ldf") returned 4 [0040.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.729] lstrlenW (lpString=".vhd") returned 4 [0040.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".vhd") returned 0x0 [0040.729] lstrlenW (lpString=".vhdx") returned 5 [0040.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".vhdx") returned 0x0 [0040.729] lstrlenW (lpString=".pst") returned 4 [0040.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".pst") returned 0x0 [0040.729] lstrlenW (lpString=".ost") returned 4 [0040.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".ost") returned 0x0 [0040.730] lstrlenW (lpString=".bak") returned 4 [0040.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".bak") returned 0x0 [0040.730] lstrlenW (lpString=".bac") returned 4 [0040.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".bac") returned 0x0 [0040.730] lstrlenW (lpString=".sys") returned 4 [0040.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".sys") returned 0x0 [0040.730] lstrlenW (lpString=".v2i") returned 4 [0040.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".v2i") returned 0x0 [0040.730] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.794] lstrlenW (lpString=".sql") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".sql") returned 0x0 [0040.794] lstrlenW (lpString=".mdf") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".mdf") returned 0x0 [0040.794] lstrlenW (lpString=".txt") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".txt") returned 0x0 [0040.794] lstrlenW (lpString=".dbf") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".dbf") returned 0x0 [0040.794] lstrlenW (lpString=".ckp") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".ckp") returned 0x0 [0040.794] lstrlenW (lpString=".dacpac") returned 7 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".dacpac") returned 0x0 [0040.794] lstrlenW (lpString=".db3") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".db3") returned 0x0 [0040.794] lstrlenW (lpString=".dtxs") returned 5 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".dtxs") returned 0x0 [0040.794] lstrlenW (lpString=".mdt") returned 4 [0040.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".mdt") returned 0x0 [0040.794] lstrlenW (lpString=".sdf") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".sdf") returned 0x0 [0040.795] lstrlenW (lpString=".MDF") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".MDF") returned 0x0 [0040.795] lstrlenW (lpString=".DBF") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".DBF") returned 0x0 [0040.795] lstrlenW (lpString=".DB") returned 3 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".DB") returned 0x0 [0040.795] lstrlenW (lpString=".db") returned 3 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".db") returned 0x0 [0040.795] lstrlenW (lpString=".ndf") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".ndf") returned 0x0 [0040.795] lstrlenW (lpString=".NDF") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".NDF") returned 0x0 [0040.795] lstrlenW (lpString=".Mdf") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".Mdf") returned 0x0 [0040.795] lstrlenW (lpString=".dat") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".dat") returned 0x0 [0040.795] lstrlenW (lpString=".DAT") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".DAT") returned 0x0 [0040.795] lstrlenW (lpString=".ldf") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.795] lstrlenW (lpString=".LDF") returned 4 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch=".LDF") returned 0x0 [0040.795] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5488 [0040.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.795] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0040.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.796] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.796] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16079744431) returned 1 [0040.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa721d730, dwHighDateTime=0x1d585b4)) [0040.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0040.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0040.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2973a0 [0040.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0040.797] GetLastError () returned 0x0 [0040.797] GetLastError () returned 0x0 [0040.797] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0040.797] GetLastError () returned 0x0 [0040.797] GetLastError () returned 0x0 [0040.798] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.811] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.812] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.812] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.812] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.813] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.813] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.814] CloseHandle (hObject=0x10c) returned 1 [0040.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.814] GetLastError () returned 0x0 [0040.815] RtlWakeConditionVariable () returned 0x27e828 [0040.815] GetCurrentThreadId () returned 0x98c [0040.815] GetCurrentThreadId () returned 0x98c [0040.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f60c0 | out: hHeap=0x260000) returned 1 [0040.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0040.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f60c0 [0040.815] lstrlenW (lpString=".ldf") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.815] lstrlenW (lpString=".vhd") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.815] lstrlenW (lpString=".vhdx") returned 5 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.815] lstrlenW (lpString=".pst") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.815] lstrlenW (lpString=".ost") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.815] lstrlenW (lpString=".bak") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.815] lstrlenW (lpString=".bac") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.815] lstrlenW (lpString=".sys") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.815] lstrlenW (lpString=".v2i") returned 4 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.815] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f60c0 | out: hHeap=0x260000) returned 1 [0040.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.816] RtlWakeConditionVariable () returned 0x27e828 [0040.816] GetCurrentThreadId () returned 0x98c [0040.816] GetCurrentThreadId () returned 0x98c [0040.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0040.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c820 | out: hHeap=0x260000) returned 1 [0040.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295508 | out: hHeap=0x260000) returned 1 [0040.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c820 [0040.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.840] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.840] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.840] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.840] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.842] CloseHandle (hObject=0x10c) returned 1 [0040.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c820 | out: hHeap=0x260000) returned 1 [0040.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0040.842] RtlWakeConditionVariable () returned 0x27e828 [0040.842] GetCurrentThreadId () returned 0x98c [0040.842] GetCurrentThreadId () returned 0x98c [0040.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6210 | out: hHeap=0x260000) returned 1 [0040.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d74e0 | out: hHeap=0x260000) returned 1 [0040.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6210 [0040.842] lstrlenW (lpString=".ldf") returned 4 [0040.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".ldf") returned 0x0 [0040.842] lstrlenW (lpString=".vhd") returned 4 [0040.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".vhd") returned 0x0 [0040.842] lstrlenW (lpString=".vhdx") returned 5 [0040.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".vhdx") returned 0x0 [0040.842] lstrlenW (lpString=".pst") returned 4 [0040.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".pst") returned 0x0 [0040.842] lstrlenW (lpString=".ost") returned 4 [0040.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".ost") returned 0x0 [0040.843] lstrlenW (lpString=".bak") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".bak") returned 0x0 [0040.843] lstrlenW (lpString=".bac") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".bac") returned 0x0 [0040.843] lstrlenW (lpString=".sys") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".sys") returned 0x0 [0040.843] lstrlenW (lpString=".v2i") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch=".v2i") returned 0x0 [0040.843] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", lpSrch="s\r\n.v2i") returned 0x0 [0040.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6210 | out: hHeap=0x260000) returned 1 [0040.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.843] RtlWakeConditionVariable () returned 0x27e828 [0040.843] GetCurrentThreadId () returned 0x98c [0040.843] GetCurrentThreadId () returned 0x98c [0040.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7518 | out: hHeap=0x260000) returned 1 [0040.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.843] lstrlenW (lpString=".ldf") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.843] lstrlenW (lpString=".vhd") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.843] lstrlenW (lpString=".vhdx") returned 5 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.843] lstrlenW (lpString=".pst") returned 4 [0040.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.843] lstrlenW (lpString=".ost") returned 4 [0040.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.844] lstrlenW (lpString=".bak") returned 4 [0040.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.844] lstrlenW (lpString=".bac") returned 4 [0040.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.844] lstrlenW (lpString=".sys") returned 4 [0040.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.844] lstrlenW (lpString=".v2i") returned 4 [0040.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.844] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.844] RtlWakeConditionVariable () returned 0x27e828 [0040.844] GetCurrentThreadId () returned 0x98c [0040.844] GetCurrentThreadId () returned 0x98c [0040.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0040.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cc70 | out: hHeap=0x260000) returned 1 [0040.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7550 | out: hHeap=0x260000) returned 1 [0040.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29cc70 [0040.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.844] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.845] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.845] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.845] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.846] CloseHandle (hObject=0x10c) returned 1 [0040.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cc70 | out: hHeap=0x260000) returned 1 [0040.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0040.846] RtlWakeConditionVariable () returned 0x27e828 [0040.846] GetCurrentThreadId () returned 0x98c [0040.846] GetCurrentThreadId () returned 0x98c [0040.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c60 | out: hHeap=0x260000) returned 1 [0040.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.846] lstrlenW (lpString=".ldf") returned 4 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.846] lstrlenW (lpString=".vhd") returned 4 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.846] lstrlenW (lpString=".vhdx") returned 5 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.846] lstrlenW (lpString=".pst") returned 4 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.846] lstrlenW (lpString=".ost") returned 4 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.846] lstrlenW (lpString=".bak") returned 4 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.846] lstrlenW (lpString=".bac") returned 4 [0040.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.847] lstrlenW (lpString=".sys") returned 4 [0040.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.847] lstrlenW (lpString=".v2i") returned 4 [0040.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.847] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.847] RtlWakeConditionVariable () returned 0x27e828 [0040.847] GetCurrentThreadId () returned 0x98c [0040.847] GetCurrentThreadId () returned 0x98c [0040.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0040.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b9c0 | out: hHeap=0x260000) returned 1 [0040.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7588 | out: hHeap=0x260000) returned 1 [0040.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b9c0 [0040.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.851] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.851] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.851] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.851] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.852] CloseHandle (hObject=0x10c) returned 1 [0040.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b9c0 | out: hHeap=0x260000) returned 1 [0040.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0040.852] RtlWakeConditionVariable () returned 0x27e828 [0040.852] GetCurrentThreadId () returned 0x98c [0040.853] GetCurrentThreadId () returned 0x98c [0040.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f66a8 | out: hHeap=0x260000) returned 1 [0040.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75f8 | out: hHeap=0x260000) returned 1 [0040.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f66a8 [0040.853] lstrlenW (lpString=".ldf") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.853] lstrlenW (lpString=".vhd") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.853] lstrlenW (lpString=".vhdx") returned 5 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.853] lstrlenW (lpString=".pst") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.853] lstrlenW (lpString=".ost") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.853] lstrlenW (lpString=".bak") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.853] lstrlenW (lpString=".bac") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.853] lstrlenW (lpString=".sys") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.853] lstrlenW (lpString=".v2i") returned 4 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.853] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f66a8 | out: hHeap=0x260000) returned 1 [0040.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.878] RtlWakeConditionVariable () returned 0x27e828 [0040.878] GetCurrentThreadId () returned 0x98c [0040.878] GetCurrentThreadId () returned 0x98c [0040.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6d38 | out: hHeap=0x260000) returned 1 [0040.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d79e8 | out: hHeap=0x260000) returned 1 [0040.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6d38 [0040.878] lstrlenW (lpString=".ldf") returned 4 [0040.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".ldf") returned 0x0 [0040.878] lstrlenW (lpString=".vhd") returned 4 [0040.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".vhd") returned 0x0 [0040.878] lstrlenW (lpString=".vhdx") returned 5 [0040.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.878] lstrlenW (lpString=".pst") returned 4 [0040.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".pst") returned 0x0 [0040.878] lstrlenW (lpString=".ost") returned 4 [0040.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".ost") returned 0x0 [0040.878] lstrlenW (lpString=".bak") returned 4 [0040.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".bak") returned 0x0 [0040.879] lstrlenW (lpString=".bac") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".bac") returned 0x0 [0040.879] lstrlenW (lpString=".sys") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".sys") returned 0x0 [0040.879] lstrlenW (lpString=".v2i") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch=".v2i") returned 0x0 [0040.879] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6d38 | out: hHeap=0x260000) returned 1 [0040.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.879] RtlWakeConditionVariable () returned 0x27e828 [0040.879] GetCurrentThreadId () returned 0x98c [0040.879] GetCurrentThreadId () returned 0x98c [0040.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2348 | out: hHeap=0x260000) returned 1 [0040.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a20 | out: hHeap=0x260000) returned 1 [0040.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2348 [0040.879] lstrlenW (lpString=".ldf") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".ldf") returned 0x0 [0040.879] lstrlenW (lpString=".vhd") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".vhd") returned 0x0 [0040.879] lstrlenW (lpString=".vhdx") returned 5 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".vhdx") returned 0x0 [0040.879] lstrlenW (lpString=".pst") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".pst") returned 0x0 [0040.879] lstrlenW (lpString=".ost") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".ost") returned 0x0 [0040.879] lstrlenW (lpString=".bak") returned 4 [0040.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".bak") returned 0x0 [0040.880] lstrlenW (lpString=".bac") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".bac") returned 0x0 [0040.880] lstrlenW (lpString=".sys") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".sys") returned 0x0 [0040.880] lstrlenW (lpString=".v2i") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch=".v2i") returned 0x0 [0040.880] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2348 | out: hHeap=0x260000) returned 1 [0040.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.880] RtlWakeConditionVariable () returned 0x27e828 [0040.880] GetCurrentThreadId () returned 0x98c [0040.880] GetCurrentThreadId () returned 0x98c [0040.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8b78 | out: hHeap=0x260000) returned 1 [0040.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a58 | out: hHeap=0x260000) returned 1 [0040.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8b78 [0040.880] lstrlenW (lpString=".ldf") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".ldf") returned 0x0 [0040.880] lstrlenW (lpString=".vhd") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".vhd") returned 0x0 [0040.880] lstrlenW (lpString=".vhdx") returned 5 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".vhdx") returned 0x0 [0040.880] lstrlenW (lpString=".pst") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".pst") returned 0x0 [0040.880] lstrlenW (lpString=".ost") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".ost") returned 0x0 [0040.880] lstrlenW (lpString=".bak") returned 4 [0040.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".bak") returned 0x0 [0040.880] lstrlenW (lpString=".bac") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".bac") returned 0x0 [0040.881] lstrlenW (lpString=".sys") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".sys") returned 0x0 [0040.881] lstrlenW (lpString=".v2i") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch=".v2i") returned 0x0 [0040.881] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8b78 | out: hHeap=0x260000) returned 1 [0040.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296b50 | out: hHeap=0x260000) returned 1 [0040.881] RtlWakeConditionVariable () returned 0x27e828 [0040.881] GetCurrentThreadId () returned 0x98c [0040.881] GetCurrentThreadId () returned 0x98c [0040.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6de0 | out: hHeap=0x260000) returned 1 [0040.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a90 | out: hHeap=0x260000) returned 1 [0040.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6de0 [0040.881] lstrlenW (lpString=".ldf") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".ldf") returned 0x0 [0040.881] lstrlenW (lpString=".vhd") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".vhd") returned 0x0 [0040.881] lstrlenW (lpString=".vhdx") returned 5 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.881] lstrlenW (lpString=".pst") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".pst") returned 0x0 [0040.881] lstrlenW (lpString=".ost") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".ost") returned 0x0 [0040.881] lstrlenW (lpString=".bak") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".bak") returned 0x0 [0040.881] lstrlenW (lpString=".bac") returned 4 [0040.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".bac") returned 0x0 [0040.882] lstrlenW (lpString=".sys") returned 4 [0040.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".sys") returned 0x0 [0040.882] lstrlenW (lpString=".v2i") returned 4 [0040.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch=".v2i") returned 0x0 [0040.882] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6de0 | out: hHeap=0x260000) returned 1 [0040.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.884] RtlWakeConditionVariable () returned 0x27e828 [0040.884] GetCurrentThreadId () returned 0x98c [0040.884] GetCurrentThreadId () returned 0x98c [0040.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6f30 | out: hHeap=0x260000) returned 1 [0040.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b00 | out: hHeap=0x260000) returned 1 [0040.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6f30 [0040.884] lstrlenW (lpString=".ldf") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".ldf") returned 0x0 [0040.884] lstrlenW (lpString=".vhd") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".vhd") returned 0x0 [0040.884] lstrlenW (lpString=".vhdx") returned 5 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.884] lstrlenW (lpString=".pst") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".pst") returned 0x0 [0040.884] lstrlenW (lpString=".ost") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".ost") returned 0x0 [0040.884] lstrlenW (lpString=".bak") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".bak") returned 0x0 [0040.884] lstrlenW (lpString=".bac") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".bac") returned 0x0 [0040.884] lstrlenW (lpString=".sys") returned 4 [0040.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".sys") returned 0x0 [0040.884] lstrlenW (lpString=".v2i") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch=".v2i") returned 0x0 [0040.885] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6f30 | out: hHeap=0x260000) returned 1 [0040.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.885] RtlWakeConditionVariable () returned 0x27e828 [0040.885] GetCurrentThreadId () returned 0x98c [0040.885] GetCurrentThreadId () returned 0x98c [0040.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6fd8 | out: hHeap=0x260000) returned 1 [0040.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b38 | out: hHeap=0x260000) returned 1 [0040.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6fd8 [0040.885] lstrlenW (lpString=".ldf") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.885] lstrlenW (lpString=".vhd") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.885] lstrlenW (lpString=".vhdx") returned 5 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.885] lstrlenW (lpString=".pst") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.885] lstrlenW (lpString=".ost") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.885] lstrlenW (lpString=".bak") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.885] lstrlenW (lpString=".bac") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.885] lstrlenW (lpString=".sys") returned 4 [0040.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.886] lstrlenW (lpString=".v2i") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.886] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6fd8 | out: hHeap=0x260000) returned 1 [0040.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.886] RtlWakeConditionVariable () returned 0x27e828 [0040.886] GetCurrentThreadId () returned 0x98c [0040.886] GetCurrentThreadId () returned 0x98c [0040.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7080 | out: hHeap=0x260000) returned 1 [0040.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b70 | out: hHeap=0x260000) returned 1 [0040.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7080 [0040.886] lstrlenW (lpString=".ldf") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".ldf") returned 0x0 [0040.886] lstrlenW (lpString=".vhd") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".vhd") returned 0x0 [0040.886] lstrlenW (lpString=".vhdx") returned 5 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.886] lstrlenW (lpString=".pst") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".pst") returned 0x0 [0040.886] lstrlenW (lpString=".ost") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".ost") returned 0x0 [0040.886] lstrlenW (lpString=".bak") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".bak") returned 0x0 [0040.886] lstrlenW (lpString=".bac") returned 4 [0040.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".bac") returned 0x0 [0040.887] lstrlenW (lpString=".sys") returned 4 [0040.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".sys") returned 0x0 [0040.887] lstrlenW (lpString=".v2i") returned 4 [0040.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch=".v2i") returned 0x0 [0040.887] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7080 | out: hHeap=0x260000) returned 1 [0040.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.887] RtlWakeConditionVariable () returned 0x27e828 [0040.887] GetCurrentThreadId () returned 0x98c [0040.887] GetCurrentThreadId () returned 0x98c [0040.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2400 | out: hHeap=0x260000) returned 1 [0040.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ba8 | out: hHeap=0x260000) returned 1 [0040.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2400 [0040.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.916] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.916] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.916] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.916] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.917] CloseHandle (hObject=0x100) returned 1 [0040.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2400 | out: hHeap=0x260000) returned 1 [0040.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.917] RtlWakeConditionVariable () returned 0x27e828 [0040.917] GetCurrentThreadId () returned 0x98c [0040.917] GetCurrentThreadId () returned 0x98c [0040.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2798 | out: hHeap=0x260000) returned 1 [0040.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d18 | out: hHeap=0x260000) returned 1 [0040.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2798 [0040.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.943] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.943] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.943] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.943] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.944] CloseHandle (hObject=0x100) returned 1 [0040.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2798 | out: hHeap=0x260000) returned 1 [0040.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.944] RtlWakeConditionVariable () returned 0x27e828 [0040.944] GetCurrentThreadId () returned 0x98c [0040.944] GetCurrentThreadId () returned 0x98c [0040.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0040.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7fb8 | out: hHeap=0x260000) returned 1 [0040.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0040.945] lstrlenW (lpString=".ldf") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".ldf") returned 0x0 [0040.945] lstrlenW (lpString=".vhd") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".vhd") returned 0x0 [0040.945] lstrlenW (lpString=".vhdx") returned 5 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".vhdx") returned 0x0 [0040.945] lstrlenW (lpString=".pst") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".pst") returned 0x0 [0040.945] lstrlenW (lpString=".ost") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".ost") returned 0x0 [0040.945] lstrlenW (lpString=".bak") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".bak") returned 0x0 [0040.945] lstrlenW (lpString=".bac") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".bac") returned 0x0 [0040.945] lstrlenW (lpString=".sys") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".sys") returned 0x0 [0040.945] lstrlenW (lpString=".v2i") returned 4 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch=".v2i") returned 0x0 [0040.945] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0040.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.946] RtlWakeConditionVariable () returned 0x27e828 [0040.946] GetCurrentThreadId () returned 0x98c [0040.946] GetCurrentThreadId () returned 0x98c [0040.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2be8 | out: hHeap=0x260000) returned 1 [0040.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ff0 | out: hHeap=0x260000) returned 1 [0040.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2be8 [0040.946] lstrlenW (lpString=".ldf") returned 4 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".ldf") returned 0x0 [0040.946] lstrlenW (lpString=".vhd") returned 4 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".vhd") returned 0x0 [0040.946] lstrlenW (lpString=".vhdx") returned 5 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".vhdx") returned 0x0 [0040.946] lstrlenW (lpString=".pst") returned 4 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".pst") returned 0x0 [0040.946] lstrlenW (lpString=".ost") returned 4 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".ost") returned 0x0 [0040.946] lstrlenW (lpString=".bak") returned 4 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".bak") returned 0x0 [0040.946] lstrlenW (lpString=".bac") returned 4 [0040.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".bac") returned 0x0 [0040.946] lstrlenW (lpString=".sys") returned 4 [0040.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".sys") returned 0x0 [0040.947] lstrlenW (lpString=".v2i") returned 4 [0040.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch=".v2i") returned 0x0 [0040.947] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2be8 | out: hHeap=0x260000) returned 1 [0040.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.947] RtlWakeConditionVariable () returned 0x27e828 [0040.947] GetCurrentThreadId () returned 0x98c [0040.947] GetCurrentThreadId () returned 0x98c [0040.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ca0 | out: hHeap=0x260000) returned 1 [0040.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8028 | out: hHeap=0x260000) returned 1 [0040.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0040.948] lstrlenW (lpString=".ldf") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".ldf") returned 0x0 [0040.948] lstrlenW (lpString=".vhd") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".vhd") returned 0x0 [0040.948] lstrlenW (lpString=".vhdx") returned 5 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".vhdx") returned 0x0 [0040.948] lstrlenW (lpString=".pst") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".pst") returned 0x0 [0040.948] lstrlenW (lpString=".ost") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".ost") returned 0x0 [0040.948] lstrlenW (lpString=".bak") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".bak") returned 0x0 [0040.948] lstrlenW (lpString=".bac") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".bac") returned 0x0 [0040.948] lstrlenW (lpString=".sys") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".sys") returned 0x0 [0040.948] lstrlenW (lpString=".v2i") returned 4 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch=".v2i") returned 0x0 [0040.948] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ca0 | out: hHeap=0x260000) returned 1 [0040.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.948] RtlWakeConditionVariable () returned 0x27e828 [0040.948] GetCurrentThreadId () returned 0x98c [0040.948] GetCurrentThreadId () returned 0x98c [0040.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2d58 | out: hHeap=0x260000) returned 1 [0040.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0040.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2d58 [0040.949] lstrlenW (lpString=".ldf") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".ldf") returned 0x0 [0040.949] lstrlenW (lpString=".vhd") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".vhd") returned 0x0 [0040.949] lstrlenW (lpString=".vhdx") returned 5 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".vhdx") returned 0x0 [0040.949] lstrlenW (lpString=".pst") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".pst") returned 0x0 [0040.949] lstrlenW (lpString=".ost") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".ost") returned 0x0 [0040.949] lstrlenW (lpString=".bak") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".bak") returned 0x0 [0040.949] lstrlenW (lpString=".bac") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".bac") returned 0x0 [0040.949] lstrlenW (lpString=".sys") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".sys") returned 0x0 [0040.949] lstrlenW (lpString=".v2i") returned 4 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch=".v2i") returned 0x0 [0040.949] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2d58 | out: hHeap=0x260000) returned 1 [0040.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.950] RtlWakeConditionVariable () returned 0x27e828 [0040.950] GetCurrentThreadId () returned 0x98c [0040.950] GetCurrentThreadId () returned 0x98c [0040.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2e10 | out: hHeap=0x260000) returned 1 [0040.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8098 | out: hHeap=0x260000) returned 1 [0040.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2e10 [0040.950] lstrlenW (lpString=".ldf") returned 4 [0040.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".ldf") returned 0x0 [0040.950] lstrlenW (lpString=".vhd") returned 4 [0040.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".vhd") returned 0x0 [0040.950] lstrlenW (lpString=".vhdx") returned 5 [0040.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".vhdx") returned 0x0 [0040.950] lstrlenW (lpString=".pst") returned 4 [0040.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".pst") returned 0x0 [0040.950] lstrlenW (lpString=".ost") returned 4 [0040.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".ost") returned 0x0 [0040.950] lstrlenW (lpString=".bak") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".bak") returned 0x0 [0040.951] lstrlenW (lpString=".bac") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".bac") returned 0x0 [0040.951] lstrlenW (lpString=".sys") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".sys") returned 0x0 [0040.951] lstrlenW (lpString=".v2i") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch=".v2i") returned 0x0 [0040.951] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2e10 | out: hHeap=0x260000) returned 1 [0040.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.951] RtlWakeConditionVariable () returned 0x27e828 [0040.951] GetCurrentThreadId () returned 0x98c [0040.951] GetCurrentThreadId () returned 0x98c [0040.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ec8 | out: hHeap=0x260000) returned 1 [0040.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d80d0 | out: hHeap=0x260000) returned 1 [0040.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ec8 [0040.951] lstrlenW (lpString=".ldf") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".ldf") returned 0x0 [0040.951] lstrlenW (lpString=".vhd") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".vhd") returned 0x0 [0040.951] lstrlenW (lpString=".vhdx") returned 5 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".vhdx") returned 0x0 [0040.951] lstrlenW (lpString=".pst") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".pst") returned 0x0 [0040.951] lstrlenW (lpString=".ost") returned 4 [0040.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".ost") returned 0x0 [0040.951] lstrlenW (lpString=".bak") returned 4 [0040.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".bak") returned 0x0 [0040.952] lstrlenW (lpString=".bac") returned 4 [0040.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".bac") returned 0x0 [0040.952] lstrlenW (lpString=".sys") returned 4 [0040.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".sys") returned 0x0 [0040.952] lstrlenW (lpString=".v2i") returned 4 [0040.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch=".v2i") returned 0x0 [0040.952] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ec8 | out: hHeap=0x260000) returned 1 [0040.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.952] RtlWakeConditionVariable () returned 0x27e828 [0040.952] GetCurrentThreadId () returned 0x98c [0040.952] GetCurrentThreadId () returned 0x98c [0040.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2f80 | out: hHeap=0x260000) returned 1 [0040.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8108 | out: hHeap=0x260000) returned 1 [0040.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0040.953] lstrlenW (lpString=".ldf") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".ldf") returned 0x0 [0040.953] lstrlenW (lpString=".vhd") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".vhd") returned 0x0 [0040.953] lstrlenW (lpString=".vhdx") returned 5 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".vhdx") returned 0x0 [0040.953] lstrlenW (lpString=".pst") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".pst") returned 0x0 [0040.953] lstrlenW (lpString=".ost") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".ost") returned 0x0 [0040.953] lstrlenW (lpString=".bak") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".bak") returned 0x0 [0040.953] lstrlenW (lpString=".bac") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".bac") returned 0x0 [0040.953] lstrlenW (lpString=".sys") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".sys") returned 0x0 [0040.953] lstrlenW (lpString=".v2i") returned 4 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch=".v2i") returned 0x0 [0040.953] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2f80 | out: hHeap=0x260000) returned 1 [0040.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.953] RtlWakeConditionVariable () returned 0x27e828 [0040.953] GetCurrentThreadId () returned 0x98c [0040.954] GetCurrentThreadId () returned 0x98c [0040.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0040.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da2e0 | out: hHeap=0x260000) returned 1 [0040.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8140 | out: hHeap=0x260000) returned 1 [0040.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da2e0 [0040.954] lstrlenW (lpString=".ldf") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".ldf") returned 0x0 [0040.954] lstrlenW (lpString=".vhd") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".vhd") returned 0x0 [0040.954] lstrlenW (lpString=".vhdx") returned 5 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".vhdx") returned 0x0 [0040.954] lstrlenW (lpString=".pst") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".pst") returned 0x0 [0040.954] lstrlenW (lpString=".ost") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".ost") returned 0x0 [0040.954] lstrlenW (lpString=".bak") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".bak") returned 0x0 [0040.954] lstrlenW (lpString=".bac") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".bac") returned 0x0 [0040.954] lstrlenW (lpString=".sys") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".sys") returned 0x0 [0040.954] lstrlenW (lpString=".v2i") returned 4 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch=".v2i") returned 0x0 [0040.954] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da2e0 | out: hHeap=0x260000) returned 1 [0040.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0040.955] RtlWakeConditionVariable () returned 0x27e828 [0040.955] GetCurrentThreadId () returned 0x98c [0040.955] GetCurrentThreadId () returned 0x98c [0040.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3038 | out: hHeap=0x260000) returned 1 [0040.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8178 | out: hHeap=0x260000) returned 1 [0040.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3038 [0040.955] lstrlenW (lpString=".ldf") returned 4 [0040.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".ldf") returned 0x0 [0040.955] lstrlenW (lpString=".vhd") returned 4 [0040.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".vhd") returned 0x0 [0040.955] lstrlenW (lpString=".vhdx") returned 5 [0040.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".vhdx") returned 0x0 [0040.955] lstrlenW (lpString=".pst") returned 4 [0040.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".pst") returned 0x0 [0040.955] lstrlenW (lpString=".ost") returned 4 [0040.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".ost") returned 0x0 [0040.955] lstrlenW (lpString=".bak") returned 4 [0040.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".bak") returned 0x0 [0040.955] lstrlenW (lpString=".bac") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".bac") returned 0x0 [0040.956] lstrlenW (lpString=".sys") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".sys") returned 0x0 [0040.956] lstrlenW (lpString=".v2i") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch=".v2i") returned 0x0 [0040.956] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3038 | out: hHeap=0x260000) returned 1 [0040.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.956] RtlWakeConditionVariable () returned 0x27e828 [0040.956] GetCurrentThreadId () returned 0x98c [0040.956] GetCurrentThreadId () returned 0x98c [0040.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0040.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da3a8 | out: hHeap=0x260000) returned 1 [0040.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81b0 | out: hHeap=0x260000) returned 1 [0040.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da3a8 [0040.956] lstrlenW (lpString=".ldf") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".ldf") returned 0x0 [0040.956] lstrlenW (lpString=".vhd") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".vhd") returned 0x0 [0040.956] lstrlenW (lpString=".vhdx") returned 5 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".vhdx") returned 0x0 [0040.956] lstrlenW (lpString=".pst") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".pst") returned 0x0 [0040.956] lstrlenW (lpString=".ost") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".ost") returned 0x0 [0040.956] lstrlenW (lpString=".bak") returned 4 [0040.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".bak") returned 0x0 [0040.957] lstrlenW (lpString=".bac") returned 4 [0040.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".bac") returned 0x0 [0040.957] lstrlenW (lpString=".sys") returned 4 [0040.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".sys") returned 0x0 [0040.957] lstrlenW (lpString=".v2i") returned 4 [0040.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch=".v2i") returned 0x0 [0040.957] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da3a8 | out: hHeap=0x260000) returned 1 [0040.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0040.957] RtlWakeConditionVariable () returned 0x27e828 [0040.957] GetCurrentThreadId () returned 0x98c [0040.957] GetCurrentThreadId () returned 0x98c [0040.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0e8 | out: hHeap=0x260000) returned 1 [0040.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81e8 | out: hHeap=0x260000) returned 1 [0040.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f0e8 [0040.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.983] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.983] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.983] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.983] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.984] CloseHandle (hObject=0x100) returned 1 [0040.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0e8 | out: hHeap=0x260000) returned 1 [0040.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.984] RtlWakeConditionVariable () returned 0x27e828 [0040.984] GetCurrentThreadId () returned 0x98c [0040.984] GetCurrentThreadId () returned 0x98c [0040.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f298 | out: hHeap=0x260000) returned 1 [0040.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0040.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f298 [0040.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.993] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.993] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.993] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.993] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.994] CloseHandle (hObject=0x100) returned 1 [0040.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f298 | out: hHeap=0x260000) returned 1 [0040.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.994] RtlWakeConditionVariable () returned 0x27e828 [0040.994] GetCurrentThreadId () returned 0x98c [0040.994] GetCurrentThreadId () returned 0x98c [0040.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eddd8 | out: hHeap=0x260000) returned 1 [0040.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d82c8 | out: hHeap=0x260000) returned 1 [0040.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0040.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.006] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.006] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.006] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.006] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.007] CloseHandle (hObject=0xf0) returned 1 [0041.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eddd8 | out: hHeap=0x260000) returned 1 [0041.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0041.007] RtlWakeConditionVariable () returned 0x27e828 [0041.007] GetCurrentThreadId () returned 0x98c [0041.008] GetCurrentThreadId () returned 0x98c [0041.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8370 | out: hHeap=0x260000) returned 1 [0041.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0041.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.011] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.011] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.011] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.011] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.013] CloseHandle (hObject=0xf0) returned 1 [0041.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.013] RtlWakeConditionVariable () returned 0x27e828 [0041.013] GetCurrentThreadId () returned 0x98c [0041.013] GetCurrentThreadId () returned 0x98c [0041.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da470 [0041.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da858 | out: hHeap=0x260000) returned 1 [0041.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8418 | out: hHeap=0x260000) returned 1 [0041.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da858 [0041.013] lstrlenW (lpString=".ldf") returned 4 [0041.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".ldf") returned 0x0 [0041.013] lstrlenW (lpString=".vhd") returned 4 [0041.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".vhd") returned 0x0 [0041.014] lstrlenW (lpString=".vhdx") returned 5 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".vhdx") returned 0x0 [0041.014] lstrlenW (lpString=".pst") returned 4 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".pst") returned 0x0 [0041.014] lstrlenW (lpString=".ost") returned 4 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".ost") returned 0x0 [0041.014] lstrlenW (lpString=".bak") returned 4 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".bak") returned 0x0 [0041.014] lstrlenW (lpString=".bac") returned 4 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".bac") returned 0x0 [0041.014] lstrlenW (lpString=".sys") returned 4 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".sys") returned 0x0 [0041.014] lstrlenW (lpString=".v2i") returned 4 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch=".v2i") returned 0x0 [0041.014] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da858 | out: hHeap=0x260000) returned 1 [0041.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da470 | out: hHeap=0x260000) returned 1 [0041.015] RtlWakeConditionVariable () returned 0x27e828 [0041.015] GetCurrentThreadId () returned 0x98c [0041.015] GetCurrentThreadId () returned 0x98c [0041.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da470 [0041.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da920 | out: hHeap=0x260000) returned 1 [0041.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337af8 | out: hHeap=0x260000) returned 1 [0041.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da920 [0041.015] lstrlenW (lpString=".ldf") returned 4 [0041.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".ldf") returned 0x0 [0041.015] lstrlenW (lpString=".vhd") returned 4 [0041.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".vhd") returned 0x0 [0041.015] lstrlenW (lpString=".vhdx") returned 5 [0041.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".vhdx") returned 0x0 [0041.015] lstrlenW (lpString=".pst") returned 4 [0041.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".pst") returned 0x0 [0041.016] lstrlenW (lpString=".ost") returned 4 [0041.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".ost") returned 0x0 [0041.016] lstrlenW (lpString=".bak") returned 4 [0041.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".bak") returned 0x0 [0041.016] lstrlenW (lpString=".bac") returned 4 [0041.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".bac") returned 0x0 [0041.016] lstrlenW (lpString=".sys") returned 4 [0041.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".sys") returned 0x0 [0041.016] lstrlenW (lpString=".v2i") returned 4 [0041.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch=".v2i") returned 0x0 [0041.016] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da920 | out: hHeap=0x260000) returned 1 [0041.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da470 | out: hHeap=0x260000) returned 1 [0041.016] RtlWakeConditionVariable () returned 0x27e828 [0041.016] GetCurrentThreadId () returned 0x98c [0041.016] GetCurrentThreadId () returned 0x98c [0041.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f520 | out: hHeap=0x260000) returned 1 [0041.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b30 | out: hHeap=0x260000) returned 1 [0041.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f520 [0041.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.024] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.024] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.024] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.024] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.025] CloseHandle (hObject=0xf0) returned 1 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f520 | out: hHeap=0x260000) returned 1 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.026] RtlWakeConditionVariable () returned 0x27e828 [0041.026] GetCurrentThreadId () returned 0x98c [0041.026] GetCurrentThreadId () returned 0x98c [0041.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0041.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f5f8 [0041.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.043] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.043] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.043] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.043] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.044] CloseHandle (hObject=0x100) returned 1 [0041.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.045] RtlWakeConditionVariable () returned 0x27e828 [0041.045] GetCurrentThreadId () returned 0x98c [0041.045] GetCurrentThreadId () returned 0x98c [0041.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cf0 | out: hHeap=0x260000) returned 1 [0041.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.045] lstrlenW (lpString=".ldf") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".ldf") returned 0x0 [0041.045] lstrlenW (lpString=".vhd") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".vhd") returned 0x0 [0041.045] lstrlenW (lpString=".vhdx") returned 5 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".vhdx") returned 0x0 [0041.045] lstrlenW (lpString=".pst") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".pst") returned 0x0 [0041.045] lstrlenW (lpString=".ost") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".ost") returned 0x0 [0041.045] lstrlenW (lpString=".bak") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".bak") returned 0x0 [0041.045] lstrlenW (lpString=".bac") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".bac") returned 0x0 [0041.045] lstrlenW (lpString=".sys") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".sys") returned 0x0 [0041.045] lstrlenW (lpString=".v2i") returned 4 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch=".v2i") returned 0x0 [0041.045] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.046] RtlWakeConditionVariable () returned 0x27e828 [0041.046] GetCurrentThreadId () returned 0x98c [0041.046] GetCurrentThreadId () returned 0x98c [0041.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d28 | out: hHeap=0x260000) returned 1 [0041.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.110] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.110] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.110] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.110] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.111] CloseHandle (hObject=0xf0) returned 1 [0041.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.111] RtlWakeConditionVariable () returned 0x27e828 [0041.111] GetCurrentThreadId () returned 0x98c [0041.111] GetCurrentThreadId () returned 0x98c [0041.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9920 [0041.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe08 | out: hHeap=0x260000) returned 1 [0041.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.112] lstrlenW (lpString=".ldf") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".ldf") returned 0x0 [0041.112] lstrlenW (lpString=".vhd") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".vhd") returned 0x0 [0041.112] lstrlenW (lpString=".vhdx") returned 5 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".vhdx") returned 0x0 [0041.112] lstrlenW (lpString=".pst") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".pst") returned 0x0 [0041.112] lstrlenW (lpString=".ost") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".ost") returned 0x0 [0041.112] lstrlenW (lpString=".bak") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".bak") returned 0x0 [0041.112] lstrlenW (lpString=".bac") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".bac") returned 0x0 [0041.112] lstrlenW (lpString=".sys") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".sys") returned 0x0 [0041.112] lstrlenW (lpString=".v2i") returned 4 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch=".v2i") returned 0x0 [0041.112] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9920 | out: hHeap=0x260000) returned 1 [0041.113] RtlWakeConditionVariable () returned 0x27e828 [0041.113] GetCurrentThreadId () returned 0x98c [0041.113] GetCurrentThreadId () returned 0x98c [0041.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9920 [0041.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9ae8 | out: hHeap=0x260000) returned 1 [0041.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe40 | out: hHeap=0x260000) returned 1 [0041.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9ae8 [0041.113] lstrlenW (lpString=".ldf") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".ldf") returned 0x0 [0041.113] lstrlenW (lpString=".vhd") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".vhd") returned 0x0 [0041.113] lstrlenW (lpString=".vhdx") returned 5 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".vhdx") returned 0x0 [0041.113] lstrlenW (lpString=".pst") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".pst") returned 0x0 [0041.113] lstrlenW (lpString=".ost") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".ost") returned 0x0 [0041.113] lstrlenW (lpString=".bak") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".bak") returned 0x0 [0041.113] lstrlenW (lpString=".bac") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".bac") returned 0x0 [0041.113] lstrlenW (lpString=".sys") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".sys") returned 0x0 [0041.113] lstrlenW (lpString=".v2i") returned 4 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch=".v2i") returned 0x0 [0041.113] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9ae8 | out: hHeap=0x260000) returned 1 [0041.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9920 | out: hHeap=0x260000) returned 1 [0041.121] RtlWakeConditionVariable () returned 0x27e828 [0041.121] GetCurrentThreadId () returned 0x98c [0041.121] GetCurrentThreadId () returned 0x98c [0041.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9920 [0041.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d48 | out: hHeap=0x260000) returned 1 [0041.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff20 | out: hHeap=0x260000) returned 1 [0041.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9d48 [0041.121] lstrlenW (lpString=".ldf") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".ldf") returned 0x0 [0041.121] lstrlenW (lpString=".vhd") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".vhd") returned 0x0 [0041.121] lstrlenW (lpString=".vhdx") returned 5 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".vhdx") returned 0x0 [0041.121] lstrlenW (lpString=".pst") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".pst") returned 0x0 [0041.121] lstrlenW (lpString=".ost") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".ost") returned 0x0 [0041.121] lstrlenW (lpString=".bak") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".bak") returned 0x0 [0041.121] lstrlenW (lpString=".bac") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".bac") returned 0x0 [0041.121] lstrlenW (lpString=".sys") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".sys") returned 0x0 [0041.121] lstrlenW (lpString=".v2i") returned 4 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch=".v2i") returned 0x0 [0041.121] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d48 | out: hHeap=0x260000) returned 1 [0041.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9920 | out: hHeap=0x260000) returned 1 [0041.136] RtlWakeConditionVariable () returned 0x27e828 [0041.136] GetCurrentThreadId () returned 0x98c [0041.136] GetCurrentThreadId () returned 0x98c [0041.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9920 [0041.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9f10 | out: hHeap=0x260000) returned 1 [0041.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00a8 | out: hHeap=0x260000) returned 1 [0041.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9f10 [0041.136] lstrlenW (lpString=".ldf") returned 4 [0041.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".ldf") returned 0x0 [0041.136] lstrlenW (lpString=".vhd") returned 4 [0041.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".vhd") returned 0x0 [0041.136] lstrlenW (lpString=".vhdx") returned 5 [0041.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".vhdx") returned 0x0 [0041.136] lstrlenW (lpString=".pst") returned 4 [0041.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".pst") returned 0x0 [0041.137] lstrlenW (lpString=".ost") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".ost") returned 0x0 [0041.137] lstrlenW (lpString=".bak") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".bak") returned 0x0 [0041.137] lstrlenW (lpString=".bac") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".bac") returned 0x0 [0041.137] lstrlenW (lpString=".sys") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".sys") returned 0x0 [0041.137] lstrlenW (lpString=".v2i") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch=".v2i") returned 0x0 [0041.137] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9f10 | out: hHeap=0x260000) returned 1 [0041.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9920 | out: hHeap=0x260000) returned 1 [0041.137] RtlWakeConditionVariable () returned 0x27e828 [0041.137] GetCurrentThreadId () returned 0x98c [0041.137] GetCurrentThreadId () returned 0x98c [0041.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30db98 | out: hHeap=0x260000) returned 1 [0041.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00e0 | out: hHeap=0x260000) returned 1 [0041.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30db98 [0041.137] lstrlenW (lpString=".ldf") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.137] lstrlenW (lpString=".vhd") returned 4 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.137] lstrlenW (lpString=".vhdx") returned 5 [0041.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.138] lstrlenW (lpString=".pst") returned 4 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.138] lstrlenW (lpString=".ost") returned 4 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.138] lstrlenW (lpString=".bak") returned 4 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.138] lstrlenW (lpString=".bac") returned 4 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.138] lstrlenW (lpString=".sys") returned 4 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.138] lstrlenW (lpString=".v2i") returned 4 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.138] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30db98 | out: hHeap=0x260000) returned 1 [0041.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.138] RtlWakeConditionVariable () returned 0x27e828 [0041.138] GetCurrentThreadId () returned 0x98c [0041.138] GetCurrentThreadId () returned 0x98c [0041.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f36b0 | out: hHeap=0x260000) returned 1 [0041.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0118 | out: hHeap=0x260000) returned 1 [0041.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0041.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.148] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.148] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.148] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.148] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.149] CloseHandle (hObject=0x100) returned 1 [0041.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f36b0 | out: hHeap=0x260000) returned 1 [0041.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.149] RtlWakeConditionVariable () returned 0x27e828 [0041.149] GetCurrentThreadId () returned 0x98c [0041.149] GetCurrentThreadId () returned 0x98c [0041.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3820 | out: hHeap=0x260000) returned 1 [0041.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01c0 | out: hHeap=0x260000) returned 1 [0041.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3820 [0041.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.184] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.184] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.184] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.184] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.185] CloseHandle (hObject=0x100) returned 1 [0041.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3820 | out: hHeap=0x260000) returned 1 [0041.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.186] RtlWakeConditionVariable () returned 0x27e828 [0041.186] GetCurrentThreadId () returned 0x98c [0041.186] GetCurrentThreadId () returned 0x98c [0041.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e2d0 | out: hHeap=0x260000) returned 1 [0041.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb90 | out: hHeap=0x260000) returned 1 [0041.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e2d0 [0041.186] lstrlenW (lpString=".ldf") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".ldf") returned 0x0 [0041.186] lstrlenW (lpString=".vhd") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".vhd") returned 0x0 [0041.186] lstrlenW (lpString=".vhdx") returned 5 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".vhdx") returned 0x0 [0041.186] lstrlenW (lpString=".pst") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".pst") returned 0x0 [0041.186] lstrlenW (lpString=".ost") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".ost") returned 0x0 [0041.186] lstrlenW (lpString=".bak") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".bak") returned 0x0 [0041.186] lstrlenW (lpString=".bac") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".bac") returned 0x0 [0041.186] lstrlenW (lpString=".sys") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".sys") returned 0x0 [0041.186] lstrlenW (lpString=".v2i") returned 4 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch=".v2i") returned 0x0 [0041.186] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", lpSrch="s\r\n.v2i") returned 0x0 [0041.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e2d0 | out: hHeap=0x260000) returned 1 [0041.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.187] RtlWakeConditionVariable () returned 0x27e828 [0041.187] GetCurrentThreadId () returned 0x98c [0041.187] GetCurrentThreadId () returned 0x98c [0041.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e378 | out: hHeap=0x260000) returned 1 [0041.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cbc8 | out: hHeap=0x260000) returned 1 [0041.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e378 [0041.187] lstrlenW (lpString=".ldf") returned 4 [0041.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.187] lstrlenW (lpString=".vhd") returned 4 [0041.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.187] lstrlenW (lpString=".vhdx") returned 5 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.188] lstrlenW (lpString=".pst") returned 4 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.188] lstrlenW (lpString=".ost") returned 4 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.188] lstrlenW (lpString=".bak") returned 4 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.188] lstrlenW (lpString=".bac") returned 4 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.188] lstrlenW (lpString=".sys") returned 4 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.188] lstrlenW (lpString=".v2i") returned 4 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.188] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e378 | out: hHeap=0x260000) returned 1 [0041.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.189] RtlWakeConditionVariable () returned 0x27e828 [0041.189] GetCurrentThreadId () returned 0x98c [0041.189] GetCurrentThreadId () returned 0x98c [0041.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0041.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0041.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0041.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.189] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.189] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.189] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.189] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.190] CloseHandle (hObject=0x100) returned 1 [0041.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0041.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.190] RtlWakeConditionVariable () returned 0x27e828 [0041.190] GetCurrentThreadId () returned 0x98c [0041.191] GetCurrentThreadId () returned 0x98c [0041.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d370 | out: hHeap=0x260000) returned 1 [0041.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0041.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0041.191] lstrlenW (lpString=".ldf") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.191] lstrlenW (lpString=".vhd") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.191] lstrlenW (lpString=".vhdx") returned 5 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.191] lstrlenW (lpString=".pst") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.191] lstrlenW (lpString=".ost") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.191] lstrlenW (lpString=".bak") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.191] lstrlenW (lpString=".bac") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.191] lstrlenW (lpString=".sys") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.191] lstrlenW (lpString=".v2i") returned 4 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.191] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d370 | out: hHeap=0x260000) returned 1 [0041.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.192] RtlWakeConditionVariable () returned 0x27e828 [0041.192] GetCurrentThreadId () returned 0x98c [0041.192] GetCurrentThreadId () returned 0x98c [0041.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b400 | out: hHeap=0x260000) returned 1 [0041.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1108 | out: hHeap=0x260000) returned 1 [0041.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b400 [0041.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.193] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.193] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.193] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.193] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.193] CloseHandle (hObject=0x100) returned 1 [0041.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b400 | out: hHeap=0x260000) returned 1 [0041.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.194] RtlWakeConditionVariable () returned 0x27e828 [0041.194] GetCurrentThreadId () returned 0x98c [0041.194] GetCurrentThreadId () returned 0x98c [0041.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b348 | out: hHeap=0x260000) returned 1 [0041.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a10d0 | out: hHeap=0x260000) returned 1 [0041.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b348 [0041.194] lstrlenW (lpString=".ldf") returned 4 [0041.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.194] lstrlenW (lpString=".vhd") returned 4 [0041.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.194] lstrlenW (lpString=".vhdx") returned 5 [0041.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.194] lstrlenW (lpString=".pst") returned 4 [0041.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.194] lstrlenW (lpString=".ost") returned 4 [0041.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.195] lstrlenW (lpString=".bak") returned 4 [0041.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.195] lstrlenW (lpString=".bac") returned 4 [0041.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.195] lstrlenW (lpString=".sys") returned 4 [0041.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.195] lstrlenW (lpString=".v2i") returned 4 [0041.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.195] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b348 | out: hHeap=0x260000) returned 1 [0041.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.195] RtlWakeConditionVariable () returned 0x27e828 [0041.195] GetCurrentThreadId () returned 0x98c [0041.195] GetCurrentThreadId () returned 0x98c [0041.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da600 | out: hHeap=0x260000) returned 1 [0041.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1098 | out: hHeap=0x260000) returned 1 [0041.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0041.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.196] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.196] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.196] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.196] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.197] CloseHandle (hObject=0x100) returned 1 [0041.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da600 | out: hHeap=0x260000) returned 1 [0041.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.197] RtlWakeConditionVariable () returned 0x27e828 [0041.197] GetCurrentThreadId () returned 0x98c [0041.197] GetCurrentThreadId () returned 0x98c [0041.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0041.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0041.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d760 [0041.197] lstrlenW (lpString=".ldf") returned 4 [0041.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.197] lstrlenW (lpString=".vhd") returned 4 [0041.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.197] lstrlenW (lpString=".vhdx") returned 5 [0041.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.197] lstrlenW (lpString=".pst") returned 4 [0041.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.197] lstrlenW (lpString=".ost") returned 4 [0041.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.198] lstrlenW (lpString=".bak") returned 4 [0041.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.198] lstrlenW (lpString=".bac") returned 4 [0041.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.198] lstrlenW (lpString=".sys") returned 4 [0041.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.198] lstrlenW (lpString=".v2i") returned 4 [0041.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.198] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0041.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.199] RtlWakeConditionVariable () returned 0x27e828 [0041.199] GetCurrentThreadId () returned 0x98c [0041.199] GetCurrentThreadId () returned 0x98c [0041.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0041.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0041.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.199] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.199] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.199] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.199] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.200] CloseHandle (hObject=0x100) returned 1 [0041.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0041.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.200] RtlWakeConditionVariable () returned 0x27e828 [0041.200] GetCurrentThreadId () returned 0x98c [0041.200] GetCurrentThreadId () returned 0x98c [0041.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296430 | out: hHeap=0x260000) returned 1 [0041.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1258 | out: hHeap=0x260000) returned 1 [0041.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296430 [0041.201] lstrlenW (lpString=".ldf") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".ldf") returned 0x0 [0041.201] lstrlenW (lpString=".vhd") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".vhd") returned 0x0 [0041.201] lstrlenW (lpString=".vhdx") returned 5 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".vhdx") returned 0x0 [0041.201] lstrlenW (lpString=".pst") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".pst") returned 0x0 [0041.201] lstrlenW (lpString=".ost") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".ost") returned 0x0 [0041.201] lstrlenW (lpString=".bak") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".bak") returned 0x0 [0041.201] lstrlenW (lpString=".bac") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".bac") returned 0x0 [0041.201] lstrlenW (lpString=".sys") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".sys") returned 0x0 [0041.201] lstrlenW (lpString=".v2i") returned 4 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch=".v2i") returned 0x0 [0041.201] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296430 | out: hHeap=0x260000) returned 1 [0041.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.201] RtlWakeConditionVariable () returned 0x27e828 [0041.201] GetCurrentThreadId () returned 0x98c [0041.201] GetCurrentThreadId () returned 0x98c [0041.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296398 | out: hHeap=0x260000) returned 1 [0041.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1220 | out: hHeap=0x260000) returned 1 [0041.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296398 [0041.202] lstrlenW (lpString=".ldf") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".ldf") returned 0x0 [0041.202] lstrlenW (lpString=".vhd") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".vhd") returned 0x0 [0041.202] lstrlenW (lpString=".vhdx") returned 5 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".vhdx") returned 0x0 [0041.202] lstrlenW (lpString=".pst") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".pst") returned 0x0 [0041.202] lstrlenW (lpString=".ost") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".ost") returned 0x0 [0041.202] lstrlenW (lpString=".bak") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".bak") returned 0x0 [0041.202] lstrlenW (lpString=".bac") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".bac") returned 0x0 [0041.202] lstrlenW (lpString=".sys") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".sys") returned 0x0 [0041.202] lstrlenW (lpString=".v2i") returned 4 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch=".v2i") returned 0x0 [0041.202] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296398 | out: hHeap=0x260000) returned 1 [0041.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.202] RtlWakeConditionVariable () returned 0x27e828 [0041.202] GetCurrentThreadId () returned 0x98c [0041.202] GetCurrentThreadId () returned 0x98c [0041.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296300 | out: hHeap=0x260000) returned 1 [0041.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11e8 | out: hHeap=0x260000) returned 1 [0041.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296300 [0041.203] lstrlenW (lpString=".ldf") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".ldf") returned 0x0 [0041.203] lstrlenW (lpString=".vhd") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".vhd") returned 0x0 [0041.203] lstrlenW (lpString=".vhdx") returned 5 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".vhdx") returned 0x0 [0041.203] lstrlenW (lpString=".pst") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".pst") returned 0x0 [0041.203] lstrlenW (lpString=".ost") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".ost") returned 0x0 [0041.203] lstrlenW (lpString=".bak") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".bak") returned 0x0 [0041.203] lstrlenW (lpString=".bac") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".bac") returned 0x0 [0041.203] lstrlenW (lpString=".sys") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".sys") returned 0x0 [0041.203] lstrlenW (lpString=".v2i") returned 4 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch=".v2i") returned 0x0 [0041.203] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", lpSrch="s\r\n.v2i") returned 0x0 [0041.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296300 | out: hHeap=0x260000) returned 1 [0041.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.204] RtlWakeConditionVariable () returned 0x27e828 [0041.204] GetCurrentThreadId () returned 0x98c [0041.204] GetCurrentThreadId () returned 0x98c [0041.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d610 | out: hHeap=0x260000) returned 1 [0041.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0041.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d610 [0041.204] lstrlenW (lpString=".ldf") returned 4 [0041.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.204] lstrlenW (lpString=".vhd") returned 4 [0041.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.204] lstrlenW (lpString=".vhdx") returned 5 [0041.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.204] lstrlenW (lpString=".pst") returned 4 [0041.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.204] lstrlenW (lpString=".ost") returned 4 [0041.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.204] lstrlenW (lpString=".bak") returned 4 [0041.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.204] lstrlenW (lpString=".bac") returned 4 [0041.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.205] lstrlenW (lpString=".sys") returned 4 [0041.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.205] lstrlenW (lpString=".v2i") returned 4 [0041.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.205] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d610 | out: hHeap=0x260000) returned 1 [0041.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.205] RtlWakeConditionVariable () returned 0x27e828 [0041.205] GetCurrentThreadId () returned 0x98c [0041.205] GetCurrentThreadId () returned 0x98c [0041.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3bb8 | out: hHeap=0x260000) returned 1 [0041.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1060 | out: hHeap=0x260000) returned 1 [0041.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0041.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.208] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.208] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.208] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.208] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.209] CloseHandle (hObject=0x100) returned 1 [0041.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3bb8 | out: hHeap=0x260000) returned 1 [0041.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.209] RtlWakeConditionVariable () returned 0x27e828 [0041.209] GetCurrentThreadId () returned 0x98c [0041.209] GetCurrentThreadId () returned 0x98c [0041.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296268 | out: hHeap=0x260000) returned 1 [0041.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1028 | out: hHeap=0x260000) returned 1 [0041.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.210] lstrlenW (lpString=".ldf") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".ldf") returned 0x0 [0041.210] lstrlenW (lpString=".vhd") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".vhd") returned 0x0 [0041.210] lstrlenW (lpString=".vhdx") returned 5 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".vhdx") returned 0x0 [0041.210] lstrlenW (lpString=".pst") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".pst") returned 0x0 [0041.210] lstrlenW (lpString=".ost") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".ost") returned 0x0 [0041.210] lstrlenW (lpString=".bak") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".bak") returned 0x0 [0041.210] lstrlenW (lpString=".bac") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".bac") returned 0x0 [0041.210] lstrlenW (lpString=".sys") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".sys") returned 0x0 [0041.210] lstrlenW (lpString=".v2i") returned 4 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch=".v2i") returned 0x0 [0041.210] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296268 | out: hHeap=0x260000) returned 1 [0041.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.210] RtlWakeConditionVariable () returned 0x27e828 [0041.210] GetCurrentThreadId () returned 0x98c [0041.210] GetCurrentThreadId () returned 0x98c [0041.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296138 | out: hHeap=0x260000) returned 1 [0041.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0041.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.211] lstrlenW (lpString=".ldf") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".ldf") returned 0x0 [0041.211] lstrlenW (lpString=".vhd") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".vhd") returned 0x0 [0041.211] lstrlenW (lpString=".vhdx") returned 5 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".vhdx") returned 0x0 [0041.211] lstrlenW (lpString=".pst") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".pst") returned 0x0 [0041.211] lstrlenW (lpString=".ost") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".ost") returned 0x0 [0041.211] lstrlenW (lpString=".bak") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".bak") returned 0x0 [0041.211] lstrlenW (lpString=".bac") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".bac") returned 0x0 [0041.211] lstrlenW (lpString=".sys") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".sys") returned 0x0 [0041.211] lstrlenW (lpString=".v2i") returned 4 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch=".v2i") returned 0x0 [0041.211] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296138 | out: hHeap=0x260000) returned 1 [0041.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.211] RtlWakeConditionVariable () returned 0x27e828 [0041.211] GetCurrentThreadId () returned 0x98c [0041.211] GetCurrentThreadId () returned 0x98c [0041.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa208 | out: hHeap=0x260000) returned 1 [0041.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".ldf") returned 0x0 [0041.212] lstrlenW (lpString=".vhd") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".vhd") returned 0x0 [0041.212] lstrlenW (lpString=".vhdx") returned 5 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".vhdx") returned 0x0 [0041.212] lstrlenW (lpString=".pst") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".pst") returned 0x0 [0041.212] lstrlenW (lpString=".ost") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".ost") returned 0x0 [0041.212] lstrlenW (lpString=".bak") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".bak") returned 0x0 [0041.212] lstrlenW (lpString=".bac") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".bac") returned 0x0 [0041.212] lstrlenW (lpString=".sys") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".sys") returned 0x0 [0041.212] lstrlenW (lpString=".v2i") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch=".v2i") returned 0x0 [0041.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.212] RtlWakeConditionVariable () returned 0x27e828 [0041.212] GetCurrentThreadId () returned 0x98c [0041.212] GetCurrentThreadId () returned 0x98c [0041.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".ldf") returned 0x0 [0041.212] lstrlenW (lpString=".vhd") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".vhd") returned 0x0 [0041.212] lstrlenW (lpString=".vhdx") returned 5 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".vhdx") returned 0x0 [0041.212] lstrlenW (lpString=".pst") returned 4 [0041.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".pst") returned 0x0 [0041.213] lstrlenW (lpString=".ost") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".ost") returned 0x0 [0041.213] lstrlenW (lpString=".bak") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".bak") returned 0x0 [0041.213] lstrlenW (lpString=".bac") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".bac") returned 0x0 [0041.213] lstrlenW (lpString=".sys") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".sys") returned 0x0 [0041.213] lstrlenW (lpString=".v2i") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch=".v2i") returned 0x0 [0041.213] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.213] RtlWakeConditionVariable () returned 0x27e828 [0041.213] GetCurrentThreadId () returned 0x98c [0041.213] GetCurrentThreadId () returned 0x98c [0041.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".ldf") returned 0x0 [0041.213] lstrlenW (lpString=".vhd") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".vhd") returned 0x0 [0041.213] lstrlenW (lpString=".vhdx") returned 5 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".vhdx") returned 0x0 [0041.213] lstrlenW (lpString=".pst") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".pst") returned 0x0 [0041.213] lstrlenW (lpString=".ost") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".ost") returned 0x0 [0041.213] lstrlenW (lpString=".bak") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".bak") returned 0x0 [0041.213] lstrlenW (lpString=".bac") returned 4 [0041.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".bac") returned 0x0 [0041.213] lstrlenW (lpString=".sys") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".sys") returned 0x0 [0041.214] lstrlenW (lpString=".v2i") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch=".v2i") returned 0x0 [0041.214] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.214] RtlWakeConditionVariable () returned 0x27e828 [0041.214] GetCurrentThreadId () returned 0x98c [0041.214] GetCurrentThreadId () returned 0x98c [0041.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".ldf") returned 0x0 [0041.214] lstrlenW (lpString=".vhd") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".vhd") returned 0x0 [0041.214] lstrlenW (lpString=".vhdx") returned 5 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".vhdx") returned 0x0 [0041.214] lstrlenW (lpString=".pst") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".pst") returned 0x0 [0041.214] lstrlenW (lpString=".ost") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".ost") returned 0x0 [0041.214] lstrlenW (lpString=".bak") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".bak") returned 0x0 [0041.214] lstrlenW (lpString=".bac") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".bac") returned 0x0 [0041.214] lstrlenW (lpString=".sys") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".sys") returned 0x0 [0041.214] lstrlenW (lpString=".v2i") returned 4 [0041.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch=".v2i") returned 0x0 [0041.214] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.215] RtlWakeConditionVariable () returned 0x27e828 [0041.215] GetCurrentThreadId () returned 0x98c [0041.215] GetCurrentThreadId () returned 0x98c [0041.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.215] lstrlenW (lpString=".vhd") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.215] lstrlenW (lpString=".vhdx") returned 5 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.215] lstrlenW (lpString=".pst") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.215] lstrlenW (lpString=".ost") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.215] lstrlenW (lpString=".bak") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.215] lstrlenW (lpString=".bac") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.215] lstrlenW (lpString=".sys") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.215] lstrlenW (lpString=".v2i") returned 4 [0041.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.216] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.216] RtlWakeConditionVariable () returned 0x27e828 [0041.216] GetCurrentThreadId () returned 0x98c [0041.216] GetCurrentThreadId () returned 0x98c [0041.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.216] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.216] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.216] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.216] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.217] CloseHandle (hObject=0x100) returned 1 [0041.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3c70 | out: hHeap=0x260000) returned 1 [0041.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.217] RtlWakeConditionVariable () returned 0x27e828 [0041.217] GetCurrentThreadId () returned 0x98c [0041.217] GetCurrentThreadId () returned 0x98c [0041.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dee0 | out: hHeap=0x260000) returned 1 [0041.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd50 | out: hHeap=0x260000) returned 1 [0041.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dee0 [0041.218] lstrlenW (lpString=".ldf") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.218] lstrlenW (lpString=".vhd") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.218] lstrlenW (lpString=".vhdx") returned 5 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.218] lstrlenW (lpString=".pst") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.218] lstrlenW (lpString=".ost") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.218] lstrlenW (lpString=".bak") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.218] lstrlenW (lpString=".bac") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.218] lstrlenW (lpString=".sys") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.218] lstrlenW (lpString=".v2i") returned 4 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.218] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dee0 | out: hHeap=0x260000) returned 1 [0041.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.218] RtlWakeConditionVariable () returned 0x27e828 [0041.218] GetCurrentThreadId () returned 0x98c [0041.218] GetCurrentThreadId () returned 0x98c [0041.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3d28 | out: hHeap=0x260000) returned 1 [0041.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd88 | out: hHeap=0x260000) returned 1 [0041.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3d28 [0041.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.219] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.219] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.219] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.219] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.220] CloseHandle (hObject=0x100) returned 1 [0041.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3d28 | out: hHeap=0x260000) returned 1 [0041.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.220] RtlWakeConditionVariable () returned 0x27e828 [0041.220] GetCurrentThreadId () returned 0x98c [0041.220] GetCurrentThreadId () returned 0x98c [0041.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d6b8 | out: hHeap=0x260000) returned 1 [0041.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1370 | out: hHeap=0x260000) returned 1 [0041.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d6b8 [0041.220] lstrlenW (lpString=".ldf") returned 4 [0041.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.220] lstrlenW (lpString=".vhd") returned 4 [0041.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.220] lstrlenW (lpString=".vhdx") returned 5 [0041.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.221] lstrlenW (lpString=".pst") returned 4 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.221] lstrlenW (lpString=".ost") returned 4 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.221] lstrlenW (lpString=".bak") returned 4 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.221] lstrlenW (lpString=".bac") returned 4 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.221] lstrlenW (lpString=".sys") returned 4 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.221] lstrlenW (lpString=".v2i") returned 4 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.221] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d6b8 | out: hHeap=0x260000) returned 1 [0041.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.247] RtlWakeConditionVariable () returned 0x27e828 [0041.247] GetCurrentThreadId () returned 0x98c [0041.247] GetCurrentThreadId () returned 0x98c [0041.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0041.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0041.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0041.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.248] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.248] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.248] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.248] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.249] CloseHandle (hObject=0x10c) returned 1 [0041.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0041.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.249] RtlWakeConditionVariable () returned 0x27e828 [0041.249] GetCurrentThreadId () returned 0x98c [0041.249] GetCurrentThreadId () returned 0x98c [0041.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3f50 | out: hHeap=0x260000) returned 1 [0041.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0041.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3f50 [0041.249] lstrlenW (lpString=".ldf") returned 4 [0041.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".ldf") returned 0x0 [0041.249] lstrlenW (lpString=".vhd") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".vhd") returned 0x0 [0041.250] lstrlenW (lpString=".vhdx") returned 5 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".vhdx") returned 0x0 [0041.250] lstrlenW (lpString=".pst") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".pst") returned 0x0 [0041.250] lstrlenW (lpString=".ost") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".ost") returned 0x0 [0041.250] lstrlenW (lpString=".bak") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".bak") returned 0x0 [0041.250] lstrlenW (lpString=".bac") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".bac") returned 0x0 [0041.250] lstrlenW (lpString=".sys") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".sys") returned 0x0 [0041.250] lstrlenW (lpString=".v2i") returned 4 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch=".v2i") returned 0x0 [0041.250] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3f50 | out: hHeap=0x260000) returned 1 [0041.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.362] RtlWakeConditionVariable () returned 0x27e828 [0041.362] GetCurrentThreadId () returned 0x98c [0041.362] GetCurrentThreadId () returned 0x98c [0041.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e768 | out: hHeap=0x260000) returned 1 [0041.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d0d0 | out: hHeap=0x260000) returned 1 [0041.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e768 [0041.362] lstrlenW (lpString=".ldf") returned 4 [0041.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".ldf") returned 0x0 [0041.362] lstrlenW (lpString=".vhd") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".vhd") returned 0x0 [0041.363] lstrlenW (lpString=".vhdx") returned 5 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".vhdx") returned 0x0 [0041.363] lstrlenW (lpString=".pst") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".pst") returned 0x0 [0041.363] lstrlenW (lpString=".ost") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".ost") returned 0x0 [0041.363] lstrlenW (lpString=".bak") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".bak") returned 0x0 [0041.363] lstrlenW (lpString=".bac") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".bac") returned 0x0 [0041.363] lstrlenW (lpString=".sys") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".sys") returned 0x0 [0041.363] lstrlenW (lpString=".v2i") returned 4 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".v2i") returned 0x0 [0041.363] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.433] lstrlenW (lpString=".sql") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".sql") returned 0x0 [0041.433] lstrlenW (lpString=".mdf") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".mdf") returned 0x0 [0041.433] lstrlenW (lpString=".txt") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".txt") returned 0x0 [0041.433] lstrlenW (lpString=".dbf") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".dbf") returned 0x0 [0041.433] lstrlenW (lpString=".ckp") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".ckp") returned 0x0 [0041.433] lstrlenW (lpString=".dacpac") returned 7 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".dacpac") returned 0x0 [0041.433] lstrlenW (lpString=".db3") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".db3") returned 0x0 [0041.433] lstrlenW (lpString=".dtxs") returned 5 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".dtxs") returned 0x0 [0041.433] lstrlenW (lpString=".mdt") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".mdt") returned 0x0 [0041.433] lstrlenW (lpString=".sdf") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".sdf") returned 0x0 [0041.433] lstrlenW (lpString=".MDF") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".MDF") returned 0x0 [0041.433] lstrlenW (lpString=".DBF") returned 4 [0041.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".DBF") returned 0x0 [0041.434] lstrlenW (lpString=".DB") returned 3 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".DB") returned 0x0 [0041.434] lstrlenW (lpString=".db") returned 3 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".db") returned 0x0 [0041.434] lstrlenW (lpString=".ndf") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".ndf") returned 0x0 [0041.434] lstrlenW (lpString=".NDF") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".NDF") returned 0x0 [0041.434] lstrlenW (lpString=".Mdf") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".Mdf") returned 0x0 [0041.434] lstrlenW (lpString=".dat") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".dat") returned 0x0 [0041.434] lstrlenW (lpString=".DAT") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".DAT") returned 0x0 [0041.434] lstrlenW (lpString=".ldf") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".ldf") returned 0x0 [0041.434] lstrlenW (lpString=".LDF") returned 4 [0041.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch=".LDF") returned 0x0 [0041.435] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.435] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0041.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.436] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.436] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16143694841) returned 1 [0041.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7836f90, dwHighDateTime=0x1d585b4)) [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d1e8 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1e8 | out: hHeap=0x260000) returned 1 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e570 [0041.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e570 | out: hHeap=0x260000) returned 1 [0041.436] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0041.437] GetLastError () returned 0x0 [0041.437] GetLastError () returned 0x0 [0041.437] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0041.437] GetLastError () returned 0x0 [0041.437] GetLastError () returned 0x0 [0041.437] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x224fdb0*=0xa388, lpOverlapped=0x0) returned 1 [0041.439] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff5c78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.439] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0xa388, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x224fdb0*=0xa388, lpOverlapped=0x0) returned 1 [0041.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.439] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.439] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.440] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.440] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.440] CloseHandle (hObject=0x10c) returned 1 [0041.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f5f8 [0041.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.481] GetLastError () returned 0x0 [0041.481] RtlWakeConditionVariable () returned 0x27e828 [0041.481] GetCurrentThreadId () returned 0x98c [0041.481] GetCurrentThreadId () returned 0x98c [0041.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa338 [0041.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa500 | out: hHeap=0x260000) returned 1 [0041.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0041.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa500 [0041.481] lstrlenW (lpString=".ldf") returned 4 [0041.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".ldf") returned 0x0 [0041.481] lstrlenW (lpString=".vhd") returned 4 [0041.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".vhd") returned 0x0 [0041.482] lstrlenW (lpString=".vhdx") returned 5 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".vhdx") returned 0x0 [0041.482] lstrlenW (lpString=".pst") returned 4 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".pst") returned 0x0 [0041.482] lstrlenW (lpString=".ost") returned 4 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".ost") returned 0x0 [0041.482] lstrlenW (lpString=".bak") returned 4 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".bak") returned 0x0 [0041.482] lstrlenW (lpString=".bac") returned 4 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".bac") returned 0x0 [0041.482] lstrlenW (lpString=".sys") returned 4 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".sys") returned 0x0 [0041.482] lstrlenW (lpString=".v2i") returned 4 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".v2i") returned 0x0 [0041.482] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.483] lstrlenW (lpString=".sql") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".sql") returned 0x0 [0041.483] lstrlenW (lpString=".mdf") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".mdf") returned 0x0 [0041.483] lstrlenW (lpString=".txt") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".txt") returned 0x0 [0041.483] lstrlenW (lpString=".dbf") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".dbf") returned 0x0 [0041.483] lstrlenW (lpString=".ckp") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".ckp") returned 0x0 [0041.483] lstrlenW (lpString=".dacpac") returned 7 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".dacpac") returned 0x0 [0041.483] lstrlenW (lpString=".db3") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".db3") returned 0x0 [0041.483] lstrlenW (lpString=".dtxs") returned 5 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".dtxs") returned 0x0 [0041.483] lstrlenW (lpString=".mdt") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".mdt") returned 0x0 [0041.483] lstrlenW (lpString=".sdf") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".sdf") returned 0x0 [0041.483] lstrlenW (lpString=".MDF") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".MDF") returned 0x0 [0041.483] lstrlenW (lpString=".DBF") returned 4 [0041.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".DBF") returned 0x0 [0041.483] lstrlenW (lpString=".DB") returned 3 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".DB") returned 0x0 [0041.484] lstrlenW (lpString=".db") returned 3 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".db") returned 0x0 [0041.484] lstrlenW (lpString=".ndf") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".ndf") returned 0x0 [0041.484] lstrlenW (lpString=".NDF") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".NDF") returned 0x0 [0041.484] lstrlenW (lpString=".Mdf") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".Mdf") returned 0x0 [0041.484] lstrlenW (lpString=".dat") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".dat") returned 0x0 [0041.484] lstrlenW (lpString=".DAT") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".DAT") returned 0x0 [0041.484] lstrlenW (lpString=".ldf") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".ldf") returned 0x0 [0041.484] lstrlenW (lpString=".LDF") returned 4 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch=".LDF") returned 0x0 [0041.484] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.485] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0041.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.486] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.487] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16148773708) returned 1 [0041.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa78a93b0, dwHighDateTime=0x1d585b4)) [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14f8 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa2a0 [0041.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.487] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0041.487] GetLastError () returned 0x0 [0041.487] GetLastError () returned 0x0 [0041.488] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0041.488] GetLastError () returned 0x0 [0041.488] GetLastError () returned 0x0 [0041.488] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.491] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.491] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.492] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.492] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.493] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.493] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.494] CloseHandle (hObject=0x10c) returned 1 [0041.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f5f8 [0041.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.495] GetLastError () returned 0x0 [0041.495] RtlWakeConditionVariable () returned 0x27e828 [0041.495] GetCurrentThreadId () returned 0x98c [0041.495] GetCurrentThreadId () returned 0x98c [0041.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa338 [0041.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa598 | out: hHeap=0x260000) returned 1 [0041.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0041.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa598 [0041.495] lstrlenW (lpString=".ldf") returned 4 [0041.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".ldf") returned 0x0 [0041.495] lstrlenW (lpString=".vhd") returned 4 [0041.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".vhd") returned 0x0 [0041.495] lstrlenW (lpString=".vhdx") returned 5 [0041.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".vhdx") returned 0x0 [0041.496] lstrlenW (lpString=".pst") returned 4 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".pst") returned 0x0 [0041.496] lstrlenW (lpString=".ost") returned 4 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".ost") returned 0x0 [0041.496] lstrlenW (lpString=".bak") returned 4 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".bak") returned 0x0 [0041.496] lstrlenW (lpString=".bac") returned 4 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".bac") returned 0x0 [0041.496] lstrlenW (lpString=".sys") returned 4 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".sys") returned 0x0 [0041.496] lstrlenW (lpString=".v2i") returned 4 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".v2i") returned 0x0 [0041.496] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.497] lstrlenW (lpString=".sql") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".sql") returned 0x0 [0041.497] lstrlenW (lpString=".mdf") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".mdf") returned 0x0 [0041.497] lstrlenW (lpString=".txt") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".txt") returned 0x0 [0041.497] lstrlenW (lpString=".dbf") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".dbf") returned 0x0 [0041.497] lstrlenW (lpString=".ckp") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".ckp") returned 0x0 [0041.497] lstrlenW (lpString=".dacpac") returned 7 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".dacpac") returned 0x0 [0041.497] lstrlenW (lpString=".db3") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".db3") returned 0x0 [0041.497] lstrlenW (lpString=".dtxs") returned 5 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".dtxs") returned 0x0 [0041.497] lstrlenW (lpString=".mdt") returned 4 [0041.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".mdt") returned 0x0 [0041.498] lstrlenW (lpString=".sdf") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".sdf") returned 0x0 [0041.498] lstrlenW (lpString=".MDF") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".MDF") returned 0x0 [0041.498] lstrlenW (lpString=".DBF") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".DBF") returned 0x0 [0041.498] lstrlenW (lpString=".DB") returned 3 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".DB") returned 0x0 [0041.498] lstrlenW (lpString=".db") returned 3 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".db") returned 0x0 [0041.498] lstrlenW (lpString=".ndf") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".ndf") returned 0x0 [0041.498] lstrlenW (lpString=".NDF") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".NDF") returned 0x0 [0041.498] lstrlenW (lpString=".Mdf") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".Mdf") returned 0x0 [0041.498] lstrlenW (lpString=".dat") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".dat") returned 0x0 [0041.498] lstrlenW (lpString=".DAT") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".DAT") returned 0x0 [0041.498] lstrlenW (lpString=".ldf") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".ldf") returned 0x0 [0041.498] lstrlenW (lpString=".LDF") returned 4 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch=".LDF") returned 0x0 [0041.498] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.499] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0041.499] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.500] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.500] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16150079943) returned 1 [0041.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa78cf510, dwHighDateTime=0x1d585b4)) [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa500 [0041.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.500] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0041.500] GetLastError () returned 0x0 [0041.501] GetLastError () returned 0x0 [0041.501] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0041.501] GetLastError () returned 0x0 [0041.501] GetLastError () returned 0x0 [0041.501] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.556] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.556] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.558] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.558] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.572] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.572] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.572] CloseHandle (hObject=0x10c) returned 1 [0041.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.891] GetLastError () returned 0x0 [0041.892] RtlWakeConditionVariable () returned 0x27e828 [0041.892] GetCurrentThreadId () returned 0x98c [0041.892] GetCurrentThreadId () returned 0x98c [0041.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312fb8 [0041.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3130e8 | out: hHeap=0x260000) returned 1 [0041.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6a0 | out: hHeap=0x260000) returned 1 [0041.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3130e8 [0041.892] lstrlenW (lpString=".ldf") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".ldf") returned 0x0 [0041.892] lstrlenW (lpString=".vhd") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".vhd") returned 0x0 [0041.892] lstrlenW (lpString=".vhdx") returned 5 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".vhdx") returned 0x0 [0041.892] lstrlenW (lpString=".pst") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".pst") returned 0x0 [0041.892] lstrlenW (lpString=".ost") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".ost") returned 0x0 [0041.892] lstrlenW (lpString=".bak") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".bak") returned 0x0 [0041.892] lstrlenW (lpString=".bac") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".bac") returned 0x0 [0041.892] lstrlenW (lpString=".sys") returned 4 [0041.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".sys") returned 0x0 [0041.892] lstrlenW (lpString=".v2i") returned 4 [0041.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".v2i") returned 0x0 [0041.893] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.893] lstrlenW (lpString=".sql") returned 4 [0041.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".sql") returned 0x0 [0041.893] lstrlenW (lpString=".mdf") returned 4 [0041.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".mdf") returned 0x0 [0041.893] lstrlenW (lpString=".txt") returned 4 [0041.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".txt") returned 0x0 [0041.893] lstrlenW (lpString=".dbf") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".dbf") returned 0x0 [0041.894] lstrlenW (lpString=".ckp") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".ckp") returned 0x0 [0041.894] lstrlenW (lpString=".dacpac") returned 7 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".dacpac") returned 0x0 [0041.894] lstrlenW (lpString=".db3") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".db3") returned 0x0 [0041.894] lstrlenW (lpString=".dtxs") returned 5 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".dtxs") returned 0x0 [0041.894] lstrlenW (lpString=".mdt") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".mdt") returned 0x0 [0041.894] lstrlenW (lpString=".sdf") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".sdf") returned 0x0 [0041.894] lstrlenW (lpString=".MDF") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".MDF") returned 0x0 [0041.894] lstrlenW (lpString=".DBF") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".DBF") returned 0x0 [0041.894] lstrlenW (lpString=".DB") returned 3 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".DB") returned 0x0 [0041.894] lstrlenW (lpString=".db") returned 3 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".db") returned 0x0 [0041.894] lstrlenW (lpString=".ndf") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".ndf") returned 0x0 [0041.894] lstrlenW (lpString=".NDF") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".NDF") returned 0x0 [0041.894] lstrlenW (lpString=".Mdf") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".Mdf") returned 0x0 [0041.894] lstrlenW (lpString=".dat") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".dat") returned 0x0 [0041.894] lstrlenW (lpString=".DAT") returned 4 [0041.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".DAT") returned 0x0 [0041.895] lstrlenW (lpString=".ldf") returned 4 [0041.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".ldf") returned 0x0 [0041.895] lstrlenW (lpString=".LDF") returned 4 [0041.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch=".LDF") returned 0x0 [0041.895] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.895] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0041.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.896] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.896] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16189680249) returned 1 [0041.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7c87770, dwHighDateTime=0x1d585b4)) [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6a0 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6a0 | out: hHeap=0x260000) returned 1 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312b90 [0041.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.896] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0041.896] GetLastError () returned 0x0 [0041.896] GetLastError () returned 0x0 [0041.896] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0041.897] GetLastError () returned 0x0 [0041.897] GetLastError () returned 0x0 [0041.897] ReadFile (in: hFile=0x108, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.902] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.902] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0041.903] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.903] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.905] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.905] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.905] CloseHandle (hObject=0x108) returned 1 [0041.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.907] GetLastError () returned 0x0 [0041.907] RtlWakeConditionVariable () returned 0x27e828 [0041.907] GetCurrentThreadId () returned 0x98c [0041.907] GetCurrentThreadId () returned 0x98c [0041.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eea0 | out: hHeap=0x260000) returned 1 [0041.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6d8 | out: hHeap=0x260000) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eea0 [0041.907] lstrlenW (lpString=".ldf") returned 4 [0041.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".ldf") returned 0x0 [0041.907] lstrlenW (lpString=".vhd") returned 4 [0041.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".vhd") returned 0x0 [0041.907] lstrlenW (lpString=".vhdx") returned 5 [0041.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".vhdx") returned 0x0 [0041.907] lstrlenW (lpString=".pst") returned 4 [0041.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".pst") returned 0x0 [0041.907] lstrlenW (lpString=".ost") returned 4 [0041.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".ost") returned 0x0 [0041.907] lstrlenW (lpString=".bak") returned 4 [0041.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".bak") returned 0x0 [0041.908] lstrlenW (lpString=".bac") returned 4 [0041.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".bac") returned 0x0 [0041.908] lstrlenW (lpString=".sys") returned 4 [0041.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".sys") returned 0x0 [0041.908] lstrlenW (lpString=".v2i") returned 4 [0041.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".v2i") returned 0x0 [0041.908] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0041.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.909] lstrlenW (lpString=".sql") returned 4 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".sql") returned 0x0 [0041.909] lstrlenW (lpString=".mdf") returned 4 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".mdf") returned 0x0 [0041.909] lstrlenW (lpString=".txt") returned 4 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".txt") returned 0x0 [0041.909] lstrlenW (lpString=".dbf") returned 4 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".dbf") returned 0x0 [0041.909] lstrlenW (lpString=".ckp") returned 4 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".ckp") returned 0x0 [0041.909] lstrlenW (lpString=".dacpac") returned 7 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".dacpac") returned 0x0 [0041.909] lstrlenW (lpString=".db3") returned 4 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".db3") returned 0x0 [0041.909] lstrlenW (lpString=".dtxs") returned 5 [0041.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".dtxs") returned 0x0 [0041.910] lstrlenW (lpString=".mdt") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".mdt") returned 0x0 [0041.910] lstrlenW (lpString=".sdf") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".sdf") returned 0x0 [0041.910] lstrlenW (lpString=".MDF") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".MDF") returned 0x0 [0041.910] lstrlenW (lpString=".DBF") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".DBF") returned 0x0 [0041.910] lstrlenW (lpString=".DB") returned 3 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".DB") returned 0x0 [0041.910] lstrlenW (lpString=".db") returned 3 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".db") returned 0x0 [0041.910] lstrlenW (lpString=".ndf") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".ndf") returned 0x0 [0041.910] lstrlenW (lpString=".NDF") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".NDF") returned 0x0 [0041.910] lstrlenW (lpString=".Mdf") returned 4 [0041.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".Mdf") returned 0x0 [0041.910] lstrlenW (lpString=".dat") returned 4 [0041.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".dat") returned 0x0 [0041.911] lstrlenW (lpString=".DAT") returned 4 [0041.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".DAT") returned 0x0 [0041.911] lstrlenW (lpString=".ldf") returned 4 [0041.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".ldf") returned 0x0 [0041.911] lstrlenW (lpString=".LDF") returned 4 [0041.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch=".LDF") returned 0x0 [0041.911] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.911] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0041.912] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.912] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.912] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16191327888) returned 1 [0041.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7cad8d0, dwHighDateTime=0x1d585b4)) [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6d8 [0041.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6d8 | out: hHeap=0x260000) returned 1 [0041.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0041.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312fb8 [0041.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0041.913] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0041.913] GetLastError () returned 0x0 [0041.913] GetLastError () returned 0x0 [0041.913] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0041.913] GetLastError () returned 0x0 [0041.913] GetLastError () returned 0x0 [0041.913] ReadFile (in: hFile=0x108, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.917] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.917] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0041.917] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.918] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.919] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.919] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.919] CloseHandle (hObject=0x108) returned 1 [0041.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.178] GetLastError () returned 0x0 [0042.178] RtlWakeConditionVariable () returned 0x27e828 [0042.178] GetCurrentThreadId () returned 0x98c [0042.178] GetCurrentThreadId () returned 0x98c [0042.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee518 [0042.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee6e8 | out: hHeap=0x260000) returned 1 [0042.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998a0 | out: hHeap=0x260000) returned 1 [0042.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee6e8 [0042.178] lstrlenW (lpString=".ldf") returned 4 [0042.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".ldf") returned 0x0 [0042.178] lstrlenW (lpString=".vhd") returned 4 [0042.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".vhd") returned 0x0 [0042.178] lstrlenW (lpString=".vhdx") returned 5 [0042.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".vhdx") returned 0x0 [0042.179] lstrlenW (lpString=".pst") returned 4 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".pst") returned 0x0 [0042.179] lstrlenW (lpString=".ost") returned 4 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".ost") returned 0x0 [0042.179] lstrlenW (lpString=".bak") returned 4 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".bak") returned 0x0 [0042.179] lstrlenW (lpString=".bac") returned 4 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".bac") returned 0x0 [0042.179] lstrlenW (lpString=".sys") returned 4 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".sys") returned 0x0 [0042.179] lstrlenW (lpString=".v2i") returned 4 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".v2i") returned 0x0 [0042.179] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0042.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.203] lstrlenW (lpString=".sql") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".sql") returned 0x0 [0042.203] lstrlenW (lpString=".mdf") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".mdf") returned 0x0 [0042.203] lstrlenW (lpString=".txt") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".txt") returned 0x0 [0042.203] lstrlenW (lpString=".dbf") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".dbf") returned 0x0 [0042.203] lstrlenW (lpString=".ckp") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".ckp") returned 0x0 [0042.203] lstrlenW (lpString=".dacpac") returned 7 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".dacpac") returned 0x0 [0042.203] lstrlenW (lpString=".db3") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".db3") returned 0x0 [0042.203] lstrlenW (lpString=".dtxs") returned 5 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".dtxs") returned 0x0 [0042.203] lstrlenW (lpString=".mdt") returned 4 [0042.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".mdt") returned 0x0 [0042.203] lstrlenW (lpString=".sdf") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".sdf") returned 0x0 [0042.204] lstrlenW (lpString=".MDF") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".MDF") returned 0x0 [0042.204] lstrlenW (lpString=".DBF") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".DBF") returned 0x0 [0042.204] lstrlenW (lpString=".DB") returned 3 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".DB") returned 0x0 [0042.204] lstrlenW (lpString=".db") returned 3 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".db") returned 0x0 [0042.204] lstrlenW (lpString=".ndf") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".ndf") returned 0x0 [0042.204] lstrlenW (lpString=".NDF") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".NDF") returned 0x0 [0042.204] lstrlenW (lpString=".Mdf") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".Mdf") returned 0x0 [0042.204] lstrlenW (lpString=".dat") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".dat") returned 0x0 [0042.204] lstrlenW (lpString=".DAT") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".DAT") returned 0x0 [0042.204] lstrlenW (lpString=".ldf") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".ldf") returned 0x0 [0042.204] lstrlenW (lpString=".LDF") returned 4 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch=".LDF") returned 0x0 [0042.204] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.204] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0042.205] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.205] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.205] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16220644253) returned 1 [0042.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7f812f0, dwHighDateTime=0x1d585b4)) [0042.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f01c0 [0042.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01c0 | out: hHeap=0x260000) returned 1 [0042.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.206] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.206] GetLastError () returned 0x0 [0042.206] GetLastError () returned 0x0 [0042.206] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.206] GetLastError () returned 0x0 [0042.206] GetLastError () returned 0x0 [0042.207] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x11644, lpOverlapped=0x0) returned 1 [0042.210] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffee9bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.210] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x11644, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x11644, lpOverlapped=0x0) returned 1 [0042.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.210] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.210] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.210] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.210] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.210] CloseHandle (hObject=0x104) returned 1 [0042.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.[deadmin@cock.li].deadmin")) returned 1 [0042.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.211] GetLastError () returned 0x0 [0042.211] RtlWakeConditionVariable () returned 0x27e828 [0042.211] GetCurrentThreadId () returned 0x98c [0042.211] GetCurrentThreadId () returned 0x98c [0042.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee518 [0042.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee8b8 | out: hHeap=0x260000) returned 1 [0042.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0042.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee8b8 [0042.212] lstrlenW (lpString=".ldf") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".ldf") returned 0x0 [0042.212] lstrlenW (lpString=".vhd") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".vhd") returned 0x0 [0042.212] lstrlenW (lpString=".vhdx") returned 5 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".vhdx") returned 0x0 [0042.212] lstrlenW (lpString=".pst") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".pst") returned 0x0 [0042.212] lstrlenW (lpString=".ost") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".ost") returned 0x0 [0042.212] lstrlenW (lpString=".bak") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".bak") returned 0x0 [0042.212] lstrlenW (lpString=".bac") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".bac") returned 0x0 [0042.212] lstrlenW (lpString=".sys") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".sys") returned 0x0 [0042.212] lstrlenW (lpString=".v2i") returned 4 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".v2i") returned 0x0 [0042.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.213] lstrlenW (lpString=".sql") returned 4 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".sql") returned 0x0 [0042.213] lstrlenW (lpString=".mdf") returned 4 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".mdf") returned 0x0 [0042.213] lstrlenW (lpString=".txt") returned 4 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".txt") returned 0x0 [0042.213] lstrlenW (lpString=".dbf") returned 4 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".dbf") returned 0x0 [0042.213] lstrlenW (lpString=".ckp") returned 4 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".ckp") returned 0x0 [0042.213] lstrlenW (lpString=".dacpac") returned 7 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".dacpac") returned 0x0 [0042.213] lstrlenW (lpString=".db3") returned 4 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".db3") returned 0x0 [0042.213] lstrlenW (lpString=".dtxs") returned 5 [0042.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".dtxs") returned 0x0 [0042.213] lstrlenW (lpString=".mdt") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".mdt") returned 0x0 [0042.214] lstrlenW (lpString=".sdf") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".sdf") returned 0x0 [0042.214] lstrlenW (lpString=".MDF") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".MDF") returned 0x0 [0042.214] lstrlenW (lpString=".DBF") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".DBF") returned 0x0 [0042.214] lstrlenW (lpString=".DB") returned 3 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".DB") returned 0x0 [0042.214] lstrlenW (lpString=".db") returned 3 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".db") returned 0x0 [0042.214] lstrlenW (lpString=".ndf") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".ndf") returned 0x0 [0042.214] lstrlenW (lpString=".NDF") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".NDF") returned 0x0 [0042.214] lstrlenW (lpString=".Mdf") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".Mdf") returned 0x0 [0042.214] lstrlenW (lpString=".dat") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".dat") returned 0x0 [0042.214] lstrlenW (lpString=".DAT") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".DAT") returned 0x0 [0042.214] lstrlenW (lpString=".ldf") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".ldf") returned 0x0 [0042.214] lstrlenW (lpString=".LDF") returned 4 [0042.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch=".LDF") returned 0x0 [0042.214] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.215] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0042.215] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.216] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.216] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16221683863) returned 1 [0042.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7fa7450, dwHighDateTime=0x1d585b4)) [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299948 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.216] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.216] GetLastError () returned 0x0 [0042.217] GetLastError () returned 0x0 [0042.217] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.217] GetLastError () returned 0x0 [0042.217] GetLastError () returned 0x0 [0042.217] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.220] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.220] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.220] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.220] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.220] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.220] CloseHandle (hObject=0x104) returned 1 [0042.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.221] GetLastError () returned 0x0 [0042.221] RtlWakeConditionVariable () returned 0x27e828 [0042.221] GetCurrentThreadId () returned 0x98c [0042.221] GetCurrentThreadId () returned 0x98c [0042.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee518 [0042.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee9a0 | out: hHeap=0x260000) returned 1 [0042.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0042.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee9a0 [0042.221] lstrlenW (lpString=".ldf") returned 4 [0042.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".ldf") returned 0x0 [0042.221] lstrlenW (lpString=".vhd") returned 4 [0042.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".vhd") returned 0x0 [0042.221] lstrlenW (lpString=".vhdx") returned 5 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".vhdx") returned 0x0 [0042.222] lstrlenW (lpString=".pst") returned 4 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".pst") returned 0x0 [0042.222] lstrlenW (lpString=".ost") returned 4 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".ost") returned 0x0 [0042.222] lstrlenW (lpString=".bak") returned 4 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".bak") returned 0x0 [0042.222] lstrlenW (lpString=".bac") returned 4 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".bac") returned 0x0 [0042.222] lstrlenW (lpString=".sys") returned 4 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".sys") returned 0x0 [0042.222] lstrlenW (lpString=".v2i") returned 4 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".v2i") returned 0x0 [0042.222] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch="s\r\n.v2i") returned 0x0 [0042.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.223] lstrlenW (lpString=".sql") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".sql") returned 0x0 [0042.223] lstrlenW (lpString=".mdf") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".mdf") returned 0x0 [0042.223] lstrlenW (lpString=".txt") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".txt") returned 0x0 [0042.223] lstrlenW (lpString=".dbf") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".dbf") returned 0x0 [0042.223] lstrlenW (lpString=".ckp") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".ckp") returned 0x0 [0042.223] lstrlenW (lpString=".dacpac") returned 7 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".dacpac") returned 0x0 [0042.223] lstrlenW (lpString=".db3") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".db3") returned 0x0 [0042.223] lstrlenW (lpString=".dtxs") returned 5 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".dtxs") returned 0x0 [0042.223] lstrlenW (lpString=".mdt") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".mdt") returned 0x0 [0042.223] lstrlenW (lpString=".sdf") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".sdf") returned 0x0 [0042.223] lstrlenW (lpString=".MDF") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".MDF") returned 0x0 [0042.223] lstrlenW (lpString=".DBF") returned 4 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".DBF") returned 0x0 [0042.223] lstrlenW (lpString=".DB") returned 3 [0042.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".DB") returned 0x0 [0042.224] lstrlenW (lpString=".db") returned 3 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".db") returned 0x0 [0042.224] lstrlenW (lpString=".ndf") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".ndf") returned 0x0 [0042.224] lstrlenW (lpString=".NDF") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".NDF") returned 0x0 [0042.224] lstrlenW (lpString=".Mdf") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".Mdf") returned 0x0 [0042.224] lstrlenW (lpString=".dat") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".dat") returned 0x0 [0042.224] lstrlenW (lpString=".DAT") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".DAT") returned 0x0 [0042.224] lstrlenW (lpString=".ldf") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".ldf") returned 0x0 [0042.224] lstrlenW (lpString=".LDF") returned 4 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch=".LDF") returned 0x0 [0042.224] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.224] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0042.225] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.225] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.225] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16222620909) returned 1 [0042.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7fa7450, dwHighDateTime=0x1d585b4)) [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997f8 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.226] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.226] GetLastError () returned 0x0 [0042.226] GetLastError () returned 0x0 [0042.226] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.226] GetLastError () returned 0x0 [0042.226] GetLastError () returned 0x0 [0042.226] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x3d90, lpOverlapped=0x0) returned 1 [0042.227] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.228] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x3d90, lpOverlapped=0x0) returned 1 [0042.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.228] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.228] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.228] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.228] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.228] CloseHandle (hObject=0x104) returned 1 [0042.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2b3fe0 [0042.228] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.229] GetLastError () returned 0x0 [0042.229] RtlWakeConditionVariable () returned 0x27e828 [0042.229] GetCurrentThreadId () returned 0x98c [0042.229] GetCurrentThreadId () returned 0x98c [0042.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee518 [0042.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eea88 | out: hHeap=0x260000) returned 1 [0042.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0042.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eea88 [0042.229] lstrlenW (lpString=".ldf") returned 4 [0042.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".ldf") returned 0x0 [0042.229] lstrlenW (lpString=".vhd") returned 4 [0042.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".vhd") returned 0x0 [0042.229] lstrlenW (lpString=".vhdx") returned 5 [0042.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".vhdx") returned 0x0 [0042.229] lstrlenW (lpString=".pst") returned 4 [0042.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".pst") returned 0x0 [0042.229] lstrlenW (lpString=".ost") returned 4 [0042.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".ost") returned 0x0 [0042.229] lstrlenW (lpString=".bak") returned 4 [0042.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".bak") returned 0x0 [0042.229] lstrlenW (lpString=".bac") returned 4 [0042.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".bac") returned 0x0 [0042.230] lstrlenW (lpString=".sys") returned 4 [0042.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".sys") returned 0x0 [0042.230] lstrlenW (lpString=".v2i") returned 4 [0042.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".v2i") returned 0x0 [0042.230] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0042.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.230] lstrlenW (lpString=".sql") returned 4 [0042.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".sql") returned 0x0 [0042.231] lstrlenW (lpString=".mdf") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".mdf") returned 0x0 [0042.231] lstrlenW (lpString=".txt") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".txt") returned 0x0 [0042.231] lstrlenW (lpString=".dbf") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".dbf") returned 0x0 [0042.231] lstrlenW (lpString=".ckp") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".ckp") returned 0x0 [0042.231] lstrlenW (lpString=".dacpac") returned 7 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".dacpac") returned 0x0 [0042.231] lstrlenW (lpString=".db3") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".db3") returned 0x0 [0042.231] lstrlenW (lpString=".dtxs") returned 5 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".dtxs") returned 0x0 [0042.231] lstrlenW (lpString=".mdt") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".mdt") returned 0x0 [0042.231] lstrlenW (lpString=".sdf") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".sdf") returned 0x0 [0042.231] lstrlenW (lpString=".MDF") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".MDF") returned 0x0 [0042.231] lstrlenW (lpString=".DBF") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".DBF") returned 0x0 [0042.231] lstrlenW (lpString=".DB") returned 3 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".DB") returned 0x0 [0042.231] lstrlenW (lpString=".db") returned 3 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".db") returned 0x0 [0042.231] lstrlenW (lpString=".ndf") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".ndf") returned 0x0 [0042.231] lstrlenW (lpString=".NDF") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".NDF") returned 0x0 [0042.231] lstrlenW (lpString=".Mdf") returned 4 [0042.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".Mdf") returned 0x0 [0042.232] lstrlenW (lpString=".dat") returned 4 [0042.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".dat") returned 0x0 [0042.232] lstrlenW (lpString=".DAT") returned 4 [0042.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".DAT") returned 0x0 [0042.232] lstrlenW (lpString=".ldf") returned 4 [0042.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".ldf") returned 0x0 [0042.232] lstrlenW (lpString=".LDF") returned 4 [0042.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch=".LDF") returned 0x0 [0042.232] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.232] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2b3f18) returned 1 [0042.233] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.233] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.233] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16223392285) returned 1 [0042.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa7fcd5b0, dwHighDateTime=0x1d585b4)) [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.233] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.233] GetLastError () returned 0x0 [0042.234] GetLastError () returned 0x0 [0042.234] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.234] GetLastError () returned 0x0 [0042.234] GetLastError () returned 0x0 [0042.234] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x9339, lpOverlapped=0x0) returned 1 [0042.343] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff6cc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.343] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x9339, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x9339, lpOverlapped=0x0) returned 1 [0042.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.344] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.344] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.344] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.344] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.344] CloseHandle (hObject=0x104) returned 1 [0042.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.345] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.[deadmin@cock.li].deadmin")) returned 1 [0042.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.345] GetLastError () returned 0x0 [0042.345] RtlWakeConditionVariable () returned 0x27e828 [0042.345] GetCurrentThreadId () returned 0x98c [0042.345] GetCurrentThreadId () returned 0x98c [0042.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bb0 | out: hHeap=0x260000) returned 1 [0042.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0042.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.460] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.460] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.460] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.460] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.461] CloseHandle (hObject=0x100) returned 1 [0042.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.461] RtlWakeConditionVariable () returned 0x27e828 [0042.461] GetCurrentThreadId () returned 0x98c [0042.461] GetCurrentThreadId () returned 0x98c [0042.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f7a8 | out: hHeap=0x260000) returned 1 [0042.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f90 | out: hHeap=0x260000) returned 1 [0042.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0042.461] lstrlenW (lpString=".ldf") returned 4 [0042.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.461] lstrlenW (lpString=".vhd") returned 4 [0042.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.461] lstrlenW (lpString=".vhdx") returned 5 [0042.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.461] lstrlenW (lpString=".pst") returned 4 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.462] lstrlenW (lpString=".ost") returned 4 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.462] lstrlenW (lpString=".bak") returned 4 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.462] lstrlenW (lpString=".bac") returned 4 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.462] lstrlenW (lpString=".sys") returned 4 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.462] lstrlenW (lpString=".v2i") returned 4 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.462] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.477] lstrlenW (lpString=".sql") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.477] lstrlenW (lpString=".mdf") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.477] lstrlenW (lpString=".txt") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.477] lstrlenW (lpString=".dbf") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.477] lstrlenW (lpString=".ckp") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.477] lstrlenW (lpString=".dacpac") returned 7 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.477] lstrlenW (lpString=".db3") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.477] lstrlenW (lpString=".dtxs") returned 5 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.477] lstrlenW (lpString=".mdt") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.477] lstrlenW (lpString=".sdf") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.477] lstrlenW (lpString=".MDF") returned 4 [0042.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.477] lstrlenW (lpString=".DBF") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.478] lstrlenW (lpString=".DB") returned 3 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.478] lstrlenW (lpString=".db") returned 3 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.478] lstrlenW (lpString=".ndf") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.478] lstrlenW (lpString=".NDF") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.478] lstrlenW (lpString=".Mdf") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.478] lstrlenW (lpString=".dat") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.478] lstrlenW (lpString=".DAT") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.478] lstrlenW (lpString=".ldf") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.478] lstrlenW (lpString=".LDF") returned 4 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.478] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.478] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.479] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.480] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.480] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16248079246) returned 1 [0042.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa822ebb0, dwHighDateTime=0x1d585b4)) [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295118 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.480] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.480] GetLastError () returned 0x0 [0042.480] GetLastError () returned 0x0 [0042.480] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.481] GetLastError () returned 0x0 [0042.481] GetLastError () returned 0x0 [0042.481] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x224fdb0*=0x412b, lpOverlapped=0x0) returned 1 [0042.483] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffbed5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.483] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x224fdb0*=0x412b, lpOverlapped=0x0) returned 1 [0042.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.483] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.484] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.484] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.484] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.484] CloseHandle (hObject=0x100) returned 1 [0042.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.486] GetLastError () returned 0x0 [0042.486] RtlWakeConditionVariable () returned 0x27e828 [0042.486] GetCurrentThreadId () returned 0x98c [0042.486] GetCurrentThreadId () returned 0x98c [0042.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef2b0 [0042.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef650 | out: hHeap=0x260000) returned 1 [0042.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950e0 | out: hHeap=0x260000) returned 1 [0042.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef650 [0042.486] lstrlenW (lpString=".ldf") returned 4 [0042.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.486] lstrlenW (lpString=".vhd") returned 4 [0042.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.486] lstrlenW (lpString=".vhdx") returned 5 [0042.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.486] lstrlenW (lpString=".pst") returned 4 [0042.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.486] lstrlenW (lpString=".ost") returned 4 [0042.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.486] lstrlenW (lpString=".bak") returned 4 [0042.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.487] lstrlenW (lpString=".bac") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.487] lstrlenW (lpString=".sys") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.487] lstrlenW (lpString=".v2i") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.487] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.487] lstrlenW (lpString=".sql") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.487] lstrlenW (lpString=".mdf") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.487] lstrlenW (lpString=".txt") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.487] lstrlenW (lpString=".dbf") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.487] lstrlenW (lpString=".ckp") returned 4 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.487] lstrlenW (lpString=".dacpac") returned 7 [0042.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.487] lstrlenW (lpString=".db3") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.488] lstrlenW (lpString=".dtxs") returned 5 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.488] lstrlenW (lpString=".mdt") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.488] lstrlenW (lpString=".sdf") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.488] lstrlenW (lpString=".MDF") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.488] lstrlenW (lpString=".DBF") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.488] lstrlenW (lpString=".DB") returned 3 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.488] lstrlenW (lpString=".db") returned 3 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.488] lstrlenW (lpString=".ndf") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.488] lstrlenW (lpString=".NDF") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.488] lstrlenW (lpString=".Mdf") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.488] lstrlenW (lpString=".dat") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.488] lstrlenW (lpString=".DAT") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.488] lstrlenW (lpString=".ldf") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.488] lstrlenW (lpString=".LDF") returned 4 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.488] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.489] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.489] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.489] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16249062703) returned 1 [0042.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa822ebb0, dwHighDateTime=0x1d585b4)) [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2950e0 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950e0 | out: hHeap=0x260000) returned 1 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.490] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.490] GetLastError () returned 0x0 [0042.490] GetLastError () returned 0x0 [0042.490] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.490] GetLastError () returned 0x0 [0042.490] GetLastError () returned 0x0 [0042.491] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x224fdb0*=0x750, lpOverlapped=0x0) returned 1 [0042.492] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff8b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.492] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x224fdb0*=0x750, lpOverlapped=0x0) returned 1 [0042.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.492] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.492] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.492] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.493] CloseHandle (hObject=0x100) returned 1 [0042.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x298fd0 [0042.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.493] GetLastError () returned 0x0 [0042.493] RtlWakeConditionVariable () returned 0x27e828 [0042.493] GetCurrentThreadId () returned 0x98c [0042.493] GetCurrentThreadId () returned 0x98c [0042.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295898 | out: hHeap=0x260000) returned 1 [0042.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950a8 | out: hHeap=0x260000) returned 1 [0042.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.495] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.495] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.496] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.496] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.497] CloseHandle (hObject=0x100) returned 1 [0042.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.497] RtlWakeConditionVariable () returned 0x27e828 [0042.497] GetCurrentThreadId () returned 0x98c [0042.497] GetCurrentThreadId () returned 0x98c [0042.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f880 | out: hHeap=0x260000) returned 1 [0042.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0042.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f880 [0042.497] lstrlenW (lpString=".ldf") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".ldf") returned 0x0 [0042.497] lstrlenW (lpString=".vhd") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".vhd") returned 0x0 [0042.497] lstrlenW (lpString=".vhdx") returned 5 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".vhdx") returned 0x0 [0042.497] lstrlenW (lpString=".pst") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".pst") returned 0x0 [0042.497] lstrlenW (lpString=".ost") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".ost") returned 0x0 [0042.497] lstrlenW (lpString=".bak") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".bak") returned 0x0 [0042.497] lstrlenW (lpString=".bac") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".bac") returned 0x0 [0042.497] lstrlenW (lpString=".sys") returned 4 [0042.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".sys") returned 0x0 [0042.497] lstrlenW (lpString=".v2i") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".v2i") returned 0x0 [0042.498] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.498] lstrlenW (lpString=".sql") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".sql") returned 0x0 [0042.498] lstrlenW (lpString=".mdf") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".mdf") returned 0x0 [0042.498] lstrlenW (lpString=".txt") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".txt") returned 0x0 [0042.498] lstrlenW (lpString=".dbf") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".dbf") returned 0x0 [0042.498] lstrlenW (lpString=".ckp") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".ckp") returned 0x0 [0042.498] lstrlenW (lpString=".dacpac") returned 7 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".dacpac") returned 0x0 [0042.498] lstrlenW (lpString=".db3") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".db3") returned 0x0 [0042.498] lstrlenW (lpString=".dtxs") returned 5 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".dtxs") returned 0x0 [0042.498] lstrlenW (lpString=".mdt") returned 4 [0042.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".mdt") returned 0x0 [0042.499] lstrlenW (lpString=".sdf") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".sdf") returned 0x0 [0042.499] lstrlenW (lpString=".MDF") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".MDF") returned 0x0 [0042.499] lstrlenW (lpString=".DBF") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".DBF") returned 0x0 [0042.499] lstrlenW (lpString=".DB") returned 3 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".DB") returned 0x0 [0042.499] lstrlenW (lpString=".db") returned 3 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".db") returned 0x0 [0042.499] lstrlenW (lpString=".ndf") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".ndf") returned 0x0 [0042.499] lstrlenW (lpString=".NDF") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".NDF") returned 0x0 [0042.499] lstrlenW (lpString=".Mdf") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".Mdf") returned 0x0 [0042.499] lstrlenW (lpString=".dat") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".dat") returned 0x0 [0042.499] lstrlenW (lpString=".DAT") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".DAT") returned 0x0 [0042.499] lstrlenW (lpString=".ldf") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".ldf") returned 0x0 [0042.499] lstrlenW (lpString=".LDF") returned 4 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch=".LDF") returned 0x0 [0042.499] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.499] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.500] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.500] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16250157312) returned 1 [0042.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8254d10, dwHighDateTime=0x1d585b4)) [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951f8 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.501] GetLastError () returned 0x0 [0042.501] GetLastError () returned 0x0 [0042.501] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.501] GetLastError () returned 0x0 [0042.501] GetLastError () returned 0x0 [0042.502] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x224fdb0*=0x543, lpOverlapped=0x0) returned 1 [0042.503] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.503] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x224fdb0*=0x543, lpOverlapped=0x0) returned 1 [0042.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.504] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.504] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.504] CloseHandle (hObject=0x100) returned 1 [0042.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x295888 [0042.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295888 | out: hHeap=0x260000) returned 1 [0042.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.505] GetLastError () returned 0x0 [0042.505] RtlWakeConditionVariable () returned 0x27e828 [0042.505] GetCurrentThreadId () returned 0x98c [0042.505] GetCurrentThreadId () returned 0x98c [0042.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x295888 [0042.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295790 | out: hHeap=0x260000) returned 1 [0042.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951c0 | out: hHeap=0x260000) returned 1 [0042.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3e10 [0042.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.506] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.506] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.506] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.506] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.507] CloseHandle (hObject=0x100) returned 1 [0042.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295888 | out: hHeap=0x260000) returned 1 [0042.507] RtlWakeConditionVariable () returned 0x27e828 [0042.507] GetCurrentThreadId () returned 0x98c [0042.507] GetCurrentThreadId () returned 0x98c [0042.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fa30 | out: hHeap=0x260000) returned 1 [0042.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295230 | out: hHeap=0x260000) returned 1 [0042.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fa30 [0042.507] lstrlenW (lpString=".ldf") returned 4 [0042.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".ldf") returned 0x0 [0042.507] lstrlenW (lpString=".vhd") returned 4 [0042.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".vhd") returned 0x0 [0042.508] lstrlenW (lpString=".vhdx") returned 5 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".vhdx") returned 0x0 [0042.508] lstrlenW (lpString=".pst") returned 4 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".pst") returned 0x0 [0042.508] lstrlenW (lpString=".ost") returned 4 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".ost") returned 0x0 [0042.508] lstrlenW (lpString=".bak") returned 4 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".bak") returned 0x0 [0042.508] lstrlenW (lpString=".bac") returned 4 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".bac") returned 0x0 [0042.508] lstrlenW (lpString=".sys") returned 4 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".sys") returned 0x0 [0042.508] lstrlenW (lpString=".v2i") returned 4 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".v2i") returned 0x0 [0042.508] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.588] lstrlenW (lpString=".sql") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".sql") returned 0x0 [0042.588] lstrlenW (lpString=".mdf") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".mdf") returned 0x0 [0042.588] lstrlenW (lpString=".txt") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".txt") returned 0x0 [0042.588] lstrlenW (lpString=".dbf") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".dbf") returned 0x0 [0042.588] lstrlenW (lpString=".ckp") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".ckp") returned 0x0 [0042.588] lstrlenW (lpString=".dacpac") returned 7 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".dacpac") returned 0x0 [0042.588] lstrlenW (lpString=".db3") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".db3") returned 0x0 [0042.588] lstrlenW (lpString=".dtxs") returned 5 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".dtxs") returned 0x0 [0042.588] lstrlenW (lpString=".mdt") returned 4 [0042.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".mdt") returned 0x0 [0042.589] lstrlenW (lpString=".sdf") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".sdf") returned 0x0 [0042.589] lstrlenW (lpString=".MDF") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".MDF") returned 0x0 [0042.589] lstrlenW (lpString=".DBF") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".DBF") returned 0x0 [0042.589] lstrlenW (lpString=".DB") returned 3 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".DB") returned 0x0 [0042.589] lstrlenW (lpString=".db") returned 3 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".db") returned 0x0 [0042.589] lstrlenW (lpString=".ndf") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".ndf") returned 0x0 [0042.589] lstrlenW (lpString=".NDF") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".NDF") returned 0x0 [0042.589] lstrlenW (lpString=".Mdf") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".Mdf") returned 0x0 [0042.589] lstrlenW (lpString=".dat") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".dat") returned 0x0 [0042.589] lstrlenW (lpString=".DAT") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".DAT") returned 0x0 [0042.589] lstrlenW (lpString=".ldf") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".ldf") returned 0x0 [0042.589] lstrlenW (lpString=".LDF") returned 4 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch=".LDF") returned 0x0 [0042.589] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.589] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.590] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.590] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.590] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16259145112) returned 1 [0042.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8339550, dwHighDateTime=0x1d585b4)) [0042.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295268 [0042.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295268 | out: hHeap=0x260000) returned 1 [0042.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.591] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.591] GetLastError () returned 0x0 [0042.591] GetLastError () returned 0x0 [0042.591] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.591] GetLastError () returned 0x0 [0042.591] GetLastError () returned 0x0 [0042.592] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x5b1, lpOverlapped=0x0) returned 1 [0042.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffa4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.595] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x5b1, lpOverlapped=0x0) returned 1 [0042.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.595] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.595] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.595] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.595] CloseHandle (hObject=0x10c) returned 1 [0042.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x298fd0 [0042.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.596] GetLastError () returned 0x0 [0042.596] RtlWakeConditionVariable () returned 0x27e828 [0042.596] GetCurrentThreadId () returned 0x98c [0042.596] GetCurrentThreadId () returned 0x98c [0042.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5960 | out: hHeap=0x260000) returned 1 [0042.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0042.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.598] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.598] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.598] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.598] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.599] CloseHandle (hObject=0x10c) returned 1 [0042.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.599] RtlWakeConditionVariable () returned 0x27e828 [0042.599] GetCurrentThreadId () returned 0x98c [0042.599] GetCurrentThreadId () returned 0x98c [0042.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0042.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0042.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0042.599] lstrlenW (lpString=".ldf") returned 4 [0042.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".ldf") returned 0x0 [0042.599] lstrlenW (lpString=".vhd") returned 4 [0042.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".vhd") returned 0x0 [0042.599] lstrlenW (lpString=".vhdx") returned 5 [0042.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".vhdx") returned 0x0 [0042.599] lstrlenW (lpString=".pst") returned 4 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".pst") returned 0x0 [0042.600] lstrlenW (lpString=".ost") returned 4 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".ost") returned 0x0 [0042.600] lstrlenW (lpString=".bak") returned 4 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".bak") returned 0x0 [0042.600] lstrlenW (lpString=".bac") returned 4 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".bac") returned 0x0 [0042.600] lstrlenW (lpString=".sys") returned 4 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".sys") returned 0x0 [0042.600] lstrlenW (lpString=".v2i") returned 4 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".v2i") returned 0x0 [0042.600] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch="s\r\n.v2i") returned 0x0 [0042.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.601] lstrlenW (lpString=".sql") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".sql") returned 0x0 [0042.601] lstrlenW (lpString=".mdf") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".mdf") returned 0x0 [0042.601] lstrlenW (lpString=".txt") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".txt") returned 0x0 [0042.601] lstrlenW (lpString=".dbf") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".dbf") returned 0x0 [0042.601] lstrlenW (lpString=".ckp") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".ckp") returned 0x0 [0042.601] lstrlenW (lpString=".dacpac") returned 7 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".dacpac") returned 0x0 [0042.601] lstrlenW (lpString=".db3") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".db3") returned 0x0 [0042.601] lstrlenW (lpString=".dtxs") returned 5 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".dtxs") returned 0x0 [0042.601] lstrlenW (lpString=".mdt") returned 4 [0042.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".mdt") returned 0x0 [0042.601] lstrlenW (lpString=".sdf") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".sdf") returned 0x0 [0042.602] lstrlenW (lpString=".MDF") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".MDF") returned 0x0 [0042.602] lstrlenW (lpString=".DBF") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".DBF") returned 0x0 [0042.602] lstrlenW (lpString=".DB") returned 3 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".DB") returned 0x0 [0042.602] lstrlenW (lpString=".db") returned 3 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".db") returned 0x0 [0042.602] lstrlenW (lpString=".ndf") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".ndf") returned 0x0 [0042.602] lstrlenW (lpString=".NDF") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".NDF") returned 0x0 [0042.602] lstrlenW (lpString=".Mdf") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".Mdf") returned 0x0 [0042.602] lstrlenW (lpString=".dat") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".dat") returned 0x0 [0042.602] lstrlenW (lpString=".DAT") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".DAT") returned 0x0 [0042.602] lstrlenW (lpString=".ldf") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".ldf") returned 0x0 [0042.602] lstrlenW (lpString=".LDF") returned 4 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch=".LDF") returned 0x0 [0042.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5950 [0042.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.602] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.603] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.603] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16260447611) returned 1 [0042.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8339550, dwHighDateTime=0x1d585b4)) [0042.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e08 [0042.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0042.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.604] GetLastError () returned 0x0 [0042.604] GetLastError () returned 0x0 [0042.604] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] GetLastError () returned 0x0 [0042.604] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.607] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.608] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.608] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.609] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.609] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.610] CloseHandle (hObject=0x10c) returned 1 [0042.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0042.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.610] GetLastError () returned 0x0 [0042.610] RtlWakeConditionVariable () returned 0x27e828 [0042.610] GetCurrentThreadId () returned 0x98c [0042.610] GetCurrentThreadId () returned 0x98c [0042.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef908 [0042.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efad8 | out: hHeap=0x260000) returned 1 [0042.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0042.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2efad8 [0042.611] lstrlenW (lpString=".ldf") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.611] lstrlenW (lpString=".vhd") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.611] lstrlenW (lpString=".vhdx") returned 5 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.611] lstrlenW (lpString=".pst") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.611] lstrlenW (lpString=".ost") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.611] lstrlenW (lpString=".bak") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.611] lstrlenW (lpString=".bac") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.611] lstrlenW (lpString=".sys") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.611] lstrlenW (lpString=".v2i") returned 4 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.611] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.613] lstrlenW (lpString=".sql") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.613] lstrlenW (lpString=".mdf") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.613] lstrlenW (lpString=".txt") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.613] lstrlenW (lpString=".dbf") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.613] lstrlenW (lpString=".ckp") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.613] lstrlenW (lpString=".dacpac") returned 7 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.613] lstrlenW (lpString=".db3") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.613] lstrlenW (lpString=".dtxs") returned 5 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.613] lstrlenW (lpString=".mdt") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.613] lstrlenW (lpString=".sdf") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.613] lstrlenW (lpString=".MDF") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.613] lstrlenW (lpString=".DBF") returned 4 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.613] lstrlenW (lpString=".DB") returned 3 [0042.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.614] lstrlenW (lpString=".db") returned 3 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.614] lstrlenW (lpString=".ndf") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.614] lstrlenW (lpString=".NDF") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.614] lstrlenW (lpString=".Mdf") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.614] lstrlenW (lpString=".dat") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.614] lstrlenW (lpString=".DAT") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.614] lstrlenW (lpString=".ldf") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.614] lstrlenW (lpString=".LDF") returned 4 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.614] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5950 [0042.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.614] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.615] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.615] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16261620107) returned 1 [0042.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa835f6b0, dwHighDateTime=0x1d585b4)) [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295498 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.616] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.616] GetLastError () returned 0x0 [0042.616] GetLastError () returned 0x0 [0042.616] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] GetLastError () returned 0x0 [0042.616] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x1861, lpOverlapped=0x0) returned 1 [0042.617] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe79f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.618] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1861, lpOverlapped=0x0) returned 1 [0042.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.618] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.618] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.618] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.618] CloseHandle (hObject=0x10c) returned 1 [0042.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.619] GetLastError () returned 0x0 [0042.619] RtlWakeConditionVariable () returned 0x27e828 [0042.619] GetCurrentThreadId () returned 0x98c [0042.619] GetCurrentThreadId () returned 0x98c [0042.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef908 [0042.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efbc0 | out: hHeap=0x260000) returned 1 [0042.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0042.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2efbc0 [0042.619] lstrlenW (lpString=".ldf") returned 4 [0042.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".ldf") returned 0x0 [0042.620] lstrlenW (lpString=".vhd") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".vhd") returned 0x0 [0042.620] lstrlenW (lpString=".vhdx") returned 5 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.620] lstrlenW (lpString=".pst") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".pst") returned 0x0 [0042.620] lstrlenW (lpString=".ost") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".ost") returned 0x0 [0042.620] lstrlenW (lpString=".bak") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".bak") returned 0x0 [0042.620] lstrlenW (lpString=".bac") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".bac") returned 0x0 [0042.620] lstrlenW (lpString=".sys") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".sys") returned 0x0 [0042.620] lstrlenW (lpString=".v2i") returned 4 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".v2i") returned 0x0 [0042.620] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.621] lstrlenW (lpString=".sql") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".sql") returned 0x0 [0042.621] lstrlenW (lpString=".mdf") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".mdf") returned 0x0 [0042.621] lstrlenW (lpString=".txt") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".txt") returned 0x0 [0042.621] lstrlenW (lpString=".dbf") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".dbf") returned 0x0 [0042.621] lstrlenW (lpString=".ckp") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".ckp") returned 0x0 [0042.621] lstrlenW (lpString=".dacpac") returned 7 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.621] lstrlenW (lpString=".db3") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".db3") returned 0x0 [0042.621] lstrlenW (lpString=".dtxs") returned 5 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.621] lstrlenW (lpString=".mdt") returned 4 [0042.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".mdt") returned 0x0 [0042.621] lstrlenW (lpString=".sdf") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".sdf") returned 0x0 [0042.622] lstrlenW (lpString=".MDF") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".MDF") returned 0x0 [0042.622] lstrlenW (lpString=".DBF") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".DBF") returned 0x0 [0042.622] lstrlenW (lpString=".DB") returned 3 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".DB") returned 0x0 [0042.622] lstrlenW (lpString=".db") returned 3 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".db") returned 0x0 [0042.622] lstrlenW (lpString=".ndf") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".ndf") returned 0x0 [0042.622] lstrlenW (lpString=".NDF") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".NDF") returned 0x0 [0042.622] lstrlenW (lpString=".Mdf") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.622] lstrlenW (lpString=".dat") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".dat") returned 0x0 [0042.622] lstrlenW (lpString=".DAT") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".DAT") returned 0x0 [0042.622] lstrlenW (lpString=".ldf") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".ldf") returned 0x0 [0042.622] lstrlenW (lpString=".LDF") returned 4 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch=".LDF") returned 0x0 [0042.622] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5950 [0042.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.622] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.623] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.623] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.623] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16262441992) returned 1 [0042.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8385810, dwHighDateTime=0x1d585b4)) [0042.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295460 [0042.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0042.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.624] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.624] GetLastError () returned 0x0 [0042.624] GetLastError () returned 0x0 [0042.624] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.624] GetLastError () returned 0x0 [0042.624] GetLastError () returned 0x0 [0042.624] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x251f, lpOverlapped=0x0) returned 1 [0042.640] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdae1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.640] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x251f, lpOverlapped=0x0) returned 1 [0042.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.640] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.640] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.640] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.641] CloseHandle (hObject=0x10c) returned 1 [0042.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x298fd0 [0042.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.776] GetLastError () returned 0x0 [0042.776] RtlWakeConditionVariable () returned 0x27e828 [0042.776] GetCurrentThreadId () returned 0x98c [0042.776] GetCurrentThreadId () returned 0x98c [0042.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297ac0 | out: hHeap=0x260000) returned 1 [0042.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0042.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.776] lstrlenW (lpString=".ldf") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".ldf") returned 0x0 [0042.776] lstrlenW (lpString=".vhd") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".vhd") returned 0x0 [0042.776] lstrlenW (lpString=".vhdx") returned 5 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".vhdx") returned 0x0 [0042.776] lstrlenW (lpString=".pst") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".pst") returned 0x0 [0042.776] lstrlenW (lpString=".ost") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".ost") returned 0x0 [0042.776] lstrlenW (lpString=".bak") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".bak") returned 0x0 [0042.776] lstrlenW (lpString=".bac") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".bac") returned 0x0 [0042.776] lstrlenW (lpString=".sys") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".sys") returned 0x0 [0042.776] lstrlenW (lpString=".v2i") returned 4 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".v2i") returned 0x0 [0042.776] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.777] lstrlenW (lpString=".sql") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".sql") returned 0x0 [0042.777] lstrlenW (lpString=".mdf") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".mdf") returned 0x0 [0042.777] lstrlenW (lpString=".txt") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".txt") returned 0x0 [0042.777] lstrlenW (lpString=".dbf") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".dbf") returned 0x0 [0042.777] lstrlenW (lpString=".ckp") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".ckp") returned 0x0 [0042.777] lstrlenW (lpString=".dacpac") returned 7 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".dacpac") returned 0x0 [0042.777] lstrlenW (lpString=".db3") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".db3") returned 0x0 [0042.777] lstrlenW (lpString=".dtxs") returned 5 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".dtxs") returned 0x0 [0042.777] lstrlenW (lpString=".mdt") returned 4 [0042.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".mdt") returned 0x0 [0042.777] lstrlenW (lpString=".sdf") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".sdf") returned 0x0 [0042.778] lstrlenW (lpString=".MDF") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".MDF") returned 0x0 [0042.778] lstrlenW (lpString=".DBF") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".DBF") returned 0x0 [0042.778] lstrlenW (lpString=".DB") returned 3 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".DB") returned 0x0 [0042.778] lstrlenW (lpString=".db") returned 3 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".db") returned 0x0 [0042.778] lstrlenW (lpString=".ndf") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".ndf") returned 0x0 [0042.778] lstrlenW (lpString=".NDF") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".NDF") returned 0x0 [0042.778] lstrlenW (lpString=".Mdf") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".Mdf") returned 0x0 [0042.778] lstrlenW (lpString=".dat") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".dat") returned 0x0 [0042.778] lstrlenW (lpString=".DAT") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".DAT") returned 0x0 [0042.778] lstrlenW (lpString=".ldf") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".ldf") returned 0x0 [0042.778] lstrlenW (lpString=".LDF") returned 4 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch=".LDF") returned 0x0 [0042.778] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.778] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0042.779] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.779] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0042.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.779] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16278041687) returned 1 [0042.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa85025d0, dwHighDateTime=0x1d585b4)) [0042.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b48 [0042.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0042.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0042.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0042.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0042.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.780] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.780] GetLastError () returned 0x0 [0042.780] GetLastError () returned 0x0 [0042.780] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.780] GetLastError () returned 0x0 [0042.780] GetLastError () returned 0x0 [0042.780] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.783] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.783] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.784] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.784] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.784] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.784] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.784] CloseHandle (hObject=0x10c) returned 1 [0042.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.785] GetLastError () returned 0x0 [0042.785] RtlWakeConditionVariable () returned 0x27e828 [0042.785] GetCurrentThreadId () returned 0x98c [0042.785] GetCurrentThreadId () returned 0x98c [0042.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297a28 | out: hHeap=0x260000) returned 1 [0042.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0042.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.785] lstrlenW (lpString=".ldf") returned 4 [0042.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".ldf") returned 0x0 [0042.785] lstrlenW (lpString=".vhd") returned 4 [0042.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".vhd") returned 0x0 [0042.785] lstrlenW (lpString=".vhdx") returned 5 [0042.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".vhdx") returned 0x0 [0042.785] lstrlenW (lpString=".pst") returned 4 [0042.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".pst") returned 0x0 [0042.785] lstrlenW (lpString=".ost") returned 4 [0042.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".ost") returned 0x0 [0042.786] lstrlenW (lpString=".bak") returned 4 [0042.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".bak") returned 0x0 [0042.786] lstrlenW (lpString=".bac") returned 4 [0042.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".bac") returned 0x0 [0042.786] lstrlenW (lpString=".sys") returned 4 [0042.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".sys") returned 0x0 [0042.786] lstrlenW (lpString=".v2i") returned 4 [0042.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".v2i") returned 0x0 [0042.786] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.787] lstrlenW (lpString=".sql") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".sql") returned 0x0 [0042.787] lstrlenW (lpString=".mdf") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".mdf") returned 0x0 [0042.787] lstrlenW (lpString=".txt") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".txt") returned 0x0 [0042.787] lstrlenW (lpString=".dbf") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".dbf") returned 0x0 [0042.787] lstrlenW (lpString=".ckp") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".ckp") returned 0x0 [0042.787] lstrlenW (lpString=".dacpac") returned 7 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".dacpac") returned 0x0 [0042.787] lstrlenW (lpString=".db3") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".db3") returned 0x0 [0042.787] lstrlenW (lpString=".dtxs") returned 5 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".dtxs") returned 0x0 [0042.787] lstrlenW (lpString=".mdt") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".mdt") returned 0x0 [0042.787] lstrlenW (lpString=".sdf") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".sdf") returned 0x0 [0042.787] lstrlenW (lpString=".MDF") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".MDF") returned 0x0 [0042.787] lstrlenW (lpString=".DBF") returned 4 [0042.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".DBF") returned 0x0 [0042.787] lstrlenW (lpString=".DB") returned 3 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".DB") returned 0x0 [0042.788] lstrlenW (lpString=".db") returned 3 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".db") returned 0x0 [0042.788] lstrlenW (lpString=".ndf") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".ndf") returned 0x0 [0042.788] lstrlenW (lpString=".NDF") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".NDF") returned 0x0 [0042.788] lstrlenW (lpString=".Mdf") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".Mdf") returned 0x0 [0042.788] lstrlenW (lpString=".dat") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".dat") returned 0x0 [0042.788] lstrlenW (lpString=".DAT") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".DAT") returned 0x0 [0042.788] lstrlenW (lpString=".ldf") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".ldf") returned 0x0 [0042.788] lstrlenW (lpString=".LDF") returned 4 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch=".LDF") returned 0x0 [0042.788] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.788] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0042.789] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.789] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0042.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.789] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16279019750) returned 1 [0042.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa85025d0, dwHighDateTime=0x1d585b4)) [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0042.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0042.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.790] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.790] GetLastError () returned 0x0 [0042.790] GetLastError () returned 0x0 [0042.790] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.790] GetLastError () returned 0x0 [0042.790] GetLastError () returned 0x0 [0042.790] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.816] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.816] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.817] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.817] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.844] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.844] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.844] CloseHandle (hObject=0x10c) returned 1 [0042.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.845] GetLastError () returned 0x0 [0042.845] RtlWakeConditionVariable () returned 0x27e828 [0042.845] GetCurrentThreadId () returned 0x98c [0042.845] GetCurrentThreadId () returned 0x98c [0042.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0042.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1918 | out: hHeap=0x260000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0042.845] lstrlenW (lpString=".ldf") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".ldf") returned 0x0 [0042.845] lstrlenW (lpString=".vhd") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".vhd") returned 0x0 [0042.845] lstrlenW (lpString=".vhdx") returned 5 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".vhdx") returned 0x0 [0042.845] lstrlenW (lpString=".pst") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".pst") returned 0x0 [0042.845] lstrlenW (lpString=".ost") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".ost") returned 0x0 [0042.845] lstrlenW (lpString=".bak") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".bak") returned 0x0 [0042.845] lstrlenW (lpString=".bac") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".bac") returned 0x0 [0042.845] lstrlenW (lpString=".sys") returned 4 [0042.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".sys") returned 0x0 [0042.845] lstrlenW (lpString=".v2i") returned 4 [0042.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".v2i") returned 0x0 [0042.846] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.856] lstrlenW (lpString=".sql") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".sql") returned 0x0 [0042.856] lstrlenW (lpString=".mdf") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".mdf") returned 0x0 [0042.856] lstrlenW (lpString=".txt") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".txt") returned 0x0 [0042.856] lstrlenW (lpString=".dbf") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".dbf") returned 0x0 [0042.856] lstrlenW (lpString=".ckp") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".ckp") returned 0x0 [0042.856] lstrlenW (lpString=".dacpac") returned 7 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".dacpac") returned 0x0 [0042.856] lstrlenW (lpString=".db3") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".db3") returned 0x0 [0042.856] lstrlenW (lpString=".dtxs") returned 5 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".dtxs") returned 0x0 [0042.856] lstrlenW (lpString=".mdt") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".mdt") returned 0x0 [0042.856] lstrlenW (lpString=".sdf") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".sdf") returned 0x0 [0042.856] lstrlenW (lpString=".MDF") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".MDF") returned 0x0 [0042.856] lstrlenW (lpString=".DBF") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".DBF") returned 0x0 [0042.856] lstrlenW (lpString=".DB") returned 3 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".DB") returned 0x0 [0042.856] lstrlenW (lpString=".db") returned 3 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".db") returned 0x0 [0042.856] lstrlenW (lpString=".ndf") returned 4 [0042.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".ndf") returned 0x0 [0042.857] lstrlenW (lpString=".NDF") returned 4 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".NDF") returned 0x0 [0042.857] lstrlenW (lpString=".Mdf") returned 4 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".Mdf") returned 0x0 [0042.857] lstrlenW (lpString=".dat") returned 4 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".dat") returned 0x0 [0042.857] lstrlenW (lpString=".DAT") returned 4 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".DAT") returned 0x0 [0042.857] lstrlenW (lpString=".ldf") returned 4 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".ldf") returned 0x0 [0042.857] lstrlenW (lpString=".LDF") returned 4 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch=".LDF") returned 0x0 [0042.857] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0042.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.857] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0042.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.858] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.858] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16285927129) returned 1 [0042.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa85c0cb0, dwHighDateTime=0x1d585b4)) [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294fc8 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0042.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0042.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0042.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0042.859] GetLastError () returned 0x0 [0042.859] GetLastError () returned 0x0 [0042.859] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0042.859] GetLastError () returned 0x0 [0042.859] GetLastError () returned 0x0 [0042.860] ReadFile (in: hFile=0x10c, lpBuffer=0x277d270, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277d270*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.874] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.874] WriteFile (in: hFile=0x10c, lpBuffer=0x277d270*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277d270*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277d270 | out: hHeap=0x260000) returned 1 [0042.876] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.876] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.085] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.085] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.085] CloseHandle (hObject=0x10c) returned 1 [0043.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0043.085] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0043.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.086] GetLastError () returned 0x0 [0043.086] RtlWakeConditionVariable () returned 0x27e828 [0043.086] GetCurrentThreadId () returned 0x98c [0043.086] GetCurrentThreadId () returned 0x98c [0043.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0043.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2970a8 | out: hHeap=0x260000) returned 1 [0043.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0043.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2970a8 [0043.086] lstrlenW (lpString=".ldf") returned 4 [0043.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".ldf") returned 0x0 [0043.086] lstrlenW (lpString=".vhd") returned 4 [0043.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".vhd") returned 0x0 [0043.087] lstrlenW (lpString=".vhdx") returned 5 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".vhdx") returned 0x0 [0043.087] lstrlenW (lpString=".pst") returned 4 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".pst") returned 0x0 [0043.087] lstrlenW (lpString=".ost") returned 4 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".ost") returned 0x0 [0043.087] lstrlenW (lpString=".bak") returned 4 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".bak") returned 0x0 [0043.087] lstrlenW (lpString=".bac") returned 4 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".bac") returned 0x0 [0043.087] lstrlenW (lpString=".sys") returned 4 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".sys") returned 0x0 [0043.087] lstrlenW (lpString=".v2i") returned 4 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".v2i") returned 0x0 [0043.087] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0043.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0043.088] lstrlenW (lpString=".sql") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".sql") returned 0x0 [0043.088] lstrlenW (lpString=".mdf") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".mdf") returned 0x0 [0043.088] lstrlenW (lpString=".txt") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".txt") returned 0x0 [0043.088] lstrlenW (lpString=".dbf") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".dbf") returned 0x0 [0043.088] lstrlenW (lpString=".ckp") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".ckp") returned 0x0 [0043.088] lstrlenW (lpString=".dacpac") returned 7 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".dacpac") returned 0x0 [0043.088] lstrlenW (lpString=".db3") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".db3") returned 0x0 [0043.088] lstrlenW (lpString=".dtxs") returned 5 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".dtxs") returned 0x0 [0043.088] lstrlenW (lpString=".mdt") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".mdt") returned 0x0 [0043.088] lstrlenW (lpString=".sdf") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".sdf") returned 0x0 [0043.088] lstrlenW (lpString=".MDF") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".MDF") returned 0x0 [0043.088] lstrlenW (lpString=".DBF") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".DBF") returned 0x0 [0043.088] lstrlenW (lpString=".DB") returned 3 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".DB") returned 0x0 [0043.088] lstrlenW (lpString=".db") returned 3 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".db") returned 0x0 [0043.088] lstrlenW (lpString=".ndf") returned 4 [0043.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".ndf") returned 0x0 [0043.089] lstrlenW (lpString=".NDF") returned 4 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".NDF") returned 0x0 [0043.089] lstrlenW (lpString=".Mdf") returned 4 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".Mdf") returned 0x0 [0043.089] lstrlenW (lpString=".dat") returned 4 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".dat") returned 0x0 [0043.089] lstrlenW (lpString=".DAT") returned 4 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".DAT") returned 0x0 [0043.089] lstrlenW (lpString=".ldf") returned 4 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".ldf") returned 0x0 [0043.089] lstrlenW (lpString=".LDF") returned 4 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch=".LDF") returned 0x0 [0043.089] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.089] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0043.090] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.090] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.090] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16309115869) returned 1 [0043.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa87fc150, dwHighDateTime=0x1d585b4)) [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949f8 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.091] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.091] GetLastError () returned 0x0 [0043.091] GetLastError () returned 0x0 [0043.091] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.091] GetLastError () returned 0x0 [0043.091] GetLastError () returned 0x0 [0043.091] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.093] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.093] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.094] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.094] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.095] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.095] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.095] CloseHandle (hObject=0x10c) returned 1 [0043.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0043.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.[deadmin@cock.li].deadmin")) returned 1 [0043.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0043.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.098] GetLastError () returned 0x0 [0043.098] RtlWakeConditionVariable () returned 0x27e828 [0043.098] GetCurrentThreadId () returned 0x98c [0043.098] GetCurrentThreadId () returned 0x98c [0043.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0043.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296db0 | out: hHeap=0x260000) returned 1 [0043.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294950 | out: hHeap=0x260000) returned 1 [0043.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296db0 [0043.098] lstrlenW (lpString=".ldf") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".ldf") returned 0x0 [0043.098] lstrlenW (lpString=".vhd") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".vhd") returned 0x0 [0043.098] lstrlenW (lpString=".vhdx") returned 5 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".vhdx") returned 0x0 [0043.098] lstrlenW (lpString=".pst") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".pst") returned 0x0 [0043.098] lstrlenW (lpString=".ost") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".ost") returned 0x0 [0043.098] lstrlenW (lpString=".bak") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".bak") returned 0x0 [0043.098] lstrlenW (lpString=".bac") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".bac") returned 0x0 [0043.098] lstrlenW (lpString=".sys") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".sys") returned 0x0 [0043.098] lstrlenW (lpString=".v2i") returned 4 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".v2i") returned 0x0 [0043.098] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0043.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0043.100] lstrlenW (lpString=".sql") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".sql") returned 0x0 [0043.100] lstrlenW (lpString=".mdf") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".mdf") returned 0x0 [0043.100] lstrlenW (lpString=".txt") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".txt") returned 0x0 [0043.100] lstrlenW (lpString=".dbf") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".dbf") returned 0x0 [0043.100] lstrlenW (lpString=".ckp") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".ckp") returned 0x0 [0043.100] lstrlenW (lpString=".dacpac") returned 7 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".dacpac") returned 0x0 [0043.100] lstrlenW (lpString=".db3") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".db3") returned 0x0 [0043.100] lstrlenW (lpString=".dtxs") returned 5 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".dtxs") returned 0x0 [0043.100] lstrlenW (lpString=".mdt") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".mdt") returned 0x0 [0043.100] lstrlenW (lpString=".sdf") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".sdf") returned 0x0 [0043.100] lstrlenW (lpString=".MDF") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".MDF") returned 0x0 [0043.100] lstrlenW (lpString=".DBF") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".DBF") returned 0x0 [0043.100] lstrlenW (lpString=".DB") returned 3 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".DB") returned 0x0 [0043.100] lstrlenW (lpString=".db") returned 3 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".db") returned 0x0 [0043.100] lstrlenW (lpString=".ndf") returned 4 [0043.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".ndf") returned 0x0 [0043.100] lstrlenW (lpString=".NDF") returned 4 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".NDF") returned 0x0 [0043.101] lstrlenW (lpString=".Mdf") returned 4 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".Mdf") returned 0x0 [0043.101] lstrlenW (lpString=".dat") returned 4 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".dat") returned 0x0 [0043.101] lstrlenW (lpString=".DAT") returned 4 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".DAT") returned 0x0 [0043.101] lstrlenW (lpString=".ldf") returned 4 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".ldf") returned 0x0 [0043.101] lstrlenW (lpString=".LDF") returned 4 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch=".LDF") returned 0x0 [0043.101] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.101] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0043.102] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.102] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.102] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16310307463) returned 1 [0043.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa87fc150, dwHighDateTime=0x1d585b4)) [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294950 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294950 | out: hHeap=0x260000) returned 1 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2970a8 [0043.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.102] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.103] GetLastError () returned 0x0 [0043.103] GetLastError () returned 0x0 [0043.103] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.103] GetLastError () returned 0x0 [0043.103] GetLastError () returned 0x0 [0043.103] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.105] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.105] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.106] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.106] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.107] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.107] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.107] CloseHandle (hObject=0x10c) returned 1 [0043.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0043.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.[deadmin@cock.li].deadmin")) returned 1 [0043.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0043.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.108] GetLastError () returned 0x0 [0043.108] RtlWakeConditionVariable () returned 0x27e828 [0043.108] GetCurrentThreadId () returned 0x98c [0043.108] GetCurrentThreadId () returned 0x98c [0043.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f21d8 | out: hHeap=0x260000) returned 1 [0043.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294918 | out: hHeap=0x260000) returned 1 [0043.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f21d8 [0043.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0043.109] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.109] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.109] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.109] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.110] CloseHandle (hObject=0x10c) returned 1 [0043.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f21d8 | out: hHeap=0x260000) returned 1 [0043.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0043.110] RtlWakeConditionVariable () returned 0x27e828 [0043.110] GetCurrentThreadId () returned 0x98c [0043.110] GetCurrentThreadId () returned 0x98c [0043.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0043.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0043.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8258 | out: hHeap=0x260000) returned 1 [0043.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0043.110] lstrlenW (lpString=".ldf") returned 4 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".ldf") returned 0x0 [0043.110] lstrlenW (lpString=".vhd") returned 4 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".vhd") returned 0x0 [0043.110] lstrlenW (lpString=".vhdx") returned 5 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".vhdx") returned 0x0 [0043.110] lstrlenW (lpString=".pst") returned 4 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".pst") returned 0x0 [0043.110] lstrlenW (lpString=".ost") returned 4 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".ost") returned 0x0 [0043.110] lstrlenW (lpString=".bak") returned 4 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".bak") returned 0x0 [0043.110] lstrlenW (lpString=".bac") returned 4 [0043.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".bac") returned 0x0 [0043.110] lstrlenW (lpString=".sys") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".sys") returned 0x0 [0043.111] lstrlenW (lpString=".v2i") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".v2i") returned 0x0 [0043.111] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch="s\r\n.v2i") returned 0x0 [0043.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0043.111] lstrlenW (lpString=".sql") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".sql") returned 0x0 [0043.111] lstrlenW (lpString=".mdf") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".mdf") returned 0x0 [0043.111] lstrlenW (lpString=".txt") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".txt") returned 0x0 [0043.111] lstrlenW (lpString=".dbf") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".dbf") returned 0x0 [0043.111] lstrlenW (lpString=".ckp") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".ckp") returned 0x0 [0043.111] lstrlenW (lpString=".dacpac") returned 7 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".dacpac") returned 0x0 [0043.111] lstrlenW (lpString=".db3") returned 4 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".db3") returned 0x0 [0043.111] lstrlenW (lpString=".dtxs") returned 5 [0043.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".dtxs") returned 0x0 [0043.112] lstrlenW (lpString=".mdt") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".mdt") returned 0x0 [0043.112] lstrlenW (lpString=".sdf") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".sdf") returned 0x0 [0043.112] lstrlenW (lpString=".MDF") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".MDF") returned 0x0 [0043.112] lstrlenW (lpString=".DBF") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".DBF") returned 0x0 [0043.112] lstrlenW (lpString=".DB") returned 3 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".DB") returned 0x0 [0043.112] lstrlenW (lpString=".db") returned 3 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".db") returned 0x0 [0043.112] lstrlenW (lpString=".ndf") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".ndf") returned 0x0 [0043.112] lstrlenW (lpString=".NDF") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".NDF") returned 0x0 [0043.112] lstrlenW (lpString=".Mdf") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".Mdf") returned 0x0 [0043.112] lstrlenW (lpString=".dat") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".dat") returned 0x0 [0043.112] lstrlenW (lpString=".DAT") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".DAT") returned 0x0 [0043.112] lstrlenW (lpString=".ldf") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".ldf") returned 0x0 [0043.112] lstrlenW (lpString=".LDF") returned 4 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch=".LDF") returned 0x0 [0043.112] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.112] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0043.113] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.113] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.113] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16311566994) returned 1 [0043.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa88222b0, dwHighDateTime=0x1d585b4)) [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8258 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8258 | out: hHeap=0x260000) returned 1 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0043.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0043.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0043.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.115] GetLastError () returned 0x0 [0043.115] GetLastError () returned 0x0 [0043.115] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.115] GetLastError () returned 0x0 [0043.116] GetLastError () returned 0x0 [0043.116] ReadFile (in: hFile=0x10c, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x224fdb0*=0x2cc7, lpOverlapped=0x0) returned 1 [0043.117] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd339, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.117] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2cc7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x2cc7, lpOverlapped=0x0) returned 1 [0043.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.117] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.117] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.118] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.118] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.118] CloseHandle (hObject=0x10c) returned 1 [0043.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.118] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.[deadmin@cock.li].deadmin")) returned 1 [0043.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.119] GetLastError () returned 0x0 [0043.119] RtlWakeConditionVariable () returned 0x27e828 [0043.119] GetCurrentThreadId () returned 0x98c [0043.119] GetCurrentThreadId () returned 0x98c [0043.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0043.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8220 | out: hHeap=0x260000) returned 1 [0043.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.119] lstrlenW (lpString=".ldf") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".ldf") returned 0x0 [0043.119] lstrlenW (lpString=".vhd") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".vhd") returned 0x0 [0043.119] lstrlenW (lpString=".vhdx") returned 5 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".vhdx") returned 0x0 [0043.119] lstrlenW (lpString=".pst") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".pst") returned 0x0 [0043.119] lstrlenW (lpString=".ost") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".ost") returned 0x0 [0043.119] lstrlenW (lpString=".bak") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".bak") returned 0x0 [0043.119] lstrlenW (lpString=".bac") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".bac") returned 0x0 [0043.119] lstrlenW (lpString=".sys") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".sys") returned 0x0 [0043.119] lstrlenW (lpString=".v2i") returned 4 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".v2i") returned 0x0 [0043.119] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.422] lstrlenW (lpString=".sql") returned 4 [0043.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".sql") returned 0x0 [0043.422] lstrlenW (lpString=".mdf") returned 4 [0043.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".mdf") returned 0x0 [0043.422] lstrlenW (lpString=".txt") returned 4 [0043.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".txt") returned 0x0 [0043.422] lstrlenW (lpString=".dbf") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".dbf") returned 0x0 [0043.423] lstrlenW (lpString=".ckp") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".ckp") returned 0x0 [0043.423] lstrlenW (lpString=".dacpac") returned 7 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".dacpac") returned 0x0 [0043.423] lstrlenW (lpString=".db3") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".db3") returned 0x0 [0043.423] lstrlenW (lpString=".dtxs") returned 5 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".dtxs") returned 0x0 [0043.423] lstrlenW (lpString=".mdt") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".mdt") returned 0x0 [0043.423] lstrlenW (lpString=".sdf") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".sdf") returned 0x0 [0043.423] lstrlenW (lpString=".MDF") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".MDF") returned 0x0 [0043.423] lstrlenW (lpString=".DBF") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".DBF") returned 0x0 [0043.423] lstrlenW (lpString=".DB") returned 3 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".DB") returned 0x0 [0043.423] lstrlenW (lpString=".db") returned 3 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".db") returned 0x0 [0043.423] lstrlenW (lpString=".ndf") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".ndf") returned 0x0 [0043.423] lstrlenW (lpString=".NDF") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".NDF") returned 0x0 [0043.423] lstrlenW (lpString=".Mdf") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".Mdf") returned 0x0 [0043.423] lstrlenW (lpString=".dat") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".dat") returned 0x0 [0043.423] lstrlenW (lpString=".DAT") returned 4 [0043.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".DAT") returned 0x0 [0043.423] lstrlenW (lpString=".ldf") returned 4 [0043.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".ldf") returned 0x0 [0043.424] lstrlenW (lpString=".LDF") returned 4 [0043.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch=".LDF") returned 0x0 [0043.424] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.424] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.425] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.425] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16342602679) returned 1 [0043.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8b1be30, dwHighDateTime=0x1d585b4)) [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8140 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8140 | out: hHeap=0x260000) returned 1 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ce30 [0043.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0043.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0043.425] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.426] GetLastError () returned 0x0 [0043.426] GetLastError () returned 0x0 [0043.426] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.426] GetLastError () returned 0x0 [0043.426] GetLastError () returned 0x0 [0043.426] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x4380, lpOverlapped=0x0) returned 1 [0043.429] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffbc80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.429] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x4380, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x4380, lpOverlapped=0x0) returned 1 [0043.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.429] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.429] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.429] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.429] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.430] CloseHandle (hObject=0x100) returned 1 [0043.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.431] GetLastError () returned 0x0 [0043.431] RtlWakeConditionVariable () returned 0x27e828 [0043.431] GetCurrentThreadId () returned 0x98c [0043.431] GetCurrentThreadId () returned 0x98c [0043.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0043.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0043.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8028 | out: hHeap=0x260000) returned 1 [0043.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0043.431] lstrlenW (lpString=".ldf") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".ldf") returned 0x0 [0043.431] lstrlenW (lpString=".vhd") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".vhd") returned 0x0 [0043.431] lstrlenW (lpString=".vhdx") returned 5 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".vhdx") returned 0x0 [0043.431] lstrlenW (lpString=".pst") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".pst") returned 0x0 [0043.431] lstrlenW (lpString=".ost") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".ost") returned 0x0 [0043.431] lstrlenW (lpString=".bak") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".bak") returned 0x0 [0043.431] lstrlenW (lpString=".bac") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".bac") returned 0x0 [0043.431] lstrlenW (lpString=".sys") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".sys") returned 0x0 [0043.431] lstrlenW (lpString=".v2i") returned 4 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".v2i") returned 0x0 [0043.431] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.456] lstrlenW (lpString=".sql") returned 4 [0043.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".sql") returned 0x0 [0043.457] lstrlenW (lpString=".mdf") returned 4 [0043.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".mdf") returned 0x0 [0043.462] lstrlenW (lpString=".txt") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".txt") returned 0x0 [0043.462] lstrlenW (lpString=".dbf") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".dbf") returned 0x0 [0043.462] lstrlenW (lpString=".ckp") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".ckp") returned 0x0 [0043.462] lstrlenW (lpString=".dacpac") returned 7 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".dacpac") returned 0x0 [0043.462] lstrlenW (lpString=".db3") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".db3") returned 0x0 [0043.462] lstrlenW (lpString=".dtxs") returned 5 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".dtxs") returned 0x0 [0043.462] lstrlenW (lpString=".mdt") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".mdt") returned 0x0 [0043.462] lstrlenW (lpString=".sdf") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".sdf") returned 0x0 [0043.462] lstrlenW (lpString=".MDF") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".MDF") returned 0x0 [0043.462] lstrlenW (lpString=".DBF") returned 4 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".DBF") returned 0x0 [0043.462] lstrlenW (lpString=".DB") returned 3 [0043.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".DB") returned 0x0 [0043.463] lstrlenW (lpString=".db") returned 3 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".db") returned 0x0 [0043.463] lstrlenW (lpString=".ndf") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".ndf") returned 0x0 [0043.463] lstrlenW (lpString=".NDF") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".NDF") returned 0x0 [0043.463] lstrlenW (lpString=".Mdf") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".Mdf") returned 0x0 [0043.463] lstrlenW (lpString=".dat") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".dat") returned 0x0 [0043.463] lstrlenW (lpString=".DAT") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".DAT") returned 0x0 [0043.463] lstrlenW (lpString=".ldf") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".ldf") returned 0x0 [0043.463] lstrlenW (lpString=".LDF") returned 4 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch=".LDF") returned 0x0 [0043.463] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0043.463] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.464] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0043.464] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.464] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16346516759) returned 1 [0043.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8b8e250, dwHighDateTime=0x1d585b4)) [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8300 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8300 | out: hHeap=0x260000) returned 1 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.465] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.465] GetLastError () returned 0x0 [0043.465] GetLastError () returned 0x0 [0043.465] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.465] GetLastError () returned 0x0 [0043.465] GetLastError () returned 0x0 [0043.465] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x18b80, lpOverlapped=0x0) returned 1 [0043.467] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.467] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x18b80, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x18b80, lpOverlapped=0x0) returned 1 [0043.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.468] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.468] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.468] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.468] CloseHandle (hObject=0x104) returned 1 [0043.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.468] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.469] GetLastError () returned 0x0 [0043.469] RtlWakeConditionVariable () returned 0x27e828 [0043.469] GetCurrentThreadId () returned 0x98c [0043.469] GetCurrentThreadId () returned 0x98c [0043.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3038 [0043.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ec8 | out: hHeap=0x260000) returned 1 [0043.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8290 | out: hHeap=0x260000) returned 1 [0043.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ec8 [0043.469] lstrlenW (lpString=".ldf") returned 4 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".ldf") returned 0x0 [0043.469] lstrlenW (lpString=".vhd") returned 4 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".vhd") returned 0x0 [0043.469] lstrlenW (lpString=".vhdx") returned 5 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".vhdx") returned 0x0 [0043.469] lstrlenW (lpString=".pst") returned 4 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".pst") returned 0x0 [0043.469] lstrlenW (lpString=".ost") returned 4 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".ost") returned 0x0 [0043.469] lstrlenW (lpString=".bak") returned 4 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".bak") returned 0x0 [0043.469] lstrlenW (lpString=".bac") returned 4 [0043.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".bac") returned 0x0 [0043.469] lstrlenW (lpString=".sys") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".sys") returned 0x0 [0043.470] lstrlenW (lpString=".v2i") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".v2i") returned 0x0 [0043.470] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch="s\r\n.v2i") returned 0x0 [0043.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.470] lstrlenW (lpString=".sql") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".sql") returned 0x0 [0043.470] lstrlenW (lpString=".mdf") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".mdf") returned 0x0 [0043.470] lstrlenW (lpString=".txt") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".txt") returned 0x0 [0043.470] lstrlenW (lpString=".dbf") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".dbf") returned 0x0 [0043.470] lstrlenW (lpString=".ckp") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".ckp") returned 0x0 [0043.470] lstrlenW (lpString=".dacpac") returned 7 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".dacpac") returned 0x0 [0043.470] lstrlenW (lpString=".db3") returned 4 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".db3") returned 0x0 [0043.470] lstrlenW (lpString=".dtxs") returned 5 [0043.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".dtxs") returned 0x0 [0043.470] lstrlenW (lpString=".mdt") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".mdt") returned 0x0 [0043.471] lstrlenW (lpString=".sdf") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".sdf") returned 0x0 [0043.471] lstrlenW (lpString=".MDF") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".MDF") returned 0x0 [0043.471] lstrlenW (lpString=".DBF") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".DBF") returned 0x0 [0043.471] lstrlenW (lpString=".DB") returned 3 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".DB") returned 0x0 [0043.471] lstrlenW (lpString=".db") returned 3 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".db") returned 0x0 [0043.471] lstrlenW (lpString=".ndf") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".ndf") returned 0x0 [0043.471] lstrlenW (lpString=".NDF") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".NDF") returned 0x0 [0043.471] lstrlenW (lpString=".Mdf") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".Mdf") returned 0x0 [0043.471] lstrlenW (lpString=".dat") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".dat") returned 0x0 [0043.471] lstrlenW (lpString=".DAT") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".DAT") returned 0x0 [0043.471] lstrlenW (lpString=".ldf") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".ldf") returned 0x0 [0043.471] lstrlenW (lpString=".LDF") returned 4 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch=".LDF") returned 0x0 [0043.471] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0043.471] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.472] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0043.472] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0043.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.472] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16347349203) returned 1 [0043.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8b8e250, dwHighDateTime=0x1d585b4)) [0043.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8290 [0043.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8290 | out: hHeap=0x260000) returned 1 [0043.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.473] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.473] GetLastError () returned 0x0 [0043.473] GetLastError () returned 0x0 [0043.473] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.473] GetLastError () returned 0x0 [0043.473] GetLastError () returned 0x0 [0043.473] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0xa7f, lpOverlapped=0x0) returned 1 [0043.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff581, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.475] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xa7f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0xa7f, lpOverlapped=0x0) returned 1 [0043.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.475] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.475] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.475] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.475] CloseHandle (hObject=0x104) returned 1 [0043.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.[deadmin@cock.li].deadmin")) returned 1 [0043.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.476] GetLastError () returned 0x0 [0043.476] RtlWakeConditionVariable () returned 0x27e828 [0043.476] GetCurrentThreadId () returned 0x98c [0043.476] GetCurrentThreadId () returned 0x98c [0043.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3038 [0043.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2e10 | out: hHeap=0x260000) returned 1 [0043.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ff0 | out: hHeap=0x260000) returned 1 [0043.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2e10 [0043.476] lstrlenW (lpString=".ldf") returned 4 [0043.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".ldf") returned 0x0 [0043.477] lstrlenW (lpString=".vhd") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".vhd") returned 0x0 [0043.477] lstrlenW (lpString=".vhdx") returned 5 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".vhdx") returned 0x0 [0043.477] lstrlenW (lpString=".pst") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".pst") returned 0x0 [0043.477] lstrlenW (lpString=".ost") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".ost") returned 0x0 [0043.477] lstrlenW (lpString=".bak") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".bak") returned 0x0 [0043.477] lstrlenW (lpString=".bac") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".bac") returned 0x0 [0043.477] lstrlenW (lpString=".sys") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".sys") returned 0x0 [0043.477] lstrlenW (lpString=".v2i") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".v2i") returned 0x0 [0043.477] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch="s\r\n.v2i") returned 0x0 [0043.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.477] lstrlenW (lpString=".sql") returned 4 [0043.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".sql") returned 0x0 [0043.478] lstrlenW (lpString=".mdf") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".mdf") returned 0x0 [0043.478] lstrlenW (lpString=".txt") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".txt") returned 0x0 [0043.478] lstrlenW (lpString=".dbf") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".dbf") returned 0x0 [0043.478] lstrlenW (lpString=".ckp") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".ckp") returned 0x0 [0043.478] lstrlenW (lpString=".dacpac") returned 7 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".dacpac") returned 0x0 [0043.478] lstrlenW (lpString=".db3") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".db3") returned 0x0 [0043.478] lstrlenW (lpString=".dtxs") returned 5 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".dtxs") returned 0x0 [0043.478] lstrlenW (lpString=".mdt") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".mdt") returned 0x0 [0043.478] lstrlenW (lpString=".sdf") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".sdf") returned 0x0 [0043.478] lstrlenW (lpString=".MDF") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".MDF") returned 0x0 [0043.478] lstrlenW (lpString=".DBF") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".DBF") returned 0x0 [0043.478] lstrlenW (lpString=".DB") returned 3 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".DB") returned 0x0 [0043.478] lstrlenW (lpString=".db") returned 3 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".db") returned 0x0 [0043.478] lstrlenW (lpString=".ndf") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".ndf") returned 0x0 [0043.478] lstrlenW (lpString=".NDF") returned 4 [0043.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".NDF") returned 0x0 [0043.478] lstrlenW (lpString=".Mdf") returned 4 [0043.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".Mdf") returned 0x0 [0043.479] lstrlenW (lpString=".dat") returned 4 [0043.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".dat") returned 0x0 [0043.479] lstrlenW (lpString=".DAT") returned 4 [0043.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".DAT") returned 0x0 [0043.479] lstrlenW (lpString=".ldf") returned 4 [0043.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".ldf") returned 0x0 [0043.479] lstrlenW (lpString=".LDF") returned 4 [0043.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch=".LDF") returned 0x0 [0043.479] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0043.479] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.480] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0043.480] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.480] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16348094893) returned 1 [0043.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8bb43b0, dwHighDateTime=0x1d585b4)) [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ff0 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ff0 | out: hHeap=0x260000) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.480] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.480] GetLastError () returned 0x0 [0043.481] GetLastError () returned 0x0 [0043.481] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.481] GetLastError () returned 0x0 [0043.481] GetLastError () returned 0x0 [0043.481] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x2174, lpOverlapped=0x0) returned 1 [0043.482] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffde8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.482] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x2174, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x2174, lpOverlapped=0x0) returned 1 [0043.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.483] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.483] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.483] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.483] CloseHandle (hObject=0x104) returned 1 [0043.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.[deadmin@cock.li].deadmin")) returned 1 [0043.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.483] GetLastError () returned 0x0 [0043.483] RtlWakeConditionVariable () returned 0x27e828 [0043.484] GetCurrentThreadId () returned 0x98c [0043.484] GetCurrentThreadId () returned 0x98c [0043.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f298 | out: hHeap=0x260000) returned 1 [0043.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7fb8 | out: hHeap=0x260000) returned 1 [0043.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f298 [0043.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.484] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.484] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.484] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.484] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.485] CloseHandle (hObject=0x104) returned 1 [0043.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f298 | out: hHeap=0x260000) returned 1 [0043.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.485] RtlWakeConditionVariable () returned 0x27e828 [0043.485] GetCurrentThreadId () returned 0x98c [0043.485] GetCurrentThreadId () returned 0x98c [0043.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0043.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0043.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f80 | out: hHeap=0x260000) returned 1 [0043.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0043.486] lstrlenW (lpString=".ldf") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".ldf") returned 0x0 [0043.486] lstrlenW (lpString=".vhd") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".vhd") returned 0x0 [0043.486] lstrlenW (lpString=".vhdx") returned 5 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".vhdx") returned 0x0 [0043.486] lstrlenW (lpString=".pst") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".pst") returned 0x0 [0043.486] lstrlenW (lpString=".ost") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".ost") returned 0x0 [0043.486] lstrlenW (lpString=".bak") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".bak") returned 0x0 [0043.486] lstrlenW (lpString=".bac") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".bac") returned 0x0 [0043.486] lstrlenW (lpString=".sys") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".sys") returned 0x0 [0043.486] lstrlenW (lpString=".v2i") returned 4 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".v2i") returned 0x0 [0043.486] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0043.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.487] lstrlenW (lpString=".sql") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".sql") returned 0x0 [0043.487] lstrlenW (lpString=".mdf") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".mdf") returned 0x0 [0043.487] lstrlenW (lpString=".txt") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".txt") returned 0x0 [0043.487] lstrlenW (lpString=".dbf") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".dbf") returned 0x0 [0043.487] lstrlenW (lpString=".ckp") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".ckp") returned 0x0 [0043.487] lstrlenW (lpString=".dacpac") returned 7 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".dacpac") returned 0x0 [0043.487] lstrlenW (lpString=".db3") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".db3") returned 0x0 [0043.487] lstrlenW (lpString=".dtxs") returned 5 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".dtxs") returned 0x0 [0043.487] lstrlenW (lpString=".mdt") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".mdt") returned 0x0 [0043.487] lstrlenW (lpString=".sdf") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".sdf") returned 0x0 [0043.487] lstrlenW (lpString=".MDF") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".MDF") returned 0x0 [0043.487] lstrlenW (lpString=".DBF") returned 4 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".DBF") returned 0x0 [0043.487] lstrlenW (lpString=".DB") returned 3 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".DB") returned 0x0 [0043.487] lstrlenW (lpString=".db") returned 3 [0043.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".db") returned 0x0 [0043.488] lstrlenW (lpString=".ndf") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".ndf") returned 0x0 [0043.488] lstrlenW (lpString=".NDF") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".NDF") returned 0x0 [0043.488] lstrlenW (lpString=".Mdf") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".Mdf") returned 0x0 [0043.488] lstrlenW (lpString=".dat") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".dat") returned 0x0 [0043.488] lstrlenW (lpString=".DAT") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".DAT") returned 0x0 [0043.488] lstrlenW (lpString=".ldf") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".ldf") returned 0x0 [0043.488] lstrlenW (lpString=".LDF") returned 4 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch=".LDF") returned 0x0 [0043.488] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0043.488] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0043.489] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.489] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16349012118) returned 1 [0043.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8bb43b0, dwHighDateTime=0x1d585b4)) [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7f80 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f80 | out: hHeap=0x260000) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0043.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0043.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.490] GetLastError () returned 0x0 [0043.490] GetLastError () returned 0x0 [0043.490] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.490] GetLastError () returned 0x0 [0043.490] GetLastError () returned 0x0 [0043.490] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.513] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.513] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.514] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.514] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.514] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.514] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.514] CloseHandle (hObject=0x104) returned 1 [0043.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0043.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.[deadmin@cock.li].deadmin")) returned 1 [0043.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0043.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.562] GetLastError () returned 0x0 [0043.562] RtlWakeConditionVariable () returned 0x27e828 [0043.562] GetCurrentThreadId () returned 0x98c [0043.562] GetCurrentThreadId () returned 0x98c [0043.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0043.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ca0 | out: hHeap=0x260000) returned 1 [0043.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7df8 | out: hHeap=0x260000) returned 1 [0043.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0043.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.683] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.683] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.684] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.684] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.685] CloseHandle (hObject=0xf8) returned 1 [0043.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2ca0 | out: hHeap=0x260000) returned 1 [0043.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2f80 | out: hHeap=0x260000) returned 1 [0043.685] RtlWakeConditionVariable () returned 0x27e828 [0043.685] GetCurrentThreadId () returned 0x98c [0043.685] GetCurrentThreadId () returned 0x98c [0043.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da790 [0043.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da6c8 | out: hHeap=0x260000) returned 1 [0043.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9e8 | out: hHeap=0x260000) returned 1 [0043.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da6c8 [0043.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.685] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.686] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.686] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.686] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.687] CloseHandle (hObject=0xf8) returned 1 [0043.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da6c8 | out: hHeap=0x260000) returned 1 [0043.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da790 | out: hHeap=0x260000) returned 1 [0043.687] RtlWakeConditionVariable () returned 0x27e828 [0043.687] GetCurrentThreadId () returned 0x98c [0043.687] GetCurrentThreadId () returned 0x98c [0043.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5c28 | out: hHeap=0x260000) returned 1 [0043.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da20 | out: hHeap=0x260000) returned 1 [0043.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5c28 [0043.687] lstrlenW (lpString=".ldf") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".ldf") returned 0x0 [0043.687] lstrlenW (lpString=".vhd") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".vhd") returned 0x0 [0043.687] lstrlenW (lpString=".vhdx") returned 5 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".vhdx") returned 0x0 [0043.687] lstrlenW (lpString=".pst") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".pst") returned 0x0 [0043.687] lstrlenW (lpString=".ost") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".ost") returned 0x0 [0043.687] lstrlenW (lpString=".bak") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".bak") returned 0x0 [0043.687] lstrlenW (lpString=".bac") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".bac") returned 0x0 [0043.687] lstrlenW (lpString=".sys") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".sys") returned 0x0 [0043.687] lstrlenW (lpString=".v2i") returned 4 [0043.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".v2i") returned 0x0 [0043.688] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.688] lstrlenW (lpString=".sql") returned 4 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".sql") returned 0x0 [0043.688] lstrlenW (lpString=".mdf") returned 4 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".mdf") returned 0x0 [0043.688] lstrlenW (lpString=".txt") returned 4 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".txt") returned 0x0 [0043.688] lstrlenW (lpString=".dbf") returned 4 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".dbf") returned 0x0 [0043.688] lstrlenW (lpString=".ckp") returned 4 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".ckp") returned 0x0 [0043.688] lstrlenW (lpString=".dacpac") returned 7 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".dacpac") returned 0x0 [0043.688] lstrlenW (lpString=".db3") returned 4 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".db3") returned 0x0 [0043.688] lstrlenW (lpString=".dtxs") returned 5 [0043.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".dtxs") returned 0x0 [0043.688] lstrlenW (lpString=".mdt") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".mdt") returned 0x0 [0043.689] lstrlenW (lpString=".sdf") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".sdf") returned 0x0 [0043.689] lstrlenW (lpString=".MDF") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".MDF") returned 0x0 [0043.689] lstrlenW (lpString=".DBF") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".DBF") returned 0x0 [0043.689] lstrlenW (lpString=".DB") returned 3 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".DB") returned 0x0 [0043.689] lstrlenW (lpString=".db") returned 3 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".db") returned 0x0 [0043.689] lstrlenW (lpString=".ndf") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".ndf") returned 0x0 [0043.689] lstrlenW (lpString=".NDF") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".NDF") returned 0x0 [0043.689] lstrlenW (lpString=".Mdf") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".Mdf") returned 0x0 [0043.689] lstrlenW (lpString=".dat") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".dat") returned 0x0 [0043.689] lstrlenW (lpString=".DAT") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".DAT") returned 0x0 [0043.689] lstrlenW (lpString=".ldf") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".ldf") returned 0x0 [0043.689] lstrlenW (lpString=".LDF") returned 4 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch=".LDF") returned 0x0 [0043.689] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.690] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.690] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.690] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.690] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16369158899) returned 1 [0043.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8da3590, dwHighDateTime=0x1d585b4)) [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da20 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da20 | out: hHeap=0x260000) returned 1 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5e20 [0043.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0043.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.691] GetLastError () returned 0x0 [0043.691] GetLastError () returned 0x0 [0043.691] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.691] GetLastError () returned 0x0 [0043.692] GetLastError () returned 0x0 [0043.697] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.697] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.701] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.701] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.701] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.701] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.702] CloseHandle (hObject=0xf8) returned 1 [0043.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.704] GetLastError () returned 0x0 [0043.704] RtlWakeConditionVariable () returned 0x27e828 [0043.704] GetCurrentThreadId () returned 0x98c [0043.704] GetCurrentThreadId () returned 0x98c [0043.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296988 | out: hHeap=0x260000) returned 1 [0043.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da90 | out: hHeap=0x260000) returned 1 [0043.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0043.704] lstrlenW (lpString=".ldf") returned 4 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".ldf") returned 0x0 [0043.704] lstrlenW (lpString=".vhd") returned 4 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".vhd") returned 0x0 [0043.704] lstrlenW (lpString=".vhdx") returned 5 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".vhdx") returned 0x0 [0043.704] lstrlenW (lpString=".pst") returned 4 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".pst") returned 0x0 [0043.704] lstrlenW (lpString=".ost") returned 4 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".ost") returned 0x0 [0043.704] lstrlenW (lpString=".bak") returned 4 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".bak") returned 0x0 [0043.704] lstrlenW (lpString=".bac") returned 4 [0043.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".bac") returned 0x0 [0043.704] lstrlenW (lpString=".sys") returned 4 [0043.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".sys") returned 0x0 [0043.705] lstrlenW (lpString=".v2i") returned 4 [0043.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".v2i") returned 0x0 [0043.705] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch="s\r\n.v2i") returned 0x0 [0043.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.706] lstrlenW (lpString=".sql") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".sql") returned 0x0 [0043.706] lstrlenW (lpString=".mdf") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".mdf") returned 0x0 [0043.706] lstrlenW (lpString=".txt") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".txt") returned 0x0 [0043.706] lstrlenW (lpString=".dbf") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".dbf") returned 0x0 [0043.706] lstrlenW (lpString=".ckp") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".ckp") returned 0x0 [0043.706] lstrlenW (lpString=".dacpac") returned 7 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".dacpac") returned 0x0 [0043.706] lstrlenW (lpString=".db3") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".db3") returned 0x0 [0043.706] lstrlenW (lpString=".dtxs") returned 5 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".dtxs") returned 0x0 [0043.706] lstrlenW (lpString=".mdt") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".mdt") returned 0x0 [0043.706] lstrlenW (lpString=".sdf") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".sdf") returned 0x0 [0043.706] lstrlenW (lpString=".MDF") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".MDF") returned 0x0 [0043.706] lstrlenW (lpString=".DBF") returned 4 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".DBF") returned 0x0 [0043.706] lstrlenW (lpString=".DB") returned 3 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".DB") returned 0x0 [0043.706] lstrlenW (lpString=".db") returned 3 [0043.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".db") returned 0x0 [0043.706] lstrlenW (lpString=".ndf") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".ndf") returned 0x0 [0043.707] lstrlenW (lpString=".NDF") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".NDF") returned 0x0 [0043.707] lstrlenW (lpString=".Mdf") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".Mdf") returned 0x0 [0043.707] lstrlenW (lpString=".dat") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".dat") returned 0x0 [0043.707] lstrlenW (lpString=".DAT") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".DAT") returned 0x0 [0043.707] lstrlenW (lpString=".ldf") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".ldf") returned 0x0 [0043.707] lstrlenW (lpString=".LDF") returned 4 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch=".LDF") returned 0x0 [0043.707] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.707] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.708] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.708] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.708] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16370914299) returned 1 [0043.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8dc96f0, dwHighDateTime=0x1d585b4)) [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da90 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da90 | out: hHeap=0x260000) returned 1 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297568 [0043.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.709] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.709] GetLastError () returned 0x0 [0043.709] GetLastError () returned 0x0 [0043.709] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.709] GetLastError () returned 0x0 [0043.709] GetLastError () returned 0x0 [0043.725] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff2060, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.725] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0xdfa0, lpOverlapped=0x0) returned 1 [0043.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.725] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.725] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.725] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.725] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.726] CloseHandle (hObject=0xf8) returned 1 [0043.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.[deadmin@cock.li].deadmin")) returned 1 [0043.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.726] GetLastError () returned 0x0 [0043.726] RtlWakeConditionVariable () returned 0x27e828 [0043.726] GetCurrentThreadId () returned 0x98c [0043.727] GetCurrentThreadId () returned 0x98c [0043.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296ab8 | out: hHeap=0x260000) returned 1 [0043.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0043.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ab8 [0043.727] lstrlenW (lpString=".ldf") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".ldf") returned 0x0 [0043.727] lstrlenW (lpString=".vhd") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".vhd") returned 0x0 [0043.727] lstrlenW (lpString=".vhdx") returned 5 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".vhdx") returned 0x0 [0043.727] lstrlenW (lpString=".pst") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".pst") returned 0x0 [0043.727] lstrlenW (lpString=".ost") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".ost") returned 0x0 [0043.727] lstrlenW (lpString=".bak") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".bak") returned 0x0 [0043.727] lstrlenW (lpString=".bac") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".bac") returned 0x0 [0043.727] lstrlenW (lpString=".sys") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".sys") returned 0x0 [0043.727] lstrlenW (lpString=".v2i") returned 4 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".v2i") returned 0x0 [0043.727] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch="s\r\n.v2i") returned 0x0 [0043.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.728] lstrlenW (lpString=".sql") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".sql") returned 0x0 [0043.728] lstrlenW (lpString=".mdf") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".mdf") returned 0x0 [0043.728] lstrlenW (lpString=".txt") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".txt") returned 0x0 [0043.728] lstrlenW (lpString=".dbf") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".dbf") returned 0x0 [0043.728] lstrlenW (lpString=".ckp") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".ckp") returned 0x0 [0043.728] lstrlenW (lpString=".dacpac") returned 7 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".dacpac") returned 0x0 [0043.728] lstrlenW (lpString=".db3") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".db3") returned 0x0 [0043.728] lstrlenW (lpString=".dtxs") returned 5 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".dtxs") returned 0x0 [0043.728] lstrlenW (lpString=".mdt") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".mdt") returned 0x0 [0043.728] lstrlenW (lpString=".sdf") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".sdf") returned 0x0 [0043.728] lstrlenW (lpString=".MDF") returned 4 [0043.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".MDF") returned 0x0 [0043.728] lstrlenW (lpString=".DBF") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".DBF") returned 0x0 [0043.729] lstrlenW (lpString=".DB") returned 3 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".DB") returned 0x0 [0043.729] lstrlenW (lpString=".db") returned 3 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".db") returned 0x0 [0043.729] lstrlenW (lpString=".ndf") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".ndf") returned 0x0 [0043.729] lstrlenW (lpString=".NDF") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".NDF") returned 0x0 [0043.729] lstrlenW (lpString=".Mdf") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".Mdf") returned 0x0 [0043.729] lstrlenW (lpString=".dat") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".dat") returned 0x0 [0043.729] lstrlenW (lpString=".DAT") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".DAT") returned 0x0 [0043.729] lstrlenW (lpString=".ldf") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".ldf") returned 0x0 [0043.729] lstrlenW (lpString=".LDF") returned 4 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch=".LDF") returned 0x0 [0043.729] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.729] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.730] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.730] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.730] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16373134224) returned 1 [0043.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8e159b0, dwHighDateTime=0x1d585b4)) [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1cd0 [0043.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0043.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0043.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.731] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.731] GetLastError () returned 0x0 [0043.731] GetLastError () returned 0x0 [0043.731] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.731] GetLastError () returned 0x0 [0043.731] GetLastError () returned 0x0 [0043.734] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.734] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.734] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.735] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.735] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.735] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.736] CloseHandle (hObject=0xf8) returned 1 [0043.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.[deadmin@cock.li].deadmin")) returned 1 [0043.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.736] GetLastError () returned 0x0 [0043.736] RtlWakeConditionVariable () returned 0x27e828 [0043.736] GetCurrentThreadId () returned 0x98c [0043.736] GetCurrentThreadId () returned 0x98c [0043.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296a20 | out: hHeap=0x260000) returned 1 [0043.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0043.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296a20 [0043.737] lstrlenW (lpString=".ldf") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".ldf") returned 0x0 [0043.737] lstrlenW (lpString=".vhd") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".vhd") returned 0x0 [0043.737] lstrlenW (lpString=".vhdx") returned 5 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".vhdx") returned 0x0 [0043.737] lstrlenW (lpString=".pst") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".pst") returned 0x0 [0043.737] lstrlenW (lpString=".ost") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".ost") returned 0x0 [0043.737] lstrlenW (lpString=".bak") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".bak") returned 0x0 [0043.737] lstrlenW (lpString=".bac") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".bac") returned 0x0 [0043.737] lstrlenW (lpString=".sys") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".sys") returned 0x0 [0043.737] lstrlenW (lpString=".v2i") returned 4 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".v2i") returned 0x0 [0043.737] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch="s\r\n.v2i") returned 0x0 [0043.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.738] lstrlenW (lpString=".sql") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".sql") returned 0x0 [0043.738] lstrlenW (lpString=".mdf") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".mdf") returned 0x0 [0043.738] lstrlenW (lpString=".txt") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".txt") returned 0x0 [0043.738] lstrlenW (lpString=".dbf") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".dbf") returned 0x0 [0043.738] lstrlenW (lpString=".ckp") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".ckp") returned 0x0 [0043.738] lstrlenW (lpString=".dacpac") returned 7 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".dacpac") returned 0x0 [0043.738] lstrlenW (lpString=".db3") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".db3") returned 0x0 [0043.738] lstrlenW (lpString=".dtxs") returned 5 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".dtxs") returned 0x0 [0043.738] lstrlenW (lpString=".mdt") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".mdt") returned 0x0 [0043.738] lstrlenW (lpString=".sdf") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".sdf") returned 0x0 [0043.738] lstrlenW (lpString=".MDF") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".MDF") returned 0x0 [0043.738] lstrlenW (lpString=".DBF") returned 4 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".DBF") returned 0x0 [0043.738] lstrlenW (lpString=".DB") returned 3 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".DB") returned 0x0 [0043.738] lstrlenW (lpString=".db") returned 3 [0043.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".db") returned 0x0 [0043.738] lstrlenW (lpString=".ndf") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".ndf") returned 0x0 [0043.739] lstrlenW (lpString=".NDF") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".NDF") returned 0x0 [0043.739] lstrlenW (lpString=".Mdf") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".Mdf") returned 0x0 [0043.739] lstrlenW (lpString=".dat") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".dat") returned 0x0 [0043.739] lstrlenW (lpString=".DAT") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".DAT") returned 0x0 [0043.739] lstrlenW (lpString=".ldf") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".ldf") returned 0x0 [0043.739] lstrlenW (lpString=".LDF") returned 4 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch=".LDF") returned 0x0 [0043.739] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0043.739] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.740] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0043.740] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.740] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16374108580) returned 1 [0043.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8e159b0, dwHighDateTime=0x1d585b4)) [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d40 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ab8 [0043.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.740] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.741] GetLastError () returned 0x0 [0043.741] GetLastError () returned 0x0 [0043.741] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.741] GetLastError () returned 0x0 [0043.741] GetLastError () returned 0x0 [0043.744] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.744] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.745] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.745] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.746] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.746] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.747] CloseHandle (hObject=0xf8) returned 1 [0043.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.[deadmin@cock.li].deadmin")) returned 1 [0043.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.747] GetLastError () returned 0x0 [0043.747] RtlWakeConditionVariable () returned 0x27e828 [0043.747] GetCurrentThreadId () returned 0x98c [0043.747] GetCurrentThreadId () returned 0x98c [0043.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0043.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2400 | out: hHeap=0x260000) returned 1 [0043.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0043.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2400 [0043.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.748] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.748] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.748] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.748] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.749] CloseHandle (hObject=0xf8) returned 1 [0043.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2400 | out: hHeap=0x260000) returned 1 [0043.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2f80 | out: hHeap=0x260000) returned 1 [0043.749] RtlWakeConditionVariable () returned 0x27e828 [0043.749] GetCurrentThreadId () returned 0x98c [0043.749] GetCurrentThreadId () returned 0x98c [0043.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0043.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f29c0 | out: hHeap=0x260000) returned 1 [0043.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0043.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f29c0 [0043.749] lstrlenW (lpString=".ldf") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".ldf") returned 0x0 [0043.750] lstrlenW (lpString=".vhd") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".vhd") returned 0x0 [0043.750] lstrlenW (lpString=".vhdx") returned 5 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".vhdx") returned 0x0 [0043.750] lstrlenW (lpString=".pst") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".pst") returned 0x0 [0043.750] lstrlenW (lpString=".ost") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".ost") returned 0x0 [0043.750] lstrlenW (lpString=".bak") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".bak") returned 0x0 [0043.750] lstrlenW (lpString=".bac") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".bac") returned 0x0 [0043.750] lstrlenW (lpString=".sys") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".sys") returned 0x0 [0043.750] lstrlenW (lpString=".v2i") returned 4 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".v2i") returned 0x0 [0043.750] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0043.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.751] lstrlenW (lpString=".sql") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".sql") returned 0x0 [0043.751] lstrlenW (lpString=".mdf") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".mdf") returned 0x0 [0043.751] lstrlenW (lpString=".txt") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".txt") returned 0x0 [0043.751] lstrlenW (lpString=".dbf") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".dbf") returned 0x0 [0043.751] lstrlenW (lpString=".ckp") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".ckp") returned 0x0 [0043.751] lstrlenW (lpString=".dacpac") returned 7 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".dacpac") returned 0x0 [0043.751] lstrlenW (lpString=".db3") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".db3") returned 0x0 [0043.751] lstrlenW (lpString=".dtxs") returned 5 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".dtxs") returned 0x0 [0043.751] lstrlenW (lpString=".mdt") returned 4 [0043.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".mdt") returned 0x0 [0043.752] lstrlenW (lpString=".sdf") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".sdf") returned 0x0 [0043.752] lstrlenW (lpString=".MDF") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".MDF") returned 0x0 [0043.752] lstrlenW (lpString=".DBF") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".DBF") returned 0x0 [0043.752] lstrlenW (lpString=".DB") returned 3 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".DB") returned 0x0 [0043.752] lstrlenW (lpString=".db") returned 3 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".db") returned 0x0 [0043.752] lstrlenW (lpString=".ndf") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".ndf") returned 0x0 [0043.752] lstrlenW (lpString=".NDF") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".NDF") returned 0x0 [0043.752] lstrlenW (lpString=".Mdf") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".Mdf") returned 0x0 [0043.752] lstrlenW (lpString=".dat") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".dat") returned 0x0 [0043.752] lstrlenW (lpString=".DAT") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".DAT") returned 0x0 [0043.752] lstrlenW (lpString=".ldf") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".ldf") returned 0x0 [0043.752] lstrlenW (lpString=".LDF") returned 4 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch=".LDF") returned 0x0 [0043.752] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f088 [0043.752] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0043.753] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0043.753] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0043.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.753] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16375444447) returned 1 [0043.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8e3bb10, dwHighDateTime=0x1d585b4)) [0043.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e68 [0043.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0043.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.754] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.754] GetLastError () returned 0x0 [0043.754] GetLastError () returned 0x0 [0043.754] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.754] GetLastError () returned 0x0 [0043.754] GetLastError () returned 0x0 [0043.756] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff1a72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.756] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xe58e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0xe58e, lpOverlapped=0x0) returned 1 [0043.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.756] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.757] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.757] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.757] CloseHandle (hObject=0xf8) returned 1 [0043.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.[deadmin@cock.li].deadmin")) returned 1 [0043.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.757] GetLastError () returned 0x0 [0043.758] RtlWakeConditionVariable () returned 0x27e828 [0043.758] GetCurrentThreadId () returned 0x98c [0043.758] GetCurrentThreadId () returned 0x98c [0043.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0043.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2908 | out: hHeap=0x260000) returned 1 [0043.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0d88 | out: hHeap=0x260000) returned 1 [0043.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0043.758] lstrlenW (lpString=".ldf") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".ldf") returned 0x0 [0043.758] lstrlenW (lpString=".vhd") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".vhd") returned 0x0 [0043.758] lstrlenW (lpString=".vhdx") returned 5 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".vhdx") returned 0x0 [0043.758] lstrlenW (lpString=".pst") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".pst") returned 0x0 [0043.758] lstrlenW (lpString=".ost") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".ost") returned 0x0 [0043.758] lstrlenW (lpString=".bak") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".bak") returned 0x0 [0043.758] lstrlenW (lpString=".bac") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".bac") returned 0x0 [0043.758] lstrlenW (lpString=".sys") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".sys") returned 0x0 [0043.758] lstrlenW (lpString=".v2i") returned 4 [0043.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".v2i") returned 0x0 [0043.759] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch="s\r\n.v2i") returned 0x0 [0043.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.759] lstrlenW (lpString=".sql") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".sql") returned 0x0 [0043.759] lstrlenW (lpString=".mdf") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".mdf") returned 0x0 [0043.759] lstrlenW (lpString=".txt") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".txt") returned 0x0 [0043.759] lstrlenW (lpString=".dbf") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".dbf") returned 0x0 [0043.759] lstrlenW (lpString=".ckp") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".ckp") returned 0x0 [0043.759] lstrlenW (lpString=".dacpac") returned 7 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".dacpac") returned 0x0 [0043.759] lstrlenW (lpString=".db3") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".db3") returned 0x0 [0043.759] lstrlenW (lpString=".dtxs") returned 5 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".dtxs") returned 0x0 [0043.759] lstrlenW (lpString=".mdt") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".mdt") returned 0x0 [0043.759] lstrlenW (lpString=".sdf") returned 4 [0043.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".sdf") returned 0x0 [0043.760] lstrlenW (lpString=".MDF") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".MDF") returned 0x0 [0043.760] lstrlenW (lpString=".DBF") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".DBF") returned 0x0 [0043.760] lstrlenW (lpString=".DB") returned 3 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".DB") returned 0x0 [0043.760] lstrlenW (lpString=".db") returned 3 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".db") returned 0x0 [0043.760] lstrlenW (lpString=".ndf") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".ndf") returned 0x0 [0043.760] lstrlenW (lpString=".NDF") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".NDF") returned 0x0 [0043.760] lstrlenW (lpString=".Mdf") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".Mdf") returned 0x0 [0043.760] lstrlenW (lpString=".dat") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".dat") returned 0x0 [0043.760] lstrlenW (lpString=".DAT") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".DAT") returned 0x0 [0043.760] lstrlenW (lpString=".ldf") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".ldf") returned 0x0 [0043.760] lstrlenW (lpString=".LDF") returned 4 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch=".LDF") returned 0x0 [0043.760] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f088 [0043.760] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0043.761] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0043.761] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.761] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16376236968) returned 1 [0043.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8e61c70, dwHighDateTime=0x1d585b4)) [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0d88 [0043.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0d88 | out: hHeap=0x260000) returned 1 [0043.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.762] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.762] GetLastError () returned 0x0 [0043.762] GetLastError () returned 0x0 [0043.762] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.762] GetLastError () returned 0x0 [0043.762] GetLastError () returned 0x0 [0043.763] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffdd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.763] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x22b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x22b, lpOverlapped=0x0) returned 1 [0043.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.763] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.763] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.764] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.764] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.764] CloseHandle (hObject=0xf8) returned 1 [0043.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.[deadmin@cock.li].deadmin")) returned 1 [0043.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.767] GetLastError () returned 0x0 [0043.767] RtlWakeConditionVariable () returned 0x27e828 [0043.767] GetCurrentThreadId () returned 0x98c [0043.767] GetCurrentThreadId () returned 0x98c [0043.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0043.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2850 | out: hHeap=0x260000) returned 1 [0043.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0043.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2850 [0043.767] lstrlenW (lpString=".ldf") returned 4 [0043.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.767] lstrlenW (lpString=".vhd") returned 4 [0043.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0043.767] lstrlenW (lpString=".vhdx") returned 5 [0043.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0043.767] lstrlenW (lpString=".pst") returned 4 [0043.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0043.768] lstrlenW (lpString=".ost") returned 4 [0043.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0043.768] lstrlenW (lpString=".bak") returned 4 [0043.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0043.768] lstrlenW (lpString=".bac") returned 4 [0043.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0043.768] lstrlenW (lpString=".sys") returned 4 [0043.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0043.768] lstrlenW (lpString=".v2i") returned 4 [0043.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0043.768] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0043.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.769] lstrlenW (lpString=".sql") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0043.769] lstrlenW (lpString=".mdf") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0043.769] lstrlenW (lpString=".txt") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0043.769] lstrlenW (lpString=".dbf") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0043.769] lstrlenW (lpString=".ckp") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0043.769] lstrlenW (lpString=".dacpac") returned 7 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0043.769] lstrlenW (lpString=".db3") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0043.769] lstrlenW (lpString=".dtxs") returned 5 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0043.769] lstrlenW (lpString=".mdt") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0043.769] lstrlenW (lpString=".sdf") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0043.769] lstrlenW (lpString=".MDF") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0043.769] lstrlenW (lpString=".DBF") returned 4 [0043.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0043.770] lstrlenW (lpString=".DB") returned 3 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0043.770] lstrlenW (lpString=".db") returned 3 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0043.770] lstrlenW (lpString=".ndf") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0043.770] lstrlenW (lpString=".NDF") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0043.770] lstrlenW (lpString=".Mdf") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0043.770] lstrlenW (lpString=".dat") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0043.770] lstrlenW (lpString=".DAT") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0043.770] lstrlenW (lpString=".ldf") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.770] lstrlenW (lpString=".LDF") returned 4 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0043.770] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0043.770] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0043.771] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0043.771] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.771] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16377222967) returned 1 [0043.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8e61c70, dwHighDateTime=0x1d585b4)) [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0dc0 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.772] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.772] GetLastError () returned 0x0 [0043.772] GetLastError () returned 0x0 [0043.772] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.772] GetLastError () returned 0x0 [0043.772] GetLastError () returned 0x0 [0043.828] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff9df, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.828] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x621, lpOverlapped=0x0) returned 1 [0043.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.829] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.829] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.830] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.830] CloseHandle (hObject=0xfc) returned 1 [0043.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0043.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.831] GetLastError () returned 0x0 [0043.831] RtlWakeConditionVariable () returned 0x27e828 [0043.831] GetCurrentThreadId () returned 0x98c [0043.831] GetCurrentThreadId () returned 0x98c [0043.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29eb10 [0043.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ebb8 | out: hHeap=0x260000) returned 1 [0043.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382a0 | out: hHeap=0x260000) returned 1 [0043.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ebb8 [0043.831] lstrlenW (lpString=".ldf") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.832] lstrlenW (lpString=".vhd") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0043.832] lstrlenW (lpString=".vhdx") returned 5 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0043.832] lstrlenW (lpString=".pst") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0043.832] lstrlenW (lpString=".ost") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0043.832] lstrlenW (lpString=".bak") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0043.832] lstrlenW (lpString=".bac") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0043.832] lstrlenW (lpString=".sys") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0043.832] lstrlenW (lpString=".v2i") returned 4 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0043.832] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0043.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.914] lstrlenW (lpString=".sql") returned 4 [0043.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0043.915] lstrlenW (lpString=".mdf") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0043.915] lstrlenW (lpString=".txt") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0043.915] lstrlenW (lpString=".dbf") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0043.915] lstrlenW (lpString=".ckp") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0043.915] lstrlenW (lpString=".dacpac") returned 7 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0043.915] lstrlenW (lpString=".db3") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0043.915] lstrlenW (lpString=".dtxs") returned 5 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0043.915] lstrlenW (lpString=".mdt") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0043.915] lstrlenW (lpString=".sdf") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0043.915] lstrlenW (lpString=".MDF") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0043.915] lstrlenW (lpString=".DBF") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0043.915] lstrlenW (lpString=".DB") returned 3 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0043.915] lstrlenW (lpString=".db") returned 3 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0043.915] lstrlenW (lpString=".ndf") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0043.915] lstrlenW (lpString=".NDF") returned 4 [0043.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0043.915] lstrlenW (lpString=".Mdf") returned 4 [0043.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0043.916] lstrlenW (lpString=".dat") returned 4 [0043.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0043.916] lstrlenW (lpString=".DAT") returned 4 [0043.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0043.916] lstrlenW (lpString=".ldf") returned 4 [0043.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.916] lstrlenW (lpString=".LDF") returned 4 [0043.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0043.916] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.916] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.917] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.917] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.917] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16391793681) returned 1 [0043.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8fdea30, dwHighDateTime=0x1d585b4)) [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ced8 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cf80 [0043.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0043.917] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.917] GetLastError () returned 0x0 [0043.918] GetLastError () returned 0x0 [0043.918] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.918] GetLastError () returned 0x0 [0043.918] GetLastError () returned 0x0 [0043.920] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb2bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.920] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x4d44, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x4d44, lpOverlapped=0x0) returned 1 [0043.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.920] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.920] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.920] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.920] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.920] CloseHandle (hObject=0xf8) returned 1 [0043.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0043.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.921] GetLastError () returned 0x0 [0043.921] RtlWakeConditionVariable () returned 0x27e828 [0043.921] GetCurrentThreadId () returned 0x98c [0043.921] GetCurrentThreadId () returned 0x98c [0043.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da538 [0043.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da858 | out: hHeap=0x260000) returned 1 [0043.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce68 | out: hHeap=0x260000) returned 1 [0043.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da858 [0043.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.922] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.922] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.922] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.922] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.923] CloseHandle (hObject=0xf8) returned 1 [0043.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da858 | out: hHeap=0x260000) returned 1 [0043.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0043.923] RtlWakeConditionVariable () returned 0x27e828 [0043.923] GetCurrentThreadId () returned 0x98c [0043.923] GetCurrentThreadId () returned 0x98c [0043.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0043.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4008 | out: hHeap=0x260000) returned 1 [0043.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce30 | out: hHeap=0x260000) returned 1 [0043.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f4008 [0043.923] lstrlenW (lpString=".ldf") returned 4 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".ldf") returned 0x0 [0043.923] lstrlenW (lpString=".vhd") returned 4 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".vhd") returned 0x0 [0043.923] lstrlenW (lpString=".vhdx") returned 5 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".vhdx") returned 0x0 [0043.923] lstrlenW (lpString=".pst") returned 4 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".pst") returned 0x0 [0043.923] lstrlenW (lpString=".ost") returned 4 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".ost") returned 0x0 [0043.923] lstrlenW (lpString=".bak") returned 4 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".bak") returned 0x0 [0043.923] lstrlenW (lpString=".bac") returned 4 [0043.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".bac") returned 0x0 [0043.923] lstrlenW (lpString=".sys") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".sys") returned 0x0 [0043.924] lstrlenW (lpString=".v2i") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".v2i") returned 0x0 [0043.924] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0043.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.924] lstrlenW (lpString=".sql") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".sql") returned 0x0 [0043.924] lstrlenW (lpString=".mdf") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".mdf") returned 0x0 [0043.924] lstrlenW (lpString=".txt") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".txt") returned 0x0 [0043.924] lstrlenW (lpString=".dbf") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".dbf") returned 0x0 [0043.924] lstrlenW (lpString=".ckp") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".ckp") returned 0x0 [0043.924] lstrlenW (lpString=".dacpac") returned 7 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".dacpac") returned 0x0 [0043.924] lstrlenW (lpString=".db3") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".db3") returned 0x0 [0043.924] lstrlenW (lpString=".dtxs") returned 5 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".dtxs") returned 0x0 [0043.924] lstrlenW (lpString=".mdt") returned 4 [0043.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".mdt") returned 0x0 [0043.925] lstrlenW (lpString=".sdf") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".sdf") returned 0x0 [0043.925] lstrlenW (lpString=".MDF") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".MDF") returned 0x0 [0043.925] lstrlenW (lpString=".DBF") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".DBF") returned 0x0 [0043.925] lstrlenW (lpString=".DB") returned 3 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".DB") returned 0x0 [0043.925] lstrlenW (lpString=".db") returned 3 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".db") returned 0x0 [0043.925] lstrlenW (lpString=".ndf") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".ndf") returned 0x0 [0043.925] lstrlenW (lpString=".NDF") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".NDF") returned 0x0 [0043.925] lstrlenW (lpString=".Mdf") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".Mdf") returned 0x0 [0043.925] lstrlenW (lpString=".dat") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".dat") returned 0x0 [0043.925] lstrlenW (lpString=".DAT") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".DAT") returned 0x0 [0043.925] lstrlenW (lpString=".ldf") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".ldf") returned 0x0 [0043.925] lstrlenW (lpString=".LDF") returned 4 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch=".LDF") returned 0x0 [0043.925] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.925] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.926] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.926] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.926] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16392752340) returned 1 [0043.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa8fdea30, dwHighDateTime=0x1d585b4)) [0043.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ce30 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce30 | out: hHeap=0x260000) returned 1 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.927] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.927] GetLastError () returned 0x0 [0043.927] GetLastError () returned 0x0 [0043.927] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.927] GetLastError () returned 0x0 [0043.927] GetLastError () returned 0x0 [0043.929] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff3d46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.929] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xc2ba, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0xc2ba, lpOverlapped=0x0) returned 1 [0043.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.930] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.930] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.930] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.930] CloseHandle (hObject=0xf8) returned 1 [0043.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.[deadmin@cock.li].deadmin")) returned 1 [0043.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.931] GetLastError () returned 0x0 [0043.931] RtlWakeConditionVariable () returned 0x27e828 [0043.931] GetCurrentThreadId () returned 0x98c [0043.931] GetCurrentThreadId () returned 0x98c [0043.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0043.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3b00 | out: hHeap=0x260000) returned 1 [0043.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdf8 | out: hHeap=0x260000) returned 1 [0043.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0043.931] lstrlenW (lpString=".ldf") returned 4 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".ldf") returned 0x0 [0043.931] lstrlenW (lpString=".vhd") returned 4 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".vhd") returned 0x0 [0043.931] lstrlenW (lpString=".vhdx") returned 5 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".vhdx") returned 0x0 [0043.931] lstrlenW (lpString=".pst") returned 4 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".pst") returned 0x0 [0043.931] lstrlenW (lpString=".ost") returned 4 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".ost") returned 0x0 [0043.931] lstrlenW (lpString=".bak") returned 4 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".bak") returned 0x0 [0043.931] lstrlenW (lpString=".bac") returned 4 [0043.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".bac") returned 0x0 [0043.932] lstrlenW (lpString=".sys") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".sys") returned 0x0 [0043.932] lstrlenW (lpString=".v2i") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".v2i") returned 0x0 [0043.932] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch="s\r\n.v2i") returned 0x0 [0043.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.932] lstrlenW (lpString=".sql") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".sql") returned 0x0 [0043.932] lstrlenW (lpString=".mdf") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".mdf") returned 0x0 [0043.932] lstrlenW (lpString=".txt") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".txt") returned 0x0 [0043.932] lstrlenW (lpString=".dbf") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".dbf") returned 0x0 [0043.932] lstrlenW (lpString=".ckp") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".ckp") returned 0x0 [0043.932] lstrlenW (lpString=".dacpac") returned 7 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".dacpac") returned 0x0 [0043.932] lstrlenW (lpString=".db3") returned 4 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".db3") returned 0x0 [0043.932] lstrlenW (lpString=".dtxs") returned 5 [0043.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".dtxs") returned 0x0 [0043.932] lstrlenW (lpString=".mdt") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".mdt") returned 0x0 [0043.933] lstrlenW (lpString=".sdf") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".sdf") returned 0x0 [0043.933] lstrlenW (lpString=".MDF") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".MDF") returned 0x0 [0043.933] lstrlenW (lpString=".DBF") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".DBF") returned 0x0 [0043.933] lstrlenW (lpString=".DB") returned 3 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".DB") returned 0x0 [0043.933] lstrlenW (lpString=".db") returned 3 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".db") returned 0x0 [0043.933] lstrlenW (lpString=".ndf") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".ndf") returned 0x0 [0043.933] lstrlenW (lpString=".NDF") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".NDF") returned 0x0 [0043.933] lstrlenW (lpString=".Mdf") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".Mdf") returned 0x0 [0043.933] lstrlenW (lpString=".dat") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".dat") returned 0x0 [0043.933] lstrlenW (lpString=".DAT") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".DAT") returned 0x0 [0043.933] lstrlenW (lpString=".ldf") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".ldf") returned 0x0 [0043.933] lstrlenW (lpString=".LDF") returned 4 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch=".LDF") returned 0x0 [0043.933] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.933] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0043.934] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.934] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.934] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16393547031) returned 1 [0043.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9004b90, dwHighDateTime=0x1d585b4)) [0043.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdf8 [0043.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdf8 | out: hHeap=0x260000) returned 1 [0043.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.935] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.935] GetLastError () returned 0x0 [0043.935] GetLastError () returned 0x0 [0043.935] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.935] GetLastError () returned 0x0 [0043.935] GetLastError () returned 0x0 [0043.936] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffdd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.936] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x227, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x227, lpOverlapped=0x0) returned 1 [0043.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.937] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.937] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.937] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.937] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.937] CloseHandle (hObject=0xf8) returned 1 [0043.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.[deadmin@cock.li].deadmin")) returned 1 [0043.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.939] GetLastError () returned 0x0 [0043.939] RtlWakeConditionVariable () returned 0x27e828 [0043.939] GetCurrentThreadId () returned 0x98c [0043.939] GetCurrentThreadId () returned 0x98c [0043.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0043.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3a48 | out: hHeap=0x260000) returned 1 [0043.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdc0 | out: hHeap=0x260000) returned 1 [0043.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3a48 [0043.940] lstrlenW (lpString=".ldf") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.940] lstrlenW (lpString=".vhd") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0043.940] lstrlenW (lpString=".vhdx") returned 5 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0043.940] lstrlenW (lpString=".pst") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0043.940] lstrlenW (lpString=".ost") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0043.940] lstrlenW (lpString=".bak") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0043.940] lstrlenW (lpString=".bac") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0043.940] lstrlenW (lpString=".sys") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0043.940] lstrlenW (lpString=".v2i") returned 4 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0043.940] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0043.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.940] lstrlenW (lpString=".sql") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0043.941] lstrlenW (lpString=".mdf") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0043.941] lstrlenW (lpString=".txt") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0043.941] lstrlenW (lpString=".dbf") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0043.941] lstrlenW (lpString=".ckp") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0043.941] lstrlenW (lpString=".dacpac") returned 7 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0043.941] lstrlenW (lpString=".db3") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0043.941] lstrlenW (lpString=".dtxs") returned 5 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0043.941] lstrlenW (lpString=".mdt") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0043.941] lstrlenW (lpString=".sdf") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0043.941] lstrlenW (lpString=".MDF") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0043.941] lstrlenW (lpString=".DBF") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0043.941] lstrlenW (lpString=".DB") returned 3 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0043.941] lstrlenW (lpString=".db") returned 3 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0043.941] lstrlenW (lpString=".ndf") returned 4 [0043.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0043.941] lstrlenW (lpString=".NDF") returned 4 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0043.942] lstrlenW (lpString=".Mdf") returned 4 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0043.942] lstrlenW (lpString=".dat") returned 4 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0043.942] lstrlenW (lpString=".DAT") returned 4 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0043.942] lstrlenW (lpString=".ldf") returned 4 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.942] lstrlenW (lpString=".LDF") returned 4 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0043.942] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.942] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0043.943] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.943] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0043.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.943] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16394405303) returned 1 [0043.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9004b90, dwHighDateTime=0x1d585b4)) [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdc0 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdc0 | out: hHeap=0x260000) returned 1 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.943] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0043.944] GetLastError () returned 0x0 [0043.944] GetLastError () returned 0x0 [0043.944] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0043.944] GetLastError () returned 0x0 [0043.944] GetLastError () returned 0x0 [0044.050] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff9e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.055] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x618, lpOverlapped=0x0) returned 1 [0044.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.058] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.058] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.058] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.058] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.058] CloseHandle (hObject=0xf8) returned 1 [0044.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.059] GetLastError () returned 0x0 [0044.059] RtlWakeConditionVariable () returned 0x27e828 [0044.059] GetCurrentThreadId () returned 0x98c [0044.059] GetCurrentThreadId () returned 0x98c [0044.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e228 | out: hHeap=0x260000) returned 1 [0044.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc70 | out: hHeap=0x260000) returned 1 [0044.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e228 [0044.059] lstrlenW (lpString=".ldf") returned 4 [0044.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".ldf") returned 0x0 [0044.059] lstrlenW (lpString=".vhd") returned 4 [0044.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".vhd") returned 0x0 [0044.059] lstrlenW (lpString=".vhdx") returned 5 [0044.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".vhdx") returned 0x0 [0044.059] lstrlenW (lpString=".pst") returned 4 [0044.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".pst") returned 0x0 [0044.059] lstrlenW (lpString=".ost") returned 4 [0044.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".ost") returned 0x0 [0044.059] lstrlenW (lpString=".bak") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".bak") returned 0x0 [0044.060] lstrlenW (lpString=".bac") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".bac") returned 0x0 [0044.060] lstrlenW (lpString=".sys") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".sys") returned 0x0 [0044.060] lstrlenW (lpString=".v2i") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".v2i") returned 0x0 [0044.060] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.060] lstrlenW (lpString=".sql") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".sql") returned 0x0 [0044.060] lstrlenW (lpString=".mdf") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".mdf") returned 0x0 [0044.060] lstrlenW (lpString=".txt") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".txt") returned 0x0 [0044.060] lstrlenW (lpString=".dbf") returned 4 [0044.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".dbf") returned 0x0 [0044.061] lstrlenW (lpString=".ckp") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".ckp") returned 0x0 [0044.061] lstrlenW (lpString=".dacpac") returned 7 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".dacpac") returned 0x0 [0044.061] lstrlenW (lpString=".db3") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".db3") returned 0x0 [0044.061] lstrlenW (lpString=".dtxs") returned 5 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".dtxs") returned 0x0 [0044.061] lstrlenW (lpString=".mdt") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".mdt") returned 0x0 [0044.061] lstrlenW (lpString=".sdf") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".sdf") returned 0x0 [0044.061] lstrlenW (lpString=".MDF") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".MDF") returned 0x0 [0044.061] lstrlenW (lpString=".DBF") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".DBF") returned 0x0 [0044.061] lstrlenW (lpString=".DB") returned 3 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".DB") returned 0x0 [0044.061] lstrlenW (lpString=".db") returned 3 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".db") returned 0x0 [0044.061] lstrlenW (lpString=".ndf") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".ndf") returned 0x0 [0044.061] lstrlenW (lpString=".NDF") returned 4 [0044.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".NDF") returned 0x0 [0044.061] lstrlenW (lpString=".Mdf") returned 4 [0044.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".Mdf") returned 0x0 [0044.062] lstrlenW (lpString=".dat") returned 4 [0044.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".dat") returned 0x0 [0044.062] lstrlenW (lpString=".DAT") returned 4 [0044.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".DAT") returned 0x0 [0044.062] lstrlenW (lpString=".ldf") returned 4 [0044.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".ldf") returned 0x0 [0044.062] lstrlenW (lpString=".LDF") returned 4 [0044.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch=".LDF") returned 0x0 [0044.062] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.062] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.063] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.063] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.063] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16406418643) returned 1 [0044.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9135690, dwHighDateTime=0x1d585b4)) [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc70 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc70 | out: hHeap=0x260000) returned 1 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0044.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b688 [0044.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0044.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b688 | out: hHeap=0x260000) returned 1 [0044.064] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.064] GetLastError () returned 0x0 [0044.064] GetLastError () returned 0x0 [0044.064] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.064] GetLastError () returned 0x0 [0044.064] GetLastError () returned 0x0 [0044.068] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.069] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0044.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.069] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.069] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.069] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.069] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.069] CloseHandle (hObject=0xf8) returned 1 [0044.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.070] GetLastError () returned 0x0 [0044.071] RtlWakeConditionVariable () returned 0x27e828 [0044.071] GetCurrentThreadId () returned 0x98c [0044.071] GetCurrentThreadId () returned 0x98c [0044.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc38 | out: hHeap=0x260000) returned 1 [0044.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.071] lstrlenW (lpString=".ldf") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".ldf") returned 0x0 [0044.071] lstrlenW (lpString=".vhd") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".vhd") returned 0x0 [0044.071] lstrlenW (lpString=".vhdx") returned 5 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".vhdx") returned 0x0 [0044.071] lstrlenW (lpString=".pst") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".pst") returned 0x0 [0044.071] lstrlenW (lpString=".ost") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".ost") returned 0x0 [0044.071] lstrlenW (lpString=".bak") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".bak") returned 0x0 [0044.071] lstrlenW (lpString=".bac") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".bac") returned 0x0 [0044.071] lstrlenW (lpString=".sys") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".sys") returned 0x0 [0044.071] lstrlenW (lpString=".v2i") returned 4 [0044.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".v2i") returned 0x0 [0044.072] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.073] lstrlenW (lpString=".sql") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".sql") returned 0x0 [0044.073] lstrlenW (lpString=".mdf") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".mdf") returned 0x0 [0044.073] lstrlenW (lpString=".txt") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".txt") returned 0x0 [0044.073] lstrlenW (lpString=".dbf") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".dbf") returned 0x0 [0044.073] lstrlenW (lpString=".ckp") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".ckp") returned 0x0 [0044.073] lstrlenW (lpString=".dacpac") returned 7 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".dacpac") returned 0x0 [0044.073] lstrlenW (lpString=".db3") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".db3") returned 0x0 [0044.073] lstrlenW (lpString=".dtxs") returned 5 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".dtxs") returned 0x0 [0044.073] lstrlenW (lpString=".mdt") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".mdt") returned 0x0 [0044.073] lstrlenW (lpString=".sdf") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".sdf") returned 0x0 [0044.073] lstrlenW (lpString=".MDF") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".MDF") returned 0x0 [0044.073] lstrlenW (lpString=".DBF") returned 4 [0044.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".DBF") returned 0x0 [0044.074] lstrlenW (lpString=".DB") returned 3 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".DB") returned 0x0 [0044.074] lstrlenW (lpString=".db") returned 3 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".db") returned 0x0 [0044.074] lstrlenW (lpString=".ndf") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".ndf") returned 0x0 [0044.074] lstrlenW (lpString=".NDF") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".NDF") returned 0x0 [0044.074] lstrlenW (lpString=".Mdf") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".Mdf") returned 0x0 [0044.074] lstrlenW (lpString=".dat") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".dat") returned 0x0 [0044.074] lstrlenW (lpString=".DAT") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".DAT") returned 0x0 [0044.074] lstrlenW (lpString=".ldf") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".ldf") returned 0x0 [0044.074] lstrlenW (lpString=".LDF") returned 4 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch=".LDF") returned 0x0 [0044.074] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.074] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.075] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.075] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.075] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16407658018) returned 1 [0044.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa915b7f0, dwHighDateTime=0x1d585b4)) [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc38 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc38 | out: hHeap=0x260000) returned 1 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e228 [0044.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e228 | out: hHeap=0x260000) returned 1 [0044.076] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.076] GetLastError () returned 0x0 [0044.076] GetLastError () returned 0x0 [0044.076] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.076] GetLastError () returned 0x0 [0044.077] GetLastError () returned 0x0 [0044.078] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffe3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.078] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1c2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x1c2, lpOverlapped=0x0) returned 1 [0044.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.078] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.078] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.078] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.079] CloseHandle (hObject=0xf8) returned 1 [0044.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.081] GetLastError () returned 0x0 [0044.081] RtlWakeConditionVariable () returned 0x27e828 [0044.081] GetCurrentThreadId () returned 0x98c [0044.081] GetCurrentThreadId () returned 0x98c [0044.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dc40 | out: hHeap=0x260000) returned 1 [0044.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x260000) returned 1 [0044.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dc40 [0044.081] lstrlenW (lpString=".ldf") returned 4 [0044.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.081] lstrlenW (lpString=".vhd") returned 4 [0044.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.081] lstrlenW (lpString=".vhdx") returned 5 [0044.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.081] lstrlenW (lpString=".pst") returned 4 [0044.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.081] lstrlenW (lpString=".ost") returned 4 [0044.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.081] lstrlenW (lpString=".bak") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.082] lstrlenW (lpString=".bac") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.082] lstrlenW (lpString=".sys") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.082] lstrlenW (lpString=".v2i") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.082] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.082] lstrlenW (lpString=".sql") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.082] lstrlenW (lpString=".mdf") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.082] lstrlenW (lpString=".txt") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.082] lstrlenW (lpString=".dbf") returned 4 [0044.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.083] lstrlenW (lpString=".ckp") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.083] lstrlenW (lpString=".dacpac") returned 7 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.083] lstrlenW (lpString=".db3") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.083] lstrlenW (lpString=".dtxs") returned 5 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.083] lstrlenW (lpString=".mdt") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.083] lstrlenW (lpString=".sdf") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.083] lstrlenW (lpString=".MDF") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.083] lstrlenW (lpString=".DBF") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.083] lstrlenW (lpString=".DB") returned 3 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.083] lstrlenW (lpString=".db") returned 3 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.083] lstrlenW (lpString=".ndf") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.083] lstrlenW (lpString=".NDF") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.083] lstrlenW (lpString=".Mdf") returned 4 [0044.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.083] lstrlenW (lpString=".dat") returned 4 [0044.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.084] lstrlenW (lpString=".DAT") returned 4 [0044.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.084] lstrlenW (lpString=".ldf") returned 4 [0044.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.084] lstrlenW (lpString=".LDF") returned 4 [0044.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.084] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.084] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.085] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.085] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16408608815) returned 1 [0044.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa915b7f0, dwHighDateTime=0x1d585b4)) [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc00 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x260000) returned 1 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.086] GetLastError () returned 0x0 [0044.086] GetLastError () returned 0x0 [0044.086] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.086] GetLastError () returned 0x0 [0044.086] GetLastError () returned 0x0 [0044.087] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff55e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.088] WriteFile (in: hFile=0xf8, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xaa2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0xaa2, lpOverlapped=0x0) returned 1 [0044.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.088] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.088] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.088] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.088] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.088] CloseHandle (hObject=0xf8) returned 1 [0044.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.089] GetLastError () returned 0x0 [0044.089] RtlWakeConditionVariable () returned 0x27e828 [0044.089] GetCurrentThreadId () returned 0x98c [0044.089] GetCurrentThreadId () returned 0x98c [0044.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30db98 | out: hHeap=0x260000) returned 1 [0044.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cbc8 | out: hHeap=0x260000) returned 1 [0044.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30db98 [0044.089] lstrlenW (lpString=".ldf") returned 4 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.089] lstrlenW (lpString=".vhd") returned 4 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.089] lstrlenW (lpString=".vhdx") returned 5 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.089] lstrlenW (lpString=".pst") returned 4 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.089] lstrlenW (lpString=".ost") returned 4 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.089] lstrlenW (lpString=".bak") returned 4 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.089] lstrlenW (lpString=".bac") returned 4 [0044.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.089] lstrlenW (lpString=".sys") returned 4 [0044.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.090] lstrlenW (lpString=".v2i") returned 4 [0044.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.090] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.146] lstrlenW (lpString=".sql") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.146] lstrlenW (lpString=".mdf") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.146] lstrlenW (lpString=".txt") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.146] lstrlenW (lpString=".dbf") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.146] lstrlenW (lpString=".ckp") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.146] lstrlenW (lpString=".dacpac") returned 7 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.146] lstrlenW (lpString=".db3") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.146] lstrlenW (lpString=".dtxs") returned 5 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.147] lstrlenW (lpString=".mdt") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.147] lstrlenW (lpString=".sdf") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.147] lstrlenW (lpString=".MDF") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.147] lstrlenW (lpString=".DBF") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.147] lstrlenW (lpString=".DB") returned 3 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.147] lstrlenW (lpString=".db") returned 3 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.147] lstrlenW (lpString=".ndf") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.147] lstrlenW (lpString=".NDF") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.147] lstrlenW (lpString=".Mdf") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.147] lstrlenW (lpString=".dat") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.147] lstrlenW (lpString=".DAT") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.147] lstrlenW (lpString=".ldf") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.147] lstrlenW (lpString=".LDF") returned 4 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.147] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.148] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.148] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0044.149] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16414965162) returned 1 [0044.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9219ed0, dwHighDateTime=0x1d585b4)) [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d1b0 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1b0 | out: hHeap=0x260000) returned 1 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30dc40 [0044.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dc40 | out: hHeap=0x260000) returned 1 [0044.149] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.149] GetLastError () returned 0x0 [0044.149] GetLastError () returned 0x0 [0044.149] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.149] GetLastError () returned 0x0 [0044.149] GetLastError () returned 0x0 [0044.151] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff56f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.151] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa90c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xa90c, lpOverlapped=0x0) returned 1 [0044.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.151] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.151] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.152] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.152] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.152] CloseHandle (hObject=0x104) returned 1 [0044.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.152] GetLastError () returned 0x0 [0044.152] RtlWakeConditionVariable () returned 0x27e828 [0044.152] GetCurrentThreadId () returned 0x98c [0044.153] GetCurrentThreadId () returned 0x98c [0044.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0044.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381c0 | out: hHeap=0x260000) returned 1 [0044.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0044.153] lstrlenW (lpString=".ldf") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.153] lstrlenW (lpString=".vhd") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.153] lstrlenW (lpString=".vhdx") returned 5 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.153] lstrlenW (lpString=".pst") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.153] lstrlenW (lpString=".ost") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.153] lstrlenW (lpString=".bak") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.153] lstrlenW (lpString=".bac") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.153] lstrlenW (lpString=".sys") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.153] lstrlenW (lpString=".v2i") returned 4 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.153] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.185] lstrlenW (lpString=".sql") returned 4 [0044.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.185] lstrlenW (lpString=".mdf") returned 4 [0044.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.186] lstrlenW (lpString=".txt") returned 4 [0044.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.186] lstrlenW (lpString=".dbf") returned 4 [0044.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.186] lstrlenW (lpString=".ckp") returned 4 [0044.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.188] lstrlenW (lpString=".dacpac") returned 7 [0044.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.197] lstrlenW (lpString=".db3") returned 4 [0044.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.197] lstrlenW (lpString=".dtxs") returned 5 [0044.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.197] lstrlenW (lpString=".mdt") returned 4 [0044.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.197] lstrlenW (lpString=".sdf") returned 4 [0044.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.197] lstrlenW (lpString=".MDF") returned 4 [0044.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.197] lstrlenW (lpString=".DBF") returned 4 [0044.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.206] lstrlenW (lpString=".DB") returned 3 [0044.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.206] lstrlenW (lpString=".db") returned 3 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.211] lstrlenW (lpString=".ndf") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.211] lstrlenW (lpString=".NDF") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.211] lstrlenW (lpString=".Mdf") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.211] lstrlenW (lpString=".dat") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.211] lstrlenW (lpString=".DAT") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.211] lstrlenW (lpString=".ldf") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.211] lstrlenW (lpString=".LDF") returned 4 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.211] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.211] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.212] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.212] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.212] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16421312047) returned 1 [0044.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa92b2450, dwHighDateTime=0x1d585b4)) [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.213] GetLastError () returned 0x0 [0044.213] GetLastError () returned 0x0 [0044.213] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.213] GetLastError () returned 0x0 [0044.213] GetLastError () returned 0x0 [0044.214] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff804, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.214] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x7fc, lpOverlapped=0x0) returned 1 [0044.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.214] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.215] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.215] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.215] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.215] CloseHandle (hObject=0x104) returned 1 [0044.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.215] GetLastError () returned 0x0 [0044.215] RtlWakeConditionVariable () returned 0x27e828 [0044.215] GetCurrentThreadId () returned 0x98c [0044.216] GetCurrentThreadId () returned 0x98c [0044.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3d28 | out: hHeap=0x260000) returned 1 [0044.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0044.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3d28 [0044.216] lstrlenW (lpString=".ldf") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.216] lstrlenW (lpString=".vhd") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.216] lstrlenW (lpString=".vhdx") returned 5 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.216] lstrlenW (lpString=".pst") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.216] lstrlenW (lpString=".ost") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.216] lstrlenW (lpString=".bak") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.216] lstrlenW (lpString=".bac") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.216] lstrlenW (lpString=".sys") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.216] lstrlenW (lpString=".v2i") returned 4 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.216] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.217] lstrlenW (lpString=".sql") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.217] lstrlenW (lpString=".mdf") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.217] lstrlenW (lpString=".txt") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.217] lstrlenW (lpString=".dbf") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.217] lstrlenW (lpString=".ckp") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.217] lstrlenW (lpString=".dacpac") returned 7 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.217] lstrlenW (lpString=".db3") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.217] lstrlenW (lpString=".dtxs") returned 5 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.217] lstrlenW (lpString=".mdt") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.217] lstrlenW (lpString=".sdf") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.217] lstrlenW (lpString=".MDF") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.217] lstrlenW (lpString=".DBF") returned 4 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.217] lstrlenW (lpString=".DB") returned 3 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.217] lstrlenW (lpString=".db") returned 3 [0044.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.218] lstrlenW (lpString=".ndf") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.218] lstrlenW (lpString=".NDF") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.218] lstrlenW (lpString=".Mdf") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.218] lstrlenW (lpString=".dat") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.218] lstrlenW (lpString=".DAT") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.218] lstrlenW (lpString=".ldf") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.218] lstrlenW (lpString=".LDF") returned 4 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.218] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.218] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.219] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.219] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.219] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16422122143) returned 1 [0044.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa92b2450, dwHighDateTime=0x1d585b4)) [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14f8 [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.221] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.221] GetLastError () returned 0x0 [0044.221] GetLastError () returned 0x0 [0044.221] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.221] GetLastError () returned 0x0 [0044.221] GetLastError () returned 0x0 [0044.222] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb06d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.222] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x4f93, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x4f93, lpOverlapped=0x0) returned 1 [0044.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.223] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.223] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.223] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.223] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.223] CloseHandle (hObject=0x104) returned 1 [0044.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.224] GetLastError () returned 0x0 [0044.224] RtlWakeConditionVariable () returned 0x27e828 [0044.224] GetCurrentThreadId () returned 0x98c [0044.224] GetCurrentThreadId () returned 0x98c [0044.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9bd8 | out: hHeap=0x260000) returned 1 [0044.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1300 | out: hHeap=0x260000) returned 1 [0044.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9bd8 [0044.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.224] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.224] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.224] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.224] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.225] CloseHandle (hObject=0x104) returned 1 [0044.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9bd8 | out: hHeap=0x260000) returned 1 [0044.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.225] RtlWakeConditionVariable () returned 0x27e828 [0044.226] GetCurrentThreadId () returned 0x98c [0044.226] GetCurrentThreadId () returned 0x98c [0044.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0044.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e810 | out: hHeap=0x260000) returned 1 [0044.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0044.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e810 [0044.226] lstrlenW (lpString=".ldf") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".ldf") returned 0x0 [0044.226] lstrlenW (lpString=".vhd") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".vhd") returned 0x0 [0044.226] lstrlenW (lpString=".vhdx") returned 5 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".vhdx") returned 0x0 [0044.226] lstrlenW (lpString=".pst") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".pst") returned 0x0 [0044.226] lstrlenW (lpString=".ost") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".ost") returned 0x0 [0044.226] lstrlenW (lpString=".bak") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".bak") returned 0x0 [0044.226] lstrlenW (lpString=".bac") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".bac") returned 0x0 [0044.226] lstrlenW (lpString=".sys") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".sys") returned 0x0 [0044.226] lstrlenW (lpString=".v2i") returned 4 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".v2i") returned 0x0 [0044.226] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.227] lstrlenW (lpString=".sql") returned 4 [0044.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".sql") returned 0x0 [0044.227] lstrlenW (lpString=".mdf") returned 4 [0044.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".mdf") returned 0x0 [0044.227] lstrlenW (lpString=".txt") returned 4 [0044.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".txt") returned 0x0 [0044.227] lstrlenW (lpString=".dbf") returned 4 [0044.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".dbf") returned 0x0 [0044.227] lstrlenW (lpString=".ckp") returned 4 [0044.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".ckp") returned 0x0 [0044.227] lstrlenW (lpString=".dacpac") returned 7 [0044.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".dacpac") returned 0x0 [0044.228] lstrlenW (lpString=".db3") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".db3") returned 0x0 [0044.228] lstrlenW (lpString=".dtxs") returned 5 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".dtxs") returned 0x0 [0044.228] lstrlenW (lpString=".mdt") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".mdt") returned 0x0 [0044.228] lstrlenW (lpString=".sdf") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".sdf") returned 0x0 [0044.228] lstrlenW (lpString=".MDF") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".MDF") returned 0x0 [0044.228] lstrlenW (lpString=".DBF") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".DBF") returned 0x0 [0044.228] lstrlenW (lpString=".DB") returned 3 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".DB") returned 0x0 [0044.228] lstrlenW (lpString=".db") returned 3 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".db") returned 0x0 [0044.228] lstrlenW (lpString=".ndf") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".ndf") returned 0x0 [0044.228] lstrlenW (lpString=".NDF") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".NDF") returned 0x0 [0044.228] lstrlenW (lpString=".Mdf") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".Mdf") returned 0x0 [0044.228] lstrlenW (lpString=".dat") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".dat") returned 0x0 [0044.228] lstrlenW (lpString=".DAT") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".DAT") returned 0x0 [0044.228] lstrlenW (lpString=".ldf") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".ldf") returned 0x0 [0044.228] lstrlenW (lpString=".LDF") returned 4 [0044.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch=".LDF") returned 0x0 [0044.228] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.229] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.229] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.229] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16423063665) returned 1 [0044.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa92d85b0, dwHighDateTime=0x1d585b4)) [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1418 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e570 [0044.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e570 | out: hHeap=0x260000) returned 1 [0044.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.230] GetLastError () returned 0x0 [0044.230] GetLastError () returned 0x0 [0044.230] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.230] GetLastError () returned 0x0 [0044.230] GetLastError () returned 0x0 [0044.232] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff29ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.232] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xd613, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0xd613, lpOverlapped=0x0) returned 1 [0044.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.233] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.233] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.233] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.233] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.233] CloseHandle (hObject=0x104) returned 1 [0044.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.234] GetLastError () returned 0x0 [0044.234] RtlWakeConditionVariable () returned 0x27e828 [0044.234] GetCurrentThreadId () returned 0x98c [0044.234] GetCurrentThreadId () returned 0x98c [0044.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0044.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e768 | out: hHeap=0x260000) returned 1 [0044.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0044.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e768 [0044.234] lstrlenW (lpString=".ldf") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".ldf") returned 0x0 [0044.234] lstrlenW (lpString=".vhd") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".vhd") returned 0x0 [0044.234] lstrlenW (lpString=".vhdx") returned 5 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".vhdx") returned 0x0 [0044.234] lstrlenW (lpString=".pst") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".pst") returned 0x0 [0044.234] lstrlenW (lpString=".ost") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".ost") returned 0x0 [0044.234] lstrlenW (lpString=".bak") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".bak") returned 0x0 [0044.234] lstrlenW (lpString=".bac") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".bac") returned 0x0 [0044.234] lstrlenW (lpString=".sys") returned 4 [0044.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".sys") returned 0x0 [0044.234] lstrlenW (lpString=".v2i") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".v2i") returned 0x0 [0044.235] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.235] lstrlenW (lpString=".sql") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".sql") returned 0x0 [0044.235] lstrlenW (lpString=".mdf") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".mdf") returned 0x0 [0044.235] lstrlenW (lpString=".txt") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".txt") returned 0x0 [0044.235] lstrlenW (lpString=".dbf") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".dbf") returned 0x0 [0044.235] lstrlenW (lpString=".ckp") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".ckp") returned 0x0 [0044.235] lstrlenW (lpString=".dacpac") returned 7 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".dacpac") returned 0x0 [0044.235] lstrlenW (lpString=".db3") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".db3") returned 0x0 [0044.235] lstrlenW (lpString=".dtxs") returned 5 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".dtxs") returned 0x0 [0044.235] lstrlenW (lpString=".mdt") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".mdt") returned 0x0 [0044.235] lstrlenW (lpString=".sdf") returned 4 [0044.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".sdf") returned 0x0 [0044.236] lstrlenW (lpString=".MDF") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".MDF") returned 0x0 [0044.236] lstrlenW (lpString=".DBF") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".DBF") returned 0x0 [0044.236] lstrlenW (lpString=".DB") returned 3 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".DB") returned 0x0 [0044.236] lstrlenW (lpString=".db") returned 3 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".db") returned 0x0 [0044.236] lstrlenW (lpString=".ndf") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".ndf") returned 0x0 [0044.236] lstrlenW (lpString=".NDF") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".NDF") returned 0x0 [0044.236] lstrlenW (lpString=".Mdf") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".Mdf") returned 0x0 [0044.236] lstrlenW (lpString=".dat") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".dat") returned 0x0 [0044.236] lstrlenW (lpString=".DAT") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".DAT") returned 0x0 [0044.236] lstrlenW (lpString=".ldf") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".ldf") returned 0x0 [0044.236] lstrlenW (lpString=".LDF") returned 4 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch=".LDF") returned 0x0 [0044.236] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.236] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.237] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.237] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16423837265) returned 1 [0044.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa92d85b0, dwHighDateTime=0x1d585b4)) [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11b0 [0044.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0044.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e810 [0044.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e810 | out: hHeap=0x260000) returned 1 [0044.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.238] GetLastError () returned 0x0 [0044.238] GetLastError () returned 0x0 [0044.238] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.238] GetLastError () returned 0x0 [0044.238] GetLastError () returned 0x0 [0044.239] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffe1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.239] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1e6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x1e6, lpOverlapped=0x0) returned 1 [0044.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.240] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.240] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.240] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.240] CloseHandle (hObject=0x104) returned 1 [0044.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.242] GetLastError () returned 0x0 [0044.242] RtlWakeConditionVariable () returned 0x27e828 [0044.242] GetCurrentThreadId () returned 0x98c [0044.242] GetCurrentThreadId () returned 0x98c [0044.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0044.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e8b8 | out: hHeap=0x260000) returned 1 [0044.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11e8 | out: hHeap=0x260000) returned 1 [0044.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e8b8 [0044.243] lstrlenW (lpString=".ldf") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.243] lstrlenW (lpString=".vhd") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.243] lstrlenW (lpString=".vhdx") returned 5 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.243] lstrlenW (lpString=".pst") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.243] lstrlenW (lpString=".ost") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.243] lstrlenW (lpString=".bak") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.243] lstrlenW (lpString=".bac") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.243] lstrlenW (lpString=".sys") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.243] lstrlenW (lpString=".v2i") returned 4 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.243] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.243] lstrlenW (lpString=".sql") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.244] lstrlenW (lpString=".mdf") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.244] lstrlenW (lpString=".txt") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.244] lstrlenW (lpString=".dbf") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.244] lstrlenW (lpString=".ckp") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.244] lstrlenW (lpString=".dacpac") returned 7 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.244] lstrlenW (lpString=".db3") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.244] lstrlenW (lpString=".dtxs") returned 5 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.244] lstrlenW (lpString=".mdt") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.244] lstrlenW (lpString=".sdf") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.244] lstrlenW (lpString=".MDF") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.244] lstrlenW (lpString=".DBF") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.244] lstrlenW (lpString=".DB") returned 3 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.244] lstrlenW (lpString=".db") returned 3 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.244] lstrlenW (lpString=".ndf") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.244] lstrlenW (lpString=".NDF") returned 4 [0044.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.245] lstrlenW (lpString=".Mdf") returned 4 [0044.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.245] lstrlenW (lpString=".dat") returned 4 [0044.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.245] lstrlenW (lpString=".DAT") returned 4 [0044.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.245] lstrlenW (lpString=".ldf") returned 4 [0044.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.245] lstrlenW (lpString=".LDF") returned 4 [0044.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.245] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.245] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.246] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.246] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16424700594) returned 1 [0044.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa92fe710, dwHighDateTime=0x1d585b4)) [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11e8 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11e8 | out: hHeap=0x260000) returned 1 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e768 [0044.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e768 | out: hHeap=0x260000) returned 1 [0044.246] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.246] GetLastError () returned 0x0 [0044.247] GetLastError () returned 0x0 [0044.247] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.247] GetLastError () returned 0x0 [0044.247] GetLastError () returned 0x0 [0044.248] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffaf3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.248] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x50d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x50d, lpOverlapped=0x0) returned 1 [0044.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.248] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.248] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.249] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.249] CloseHandle (hObject=0x104) returned 1 [0044.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.249] GetLastError () returned 0x0 [0044.249] RtlWakeConditionVariable () returned 0x27e828 [0044.249] GetCurrentThreadId () returned 0x98c [0044.249] GetCurrentThreadId () returned 0x98c [0044.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0044.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1220 | out: hHeap=0x260000) returned 1 [0044.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0044.250] lstrlenW (lpString=".ldf") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.250] lstrlenW (lpString=".vhd") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.250] lstrlenW (lpString=".vhdx") returned 5 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.250] lstrlenW (lpString=".pst") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.250] lstrlenW (lpString=".ost") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.250] lstrlenW (lpString=".bak") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.250] lstrlenW (lpString=".bac") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.250] lstrlenW (lpString=".sys") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.250] lstrlenW (lpString=".v2i") returned 4 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.250] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.251] lstrlenW (lpString=".sql") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.251] lstrlenW (lpString=".mdf") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.251] lstrlenW (lpString=".txt") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.251] lstrlenW (lpString=".dbf") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.251] lstrlenW (lpString=".ckp") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.251] lstrlenW (lpString=".dacpac") returned 7 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.251] lstrlenW (lpString=".db3") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.251] lstrlenW (lpString=".dtxs") returned 5 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.251] lstrlenW (lpString=".mdt") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.251] lstrlenW (lpString=".sdf") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.251] lstrlenW (lpString=".MDF") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.251] lstrlenW (lpString=".DBF") returned 4 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.251] lstrlenW (lpString=".DB") returned 3 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.251] lstrlenW (lpString=".db") returned 3 [0044.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.252] lstrlenW (lpString=".ndf") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.252] lstrlenW (lpString=".NDF") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.252] lstrlenW (lpString=".Mdf") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.252] lstrlenW (lpString=".dat") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.252] lstrlenW (lpString=".DAT") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.252] lstrlenW (lpString=".ldf") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.252] lstrlenW (lpString=".LDF") returned 4 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.252] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.252] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.253] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.253] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.253] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16425409584) returned 1 [0044.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa92fe710, dwHighDateTime=0x1d585b4)) [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1220 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1220 | out: hHeap=0x260000) returned 1 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.254] GetLastError () returned 0x0 [0044.254] GetLastError () returned 0x0 [0044.254] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.254] GetLastError () returned 0x0 [0044.254] GetLastError () returned 0x0 [0044.255] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffafa1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.255] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x505f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x505f, lpOverlapped=0x0) returned 1 [0044.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.256] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.256] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.256] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.256] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.256] CloseHandle (hObject=0x104) returned 1 [0044.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.257] GetLastError () returned 0x0 [0044.257] RtlWakeConditionVariable () returned 0x27e828 [0044.257] GetCurrentThreadId () returned 0x98c [0044.257] GetCurrentThreadId () returned 0x98c [0044.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db280 | out: hHeap=0x260000) returned 1 [0044.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1258 | out: hHeap=0x260000) returned 1 [0044.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db280 [0044.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.258] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.258] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.258] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.258] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.259] CloseHandle (hObject=0x104) returned 1 [0044.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db280 | out: hHeap=0x260000) returned 1 [0044.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.259] RtlWakeConditionVariable () returned 0x27e828 [0044.259] GetCurrentThreadId () returned 0x98c [0044.259] GetCurrentThreadId () returned 0x98c [0044.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3768 | out: hHeap=0x260000) returned 1 [0044.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0044.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3768 [0044.259] lstrlenW (lpString=".ldf") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".ldf") returned 0x0 [0044.259] lstrlenW (lpString=".vhd") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".vhd") returned 0x0 [0044.259] lstrlenW (lpString=".vhdx") returned 5 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".vhdx") returned 0x0 [0044.259] lstrlenW (lpString=".pst") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".pst") returned 0x0 [0044.259] lstrlenW (lpString=".ost") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".ost") returned 0x0 [0044.259] lstrlenW (lpString=".bak") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".bak") returned 0x0 [0044.259] lstrlenW (lpString=".bac") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".bac") returned 0x0 [0044.259] lstrlenW (lpString=".sys") returned 4 [0044.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".sys") returned 0x0 [0044.259] lstrlenW (lpString=".v2i") returned 4 [0044.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".v2i") returned 0x0 [0044.260] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.260] lstrlenW (lpString=".sql") returned 4 [0044.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".sql") returned 0x0 [0044.260] lstrlenW (lpString=".mdf") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".mdf") returned 0x0 [0044.261] lstrlenW (lpString=".txt") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".txt") returned 0x0 [0044.261] lstrlenW (lpString=".dbf") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".dbf") returned 0x0 [0044.261] lstrlenW (lpString=".ckp") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".ckp") returned 0x0 [0044.261] lstrlenW (lpString=".dacpac") returned 7 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".dacpac") returned 0x0 [0044.261] lstrlenW (lpString=".db3") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".db3") returned 0x0 [0044.261] lstrlenW (lpString=".dtxs") returned 5 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".dtxs") returned 0x0 [0044.261] lstrlenW (lpString=".mdt") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".mdt") returned 0x0 [0044.261] lstrlenW (lpString=".sdf") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".sdf") returned 0x0 [0044.261] lstrlenW (lpString=".MDF") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".MDF") returned 0x0 [0044.261] lstrlenW (lpString=".DBF") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".DBF") returned 0x0 [0044.261] lstrlenW (lpString=".DB") returned 3 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".DB") returned 0x0 [0044.261] lstrlenW (lpString=".db") returned 3 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".db") returned 0x0 [0044.261] lstrlenW (lpString=".ndf") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".ndf") returned 0x0 [0044.261] lstrlenW (lpString=".NDF") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".NDF") returned 0x0 [0044.261] lstrlenW (lpString=".Mdf") returned 4 [0044.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".Mdf") returned 0x0 [0044.262] lstrlenW (lpString=".dat") returned 4 [0044.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".dat") returned 0x0 [0044.262] lstrlenW (lpString=".DAT") returned 4 [0044.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".DAT") returned 0x0 [0044.262] lstrlenW (lpString=".ldf") returned 4 [0044.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".ldf") returned 0x0 [0044.262] lstrlenW (lpString=".LDF") returned 4 [0044.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch=".LDF") returned 0x0 [0044.262] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.262] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.263] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.263] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16426389474) returned 1 [0044.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9324870, dwHighDateTime=0x1d585b4)) [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1290 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.263] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.263] GetLastError () returned 0x0 [0044.264] GetLastError () returned 0x0 [0044.264] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.264] GetLastError () returned 0x0 [0044.264] GetLastError () returned 0x0 [0044.266] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff4e28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.266] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xb1d8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0xb1d8, lpOverlapped=0x0) returned 1 [0044.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.266] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.266] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.266] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.266] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.266] CloseHandle (hObject=0x104) returned 1 [0044.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.266] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.267] GetLastError () returned 0x0 [0044.267] RtlWakeConditionVariable () returned 0x27e828 [0044.267] GetCurrentThreadId () returned 0x98c [0044.267] GetCurrentThreadId () returned 0x98c [0044.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3540 | out: hHeap=0x260000) returned 1 [0044.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0044.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3540 [0044.267] lstrlenW (lpString=".ldf") returned 4 [0044.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".ldf") returned 0x0 [0044.267] lstrlenW (lpString=".vhd") returned 4 [0044.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".vhd") returned 0x0 [0044.267] lstrlenW (lpString=".vhdx") returned 5 [0044.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".vhdx") returned 0x0 [0044.267] lstrlenW (lpString=".pst") returned 4 [0044.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".pst") returned 0x0 [0044.267] lstrlenW (lpString=".ost") returned 4 [0044.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".ost") returned 0x0 [0044.268] lstrlenW (lpString=".bak") returned 4 [0044.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".bak") returned 0x0 [0044.268] lstrlenW (lpString=".bac") returned 4 [0044.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".bac") returned 0x0 [0044.268] lstrlenW (lpString=".sys") returned 4 [0044.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".sys") returned 0x0 [0044.268] lstrlenW (lpString=".v2i") returned 4 [0044.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".v2i") returned 0x0 [0044.268] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.269] lstrlenW (lpString=".sql") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".sql") returned 0x0 [0044.269] lstrlenW (lpString=".mdf") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".mdf") returned 0x0 [0044.269] lstrlenW (lpString=".txt") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".txt") returned 0x0 [0044.269] lstrlenW (lpString=".dbf") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".dbf") returned 0x0 [0044.269] lstrlenW (lpString=".ckp") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".ckp") returned 0x0 [0044.269] lstrlenW (lpString=".dacpac") returned 7 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".dacpac") returned 0x0 [0044.269] lstrlenW (lpString=".db3") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".db3") returned 0x0 [0044.269] lstrlenW (lpString=".dtxs") returned 5 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".dtxs") returned 0x0 [0044.269] lstrlenW (lpString=".mdt") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".mdt") returned 0x0 [0044.269] lstrlenW (lpString=".sdf") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".sdf") returned 0x0 [0044.269] lstrlenW (lpString=".MDF") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".MDF") returned 0x0 [0044.269] lstrlenW (lpString=".DBF") returned 4 [0044.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".DBF") returned 0x0 [0044.270] lstrlenW (lpString=".DB") returned 3 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".DB") returned 0x0 [0044.270] lstrlenW (lpString=".db") returned 3 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".db") returned 0x0 [0044.270] lstrlenW (lpString=".ndf") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".ndf") returned 0x0 [0044.270] lstrlenW (lpString=".NDF") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".NDF") returned 0x0 [0044.270] lstrlenW (lpString=".Mdf") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".Mdf") returned 0x0 [0044.270] lstrlenW (lpString=".dat") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".dat") returned 0x0 [0044.270] lstrlenW (lpString=".DAT") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".DAT") returned 0x0 [0044.270] lstrlenW (lpString=".ldf") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".ldf") returned 0x0 [0044.270] lstrlenW (lpString=".LDF") returned 4 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch=".LDF") returned 0x0 [0044.270] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.270] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.271] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.271] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.271] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16427223159) returned 1 [0044.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9324870, dwHighDateTime=0x1d585b4)) [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.272] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.272] GetLastError () returned 0x0 [0044.272] GetLastError () returned 0x0 [0044.272] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.272] GetLastError () returned 0x0 [0044.272] GetLastError () returned 0x0 [0044.274] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffe20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.274] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x224fdb0*=0x1e0, lpOverlapped=0x0) returned 1 [0044.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.274] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.274] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.274] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.274] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.274] CloseHandle (hObject=0x104) returned 1 [0044.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.431] GetLastError () returned 0x0 [0044.431] RtlWakeConditionVariable () returned 0x27e828 [0044.431] GetCurrentThreadId () returned 0x98c [0044.431] GetCurrentThreadId () returned 0x98c [0044.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad08 | out: hHeap=0x260000) returned 1 [0044.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d320 | out: hHeap=0x260000) returned 1 [0044.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0044.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.431] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.431] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.431] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.431] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.432] CloseHandle (hObject=0x104) returned 1 [0044.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad08 | out: hHeap=0x260000) returned 1 [0044.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.433] RtlWakeConditionVariable () returned 0x27e828 [0044.433] GetCurrentThreadId () returned 0x98c [0044.433] GetCurrentThreadId () returned 0x98c [0044.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e6c0 | out: hHeap=0x260000) returned 1 [0044.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d2e8 | out: hHeap=0x260000) returned 1 [0044.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0044.433] lstrlenW (lpString=".ldf") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".ldf") returned 0x0 [0044.433] lstrlenW (lpString=".vhd") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".vhd") returned 0x0 [0044.433] lstrlenW (lpString=".vhdx") returned 5 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".vhdx") returned 0x0 [0044.433] lstrlenW (lpString=".pst") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".pst") returned 0x0 [0044.433] lstrlenW (lpString=".ost") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".ost") returned 0x0 [0044.433] lstrlenW (lpString=".bak") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".bak") returned 0x0 [0044.433] lstrlenW (lpString=".bac") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".bac") returned 0x0 [0044.433] lstrlenW (lpString=".sys") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".sys") returned 0x0 [0044.433] lstrlenW (lpString=".v2i") returned 4 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".v2i") returned 0x0 [0044.433] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.434] lstrlenW (lpString=".sql") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".sql") returned 0x0 [0044.434] lstrlenW (lpString=".mdf") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".mdf") returned 0x0 [0044.434] lstrlenW (lpString=".txt") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".txt") returned 0x0 [0044.434] lstrlenW (lpString=".dbf") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".dbf") returned 0x0 [0044.434] lstrlenW (lpString=".ckp") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".ckp") returned 0x0 [0044.434] lstrlenW (lpString=".dacpac") returned 7 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".dacpac") returned 0x0 [0044.434] lstrlenW (lpString=".db3") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".db3") returned 0x0 [0044.434] lstrlenW (lpString=".dtxs") returned 5 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".dtxs") returned 0x0 [0044.434] lstrlenW (lpString=".mdt") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".mdt") returned 0x0 [0044.434] lstrlenW (lpString=".sdf") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".sdf") returned 0x0 [0044.434] lstrlenW (lpString=".MDF") returned 4 [0044.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".MDF") returned 0x0 [0044.435] lstrlenW (lpString=".DBF") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".DBF") returned 0x0 [0044.435] lstrlenW (lpString=".DB") returned 3 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".DB") returned 0x0 [0044.435] lstrlenW (lpString=".db") returned 3 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".db") returned 0x0 [0044.435] lstrlenW (lpString=".ndf") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".ndf") returned 0x0 [0044.435] lstrlenW (lpString=".NDF") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".NDF") returned 0x0 [0044.435] lstrlenW (lpString=".Mdf") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".Mdf") returned 0x0 [0044.435] lstrlenW (lpString=".dat") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".dat") returned 0x0 [0044.435] lstrlenW (lpString=".DAT") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".DAT") returned 0x0 [0044.435] lstrlenW (lpString=".ldf") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".ldf") returned 0x0 [0044.435] lstrlenW (lpString=".LDF") returned 4 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch=".LDF") returned 0x0 [0044.435] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.435] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.436] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.436] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16443737009) returned 1 [0044.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa94c7790, dwHighDateTime=0x1d585b4)) [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d2e8 [0044.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d2e8 | out: hHeap=0x260000) returned 1 [0044.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ea08 [0044.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ea08 | out: hHeap=0x260000) returned 1 [0044.437] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.437] GetLastError () returned 0x0 [0044.437] GetLastError () returned 0x0 [0044.437] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.437] GetLastError () returned 0x0 [0044.437] GetLastError () returned 0x0 [0044.440] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff4708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.440] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb8f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xb8f8, lpOverlapped=0x0) returned 1 [0044.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.441] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.441] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.441] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.441] CloseHandle (hObject=0x104) returned 1 [0044.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.442] GetLastError () returned 0x0 [0044.442] RtlWakeConditionVariable () returned 0x27e828 [0044.442] GetCurrentThreadId () returned 0x98c [0044.442] GetCurrentThreadId () returned 0x98c [0044.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de38 | out: hHeap=0x260000) returned 1 [0044.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338070 | out: hHeap=0x260000) returned 1 [0044.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30de38 [0044.442] lstrlenW (lpString=".ldf") returned 4 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".ldf") returned 0x0 [0044.442] lstrlenW (lpString=".vhd") returned 4 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".vhd") returned 0x0 [0044.442] lstrlenW (lpString=".vhdx") returned 5 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".vhdx") returned 0x0 [0044.442] lstrlenW (lpString=".pst") returned 4 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".pst") returned 0x0 [0044.442] lstrlenW (lpString=".ost") returned 4 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".ost") returned 0x0 [0044.442] lstrlenW (lpString=".bak") returned 4 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".bak") returned 0x0 [0044.442] lstrlenW (lpString=".bac") returned 4 [0044.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".bac") returned 0x0 [0044.442] lstrlenW (lpString=".sys") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".sys") returned 0x0 [0044.443] lstrlenW (lpString=".v2i") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".v2i") returned 0x0 [0044.443] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.443] lstrlenW (lpString=".sql") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".sql") returned 0x0 [0044.443] lstrlenW (lpString=".mdf") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".mdf") returned 0x0 [0044.443] lstrlenW (lpString=".txt") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".txt") returned 0x0 [0044.443] lstrlenW (lpString=".dbf") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".dbf") returned 0x0 [0044.443] lstrlenW (lpString=".ckp") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".ckp") returned 0x0 [0044.443] lstrlenW (lpString=".dacpac") returned 7 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".dacpac") returned 0x0 [0044.443] lstrlenW (lpString=".db3") returned 4 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".db3") returned 0x0 [0044.443] lstrlenW (lpString=".dtxs") returned 5 [0044.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".dtxs") returned 0x0 [0044.444] lstrlenW (lpString=".mdt") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".mdt") returned 0x0 [0044.444] lstrlenW (lpString=".sdf") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".sdf") returned 0x0 [0044.444] lstrlenW (lpString=".MDF") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".MDF") returned 0x0 [0044.444] lstrlenW (lpString=".DBF") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".DBF") returned 0x0 [0044.444] lstrlenW (lpString=".DB") returned 3 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".DB") returned 0x0 [0044.444] lstrlenW (lpString=".db") returned 3 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".db") returned 0x0 [0044.444] lstrlenW (lpString=".ndf") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".ndf") returned 0x0 [0044.444] lstrlenW (lpString=".NDF") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".NDF") returned 0x0 [0044.444] lstrlenW (lpString=".Mdf") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".Mdf") returned 0x0 [0044.444] lstrlenW (lpString=".dat") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".dat") returned 0x0 [0044.444] lstrlenW (lpString=".DAT") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".DAT") returned 0x0 [0044.444] lstrlenW (lpString=".ldf") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".ldf") returned 0x0 [0044.444] lstrlenW (lpString=".LDF") returned 4 [0044.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch=".LDF") returned 0x0 [0044.445] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.445] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.446] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.446] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.446] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16444689155) returned 1 [0044.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa94ed8f0, dwHighDateTime=0x1d585b4)) [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338070 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338070 | out: hHeap=0x260000) returned 1 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e6c0 [0044.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e6c0 | out: hHeap=0x260000) returned 1 [0044.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.446] GetLastError () returned 0x0 [0044.447] GetLastError () returned 0x0 [0044.447] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.447] GetLastError () returned 0x0 [0044.447] GetLastError () returned 0x0 [0044.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffdef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.448] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x211, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x211, lpOverlapped=0x0) returned 1 [0044.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.448] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.448] CloseHandle (hObject=0x104) returned 1 [0044.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.450] GetLastError () returned 0x0 [0044.451] RtlWakeConditionVariable () returned 0x27e828 [0044.451] GetCurrentThreadId () returned 0x98c [0044.451] GetCurrentThreadId () returned 0x98c [0044.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dd90 | out: hHeap=0x260000) returned 1 [0044.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338038 | out: hHeap=0x260000) returned 1 [0044.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dd90 [0044.451] lstrlenW (lpString=".ldf") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.451] lstrlenW (lpString=".vhd") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.451] lstrlenW (lpString=".vhdx") returned 5 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.451] lstrlenW (lpString=".pst") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.451] lstrlenW (lpString=".ost") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.451] lstrlenW (lpString=".bak") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.451] lstrlenW (lpString=".bac") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.451] lstrlenW (lpString=".sys") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.451] lstrlenW (lpString=".v2i") returned 4 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.451] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.452] lstrlenW (lpString=".sql") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.452] lstrlenW (lpString=".mdf") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.452] lstrlenW (lpString=".txt") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.452] lstrlenW (lpString=".dbf") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.452] lstrlenW (lpString=".ckp") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.452] lstrlenW (lpString=".dacpac") returned 7 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.452] lstrlenW (lpString=".db3") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.452] lstrlenW (lpString=".dtxs") returned 5 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.452] lstrlenW (lpString=".mdt") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.452] lstrlenW (lpString=".sdf") returned 4 [0044.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.452] lstrlenW (lpString=".MDF") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.453] lstrlenW (lpString=".DBF") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.453] lstrlenW (lpString=".DB") returned 3 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.453] lstrlenW (lpString=".db") returned 3 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.453] lstrlenW (lpString=".ndf") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.453] lstrlenW (lpString=".NDF") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.453] lstrlenW (lpString=".Mdf") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.453] lstrlenW (lpString=".dat") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.453] lstrlenW (lpString=".DAT") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.453] lstrlenW (lpString=".ldf") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.453] lstrlenW (lpString=".LDF") returned 4 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.453] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.453] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.454] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.454] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16445547611) returned 1 [0044.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa94ed8f0, dwHighDateTime=0x1d585b4)) [0044.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338038 [0044.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338038 | out: hHeap=0x260000) returned 1 [0044.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30de38 [0044.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de38 | out: hHeap=0x260000) returned 1 [0044.455] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.455] GetLastError () returned 0x0 [0044.455] GetLastError () returned 0x0 [0044.455] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.455] GetLastError () returned 0x0 [0044.455] GetLastError () returned 0x0 [0044.457] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.457] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x543, lpOverlapped=0x0) returned 1 [0044.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.457] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.457] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.457] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.457] CloseHandle (hObject=0x104) returned 1 [0044.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.458] GetLastError () returned 0x0 [0044.458] RtlWakeConditionVariable () returned 0x27e828 [0044.458] GetCurrentThreadId () returned 0x98c [0044.458] GetCurrentThreadId () returned 0x98c [0044.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dce8 | out: hHeap=0x260000) returned 1 [0044.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338000 | out: hHeap=0x260000) returned 1 [0044.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dce8 [0044.458] lstrlenW (lpString=".ldf") returned 4 [0044.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.458] lstrlenW (lpString=".vhd") returned 4 [0044.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.458] lstrlenW (lpString=".vhdx") returned 5 [0044.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.458] lstrlenW (lpString=".pst") returned 4 [0044.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.458] lstrlenW (lpString=".ost") returned 4 [0044.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.458] lstrlenW (lpString=".bak") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.459] lstrlenW (lpString=".bac") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.459] lstrlenW (lpString=".sys") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.459] lstrlenW (lpString=".v2i") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.459] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.459] lstrlenW (lpString=".sql") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.459] lstrlenW (lpString=".mdf") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.459] lstrlenW (lpString=".txt") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.459] lstrlenW (lpString=".dbf") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.459] lstrlenW (lpString=".ckp") returned 4 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.459] lstrlenW (lpString=".dacpac") returned 7 [0044.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.459] lstrlenW (lpString=".db3") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.460] lstrlenW (lpString=".dtxs") returned 5 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.460] lstrlenW (lpString=".mdt") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.460] lstrlenW (lpString=".sdf") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.460] lstrlenW (lpString=".MDF") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.460] lstrlenW (lpString=".DBF") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.460] lstrlenW (lpString=".DB") returned 3 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.460] lstrlenW (lpString=".db") returned 3 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.460] lstrlenW (lpString=".ndf") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.460] lstrlenW (lpString=".NDF") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.460] lstrlenW (lpString=".Mdf") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.460] lstrlenW (lpString=".dat") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.460] lstrlenW (lpString=".DAT") returned 4 [0044.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.461] lstrlenW (lpString=".ldf") returned 4 [0044.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.461] lstrlenW (lpString=".LDF") returned 4 [0044.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.461] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.461] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.462] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.462] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.462] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16446282055) returned 1 [0044.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9513a50, dwHighDateTime=0x1d585b4)) [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338000 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338000 | out: hHeap=0x260000) returned 1 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30dd90 [0044.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dd90 | out: hHeap=0x260000) returned 1 [0044.462] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.462] GetLastError () returned 0x0 [0044.462] GetLastError () returned 0x0 [0044.463] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.463] GetLastError () returned 0x0 [0044.463] GetLastError () returned 0x0 [0044.541] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff98de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.541] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6722, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x6722, lpOverlapped=0x0) returned 1 [0044.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.541] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.541] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.541] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.541] CloseHandle (hObject=0x104) returned 1 [0044.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.557] GetLastError () returned 0x0 [0044.557] RtlWakeConditionVariable () returned 0x27e828 [0044.557] GetCurrentThreadId () returned 0x98c [0044.557] GetCurrentThreadId () returned 0x98c [0044.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29da00 | out: hHeap=0x260000) returned 1 [0044.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0044.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29da00 [0044.557] lstrlenW (lpString=".ldf") returned 4 [0044.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.557] lstrlenW (lpString=".vhd") returned 4 [0044.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.557] lstrlenW (lpString=".vhdx") returned 5 [0044.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.557] lstrlenW (lpString=".pst") returned 4 [0044.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.557] lstrlenW (lpString=".ost") returned 4 [0044.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.557] lstrlenW (lpString=".bak") returned 4 [0044.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.558] lstrlenW (lpString=".bac") returned 4 [0044.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.558] lstrlenW (lpString=".sys") returned 4 [0044.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.558] lstrlenW (lpString=".v2i") returned 4 [0044.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.558] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.604] lstrlenW (lpString=".sql") returned 4 [0044.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.604] lstrlenW (lpString=".mdf") returned 4 [0044.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.604] lstrlenW (lpString=".txt") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.605] lstrlenW (lpString=".dbf") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.605] lstrlenW (lpString=".ckp") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.605] lstrlenW (lpString=".dacpac") returned 7 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.605] lstrlenW (lpString=".db3") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.605] lstrlenW (lpString=".dtxs") returned 5 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.605] lstrlenW (lpString=".mdt") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.605] lstrlenW (lpString=".sdf") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.605] lstrlenW (lpString=".MDF") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.605] lstrlenW (lpString=".DBF") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.605] lstrlenW (lpString=".DB") returned 3 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.605] lstrlenW (lpString=".db") returned 3 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.605] lstrlenW (lpString=".ndf") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.605] lstrlenW (lpString=".NDF") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.605] lstrlenW (lpString=".Mdf") returned 4 [0044.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.605] lstrlenW (lpString=".dat") returned 4 [0044.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.606] lstrlenW (lpString=".DAT") returned 4 [0044.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.606] lstrlenW (lpString=".ldf") returned 4 [0044.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.606] lstrlenW (lpString=".LDF") returned 4 [0044.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.606] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0044.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.606] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.607] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.607] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.607] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16460787639) returned 1 [0044.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa966a6b0, dwHighDateTime=0x1d585b4)) [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d630 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0044.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0044.607] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.607] GetLastError () returned 0x0 [0044.607] GetLastError () returned 0x0 [0044.608] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.608] GetLastError () returned 0x0 [0044.608] GetLastError () returned 0x0 [0044.609] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb67f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.609] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x4981, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x4981, lpOverlapped=0x0) returned 1 [0044.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0044.864] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.864] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.865] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.865] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.865] CloseHandle (hObject=0x108) returned 1 [0044.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.865] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.865] GetLastError () returned 0x0 [0044.865] RtlWakeConditionVariable () returned 0x27e828 [0044.865] GetCurrentThreadId () returned 0x98c [0044.865] GetCurrentThreadId () returned 0x98c [0044.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f488 | out: hHeap=0x260000) returned 1 [0044.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d220 | out: hHeap=0x260000) returned 1 [0044.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f488 [0044.866] lstrlenW (lpString=".ldf") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".ldf") returned 0x0 [0044.866] lstrlenW (lpString=".vhd") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".vhd") returned 0x0 [0044.866] lstrlenW (lpString=".vhdx") returned 5 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".vhdx") returned 0x0 [0044.866] lstrlenW (lpString=".pst") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".pst") returned 0x0 [0044.866] lstrlenW (lpString=".ost") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".ost") returned 0x0 [0044.866] lstrlenW (lpString=".bak") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".bak") returned 0x0 [0044.866] lstrlenW (lpString=".bac") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".bac") returned 0x0 [0044.866] lstrlenW (lpString=".sys") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".sys") returned 0x0 [0044.866] lstrlenW (lpString=".v2i") returned 4 [0044.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".v2i") returned 0x0 [0044.866] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.876] lstrlenW (lpString=".sql") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".sql") returned 0x0 [0044.876] lstrlenW (lpString=".mdf") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".mdf") returned 0x0 [0044.876] lstrlenW (lpString=".txt") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".txt") returned 0x0 [0044.876] lstrlenW (lpString=".dbf") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".dbf") returned 0x0 [0044.876] lstrlenW (lpString=".ckp") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".ckp") returned 0x0 [0044.876] lstrlenW (lpString=".dacpac") returned 7 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".dacpac") returned 0x0 [0044.876] lstrlenW (lpString=".db3") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".db3") returned 0x0 [0044.876] lstrlenW (lpString=".dtxs") returned 5 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".dtxs") returned 0x0 [0044.876] lstrlenW (lpString=".mdt") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".mdt") returned 0x0 [0044.876] lstrlenW (lpString=".sdf") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".sdf") returned 0x0 [0044.876] lstrlenW (lpString=".MDF") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".MDF") returned 0x0 [0044.876] lstrlenW (lpString=".DBF") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".DBF") returned 0x0 [0044.876] lstrlenW (lpString=".DB") returned 3 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".DB") returned 0x0 [0044.876] lstrlenW (lpString=".db") returned 3 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".db") returned 0x0 [0044.876] lstrlenW (lpString=".ndf") returned 4 [0044.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".ndf") returned 0x0 [0044.876] lstrlenW (lpString=".NDF") returned 4 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".NDF") returned 0x0 [0044.877] lstrlenW (lpString=".Mdf") returned 4 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".Mdf") returned 0x0 [0044.877] lstrlenW (lpString=".dat") returned 4 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".dat") returned 0x0 [0044.877] lstrlenW (lpString=".DAT") returned 4 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".DAT") returned 0x0 [0044.877] lstrlenW (lpString=".ldf") returned 4 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".ldf") returned 0x0 [0044.877] lstrlenW (lpString=".LDF") returned 4 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch=".LDF") returned 0x0 [0044.877] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.877] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.878] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.878] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16487899755) returned 1 [0044.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa98f1e10, dwHighDateTime=0x1d585b4)) [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f290 [0044.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f290 | out: hHeap=0x260000) returned 1 [0044.878] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.878] GetLastError () returned 0x0 [0044.879] GetLastError () returned 0x0 [0044.879] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.879] GetLastError () returned 0x0 [0044.879] GetLastError () returned 0x0 [0044.887] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff1d14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.887] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xe2ec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xe2ec, lpOverlapped=0x0) returned 1 [0044.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.887] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.887] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.887] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.887] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.887] CloseHandle (hObject=0xfc) returned 1 [0044.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.888] GetLastError () returned 0x0 [0044.888] RtlWakeConditionVariable () returned 0x27e828 [0044.888] GetCurrentThreadId () returned 0x98c [0044.888] GetCurrentThreadId () returned 0x98c [0044.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f530 | out: hHeap=0x260000) returned 1 [0044.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0044.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f530 [0044.888] lstrlenW (lpString=".ldf") returned 4 [0044.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".ldf") returned 0x0 [0044.888] lstrlenW (lpString=".vhd") returned 4 [0044.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".vhd") returned 0x0 [0044.888] lstrlenW (lpString=".vhdx") returned 5 [0044.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".vhdx") returned 0x0 [0044.888] lstrlenW (lpString=".pst") returned 4 [0044.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".pst") returned 0x0 [0044.888] lstrlenW (lpString=".ost") returned 4 [0044.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".ost") returned 0x0 [0044.888] lstrlenW (lpString=".bak") returned 4 [0044.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".bak") returned 0x0 [0044.889] lstrlenW (lpString=".bac") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".bac") returned 0x0 [0044.889] lstrlenW (lpString=".sys") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".sys") returned 0x0 [0044.889] lstrlenW (lpString=".v2i") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".v2i") returned 0x0 [0044.889] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.889] lstrlenW (lpString=".sql") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".sql") returned 0x0 [0044.889] lstrlenW (lpString=".mdf") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".mdf") returned 0x0 [0044.889] lstrlenW (lpString=".txt") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".txt") returned 0x0 [0044.889] lstrlenW (lpString=".dbf") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".dbf") returned 0x0 [0044.889] lstrlenW (lpString=".ckp") returned 4 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".ckp") returned 0x0 [0044.889] lstrlenW (lpString=".dacpac") returned 7 [0044.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".dacpac") returned 0x0 [0044.889] lstrlenW (lpString=".db3") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".db3") returned 0x0 [0044.890] lstrlenW (lpString=".dtxs") returned 5 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".dtxs") returned 0x0 [0044.890] lstrlenW (lpString=".mdt") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".mdt") returned 0x0 [0044.890] lstrlenW (lpString=".sdf") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".sdf") returned 0x0 [0044.890] lstrlenW (lpString=".MDF") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".MDF") returned 0x0 [0044.890] lstrlenW (lpString=".DBF") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".DBF") returned 0x0 [0044.890] lstrlenW (lpString=".DB") returned 3 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".DB") returned 0x0 [0044.890] lstrlenW (lpString=".db") returned 3 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".db") returned 0x0 [0044.890] lstrlenW (lpString=".ndf") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".ndf") returned 0x0 [0044.890] lstrlenW (lpString=".NDF") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".NDF") returned 0x0 [0044.890] lstrlenW (lpString=".Mdf") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".Mdf") returned 0x0 [0044.890] lstrlenW (lpString=".dat") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".dat") returned 0x0 [0044.890] lstrlenW (lpString=".DAT") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".DAT") returned 0x0 [0044.890] lstrlenW (lpString=".ldf") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".ldf") returned 0x0 [0044.890] lstrlenW (lpString=".LDF") returned 4 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch=".LDF") returned 0x0 [0044.890] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.891] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.891] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.891] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.891] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16489250954) returned 1 [0044.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9917f70, dwHighDateTime=0x1d585b4)) [0044.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1530 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f488 [0044.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f488 | out: hHeap=0x260000) returned 1 [0044.892] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.892] GetLastError () returned 0x0 [0044.892] GetLastError () returned 0x0 [0044.892] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.892] GetLastError () returned 0x0 [0044.892] GetLastError () returned 0x0 [0044.893] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdf2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.893] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x20e, lpOverlapped=0x0) returned 1 [0044.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.893] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.894] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.894] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.894] CloseHandle (hObject=0xfc) returned 1 [0044.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.903] GetLastError () returned 0x0 [0044.903] RtlWakeConditionVariable () returned 0x27e828 [0044.903] GetCurrentThreadId () returned 0x98c [0044.903] GetCurrentThreadId () returned 0x98c [0044.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f5d8 | out: hHeap=0x260000) returned 1 [0044.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7f0 | out: hHeap=0x260000) returned 1 [0044.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f5d8 [0044.903] lstrlenW (lpString=".ldf") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.903] lstrlenW (lpString=".vhd") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.903] lstrlenW (lpString=".vhdx") returned 5 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.903] lstrlenW (lpString=".pst") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.903] lstrlenW (lpString=".ost") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.903] lstrlenW (lpString=".bak") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.903] lstrlenW (lpString=".bac") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.903] lstrlenW (lpString=".sys") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.903] lstrlenW (lpString=".v2i") returned 4 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.903] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.904] lstrlenW (lpString=".sql") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.904] lstrlenW (lpString=".mdf") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.904] lstrlenW (lpString=".txt") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.904] lstrlenW (lpString=".dbf") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.904] lstrlenW (lpString=".ckp") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.904] lstrlenW (lpString=".dacpac") returned 7 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.904] lstrlenW (lpString=".db3") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.904] lstrlenW (lpString=".dtxs") returned 5 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.904] lstrlenW (lpString=".mdt") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.904] lstrlenW (lpString=".sdf") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.904] lstrlenW (lpString=".MDF") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.904] lstrlenW (lpString=".DBF") returned 4 [0044.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.904] lstrlenW (lpString=".DB") returned 3 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.905] lstrlenW (lpString=".db") returned 3 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.905] lstrlenW (lpString=".ndf") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.905] lstrlenW (lpString=".NDF") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.905] lstrlenW (lpString=".Mdf") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.905] lstrlenW (lpString=".dat") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.905] lstrlenW (lpString=".DAT") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.905] lstrlenW (lpString=".ldf") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.905] lstrlenW (lpString=".LDF") returned 4 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.905] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.906] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.906] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16490716675) returned 1 [0044.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa993e0d0, dwHighDateTime=0x1d585b4)) [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7f0 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7f0 | out: hHeap=0x260000) returned 1 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f530 [0044.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f530 | out: hHeap=0x260000) returned 1 [0044.907] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.907] GetLastError () returned 0x0 [0044.907] GetLastError () returned 0x0 [0044.907] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.907] GetLastError () returned 0x0 [0044.907] GetLastError () returned 0x0 [0044.909] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff440d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.909] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xbbf3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xbbf3, lpOverlapped=0x0) returned 1 [0044.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.909] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.909] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.909] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.909] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.909] CloseHandle (hObject=0xfc) returned 1 [0044.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.910] GetLastError () returned 0x0 [0044.910] RtlWakeConditionVariable () returned 0x27e828 [0044.910] GetCurrentThreadId () returned 0x98c [0044.910] GetCurrentThreadId () returned 0x98c [0044.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db668 | out: hHeap=0x260000) returned 1 [0044.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7b8 | out: hHeap=0x260000) returned 1 [0044.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db668 [0044.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.915] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.915] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.915] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.915] WriteFile (in: hFile=0xfc, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.916] CloseHandle (hObject=0xfc) returned 1 [0044.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db668 | out: hHeap=0x260000) returned 1 [0044.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf60 | out: hHeap=0x260000) returned 1 [0044.916] RtlWakeConditionVariable () returned 0x27e828 [0044.916] GetCurrentThreadId () returned 0x98c [0044.916] GetCurrentThreadId () returned 0x98c [0044.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f680 | out: hHeap=0x260000) returned 1 [0044.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d780 | out: hHeap=0x260000) returned 1 [0044.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f680 [0044.916] lstrlenW (lpString=".ldf") returned 4 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".ldf") returned 0x0 [0044.916] lstrlenW (lpString=".vhd") returned 4 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".vhd") returned 0x0 [0044.916] lstrlenW (lpString=".vhdx") returned 5 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".vhdx") returned 0x0 [0044.916] lstrlenW (lpString=".pst") returned 4 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".pst") returned 0x0 [0044.916] lstrlenW (lpString=".ost") returned 4 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".ost") returned 0x0 [0044.916] lstrlenW (lpString=".bak") returned 4 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".bak") returned 0x0 [0044.916] lstrlenW (lpString=".bac") returned 4 [0044.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".bac") returned 0x0 [0044.916] lstrlenW (lpString=".sys") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".sys") returned 0x0 [0044.917] lstrlenW (lpString=".v2i") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".v2i") returned 0x0 [0044.917] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.917] lstrlenW (lpString=".sql") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".sql") returned 0x0 [0044.917] lstrlenW (lpString=".mdf") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".mdf") returned 0x0 [0044.917] lstrlenW (lpString=".txt") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".txt") returned 0x0 [0044.917] lstrlenW (lpString=".dbf") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".dbf") returned 0x0 [0044.917] lstrlenW (lpString=".ckp") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".ckp") returned 0x0 [0044.917] lstrlenW (lpString=".dacpac") returned 7 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".dacpac") returned 0x0 [0044.917] lstrlenW (lpString=".db3") returned 4 [0044.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".db3") returned 0x0 [0044.917] lstrlenW (lpString=".dtxs") returned 5 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".dtxs") returned 0x0 [0044.918] lstrlenW (lpString=".mdt") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".mdt") returned 0x0 [0044.918] lstrlenW (lpString=".sdf") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".sdf") returned 0x0 [0044.918] lstrlenW (lpString=".MDF") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".MDF") returned 0x0 [0044.918] lstrlenW (lpString=".DBF") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".DBF") returned 0x0 [0044.918] lstrlenW (lpString=".DB") returned 3 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".DB") returned 0x0 [0044.918] lstrlenW (lpString=".db") returned 3 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".db") returned 0x0 [0044.918] lstrlenW (lpString=".ndf") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".ndf") returned 0x0 [0044.918] lstrlenW (lpString=".NDF") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".NDF") returned 0x0 [0044.918] lstrlenW (lpString=".Mdf") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".Mdf") returned 0x0 [0044.918] lstrlenW (lpString=".dat") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".dat") returned 0x0 [0044.918] lstrlenW (lpString=".DAT") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".DAT") returned 0x0 [0044.918] lstrlenW (lpString=".ldf") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".ldf") returned 0x0 [0044.918] lstrlenW (lpString=".LDF") returned 4 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch=".LDF") returned 0x0 [0044.918] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.918] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0044.919] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.919] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.919] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16492045199) returned 1 [0044.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9964230, dwHighDateTime=0x1d585b4)) [0044.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d780 [0044.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d780 | out: hHeap=0x260000) returned 1 [0044.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f5d8 [0044.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f5d8 | out: hHeap=0x260000) returned 1 [0044.920] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0044.920] GetLastError () returned 0x0 [0044.920] GetLastError () returned 0x0 [0044.920] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0044.920] GetLastError () returned 0x0 [0044.920] GetLastError () returned 0x0 [0044.944] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff39b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.983] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc649, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xc649, lpOverlapped=0x0) returned 1 [0045.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.000] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.000] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.004] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.004] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.004] CloseHandle (hObject=0xfc) returned 1 [0045.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0045.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0045.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0045.206] GetLastError () returned 0x0 [0045.206] RtlWakeConditionVariable () returned 0x27e828 [0045.206] GetCurrentThreadId () returned 0x98c [0045.206] GetCurrentThreadId () returned 0x98c [0045.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e3d8 | out: hHeap=0x260000) returned 1 [0045.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d860 | out: hHeap=0x260000) returned 1 [0045.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e3d8 [0045.207] lstrlenW (lpString=".ldf") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".ldf") returned 0x0 [0045.207] lstrlenW (lpString=".vhd") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".vhd") returned 0x0 [0045.207] lstrlenW (lpString=".vhdx") returned 5 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".vhdx") returned 0x0 [0045.207] lstrlenW (lpString=".pst") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".pst") returned 0x0 [0045.207] lstrlenW (lpString=".ost") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".ost") returned 0x0 [0045.207] lstrlenW (lpString=".bak") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".bak") returned 0x0 [0045.207] lstrlenW (lpString=".bac") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".bac") returned 0x0 [0045.207] lstrlenW (lpString=".sys") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".sys") returned 0x0 [0045.207] lstrlenW (lpString=".v2i") returned 4 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".v2i") returned 0x0 [0045.207] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.334] lstrlenW (lpString=".sql") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".sql") returned 0x0 [0045.334] lstrlenW (lpString=".mdf") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".mdf") returned 0x0 [0045.334] lstrlenW (lpString=".txt") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".txt") returned 0x0 [0045.334] lstrlenW (lpString=".dbf") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".dbf") returned 0x0 [0045.334] lstrlenW (lpString=".ckp") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".ckp") returned 0x0 [0045.334] lstrlenW (lpString=".dacpac") returned 7 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".dacpac") returned 0x0 [0045.334] lstrlenW (lpString=".db3") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".db3") returned 0x0 [0045.334] lstrlenW (lpString=".dtxs") returned 5 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".dtxs") returned 0x0 [0045.334] lstrlenW (lpString=".mdt") returned 4 [0045.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".mdt") returned 0x0 [0045.334] lstrlenW (lpString=".sdf") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".sdf") returned 0x0 [0045.335] lstrlenW (lpString=".MDF") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".MDF") returned 0x0 [0045.335] lstrlenW (lpString=".DBF") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".DBF") returned 0x0 [0045.335] lstrlenW (lpString=".DB") returned 3 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".DB") returned 0x0 [0045.335] lstrlenW (lpString=".db") returned 3 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".db") returned 0x0 [0045.335] lstrlenW (lpString=".ndf") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".ndf") returned 0x0 [0045.335] lstrlenW (lpString=".NDF") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".NDF") returned 0x0 [0045.335] lstrlenW (lpString=".Mdf") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".Mdf") returned 0x0 [0045.335] lstrlenW (lpString=".dat") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".dat") returned 0x0 [0045.335] lstrlenW (lpString=".DAT") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".DAT") returned 0x0 [0045.335] lstrlenW (lpString=".ldf") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".ldf") returned 0x0 [0045.335] lstrlenW (lpString=".LDF") returned 4 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch=".LDF") returned 0x0 [0045.335] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.335] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.336] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.336] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.336] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16533731902) returned 1 [0045.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9d68750, dwHighDateTime=0x1d585b4)) [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0045.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ced8 [0045.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0045.337] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.337] GetLastError () returned 0x0 [0045.337] GetLastError () returned 0x0 [0045.337] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.337] GetLastError () returned 0x0 [0045.337] GetLastError () returned 0x0 [0045.348] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff4df2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.348] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb20e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xb20e, lpOverlapped=0x0) returned 1 [0045.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.349] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.349] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.349] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.349] CloseHandle (hObject=0x108) returned 1 [0045.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.350] GetLastError () returned 0x0 [0045.350] RtlWakeConditionVariable () returned 0x27e828 [0045.350] GetCurrentThreadId () returned 0x98c [0045.350] GetCurrentThreadId () returned 0x98c [0045.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b9c0 [0045.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c820 | out: hHeap=0x260000) returned 1 [0045.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299558 | out: hHeap=0x260000) returned 1 [0045.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c820 [0045.350] lstrlenW (lpString=".ldf") returned 4 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".ldf") returned 0x0 [0045.350] lstrlenW (lpString=".vhd") returned 4 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".vhd") returned 0x0 [0045.350] lstrlenW (lpString=".vhdx") returned 5 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".vhdx") returned 0x0 [0045.350] lstrlenW (lpString=".pst") returned 4 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".pst") returned 0x0 [0045.350] lstrlenW (lpString=".ost") returned 4 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".ost") returned 0x0 [0045.350] lstrlenW (lpString=".bak") returned 4 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".bak") returned 0x0 [0045.350] lstrlenW (lpString=".bac") returned 4 [0045.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".bac") returned 0x0 [0045.351] lstrlenW (lpString=".sys") returned 4 [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".sys") returned 0x0 [0045.351] lstrlenW (lpString=".v2i") returned 4 [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".v2i") returned 0x0 [0045.351] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.363] lstrlenW (lpString=".sql") returned 4 [0045.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".sql") returned 0x0 [0045.363] lstrlenW (lpString=".mdf") returned 4 [0045.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".mdf") returned 0x0 [0045.363] lstrlenW (lpString=".txt") returned 4 [0045.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".txt") returned 0x0 [0045.363] lstrlenW (lpString=".dbf") returned 4 [0045.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".dbf") returned 0x0 [0045.363] lstrlenW (lpString=".ckp") returned 4 [0045.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".ckp") returned 0x0 [0045.363] lstrlenW (lpString=".dacpac") returned 7 [0045.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".dacpac") returned 0x0 [0045.363] lstrlenW (lpString=".db3") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".db3") returned 0x0 [0045.364] lstrlenW (lpString=".dtxs") returned 5 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".dtxs") returned 0x0 [0045.364] lstrlenW (lpString=".mdt") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".mdt") returned 0x0 [0045.364] lstrlenW (lpString=".sdf") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".sdf") returned 0x0 [0045.364] lstrlenW (lpString=".MDF") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".MDF") returned 0x0 [0045.364] lstrlenW (lpString=".DBF") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".DBF") returned 0x0 [0045.364] lstrlenW (lpString=".DB") returned 3 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".DB") returned 0x0 [0045.364] lstrlenW (lpString=".db") returned 3 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".db") returned 0x0 [0045.364] lstrlenW (lpString=".ndf") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".ndf") returned 0x0 [0045.364] lstrlenW (lpString=".NDF") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".NDF") returned 0x0 [0045.364] lstrlenW (lpString=".Mdf") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".Mdf") returned 0x0 [0045.364] lstrlenW (lpString=".dat") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".dat") returned 0x0 [0045.364] lstrlenW (lpString=".DAT") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".DAT") returned 0x0 [0045.364] lstrlenW (lpString=".ldf") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".ldf") returned 0x0 [0045.364] lstrlenW (lpString=".LDF") returned 4 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch=".LDF") returned 0x0 [0045.364] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.365] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.366] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.366] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16536696481) returned 1 [0045.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9db4a10, dwHighDateTime=0x1d585b4)) [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13e0 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e030 [0045.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0045.366] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.366] GetLastError () returned 0x0 [0045.367] GetLastError () returned 0x0 [0045.367] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.367] GetLastError () returned 0x0 [0045.367] GetLastError () returned 0x0 [0045.369] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffedfa2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.369] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1205e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1205e, lpOverlapped=0x0) returned 1 [0045.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.370] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.370] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.370] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.370] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.370] CloseHandle (hObject=0xfc) returned 1 [0045.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.371] GetLastError () returned 0x0 [0045.371] RtlWakeConditionVariable () returned 0x27e828 [0045.371] GetCurrentThreadId () returned 0x98c [0045.371] GetCurrentThreadId () returned 0x98c [0045.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b9c0 [0045.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c8d8 | out: hHeap=0x260000) returned 1 [0045.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0045.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c8d8 [0045.371] lstrlenW (lpString=".ldf") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.371] lstrlenW (lpString=".vhd") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.371] lstrlenW (lpString=".vhdx") returned 5 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.371] lstrlenW (lpString=".pst") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.371] lstrlenW (lpString=".ost") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.371] lstrlenW (lpString=".bak") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.371] lstrlenW (lpString=".bac") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.371] lstrlenW (lpString=".sys") returned 4 [0045.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.372] lstrlenW (lpString=".v2i") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.372] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.372] lstrlenW (lpString=".sql") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.372] lstrlenW (lpString=".mdf") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.372] lstrlenW (lpString=".txt") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.372] lstrlenW (lpString=".dbf") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.372] lstrlenW (lpString=".ckp") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.372] lstrlenW (lpString=".dacpac") returned 7 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.372] lstrlenW (lpString=".db3") returned 4 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.372] lstrlenW (lpString=".dtxs") returned 5 [0045.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.372] lstrlenW (lpString=".mdt") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.373] lstrlenW (lpString=".sdf") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.373] lstrlenW (lpString=".MDF") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.373] lstrlenW (lpString=".DBF") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.373] lstrlenW (lpString=".DB") returned 3 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.373] lstrlenW (lpString=".db") returned 3 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.373] lstrlenW (lpString=".ndf") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.373] lstrlenW (lpString=".NDF") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.373] lstrlenW (lpString=".Mdf") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.373] lstrlenW (lpString=".dat") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.373] lstrlenW (lpString=".DAT") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.373] lstrlenW (lpString=".ldf") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.373] lstrlenW (lpString=".LDF") returned 4 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.373] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.373] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.374] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.374] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.374] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16537549505) returned 1 [0045.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9db4a10, dwHighDateTime=0x1d585b4)) [0045.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0045.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0045.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e030 [0045.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0045.375] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.375] GetLastError () returned 0x0 [0045.375] GetLastError () returned 0x0 [0045.375] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.375] GetLastError () returned 0x0 [0045.375] GetLastError () returned 0x0 [0045.377] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff3085, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.377] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xcf7b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xcf7b, lpOverlapped=0x0) returned 1 [0045.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.377] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.378] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.378] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.378] CloseHandle (hObject=0xfc) returned 1 [0045.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.380] GetLastError () returned 0x0 [0045.380] RtlWakeConditionVariable () returned 0x27e828 [0045.380] GetCurrentThreadId () returned 0x98c [0045.380] GetCurrentThreadId () returned 0x98c [0045.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ec8 | out: hHeap=0x260000) returned 1 [0045.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0045.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8ec8 [0045.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.381] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.381] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.381] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.381] WriteFile (in: hFile=0xfc, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.382] CloseHandle (hObject=0xfc) returned 1 [0045.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ec8 | out: hHeap=0x260000) returned 1 [0045.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e00 | out: hHeap=0x260000) returned 1 [0045.382] RtlWakeConditionVariable () returned 0x27e828 [0045.382] GetCurrentThreadId () returned 0x98c [0045.382] GetCurrentThreadId () returned 0x98c [0045.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f79b0 | out: hHeap=0x260000) returned 1 [0045.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00a8 | out: hHeap=0x260000) returned 1 [0045.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f79b0 [0045.382] lstrlenW (lpString=".ldf") returned 4 [0045.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.382] lstrlenW (lpString=".vhd") returned 4 [0045.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.382] lstrlenW (lpString=".vhdx") returned 5 [0045.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.382] lstrlenW (lpString=".pst") returned 4 [0045.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.382] lstrlenW (lpString=".ost") returned 4 [0045.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.382] lstrlenW (lpString=".bak") returned 4 [0045.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.382] lstrlenW (lpString=".bac") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.383] lstrlenW (lpString=".sys") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.383] lstrlenW (lpString=".v2i") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.383] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.383] lstrlenW (lpString=".sql") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.383] lstrlenW (lpString=".mdf") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.383] lstrlenW (lpString=".txt") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.383] lstrlenW (lpString=".dbf") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.383] lstrlenW (lpString=".ckp") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.383] lstrlenW (lpString=".dacpac") returned 7 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.383] lstrlenW (lpString=".db3") returned 4 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.383] lstrlenW (lpString=".dtxs") returned 5 [0045.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.384] lstrlenW (lpString=".mdt") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.384] lstrlenW (lpString=".sdf") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.384] lstrlenW (lpString=".MDF") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.384] lstrlenW (lpString=".DBF") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.384] lstrlenW (lpString=".DB") returned 3 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.384] lstrlenW (lpString=".db") returned 3 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.384] lstrlenW (lpString=".ndf") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.384] lstrlenW (lpString=".NDF") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.384] lstrlenW (lpString=".Mdf") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.384] lstrlenW (lpString=".dat") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.384] lstrlenW (lpString=".DAT") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.384] lstrlenW (lpString=".ldf") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.384] lstrlenW (lpString=".LDF") returned 4 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.384] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.384] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.385] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.385] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.385] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16538656727) returned 1 [0045.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9ddab70, dwHighDateTime=0x1d585b4)) [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00a8 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00a8 | out: hHeap=0x260000) returned 1 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6750 [0045.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0045.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.386] GetLastError () returned 0x0 [0045.386] GetLastError () returned 0x0 [0045.386] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.386] GetLastError () returned 0x0 [0045.386] GetLastError () returned 0x0 [0045.478] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff5d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.478] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xa2c, lpOverlapped=0x0) returned 1 [0045.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.478] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.479] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.479] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.479] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.479] CloseHandle (hObject=0xfc) returned 1 [0045.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.480] GetLastError () returned 0x0 [0045.480] RtlWakeConditionVariable () returned 0x27e828 [0045.480] GetCurrentThreadId () returned 0x98c [0045.480] GetCurrentThreadId () returned 0x98c [0045.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bf80 | out: hHeap=0x260000) returned 1 [0045.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01f8 | out: hHeap=0x260000) returned 1 [0045.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0045.480] lstrlenW (lpString=".ldf") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.480] lstrlenW (lpString=".vhd") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.480] lstrlenW (lpString=".vhdx") returned 5 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.480] lstrlenW (lpString=".pst") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.480] lstrlenW (lpString=".ost") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.480] lstrlenW (lpString=".bak") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.480] lstrlenW (lpString=".bac") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.480] lstrlenW (lpString=".sys") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.480] lstrlenW (lpString=".v2i") returned 4 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.480] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.524] lstrlenW (lpString=".sql") returned 4 [0045.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.525] lstrlenW (lpString=".mdf") returned 4 [0045.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.525] lstrlenW (lpString=".txt") returned 4 [0045.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.525] lstrlenW (lpString=".dbf") returned 4 [0045.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.525] lstrlenW (lpString=".ckp") returned 4 [0045.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.525] lstrlenW (lpString=".dacpac") returned 7 [0045.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.541] lstrlenW (lpString=".db3") returned 4 [0045.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.541] lstrlenW (lpString=".dtxs") returned 5 [0045.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.541] lstrlenW (lpString=".mdt") returned 4 [0045.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.542] lstrlenW (lpString=".sdf") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.542] lstrlenW (lpString=".MDF") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.542] lstrlenW (lpString=".DBF") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.542] lstrlenW (lpString=".DB") returned 3 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.542] lstrlenW (lpString=".db") returned 3 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.542] lstrlenW (lpString=".ndf") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.542] lstrlenW (lpString=".NDF") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.542] lstrlenW (lpString=".Mdf") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.542] lstrlenW (lpString=".dat") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.542] lstrlenW (lpString=".DAT") returned 4 [0045.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.543] lstrlenW (lpString=".ldf") returned 4 [0045.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.543] lstrlenW (lpString=".LDF") returned 4 [0045.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.543] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.543] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.544] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.544] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.544] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16554479120) returned 1 [0045.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9f57930, dwHighDateTime=0x1d585b4)) [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0310 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0310 | out: hHeap=0x260000) returned 1 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0045.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0045.544] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.544] GetLastError () returned 0x0 [0045.544] GetLastError () returned 0x0 [0045.544] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.545] GetLastError () returned 0x0 [0045.545] GetLastError () returned 0x0 [0045.548] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff44a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.548] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xbb5a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0xbb5a, lpOverlapped=0x0) returned 1 [0045.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.548] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.548] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.548] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.548] CloseHandle (hObject=0x10c) returned 1 [0045.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.549] GetLastError () returned 0x0 [0045.549] RtlWakeConditionVariable () returned 0x27e828 [0045.549] GetCurrentThreadId () returned 0x98c [0045.549] GetCurrentThreadId () returned 0x98c [0045.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9120 | out: hHeap=0x260000) returned 1 [0045.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0348 | out: hHeap=0x260000) returned 1 [0045.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9120 [0045.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.550] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.550] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.550] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.550] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.551] CloseHandle (hObject=0x10c) returned 1 [0045.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9120 | out: hHeap=0x260000) returned 1 [0045.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e00 | out: hHeap=0x260000) returned 1 [0045.551] RtlWakeConditionVariable () returned 0x27e828 [0045.551] GetCurrentThreadId () returned 0x98c [0045.551] GetCurrentThreadId () returned 0x98c [0045.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0045.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c98 | out: hHeap=0x260000) returned 1 [0045.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0045.551] lstrlenW (lpString=".ldf") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.551] lstrlenW (lpString=".vhd") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.551] lstrlenW (lpString=".vhdx") returned 5 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.551] lstrlenW (lpString=".pst") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.551] lstrlenW (lpString=".ost") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.551] lstrlenW (lpString=".bak") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.551] lstrlenW (lpString=".bac") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.551] lstrlenW (lpString=".sys") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.551] lstrlenW (lpString=".v2i") returned 4 [0045.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.551] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.552] lstrlenW (lpString=".sql") returned 4 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.552] lstrlenW (lpString=".mdf") returned 4 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.552] lstrlenW (lpString=".txt") returned 4 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.552] lstrlenW (lpString=".dbf") returned 4 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.552] lstrlenW (lpString=".ckp") returned 4 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.552] lstrlenW (lpString=".dacpac") returned 7 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.552] lstrlenW (lpString=".db3") returned 4 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.552] lstrlenW (lpString=".dtxs") returned 5 [0045.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.552] lstrlenW (lpString=".mdt") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.553] lstrlenW (lpString=".sdf") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.553] lstrlenW (lpString=".MDF") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.553] lstrlenW (lpString=".DBF") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.553] lstrlenW (lpString=".DB") returned 3 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.553] lstrlenW (lpString=".db") returned 3 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.553] lstrlenW (lpString=".ndf") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.553] lstrlenW (lpString=".NDF") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.553] lstrlenW (lpString=".Mdf") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.553] lstrlenW (lpString=".dat") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.553] lstrlenW (lpString=".DAT") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.553] lstrlenW (lpString=".ldf") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.553] lstrlenW (lpString=".LDF") returned 4 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.553] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.553] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.554] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.554] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.554] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16555542802) returned 1 [0045.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9f7da90, dwHighDateTime=0x1d585b4)) [0045.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c98 [0045.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c98 | out: hHeap=0x260000) returned 1 [0045.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5cd0 [0045.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5cd0 | out: hHeap=0x260000) returned 1 [0045.555] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.555] GetLastError () returned 0x0 [0045.555] GetLastError () returned 0x0 [0045.555] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.555] GetLastError () returned 0x0 [0045.555] GetLastError () returned 0x0 [0045.557] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffc57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.557] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x3a9, lpOverlapped=0x0) returned 1 [0045.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.557] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.557] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.557] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.558] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.558] CloseHandle (hObject=0x10c) returned 1 [0045.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.558] GetLastError () returned 0x0 [0045.558] RtlWakeConditionVariable () returned 0x27e828 [0045.558] GetCurrentThreadId () returned 0x98c [0045.558] GetCurrentThreadId () returned 0x98c [0045.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0045.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0045.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0045.559] lstrlenW (lpString=".ldf") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".ldf") returned 0x0 [0045.559] lstrlenW (lpString=".vhd") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".vhd") returned 0x0 [0045.559] lstrlenW (lpString=".vhdx") returned 5 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".vhdx") returned 0x0 [0045.559] lstrlenW (lpString=".pst") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".pst") returned 0x0 [0045.559] lstrlenW (lpString=".ost") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".ost") returned 0x0 [0045.559] lstrlenW (lpString=".bak") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".bak") returned 0x0 [0045.559] lstrlenW (lpString=".bac") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".bac") returned 0x0 [0045.559] lstrlenW (lpString=".sys") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".sys") returned 0x0 [0045.559] lstrlenW (lpString=".v2i") returned 4 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".v2i") returned 0x0 [0045.559] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.560] lstrlenW (lpString=".sql") returned 4 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".sql") returned 0x0 [0045.560] lstrlenW (lpString=".mdf") returned 4 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".mdf") returned 0x0 [0045.560] lstrlenW (lpString=".txt") returned 4 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".txt") returned 0x0 [0045.560] lstrlenW (lpString=".dbf") returned 4 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".dbf") returned 0x0 [0045.560] lstrlenW (lpString=".ckp") returned 4 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".ckp") returned 0x0 [0045.560] lstrlenW (lpString=".dacpac") returned 7 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".dacpac") returned 0x0 [0045.560] lstrlenW (lpString=".db3") returned 4 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".db3") returned 0x0 [0045.560] lstrlenW (lpString=".dtxs") returned 5 [0045.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".dtxs") returned 0x0 [0045.560] lstrlenW (lpString=".mdt") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".mdt") returned 0x0 [0045.561] lstrlenW (lpString=".sdf") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".sdf") returned 0x0 [0045.561] lstrlenW (lpString=".MDF") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".MDF") returned 0x0 [0045.561] lstrlenW (lpString=".DBF") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".DBF") returned 0x0 [0045.561] lstrlenW (lpString=".DB") returned 3 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".DB") returned 0x0 [0045.561] lstrlenW (lpString=".db") returned 3 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".db") returned 0x0 [0045.561] lstrlenW (lpString=".ndf") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".ndf") returned 0x0 [0045.561] lstrlenW (lpString=".NDF") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".NDF") returned 0x0 [0045.561] lstrlenW (lpString=".Mdf") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".Mdf") returned 0x0 [0045.561] lstrlenW (lpString=".dat") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".dat") returned 0x0 [0045.561] lstrlenW (lpString=".DAT") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".DAT") returned 0x0 [0045.561] lstrlenW (lpString=".ldf") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".ldf") returned 0x0 [0045.561] lstrlenW (lpString=".LDF") returned 4 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch=".LDF") returned 0x0 [0045.561] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.561] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.562] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.562] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.562] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16556343543) returned 1 [0045.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9f7da90, dwHighDateTime=0x1d585b4)) [0045.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c60 [0045.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0045.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0045.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3311d8 [0045.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0045.563] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.563] GetLastError () returned 0x0 [0045.563] GetLastError () returned 0x0 [0045.563] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.563] GetLastError () returned 0x0 [0045.563] GetLastError () returned 0x0 [0045.565] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffebec3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.565] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x1413d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x1413d, lpOverlapped=0x0) returned 1 [0045.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.566] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.566] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.566] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.566] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.566] CloseHandle (hObject=0x10c) returned 1 [0045.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.568] GetLastError () returned 0x0 [0045.568] RtlWakeConditionVariable () returned 0x27e828 [0045.568] GetCurrentThreadId () returned 0x98c [0045.568] GetCurrentThreadId () returned 0x98c [0045.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296268 | out: hHeap=0x260000) returned 1 [0045.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0045.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0045.568] lstrlenW (lpString=".ldf") returned 4 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".ldf") returned 0x0 [0045.568] lstrlenW (lpString=".vhd") returned 4 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".vhd") returned 0x0 [0045.568] lstrlenW (lpString=".vhdx") returned 5 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".vhdx") returned 0x0 [0045.568] lstrlenW (lpString=".pst") returned 4 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".pst") returned 0x0 [0045.568] lstrlenW (lpString=".ost") returned 4 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".ost") returned 0x0 [0045.568] lstrlenW (lpString=".bak") returned 4 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".bak") returned 0x0 [0045.568] lstrlenW (lpString=".bac") returned 4 [0045.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".bac") returned 0x0 [0045.569] lstrlenW (lpString=".sys") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".sys") returned 0x0 [0045.569] lstrlenW (lpString=".v2i") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".v2i") returned 0x0 [0045.569] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.569] lstrlenW (lpString=".sql") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".sql") returned 0x0 [0045.569] lstrlenW (lpString=".mdf") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".mdf") returned 0x0 [0045.569] lstrlenW (lpString=".txt") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".txt") returned 0x0 [0045.569] lstrlenW (lpString=".dbf") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".dbf") returned 0x0 [0045.569] lstrlenW (lpString=".ckp") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".ckp") returned 0x0 [0045.569] lstrlenW (lpString=".dacpac") returned 7 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".dacpac") returned 0x0 [0045.569] lstrlenW (lpString=".db3") returned 4 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".db3") returned 0x0 [0045.569] lstrlenW (lpString=".dtxs") returned 5 [0045.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".dtxs") returned 0x0 [0045.570] lstrlenW (lpString=".mdt") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".mdt") returned 0x0 [0045.570] lstrlenW (lpString=".sdf") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".sdf") returned 0x0 [0045.570] lstrlenW (lpString=".MDF") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".MDF") returned 0x0 [0045.570] lstrlenW (lpString=".DBF") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".DBF") returned 0x0 [0045.570] lstrlenW (lpString=".DB") returned 3 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".DB") returned 0x0 [0045.570] lstrlenW (lpString=".db") returned 3 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".db") returned 0x0 [0045.570] lstrlenW (lpString=".ndf") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".ndf") returned 0x0 [0045.570] lstrlenW (lpString=".NDF") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".NDF") returned 0x0 [0045.570] lstrlenW (lpString=".Mdf") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".Mdf") returned 0x0 [0045.570] lstrlenW (lpString=".dat") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".dat") returned 0x0 [0045.570] lstrlenW (lpString=".DAT") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".DAT") returned 0x0 [0045.570] lstrlenW (lpString=".ldf") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".ldf") returned 0x0 [0045.570] lstrlenW (lpString=".LDF") returned 4 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch=".LDF") returned 0x0 [0045.570] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.570] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.571] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.571] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.571] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16557242144) returned 1 [0045.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9fa3bf0, dwHighDateTime=0x1d585b4)) [0045.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b80 [0045.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0045.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0045.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0045.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0045.572] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.572] GetLastError () returned 0x0 [0045.572] GetLastError () returned 0x0 [0045.572] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.572] GetLastError () returned 0x0 [0045.572] GetLastError () returned 0x0 [0045.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.573] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x1bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x1bc, lpOverlapped=0x0) returned 1 [0045.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.574] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.574] CloseHandle (hObject=0x10c) returned 1 [0045.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.574] GetLastError () returned 0x0 [0045.574] RtlWakeConditionVariable () returned 0x27e828 [0045.574] GetCurrentThreadId () returned 0x98c [0045.574] GetCurrentThreadId () returned 0x98c [0045.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eea0 | out: hHeap=0x260000) returned 1 [0045.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0045.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eea0 [0045.575] lstrlenW (lpString=".ldf") returned 4 [0045.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.575] lstrlenW (lpString=".vhd") returned 4 [0045.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.575] lstrlenW (lpString=".vhdx") returned 5 [0045.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.575] lstrlenW (lpString=".pst") returned 4 [0045.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.575] lstrlenW (lpString=".ost") returned 4 [0045.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.575] lstrlenW (lpString=".bak") returned 4 [0045.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.576] lstrlenW (lpString=".bac") returned 4 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.576] lstrlenW (lpString=".sys") returned 4 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.576] lstrlenW (lpString=".v2i") returned 4 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.576] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.576] lstrlenW (lpString=".sql") returned 4 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.576] lstrlenW (lpString=".mdf") returned 4 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.576] lstrlenW (lpString=".txt") returned 4 [0045.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.576] lstrlenW (lpString=".dbf") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.577] lstrlenW (lpString=".ckp") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.577] lstrlenW (lpString=".dacpac") returned 7 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.577] lstrlenW (lpString=".db3") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.577] lstrlenW (lpString=".dtxs") returned 5 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.577] lstrlenW (lpString=".mdt") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.577] lstrlenW (lpString=".sdf") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.577] lstrlenW (lpString=".MDF") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.577] lstrlenW (lpString=".DBF") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.577] lstrlenW (lpString=".DB") returned 3 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.577] lstrlenW (lpString=".db") returned 3 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.577] lstrlenW (lpString=".ndf") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.577] lstrlenW (lpString=".NDF") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.577] lstrlenW (lpString=".Mdf") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.577] lstrlenW (lpString=".dat") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.577] lstrlenW (lpString=".DAT") returned 4 [0045.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.578] lstrlenW (lpString=".ldf") returned 4 [0045.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.578] lstrlenW (lpString=".LDF") returned 4 [0045.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.578] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.578] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.578] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.579] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.579] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16557977884) returned 1 [0045.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9fa3bf0, dwHighDateTime=0x1d585b4)) [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e030 [0045.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0045.579] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.579] GetLastError () returned 0x0 [0045.579] GetLastError () returned 0x0 [0045.579] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.579] GetLastError () returned 0x0 [0045.580] GetLastError () returned 0x0 [0045.581] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8d87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.581] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x7279, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x7279, lpOverlapped=0x0) returned 1 [0045.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.581] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.581] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.582] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.582] CloseHandle (hObject=0x10c) returned 1 [0045.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.582] GetLastError () returned 0x0 [0045.582] RtlWakeConditionVariable () returned 0x27e828 [0045.582] GetCurrentThreadId () returned 0x98c [0045.582] GetCurrentThreadId () returned 0x98c [0045.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9378 | out: hHeap=0x260000) returned 1 [0045.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294cd0 | out: hHeap=0x260000) returned 1 [0045.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9378 [0045.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.583] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.583] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.583] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.583] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.584] CloseHandle (hObject=0x10c) returned 1 [0045.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9378 | out: hHeap=0x260000) returned 1 [0045.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e00 | out: hHeap=0x260000) returned 1 [0045.584] RtlWakeConditionVariable () returned 0x27e828 [0045.584] GetCurrentThreadId () returned 0x98c [0045.584] GetCurrentThreadId () returned 0x98c [0045.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0045.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ad8 | out: hHeap=0x260000) returned 1 [0045.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0045.585] lstrlenW (lpString=".ldf") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.585] lstrlenW (lpString=".vhd") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.585] lstrlenW (lpString=".vhdx") returned 5 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.585] lstrlenW (lpString=".pst") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.585] lstrlenW (lpString=".ost") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.585] lstrlenW (lpString=".bak") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.585] lstrlenW (lpString=".bac") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.585] lstrlenW (lpString=".sys") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.585] lstrlenW (lpString=".v2i") returned 4 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.585] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.586] lstrlenW (lpString=".sql") returned 4 [0045.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.586] lstrlenW (lpString=".mdf") returned 4 [0045.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.586] lstrlenW (lpString=".txt") returned 4 [0045.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.586] lstrlenW (lpString=".dbf") returned 4 [0045.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.586] lstrlenW (lpString=".ckp") returned 4 [0045.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.586] lstrlenW (lpString=".dacpac") returned 7 [0045.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.586] lstrlenW (lpString=".db3") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.587] lstrlenW (lpString=".dtxs") returned 5 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.587] lstrlenW (lpString=".mdt") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.587] lstrlenW (lpString=".sdf") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.587] lstrlenW (lpString=".MDF") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.587] lstrlenW (lpString=".DBF") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.587] lstrlenW (lpString=".DB") returned 3 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.587] lstrlenW (lpString=".db") returned 3 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.587] lstrlenW (lpString=".ndf") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.587] lstrlenW (lpString=".NDF") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.587] lstrlenW (lpString=".Mdf") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.587] lstrlenW (lpString=".dat") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.587] lstrlenW (lpString=".DAT") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.587] lstrlenW (lpString=".ldf") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.587] lstrlenW (lpString=".LDF") returned 4 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.587] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.588] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.588] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.588] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16558955355) returned 1 [0045.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9fc9d50, dwHighDateTime=0x1d585b4)) [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294ad8 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ad8 | out: hHeap=0x260000) returned 1 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30eea0 [0045.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eea0 | out: hHeap=0x260000) returned 1 [0045.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.589] GetLastError () returned 0x0 [0045.589] GetLastError () returned 0x0 [0045.589] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.589] GetLastError () returned 0x0 [0045.589] GetLastError () returned 0x0 [0045.591] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffc0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.591] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x3f1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x3f1, lpOverlapped=0x0) returned 1 [0045.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.591] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.592] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.592] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.592] CloseHandle (hObject=0x10c) returned 1 [0045.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.592] GetLastError () returned 0x0 [0045.593] RtlWakeConditionVariable () returned 0x27e828 [0045.593] GetCurrentThreadId () returned 0x98c [0045.593] GetCurrentThreadId () returned 0x98c [0045.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eff0 | out: hHeap=0x260000) returned 1 [0045.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c28 | out: hHeap=0x260000) returned 1 [0045.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eff0 [0045.593] lstrlenW (lpString=".ldf") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".ldf") returned 0x0 [0045.593] lstrlenW (lpString=".vhd") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".vhd") returned 0x0 [0045.593] lstrlenW (lpString=".vhdx") returned 5 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".vhdx") returned 0x0 [0045.593] lstrlenW (lpString=".pst") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".pst") returned 0x0 [0045.593] lstrlenW (lpString=".ost") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".ost") returned 0x0 [0045.593] lstrlenW (lpString=".bak") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".bak") returned 0x0 [0045.593] lstrlenW (lpString=".bac") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".bac") returned 0x0 [0045.593] lstrlenW (lpString=".sys") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".sys") returned 0x0 [0045.593] lstrlenW (lpString=".v2i") returned 4 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".v2i") returned 0x0 [0045.593] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.594] lstrlenW (lpString=".sql") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".sql") returned 0x0 [0045.594] lstrlenW (lpString=".mdf") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".mdf") returned 0x0 [0045.594] lstrlenW (lpString=".txt") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".txt") returned 0x0 [0045.594] lstrlenW (lpString=".dbf") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".dbf") returned 0x0 [0045.594] lstrlenW (lpString=".ckp") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".ckp") returned 0x0 [0045.594] lstrlenW (lpString=".dacpac") returned 7 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".dacpac") returned 0x0 [0045.594] lstrlenW (lpString=".db3") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".db3") returned 0x0 [0045.594] lstrlenW (lpString=".dtxs") returned 5 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".dtxs") returned 0x0 [0045.594] lstrlenW (lpString=".mdt") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".mdt") returned 0x0 [0045.594] lstrlenW (lpString=".sdf") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".sdf") returned 0x0 [0045.594] lstrlenW (lpString=".MDF") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".MDF") returned 0x0 [0045.594] lstrlenW (lpString=".DBF") returned 4 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".DBF") returned 0x0 [0045.594] lstrlenW (lpString=".DB") returned 3 [0045.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".DB") returned 0x0 [0045.595] lstrlenW (lpString=".db") returned 3 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".db") returned 0x0 [0045.595] lstrlenW (lpString=".ndf") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".ndf") returned 0x0 [0045.595] lstrlenW (lpString=".NDF") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".NDF") returned 0x0 [0045.595] lstrlenW (lpString=".Mdf") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".Mdf") returned 0x0 [0045.595] lstrlenW (lpString=".dat") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".dat") returned 0x0 [0045.595] lstrlenW (lpString=".DAT") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".DAT") returned 0x0 [0045.595] lstrlenW (lpString=".ldf") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".ldf") returned 0x0 [0045.595] lstrlenW (lpString=".LDF") returned 4 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch=".LDF") returned 0x0 [0045.595] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.595] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.596] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.596] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16559713188) returned 1 [0045.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9fc9d50, dwHighDateTime=0x1d585b4)) [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c28 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c28 | out: hHeap=0x260000) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0045.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0045.596] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.597] GetLastError () returned 0x0 [0045.597] GetLastError () returned 0x0 [0045.597] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.597] GetLastError () returned 0x0 [0045.597] GetLastError () returned 0x0 [0045.599] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffeb3c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.599] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x14c40, lpOverlapped=0x0) returned 1 [0045.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.600] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.600] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.600] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.600] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.600] CloseHandle (hObject=0x10c) returned 1 [0045.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.602] GetLastError () returned 0x0 [0045.602] RtlWakeConditionVariable () returned 0x27e828 [0045.602] GetCurrentThreadId () returned 0x98c [0045.602] GetCurrentThreadId () returned 0x98c [0045.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0045.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0045.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319af8 [0045.602] lstrlenW (lpString=".ldf") returned 4 [0045.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.602] lstrlenW (lpString=".vhd") returned 4 [0045.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.602] lstrlenW (lpString=".vhdx") returned 5 [0045.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.602] lstrlenW (lpString=".pst") returned 4 [0045.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.602] lstrlenW (lpString=".ost") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.603] lstrlenW (lpString=".bak") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.603] lstrlenW (lpString=".bac") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.603] lstrlenW (lpString=".sys") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.603] lstrlenW (lpString=".v2i") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.603] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.603] lstrlenW (lpString=".sql") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.603] lstrlenW (lpString=".mdf") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.603] lstrlenW (lpString=".txt") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.603] lstrlenW (lpString=".dbf") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.603] lstrlenW (lpString=".ckp") returned 4 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.603] lstrlenW (lpString=".dacpac") returned 7 [0045.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.604] lstrlenW (lpString=".db3") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.604] lstrlenW (lpString=".dtxs") returned 5 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.604] lstrlenW (lpString=".mdt") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.604] lstrlenW (lpString=".sdf") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.604] lstrlenW (lpString=".MDF") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.604] lstrlenW (lpString=".DBF") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.604] lstrlenW (lpString=".DB") returned 3 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.604] lstrlenW (lpString=".db") returned 3 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.604] lstrlenW (lpString=".ndf") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.604] lstrlenW (lpString=".NDF") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.604] lstrlenW (lpString=".Mdf") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.604] lstrlenW (lpString=".dat") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.604] lstrlenW (lpString=".DAT") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.604] lstrlenW (lpString=".ldf") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.604] lstrlenW (lpString=".LDF") returned 4 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.604] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.605] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.605] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.605] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.605] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16560655594) returned 1 [0045.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xa9fefeb0, dwHighDateTime=0x1d585b4)) [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d08 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e138 [0045.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e138 | out: hHeap=0x260000) returned 1 [0045.606] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.606] GetLastError () returned 0x0 [0045.606] GetLastError () returned 0x0 [0045.606] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.606] GetLastError () returned 0x0 [0045.606] GetLastError () returned 0x0 [0045.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff95d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.608] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x6a29, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x6a29, lpOverlapped=0x0) returned 1 [0045.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.608] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.608] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.608] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.608] CloseHandle (hObject=0x10c) returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.609] GetLastError () returned 0x0 [0045.609] RtlWakeConditionVariable () returned 0x27e828 [0045.609] GetCurrentThreadId () returned 0x98c [0045.609] GetCurrentThreadId () returned 0x98c [0045.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f95d0 | out: hHeap=0x260000) returned 1 [0045.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294988 | out: hHeap=0x260000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f95d0 [0045.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.610] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.610] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.610] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.610] WriteFile (in: hFile=0x10c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.611] CloseHandle (hObject=0x10c) returned 1 [0045.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f95d0 | out: hHeap=0x260000) returned 1 [0045.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.611] RtlWakeConditionVariable () returned 0x27e828 [0045.611] GetCurrentThreadId () returned 0x98c [0045.611] GetCurrentThreadId () returned 0x98c [0045.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0045.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ee8 | out: hHeap=0x260000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319ba0 [0045.611] lstrlenW (lpString=".ldf") returned 4 [0045.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.611] lstrlenW (lpString=".vhd") returned 4 [0045.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.611] lstrlenW (lpString=".vhdx") returned 5 [0045.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.611] lstrlenW (lpString=".pst") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.612] lstrlenW (lpString=".ost") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.612] lstrlenW (lpString=".bak") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.612] lstrlenW (lpString=".bac") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.612] lstrlenW (lpString=".sys") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.612] lstrlenW (lpString=".v2i") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.612] lstrlenW (lpString=".sql") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.612] lstrlenW (lpString=".mdf") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.612] lstrlenW (lpString=".txt") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.612] lstrlenW (lpString=".dbf") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.612] lstrlenW (lpString=".ckp") returned 4 [0045.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.613] lstrlenW (lpString=".dacpac") returned 7 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.613] lstrlenW (lpString=".db3") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.613] lstrlenW (lpString=".dtxs") returned 5 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.613] lstrlenW (lpString=".mdt") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.613] lstrlenW (lpString=".sdf") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.613] lstrlenW (lpString=".MDF") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.613] lstrlenW (lpString=".DBF") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.613] lstrlenW (lpString=".DB") returned 3 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.613] lstrlenW (lpString=".db") returned 3 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.613] lstrlenW (lpString=".ndf") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.613] lstrlenW (lpString=".NDF") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.613] lstrlenW (lpString=".Mdf") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.613] lstrlenW (lpString=".dat") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.613] lstrlenW (lpString=".DAT") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.613] lstrlenW (lpString=".ldf") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.613] lstrlenW (lpString=".LDF") returned 4 [0045.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.613] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.614] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.614] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.628] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.628] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16562880580) returned 1 [0045.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa016010, dwHighDateTime=0x1d585b4)) [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f58 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e1e0 [0045.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e1e0 | out: hHeap=0x260000) returned 1 [0045.628] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.628] GetLastError () returned 0x0 [0045.628] GetLastError () returned 0x0 [0045.628] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.629] GetLastError () returned 0x0 [0045.629] GetLastError () returned 0x0 [0045.631] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff75f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.631] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8a1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x8a1, lpOverlapped=0x0) returned 1 [0045.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.631] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.631] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.631] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.631] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.631] CloseHandle (hObject=0x10c) returned 1 [0045.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.658] GetLastError () returned 0x0 [0045.658] RtlWakeConditionVariable () returned 0x27e828 [0045.658] GetCurrentThreadId () returned 0x98c [0045.659] GetCurrentThreadId () returned 0x98c [0045.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319e40 | out: hHeap=0x260000) returned 1 [0045.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0045.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319e40 [0045.659] lstrlenW (lpString=".ldf") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.659] lstrlenW (lpString=".vhd") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.659] lstrlenW (lpString=".vhdx") returned 5 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.659] lstrlenW (lpString=".pst") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.659] lstrlenW (lpString=".ost") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.659] lstrlenW (lpString=".bak") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.659] lstrlenW (lpString=".bac") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.659] lstrlenW (lpString=".sys") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.659] lstrlenW (lpString=".v2i") returned 4 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.659] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.660] lstrlenW (lpString=".sql") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.660] lstrlenW (lpString=".mdf") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.660] lstrlenW (lpString=".txt") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.660] lstrlenW (lpString=".dbf") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.660] lstrlenW (lpString=".ckp") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.660] lstrlenW (lpString=".dacpac") returned 7 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.660] lstrlenW (lpString=".db3") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.660] lstrlenW (lpString=".dtxs") returned 5 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.660] lstrlenW (lpString=".mdt") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.660] lstrlenW (lpString=".sdf") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.660] lstrlenW (lpString=".MDF") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.660] lstrlenW (lpString=".DBF") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.660] lstrlenW (lpString=".DB") returned 3 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.660] lstrlenW (lpString=".db") returned 3 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.660] lstrlenW (lpString=".ndf") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.660] lstrlenW (lpString=".NDF") returned 4 [0045.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.661] lstrlenW (lpString=".Mdf") returned 4 [0045.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.661] lstrlenW (lpString=".dat") returned 4 [0045.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.661] lstrlenW (lpString=".DAT") returned 4 [0045.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.661] lstrlenW (lpString=".ldf") returned 4 [0045.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.661] lstrlenW (lpString=".LDF") returned 4 [0045.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.661] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.661] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.662] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.662] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.662] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16566311468) returned 1 [0045.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa088430, dwHighDateTime=0x1d585b4)) [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295000 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0045.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0045.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.663] GetLastError () returned 0x0 [0045.663] GetLastError () returned 0x0 [0045.663] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.663] GetLastError () returned 0x0 [0045.663] GetLastError () returned 0x0 [0045.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff621, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.664] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9df, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x9df, lpOverlapped=0x0) returned 1 [0045.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.664] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.665] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.665] CloseHandle (hObject=0x10c) returned 1 [0045.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.665] GetLastError () returned 0x0 [0045.666] RtlWakeConditionVariable () returned 0x27e828 [0045.666] GetCurrentThreadId () returned 0x98c [0045.666] GetCurrentThreadId () returned 0x98c [0045.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ee8 | out: hHeap=0x260000) returned 1 [0045.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0045.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319ee8 [0045.666] lstrlenW (lpString=".ldf") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".ldf") returned 0x0 [0045.666] lstrlenW (lpString=".vhd") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".vhd") returned 0x0 [0045.666] lstrlenW (lpString=".vhdx") returned 5 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".vhdx") returned 0x0 [0045.666] lstrlenW (lpString=".pst") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".pst") returned 0x0 [0045.666] lstrlenW (lpString=".ost") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".ost") returned 0x0 [0045.666] lstrlenW (lpString=".bak") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".bak") returned 0x0 [0045.666] lstrlenW (lpString=".bac") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".bac") returned 0x0 [0045.666] lstrlenW (lpString=".sys") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".sys") returned 0x0 [0045.666] lstrlenW (lpString=".v2i") returned 4 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".v2i") returned 0x0 [0045.666] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.667] lstrlenW (lpString=".sql") returned 4 [0045.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".sql") returned 0x0 [0045.667] lstrlenW (lpString=".mdf") returned 4 [0045.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".mdf") returned 0x0 [0045.667] lstrlenW (lpString=".txt") returned 4 [0045.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".txt") returned 0x0 [0045.667] lstrlenW (lpString=".dbf") returned 4 [0045.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".dbf") returned 0x0 [0045.667] lstrlenW (lpString=".ckp") returned 4 [0045.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".ckp") returned 0x0 [0045.667] lstrlenW (lpString=".dacpac") returned 7 [0045.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".dacpac") returned 0x0 [0045.667] lstrlenW (lpString=".db3") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".db3") returned 0x0 [0045.668] lstrlenW (lpString=".dtxs") returned 5 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".dtxs") returned 0x0 [0045.668] lstrlenW (lpString=".mdt") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".mdt") returned 0x0 [0045.668] lstrlenW (lpString=".sdf") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".sdf") returned 0x0 [0045.668] lstrlenW (lpString=".MDF") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".MDF") returned 0x0 [0045.668] lstrlenW (lpString=".DBF") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".DBF") returned 0x0 [0045.668] lstrlenW (lpString=".DB") returned 3 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".DB") returned 0x0 [0045.668] lstrlenW (lpString=".db") returned 3 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".db") returned 0x0 [0045.668] lstrlenW (lpString=".ndf") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".ndf") returned 0x0 [0045.668] lstrlenW (lpString=".NDF") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".NDF") returned 0x0 [0045.668] lstrlenW (lpString=".Mdf") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".Mdf") returned 0x0 [0045.668] lstrlenW (lpString=".dat") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".dat") returned 0x0 [0045.668] lstrlenW (lpString=".DAT") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".DAT") returned 0x0 [0045.668] lstrlenW (lpString=".ldf") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".ldf") returned 0x0 [0045.668] lstrlenW (lpString=".LDF") returned 4 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch=".LDF") returned 0x0 [0045.668] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.669] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.669] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.669] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16567050684) returned 1 [0045.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa088430, dwHighDateTime=0x1d585b4)) [0045.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295038 [0045.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0045.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319e40 [0045.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319e40 | out: hHeap=0x260000) returned 1 [0045.670] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.670] GetLastError () returned 0x0 [0045.670] GetLastError () returned 0x0 [0045.670] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.670] GetLastError () returned 0x0 [0045.670] GetLastError () returned 0x0 [0045.672] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffef50f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.672] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x10af1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x10af1, lpOverlapped=0x0) returned 1 [0045.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.673] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.673] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.673] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.673] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.673] CloseHandle (hObject=0x10c) returned 1 [0045.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.673] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.675] GetLastError () returned 0x0 [0045.675] RtlWakeConditionVariable () returned 0x27e828 [0045.675] GetCurrentThreadId () returned 0x98c [0045.675] GetCurrentThreadId () returned 0x98c [0045.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319f90 | out: hHeap=0x260000) returned 1 [0045.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295070 | out: hHeap=0x260000) returned 1 [0045.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319f90 [0045.675] lstrlenW (lpString=".ldf") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".ldf") returned 0x0 [0045.675] lstrlenW (lpString=".vhd") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".vhd") returned 0x0 [0045.675] lstrlenW (lpString=".vhdx") returned 5 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".vhdx") returned 0x0 [0045.675] lstrlenW (lpString=".pst") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".pst") returned 0x0 [0045.675] lstrlenW (lpString=".ost") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".ost") returned 0x0 [0045.675] lstrlenW (lpString=".bak") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".bak") returned 0x0 [0045.675] lstrlenW (lpString=".bac") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".bac") returned 0x0 [0045.675] lstrlenW (lpString=".sys") returned 4 [0045.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".sys") returned 0x0 [0045.675] lstrlenW (lpString=".v2i") returned 4 [0045.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".v2i") returned 0x0 [0045.676] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.677] lstrlenW (lpString=".sql") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".sql") returned 0x0 [0045.677] lstrlenW (lpString=".mdf") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".mdf") returned 0x0 [0045.677] lstrlenW (lpString=".txt") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".txt") returned 0x0 [0045.677] lstrlenW (lpString=".dbf") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".dbf") returned 0x0 [0045.677] lstrlenW (lpString=".ckp") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".ckp") returned 0x0 [0045.677] lstrlenW (lpString=".dacpac") returned 7 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".dacpac") returned 0x0 [0045.677] lstrlenW (lpString=".db3") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".db3") returned 0x0 [0045.677] lstrlenW (lpString=".dtxs") returned 5 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".dtxs") returned 0x0 [0045.677] lstrlenW (lpString=".mdt") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".mdt") returned 0x0 [0045.677] lstrlenW (lpString=".sdf") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".sdf") returned 0x0 [0045.677] lstrlenW (lpString=".MDF") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".MDF") returned 0x0 [0045.677] lstrlenW (lpString=".DBF") returned 4 [0045.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".DBF") returned 0x0 [0045.678] lstrlenW (lpString=".DB") returned 3 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".DB") returned 0x0 [0045.678] lstrlenW (lpString=".db") returned 3 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".db") returned 0x0 [0045.678] lstrlenW (lpString=".ndf") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".ndf") returned 0x0 [0045.678] lstrlenW (lpString=".NDF") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".NDF") returned 0x0 [0045.678] lstrlenW (lpString=".Mdf") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".Mdf") returned 0x0 [0045.678] lstrlenW (lpString=".dat") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".dat") returned 0x0 [0045.678] lstrlenW (lpString=".DAT") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".DAT") returned 0x0 [0045.678] lstrlenW (lpString=".ldf") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".ldf") returned 0x0 [0045.678] lstrlenW (lpString=".LDF") returned 4 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch=".LDF") returned 0x0 [0045.678] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.678] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.679] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.679] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.679] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16568018858) returned 1 [0045.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa0ae590, dwHighDateTime=0x1d585b4)) [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295070 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295070 | out: hHeap=0x260000) returned 1 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ee8 [0045.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ee8 | out: hHeap=0x260000) returned 1 [0045.680] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.680] GetLastError () returned 0x0 [0045.680] GetLastError () returned 0x0 [0045.680] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.680] GetLastError () returned 0x0 [0045.680] GetLastError () returned 0x0 [0045.681] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.681] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1d2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1d2, lpOverlapped=0x0) returned 1 [0045.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.681] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.681] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.681] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.681] CloseHandle (hObject=0x10c) returned 1 [0045.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.682] GetLastError () returned 0x0 [0045.682] RtlWakeConditionVariable () returned 0x27e828 [0045.682] GetCurrentThreadId () returned 0x98c [0045.682] GetCurrentThreadId () returned 0x98c [0045.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0045.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0045.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a038 [0045.682] lstrlenW (lpString=".ldf") returned 4 [0045.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.682] lstrlenW (lpString=".vhd") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.683] lstrlenW (lpString=".vhdx") returned 5 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.683] lstrlenW (lpString=".pst") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.683] lstrlenW (lpString=".ost") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.683] lstrlenW (lpString=".bak") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.683] lstrlenW (lpString=".bac") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.683] lstrlenW (lpString=".sys") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.683] lstrlenW (lpString=".v2i") returned 4 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.683] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.684] lstrlenW (lpString=".sql") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.684] lstrlenW (lpString=".mdf") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.684] lstrlenW (lpString=".txt") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.684] lstrlenW (lpString=".dbf") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.684] lstrlenW (lpString=".ckp") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.684] lstrlenW (lpString=".dacpac") returned 7 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.684] lstrlenW (lpString=".db3") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.684] lstrlenW (lpString=".dtxs") returned 5 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.684] lstrlenW (lpString=".mdt") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.684] lstrlenW (lpString=".sdf") returned 4 [0045.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.684] lstrlenW (lpString=".MDF") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.685] lstrlenW (lpString=".DBF") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.685] lstrlenW (lpString=".DB") returned 3 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.685] lstrlenW (lpString=".db") returned 3 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.685] lstrlenW (lpString=".ndf") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.685] lstrlenW (lpString=".NDF") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.685] lstrlenW (lpString=".Mdf") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.685] lstrlenW (lpString=".dat") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.685] lstrlenW (lpString=".DAT") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.685] lstrlenW (lpString=".ldf") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.685] lstrlenW (lpString=".LDF") returned 4 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.685] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.685] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.686] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.686] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16568725790) returned 1 [0045.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa0ae590, dwHighDateTime=0x1d585b4)) [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295150 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319f90 [0045.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319f90 | out: hHeap=0x260000) returned 1 [0045.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.687] GetLastError () returned 0x0 [0045.687] GetLastError () returned 0x0 [0045.687] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.687] GetLastError () returned 0x0 [0045.687] GetLastError () returned 0x0 [0045.772] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb3bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.772] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4c45, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x4c45, lpOverlapped=0x0) returned 1 [0045.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.779] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.779] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.779] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.779] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.779] CloseHandle (hObject=0x10c) returned 1 [0045.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x316238 [0045.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x316238 | out: hHeap=0x260000) returned 1 [0045.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.780] GetLastError () returned 0x0 [0045.780] RtlWakeConditionVariable () returned 0x27e828 [0045.780] GetCurrentThreadId () returned 0x98c [0045.780] GetCurrentThreadId () returned 0x98c [0045.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a230 | out: hHeap=0x260000) returned 1 [0045.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0045.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.781] lstrlenW (lpString=".ldf") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".ldf") returned 0x0 [0045.781] lstrlenW (lpString=".vhd") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".vhd") returned 0x0 [0045.781] lstrlenW (lpString=".vhdx") returned 5 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".vhdx") returned 0x0 [0045.781] lstrlenW (lpString=".pst") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".pst") returned 0x0 [0045.781] lstrlenW (lpString=".ost") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".ost") returned 0x0 [0045.781] lstrlenW (lpString=".bak") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".bak") returned 0x0 [0045.781] lstrlenW (lpString=".bac") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".bac") returned 0x0 [0045.781] lstrlenW (lpString=".sys") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".sys") returned 0x0 [0045.781] lstrlenW (lpString=".v2i") returned 4 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".v2i") returned 0x0 [0045.781] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.840] lstrlenW (lpString=".sql") returned 4 [0045.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".sql") returned 0x0 [0045.840] lstrlenW (lpString=".mdf") returned 4 [0045.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".mdf") returned 0x0 [0045.840] lstrlenW (lpString=".txt") returned 4 [0045.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".txt") returned 0x0 [0045.841] lstrlenW (lpString=".dbf") returned 4 [0045.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".dbf") returned 0x0 [0045.844] lstrlenW (lpString=".ckp") returned 4 [0045.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".ckp") returned 0x0 [0045.858] lstrlenW (lpString=".dacpac") returned 7 [0045.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".dacpac") returned 0x0 [0045.858] lstrlenW (lpString=".db3") returned 4 [0045.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".db3") returned 0x0 [0045.867] lstrlenW (lpString=".dtxs") returned 5 [0045.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".dtxs") returned 0x0 [0045.867] lstrlenW (lpString=".mdt") returned 4 [0045.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".mdt") returned 0x0 [0045.867] lstrlenW (lpString=".sdf") returned 4 [0045.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".sdf") returned 0x0 [0045.884] lstrlenW (lpString=".MDF") returned 4 [0045.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".MDF") returned 0x0 [0045.884] lstrlenW (lpString=".DBF") returned 4 [0045.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".DBF") returned 0x0 [0045.884] lstrlenW (lpString=".DB") returned 3 [0045.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".DB") returned 0x0 [0045.886] lstrlenW (lpString=".db") returned 3 [0045.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".db") returned 0x0 [0045.889] lstrlenW (lpString=".ndf") returned 4 [0045.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".ndf") returned 0x0 [0045.889] lstrlenW (lpString=".NDF") returned 4 [0045.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".NDF") returned 0x0 [0045.889] lstrlenW (lpString=".Mdf") returned 4 [0045.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".Mdf") returned 0x0 [0045.894] lstrlenW (lpString=".dat") returned 4 [0045.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".dat") returned 0x0 [0045.894] lstrlenW (lpString=".DAT") returned 4 [0045.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".DAT") returned 0x0 [0045.894] lstrlenW (lpString=".ldf") returned 4 [0045.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".ldf") returned 0x0 [0045.894] lstrlenW (lpString=".LDF") returned 4 [0045.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch=".LDF") returned 0x0 [0045.894] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.894] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0045.895] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.895] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.896] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16589676105) returned 1 [0045.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa2c38d0, dwHighDateTime=0x1d585b4)) [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a428 [0045.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a428 | out: hHeap=0x260000) returned 1 [0045.896] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0045.896] GetLastError () returned 0x0 [0045.896] GetLastError () returned 0x0 [0045.896] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0045.897] GetLastError () returned 0x0 [0045.897] GetLastError () returned 0x0 [0045.899] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffdbe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.899] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x242, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x242, lpOverlapped=0x0) returned 1 [0045.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.899] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.899] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.899] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.899] CloseHandle (hObject=0x104) returned 1 [0045.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.900] GetLastError () returned 0x0 [0045.900] RtlWakeConditionVariable () returned 0x27e828 [0045.900] GetCurrentThreadId () returned 0x98c [0045.900] GetCurrentThreadId () returned 0x98c [0045.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0045.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a578 | out: hHeap=0x260000) returned 1 [0045.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a578 [0045.901] lstrlenW (lpString=".ldf") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".ldf") returned 0x0 [0045.901] lstrlenW (lpString=".vhd") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".vhd") returned 0x0 [0045.901] lstrlenW (lpString=".vhdx") returned 5 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".vhdx") returned 0x0 [0045.901] lstrlenW (lpString=".pst") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".pst") returned 0x0 [0045.901] lstrlenW (lpString=".ost") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".ost") returned 0x0 [0045.901] lstrlenW (lpString=".bak") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".bak") returned 0x0 [0045.901] lstrlenW (lpString=".bac") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".bac") returned 0x0 [0045.901] lstrlenW (lpString=".sys") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".sys") returned 0x0 [0045.901] lstrlenW (lpString=".v2i") returned 4 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".v2i") returned 0x0 [0045.901] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.016] lstrlenW (lpString=".sql") returned 4 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".sql") returned 0x0 [0046.016] lstrlenW (lpString=".mdf") returned 4 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".mdf") returned 0x0 [0046.016] lstrlenW (lpString=".txt") returned 4 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".txt") returned 0x0 [0046.016] lstrlenW (lpString=".dbf") returned 4 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".dbf") returned 0x0 [0046.016] lstrlenW (lpString=".ckp") returned 4 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".ckp") returned 0x0 [0046.016] lstrlenW (lpString=".dacpac") returned 7 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".dacpac") returned 0x0 [0046.016] lstrlenW (lpString=".db3") returned 4 [0046.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".db3") returned 0x0 [0046.017] lstrlenW (lpString=".dtxs") returned 5 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".dtxs") returned 0x0 [0046.017] lstrlenW (lpString=".mdt") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".mdt") returned 0x0 [0046.017] lstrlenW (lpString=".sdf") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".sdf") returned 0x0 [0046.017] lstrlenW (lpString=".MDF") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".MDF") returned 0x0 [0046.017] lstrlenW (lpString=".DBF") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".DBF") returned 0x0 [0046.017] lstrlenW (lpString=".DB") returned 3 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".DB") returned 0x0 [0046.017] lstrlenW (lpString=".db") returned 3 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".db") returned 0x0 [0046.017] lstrlenW (lpString=".ndf") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".ndf") returned 0x0 [0046.017] lstrlenW (lpString=".NDF") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".NDF") returned 0x0 [0046.017] lstrlenW (lpString=".Mdf") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".Mdf") returned 0x0 [0046.017] lstrlenW (lpString=".dat") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".dat") returned 0x0 [0046.017] lstrlenW (lpString=".DAT") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".DAT") returned 0x0 [0046.017] lstrlenW (lpString=".ldf") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".ldf") returned 0x0 [0046.017] lstrlenW (lpString=".LDF") returned 4 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch=".LDF") returned 0x0 [0046.017] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.018] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3351e0) returned 1 [0046.018] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.018] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.018] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16601954020) returned 1 [0046.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa3ce270, dwHighDateTime=0x1d585b4)) [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337140 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337140 | out: hHeap=0x260000) returned 1 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a770 [0046.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a770 | out: hHeap=0x260000) returned 1 [0046.019] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.019] GetLastError () returned 0x0 [0046.019] GetLastError () returned 0x0 [0046.019] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.019] GetLastError () returned 0x0 [0046.019] GetLastError () returned 0x0 [0046.022] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe5f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.022] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x1a1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x1a1, lpOverlapped=0x0) returned 1 [0046.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.022] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.022] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.022] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.022] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.022] CloseHandle (hObject=0xfc) returned 1 [0046.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.022] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.[deadmin@cock.li].deadmin")) returned 1 [0046.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.023] GetLastError () returned 0x0 [0046.023] RtlWakeConditionVariable () returned 0x27e828 [0046.023] GetCurrentThreadId () returned 0x98c [0046.023] GetCurrentThreadId () returned 0x98c [0046.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0046.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9828 | out: hHeap=0x260000) returned 1 [0046.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0046.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9828 [0046.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.024] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.024] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.024] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.024] WriteFile (in: hFile=0xfc, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.025] CloseHandle (hObject=0xfc) returned 1 [0046.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9828 | out: hHeap=0x260000) returned 1 [0046.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0046.025] RtlWakeConditionVariable () returned 0x27e828 [0046.025] GetCurrentThreadId () returned 0x98c [0046.025] GetCurrentThreadId () returned 0x98c [0046.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0046.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a8c0 | out: hHeap=0x260000) returned 1 [0046.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0046.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a8c0 [0046.025] lstrlenW (lpString=".ldf") returned 4 [0046.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".ldf") returned 0x0 [0046.025] lstrlenW (lpString=".vhd") returned 4 [0046.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".vhd") returned 0x0 [0046.025] lstrlenW (lpString=".vhdx") returned 5 [0046.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".vhdx") returned 0x0 [0046.025] lstrlenW (lpString=".pst") returned 4 [0046.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".pst") returned 0x0 [0046.026] lstrlenW (lpString=".ost") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".ost") returned 0x0 [0046.026] lstrlenW (lpString=".bak") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".bak") returned 0x0 [0046.026] lstrlenW (lpString=".bac") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".bac") returned 0x0 [0046.026] lstrlenW (lpString=".sys") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".sys") returned 0x0 [0046.026] lstrlenW (lpString=".v2i") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".v2i") returned 0x0 [0046.026] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.026] lstrlenW (lpString=".sql") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".sql") returned 0x0 [0046.026] lstrlenW (lpString=".mdf") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".mdf") returned 0x0 [0046.026] lstrlenW (lpString=".txt") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".txt") returned 0x0 [0046.026] lstrlenW (lpString=".dbf") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".dbf") returned 0x0 [0046.026] lstrlenW (lpString=".ckp") returned 4 [0046.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".ckp") returned 0x0 [0046.027] lstrlenW (lpString=".dacpac") returned 7 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".dacpac") returned 0x0 [0046.027] lstrlenW (lpString=".db3") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".db3") returned 0x0 [0046.027] lstrlenW (lpString=".dtxs") returned 5 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".dtxs") returned 0x0 [0046.027] lstrlenW (lpString=".mdt") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".mdt") returned 0x0 [0046.027] lstrlenW (lpString=".sdf") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".sdf") returned 0x0 [0046.027] lstrlenW (lpString=".MDF") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".MDF") returned 0x0 [0046.027] lstrlenW (lpString=".DBF") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".DBF") returned 0x0 [0046.027] lstrlenW (lpString=".DB") returned 3 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".DB") returned 0x0 [0046.027] lstrlenW (lpString=".db") returned 3 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".db") returned 0x0 [0046.027] lstrlenW (lpString=".ndf") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".ndf") returned 0x0 [0046.027] lstrlenW (lpString=".NDF") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".NDF") returned 0x0 [0046.027] lstrlenW (lpString=".Mdf") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".Mdf") returned 0x0 [0046.027] lstrlenW (lpString=".dat") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".dat") returned 0x0 [0046.027] lstrlenW (lpString=".DAT") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".DAT") returned 0x0 [0046.027] lstrlenW (lpString=".ldf") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".ldf") returned 0x0 [0046.027] lstrlenW (lpString=".LDF") returned 4 [0046.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch=".LDF") returned 0x0 [0046.027] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.028] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3351e0) returned 1 [0046.028] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.028] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.028] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16602960540) returned 1 [0046.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa3f43d0, dwHighDateTime=0x1d585b4)) [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c28 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a578 [0046.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a578 | out: hHeap=0x260000) returned 1 [0046.029] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.029] GetLastError () returned 0x0 [0046.029] GetLastError () returned 0x0 [0046.029] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.029] GetLastError () returned 0x0 [0046.029] GetLastError () returned 0x0 [0046.032] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.032] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.033] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.033] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.033] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.033] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.033] CloseHandle (hObject=0xfc) returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2a0378 [0046.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0378 | out: hHeap=0x260000) returned 1 [0046.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.034] GetLastError () returned 0x0 [0046.034] RtlWakeConditionVariable () returned 0x27e828 [0046.034] GetCurrentThreadId () returned 0x98c [0046.034] GetCurrentThreadId () returned 0x98c [0046.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0046.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a968 | out: hHeap=0x260000) returned 1 [0046.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0046.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a968 [0046.034] lstrlenW (lpString=".ldf") returned 4 [0046.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".ldf") returned 0x0 [0046.034] lstrlenW (lpString=".vhd") returned 4 [0046.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".vhd") returned 0x0 [0046.034] lstrlenW (lpString=".vhdx") returned 5 [0046.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".vhdx") returned 0x0 [0046.034] lstrlenW (lpString=".pst") returned 4 [0046.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".pst") returned 0x0 [0046.035] lstrlenW (lpString=".ost") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".ost") returned 0x0 [0046.035] lstrlenW (lpString=".bak") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".bak") returned 0x0 [0046.035] lstrlenW (lpString=".bac") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".bac") returned 0x0 [0046.035] lstrlenW (lpString=".sys") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".sys") returned 0x0 [0046.035] lstrlenW (lpString=".v2i") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".v2i") returned 0x0 [0046.035] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch="s\r\n.v2i") returned 0x0 [0046.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.035] lstrlenW (lpString=".sql") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".sql") returned 0x0 [0046.035] lstrlenW (lpString=".mdf") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".mdf") returned 0x0 [0046.035] lstrlenW (lpString=".txt") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".txt") returned 0x0 [0046.035] lstrlenW (lpString=".dbf") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".dbf") returned 0x0 [0046.035] lstrlenW (lpString=".ckp") returned 4 [0046.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".ckp") returned 0x0 [0046.035] lstrlenW (lpString=".dacpac") returned 7 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".dacpac") returned 0x0 [0046.036] lstrlenW (lpString=".db3") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".db3") returned 0x0 [0046.036] lstrlenW (lpString=".dtxs") returned 5 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".dtxs") returned 0x0 [0046.036] lstrlenW (lpString=".mdt") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".mdt") returned 0x0 [0046.036] lstrlenW (lpString=".sdf") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".sdf") returned 0x0 [0046.036] lstrlenW (lpString=".MDF") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".MDF") returned 0x0 [0046.036] lstrlenW (lpString=".DBF") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".DBF") returned 0x0 [0046.036] lstrlenW (lpString=".DB") returned 3 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".DB") returned 0x0 [0046.036] lstrlenW (lpString=".db") returned 3 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".db") returned 0x0 [0046.036] lstrlenW (lpString=".ndf") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".ndf") returned 0x0 [0046.036] lstrlenW (lpString=".NDF") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".NDF") returned 0x0 [0046.036] lstrlenW (lpString=".Mdf") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".Mdf") returned 0x0 [0046.036] lstrlenW (lpString=".dat") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".dat") returned 0x0 [0046.036] lstrlenW (lpString=".DAT") returned 4 [0046.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".DAT") returned 0x0 [0046.036] lstrlenW (lpString=".ldf") returned 4 [0046.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".ldf") returned 0x0 [0046.037] lstrlenW (lpString=".LDF") returned 4 [0046.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch=".LDF") returned 0x0 [0046.037] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.037] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3351e0) returned 1 [0046.037] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.037] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.038] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16603873133) returned 1 [0046.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa41a530, dwHighDateTime=0x1d585b4)) [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bf0 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a8c0 [0046.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a8c0 | out: hHeap=0x260000) returned 1 [0046.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.038] GetLastError () returned 0x0 [0046.038] GetLastError () returned 0x0 [0046.038] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.038] GetLastError () returned 0x0 [0046.039] GetLastError () returned 0x0 [0046.042] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.042] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.043] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.043] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.045] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.045] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.045] CloseHandle (hObject=0xfc) returned 1 [0046.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.[deadmin@cock.li].deadmin")) returned 1 [0046.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.046] GetLastError () returned 0x0 [0046.046] RtlWakeConditionVariable () returned 0x27e828 [0046.046] GetCurrentThreadId () returned 0x98c [0046.046] GetCurrentThreadId () returned 0x98c [0046.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0046.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f98f0 | out: hHeap=0x260000) returned 1 [0046.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0046.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f98f0 [0046.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0046.199] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.199] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.199] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.199] WriteFile (in: hFile=0x108, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.200] CloseHandle (hObject=0x108) returned 1 [0046.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f98f0 | out: hHeap=0x260000) returned 1 [0046.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0046.200] RtlWakeConditionVariable () returned 0x27e828 [0046.200] GetCurrentThreadId () returned 0x98c [0046.200] GetCurrentThreadId () returned 0x98c [0046.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b0a0 [0046.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0046.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d940 | out: hHeap=0x260000) returned 1 [0046.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b298 [0046.201] lstrlenW (lpString=".ldf") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".ldf") returned 0x0 [0046.201] lstrlenW (lpString=".vhd") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".vhd") returned 0x0 [0046.201] lstrlenW (lpString=".vhdx") returned 5 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".vhdx") returned 0x0 [0046.201] lstrlenW (lpString=".pst") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".pst") returned 0x0 [0046.201] lstrlenW (lpString=".ost") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".ost") returned 0x0 [0046.201] lstrlenW (lpString=".bak") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".bak") returned 0x0 [0046.201] lstrlenW (lpString=".bac") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".bac") returned 0x0 [0046.201] lstrlenW (lpString=".sys") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".sys") returned 0x0 [0046.201] lstrlenW (lpString=".v2i") returned 4 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".v2i") returned 0x0 [0046.201] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.294] lstrlenW (lpString=".sql") returned 4 [0046.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".sql") returned 0x0 [0046.294] lstrlenW (lpString=".mdf") returned 4 [0046.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".mdf") returned 0x0 [0046.294] lstrlenW (lpString=".txt") returned 4 [0046.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".txt") returned 0x0 [0046.294] lstrlenW (lpString=".dbf") returned 4 [0046.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".dbf") returned 0x0 [0046.295] lstrlenW (lpString=".ckp") returned 4 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".ckp") returned 0x0 [0046.311] lstrlenW (lpString=".dacpac") returned 7 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".dacpac") returned 0x0 [0046.311] lstrlenW (lpString=".db3") returned 4 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".db3") returned 0x0 [0046.311] lstrlenW (lpString=".dtxs") returned 5 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".dtxs") returned 0x0 [0046.311] lstrlenW (lpString=".mdt") returned 4 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".mdt") returned 0x0 [0046.311] lstrlenW (lpString=".sdf") returned 4 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".sdf") returned 0x0 [0046.311] lstrlenW (lpString=".MDF") returned 4 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".MDF") returned 0x0 [0046.311] lstrlenW (lpString=".DBF") returned 4 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".DBF") returned 0x0 [0046.311] lstrlenW (lpString=".DB") returned 3 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".DB") returned 0x0 [0046.311] lstrlenW (lpString=".db") returned 3 [0046.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".db") returned 0x0 [0046.322] lstrlenW (lpString=".ndf") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".ndf") returned 0x0 [0046.322] lstrlenW (lpString=".NDF") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".NDF") returned 0x0 [0046.322] lstrlenW (lpString=".Mdf") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".Mdf") returned 0x0 [0046.322] lstrlenW (lpString=".dat") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".dat") returned 0x0 [0046.322] lstrlenW (lpString=".DAT") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".DAT") returned 0x0 [0046.322] lstrlenW (lpString=".ldf") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".ldf") returned 0x0 [0046.322] lstrlenW (lpString=".LDF") returned 4 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch=".LDF") returned 0x0 [0046.322] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.322] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0046.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.333] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2cd240 [0046.333] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16633417264) returned 1 [0046.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa6edf50, dwHighDateTime=0x1d585b4)) [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7710 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7710 | out: hHeap=0x260000) returned 1 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0046.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0046.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.334] GetLastError () returned 0x0 [0046.334] GetLastError () returned 0x0 [0046.334] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.334] GetLastError () returned 0x0 [0046.334] GetLastError () returned 0x0 [0046.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffee6a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.337] WriteFile (in: hFile=0x104, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x1195f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1195f, lpOverlapped=0x0) returned 1 [0046.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0046.338] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.338] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.338] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.338] CloseHandle (hObject=0x104) returned 1 [0046.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.339] GetLastError () returned 0x0 [0046.340] RtlWakeConditionVariable () returned 0x27e828 [0046.340] GetCurrentThreadId () returned 0x98c [0046.340] GetCurrentThreadId () returned 0x98c [0046.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x333e58 [0046.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edda8 | out: hHeap=0x260000) returned 1 [0046.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7780 | out: hHeap=0x260000) returned 1 [0046.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edda8 [0046.340] lstrlenW (lpString=".ldf") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".ldf") returned 0x0 [0046.340] lstrlenW (lpString=".vhd") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".vhd") returned 0x0 [0046.340] lstrlenW (lpString=".vhdx") returned 5 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".vhdx") returned 0x0 [0046.340] lstrlenW (lpString=".pst") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".pst") returned 0x0 [0046.340] lstrlenW (lpString=".ost") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".ost") returned 0x0 [0046.340] lstrlenW (lpString=".bak") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".bak") returned 0x0 [0046.340] lstrlenW (lpString=".bac") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".bac") returned 0x0 [0046.340] lstrlenW (lpString=".sys") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".sys") returned 0x0 [0046.340] lstrlenW (lpString=".v2i") returned 4 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".v2i") returned 0x0 [0046.340] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.341] lstrlenW (lpString=".sql") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".sql") returned 0x0 [0046.341] lstrlenW (lpString=".mdf") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".mdf") returned 0x0 [0046.341] lstrlenW (lpString=".txt") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".txt") returned 0x0 [0046.341] lstrlenW (lpString=".dbf") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".dbf") returned 0x0 [0046.341] lstrlenW (lpString=".ckp") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".ckp") returned 0x0 [0046.341] lstrlenW (lpString=".dacpac") returned 7 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".dacpac") returned 0x0 [0046.341] lstrlenW (lpString=".db3") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".db3") returned 0x0 [0046.341] lstrlenW (lpString=".dtxs") returned 5 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".dtxs") returned 0x0 [0046.341] lstrlenW (lpString=".mdt") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".mdt") returned 0x0 [0046.341] lstrlenW (lpString=".sdf") returned 4 [0046.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".sdf") returned 0x0 [0046.341] lstrlenW (lpString=".MDF") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".MDF") returned 0x0 [0046.342] lstrlenW (lpString=".DBF") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".DBF") returned 0x0 [0046.342] lstrlenW (lpString=".DB") returned 3 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".DB") returned 0x0 [0046.342] lstrlenW (lpString=".db") returned 3 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".db") returned 0x0 [0046.342] lstrlenW (lpString=".ndf") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".ndf") returned 0x0 [0046.342] lstrlenW (lpString=".NDF") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".NDF") returned 0x0 [0046.342] lstrlenW (lpString=".Mdf") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".Mdf") returned 0x0 [0046.342] lstrlenW (lpString=".dat") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".dat") returned 0x0 [0046.342] lstrlenW (lpString=".DAT") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".DAT") returned 0x0 [0046.342] lstrlenW (lpString=".ldf") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".ldf") returned 0x0 [0046.342] lstrlenW (lpString=".LDF") returned 4 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch=".LDF") returned 0x0 [0046.342] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.342] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0046.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.345] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0046.346] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16634760454) returned 1 [0046.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa6edf50, dwHighDateTime=0x1d585b4)) [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7780 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7780 | out: hHeap=0x260000) returned 1 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.347] GetLastError () returned 0x0 [0046.347] GetLastError () returned 0x0 [0046.347] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.347] GetLastError () returned 0x0 [0046.347] GetLastError () returned 0x0 [0046.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.389] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0046.402] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.402] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.446] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.446] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.446] CloseHandle (hObject=0x104) returned 1 [0046.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.446] GetLastError () returned 0x0 [0046.446] RtlWakeConditionVariable () returned 0x27e828 [0046.446] GetCurrentThreadId () returned 0x98c [0046.446] GetCurrentThreadId () returned 0x98c [0046.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x333e58 [0046.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee4d8 | out: hHeap=0x260000) returned 1 [0046.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8220 | out: hHeap=0x260000) returned 1 [0046.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee4d8 [0046.447] lstrlenW (lpString=".ldf") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".ldf") returned 0x0 [0046.447] lstrlenW (lpString=".vhd") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".vhd") returned 0x0 [0046.447] lstrlenW (lpString=".vhdx") returned 5 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".vhdx") returned 0x0 [0046.447] lstrlenW (lpString=".pst") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".pst") returned 0x0 [0046.447] lstrlenW (lpString=".ost") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".ost") returned 0x0 [0046.447] lstrlenW (lpString=".bak") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".bak") returned 0x0 [0046.447] lstrlenW (lpString=".bac") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".bac") returned 0x0 [0046.447] lstrlenW (lpString=".sys") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".sys") returned 0x0 [0046.447] lstrlenW (lpString=".v2i") returned 4 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".v2i") returned 0x0 [0046.447] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch="s\r\n.v2i") returned 0x0 [0046.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.545] lstrlenW (lpString=".sql") returned 4 [0046.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".sql") returned 0x0 [0046.545] lstrlenW (lpString=".mdf") returned 4 [0046.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".mdf") returned 0x0 [0046.545] lstrlenW (lpString=".txt") returned 4 [0046.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".txt") returned 0x0 [0046.545] lstrlenW (lpString=".dbf") returned 4 [0046.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".dbf") returned 0x0 [0046.545] lstrlenW (lpString=".ckp") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".ckp") returned 0x0 [0046.546] lstrlenW (lpString=".dacpac") returned 7 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".dacpac") returned 0x0 [0046.546] lstrlenW (lpString=".db3") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".db3") returned 0x0 [0046.546] lstrlenW (lpString=".dtxs") returned 5 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".dtxs") returned 0x0 [0046.546] lstrlenW (lpString=".mdt") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".mdt") returned 0x0 [0046.546] lstrlenW (lpString=".sdf") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".sdf") returned 0x0 [0046.546] lstrlenW (lpString=".MDF") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".MDF") returned 0x0 [0046.546] lstrlenW (lpString=".DBF") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".DBF") returned 0x0 [0046.546] lstrlenW (lpString=".DB") returned 3 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".DB") returned 0x0 [0046.546] lstrlenW (lpString=".db") returned 3 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".db") returned 0x0 [0046.546] lstrlenW (lpString=".ndf") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".ndf") returned 0x0 [0046.546] lstrlenW (lpString=".NDF") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".NDF") returned 0x0 [0046.546] lstrlenW (lpString=".Mdf") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".Mdf") returned 0x0 [0046.546] lstrlenW (lpString=".dat") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".dat") returned 0x0 [0046.546] lstrlenW (lpString=".DAT") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".DAT") returned 0x0 [0046.546] lstrlenW (lpString=".ldf") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".ldf") returned 0x0 [0046.546] lstrlenW (lpString=".LDF") returned 4 [0046.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch=".LDF") returned 0x0 [0046.547] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.547] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0046.547] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.547] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.548] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16654865754) returned 1 [0046.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa8dd130, dwHighDateTime=0x1d585b4)) [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e58 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e58 | out: hHeap=0x260000) returned 1 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.548] GetLastError () returned 0x0 [0046.548] GetLastError () returned 0x0 [0046.548] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.548] GetLastError () returned 0x0 [0046.548] GetLastError () returned 0x0 [0046.550] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffd34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.550] WriteFile (in: hFile=0xf8, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x2cc, lpOverlapped=0x0) returned 1 [0046.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.550] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.550] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.550] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.551] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.551] CloseHandle (hObject=0xf8) returned 1 [0046.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.[deadmin@cock.li].deadmin")) returned 1 [0046.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.555] GetLastError () returned 0x0 [0046.555] RtlWakeConditionVariable () returned 0x27e828 [0046.555] GetCurrentThreadId () returned 0x98c [0046.555] GetCurrentThreadId () returned 0x98c [0046.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x333e58 [0046.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f21d8 | out: hHeap=0x260000) returned 1 [0046.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0046.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f21d8 [0046.556] lstrlenW (lpString=".ldf") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".ldf") returned 0x0 [0046.556] lstrlenW (lpString=".vhd") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".vhd") returned 0x0 [0046.556] lstrlenW (lpString=".vhdx") returned 5 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".vhdx") returned 0x0 [0046.556] lstrlenW (lpString=".pst") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".pst") returned 0x0 [0046.556] lstrlenW (lpString=".ost") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".ost") returned 0x0 [0046.556] lstrlenW (lpString=".bak") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".bak") returned 0x0 [0046.556] lstrlenW (lpString=".bac") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".bac") returned 0x0 [0046.556] lstrlenW (lpString=".sys") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".sys") returned 0x0 [0046.556] lstrlenW (lpString=".v2i") returned 4 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".v2i") returned 0x0 [0046.556] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.557] lstrlenW (lpString=".sql") returned 4 [0046.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".sql") returned 0x0 [0046.557] lstrlenW (lpString=".mdf") returned 4 [0046.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".mdf") returned 0x0 [0046.557] lstrlenW (lpString=".txt") returned 4 [0046.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".txt") returned 0x0 [0046.557] lstrlenW (lpString=".dbf") returned 4 [0046.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".dbf") returned 0x0 [0046.557] lstrlenW (lpString=".ckp") returned 4 [0046.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".ckp") returned 0x0 [0046.557] lstrlenW (lpString=".dacpac") returned 7 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".dacpac") returned 0x0 [0046.558] lstrlenW (lpString=".db3") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".db3") returned 0x0 [0046.558] lstrlenW (lpString=".dtxs") returned 5 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".dtxs") returned 0x0 [0046.558] lstrlenW (lpString=".mdt") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".mdt") returned 0x0 [0046.558] lstrlenW (lpString=".sdf") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".sdf") returned 0x0 [0046.558] lstrlenW (lpString=".MDF") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".MDF") returned 0x0 [0046.558] lstrlenW (lpString=".DBF") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".DBF") returned 0x0 [0046.558] lstrlenW (lpString=".DB") returned 3 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".DB") returned 0x0 [0046.558] lstrlenW (lpString=".db") returned 3 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".db") returned 0x0 [0046.558] lstrlenW (lpString=".ndf") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".ndf") returned 0x0 [0046.558] lstrlenW (lpString=".NDF") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".NDF") returned 0x0 [0046.558] lstrlenW (lpString=".Mdf") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".Mdf") returned 0x0 [0046.558] lstrlenW (lpString=".dat") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".dat") returned 0x0 [0046.558] lstrlenW (lpString=".DAT") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".DAT") returned 0x0 [0046.558] lstrlenW (lpString=".ldf") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".ldf") returned 0x0 [0046.558] lstrlenW (lpString=".LDF") returned 4 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch=".LDF") returned 0x0 [0046.558] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.559] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0046.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.559] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.559] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16656057623) returned 1 [0046.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa903290, dwHighDateTime=0x1d585b4)) [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8060 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.560] GetLastError () returned 0x0 [0046.560] GetLastError () returned 0x0 [0046.560] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.560] GetLastError () returned 0x0 [0046.560] GetLastError () returned 0x0 [0046.563] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd678, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.563] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x2988, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x2988, lpOverlapped=0x0) returned 1 [0046.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.563] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.563] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.564] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.564] CloseHandle (hObject=0xf8) returned 1 [0046.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.564] GetLastError () returned 0x0 [0046.564] RtlWakeConditionVariable () returned 0x27e828 [0046.564] GetCurrentThreadId () returned 0x98c [0046.565] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.565] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.565] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.565] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.566] CloseHandle (hObject=0xf8) returned 1 [0046.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da218 | out: hHeap=0x260000) returned 1 [0046.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c10 | out: hHeap=0x260000) returned 1 [0046.566] RtlWakeConditionVariable () returned 0x27e828 [0046.566] GetCurrentThreadId () returned 0x98c [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".ldf") returned 0x0 [0046.566] lstrlenW (lpString=".vhd") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".vhd") returned 0x0 [0046.566] lstrlenW (lpString=".vhdx") returned 5 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".vhdx") returned 0x0 [0046.566] lstrlenW (lpString=".pst") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".pst") returned 0x0 [0046.566] lstrlenW (lpString=".ost") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".ost") returned 0x0 [0046.566] lstrlenW (lpString=".bak") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".bak") returned 0x0 [0046.566] lstrlenW (lpString=".bac") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".bac") returned 0x0 [0046.566] lstrlenW (lpString=".sys") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".sys") returned 0x0 [0046.566] lstrlenW (lpString=".v2i") returned 4 [0046.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".v2i") returned 0x0 [0046.567] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.567] lstrlenW (lpString=".sql") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".sql") returned 0x0 [0046.567] lstrlenW (lpString=".mdf") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".mdf") returned 0x0 [0046.567] lstrlenW (lpString=".txt") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".txt") returned 0x0 [0046.567] lstrlenW (lpString=".dbf") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".dbf") returned 0x0 [0046.567] lstrlenW (lpString=".ckp") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".ckp") returned 0x0 [0046.567] lstrlenW (lpString=".dacpac") returned 7 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".dacpac") returned 0x0 [0046.567] lstrlenW (lpString=".db3") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".db3") returned 0x0 [0046.567] lstrlenW (lpString=".dtxs") returned 5 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".dtxs") returned 0x0 [0046.567] lstrlenW (lpString=".mdt") returned 4 [0046.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".mdt") returned 0x0 [0046.568] lstrlenW (lpString=".sdf") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".sdf") returned 0x0 [0046.568] lstrlenW (lpString=".MDF") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".MDF") returned 0x0 [0046.568] lstrlenW (lpString=".DBF") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".DBF") returned 0x0 [0046.568] lstrlenW (lpString=".DB") returned 3 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".DB") returned 0x0 [0046.568] lstrlenW (lpString=".db") returned 3 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".db") returned 0x0 [0046.568] lstrlenW (lpString=".ndf") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".ndf") returned 0x0 [0046.568] lstrlenW (lpString=".NDF") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".NDF") returned 0x0 [0046.568] lstrlenW (lpString=".Mdf") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".Mdf") returned 0x0 [0046.568] lstrlenW (lpString=".dat") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".dat") returned 0x0 [0046.568] lstrlenW (lpString=".DAT") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".DAT") returned 0x0 [0046.568] lstrlenW (lpString=".ldf") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".ldf") returned 0x0 [0046.568] lstrlenW (lpString=".LDF") returned 4 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch=".LDF") returned 0x0 [0046.568] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.568] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0046.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.569] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.569] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16657064962) returned 1 [0046.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa9293f0, dwHighDateTime=0x1d585b4)) [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d80d0 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d80d0 | out: hHeap=0x260000) returned 1 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b730 [0046.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321638 [0046.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b730 | out: hHeap=0x260000) returned 1 [0046.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.570] GetLastError () returned 0x0 [0046.570] GetLastError () returned 0x0 [0046.570] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.570] GetLastError () returned 0x0 [0046.571] GetLastError () returned 0x0 [0046.573] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5078, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.573] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xaf88, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0xaf88, lpOverlapped=0x0) returned 1 [0046.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.573] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.573] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.573] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.573] CloseHandle (hObject=0xf8) returned 1 [0046.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fcb8 [0046.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fcb8 | out: hHeap=0x260000) returned 1 [0046.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.574] GetLastError () returned 0x0 [0046.574] RtlWakeConditionVariable () returned 0x27e828 [0046.574] GetCurrentThreadId () returned 0x98c [0046.576] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.576] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.576] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.576] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.577] CloseHandle (hObject=0xf8) returned 1 [0046.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ef8 | out: hHeap=0x260000) returned 1 [0046.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c10 | out: hHeap=0x260000) returned 1 [0046.577] RtlWakeConditionVariable () returned 0x27e828 [0046.577] GetCurrentThreadId () returned 0x98c [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".ldf") returned 0x0 [0046.577] lstrlenW (lpString=".vhd") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".vhd") returned 0x0 [0046.577] lstrlenW (lpString=".vhdx") returned 5 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".vhdx") returned 0x0 [0046.577] lstrlenW (lpString=".pst") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".pst") returned 0x0 [0046.577] lstrlenW (lpString=".ost") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".ost") returned 0x0 [0046.577] lstrlenW (lpString=".bak") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".bak") returned 0x0 [0046.577] lstrlenW (lpString=".bac") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".bac") returned 0x0 [0046.577] lstrlenW (lpString=".sys") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".sys") returned 0x0 [0046.577] lstrlenW (lpString=".v2i") returned 4 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".v2i") returned 0x0 [0046.577] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch="s\r\n.v2i") returned 0x0 [0046.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.578] lstrlenW (lpString=".sql") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".sql") returned 0x0 [0046.578] lstrlenW (lpString=".mdf") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".mdf") returned 0x0 [0046.578] lstrlenW (lpString=".txt") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".txt") returned 0x0 [0046.578] lstrlenW (lpString=".dbf") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".dbf") returned 0x0 [0046.578] lstrlenW (lpString=".ckp") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".ckp") returned 0x0 [0046.578] lstrlenW (lpString=".dacpac") returned 7 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".dacpac") returned 0x0 [0046.578] lstrlenW (lpString=".db3") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".db3") returned 0x0 [0046.578] lstrlenW (lpString=".dtxs") returned 5 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".dtxs") returned 0x0 [0046.578] lstrlenW (lpString=".mdt") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".mdt") returned 0x0 [0046.578] lstrlenW (lpString=".sdf") returned 4 [0046.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".sdf") returned 0x0 [0046.578] lstrlenW (lpString=".MDF") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".MDF") returned 0x0 [0046.579] lstrlenW (lpString=".DBF") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".DBF") returned 0x0 [0046.579] lstrlenW (lpString=".DB") returned 3 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".DB") returned 0x0 [0046.579] lstrlenW (lpString=".db") returned 3 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".db") returned 0x0 [0046.579] lstrlenW (lpString=".ndf") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".ndf") returned 0x0 [0046.579] lstrlenW (lpString=".NDF") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".NDF") returned 0x0 [0046.579] lstrlenW (lpString=".Mdf") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".Mdf") returned 0x0 [0046.579] lstrlenW (lpString=".dat") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".dat") returned 0x0 [0046.579] lstrlenW (lpString=".DAT") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".DAT") returned 0x0 [0046.579] lstrlenW (lpString=".ldf") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".ldf") returned 0x0 [0046.579] lstrlenW (lpString=".LDF") returned 4 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch=".LDF") returned 0x0 [0046.579] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.579] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310af8) returned 1 [0046.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.580] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.580] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16658132675) returned 1 [0046.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaa9293f0, dwHighDateTime=0x1d585b4)) [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ed8 [0046.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ed8 | out: hHeap=0x260000) returned 1 [0046.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.581] GetLastError () returned 0x0 [0046.581] GetLastError () returned 0x0 [0046.581] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.581] GetLastError () returned 0x0 [0046.581] GetLastError () returned 0x0 [0046.620] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.620] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.622] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.622] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.622] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.622] CloseHandle (hObject=0xf8) returned 1 [0046.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0046.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.[deadmin@cock.li].deadmin")) returned 1 [0046.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0046.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.674] GetLastError () returned 0x0 [0046.674] RtlWakeConditionVariable () returned 0x27e828 [0046.674] GetCurrentThreadId () returned 0x98c [0046.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".ldf") returned 0x0 [0046.674] lstrlenW (lpString=".vhd") returned 4 [0046.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".vhd") returned 0x0 [0046.674] lstrlenW (lpString=".vhdx") returned 5 [0046.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".vhdx") returned 0x0 [0046.674] lstrlenW (lpString=".pst") returned 4 [0046.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".pst") returned 0x0 [0046.674] lstrlenW (lpString=".ost") returned 4 [0046.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".ost") returned 0x0 [0046.674] lstrlenW (lpString=".bak") returned 4 [0046.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".bak") returned 0x0 [0046.674] lstrlenW (lpString=".bac") returned 4 [0046.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".bac") returned 0x0 [0046.675] lstrlenW (lpString=".sys") returned 4 [0046.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".sys") returned 0x0 [0046.675] lstrlenW (lpString=".v2i") returned 4 [0046.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch=".v2i") returned 0x0 [0046.675] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310c90 | out: hHeap=0x260000) returned 1 [0046.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3352f0 | out: hHeap=0x260000) returned 1 [0046.691] RtlWakeConditionVariable () returned 0x27e828 [0046.691] GetCurrentThreadId () returned 0x98c [0046.706] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.706] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.706] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.706] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.717] CloseHandle (hObject=0x104) returned 1 [0046.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0046.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.717] RtlWakeConditionVariable () returned 0x27e828 [0046.717] GetCurrentThreadId () returned 0x98c [0046.729] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.729] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.729] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.729] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.730] CloseHandle (hObject=0x104) returned 1 [0046.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e228 | out: hHeap=0x260000) returned 1 [0046.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.730] RtlWakeConditionVariable () returned 0x27e828 [0046.730] GetCurrentThreadId () returned 0x98c [0046.737] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311510) returned 1 [0046.738] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.738] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0046.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.738] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16673903944) returned 1 [0046.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaaacc310, dwHighDateTime=0x1d585b4)) [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3381c0 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381c0 | out: hHeap=0x260000) returned 1 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0046.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0046.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0046.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27536f0 [0046.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0046.738] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.739] GetLastError () returned 0x0 [0046.739] GetLastError () returned 0x0 [0046.739] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.739] GetLastError () returned 0x0 [0046.739] GetLastError () returned 0x0 [0046.742] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff1a80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.743] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xe580, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0xe580, lpOverlapped=0x0) returned 1 [0046.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.743] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.743] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.744] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.744] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.744] CloseHandle (hObject=0x104) returned 1 [0046.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0046.744] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.745] GetLastError () returned 0x0 [0046.745] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.745] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.745] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.745] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.746] CloseHandle (hObject=0x104) returned 1 [0046.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0046.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e870 | out: hHeap=0x260000) returned 1 [0046.746] RtlWakeConditionVariable () returned 0x27e828 [0046.746] GetCurrentThreadId () returned 0x98c [0046.749] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.749] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.749] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.749] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.750] CloseHandle (hObject=0xf8) returned 1 [0046.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3a48 | out: hHeap=0x260000) returned 1 [0046.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.751] RtlWakeConditionVariable () returned 0x27e828 [0046.751] GetCurrentThreadId () returned 0x98c [0046.753] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0046.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.754] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0046.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.754] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16675838125) returned 1 [0046.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaaaf2470, dwHighDateTime=0x1d585b4)) [0046.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8370 [0046.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8370 | out: hHeap=0x260000) returned 1 [0046.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0046.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ce30 [0046.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0046.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329180 [0046.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0046.758] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.758] GetLastError () returned 0x0 [0046.758] GetLastError () returned 0x0 [0046.758] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.758] GetLastError () returned 0x0 [0046.758] GetLastError () returned 0x0 [0046.761] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.761] WriteFile (in: hFile=0xf8, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.762] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.762] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.764] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.764] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.764] CloseHandle (hObject=0xf8) returned 1 [0046.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edf18 [0046.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.765] GetLastError () returned 0x0 [0046.790] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312500) returned 1 [0046.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.791] CryptReleaseContext (hProv=0x312500, dwFlags=0x0) returned 1 [0046.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.791] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16679177293) returned 1 [0046.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaab3e730, dwHighDateTime=0x1d585b4)) [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1800 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0046.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0046.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0046.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0046.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297010 [0046.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0046.791] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0046.791] GetLastError () returned 0x0 [0046.791] GetLastError () returned 0x0 [0046.791] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0046.792] GetLastError () returned 0x0 [0046.792] GetLastError () returned 0x0 [0046.794] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.794] WriteFile (in: hFile=0xf8, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.795] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.795] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.796] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.796] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.796] CloseHandle (hObject=0xf8) returned 1 [0046.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edf18 [0046.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.797] GetLastError () returned 0x0 [0046.836] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.836] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.836] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.836] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.837] CloseHandle (hObject=0xf8) returned 1 [0046.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3260 | out: hHeap=0x260000) returned 1 [0046.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.838] RtlWakeConditionVariable () returned 0x27e828 [0046.838] GetCurrentThreadId () returned 0x98c [0046.886] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.886] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.886] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.886] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.887] CloseHandle (hObject=0xf8) returned 1 [0046.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3f50 | out: hHeap=0x260000) returned 1 [0046.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3990 | out: hHeap=0x260000) returned 1 [0046.887] RtlWakeConditionVariable () returned 0x27e828 [0046.887] GetCurrentThreadId () returned 0x98c [0046.902] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.902] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.902] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.902] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.903] CloseHandle (hObject=0xf8) returned 1 [0046.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f26e0 | out: hHeap=0x260000) returned 1 [0046.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2908 | out: hHeap=0x260000) returned 1 [0046.904] RtlWakeConditionVariable () returned 0x27e828 [0046.904] GetCurrentThreadId () returned 0x98c [0046.926] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.926] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.926] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.926] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.927] CloseHandle (hObject=0xf8) returned 1 [0046.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e180 | out: hHeap=0x260000) returned 1 [0046.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0046.927] RtlWakeConditionVariable () returned 0x27e828 [0046.927] GetCurrentThreadId () returned 0x98c [0046.945] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.945] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.945] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.945] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.946] CloseHandle (hObject=0xf8) returned 1 [0046.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0046.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3d28 | out: hHeap=0x260000) returned 1 [0046.946] RtlWakeConditionVariable () returned 0x27e828 [0046.946] GetCurrentThreadId () returned 0x98c [0046.968] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.968] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.968] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.968] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.971] CloseHandle (hObject=0xf8) returned 1 [0046.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0046.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.971] RtlWakeConditionVariable () returned 0x27e828 [0046.971] GetCurrentThreadId () returned 0x98c [0047.151] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.151] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.151] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.151] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.152] CloseHandle (hObject=0xf8) returned 1 [0047.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e3d8 | out: hHeap=0x260000) returned 1 [0047.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f878 | out: hHeap=0x260000) returned 1 [0047.153] RtlWakeConditionVariable () returned 0x27e828 [0047.153] GetCurrentThreadId () returned 0x98c [0047.176] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.176] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.176] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.176] WriteFile (in: hFile=0xf8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.178] CloseHandle (hObject=0xf8) returned 1 [0047.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0047.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0047.178] RtlWakeConditionVariable () returned 0x27e828 [0047.178] GetCurrentThreadId () returned 0x98c [0047.310] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.310] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.310] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.310] WriteFile (in: hFile=0x104, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.311] CloseHandle (hObject=0x104) returned 1 [0047.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x331ac0 | out: hHeap=0x260000) returned 1 [0047.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x331990 | out: hHeap=0x260000) returned 1 [0047.311] RtlWakeConditionVariable () returned 0x27e828 [0047.311] GetCurrentThreadId () returned 0x98c [0047.330] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.342] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.342] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16734332309) returned 1 [0047.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab073750, dwHighDateTime=0x1d585b4)) [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3371e8 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3371e8 | out: hHeap=0x260000) returned 1 [0047.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.343] GetLastError () returned 0x0 [0047.343] GetLastError () returned 0x0 [0047.343] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.343] GetLastError () returned 0x0 [0047.343] GetLastError () returned 0x0 [0047.355] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb6ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.355] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4932, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x4932, lpOverlapped=0x0) returned 1 [0047.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.355] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.355] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.355] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.355] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.355] CloseHandle (hObject=0xf8) returned 1 [0047.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0047.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0047.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.356] GetLastError () returned 0x0 [0047.362] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.362] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.362] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.363] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16736365274) returned 1 [0047.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab0bfa10, dwHighDateTime=0x1d585b4)) [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337220 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337220 | out: hHeap=0x260000) returned 1 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.363] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.363] GetLastError () returned 0x0 [0047.363] GetLastError () returned 0x0 [0047.363] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.363] GetLastError () returned 0x0 [0047.363] GetLastError () returned 0x0 [0047.367] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff8ba2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.367] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x745e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x745e, lpOverlapped=0x0) returned 1 [0047.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.369] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.369] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.369] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.369] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.369] CloseHandle (hObject=0x100) returned 1 [0047.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30dbd8 [0047.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dbd8 | out: hHeap=0x260000) returned 1 [0047.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.370] GetLastError () returned 0x0 [0047.370] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.370] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.370] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.370] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.371] CloseHandle (hObject=0x100) returned 1 [0047.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a01c8 | out: hHeap=0x260000) returned 1 [0047.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0047.371] RtlWakeConditionVariable () returned 0x27e828 [0047.371] GetCurrentThreadId () returned 0x98c [0047.372] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.372] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.372] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16737356716) returned 1 [0047.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab0bfa10, dwHighDateTime=0x1d585b4)) [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337290 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337290 | out: hHeap=0x260000) returned 1 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a230 [0047.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a230 | out: hHeap=0x260000) returned 1 [0047.373] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.373] GetLastError () returned 0x0 [0047.373] GetLastError () returned 0x0 [0047.373] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.373] GetLastError () returned 0x0 [0047.373] GetLastError () returned 0x0 [0047.379] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.379] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0047.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.380] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.381] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.382] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.382] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.382] CloseHandle (hObject=0x100) returned 1 [0047.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0047.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.[deadmin@cock.li].deadmin")) returned 1 [0047.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0047.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.383] GetLastError () returned 0x0 [0047.383] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.384] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.384] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.384] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16738520653) returned 1 [0047.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab0e5b70, dwHighDateTime=0x1d585b4)) [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337300 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337300 | out: hHeap=0x260000) returned 1 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.385] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.385] GetLastError () returned 0x0 [0047.385] GetLastError () returned 0x0 [0047.385] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.385] GetLastError () returned 0x0 [0047.385] GetLastError () returned 0x0 [0047.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.457] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0047.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.458] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.458] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.464] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.464] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.464] CloseHandle (hObject=0x100) returned 1 [0047.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f8bb8 [0047.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.[deadmin@cock.li].deadmin")) returned 1 [0047.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8bb8 | out: hHeap=0x260000) returned 1 [0047.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.465] GetLastError () returned 0x0 [0047.573] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.574] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.574] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.574] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16757484717) returned 1 [0047.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab2aebf0, dwHighDateTime=0x1d585b4)) [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db7c8 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db7c8 | out: hHeap=0x260000) returned 1 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332998 [0047.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.574] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.574] GetLastError () returned 0x0 [0047.574] GetLastError () returned 0x0 [0047.574] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.575] GetLastError () returned 0x0 [0047.575] GetLastError () returned 0x0 [0047.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe1fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.577] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1e06, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1e06, lpOverlapped=0x0) returned 1 [0047.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.578] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.578] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.578] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.578] CloseHandle (hObject=0x100) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.609] GetLastError () returned 0x0 [0047.629] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.635] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.635] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.635] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16763651162) returned 1 [0047.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab347170, dwHighDateTime=0x1d585b4)) [0047.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f90 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f90 | out: hHeap=0x260000) returned 1 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ecb8 [0047.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.636] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.636] GetLastError () returned 0x0 [0047.636] GetLastError () returned 0x0 [0047.636] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.636] GetLastError () returned 0x0 [0047.637] GetLastError () returned 0x0 [0047.639] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffeeda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.640] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1126, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1126, lpOverlapped=0x0) returned 1 [0047.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.640] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.640] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.640] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.640] CloseHandle (hObject=0x100) returned 1 [0047.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.641] GetLastError () returned 0x0 [0047.642] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.643] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.643] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16764383085) returned 1 [0047.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab36d2d0, dwHighDateTime=0x1d585b4)) [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294eb0 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31eb88 [0047.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.643] GetLastError () returned 0x0 [0047.643] GetLastError () returned 0x0 [0047.643] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.644] GetLastError () returned 0x0 [0047.644] GetLastError () returned 0x0 [0047.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.645] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1634, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1634, lpOverlapped=0x0) returned 1 [0047.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.645] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.646] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.646] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.646] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.646] CloseHandle (hObject=0x100) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.647] GetLastError () returned 0x0 [0047.647] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.648] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.648] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16764880118) returned 1 [0047.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab36d2d0, dwHighDateTime=0x1d585b4)) [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295118 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ede8 [0047.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.648] GetLastError () returned 0x0 [0047.648] GetLastError () returned 0x0 [0047.649] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.649] GetLastError () returned 0x0 [0047.649] GetLastError () returned 0x0 [0047.650] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffaf9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.650] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5062, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x5062, lpOverlapped=0x0) returned 1 [0047.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.650] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.651] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.651] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.651] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.651] CloseHandle (hObject=0x100) returned 1 [0047.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.652] GetLastError () returned 0x0 [0047.652] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.653] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.653] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.653] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16765417656) returned 1 [0047.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab36d2d0, dwHighDateTime=0x1d585b4)) [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953f0 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ee80 [0047.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.654] GetLastError () returned 0x0 [0047.654] GetLastError () returned 0x0 [0047.654] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.654] GetLastError () returned 0x0 [0047.654] GetLastError () returned 0x0 [0047.655] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd5b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.655] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x2a50, lpOverlapped=0x0) returned 1 [0047.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.656] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.656] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.656] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.656] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.656] CloseHandle (hObject=0x100) returned 1 [0047.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.657] GetLastError () returned 0x0 [0047.657] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.658] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.658] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.664] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16766558223) returned 1 [0047.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab393430, dwHighDateTime=0x1d585b4)) [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8f38 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8f38 | out: hHeap=0x260000) returned 1 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ef18 [0047.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.665] GetLastError () returned 0x0 [0047.665] GetLastError () returned 0x0 [0047.665] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.665] GetLastError () returned 0x0 [0047.665] GetLastError () returned 0x0 [0047.668] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc7a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.668] WriteFile (in: hFile=0x100, lpBuffer=0x2ba238*, nNumberOfBytesToWrite=0x385c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2ba238*, lpNumberOfBytesWritten=0x224fdb0*=0x385c, lpOverlapped=0x0) returned 1 [0047.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba238 | out: hHeap=0x260000) returned 1 [0047.668] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.668] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.668] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.668] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.669] CloseHandle (hObject=0x100) returned 1 [0047.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.753] GetLastError () returned 0x0 [0047.753] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.754] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.754] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16775522391) returned 1 [0047.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab477c70, dwHighDateTime=0x1d585b4)) [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b80 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31efb0 [0047.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.755] GetLastError () returned 0x0 [0047.755] GetLastError () returned 0x0 [0047.755] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.755] GetLastError () returned 0x0 [0047.755] GetLastError () returned 0x0 [0047.759] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff932e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.759] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6cd2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x6cd2, lpOverlapped=0x0) returned 1 [0047.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.759] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.759] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.759] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.759] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.760] CloseHandle (hObject=0x100) returned 1 [0047.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.760] GetLastError () returned 0x0 [0047.761] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.762] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.762] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.762] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16776282204) returned 1 [0047.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab477c70, dwHighDateTime=0x1d585b4)) [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294720 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f3d8 [0047.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.762] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.762] GetLastError () returned 0x0 [0047.762] GetLastError () returned 0x0 [0047.763] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.763] GetLastError () returned 0x0 [0047.763] GetLastError () returned 0x0 [0047.764] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff15e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.764] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xea2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xea2, lpOverlapped=0x0) returned 1 [0047.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.764] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.764] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.765] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.765] CloseHandle (hObject=0x100) returned 1 [0047.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.766] GetLastError () returned 0x0 [0047.766] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.767] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.767] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16776780082) returned 1 [0047.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab477c70, dwHighDateTime=0x1d585b4)) [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949c0 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f470 [0047.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.767] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.767] GetLastError () returned 0x0 [0047.768] GetLastError () returned 0x0 [0047.768] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.768] GetLastError () returned 0x0 [0047.768] GetLastError () returned 0x0 [0047.769] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe934, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.769] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x16cc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x16cc, lpOverlapped=0x0) returned 1 [0047.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.770] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.770] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.770] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.770] CloseHandle (hObject=0x100) returned 1 [0047.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.771] GetLastError () returned 0x0 [0047.771] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.772] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.772] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.772] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16777326869) returned 1 [0047.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab49ddd0, dwHighDateTime=0x1d585b4)) [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294aa0 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f508 [0047.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.773] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.773] GetLastError () returned 0x0 [0047.773] GetLastError () returned 0x0 [0047.773] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.773] GetLastError () returned 0x0 [0047.773] GetLastError () returned 0x0 [0047.774] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff43c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.774] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xbc4, lpOverlapped=0x0) returned 1 [0047.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.775] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.775] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.775] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.775] CloseHandle (hObject=0x100) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.776] GetLastError () returned 0x0 [0047.776] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.777] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.777] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16777803179) returned 1 [0047.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab49ddd0, dwHighDateTime=0x1d585b4)) [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b10 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f5a0 [0047.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.777] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.778] GetLastError () returned 0x0 [0047.778] GetLastError () returned 0x0 [0047.778] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.778] GetLastError () returned 0x0 [0047.778] GetLastError () returned 0x0 [0047.779] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff53c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.779] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xac4, lpOverlapped=0x0) returned 1 [0047.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.779] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.780] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.780] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.780] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.780] CloseHandle (hObject=0x100) returned 1 [0047.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.781] GetLastError () returned 0x0 [0047.781] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.781] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.782] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.782] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16778278283) returned 1 [0047.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab49ddd0, dwHighDateTime=0x1d585b4)) [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f04f0 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f04f0 | out: hHeap=0x260000) returned 1 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f638 [0047.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.782] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.782] GetLastError () returned 0x0 [0047.782] GetLastError () returned 0x0 [0047.782] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.783] GetLastError () returned 0x0 [0047.783] GetLastError () returned 0x0 [0047.789] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe334, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.789] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1ccc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1ccc, lpOverlapped=0x0) returned 1 [0047.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.789] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.789] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.790] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.790] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.790] CloseHandle (hObject=0x100) returned 1 [0047.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.790] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.791] GetLastError () returned 0x0 [0047.791] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.792] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.792] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.792] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16779287992) returned 1 [0047.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab4c3f30, dwHighDateTime=0x1d585b4)) [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0560 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0560 | out: hHeap=0x260000) returned 1 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f6d0 [0047.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.792] GetLastError () returned 0x0 [0047.792] GetLastError () returned 0x0 [0047.793] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.793] GetLastError () returned 0x0 [0047.793] GetLastError () returned 0x0 [0047.795] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe618, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.795] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19e8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19e8, lpOverlapped=0x0) returned 1 [0047.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.797] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.797] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.797] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.798] CloseHandle (hObject=0x100) returned 1 [0047.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.798] GetLastError () returned 0x0 [0047.824] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.825] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.825] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.825] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16782629295) returned 1 [0047.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab5101f0, dwHighDateTime=0x1d585b4)) [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7550 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7550 | out: hHeap=0x260000) returned 1 [0047.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f800 [0047.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.826] GetLastError () returned 0x0 [0047.826] GetLastError () returned 0x0 [0047.826] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.826] GetLastError () returned 0x0 [0047.826] GetLastError () returned 0x0 [0047.829] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.829] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x83c, lpOverlapped=0x0) returned 1 [0047.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.830] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.830] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.830] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.830] CloseHandle (hObject=0x100) returned 1 [0047.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.831] GetLastError () returned 0x0 [0047.831] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.832] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.832] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.832] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16783344981) returned 1 [0047.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab536350, dwHighDateTime=0x1d585b4)) [0047.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f05d0 [0047.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f05d0 | out: hHeap=0x260000) returned 1 [0047.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f898 [0047.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.833] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.833] GetLastError () returned 0x0 [0047.833] GetLastError () returned 0x0 [0047.833] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.833] GetLastError () returned 0x0 [0047.833] GetLastError () returned 0x0 [0047.835] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdbe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.835] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2418, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x2418, lpOverlapped=0x0) returned 1 [0047.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.835] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.835] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.835] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.835] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.835] CloseHandle (hObject=0x100) returned 1 [0047.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.836] GetLastError () returned 0x0 [0047.836] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.837] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.837] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.837] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16783838330) returned 1 [0047.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab536350, dwHighDateTime=0x1d585b4)) [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0608 [0047.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0608 | out: hHeap=0x260000) returned 1 [0047.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f930 [0047.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.838] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.838] GetLastError () returned 0x0 [0047.838] GetLastError () returned 0x0 [0047.838] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.838] GetLastError () returned 0x0 [0047.838] GetLastError () returned 0x0 [0047.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.840] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x928, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x928, lpOverlapped=0x0) returned 1 [0047.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.840] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.840] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.840] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.840] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.840] CloseHandle (hObject=0x100) returned 1 [0047.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.841] GetLastError () returned 0x0 [0047.841] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.842] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.842] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.842] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16784322374) returned 1 [0047.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab536350, dwHighDateTime=0x1d585b4)) [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0640 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0640 | out: hHeap=0x260000) returned 1 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f9c8 [0047.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.843] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.843] GetLastError () returned 0x0 [0047.843] GetLastError () returned 0x0 [0047.843] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.843] GetLastError () returned 0x0 [0047.843] GetLastError () returned 0x0 [0047.844] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe854, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.845] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x17ac, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x17ac, lpOverlapped=0x0) returned 1 [0047.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.845] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.845] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.845] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.845] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.845] CloseHandle (hObject=0x100) returned 1 [0047.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.846] GetLastError () returned 0x0 [0047.846] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.847] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.847] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.847] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16784832039) returned 1 [0047.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab55c4b0, dwHighDateTime=0x1d585b4)) [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0678 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0678 | out: hHeap=0x260000) returned 1 [0047.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fa60 [0047.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.848] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.848] GetLastError () returned 0x0 [0047.848] GetLastError () returned 0x0 [0047.848] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.848] GetLastError () returned 0x0 [0047.848] GetLastError () returned 0x0 [0047.849] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff2a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.850] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xd58, lpOverlapped=0x0) returned 1 [0047.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.850] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.850] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.850] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.850] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.850] CloseHandle (hObject=0x100) returned 1 [0047.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.851] GetLastError () returned 0x0 [0047.852] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.852] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0047.852] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.853] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16785372228) returned 1 [0047.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab55c4b0, dwHighDateTime=0x1d585b4)) [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f06b0 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0047.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f06b0 | out: hHeap=0x260000) returned 1 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31faf8 [0047.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.853] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.853] GetLastError () returned 0x0 [0047.853] GetLastError () returned 0x0 [0047.853] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.853] GetLastError () returned 0x0 [0047.854] GetLastError () returned 0x0 [0047.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff5b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.855] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xa4c, lpOverlapped=0x0) returned 1 [0047.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.855] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.855] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.855] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.855] CloseHandle (hObject=0x100) returned 1 [0047.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.856] GetLastError () returned 0x0 [0047.856] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0047.857] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0047.857] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0047.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.857] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16785842048) returned 1 [0047.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab55c4b0, dwHighDateTime=0x1d585b4)) [0047.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f06e8 [0047.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0047.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f06e8 | out: hHeap=0x260000) returned 1 [0047.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0047.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fb90 [0047.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.858] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0047.858] GetLastError () returned 0x0 [0047.858] GetLastError () returned 0x0 [0047.858] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0047.858] GetLastError () returned 0x0 [0047.858] GetLastError () returned 0x0 [0047.893] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe614, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.893] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19ec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x19ec, lpOverlapped=0x0) returned 1 [0047.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.895] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.895] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.895] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.895] CloseHandle (hObject=0x100) returned 1 [0047.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.072] GetLastError () returned 0x0 [0048.072] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.073] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.073] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.073] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16807394686) returned 1 [0048.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab7717f0, dwHighDateTime=0x1d585b4)) [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0d40 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0d40 | out: hHeap=0x260000) returned 1 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321210 [0048.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.073] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.073] GetLastError () returned 0x0 [0048.074] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.074] GetLastError () returned 0x0 [0048.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffcb35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.076] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x34cb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x34cb, lpOverlapped=0x0) returned 1 [0048.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.076] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.077] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.077] CloseHandle (hObject=0x100) returned 1 [0048.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.[deadmin@cock.li].deadmin")) returned 1 [0048.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.077] GetLastError () returned 0x0 [0048.078] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.079] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.079] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.079] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16808017463) returned 1 [0048.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab7717f0, dwHighDateTime=0x1d585b4)) [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0d78 [0048.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0d78 | out: hHeap=0x260000) returned 1 [0048.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321340 [0048.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.080] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.080] GetLastError () returned 0x0 [0048.080] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.080] GetLastError () returned 0x0 [0048.081] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffb123, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.081] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4edd, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x4edd, lpOverlapped=0x0) returned 1 [0048.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.082] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.082] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.082] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.082] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.082] CloseHandle (hObject=0x100) returned 1 [0048.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.[deadmin@cock.li].deadmin")) returned 1 [0048.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.083] GetLastError () returned 0x0 [0048.083] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.084] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.084] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.084] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16808544377) returned 1 [0048.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab797950, dwHighDateTime=0x1d585b4)) [0048.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0db0 [0048.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0db0 | out: hHeap=0x260000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3213d8 [0048.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.085] GetLastError () returned 0x0 [0048.085] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.085] GetLastError () returned 0x0 [0048.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffb01a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.086] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4fe6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x4fe6, lpOverlapped=0x0) returned 1 [0048.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.087] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.087] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.087] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.087] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.087] CloseHandle (hObject=0x100) returned 1 [0048.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.[deadmin@cock.li].deadmin")) returned 1 [0048.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.088] GetLastError () returned 0x0 [0048.088] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.089] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.089] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.089] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16809042465) returned 1 [0048.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab797950, dwHighDateTime=0x1d585b4)) [0048.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0de8 [0048.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0de8 | out: hHeap=0x260000) returned 1 [0048.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321470 [0048.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.090] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.090] GetLastError () returned 0x0 [0048.090] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.090] GetLastError () returned 0x0 [0048.092] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc28b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.092] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3d75, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x3d75, lpOverlapped=0x0) returned 1 [0048.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.092] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.092] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.092] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.092] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.092] CloseHandle (hObject=0x100) returned 1 [0048.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.[deadmin@cock.li].deadmin")) returned 1 [0048.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.093] GetLastError () returned 0x0 [0048.093] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.094] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.094] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.094] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16809545145) returned 1 [0048.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab797950, dwHighDateTime=0x1d585b4)) [0048.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e20 [0048.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e20 | out: hHeap=0x260000) returned 1 [0048.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321508 [0048.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.095] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.095] GetLastError () returned 0x0 [0048.095] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.095] GetLastError () returned 0x0 [0048.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffcd4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.097] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x32b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x32b6, lpOverlapped=0x0) returned 1 [0048.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.097] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.097] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.097] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.097] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.097] CloseHandle (hObject=0x100) returned 1 [0048.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.098] GetLastError () returned 0x0 [0048.098] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.099] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.099] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.099] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16810040401) returned 1 [0048.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab7bdab0, dwHighDateTime=0x1d585b4)) [0048.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d80d0 [0048.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d80d0 | out: hHeap=0x260000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3215a0 [0048.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.100] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.100] GetLastError () returned 0x0 [0048.100] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.100] GetLastError () returned 0x0 [0048.101] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffda12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.101] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x25ee, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x25ee, lpOverlapped=0x0) returned 1 [0048.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.102] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.102] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.102] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.102] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.102] CloseHandle (hObject=0x100) returned 1 [0048.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.103] GetLastError () returned 0x0 [0048.103] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.104] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.104] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.104] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16810505207) returned 1 [0048.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab7bdab0, dwHighDateTime=0x1d585b4)) [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8098 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8098 | out: hHeap=0x260000) returned 1 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321638 [0048.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.104] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.105] GetLastError () returned 0x0 [0048.105] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.105] GetLastError () returned 0x0 [0048.182] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffddbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.182] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2244, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x2244, lpOverlapped=0x0) returned 1 [0048.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.182] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.182] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.183] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.183] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.183] CloseHandle (hObject=0x100) returned 1 [0048.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.219] GetLastError () returned 0x0 [0048.219] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.220] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.220] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.220] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16822115066) returned 1 [0048.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab8ee5b0, dwHighDateTime=0x1d585b4)) [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f11a0 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f11a0 | out: hHeap=0x260000) returned 1 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3216d0 [0048.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.221] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.221] GetLastError () returned 0x0 [0048.221] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.221] GetLastError () returned 0x0 [0048.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffed9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.282] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1264, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x1264, lpOverlapped=0x0) returned 1 [0048.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.283] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.283] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.283] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.283] CloseHandle (hObject=0x100) returned 1 [0048.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.284] GetLastError () returned 0x0 [0048.284] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.285] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.285] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.285] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16828600018) returned 1 [0048.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab986b30, dwHighDateTime=0x1d585b4)) [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f13d0 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f13d0 | out: hHeap=0x260000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322218 [0048.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.285] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.285] GetLastError () returned 0x0 [0048.286] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.286] GetLastError () returned 0x0 [0048.290] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffcd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.290] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x32c, lpOverlapped=0x0) returned 1 [0048.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.291] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.291] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.291] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.291] CloseHandle (hObject=0x100) returned 1 [0048.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.309] GetLastError () returned 0x0 [0048.310] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.310] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.311] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16831165958) returned 1 [0048.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xab9acc90, dwHighDateTime=0x1d585b4)) [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7f48 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f48 | out: hHeap=0x260000) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354308 [0048.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.311] GetLastError () returned 0x0 [0048.311] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.311] GetLastError () returned 0x0 [0048.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.317] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x6ba0, lpOverlapped=0x0) returned 1 [0048.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.317] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.317] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.318] CloseHandle (hObject=0x10c) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.319] GetLastError () returned 0x0 [0048.344] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.345] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.345] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16834655599) returned 1 [0048.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaba1f0b0, dwHighDateTime=0x1d585b4)) [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8550 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8550 | out: hHeap=0x260000) returned 1 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322b88 [0048.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.346] GetLastError () returned 0x0 [0048.346] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.346] GetLastError () returned 0x0 [0048.347] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffeec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.348] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x1138, lpOverlapped=0x0) returned 1 [0048.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.348] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.348] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.348] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.348] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.348] CloseHandle (hObject=0x10c) returned 1 [0048.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.349] GetLastError () returned 0x0 [0048.350] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.351] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.351] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16835189774) returned 1 [0048.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaba1f0b0, dwHighDateTime=0x1d585b4)) [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8588 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8588 | out: hHeap=0x260000) returned 1 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322b88 [0048.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.351] GetLastError () returned 0x0 [0048.351] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.352] GetLastError () returned 0x0 [0048.353] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffface, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.353] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x532, lpOverlapped=0x0) returned 1 [0048.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.353] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.353] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.354] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.354] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.354] CloseHandle (hObject=0x10c) returned 1 [0048.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.355] GetLastError () returned 0x0 [0048.355] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.356] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.356] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.356] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16835736270) returned 1 [0048.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaba1f0b0, dwHighDateTime=0x1d585b4)) [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d85c0 [0048.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d85c0 | out: hHeap=0x260000) returned 1 [0048.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322cb8 [0048.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.357] GetLastError () returned 0x0 [0048.357] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.357] GetLastError () returned 0x0 [0048.358] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffa5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.358] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x5a4, lpOverlapped=0x0) returned 1 [0048.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.359] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.359] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.359] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.359] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.359] CloseHandle (hObject=0x10c) returned 1 [0048.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.360] GetLastError () returned 0x0 [0048.360] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.361] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.361] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.361] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16836208992) returned 1 [0048.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaba45210, dwHighDateTime=0x1d585b4)) [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d85f8 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d85f8 | out: hHeap=0x260000) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322d50 [0048.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.361] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.362] GetLastError () returned 0x0 [0048.362] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.362] GetLastError () returned 0x0 [0048.363] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe0da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.363] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1f26, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x1f26, lpOverlapped=0x0) returned 1 [0048.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.363] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.363] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.364] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.364] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.364] CloseHandle (hObject=0x10c) returned 1 [0048.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.365] GetLastError () returned 0x0 [0048.365] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.366] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.366] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16836684459) returned 1 [0048.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaba45210, dwHighDateTime=0x1d585b4)) [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8630 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8630 | out: hHeap=0x260000) returned 1 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322de8 [0048.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.366] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.366] GetLastError () returned 0x0 [0048.366] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.366] GetLastError () returned 0x0 [0048.443] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff6b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.470] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x94a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x94a, lpOverlapped=0x0) returned 1 [0048.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.476] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.476] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.476] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.476] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.476] CloseHandle (hObject=0x10c) returned 1 [0048.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.477] GetLastError () returned 0x0 [0048.477] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.478] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.478] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.478] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16847920309) returned 1 [0048.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb4fbb0, dwHighDateTime=0x1d585b4)) [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8ac8 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8ac8 | out: hHeap=0x260000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322e80 [0048.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.479] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.479] GetLastError () returned 0x0 [0048.479] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.479] GetLastError () returned 0x0 [0048.480] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc56c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.480] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x3a94, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x3a94, lpOverlapped=0x0) returned 1 [0048.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.481] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.481] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.481] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.481] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.481] CloseHandle (hObject=0x10c) returned 1 [0048.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.482] GetLastError () returned 0x0 [0048.482] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.483] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.483] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16848417645) returned 1 [0048.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb4fbb0, dwHighDateTime=0x1d585b4)) [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d978 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d978 | out: hHeap=0x260000) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2973a0 [0048.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.484] GetLastError () returned 0x0 [0048.484] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.484] GetLastError () returned 0x0 [0048.485] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff8ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.486] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x752, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x752, lpOverlapped=0x0) returned 1 [0048.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.486] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.486] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.486] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.486] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.486] CloseHandle (hObject=0x10c) returned 1 [0048.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.487] GetLastError () returned 0x0 [0048.487] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.488] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.488] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16848930121) returned 1 [0048.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb75d10, dwHighDateTime=0x1d585b4)) [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d9b0 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9b0 | out: hHeap=0x260000) returned 1 [0048.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323af8 [0048.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.489] GetLastError () returned 0x0 [0048.489] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.489] GetLastError () returned 0x0 [0048.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff094, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.490] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xf6c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xf6c, lpOverlapped=0x0) returned 1 [0048.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.491] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.491] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.491] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.491] CloseHandle (hObject=0x10c) returned 1 [0048.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.492] GetLastError () returned 0x0 [0048.492] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.493] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.493] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16849403159) returned 1 [0048.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb75d10, dwHighDateTime=0x1d585b4)) [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b00 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b00 | out: hHeap=0x260000) returned 1 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0048.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.493] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.494] GetLastError () returned 0x0 [0048.494] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.494] GetLastError () returned 0x0 [0048.495] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd6d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.495] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x292a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x292a, lpOverlapped=0x0) returned 1 [0048.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.495] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.495] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.496] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.496] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.496] CloseHandle (hObject=0x10c) returned 1 [0048.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.497] GetLastError () returned 0x0 [0048.497] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.497] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.498] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.498] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16849877497) returned 1 [0048.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb75d10, dwHighDateTime=0x1d585b4)) [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b38 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b38 | out: hHeap=0x260000) returned 1 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323c28 [0048.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.498] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.498] GetLastError () returned 0x0 [0048.498] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.498] GetLastError () returned 0x0 [0048.500] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffef74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.500] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x108c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x108c, lpOverlapped=0x0) returned 1 [0048.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.500] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.500] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.501] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.501] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.501] CloseHandle (hObject=0x10c) returned 1 [0048.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.502] GetLastError () returned 0x0 [0048.502] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.503] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.503] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.503] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16850382282) returned 1 [0048.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb9be70, dwHighDateTime=0x1d585b4)) [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b70 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b70 | out: hHeap=0x260000) returned 1 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323cc0 [0048.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.503] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.503] GetLastError () returned 0x0 [0048.503] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.503] GetLastError () returned 0x0 [0048.505] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdb96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.505] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x246a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x246a, lpOverlapped=0x0) returned 1 [0048.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.505] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.505] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.506] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.506] CloseHandle (hObject=0x10c) returned 1 [0048.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.506] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0048.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.507] GetLastError () returned 0x0 [0048.507] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.508] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.508] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.508] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16850932037) returned 1 [0048.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabb9be70, dwHighDateTime=0x1d585b4)) [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b70 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b70 | out: hHeap=0x260000) returned 1 [0048.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323d58 [0048.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.509] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.509] GetLastError () returned 0x0 [0048.509] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.509] GetLastError () returned 0x0 [0048.526] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff214, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.526] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xdec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xdec, lpOverlapped=0x0) returned 1 [0048.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.527] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.527] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.527] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.527] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.527] CloseHandle (hObject=0x10c) returned 1 [0048.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.531] GetLastError () returned 0x0 [0048.603] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3128b8) returned 1 [0048.604] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.604] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.604] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16860490232) returned 1 [0048.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabc806b0, dwHighDateTime=0x1d585b4)) [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8eb8 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8eb8 | out: hHeap=0x260000) returned 1 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324510 [0048.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.604] GetLastError () returned 0x0 [0048.604] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.605] GetLastError () returned 0x0 [0048.607] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff72a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.607] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x8d6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x8d6, lpOverlapped=0x0) returned 1 [0048.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.607] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.607] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.607] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.608] CloseHandle (hObject=0x104) returned 1 [0048.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.608] GetLastError () returned 0x0 [0048.622] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.668] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.668] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.668] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16867419559) returned 1 [0048.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabd3ed90, dwHighDateTime=0x1d585b4)) [0048.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d91c8 [0048.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d91c8 | out: hHeap=0x260000) returned 1 [0048.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324d50 [0048.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.688] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.688] GetLastError () returned 0x0 [0048.688] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.688] GetLastError () returned 0x0 [0048.691] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffce8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.691] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x318, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x318, lpOverlapped=0x0) returned 1 [0048.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.691] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.691] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.691] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.691] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.691] CloseHandle (hObject=0xf8) returned 1 [0048.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.691] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.692] GetLastError () returned 0x0 [0048.692] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.693] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.693] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.693] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16869434426) returned 1 [0048.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabd64ef0, dwHighDateTime=0x1d585b4)) [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337bd8 [0048.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337bd8 | out: hHeap=0x260000) returned 1 [0048.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297600 [0048.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.694] GetLastError () returned 0x0 [0048.694] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.694] GetLastError () returned 0x0 [0048.695] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff194, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.695] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xe6c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xe6c, lpOverlapped=0x0) returned 1 [0048.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.696] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.696] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.696] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.696] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.696] CloseHandle (hObject=0xf8) returned 1 [0048.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.697] GetLastError () returned 0x0 [0048.698] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.698] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.699] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.699] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16869978590) returned 1 [0048.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabd64ef0, dwHighDateTime=0x1d585b4)) [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea278 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea278 | out: hHeap=0x260000) returned 1 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324d50 [0048.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.699] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.699] GetLastError () returned 0x0 [0048.699] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.699] GetLastError () returned 0x0 [0048.701] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff1d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.701] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xe30, lpOverlapped=0x0) returned 1 [0048.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.702] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.702] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.702] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.702] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.702] CloseHandle (hObject=0xf8) returned 1 [0048.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.703] GetLastError () returned 0x0 [0048.704] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.705] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.705] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.705] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16870621699) returned 1 [0048.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabd8b050, dwHighDateTime=0x1d585b4)) [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea630 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea630 | out: hHeap=0x260000) returned 1 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320050 [0048.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.706] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.706] GetLastError () returned 0x0 [0048.706] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.706] GetLastError () returned 0x0 [0048.707] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff1e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.707] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xe20, lpOverlapped=0x0) returned 1 [0048.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.708] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.708] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.708] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.708] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.708] CloseHandle (hObject=0xf8) returned 1 [0048.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.709] GetLastError () returned 0x0 [0048.709] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.710] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.710] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.710] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16871144139) returned 1 [0048.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabd8b050, dwHighDateTime=0x1d585b4)) [0048.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3382a0 [0048.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382a0 | out: hHeap=0x260000) returned 1 [0048.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0048.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0048.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324f18 [0048.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.711] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.711] GetLastError () returned 0x0 [0048.711] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.711] GetLastError () returned 0x0 [0048.831] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff7a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.831] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x85c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x85c, lpOverlapped=0x0) returned 1 [0048.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.831] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.831] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.832] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.832] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.832] CloseHandle (hObject=0xf8) returned 1 [0048.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.833] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0048.834] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.834] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.834] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.834] GetLastError () returned 0x0 [0048.835] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff818, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.835] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x7e8, lpOverlapped=0x0) returned 1 [0048.836] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.836] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.836] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.836] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.836] CloseHandle (hObject=0xf8) returned 1 [0048.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.837] GetLastError () returned 0x0 [0048.837] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0048.838] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.838] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.838] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16883917657) returned 1 [0048.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabebbb50, dwHighDateTime=0x1d585b4)) [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7e68 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e68 | out: hHeap=0x260000) returned 1 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325af8 [0048.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.839] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.839] GetLastError () returned 0x0 [0048.839] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.839] GetLastError () returned 0x0 [0048.840] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff7dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.840] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x824, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x824, lpOverlapped=0x0) returned 1 [0048.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.841] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.841] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.841] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.841] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.841] CloseHandle (hObject=0xf8) returned 1 [0048.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.842] GetLastError () returned 0x0 [0048.845] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0048.846] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.846] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.846] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16884726813) returned 1 [0048.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabee1cb0, dwHighDateTime=0x1d585b4)) [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7e30 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e30 | out: hHeap=0x260000) returned 1 [0048.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325b90 [0048.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.847] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.847] GetLastError () returned 0x0 [0048.847] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.847] GetLastError () returned 0x0 [0048.848] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffa58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.848] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x5a8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x5a8, lpOverlapped=0x0) returned 1 [0048.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.849] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.849] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.849] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.849] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.849] CloseHandle (hObject=0xf8) returned 1 [0048.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.850] GetLastError () returned 0x0 [0048.850] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0048.851] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.851] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.851] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16885241434) returned 1 [0048.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabee1cb0, dwHighDateTime=0x1d585b4)) [0048.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7df8 [0048.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7df8 | out: hHeap=0x260000) returned 1 [0048.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325c28 [0048.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.852] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.852] GetLastError () returned 0x0 [0048.852] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.852] GetLastError () returned 0x0 [0048.853] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff44c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.854] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xbb4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xbb4, lpOverlapped=0x0) returned 1 [0048.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.854] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.854] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.854] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.854] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.854] CloseHandle (hObject=0xf8) returned 1 [0048.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.855] GetLastError () returned 0x0 [0048.855] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0048.856] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.856] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.856] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16885722011) returned 1 [0048.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabee1cb0, dwHighDateTime=0x1d585b4)) [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7fb8 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7fb8 | out: hHeap=0x260000) returned 1 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325cc0 [0048.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.857] GetLastError () returned 0x0 [0048.857] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.857] GetLastError () returned 0x0 [0048.858] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.858] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0048.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.859] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.859] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.859] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.859] CloseHandle (hObject=0xf8) returned 1 [0048.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.860] GetLastError () returned 0x0 [0048.860] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0048.861] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.861] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.861] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16886225755) returned 1 [0048.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xabf07e10, dwHighDateTime=0x1d585b4)) [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294598 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294598 | out: hHeap=0x260000) returned 1 [0048.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0048.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.862] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.862] GetLastError () returned 0x0 [0048.862] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.862] GetLastError () returned 0x0 [0048.863] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffde8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.863] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2174, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x2174, lpOverlapped=0x0) returned 1 [0048.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.864] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.864] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.864] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.864] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.864] CloseHandle (hObject=0xf8) returned 1 [0048.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.865] GetLastError () returned 0x0 [0048.981] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.981] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.982] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.982] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16898279553) returned 1 [0048.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac0127b0, dwHighDateTime=0x1d585b4)) [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ee0 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ee0 | out: hHeap=0x260000) returned 1 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3209d0 [0048.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.982] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.982] GetLastError () returned 0x0 [0048.982] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.982] GetLastError () returned 0x0 [0048.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.985] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x6e8, lpOverlapped=0x0) returned 1 [0048.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.985] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.985] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.985] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.985] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.986] CloseHandle (hObject=0x100) returned 1 [0048.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.986] GetLastError () returned 0x0 [0048.987] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.987] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.987] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.988] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16898866994) returned 1 [0048.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac038910, dwHighDateTime=0x1d585b4)) [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326f18 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326f18 | out: hHeap=0x260000) returned 1 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3209d0 [0048.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.988] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.988] GetLastError () returned 0x0 [0048.988] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.988] GetLastError () returned 0x0 [0048.990] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffd20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.990] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x2e0, lpOverlapped=0x0) returned 1 [0048.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.990] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.990] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.990] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.990] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.990] CloseHandle (hObject=0x100) returned 1 [0048.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.991] GetLastError () returned 0x0 [0048.991] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.992] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.992] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.992] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16899338678) returned 1 [0048.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac038910, dwHighDateTime=0x1d585b4)) [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326f50 [0048.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326f50 | out: hHeap=0x260000) returned 1 [0048.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eb958 [0048.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.993] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.993] GetLastError () returned 0x0 [0048.993] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.993] GetLastError () returned 0x0 [0048.994] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffbc64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.994] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x439c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x439c, lpOverlapped=0x0) returned 1 [0048.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.995] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.995] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.995] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.995] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.995] CloseHandle (hObject=0x100) returned 1 [0048.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.996] GetLastError () returned 0x0 [0048.997] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0048.997] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.997] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.998] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16899875342) returned 1 [0048.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac038910, dwHighDateTime=0x1d585b4)) [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326f88 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326f88 | out: hHeap=0x260000) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eb9f0 [0048.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.998] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0048.998] GetLastError () returned 0x0 [0048.998] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0048.998] GetLastError () returned 0x0 [0049.000] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe0f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.000] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1f08, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x1f08, lpOverlapped=0x0) returned 1 [0049.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.000] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.000] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.001] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.001] CloseHandle (hObject=0x100) returned 1 [0049.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.002] GetLastError () returned 0x0 [0049.002] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.003] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.003] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.003] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16900392384) returned 1 [0049.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac05ea70, dwHighDateTime=0x1d585b4)) [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326fc0 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326fc0 | out: hHeap=0x260000) returned 1 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eba88 [0049.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.003] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.003] GetLastError () returned 0x0 [0049.003] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.004] GetLastError () returned 0x0 [0049.005] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd6be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.005] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2942, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x2942, lpOverlapped=0x0) returned 1 [0049.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.005] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.006] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.006] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.006] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.006] CloseHandle (hObject=0x100) returned 1 [0049.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.007] GetLastError () returned 0x0 [0049.013] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.013] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.013] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.013] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16901453846) returned 1 [0049.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac05ea70, dwHighDateTime=0x1d585b4)) [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ff8 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ff8 | out: hHeap=0x260000) returned 1 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebb20 [0049.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.014] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.014] GetLastError () returned 0x0 [0049.014] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.014] GetLastError () returned 0x0 [0049.016] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffed12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.016] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x12ee, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x12ee, lpOverlapped=0x0) returned 1 [0049.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.016] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.016] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.016] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.016] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.016] CloseHandle (hObject=0x100) returned 1 [0049.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.017] GetLastError () returned 0x0 [0049.017] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.018] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.018] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.018] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16901954763) returned 1 [0049.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac084bd0, dwHighDateTime=0x1d585b4)) [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327030 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327030 | out: hHeap=0x260000) returned 1 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebbb8 [0049.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.019] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.019] GetLastError () returned 0x0 [0049.019] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.019] GetLastError () returned 0x0 [0049.128] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffba46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.128] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x45ba, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x45ba, lpOverlapped=0x0) returned 1 [0049.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.131] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.131] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.132] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.132] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.132] CloseHandle (hObject=0x100) returned 1 [0049.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.133] GetLastError () returned 0x0 [0049.144] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.144] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.144] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.144] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16914556028) returned 1 [0049.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac1b56d0, dwHighDateTime=0x1d585b4)) [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3273b0 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3273b0 | out: hHeap=0x260000) returned 1 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0049.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.145] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.145] GetLastError () returned 0x0 [0049.145] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.145] GetLastError () returned 0x0 [0049.151] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffed44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.151] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x12bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x12bc, lpOverlapped=0x0) returned 1 [0049.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.151] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.151] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.152] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.152] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.152] CloseHandle (hObject=0x108) returned 1 [0049.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.170] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.186] GetLastError () returned 0x0 [0049.186] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.187] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.187] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.188] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16918865033) returned 1 [0049.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac227af0, dwHighDateTime=0x1d585b4)) [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327570 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327570 | out: hHeap=0x260000) returned 1 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec668 [0049.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.188] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.188] GetLastError () returned 0x0 [0049.188] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.188] GetLastError () returned 0x0 [0049.195] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffd10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.195] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x2f0, lpOverlapped=0x0) returned 1 [0049.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.195] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.195] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.196] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.196] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.196] CloseHandle (hObject=0x100) returned 1 [0049.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.197] GetLastError () returned 0x0 [0049.197] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.198] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.198] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.198] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16919883732) returned 1 [0049.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac227af0, dwHighDateTime=0x1d585b4)) [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3275a8 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3275a8 | out: hHeap=0x260000) returned 1 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecb28 [0049.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.198] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.198] GetLastError () returned 0x0 [0049.198] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.198] GetLastError () returned 0x0 [0049.203] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd470, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.203] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x2b90, lpOverlapped=0x0) returned 1 [0049.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.203] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.203] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.203] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.203] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.204] CloseHandle (hObject=0x100) returned 1 [0049.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.205] GetLastError () returned 0x0 [0049.205] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.206] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.206] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.206] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16920690630) returned 1 [0049.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac24dc50, dwHighDateTime=0x1d585b4)) [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327618 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327618 | out: hHeap=0x260000) returned 1 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecbc0 [0049.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.206] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.206] GetLastError () returned 0x0 [0049.206] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.207] GetLastError () returned 0x0 [0049.208] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc970, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.208] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x3690, lpOverlapped=0x0) returned 1 [0049.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.209] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.209] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.209] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.209] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.209] CloseHandle (hObject=0x100) returned 1 [0049.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.210] GetLastError () returned 0x0 [0049.210] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.211] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.211] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.211] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16921234192) returned 1 [0049.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac24dc50, dwHighDateTime=0x1d585b4)) [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327650 [0049.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327650 | out: hHeap=0x260000) returned 1 [0049.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eccf0 [0049.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.212] GetLastError () returned 0x0 [0049.212] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.212] GetLastError () returned 0x0 [0049.214] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff5930, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.214] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xa6d0, lpOverlapped=0x0) returned 1 [0049.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.214] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.214] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.215] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.215] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.215] CloseHandle (hObject=0x100) returned 1 [0049.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.216] GetLastError () returned 0x0 [0049.216] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.217] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.217] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16921824154) returned 1 [0049.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac24dc50, dwHighDateTime=0x1d585b4)) [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327688 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327688 | out: hHeap=0x260000) returned 1 [0049.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecd88 [0049.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.218] GetLastError () returned 0x0 [0049.218] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.218] GetLastError () returned 0x0 [0049.219] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc4c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.219] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3b3c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x3b3c, lpOverlapped=0x0) returned 1 [0049.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.220] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.220] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.220] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.220] CloseHandle (hObject=0x100) returned 1 [0049.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.221] GetLastError () returned 0x0 [0049.221] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.222] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.222] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.222] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16922321968) returned 1 [0049.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac273db0, dwHighDateTime=0x1d585b4)) [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3276c0 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3276c0 | out: hHeap=0x260000) returned 1 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ece20 [0049.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.223] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.223] GetLastError () returned 0x0 [0049.223] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.223] GetLastError () returned 0x0 [0049.388] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffede6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.388] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x121a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x121a, lpOverlapped=0x0) returned 1 [0049.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.391] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.391] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.391] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.391] CloseHandle (hObject=0x100) returned 1 [0049.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.432] GetLastError () returned 0x0 [0049.432] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.433] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.433] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.433] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16943442852) returned 1 [0049.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac462f90, dwHighDateTime=0x1d585b4)) [0049.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3278f0 [0049.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3278f0 | out: hHeap=0x260000) returned 1 [0049.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eceb8 [0049.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.434] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.434] GetLastError () returned 0x0 [0049.434] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.434] GetLastError () returned 0x0 [0049.437] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffcd62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.437] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x329e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x329e, lpOverlapped=0x0) returned 1 [0049.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.438] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.438] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.438] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.438] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.438] CloseHandle (hObject=0x100) returned 1 [0049.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.439] GetLastError () returned 0x0 [0049.439] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.440] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.440] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.440] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16944119308) returned 1 [0049.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac4890f0, dwHighDateTime=0x1d585b4)) [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327928 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327928 | out: hHeap=0x260000) returned 1 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed4a8 [0049.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.441] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.441] GetLastError () returned 0x0 [0049.441] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.441] GetLastError () returned 0x0 [0049.442] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.442] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x9b8, lpOverlapped=0x0) returned 1 [0049.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.442] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.443] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.443] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.443] CloseHandle (hObject=0x100) returned 1 [0049.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.444] GetLastError () returned 0x0 [0049.444] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.445] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.445] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16944589390) returned 1 [0049.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac4890f0, dwHighDateTime=0x1d585b4)) [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327960 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327960 | out: hHeap=0x260000) returned 1 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed540 [0049.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.445] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.445] GetLastError () returned 0x0 [0049.445] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.446] GetLastError () returned 0x0 [0049.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff774, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.447] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x88c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x88c, lpOverlapped=0x0) returned 1 [0049.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.447] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.447] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.447] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.448] CloseHandle (hObject=0x100) returned 1 [0049.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.448] GetLastError () returned 0x0 [0049.449] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.449] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.449] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16945060842) returned 1 [0049.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac4890f0, dwHighDateTime=0x1d585b4)) [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327998 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327998 | out: hHeap=0x260000) returned 1 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed5d8 [0049.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.450] GetLastError () returned 0x0 [0049.450] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.450] GetLastError () returned 0x0 [0049.452] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffeed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.452] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x112c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x112c, lpOverlapped=0x0) returned 1 [0049.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.452] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.452] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.452] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.452] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.453] CloseHandle (hObject=0x100) returned 1 [0049.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.453] GetLastError () returned 0x0 [0049.454] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.454] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.454] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16945551833) returned 1 [0049.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac4af250, dwHighDateTime=0x1d585b4)) [0049.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3279d0 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3279d0 | out: hHeap=0x260000) returned 1 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed670 [0049.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.455] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.455] GetLastError () returned 0x0 [0049.455] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.455] GetLastError () returned 0x0 [0049.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff190, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.456] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xe70, lpOverlapped=0x0) returned 1 [0049.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.457] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.457] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.457] CloseHandle (hObject=0x100) returned 1 [0049.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.458] GetLastError () returned 0x0 [0049.458] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.459] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.459] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16946039529) returned 1 [0049.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac4af250, dwHighDateTime=0x1d585b4)) [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327a08 [0049.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327a08 | out: hHeap=0x260000) returned 1 [0049.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed708 [0049.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.460] GetLastError () returned 0x0 [0049.460] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.460] GetLastError () returned 0x0 [0049.495] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff9e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.495] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x61c, lpOverlapped=0x0) returned 1 [0049.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.496] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.496] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.496] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.496] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.497] CloseHandle (hObject=0x100) returned 1 [0049.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.500] GetLastError () returned 0x0 [0049.500] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.501] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.501] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.501] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16950202666) returned 1 [0049.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac521670, dwHighDateTime=0x1d585b4)) [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946e8 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946e8 | out: hHeap=0x260000) returned 1 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3209d0 [0049.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.502] GetLastError () returned 0x0 [0049.502] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.502] GetLastError () returned 0x0 [0049.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff06c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.504] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xf94, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xf94, lpOverlapped=0x0) returned 1 [0049.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.506] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.506] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.506] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.507] CloseHandle (hObject=0x100) returned 1 [0049.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.508] GetLastError () returned 0x0 [0049.508] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.509] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.509] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.509] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16951034622) returned 1 [0049.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac521670, dwHighDateTime=0x1d585b4)) [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946b0 [0049.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946b0 | out: hHeap=0x260000) returned 1 [0049.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327cb8 [0049.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.510] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.510] GetLastError () returned 0x0 [0049.510] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.510] GetLastError () returned 0x0 [0049.512] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff5b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.513] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xa4c, lpOverlapped=0x0) returned 1 [0049.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.513] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.513] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.513] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.513] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.513] CloseHandle (hObject=0x100) returned 1 [0049.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.514] GetLastError () returned 0x0 [0049.515] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.516] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.516] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16951678649) returned 1 [0049.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac5477d0, dwHighDateTime=0x1d585b4)) [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294678 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294678 | out: hHeap=0x260000) returned 1 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327d50 [0049.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.516] GetLastError () returned 0x0 [0049.516] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.516] GetLastError () returned 0x0 [0049.518] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffeaf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.518] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1510, lpOverlapped=0x0) returned 1 [0049.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.518] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.518] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.518] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.518] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.519] CloseHandle (hObject=0x100) returned 1 [0049.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.519] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.519] GetLastError () returned 0x0 [0049.520] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.520] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.520] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.521] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16952166216) returned 1 [0049.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac5477d0, dwHighDateTime=0x1d585b4)) [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294640 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294640 | out: hHeap=0x260000) returned 1 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327de8 [0049.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.521] GetLastError () returned 0x0 [0049.521] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.521] GetLastError () returned 0x0 [0049.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.523] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x670, lpOverlapped=0x0) returned 1 [0049.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.523] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.523] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.523] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.523] CloseHandle (hObject=0x100) returned 1 [0049.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.524] GetLastError () returned 0x0 [0049.525] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.525] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.525] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16952654590) returned 1 [0049.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac5477d0, dwHighDateTime=0x1d585b4)) [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294608 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294608 | out: hHeap=0x260000) returned 1 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327e80 [0049.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.526] GetLastError () returned 0x0 [0049.526] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.526] GetLastError () returned 0x0 [0049.527] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff3c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.528] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xc38, lpOverlapped=0x0) returned 1 [0049.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.528] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.528] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.528] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.528] CloseHandle (hObject=0x100) returned 1 [0049.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.529] GetLastError () returned 0x0 [0049.530] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.531] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.531] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.531] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16953195436) returned 1 [0049.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac56d930, dwHighDateTime=0x1d585b4)) [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327a78 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327a78 | out: hHeap=0x260000) returned 1 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327f18 [0049.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.531] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.531] GetLastError () returned 0x0 [0049.532] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.532] GetLastError () returned 0x0 [0049.536] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffcd4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.536] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x32b5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x32b5, lpOverlapped=0x0) returned 1 [0049.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.536] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.536] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.536] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.536] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.537] CloseHandle (hObject=0x100) returned 1 [0049.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.539] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310b80) returned 1 [0049.540] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.540] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0049.540] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.540] GetLastError () returned 0x0 [0049.541] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.541] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x816, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x816, lpOverlapped=0x0) returned 1 [0049.542] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.542] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.542] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.542] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.542] CloseHandle (hObject=0x100) returned 1 [0049.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.543] GetLastError () returned 0x0 [0049.544] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.544] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.544] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.545] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16954577503) returned 1 [0049.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac56d930, dwHighDateTime=0x1d585b4)) [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337d60 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d60 | out: hHeap=0x260000) returned 1 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327fb0 [0049.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.545] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.545] GetLastError () returned 0x0 [0049.545] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.545] GetLastError () returned 0x0 [0049.547] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe271, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.547] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x1d8f, lpOverlapped=0x0) returned 1 [0049.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.547] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.547] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.548] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.548] CloseHandle (hObject=0x100) returned 1 [0049.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.549] GetLastError () returned 0x0 [0049.549] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.550] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.550] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.550] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16955108001) returned 1 [0049.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac593a90, dwHighDateTime=0x1d585b4)) [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337d28 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d28 | out: hHeap=0x260000) returned 1 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3280e0 [0049.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.551] GetLastError () returned 0x0 [0049.551] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.551] GetLastError () returned 0x0 [0049.552] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe745, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.552] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x18bb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x18bb, lpOverlapped=0x0) returned 1 [0049.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.552] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.552] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.553] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.553] CloseHandle (hObject=0x100) returned 1 [0049.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.554] GetLastError () returned 0x0 [0049.554] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.555] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.555] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.555] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16955646938) returned 1 [0049.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac593a90, dwHighDateTime=0x1d585b4)) [0049.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337cf0 [0049.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cf0 | out: hHeap=0x260000) returned 1 [0049.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328178 [0049.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.556] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.556] GetLastError () returned 0x0 [0049.556] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.556] GetLastError () returned 0x0 [0049.560] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff14c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.560] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xeb4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xeb4, lpOverlapped=0x0) returned 1 [0049.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.560] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.561] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.561] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.561] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.561] CloseHandle (hObject=0x100) returned 1 [0049.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.562] GetLastError () returned 0x0 [0049.563] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.564] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.564] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16956491245) returned 1 [0049.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac5b9bf0, dwHighDateTime=0x1d585b4)) [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337cb8 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cb8 | out: hHeap=0x260000) returned 1 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328210 [0049.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.564] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.564] GetLastError () returned 0x0 [0049.565] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.565] GetLastError () returned 0x0 [0049.566] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff658, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.566] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9a8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x9a8, lpOverlapped=0x0) returned 1 [0049.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.566] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.566] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.567] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.567] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.567] CloseHandle (hObject=0x100) returned 1 [0049.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.568] GetLastError () returned 0x0 [0049.568] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.569] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.569] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16957032425) returned 1 [0049.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac5b9bf0, dwHighDateTime=0x1d585b4)) [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c80 [0049.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c80 | out: hHeap=0x260000) returned 1 [0049.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3282a8 [0049.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.570] GetLastError () returned 0x0 [0049.570] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.570] GetLastError () returned 0x0 [0049.571] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff748, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.571] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x8b8, lpOverlapped=0x0) returned 1 [0049.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.572] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.572] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.572] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.572] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.572] CloseHandle (hObject=0x100) returned 1 [0049.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.573] GetLastError () returned 0x0 [0049.573] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.574] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.574] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.574] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16957523997) returned 1 [0049.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac5b9bf0, dwHighDateTime=0x1d585b4)) [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329af0 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329af0 | out: hHeap=0x260000) returned 1 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328340 [0049.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.575] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.575] GetLastError () returned 0x0 [0049.575] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.575] GetLastError () returned 0x0 [0049.635] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffbfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.635] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x402, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x402, lpOverlapped=0x0) returned 1 [0049.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.637] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.637] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.637] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.637] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.638] CloseHandle (hObject=0x100) returned 1 [0049.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.963] GetLastError () returned 0x0 [0049.964] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.964] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.965] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16996568684) returned 1 [0049.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac971e50, dwHighDateTime=0x1d585b4)) [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a500 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a500 | out: hHeap=0x260000) returned 1 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b508 [0049.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.965] GetLastError () returned 0x0 [0049.965] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.965] GetLastError () returned 0x0 [0049.968] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff8c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.968] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x738, lpOverlapped=0x0) returned 1 [0049.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.968] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.968] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.968] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.968] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.969] CloseHandle (hObject=0xf8) returned 1 [0049.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.969] GetLastError () returned 0x0 [0049.970] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.971] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.971] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.971] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16997227184) returned 1 [0049.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac997fb0, dwHighDateTime=0x1d585b4)) [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a538 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a538 | out: hHeap=0x260000) returned 1 [0049.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b638 [0049.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.972] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.972] GetLastError () returned 0x0 [0049.972] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.972] GetLastError () returned 0x0 [0049.973] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.973] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2bb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x2bb6, lpOverlapped=0x0) returned 1 [0049.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.974] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.974] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.974] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.974] CloseHandle (hObject=0xf8) returned 1 [0049.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.975] GetLastError () returned 0x0 [0049.976] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.977] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.977] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.977] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16997802163) returned 1 [0049.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac997fb0, dwHighDateTime=0x1d585b4)) [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a570 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a570 | out: hHeap=0x260000) returned 1 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b6d0 [0049.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.978] GetLastError () returned 0x0 [0049.978] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.978] GetLastError () returned 0x0 [0049.979] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff89c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.979] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x764, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x764, lpOverlapped=0x0) returned 1 [0049.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.979] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.979] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.980] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.980] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.980] CloseHandle (hObject=0xf8) returned 1 [0049.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.981] GetLastError () returned 0x0 [0049.981] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.982] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.982] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16998299860) returned 1 [0049.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac997fb0, dwHighDateTime=0x1d585b4)) [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd18 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd18 | out: hHeap=0x260000) returned 1 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3283d8 [0049.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.983] GetLastError () returned 0x0 [0049.983] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.983] GetLastError () returned 0x0 [0049.984] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffd48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.984] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2b8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x2b8, lpOverlapped=0x0) returned 1 [0049.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.984] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.984] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.984] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.984] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.985] CloseHandle (hObject=0xf8) returned 1 [0049.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.986] GetLastError () returned 0x0 [0049.986] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.987] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.987] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.987] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16998791903) returned 1 [0049.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac9be110, dwHighDateTime=0x1d585b4)) [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cce0 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cce0 | out: hHeap=0x260000) returned 1 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3290e8 [0049.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.987] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.987] GetLastError () returned 0x0 [0049.988] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.988] GetLastError () returned 0x0 [0049.989] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff878, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.989] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x788, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x788, lpOverlapped=0x0) returned 1 [0049.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.989] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.989] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.990] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.990] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.990] CloseHandle (hObject=0xf8) returned 1 [0049.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.991] GetLastError () returned 0x0 [0049.991] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0049.992] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.992] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.992] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=16999287584) returned 1 [0049.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xac9be110, dwHighDateTime=0x1d585b4)) [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cca8 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cca8 | out: hHeap=0x260000) returned 1 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329050 [0049.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.992] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0049.992] GetLastError () returned 0x0 [0049.992] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0049.993] GetLastError () returned 0x0 [0050.035] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdc2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.035] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x23d4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x23d4, lpOverlapped=0x0) returned 1 [0050.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.036] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.036] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.036] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.036] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.036] CloseHandle (hObject=0xf8) returned 1 [0050.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.077] GetLastError () returned 0x0 [0050.077] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.078] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.078] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.078] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17007912387) returned 1 [0050.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacaa2950, dwHighDateTime=0x1d585b4)) [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a848 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a848 | out: hHeap=0x260000) returned 1 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bdf0 [0050.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.079] GetLastError () returned 0x0 [0050.079] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.079] GetLastError () returned 0x0 [0050.082] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.082] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x375e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x375e, lpOverlapped=0x0) returned 1 [0050.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.082] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.082] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.083] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.083] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.083] CloseHandle (hObject=0xf8) returned 1 [0050.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.117] GetLastError () returned 0x0 [0050.118] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.119] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.119] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.119] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17012010579) returned 1 [0050.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacaeec10, dwHighDateTime=0x1d585b4)) [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a9d0 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a9d0 | out: hHeap=0x260000) returned 1 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bf20 [0050.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.120] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.120] GetLastError () returned 0x0 [0050.120] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.120] GetLastError () returned 0x0 [0050.122] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffbb1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.122] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x44e6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x44e6, lpOverlapped=0x0) returned 1 [0050.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.123] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.123] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.123] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.123] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.123] CloseHandle (hObject=0xf8) returned 1 [0050.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.124] GetLastError () returned 0x0 [0050.125] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.125] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.125] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.126] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17012668969) returned 1 [0050.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacb14d70, dwHighDateTime=0x1d585b4)) [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32aa08 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32aa08 | out: hHeap=0x260000) returned 1 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c348 [0050.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.126] GetLastError () returned 0x0 [0050.126] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.126] GetLastError () returned 0x0 [0050.128] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff2fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.128] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0xd04, lpOverlapped=0x0) returned 1 [0050.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.128] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.128] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.129] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.129] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.129] CloseHandle (hObject=0xf8) returned 1 [0050.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.130] GetLastError () returned 0x0 [0050.130] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.131] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.131] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.131] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17013220214) returned 1 [0050.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacb14d70, dwHighDateTime=0x1d585b4)) [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32aa40 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32aa40 | out: hHeap=0x260000) returned 1 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7b40 [0050.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c3e0 [0050.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7b40 | out: hHeap=0x260000) returned 1 [0050.132] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.132] GetLastError () returned 0x0 [0050.132] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.132] GetLastError () returned 0x0 [0050.133] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffa50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.133] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x5b0, lpOverlapped=0x0) returned 1 [0050.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.134] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.134] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.134] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.134] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.134] CloseHandle (hObject=0xf8) returned 1 [0050.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.135] GetLastError () returned 0x0 [0050.135] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.136] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.136] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.136] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17013751438) returned 1 [0050.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacb14d70, dwHighDateTime=0x1d585b4)) [0050.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32aa78 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32aa78 | out: hHeap=0x260000) returned 1 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7b40 [0050.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c478 [0050.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7b40 | out: hHeap=0x260000) returned 1 [0050.137] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.137] GetLastError () returned 0x0 [0050.137] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.137] GetLastError () returned 0x0 [0050.139] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffeb3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.139] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x14c2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x14c2, lpOverlapped=0x0) returned 1 [0050.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.139] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.139] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.139] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.140] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.140] CloseHandle (hObject=0xf8) returned 1 [0050.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.141] GetLastError () returned 0x0 [0050.141] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.142] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.142] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.142] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17014286521) returned 1 [0050.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacb3aed0, dwHighDateTime=0x1d585b4)) [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294800 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294800 | out: hHeap=0x260000) returned 1 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7b40 [0050.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c510 [0050.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7b40 | out: hHeap=0x260000) returned 1 [0050.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.142] GetLastError () returned 0x0 [0050.143] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.143] GetLastError () returned 0x0 [0050.218] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe4ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.218] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1b16, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x1b16, lpOverlapped=0x0) returned 1 [0050.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.219] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.219] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.220] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.220] CloseHandle (hObject=0xf8) returned 1 [0050.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.268] GetLastError () returned 0x0 [0050.268] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.269] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.269] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.269] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17027053240) returned 1 [0050.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacc6b9d0, dwHighDateTime=0x1d585b4)) [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ce38 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ce38 | out: hHeap=0x260000) returned 1 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec1a8 [0050.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.270] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.270] GetLastError () returned 0x0 [0050.270] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.270] GetLastError () returned 0x0 [0050.272] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb338, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.272] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4cc8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x4cc8, lpOverlapped=0x0) returned 1 [0050.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.272] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.272] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.273] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.273] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.273] CloseHandle (hObject=0xf8) returned 1 [0050.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.274] GetLastError () returned 0x0 [0050.274] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.275] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.275] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.275] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17027747370) returned 1 [0050.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacc6b9d0, dwHighDateTime=0x1d585b4)) [0050.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ce70 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ce70 | out: hHeap=0x260000) returned 1 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27500f8 [0050.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.277] GetLastError () returned 0x0 [0050.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.277] GetLastError () returned 0x0 [0050.279] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffa8ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.279] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5754, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x5754, lpOverlapped=0x0) returned 1 [0050.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.280] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.280] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.280] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.280] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.280] CloseHandle (hObject=0xf8) returned 1 [0050.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.281] GetLastError () returned 0x0 [0050.282] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.283] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.283] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.283] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17028401016) returned 1 [0050.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacc91b30, dwHighDateTime=0x1d585b4)) [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cea8 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cea8 | out: hHeap=0x260000) returned 1 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750190 [0050.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.283] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.284] GetLastError () returned 0x0 [0050.284] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.284] GetLastError () returned 0x0 [0050.285] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffaa46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.285] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x55ba, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0x55ba, lpOverlapped=0x0) returned 1 [0050.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.285] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.286] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.286] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.286] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.286] CloseHandle (hObject=0xf8) returned 1 [0050.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.287] GetLastError () returned 0x0 [0050.287] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.288] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.288] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17028914380) returned 1 [0050.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacc91b30, dwHighDateTime=0x1d585b4)) [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cee0 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cee0 | out: hHeap=0x260000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750228 [0050.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.289] GetLastError () returned 0x0 [0050.289] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.289] GetLastError () returned 0x0 [0050.291] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff3ac6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.291] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc53a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xc53a, lpOverlapped=0x0) returned 1 [0050.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.292] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.292] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.292] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.292] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.293] CloseHandle (hObject=0xf8) returned 1 [0050.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.294] GetLastError () returned 0x0 [0050.295] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.296] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.296] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.296] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17029763978) returned 1 [0050.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaccb7c90, dwHighDateTime=0x1d585b4)) [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cf18 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cf18 | out: hHeap=0x260000) returned 1 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27502c0 [0050.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.297] GetLastError () returned 0x0 [0050.297] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.297] GetLastError () returned 0x0 [0050.300] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff0301, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.300] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xfcff, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xfcff, lpOverlapped=0x0) returned 1 [0050.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.300] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.300] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.301] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.301] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.301] CloseHandle (hObject=0xf8) returned 1 [0050.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.302] GetLastError () returned 0x0 [0050.302] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.303] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.303] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.304] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17030472019) returned 1 [0050.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaccb7c90, dwHighDateTime=0x1d585b4)) [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cf50 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cf50 | out: hHeap=0x260000) returned 1 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750358 [0050.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.304] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.304] GetLastError () returned 0x0 [0050.304] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.305] GetLastError () returned 0x0 [0050.349] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5453, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.350] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xabad, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x224fdb0*=0xabad, lpOverlapped=0x0) returned 1 [0050.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.352] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.352] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.352] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.352] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.352] CloseHandle (hObject=0xf8) returned 1 [0050.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.515] GetLastError () returned 0x0 [0050.515] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.516] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.516] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.516] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17051729522) returned 1 [0050.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaceccfd0, dwHighDateTime=0x1d585b4)) [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d4c8 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d4c8 | out: hHeap=0x260000) returned 1 [0050.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27503f0 [0050.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.517] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.517] GetLastError () returned 0x0 [0050.517] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.517] GetLastError () returned 0x0 [0050.520] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd56e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.520] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x2a92, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x2a92, lpOverlapped=0x0) returned 1 [0050.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.520] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.520] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.520] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.521] CloseHandle (hObject=0x104) returned 1 [0050.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.524] GetLastError () returned 0x0 [0050.524] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.525] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.525] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17052631591) returned 1 [0050.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaceccfd0, dwHighDateTime=0x1d585b4)) [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d500 [0050.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d500 | out: hHeap=0x260000) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27515c0 [0050.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.526] GetLastError () returned 0x0 [0050.526] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.526] GetLastError () returned 0x0 [0050.527] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeb75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.527] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x148b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x148b, lpOverlapped=0x0) returned 1 [0050.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.528] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.528] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.528] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.528] CloseHandle (hObject=0x104) returned 1 [0050.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.529] GetLastError () returned 0x0 [0050.530] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.530] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.530] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.530] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17053159774) returned 1 [0050.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacef3130, dwHighDateTime=0x1d585b4)) [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d538 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d538 | out: hHeap=0x260000) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751658 [0050.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.531] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.531] GetLastError () returned 0x0 [0050.531] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.531] GetLastError () returned 0x0 [0050.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff7b49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.533] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x84b7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x84b7, lpOverlapped=0x0) returned 1 [0050.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.533] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.534] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.534] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.534] CloseHandle (hObject=0x104) returned 1 [0050.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.535] GetLastError () returned 0x0 [0050.537] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.538] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.538] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17053953712) returned 1 [0050.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacef3130, dwHighDateTime=0x1d585b4)) [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d570 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d570 | out: hHeap=0x260000) returned 1 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27516f0 [0050.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.539] GetLastError () returned 0x0 [0050.539] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.539] GetLastError () returned 0x0 [0050.541] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbf61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.541] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x409f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x409f, lpOverlapped=0x0) returned 1 [0050.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.541] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.541] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.542] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.542] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.542] CloseHandle (hObject=0x104) returned 1 [0050.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.543] GetLastError () returned 0x0 [0050.543] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.544] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.544] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.544] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17054498639) returned 1 [0050.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xacef3130, dwHighDateTime=0x1d585b4)) [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ce68 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce68 | out: hHeap=0x260000) returned 1 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752228 [0050.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.655] GetLastError () returned 0x0 [0050.655] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.655] GetLastError () returned 0x0 [0050.658] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff3737, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.658] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0xc8c9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0xc8c9, lpOverlapped=0x0) returned 1 [0050.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.658] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.659] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.659] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.659] CloseHandle (hObject=0x104) returned 1 [0050.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.660] GetLastError () returned 0x0 [0050.660] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.661] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.661] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17066232808) returned 1 [0050.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad023c30, dwHighDateTime=0x1d585b4)) [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ce30 [0050.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce30 | out: hHeap=0x260000) returned 1 [0050.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752228 [0050.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.662] GetLastError () returned 0x0 [0050.662] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.662] GetLastError () returned 0x0 [0050.664] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc18c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.664] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0x3e74, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0x3e74, lpOverlapped=0x0) returned 1 [0050.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.664] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.664] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.664] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.665] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.665] CloseHandle (hObject=0x104) returned 1 [0050.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.666] GetLastError () returned 0x0 [0050.666] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.667] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.667] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17066818782) returned 1 [0050.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad023c30, dwHighDateTime=0x1d585b4)) [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd88 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd88 | out: hHeap=0x260000) returned 1 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752358 [0050.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.668] GetLastError () returned 0x0 [0050.668] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.668] GetLastError () returned 0x0 [0050.670] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff9688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.670] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0x6978, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0x6978, lpOverlapped=0x0) returned 1 [0050.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.670] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.670] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.670] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.670] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.671] CloseHandle (hObject=0x104) returned 1 [0050.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.671] GetLastError () returned 0x0 [0050.672] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.672] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.672] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.673] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17067367673) returned 1 [0050.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad049d90, dwHighDateTime=0x1d585b4)) [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd50 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd50 | out: hHeap=0x260000) returned 1 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27523f0 [0050.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.673] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.673] GetLastError () returned 0x0 [0050.673] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.673] GetLastError () returned 0x0 [0050.675] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd430, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.675] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0x2bd0, lpOverlapped=0x0) returned 1 [0050.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.675] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.675] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.676] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.676] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.676] CloseHandle (hObject=0x104) returned 1 [0050.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.677] GetLastError () returned 0x0 [0050.677] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.678] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.678] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.678] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17067893225) returned 1 [0050.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad049d90, dwHighDateTime=0x1d585b4)) [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d960 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d960 | out: hHeap=0x260000) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752488 [0050.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.678] GetLastError () returned 0x0 [0050.679] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.679] GetLastError () returned 0x0 [0050.680] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbd70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.680] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0x4290, lpOverlapped=0x0) returned 1 [0050.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.681] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.681] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.681] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.681] CloseHandle (hObject=0x104) returned 1 [0050.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.682] GetLastError () returned 0x0 [0050.682] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.683] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.683] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.683] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17068440617) returned 1 [0050.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad049d90, dwHighDateTime=0x1d585b4)) [0050.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d998 [0050.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d998 | out: hHeap=0x260000) returned 1 [0050.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752520 [0050.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.684] GetLastError () returned 0x0 [0050.684] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.684] GetLastError () returned 0x0 [0050.686] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.686] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0x43c0, lpOverlapped=0x0) returned 1 [0050.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.686] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.686] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.686] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.687] CloseHandle (hObject=0x104) returned 1 [0050.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.687] GetLastError () returned 0x0 [0050.688] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.688] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.689] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17068976640) returned 1 [0050.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad06fef0, dwHighDateTime=0x1d585b4)) [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d9d0 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d9d0 | out: hHeap=0x260000) returned 1 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27525b8 [0050.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.689] GetLastError () returned 0x0 [0050.689] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.689] GetLastError () returned 0x0 [0050.709] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffcd9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.709] WriteFile (in: hFile=0x104, lpBuffer=0x2816090*, nNumberOfBytesToWrite=0x3264, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2816090*, lpNumberOfBytesWritten=0x224fdb0*=0x3264, lpOverlapped=0x0) returned 1 [0050.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2816090 | out: hHeap=0x260000) returned 1 [0050.710] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.710] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.711] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.711] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.711] CloseHandle (hObject=0x104) returned 1 [0050.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.715] GetLastError () returned 0x0 [0050.715] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.726] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.726] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.726] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17072761174) returned 1 [0050.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad0bc1b0, dwHighDateTime=0x1d585b4)) [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32da40 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32da40 | out: hHeap=0x260000) returned 1 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752650 [0050.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.727] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.727] GetLastError () returned 0x0 [0050.727] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.727] GetLastError () returned 0x0 [0050.733] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe8ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.733] WriteFile (in: hFile=0x104, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x1714, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x1714, lpOverlapped=0x0) returned 1 [0050.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.735] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.735] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.735] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.735] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.736] CloseHandle (hObject=0x104) returned 1 [0050.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.737] GetLastError () returned 0x0 [0050.737] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.738] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.738] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.738] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17073923992) returned 1 [0050.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad0e2310, dwHighDateTime=0x1d585b4)) [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32da78 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32da78 | out: hHeap=0x260000) returned 1 [0050.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752780 [0050.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.739] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.739] GetLastError () returned 0x0 [0050.739] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.739] GetLastError () returned 0x0 [0050.742] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffa3d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.742] WriteFile (in: hFile=0x104, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x5c2c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x5c2c, lpOverlapped=0x0) returned 1 [0050.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.743] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.743] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.743] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.743] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.744] CloseHandle (hObject=0x104) returned 1 [0050.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.744] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.745] GetLastError () returned 0x0 [0050.745] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.746] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.746] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17074703979) returned 1 [0050.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad0e2310, dwHighDateTime=0x1d585b4)) [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32daf0 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32daf0 | out: hHeap=0x260000) returned 1 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752818 [0050.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.746] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.747] GetLastError () returned 0x0 [0050.747] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.747] GetLastError () returned 0x0 [0050.748] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffebcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.748] WriteFile (in: hFile=0x104, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x1434, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x1434, lpOverlapped=0x0) returned 1 [0050.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.749] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.749] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.749] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.749] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.749] CloseHandle (hObject=0x104) returned 1 [0050.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.750] GetLastError () returned 0x0 [0050.751] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.752] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.752] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.752] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17075338108) returned 1 [0050.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad108470, dwHighDateTime=0x1d585b4)) [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db28 [0050.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db28 | out: hHeap=0x260000) returned 1 [0050.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27528b0 [0050.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.753] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.753] GetLastError () returned 0x0 [0050.753] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.753] GetLastError () returned 0x0 [0050.755] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffea00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.755] WriteFile (in: hFile=0x104, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x1600, lpOverlapped=0x0) returned 1 [0050.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.755] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.755] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.755] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.755] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.756] CloseHandle (hObject=0x104) returned 1 [0050.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.756] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.757] GetLastError () returned 0x0 [0050.757] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.758] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.758] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.758] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17075934940) returned 1 [0050.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad108470, dwHighDateTime=0x1d585b4)) [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db60 [0050.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db60 | out: hHeap=0x260000) returned 1 [0050.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752948 [0050.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.759] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.759] GetLastError () returned 0x0 [0050.759] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.759] GetLastError () returned 0x0 [0050.802] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff28c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.802] WriteFile (in: hFile=0x104, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0xd74, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0xd74, lpOverlapped=0x0) returned 1 [0050.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.829] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.829] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.830] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.830] CloseHandle (hObject=0x104) returned 1 [0050.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.832] GetLastError () returned 0x0 [0050.840] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.841] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.841] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.841] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17084232074) returned 1 [0050.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad1eccb0, dwHighDateTime=0x1d585b4)) [0050.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dd58 [0050.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dd58 | out: hHeap=0x260000) returned 1 [0050.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27529e0 [0050.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.842] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.842] GetLastError () returned 0x0 [0050.842] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.842] GetLastError () returned 0x0 [0050.846] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd2ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.846] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x2d14, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x2d14, lpOverlapped=0x0) returned 1 [0050.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.849] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.849] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.850] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.850] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.850] CloseHandle (hObject=0x118) returned 1 [0050.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.851] GetLastError () returned 0x0 [0050.852] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.853] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.853] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.853] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17085397417) returned 1 [0050.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad1eccb0, dwHighDateTime=0x1d585b4)) [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dd90 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dd90 | out: hHeap=0x260000) returned 1 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752f38 [0050.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.854] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.854] GetLastError () returned 0x0 [0050.854] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.854] GetLastError () returned 0x0 [0050.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffed44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.858] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x12bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x12bc, lpOverlapped=0x0) returned 1 [0050.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.858] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.858] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.859] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.859] CloseHandle (hObject=0x118) returned 1 [0050.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.861] GetLastError () returned 0x0 [0050.861] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.862] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.862] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17086402363) returned 1 [0050.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad212e10, dwHighDateTime=0x1d585b4)) [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ddc8 [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ddc8 | out: hHeap=0x260000) returned 1 [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752fd0 [0050.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.864] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.864] GetLastError () returned 0x0 [0050.864] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.864] GetLastError () returned 0x0 [0050.866] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe658, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.866] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x19a8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x19a8, lpOverlapped=0x0) returned 1 [0050.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.866] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.866] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.867] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.867] CloseHandle (hObject=0x118) returned 1 [0050.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.869] GetLastError () returned 0x0 [0050.869] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.870] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.870] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.870] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17087127691) returned 1 [0050.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad212e10, dwHighDateTime=0x1d585b4)) [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32de00 [0050.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32de00 | out: hHeap=0x260000) returned 1 [0050.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753068 [0050.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.871] GetLastError () returned 0x0 [0050.871] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.871] GetLastError () returned 0x0 [0050.988] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc228, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.988] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x3dd8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x3dd8, lpOverlapped=0x0) returned 1 [0050.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0050.988] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.988] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.988] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.989] CloseHandle (hObject=0x118) returned 1 [0050.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.990] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.991] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.991] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.993] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.993] GetLastError () returned 0x0 [0050.995] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffec9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.995] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x1364, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x1364, lpOverlapped=0x0) returned 1 [0050.995] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.995] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.996] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.996] CloseHandle (hObject=0x118) returned 1 [0050.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.997] GetLastError () returned 0x0 [0050.997] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0050.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.998] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0050.998] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17099927450) returned 1 [0050.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad369a70, dwHighDateTime=0x1d585b4)) [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e110 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e110 | out: hHeap=0x260000) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27539e8 [0050.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0050.999] GetLastError () returned 0x0 [0050.999] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0050.999] GetLastError () returned 0x0 [0051.001] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffedf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.001] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x1210, lpOverlapped=0x0) returned 1 [0051.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.001] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.001] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.002] CloseHandle (hObject=0x118) returned 1 [0051.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.003] GetLastError () returned 0x0 [0051.003] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.004] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.004] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.004] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17100536976) returned 1 [0051.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad369a70, dwHighDateTime=0x1d585b4)) [0051.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e148 [0051.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e148 | out: hHeap=0x260000) returned 1 [0051.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753a80 [0051.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.005] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.005] GetLastError () returned 0x0 [0051.005] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.005] GetLastError () returned 0x0 [0051.007] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe908, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.007] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x16f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x16f8, lpOverlapped=0x0) returned 1 [0051.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.007] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.007] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.007] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.007] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.008] CloseHandle (hObject=0x118) returned 1 [0051.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.009] GetLastError () returned 0x0 [0051.009] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.010] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.010] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.010] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17101096383) returned 1 [0051.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad369a70, dwHighDateTime=0x1d585b4)) [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e180 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e180 | out: hHeap=0x260000) returned 1 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753b18 [0051.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.010] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.011] GetLastError () returned 0x0 [0051.011] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.011] GetLastError () returned 0x0 [0051.012] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe8a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.012] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x175c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x175c, lpOverlapped=0x0) returned 1 [0051.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.013] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.013] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.013] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.013] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.013] CloseHandle (hObject=0x118) returned 1 [0051.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.013] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.014] GetLastError () returned 0x0 [0051.015] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.016] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.016] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.016] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17101701010) returned 1 [0051.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad38fbd0, dwHighDateTime=0x1d585b4)) [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e1b8 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e1b8 | out: hHeap=0x260000) returned 1 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753bb0 [0051.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.016] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.017] GetLastError () returned 0x0 [0051.017] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.017] GetLastError () returned 0x0 [0051.018] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdfc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.018] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x203c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x203c, lpOverlapped=0x0) returned 1 [0051.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.019] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.019] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.019] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.019] CloseHandle (hObject=0x118) returned 1 [0051.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.020] GetLastError () returned 0x0 [0051.020] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.021] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.021] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.021] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17102242525) returned 1 [0051.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad38fbd0, dwHighDateTime=0x1d585b4)) [0051.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e1f0 [0051.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e1f0 | out: hHeap=0x260000) returned 1 [0051.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753c48 [0051.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.022] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.022] GetLastError () returned 0x0 [0051.022] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.022] GetLastError () returned 0x0 [0051.117] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffecb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.139] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x1350, lpOverlapped=0x0) returned 1 [0051.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.151] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.151] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.151] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.151] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.151] CloseHandle (hObject=0x118) returned 1 [0051.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.152] GetLastError () returned 0x0 [0051.152] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.153] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.153] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17115446257) returned 1 [0051.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad4e6830, dwHighDateTime=0x1d585b4)) [0051.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e688 [0051.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e688 | out: hHeap=0x260000) returned 1 [0051.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a8c0 [0051.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.154] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.154] GetLastError () returned 0x0 [0051.154] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.154] GetLastError () returned 0x0 [0051.155] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd8b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.155] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x274c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x274c, lpOverlapped=0x0) returned 1 [0051.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.156] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.156] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.156] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.156] CloseHandle (hObject=0x118) returned 1 [0051.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.157] GetLastError () returned 0x0 [0051.157] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.158] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.158] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.158] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17115947853) returned 1 [0051.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad4e6830, dwHighDateTime=0x1d585b4)) [0051.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e6c0 [0051.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e6c0 | out: hHeap=0x260000) returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a9f0 [0051.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.159] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.159] GetLastError () returned 0x0 [0051.159] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.159] GetLastError () returned 0x0 [0051.160] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe94c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.161] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x16b4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x16b4, lpOverlapped=0x0) returned 1 [0051.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.161] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.161] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.161] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.161] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.161] CloseHandle (hObject=0x118) returned 1 [0051.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.162] GetLastError () returned 0x0 [0051.163] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.163] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.163] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.163] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17116460141) returned 1 [0051.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad4e6830, dwHighDateTime=0x1d585b4)) [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e6f8 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e6f8 | out: hHeap=0x260000) returned 1 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277aa88 [0051.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.164] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.164] GetLastError () returned 0x0 [0051.164] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.164] GetLastError () returned 0x0 [0051.166] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffa404, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.166] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x5bfc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x5bfc, lpOverlapped=0x0) returned 1 [0051.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.166] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.166] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.166] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.166] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.167] CloseHandle (hObject=0x118) returned 1 [0051.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.168] GetLastError () returned 0x0 [0051.168] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.169] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.169] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17117052455) returned 1 [0051.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad50c990, dwHighDateTime=0x1d585b4)) [0051.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e730 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e730 | out: hHeap=0x260000) returned 1 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ab20 [0051.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.170] GetLastError () returned 0x0 [0051.170] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.170] GetLastError () returned 0x0 [0051.171] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd184, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.172] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x2e7c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x2e7c, lpOverlapped=0x0) returned 1 [0051.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.172] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.172] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.172] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.173] CloseHandle (hObject=0x118) returned 1 [0051.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.174] GetLastError () returned 0x0 [0051.174] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.175] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.175] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.175] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17117601998) returned 1 [0051.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad50c990, dwHighDateTime=0x1d585b4)) [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8028 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8028 | out: hHeap=0x260000) returned 1 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277abb8 [0051.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.175] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.176] GetLastError () returned 0x0 [0051.176] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.176] GetLastError () returned 0x0 [0051.177] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb370, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.177] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x4c90, lpOverlapped=0x0) returned 1 [0051.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.177] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.178] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.178] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.178] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.178] CloseHandle (hObject=0x118) returned 1 [0051.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.179] GetLastError () returned 0x0 [0051.180] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.181] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.181] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.181] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17118190724) returned 1 [0051.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xad50c990, dwHighDateTime=0x1d585b4)) [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8338 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8338 | out: hHeap=0x260000) returned 1 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ac50 [0051.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.181] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.181] GetLastError () returned 0x0 [0051.182] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.182] GetLastError () returned 0x0 [0051.183] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff79c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.183] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x864, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x224fdb0*=0x864, lpOverlapped=0x0) returned 1 [0051.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.183] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.385] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.386] CloseHandle (hObject=0x118) returned 1 [0051.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.458] GetLastError () returned 0x0 [0051.727] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.728] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.728] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.728] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17172897423) returned 1 [0051.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xada419b0, dwHighDateTime=0x1d585b4)) [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299440 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299440 | out: hHeap=0x260000) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297698 [0051.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.728] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.729] GetLastError () returned 0x0 [0051.729] GetLastError () returned 0x0 [0051.729] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.729] GetLastError () returned 0x0 [0051.729] GetLastError () returned 0x0 [0051.731] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff9eb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.731] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x614c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x614c, lpOverlapped=0x0) returned 1 [0051.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.731] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.731] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.731] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.732] CloseHandle (hObject=0x118) returned 1 [0051.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.779] GetLastError () returned 0x0 [0051.834] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.835] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.835] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.835] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17183628640) returned 1 [0051.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadb4c350, dwHighDateTime=0x1d585b4)) [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294a30 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a30 | out: hHeap=0x260000) returned 1 [0051.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2964c8 [0051.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.836] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.836] GetLastError () returned 0x0 [0051.836] GetLastError () returned 0x0 [0051.836] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.836] GetLastError () returned 0x0 [0051.836] GetLastError () returned 0x0 [0051.839] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe878, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.839] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1788, lpOverlapped=0x0) returned 1 [0051.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.839] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.840] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.840] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.840] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.840] CloseHandle (hObject=0x118) returned 1 [0051.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.841] GetLastError () returned 0x0 [0051.841] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.842] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.842] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.842] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17184346371) returned 1 [0051.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadb724b0, dwHighDateTime=0x1d585b4)) [0051.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949f8 [0051.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0051.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297438 [0051.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.843] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.843] GetLastError () returned 0x0 [0051.843] GetLastError () returned 0x0 [0051.843] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.843] GetLastError () returned 0x0 [0051.843] GetLastError () returned 0x0 [0051.845] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffbfac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.845] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4054, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x4054, lpOverlapped=0x0) returned 1 [0051.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.845] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.845] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.846] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.846] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.846] CloseHandle (hObject=0x118) returned 1 [0051.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.847] GetLastError () returned 0x0 [0051.848] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.848] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.848] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.849] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17184967139) returned 1 [0051.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadb724b0, dwHighDateTime=0x1d585b4)) [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294950 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294950 | out: hHeap=0x260000) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ee0 [0051.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.849] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.849] GetLastError () returned 0x0 [0051.849] GetLastError () returned 0x0 [0051.849] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.850] GetLastError () returned 0x0 [0051.850] GetLastError () returned 0x0 [0051.851] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe534, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.851] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1acc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1acc, lpOverlapped=0x0) returned 1 [0051.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.851] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.852] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.852] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.852] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.852] CloseHandle (hObject=0x118) returned 1 [0051.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.853] GetLastError () returned 0x0 [0051.853] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.854] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.854] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.854] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17185539629) returned 1 [0051.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadb98610, dwHighDateTime=0x1d585b4)) [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294918 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294918 | out: hHeap=0x260000) returned 1 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296d18 [0051.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.855] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.855] GetLastError () returned 0x0 [0051.855] GetLastError () returned 0x0 [0051.855] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.855] GetLastError () returned 0x0 [0051.856] GetLastError () returned 0x0 [0051.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe6e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.857] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1918, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1918, lpOverlapped=0x0) returned 1 [0051.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.858] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.858] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.858] CloseHandle (hObject=0x118) returned 1 [0051.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.859] GetLastError () returned 0x0 [0051.859] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.860] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.860] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.860] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17186126127) returned 1 [0051.860] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadb98610, dwHighDateTime=0x1d585b4)) [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948e0 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948e0 | out: hHeap=0x260000) returned 1 [0051.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec110 [0051.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.861] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.861] GetLastError () returned 0x0 [0051.861] GetLastError () returned 0x0 [0051.861] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.861] GetLastError () returned 0x0 [0051.861] GetLastError () returned 0x0 [0051.978] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdd60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.978] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x22a0, lpOverlapped=0x0) returned 1 [0051.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.979] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.979] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.980] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.980] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.980] CloseHandle (hObject=0x118) returned 1 [0051.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.981] GetLastError () returned 0x0 [0051.981] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.982] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.982] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17198327312) returned 1 [0051.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadcc9110, dwHighDateTime=0x1d585b4)) [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efdd0 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efdd0 | out: hHeap=0x260000) returned 1 [0051.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a668 [0051.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.983] GetLastError () returned 0x0 [0051.983] GetLastError () returned 0x0 [0051.983] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.983] GetLastError () returned 0x0 [0051.983] GetLastError () returned 0x0 [0051.985] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff1c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.985] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xe3c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0xe3c, lpOverlapped=0x0) returned 1 [0051.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.985] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.985] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.986] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.986] CloseHandle (hObject=0x118) returned 1 [0051.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.987] GetLastError () returned 0x0 [0051.988] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.989] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.989] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.989] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17199024113) returned 1 [0051.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadcc9110, dwHighDateTime=0x1d585b4)) [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe08 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe08 | out: hHeap=0x260000) returned 1 [0051.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a798 [0051.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.990] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.990] GetLastError () returned 0x0 [0051.990] GetLastError () returned 0x0 [0051.990] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.990] GetLastError () returned 0x0 [0051.990] GetLastError () returned 0x0 [0051.992] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffec74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.992] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x138c, lpOverlapped=0x0) returned 1 [0051.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.992] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.992] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.993] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.993] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.993] CloseHandle (hObject=0x118) returned 1 [0051.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.994] GetLastError () returned 0x0 [0051.994] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0051.995] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.995] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.995] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17199623686) returned 1 [0051.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadcef270, dwHighDateTime=0x1d585b4)) [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe40 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe40 | out: hHeap=0x260000) returned 1 [0051.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a830 [0051.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.996] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0051.996] GetLastError () returned 0x0 [0051.996] GetLastError () returned 0x0 [0051.996] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0051.996] GetLastError () returned 0x0 [0051.996] GetLastError () returned 0x0 [0051.998] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffed4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.998] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x12b4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x12b4, lpOverlapped=0x0) returned 1 [0051.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.998] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.998] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.998] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.999] CloseHandle (hObject=0x118) returned 1 [0051.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0052.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.000] GetLastError () returned 0x0 [0052.000] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.001] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.001] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.001] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17200205838) returned 1 [0052.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadcef270, dwHighDateTime=0x1d585b4)) [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe78 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe78 | out: hHeap=0x260000) returned 1 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a8c8 [0052.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.001] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.002] GetLastError () returned 0x0 [0052.002] GetLastError () returned 0x0 [0052.002] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.002] GetLastError () returned 0x0 [0052.002] GetLastError () returned 0x0 [0052.003] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdfe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.004] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x2020, lpOverlapped=0x0) returned 1 [0052.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.004] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.004] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.004] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.004] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.005] CloseHandle (hObject=0x118) returned 1 [0052.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0052.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0052.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.006] GetLastError () returned 0x0 [0052.006] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.007] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.007] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17200783711) returned 1 [0052.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadcef270, dwHighDateTime=0x1d585b4)) [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efeb0 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efeb0 | out: hHeap=0x260000) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a960 [0052.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.007] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.007] GetLastError () returned 0x0 [0052.008] GetLastError () returned 0x0 [0052.008] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.008] GetLastError () returned 0x0 [0052.008] GetLastError () returned 0x0 [0052.010] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffed94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.010] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x126c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x126c, lpOverlapped=0x0) returned 1 [0052.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.011] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.011] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.011] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.011] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.011] CloseHandle (hObject=0x118) returned 1 [0052.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0052.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0052.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.012] GetLastError () returned 0x0 [0052.133] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.134] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.134] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.134] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17213555030) returned 1 [0052.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xade1fd70, dwHighDateTime=0x1d585b4)) [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14f8 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756650 [0052.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.135] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.136] GetLastError () returned 0x0 [0052.136] GetLastError () returned 0x0 [0052.136] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.136] GetLastError () returned 0x0 [0052.136] GetLastError () returned 0x0 [0052.140] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffbeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.140] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4146, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x4146, lpOverlapped=0x0) returned 1 [0052.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.141] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.141] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.141] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.141] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.142] CloseHandle (hObject=0x10c) returned 1 [0052.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.143] GetLastError () returned 0x0 [0052.143] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.144] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.144] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.145] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17214572040) returned 1 [0052.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xade45ed0, dwHighDateTime=0x1d585b4)) [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1300 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1300 | out: hHeap=0x260000) returned 1 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756650 [0052.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.145] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.145] GetLastError () returned 0x0 [0052.146] GetLastError () returned 0x0 [0052.146] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.146] GetLastError () returned 0x0 [0052.146] GetLastError () returned 0x0 [0052.148] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff6aa3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.148] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x955d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x955d, lpOverlapped=0x0) returned 1 [0052.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.149] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.149] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.149] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.150] CloseHandle (hObject=0x10c) returned 1 [0052.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.151] GetLastError () returned 0x0 [0052.152] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.153] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.153] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17215411777) returned 1 [0052.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xade6c030, dwHighDateTime=0x1d585b4)) [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1418 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756780 [0052.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.154] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.154] GetLastError () returned 0x0 [0052.154] GetLastError () returned 0x0 [0052.154] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.154] GetLastError () returned 0x0 [0052.154] GetLastError () returned 0x0 [0052.156] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff94ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.156] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6b01, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x6b01, lpOverlapped=0x0) returned 1 [0052.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.157] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.157] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.157] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.157] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.158] CloseHandle (hObject=0x10c) returned 1 [0052.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.159] GetLastError () returned 0x0 [0052.160] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.161] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.161] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17216487129) returned 1 [0052.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xade6c030, dwHighDateTime=0x1d585b4)) [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11b0 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756818 [0052.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.164] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.165] GetLastError () returned 0x0 [0052.165] GetLastError () returned 0x0 [0052.165] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.165] GetLastError () returned 0x0 [0052.165] GetLastError () returned 0x0 [0052.167] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff02de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.167] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xfd22, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xfd22, lpOverlapped=0x0) returned 1 [0052.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.169] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.169] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.169] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.169] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.170] CloseHandle (hObject=0x10c) returned 1 [0052.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.170] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.171] GetLastError () returned 0x0 [0052.172] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.173] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.173] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.173] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17217448404) returned 1 [0052.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xade92190, dwHighDateTime=0x1d585b4)) [0052.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11e8 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11e8 | out: hHeap=0x260000) returned 1 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27568b0 [0052.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.174] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.174] GetLastError () returned 0x0 [0052.174] GetLastError () returned 0x0 [0052.174] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.175] GetLastError () returned 0x0 [0052.175] GetLastError () returned 0x0 [0052.177] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff4abc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.177] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xb544, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xb544, lpOverlapped=0x0) returned 1 [0052.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.177] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.178] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.178] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.178] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.178] CloseHandle (hObject=0x10c) returned 1 [0052.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.183] GetLastError () returned 0x0 [0052.183] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.184] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.184] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17218557881) returned 1 [0052.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadeb82f0, dwHighDateTime=0x1d585b4)) [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1220 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0052.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1220 | out: hHeap=0x260000) returned 1 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756948 [0052.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.185] GetLastError () returned 0x0 [0052.185] GetLastError () returned 0x0 [0052.186] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] GetLastError () returned 0x0 [0052.188] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffded2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.188] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x212e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x212e, lpOverlapped=0x0) returned 1 [0052.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.188] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.188] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.189] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.189] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.189] CloseHandle (hObject=0x10c) returned 1 [0052.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.190] GetLastError () returned 0x0 [0052.191] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.192] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.192] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.192] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17219350168) returned 1 [0052.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadeb82f0, dwHighDateTime=0x1d585b4)) [0052.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1258 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0052.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1258 | out: hHeap=0x260000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27569e0 [0052.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.193] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.193] GetLastError () returned 0x0 [0052.193] GetLastError () returned 0x0 [0052.193] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.194] GetLastError () returned 0x0 [0052.194] GetLastError () returned 0x0 [0052.195] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffeefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.195] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1104, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1104, lpOverlapped=0x0) returned 1 [0052.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.196] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.196] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.196] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.196] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.197] CloseHandle (hObject=0x10c) returned 1 [0052.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.198] GetLastError () returned 0x0 [0052.199] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.200] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.200] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.200] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17220089932) returned 1 [0052.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xadede450, dwHighDateTime=0x1d585b4)) [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1290 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0052.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756a78 [0052.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.200] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.201] GetLastError () returned 0x0 [0052.201] GetLastError () returned 0x0 [0052.201] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.201] GetLastError () returned 0x0 [0052.201] GetLastError () returned 0x0 [0052.308] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc398, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.308] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3c68, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x3c68, lpOverlapped=0x0) returned 1 [0052.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.310] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.310] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.311] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.311] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.311] CloseHandle (hObject=0x10c) returned 1 [0052.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.312] GetLastError () returned 0x0 [0052.324] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.325] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.325] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.325] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17232637983) returned 1 [0052.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae00ef50, dwHighDateTime=0x1d585b4)) [0052.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5c0 [0052.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x260000) returned 1 [0052.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756b10 [0052.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.326] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.326] GetLastError () returned 0x0 [0052.326] GetLastError () returned 0x0 [0052.326] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.326] GetLastError () returned 0x0 [0052.327] GetLastError () returned 0x0 [0052.328] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff190, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.328] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xe70, lpOverlapped=0x0) returned 1 [0052.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.329] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.329] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.329] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.330] CloseHandle (hObject=0x118) returned 1 [0052.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0052.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0052.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.331] GetLastError () returned 0x0 [0052.332] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.333] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.333] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17233396115) returned 1 [0052.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae00ef50, dwHighDateTime=0x1d585b4)) [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d550 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x260000) returned 1 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27572c8 [0052.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.333] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.334] GetLastError () returned 0x0 [0052.334] GetLastError () returned 0x0 [0052.334] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.334] GetLastError () returned 0x0 [0052.334] GetLastError () returned 0x0 [0052.335] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff2d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.336] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xd28, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xd28, lpOverlapped=0x0) returned 1 [0052.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.336] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.336] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.336] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.337] CloseHandle (hObject=0x118) returned 1 [0052.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0052.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0052.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.338] GetLastError () returned 0x0 [0052.338] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.339] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.339] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17234020778) returned 1 [0052.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae0350b0, dwHighDateTime=0x1d585b4)) [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d518 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d518 | out: hHeap=0x260000) returned 1 [0052.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757360 [0052.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.340] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.340] GetLastError () returned 0x0 [0052.340] GetLastError () returned 0x0 [0052.340] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.340] GetLastError () returned 0x0 [0052.340] GetLastError () returned 0x0 [0052.342] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd54c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.342] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2ab4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x2ab4, lpOverlapped=0x0) returned 1 [0052.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.342] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.342] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.342] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.343] CloseHandle (hObject=0x118) returned 1 [0052.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0052.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0052.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.344] GetLastError () returned 0x0 [0052.344] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.345] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.345] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17234616077) returned 1 [0052.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae0350b0, dwHighDateTime=0x1d585b4)) [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4e0 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x260000) returned 1 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27573f8 [0052.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.346] GetLastError () returned 0x0 [0052.346] GetLastError () returned 0x0 [0052.346] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.346] GetLastError () returned 0x0 [0052.346] GetLastError () returned 0x0 [0052.348] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe73c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.348] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x18c4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x18c4, lpOverlapped=0x0) returned 1 [0052.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.348] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.348] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.348] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.348] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.349] CloseHandle (hObject=0x118) returned 1 [0052.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0052.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0052.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.350] GetLastError () returned 0x0 [0052.350] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.351] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.351] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17235220809) returned 1 [0052.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae0350b0, dwHighDateTime=0x1d585b4)) [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4a8 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4a8 | out: hHeap=0x260000) returned 1 [0052.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757490 [0052.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.352] GetLastError () returned 0x0 [0052.352] GetLastError () returned 0x0 [0052.352] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.352] GetLastError () returned 0x0 [0052.352] GetLastError () returned 0x0 [0052.491] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd9d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.491] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2628, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x2628, lpOverlapped=0x0) returned 1 [0052.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.493] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.493] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.494] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.494] CloseHandle (hObject=0x118) returned 1 [0052.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.495] GetLastError () returned 0x0 [0052.495] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.496] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.496] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17249754327) returned 1 [0052.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae1b1e70, dwHighDateTime=0x1d585b4)) [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338118 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338118 | out: hHeap=0x260000) returned 1 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750a78 [0052.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.497] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.497] GetLastError () returned 0x0 [0052.497] GetLastError () returned 0x0 [0052.497] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.497] GetLastError () returned 0x0 [0052.498] GetLastError () returned 0x0 [0052.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe4d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.501] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1b2c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x1b2c, lpOverlapped=0x0) returned 1 [0052.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.502] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.502] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.502] CloseHandle (hObject=0x118) returned 1 [0052.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.503] GetLastError () returned 0x0 [0052.504] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.505] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.505] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17250623050) returned 1 [0052.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae1b1e70, dwHighDateTime=0x1d585b4)) [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3380e0 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380e0 | out: hHeap=0x260000) returned 1 [0052.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758060 [0052.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.506] GetLastError () returned 0x0 [0052.506] GetLastError () returned 0x0 [0052.506] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.506] GetLastError () returned 0x0 [0052.506] GetLastError () returned 0x0 [0052.508] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff86c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.508] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x794, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x794, lpOverlapped=0x0) returned 1 [0052.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.508] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.508] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.508] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.509] CloseHandle (hObject=0x118) returned 1 [0052.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.510] GetLastError () returned 0x0 [0052.510] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.511] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.511] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.511] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17251255063) returned 1 [0052.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae1d7fd0, dwHighDateTime=0x1d585b4)) [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3380a8 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380a8 | out: hHeap=0x260000) returned 1 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27580f8 [0052.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.512] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.512] GetLastError () returned 0x0 [0052.512] GetLastError () returned 0x0 [0052.512] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.512] GetLastError () returned 0x0 [0052.513] GetLastError () returned 0x0 [0052.514] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd654, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.514] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x29ac, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x29ac, lpOverlapped=0x0) returned 1 [0052.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.515] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.515] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.515] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.515] CloseHandle (hObject=0x118) returned 1 [0052.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.516] GetLastError () returned 0x0 [0052.517] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.518] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.518] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.518] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17251887616) returned 1 [0052.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae1d7fd0, dwHighDateTime=0x1d585b4)) [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338070 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338070 | out: hHeap=0x260000) returned 1 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758190 [0052.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.518] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.518] GetLastError () returned 0x0 [0052.519] GetLastError () returned 0x0 [0052.519] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.519] GetLastError () returned 0x0 [0052.519] GetLastError () returned 0x0 [0052.520] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd3ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.520] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2c54, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x2c54, lpOverlapped=0x0) returned 1 [0052.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.521] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.521] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.521] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.521] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.521] CloseHandle (hObject=0x118) returned 1 [0052.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.522] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.522] GetLastError () returned 0x0 [0052.523] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.523] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.524] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.524] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17252480387) returned 1 [0052.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae1d7fd0, dwHighDateTime=0x1d585b4)) [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338038 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338038 | out: hHeap=0x260000) returned 1 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758228 [0052.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.524] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.524] GetLastError () returned 0x0 [0052.525] GetLastError () returned 0x0 [0052.525] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.525] GetLastError () returned 0x0 [0052.525] GetLastError () returned 0x0 [0052.532] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffee70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.532] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x1190, lpOverlapped=0x0) returned 1 [0052.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.533] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.533] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.533] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.533] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.533] CloseHandle (hObject=0x118) returned 1 [0052.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.573] GetLastError () returned 0x0 [0052.573] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.574] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.574] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.574] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17257510626) returned 1 [0052.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae270550, dwHighDateTime=0x1d585b4)) [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f58 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f58 | out: hHeap=0x260000) returned 1 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27582c0 [0052.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.575] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.575] GetLastError () returned 0x0 [0052.575] GetLastError () returned 0x0 [0052.575] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.575] GetLastError () returned 0x0 [0052.575] GetLastError () returned 0x0 [0052.577] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff440, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.577] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xbc0, lpOverlapped=0x0) returned 1 [0052.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.577] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.577] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.578] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.578] CloseHandle (hObject=0x118) returned 1 [0052.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.579] GetLastError () returned 0x0 [0052.579] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.580] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.580] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17258126193) returned 1 [0052.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae270550, dwHighDateTime=0x1d585b4)) [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f20 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f20 | out: hHeap=0x260000) returned 1 [0052.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27586e8 [0052.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.581] GetLastError () returned 0x0 [0052.581] GetLastError () returned 0x0 [0052.581] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.581] GetLastError () returned 0x0 [0052.581] GetLastError () returned 0x0 [0052.583] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb180, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.583] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x4e80, lpOverlapped=0x0) returned 1 [0052.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.583] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.583] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.584] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.584] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.584] CloseHandle (hObject=0x118) returned 1 [0052.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.585] GetLastError () returned 0x0 [0052.585] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.586] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.586] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17258730497) returned 1 [0052.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae270550, dwHighDateTime=0x1d585b4)) [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337ee8 [0052.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ee8 | out: hHeap=0x260000) returned 1 [0052.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758780 [0052.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.587] GetLastError () returned 0x0 [0052.587] GetLastError () returned 0x0 [0052.587] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.587] GetLastError () returned 0x0 [0052.587] GetLastError () returned 0x0 [0052.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff70f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.589] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8f0c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x8f0c, lpOverlapped=0x0) returned 1 [0052.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.589] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.590] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.590] CloseHandle (hObject=0x118) returned 1 [0052.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.591] GetLastError () returned 0x0 [0052.592] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.593] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.593] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.593] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17259429945) returned 1 [0052.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae2966b0, dwHighDateTime=0x1d585b4)) [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337eb0 [0052.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337eb0 | out: hHeap=0x260000) returned 1 [0052.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758818 [0052.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.594] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.594] GetLastError () returned 0x0 [0052.594] GetLastError () returned 0x0 [0052.594] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.594] GetLastError () returned 0x0 [0052.594] GetLastError () returned 0x0 [0052.596] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff87b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.596] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x7850, lpOverlapped=0x0) returned 1 [0052.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.596] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.596] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.597] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.597] CloseHandle (hObject=0x118) returned 1 [0052.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.598] GetLastError () returned 0x0 [0052.598] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.599] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.599] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17260051952) returned 1 [0052.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae2966b0, dwHighDateTime=0x1d585b4)) [0052.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e78 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e78 | out: hHeap=0x260000) returned 1 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27588b0 [0052.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.600] GetLastError () returned 0x0 [0052.600] GetLastError () returned 0x0 [0052.600] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.600] GetLastError () returned 0x0 [0052.601] GetLastError () returned 0x0 [0052.602] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff69a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.602] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x9658, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x9658, lpOverlapped=0x0) returned 1 [0052.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.603] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.603] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.603] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.678] CloseHandle (hObject=0x118) returned 1 [0052.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.772] GetLastError () returned 0x0 [0052.772] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.773] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.773] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.773] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17277448790) returned 1 [0052.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae4395d0, dwHighDateTime=0x1d585b4)) [0052.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5320 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758948 [0052.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.774] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.774] GetLastError () returned 0x0 [0052.774] GetLastError () returned 0x0 [0052.774] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.774] GetLastError () returned 0x0 [0052.775] GetLastError () returned 0x0 [0052.778] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffae56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.778] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x51aa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x51aa, lpOverlapped=0x0) returned 1 [0052.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.779] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.779] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.780] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.780] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.780] CloseHandle (hObject=0x118) returned 1 [0052.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.784] GetLastError () returned 0x0 [0052.784] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.785] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.785] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.785] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17278601021) returned 1 [0052.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae45f730, dwHighDateTime=0x1d585b4)) [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f52e8 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f52e8 | out: hHeap=0x260000) returned 1 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759360 [0052.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.786] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.786] GetLastError () returned 0x0 [0052.786] GetLastError () returned 0x0 [0052.786] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.786] GetLastError () returned 0x0 [0052.786] GetLastError () returned 0x0 [0052.788] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc778, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.788] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3888, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x3888, lpOverlapped=0x0) returned 1 [0052.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.788] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.789] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.789] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.789] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.789] CloseHandle (hObject=0x118) returned 1 [0052.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.790] GetLastError () returned 0x0 [0052.791] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.792] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.792] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.792] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17279288025) returned 1 [0052.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae485890, dwHighDateTime=0x1d585b4)) [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f52b0 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f52b0 | out: hHeap=0x260000) returned 1 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27593f8 [0052.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.793] GetLastError () returned 0x0 [0052.793] GetLastError () returned 0x0 [0052.793] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.793] GetLastError () returned 0x0 [0052.793] GetLastError () returned 0x0 [0052.794] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.794] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1ae8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x1ae8, lpOverlapped=0x0) returned 1 [0052.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.795] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.795] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.795] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.795] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.796] CloseHandle (hObject=0x118) returned 1 [0052.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.797] GetLastError () returned 0x0 [0052.797] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.798] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.798] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.798] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17279927804) returned 1 [0052.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae485890, dwHighDateTime=0x1d585b4)) [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5278 [0052.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5278 | out: hHeap=0x260000) returned 1 [0052.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759490 [0052.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.799] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.799] GetLastError () returned 0x0 [0052.799] GetLastError () returned 0x0 [0052.799] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.799] GetLastError () returned 0x0 [0052.799] GetLastError () returned 0x0 [0052.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe2e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.801] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1d18, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x1d18, lpOverlapped=0x0) returned 1 [0052.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.801] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.802] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.802] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.802] CloseHandle (hObject=0x118) returned 1 [0052.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.803] GetLastError () returned 0x0 [0052.929] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.929] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.929] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.930] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17293078420) returned 1 [0052.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae5b6390, dwHighDateTime=0x1d585b4)) [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb58 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb58 | out: hHeap=0x260000) returned 1 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759e10 [0052.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.930] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.930] GetLastError () returned 0x0 [0052.931] GetLastError () returned 0x0 [0052.931] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.931] GetLastError () returned 0x0 [0052.931] GetLastError () returned 0x0 [0052.933] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe48c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.933] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1b74, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x1b74, lpOverlapped=0x0) returned 1 [0052.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.934] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.934] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.934] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.934] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.935] CloseHandle (hObject=0x118) returned 1 [0052.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.935] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.936] GetLastError () returned 0x0 [0052.937] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.937] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.937] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.938] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17293875430) returned 1 [0052.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae5dc4f0, dwHighDateTime=0x1d585b4)) [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb90 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb90 | out: hHeap=0x260000) returned 1 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27595c0 [0052.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.938] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.938] GetLastError () returned 0x0 [0052.939] GetLastError () returned 0x0 [0052.939] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.939] GetLastError () returned 0x0 [0052.939] GetLastError () returned 0x0 [0052.940] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff75f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.940] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x8a0c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x8a0c, lpOverlapped=0x0) returned 1 [0052.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.941] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.941] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.941] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.942] CloseHandle (hObject=0x118) returned 1 [0052.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0052.943] GetLastError () returned 0x0 [0052.943] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0052.944] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.944] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0052.944] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17294519115) returned 1 [0052.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae5dc4f0, dwHighDateTime=0x1d585b4)) [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d178 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d178 | out: hHeap=0x260000) returned 1 [0052.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3268a0 [0052.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0052.945] GetLastError () returned 0x0 [0052.945] GetLastError () returned 0x0 [0052.945] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0052.945] GetLastError () returned 0x0 [0052.945] GetLastError () returned 0x0 [0052.965] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff8292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.965] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x7d6e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x7d6e, lpOverlapped=0x0) returned 1 [0052.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.966] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.966] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.966] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.966] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.967] CloseHandle (hObject=0x118) returned 1 [0052.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.[deadmin@cock.li].deadmin")) returned 1 [0053.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.019] GetLastError () returned 0x0 [0053.122] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.123] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.123] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17312430646) returned 1 [0053.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae7a5570, dwHighDateTime=0x1d585b4)) [0053.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f53c8 [0053.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f53c8 | out: hHeap=0x260000) returned 1 [0053.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a3f0 [0053.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.124] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.124] GetLastError () returned 0x0 [0053.124] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.124] GetLastError () returned 0x0 [0053.127] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff902e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.128] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6fd2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x6fd2, lpOverlapped=0x0) returned 1 [0053.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.129] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.129] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.129] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.130] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.130] CloseHandle (hObject=0xf8) returned 1 [0053.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.132] GetLastError () returned 0x0 [0053.132] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.133] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.133] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.133] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17313436164) returned 1 [0053.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae7a5570, dwHighDateTime=0x1d585b4)) [0053.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ced8 [0053.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0053.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a488 [0053.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.135] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.135] GetLastError () returned 0x0 [0053.135] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.135] GetLastError () returned 0x0 [0053.195] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff665e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.196] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x99a2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x99a2, lpOverlapped=0x0) returned 1 [0053.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.198] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.198] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.198] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.199] CloseHandle (hObject=0xf8) returned 1 [0053.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.217] GetLastError () returned 0x0 [0053.217] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756858) returned 1 [0053.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.218] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.219] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17321972133) returned 1 [0053.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae889db0, dwHighDateTime=0x1d585b4)) [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a948 [0053.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.220] GetLastError () returned 0x0 [0053.220] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.220] GetLastError () returned 0x0 [0053.239] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff7472, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.239] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x8b8e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x8b8e, lpOverlapped=0x0) returned 1 [0053.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.239] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.239] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.240] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.240] CloseHandle (hObject=0xf8) returned 1 [0053.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.251] GetLastError () returned 0x0 [0053.293] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.293] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.293] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.293] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17329457387) returned 1 [0053.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae948490, dwHighDateTime=0x1d585b4)) [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00e0 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00e0 | out: hHeap=0x260000) returned 1 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ad70 [0053.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.294] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.294] GetLastError () returned 0x0 [0053.294] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.294] GetLastError () returned 0x0 [0053.308] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffde26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.308] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x21da, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x21da, lpOverlapped=0x0) returned 1 [0053.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.309] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.309] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.309] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.309] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.309] CloseHandle (hObject=0x104) returned 1 [0053.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.320] GetLastError () returned 0x0 [0053.327] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.328] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.328] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.328] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17332914604) returned 1 [0053.328] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae994750, dwHighDateTime=0x1d585b4)) [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295540 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295540 | out: hHeap=0x260000) returned 1 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b230 [0053.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.329] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.329] GetLastError () returned 0x0 [0053.329] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.329] GetLastError () returned 0x0 [0053.333] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd790, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.333] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x2870, lpOverlapped=0x0) returned 1 [0053.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.334] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.334] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.335] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.335] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.335] CloseHandle (hObject=0x104) returned 1 [0053.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.350] GetLastError () returned 0x0 [0053.350] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.351] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.351] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17335193947) returned 1 [0053.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xae9ba8b0, dwHighDateTime=0x1d585b4)) [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2954d0 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b360 [0053.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.352] GetLastError () returned 0x0 [0053.352] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.352] GetLastError () returned 0x0 [0053.409] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdb80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.409] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x2480, lpOverlapped=0x0) returned 1 [0053.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.410] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.410] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.413] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.413] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.413] CloseHandle (hObject=0x104) returned 1 [0053.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.414] GetLastError () returned 0x0 [0053.415] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.416] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.416] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.416] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17341699460) returned 1 [0053.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaea78f90, dwHighDateTime=0x1d585b4)) [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8140 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8140 | out: hHeap=0x260000) returned 1 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0053.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.417] GetLastError () returned 0x0 [0053.418] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.418] GetLastError () returned 0x0 [0053.432] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe434, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.432] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1bcc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1bcc, lpOverlapped=0x0) returned 1 [0053.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.432] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.433] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.433] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.433] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.433] CloseHandle (hObject=0x104) returned 1 [0053.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.438] GetLastError () returned 0x0 [0053.438] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.439] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.439] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.439] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17344002679) returned 1 [0053.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaea9f0f0, dwHighDateTime=0x1d585b4)) [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c060 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c060 | out: hHeap=0x260000) returned 1 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b6f0 [0053.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.439] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.440] GetLastError () returned 0x0 [0053.440] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.440] GetLastError () returned 0x0 [0053.478] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdde4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.478] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x221c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x221c, lpOverlapped=0x0) returned 1 [0053.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.480] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.480] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.493] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.493] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.502] CloseHandle (hObject=0x10c) returned 1 [0053.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.503] GetLastError () returned 0x0 [0053.503] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.504] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.504] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.505] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17350570345) returned 1 [0053.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaeb37670, dwHighDateTime=0x1d585b4)) [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f55c0 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f55c0 | out: hHeap=0x260000) returned 1 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b820 [0053.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.505] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.506] GetLastError () returned 0x0 [0053.506] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.506] GetLastError () returned 0x0 [0053.527] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.527] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xd90, lpOverlapped=0x0) returned 1 [0053.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.527] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.528] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.528] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.528] CloseHandle (hObject=0x10c) returned 1 [0053.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.529] GetLastError () returned 0x0 [0053.529] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.530] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.530] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.530] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17353290673) returned 1 [0053.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaeb83930, dwHighDateTime=0x1d585b4)) [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f54e0 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f54e0 | out: hHeap=0x260000) returned 1 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275bbb0 [0053.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.532] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.533] GetLastError () returned 0x0 [0053.533] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.533] GetLastError () returned 0x0 [0053.535] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.535] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x16c0, lpOverlapped=0x0) returned 1 [0053.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.535] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.535] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.535] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.536] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.536] CloseHandle (hObject=0x10c) returned 1 [0053.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.537] GetLastError () returned 0x0 [0053.537] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.538] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.538] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17353914782) returned 1 [0053.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaeb83930, dwHighDateTime=0x1d585b4)) [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f54a8 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f54a8 | out: hHeap=0x260000) returned 1 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275be10 [0053.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.539] GetLastError () returned 0x0 [0053.539] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.539] GetLastError () returned 0x0 [0053.572] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc4a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.572] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3b5c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x3b5c, lpOverlapped=0x0) returned 1 [0053.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.573] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.573] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.573] CloseHandle (hObject=0x10c) returned 1 [0053.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.574] GetLastError () returned 0x0 [0053.575] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.575] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.575] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.575] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17357655593) returned 1 [0053.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaebf5d50, dwHighDateTime=0x1d585b4)) [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c258 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c258 | out: hHeap=0x260000) returned 1 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2120 [0053.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.576] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.576] GetLastError () returned 0x0 [0053.576] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.576] GetLastError () returned 0x0 [0053.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffee4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.618] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x11b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x11b6, lpOverlapped=0x0) returned 1 [0053.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.618] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.619] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.619] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.619] CloseHandle (hObject=0x10c) returned 1 [0053.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.639] GetLastError () returned 0x0 [0053.640] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.641] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.641] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17364181179) returned 1 [0053.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaec8e2d0, dwHighDateTime=0x1d585b4)) [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c3a8 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c3a8 | out: hHeap=0x260000) returned 1 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f22e8 [0053.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.641] GetLastError () returned 0x0 [0053.642] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.642] GetLastError () returned 0x0 [0053.660] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff444, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.660] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xbbc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xbbc, lpOverlapped=0x0) returned 1 [0053.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.660] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.660] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.660] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.661] CloseHandle (hObject=0x10c) returned 1 [0053.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.663] GetLastError () returned 0x0 [0053.663] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.664] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.664] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.664] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17366493507) returned 1 [0053.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaecb4430, dwHighDateTime=0x1d585b4)) [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c450 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c450 | out: hHeap=0x260000) returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0053.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.665] GetLastError () returned 0x0 [0053.665] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.665] GetLastError () returned 0x0 [0053.666] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff10e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.666] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xef2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xef2, lpOverlapped=0x0) returned 1 [0053.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.667] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.667] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.667] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.667] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.667] CloseHandle (hObject=0x10c) returned 1 [0053.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.669] GetLastError () returned 0x0 [0053.669] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.669] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.670] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17367079269) returned 1 [0053.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaecda590, dwHighDateTime=0x1d585b4)) [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c488 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c488 | out: hHeap=0x260000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2840 [0053.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.670] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.670] GetLastError () returned 0x0 [0053.670] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.671] GetLastError () returned 0x0 [0053.672] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffca7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.672] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x3586, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x3586, lpOverlapped=0x0) returned 1 [0053.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.673] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.673] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.673] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.673] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.674] CloseHandle (hObject=0x10c) returned 1 [0053.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.675] GetLastError () returned 0x0 [0053.675] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.676] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.676] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17367696656) returned 1 [0053.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaecda590, dwHighDateTime=0x1d585b4)) [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c4c0 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c4c0 | out: hHeap=0x260000) returned 1 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f28d8 [0053.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.676] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.677] GetLastError () returned 0x0 [0053.677] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.677] GetLastError () returned 0x0 [0053.753] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe500, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.753] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x1b00, lpOverlapped=0x0) returned 1 [0053.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.754] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.754] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.755] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.755] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.755] CloseHandle (hObject=0x10c) returned 1 [0053.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.801] GetLastError () returned 0x0 [0053.810] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.844] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.844] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.844] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17384553573) returned 1 [0053.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaee7d4b0, dwHighDateTime=0x1d585b4)) [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c6f0 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c6f0 | out: hHeap=0x260000) returned 1 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2f60 [0053.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.845] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.845] GetLastError () returned 0x0 [0053.845] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.845] GetLastError () returned 0x0 [0053.849] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff99dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.849] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x6624, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x6624, lpOverlapped=0x0) returned 1 [0053.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.851] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.851] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.852] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.852] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.852] CloseHandle (hObject=0x110) returned 1 [0053.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.853] GetLastError () returned 0x0 [0053.854] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.854] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.854] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.854] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17385560980) returned 1 [0053.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaeea3610, dwHighDateTime=0x1d585b4)) [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5748 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5748 | out: hHeap=0x260000) returned 1 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2d98 [0053.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.855] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.855] GetLastError () returned 0x0 [0053.855] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.855] GetLastError () returned 0x0 [0053.860] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff5962, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.860] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xa69e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0xa69e, lpOverlapped=0x0) returned 1 [0053.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.861] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.861] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.861] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.861] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.861] CloseHandle (hObject=0x110) returned 1 [0053.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.861] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.862] GetLastError () returned 0x0 [0053.863] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.863] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.863] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.864] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17386467600) returned 1 [0053.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaeea3610, dwHighDateTime=0x1d585b4)) [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5710 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5710 | out: hHeap=0x260000) returned 1 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3090 [0053.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.864] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.864] GetLastError () returned 0x0 [0053.864] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.864] GetLastError () returned 0x0 [0053.866] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff9064, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.866] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x6f9c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x6f9c, lpOverlapped=0x0) returned 1 [0053.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.867] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.867] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.867] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.868] CloseHandle (hObject=0x110) returned 1 [0053.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.869] GetLastError () returned 0x0 [0053.870] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.870] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.870] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.870] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17387163810) returned 1 [0053.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaeec9770, dwHighDateTime=0x1d585b4)) [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f56d8 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f56d8 | out: hHeap=0x260000) returned 1 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3128 [0053.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.871] GetLastError () returned 0x0 [0053.871] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.871] GetLastError () returned 0x0 [0053.873] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff6294, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.873] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x9d6c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x9d6c, lpOverlapped=0x0) returned 1 [0053.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.874] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.874] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.874] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.874] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.874] CloseHandle (hObject=0x110) returned 1 [0053.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.910] GetLastError () returned 0x0 [0053.910] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.932] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.932] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.933] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17393378632) returned 1 [0053.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaef61cf0, dwHighDateTime=0x1d585b4)) [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c808 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c808 | out: hHeap=0x260000) returned 1 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3680 [0053.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.933] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.933] GetLastError () returned 0x0 [0053.933] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.934] GetLastError () returned 0x0 [0053.935] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff3c82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.935] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xc37e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0xc37e, lpOverlapped=0x0) returned 1 [0053.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.936] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.936] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.936] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.936] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.936] CloseHandle (hObject=0x118) returned 1 [0053.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.937] GetLastError () returned 0x0 [0053.938] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.938] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.938] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.939] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17393975855) returned 1 [0053.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaef61cf0, dwHighDateTime=0x1d585b4)) [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c8b0 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c8b0 | out: hHeap=0x260000) returned 1 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3550 [0053.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.939] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.939] GetLastError () returned 0x0 [0053.939] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.939] GetLastError () returned 0x0 [0053.941] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffca44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.941] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x35bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x35bc, lpOverlapped=0x0) returned 1 [0053.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.942] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.942] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.942] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.942] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.942] CloseHandle (hObject=0x118) returned 1 [0053.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.943] GetLastError () returned 0x0 [0053.944] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.944] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.944] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.945] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17394575921) returned 1 [0053.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaef61cf0, dwHighDateTime=0x1d585b4)) [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c8e8 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c8e8 | out: hHeap=0x260000) returned 1 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f37b0 [0053.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.946] GetLastError () returned 0x0 [0053.946] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.946] GetLastError () returned 0x0 [0053.948] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd5e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.948] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2a18, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x2a18, lpOverlapped=0x0) returned 1 [0053.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.948] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.948] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.948] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.949] CloseHandle (hObject=0x118) returned 1 [0053.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.950] GetLastError () returned 0x0 [0053.950] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.951] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.951] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.951] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17395212862) returned 1 [0053.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaef87e50, dwHighDateTime=0x1d585b4)) [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c920 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c920 | out: hHeap=0x260000) returned 1 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3848 [0053.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.952] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.952] GetLastError () returned 0x0 [0053.952] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.952] GetLastError () returned 0x0 [0053.953] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffeb7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.953] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1484, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1484, lpOverlapped=0x0) returned 1 [0053.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.954] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.954] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.954] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.954] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.955] CloseHandle (hObject=0x118) returned 1 [0053.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.956] GetLastError () returned 0x0 [0053.956] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.957] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.957] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17395784089) returned 1 [0053.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaef87e50, dwHighDateTime=0x1d585b4)) [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c958 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c958 | out: hHeap=0x260000) returned 1 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0053.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.957] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.957] GetLastError () returned 0x0 [0053.957] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.958] GetLastError () returned 0x0 [0053.959] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd84c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.959] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x27b4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x27b4, lpOverlapped=0x0) returned 1 [0053.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.960] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.960] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.960] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.960] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.960] CloseHandle (hObject=0x118) returned 1 [0053.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.962] GetLastError () returned 0x0 [0053.962] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0053.962] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.962] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.963] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17396375032) returned 1 [0053.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaefadfb0, dwHighDateTime=0x1d585b4)) [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c990 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c990 | out: hHeap=0x260000) returned 1 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0053.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.963] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0053.963] GetLastError () returned 0x0 [0053.963] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0053.963] GetLastError () returned 0x0 [0053.965] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffcfd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.965] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x302c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x302c, lpOverlapped=0x0) returned 1 [0053.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.966] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.966] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.966] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.966] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.967] CloseHandle (hObject=0x118) returned 1 [0053.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.017] GetLastError () returned 0x0 [0054.024] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.042] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.042] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17404328761) returned 1 [0054.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf06c690, dwHighDateTime=0x1d585b4)) [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cbf8 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cbf8 | out: hHeap=0x260000) returned 1 [0054.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d0f8 [0054.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.043] GetLastError () returned 0x0 [0054.043] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.043] GetLastError () returned 0x0 [0054.046] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffac68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.047] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5398, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x5398, lpOverlapped=0x0) returned 1 [0054.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.047] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.047] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.047] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.047] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.048] CloseHandle (hObject=0x118) returned 1 [0054.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.049] GetLastError () returned 0x0 [0054.049] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.050] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.050] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17405125512) returned 1 [0054.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf06c690, dwHighDateTime=0x1d585b4)) [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cca0 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cca0 | out: hHeap=0x260000) returned 1 [0054.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d0f8 [0054.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.051] GetLastError () returned 0x0 [0054.051] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.051] GetLastError () returned 0x0 [0054.056] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff918c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.056] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6e74, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x6e74, lpOverlapped=0x0) returned 1 [0054.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.057] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.057] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.057] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.057] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.058] CloseHandle (hObject=0x118) returned 1 [0054.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.059] GetLastError () returned 0x0 [0054.060] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.060] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.060] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.061] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17406165090) returned 1 [0054.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf0927f0, dwHighDateTime=0x1d585b4)) [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ccd8 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ccd8 | out: hHeap=0x260000) returned 1 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d228 [0054.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.061] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.061] GetLastError () returned 0x0 [0054.061] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.061] GetLastError () returned 0x0 [0054.063] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe7f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.063] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x180e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x180e, lpOverlapped=0x0) returned 1 [0054.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.063] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.064] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.064] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.064] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.064] CloseHandle (hObject=0x118) returned 1 [0054.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.065] GetLastError () returned 0x0 [0054.065] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.066] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.066] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17406750462) returned 1 [0054.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf0927f0, dwHighDateTime=0x1d585b4)) [0054.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cd10 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd10 | out: hHeap=0x260000) returned 1 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d2c0 [0054.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.067] GetLastError () returned 0x0 [0054.067] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.067] GetLastError () returned 0x0 [0054.069] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffda34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.069] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x25cc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x25cc, lpOverlapped=0x0) returned 1 [0054.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.069] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.070] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.070] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.070] CloseHandle (hObject=0x118) returned 1 [0054.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.071] GetLastError () returned 0x0 [0054.072] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.072] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.072] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.073] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17407376626) returned 1 [0054.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf0b8950, dwHighDateTime=0x1d585b4)) [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f57f0 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f57f0 | out: hHeap=0x260000) returned 1 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2967c0 [0054.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.073] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.073] GetLastError () returned 0x0 [0054.073] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.074] GetLastError () returned 0x0 [0054.171] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe666, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.171] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x199a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x199a, lpOverlapped=0x0) returned 1 [0054.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.185] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.185] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.186] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.186] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.186] CloseHandle (hObject=0x118) returned 1 [0054.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.187] GetLastError () returned 0x0 [0054.188] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.188] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.188] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.189] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17418967450) returned 1 [0054.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf1c32f0, dwHighDateTime=0x1d585b4)) [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27610d0 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27610d0 | out: hHeap=0x260000) returned 1 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dc40 [0054.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.189] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.189] GetLastError () returned 0x0 [0054.189] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.189] GetLastError () returned 0x0 [0054.191] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe0ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.191] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1f46, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1f46, lpOverlapped=0x0) returned 1 [0054.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.191] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.192] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.192] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.192] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.192] CloseHandle (hObject=0x118) returned 1 [0054.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.193] GetLastError () returned 0x0 [0054.194] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.195] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.195] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.195] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17419644829) returned 1 [0054.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf1e9450, dwHighDateTime=0x1d585b4)) [0054.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761108 [0054.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761108 | out: hHeap=0x260000) returned 1 [0054.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dd70 [0054.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.196] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.196] GetLastError () returned 0x0 [0054.196] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.196] GetLastError () returned 0x0 [0054.198] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdb1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.198] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x24e2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x24e2, lpOverlapped=0x0) returned 1 [0054.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.198] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.198] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.199] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.199] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.199] CloseHandle (hObject=0x118) returned 1 [0054.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.200] GetLastError () returned 0x0 [0054.201] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.202] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.202] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17420297268) returned 1 [0054.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf1e9450, dwHighDateTime=0x1d585b4)) [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761140 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761140 | out: hHeap=0x260000) returned 1 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275de08 [0054.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.202] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.203] GetLastError () returned 0x0 [0054.203] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.203] GetLastError () returned 0x0 [0054.205] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff64c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.205] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9b3a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x9b3a, lpOverlapped=0x0) returned 1 [0054.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.205] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.205] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.206] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.206] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.206] CloseHandle (hObject=0x118) returned 1 [0054.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.207] GetLastError () returned 0x0 [0054.207] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.208] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.208] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.208] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17420931052) returned 1 [0054.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf1e9450, dwHighDateTime=0x1d585b4)) [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761178 [0054.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761178 | out: hHeap=0x260000) returned 1 [0054.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dea0 [0054.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.209] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.209] GetLastError () returned 0x0 [0054.209] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.209] GetLastError () returned 0x0 [0054.211] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffeb7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.211] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1484, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1484, lpOverlapped=0x0) returned 1 [0054.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.211] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.211] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.212] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.212] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.212] CloseHandle (hObject=0x118) returned 1 [0054.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.213] GetLastError () returned 0x0 [0054.214] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.214] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.214] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.214] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17421562199) returned 1 [0054.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf20f5b0, dwHighDateTime=0x1d585b4)) [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27611b0 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27611b0 | out: hHeap=0x260000) returned 1 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275df38 [0054.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.215] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.215] GetLastError () returned 0x0 [0054.215] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.215] GetLastError () returned 0x0 [0054.217] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff266, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.217] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xd9a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0xd9a, lpOverlapped=0x0) returned 1 [0054.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.217] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.217] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.218] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.218] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.218] CloseHandle (hObject=0x118) returned 1 [0054.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.218] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.219] GetLastError () returned 0x0 [0054.220] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.220] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.220] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.221] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17422167911) returned 1 [0054.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf20f5b0, dwHighDateTime=0x1d585b4)) [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27611e8 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27611e8 | out: hHeap=0x260000) returned 1 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dfd0 [0054.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.221] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.221] GetLastError () returned 0x0 [0054.221] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.221] GetLastError () returned 0x0 [0054.329] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.329] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1ca8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x224fdb0*=0x1ca8, lpOverlapped=0x0) returned 1 [0054.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.341] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.341] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.349] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.353] CloseHandle (hObject=0x118) returned 1 [0054.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.477] GetLastError () returned 0x0 [0054.478] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.479] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.479] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.479] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17447988074) returned 1 [0054.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf496d10, dwHighDateTime=0x1d585b4)) [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27614c0 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27614c0 | out: hHeap=0x260000) returned 1 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e068 [0054.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.479] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.480] GetLastError () returned 0x0 [0054.480] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.480] GetLastError () returned 0x0 [0054.483] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff68a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.484] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x975e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x975e, lpOverlapped=0x0) returned 1 [0054.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.484] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.484] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.485] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.485] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.485] CloseHandle (hObject=0x10c) returned 1 [0054.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0054.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0054.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.486] GetLastError () returned 0x0 [0054.486] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.487] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.487] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17448837225) returned 1 [0054.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf496d10, dwHighDateTime=0x1d585b4)) [0054.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27614f8 [0054.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27614f8 | out: hHeap=0x260000) returned 1 [0054.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e8b8 [0054.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.488] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.488] GetLastError () returned 0x0 [0054.488] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.488] GetLastError () returned 0x0 [0054.490] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff313a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.491] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xcec6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xcec6, lpOverlapped=0x0) returned 1 [0054.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.491] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.491] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.492] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.492] CloseHandle (hObject=0x10c) returned 1 [0054.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0054.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0054.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.493] GetLastError () returned 0x0 [0054.493] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.494] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.494] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.494] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17449536116) returned 1 [0054.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf4bce70, dwHighDateTime=0x1d585b4)) [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761530 [0054.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761530 | out: hHeap=0x260000) returned 1 [0054.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e950 [0054.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.495] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.495] GetLastError () returned 0x0 [0054.495] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.495] GetLastError () returned 0x0 [0054.497] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb4c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.497] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x4b40, lpOverlapped=0x0) returned 1 [0054.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.497] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.497] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.498] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.498] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.498] CloseHandle (hObject=0x10c) returned 1 [0054.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.499] GetLastError () returned 0x0 [0054.500] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.500] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.501] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17450172043) returned 1 [0054.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf4bce70, dwHighDateTime=0x1d585b4)) [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761568 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761568 | out: hHeap=0x260000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e9e8 [0054.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.501] GetLastError () returned 0x0 [0054.501] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.501] GetLastError () returned 0x0 [0054.503] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff7f2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.503] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x80d4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x80d4, lpOverlapped=0x0) returned 1 [0054.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.504] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.504] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.504] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.505] CloseHandle (hObject=0x10c) returned 1 [0054.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.506] GetLastError () returned 0x0 [0054.506] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.507] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.507] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17450973180) returned 1 [0054.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf4e2fd0, dwHighDateTime=0x1d585b4)) [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27615d8 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0054.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27615d8 | out: hHeap=0x260000) returned 1 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ea80 [0054.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.509] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.510] GetLastError () returned 0x0 [0054.510] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.510] GetLastError () returned 0x0 [0054.512] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffa900, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.512] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x5700, lpOverlapped=0x0) returned 1 [0054.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.512] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.512] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.513] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.513] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.513] CloseHandle (hObject=0x10c) returned 1 [0054.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.513] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.514] GetLastError () returned 0x0 [0054.514] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.515] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.515] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17451639395) returned 1 [0054.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf4e2fd0, dwHighDateTime=0x1d585b4)) [0054.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761610 [0054.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0054.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761610 | out: hHeap=0x260000) returned 1 [0054.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0054.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ebb0 [0054.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.516] GetLastError () returned 0x0 [0054.516] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.516] GetLastError () returned 0x0 [0054.617] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9f3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.617] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x60c2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x60c2, lpOverlapped=0x0) returned 1 [0054.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.618] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.619] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.619] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.619] CloseHandle (hObject=0x10c) returned 1 [0054.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.790] GetLastError () returned 0x0 [0054.790] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.791] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.791] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.791] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17479199435) returned 1 [0054.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf790890, dwHighDateTime=0x1d585b4)) [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761b88 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761b88 | out: hHeap=0x260000) returned 1 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ec48 [0054.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.791] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.792] GetLastError () returned 0x0 [0054.792] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.792] GetLastError () returned 0x0 [0054.795] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff54e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.795] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xab2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0xab2, lpOverlapped=0x0) returned 1 [0054.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.795] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.795] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.796] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.796] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.796] CloseHandle (hObject=0x10c) returned 1 [0054.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.797] GetLastError () returned 0x0 [0054.798] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0054.798] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.798] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.799] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17479965839) returned 1 [0054.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf790890, dwHighDateTime=0x1d585b4)) [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761bc0 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761bc0 | out: hHeap=0x260000) returned 1 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fd80 [0054.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.799] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.799] GetLastError () returned 0x0 [0054.799] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.799] GetLastError () returned 0x0 [0054.810] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff7d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.810] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x82a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x82a, lpOverlapped=0x0) returned 1 [0054.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.812] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.812] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.813] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.813] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.813] CloseHandle (hObject=0x10c) returned 1 [0054.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.852] GetLastError () returned 0x0 [0054.860] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2718) returned 1 [0054.866] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.866] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.866] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17486720467) returned 1 [0054.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf84ef70, dwHighDateTime=0x1d585b4)) [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761d10 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761d10 | out: hHeap=0x260000) returned 1 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d17f8 [0054.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760078 [0054.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d17f8 | out: hHeap=0x260000) returned 1 [0054.867] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.867] GetLastError () returned 0x0 [0054.867] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.867] GetLastError () returned 0x0 [0054.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffeeff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.869] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1100c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x1100c, lpOverlapped=0x0) returned 1 [0054.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.870] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.870] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.870] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.870] CloseHandle (hObject=0xf0) returned 1 [0054.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0054.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0054.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.871] GetLastError () returned 0x0 [0054.872] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2718) returned 1 [0054.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.873] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.873] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17487380668) returned 1 [0054.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf84ef70, dwHighDateTime=0x1d585b4)) [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761d48 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761d48 | out: hHeap=0x260000) returned 1 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d17f8 [0054.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760110 [0054.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d17f8 | out: hHeap=0x260000) returned 1 [0054.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.873] GetLastError () returned 0x0 [0054.874] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.874] GetLastError () returned 0x0 [0054.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff0aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.875] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xf56, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xf56, lpOverlapped=0x0) returned 1 [0054.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.876] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.876] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.876] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.877] CloseHandle (hObject=0xf0) returned 1 [0054.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0054.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0054.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.878] GetLastError () returned 0x0 [0054.878] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2718) returned 1 [0054.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.879] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0054.879] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17487993147) returned 1 [0054.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaf84ef70, dwHighDateTime=0x1d585b4)) [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761d80 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761d80 | out: hHeap=0x260000) returned 1 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d17f8 [0054.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760240 [0054.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d17f8 | out: hHeap=0x260000) returned 1 [0054.879] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0054.880] GetLastError () returned 0x0 [0054.880] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0054.880] GetLastError () returned 0x0 [0054.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff096, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.889] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xf6a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xf6a, lpOverlapped=0x0) returned 1 [0054.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.889] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.890] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.890] CloseHandle (hObject=0xf0) returned 1 [0054.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0054.966] GetLastError () returned 0x0 [0055.234] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.254] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.254] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17525497409) returned 1 [0055.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xafbe1070, dwHighDateTime=0x1d585b4)) [0055.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27620d0 [0055.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27620d0 | out: hHeap=0x260000) returned 1 [0055.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27643f0 [0055.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.267] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.267] GetLastError () returned 0x0 [0055.267] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.267] GetLastError () returned 0x0 [0055.270] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc900, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.271] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x3700, lpOverlapped=0x0) returned 1 [0055.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.271] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.271] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.272] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.272] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.272] CloseHandle (hObject=0x104) returned 1 [0055.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.272] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.273] GetLastError () returned 0x0 [0055.273] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.274] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.274] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.274] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17527544235) returned 1 [0055.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xafc2d330, dwHighDateTime=0x1d585b4)) [0055.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762178 [0055.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762178 | out: hHeap=0x260000) returned 1 [0055.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27643f0 [0055.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.275] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.275] GetLastError () returned 0x0 [0055.275] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.275] GetLastError () returned 0x0 [0055.277] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff2944, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.278] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xd6bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0xd6bc, lpOverlapped=0x0) returned 1 [0055.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.278] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.278] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.279] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.279] CloseHandle (hObject=0x104) returned 1 [0055.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.280] GetLastError () returned 0x0 [0055.290] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.316] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.316] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.316] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17531692941) returned 1 [0055.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xafc795f0, dwHighDateTime=0x1d585b4)) [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762220 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762220 | out: hHeap=0x260000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27648b0 [0055.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.317] GetLastError () returned 0x0 [0055.317] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.317] GetLastError () returned 0x0 [0055.320] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff765c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.320] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x89a4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x89a4, lpOverlapped=0x0) returned 1 [0055.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.321] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.321] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.321] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.322] CloseHandle (hObject=0x104) returned 1 [0055.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.323] GetLastError () returned 0x0 [0055.323] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2c68) returned 1 [0055.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.324] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0055.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.324] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17532546305) returned 1 [0055.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xafc9f750, dwHighDateTime=0x1d585b4)) [0055.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762300 [0055.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762300 | out: hHeap=0x260000) returned 1 [0055.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764650 [0055.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.325] GetLastError () returned 0x0 [0055.325] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.325] GetLastError () returned 0x0 [0055.327] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff6176, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.327] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x9e8a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x9e8a, lpOverlapped=0x0) returned 1 [0055.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.328] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.328] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.328] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.328] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.328] CloseHandle (hObject=0x104) returned 1 [0055.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.330] GetLastError () returned 0x0 [0055.330] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2c68) returned 1 [0055.331] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.331] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0055.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.331] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17533187964) returned 1 [0055.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xafc9f750, dwHighDateTime=0x1d585b4)) [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762338 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762338 | out: hHeap=0x260000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27649e0 [0055.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.332] GetLastError () returned 0x0 [0055.332] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.332] GetLastError () returned 0x0 [0055.333] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffda70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.333] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x224fdb0*=0x2590, lpOverlapped=0x0) returned 1 [0055.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.334] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.334] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.334] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.334] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.335] CloseHandle (hObject=0x104) returned 1 [0055.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.336] GetLastError () returned 0x0 [0055.553] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.561] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.567] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17556857628) returned 1 [0055.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaff00d50, dwHighDateTime=0x1d585b4)) [0055.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762648 [0055.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762648 | out: hHeap=0x260000) returned 1 [0055.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27652c8 [0055.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.580] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.581] GetLastError () returned 0x0 [0055.581] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.581] GetLastError () returned 0x0 [0055.584] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdf1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.584] WriteFile (in: hFile=0x118, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x20e4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x224fdb0*=0x20e4, lpOverlapped=0x0) returned 1 [0055.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0055.585] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.585] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.585] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.585] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.585] CloseHandle (hObject=0x118) returned 1 [0055.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.587] GetLastError () returned 0x0 [0055.587] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.588] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.588] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17558934401) returned 1 [0055.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaff26eb0, dwHighDateTime=0x1d585b4)) [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27626b8 [0055.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27626b8 | out: hHeap=0x260000) returned 1 [0055.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764b10 [0055.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.589] GetLastError () returned 0x0 [0055.589] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.589] GetLastError () returned 0x0 [0055.591] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffbdca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.591] WriteFile (in: hFile=0x118, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x4236, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x224fdb0*=0x4236, lpOverlapped=0x0) returned 1 [0055.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0055.592] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.592] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.592] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.593] CloseHandle (hObject=0x118) returned 1 [0055.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.594] GetLastError () returned 0x0 [0055.594] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.595] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.595] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.595] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17559600117) returned 1 [0055.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaff26eb0, dwHighDateTime=0x1d585b4)) [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27626f0 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27626f0 | out: hHeap=0x260000) returned 1 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0055.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.596] GetLastError () returned 0x0 [0055.596] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.596] GetLastError () returned 0x0 [0055.597] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc364, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.598] WriteFile (in: hFile=0x118, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x3c9c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x224fdb0*=0x3c9c, lpOverlapped=0x0) returned 1 [0055.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0055.598] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.598] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.599] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.599] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.599] CloseHandle (hObject=0x118) returned 1 [0055.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.600] GetLastError () returned 0x0 [0055.601] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.601] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.601] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.602] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17560311293) returned 1 [0055.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaff4d010, dwHighDateTime=0x1d585b4)) [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762760 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762760 | out: hHeap=0x260000) returned 1 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765490 [0055.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.603] GetLastError () returned 0x0 [0055.603] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.603] GetLastError () returned 0x0 [0055.605] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb6a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.605] WriteFile (in: hFile=0x118, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x224fdb0*=0x4960, lpOverlapped=0x0) returned 1 [0055.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0055.605] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.605] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.605] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.606] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.606] CloseHandle (hObject=0x118) returned 1 [0055.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.607] GetLastError () returned 0x0 [0055.608] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.609] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.609] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.609] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17560989746) returned 1 [0055.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaff4d010, dwHighDateTime=0x1d585b4)) [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1a18 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1a18 | out: hHeap=0x260000) returned 1 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27655c0 [0055.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.610] GetLastError () returned 0x0 [0055.610] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.610] GetLastError () returned 0x0 [0055.611] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffba7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.612] WriteFile (in: hFile=0x118, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x4584, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x224fdb0*=0x4584, lpOverlapped=0x0) returned 1 [0055.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0055.612] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.612] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.612] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.612] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.613] CloseHandle (hObject=0x118) returned 1 [0055.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.614] GetLastError () returned 0x0 [0055.614] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.615] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.615] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17561613741) returned 1 [0055.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xaff73170, dwHighDateTime=0x1d585b4)) [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f19e0 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f19e0 | out: hHeap=0x260000) returned 1 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0055.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.616] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.616] GetLastError () returned 0x0 [0055.616] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.616] GetLastError () returned 0x0 [0055.689] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd4f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.689] WriteFile (in: hFile=0x118, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x2b0e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x224fdb0*=0x2b0e, lpOverlapped=0x0) returned 1 [0055.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0055.689] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.689] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.690] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.690] CloseHandle (hObject=0x118) returned 1 [0055.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.755] GetLastError () returned 0x0 [0055.766] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.767] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.767] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17576817355) returned 1 [0055.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb00c9dd0, dwHighDateTime=0x1d585b4)) [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762a00 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762a00 | out: hHeap=0x260000) returned 1 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765fd8 [0055.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.768] GetLastError () returned 0x0 [0055.768] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.768] GetLastError () returned 0x0 [0055.771] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff6ee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.771] WriteFile (in: hFile=0xf0, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0x911a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0x911a, lpOverlapped=0x0) returned 1 [0055.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.772] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.772] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.772] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.772] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.773] CloseHandle (hObject=0xf0) returned 1 [0055.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.774] GetLastError () returned 0x0 [0055.774] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.775] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.775] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.775] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17577600200) returned 1 [0055.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb00eff30, dwHighDateTime=0x1d585b4)) [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762a38 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762a38 | out: hHeap=0x260000) returned 1 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766070 [0055.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.775] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.776] GetLastError () returned 0x0 [0055.776] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.776] GetLastError () returned 0x0 [0055.778] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff7e55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.778] WriteFile (in: hFile=0xf0, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0x81ab, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0x81ab, lpOverlapped=0x0) returned 1 [0055.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.780] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.781] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.781] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.781] CloseHandle (hObject=0xf0) returned 1 [0055.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.782] GetLastError () returned 0x0 [0055.782] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.783] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.783] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.783] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17578452690) returned 1 [0055.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb00eff30, dwHighDateTime=0x1d585b4)) [0055.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762a70 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762a70 | out: hHeap=0x260000) returned 1 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27661a0 [0055.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.784] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.784] GetLastError () returned 0x0 [0055.784] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.784] GetLastError () returned 0x0 [0055.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff462f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.787] WriteFile (in: hFile=0xf0, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0xb9d1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0xb9d1, lpOverlapped=0x0) returned 1 [0055.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.787] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.787] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.788] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.788] CloseHandle (hObject=0xf0) returned 1 [0055.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.789] GetLastError () returned 0x0 [0055.790] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.790] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.791] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17579165731) returned 1 [0055.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0116090, dwHighDateTime=0x1d585b4)) [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762ae0 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762ae0 | out: hHeap=0x260000) returned 1 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766238 [0055.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.791] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.791] GetLastError () returned 0x0 [0055.791] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.791] GetLastError () returned 0x0 [0055.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb4fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.794] WriteFile (in: hFile=0xf0, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0x4b02, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0x4b02, lpOverlapped=0x0) returned 1 [0055.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.794] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.794] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.794] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.795] CloseHandle (hObject=0xf0) returned 1 [0055.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.796] GetLastError () returned 0x0 [0055.796] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0055.797] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0055.797] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0055.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.797] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17579829706) returned 1 [0055.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0116090, dwHighDateTime=0x1d585b4)) [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762b18 [0055.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762b18 | out: hHeap=0x260000) returned 1 [0055.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766368 [0055.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.798] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.798] GetLastError () returned 0x0 [0055.798] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.798] GetLastError () returned 0x0 [0055.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbdc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.800] WriteFile (in: hFile=0xf0, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0x423a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0x423a, lpOverlapped=0x0) returned 1 [0055.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.800] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.801] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.801] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.801] CloseHandle (hObject=0xf0) returned 1 [0055.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.802] GetLastError () returned 0x0 [0055.803] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0055.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.804] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0055.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.804] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17580515364) returned 1 [0055.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb013c1f0, dwHighDateTime=0x1d585b4)) [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762ae0 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762ae0 | out: hHeap=0x260000) returned 1 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766400 [0055.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.805] GetLastError () returned 0x0 [0055.805] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.805] GetLastError () returned 0x0 [0055.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffbe80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.807] WriteFile (in: hFile=0x10c, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0x4180, lpOverlapped=0x0) returned 1 [0055.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.807] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.808] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.808] CloseHandle (hObject=0x10c) returned 1 [0055.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.809] GetLastError () returned 0x0 [0055.809] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.810] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.810] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.810] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17581153358) returned 1 [0055.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb013c1f0, dwHighDateTime=0x1d585b4)) [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762b88 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762b88 | out: hHeap=0x260000) returned 1 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766498 [0055.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.811] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.811] GetLastError () returned 0x0 [0055.811] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.811] GetLastError () returned 0x0 [0055.845] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd206, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.845] WriteFile (in: hFile=0x10c, lpBuffer=0x280b080*, nNumberOfBytesToWrite=0x2dfa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280b080*, lpNumberOfBytesWritten=0x224fdb0*=0x2dfa, lpOverlapped=0x0) returned 1 [0055.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b080 | out: hHeap=0x260000) returned 1 [0055.847] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.847] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.847] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.847] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.848] CloseHandle (hObject=0x10c) returned 1 [0055.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.915] GetLastError () returned 0x0 [0055.916] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.916] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.917] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.917] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17591782964) returned 1 [0055.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0246b90, dwHighDateTime=0x1d585b4)) [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bbd8 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bbd8 | out: hHeap=0x260000) returned 1 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766530 [0055.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.917] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.918] GetLastError () returned 0x0 [0055.918] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.918] GetLastError () returned 0x0 [0055.922] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff561e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.922] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xa9e2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0xa9e2, lpOverlapped=0x0) returned 1 [0055.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0055.923] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.923] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.924] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.924] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.924] CloseHandle (hObject=0x100) returned 1 [0055.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.925] GetLastError () returned 0x0 [0055.925] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.926] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.926] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.926] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17592741380) returned 1 [0055.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb026ccf0, dwHighDateTime=0x1d585b4)) [0055.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bba0 [0055.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bba0 | out: hHeap=0x260000) returned 1 [0055.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766bb8 [0055.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.927] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.927] GetLastError () returned 0x0 [0055.927] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.927] GetLastError () returned 0x0 [0055.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc11d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.929] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x3ee3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x3ee3, lpOverlapped=0x0) returned 1 [0055.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0055.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.929] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.930] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.930] CloseHandle (hObject=0x100) returned 1 [0055.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.931] GetLastError () returned 0x0 [0055.932] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.932] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.932] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.933] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17593368693) returned 1 [0055.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb026ccf0, dwHighDateTime=0x1d585b4)) [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bb68 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bb68 | out: hHeap=0x260000) returned 1 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766c50 [0055.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.933] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.933] GetLastError () returned 0x0 [0055.933] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.933] GetLastError () returned 0x0 [0055.935] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe076, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.936] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1f8a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x1f8a, lpOverlapped=0x0) returned 1 [0055.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0055.936] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.936] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.936] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.937] CloseHandle (hObject=0x100) returned 1 [0055.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.938] GetLastError () returned 0x0 [0055.939] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.940] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.940] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.940] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17594095975) returned 1 [0055.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb026ccf0, dwHighDateTime=0x1d585b4)) [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31baf8 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31baf8 | out: hHeap=0x260000) returned 1 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766ce8 [0055.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.940] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.941] GetLastError () returned 0x0 [0055.941] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.941] GetLastError () returned 0x0 [0055.943] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff90bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.943] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x6f43, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x6f43, lpOverlapped=0x0) returned 1 [0055.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0055.943] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.944] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.944] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.944] CloseHandle (hObject=0x100) returned 1 [0055.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.946] GetLastError () returned 0x0 [0055.946] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0055.947] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.947] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.947] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17594839237) returned 1 [0055.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0292e50, dwHighDateTime=0x1d585b4)) [0055.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762d10 [0055.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762d10 | out: hHeap=0x260000) returned 1 [0055.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766e18 [0055.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0055.948] GetLastError () returned 0x0 [0055.948] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0055.948] GetLastError () returned 0x0 [0055.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff9558, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.991] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x6aa8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x224fdb0*=0x6aa8, lpOverlapped=0x0) returned 1 [0055.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0055.991] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.991] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.992] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.992] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.992] CloseHandle (hObject=0x100) returned 1 [0056.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.023] GetLastError () returned 0x0 [0056.030] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.037] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.044] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.044] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17604516707) returned 1 [0056.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0377690, dwHighDateTime=0x1d585b4)) [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762fb0 [0056.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762fb0 | out: hHeap=0x260000) returned 1 [0056.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767538 [0056.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.045] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.045] GetLastError () returned 0x0 [0056.045] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.045] GetLastError () returned 0x0 [0056.049] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb646, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.049] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x49ba, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x49ba, lpOverlapped=0x0) returned 1 [0056.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.049] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.049] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.050] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.050] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.050] CloseHandle (hObject=0x104) returned 1 [0056.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.051] GetLastError () returned 0x0 [0056.052] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.052] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.052] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.052] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17605361611) returned 1 [0056.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb039d7f0, dwHighDateTime=0x1d585b4)) [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762fe8 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762fe8 | out: hHeap=0x260000) returned 1 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767408 [0056.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.053] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.054] GetLastError () returned 0x0 [0056.054] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.054] GetLastError () returned 0x0 [0056.058] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.059] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.061] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.061] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.061] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.062] CloseHandle (hObject=0x104) returned 1 [0056.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.063] GetLastError () returned 0x0 [0056.063] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.064] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.064] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17606549345) returned 1 [0056.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb039d7f0, dwHighDateTime=0x1d585b4)) [0056.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763058 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763058 | out: hHeap=0x260000) returned 1 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767668 [0056.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.065] GetLastError () returned 0x0 [0056.065] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.065] GetLastError () returned 0x0 [0056.068] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.068] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.069] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.069] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.070] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.070] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.070] CloseHandle (hObject=0x104) returned 1 [0056.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.071] GetLastError () returned 0x0 [0056.072] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.073] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.073] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.073] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17607432175) returned 1 [0056.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb03c3950, dwHighDateTime=0x1d585b4)) [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763090 [0056.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763090 | out: hHeap=0x260000) returned 1 [0056.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767798 [0056.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.074] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.074] GetLastError () returned 0x0 [0056.074] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.074] GetLastError () returned 0x0 [0056.076] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7b2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.076] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x184d3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x184d3, lpOverlapped=0x0) returned 1 [0056.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.077] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.078] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.078] CloseHandle (hObject=0x104) returned 1 [0056.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.098] GetLastError () returned 0x0 [0056.098] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.099] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.099] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.099] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17610052309) returned 1 [0056.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb040fc10, dwHighDateTime=0x1d585b4)) [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27630c8 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27630c8 | out: hHeap=0x260000) returned 1 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767830 [0056.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.100] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.100] GetLastError () returned 0x0 [0056.100] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.100] GetLastError () returned 0x0 [0056.104] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.105] WriteFile (in: hFile=0x100, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.106] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.106] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.106] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.106] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.107] CloseHandle (hObject=0x100) returned 1 [0056.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.108] GetLastError () returned 0x0 [0056.109] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.110] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.110] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17611111958) returned 1 [0056.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb040fc10, dwHighDateTime=0x1d585b4)) [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763100 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763100 | out: hHeap=0x260000) returned 1 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27678c8 [0056.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.111] GetLastError () returned 0x0 [0056.111] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.111] GetLastError () returned 0x0 [0056.114] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe9ac6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.114] WriteFile (in: hFile=0x100, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1653a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x224fdb0*=0x1653a, lpOverlapped=0x0) returned 1 [0056.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.115] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.115] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.115] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.115] CloseHandle (hObject=0x100) returned 1 [0056.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.117] GetLastError () returned 0x0 [0056.117] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.118] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17611925213) returned 1 [0056.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0435d70, dwHighDateTime=0x1d585b4)) [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763138 [0056.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763138 | out: hHeap=0x260000) returned 1 [0056.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767960 [0056.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.119] GetLastError () returned 0x0 [0056.119] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.119] GetLastError () returned 0x0 [0056.122] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffec1e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.122] WriteFile (in: hFile=0x100, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x13e1d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x224fdb0*=0x13e1d, lpOverlapped=0x0) returned 1 [0056.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.124] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.124] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.125] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.125] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.125] CloseHandle (hObject=0x100) returned 1 [0056.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.127] GetLastError () returned 0x0 [0056.127] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.128] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.128] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.128] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17612934614) returned 1 [0056.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0435d70, dwHighDateTime=0x1d585b4)) [0056.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763170 [0056.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763170 | out: hHeap=0x260000) returned 1 [0056.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27679f8 [0056.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.129] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.129] GetLastError () returned 0x0 [0056.129] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.129] GetLastError () returned 0x0 [0056.171] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffeace4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.171] WriteFile (in: hFile=0x100, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1531c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x1531c, lpOverlapped=0x0) returned 1 [0056.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.172] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.172] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.172] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.224] CloseHandle (hObject=0x100) returned 1 [0056.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.234] GetLastError () returned 0x0 [0056.234] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.235] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.235] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.235] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17623635517) returned 1 [0056.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0540710, dwHighDateTime=0x1d585b4)) [0056.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27633d8 [0056.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27633d8 | out: hHeap=0x260000) returned 1 [0056.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x330ee0 [0056.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.236] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.236] GetLastError () returned 0x0 [0056.236] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.236] GetLastError () returned 0x0 [0056.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.239] WriteFile (in: hFile=0x100, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.241] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.241] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.241] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.241] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.242] CloseHandle (hObject=0x100) returned 1 [0056.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.243] GetLastError () returned 0x0 [0056.243] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.244] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.244] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.244] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17624528931) returned 1 [0056.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0566870, dwHighDateTime=0x1d585b4)) [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763410 [0056.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763410 | out: hHeap=0x260000) returned 1 [0056.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3310a8 [0056.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.245] GetLastError () returned 0x0 [0056.245] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.245] GetLastError () returned 0x0 [0056.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7778, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.248] WriteFile (in: hFile=0x100, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x18888, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x18888, lpOverlapped=0x0) returned 1 [0056.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.249] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.249] CloseHandle (hObject=0x100) returned 1 [0056.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.251] GetLastError () returned 0x0 [0056.251] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.252] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.252] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.252] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17625349412) returned 1 [0056.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0566870, dwHighDateTime=0x1d585b4)) [0056.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763448 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763448 | out: hHeap=0x260000) returned 1 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331010 [0056.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.253] GetLastError () returned 0x0 [0056.253] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.253] GetLastError () returned 0x0 [0056.256] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe92f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.256] WriteFile (in: hFile=0x100, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x16d08, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x16d08, lpOverlapped=0x0) returned 1 [0056.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.257] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.257] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.257] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.257] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.258] CloseHandle (hObject=0x100) returned 1 [0056.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.259] GetLastError () returned 0x0 [0056.259] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.260] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.260] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.260] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17626148700) returned 1 [0056.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb058c9d0, dwHighDateTime=0x1d585b4)) [0056.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763480 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763480 | out: hHeap=0x260000) returned 1 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296690 [0056.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.261] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.261] GetLastError () returned 0x0 [0056.261] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.261] GetLastError () returned 0x0 [0056.264] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.264] WriteFile (in: hFile=0x100, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.266] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.266] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.266] CloseHandle (hObject=0x100) returned 1 [0056.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.266] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.267] GetLastError () returned 0x0 [0056.363] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.379] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.379] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.379] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17638015820) returned 1 [0056.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb06bd4d0, dwHighDateTime=0x1d585b4)) [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763758 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763758 | out: hHeap=0x260000) returned 1 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5f00 [0056.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.380] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.380] GetLastError () returned 0x0 [0056.380] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.380] GetLastError () returned 0x0 [0056.384] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe8861, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.384] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1779f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1779f, lpOverlapped=0x0) returned 1 [0056.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.385] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.385] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.385] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.385] CloseHandle (hObject=0xf8) returned 1 [0056.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.387] GetLastError () returned 0x0 [0056.388] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.388] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.388] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.389] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17638964904) returned 1 [0056.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb06bd4d0, dwHighDateTime=0x1d585b4)) [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27637c8 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27637c8 | out: hHeap=0x260000) returned 1 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5f00 [0056.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.389] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.389] GetLastError () returned 0x0 [0056.389] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.389] GetLastError () returned 0x0 [0056.391] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff6739, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.391] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x98c7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x98c7, lpOverlapped=0x0) returned 1 [0056.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.392] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.393] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.393] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.393] CloseHandle (hObject=0xf8) returned 1 [0056.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.395] GetLastError () returned 0x0 [0056.395] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.396] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.396] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17639692375) returned 1 [0056.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb06e3630, dwHighDateTime=0x1d585b4)) [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763800 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763800 | out: hHeap=0x260000) returned 1 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6030 [0056.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.396] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.397] GetLastError () returned 0x0 [0056.397] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.397] GetLastError () returned 0x0 [0056.399] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff4641, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.399] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xb9bf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0xb9bf, lpOverlapped=0x0) returned 1 [0056.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.399] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.399] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.400] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.400] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.400] CloseHandle (hObject=0xf8) returned 1 [0056.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.401] GetLastError () returned 0x0 [0056.402] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.402] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.402] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.402] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17640361127) returned 1 [0056.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb06e3630, dwHighDateTime=0x1d585b4)) [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763838 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763838 | out: hHeap=0x260000) returned 1 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f60c8 [0056.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.403] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.403] GetLastError () returned 0x0 [0056.403] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.403] GetLastError () returned 0x0 [0056.406] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff6714, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.406] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x98ec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x98ec, lpOverlapped=0x0) returned 1 [0056.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.406] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.406] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.407] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.407] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.407] CloseHandle (hObject=0xf8) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.408] GetLastError () returned 0x0 [0056.409] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.410] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.410] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.410] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17641130687) returned 1 [0056.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0709790, dwHighDateTime=0x1d585b4)) [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763870 [0056.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763870 | out: hHeap=0x260000) returned 1 [0056.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6160 [0056.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.411] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.411] GetLastError () returned 0x0 [0056.411] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.411] GetLastError () returned 0x0 [0056.413] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff820d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.413] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7df3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7df3, lpOverlapped=0x0) returned 1 [0056.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.491] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.491] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.491] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.491] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.492] CloseHandle (hObject=0xf8) returned 1 [0056.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.501] GetLastError () returned 0x0 [0056.508] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0056.509] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.509] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.509] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17651033949) returned 1 [0056.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb07edfd0, dwHighDateTime=0x1d585b4)) [0056.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763988 [0056.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763988 | out: hHeap=0x260000) returned 1 [0056.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f69b0 [0056.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.522] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.522] GetLastError () returned 0x0 [0056.522] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.522] GetLastError () returned 0x0 [0056.528] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe520, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.528] WriteFile (in: hFile=0xf8, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x224fdb0*=0x1ae0, lpOverlapped=0x0) returned 1 [0056.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.528] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.528] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.529] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.529] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.529] CloseHandle (hObject=0xf8) returned 1 [0056.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0056.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.540] GetLastError () returned 0x0 [0056.540] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.541] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.541] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.541] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17654251904) returned 1 [0056.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb083a290, dwHighDateTime=0x1d585b4)) [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763a30 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763a30 | out: hHeap=0x260000) returned 1 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6918 [0056.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.542] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.542] GetLastError () returned 0x0 [0056.542] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.542] GetLastError () returned 0x0 [0056.544] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.544] WriteFile (in: hFile=0xf8, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x1384, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x1384, lpOverlapped=0x0) returned 1 [0056.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.545] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.545] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.545] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.545] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.546] CloseHandle (hObject=0xf8) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.547] GetLastError () returned 0x0 [0056.547] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.548] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.548] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.548] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17654923232) returned 1 [0056.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb083a290, dwHighDateTime=0x1d585b4)) [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763a68 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763a68 | out: hHeap=0x260000) returned 1 [0056.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6c10 [0056.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.549] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.549] GetLastError () returned 0x0 [0056.549] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.549] GetLastError () returned 0x0 [0056.551] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff79c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.551] WriteFile (in: hFile=0xf8, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x864, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x864, lpOverlapped=0x0) returned 1 [0056.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.551] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.551] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.552] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.552] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.552] CloseHandle (hObject=0xf8) returned 1 [0056.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.553] GetLastError () returned 0x0 [0056.553] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.554] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.554] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.554] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17655537493) returned 1 [0056.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb08603f0, dwHighDateTime=0x1d585b4)) [0056.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763aa0 [0056.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763aa0 | out: hHeap=0x260000) returned 1 [0056.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6ca8 [0056.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.555] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.555] GetLastError () returned 0x0 [0056.555] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.555] GetLastError () returned 0x0 [0056.557] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffee8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.557] WriteFile (in: hFile=0xf8, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x1172, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x224fdb0*=0x1172, lpOverlapped=0x0) returned 1 [0056.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.557] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.557] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.558] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.558] CloseHandle (hObject=0xf8) returned 1 [0056.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.559] GetLastError () returned 0x0 [0056.565] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.585] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.591] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17659212898) returned 1 [0056.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb08ac6b0, dwHighDateTime=0x1d585b4)) [0056.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763bf0 [0056.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763bf0 | out: hHeap=0x260000) returned 1 [0056.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7038 [0056.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.592] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.592] GetLastError () returned 0x0 [0056.592] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.592] GetLastError () returned 0x0 [0056.595] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdf36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.595] WriteFile (in: hFile=0xf8, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x20ca, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x224fdb0*=0x20ca, lpOverlapped=0x0) returned 1 [0056.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.681] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.681] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.695] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.704] CloseHandle (hObject=0xf8) returned 1 [0056.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.705] GetLastError () returned 0x0 [0056.705] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.713] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.713] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.713] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17671453230) returned 1 [0056.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb09dd1b0, dwHighDateTime=0x1d585b4)) [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763ec8 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763ec8 | out: hHeap=0x260000) returned 1 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6dd8 [0056.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.714] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.714] GetLastError () returned 0x0 [0056.714] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.714] GetLastError () returned 0x0 [0056.717] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff82ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.717] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7d14, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7d14, lpOverlapped=0x0) returned 1 [0056.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.718] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.718] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.719] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.719] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.719] CloseHandle (hObject=0xf8) returned 1 [0056.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.720] GetLastError () returned 0x0 [0056.721] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.721] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.721] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.721] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17672259885) returned 1 [0056.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0a03310, dwHighDateTime=0x1d585b4)) [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763f00 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763f00 | out: hHeap=0x260000) returned 1 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bcc0 [0056.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.722] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.722] GetLastError () returned 0x0 [0056.722] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.723] GetLastError () returned 0x0 [0056.725] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff9b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.725] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x64c, lpOverlapped=0x0) returned 1 [0056.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.725] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.725] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.726] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.726] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.726] CloseHandle (hObject=0xf8) returned 1 [0056.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.728] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.729] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.729] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.729] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.729] GetLastError () returned 0x0 [0056.731] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff89a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.731] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7658, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7658, lpOverlapped=0x0) returned 1 [0056.732] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.733] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.733] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.733] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.733] CloseHandle (hObject=0xf8) returned 1 [0056.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.735] GetLastError () returned 0x0 [0056.735] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.736] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.736] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.736] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17673684790) returned 1 [0056.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0a03310, dwHighDateTime=0x1d585b4)) [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763f70 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763f70 | out: hHeap=0x260000) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b42e8 [0056.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.736] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.736] GetLastError () returned 0x0 [0056.737] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.737] GetLastError () returned 0x0 [0056.738] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdc08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.739] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x23f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x23f8, lpOverlapped=0x0) returned 1 [0056.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.739] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.739] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.739] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.739] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.740] CloseHandle (hObject=0xf8) returned 1 [0056.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.741] GetLastError () returned 0x0 [0056.741] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.742] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.742] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17674324100) returned 1 [0056.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0a29470, dwHighDateTime=0x1d585b4)) [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763fa8 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763fa8 | out: hHeap=0x260000) returned 1 [0056.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4380 [0056.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.743] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.743] GetLastError () returned 0x0 [0056.743] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.743] GetLastError () returned 0x0 [0056.848] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff878, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.849] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x788, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x788, lpOverlapped=0x0) returned 1 [0056.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.849] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.849] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.850] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.850] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.850] CloseHandle (hObject=0xf8) returned 1 [0056.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.852] GetLastError () returned 0x0 [0056.852] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.853] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.853] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.853] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17685402468) returned 1 [0056.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0b33e10, dwHighDateTime=0x1d585b4)) [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c038 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c038 | out: hHeap=0x260000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4418 [0056.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.854] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.854] GetLastError () returned 0x0 [0056.854] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.854] GetLastError () returned 0x0 [0056.858] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.858] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1f38, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1f38, lpOverlapped=0x0) returned 1 [0056.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.858] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.858] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.859] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.859] CloseHandle (hObject=0xf8) returned 1 [0056.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.860] GetLastError () returned 0x0 [0056.861] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.862] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.862] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17686329607) returned 1 [0056.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0b59f70, dwHighDateTime=0x1d585b4)) [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c000 [0056.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c000 | out: hHeap=0x260000) returned 1 [0056.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4bd0 [0056.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.863] GetLastError () returned 0x0 [0056.863] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.863] GetLastError () returned 0x0 [0056.865] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffedb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.865] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1248, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1248, lpOverlapped=0x0) returned 1 [0056.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.865] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.866] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.866] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.866] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.866] CloseHandle (hObject=0xf8) returned 1 [0056.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.868] GetLastError () returned 0x0 [0056.868] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.869] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.869] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.869] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17686989621) returned 1 [0056.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0b59f70, dwHighDateTime=0x1d585b4)) [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bfc8 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bfc8 | out: hHeap=0x260000) returned 1 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4c68 [0056.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.869] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.870] GetLastError () returned 0x0 [0056.870] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.870] GetLastError () returned 0x0 [0056.871] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffddd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.871] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x2230, lpOverlapped=0x0) returned 1 [0056.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.872] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.872] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.872] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.873] CloseHandle (hObject=0xf8) returned 1 [0056.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.874] GetLastError () returned 0x0 [0056.874] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.875] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.875] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.875] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17687631143) returned 1 [0056.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0b59f70, dwHighDateTime=0x1d585b4)) [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bf90 [0056.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bf90 | out: hHeap=0x260000) returned 1 [0056.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4d00 [0056.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.876] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.876] GetLastError () returned 0x0 [0056.876] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.876] GetLastError () returned 0x0 [0056.879] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffea50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.879] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x15b0, lpOverlapped=0x0) returned 1 [0056.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.880] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.880] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.880] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.880] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.881] CloseHandle (hObject=0xf8) returned 1 [0056.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.882] GetLastError () returned 0x0 [0056.882] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.883] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.883] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.883] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17688440094) returned 1 [0056.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0b800d0, dwHighDateTime=0x1d585b4)) [0056.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bf58 [0056.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bf58 | out: hHeap=0x260000) returned 1 [0056.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4d98 [0056.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.884] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.884] GetLastError () returned 0x0 [0056.884] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.884] GetLastError () returned 0x0 [0056.887] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe7a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.887] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1858, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x1858, lpOverlapped=0x0) returned 1 [0056.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.887] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.887] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.888] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.888] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.888] CloseHandle (hObject=0xf8) returned 1 [0056.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.890] GetLastError () returned 0x0 [0056.898] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.899] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.899] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17690049275) returned 1 [0056.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0ba6230, dwHighDateTime=0x1d585b4)) [0056.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bf20 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bf20 | out: hHeap=0x260000) returned 1 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4e30 [0056.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.900] GetLastError () returned 0x0 [0056.900] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.900] GetLastError () returned 0x0 [0056.903] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe38c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.903] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x1c74, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x1c74, lpOverlapped=0x0) returned 1 [0056.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0056.906] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.906] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.907] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.907] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.907] CloseHandle (hObject=0xf8) returned 1 [0056.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0056.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0056.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.908] GetLastError () returned 0x0 [0056.912] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.913] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.913] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.913] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17691397237) returned 1 [0056.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0bcc390, dwHighDateTime=0x1d585b4)) [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bee8 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bee8 | out: hHeap=0x260000) returned 1 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4ec8 [0056.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.914] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.914] GetLastError () returned 0x0 [0056.914] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.914] GetLastError () returned 0x0 [0056.917] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe96c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.917] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x1694, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x1694, lpOverlapped=0x0) returned 1 [0056.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0056.917] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.918] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.918] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.918] CloseHandle (hObject=0xf8) returned 1 [0056.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0056.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0056.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.919] GetLastError () returned 0x0 [0056.920] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.920] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.920] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.921] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17692177326) returned 1 [0056.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0bcc390, dwHighDateTime=0x1d585b4)) [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31beb0 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31beb0 | out: hHeap=0x260000) returned 1 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4f60 [0056.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.921] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.921] GetLastError () returned 0x0 [0056.922] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.922] GetLastError () returned 0x0 [0056.923] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff5fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.923] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xa04, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xa04, lpOverlapped=0x0) returned 1 [0056.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0056.924] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.924] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.924] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.924] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.925] CloseHandle (hObject=0xf8) returned 1 [0056.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0056.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0056.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.926] GetLastError () returned 0x0 [0056.926] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.927] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.927] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17692806035) returned 1 [0056.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0bf24f0, dwHighDateTime=0x1d585b4)) [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31be78 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31be78 | out: hHeap=0x260000) returned 1 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4ff8 [0056.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.928] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.928] GetLastError () returned 0x0 [0056.928] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.928] GetLastError () returned 0x0 [0056.929] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff8f10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.929] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x70f0, lpOverlapped=0x0) returned 1 [0056.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0056.930] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.930] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.930] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.931] CloseHandle (hObject=0xf8) returned 1 [0056.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0056.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0056.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0056.932] GetLastError () returned 0x0 [0056.932] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0056.933] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.933] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0056.933] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17693417500) returned 1 [0056.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0bf24f0, dwHighDateTime=0x1d585b4)) [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31be40 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31be40 | out: hHeap=0x260000) returned 1 [0056.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5090 [0056.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.934] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0056.934] GetLastError () returned 0x0 [0056.934] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0056.934] GetLastError () returned 0x0 [0057.060] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe952, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.060] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x16ae, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x16ae, lpOverlapped=0x0) returned 1 [0057.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.062] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.062] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.063] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.063] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.063] CloseHandle (hObject=0xf8) returned 1 [0057.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.065] GetLastError () returned 0x0 [0057.065] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.066] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.066] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17706721527) returned 1 [0057.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0d49150, dwHighDateTime=0x1d585b4)) [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1cb8 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1cb8 | out: hHeap=0x260000) returned 1 [0057.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5128 [0057.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.067] GetLastError () returned 0x0 [0057.067] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.067] GetLastError () returned 0x0 [0057.070] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffef38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.070] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x10c8, lpOverlapped=0x0) returned 1 [0057.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.071] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.071] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.071] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.071] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.072] CloseHandle (hObject=0xf8) returned 1 [0057.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.073] GetLastError () returned 0x0 [0057.073] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.074] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.074] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17707652566) returned 1 [0057.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0d49150, dwHighDateTime=0x1d585b4)) [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c80 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c80 | out: hHeap=0x260000) returned 1 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5c70 [0057.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.076] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.076] GetLastError () returned 0x0 [0057.076] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.076] GetLastError () returned 0x0 [0057.078] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.078] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xdb8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xdb8, lpOverlapped=0x0) returned 1 [0057.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.078] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.079] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.079] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.079] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.079] CloseHandle (hObject=0xf8) returned 1 [0057.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.081] GetLastError () returned 0x0 [0057.081] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.081] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.082] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.082] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17708284422) returned 1 [0057.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0d6f2b0, dwHighDateTime=0x1d585b4)) [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c48 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c48 | out: hHeap=0x260000) returned 1 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5d08 [0057.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.082] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.083] GetLastError () returned 0x0 [0057.083] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.083] GetLastError () returned 0x0 [0057.084] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd820, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.084] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x27e0, lpOverlapped=0x0) returned 1 [0057.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.085] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.085] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.085] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.085] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.086] CloseHandle (hObject=0xf8) returned 1 [0057.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.087] GetLastError () returned 0x0 [0057.087] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.088] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.088] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.088] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17708914097) returned 1 [0057.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0d6f2b0, dwHighDateTime=0x1d585b4)) [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c10 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c10 | out: hHeap=0x260000) returned 1 [0057.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5da0 [0057.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.089] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.089] GetLastError () returned 0x0 [0057.089] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.089] GetLastError () returned 0x0 [0057.091] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff6e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.091] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x918, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x918, lpOverlapped=0x0) returned 1 [0057.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.091] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.091] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.092] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.092] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.092] CloseHandle (hObject=0xf8) returned 1 [0057.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.092] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.093] GetLastError () returned 0x0 [0057.094] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.095] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.095] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.095] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17709607751) returned 1 [0057.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0d6f2b0, dwHighDateTime=0x1d585b4)) [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1bd8 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1bd8 | out: hHeap=0x260000) returned 1 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5e38 [0057.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.096] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.096] GetLastError () returned 0x0 [0057.096] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.096] GetLastError () returned 0x0 [0057.299] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffbc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.299] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x43c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x43c, lpOverlapped=0x0) returned 1 [0057.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.300] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.300] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.301] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.301] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.301] CloseHandle (hObject=0xf8) returned 1 [0057.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.325] GetLastError () returned 0x0 [0057.325] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.326] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.326] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.326] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17732722981) returned 1 [0057.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0faa750, dwHighDateTime=0x1d585b4)) [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294ee8 [0057.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ee8 | out: hHeap=0x260000) returned 1 [0057.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5ed0 [0057.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.327] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.327] GetLastError () returned 0x0 [0057.327] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.327] GetLastError () returned 0x0 [0057.329] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff300, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.329] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xd00, lpOverlapped=0x0) returned 1 [0057.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.330] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.330] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.331] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.331] CloseHandle (hObject=0x104) returned 1 [0057.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0057.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0057.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.333] GetLastError () returned 0x0 [0057.333] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.334] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.334] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.334] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17733538355) returned 1 [0057.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0fd08b0, dwHighDateTime=0x1d585b4)) [0057.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f20 [0057.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0057.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6390 [0057.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.335] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.335] GetLastError () returned 0x0 [0057.335] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.335] GetLastError () returned 0x0 [0057.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.337] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x8e0, lpOverlapped=0x0) returned 1 [0057.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.338] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.338] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.340] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.340] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.341] CloseHandle (hObject=0x104) returned 1 [0057.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0057.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0057.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.342] GetLastError () returned 0x0 [0057.342] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.343] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.343] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17734444445) returned 1 [0057.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0fd08b0, dwHighDateTime=0x1d585b4)) [0057.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f58 [0057.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0057.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6428 [0057.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.344] GetLastError () returned 0x0 [0057.344] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.344] GetLastError () returned 0x0 [0057.346] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff1ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.346] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xe14, lpOverlapped=0x0) returned 1 [0057.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.347] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.347] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.347] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.348] CloseHandle (hObject=0x104) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0057.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0057.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.349] GetLastError () returned 0x0 [0057.349] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.350] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.350] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.350] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17735141166) returned 1 [0057.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0ff6a10, dwHighDateTime=0x1d585b4)) [0057.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295000 [0057.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0057.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b64c0 [0057.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.351] GetLastError () returned 0x0 [0057.351] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.351] GetLastError () returned 0x0 [0057.353] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe83c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.353] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x17c4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x17c4, lpOverlapped=0x0) returned 1 [0057.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.354] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.354] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.354] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.354] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.355] CloseHandle (hObject=0x104) returned 1 [0057.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0057.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0057.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.356] GetLastError () returned 0x0 [0057.359] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.360] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.360] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.360] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17736132448) returned 1 [0057.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb0ff6a10, dwHighDateTime=0x1d585b4)) [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ccd0 [0057.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ccd0 | out: hHeap=0x260000) returned 1 [0057.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5420 [0057.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.361] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.361] GetLastError () returned 0x0 [0057.361] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.361] GetLastError () returned 0x0 [0057.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.363] WriteFile (in: hFile=0xf0, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xd28, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xd28, lpOverlapped=0x0) returned 1 [0057.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.363] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.363] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.364] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.364] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.364] CloseHandle (hObject=0xf0) returned 1 [0057.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.365] GetLastError () returned 0x0 [0057.366] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.367] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.367] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17736781524) returned 1 [0057.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb101cb70, dwHighDateTime=0x1d585b4)) [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295150 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0057.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b65f0 [0057.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.367] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.368] GetLastError () returned 0x0 [0057.368] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.368] GetLastError () returned 0x0 [0057.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff314, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.372] WriteFile (in: hFile=0xf0, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xcec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xcec, lpOverlapped=0x0) returned 1 [0057.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.373] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.373] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.373] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.373] CloseHandle (hObject=0xf0) returned 1 [0057.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.375] GetLastError () returned 0x0 [0057.375] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.376] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.376] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17737753290) returned 1 [0057.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb101cb70, dwHighDateTime=0x1d585b4)) [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295188 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6720 [0057.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.377] GetLastError () returned 0x0 [0057.378] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.378] GetLastError () returned 0x0 [0057.379] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff428, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.379] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xbd8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xbd8, lpOverlapped=0x0) returned 1 [0057.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.380] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.380] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.380] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.380] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.381] CloseHandle (hObject=0x104) returned 1 [0057.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.382] GetLastError () returned 0x0 [0057.382] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0057.383] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0057.383] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0057.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.383] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17738413246) returned 1 [0057.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1042cd0, dwHighDateTime=0x1d585b4)) [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f03b8 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03b8 | out: hHeap=0x260000) returned 1 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b67b8 [0057.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.384] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.384] GetLastError () returned 0x0 [0057.384] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.384] GetLastError () returned 0x0 [0057.386] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff6b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.386] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0x948, lpOverlapped=0x0) returned 1 [0057.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.386] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.386] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.387] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.387] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.387] CloseHandle (hObject=0x104) returned 1 [0057.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.388] GetLastError () returned 0x0 [0057.389] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0057.389] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.389] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0057.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.389] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17739062951) returned 1 [0057.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1042cd0, dwHighDateTime=0x1d585b4)) [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8220 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8220 | out: hHeap=0x260000) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2978f8 [0057.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.390] GetLastError () returned 0x0 [0057.390] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.390] GetLastError () returned 0x0 [0057.392] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff37c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.392] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xc84, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xc84, lpOverlapped=0x0) returned 1 [0057.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.393] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.393] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.393] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.394] CloseHandle (hObject=0x104) returned 1 [0057.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.395] GetLastError () returned 0x0 [0057.395] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.396] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.396] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17739716618) returned 1 [0057.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1068e30, dwHighDateTime=0x1d585b4)) [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f2a0 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2a0 | out: hHeap=0x260000) returned 1 [0057.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6850 [0057.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.397] GetLastError () returned 0x0 [0057.397] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.397] GetLastError () returned 0x0 [0057.415] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff4d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.415] WriteFile (in: hFile=0x104, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0xb2c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x224fdb0*=0xb2c, lpOverlapped=0x0) returned 1 [0057.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.423] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.423] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.423] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.423] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.424] CloseHandle (hObject=0x104) returned 1 [0057.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.424] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.427] GetLastError () returned 0x0 [0057.434] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.435] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.435] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.435] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17743598209) returned 1 [0057.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb10b50f0, dwHighDateTime=0x1d585b4)) [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f1c0 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f1c0 | out: hHeap=0x260000) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b68e8 [0057.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.436] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.436] GetLastError () returned 0x0 [0057.436] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.436] GetLastError () returned 0x0 [0057.463] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdee0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.464] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x2120, lpOverlapped=0x0) returned 1 [0057.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.464] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.464] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.465] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.465] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.465] CloseHandle (hObject=0xf8) returned 1 [0057.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.467] GetLastError () returned 0x0 [0057.467] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.468] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.468] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.468] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17746900114) returned 1 [0057.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb11013b0, dwHighDateTime=0x1d585b4)) [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f0e0 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f0e0 | out: hHeap=0x260000) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6b48 [0057.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.469] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.469] GetLastError () returned 0x0 [0057.469] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.469] GetLastError () returned 0x0 [0057.480] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff4dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.480] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xb24, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0xb24, lpOverlapped=0x0) returned 1 [0057.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.482] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.482] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.483] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.483] CloseHandle (hObject=0xf8) returned 1 [0057.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.507] GetLastError () returned 0x0 [0057.507] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.508] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.508] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.508] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17750949378) returned 1 [0057.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb11737d0, dwHighDateTime=0x1d585b4)) [0057.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ef90 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ef90 | out: hHeap=0x260000) returned 1 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6da8 [0057.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.509] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.509] GetLastError () returned 0x0 [0057.509] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.509] GetLastError () returned 0x0 [0057.512] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffebcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.512] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1434, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x1434, lpOverlapped=0x0) returned 1 [0057.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.513] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.513] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.513] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.513] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.514] CloseHandle (hObject=0xf8) returned 1 [0057.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.515] GetLastError () returned 0x0 [0057.515] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.516] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.516] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.516] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17751719003) returned 1 [0057.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb11737d0, dwHighDateTime=0x1d585b4)) [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ef58 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0057.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ef58 | out: hHeap=0x260000) returned 1 [0057.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0057.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7138 [0057.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.517] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.517] GetLastError () returned 0x0 [0057.517] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.517] GetLastError () returned 0x0 [0057.519] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffcde8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.519] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x3218, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x3218, lpOverlapped=0x0) returned 1 [0057.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.519] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.519] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.520] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.520] CloseHandle (hObject=0xf8) returned 1 [0057.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.521] GetLastError () returned 0x0 [0057.522] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0057.522] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0057.522] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0057.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0057.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.523] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17752370208) returned 1 [0057.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1199930, dwHighDateTime=0x1d585b4)) [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ef20 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ef20 | out: hHeap=0x260000) returned 1 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b71d0 [0057.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.523] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.523] GetLastError () returned 0x0 [0057.523] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.524] GetLastError () returned 0x0 [0057.571] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffaa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.604] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x55c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x55c, lpOverlapped=0x0) returned 1 [0057.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.605] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.605] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.605] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.605] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.606] CloseHandle (hObject=0xf8) returned 1 [0057.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.607] GetLastError () returned 0x0 [0057.607] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.608] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.608] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17760927176) returned 1 [0057.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1258010, dwHighDateTime=0x1d585b4)) [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ec80 [0057.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ec80 | out: hHeap=0x260000) returned 1 [0057.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7268 [0057.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.609] GetLastError () returned 0x0 [0057.609] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.609] GetLastError () returned 0x0 [0057.611] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.611] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1652, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x1652, lpOverlapped=0x0) returned 1 [0057.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.612] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.612] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.612] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.612] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.612] CloseHandle (hObject=0xf8) returned 1 [0057.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.614] GetLastError () returned 0x0 [0057.614] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.615] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.615] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17761593980) returned 1 [0057.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb127e170, dwHighDateTime=0x1d585b4)) [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ec48 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ec48 | out: hHeap=0x260000) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7988 [0057.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.615] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.616] GetLastError () returned 0x0 [0057.616] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.616] GetLastError () returned 0x0 [0057.617] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdea6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.617] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x215a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x215a, lpOverlapped=0x0) returned 1 [0057.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.618] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.618] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.618] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.618] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.619] CloseHandle (hObject=0xf8) returned 1 [0057.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.620] GetLastError () returned 0x0 [0057.621] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.621] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.621] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.622] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17762277168) returned 1 [0057.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb127e170, dwHighDateTime=0x1d585b4)) [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295428 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7a20 [0057.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.622] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.622] GetLastError () returned 0x0 [0057.623] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.623] GetLastError () returned 0x0 [0057.626] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe84a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.626] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x17b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x17b6, lpOverlapped=0x0) returned 1 [0057.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.626] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.626] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.627] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.627] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.627] CloseHandle (hObject=0xf8) returned 1 [0057.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.629] GetLastError () returned 0x0 [0057.629] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.630] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.630] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17763141153) returned 1 [0057.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb12a42d0, dwHighDateTime=0x1d585b4)) [0057.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d81b0 [0057.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81b0 | out: hHeap=0x260000) returned 1 [0057.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x330e48 [0057.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.631] GetLastError () returned 0x0 [0057.631] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.631] GetLastError () returned 0x0 [0057.633] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe87c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.633] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1784, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x1784, lpOverlapped=0x0) returned 1 [0057.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.634] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.634] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.634] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.635] CloseHandle (hObject=0xf8) returned 1 [0057.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.636] GetLastError () returned 0x0 [0057.636] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.637] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.637] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.637] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17763818656) returned 1 [0057.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb12a42d0, dwHighDateTime=0x1d585b4)) [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8178 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8178 | out: hHeap=0x260000) returned 1 [0057.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331ac0 [0057.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.638] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.638] GetLastError () returned 0x0 [0057.638] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.638] GetLastError () returned 0x0 [0057.765] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe1a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.765] WriteFile (in: hFile=0xf8, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1e58, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x224fdb0*=0x1e58, lpOverlapped=0x0) returned 1 [0057.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.789] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.789] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.789] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.789] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.805] CloseHandle (hObject=0xf8) returned 1 [0057.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.860] GetLastError () returned 0x0 [0057.860] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.861] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.861] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.861] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17786256496) returned 1 [0057.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb14df770, dwHighDateTime=0x1d585b4)) [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b48 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7d18 [0057.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.862] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.862] GetLastError () returned 0x0 [0057.862] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.862] GetLastError () returned 0x0 [0057.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe51a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.876] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1ae6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1ae6, lpOverlapped=0x0) returned 1 [0057.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.880] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.880] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.880] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.881] CloseHandle (hObject=0xf0) returned 1 [0057.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.927] GetLastError () returned 0x0 [0057.934] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.934] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.934] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.935] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17793564239) returned 1 [0057.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1577cf0, dwHighDateTime=0x1d585b4)) [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0428 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0428 | out: hHeap=0x260000) returned 1 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0057.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.935] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.935] GetLastError () returned 0x0 [0057.935] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.935] GetLastError () returned 0x0 [0057.943] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.943] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1138, lpOverlapped=0x0) returned 1 [0057.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.944] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.944] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.944] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.945] CloseHandle (hObject=0xf0) returned 1 [0057.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.946] GetLastError () returned 0x0 [0057.946] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.947] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.947] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.947] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17794831744) returned 1 [0057.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb159de50, dwHighDateTime=0x1d585b4)) [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0498 [0057.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0498 | out: hHeap=0x260000) returned 1 [0057.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bcc0 [0057.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.948] GetLastError () returned 0x0 [0057.948] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.948] GetLastError () returned 0x0 [0057.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe504, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.956] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1afc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1afc, lpOverlapped=0x0) returned 1 [0057.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.956] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.956] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.957] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.957] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.957] CloseHandle (hObject=0xf0) returned 1 [0057.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.957] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.959] GetLastError () returned 0x0 [0057.966] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0057.986] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.986] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.986] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17798718633) returned 1 [0057.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1610270, dwHighDateTime=0x1d585b4)) [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0057.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331f80 [0057.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.987] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0057.987] GetLastError () returned 0x0 [0057.987] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0057.987] GetLastError () returned 0x0 [0058.068] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff61d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.068] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x9e2c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x224fdb0*=0x9e2c, lpOverlapped=0x0) returned 1 [0058.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.069] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.070] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.070] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.070] CloseHandle (hObject=0xf0) returned 1 [0058.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.187] GetLastError () returned 0x0 [0058.194] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.207] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.221] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.221] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17822256059) returned 1 [0058.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb184b710, dwHighDateTime=0x1d585b4)) [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77b8 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29de28 [0058.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.222] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.222] GetLastError () returned 0x0 [0058.222] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.222] GetLastError () returned 0x0 [0058.413] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcc80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.413] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x3380, lpOverlapped=0x0) returned 1 [0058.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.414] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.414] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.414] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.414] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.415] CloseHandle (hObject=0xf0) returned 1 [0058.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.416] GetLastError () returned 0x0 [0058.416] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.417] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.417] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.417] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17841832448) returned 1 [0058.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1a14790, dwHighDateTime=0x1d585b4)) [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9d50 [0058.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d50 | out: hHeap=0x260000) returned 1 [0058.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dbc8 [0058.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.418] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.418] GetLastError () returned 0x0 [0058.418] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.418] GetLastError () returned 0x0 [0058.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.434] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x78a, lpOverlapped=0x0) returned 1 [0058.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.437] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.437] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.438] CloseHandle (hObject=0xf0) returned 1 [0058.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.439] GetLastError () returned 0x0 [0058.439] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.440] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.440] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.440] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17844135976) returned 1 [0058.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1a60a50, dwHighDateTime=0x1d585b4)) [0058.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9df8 [0058.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9df8 | out: hHeap=0x260000) returned 1 [0058.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e380 [0058.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.441] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.441] GetLastError () returned 0x0 [0058.441] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.441] GetLastError () returned 0x0 [0058.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe984, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.450] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x167c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x167c, lpOverlapped=0x0) returned 1 [0058.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.453] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.454] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.454] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.454] CloseHandle (hObject=0xf0) returned 1 [0058.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3b78 [0058.459] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3b78 | out: hHeap=0x260000) returned 1 [0058.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.464] GetLastError () returned 0x0 [0058.464] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.465] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.465] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.465] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17846625975) returned 1 [0058.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1a86bb0, dwHighDateTime=0x1d585b4)) [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ea0 [0058.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ea0 | out: hHeap=0x260000) returned 1 [0058.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e548 [0058.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.466] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.466] GetLastError () returned 0x0 [0058.466] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.466] GetLastError () returned 0x0 [0058.472] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8032, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.472] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7fce, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x7fce, lpOverlapped=0x0) returned 1 [0058.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.473] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.473] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.473] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.473] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.474] CloseHandle (hObject=0x11c) returned 1 [0058.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.475] GetLastError () returned 0x0 [0058.475] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.476] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.476] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.476] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17847751378) returned 1 [0058.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1aacd10, dwHighDateTime=0x1d585b4)) [0058.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9f10 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9f10 | out: hHeap=0x260000) returned 1 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e710 [0058.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.477] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.477] GetLastError () returned 0x0 [0058.477] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.477] GetLastError () returned 0x0 [0058.480] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbfb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.480] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x4048, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x4048, lpOverlapped=0x0) returned 1 [0058.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.483] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.483] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.483] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.483] CloseHandle (hObject=0x11c) returned 1 [0058.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.485] GetLastError () returned 0x0 [0058.485] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.486] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.486] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17848702509) returned 1 [0058.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1ad2e70, dwHighDateTime=0x1d585b4)) [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9f48 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0058.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9f48 | out: hHeap=0x260000) returned 1 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e840 [0058.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.487] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.487] GetLastError () returned 0x0 [0058.487] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.487] GetLastError () returned 0x0 [0058.537] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff9d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.558] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x629, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x629, lpOverlapped=0x0) returned 1 [0058.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.566] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.566] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.566] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.566] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.567] CloseHandle (hObject=0x11c) returned 1 [0058.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.585] GetLastError () returned 0x0 [0058.585] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.587] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.587] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.587] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17858802883) returned 1 [0058.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1bb76b0, dwHighDateTime=0x1d585b4)) [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da1e8 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da1e8 | out: hHeap=0x260000) returned 1 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ad88 [0058.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.588] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.588] GetLastError () returned 0x0 [0058.588] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.588] GetLastError () returned 0x0 [0058.589] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.589] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7c08, lpOverlapped=0x0) returned 1 [0058.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.590] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.590] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.590] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.591] CloseHandle (hObject=0x11c) returned 1 [0058.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.592] GetLastError () returned 0x0 [0058.593] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.594] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.594] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.594] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17859514042) returned 1 [0058.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1bdd810, dwHighDateTime=0x1d585b4)) [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da220 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da220 | out: hHeap=0x260000) returned 1 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b080 [0058.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.595] GetLastError () returned 0x0 [0058.595] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.595] GetLastError () returned 0x0 [0058.613] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.613] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.613] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.613] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.614] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.614] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.614] CloseHandle (hObject=0x11c) returned 1 [0058.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.616] GetLastError () returned 0x0 [0058.616] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.617] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.617] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17861786129) returned 1 [0058.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1c03970, dwHighDateTime=0x1d585b4)) [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da2c8 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da2c8 | out: hHeap=0x260000) returned 1 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b118 [0058.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.618] GetLastError () returned 0x0 [0058.618] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.618] GetLastError () returned 0x0 [0058.626] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.626] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.626] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.627] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.627] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.627] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.627] CloseHandle (hObject=0x11c) returned 1 [0058.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.629] GetLastError () returned 0x0 [0058.629] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.630] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.630] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17863097336) returned 1 [0058.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1c29ad0, dwHighDateTime=0x1d585b4)) [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da338 [0058.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da338 | out: hHeap=0x260000) returned 1 [0058.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b2e0 [0058.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.631] GetLastError () returned 0x0 [0058.631] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.631] GetLastError () returned 0x0 [0058.639] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbae2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.639] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x451e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x451e, lpOverlapped=0x0) returned 1 [0058.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.639] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.640] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.640] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.641] CloseHandle (hObject=0x11c) returned 1 [0058.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.642] GetLastError () returned 0x0 [0058.642] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.643] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.643] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17864418945) returned 1 [0058.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1c4fc30, dwHighDateTime=0x1d585b4)) [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da3a8 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da3a8 | out: hHeap=0x260000) returned 1 [0058.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b410 [0058.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.644] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.644] GetLastError () returned 0x0 [0058.644] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.644] GetLastError () returned 0x0 [0058.649] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.649] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.651] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.652] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.652] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.652] CloseHandle (hObject=0x11c) returned 1 [0058.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.736] GetLastError () returned 0x0 [0058.737] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.744] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.744] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.744] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17874503305) returned 1 [0058.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1d34470, dwHighDateTime=0x1d585b4)) [0058.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da6b8 [0058.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da6b8 | out: hHeap=0x260000) returned 1 [0058.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bcf8 [0058.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.752] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.752] GetLastError () returned 0x0 [0058.753] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.753] GetLastError () returned 0x0 [0058.756] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.756] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.756] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.757] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.757] CloseHandle (hObject=0x11c) returned 1 [0058.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.758] GetLastError () returned 0x0 [0058.759] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.760] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.760] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17876130619) returned 1 [0058.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1d5a5d0, dwHighDateTime=0x1d585b4)) [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da6f0 [0058.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da6f0 | out: hHeap=0x260000) returned 1 [0058.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bc60 [0058.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.761] GetLastError () returned 0x0 [0058.761] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.761] GetLastError () returned 0x0 [0058.764] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.764] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.764] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.764] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.765] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.765] CloseHandle (hObject=0x11c) returned 1 [0058.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.766] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.767] GetLastError () returned 0x0 [0058.767] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.768] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.768] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.768] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17876885572) returned 1 [0058.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1d80730, dwHighDateTime=0x1d585b4)) [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da728 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da728 | out: hHeap=0x260000) returned 1 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29be28 [0058.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.769] GetLastError () returned 0x0 [0058.769] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.769] GetLastError () returned 0x0 [0058.771] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff7b67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.771] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8499, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x8499, lpOverlapped=0x0) returned 1 [0058.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.772] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.772] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.772] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.773] CloseHandle (hObject=0x11c) returned 1 [0058.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.776] GetLastError () returned 0x0 [0058.777] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x283ac50) returned 1 [0058.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.777] CryptReleaseContext (hProv=0x283ac50, dwFlags=0x0) returned 1 [0058.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.778] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17877864733) returned 1 [0058.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1d80730, dwHighDateTime=0x1d585b4)) [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da760 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da760 | out: hHeap=0x260000) returned 1 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bec0 [0058.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.778] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.778] GetLastError () returned 0x0 [0058.778] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.779] GetLastError () returned 0x0 [0058.782] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff9c65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.782] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x639b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x639b, lpOverlapped=0x0) returned 1 [0058.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.782] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.782] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.783] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.783] CloseHandle (hObject=0x11c) returned 1 [0058.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.784] GetLastError () returned 0x0 [0058.785] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.785] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.786] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.786] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17878681840) returned 1 [0058.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1da6890, dwHighDateTime=0x1d585b4)) [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da798 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da798 | out: hHeap=0x260000) returned 1 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bf58 [0058.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.786] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.786] GetLastError () returned 0x0 [0058.787] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.787] GetLastError () returned 0x0 [0058.864] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8170, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.865] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x7e90, lpOverlapped=0x0) returned 1 [0058.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.865] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.866] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.866] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.866] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.867] CloseHandle (hObject=0x11c) returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.869] GetLastError () returned 0x0 [0058.887] lstrlenW (lpString=".sql") returned 4 [0058.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".sql") returned 0x0 [0058.887] lstrlenW (lpString=".mdf") returned 4 [0058.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".mdf") returned 0x0 [0058.887] lstrlenW (lpString=".txt") returned 4 [0058.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".txt") returned 0x0 [0058.887] lstrlenW (lpString=".dbf") returned 4 [0058.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".dbf") returned 0x0 [0058.887] lstrlenW (lpString=".ckp") returned 4 [0058.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".ckp") returned 0x0 [0058.888] lstrlenW (lpString=".dacpac") returned 7 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".dacpac") returned 0x0 [0058.888] lstrlenW (lpString=".db3") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".db3") returned 0x0 [0058.888] lstrlenW (lpString=".dtxs") returned 5 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".dtxs") returned 0x0 [0058.888] lstrlenW (lpString=".mdt") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".mdt") returned 0x0 [0058.888] lstrlenW (lpString=".sdf") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".sdf") returned 0x0 [0058.888] lstrlenW (lpString=".MDF") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".MDF") returned 0x0 [0058.888] lstrlenW (lpString=".DBF") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".DBF") returned 0x0 [0058.888] lstrlenW (lpString=".DB") returned 3 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".DB") returned 0x0 [0058.888] lstrlenW (lpString=".db") returned 3 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".db") returned 0x0 [0058.888] lstrlenW (lpString=".ndf") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".ndf") returned 0x0 [0058.888] lstrlenW (lpString=".NDF") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".NDF") returned 0x0 [0058.888] lstrlenW (lpString=".Mdf") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".Mdf") returned 0x0 [0058.888] lstrlenW (lpString=".dat") returned 4 [0058.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".dat") returned 0x0 [0058.888] lstrlenW (lpString=".DAT") returned 4 [0058.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".DAT") returned 0x0 [0058.889] lstrlenW (lpString=".ldf") returned 4 [0058.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".ldf") returned 0x0 [0058.889] lstrlenW (lpString=".LDF") returned 4 [0058.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch=".LDF") returned 0x0 [0058.889] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0058.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0058.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a308 [0058.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0058.889] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0058.891] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.891] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0058.891] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17889225878) returned 1 [0058.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb1eb1230, dwHighDateTime=0x1d585b4)) [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da958 [0058.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da958 | out: hHeap=0x260000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bff0 [0058.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.892] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0058.893] GetLastError () returned 0x0 [0058.893] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0058.893] GetLastError () returned 0x0 [0058.936] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff827c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.936] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7d84, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x7d84, lpOverlapped=0x0) returned 1 [0058.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.937] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.937] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.938] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.938] CloseHandle (hObject=0x11c) returned 1 [0058.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.938] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0058.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.940] GetLastError () returned 0x0 [0059.085] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.086] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.086] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17908714241) returned 1 [0059.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb207a2b0, dwHighDateTime=0x1d585b4)) [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28469d8 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28469d8 | out: hHeap=0x260000) returned 1 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0059.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.087] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.087] GetLastError () returned 0x0 [0059.087] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.087] GetLastError () returned 0x0 [0059.089] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff7ee8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.089] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8118, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x8118, lpOverlapped=0x0) returned 1 [0059.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.090] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.090] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.090] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.090] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.091] CloseHandle (hObject=0xf0) returned 1 [0059.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.092] GetLastError () returned 0x0 [0059.092] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.093] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.093] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.093] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17909436572) returned 1 [0059.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb20a0410, dwHighDateTime=0x1d585b4)) [0059.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daca0 [0059.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daca0 | out: hHeap=0x260000) returned 1 [0059.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0059.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.094] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.094] GetLastError () returned 0x0 [0059.094] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.094] GetLastError () returned 0x0 [0059.096] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff3a29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.096] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xc5d7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xc5d7, lpOverlapped=0x0) returned 1 [0059.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.097] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.097] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.097] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.097] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.098] CloseHandle (hObject=0xf0) returned 1 [0059.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.099] GetLastError () returned 0x0 [0059.099] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.100] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.100] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.100] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17910112023) returned 1 [0059.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb20a0410, dwHighDateTime=0x1d585b4)) [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dacd8 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dacd8 | out: hHeap=0x260000) returned 1 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332db0 [0059.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.101] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.101] GetLastError () returned 0x0 [0059.101] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.101] GetLastError () returned 0x0 [0059.106] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff0bc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.107] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xf438, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xf438, lpOverlapped=0x0) returned 1 [0059.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.124] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.124] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.124] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.125] CloseHandle (hObject=0xf0) returned 1 [0059.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.126] GetLastError () returned 0x0 [0059.126] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.127] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.127] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.127] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17912846887) returned 1 [0059.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb20ec6d0, dwHighDateTime=0x1d585b4)) [0059.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dad80 [0059.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad80 | out: hHeap=0x260000) returned 1 [0059.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332e48 [0059.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.128] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.128] GetLastError () returned 0x0 [0059.128] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.128] GetLastError () returned 0x0 [0059.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc38a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.141] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c76, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c76, lpOverlapped=0x0) returned 1 [0059.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.141] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.142] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.142] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.142] CloseHandle (hObject=0xf0) returned 1 [0059.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.144] GetLastError () returned 0x0 [0059.144] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.145] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.145] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.145] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17914587081) returned 1 [0059.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2112830, dwHighDateTime=0x1d585b4)) [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dadf0 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dadf0 | out: hHeap=0x260000) returned 1 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333010 [0059.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.145] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.146] GetLastError () returned 0x0 [0059.146] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.146] GetLastError () returned 0x0 [0059.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb62e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.149] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x49d2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x49d2, lpOverlapped=0x0) returned 1 [0059.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.150] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.150] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.150] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.151] CloseHandle (hObject=0xf0) returned 1 [0059.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.[deadmin@cock.li].deadmin")) returned 1 [0059.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.152] GetLastError () returned 0x0 [0059.152] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.153] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.153] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17915414357) returned 1 [0059.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2112830, dwHighDateTime=0x1d585b4)) [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dae60 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dae60 | out: hHeap=0x260000) returned 1 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333140 [0059.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.154] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.154] GetLastError () returned 0x0 [0059.154] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.154] GetLastError () returned 0x0 [0059.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8bb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.181] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x7450, lpOverlapped=0x0) returned 1 [0059.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.182] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.183] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.183] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.183] CloseHandle (hObject=0xf0) returned 1 [0059.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.187] GetLastError () returned 0x0 [0059.187] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.188] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.188] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.188] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17918967868) returned 1 [0059.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2184c50, dwHighDateTime=0x1d585b4)) [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daf40 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf40 | out: hHeap=0x260000) returned 1 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333270 [0059.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.189] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.190] GetLastError () returned 0x0 [0059.190] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.190] GetLastError () returned 0x0 [0059.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcde1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.198] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x321f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x321f, lpOverlapped=0x0) returned 1 [0059.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.199] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.199] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.199] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.199] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.200] CloseHandle (hObject=0xf0) returned 1 [0059.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.201] GetLastError () returned 0x0 [0059.208] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x283ae70) returned 1 [0059.209] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.209] CryptReleaseContext (hProv=0x283ae70, dwFlags=0x0) returned 1 [0059.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.209] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17921039147) returned 1 [0059.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb21aadb0, dwHighDateTime=0x1d585b4)) [0059.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dafe8 [0059.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dafe8 | out: hHeap=0x260000) returned 1 [0059.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333568 [0059.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.210] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.210] GetLastError () returned 0x0 [0059.210] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.210] GetLastError () returned 0x0 [0059.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff10a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.281] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xef6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xef6, lpOverlapped=0x0) returned 1 [0059.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.282] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.282] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.282] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.282] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.283] CloseHandle (hObject=0xf0) returned 1 [0059.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.293] GetLastError () returned 0x0 [0059.298] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.299] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.299] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17929984361) returned 1 [0059.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb228f5f0, dwHighDateTime=0x1d585b4)) [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db100 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db100 | out: hHeap=0x260000) returned 1 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333600 [0059.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.300] GetLastError () returned 0x0 [0059.300] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.300] GetLastError () returned 0x0 [0059.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.384] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x6ec, lpOverlapped=0x0) returned 1 [0059.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.384] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.384] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.385] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.385] CloseHandle (hObject=0xf0) returned 1 [0059.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.387] GetLastError () returned 0x0 [0059.387] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.388] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.388] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.388] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17938890352) returned 1 [0059.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb234dcd0, dwHighDateTime=0x1d585b4)) [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db330 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db330 | out: hHeap=0x260000) returned 1 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3338f8 [0059.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.388] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.389] GetLastError () returned 0x0 [0059.389] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.389] GetLastError () returned 0x0 [0059.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdf20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.421] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x224fdb0*=0x20e0, lpOverlapped=0x0) returned 1 [0059.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0059.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.421] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.422] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.422] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.422] CloseHandle (hObject=0xf0) returned 1 [0059.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.422] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.423] GetLastError () returned 0x0 [0059.424] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.424] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.424] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.425] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17942575302) returned 1 [0059.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb23c00f0, dwHighDateTime=0x1d585b4)) [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d75f8 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75f8 | out: hHeap=0x260000) returned 1 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0059.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.425] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.425] GetLastError () returned 0x0 [0059.426] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.426] GetLastError () returned 0x0 [0059.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.431] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x60c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x60c, lpOverlapped=0x0) returned 1 [0059.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.432] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.432] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.432] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.433] CloseHandle (hObject=0xf0) returned 1 [0059.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.434] GetLastError () returned 0x0 [0059.435] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.435] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.435] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.436] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17943666347) returned 1 [0059.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb23c00f0, dwHighDateTime=0x1d585b4)) [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d76a0 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76a0 | out: hHeap=0x260000) returned 1 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332900 [0059.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.436] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.437] GetLastError () returned 0x0 [0059.437] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.437] GetLastError () returned 0x0 [0059.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe4fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.439] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1b04, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x1b04, lpOverlapped=0x0) returned 1 [0059.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.440] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.440] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.440] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.440] CloseHandle (hObject=0xf0) returned 1 [0059.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.442] GetLastError () returned 0x0 [0059.442] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.443] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.443] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.443] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17944409941) returned 1 [0059.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb23e6250, dwHighDateTime=0x1d585b4)) [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d76d8 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76d8 | out: hHeap=0x260000) returned 1 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332738 [0059.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.444] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.444] GetLastError () returned 0x0 [0059.444] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.444] GetLastError () returned 0x0 [0059.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffec74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.455] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x138c, lpOverlapped=0x0) returned 1 [0059.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.456] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.456] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.457] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.457] CloseHandle (hObject=0xf0) returned 1 [0059.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.459] GetLastError () returned 0x0 [0059.461] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.462] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.462] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.462] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17946355508) returned 1 [0059.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb240c3b0, dwHighDateTime=0x1d585b4)) [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7748 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7748 | out: hHeap=0x260000) returned 1 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333ee8 [0059.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.463] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.463] GetLastError () returned 0x0 [0059.463] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.463] GetLastError () returned 0x0 [0059.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff933c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.477] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x6cc4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x224fdb0*=0x6cc4, lpOverlapped=0x0) returned 1 [0059.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.480] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.481] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.481] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.481] CloseHandle (hObject=0xf0) returned 1 [0059.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.570] GetLastError () returned 0x0 [0059.601] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.611] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.611] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.611] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17961211660) returned 1 [0059.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2589170, dwHighDateTime=0x1d585b4)) [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db598 [0059.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db598 | out: hHeap=0x260000) returned 1 [0059.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334738 [0059.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.640] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.640] GetLastError () returned 0x0 [0059.640] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.641] GetLastError () returned 0x0 [0059.644] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.644] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x3b2e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x3b2e, lpOverlapped=0x0) returned 1 [0059.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.644] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.645] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.645] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.645] CloseHandle (hObject=0x11c) returned 1 [0059.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.647] GetLastError () returned 0x0 [0059.647] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.648] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.648] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.648] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17964924756) returned 1 [0059.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb25d5430, dwHighDateTime=0x1d585b4)) [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db6b0 [0059.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db6b0 | out: hHeap=0x260000) returned 1 [0059.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334440 [0059.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.649] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.649] GetLastError () returned 0x0 [0059.649] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.649] GetLastError () returned 0x0 [0059.650] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd840, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.651] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x27c0, lpOverlapped=0x0) returned 1 [0059.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.651] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.651] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.652] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.652] CloseHandle (hObject=0x11c) returned 1 [0059.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.653] GetLastError () returned 0x0 [0059.654] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.654] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.654] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.655] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17965600410) returned 1 [0059.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb25fb590, dwHighDateTime=0x1d585b4)) [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db6e8 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db6e8 | out: hHeap=0x260000) returned 1 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334868 [0059.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.656] GetLastError () returned 0x0 [0059.656] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.656] GetLastError () returned 0x0 [0059.658] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffdc74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.658] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x238c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x238c, lpOverlapped=0x0) returned 1 [0059.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.658] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.658] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.659] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.659] CloseHandle (hObject=0x11c) returned 1 [0059.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.661] GetLastError () returned 0x0 [0059.661] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.662] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.662] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.662] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17966295649) returned 1 [0059.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb25fb590, dwHighDateTime=0x1d585b4)) [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db720 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db720 | out: hHeap=0x260000) returned 1 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334900 [0059.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.663] GetLastError () returned 0x0 [0059.663] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.663] GetLastError () returned 0x0 [0059.670] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffea02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.670] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x15fe, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x15fe, lpOverlapped=0x0) returned 1 [0059.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.671] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.671] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.671] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.671] CloseHandle (hObject=0x11c) returned 1 [0059.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.672] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.673] GetLastError () returned 0x0 [0059.673] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.675] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.675] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.675] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17967652406) returned 1 [0059.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb26216f0, dwHighDateTime=0x1d585b4)) [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db790 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db790 | out: hHeap=0x260000) returned 1 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334998 [0059.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.676] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.676] GetLastError () returned 0x0 [0059.676] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.676] GetLastError () returned 0x0 [0059.678] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd160, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.678] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2ea0, lpOverlapped=0x0) returned 1 [0059.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.678] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.678] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.679] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.679] CloseHandle (hObject=0x11c) returned 1 [0059.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.681] GetLastError () returned 0x0 [0059.681] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.682] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.682] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.682] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17968289731) returned 1 [0059.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb26216f0, dwHighDateTime=0x1d585b4)) [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db7c8 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db7c8 | out: hHeap=0x260000) returned 1 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334ac8 [0059.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.682] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.683] GetLastError () returned 0x0 [0059.683] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.683] GetLastError () returned 0x0 [0059.684] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb08e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.685] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x4f72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x4f72, lpOverlapped=0x0) returned 1 [0059.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.685] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.685] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.686] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.687] CloseHandle (hObject=0x11c) returned 1 [0059.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.688] GetLastError () returned 0x0 [0059.688] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.689] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0059.689] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0059.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.689] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17969050122) returned 1 [0059.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2647850, dwHighDateTime=0x1d585b4)) [0059.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db800 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db800 | out: hHeap=0x260000) returned 1 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334b60 [0059.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.690] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.690] GetLastError () returned 0x0 [0059.690] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.690] GetLastError () returned 0x0 [0059.785] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe08c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.785] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1f74, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x1f74, lpOverlapped=0x0) returned 1 [0059.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.786] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.786] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.786] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.787] CloseHandle (hObject=0x11c) returned 1 [0059.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.796] GetLastError () returned 0x0 [0059.797] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.799] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.799] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.800] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17980143612) returned 1 [0059.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb27521f0, dwHighDateTime=0x1d585b4)) [0059.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8288 [0059.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8288 | out: hHeap=0x260000) returned 1 [0059.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c418 [0059.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.801] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.801] GetLastError () returned 0x0 [0059.801] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.801] GetLastError () returned 0x0 [0059.803] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb892, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.803] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x476e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x476e, lpOverlapped=0x0) returned 1 [0059.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.804] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.804] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.804] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.804] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.805] CloseHandle (hObject=0x11c) returned 1 [0059.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.805] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.806] GetLastError () returned 0x0 [0059.806] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.807] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.807] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.807] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17980848497) returned 1 [0059.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb27521f0, dwHighDateTime=0x1d585b4)) [0059.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b82c0 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b82c0 | out: hHeap=0x260000) returned 1 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315c28 [0059.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.808] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.808] GetLastError () returned 0x0 [0059.808] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.808] GetLastError () returned 0x0 [0059.812] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff2720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.812] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xd8e0, lpOverlapped=0x0) returned 1 [0059.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.812] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.812] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.813] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.813] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.813] CloseHandle (hObject=0x11c) returned 1 [0059.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.815] GetLastError () returned 0x0 [0059.815] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.815] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.816] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.816] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17981685218) returned 1 [0059.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2778350, dwHighDateTime=0x1d585b4)) [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b82f8 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b82f8 | out: hHeap=0x260000) returned 1 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315cc0 [0059.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.816] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.817] GetLastError () returned 0x0 [0059.817] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.817] GetLastError () returned 0x0 [0059.818] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffef348, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.819] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x10cb8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x10cb8, lpOverlapped=0x0) returned 1 [0059.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.819] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.819] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.820] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.820] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.820] CloseHandle (hObject=0x11c) returned 1 [0059.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.820] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.853] GetLastError () returned 0x0 [0059.853] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.854] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.854] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.854] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17985542292) returned 1 [0059.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb27c4610, dwHighDateTime=0x1d585b4)) [0059.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b83a0 [0059.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b83a0 | out: hHeap=0x260000) returned 1 [0059.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315d58 [0059.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.855] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.855] GetLastError () returned 0x0 [0059.855] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.855] GetLastError () returned 0x0 [0059.874] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff746a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.874] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8b96, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x224fdb0*=0x8b96, lpOverlapped=0x0) returned 1 [0059.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.874] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.875] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.875] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.875] CloseHandle (hObject=0x11c) returned 1 [0059.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0059.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0059.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.908] GetLastError () returned 0x0 [0059.908] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.909] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.909] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.909] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17991024555) returned 1 [0059.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb285cb90, dwHighDateTime=0x1d585b4)) [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8448 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8448 | out: hHeap=0x260000) returned 1 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315f20 [0059.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.911] GetLastError () returned 0x0 [0059.911] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.912] GetLastError () returned 0x0 [0059.953] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe6b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.953] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1948, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x1948, lpOverlapped=0x0) returned 1 [0059.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.954] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.954] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.955] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.955] CloseHandle (hObject=0x11c) returned 1 [0059.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.957] GetLastError () returned 0x0 [0059.990] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0059.991] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.991] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.991] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=17999205781) returned 1 [0059.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb291b270, dwHighDateTime=0x1d585b4)) [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8640 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8640 | out: hHeap=0x260000) returned 1 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3162b0 [0059.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.992] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0059.992] GetLastError () returned 0x0 [0059.992] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0059.992] GetLastError () returned 0x0 [0059.997] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.997] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x828, lpOverlapped=0x0) returned 1 [0059.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0059.998] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.998] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.999] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.999] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.999] CloseHandle (hObject=0x118) returned 1 [0060.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0060.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0060.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.004] GetLastError () returned 0x0 [0060.004] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.005] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.005] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18000606359) returned 1 [0060.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb29413d0, dwHighDateTime=0x1d585b4)) [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8678 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8678 | out: hHeap=0x260000) returned 1 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3163e0 [0060.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.006] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.006] GetLastError () returned 0x0 [0060.006] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.006] GetLastError () returned 0x0 [0060.011] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa614, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.011] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x59ec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x59ec, lpOverlapped=0x0) returned 1 [0060.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.013] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.013] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.014] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.014] CloseHandle (hObject=0x110) returned 1 [0060.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.016] GetLastError () returned 0x0 [0060.017] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.017] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.017] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.018] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18001869516) returned 1 [0060.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2967530, dwHighDateTime=0x1d585b4)) [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b86b0 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b86b0 | out: hHeap=0x260000) returned 1 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3166d8 [0060.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.018] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.018] GetLastError () returned 0x0 [0060.018] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.019] GetLastError () returned 0x0 [0060.020] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff494, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.020] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xb6c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xb6c, lpOverlapped=0x0) returned 1 [0060.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.021] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.021] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.021] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.021] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.021] CloseHandle (hObject=0x110) returned 1 [0060.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.022] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.023] GetLastError () returned 0x0 [0060.023] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.024] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.024] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18002514015) returned 1 [0060.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2967530, dwHighDateTime=0x1d585b4)) [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b86e8 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b86e8 | out: hHeap=0x260000) returned 1 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316770 [0060.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.025] GetLastError () returned 0x0 [0060.025] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.025] GetLastError () returned 0x0 [0060.026] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff538, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.026] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xac8, lpOverlapped=0x0) returned 1 [0060.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.027] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.027] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.027] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.028] CloseHandle (hObject=0x110) returned 1 [0060.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.200] GetLastError () returned 0x0 [0060.216] lstrlenW (lpString=".sql") returned 4 [0060.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".sql") returned 0x0 [0060.216] lstrlenW (lpString=".mdf") returned 4 [0060.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".mdf") returned 0x0 [0060.217] lstrlenW (lpString=".txt") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".txt") returned 0x0 [0060.217] lstrlenW (lpString=".dbf") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".dbf") returned 0x0 [0060.217] lstrlenW (lpString=".ckp") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".ckp") returned 0x0 [0060.217] lstrlenW (lpString=".dacpac") returned 7 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".dacpac") returned 0x0 [0060.217] lstrlenW (lpString=".db3") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".db3") returned 0x0 [0060.217] lstrlenW (lpString=".dtxs") returned 5 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".dtxs") returned 0x0 [0060.217] lstrlenW (lpString=".mdt") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".mdt") returned 0x0 [0060.217] lstrlenW (lpString=".sdf") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".sdf") returned 0x0 [0060.217] lstrlenW (lpString=".MDF") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".MDF") returned 0x0 [0060.217] lstrlenW (lpString=".DBF") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".DBF") returned 0x0 [0060.217] lstrlenW (lpString=".DB") returned 3 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".DB") returned 0x0 [0060.217] lstrlenW (lpString=".db") returned 3 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".db") returned 0x0 [0060.217] lstrlenW (lpString=".ndf") returned 4 [0060.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".ndf") returned 0x0 [0060.217] lstrlenW (lpString=".NDF") returned 4 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".NDF") returned 0x0 [0060.218] lstrlenW (lpString=".Mdf") returned 4 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".Mdf") returned 0x0 [0060.218] lstrlenW (lpString=".dat") returned 4 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".dat") returned 0x0 [0060.218] lstrlenW (lpString=".DAT") returned 4 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".DAT") returned 0x0 [0060.218] lstrlenW (lpString=".ldf") returned 4 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".ldf") returned 0x0 [0060.218] lstrlenW (lpString=".LDF") returned 4 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch=".LDF") returned 0x0 [0060.218] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0060.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0060.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0060.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0060.218] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.219] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.219] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.219] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18022018862) returned 1 [0060.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2b56710, dwHighDateTime=0x1d585b4)) [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ef330 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef330 | out: hHeap=0x260000) returned 1 [0060.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316808 [0060.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.220] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.220] GetLastError () returned 0x0 [0060.220] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.220] GetLastError () returned 0x0 [0060.223] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff9d4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.223] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x62b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x62b6, lpOverlapped=0x0) returned 1 [0060.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.223] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.223] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.224] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.224] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.224] CloseHandle (hObject=0xfc) returned 1 [0060.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc548 [0060.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc548 | out: hHeap=0x260000) returned 1 [0060.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.226] GetLastError () returned 0x0 [0060.227] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.227] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.228] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.228] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18022883886) returned 1 [0060.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2b56710, dwHighDateTime=0x1d585b4)) [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8988 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8988 | out: hHeap=0x260000) returned 1 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316f28 [0060.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.228] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.229] GetLastError () returned 0x0 [0060.229] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.229] GetLastError () returned 0x0 [0060.235] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff9cfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.236] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x6302, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x6302, lpOverlapped=0x0) returned 1 [0060.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.236] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.236] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.237] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.237] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.237] CloseHandle (hObject=0xfc) returned 1 [0060.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.238] GetLastError () returned 0x0 [0060.239] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0060.239] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0060.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.240] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18024072100) returned 1 [0060.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2b7c870, dwHighDateTime=0x1d585b4)) [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b89f8 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0060.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b89f8 | out: hHeap=0x260000) returned 1 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316fc0 [0060.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.240] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.240] GetLastError () returned 0x0 [0060.240] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.241] GetLastError () returned 0x0 [0060.242] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe9b88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.242] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x16478, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x16478, lpOverlapped=0x0) returned 1 [0060.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.243] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.243] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.244] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.244] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.244] CloseHandle (hObject=0xfc) returned 1 [0060.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.245] GetLastError () returned 0x0 [0060.246] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0060.246] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0060.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.247] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18024766369) returned 1 [0060.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2b7c870, dwHighDateTime=0x1d585b4)) [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8a30 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8a30 | out: hHeap=0x260000) returned 1 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3170f0 [0060.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.247] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.248] GetLastError () returned 0x0 [0060.248] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.248] GetLastError () returned 0x0 [0060.249] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe8a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.249] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1758, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x1758, lpOverlapped=0x0) returned 1 [0060.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.250] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.250] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.250] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.251] CloseHandle (hObject=0xfc) returned 1 [0060.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.252] GetLastError () returned 0x0 [0060.254] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.257] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0060.257] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0060.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.257] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18025854213) returned 1 [0060.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2ba29d0, dwHighDateTime=0x1d585b4)) [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8a68 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8a68 | out: hHeap=0x260000) returned 1 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317188 [0060.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.258] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.258] GetLastError () returned 0x0 [0060.258] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.258] GetLastError () returned 0x0 [0060.282] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffec04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.282] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x13fc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x13fc, lpOverlapped=0x0) returned 1 [0060.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.282] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.282] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.283] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.283] CloseHandle (hObject=0xfc) returned 1 [0060.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.284] GetLastError () returned 0x0 [0060.285] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.285] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.285] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.286] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18028680264) returned 1 [0060.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2beec90, dwHighDateTime=0x1d585b4)) [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8b48 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8b48 | out: hHeap=0x260000) returned 1 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317220 [0060.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.286] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.286] GetLastError () returned 0x0 [0060.287] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.287] GetLastError () returned 0x0 [0060.288] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffabc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.288] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x543a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x543a, lpOverlapped=0x0) returned 1 [0060.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.289] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.289] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.289] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.289] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.290] CloseHandle (hObject=0xfc) returned 1 [0060.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.291] GetLastError () returned 0x0 [0060.291] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.292] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.292] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.292] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18029335708) returned 1 [0060.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2beec90, dwHighDateTime=0x1d585b4)) [0060.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8b80 [0060.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8b80 | out: hHeap=0x260000) returned 1 [0060.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317480 [0060.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.293] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.293] GetLastError () returned 0x0 [0060.293] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.293] GetLastError () returned 0x0 [0060.320] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe912, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.321] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x16ee, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x16ee, lpOverlapped=0x0) returned 1 [0060.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.321] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.322] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.322] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.322] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.322] CloseHandle (hObject=0xfc) returned 1 [0060.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.324] GetLastError () returned 0x0 [0060.324] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.325] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.325] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.325] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18032615720) returned 1 [0060.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2c3af50, dwHighDateTime=0x1d585b4)) [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8c28 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8c28 | out: hHeap=0x260000) returned 1 [0060.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317518 [0060.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.326] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.326] GetLastError () returned 0x0 [0060.326] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.326] GetLastError () returned 0x0 [0060.329] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc926, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.329] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x36da, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x36da, lpOverlapped=0x0) returned 1 [0060.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.331] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.331] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.331] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.335] CloseHandle (hObject=0xfc) returned 1 [0060.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.337] GetLastError () returned 0x0 [0060.338] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.340] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.340] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.340] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18034120137) returned 1 [0060.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2c610b0, dwHighDateTime=0x1d585b4)) [0060.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8c60 [0060.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8c60 | out: hHeap=0x260000) returned 1 [0060.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3176e0 [0060.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.342] GetLastError () returned 0x0 [0060.342] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.343] GetLastError () returned 0x0 [0060.350] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc018, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.350] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x3fe8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x3fe8, lpOverlapped=0x0) returned 1 [0060.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.350] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.351] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.351] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.351] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.353] CloseHandle (hObject=0xfc) returned 1 [0060.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.354] GetLastError () returned 0x0 [0060.355] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x283bff8) returned 1 [0060.355] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.355] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.356] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18035673958) returned 1 [0060.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2c87210, dwHighDateTime=0x1d585b4)) [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8cd0 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8cd0 | out: hHeap=0x260000) returned 1 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317778 [0060.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.356] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.459] GetLastError () returned 0x0 [0060.459] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.459] GetLastError () returned 0x0 [0060.522] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd608, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.522] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x29f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x29f8, lpOverlapped=0x0) returned 1 [0060.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.522] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.522] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.523] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.523] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.523] CloseHandle (hObject=0xfc) returned 1 [0060.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.525] GetLastError () returned 0x0 [0060.525] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.526] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.526] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.526] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18052706392) returned 1 [0060.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2e2a130, dwHighDateTime=0x1d585b4)) [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9050 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9050 | out: hHeap=0x260000) returned 1 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba380 [0060.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.528] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.528] GetLastError () returned 0x0 [0060.528] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.528] GetLastError () returned 0x0 [0060.543] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffa628, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.543] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x59d8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x59d8, lpOverlapped=0x0) returned 1 [0060.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.545] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.545] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.546] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.546] CloseHandle (hObject=0xfc) returned 1 [0060.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28334f8 [0060.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28334f8 | out: hHeap=0x260000) returned 1 [0060.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.575] GetLastError () returned 0x0 [0060.576] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x283bff8) returned 1 [0060.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.576] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.577] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18057780069) returned 1 [0060.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2ec26b0, dwHighDateTime=0x1d585b4)) [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b91d8 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b91d8 | out: hHeap=0x260000) returned 1 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba4b0 [0060.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.578] GetLastError () returned 0x0 [0060.578] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.578] GetLastError () returned 0x0 [0060.588] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff9358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.588] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x6ca8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x6ca8, lpOverlapped=0x0) returned 1 [0060.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.589] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.589] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.590] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.591] CloseHandle (hObject=0xfc) returned 1 [0060.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.592] GetLastError () returned 0x0 [0060.593] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x283bff8) returned 1 [0060.593] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.594] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.594] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18059484897) returned 1 [0060.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2ee8810, dwHighDateTime=0x1d585b4)) [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9248 [0060.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9248 | out: hHeap=0x260000) returned 1 [0060.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba8d8 [0060.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.595] GetLastError () returned 0x0 [0060.595] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.595] GetLastError () returned 0x0 [0060.603] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.603] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x578, lpOverlapped=0x0) returned 1 [0060.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.605] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.605] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.606] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.606] CloseHandle (hObject=0xfc) returned 1 [0060.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28334f8 [0060.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28334f8 | out: hHeap=0x260000) returned 1 [0060.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.629] GetLastError () returned 0x0 [0060.629] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x283bff8) returned 1 [0060.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.630] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.630] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18063139462) returned 1 [0060.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb2f34ad0, dwHighDateTime=0x1d585b4)) [0060.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9328 [0060.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9328 | out: hHeap=0x260000) returned 1 [0060.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2baa08 [0060.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.631] GetLastError () returned 0x0 [0060.631] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.631] GetLastError () returned 0x0 [0060.743] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffdc58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.758] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x23a8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x224fdb0*=0x23a8, lpOverlapped=0x0) returned 1 [0060.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.764] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.774] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.818] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.819] CloseHandle (hObject=0x11c) returned 1 [0060.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.821] GetLastError () returned 0x0 [0060.821] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.822] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.822] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.822] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18082311974) returned 1 [0060.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3123cb0, dwHighDateTime=0x1d585b4)) [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c60 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c60 | out: hHeap=0x260000) returned 1 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f210 [0060.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.835] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.836] GetLastError () returned 0x0 [0060.836] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.836] GetLastError () returned 0x0 [0060.839] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff510, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.839] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xaf0, lpOverlapped=0x0) returned 1 [0060.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.840] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.841] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.841] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.842] CloseHandle (hObject=0x11c) returned 1 [0060.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0060.843] GetLastError () returned 0x0 [0060.844] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0060.845] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.845] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0060.845] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18084609629) returned 1 [0060.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3149e10, dwHighDateTime=0x1d585b4)) [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1918 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1918 | out: hHeap=0x260000) returned 1 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f0e0 [0060.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.846] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0060.846] GetLastError () returned 0x0 [0060.846] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0060.846] GetLastError () returned 0x0 [0061.029] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff598, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.029] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xa68, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xa68, lpOverlapped=0x0) returned 1 [0061.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.059] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.059] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.060] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.060] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.061] CloseHandle (hObject=0x11c) returned 1 [0061.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.062] GetLastError () returned 0x0 [0061.459] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.464] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.465] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.465] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18146587308) returned 1 [0061.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb373d510, dwHighDateTime=0x1d585b4)) [0061.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0598 [0061.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0598 | out: hHeap=0x260000) returned 1 [0061.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f3d8 [0061.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.471] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.471] GetLastError () returned 0x0 [0061.471] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.471] GetLastError () returned 0x0 [0061.474] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff6986, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.474] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x967a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x967a, lpOverlapped=0x0) returned 1 [0061.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.475] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.475] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.476] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.476] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.477] CloseHandle (hObject=0xfc) returned 1 [0061.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.478] GetLastError () returned 0x0 [0061.478] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.479] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.479] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.479] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18148054386) returned 1 [0061.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb373d510, dwHighDateTime=0x1d585b4)) [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0560 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0560 | out: hHeap=0x260000) returned 1 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f3d8 [0061.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.480] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.480] GetLastError () returned 0x0 [0061.480] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.480] GetLastError () returned 0x0 [0061.482] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd89c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.482] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2764, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x2764, lpOverlapped=0x0) returned 1 [0061.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.483] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.483] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.483] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.484] CloseHandle (hObject=0xfc) returned 1 [0061.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.485] GetLastError () returned 0x0 [0061.486] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.487] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.487] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18148809270) returned 1 [0061.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3763670, dwHighDateTime=0x1d585b4)) [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0528 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0528 | out: hHeap=0x260000) returned 1 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f340 [0061.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.488] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.488] GetLastError () returned 0x0 [0061.488] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.488] GetLastError () returned 0x0 [0061.489] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff650, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.489] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x9b0, lpOverlapped=0x0) returned 1 [0061.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.490] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.490] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.490] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.490] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.491] CloseHandle (hObject=0xfc) returned 1 [0061.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.492] GetLastError () returned 0x0 [0061.493] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.493] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.493] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18149463903) returned 1 [0061.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3763670, dwHighDateTime=0x1d585b4)) [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f04f0 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f04f0 | out: hHeap=0x260000) returned 1 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f638 [0061.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.494] GetLastError () returned 0x0 [0061.494] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.495] GetLastError () returned 0x0 [0061.496] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.496] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x634, lpOverlapped=0x0) returned 1 [0061.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.497] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.497] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.497] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.497] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.498] CloseHandle (hObject=0xfc) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.499] GetLastError () returned 0x0 [0061.499] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.500] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.500] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18150139913) returned 1 [0061.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb37897d0, dwHighDateTime=0x1d585b4)) [0061.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9c58 [0061.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9c58 | out: hHeap=0x260000) returned 1 [0061.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f5a0 [0061.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.501] GetLastError () returned 0x0 [0061.501] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.501] GetLastError () returned 0x0 [0061.554] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.554] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2734, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x2734, lpOverlapped=0x0) returned 1 [0061.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.555] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.555] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.556] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.556] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.556] CloseHandle (hObject=0xfc) returned 1 [0061.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.570] GetLastError () returned 0x0 [0061.571] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.572] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.572] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18157357755) returned 1 [0061.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3821d50, dwHighDateTime=0x1d585b4)) [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9da8 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9da8 | out: hHeap=0x260000) returned 1 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc5f0 [0061.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.573] GetLastError () returned 0x0 [0061.573] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.574] GetLastError () returned 0x0 [0061.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcc72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.576] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x338e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x338e, lpOverlapped=0x0) returned 1 [0061.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.577] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.578] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.578] CloseHandle (hObject=0xf0) returned 1 [0061.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.579] GetLastError () returned 0x0 [0061.580] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0061.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.581] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0061.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.581] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18158184982) returned 1 [0061.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3847eb0, dwHighDateTime=0x1d585b4)) [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9de0 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9de0 | out: hHeap=0x260000) returned 1 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0061.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.582] GetLastError () returned 0x0 [0061.582] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.582] GetLastError () returned 0x0 [0061.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff74a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.583] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x8b6, lpOverlapped=0x0) returned 1 [0061.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.584] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.584] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.584] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.584] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.585] CloseHandle (hObject=0xf0) returned 1 [0061.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28959e0 [0061.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28959e0 | out: hHeap=0x260000) returned 1 [0061.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.586] GetLastError () returned 0x0 [0061.587] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.588] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.588] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18158924358) returned 1 [0061.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3847eb0, dwHighDateTime=0x1d585b4)) [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9e18 [0061.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9e18 | out: hHeap=0x260000) returned 1 [0061.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc720 [0061.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.589] GetLastError () returned 0x0 [0061.589] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.589] GetLastError () returned 0x0 [0061.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff421e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.591] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xbde2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xbde2, lpOverlapped=0x0) returned 1 [0061.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.592] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.593] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.593] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.594] CloseHandle (hObject=0xf0) returned 1 [0061.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28959e0 [0061.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28959e0 | out: hHeap=0x260000) returned 1 [0061.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.595] GetLastError () returned 0x0 [0061.595] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.596] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.596] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18160005001) returned 1 [0061.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb386e010, dwHighDateTime=0x1d585b4)) [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9e50 [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9e50 | out: hHeap=0x260000) returned 1 [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc7b8 [0061.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.600] GetLastError () returned 0x0 [0061.600] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.600] GetLastError () returned 0x0 [0061.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe2a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.697] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1d5e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x1d5e, lpOverlapped=0x0) returned 1 [0061.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.736] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.736] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.736] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.737] CloseHandle (hObject=0xf0) returned 1 [0061.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.854] GetLastError () returned 0x0 [0061.854] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.855] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.855] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.855] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18185615008) returned 1 [0061.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3af5770, dwHighDateTime=0x1d585b4)) [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0758 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0758 | out: hHeap=0x260000) returned 1 [0061.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fd58 [0061.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.856] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.856] GetLastError () returned 0x0 [0061.856] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.856] GetLastError () returned 0x0 [0061.860] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdebe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.860] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2142, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x2142, lpOverlapped=0x0) returned 1 [0061.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.861] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.861] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.862] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.862] CloseHandle (hObject=0xf0) returned 1 [0061.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.863] GetLastError () returned 0x0 [0061.864] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.865] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.865] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.865] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18186595435) returned 1 [0061.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3af5770, dwHighDateTime=0x1d585b4)) [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0720 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0720 | out: hHeap=0x260000) returned 1 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f768 [0061.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.866] GetLastError () returned 0x0 [0061.866] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.866] GetLastError () returned 0x0 [0061.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff9340, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.868] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x6cc0, lpOverlapped=0x0) returned 1 [0061.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.869] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.869] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.870] CloseHandle (hObject=0xf0) returned 1 [0061.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.871] GetLastError () returned 0x0 [0061.872] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.872] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.873] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18187381930) returned 1 [0061.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3b1b8d0, dwHighDateTime=0x1d585b4)) [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f06e8 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f06e8 | out: hHeap=0x260000) returned 1 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fb90 [0061.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.874] GetLastError () returned 0x0 [0061.874] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.874] GetLastError () returned 0x0 [0061.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff83b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.876] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7c4a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x7c4a, lpOverlapped=0x0) returned 1 [0061.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.876] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.877] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.877] CloseHandle (hObject=0xf0) returned 1 [0061.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.879] GetLastError () returned 0x0 [0061.880] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.880] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.880] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.881] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18188170443) returned 1 [0061.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3b1b8d0, dwHighDateTime=0x1d585b4)) [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f06b0 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f06b0 | out: hHeap=0x260000) returned 1 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31faf8 [0061.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.881] GetLastError () returned 0x0 [0061.882] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.882] GetLastError () returned 0x0 [0061.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.930] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x8e0, lpOverlapped=0x0) returned 1 [0061.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.933] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.934] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.934] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.934] CloseHandle (hObject=0xf0) returned 1 [0061.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0061.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0061.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.955] GetLastError () returned 0x0 [0061.956] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.956] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.956] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.957] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18195769337) returned 1 [0061.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3bd9fb0, dwHighDateTime=0x1d585b4)) [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7550 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7550 | out: hHeap=0x260000) returned 1 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd268 [0061.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.957] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.957] GetLastError () returned 0x0 [0061.958] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.958] GetLastError () returned 0x0 [0061.960] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.960] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2e4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2e4, lpOverlapped=0x0) returned 1 [0061.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.961] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.961] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.961] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.961] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.962] CloseHandle (hObject=0x118) returned 1 [0061.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0061.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.[deadmin@cock.li].deadmin")) returned 1 [0061.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0061.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.963] GetLastError () returned 0x0 [0061.964] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.965] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.965] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18196586157) returned 1 [0061.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3c00110, dwHighDateTime=0x1d585b4)) [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7588 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7588 | out: hHeap=0x260000) returned 1 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd4c8 [0061.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.982] GetLastError () returned 0x0 [0061.983] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.984] GetLastError () returned 0x0 [0061.984] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.984] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x16b, lpOverlapped=0x0) returned 1 [0061.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.986] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.986] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.987] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.987] CloseHandle (hObject=0x118) returned 1 [0061.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0061.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.[deadmin@cock.li].deadmin")) returned 1 [0061.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0061.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.991] GetLastError () returned 0x0 [0061.991] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.992] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.992] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.992] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18199320363) returned 1 [0061.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3c26270, dwHighDateTime=0x1d585b4)) [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d75c0 [0061.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75c0 | out: hHeap=0x260000) returned 1 [0061.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd560 [0061.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.993] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0061.993] GetLastError () returned 0x0 [0061.993] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0061.993] GetLastError () returned 0x0 [0061.994] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.994] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x167, lpOverlapped=0x0) returned 1 [0061.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.995] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.995] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.996] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.996] CloseHandle (hObject=0x118) returned 1 [0061.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0061.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.[deadmin@cock.li].deadmin")) returned 1 [0061.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0061.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0061.998] GetLastError () returned 0x0 [0061.998] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0061.999] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.999] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0061.999] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18200023299) returned 1 [0061.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3c4c3d0, dwHighDateTime=0x1d585b4)) [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b10 [0061.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0062.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd5f8 [0062.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.000] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.000] GetLastError () returned 0x0 [0062.000] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.000] GetLastError () returned 0x0 [0062.001] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.001] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x19a, lpOverlapped=0x0) returned 1 [0062.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.002] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.002] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.002] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.002] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.003] CloseHandle (hObject=0x118) returned 1 [0062.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.004] GetLastError () returned 0x0 [0062.004] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.005] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.005] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18200649962) returned 1 [0062.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3c4c3d0, dwHighDateTime=0x1d585b4)) [0062.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294aa0 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd690 [0062.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.006] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.006] GetLastError () returned 0x0 [0062.006] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.006] GetLastError () returned 0x0 [0062.007] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffeb3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.007] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x14d, lpOverlapped=0x0) returned 1 [0062.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.008] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.008] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.008] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.008] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.009] CloseHandle (hObject=0x118) returned 1 [0062.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.150] GetLastError () returned 0x0 [0062.150] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.155] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.155] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.155] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18215652622) returned 1 [0062.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3dc9190, dwHighDateTime=0x1d585b4)) [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351418 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351418 | out: hHeap=0x260000) returned 1 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd728 [0062.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.156] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.156] GetLastError () returned 0x0 [0062.157] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.157] GetLastError () returned 0x0 [0062.159] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.159] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x1ab, lpOverlapped=0x0) returned 1 [0062.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.160] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.160] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.161] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.161] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.161] CloseHandle (hObject=0xfc) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.163] GetLastError () returned 0x0 [0062.163] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.164] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.164] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.164] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18216533381) returned 1 [0062.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3dc9190, dwHighDateTime=0x1d585b4)) [0062.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351450 [0062.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351450 | out: hHeap=0x260000) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdbe8 [0062.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.165] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.165] GetLastError () returned 0x0 [0062.165] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.165] GetLastError () returned 0x0 [0062.166] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.166] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x255, lpOverlapped=0x0) returned 1 [0062.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.167] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.167] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.167] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.168] CloseHandle (hObject=0xfc) returned 1 [0062.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.169] GetLastError () returned 0x0 [0062.176] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.177] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.177] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.177] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18217840854) returned 1 [0062.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3def2f0, dwHighDateTime=0x1d585b4)) [0062.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2899a90 [0062.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2899a90 | out: hHeap=0x260000) returned 1 [0062.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdc80 [0062.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.178] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.178] GetLastError () returned 0x0 [0062.178] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.178] GetLastError () returned 0x0 [0062.181] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.181] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2a7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2a7, lpOverlapped=0x0) returned 1 [0062.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.181] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.182] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.182] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.183] CloseHandle (hObject=0x118) returned 1 [0062.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.184] GetLastError () returned 0x0 [0062.184] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.185] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.185] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.185] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18218663638) returned 1 [0062.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e15450, dwHighDateTime=0x1d585b4)) [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3514c0 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3514c0 | out: hHeap=0x260000) returned 1 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdd18 [0062.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.186] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.186] GetLastError () returned 0x0 [0062.187] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.187] GetLastError () returned 0x0 [0062.188] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.188] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2ad, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2ad, lpOverlapped=0x0) returned 1 [0062.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.188] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.188] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.189] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.189] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.192] CloseHandle (hObject=0x118) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.194] GetLastError () returned 0x0 [0062.194] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.195] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.195] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.195] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18219590871) returned 1 [0062.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e15450, dwHighDateTime=0x1d585b4)) [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3514f8 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3514f8 | out: hHeap=0x260000) returned 1 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bddb0 [0062.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.196] GetLastError () returned 0x0 [0062.196] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.196] GetLastError () returned 0x0 [0062.197] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.197] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x161, lpOverlapped=0x0) returned 1 [0062.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.198] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.198] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.198] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.199] CloseHandle (hObject=0x118) returned 1 [0062.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.200] GetLastError () returned 0x0 [0062.201] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.202] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.202] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18220300049) returned 1 [0062.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e3b5b0, dwHighDateTime=0x1d585b4)) [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351530 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351530 | out: hHeap=0x260000) returned 1 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bde48 [0062.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.203] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.203] GetLastError () returned 0x0 [0062.203] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.203] GetLastError () returned 0x0 [0062.204] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe11, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.204] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1ef, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x1ef, lpOverlapped=0x0) returned 1 [0062.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.205] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.206] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.206] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.206] CloseHandle (hObject=0x118) returned 1 [0062.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.208] GetLastError () returned 0x0 [0062.208] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.209] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.209] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.209] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18221017897) returned 1 [0062.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e3b5b0, dwHighDateTime=0x1d585b4)) [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351568 [0062.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351568 | out: hHeap=0x260000) returned 1 [0062.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdee0 [0062.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.210] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.210] GetLastError () returned 0x0 [0062.210] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.210] GetLastError () returned 0x0 [0062.212] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.212] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x37e, lpOverlapped=0x0) returned 1 [0062.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.213] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.213] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.214] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.214] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.214] CloseHandle (hObject=0x118) returned 1 [0062.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896660 [0062.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896660 | out: hHeap=0x260000) returned 1 [0062.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.216] GetLastError () returned 0x0 [0062.217] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.218] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.218] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18221906945) returned 1 [0062.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e61710, dwHighDateTime=0x1d585b4)) [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3515a0 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3515a0 | out: hHeap=0x260000) returned 1 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdf78 [0062.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.219] GetLastError () returned 0x0 [0062.219] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.219] GetLastError () returned 0x0 [0062.220] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.220] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2bc, lpOverlapped=0x0) returned 1 [0062.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.221] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.221] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.221] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.221] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.222] CloseHandle (hObject=0x118) returned 1 [0062.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896660 [0062.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896660 | out: hHeap=0x260000) returned 1 [0062.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.223] GetLastError () returned 0x0 [0062.223] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.224] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.224] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.224] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18222549955) returned 1 [0062.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e61710, dwHighDateTime=0x1d585b4)) [0062.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3515d8 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3515d8 | out: hHeap=0x260000) returned 1 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be010 [0062.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.225] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.225] GetLastError () returned 0x0 [0062.225] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.225] GetLastError () returned 0x0 [0062.226] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.227] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x13e, lpOverlapped=0x0) returned 1 [0062.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.227] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.227] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.228] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.228] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.228] CloseHandle (hObject=0x118) returned 1 [0062.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896660 [0062.228] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896660 | out: hHeap=0x260000) returned 1 [0062.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.230] GetLastError () returned 0x0 [0062.230] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.231] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.231] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.231] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18223215842) returned 1 [0062.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e87870, dwHighDateTime=0x1d585b4)) [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351610 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351610 | out: hHeap=0x260000) returned 1 [0062.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be0a8 [0062.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.232] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.232] GetLastError () returned 0x0 [0062.232] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.232] GetLastError () returned 0x0 [0062.233] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffdb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.233] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x250, lpOverlapped=0x0) returned 1 [0062.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.234] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.234] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.234] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.234] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.235] CloseHandle (hObject=0x118) returned 1 [0062.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896660 [0062.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896660 | out: hHeap=0x260000) returned 1 [0062.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.236] GetLastError () returned 0x0 [0062.237] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.237] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.238] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18223875521) returned 1 [0062.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3e87870, dwHighDateTime=0x1d585b4)) [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351648 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351648 | out: hHeap=0x260000) returned 1 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b2e0 [0062.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.238] GetLastError () returned 0x0 [0062.239] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.239] GetLastError () returned 0x0 [0062.240] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.240] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2a9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2a9, lpOverlapped=0x0) returned 1 [0062.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.240] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.240] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.241] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.241] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.241] CloseHandle (hObject=0x118) returned 1 [0062.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896660 [0062.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896660 | out: hHeap=0x260000) returned 1 [0062.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.243] GetLastError () returned 0x0 [0062.243] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.244] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.244] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.244] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18224563573) returned 1 [0062.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ead9d0, dwHighDateTime=0x1d585b4)) [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351680 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351680 | out: hHeap=0x260000) returned 1 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353300 [0062.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.245] GetLastError () returned 0x0 [0062.245] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.246] GetLastError () returned 0x0 [0062.247] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdf8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.248] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2076, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2076, lpOverlapped=0x0) returned 1 [0062.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.248] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.248] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.249] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.249] CloseHandle (hObject=0x118) returned 1 [0062.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896660 [0062.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896660 | out: hHeap=0x260000) returned 1 [0062.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.251] GetLastError () returned 0x0 [0062.252] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.253] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.253] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.253] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18225393351) returned 1 [0062.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ead9d0, dwHighDateTime=0x1d585b4)) [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3516b8 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3516b8 | out: hHeap=0x260000) returned 1 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353398 [0062.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.254] GetLastError () returned 0x0 [0062.254] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.254] GetLastError () returned 0x0 [0062.255] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.255] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x172, lpOverlapped=0x0) returned 1 [0062.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.255] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.255] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.256] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.256] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.257] CloseHandle (hObject=0x118) returned 1 [0062.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896728 [0062.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896728 | out: hHeap=0x260000) returned 1 [0062.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.258] GetLastError () returned 0x0 [0062.259] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.259] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.259] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.260] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18226084002) returned 1 [0062.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ed3b30, dwHighDateTime=0x1d585b4)) [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3516f0 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3516f0 | out: hHeap=0x260000) returned 1 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353430 [0062.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.260] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.261] GetLastError () returned 0x0 [0062.261] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.261] GetLastError () returned 0x0 [0062.262] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff767, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.262] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x899, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x899, lpOverlapped=0x0) returned 1 [0062.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.263] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.263] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.263] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.263] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.264] CloseHandle (hObject=0x118) returned 1 [0062.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896728 [0062.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896728 | out: hHeap=0x260000) returned 1 [0062.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.265] GetLastError () returned 0x0 [0062.265] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.266] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.266] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.266] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18226752270) returned 1 [0062.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ed3b30, dwHighDateTime=0x1d585b4)) [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351728 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351728 | out: hHeap=0x260000) returned 1 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3534c8 [0062.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.267] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.267] GetLastError () returned 0x0 [0062.267] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.267] GetLastError () returned 0x0 [0062.268] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.268] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2c3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2c3, lpOverlapped=0x0) returned 1 [0062.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.269] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.270] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.270] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.270] CloseHandle (hObject=0x118) returned 1 [0062.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896728 [0062.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896728 | out: hHeap=0x260000) returned 1 [0062.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.272] GetLastError () returned 0x0 [0062.272] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.273] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.273] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.273] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18227394038) returned 1 [0062.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ed3b30, dwHighDateTime=0x1d585b4)) [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351760 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351760 | out: hHeap=0x260000) returned 1 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353560 [0062.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.274] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.274] GetLastError () returned 0x0 [0062.274] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.274] GetLastError () returned 0x0 [0062.275] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffdad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.275] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x253, lpOverlapped=0x0) returned 1 [0062.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.276] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.276] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.276] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.276] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.277] CloseHandle (hObject=0x118) returned 1 [0062.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896728 [0062.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896728 | out: hHeap=0x260000) returned 1 [0062.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.278] GetLastError () returned 0x0 [0062.278] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.279] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.279] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.279] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18228042128) returned 1 [0062.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ef9c90, dwHighDateTime=0x1d585b4)) [0062.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351798 [0062.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351798 | out: hHeap=0x260000) returned 1 [0062.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3535f8 [0062.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.280] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.280] GetLastError () returned 0x0 [0062.280] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.280] GetLastError () returned 0x0 [0062.282] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffb2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.282] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x4d5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x4d5, lpOverlapped=0x0) returned 1 [0062.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.282] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.282] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.283] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.283] CloseHandle (hObject=0x118) returned 1 [0062.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896728 [0062.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896728 | out: hHeap=0x260000) returned 1 [0062.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.285] GetLastError () returned 0x0 [0062.285] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.286] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.286] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18228734993) returned 1 [0062.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3ef9c90, dwHighDateTime=0x1d585b4)) [0062.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3517d0 [0062.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3517d0 | out: hHeap=0x260000) returned 1 [0062.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353690 [0062.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.287] GetLastError () returned 0x0 [0062.287] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.287] GetLastError () returned 0x0 [0062.289] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffce1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.289] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x31f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x31f, lpOverlapped=0x0) returned 1 [0062.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.290] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.290] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.291] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.291] CloseHandle (hObject=0x118) returned 1 [0062.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896728 [0062.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896728 | out: hHeap=0x260000) returned 1 [0062.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.293] GetLastError () returned 0x0 [0062.293] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.294] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.294] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.294] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18229494733) returned 1 [0062.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3f1fdf0, dwHighDateTime=0x1d585b4)) [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351808 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351808 | out: hHeap=0x260000) returned 1 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353728 [0062.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.295] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.295] GetLastError () returned 0x0 [0062.295] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.295] GetLastError () returned 0x0 [0062.296] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.297] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0062.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.297] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.297] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.298] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.298] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.298] CloseHandle (hObject=0x118) returned 1 [0062.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.299] GetLastError () returned 0x0 [0062.300] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.301] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.301] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.301] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18230237817) returned 1 [0062.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb3f1fdf0, dwHighDateTime=0x1d585b4)) [0062.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351840 [0062.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351840 | out: hHeap=0x260000) returned 1 [0062.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3537c0 [0062.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.302] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.302] GetLastError () returned 0x0 [0062.302] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.302] GetLastError () returned 0x0 [0062.380] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.392] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2e2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2e2, lpOverlapped=0x0) returned 1 [0062.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.403] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.403] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.404] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.404] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.404] CloseHandle (hObject=0x118) returned 1 [0062.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.406] GetLastError () returned 0x0 [0062.407] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.407] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.407] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.408] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18240868280) returned 1 [0062.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb402a790, dwHighDateTime=0x1d585b4)) [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351b88 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351b88 | out: hHeap=0x260000) returned 1 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353858 [0062.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.408] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.408] GetLastError () returned 0x0 [0062.408] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.409] GetLastError () returned 0x0 [0062.410] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff5ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.410] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xa16, lpOverlapped=0x0) returned 1 [0062.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.411] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.411] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.411] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.411] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.412] CloseHandle (hObject=0x118) returned 1 [0062.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.[deadmin@cock.li].deadmin")) returned 1 [0062.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.413] GetLastError () returned 0x0 [0062.414] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.414] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.414] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.415] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18241570278) returned 1 [0062.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb402a790, dwHighDateTime=0x1d585b4)) [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351bc0 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351bc0 | out: hHeap=0x260000) returned 1 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354140 [0062.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.415] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.415] GetLastError () returned 0x0 [0062.416] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.416] GetLastError () returned 0x0 [0062.417] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff68a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.417] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x976, lpOverlapped=0x0) returned 1 [0062.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.418] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.418] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.418] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.419] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.419] CloseHandle (hObject=0x118) returned 1 [0062.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.[deadmin@cock.li].deadmin")) returned 1 [0062.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.420] GetLastError () returned 0x0 [0062.421] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.421] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.421] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.422] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18242270583) returned 1 [0062.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb40508f0, dwHighDateTime=0x1d585b4)) [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351bf8 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351bf8 | out: hHeap=0x260000) returned 1 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3541d8 [0062.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.422] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.422] GetLastError () returned 0x0 [0062.423] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.423] GetLastError () returned 0x0 [0062.424] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe4fd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.424] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1b03, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x1b03, lpOverlapped=0x0) returned 1 [0062.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.425] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.425] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.426] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.426] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.426] CloseHandle (hObject=0x118) returned 1 [0062.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0062.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.427] GetLastError () returned 0x0 [0062.428] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.429] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.429] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0062.429] WriteFile (in: hFile=0x118, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0062.430] CloseHandle (hObject=0x118) returned 1 [0062.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336dd0 | out: hHeap=0x260000) returned 1 [0062.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336d18 | out: hHeap=0x260000) returned 1 [0062.430] RtlWakeConditionVariable () returned 0x27e828 [0062.430] GetCurrentThreadId () returned 0x98c [0062.431] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.432] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.432] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.432] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18243337312) returned 1 [0062.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4076a50, dwHighDateTime=0x1d585b4)) [0062.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0bb8 [0062.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0bb8 | out: hHeap=0x260000) returned 1 [0062.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0062.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.433] GetLastError () returned 0x0 [0062.433] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.433] GetLastError () returned 0x0 [0062.435] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff089, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.435] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xf77, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xf77, lpOverlapped=0x0) returned 1 [0062.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.435] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.435] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.436] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.436] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.436] CloseHandle (hObject=0x118) returned 1 [0062.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.438] GetLastError () returned 0x0 [0062.438] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.439] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.439] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.439] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18244023179) returned 1 [0062.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4076a50, dwHighDateTime=0x1d585b4)) [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b80 [0062.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b80 | out: hHeap=0x260000) returned 1 [0062.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0062.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.440] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.440] GetLastError () returned 0x0 [0062.440] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.440] GetLastError () returned 0x0 [0062.441] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffffd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.441] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2f, lpOverlapped=0x0) returned 1 [0062.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.442] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.442] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.442] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.442] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.443] CloseHandle (hObject=0x118) returned 1 [0062.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.448] GetLastError () returned 0x0 [0062.449] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.450] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.450] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.450] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18245104809) returned 1 [0062.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb409cbb0, dwHighDateTime=0x1d585b4)) [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b48 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b48 | out: hHeap=0x260000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0062.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.451] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.451] GetLastError () returned 0x0 [0062.451] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.451] GetLastError () returned 0x0 [0062.452] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.452] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2dd, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x2dd, lpOverlapped=0x0) returned 1 [0062.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.453] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.453] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.454] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.454] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.454] CloseHandle (hObject=0x118) returned 1 [0062.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.458] GetLastError () returned 0x0 [0062.458] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.459] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.459] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18246029653) returned 1 [0062.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb409cbb0, dwHighDateTime=0x1d585b4)) [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b10 [0062.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b10 | out: hHeap=0x260000) returned 1 [0062.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0062.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.460] GetLastError () returned 0x0 [0062.460] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.460] GetLastError () returned 0x0 [0062.462] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffa6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.462] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x595, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x595, lpOverlapped=0x0) returned 1 [0062.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.463] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.463] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.464] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.464] CloseHandle (hObject=0x118) returned 1 [0062.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.465] GetLastError () returned 0x0 [0062.466] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.467] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.467] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.467] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18246834673) returned 1 [0062.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb40c2d10, dwHighDateTime=0x1d585b4)) [0062.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0ad8 [0062.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0ad8 | out: hHeap=0x260000) returned 1 [0062.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0062.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.468] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.468] GetLastError () returned 0x0 [0062.468] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.468] GetLastError () returned 0x0 [0062.470] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffee2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.470] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x11d1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x11d1, lpOverlapped=0x0) returned 1 [0062.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.471] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.471] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.471] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.471] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.472] CloseHandle (hObject=0x118) returned 1 [0062.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.473] GetLastError () returned 0x0 [0062.473] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.474] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.474] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18247548501) returned 1 [0062.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb40c2d10, dwHighDateTime=0x1d585b4)) [0062.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0aa0 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0aa0 | out: hHeap=0x260000) returned 1 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333730 [0062.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.475] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.475] GetLastError () returned 0x0 [0062.475] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.475] GetLastError () returned 0x0 [0062.559] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffecdd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.566] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1323, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x1323, lpOverlapped=0x0) returned 1 [0062.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.583] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.583] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.583] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.584] CloseHandle (hObject=0x118) returned 1 [0062.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.585] GetLastError () returned 0x0 [0062.585] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.586] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.586] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18258750136) returned 1 [0062.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb41cd6b0, dwHighDateTime=0x1d585b4)) [0062.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351d10 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351d10 | out: hHeap=0x260000) returned 1 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.587] GetLastError () returned 0x0 [0062.588] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.588] GetLastError () returned 0x0 [0062.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffaea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.590] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x516, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x516, lpOverlapped=0x0) returned 1 [0062.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.590] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.590] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.591] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.591] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.591] CloseHandle (hObject=0x118) returned 1 [0062.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.592] GetLastError () returned 0x0 [0062.593] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.593] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.594] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.594] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18259483551) returned 1 [0062.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb41f3810, dwHighDateTime=0x1d585b4)) [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351d48 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351d48 | out: hHeap=0x260000) returned 1 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.594] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.595] GetLastError () returned 0x0 [0062.595] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.595] GetLastError () returned 0x0 [0062.599] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffd03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.599] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2fd, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x2fd, lpOverlapped=0x0) returned 1 [0062.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.600] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.600] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.600] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.600] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.601] CloseHandle (hObject=0x118) returned 1 [0062.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0062.629] GetLastError () returned 0x0 [0062.634] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.635] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.635] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.635] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18263639422) returned 1 [0062.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4265c30, dwHighDateTime=0x1d585b4)) [0062.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351e98 [0062.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351e98 | out: hHeap=0x260000) returned 1 [0062.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.636] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.636] GetLastError () returned 0x0 [0062.636] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.636] GetLastError () returned 0x0 [0062.641] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff681, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.641] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x97f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x97f, lpOverlapped=0x0) returned 1 [0062.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.642] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.642] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.642] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.642] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.643] CloseHandle (hObject=0x118) returned 1 [0062.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.644] GetLastError () returned 0x0 [0062.644] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.645] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.645] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.645] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18264660317) returned 1 [0062.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4265c30, dwHighDateTime=0x1d585b4)) [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351ed0 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351ed0 | out: hHeap=0x260000) returned 1 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcb48 [0062.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.646] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.646] GetLastError () returned 0x0 [0062.646] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.647] GetLastError () returned 0x0 [0062.648] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffa87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.648] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x579, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x579, lpOverlapped=0x0) returned 1 [0062.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.649] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.649] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.649] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.650] CloseHandle (hObject=0x118) returned 1 [0062.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.651] GetLastError () returned 0x0 [0062.652] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.652] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.652] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.653] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18265377064) returned 1 [0062.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb428bd90, dwHighDateTime=0x1d585b4)) [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351f08 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351f08 | out: hHeap=0x260000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.653] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.654] GetLastError () returned 0x0 [0062.654] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.654] GetLastError () returned 0x0 [0062.673] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb544, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.673] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4abc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x4abc, lpOverlapped=0x0) returned 1 [0062.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.673] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.673] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.674] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.674] CloseHandle (hObject=0x118) returned 1 [0062.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0062.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0062.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.679] GetLastError () returned 0x0 [0062.680] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.680] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.680] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.681] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18268167760) returned 1 [0062.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb42b1ef0, dwHighDateTime=0x1d585b4)) [0062.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351f40 [0062.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351f40 | out: hHeap=0x260000) returned 1 [0062.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.682] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.682] GetLastError () returned 0x0 [0062.682] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.682] GetLastError () returned 0x0 [0062.685] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe9ad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.685] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1653, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x1653, lpOverlapped=0x0) returned 1 [0062.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.686] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.686] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.686] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.687] CloseHandle (hObject=0x100) returned 1 [0062.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0062.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0062.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.689] GetLastError () returned 0x0 [0062.689] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.690] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.690] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.690] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18269110798) returned 1 [0062.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb42d8050, dwHighDateTime=0x1d585b4)) [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351f78 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351f78 | out: hHeap=0x260000) returned 1 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.691] GetLastError () returned 0x0 [0062.691] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.691] GetLastError () returned 0x0 [0062.693] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffec95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.693] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x136b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x136b, lpOverlapped=0x0) returned 1 [0062.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.693] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.693] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.694] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.694] CloseHandle (hObject=0x100) returned 1 [0062.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0062.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0062.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.696] GetLastError () returned 0x0 [0062.696] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.697] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.697] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18269845501) returned 1 [0062.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb42fe1b0, dwHighDateTime=0x1d585b4)) [0062.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0062.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0062.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351fb0 [0062.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351fb0 | out: hHeap=0x260000) returned 1 [0062.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.698] GetLastError () returned 0x0 [0062.698] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.698] GetLastError () returned 0x0 [0062.700] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff43c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.700] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xbc4, lpOverlapped=0x0) returned 1 [0062.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.700] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.701] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.701] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.701] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.702] CloseHandle (hObject=0x100) returned 1 [0062.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0062.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0062.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.703] GetLastError () returned 0x0 [0062.703] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.703] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.703] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0062.703] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0062.705] CloseHandle (hObject=0x100) returned 1 [0062.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29efe0 | out: hHeap=0x260000) returned 1 [0062.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.705] RtlWakeConditionVariable () returned 0x27e828 [0062.705] GetCurrentThreadId () returned 0x98c [0062.705] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.705] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.705] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0062.705] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0062.707] CloseHandle (hObject=0x100) returned 1 [0062.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x358528 | out: hHeap=0x260000) returned 1 [0062.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336d18 | out: hHeap=0x260000) returned 1 [0062.707] RtlWakeConditionVariable () returned 0x27e828 [0062.707] GetCurrentThreadId () returned 0x98c [0062.707] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.707] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0062.707] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0062.707] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0062.709] CloseHandle (hObject=0x100) returned 1 [0062.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.709] RtlWakeConditionVariable () returned 0x27e828 [0062.709] GetCurrentThreadId () returned 0x98c [0062.710] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.711] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.711] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.711] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18271212137) returned 1 [0062.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb42fe1b0, dwHighDateTime=0x1d585b4)) [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1168 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1168 | out: hHeap=0x260000) returned 1 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0062.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.712] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.712] GetLastError () returned 0x0 [0062.712] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.721] GetLastError () returned 0x0 [0062.723] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff2f56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.723] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xd0aa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xd0aa, lpOverlapped=0x0) returned 1 [0062.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.724] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.724] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.724] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.724] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.725] CloseHandle (hObject=0x100) returned 1 [0062.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.728] GetLastError () returned 0x0 [0062.729] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0062.730] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.730] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.730] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18273138375) returned 1 [0062.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb434a470, dwHighDateTime=0x1d585b4)) [0062.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1130 [0062.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1130 | out: hHeap=0x260000) returned 1 [0062.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321e88 [0062.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.731] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.731] GetLastError () returned 0x0 [0062.731] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.731] GetLastError () returned 0x0 [0062.734] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.734] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.736] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.736] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.737] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.737] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.737] CloseHandle (hObject=0x100) returned 1 [0062.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.803] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.804] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.805] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.805] GetLastError () returned 0x0 [0062.808] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffea5aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.808] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x15a56, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x15a56, lpOverlapped=0x0) returned 1 [0062.809] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.809] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.809] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.810] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.810] CloseHandle (hObject=0x118) returned 1 [0062.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3ee8 [0062.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3ee8 | out: hHeap=0x260000) returned 1 [0062.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.811] GetLastError () returned 0x0 [0062.812] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.813] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.813] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.813] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18281406394) returned 1 [0062.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4408b50, dwHighDateTime=0x1d585b4)) [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f38 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f38 | out: hHeap=0x260000) returned 1 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321df0 [0062.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.814] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.814] GetLastError () returned 0x0 [0062.814] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.814] GetLastError () returned 0x0 [0062.817] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.817] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.819] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.819] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.820] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.820] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.821] CloseHandle (hObject=0x118) returned 1 [0062.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.822] GetLastError () returned 0x0 [0062.823] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.824] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.824] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.824] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18282512589) returned 1 [0062.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb442ecb0, dwHighDateTime=0x1d585b4)) [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0ec8 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0ec8 | out: hHeap=0x260000) returned 1 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321af8 [0062.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.825] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.825] GetLastError () returned 0x0 [0062.825] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.825] GetLastError () returned 0x0 [0062.842] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffef09f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.842] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x10f61, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x10f61, lpOverlapped=0x0) returned 1 [0062.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.843] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.843] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.844] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.844] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.845] CloseHandle (hObject=0x118) returned 1 [0062.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.846] GetLastError () returned 0x0 [0062.847] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.848] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.848] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.848] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18284908480) returned 1 [0062.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4454e10, dwHighDateTime=0x1d585b4)) [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e90 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0062.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e90 | out: hHeap=0x260000) returned 1 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0062.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3219c8 [0062.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.849] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.849] GetLastError () returned 0x0 [0062.849] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.849] GetLastError () returned 0x0 [0062.851] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff3d88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.851] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xc278, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xc278, lpOverlapped=0x0) returned 1 [0062.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.852] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.852] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.852] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.852] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.853] CloseHandle (hObject=0x118) returned 1 [0062.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.853] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.854] GetLastError () returned 0x0 [0062.855] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897988) returned 1 [0062.856] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.856] CryptReleaseContext (hProv=0x2897988, dwFlags=0x0) returned 1 [0062.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.856] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18285712486) returned 1 [0062.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb447af70, dwHighDateTime=0x1d585b4)) [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e58 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e58 | out: hHeap=0x260000) returned 1 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321930 [0062.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.857] GetLastError () returned 0x0 [0062.857] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.857] GetLastError () returned 0x0 [0062.859] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff28b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.859] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xd748, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xd748, lpOverlapped=0x0) returned 1 [0062.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.860] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.860] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.860] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.860] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.861] CloseHandle (hObject=0x118) returned 1 [0062.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.861] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.862] GetLastError () returned 0x0 [0062.863] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.864] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.864] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.864] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18286500209) returned 1 [0062.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb447af70, dwHighDateTime=0x1d585b4)) [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e20 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e20 | out: hHeap=0x260000) returned 1 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321898 [0062.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.865] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.865] GetLastError () returned 0x0 [0062.865] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.865] GetLastError () returned 0x0 [0062.867] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffeff58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.867] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x100a8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x100a8, lpOverlapped=0x0) returned 1 [0062.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.868] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.868] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.869] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.869] CloseHandle (hObject=0x118) returned 1 [0062.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.870] GetLastError () returned 0x0 [0062.871] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.872] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.872] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18287328941) returned 1 [0062.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb44a10d0, dwHighDateTime=0x1d585b4)) [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0de8 [0062.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0062.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0de8 | out: hHeap=0x260000) returned 1 [0062.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0062.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321800 [0062.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.873] GetLastError () returned 0x0 [0062.873] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.873] GetLastError () returned 0x0 [0062.875] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff07ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.876] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xf814, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xf814, lpOverlapped=0x0) returned 1 [0062.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.877] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.877] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.878] CloseHandle (hObject=0x118) returned 1 [0062.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.879] GetLastError () returned 0x0 [0062.889] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.890] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.890] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.890] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18289157974) returned 1 [0062.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb44c7230, dwHighDateTime=0x1d585b4)) [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f00 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f00 | out: hHeap=0x260000) returned 1 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321800 [0062.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.891] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.891] GetLastError () returned 0x0 [0062.891] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.892] GetLastError () returned 0x0 [0062.894] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff2d20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.894] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xd2e0, lpOverlapped=0x0) returned 1 [0062.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.895] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.895] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.895] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.896] CloseHandle (hObject=0xfc) returned 1 [0062.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.897] GetLastError () returned 0x0 [0062.901] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.901] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.901] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.902] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18290277968) returned 1 [0062.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb44ed390, dwHighDateTime=0x1d585b4)) [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0d78 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0d78 | out: hHeap=0x260000) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320d50 [0062.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.902] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.903] GetLastError () returned 0x0 [0062.903] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.903] GetLastError () returned 0x0 [0062.906] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.906] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.908] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.908] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.910] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.910] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.910] CloseHandle (hObject=0xfc) returned 1 [0062.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.953] GetLastError () returned 0x0 [0062.954] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.955] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.955] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.955] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18295614565) returned 1 [0062.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb455f7b0, dwHighDateTime=0x1d585b4)) [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0c28 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0c28 | out: hHeap=0x260000) returned 1 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321638 [0062.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.956] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.956] GetLastError () returned 0x0 [0062.956] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.956] GetLastError () returned 0x0 [0062.958] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffecd47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.958] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x132b9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0x132b9, lpOverlapped=0x0) returned 1 [0062.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.959] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.959] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.960] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.960] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.960] CloseHandle (hObject=0xfc) returned 1 [0062.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.961] GetLastError () returned 0x0 [0062.962] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0062.963] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.963] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.963] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18296616443) returned 1 [0062.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4585910, dwHighDateTime=0x1d585b4)) [0062.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0bf0 [0062.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0bf0 | out: hHeap=0x260000) returned 1 [0062.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321210 [0062.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.966] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0062.966] GetLastError () returned 0x0 [0062.966] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0062.966] GetLastError () returned 0x0 [0062.969] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe910c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.969] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x16ef4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0x16ef4, lpOverlapped=0x0) returned 1 [0062.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.969] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.969] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.970] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.970] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.970] CloseHandle (hObject=0xfc) returned 1 [0062.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0063.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.391] GetLastError () returned 0x0 [0063.392] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.393] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.393] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0063.393] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18339414646) returned 1 [0063.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4989e30, dwHighDateTime=0x1d585b4)) [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352250 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352250 | out: hHeap=0x260000) returned 1 [0063.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0063.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.394] GetLastError () returned 0x0 [0063.394] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.394] GetLastError () returned 0x0 [0063.396] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.397] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x3a0, lpOverlapped=0x0) returned 1 [0063.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.398] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.398] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.399] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.400] CloseHandle (hObject=0xfc) returned 1 [0063.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.402] GetLastError () returned 0x0 [0063.402] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.403] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.404] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0063.404] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18340488902) returned 1 [0063.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb49aff90, dwHighDateTime=0x1d585b4)) [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352288 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352288 | out: hHeap=0x260000) returned 1 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0063.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.405] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.405] GetLastError () returned 0x0 [0063.405] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.405] GetLastError () returned 0x0 [0063.407] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc63, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.407] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x39d, lpOverlapped=0x0) returned 1 [0063.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.408] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.408] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.409] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.409] CloseHandle (hObject=0xfc) returned 1 [0063.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.411] GetLastError () returned 0x0 [0063.412] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.413] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.413] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0063.414] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18341486144) returned 1 [0063.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb49aff90, dwHighDateTime=0x1d585b4)) [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3522c0 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3522c0 | out: hHeap=0x260000) returned 1 [0063.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0063.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.415] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.415] GetLastError () returned 0x0 [0063.415] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.415] GetLastError () returned 0x0 [0063.417] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.418] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x3bf, lpOverlapped=0x0) returned 1 [0063.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.418] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.418] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.424] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.424] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.424] CloseHandle (hObject=0xfc) returned 1 [0063.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.513] GetLastError () returned 0x0 [0063.534] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.535] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.535] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.535] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18353616841) returned 1 [0063.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4ae0a90, dwHighDateTime=0x1d585b4)) [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352170 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352170 | out: hHeap=0x260000) returned 1 [0063.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.536] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.536] GetLastError () returned 0x0 [0063.536] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.536] GetLastError () returned 0x0 [0063.538] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.538] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c4, lpOverlapped=0x0) returned 1 [0063.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.538] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.539] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.539] CloseHandle (hObject=0x118) returned 1 [0063.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.541] GetLastError () returned 0x0 [0063.541] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.542] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.542] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.542] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18354304293) returned 1 [0063.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4b06bf0, dwHighDateTime=0x1d585b4)) [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3524f0 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3524f0 | out: hHeap=0x260000) returned 1 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.543] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.543] GetLastError () returned 0x0 [0063.543] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.543] GetLastError () returned 0x0 [0063.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.545] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c4, lpOverlapped=0x0) returned 1 [0063.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.545] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.546] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.546] CloseHandle (hObject=0x118) returned 1 [0063.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.548] GetLastError () returned 0x0 [0063.548] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.549] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.549] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.549] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18355012360) returned 1 [0063.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4b06bf0, dwHighDateTime=0x1d585b4)) [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352528 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352528 | out: hHeap=0x260000) returned 1 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.550] GetLastError () returned 0x0 [0063.550] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.550] GetLastError () returned 0x0 [0063.553] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.554] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.554] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.555] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.555] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.555] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.556] CloseHandle (hObject=0x118) returned 1 [0063.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.558] GetLastError () returned 0x0 [0063.558] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.559] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.559] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18356007398) returned 1 [0063.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4b2cd50, dwHighDateTime=0x1d585b4)) [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352560 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352560 | out: hHeap=0x260000) returned 1 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.560] GetLastError () returned 0x0 [0063.560] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.560] GetLastError () returned 0x0 [0063.561] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.562] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3a0, lpOverlapped=0x0) returned 1 [0063.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.562] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.562] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.563] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.563] CloseHandle (hObject=0x118) returned 1 [0063.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.564] GetLastError () returned 0x0 [0063.565] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.566] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.566] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18356683767) returned 1 [0063.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4b2cd50, dwHighDateTime=0x1d585b4)) [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3525d0 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3525d0 | out: hHeap=0x260000) returned 1 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.567] GetLastError () returned 0x0 [0063.567] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.567] GetLastError () returned 0x0 [0063.757] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.757] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3bf, lpOverlapped=0x0) returned 1 [0063.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.758] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.758] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.758] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.758] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.759] CloseHandle (hObject=0x118) returned 1 [0063.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.759] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.760] GetLastError () returned 0x0 [0063.774] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.776] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.776] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.776] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18377701083) returned 1 [0063.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4d42090, dwHighDateTime=0x1d585b4)) [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352598 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352598 | out: hHeap=0x260000) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0063.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0063.777] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.777] GetLastError () returned 0x0 [0063.777] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.777] GetLastError () returned 0x0 [0063.780] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.780] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.781] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.781] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.781] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.781] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.782] CloseHandle (hObject=0x120) returned 1 [0063.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845bd8 [0063.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845bd8 | out: hHeap=0x260000) returned 1 [0063.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.783] GetLastError () returned 0x0 [0063.783] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.784] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.784] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.784] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18378563420) returned 1 [0063.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4d42090, dwHighDateTime=0x1d585b4)) [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3527c8 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3527c8 | out: hHeap=0x260000) returned 1 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0063.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0063.785] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.785] GetLastError () returned 0x0 [0063.785] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.786] GetLastError () returned 0x0 [0063.788] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.788] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c4, lpOverlapped=0x0) returned 1 [0063.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.788] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.788] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.789] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.789] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.789] CloseHandle (hObject=0x120) returned 1 [0063.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845bd8 [0063.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845bd8 | out: hHeap=0x260000) returned 1 [0063.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.791] GetLastError () returned 0x0 [0063.791] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.792] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.792] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.792] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18379315808) returned 1 [0063.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4d681f0, dwHighDateTime=0x1d585b4)) [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352800 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352800 | out: hHeap=0x260000) returned 1 [0063.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0063.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0063.793] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.793] GetLastError () returned 0x0 [0063.793] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.793] GetLastError () returned 0x0 [0063.795] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.795] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c2, lpOverlapped=0x0) returned 1 [0063.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.796] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.796] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.797] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.797] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.797] CloseHandle (hObject=0x120) returned 1 [0063.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0063.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0063.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.798] GetLastError () returned 0x0 [0063.799] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.799] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.799] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.800] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18380082547) returned 1 [0063.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4d681f0, dwHighDateTime=0x1d585b4)) [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352838 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352838 | out: hHeap=0x260000) returned 1 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0063.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0063.800] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.801] GetLastError () returned 0x0 [0063.801] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.801] GetLastError () returned 0x0 [0063.802] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.802] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0063.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.803] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.803] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.803] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.803] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.804] CloseHandle (hObject=0x120) returned 1 [0063.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0063.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0063.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.805] GetLastError () returned 0x0 [0063.845] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.861] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.861] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.862] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18386267212) returned 1 [0063.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4e00770, dwHighDateTime=0x1d585b4)) [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352988 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352988 | out: hHeap=0x260000) returned 1 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.862] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.862] GetLastError () returned 0x0 [0063.862] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.863] GetLastError () returned 0x0 [0063.865] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.865] WriteFile (in: hFile=0x118, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.866] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.866] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.867] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.867] CloseHandle (hObject=0x118) returned 1 [0063.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.869] GetLastError () returned 0x0 [0063.869] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.870] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.870] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.870] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18387109022) returned 1 [0063.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4e268d0, dwHighDateTime=0x1d585b4)) [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3529f8 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3529f8 | out: hHeap=0x260000) returned 1 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.871] GetLastError () returned 0x0 [0063.871] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.871] GetLastError () returned 0x0 [0063.873] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.873] WriteFile (in: hFile=0x118, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.873] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.873] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.874] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.874] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.874] CloseHandle (hObject=0x118) returned 1 [0063.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.885] GetLastError () returned 0x0 [0063.885] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.886] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.886] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18388761258) returned 1 [0063.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4e4ca30, dwHighDateTime=0x1d585b4)) [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352a30 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352a30 | out: hHeap=0x260000) returned 1 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a230 [0063.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a230 | out: hHeap=0x260000) returned 1 [0063.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.887] GetLastError () returned 0x0 [0063.887] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.888] GetLastError () returned 0x0 [0063.889] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.889] WriteFile (in: hFile=0x118, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0x3bf, lpOverlapped=0x0) returned 1 [0063.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.890] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.890] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.891] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.891] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.891] CloseHandle (hObject=0x118) returned 1 [0063.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.893] GetLastError () returned 0x0 [0063.893] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2897900) returned 1 [0063.894] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.894] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.894] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18389500269) returned 1 [0063.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4e4ca30, dwHighDateTime=0x1d585b4)) [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352a68 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352a68 | out: hHeap=0x260000) returned 1 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a2d8 [0063.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a2d8 | out: hHeap=0x260000) returned 1 [0063.895] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.895] GetLastError () returned 0x0 [0063.895] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.895] GetLastError () returned 0x0 [0063.910] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.911] WriteFile (in: hFile=0x118, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0063.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.914] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.914] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.914] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.914] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.915] CloseHandle (hObject=0x118) returned 1 [0063.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845bd8 [0063.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845bd8 | out: hHeap=0x260000) returned 1 [0063.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.923] GetLastError () returned 0x0 [0063.924] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0063.925] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.925] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0063.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.925] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18392642030) returned 1 [0063.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4e98cf0, dwHighDateTime=0x1d585b4)) [0063.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352aa0 [0063.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352aa0 | out: hHeap=0x260000) returned 1 [0063.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a380 [0063.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a380 | out: hHeap=0x260000) returned 1 [0063.926] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.926] GetLastError () returned 0x0 [0063.926] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.926] GetLastError () returned 0x0 [0063.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.929] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0063.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.930] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.930] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.931] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.931] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.931] CloseHandle (hObject=0x100) returned 1 [0063.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845bd8 [0063.932] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845bd8 | out: hHeap=0x260000) returned 1 [0063.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.933] GetLastError () returned 0x0 [0063.933] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0063.934] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.934] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0063.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.934] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18393532681) returned 1 [0063.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4ebee50, dwHighDateTime=0x1d585b4)) [0063.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352ad8 [0063.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352ad8 | out: hHeap=0x260000) returned 1 [0063.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.935] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.935] GetLastError () returned 0x0 [0063.935] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.935] GetLastError () returned 0x0 [0063.937] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.937] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3c3, lpOverlapped=0x0) returned 1 [0063.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.937] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.937] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.938] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.938] CloseHandle (hObject=0x100) returned 1 [0063.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845bd8 [0063.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845bd8 | out: hHeap=0x260000) returned 1 [0063.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.940] GetLastError () returned 0x0 [0063.940] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0063.940] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0063.940] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0063.940] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0063.942] CloseHandle (hObject=0x100) returned 1 [0063.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ae0 | out: hHeap=0x260000) returned 1 [0063.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0063.942] RtlWakeConditionVariable () returned 0x27e828 [0063.942] GetCurrentThreadId () returned 0x98c [0063.944] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0063.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.945] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0063.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.945] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18394598077) returned 1 [0063.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4ee4fb0, dwHighDateTime=0x1d585b4)) [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352b48 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352b48 | out: hHeap=0x260000) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.946] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.946] GetLastError () returned 0x0 [0063.946] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.946] GetLastError () returned 0x0 [0063.948] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffad9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.948] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5261, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x5261, lpOverlapped=0x0) returned 1 [0063.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.949] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.949] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.949] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.949] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.950] CloseHandle (hObject=0x100) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0063.950] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.[deadmin@cock.li].deadmin")) returned 1 [0063.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0063.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.951] GetLastError () returned 0x0 [0063.951] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0063.952] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.952] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0063.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.953] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18395380685) returned 1 [0063.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4ee4fb0, dwHighDateTime=0x1d585b4)) [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352b80 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352b80 | out: hHeap=0x260000) returned 1 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.954] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0063.954] GetLastError () returned 0x0 [0063.954] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0063.954] GetLastError () returned 0x0 [0063.956] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff951b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.956] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x6ae5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x6ae5, lpOverlapped=0x0) returned 1 [0063.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.957] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.957] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.957] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.957] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.958] CloseHandle (hObject=0x100) returned 1 [0063.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.[deadmin@cock.li].deadmin")) returned 1 [0063.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.959] GetLastError () returned 0x0 [0063.959] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.038] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.048] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.054] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18405562514) returned 1 [0064.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4fef950, dwHighDateTime=0x1d585b4)) [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352e58 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352e58 | out: hHeap=0x260000) returned 1 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.055] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.055] GetLastError () returned 0x0 [0064.055] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.056] GetLastError () returned 0x0 [0064.058] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.059] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.060] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.060] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.060] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.060] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.061] CloseHandle (hObject=0x100) returned 1 [0064.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.062] GetLastError () returned 0x0 [0064.062] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.063] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.063] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.063] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18406451565) returned 1 [0064.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb4fef950, dwHighDateTime=0x1d585b4)) [0064.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352e90 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352e90 | out: hHeap=0x260000) returned 1 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.064] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.064] GetLastError () returned 0x0 [0064.064] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.064] GetLastError () returned 0x0 [0064.066] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffad5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.066] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x52a4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x52a4, lpOverlapped=0x0) returned 1 [0064.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.067] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.067] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.067] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.067] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.068] CloseHandle (hObject=0x100) returned 1 [0064.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.069] GetLastError () returned 0x0 [0064.069] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.070] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.070] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.070] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18407157238) returned 1 [0064.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5015ab0, dwHighDateTime=0x1d585b4)) [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352ec8 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352ec8 | out: hHeap=0x260000) returned 1 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.071] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.071] GetLastError () returned 0x0 [0064.071] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.071] GetLastError () returned 0x0 [0064.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff97e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.076] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6818, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x6818, lpOverlapped=0x0) returned 1 [0064.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.077] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.077] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.078] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.078] CloseHandle (hObject=0x100) returned 1 [0064.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.079] GetLastError () returned 0x0 [0064.080] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.080] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.081] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.081] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18408182551) returned 1 [0064.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5015ab0, dwHighDateTime=0x1d585b4)) [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352f00 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352f00 | out: hHeap=0x260000) returned 1 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.081] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.082] GetLastError () returned 0x0 [0064.082] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.082] GetLastError () returned 0x0 [0064.084] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffb8ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.085] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4732, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x4732, lpOverlapped=0x0) returned 1 [0064.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.086] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.086] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.086] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.086] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.087] CloseHandle (hObject=0x100) returned 1 [0064.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.088] GetLastError () returned 0x0 [0064.088] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.089] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.089] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.089] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18409026504) returned 1 [0064.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb503bc10, dwHighDateTime=0x1d585b4)) [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352f38 [0064.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352f38 | out: hHeap=0x260000) returned 1 [0064.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.090] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.090] GetLastError () returned 0x0 [0064.090] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.090] GetLastError () returned 0x0 [0064.092] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffb731, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.092] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x48cf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x48cf, lpOverlapped=0x0) returned 1 [0064.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.092] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.093] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.093] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.093] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.094] CloseHandle (hObject=0x100) returned 1 [0064.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.095] GetLastError () returned 0x0 [0064.095] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.096] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.096] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.096] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18409737789) returned 1 [0064.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb503bc10, dwHighDateTime=0x1d585b4)) [0064.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352f70 [0064.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352f70 | out: hHeap=0x260000) returned 1 [0064.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.097] GetLastError () returned 0x0 [0064.097] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.097] GetLastError () returned 0x0 [0064.101] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.102] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.103] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.103] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.104] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.105] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.105] CloseHandle (hObject=0x100) returned 1 [0064.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.107] GetLastError () returned 0x0 [0064.107] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.108] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.108] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.108] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18410900695) returned 1 [0064.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5061d70, dwHighDateTime=0x1d585b4)) [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352fa8 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352fa8 | out: hHeap=0x260000) returned 1 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.109] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.109] GetLastError () returned 0x0 [0064.109] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.109] GetLastError () returned 0x0 [0064.111] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.112] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.113] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.113] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.114] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.114] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.114] CloseHandle (hObject=0x100) returned 1 [0064.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.115] GetLastError () returned 0x0 [0064.116] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.117] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.117] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.117] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18411789345) returned 1 [0064.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5087ed0, dwHighDateTime=0x1d585b4)) [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352fe0 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352fe0 | out: hHeap=0x260000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.117] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.118] GetLastError () returned 0x0 [0064.118] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.118] GetLastError () returned 0x0 [0064.119] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff6586, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.120] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x9a7a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x9a7a, lpOverlapped=0x0) returned 1 [0064.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.120] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.120] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.121] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.121] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.121] CloseHandle (hObject=0x100) returned 1 [0064.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.123] GetLastError () returned 0x0 [0064.123] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.124] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.124] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.124] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18412504992) returned 1 [0064.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5087ed0, dwHighDateTime=0x1d585b4)) [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353018 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353018 | out: hHeap=0x260000) returned 1 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.125] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.125] GetLastError () returned 0x0 [0064.125] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.125] GetLastError () returned 0x0 [0064.126] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffa1cb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.127] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5e35, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x5e35, lpOverlapped=0x0) returned 1 [0064.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.127] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.127] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.128] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.128] CloseHandle (hObject=0x100) returned 1 [0064.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.130] GetLastError () returned 0x0 [0064.130] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.131] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.131] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.131] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18413199694) returned 1 [0064.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5087ed0, dwHighDateTime=0x1d585b4)) [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353050 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353050 | out: hHeap=0x260000) returned 1 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.132] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.220] GetLastError () returned 0x0 [0064.221] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.221] GetLastError () returned 0x0 [0064.223] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff56a3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.223] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xa95d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0xa95d, lpOverlapped=0x0) returned 1 [0064.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.224] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.224] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.225] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.225] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.225] CloseHandle (hObject=0x100) returned 1 [0064.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.226] GetLastError () returned 0x0 [0064.227] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.227] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.228] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.228] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18422884805) returned 1 [0064.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5192870, dwHighDateTime=0x1d585b4)) [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353248 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353248 | out: hHeap=0x260000) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.228] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.229] GetLastError () returned 0x0 [0064.229] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.229] GetLastError () returned 0x0 [0064.231] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff937b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.231] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x6c85, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x6c85, lpOverlapped=0x0) returned 1 [0064.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.232] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.232] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.232] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.233] CloseHandle (hObject=0x100) returned 1 [0064.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.234] GetLastError () returned 0x0 [0064.234] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.236] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.236] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.236] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18423722667) returned 1 [0064.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5192870, dwHighDateTime=0x1d585b4)) [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353280 [0064.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353280 | out: hHeap=0x260000) returned 1 [0064.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.237] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.237] GetLastError () returned 0x0 [0064.237] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.237] GetLastError () returned 0x0 [0064.239] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffa374, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.239] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x5c8c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x5c8c, lpOverlapped=0x0) returned 1 [0064.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.240] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.240] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.241] CloseHandle (hObject=0x100) returned 1 [0064.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.242] GetLastError () returned 0x0 [0064.243] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.244] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.244] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.244] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18424497232) returned 1 [0064.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb51b89d0, dwHighDateTime=0x1d585b4)) [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7940 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7940 | out: hHeap=0x260000) returned 1 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.245] GetLastError () returned 0x0 [0064.245] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.245] GetLastError () returned 0x0 [0064.247] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff5eb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.247] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xa14f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0xa14f, lpOverlapped=0x0) returned 1 [0064.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.248] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.248] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.248] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.249] CloseHandle (hObject=0x100) returned 1 [0064.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.250] GetLastError () returned 0x0 [0064.251] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.251] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.251] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.252] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18425281223) returned 1 [0064.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb51b89d0, dwHighDateTime=0x1d585b4)) [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7978 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7978 | out: hHeap=0x260000) returned 1 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.252] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.253] GetLastError () returned 0x0 [0064.253] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.253] GetLastError () returned 0x0 [0064.255] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.255] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.256] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.268] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.268] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.269] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.269] CloseHandle (hObject=0x100) returned 1 [0064.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.275] GetLastError () returned 0x0 [0064.275] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.276] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.276] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.276] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18427748324) returned 1 [0064.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5204c90, dwHighDateTime=0x1d585b4)) [0064.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a20 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a20 | out: hHeap=0x260000) returned 1 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.277] GetLastError () returned 0x0 [0064.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.277] GetLastError () returned 0x0 [0064.280] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff8608, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.280] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x79f8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x79f8, lpOverlapped=0x0) returned 1 [0064.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.281] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.281] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.281] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.281] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.282] CloseHandle (hObject=0x120) returned 1 [0064.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.283] GetLastError () returned 0x0 [0064.284] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.285] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.285] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.285] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18428594764) returned 1 [0064.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5204c90, dwHighDateTime=0x1d585b4)) [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a58 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a58 | out: hHeap=0x260000) returned 1 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.285] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.286] GetLastError () returned 0x0 [0064.286] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.286] GetLastError () returned 0x0 [0064.288] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.288] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.289] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.289] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.290] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.290] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.290] CloseHandle (hObject=0x120) returned 1 [0064.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.292] GetLastError () returned 0x0 [0064.292] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.292] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.292] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0064.292] WriteFile (in: hFile=0x120, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0064.293] CloseHandle (hObject=0x120) returned 1 [0064.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8bb8 | out: hHeap=0x260000) returned 1 [0064.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.294] RtlWakeConditionVariable () returned 0x27e828 [0064.294] GetCurrentThreadId () returned 0x98c [0064.295] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.296] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.296] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.296] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18429728764) returned 1 [0064.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb522adf0, dwHighDateTime=0x1d585b4)) [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8ba8 [0064.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8ba8 | out: hHeap=0x260000) returned 1 [0064.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.297] GetLastError () returned 0x0 [0064.297] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.297] GetLastError () returned 0x0 [0064.299] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.299] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe19, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xe19, lpOverlapped=0x0) returned 1 [0064.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.299] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.300] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.300] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.300] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.301] CloseHandle (hObject=0x120) returned 1 [0064.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.302] GetLastError () returned 0x0 [0064.303] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.303] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.304] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.304] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18430482591) returned 1 [0064.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5250f50, dwHighDateTime=0x1d585b4)) [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b70 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b70 | out: hHeap=0x260000) returned 1 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27cd080 [0064.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd080 | out: hHeap=0x260000) returned 1 [0064.304] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.305] GetLastError () returned 0x0 [0064.305] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.305] GetLastError () returned 0x0 [0064.307] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.307] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe2a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xe2a, lpOverlapped=0x0) returned 1 [0064.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.307] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.307] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.308] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.308] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.308] CloseHandle (hObject=0x120) returned 1 [0064.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.310] GetLastError () returned 0x0 [0064.310] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.311] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.311] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18431205157) returned 1 [0064.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5250f50, dwHighDateTime=0x1d585b4)) [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b38 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b38 | out: hHeap=0x260000) returned 1 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a4d0 [0064.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a4d0 | out: hHeap=0x260000) returned 1 [0064.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.312] GetLastError () returned 0x0 [0064.312] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.312] GetLastError () returned 0x0 [0064.359] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff112, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.359] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xeee, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0xeee, lpOverlapped=0x0) returned 1 [0064.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.359] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.359] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.360] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.360] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.361] CloseHandle (hObject=0x120) returned 1 [0064.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0064.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.429] GetLastError () returned 0x0 [0064.430] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.430] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.430] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.431] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18443170050) returned 1 [0064.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5381a50, dwHighDateTime=0x1d585b4)) [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8828 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8828 | out: hHeap=0x260000) returned 1 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a578 [0064.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a578 | out: hHeap=0x260000) returned 1 [0064.431] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.431] GetLastError () returned 0x0 [0064.431] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.432] GetLastError () returned 0x0 [0064.433] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff24b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.433] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xdb5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0xdb5, lpOverlapped=0x0) returned 1 [0064.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.434] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.434] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.434] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.435] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.435] CloseHandle (hObject=0xa4) returned 1 [0064.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0064.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.436] GetLastError () returned 0x0 [0064.437] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.438] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.438] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.438] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18443916595) returned 1 [0064.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5381a50, dwHighDateTime=0x1d585b4)) [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d87f0 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d87f0 | out: hHeap=0x260000) returned 1 [0064.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.439] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.439] GetLastError () returned 0x0 [0064.439] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.439] GetLastError () returned 0x0 [0064.440] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff12c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.441] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0xed4, lpOverlapped=0x0) returned 1 [0064.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.441] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.441] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.442] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.442] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.442] CloseHandle (hObject=0xa4) returned 1 [0064.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.444] GetLastError () returned 0x0 [0064.445] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.446] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.446] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.446] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18444694131) returned 1 [0064.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb53a7bb0, dwHighDateTime=0x1d585b4)) [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d87b8 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d87b8 | out: hHeap=0x260000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a8c0 [0064.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a8c0 | out: hHeap=0x260000) returned 1 [0064.447] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.447] GetLastError () returned 0x0 [0064.447] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.447] GetLastError () returned 0x0 [0064.449] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff1a7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.449] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0xe59, lpOverlapped=0x0) returned 1 [0064.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.449] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.450] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.450] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.450] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.451] CloseHandle (hObject=0xa4) returned 1 [0064.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0064.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.452] GetLastError () returned 0x0 [0064.452] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.453] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.453] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.453] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18445452925) returned 1 [0064.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb53a7bb0, dwHighDateTime=0x1d585b4)) [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8780 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8780 | out: hHeap=0x260000) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.454] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.454] GetLastError () returned 0x0 [0064.454] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.454] GetLastError () returned 0x0 [0064.456] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff0f7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.456] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xf09, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0xf09, lpOverlapped=0x0) returned 1 [0064.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.456] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.456] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.457] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.458] CloseHandle (hObject=0xa4) returned 1 [0064.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.459] GetLastError () returned 0x0 [0064.459] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.460] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.460] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.460] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18446157727) returned 1 [0064.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb53cdd10, dwHighDateTime=0x1d585b4)) [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8748 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8748 | out: hHeap=0x260000) returned 1 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.461] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.461] GetLastError () returned 0x0 [0064.461] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.461] GetLastError () returned 0x0 [0064.538] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff1d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.538] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe2a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0xe2a, lpOverlapped=0x0) returned 1 [0064.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.539] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.539] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.539] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.540] CloseHandle (hObject=0xa4) returned 1 [0064.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.541] GetLastError () returned 0x0 [0064.560] lstrlenW (lpString=".sql") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".sql") returned 0x0 [0064.561] lstrlenW (lpString=".mdf") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".mdf") returned 0x0 [0064.561] lstrlenW (lpString=".txt") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".txt") returned 0x0 [0064.561] lstrlenW (lpString=".dbf") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".dbf") returned 0x0 [0064.561] lstrlenW (lpString=".ckp") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".ckp") returned 0x0 [0064.561] lstrlenW (lpString=".dacpac") returned 7 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".dacpac") returned 0x0 [0064.561] lstrlenW (lpString=".db3") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".db3") returned 0x0 [0064.561] lstrlenW (lpString=".dtxs") returned 5 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".dtxs") returned 0x0 [0064.561] lstrlenW (lpString=".mdt") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".mdt") returned 0x0 [0064.561] lstrlenW (lpString=".sdf") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".sdf") returned 0x0 [0064.561] lstrlenW (lpString=".MDF") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".MDF") returned 0x0 [0064.561] lstrlenW (lpString=".DBF") returned 4 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".DBF") returned 0x0 [0064.561] lstrlenW (lpString=".DB") returned 3 [0064.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".DB") returned 0x0 [0064.562] lstrlenW (lpString=".db") returned 3 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".db") returned 0x0 [0064.562] lstrlenW (lpString=".ndf") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".ndf") returned 0x0 [0064.562] lstrlenW (lpString=".NDF") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".NDF") returned 0x0 [0064.562] lstrlenW (lpString=".Mdf") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".Mdf") returned 0x0 [0064.562] lstrlenW (lpString=".dat") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".dat") returned 0x0 [0064.562] lstrlenW (lpString=".DAT") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".DAT") returned 0x0 [0064.562] lstrlenW (lpString=".ldf") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".ldf") returned 0x0 [0064.562] lstrlenW (lpString=".LDF") returned 4 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch=".LDF") returned 0x0 [0064.562] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0064.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0064.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0064.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0064.562] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.563] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.563] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.563] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18456441167) returned 1 [0064.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb54b2550, dwHighDateTime=0x1d585b4)) [0064.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x289a2a8 [0064.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x289a2a8 | out: hHeap=0x260000) returned 1 [0064.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.564] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.564] GetLastError () returned 0x0 [0064.564] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.564] GetLastError () returned 0x0 [0064.583] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff1a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.583] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe5a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x224fdb0*=0xe5a, lpOverlapped=0x0) returned 1 [0064.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.599] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.599] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.611] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.611] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.611] CloseHandle (hObject=0xfc) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.773] GetLastError () returned 0x0 [0064.774] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.774] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.774] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0064.774] WriteFile (in: hFile=0xfc, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0064.775] CloseHandle (hObject=0xfc) returned 1 [0064.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e8700 | out: hHeap=0x260000) returned 1 [0064.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0064.775] RtlWakeConditionVariable () returned 0x27e828 [0064.775] GetCurrentThreadId () returned 0x98c [0064.776] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.792] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.792] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.792] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18479355612) returned 1 [0064.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb56ed9f0, dwHighDateTime=0x1d585b4)) [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8060 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323cc0 [0064.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.793] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.793] GetLastError () returned 0x0 [0064.793] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.794] GetLastError () returned 0x0 [0064.805] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc260, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.805] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3da0, lpOverlapped=0x0) returned 1 [0064.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.806] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.806] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.807] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.807] CloseHandle (hObject=0xfc) returned 1 [0064.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.[deadmin@cock.li].deadmin")) returned 1 [0064.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.808] GetLastError () returned 0x0 [0064.809] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.809] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0064.809] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.810] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18481079198) returned 1 [0064.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5713b50, dwHighDateTime=0x1d585b4)) [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8108 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779160 [0064.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8108 | out: hHeap=0x260000) returned 1 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779160 | out: hHeap=0x260000) returned 1 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322e80 [0064.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.810] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.811] GetLastError () returned 0x0 [0064.811] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.811] GetLastError () returned 0x0 [0064.841] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc9fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.841] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3602, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x3602, lpOverlapped=0x0) returned 1 [0064.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.844] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.844] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.845] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.845] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.845] CloseHandle (hObject=0xfc) returned 1 [0064.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.879] GetLastError () returned 0x0 [0064.879] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.880] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.880] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.880] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18488113032) returned 1 [0064.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb57ac0d0, dwHighDateTime=0x1d585b4)) [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d978 [0064.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d978 | out: hHeap=0x260000) returned 1 [0064.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323898 [0064.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.881] GetLastError () returned 0x0 [0064.881] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.881] GetLastError () returned 0x0 [0064.888] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff57f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.889] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xa80a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xa80a, lpOverlapped=0x0) returned 1 [0064.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.890] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.890] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.890] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.891] CloseHandle (hObject=0xfc) returned 1 [0064.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.892] GetLastError () returned 0x0 [0064.893] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0064.909] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.910] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.910] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18491112090) returned 1 [0064.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb57f8390, dwHighDateTime=0x1d585b4)) [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e90c0 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e90c0 | out: hHeap=0x260000) returned 1 [0064.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323470 [0064.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0064.911] GetLastError () returned 0x0 [0064.911] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0064.911] GetLastError () returned 0x0 [0064.923] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe006, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.924] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1ffa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x1ffa, lpOverlapped=0x0) returned 1 [0064.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.924] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.924] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.925] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.925] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.926] CloseHandle (hObject=0xfc) returned 1 [0064.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.926] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.927] GetLastError () returned 0x0 [0065.082] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.082] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.082] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.083] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18508383029) returned 1 [0065.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb599b2b0, dwHighDateTime=0x1d585b4)) [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x289e528 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x289e528 | out: hHeap=0x260000) returned 1 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323508 [0065.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.084] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.084] GetLastError () returned 0x0 [0065.084] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.084] GetLastError () returned 0x0 [0065.086] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb2c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.087] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x4d38, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x4d38, lpOverlapped=0x0) returned 1 [0065.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.088] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.088] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.089] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.089] CloseHandle (hObject=0x118) returned 1 [0065.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bcd60 [0065.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bcd60 | out: hHeap=0x260000) returned 1 [0065.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.091] GetLastError () returned 0x0 [0065.091] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.092] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.092] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.092] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18509303902) returned 1 [0065.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb59c1410, dwHighDateTime=0x1d585b4)) [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e91a0 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e91a0 | out: hHeap=0x260000) returned 1 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323210 [0065.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.093] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.093] GetLastError () returned 0x0 [0065.093] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.093] GetLastError () returned 0x0 [0065.095] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff8fe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.095] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7018, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x7018, lpOverlapped=0x0) returned 1 [0065.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.096] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.096] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.096] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.096] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.097] CloseHandle (hObject=0x118) returned 1 [0065.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0065.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0065.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.098] GetLastError () returned 0x0 [0065.098] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.099] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.099] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.099] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18510038559) returned 1 [0065.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb59e7570, dwHighDateTime=0x1d585b4)) [0065.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e91d8 [0065.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e91d8 | out: hHeap=0x260000) returned 1 [0065.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323178 [0065.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.100] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.100] GetLastError () returned 0x0 [0065.100] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.100] GetLastError () returned 0x0 [0065.102] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffeb06, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.102] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x14fa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x14fa, lpOverlapped=0x0) returned 1 [0065.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.103] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.103] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.104] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.104] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.104] CloseHandle (hObject=0x118) returned 1 [0065.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0065.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0065.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.105] GetLastError () returned 0x0 [0065.106] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.106] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.106] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.107] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18510772120) returned 1 [0065.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb59e7570, dwHighDateTime=0x1d585b4)) [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9210 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9210 | out: hHeap=0x260000) returned 1 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3230e0 [0065.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.107] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.107] GetLastError () returned 0x0 [0065.108] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.108] GetLastError () returned 0x0 [0065.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe8e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.109] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x171c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x171c, lpOverlapped=0x0) returned 1 [0065.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.110] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.110] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.110] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.110] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.111] CloseHandle (hObject=0x118) returned 1 [0065.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bcd60 [0065.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bcd60 | out: hHeap=0x260000) returned 1 [0065.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.112] GetLastError () returned 0x0 [0065.113] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.114] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.114] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.114] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18511509951) returned 1 [0065.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb59e7570, dwHighDateTime=0x1d585b4)) [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9248 [0065.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9248 | out: hHeap=0x260000) returned 1 [0065.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323048 [0065.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.115] GetLastError () returned 0x0 [0065.115] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.115] GetLastError () returned 0x0 [0065.144] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd09c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.144] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2f64, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x2f64, lpOverlapped=0x0) returned 1 [0065.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.145] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.145] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.145] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.145] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.146] CloseHandle (hObject=0x118) returned 1 [0065.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.148] GetLastError () returned 0x0 [0065.148] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.149] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.149] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.149] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18515000811) returned 1 [0065.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5a59990, dwHighDateTime=0x1d585b4)) [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e92f0 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e92f0 | out: hHeap=0x260000) returned 1 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322fb0 [0065.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.150] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.150] GetLastError () returned 0x0 [0065.150] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.150] GetLastError () returned 0x0 [0065.299] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffce26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.299] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x31da, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x31da, lpOverlapped=0x0) returned 1 [0065.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.301] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.301] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.302] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.302] CloseHandle (hObject=0x118) returned 1 [0065.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.310] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.314] GetLastError () returned 0x0 [0065.314] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.315] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.315] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18531600877) returned 1 [0065.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5bd6750, dwHighDateTime=0x1d585b4)) [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9398 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9398 | out: hHeap=0x260000) returned 1 [0065.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3540a8 [0065.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.324] GetLastError () returned 0x0 [0065.324] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.324] GetLastError () returned 0x0 [0065.328] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff84e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.328] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7b2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x7b2, lpOverlapped=0x0) returned 1 [0065.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.328] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.328] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.329] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.329] CloseHandle (hObject=0x118) returned 1 [0065.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.374] GetLastError () returned 0x0 [0065.375] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.375] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.375] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.376] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18537899909) returned 1 [0065.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5c94e30, dwHighDateTime=0x1d585b4)) [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8cf8 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8cf8 | out: hHeap=0x260000) returned 1 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354730 [0065.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.387] GetLastError () returned 0x0 [0065.387] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.387] GetLastError () returned 0x0 [0065.396] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff6b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.397] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x948, lpOverlapped=0x0) returned 1 [0065.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.398] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.398] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.398] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.398] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.399] CloseHandle (hObject=0x118) returned 1 [0065.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.400] GetLastError () returned 0x0 [0065.400] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.401] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.401] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.401] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18540248527) returned 1 [0065.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5cbaf90, dwHighDateTime=0x1d585b4)) [0065.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8cc0 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8cc0 | out: hHeap=0x260000) returned 1 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3547c8 [0065.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.402] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.402] GetLastError () returned 0x0 [0065.402] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.402] GetLastError () returned 0x0 [0065.424] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffee1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.424] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x11e2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x224fdb0*=0x11e2, lpOverlapped=0x0) returned 1 [0065.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.425] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.425] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.425] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.426] CloseHandle (hObject=0x118) returned 1 [0065.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.427] GetLastError () returned 0x0 [0065.573] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.594] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.595] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.595] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18559588453) returned 1 [0065.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5e84010, dwHighDateTime=0x1d585b4)) [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e97f8 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e97f8 | out: hHeap=0x260000) returned 1 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355278 [0065.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.596] GetLastError () returned 0x0 [0065.596] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.596] GetLastError () returned 0x0 [0065.605] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffee42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.605] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x11be, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x11be, lpOverlapped=0x0) returned 1 [0065.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.605] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.605] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.606] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.606] CloseHandle (hObject=0x118) returned 1 [0065.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.608] GetLastError () returned 0x0 [0065.608] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.609] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.609] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.609] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18561037832) returned 1 [0065.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5eaa170, dwHighDateTime=0x1d585b4)) [0065.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9910 [0065.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9910 | out: hHeap=0x260000) returned 1 [0065.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354ac0 [0065.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.610] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.610] GetLastError () returned 0x0 [0065.610] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.610] GetLastError () returned 0x0 [0065.612] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff120, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.612] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0xee0, lpOverlapped=0x0) returned 1 [0065.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.612] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.612] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.613] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.613] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.613] CloseHandle (hObject=0x118) returned 1 [0065.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.615] GetLastError () returned 0x0 [0065.615] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.616] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.616] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18561726850) returned 1 [0065.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5ed02d0, dwHighDateTime=0x1d585b4)) [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9948 [0065.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9948 | out: hHeap=0x260000) returned 1 [0065.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3554d8 [0065.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.617] GetLastError () returned 0x0 [0065.617] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.617] GetLastError () returned 0x0 [0065.619] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffcf26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.619] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x30da, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x30da, lpOverlapped=0x0) returned 1 [0065.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.620] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.620] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.621] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.621] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.621] CloseHandle (hObject=0x118) returned 1 [0065.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.623] GetLastError () returned 0x0 [0065.623] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.624] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.624] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.624] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18562497967) returned 1 [0065.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5ed02d0, dwHighDateTime=0x1d585b4)) [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9980 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9980 | out: hHeap=0x260000) returned 1 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355570 [0065.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.625] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.625] GetLastError () returned 0x0 [0065.625] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.625] GetLastError () returned 0x0 [0065.627] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff8810, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.627] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x77f0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x77f0, lpOverlapped=0x0) returned 1 [0065.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.628] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.628] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.629] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.629] CloseHandle (hObject=0x118) returned 1 [0065.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.631] GetLastError () returned 0x0 [0065.631] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.632] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.632] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.632] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18563351086) returned 1 [0065.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5ef6430, dwHighDateTime=0x1d585b4)) [0065.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8d68 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8d68 | out: hHeap=0x260000) returned 1 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322cb8 [0065.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.633] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.633] GetLastError () returned 0x0 [0065.633] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.633] GetLastError () returned 0x0 [0065.724] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffeade, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.724] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1522, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x1522, lpOverlapped=0x0) returned 1 [0065.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.725] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.725] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.725] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.725] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.726] CloseHandle (hObject=0x118) returned 1 [0065.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.734] GetLastError () returned 0x0 [0065.735] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.735] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.735] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.736] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18573668205) returned 1 [0065.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb5fdac70, dwHighDateTime=0x1d585b4)) [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9bb0 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9bb0 | out: hHeap=0x260000) returned 1 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2973a0 [0065.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.736] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.736] GetLastError () returned 0x0 [0065.736] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.737] GetLastError () returned 0x0 [0065.748] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffedce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.748] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1232, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x1232, lpOverlapped=0x0) returned 1 [0065.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.749] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.749] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.749] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.749] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.750] CloseHandle (hObject=0x118) returned 1 [0065.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.751] GetLastError () returned 0x0 [0065.752] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.752] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.752] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.753] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18575382174) returned 1 [0065.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6000dd0, dwHighDateTime=0x1d585b4)) [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9c20 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9c20 | out: hHeap=0x260000) returned 1 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355440 [0065.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.753] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.754] GetLastError () returned 0x0 [0065.754] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.754] GetLastError () returned 0x0 [0065.755] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffea74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.755] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x158c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x158c, lpOverlapped=0x0) returned 1 [0065.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.756] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.756] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.757] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.757] CloseHandle (hObject=0x118) returned 1 [0065.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.771] GetLastError () returned 0x0 [0065.771] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.772] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.772] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.772] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18577311062) returned 1 [0065.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb604d090, dwHighDateTime=0x1d585b4)) [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9c58 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9c58 | out: hHeap=0x260000) returned 1 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355900 [0065.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.773] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.773] GetLastError () returned 0x0 [0065.773] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.773] GetLastError () returned 0x0 [0065.788] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff130, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.792] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x224fdb0*=0xed0, lpOverlapped=0x0) returned 1 [0065.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.793] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.793] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.794] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.794] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.794] CloseHandle (hObject=0x118) returned 1 [0065.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.795] GetLastError () returned 0x0 [0065.796] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.797] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.797] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.797] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18579789705) returned 1 [0065.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb60731f0, dwHighDateTime=0x1d585b4)) [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9d00 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9d00 | out: hHeap=0x260000) returned 1 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355998 [0065.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.798] GetLastError () returned 0x0 [0065.798] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.798] GetLastError () returned 0x0 [0065.820] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff9d1d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.820] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x62e3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x224fdb0*=0x62e3, lpOverlapped=0x0) returned 1 [0065.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.821] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.821] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.822] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.822] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.822] CloseHandle (hObject=0x118) returned 1 [0065.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.[deadmin@cock.li].deadmin")) returned 1 [0065.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.824] GetLastError () returned 0x0 [0065.825] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.826] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.826] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.826] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18582710616) returned 1 [0065.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb60bf4b0, dwHighDateTime=0x1d585b4)) [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9da8 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9da8 | out: hHeap=0x260000) returned 1 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324cb8 [0065.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.827] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.827] GetLastError () returned 0x0 [0065.827] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.827] GetLastError () returned 0x0 [0065.842] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd5ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.842] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x2a12, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x224fdb0*=0x2a12, lpOverlapped=0x0) returned 1 [0065.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.843] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.843] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.844] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.844] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.844] CloseHandle (hObject=0x118) returned 1 [0065.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.846] GetLastError () returned 0x0 [0065.846] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.847] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.847] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.847] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18584841660) returned 1 [0065.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb60e5610, dwHighDateTime=0x1d585b4)) [0065.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9de0 [0065.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9de0 | out: hHeap=0x260000) returned 1 [0065.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355b60 [0065.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.848] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.848] GetLastError () returned 0x0 [0065.848] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.848] GetLastError () returned 0x0 [0065.850] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff6a74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.850] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x958c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x224fdb0*=0x958c, lpOverlapped=0x0) returned 1 [0065.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.851] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.851] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.852] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.852] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.852] CloseHandle (hObject=0x118) returned 1 [0065.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.854] GetLastError () returned 0x0 [0065.854] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.855] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.855] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.855] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18585593140) returned 1 [0065.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb610b770, dwHighDateTime=0x1d585b4)) [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9e18 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9e18 | out: hHeap=0x260000) returned 1 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355bf8 [0065.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.856] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.856] GetLastError () returned 0x0 [0065.856] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.856] GetLastError () returned 0x0 [0065.864] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffcbae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.864] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x3452, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x224fdb0*=0x3452, lpOverlapped=0x0) returned 1 [0065.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.865] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.865] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.866] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.866] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.866] CloseHandle (hObject=0x118) returned 1 [0065.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.866] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.981] GetLastError () returned 0x0 [0065.981] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.982] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.982] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18598298221) returned 1 [0065.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb623c270, dwHighDateTime=0x1d585b4)) [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea080 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea080 | out: hHeap=0x260000) returned 1 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355c90 [0065.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.983] GetLastError () returned 0x0 [0065.983] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.983] GetLastError () returned 0x0 [0065.986] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff772, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.986] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x88e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x88e, lpOverlapped=0x0) returned 1 [0065.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.987] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.987] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.988] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.988] CloseHandle (hObject=0x118) returned 1 [0065.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.990] GetLastError () returned 0x0 [0065.990] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0065.991] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.991] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0065.991] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18599217752) returned 1 [0065.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb62623d0, dwHighDateTime=0x1d585b4)) [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea0b8 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea0b8 | out: hHeap=0x260000) returned 1 [0065.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356318 [0065.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.992] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0065.992] GetLastError () returned 0x0 [0065.992] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0065.992] GetLastError () returned 0x0 [0066.008] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff6d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.008] WriteFile (in: hFile=0x118, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x92c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x92c, lpOverlapped=0x0) returned 1 [0066.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.009] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.009] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.010] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.010] CloseHandle (hObject=0x118) returned 1 [0066.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.048] GetLastError () returned 0x0 [0066.049] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.050] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.071] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18607188868) returned 1 [0066.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6320ab0, dwHighDateTime=0x1d585b4)) [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea208 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea208 | out: hHeap=0x260000) returned 1 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356610 [0066.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.071] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.072] GetLastError () returned 0x0 [0066.072] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.072] GetLastError () returned 0x0 [0066.131] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff9248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.131] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x6db8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x6db8, lpOverlapped=0x0) returned 1 [0066.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.132] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.132] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.132] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.132] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.133] CloseHandle (hObject=0x118) returned 1 [0066.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.134] GetLastError () returned 0x0 [0066.134] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.135] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.135] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18613656728) returned 1 [0066.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb63b9030, dwHighDateTime=0x1d585b4)) [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea320 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea320 | out: hHeap=0x260000) returned 1 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3566a8 [0066.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.136] GetLastError () returned 0x0 [0066.136] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.136] GetLastError () returned 0x0 [0066.142] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff9d38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.142] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x62c8, lpOverlapped=0x0) returned 1 [0066.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.143] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.143] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.143] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.143] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.144] CloseHandle (hObject=0x118) returned 1 [0066.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.149] GetLastError () returned 0x0 [0066.149] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.151] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.151] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.151] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18615210961) returned 1 [0066.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb63df190, dwHighDateTime=0x1d585b4)) [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea390 [0066.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea390 | out: hHeap=0x260000) returned 1 [0066.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356a38 [0066.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.152] GetLastError () returned 0x0 [0066.152] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.152] GetLastError () returned 0x0 [0066.163] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffbcde, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.163] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x4322, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x4322, lpOverlapped=0x0) returned 1 [0066.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.164] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.164] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.165] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.165] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.166] CloseHandle (hObject=0x118) returned 1 [0066.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.167] GetLastError () returned 0x0 [0066.167] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.168] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.168] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.168] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18616933626) returned 1 [0066.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb64052f0, dwHighDateTime=0x1d585b4)) [0066.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea400 [0066.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea400 | out: hHeap=0x260000) returned 1 [0066.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356b68 [0066.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.169] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.169] GetLastError () returned 0x0 [0066.169] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.169] GetLastError () returned 0x0 [0066.171] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdc64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.171] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x239c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x239c, lpOverlapped=0x0) returned 1 [0066.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.172] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.172] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.172] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.173] CloseHandle (hObject=0x118) returned 1 [0066.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.174] GetLastError () returned 0x0 [0066.175] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.176] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.176] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.176] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18617712021) returned 1 [0066.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb642b450, dwHighDateTime=0x1d585b4)) [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea438 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea438 | out: hHeap=0x260000) returned 1 [0066.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356c98 [0066.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.177] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.177] GetLastError () returned 0x0 [0066.177] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.177] GetLastError () returned 0x0 [0066.242] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff2504, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.242] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xdafc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xdafc, lpOverlapped=0x0) returned 1 [0066.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.243] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.243] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.243] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.244] CloseHandle (hObject=0x118) returned 1 [0066.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.245] GetLastError () returned 0x0 [0066.246] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.246] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.247] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18624775077) returned 1 [0066.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb64c39d0, dwHighDateTime=0x1d585b4)) [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea630 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea630 | out: hHeap=0x260000) returned 1 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0066.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f800 [0066.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0066.247] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.248] GetLastError () returned 0x0 [0066.248] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.248] GetLastError () returned 0x0 [0066.315] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffcc8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.315] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x3372, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x3372, lpOverlapped=0x0) returned 1 [0066.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.316] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.316] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.316] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.316] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.317] CloseHandle (hObject=0x118) returned 1 [0066.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.318] GetLastError () returned 0x0 [0066.319] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0066.319] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0066.319] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0066.319] WriteFile (in: hFile=0x118, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0066.320] CloseHandle (hObject=0x118) returned 1 [0066.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e87b8 | out: hHeap=0x260000) returned 1 [0066.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0066.320] RtlWakeConditionVariable () returned 0x27e828 [0066.320] GetCurrentThreadId () returned 0x98c [0066.321] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.322] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.322] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.322] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18632351356) returned 1 [0066.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb65820b0, dwHighDateTime=0x1d585b4)) [0066.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326e38 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326e38 | out: hHeap=0x260000) returned 1 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0066.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323af8 [0066.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0066.323] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.323] GetLastError () returned 0x0 [0066.323] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.323] GetLastError () returned 0x0 [0066.334] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc260, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.334] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x3da0, lpOverlapped=0x0) returned 1 [0066.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.336] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.337] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.337] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.337] CloseHandle (hObject=0x118) returned 1 [0066.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.[deadmin@cock.li].deadmin")) returned 1 [0066.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.339] GetLastError () returned 0x0 [0066.340] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.341] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.341] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.341] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18634205000) returned 1 [0066.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb65a8210, dwHighDateTime=0x1d585b4)) [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326dc8 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326dc8 | out: hHeap=0x260000) returned 1 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b148 [0066.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0066.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b148 | out: hHeap=0x260000) returned 1 [0066.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.342] GetLastError () returned 0x0 [0066.342] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.342] GetLastError () returned 0x0 [0066.361] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.361] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0066.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.362] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.362] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.363] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.363] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.363] CloseHandle (hObject=0x118) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x284a0a8 [0066.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284a0a8 | out: hHeap=0x260000) returned 1 [0066.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.365] GetLastError () returned 0x0 [0066.365] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.366] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.367] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18636766658) returned 1 [0066.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb65f44d0, dwHighDateTime=0x1d585b4)) [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326d58 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326d58 | out: hHeap=0x260000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0066.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323af8 [0066.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0066.367] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.367] GetLastError () returned 0x0 [0066.368] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.368] GetLastError () returned 0x0 [0066.370] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff2de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.370] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xd22, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xd22, lpOverlapped=0x0) returned 1 [0066.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.371] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.371] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.371] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.371] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.372] CloseHandle (hObject=0x118) returned 1 [0066.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.373] GetLastError () returned 0x0 [0066.374] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.375] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.375] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.375] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18637617611) returned 1 [0066.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb65f44d0, dwHighDateTime=0x1d585b4)) [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ce8 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ce8 | out: hHeap=0x260000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b3e8 [0066.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b3e8 | out: hHeap=0x260000) returned 1 [0066.376] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.376] GetLastError () returned 0x0 [0066.376] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.376] GetLastError () returned 0x0 [0066.404] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff8a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.404] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x758, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x758, lpOverlapped=0x0) returned 1 [0066.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.405] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.405] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.406] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.406] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.406] CloseHandle (hObject=0x118) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.406] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.408] GetLastError () returned 0x0 [0066.413] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.414] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.414] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.414] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18641536317) returned 1 [0066.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb66668f0, dwHighDateTime=0x1d585b4)) [0066.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326c08 [0066.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326c08 | out: hHeap=0x260000) returned 1 [0066.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b538 [0066.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b538 | out: hHeap=0x260000) returned 1 [0066.415] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.415] GetLastError () returned 0x0 [0066.415] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.415] GetLastError () returned 0x0 [0066.417] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdf98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.417] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x2068, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x2068, lpOverlapped=0x0) returned 1 [0066.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.417] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.418] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.418] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.418] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.419] CloseHandle (hObject=0x104) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x284a0a8 [0066.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284a0a8 | out: hHeap=0x260000) returned 1 [0066.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.420] GetLastError () returned 0x0 [0066.420] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.421] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.421] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.421] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18642237877) returned 1 [0066.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb66668f0, dwHighDateTime=0x1d585b4)) [0066.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326bd0 [0066.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326bd0 | out: hHeap=0x260000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b7d8 [0066.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b7d8 | out: hHeap=0x260000) returned 1 [0066.422] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.422] GetLastError () returned 0x0 [0066.422] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.422] GetLastError () returned 0x0 [0066.451] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffed72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.451] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x128e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x128e, lpOverlapped=0x0) returned 1 [0066.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.452] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.452] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.453] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.453] CloseHandle (hObject=0x104) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.455] GetLastError () returned 0x0 [0066.455] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.456] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.456] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.456] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18645698963) returned 1 [0066.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb66d8d10, dwHighDateTime=0x1d585b4)) [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326e70 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326e70 | out: hHeap=0x260000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d3558 [0066.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d3558 | out: hHeap=0x260000) returned 1 [0066.457] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.457] GetLastError () returned 0x0 [0066.457] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.457] GetLastError () returned 0x0 [0066.459] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.459] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xc3c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xc3c, lpOverlapped=0x0) returned 1 [0066.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.460] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.460] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.460] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.460] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.461] CloseHandle (hObject=0x104) returned 1 [0066.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.465] GetLastError () returned 0x0 [0066.465] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.466] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.466] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18646723208) returned 1 [0066.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb66d8d10, dwHighDateTime=0x1d585b4)) [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea7f0 [0066.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea7f0 | out: hHeap=0x260000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x334e68 [0066.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x334e68 | out: hHeap=0x260000) returned 1 [0066.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.467] GetLastError () returned 0x0 [0066.467] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.467] GetLastError () returned 0x0 [0066.469] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff9e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.469] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x61c, lpOverlapped=0x0) returned 1 [0066.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.469] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.469] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.470] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.470] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.470] CloseHandle (hObject=0x104) returned 1 [0066.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.497] GetLastError () returned 0x0 [0066.497] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.498] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.498] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.498] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18649945924) returned 1 [0066.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6724fd0, dwHighDateTime=0x1d585b4)) [0066.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea8d0 [0066.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea8d0 | out: hHeap=0x260000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x334f10 [0066.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x334f10 | out: hHeap=0x260000) returned 1 [0066.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.499] GetLastError () returned 0x0 [0066.499] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.499] GetLastError () returned 0x0 [0066.502] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff7ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.502] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x814, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x814, lpOverlapped=0x0) returned 1 [0066.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.503] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.503] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.504] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.505] CloseHandle (hObject=0x104) returned 1 [0066.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.506] GetLastError () returned 0x0 [0066.507] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.508] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.508] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.508] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18650897147) returned 1 [0066.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb674b130, dwHighDateTime=0x1d585b4)) [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea908 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea908 | out: hHeap=0x260000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3351b0 [0066.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3351b0 | out: hHeap=0x260000) returned 1 [0066.509] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.509] GetLastError () returned 0x0 [0066.509] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.509] GetLastError () returned 0x0 [0066.510] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff726, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.510] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x8da, lpOverlapped=0x0) returned 1 [0066.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.511] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.511] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.512] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.512] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.512] CloseHandle (hObject=0x104) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.512] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.514] GetLastError () returned 0x0 [0066.514] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.515] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.515] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18651615358) returned 1 [0066.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb674b130, dwHighDateTime=0x1d585b4)) [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea940 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea940 | out: hHeap=0x260000) returned 1 [0066.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335258 [0066.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335258 | out: hHeap=0x260000) returned 1 [0066.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.516] GetLastError () returned 0x0 [0066.516] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.516] GetLastError () returned 0x0 [0066.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff726, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.533] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x8da, lpOverlapped=0x0) returned 1 [0066.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.534] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.534] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.535] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.535] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.535] CloseHandle (hObject=0x104) returned 1 [0066.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.537] GetLastError () returned 0x0 [0066.537] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.538] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.539] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18653972556) returned 1 [0066.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb67973f0, dwHighDateTime=0x1d585b4)) [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea9e8 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea9e8 | out: hHeap=0x260000) returned 1 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335300 [0066.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335300 | out: hHeap=0x260000) returned 1 [0066.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.539] GetLastError () returned 0x0 [0066.540] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.540] GetLastError () returned 0x0 [0066.567] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.567] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xc6e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xc6e, lpOverlapped=0x0) returned 1 [0066.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.568] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.568] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.569] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.569] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.569] CloseHandle (hObject=0x104) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.571] GetLastError () returned 0x0 [0066.571] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x28985c0) returned 1 [0066.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.572] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.572] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18657341778) returned 1 [0066.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb67e36b0, dwHighDateTime=0x1d585b4)) [0066.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaac8 [0066.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaac8 | out: hHeap=0x260000) returned 1 [0066.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3354f8 [0066.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3354f8 | out: hHeap=0x260000) returned 1 [0066.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.573] GetLastError () returned 0x0 [0066.573] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.573] GetLastError () returned 0x0 [0066.625] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff8fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.625] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x704, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x704, lpOverlapped=0x0) returned 1 [0066.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.625] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.625] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.626] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.626] CloseHandle (hObject=0x104) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.628] GetLastError () returned 0x0 [0066.629] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.630] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.630] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18663129903) returned 1 [0066.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb687bc30, dwHighDateTime=0x1d585b4)) [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327308 [0066.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327308 | out: hHeap=0x260000) returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335798 [0066.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335798 | out: hHeap=0x260000) returned 1 [0066.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.631] GetLastError () returned 0x0 [0066.631] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.631] GetLastError () returned 0x0 [0066.656] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeaae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.656] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x1552, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x1552, lpOverlapped=0x0) returned 1 [0066.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.656] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.656] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.657] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.657] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.657] CloseHandle (hObject=0x104) returned 1 [0066.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.658] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.659] GetLastError () returned 0x0 [0066.667] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.667] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.668] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18667006268) returned 1 [0066.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb68c7ef0, dwHighDateTime=0x1d585b4)) [0066.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3271b8 [0066.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3271b8 | out: hHeap=0x260000) returned 1 [0066.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335ae0 [0066.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335ae0 | out: hHeap=0x260000) returned 1 [0066.670] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.670] GetLastError () returned 0x0 [0066.670] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.670] GetLastError () returned 0x0 [0066.672] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff8d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.672] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x72c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x72c, lpOverlapped=0x0) returned 1 [0066.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.673] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.673] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.673] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.673] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.674] CloseHandle (hObject=0x104) returned 1 [0066.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.675] GetLastError () returned 0x0 [0066.676] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.676] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.677] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18667765387) returned 1 [0066.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb68ee050, dwHighDateTime=0x1d585b4)) [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327180 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327180 | out: hHeap=0x260000) returned 1 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335cd8 [0066.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335cd8 | out: hHeap=0x260000) returned 1 [0066.677] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.677] GetLastError () returned 0x0 [0066.677] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.678] GetLastError () returned 0x0 [0066.679] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.679] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xc5a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xc5a, lpOverlapped=0x0) returned 1 [0066.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.680] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.680] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.680] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.681] CloseHandle (hObject=0x104) returned 1 [0066.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.682] GetLastError () returned 0x0 [0066.683] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.683] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.683] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.684] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18668471195) returned 1 [0066.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb68ee050, dwHighDateTime=0x1d585b4)) [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327148 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327148 | out: hHeap=0x260000) returned 1 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335e28 [0066.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335e28 | out: hHeap=0x260000) returned 1 [0066.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.684] GetLastError () returned 0x0 [0066.685] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.685] GetLastError () returned 0x0 [0066.689] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff980, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.689] WriteFile (in: hFile=0x104, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x680, lpOverlapped=0x0) returned 1 [0066.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.689] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.689] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.690] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.691] CloseHandle (hObject=0x104) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.691] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.692] GetLastError () returned 0x0 [0066.696] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.696] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.696] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.697] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18669779646) returned 1 [0066.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb69141b0, dwHighDateTime=0x1d585b4)) [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3271f0 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3271f0 | out: hHeap=0x260000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335ed0 [0066.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335ed0 | out: hHeap=0x260000) returned 1 [0066.697] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.698] GetLastError () returned 0x0 [0066.698] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.698] GetLastError () returned 0x0 [0066.699] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff2f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.699] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xd10, lpOverlapped=0x0) returned 1 [0066.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.700] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.700] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.701] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.701] CloseHandle (hObject=0x11c) returned 1 [0066.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.719] GetLastError () returned 0x0 [0066.741] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.742] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.742] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18674321819) returned 1 [0066.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb69865d0, dwHighDateTime=0x1d585b4)) [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327068 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327068 | out: hHeap=0x260000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335f78 [0066.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335f78 | out: hHeap=0x260000) returned 1 [0066.743] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.743] GetLastError () returned 0x0 [0066.743] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.743] GetLastError () returned 0x0 [0066.798] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.798] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x7e4, lpOverlapped=0x0) returned 1 [0066.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.799] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.799] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.800] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.801] CloseHandle (hObject=0x118) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.802] GetLastError () returned 0x0 [0066.802] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.803] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.803] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18680449331) returned 1 [0066.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6a1eb50, dwHighDateTime=0x1d585b4)) [0066.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326fc0 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326fc0 | out: hHeap=0x260000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336218 [0066.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336218 | out: hHeap=0x260000) returned 1 [0066.804] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.804] GetLastError () returned 0x0 [0066.804] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.804] GetLastError () returned 0x0 [0066.812] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff994, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.812] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x66c, lpOverlapped=0x0) returned 1 [0066.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.815] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.815] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.816] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.816] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.816] CloseHandle (hObject=0x118) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.846] GetLastError () returned 0x0 [0066.847] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.847] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.847] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.847] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18684863554) returned 1 [0066.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6a90f70, dwHighDateTime=0x1d585b4)) [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ee0 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ee0 | out: hHeap=0x260000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336410 [0066.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336410 | out: hHeap=0x260000) returned 1 [0066.848] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.848] GetLastError () returned 0x0 [0066.848] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.849] GetLastError () returned 0x0 [0066.916] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff92c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.916] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x6d4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0x6d4, lpOverlapped=0x0) returned 1 [0066.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.917] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.918] WriteFile (in: hFile=0xa4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.918] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.919] CloseHandle (hObject=0xa4) returned 1 [0066.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0066.921] GetLastError () returned 0x0 [0066.921] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0066.922] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.922] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0066.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0066.922] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18692346487) returned 1 [0066.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6b294f0, dwHighDateTime=0x1d585b4)) [0066.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eabe0 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eabe0 | out: hHeap=0x260000) returned 1 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3366b0 [0066.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3366b0 | out: hHeap=0x260000) returned 1 [0066.923] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0066.923] GetLastError () returned 0x0 [0066.923] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0066.923] GetLastError () returned 0x0 [0067.015] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff538, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.016] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x224fdb0*=0xac8, lpOverlapped=0x0) returned 1 [0067.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.030] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.030] WriteFile (in: hFile=0xa4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.031] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.031] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.031] CloseHandle (hObject=0xa4) returned 1 [0067.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.038] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.039] GetLastError () returned 0x0 [0067.044] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.045] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.045] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.045] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18704634134) returned 1 [0067.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6c59ff0, dwHighDateTime=0x1d585b4)) [0067.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327650 [0067.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327650 | out: hHeap=0x260000) returned 1 [0067.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x354560 [0067.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x354560 | out: hHeap=0x260000) returned 1 [0067.046] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.046] GetLastError () returned 0x0 [0067.046] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.046] GetLastError () returned 0x0 [0067.105] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff5d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.105] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xa28, lpOverlapped=0x0) returned 1 [0067.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0067.106] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.106] WriteFile (in: hFile=0xa4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.106] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.106] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.107] CloseHandle (hObject=0xa4) returned 1 [0067.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.160] GetLastError () returned 0x0 [0067.160] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.161] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.161] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18716253805) returned 1 [0067.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6d8aaf0, dwHighDateTime=0x1d585b4)) [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327420 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327420 | out: hHeap=0x260000) returned 1 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be250 [0067.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be250 | out: hHeap=0x260000) returned 1 [0067.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.162] GetLastError () returned 0x0 [0067.162] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.162] GetLastError () returned 0x0 [0067.213] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffed16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.213] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x12ea, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x12ea, lpOverlapped=0x0) returned 1 [0067.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0067.214] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.214] WriteFile (in: hFile=0xa4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.215] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.215] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.215] CloseHandle (hObject=0xa4) returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.217] GetLastError () returned 0x0 [0067.221] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.222] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.222] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.222] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18722307390) returned 1 [0067.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6e23070, dwHighDateTime=0x1d585b4)) [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3278f0 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3278f0 | out: hHeap=0x260000) returned 1 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be988 [0067.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be988 | out: hHeap=0x260000) returned 1 [0067.223] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.223] GetLastError () returned 0x0 [0067.223] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.223] GetLastError () returned 0x0 [0067.225] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.225] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xb1, lpOverlapped=0x0) returned 1 [0067.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.226] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.226] WriteFile (in: hFile=0xa4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.227] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.227] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.227] CloseHandle (hObject=0xa4) returned 1 [0067.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.259] GetLastError () returned 0x0 [0067.299] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.300] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.300] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18730096772) returned 1 [0067.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6ee1750, dwHighDateTime=0x1d585b4)) [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3273b0 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3273b0 | out: hHeap=0x260000) returned 1 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf2b8 [0067.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf2b8 | out: hHeap=0x260000) returned 1 [0067.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.301] GetLastError () returned 0x0 [0067.301] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.301] GetLastError () returned 0x0 [0067.302] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffb95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.303] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x46b, lpOverlapped=0x0) returned 1 [0067.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.303] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.303] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.304] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.304] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.304] CloseHandle (hObject=0x11c) returned 1 [0067.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.306] GetLastError () returned 0x0 [0067.307] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.307] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.307] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.307] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18730862261) returned 1 [0067.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6ee1750, dwHighDateTime=0x1d585b4)) [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327378 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327378 | out: hHeap=0x260000) returned 1 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf018 [0067.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf018 | out: hHeap=0x260000) returned 1 [0067.308] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.308] GetLastError () returned 0x0 [0067.308] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.309] GetLastError () returned 0x0 [0067.309] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.310] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x11a, lpOverlapped=0x0) returned 1 [0067.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.310] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.310] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.311] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.311] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.311] CloseHandle (hObject=0x11c) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.312] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.313] GetLastError () returned 0x0 [0067.313] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.314] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.325] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.326] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18732664755) returned 1 [0067.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f078b0, dwHighDateTime=0x1d585b4)) [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eac88 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eac88 | out: hHeap=0x260000) returned 1 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b27e8 [0067.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bef70 [0067.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b27e8 | out: hHeap=0x260000) returned 1 [0067.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bef70 | out: hHeap=0x260000) returned 1 [0067.326] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.326] GetLastError () returned 0x0 [0067.327] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.327] GetLastError () returned 0x0 [0067.327] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.328] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xcc, lpOverlapped=0x0) returned 1 [0067.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.328] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.328] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.329] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.329] CloseHandle (hObject=0x11c) returned 1 [0067.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.333] GetLastError () returned 0x0 [0067.334] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.334] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.334] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.335] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18733578837) returned 1 [0067.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f2da10, dwHighDateTime=0x1d585b4)) [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eacc0 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eacc0 | out: hHeap=0x260000) returned 1 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf4b0 [0067.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf4b0 | out: hHeap=0x260000) returned 1 [0067.335] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.336] GetLastError () returned 0x0 [0067.336] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.336] GetLastError () returned 0x0 [0067.339] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.339] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xce, lpOverlapped=0x0) returned 1 [0067.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.339] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.340] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.340] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.340] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.341] CloseHandle (hObject=0x11c) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.342] GetLastError () returned 0x0 [0067.343] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.343] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.344] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18734470146) returned 1 [0067.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f2da10, dwHighDateTime=0x1d585b4)) [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eacf8 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eacf8 | out: hHeap=0x260000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf600 [0067.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf600 | out: hHeap=0x260000) returned 1 [0067.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.344] GetLastError () returned 0x0 [0067.345] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.345] GetLastError () returned 0x0 [0067.346] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.346] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xb3, lpOverlapped=0x0) returned 1 [0067.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.346] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.346] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.347] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.347] CloseHandle (hObject=0x11c) returned 1 [0067.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.349] GetLastError () returned 0x0 [0067.350] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.350] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.350] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.351] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18735179266) returned 1 [0067.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f53b70, dwHighDateTime=0x1d585b4)) [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ead30 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ead30 | out: hHeap=0x260000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf6a8 [0067.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf6a8 | out: hHeap=0x260000) returned 1 [0067.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.352] GetLastError () returned 0x0 [0067.352] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.352] GetLastError () returned 0x0 [0067.356] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.357] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xb3, lpOverlapped=0x0) returned 1 [0067.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.357] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.357] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.358] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.358] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.359] CloseHandle (hObject=0x11c) returned 1 [0067.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.361] GetLastError () returned 0x0 [0067.361] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.362] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.362] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.362] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18736344824) returned 1 [0067.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f79cd0, dwHighDateTime=0x1d585b4)) [0067.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ead68 [0067.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ead68 | out: hHeap=0x260000) returned 1 [0067.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf750 [0067.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf750 | out: hHeap=0x260000) returned 1 [0067.363] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.363] GetLastError () returned 0x0 [0067.363] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.363] GetLastError () returned 0x0 [0067.364] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.364] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x111, lpOverlapped=0x0) returned 1 [0067.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.365] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.365] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.367] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.367] CloseHandle (hObject=0x11c) returned 1 [0067.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.367] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.369] GetLastError () returned 0x0 [0067.369] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.370] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.370] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.370] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18737115751) returned 1 [0067.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f79cd0, dwHighDateTime=0x1d585b4)) [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eada0 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eada0 | out: hHeap=0x260000) returned 1 [0067.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf7f8 [0067.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf7f8 | out: hHeap=0x260000) returned 1 [0067.376] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.376] GetLastError () returned 0x0 [0067.376] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.377] GetLastError () returned 0x0 [0067.378] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.378] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x112, lpOverlapped=0x0) returned 1 [0067.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.380] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.380] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.382] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.383] CloseHandle (hObject=0x11c) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.387] GetLastError () returned 0x0 [0067.387] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.390] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.390] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.390] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18739088603) returned 1 [0067.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6f9fe30, dwHighDateTime=0x1d585b4)) [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eadd8 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eadd8 | out: hHeap=0x260000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf8a0 [0067.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf8a0 | out: hHeap=0x260000) returned 1 [0067.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.391] GetLastError () returned 0x0 [0067.391] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.391] GetLastError () returned 0x0 [0067.392] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffec4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.392] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0x13c, lpOverlapped=0x0) returned 1 [0067.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.393] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.393] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.394] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.394] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.394] CloseHandle (hObject=0x11c) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.396] GetLastError () returned 0x0 [0067.396] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.397] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.397] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.397] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18739857789) returned 1 [0067.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6fc5f90, dwHighDateTime=0x1d585b4)) [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eae10 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eae10 | out: hHeap=0x260000) returned 1 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf948 [0067.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf948 | out: hHeap=0x260000) returned 1 [0067.398] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.398] GetLastError () returned 0x0 [0067.398] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.399] GetLastError () returned 0x0 [0067.400] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.400] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xf5, lpOverlapped=0x0) returned 1 [0067.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.400] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.400] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.401] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.401] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.402] CloseHandle (hObject=0x11c) returned 1 [0067.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.403] GetLastError () returned 0x0 [0067.403] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.404] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.404] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.404] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18740560832) returned 1 [0067.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6fc5f90, dwHighDateTime=0x1d585b4)) [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eae48 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eae48 | out: hHeap=0x260000) returned 1 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf9f0 [0067.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf9f0 | out: hHeap=0x260000) returned 1 [0067.405] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.405] GetLastError () returned 0x0 [0067.405] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.406] GetLastError () returned 0x0 [0067.407] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.407] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xf5, lpOverlapped=0x0) returned 1 [0067.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.407] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.407] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.408] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.408] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.409] CloseHandle (hObject=0x11c) returned 1 [0067.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.410] GetLastError () returned 0x0 [0067.411] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.419] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.419] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.419] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18742034257) returned 1 [0067.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb6fec0f0, dwHighDateTime=0x1d585b4)) [0067.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eae80 [0067.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eae80 | out: hHeap=0x260000) returned 1 [0067.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bfa98 [0067.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bfa98 | out: hHeap=0x260000) returned 1 [0067.420] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.420] GetLastError () returned 0x0 [0067.421] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.421] GetLastError () returned 0x0 [0067.422] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.422] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xf5, lpOverlapped=0x0) returned 1 [0067.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.424] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.424] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.425] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.425] CloseHandle (hObject=0x11c) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.427] GetLastError () returned 0x0 [0067.428] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.429] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.429] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.429] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18743002414) returned 1 [0067.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7012250, dwHighDateTime=0x1d585b4)) [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaeb8 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaeb8 | out: hHeap=0x260000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bfb40 [0067.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bfb40 | out: hHeap=0x260000) returned 1 [0067.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.430] GetLastError () returned 0x0 [0067.430] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.430] GetLastError () returned 0x0 [0067.431] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.431] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xb7, lpOverlapped=0x0) returned 1 [0067.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.432] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.432] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.432] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.433] CloseHandle (hObject=0x11c) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.435] GetLastError () returned 0x0 [0067.435] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.436] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.436] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18743740713) returned 1 [0067.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7012250, dwHighDateTime=0x1d585b4)) [0067.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaef0 [0067.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaef0 | out: hHeap=0x260000) returned 1 [0067.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bfbe8 [0067.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bfbe8 | out: hHeap=0x260000) returned 1 [0067.437] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.437] GetLastError () returned 0x0 [0067.437] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.437] GetLastError () returned 0x0 [0067.438] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.438] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x224fdb0*=0xc8, lpOverlapped=0x0) returned 1 [0067.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.439] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.439] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.439] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.439] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.440] CloseHandle (hObject=0x11c) returned 1 [0067.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.882] GetLastError () returned 0x0 [0067.883] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0067.883] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.883] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0067.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.950] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18795077403) returned 1 [0067.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb74fafb0, dwHighDateTime=0x1d585b4)) [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7c18 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c18 | out: hHeap=0x260000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1a98 [0067.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1a98 | out: hHeap=0x260000) returned 1 [0067.950] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0067.951] GetLastError () returned 0x0 [0067.951] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0067.951] GetLastError () returned 0x0 [0067.952] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.952] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xfe, lpOverlapped=0x0) returned 1 [0067.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.953] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.953] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.953] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.953] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.954] CloseHandle (hObject=0x11c) returned 1 [0068.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.018] GetLastError () returned 0x0 [0068.028] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.030] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.030] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.030] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18803152691) returned 1 [0068.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb75b9690, dwHighDateTime=0x1d585b4)) [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2945d0 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2945d0 | out: hHeap=0x260000) returned 1 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1948 [0068.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1948 | out: hHeap=0x260000) returned 1 [0068.031] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.031] GetLastError () returned 0x0 [0068.031] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.031] GetLastError () returned 0x0 [0068.032] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.033] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x78, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x78, lpOverlapped=0x0) returned 1 [0068.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.033] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.033] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.037] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.037] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.038] CloseHandle (hObject=0xf0) returned 1 [0068.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.038] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.043] GetLastError () returned 0x0 [0068.043] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.045] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.045] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.045] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18804619563) returned 1 [0068.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb75df7f0, dwHighDateTime=0x1d585b4)) [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294598 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294598 | out: hHeap=0x260000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1f30 [0068.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1f30 | out: hHeap=0x260000) returned 1 [0068.046] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.046] GetLastError () returned 0x0 [0068.046] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.046] GetLastError () returned 0x0 [0068.047] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.047] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x77, lpOverlapped=0x0) returned 1 [0068.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.048] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.048] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.049] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.049] CloseHandle (hObject=0xf0) returned 1 [0068.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.051] GetLastError () returned 0x0 [0068.052] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.053] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.053] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.053] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18805400092) returned 1 [0068.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7605950, dwHighDateTime=0x1d585b4)) [0068.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7fb8 [0068.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7fb8 | out: hHeap=0x260000) returned 1 [0068.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1fd8 [0068.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1fd8 | out: hHeap=0x260000) returned 1 [0068.055] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.055] GetLastError () returned 0x0 [0068.055] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.055] GetLastError () returned 0x0 [0068.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.056] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0068.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.057] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.057] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.057] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.057] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.058] CloseHandle (hObject=0xf0) returned 1 [0068.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.065] GetLastError () returned 0x0 [0068.065] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.066] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.066] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18806692819) returned 1 [0068.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb762bab0, dwHighDateTime=0x1d585b4)) [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7df8 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7df8 | out: hHeap=0x260000) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2080 [0068.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2080 | out: hHeap=0x260000) returned 1 [0068.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.069] GetLastError () returned 0x0 [0068.069] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.069] GetLastError () returned 0x0 [0068.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.080] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xb0, lpOverlapped=0x0) returned 1 [0068.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.082] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.083] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.083] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.084] CloseHandle (hObject=0xf0) returned 1 [0068.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.095] GetLastError () returned 0x0 [0068.096] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.097] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.097] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.097] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18809816815) returned 1 [0068.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7677d70, dwHighDateTime=0x1d585b4)) [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7e30 [0068.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e30 | out: hHeap=0x260000) returned 1 [0068.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2128 [0068.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2128 | out: hHeap=0x260000) returned 1 [0068.098] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.098] GetLastError () returned 0x0 [0068.098] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.098] GetLastError () returned 0x0 [0068.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.100] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xb1, lpOverlapped=0x0) returned 1 [0068.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.101] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.101] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.101] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.102] CloseHandle (hObject=0xf0) returned 1 [0068.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.105] GetLastError () returned 0x0 [0068.105] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.106] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.106] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.106] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18810738460) returned 1 [0068.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7677d70, dwHighDateTime=0x1d585b4)) [0068.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7e68 [0068.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e68 | out: hHeap=0x260000) returned 1 [0068.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2250 [0068.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2250 | out: hHeap=0x260000) returned 1 [0068.109] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.109] GetLastError () returned 0x0 [0068.109] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.109] GetLastError () returned 0x0 [0068.111] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.111] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xaf, lpOverlapped=0x0) returned 1 [0068.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.112] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.112] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.113] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.113] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.114] CloseHandle (hObject=0xf0) returned 1 [0068.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.116] GetLastError () returned 0x0 [0068.117] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.119] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18811975753) returned 1 [0068.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb769ded0, dwHighDateTime=0x1d585b4)) [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ea0 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ea0 | out: hHeap=0x260000) returned 1 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c22f8 [0068.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c22f8 | out: hHeap=0x260000) returned 1 [0068.120] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.120] GetLastError () returned 0x0 [0068.120] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.120] GetLastError () returned 0x0 [0068.121] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.122] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xaf, lpOverlapped=0x0) returned 1 [0068.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.123] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.123] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.123] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.124] CloseHandle (hObject=0xf0) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.182] GetLastError () returned 0x0 [0068.183] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.184] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.185] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18818567003) returned 1 [0068.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7736450, dwHighDateTime=0x1d585b4)) [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4250 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4250 | out: hHeap=0x260000) returned 1 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c23a0 [0068.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c23a0 | out: hHeap=0x260000) returned 1 [0068.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.186] GetLastError () returned 0x0 [0068.186] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.186] GetLastError () returned 0x0 [0068.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.192] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x154, lpOverlapped=0x0) returned 1 [0068.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.197] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.198] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.199] CloseHandle (hObject=0xf0) returned 1 [0068.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.201] GetLastError () returned 0x0 [0068.201] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.202] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.203] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18820386499) returned 1 [0068.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb775c5b0, dwHighDateTime=0x1d585b4)) [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4288 [0068.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4288 | out: hHeap=0x260000) returned 1 [0068.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c24f0 [0068.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c24f0 | out: hHeap=0x260000) returned 1 [0068.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.204] GetLastError () returned 0x0 [0068.204] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.204] GetLastError () returned 0x0 [0068.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.206] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x101, lpOverlapped=0x0) returned 1 [0068.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.207] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.207] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.207] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.208] CloseHandle (hObject=0xf0) returned 1 [0068.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.210] GetLastError () returned 0x0 [0068.210] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.211] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.211] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.211] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18821241126) returned 1 [0068.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7782710, dwHighDateTime=0x1d585b4)) [0068.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c42c0 [0068.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c42c0 | out: hHeap=0x260000) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2598 [0068.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2598 | out: hHeap=0x260000) returned 1 [0068.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.212] GetLastError () returned 0x0 [0068.212] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.213] GetLastError () returned 0x0 [0068.214] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.214] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x91, lpOverlapped=0x0) returned 1 [0068.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.215] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.215] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.215] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.216] CloseHandle (hObject=0xf0) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.221] GetLastError () returned 0x0 [0068.221] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.222] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.222] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.222] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18822353573) returned 1 [0068.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb77a8870, dwHighDateTime=0x1d585b4)) [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c42f8 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c42f8 | out: hHeap=0x260000) returned 1 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2640 [0068.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2640 | out: hHeap=0x260000) returned 1 [0068.223] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.223] GetLastError () returned 0x0 [0068.224] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.224] GetLastError () returned 0x0 [0068.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffed0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.225] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x130, lpOverlapped=0x0) returned 1 [0068.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.226] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.227] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.227] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.227] CloseHandle (hObject=0xf0) returned 1 [0068.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.228] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.236] GetLastError () returned 0x0 [0068.237] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.238] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.239] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18823980724) returned 1 [0068.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb77ce9d0, dwHighDateTime=0x1d585b4)) [0068.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4330 [0068.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4330 | out: hHeap=0x260000) returned 1 [0068.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c26e8 [0068.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c26e8 | out: hHeap=0x260000) returned 1 [0068.243] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.243] GetLastError () returned 0x0 [0068.243] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.243] GetLastError () returned 0x0 [0068.244] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.244] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x8a, lpOverlapped=0x0) returned 1 [0068.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.245] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.245] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.246] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.246] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.247] CloseHandle (hObject=0xf0) returned 1 [0068.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.249] GetLastError () returned 0x0 [0068.250] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.251] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.251] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.251] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18825224335) returned 1 [0068.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb77f4b30, dwHighDateTime=0x1d585b4)) [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4368 [0068.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4368 | out: hHeap=0x260000) returned 1 [0068.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2790 [0068.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2790 | out: hHeap=0x260000) returned 1 [0068.252] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.252] GetLastError () returned 0x0 [0068.252] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.252] GetLastError () returned 0x0 [0068.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.254] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x1c8, lpOverlapped=0x0) returned 1 [0068.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.255] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.255] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.255] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.256] CloseHandle (hObject=0xf0) returned 1 [0068.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.258] GetLastError () returned 0x0 [0068.259] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.260] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.260] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.260] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18826126611) returned 1 [0068.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb77f4b30, dwHighDateTime=0x1d585b4)) [0068.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c43a0 [0068.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c43a0 | out: hHeap=0x260000) returned 1 [0068.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2838 [0068.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2838 | out: hHeap=0x260000) returned 1 [0068.261] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.261] GetLastError () returned 0x0 [0068.261] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.261] GetLastError () returned 0x0 [0068.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.263] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0068.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.264] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.264] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.264] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.265] CloseHandle (hObject=0xf0) returned 1 [0068.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.550] GetLastError () returned 0x0 [0068.551] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.552] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18855279840) returned 1 [0068.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7ac8550, dwHighDateTime=0x1d585b4)) [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4678 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4678 | out: hHeap=0x260000) returned 1 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867ca0 [0068.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c28e0 [0068.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867ca0 | out: hHeap=0x260000) returned 1 [0068.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c28e0 | out: hHeap=0x260000) returned 1 [0068.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.553] GetLastError () returned 0x0 [0068.553] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.553] GetLastError () returned 0x0 [0068.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.554] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x1a0, lpOverlapped=0x0) returned 1 [0068.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.555] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.555] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.555] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.556] CloseHandle (hObject=0xf0) returned 1 [0068.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.557] GetLastError () returned 0x0 [0068.558] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.559] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.559] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18856032359) returned 1 [0068.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7ac8550, dwHighDateTime=0x1d585b4)) [0068.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c46b0 [0068.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c46b0 | out: hHeap=0x260000) returned 1 [0068.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867ca0 [0068.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c38a0 [0068.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867ca0 | out: hHeap=0x260000) returned 1 [0068.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c38a0 | out: hHeap=0x260000) returned 1 [0068.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.560] GetLastError () returned 0x0 [0068.560] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.560] GetLastError () returned 0x0 [0068.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.602] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x3cb, lpOverlapped=0x0) returned 1 [0068.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.605] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.605] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.606] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.606] CloseHandle (hObject=0xf0) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.608] GetLastError () returned 0x0 [0068.610] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.611] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.611] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.611] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18861222186) returned 1 [0068.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7b60ad0, dwHighDateTime=0x1d585b4)) [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c47c8 [0068.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c47c8 | out: hHeap=0x260000) returned 1 [0068.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3948 [0068.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3948 | out: hHeap=0x260000) returned 1 [0068.612] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.612] GetLastError () returned 0x0 [0068.612] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.612] GetLastError () returned 0x0 [0068.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.615] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xb2, lpOverlapped=0x0) returned 1 [0068.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.615] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.616] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.616] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.617] CloseHandle (hObject=0xf0) returned 1 [0068.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.619] GetLastError () returned 0x0 [0068.619] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.620] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.620] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.620] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18862113909) returned 1 [0068.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7b60ad0, dwHighDateTime=0x1d585b4)) [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4800 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4800 | out: hHeap=0x260000) returned 1 [0068.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3c90 [0068.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3c90 | out: hHeap=0x260000) returned 1 [0068.621] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.621] GetLastError () returned 0x0 [0068.621] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.621] GetLastError () returned 0x0 [0068.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.622] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xf5, lpOverlapped=0x0) returned 1 [0068.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.623] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.623] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.624] CloseHandle (hObject=0xf0) returned 1 [0068.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.626] GetLastError () returned 0x0 [0068.626] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.627] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.627] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.627] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18862791284) returned 1 [0068.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7b86c30, dwHighDateTime=0x1d585b4)) [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4838 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4838 | out: hHeap=0x260000) returned 1 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3d38 [0068.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3d38 | out: hHeap=0x260000) returned 1 [0068.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.628] GetLastError () returned 0x0 [0068.628] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.628] GetLastError () returned 0x0 [0068.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.629] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xec, lpOverlapped=0x0) returned 1 [0068.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.630] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.630] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.631] CloseHandle (hObject=0xf0) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.632] GetLastError () returned 0x0 [0068.633] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.634] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.634] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18863506087) returned 1 [0068.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7b86c30, dwHighDateTime=0x1d585b4)) [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4870 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4870 | out: hHeap=0x260000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3de0 [0068.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3de0 | out: hHeap=0x260000) returned 1 [0068.635] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.635] GetLastError () returned 0x0 [0068.635] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.635] GetLastError () returned 0x0 [0068.636] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.636] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xc8, lpOverlapped=0x0) returned 1 [0068.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.637] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.637] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.637] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.638] CloseHandle (hObject=0xf0) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.640] GetLastError () returned 0x0 [0068.640] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.677] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.677] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18867808430) returned 1 [0068.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7bf9050, dwHighDateTime=0x1d585b4)) [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c49c0 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c49c0 | out: hHeap=0x260000) returned 1 [0068.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6250 [0068.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6250 | out: hHeap=0x260000) returned 1 [0068.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.678] GetLastError () returned 0x0 [0068.678] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.678] GetLastError () returned 0x0 [0068.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.679] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xd4, lpOverlapped=0x0) returned 1 [0068.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.680] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.681] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.682] CloseHandle (hObject=0xf0) returned 1 [0068.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.759] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.949] GetLastError () returned 0x0 [0068.949] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.950] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.950] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.950] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18895127026) returned 1 [0068.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7e807b0, dwHighDateTime=0x1d585b4)) [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5050 [0068.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5050 | out: hHeap=0x260000) returned 1 [0068.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7558 [0068.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7558 | out: hHeap=0x260000) returned 1 [0068.951] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.951] GetLastError () returned 0x0 [0068.951] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.951] GetLastError () returned 0x0 [0068.953] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.953] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0068.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.954] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.954] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.954] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.954] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.955] CloseHandle (hObject=0x120) returned 1 [0068.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.957] GetLastError () returned 0x0 [0068.957] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.958] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.958] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.958] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18895949399) returned 1 [0068.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7ea6910, dwHighDateTime=0x1d585b4)) [0068.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5088 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5088 | out: hHeap=0x260000) returned 1 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c76a8 [0068.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c76a8 | out: hHeap=0x260000) returned 1 [0068.959] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.959] GetLastError () returned 0x0 [0068.959] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.959] GetLastError () returned 0x0 [0068.960] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.960] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xe0, lpOverlapped=0x0) returned 1 [0068.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.961] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.961] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.962] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.962] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.963] CloseHandle (hObject=0x120) returned 1 [0068.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.963] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.964] GetLastError () returned 0x0 [0068.965] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.966] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.966] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.966] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18896717538) returned 1 [0068.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7ea6910, dwHighDateTime=0x1d585b4)) [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c50c0 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c50c0 | out: hHeap=0x260000) returned 1 [0068.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7750 [0068.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7750 | out: hHeap=0x260000) returned 1 [0068.967] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.967] GetLastError () returned 0x0 [0068.967] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.967] GetLastError () returned 0x0 [0068.968] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.968] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xe0, lpOverlapped=0x0) returned 1 [0068.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.969] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.969] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.969] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.970] CloseHandle (hObject=0x120) returned 1 [0068.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.971] GetLastError () returned 0x0 [0068.972] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.973] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.973] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.973] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18897394915) returned 1 [0068.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7ecca70, dwHighDateTime=0x1d585b4)) [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c50f8 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c50f8 | out: hHeap=0x260000) returned 1 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c77f8 [0068.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c77f8 | out: hHeap=0x260000) returned 1 [0068.974] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0068.974] GetLastError () returned 0x0 [0068.974] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0068.974] GetLastError () returned 0x0 [0068.975] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.975] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xe0, lpOverlapped=0x0) returned 1 [0068.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.978] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.978] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.979] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.979] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.980] CloseHandle (hObject=0x120) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.981] GetLastError () returned 0x0 [0068.982] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0068.983] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.983] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.983] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18898421658) returned 1 [0069.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7fb12b0, dwHighDateTime=0x1d585b4)) [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c52b8 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c52b8 | out: hHeap=0x260000) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b148 [0069.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0069.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b148 | out: hHeap=0x260000) returned 1 [0069.076] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.077] GetLastError () returned 0x0 [0069.077] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.077] GetLastError () returned 0x0 [0069.079] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.079] WriteFile (in: hFile=0x120, lpBuffer=0x29350a8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29350a8*, lpNumberOfBytesWritten=0x224fdb0*=0xe0, lpOverlapped=0x0) returned 1 [0069.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29350a8 | out: hHeap=0x260000) returned 1 [0069.080] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.080] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.081] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.081] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.082] CloseHandle (hObject=0x120) returned 1 [0069.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.083] GetLastError () returned 0x0 [0069.084] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.085] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.085] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18908592443) returned 1 [0069.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7fd7410, dwHighDateTime=0x1d585b4)) [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c52f0 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c52f0 | out: hHeap=0x260000) returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328df0 [0069.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.086] GetLastError () returned 0x0 [0069.086] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.086] GetLastError () returned 0x0 [0069.087] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffda5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.087] WriteFile (in: hFile=0x120, lpBuffer=0x29350a8*, nNumberOfBytesToWrite=0x25b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29350a8*, lpNumberOfBytesWritten=0x224fdb0*=0x25b, lpOverlapped=0x0) returned 1 [0069.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29350a8 | out: hHeap=0x260000) returned 1 [0069.087] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.088] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.088] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.088] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.089] CloseHandle (hObject=0x120) returned 1 [0069.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.090] GetLastError () returned 0x0 [0069.091] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.091] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.091] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.092] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18909266965) returned 1 [0069.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb7fd7410, dwHighDateTime=0x1d585b4)) [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5328 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5328 | out: hHeap=0x260000) returned 1 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328af8 [0069.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.092] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.092] GetLastError () returned 0x0 [0069.093] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.093] GetLastError () returned 0x0 [0069.106] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffe29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.107] WriteFile (in: hFile=0x120, lpBuffer=0x29350a8*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29350a8*, lpNumberOfBytesWritten=0x224fdb0*=0x1d7, lpOverlapped=0x0) returned 1 [0069.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29350a8 | out: hHeap=0x260000) returned 1 [0069.172] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.172] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.173] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.173] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.173] CloseHandle (hObject=0x120) returned 1 [0069.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0069.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0069.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.266] GetLastError () returned 0x0 [0069.266] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.267] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.267] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.267] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18926818033) returned 1 [0069.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb81a0490, dwHighDateTime=0x1d585b4)) [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5788 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5788 | out: hHeap=0x260000) returned 1 [0069.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328a60 [0069.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.268] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.268] GetLastError () returned 0x0 [0069.268] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.268] GetLastError () returned 0x0 [0069.271] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.271] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x482, lpOverlapped=0x0) returned 1 [0069.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.272] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.272] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.273] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.273] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.273] CloseHandle (hObject=0x108) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0069.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0069.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.275] GetLastError () returned 0x0 [0069.275] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.276] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.276] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.276] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18927737489) returned 1 [0069.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb81a0490, dwHighDateTime=0x1d585b4)) [0069.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c57c0 [0069.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c57c0 | out: hHeap=0x260000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327d50 [0069.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.277] GetLastError () returned 0x0 [0069.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.277] GetLastError () returned 0x0 [0069.312] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.312] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x482, lpOverlapped=0x0) returned 1 [0069.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.313] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.313] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.314] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.314] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.314] CloseHandle (hObject=0x108) returned 1 [0069.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.316] GetLastError () returned 0x0 [0069.316] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.317] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.317] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.317] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18931811869) returned 1 [0069.317] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb82128b0, dwHighDateTime=0x1d585b4)) [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a148 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a148 | out: hHeap=0x260000) returned 1 [0069.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0069.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.318] GetLastError () returned 0x0 [0069.318] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.318] GetLastError () returned 0x0 [0069.319] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff2e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.320] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xd1d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xd1d, lpOverlapped=0x0) returned 1 [0069.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.321] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.321] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.321] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.322] CloseHandle (hObject=0x108) returned 1 [0069.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.324] GetLastError () returned 0x0 [0069.324] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.325] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.325] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.325] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18932749791) returned 1 [0069.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8238a10, dwHighDateTime=0x1d585b4)) [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a110 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a110 | out: hHeap=0x260000) returned 1 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3209d0 [0069.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.327] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.327] GetLastError () returned 0x0 [0069.328] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.328] GetLastError () returned 0x0 [0069.329] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff6ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.329] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x901, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x901, lpOverlapped=0x0) returned 1 [0069.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.330] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.330] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.331] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.331] CloseHandle (hObject=0x108) returned 1 [0069.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.333] GetLastError () returned 0x0 [0069.333] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.334] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.334] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.334] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18933544421) returned 1 [0069.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8238a10, dwHighDateTime=0x1d585b4)) [0069.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a0d8 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a0d8 | out: hHeap=0x260000) returned 1 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320938 [0069.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.335] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.335] GetLastError () returned 0x0 [0069.335] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.335] GetLastError () returned 0x0 [0069.337] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe5eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.337] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1a15, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x1a15, lpOverlapped=0x0) returned 1 [0069.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.338] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.338] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.341] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.342] CloseHandle (hObject=0x108) returned 1 [0069.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.344] GetLastError () returned 0x0 [0069.344] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.345] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.345] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18934605486) returned 1 [0069.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb825eb70, dwHighDateTime=0x1d585b4)) [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a0a0 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a0a0 | out: hHeap=0x260000) returned 1 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3208a0 [0069.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.346] GetLastError () returned 0x0 [0069.346] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.346] GetLastError () returned 0x0 [0069.347] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffeb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.347] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x148, lpOverlapped=0x0) returned 1 [0069.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.348] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.348] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.349] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.349] CloseHandle (hObject=0x108) returned 1 [0069.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.356] GetLastError () returned 0x0 [0069.357] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.358] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.358] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18935908936) returned 1 [0069.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8284cd0, dwHighDateTime=0x1d585b4)) [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a068 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a068 | out: hHeap=0x260000) returned 1 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867d90 [0069.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867d90 | out: hHeap=0x260000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320808 [0069.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.359] GetLastError () returned 0x0 [0069.359] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.359] GetLastError () returned 0x0 [0069.361] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffee2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.361] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x11e, lpOverlapped=0x0) returned 1 [0069.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.363] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.363] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.363] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.363] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.364] CloseHandle (hObject=0x108) returned 1 [0069.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.366] GetLastError () returned 0x0 [0069.367] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.368] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.368] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.369] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18936966740) returned 1 [0069.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8284cd0, dwHighDateTime=0x1d585b4)) [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28b0308 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28b0308 | out: hHeap=0x260000) returned 1 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320770 [0069.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.369] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.369] GetLastError () returned 0x0 [0069.370] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.370] GetLastError () returned 0x0 [0069.371] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffe6d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.371] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x193, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x193, lpOverlapped=0x0) returned 1 [0069.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.371] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.371] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.372] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.372] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.373] CloseHandle (hObject=0x108) returned 1 [0069.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.375] GetLastError () returned 0x0 [0069.375] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.376] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.376] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18937742549) returned 1 [0069.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb82aae30, dwHighDateTime=0x1d585b4)) [0069.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ff8 [0069.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ff8 | out: hHeap=0x260000) returned 1 [0069.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3206d8 [0069.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.377] GetLastError () returned 0x0 [0069.377] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.377] GetLastError () returned 0x0 [0069.379] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff99c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.379] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x664, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x664, lpOverlapped=0x0) returned 1 [0069.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.380] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.380] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.381] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.381] CloseHandle (hObject=0x108) returned 1 [0069.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.383] GetLastError () returned 0x0 [0069.383] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.384] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.384] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.384] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18938517007) returned 1 [0069.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb82aae30, dwHighDateTime=0x1d585b4)) [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329fc0 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329fc0 | out: hHeap=0x260000) returned 1 [0069.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320640 [0069.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.385] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.385] GetLastError () returned 0x0 [0069.385] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.385] GetLastError () returned 0x0 [0069.387] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff63b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.387] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x9c5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x9c5, lpOverlapped=0x0) returned 1 [0069.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.387] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.388] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.388] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.389] CloseHandle (hObject=0x108) returned 1 [0069.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.390] GetLastError () returned 0x0 [0069.391] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.391] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.393] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.393] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18939405633) returned 1 [0069.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb82d0f90, dwHighDateTime=0x1d585b4)) [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329f88 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329f88 | out: hHeap=0x260000) returned 1 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3205a8 [0069.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.394] GetLastError () returned 0x0 [0069.394] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.394] GetLastError () returned 0x0 [0069.395] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.395] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x4d3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x4d3, lpOverlapped=0x0) returned 1 [0069.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.396] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.396] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.397] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.397] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.397] CloseHandle (hObject=0x108) returned 1 [0069.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.399] GetLastError () returned 0x0 [0069.400] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.401] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.401] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.401] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18940192325) returned 1 [0069.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb82d0f90, dwHighDateTime=0x1d585b4)) [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329f50 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329f50 | out: hHeap=0x260000) returned 1 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0069.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.402] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.402] GetLastError () returned 0x0 [0069.402] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.402] GetLastError () returned 0x0 [0069.540] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffc6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.540] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x395, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x395, lpOverlapped=0x0) returned 1 [0069.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.541] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.541] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.542] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.542] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.542] CloseHandle (hObject=0x108) returned 1 [0069.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.549] GetLastError () returned 0x0 [0069.550] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.551] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18955190817) returned 1 [0069.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb844dd50, dwHighDateTime=0x1d585b4)) [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329dc8 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329dc8 | out: hHeap=0x260000) returned 1 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320478 [0069.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.551] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.552] GetLastError () returned 0x0 [0069.552] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.552] GetLastError () returned 0x0 [0069.577] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff778, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.577] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x888, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x888, lpOverlapped=0x0) returned 1 [0069.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.578] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.578] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.579] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.579] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.579] CloseHandle (hObject=0x108) returned 1 [0069.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.581] GetLastError () returned 0x0 [0069.581] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.582] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.582] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.582] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18958330303) returned 1 [0069.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb849a010, dwHighDateTime=0x1d585b4)) [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329d58 [0069.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329d58 | out: hHeap=0x260000) returned 1 [0069.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328340 [0069.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.583] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.583] GetLastError () returned 0x0 [0069.583] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.583] GetLastError () returned 0x0 [0069.587] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.587] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x344, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x344, lpOverlapped=0x0) returned 1 [0069.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.587] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.588] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.588] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.588] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.589] CloseHandle (hObject=0x108) returned 1 [0069.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.590] GetLastError () returned 0x0 [0069.591] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.591] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.592] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18959284054) returned 1 [0069.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb84c0170, dwHighDateTime=0x1d585b4)) [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c57f8 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c57f8 | out: hHeap=0x260000) returned 1 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed410 [0069.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.593] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.593] GetLastError () returned 0x0 [0069.593] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.593] GetLastError () returned 0x0 [0069.594] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.594] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x96, lpOverlapped=0x0) returned 1 [0069.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.595] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.595] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.595] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.596] CloseHandle (hObject=0x108) returned 1 [0069.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.598] GetLastError () returned 0x0 [0069.598] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.599] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.599] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18960022523) returned 1 [0069.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb84c0170, dwHighDateTime=0x1d585b4)) [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5830 [0069.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5830 | out: hHeap=0x260000) returned 1 [0069.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed7a0 [0069.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.600] GetLastError () returned 0x0 [0069.600] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.600] GetLastError () returned 0x0 [0069.601] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.602] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x46b, lpOverlapped=0x0) returned 1 [0069.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.602] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.602] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.603] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.603] CloseHandle (hObject=0x108) returned 1 [0069.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.605] GetLastError () returned 0x0 [0069.607] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.608] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.608] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18960920789) returned 1 [0069.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb84e62d0, dwHighDateTime=0x1d585b4)) [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5868 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5868 | out: hHeap=0x260000) returned 1 [0069.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eca90 [0069.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.609] GetLastError () returned 0x0 [0069.609] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.609] GetLastError () returned 0x0 [0069.631] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff71d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.631] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x8e3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x8e3, lpOverlapped=0x0) returned 1 [0069.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.678] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.678] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.682] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.682] CloseHandle (hObject=0x108) returned 1 [0069.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.684] GetLastError () returned 0x0 [0069.684] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.685] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.685] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.685] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18968609937) returned 1 [0069.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb857e850, dwHighDateTime=0x1d585b4)) [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5a60 [0069.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5a60 | out: hHeap=0x260000) returned 1 [0069.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed708 [0069.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.686] GetLastError () returned 0x0 [0069.686] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.686] GetLastError () returned 0x0 [0069.687] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.687] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x11a, lpOverlapped=0x0) returned 1 [0069.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.688] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.688] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.688] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.689] CloseHandle (hObject=0x108) returned 1 [0069.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.691] GetLastError () returned 0x0 [0069.691] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.692] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.692] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.692] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18969298094) returned 1 [0069.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb85a49b0, dwHighDateTime=0x1d585b4)) [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5a98 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5a98 | out: hHeap=0x260000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed1b0 [0069.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.693] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.693] GetLastError () returned 0x0 [0069.693] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.693] GetLastError () returned 0x0 [0069.694] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.694] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x11a, lpOverlapped=0x0) returned 1 [0069.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.695] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.695] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.695] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.696] CloseHandle (hObject=0x108) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.697] GetLastError () returned 0x0 [0069.698] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.698] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.698] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.698] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18969964037) returned 1 [0069.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb85a49b0, dwHighDateTime=0x1d585b4)) [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5ad0 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5ad0 | out: hHeap=0x260000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed118 [0069.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.699] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.699] GetLastError () returned 0x0 [0069.699] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.700] GetLastError () returned 0x0 [0069.700] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffe2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.701] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x1d3, lpOverlapped=0x0) returned 1 [0069.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.701] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.701] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.702] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.702] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.703] CloseHandle (hObject=0x108) returned 1 [0069.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.707] GetLastError () returned 0x0 [0069.707] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.708] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.708] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.708] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18970959122) returned 1 [0069.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb85cab10, dwHighDateTime=0x1d585b4)) [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5b08 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5b08 | out: hHeap=0x260000) returned 1 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecfe8 [0069.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.709] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.709] GetLastError () returned 0x0 [0069.709] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.710] GetLastError () returned 0x0 [0069.710] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.711] WriteFile (in: hFile=0x108, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x15e, lpOverlapped=0x0) returned 1 [0069.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.711] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.711] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.774] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.783] CloseHandle (hObject=0x108) returned 1 [0069.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.792] GetLastError () returned 0x0 [0069.795] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.796] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.796] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18979738217) returned 1 [0069.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb86af350, dwHighDateTime=0x1d585b4)) [0069.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5b40 [0069.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5b40 | out: hHeap=0x260000) returned 1 [0069.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec5d0 [0069.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.797] GetLastError () returned 0x0 [0069.797] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.797] GetLastError () returned 0x0 [0069.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc468, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.801] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x3b98, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x3b98, lpOverlapped=0x0) returned 1 [0069.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.803] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.805] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.805] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.807] CloseHandle (hObject=0xf0) returned 1 [0069.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.[deadmin@cock.li].deadmin")) returned 1 [0069.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.810] GetLastError () returned 0x0 [0069.810] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0069.810] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0069.810] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0069.810] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0069.812] CloseHandle (hObject=0xf0) returned 1 [0069.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e8928 | out: hHeap=0x260000) returned 1 [0069.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0069.812] RtlWakeConditionVariable () returned 0x27e828 [0069.812] GetCurrentThreadId () returned 0x98c [0069.812] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.813] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.813] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.813] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18981462957) returned 1 [0069.814] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb86d54b0, dwHighDateTime=0x1d585b4)) [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5bb0 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5bb0 | out: hHeap=0x260000) returned 1 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecf50 [0069.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.814] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.814] GetLastError () returned 0x0 [0069.815] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.815] GetLastError () returned 0x0 [0069.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc260, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.817] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x3da0, lpOverlapped=0x0) returned 1 [0069.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.818] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.818] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.818] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.819] CloseHandle (hObject=0xf0) returned 1 [0069.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.[deadmin@cock.li].deadmin")) returned 1 [0069.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.821] GetLastError () returned 0x0 [0069.822] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0069.822] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0069.822] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0069.822] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0069.823] CloseHandle (hObject=0xf0) returned 1 [0069.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c79f0 | out: hHeap=0x260000) returned 1 [0069.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.823] RtlWakeConditionVariable () returned 0x27e828 [0069.823] GetCurrentThreadId () returned 0x98c [0069.824] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0069.824] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0069.824] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0069.824] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0069.825] CloseHandle (hObject=0xf0) returned 1 [0069.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ecd88 | out: hHeap=0x260000) returned 1 [0069.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x328d58 | out: hHeap=0x260000) returned 1 [0069.826] RtlWakeConditionVariable () returned 0x27e828 [0069.826] GetCurrentThreadId () returned 0x98c [0069.826] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.827] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0069.827] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0069.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.827] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18982847824) returned 1 [0069.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb86fb610, dwHighDateTime=0x1d585b4)) [0069.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a6c0 [0069.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.828] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.828] GetLastError () returned 0x0 [0069.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffac50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.856] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x53b0, lpOverlapped=0x0) returned 1 [0069.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.856] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.857] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.857] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.858] CloseHandle (hObject=0xf0) returned 1 [0069.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.[deadmin@cock.li].deadmin")) returned 1 [0069.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.859] GetLastError () returned 0x0 [0069.860] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x295cd08) returned 1 [0069.861] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.861] CryptReleaseContext (hProv=0x295cd08, dwFlags=0x0) returned 1 [0069.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.862] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18986265791) returned 1 [0069.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb87478d0, dwHighDateTime=0x1d585b4)) [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a650 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a650 | out: hHeap=0x260000) returned 1 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0069.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.862] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.862] GetLastError () returned 0x0 [0069.863] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.863] GetLastError () returned 0x0 [0069.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcc48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.866] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x33b8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x33b8, lpOverlapped=0x0) returned 1 [0069.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.866] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.866] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.867] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.867] CloseHandle (hObject=0xf0) returned 1 [0069.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.[deadmin@cock.li].deadmin")) returned 1 [0069.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0069.869] GetLastError () returned 0x0 [0069.870] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0069.870] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.870] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0069.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0069.871] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=18987165231) returned 1 [0069.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb87478d0, dwHighDateTime=0x1d585b4)) [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a618 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a618 | out: hHeap=0x260000) returned 1 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b9c8 [0069.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0069.871] GetLastError () returned 0x0 [0069.871] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0069.872] GetLastError () returned 0x0 [0069.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.928] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0069.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.937] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.075] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.086] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.087] CloseHandle (hObject=0xf0) returned 1 [0070.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.088] GetLastError () returned 0x0 [0070.089] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3111e0) returned 1 [0070.090] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.090] CryptReleaseContext (hProv=0x3111e0, dwFlags=0x0) returned 1 [0070.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.090] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19009105645) returned 1 [0070.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb895cc10, dwHighDateTime=0x1d585b4)) [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5d70 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5d70 | out: hHeap=0x260000) returned 1 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b898 [0070.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.091] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.096] GetLastError () returned 0x0 [0070.096] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.097] GetLastError () returned 0x0 [0070.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb258, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.099] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x4da8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x4da8, lpOverlapped=0x0) returned 1 [0070.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.100] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.100] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.100] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.101] CloseHandle (hObject=0xf0) returned 1 [0070.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.101] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.217] GetLastError () returned 0x0 [0070.247] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311488) returned 1 [0070.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.254] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.255] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19025571933) returned 1 [0070.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8affb30, dwHighDateTime=0x1d585b4)) [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5ef8 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5ef8 | out: hHeap=0x260000) returned 1 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0070.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.272] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.272] GetLastError () returned 0x0 [0070.272] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.272] GetLastError () returned 0x0 [0070.276] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.276] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.277] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.277] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.279] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.279] CloseHandle (hObject=0xfc) returned 1 [0070.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.[deadmin@cock.li].deadmin")) returned 1 [0070.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.286] GetLastError () returned 0x0 [0070.287] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312500) returned 1 [0070.287] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.288] CryptReleaseContext (hProv=0x312500, dwFlags=0x0) returned 1 [0070.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.288] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19028884651) returned 1 [0070.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8b4bdf0, dwHighDateTime=0x1d585b4)) [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cdc8 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cdc8 | out: hHeap=0x260000) returned 1 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297600 [0070.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.289] GetLastError () returned 0x0 [0070.289] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.289] GetLastError () returned 0x0 [0070.292] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff945, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.292] WriteFile (in: hFile=0x120, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x6bb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x6bb, lpOverlapped=0x0) returned 1 [0070.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.292] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.292] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.293] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.293] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.294] CloseHandle (hObject=0x120) returned 1 [0070.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.[deadmin@cock.li].deadmin")) returned 1 [0070.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.296] GetLastError () returned 0x0 [0070.297] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312500) returned 1 [0070.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.298] CryptReleaseContext (hProv=0x312500, dwFlags=0x0) returned 1 [0070.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.298] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19029945053) returned 1 [0070.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8b71f50, dwHighDateTime=0x1d585b4)) [0070.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cd90 [0070.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cd90 | out: hHeap=0x260000) returned 1 [0070.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296f78 [0070.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.299] GetLastError () returned 0x0 [0070.299] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.299] GetLastError () returned 0x0 [0070.304] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff0298, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.304] WriteFile (in: hFile=0x120, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xfd68, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0xfd68, lpOverlapped=0x0) returned 1 [0070.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.305] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.305] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.306] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.306] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.306] CloseHandle (hObject=0x120) returned 1 [0070.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2818360 [0070.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2818360 | out: hHeap=0x260000) returned 1 [0070.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.308] GetLastError () returned 0x0 [0070.309] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312940) returned 1 [0070.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.310] CryptReleaseContext (hProv=0x312940, dwFlags=0x0) returned 1 [0070.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.311] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19031167639) returned 1 [0070.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8b980b0, dwHighDateTime=0x1d585b4)) [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cd58 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cd58 | out: hHeap=0x260000) returned 1 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.311] GetLastError () returned 0x0 [0070.312] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.312] GetLastError () returned 0x0 [0070.316] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff68a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.316] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x9760, lpOverlapped=0x0) returned 1 [0070.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.317] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.317] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.318] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.318] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.318] CloseHandle (hObject=0x120) returned 1 [0070.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.320] GetLastError () returned 0x0 [0070.320] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0070.321] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.321] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.321] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19032236033) returned 1 [0070.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8b980b0, dwHighDateTime=0x1d585b4)) [0070.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cce8 [0070.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cce8 | out: hHeap=0x260000) returned 1 [0070.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0070.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.322] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.322] GetLastError () returned 0x0 [0070.322] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.322] GetLastError () returned 0x0 [0070.324] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffc772, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.324] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x388e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x388e, lpOverlapped=0x0) returned 1 [0070.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.379] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.380] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.389] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.398] CloseHandle (hObject=0x120) returned 1 [0070.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.[deadmin@cock.li].deadmin")) returned 1 [0070.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.443] GetLastError () returned 0x0 [0070.443] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312258) returned 1 [0070.444] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.444] CryptReleaseContext (hProv=0x312258, dwFlags=0x0) returned 1 [0070.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.444] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19044541266) returned 1 [0070.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8cc8bb0, dwHighDateTime=0x1d585b4)) [0070.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a9d0 [0070.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a9d0 | out: hHeap=0x260000) returned 1 [0070.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27ecda8 [0070.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ecda8 | out: hHeap=0x260000) returned 1 [0070.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecb28 [0070.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.445] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.445] GetLastError () returned 0x0 [0070.445] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.445] GetLastError () returned 0x0 [0070.447] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.447] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x26d, lpOverlapped=0x0) returned 1 [0070.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.448] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.448] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.448] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.449] CloseHandle (hObject=0x120) returned 1 [0070.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0070.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.451] GetLastError () returned 0x0 [0070.451] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312258) returned 1 [0070.452] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.452] CryptReleaseContext (hProv=0x312258, dwFlags=0x0) returned 1 [0070.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.452] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19045343860) returned 1 [0070.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8ceed10, dwHighDateTime=0x1d585b4)) [0070.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a998 [0070.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a998 | out: hHeap=0x260000) returned 1 [0070.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27ecda8 [0070.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ecda8 | out: hHeap=0x260000) returned 1 [0070.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec8c8 [0070.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.453] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.453] GetLastError () returned 0x0 [0070.453] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.453] GetLastError () returned 0x0 [0070.454] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.455] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xcd, lpOverlapped=0x0) returned 1 [0070.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.455] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.455] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.456] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.456] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.456] CloseHandle (hObject=0x120) returned 1 [0070.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0070.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.458] GetLastError () returned 0x0 [0070.458] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312258) returned 1 [0070.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.459] CryptReleaseContext (hProv=0x312258, dwFlags=0x0) returned 1 [0070.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.459] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19046062475) returned 1 [0070.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8ceed10, dwHighDateTime=0x1d585b4)) [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a960 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a960 | out: hHeap=0x260000) returned 1 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27ecda8 [0070.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ecda8 | out: hHeap=0x260000) returned 1 [0070.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec830 [0070.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.460] GetLastError () returned 0x0 [0070.460] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.461] GetLastError () returned 0x0 [0070.462] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.462] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0070.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.462] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.462] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.463] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.464] CloseHandle (hObject=0x120) returned 1 [0070.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0070.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.466] GetLastError () returned 0x0 [0070.466] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312258) returned 1 [0070.467] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.467] CryptReleaseContext (hProv=0x312258, dwFlags=0x0) returned 1 [0070.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.467] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19046828175) returned 1 [0070.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8d14e70, dwHighDateTime=0x1d585b4)) [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a928 [0070.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a928 | out: hHeap=0x260000) returned 1 [0070.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27ecda8 [0070.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ecda8 | out: hHeap=0x260000) returned 1 [0070.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec798 [0070.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.468] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.468] GetLastError () returned 0x0 [0070.468] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.468] GetLastError () returned 0x0 [0070.469] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.469] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0070.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.470] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.470] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.471] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.471] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.471] CloseHandle (hObject=0x120) returned 1 [0070.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0070.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.475] GetLastError () returned 0x0 [0070.495] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311b70) returned 1 [0070.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.496] CryptReleaseContext (hProv=0x311b70, dwFlags=0x0) returned 1 [0070.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.496] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19049901268) returned 1 [0070.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8d61130, dwHighDateTime=0x1d585b4)) [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2858078 [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2858078 | out: hHeap=0x260000) returned 1 [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec538 [0070.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.499] GetLastError () returned 0x0 [0070.499] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.499] GetLastError () returned 0x0 [0070.501] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd080, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.501] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2f80, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x2f80, lpOverlapped=0x0) returned 1 [0070.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.502] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.502] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.502] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.503] CloseHandle (hObject=0x108) returned 1 [0070.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.505] GetLastError () returned 0x0 [0070.505] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311b70) returned 1 [0070.506] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.506] CryptReleaseContext (hProv=0x311b70, dwFlags=0x0) returned 1 [0070.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.506] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19050744030) returned 1 [0070.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8d61130, dwHighDateTime=0x1d585b4)) [0070.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a8b8 [0070.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a8b8 | out: hHeap=0x260000) returned 1 [0070.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec4a0 [0070.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.507] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.507] GetLastError () returned 0x0 [0070.507] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.507] GetLastError () returned 0x0 [0070.540] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.540] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.541] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.542] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.542] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.542] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.543] CloseHandle (hObject=0x108) returned 1 [0070.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.[deadmin@cock.li].deadmin")) returned 1 [0070.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.701] GetLastError () returned 0x0 [0070.710] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311e18) returned 1 [0070.710] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.710] CryptReleaseContext (hProv=0x311e18, dwFlags=0x0) returned 1 [0070.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.711] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19071166013) returned 1 [0070.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8f50310, dwHighDateTime=0x1d585b4)) [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28584d8 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28584d8 | out: hHeap=0x260000) returned 1 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x357008 [0070.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357008 | out: hHeap=0x260000) returned 1 [0070.711] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.711] GetLastError () returned 0x0 [0070.711] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.712] GetLastError () returned 0x0 [0070.715] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff822d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.715] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x7dd3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x7dd3, lpOverlapped=0x0) returned 1 [0070.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.725] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.725] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.726] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.726] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.726] CloseHandle (hObject=0x108) returned 1 [0070.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.727] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.728] GetLastError () returned 0x0 [0070.728] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311e18) returned 1 [0070.729] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.729] CryptReleaseContext (hProv=0x311e18, dwFlags=0x0) returned 1 [0070.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.729] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19073046740) returned 1 [0070.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb8f76470, dwHighDateTime=0x1d585b4)) [0070.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a3e8 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a3e8 | out: hHeap=0x260000) returned 1 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314cf0 [0070.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314cf0 | out: hHeap=0x260000) returned 1 [0070.730] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.730] GetLastError () returned 0x0 [0070.730] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.731] GetLastError () returned 0x0 [0070.752] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffecd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.752] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x132a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x132a, lpOverlapped=0x0) returned 1 [0070.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.755] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.755] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.755] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.755] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.756] CloseHandle (hObject=0x108) returned 1 [0070.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.756] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.792] GetLastError () returned 0x0 [0070.793] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0070.794] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.794] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.794] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19079523365) returned 1 [0070.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9034b50, dwHighDateTime=0x1d585b4)) [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf80 [0070.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf80 | out: hHeap=0x260000) returned 1 [0070.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x356f60 [0070.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x356f60 | out: hHeap=0x260000) returned 1 [0070.795] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.795] GetLastError () returned 0x0 [0070.795] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.795] GetLastError () returned 0x0 [0070.806] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe6c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.806] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x193c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x193c, lpOverlapped=0x0) returned 1 [0070.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.807] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.807] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.808] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.808] CloseHandle (hObject=0x108) returned 1 [0070.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.810] GetLastError () returned 0x0 [0070.810] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0070.811] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.811] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.811] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19081233539) returned 1 [0070.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb905acb0, dwHighDateTime=0x1d585b4)) [0070.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d340 [0070.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d340 | out: hHeap=0x260000) returned 1 [0070.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.812] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.812] GetLastError () returned 0x0 [0070.812] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.812] GetLastError () returned 0x0 [0070.821] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.821] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x75c, lpOverlapped=0x0) returned 1 [0070.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.822] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.822] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.823] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.823] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.824] CloseHandle (hObject=0x108) returned 1 [0070.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0070.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css.[deadmin@cock.li].deadmin")) returned 1 [0070.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.825] GetLastError () returned 0x0 [0070.826] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0070.827] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.827] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.827] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19082791955) returned 1 [0070.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9080e10, dwHighDateTime=0x1d585b4)) [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d2d0 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d2d0 | out: hHeap=0x260000) returned 1 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.828] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.828] GetLastError () returned 0x0 [0070.828] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.828] GetLastError () returned 0x0 [0070.829] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.829] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0070.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.830] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.830] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.830] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.831] CloseHandle (hObject=0x108) returned 1 [0070.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0070.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0070.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.835] GetLastError () returned 0x0 [0070.902] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.902] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.902] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0070.902] WriteFile (in: hFile=0x108, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0070.904] CloseHandle (hObject=0x108) returned 1 [0070.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282a8f0 | out: hHeap=0x260000) returned 1 [0070.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.904] RtlWakeConditionVariable () returned 0x27e828 [0070.904] GetCurrentThreadId () returned 0x98c [0070.967] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0070.968] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.968] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.968] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19096930426) returned 1 [0070.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb91d7a70, dwHighDateTime=0x1d585b4)) [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32da08 [0070.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32da08 | out: hHeap=0x260000) returned 1 [0070.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.969] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0070.969] GetLastError () returned 0x0 [0070.969] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0070.969] GetLastError () returned 0x0 [0070.970] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.970] WriteFile (in: hFile=0x11c, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0070.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.971] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.971] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.972] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.972] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.972] CloseHandle (hObject=0x11c) returned 1 [0070.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0070.973] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0070.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.974] GetLastError () returned 0x0 [0071.023] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.025] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.025] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.025] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19102664000) returned 1 [0071.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9249e90, dwHighDateTime=0x1d585b4)) [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d8f0 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d8f0 | out: hHeap=0x260000) returned 1 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.026] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.027] GetLastError () returned 0x0 [0071.027] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.027] GetLastError () returned 0x0 [0071.030] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.030] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0071.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.031] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.032] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.033] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.033] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.033] CloseHandle (hObject=0x100) returned 1 [0071.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0071.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0071.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.106] GetLastError () returned 0x0 [0071.145] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.151] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.151] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.152] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19115280005) returned 1 [0071.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb93a0af0, dwHighDateTime=0x1d585b4)) [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32df18 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32df18 | out: hHeap=0x260000) returned 1 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.153] GetLastError () returned 0x0 [0071.153] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.153] GetLastError () returned 0x0 [0071.155] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.155] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0071.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.156] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.156] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.156] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.157] CloseHandle (hObject=0xfc) returned 1 [0071.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.158] GetLastError () returned 0x0 [0071.194] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.194] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.194] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.194] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.196] CloseHandle (hObject=0x100) returned 1 [0071.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dda8 | out: hHeap=0x260000) returned 1 [0071.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0071.196] RtlWakeConditionVariable () returned 0x27e828 [0071.196] GetCurrentThreadId () returned 0x98c [0071.196] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.197] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.197] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.197] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19119833582) returned 1 [0071.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb93ecdb0, dwHighDateTime=0x1d585b4)) [0071.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dfc0 [0071.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dfc0 | out: hHeap=0x260000) returned 1 [0071.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.198] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.198] GetLastError () returned 0x0 [0071.198] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.198] GetLastError () returned 0x0 [0071.201] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.201] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x1b8, lpOverlapped=0x0) returned 1 [0071.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.202] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.202] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.202] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.202] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.203] CloseHandle (hObject=0x100) returned 1 [0071.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.208] GetLastError () returned 0x0 [0071.208] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.209] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.209] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.209] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19121033540) returned 1 [0071.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9412f10, dwHighDateTime=0x1d585b4)) [0071.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32de00 [0071.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32de00 | out: hHeap=0x260000) returned 1 [0071.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.210] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.210] GetLastError () returned 0x0 [0071.210] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.210] GetLastError () returned 0x0 [0071.211] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.213] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0071.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.282] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.282] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.283] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.284] CloseHandle (hObject=0x100) returned 1 [0071.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.285] GetLastError () returned 0x0 [0071.310] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.311] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.314] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19131532496) returned 1 [0071.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb951d8b0, dwHighDateTime=0x1d585b4)) [0071.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2859c40 [0071.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2859c40 | out: hHeap=0x260000) returned 1 [0071.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.316] GetLastError () returned 0x0 [0071.316] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.316] GetLastError () returned 0x0 [0071.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff83c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.326] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x7c4, lpOverlapped=0x0) returned 1 [0071.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.330] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.330] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.330] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.334] CloseHandle (hObject=0xf0) returned 1 [0071.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0071.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css.[deadmin@cock.li].deadmin")) returned 1 [0071.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0071.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.336] GetLastError () returned 0x0 [0071.336] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312500) returned 1 [0071.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0071.337] CryptReleaseContext (hProv=0x312500, dwFlags=0x0) returned 1 [0071.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.337] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19133825625) returned 1 [0071.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9543a10, dwHighDateTime=0x1d585b4)) [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e490 [0071.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e490 | out: hHeap=0x260000) returned 1 [0071.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.338] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.338] GetLastError () returned 0x0 [0071.338] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.338] GetLastError () returned 0x0 [0071.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffef5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.339] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x10b, lpOverlapped=0x0) returned 1 [0071.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.340] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.340] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.340] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.340] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.341] CloseHandle (hObject=0xf0) returned 1 [0071.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0071.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0071.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.343] GetLastError () returned 0x0 [0071.343] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.343] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.343] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.343] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.344] CloseHandle (hObject=0xf0) returned 1 [0071.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de90 | out: hHeap=0x260000) returned 1 [0071.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0071.345] RtlWakeConditionVariable () returned 0x27e828 [0071.345] GetCurrentThreadId () returned 0x98c [0071.345] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312500) returned 1 [0071.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0071.346] CryptReleaseContext (hProv=0x312500, dwFlags=0x0) returned 1 [0071.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.346] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19134713529) returned 1 [0071.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9569b70, dwHighDateTime=0x1d585b4)) [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e420 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e420 | out: hHeap=0x260000) returned 1 [0071.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.347] GetLastError () returned 0x0 [0071.347] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.347] GetLastError () returned 0x0 [0071.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff289, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.349] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd77, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xd77, lpOverlapped=0x0) returned 1 [0071.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.350] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.350] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.350] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.351] CloseHandle (hObject=0xf0) returned 1 [0071.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0071.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css.[deadmin@cock.li].deadmin")) returned 1 [0071.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0071.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.352] GetLastError () returned 0x0 [0071.352] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.353] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.353] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.353] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19135447186) returned 1 [0071.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9569b70, dwHighDateTime=0x1d585b4)) [0071.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e3e8 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e3e8 | out: hHeap=0x260000) returned 1 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.354] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.354] GetLastError () returned 0x0 [0071.354] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.355] GetLastError () returned 0x0 [0071.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.415] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x715, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x715, lpOverlapped=0x0) returned 1 [0071.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.416] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.416] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.417] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.417] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.418] CloseHandle (hObject=0xf0) returned 1 [0071.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css.[deadmin@cock.li].deadmin")) returned 1 [0071.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.419] GetLastError () returned 0x0 [0071.419] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.420] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.420] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.421] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19142165330) returned 1 [0071.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9628250, dwHighDateTime=0x1d585b4)) [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7d50 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d50 | out: hHeap=0x260000) returned 1 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.421] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.421] GetLastError () returned 0x0 [0071.422] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.422] GetLastError () returned 0x0 [0071.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8fb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.426] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x705, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x705, lpOverlapped=0x0) returned 1 [0071.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.430] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.432] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.432] CloseHandle (hObject=0xf0) returned 1 [0071.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css.[deadmin@cock.li].deadmin")) returned 1 [0071.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.434] GetLastError () returned 0x0 [0071.442] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.505] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.505] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19150662918) returned 1 [0071.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb96e6930, dwHighDateTime=0x1d585b4)) [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e688 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e688 | out: hHeap=0x260000) returned 1 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.506] GetLastError () returned 0x0 [0071.506] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.511] GetLastError () returned 0x0 [0071.513] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.513] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x366, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x366, lpOverlapped=0x0) returned 1 [0071.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.516] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.516] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.516] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.517] CloseHandle (hObject=0xf0) returned 1 [0071.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.518] GetLastError () returned 0x0 [0071.519] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.519] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.519] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19152060082) returned 1 [0071.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb970ca90, dwHighDateTime=0x1d585b4)) [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e650 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e650 | out: hHeap=0x260000) returned 1 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.520] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.520] GetLastError () returned 0x0 [0071.520] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.520] GetLastError () returned 0x0 [0071.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.523] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0071.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.523] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.523] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.524] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.524] CloseHandle (hObject=0xf0) returned 1 [0071.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.526] GetLastError () returned 0x0 [0071.526] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.527] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.527] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.527] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19152839417) returned 1 [0071.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9732bf0, dwHighDateTime=0x1d585b4)) [0071.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e618 [0071.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e618 | out: hHeap=0x260000) returned 1 [0071.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.528] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.528] GetLastError () returned 0x0 [0071.528] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.528] GetLastError () returned 0x0 [0071.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.529] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0071.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.530] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.530] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.530] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.531] CloseHandle (hObject=0xf0) returned 1 [0071.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.589] GetLastError () returned 0x0 [0071.809] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.810] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.810] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.810] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19181109242) returned 1 [0071.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb99e04b0, dwHighDateTime=0x1d585b4)) [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e7d8 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e7d8 | out: hHeap=0x260000) returned 1 [0071.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.811] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.811] GetLastError () returned 0x0 [0071.811] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.811] GetLastError () returned 0x0 [0071.814] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.814] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xe2, lpOverlapped=0x0) returned 1 [0071.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.815] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.815] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.816] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.816] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.817] CloseHandle (hObject=0xfc) returned 1 [0071.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.[deadmin@cock.li].deadmin")) returned 1 [0071.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.819] GetLastError () returned 0x0 [0071.820] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0071.820] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.820] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.821] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19182167725) returned 1 [0071.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb99e04b0, dwHighDateTime=0x1d585b4)) [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e538 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e538 | out: hHeap=0x260000) returned 1 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.821] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.821] GetLastError () returned 0x0 [0071.822] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.822] GetLastError () returned 0x0 [0071.827] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff972, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.827] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x68e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x68e, lpOverlapped=0x0) returned 1 [0071.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.828] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.828] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.828] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.828] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.829] CloseHandle (hObject=0xfc) returned 1 [0071.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.829] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.830] GetLastError () returned 0x0 [0071.831] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.831] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.831] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.831] WriteFile (in: hFile=0xfc, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.832] CloseHandle (hObject=0xfc) returned 1 [0071.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28201a0 | out: hHeap=0x260000) returned 1 [0071.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.832] RtlWakeConditionVariable () returned 0x27e828 [0071.832] GetCurrentThreadId () returned 0x98c [0071.833] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311268) returned 1 [0071.834] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0071.834] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0071.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.834] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19183490083) returned 1 [0071.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9a06610, dwHighDateTime=0x1d585b4)) [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e3b0 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e3b0 | out: hHeap=0x260000) returned 1 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0071.835] GetLastError () returned 0x0 [0071.835] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0071.835] GetLastError () returned 0x0 [0072.149] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe634, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.149] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19cc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x19cc, lpOverlapped=0x0) returned 1 [0072.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.151] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.151] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.152] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.152] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.153] CloseHandle (hObject=0xfc) returned 1 [0072.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0072.163] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css.[deadmin@cock.li].deadmin")) returned 1 [0072.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0072.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.193] GetLastError () returned 0x0 [0072.290] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.316] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.316] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.316] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19231738830) returned 1 [0072.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9ea30b0, dwHighDateTime=0x1d585b4)) [0072.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db98 [0072.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db98 | out: hHeap=0x260000) returned 1 [0072.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.334] GetLastError () returned 0x0 [0072.334] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.334] GetLastError () returned 0x0 [0072.337] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.337] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0072.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.338] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.338] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.338] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.339] CloseHandle (hObject=0x100) returned 1 [0072.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0072.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.341] GetLastError () returned 0x0 [0072.341] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.342] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.342] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19234307548) returned 1 [0072.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9eef370, dwHighDateTime=0x1d585b4)) [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db28 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db28 | out: hHeap=0x260000) returned 1 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.343] GetLastError () returned 0x0 [0072.343] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.343] GetLastError () returned 0x0 [0072.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff8ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.345] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x732, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x732, lpOverlapped=0x0) returned 1 [0072.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.345] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.345] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.346] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.346] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.347] CloseHandle (hObject=0x100) returned 1 [0072.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0072.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css.[deadmin@cock.li].deadmin")) returned 1 [0072.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.351] GetLastError () returned 0x0 [0072.351] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.351] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.351] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0072.351] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0072.353] CloseHandle (hObject=0x100) returned 1 [0072.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e3e0 | out: hHeap=0x260000) returned 1 [0072.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.353] RtlWakeConditionVariable () returned 0x27e828 [0072.353] GetCurrentThreadId () returned 0x98c [0072.353] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.354] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.354] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0072.354] WriteFile (in: hFile=0x100, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0072.355] CloseHandle (hObject=0x100) returned 1 [0072.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0072.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0072.355] RtlWakeConditionVariable () returned 0x27e828 [0072.355] GetCurrentThreadId () returned 0x98c [0072.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314f90 | out: hHeap=0x260000) returned 1 [0072.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.356] RtlWakeConditionVariable () returned 0x27e828 [0072.356] GetCurrentThreadId () returned 0x98c [0072.357] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.358] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.358] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19235896799) returned 1 [0072.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f154d0, dwHighDateTime=0x1d585b4)) [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ce30 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce30 | out: hHeap=0x260000) returned 1 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0072.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.359] GetLastError () returned 0x0 [0072.359] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.359] GetLastError () returned 0x0 [0072.360] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffd8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.361] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x272, lpOverlapped=0x0) returned 1 [0072.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.361] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.361] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.362] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.363] CloseHandle (hObject=0x100) returned 1 [0072.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0072.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0072.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.364] GetLastError () returned 0x0 [0072.365] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.365] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.365] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.366] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19236675390) returned 1 [0072.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f154d0, dwHighDateTime=0x1d585b4)) [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ce68 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce68 | out: hHeap=0x260000) returned 1 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b830 [0072.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.366] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.366] GetLastError () returned 0x0 [0072.367] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.367] GetLastError () returned 0x0 [0072.368] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.368] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0xda, lpOverlapped=0x0) returned 1 [0072.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.369] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.369] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.370] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.370] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.370] CloseHandle (hObject=0x100) returned 1 [0072.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0072.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0072.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0072.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.372] GetLastError () returned 0x0 [0072.372] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.373] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.373] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.373] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19237451120) returned 1 [0072.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f3b630, dwHighDateTime=0x1d585b4)) [0072.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d028 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d028 | out: hHeap=0x260000) returned 1 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b798 [0072.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.374] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.374] GetLastError () returned 0x0 [0072.374] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.374] GetLastError () returned 0x0 [0072.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.375] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x6f, lpOverlapped=0x0) returned 1 [0072.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.376] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.376] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.377] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.377] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.377] CloseHandle (hObject=0x100) returned 1 [0072.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0072.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0072.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.379] GetLastError () returned 0x0 [0072.379] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.380] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.380] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19238149175) returned 1 [0072.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f3b630, dwHighDateTime=0x1d585b4)) [0072.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cea0 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cea0 | out: hHeap=0x260000) returned 1 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b700 [0072.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.381] GetLastError () returned 0x0 [0072.381] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.381] GetLastError () returned 0x0 [0072.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.383] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x6e, lpOverlapped=0x0) returned 1 [0072.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.383] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.384] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.384] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.385] CloseHandle (hObject=0x100) returned 1 [0072.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0072.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0072.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.386] GetLastError () returned 0x0 [0072.388] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311268) returned 1 [0072.389] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.389] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.389] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19238996303) returned 1 [0072.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f61790, dwHighDateTime=0x1d585b4)) [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d060 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.390] GetLastError () returned 0x0 [0072.390] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.390] GetLastError () returned 0x0 [0072.391] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff7298, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.391] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x8d68, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x8d68, lpOverlapped=0x0) returned 1 [0072.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.392] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.393] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.393] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.394] CloseHandle (hObject=0x100) returned 1 [0072.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.[deadmin@cock.li].deadmin")) returned 1 [0072.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.395] GetLastError () returned 0x0 [0072.396] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.397] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.397] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.397] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19239859905) returned 1 [0072.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f61790, dwHighDateTime=0x1d585b4)) [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d098 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d098 | out: hHeap=0x260000) returned 1 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b5d0 [0072.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.398] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.398] GetLastError () returned 0x0 [0072.398] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.399] GetLastError () returned 0x0 [0072.400] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff881, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.401] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x77f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x77f, lpOverlapped=0x0) returned 1 [0072.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.401] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.401] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.402] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.402] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.402] CloseHandle (hObject=0x100) returned 1 [0072.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0072.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.[deadmin@cock.li].deadmin")) returned 1 [0072.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0072.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.404] GetLastError () returned 0x0 [0072.405] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x312478) returned 1 [0072.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.405] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.405] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19240661433) returned 1 [0072.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xb9f878f0, dwHighDateTime=0x1d585b4)) [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d0d0 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d0d0 | out: hHeap=0x260000) returned 1 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.406] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.406] GetLastError () returned 0x0 [0072.406] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.407] GetLastError () returned 0x0 [0072.418] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffae3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.418] WriteFile (in: hFile=0x100, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x51d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x51d, lpOverlapped=0x0) returned 1 [0072.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.419] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.419] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.419] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.420] CloseHandle (hObject=0x100) returned 1 [0072.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.[deadmin@cock.li].deadmin")) returned 1 [0072.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.586] GetLastError () returned 0x0 [0072.586] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311268) returned 1 [0072.587] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.587] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.587] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19258809964) returned 1 [0072.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba150970, dwHighDateTime=0x1d585b4)) [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d40 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d40 | out: hHeap=0x260000) returned 1 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b538 [0072.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.588] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.588] GetLastError () returned 0x0 [0072.588] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.588] GetLastError () returned 0x0 [0072.610] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.610] WriteFile (in: hFile=0x104, lpBuffer=0x29350a8*, nNumberOfBytesToWrite=0x2bc8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29350a8*, lpNumberOfBytesWritten=0x224fdb0*=0x2bc8, lpOverlapped=0x0) returned 1 [0072.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29350a8 | out: hHeap=0x260000) returned 1 [0072.611] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.611] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.611] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.611] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.612] CloseHandle (hObject=0x104) returned 1 [0072.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.[deadmin@cock.li].deadmin")) returned 1 [0072.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.614] GetLastError () returned 0x0 [0072.614] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311bf8) returned 1 [0072.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.615] CryptReleaseContext (hProv=0x311bf8, dwFlags=0x0) returned 1 [0072.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.615] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19261608922) returned 1 [0072.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba176ad0, dwHighDateTime=0x1d585b4)) [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d570 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d570 | out: hHeap=0x260000) returned 1 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bd88 [0072.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.616] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.616] GetLastError () returned 0x0 [0072.616] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.616] GetLastError () returned 0x0 [0072.631] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.632] WriteFile (in: hFile=0x104, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0072.634] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.634] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.650] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.650] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.651] CloseHandle (hObject=0x104) returned 1 [0072.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.653] GetLastError () returned 0x0 [0072.653] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311bf8) returned 1 [0072.654] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.654] CryptReleaseContext (hProv=0x311bf8, dwFlags=0x0) returned 1 [0072.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.654] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19265516190) returned 1 [0072.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba1e8ef0, dwHighDateTime=0x1d585b4)) [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d500 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d500 | out: hHeap=0x260000) returned 1 [0072.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bc58 [0072.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.655] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.655] GetLastError () returned 0x0 [0072.655] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.655] GetLastError () returned 0x0 [0072.679] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.679] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0072.681] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.681] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.681] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.682] CloseHandle (hObject=0x104) returned 1 [0072.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.[deadmin@cock.li].deadmin")) returned 1 [0072.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.708] GetLastError () returned 0x0 [0072.709] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311510) returned 1 [0072.709] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.709] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.710] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19271072052) returned 1 [0072.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba25b310, dwHighDateTime=0x1d585b4)) [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d148 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d148 | out: hHeap=0x260000) returned 1 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bb28 [0072.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.710] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.710] GetLastError () returned 0x0 [0072.711] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.711] GetLastError () returned 0x0 [0072.733] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.733] WriteFile (in: hFile=0x11c, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.734] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.734] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.736] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.736] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.736] CloseHandle (hObject=0x11c) returned 1 [0072.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.749] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.751] GetLastError () returned 0x0 [0072.752] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311d08) returned 1 [0072.752] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.753] CryptReleaseContext (hProv=0x311d08, dwFlags=0x0) returned 1 [0072.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.753] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19275386004) returned 1 [0072.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba2cd730, dwHighDateTime=0x1d585b4)) [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d0a0 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d0a0 | out: hHeap=0x260000) returned 1 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x280e0a0 [0072.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280e0a0 | out: hHeap=0x260000) returned 1 [0072.753] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.754] GetLastError () returned 0x0 [0072.754] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.754] GetLastError () returned 0x0 [0072.760] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.760] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9b80, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x9b80, lpOverlapped=0x0) returned 1 [0072.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.761] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.761] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.762] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.762] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.762] CloseHandle (hObject=0x108) returned 1 [0072.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.763] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0072.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.764] GetLastError () returned 0x0 [0072.802] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c08) returned 1 [0072.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.803] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0072.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.803] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19280418106) returned 1 [0072.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba33fb50, dwHighDateTime=0x1d585b4)) [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e9d0 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e9d0 | out: hHeap=0x260000) returned 1 [0072.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ba90 [0072.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.804] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.804] GetLastError () returned 0x0 [0072.804] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.804] GetLastError () returned 0x0 [0072.807] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.807] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x58c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x58c, lpOverlapped=0x0) returned 1 [0072.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.808] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.809] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.809] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.809] CloseHandle (hObject=0x108) returned 1 [0072.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.[deadmin@cock.li].deadmin")) returned 1 [0072.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.811] GetLastError () returned 0x0 [0072.812] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311d08) returned 1 [0072.812] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.813] CryptReleaseContext (hProv=0x311d08, dwFlags=0x0) returned 1 [0072.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.813] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19281385907) returned 1 [0072.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba365cb0, dwHighDateTime=0x1d585b4)) [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e998 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e998 | out: hHeap=0x260000) returned 1 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x280e0a0 [0072.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ba90 [0072.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280e0a0 | out: hHeap=0x260000) returned 1 [0072.813] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.814] GetLastError () returned 0x0 [0072.814] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.814] GetLastError () returned 0x0 [0072.815] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.815] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xd4, lpOverlapped=0x0) returned 1 [0072.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.815] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.815] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.816] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.816] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.817] CloseHandle (hObject=0x108) returned 1 [0072.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0072.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.818] GetLastError () returned 0x0 [0072.819] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311d08) returned 1 [0072.820] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.820] CryptReleaseContext (hProv=0x311d08, dwFlags=0x0) returned 1 [0072.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.820] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19282094119) returned 1 [0072.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba365cb0, dwHighDateTime=0x1d585b4)) [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e960 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e960 | out: hHeap=0x260000) returned 1 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315428 [0072.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ba90 [0072.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315428 | out: hHeap=0x260000) returned 1 [0072.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.821] GetLastError () returned 0x0 [0072.821] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.862] GetLastError () returned 0x0 [0072.930] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.930] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0072.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0072.931] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.931] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.932] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.932] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.932] CloseHandle (hObject=0x108) returned 1 [0072.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.934] GetLastError () returned 0x0 [0072.935] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x295d148) returned 1 [0072.935] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.935] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0072.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.936] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19293665367) returned 1 [0072.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba4967b0, dwHighDateTime=0x1d585b4)) [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8338 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8338 | out: hHeap=0x260000) returned 1 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b8c8 [0072.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.936] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.936] GetLastError () returned 0x0 [0072.936] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.937] GetLastError () returned 0x0 [0072.938] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.938] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0072.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0072.938] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.938] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.939] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.939] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.940] CloseHandle (hObject=0x108) returned 1 [0072.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.940] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.941] GetLastError () returned 0x0 [0072.942] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x295d148) returned 1 [0072.942] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.942] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0072.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.943] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19294367685) returned 1 [0072.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba4967b0, dwHighDateTime=0x1d585b4)) [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8028 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8028 | out: hHeap=0x260000) returned 1 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ac50 [0072.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.943] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.943] GetLastError () returned 0x0 [0072.943] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.944] GetLastError () returned 0x0 [0072.945] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.945] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0072.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0072.945] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.946] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.946] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.946] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.947] CloseHandle (hObject=0x108) returned 1 [0072.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0072.949] GetLastError () returned 0x0 [0072.949] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x295d148) returned 1 [0072.950] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.950] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0072.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0072.950] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19295118890) returned 1 [0072.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba4bc910, dwHighDateTime=0x1d585b4)) [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ff0 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0072.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a408 [0072.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.951] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0072.951] GetLastError () returned 0x0 [0072.951] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0072.951] GetLastError () returned 0x0 [0073.008] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.008] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.011] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.011] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.030] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.030] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.030] CloseHandle (hObject=0x108) returned 1 [0073.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.032] GetLastError () returned 0x0 [0073.032] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3118c8) returned 1 [0073.033] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.033] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.033] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19303446678) returned 1 [0073.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba57aff0, dwHighDateTime=0x1d585b4)) [0073.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e68 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a9f8 [0073.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.034] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.034] GetLastError () returned 0x0 [0073.034] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.034] GetLastError () returned 0x0 [0073.129] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.129] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x26d, lpOverlapped=0x0) returned 1 [0073.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.132] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.132] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.133] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.133] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.133] CloseHandle (hObject=0x108) returned 1 [0073.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0073.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.138] GetLastError () returned 0x0 [0073.138] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311510) returned 1 [0073.139] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.139] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0073.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.139] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19314021162) returned 1 [0073.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba685990, dwHighDateTime=0x1d585b4)) [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299328 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299328 | out: hHeap=0x260000) returned 1 [0073.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a668 [0073.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.140] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.140] GetLastError () returned 0x0 [0073.140] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.140] GetLastError () returned 0x0 [0073.142] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.142] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0073.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.143] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.143] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.144] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.144] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.144] CloseHandle (hObject=0x108) returned 1 [0073.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.146] GetLastError () returned 0x0 [0073.208] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3118c8) returned 1 [0073.284] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.284] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.284] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19328535794) returned 1 [0073.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba7dc5f0, dwHighDateTime=0x1d585b4)) [0073.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299558 [0073.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299558 | out: hHeap=0x260000) returned 1 [0073.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0073.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.285] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.285] GetLastError () returned 0x0 [0073.285] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.285] GetLastError () returned 0x0 [0073.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.303] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0073.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.306] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.307] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.307] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.307] CloseHandle (hObject=0xf0) returned 1 [0073.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.[deadmin@cock.li].deadmin")) returned 1 [0073.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.309] GetLastError () returned 0x0 [0073.313] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x310c90) returned 1 [0073.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.315] CryptReleaseContext (hProv=0x310c90, dwFlags=0x0) returned 1 [0073.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.315] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19331626840) returned 1 [0073.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba8288b0, dwHighDateTime=0x1d585b4)) [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994e8 [0073.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0073.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0073.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.316] GetLastError () returned 0x0 [0073.316] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.316] GetLastError () returned 0x0 [0073.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.366] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.368] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.368] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.378] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.378] CloseHandle (hObject=0xf0) returned 1 [0073.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.415] GetLastError () returned 0x0 [0073.425] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3110d0) returned 1 [0073.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.426] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.426] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19342742764) returned 1 [0073.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba933250, dwHighDateTime=0x1d585b4)) [0073.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19f8 [0073.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0073.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751bb0 [0073.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.427] GetLastError () returned 0x0 [0073.427] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.427] GetLastError () returned 0x0 [0073.431] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff9e80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.431] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x6180, lpOverlapped=0x0) returned 1 [0073.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.432] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.432] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.433] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.433] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.433] CloseHandle (hObject=0x104) returned 1 [0073.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0073.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.435] GetLastError () returned 0x0 [0073.435] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311158) returned 1 [0073.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.436] CryptReleaseContext (hProv=0x311158, dwFlags=0x0) returned 1 [0073.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.436] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19343746526) returned 1 [0073.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba9593b0, dwHighDateTime=0x1d585b4)) [0073.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19c0 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19c0 | out: hHeap=0x260000) returned 1 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.437] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.437] GetLastError () returned 0x0 [0073.437] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.437] GetLastError () returned 0x0 [0073.462] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.462] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.464] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.482] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.482] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.482] CloseHandle (hObject=0x104) returned 1 [0073.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.493] GetLastError () returned 0x0 [0073.495] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3110d0) returned 1 [0073.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.496] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.496] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19349730036) returned 1 [0073.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba9f1930, dwHighDateTime=0x1d585b4)) [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1720 [0073.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0073.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0073.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.497] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.497] GetLastError () returned 0x0 [0073.497] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.497] GetLastError () returned 0x0 [0073.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.499] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xcf, lpOverlapped=0x0) returned 1 [0073.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.500] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.501] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.501] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.501] CloseHandle (hObject=0xf0) returned 1 [0073.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.503] GetLastError () returned 0x0 [0073.503] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3110d0) returned 1 [0073.504] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.504] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.504] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19350559404) returned 1 [0073.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xba9f1930, dwHighDateTime=0x1d585b4)) [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758e08 [0073.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.505] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.505] GetLastError () returned 0x0 [0073.505] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.506] GetLastError () returned 0x0 [0073.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.506] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0073.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.507] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.508] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.508] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.509] CloseHandle (hObject=0xf0) returned 1 [0073.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.510] GetLastError () returned 0x0 [0073.511] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3110d0) returned 1 [0073.512] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.512] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.512] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19351286797) returned 1 [0073.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbaa17a90, dwHighDateTime=0x1d585b4)) [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758d70 [0073.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.512] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.513] GetLastError () returned 0x0 [0073.513] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.513] GetLastError () returned 0x0 [0073.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.514] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0073.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.514] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.515] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.516] CloseHandle (hObject=0xf0) returned 1 [0073.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.517] GetLastError () returned 0x0 [0073.518] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3110d0) returned 1 [0073.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.519] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.519] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19351989129) returned 1 [0073.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbaa17a90, dwHighDateTime=0x1d585b4)) [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff90 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff90 | out: hHeap=0x260000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758c40 [0073.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.519] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.520] GetLastError () returned 0x0 [0073.520] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.521] GetLastError () returned 0x0 [0073.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.589] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.591] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.690] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.695] CloseHandle (hObject=0xf0) returned 1 [0073.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c498 [0073.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.[deadmin@cock.li].deadmin")) returned 1 [0073.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c498 | out: hHeap=0x260000) returned 1 [0073.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.696] GetLastError () returned 0x0 [0073.697] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0073.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.698] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.698] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19369884100) returned 1 [0073.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbabe0b10, dwHighDateTime=0x1d585b4)) [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d390 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d390 | out: hHeap=0x260000) returned 1 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758ba8 [0073.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.699] GetLastError () returned 0x0 [0073.699] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.699] GetLastError () returned 0x0 [0073.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.700] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x28b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x28b, lpOverlapped=0x0) returned 1 [0073.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.701] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.702] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.702] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.702] CloseHandle (hObject=0xf0) returned 1 [0073.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0073.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.704] GetLastError () returned 0x0 [0073.704] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0073.705] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.705] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.706] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19370670717) returned 1 [0073.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbabe0b10, dwHighDateTime=0x1d585b4)) [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d3c8 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758780 [0073.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.706] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.706] GetLastError () returned 0x0 [0073.707] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.707] GetLastError () returned 0x0 [0073.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.708] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xd3, lpOverlapped=0x0) returned 1 [0073.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.708] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.708] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.709] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.709] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.710] CloseHandle (hObject=0xf0) returned 1 [0073.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.722] GetLastError () returned 0x0 [0073.722] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0073.723] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.723] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.723] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19372410553) returned 1 [0073.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbac06c70, dwHighDateTime=0x1d585b4)) [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d400 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3156c8 [0073.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3156c8 | out: hHeap=0x260000) returned 1 [0073.724] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.724] GetLastError () returned 0x0 [0073.724] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.724] GetLastError () returned 0x0 [0073.725] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.725] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0073.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.726] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.726] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.726] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.727] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.727] CloseHandle (hObject=0xf0) returned 1 [0073.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.727] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.729] GetLastError () returned 0x0 [0073.729] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0073.730] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.730] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.730] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19373133129) returned 1 [0073.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbac2cdd0, dwHighDateTime=0x1d585b4)) [0073.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da90 [0073.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da90 | out: hHeap=0x260000) returned 1 [0073.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315818 [0073.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315818 | out: hHeap=0x260000) returned 1 [0073.731] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.731] GetLastError () returned 0x0 [0073.731] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.731] GetLastError () returned 0x0 [0073.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.732] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0073.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.733] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.734] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.734] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.734] CloseHandle (hObject=0xf0) returned 1 [0073.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0073.736] GetLastError () returned 0x0 [0073.736] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756060) returned 1 [0073.737] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.737] CryptReleaseContext (hProv=0x2756060, dwFlags=0x0) returned 1 [0073.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0073.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0073.737] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19373841979) returned 1 [0073.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbac2cdd0, dwHighDateTime=0x1d585b4)) [0073.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0073.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0073.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0073.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da58 [0073.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da58 | out: hHeap=0x260000) returned 1 [0073.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.738] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0073.738] GetLastError () returned 0x0 [0073.738] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0073.738] GetLastError () returned 0x0 [0073.767] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.767] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.784] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.002] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.002] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.002] CloseHandle (hObject=0xf0) returned 1 [0074.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0074.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.[deadmin@cock.li].deadmin")) returned 1 [0074.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0074.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.004] GetLastError () returned 0x0 [0074.177] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27561f8) returned 1 [0074.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.178] CryptReleaseContext (hProv=0x27561f8, dwFlags=0x0) returned 1 [0074.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.182] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19418272129) returned 1 [0074.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb07d5b0, dwHighDateTime=0x1d585b4)) [0074.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0074.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0074.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3265a8 [0074.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.184] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.185] GetLastError () returned 0x0 [0074.185] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.185] GetLastError () returned 0x0 [0074.192] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.192] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0074.194] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.194] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.198] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.198] CloseHandle (hObject=0xfc) returned 1 [0074.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0074.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0074.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0074.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.200] GetLastError () returned 0x0 [0074.201] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756528) returned 1 [0074.201] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.201] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.202] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19420271744) returned 1 [0074.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb0a3710, dwHighDateTime=0x1d585b4)) [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f48 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f48 | out: hHeap=0x260000) returned 1 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3265a8 [0074.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.202] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.202] GetLastError () returned 0x0 [0074.203] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.203] GetLastError () returned 0x0 [0074.205] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.205] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0074.206] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.206] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.420] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.420] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.420] CloseHandle (hObject=0xfc) returned 1 [0074.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0074.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.422] GetLastError () returned 0x0 [0074.422] RtlWakeConditionVariable () returned 0x27e828 [0074.422] GetCurrentThreadId () returned 0x98c [0074.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".ldf") returned 0x0 [0074.422] lstrlenW (lpString=".vhd") returned 4 [0074.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".vhd") returned 0x0 [0074.422] lstrlenW (lpString=".vhdx") returned 5 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".vhdx") returned 0x0 [0074.423] lstrlenW (lpString=".pst") returned 4 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".pst") returned 0x0 [0074.423] lstrlenW (lpString=".ost") returned 4 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".ost") returned 0x0 [0074.423] lstrlenW (lpString=".bak") returned 4 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".bak") returned 0x0 [0074.423] lstrlenW (lpString=".bac") returned 4 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".bac") returned 0x0 [0074.423] lstrlenW (lpString=".sys") returned 4 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".sys") returned 0x0 [0074.423] lstrlenW (lpString=".v2i") returned 4 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".v2i") returned 0x0 [0074.423] lstrlenW (lpString="s\r\n.v2i") returned 7 [0074.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0074.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0074.615] lstrlenW (lpString=".sql") returned 4 [0074.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".sql") returned 0x0 [0074.615] lstrlenW (lpString=".mdf") returned 4 [0074.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".mdf") returned 0x0 [0074.615] lstrlenW (lpString=".txt") returned 4 [0074.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".txt") returned 0x0 [0074.615] lstrlenW (lpString=".dbf") returned 4 [0074.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".dbf") returned 0x0 [0074.615] lstrlenW (lpString=".ckp") returned 4 [0074.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".ckp") returned 0x0 [0074.615] lstrlenW (lpString=".dacpac") returned 7 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".dacpac") returned 0x0 [0074.616] lstrlenW (lpString=".db3") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".db3") returned 0x0 [0074.616] lstrlenW (lpString=".dtxs") returned 5 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".dtxs") returned 0x0 [0074.616] lstrlenW (lpString=".mdt") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".mdt") returned 0x0 [0074.616] lstrlenW (lpString=".sdf") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".sdf") returned 0x0 [0074.616] lstrlenW (lpString=".MDF") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".MDF") returned 0x0 [0074.616] lstrlenW (lpString=".DBF") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".DBF") returned 0x0 [0074.616] lstrlenW (lpString=".DB") returned 3 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".DB") returned 0x0 [0074.616] lstrlenW (lpString=".db") returned 3 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".db") returned 0x0 [0074.616] lstrlenW (lpString=".ndf") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".ndf") returned 0x0 [0074.616] lstrlenW (lpString=".NDF") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".NDF") returned 0x0 [0074.616] lstrlenW (lpString=".Mdf") returned 4 [0074.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".Mdf") returned 0x0 [0074.616] lstrlenW (lpString=".dat") returned 4 [0074.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".dat") returned 0x0 [0074.617] lstrlenW (lpString=".DAT") returned 4 [0074.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".DAT") returned 0x0 [0074.617] lstrlenW (lpString=".ldf") returned 4 [0074.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".ldf") returned 0x0 [0074.617] lstrlenW (lpString=".LDF") returned 4 [0074.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch=".LDF") returned 0x0 [0074.617] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0074.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0074.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a578 [0074.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0074.617] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0074.618] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.618] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.618] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19461925299) returned 1 [0074.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb4a7c30, dwHighDateTime=0x1d585b4)) [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2889ed8 [0074.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2889ed8 | out: hHeap=0x260000) returned 1 [0074.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a2c0 [0074.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.619] GetLastError () returned 0x0 [0074.619] GetLastError () returned 0x0 [0074.619] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.620] GetLastError () returned 0x0 [0074.620] GetLastError () returned 0x0 [0074.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.624] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.625] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.625] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.627] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.627] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.627] CloseHandle (hObject=0xf0) returned 1 [0074.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x281acc8 [0074.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.[deadmin@cock.li].deadmin")) returned 1 [0074.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281acc8 | out: hHeap=0x260000) returned 1 [0074.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.629] GetLastError () returned 0x0 [0074.629] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0074.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.630] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.631] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19463183799) returned 1 [0074.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb4cdd90, dwHighDateTime=0x1d585b4)) [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1108 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1108 | out: hHeap=0x260000) returned 1 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x280f798 [0074.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326218 [0074.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280f798 | out: hHeap=0x260000) returned 1 [0074.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.632] GetLastError () returned 0x0 [0074.632] GetLastError () returned 0x0 [0074.632] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.632] GetLastError () returned 0x0 [0074.632] GetLastError () returned 0x0 [0074.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffef680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.635] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x10980, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x10980, lpOverlapped=0x0) returned 1 [0074.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.636] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.636] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.637] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.637] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.637] CloseHandle (hObject=0xf0) returned 1 [0074.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0074.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.639] GetLastError () returned 0x0 [0074.640] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0074.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.640] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.641] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19464175730) returned 1 [0074.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb4cdd90, dwHighDateTime=0x1d585b4)) [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27521b0 [0074.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326218 [0074.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27521b0 | out: hHeap=0x260000) returned 1 [0074.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.642] GetLastError () returned 0x0 [0074.642] GetLastError () returned 0x0 [0074.642] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.642] GetLastError () returned 0x0 [0074.642] GetLastError () returned 0x0 [0074.645] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.645] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.647] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.649] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.649] CloseHandle (hObject=0xf0) returned 1 [0074.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0074.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.651] GetLastError () returned 0x0 [0074.652] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0074.653] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.653] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.654] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19465469934) returned 1 [0074.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb4f3ef0, dwHighDateTime=0x1d585b4)) [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5438 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5438 | out: hHeap=0x260000) returned 1 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752258 [0074.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326218 [0074.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752258 | out: hHeap=0x260000) returned 1 [0074.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.654] GetLastError () returned 0x0 [0074.655] GetLastError () returned 0x0 [0074.655] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.655] GetLastError () returned 0x0 [0074.655] GetLastError () returned 0x0 [0074.808] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff349, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.808] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0xcb7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x224fdb0*=0xcb7, lpOverlapped=0x0) returned 1 [0074.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.810] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.811] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.811] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.812] CloseHandle (hObject=0xf0) returned 1 [0074.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini.[deadmin@cock.li].deadmin")) returned 1 [0074.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0074.945] GetLastError () returned 0x0 [0074.945] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0074.946] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.946] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0074.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0074.946] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19494734593) returned 1 [0074.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb7c7910, dwHighDateTime=0x1d585b4)) [0074.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0074.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0074.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0074.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f52b0 [0074.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f52b0 | out: hHeap=0x260000) returned 1 [0074.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752300 [0074.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752300 | out: hHeap=0x260000) returned 1 [0074.947] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0074.947] GetLastError () returned 0x0 [0074.947] GetLastError () returned 0x0 [0074.947] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0074.948] GetLastError () returned 0x0 [0074.948] GetLastError () returned 0x0 [0074.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.972] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.974] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.003] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.003] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.004] CloseHandle (hObject=0xf0) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css.[deadmin@cock.li].deadmin")) returned 1 [0075.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.035] GetLastError () returned 0x0 [0075.036] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.037] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.037] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.037] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19503795796) returned 1 [0075.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb8ac150, dwHighDateTime=0x1d585b4)) [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5390 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5390 | out: hHeap=0x260000) returned 1 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752990 [0075.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752990 | out: hHeap=0x260000) returned 1 [0075.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.038] GetLastError () returned 0x0 [0075.038] GetLastError () returned 0x0 [0075.038] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.038] GetLastError () returned 0x0 [0075.038] GetLastError () returned 0x0 [0075.044] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.044] WriteFile (in: hFile=0xfc, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.046] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.046] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.052] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.052] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.052] CloseHandle (hObject=0xfc) returned 1 [0075.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css.[deadmin@cock.li].deadmin")) returned 1 [0075.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.056] GetLastError () returned 0x0 [0075.056] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.057] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0075.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.057] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19505845364) returned 1 [0075.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbb8d22b0, dwHighDateTime=0x1d585b4)) [0075.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0075.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f80 [0075.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f80 | out: hHeap=0x260000) returned 1 [0075.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752c30 [0075.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752c30 | out: hHeap=0x260000) returned 1 [0075.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.058] GetLastError () returned 0x0 [0075.058] GetLastError () returned 0x0 [0075.059] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.059] GetLastError () returned 0x0 [0075.059] GetLastError () returned 0x0 [0075.325] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.325] WriteFile (in: hFile=0xfc, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0075.327] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.327] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.437] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.438] CloseHandle (hObject=0xfc) returned 1 [0075.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css.[deadmin@cock.li].deadmin")) returned 1 [0075.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.693] GetLastError () returned 0x0 [0075.767] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.768] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.768] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.768] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19576910673) returned 1 [0075.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbbf84090, dwHighDateTime=0x1d585b4)) [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x290f0a8 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290f0a8 | out: hHeap=0x260000) returned 1 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752d80 [0075.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752d80 | out: hHeap=0x260000) returned 1 [0075.769] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.769] GetLastError () returned 0x0 [0075.769] GetLastError () returned 0x0 [0075.769] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.769] GetLastError () returned 0x0 [0075.770] GetLastError () returned 0x0 [0075.774] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.774] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.777] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.777] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.778] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.778] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.779] CloseHandle (hObject=0xe4) returned 1 [0075.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css.[deadmin@cock.li].deadmin")) returned 1 [0075.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.781] GetLastError () returned 0x0 [0075.781] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.782] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.782] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19578304247) returned 1 [0075.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbbfaa1f0, dwHighDateTime=0x1d585b4)) [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27539f8 [0075.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27539f8 | out: hHeap=0x260000) returned 1 [0075.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.783] GetLastError () returned 0x0 [0075.783] GetLastError () returned 0x0 [0075.783] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.783] GetLastError () returned 0x0 [0075.783] GetLastError () returned 0x0 [0075.786] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.786] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.788] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.788] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.788] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.789] CloseHandle (hObject=0xe4) returned 1 [0075.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css.[deadmin@cock.li].deadmin")) returned 1 [0075.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.791] GetLastError () returned 0x0 [0075.791] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.792] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.792] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.792] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19579314850) returned 1 [0075.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbbfd0350, dwHighDateTime=0x1d585b4)) [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f90 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0075.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0075.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0075.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753aa0 [0075.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753aa0 | out: hHeap=0x260000) returned 1 [0075.793] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.793] GetLastError () returned 0x0 [0075.793] GetLastError () returned 0x0 [0075.793] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.793] GetLastError () returned 0x0 [0075.793] GetLastError () returned 0x0 [0075.796] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.797] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.798] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.798] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.799] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.799] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.799] CloseHandle (hObject=0xe4) returned 1 [0075.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.800] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css.[deadmin@cock.li].deadmin")) returned 1 [0075.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.813] GetLastError () returned 0x0 [0075.814] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.815] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.815] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.815] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19581588105) returned 1 [0075.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbbff64b0, dwHighDateTime=0x1d585b4)) [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337fc8 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337fc8 | out: hHeap=0x260000) returned 1 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753b48 [0075.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753b48 | out: hHeap=0x260000) returned 1 [0075.815] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.816] GetLastError () returned 0x0 [0075.816] GetLastError () returned 0x0 [0075.816] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.816] GetLastError () returned 0x0 [0075.816] GetLastError () returned 0x0 [0075.819] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.820] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.821] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.821] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.822] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.822] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.822] CloseHandle (hObject=0xe4) returned 1 [0075.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css.[deadmin@cock.li].deadmin")) returned 1 [0075.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.824] GetLastError () returned 0x0 [0075.825] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.825] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.826] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.826] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19582685689) returned 1 [0075.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc01c610, dwHighDateTime=0x1d585b4)) [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338000 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338000 | out: hHeap=0x260000) returned 1 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753bf0 [0075.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753bf0 | out: hHeap=0x260000) returned 1 [0075.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.827] GetLastError () returned 0x0 [0075.827] GetLastError () returned 0x0 [0075.827] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.827] GetLastError () returned 0x0 [0075.827] GetLastError () returned 0x0 [0075.830] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.830] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.831] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.831] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.832] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.832] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.833] CloseHandle (hObject=0xe4) returned 1 [0075.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css.[deadmin@cock.li].deadmin")) returned 1 [0075.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.835] GetLastError () returned 0x0 [0075.835] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.836] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.836] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19583694911) returned 1 [0075.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc042770, dwHighDateTime=0x1d585b4)) [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338070 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338070 | out: hHeap=0x260000) returned 1 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753c98 [0075.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753c98 | out: hHeap=0x260000) returned 1 [0075.836] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.837] GetLastError () returned 0x0 [0075.837] GetLastError () returned 0x0 [0075.837] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.837] GetLastError () returned 0x0 [0075.837] GetLastError () returned 0x0 [0075.926] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.927] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.928] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.928] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.928] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.929] CloseHandle (hObject=0xe4) returned 1 [0075.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css.[deadmin@cock.li].deadmin")) returned 1 [0075.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.931] GetLastError () returned 0x0 [0075.931] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.932] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.932] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.932] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19593305349) returned 1 [0075.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc126fb0, dwHighDateTime=0x1d585b4)) [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294870 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294870 | out: hHeap=0x260000) returned 1 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c83a0 [0075.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c83a0 | out: hHeap=0x260000) returned 1 [0075.933] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.933] GetLastError () returned 0x0 [0075.933] GetLastError () returned 0x0 [0075.933] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.933] GetLastError () returned 0x0 [0075.933] GetLastError () returned 0x0 [0075.945] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.945] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.947] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.947] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.947] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.947] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.948] CloseHandle (hObject=0xe4) returned 1 [0075.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css.[deadmin@cock.li].deadmin")) returned 1 [0075.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.950] GetLastError () returned 0x0 [0075.960] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.979] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.979] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.979] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19598043820) returned 1 [0075.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc1993d0, dwHighDateTime=0x1d585b4)) [0075.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949f8 [0075.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0075.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8838 [0075.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8838 | out: hHeap=0x260000) returned 1 [0075.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.980] GetLastError () returned 0x0 [0075.981] GetLastError () returned 0x0 [0075.981] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.981] GetLastError () returned 0x0 [0075.981] GetLastError () returned 0x0 [0075.984] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.984] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.985] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.985] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.986] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.986] CloseHandle (hObject=0xe4) returned 1 [0075.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css.[deadmin@cock.li].deadmin")) returned 1 [0075.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0075.988] GetLastError () returned 0x0 [0075.988] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0075.989] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.989] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0075.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0075.989] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19599049446) returned 1 [0075.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc1bf530, dwHighDateTime=0x1d585b4)) [0075.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294a30 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a30 | out: hHeap=0x260000) returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c86e8 [0075.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c86e8 | out: hHeap=0x260000) returned 1 [0075.990] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0075.990] GetLastError () returned 0x0 [0075.990] GetLastError () returned 0x0 [0075.990] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0075.991] GetLastError () returned 0x0 [0075.991] GetLastError () returned 0x0 [0075.994] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.994] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.996] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.996] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.997] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.997] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.998] CloseHandle (hObject=0xe4) returned 1 [0075.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css.[deadmin@cock.li].deadmin")) returned 1 [0075.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.000] GetLastError () returned 0x0 [0076.000] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0076.000] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0076.000] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0076.000] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0076.002] CloseHandle (hObject=0xe4) returned 1 [0076.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348ba0 | out: hHeap=0x260000) returned 1 [0076.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0076.002] RtlWakeConditionVariable () returned 0x27e828 [0076.002] GetCurrentThreadId () returned 0x98c [0076.085] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.113] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.113] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.113] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19611450387) returned 1 [0076.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc2f0030, dwHighDateTime=0x1d585b4)) [0076.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d40 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e5e0 [0076.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753f38 [0076.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e5e0 | out: hHeap=0x260000) returned 1 [0076.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753f38 | out: hHeap=0x260000) returned 1 [0076.114] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.114] GetLastError () returned 0x0 [0076.114] GetLastError () returned 0x0 [0076.114] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.115] GetLastError () returned 0x0 [0076.115] GetLastError () returned 0x0 [0076.116] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe7d5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.116] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x182b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x182b, lpOverlapped=0x0) returned 1 [0076.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.118] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.118] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.118] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.119] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.119] CloseHandle (hObject=0xe4) returned 1 [0076.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini.[deadmin@cock.li].deadmin")) returned 1 [0076.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.121] GetLastError () returned 0x0 [0076.122] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.123] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.123] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19612391785) returned 1 [0076.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc2f0030, dwHighDateTime=0x1d585b4)) [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e5e0 [0076.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753f38 [0076.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e5e0 | out: hHeap=0x260000) returned 1 [0076.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ae08 [0076.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753f38 | out: hHeap=0x260000) returned 1 [0076.123] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.124] GetLastError () returned 0x0 [0076.124] GetLastError () returned 0x0 [0076.124] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.124] GetLastError () returned 0x0 [0076.124] GetLastError () returned 0x0 [0076.126] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff093, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.126] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xf6d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xf6d, lpOverlapped=0x0) returned 1 [0076.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.127] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.127] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.128] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.129] CloseHandle (hObject=0xe4) returned 1 [0076.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.130] GetLastError () returned 0x0 [0076.131] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.131] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.131] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.131] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19613260363) returned 1 [0076.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc316190, dwHighDateTime=0x1d585b4)) [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d08 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d08 | out: hHeap=0x260000) returned 1 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e5e0 [0076.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9018 [0076.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e5e0 | out: hHeap=0x260000) returned 1 [0076.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0076.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9018 | out: hHeap=0x260000) returned 1 [0076.132] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.132] GetLastError () returned 0x0 [0076.132] GetLastError () returned 0x0 [0076.133] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.133] GetLastError () returned 0x0 [0076.133] GetLastError () returned 0x0 [0076.134] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffcbf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.135] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3408, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x3408, lpOverlapped=0x0) returned 1 [0076.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.135] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.136] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.136] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.136] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.137] CloseHandle (hObject=0xe4) returned 1 [0076.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.138] GetLastError () returned 0x0 [0076.139] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.140] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.140] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.140] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19614092500) returned 1 [0076.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc316190, dwHighDateTime=0x1d585b4)) [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e5e0 [0076.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c90c0 [0076.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e5e0 | out: hHeap=0x260000) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0076.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c90c0 | out: hHeap=0x260000) returned 1 [0076.140] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.141] GetLastError () returned 0x0 [0076.141] GetLastError () returned 0x0 [0076.141] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.141] GetLastError () returned 0x0 [0076.141] GetLastError () returned 0x0 [0076.143] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd282, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.143] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2d7e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2d7e, lpOverlapped=0x0) returned 1 [0076.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.144] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.144] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.145] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.145] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.146] CloseHandle (hObject=0xe4) returned 1 [0076.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.220] GetLastError () returned 0x0 [0076.229] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.230] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.230] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.230] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19623132581) returned 1 [0076.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc3fa9d0, dwHighDateTime=0x1d585b4)) [0076.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca2c0 [0076.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca2c0 | out: hHeap=0x260000) returned 1 [0076.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753f38 [0076.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ac40 [0076.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753f38 | out: hHeap=0x260000) returned 1 [0076.231] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.231] GetLastError () returned 0x0 [0076.231] GetLastError () returned 0x0 [0076.231] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.231] GetLastError () returned 0x0 [0076.232] GetLastError () returned 0x0 [0076.233] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff46a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.233] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xb96, lpOverlapped=0x0) returned 1 [0076.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.234] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.234] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.235] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.235] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.236] CloseHandle (hObject=0xd8) returned 1 [0076.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.237] GetLastError () returned 0x0 [0076.238] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.239] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.239] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19623985218) returned 1 [0076.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc420b30, dwHighDateTime=0x1d585b4)) [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca2f8 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca2f8 | out: hHeap=0x260000) returned 1 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753f38 [0076.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275aa78 [0076.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753f38 | out: hHeap=0x260000) returned 1 [0076.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.240] GetLastError () returned 0x0 [0076.240] GetLastError () returned 0x0 [0076.240] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.240] GetLastError () returned 0x0 [0076.240] GetLastError () returned 0x0 [0076.242] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff08d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.242] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf73, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xf73, lpOverlapped=0x0) returned 1 [0076.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.243] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.243] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.244] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.244] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.244] CloseHandle (hObject=0xd8) returned 1 [0076.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.246] GetLastError () returned 0x0 [0076.246] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.247] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.247] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.247] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19624843972) returned 1 [0076.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc420b30, dwHighDateTime=0x1d585b4)) [0076.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca330 [0076.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca330 | out: hHeap=0x260000) returned 1 [0076.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9168 [0076.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9168 | out: hHeap=0x260000) returned 1 [0076.248] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.248] GetLastError () returned 0x0 [0076.248] GetLastError () returned 0x0 [0076.248] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.249] GetLastError () returned 0x0 [0076.249] GetLastError () returned 0x0 [0076.250] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffccd2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.250] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x332e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x332e, lpOverlapped=0x0) returned 1 [0076.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.251] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.251] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.252] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.252] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.253] CloseHandle (hObject=0xd8) returned 1 [0076.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.255] GetLastError () returned 0x0 [0076.256] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.257] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.257] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.257] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19625812268) returned 1 [0076.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc446c90, dwHighDateTime=0x1d585b4)) [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca368 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca368 | out: hHeap=0x260000) returned 1 [0076.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c98a0 [0076.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c98a0 | out: hHeap=0x260000) returned 1 [0076.258] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.258] GetLastError () returned 0x0 [0076.258] GetLastError () returned 0x0 [0076.258] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.258] GetLastError () returned 0x0 [0076.258] GetLastError () returned 0x0 [0076.261] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffb426, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.261] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4bda, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x4bda, lpOverlapped=0x0) returned 1 [0076.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.261] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.261] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.262] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.262] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.263] CloseHandle (hObject=0xd8) returned 1 [0076.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.264] GetLastError () returned 0x0 [0076.265] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.265] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.265] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.266] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19626680434) returned 1 [0076.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc446c90, dwHighDateTime=0x1d585b4)) [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca3a0 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca3a0 | out: hHeap=0x260000) returned 1 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9948 [0076.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9948 | out: hHeap=0x260000) returned 1 [0076.266] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.267] GetLastError () returned 0x0 [0076.267] GetLastError () returned 0x0 [0076.267] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.267] GetLastError () returned 0x0 [0076.267] GetLastError () returned 0x0 [0076.369] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.369] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x838, lpOverlapped=0x0) returned 1 [0076.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.369] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.370] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.370] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.370] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.371] CloseHandle (hObject=0xd8) returned 1 [0076.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.527] GetLastError () returned 0x0 [0076.531] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.532] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.532] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.532] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19653291893) returned 1 [0076.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc6ce3f0, dwHighDateTime=0x1d585b4)) [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca8a8 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca8a8 | out: hHeap=0x260000) returned 1 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cca30 [0076.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cca30 | out: hHeap=0x260000) returned 1 [0076.532] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.533] GetLastError () returned 0x0 [0076.533] GetLastError () returned 0x0 [0076.533] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.533] GetLastError () returned 0x0 [0076.533] GetLastError () returned 0x0 [0076.536] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7f27, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.536] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x80d9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x80d9, lpOverlapped=0x0) returned 1 [0076.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.537] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.537] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.537] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.537] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.538] CloseHandle (hObject=0x108) returned 1 [0076.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.540] GetLastError () returned 0x0 [0076.540] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.541] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.541] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.541] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19654217650) returned 1 [0076.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc6f4550, dwHighDateTime=0x1d585b4)) [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca8e0 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca8e0 | out: hHeap=0x260000) returned 1 [0076.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ccb80 [0076.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ccb80 | out: hHeap=0x260000) returned 1 [0076.542] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.542] GetLastError () returned 0x0 [0076.542] GetLastError () returned 0x0 [0076.542] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.542] GetLastError () returned 0x0 [0076.542] GetLastError () returned 0x0 [0076.544] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.544] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3ae8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3ae8, lpOverlapped=0x0) returned 1 [0076.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.545] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.545] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.546] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.547] CloseHandle (hObject=0x108) returned 1 [0076.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.549] GetLastError () returned 0x0 [0076.549] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.550] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.550] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.550] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19655302337) returned 1 [0076.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc71a6b0, dwHighDateTime=0x1d585b4)) [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca918 [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca918 | out: hHeap=0x260000) returned 1 [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ccc28 [0076.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ccc28 | out: hHeap=0x260000) returned 1 [0076.553] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.553] GetLastError () returned 0x0 [0076.553] GetLastError () returned 0x0 [0076.553] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.553] GetLastError () returned 0x0 [0076.554] GetLastError () returned 0x0 [0076.555] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd4ad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.556] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2b53, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x2b53, lpOverlapped=0x0) returned 1 [0076.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.557] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.557] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.558] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.559] CloseHandle (hObject=0x108) returned 1 [0076.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.561] GetLastError () returned 0x0 [0076.580] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.582] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.582] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.582] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19658318812) returned 1 [0076.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc766970, dwHighDateTime=0x1d585b4)) [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca950 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca950 | out: hHeap=0x260000) returned 1 [0076.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cccd0 [0076.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cccd0 | out: hHeap=0x260000) returned 1 [0076.583] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.583] GetLastError () returned 0x0 [0076.583] GetLastError () returned 0x0 [0076.583] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.583] GetLastError () returned 0x0 [0076.583] GetLastError () returned 0x0 [0076.585] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe874, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.585] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x178c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x178c, lpOverlapped=0x0) returned 1 [0076.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.658] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.658] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.659] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.660] CloseHandle (hObject=0x108) returned 1 [0076.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.662] GetLastError () returned 0x0 [0076.735] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.758] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.758] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.758] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19675938382) returned 1 [0076.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc909890, dwHighDateTime=0x1d585b4)) [0076.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cab48 [0076.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cab48 | out: hHeap=0x260000) returned 1 [0076.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0076.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.759] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.759] GetLastError () returned 0x0 [0076.760] GetLastError () returned 0x0 [0076.760] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.760] GetLastError () returned 0x0 [0076.760] GetLastError () returned 0x0 [0076.767] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbde9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.767] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4217, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x4217, lpOverlapped=0x0) returned 1 [0076.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.769] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.769] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.770] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.770] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.771] CloseHandle (hObject=0x11c) returned 1 [0076.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.772] GetLastError () returned 0x0 [0076.773] RtlWakeConditionVariable () returned 0x0 [0076.773] GetCurrentThreadId () returned 0x98c [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".ldf") returned 0x0 [0076.773] lstrlenW (lpString=".vhd") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".vhd") returned 0x0 [0076.773] lstrlenW (lpString=".vhdx") returned 5 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".vhdx") returned 0x0 [0076.773] lstrlenW (lpString=".pst") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".pst") returned 0x0 [0076.773] lstrlenW (lpString=".ost") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".ost") returned 0x0 [0076.773] lstrlenW (lpString=".bak") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".bak") returned 0x0 [0076.773] lstrlenW (lpString=".bac") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".bac") returned 0x0 [0076.773] lstrlenW (lpString=".sys") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".sys") returned 0x0 [0076.773] lstrlenW (lpString=".v2i") returned 4 [0076.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".v2i") returned 0x0 [0076.774] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0076.775] lstrlenW (lpString=".sql") returned 4 [0076.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".sql") returned 0x0 [0076.775] lstrlenW (lpString=".mdf") returned 4 [0076.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".mdf") returned 0x0 [0076.775] lstrlenW (lpString=".txt") returned 4 [0076.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".txt") returned 0x0 [0076.775] lstrlenW (lpString=".dbf") returned 4 [0076.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".dbf") returned 0x0 [0076.775] lstrlenW (lpString=".ckp") returned 4 [0076.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".ckp") returned 0x0 [0076.776] lstrlenW (lpString=".dacpac") returned 7 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".dacpac") returned 0x0 [0076.776] lstrlenW (lpString=".db3") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".db3") returned 0x0 [0076.776] lstrlenW (lpString=".dtxs") returned 5 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".dtxs") returned 0x0 [0076.776] lstrlenW (lpString=".mdt") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".mdt") returned 0x0 [0076.776] lstrlenW (lpString=".sdf") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".sdf") returned 0x0 [0076.776] lstrlenW (lpString=".MDF") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".MDF") returned 0x0 [0076.776] lstrlenW (lpString=".DBF") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".DBF") returned 0x0 [0076.776] lstrlenW (lpString=".DB") returned 3 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".DB") returned 0x0 [0076.776] lstrlenW (lpString=".db") returned 3 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".db") returned 0x0 [0076.776] lstrlenW (lpString=".ndf") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".ndf") returned 0x0 [0076.776] lstrlenW (lpString=".NDF") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".NDF") returned 0x0 [0076.776] lstrlenW (lpString=".Mdf") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".Mdf") returned 0x0 [0076.776] lstrlenW (lpString=".dat") returned 4 [0076.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".dat") returned 0x0 [0076.777] lstrlenW (lpString=".DAT") returned 4 [0076.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".DAT") returned 0x0 [0076.777] lstrlenW (lpString=".ldf") returned 4 [0076.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".ldf") returned 0x0 [0076.777] lstrlenW (lpString=".LDF") returned 4 [0076.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch=".LDF") returned 0x0 [0076.777] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0076.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.777] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.778] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.778] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.778] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19677908566) returned 1 [0076.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc92f9f0, dwHighDateTime=0x1d585b4)) [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cabb8 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cabb8 | out: hHeap=0x260000) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753f38 [0076.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b658 [0076.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753f38 | out: hHeap=0x260000) returned 1 [0076.779] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.779] GetLastError () returned 0x0 [0076.779] GetLastError () returned 0x0 [0076.779] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.779] GetLastError () returned 0x0 [0076.779] GetLastError () returned 0x0 [0076.783] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff2d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.783] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd2e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd2e, lpOverlapped=0x0) returned 1 [0076.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.783] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.783] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.784] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.784] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.784] CloseHandle (hObject=0x11c) returned 1 [0076.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.786] GetLastError () returned 0x0 [0076.786] RtlWakeConditionVariable () returned 0x0 [0076.786] GetCurrentThreadId () returned 0x98c [0076.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".ldf") returned 0x0 [0076.786] lstrlenW (lpString=".vhd") returned 4 [0076.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".vhd") returned 0x0 [0076.786] lstrlenW (lpString=".vhdx") returned 5 [0076.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".vhdx") returned 0x0 [0076.786] lstrlenW (lpString=".pst") returned 4 [0076.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".pst") returned 0x0 [0076.786] lstrlenW (lpString=".ost") returned 4 [0076.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".ost") returned 0x0 [0076.786] lstrlenW (lpString=".bak") returned 4 [0076.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".bak") returned 0x0 [0076.786] lstrlenW (lpString=".bac") returned 4 [0076.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".bac") returned 0x0 [0076.787] lstrlenW (lpString=".sys") returned 4 [0076.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".sys") returned 0x0 [0076.787] lstrlenW (lpString=".v2i") returned 4 [0076.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".v2i") returned 0x0 [0076.787] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0076.788] lstrlenW (lpString=".sql") returned 4 [0076.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".sql") returned 0x0 [0076.788] lstrlenW (lpString=".mdf") returned 4 [0076.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".mdf") returned 0x0 [0076.788] lstrlenW (lpString=".txt") returned 4 [0076.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".txt") returned 0x0 [0076.788] lstrlenW (lpString=".dbf") returned 4 [0076.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".dbf") returned 0x0 [0076.788] lstrlenW (lpString=".ckp") returned 4 [0076.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".ckp") returned 0x0 [0076.789] lstrlenW (lpString=".dacpac") returned 7 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".dacpac") returned 0x0 [0076.789] lstrlenW (lpString=".db3") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".db3") returned 0x0 [0076.789] lstrlenW (lpString=".dtxs") returned 5 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".dtxs") returned 0x0 [0076.789] lstrlenW (lpString=".mdt") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".mdt") returned 0x0 [0076.789] lstrlenW (lpString=".sdf") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".sdf") returned 0x0 [0076.789] lstrlenW (lpString=".MDF") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".MDF") returned 0x0 [0076.789] lstrlenW (lpString=".DBF") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".DBF") returned 0x0 [0076.789] lstrlenW (lpString=".DB") returned 3 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".DB") returned 0x0 [0076.789] lstrlenW (lpString=".db") returned 3 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".db") returned 0x0 [0076.789] lstrlenW (lpString=".ndf") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".ndf") returned 0x0 [0076.789] lstrlenW (lpString=".NDF") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".NDF") returned 0x0 [0076.789] lstrlenW (lpString=".Mdf") returned 4 [0076.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".Mdf") returned 0x0 [0076.789] lstrlenW (lpString=".dat") returned 4 [0076.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".dat") returned 0x0 [0076.790] lstrlenW (lpString=".DAT") returned 4 [0076.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".DAT") returned 0x0 [0076.790] lstrlenW (lpString=".ldf") returned 4 [0076.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".ldf") returned 0x0 [0076.790] lstrlenW (lpString=".LDF") returned 4 [0076.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch=".LDF") returned 0x0 [0076.790] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0076.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.790] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0076.791] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.791] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.791] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19679216152) returned 1 [0076.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbc955b50, dwHighDateTime=0x1d585b4)) [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cabf0 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cabf0 | out: hHeap=0x260000) returned 1 [0076.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753f38 [0076.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0076.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753f38 | out: hHeap=0x260000) returned 1 [0076.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0076.792] GetLastError () returned 0x0 [0076.792] GetLastError () returned 0x0 [0076.792] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0076.792] GetLastError () returned 0x0 [0076.793] GetLastError () returned 0x0 [0076.862] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffddfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.863] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2204, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2204, lpOverlapped=0x0) returned 1 [0076.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.865] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.865] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.865] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.865] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.865] CloseHandle (hObject=0x11c) returned 1 [0076.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.865] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.187] GetLastError () returned 0x0 [0077.187] RtlWakeConditionVariable () returned 0x0 [0077.190] GetCurrentThreadId () returned 0x98c [0077.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".ldf") returned 0x0 [0077.192] lstrlenW (lpString=".vhd") returned 4 [0077.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".vhd") returned 0x0 [0077.192] lstrlenW (lpString=".vhdx") returned 5 [0077.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".vhdx") returned 0x0 [0077.192] lstrlenW (lpString=".pst") returned 4 [0077.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".pst") returned 0x0 [0077.192] lstrlenW (lpString=".ost") returned 4 [0077.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".ost") returned 0x0 [0077.193] lstrlenW (lpString=".bak") returned 4 [0077.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".bak") returned 0x0 [0077.193] lstrlenW (lpString=".bac") returned 4 [0077.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".bac") returned 0x0 [0077.193] lstrlenW (lpString=".sys") returned 4 [0077.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".sys") returned 0x0 [0077.194] lstrlenW (lpString=".v2i") returned 4 [0077.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".v2i") returned 0x0 [0077.195] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.198] lstrlenW (lpString=".sql") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".sql") returned 0x0 [0077.198] lstrlenW (lpString=".mdf") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".mdf") returned 0x0 [0077.198] lstrlenW (lpString=".txt") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".txt") returned 0x0 [0077.198] lstrlenW (lpString=".dbf") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".dbf") returned 0x0 [0077.198] lstrlenW (lpString=".ckp") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".ckp") returned 0x0 [0077.198] lstrlenW (lpString=".dacpac") returned 7 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".dacpac") returned 0x0 [0077.198] lstrlenW (lpString=".db3") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".db3") returned 0x0 [0077.198] lstrlenW (lpString=".dtxs") returned 5 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".dtxs") returned 0x0 [0077.198] lstrlenW (lpString=".mdt") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".mdt") returned 0x0 [0077.198] lstrlenW (lpString=".sdf") returned 4 [0077.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".sdf") returned 0x0 [0077.199] lstrlenW (lpString=".MDF") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".MDF") returned 0x0 [0077.199] lstrlenW (lpString=".DBF") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".DBF") returned 0x0 [0077.199] lstrlenW (lpString=".DB") returned 3 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".DB") returned 0x0 [0077.199] lstrlenW (lpString=".db") returned 3 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".db") returned 0x0 [0077.199] lstrlenW (lpString=".ndf") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".ndf") returned 0x0 [0077.199] lstrlenW (lpString=".NDF") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".NDF") returned 0x0 [0077.199] lstrlenW (lpString=".Mdf") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".Mdf") returned 0x0 [0077.199] lstrlenW (lpString=".dat") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".dat") returned 0x0 [0077.199] lstrlenW (lpString=".DAT") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".DAT") returned 0x0 [0077.199] lstrlenW (lpString=".ldf") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".ldf") returned 0x0 [0077.199] lstrlenW (lpString=".LDF") returned 4 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch=".LDF") returned 0x0 [0077.199] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.200] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.200] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.200] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.201] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19720401910) returned 1 [0077.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbcd33f10, dwHighDateTime=0x1d585b4)) [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cafe0 [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cafe0 | out: hHeap=0x260000) returned 1 [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd9f0 [0077.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd9f0 | out: hHeap=0x260000) returned 1 [0077.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.204] GetLastError () returned 0x0 [0077.204] GetLastError () returned 0x0 [0077.204] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.204] GetLastError () returned 0x0 [0077.204] GetLastError () returned 0x0 [0077.206] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbd16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.206] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x42ea, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x42ea, lpOverlapped=0x0) returned 1 [0077.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.206] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.206] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.206] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.206] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.207] CloseHandle (hObject=0x11c) returned 1 [0077.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.209] GetLastError () returned 0x0 [0077.209] RtlWakeConditionVariable () returned 0x0 [0077.209] GetCurrentThreadId () returned 0x98c [0077.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".ldf") returned 0x0 [0077.209] lstrlenW (lpString=".vhd") returned 4 [0077.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".vhd") returned 0x0 [0077.209] lstrlenW (lpString=".vhdx") returned 5 [0077.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".vhdx") returned 0x0 [0077.209] lstrlenW (lpString=".pst") returned 4 [0077.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".pst") returned 0x0 [0077.209] lstrlenW (lpString=".ost") returned 4 [0077.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".ost") returned 0x0 [0077.209] lstrlenW (lpString=".bak") returned 4 [0077.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".bak") returned 0x0 [0077.210] lstrlenW (lpString=".bac") returned 4 [0077.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".bac") returned 0x0 [0077.210] lstrlenW (lpString=".sys") returned 4 [0077.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".sys") returned 0x0 [0077.210] lstrlenW (lpString=".v2i") returned 4 [0077.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".v2i") returned 0x0 [0077.210] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.212] lstrlenW (lpString=".sql") returned 4 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".sql") returned 0x0 [0077.212] lstrlenW (lpString=".mdf") returned 4 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".mdf") returned 0x0 [0077.212] lstrlenW (lpString=".txt") returned 4 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".txt") returned 0x0 [0077.212] lstrlenW (lpString=".dbf") returned 4 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".dbf") returned 0x0 [0077.212] lstrlenW (lpString=".ckp") returned 4 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".ckp") returned 0x0 [0077.212] lstrlenW (lpString=".dacpac") returned 7 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".dacpac") returned 0x0 [0077.212] lstrlenW (lpString=".db3") returned 4 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".db3") returned 0x0 [0077.212] lstrlenW (lpString=".dtxs") returned 5 [0077.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".dtxs") returned 0x0 [0077.212] lstrlenW (lpString=".mdt") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".mdt") returned 0x0 [0077.213] lstrlenW (lpString=".sdf") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".sdf") returned 0x0 [0077.213] lstrlenW (lpString=".MDF") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".MDF") returned 0x0 [0077.213] lstrlenW (lpString=".DBF") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".DBF") returned 0x0 [0077.213] lstrlenW (lpString=".DB") returned 3 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".DB") returned 0x0 [0077.213] lstrlenW (lpString=".db") returned 3 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".db") returned 0x0 [0077.213] lstrlenW (lpString=".ndf") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".ndf") returned 0x0 [0077.213] lstrlenW (lpString=".NDF") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".NDF") returned 0x0 [0077.213] lstrlenW (lpString=".Mdf") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".Mdf") returned 0x0 [0077.213] lstrlenW (lpString=".dat") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".dat") returned 0x0 [0077.213] lstrlenW (lpString=".DAT") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".DAT") returned 0x0 [0077.213] lstrlenW (lpString=".ldf") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".ldf") returned 0x0 [0077.213] lstrlenW (lpString=".LDF") returned 4 [0077.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch=".LDF") returned 0x0 [0077.213] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.214] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.214] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.214] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.215] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19721579977) returned 1 [0077.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbcd5a070, dwHighDateTime=0x1d585b4)) [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb018 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb018 | out: hHeap=0x260000) returned 1 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cdbe8 [0077.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cdbe8 | out: hHeap=0x260000) returned 1 [0077.215] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.216] GetLastError () returned 0x0 [0077.216] GetLastError () returned 0x0 [0077.216] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.216] GetLastError () returned 0x0 [0077.216] GetLastError () returned 0x0 [0077.218] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe67d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.218] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1983, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1983, lpOverlapped=0x0) returned 1 [0077.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.218] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.218] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.218] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.218] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.218] CloseHandle (hObject=0x11c) returned 1 [0077.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.220] GetLastError () returned 0x0 [0077.220] RtlWakeConditionVariable () returned 0x0 [0077.220] GetCurrentThreadId () returned 0x98c [0077.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".ldf") returned 0x0 [0077.221] lstrlenW (lpString=".vhd") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".vhd") returned 0x0 [0077.221] lstrlenW (lpString=".vhdx") returned 5 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".vhdx") returned 0x0 [0077.221] lstrlenW (lpString=".pst") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".pst") returned 0x0 [0077.221] lstrlenW (lpString=".ost") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".ost") returned 0x0 [0077.221] lstrlenW (lpString=".bak") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".bak") returned 0x0 [0077.221] lstrlenW (lpString=".bac") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".bac") returned 0x0 [0077.221] lstrlenW (lpString=".sys") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".sys") returned 0x0 [0077.221] lstrlenW (lpString=".v2i") returned 4 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".v2i") returned 0x0 [0077.221] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.222] lstrlenW (lpString=".sql") returned 4 [0077.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".sql") returned 0x0 [0077.222] lstrlenW (lpString=".mdf") returned 4 [0077.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".mdf") returned 0x0 [0077.222] lstrlenW (lpString=".txt") returned 4 [0077.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".txt") returned 0x0 [0077.223] lstrlenW (lpString=".dbf") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".dbf") returned 0x0 [0077.223] lstrlenW (lpString=".ckp") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".ckp") returned 0x0 [0077.223] lstrlenW (lpString=".dacpac") returned 7 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".dacpac") returned 0x0 [0077.223] lstrlenW (lpString=".db3") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".db3") returned 0x0 [0077.223] lstrlenW (lpString=".dtxs") returned 5 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".dtxs") returned 0x0 [0077.223] lstrlenW (lpString=".mdt") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".mdt") returned 0x0 [0077.223] lstrlenW (lpString=".sdf") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".sdf") returned 0x0 [0077.223] lstrlenW (lpString=".MDF") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".MDF") returned 0x0 [0077.223] lstrlenW (lpString=".DBF") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".DBF") returned 0x0 [0077.223] lstrlenW (lpString=".DB") returned 3 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".DB") returned 0x0 [0077.223] lstrlenW (lpString=".db") returned 3 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".db") returned 0x0 [0077.223] lstrlenW (lpString=".ndf") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".ndf") returned 0x0 [0077.223] lstrlenW (lpString=".NDF") returned 4 [0077.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".NDF") returned 0x0 [0077.224] lstrlenW (lpString=".Mdf") returned 4 [0077.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".Mdf") returned 0x0 [0077.224] lstrlenW (lpString=".dat") returned 4 [0077.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".dat") returned 0x0 [0077.224] lstrlenW (lpString=".DAT") returned 4 [0077.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".DAT") returned 0x0 [0077.224] lstrlenW (lpString=".ldf") returned 4 [0077.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".ldf") returned 0x0 [0077.224] lstrlenW (lpString=".LDF") returned 4 [0077.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch=".LDF") returned 0x0 [0077.224] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.224] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.225] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.225] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.225] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19722617745) returned 1 [0077.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbcd801d0, dwHighDateTime=0x1d585b4)) [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb050 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb050 | out: hHeap=0x260000) returned 1 [0077.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cdc90 [0077.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cdc90 | out: hHeap=0x260000) returned 1 [0077.226] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.226] GetLastError () returned 0x0 [0077.226] GetLastError () returned 0x0 [0077.226] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.226] GetLastError () returned 0x0 [0077.226] GetLastError () returned 0x0 [0077.399] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd58f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.399] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2a71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2a71, lpOverlapped=0x0) returned 1 [0077.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.400] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.400] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.400] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.400] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.400] CloseHandle (hObject=0x11c) returned 1 [0077.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.438] GetLastError () returned 0x0 [0077.438] RtlWakeConditionVariable () returned 0x0 [0077.438] GetCurrentThreadId () returned 0x98c [0077.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".ldf") returned 0x0 [0077.439] lstrlenW (lpString=".vhd") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".vhd") returned 0x0 [0077.439] lstrlenW (lpString=".vhdx") returned 5 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".vhdx") returned 0x0 [0077.439] lstrlenW (lpString=".pst") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".pst") returned 0x0 [0077.439] lstrlenW (lpString=".ost") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".ost") returned 0x0 [0077.439] lstrlenW (lpString=".bak") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".bak") returned 0x0 [0077.439] lstrlenW (lpString=".bac") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".bac") returned 0x0 [0077.439] lstrlenW (lpString=".sys") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".sys") returned 0x0 [0077.439] lstrlenW (lpString=".v2i") returned 4 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".v2i") returned 0x0 [0077.439] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.552] lstrlenW (lpString=".sql") returned 4 [0077.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".sql") returned 0x0 [0077.552] lstrlenW (lpString=".mdf") returned 4 [0077.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".mdf") returned 0x0 [0077.552] lstrlenW (lpString=".txt") returned 4 [0077.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".txt") returned 0x0 [0077.552] lstrlenW (lpString=".dbf") returned 4 [0077.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".dbf") returned 0x0 [0077.552] lstrlenW (lpString=".ckp") returned 4 [0077.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".ckp") returned 0x0 [0077.553] lstrlenW (lpString=".dacpac") returned 7 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".dacpac") returned 0x0 [0077.553] lstrlenW (lpString=".db3") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".db3") returned 0x0 [0077.553] lstrlenW (lpString=".dtxs") returned 5 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".dtxs") returned 0x0 [0077.553] lstrlenW (lpString=".mdt") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".mdt") returned 0x0 [0077.553] lstrlenW (lpString=".sdf") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".sdf") returned 0x0 [0077.553] lstrlenW (lpString=".MDF") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".MDF") returned 0x0 [0077.553] lstrlenW (lpString=".DBF") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".DBF") returned 0x0 [0077.553] lstrlenW (lpString=".DB") returned 3 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".DB") returned 0x0 [0077.553] lstrlenW (lpString=".db") returned 3 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".db") returned 0x0 [0077.553] lstrlenW (lpString=".ndf") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".ndf") returned 0x0 [0077.553] lstrlenW (lpString=".NDF") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".NDF") returned 0x0 [0077.553] lstrlenW (lpString=".Mdf") returned 4 [0077.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".Mdf") returned 0x0 [0077.553] lstrlenW (lpString=".dat") returned 4 [0077.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".dat") returned 0x0 [0077.554] lstrlenW (lpString=".DAT") returned 4 [0077.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".DAT") returned 0x0 [0077.554] lstrlenW (lpString=".ldf") returned 4 [0077.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".ldf") returned 0x0 [0077.554] lstrlenW (lpString=".LDF") returned 4 [0077.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch=".LDF") returned 0x0 [0077.554] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.554] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.555] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.555] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.555] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19755603875) returned 1 [0077.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd09feb0, dwHighDateTime=0x1d585b4)) [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb1d8 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb1d8 | out: hHeap=0x260000) returned 1 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cead8 [0077.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cead8 | out: hHeap=0x260000) returned 1 [0077.556] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.556] GetLastError () returned 0x0 [0077.556] GetLastError () returned 0x0 [0077.556] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.556] GetLastError () returned 0x0 [0077.556] GetLastError () returned 0x0 [0077.559] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff614f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.559] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x9eb1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x9eb1, lpOverlapped=0x0) returned 1 [0077.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0077.559] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.559] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.560] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.560] CloseHandle (hObject=0xe4) returned 1 [0077.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.561] GetLastError () returned 0x0 [0077.561] RtlWakeConditionVariable () returned 0x0 [0077.561] GetCurrentThreadId () returned 0x98c [0077.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".ldf") returned 0x0 [0077.561] lstrlenW (lpString=".vhd") returned 4 [0077.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".vhd") returned 0x0 [0077.561] lstrlenW (lpString=".vhdx") returned 5 [0077.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".vhdx") returned 0x0 [0077.561] lstrlenW (lpString=".pst") returned 4 [0077.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".pst") returned 0x0 [0077.562] lstrlenW (lpString=".ost") returned 4 [0077.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".ost") returned 0x0 [0077.562] lstrlenW (lpString=".bak") returned 4 [0077.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".bak") returned 0x0 [0077.562] lstrlenW (lpString=".bac") returned 4 [0077.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".bac") returned 0x0 [0077.562] lstrlenW (lpString=".sys") returned 4 [0077.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".sys") returned 0x0 [0077.562] lstrlenW (lpString=".v2i") returned 4 [0077.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".v2i") returned 0x0 [0077.562] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.563] lstrlenW (lpString=".sql") returned 4 [0077.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".sql") returned 0x0 [0077.563] lstrlenW (lpString=".mdf") returned 4 [0077.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".mdf") returned 0x0 [0077.563] lstrlenW (lpString=".txt") returned 4 [0077.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".txt") returned 0x0 [0077.563] lstrlenW (lpString=".dbf") returned 4 [0077.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".dbf") returned 0x0 [0077.563] lstrlenW (lpString=".ckp") returned 4 [0077.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".ckp") returned 0x0 [0077.563] lstrlenW (lpString=".dacpac") returned 7 [0077.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".dacpac") returned 0x0 [0077.563] lstrlenW (lpString=".db3") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".db3") returned 0x0 [0077.564] lstrlenW (lpString=".dtxs") returned 5 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".dtxs") returned 0x0 [0077.564] lstrlenW (lpString=".mdt") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".mdt") returned 0x0 [0077.564] lstrlenW (lpString=".sdf") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".sdf") returned 0x0 [0077.564] lstrlenW (lpString=".MDF") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".MDF") returned 0x0 [0077.564] lstrlenW (lpString=".DBF") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".DBF") returned 0x0 [0077.564] lstrlenW (lpString=".DB") returned 3 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".DB") returned 0x0 [0077.564] lstrlenW (lpString=".db") returned 3 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".db") returned 0x0 [0077.564] lstrlenW (lpString=".ndf") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".ndf") returned 0x0 [0077.564] lstrlenW (lpString=".NDF") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".NDF") returned 0x0 [0077.564] lstrlenW (lpString=".Mdf") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".Mdf") returned 0x0 [0077.564] lstrlenW (lpString=".dat") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".dat") returned 0x0 [0077.564] lstrlenW (lpString=".DAT") returned 4 [0077.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".DAT") returned 0x0 [0077.565] lstrlenW (lpString=".ldf") returned 4 [0077.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".ldf") returned 0x0 [0077.565] lstrlenW (lpString=".LDF") returned 4 [0077.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch=".LDF") returned 0x0 [0077.565] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.565] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.566] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.566] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.566] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19756694663) returned 1 [0077.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd0c6010, dwHighDateTime=0x1d585b4)) [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb210 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb210 | out: hHeap=0x260000) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce4f0 [0077.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce4f0 | out: hHeap=0x260000) returned 1 [0077.567] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.567] GetLastError () returned 0x0 [0077.567] GetLastError () returned 0x0 [0077.567] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.567] GetLastError () returned 0x0 [0077.567] GetLastError () returned 0x0 [0077.569] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff65a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.569] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x9a60, lpOverlapped=0x0) returned 1 [0077.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0077.570] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.570] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.570] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.570] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.570] CloseHandle (hObject=0xe4) returned 1 [0077.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.571] GetLastError () returned 0x0 [0077.571] RtlWakeConditionVariable () returned 0x0 [0077.571] GetCurrentThreadId () returned 0x98c [0077.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".ldf") returned 0x0 [0077.571] lstrlenW (lpString=".vhd") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".vhd") returned 0x0 [0077.572] lstrlenW (lpString=".vhdx") returned 5 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".vhdx") returned 0x0 [0077.572] lstrlenW (lpString=".pst") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".pst") returned 0x0 [0077.572] lstrlenW (lpString=".ost") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".ost") returned 0x0 [0077.572] lstrlenW (lpString=".bak") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".bak") returned 0x0 [0077.572] lstrlenW (lpString=".bac") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".bac") returned 0x0 [0077.572] lstrlenW (lpString=".sys") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".sys") returned 0x0 [0077.572] lstrlenW (lpString=".v2i") returned 4 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".v2i") returned 0x0 [0077.572] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.574] lstrlenW (lpString=".sql") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".sql") returned 0x0 [0077.574] lstrlenW (lpString=".mdf") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".mdf") returned 0x0 [0077.574] lstrlenW (lpString=".txt") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".txt") returned 0x0 [0077.574] lstrlenW (lpString=".dbf") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".dbf") returned 0x0 [0077.574] lstrlenW (lpString=".ckp") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".ckp") returned 0x0 [0077.574] lstrlenW (lpString=".dacpac") returned 7 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".dacpac") returned 0x0 [0077.574] lstrlenW (lpString=".db3") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".db3") returned 0x0 [0077.574] lstrlenW (lpString=".dtxs") returned 5 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".dtxs") returned 0x0 [0077.574] lstrlenW (lpString=".mdt") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".mdt") returned 0x0 [0077.574] lstrlenW (lpString=".sdf") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".sdf") returned 0x0 [0077.574] lstrlenW (lpString=".MDF") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".MDF") returned 0x0 [0077.574] lstrlenW (lpString=".DBF") returned 4 [0077.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".DBF") returned 0x0 [0077.574] lstrlenW (lpString=".DB") returned 3 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".DB") returned 0x0 [0077.575] lstrlenW (lpString=".db") returned 3 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".db") returned 0x0 [0077.575] lstrlenW (lpString=".ndf") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".ndf") returned 0x0 [0077.575] lstrlenW (lpString=".NDF") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".NDF") returned 0x0 [0077.575] lstrlenW (lpString=".Mdf") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".Mdf") returned 0x0 [0077.575] lstrlenW (lpString=".dat") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".dat") returned 0x0 [0077.575] lstrlenW (lpString=".DAT") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".DAT") returned 0x0 [0077.575] lstrlenW (lpString=".ldf") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".ldf") returned 0x0 [0077.575] lstrlenW (lpString=".LDF") returned 4 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch=".LDF") returned 0x0 [0077.575] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.575] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.576] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.576] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19757747008) returned 1 [0077.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd0c6010, dwHighDateTime=0x1d585b4)) [0077.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb248 [0077.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb248 | out: hHeap=0x260000) returned 1 [0077.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cec28 [0077.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cec28 | out: hHeap=0x260000) returned 1 [0077.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.577] GetLastError () returned 0x0 [0077.577] GetLastError () returned 0x0 [0077.577] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.578] GetLastError () returned 0x0 [0077.578] GetLastError () returned 0x0 [0077.580] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff1a6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.580] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xe591, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xe591, lpOverlapped=0x0) returned 1 [0077.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0077.580] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.580] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.587] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.587] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.587] CloseHandle (hObject=0xe4) returned 1 [0077.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.588] GetLastError () returned 0x0 [0077.588] RtlWakeConditionVariable () returned 0x0 [0077.588] GetCurrentThreadId () returned 0x98c [0077.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".ldf") returned 0x0 [0077.588] lstrlenW (lpString=".vhd") returned 4 [0077.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".vhd") returned 0x0 [0077.588] lstrlenW (lpString=".vhdx") returned 5 [0077.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".vhdx") returned 0x0 [0077.588] lstrlenW (lpString=".pst") returned 4 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".pst") returned 0x0 [0077.589] lstrlenW (lpString=".ost") returned 4 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".ost") returned 0x0 [0077.589] lstrlenW (lpString=".bak") returned 4 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".bak") returned 0x0 [0077.589] lstrlenW (lpString=".bac") returned 4 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".bac") returned 0x0 [0077.589] lstrlenW (lpString=".sys") returned 4 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".sys") returned 0x0 [0077.589] lstrlenW (lpString=".v2i") returned 4 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".v2i") returned 0x0 [0077.589] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.590] lstrlenW (lpString=".sql") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".sql") returned 0x0 [0077.590] lstrlenW (lpString=".mdf") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".mdf") returned 0x0 [0077.590] lstrlenW (lpString=".txt") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".txt") returned 0x0 [0077.590] lstrlenW (lpString=".dbf") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".dbf") returned 0x0 [0077.590] lstrlenW (lpString=".ckp") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".ckp") returned 0x0 [0077.590] lstrlenW (lpString=".dacpac") returned 7 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".dacpac") returned 0x0 [0077.590] lstrlenW (lpString=".db3") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".db3") returned 0x0 [0077.590] lstrlenW (lpString=".dtxs") returned 5 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".dtxs") returned 0x0 [0077.590] lstrlenW (lpString=".mdt") returned 4 [0077.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".mdt") returned 0x0 [0077.591] lstrlenW (lpString=".sdf") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".sdf") returned 0x0 [0077.591] lstrlenW (lpString=".MDF") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".MDF") returned 0x0 [0077.591] lstrlenW (lpString=".DBF") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".DBF") returned 0x0 [0077.591] lstrlenW (lpString=".DB") returned 3 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".DB") returned 0x0 [0077.591] lstrlenW (lpString=".db") returned 3 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".db") returned 0x0 [0077.591] lstrlenW (lpString=".ndf") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".ndf") returned 0x0 [0077.591] lstrlenW (lpString=".NDF") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".NDF") returned 0x0 [0077.591] lstrlenW (lpString=".Mdf") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".Mdf") returned 0x0 [0077.591] lstrlenW (lpString=".dat") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".dat") returned 0x0 [0077.591] lstrlenW (lpString=".DAT") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".DAT") returned 0x0 [0077.591] lstrlenW (lpString=".ldf") returned 4 [0077.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".ldf") returned 0x0 [0077.591] lstrlenW (lpString=".LDF") returned 4 [0077.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch=".LDF") returned 0x0 [0077.592] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.592] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.593] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.593] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.593] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19759409039) returned 1 [0077.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd0ec170, dwHighDateTime=0x1d585b4)) [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb280 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb280 | out: hHeap=0x260000) returned 1 [0077.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cecd0 [0077.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cecd0 | out: hHeap=0x260000) returned 1 [0077.594] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.594] GetLastError () returned 0x0 [0077.594] GetLastError () returned 0x0 [0077.594] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.595] GetLastError () returned 0x0 [0077.595] GetLastError () returned 0x0 [0077.596] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff676, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.596] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x98a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x98a, lpOverlapped=0x0) returned 1 [0077.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0077.597] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.597] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.597] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.597] CloseHandle (hObject=0xe4) returned 1 [0077.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.598] GetLastError () returned 0x0 [0077.598] RtlWakeConditionVariable () returned 0x0 [0077.598] GetCurrentThreadId () returned 0x98c [0077.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".ldf") returned 0x0 [0077.598] lstrlenW (lpString=".vhd") returned 4 [0077.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".vhd") returned 0x0 [0077.599] lstrlenW (lpString=".vhdx") returned 5 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".vhdx") returned 0x0 [0077.599] lstrlenW (lpString=".pst") returned 4 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".pst") returned 0x0 [0077.599] lstrlenW (lpString=".ost") returned 4 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".ost") returned 0x0 [0077.599] lstrlenW (lpString=".bak") returned 4 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".bak") returned 0x0 [0077.599] lstrlenW (lpString=".bac") returned 4 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".bac") returned 0x0 [0077.599] lstrlenW (lpString=".sys") returned 4 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".sys") returned 0x0 [0077.599] lstrlenW (lpString=".v2i") returned 4 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".v2i") returned 0x0 [0077.599] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.600] lstrlenW (lpString=".sql") returned 4 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".sql") returned 0x0 [0077.600] lstrlenW (lpString=".mdf") returned 4 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".mdf") returned 0x0 [0077.600] lstrlenW (lpString=".txt") returned 4 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".txt") returned 0x0 [0077.600] lstrlenW (lpString=".dbf") returned 4 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".dbf") returned 0x0 [0077.600] lstrlenW (lpString=".ckp") returned 4 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".ckp") returned 0x0 [0077.600] lstrlenW (lpString=".dacpac") returned 7 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".dacpac") returned 0x0 [0077.600] lstrlenW (lpString=".db3") returned 4 [0077.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".db3") returned 0x0 [0077.600] lstrlenW (lpString=".dtxs") returned 5 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".dtxs") returned 0x0 [0077.601] lstrlenW (lpString=".mdt") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".mdt") returned 0x0 [0077.601] lstrlenW (lpString=".sdf") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".sdf") returned 0x0 [0077.601] lstrlenW (lpString=".MDF") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".MDF") returned 0x0 [0077.601] lstrlenW (lpString=".DBF") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".DBF") returned 0x0 [0077.601] lstrlenW (lpString=".DB") returned 3 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".DB") returned 0x0 [0077.601] lstrlenW (lpString=".db") returned 3 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".db") returned 0x0 [0077.601] lstrlenW (lpString=".ndf") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".ndf") returned 0x0 [0077.601] lstrlenW (lpString=".NDF") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".NDF") returned 0x0 [0077.601] lstrlenW (lpString=".Mdf") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".Mdf") returned 0x0 [0077.601] lstrlenW (lpString=".dat") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".dat") returned 0x0 [0077.601] lstrlenW (lpString=".DAT") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".DAT") returned 0x0 [0077.601] lstrlenW (lpString=".ldf") returned 4 [0077.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".ldf") returned 0x0 [0077.601] lstrlenW (lpString=".LDF") returned 4 [0077.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch=".LDF") returned 0x0 [0077.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.602] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.603] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.603] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19760383475) returned 1 [0077.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd1122d0, dwHighDateTime=0x1d585b4)) [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb2b8 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb2b8 | out: hHeap=0x260000) returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ced78 [0077.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ced78 | out: hHeap=0x260000) returned 1 [0077.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.604] GetLastError () returned 0x0 [0077.604] GetLastError () returned 0x0 [0077.604] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.604] GetLastError () returned 0x0 [0077.604] GetLastError () returned 0x0 [0077.606] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff669, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.606] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x997, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x997, lpOverlapped=0x0) returned 1 [0077.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0077.606] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.606] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.606] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.606] CloseHandle (hObject=0xe4) returned 1 [0077.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.608] GetLastError () returned 0x0 [0077.608] RtlWakeConditionVariable () returned 0x0 [0077.608] GetCurrentThreadId () returned 0x98c [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".ldf") returned 0x0 [0077.608] lstrlenW (lpString=".vhd") returned 4 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".vhd") returned 0x0 [0077.608] lstrlenW (lpString=".vhdx") returned 5 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".vhdx") returned 0x0 [0077.608] lstrlenW (lpString=".pst") returned 4 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".pst") returned 0x0 [0077.608] lstrlenW (lpString=".ost") returned 4 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".ost") returned 0x0 [0077.608] lstrlenW (lpString=".bak") returned 4 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".bak") returned 0x0 [0077.608] lstrlenW (lpString=".bac") returned 4 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".bac") returned 0x0 [0077.608] lstrlenW (lpString=".sys") returned 4 [0077.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".sys") returned 0x0 [0077.608] lstrlenW (lpString=".v2i") returned 4 [0077.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".v2i") returned 0x0 [0077.609] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.609] lstrlenW (lpString=".sql") returned 4 [0077.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".sql") returned 0x0 [0077.610] lstrlenW (lpString=".mdf") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".mdf") returned 0x0 [0077.610] lstrlenW (lpString=".txt") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".txt") returned 0x0 [0077.610] lstrlenW (lpString=".dbf") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".dbf") returned 0x0 [0077.610] lstrlenW (lpString=".ckp") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".ckp") returned 0x0 [0077.610] lstrlenW (lpString=".dacpac") returned 7 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".dacpac") returned 0x0 [0077.610] lstrlenW (lpString=".db3") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".db3") returned 0x0 [0077.610] lstrlenW (lpString=".dtxs") returned 5 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".dtxs") returned 0x0 [0077.610] lstrlenW (lpString=".mdt") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".mdt") returned 0x0 [0077.610] lstrlenW (lpString=".sdf") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".sdf") returned 0x0 [0077.610] lstrlenW (lpString=".MDF") returned 4 [0077.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".MDF") returned 0x0 [0077.610] lstrlenW (lpString=".DBF") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".DBF") returned 0x0 [0077.611] lstrlenW (lpString=".DB") returned 3 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".DB") returned 0x0 [0077.611] lstrlenW (lpString=".db") returned 3 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".db") returned 0x0 [0077.611] lstrlenW (lpString=".ndf") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".ndf") returned 0x0 [0077.611] lstrlenW (lpString=".NDF") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".NDF") returned 0x0 [0077.611] lstrlenW (lpString=".Mdf") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".Mdf") returned 0x0 [0077.611] lstrlenW (lpString=".dat") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".dat") returned 0x0 [0077.611] lstrlenW (lpString=".DAT") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".DAT") returned 0x0 [0077.611] lstrlenW (lpString=".ldf") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".ldf") returned 0x0 [0077.611] lstrlenW (lpString=".LDF") returned 4 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch=".LDF") returned 0x0 [0077.611] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.611] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.612] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.612] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.612] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19761350542) returned 1 [0077.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd138430, dwHighDateTime=0x1d585b4)) [0077.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb2f0 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb2f0 | out: hHeap=0x260000) returned 1 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cee20 [0077.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cee20 | out: hHeap=0x260000) returned 1 [0077.613] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.613] GetLastError () returned 0x0 [0077.613] GetLastError () returned 0x0 [0077.613] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.614] GetLastError () returned 0x0 [0077.614] GetLastError () returned 0x0 [0077.626] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe4fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.626] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1b06, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x1b06, lpOverlapped=0x0) returned 1 [0077.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0077.628] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.629] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.629] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.629] CloseHandle (hObject=0xe4) returned 1 [0077.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.632] GetLastError () returned 0x0 [0077.632] RtlWakeConditionVariable () returned 0x0 [0077.632] GetCurrentThreadId () returned 0x98c [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".ldf") returned 0x0 [0077.632] lstrlenW (lpString=".vhd") returned 4 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".vhd") returned 0x0 [0077.632] lstrlenW (lpString=".vhdx") returned 5 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".vhdx") returned 0x0 [0077.632] lstrlenW (lpString=".pst") returned 4 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".pst") returned 0x0 [0077.632] lstrlenW (lpString=".ost") returned 4 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".ost") returned 0x0 [0077.632] lstrlenW (lpString=".bak") returned 4 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".bak") returned 0x0 [0077.632] lstrlenW (lpString=".bac") returned 4 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".bac") returned 0x0 [0077.632] lstrlenW (lpString=".sys") returned 4 [0077.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".sys") returned 0x0 [0077.632] lstrlenW (lpString=".v2i") returned 4 [0077.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".v2i") returned 0x0 [0077.633] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.634] lstrlenW (lpString=".sql") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".sql") returned 0x0 [0077.634] lstrlenW (lpString=".mdf") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".mdf") returned 0x0 [0077.634] lstrlenW (lpString=".txt") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".txt") returned 0x0 [0077.634] lstrlenW (lpString=".dbf") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".dbf") returned 0x0 [0077.634] lstrlenW (lpString=".ckp") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".ckp") returned 0x0 [0077.634] lstrlenW (lpString=".dacpac") returned 7 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".dacpac") returned 0x0 [0077.634] lstrlenW (lpString=".db3") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".db3") returned 0x0 [0077.634] lstrlenW (lpString=".dtxs") returned 5 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".dtxs") returned 0x0 [0077.634] lstrlenW (lpString=".mdt") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".mdt") returned 0x0 [0077.634] lstrlenW (lpString=".sdf") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".sdf") returned 0x0 [0077.634] lstrlenW (lpString=".MDF") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".MDF") returned 0x0 [0077.634] lstrlenW (lpString=".DBF") returned 4 [0077.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".DBF") returned 0x0 [0077.634] lstrlenW (lpString=".DB") returned 3 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".DB") returned 0x0 [0077.635] lstrlenW (lpString=".db") returned 3 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".db") returned 0x0 [0077.635] lstrlenW (lpString=".ndf") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".ndf") returned 0x0 [0077.635] lstrlenW (lpString=".NDF") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".NDF") returned 0x0 [0077.635] lstrlenW (lpString=".Mdf") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".Mdf") returned 0x0 [0077.635] lstrlenW (lpString=".dat") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".dat") returned 0x0 [0077.635] lstrlenW (lpString=".DAT") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".DAT") returned 0x0 [0077.635] lstrlenW (lpString=".ldf") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".ldf") returned 0x0 [0077.635] lstrlenW (lpString=".LDF") returned 4 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch=".LDF") returned 0x0 [0077.635] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.635] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.636] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.636] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.636] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19763745480) returned 1 [0077.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd15e590, dwHighDateTime=0x1d585b4)) [0077.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb360 [0077.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb360 | out: hHeap=0x260000) returned 1 [0077.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ceec8 [0077.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ceec8 | out: hHeap=0x260000) returned 1 [0077.637] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.637] GetLastError () returned 0x0 [0077.637] GetLastError () returned 0x0 [0077.637] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.638] GetLastError () returned 0x0 [0077.638] GetLastError () returned 0x0 [0077.641] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe845, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.641] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x17bb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x17bb, lpOverlapped=0x0) returned 1 [0077.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.642] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.642] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.642] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.642] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.642] CloseHandle (hObject=0xe4) returned 1 [0077.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.643] GetLastError () returned 0x0 [0077.643] RtlWakeConditionVariable () returned 0x27e828 [0077.643] GetCurrentThreadId () returned 0x98c [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".ldf") returned 0x0 [0077.644] lstrlenW (lpString=".vhd") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".vhd") returned 0x0 [0077.644] lstrlenW (lpString=".vhdx") returned 5 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".vhdx") returned 0x0 [0077.644] lstrlenW (lpString=".pst") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".pst") returned 0x0 [0077.644] lstrlenW (lpString=".ost") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".ost") returned 0x0 [0077.644] lstrlenW (lpString=".bak") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".bak") returned 0x0 [0077.644] lstrlenW (lpString=".bac") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".bac") returned 0x0 [0077.644] lstrlenW (lpString=".sys") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".sys") returned 0x0 [0077.644] lstrlenW (lpString=".v2i") returned 4 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".v2i") returned 0x0 [0077.644] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.645] lstrlenW (lpString=".sql") returned 4 [0077.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".sql") returned 0x0 [0077.645] lstrlenW (lpString=".mdf") returned 4 [0077.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".mdf") returned 0x0 [0077.645] lstrlenW (lpString=".txt") returned 4 [0077.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".txt") returned 0x0 [0077.645] lstrlenW (lpString=".dbf") returned 4 [0077.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".dbf") returned 0x0 [0077.645] lstrlenW (lpString=".ckp") returned 4 [0077.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".ckp") returned 0x0 [0077.645] lstrlenW (lpString=".dacpac") returned 7 [0077.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".dacpac") returned 0x0 [0077.646] lstrlenW (lpString=".db3") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".db3") returned 0x0 [0077.646] lstrlenW (lpString=".dtxs") returned 5 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".dtxs") returned 0x0 [0077.646] lstrlenW (lpString=".mdt") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".mdt") returned 0x0 [0077.646] lstrlenW (lpString=".sdf") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".sdf") returned 0x0 [0077.646] lstrlenW (lpString=".MDF") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".MDF") returned 0x0 [0077.646] lstrlenW (lpString=".DBF") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".DBF") returned 0x0 [0077.646] lstrlenW (lpString=".DB") returned 3 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".DB") returned 0x0 [0077.646] lstrlenW (lpString=".db") returned 3 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".db") returned 0x0 [0077.646] lstrlenW (lpString=".ndf") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".ndf") returned 0x0 [0077.646] lstrlenW (lpString=".NDF") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".NDF") returned 0x0 [0077.646] lstrlenW (lpString=".Mdf") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".Mdf") returned 0x0 [0077.646] lstrlenW (lpString=".dat") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".dat") returned 0x0 [0077.646] lstrlenW (lpString=".DAT") returned 4 [0077.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".DAT") returned 0x0 [0077.647] lstrlenW (lpString=".ldf") returned 4 [0077.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".ldf") returned 0x0 [0077.647] lstrlenW (lpString=".LDF") returned 4 [0077.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch=".LDF") returned 0x0 [0077.647] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.647] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.648] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.648] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.648] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19764895560) returned 1 [0077.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd1846f0, dwHighDateTime=0x1d585b4)) [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb398 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb398 | out: hHeap=0x260000) returned 1 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf018 [0077.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf018 | out: hHeap=0x260000) returned 1 [0077.649] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.649] GetLastError () returned 0x0 [0077.649] GetLastError () returned 0x0 [0077.649] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.649] GetLastError () returned 0x0 [0077.649] GetLastError () returned 0x0 [0077.651] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe915, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.651] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16eb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x16eb, lpOverlapped=0x0) returned 1 [0077.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.651] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.651] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.651] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.651] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.651] CloseHandle (hObject=0xe4) returned 1 [0077.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.652] GetLastError () returned 0x0 [0077.653] RtlWakeConditionVariable () returned 0x27e828 [0077.653] GetCurrentThreadId () returned 0x98c [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".ldf") returned 0x0 [0077.653] lstrlenW (lpString=".vhd") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".vhd") returned 0x0 [0077.653] lstrlenW (lpString=".vhdx") returned 5 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".vhdx") returned 0x0 [0077.653] lstrlenW (lpString=".pst") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".pst") returned 0x0 [0077.653] lstrlenW (lpString=".ost") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".ost") returned 0x0 [0077.653] lstrlenW (lpString=".bak") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".bak") returned 0x0 [0077.653] lstrlenW (lpString=".bac") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".bac") returned 0x0 [0077.653] lstrlenW (lpString=".sys") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".sys") returned 0x0 [0077.653] lstrlenW (lpString=".v2i") returned 4 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".v2i") returned 0x0 [0077.653] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.654] lstrlenW (lpString=".sql") returned 4 [0077.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".sql") returned 0x0 [0077.654] lstrlenW (lpString=".mdf") returned 4 [0077.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".mdf") returned 0x0 [0077.654] lstrlenW (lpString=".txt") returned 4 [0077.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".txt") returned 0x0 [0077.654] lstrlenW (lpString=".dbf") returned 4 [0077.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".dbf") returned 0x0 [0077.655] lstrlenW (lpString=".ckp") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".ckp") returned 0x0 [0077.655] lstrlenW (lpString=".dacpac") returned 7 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".dacpac") returned 0x0 [0077.655] lstrlenW (lpString=".db3") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".db3") returned 0x0 [0077.655] lstrlenW (lpString=".dtxs") returned 5 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".dtxs") returned 0x0 [0077.655] lstrlenW (lpString=".mdt") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".mdt") returned 0x0 [0077.655] lstrlenW (lpString=".sdf") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".sdf") returned 0x0 [0077.655] lstrlenW (lpString=".MDF") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".MDF") returned 0x0 [0077.655] lstrlenW (lpString=".DBF") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".DBF") returned 0x0 [0077.655] lstrlenW (lpString=".DB") returned 3 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".DB") returned 0x0 [0077.655] lstrlenW (lpString=".db") returned 3 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".db") returned 0x0 [0077.655] lstrlenW (lpString=".ndf") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".ndf") returned 0x0 [0077.655] lstrlenW (lpString=".NDF") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".NDF") returned 0x0 [0077.655] lstrlenW (lpString=".Mdf") returned 4 [0077.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".Mdf") returned 0x0 [0077.656] lstrlenW (lpString=".dat") returned 4 [0077.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".dat") returned 0x0 [0077.656] lstrlenW (lpString=".DAT") returned 4 [0077.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".DAT") returned 0x0 [0077.656] lstrlenW (lpString=".ldf") returned 4 [0077.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".ldf") returned 0x0 [0077.656] lstrlenW (lpString=".LDF") returned 4 [0077.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch=".LDF") returned 0x0 [0077.656] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.656] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.657] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.657] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19765826756) returned 1 [0077.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd1aa850, dwHighDateTime=0x1d585b4)) [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb3d0 [0077.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb3d0 | out: hHeap=0x260000) returned 1 [0077.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf0c0 [0077.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf0c0 | out: hHeap=0x260000) returned 1 [0077.658] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.658] GetLastError () returned 0x0 [0077.658] GetLastError () returned 0x0 [0077.658] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.658] GetLastError () returned 0x0 [0077.658] GetLastError () returned 0x0 [0077.660] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffecfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.660] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1304, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1304, lpOverlapped=0x0) returned 1 [0077.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.660] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.660] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.661] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.661] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.661] CloseHandle (hObject=0xe4) returned 1 [0077.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.662] GetLastError () returned 0x0 [0077.662] RtlWakeConditionVariable () returned 0x27e828 [0077.662] GetCurrentThreadId () returned 0x98c [0077.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".ldf") returned 0x0 [0077.662] lstrlenW (lpString=".vhd") returned 4 [0077.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".vhd") returned 0x0 [0077.662] lstrlenW (lpString=".vhdx") returned 5 [0077.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".vhdx") returned 0x0 [0077.662] lstrlenW (lpString=".pst") returned 4 [0077.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".pst") returned 0x0 [0077.663] lstrlenW (lpString=".ost") returned 4 [0077.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".ost") returned 0x0 [0077.663] lstrlenW (lpString=".bak") returned 4 [0077.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".bak") returned 0x0 [0077.663] lstrlenW (lpString=".bac") returned 4 [0077.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".bac") returned 0x0 [0077.663] lstrlenW (lpString=".sys") returned 4 [0077.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".sys") returned 0x0 [0077.663] lstrlenW (lpString=".v2i") returned 4 [0077.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".v2i") returned 0x0 [0077.663] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.664] lstrlenW (lpString=".sql") returned 4 [0077.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".sql") returned 0x0 [0077.664] lstrlenW (lpString=".mdf") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".mdf") returned 0x0 [0077.665] lstrlenW (lpString=".txt") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".txt") returned 0x0 [0077.665] lstrlenW (lpString=".dbf") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".dbf") returned 0x0 [0077.665] lstrlenW (lpString=".ckp") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".ckp") returned 0x0 [0077.665] lstrlenW (lpString=".dacpac") returned 7 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".dacpac") returned 0x0 [0077.665] lstrlenW (lpString=".db3") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".db3") returned 0x0 [0077.665] lstrlenW (lpString=".dtxs") returned 5 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".dtxs") returned 0x0 [0077.665] lstrlenW (lpString=".mdt") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".mdt") returned 0x0 [0077.665] lstrlenW (lpString=".sdf") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".sdf") returned 0x0 [0077.665] lstrlenW (lpString=".MDF") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".MDF") returned 0x0 [0077.665] lstrlenW (lpString=".DBF") returned 4 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".DBF") returned 0x0 [0077.665] lstrlenW (lpString=".DB") returned 3 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".DB") returned 0x0 [0077.665] lstrlenW (lpString=".db") returned 3 [0077.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".db") returned 0x0 [0077.666] lstrlenW (lpString=".ndf") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".ndf") returned 0x0 [0077.666] lstrlenW (lpString=".NDF") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".NDF") returned 0x0 [0077.666] lstrlenW (lpString=".Mdf") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".Mdf") returned 0x0 [0077.666] lstrlenW (lpString=".dat") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".dat") returned 0x0 [0077.666] lstrlenW (lpString=".DAT") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".DAT") returned 0x0 [0077.666] lstrlenW (lpString=".ldf") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".ldf") returned 0x0 [0077.666] lstrlenW (lpString=".LDF") returned 4 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch=".LDF") returned 0x0 [0077.666] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.666] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.667] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.667] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19766832427) returned 1 [0077.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd1aa850, dwHighDateTime=0x1d585b4)) [0077.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb408 [0077.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb408 | out: hHeap=0x260000) returned 1 [0077.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd408 [0077.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd408 | out: hHeap=0x260000) returned 1 [0077.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.668] GetLastError () returned 0x0 [0077.668] GetLastError () returned 0x0 [0077.668] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.668] GetLastError () returned 0x0 [0077.669] GetLastError () returned 0x0 [0077.706] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffebe4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.706] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x141c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x141c, lpOverlapped=0x0) returned 1 [0077.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.707] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.707] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.707] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.707] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.707] CloseHandle (hObject=0xe4) returned 1 [0077.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.800] GetLastError () returned 0x0 [0077.800] RtlWakeConditionVariable () returned 0x0 [0077.820] GetCurrentThreadId () returned 0x98c [0077.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".ldf") returned 0x0 [0077.820] lstrlenW (lpString=".vhd") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".vhd") returned 0x0 [0077.829] lstrlenW (lpString=".vhdx") returned 5 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".vhdx") returned 0x0 [0077.829] lstrlenW (lpString=".pst") returned 4 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".pst") returned 0x0 [0077.829] lstrlenW (lpString=".ost") returned 4 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".ost") returned 0x0 [0077.829] lstrlenW (lpString=".bak") returned 4 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".bak") returned 0x0 [0077.829] lstrlenW (lpString=".bac") returned 4 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".bac") returned 0x0 [0077.829] lstrlenW (lpString=".sys") returned 4 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".sys") returned 0x0 [0077.829] lstrlenW (lpString=".v2i") returned 4 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".v2i") returned 0x0 [0077.829] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.830] lstrlenW (lpString=".sql") returned 4 [0077.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".sql") returned 0x0 [0077.830] lstrlenW (lpString=".mdf") returned 4 [0077.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".mdf") returned 0x0 [0077.830] lstrlenW (lpString=".txt") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".txt") returned 0x0 [0077.831] lstrlenW (lpString=".dbf") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".dbf") returned 0x0 [0077.831] lstrlenW (lpString=".ckp") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".ckp") returned 0x0 [0077.831] lstrlenW (lpString=".dacpac") returned 7 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".dacpac") returned 0x0 [0077.831] lstrlenW (lpString=".db3") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".db3") returned 0x0 [0077.831] lstrlenW (lpString=".dtxs") returned 5 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".dtxs") returned 0x0 [0077.831] lstrlenW (lpString=".mdt") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".mdt") returned 0x0 [0077.831] lstrlenW (lpString=".sdf") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".sdf") returned 0x0 [0077.831] lstrlenW (lpString=".MDF") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".MDF") returned 0x0 [0077.831] lstrlenW (lpString=".DBF") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".DBF") returned 0x0 [0077.831] lstrlenW (lpString=".DB") returned 3 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".DB") returned 0x0 [0077.831] lstrlenW (lpString=".db") returned 3 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".db") returned 0x0 [0077.831] lstrlenW (lpString=".ndf") returned 4 [0077.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".ndf") returned 0x0 [0077.831] lstrlenW (lpString=".NDF") returned 4 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".NDF") returned 0x0 [0077.832] lstrlenW (lpString=".Mdf") returned 4 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".Mdf") returned 0x0 [0077.832] lstrlenW (lpString=".dat") returned 4 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".dat") returned 0x0 [0077.832] lstrlenW (lpString=".DAT") returned 4 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".DAT") returned 0x0 [0077.832] lstrlenW (lpString=".ldf") returned 4 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".ldf") returned 0x0 [0077.832] lstrlenW (lpString=".LDF") returned 4 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch=".LDF") returned 0x0 [0077.832] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.832] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.833] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.833] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.833] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19783426449) returned 1 [0077.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd34d770, dwHighDateTime=0x1d585b4)) [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb750 [0077.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb750 | out: hHeap=0x260000) returned 1 [0077.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cfa98 [0077.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cfa98 | out: hHeap=0x260000) returned 1 [0077.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.834] GetLastError () returned 0x0 [0077.834] GetLastError () returned 0x0 [0077.834] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.834] GetLastError () returned 0x0 [0077.835] GetLastError () returned 0x0 [0077.837] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff24d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.837] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xdb2e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xdb2e, lpOverlapped=0x0) returned 1 [0077.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.837] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.838] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.838] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.838] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.838] CloseHandle (hObject=0x108) returned 1 [0077.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.839] GetLastError () returned 0x0 [0077.839] RtlWakeConditionVariable () returned 0x0 [0077.839] GetCurrentThreadId () returned 0x98c [0077.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".ldf") returned 0x0 [0077.839] lstrlenW (lpString=".vhd") returned 4 [0077.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".vhd") returned 0x0 [0077.839] lstrlenW (lpString=".vhdx") returned 5 [0077.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".vhdx") returned 0x0 [0077.840] lstrlenW (lpString=".pst") returned 4 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".pst") returned 0x0 [0077.840] lstrlenW (lpString=".ost") returned 4 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".ost") returned 0x0 [0077.840] lstrlenW (lpString=".bak") returned 4 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".bak") returned 0x0 [0077.840] lstrlenW (lpString=".bac") returned 4 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".bac") returned 0x0 [0077.840] lstrlenW (lpString=".sys") returned 4 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".sys") returned 0x0 [0077.840] lstrlenW (lpString=".v2i") returned 4 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".v2i") returned 0x0 [0077.840] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.841] lstrlenW (lpString=".sql") returned 4 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".sql") returned 0x0 [0077.841] lstrlenW (lpString=".mdf") returned 4 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".mdf") returned 0x0 [0077.841] lstrlenW (lpString=".txt") returned 4 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".txt") returned 0x0 [0077.841] lstrlenW (lpString=".dbf") returned 4 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".dbf") returned 0x0 [0077.841] lstrlenW (lpString=".ckp") returned 4 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".ckp") returned 0x0 [0077.841] lstrlenW (lpString=".dacpac") returned 7 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".dacpac") returned 0x0 [0077.841] lstrlenW (lpString=".db3") returned 4 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".db3") returned 0x0 [0077.841] lstrlenW (lpString=".dtxs") returned 5 [0077.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".dtxs") returned 0x0 [0077.841] lstrlenW (lpString=".mdt") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".mdt") returned 0x0 [0077.842] lstrlenW (lpString=".sdf") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".sdf") returned 0x0 [0077.842] lstrlenW (lpString=".MDF") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".MDF") returned 0x0 [0077.842] lstrlenW (lpString=".DBF") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".DBF") returned 0x0 [0077.842] lstrlenW (lpString=".DB") returned 3 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".DB") returned 0x0 [0077.842] lstrlenW (lpString=".db") returned 3 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".db") returned 0x0 [0077.842] lstrlenW (lpString=".ndf") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".ndf") returned 0x0 [0077.842] lstrlenW (lpString=".NDF") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".NDF") returned 0x0 [0077.842] lstrlenW (lpString=".Mdf") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".Mdf") returned 0x0 [0077.842] lstrlenW (lpString=".dat") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".dat") returned 0x0 [0077.842] lstrlenW (lpString=".DAT") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".DAT") returned 0x0 [0077.842] lstrlenW (lpString=".ldf") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".ldf") returned 0x0 [0077.842] lstrlenW (lpString=".LDF") returned 4 [0077.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch=".LDF") returned 0x0 [0077.842] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.843] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.843] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.843] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.844] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19784476695) returned 1 [0077.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd3738d0, dwHighDateTime=0x1d585b4)) [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb788 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb788 | out: hHeap=0x260000) returned 1 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cfb40 [0077.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cfb40 | out: hHeap=0x260000) returned 1 [0077.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.857] GetLastError () returned 0x0 [0077.857] GetLastError () returned 0x0 [0077.857] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.857] GetLastError () returned 0x0 [0077.857] GetLastError () returned 0x0 [0077.898] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbe1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.898] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x41e5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x41e5, lpOverlapped=0x0) returned 1 [0077.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.898] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.899] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.899] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.899] CloseHandle (hObject=0x108) returned 1 [0077.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.966] GetLastError () returned 0x0 [0077.966] RtlWakeConditionVariable () returned 0x0 [0077.967] GetCurrentThreadId () returned 0x98c [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".ldf") returned 0x0 [0077.967] lstrlenW (lpString=".vhd") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".vhd") returned 0x0 [0077.967] lstrlenW (lpString=".vhdx") returned 5 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".vhdx") returned 0x0 [0077.967] lstrlenW (lpString=".pst") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".pst") returned 0x0 [0077.967] lstrlenW (lpString=".ost") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".ost") returned 0x0 [0077.967] lstrlenW (lpString=".bak") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".bak") returned 0x0 [0077.967] lstrlenW (lpString=".bac") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".bac") returned 0x0 [0077.967] lstrlenW (lpString=".sys") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".sys") returned 0x0 [0077.967] lstrlenW (lpString=".v2i") returned 4 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".v2i") returned 0x0 [0077.967] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0077.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.969] lstrlenW (lpString=".sql") returned 4 [0077.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".sql") returned 0x0 [0077.969] lstrlenW (lpString=".mdf") returned 4 [0077.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".mdf") returned 0x0 [0077.969] lstrlenW (lpString=".txt") returned 4 [0077.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".txt") returned 0x0 [0077.970] lstrlenW (lpString=".dbf") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".dbf") returned 0x0 [0077.970] lstrlenW (lpString=".ckp") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".ckp") returned 0x0 [0077.970] lstrlenW (lpString=".dacpac") returned 7 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".dacpac") returned 0x0 [0077.970] lstrlenW (lpString=".db3") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".db3") returned 0x0 [0077.970] lstrlenW (lpString=".dtxs") returned 5 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".dtxs") returned 0x0 [0077.970] lstrlenW (lpString=".mdt") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".mdt") returned 0x0 [0077.970] lstrlenW (lpString=".sdf") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".sdf") returned 0x0 [0077.970] lstrlenW (lpString=".MDF") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".MDF") returned 0x0 [0077.970] lstrlenW (lpString=".DBF") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".DBF") returned 0x0 [0077.970] lstrlenW (lpString=".DB") returned 3 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".DB") returned 0x0 [0077.970] lstrlenW (lpString=".db") returned 3 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".db") returned 0x0 [0077.970] lstrlenW (lpString=".ndf") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".ndf") returned 0x0 [0077.970] lstrlenW (lpString=".NDF") returned 4 [0077.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".NDF") returned 0x0 [0077.971] lstrlenW (lpString=".Mdf") returned 4 [0077.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".Mdf") returned 0x0 [0077.971] lstrlenW (lpString=".dat") returned 4 [0077.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".dat") returned 0x0 [0077.971] lstrlenW (lpString=".DAT") returned 4 [0077.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".DAT") returned 0x0 [0077.971] lstrlenW (lpString=".ldf") returned 4 [0077.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".ldf") returned 0x0 [0077.971] lstrlenW (lpString=".LDF") returned 4 [0077.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch=".LDF") returned 0x0 [0077.971] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.971] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.972] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.972] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.972] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19797318208) returned 1 [0077.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd4a43d0, dwHighDateTime=0x1d585b4)) [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c568 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c568 | out: hHeap=0x260000) returned 1 [0077.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0077.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0077.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0077.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.973] GetLastError () returned 0x0 [0077.973] GetLastError () returned 0x0 [0077.973] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.973] GetLastError () returned 0x0 [0077.973] GetLastError () returned 0x0 [0077.976] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdc79, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.976] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2387, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2387, lpOverlapped=0x0) returned 1 [0077.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.976] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.976] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.976] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.976] CloseHandle (hObject=0x108) returned 1 [0077.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx.[deadmin@cock.li].deadmin")) returned 1 [0077.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.978] GetLastError () returned 0x0 [0077.978] RtlWakeConditionVariable () returned 0x0 [0077.978] GetCurrentThreadId () returned 0x98c [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".ldf") returned 0x0 [0077.978] lstrlenW (lpString=".vhd") returned 4 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".vhd") returned 0x0 [0077.978] lstrlenW (lpString=".vhdx") returned 5 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".vhdx") returned 0x0 [0077.978] lstrlenW (lpString=".pst") returned 4 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".pst") returned 0x0 [0077.978] lstrlenW (lpString=".ost") returned 4 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".ost") returned 0x0 [0077.978] lstrlenW (lpString=".bak") returned 4 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".bak") returned 0x0 [0077.978] lstrlenW (lpString=".bac") returned 4 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".bac") returned 0x0 [0077.978] lstrlenW (lpString=".sys") returned 4 [0077.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".sys") returned 0x0 [0077.979] lstrlenW (lpString=".v2i") returned 4 [0077.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".v2i") returned 0x0 [0077.979] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0077.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.979] lstrlenW (lpString=".sql") returned 4 [0077.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".sql") returned 0x0 [0077.980] lstrlenW (lpString=".mdf") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".mdf") returned 0x0 [0077.980] lstrlenW (lpString=".txt") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".txt") returned 0x0 [0077.980] lstrlenW (lpString=".dbf") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".dbf") returned 0x0 [0077.980] lstrlenW (lpString=".ckp") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".ckp") returned 0x0 [0077.980] lstrlenW (lpString=".dacpac") returned 7 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".dacpac") returned 0x0 [0077.980] lstrlenW (lpString=".db3") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".db3") returned 0x0 [0077.980] lstrlenW (lpString=".dtxs") returned 5 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".dtxs") returned 0x0 [0077.980] lstrlenW (lpString=".mdt") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".mdt") returned 0x0 [0077.980] lstrlenW (lpString=".sdf") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".sdf") returned 0x0 [0077.980] lstrlenW (lpString=".MDF") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".MDF") returned 0x0 [0077.980] lstrlenW (lpString=".DBF") returned 4 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".DBF") returned 0x0 [0077.980] lstrlenW (lpString=".DB") returned 3 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".DB") returned 0x0 [0077.980] lstrlenW (lpString=".db") returned 3 [0077.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".db") returned 0x0 [0077.981] lstrlenW (lpString=".ndf") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".ndf") returned 0x0 [0077.981] lstrlenW (lpString=".NDF") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".NDF") returned 0x0 [0077.981] lstrlenW (lpString=".Mdf") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".Mdf") returned 0x0 [0077.981] lstrlenW (lpString=".dat") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".dat") returned 0x0 [0077.981] lstrlenW (lpString=".DAT") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".DAT") returned 0x0 [0077.981] lstrlenW (lpString=".ldf") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".ldf") returned 0x0 [0077.981] lstrlenW (lpString=".LDF") returned 4 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch=".LDF") returned 0x0 [0077.981] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.981] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.982] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.982] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19798334926) returned 1 [0077.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd4a43d0, dwHighDateTime=0x1d585b4)) [0077.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c530 [0077.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c530 | out: hHeap=0x260000) returned 1 [0077.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0250 [0077.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0077.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0250 | out: hHeap=0x260000) returned 1 [0077.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.983] GetLastError () returned 0x0 [0077.983] GetLastError () returned 0x0 [0077.983] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.983] GetLastError () returned 0x0 [0077.984] GetLastError () returned 0x0 [0077.985] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdc20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.985] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x23e0, lpOverlapped=0x0) returned 1 [0077.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.986] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.986] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.986] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.986] CloseHandle (hObject=0x108) returned 1 [0077.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx.[deadmin@cock.li].deadmin")) returned 1 [0077.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.987] GetLastError () returned 0x0 [0077.987] RtlWakeConditionVariable () returned 0x0 [0077.987] GetCurrentThreadId () returned 0x98c [0077.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".ldf") returned 0x0 [0077.988] lstrlenW (lpString=".vhd") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".vhd") returned 0x0 [0077.988] lstrlenW (lpString=".vhdx") returned 5 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".vhdx") returned 0x0 [0077.988] lstrlenW (lpString=".pst") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".pst") returned 0x0 [0077.988] lstrlenW (lpString=".ost") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".ost") returned 0x0 [0077.988] lstrlenW (lpString=".bak") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".bak") returned 0x0 [0077.988] lstrlenW (lpString=".bac") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".bac") returned 0x0 [0077.988] lstrlenW (lpString=".sys") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".sys") returned 0x0 [0077.988] lstrlenW (lpString=".v2i") returned 4 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".v2i") returned 0x0 [0077.988] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0077.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.989] lstrlenW (lpString=".sql") returned 4 [0077.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".sql") returned 0x0 [0077.989] lstrlenW (lpString=".mdf") returned 4 [0077.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".mdf") returned 0x0 [0077.989] lstrlenW (lpString=".txt") returned 4 [0077.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".txt") returned 0x0 [0077.989] lstrlenW (lpString=".dbf") returned 4 [0077.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".dbf") returned 0x0 [0077.989] lstrlenW (lpString=".ckp") returned 4 [0077.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".ckp") returned 0x0 [0077.989] lstrlenW (lpString=".dacpac") returned 7 [0077.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".dacpac") returned 0x0 [0077.990] lstrlenW (lpString=".db3") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".db3") returned 0x0 [0077.990] lstrlenW (lpString=".dtxs") returned 5 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".dtxs") returned 0x0 [0077.990] lstrlenW (lpString=".mdt") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".mdt") returned 0x0 [0077.990] lstrlenW (lpString=".sdf") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".sdf") returned 0x0 [0077.990] lstrlenW (lpString=".MDF") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".MDF") returned 0x0 [0077.990] lstrlenW (lpString=".DBF") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".DBF") returned 0x0 [0077.990] lstrlenW (lpString=".DB") returned 3 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".DB") returned 0x0 [0077.990] lstrlenW (lpString=".db") returned 3 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".db") returned 0x0 [0077.990] lstrlenW (lpString=".ndf") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".ndf") returned 0x0 [0077.990] lstrlenW (lpString=".NDF") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".NDF") returned 0x0 [0077.990] lstrlenW (lpString=".Mdf") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".Mdf") returned 0x0 [0077.990] lstrlenW (lpString=".dat") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".dat") returned 0x0 [0077.990] lstrlenW (lpString=".DAT") returned 4 [0077.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".DAT") returned 0x0 [0077.991] lstrlenW (lpString=".ldf") returned 4 [0077.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".ldf") returned 0x0 [0077.991] lstrlenW (lpString=".LDF") returned 4 [0077.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch=".LDF") returned 0x0 [0077.991] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.991] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0077.992] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.992] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.992] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19799301460) returned 1 [0077.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd4ca530, dwHighDateTime=0x1d585b4)) [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c4f8 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c4f8 | out: hHeap=0x260000) returned 1 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf9f0 [0077.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0077.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf9f0 | out: hHeap=0x260000) returned 1 [0077.993] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0077.993] GetLastError () returned 0x0 [0077.993] GetLastError () returned 0x0 [0077.993] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0077.993] GetLastError () returned 0x0 [0077.993] GetLastError () returned 0x0 [0077.995] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdf0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.995] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x20f5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x20f5, lpOverlapped=0x0) returned 1 [0077.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.995] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.995] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.995] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.995] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.995] CloseHandle (hObject=0x108) returned 1 [0077.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0077.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx.[deadmin@cock.li].deadmin")) returned 1 [0077.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0077.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.999] GetLastError () returned 0x0 [0077.999] RtlWakeConditionVariable () returned 0x0 [0077.999] GetCurrentThreadId () returned 0x98c [0077.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".ldf") returned 0x0 [0077.999] lstrlenW (lpString=".vhd") returned 4 [0077.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".vhd") returned 0x0 [0077.999] lstrlenW (lpString=".vhdx") returned 5 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".vhdx") returned 0x0 [0078.000] lstrlenW (lpString=".pst") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".pst") returned 0x0 [0078.000] lstrlenW (lpString=".ost") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".ost") returned 0x0 [0078.000] lstrlenW (lpString=".bak") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".bak") returned 0x0 [0078.000] lstrlenW (lpString=".bac") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".bac") returned 0x0 [0078.000] lstrlenW (lpString=".sys") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".sys") returned 0x0 [0078.041] lstrlenW (lpString=".v2i") returned 4 [0078.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".v2i") returned 0x0 [0078.041] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.145] lstrlenW (lpString=".sql") returned 4 [0078.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".sql") returned 0x0 [0078.146] lstrlenW (lpString=".mdf") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".mdf") returned 0x0 [0078.146] lstrlenW (lpString=".txt") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".txt") returned 0x0 [0078.146] lstrlenW (lpString=".dbf") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".dbf") returned 0x0 [0078.146] lstrlenW (lpString=".ckp") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".ckp") returned 0x0 [0078.146] lstrlenW (lpString=".dacpac") returned 7 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".dacpac") returned 0x0 [0078.146] lstrlenW (lpString=".db3") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".db3") returned 0x0 [0078.146] lstrlenW (lpString=".dtxs") returned 5 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".dtxs") returned 0x0 [0078.146] lstrlenW (lpString=".mdt") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".mdt") returned 0x0 [0078.146] lstrlenW (lpString=".sdf") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".sdf") returned 0x0 [0078.146] lstrlenW (lpString=".MDF") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".MDF") returned 0x0 [0078.146] lstrlenW (lpString=".DBF") returned 4 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".DBF") returned 0x0 [0078.146] lstrlenW (lpString=".DB") returned 3 [0078.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".DB") returned 0x0 [0078.146] lstrlenW (lpString=".db") returned 3 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".db") returned 0x0 [0078.147] lstrlenW (lpString=".ndf") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".ndf") returned 0x0 [0078.147] lstrlenW (lpString=".NDF") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".NDF") returned 0x0 [0078.147] lstrlenW (lpString=".Mdf") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".Mdf") returned 0x0 [0078.147] lstrlenW (lpString=".dat") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".dat") returned 0x0 [0078.147] lstrlenW (lpString=".DAT") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".DAT") returned 0x0 [0078.147] lstrlenW (lpString=".ldf") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".ldf") returned 0x0 [0078.147] lstrlenW (lpString=".LDF") returned 4 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch=".LDF") returned 0x0 [0078.147] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.147] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.148] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.148] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19815125126) returned 1 [0078.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd6472f0, dwHighDateTime=0x1d585b4)) [0078.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbc20 [0078.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbc20 | out: hHeap=0x260000) returned 1 [0078.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d08e0 [0078.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d08e0 | out: hHeap=0x260000) returned 1 [0078.151] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.151] GetLastError () returned 0x0 [0078.151] GetLastError () returned 0x0 [0078.151] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.151] GetLastError () returned 0x0 [0078.152] GetLastError () returned 0x0 [0078.154] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffde97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.154] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x2169, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x2169, lpOverlapped=0x0) returned 1 [0078.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.154] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.154] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.155] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.155] CloseHandle (hObject=0xe4) returned 1 [0078.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0078.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0078.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.157] GetLastError () returned 0x0 [0078.157] RtlWakeConditionVariable () returned 0x0 [0078.157] GetCurrentThreadId () returned 0x98c [0078.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".ldf") returned 0x0 [0078.157] lstrlenW (lpString=".vhd") returned 4 [0078.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".vhd") returned 0x0 [0078.157] lstrlenW (lpString=".vhdx") returned 5 [0078.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".vhdx") returned 0x0 [0078.157] lstrlenW (lpString=".pst") returned 4 [0078.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".pst") returned 0x0 [0078.157] lstrlenW (lpString=".ost") returned 4 [0078.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".ost") returned 0x0 [0078.157] lstrlenW (lpString=".bak") returned 4 [0078.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".bak") returned 0x0 [0078.157] lstrlenW (lpString=".bac") returned 4 [0078.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".bac") returned 0x0 [0078.158] lstrlenW (lpString=".sys") returned 4 [0078.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".sys") returned 0x0 [0078.158] lstrlenW (lpString=".v2i") returned 4 [0078.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".v2i") returned 0x0 [0078.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.160] lstrlenW (lpString=".sql") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".sql") returned 0x0 [0078.160] lstrlenW (lpString=".mdf") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".mdf") returned 0x0 [0078.160] lstrlenW (lpString=".txt") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".txt") returned 0x0 [0078.160] lstrlenW (lpString=".dbf") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".dbf") returned 0x0 [0078.160] lstrlenW (lpString=".ckp") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".ckp") returned 0x0 [0078.160] lstrlenW (lpString=".dacpac") returned 7 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".dacpac") returned 0x0 [0078.160] lstrlenW (lpString=".db3") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".db3") returned 0x0 [0078.160] lstrlenW (lpString=".dtxs") returned 5 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".dtxs") returned 0x0 [0078.160] lstrlenW (lpString=".mdt") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".mdt") returned 0x0 [0078.160] lstrlenW (lpString=".sdf") returned 4 [0078.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".sdf") returned 0x0 [0078.161] lstrlenW (lpString=".MDF") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".MDF") returned 0x0 [0078.161] lstrlenW (lpString=".DBF") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".DBF") returned 0x0 [0078.161] lstrlenW (lpString=".DB") returned 3 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".DB") returned 0x0 [0078.161] lstrlenW (lpString=".db") returned 3 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".db") returned 0x0 [0078.161] lstrlenW (lpString=".ndf") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".ndf") returned 0x0 [0078.161] lstrlenW (lpString=".NDF") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".NDF") returned 0x0 [0078.161] lstrlenW (lpString=".Mdf") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".Mdf") returned 0x0 [0078.161] lstrlenW (lpString=".dat") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".dat") returned 0x0 [0078.161] lstrlenW (lpString=".DAT") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".DAT") returned 0x0 [0078.161] lstrlenW (lpString=".ldf") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".ldf") returned 0x0 [0078.161] lstrlenW (lpString=".LDF") returned 4 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch=".LDF") returned 0x0 [0078.161] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.162] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756170) returned 1 [0078.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.162] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0078.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.163] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19816365416) returned 1 [0078.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd66d450, dwHighDateTime=0x1d585b4)) [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbc58 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbc58 | out: hHeap=0x260000) returned 1 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d08e0 [0078.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d08e0 | out: hHeap=0x260000) returned 1 [0078.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.163] GetLastError () returned 0x0 [0078.164] GetLastError () returned 0x0 [0078.164] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.164] GetLastError () returned 0x0 [0078.164] GetLastError () returned 0x0 [0078.165] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.165] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.166] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.166] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.166] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.166] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.166] CloseHandle (hObject=0xe4) returned 1 [0078.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0078.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.[deadmin@cock.li].deadmin")) returned 1 [0078.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0078.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.168] GetLastError () returned 0x0 [0078.168] RtlWakeConditionVariable () returned 0x0 [0078.168] GetCurrentThreadId () returned 0x98c [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".ldf") returned 0x0 [0078.168] lstrlenW (lpString=".vhd") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".vhd") returned 0x0 [0078.168] lstrlenW (lpString=".vhdx") returned 5 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".vhdx") returned 0x0 [0078.168] lstrlenW (lpString=".pst") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".pst") returned 0x0 [0078.168] lstrlenW (lpString=".ost") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".ost") returned 0x0 [0078.168] lstrlenW (lpString=".bak") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".bak") returned 0x0 [0078.168] lstrlenW (lpString=".bac") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".bac") returned 0x0 [0078.168] lstrlenW (lpString=".sys") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".sys") returned 0x0 [0078.168] lstrlenW (lpString=".v2i") returned 4 [0078.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".v2i") returned 0x0 [0078.169] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0078.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.170] lstrlenW (lpString=".sql") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".sql") returned 0x0 [0078.170] lstrlenW (lpString=".mdf") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".mdf") returned 0x0 [0078.170] lstrlenW (lpString=".txt") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".txt") returned 0x0 [0078.170] lstrlenW (lpString=".dbf") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".dbf") returned 0x0 [0078.170] lstrlenW (lpString=".ckp") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".ckp") returned 0x0 [0078.170] lstrlenW (lpString=".dacpac") returned 7 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".dacpac") returned 0x0 [0078.170] lstrlenW (lpString=".db3") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".db3") returned 0x0 [0078.170] lstrlenW (lpString=".dtxs") returned 5 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".dtxs") returned 0x0 [0078.170] lstrlenW (lpString=".mdt") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".mdt") returned 0x0 [0078.170] lstrlenW (lpString=".sdf") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".sdf") returned 0x0 [0078.170] lstrlenW (lpString=".MDF") returned 4 [0078.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".MDF") returned 0x0 [0078.171] lstrlenW (lpString=".DBF") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".DBF") returned 0x0 [0078.171] lstrlenW (lpString=".DB") returned 3 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".DB") returned 0x0 [0078.171] lstrlenW (lpString=".db") returned 3 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".db") returned 0x0 [0078.171] lstrlenW (lpString=".ndf") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".ndf") returned 0x0 [0078.171] lstrlenW (lpString=".NDF") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".NDF") returned 0x0 [0078.171] lstrlenW (lpString=".Mdf") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".Mdf") returned 0x0 [0078.171] lstrlenW (lpString=".dat") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".dat") returned 0x0 [0078.171] lstrlenW (lpString=".DAT") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".DAT") returned 0x0 [0078.171] lstrlenW (lpString=".ldf") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".ldf") returned 0x0 [0078.171] lstrlenW (lpString=".LDF") returned 4 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch=".LDF") returned 0x0 [0078.171] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.171] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.172] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.172] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.173] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19817370650) returned 1 [0078.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd6935b0, dwHighDateTime=0x1d585b4)) [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbc90 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbc90 | out: hHeap=0x260000) returned 1 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d08e0 [0078.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f25e0 [0078.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d08e0 | out: hHeap=0x260000) returned 1 [0078.173] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.173] GetLastError () returned 0x0 [0078.174] GetLastError () returned 0x0 [0078.174] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.174] GetLastError () returned 0x0 [0078.174] GetLastError () returned 0x0 [0078.176] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff3f93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.176] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xc06d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xc06d, lpOverlapped=0x0) returned 1 [0078.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.176] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.176] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.177] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.177] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.177] CloseHandle (hObject=0xe4) returned 1 [0078.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.177] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.[deadmin@cock.li].deadmin")) returned 1 [0078.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.179] GetLastError () returned 0x0 [0078.179] RtlWakeConditionVariable () returned 0x0 [0078.179] GetCurrentThreadId () returned 0x98c [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".ldf") returned 0x0 [0078.180] lstrlenW (lpString=".vhd") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".vhd") returned 0x0 [0078.180] lstrlenW (lpString=".vhdx") returned 5 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".vhdx") returned 0x0 [0078.180] lstrlenW (lpString=".pst") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".pst") returned 0x0 [0078.180] lstrlenW (lpString=".ost") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".ost") returned 0x0 [0078.180] lstrlenW (lpString=".bak") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".bak") returned 0x0 [0078.180] lstrlenW (lpString=".bac") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".bac") returned 0x0 [0078.180] lstrlenW (lpString=".sys") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".sys") returned 0x0 [0078.180] lstrlenW (lpString=".v2i") returned 4 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".v2i") returned 0x0 [0078.180] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.221] lstrlenW (lpString=".sql") returned 4 [0078.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".sql") returned 0x0 [0078.221] lstrlenW (lpString=".mdf") returned 4 [0078.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".mdf") returned 0x0 [0078.221] lstrlenW (lpString=".txt") returned 4 [0078.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".txt") returned 0x0 [0078.221] lstrlenW (lpString=".dbf") returned 4 [0078.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".dbf") returned 0x0 [0078.221] lstrlenW (lpString=".ckp") returned 4 [0078.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".ckp") returned 0x0 [0078.221] lstrlenW (lpString=".dacpac") returned 7 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".dacpac") returned 0x0 [0078.222] lstrlenW (lpString=".db3") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".db3") returned 0x0 [0078.222] lstrlenW (lpString=".dtxs") returned 5 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".dtxs") returned 0x0 [0078.222] lstrlenW (lpString=".mdt") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".mdt") returned 0x0 [0078.222] lstrlenW (lpString=".sdf") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".sdf") returned 0x0 [0078.222] lstrlenW (lpString=".MDF") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".MDF") returned 0x0 [0078.222] lstrlenW (lpString=".DBF") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".DBF") returned 0x0 [0078.222] lstrlenW (lpString=".DB") returned 3 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".DB") returned 0x0 [0078.222] lstrlenW (lpString=".db") returned 3 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".db") returned 0x0 [0078.222] lstrlenW (lpString=".ndf") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".ndf") returned 0x0 [0078.222] lstrlenW (lpString=".NDF") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".NDF") returned 0x0 [0078.222] lstrlenW (lpString=".Mdf") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".Mdf") returned 0x0 [0078.222] lstrlenW (lpString=".dat") returned 4 [0078.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".dat") returned 0x0 [0078.223] lstrlenW (lpString=".DAT") returned 4 [0078.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".DAT") returned 0x0 [0078.223] lstrlenW (lpString=".ldf") returned 4 [0078.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".ldf") returned 0x0 [0078.223] lstrlenW (lpString=".LDF") returned 4 [0078.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch=".LDF") returned 0x0 [0078.223] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.223] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.224] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.224] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.224] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19822517496) returned 1 [0078.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd7059d0, dwHighDateTime=0x1d585b4)) [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbd38 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbd38 | out: hHeap=0x260000) returned 1 [0078.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f25e0 [0078.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.225] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.225] GetLastError () returned 0x0 [0078.225] GetLastError () returned 0x0 [0078.225] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.225] GetLastError () returned 0x0 [0078.225] GetLastError () returned 0x0 [0078.229] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff4298, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.229] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbd68, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xbd68, lpOverlapped=0x0) returned 1 [0078.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.229] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.229] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.229] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.229] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.229] CloseHandle (hObject=0xd8) returned 1 [0078.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.232] GetLastError () returned 0x0 [0078.232] RtlWakeConditionVariable () returned 0x0 [0078.232] GetCurrentThreadId () returned 0x98c [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.232] lstrlenW (lpString=".vhd") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".vhd") returned 0x0 [0078.232] lstrlenW (lpString=".vhdx") returned 5 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".vhdx") returned 0x0 [0078.232] lstrlenW (lpString=".pst") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".pst") returned 0x0 [0078.232] lstrlenW (lpString=".ost") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".ost") returned 0x0 [0078.232] lstrlenW (lpString=".bak") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".bak") returned 0x0 [0078.232] lstrlenW (lpString=".bac") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".bac") returned 0x0 [0078.232] lstrlenW (lpString=".sys") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".sys") returned 0x0 [0078.232] lstrlenW (lpString=".v2i") returned 4 [0078.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".v2i") returned 0x0 [0078.232] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0078.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.234] lstrlenW (lpString=".sql") returned 4 [0078.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".sql") returned 0x0 [0078.234] lstrlenW (lpString=".mdf") returned 4 [0078.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".mdf") returned 0x0 [0078.234] lstrlenW (lpString=".txt") returned 4 [0078.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".txt") returned 0x0 [0078.234] lstrlenW (lpString=".dbf") returned 4 [0078.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".dbf") returned 0x0 [0078.234] lstrlenW (lpString=".ckp") returned 4 [0078.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".ckp") returned 0x0 [0078.234] lstrlenW (lpString=".dacpac") returned 7 [0078.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".dacpac") returned 0x0 [0078.235] lstrlenW (lpString=".db3") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".db3") returned 0x0 [0078.235] lstrlenW (lpString=".dtxs") returned 5 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".dtxs") returned 0x0 [0078.235] lstrlenW (lpString=".mdt") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".mdt") returned 0x0 [0078.235] lstrlenW (lpString=".sdf") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".sdf") returned 0x0 [0078.235] lstrlenW (lpString=".MDF") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".MDF") returned 0x0 [0078.235] lstrlenW (lpString=".DBF") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".DBF") returned 0x0 [0078.235] lstrlenW (lpString=".DB") returned 3 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".DB") returned 0x0 [0078.235] lstrlenW (lpString=".db") returned 3 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".db") returned 0x0 [0078.235] lstrlenW (lpString=".ndf") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".ndf") returned 0x0 [0078.235] lstrlenW (lpString=".NDF") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".NDF") returned 0x0 [0078.235] lstrlenW (lpString=".Mdf") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".Mdf") returned 0x0 [0078.235] lstrlenW (lpString=".dat") returned 4 [0078.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".dat") returned 0x0 [0078.235] lstrlenW (lpString=".DAT") returned 4 [0078.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".DAT") returned 0x0 [0078.236] lstrlenW (lpString=".ldf") returned 4 [0078.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.236] lstrlenW (lpString=".LDF") returned 4 [0078.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch=".LDF") returned 0x0 [0078.236] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.236] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.237] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.237] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19823798217) returned 1 [0078.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd72bb30, dwHighDateTime=0x1d585b4)) [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbd70 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbd70 | out: hHeap=0x260000) returned 1 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f28d8 [0078.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.238] GetLastError () returned 0x0 [0078.238] GetLastError () returned 0x0 [0078.238] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.238] GetLastError () returned 0x0 [0078.238] GetLastError () returned 0x0 [0078.239] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.239] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xcf, lpOverlapped=0x0) returned 1 [0078.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.240] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.240] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.240] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.240] CloseHandle (hObject=0xd8) returned 1 [0078.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0078.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.242] GetLastError () returned 0x0 [0078.242] RtlWakeConditionVariable () returned 0x27e828 [0078.242] GetCurrentThreadId () returned 0x98c [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.242] lstrlenW (lpString=".vhd") returned 4 [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.242] lstrlenW (lpString=".vhdx") returned 5 [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.242] lstrlenW (lpString=".pst") returned 4 [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".pst") returned 0x0 [0078.242] lstrlenW (lpString=".ost") returned 4 [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".ost") returned 0x0 [0078.242] lstrlenW (lpString=".bak") returned 4 [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".bak") returned 0x0 [0078.242] lstrlenW (lpString=".bac") returned 4 [0078.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".bac") returned 0x0 [0078.242] lstrlenW (lpString=".sys") returned 4 [0078.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".sys") returned 0x0 [0078.243] lstrlenW (lpString=".v2i") returned 4 [0078.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.243] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.244] lstrlenW (lpString=".sql") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".sql") returned 0x0 [0078.244] lstrlenW (lpString=".mdf") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.244] lstrlenW (lpString=".txt") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".txt") returned 0x0 [0078.244] lstrlenW (lpString=".dbf") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.244] lstrlenW (lpString=".ckp") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.244] lstrlenW (lpString=".dacpac") returned 7 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.244] lstrlenW (lpString=".db3") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".db3") returned 0x0 [0078.244] lstrlenW (lpString=".dtxs") returned 5 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.244] lstrlenW (lpString=".mdt") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.244] lstrlenW (lpString=".sdf") returned 4 [0078.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.245] lstrlenW (lpString=".MDF") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.245] lstrlenW (lpString=".DBF") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.245] lstrlenW (lpString=".DB") returned 3 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".DB") returned 0x0 [0078.245] lstrlenW (lpString=".db") returned 3 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".db") returned 0x0 [0078.245] lstrlenW (lpString=".ndf") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.245] lstrlenW (lpString=".NDF") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.245] lstrlenW (lpString=".Mdf") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.245] lstrlenW (lpString=".dat") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".dat") returned 0x0 [0078.245] lstrlenW (lpString=".DAT") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.245] lstrlenW (lpString=".ldf") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.245] lstrlenW (lpString=".LDF") returned 4 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.245] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.246] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.246] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.247] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19824766728) returned 1 [0078.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd72bb30, dwHighDateTime=0x1d585b4)) [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbda8 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbda8 | out: hHeap=0x260000) returned 1 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2548 [0078.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.247] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.247] GetLastError () returned 0x0 [0078.248] GetLastError () returned 0x0 [0078.248] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.248] GetLastError () returned 0x0 [0078.248] GetLastError () returned 0x0 [0078.249] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.249] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0078.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.249] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.249] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.249] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.250] CloseHandle (hObject=0xd8) returned 1 [0078.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.251] GetLastError () returned 0x0 [0078.251] RtlWakeConditionVariable () returned 0x27e828 [0078.251] GetCurrentThreadId () returned 0x98c [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.252] lstrlenW (lpString=".vhd") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.252] lstrlenW (lpString=".vhdx") returned 5 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.252] lstrlenW (lpString=".pst") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".pst") returned 0x0 [0078.252] lstrlenW (lpString=".ost") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".ost") returned 0x0 [0078.252] lstrlenW (lpString=".bak") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".bak") returned 0x0 [0078.252] lstrlenW (lpString=".bac") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".bac") returned 0x0 [0078.252] lstrlenW (lpString=".sys") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".sys") returned 0x0 [0078.252] lstrlenW (lpString=".v2i") returned 4 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.252] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.253] lstrlenW (lpString=".sql") returned 4 [0078.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".sql") returned 0x0 [0078.253] lstrlenW (lpString=".mdf") returned 4 [0078.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.254] lstrlenW (lpString=".txt") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".txt") returned 0x0 [0078.254] lstrlenW (lpString=".dbf") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.254] lstrlenW (lpString=".ckp") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.254] lstrlenW (lpString=".dacpac") returned 7 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.254] lstrlenW (lpString=".db3") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".db3") returned 0x0 [0078.254] lstrlenW (lpString=".dtxs") returned 5 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.254] lstrlenW (lpString=".mdt") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.254] lstrlenW (lpString=".sdf") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.254] lstrlenW (lpString=".MDF") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.254] lstrlenW (lpString=".DBF") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.254] lstrlenW (lpString=".DB") returned 3 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".DB") returned 0x0 [0078.254] lstrlenW (lpString=".db") returned 3 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".db") returned 0x0 [0078.254] lstrlenW (lpString=".ndf") returned 4 [0078.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.255] lstrlenW (lpString=".NDF") returned 4 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.255] lstrlenW (lpString=".Mdf") returned 4 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.255] lstrlenW (lpString=".dat") returned 4 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".dat") returned 0x0 [0078.255] lstrlenW (lpString=".DAT") returned 4 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.255] lstrlenW (lpString=".ldf") returned 4 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.255] lstrlenW (lpString=".LDF") returned 4 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.255] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.255] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.256] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.256] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.256] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19825725630) returned 1 [0078.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd751c90, dwHighDateTime=0x1d585b4)) [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbde0 [0078.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbde0 | out: hHeap=0x260000) returned 1 [0078.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f22e8 [0078.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.257] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.257] GetLastError () returned 0x0 [0078.257] GetLastError () returned 0x0 [0078.257] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.257] GetLastError () returned 0x0 [0078.258] GetLastError () returned 0x0 [0078.259] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.259] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0078.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.259] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.259] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.259] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.259] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.259] CloseHandle (hObject=0xd8) returned 1 [0078.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.261] GetLastError () returned 0x0 [0078.261] RtlWakeConditionVariable () returned 0x0 [0078.261] GetCurrentThreadId () returned 0x98c [0078.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".ldf") returned 0x0 [0078.261] lstrlenW (lpString=".vhd") returned 4 [0078.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".vhd") returned 0x0 [0078.261] lstrlenW (lpString=".vhdx") returned 5 [0078.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".vhdx") returned 0x0 [0078.261] lstrlenW (lpString=".pst") returned 4 [0078.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".pst") returned 0x0 [0078.261] lstrlenW (lpString=".ost") returned 4 [0078.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".ost") returned 0x0 [0078.262] lstrlenW (lpString=".bak") returned 4 [0078.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".bak") returned 0x0 [0078.262] lstrlenW (lpString=".bac") returned 4 [0078.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".bac") returned 0x0 [0078.262] lstrlenW (lpString=".sys") returned 4 [0078.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".sys") returned 0x0 [0078.262] lstrlenW (lpString=".v2i") returned 4 [0078.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".v2i") returned 0x0 [0078.262] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.263] lstrlenW (lpString=".sql") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".sql") returned 0x0 [0078.264] lstrlenW (lpString=".mdf") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".mdf") returned 0x0 [0078.264] lstrlenW (lpString=".txt") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".txt") returned 0x0 [0078.264] lstrlenW (lpString=".dbf") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".dbf") returned 0x0 [0078.264] lstrlenW (lpString=".ckp") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".ckp") returned 0x0 [0078.264] lstrlenW (lpString=".dacpac") returned 7 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".dacpac") returned 0x0 [0078.264] lstrlenW (lpString=".db3") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".db3") returned 0x0 [0078.264] lstrlenW (lpString=".dtxs") returned 5 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".dtxs") returned 0x0 [0078.264] lstrlenW (lpString=".mdt") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".mdt") returned 0x0 [0078.264] lstrlenW (lpString=".sdf") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".sdf") returned 0x0 [0078.264] lstrlenW (lpString=".MDF") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".MDF") returned 0x0 [0078.264] lstrlenW (lpString=".DBF") returned 4 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".DBF") returned 0x0 [0078.264] lstrlenW (lpString=".DB") returned 3 [0078.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".DB") returned 0x0 [0078.264] lstrlenW (lpString=".db") returned 3 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".db") returned 0x0 [0078.265] lstrlenW (lpString=".ndf") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".ndf") returned 0x0 [0078.265] lstrlenW (lpString=".NDF") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".NDF") returned 0x0 [0078.265] lstrlenW (lpString=".Mdf") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".Mdf") returned 0x0 [0078.265] lstrlenW (lpString=".dat") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".dat") returned 0x0 [0078.265] lstrlenW (lpString=".DAT") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".DAT") returned 0x0 [0078.265] lstrlenW (lpString=".ldf") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".ldf") returned 0x0 [0078.265] lstrlenW (lpString=".LDF") returned 4 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch=".LDF") returned 0x0 [0078.265] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.265] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27568e0) returned 1 [0078.266] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.266] CryptReleaseContext (hProv=0x27568e0, dwFlags=0x0) returned 1 [0078.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.266] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19826743052) returned 1 [0078.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd777df0, dwHighDateTime=0x1d585b4)) [0078.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbe18 [0078.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbe18 | out: hHeap=0x260000) returned 1 [0078.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.267] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.267] GetLastError () returned 0x0 [0078.267] GetLastError () returned 0x0 [0078.267] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.267] GetLastError () returned 0x0 [0078.268] GetLastError () returned 0x0 [0078.270] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffef288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.270] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x10d78, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x10d78, lpOverlapped=0x0) returned 1 [0078.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.270] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.270] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.271] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.271] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.271] CloseHandle (hObject=0xd8) returned 1 [0078.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0078.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0078.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.272] GetLastError () returned 0x0 [0078.272] RtlWakeConditionVariable () returned 0x0 [0078.272] GetCurrentThreadId () returned 0x98c [0078.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0078.272] lstrlenW (lpString=".vhd") returned 4 [0078.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0078.272] lstrlenW (lpString=".vhdx") returned 5 [0078.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0078.273] lstrlenW (lpString=".pst") returned 4 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0078.273] lstrlenW (lpString=".ost") returned 4 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0078.273] lstrlenW (lpString=".bak") returned 4 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0078.273] lstrlenW (lpString=".bac") returned 4 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0078.273] lstrlenW (lpString=".sys") returned 4 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0078.273] lstrlenW (lpString=".v2i") returned 4 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0078.273] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.274] lstrlenW (lpString=".sql") returned 4 [0078.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0078.274] lstrlenW (lpString=".mdf") returned 4 [0078.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0078.274] lstrlenW (lpString=".txt") returned 4 [0078.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0078.274] lstrlenW (lpString=".dbf") returned 4 [0078.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0078.274] lstrlenW (lpString=".ckp") returned 4 [0078.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0078.274] lstrlenW (lpString=".dacpac") returned 7 [0078.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0078.274] lstrlenW (lpString=".db3") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0078.275] lstrlenW (lpString=".dtxs") returned 5 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0078.275] lstrlenW (lpString=".mdt") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0078.275] lstrlenW (lpString=".sdf") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0078.275] lstrlenW (lpString=".MDF") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0078.275] lstrlenW (lpString=".DBF") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0078.275] lstrlenW (lpString=".DB") returned 3 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0078.275] lstrlenW (lpString=".db") returned 3 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0078.275] lstrlenW (lpString=".ndf") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0078.275] lstrlenW (lpString=".NDF") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0078.275] lstrlenW (lpString=".Mdf") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0078.275] lstrlenW (lpString=".dat") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0078.275] lstrlenW (lpString=".DAT") returned 4 [0078.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0078.275] lstrlenW (lpString=".ldf") returned 4 [0078.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0078.276] lstrlenW (lpString=".LDF") returned 4 [0078.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0078.276] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.276] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.277] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.277] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.277] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19827789734) returned 1 [0078.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd777df0, dwHighDateTime=0x1d585b4)) [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbe50 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbe50 | out: hHeap=0x260000) returned 1 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2380 [0078.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.278] GetLastError () returned 0x0 [0078.278] GetLastError () returned 0x0 [0078.278] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.278] GetLastError () returned 0x0 [0078.278] GetLastError () returned 0x0 [0078.281] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd280, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.281] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x2d80, lpOverlapped=0x0) returned 1 [0078.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.282] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.282] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.282] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.282] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.282] CloseHandle (hObject=0xd8) returned 1 [0078.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0078.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.283] GetLastError () returned 0x0 [0078.284] RtlWakeConditionVariable () returned 0x0 [0078.284] GetCurrentThreadId () returned 0x98c [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".ldf") returned 0x0 [0078.284] lstrlenW (lpString=".vhd") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".vhd") returned 0x0 [0078.284] lstrlenW (lpString=".vhdx") returned 5 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".vhdx") returned 0x0 [0078.284] lstrlenW (lpString=".pst") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".pst") returned 0x0 [0078.284] lstrlenW (lpString=".ost") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".ost") returned 0x0 [0078.284] lstrlenW (lpString=".bak") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".bak") returned 0x0 [0078.284] lstrlenW (lpString=".bac") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".bac") returned 0x0 [0078.284] lstrlenW (lpString=".sys") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".sys") returned 0x0 [0078.284] lstrlenW (lpString=".v2i") returned 4 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".v2i") returned 0x0 [0078.284] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.285] lstrlenW (lpString=".sql") returned 4 [0078.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".sql") returned 0x0 [0078.285] lstrlenW (lpString=".mdf") returned 4 [0078.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".mdf") returned 0x0 [0078.285] lstrlenW (lpString=".txt") returned 4 [0078.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".txt") returned 0x0 [0078.286] lstrlenW (lpString=".dbf") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".dbf") returned 0x0 [0078.286] lstrlenW (lpString=".ckp") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".ckp") returned 0x0 [0078.286] lstrlenW (lpString=".dacpac") returned 7 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".dacpac") returned 0x0 [0078.286] lstrlenW (lpString=".db3") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".db3") returned 0x0 [0078.286] lstrlenW (lpString=".dtxs") returned 5 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".dtxs") returned 0x0 [0078.286] lstrlenW (lpString=".mdt") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".mdt") returned 0x0 [0078.286] lstrlenW (lpString=".sdf") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".sdf") returned 0x0 [0078.286] lstrlenW (lpString=".MDF") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".MDF") returned 0x0 [0078.286] lstrlenW (lpString=".DBF") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".DBF") returned 0x0 [0078.286] lstrlenW (lpString=".DB") returned 3 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".DB") returned 0x0 [0078.286] lstrlenW (lpString=".db") returned 3 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".db") returned 0x0 [0078.286] lstrlenW (lpString=".ndf") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".ndf") returned 0x0 [0078.286] lstrlenW (lpString=".NDF") returned 4 [0078.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".NDF") returned 0x0 [0078.287] lstrlenW (lpString=".Mdf") returned 4 [0078.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".Mdf") returned 0x0 [0078.287] lstrlenW (lpString=".dat") returned 4 [0078.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".dat") returned 0x0 [0078.287] lstrlenW (lpString=".DAT") returned 4 [0078.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".DAT") returned 0x0 [0078.287] lstrlenW (lpString=".ldf") returned 4 [0078.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".ldf") returned 0x0 [0078.287] lstrlenW (lpString=".LDF") returned 4 [0078.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch=".LDF") returned 0x0 [0078.287] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.287] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756968) returned 1 [0078.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.288] CryptReleaseContext (hProv=0x2756968, dwFlags=0x0) returned 1 [0078.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.288] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19828916627) returned 1 [0078.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd79df50, dwHighDateTime=0x1d585b4)) [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbe88 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbe88 | out: hHeap=0x260000) returned 1 [0078.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.289] GetLastError () returned 0x0 [0078.289] GetLastError () returned 0x0 [0078.289] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.289] GetLastError () returned 0x0 [0078.289] GetLastError () returned 0x0 [0078.291] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff5a90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.292] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xa570, lpOverlapped=0x0) returned 1 [0078.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.292] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.292] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.292] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.292] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.292] CloseHandle (hObject=0xd8) returned 1 [0078.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0078.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0078.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.294] GetLastError () returned 0x0 [0078.294] RtlWakeConditionVariable () returned 0x0 [0078.294] GetCurrentThreadId () returned 0x98c [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".ldf") returned 0x0 [0078.294] lstrlenW (lpString=".vhd") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".vhd") returned 0x0 [0078.294] lstrlenW (lpString=".vhdx") returned 5 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".vhdx") returned 0x0 [0078.294] lstrlenW (lpString=".pst") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".pst") returned 0x0 [0078.294] lstrlenW (lpString=".ost") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".ost") returned 0x0 [0078.294] lstrlenW (lpString=".bak") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".bak") returned 0x0 [0078.294] lstrlenW (lpString=".bac") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".bac") returned 0x0 [0078.294] lstrlenW (lpString=".sys") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".sys") returned 0x0 [0078.294] lstrlenW (lpString=".v2i") returned 4 [0078.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".v2i") returned 0x0 [0078.295] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.326] lstrlenW (lpString=".sql") returned 4 [0078.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".sql") returned 0x0 [0078.326] lstrlenW (lpString=".mdf") returned 4 [0078.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".mdf") returned 0x0 [0078.326] lstrlenW (lpString=".txt") returned 4 [0078.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".txt") returned 0x0 [0078.326] lstrlenW (lpString=".dbf") returned 4 [0078.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".dbf") returned 0x0 [0078.326] lstrlenW (lpString=".ckp") returned 4 [0078.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".ckp") returned 0x0 [0078.326] lstrlenW (lpString=".dacpac") returned 7 [0078.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".dacpac") returned 0x0 [0078.340] lstrlenW (lpString=".db3") returned 4 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".db3") returned 0x0 [0078.340] lstrlenW (lpString=".dtxs") returned 5 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".dtxs") returned 0x0 [0078.340] lstrlenW (lpString=".mdt") returned 4 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".mdt") returned 0x0 [0078.340] lstrlenW (lpString=".sdf") returned 4 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".sdf") returned 0x0 [0078.340] lstrlenW (lpString=".MDF") returned 4 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".MDF") returned 0x0 [0078.340] lstrlenW (lpString=".DBF") returned 4 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".DBF") returned 0x0 [0078.340] lstrlenW (lpString=".DB") returned 3 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".DB") returned 0x0 [0078.340] lstrlenW (lpString=".db") returned 3 [0078.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".db") returned 0x0 [0078.340] lstrlenW (lpString=".ndf") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".ndf") returned 0x0 [0078.341] lstrlenW (lpString=".NDF") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".NDF") returned 0x0 [0078.341] lstrlenW (lpString=".Mdf") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".Mdf") returned 0x0 [0078.341] lstrlenW (lpString=".dat") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".dat") returned 0x0 [0078.341] lstrlenW (lpString=".DAT") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".DAT") returned 0x0 [0078.341] lstrlenW (lpString=".ldf") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".ldf") returned 0x0 [0078.341] lstrlenW (lpString=".LDF") returned 4 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch=".LDF") returned 0x0 [0078.341] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.341] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756b00) returned 1 [0078.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.342] CryptReleaseContext (hProv=0x2756b00, dwFlags=0x0) returned 1 [0078.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.342] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19834328192) returned 1 [0078.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd810370, dwHighDateTime=0x1d585b4)) [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c9c8 [0078.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c9c8 | out: hHeap=0x260000) returned 1 [0078.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.343] GetLastError () returned 0x0 [0078.343] GetLastError () returned 0x0 [0078.343] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.343] GetLastError () returned 0x0 [0078.343] GetLastError () returned 0x0 [0078.347] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.347] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.347] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.347] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.347] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.347] CloseHandle (hObject=0xe4) returned 1 [0078.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.[deadmin@cock.li].deadmin")) returned 1 [0078.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.349] GetLastError () returned 0x0 [0078.349] RtlWakeConditionVariable () returned 0x0 [0078.349] GetCurrentThreadId () returned 0x98c [0078.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".ldf") returned 0x0 [0078.349] lstrlenW (lpString=".vhd") returned 4 [0078.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".vhd") returned 0x0 [0078.349] lstrlenW (lpString=".vhdx") returned 5 [0078.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".vhdx") returned 0x0 [0078.349] lstrlenW (lpString=".pst") returned 4 [0078.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".pst") returned 0x0 [0078.349] lstrlenW (lpString=".ost") returned 4 [0078.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".ost") returned 0x0 [0078.349] lstrlenW (lpString=".bak") returned 4 [0078.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".bak") returned 0x0 [0078.349] lstrlenW (lpString=".bac") returned 4 [0078.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".bac") returned 0x0 [0078.350] lstrlenW (lpString=".sys") returned 4 [0078.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".sys") returned 0x0 [0078.350] lstrlenW (lpString=".v2i") returned 4 [0078.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".v2i") returned 0x0 [0078.350] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.351] lstrlenW (lpString=".sql") returned 4 [0078.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".sql") returned 0x0 [0078.351] lstrlenW (lpString=".mdf") returned 4 [0078.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".mdf") returned 0x0 [0078.351] lstrlenW (lpString=".txt") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".txt") returned 0x0 [0078.352] lstrlenW (lpString=".dbf") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".dbf") returned 0x0 [0078.352] lstrlenW (lpString=".ckp") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".ckp") returned 0x0 [0078.352] lstrlenW (lpString=".dacpac") returned 7 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".dacpac") returned 0x0 [0078.352] lstrlenW (lpString=".db3") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".db3") returned 0x0 [0078.352] lstrlenW (lpString=".dtxs") returned 5 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".dtxs") returned 0x0 [0078.352] lstrlenW (lpString=".mdt") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".mdt") returned 0x0 [0078.352] lstrlenW (lpString=".sdf") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".sdf") returned 0x0 [0078.352] lstrlenW (lpString=".MDF") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".MDF") returned 0x0 [0078.352] lstrlenW (lpString=".DBF") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".DBF") returned 0x0 [0078.352] lstrlenW (lpString=".DB") returned 3 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".DB") returned 0x0 [0078.352] lstrlenW (lpString=".db") returned 3 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".db") returned 0x0 [0078.352] lstrlenW (lpString=".ndf") returned 4 [0078.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".ndf") returned 0x0 [0078.353] lstrlenW (lpString=".NDF") returned 4 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".NDF") returned 0x0 [0078.353] lstrlenW (lpString=".Mdf") returned 4 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".Mdf") returned 0x0 [0078.353] lstrlenW (lpString=".dat") returned 4 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".dat") returned 0x0 [0078.353] lstrlenW (lpString=".DAT") returned 4 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".DAT") returned 0x0 [0078.353] lstrlenW (lpString=".ldf") returned 4 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".ldf") returned 0x0 [0078.353] lstrlenW (lpString=".LDF") returned 4 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch=".LDF") returned 0x0 [0078.353] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.353] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756a78) returned 1 [0078.354] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.354] CryptReleaseContext (hProv=0x2756a78, dwFlags=0x0) returned 1 [0078.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.354] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19835522709) returned 1 [0078.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd8364d0, dwHighDateTime=0x1d585b4)) [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c990 [0078.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c990 | out: hHeap=0x260000) returned 1 [0078.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.355] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.355] GetLastError () returned 0x0 [0078.355] GetLastError () returned 0x0 [0078.355] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.355] GetLastError () returned 0x0 [0078.355] GetLastError () returned 0x0 [0078.358] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.358] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.358] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.358] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.358] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.358] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.358] CloseHandle (hObject=0xe4) returned 1 [0078.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0078.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.[deadmin@cock.li].deadmin")) returned 1 [0078.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0078.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.359] GetLastError () returned 0x0 [0078.360] RtlWakeConditionVariable () returned 0x0 [0078.360] GetCurrentThreadId () returned 0x98c [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".ldf") returned 0x0 [0078.360] lstrlenW (lpString=".vhd") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".vhd") returned 0x0 [0078.360] lstrlenW (lpString=".vhdx") returned 5 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".vhdx") returned 0x0 [0078.360] lstrlenW (lpString=".pst") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".pst") returned 0x0 [0078.360] lstrlenW (lpString=".ost") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".ost") returned 0x0 [0078.360] lstrlenW (lpString=".bak") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".bak") returned 0x0 [0078.360] lstrlenW (lpString=".bac") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".bac") returned 0x0 [0078.360] lstrlenW (lpString=".sys") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".sys") returned 0x0 [0078.360] lstrlenW (lpString=".v2i") returned 4 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".v2i") returned 0x0 [0078.360] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.361] lstrlenW (lpString=".sql") returned 4 [0078.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".sql") returned 0x0 [0078.361] lstrlenW (lpString=".mdf") returned 4 [0078.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".mdf") returned 0x0 [0078.362] lstrlenW (lpString=".txt") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".txt") returned 0x0 [0078.362] lstrlenW (lpString=".dbf") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".dbf") returned 0x0 [0078.362] lstrlenW (lpString=".ckp") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".ckp") returned 0x0 [0078.362] lstrlenW (lpString=".dacpac") returned 7 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".dacpac") returned 0x0 [0078.362] lstrlenW (lpString=".db3") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".db3") returned 0x0 [0078.362] lstrlenW (lpString=".dtxs") returned 5 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".dtxs") returned 0x0 [0078.362] lstrlenW (lpString=".mdt") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".mdt") returned 0x0 [0078.362] lstrlenW (lpString=".sdf") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".sdf") returned 0x0 [0078.362] lstrlenW (lpString=".MDF") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".MDF") returned 0x0 [0078.362] lstrlenW (lpString=".DBF") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".DBF") returned 0x0 [0078.362] lstrlenW (lpString=".DB") returned 3 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".DB") returned 0x0 [0078.362] lstrlenW (lpString=".db") returned 3 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".db") returned 0x0 [0078.362] lstrlenW (lpString=".ndf") returned 4 [0078.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".ndf") returned 0x0 [0078.363] lstrlenW (lpString=".NDF") returned 4 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".NDF") returned 0x0 [0078.363] lstrlenW (lpString=".Mdf") returned 4 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".Mdf") returned 0x0 [0078.363] lstrlenW (lpString=".dat") returned 4 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".dat") returned 0x0 [0078.363] lstrlenW (lpString=".DAT") returned 4 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".DAT") returned 0x0 [0078.363] lstrlenW (lpString=".ldf") returned 4 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".ldf") returned 0x0 [0078.363] lstrlenW (lpString=".LDF") returned 4 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch=".LDF") returned 0x0 [0078.363] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.363] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756c10) returned 1 [0078.364] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.364] CryptReleaseContext (hProv=0x2756c10, dwFlags=0x0) returned 1 [0078.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.364] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19836522120) returned 1 [0078.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd85c630, dwHighDateTime=0x1d585b4)) [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c958 [0078.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c958 | out: hHeap=0x260000) returned 1 [0078.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.365] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.365] GetLastError () returned 0x0 [0078.365] GetLastError () returned 0x0 [0078.365] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.365] GetLastError () returned 0x0 [0078.365] GetLastError () returned 0x0 [0078.367] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff284, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.367] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd7c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd7c, lpOverlapped=0x0) returned 1 [0078.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.367] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.367] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.367] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.368] CloseHandle (hObject=0xe4) returned 1 [0078.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.[deadmin@cock.li].deadmin")) returned 1 [0078.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.369] GetLastError () returned 0x0 [0078.369] RtlWakeConditionVariable () returned 0x0 [0078.369] GetCurrentThreadId () returned 0x98c [0078.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".ldf") returned 0x0 [0078.369] lstrlenW (lpString=".vhd") returned 4 [0078.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".vhd") returned 0x0 [0078.369] lstrlenW (lpString=".vhdx") returned 5 [0078.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".vhdx") returned 0x0 [0078.369] lstrlenW (lpString=".pst") returned 4 [0078.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".pst") returned 0x0 [0078.369] lstrlenW (lpString=".ost") returned 4 [0078.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".ost") returned 0x0 [0078.369] lstrlenW (lpString=".bak") returned 4 [0078.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".bak") returned 0x0 [0078.370] lstrlenW (lpString=".bac") returned 4 [0078.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".bac") returned 0x0 [0078.370] lstrlenW (lpString=".sys") returned 4 [0078.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".sys") returned 0x0 [0078.370] lstrlenW (lpString=".v2i") returned 4 [0078.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".v2i") returned 0x0 [0078.370] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.371] lstrlenW (lpString=".sql") returned 4 [0078.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".sql") returned 0x0 [0078.371] lstrlenW (lpString=".mdf") returned 4 [0078.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".mdf") returned 0x0 [0078.371] lstrlenW (lpString=".txt") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".txt") returned 0x0 [0078.372] lstrlenW (lpString=".dbf") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".dbf") returned 0x0 [0078.372] lstrlenW (lpString=".ckp") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".ckp") returned 0x0 [0078.372] lstrlenW (lpString=".dacpac") returned 7 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".dacpac") returned 0x0 [0078.372] lstrlenW (lpString=".db3") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".db3") returned 0x0 [0078.372] lstrlenW (lpString=".dtxs") returned 5 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".dtxs") returned 0x0 [0078.372] lstrlenW (lpString=".mdt") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".mdt") returned 0x0 [0078.372] lstrlenW (lpString=".sdf") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".sdf") returned 0x0 [0078.372] lstrlenW (lpString=".MDF") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".MDF") returned 0x0 [0078.372] lstrlenW (lpString=".DBF") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".DBF") returned 0x0 [0078.372] lstrlenW (lpString=".DB") returned 3 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".DB") returned 0x0 [0078.372] lstrlenW (lpString=".db") returned 3 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".db") returned 0x0 [0078.372] lstrlenW (lpString=".ndf") returned 4 [0078.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".ndf") returned 0x0 [0078.372] lstrlenW (lpString=".NDF") returned 4 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".NDF") returned 0x0 [0078.373] lstrlenW (lpString=".Mdf") returned 4 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".Mdf") returned 0x0 [0078.373] lstrlenW (lpString=".dat") returned 4 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".dat") returned 0x0 [0078.373] lstrlenW (lpString=".DAT") returned 4 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".DAT") returned 0x0 [0078.373] lstrlenW (lpString=".ldf") returned 4 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".ldf") returned 0x0 [0078.373] lstrlenW (lpString=".LDF") returned 4 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch=".LDF") returned 0x0 [0078.373] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.373] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756c98) returned 1 [0078.374] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.374] CryptReleaseContext (hProv=0x2756c98, dwFlags=0x0) returned 1 [0078.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.374] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19837518988) returned 1 [0078.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbd85c630, dwHighDateTime=0x1d585b4)) [0078.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c798 [0078.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c798 | out: hHeap=0x260000) returned 1 [0078.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.446] GetLastError () returned 0x0 [0078.447] GetLastError () returned 0x0 [0078.447] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.447] GetLastError () returned 0x0 [0078.447] GetLastError () returned 0x0 [0078.546] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.546] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.547] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.547] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.547] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.547] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.547] CloseHandle (hObject=0xe4) returned 1 [0078.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.[deadmin@cock.li].deadmin")) returned 1 [0078.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.550] GetLastError () returned 0x0 [0078.550] RtlWakeConditionVariable () returned 0x0 [0078.550] GetCurrentThreadId () returned 0x98c [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".ldf") returned 0x0 [0078.550] lstrlenW (lpString=".vhd") returned 4 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".vhd") returned 0x0 [0078.550] lstrlenW (lpString=".vhdx") returned 5 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".vhdx") returned 0x0 [0078.550] lstrlenW (lpString=".pst") returned 4 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".pst") returned 0x0 [0078.550] lstrlenW (lpString=".ost") returned 4 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".ost") returned 0x0 [0078.550] lstrlenW (lpString=".bak") returned 4 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".bak") returned 0x0 [0078.550] lstrlenW (lpString=".bac") returned 4 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".bac") returned 0x0 [0078.550] lstrlenW (lpString=".sys") returned 4 [0078.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".sys") returned 0x0 [0078.550] lstrlenW (lpString=".v2i") returned 4 [0078.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".v2i") returned 0x0 [0078.551] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch="s\r\n.v2i") returned 0x0 [0078.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.570] lstrlenW (lpString=".sql") returned 4 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".sql") returned 0x0 [0078.570] lstrlenW (lpString=".mdf") returned 4 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".mdf") returned 0x0 [0078.570] lstrlenW (lpString=".txt") returned 4 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".txt") returned 0x0 [0078.570] lstrlenW (lpString=".dbf") returned 4 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".dbf") returned 0x0 [0078.570] lstrlenW (lpString=".ckp") returned 4 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".ckp") returned 0x0 [0078.570] lstrlenW (lpString=".dacpac") returned 7 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".dacpac") returned 0x0 [0078.570] lstrlenW (lpString=".db3") returned 4 [0078.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".db3") returned 0x0 [0078.570] lstrlenW (lpString=".dtxs") returned 5 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".dtxs") returned 0x0 [0078.571] lstrlenW (lpString=".mdt") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".mdt") returned 0x0 [0078.571] lstrlenW (lpString=".sdf") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".sdf") returned 0x0 [0078.571] lstrlenW (lpString=".MDF") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".MDF") returned 0x0 [0078.571] lstrlenW (lpString=".DBF") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".DBF") returned 0x0 [0078.571] lstrlenW (lpString=".DB") returned 3 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".DB") returned 0x0 [0078.571] lstrlenW (lpString=".db") returned 3 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".db") returned 0x0 [0078.571] lstrlenW (lpString=".ndf") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".ndf") returned 0x0 [0078.571] lstrlenW (lpString=".NDF") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".NDF") returned 0x0 [0078.571] lstrlenW (lpString=".Mdf") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".Mdf") returned 0x0 [0078.571] lstrlenW (lpString=".dat") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".dat") returned 0x0 [0078.571] lstrlenW (lpString=".DAT") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".DAT") returned 0x0 [0078.571] lstrlenW (lpString=".ldf") returned 4 [0078.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".ldf") returned 0x0 [0078.572] lstrlenW (lpString=".LDF") returned 4 [0078.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch=".LDF") returned 0x0 [0078.572] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.572] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756d20) returned 1 [0078.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.573] CryptReleaseContext (hProv=0x2756d20, dwFlags=0x0) returned 1 [0078.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.573] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19857385383) returned 1 [0078.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbda4b810, dwHighDateTime=0x1d585b4)) [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c6f0 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c6f0 | out: hHeap=0x260000) returned 1 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.574] GetLastError () returned 0x0 [0078.574] GetLastError () returned 0x0 [0078.574] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.574] GetLastError () returned 0x0 [0078.574] GetLastError () returned 0x0 [0078.577] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff8b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.577] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x74c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x74c, lpOverlapped=0x0) returned 1 [0078.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.577] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.577] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.577] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.577] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.577] CloseHandle (hObject=0xe4) returned 1 [0078.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.577] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.[deadmin@cock.li].deadmin")) returned 1 [0078.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.579] GetLastError () returned 0x0 [0078.579] RtlWakeConditionVariable () returned 0x0 [0078.579] GetCurrentThreadId () returned 0x98c [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0078.579] lstrlenW (lpString=".vhd") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0078.579] lstrlenW (lpString=".vhdx") returned 5 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0078.579] lstrlenW (lpString=".pst") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0078.579] lstrlenW (lpString=".ost") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0078.579] lstrlenW (lpString=".bak") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0078.579] lstrlenW (lpString=".bac") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0078.579] lstrlenW (lpString=".sys") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0078.579] lstrlenW (lpString=".v2i") returned 4 [0078.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0078.580] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.581] lstrlenW (lpString=".sql") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0078.581] lstrlenW (lpString=".mdf") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0078.581] lstrlenW (lpString=".txt") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0078.581] lstrlenW (lpString=".dbf") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0078.581] lstrlenW (lpString=".ckp") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0078.581] lstrlenW (lpString=".dacpac") returned 7 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0078.581] lstrlenW (lpString=".db3") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0078.581] lstrlenW (lpString=".dtxs") returned 5 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0078.581] lstrlenW (lpString=".mdt") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0078.581] lstrlenW (lpString=".sdf") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0078.581] lstrlenW (lpString=".MDF") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0078.581] lstrlenW (lpString=".DBF") returned 4 [0078.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0078.582] lstrlenW (lpString=".DB") returned 3 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0078.582] lstrlenW (lpString=".db") returned 3 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0078.582] lstrlenW (lpString=".ndf") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0078.582] lstrlenW (lpString=".NDF") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0078.582] lstrlenW (lpString=".Mdf") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0078.582] lstrlenW (lpString=".dat") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0078.582] lstrlenW (lpString=".DAT") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0078.582] lstrlenW (lpString=".ldf") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0078.582] lstrlenW (lpString=".LDF") returned 4 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0078.582] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.582] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x311400) returned 1 [0078.583] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.583] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.583] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19858445624) returned 1 [0078.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbda71970, dwHighDateTime=0x1d585b4)) [0078.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c6b8 [0078.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c6b8 | out: hHeap=0x260000) returned 1 [0078.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0ad8 [0078.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0ad8 | out: hHeap=0x260000) returned 1 [0078.584] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.584] GetLastError () returned 0x0 [0078.584] GetLastError () returned 0x0 [0078.584] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.585] GetLastError () returned 0x0 [0078.585] GetLastError () returned 0x0 [0078.682] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffb480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.682] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x4b80, lpOverlapped=0x0) returned 1 [0078.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.682] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.682] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.682] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.682] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.682] CloseHandle (hObject=0xe4) returned 1 [0078.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0078.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.684] GetLastError () returned 0x0 [0078.685] RtlWakeConditionVariable () returned 0x27e828 [0078.685] GetCurrentThreadId () returned 0x98c [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0078.685] lstrlenW (lpString=".vhd") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0078.685] lstrlenW (lpString=".vhdx") returned 5 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0078.685] lstrlenW (lpString=".pst") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0078.685] lstrlenW (lpString=".ost") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0078.685] lstrlenW (lpString=".bak") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0078.685] lstrlenW (lpString=".bac") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0078.685] lstrlenW (lpString=".sys") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0078.685] lstrlenW (lpString=".v2i") returned 4 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0078.685] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.690] lstrlenW (lpString=".sql") returned 4 [0078.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0078.691] lstrlenW (lpString=".mdf") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0078.691] lstrlenW (lpString=".txt") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0078.691] lstrlenW (lpString=".dbf") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0078.691] lstrlenW (lpString=".ckp") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0078.691] lstrlenW (lpString=".dacpac") returned 7 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0078.691] lstrlenW (lpString=".db3") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0078.691] lstrlenW (lpString=".dtxs") returned 5 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0078.691] lstrlenW (lpString=".mdt") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0078.691] lstrlenW (lpString=".sdf") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0078.691] lstrlenW (lpString=".MDF") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0078.691] lstrlenW (lpString=".DBF") returned 4 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0078.691] lstrlenW (lpString=".DB") returned 3 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0078.691] lstrlenW (lpString=".db") returned 3 [0078.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0078.692] lstrlenW (lpString=".ndf") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0078.692] lstrlenW (lpString=".NDF") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0078.692] lstrlenW (lpString=".Mdf") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0078.692] lstrlenW (lpString=".dat") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0078.692] lstrlenW (lpString=".DAT") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0078.692] lstrlenW (lpString=".ldf") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0078.692] lstrlenW (lpString=".LDF") returned 4 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0078.692] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.692] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756f40) returned 1 [0078.693] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.693] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.693] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19869434594) returned 1 [0078.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdb7c310, dwHighDateTime=0x1d585b4)) [0078.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c610 [0078.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c610 | out: hHeap=0x260000) returned 1 [0078.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f37b0 [0078.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.694] GetLastError () returned 0x0 [0078.694] GetLastError () returned 0x0 [0078.694] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.694] GetLastError () returned 0x0 [0078.695] GetLastError () returned 0x0 [0078.759] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.759] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.760] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.760] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.786] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.787] CloseHandle (hObject=0xe4) returned 1 [0078.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0078.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.788] GetLastError () returned 0x0 [0078.788] RtlWakeConditionVariable () returned 0x27e828 [0078.788] GetCurrentThreadId () returned 0x98c [0078.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.788] lstrlenW (lpString=".vhd") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".vhd") returned 0x0 [0078.789] lstrlenW (lpString=".vhdx") returned 5 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".vhdx") returned 0x0 [0078.789] lstrlenW (lpString=".pst") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".pst") returned 0x0 [0078.789] lstrlenW (lpString=".ost") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".ost") returned 0x0 [0078.789] lstrlenW (lpString=".bak") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".bak") returned 0x0 [0078.789] lstrlenW (lpString=".bac") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".bac") returned 0x0 [0078.789] lstrlenW (lpString=".sys") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".sys") returned 0x0 [0078.789] lstrlenW (lpString=".v2i") returned 4 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".v2i") returned 0x0 [0078.789] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0078.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.790] lstrlenW (lpString=".sql") returned 4 [0078.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".sql") returned 0x0 [0078.790] lstrlenW (lpString=".mdf") returned 4 [0078.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".mdf") returned 0x0 [0078.790] lstrlenW (lpString=".txt") returned 4 [0078.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".txt") returned 0x0 [0078.790] lstrlenW (lpString=".dbf") returned 4 [0078.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".dbf") returned 0x0 [0078.790] lstrlenW (lpString=".ckp") returned 4 [0078.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".ckp") returned 0x0 [0078.790] lstrlenW (lpString=".dacpac") returned 7 [0078.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".dacpac") returned 0x0 [0078.791] lstrlenW (lpString=".db3") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".db3") returned 0x0 [0078.791] lstrlenW (lpString=".dtxs") returned 5 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".dtxs") returned 0x0 [0078.791] lstrlenW (lpString=".mdt") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".mdt") returned 0x0 [0078.791] lstrlenW (lpString=".sdf") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".sdf") returned 0x0 [0078.791] lstrlenW (lpString=".MDF") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".MDF") returned 0x0 [0078.791] lstrlenW (lpString=".DBF") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".DBF") returned 0x0 [0078.791] lstrlenW (lpString=".DB") returned 3 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".DB") returned 0x0 [0078.791] lstrlenW (lpString=".db") returned 3 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".db") returned 0x0 [0078.791] lstrlenW (lpString=".ndf") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".ndf") returned 0x0 [0078.791] lstrlenW (lpString=".NDF") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".NDF") returned 0x0 [0078.791] lstrlenW (lpString=".Mdf") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".Mdf") returned 0x0 [0078.791] lstrlenW (lpString=".dat") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".dat") returned 0x0 [0078.791] lstrlenW (lpString=".DAT") returned 4 [0078.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".DAT") returned 0x0 [0078.792] lstrlenW (lpString=".ldf") returned 4 [0078.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.792] lstrlenW (lpString=".LDF") returned 4 [0078.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch=".LDF") returned 0x0 [0078.792] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.792] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.793] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.793] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.793] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19879394484) returned 1 [0078.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdc60b50, dwHighDateTime=0x1d585b4)) [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc0f0 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc0f0 | out: hHeap=0x260000) returned 1 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0ad8 [0078.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0ad8 | out: hHeap=0x260000) returned 1 [0078.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.794] GetLastError () returned 0x0 [0078.794] GetLastError () returned 0x0 [0078.794] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.794] GetLastError () returned 0x0 [0078.794] GetLastError () returned 0x0 [0078.799] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.799] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x2a4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x2a4, lpOverlapped=0x0) returned 1 [0078.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.799] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.799] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.800] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.800] CloseHandle (hObject=0xe4) returned 1 [0078.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.800] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0078.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.801] GetLastError () returned 0x0 [0078.801] RtlWakeConditionVariable () returned 0x0 [0078.801] GetCurrentThreadId () returned 0x98c [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.802] lstrlenW (lpString=".vhd") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".vhd") returned 0x0 [0078.802] lstrlenW (lpString=".vhdx") returned 5 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".vhdx") returned 0x0 [0078.802] lstrlenW (lpString=".pst") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".pst") returned 0x0 [0078.802] lstrlenW (lpString=".ost") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".ost") returned 0x0 [0078.802] lstrlenW (lpString=".bak") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".bak") returned 0x0 [0078.802] lstrlenW (lpString=".bac") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".bac") returned 0x0 [0078.802] lstrlenW (lpString=".sys") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".sys") returned 0x0 [0078.802] lstrlenW (lpString=".v2i") returned 4 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".v2i") returned 0x0 [0078.802] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0078.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.803] lstrlenW (lpString=".sql") returned 4 [0078.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".sql") returned 0x0 [0078.803] lstrlenW (lpString=".mdf") returned 4 [0078.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".mdf") returned 0x0 [0078.803] lstrlenW (lpString=".txt") returned 4 [0078.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".txt") returned 0x0 [0078.804] lstrlenW (lpString=".dbf") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".dbf") returned 0x0 [0078.804] lstrlenW (lpString=".ckp") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".ckp") returned 0x0 [0078.804] lstrlenW (lpString=".dacpac") returned 7 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".dacpac") returned 0x0 [0078.804] lstrlenW (lpString=".db3") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".db3") returned 0x0 [0078.804] lstrlenW (lpString=".dtxs") returned 5 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".dtxs") returned 0x0 [0078.804] lstrlenW (lpString=".mdt") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".mdt") returned 0x0 [0078.804] lstrlenW (lpString=".sdf") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".sdf") returned 0x0 [0078.804] lstrlenW (lpString=".MDF") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".MDF") returned 0x0 [0078.804] lstrlenW (lpString=".DBF") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".DBF") returned 0x0 [0078.804] lstrlenW (lpString=".DB") returned 3 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".DB") returned 0x0 [0078.804] lstrlenW (lpString=".db") returned 3 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".db") returned 0x0 [0078.804] lstrlenW (lpString=".ndf") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".ndf") returned 0x0 [0078.804] lstrlenW (lpString=".NDF") returned 4 [0078.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".NDF") returned 0x0 [0078.805] lstrlenW (lpString=".Mdf") returned 4 [0078.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".Mdf") returned 0x0 [0078.805] lstrlenW (lpString=".dat") returned 4 [0078.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".dat") returned 0x0 [0078.805] lstrlenW (lpString=".DAT") returned 4 [0078.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".DAT") returned 0x0 [0078.805] lstrlenW (lpString=".ldf") returned 4 [0078.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.805] lstrlenW (lpString=".LDF") returned 4 [0078.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch=".LDF") returned 0x0 [0078.805] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.805] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.806] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.806] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.806] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19880717141) returned 1 [0078.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdc86cb0, dwHighDateTime=0x1d585b4)) [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc128 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc128 | out: hHeap=0x260000) returned 1 [0078.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0cd0 [0078.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0cd0 | out: hHeap=0x260000) returned 1 [0078.807] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.807] GetLastError () returned 0x0 [0078.807] GetLastError () returned 0x0 [0078.807] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.807] GetLastError () returned 0x0 [0078.807] GetLastError () returned 0x0 [0078.808] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.809] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd8, lpOverlapped=0x0) returned 1 [0078.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.809] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.809] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.809] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.809] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.809] CloseHandle (hObject=0xe4) returned 1 [0078.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0078.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.811] GetLastError () returned 0x0 [0078.811] RtlWakeConditionVariable () returned 0x27e828 [0078.811] GetCurrentThreadId () returned 0x98c [0078.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.811] lstrlenW (lpString=".vhd") returned 4 [0078.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.811] lstrlenW (lpString=".vhdx") returned 5 [0078.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.811] lstrlenW (lpString=".pst") returned 4 [0078.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".pst") returned 0x0 [0078.811] lstrlenW (lpString=".ost") returned 4 [0078.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".ost") returned 0x0 [0078.811] lstrlenW (lpString=".bak") returned 4 [0078.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".bak") returned 0x0 [0078.811] lstrlenW (lpString=".bac") returned 4 [0078.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".bac") returned 0x0 [0078.812] lstrlenW (lpString=".sys") returned 4 [0078.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".sys") returned 0x0 [0078.812] lstrlenW (lpString=".v2i") returned 4 [0078.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.812] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.813] lstrlenW (lpString=".sql") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".sql") returned 0x0 [0078.813] lstrlenW (lpString=".mdf") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.813] lstrlenW (lpString=".txt") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".txt") returned 0x0 [0078.813] lstrlenW (lpString=".dbf") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.813] lstrlenW (lpString=".ckp") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.813] lstrlenW (lpString=".dacpac") returned 7 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.813] lstrlenW (lpString=".db3") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".db3") returned 0x0 [0078.813] lstrlenW (lpString=".dtxs") returned 5 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.813] lstrlenW (lpString=".mdt") returned 4 [0078.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.813] lstrlenW (lpString=".sdf") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.814] lstrlenW (lpString=".MDF") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.814] lstrlenW (lpString=".DBF") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.814] lstrlenW (lpString=".DB") returned 3 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".DB") returned 0x0 [0078.814] lstrlenW (lpString=".db") returned 3 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".db") returned 0x0 [0078.814] lstrlenW (lpString=".ndf") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.814] lstrlenW (lpString=".NDF") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.814] lstrlenW (lpString=".Mdf") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.814] lstrlenW (lpString=".dat") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".dat") returned 0x0 [0078.814] lstrlenW (lpString=".DAT") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.814] lstrlenW (lpString=".ldf") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.814] lstrlenW (lpString=".LDF") returned 4 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.814] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.815] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.815] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.815] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.815] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19881663534) returned 1 [0078.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdcace10, dwHighDateTime=0x1d585b4)) [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc160 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc160 | out: hHeap=0x260000) returned 1 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0d78 [0078.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0d78 | out: hHeap=0x260000) returned 1 [0078.816] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.816] GetLastError () returned 0x0 [0078.817] GetLastError () returned 0x0 [0078.817] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.817] GetLastError () returned 0x0 [0078.817] GetLastError () returned 0x0 [0078.818] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.818] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0078.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.818] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.818] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.818] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.818] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.818] CloseHandle (hObject=0xe4) returned 1 [0078.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0078.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0078.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.820] GetLastError () returned 0x0 [0078.820] RtlWakeConditionVariable () returned 0x27e828 [0078.820] GetCurrentThreadId () returned 0x98c [0078.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.820] lstrlenW (lpString=".vhd") returned 4 [0078.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.820] lstrlenW (lpString=".vhdx") returned 5 [0078.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.820] lstrlenW (lpString=".pst") returned 4 [0078.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".pst") returned 0x0 [0078.820] lstrlenW (lpString=".ost") returned 4 [0078.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".ost") returned 0x0 [0078.820] lstrlenW (lpString=".bak") returned 4 [0078.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".bak") returned 0x0 [0078.821] lstrlenW (lpString=".bac") returned 4 [0078.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".bac") returned 0x0 [0078.821] lstrlenW (lpString=".sys") returned 4 [0078.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".sys") returned 0x0 [0078.821] lstrlenW (lpString=".v2i") returned 4 [0078.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.821] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.822] lstrlenW (lpString=".sql") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".sql") returned 0x0 [0078.822] lstrlenW (lpString=".mdf") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.822] lstrlenW (lpString=".txt") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".txt") returned 0x0 [0078.822] lstrlenW (lpString=".dbf") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.822] lstrlenW (lpString=".ckp") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.822] lstrlenW (lpString=".dacpac") returned 7 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.822] lstrlenW (lpString=".db3") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".db3") returned 0x0 [0078.822] lstrlenW (lpString=".dtxs") returned 5 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.822] lstrlenW (lpString=".mdt") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.822] lstrlenW (lpString=".sdf") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.822] lstrlenW (lpString=".MDF") returned 4 [0078.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.823] lstrlenW (lpString=".DBF") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.823] lstrlenW (lpString=".DB") returned 3 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".DB") returned 0x0 [0078.823] lstrlenW (lpString=".db") returned 3 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".db") returned 0x0 [0078.823] lstrlenW (lpString=".ndf") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.823] lstrlenW (lpString=".NDF") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.823] lstrlenW (lpString=".Mdf") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.823] lstrlenW (lpString=".dat") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".dat") returned 0x0 [0078.823] lstrlenW (lpString=".DAT") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.823] lstrlenW (lpString=".ldf") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.823] lstrlenW (lpString=".LDF") returned 4 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.823] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.824] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.824] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.824] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.824] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19882562100) returned 1 [0078.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdcace10, dwHighDateTime=0x1d585b4)) [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc198 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc198 | out: hHeap=0x260000) returned 1 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0e20 [0078.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0e20 | out: hHeap=0x260000) returned 1 [0078.825] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.825] GetLastError () returned 0x0 [0078.826] GetLastError () returned 0x0 [0078.826] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.826] GetLastError () returned 0x0 [0078.826] GetLastError () returned 0x0 [0078.836] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.836] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0078.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.836] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.836] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.837] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.837] CloseHandle (hObject=0xe4) returned 1 [0078.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0078.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0078.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.838] GetLastError () returned 0x0 [0078.839] RtlWakeConditionVariable () returned 0x0 [0078.839] GetCurrentThreadId () returned 0x98c [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.839] lstrlenW (lpString=".vhd") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".vhd") returned 0x0 [0078.839] lstrlenW (lpString=".vhdx") returned 5 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".vhdx") returned 0x0 [0078.839] lstrlenW (lpString=".pst") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".pst") returned 0x0 [0078.839] lstrlenW (lpString=".ost") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".ost") returned 0x0 [0078.839] lstrlenW (lpString=".bak") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".bak") returned 0x0 [0078.839] lstrlenW (lpString=".bac") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".bac") returned 0x0 [0078.839] lstrlenW (lpString=".sys") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".sys") returned 0x0 [0078.839] lstrlenW (lpString=".v2i") returned 4 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".v2i") returned 0x0 [0078.839] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0078.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.840] lstrlenW (lpString=".sql") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".sql") returned 0x0 [0078.841] lstrlenW (lpString=".mdf") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".mdf") returned 0x0 [0078.841] lstrlenW (lpString=".txt") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".txt") returned 0x0 [0078.841] lstrlenW (lpString=".dbf") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".dbf") returned 0x0 [0078.841] lstrlenW (lpString=".ckp") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".ckp") returned 0x0 [0078.841] lstrlenW (lpString=".dacpac") returned 7 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".dacpac") returned 0x0 [0078.841] lstrlenW (lpString=".db3") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".db3") returned 0x0 [0078.841] lstrlenW (lpString=".dtxs") returned 5 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".dtxs") returned 0x0 [0078.841] lstrlenW (lpString=".mdt") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".mdt") returned 0x0 [0078.841] lstrlenW (lpString=".sdf") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".sdf") returned 0x0 [0078.841] lstrlenW (lpString=".MDF") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".MDF") returned 0x0 [0078.841] lstrlenW (lpString=".DBF") returned 4 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".DBF") returned 0x0 [0078.841] lstrlenW (lpString=".DB") returned 3 [0078.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".DB") returned 0x0 [0078.841] lstrlenW (lpString=".db") returned 3 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".db") returned 0x0 [0078.842] lstrlenW (lpString=".ndf") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".ndf") returned 0x0 [0078.842] lstrlenW (lpString=".NDF") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".NDF") returned 0x0 [0078.842] lstrlenW (lpString=".Mdf") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".Mdf") returned 0x0 [0078.842] lstrlenW (lpString=".dat") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".dat") returned 0x0 [0078.842] lstrlenW (lpString=".DAT") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".DAT") returned 0x0 [0078.842] lstrlenW (lpString=".ldf") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.842] lstrlenW (lpString=".LDF") returned 4 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch=".LDF") returned 0x0 [0078.842] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.842] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.843] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.843] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.843] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19884458477) returned 1 [0078.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdcf90d0, dwHighDateTime=0x1d585b4)) [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5668 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5668 | out: hHeap=0x260000) returned 1 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.858] GetLastError () returned 0x0 [0078.858] GetLastError () returned 0x0 [0078.858] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.858] GetLastError () returned 0x0 [0078.858] GetLastError () returned 0x0 [0078.859] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.859] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xcd, lpOverlapped=0x0) returned 1 [0078.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.860] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.860] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.860] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.860] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.860] CloseHandle (hObject=0xe4) returned 1 [0078.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.860] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0078.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.862] GetLastError () returned 0x0 [0078.862] RtlWakeConditionVariable () returned 0x27e828 [0078.862] GetCurrentThreadId () returned 0x98c [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.863] lstrlenW (lpString=".vhd") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.863] lstrlenW (lpString=".vhdx") returned 5 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.863] lstrlenW (lpString=".pst") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".pst") returned 0x0 [0078.863] lstrlenW (lpString=".ost") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".ost") returned 0x0 [0078.863] lstrlenW (lpString=".bak") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".bak") returned 0x0 [0078.863] lstrlenW (lpString=".bac") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".bac") returned 0x0 [0078.863] lstrlenW (lpString=".sys") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".sys") returned 0x0 [0078.863] lstrlenW (lpString=".v2i") returned 4 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.863] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.865] lstrlenW (lpString=".sql") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".sql") returned 0x0 [0078.865] lstrlenW (lpString=".mdf") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.865] lstrlenW (lpString=".txt") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".txt") returned 0x0 [0078.865] lstrlenW (lpString=".dbf") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.865] lstrlenW (lpString=".ckp") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.865] lstrlenW (lpString=".dacpac") returned 7 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.865] lstrlenW (lpString=".db3") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".db3") returned 0x0 [0078.865] lstrlenW (lpString=".dtxs") returned 5 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.865] lstrlenW (lpString=".mdt") returned 4 [0078.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.865] lstrlenW (lpString=".sdf") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.866] lstrlenW (lpString=".MDF") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.866] lstrlenW (lpString=".DBF") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.866] lstrlenW (lpString=".DB") returned 3 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".DB") returned 0x0 [0078.866] lstrlenW (lpString=".db") returned 3 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".db") returned 0x0 [0078.866] lstrlenW (lpString=".ndf") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.866] lstrlenW (lpString=".NDF") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.866] lstrlenW (lpString=".Mdf") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.866] lstrlenW (lpString=".dat") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".dat") returned 0x0 [0078.866] lstrlenW (lpString=".DAT") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.866] lstrlenW (lpString=".ldf") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.866] lstrlenW (lpString=".LDF") returned 4 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.866] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.867] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.867] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.867] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.868] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19886879608) returned 1 [0078.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdd1f230, dwHighDateTime=0x1d585b4)) [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761488 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761488 | out: hHeap=0x260000) returned 1 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0078.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.868] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.869] GetLastError () returned 0x0 [0078.869] GetLastError () returned 0x0 [0078.869] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.869] GetLastError () returned 0x0 [0078.869] GetLastError () returned 0x0 [0078.889] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.889] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0078.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.889] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.889] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.890] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.890] CloseHandle (hObject=0xe4) returned 1 [0078.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.891] GetLastError () returned 0x0 [0078.891] RtlWakeConditionVariable () returned 0x0 [0078.891] GetCurrentThreadId () returned 0x98c [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.892] lstrlenW (lpString=".vhd") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".vhd") returned 0x0 [0078.892] lstrlenW (lpString=".vhdx") returned 5 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".vhdx") returned 0x0 [0078.892] lstrlenW (lpString=".pst") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".pst") returned 0x0 [0078.892] lstrlenW (lpString=".ost") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".ost") returned 0x0 [0078.892] lstrlenW (lpString=".bak") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".bak") returned 0x0 [0078.892] lstrlenW (lpString=".bac") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".bac") returned 0x0 [0078.892] lstrlenW (lpString=".sys") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".sys") returned 0x0 [0078.892] lstrlenW (lpString=".v2i") returned 4 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".v2i") returned 0x0 [0078.892] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0078.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.893] lstrlenW (lpString=".sql") returned 4 [0078.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".sql") returned 0x0 [0078.893] lstrlenW (lpString=".mdf") returned 4 [0078.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".mdf") returned 0x0 [0078.893] lstrlenW (lpString=".txt") returned 4 [0078.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".txt") returned 0x0 [0078.893] lstrlenW (lpString=".dbf") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".dbf") returned 0x0 [0078.894] lstrlenW (lpString=".ckp") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".ckp") returned 0x0 [0078.894] lstrlenW (lpString=".dacpac") returned 7 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".dacpac") returned 0x0 [0078.894] lstrlenW (lpString=".db3") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".db3") returned 0x0 [0078.894] lstrlenW (lpString=".dtxs") returned 5 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".dtxs") returned 0x0 [0078.894] lstrlenW (lpString=".mdt") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".mdt") returned 0x0 [0078.894] lstrlenW (lpString=".sdf") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".sdf") returned 0x0 [0078.894] lstrlenW (lpString=".MDF") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".MDF") returned 0x0 [0078.894] lstrlenW (lpString=".DBF") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".DBF") returned 0x0 [0078.894] lstrlenW (lpString=".DB") returned 3 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".DB") returned 0x0 [0078.894] lstrlenW (lpString=".db") returned 3 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".db") returned 0x0 [0078.894] lstrlenW (lpString=".ndf") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".ndf") returned 0x0 [0078.894] lstrlenW (lpString=".NDF") returned 4 [0078.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".NDF") returned 0x0 [0078.894] lstrlenW (lpString=".Mdf") returned 4 [0078.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".Mdf") returned 0x0 [0078.895] lstrlenW (lpString=".dat") returned 4 [0078.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".dat") returned 0x0 [0078.895] lstrlenW (lpString=".DAT") returned 4 [0078.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".DAT") returned 0x0 [0078.895] lstrlenW (lpString=".ldf") returned 4 [0078.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.895] lstrlenW (lpString=".LDF") returned 4 [0078.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch=".LDF") returned 0x0 [0078.895] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.895] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.896] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.896] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19889712653) returned 1 [0078.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdd6b4f0, dwHighDateTime=0x1d585b4)) [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27613e0 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27613e0 | out: hHeap=0x260000) returned 1 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e6f0 [0078.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.897] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.897] GetLastError () returned 0x0 [0078.897] GetLastError () returned 0x0 [0078.897] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.897] GetLastError () returned 0x0 [0078.897] GetLastError () returned 0x0 [0078.899] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.899] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x281, lpOverlapped=0x0) returned 1 [0078.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.899] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.899] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.900] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.900] CloseHandle (hObject=0xe4) returned 1 [0078.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0078.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.901] GetLastError () returned 0x0 [0078.901] RtlWakeConditionVariable () returned 0x0 [0078.901] GetCurrentThreadId () returned 0x98c [0078.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.901] lstrlenW (lpString=".vhd") returned 4 [0078.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".vhd") returned 0x0 [0078.901] lstrlenW (lpString=".vhdx") returned 5 [0078.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".vhdx") returned 0x0 [0078.901] lstrlenW (lpString=".pst") returned 4 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".pst") returned 0x0 [0078.902] lstrlenW (lpString=".ost") returned 4 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".ost") returned 0x0 [0078.902] lstrlenW (lpString=".bak") returned 4 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".bak") returned 0x0 [0078.902] lstrlenW (lpString=".bac") returned 4 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".bac") returned 0x0 [0078.902] lstrlenW (lpString=".sys") returned 4 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".sys") returned 0x0 [0078.902] lstrlenW (lpString=".v2i") returned 4 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".v2i") returned 0x0 [0078.902] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0078.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.903] lstrlenW (lpString=".sql") returned 4 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".sql") returned 0x0 [0078.903] lstrlenW (lpString=".mdf") returned 4 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".mdf") returned 0x0 [0078.903] lstrlenW (lpString=".txt") returned 4 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".txt") returned 0x0 [0078.903] lstrlenW (lpString=".dbf") returned 4 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".dbf") returned 0x0 [0078.903] lstrlenW (lpString=".ckp") returned 4 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".ckp") returned 0x0 [0078.903] lstrlenW (lpString=".dacpac") returned 7 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".dacpac") returned 0x0 [0078.903] lstrlenW (lpString=".db3") returned 4 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".db3") returned 0x0 [0078.903] lstrlenW (lpString=".dtxs") returned 5 [0078.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".dtxs") returned 0x0 [0078.904] lstrlenW (lpString=".mdt") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".mdt") returned 0x0 [0078.904] lstrlenW (lpString=".sdf") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".sdf") returned 0x0 [0078.904] lstrlenW (lpString=".MDF") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".MDF") returned 0x0 [0078.904] lstrlenW (lpString=".DBF") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".DBF") returned 0x0 [0078.904] lstrlenW (lpString=".DB") returned 3 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".DB") returned 0x0 [0078.904] lstrlenW (lpString=".db") returned 3 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".db") returned 0x0 [0078.904] lstrlenW (lpString=".ndf") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".ndf") returned 0x0 [0078.904] lstrlenW (lpString=".NDF") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".NDF") returned 0x0 [0078.904] lstrlenW (lpString=".Mdf") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".Mdf") returned 0x0 [0078.904] lstrlenW (lpString=".dat") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".dat") returned 0x0 [0078.904] lstrlenW (lpString=".DAT") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".DAT") returned 0x0 [0078.904] lstrlenW (lpString=".ldf") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.904] lstrlenW (lpString=".LDF") returned 4 [0078.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch=".LDF") returned 0x0 [0078.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.905] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.906] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.906] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19890732959) returned 1 [0078.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdd91650, dwHighDateTime=0x1d585b4)) [0078.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27613a8 [0078.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27613a8 | out: hHeap=0x260000) returned 1 [0078.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e528 [0078.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.907] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.907] GetLastError () returned 0x0 [0078.907] GetLastError () returned 0x0 [0078.907] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.907] GetLastError () returned 0x0 [0078.908] GetLastError () returned 0x0 [0078.908] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.909] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd1, lpOverlapped=0x0) returned 1 [0078.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.909] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.909] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.909] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.909] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.909] CloseHandle (hObject=0xe4) returned 1 [0078.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0078.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.911] GetLastError () returned 0x0 [0078.911] RtlWakeConditionVariable () returned 0x27e828 [0078.911] GetCurrentThreadId () returned 0x98c [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.911] lstrlenW (lpString=".vhd") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.911] lstrlenW (lpString=".vhdx") returned 5 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.911] lstrlenW (lpString=".pst") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".pst") returned 0x0 [0078.911] lstrlenW (lpString=".ost") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".ost") returned 0x0 [0078.911] lstrlenW (lpString=".bak") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".bak") returned 0x0 [0078.911] lstrlenW (lpString=".bac") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".bac") returned 0x0 [0078.911] lstrlenW (lpString=".sys") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".sys") returned 0x0 [0078.911] lstrlenW (lpString=".v2i") returned 4 [0078.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.912] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.913] lstrlenW (lpString=".sql") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".sql") returned 0x0 [0078.913] lstrlenW (lpString=".mdf") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.913] lstrlenW (lpString=".txt") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".txt") returned 0x0 [0078.913] lstrlenW (lpString=".dbf") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.913] lstrlenW (lpString=".ckp") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.913] lstrlenW (lpString=".dacpac") returned 7 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.913] lstrlenW (lpString=".db3") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".db3") returned 0x0 [0078.913] lstrlenW (lpString=".dtxs") returned 5 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.913] lstrlenW (lpString=".mdt") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.913] lstrlenW (lpString=".sdf") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.913] lstrlenW (lpString=".MDF") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.913] lstrlenW (lpString=".DBF") returned 4 [0078.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.913] lstrlenW (lpString=".DB") returned 3 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".DB") returned 0x0 [0078.914] lstrlenW (lpString=".db") returned 3 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".db") returned 0x0 [0078.914] lstrlenW (lpString=".ndf") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.914] lstrlenW (lpString=".NDF") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.914] lstrlenW (lpString=".Mdf") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.914] lstrlenW (lpString=".dat") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".dat") returned 0x0 [0078.914] lstrlenW (lpString=".DAT") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.914] lstrlenW (lpString=".ldf") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.914] lstrlenW (lpString=".LDF") returned 4 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.914] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.914] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.915] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.915] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.915] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19891639776) returned 1 [0078.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdd91650, dwHighDateTime=0x1d585b4)) [0078.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761370 [0078.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761370 | out: hHeap=0x260000) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e490 [0078.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.916] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.916] GetLastError () returned 0x0 [0078.916] GetLastError () returned 0x0 [0078.916] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.916] GetLastError () returned 0x0 [0078.917] GetLastError () returned 0x0 [0078.918] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.918] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0078.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.918] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.918] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.918] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.918] CloseHandle (hObject=0xe4) returned 1 [0078.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.920] GetLastError () returned 0x0 [0078.920] RtlWakeConditionVariable () returned 0x27e828 [0078.920] GetCurrentThreadId () returned 0x98c [0078.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.920] lstrlenW (lpString=".vhd") returned 4 [0078.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.920] lstrlenW (lpString=".vhdx") returned 5 [0078.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.920] lstrlenW (lpString=".pst") returned 4 [0078.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".pst") returned 0x0 [0078.920] lstrlenW (lpString=".ost") returned 4 [0078.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".ost") returned 0x0 [0078.921] lstrlenW (lpString=".bak") returned 4 [0078.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".bak") returned 0x0 [0078.921] lstrlenW (lpString=".bac") returned 4 [0078.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".bac") returned 0x0 [0078.921] lstrlenW (lpString=".sys") returned 4 [0078.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".sys") returned 0x0 [0078.921] lstrlenW (lpString=".v2i") returned 4 [0078.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.921] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.922] lstrlenW (lpString=".sql") returned 4 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".sql") returned 0x0 [0078.922] lstrlenW (lpString=".mdf") returned 4 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.922] lstrlenW (lpString=".txt") returned 4 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".txt") returned 0x0 [0078.922] lstrlenW (lpString=".dbf") returned 4 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.922] lstrlenW (lpString=".ckp") returned 4 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.922] lstrlenW (lpString=".dacpac") returned 7 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.922] lstrlenW (lpString=".db3") returned 4 [0078.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".db3") returned 0x0 [0078.923] lstrlenW (lpString=".dtxs") returned 5 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.923] lstrlenW (lpString=".mdt") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.923] lstrlenW (lpString=".sdf") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.923] lstrlenW (lpString=".MDF") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.923] lstrlenW (lpString=".DBF") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.923] lstrlenW (lpString=".DB") returned 3 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".DB") returned 0x0 [0078.923] lstrlenW (lpString=".db") returned 3 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".db") returned 0x0 [0078.923] lstrlenW (lpString=".ndf") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.923] lstrlenW (lpString=".NDF") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.923] lstrlenW (lpString=".Mdf") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.923] lstrlenW (lpString=".dat") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".dat") returned 0x0 [0078.923] lstrlenW (lpString=".DAT") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.923] lstrlenW (lpString=".ldf") returned 4 [0078.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.924] lstrlenW (lpString=".LDF") returned 4 [0078.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.924] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.924] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.925] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.925] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.925] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19892587716) returned 1 [0078.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbddb77b0, dwHighDateTime=0x1d585b4)) [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761338 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761338 | out: hHeap=0x260000) returned 1 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e3f8 [0078.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.926] GetLastError () returned 0x0 [0078.926] GetLastError () returned 0x0 [0078.926] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.926] GetLastError () returned 0x0 [0078.926] GetLastError () returned 0x0 [0078.927] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.927] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0078.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.928] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.928] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.928] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.928] CloseHandle (hObject=0xe4) returned 1 [0078.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.932] GetLastError () returned 0x0 [0078.932] RtlWakeConditionVariable () returned 0x0 [0078.932] GetCurrentThreadId () returned 0x98c [0078.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".ldf") returned 0x0 [0078.932] lstrlenW (lpString=".vhd") returned 4 [0078.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".vhd") returned 0x0 [0078.932] lstrlenW (lpString=".vhdx") returned 5 [0078.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".vhdx") returned 0x0 [0078.933] lstrlenW (lpString=".pst") returned 4 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".pst") returned 0x0 [0078.933] lstrlenW (lpString=".ost") returned 4 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".ost") returned 0x0 [0078.933] lstrlenW (lpString=".bak") returned 4 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".bak") returned 0x0 [0078.933] lstrlenW (lpString=".bac") returned 4 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".bac") returned 0x0 [0078.933] lstrlenW (lpString=".sys") returned 4 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".sys") returned 0x0 [0078.933] lstrlenW (lpString=".v2i") returned 4 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".v2i") returned 0x0 [0078.933] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0078.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.934] lstrlenW (lpString=".sql") returned 4 [0078.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".sql") returned 0x0 [0078.934] lstrlenW (lpString=".mdf") returned 4 [0078.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".mdf") returned 0x0 [0078.934] lstrlenW (lpString=".txt") returned 4 [0078.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".txt") returned 0x0 [0078.935] lstrlenW (lpString=".dbf") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".dbf") returned 0x0 [0078.935] lstrlenW (lpString=".ckp") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".ckp") returned 0x0 [0078.935] lstrlenW (lpString=".dacpac") returned 7 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".dacpac") returned 0x0 [0078.935] lstrlenW (lpString=".db3") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".db3") returned 0x0 [0078.935] lstrlenW (lpString=".dtxs") returned 5 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".dtxs") returned 0x0 [0078.935] lstrlenW (lpString=".mdt") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".mdt") returned 0x0 [0078.935] lstrlenW (lpString=".sdf") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".sdf") returned 0x0 [0078.935] lstrlenW (lpString=".MDF") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".MDF") returned 0x0 [0078.935] lstrlenW (lpString=".DBF") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".DBF") returned 0x0 [0078.935] lstrlenW (lpString=".DB") returned 3 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".DB") returned 0x0 [0078.935] lstrlenW (lpString=".db") returned 3 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".db") returned 0x0 [0078.935] lstrlenW (lpString=".ndf") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".ndf") returned 0x0 [0078.935] lstrlenW (lpString=".NDF") returned 4 [0078.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".NDF") returned 0x0 [0078.936] lstrlenW (lpString=".Mdf") returned 4 [0078.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".Mdf") returned 0x0 [0078.936] lstrlenW (lpString=".dat") returned 4 [0078.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".dat") returned 0x0 [0078.936] lstrlenW (lpString=".DAT") returned 4 [0078.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".DAT") returned 0x0 [0078.936] lstrlenW (lpString=".ldf") returned 4 [0078.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".ldf") returned 0x0 [0078.936] lstrlenW (lpString=".LDF") returned 4 [0078.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch=".LDF") returned 0x0 [0078.936] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.936] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.937] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.937] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.937] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19893838184) returned 1 [0078.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdddd910, dwHighDateTime=0x1d585b4)) [0078.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761300 [0078.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761300 | out: hHeap=0x260000) returned 1 [0078.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d9e0 [0078.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.938] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.938] GetLastError () returned 0x0 [0078.938] GetLastError () returned 0x0 [0078.938] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.938] GetLastError () returned 0x0 [0078.939] GetLastError () returned 0x0 [0078.941] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.942] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.943] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.943] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.945] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.945] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.945] CloseHandle (hObject=0xe4) returned 1 [0078.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.[deadmin@cock.li].deadmin")) returned 1 [0078.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.947] GetLastError () returned 0x0 [0078.947] RtlWakeConditionVariable () returned 0x0 [0078.947] GetCurrentThreadId () returned 0x98c [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.947] lstrlenW (lpString=".vhd") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".vhd") returned 0x0 [0078.947] lstrlenW (lpString=".vhdx") returned 5 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".vhdx") returned 0x0 [0078.947] lstrlenW (lpString=".pst") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".pst") returned 0x0 [0078.947] lstrlenW (lpString=".ost") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".ost") returned 0x0 [0078.947] lstrlenW (lpString=".bak") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".bak") returned 0x0 [0078.947] lstrlenW (lpString=".bac") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".bac") returned 0x0 [0078.947] lstrlenW (lpString=".sys") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".sys") returned 0x0 [0078.947] lstrlenW (lpString=".v2i") returned 4 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".v2i") returned 0x0 [0078.947] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0078.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.949] lstrlenW (lpString=".sql") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".sql") returned 0x0 [0078.949] lstrlenW (lpString=".mdf") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".mdf") returned 0x0 [0078.949] lstrlenW (lpString=".txt") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".txt") returned 0x0 [0078.949] lstrlenW (lpString=".dbf") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".dbf") returned 0x0 [0078.949] lstrlenW (lpString=".ckp") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".ckp") returned 0x0 [0078.949] lstrlenW (lpString=".dacpac") returned 7 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".dacpac") returned 0x0 [0078.949] lstrlenW (lpString=".db3") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".db3") returned 0x0 [0078.949] lstrlenW (lpString=".dtxs") returned 5 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".dtxs") returned 0x0 [0078.949] lstrlenW (lpString=".mdt") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".mdt") returned 0x0 [0078.949] lstrlenW (lpString=".sdf") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".sdf") returned 0x0 [0078.949] lstrlenW (lpString=".MDF") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".MDF") returned 0x0 [0078.949] lstrlenW (lpString=".DBF") returned 4 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".DBF") returned 0x0 [0078.949] lstrlenW (lpString=".DB") returned 3 [0078.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".DB") returned 0x0 [0078.950] lstrlenW (lpString=".db") returned 3 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".db") returned 0x0 [0078.950] lstrlenW (lpString=".ndf") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".ndf") returned 0x0 [0078.950] lstrlenW (lpString=".NDF") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".NDF") returned 0x0 [0078.950] lstrlenW (lpString=".Mdf") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".Mdf") returned 0x0 [0078.950] lstrlenW (lpString=".dat") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".dat") returned 0x0 [0078.950] lstrlenW (lpString=".DAT") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".DAT") returned 0x0 [0078.950] lstrlenW (lpString=".ldf") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.950] lstrlenW (lpString=".LDF") returned 4 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch=".LDF") returned 0x0 [0078.950] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.950] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.951] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.951] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.951] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19895239607) returned 1 [0078.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbdddd910, dwHighDateTime=0x1d585b4)) [0078.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27612c8 [0078.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27612c8 | out: hHeap=0x260000) returned 1 [0078.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e2c8 [0078.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.952] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.952] GetLastError () returned 0x0 [0078.952] GetLastError () returned 0x0 [0078.952] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.953] GetLastError () returned 0x0 [0078.953] GetLastError () returned 0x0 [0078.954] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.954] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x281, lpOverlapped=0x0) returned 1 [0078.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.954] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.955] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.955] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.955] CloseHandle (hObject=0xe4) returned 1 [0078.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0078.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.956] GetLastError () returned 0x0 [0078.956] RtlWakeConditionVariable () returned 0x0 [0078.956] GetCurrentThreadId () returned 0x98c [0078.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.956] lstrlenW (lpString=".vhd") returned 4 [0078.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".vhd") returned 0x0 [0078.956] lstrlenW (lpString=".vhdx") returned 5 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".vhdx") returned 0x0 [0078.957] lstrlenW (lpString=".pst") returned 4 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".pst") returned 0x0 [0078.957] lstrlenW (lpString=".ost") returned 4 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".ost") returned 0x0 [0078.957] lstrlenW (lpString=".bak") returned 4 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".bak") returned 0x0 [0078.957] lstrlenW (lpString=".bac") returned 4 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".bac") returned 0x0 [0078.957] lstrlenW (lpString=".sys") returned 4 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".sys") returned 0x0 [0078.957] lstrlenW (lpString=".v2i") returned 4 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".v2i") returned 0x0 [0078.957] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0078.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.958] lstrlenW (lpString=".sql") returned 4 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".sql") returned 0x0 [0078.958] lstrlenW (lpString=".mdf") returned 4 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".mdf") returned 0x0 [0078.958] lstrlenW (lpString=".txt") returned 4 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".txt") returned 0x0 [0078.958] lstrlenW (lpString=".dbf") returned 4 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".dbf") returned 0x0 [0078.958] lstrlenW (lpString=".ckp") returned 4 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".ckp") returned 0x0 [0078.958] lstrlenW (lpString=".dacpac") returned 7 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".dacpac") returned 0x0 [0078.958] lstrlenW (lpString=".db3") returned 4 [0078.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".db3") returned 0x0 [0078.959] lstrlenW (lpString=".dtxs") returned 5 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".dtxs") returned 0x0 [0078.959] lstrlenW (lpString=".mdt") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".mdt") returned 0x0 [0078.959] lstrlenW (lpString=".sdf") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".sdf") returned 0x0 [0078.959] lstrlenW (lpString=".MDF") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".MDF") returned 0x0 [0078.959] lstrlenW (lpString=".DBF") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".DBF") returned 0x0 [0078.959] lstrlenW (lpString=".DB") returned 3 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".DB") returned 0x0 [0078.959] lstrlenW (lpString=".db") returned 3 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".db") returned 0x0 [0078.959] lstrlenW (lpString=".ndf") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".ndf") returned 0x0 [0078.959] lstrlenW (lpString=".NDF") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".NDF") returned 0x0 [0078.959] lstrlenW (lpString=".Mdf") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".Mdf") returned 0x0 [0078.959] lstrlenW (lpString=".dat") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".dat") returned 0x0 [0078.959] lstrlenW (lpString=".DAT") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".DAT") returned 0x0 [0078.959] lstrlenW (lpString=".ldf") returned 4 [0078.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.960] lstrlenW (lpString=".LDF") returned 4 [0078.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch=".LDF") returned 0x0 [0078.960] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.960] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.961] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.961] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.961] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19896185774) returned 1 [0078.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbde03a70, dwHighDateTime=0x1d585b4)) [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761290 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761290 | out: hHeap=0x260000) returned 1 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e230 [0078.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.961] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.962] GetLastError () returned 0x0 [0078.962] GetLastError () returned 0x0 [0078.962] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.962] GetLastError () returned 0x0 [0078.962] GetLastError () returned 0x0 [0078.963] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.963] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd1, lpOverlapped=0x0) returned 1 [0078.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.964] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.964] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.964] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.964] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.964] CloseHandle (hObject=0xe4) returned 1 [0078.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0078.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.965] GetLastError () returned 0x0 [0078.966] RtlWakeConditionVariable () returned 0x0 [0078.966] GetCurrentThreadId () returned 0x98c [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.966] lstrlenW (lpString=".vhd") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.966] lstrlenW (lpString=".vhdx") returned 5 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.966] lstrlenW (lpString=".pst") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".pst") returned 0x0 [0078.966] lstrlenW (lpString=".ost") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".ost") returned 0x0 [0078.966] lstrlenW (lpString=".bak") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".bak") returned 0x0 [0078.966] lstrlenW (lpString=".bac") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".bac") returned 0x0 [0078.966] lstrlenW (lpString=".sys") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".sys") returned 0x0 [0078.966] lstrlenW (lpString=".v2i") returned 4 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.966] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.968] lstrlenW (lpString=".sql") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".sql") returned 0x0 [0078.968] lstrlenW (lpString=".mdf") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.968] lstrlenW (lpString=".txt") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".txt") returned 0x0 [0078.968] lstrlenW (lpString=".dbf") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.968] lstrlenW (lpString=".ckp") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.968] lstrlenW (lpString=".dacpac") returned 7 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.968] lstrlenW (lpString=".db3") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".db3") returned 0x0 [0078.968] lstrlenW (lpString=".dtxs") returned 5 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.968] lstrlenW (lpString=".mdt") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.968] lstrlenW (lpString=".sdf") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.968] lstrlenW (lpString=".MDF") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.968] lstrlenW (lpString=".DBF") returned 4 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.968] lstrlenW (lpString=".DB") returned 3 [0078.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".DB") returned 0x0 [0078.969] lstrlenW (lpString=".db") returned 3 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".db") returned 0x0 [0078.969] lstrlenW (lpString=".ndf") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.969] lstrlenW (lpString=".NDF") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.969] lstrlenW (lpString=".Mdf") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.969] lstrlenW (lpString=".dat") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".dat") returned 0x0 [0078.969] lstrlenW (lpString=".DAT") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.969] lstrlenW (lpString=".ldf") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.969] lstrlenW (lpString=".LDF") returned 4 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.969] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.969] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.970] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.970] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19897138395) returned 1 [0078.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbde29bd0, dwHighDateTime=0x1d585b4)) [0078.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761258 [0078.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761258 | out: hHeap=0x260000) returned 1 [0078.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e198 [0078.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.971] GetLastError () returned 0x0 [0078.971] GetLastError () returned 0x0 [0078.971] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.971] GetLastError () returned 0x0 [0078.972] GetLastError () returned 0x0 [0078.973] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.973] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0078.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.973] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.973] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.973] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.973] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.973] CloseHandle (hObject=0xe4) returned 1 [0078.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.973] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.975] GetLastError () returned 0x0 [0078.975] RtlWakeConditionVariable () returned 0x27e828 [0078.975] GetCurrentThreadId () returned 0x98c [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.975] lstrlenW (lpString=".vhd") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.975] lstrlenW (lpString=".vhdx") returned 5 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.975] lstrlenW (lpString=".pst") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".pst") returned 0x0 [0078.975] lstrlenW (lpString=".ost") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".ost") returned 0x0 [0078.975] lstrlenW (lpString=".bak") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".bak") returned 0x0 [0078.975] lstrlenW (lpString=".bac") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".bac") returned 0x0 [0078.975] lstrlenW (lpString=".sys") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".sys") returned 0x0 [0078.975] lstrlenW (lpString=".v2i") returned 4 [0078.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.976] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.976] lstrlenW (lpString=".sql") returned 4 [0078.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".sql") returned 0x0 [0078.977] lstrlenW (lpString=".mdf") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.977] lstrlenW (lpString=".txt") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".txt") returned 0x0 [0078.977] lstrlenW (lpString=".dbf") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.977] lstrlenW (lpString=".ckp") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.977] lstrlenW (lpString=".dacpac") returned 7 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.977] lstrlenW (lpString=".db3") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".db3") returned 0x0 [0078.977] lstrlenW (lpString=".dtxs") returned 5 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.977] lstrlenW (lpString=".mdt") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.977] lstrlenW (lpString=".sdf") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.977] lstrlenW (lpString=".MDF") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.977] lstrlenW (lpString=".DBF") returned 4 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.977] lstrlenW (lpString=".DB") returned 3 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".DB") returned 0x0 [0078.977] lstrlenW (lpString=".db") returned 3 [0078.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".db") returned 0x0 [0078.978] lstrlenW (lpString=".ndf") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.978] lstrlenW (lpString=".NDF") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.978] lstrlenW (lpString=".Mdf") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.978] lstrlenW (lpString=".dat") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".dat") returned 0x0 [0078.978] lstrlenW (lpString=".DAT") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.978] lstrlenW (lpString=".ldf") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.978] lstrlenW (lpString=".LDF") returned 4 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.978] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.978] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.979] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.979] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.979] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19898031477) returned 1 [0078.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbde29bd0, dwHighDateTime=0x1d585b4)) [0078.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761220 [0078.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761220 | out: hHeap=0x260000) returned 1 [0078.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e100 [0078.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.980] GetLastError () returned 0x0 [0078.980] GetLastError () returned 0x0 [0078.980] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.980] GetLastError () returned 0x0 [0078.981] GetLastError () returned 0x0 [0078.982] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.982] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0078.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.982] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.982] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.982] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.982] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.982] CloseHandle (hObject=0xe4) returned 1 [0078.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.984] GetLastError () returned 0x0 [0078.984] RtlWakeConditionVariable () returned 0x27e828 [0078.984] GetCurrentThreadId () returned 0x98c [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".ldf") returned 0x0 [0078.984] lstrlenW (lpString=".vhd") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".vhd") returned 0x0 [0078.984] lstrlenW (lpString=".vhdx") returned 5 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".vhdx") returned 0x0 [0078.984] lstrlenW (lpString=".pst") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".pst") returned 0x0 [0078.984] lstrlenW (lpString=".ost") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".ost") returned 0x0 [0078.984] lstrlenW (lpString=".bak") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".bak") returned 0x0 [0078.984] lstrlenW (lpString=".bac") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".bac") returned 0x0 [0078.984] lstrlenW (lpString=".sys") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".sys") returned 0x0 [0078.984] lstrlenW (lpString=".v2i") returned 4 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".v2i") returned 0x0 [0078.984] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.985] lstrlenW (lpString=".sql") returned 4 [0078.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".sql") returned 0x0 [0078.985] lstrlenW (lpString=".mdf") returned 4 [0078.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".mdf") returned 0x0 [0078.986] lstrlenW (lpString=".txt") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".txt") returned 0x0 [0078.986] lstrlenW (lpString=".dbf") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".dbf") returned 0x0 [0078.986] lstrlenW (lpString=".ckp") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".ckp") returned 0x0 [0078.986] lstrlenW (lpString=".dacpac") returned 7 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".dacpac") returned 0x0 [0078.986] lstrlenW (lpString=".db3") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".db3") returned 0x0 [0078.986] lstrlenW (lpString=".dtxs") returned 5 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".dtxs") returned 0x0 [0078.986] lstrlenW (lpString=".mdt") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".mdt") returned 0x0 [0078.986] lstrlenW (lpString=".sdf") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".sdf") returned 0x0 [0078.986] lstrlenW (lpString=".MDF") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".MDF") returned 0x0 [0078.986] lstrlenW (lpString=".DBF") returned 4 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".DBF") returned 0x0 [0078.986] lstrlenW (lpString=".DB") returned 3 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".DB") returned 0x0 [0078.986] lstrlenW (lpString=".db") returned 3 [0078.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".db") returned 0x0 [0078.986] lstrlenW (lpString=".ndf") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".ndf") returned 0x0 [0078.987] lstrlenW (lpString=".NDF") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".NDF") returned 0x0 [0078.987] lstrlenW (lpString=".Mdf") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".Mdf") returned 0x0 [0078.987] lstrlenW (lpString=".dat") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".dat") returned 0x0 [0078.987] lstrlenW (lpString=".DAT") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".DAT") returned 0x0 [0078.987] lstrlenW (lpString=".ldf") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".ldf") returned 0x0 [0078.987] lstrlenW (lpString=".LDF") returned 4 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch=".LDF") returned 0x0 [0078.987] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.987] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0078.988] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.988] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.988] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19898925035) returned 1 [0078.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbde4fd30, dwHighDateTime=0x1d585b4)) [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27611e8 [0078.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27611e8 | out: hHeap=0x260000) returned 1 [0078.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d6e8 [0078.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.989] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0078.989] GetLastError () returned 0x0 [0078.989] GetLastError () returned 0x0 [0078.989] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0078.989] GetLastError () returned 0x0 [0078.989] GetLastError () returned 0x0 [0078.991] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff3a90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.992] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc570, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xc570, lpOverlapped=0x0) returned 1 [0078.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.992] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.992] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.992] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.992] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.992] CloseHandle (hObject=0xe4) returned 1 [0078.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0078.993] GetLastError () returned 0x0 [0078.994] RtlWakeConditionVariable () returned 0x0 [0078.994] GetCurrentThreadId () returned 0x98c [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".ldf") returned 0x0 [0078.994] lstrlenW (lpString=".vhd") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".vhd") returned 0x0 [0078.994] lstrlenW (lpString=".vhdx") returned 5 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".vhdx") returned 0x0 [0078.994] lstrlenW (lpString=".pst") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".pst") returned 0x0 [0078.994] lstrlenW (lpString=".ost") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".ost") returned 0x0 [0078.994] lstrlenW (lpString=".bak") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".bak") returned 0x0 [0078.994] lstrlenW (lpString=".bac") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".bac") returned 0x0 [0078.994] lstrlenW (lpString=".sys") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".sys") returned 0x0 [0078.994] lstrlenW (lpString=".v2i") returned 4 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".v2i") returned 0x0 [0078.994] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0078.995] lstrlenW (lpString=".sql") returned 4 [0078.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".sql") returned 0x0 [0078.995] lstrlenW (lpString=".mdf") returned 4 [0078.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".mdf") returned 0x0 [0078.995] lstrlenW (lpString=".txt") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".txt") returned 0x0 [0078.996] lstrlenW (lpString=".dbf") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".dbf") returned 0x0 [0078.996] lstrlenW (lpString=".ckp") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".ckp") returned 0x0 [0078.996] lstrlenW (lpString=".dacpac") returned 7 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".dacpac") returned 0x0 [0078.996] lstrlenW (lpString=".db3") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".db3") returned 0x0 [0078.996] lstrlenW (lpString=".dtxs") returned 5 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".dtxs") returned 0x0 [0078.996] lstrlenW (lpString=".mdt") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".mdt") returned 0x0 [0078.996] lstrlenW (lpString=".sdf") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".sdf") returned 0x0 [0078.996] lstrlenW (lpString=".MDF") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".MDF") returned 0x0 [0078.996] lstrlenW (lpString=".DBF") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".DBF") returned 0x0 [0078.996] lstrlenW (lpString=".DB") returned 3 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".DB") returned 0x0 [0078.996] lstrlenW (lpString=".db") returned 3 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".db") returned 0x0 [0078.996] lstrlenW (lpString=".ndf") returned 4 [0078.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".ndf") returned 0x0 [0078.996] lstrlenW (lpString=".NDF") returned 4 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".NDF") returned 0x0 [0078.997] lstrlenW (lpString=".Mdf") returned 4 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".Mdf") returned 0x0 [0078.997] lstrlenW (lpString=".dat") returned 4 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".dat") returned 0x0 [0078.997] lstrlenW (lpString=".DAT") returned 4 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".DAT") returned 0x0 [0078.997] lstrlenW (lpString=".ldf") returned 4 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".ldf") returned 0x0 [0078.997] lstrlenW (lpString=".LDF") returned 4 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch=".LDF") returned 0x0 [0078.997] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0078.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.997] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756fc8) returned 1 [0078.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.998] CryptReleaseContext (hProv=0x2756fc8, dwFlags=0x0) returned 1 [0078.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0078.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0078.998] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19899923935) returned 1 [0078.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbde4fd30, dwHighDateTime=0x1d585b4)) [0078.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0078.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0078.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27611b0 [0079.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27611b0 | out: hHeap=0x260000) returned 1 [0079.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3680 [0079.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.109] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.109] GetLastError () returned 0x0 [0079.110] GetLastError () returned 0x0 [0079.110] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.110] GetLastError () returned 0x0 [0079.110] GetLastError () returned 0x0 [0079.153] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffef478, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.153] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10b88, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x10b88, lpOverlapped=0x0) returned 1 [0079.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.185] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.185] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.188] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.188] CloseHandle (hObject=0xe4) returned 1 [0079.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.[deadmin@cock.li].deadmin")) returned 1 [0079.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.189] GetLastError () returned 0x0 [0079.189] RtlWakeConditionVariable () returned 0x27e828 [0079.189] GetCurrentThreadId () returned 0x98c [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".ldf") returned 0x0 [0079.190] lstrlenW (lpString=".vhd") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".vhd") returned 0x0 [0079.190] lstrlenW (lpString=".vhdx") returned 5 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".vhdx") returned 0x0 [0079.190] lstrlenW (lpString=".pst") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".pst") returned 0x0 [0079.190] lstrlenW (lpString=".ost") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".ost") returned 0x0 [0079.190] lstrlenW (lpString=".bak") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".bak") returned 0x0 [0079.190] lstrlenW (lpString=".bac") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".bac") returned 0x0 [0079.190] lstrlenW (lpString=".sys") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".sys") returned 0x0 [0079.190] lstrlenW (lpString=".v2i") returned 4 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".v2i") returned 0x0 [0079.190] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch="s\r\n.v2i") returned 0x0 [0079.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0079.194] lstrlenW (lpString=".sql") returned 4 [0079.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".sql") returned 0x0 [0079.194] lstrlenW (lpString=".mdf") returned 4 [0079.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".mdf") returned 0x0 [0079.195] lstrlenW (lpString=".txt") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".txt") returned 0x0 [0079.195] lstrlenW (lpString=".dbf") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".dbf") returned 0x0 [0079.195] lstrlenW (lpString=".ckp") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".ckp") returned 0x0 [0079.195] lstrlenW (lpString=".dacpac") returned 7 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".dacpac") returned 0x0 [0079.195] lstrlenW (lpString=".db3") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".db3") returned 0x0 [0079.195] lstrlenW (lpString=".dtxs") returned 5 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".dtxs") returned 0x0 [0079.195] lstrlenW (lpString=".mdt") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".mdt") returned 0x0 [0079.195] lstrlenW (lpString=".sdf") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".sdf") returned 0x0 [0079.195] lstrlenW (lpString=".MDF") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".MDF") returned 0x0 [0079.195] lstrlenW (lpString=".DBF") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".DBF") returned 0x0 [0079.195] lstrlenW (lpString=".DB") returned 3 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".DB") returned 0x0 [0079.195] lstrlenW (lpString=".db") returned 3 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".db") returned 0x0 [0079.195] lstrlenW (lpString=".ndf") returned 4 [0079.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".ndf") returned 0x0 [0079.196] lstrlenW (lpString=".NDF") returned 4 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".NDF") returned 0x0 [0079.196] lstrlenW (lpString=".Mdf") returned 4 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".Mdf") returned 0x0 [0079.196] lstrlenW (lpString=".dat") returned 4 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".dat") returned 0x0 [0079.196] lstrlenW (lpString=".DAT") returned 4 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".DAT") returned 0x0 [0079.196] lstrlenW (lpString=".ldf") returned 4 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".ldf") returned 0x0 [0079.196] lstrlenW (lpString=".LDF") returned 4 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch=".LDF") returned 0x0 [0079.196] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0079.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.196] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0079.197] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.197] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0079.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.197] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19919822879) returned 1 [0079.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe03ef10, dwHighDateTime=0x1d585b4)) [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27610d0 [0079.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27610d0 | out: hHeap=0x260000) returned 1 [0079.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dfd0 [0079.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.198] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.198] GetLastError () returned 0x0 [0079.198] GetLastError () returned 0x0 [0079.198] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.198] GetLastError () returned 0x0 [0079.198] GetLastError () returned 0x0 [0079.200] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff86c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.200] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x794, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x794, lpOverlapped=0x0) returned 1 [0079.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.200] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.200] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.200] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.200] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.201] CloseHandle (hObject=0xe4) returned 1 [0079.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.[deadmin@cock.li].deadmin")) returned 1 [0079.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.202] GetLastError () returned 0x0 [0079.202] RtlWakeConditionVariable () returned 0x0 [0079.202] GetCurrentThreadId () returned 0x98c [0079.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".ldf") returned 0x0 [0079.202] lstrlenW (lpString=".vhd") returned 4 [0079.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".vhd") returned 0x0 [0079.202] lstrlenW (lpString=".vhdx") returned 5 [0079.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".vhdx") returned 0x0 [0079.202] lstrlenW (lpString=".pst") returned 4 [0079.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".pst") returned 0x0 [0079.202] lstrlenW (lpString=".ost") returned 4 [0079.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".ost") returned 0x0 [0079.203] lstrlenW (lpString=".bak") returned 4 [0079.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".bak") returned 0x0 [0079.203] lstrlenW (lpString=".bac") returned 4 [0079.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".bac") returned 0x0 [0079.203] lstrlenW (lpString=".sys") returned 4 [0079.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".sys") returned 0x0 [0079.203] lstrlenW (lpString=".v2i") returned 4 [0079.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".v2i") returned 0x0 [0079.203] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch="s\r\n.v2i") returned 0x0 [0079.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0079.204] lstrlenW (lpString=".sql") returned 4 [0079.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".sql") returned 0x0 [0079.204] lstrlenW (lpString=".mdf") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".mdf") returned 0x0 [0079.205] lstrlenW (lpString=".txt") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".txt") returned 0x0 [0079.205] lstrlenW (lpString=".dbf") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".dbf") returned 0x0 [0079.205] lstrlenW (lpString=".ckp") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".ckp") returned 0x0 [0079.205] lstrlenW (lpString=".dacpac") returned 7 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".dacpac") returned 0x0 [0079.205] lstrlenW (lpString=".db3") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".db3") returned 0x0 [0079.205] lstrlenW (lpString=".dtxs") returned 5 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".dtxs") returned 0x0 [0079.205] lstrlenW (lpString=".mdt") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".mdt") returned 0x0 [0079.205] lstrlenW (lpString=".sdf") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".sdf") returned 0x0 [0079.205] lstrlenW (lpString=".MDF") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".MDF") returned 0x0 [0079.205] lstrlenW (lpString=".DBF") returned 4 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".DBF") returned 0x0 [0079.205] lstrlenW (lpString=".DB") returned 3 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".DB") returned 0x0 [0079.205] lstrlenW (lpString=".db") returned 3 [0079.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".db") returned 0x0 [0079.205] lstrlenW (lpString=".ndf") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".ndf") returned 0x0 [0079.206] lstrlenW (lpString=".NDF") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".NDF") returned 0x0 [0079.206] lstrlenW (lpString=".Mdf") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".Mdf") returned 0x0 [0079.206] lstrlenW (lpString=".dat") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".dat") returned 0x0 [0079.206] lstrlenW (lpString=".DAT") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".DAT") returned 0x0 [0079.206] lstrlenW (lpString=".ldf") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".ldf") returned 0x0 [0079.206] lstrlenW (lpString=".LDF") returned 4 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch=".LDF") returned 0x0 [0079.206] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0079.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.206] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0079.207] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.207] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0079.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.207] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19920827733) returned 1 [0079.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe065070, dwHighDateTime=0x1d585b4)) [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761098 [0079.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761098 | out: hHeap=0x260000) returned 1 [0079.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dea0 [0079.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.208] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.208] GetLastError () returned 0x0 [0079.208] GetLastError () returned 0x0 [0079.208] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.208] GetLastError () returned 0x0 [0079.208] GetLastError () returned 0x0 [0079.210] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffa87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.210] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x579, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x579, lpOverlapped=0x0) returned 1 [0079.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.210] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.210] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.211] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.211] CloseHandle (hObject=0xe4) returned 1 [0079.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.[deadmin@cock.li].deadmin")) returned 1 [0079.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.212] GetLastError () returned 0x0 [0079.212] RtlWakeConditionVariable () returned 0x0 [0079.212] GetCurrentThreadId () returned 0x98c [0079.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".ldf") returned 0x0 [0079.212] lstrlenW (lpString=".vhd") returned 4 [0079.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".vhd") returned 0x0 [0079.212] lstrlenW (lpString=".vhdx") returned 5 [0079.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".vhdx") returned 0x0 [0079.213] lstrlenW (lpString=".pst") returned 4 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".pst") returned 0x0 [0079.213] lstrlenW (lpString=".ost") returned 4 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".ost") returned 0x0 [0079.213] lstrlenW (lpString=".bak") returned 4 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".bak") returned 0x0 [0079.213] lstrlenW (lpString=".bac") returned 4 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".bac") returned 0x0 [0079.213] lstrlenW (lpString=".sys") returned 4 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".sys") returned 0x0 [0079.213] lstrlenW (lpString=".v2i") returned 4 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".v2i") returned 0x0 [0079.213] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch="s\r\n.v2i") returned 0x0 [0079.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0079.214] lstrlenW (lpString=".sql") returned 4 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".sql") returned 0x0 [0079.214] lstrlenW (lpString=".mdf") returned 4 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".mdf") returned 0x0 [0079.214] lstrlenW (lpString=".txt") returned 4 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".txt") returned 0x0 [0079.214] lstrlenW (lpString=".dbf") returned 4 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".dbf") returned 0x0 [0079.214] lstrlenW (lpString=".ckp") returned 4 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".ckp") returned 0x0 [0079.214] lstrlenW (lpString=".dacpac") returned 7 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".dacpac") returned 0x0 [0079.214] lstrlenW (lpString=".db3") returned 4 [0079.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".db3") returned 0x0 [0079.215] lstrlenW (lpString=".dtxs") returned 5 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".dtxs") returned 0x0 [0079.215] lstrlenW (lpString=".mdt") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".mdt") returned 0x0 [0079.215] lstrlenW (lpString=".sdf") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".sdf") returned 0x0 [0079.215] lstrlenW (lpString=".MDF") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".MDF") returned 0x0 [0079.215] lstrlenW (lpString=".DBF") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".DBF") returned 0x0 [0079.215] lstrlenW (lpString=".DB") returned 3 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".DB") returned 0x0 [0079.215] lstrlenW (lpString=".db") returned 3 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".db") returned 0x0 [0079.215] lstrlenW (lpString=".ndf") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".ndf") returned 0x0 [0079.215] lstrlenW (lpString=".NDF") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".NDF") returned 0x0 [0079.215] lstrlenW (lpString=".Mdf") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".Mdf") returned 0x0 [0079.215] lstrlenW (lpString=".dat") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".dat") returned 0x0 [0079.215] lstrlenW (lpString=".DAT") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".DAT") returned 0x0 [0079.215] lstrlenW (lpString=".ldf") returned 4 [0079.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".ldf") returned 0x0 [0079.216] lstrlenW (lpString=".LDF") returned 4 [0079.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch=".LDF") returned 0x0 [0079.216] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0079.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.216] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27570d8) returned 1 [0079.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.217] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0079.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0079.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.545] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19954638275) returned 1 [0079.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe3aaeb0, dwHighDateTime=0x1d585b4)) [0079.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cfe8 [0079.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cfe8 | out: hHeap=0x260000) returned 1 [0079.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d8b0 [0079.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.546] GetLastError () returned 0x0 [0079.547] GetLastError () returned 0x0 [0079.547] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.547] GetLastError () returned 0x0 [0079.547] GetLastError () returned 0x0 [0079.549] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff8de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.550] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x722, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x722, lpOverlapped=0x0) returned 1 [0079.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.579] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.579] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.587] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.587] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.587] CloseHandle (hObject=0xe4) returned 1 [0079.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.601] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.[deadmin@cock.li].deadmin")) returned 1 [0079.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.603] GetLastError () returned 0x0 [0079.603] RtlWakeConditionVariable () returned 0x27e828 [0079.603] GetCurrentThreadId () returned 0x98c [0079.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.603] lstrlenW (lpString=".vhd") returned 4 [0079.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".vhd") returned 0x0 [0079.603] lstrlenW (lpString=".vhdx") returned 5 [0079.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".vhdx") returned 0x0 [0079.603] lstrlenW (lpString=".pst") returned 4 [0079.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".pst") returned 0x0 [0079.603] lstrlenW (lpString=".ost") returned 4 [0079.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".ost") returned 0x0 [0079.604] lstrlenW (lpString=".bak") returned 4 [0079.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".bak") returned 0x0 [0079.604] lstrlenW (lpString=".bac") returned 4 [0079.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".bac") returned 0x0 [0079.604] lstrlenW (lpString=".sys") returned 4 [0079.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".sys") returned 0x0 [0079.604] lstrlenW (lpString=".v2i") returned 4 [0079.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".v2i") returned 0x0 [0079.604] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0079.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0079.605] lstrlenW (lpString=".sql") returned 4 [0079.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".sql") returned 0x0 [0079.606] lstrlenW (lpString=".mdf") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".mdf") returned 0x0 [0079.606] lstrlenW (lpString=".txt") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".txt") returned 0x0 [0079.606] lstrlenW (lpString=".dbf") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".dbf") returned 0x0 [0079.606] lstrlenW (lpString=".ckp") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".ckp") returned 0x0 [0079.606] lstrlenW (lpString=".dacpac") returned 7 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".dacpac") returned 0x0 [0079.606] lstrlenW (lpString=".db3") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".db3") returned 0x0 [0079.606] lstrlenW (lpString=".dtxs") returned 5 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".dtxs") returned 0x0 [0079.606] lstrlenW (lpString=".mdt") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".mdt") returned 0x0 [0079.606] lstrlenW (lpString=".sdf") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".sdf") returned 0x0 [0079.606] lstrlenW (lpString=".MDF") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".MDF") returned 0x0 [0079.606] lstrlenW (lpString=".DBF") returned 4 [0079.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".DBF") returned 0x0 [0079.607] lstrlenW (lpString=".DB") returned 3 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".DB") returned 0x0 [0079.607] lstrlenW (lpString=".db") returned 3 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".db") returned 0x0 [0079.607] lstrlenW (lpString=".ndf") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".ndf") returned 0x0 [0079.607] lstrlenW (lpString=".NDF") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".NDF") returned 0x0 [0079.607] lstrlenW (lpString=".Mdf") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".Mdf") returned 0x0 [0079.607] lstrlenW (lpString=".dat") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".dat") returned 0x0 [0079.607] lstrlenW (lpString=".DAT") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".DAT") returned 0x0 [0079.607] lstrlenW (lpString=".ldf") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.607] lstrlenW (lpString=".LDF") returned 4 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch=".LDF") returned 0x0 [0079.607] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0079.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.608] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756f40) returned 1 [0079.609] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.609] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.609] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19961003332) returned 1 [0079.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe443430, dwHighDateTime=0x1d585b4)) [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cf40 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cf40 | out: hHeap=0x260000) returned 1 [0079.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dd70 [0079.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.610] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.610] GetLastError () returned 0x0 [0079.610] GetLastError () returned 0x0 [0079.610] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.611] GetLastError () returned 0x0 [0079.611] GetLastError () returned 0x0 [0079.612] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.612] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xcf, lpOverlapped=0x0) returned 1 [0079.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.612] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.613] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.613] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.613] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.613] CloseHandle (hObject=0xe4) returned 1 [0079.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0079.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.616] GetLastError () returned 0x0 [0079.616] RtlWakeConditionVariable () returned 0x0 [0079.616] GetCurrentThreadId () returned 0x98c [0079.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.616] lstrlenW (lpString=".vhd") returned 4 [0079.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.616] lstrlenW (lpString=".vhdx") returned 5 [0079.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.616] lstrlenW (lpString=".pst") returned 4 [0079.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".pst") returned 0x0 [0079.616] lstrlenW (lpString=".ost") returned 4 [0079.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".ost") returned 0x0 [0079.616] lstrlenW (lpString=".bak") returned 4 [0079.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".bak") returned 0x0 [0079.616] lstrlenW (lpString=".bac") returned 4 [0079.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".bac") returned 0x0 [0079.617] lstrlenW (lpString=".sys") returned 4 [0079.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".sys") returned 0x0 [0079.617] lstrlenW (lpString=".v2i") returned 4 [0079.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.617] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0079.618] lstrlenW (lpString=".sql") returned 4 [0079.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".sql") returned 0x0 [0079.618] lstrlenW (lpString=".mdf") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.619] lstrlenW (lpString=".txt") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".txt") returned 0x0 [0079.619] lstrlenW (lpString=".dbf") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.619] lstrlenW (lpString=".ckp") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.619] lstrlenW (lpString=".dacpac") returned 7 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.619] lstrlenW (lpString=".db3") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".db3") returned 0x0 [0079.619] lstrlenW (lpString=".dtxs") returned 5 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.619] lstrlenW (lpString=".mdt") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.619] lstrlenW (lpString=".sdf") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.619] lstrlenW (lpString=".MDF") returned 4 [0079.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.619] lstrlenW (lpString=".DBF") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.620] lstrlenW (lpString=".DB") returned 3 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".DB") returned 0x0 [0079.620] lstrlenW (lpString=".db") returned 3 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".db") returned 0x0 [0079.620] lstrlenW (lpString=".ndf") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.620] lstrlenW (lpString=".NDF") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.620] lstrlenW (lpString=".Mdf") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.620] lstrlenW (lpString=".dat") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".dat") returned 0x0 [0079.620] lstrlenW (lpString=".DAT") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.620] lstrlenW (lpString=".ldf") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.620] lstrlenW (lpString=".LDF") returned 4 [0079.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.620] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0079.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.621] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756f40) returned 1 [0079.622] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.622] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0079.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.622] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19962310699) returned 1 [0079.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe443430, dwHighDateTime=0x1d585b4)) [0079.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cf08 [0079.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cf08 | out: hHeap=0x260000) returned 1 [0079.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d520 [0079.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.623] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.623] GetLastError () returned 0x0 [0079.624] GetLastError () returned 0x0 [0079.624] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.624] GetLastError () returned 0x0 [0079.624] GetLastError () returned 0x0 [0079.625] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.625] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x72, lpOverlapped=0x0) returned 1 [0079.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.626] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.626] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.626] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.626] CloseHandle (hObject=0xe4) returned 1 [0079.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.629] GetLastError () returned 0x0 [0079.629] RtlWakeConditionVariable () returned 0x27e828 [0079.629] GetCurrentThreadId () returned 0x98c [0079.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.629] lstrlenW (lpString=".vhd") returned 4 [0079.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.629] lstrlenW (lpString=".vhdx") returned 5 [0079.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.629] lstrlenW (lpString=".pst") returned 4 [0079.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".pst") returned 0x0 [0079.629] lstrlenW (lpString=".ost") returned 4 [0079.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".ost") returned 0x0 [0079.629] lstrlenW (lpString=".bak") returned 4 [0079.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".bak") returned 0x0 [0079.630] lstrlenW (lpString=".bac") returned 4 [0079.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".bac") returned 0x0 [0079.630] lstrlenW (lpString=".sys") returned 4 [0079.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".sys") returned 0x0 [0079.630] lstrlenW (lpString=".v2i") returned 4 [0079.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.630] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0079.631] lstrlenW (lpString=".sql") returned 4 [0079.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".sql") returned 0x0 [0079.632] lstrlenW (lpString=".mdf") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.632] lstrlenW (lpString=".txt") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".txt") returned 0x0 [0079.632] lstrlenW (lpString=".dbf") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.632] lstrlenW (lpString=".ckp") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.632] lstrlenW (lpString=".dacpac") returned 7 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.632] lstrlenW (lpString=".db3") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".db3") returned 0x0 [0079.632] lstrlenW (lpString=".dtxs") returned 5 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.632] lstrlenW (lpString=".mdt") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.632] lstrlenW (lpString=".sdf") returned 4 [0079.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.632] lstrlenW (lpString=".MDF") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.633] lstrlenW (lpString=".DBF") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.633] lstrlenW (lpString=".DB") returned 3 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".DB") returned 0x0 [0079.633] lstrlenW (lpString=".db") returned 3 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".db") returned 0x0 [0079.633] lstrlenW (lpString=".ndf") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.633] lstrlenW (lpString=".NDF") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.633] lstrlenW (lpString=".Mdf") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.633] lstrlenW (lpString=".dat") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".dat") returned 0x0 [0079.633] lstrlenW (lpString=".DAT") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.633] lstrlenW (lpString=".ldf") returned 4 [0079.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.633] lstrlenW (lpString=".LDF") returned 4 [0079.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.634] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0079.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.634] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756f40) returned 1 [0079.635] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.635] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.635] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=19963618472) returned 1 [0079.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe469590, dwHighDateTime=0x1d585b4)) [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ced0 [0079.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ced0 | out: hHeap=0x260000) returned 1 [0079.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d488 [0079.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.636] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0079.636] GetLastError () returned 0x0 [0079.636] GetLastError () returned 0x0 [0079.637] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0079.637] GetLastError () returned 0x0 [0079.637] GetLastError () returned 0x0 [0079.891] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.891] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x71, lpOverlapped=0x0) returned 1 [0079.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.894] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.894] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.894] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.130] CloseHandle (hObject=0xe4) returned 1 [0080.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0080.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.140] GetLastError () returned 0x0 [0080.140] RtlWakeConditionVariable () returned 0x0 [0080.140] GetCurrentThreadId () returned 0x98c [0080.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".ldf") returned 0x0 [0080.141] lstrlenW (lpString=".vhd") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".vhd") returned 0x0 [0080.141] lstrlenW (lpString=".vhdx") returned 5 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".vhdx") returned 0x0 [0080.141] lstrlenW (lpString=".pst") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".pst") returned 0x0 [0080.141] lstrlenW (lpString=".ost") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".ost") returned 0x0 [0080.141] lstrlenW (lpString=".bak") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".bak") returned 0x0 [0080.141] lstrlenW (lpString=".bac") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".bac") returned 0x0 [0080.141] lstrlenW (lpString=".sys") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".sys") returned 0x0 [0080.141] lstrlenW (lpString=".v2i") returned 4 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".v2i") returned 0x0 [0080.141] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.143] lstrlenW (lpString=".sql") returned 4 [0080.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".sql") returned 0x0 [0080.143] lstrlenW (lpString=".mdf") returned 4 [0080.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".mdf") returned 0x0 [0080.143] lstrlenW (lpString=".txt") returned 4 [0080.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".txt") returned 0x0 [0080.144] lstrlenW (lpString=".dbf") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".dbf") returned 0x0 [0080.144] lstrlenW (lpString=".ckp") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".ckp") returned 0x0 [0080.144] lstrlenW (lpString=".dacpac") returned 7 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".dacpac") returned 0x0 [0080.144] lstrlenW (lpString=".db3") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".db3") returned 0x0 [0080.144] lstrlenW (lpString=".dtxs") returned 5 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".dtxs") returned 0x0 [0080.144] lstrlenW (lpString=".mdt") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".mdt") returned 0x0 [0080.144] lstrlenW (lpString=".sdf") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".sdf") returned 0x0 [0080.144] lstrlenW (lpString=".MDF") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".MDF") returned 0x0 [0080.144] lstrlenW (lpString=".DBF") returned 4 [0080.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".DBF") returned 0x0 [0080.145] lstrlenW (lpString=".DB") returned 3 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".DB") returned 0x0 [0080.145] lstrlenW (lpString=".db") returned 3 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".db") returned 0x0 [0080.145] lstrlenW (lpString=".ndf") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".ndf") returned 0x0 [0080.145] lstrlenW (lpString=".NDF") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".NDF") returned 0x0 [0080.145] lstrlenW (lpString=".Mdf") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".Mdf") returned 0x0 [0080.145] lstrlenW (lpString=".dat") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".dat") returned 0x0 [0080.145] lstrlenW (lpString=".DAT") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".DAT") returned 0x0 [0080.145] lstrlenW (lpString=".ldf") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".ldf") returned 0x0 [0080.145] lstrlenW (lpString=".LDF") returned 4 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch=".LDF") returned 0x0 [0080.145] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.146] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2756f40) returned 1 [0080.147] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.147] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0080.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.147] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20014805328) returned 1 [0080.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe9522f0, dwHighDateTime=0x1d585b4)) [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761760 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761760 | out: hHeap=0x260000) returned 1 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1408 [0080.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e5c0 [0080.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.148] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.148] GetLastError () returned 0x0 [0080.148] GetLastError () returned 0x0 [0080.148] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.148] GetLastError () returned 0x0 [0080.148] GetLastError () returned 0x0 [0080.151] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.151] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.153] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.153] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.155] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.155] CloseHandle (hObject=0xe4) returned 1 [0080.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348e80 [0080.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348e80 | out: hHeap=0x260000) returned 1 [0080.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.157] GetLastError () returned 0x0 [0080.158] RtlWakeConditionVariable () returned 0x0 [0080.158] GetCurrentThreadId () returned 0x98c [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".ldf") returned 0x0 [0080.158] lstrlenW (lpString=".vhd") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".vhd") returned 0x0 [0080.158] lstrlenW (lpString=".vhdx") returned 5 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".vhdx") returned 0x0 [0080.158] lstrlenW (lpString=".pst") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".pst") returned 0x0 [0080.158] lstrlenW (lpString=".ost") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".ost") returned 0x0 [0080.158] lstrlenW (lpString=".bak") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".bak") returned 0x0 [0080.158] lstrlenW (lpString=".bac") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".bac") returned 0x0 [0080.158] lstrlenW (lpString=".sys") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".sys") returned 0x0 [0080.158] lstrlenW (lpString=".v2i") returned 4 [0080.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".v2i") returned 0x0 [0080.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch="s\r\n.v2i") returned 0x0 [0080.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.160] lstrlenW (lpString=".sql") returned 4 [0080.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".sql") returned 0x0 [0080.160] lstrlenW (lpString=".mdf") returned 4 [0080.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".mdf") returned 0x0 [0080.160] lstrlenW (lpString=".txt") returned 4 [0080.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".txt") returned 0x0 [0080.160] lstrlenW (lpString=".dbf") returned 4 [0080.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".dbf") returned 0x0 [0080.160] lstrlenW (lpString=".ckp") returned 4 [0080.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".ckp") returned 0x0 [0080.160] lstrlenW (lpString=".dacpac") returned 7 [0080.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".dacpac") returned 0x0 [0080.160] lstrlenW (lpString=".db3") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".db3") returned 0x0 [0080.161] lstrlenW (lpString=".dtxs") returned 5 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".dtxs") returned 0x0 [0080.161] lstrlenW (lpString=".mdt") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".mdt") returned 0x0 [0080.161] lstrlenW (lpString=".sdf") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".sdf") returned 0x0 [0080.161] lstrlenW (lpString=".MDF") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".MDF") returned 0x0 [0080.161] lstrlenW (lpString=".DBF") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".DBF") returned 0x0 [0080.161] lstrlenW (lpString=".DB") returned 3 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".DB") returned 0x0 [0080.161] lstrlenW (lpString=".db") returned 3 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".db") returned 0x0 [0080.161] lstrlenW (lpString=".ndf") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".ndf") returned 0x0 [0080.161] lstrlenW (lpString=".NDF") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".NDF") returned 0x0 [0080.161] lstrlenW (lpString=".Mdf") returned 4 [0080.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".Mdf") returned 0x0 [0080.162] lstrlenW (lpString=".dat") returned 4 [0080.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".dat") returned 0x0 [0080.162] lstrlenW (lpString=".DAT") returned 4 [0080.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".DAT") returned 0x0 [0080.162] lstrlenW (lpString=".ldf") returned 4 [0080.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".ldf") returned 0x0 [0080.162] lstrlenW (lpString=".LDF") returned 4 [0080.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch=".LDF") returned 0x0 [0080.162] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.162] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27577c0) returned 1 [0080.163] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.163] CryptReleaseContext (hProv=0x27577c0, dwFlags=0x0) returned 1 [0080.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.163] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20016440816) returned 1 [0080.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe978450, dwHighDateTime=0x1d585b4)) [0080.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761728 [0080.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761728 | out: hHeap=0x260000) returned 1 [0080.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1408 [0080.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d3f0 [0080.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.164] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.164] GetLastError () returned 0x0 [0080.165] GetLastError () returned 0x0 [0080.165] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.165] GetLastError () returned 0x0 [0080.165] GetLastError () returned 0x0 [0080.169] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffb31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.169] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x4cf, lpOverlapped=0x0) returned 1 [0080.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.169] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.169] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.169] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.169] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.170] CloseHandle (hObject=0xe4) returned 1 [0080.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.170] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.[deadmin@cock.li].deadmin")) returned 1 [0080.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.172] GetLastError () returned 0x0 [0080.172] RtlWakeConditionVariable () returned 0x0 [0080.172] GetCurrentThreadId () returned 0x98c [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".ldf") returned 0x0 [0080.173] lstrlenW (lpString=".vhd") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".vhd") returned 0x0 [0080.173] lstrlenW (lpString=".vhdx") returned 5 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".vhdx") returned 0x0 [0080.173] lstrlenW (lpString=".pst") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".pst") returned 0x0 [0080.173] lstrlenW (lpString=".ost") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".ost") returned 0x0 [0080.173] lstrlenW (lpString=".bak") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".bak") returned 0x0 [0080.173] lstrlenW (lpString=".bac") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".bac") returned 0x0 [0080.173] lstrlenW (lpString=".sys") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".sys") returned 0x0 [0080.173] lstrlenW (lpString=".v2i") returned 4 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".v2i") returned 0x0 [0080.173] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0080.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.175] lstrlenW (lpString=".sql") returned 4 [0080.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".sql") returned 0x0 [0080.175] lstrlenW (lpString=".mdf") returned 4 [0080.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".mdf") returned 0x0 [0080.175] lstrlenW (lpString=".txt") returned 4 [0080.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".txt") returned 0x0 [0080.175] lstrlenW (lpString=".dbf") returned 4 [0080.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".dbf") returned 0x0 [0080.175] lstrlenW (lpString=".ckp") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".ckp") returned 0x0 [0080.176] lstrlenW (lpString=".dacpac") returned 7 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".dacpac") returned 0x0 [0080.176] lstrlenW (lpString=".db3") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".db3") returned 0x0 [0080.176] lstrlenW (lpString=".dtxs") returned 5 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".dtxs") returned 0x0 [0080.176] lstrlenW (lpString=".mdt") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".mdt") returned 0x0 [0080.176] lstrlenW (lpString=".sdf") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".sdf") returned 0x0 [0080.176] lstrlenW (lpString=".MDF") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".MDF") returned 0x0 [0080.176] lstrlenW (lpString=".DBF") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".DBF") returned 0x0 [0080.176] lstrlenW (lpString=".DB") returned 3 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".DB") returned 0x0 [0080.176] lstrlenW (lpString=".db") returned 3 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".db") returned 0x0 [0080.176] lstrlenW (lpString=".ndf") returned 4 [0080.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".ndf") returned 0x0 [0080.177] lstrlenW (lpString=".NDF") returned 4 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".NDF") returned 0x0 [0080.177] lstrlenW (lpString=".Mdf") returned 4 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".Mdf") returned 0x0 [0080.177] lstrlenW (lpString=".dat") returned 4 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".dat") returned 0x0 [0080.177] lstrlenW (lpString=".DAT") returned 4 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".DAT") returned 0x0 [0080.177] lstrlenW (lpString=".ldf") returned 4 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".ldf") returned 0x0 [0080.177] lstrlenW (lpString=".LDF") returned 4 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch=".LDF") returned 0x0 [0080.177] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.177] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27577c0) returned 1 [0080.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.178] CryptReleaseContext (hProv=0x27577c0, dwFlags=0x0) returned 1 [0080.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.179] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20017974215) returned 1 [0080.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbe99e5b0, dwHighDateTime=0x1d585b4)) [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27616f0 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27616f0 | out: hHeap=0x260000) returned 1 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1408 [0080.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0080.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.180] GetLastError () returned 0x0 [0080.180] GetLastError () returned 0x0 [0080.180] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.180] GetLastError () returned 0x0 [0080.180] GetLastError () returned 0x0 [0080.235] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffefb35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.249] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x104cb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x104cb, lpOverlapped=0x0) returned 1 [0080.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.262] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.263] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.263] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.263] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.263] CloseHandle (hObject=0xe4) returned 1 [0080.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.[deadmin@cock.li].deadmin")) returned 1 [0080.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.265] GetLastError () returned 0x0 [0080.265] RtlWakeConditionVariable () returned 0x0 [0080.265] GetCurrentThreadId () returned 0x98c [0080.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".ldf") returned 0x0 [0080.265] lstrlenW (lpString=".vhd") returned 4 [0080.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".vhd") returned 0x0 [0080.265] lstrlenW (lpString=".vhdx") returned 5 [0080.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".vhdx") returned 0x0 [0080.265] lstrlenW (lpString=".pst") returned 4 [0080.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".pst") returned 0x0 [0080.265] lstrlenW (lpString=".ost") returned 4 [0080.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".ost") returned 0x0 [0080.265] lstrlenW (lpString=".bak") returned 4 [0080.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".bak") returned 0x0 [0080.266] lstrlenW (lpString=".bac") returned 4 [0080.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".bac") returned 0x0 [0080.266] lstrlenW (lpString=".sys") returned 4 [0080.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".sys") returned 0x0 [0080.266] lstrlenW (lpString=".v2i") returned 4 [0080.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".v2i") returned 0x0 [0080.266] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch="s\r\n.v2i") returned 0x0 [0080.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.267] lstrlenW (lpString=".sql") returned 4 [0080.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".sql") returned 0x0 [0080.267] lstrlenW (lpString=".mdf") returned 4 [0080.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".mdf") returned 0x0 [0080.267] lstrlenW (lpString=".txt") returned 4 [0080.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".txt") returned 0x0 [0080.267] lstrlenW (lpString=".dbf") returned 4 [0080.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".dbf") returned 0x0 [0080.267] lstrlenW (lpString=".ckp") returned 4 [0080.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".ckp") returned 0x0 [0080.267] lstrlenW (lpString=".dacpac") returned 7 [0080.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".dacpac") returned 0x0 [0080.268] lstrlenW (lpString=".db3") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".db3") returned 0x0 [0080.268] lstrlenW (lpString=".dtxs") returned 5 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".dtxs") returned 0x0 [0080.268] lstrlenW (lpString=".mdt") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".mdt") returned 0x0 [0080.268] lstrlenW (lpString=".sdf") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".sdf") returned 0x0 [0080.268] lstrlenW (lpString=".MDF") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".MDF") returned 0x0 [0080.268] lstrlenW (lpString=".DBF") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".DBF") returned 0x0 [0080.268] lstrlenW (lpString=".DB") returned 3 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".DB") returned 0x0 [0080.268] lstrlenW (lpString=".db") returned 3 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".db") returned 0x0 [0080.268] lstrlenW (lpString=".ndf") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".ndf") returned 0x0 [0080.268] lstrlenW (lpString=".NDF") returned 4 [0080.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".NDF") returned 0x0 [0080.268] lstrlenW (lpString=".Mdf") returned 4 [0080.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".Mdf") returned 0x0 [0080.269] lstrlenW (lpString=".dat") returned 4 [0080.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".dat") returned 0x0 [0080.269] lstrlenW (lpString=".DAT") returned 4 [0080.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".DAT") returned 0x0 [0080.269] lstrlenW (lpString=".ldf") returned 4 [0080.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".ldf") returned 0x0 [0080.269] lstrlenW (lpString=".LDF") returned 4 [0080.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch=".LDF") returned 0x0 [0080.269] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.269] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757380) returned 1 [0080.270] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.270] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0080.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.270] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20027157166) returned 1 [0080.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbea82df0, dwHighDateTime=0x1d585b4)) [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761b50 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761b50 | out: hHeap=0x260000) returned 1 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0080.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.271] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.271] GetLastError () returned 0x0 [0080.272] GetLastError () returned 0x0 [0080.272] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.272] GetLastError () returned 0x0 [0080.272] GetLastError () returned 0x0 [0080.275] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.276] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.277] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.278] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.279] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.279] CloseHandle (hObject=0xe4) returned 1 [0080.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.[deadmin@cock.li].deadmin")) returned 1 [0080.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.281] GetLastError () returned 0x0 [0080.281] RtlWakeConditionVariable () returned 0x0 [0080.281] GetCurrentThreadId () returned 0x98c [0080.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".ldf") returned 0x0 [0080.281] lstrlenW (lpString=".vhd") returned 4 [0080.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".vhd") returned 0x0 [0080.281] lstrlenW (lpString=".vhdx") returned 5 [0080.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".vhdx") returned 0x0 [0080.281] lstrlenW (lpString=".pst") returned 4 [0080.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".pst") returned 0x0 [0080.282] lstrlenW (lpString=".ost") returned 4 [0080.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".ost") returned 0x0 [0080.282] lstrlenW (lpString=".bak") returned 4 [0080.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".bak") returned 0x0 [0080.282] lstrlenW (lpString=".bac") returned 4 [0080.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".bac") returned 0x0 [0080.282] lstrlenW (lpString=".sys") returned 4 [0080.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".sys") returned 0x0 [0080.282] lstrlenW (lpString=".v2i") returned 4 [0080.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".v2i") returned 0x0 [0080.282] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch="s\r\n.v2i") returned 0x0 [0080.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.283] lstrlenW (lpString=".sql") returned 4 [0080.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".sql") returned 0x0 [0080.283] lstrlenW (lpString=".mdf") returned 4 [0080.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".mdf") returned 0x0 [0080.283] lstrlenW (lpString=".txt") returned 4 [0080.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".txt") returned 0x0 [0080.283] lstrlenW (lpString=".dbf") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".dbf") returned 0x0 [0080.284] lstrlenW (lpString=".ckp") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".ckp") returned 0x0 [0080.284] lstrlenW (lpString=".dacpac") returned 7 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".dacpac") returned 0x0 [0080.284] lstrlenW (lpString=".db3") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".db3") returned 0x0 [0080.284] lstrlenW (lpString=".dtxs") returned 5 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".dtxs") returned 0x0 [0080.284] lstrlenW (lpString=".mdt") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".mdt") returned 0x0 [0080.284] lstrlenW (lpString=".sdf") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".sdf") returned 0x0 [0080.284] lstrlenW (lpString=".MDF") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".MDF") returned 0x0 [0080.284] lstrlenW (lpString=".DBF") returned 4 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".DBF") returned 0x0 [0080.284] lstrlenW (lpString=".DB") returned 3 [0080.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".DB") returned 0x0 [0080.284] lstrlenW (lpString=".db") returned 3 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".db") returned 0x0 [0080.285] lstrlenW (lpString=".ndf") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".ndf") returned 0x0 [0080.285] lstrlenW (lpString=".NDF") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".NDF") returned 0x0 [0080.285] lstrlenW (lpString=".Mdf") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".Mdf") returned 0x0 [0080.285] lstrlenW (lpString=".dat") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".dat") returned 0x0 [0080.285] lstrlenW (lpString=".DAT") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".DAT") returned 0x0 [0080.285] lstrlenW (lpString=".ldf") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".ldf") returned 0x0 [0080.285] lstrlenW (lpString=".LDF") returned 4 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch=".LDF") returned 0x0 [0080.285] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.285] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757380) returned 1 [0080.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.286] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0080.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.287] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20028783202) returned 1 [0080.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbeaa8f50, dwHighDateTime=0x1d585b4)) [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761ae0 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761ae0 | out: hHeap=0x260000) returned 1 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.288] GetLastError () returned 0x0 [0080.288] GetLastError () returned 0x0 [0080.288] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.288] GetLastError () returned 0x0 [0080.288] GetLastError () returned 0x0 [0080.292] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.293] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.294] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.294] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.295] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.295] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.295] CloseHandle (hObject=0xe4) returned 1 [0080.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.[deadmin@cock.li].deadmin")) returned 1 [0080.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.297] GetLastError () returned 0x0 [0080.297] RtlWakeConditionVariable () returned 0x0 [0080.297] GetCurrentThreadId () returned 0x98c [0080.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".ldf") returned 0x0 [0080.298] lstrlenW (lpString=".vhd") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".vhd") returned 0x0 [0080.298] lstrlenW (lpString=".vhdx") returned 5 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".vhdx") returned 0x0 [0080.298] lstrlenW (lpString=".pst") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".pst") returned 0x0 [0080.298] lstrlenW (lpString=".ost") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".ost") returned 0x0 [0080.298] lstrlenW (lpString=".bak") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".bak") returned 0x0 [0080.298] lstrlenW (lpString=".bac") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".bac") returned 0x0 [0080.298] lstrlenW (lpString=".sys") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".sys") returned 0x0 [0080.298] lstrlenW (lpString=".v2i") returned 4 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".v2i") returned 0x0 [0080.298] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch="s\r\n.v2i") returned 0x0 [0080.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.418] lstrlenW (lpString=".sql") returned 4 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".sql") returned 0x0 [0080.418] lstrlenW (lpString=".mdf") returned 4 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".mdf") returned 0x0 [0080.418] lstrlenW (lpString=".txt") returned 4 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".txt") returned 0x0 [0080.418] lstrlenW (lpString=".dbf") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".dbf") returned 0x0 [0080.419] lstrlenW (lpString=".ckp") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".ckp") returned 0x0 [0080.419] lstrlenW (lpString=".dacpac") returned 7 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".dacpac") returned 0x0 [0080.419] lstrlenW (lpString=".db3") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".db3") returned 0x0 [0080.419] lstrlenW (lpString=".dtxs") returned 5 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".dtxs") returned 0x0 [0080.419] lstrlenW (lpString=".mdt") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".mdt") returned 0x0 [0080.419] lstrlenW (lpString=".sdf") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".sdf") returned 0x0 [0080.419] lstrlenW (lpString=".MDF") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".MDF") returned 0x0 [0080.419] lstrlenW (lpString=".DBF") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".DBF") returned 0x0 [0080.419] lstrlenW (lpString=".DB") returned 3 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".DB") returned 0x0 [0080.419] lstrlenW (lpString=".db") returned 3 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".db") returned 0x0 [0080.419] lstrlenW (lpString=".ndf") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".ndf") returned 0x0 [0080.419] lstrlenW (lpString=".NDF") returned 4 [0080.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".NDF") returned 0x0 [0080.419] lstrlenW (lpString=".Mdf") returned 4 [0080.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".Mdf") returned 0x0 [0080.420] lstrlenW (lpString=".dat") returned 4 [0080.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".dat") returned 0x0 [0080.420] lstrlenW (lpString=".DAT") returned 4 [0080.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".DAT") returned 0x0 [0080.420] lstrlenW (lpString=".ldf") returned 4 [0080.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".ldf") returned 0x0 [0080.420] lstrlenW (lpString=".LDF") returned 4 [0080.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch=".LDF") returned 0x0 [0080.420] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0080.420] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757b78) returned 1 [0080.421] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0080.421] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.421] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20042213496) returned 1 [0080.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbebffbb0, dwHighDateTime=0x1d585b4)) [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27618e8 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27618e8 | out: hHeap=0x260000) returned 1 [0080.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f8c0 [0080.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.422] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.422] GetLastError () returned 0x0 [0080.422] GetLastError () returned 0x0 [0080.422] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.422] GetLastError () returned 0x0 [0080.422] GetLastError () returned 0x0 [0080.425] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.425] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.426] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.426] WriteFile (in: hFile=0xe8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.427] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.427] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.427] CloseHandle (hObject=0xe8) returned 1 [0080.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.[deadmin@cock.li].deadmin")) returned 1 [0080.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.432] GetLastError () returned 0x0 [0080.432] RtlWakeConditionVariable () returned 0x0 [0080.432] GetCurrentThreadId () returned 0x98c [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".ldf") returned 0x0 [0080.432] lstrlenW (lpString=".vhd") returned 4 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".vhd") returned 0x0 [0080.432] lstrlenW (lpString=".vhdx") returned 5 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".vhdx") returned 0x0 [0080.432] lstrlenW (lpString=".pst") returned 4 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".pst") returned 0x0 [0080.432] lstrlenW (lpString=".ost") returned 4 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".ost") returned 0x0 [0080.432] lstrlenW (lpString=".bak") returned 4 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".bak") returned 0x0 [0080.432] lstrlenW (lpString=".bac") returned 4 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".bac") returned 0x0 [0080.432] lstrlenW (lpString=".sys") returned 4 [0080.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".sys") returned 0x0 [0080.432] lstrlenW (lpString=".v2i") returned 4 [0080.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".v2i") returned 0x0 [0080.433] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch="s\r\n.v2i") returned 0x0 [0080.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.434] lstrlenW (lpString=".sql") returned 4 [0080.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".sql") returned 0x0 [0080.434] lstrlenW (lpString=".mdf") returned 4 [0080.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".mdf") returned 0x0 [0080.434] lstrlenW (lpString=".txt") returned 4 [0080.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".txt") returned 0x0 [0080.435] lstrlenW (lpString=".dbf") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".dbf") returned 0x0 [0080.435] lstrlenW (lpString=".ckp") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".ckp") returned 0x0 [0080.435] lstrlenW (lpString=".dacpac") returned 7 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".dacpac") returned 0x0 [0080.435] lstrlenW (lpString=".db3") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".db3") returned 0x0 [0080.435] lstrlenW (lpString=".dtxs") returned 5 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".dtxs") returned 0x0 [0080.435] lstrlenW (lpString=".mdt") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".mdt") returned 0x0 [0080.435] lstrlenW (lpString=".sdf") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".sdf") returned 0x0 [0080.435] lstrlenW (lpString=".MDF") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".MDF") returned 0x0 [0080.435] lstrlenW (lpString=".DBF") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".DBF") returned 0x0 [0080.435] lstrlenW (lpString=".DB") returned 3 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".DB") returned 0x0 [0080.435] lstrlenW (lpString=".db") returned 3 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".db") returned 0x0 [0080.435] lstrlenW (lpString=".ndf") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".ndf") returned 0x0 [0080.435] lstrlenW (lpString=".NDF") returned 4 [0080.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".NDF") returned 0x0 [0080.436] lstrlenW (lpString=".Mdf") returned 4 [0080.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".Mdf") returned 0x0 [0080.436] lstrlenW (lpString=".dat") returned 4 [0080.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".dat") returned 0x0 [0080.436] lstrlenW (lpString=".DAT") returned 4 [0080.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".DAT") returned 0x0 [0080.436] lstrlenW (lpString=".ldf") returned 4 [0080.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".ldf") returned 0x0 [0080.436] lstrlenW (lpString=".LDF") returned 4 [0080.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch=".LDF") returned 0x0 [0080.436] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.436] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757b78) returned 1 [0080.437] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.437] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.437] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20043822164) returned 1 [0080.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbec25d10, dwHighDateTime=0x1d585b4)) [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27618b0 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27618b0 | out: hHeap=0x260000) returned 1 [0080.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e5c0 [0080.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.438] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.438] GetLastError () returned 0x0 [0080.438] GetLastError () returned 0x0 [0080.438] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.438] GetLastError () returned 0x0 [0080.438] GetLastError () returned 0x0 [0080.440] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffffcf6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.440] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x30a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x30a, lpOverlapped=0x0) returned 1 [0080.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.440] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.440] WriteFile (in: hFile=0xe8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.441] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.441] CloseHandle (hObject=0xe8) returned 1 [0080.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.[deadmin@cock.li].deadmin")) returned 1 [0080.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.442] GetLastError () returned 0x0 [0080.443] RtlWakeConditionVariable () returned 0x0 [0080.443] GetCurrentThreadId () returned 0x98c [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".ldf") returned 0x0 [0080.443] lstrlenW (lpString=".vhd") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".vhd") returned 0x0 [0080.443] lstrlenW (lpString=".vhdx") returned 5 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".vhdx") returned 0x0 [0080.443] lstrlenW (lpString=".pst") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".pst") returned 0x0 [0080.443] lstrlenW (lpString=".ost") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".ost") returned 0x0 [0080.443] lstrlenW (lpString=".bak") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".bak") returned 0x0 [0080.443] lstrlenW (lpString=".bac") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".bac") returned 0x0 [0080.443] lstrlenW (lpString=".sys") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".sys") returned 0x0 [0080.443] lstrlenW (lpString=".v2i") returned 4 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".v2i") returned 0x0 [0080.443] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.445] lstrlenW (lpString=".sql") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".sql") returned 0x0 [0080.445] lstrlenW (lpString=".mdf") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".mdf") returned 0x0 [0080.445] lstrlenW (lpString=".txt") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".txt") returned 0x0 [0080.445] lstrlenW (lpString=".dbf") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".dbf") returned 0x0 [0080.445] lstrlenW (lpString=".ckp") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".ckp") returned 0x0 [0080.445] lstrlenW (lpString=".dacpac") returned 7 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".dacpac") returned 0x0 [0080.445] lstrlenW (lpString=".db3") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".db3") returned 0x0 [0080.445] lstrlenW (lpString=".dtxs") returned 5 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".dtxs") returned 0x0 [0080.445] lstrlenW (lpString=".mdt") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".mdt") returned 0x0 [0080.445] lstrlenW (lpString=".sdf") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".sdf") returned 0x0 [0080.445] lstrlenW (lpString=".MDF") returned 4 [0080.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".MDF") returned 0x0 [0080.446] lstrlenW (lpString=".DBF") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".DBF") returned 0x0 [0080.446] lstrlenW (lpString=".DB") returned 3 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".DB") returned 0x0 [0080.446] lstrlenW (lpString=".db") returned 3 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".db") returned 0x0 [0080.446] lstrlenW (lpString=".ndf") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".ndf") returned 0x0 [0080.446] lstrlenW (lpString=".NDF") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".NDF") returned 0x0 [0080.446] lstrlenW (lpString=".Mdf") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".Mdf") returned 0x0 [0080.446] lstrlenW (lpString=".dat") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".dat") returned 0x0 [0080.446] lstrlenW (lpString=".DAT") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".DAT") returned 0x0 [0080.446] lstrlenW (lpString=".ldf") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".ldf") returned 0x0 [0080.446] lstrlenW (lpString=".LDF") returned 4 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch=".LDF") returned 0x0 [0080.446] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.447] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27576b0) returned 1 [0080.448] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.448] CryptReleaseContext (hProv=0x27576b0, dwFlags=0x0) returned 1 [0080.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.448] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20044895881) returned 1 [0080.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbec25d10, dwHighDateTime=0x1d585b4)) [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27615a0 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27615a0 | out: hHeap=0x260000) returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f9f0 [0080.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.449] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.449] GetLastError () returned 0x0 [0080.449] GetLastError () returned 0x0 [0080.449] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.449] GetLastError () returned 0x0 [0080.449] GetLastError () returned 0x0 [0080.452] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.452] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.453] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.453] WriteFile (in: hFile=0xe8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.453] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.453] CloseHandle (hObject=0xe8) returned 1 [0080.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.455] GetLastError () returned 0x0 [0080.455] RtlWakeConditionVariable () returned 0x0 [0080.455] GetCurrentThreadId () returned 0x98c [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".ldf") returned 0x0 [0080.455] lstrlenW (lpString=".vhd") returned 4 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".vhd") returned 0x0 [0080.455] lstrlenW (lpString=".vhdx") returned 5 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".vhdx") returned 0x0 [0080.455] lstrlenW (lpString=".pst") returned 4 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".pst") returned 0x0 [0080.455] lstrlenW (lpString=".ost") returned 4 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".ost") returned 0x0 [0080.455] lstrlenW (lpString=".bak") returned 4 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".bak") returned 0x0 [0080.455] lstrlenW (lpString=".bac") returned 4 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".bac") returned 0x0 [0080.455] lstrlenW (lpString=".sys") returned 4 [0080.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".sys") returned 0x0 [0080.455] lstrlenW (lpString=".v2i") returned 4 [0080.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".v2i") returned 0x0 [0080.456] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch="s\r\n.v2i") returned 0x0 [0080.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.538] lstrlenW (lpString=".sql") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".sql") returned 0x0 [0080.538] lstrlenW (lpString=".mdf") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".mdf") returned 0x0 [0080.538] lstrlenW (lpString=".txt") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".txt") returned 0x0 [0080.538] lstrlenW (lpString=".dbf") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".dbf") returned 0x0 [0080.538] lstrlenW (lpString=".ckp") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".ckp") returned 0x0 [0080.538] lstrlenW (lpString=".dacpac") returned 7 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".dacpac") returned 0x0 [0080.538] lstrlenW (lpString=".db3") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".db3") returned 0x0 [0080.538] lstrlenW (lpString=".dtxs") returned 5 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".dtxs") returned 0x0 [0080.538] lstrlenW (lpString=".mdt") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".mdt") returned 0x0 [0080.538] lstrlenW (lpString=".sdf") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".sdf") returned 0x0 [0080.538] lstrlenW (lpString=".MDF") returned 4 [0080.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".MDF") returned 0x0 [0080.539] lstrlenW (lpString=".DBF") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".DBF") returned 0x0 [0080.539] lstrlenW (lpString=".DB") returned 3 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".DB") returned 0x0 [0080.539] lstrlenW (lpString=".db") returned 3 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".db") returned 0x0 [0080.539] lstrlenW (lpString=".ndf") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".ndf") returned 0x0 [0080.539] lstrlenW (lpString=".NDF") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".NDF") returned 0x0 [0080.539] lstrlenW (lpString=".Mdf") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".Mdf") returned 0x0 [0080.539] lstrlenW (lpString=".dat") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".dat") returned 0x0 [0080.539] lstrlenW (lpString=".DAT") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".DAT") returned 0x0 [0080.539] lstrlenW (lpString=".ldf") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".ldf") returned 0x0 [0080.539] lstrlenW (lpString=".LDF") returned 4 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch=".LDF") returned 0x0 [0080.539] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.539] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757c00) returned 1 [0080.540] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.540] CryptReleaseContext (hProv=0x2757c00, dwFlags=0x0) returned 1 [0080.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.540] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20054157883) returned 1 [0080.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbed0a550, dwHighDateTime=0x1d585b4)) [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff20 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff20 | out: hHeap=0x260000) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.541] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.541] GetLastError () returned 0x0 [0080.541] GetLastError () returned 0x0 [0080.542] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.542] GetLastError () returned 0x0 [0080.542] GetLastError () returned 0x0 [0080.543] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffff87a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.543] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x786, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x786, lpOverlapped=0x0) returned 1 [0080.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.543] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.544] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.544] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.544] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.544] CloseHandle (hObject=0xe8) returned 1 [0080.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.[deadmin@cock.li].deadmin")) returned 1 [0080.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.545] GetLastError () returned 0x0 [0080.545] RtlWakeConditionVariable () returned 0x0 [0080.545] GetCurrentThreadId () returned 0x98c [0080.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".ldf") returned 0x0 [0080.545] lstrlenW (lpString=".vhd") returned 4 [0080.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".vhd") returned 0x0 [0080.546] lstrlenW (lpString=".vhdx") returned 5 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".vhdx") returned 0x0 [0080.546] lstrlenW (lpString=".pst") returned 4 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".pst") returned 0x0 [0080.546] lstrlenW (lpString=".ost") returned 4 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".ost") returned 0x0 [0080.546] lstrlenW (lpString=".bak") returned 4 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".bak") returned 0x0 [0080.546] lstrlenW (lpString=".bac") returned 4 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".bac") returned 0x0 [0080.546] lstrlenW (lpString=".sys") returned 4 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".sys") returned 0x0 [0080.546] lstrlenW (lpString=".v2i") returned 4 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".v2i") returned 0x0 [0080.546] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.563] lstrlenW (lpString=".sql") returned 4 [0080.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".sql") returned 0x0 [0080.563] lstrlenW (lpString=".mdf") returned 4 [0080.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".mdf") returned 0x0 [0080.564] lstrlenW (lpString=".txt") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".txt") returned 0x0 [0080.564] lstrlenW (lpString=".dbf") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".dbf") returned 0x0 [0080.564] lstrlenW (lpString=".ckp") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".ckp") returned 0x0 [0080.564] lstrlenW (lpString=".dacpac") returned 7 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".dacpac") returned 0x0 [0080.564] lstrlenW (lpString=".db3") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".db3") returned 0x0 [0080.564] lstrlenW (lpString=".dtxs") returned 5 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".dtxs") returned 0x0 [0080.564] lstrlenW (lpString=".mdt") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".mdt") returned 0x0 [0080.564] lstrlenW (lpString=".sdf") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".sdf") returned 0x0 [0080.564] lstrlenW (lpString=".MDF") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".MDF") returned 0x0 [0080.564] lstrlenW (lpString=".DBF") returned 4 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".DBF") returned 0x0 [0080.564] lstrlenW (lpString=".DB") returned 3 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".DB") returned 0x0 [0080.564] lstrlenW (lpString=".db") returned 3 [0080.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".db") returned 0x0 [0080.564] lstrlenW (lpString=".ndf") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".ndf") returned 0x0 [0080.565] lstrlenW (lpString=".NDF") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".NDF") returned 0x0 [0080.565] lstrlenW (lpString=".Mdf") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".Mdf") returned 0x0 [0080.565] lstrlenW (lpString=".dat") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".dat") returned 0x0 [0080.565] lstrlenW (lpString=".DAT") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".DAT") returned 0x0 [0080.565] lstrlenW (lpString=".ldf") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".ldf") returned 0x0 [0080.565] lstrlenW (lpString=".LDF") returned 4 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch=".LDF") returned 0x0 [0080.565] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.565] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757c88) returned 1 [0080.566] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.566] CryptReleaseContext (hProv=0x2757c88, dwFlags=0x0) returned 1 [0080.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.566] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20056731325) returned 1 [0080.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbed56810, dwHighDateTime=0x1d585b4)) [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd28 [0080.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd28 | out: hHeap=0x260000) returned 1 [0080.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e5e0 [0080.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e5e0 | out: hHeap=0x260000) returned 1 [0080.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0080.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.567] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.567] GetLastError () returned 0x0 [0080.567] GetLastError () returned 0x0 [0080.567] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.567] GetLastError () returned 0x0 [0080.568] GetLastError () returned 0x0 [0080.576] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.576] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.578] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.578] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.583] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.583] CloseHandle (hObject=0x11c) returned 1 [0080.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0080.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0080.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.585] GetLastError () returned 0x0 [0080.585] RtlWakeConditionVariable () returned 0x0 [0080.585] GetCurrentThreadId () returned 0x98c [0080.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".ldf") returned 0x0 [0080.585] lstrlenW (lpString=".vhd") returned 4 [0080.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".vhd") returned 0x0 [0080.585] lstrlenW (lpString=".vhdx") returned 5 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".vhdx") returned 0x0 [0080.586] lstrlenW (lpString=".pst") returned 4 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".pst") returned 0x0 [0080.586] lstrlenW (lpString=".ost") returned 4 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".ost") returned 0x0 [0080.586] lstrlenW (lpString=".bak") returned 4 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".bak") returned 0x0 [0080.586] lstrlenW (lpString=".bac") returned 4 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".bac") returned 0x0 [0080.586] lstrlenW (lpString=".sys") returned 4 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".sys") returned 0x0 [0080.586] lstrlenW (lpString=".v2i") returned 4 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".v2i") returned 0x0 [0080.586] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch="s\r\n.v2i") returned 0x0 [0080.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.587] lstrlenW (lpString=".sql") returned 4 [0080.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".sql") returned 0x0 [0080.587] lstrlenW (lpString=".mdf") returned 4 [0080.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".mdf") returned 0x0 [0080.587] lstrlenW (lpString=".txt") returned 4 [0080.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".txt") returned 0x0 [0080.587] lstrlenW (lpString=".dbf") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".dbf") returned 0x0 [0080.588] lstrlenW (lpString=".ckp") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".ckp") returned 0x0 [0080.588] lstrlenW (lpString=".dacpac") returned 7 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".dacpac") returned 0x0 [0080.588] lstrlenW (lpString=".db3") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".db3") returned 0x0 [0080.588] lstrlenW (lpString=".dtxs") returned 5 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".dtxs") returned 0x0 [0080.588] lstrlenW (lpString=".mdt") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".mdt") returned 0x0 [0080.588] lstrlenW (lpString=".sdf") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".sdf") returned 0x0 [0080.588] lstrlenW (lpString=".MDF") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".MDF") returned 0x0 [0080.588] lstrlenW (lpString=".DBF") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".DBF") returned 0x0 [0080.588] lstrlenW (lpString=".DB") returned 3 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".DB") returned 0x0 [0080.588] lstrlenW (lpString=".db") returned 3 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".db") returned 0x0 [0080.588] lstrlenW (lpString=".ndf") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".ndf") returned 0x0 [0080.588] lstrlenW (lpString=".NDF") returned 4 [0080.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".NDF") returned 0x0 [0080.588] lstrlenW (lpString=".Mdf") returned 4 [0080.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".Mdf") returned 0x0 [0080.589] lstrlenW (lpString=".dat") returned 4 [0080.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".dat") returned 0x0 [0080.589] lstrlenW (lpString=".DAT") returned 4 [0080.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".DAT") returned 0x0 [0080.589] lstrlenW (lpString=".ldf") returned 4 [0080.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".ldf") returned 0x0 [0080.589] lstrlenW (lpString=".LDF") returned 4 [0080.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch=".LDF") returned 0x0 [0080.589] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.589] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757c00) returned 1 [0080.590] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.590] CryptReleaseContext (hProv=0x2757c00, dwFlags=0x0) returned 1 [0080.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.590] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20059133973) returned 1 [0080.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbeda2ad0, dwHighDateTime=0x1d585b4)) [0080.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efcf0 [0080.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efcf0 | out: hHeap=0x260000) returned 1 [0080.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0080.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.591] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.591] GetLastError () returned 0x0 [0080.591] GetLastError () returned 0x0 [0080.591] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.591] GetLastError () returned 0x0 [0080.592] GetLastError () returned 0x0 [0080.603] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.603] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.604] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.604] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.616] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.616] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.617] CloseHandle (hObject=0x11c) returned 1 [0080.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0080.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.[deadmin@cock.li].deadmin")) returned 1 [0080.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0080.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.618] GetLastError () returned 0x0 [0080.618] RtlWakeConditionVariable () returned 0x27e828 [0080.618] GetCurrentThreadId () returned 0x98c [0080.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".ldf") returned 0x0 [0080.618] lstrlenW (lpString=".vhd") returned 4 [0080.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".vhd") returned 0x0 [0080.618] lstrlenW (lpString=".vhdx") returned 5 [0080.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".vhdx") returned 0x0 [0080.618] lstrlenW (lpString=".pst") returned 4 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".pst") returned 0x0 [0080.619] lstrlenW (lpString=".ost") returned 4 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".ost") returned 0x0 [0080.619] lstrlenW (lpString=".bak") returned 4 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".bak") returned 0x0 [0080.619] lstrlenW (lpString=".bac") returned 4 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".bac") returned 0x0 [0080.619] lstrlenW (lpString=".sys") returned 4 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".sys") returned 0x0 [0080.619] lstrlenW (lpString=".v2i") returned 4 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".v2i") returned 0x0 [0080.619] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.620] lstrlenW (lpString=".sql") returned 4 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".sql") returned 0x0 [0080.620] lstrlenW (lpString=".mdf") returned 4 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".mdf") returned 0x0 [0080.620] lstrlenW (lpString=".txt") returned 4 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".txt") returned 0x0 [0080.620] lstrlenW (lpString=".dbf") returned 4 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".dbf") returned 0x0 [0080.620] lstrlenW (lpString=".ckp") returned 4 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".ckp") returned 0x0 [0080.620] lstrlenW (lpString=".dacpac") returned 7 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".dacpac") returned 0x0 [0080.620] lstrlenW (lpString=".db3") returned 4 [0080.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".db3") returned 0x0 [0080.620] lstrlenW (lpString=".dtxs") returned 5 [0080.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".dtxs") returned 0x0 [0080.621] lstrlenW (lpString=".mdt") returned 4 [0080.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".mdt") returned 0x0 [0080.621] lstrlenW (lpString=".sdf") returned 4 [0080.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".sdf") returned 0x0 [0080.621] lstrlenW (lpString=".MDF") returned 4 [0080.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".MDF") returned 0x0 [0080.723] lstrlenW (lpString=".DBF") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".DBF") returned 0x0 [0080.723] lstrlenW (lpString=".DB") returned 3 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".DB") returned 0x0 [0080.723] lstrlenW (lpString=".db") returned 3 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".db") returned 0x0 [0080.723] lstrlenW (lpString=".ndf") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".ndf") returned 0x0 [0080.723] lstrlenW (lpString=".NDF") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".NDF") returned 0x0 [0080.723] lstrlenW (lpString=".Mdf") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".Mdf") returned 0x0 [0080.723] lstrlenW (lpString=".dat") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".dat") returned 0x0 [0080.723] lstrlenW (lpString=".DAT") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".DAT") returned 0x0 [0080.723] lstrlenW (lpString=".ldf") returned 4 [0080.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".ldf") returned 0x0 [0080.723] lstrlenW (lpString=".LDF") returned 4 [0080.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch=".LDF") returned 0x0 [0080.724] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.724] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d22d8) returned 1 [0080.724] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.725] CryptReleaseContext (hProv=0x2d22d8, dwFlags=0x0) returned 1 [0080.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.725] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20072585047) returned 1 [0080.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbeed35d0, dwHighDateTime=0x1d585b4)) [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.725] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.726] GetLastError () returned 0x0 [0080.726] GetLastError () returned 0x0 [0080.726] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.726] GetLastError () returned 0x0 [0080.726] GetLastError () returned 0x0 [0080.729] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.729] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.730] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.730] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.746] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.746] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.747] CloseHandle (hObject=0x11c) returned 1 [0080.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.754] GetLastError () returned 0x0 [0080.755] RtlWakeConditionVariable () returned 0x0 [0080.755] GetCurrentThreadId () returned 0x98c [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".ldf") returned 0x0 [0080.755] lstrlenW (lpString=".vhd") returned 4 [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".vhd") returned 0x0 [0080.755] lstrlenW (lpString=".vhdx") returned 5 [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".vhdx") returned 0x0 [0080.755] lstrlenW (lpString=".pst") returned 4 [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".pst") returned 0x0 [0080.755] lstrlenW (lpString=".ost") returned 4 [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".ost") returned 0x0 [0080.755] lstrlenW (lpString=".bak") returned 4 [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".bak") returned 0x0 [0080.755] lstrlenW (lpString=".bac") returned 4 [0080.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".bac") returned 0x0 [0080.756] lstrlenW (lpString=".sys") returned 4 [0080.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".sys") returned 0x0 [0080.756] lstrlenW (lpString=".v2i") returned 4 [0080.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".v2i") returned 0x0 [0080.756] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.758] lstrlenW (lpString=".sql") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".sql") returned 0x0 [0080.758] lstrlenW (lpString=".mdf") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".mdf") returned 0x0 [0080.758] lstrlenW (lpString=".txt") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".txt") returned 0x0 [0080.758] lstrlenW (lpString=".dbf") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".dbf") returned 0x0 [0080.758] lstrlenW (lpString=".ckp") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".ckp") returned 0x0 [0080.758] lstrlenW (lpString=".dacpac") returned 7 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".dacpac") returned 0x0 [0080.758] lstrlenW (lpString=".db3") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".db3") returned 0x0 [0080.758] lstrlenW (lpString=".dtxs") returned 5 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".dtxs") returned 0x0 [0080.758] lstrlenW (lpString=".mdt") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".mdt") returned 0x0 [0080.758] lstrlenW (lpString=".sdf") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".sdf") returned 0x0 [0080.758] lstrlenW (lpString=".MDF") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".MDF") returned 0x0 [0080.758] lstrlenW (lpString=".DBF") returned 4 [0080.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".DBF") returned 0x0 [0080.758] lstrlenW (lpString=".DB") returned 3 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".DB") returned 0x0 [0080.759] lstrlenW (lpString=".db") returned 3 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".db") returned 0x0 [0080.759] lstrlenW (lpString=".ndf") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".ndf") returned 0x0 [0080.759] lstrlenW (lpString=".NDF") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".NDF") returned 0x0 [0080.759] lstrlenW (lpString=".Mdf") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".Mdf") returned 0x0 [0080.759] lstrlenW (lpString=".dat") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".dat") returned 0x0 [0080.759] lstrlenW (lpString=".DAT") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".DAT") returned 0x0 [0080.759] lstrlenW (lpString=".ldf") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".ldf") returned 0x0 [0080.759] lstrlenW (lpString=".LDF") returned 4 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch=".LDF") returned 0x0 [0080.759] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.759] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757e20) returned 1 [0080.761] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.761] CryptReleaseContext (hProv=0x2757e20, dwFlags=0x0) returned 1 [0080.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.804] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20080559807) returned 1 [0080.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbef91cb0, dwHighDateTime=0x1d585b4)) [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338330 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338330 | out: hHeap=0x260000) returned 1 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.805] GetLastError () returned 0x0 [0080.806] GetLastError () returned 0x0 [0080.806] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.806] GetLastError () returned 0x0 [0080.806] GetLastError () returned 0x0 [0080.809] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.810] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.811] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.811] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.811] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.811] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.811] CloseHandle (hObject=0x11c) returned 1 [0080.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.854] GetLastError () returned 0x0 [0080.854] RtlWakeConditionVariable () returned 0x27e828 [0080.854] GetCurrentThreadId () returned 0x98c [0080.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".ldf") returned 0x0 [0080.854] lstrlenW (lpString=".vhd") returned 4 [0080.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".vhd") returned 0x0 [0080.854] lstrlenW (lpString=".vhdx") returned 5 [0080.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".vhdx") returned 0x0 [0080.854] lstrlenW (lpString=".pst") returned 4 [0080.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".pst") returned 0x0 [0080.854] lstrlenW (lpString=".ost") returned 4 [0080.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".ost") returned 0x0 [0080.854] lstrlenW (lpString=".bak") returned 4 [0080.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".bak") returned 0x0 [0080.855] lstrlenW (lpString=".bac") returned 4 [0080.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".bac") returned 0x0 [0080.855] lstrlenW (lpString=".sys") returned 4 [0080.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".sys") returned 0x0 [0080.855] lstrlenW (lpString=".v2i") returned 4 [0080.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".v2i") returned 0x0 [0080.855] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch="s\r\n.v2i") returned 0x0 [0080.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.856] lstrlenW (lpString=".sql") returned 4 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".sql") returned 0x0 [0080.856] lstrlenW (lpString=".mdf") returned 4 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".mdf") returned 0x0 [0080.856] lstrlenW (lpString=".txt") returned 4 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".txt") returned 0x0 [0080.856] lstrlenW (lpString=".dbf") returned 4 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".dbf") returned 0x0 [0080.856] lstrlenW (lpString=".ckp") returned 4 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".ckp") returned 0x0 [0080.856] lstrlenW (lpString=".dacpac") returned 7 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".dacpac") returned 0x0 [0080.856] lstrlenW (lpString=".db3") returned 4 [0080.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".db3") returned 0x0 [0080.856] lstrlenW (lpString=".dtxs") returned 5 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".dtxs") returned 0x0 [0080.857] lstrlenW (lpString=".mdt") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".mdt") returned 0x0 [0080.857] lstrlenW (lpString=".sdf") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".sdf") returned 0x0 [0080.857] lstrlenW (lpString=".MDF") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".MDF") returned 0x0 [0080.857] lstrlenW (lpString=".DBF") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".DBF") returned 0x0 [0080.857] lstrlenW (lpString=".DB") returned 3 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".DB") returned 0x0 [0080.857] lstrlenW (lpString=".db") returned 3 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".db") returned 0x0 [0080.857] lstrlenW (lpString=".ndf") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".ndf") returned 0x0 [0080.857] lstrlenW (lpString=".NDF") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".NDF") returned 0x0 [0080.857] lstrlenW (lpString=".Mdf") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".Mdf") returned 0x0 [0080.857] lstrlenW (lpString=".dat") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".dat") returned 0x0 [0080.857] lstrlenW (lpString=".DAT") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".DAT") returned 0x0 [0080.857] lstrlenW (lpString=".ldf") returned 4 [0080.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".ldf") returned 0x0 [0080.858] lstrlenW (lpString=".LDF") returned 4 [0080.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch=".LDF") returned 0x0 [0080.858] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.858] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d22d8) returned 1 [0080.859] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.859] CryptReleaseContext (hProv=0x2d22d8, dwFlags=0x0) returned 1 [0080.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.859] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20085988565) returned 1 [0080.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf02a230, dwHighDateTime=0x1d585b4)) [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3383d8 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3383d8 | out: hHeap=0x260000) returned 1 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f368 [0080.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.860] GetLastError () returned 0x0 [0080.860] GetLastError () returned 0x0 [0080.860] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.860] GetLastError () returned 0x0 [0080.860] GetLastError () returned 0x0 [0080.862] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffccdf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.862] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3321, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x3321, lpOverlapped=0x0) returned 1 [0080.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.862] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.862] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.862] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.862] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.863] CloseHandle (hObject=0xe4) returned 1 [0080.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.[deadmin@cock.li].deadmin")) returned 1 [0080.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.864] GetLastError () returned 0x0 [0080.865] RtlWakeConditionVariable () returned 0x0 [0080.865] GetCurrentThreadId () returned 0x98c [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".ldf") returned 0x0 [0080.865] lstrlenW (lpString=".vhd") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".vhd") returned 0x0 [0080.865] lstrlenW (lpString=".vhdx") returned 5 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".vhdx") returned 0x0 [0080.865] lstrlenW (lpString=".pst") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".pst") returned 0x0 [0080.865] lstrlenW (lpString=".ost") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".ost") returned 0x0 [0080.865] lstrlenW (lpString=".bak") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".bak") returned 0x0 [0080.865] lstrlenW (lpString=".bac") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".bac") returned 0x0 [0080.865] lstrlenW (lpString=".sys") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".sys") returned 0x0 [0080.865] lstrlenW (lpString=".v2i") returned 4 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".v2i") returned 0x0 [0080.865] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0080.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.867] lstrlenW (lpString=".sql") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".sql") returned 0x0 [0080.867] lstrlenW (lpString=".mdf") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".mdf") returned 0x0 [0080.867] lstrlenW (lpString=".txt") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".txt") returned 0x0 [0080.867] lstrlenW (lpString=".dbf") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".dbf") returned 0x0 [0080.867] lstrlenW (lpString=".ckp") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".ckp") returned 0x0 [0080.867] lstrlenW (lpString=".dacpac") returned 7 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".dacpac") returned 0x0 [0080.867] lstrlenW (lpString=".db3") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".db3") returned 0x0 [0080.867] lstrlenW (lpString=".dtxs") returned 5 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".dtxs") returned 0x0 [0080.867] lstrlenW (lpString=".mdt") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".mdt") returned 0x0 [0080.867] lstrlenW (lpString=".sdf") returned 4 [0080.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".sdf") returned 0x0 [0080.867] lstrlenW (lpString=".MDF") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".MDF") returned 0x0 [0080.868] lstrlenW (lpString=".DBF") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".DBF") returned 0x0 [0080.868] lstrlenW (lpString=".DB") returned 3 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".DB") returned 0x0 [0080.868] lstrlenW (lpString=".db") returned 3 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".db") returned 0x0 [0080.868] lstrlenW (lpString=".ndf") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".ndf") returned 0x0 [0080.868] lstrlenW (lpString=".NDF") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".NDF") returned 0x0 [0080.868] lstrlenW (lpString=".Mdf") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".Mdf") returned 0x0 [0080.868] lstrlenW (lpString=".dat") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".dat") returned 0x0 [0080.868] lstrlenW (lpString=".DAT") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".DAT") returned 0x0 [0080.868] lstrlenW (lpString=".ldf") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".ldf") returned 0x0 [0080.868] lstrlenW (lpString=".LDF") returned 4 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch=".LDF") returned 0x0 [0080.868] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.869] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d22d8) returned 1 [0080.869] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.869] CryptReleaseContext (hProv=0x2d22d8, dwFlags=0x0) returned 1 [0080.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.870] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20087065909) returned 1 [0080.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf02a230, dwHighDateTime=0x1d585b4)) [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761db8 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761db8 | out: hHeap=0x260000) returned 1 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1750 [0080.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1750 | out: hHeap=0x260000) returned 1 [0080.870] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0080.871] GetLastError () returned 0x0 [0080.871] GetLastError () returned 0x0 [0080.871] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0080.871] GetLastError () returned 0x0 [0080.871] GetLastError () returned 0x0 [0081.018] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff86db, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.021] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x7925, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x7925, lpOverlapped=0x0) returned 1 [0081.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.027] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.027] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.030] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.030] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.031] CloseHandle (hObject=0xe4) returned 1 [0081.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.052] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.108] GetLastError () returned 0x0 [0081.109] RtlWakeConditionVariable () returned 0x0 [0081.109] GetCurrentThreadId () returned 0x98c [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".ldf") returned 0x0 [0081.109] lstrlenW (lpString=".vhd") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".vhd") returned 0x0 [0081.109] lstrlenW (lpString=".vhdx") returned 5 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".vhdx") returned 0x0 [0081.109] lstrlenW (lpString=".pst") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".pst") returned 0x0 [0081.109] lstrlenW (lpString=".ost") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".ost") returned 0x0 [0081.109] lstrlenW (lpString=".bak") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".bak") returned 0x0 [0081.109] lstrlenW (lpString=".bac") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".bac") returned 0x0 [0081.109] lstrlenW (lpString=".sys") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".sys") returned 0x0 [0081.109] lstrlenW (lpString=".v2i") returned 4 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".v2i") returned 0x0 [0081.109] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.526] lstrlenW (lpString=".sql") returned 4 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".sql") returned 0x0 [0081.526] lstrlenW (lpString=".mdf") returned 4 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".mdf") returned 0x0 [0081.526] lstrlenW (lpString=".txt") returned 4 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".txt") returned 0x0 [0081.526] lstrlenW (lpString=".dbf") returned 4 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".dbf") returned 0x0 [0081.526] lstrlenW (lpString=".ckp") returned 4 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".ckp") returned 0x0 [0081.526] lstrlenW (lpString=".dacpac") returned 7 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".dacpac") returned 0x0 [0081.526] lstrlenW (lpString=".db3") returned 4 [0081.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".db3") returned 0x0 [0081.526] lstrlenW (lpString=".dtxs") returned 5 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".dtxs") returned 0x0 [0081.527] lstrlenW (lpString=".mdt") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".mdt") returned 0x0 [0081.527] lstrlenW (lpString=".sdf") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".sdf") returned 0x0 [0081.527] lstrlenW (lpString=".MDF") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".MDF") returned 0x0 [0081.527] lstrlenW (lpString=".DBF") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".DBF") returned 0x0 [0081.527] lstrlenW (lpString=".DB") returned 3 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".DB") returned 0x0 [0081.527] lstrlenW (lpString=".db") returned 3 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".db") returned 0x0 [0081.527] lstrlenW (lpString=".ndf") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".ndf") returned 0x0 [0081.527] lstrlenW (lpString=".NDF") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".NDF") returned 0x0 [0081.527] lstrlenW (lpString=".Mdf") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".Mdf") returned 0x0 [0081.527] lstrlenW (lpString=".dat") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".dat") returned 0x0 [0081.527] lstrlenW (lpString=".DAT") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".DAT") returned 0x0 [0081.527] lstrlenW (lpString=".ldf") returned 4 [0081.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".ldf") returned 0x0 [0081.528] lstrlenW (lpString=".LDF") returned 4 [0081.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch=".LDF") returned 0x0 [0081.528] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.528] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757af0) returned 1 [0081.529] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.529] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.529] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20153004522) returned 1 [0081.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf68fd50, dwHighDateTime=0x1d585b4)) [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761ca0 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761ca0 | out: hHeap=0x260000) returned 1 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d17f8 [0081.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d17f8 | out: hHeap=0x260000) returned 1 [0081.530] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.530] GetLastError () returned 0x0 [0081.530] GetLastError () returned 0x0 [0081.530] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.530] GetLastError () returned 0x0 [0081.530] GetLastError () returned 0x0 [0081.534] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7412, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.534] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8bee, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x8bee, lpOverlapped=0x0) returned 1 [0081.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.534] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.534] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.534] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.534] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.534] CloseHandle (hObject=0x108) returned 1 [0081.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.537] GetLastError () returned 0x0 [0081.537] RtlWakeConditionVariable () returned 0x0 [0081.537] GetCurrentThreadId () returned 0x98c [0081.543] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.543] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.543] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0081.543] WriteFile (in: hFile=0x108, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0081.545] CloseHandle (hObject=0x108) returned 1 [0081.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0081.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.545] RtlWakeConditionVariable () returned 0x0 [0081.545] GetCurrentThreadId () returned 0x98c [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".ldf") returned 0x0 [0081.546] lstrlenW (lpString=".vhd") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".vhd") returned 0x0 [0081.546] lstrlenW (lpString=".vhdx") returned 5 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".vhdx") returned 0x0 [0081.546] lstrlenW (lpString=".pst") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".pst") returned 0x0 [0081.546] lstrlenW (lpString=".ost") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".ost") returned 0x0 [0081.546] lstrlenW (lpString=".bak") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".bak") returned 0x0 [0081.546] lstrlenW (lpString=".bac") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".bac") returned 0x0 [0081.546] lstrlenW (lpString=".sys") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".sys") returned 0x0 [0081.546] lstrlenW (lpString=".v2i") returned 4 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".v2i") returned 0x0 [0081.546] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.548] lstrlenW (lpString=".sql") returned 4 [0081.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".sql") returned 0x0 [0081.548] lstrlenW (lpString=".mdf") returned 4 [0081.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".mdf") returned 0x0 [0081.548] lstrlenW (lpString=".txt") returned 4 [0081.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".txt") returned 0x0 [0081.548] lstrlenW (lpString=".dbf") returned 4 [0081.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".dbf") returned 0x0 [0081.549] lstrlenW (lpString=".ckp") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".ckp") returned 0x0 [0081.549] lstrlenW (lpString=".dacpac") returned 7 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".dacpac") returned 0x0 [0081.549] lstrlenW (lpString=".db3") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".db3") returned 0x0 [0081.549] lstrlenW (lpString=".dtxs") returned 5 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".dtxs") returned 0x0 [0081.549] lstrlenW (lpString=".mdt") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".mdt") returned 0x0 [0081.549] lstrlenW (lpString=".sdf") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".sdf") returned 0x0 [0081.549] lstrlenW (lpString=".MDF") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".MDF") returned 0x0 [0081.549] lstrlenW (lpString=".DBF") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".DBF") returned 0x0 [0081.549] lstrlenW (lpString=".DB") returned 3 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".DB") returned 0x0 [0081.549] lstrlenW (lpString=".db") returned 3 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".db") returned 0x0 [0081.549] lstrlenW (lpString=".ndf") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".ndf") returned 0x0 [0081.549] lstrlenW (lpString=".NDF") returned 4 [0081.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".NDF") returned 0x0 [0081.549] lstrlenW (lpString=".Mdf") returned 4 [0081.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".Mdf") returned 0x0 [0081.550] lstrlenW (lpString=".dat") returned 4 [0081.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".dat") returned 0x0 [0081.550] lstrlenW (lpString=".DAT") returned 4 [0081.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".DAT") returned 0x0 [0081.550] lstrlenW (lpString=".ldf") returned 4 [0081.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".ldf") returned 0x0 [0081.550] lstrlenW (lpString=".LDF") returned 4 [0081.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch=".LDF") returned 0x0 [0081.550] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.550] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757af0) returned 1 [0081.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.551] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.551] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20155223760) returned 1 [0081.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf6b5eb0, dwHighDateTime=0x1d585b4)) [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761fe8 [0081.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761fe8 | out: hHeap=0x260000) returned 1 [0081.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1b40 [0081.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1b40 | out: hHeap=0x260000) returned 1 [0081.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.552] GetLastError () returned 0x0 [0081.552] GetLastError () returned 0x0 [0081.552] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.552] GetLastError () returned 0x0 [0081.553] GetLastError () returned 0x0 [0081.556] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.556] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.557] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.558] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.609] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.609] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.609] CloseHandle (hObject=0x108) returned 1 [0081.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.611] GetLastError () returned 0x0 [0081.611] RtlWakeConditionVariable () returned 0x0 [0081.611] GetCurrentThreadId () returned 0x98c [0081.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".ldf") returned 0x0 [0081.611] lstrlenW (lpString=".vhd") returned 4 [0081.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".vhd") returned 0x0 [0081.611] lstrlenW (lpString=".vhdx") returned 5 [0081.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".vhdx") returned 0x0 [0081.611] lstrlenW (lpString=".pst") returned 4 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".pst") returned 0x0 [0081.612] lstrlenW (lpString=".ost") returned 4 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".ost") returned 0x0 [0081.612] lstrlenW (lpString=".bak") returned 4 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".bak") returned 0x0 [0081.612] lstrlenW (lpString=".bac") returned 4 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".bac") returned 0x0 [0081.612] lstrlenW (lpString=".sys") returned 4 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".sys") returned 0x0 [0081.612] lstrlenW (lpString=".v2i") returned 4 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".v2i") returned 0x0 [0081.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.699] lstrlenW (lpString=".sql") returned 4 [0081.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".sql") returned 0x0 [0081.700] lstrlenW (lpString=".mdf") returned 4 [0081.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".mdf") returned 0x0 [0081.700] lstrlenW (lpString=".txt") returned 4 [0081.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".txt") returned 0x0 [0081.710] lstrlenW (lpString=".dbf") returned 4 [0081.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".dbf") returned 0x0 [0081.710] lstrlenW (lpString=".ckp") returned 4 [0081.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".ckp") returned 0x0 [0081.710] lstrlenW (lpString=".dacpac") returned 7 [0081.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".dacpac") returned 0x0 [0081.733] lstrlenW (lpString=".db3") returned 4 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".db3") returned 0x0 [0081.733] lstrlenW (lpString=".dtxs") returned 5 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".dtxs") returned 0x0 [0081.733] lstrlenW (lpString=".mdt") returned 4 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".mdt") returned 0x0 [0081.733] lstrlenW (lpString=".sdf") returned 4 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".sdf") returned 0x0 [0081.733] lstrlenW (lpString=".MDF") returned 4 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".MDF") returned 0x0 [0081.733] lstrlenW (lpString=".DBF") returned 4 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".DBF") returned 0x0 [0081.733] lstrlenW (lpString=".DB") returned 3 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".DB") returned 0x0 [0081.733] lstrlenW (lpString=".db") returned 3 [0081.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".db") returned 0x0 [0081.733] lstrlenW (lpString=".ndf") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".ndf") returned 0x0 [0081.734] lstrlenW (lpString=".NDF") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".NDF") returned 0x0 [0081.734] lstrlenW (lpString=".Mdf") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".Mdf") returned 0x0 [0081.734] lstrlenW (lpString=".dat") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".dat") returned 0x0 [0081.734] lstrlenW (lpString=".DAT") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".DAT") returned 0x0 [0081.734] lstrlenW (lpString=".ldf") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".ldf") returned 0x0 [0081.734] lstrlenW (lpString=".LDF") returned 4 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch=".LDF") returned 0x0 [0081.734] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.734] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757af0) returned 1 [0081.735] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.735] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.735] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20173627822) returned 1 [0081.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf87ef30, dwHighDateTime=0x1d585b4)) [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3384f0 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3384f0 | out: hHeap=0x260000) returned 1 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0081.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0081.736] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.736] GetLastError () returned 0x0 [0081.736] GetLastError () returned 0x0 [0081.737] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.737] GetLastError () returned 0x0 [0081.737] GetLastError () returned 0x0 [0081.741] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.741] WriteFile (in: hFile=0xe8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0081.742] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.742] WriteFile (in: hFile=0xe8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.743] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.743] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.743] CloseHandle (hObject=0xe8) returned 1 [0081.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0081.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0081.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.745] GetLastError () returned 0x0 [0081.745] RtlWakeConditionVariable () returned 0x0 [0081.745] GetCurrentThreadId () returned 0x98c [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".ldf") returned 0x0 [0081.745] lstrlenW (lpString=".vhd") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".vhd") returned 0x0 [0081.745] lstrlenW (lpString=".vhdx") returned 5 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".vhdx") returned 0x0 [0081.745] lstrlenW (lpString=".pst") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".pst") returned 0x0 [0081.745] lstrlenW (lpString=".ost") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".ost") returned 0x0 [0081.745] lstrlenW (lpString=".bak") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".bak") returned 0x0 [0081.745] lstrlenW (lpString=".bac") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".bac") returned 0x0 [0081.745] lstrlenW (lpString=".sys") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".sys") returned 0x0 [0081.745] lstrlenW (lpString=".v2i") returned 4 [0081.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".v2i") returned 0x0 [0081.746] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.746] lstrlenW (lpString=".sql") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".sql") returned 0x0 [0081.747] lstrlenW (lpString=".mdf") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".mdf") returned 0x0 [0081.747] lstrlenW (lpString=".txt") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".txt") returned 0x0 [0081.747] lstrlenW (lpString=".dbf") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".dbf") returned 0x0 [0081.747] lstrlenW (lpString=".ckp") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".ckp") returned 0x0 [0081.747] lstrlenW (lpString=".dacpac") returned 7 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".dacpac") returned 0x0 [0081.747] lstrlenW (lpString=".db3") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".db3") returned 0x0 [0081.747] lstrlenW (lpString=".dtxs") returned 5 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".dtxs") returned 0x0 [0081.747] lstrlenW (lpString=".mdt") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".mdt") returned 0x0 [0081.747] lstrlenW (lpString=".sdf") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".sdf") returned 0x0 [0081.747] lstrlenW (lpString=".MDF") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".MDF") returned 0x0 [0081.747] lstrlenW (lpString=".DBF") returned 4 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".DBF") returned 0x0 [0081.747] lstrlenW (lpString=".DB") returned 3 [0081.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".DB") returned 0x0 [0081.747] lstrlenW (lpString=".db") returned 3 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".db") returned 0x0 [0081.748] lstrlenW (lpString=".ndf") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".ndf") returned 0x0 [0081.748] lstrlenW (lpString=".NDF") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".NDF") returned 0x0 [0081.748] lstrlenW (lpString=".Mdf") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".Mdf") returned 0x0 [0081.748] lstrlenW (lpString=".dat") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".dat") returned 0x0 [0081.748] lstrlenW (lpString=".DAT") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".DAT") returned 0x0 [0081.748] lstrlenW (lpString=".ldf") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".ldf") returned 0x0 [0081.748] lstrlenW (lpString=".LDF") returned 4 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch=".LDF") returned 0x0 [0081.748] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.748] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757af0) returned 1 [0081.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.749] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.749] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20175035619) returned 1 [0081.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf8a5090, dwHighDateTime=0x1d585b4)) [0081.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338528 [0081.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338528 | out: hHeap=0x260000) returned 1 [0081.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0081.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760798 [0081.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0081.750] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.750] GetLastError () returned 0x0 [0081.750] GetLastError () returned 0x0 [0081.750] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.750] GetLastError () returned 0x0 [0081.751] GetLastError () returned 0x0 [0081.754] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffff9130, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.754] WriteFile (in: hFile=0xe8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x6ed0, lpOverlapped=0x0) returned 1 [0081.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0081.754] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.755] WriteFile (in: hFile=0xe8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.755] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.755] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.755] CloseHandle (hObject=0xe8) returned 1 [0081.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.755] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.757] GetLastError () returned 0x0 [0081.757] RtlWakeConditionVariable () returned 0x0 [0081.757] GetCurrentThreadId () returned 0x98c [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".ldf") returned 0x0 [0081.757] lstrlenW (lpString=".vhd") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".vhd") returned 0x0 [0081.757] lstrlenW (lpString=".vhdx") returned 5 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".vhdx") returned 0x0 [0081.757] lstrlenW (lpString=".pst") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".pst") returned 0x0 [0081.757] lstrlenW (lpString=".ost") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".ost") returned 0x0 [0081.757] lstrlenW (lpString=".bak") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".bak") returned 0x0 [0081.757] lstrlenW (lpString=".bac") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".bac") returned 0x0 [0081.757] lstrlenW (lpString=".sys") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".sys") returned 0x0 [0081.757] lstrlenW (lpString=".v2i") returned 4 [0081.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".v2i") returned 0x0 [0081.758] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.759] lstrlenW (lpString=".sql") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".sql") returned 0x0 [0081.759] lstrlenW (lpString=".mdf") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".mdf") returned 0x0 [0081.759] lstrlenW (lpString=".txt") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".txt") returned 0x0 [0081.759] lstrlenW (lpString=".dbf") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".dbf") returned 0x0 [0081.759] lstrlenW (lpString=".ckp") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".ckp") returned 0x0 [0081.759] lstrlenW (lpString=".dacpac") returned 7 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".dacpac") returned 0x0 [0081.759] lstrlenW (lpString=".db3") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".db3") returned 0x0 [0081.759] lstrlenW (lpString=".dtxs") returned 5 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".dtxs") returned 0x0 [0081.759] lstrlenW (lpString=".mdt") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".mdt") returned 0x0 [0081.759] lstrlenW (lpString=".sdf") returned 4 [0081.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".sdf") returned 0x0 [0081.760] lstrlenW (lpString=".MDF") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".MDF") returned 0x0 [0081.760] lstrlenW (lpString=".DBF") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".DBF") returned 0x0 [0081.760] lstrlenW (lpString=".DB") returned 3 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".DB") returned 0x0 [0081.760] lstrlenW (lpString=".db") returned 3 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".db") returned 0x0 [0081.760] lstrlenW (lpString=".ndf") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".ndf") returned 0x0 [0081.760] lstrlenW (lpString=".NDF") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".NDF") returned 0x0 [0081.760] lstrlenW (lpString=".Mdf") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".Mdf") returned 0x0 [0081.760] lstrlenW (lpString=".dat") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".dat") returned 0x0 [0081.760] lstrlenW (lpString=".DAT") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".DAT") returned 0x0 [0081.760] lstrlenW (lpString=".ldf") returned 4 [0081.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".ldf") returned 0x0 [0081.760] lstrlenW (lpString=".LDF") returned 4 [0081.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch=".LDF") returned 0x0 [0081.761] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.761] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2757af0) returned 1 [0081.761] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.762] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.762] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20176283144) returned 1 [0081.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf8cb1f0, dwHighDateTime=0x1d585b4)) [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338560 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338560 | out: hHeap=0x260000) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0081.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0081.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0081.762] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.763] GetLastError () returned 0x0 [0081.763] GetLastError () returned 0x0 [0081.763] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.763] GetLastError () returned 0x0 [0081.763] GetLastError () returned 0x0 [0081.883] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffff3744, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.883] WriteFile (in: hFile=0xe8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xc8bc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0xc8bc, lpOverlapped=0x0) returned 1 [0081.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0081.883] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.883] WriteFile (in: hFile=0xe8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.883] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.884] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.884] CloseHandle (hObject=0xe8) returned 1 [0081.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.886] GetLastError () returned 0x0 [0081.886] RtlWakeConditionVariable () returned 0x0 [0081.886] GetCurrentThreadId () returned 0x98c [0081.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".ldf") returned 0x0 [0081.886] lstrlenW (lpString=".vhd") returned 4 [0081.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".vhd") returned 0x0 [0081.886] lstrlenW (lpString=".vhdx") returned 5 [0081.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".vhdx") returned 0x0 [0081.886] lstrlenW (lpString=".pst") returned 4 [0081.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".pst") returned 0x0 [0081.886] lstrlenW (lpString=".ost") returned 4 [0081.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".ost") returned 0x0 [0081.887] lstrlenW (lpString=".bak") returned 4 [0081.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".bak") returned 0x0 [0081.887] lstrlenW (lpString=".bac") returned 4 [0081.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".bac") returned 0x0 [0081.887] lstrlenW (lpString=".sys") returned 4 [0081.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".sys") returned 0x0 [0081.887] lstrlenW (lpString=".v2i") returned 4 [0081.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".v2i") returned 0x0 [0081.887] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0081.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.894] lstrlenW (lpString=".sql") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".sql") returned 0x0 [0081.894] lstrlenW (lpString=".mdf") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".mdf") returned 0x0 [0081.894] lstrlenW (lpString=".txt") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".txt") returned 0x0 [0081.894] lstrlenW (lpString=".dbf") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".dbf") returned 0x0 [0081.894] lstrlenW (lpString=".ckp") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".ckp") returned 0x0 [0081.894] lstrlenW (lpString=".dacpac") returned 7 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".dacpac") returned 0x0 [0081.894] lstrlenW (lpString=".db3") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".db3") returned 0x0 [0081.894] lstrlenW (lpString=".dtxs") returned 5 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".dtxs") returned 0x0 [0081.894] lstrlenW (lpString=".mdt") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".mdt") returned 0x0 [0081.894] lstrlenW (lpString=".sdf") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".sdf") returned 0x0 [0081.894] lstrlenW (lpString=".MDF") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".MDF") returned 0x0 [0081.894] lstrlenW (lpString=".DBF") returned 4 [0081.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".DBF") returned 0x0 [0081.895] lstrlenW (lpString=".DB") returned 3 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".DB") returned 0x0 [0081.895] lstrlenW (lpString=".db") returned 3 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".db") returned 0x0 [0081.895] lstrlenW (lpString=".ndf") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".ndf") returned 0x0 [0081.895] lstrlenW (lpString=".NDF") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".NDF") returned 0x0 [0081.895] lstrlenW (lpString=".Mdf") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".Mdf") returned 0x0 [0081.895] lstrlenW (lpString=".dat") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".dat") returned 0x0 [0081.895] lstrlenW (lpString=".DAT") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".DAT") returned 0x0 [0081.895] lstrlenW (lpString=".ldf") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".ldf") returned 0x0 [0081.895] lstrlenW (lpString=".LDF") returned 4 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch=".LDF") returned 0x0 [0081.895] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.895] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2360) returned 1 [0081.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.896] CryptReleaseContext (hProv=0x2d2360, dwFlags=0x0) returned 1 [0081.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.896] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20189750691) returned 1 [0081.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbf9fbcf0, dwHighDateTime=0x1d585b4)) [0081.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338800 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338800 | out: hHeap=0x260000) returned 1 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.897] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.897] GetLastError () returned 0x0 [0081.897] GetLastError () returned 0x0 [0081.898] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.898] GetLastError () returned 0x0 [0081.898] GetLastError () returned 0x0 [0081.902] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.903] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.904] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.904] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.905] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.905] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.905] CloseHandle (hObject=0x11c) returned 1 [0081.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0081.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.[deadmin@cock.li].deadmin")) returned 1 [0081.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0081.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.907] GetLastError () returned 0x0 [0081.907] RtlWakeConditionVariable () returned 0x0 [0081.907] GetCurrentThreadId () returned 0x98c [0081.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".ldf") returned 0x0 [0081.907] lstrlenW (lpString=".vhd") returned 4 [0081.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".vhd") returned 0x0 [0081.907] lstrlenW (lpString=".vhdx") returned 5 [0081.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".vhdx") returned 0x0 [0081.907] lstrlenW (lpString=".pst") returned 4 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".pst") returned 0x0 [0081.908] lstrlenW (lpString=".ost") returned 4 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".ost") returned 0x0 [0081.908] lstrlenW (lpString=".bak") returned 4 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".bak") returned 0x0 [0081.908] lstrlenW (lpString=".bac") returned 4 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".bac") returned 0x0 [0081.908] lstrlenW (lpString=".sys") returned 4 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".sys") returned 0x0 [0081.908] lstrlenW (lpString=".v2i") returned 4 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".v2i") returned 0x0 [0081.908] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0081.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.910] lstrlenW (lpString=".sql") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".sql") returned 0x0 [0081.910] lstrlenW (lpString=".mdf") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".mdf") returned 0x0 [0081.910] lstrlenW (lpString=".txt") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".txt") returned 0x0 [0081.910] lstrlenW (lpString=".dbf") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".dbf") returned 0x0 [0081.910] lstrlenW (lpString=".ckp") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".ckp") returned 0x0 [0081.910] lstrlenW (lpString=".dacpac") returned 7 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".dacpac") returned 0x0 [0081.910] lstrlenW (lpString=".db3") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".db3") returned 0x0 [0081.910] lstrlenW (lpString=".dtxs") returned 5 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".dtxs") returned 0x0 [0081.910] lstrlenW (lpString=".mdt") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".mdt") returned 0x0 [0081.910] lstrlenW (lpString=".sdf") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".sdf") returned 0x0 [0081.910] lstrlenW (lpString=".MDF") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".MDF") returned 0x0 [0081.910] lstrlenW (lpString=".DBF") returned 4 [0081.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".DBF") returned 0x0 [0081.910] lstrlenW (lpString=".DB") returned 3 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".DB") returned 0x0 [0081.911] lstrlenW (lpString=".db") returned 3 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".db") returned 0x0 [0081.911] lstrlenW (lpString=".ndf") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".ndf") returned 0x0 [0081.911] lstrlenW (lpString=".NDF") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".NDF") returned 0x0 [0081.911] lstrlenW (lpString=".Mdf") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".Mdf") returned 0x0 [0081.911] lstrlenW (lpString=".dat") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".dat") returned 0x0 [0081.911] lstrlenW (lpString=".DAT") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".DAT") returned 0x0 [0081.911] lstrlenW (lpString=".ldf") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".ldf") returned 0x0 [0081.911] lstrlenW (lpString=".LDF") returned 4 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch=".LDF") returned 0x0 [0081.911] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.911] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d27a0) returned 1 [0081.912] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.912] CryptReleaseContext (hProv=0x2d27a0, dwFlags=0x0) returned 1 [0081.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.912] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20191347299) returned 1 [0081.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfa21e50, dwHighDateTime=0x1d585b4)) [0081.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338838 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338838 | out: hHeap=0x260000) returned 1 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.913] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.913] GetLastError () returned 0x0 [0081.913] GetLastError () returned 0x0 [0081.914] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.914] GetLastError () returned 0x0 [0081.914] GetLastError () returned 0x0 [0081.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.917] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.918] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.918] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.920] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.920] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.920] CloseHandle (hObject=0x11c) returned 1 [0081.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0081.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.[deadmin@cock.li].deadmin")) returned 1 [0081.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0081.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.922] GetLastError () returned 0x0 [0081.922] RtlWakeConditionVariable () returned 0x0 [0081.922] GetCurrentThreadId () returned 0x98c [0081.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".ldf") returned 0x0 [0081.922] lstrlenW (lpString=".vhd") returned 4 [0081.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".vhd") returned 0x0 [0081.922] lstrlenW (lpString=".vhdx") returned 5 [0081.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".vhdx") returned 0x0 [0081.922] lstrlenW (lpString=".pst") returned 4 [0081.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".pst") returned 0x0 [0081.922] lstrlenW (lpString=".ost") returned 4 [0081.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".ost") returned 0x0 [0081.923] lstrlenW (lpString=".bak") returned 4 [0081.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".bak") returned 0x0 [0081.923] lstrlenW (lpString=".bac") returned 4 [0081.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".bac") returned 0x0 [0081.923] lstrlenW (lpString=".sys") returned 4 [0081.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".sys") returned 0x0 [0081.923] lstrlenW (lpString=".v2i") returned 4 [0081.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".v2i") returned 0x0 [0081.923] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch="s\r\n.v2i") returned 0x0 [0081.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.924] lstrlenW (lpString=".sql") returned 4 [0081.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".sql") returned 0x0 [0081.924] lstrlenW (lpString=".mdf") returned 4 [0081.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".mdf") returned 0x0 [0081.924] lstrlenW (lpString=".txt") returned 4 [0081.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".txt") returned 0x0 [0081.924] lstrlenW (lpString=".dbf") returned 4 [0081.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".dbf") returned 0x0 [0081.924] lstrlenW (lpString=".ckp") returned 4 [0081.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".ckp") returned 0x0 [0081.925] lstrlenW (lpString=".dacpac") returned 7 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".dacpac") returned 0x0 [0081.925] lstrlenW (lpString=".db3") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".db3") returned 0x0 [0081.925] lstrlenW (lpString=".dtxs") returned 5 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".dtxs") returned 0x0 [0081.925] lstrlenW (lpString=".mdt") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".mdt") returned 0x0 [0081.925] lstrlenW (lpString=".sdf") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".sdf") returned 0x0 [0081.925] lstrlenW (lpString=".MDF") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".MDF") returned 0x0 [0081.925] lstrlenW (lpString=".DBF") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".DBF") returned 0x0 [0081.925] lstrlenW (lpString=".DB") returned 3 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".DB") returned 0x0 [0081.925] lstrlenW (lpString=".db") returned 3 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".db") returned 0x0 [0081.925] lstrlenW (lpString=".ndf") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".ndf") returned 0x0 [0081.925] lstrlenW (lpString=".NDF") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".NDF") returned 0x0 [0081.925] lstrlenW (lpString=".Mdf") returned 4 [0081.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".Mdf") returned 0x0 [0081.925] lstrlenW (lpString=".dat") returned 4 [0081.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".dat") returned 0x0 [0081.926] lstrlenW (lpString=".DAT") returned 4 [0081.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".DAT") returned 0x0 [0081.926] lstrlenW (lpString=".ldf") returned 4 [0081.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".ldf") returned 0x0 [0081.926] lstrlenW (lpString=".LDF") returned 4 [0081.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch=".LDF") returned 0x0 [0081.926] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.926] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2828) returned 1 [0081.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.927] CryptReleaseContext (hProv=0x2d2828, dwFlags=0x0) returned 1 [0081.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.927] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20192808394) returned 1 [0081.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfa47fb0, dwHighDateTime=0x1d585b4)) [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338870 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338870 | out: hHeap=0x260000) returned 1 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.928] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0081.928] GetLastError () returned 0x0 [0081.928] GetLastError () returned 0x0 [0081.928] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0081.928] GetLastError () returned 0x0 [0081.928] GetLastError () returned 0x0 [0081.949] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff84f7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.949] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7b09, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x7b09, lpOverlapped=0x0) returned 1 [0081.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.968] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.968] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.968] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.968] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.968] CloseHandle (hObject=0x11c) returned 1 [0081.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0081.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.[deadmin@cock.li].deadmin")) returned 1 [0082.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.100] GetLastError () returned 0x0 [0082.111] RtlWakeConditionVariable () returned 0x0 [0082.119] GetCurrentThreadId () returned 0x98c [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".ldf") returned 0x0 [0082.119] lstrlenW (lpString=".vhd") returned 4 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".vhd") returned 0x0 [0082.119] lstrlenW (lpString=".vhdx") returned 5 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".vhdx") returned 0x0 [0082.119] lstrlenW (lpString=".pst") returned 4 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".pst") returned 0x0 [0082.119] lstrlenW (lpString=".ost") returned 4 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".ost") returned 0x0 [0082.119] lstrlenW (lpString=".bak") returned 4 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".bak") returned 0x0 [0082.119] lstrlenW (lpString=".bac") returned 4 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".bac") returned 0x0 [0082.119] lstrlenW (lpString=".sys") returned 4 [0082.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".sys") returned 0x0 [0082.120] lstrlenW (lpString=".v2i") returned 4 [0082.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".v2i") returned 0x0 [0082.120] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.120] lstrlenW (lpString=".sql") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".sql") returned 0x0 [0082.121] lstrlenW (lpString=".mdf") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".mdf") returned 0x0 [0082.121] lstrlenW (lpString=".txt") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".txt") returned 0x0 [0082.121] lstrlenW (lpString=".dbf") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".dbf") returned 0x0 [0082.121] lstrlenW (lpString=".ckp") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".ckp") returned 0x0 [0082.121] lstrlenW (lpString=".dacpac") returned 7 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".dacpac") returned 0x0 [0082.121] lstrlenW (lpString=".db3") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".db3") returned 0x0 [0082.121] lstrlenW (lpString=".dtxs") returned 5 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".dtxs") returned 0x0 [0082.121] lstrlenW (lpString=".mdt") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".mdt") returned 0x0 [0082.121] lstrlenW (lpString=".sdf") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".sdf") returned 0x0 [0082.121] lstrlenW (lpString=".MDF") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".MDF") returned 0x0 [0082.121] lstrlenW (lpString=".DBF") returned 4 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".DBF") returned 0x0 [0082.121] lstrlenW (lpString=".DB") returned 3 [0082.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".DB") returned 0x0 [0082.121] lstrlenW (lpString=".db") returned 3 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".db") returned 0x0 [0082.122] lstrlenW (lpString=".ndf") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".ndf") returned 0x0 [0082.122] lstrlenW (lpString=".NDF") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".NDF") returned 0x0 [0082.122] lstrlenW (lpString=".Mdf") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".Mdf") returned 0x0 [0082.122] lstrlenW (lpString=".dat") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".dat") returned 0x0 [0082.122] lstrlenW (lpString=".DAT") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".DAT") returned 0x0 [0082.122] lstrlenW (lpString=".ldf") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".ldf") returned 0x0 [0082.122] lstrlenW (lpString=".LDF") returned 4 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch=".LDF") returned 0x0 [0082.122] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f150 [0082.122] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d28b0) returned 1 [0082.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f150 | out: pbBuffer=0x27f150) returned 1 [0082.123] CryptReleaseContext (hProv=0x2d28b0, dwFlags=0x0) returned 1 [0082.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f150 | out: hHeap=0x260000) returned 1 [0082.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.123] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20212671233) returned 1 [0082.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfc37190, dwHighDateTime=0x1d585b4)) [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762140 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762140 | out: hHeap=0x260000) returned 1 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27643f0 [0082.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.127] GetLastError () returned 0x0 [0082.127] GetLastError () returned 0x0 [0082.127] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.127] GetLastError () returned 0x0 [0082.127] GetLastError () returned 0x0 [0082.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd650, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.129] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x29b0, lpOverlapped=0x0) returned 1 [0082.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.129] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.129] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.129] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.129] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.130] CloseHandle (hObject=0xf0) returned 1 [0082.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.133] GetLastError () returned 0x0 [0082.133] RtlWakeConditionVariable () returned 0x0 [0082.134] GetCurrentThreadId () returned 0x98c [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".ldf") returned 0x0 [0082.134] lstrlenW (lpString=".vhd") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".vhd") returned 0x0 [0082.134] lstrlenW (lpString=".vhdx") returned 5 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".vhdx") returned 0x0 [0082.134] lstrlenW (lpString=".pst") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".pst") returned 0x0 [0082.134] lstrlenW (lpString=".ost") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".ost") returned 0x0 [0082.134] lstrlenW (lpString=".bak") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".bak") returned 0x0 [0082.134] lstrlenW (lpString=".bac") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".bac") returned 0x0 [0082.134] lstrlenW (lpString=".sys") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".sys") returned 0x0 [0082.134] lstrlenW (lpString=".v2i") returned 4 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".v2i") returned 0x0 [0082.134] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.135] lstrlenW (lpString=".sql") returned 4 [0082.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".sql") returned 0x0 [0082.135] lstrlenW (lpString=".mdf") returned 4 [0082.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".mdf") returned 0x0 [0082.136] lstrlenW (lpString=".txt") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".txt") returned 0x0 [0082.136] lstrlenW (lpString=".dbf") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".dbf") returned 0x0 [0082.136] lstrlenW (lpString=".ckp") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".ckp") returned 0x0 [0082.136] lstrlenW (lpString=".dacpac") returned 7 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".dacpac") returned 0x0 [0082.136] lstrlenW (lpString=".db3") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".db3") returned 0x0 [0082.136] lstrlenW (lpString=".dtxs") returned 5 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".dtxs") returned 0x0 [0082.136] lstrlenW (lpString=".mdt") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".mdt") returned 0x0 [0082.136] lstrlenW (lpString=".sdf") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".sdf") returned 0x0 [0082.136] lstrlenW (lpString=".MDF") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".MDF") returned 0x0 [0082.136] lstrlenW (lpString=".DBF") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".DBF") returned 0x0 [0082.136] lstrlenW (lpString=".DB") returned 3 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".DB") returned 0x0 [0082.136] lstrlenW (lpString=".db") returned 3 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".db") returned 0x0 [0082.136] lstrlenW (lpString=".ndf") returned 4 [0082.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".ndf") returned 0x0 [0082.137] lstrlenW (lpString=".NDF") returned 4 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".NDF") returned 0x0 [0082.137] lstrlenW (lpString=".Mdf") returned 4 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".Mdf") returned 0x0 [0082.137] lstrlenW (lpString=".dat") returned 4 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".dat") returned 0x0 [0082.137] lstrlenW (lpString=".DAT") returned 4 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".DAT") returned 0x0 [0082.137] lstrlenW (lpString=".ldf") returned 4 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".ldf") returned 0x0 [0082.137] lstrlenW (lpString=".LDF") returned 4 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch=".LDF") returned 0x0 [0082.137] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f150 [0082.137] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d28b0) returned 1 [0082.138] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f150 | out: pbBuffer=0x27f150) returned 1 [0082.138] CryptReleaseContext (hProv=0x2d28b0, dwFlags=0x0) returned 1 [0082.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f150 | out: hHeap=0x260000) returned 1 [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.138] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20213928007) returned 1 [0082.138] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfc5d2f0, dwHighDateTime=0x1d585b4)) [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27620d0 [0082.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0082.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27620d0 | out: hHeap=0x260000) returned 1 [0082.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0082.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325df0 [0082.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.139] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.139] GetLastError () returned 0x0 [0082.139] GetLastError () returned 0x0 [0082.139] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.139] GetLastError () returned 0x0 [0082.140] GetLastError () returned 0x0 [0082.141] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffce60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.142] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x31a0, lpOverlapped=0x0) returned 1 [0082.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.142] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.142] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.142] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.142] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.142] CloseHandle (hObject=0xf0) returned 1 [0082.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.143] GetLastError () returned 0x0 [0082.143] RtlWakeConditionVariable () returned 0x0 [0082.144] GetCurrentThreadId () returned 0x98c [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".ldf") returned 0x0 [0082.144] lstrlenW (lpString=".vhd") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".vhd") returned 0x0 [0082.144] lstrlenW (lpString=".vhdx") returned 5 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".vhdx") returned 0x0 [0082.144] lstrlenW (lpString=".pst") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".pst") returned 0x0 [0082.144] lstrlenW (lpString=".ost") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".ost") returned 0x0 [0082.144] lstrlenW (lpString=".bak") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".bak") returned 0x0 [0082.144] lstrlenW (lpString=".bac") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".bac") returned 0x0 [0082.144] lstrlenW (lpString=".sys") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".sys") returned 0x0 [0082.144] lstrlenW (lpString=".v2i") returned 4 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".v2i") returned 0x0 [0082.144] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.145] lstrlenW (lpString=".sql") returned 4 [0082.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".sql") returned 0x0 [0082.145] lstrlenW (lpString=".mdf") returned 4 [0082.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".mdf") returned 0x0 [0082.145] lstrlenW (lpString=".txt") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".txt") returned 0x0 [0082.146] lstrlenW (lpString=".dbf") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".dbf") returned 0x0 [0082.146] lstrlenW (lpString=".ckp") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".ckp") returned 0x0 [0082.146] lstrlenW (lpString=".dacpac") returned 7 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".dacpac") returned 0x0 [0082.146] lstrlenW (lpString=".db3") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".db3") returned 0x0 [0082.146] lstrlenW (lpString=".dtxs") returned 5 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".dtxs") returned 0x0 [0082.146] lstrlenW (lpString=".mdt") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".mdt") returned 0x0 [0082.146] lstrlenW (lpString=".sdf") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".sdf") returned 0x0 [0082.146] lstrlenW (lpString=".MDF") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".MDF") returned 0x0 [0082.146] lstrlenW (lpString=".DBF") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".DBF") returned 0x0 [0082.146] lstrlenW (lpString=".DB") returned 3 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".DB") returned 0x0 [0082.146] lstrlenW (lpString=".db") returned 3 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".db") returned 0x0 [0082.146] lstrlenW (lpString=".ndf") returned 4 [0082.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".ndf") returned 0x0 [0082.146] lstrlenW (lpString=".NDF") returned 4 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".NDF") returned 0x0 [0082.147] lstrlenW (lpString=".Mdf") returned 4 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".Mdf") returned 0x0 [0082.147] lstrlenW (lpString=".dat") returned 4 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".dat") returned 0x0 [0082.147] lstrlenW (lpString=".DAT") returned 4 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".DAT") returned 0x0 [0082.147] lstrlenW (lpString=".ldf") returned 4 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".ldf") returned 0x0 [0082.147] lstrlenW (lpString=".LDF") returned 4 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch=".LDF") returned 0x0 [0082.147] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f178 [0082.147] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2a48) returned 1 [0082.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f178 | out: pbBuffer=0x27f178) returned 1 [0082.148] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f178 | out: hHeap=0x260000) returned 1 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.148] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20214920592) returned 1 [0082.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfc5d2f0, dwHighDateTime=0x1d585b4)) [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762108 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762108 | out: hHeap=0x260000) returned 1 [0082.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0082.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.149] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.149] GetLastError () returned 0x0 [0082.149] GetLastError () returned 0x0 [0082.149] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.149] GetLastError () returned 0x0 [0082.149] GetLastError () returned 0x0 [0082.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd478, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.200] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2b88, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2b88, lpOverlapped=0x0) returned 1 [0082.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.200] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.200] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.200] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.201] CloseHandle (hObject=0xf0) returned 1 [0082.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.206] GetLastError () returned 0x0 [0082.206] RtlWakeConditionVariable () returned 0x0 [0082.206] GetCurrentThreadId () returned 0x98c [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".ldf") returned 0x0 [0082.206] lstrlenW (lpString=".vhd") returned 4 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".vhd") returned 0x0 [0082.206] lstrlenW (lpString=".vhdx") returned 5 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".vhdx") returned 0x0 [0082.206] lstrlenW (lpString=".pst") returned 4 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".pst") returned 0x0 [0082.206] lstrlenW (lpString=".ost") returned 4 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".ost") returned 0x0 [0082.206] lstrlenW (lpString=".bak") returned 4 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".bak") returned 0x0 [0082.206] lstrlenW (lpString=".bac") returned 4 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".bac") returned 0x0 [0082.206] lstrlenW (lpString=".sys") returned 4 [0082.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".sys") returned 0x0 [0082.206] lstrlenW (lpString=".v2i") returned 4 [0082.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".v2i") returned 0x0 [0082.207] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.220] lstrlenW (lpString=".sql") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".sql") returned 0x0 [0082.221] lstrlenW (lpString=".mdf") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".mdf") returned 0x0 [0082.221] lstrlenW (lpString=".txt") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".txt") returned 0x0 [0082.221] lstrlenW (lpString=".dbf") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".dbf") returned 0x0 [0082.221] lstrlenW (lpString=".ckp") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".ckp") returned 0x0 [0082.221] lstrlenW (lpString=".dacpac") returned 7 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".dacpac") returned 0x0 [0082.221] lstrlenW (lpString=".db3") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".db3") returned 0x0 [0082.221] lstrlenW (lpString=".dtxs") returned 5 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".dtxs") returned 0x0 [0082.221] lstrlenW (lpString=".mdt") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".mdt") returned 0x0 [0082.221] lstrlenW (lpString=".sdf") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".sdf") returned 0x0 [0082.221] lstrlenW (lpString=".MDF") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".MDF") returned 0x0 [0082.221] lstrlenW (lpString=".DBF") returned 4 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".DBF") returned 0x0 [0082.221] lstrlenW (lpString=".DB") returned 3 [0082.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".DB") returned 0x0 [0082.222] lstrlenW (lpString=".db") returned 3 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".db") returned 0x0 [0082.222] lstrlenW (lpString=".ndf") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".ndf") returned 0x0 [0082.222] lstrlenW (lpString=".NDF") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".NDF") returned 0x0 [0082.222] lstrlenW (lpString=".Mdf") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".Mdf") returned 0x0 [0082.222] lstrlenW (lpString=".dat") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".dat") returned 0x0 [0082.222] lstrlenW (lpString=".DAT") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".DAT") returned 0x0 [0082.222] lstrlenW (lpString=".ldf") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".ldf") returned 0x0 [0082.222] lstrlenW (lpString=".LDF") returned 4 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch=".LDF") returned 0x0 [0082.222] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.222] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d28b0) returned 1 [0082.223] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.223] CryptReleaseContext (hProv=0x2d28b0, dwFlags=0x0) returned 1 [0082.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.223] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20222441170) returned 1 [0082.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfd1b9d0, dwHighDateTime=0x1d585b4)) [0082.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338b48 [0082.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338b48 | out: hHeap=0x260000) returned 1 [0082.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0082.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.224] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.224] GetLastError () returned 0x0 [0082.224] GetLastError () returned 0x0 [0082.224] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.225] GetLastError () returned 0x0 [0082.225] GetLastError () returned 0x0 [0082.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff0688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.227] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf978, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xf978, lpOverlapped=0x0) returned 1 [0082.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.227] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.227] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.227] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.227] CloseHandle (hObject=0xf0) returned 1 [0082.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.229] GetLastError () returned 0x0 [0082.229] RtlWakeConditionVariable () returned 0x16f340 [0082.229] GetCurrentThreadId () returned 0x98c [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".ldf") returned 0x0 [0082.229] lstrlenW (lpString=".vhd") returned 4 [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".vhd") returned 0x0 [0082.229] lstrlenW (lpString=".vhdx") returned 5 [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".vhdx") returned 0x0 [0082.229] lstrlenW (lpString=".pst") returned 4 [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".pst") returned 0x0 [0082.229] lstrlenW (lpString=".ost") returned 4 [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".ost") returned 0x0 [0082.229] lstrlenW (lpString=".bak") returned 4 [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".bak") returned 0x0 [0082.229] lstrlenW (lpString=".bac") returned 4 [0082.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".bac") returned 0x0 [0082.229] lstrlenW (lpString=".sys") returned 4 [0082.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".sys") returned 0x0 [0082.230] lstrlenW (lpString=".v2i") returned 4 [0082.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".v2i") returned 0x0 [0082.230] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.231] lstrlenW (lpString=".sql") returned 4 [0082.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".sql") returned 0x0 [0082.231] lstrlenW (lpString=".mdf") returned 4 [0082.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".mdf") returned 0x0 [0082.231] lstrlenW (lpString=".txt") returned 4 [0082.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".txt") returned 0x0 [0082.231] lstrlenW (lpString=".dbf") returned 4 [0082.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".dbf") returned 0x0 [0082.231] lstrlenW (lpString=".ckp") returned 4 [0082.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".ckp") returned 0x0 [0082.231] lstrlenW (lpString=".dacpac") returned 7 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".dacpac") returned 0x0 [0082.232] lstrlenW (lpString=".db3") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".db3") returned 0x0 [0082.232] lstrlenW (lpString=".dtxs") returned 5 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".dtxs") returned 0x0 [0082.232] lstrlenW (lpString=".mdt") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".mdt") returned 0x0 [0082.232] lstrlenW (lpString=".sdf") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".sdf") returned 0x0 [0082.232] lstrlenW (lpString=".MDF") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".MDF") returned 0x0 [0082.232] lstrlenW (lpString=".DBF") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".DBF") returned 0x0 [0082.232] lstrlenW (lpString=".DB") returned 3 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".DB") returned 0x0 [0082.232] lstrlenW (lpString=".db") returned 3 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".db") returned 0x0 [0082.232] lstrlenW (lpString=".ndf") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".ndf") returned 0x0 [0082.232] lstrlenW (lpString=".NDF") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".NDF") returned 0x0 [0082.232] lstrlenW (lpString=".Mdf") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".Mdf") returned 0x0 [0082.232] lstrlenW (lpString=".dat") returned 4 [0082.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".dat") returned 0x0 [0082.233] lstrlenW (lpString=".DAT") returned 4 [0082.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".DAT") returned 0x0 [0082.233] lstrlenW (lpString=".ldf") returned 4 [0082.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".ldf") returned 0x0 [0082.233] lstrlenW (lpString=".LDF") returned 4 [0082.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch=".LDF") returned 0x0 [0082.233] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.233] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2690) returned 1 [0082.234] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.234] CryptReleaseContext (hProv=0x2d2690, dwFlags=0x0) returned 1 [0082.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.234] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20223503709) returned 1 [0082.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfd41b30, dwHighDateTime=0x1d585b4)) [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338b80 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338b80 | out: hHeap=0x260000) returned 1 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325af8 [0082.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.235] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.235] GetLastError () returned 0x0 [0082.235] GetLastError () returned 0x0 [0082.235] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.235] GetLastError () returned 0x0 [0082.235] GetLastError () returned 0x0 [0082.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.238] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.239] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.239] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.239] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.239] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.239] CloseHandle (hObject=0xf0) returned 1 [0082.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.241] GetLastError () returned 0x0 [0082.241] RtlWakeConditionVariable () returned 0x0 [0082.241] GetCurrentThreadId () returned 0x98c [0082.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".ldf") returned 0x0 [0082.241] lstrlenW (lpString=".vhd") returned 4 [0082.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".vhd") returned 0x0 [0082.241] lstrlenW (lpString=".vhdx") returned 5 [0082.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".vhdx") returned 0x0 [0082.241] lstrlenW (lpString=".pst") returned 4 [0082.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".pst") returned 0x0 [0082.241] lstrlenW (lpString=".ost") returned 4 [0082.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".ost") returned 0x0 [0082.241] lstrlenW (lpString=".bak") returned 4 [0082.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".bak") returned 0x0 [0082.241] lstrlenW (lpString=".bac") returned 4 [0082.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".bac") returned 0x0 [0082.242] lstrlenW (lpString=".sys") returned 4 [0082.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".sys") returned 0x0 [0082.242] lstrlenW (lpString=".v2i") returned 4 [0082.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".v2i") returned 0x0 [0082.242] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.243] lstrlenW (lpString=".sql") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".sql") returned 0x0 [0082.243] lstrlenW (lpString=".mdf") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".mdf") returned 0x0 [0082.243] lstrlenW (lpString=".txt") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".txt") returned 0x0 [0082.243] lstrlenW (lpString=".dbf") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".dbf") returned 0x0 [0082.243] lstrlenW (lpString=".ckp") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".ckp") returned 0x0 [0082.243] lstrlenW (lpString=".dacpac") returned 7 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".dacpac") returned 0x0 [0082.243] lstrlenW (lpString=".db3") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".db3") returned 0x0 [0082.243] lstrlenW (lpString=".dtxs") returned 5 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".dtxs") returned 0x0 [0082.243] lstrlenW (lpString=".mdt") returned 4 [0082.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".mdt") returned 0x0 [0082.243] lstrlenW (lpString=".sdf") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".sdf") returned 0x0 [0082.244] lstrlenW (lpString=".MDF") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".MDF") returned 0x0 [0082.244] lstrlenW (lpString=".DBF") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".DBF") returned 0x0 [0082.244] lstrlenW (lpString=".DB") returned 3 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".DB") returned 0x0 [0082.244] lstrlenW (lpString=".db") returned 3 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".db") returned 0x0 [0082.244] lstrlenW (lpString=".ndf") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".ndf") returned 0x0 [0082.244] lstrlenW (lpString=".NDF") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".NDF") returned 0x0 [0082.244] lstrlenW (lpString=".Mdf") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".Mdf") returned 0x0 [0082.244] lstrlenW (lpString=".dat") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".dat") returned 0x0 [0082.244] lstrlenW (lpString=".DAT") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".DAT") returned 0x0 [0082.244] lstrlenW (lpString=".ldf") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".ldf") returned 0x0 [0082.244] lstrlenW (lpString=".LDF") returned 4 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch=".LDF") returned 0x0 [0082.244] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.245] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2690) returned 1 [0082.245] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.245] CryptReleaseContext (hProv=0x2d2690, dwFlags=0x0) returned 1 [0082.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.246] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20224669320) returned 1 [0082.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfd67c90, dwHighDateTime=0x1d585b4)) [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338bb8 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338bb8 | out: hHeap=0x260000) returned 1 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324fb0 [0082.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.246] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.246] GetLastError () returned 0x0 [0082.247] GetLastError () returned 0x0 [0082.247] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.247] GetLastError () returned 0x0 [0082.247] GetLastError () returned 0x0 [0082.249] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.250] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.250] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.251] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.251] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.251] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.251] CloseHandle (hObject=0xf0) returned 1 [0082.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.252] GetLastError () returned 0x0 [0082.252] RtlWakeConditionVariable () returned 0x27e828 [0082.252] GetCurrentThreadId () returned 0x98c [0082.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".ldf") returned 0x0 [0082.252] lstrlenW (lpString=".vhd") returned 4 [0082.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".vhd") returned 0x0 [0082.253] lstrlenW (lpString=".vhdx") returned 5 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".vhdx") returned 0x0 [0082.253] lstrlenW (lpString=".pst") returned 4 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".pst") returned 0x0 [0082.253] lstrlenW (lpString=".ost") returned 4 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".ost") returned 0x0 [0082.253] lstrlenW (lpString=".bak") returned 4 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".bak") returned 0x0 [0082.253] lstrlenW (lpString=".bac") returned 4 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".bac") returned 0x0 [0082.253] lstrlenW (lpString=".sys") returned 4 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".sys") returned 0x0 [0082.253] lstrlenW (lpString=".v2i") returned 4 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".v2i") returned 0x0 [0082.253] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.257] lstrlenW (lpString=".sql") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".sql") returned 0x0 [0082.257] lstrlenW (lpString=".mdf") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".mdf") returned 0x0 [0082.257] lstrlenW (lpString=".txt") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".txt") returned 0x0 [0082.257] lstrlenW (lpString=".dbf") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".dbf") returned 0x0 [0082.257] lstrlenW (lpString=".ckp") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".ckp") returned 0x0 [0082.257] lstrlenW (lpString=".dacpac") returned 7 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".dacpac") returned 0x0 [0082.257] lstrlenW (lpString=".db3") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".db3") returned 0x0 [0082.257] lstrlenW (lpString=".dtxs") returned 5 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".dtxs") returned 0x0 [0082.257] lstrlenW (lpString=".mdt") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".mdt") returned 0x0 [0082.257] lstrlenW (lpString=".sdf") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".sdf") returned 0x0 [0082.257] lstrlenW (lpString=".MDF") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".MDF") returned 0x0 [0082.257] lstrlenW (lpString=".DBF") returned 4 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".DBF") returned 0x0 [0082.257] lstrlenW (lpString=".DB") returned 3 [0082.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".DB") returned 0x0 [0082.258] lstrlenW (lpString=".db") returned 3 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".db") returned 0x0 [0082.258] lstrlenW (lpString=".ndf") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".ndf") returned 0x0 [0082.258] lstrlenW (lpString=".NDF") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".NDF") returned 0x0 [0082.258] lstrlenW (lpString=".Mdf") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".Mdf") returned 0x0 [0082.258] lstrlenW (lpString=".dat") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".dat") returned 0x0 [0082.258] lstrlenW (lpString=".DAT") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".DAT") returned 0x0 [0082.258] lstrlenW (lpString=".ldf") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".ldf") returned 0x0 [0082.258] lstrlenW (lpString=".LDF") returned 4 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch=".LDF") returned 0x0 [0082.258] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.258] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2a48) returned 1 [0082.259] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.259] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.259] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20226058530) returned 1 [0082.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfd8ddf0, dwHighDateTime=0x1d585b4)) [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338bf0 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338bf0 | out: hHeap=0x260000) returned 1 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3259c8 [0082.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.260] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.260] GetLastError () returned 0x0 [0082.261] GetLastError () returned 0x0 [0082.261] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.261] GetLastError () returned 0x0 [0082.261] GetLastError () returned 0x0 [0082.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffee860, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.263] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x117a0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x117a0, lpOverlapped=0x0) returned 1 [0082.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.263] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.263] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.263] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.264] CloseHandle (hObject=0xf0) returned 1 [0082.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.265] GetLastError () returned 0x0 [0082.265] RtlWakeConditionVariable () returned 0x27e828 [0082.265] GetCurrentThreadId () returned 0x98c [0082.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".ldf") returned 0x0 [0082.265] lstrlenW (lpString=".vhd") returned 4 [0082.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".vhd") returned 0x0 [0082.265] lstrlenW (lpString=".vhdx") returned 5 [0082.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".vhdx") returned 0x0 [0082.265] lstrlenW (lpString=".pst") returned 4 [0082.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".pst") returned 0x0 [0082.265] lstrlenW (lpString=".ost") returned 4 [0082.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".ost") returned 0x0 [0082.265] lstrlenW (lpString=".bak") returned 4 [0082.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".bak") returned 0x0 [0082.266] lstrlenW (lpString=".bac") returned 4 [0082.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".bac") returned 0x0 [0082.266] lstrlenW (lpString=".sys") returned 4 [0082.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".sys") returned 0x0 [0082.266] lstrlenW (lpString=".v2i") returned 4 [0082.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".v2i") returned 0x0 [0082.266] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.267] lstrlenW (lpString=".sql") returned 4 [0082.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".sql") returned 0x0 [0082.267] lstrlenW (lpString=".mdf") returned 4 [0082.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".mdf") returned 0x0 [0082.267] lstrlenW (lpString=".txt") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".txt") returned 0x0 [0082.268] lstrlenW (lpString=".dbf") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".dbf") returned 0x0 [0082.268] lstrlenW (lpString=".ckp") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".ckp") returned 0x0 [0082.268] lstrlenW (lpString=".dacpac") returned 7 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".dacpac") returned 0x0 [0082.268] lstrlenW (lpString=".db3") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".db3") returned 0x0 [0082.268] lstrlenW (lpString=".dtxs") returned 5 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".dtxs") returned 0x0 [0082.268] lstrlenW (lpString=".mdt") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".mdt") returned 0x0 [0082.268] lstrlenW (lpString=".sdf") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".sdf") returned 0x0 [0082.268] lstrlenW (lpString=".MDF") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".MDF") returned 0x0 [0082.268] lstrlenW (lpString=".DBF") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".DBF") returned 0x0 [0082.268] lstrlenW (lpString=".DB") returned 3 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".DB") returned 0x0 [0082.268] lstrlenW (lpString=".db") returned 3 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".db") returned 0x0 [0082.268] lstrlenW (lpString=".ndf") returned 4 [0082.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".ndf") returned 0x0 [0082.268] lstrlenW (lpString=".NDF") returned 4 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".NDF") returned 0x0 [0082.269] lstrlenW (lpString=".Mdf") returned 4 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".Mdf") returned 0x0 [0082.269] lstrlenW (lpString=".dat") returned 4 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".dat") returned 0x0 [0082.269] lstrlenW (lpString=".DAT") returned 4 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".DAT") returned 0x0 [0082.269] lstrlenW (lpString=".ldf") returned 4 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".ldf") returned 0x0 [0082.269] lstrlenW (lpString=".LDF") returned 4 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch=".LDF") returned 0x0 [0082.269] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.269] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2a48) returned 1 [0082.270] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.270] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.270] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20227119741) returned 1 [0082.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfd8ddf0, dwHighDateTime=0x1d585b4)) [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338c28 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338c28 | out: hHeap=0x260000) returned 1 [0082.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325930 [0082.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.271] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.271] GetLastError () returned 0x0 [0082.271] GetLastError () returned 0x0 [0082.271] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.271] GetLastError () returned 0x0 [0082.271] GetLastError () returned 0x0 [0082.273] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff0868, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.274] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf798, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xf798, lpOverlapped=0x0) returned 1 [0082.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.274] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.274] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.274] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.274] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.274] CloseHandle (hObject=0xf0) returned 1 [0082.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.275] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.276] GetLastError () returned 0x0 [0082.276] RtlWakeConditionVariable () returned 0x27e828 [0082.276] GetCurrentThreadId () returned 0x98c [0082.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".ldf") returned 0x0 [0082.276] lstrlenW (lpString=".vhd") returned 4 [0082.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".vhd") returned 0x0 [0082.276] lstrlenW (lpString=".vhdx") returned 5 [0082.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".vhdx") returned 0x0 [0082.276] lstrlenW (lpString=".pst") returned 4 [0082.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".pst") returned 0x0 [0082.276] lstrlenW (lpString=".ost") returned 4 [0082.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".ost") returned 0x0 [0082.276] lstrlenW (lpString=".bak") returned 4 [0082.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".bak") returned 0x0 [0082.277] lstrlenW (lpString=".bac") returned 4 [0082.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".bac") returned 0x0 [0082.277] lstrlenW (lpString=".sys") returned 4 [0082.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".sys") returned 0x0 [0082.277] lstrlenW (lpString=".v2i") returned 4 [0082.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".v2i") returned 0x0 [0082.277] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.278] lstrlenW (lpString=".sql") returned 4 [0082.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".sql") returned 0x0 [0082.278] lstrlenW (lpString=".mdf") returned 4 [0082.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".mdf") returned 0x0 [0082.278] lstrlenW (lpString=".txt") returned 4 [0082.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".txt") returned 0x0 [0082.278] lstrlenW (lpString=".dbf") returned 4 [0082.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".dbf") returned 0x0 [0082.278] lstrlenW (lpString=".ckp") returned 4 [0082.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".ckp") returned 0x0 [0082.278] lstrlenW (lpString=".dacpac") returned 7 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".dacpac") returned 0x0 [0082.279] lstrlenW (lpString=".db3") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".db3") returned 0x0 [0082.279] lstrlenW (lpString=".dtxs") returned 5 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".dtxs") returned 0x0 [0082.279] lstrlenW (lpString=".mdt") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".mdt") returned 0x0 [0082.279] lstrlenW (lpString=".sdf") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".sdf") returned 0x0 [0082.279] lstrlenW (lpString=".MDF") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".MDF") returned 0x0 [0082.279] lstrlenW (lpString=".DBF") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".DBF") returned 0x0 [0082.279] lstrlenW (lpString=".DB") returned 3 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".DB") returned 0x0 [0082.279] lstrlenW (lpString=".db") returned 3 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".db") returned 0x0 [0082.279] lstrlenW (lpString=".ndf") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".ndf") returned 0x0 [0082.279] lstrlenW (lpString=".NDF") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".NDF") returned 0x0 [0082.279] lstrlenW (lpString=".Mdf") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".Mdf") returned 0x0 [0082.279] lstrlenW (lpString=".dat") returned 4 [0082.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".dat") returned 0x0 [0082.279] lstrlenW (lpString=".DAT") returned 4 [0082.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".DAT") returned 0x0 [0082.280] lstrlenW (lpString=".ldf") returned 4 [0082.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".ldf") returned 0x0 [0082.280] lstrlenW (lpString=".LDF") returned 4 [0082.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch=".LDF") returned 0x0 [0082.280] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.280] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2a48) returned 1 [0082.281] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.281] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.281] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20228197978) returned 1 [0082.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfdb3f50, dwHighDateTime=0x1d585b4)) [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338c60 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338c60 | out: hHeap=0x260000) returned 1 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325898 [0082.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.282] GetLastError () returned 0x0 [0082.282] GetLastError () returned 0x0 [0082.282] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.282] GetLastError () returned 0x0 [0082.282] GetLastError () returned 0x0 [0082.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff3468, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.285] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcb98, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xcb98, lpOverlapped=0x0) returned 1 [0082.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.285] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.285] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.285] CloseHandle (hObject=0xf0) returned 1 [0082.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.286] GetLastError () returned 0x0 [0082.287] RtlWakeConditionVariable () returned 0x27e828 [0082.287] GetCurrentThreadId () returned 0x98c [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".ldf") returned 0x0 [0082.287] lstrlenW (lpString=".vhd") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".vhd") returned 0x0 [0082.287] lstrlenW (lpString=".vhdx") returned 5 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".vhdx") returned 0x0 [0082.287] lstrlenW (lpString=".pst") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".pst") returned 0x0 [0082.287] lstrlenW (lpString=".ost") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".ost") returned 0x0 [0082.287] lstrlenW (lpString=".bak") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".bak") returned 0x0 [0082.287] lstrlenW (lpString=".bac") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".bac") returned 0x0 [0082.287] lstrlenW (lpString=".sys") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".sys") returned 0x0 [0082.287] lstrlenW (lpString=".v2i") returned 4 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".v2i") returned 0x0 [0082.287] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.288] lstrlenW (lpString=".sql") returned 4 [0082.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".sql") returned 0x0 [0082.288] lstrlenW (lpString=".mdf") returned 4 [0082.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".mdf") returned 0x0 [0082.288] lstrlenW (lpString=".txt") returned 4 [0082.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".txt") returned 0x0 [0082.288] lstrlenW (lpString=".dbf") returned 4 [0082.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".dbf") returned 0x0 [0082.289] lstrlenW (lpString=".ckp") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".ckp") returned 0x0 [0082.289] lstrlenW (lpString=".dacpac") returned 7 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".dacpac") returned 0x0 [0082.289] lstrlenW (lpString=".db3") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".db3") returned 0x0 [0082.289] lstrlenW (lpString=".dtxs") returned 5 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".dtxs") returned 0x0 [0082.289] lstrlenW (lpString=".mdt") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".mdt") returned 0x0 [0082.289] lstrlenW (lpString=".sdf") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".sdf") returned 0x0 [0082.289] lstrlenW (lpString=".MDF") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".MDF") returned 0x0 [0082.289] lstrlenW (lpString=".DBF") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".DBF") returned 0x0 [0082.289] lstrlenW (lpString=".DB") returned 3 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".DB") returned 0x0 [0082.289] lstrlenW (lpString=".db") returned 3 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".db") returned 0x0 [0082.289] lstrlenW (lpString=".ndf") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".ndf") returned 0x0 [0082.289] lstrlenW (lpString=".NDF") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".NDF") returned 0x0 [0082.289] lstrlenW (lpString=".Mdf") returned 4 [0082.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".Mdf") returned 0x0 [0082.290] lstrlenW (lpString=".dat") returned 4 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".dat") returned 0x0 [0082.290] lstrlenW (lpString=".DAT") returned 4 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".DAT") returned 0x0 [0082.290] lstrlenW (lpString=".ldf") returned 4 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".ldf") returned 0x0 [0082.290] lstrlenW (lpString=".LDF") returned 4 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch=".LDF") returned 0x0 [0082.290] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.290] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2a48) returned 1 [0082.308] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.308] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.308] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20230946064) returned 1 [0082.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfe00210, dwHighDateTime=0x1d585b4)) [0082.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338d08 [0082.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338d08 | out: hHeap=0x260000) returned 1 [0082.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.309] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.309] GetLastError () returned 0x0 [0082.309] GetLastError () returned 0x0 [0082.309] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.310] GetLastError () returned 0x0 [0082.310] GetLastError () returned 0x0 [0082.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.313] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.314] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.314] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.314] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.314] CloseHandle (hObject=0xf0) returned 1 [0082.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.333] GetLastError () returned 0x0 [0082.344] RtlWakeConditionVariable () returned 0x27e828 [0082.344] GetCurrentThreadId () returned 0x98c [0082.345] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.345] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.345] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0082.345] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0082.347] CloseHandle (hObject=0xe4) returned 1 [0082.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2778290 | out: hHeap=0x260000) returned 1 [0082.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.347] RtlWakeConditionVariable () returned 0x27e828 [0082.347] GetCurrentThreadId () returned 0x98c [0082.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".ldf") returned 0x0 [0082.347] lstrlenW (lpString=".vhd") returned 4 [0082.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".vhd") returned 0x0 [0082.347] lstrlenW (lpString=".vhdx") returned 5 [0082.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".vhdx") returned 0x0 [0082.347] lstrlenW (lpString=".pst") returned 4 [0082.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".pst") returned 0x0 [0082.347] lstrlenW (lpString=".ost") returned 4 [0082.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".ost") returned 0x0 [0082.348] lstrlenW (lpString=".bak") returned 4 [0082.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".bak") returned 0x0 [0082.348] lstrlenW (lpString=".bac") returned 4 [0082.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".bac") returned 0x0 [0082.348] lstrlenW (lpString=".sys") returned 4 [0082.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".sys") returned 0x0 [0082.348] lstrlenW (lpString=".v2i") returned 4 [0082.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".v2i") returned 0x0 [0082.348] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.349] lstrlenW (lpString=".sql") returned 4 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".sql") returned 0x0 [0082.349] lstrlenW (lpString=".mdf") returned 4 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".mdf") returned 0x0 [0082.349] lstrlenW (lpString=".txt") returned 4 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".txt") returned 0x0 [0082.349] lstrlenW (lpString=".dbf") returned 4 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".dbf") returned 0x0 [0082.349] lstrlenW (lpString=".ckp") returned 4 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".ckp") returned 0x0 [0082.349] lstrlenW (lpString=".dacpac") returned 7 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".dacpac") returned 0x0 [0082.349] lstrlenW (lpString=".db3") returned 4 [0082.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".db3") returned 0x0 [0082.349] lstrlenW (lpString=".dtxs") returned 5 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".dtxs") returned 0x0 [0082.350] lstrlenW (lpString=".mdt") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".mdt") returned 0x0 [0082.350] lstrlenW (lpString=".sdf") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".sdf") returned 0x0 [0082.350] lstrlenW (lpString=".MDF") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".MDF") returned 0x0 [0082.350] lstrlenW (lpString=".DBF") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".DBF") returned 0x0 [0082.350] lstrlenW (lpString=".DB") returned 3 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".DB") returned 0x0 [0082.350] lstrlenW (lpString=".db") returned 3 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".db") returned 0x0 [0082.350] lstrlenW (lpString=".ndf") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".ndf") returned 0x0 [0082.350] lstrlenW (lpString=".NDF") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".NDF") returned 0x0 [0082.350] lstrlenW (lpString=".Mdf") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".Mdf") returned 0x0 [0082.350] lstrlenW (lpString=".dat") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".dat") returned 0x0 [0082.350] lstrlenW (lpString=".DAT") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".DAT") returned 0x0 [0082.350] lstrlenW (lpString=".ldf") returned 4 [0082.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".ldf") returned 0x0 [0082.351] lstrlenW (lpString=".LDF") returned 4 [0082.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch=".LDF") returned 0x0 [0082.351] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.351] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2e88) returned 1 [0082.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.352] CryptReleaseContext (hProv=0x2d2e88, dwFlags=0x0) returned 1 [0082.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.352] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20235285342) returned 1 [0082.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfe4c4d0, dwHighDateTime=0x1d585b4)) [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338de8 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338de8 | out: hHeap=0x260000) returned 1 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0082.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.353] GetLastError () returned 0x0 [0082.353] GetLastError () returned 0x0 [0082.353] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.353] GetLastError () returned 0x0 [0082.353] GetLastError () returned 0x0 [0082.356] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.356] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.357] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.357] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.360] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.360] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.360] CloseHandle (hObject=0xe4) returned 1 [0082.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.361] GetLastError () returned 0x0 [0082.361] RtlWakeConditionVariable () returned 0x0 [0082.361] GetCurrentThreadId () returned 0x98c [0082.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".ldf") returned 0x0 [0082.361] lstrlenW (lpString=".vhd") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".vhd") returned 0x0 [0082.362] lstrlenW (lpString=".vhdx") returned 5 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".vhdx") returned 0x0 [0082.362] lstrlenW (lpString=".pst") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".pst") returned 0x0 [0082.362] lstrlenW (lpString=".ost") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".ost") returned 0x0 [0082.362] lstrlenW (lpString=".bak") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".bak") returned 0x0 [0082.362] lstrlenW (lpString=".bac") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".bac") returned 0x0 [0082.362] lstrlenW (lpString=".sys") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".sys") returned 0x0 [0082.362] lstrlenW (lpString=".v2i") returned 4 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".v2i") returned 0x0 [0082.362] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.363] lstrlenW (lpString=".sql") returned 4 [0082.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".sql") returned 0x0 [0082.363] lstrlenW (lpString=".mdf") returned 4 [0082.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".mdf") returned 0x0 [0082.363] lstrlenW (lpString=".txt") returned 4 [0082.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".txt") returned 0x0 [0082.363] lstrlenW (lpString=".dbf") returned 4 [0082.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".dbf") returned 0x0 [0082.363] lstrlenW (lpString=".ckp") returned 4 [0082.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".ckp") returned 0x0 [0082.363] lstrlenW (lpString=".dacpac") returned 7 [0082.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".dacpac") returned 0x0 [0082.363] lstrlenW (lpString=".db3") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".db3") returned 0x0 [0082.364] lstrlenW (lpString=".dtxs") returned 5 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".dtxs") returned 0x0 [0082.364] lstrlenW (lpString=".mdt") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".mdt") returned 0x0 [0082.364] lstrlenW (lpString=".sdf") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".sdf") returned 0x0 [0082.364] lstrlenW (lpString=".MDF") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".MDF") returned 0x0 [0082.364] lstrlenW (lpString=".DBF") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".DBF") returned 0x0 [0082.364] lstrlenW (lpString=".DB") returned 3 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".DB") returned 0x0 [0082.364] lstrlenW (lpString=".db") returned 3 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".db") returned 0x0 [0082.364] lstrlenW (lpString=".ndf") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".ndf") returned 0x0 [0082.364] lstrlenW (lpString=".NDF") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".NDF") returned 0x0 [0082.364] lstrlenW (lpString=".Mdf") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".Mdf") returned 0x0 [0082.364] lstrlenW (lpString=".dat") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".dat") returned 0x0 [0082.364] lstrlenW (lpString=".DAT") returned 4 [0082.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".DAT") returned 0x0 [0082.365] lstrlenW (lpString=".ldf") returned 4 [0082.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".ldf") returned 0x0 [0082.365] lstrlenW (lpString=".LDF") returned 4 [0082.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch=".LDF") returned 0x0 [0082.365] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.365] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2f10) returned 1 [0082.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.366] CryptReleaseContext (hProv=0x2d2f10, dwFlags=0x0) returned 1 [0082.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.366] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20236693252) returned 1 [0082.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfe72630, dwHighDateTime=0x1d585b4)) [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338e20 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338e20 | out: hHeap=0x260000) returned 1 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0082.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.366] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.367] GetLastError () returned 0x0 [0082.367] GetLastError () returned 0x0 [0082.367] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.367] GetLastError () returned 0x0 [0082.367] GetLastError () returned 0x0 [0082.370] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.370] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.371] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.371] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.373] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.373] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.373] CloseHandle (hObject=0xe4) returned 1 [0082.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.375] GetLastError () returned 0x0 [0082.375] RtlWakeConditionVariable () returned 0x0 [0082.375] GetCurrentThreadId () returned 0x98c [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".ldf") returned 0x0 [0082.375] lstrlenW (lpString=".vhd") returned 4 [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".vhd") returned 0x0 [0082.375] lstrlenW (lpString=".vhdx") returned 5 [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".vhdx") returned 0x0 [0082.375] lstrlenW (lpString=".pst") returned 4 [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".pst") returned 0x0 [0082.375] lstrlenW (lpString=".ost") returned 4 [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".ost") returned 0x0 [0082.375] lstrlenW (lpString=".bak") returned 4 [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".bak") returned 0x0 [0082.375] lstrlenW (lpString=".bac") returned 4 [0082.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".bac") returned 0x0 [0082.376] lstrlenW (lpString=".sys") returned 4 [0082.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".sys") returned 0x0 [0082.376] lstrlenW (lpString=".v2i") returned 4 [0082.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".v2i") returned 0x0 [0082.376] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.377] lstrlenW (lpString=".sql") returned 4 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".sql") returned 0x0 [0082.377] lstrlenW (lpString=".mdf") returned 4 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".mdf") returned 0x0 [0082.377] lstrlenW (lpString=".txt") returned 4 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".txt") returned 0x0 [0082.377] lstrlenW (lpString=".dbf") returned 4 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".dbf") returned 0x0 [0082.377] lstrlenW (lpString=".ckp") returned 4 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".ckp") returned 0x0 [0082.377] lstrlenW (lpString=".dacpac") returned 7 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".dacpac") returned 0x0 [0082.377] lstrlenW (lpString=".db3") returned 4 [0082.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".db3") returned 0x0 [0082.378] lstrlenW (lpString=".dtxs") returned 5 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".dtxs") returned 0x0 [0082.378] lstrlenW (lpString=".mdt") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".mdt") returned 0x0 [0082.378] lstrlenW (lpString=".sdf") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".sdf") returned 0x0 [0082.378] lstrlenW (lpString=".MDF") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".MDF") returned 0x0 [0082.378] lstrlenW (lpString=".DBF") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".DBF") returned 0x0 [0082.378] lstrlenW (lpString=".DB") returned 3 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".DB") returned 0x0 [0082.378] lstrlenW (lpString=".db") returned 3 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".db") returned 0x0 [0082.378] lstrlenW (lpString=".ndf") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".ndf") returned 0x0 [0082.378] lstrlenW (lpString=".NDF") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".NDF") returned 0x0 [0082.378] lstrlenW (lpString=".Mdf") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".Mdf") returned 0x0 [0082.378] lstrlenW (lpString=".dat") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".dat") returned 0x0 [0082.378] lstrlenW (lpString=".DAT") returned 4 [0082.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".DAT") returned 0x0 [0082.378] lstrlenW (lpString=".ldf") returned 4 [0082.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".ldf") returned 0x0 [0082.379] lstrlenW (lpString=".LDF") returned 4 [0082.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch=".LDF") returned 0x0 [0082.379] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.379] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2f98) returned 1 [0082.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.380] CryptReleaseContext (hProv=0x2d2f98, dwFlags=0x0) returned 1 [0082.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.380] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20238093864) returned 1 [0082.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbfe98790, dwHighDateTime=0x1d585b4)) [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338e58 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338e58 | out: hHeap=0x260000) returned 1 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0082.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.381] GetLastError () returned 0x0 [0082.381] GetLastError () returned 0x0 [0082.381] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.381] GetLastError () returned 0x0 [0082.381] GetLastError () returned 0x0 [0082.402] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.402] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.403] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.403] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.426] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.426] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.426] CloseHandle (hObject=0xe4) returned 1 [0082.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.428] GetLastError () returned 0x0 [0082.428] RtlWakeConditionVariable () returned 0x27e828 [0082.428] GetCurrentThreadId () returned 0x98c [0082.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".ldf") returned 0x0 [0082.428] lstrlenW (lpString=".vhd") returned 4 [0082.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".vhd") returned 0x0 [0082.428] lstrlenW (lpString=".vhdx") returned 5 [0082.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".vhdx") returned 0x0 [0082.428] lstrlenW (lpString=".pst") returned 4 [0082.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".pst") returned 0x0 [0082.428] lstrlenW (lpString=".ost") returned 4 [0082.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".ost") returned 0x0 [0082.429] lstrlenW (lpString=".bak") returned 4 [0082.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".bak") returned 0x0 [0082.429] lstrlenW (lpString=".bac") returned 4 [0082.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".bac") returned 0x0 [0082.429] lstrlenW (lpString=".sys") returned 4 [0082.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".sys") returned 0x0 [0082.429] lstrlenW (lpString=".v2i") returned 4 [0082.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".v2i") returned 0x0 [0082.429] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.430] lstrlenW (lpString=".sql") returned 4 [0082.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".sql") returned 0x0 [0082.430] lstrlenW (lpString=".mdf") returned 4 [0082.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".mdf") returned 0x0 [0082.430] lstrlenW (lpString=".txt") returned 4 [0082.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".txt") returned 0x0 [0082.430] lstrlenW (lpString=".dbf") returned 4 [0082.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".dbf") returned 0x0 [0082.431] lstrlenW (lpString=".ckp") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".ckp") returned 0x0 [0082.431] lstrlenW (lpString=".dacpac") returned 7 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".dacpac") returned 0x0 [0082.431] lstrlenW (lpString=".db3") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".db3") returned 0x0 [0082.431] lstrlenW (lpString=".dtxs") returned 5 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".dtxs") returned 0x0 [0082.431] lstrlenW (lpString=".mdt") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".mdt") returned 0x0 [0082.431] lstrlenW (lpString=".sdf") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".sdf") returned 0x0 [0082.431] lstrlenW (lpString=".MDF") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".MDF") returned 0x0 [0082.431] lstrlenW (lpString=".DBF") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".DBF") returned 0x0 [0082.431] lstrlenW (lpString=".DB") returned 3 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".DB") returned 0x0 [0082.431] lstrlenW (lpString=".db") returned 3 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".db") returned 0x0 [0082.431] lstrlenW (lpString=".ndf") returned 4 [0082.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".ndf") returned 0x0 [0082.432] lstrlenW (lpString=".NDF") returned 4 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".NDF") returned 0x0 [0082.432] lstrlenW (lpString=".Mdf") returned 4 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".Mdf") returned 0x0 [0082.432] lstrlenW (lpString=".dat") returned 4 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".dat") returned 0x0 [0082.432] lstrlenW (lpString=".DAT") returned 4 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".DAT") returned 0x0 [0082.432] lstrlenW (lpString=".ldf") returned 4 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".ldf") returned 0x0 [0082.432] lstrlenW (lpString=".LDF") returned 4 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch=".LDF") returned 0x0 [0082.432] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.432] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d3020) returned 1 [0082.433] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.433] CryptReleaseContext (hProv=0x2d3020, dwFlags=0x0) returned 1 [0082.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.433] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20243427572) returned 1 [0082.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xbff30d10, dwHighDateTime=0x1d585b4)) [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338f38 [0082.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338f38 | out: hHeap=0x260000) returned 1 [0082.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.434] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.434] GetLastError () returned 0x0 [0082.434] GetLastError () returned 0x0 [0082.434] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.434] GetLastError () returned 0x0 [0082.435] GetLastError () returned 0x0 [0082.446] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.446] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.447] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.447] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.456] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.456] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.456] CloseHandle (hObject=0xe4) returned 1 [0082.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349218 [0082.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349218 | out: hHeap=0x260000) returned 1 [0082.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.486] GetLastError () returned 0x0 [0082.486] RtlWakeConditionVariable () returned 0x27e828 [0082.486] GetCurrentThreadId () returned 0x98c [0082.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".ldf") returned 0x0 [0082.487] lstrlenW (lpString=".vhd") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".vhd") returned 0x0 [0082.487] lstrlenW (lpString=".vhdx") returned 5 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".vhdx") returned 0x0 [0082.487] lstrlenW (lpString=".pst") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".pst") returned 0x0 [0082.487] lstrlenW (lpString=".ost") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".ost") returned 0x0 [0082.487] lstrlenW (lpString=".bak") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".bak") returned 0x0 [0082.487] lstrlenW (lpString=".bac") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".bac") returned 0x0 [0082.487] lstrlenW (lpString=".sys") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".sys") returned 0x0 [0082.487] lstrlenW (lpString=".v2i") returned 4 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".v2i") returned 0x0 [0082.487] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.517] lstrlenW (lpString=".sql") returned 4 [0082.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".sql") returned 0x0 [0082.517] lstrlenW (lpString=".mdf") returned 4 [0082.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".mdf") returned 0x0 [0082.518] lstrlenW (lpString=".txt") returned 4 [0082.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".txt") returned 0x0 [0082.518] lstrlenW (lpString=".dbf") returned 4 [0082.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".dbf") returned 0x0 [0082.518] lstrlenW (lpString=".ckp") returned 4 [0082.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".ckp") returned 0x0 [0082.518] lstrlenW (lpString=".dacpac") returned 7 [0082.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".dacpac") returned 0x0 [0082.540] lstrlenW (lpString=".db3") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".db3") returned 0x0 [0082.540] lstrlenW (lpString=".dtxs") returned 5 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".dtxs") returned 0x0 [0082.540] lstrlenW (lpString=".mdt") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".mdt") returned 0x0 [0082.540] lstrlenW (lpString=".sdf") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".sdf") returned 0x0 [0082.540] lstrlenW (lpString=".MDF") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".MDF") returned 0x0 [0082.540] lstrlenW (lpString=".DBF") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".DBF") returned 0x0 [0082.540] lstrlenW (lpString=".DB") returned 3 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".DB") returned 0x0 [0082.540] lstrlenW (lpString=".db") returned 3 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".db") returned 0x0 [0082.540] lstrlenW (lpString=".ndf") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".ndf") returned 0x0 [0082.540] lstrlenW (lpString=".NDF") returned 4 [0082.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".NDF") returned 0x0 [0082.541] lstrlenW (lpString=".Mdf") returned 4 [0082.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".Mdf") returned 0x0 [0082.541] lstrlenW (lpString=".dat") returned 4 [0082.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".dat") returned 0x0 [0082.541] lstrlenW (lpString=".DAT") returned 4 [0082.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".DAT") returned 0x0 [0082.541] lstrlenW (lpString=".ldf") returned 4 [0082.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".ldf") returned 0x0 [0082.541] lstrlenW (lpString=".LDF") returned 4 [0082.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch=".LDF") returned 0x0 [0082.541] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.541] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d33d8) returned 1 [0082.542] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.542] CryptReleaseContext (hProv=0x2d33d8, dwFlags=0x0) returned 1 [0082.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.542] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20254321020) returned 1 [0082.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc003b6b0, dwHighDateTime=0x1d585b4)) [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762488 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762488 | out: hHeap=0x260000) returned 1 [0082.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.543] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.543] GetLastError () returned 0x0 [0082.543] GetLastError () returned 0x0 [0082.543] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.543] GetLastError () returned 0x0 [0082.544] GetLastError () returned 0x0 [0082.556] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.556] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.557] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.557] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.557] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.557] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.557] CloseHandle (hObject=0xd8) returned 1 [0082.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.559] GetLastError () returned 0x0 [0082.559] RtlWakeConditionVariable () returned 0x0 [0082.559] GetCurrentThreadId () returned 0x98c [0082.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".ldf") returned 0x0 [0082.559] lstrlenW (lpString=".vhd") returned 4 [0082.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".vhd") returned 0x0 [0082.559] lstrlenW (lpString=".vhdx") returned 5 [0082.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".vhdx") returned 0x0 [0082.559] lstrlenW (lpString=".pst") returned 4 [0082.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".pst") returned 0x0 [0082.559] lstrlenW (lpString=".ost") returned 4 [0082.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".ost") returned 0x0 [0082.559] lstrlenW (lpString=".bak") returned 4 [0082.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".bak") returned 0x0 [0082.560] lstrlenW (lpString=".bac") returned 4 [0082.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".bac") returned 0x0 [0082.560] lstrlenW (lpString=".sys") returned 4 [0082.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".sys") returned 0x0 [0082.560] lstrlenW (lpString=".v2i") returned 4 [0082.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".v2i") returned 0x0 [0082.560] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.561] lstrlenW (lpString=".sql") returned 4 [0082.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".sql") returned 0x0 [0082.561] lstrlenW (lpString=".mdf") returned 4 [0082.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".mdf") returned 0x0 [0082.561] lstrlenW (lpString=".txt") returned 4 [0082.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".txt") returned 0x0 [0082.561] lstrlenW (lpString=".dbf") returned 4 [0082.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".dbf") returned 0x0 [0082.561] lstrlenW (lpString=".ckp") returned 4 [0082.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".ckp") returned 0x0 [0082.561] lstrlenW (lpString=".dacpac") returned 7 [0082.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".dacpac") returned 0x0 [0082.562] lstrlenW (lpString=".db3") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".db3") returned 0x0 [0082.562] lstrlenW (lpString=".dtxs") returned 5 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".dtxs") returned 0x0 [0082.562] lstrlenW (lpString=".mdt") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".mdt") returned 0x0 [0082.562] lstrlenW (lpString=".sdf") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".sdf") returned 0x0 [0082.562] lstrlenW (lpString=".MDF") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".MDF") returned 0x0 [0082.562] lstrlenW (lpString=".DBF") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".DBF") returned 0x0 [0082.562] lstrlenW (lpString=".DB") returned 3 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".DB") returned 0x0 [0082.562] lstrlenW (lpString=".db") returned 3 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".db") returned 0x0 [0082.562] lstrlenW (lpString=".ndf") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".ndf") returned 0x0 [0082.562] lstrlenW (lpString=".NDF") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".NDF") returned 0x0 [0082.562] lstrlenW (lpString=".Mdf") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".Mdf") returned 0x0 [0082.562] lstrlenW (lpString=".dat") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".dat") returned 0x0 [0082.562] lstrlenW (lpString=".DAT") returned 4 [0082.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".DAT") returned 0x0 [0082.563] lstrlenW (lpString=".ldf") returned 4 [0082.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".ldf") returned 0x0 [0082.563] lstrlenW (lpString=".LDF") returned 4 [0082.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch=".LDF") returned 0x0 [0082.563] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.563] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d3460) returned 1 [0082.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.564] CryptReleaseContext (hProv=0x2d3460, dwFlags=0x0) returned 1 [0082.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.564] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20256497028) returned 1 [0082.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0061810, dwHighDateTime=0x1d585b4)) [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762418 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762418 | out: hHeap=0x260000) returned 1 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.565] GetLastError () returned 0x0 [0082.565] GetLastError () returned 0x0 [0082.565] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.565] GetLastError () returned 0x0 [0082.565] GetLastError () returned 0x0 [0082.621] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.636] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.650] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.650] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.705] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.705] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.705] CloseHandle (hObject=0xd8) returned 1 [0082.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0082.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0082.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.787] GetLastError () returned 0x0 [0082.788] RtlWakeConditionVariable () returned 0x0 [0082.788] GetCurrentThreadId () returned 0x98c [0082.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".ldf") returned 0x0 [0082.788] lstrlenW (lpString=".vhd") returned 4 [0082.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".vhd") returned 0x0 [0082.788] lstrlenW (lpString=".vhdx") returned 5 [0082.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".vhdx") returned 0x0 [0082.788] lstrlenW (lpString=".pst") returned 4 [0082.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".pst") returned 0x0 [0082.788] lstrlenW (lpString=".ost") returned 4 [0082.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".ost") returned 0x0 [0082.788] lstrlenW (lpString=".bak") returned 4 [0082.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".bak") returned 0x0 [0082.789] lstrlenW (lpString=".bac") returned 4 [0082.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".bac") returned 0x0 [0082.789] lstrlenW (lpString=".sys") returned 4 [0082.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".sys") returned 0x0 [0082.789] lstrlenW (lpString=".v2i") returned 4 [0082.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".v2i") returned 0x0 [0082.789] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch="s\r\n.v2i") returned 0x0 [0082.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.790] lstrlenW (lpString=".sql") returned 4 [0082.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".sql") returned 0x0 [0082.790] lstrlenW (lpString=".mdf") returned 4 [0082.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".mdf") returned 0x0 [0082.790] lstrlenW (lpString=".txt") returned 4 [0082.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".txt") returned 0x0 [0082.790] lstrlenW (lpString=".dbf") returned 4 [0082.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".dbf") returned 0x0 [0082.790] lstrlenW (lpString=".ckp") returned 4 [0082.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".ckp") returned 0x0 [0082.790] lstrlenW (lpString=".dacpac") returned 7 [0082.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".dacpac") returned 0x0 [0082.790] lstrlenW (lpString=".db3") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".db3") returned 0x0 [0082.791] lstrlenW (lpString=".dtxs") returned 5 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".dtxs") returned 0x0 [0082.791] lstrlenW (lpString=".mdt") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".mdt") returned 0x0 [0082.791] lstrlenW (lpString=".sdf") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".sdf") returned 0x0 [0082.791] lstrlenW (lpString=".MDF") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".MDF") returned 0x0 [0082.791] lstrlenW (lpString=".DBF") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".DBF") returned 0x0 [0082.791] lstrlenW (lpString=".DB") returned 3 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".DB") returned 0x0 [0082.791] lstrlenW (lpString=".db") returned 3 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".db") returned 0x0 [0082.791] lstrlenW (lpString=".ndf") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".ndf") returned 0x0 [0082.791] lstrlenW (lpString=".NDF") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".NDF") returned 0x0 [0082.791] lstrlenW (lpString=".Mdf") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".Mdf") returned 0x0 [0082.791] lstrlenW (lpString=".dat") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".dat") returned 0x0 [0082.791] lstrlenW (lpString=".DAT") returned 4 [0082.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".DAT") returned 0x0 [0082.792] lstrlenW (lpString=".ldf") returned 4 [0082.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".ldf") returned 0x0 [0082.792] lstrlenW (lpString=".LDF") returned 4 [0082.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch=".LDF") returned 0x0 [0082.792] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.792] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2c68) returned 1 [0082.793] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.793] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.793] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20279402644) returned 1 [0082.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc029ccb0, dwHighDateTime=0x1d585b4)) [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3392f0 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3392f0 | out: hHeap=0x260000) returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764f38 [0082.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.794] GetLastError () returned 0x0 [0082.794] GetLastError () returned 0x0 [0082.794] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.794] GetLastError () returned 0x0 [0082.794] GetLastError () returned 0x0 [0082.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffb54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.796] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4ac, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x4ac, lpOverlapped=0x0) returned 1 [0082.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.796] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.797] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.797] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.797] CloseHandle (hObject=0xf0) returned 1 [0082.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.[deadmin@cock.li].deadmin")) returned 1 [0082.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.799] GetLastError () returned 0x0 [0082.799] RtlWakeConditionVariable () returned 0x0 [0082.799] GetCurrentThreadId () returned 0x98c [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".ldf") returned 0x0 [0082.799] lstrlenW (lpString=".vhd") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".vhd") returned 0x0 [0082.799] lstrlenW (lpString=".vhdx") returned 5 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".vhdx") returned 0x0 [0082.799] lstrlenW (lpString=".pst") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".pst") returned 0x0 [0082.799] lstrlenW (lpString=".ost") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".ost") returned 0x0 [0082.799] lstrlenW (lpString=".bak") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".bak") returned 0x0 [0082.799] lstrlenW (lpString=".bac") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".bac") returned 0x0 [0082.799] lstrlenW (lpString=".sys") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".sys") returned 0x0 [0082.799] lstrlenW (lpString=".v2i") returned 4 [0082.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".v2i") returned 0x0 [0082.799] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch="s\r\n.v2i") returned 0x0 [0082.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.801] lstrlenW (lpString=".sql") returned 4 [0082.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".sql") returned 0x0 [0082.801] lstrlenW (lpString=".mdf") returned 4 [0082.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".mdf") returned 0x0 [0082.801] lstrlenW (lpString=".txt") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".txt") returned 0x0 [0082.802] lstrlenW (lpString=".dbf") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".dbf") returned 0x0 [0082.802] lstrlenW (lpString=".ckp") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".ckp") returned 0x0 [0082.802] lstrlenW (lpString=".dacpac") returned 7 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".dacpac") returned 0x0 [0082.802] lstrlenW (lpString=".db3") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".db3") returned 0x0 [0082.802] lstrlenW (lpString=".dtxs") returned 5 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".dtxs") returned 0x0 [0082.802] lstrlenW (lpString=".mdt") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".mdt") returned 0x0 [0082.802] lstrlenW (lpString=".sdf") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".sdf") returned 0x0 [0082.802] lstrlenW (lpString=".MDF") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".MDF") returned 0x0 [0082.802] lstrlenW (lpString=".DBF") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".DBF") returned 0x0 [0082.802] lstrlenW (lpString=".DB") returned 3 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".DB") returned 0x0 [0082.802] lstrlenW (lpString=".db") returned 3 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".db") returned 0x0 [0082.802] lstrlenW (lpString=".ndf") returned 4 [0082.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".ndf") returned 0x0 [0082.802] lstrlenW (lpString=".NDF") returned 4 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".NDF") returned 0x0 [0082.803] lstrlenW (lpString=".Mdf") returned 4 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".Mdf") returned 0x0 [0082.803] lstrlenW (lpString=".dat") returned 4 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".dat") returned 0x0 [0082.803] lstrlenW (lpString=".DAT") returned 4 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".DAT") returned 0x0 [0082.803] lstrlenW (lpString=".ldf") returned 4 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".ldf") returned 0x0 [0082.803] lstrlenW (lpString=".LDF") returned 4 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch=".LDF") returned 0x0 [0082.803] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.803] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d35f8) returned 1 [0082.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.804] CryptReleaseContext (hProv=0x2d35f8, dwFlags=0x0) returned 1 [0082.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.804] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20280523445) returned 1 [0082.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc029ccb0, dwHighDateTime=0x1d585b4)) [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339328 [0082.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339328 | out: hHeap=0x260000) returned 1 [0082.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0082.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.805] GetLastError () returned 0x0 [0082.805] GetLastError () returned 0x0 [0082.806] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.806] GetLastError () returned 0x0 [0082.806] GetLastError () returned 0x0 [0082.810] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.810] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.811] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.811] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.813] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.813] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.813] CloseHandle (hObject=0xf0) returned 1 [0082.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0082.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.[deadmin@cock.li].deadmin")) returned 1 [0082.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0082.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.814] GetLastError () returned 0x0 [0082.815] RtlWakeConditionVariable () returned 0x0 [0082.815] GetCurrentThreadId () returned 0x98c [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".ldf") returned 0x0 [0082.815] lstrlenW (lpString=".vhd") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".vhd") returned 0x0 [0082.815] lstrlenW (lpString=".vhdx") returned 5 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".vhdx") returned 0x0 [0082.815] lstrlenW (lpString=".pst") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".pst") returned 0x0 [0082.815] lstrlenW (lpString=".ost") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".ost") returned 0x0 [0082.815] lstrlenW (lpString=".bak") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".bak") returned 0x0 [0082.815] lstrlenW (lpString=".bac") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".bac") returned 0x0 [0082.815] lstrlenW (lpString=".sys") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".sys") returned 0x0 [0082.815] lstrlenW (lpString=".v2i") returned 4 [0082.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".v2i") returned 0x0 [0082.815] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch="s\r\n.v2i") returned 0x0 [0082.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.817] lstrlenW (lpString=".sql") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".sql") returned 0x0 [0082.817] lstrlenW (lpString=".mdf") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".mdf") returned 0x0 [0082.817] lstrlenW (lpString=".txt") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".txt") returned 0x0 [0082.817] lstrlenW (lpString=".dbf") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".dbf") returned 0x0 [0082.817] lstrlenW (lpString=".ckp") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".ckp") returned 0x0 [0082.817] lstrlenW (lpString=".dacpac") returned 7 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".dacpac") returned 0x0 [0082.817] lstrlenW (lpString=".db3") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".db3") returned 0x0 [0082.817] lstrlenW (lpString=".dtxs") returned 5 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".dtxs") returned 0x0 [0082.817] lstrlenW (lpString=".mdt") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".mdt") returned 0x0 [0082.817] lstrlenW (lpString=".sdf") returned 4 [0082.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".sdf") returned 0x0 [0082.817] lstrlenW (lpString=".MDF") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".MDF") returned 0x0 [0082.818] lstrlenW (lpString=".DBF") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".DBF") returned 0x0 [0082.818] lstrlenW (lpString=".DB") returned 3 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".DB") returned 0x0 [0082.818] lstrlenW (lpString=".db") returned 3 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".db") returned 0x0 [0082.818] lstrlenW (lpString=".ndf") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".ndf") returned 0x0 [0082.818] lstrlenW (lpString=".NDF") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".NDF") returned 0x0 [0082.818] lstrlenW (lpString=".Mdf") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".Mdf") returned 0x0 [0082.818] lstrlenW (lpString=".dat") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".dat") returned 0x0 [0082.818] lstrlenW (lpString=".DAT") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".DAT") returned 0x0 [0082.818] lstrlenW (lpString=".ldf") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".ldf") returned 0x0 [0082.818] lstrlenW (lpString=".LDF") returned 4 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch=".LDF") returned 0x0 [0082.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.819] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d3d68) returned 1 [0082.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.819] CryptReleaseContext (hProv=0x2d3d68, dwFlags=0x0) returned 1 [0082.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.820] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20282070503) returned 1 [0082.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc02c2e10, dwHighDateTime=0x1d585b4)) [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339360 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339360 | out: hHeap=0x260000) returned 1 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0082.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.899] GetLastError () returned 0x0 [0082.900] GetLastError () returned 0x0 [0082.900] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.900] GetLastError () returned 0x0 [0082.900] GetLastError () returned 0x0 [0082.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff42a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.902] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbd60, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xbd60, lpOverlapped=0x0) returned 1 [0082.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.903] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.903] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.903] CloseHandle (hObject=0xf0) returned 1 [0082.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.906] GetLastError () returned 0x0 [0082.906] RtlWakeConditionVariable () returned 0x0 [0082.906] GetCurrentThreadId () returned 0x98c [0082.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".ldf") returned 0x0 [0082.906] lstrlenW (lpString=".vhd") returned 4 [0082.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".vhd") returned 0x0 [0082.906] lstrlenW (lpString=".vhdx") returned 5 [0082.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".vhdx") returned 0x0 [0082.906] lstrlenW (lpString=".pst") returned 4 [0082.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".pst") returned 0x0 [0082.906] lstrlenW (lpString=".ost") returned 4 [0082.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".ost") returned 0x0 [0082.906] lstrlenW (lpString=".bak") returned 4 [0082.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".bak") returned 0x0 [0082.906] lstrlenW (lpString=".bac") returned 4 [0082.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".bac") returned 0x0 [0082.907] lstrlenW (lpString=".sys") returned 4 [0082.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".sys") returned 0x0 [0082.907] lstrlenW (lpString=".v2i") returned 4 [0082.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".v2i") returned 0x0 [0082.907] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.908] lstrlenW (lpString=".sql") returned 4 [0082.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".sql") returned 0x0 [0082.909] lstrlenW (lpString=".mdf") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".mdf") returned 0x0 [0082.909] lstrlenW (lpString=".txt") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".txt") returned 0x0 [0082.909] lstrlenW (lpString=".dbf") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".dbf") returned 0x0 [0082.909] lstrlenW (lpString=".ckp") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".ckp") returned 0x0 [0082.909] lstrlenW (lpString=".dacpac") returned 7 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".dacpac") returned 0x0 [0082.909] lstrlenW (lpString=".db3") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".db3") returned 0x0 [0082.909] lstrlenW (lpString=".dtxs") returned 5 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".dtxs") returned 0x0 [0082.909] lstrlenW (lpString=".mdt") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".mdt") returned 0x0 [0082.909] lstrlenW (lpString=".sdf") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".sdf") returned 0x0 [0082.909] lstrlenW (lpString=".MDF") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".MDF") returned 0x0 [0082.909] lstrlenW (lpString=".DBF") returned 4 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".DBF") returned 0x0 [0082.909] lstrlenW (lpString=".DB") returned 3 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".DB") returned 0x0 [0082.909] lstrlenW (lpString=".db") returned 3 [0082.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".db") returned 0x0 [0082.910] lstrlenW (lpString=".ndf") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".ndf") returned 0x0 [0082.910] lstrlenW (lpString=".NDF") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".NDF") returned 0x0 [0082.910] lstrlenW (lpString=".Mdf") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".Mdf") returned 0x0 [0082.910] lstrlenW (lpString=".dat") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".dat") returned 0x0 [0082.910] lstrlenW (lpString=".DAT") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".DAT") returned 0x0 [0082.910] lstrlenW (lpString=".ldf") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".ldf") returned 0x0 [0082.910] lstrlenW (lpString=".LDF") returned 4 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch=".LDF") returned 0x0 [0082.910] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.910] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2c68) returned 1 [0082.911] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.911] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.911] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20291239989) returned 1 [0082.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc03a7650, dwHighDateTime=0x1d585b4)) [0082.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3394b0 [0082.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3394b0 | out: hHeap=0x260000) returned 1 [0082.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0082.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0082.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0082.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.912] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.912] GetLastError () returned 0x0 [0082.912] GetLastError () returned 0x0 [0082.912] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.913] GetLastError () returned 0x0 [0082.913] GetLastError () returned 0x0 [0082.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.916] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.918] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.918] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.918] CloseHandle (hObject=0xf0) returned 1 [0082.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.920] GetLastError () returned 0x0 [0082.920] RtlWakeConditionVariable () returned 0x0 [0082.920] GetCurrentThreadId () returned 0x98c [0082.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".ldf") returned 0x0 [0082.920] lstrlenW (lpString=".vhd") returned 4 [0082.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".vhd") returned 0x0 [0082.921] lstrlenW (lpString=".vhdx") returned 5 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".vhdx") returned 0x0 [0082.921] lstrlenW (lpString=".pst") returned 4 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".pst") returned 0x0 [0082.921] lstrlenW (lpString=".ost") returned 4 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".ost") returned 0x0 [0082.921] lstrlenW (lpString=".bak") returned 4 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".bak") returned 0x0 [0082.921] lstrlenW (lpString=".bac") returned 4 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".bac") returned 0x0 [0082.921] lstrlenW (lpString=".sys") returned 4 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".sys") returned 0x0 [0082.921] lstrlenW (lpString=".v2i") returned 4 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".v2i") returned 0x0 [0082.921] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0082.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.924] lstrlenW (lpString=".sql") returned 4 [0082.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".sql") returned 0x0 [0082.924] lstrlenW (lpString=".mdf") returned 4 [0082.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".mdf") returned 0x0 [0082.924] lstrlenW (lpString=".txt") returned 4 [0082.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".txt") returned 0x0 [0082.924] lstrlenW (lpString=".dbf") returned 4 [0082.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".dbf") returned 0x0 [0082.925] lstrlenW (lpString=".ckp") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".ckp") returned 0x0 [0082.925] lstrlenW (lpString=".dacpac") returned 7 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".dacpac") returned 0x0 [0082.925] lstrlenW (lpString=".db3") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".db3") returned 0x0 [0082.925] lstrlenW (lpString=".dtxs") returned 5 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".dtxs") returned 0x0 [0082.925] lstrlenW (lpString=".mdt") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".mdt") returned 0x0 [0082.925] lstrlenW (lpString=".sdf") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".sdf") returned 0x0 [0082.925] lstrlenW (lpString=".MDF") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".MDF") returned 0x0 [0082.925] lstrlenW (lpString=".DBF") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".DBF") returned 0x0 [0082.925] lstrlenW (lpString=".DB") returned 3 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".DB") returned 0x0 [0082.925] lstrlenW (lpString=".db") returned 3 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".db") returned 0x0 [0082.925] lstrlenW (lpString=".ndf") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".ndf") returned 0x0 [0082.925] lstrlenW (lpString=".NDF") returned 4 [0082.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".NDF") returned 0x0 [0082.925] lstrlenW (lpString=".Mdf") returned 4 [0082.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".Mdf") returned 0x0 [0082.926] lstrlenW (lpString=".dat") returned 4 [0082.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".dat") returned 0x0 [0082.926] lstrlenW (lpString=".DAT") returned 4 [0082.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".DAT") returned 0x0 [0082.926] lstrlenW (lpString=".ldf") returned 4 [0082.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".ldf") returned 0x0 [0082.926] lstrlenW (lpString=".LDF") returned 4 [0082.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch=".LDF") returned 0x0 [0082.926] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.926] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2c68) returned 1 [0082.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.927] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.927] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20292821326) returned 1 [0082.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc03cd7b0, dwHighDateTime=0x1d585b4)) [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1a18 [0082.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1a18 | out: hHeap=0x260000) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764ea0 [0082.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.928] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.928] GetLastError () returned 0x0 [0082.928] GetLastError () returned 0x0 [0082.928] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.928] GetLastError () returned 0x0 [0082.929] GetLastError () returned 0x0 [0082.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.931] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x436, lpOverlapped=0x0) returned 1 [0082.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.931] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.931] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.931] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.931] CloseHandle (hObject=0xf0) returned 1 [0082.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.[deadmin@cock.li].deadmin")) returned 1 [0082.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.933] GetLastError () returned 0x0 [0082.933] RtlWakeConditionVariable () returned 0x0 [0082.933] GetCurrentThreadId () returned 0x98c [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".ldf") returned 0x0 [0082.934] lstrlenW (lpString=".vhd") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".vhd") returned 0x0 [0082.934] lstrlenW (lpString=".vhdx") returned 5 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".vhdx") returned 0x0 [0082.934] lstrlenW (lpString=".pst") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".pst") returned 0x0 [0082.934] lstrlenW (lpString=".ost") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".ost") returned 0x0 [0082.934] lstrlenW (lpString=".bak") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".bak") returned 0x0 [0082.934] lstrlenW (lpString=".bac") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".bac") returned 0x0 [0082.934] lstrlenW (lpString=".sys") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".sys") returned 0x0 [0082.934] lstrlenW (lpString=".v2i") returned 4 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".v2i") returned 0x0 [0082.934] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0082.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.936] lstrlenW (lpString=".sql") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".sql") returned 0x0 [0082.936] lstrlenW (lpString=".mdf") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".mdf") returned 0x0 [0082.936] lstrlenW (lpString=".txt") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".txt") returned 0x0 [0082.936] lstrlenW (lpString=".dbf") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".dbf") returned 0x0 [0082.936] lstrlenW (lpString=".ckp") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".ckp") returned 0x0 [0082.936] lstrlenW (lpString=".dacpac") returned 7 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".dacpac") returned 0x0 [0082.936] lstrlenW (lpString=".db3") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".db3") returned 0x0 [0082.936] lstrlenW (lpString=".dtxs") returned 5 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".dtxs") returned 0x0 [0082.936] lstrlenW (lpString=".mdt") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".mdt") returned 0x0 [0082.936] lstrlenW (lpString=".sdf") returned 4 [0082.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".sdf") returned 0x0 [0082.936] lstrlenW (lpString=".MDF") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".MDF") returned 0x0 [0082.937] lstrlenW (lpString=".DBF") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".DBF") returned 0x0 [0082.937] lstrlenW (lpString=".DB") returned 3 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".DB") returned 0x0 [0082.937] lstrlenW (lpString=".db") returned 3 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".db") returned 0x0 [0082.937] lstrlenW (lpString=".ndf") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".ndf") returned 0x0 [0082.937] lstrlenW (lpString=".NDF") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".NDF") returned 0x0 [0082.937] lstrlenW (lpString=".Mdf") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".Mdf") returned 0x0 [0082.937] lstrlenW (lpString=".dat") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".dat") returned 0x0 [0082.937] lstrlenW (lpString=".DAT") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".DAT") returned 0x0 [0082.937] lstrlenW (lpString=".ldf") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".ldf") returned 0x0 [0082.937] lstrlenW (lpString=".LDF") returned 4 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch=".LDF") returned 0x0 [0082.937] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.938] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d2c68) returned 1 [0082.938] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.938] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.939] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20293966058) returned 1 [0082.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc03f3910, dwHighDateTime=0x1d585b4)) [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f19e0 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f19e0 | out: hHeap=0x260000) returned 1 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27655c0 [0082.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.939] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0082.939] GetLastError () returned 0x0 [0082.940] GetLastError () returned 0x0 [0082.940] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0082.940] GetLastError () returned 0x0 [0082.940] GetLastError () returned 0x0 [0083.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.081] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.081] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.081] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.081] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.081] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.082] CloseHandle (hObject=0xf0) returned 1 [0083.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0083.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0083.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.177] GetLastError () returned 0x0 [0083.177] RtlWakeConditionVariable () returned 0x0 [0083.178] GetCurrentThreadId () returned 0x98c [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".ldf") returned 0x0 [0083.178] lstrlenW (lpString=".vhd") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".vhd") returned 0x0 [0083.178] lstrlenW (lpString=".vhdx") returned 5 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".vhdx") returned 0x0 [0083.178] lstrlenW (lpString=".pst") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".pst") returned 0x0 [0083.178] lstrlenW (lpString=".ost") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".ost") returned 0x0 [0083.178] lstrlenW (lpString=".bak") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".bak") returned 0x0 [0083.178] lstrlenW (lpString=".bac") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".bac") returned 0x0 [0083.178] lstrlenW (lpString=".sys") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".sys") returned 0x0 [0083.178] lstrlenW (lpString=".v2i") returned 4 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".v2i") returned 0x0 [0083.178] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.185] lstrlenW (lpString=".sql") returned 4 [0083.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".sql") returned 0x0 [0083.185] lstrlenW (lpString=".mdf") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".mdf") returned 0x0 [0083.195] lstrlenW (lpString=".txt") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".txt") returned 0x0 [0083.195] lstrlenW (lpString=".dbf") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".dbf") returned 0x0 [0083.195] lstrlenW (lpString=".ckp") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".ckp") returned 0x0 [0083.195] lstrlenW (lpString=".dacpac") returned 7 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".dacpac") returned 0x0 [0083.195] lstrlenW (lpString=".db3") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".db3") returned 0x0 [0083.195] lstrlenW (lpString=".dtxs") returned 5 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".dtxs") returned 0x0 [0083.195] lstrlenW (lpString=".mdt") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".mdt") returned 0x0 [0083.195] lstrlenW (lpString=".sdf") returned 4 [0083.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".sdf") returned 0x0 [0083.195] lstrlenW (lpString=".MDF") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".MDF") returned 0x0 [0083.196] lstrlenW (lpString=".DBF") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".DBF") returned 0x0 [0083.196] lstrlenW (lpString=".DB") returned 3 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".DB") returned 0x0 [0083.196] lstrlenW (lpString=".db") returned 3 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".db") returned 0x0 [0083.196] lstrlenW (lpString=".ndf") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".ndf") returned 0x0 [0083.196] lstrlenW (lpString=".NDF") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".NDF") returned 0x0 [0083.196] lstrlenW (lpString=".Mdf") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".Mdf") returned 0x0 [0083.196] lstrlenW (lpString=".dat") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".dat") returned 0x0 [0083.196] lstrlenW (lpString=".DAT") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".DAT") returned 0x0 [0083.196] lstrlenW (lpString=".ldf") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".ldf") returned 0x0 [0083.196] lstrlenW (lpString=".LDF") returned 4 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch=".LDF") returned 0x0 [0083.196] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.197] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.197] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.197] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.197] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20319861656) returned 1 [0083.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc067b070, dwHighDateTime=0x1d585b4)) [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3397f8 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3397f8 | out: hHeap=0x260000) returned 1 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764c40 [0083.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.198] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.198] GetLastError () returned 0x0 [0083.199] GetLastError () returned 0x0 [0083.199] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.199] GetLastError () returned 0x0 [0083.199] GetLastError () returned 0x0 [0083.204] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.204] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.205] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.205] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.205] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.205] CloseHandle (hObject=0xf0) returned 1 [0083.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0083.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0083.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.206] GetLastError () returned 0x0 [0083.207] RtlWakeConditionVariable () returned 0x0 [0083.207] GetCurrentThreadId () returned 0x98c [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".ldf") returned 0x0 [0083.207] lstrlenW (lpString=".vhd") returned 4 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".vhd") returned 0x0 [0083.207] lstrlenW (lpString=".vhdx") returned 5 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".vhdx") returned 0x0 [0083.207] lstrlenW (lpString=".pst") returned 4 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".pst") returned 0x0 [0083.207] lstrlenW (lpString=".ost") returned 4 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".ost") returned 0x0 [0083.207] lstrlenW (lpString=".bak") returned 4 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".bak") returned 0x0 [0083.207] lstrlenW (lpString=".bac") returned 4 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".bac") returned 0x0 [0083.207] lstrlenW (lpString=".sys") returned 4 [0083.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".sys") returned 0x0 [0083.207] lstrlenW (lpString=".v2i") returned 4 [0083.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".v2i") returned 0x0 [0083.208] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.209] lstrlenW (lpString=".sql") returned 4 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".sql") returned 0x0 [0083.209] lstrlenW (lpString=".mdf") returned 4 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".mdf") returned 0x0 [0083.209] lstrlenW (lpString=".txt") returned 4 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".txt") returned 0x0 [0083.209] lstrlenW (lpString=".dbf") returned 4 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".dbf") returned 0x0 [0083.209] lstrlenW (lpString=".ckp") returned 4 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".ckp") returned 0x0 [0083.209] lstrlenW (lpString=".dacpac") returned 7 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".dacpac") returned 0x0 [0083.209] lstrlenW (lpString=".db3") returned 4 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".db3") returned 0x0 [0083.209] lstrlenW (lpString=".dtxs") returned 5 [0083.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".dtxs") returned 0x0 [0083.209] lstrlenW (lpString=".mdt") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".mdt") returned 0x0 [0083.210] lstrlenW (lpString=".sdf") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".sdf") returned 0x0 [0083.210] lstrlenW (lpString=".MDF") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".MDF") returned 0x0 [0083.210] lstrlenW (lpString=".DBF") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".DBF") returned 0x0 [0083.210] lstrlenW (lpString=".DB") returned 3 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".DB") returned 0x0 [0083.210] lstrlenW (lpString=".db") returned 3 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".db") returned 0x0 [0083.210] lstrlenW (lpString=".ndf") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".ndf") returned 0x0 [0083.210] lstrlenW (lpString=".NDF") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".NDF") returned 0x0 [0083.210] lstrlenW (lpString=".Mdf") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".Mdf") returned 0x0 [0083.210] lstrlenW (lpString=".dat") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".dat") returned 0x0 [0083.210] lstrlenW (lpString=".DAT") returned 4 [0083.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".DAT") returned 0x0 [0083.210] lstrlenW (lpString=".ldf") returned 4 [0083.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".ldf") returned 0x0 [0083.211] lstrlenW (lpString=".LDF") returned 4 [0083.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch=".LDF") returned 0x0 [0083.211] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.211] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.212] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.212] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.212] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20321288680) returned 1 [0083.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc06a11d0, dwHighDateTime=0x1d585b4)) [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339830 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339830 | out: hHeap=0x260000) returned 1 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764ba8 [0083.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.213] GetLastError () returned 0x0 [0083.213] GetLastError () returned 0x0 [0083.213] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.213] GetLastError () returned 0x0 [0083.213] GetLastError () returned 0x0 [0083.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.219] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.222] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.222] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.222] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.222] CloseHandle (hObject=0xf0) returned 1 [0083.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.224] GetLastError () returned 0x0 [0083.224] RtlWakeConditionVariable () returned 0x0 [0083.224] GetCurrentThreadId () returned 0x98c [0083.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".ldf") returned 0x0 [0083.224] lstrlenW (lpString=".vhd") returned 4 [0083.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".vhd") returned 0x0 [0083.224] lstrlenW (lpString=".vhdx") returned 5 [0083.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".vhdx") returned 0x0 [0083.224] lstrlenW (lpString=".pst") returned 4 [0083.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".pst") returned 0x0 [0083.224] lstrlenW (lpString=".ost") returned 4 [0083.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".ost") returned 0x0 [0083.225] lstrlenW (lpString=".bak") returned 4 [0083.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".bak") returned 0x0 [0083.225] lstrlenW (lpString=".bac") returned 4 [0083.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".bac") returned 0x0 [0083.225] lstrlenW (lpString=".sys") returned 4 [0083.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".sys") returned 0x0 [0083.225] lstrlenW (lpString=".v2i") returned 4 [0083.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".v2i") returned 0x0 [0083.225] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.226] lstrlenW (lpString=".sql") returned 4 [0083.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".sql") returned 0x0 [0083.226] lstrlenW (lpString=".mdf") returned 4 [0083.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".mdf") returned 0x0 [0083.226] lstrlenW (lpString=".txt") returned 4 [0083.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".txt") returned 0x0 [0083.226] lstrlenW (lpString=".dbf") returned 4 [0083.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".dbf") returned 0x0 [0083.226] lstrlenW (lpString=".ckp") returned 4 [0083.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".ckp") returned 0x0 [0083.226] lstrlenW (lpString=".dacpac") returned 7 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".dacpac") returned 0x0 [0083.227] lstrlenW (lpString=".db3") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".db3") returned 0x0 [0083.227] lstrlenW (lpString=".dtxs") returned 5 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".dtxs") returned 0x0 [0083.227] lstrlenW (lpString=".mdt") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".mdt") returned 0x0 [0083.227] lstrlenW (lpString=".sdf") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".sdf") returned 0x0 [0083.227] lstrlenW (lpString=".MDF") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".MDF") returned 0x0 [0083.227] lstrlenW (lpString=".DBF") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".DBF") returned 0x0 [0083.227] lstrlenW (lpString=".DB") returned 3 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".DB") returned 0x0 [0083.227] lstrlenW (lpString=".db") returned 3 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".db") returned 0x0 [0083.227] lstrlenW (lpString=".ndf") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".ndf") returned 0x0 [0083.227] lstrlenW (lpString=".NDF") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".NDF") returned 0x0 [0083.227] lstrlenW (lpString=".Mdf") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".Mdf") returned 0x0 [0083.227] lstrlenW (lpString=".dat") returned 4 [0083.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".dat") returned 0x0 [0083.227] lstrlenW (lpString=".DAT") returned 4 [0083.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".DAT") returned 0x0 [0083.228] lstrlenW (lpString=".ldf") returned 4 [0083.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".ldf") returned 0x0 [0083.228] lstrlenW (lpString=".LDF") returned 4 [0083.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch=".LDF") returned 0x0 [0083.228] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.228] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.229] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.229] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20323000200) returned 1 [0083.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc06c7330, dwHighDateTime=0x1d585b4)) [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339868 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339868 | out: hHeap=0x260000) returned 1 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325638 [0083.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.230] GetLastError () returned 0x0 [0083.230] GetLastError () returned 0x0 [0083.230] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.230] GetLastError () returned 0x0 [0083.230] GetLastError () returned 0x0 [0083.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.423] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.423] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.424] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.424] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.424] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.424] CloseHandle (hObject=0xf0) returned 1 [0083.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.424] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.425] GetLastError () returned 0x0 [0083.426] RtlWakeConditionVariable () returned 0x0 [0083.426] GetCurrentThreadId () returned 0x98c [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".ldf") returned 0x0 [0083.426] lstrlenW (lpString=".vhd") returned 4 [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".vhd") returned 0x0 [0083.426] lstrlenW (lpString=".vhdx") returned 5 [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".vhdx") returned 0x0 [0083.426] lstrlenW (lpString=".pst") returned 4 [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".pst") returned 0x0 [0083.426] lstrlenW (lpString=".ost") returned 4 [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".ost") returned 0x0 [0083.426] lstrlenW (lpString=".bak") returned 4 [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".bak") returned 0x0 [0083.426] lstrlenW (lpString=".bac") returned 4 [0083.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".bac") returned 0x0 [0083.426] lstrlenW (lpString=".sys") returned 4 [0083.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".sys") returned 0x0 [0083.427] lstrlenW (lpString=".v2i") returned 4 [0083.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".v2i") returned 0x0 [0083.427] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.428] lstrlenW (lpString=".sql") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".sql") returned 0x0 [0083.428] lstrlenW (lpString=".mdf") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".mdf") returned 0x0 [0083.428] lstrlenW (lpString=".txt") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".txt") returned 0x0 [0083.428] lstrlenW (lpString=".dbf") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".dbf") returned 0x0 [0083.428] lstrlenW (lpString=".ckp") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".ckp") returned 0x0 [0083.428] lstrlenW (lpString=".dacpac") returned 7 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".dacpac") returned 0x0 [0083.428] lstrlenW (lpString=".db3") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".db3") returned 0x0 [0083.428] lstrlenW (lpString=".dtxs") returned 5 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".dtxs") returned 0x0 [0083.428] lstrlenW (lpString=".mdt") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".mdt") returned 0x0 [0083.428] lstrlenW (lpString=".sdf") returned 4 [0083.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".sdf") returned 0x0 [0083.429] lstrlenW (lpString=".MDF") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".MDF") returned 0x0 [0083.429] lstrlenW (lpString=".DBF") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".DBF") returned 0x0 [0083.429] lstrlenW (lpString=".DB") returned 3 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".DB") returned 0x0 [0083.429] lstrlenW (lpString=".db") returned 3 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".db") returned 0x0 [0083.429] lstrlenW (lpString=".ndf") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".ndf") returned 0x0 [0083.429] lstrlenW (lpString=".NDF") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".NDF") returned 0x0 [0083.429] lstrlenW (lpString=".Mdf") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".Mdf") returned 0x0 [0083.429] lstrlenW (lpString=".dat") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".dat") returned 0x0 [0083.429] lstrlenW (lpString=".DAT") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".DAT") returned 0x0 [0083.429] lstrlenW (lpString=".ldf") returned 4 [0083.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".ldf") returned 0x0 [0083.429] lstrlenW (lpString=".LDF") returned 4 [0083.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch=".LDF") returned 0x0 [0083.430] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.430] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.430] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.431] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.431] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20343184597) returned 1 [0083.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc08b6510, dwHighDateTime=0x1d585b4)) [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339ad0 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339ad0 | out: hHeap=0x260000) returned 1 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751820 [0083.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.431] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.432] GetLastError () returned 0x0 [0083.432] GetLastError () returned 0x0 [0083.432] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.432] GetLastError () returned 0x0 [0083.432] GetLastError () returned 0x0 [0083.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.434] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x8be, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x8be, lpOverlapped=0x0) returned 1 [0083.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.434] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.434] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.434] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.434] CloseHandle (hObject=0xf0) returned 1 [0083.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.436] GetLastError () returned 0x0 [0083.436] RtlWakeConditionVariable () returned 0x0 [0083.436] GetCurrentThreadId () returned 0x98c [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".ldf") returned 0x0 [0083.436] lstrlenW (lpString=".vhd") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".vhd") returned 0x0 [0083.436] lstrlenW (lpString=".vhdx") returned 5 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".vhdx") returned 0x0 [0083.436] lstrlenW (lpString=".pst") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".pst") returned 0x0 [0083.436] lstrlenW (lpString=".ost") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".ost") returned 0x0 [0083.436] lstrlenW (lpString=".bak") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".bak") returned 0x0 [0083.436] lstrlenW (lpString=".bac") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".bac") returned 0x0 [0083.436] lstrlenW (lpString=".sys") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".sys") returned 0x0 [0083.436] lstrlenW (lpString=".v2i") returned 4 [0083.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".v2i") returned 0x0 [0083.436] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.438] lstrlenW (lpString=".sql") returned 4 [0083.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".sql") returned 0x0 [0083.438] lstrlenW (lpString=".mdf") returned 4 [0083.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".mdf") returned 0x0 [0083.438] lstrlenW (lpString=".txt") returned 4 [0083.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".txt") returned 0x0 [0083.438] lstrlenW (lpString=".dbf") returned 4 [0083.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".dbf") returned 0x0 [0083.438] lstrlenW (lpString=".ckp") returned 4 [0083.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".ckp") returned 0x0 [0083.438] lstrlenW (lpString=".dacpac") returned 7 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".dacpac") returned 0x0 [0083.439] lstrlenW (lpString=".db3") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".db3") returned 0x0 [0083.439] lstrlenW (lpString=".dtxs") returned 5 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".dtxs") returned 0x0 [0083.439] lstrlenW (lpString=".mdt") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".mdt") returned 0x0 [0083.439] lstrlenW (lpString=".sdf") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".sdf") returned 0x0 [0083.439] lstrlenW (lpString=".MDF") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".MDF") returned 0x0 [0083.439] lstrlenW (lpString=".DBF") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".DBF") returned 0x0 [0083.439] lstrlenW (lpString=".DB") returned 3 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".DB") returned 0x0 [0083.439] lstrlenW (lpString=".db") returned 3 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".db") returned 0x0 [0083.439] lstrlenW (lpString=".ndf") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".ndf") returned 0x0 [0083.439] lstrlenW (lpString=".NDF") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".NDF") returned 0x0 [0083.439] lstrlenW (lpString=".Mdf") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".Mdf") returned 0x0 [0083.439] lstrlenW (lpString=".dat") returned 4 [0083.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".dat") returned 0x0 [0083.440] lstrlenW (lpString=".DAT") returned 4 [0083.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".DAT") returned 0x0 [0083.440] lstrlenW (lpString=".ldf") returned 4 [0083.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".ldf") returned 0x0 [0083.440] lstrlenW (lpString=".LDF") returned 4 [0083.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch=".LDF") returned 0x0 [0083.440] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.440] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.441] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.441] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.441] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20344202097) returned 1 [0083.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc08b6510, dwHighDateTime=0x1d585b4)) [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339b08 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339b08 | out: hHeap=0x260000) returned 1 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751ea8 [0083.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.442] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.442] GetLastError () returned 0x0 [0083.442] GetLastError () returned 0x0 [0083.442] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.442] GetLastError () returned 0x0 [0083.442] GetLastError () returned 0x0 [0083.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcf3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.444] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x30d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x30d, lpOverlapped=0x0) returned 1 [0083.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.444] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.444] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.444] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.444] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.444] CloseHandle (hObject=0xf0) returned 1 [0083.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.445] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.446] GetLastError () returned 0x0 [0083.446] RtlWakeConditionVariable () returned 0x0 [0083.446] GetCurrentThreadId () returned 0x98c [0083.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".ldf") returned 0x0 [0083.446] lstrlenW (lpString=".vhd") returned 4 [0083.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".vhd") returned 0x0 [0083.446] lstrlenW (lpString=".vhdx") returned 5 [0083.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".vhdx") returned 0x0 [0083.446] lstrlenW (lpString=".pst") returned 4 [0083.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".pst") returned 0x0 [0083.446] lstrlenW (lpString=".ost") returned 4 [0083.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".ost") returned 0x0 [0083.446] lstrlenW (lpString=".bak") returned 4 [0083.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".bak") returned 0x0 [0083.447] lstrlenW (lpString=".bac") returned 4 [0083.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".bac") returned 0x0 [0083.447] lstrlenW (lpString=".sys") returned 4 [0083.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".sys") returned 0x0 [0083.447] lstrlenW (lpString=".v2i") returned 4 [0083.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".v2i") returned 0x0 [0083.447] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.448] lstrlenW (lpString=".sql") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".sql") returned 0x0 [0083.448] lstrlenW (lpString=".mdf") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".mdf") returned 0x0 [0083.448] lstrlenW (lpString=".txt") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".txt") returned 0x0 [0083.448] lstrlenW (lpString=".dbf") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".dbf") returned 0x0 [0083.448] lstrlenW (lpString=".ckp") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".ckp") returned 0x0 [0083.448] lstrlenW (lpString=".dacpac") returned 7 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".dacpac") returned 0x0 [0083.448] lstrlenW (lpString=".db3") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".db3") returned 0x0 [0083.448] lstrlenW (lpString=".dtxs") returned 5 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".dtxs") returned 0x0 [0083.448] lstrlenW (lpString=".mdt") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".mdt") returned 0x0 [0083.448] lstrlenW (lpString=".sdf") returned 4 [0083.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".sdf") returned 0x0 [0083.448] lstrlenW (lpString=".MDF") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".MDF") returned 0x0 [0083.449] lstrlenW (lpString=".DBF") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".DBF") returned 0x0 [0083.449] lstrlenW (lpString=".DB") returned 3 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".DB") returned 0x0 [0083.449] lstrlenW (lpString=".db") returned 3 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".db") returned 0x0 [0083.449] lstrlenW (lpString=".ndf") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".ndf") returned 0x0 [0083.449] lstrlenW (lpString=".NDF") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".NDF") returned 0x0 [0083.449] lstrlenW (lpString=".Mdf") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".Mdf") returned 0x0 [0083.449] lstrlenW (lpString=".dat") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".dat") returned 0x0 [0083.449] lstrlenW (lpString=".DAT") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".DAT") returned 0x0 [0083.449] lstrlenW (lpString=".ldf") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".ldf") returned 0x0 [0083.449] lstrlenW (lpString=".LDF") returned 4 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch=".LDF") returned 0x0 [0083.449] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.450] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.450] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.450] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.450] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20345163725) returned 1 [0083.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc08dc670, dwHighDateTime=0x1d585b4)) [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339b40 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339b40 | out: hHeap=0x260000) returned 1 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751e10 [0083.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.451] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.451] GetLastError () returned 0x0 [0083.452] GetLastError () returned 0x0 [0083.452] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.452] GetLastError () returned 0x0 [0083.452] GetLastError () returned 0x0 [0083.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.454] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.454] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.454] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.454] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.454] CloseHandle (hObject=0xf0) returned 1 [0083.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.455] GetLastError () returned 0x0 [0083.456] RtlWakeConditionVariable () returned 0x0 [0083.456] GetCurrentThreadId () returned 0x98c [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".ldf") returned 0x0 [0083.456] lstrlenW (lpString=".vhd") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".vhd") returned 0x0 [0083.456] lstrlenW (lpString=".vhdx") returned 5 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".vhdx") returned 0x0 [0083.456] lstrlenW (lpString=".pst") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".pst") returned 0x0 [0083.456] lstrlenW (lpString=".ost") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".ost") returned 0x0 [0083.456] lstrlenW (lpString=".bak") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".bak") returned 0x0 [0083.456] lstrlenW (lpString=".bac") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".bac") returned 0x0 [0083.456] lstrlenW (lpString=".sys") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".sys") returned 0x0 [0083.456] lstrlenW (lpString=".v2i") returned 4 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".v2i") returned 0x0 [0083.456] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.457] lstrlenW (lpString=".sql") returned 4 [0083.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".sql") returned 0x0 [0083.457] lstrlenW (lpString=".mdf") returned 4 [0083.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".mdf") returned 0x0 [0083.457] lstrlenW (lpString=".txt") returned 4 [0083.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".txt") returned 0x0 [0083.457] lstrlenW (lpString=".dbf") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".dbf") returned 0x0 [0083.458] lstrlenW (lpString=".ckp") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".ckp") returned 0x0 [0083.458] lstrlenW (lpString=".dacpac") returned 7 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".dacpac") returned 0x0 [0083.458] lstrlenW (lpString=".db3") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".db3") returned 0x0 [0083.458] lstrlenW (lpString=".dtxs") returned 5 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".dtxs") returned 0x0 [0083.458] lstrlenW (lpString=".mdt") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".mdt") returned 0x0 [0083.458] lstrlenW (lpString=".sdf") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".sdf") returned 0x0 [0083.458] lstrlenW (lpString=".MDF") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".MDF") returned 0x0 [0083.458] lstrlenW (lpString=".DBF") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".DBF") returned 0x0 [0083.458] lstrlenW (lpString=".DB") returned 3 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".DB") returned 0x0 [0083.458] lstrlenW (lpString=".db") returned 3 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".db") returned 0x0 [0083.458] lstrlenW (lpString=".ndf") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".ndf") returned 0x0 [0083.458] lstrlenW (lpString=".NDF") returned 4 [0083.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".NDF") returned 0x0 [0083.458] lstrlenW (lpString=".Mdf") returned 4 [0083.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".Mdf") returned 0x0 [0083.459] lstrlenW (lpString=".dat") returned 4 [0083.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".dat") returned 0x0 [0083.459] lstrlenW (lpString=".DAT") returned 4 [0083.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".DAT") returned 0x0 [0083.459] lstrlenW (lpString=".ldf") returned 4 [0083.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".ldf") returned 0x0 [0083.459] lstrlenW (lpString=".LDF") returned 4 [0083.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch=".LDF") returned 0x0 [0083.459] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.459] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.460] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.460] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.579] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20357999362) returned 1 [0083.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0a0d170, dwHighDateTime=0x1d585b4)) [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339b78 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339b78 | out: hHeap=0x260000) returned 1 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751e10 [0083.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.580] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.580] GetLastError () returned 0x0 [0083.580] GetLastError () returned 0x0 [0083.580] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.580] GetLastError () returned 0x0 [0083.580] GetLastError () returned 0x0 [0083.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.585] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.585] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.586] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.586] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.586] CloseHandle (hObject=0xf0) returned 1 [0083.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0083.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0083.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.627] GetLastError () returned 0x0 [0083.627] RtlWakeConditionVariable () returned 0x27e828 [0083.627] GetCurrentThreadId () returned 0x98c [0083.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".ldf") returned 0x0 [0083.627] lstrlenW (lpString=".vhd") returned 4 [0083.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".vhd") returned 0x0 [0083.627] lstrlenW (lpString=".vhdx") returned 5 [0083.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".vhdx") returned 0x0 [0083.627] lstrlenW (lpString=".pst") returned 4 [0083.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".pst") returned 0x0 [0083.627] lstrlenW (lpString=".ost") returned 4 [0083.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".ost") returned 0x0 [0083.628] lstrlenW (lpString=".bak") returned 4 [0083.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".bak") returned 0x0 [0083.628] lstrlenW (lpString=".bac") returned 4 [0083.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".bac") returned 0x0 [0083.628] lstrlenW (lpString=".sys") returned 4 [0083.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".sys") returned 0x0 [0083.628] lstrlenW (lpString=".v2i") returned 4 [0083.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".v2i") returned 0x0 [0083.628] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.629] lstrlenW (lpString=".sql") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".sql") returned 0x0 [0083.629] lstrlenW (lpString=".mdf") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".mdf") returned 0x0 [0083.629] lstrlenW (lpString=".txt") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".txt") returned 0x0 [0083.629] lstrlenW (lpString=".dbf") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".dbf") returned 0x0 [0083.629] lstrlenW (lpString=".ckp") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".ckp") returned 0x0 [0083.629] lstrlenW (lpString=".dacpac") returned 7 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".dacpac") returned 0x0 [0083.629] lstrlenW (lpString=".db3") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".db3") returned 0x0 [0083.629] lstrlenW (lpString=".dtxs") returned 5 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".dtxs") returned 0x0 [0083.629] lstrlenW (lpString=".mdt") returned 4 [0083.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".mdt") returned 0x0 [0083.629] lstrlenW (lpString=".sdf") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".sdf") returned 0x0 [0083.630] lstrlenW (lpString=".MDF") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".MDF") returned 0x0 [0083.630] lstrlenW (lpString=".DBF") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".DBF") returned 0x0 [0083.630] lstrlenW (lpString=".DB") returned 3 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".DB") returned 0x0 [0083.630] lstrlenW (lpString=".db") returned 3 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".db") returned 0x0 [0083.630] lstrlenW (lpString=".ndf") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".ndf") returned 0x0 [0083.630] lstrlenW (lpString=".NDF") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".NDF") returned 0x0 [0083.630] lstrlenW (lpString=".Mdf") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".Mdf") returned 0x0 [0083.630] lstrlenW (lpString=".dat") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".dat") returned 0x0 [0083.630] lstrlenW (lpString=".DAT") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".DAT") returned 0x0 [0083.630] lstrlenW (lpString=".ldf") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".ldf") returned 0x0 [0083.630] lstrlenW (lpString=".LDF") returned 4 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch=".LDF") returned 0x0 [0083.630] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0083.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.631] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0083.631] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.631] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0083.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0083.632] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20363267903) returned 1 [0083.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0aa56f0, dwHighDateTime=0x1d585b4)) [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762798 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762798 | out: hHeap=0x260000) returned 1 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765a80 [0083.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.632] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0083.633] GetLastError () returned 0x0 [0083.633] GetLastError () returned 0x0 [0083.633] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0083.633] GetLastError () returned 0x0 [0083.633] GetLastError () returned 0x0 [0084.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.037] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.037] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.037] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.037] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.037] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.038] CloseHandle (hObject=0xf0) returned 1 [0084.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.038] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.039] GetLastError () returned 0x0 [0084.039] RtlWakeConditionVariable () returned 0x27e828 [0084.039] GetCurrentThreadId () returned 0x98c [0084.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".ldf") returned 0x0 [0084.039] lstrlenW (lpString=".vhd") returned 4 [0084.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".vhd") returned 0x0 [0084.040] lstrlenW (lpString=".vhdx") returned 5 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".vhdx") returned 0x0 [0084.040] lstrlenW (lpString=".pst") returned 4 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".pst") returned 0x0 [0084.040] lstrlenW (lpString=".ost") returned 4 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".ost") returned 0x0 [0084.040] lstrlenW (lpString=".bak") returned 4 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".bak") returned 0x0 [0084.040] lstrlenW (lpString=".bac") returned 4 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".bac") returned 0x0 [0084.040] lstrlenW (lpString=".sys") returned 4 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".sys") returned 0x0 [0084.040] lstrlenW (lpString=".v2i") returned 4 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".v2i") returned 0x0 [0084.040] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.041] lstrlenW (lpString=".sql") returned 4 [0084.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".sql") returned 0x0 [0084.041] lstrlenW (lpString=".mdf") returned 4 [0084.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".mdf") returned 0x0 [0084.041] lstrlenW (lpString=".txt") returned 4 [0084.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".txt") returned 0x0 [0084.041] lstrlenW (lpString=".dbf") returned 4 [0084.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".dbf") returned 0x0 [0084.041] lstrlenW (lpString=".ckp") returned 4 [0084.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".ckp") returned 0x0 [0084.041] lstrlenW (lpString=".dacpac") returned 7 [0084.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".dacpac") returned 0x0 [0084.041] lstrlenW (lpString=".db3") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".db3") returned 0x0 [0084.042] lstrlenW (lpString=".dtxs") returned 5 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".dtxs") returned 0x0 [0084.042] lstrlenW (lpString=".mdt") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".mdt") returned 0x0 [0084.042] lstrlenW (lpString=".sdf") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".sdf") returned 0x0 [0084.042] lstrlenW (lpString=".MDF") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".MDF") returned 0x0 [0084.042] lstrlenW (lpString=".DBF") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".DBF") returned 0x0 [0084.042] lstrlenW (lpString=".DB") returned 3 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".DB") returned 0x0 [0084.042] lstrlenW (lpString=".db") returned 3 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".db") returned 0x0 [0084.042] lstrlenW (lpString=".ndf") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".ndf") returned 0x0 [0084.042] lstrlenW (lpString=".NDF") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".NDF") returned 0x0 [0084.042] lstrlenW (lpString=".Mdf") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".Mdf") returned 0x0 [0084.042] lstrlenW (lpString=".dat") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".dat") returned 0x0 [0084.042] lstrlenW (lpString=".DAT") returned 4 [0084.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".DAT") returned 0x0 [0084.042] lstrlenW (lpString=".ldf") returned 4 [0084.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".ldf") returned 0x0 [0084.043] lstrlenW (lpString=".LDF") returned 4 [0084.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch=".LDF") returned 0x0 [0084.043] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.043] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.044] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.044] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.044] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20404490603) returned 1 [0084.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0e83ab0, dwHighDateTime=0x1d585b4)) [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27625d8 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27625d8 | out: hHeap=0x260000) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750a78 [0084.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.044] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.045] GetLastError () returned 0x0 [0084.045] GetLastError () returned 0x0 [0084.045] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.045] GetLastError () returned 0x0 [0084.045] GetLastError () returned 0x0 [0084.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9af, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.053] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x651, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x651, lpOverlapped=0x0) returned 1 [0084.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.054] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.054] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.055] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.055] CloseHandle (hObject=0xf0) returned 1 [0084.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.056] GetLastError () returned 0x0 [0084.056] RtlWakeConditionVariable () returned 0x27e828 [0084.056] GetCurrentThreadId () returned 0x98c [0084.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".ldf") returned 0x0 [0084.056] lstrlenW (lpString=".vhd") returned 4 [0084.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".vhd") returned 0x0 [0084.056] lstrlenW (lpString=".vhdx") returned 5 [0084.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".vhdx") returned 0x0 [0084.056] lstrlenW (lpString=".pst") returned 4 [0084.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".pst") returned 0x0 [0084.056] lstrlenW (lpString=".ost") returned 4 [0084.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".ost") returned 0x0 [0084.056] lstrlenW (lpString=".bak") returned 4 [0084.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".bak") returned 0x0 [0084.057] lstrlenW (lpString=".bac") returned 4 [0084.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".bac") returned 0x0 [0084.057] lstrlenW (lpString=".sys") returned 4 [0084.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".sys") returned 0x0 [0084.057] lstrlenW (lpString=".v2i") returned 4 [0084.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".v2i") returned 0x0 [0084.057] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.058] lstrlenW (lpString=".sql") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".sql") returned 0x0 [0084.058] lstrlenW (lpString=".mdf") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".mdf") returned 0x0 [0084.058] lstrlenW (lpString=".txt") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".txt") returned 0x0 [0084.058] lstrlenW (lpString=".dbf") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".dbf") returned 0x0 [0084.058] lstrlenW (lpString=".ckp") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".ckp") returned 0x0 [0084.058] lstrlenW (lpString=".dacpac") returned 7 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".dacpac") returned 0x0 [0084.058] lstrlenW (lpString=".db3") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".db3") returned 0x0 [0084.058] lstrlenW (lpString=".dtxs") returned 5 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".dtxs") returned 0x0 [0084.058] lstrlenW (lpString=".mdt") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".mdt") returned 0x0 [0084.058] lstrlenW (lpString=".sdf") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".sdf") returned 0x0 [0084.058] lstrlenW (lpString=".MDF") returned 4 [0084.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".MDF") returned 0x0 [0084.059] lstrlenW (lpString=".DBF") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".DBF") returned 0x0 [0084.059] lstrlenW (lpString=".DB") returned 3 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".DB") returned 0x0 [0084.059] lstrlenW (lpString=".db") returned 3 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".db") returned 0x0 [0084.059] lstrlenW (lpString=".ndf") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".ndf") returned 0x0 [0084.059] lstrlenW (lpString=".NDF") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".NDF") returned 0x0 [0084.059] lstrlenW (lpString=".Mdf") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".Mdf") returned 0x0 [0084.059] lstrlenW (lpString=".dat") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".dat") returned 0x0 [0084.059] lstrlenW (lpString=".DAT") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".DAT") returned 0x0 [0084.059] lstrlenW (lpString=".ldf") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".ldf") returned 0x0 [0084.059] lstrlenW (lpString=".LDF") returned 4 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch=".LDF") returned 0x0 [0084.059] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0084.059] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d3ce0) returned 1 [0084.060] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0084.060] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0084.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.060] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20406153066) returned 1 [0084.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0ea9c10, dwHighDateTime=0x1d585b4)) [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339c20 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339c20 | out: hHeap=0x260000) returned 1 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751b18 [0084.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.061] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.061] GetLastError () returned 0x0 [0084.061] GetLastError () returned 0x0 [0084.062] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.062] GetLastError () returned 0x0 [0084.062] GetLastError () returned 0x0 [0084.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.064] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.064] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.064] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.064] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.064] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.064] CloseHandle (hObject=0xf0) returned 1 [0084.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.066] GetLastError () returned 0x0 [0084.066] RtlWakeConditionVariable () returned 0x0 [0084.066] GetCurrentThreadId () returned 0x98c [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".ldf") returned 0x0 [0084.066] lstrlenW (lpString=".vhd") returned 4 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".vhd") returned 0x0 [0084.066] lstrlenW (lpString=".vhdx") returned 5 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".vhdx") returned 0x0 [0084.066] lstrlenW (lpString=".pst") returned 4 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".pst") returned 0x0 [0084.066] lstrlenW (lpString=".ost") returned 4 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".ost") returned 0x0 [0084.066] lstrlenW (lpString=".bak") returned 4 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".bak") returned 0x0 [0084.066] lstrlenW (lpString=".bac") returned 4 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".bac") returned 0x0 [0084.066] lstrlenW (lpString=".sys") returned 4 [0084.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".sys") returned 0x0 [0084.066] lstrlenW (lpString=".v2i") returned 4 [0084.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".v2i") returned 0x0 [0084.067] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.067] lstrlenW (lpString=".sql") returned 4 [0084.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".sql") returned 0x0 [0084.067] lstrlenW (lpString=".mdf") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".mdf") returned 0x0 [0084.068] lstrlenW (lpString=".txt") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".txt") returned 0x0 [0084.068] lstrlenW (lpString=".dbf") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".dbf") returned 0x0 [0084.068] lstrlenW (lpString=".ckp") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".ckp") returned 0x0 [0084.068] lstrlenW (lpString=".dacpac") returned 7 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".dacpac") returned 0x0 [0084.068] lstrlenW (lpString=".db3") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".db3") returned 0x0 [0084.068] lstrlenW (lpString=".dtxs") returned 5 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".dtxs") returned 0x0 [0084.068] lstrlenW (lpString=".mdt") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".mdt") returned 0x0 [0084.068] lstrlenW (lpString=".sdf") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".sdf") returned 0x0 [0084.068] lstrlenW (lpString=".MDF") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".MDF") returned 0x0 [0084.068] lstrlenW (lpString=".DBF") returned 4 [0084.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".DBF") returned 0x0 [0084.069] lstrlenW (lpString=".DB") returned 3 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".DB") returned 0x0 [0084.069] lstrlenW (lpString=".db") returned 3 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".db") returned 0x0 [0084.069] lstrlenW (lpString=".ndf") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".ndf") returned 0x0 [0084.069] lstrlenW (lpString=".NDF") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".NDF") returned 0x0 [0084.069] lstrlenW (lpString=".Mdf") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".Mdf") returned 0x0 [0084.069] lstrlenW (lpString=".dat") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".dat") returned 0x0 [0084.069] lstrlenW (lpString=".DAT") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".DAT") returned 0x0 [0084.069] lstrlenW (lpString=".ldf") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".ldf") returned 0x0 [0084.069] lstrlenW (lpString=".LDF") returned 4 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch=".LDF") returned 0x0 [0084.069] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.069] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.070] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.070] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.070] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20407155426) returned 1 [0084.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0ecfd70, dwHighDateTime=0x1d585b4)) [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339c58 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339c58 | out: hHeap=0x260000) returned 1 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27519e8 [0084.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.071] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.071] GetLastError () returned 0x0 [0084.071] GetLastError () returned 0x0 [0084.072] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.072] GetLastError () returned 0x0 [0084.072] GetLastError () returned 0x0 [0084.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.074] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x30b, lpOverlapped=0x0) returned 1 [0084.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.074] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.074] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.074] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.074] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.074] CloseHandle (hObject=0xf0) returned 1 [0084.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.076] GetLastError () returned 0x0 [0084.076] RtlWakeConditionVariable () returned 0x0 [0084.076] GetCurrentThreadId () returned 0x98c [0084.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".ldf") returned 0x0 [0084.076] lstrlenW (lpString=".vhd") returned 4 [0084.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".vhd") returned 0x0 [0084.076] lstrlenW (lpString=".vhdx") returned 5 [0084.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".vhdx") returned 0x0 [0084.076] lstrlenW (lpString=".pst") returned 4 [0084.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".pst") returned 0x0 [0084.076] lstrlenW (lpString=".ost") returned 4 [0084.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".ost") returned 0x0 [0084.076] lstrlenW (lpString=".bak") returned 4 [0084.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".bak") returned 0x0 [0084.076] lstrlenW (lpString=".bac") returned 4 [0084.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".bac") returned 0x0 [0084.077] lstrlenW (lpString=".sys") returned 4 [0084.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".sys") returned 0x0 [0084.077] lstrlenW (lpString=".v2i") returned 4 [0084.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".v2i") returned 0x0 [0084.077] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.078] lstrlenW (lpString=".sql") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".sql") returned 0x0 [0084.078] lstrlenW (lpString=".mdf") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".mdf") returned 0x0 [0084.078] lstrlenW (lpString=".txt") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".txt") returned 0x0 [0084.078] lstrlenW (lpString=".dbf") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".dbf") returned 0x0 [0084.078] lstrlenW (lpString=".ckp") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".ckp") returned 0x0 [0084.078] lstrlenW (lpString=".dacpac") returned 7 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".dacpac") returned 0x0 [0084.078] lstrlenW (lpString=".db3") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".db3") returned 0x0 [0084.078] lstrlenW (lpString=".dtxs") returned 5 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".dtxs") returned 0x0 [0084.078] lstrlenW (lpString=".mdt") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".mdt") returned 0x0 [0084.078] lstrlenW (lpString=".sdf") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".sdf") returned 0x0 [0084.078] lstrlenW (lpString=".MDF") returned 4 [0084.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".MDF") returned 0x0 [0084.078] lstrlenW (lpString=".DBF") returned 4 [0084.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".DBF") returned 0x0 [0084.079] lstrlenW (lpString=".DB") returned 3 [0084.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".DB") returned 0x0 [0084.079] lstrlenW (lpString=".db") returned 3 [0084.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".db") returned 0x0 [0084.079] lstrlenW (lpString=".ndf") returned 4 [0084.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".ndf") returned 0x0 [0084.079] lstrlenW (lpString=".NDF") returned 4 [0084.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".NDF") returned 0x0 [0084.083] lstrlenW (lpString=".Mdf") returned 4 [0084.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".Mdf") returned 0x0 [0084.083] lstrlenW (lpString=".dat") returned 4 [0084.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".dat") returned 0x0 [0084.084] lstrlenW (lpString=".DAT") returned 4 [0084.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".DAT") returned 0x0 [0084.084] lstrlenW (lpString=".ldf") returned 4 [0084.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".ldf") returned 0x0 [0084.084] lstrlenW (lpString=".LDF") returned 4 [0084.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch=".LDF") returned 0x0 [0084.084] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.084] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.085] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.085] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20408621902) returned 1 [0084.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0ef5ed0, dwHighDateTime=0x1d585b4)) [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339c90 [0084.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339c90 | out: hHeap=0x260000) returned 1 [0084.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28124e0 [0084.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751950 [0084.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28124e0 | out: hHeap=0x260000) returned 1 [0084.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.086] GetLastError () returned 0x0 [0084.086] GetLastError () returned 0x0 [0084.086] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.086] GetLastError () returned 0x0 [0084.087] GetLastError () returned 0x0 [0084.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.172] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.172] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.172] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.173] CloseHandle (hObject=0xf0) returned 1 [0084.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.176] GetLastError () returned 0x0 [0084.177] RtlWakeConditionVariable () returned 0x27e828 [0084.177] GetCurrentThreadId () returned 0x98c [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".ldf") returned 0x0 [0084.177] lstrlenW (lpString=".vhd") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".vhd") returned 0x0 [0084.177] lstrlenW (lpString=".vhdx") returned 5 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".vhdx") returned 0x0 [0084.177] lstrlenW (lpString=".pst") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".pst") returned 0x0 [0084.177] lstrlenW (lpString=".ost") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".ost") returned 0x0 [0084.177] lstrlenW (lpString=".bak") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".bak") returned 0x0 [0084.177] lstrlenW (lpString=".bac") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".bac") returned 0x0 [0084.177] lstrlenW (lpString=".sys") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".sys") returned 0x0 [0084.177] lstrlenW (lpString=".v2i") returned 4 [0084.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".v2i") returned 0x0 [0084.178] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.180] lstrlenW (lpString=".sql") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".sql") returned 0x0 [0084.180] lstrlenW (lpString=".mdf") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".mdf") returned 0x0 [0084.180] lstrlenW (lpString=".txt") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".txt") returned 0x0 [0084.180] lstrlenW (lpString=".dbf") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".dbf") returned 0x0 [0084.180] lstrlenW (lpString=".ckp") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".ckp") returned 0x0 [0084.180] lstrlenW (lpString=".dacpac") returned 7 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".dacpac") returned 0x0 [0084.180] lstrlenW (lpString=".db3") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".db3") returned 0x0 [0084.180] lstrlenW (lpString=".dtxs") returned 5 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".dtxs") returned 0x0 [0084.180] lstrlenW (lpString=".mdt") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".mdt") returned 0x0 [0084.180] lstrlenW (lpString=".sdf") returned 4 [0084.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".sdf") returned 0x0 [0084.180] lstrlenW (lpString=".MDF") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".MDF") returned 0x0 [0084.181] lstrlenW (lpString=".DBF") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".DBF") returned 0x0 [0084.181] lstrlenW (lpString=".DB") returned 3 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".DB") returned 0x0 [0084.181] lstrlenW (lpString=".db") returned 3 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".db") returned 0x0 [0084.181] lstrlenW (lpString=".ndf") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".ndf") returned 0x0 [0084.181] lstrlenW (lpString=".NDF") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".NDF") returned 0x0 [0084.181] lstrlenW (lpString=".Mdf") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".Mdf") returned 0x0 [0084.181] lstrlenW (lpString=".dat") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".dat") returned 0x0 [0084.181] lstrlenW (lpString=".DAT") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".DAT") returned 0x0 [0084.181] lstrlenW (lpString=".ldf") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".ldf") returned 0x0 [0084.181] lstrlenW (lpString=".LDF") returned 4 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch=".LDF") returned 0x0 [0084.181] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.182] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.182] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.183] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20418367970) returned 1 [0084.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc0fda710, dwHighDateTime=0x1d585b4)) [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339d38 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339d38 | out: hHeap=0x260000) returned 1 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27518b8 [0084.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.183] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.183] GetLastError () returned 0x0 [0084.184] GetLastError () returned 0x0 [0084.184] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.184] GetLastError () returned 0x0 [0084.184] GetLastError () returned 0x0 [0084.189] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcf3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.189] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x30d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x30d, lpOverlapped=0x0) returned 1 [0084.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.192] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.192] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.192] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.192] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.192] CloseHandle (hObject=0xf0) returned 1 [0084.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.244] GetLastError () returned 0x0 [0084.244] RtlWakeConditionVariable () returned 0x27e828 [0084.244] GetCurrentThreadId () returned 0x98c [0084.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".ldf") returned 0x0 [0084.244] lstrlenW (lpString=".vhd") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".vhd") returned 0x0 [0084.245] lstrlenW (lpString=".vhdx") returned 5 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".vhdx") returned 0x0 [0084.245] lstrlenW (lpString=".pst") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".pst") returned 0x0 [0084.245] lstrlenW (lpString=".ost") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".ost") returned 0x0 [0084.245] lstrlenW (lpString=".bak") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".bak") returned 0x0 [0084.245] lstrlenW (lpString=".bac") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".bac") returned 0x0 [0084.245] lstrlenW (lpString=".sys") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".sys") returned 0x0 [0084.245] lstrlenW (lpString=".v2i") returned 4 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".v2i") returned 0x0 [0084.245] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.246] lstrlenW (lpString=".sql") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".sql") returned 0x0 [0084.247] lstrlenW (lpString=".mdf") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".mdf") returned 0x0 [0084.247] lstrlenW (lpString=".txt") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".txt") returned 0x0 [0084.247] lstrlenW (lpString=".dbf") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".dbf") returned 0x0 [0084.247] lstrlenW (lpString=".ckp") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".ckp") returned 0x0 [0084.247] lstrlenW (lpString=".dacpac") returned 7 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".dacpac") returned 0x0 [0084.247] lstrlenW (lpString=".db3") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".db3") returned 0x0 [0084.247] lstrlenW (lpString=".dtxs") returned 5 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".dtxs") returned 0x0 [0084.247] lstrlenW (lpString=".mdt") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".mdt") returned 0x0 [0084.247] lstrlenW (lpString=".sdf") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".sdf") returned 0x0 [0084.247] lstrlenW (lpString=".MDF") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".MDF") returned 0x0 [0084.247] lstrlenW (lpString=".DBF") returned 4 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".DBF") returned 0x0 [0084.247] lstrlenW (lpString=".DB") returned 3 [0084.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".DB") returned 0x0 [0084.248] lstrlenW (lpString=".db") returned 3 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".db") returned 0x0 [0084.248] lstrlenW (lpString=".ndf") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".ndf") returned 0x0 [0084.248] lstrlenW (lpString=".NDF") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".NDF") returned 0x0 [0084.248] lstrlenW (lpString=".Mdf") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".Mdf") returned 0x0 [0084.248] lstrlenW (lpString=".dat") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".dat") returned 0x0 [0084.248] lstrlenW (lpString=".DAT") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".DAT") returned 0x0 [0084.248] lstrlenW (lpString=".ldf") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".ldf") returned 0x0 [0084.248] lstrlenW (lpString=".LDF") returned 4 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch=".LDF") returned 0x0 [0084.248] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.248] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.249] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.249] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.249] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20425045203) returned 1 [0084.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1072c90, dwHighDateTime=0x1d585b4)) [0084.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339e50 [0084.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339e50 | out: hHeap=0x260000) returned 1 [0084.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27516f0 [0084.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.250] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.250] GetLastError () returned 0x0 [0084.250] GetLastError () returned 0x0 [0084.251] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.251] GetLastError () returned 0x0 [0084.251] GetLastError () returned 0x0 [0084.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.259] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.259] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.259] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.259] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.259] CloseHandle (hObject=0xf0) returned 1 [0084.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.281] GetLastError () returned 0x0 [0084.282] RtlWakeConditionVariable () returned 0x27e828 [0084.282] GetCurrentThreadId () returned 0x98c [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".ldf") returned 0x0 [0084.282] lstrlenW (lpString=".vhd") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".vhd") returned 0x0 [0084.282] lstrlenW (lpString=".vhdx") returned 5 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".vhdx") returned 0x0 [0084.282] lstrlenW (lpString=".pst") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".pst") returned 0x0 [0084.282] lstrlenW (lpString=".ost") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".ost") returned 0x0 [0084.282] lstrlenW (lpString=".bak") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".bak") returned 0x0 [0084.282] lstrlenW (lpString=".bac") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".bac") returned 0x0 [0084.282] lstrlenW (lpString=".sys") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".sys") returned 0x0 [0084.282] lstrlenW (lpString=".v2i") returned 4 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".v2i") returned 0x0 [0084.282] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.284] lstrlenW (lpString=".sql") returned 4 [0084.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".sql") returned 0x0 [0084.284] lstrlenW (lpString=".mdf") returned 4 [0084.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".mdf") returned 0x0 [0084.284] lstrlenW (lpString=".txt") returned 4 [0084.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".txt") returned 0x0 [0084.284] lstrlenW (lpString=".dbf") returned 4 [0084.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".dbf") returned 0x0 [0084.284] lstrlenW (lpString=".ckp") returned 4 [0084.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".ckp") returned 0x0 [0084.285] lstrlenW (lpString=".dacpac") returned 7 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".dacpac") returned 0x0 [0084.285] lstrlenW (lpString=".db3") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".db3") returned 0x0 [0084.285] lstrlenW (lpString=".dtxs") returned 5 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".dtxs") returned 0x0 [0084.285] lstrlenW (lpString=".mdt") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".mdt") returned 0x0 [0084.285] lstrlenW (lpString=".sdf") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".sdf") returned 0x0 [0084.285] lstrlenW (lpString=".MDF") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".MDF") returned 0x0 [0084.285] lstrlenW (lpString=".DBF") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".DBF") returned 0x0 [0084.285] lstrlenW (lpString=".DB") returned 3 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".DB") returned 0x0 [0084.285] lstrlenW (lpString=".db") returned 3 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".db") returned 0x0 [0084.285] lstrlenW (lpString=".ndf") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".ndf") returned 0x0 [0084.285] lstrlenW (lpString=".NDF") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".NDF") returned 0x0 [0084.285] lstrlenW (lpString=".Mdf") returned 4 [0084.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".Mdf") returned 0x0 [0084.285] lstrlenW (lpString=".dat") returned 4 [0084.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".dat") returned 0x0 [0084.286] lstrlenW (lpString=".DAT") returned 4 [0084.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".DAT") returned 0x0 [0084.286] lstrlenW (lpString=".ldf") returned 4 [0084.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".ldf") returned 0x0 [0084.286] lstrlenW (lpString=".LDF") returned 4 [0084.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch=".LDF") returned 0x0 [0084.286] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.286] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.366] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.366] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20436702363) returned 1 [0084.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc11a3790, dwHighDateTime=0x1d585b4)) [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a010 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a010 | out: hHeap=0x260000) returned 1 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27512c8 [0084.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.367] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.367] GetLastError () returned 0x0 [0084.367] GetLastError () returned 0x0 [0084.367] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.367] GetLastError () returned 0x0 [0084.367] GetLastError () returned 0x0 [0084.431] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.431] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.432] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.432] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.432] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.432] CloseHandle (hObject=0xd8) returned 1 [0084.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.434] GetLastError () returned 0x0 [0084.434] RtlWakeConditionVariable () returned 0x0 [0084.434] GetCurrentThreadId () returned 0x98c [0084.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".ldf") returned 0x0 [0084.434] lstrlenW (lpString=".vhd") returned 4 [0084.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".vhd") returned 0x0 [0084.434] lstrlenW (lpString=".vhdx") returned 5 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".vhdx") returned 0x0 [0084.435] lstrlenW (lpString=".pst") returned 4 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".pst") returned 0x0 [0084.435] lstrlenW (lpString=".ost") returned 4 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".ost") returned 0x0 [0084.435] lstrlenW (lpString=".bak") returned 4 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".bak") returned 0x0 [0084.435] lstrlenW (lpString=".bac") returned 4 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".bac") returned 0x0 [0084.435] lstrlenW (lpString=".sys") returned 4 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".sys") returned 0x0 [0084.435] lstrlenW (lpString=".v2i") returned 4 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".v2i") returned 0x0 [0084.435] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.436] lstrlenW (lpString=".sql") returned 4 [0084.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".sql") returned 0x0 [0084.436] lstrlenW (lpString=".mdf") returned 4 [0084.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".mdf") returned 0x0 [0084.436] lstrlenW (lpString=".txt") returned 4 [0084.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".txt") returned 0x0 [0084.436] lstrlenW (lpString=".dbf") returned 4 [0084.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".dbf") returned 0x0 [0084.436] lstrlenW (lpString=".ckp") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".ckp") returned 0x0 [0084.437] lstrlenW (lpString=".dacpac") returned 7 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".dacpac") returned 0x0 [0084.437] lstrlenW (lpString=".db3") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".db3") returned 0x0 [0084.437] lstrlenW (lpString=".dtxs") returned 5 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".dtxs") returned 0x0 [0084.437] lstrlenW (lpString=".mdt") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".mdt") returned 0x0 [0084.437] lstrlenW (lpString=".sdf") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".sdf") returned 0x0 [0084.437] lstrlenW (lpString=".MDF") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".MDF") returned 0x0 [0084.437] lstrlenW (lpString=".DBF") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".DBF") returned 0x0 [0084.437] lstrlenW (lpString=".DB") returned 3 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".DB") returned 0x0 [0084.437] lstrlenW (lpString=".db") returned 3 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".db") returned 0x0 [0084.437] lstrlenW (lpString=".ndf") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".ndf") returned 0x0 [0084.437] lstrlenW (lpString=".NDF") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".NDF") returned 0x0 [0084.437] lstrlenW (lpString=".Mdf") returned 4 [0084.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".Mdf") returned 0x0 [0084.438] lstrlenW (lpString=".dat") returned 4 [0084.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".dat") returned 0x0 [0084.438] lstrlenW (lpString=".DAT") returned 4 [0084.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".DAT") returned 0x0 [0084.438] lstrlenW (lpString=".ldf") returned 4 [0084.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".ldf") returned 0x0 [0084.438] lstrlenW (lpString=".LDF") returned 4 [0084.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch=".LDF") returned 0x0 [0084.438] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.438] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.439] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.439] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.439] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20444015501) returned 1 [0084.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc123bd10, dwHighDateTime=0x1d585b4)) [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a160 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a160 | out: hHeap=0x260000) returned 1 [0084.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751230 [0084.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.440] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.440] GetLastError () returned 0x0 [0084.440] GetLastError () returned 0x0 [0084.440] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.440] GetLastError () returned 0x0 [0084.440] GetLastError () returned 0x0 [0084.442] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffccb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.442] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x335, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x335, lpOverlapped=0x0) returned 1 [0084.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.442] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.442] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.442] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.442] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.443] CloseHandle (hObject=0xd8) returned 1 [0084.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.445] GetLastError () returned 0x0 [0084.445] RtlWakeConditionVariable () returned 0x27e828 [0084.445] GetCurrentThreadId () returned 0x98c [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".ldf") returned 0x0 [0084.445] lstrlenW (lpString=".vhd") returned 4 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".vhd") returned 0x0 [0084.445] lstrlenW (lpString=".vhdx") returned 5 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".vhdx") returned 0x0 [0084.445] lstrlenW (lpString=".pst") returned 4 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".pst") returned 0x0 [0084.445] lstrlenW (lpString=".ost") returned 4 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".ost") returned 0x0 [0084.445] lstrlenW (lpString=".bak") returned 4 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".bak") returned 0x0 [0084.445] lstrlenW (lpString=".bac") returned 4 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".bac") returned 0x0 [0084.445] lstrlenW (lpString=".sys") returned 4 [0084.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".sys") returned 0x0 [0084.445] lstrlenW (lpString=".v2i") returned 4 [0084.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".v2i") returned 0x0 [0084.446] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.447] lstrlenW (lpString=".sql") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".sql") returned 0x0 [0084.447] lstrlenW (lpString=".mdf") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".mdf") returned 0x0 [0084.447] lstrlenW (lpString=".txt") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".txt") returned 0x0 [0084.447] lstrlenW (lpString=".dbf") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".dbf") returned 0x0 [0084.447] lstrlenW (lpString=".ckp") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".ckp") returned 0x0 [0084.447] lstrlenW (lpString=".dacpac") returned 7 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".dacpac") returned 0x0 [0084.447] lstrlenW (lpString=".db3") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".db3") returned 0x0 [0084.447] lstrlenW (lpString=".dtxs") returned 5 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".dtxs") returned 0x0 [0084.447] lstrlenW (lpString=".mdt") returned 4 [0084.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".mdt") returned 0x0 [0084.448] lstrlenW (lpString=".sdf") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".sdf") returned 0x0 [0084.448] lstrlenW (lpString=".MDF") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".MDF") returned 0x0 [0084.448] lstrlenW (lpString=".DBF") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".DBF") returned 0x0 [0084.448] lstrlenW (lpString=".DB") returned 3 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".DB") returned 0x0 [0084.448] lstrlenW (lpString=".db") returned 3 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".db") returned 0x0 [0084.448] lstrlenW (lpString=".ndf") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".ndf") returned 0x0 [0084.448] lstrlenW (lpString=".NDF") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".NDF") returned 0x0 [0084.448] lstrlenW (lpString=".Mdf") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".Mdf") returned 0x0 [0084.448] lstrlenW (lpString=".dat") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".dat") returned 0x0 [0084.448] lstrlenW (lpString=".DAT") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".DAT") returned 0x0 [0084.448] lstrlenW (lpString=".ldf") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".ldf") returned 0x0 [0084.448] lstrlenW (lpString=".LDF") returned 4 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch=".LDF") returned 0x0 [0084.448] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.449] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.449] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.450] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20445081455) returned 1 [0084.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1261e70, dwHighDateTime=0x1d585b4)) [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a198 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a198 | out: hHeap=0x260000) returned 1 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750ba8 [0084.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.451] GetLastError () returned 0x0 [0084.451] GetLastError () returned 0x0 [0084.451] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.451] GetLastError () returned 0x0 [0084.451] GetLastError () returned 0x0 [0084.453] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffb51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.453] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4af, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x4af, lpOverlapped=0x0) returned 1 [0084.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.453] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.453] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.453] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.453] CloseHandle (hObject=0xd8) returned 1 [0084.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.455] GetLastError () returned 0x0 [0084.455] RtlWakeConditionVariable () returned 0x27e828 [0084.455] GetCurrentThreadId () returned 0x98c [0084.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".ldf") returned 0x0 [0084.455] lstrlenW (lpString=".vhd") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".vhd") returned 0x0 [0084.456] lstrlenW (lpString=".vhdx") returned 5 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".vhdx") returned 0x0 [0084.456] lstrlenW (lpString=".pst") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".pst") returned 0x0 [0084.456] lstrlenW (lpString=".ost") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".ost") returned 0x0 [0084.456] lstrlenW (lpString=".bak") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".bak") returned 0x0 [0084.456] lstrlenW (lpString=".bac") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".bac") returned 0x0 [0084.456] lstrlenW (lpString=".sys") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".sys") returned 0x0 [0084.456] lstrlenW (lpString=".v2i") returned 4 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".v2i") returned 0x0 [0084.456] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.457] lstrlenW (lpString=".sql") returned 4 [0084.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".sql") returned 0x0 [0084.458] lstrlenW (lpString=".mdf") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".mdf") returned 0x0 [0084.458] lstrlenW (lpString=".txt") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".txt") returned 0x0 [0084.458] lstrlenW (lpString=".dbf") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".dbf") returned 0x0 [0084.458] lstrlenW (lpString=".ckp") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".ckp") returned 0x0 [0084.458] lstrlenW (lpString=".dacpac") returned 7 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".dacpac") returned 0x0 [0084.458] lstrlenW (lpString=".db3") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".db3") returned 0x0 [0084.458] lstrlenW (lpString=".dtxs") returned 5 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".dtxs") returned 0x0 [0084.458] lstrlenW (lpString=".mdt") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".mdt") returned 0x0 [0084.458] lstrlenW (lpString=".sdf") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".sdf") returned 0x0 [0084.458] lstrlenW (lpString=".MDF") returned 4 [0084.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".MDF") returned 0x0 [0084.458] lstrlenW (lpString=".DBF") returned 4 [0084.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".DBF") returned 0x0 [0084.459] lstrlenW (lpString=".DB") returned 3 [0084.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".DB") returned 0x0 [0084.459] lstrlenW (lpString=".db") returned 3 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".db") returned 0x0 [0084.460] lstrlenW (lpString=".ndf") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".ndf") returned 0x0 [0084.460] lstrlenW (lpString=".NDF") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".NDF") returned 0x0 [0084.460] lstrlenW (lpString=".Mdf") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".Mdf") returned 0x0 [0084.460] lstrlenW (lpString=".dat") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".dat") returned 0x0 [0084.460] lstrlenW (lpString=".DAT") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".DAT") returned 0x0 [0084.460] lstrlenW (lpString=".ldf") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".ldf") returned 0x0 [0084.460] lstrlenW (lpString=".LDF") returned 4 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch=".LDF") returned 0x0 [0084.460] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.460] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.461] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.461] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.461] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20446244577) returned 1 [0084.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1287fd0, dwHighDateTime=0x1d585b4)) [0084.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a1d0 [0084.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a1d0 | out: hHeap=0x260000) returned 1 [0084.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27509e0 [0084.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.462] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.462] GetLastError () returned 0x0 [0084.462] GetLastError () returned 0x0 [0084.463] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.463] GetLastError () returned 0x0 [0084.463] GetLastError () returned 0x0 [0084.528] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.528] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x343, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x343, lpOverlapped=0x0) returned 1 [0084.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.528] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.528] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.528] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.528] CloseHandle (hObject=0xd8) returned 1 [0084.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.594] GetLastError () returned 0x0 [0084.594] RtlWakeConditionVariable () returned 0x0 [0084.594] GetCurrentThreadId () returned 0x98c [0084.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".ldf") returned 0x0 [0084.594] lstrlenW (lpString=".vhd") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".vhd") returned 0x0 [0084.595] lstrlenW (lpString=".vhdx") returned 5 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".vhdx") returned 0x0 [0084.595] lstrlenW (lpString=".pst") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".pst") returned 0x0 [0084.595] lstrlenW (lpString=".ost") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".ost") returned 0x0 [0084.595] lstrlenW (lpString=".bak") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".bak") returned 0x0 [0084.595] lstrlenW (lpString=".bac") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".bac") returned 0x0 [0084.595] lstrlenW (lpString=".sys") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".sys") returned 0x0 [0084.595] lstrlenW (lpString=".v2i") returned 4 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".v2i") returned 0x0 [0084.595] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.596] lstrlenW (lpString=".sql") returned 4 [0084.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".sql") returned 0x0 [0084.596] lstrlenW (lpString=".mdf") returned 4 [0084.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".mdf") returned 0x0 [0084.596] lstrlenW (lpString=".txt") returned 4 [0084.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".txt") returned 0x0 [0084.596] lstrlenW (lpString=".dbf") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".dbf") returned 0x0 [0084.597] lstrlenW (lpString=".ckp") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".ckp") returned 0x0 [0084.597] lstrlenW (lpString=".dacpac") returned 7 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".dacpac") returned 0x0 [0084.597] lstrlenW (lpString=".db3") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".db3") returned 0x0 [0084.597] lstrlenW (lpString=".dtxs") returned 5 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".dtxs") returned 0x0 [0084.597] lstrlenW (lpString=".mdt") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".mdt") returned 0x0 [0084.597] lstrlenW (lpString=".sdf") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".sdf") returned 0x0 [0084.597] lstrlenW (lpString=".MDF") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".MDF") returned 0x0 [0084.597] lstrlenW (lpString=".DBF") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".DBF") returned 0x0 [0084.597] lstrlenW (lpString=".DB") returned 3 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".DB") returned 0x0 [0084.597] lstrlenW (lpString=".db") returned 3 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".db") returned 0x0 [0084.597] lstrlenW (lpString=".ndf") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".ndf") returned 0x0 [0084.597] lstrlenW (lpString=".NDF") returned 4 [0084.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".NDF") returned 0x0 [0084.598] lstrlenW (lpString=".Mdf") returned 4 [0084.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".Mdf") returned 0x0 [0084.598] lstrlenW (lpString=".dat") returned 4 [0084.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".dat") returned 0x0 [0084.598] lstrlenW (lpString=".DAT") returned 4 [0084.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".DAT") returned 0x0 [0084.598] lstrlenW (lpString=".ldf") returned 4 [0084.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".ldf") returned 0x0 [0084.598] lstrlenW (lpString=".LDF") returned 4 [0084.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch=".LDF") returned 0x0 [0084.598] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.598] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.599] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.599] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20460040827) returned 1 [0084.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc13dec30, dwHighDateTime=0x1d585b4)) [0084.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0230 [0084.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0230 | out: hHeap=0x260000) returned 1 [0084.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0084.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.600] GetLastError () returned 0x0 [0084.600] GetLastError () returned 0x0 [0084.601] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.601] GetLastError () returned 0x0 [0084.601] GetLastError () returned 0x0 [0084.602] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.602] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.603] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.603] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.603] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.603] CloseHandle (hObject=0xd8) returned 1 [0084.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.605] GetLastError () returned 0x0 [0084.605] RtlWakeConditionVariable () returned 0x0 [0084.605] GetCurrentThreadId () returned 0x98c [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".ldf") returned 0x0 [0084.605] lstrlenW (lpString=".vhd") returned 4 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".vhd") returned 0x0 [0084.605] lstrlenW (lpString=".vhdx") returned 5 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".vhdx") returned 0x0 [0084.605] lstrlenW (lpString=".pst") returned 4 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".pst") returned 0x0 [0084.605] lstrlenW (lpString=".ost") returned 4 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".ost") returned 0x0 [0084.605] lstrlenW (lpString=".bak") returned 4 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".bak") returned 0x0 [0084.605] lstrlenW (lpString=".bac") returned 4 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".bac") returned 0x0 [0084.605] lstrlenW (lpString=".sys") returned 4 [0084.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".sys") returned 0x0 [0084.605] lstrlenW (lpString=".v2i") returned 4 [0084.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".v2i") returned 0x0 [0084.606] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.607] lstrlenW (lpString=".sql") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".sql") returned 0x0 [0084.607] lstrlenW (lpString=".mdf") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".mdf") returned 0x0 [0084.607] lstrlenW (lpString=".txt") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".txt") returned 0x0 [0084.607] lstrlenW (lpString=".dbf") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".dbf") returned 0x0 [0084.607] lstrlenW (lpString=".ckp") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".ckp") returned 0x0 [0084.607] lstrlenW (lpString=".dacpac") returned 7 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".dacpac") returned 0x0 [0084.607] lstrlenW (lpString=".db3") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".db3") returned 0x0 [0084.607] lstrlenW (lpString=".dtxs") returned 5 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".dtxs") returned 0x0 [0084.607] lstrlenW (lpString=".mdt") returned 4 [0084.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".mdt") returned 0x0 [0084.607] lstrlenW (lpString=".sdf") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".sdf") returned 0x0 [0084.608] lstrlenW (lpString=".MDF") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".MDF") returned 0x0 [0084.608] lstrlenW (lpString=".DBF") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".DBF") returned 0x0 [0084.608] lstrlenW (lpString=".DB") returned 3 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".DB") returned 0x0 [0084.608] lstrlenW (lpString=".db") returned 3 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".db") returned 0x0 [0084.608] lstrlenW (lpString=".ndf") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".ndf") returned 0x0 [0084.608] lstrlenW (lpString=".NDF") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".NDF") returned 0x0 [0084.608] lstrlenW (lpString=".Mdf") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".Mdf") returned 0x0 [0084.608] lstrlenW (lpString=".dat") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".dat") returned 0x0 [0084.608] lstrlenW (lpString=".DAT") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".DAT") returned 0x0 [0084.608] lstrlenW (lpString=".ldf") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".ldf") returned 0x0 [0084.608] lstrlenW (lpString=".LDF") returned 4 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch=".LDF") returned 0x0 [0084.608] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.609] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.609] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.609] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.610] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20461071227) returned 1 [0084.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc13dec30, dwHighDateTime=0x1d585b4)) [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f01c0 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01c0 | out: hHeap=0x260000) returned 1 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c8a0 [0084.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.610] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.610] GetLastError () returned 0x0 [0084.611] GetLastError () returned 0x0 [0084.611] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.611] GetLastError () returned 0x0 [0084.611] GetLastError () returned 0x0 [0084.612] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.612] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x280, lpOverlapped=0x0) returned 1 [0084.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.612] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.612] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.612] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.612] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.613] CloseHandle (hObject=0xd8) returned 1 [0084.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.615] GetLastError () returned 0x0 [0084.615] RtlWakeConditionVariable () returned 0x0 [0084.615] GetCurrentThreadId () returned 0x98c [0084.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".ldf") returned 0x0 [0084.615] lstrlenW (lpString=".vhd") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".vhd") returned 0x0 [0084.616] lstrlenW (lpString=".vhdx") returned 5 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".vhdx") returned 0x0 [0084.616] lstrlenW (lpString=".pst") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".pst") returned 0x0 [0084.616] lstrlenW (lpString=".ost") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".ost") returned 0x0 [0084.616] lstrlenW (lpString=".bak") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".bak") returned 0x0 [0084.616] lstrlenW (lpString=".bac") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".bac") returned 0x0 [0084.616] lstrlenW (lpString=".sys") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".sys") returned 0x0 [0084.616] lstrlenW (lpString=".v2i") returned 4 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".v2i") returned 0x0 [0084.616] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.617] lstrlenW (lpString=".sql") returned 4 [0084.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".sql") returned 0x0 [0084.617] lstrlenW (lpString=".mdf") returned 4 [0084.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".mdf") returned 0x0 [0084.617] lstrlenW (lpString=".txt") returned 4 [0084.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".txt") returned 0x0 [0084.617] lstrlenW (lpString=".dbf") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".dbf") returned 0x0 [0084.618] lstrlenW (lpString=".ckp") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".ckp") returned 0x0 [0084.618] lstrlenW (lpString=".dacpac") returned 7 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".dacpac") returned 0x0 [0084.618] lstrlenW (lpString=".db3") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".db3") returned 0x0 [0084.618] lstrlenW (lpString=".dtxs") returned 5 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".dtxs") returned 0x0 [0084.618] lstrlenW (lpString=".mdt") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".mdt") returned 0x0 [0084.618] lstrlenW (lpString=".sdf") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".sdf") returned 0x0 [0084.618] lstrlenW (lpString=".MDF") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".MDF") returned 0x0 [0084.618] lstrlenW (lpString=".DBF") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".DBF") returned 0x0 [0084.618] lstrlenW (lpString=".DB") returned 3 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".DB") returned 0x0 [0084.618] lstrlenW (lpString=".db") returned 3 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".db") returned 0x0 [0084.618] lstrlenW (lpString=".ndf") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".ndf") returned 0x0 [0084.618] lstrlenW (lpString=".NDF") returned 4 [0084.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".NDF") returned 0x0 [0084.618] lstrlenW (lpString=".Mdf") returned 4 [0084.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".Mdf") returned 0x0 [0084.619] lstrlenW (lpString=".dat") returned 4 [0084.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".dat") returned 0x0 [0084.619] lstrlenW (lpString=".DAT") returned 4 [0084.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".DAT") returned 0x0 [0084.619] lstrlenW (lpString=".ldf") returned 4 [0084.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".ldf") returned 0x0 [0084.619] lstrlenW (lpString=".LDF") returned 4 [0084.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch=".LDF") returned 0x0 [0084.619] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.619] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.620] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.620] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.620] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20462117689) returned 1 [0084.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1404d90, dwHighDateTime=0x1d585b4)) [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0188 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0188 | out: hHeap=0x260000) returned 1 [0084.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c2b0 [0084.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.621] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.621] GetLastError () returned 0x0 [0084.621] GetLastError () returned 0x0 [0084.621] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.621] GetLastError () returned 0x0 [0084.621] GetLastError () returned 0x0 [0084.622] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.623] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x29c, lpOverlapped=0x0) returned 1 [0084.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.623] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.623] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.623] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.623] CloseHandle (hObject=0xd8) returned 1 [0084.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.625] GetLastError () returned 0x0 [0084.625] RtlWakeConditionVariable () returned 0x27e828 [0084.625] GetCurrentThreadId () returned 0x98c [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".ldf") returned 0x0 [0084.625] lstrlenW (lpString=".vhd") returned 4 [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".vhd") returned 0x0 [0084.625] lstrlenW (lpString=".vhdx") returned 5 [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".vhdx") returned 0x0 [0084.625] lstrlenW (lpString=".pst") returned 4 [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".pst") returned 0x0 [0084.625] lstrlenW (lpString=".ost") returned 4 [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".ost") returned 0x0 [0084.625] lstrlenW (lpString=".bak") returned 4 [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".bak") returned 0x0 [0084.625] lstrlenW (lpString=".bac") returned 4 [0084.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".bac") returned 0x0 [0084.626] lstrlenW (lpString=".sys") returned 4 [0084.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".sys") returned 0x0 [0084.626] lstrlenW (lpString=".v2i") returned 4 [0084.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".v2i") returned 0x0 [0084.626] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.627] lstrlenW (lpString=".sql") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".sql") returned 0x0 [0084.627] lstrlenW (lpString=".mdf") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".mdf") returned 0x0 [0084.627] lstrlenW (lpString=".txt") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".txt") returned 0x0 [0084.627] lstrlenW (lpString=".dbf") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".dbf") returned 0x0 [0084.627] lstrlenW (lpString=".ckp") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".ckp") returned 0x0 [0084.627] lstrlenW (lpString=".dacpac") returned 7 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".dacpac") returned 0x0 [0084.627] lstrlenW (lpString=".db3") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".db3") returned 0x0 [0084.627] lstrlenW (lpString=".dtxs") returned 5 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".dtxs") returned 0x0 [0084.627] lstrlenW (lpString=".mdt") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".mdt") returned 0x0 [0084.627] lstrlenW (lpString=".sdf") returned 4 [0084.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".sdf") returned 0x0 [0084.627] lstrlenW (lpString=".MDF") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".MDF") returned 0x0 [0084.628] lstrlenW (lpString=".DBF") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".DBF") returned 0x0 [0084.628] lstrlenW (lpString=".DB") returned 3 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".DB") returned 0x0 [0084.628] lstrlenW (lpString=".db") returned 3 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".db") returned 0x0 [0084.628] lstrlenW (lpString=".ndf") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".ndf") returned 0x0 [0084.628] lstrlenW (lpString=".NDF") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".NDF") returned 0x0 [0084.628] lstrlenW (lpString=".Mdf") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".Mdf") returned 0x0 [0084.628] lstrlenW (lpString=".dat") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".dat") returned 0x0 [0084.628] lstrlenW (lpString=".DAT") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".DAT") returned 0x0 [0084.628] lstrlenW (lpString=".ldf") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".ldf") returned 0x0 [0084.628] lstrlenW (lpString=".LDF") returned 4 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch=".LDF") returned 0x0 [0084.628] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.628] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.629] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.629] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.629] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20463060835) returned 1 [0084.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1404d90, dwHighDateTime=0x1d585b4)) [0084.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0150 [0084.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0150 | out: hHeap=0x260000) returned 1 [0084.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c050 [0084.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.755] GetLastError () returned 0x0 [0084.756] GetLastError () returned 0x0 [0084.756] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.756] GetLastError () returned 0x0 [0084.756] GetLastError () returned 0x0 [0084.770] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd86a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.771] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x2796, lpOverlapped=0x0) returned 1 [0084.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.771] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.771] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.771] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.771] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.771] CloseHandle (hObject=0xd8) returned 1 [0084.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.772] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.773] GetLastError () returned 0x0 [0084.773] RtlWakeConditionVariable () returned 0x0 [0084.773] GetCurrentThreadId () returned 0x98c [0084.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".ldf") returned 0x0 [0084.773] lstrlenW (lpString=".vhd") returned 4 [0084.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".vhd") returned 0x0 [0084.773] lstrlenW (lpString=".vhdx") returned 5 [0084.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".vhdx") returned 0x0 [0084.773] lstrlenW (lpString=".pst") returned 4 [0084.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".pst") returned 0x0 [0084.774] lstrlenW (lpString=".ost") returned 4 [0084.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".ost") returned 0x0 [0084.774] lstrlenW (lpString=".bak") returned 4 [0084.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".bak") returned 0x0 [0084.774] lstrlenW (lpString=".bac") returned 4 [0084.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".bac") returned 0x0 [0084.774] lstrlenW (lpString=".sys") returned 4 [0084.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".sys") returned 0x0 [0084.774] lstrlenW (lpString=".v2i") returned 4 [0084.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".v2i") returned 0x0 [0084.774] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.775] lstrlenW (lpString=".sql") returned 4 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".sql") returned 0x0 [0084.775] lstrlenW (lpString=".mdf") returned 4 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".mdf") returned 0x0 [0084.775] lstrlenW (lpString=".txt") returned 4 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".txt") returned 0x0 [0084.775] lstrlenW (lpString=".dbf") returned 4 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".dbf") returned 0x0 [0084.775] lstrlenW (lpString=".ckp") returned 4 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".ckp") returned 0x0 [0084.775] lstrlenW (lpString=".dacpac") returned 7 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".dacpac") returned 0x0 [0084.775] lstrlenW (lpString=".db3") returned 4 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".db3") returned 0x0 [0084.775] lstrlenW (lpString=".dtxs") returned 5 [0084.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".dtxs") returned 0x0 [0084.775] lstrlenW (lpString=".mdt") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".mdt") returned 0x0 [0084.776] lstrlenW (lpString=".sdf") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".sdf") returned 0x0 [0084.776] lstrlenW (lpString=".MDF") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".MDF") returned 0x0 [0084.776] lstrlenW (lpString=".DBF") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".DBF") returned 0x0 [0084.776] lstrlenW (lpString=".DB") returned 3 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".DB") returned 0x0 [0084.776] lstrlenW (lpString=".db") returned 3 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".db") returned 0x0 [0084.776] lstrlenW (lpString=".ndf") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".ndf") returned 0x0 [0084.776] lstrlenW (lpString=".NDF") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".NDF") returned 0x0 [0084.776] lstrlenW (lpString=".Mdf") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".Mdf") returned 0x0 [0084.776] lstrlenW (lpString=".dat") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".dat") returned 0x0 [0084.776] lstrlenW (lpString=".DAT") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".DAT") returned 0x0 [0084.776] lstrlenW (lpString=".ldf") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".ldf") returned 0x0 [0084.776] lstrlenW (lpString=".LDF") returned 4 [0084.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch=".LDF") returned 0x0 [0084.776] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.777] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d30a8) returned 1 [0084.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.777] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.778] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20477877057) returned 1 [0084.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1581b50, dwHighDateTime=0x1d585b4)) [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c4b8 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c4b8 | out: hHeap=0x260000) returned 1 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c938 [0084.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.778] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.778] GetLastError () returned 0x0 [0084.779] GetLastError () returned 0x0 [0084.779] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.779] GetLastError () returned 0x0 [0084.779] GetLastError () returned 0x0 [0084.798] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.798] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x326, lpOverlapped=0x0) returned 1 [0084.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.798] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.798] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.798] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.798] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.798] CloseHandle (hObject=0xd8) returned 1 [0084.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.800] GetLastError () returned 0x0 [0084.800] RtlWakeConditionVariable () returned 0x0 [0084.800] GetCurrentThreadId () returned 0x98c [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".ldf") returned 0x0 [0084.800] lstrlenW (lpString=".vhd") returned 4 [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".vhd") returned 0x0 [0084.800] lstrlenW (lpString=".vhdx") returned 5 [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".vhdx") returned 0x0 [0084.800] lstrlenW (lpString=".pst") returned 4 [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".pst") returned 0x0 [0084.800] lstrlenW (lpString=".ost") returned 4 [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".ost") returned 0x0 [0084.800] lstrlenW (lpString=".bak") returned 4 [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".bak") returned 0x0 [0084.800] lstrlenW (lpString=".bac") returned 4 [0084.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".bac") returned 0x0 [0084.800] lstrlenW (lpString=".sys") returned 4 [0084.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".sys") returned 0x0 [0084.801] lstrlenW (lpString=".v2i") returned 4 [0084.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".v2i") returned 0x0 [0084.801] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0084.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.802] lstrlenW (lpString=".sql") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".sql") returned 0x0 [0084.802] lstrlenW (lpString=".mdf") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".mdf") returned 0x0 [0084.802] lstrlenW (lpString=".txt") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".txt") returned 0x0 [0084.802] lstrlenW (lpString=".dbf") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".dbf") returned 0x0 [0084.802] lstrlenW (lpString=".ckp") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".ckp") returned 0x0 [0084.802] lstrlenW (lpString=".dacpac") returned 7 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".dacpac") returned 0x0 [0084.802] lstrlenW (lpString=".db3") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".db3") returned 0x0 [0084.802] lstrlenW (lpString=".dtxs") returned 5 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".dtxs") returned 0x0 [0084.802] lstrlenW (lpString=".mdt") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".mdt") returned 0x0 [0084.802] lstrlenW (lpString=".sdf") returned 4 [0084.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".sdf") returned 0x0 [0084.803] lstrlenW (lpString=".MDF") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".MDF") returned 0x0 [0084.803] lstrlenW (lpString=".DBF") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".DBF") returned 0x0 [0084.803] lstrlenW (lpString=".DB") returned 3 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".DB") returned 0x0 [0084.803] lstrlenW (lpString=".db") returned 3 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".db") returned 0x0 [0084.803] lstrlenW (lpString=".ndf") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".ndf") returned 0x0 [0084.803] lstrlenW (lpString=".NDF") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".NDF") returned 0x0 [0084.803] lstrlenW (lpString=".Mdf") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".Mdf") returned 0x0 [0084.803] lstrlenW (lpString=".dat") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".dat") returned 0x0 [0084.803] lstrlenW (lpString=".DAT") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".DAT") returned 0x0 [0084.803] lstrlenW (lpString=".ldf") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".ldf") returned 0x0 [0084.803] lstrlenW (lpString=".LDF") returned 4 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch=".LDF") returned 0x0 [0084.803] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.804] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2d3ac0) returned 1 [0084.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.804] CryptReleaseContext (hProv=0x2d3ac0, dwFlags=0x0) returned 1 [0084.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.805] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20480566156) returned 1 [0084.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc15cde10, dwHighDateTime=0x1d585b4)) [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c598 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c598 | out: hHeap=0x260000) returned 1 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0084.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.805] GetLastError () returned 0x0 [0084.806] GetLastError () returned 0x0 [0084.806] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.806] GetLastError () returned 0x0 [0084.806] GetLastError () returned 0x0 [0084.821] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.821] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.822] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.822] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.830] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.831] CloseHandle (hObject=0xd8) returned 1 [0084.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0084.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.[deadmin@cock.li].deadmin")) returned 1 [0084.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0084.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.856] GetLastError () returned 0x0 [0084.856] RtlWakeConditionVariable () returned 0x0 [0084.856] GetCurrentThreadId () returned 0x98c [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".ldf") returned 0x0 [0084.857] lstrlenW (lpString=".vhd") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".vhd") returned 0x0 [0084.857] lstrlenW (lpString=".vhdx") returned 5 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".vhdx") returned 0x0 [0084.857] lstrlenW (lpString=".pst") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".pst") returned 0x0 [0084.857] lstrlenW (lpString=".ost") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".ost") returned 0x0 [0084.857] lstrlenW (lpString=".bak") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".bak") returned 0x0 [0084.857] lstrlenW (lpString=".bac") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".bac") returned 0x0 [0084.857] lstrlenW (lpString=".sys") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".sys") returned 0x0 [0084.857] lstrlenW (lpString=".v2i") returned 4 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".v2i") returned 0x0 [0084.857] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0084.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.871] lstrlenW (lpString=".sql") returned 4 [0084.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".sql") returned 0x0 [0084.882] lstrlenW (lpString=".mdf") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".mdf") returned 0x0 [0084.882] lstrlenW (lpString=".txt") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".txt") returned 0x0 [0084.882] lstrlenW (lpString=".dbf") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".dbf") returned 0x0 [0084.882] lstrlenW (lpString=".ckp") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".ckp") returned 0x0 [0084.882] lstrlenW (lpString=".dacpac") returned 7 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".dacpac") returned 0x0 [0084.882] lstrlenW (lpString=".db3") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".db3") returned 0x0 [0084.882] lstrlenW (lpString=".dtxs") returned 5 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".dtxs") returned 0x0 [0084.882] lstrlenW (lpString=".mdt") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".mdt") returned 0x0 [0084.882] lstrlenW (lpString=".sdf") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".sdf") returned 0x0 [0084.882] lstrlenW (lpString=".MDF") returned 4 [0084.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".MDF") returned 0x0 [0084.882] lstrlenW (lpString=".DBF") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".DBF") returned 0x0 [0084.883] lstrlenW (lpString=".DB") returned 3 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".DB") returned 0x0 [0084.883] lstrlenW (lpString=".db") returned 3 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".db") returned 0x0 [0084.883] lstrlenW (lpString=".ndf") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".ndf") returned 0x0 [0084.883] lstrlenW (lpString=".NDF") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".NDF") returned 0x0 [0084.883] lstrlenW (lpString=".Mdf") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".Mdf") returned 0x0 [0084.883] lstrlenW (lpString=".dat") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".dat") returned 0x0 [0084.883] lstrlenW (lpString=".DAT") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".DAT") returned 0x0 [0084.883] lstrlenW (lpString=".ldf") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".ldf") returned 0x0 [0084.883] lstrlenW (lpString=".LDF") returned 4 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch=".LDF") returned 0x0 [0084.883] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.883] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e2f8) returned 1 [0084.884] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.884] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.884] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20488556991) returned 1 [0084.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc168c4f0, dwHighDateTime=0x1d585b4)) [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c6e8 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c6e8 | out: hHeap=0x260000) returned 1 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bdf0 [0084.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0084.885] GetLastError () returned 0x0 [0084.886] GetLastError () returned 0x0 [0084.886] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0084.886] GetLastError () returned 0x0 [0084.886] GetLastError () returned 0x0 [0084.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.889] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.891] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.891] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.895] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.895] CloseHandle (hObject=0xf0) returned 1 [0084.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0084.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.[deadmin@cock.li].deadmin")) returned 1 [0084.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0084.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.974] GetLastError () returned 0x0 [0084.974] RtlWakeConditionVariable () returned 0x0 [0084.974] GetCurrentThreadId () returned 0x98c [0084.975] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.975] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.975] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0084.975] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0084.976] CloseHandle (hObject=0xf0) returned 1 [0084.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0084.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0084.977] RtlWakeConditionVariable () returned 0x0 [0084.977] GetCurrentThreadId () returned 0x98c [0085.065] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.065] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.065] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.065] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.068] CloseHandle (hObject=0xf0) returned 1 [0085.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e400 | out: hHeap=0x260000) returned 1 [0085.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.068] RtlWakeConditionVariable () returned 0x0 [0085.068] GetCurrentThreadId () returned 0x98c [0085.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".ldf") returned 0x0 [0085.068] lstrlenW (lpString=".vhd") returned 4 [0085.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".vhd") returned 0x0 [0085.069] lstrlenW (lpString=".vhdx") returned 5 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".vhdx") returned 0x0 [0085.069] lstrlenW (lpString=".pst") returned 4 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".pst") returned 0x0 [0085.069] lstrlenW (lpString=".ost") returned 4 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".ost") returned 0x0 [0085.069] lstrlenW (lpString=".bak") returned 4 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".bak") returned 0x0 [0085.069] lstrlenW (lpString=".bac") returned 4 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".bac") returned 0x0 [0085.069] lstrlenW (lpString=".sys") returned 4 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".sys") returned 0x0 [0085.069] lstrlenW (lpString=".v2i") returned 4 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".v2i") returned 0x0 [0085.069] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.070] lstrlenW (lpString=".sql") returned 4 [0085.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".sql") returned 0x0 [0085.070] lstrlenW (lpString=".mdf") returned 4 [0085.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".mdf") returned 0x0 [0085.070] lstrlenW (lpString=".txt") returned 4 [0085.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".txt") returned 0x0 [0085.070] lstrlenW (lpString=".dbf") returned 4 [0085.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".dbf") returned 0x0 [0085.070] lstrlenW (lpString=".ckp") returned 4 [0085.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".ckp") returned 0x0 [0085.070] lstrlenW (lpString=".dacpac") returned 7 [0085.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".dacpac") returned 0x0 [0085.071] lstrlenW (lpString=".db3") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".db3") returned 0x0 [0085.071] lstrlenW (lpString=".dtxs") returned 5 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".dtxs") returned 0x0 [0085.071] lstrlenW (lpString=".mdt") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".mdt") returned 0x0 [0085.071] lstrlenW (lpString=".sdf") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".sdf") returned 0x0 [0085.071] lstrlenW (lpString=".MDF") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".MDF") returned 0x0 [0085.071] lstrlenW (lpString=".DBF") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".DBF") returned 0x0 [0085.071] lstrlenW (lpString=".DB") returned 3 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".DB") returned 0x0 [0085.071] lstrlenW (lpString=".db") returned 3 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".db") returned 0x0 [0085.071] lstrlenW (lpString=".ndf") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".ndf") returned 0x0 [0085.071] lstrlenW (lpString=".NDF") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".NDF") returned 0x0 [0085.071] lstrlenW (lpString=".Mdf") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".Mdf") returned 0x0 [0085.071] lstrlenW (lpString=".dat") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".dat") returned 0x0 [0085.071] lstrlenW (lpString=".DAT") returned 4 [0085.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".DAT") returned 0x0 [0085.072] lstrlenW (lpString=".ldf") returned 4 [0085.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".ldf") returned 0x0 [0085.072] lstrlenW (lpString=".LDF") returned 4 [0085.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch=".LDF") returned 0x0 [0085.072] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.072] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.073] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.073] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.073] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20507399432) returned 1 [0085.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1855570, dwHighDateTime=0x1d585b4)) [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762fe8 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762fe8 | out: hHeap=0x260000) returned 1 [0085.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0085.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0085.074] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.074] GetLastError () returned 0x0 [0085.074] GetLastError () returned 0x0 [0085.074] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.074] GetLastError () returned 0x0 [0085.074] GetLastError () returned 0x0 [0085.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc500, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.077] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3b00, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3b00, lpOverlapped=0x0) returned 1 [0085.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.077] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.077] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.077] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.077] CloseHandle (hObject=0xf0) returned 1 [0085.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.079] GetLastError () returned 0x0 [0085.079] RtlWakeConditionVariable () returned 0x0 [0085.079] GetCurrentThreadId () returned 0x98c [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".ldf") returned 0x0 [0085.079] lstrlenW (lpString=".vhd") returned 4 [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".vhd") returned 0x0 [0085.079] lstrlenW (lpString=".vhdx") returned 5 [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".vhdx") returned 0x0 [0085.079] lstrlenW (lpString=".pst") returned 4 [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".pst") returned 0x0 [0085.079] lstrlenW (lpString=".ost") returned 4 [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".ost") returned 0x0 [0085.079] lstrlenW (lpString=".bak") returned 4 [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".bak") returned 0x0 [0085.079] lstrlenW (lpString=".bac") returned 4 [0085.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".bac") returned 0x0 [0085.080] lstrlenW (lpString=".sys") returned 4 [0085.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".sys") returned 0x0 [0085.080] lstrlenW (lpString=".v2i") returned 4 [0085.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".v2i") returned 0x0 [0085.080] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.081] lstrlenW (lpString=".sql") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".sql") returned 0x0 [0085.081] lstrlenW (lpString=".mdf") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".mdf") returned 0x0 [0085.081] lstrlenW (lpString=".txt") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".txt") returned 0x0 [0085.081] lstrlenW (lpString=".dbf") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".dbf") returned 0x0 [0085.081] lstrlenW (lpString=".ckp") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".ckp") returned 0x0 [0085.081] lstrlenW (lpString=".dacpac") returned 7 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".dacpac") returned 0x0 [0085.081] lstrlenW (lpString=".db3") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".db3") returned 0x0 [0085.081] lstrlenW (lpString=".dtxs") returned 5 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".dtxs") returned 0x0 [0085.081] lstrlenW (lpString=".mdt") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".mdt") returned 0x0 [0085.081] lstrlenW (lpString=".sdf") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".sdf") returned 0x0 [0085.081] lstrlenW (lpString=".MDF") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".MDF") returned 0x0 [0085.081] lstrlenW (lpString=".DBF") returned 4 [0085.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".DBF") returned 0x0 [0085.082] lstrlenW (lpString=".DB") returned 3 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".DB") returned 0x0 [0085.082] lstrlenW (lpString=".db") returned 3 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".db") returned 0x0 [0085.082] lstrlenW (lpString=".ndf") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".ndf") returned 0x0 [0085.082] lstrlenW (lpString=".NDF") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".NDF") returned 0x0 [0085.082] lstrlenW (lpString=".Mdf") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".Mdf") returned 0x0 [0085.082] lstrlenW (lpString=".dat") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".dat") returned 0x0 [0085.082] lstrlenW (lpString=".DAT") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".DAT") returned 0x0 [0085.082] lstrlenW (lpString=".ldf") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".ldf") returned 0x0 [0085.082] lstrlenW (lpString=".LDF") returned 4 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch=".LDF") returned 0x0 [0085.082] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.083] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.083] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.083] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.083] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20508886421) returned 1 [0085.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc187b6d0, dwHighDateTime=0x1d585b4)) [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762fb0 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762fb0 | out: hHeap=0x260000) returned 1 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a640 [0085.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a640 | out: hHeap=0x260000) returned 1 [0085.088] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.089] GetLastError () returned 0x0 [0085.089] GetLastError () returned 0x0 [0085.089] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.089] GetLastError () returned 0x0 [0085.090] GetLastError () returned 0x0 [0085.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff637c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.092] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9c84, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x9c84, lpOverlapped=0x0) returned 1 [0085.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.092] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.092] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.093] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.093] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.093] CloseHandle (hObject=0xf0) returned 1 [0085.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.094] GetLastError () returned 0x0 [0085.094] RtlWakeConditionVariable () returned 0x0 [0085.094] GetCurrentThreadId () returned 0x98c [0085.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".ldf") returned 0x0 [0085.094] lstrlenW (lpString=".vhd") returned 4 [0085.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".vhd") returned 0x0 [0085.095] lstrlenW (lpString=".vhdx") returned 5 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".vhdx") returned 0x0 [0085.095] lstrlenW (lpString=".pst") returned 4 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".pst") returned 0x0 [0085.095] lstrlenW (lpString=".ost") returned 4 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".ost") returned 0x0 [0085.095] lstrlenW (lpString=".bak") returned 4 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".bak") returned 0x0 [0085.095] lstrlenW (lpString=".bac") returned 4 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".bac") returned 0x0 [0085.095] lstrlenW (lpString=".sys") returned 4 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".sys") returned 0x0 [0085.095] lstrlenW (lpString=".v2i") returned 4 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".v2i") returned 0x0 [0085.095] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.096] lstrlenW (lpString=".sql") returned 4 [0085.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".sql") returned 0x0 [0085.096] lstrlenW (lpString=".mdf") returned 4 [0085.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".mdf") returned 0x0 [0085.096] lstrlenW (lpString=".txt") returned 4 [0085.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".txt") returned 0x0 [0085.096] lstrlenW (lpString=".dbf") returned 4 [0085.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".dbf") returned 0x0 [0085.096] lstrlenW (lpString=".ckp") returned 4 [0085.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".ckp") returned 0x0 [0085.096] lstrlenW (lpString=".dacpac") returned 7 [0085.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".dacpac") returned 0x0 [0085.096] lstrlenW (lpString=".db3") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".db3") returned 0x0 [0085.097] lstrlenW (lpString=".dtxs") returned 5 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".dtxs") returned 0x0 [0085.097] lstrlenW (lpString=".mdt") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".mdt") returned 0x0 [0085.097] lstrlenW (lpString=".sdf") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".sdf") returned 0x0 [0085.097] lstrlenW (lpString=".MDF") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".MDF") returned 0x0 [0085.097] lstrlenW (lpString=".DBF") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".DBF") returned 0x0 [0085.097] lstrlenW (lpString=".DB") returned 3 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".DB") returned 0x0 [0085.097] lstrlenW (lpString=".db") returned 3 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".db") returned 0x0 [0085.097] lstrlenW (lpString=".ndf") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".ndf") returned 0x0 [0085.097] lstrlenW (lpString=".NDF") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".NDF") returned 0x0 [0085.097] lstrlenW (lpString=".Mdf") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".Mdf") returned 0x0 [0085.097] lstrlenW (lpString=".dat") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".dat") returned 0x0 [0085.097] lstrlenW (lpString=".DAT") returned 4 [0085.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".DAT") returned 0x0 [0085.097] lstrlenW (lpString=".ldf") returned 4 [0085.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".ldf") returned 0x0 [0085.098] lstrlenW (lpString=".LDF") returned 4 [0085.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch=".LDF") returned 0x0 [0085.098] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.098] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.279] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.279] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.280] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20528078629) returned 1 [0085.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1a44750, dwHighDateTime=0x1d585b4)) [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762f08 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762f08 | out: hHeap=0x260000) returned 1 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a6e8 [0085.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a6e8 | out: hHeap=0x260000) returned 1 [0085.280] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.280] GetLastError () returned 0x0 [0085.281] GetLastError () returned 0x0 [0085.281] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.281] GetLastError () returned 0x0 [0085.281] GetLastError () returned 0x0 [0085.284] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff72ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.284] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8d36, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x8d36, lpOverlapped=0x0) returned 1 [0085.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.285] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.285] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.285] CloseHandle (hObject=0xf0) returned 1 [0085.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.328] GetLastError () returned 0x0 [0085.328] RtlWakeConditionVariable () returned 0x27e828 [0085.328] GetCurrentThreadId () returned 0x98c [0085.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".ldf") returned 0x0 [0085.328] lstrlenW (lpString=".vhd") returned 4 [0085.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".vhd") returned 0x0 [0085.329] lstrlenW (lpString=".vhdx") returned 5 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".vhdx") returned 0x0 [0085.329] lstrlenW (lpString=".pst") returned 4 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".pst") returned 0x0 [0085.329] lstrlenW (lpString=".ost") returned 4 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".ost") returned 0x0 [0085.329] lstrlenW (lpString=".bak") returned 4 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".bak") returned 0x0 [0085.329] lstrlenW (lpString=".bac") returned 4 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".bac") returned 0x0 [0085.329] lstrlenW (lpString=".sys") returned 4 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".sys") returned 0x0 [0085.329] lstrlenW (lpString=".v2i") returned 4 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".v2i") returned 0x0 [0085.329] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.330] lstrlenW (lpString=".sql") returned 4 [0085.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".sql") returned 0x0 [0085.330] lstrlenW (lpString=".mdf") returned 4 [0085.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".mdf") returned 0x0 [0085.330] lstrlenW (lpString=".txt") returned 4 [0085.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".txt") returned 0x0 [0085.330] lstrlenW (lpString=".dbf") returned 4 [0085.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".dbf") returned 0x0 [0085.330] lstrlenW (lpString=".ckp") returned 4 [0085.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".ckp") returned 0x0 [0085.330] lstrlenW (lpString=".dacpac") returned 7 [0085.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".dacpac") returned 0x0 [0085.330] lstrlenW (lpString=".db3") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".db3") returned 0x0 [0085.331] lstrlenW (lpString=".dtxs") returned 5 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".dtxs") returned 0x0 [0085.331] lstrlenW (lpString=".mdt") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".mdt") returned 0x0 [0085.331] lstrlenW (lpString=".sdf") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".sdf") returned 0x0 [0085.331] lstrlenW (lpString=".MDF") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".MDF") returned 0x0 [0085.331] lstrlenW (lpString=".DBF") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".DBF") returned 0x0 [0085.331] lstrlenW (lpString=".DB") returned 3 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".DB") returned 0x0 [0085.331] lstrlenW (lpString=".db") returned 3 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".db") returned 0x0 [0085.331] lstrlenW (lpString=".ndf") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".ndf") returned 0x0 [0085.331] lstrlenW (lpString=".NDF") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".NDF") returned 0x0 [0085.331] lstrlenW (lpString=".Mdf") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".Mdf") returned 0x0 [0085.331] lstrlenW (lpString=".dat") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".dat") returned 0x0 [0085.331] lstrlenW (lpString=".DAT") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".DAT") returned 0x0 [0085.331] lstrlenW (lpString=".ldf") returned 4 [0085.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".ldf") returned 0x0 [0085.332] lstrlenW (lpString=".LDF") returned 4 [0085.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch=".LDF") returned 0x0 [0085.332] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.332] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.333] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.333] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20533401798) returned 1 [0085.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1adccd0, dwHighDateTime=0x1d585b4)) [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27632f8 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27632f8 | out: hHeap=0x260000) returned 1 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a790 [0085.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a790 | out: hHeap=0x260000) returned 1 [0085.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.334] GetLastError () returned 0x0 [0085.334] GetLastError () returned 0x0 [0085.334] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.334] GetLastError () returned 0x0 [0085.334] GetLastError () returned 0x0 [0085.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff297a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.337] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd686, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd686, lpOverlapped=0x0) returned 1 [0085.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.338] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.338] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.338] CloseHandle (hObject=0xf0) returned 1 [0085.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.339] GetLastError () returned 0x0 [0085.339] RtlWakeConditionVariable () returned 0x0 [0085.339] GetCurrentThreadId () returned 0x98c [0085.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".ldf") returned 0x0 [0085.339] lstrlenW (lpString=".vhd") returned 4 [0085.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".vhd") returned 0x0 [0085.339] lstrlenW (lpString=".vhdx") returned 5 [0085.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".vhdx") returned 0x0 [0085.339] lstrlenW (lpString=".pst") returned 4 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".pst") returned 0x0 [0085.340] lstrlenW (lpString=".ost") returned 4 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".ost") returned 0x0 [0085.340] lstrlenW (lpString=".bak") returned 4 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".bak") returned 0x0 [0085.340] lstrlenW (lpString=".bac") returned 4 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".bac") returned 0x0 [0085.340] lstrlenW (lpString=".sys") returned 4 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".sys") returned 0x0 [0085.340] lstrlenW (lpString=".v2i") returned 4 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".v2i") returned 0x0 [0085.340] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.341] lstrlenW (lpString=".sql") returned 4 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".sql") returned 0x0 [0085.341] lstrlenW (lpString=".mdf") returned 4 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".mdf") returned 0x0 [0085.341] lstrlenW (lpString=".txt") returned 4 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".txt") returned 0x0 [0085.341] lstrlenW (lpString=".dbf") returned 4 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".dbf") returned 0x0 [0085.341] lstrlenW (lpString=".ckp") returned 4 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".ckp") returned 0x0 [0085.341] lstrlenW (lpString=".dacpac") returned 7 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".dacpac") returned 0x0 [0085.341] lstrlenW (lpString=".db3") returned 4 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".db3") returned 0x0 [0085.341] lstrlenW (lpString=".dtxs") returned 5 [0085.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".dtxs") returned 0x0 [0085.342] lstrlenW (lpString=".mdt") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".mdt") returned 0x0 [0085.342] lstrlenW (lpString=".sdf") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".sdf") returned 0x0 [0085.342] lstrlenW (lpString=".MDF") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".MDF") returned 0x0 [0085.342] lstrlenW (lpString=".DBF") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".DBF") returned 0x0 [0085.342] lstrlenW (lpString=".DB") returned 3 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".DB") returned 0x0 [0085.342] lstrlenW (lpString=".db") returned 3 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".db") returned 0x0 [0085.342] lstrlenW (lpString=".ndf") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".ndf") returned 0x0 [0085.342] lstrlenW (lpString=".NDF") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".NDF") returned 0x0 [0085.342] lstrlenW (lpString=".Mdf") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".Mdf") returned 0x0 [0085.342] lstrlenW (lpString=".dat") returned 4 [0085.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".dat") returned 0x0 [0085.342] lstrlenW (lpString=".DAT") returned 4 [0085.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".DAT") returned 0x0 [0085.343] lstrlenW (lpString=".ldf") returned 4 [0085.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".ldf") returned 0x0 [0085.343] lstrlenW (lpString=".LDF") returned 4 [0085.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch=".LDF") returned 0x0 [0085.343] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.343] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.344] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.344] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.344] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20534521679) returned 1 [0085.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1adccd0, dwHighDateTime=0x1d585b4)) [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763368 [0085.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763368 | out: hHeap=0x260000) returned 1 [0085.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a988 [0085.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a988 | out: hHeap=0x260000) returned 1 [0085.345] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.345] GetLastError () returned 0x0 [0085.345] GetLastError () returned 0x0 [0085.345] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.345] GetLastError () returned 0x0 [0085.346] GetLastError () returned 0x0 [0085.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffeff16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.348] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x100ea, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x100ea, lpOverlapped=0x0) returned 1 [0085.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.348] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.348] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.348] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.349] CloseHandle (hObject=0xf0) returned 1 [0085.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.350] GetLastError () returned 0x0 [0085.350] RtlWakeConditionVariable () returned 0x0 [0085.350] GetCurrentThreadId () returned 0x98c [0085.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".ldf") returned 0x0 [0085.350] lstrlenW (lpString=".vhd") returned 4 [0085.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".vhd") returned 0x0 [0085.350] lstrlenW (lpString=".vhdx") returned 5 [0085.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".vhdx") returned 0x0 [0085.350] lstrlenW (lpString=".pst") returned 4 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".pst") returned 0x0 [0085.351] lstrlenW (lpString=".ost") returned 4 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".ost") returned 0x0 [0085.351] lstrlenW (lpString=".bak") returned 4 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".bak") returned 0x0 [0085.351] lstrlenW (lpString=".bac") returned 4 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".bac") returned 0x0 [0085.351] lstrlenW (lpString=".sys") returned 4 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".sys") returned 0x0 [0085.351] lstrlenW (lpString=".v2i") returned 4 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".v2i") returned 0x0 [0085.351] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.352] lstrlenW (lpString=".sql") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".sql") returned 0x0 [0085.352] lstrlenW (lpString=".mdf") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".mdf") returned 0x0 [0085.352] lstrlenW (lpString=".txt") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".txt") returned 0x0 [0085.352] lstrlenW (lpString=".dbf") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".dbf") returned 0x0 [0085.352] lstrlenW (lpString=".ckp") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".ckp") returned 0x0 [0085.352] lstrlenW (lpString=".dacpac") returned 7 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".dacpac") returned 0x0 [0085.352] lstrlenW (lpString=".db3") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".db3") returned 0x0 [0085.352] lstrlenW (lpString=".dtxs") returned 5 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".dtxs") returned 0x0 [0085.352] lstrlenW (lpString=".mdt") returned 4 [0085.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".mdt") returned 0x0 [0085.352] lstrlenW (lpString=".sdf") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".sdf") returned 0x0 [0085.353] lstrlenW (lpString=".MDF") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".MDF") returned 0x0 [0085.353] lstrlenW (lpString=".DBF") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".DBF") returned 0x0 [0085.353] lstrlenW (lpString=".DB") returned 3 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".DB") returned 0x0 [0085.353] lstrlenW (lpString=".db") returned 3 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".db") returned 0x0 [0085.353] lstrlenW (lpString=".ndf") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".ndf") returned 0x0 [0085.353] lstrlenW (lpString=".NDF") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".NDF") returned 0x0 [0085.353] lstrlenW (lpString=".Mdf") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".Mdf") returned 0x0 [0085.353] lstrlenW (lpString=".dat") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".dat") returned 0x0 [0085.353] lstrlenW (lpString=".DAT") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".DAT") returned 0x0 [0085.353] lstrlenW (lpString=".ldf") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".ldf") returned 0x0 [0085.353] lstrlenW (lpString=".LDF") returned 4 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch=".LDF") returned 0x0 [0085.353] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.354] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.354] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.354] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.355] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20535567073) returned 1 [0085.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1b02e30, dwHighDateTime=0x1d585b4)) [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763330 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763330 | out: hHeap=0x260000) returned 1 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33aa30 [0085.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33aa30 | out: hHeap=0x260000) returned 1 [0085.355] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.355] GetLastError () returned 0x0 [0085.356] GetLastError () returned 0x0 [0085.356] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.356] GetLastError () returned 0x0 [0085.356] GetLastError () returned 0x0 [0085.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff29b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.374] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd64a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xd64a, lpOverlapped=0x0) returned 1 [0085.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.375] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.375] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.375] CloseHandle (hObject=0xf0) returned 1 [0085.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.384] GetLastError () returned 0x0 [0085.384] RtlWakeConditionVariable () returned 0x0 [0085.384] GetCurrentThreadId () returned 0x98c [0085.385] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.385] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.385] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.385] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.387] CloseHandle (hObject=0xf0) returned 1 [0085.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d370 | out: hHeap=0x260000) returned 1 [0085.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0085.387] RtlWakeConditionVariable () returned 0x27e828 [0085.387] GetCurrentThreadId () returned 0x98c [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".ldf") returned 0x0 [0085.388] lstrlenW (lpString=".vhd") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".vhd") returned 0x0 [0085.388] lstrlenW (lpString=".vhdx") returned 5 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".vhdx") returned 0x0 [0085.388] lstrlenW (lpString=".pst") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".pst") returned 0x0 [0085.388] lstrlenW (lpString=".ost") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".ost") returned 0x0 [0085.388] lstrlenW (lpString=".bak") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".bak") returned 0x0 [0085.388] lstrlenW (lpString=".bac") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".bac") returned 0x0 [0085.388] lstrlenW (lpString=".sys") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".sys") returned 0x0 [0085.388] lstrlenW (lpString=".v2i") returned 4 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".v2i") returned 0x0 [0085.388] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.390] lstrlenW (lpString=".sql") returned 4 [0085.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".sql") returned 0x0 [0085.390] lstrlenW (lpString=".mdf") returned 4 [0085.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".mdf") returned 0x0 [0085.391] lstrlenW (lpString=".txt") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".txt") returned 0x0 [0085.391] lstrlenW (lpString=".dbf") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".dbf") returned 0x0 [0085.391] lstrlenW (lpString=".ckp") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".ckp") returned 0x0 [0085.391] lstrlenW (lpString=".dacpac") returned 7 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".dacpac") returned 0x0 [0085.391] lstrlenW (lpString=".db3") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".db3") returned 0x0 [0085.391] lstrlenW (lpString=".dtxs") returned 5 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".dtxs") returned 0x0 [0085.391] lstrlenW (lpString=".mdt") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".mdt") returned 0x0 [0085.391] lstrlenW (lpString=".sdf") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".sdf") returned 0x0 [0085.391] lstrlenW (lpString=".MDF") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".MDF") returned 0x0 [0085.391] lstrlenW (lpString=".DBF") returned 4 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".DBF") returned 0x0 [0085.391] lstrlenW (lpString=".DB") returned 3 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".DB") returned 0x0 [0085.391] lstrlenW (lpString=".db") returned 3 [0085.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".db") returned 0x0 [0085.392] lstrlenW (lpString=".ndf") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".ndf") returned 0x0 [0085.392] lstrlenW (lpString=".NDF") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".NDF") returned 0x0 [0085.392] lstrlenW (lpString=".Mdf") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".Mdf") returned 0x0 [0085.392] lstrlenW (lpString=".dat") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".dat") returned 0x0 [0085.392] lstrlenW (lpString=".DAT") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".DAT") returned 0x0 [0085.392] lstrlenW (lpString=".ldf") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".ldf") returned 0x0 [0085.392] lstrlenW (lpString=".LDF") returned 4 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch=".LDF") returned 0x0 [0085.392] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.392] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.393] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.393] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.393] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20539441214) returned 1 [0085.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1b4f0f0, dwHighDateTime=0x1d585b4)) [0085.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27634b8 [0085.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27634b8 | out: hHeap=0x260000) returned 1 [0085.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33aad8 [0085.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33aad8 | out: hHeap=0x260000) returned 1 [0085.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.394] GetLastError () returned 0x0 [0085.395] GetLastError () returned 0x0 [0085.395] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.395] GetLastError () returned 0x0 [0085.395] GetLastError () returned 0x0 [0085.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff3704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.397] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc8fc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc8fc, lpOverlapped=0x0) returned 1 [0085.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.398] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.398] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.398] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.398] CloseHandle (hObject=0xf0) returned 1 [0085.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.400] GetLastError () returned 0x0 [0085.400] RtlWakeConditionVariable () returned 0x0 [0085.400] GetCurrentThreadId () returned 0x98c [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".ldf") returned 0x0 [0085.400] lstrlenW (lpString=".vhd") returned 4 [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".vhd") returned 0x0 [0085.400] lstrlenW (lpString=".vhdx") returned 5 [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".vhdx") returned 0x0 [0085.400] lstrlenW (lpString=".pst") returned 4 [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".pst") returned 0x0 [0085.400] lstrlenW (lpString=".ost") returned 4 [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".ost") returned 0x0 [0085.400] lstrlenW (lpString=".bak") returned 4 [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".bak") returned 0x0 [0085.400] lstrlenW (lpString=".bac") returned 4 [0085.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".bac") returned 0x0 [0085.400] lstrlenW (lpString=".sys") returned 4 [0085.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".sys") returned 0x0 [0085.401] lstrlenW (lpString=".v2i") returned 4 [0085.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".v2i") returned 0x0 [0085.401] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.402] lstrlenW (lpString=".sql") returned 4 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".sql") returned 0x0 [0085.402] lstrlenW (lpString=".mdf") returned 4 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".mdf") returned 0x0 [0085.402] lstrlenW (lpString=".txt") returned 4 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".txt") returned 0x0 [0085.402] lstrlenW (lpString=".dbf") returned 4 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".dbf") returned 0x0 [0085.402] lstrlenW (lpString=".ckp") returned 4 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".ckp") returned 0x0 [0085.402] lstrlenW (lpString=".dacpac") returned 7 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".dacpac") returned 0x0 [0085.402] lstrlenW (lpString=".db3") returned 4 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".db3") returned 0x0 [0085.402] lstrlenW (lpString=".dtxs") returned 5 [0085.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".dtxs") returned 0x0 [0085.402] lstrlenW (lpString=".mdt") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".mdt") returned 0x0 [0085.403] lstrlenW (lpString=".sdf") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".sdf") returned 0x0 [0085.403] lstrlenW (lpString=".MDF") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".MDF") returned 0x0 [0085.403] lstrlenW (lpString=".DBF") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".DBF") returned 0x0 [0085.403] lstrlenW (lpString=".DB") returned 3 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".DB") returned 0x0 [0085.403] lstrlenW (lpString=".db") returned 3 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".db") returned 0x0 [0085.403] lstrlenW (lpString=".ndf") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".ndf") returned 0x0 [0085.403] lstrlenW (lpString=".NDF") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".NDF") returned 0x0 [0085.403] lstrlenW (lpString=".Mdf") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".Mdf") returned 0x0 [0085.403] lstrlenW (lpString=".dat") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".dat") returned 0x0 [0085.403] lstrlenW (lpString=".DAT") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".DAT") returned 0x0 [0085.403] lstrlenW (lpString=".ldf") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".ldf") returned 0x0 [0085.403] lstrlenW (lpString=".LDF") returned 4 [0085.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch=".LDF") returned 0x0 [0085.404] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.404] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.404] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.404] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.405] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20540581679) returned 1 [0085.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1b75250, dwHighDateTime=0x1d585b4)) [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763480 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763480 | out: hHeap=0x260000) returned 1 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33acd0 [0085.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33acd0 | out: hHeap=0x260000) returned 1 [0085.405] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.406] GetLastError () returned 0x0 [0085.406] GetLastError () returned 0x0 [0085.406] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.406] GetLastError () returned 0x0 [0085.406] GetLastError () returned 0x0 [0085.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff60e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.408] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9f18, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x9f18, lpOverlapped=0x0) returned 1 [0085.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.409] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.409] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.409] CloseHandle (hObject=0xf0) returned 1 [0085.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.411] GetLastError () returned 0x0 [0085.411] RtlWakeConditionVariable () returned 0x0 [0085.411] GetCurrentThreadId () returned 0x98c [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".ldf") returned 0x0 [0085.411] lstrlenW (lpString=".vhd") returned 4 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".vhd") returned 0x0 [0085.411] lstrlenW (lpString=".vhdx") returned 5 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".vhdx") returned 0x0 [0085.411] lstrlenW (lpString=".pst") returned 4 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".pst") returned 0x0 [0085.411] lstrlenW (lpString=".ost") returned 4 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".ost") returned 0x0 [0085.411] lstrlenW (lpString=".bak") returned 4 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".bak") returned 0x0 [0085.411] lstrlenW (lpString=".bac") returned 4 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".bac") returned 0x0 [0085.411] lstrlenW (lpString=".sys") returned 4 [0085.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".sys") returned 0x0 [0085.412] lstrlenW (lpString=".v2i") returned 4 [0085.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".v2i") returned 0x0 [0085.412] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.413] lstrlenW (lpString=".sql") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".sql") returned 0x0 [0085.413] lstrlenW (lpString=".mdf") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".mdf") returned 0x0 [0085.413] lstrlenW (lpString=".txt") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".txt") returned 0x0 [0085.413] lstrlenW (lpString=".dbf") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".dbf") returned 0x0 [0085.413] lstrlenW (lpString=".ckp") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".ckp") returned 0x0 [0085.413] lstrlenW (lpString=".dacpac") returned 7 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".dacpac") returned 0x0 [0085.413] lstrlenW (lpString=".db3") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".db3") returned 0x0 [0085.413] lstrlenW (lpString=".dtxs") returned 5 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".dtxs") returned 0x0 [0085.413] lstrlenW (lpString=".mdt") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".mdt") returned 0x0 [0085.413] lstrlenW (lpString=".sdf") returned 4 [0085.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".sdf") returned 0x0 [0085.413] lstrlenW (lpString=".MDF") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".MDF") returned 0x0 [0085.414] lstrlenW (lpString=".DBF") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".DBF") returned 0x0 [0085.414] lstrlenW (lpString=".DB") returned 3 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".DB") returned 0x0 [0085.414] lstrlenW (lpString=".db") returned 3 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".db") returned 0x0 [0085.414] lstrlenW (lpString=".ndf") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".ndf") returned 0x0 [0085.414] lstrlenW (lpString=".NDF") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".NDF") returned 0x0 [0085.414] lstrlenW (lpString=".Mdf") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".Mdf") returned 0x0 [0085.414] lstrlenW (lpString=".dat") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".dat") returned 0x0 [0085.414] lstrlenW (lpString=".DAT") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".DAT") returned 0x0 [0085.414] lstrlenW (lpString=".ldf") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".ldf") returned 0x0 [0085.414] lstrlenW (lpString=".LDF") returned 4 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch=".LDF") returned 0x0 [0085.414] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.415] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.415] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.415] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.416] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20541667087) returned 1 [0085.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1b9b3b0, dwHighDateTime=0x1d585b4)) [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763448 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763448 | out: hHeap=0x260000) returned 1 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ad78 [0085.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ad78 | out: hHeap=0x260000) returned 1 [0085.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.416] GetLastError () returned 0x0 [0085.417] GetLastError () returned 0x0 [0085.417] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.417] GetLastError () returned 0x0 [0085.417] GetLastError () returned 0x0 [0085.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff5bee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.445] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa412, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xa412, lpOverlapped=0x0) returned 1 [0085.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.445] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.445] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.445] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.445] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.445] CloseHandle (hObject=0xf0) returned 1 [0085.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.516] GetLastError () returned 0x0 [0085.517] RtlWakeConditionVariable () returned 0x0 [0085.517] GetCurrentThreadId () returned 0x98c [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.517] lstrlenW (lpString=".vhd") returned 4 [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.517] lstrlenW (lpString=".vhdx") returned 5 [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.517] lstrlenW (lpString=".pst") returned 4 [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.517] lstrlenW (lpString=".ost") returned 4 [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.517] lstrlenW (lpString=".bak") returned 4 [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.517] lstrlenW (lpString=".bac") returned 4 [0085.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.517] lstrlenW (lpString=".sys") returned 4 [0085.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.518] lstrlenW (lpString=".v2i") returned 4 [0085.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.518] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.519] lstrlenW (lpString=".sql") returned 4 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.519] lstrlenW (lpString=".mdf") returned 4 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.519] lstrlenW (lpString=".txt") returned 4 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.519] lstrlenW (lpString=".dbf") returned 4 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.519] lstrlenW (lpString=".ckp") returned 4 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.519] lstrlenW (lpString=".dacpac") returned 7 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.519] lstrlenW (lpString=".db3") returned 4 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.519] lstrlenW (lpString=".dtxs") returned 5 [0085.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.519] lstrlenW (lpString=".mdt") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.520] lstrlenW (lpString=".sdf") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.520] lstrlenW (lpString=".MDF") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.520] lstrlenW (lpString=".DBF") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.520] lstrlenW (lpString=".DB") returned 3 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.520] lstrlenW (lpString=".db") returned 3 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.520] lstrlenW (lpString=".ndf") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.520] lstrlenW (lpString=".NDF") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.520] lstrlenW (lpString=".Mdf") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.520] lstrlenW (lpString=".dat") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.520] lstrlenW (lpString=".DAT") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.520] lstrlenW (lpString=".ldf") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.520] lstrlenW (lpString=".LDF") returned 4 [0085.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.520] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.521] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.521] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.521] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.522] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20552282770) returned 1 [0085.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1ca5d50, dwHighDateTime=0x1d585b4)) [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763950 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763950 | out: hHeap=0x260000) returned 1 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.522] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.523] GetLastError () returned 0x0 [0085.523] GetLastError () returned 0x0 [0085.523] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.523] GetLastError () returned 0x0 [0085.523] GetLastError () returned 0x0 [0085.526] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff6c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.526] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x938, lpOverlapped=0x0) returned 1 [0085.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0085.526] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.526] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.526] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.526] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.526] CloseHandle (hObject=0xe4) returned 1 [0085.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.528] GetLastError () returned 0x0 [0085.528] RtlWakeConditionVariable () returned 0x0 [0085.528] GetCurrentThreadId () returned 0x98c [0085.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".ldf") returned 0x0 [0085.528] lstrlenW (lpString=".vhd") returned 4 [0085.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".vhd") returned 0x0 [0085.528] lstrlenW (lpString=".vhdx") returned 5 [0085.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".vhdx") returned 0x0 [0085.528] lstrlenW (lpString=".pst") returned 4 [0085.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".pst") returned 0x0 [0085.528] lstrlenW (lpString=".ost") returned 4 [0085.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".ost") returned 0x0 [0085.528] lstrlenW (lpString=".bak") returned 4 [0085.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".bak") returned 0x0 [0085.529] lstrlenW (lpString=".bac") returned 4 [0085.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".bac") returned 0x0 [0085.529] lstrlenW (lpString=".sys") returned 4 [0085.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".sys") returned 0x0 [0085.529] lstrlenW (lpString=".v2i") returned 4 [0085.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".v2i") returned 0x0 [0085.529] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.530] lstrlenW (lpString=".sql") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".sql") returned 0x0 [0085.530] lstrlenW (lpString=".mdf") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".mdf") returned 0x0 [0085.530] lstrlenW (lpString=".txt") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".txt") returned 0x0 [0085.530] lstrlenW (lpString=".dbf") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".dbf") returned 0x0 [0085.530] lstrlenW (lpString=".ckp") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".ckp") returned 0x0 [0085.530] lstrlenW (lpString=".dacpac") returned 7 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".dacpac") returned 0x0 [0085.530] lstrlenW (lpString=".db3") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".db3") returned 0x0 [0085.530] lstrlenW (lpString=".dtxs") returned 5 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".dtxs") returned 0x0 [0085.530] lstrlenW (lpString=".mdt") returned 4 [0085.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".mdt") returned 0x0 [0085.531] lstrlenW (lpString=".sdf") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".sdf") returned 0x0 [0085.531] lstrlenW (lpString=".MDF") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".MDF") returned 0x0 [0085.531] lstrlenW (lpString=".DBF") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".DBF") returned 0x0 [0085.531] lstrlenW (lpString=".DB") returned 3 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".DB") returned 0x0 [0085.531] lstrlenW (lpString=".db") returned 3 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".db") returned 0x0 [0085.531] lstrlenW (lpString=".ndf") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".ndf") returned 0x0 [0085.531] lstrlenW (lpString=".NDF") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".NDF") returned 0x0 [0085.531] lstrlenW (lpString=".Mdf") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".Mdf") returned 0x0 [0085.531] lstrlenW (lpString=".dat") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".dat") returned 0x0 [0085.531] lstrlenW (lpString=".DAT") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".DAT") returned 0x0 [0085.531] lstrlenW (lpString=".ldf") returned 4 [0085.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".ldf") returned 0x0 [0085.532] lstrlenW (lpString=".LDF") returned 4 [0085.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch=".LDF") returned 0x0 [0085.532] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.532] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.532] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.533] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.533] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20553386360) returned 1 [0085.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1ca5d50, dwHighDateTime=0x1d585b4)) [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763918 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763918 | out: hHeap=0x260000) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.533] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.534] GetLastError () returned 0x0 [0085.534] GetLastError () returned 0x0 [0085.534] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.534] GetLastError () returned 0x0 [0085.534] GetLastError () returned 0x0 [0085.536] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd695, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.536] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x296b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x296b, lpOverlapped=0x0) returned 1 [0085.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0085.536] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.536] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.536] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.536] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.536] CloseHandle (hObject=0xe4) returned 1 [0085.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.537] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.538] GetLastError () returned 0x0 [0085.538] RtlWakeConditionVariable () returned 0x0 [0085.538] GetCurrentThreadId () returned 0x98c [0085.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".ldf") returned 0x0 [0085.538] lstrlenW (lpString=".vhd") returned 4 [0085.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".vhd") returned 0x0 [0085.538] lstrlenW (lpString=".vhdx") returned 5 [0085.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.538] lstrlenW (lpString=".pst") returned 4 [0085.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".pst") returned 0x0 [0085.538] lstrlenW (lpString=".ost") returned 4 [0085.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".ost") returned 0x0 [0085.539] lstrlenW (lpString=".bak") returned 4 [0085.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".bak") returned 0x0 [0085.539] lstrlenW (lpString=".bac") returned 4 [0085.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".bac") returned 0x0 [0085.539] lstrlenW (lpString=".sys") returned 4 [0085.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".sys") returned 0x0 [0085.539] lstrlenW (lpString=".v2i") returned 4 [0085.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".v2i") returned 0x0 [0085.539] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.540] lstrlenW (lpString=".sql") returned 4 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".sql") returned 0x0 [0085.540] lstrlenW (lpString=".mdf") returned 4 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".mdf") returned 0x0 [0085.540] lstrlenW (lpString=".txt") returned 4 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".txt") returned 0x0 [0085.540] lstrlenW (lpString=".dbf") returned 4 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".dbf") returned 0x0 [0085.540] lstrlenW (lpString=".ckp") returned 4 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".ckp") returned 0x0 [0085.540] lstrlenW (lpString=".dacpac") returned 7 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.540] lstrlenW (lpString=".db3") returned 4 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".db3") returned 0x0 [0085.540] lstrlenW (lpString=".dtxs") returned 5 [0085.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.541] lstrlenW (lpString=".mdt") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".mdt") returned 0x0 [0085.541] lstrlenW (lpString=".sdf") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".sdf") returned 0x0 [0085.541] lstrlenW (lpString=".MDF") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".MDF") returned 0x0 [0085.541] lstrlenW (lpString=".DBF") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".DBF") returned 0x0 [0085.541] lstrlenW (lpString=".DB") returned 3 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".DB") returned 0x0 [0085.541] lstrlenW (lpString=".db") returned 3 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".db") returned 0x0 [0085.541] lstrlenW (lpString=".ndf") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".ndf") returned 0x0 [0085.541] lstrlenW (lpString=".NDF") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".NDF") returned 0x0 [0085.541] lstrlenW (lpString=".Mdf") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.541] lstrlenW (lpString=".dat") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".dat") returned 0x0 [0085.541] lstrlenW (lpString=".DAT") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".DAT") returned 0x0 [0085.541] lstrlenW (lpString=".ldf") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".ldf") returned 0x0 [0085.541] lstrlenW (lpString=".LDF") returned 4 [0085.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch=".LDF") returned 0x0 [0085.542] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.542] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.542] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.542] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.543] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20554381076) returned 1 [0085.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1ccbeb0, dwHighDateTime=0x1d585b4)) [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27638e0 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27638e0 | out: hHeap=0x260000) returned 1 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.543] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.544] GetLastError () returned 0x0 [0085.544] GetLastError () returned 0x0 [0085.544] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.544] GetLastError () returned 0x0 [0085.544] GetLastError () returned 0x0 [0085.546] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff088, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.546] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xf78, lpOverlapped=0x0) returned 1 [0085.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0085.546] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.546] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.546] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.547] CloseHandle (hObject=0xe4) returned 1 [0085.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.548] GetLastError () returned 0x0 [0085.548] RtlWakeConditionVariable () returned 0x0 [0085.548] GetCurrentThreadId () returned 0x98c [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.549] lstrlenW (lpString=".vhd") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.549] lstrlenW (lpString=".vhdx") returned 5 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.549] lstrlenW (lpString=".pst") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.549] lstrlenW (lpString=".ost") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.549] lstrlenW (lpString=".bak") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.549] lstrlenW (lpString=".bac") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.549] lstrlenW (lpString=".sys") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.549] lstrlenW (lpString=".v2i") returned 4 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.549] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.550] lstrlenW (lpString=".sql") returned 4 [0085.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.691] lstrlenW (lpString=".mdf") returned 4 [0085.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.691] lstrlenW (lpString=".txt") returned 4 [0085.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.691] lstrlenW (lpString=".dbf") returned 4 [0085.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.691] lstrlenW (lpString=".ckp") returned 4 [0085.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.691] lstrlenW (lpString=".dacpac") returned 7 [0085.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.691] lstrlenW (lpString=".db3") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.692] lstrlenW (lpString=".dtxs") returned 5 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.692] lstrlenW (lpString=".mdt") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.692] lstrlenW (lpString=".sdf") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.692] lstrlenW (lpString=".MDF") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.692] lstrlenW (lpString=".DBF") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.692] lstrlenW (lpString=".DB") returned 3 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.692] lstrlenW (lpString=".db") returned 3 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".db") returned 0x0 [0085.692] lstrlenW (lpString=".ndf") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.692] lstrlenW (lpString=".NDF") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.692] lstrlenW (lpString=".Mdf") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.692] lstrlenW (lpString=".dat") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.692] lstrlenW (lpString=".DAT") returned 4 [0085.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.692] lstrlenW (lpString=".ldf") returned 4 [0085.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.693] lstrlenW (lpString=".LDF") returned 4 [0085.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.693] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.693] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.694] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.694] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.694] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20569496183) returned 1 [0085.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1e48c70, dwHighDateTime=0x1d585b4)) [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763608 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763608 | out: hHeap=0x260000) returned 1 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.695] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.695] GetLastError () returned 0x0 [0085.695] GetLastError () returned 0x0 [0085.695] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.695] GetLastError () returned 0x0 [0085.695] GetLastError () returned 0x0 [0085.698] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe939, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.698] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x16c7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x16c7, lpOverlapped=0x0) returned 1 [0085.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.699] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.699] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.699] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.699] CloseHandle (hObject=0xe4) returned 1 [0085.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d4a8 [0085.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0085.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.701] GetLastError () returned 0x0 [0085.701] RtlWakeConditionVariable () returned 0x0 [0085.701] GetCurrentThreadId () returned 0x98c [0085.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".ldf") returned 0x0 [0085.701] lstrlenW (lpString=".vhd") returned 4 [0085.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".vhd") returned 0x0 [0085.701] lstrlenW (lpString=".vhdx") returned 5 [0085.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".vhdx") returned 0x0 [0085.702] lstrlenW (lpString=".pst") returned 4 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".pst") returned 0x0 [0085.702] lstrlenW (lpString=".ost") returned 4 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".ost") returned 0x0 [0085.702] lstrlenW (lpString=".bak") returned 4 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".bak") returned 0x0 [0085.702] lstrlenW (lpString=".bac") returned 4 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".bac") returned 0x0 [0085.702] lstrlenW (lpString=".sys") returned 4 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".sys") returned 0x0 [0085.702] lstrlenW (lpString=".v2i") returned 4 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".v2i") returned 0x0 [0085.702] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.704] lstrlenW (lpString=".sql") returned 4 [0085.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".sql") returned 0x0 [0085.704] lstrlenW (lpString=".mdf") returned 4 [0085.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".mdf") returned 0x0 [0085.704] lstrlenW (lpString=".txt") returned 4 [0085.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".txt") returned 0x0 [0085.705] lstrlenW (lpString=".dbf") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".dbf") returned 0x0 [0085.705] lstrlenW (lpString=".ckp") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".ckp") returned 0x0 [0085.705] lstrlenW (lpString=".dacpac") returned 7 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".dacpac") returned 0x0 [0085.705] lstrlenW (lpString=".db3") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".db3") returned 0x0 [0085.705] lstrlenW (lpString=".dtxs") returned 5 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".dtxs") returned 0x0 [0085.705] lstrlenW (lpString=".mdt") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".mdt") returned 0x0 [0085.705] lstrlenW (lpString=".sdf") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".sdf") returned 0x0 [0085.705] lstrlenW (lpString=".MDF") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".MDF") returned 0x0 [0085.705] lstrlenW (lpString=".DBF") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".DBF") returned 0x0 [0085.705] lstrlenW (lpString=".DB") returned 3 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".DB") returned 0x0 [0085.705] lstrlenW (lpString=".db") returned 3 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".db") returned 0x0 [0085.705] lstrlenW (lpString=".ndf") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".ndf") returned 0x0 [0085.705] lstrlenW (lpString=".NDF") returned 4 [0085.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".NDF") returned 0x0 [0085.706] lstrlenW (lpString=".Mdf") returned 4 [0085.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".Mdf") returned 0x0 [0085.706] lstrlenW (lpString=".dat") returned 4 [0085.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".dat") returned 0x0 [0085.706] lstrlenW (lpString=".DAT") returned 4 [0085.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".DAT") returned 0x0 [0085.706] lstrlenW (lpString=".ldf") returned 4 [0085.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".ldf") returned 0x0 [0085.706] lstrlenW (lpString=".LDF") returned 4 [0085.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch=".LDF") returned 0x0 [0085.706] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.706] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.715] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.715] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.715] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20571643148) returned 1 [0085.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1e6edd0, dwHighDateTime=0x1d585b4)) [0085.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27635d0 [0085.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27635d0 | out: hHeap=0x260000) returned 1 [0085.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.716] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.716] GetLastError () returned 0x0 [0085.717] GetLastError () returned 0x0 [0085.717] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.717] GetLastError () returned 0x0 [0085.717] GetLastError () returned 0x0 [0085.721] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe16d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.721] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1e93, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x1e93, lpOverlapped=0x0) returned 1 [0085.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.721] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.721] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.721] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.721] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.722] CloseHandle (hObject=0xe4) returned 1 [0085.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.724] GetLastError () returned 0x0 [0085.724] RtlWakeConditionVariable () returned 0x0 [0085.724] GetCurrentThreadId () returned 0x98c [0085.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.724] lstrlenW (lpString=".vhd") returned 4 [0085.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.725] lstrlenW (lpString=".vhdx") returned 5 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.725] lstrlenW (lpString=".pst") returned 4 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.725] lstrlenW (lpString=".ost") returned 4 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.725] lstrlenW (lpString=".bak") returned 4 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.725] lstrlenW (lpString=".bac") returned 4 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.725] lstrlenW (lpString=".sys") returned 4 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.725] lstrlenW (lpString=".v2i") returned 4 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.725] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.727] lstrlenW (lpString=".sql") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.727] lstrlenW (lpString=".mdf") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.727] lstrlenW (lpString=".txt") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.727] lstrlenW (lpString=".dbf") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.727] lstrlenW (lpString=".ckp") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.727] lstrlenW (lpString=".dacpac") returned 7 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.727] lstrlenW (lpString=".db3") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.727] lstrlenW (lpString=".dtxs") returned 5 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.727] lstrlenW (lpString=".mdt") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.727] lstrlenW (lpString=".sdf") returned 4 [0085.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.728] lstrlenW (lpString=".MDF") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.728] lstrlenW (lpString=".DBF") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.728] lstrlenW (lpString=".DB") returned 3 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.728] lstrlenW (lpString=".db") returned 3 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.728] lstrlenW (lpString=".ndf") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.728] lstrlenW (lpString=".NDF") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.728] lstrlenW (lpString=".Mdf") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.728] lstrlenW (lpString=".dat") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.728] lstrlenW (lpString=".DAT") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.728] lstrlenW (lpString=".ldf") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.728] lstrlenW (lpString=".LDF") returned 4 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.728] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.729] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.729] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.729] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.730] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20573073986) returned 1 [0085.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1e94f30, dwHighDateTime=0x1d585b4)) [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763598 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763598 | out: hHeap=0x260000) returned 1 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.730] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.731] GetLastError () returned 0x0 [0085.731] GetLastError () returned 0x0 [0085.731] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.731] GetLastError () returned 0x0 [0085.731] GetLastError () returned 0x0 [0085.733] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff508, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.733] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xaf8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0xaf8, lpOverlapped=0x0) returned 1 [0085.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.733] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.733] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.733] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.733] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.734] CloseHandle (hObject=0xe4) returned 1 [0085.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.736] GetLastError () returned 0x0 [0085.736] RtlWakeConditionVariable () returned 0x0 [0085.736] GetCurrentThreadId () returned 0x98c [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.736] lstrlenW (lpString=".vhd") returned 4 [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.736] lstrlenW (lpString=".vhdx") returned 5 [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.736] lstrlenW (lpString=".pst") returned 4 [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.736] lstrlenW (lpString=".ost") returned 4 [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.736] lstrlenW (lpString=".bak") returned 4 [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.736] lstrlenW (lpString=".bac") returned 4 [0085.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.737] lstrlenW (lpString=".sys") returned 4 [0085.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.737] lstrlenW (lpString=".v2i") returned 4 [0085.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.737] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.745] lstrlenW (lpString=".sql") returned 4 [0085.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.745] lstrlenW (lpString=".mdf") returned 4 [0085.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.745] lstrlenW (lpString=".txt") returned 4 [0085.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.745] lstrlenW (lpString=".dbf") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.746] lstrlenW (lpString=".ckp") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.746] lstrlenW (lpString=".dacpac") returned 7 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.746] lstrlenW (lpString=".db3") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.746] lstrlenW (lpString=".dtxs") returned 5 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.746] lstrlenW (lpString=".mdt") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.746] lstrlenW (lpString=".sdf") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.746] lstrlenW (lpString=".MDF") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.746] lstrlenW (lpString=".DBF") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.746] lstrlenW (lpString=".DB") returned 3 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.746] lstrlenW (lpString=".db") returned 3 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".db") returned 0x0 [0085.746] lstrlenW (lpString=".ndf") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.746] lstrlenW (lpString=".NDF") returned 4 [0085.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.747] lstrlenW (lpString=".Mdf") returned 4 [0085.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.747] lstrlenW (lpString=".dat") returned 4 [0085.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.747] lstrlenW (lpString=".DAT") returned 4 [0085.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.747] lstrlenW (lpString=".ldf") returned 4 [0085.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.747] lstrlenW (lpString=".LDF") returned 4 [0085.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.747] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.747] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.748] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.748] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.748] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20574921611) returned 1 [0085.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1ebb090, dwHighDateTime=0x1d585b4)) [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763528 [0085.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763528 | out: hHeap=0x260000) returned 1 [0085.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.749] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.749] GetLastError () returned 0x0 [0085.749] GetLastError () returned 0x0 [0085.749] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.749] GetLastError () returned 0x0 [0085.750] GetLastError () returned 0x0 [0085.753] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffda1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.753] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x25e5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x25e5, lpOverlapped=0x0) returned 1 [0085.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.753] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.753] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.754] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.754] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.754] CloseHandle (hObject=0xe4) returned 1 [0085.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0085.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0085.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.770] GetLastError () returned 0x0 [0085.770] RtlWakeConditionVariable () returned 0x0 [0085.770] GetCurrentThreadId () returned 0x98c [0085.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.770] lstrlenW (lpString=".vhd") returned 4 [0085.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.770] lstrlenW (lpString=".vhdx") returned 5 [0085.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.771] lstrlenW (lpString=".pst") returned 4 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.771] lstrlenW (lpString=".ost") returned 4 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.771] lstrlenW (lpString=".bak") returned 4 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.771] lstrlenW (lpString=".bac") returned 4 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.771] lstrlenW (lpString=".sys") returned 4 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.771] lstrlenW (lpString=".v2i") returned 4 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.771] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.800] lstrlenW (lpString=".sql") returned 4 [0085.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.800] lstrlenW (lpString=".mdf") returned 4 [0085.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.800] lstrlenW (lpString=".txt") returned 4 [0085.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.800] lstrlenW (lpString=".dbf") returned 4 [0085.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.801] lstrlenW (lpString=".ckp") returned 4 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.801] lstrlenW (lpString=".dacpac") returned 7 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.801] lstrlenW (lpString=".db3") returned 4 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.801] lstrlenW (lpString=".dtxs") returned 5 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.801] lstrlenW (lpString=".mdt") returned 4 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.801] lstrlenW (lpString=".sdf") returned 4 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.801] lstrlenW (lpString=".MDF") returned 4 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.801] lstrlenW (lpString=".DBF") returned 4 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.801] lstrlenW (lpString=".DB") returned 3 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.801] lstrlenW (lpString=".db") returned 3 [0085.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".db") returned 0x0 [0085.802] lstrlenW (lpString=".ndf") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.802] lstrlenW (lpString=".NDF") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.802] lstrlenW (lpString=".Mdf") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.802] lstrlenW (lpString=".dat") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.802] lstrlenW (lpString=".DAT") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.802] lstrlenW (lpString=".ldf") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.802] lstrlenW (lpString=".LDF") returned 4 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.802] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.802] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.803] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.804] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20580480895) returned 1 [0085.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1f53610, dwHighDateTime=0x1d585b4)) [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27630c8 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27630c8 | out: hHeap=0x260000) returned 1 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.805] GetLastError () returned 0x0 [0085.805] GetLastError () returned 0x0 [0085.805] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.805] GetLastError () returned 0x0 [0085.805] GetLastError () returned 0x0 [0085.809] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdd0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.809] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x22f6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x22f6, lpOverlapped=0x0) returned 1 [0085.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.809] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.809] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.810] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.810] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.810] CloseHandle (hObject=0xe4) returned 1 [0085.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.813] GetLastError () returned 0x0 [0085.813] RtlWakeConditionVariable () returned 0x0 [0085.813] GetCurrentThreadId () returned 0x98c [0085.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".ldf") returned 0x0 [0085.813] lstrlenW (lpString=".vhd") returned 4 [0085.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".vhd") returned 0x0 [0085.813] lstrlenW (lpString=".vhdx") returned 5 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".vhdx") returned 0x0 [0085.814] lstrlenW (lpString=".pst") returned 4 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".pst") returned 0x0 [0085.814] lstrlenW (lpString=".ost") returned 4 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".ost") returned 0x0 [0085.814] lstrlenW (lpString=".bak") returned 4 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".bak") returned 0x0 [0085.814] lstrlenW (lpString=".bac") returned 4 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".bac") returned 0x0 [0085.814] lstrlenW (lpString=".sys") returned 4 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".sys") returned 0x0 [0085.814] lstrlenW (lpString=".v2i") returned 4 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".v2i") returned 0x0 [0085.814] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.822] lstrlenW (lpString=".sql") returned 4 [0085.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".sql") returned 0x0 [0085.822] lstrlenW (lpString=".mdf") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".mdf") returned 0x0 [0085.823] lstrlenW (lpString=".txt") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".txt") returned 0x0 [0085.823] lstrlenW (lpString=".dbf") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".dbf") returned 0x0 [0085.823] lstrlenW (lpString=".ckp") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".ckp") returned 0x0 [0085.823] lstrlenW (lpString=".dacpac") returned 7 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".dacpac") returned 0x0 [0085.823] lstrlenW (lpString=".db3") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".db3") returned 0x0 [0085.823] lstrlenW (lpString=".dtxs") returned 5 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".dtxs") returned 0x0 [0085.823] lstrlenW (lpString=".mdt") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".mdt") returned 0x0 [0085.823] lstrlenW (lpString=".sdf") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".sdf") returned 0x0 [0085.823] lstrlenW (lpString=".MDF") returned 4 [0085.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".MDF") returned 0x0 [0085.823] lstrlenW (lpString=".DBF") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".DBF") returned 0x0 [0085.824] lstrlenW (lpString=".DB") returned 3 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".DB") returned 0x0 [0085.824] lstrlenW (lpString=".db") returned 3 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".db") returned 0x0 [0085.824] lstrlenW (lpString=".ndf") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".ndf") returned 0x0 [0085.824] lstrlenW (lpString=".NDF") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".NDF") returned 0x0 [0085.824] lstrlenW (lpString=".Mdf") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".Mdf") returned 0x0 [0085.824] lstrlenW (lpString=".dat") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".dat") returned 0x0 [0085.824] lstrlenW (lpString=".DAT") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".DAT") returned 0x0 [0085.824] lstrlenW (lpString=".ldf") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".ldf") returned 0x0 [0085.824] lstrlenW (lpString=".LDF") returned 4 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch=".LDF") returned 0x0 [0085.824] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.825] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.826] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.826] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.826] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20582711215) returned 1 [0085.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1f79770, dwHighDateTime=0x1d585b4)) [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763ec8 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763ec8 | out: hHeap=0x260000) returned 1 [0085.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.827] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.827] GetLastError () returned 0x0 [0085.827] GetLastError () returned 0x0 [0085.827] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.828] GetLastError () returned 0x0 [0085.828] GetLastError () returned 0x0 [0085.830] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffbf56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.830] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x40aa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x40aa, lpOverlapped=0x0) returned 1 [0085.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.830] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.830] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.831] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.831] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.831] CloseHandle (hObject=0xe4) returned 1 [0085.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.863] GetLastError () returned 0x0 [0085.863] RtlWakeConditionVariable () returned 0x27e828 [0085.863] GetCurrentThreadId () returned 0x98c [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.864] lstrlenW (lpString=".vhd") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".vhd") returned 0x0 [0085.864] lstrlenW (lpString=".vhdx") returned 5 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".vhdx") returned 0x0 [0085.864] lstrlenW (lpString=".pst") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".pst") returned 0x0 [0085.864] lstrlenW (lpString=".ost") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".ost") returned 0x0 [0085.864] lstrlenW (lpString=".bak") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".bak") returned 0x0 [0085.864] lstrlenW (lpString=".bac") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".bac") returned 0x0 [0085.864] lstrlenW (lpString=".sys") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".sys") returned 0x0 [0085.864] lstrlenW (lpString=".v2i") returned 4 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".v2i") returned 0x0 [0085.864] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.866] lstrlenW (lpString=".sql") returned 4 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".sql") returned 0x0 [0085.866] lstrlenW (lpString=".mdf") returned 4 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".mdf") returned 0x0 [0085.866] lstrlenW (lpString=".txt") returned 4 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".txt") returned 0x0 [0085.866] lstrlenW (lpString=".dbf") returned 4 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".dbf") returned 0x0 [0085.866] lstrlenW (lpString=".ckp") returned 4 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".ckp") returned 0x0 [0085.866] lstrlenW (lpString=".dacpac") returned 7 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".dacpac") returned 0x0 [0085.866] lstrlenW (lpString=".db3") returned 4 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".db3") returned 0x0 [0085.866] lstrlenW (lpString=".dtxs") returned 5 [0085.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".dtxs") returned 0x0 [0085.866] lstrlenW (lpString=".mdt") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".mdt") returned 0x0 [0085.867] lstrlenW (lpString=".sdf") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".sdf") returned 0x0 [0085.867] lstrlenW (lpString=".MDF") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".MDF") returned 0x0 [0085.867] lstrlenW (lpString=".DBF") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".DBF") returned 0x0 [0085.867] lstrlenW (lpString=".DB") returned 3 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".DB") returned 0x0 [0085.867] lstrlenW (lpString=".db") returned 3 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".db") returned 0x0 [0085.867] lstrlenW (lpString=".ndf") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".ndf") returned 0x0 [0085.867] lstrlenW (lpString=".NDF") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".NDF") returned 0x0 [0085.867] lstrlenW (lpString=".Mdf") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".Mdf") returned 0x0 [0085.867] lstrlenW (lpString=".dat") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".dat") returned 0x0 [0085.867] lstrlenW (lpString=".DAT") returned 4 [0085.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".DAT") returned 0x0 [0085.868] lstrlenW (lpString=".ldf") returned 4 [0085.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.868] lstrlenW (lpString=".LDF") returned 4 [0085.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch=".LDF") returned 0x0 [0085.868] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.868] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.869] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.869] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.869] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20587036508) returned 1 [0085.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc1febb90, dwHighDateTime=0x1d585b4)) [0085.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763e58 [0085.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763e58 | out: hHeap=0x260000) returned 1 [0085.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.870] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.870] GetLastError () returned 0x0 [0085.871] GetLastError () returned 0x0 [0085.871] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.871] GetLastError () returned 0x0 [0085.871] GetLastError () returned 0x0 [0085.873] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.873] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x368, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x368, lpOverlapped=0x0) returned 1 [0085.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.874] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.874] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.874] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.874] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.874] CloseHandle (hObject=0xe4) returned 1 [0085.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d590 [0085.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d590 | out: hHeap=0x260000) returned 1 [0085.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.877] GetLastError () returned 0x0 [0085.877] RtlWakeConditionVariable () returned 0x0 [0085.877] GetCurrentThreadId () returned 0x98c [0085.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.877] lstrlenW (lpString=".vhd") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".vhd") returned 0x0 [0085.878] lstrlenW (lpString=".vhdx") returned 5 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".vhdx") returned 0x0 [0085.878] lstrlenW (lpString=".pst") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".pst") returned 0x0 [0085.878] lstrlenW (lpString=".ost") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".ost") returned 0x0 [0085.878] lstrlenW (lpString=".bak") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".bak") returned 0x0 [0085.878] lstrlenW (lpString=".bac") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".bac") returned 0x0 [0085.878] lstrlenW (lpString=".sys") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".sys") returned 0x0 [0085.878] lstrlenW (lpString=".v2i") returned 4 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".v2i") returned 0x0 [0085.878] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.881] lstrlenW (lpString=".sql") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".sql") returned 0x0 [0085.881] lstrlenW (lpString=".mdf") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".mdf") returned 0x0 [0085.881] lstrlenW (lpString=".txt") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".txt") returned 0x0 [0085.881] lstrlenW (lpString=".dbf") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".dbf") returned 0x0 [0085.881] lstrlenW (lpString=".ckp") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".ckp") returned 0x0 [0085.881] lstrlenW (lpString=".dacpac") returned 7 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".dacpac") returned 0x0 [0085.881] lstrlenW (lpString=".db3") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".db3") returned 0x0 [0085.881] lstrlenW (lpString=".dtxs") returned 5 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".dtxs") returned 0x0 [0085.881] lstrlenW (lpString=".mdt") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".mdt") returned 0x0 [0085.881] lstrlenW (lpString=".sdf") returned 4 [0085.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".sdf") returned 0x0 [0085.882] lstrlenW (lpString=".MDF") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".MDF") returned 0x0 [0085.882] lstrlenW (lpString=".DBF") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".DBF") returned 0x0 [0085.882] lstrlenW (lpString=".DB") returned 3 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".DB") returned 0x0 [0085.882] lstrlenW (lpString=".db") returned 3 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".db") returned 0x0 [0085.882] lstrlenW (lpString=".ndf") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".ndf") returned 0x0 [0085.882] lstrlenW (lpString=".NDF") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".NDF") returned 0x0 [0085.882] lstrlenW (lpString=".Mdf") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".Mdf") returned 0x0 [0085.882] lstrlenW (lpString=".dat") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".dat") returned 0x0 [0085.882] lstrlenW (lpString=".DAT") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".DAT") returned 0x0 [0085.882] lstrlenW (lpString=".ldf") returned 4 [0085.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.883] lstrlenW (lpString=".LDF") returned 4 [0085.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch=".LDF") returned 0x0 [0085.883] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.883] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.884] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.884] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.884] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20588531442) returned 1 [0085.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2011cf0, dwHighDateTime=0x1d585b4)) [0085.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763de8 [0085.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763de8 | out: hHeap=0x260000) returned 1 [0085.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.885] GetLastError () returned 0x0 [0085.886] GetLastError () returned 0x0 [0085.886] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.886] GetLastError () returned 0x0 [0085.886] GetLastError () returned 0x0 [0085.903] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.903] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0085.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.903] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.903] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.903] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.903] CloseHandle (hObject=0xe4) returned 1 [0085.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d590 [0085.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d590 | out: hHeap=0x260000) returned 1 [0085.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.979] GetLastError () returned 0x0 [0085.979] RtlWakeConditionVariable () returned 0x0 [0085.979] GetCurrentThreadId () returned 0x98c [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.980] lstrlenW (lpString=".vhd") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.980] lstrlenW (lpString=".vhdx") returned 5 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.980] lstrlenW (lpString=".pst") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.980] lstrlenW (lpString=".ost") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.980] lstrlenW (lpString=".bak") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.980] lstrlenW (lpString=".bac") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.980] lstrlenW (lpString=".sys") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.980] lstrlenW (lpString=".v2i") returned 4 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.980] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.981] lstrlenW (lpString=".sql") returned 4 [0085.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.981] lstrlenW (lpString=".mdf") returned 4 [0085.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.981] lstrlenW (lpString=".txt") returned 4 [0085.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.981] lstrlenW (lpString=".dbf") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.982] lstrlenW (lpString=".ckp") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.982] lstrlenW (lpString=".dacpac") returned 7 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.982] lstrlenW (lpString=".db3") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.982] lstrlenW (lpString=".dtxs") returned 5 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.982] lstrlenW (lpString=".mdt") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.982] lstrlenW (lpString=".sdf") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.982] lstrlenW (lpString=".MDF") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.982] lstrlenW (lpString=".DBF") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.982] lstrlenW (lpString=".DB") returned 3 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.982] lstrlenW (lpString=".db") returned 3 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.982] lstrlenW (lpString=".ndf") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.982] lstrlenW (lpString=".NDF") returned 4 [0085.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.983] lstrlenW (lpString=".Mdf") returned 4 [0085.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.983] lstrlenW (lpString=".dat") returned 4 [0085.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.983] lstrlenW (lpString=".DAT") returned 4 [0085.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.983] lstrlenW (lpString=".ldf") returned 4 [0085.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.983] lstrlenW (lpString=".LDF") returned 4 [0085.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.983] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.983] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.984] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.984] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.984] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20598518770) returned 1 [0085.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc20f6530, dwHighDateTime=0x1d585b4)) [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c98 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c98 | out: hHeap=0x260000) returned 1 [0085.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.985] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.985] GetLastError () returned 0x0 [0085.985] GetLastError () returned 0x0 [0085.985] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.985] GetLastError () returned 0x0 [0085.985] GetLastError () returned 0x0 [0085.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.987] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xc0, lpOverlapped=0x0) returned 1 [0085.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.987] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.987] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.987] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.987] CloseHandle (hObject=0xf0) returned 1 [0085.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.989] GetLastError () returned 0x0 [0085.989] RtlWakeConditionVariable () returned 0x0 [0085.989] GetCurrentThreadId () returned 0x98c [0085.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.989] lstrlenW (lpString=".vhd") returned 4 [0085.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.989] lstrlenW (lpString=".vhdx") returned 5 [0085.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.989] lstrlenW (lpString=".pst") returned 4 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.990] lstrlenW (lpString=".ost") returned 4 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.990] lstrlenW (lpString=".bak") returned 4 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.990] lstrlenW (lpString=".bac") returned 4 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.990] lstrlenW (lpString=".sys") returned 4 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.990] lstrlenW (lpString=".v2i") returned 4 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.990] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.991] lstrlenW (lpString=".sql") returned 4 [0085.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.991] lstrlenW (lpString=".mdf") returned 4 [0085.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.991] lstrlenW (lpString=".txt") returned 4 [0085.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.991] lstrlenW (lpString=".dbf") returned 4 [0085.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.991] lstrlenW (lpString=".ckp") returned 4 [0085.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.991] lstrlenW (lpString=".dacpac") returned 7 [0085.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.991] lstrlenW (lpString=".db3") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.992] lstrlenW (lpString=".dtxs") returned 5 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.992] lstrlenW (lpString=".mdt") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.992] lstrlenW (lpString=".sdf") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.992] lstrlenW (lpString=".MDF") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.992] lstrlenW (lpString=".DBF") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.992] lstrlenW (lpString=".DB") returned 3 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.992] lstrlenW (lpString=".db") returned 3 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".db") returned 0x0 [0085.992] lstrlenW (lpString=".ndf") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.992] lstrlenW (lpString=".NDF") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.992] lstrlenW (lpString=".Mdf") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.992] lstrlenW (lpString=".dat") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.992] lstrlenW (lpString=".DAT") returned 4 [0085.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.992] lstrlenW (lpString=".ldf") returned 4 [0085.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.993] lstrlenW (lpString=".LDF") returned 4 [0085.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.993] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.993] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0085.994] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.994] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.994] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20599493873) returned 1 [0085.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc211c690, dwHighDateTime=0x1d585b4)) [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c60 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c60 | out: hHeap=0x260000) returned 1 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.994] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0085.995] GetLastError () returned 0x0 [0085.995] GetLastError () returned 0x0 [0085.995] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0085.995] GetLastError () returned 0x0 [0085.995] GetLastError () returned 0x0 [0085.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffadfd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.998] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5203, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x5203, lpOverlapped=0x0) returned 1 [0085.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.998] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.998] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.998] CloseHandle (hObject=0xf0) returned 1 [0085.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.000] GetLastError () returned 0x0 [0086.000] RtlWakeConditionVariable () returned 0x0 [0086.000] GetCurrentThreadId () returned 0x98c [0086.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.000] lstrlenW (lpString=".vhd") returned 4 [0086.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.000] lstrlenW (lpString=".vhdx") returned 5 [0086.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.000] lstrlenW (lpString=".pst") returned 4 [0086.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.001] lstrlenW (lpString=".ost") returned 4 [0086.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.001] lstrlenW (lpString=".bak") returned 4 [0086.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.001] lstrlenW (lpString=".bac") returned 4 [0086.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.001] lstrlenW (lpString=".sys") returned 4 [0086.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.001] lstrlenW (lpString=".v2i") returned 4 [0086.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.001] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.002] lstrlenW (lpString=".sql") returned 4 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.002] lstrlenW (lpString=".mdf") returned 4 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.002] lstrlenW (lpString=".txt") returned 4 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.002] lstrlenW (lpString=".dbf") returned 4 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.002] lstrlenW (lpString=".ckp") returned 4 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.002] lstrlenW (lpString=".dacpac") returned 7 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.002] lstrlenW (lpString=".db3") returned 4 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.002] lstrlenW (lpString=".dtxs") returned 5 [0086.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.003] lstrlenW (lpString=".mdt") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.003] lstrlenW (lpString=".sdf") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.003] lstrlenW (lpString=".MDF") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.003] lstrlenW (lpString=".DBF") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.003] lstrlenW (lpString=".DB") returned 3 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.003] lstrlenW (lpString=".db") returned 3 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.003] lstrlenW (lpString=".ndf") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.003] lstrlenW (lpString=".NDF") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.003] lstrlenW (lpString=".Mdf") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.003] lstrlenW (lpString=".dat") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.003] lstrlenW (lpString=".DAT") returned 4 [0086.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.004] lstrlenW (lpString=".ldf") returned 4 [0086.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.004] lstrlenW (lpString=".LDF") returned 4 [0086.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.004] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.004] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.005] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.005] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20600596119) returned 1 [0086.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc21427f0, dwHighDateTime=0x1d585b4)) [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c28 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c28 | out: hHeap=0x260000) returned 1 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0086.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0086.006] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.006] GetLastError () returned 0x0 [0086.006] GetLastError () returned 0x0 [0086.006] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.006] GetLastError () returned 0x0 [0086.006] GetLastError () returned 0x0 [0086.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffedc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.009] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1238, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1238, lpOverlapped=0x0) returned 1 [0086.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.009] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.009] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.009] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.009] CloseHandle (hObject=0xf0) returned 1 [0086.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.011] GetLastError () returned 0x0 [0086.011] RtlWakeConditionVariable () returned 0x0 [0086.011] GetCurrentThreadId () returned 0x98c [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".ldf") returned 0x0 [0086.011] lstrlenW (lpString=".vhd") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".vhd") returned 0x0 [0086.011] lstrlenW (lpString=".vhdx") returned 5 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".vhdx") returned 0x0 [0086.011] lstrlenW (lpString=".pst") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".pst") returned 0x0 [0086.011] lstrlenW (lpString=".ost") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".ost") returned 0x0 [0086.011] lstrlenW (lpString=".bak") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".bak") returned 0x0 [0086.011] lstrlenW (lpString=".bac") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".bac") returned 0x0 [0086.011] lstrlenW (lpString=".sys") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".sys") returned 0x0 [0086.011] lstrlenW (lpString=".v2i") returned 4 [0086.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".v2i") returned 0x0 [0086.012] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.012] lstrlenW (lpString=".sql") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".sql") returned 0x0 [0086.013] lstrlenW (lpString=".mdf") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".mdf") returned 0x0 [0086.013] lstrlenW (lpString=".txt") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".txt") returned 0x0 [0086.013] lstrlenW (lpString=".dbf") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".dbf") returned 0x0 [0086.013] lstrlenW (lpString=".ckp") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".ckp") returned 0x0 [0086.013] lstrlenW (lpString=".dacpac") returned 7 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".dacpac") returned 0x0 [0086.013] lstrlenW (lpString=".db3") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".db3") returned 0x0 [0086.013] lstrlenW (lpString=".dtxs") returned 5 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".dtxs") returned 0x0 [0086.013] lstrlenW (lpString=".mdt") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".mdt") returned 0x0 [0086.013] lstrlenW (lpString=".sdf") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".sdf") returned 0x0 [0086.013] lstrlenW (lpString=".MDF") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".MDF") returned 0x0 [0086.013] lstrlenW (lpString=".DBF") returned 4 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".DBF") returned 0x0 [0086.013] lstrlenW (lpString=".DB") returned 3 [0086.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".DB") returned 0x0 [0086.013] lstrlenW (lpString=".db") returned 3 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".db") returned 0x0 [0086.014] lstrlenW (lpString=".ndf") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".ndf") returned 0x0 [0086.014] lstrlenW (lpString=".NDF") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".NDF") returned 0x0 [0086.014] lstrlenW (lpString=".Mdf") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".Mdf") returned 0x0 [0086.014] lstrlenW (lpString=".dat") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".dat") returned 0x0 [0086.014] lstrlenW (lpString=".DAT") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".DAT") returned 0x0 [0086.014] lstrlenW (lpString=".ldf") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".ldf") returned 0x0 [0086.014] lstrlenW (lpString=".LDF") returned 4 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch=".LDF") returned 0x0 [0086.014] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.014] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.015] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.015] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.015] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20601639750) returned 1 [0086.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc21427f0, dwHighDateTime=0x1d585b4)) [0086.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763bf0 [0086.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763bf0 | out: hHeap=0x260000) returned 1 [0086.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.016] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.016] GetLastError () returned 0x0 [0086.016] GetLastError () returned 0x0 [0086.016] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.017] GetLastError () returned 0x0 [0086.017] GetLastError () returned 0x0 [0086.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff3e5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.118] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc1b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xc1b, lpOverlapped=0x0) returned 1 [0086.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.118] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.123] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.123] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.123] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.123] CloseHandle (hObject=0xf0) returned 1 [0086.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.187] GetLastError () returned 0x0 [0086.187] RtlWakeConditionVariable () returned 0x0 [0086.188] GetCurrentThreadId () returned 0x98c [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.188] lstrlenW (lpString=".vhd") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.188] lstrlenW (lpString=".vhdx") returned 5 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.188] lstrlenW (lpString=".pst") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.188] lstrlenW (lpString=".ost") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.188] lstrlenW (lpString=".bak") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.188] lstrlenW (lpString=".bac") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.188] lstrlenW (lpString=".sys") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.188] lstrlenW (lpString=".v2i") returned 4 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.188] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.189] lstrlenW (lpString=".sql") returned 4 [0086.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.189] lstrlenW (lpString=".mdf") returned 4 [0086.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.189] lstrlenW (lpString=".txt") returned 4 [0086.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.190] lstrlenW (lpString=".dbf") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.190] lstrlenW (lpString=".ckp") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.190] lstrlenW (lpString=".dacpac") returned 7 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.190] lstrlenW (lpString=".db3") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.190] lstrlenW (lpString=".dtxs") returned 5 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.190] lstrlenW (lpString=".mdt") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.190] lstrlenW (lpString=".sdf") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.190] lstrlenW (lpString=".MDF") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.190] lstrlenW (lpString=".DBF") returned 4 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.190] lstrlenW (lpString=".DB") returned 3 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.190] lstrlenW (lpString=".db") returned 3 [0086.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.191] lstrlenW (lpString=".ndf") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.191] lstrlenW (lpString=".NDF") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.191] lstrlenW (lpString=".Mdf") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.191] lstrlenW (lpString=".dat") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.191] lstrlenW (lpString=".DAT") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.191] lstrlenW (lpString=".ldf") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.191] lstrlenW (lpString=".LDF") returned 4 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.191] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.191] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.205] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.205] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.205] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20620654598) returned 1 [0086.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc230b870, dwHighDateTime=0x1d585b4)) [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27629c8 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27629c8 | out: hHeap=0x260000) returned 1 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0086.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0086.206] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.206] GetLastError () returned 0x0 [0086.207] GetLastError () returned 0x0 [0086.207] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.207] GetLastError () returned 0x0 [0086.207] GetLastError () returned 0x0 [0086.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeac8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.210] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1538, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1538, lpOverlapped=0x0) returned 1 [0086.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.210] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.211] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.211] CloseHandle (hObject=0xf0) returned 1 [0086.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.212] GetLastError () returned 0x0 [0086.212] RtlWakeConditionVariable () returned 0x0 [0086.212] GetCurrentThreadId () returned 0x98c [0086.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".ldf") returned 0x0 [0086.212] lstrlenW (lpString=".vhd") returned 4 [0086.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".vhd") returned 0x0 [0086.213] lstrlenW (lpString=".vhdx") returned 5 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".vhdx") returned 0x0 [0086.213] lstrlenW (lpString=".pst") returned 4 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".pst") returned 0x0 [0086.213] lstrlenW (lpString=".ost") returned 4 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".ost") returned 0x0 [0086.213] lstrlenW (lpString=".bak") returned 4 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".bak") returned 0x0 [0086.213] lstrlenW (lpString=".bac") returned 4 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".bac") returned 0x0 [0086.213] lstrlenW (lpString=".sys") returned 4 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".sys") returned 0x0 [0086.213] lstrlenW (lpString=".v2i") returned 4 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".v2i") returned 0x0 [0086.213] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.214] lstrlenW (lpString=".sql") returned 4 [0086.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".sql") returned 0x0 [0086.214] lstrlenW (lpString=".mdf") returned 4 [0086.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".mdf") returned 0x0 [0086.214] lstrlenW (lpString=".txt") returned 4 [0086.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".txt") returned 0x0 [0086.214] lstrlenW (lpString=".dbf") returned 4 [0086.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".dbf") returned 0x0 [0086.214] lstrlenW (lpString=".ckp") returned 4 [0086.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".ckp") returned 0x0 [0086.214] lstrlenW (lpString=".dacpac") returned 7 [0086.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".dacpac") returned 0x0 [0086.214] lstrlenW (lpString=".db3") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".db3") returned 0x0 [0086.215] lstrlenW (lpString=".dtxs") returned 5 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".dtxs") returned 0x0 [0086.215] lstrlenW (lpString=".mdt") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".mdt") returned 0x0 [0086.215] lstrlenW (lpString=".sdf") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".sdf") returned 0x0 [0086.215] lstrlenW (lpString=".MDF") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".MDF") returned 0x0 [0086.215] lstrlenW (lpString=".DBF") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".DBF") returned 0x0 [0086.215] lstrlenW (lpString=".DB") returned 3 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".DB") returned 0x0 [0086.215] lstrlenW (lpString=".db") returned 3 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".db") returned 0x0 [0086.215] lstrlenW (lpString=".ndf") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".ndf") returned 0x0 [0086.215] lstrlenW (lpString=".NDF") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".NDF") returned 0x0 [0086.215] lstrlenW (lpString=".Mdf") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".Mdf") returned 0x0 [0086.215] lstrlenW (lpString=".dat") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".dat") returned 0x0 [0086.215] lstrlenW (lpString=".DAT") returned 4 [0086.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".DAT") returned 0x0 [0086.215] lstrlenW (lpString=".ldf") returned 4 [0086.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".ldf") returned 0x0 [0086.216] lstrlenW (lpString=".LDF") returned 4 [0086.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch=".LDF") returned 0x0 [0086.216] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.216] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.217] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.217] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20621788436) returned 1 [0086.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc23319d0, dwHighDateTime=0x1d585b4)) [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762990 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762990 | out: hHeap=0x260000) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0086.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0086.217] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.218] GetLastError () returned 0x0 [0086.218] GetLastError () returned 0x0 [0086.218] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.218] GetLastError () returned 0x0 [0086.218] GetLastError () returned 0x0 [0086.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.220] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x838, lpOverlapped=0x0) returned 1 [0086.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.220] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.220] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.220] CloseHandle (hObject=0xf0) returned 1 [0086.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.222] GetLastError () returned 0x0 [0086.222] RtlWakeConditionVariable () returned 0x0 [0086.222] GetCurrentThreadId () returned 0x98c [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.222] lstrlenW (lpString=".vhd") returned 4 [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.222] lstrlenW (lpString=".vhdx") returned 5 [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.222] lstrlenW (lpString=".pst") returned 4 [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.222] lstrlenW (lpString=".ost") returned 4 [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.222] lstrlenW (lpString=".bak") returned 4 [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.222] lstrlenW (lpString=".bac") returned 4 [0086.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.222] lstrlenW (lpString=".sys") returned 4 [0086.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.223] lstrlenW (lpString=".v2i") returned 4 [0086.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.223] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.224] lstrlenW (lpString=".sql") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.224] lstrlenW (lpString=".mdf") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.224] lstrlenW (lpString=".txt") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.224] lstrlenW (lpString=".dbf") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.224] lstrlenW (lpString=".ckp") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.224] lstrlenW (lpString=".dacpac") returned 7 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.224] lstrlenW (lpString=".db3") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.224] lstrlenW (lpString=".dtxs") returned 5 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.224] lstrlenW (lpString=".mdt") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.224] lstrlenW (lpString=".sdf") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.224] lstrlenW (lpString=".MDF") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.224] lstrlenW (lpString=".DBF") returned 4 [0086.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.225] lstrlenW (lpString=".DB") returned 3 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.225] lstrlenW (lpString=".db") returned 3 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".db") returned 0x0 [0086.225] lstrlenW (lpString=".ndf") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.225] lstrlenW (lpString=".NDF") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.225] lstrlenW (lpString=".Mdf") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.225] lstrlenW (lpString=".dat") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.225] lstrlenW (lpString=".DAT") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.225] lstrlenW (lpString=".ldf") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.225] lstrlenW (lpString=".LDF") returned 4 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.225] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.225] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.226] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.226] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.226] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20622751347) returned 1 [0086.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2357b30, dwHighDateTime=0x1d585b4)) [0086.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762958 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762958 | out: hHeap=0x260000) returned 1 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b2b8 [0086.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b2b8 | out: hHeap=0x260000) returned 1 [0086.227] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.227] GetLastError () returned 0x0 [0086.227] GetLastError () returned 0x0 [0086.228] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.228] GetLastError () returned 0x0 [0086.228] GetLastError () returned 0x0 [0086.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdcf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.230] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2308, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2308, lpOverlapped=0x0) returned 1 [0086.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.230] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.230] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.230] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.230] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.230] CloseHandle (hObject=0xf0) returned 1 [0086.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.232] GetLastError () returned 0x0 [0086.232] RtlWakeConditionVariable () returned 0x0 [0086.232] GetCurrentThreadId () returned 0x98c [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.232] lstrlenW (lpString=".vhd") returned 4 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.232] lstrlenW (lpString=".vhdx") returned 5 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.232] lstrlenW (lpString=".pst") returned 4 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.232] lstrlenW (lpString=".ost") returned 4 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.232] lstrlenW (lpString=".bak") returned 4 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.232] lstrlenW (lpString=".bac") returned 4 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.232] lstrlenW (lpString=".sys") returned 4 [0086.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.232] lstrlenW (lpString=".v2i") returned 4 [0086.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.233] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.248] lstrlenW (lpString=".sql") returned 4 [0086.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.248] lstrlenW (lpString=".mdf") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.249] lstrlenW (lpString=".txt") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.249] lstrlenW (lpString=".dbf") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.249] lstrlenW (lpString=".ckp") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.249] lstrlenW (lpString=".dacpac") returned 7 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.249] lstrlenW (lpString=".db3") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.249] lstrlenW (lpString=".dtxs") returned 5 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.249] lstrlenW (lpString=".mdt") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.249] lstrlenW (lpString=".sdf") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.249] lstrlenW (lpString=".MDF") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.249] lstrlenW (lpString=".DBF") returned 4 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.249] lstrlenW (lpString=".DB") returned 3 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.249] lstrlenW (lpString=".db") returned 3 [0086.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.249] lstrlenW (lpString=".ndf") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.250] lstrlenW (lpString=".NDF") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.250] lstrlenW (lpString=".Mdf") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.250] lstrlenW (lpString=".dat") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.250] lstrlenW (lpString=".DAT") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.250] lstrlenW (lpString=".ldf") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.250] lstrlenW (lpString=".LDF") returned 4 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.250] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.250] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.251] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.251] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.251] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20625229271) returned 1 [0086.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc237dc90, dwHighDateTime=0x1d585b4)) [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762920 [0086.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762920 | out: hHeap=0x260000) returned 1 [0086.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b210 [0086.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b210 | out: hHeap=0x260000) returned 1 [0086.252] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.252] GetLastError () returned 0x0 [0086.252] GetLastError () returned 0x0 [0086.252] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.253] GetLastError () returned 0x0 [0086.253] GetLastError () returned 0x0 [0086.255] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.255] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x638, lpOverlapped=0x0) returned 1 [0086.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.255] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.256] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.256] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.256] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.256] CloseHandle (hObject=0x11c) returned 1 [0086.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.257] GetLastError () returned 0x0 [0086.257] RtlWakeConditionVariable () returned 0x0 [0086.258] GetCurrentThreadId () returned 0x98c [0086.258] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.258] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.258] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.258] WriteFile (in: hFile=0x11c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.260] CloseHandle (hObject=0x11c) returned 1 [0086.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341938 | out: hHeap=0x260000) returned 1 [0086.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0086.260] RtlWakeConditionVariable () returned 0x27e828 [0086.260] GetCurrentThreadId () returned 0x98c [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.260] lstrlenW (lpString=".vhd") returned 4 [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.260] lstrlenW (lpString=".vhdx") returned 5 [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.260] lstrlenW (lpString=".pst") returned 4 [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.260] lstrlenW (lpString=".ost") returned 4 [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.260] lstrlenW (lpString=".bak") returned 4 [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.260] lstrlenW (lpString=".bac") returned 4 [0086.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.260] lstrlenW (lpString=".sys") returned 4 [0086.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.261] lstrlenW (lpString=".v2i") returned 4 [0086.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.261] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.262] lstrlenW (lpString=".sql") returned 4 [0086.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.262] lstrlenW (lpString=".mdf") returned 4 [0086.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.262] lstrlenW (lpString=".txt") returned 4 [0086.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.262] lstrlenW (lpString=".dbf") returned 4 [0086.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.263] lstrlenW (lpString=".ckp") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.263] lstrlenW (lpString=".dacpac") returned 7 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.263] lstrlenW (lpString=".db3") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.263] lstrlenW (lpString=".dtxs") returned 5 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.263] lstrlenW (lpString=".mdt") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.263] lstrlenW (lpString=".sdf") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.263] lstrlenW (lpString=".MDF") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.263] lstrlenW (lpString=".DBF") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.263] lstrlenW (lpString=".DB") returned 3 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.263] lstrlenW (lpString=".db") returned 3 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".db") returned 0x0 [0086.263] lstrlenW (lpString=".ndf") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.263] lstrlenW (lpString=".NDF") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.263] lstrlenW (lpString=".Mdf") returned 4 [0086.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.264] lstrlenW (lpString=".dat") returned 4 [0086.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.264] lstrlenW (lpString=".DAT") returned 4 [0086.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.264] lstrlenW (lpString=".ldf") returned 4 [0086.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.264] lstrlenW (lpString=".LDF") returned 4 [0086.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.264] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.264] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.265] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.265] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.265] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20626609258) returned 1 [0086.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc23a3df0, dwHighDateTime=0x1d585b4)) [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1e40 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1e40 | out: hHeap=0x260000) returned 1 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b210 [0086.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b210 | out: hHeap=0x260000) returned 1 [0086.266] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.266] GetLastError () returned 0x0 [0086.266] GetLastError () returned 0x0 [0086.266] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.266] GetLastError () returned 0x0 [0086.266] GetLastError () returned 0x0 [0086.268] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffcbdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.268] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3424, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3424, lpOverlapped=0x0) returned 1 [0086.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.268] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.268] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.268] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.268] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.269] CloseHandle (hObject=0x11c) returned 1 [0086.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.270] GetLastError () returned 0x0 [0086.270] RtlWakeConditionVariable () returned 0x27e828 [0086.270] GetCurrentThreadId () returned 0x98c [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.271] lstrlenW (lpString=".vhd") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.271] lstrlenW (lpString=".vhdx") returned 5 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.271] lstrlenW (lpString=".pst") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.271] lstrlenW (lpString=".ost") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.271] lstrlenW (lpString=".bak") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.271] lstrlenW (lpString=".bac") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.271] lstrlenW (lpString=".sys") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.271] lstrlenW (lpString=".v2i") returned 4 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.271] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.273] lstrlenW (lpString=".sql") returned 4 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.273] lstrlenW (lpString=".mdf") returned 4 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.273] lstrlenW (lpString=".txt") returned 4 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.273] lstrlenW (lpString=".dbf") returned 4 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.273] lstrlenW (lpString=".ckp") returned 4 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.273] lstrlenW (lpString=".dacpac") returned 7 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.273] lstrlenW (lpString=".db3") returned 4 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.273] lstrlenW (lpString=".dtxs") returned 5 [0086.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.273] lstrlenW (lpString=".mdt") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.274] lstrlenW (lpString=".sdf") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.274] lstrlenW (lpString=".MDF") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.274] lstrlenW (lpString=".DBF") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.274] lstrlenW (lpString=".DB") returned 3 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.274] lstrlenW (lpString=".db") returned 3 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.274] lstrlenW (lpString=".ndf") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.274] lstrlenW (lpString=".NDF") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.274] lstrlenW (lpString=".Mdf") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.274] lstrlenW (lpString=".dat") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.274] lstrlenW (lpString=".DAT") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.274] lstrlenW (lpString=".ldf") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.274] lstrlenW (lpString=".LDF") returned 4 [0086.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.274] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.275] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.275] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.275] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.276] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20627675499) returned 1 [0086.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc23c9f50, dwHighDateTime=0x1d585b4)) [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1dd0 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1dd0 | out: hHeap=0x260000) returned 1 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b2b8 [0086.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b2b8 | out: hHeap=0x260000) returned 1 [0086.276] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.276] GetLastError () returned 0x0 [0086.277] GetLastError () returned 0x0 [0086.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.277] GetLastError () returned 0x0 [0086.277] GetLastError () returned 0x0 [0086.279] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff3c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.279] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc38, lpOverlapped=0x0) returned 1 [0086.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.279] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.279] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.279] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.279] CloseHandle (hObject=0x11c) returned 1 [0086.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.281] GetLastError () returned 0x0 [0086.281] RtlWakeConditionVariable () returned 0x27e828 [0086.281] GetCurrentThreadId () returned 0x98c [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".ldf") returned 0x0 [0086.281] lstrlenW (lpString=".vhd") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".vhd") returned 0x0 [0086.281] lstrlenW (lpString=".vhdx") returned 5 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.281] lstrlenW (lpString=".pst") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".pst") returned 0x0 [0086.281] lstrlenW (lpString=".ost") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".ost") returned 0x0 [0086.281] lstrlenW (lpString=".bak") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".bak") returned 0x0 [0086.281] lstrlenW (lpString=".bac") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".bac") returned 0x0 [0086.281] lstrlenW (lpString=".sys") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".sys") returned 0x0 [0086.281] lstrlenW (lpString=".v2i") returned 4 [0086.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".v2i") returned 0x0 [0086.282] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.282] lstrlenW (lpString=".sql") returned 4 [0086.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".sql") returned 0x0 [0086.283] lstrlenW (lpString=".mdf") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".mdf") returned 0x0 [0086.283] lstrlenW (lpString=".txt") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".txt") returned 0x0 [0086.283] lstrlenW (lpString=".dbf") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".dbf") returned 0x0 [0086.283] lstrlenW (lpString=".ckp") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".ckp") returned 0x0 [0086.283] lstrlenW (lpString=".dacpac") returned 7 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.283] lstrlenW (lpString=".db3") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".db3") returned 0x0 [0086.283] lstrlenW (lpString=".dtxs") returned 5 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.283] lstrlenW (lpString=".mdt") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".mdt") returned 0x0 [0086.283] lstrlenW (lpString=".sdf") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".sdf") returned 0x0 [0086.283] lstrlenW (lpString=".MDF") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".MDF") returned 0x0 [0086.283] lstrlenW (lpString=".DBF") returned 4 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".DBF") returned 0x0 [0086.283] lstrlenW (lpString=".DB") returned 3 [0086.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".DB") returned 0x0 [0086.283] lstrlenW (lpString=".db") returned 3 [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".db") returned 0x0 [0086.350] lstrlenW (lpString=".ndf") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".ndf") returned 0x0 [0086.350] lstrlenW (lpString=".NDF") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".NDF") returned 0x0 [0086.350] lstrlenW (lpString=".Mdf") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.350] lstrlenW (lpString=".dat") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".dat") returned 0x0 [0086.350] lstrlenW (lpString=".DAT") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".DAT") returned 0x0 [0086.350] lstrlenW (lpString=".ldf") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".ldf") returned 0x0 [0086.350] lstrlenW (lpString=".LDF") returned 4 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch=".LDF") returned 0x0 [0086.350] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.350] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.351] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.351] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20635242026) returned 1 [0086.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2488630, dwHighDateTime=0x1d585b4)) [0086.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294ee8 [0086.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ee8 | out: hHeap=0x260000) returned 1 [0086.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.352] GetLastError () returned 0x0 [0086.352] GetLastError () returned 0x0 [0086.352] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.353] GetLastError () returned 0x0 [0086.353] GetLastError () returned 0x0 [0086.354] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc05e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.354] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3fa2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x3fa2, lpOverlapped=0x0) returned 1 [0086.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.355] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.355] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.355] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.355] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.355] CloseHandle (hObject=0x11c) returned 1 [0086.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.356] GetLastError () returned 0x0 [0086.357] RtlWakeConditionVariable () returned 0x0 [0086.357] GetCurrentThreadId () returned 0x98c [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".ldf") returned 0x0 [0086.357] lstrlenW (lpString=".vhd") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".vhd") returned 0x0 [0086.357] lstrlenW (lpString=".vhdx") returned 5 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".vhdx") returned 0x0 [0086.357] lstrlenW (lpString=".pst") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".pst") returned 0x0 [0086.357] lstrlenW (lpString=".ost") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".ost") returned 0x0 [0086.357] lstrlenW (lpString=".bak") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".bak") returned 0x0 [0086.357] lstrlenW (lpString=".bac") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".bac") returned 0x0 [0086.357] lstrlenW (lpString=".sys") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".sys") returned 0x0 [0086.357] lstrlenW (lpString=".v2i") returned 4 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".v2i") returned 0x0 [0086.357] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.374] lstrlenW (lpString=".sql") returned 4 [0086.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".sql") returned 0x0 [0086.374] lstrlenW (lpString=".mdf") returned 4 [0086.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".mdf") returned 0x0 [0086.374] lstrlenW (lpString=".txt") returned 4 [0086.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".txt") returned 0x0 [0086.374] lstrlenW (lpString=".dbf") returned 4 [0086.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".dbf") returned 0x0 [0086.374] lstrlenW (lpString=".ckp") returned 4 [0086.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".ckp") returned 0x0 [0086.385] lstrlenW (lpString=".dacpac") returned 7 [0086.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".dacpac") returned 0x0 [0086.395] lstrlenW (lpString=".db3") returned 4 [0086.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".db3") returned 0x0 [0086.395] lstrlenW (lpString=".dtxs") returned 5 [0086.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".dtxs") returned 0x0 [0086.405] lstrlenW (lpString=".mdt") returned 4 [0086.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".mdt") returned 0x0 [0086.405] lstrlenW (lpString=".sdf") returned 4 [0086.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".sdf") returned 0x0 [0086.405] lstrlenW (lpString=".MDF") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".MDF") returned 0x0 [0086.406] lstrlenW (lpString=".DBF") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".DBF") returned 0x0 [0086.406] lstrlenW (lpString=".DB") returned 3 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".DB") returned 0x0 [0086.406] lstrlenW (lpString=".db") returned 3 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".db") returned 0x0 [0086.406] lstrlenW (lpString=".ndf") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".ndf") returned 0x0 [0086.406] lstrlenW (lpString=".NDF") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".NDF") returned 0x0 [0086.406] lstrlenW (lpString=".Mdf") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".Mdf") returned 0x0 [0086.406] lstrlenW (lpString=".dat") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".dat") returned 0x0 [0086.406] lstrlenW (lpString=".DAT") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".DAT") returned 0x0 [0086.406] lstrlenW (lpString=".ldf") returned 4 [0086.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".ldf") returned 0x0 [0086.406] lstrlenW (lpString=".LDF") returned 4 [0086.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch=".LDF") returned 0x0 [0086.407] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.407] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.407] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.407] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.408] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20640880982) returned 1 [0086.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc24faa50, dwHighDateTime=0x1d585b4)) [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c790 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c790 | out: hHeap=0x260000) returned 1 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.409] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.409] GetLastError () returned 0x0 [0086.409] GetLastError () returned 0x0 [0086.409] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.409] GetLastError () returned 0x0 [0086.409] GetLastError () returned 0x0 [0086.422] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb7f3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.422] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x480d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x480d, lpOverlapped=0x0) returned 1 [0086.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.423] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.423] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.423] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.423] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.423] CloseHandle (hObject=0x11c) returned 1 [0086.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.425] GetLastError () returned 0x0 [0086.425] RtlWakeConditionVariable () returned 0x0 [0086.425] GetCurrentThreadId () returned 0x98c [0086.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".ldf") returned 0x0 [0086.425] lstrlenW (lpString=".vhd") returned 4 [0086.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".vhd") returned 0x0 [0086.425] lstrlenW (lpString=".vhdx") returned 5 [0086.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.425] lstrlenW (lpString=".pst") returned 4 [0086.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".pst") returned 0x0 [0086.425] lstrlenW (lpString=".ost") returned 4 [0086.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".ost") returned 0x0 [0086.425] lstrlenW (lpString=".bak") returned 4 [0086.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".bak") returned 0x0 [0086.425] lstrlenW (lpString=".bac") returned 4 [0086.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".bac") returned 0x0 [0086.426] lstrlenW (lpString=".sys") returned 4 [0086.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".sys") returned 0x0 [0086.426] lstrlenW (lpString=".v2i") returned 4 [0086.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".v2i") returned 0x0 [0086.426] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.427] lstrlenW (lpString=".sql") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".sql") returned 0x0 [0086.427] lstrlenW (lpString=".mdf") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".mdf") returned 0x0 [0086.427] lstrlenW (lpString=".txt") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".txt") returned 0x0 [0086.427] lstrlenW (lpString=".dbf") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".dbf") returned 0x0 [0086.427] lstrlenW (lpString=".ckp") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".ckp") returned 0x0 [0086.427] lstrlenW (lpString=".dacpac") returned 7 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.427] lstrlenW (lpString=".db3") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".db3") returned 0x0 [0086.427] lstrlenW (lpString=".dtxs") returned 5 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.427] lstrlenW (lpString=".mdt") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".mdt") returned 0x0 [0086.427] lstrlenW (lpString=".sdf") returned 4 [0086.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".sdf") returned 0x0 [0086.428] lstrlenW (lpString=".MDF") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".MDF") returned 0x0 [0086.428] lstrlenW (lpString=".DBF") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".DBF") returned 0x0 [0086.428] lstrlenW (lpString=".DB") returned 3 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".DB") returned 0x0 [0086.428] lstrlenW (lpString=".db") returned 3 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".db") returned 0x0 [0086.428] lstrlenW (lpString=".ndf") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".ndf") returned 0x0 [0086.428] lstrlenW (lpString=".NDF") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".NDF") returned 0x0 [0086.428] lstrlenW (lpString=".Mdf") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.428] lstrlenW (lpString=".dat") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".dat") returned 0x0 [0086.428] lstrlenW (lpString=".DAT") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".DAT") returned 0x0 [0086.428] lstrlenW (lpString=".ldf") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".ldf") returned 0x0 [0086.428] lstrlenW (lpString=".LDF") returned 4 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch=".LDF") returned 0x0 [0086.428] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.429] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.429] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.429] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.430] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20643065763) returned 1 [0086.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2546d10, dwHighDateTime=0x1d585b4)) [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c800 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c800 | out: hHeap=0x260000) returned 1 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.430] GetLastError () returned 0x0 [0086.431] GetLastError () returned 0x0 [0086.431] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.431] GetLastError () returned 0x0 [0086.431] GetLastError () returned 0x0 [0086.436] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.436] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1c6e, lpOverlapped=0x0) returned 1 [0086.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.437] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.437] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.437] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.437] CloseHandle (hObject=0x11c) returned 1 [0086.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.438] GetLastError () returned 0x0 [0086.439] RtlWakeConditionVariable () returned 0x0 [0086.439] GetCurrentThreadId () returned 0x98c [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".ldf") returned 0x0 [0086.439] lstrlenW (lpString=".vhd") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".vhd") returned 0x0 [0086.439] lstrlenW (lpString=".vhdx") returned 5 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".vhdx") returned 0x0 [0086.439] lstrlenW (lpString=".pst") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".pst") returned 0x0 [0086.439] lstrlenW (lpString=".ost") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".ost") returned 0x0 [0086.439] lstrlenW (lpString=".bak") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".bak") returned 0x0 [0086.439] lstrlenW (lpString=".bac") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".bac") returned 0x0 [0086.439] lstrlenW (lpString=".sys") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".sys") returned 0x0 [0086.439] lstrlenW (lpString=".v2i") returned 4 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".v2i") returned 0x0 [0086.439] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.440] lstrlenW (lpString=".sql") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".sql") returned 0x0 [0086.441] lstrlenW (lpString=".mdf") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".mdf") returned 0x0 [0086.441] lstrlenW (lpString=".txt") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".txt") returned 0x0 [0086.441] lstrlenW (lpString=".dbf") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".dbf") returned 0x0 [0086.441] lstrlenW (lpString=".ckp") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".ckp") returned 0x0 [0086.441] lstrlenW (lpString=".dacpac") returned 7 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".dacpac") returned 0x0 [0086.441] lstrlenW (lpString=".db3") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".db3") returned 0x0 [0086.441] lstrlenW (lpString=".dtxs") returned 5 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".dtxs") returned 0x0 [0086.441] lstrlenW (lpString=".mdt") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".mdt") returned 0x0 [0086.441] lstrlenW (lpString=".sdf") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".sdf") returned 0x0 [0086.441] lstrlenW (lpString=".MDF") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".MDF") returned 0x0 [0086.441] lstrlenW (lpString=".DBF") returned 4 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".DBF") returned 0x0 [0086.441] lstrlenW (lpString=".DB") returned 3 [0086.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".DB") returned 0x0 [0086.442] lstrlenW (lpString=".db") returned 3 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".db") returned 0x0 [0086.442] lstrlenW (lpString=".ndf") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".ndf") returned 0x0 [0086.442] lstrlenW (lpString=".NDF") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".NDF") returned 0x0 [0086.442] lstrlenW (lpString=".Mdf") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".Mdf") returned 0x0 [0086.442] lstrlenW (lpString=".dat") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".dat") returned 0x0 [0086.442] lstrlenW (lpString=".DAT") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".DAT") returned 0x0 [0086.442] lstrlenW (lpString=".ldf") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".ldf") returned 0x0 [0086.442] lstrlenW (lpString=".LDF") returned 4 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch=".LDF") returned 0x0 [0086.442] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.442] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.443] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.443] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.443] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20644443188) returned 1 [0086.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc256ce70, dwHighDateTime=0x1d585b4)) [0086.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c870 [0086.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c870 | out: hHeap=0x260000) returned 1 [0086.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.444] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.444] GetLastError () returned 0x0 [0086.444] GetLastError () returned 0x0 [0086.444] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.445] GetLastError () returned 0x0 [0086.445] GetLastError () returned 0x0 [0086.446] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.446] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1c6e, lpOverlapped=0x0) returned 1 [0086.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.446] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.447] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.447] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.447] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.447] CloseHandle (hObject=0x11c) returned 1 [0086.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.448] GetLastError () returned 0x0 [0086.448] RtlWakeConditionVariable () returned 0x27e828 [0086.448] GetCurrentThreadId () returned 0x98c [0086.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".ldf") returned 0x0 [0086.448] lstrlenW (lpString=".vhd") returned 4 [0086.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".vhd") returned 0x0 [0086.449] lstrlenW (lpString=".vhdx") returned 5 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".vhdx") returned 0x0 [0086.449] lstrlenW (lpString=".pst") returned 4 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".pst") returned 0x0 [0086.449] lstrlenW (lpString=".ost") returned 4 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".ost") returned 0x0 [0086.449] lstrlenW (lpString=".bak") returned 4 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".bak") returned 0x0 [0086.449] lstrlenW (lpString=".bac") returned 4 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".bac") returned 0x0 [0086.449] lstrlenW (lpString=".sys") returned 4 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".sys") returned 0x0 [0086.449] lstrlenW (lpString=".v2i") returned 4 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".v2i") returned 0x0 [0086.449] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.450] lstrlenW (lpString=".sql") returned 4 [0086.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".sql") returned 0x0 [0086.450] lstrlenW (lpString=".mdf") returned 4 [0086.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".mdf") returned 0x0 [0086.450] lstrlenW (lpString=".txt") returned 4 [0086.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".txt") returned 0x0 [0086.450] lstrlenW (lpString=".dbf") returned 4 [0086.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".dbf") returned 0x0 [0086.450] lstrlenW (lpString=".ckp") returned 4 [0086.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".ckp") returned 0x0 [0086.450] lstrlenW (lpString=".dacpac") returned 7 [0086.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".dacpac") returned 0x0 [0086.450] lstrlenW (lpString=".db3") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".db3") returned 0x0 [0086.451] lstrlenW (lpString=".dtxs") returned 5 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".dtxs") returned 0x0 [0086.451] lstrlenW (lpString=".mdt") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".mdt") returned 0x0 [0086.451] lstrlenW (lpString=".sdf") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".sdf") returned 0x0 [0086.451] lstrlenW (lpString=".MDF") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".MDF") returned 0x0 [0086.451] lstrlenW (lpString=".DBF") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".DBF") returned 0x0 [0086.451] lstrlenW (lpString=".DB") returned 3 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".DB") returned 0x0 [0086.451] lstrlenW (lpString=".db") returned 3 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".db") returned 0x0 [0086.451] lstrlenW (lpString=".ndf") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".ndf") returned 0x0 [0086.451] lstrlenW (lpString=".NDF") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".NDF") returned 0x0 [0086.451] lstrlenW (lpString=".Mdf") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".Mdf") returned 0x0 [0086.451] lstrlenW (lpString=".dat") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".dat") returned 0x0 [0086.451] lstrlenW (lpString=".DAT") returned 4 [0086.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".DAT") returned 0x0 [0086.451] lstrlenW (lpString=".ldf") returned 4 [0086.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".ldf") returned 0x0 [0086.452] lstrlenW (lpString=".LDF") returned 4 [0086.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch=".LDF") returned 0x0 [0086.452] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.452] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.453] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.453] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.453] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20645392383) returned 1 [0086.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc256ce70, dwHighDateTime=0x1d585b4)) [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c8a8 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c8a8 | out: hHeap=0x260000) returned 1 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.453] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.454] GetLastError () returned 0x0 [0086.454] GetLastError () returned 0x0 [0086.454] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.454] GetLastError () returned 0x0 [0086.454] GetLastError () returned 0x0 [0086.514] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc188, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.514] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3e78, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x3e78, lpOverlapped=0x0) returned 1 [0086.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.514] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.515] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.515] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.515] CloseHandle (hObject=0x11c) returned 1 [0086.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.628] GetLastError () returned 0x0 [0086.628] RtlWakeConditionVariable () returned 0x0 [0086.628] GetCurrentThreadId () returned 0x98c [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".ldf") returned 0x0 [0086.629] lstrlenW (lpString=".vhd") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".vhd") returned 0x0 [0086.629] lstrlenW (lpString=".vhdx") returned 5 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".vhdx") returned 0x0 [0086.629] lstrlenW (lpString=".pst") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".pst") returned 0x0 [0086.629] lstrlenW (lpString=".ost") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".ost") returned 0x0 [0086.629] lstrlenW (lpString=".bak") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".bak") returned 0x0 [0086.629] lstrlenW (lpString=".bac") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".bac") returned 0x0 [0086.629] lstrlenW (lpString=".sys") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".sys") returned 0x0 [0086.629] lstrlenW (lpString=".v2i") returned 4 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".v2i") returned 0x0 [0086.629] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.659] lstrlenW (lpString=".sql") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".sql") returned 0x0 [0086.660] lstrlenW (lpString=".mdf") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".mdf") returned 0x0 [0086.660] lstrlenW (lpString=".txt") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".txt") returned 0x0 [0086.660] lstrlenW (lpString=".dbf") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".dbf") returned 0x0 [0086.660] lstrlenW (lpString=".ckp") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".ckp") returned 0x0 [0086.660] lstrlenW (lpString=".dacpac") returned 7 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".dacpac") returned 0x0 [0086.660] lstrlenW (lpString=".db3") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".db3") returned 0x0 [0086.660] lstrlenW (lpString=".dtxs") returned 5 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".dtxs") returned 0x0 [0086.660] lstrlenW (lpString=".mdt") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".mdt") returned 0x0 [0086.660] lstrlenW (lpString=".sdf") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".sdf") returned 0x0 [0086.660] lstrlenW (lpString=".MDF") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".MDF") returned 0x0 [0086.660] lstrlenW (lpString=".DBF") returned 4 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".DBF") returned 0x0 [0086.660] lstrlenW (lpString=".DB") returned 3 [0086.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".DB") returned 0x0 [0086.661] lstrlenW (lpString=".db") returned 3 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".db") returned 0x0 [0086.661] lstrlenW (lpString=".ndf") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".ndf") returned 0x0 [0086.661] lstrlenW (lpString=".NDF") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".NDF") returned 0x0 [0086.661] lstrlenW (lpString=".Mdf") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".Mdf") returned 0x0 [0086.661] lstrlenW (lpString=".dat") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".dat") returned 0x0 [0086.661] lstrlenW (lpString=".DAT") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".DAT") returned 0x0 [0086.661] lstrlenW (lpString=".ldf") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".ldf") returned 0x0 [0086.661] lstrlenW (lpString=".LDF") returned 4 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch=".LDF") returned 0x0 [0086.661] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.661] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.662] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.662] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.662] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20666342285) returned 1 [0086.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc27821b0, dwHighDateTime=0x1d585b4)) [0086.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f2a0 [0086.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2a0 | out: hHeap=0x260000) returned 1 [0086.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.663] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.663] GetLastError () returned 0x0 [0086.663] GetLastError () returned 0x0 [0086.663] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.664] GetLastError () returned 0x0 [0086.664] GetLastError () returned 0x0 [0086.678] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff1e5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.678] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xe1b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xe1b, lpOverlapped=0x0) returned 1 [0086.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.678] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.678] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.678] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.678] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.679] CloseHandle (hObject=0xe4) returned 1 [0086.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.681] GetLastError () returned 0x0 [0086.681] RtlWakeConditionVariable () returned 0x27e828 [0086.681] GetCurrentThreadId () returned 0x98c [0086.681] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.681] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.681] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.681] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.683] CloseHandle (hObject=0xe4) returned 1 [0086.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31d598 | out: hHeap=0x260000) returned 1 [0086.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.683] RtlWakeConditionVariable () returned 0x27e828 [0086.683] GetCurrentThreadId () returned 0x98c [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".ldf") returned 0x0 [0086.684] lstrlenW (lpString=".vhd") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".vhd") returned 0x0 [0086.684] lstrlenW (lpString=".vhdx") returned 5 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".vhdx") returned 0x0 [0086.684] lstrlenW (lpString=".pst") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".pst") returned 0x0 [0086.684] lstrlenW (lpString=".ost") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".ost") returned 0x0 [0086.684] lstrlenW (lpString=".bak") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".bak") returned 0x0 [0086.684] lstrlenW (lpString=".bac") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".bac") returned 0x0 [0086.684] lstrlenW (lpString=".sys") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".sys") returned 0x0 [0086.684] lstrlenW (lpString=".v2i") returned 4 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".v2i") returned 0x0 [0086.684] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.686] lstrlenW (lpString=".sql") returned 4 [0086.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".sql") returned 0x0 [0086.686] lstrlenW (lpString=".mdf") returned 4 [0086.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".mdf") returned 0x0 [0086.686] lstrlenW (lpString=".txt") returned 4 [0086.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".txt") returned 0x0 [0086.686] lstrlenW (lpString=".dbf") returned 4 [0086.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".dbf") returned 0x0 [0086.686] lstrlenW (lpString=".ckp") returned 4 [0086.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".ckp") returned 0x0 [0086.687] lstrlenW (lpString=".dacpac") returned 7 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".dacpac") returned 0x0 [0086.687] lstrlenW (lpString=".db3") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".db3") returned 0x0 [0086.687] lstrlenW (lpString=".dtxs") returned 5 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".dtxs") returned 0x0 [0086.687] lstrlenW (lpString=".mdt") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".mdt") returned 0x0 [0086.687] lstrlenW (lpString=".sdf") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".sdf") returned 0x0 [0086.687] lstrlenW (lpString=".MDF") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".MDF") returned 0x0 [0086.687] lstrlenW (lpString=".DBF") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".DBF") returned 0x0 [0086.687] lstrlenW (lpString=".DB") returned 3 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".DB") returned 0x0 [0086.687] lstrlenW (lpString=".db") returned 3 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".db") returned 0x0 [0086.687] lstrlenW (lpString=".ndf") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".ndf") returned 0x0 [0086.687] lstrlenW (lpString=".NDF") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".NDF") returned 0x0 [0086.687] lstrlenW (lpString=".Mdf") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".Mdf") returned 0x0 [0086.687] lstrlenW (lpString=".dat") returned 4 [0086.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".dat") returned 0x0 [0086.688] lstrlenW (lpString=".DAT") returned 4 [0086.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".DAT") returned 0x0 [0086.688] lstrlenW (lpString=".ldf") returned 4 [0086.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".ldf") returned 0x0 [0086.688] lstrlenW (lpString=".LDF") returned 4 [0086.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch=".LDF") returned 0x0 [0086.688] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.688] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.689] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.689] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.689] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20669005728) returned 1 [0086.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc27a8310, dwHighDateTime=0x1d585b4)) [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295230 [0086.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295230 | out: hHeap=0x260000) returned 1 [0086.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.690] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.690] GetLastError () returned 0x0 [0086.690] GetLastError () returned 0x0 [0086.690] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.690] GetLastError () returned 0x0 [0086.691] GetLastError () returned 0x0 [0086.692] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdae7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.692] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2519, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x2519, lpOverlapped=0x0) returned 1 [0086.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.693] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.693] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.693] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.693] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.693] CloseHandle (hObject=0xe4) returned 1 [0086.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.695] GetLastError () returned 0x0 [0086.695] RtlWakeConditionVariable () returned 0x0 [0086.695] GetCurrentThreadId () returned 0x98c [0086.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.695] lstrlenW (lpString=".vhd") returned 4 [0086.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".vhd") returned 0x0 [0086.695] lstrlenW (lpString=".vhdx") returned 5 [0086.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.696] lstrlenW (lpString=".pst") returned 4 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".pst") returned 0x0 [0086.696] lstrlenW (lpString=".ost") returned 4 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".ost") returned 0x0 [0086.696] lstrlenW (lpString=".bak") returned 4 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".bak") returned 0x0 [0086.696] lstrlenW (lpString=".bac") returned 4 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".bac") returned 0x0 [0086.696] lstrlenW (lpString=".sys") returned 4 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".sys") returned 0x0 [0086.696] lstrlenW (lpString=".v2i") returned 4 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".v2i") returned 0x0 [0086.696] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.697] lstrlenW (lpString=".sql") returned 4 [0086.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".sql") returned 0x0 [0086.697] lstrlenW (lpString=".mdf") returned 4 [0086.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".mdf") returned 0x0 [0086.698] lstrlenW (lpString=".txt") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".txt") returned 0x0 [0086.698] lstrlenW (lpString=".dbf") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".dbf") returned 0x0 [0086.698] lstrlenW (lpString=".ckp") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".ckp") returned 0x0 [0086.698] lstrlenW (lpString=".dacpac") returned 7 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.698] lstrlenW (lpString=".db3") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".db3") returned 0x0 [0086.698] lstrlenW (lpString=".dtxs") returned 5 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.698] lstrlenW (lpString=".mdt") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".mdt") returned 0x0 [0086.698] lstrlenW (lpString=".sdf") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".sdf") returned 0x0 [0086.698] lstrlenW (lpString=".MDF") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".MDF") returned 0x0 [0086.698] lstrlenW (lpString=".DBF") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".DBF") returned 0x0 [0086.698] lstrlenW (lpString=".DB") returned 3 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".DB") returned 0x0 [0086.698] lstrlenW (lpString=".db") returned 3 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".db") returned 0x0 [0086.698] lstrlenW (lpString=".ndf") returned 4 [0086.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".ndf") returned 0x0 [0086.699] lstrlenW (lpString=".NDF") returned 4 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".NDF") returned 0x0 [0086.699] lstrlenW (lpString=".Mdf") returned 4 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.699] lstrlenW (lpString=".dat") returned 4 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".dat") returned 0x0 [0086.699] lstrlenW (lpString=".DAT") returned 4 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".DAT") returned 0x0 [0086.699] lstrlenW (lpString=".ldf") returned 4 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.699] lstrlenW (lpString=".LDF") returned 4 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch=".LDF") returned 0x0 [0086.699] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.699] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.700] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.700] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.700] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20670127983) returned 1 [0086.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc27ce470, dwHighDateTime=0x1d585b4)) [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295428 [0086.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0086.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.701] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.701] GetLastError () returned 0x0 [0086.701] GetLastError () returned 0x0 [0086.701] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.701] GetLastError () returned 0x0 [0086.702] GetLastError () returned 0x0 [0086.816] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.816] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xca8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xca8, lpOverlapped=0x0) returned 1 [0086.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.816] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.816] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.816] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.816] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.817] CloseHandle (hObject=0xe4) returned 1 [0086.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.818] GetLastError () returned 0x0 [0086.818] RtlWakeConditionVariable () returned 0x0 [0086.819] GetCurrentThreadId () returned 0x98c [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".ldf") returned 0x0 [0086.819] lstrlenW (lpString=".vhd") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".vhd") returned 0x0 [0086.819] lstrlenW (lpString=".vhdx") returned 5 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".vhdx") returned 0x0 [0086.819] lstrlenW (lpString=".pst") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".pst") returned 0x0 [0086.819] lstrlenW (lpString=".ost") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".ost") returned 0x0 [0086.819] lstrlenW (lpString=".bak") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".bak") returned 0x0 [0086.819] lstrlenW (lpString=".bac") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".bac") returned 0x0 [0086.819] lstrlenW (lpString=".sys") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".sys") returned 0x0 [0086.819] lstrlenW (lpString=".v2i") returned 4 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".v2i") returned 0x0 [0086.819] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.926] lstrlenW (lpString=".sql") returned 4 [0086.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".sql") returned 0x0 [0086.926] lstrlenW (lpString=".mdf") returned 4 [0086.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".mdf") returned 0x0 [0086.926] lstrlenW (lpString=".txt") returned 4 [0086.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".txt") returned 0x0 [0086.927] lstrlenW (lpString=".dbf") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".dbf") returned 0x0 [0086.927] lstrlenW (lpString=".ckp") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".ckp") returned 0x0 [0086.927] lstrlenW (lpString=".dacpac") returned 7 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".dacpac") returned 0x0 [0086.927] lstrlenW (lpString=".db3") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".db3") returned 0x0 [0086.927] lstrlenW (lpString=".dtxs") returned 5 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".dtxs") returned 0x0 [0086.927] lstrlenW (lpString=".mdt") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".mdt") returned 0x0 [0086.927] lstrlenW (lpString=".sdf") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".sdf") returned 0x0 [0086.927] lstrlenW (lpString=".MDF") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".MDF") returned 0x0 [0086.927] lstrlenW (lpString=".DBF") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".DBF") returned 0x0 [0086.927] lstrlenW (lpString=".DB") returned 3 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".DB") returned 0x0 [0086.927] lstrlenW (lpString=".db") returned 3 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".db") returned 0x0 [0086.927] lstrlenW (lpString=".ndf") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".ndf") returned 0x0 [0086.927] lstrlenW (lpString=".NDF") returned 4 [0086.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".NDF") returned 0x0 [0086.928] lstrlenW (lpString=".Mdf") returned 4 [0086.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".Mdf") returned 0x0 [0086.928] lstrlenW (lpString=".dat") returned 4 [0086.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".dat") returned 0x0 [0086.928] lstrlenW (lpString=".DAT") returned 4 [0086.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".DAT") returned 0x0 [0086.928] lstrlenW (lpString=".ldf") returned 4 [0086.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".ldf") returned 0x0 [0086.928] lstrlenW (lpString=".LDF") returned 4 [0086.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch=".LDF") returned 0x0 [0086.928] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.928] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.929] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.929] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.929] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20693025774) returned 1 [0086.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2a09910, dwHighDateTime=0x1d585b4)) [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ce20 [0086.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ce20 | out: hHeap=0x260000) returned 1 [0086.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.930] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.930] GetLastError () returned 0x0 [0086.930] GetLastError () returned 0x0 [0086.930] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.931] GetLastError () returned 0x0 [0086.931] GetLastError () returned 0x0 [0086.932] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.933] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x161d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x161d, lpOverlapped=0x0) returned 1 [0086.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.933] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.933] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.933] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.933] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.933] CloseHandle (hObject=0xe4) returned 1 [0086.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.936] GetLastError () returned 0x0 [0086.936] RtlWakeConditionVariable () returned 0x0 [0086.936] GetCurrentThreadId () returned 0x98c [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".ldf") returned 0x0 [0086.936] lstrlenW (lpString=".vhd") returned 4 [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".vhd") returned 0x0 [0086.936] lstrlenW (lpString=".vhdx") returned 5 [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".vhdx") returned 0x0 [0086.936] lstrlenW (lpString=".pst") returned 4 [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".pst") returned 0x0 [0086.936] lstrlenW (lpString=".ost") returned 4 [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".ost") returned 0x0 [0086.936] lstrlenW (lpString=".bak") returned 4 [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".bak") returned 0x0 [0086.936] lstrlenW (lpString=".bac") returned 4 [0086.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".bac") returned 0x0 [0086.937] lstrlenW (lpString=".sys") returned 4 [0086.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".sys") returned 0x0 [0086.937] lstrlenW (lpString=".v2i") returned 4 [0086.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".v2i") returned 0x0 [0086.937] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.939] lstrlenW (lpString=".sql") returned 4 [0086.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".sql") returned 0x0 [0086.939] lstrlenW (lpString=".mdf") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".mdf") returned 0x0 [0086.940] lstrlenW (lpString=".txt") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".txt") returned 0x0 [0086.940] lstrlenW (lpString=".dbf") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".dbf") returned 0x0 [0086.940] lstrlenW (lpString=".ckp") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".ckp") returned 0x0 [0086.940] lstrlenW (lpString=".dacpac") returned 7 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".dacpac") returned 0x0 [0086.940] lstrlenW (lpString=".db3") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".db3") returned 0x0 [0086.940] lstrlenW (lpString=".dtxs") returned 5 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".dtxs") returned 0x0 [0086.940] lstrlenW (lpString=".mdt") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".mdt") returned 0x0 [0086.940] lstrlenW (lpString=".sdf") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".sdf") returned 0x0 [0086.940] lstrlenW (lpString=".MDF") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".MDF") returned 0x0 [0086.940] lstrlenW (lpString=".DBF") returned 4 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".DBF") returned 0x0 [0086.940] lstrlenW (lpString=".DB") returned 3 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".DB") returned 0x0 [0086.940] lstrlenW (lpString=".db") returned 3 [0086.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".db") returned 0x0 [0086.941] lstrlenW (lpString=".ndf") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".ndf") returned 0x0 [0086.941] lstrlenW (lpString=".NDF") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".NDF") returned 0x0 [0086.941] lstrlenW (lpString=".Mdf") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".Mdf") returned 0x0 [0086.941] lstrlenW (lpString=".dat") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".dat") returned 0x0 [0086.941] lstrlenW (lpString=".DAT") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".DAT") returned 0x0 [0086.941] lstrlenW (lpString=".ldf") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".ldf") returned 0x0 [0086.941] lstrlenW (lpString=".LDF") returned 4 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch=".LDF") returned 0x0 [0086.941] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.941] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0086.942] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.942] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.942] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20694338689) returned 1 [0086.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2a2fa70, dwHighDateTime=0x1d585b4)) [0086.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ce58 [0086.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ce58 | out: hHeap=0x260000) returned 1 [0086.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.943] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0086.943] GetLastError () returned 0x0 [0086.943] GetLastError () returned 0x0 [0086.944] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0086.944] GetLastError () returned 0x0 [0086.944] GetLastError () returned 0x0 [0086.946] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffaebf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.946] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5141, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x5141, lpOverlapped=0x0) returned 1 [0086.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.946] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.946] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.946] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.946] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.946] CloseHandle (hObject=0xe4) returned 1 [0086.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.949] GetLastError () returned 0x0 [0086.949] RtlWakeConditionVariable () returned 0x0 [0086.949] GetCurrentThreadId () returned 0x98c [0086.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".ldf") returned 0x0 [0086.949] lstrlenW (lpString=".vhd") returned 4 [0086.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".vhd") returned 0x0 [0086.949] lstrlenW (lpString=".vhdx") returned 5 [0086.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".vhdx") returned 0x0 [0086.949] lstrlenW (lpString=".pst") returned 4 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".pst") returned 0x0 [0086.950] lstrlenW (lpString=".ost") returned 4 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".ost") returned 0x0 [0086.950] lstrlenW (lpString=".bak") returned 4 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".bak") returned 0x0 [0086.950] lstrlenW (lpString=".bac") returned 4 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".bac") returned 0x0 [0086.950] lstrlenW (lpString=".sys") returned 4 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".sys") returned 0x0 [0086.950] lstrlenW (lpString=".v2i") returned 4 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".v2i") returned 0x0 [0086.950] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.952] lstrlenW (lpString=".sql") returned 4 [0086.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".sql") returned 0x0 [0086.952] lstrlenW (lpString=".mdf") returned 4 [0086.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".mdf") returned 0x0 [0086.952] lstrlenW (lpString=".txt") returned 4 [0086.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".txt") returned 0x0 [0086.953] lstrlenW (lpString=".dbf") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".dbf") returned 0x0 [0086.953] lstrlenW (lpString=".ckp") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".ckp") returned 0x0 [0086.953] lstrlenW (lpString=".dacpac") returned 7 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".dacpac") returned 0x0 [0086.953] lstrlenW (lpString=".db3") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".db3") returned 0x0 [0086.953] lstrlenW (lpString=".dtxs") returned 5 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".dtxs") returned 0x0 [0086.953] lstrlenW (lpString=".mdt") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".mdt") returned 0x0 [0086.953] lstrlenW (lpString=".sdf") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".sdf") returned 0x0 [0086.953] lstrlenW (lpString=".MDF") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".MDF") returned 0x0 [0086.953] lstrlenW (lpString=".DBF") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".DBF") returned 0x0 [0086.953] lstrlenW (lpString=".DB") returned 3 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".DB") returned 0x0 [0086.953] lstrlenW (lpString=".db") returned 3 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".db") returned 0x0 [0086.953] lstrlenW (lpString=".ndf") returned 4 [0086.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".ndf") returned 0x0 [0086.953] lstrlenW (lpString=".NDF") returned 4 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".NDF") returned 0x0 [0086.954] lstrlenW (lpString=".Mdf") returned 4 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".Mdf") returned 0x0 [0086.954] lstrlenW (lpString=".dat") returned 4 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".dat") returned 0x0 [0086.954] lstrlenW (lpString=".DAT") returned 4 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".DAT") returned 0x0 [0086.954] lstrlenW (lpString=".ldf") returned 4 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".ldf") returned 0x0 [0086.954] lstrlenW (lpString=".LDF") returned 4 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch=".LDF") returned 0x0 [0086.954] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.954] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.003] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.004] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.004] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20700483404) returned 1 [0087.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2ac7ff0, dwHighDateTime=0x1d585b4)) [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ce90 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ce90 | out: hHeap=0x260000) returned 1 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.004] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.005] GetLastError () returned 0x0 [0087.005] GetLastError () returned 0x0 [0087.005] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.005] GetLastError () returned 0x0 [0087.005] GetLastError () returned 0x0 [0087.007] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe6c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.007] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x193c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x193c, lpOverlapped=0x0) returned 1 [0087.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.007] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.007] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.007] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.007] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.007] CloseHandle (hObject=0xe4) returned 1 [0087.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0087.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0087.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.075] GetLastError () returned 0x0 [0087.075] RtlWakeConditionVariable () returned 0x27e828 [0087.075] GetCurrentThreadId () returned 0x98c [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".ldf") returned 0x0 [0087.076] lstrlenW (lpString=".vhd") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".vhd") returned 0x0 [0087.076] lstrlenW (lpString=".vhdx") returned 5 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".vhdx") returned 0x0 [0087.076] lstrlenW (lpString=".pst") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".pst") returned 0x0 [0087.076] lstrlenW (lpString=".ost") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".ost") returned 0x0 [0087.076] lstrlenW (lpString=".bak") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".bak") returned 0x0 [0087.076] lstrlenW (lpString=".bac") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".bac") returned 0x0 [0087.076] lstrlenW (lpString=".sys") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".sys") returned 0x0 [0087.076] lstrlenW (lpString=".v2i") returned 4 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".v2i") returned 0x0 [0087.076] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.079] lstrlenW (lpString=".sql") returned 4 [0087.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".sql") returned 0x0 [0087.079] lstrlenW (lpString=".mdf") returned 4 [0087.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".mdf") returned 0x0 [0087.079] lstrlenW (lpString=".txt") returned 4 [0087.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".txt") returned 0x0 [0087.080] lstrlenW (lpString=".dbf") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".dbf") returned 0x0 [0087.080] lstrlenW (lpString=".ckp") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".ckp") returned 0x0 [0087.080] lstrlenW (lpString=".dacpac") returned 7 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".dacpac") returned 0x0 [0087.080] lstrlenW (lpString=".db3") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".db3") returned 0x0 [0087.080] lstrlenW (lpString=".dtxs") returned 5 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".dtxs") returned 0x0 [0087.080] lstrlenW (lpString=".mdt") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".mdt") returned 0x0 [0087.080] lstrlenW (lpString=".sdf") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".sdf") returned 0x0 [0087.080] lstrlenW (lpString=".MDF") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".MDF") returned 0x0 [0087.080] lstrlenW (lpString=".DBF") returned 4 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".DBF") returned 0x0 [0087.080] lstrlenW (lpString=".DB") returned 3 [0087.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".DB") returned 0x0 [0087.080] lstrlenW (lpString=".db") returned 3 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".db") returned 0x0 [0087.081] lstrlenW (lpString=".ndf") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".ndf") returned 0x0 [0087.081] lstrlenW (lpString=".NDF") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".NDF") returned 0x0 [0087.081] lstrlenW (lpString=".Mdf") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".Mdf") returned 0x0 [0087.081] lstrlenW (lpString=".dat") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".dat") returned 0x0 [0087.081] lstrlenW (lpString=".DAT") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".DAT") returned 0x0 [0087.081] lstrlenW (lpString=".ldf") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".ldf") returned 0x0 [0087.081] lstrlenW (lpString=".LDF") returned 4 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch=".LDF") returned 0x0 [0087.081] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.081] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.082] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.082] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.083] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20708382877) returned 1 [0087.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2b866d0, dwHighDateTime=0x1d585b4)) [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0310 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0310 | out: hHeap=0x260000) returned 1 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.084] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.084] GetLastError () returned 0x0 [0087.084] GetLastError () returned 0x0 [0087.084] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.084] GetLastError () returned 0x0 [0087.084] GetLastError () returned 0x0 [0087.099] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc974, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.099] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x368c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x368c, lpOverlapped=0x0) returned 1 [0087.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.100] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.100] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.100] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.100] CloseHandle (hObject=0xf0) returned 1 [0087.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0087.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.102] GetLastError () returned 0x0 [0087.102] RtlWakeConditionVariable () returned 0x0 [0087.102] GetCurrentThreadId () returned 0x98c [0087.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".ldf") returned 0x0 [0087.103] lstrlenW (lpString=".vhd") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".vhd") returned 0x0 [0087.103] lstrlenW (lpString=".vhdx") returned 5 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".vhdx") returned 0x0 [0087.103] lstrlenW (lpString=".pst") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".pst") returned 0x0 [0087.103] lstrlenW (lpString=".ost") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".ost") returned 0x0 [0087.103] lstrlenW (lpString=".bak") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".bak") returned 0x0 [0087.103] lstrlenW (lpString=".bac") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".bac") returned 0x0 [0087.103] lstrlenW (lpString=".sys") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".sys") returned 0x0 [0087.103] lstrlenW (lpString=".v2i") returned 4 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".v2i") returned 0x0 [0087.103] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.105] lstrlenW (lpString=".sql") returned 4 [0087.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".sql") returned 0x0 [0087.105] lstrlenW (lpString=".mdf") returned 4 [0087.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".mdf") returned 0x0 [0087.105] lstrlenW (lpString=".txt") returned 4 [0087.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".txt") returned 0x0 [0087.105] lstrlenW (lpString=".dbf") returned 4 [0087.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".dbf") returned 0x0 [0087.105] lstrlenW (lpString=".ckp") returned 4 [0087.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".ckp") returned 0x0 [0087.105] lstrlenW (lpString=".dacpac") returned 7 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".dacpac") returned 0x0 [0087.106] lstrlenW (lpString=".db3") returned 4 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".db3") returned 0x0 [0087.106] lstrlenW (lpString=".dtxs") returned 5 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".dtxs") returned 0x0 [0087.106] lstrlenW (lpString=".mdt") returned 4 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".mdt") returned 0x0 [0087.106] lstrlenW (lpString=".sdf") returned 4 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".sdf") returned 0x0 [0087.106] lstrlenW (lpString=".MDF") returned 4 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".MDF") returned 0x0 [0087.106] lstrlenW (lpString=".DBF") returned 4 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".DBF") returned 0x0 [0087.106] lstrlenW (lpString=".DB") returned 3 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".DB") returned 0x0 [0087.106] lstrlenW (lpString=".db") returned 3 [0087.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".db") returned 0x0 [0087.106] lstrlenW (lpString=".ndf") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".ndf") returned 0x0 [0087.107] lstrlenW (lpString=".NDF") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".NDF") returned 0x0 [0087.107] lstrlenW (lpString=".Mdf") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".Mdf") returned 0x0 [0087.107] lstrlenW (lpString=".dat") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".dat") returned 0x0 [0087.107] lstrlenW (lpString=".DAT") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".DAT") returned 0x0 [0087.107] lstrlenW (lpString=".ldf") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".ldf") returned 0x0 [0087.107] lstrlenW (lpString=".LDF") returned 4 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch=".LDF") returned 0x0 [0087.107] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.107] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.108] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.108] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.109] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20710989202) returned 1 [0087.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2bac830, dwHighDateTime=0x1d585b4)) [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f02a0 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02a0 | out: hHeap=0x260000) returned 1 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.110] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.110] GetLastError () returned 0x0 [0087.110] GetLastError () returned 0x0 [0087.110] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.110] GetLastError () returned 0x0 [0087.111] GetLastError () returned 0x0 [0087.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.127] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3004, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x3004, lpOverlapped=0x0) returned 1 [0087.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.127] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.128] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.128] CloseHandle (hObject=0xf0) returned 1 [0087.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.130] GetLastError () returned 0x0 [0087.130] RtlWakeConditionVariable () returned 0x0 [0087.130] GetCurrentThreadId () returned 0x98c [0087.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.130] lstrlenW (lpString=".vhd") returned 4 [0087.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".vhd") returned 0x0 [0087.130] lstrlenW (lpString=".vhdx") returned 5 [0087.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".vhdx") returned 0x0 [0087.131] lstrlenW (lpString=".pst") returned 4 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".pst") returned 0x0 [0087.131] lstrlenW (lpString=".ost") returned 4 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".ost") returned 0x0 [0087.131] lstrlenW (lpString=".bak") returned 4 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".bak") returned 0x0 [0087.131] lstrlenW (lpString=".bac") returned 4 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".bac") returned 0x0 [0087.131] lstrlenW (lpString=".sys") returned 4 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".sys") returned 0x0 [0087.131] lstrlenW (lpString=".v2i") returned 4 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".v2i") returned 0x0 [0087.131] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.132] lstrlenW (lpString=".sql") returned 4 [0087.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".sql") returned 0x0 [0087.132] lstrlenW (lpString=".mdf") returned 4 [0087.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".mdf") returned 0x0 [0087.132] lstrlenW (lpString=".txt") returned 4 [0087.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".txt") returned 0x0 [0087.132] lstrlenW (lpString=".dbf") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".dbf") returned 0x0 [0087.133] lstrlenW (lpString=".ckp") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".ckp") returned 0x0 [0087.133] lstrlenW (lpString=".dacpac") returned 7 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".dacpac") returned 0x0 [0087.133] lstrlenW (lpString=".db3") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".db3") returned 0x0 [0087.133] lstrlenW (lpString=".dtxs") returned 5 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".dtxs") returned 0x0 [0087.133] lstrlenW (lpString=".mdt") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".mdt") returned 0x0 [0087.133] lstrlenW (lpString=".sdf") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".sdf") returned 0x0 [0087.133] lstrlenW (lpString=".MDF") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".MDF") returned 0x0 [0087.133] lstrlenW (lpString=".DBF") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".DBF") returned 0x0 [0087.133] lstrlenW (lpString=".DB") returned 3 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".DB") returned 0x0 [0087.133] lstrlenW (lpString=".db") returned 3 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".db") returned 0x0 [0087.133] lstrlenW (lpString=".ndf") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".ndf") returned 0x0 [0087.133] lstrlenW (lpString=".NDF") returned 4 [0087.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".NDF") returned 0x0 [0087.133] lstrlenW (lpString=".Mdf") returned 4 [0087.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".Mdf") returned 0x0 [0087.134] lstrlenW (lpString=".dat") returned 4 [0087.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".dat") returned 0x0 [0087.134] lstrlenW (lpString=".DAT") returned 4 [0087.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".DAT") returned 0x0 [0087.134] lstrlenW (lpString=".ldf") returned 4 [0087.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.134] lstrlenW (lpString=".LDF") returned 4 [0087.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch=".LDF") returned 0x0 [0087.134] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.134] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.135] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.135] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20713615715) returned 1 [0087.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2bf8af0, dwHighDateTime=0x1d585b4)) [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0498 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0498 | out: hHeap=0x260000) returned 1 [0087.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.136] GetLastError () returned 0x0 [0087.136] GetLastError () returned 0x0 [0087.136] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.136] GetLastError () returned 0x0 [0087.136] GetLastError () returned 0x0 [0087.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbc5d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.240] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x43a3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x43a3, lpOverlapped=0x0) returned 1 [0087.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.251] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.252] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.252] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.252] CloseHandle (hObject=0xf0) returned 1 [0087.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.254] GetLastError () returned 0x0 [0087.254] RtlWakeConditionVariable () returned 0x0 [0087.254] GetCurrentThreadId () returned 0x98c [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.254] lstrlenW (lpString=".vhd") returned 4 [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".vhd") returned 0x0 [0087.254] lstrlenW (lpString=".vhdx") returned 5 [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".vhdx") returned 0x0 [0087.254] lstrlenW (lpString=".pst") returned 4 [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".pst") returned 0x0 [0087.254] lstrlenW (lpString=".ost") returned 4 [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".ost") returned 0x0 [0087.254] lstrlenW (lpString=".bak") returned 4 [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".bak") returned 0x0 [0087.254] lstrlenW (lpString=".bac") returned 4 [0087.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".bac") returned 0x0 [0087.255] lstrlenW (lpString=".sys") returned 4 [0087.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".sys") returned 0x0 [0087.255] lstrlenW (lpString=".v2i") returned 4 [0087.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".v2i") returned 0x0 [0087.255] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.256] lstrlenW (lpString=".sql") returned 4 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".sql") returned 0x0 [0087.256] lstrlenW (lpString=".mdf") returned 4 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".mdf") returned 0x0 [0087.256] lstrlenW (lpString=".txt") returned 4 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".txt") returned 0x0 [0087.256] lstrlenW (lpString=".dbf") returned 4 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".dbf") returned 0x0 [0087.256] lstrlenW (lpString=".ckp") returned 4 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".ckp") returned 0x0 [0087.256] lstrlenW (lpString=".dacpac") returned 7 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".dacpac") returned 0x0 [0087.256] lstrlenW (lpString=".db3") returned 4 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".db3") returned 0x0 [0087.256] lstrlenW (lpString=".dtxs") returned 5 [0087.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".dtxs") returned 0x0 [0087.257] lstrlenW (lpString=".mdt") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".mdt") returned 0x0 [0087.257] lstrlenW (lpString=".sdf") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".sdf") returned 0x0 [0087.257] lstrlenW (lpString=".MDF") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".MDF") returned 0x0 [0087.257] lstrlenW (lpString=".DBF") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".DBF") returned 0x0 [0087.257] lstrlenW (lpString=".DB") returned 3 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".DB") returned 0x0 [0087.257] lstrlenW (lpString=".db") returned 3 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".db") returned 0x0 [0087.257] lstrlenW (lpString=".ndf") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".ndf") returned 0x0 [0087.257] lstrlenW (lpString=".NDF") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".NDF") returned 0x0 [0087.257] lstrlenW (lpString=".Mdf") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".Mdf") returned 0x0 [0087.257] lstrlenW (lpString=".dat") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".dat") returned 0x0 [0087.257] lstrlenW (lpString=".DAT") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".DAT") returned 0x0 [0087.257] lstrlenW (lpString=".ldf") returned 4 [0087.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.257] lstrlenW (lpString=".LDF") returned 4 [0087.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch=".LDF") returned 0x0 [0087.258] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.258] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.258] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.259] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.259] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20725986232) returned 1 [0087.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2d295f0, dwHighDateTime=0x1d585b4)) [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d210 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d210 | out: hHeap=0x260000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.259] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.260] GetLastError () returned 0x0 [0087.260] GetLastError () returned 0x0 [0087.260] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.260] GetLastError () returned 0x0 [0087.260] GetLastError () returned 0x0 [0087.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc4c1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.262] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3b3f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x3b3f, lpOverlapped=0x0) returned 1 [0087.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.262] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.262] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.262] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.262] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.262] CloseHandle (hObject=0xf0) returned 1 [0087.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.264] GetLastError () returned 0x0 [0087.264] RtlWakeConditionVariable () returned 0x0 [0087.264] GetCurrentThreadId () returned 0x98c [0087.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".ldf") returned 0x0 [0087.265] lstrlenW (lpString=".vhd") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".vhd") returned 0x0 [0087.265] lstrlenW (lpString=".vhdx") returned 5 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".vhdx") returned 0x0 [0087.265] lstrlenW (lpString=".pst") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".pst") returned 0x0 [0087.265] lstrlenW (lpString=".ost") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".ost") returned 0x0 [0087.265] lstrlenW (lpString=".bak") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".bak") returned 0x0 [0087.265] lstrlenW (lpString=".bac") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".bac") returned 0x0 [0087.265] lstrlenW (lpString=".sys") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".sys") returned 0x0 [0087.265] lstrlenW (lpString=".v2i") returned 4 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".v2i") returned 0x0 [0087.265] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.266] lstrlenW (lpString=".sql") returned 4 [0087.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".sql") returned 0x0 [0087.266] lstrlenW (lpString=".mdf") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".mdf") returned 0x0 [0087.267] lstrlenW (lpString=".txt") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".txt") returned 0x0 [0087.267] lstrlenW (lpString=".dbf") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".dbf") returned 0x0 [0087.267] lstrlenW (lpString=".ckp") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".ckp") returned 0x0 [0087.267] lstrlenW (lpString=".dacpac") returned 7 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".dacpac") returned 0x0 [0087.267] lstrlenW (lpString=".db3") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".db3") returned 0x0 [0087.267] lstrlenW (lpString=".dtxs") returned 5 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".dtxs") returned 0x0 [0087.267] lstrlenW (lpString=".mdt") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".mdt") returned 0x0 [0087.267] lstrlenW (lpString=".sdf") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".sdf") returned 0x0 [0087.267] lstrlenW (lpString=".MDF") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".MDF") returned 0x0 [0087.267] lstrlenW (lpString=".DBF") returned 4 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".DBF") returned 0x0 [0087.267] lstrlenW (lpString=".DB") returned 3 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".DB") returned 0x0 [0087.267] lstrlenW (lpString=".db") returned 3 [0087.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".db") returned 0x0 [0087.268] lstrlenW (lpString=".ndf") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".ndf") returned 0x0 [0087.268] lstrlenW (lpString=".NDF") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".NDF") returned 0x0 [0087.268] lstrlenW (lpString=".Mdf") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".Mdf") returned 0x0 [0087.268] lstrlenW (lpString=".dat") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".dat") returned 0x0 [0087.268] lstrlenW (lpString=".DAT") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".DAT") returned 0x0 [0087.268] lstrlenW (lpString=".ldf") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".ldf") returned 0x0 [0087.268] lstrlenW (lpString=".LDF") returned 4 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch=".LDF") returned 0x0 [0087.268] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.268] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.269] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.269] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.269] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20727036008) returned 1 [0087.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2d4f750, dwHighDateTime=0x1d585b4)) [0087.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d248 [0087.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d248 | out: hHeap=0x260000) returned 1 [0087.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.270] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.270] GetLastError () returned 0x0 [0087.270] GetLastError () returned 0x0 [0087.270] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.270] GetLastError () returned 0x0 [0087.271] GetLastError () returned 0x0 [0087.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbbc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.273] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x443a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x443a, lpOverlapped=0x0) returned 1 [0087.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.273] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.273] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.273] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.273] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.273] CloseHandle (hObject=0xf0) returned 1 [0087.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.275] GetLastError () returned 0x0 [0087.275] RtlWakeConditionVariable () returned 0x0 [0087.275] GetCurrentThreadId () returned 0x98c [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".ldf") returned 0x0 [0087.275] lstrlenW (lpString=".vhd") returned 4 [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".vhd") returned 0x0 [0087.275] lstrlenW (lpString=".vhdx") returned 5 [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".vhdx") returned 0x0 [0087.275] lstrlenW (lpString=".pst") returned 4 [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".pst") returned 0x0 [0087.275] lstrlenW (lpString=".ost") returned 4 [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".ost") returned 0x0 [0087.275] lstrlenW (lpString=".bak") returned 4 [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".bak") returned 0x0 [0087.275] lstrlenW (lpString=".bac") returned 4 [0087.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".bac") returned 0x0 [0087.276] lstrlenW (lpString=".sys") returned 4 [0087.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".sys") returned 0x0 [0087.276] lstrlenW (lpString=".v2i") returned 4 [0087.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".v2i") returned 0x0 [0087.276] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.277] lstrlenW (lpString=".sql") returned 4 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".sql") returned 0x0 [0087.277] lstrlenW (lpString=".mdf") returned 4 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".mdf") returned 0x0 [0087.277] lstrlenW (lpString=".txt") returned 4 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".txt") returned 0x0 [0087.277] lstrlenW (lpString=".dbf") returned 4 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".dbf") returned 0x0 [0087.277] lstrlenW (lpString=".ckp") returned 4 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".ckp") returned 0x0 [0087.277] lstrlenW (lpString=".dacpac") returned 7 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".dacpac") returned 0x0 [0087.277] lstrlenW (lpString=".db3") returned 4 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".db3") returned 0x0 [0087.277] lstrlenW (lpString=".dtxs") returned 5 [0087.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".dtxs") returned 0x0 [0087.278] lstrlenW (lpString=".mdt") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".mdt") returned 0x0 [0087.278] lstrlenW (lpString=".sdf") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".sdf") returned 0x0 [0087.278] lstrlenW (lpString=".MDF") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".MDF") returned 0x0 [0087.278] lstrlenW (lpString=".DBF") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".DBF") returned 0x0 [0087.278] lstrlenW (lpString=".DB") returned 3 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".DB") returned 0x0 [0087.278] lstrlenW (lpString=".db") returned 3 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".db") returned 0x0 [0087.278] lstrlenW (lpString=".ndf") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".ndf") returned 0x0 [0087.278] lstrlenW (lpString=".NDF") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".NDF") returned 0x0 [0087.278] lstrlenW (lpString=".Mdf") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".Mdf") returned 0x0 [0087.278] lstrlenW (lpString=".dat") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".dat") returned 0x0 [0087.278] lstrlenW (lpString=".DAT") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".DAT") returned 0x0 [0087.278] lstrlenW (lpString=".ldf") returned 4 [0087.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".ldf") returned 0x0 [0087.278] lstrlenW (lpString=".LDF") returned 4 [0087.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch=".LDF") returned 0x0 [0087.279] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.279] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.279] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.280] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.280] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20728085134) returned 1 [0087.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2d4f750, dwHighDateTime=0x1d585b4)) [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d280 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d280 | out: hHeap=0x260000) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.280] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.281] GetLastError () returned 0x0 [0087.281] GetLastError () returned 0x0 [0087.281] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.281] GetLastError () returned 0x0 [0087.281] GetLastError () returned 0x0 [0087.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffed0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.283] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x12f5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x12f5, lpOverlapped=0x0) returned 1 [0087.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.283] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.286] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.286] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.286] CloseHandle (hObject=0xf0) returned 1 [0087.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.288] GetLastError () returned 0x0 [0087.288] RtlWakeConditionVariable () returned 0x0 [0087.288] GetCurrentThreadId () returned 0x98c [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".ldf") returned 0x0 [0087.288] lstrlenW (lpString=".vhd") returned 4 [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".vhd") returned 0x0 [0087.288] lstrlenW (lpString=".vhdx") returned 5 [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".vhdx") returned 0x0 [0087.288] lstrlenW (lpString=".pst") returned 4 [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".pst") returned 0x0 [0087.288] lstrlenW (lpString=".ost") returned 4 [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".ost") returned 0x0 [0087.288] lstrlenW (lpString=".bak") returned 4 [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".bak") returned 0x0 [0087.288] lstrlenW (lpString=".bac") returned 4 [0087.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".bac") returned 0x0 [0087.288] lstrlenW (lpString=".sys") returned 4 [0087.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".sys") returned 0x0 [0087.289] lstrlenW (lpString=".v2i") returned 4 [0087.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".v2i") returned 0x0 [0087.289] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.290] lstrlenW (lpString=".sql") returned 4 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".sql") returned 0x0 [0087.290] lstrlenW (lpString=".mdf") returned 4 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".mdf") returned 0x0 [0087.290] lstrlenW (lpString=".txt") returned 4 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".txt") returned 0x0 [0087.290] lstrlenW (lpString=".dbf") returned 4 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".dbf") returned 0x0 [0087.290] lstrlenW (lpString=".ckp") returned 4 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".ckp") returned 0x0 [0087.290] lstrlenW (lpString=".dacpac") returned 7 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".dacpac") returned 0x0 [0087.290] lstrlenW (lpString=".db3") returned 4 [0087.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".db3") returned 0x0 [0087.291] lstrlenW (lpString=".dtxs") returned 5 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".dtxs") returned 0x0 [0087.291] lstrlenW (lpString=".mdt") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".mdt") returned 0x0 [0087.291] lstrlenW (lpString=".sdf") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".sdf") returned 0x0 [0087.291] lstrlenW (lpString=".MDF") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".MDF") returned 0x0 [0087.291] lstrlenW (lpString=".DBF") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".DBF") returned 0x0 [0087.291] lstrlenW (lpString=".DB") returned 3 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".DB") returned 0x0 [0087.291] lstrlenW (lpString=".db") returned 3 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".db") returned 0x0 [0087.291] lstrlenW (lpString=".ndf") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".ndf") returned 0x0 [0087.291] lstrlenW (lpString=".NDF") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".NDF") returned 0x0 [0087.291] lstrlenW (lpString=".Mdf") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".Mdf") returned 0x0 [0087.291] lstrlenW (lpString=".dat") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".dat") returned 0x0 [0087.291] lstrlenW (lpString=".DAT") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".DAT") returned 0x0 [0087.291] lstrlenW (lpString=".ldf") returned 4 [0087.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".ldf") returned 0x0 [0087.292] lstrlenW (lpString=".LDF") returned 4 [0087.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch=".LDF") returned 0x0 [0087.292] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.292] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.293] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.293] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.293] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20729390427) returned 1 [0087.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc2d758b0, dwHighDateTime=0x1d585b4)) [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d2b8 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d2b8 | out: hHeap=0x260000) returned 1 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.293] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.294] GetLastError () returned 0x0 [0087.294] GetLastError () returned 0x0 [0087.294] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.294] GetLastError () returned 0x0 [0087.294] GetLastError () returned 0x0 [0087.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbc38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.403] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x43c8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x43c8, lpOverlapped=0x0) returned 1 [0087.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.404] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.404] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.404] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.404] CloseHandle (hObject=0xf0) returned 1 [0087.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.405] GetLastError () returned 0x0 [0087.406] RtlWakeConditionVariable () returned 0x0 [0087.406] GetCurrentThreadId () returned 0x98c [0087.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0087.406] lstrlenW (lpString=".vhd") returned 4 [0087.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".vhd") returned 0x0 [0087.406] lstrlenW (lpString=".vhdx") returned 5 [0087.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".vhdx") returned 0x0 [0087.406] lstrlenW (lpString=".pst") returned 4 [0087.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".pst") returned 0x0 [0087.406] lstrlenW (lpString=".ost") returned 4 [0087.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".ost") returned 0x0 [0087.406] lstrlenW (lpString=".bak") returned 4 [0087.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".bak") returned 0x0 [0087.407] lstrlenW (lpString=".bac") returned 4 [0087.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".bac") returned 0x0 [0087.407] lstrlenW (lpString=".sys") returned 4 [0087.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".sys") returned 0x0 [0087.407] lstrlenW (lpString=".v2i") returned 4 [0087.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".v2i") returned 0x0 [0087.407] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.649] lstrlenW (lpString=".sql") returned 4 [0087.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".sql") returned 0x0 [0087.649] lstrlenW (lpString=".mdf") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".mdf") returned 0x0 [0087.650] lstrlenW (lpString=".txt") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".txt") returned 0x0 [0087.650] lstrlenW (lpString=".dbf") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".dbf") returned 0x0 [0087.650] lstrlenW (lpString=".ckp") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".ckp") returned 0x0 [0087.650] lstrlenW (lpString=".dacpac") returned 7 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".dacpac") returned 0x0 [0087.650] lstrlenW (lpString=".db3") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".db3") returned 0x0 [0087.650] lstrlenW (lpString=".dtxs") returned 5 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".dtxs") returned 0x0 [0087.650] lstrlenW (lpString=".mdt") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".mdt") returned 0x0 [0087.650] lstrlenW (lpString=".sdf") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".sdf") returned 0x0 [0087.650] lstrlenW (lpString=".MDF") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".MDF") returned 0x0 [0087.650] lstrlenW (lpString=".DBF") returned 4 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".DBF") returned 0x0 [0087.650] lstrlenW (lpString=".DB") returned 3 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".DB") returned 0x0 [0087.650] lstrlenW (lpString=".db") returned 3 [0087.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".db") returned 0x0 [0087.650] lstrlenW (lpString=".ndf") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".ndf") returned 0x0 [0087.651] lstrlenW (lpString=".NDF") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".NDF") returned 0x0 [0087.651] lstrlenW (lpString=".Mdf") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".Mdf") returned 0x0 [0087.651] lstrlenW (lpString=".dat") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".dat") returned 0x0 [0087.651] lstrlenW (lpString=".DAT") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".DAT") returned 0x0 [0087.651] lstrlenW (lpString=".ldf") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0087.651] lstrlenW (lpString=".LDF") returned 4 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch=".LDF") returned 0x0 [0087.651] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.651] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.652] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.652] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.652] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20765332638) returned 1 [0087.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc30e1850, dwHighDateTime=0x1d585b4)) [0087.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d6a8 [0087.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d6a8 | out: hHeap=0x260000) returned 1 [0087.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0087.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.653] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.653] GetLastError () returned 0x0 [0087.653] GetLastError () returned 0x0 [0087.653] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.653] GetLastError () returned 0x0 [0087.654] GetLastError () returned 0x0 [0087.656] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff859, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.656] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x7a7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x7a7, lpOverlapped=0x0) returned 1 [0087.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.657] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.657] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.657] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.657] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.657] CloseHandle (hObject=0xf0) returned 1 [0087.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.[deadmin@cock.li].deadmin")) returned 1 [0087.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.658] GetLastError () returned 0x0 [0087.659] RtlWakeConditionVariable () returned 0x0 [0087.659] GetCurrentThreadId () returned 0x98c [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0087.659] lstrlenW (lpString=".vhd") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".vhd") returned 0x0 [0087.659] lstrlenW (lpString=".vhdx") returned 5 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".vhdx") returned 0x0 [0087.659] lstrlenW (lpString=".pst") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".pst") returned 0x0 [0087.659] lstrlenW (lpString=".ost") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".ost") returned 0x0 [0087.659] lstrlenW (lpString=".bak") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".bak") returned 0x0 [0087.659] lstrlenW (lpString=".bac") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".bac") returned 0x0 [0087.659] lstrlenW (lpString=".sys") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".sys") returned 0x0 [0087.659] lstrlenW (lpString=".v2i") returned 4 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".v2i") returned 0x0 [0087.659] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.660] lstrlenW (lpString=".sql") returned 4 [0087.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".sql") returned 0x0 [0087.661] lstrlenW (lpString=".mdf") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".mdf") returned 0x0 [0087.661] lstrlenW (lpString=".txt") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".txt") returned 0x0 [0087.661] lstrlenW (lpString=".dbf") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".dbf") returned 0x0 [0087.661] lstrlenW (lpString=".ckp") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".ckp") returned 0x0 [0087.661] lstrlenW (lpString=".dacpac") returned 7 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".dacpac") returned 0x0 [0087.661] lstrlenW (lpString=".db3") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".db3") returned 0x0 [0087.661] lstrlenW (lpString=".dtxs") returned 5 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".dtxs") returned 0x0 [0087.661] lstrlenW (lpString=".mdt") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".mdt") returned 0x0 [0087.661] lstrlenW (lpString=".sdf") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".sdf") returned 0x0 [0087.661] lstrlenW (lpString=".MDF") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".MDF") returned 0x0 [0087.661] lstrlenW (lpString=".DBF") returned 4 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".DBF") returned 0x0 [0087.661] lstrlenW (lpString=".DB") returned 3 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".DB") returned 0x0 [0087.661] lstrlenW (lpString=".db") returned 3 [0087.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".db") returned 0x0 [0087.662] lstrlenW (lpString=".ndf") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".ndf") returned 0x0 [0087.662] lstrlenW (lpString=".NDF") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".NDF") returned 0x0 [0087.662] lstrlenW (lpString=".Mdf") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".Mdf") returned 0x0 [0087.662] lstrlenW (lpString=".dat") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".dat") returned 0x0 [0087.662] lstrlenW (lpString=".DAT") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".DAT") returned 0x0 [0087.662] lstrlenW (lpString=".ldf") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0087.662] lstrlenW (lpString=".LDF") returned 4 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch=".LDF") returned 0x0 [0087.662] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.662] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.663] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.663] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.663] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20766433983) returned 1 [0087.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc31079b0, dwHighDateTime=0x1d585b4)) [0087.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d6e0 [0087.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d6e0 | out: hHeap=0x260000) returned 1 [0087.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0087.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.664] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.664] GetLastError () returned 0x0 [0087.664] GetLastError () returned 0x0 [0087.664] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.664] GetLastError () returned 0x0 [0087.665] GetLastError () returned 0x0 [0087.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeb67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.666] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1499, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1499, lpOverlapped=0x0) returned 1 [0087.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.666] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.667] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.667] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.667] CloseHandle (hObject=0xf0) returned 1 [0087.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.668] GetLastError () returned 0x0 [0087.668] RtlWakeConditionVariable () returned 0x0 [0087.669] GetCurrentThreadId () returned 0x98c [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0087.669] lstrlenW (lpString=".vhd") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0087.669] lstrlenW (lpString=".vhdx") returned 5 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0087.669] lstrlenW (lpString=".pst") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".pst") returned 0x0 [0087.669] lstrlenW (lpString=".ost") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ost") returned 0x0 [0087.669] lstrlenW (lpString=".bak") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bak") returned 0x0 [0087.669] lstrlenW (lpString=".bac") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bac") returned 0x0 [0087.669] lstrlenW (lpString=".sys") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sys") returned 0x0 [0087.669] lstrlenW (lpString=".v2i") returned 4 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0087.669] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0087.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.671] lstrlenW (lpString=".sql") returned 4 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sql") returned 0x0 [0087.671] lstrlenW (lpString=".mdf") returned 4 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0087.671] lstrlenW (lpString=".txt") returned 4 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".txt") returned 0x0 [0087.671] lstrlenW (lpString=".dbf") returned 4 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0087.671] lstrlenW (lpString=".ckp") returned 4 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0087.671] lstrlenW (lpString=".dacpac") returned 7 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0087.671] lstrlenW (lpString=".db3") returned 4 [0087.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db3") returned 0x0 [0087.671] lstrlenW (lpString=".dtxs") returned 5 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0087.672] lstrlenW (lpString=".mdt") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0087.672] lstrlenW (lpString=".sdf") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0087.672] lstrlenW (lpString=".MDF") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0087.672] lstrlenW (lpString=".DBF") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0087.672] lstrlenW (lpString=".DB") returned 3 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DB") returned 0x0 [0087.672] lstrlenW (lpString=".db") returned 3 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db") returned 0x0 [0087.672] lstrlenW (lpString=".ndf") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0087.672] lstrlenW (lpString=".NDF") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0087.672] lstrlenW (lpString=".Mdf") returned 4 [0087.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0087.672] lstrlenW (lpString=".dat") returned 4 [0087.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dat") returned 0x0 [0087.673] lstrlenW (lpString=".DAT") returned 4 [0087.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0087.673] lstrlenW (lpString=".ldf") returned 4 [0087.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0087.673] lstrlenW (lpString=".LDF") returned 4 [0087.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0087.673] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.673] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.674] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.674] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20767507373) returned 1 [0087.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc312db10, dwHighDateTime=0x1d585b4)) [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d718 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d718 | out: hHeap=0x260000) returned 1 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0087.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.675] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.675] GetLastError () returned 0x0 [0087.675] GetLastError () returned 0x0 [0087.675] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.675] GetLastError () returned 0x0 [0087.675] GetLastError () returned 0x0 [0087.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.677] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x638, lpOverlapped=0x0) returned 1 [0087.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.677] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.677] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.678] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.678] CloseHandle (hObject=0xf0) returned 1 [0087.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0087.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0087.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.679] GetLastError () returned 0x0 [0087.679] RtlWakeConditionVariable () returned 0x0 [0087.679] GetCurrentThreadId () returned 0x98c [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".ldf") returned 0x0 [0087.680] lstrlenW (lpString=".vhd") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".vhd") returned 0x0 [0087.680] lstrlenW (lpString=".vhdx") returned 5 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".vhdx") returned 0x0 [0087.680] lstrlenW (lpString=".pst") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".pst") returned 0x0 [0087.680] lstrlenW (lpString=".ost") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".ost") returned 0x0 [0087.680] lstrlenW (lpString=".bak") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".bak") returned 0x0 [0087.680] lstrlenW (lpString=".bac") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".bac") returned 0x0 [0087.680] lstrlenW (lpString=".sys") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".sys") returned 0x0 [0087.680] lstrlenW (lpString=".v2i") returned 4 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".v2i") returned 0x0 [0087.680] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.699] lstrlenW (lpString=".sql") returned 4 [0087.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".sql") returned 0x0 [0087.699] lstrlenW (lpString=".mdf") returned 4 [0087.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".mdf") returned 0x0 [0087.699] lstrlenW (lpString=".txt") returned 4 [0087.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".txt") returned 0x0 [0087.699] lstrlenW (lpString=".dbf") returned 4 [0087.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".dbf") returned 0x0 [0087.700] lstrlenW (lpString=".ckp") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".ckp") returned 0x0 [0087.700] lstrlenW (lpString=".dacpac") returned 7 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".dacpac") returned 0x0 [0087.700] lstrlenW (lpString=".db3") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".db3") returned 0x0 [0087.700] lstrlenW (lpString=".dtxs") returned 5 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".dtxs") returned 0x0 [0087.700] lstrlenW (lpString=".mdt") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".mdt") returned 0x0 [0087.700] lstrlenW (lpString=".sdf") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".sdf") returned 0x0 [0087.700] lstrlenW (lpString=".MDF") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".MDF") returned 0x0 [0087.700] lstrlenW (lpString=".DBF") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".DBF") returned 0x0 [0087.700] lstrlenW (lpString=".DB") returned 3 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".DB") returned 0x0 [0087.700] lstrlenW (lpString=".db") returned 3 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".db") returned 0x0 [0087.700] lstrlenW (lpString=".ndf") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".ndf") returned 0x0 [0087.700] lstrlenW (lpString=".NDF") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".NDF") returned 0x0 [0087.700] lstrlenW (lpString=".Mdf") returned 4 [0087.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".Mdf") returned 0x0 [0087.701] lstrlenW (lpString=".dat") returned 4 [0087.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".dat") returned 0x0 [0087.701] lstrlenW (lpString=".DAT") returned 4 [0087.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".DAT") returned 0x0 [0087.701] lstrlenW (lpString=".ldf") returned 4 [0087.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".ldf") returned 0x0 [0087.701] lstrlenW (lpString=".LDF") returned 4 [0087.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch=".LDF") returned 0x0 [0087.701] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.701] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.702] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.702] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.702] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20770316470) returned 1 [0087.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3153c70, dwHighDateTime=0x1d585b4)) [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d7c0 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d7c0 | out: hHeap=0x260000) returned 1 [0087.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.703] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.703] GetLastError () returned 0x0 [0087.703] GetLastError () returned 0x0 [0087.703] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.703] GetLastError () returned 0x0 [0087.704] GetLastError () returned 0x0 [0087.705] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe405, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.705] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1bfb, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1bfb, lpOverlapped=0x0) returned 1 [0087.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.706] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.706] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.706] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.706] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.706] CloseHandle (hObject=0xe4) returned 1 [0087.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.708] GetLastError () returned 0x0 [0087.708] RtlWakeConditionVariable () returned 0x0 [0087.708] GetCurrentThreadId () returned 0x98c [0087.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".ldf") returned 0x0 [0087.708] lstrlenW (lpString=".vhd") returned 4 [0087.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".vhd") returned 0x0 [0087.708] lstrlenW (lpString=".vhdx") returned 5 [0087.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".vhdx") returned 0x0 [0087.708] lstrlenW (lpString=".pst") returned 4 [0087.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".pst") returned 0x0 [0087.708] lstrlenW (lpString=".ost") returned 4 [0087.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".ost") returned 0x0 [0087.709] lstrlenW (lpString=".bak") returned 4 [0087.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".bak") returned 0x0 [0087.709] lstrlenW (lpString=".bac") returned 4 [0087.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".bac") returned 0x0 [0087.709] lstrlenW (lpString=".sys") returned 4 [0087.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".sys") returned 0x0 [0087.709] lstrlenW (lpString=".v2i") returned 4 [0087.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".v2i") returned 0x0 [0087.709] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch="s\r\n.v2i") returned 0x0 [0087.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.710] lstrlenW (lpString=".sql") returned 4 [0087.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".sql") returned 0x0 [0087.710] lstrlenW (lpString=".mdf") returned 4 [0087.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".mdf") returned 0x0 [0087.710] lstrlenW (lpString=".txt") returned 4 [0087.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".txt") returned 0x0 [0087.710] lstrlenW (lpString=".dbf") returned 4 [0087.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".dbf") returned 0x0 [0087.710] lstrlenW (lpString=".ckp") returned 4 [0087.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".ckp") returned 0x0 [0087.710] lstrlenW (lpString=".dacpac") returned 7 [0087.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".dacpac") returned 0x0 [0087.710] lstrlenW (lpString=".db3") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".db3") returned 0x0 [0087.711] lstrlenW (lpString=".dtxs") returned 5 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".dtxs") returned 0x0 [0087.711] lstrlenW (lpString=".mdt") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".mdt") returned 0x0 [0087.711] lstrlenW (lpString=".sdf") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".sdf") returned 0x0 [0087.711] lstrlenW (lpString=".MDF") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".MDF") returned 0x0 [0087.711] lstrlenW (lpString=".DBF") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".DBF") returned 0x0 [0087.711] lstrlenW (lpString=".DB") returned 3 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".DB") returned 0x0 [0087.711] lstrlenW (lpString=".db") returned 3 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".db") returned 0x0 [0087.711] lstrlenW (lpString=".ndf") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".ndf") returned 0x0 [0087.711] lstrlenW (lpString=".NDF") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".NDF") returned 0x0 [0087.711] lstrlenW (lpString=".Mdf") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".Mdf") returned 0x0 [0087.711] lstrlenW (lpString=".dat") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".dat") returned 0x0 [0087.711] lstrlenW (lpString=".DAT") returned 4 [0087.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".DAT") returned 0x0 [0087.711] lstrlenW (lpString=".ldf") returned 4 [0087.712] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".ldf") returned 0x0 [0087.712] lstrlenW (lpString=".LDF") returned 4 [0087.712] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch=".LDF") returned 0x0 [0087.712] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.712] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.712] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.713] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.713] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.713] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20771392358) returned 1 [0087.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3179dd0, dwHighDateTime=0x1d585b4)) [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d7f8 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d7f8 | out: hHeap=0x260000) returned 1 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.713] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.714] GetLastError () returned 0x0 [0087.714] GetLastError () returned 0x0 [0087.714] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.714] GetLastError () returned 0x0 [0087.714] GetLastError () returned 0x0 [0087.716] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff35a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.716] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xca6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xca6, lpOverlapped=0x0) returned 1 [0087.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.716] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.716] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.716] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.716] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.716] CloseHandle (hObject=0xe4) returned 1 [0087.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.717] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js.[deadmin@cock.li].deadmin")) returned 1 [0087.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.719] GetLastError () returned 0x0 [0087.719] RtlWakeConditionVariable () returned 0x27e828 [0087.719] GetCurrentThreadId () returned 0x98c [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".ldf") returned 0x0 [0087.727] lstrlenW (lpString=".vhd") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".vhd") returned 0x0 [0087.727] lstrlenW (lpString=".vhdx") returned 5 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".vhdx") returned 0x0 [0087.727] lstrlenW (lpString=".pst") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".pst") returned 0x0 [0087.727] lstrlenW (lpString=".ost") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".ost") returned 0x0 [0087.727] lstrlenW (lpString=".bak") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".bak") returned 0x0 [0087.727] lstrlenW (lpString=".bac") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".bac") returned 0x0 [0087.727] lstrlenW (lpString=".sys") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".sys") returned 0x0 [0087.727] lstrlenW (lpString=".v2i") returned 4 [0087.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".v2i") returned 0x0 [0087.727] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.729] lstrlenW (lpString=".sql") returned 4 [0087.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".sql") returned 0x0 [0087.729] lstrlenW (lpString=".mdf") returned 4 [0087.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".mdf") returned 0x0 [0087.729] lstrlenW (lpString=".txt") returned 4 [0087.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".txt") returned 0x0 [0087.729] lstrlenW (lpString=".dbf") returned 4 [0087.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".dbf") returned 0x0 [0087.729] lstrlenW (lpString=".ckp") returned 4 [0087.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".ckp") returned 0x0 [0087.730] lstrlenW (lpString=".dacpac") returned 7 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".dacpac") returned 0x0 [0087.730] lstrlenW (lpString=".db3") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".db3") returned 0x0 [0087.730] lstrlenW (lpString=".dtxs") returned 5 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".dtxs") returned 0x0 [0087.730] lstrlenW (lpString=".mdt") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".mdt") returned 0x0 [0087.730] lstrlenW (lpString=".sdf") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".sdf") returned 0x0 [0087.730] lstrlenW (lpString=".MDF") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".MDF") returned 0x0 [0087.730] lstrlenW (lpString=".DBF") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".DBF") returned 0x0 [0087.730] lstrlenW (lpString=".DB") returned 3 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".DB") returned 0x0 [0087.730] lstrlenW (lpString=".db") returned 3 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".db") returned 0x0 [0087.730] lstrlenW (lpString=".ndf") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".ndf") returned 0x0 [0087.730] lstrlenW (lpString=".NDF") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".NDF") returned 0x0 [0087.730] lstrlenW (lpString=".Mdf") returned 4 [0087.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".Mdf") returned 0x0 [0087.730] lstrlenW (lpString=".dat") returned 4 [0087.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".dat") returned 0x0 [0087.731] lstrlenW (lpString=".DAT") returned 4 [0087.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".DAT") returned 0x0 [0087.731] lstrlenW (lpString=".ldf") returned 4 [0087.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".ldf") returned 0x0 [0087.731] lstrlenW (lpString=".LDF") returned 4 [0087.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch=".LDF") returned 0x0 [0087.731] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.731] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.732] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.732] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.732] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20773306541) returned 1 [0087.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc319ff30, dwHighDateTime=0x1d585b4)) [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d830 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d830 | out: hHeap=0x260000) returned 1 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.733] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.733] GetLastError () returned 0x0 [0087.733] GetLastError () returned 0x0 [0087.733] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.733] GetLastError () returned 0x0 [0087.733] GetLastError () returned 0x0 [0087.735] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.735] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x33a, lpOverlapped=0x0) returned 1 [0087.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.735] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.735] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.735] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.735] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.735] CloseHandle (hObject=0xe4) returned 1 [0087.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.737] GetLastError () returned 0x0 [0087.737] RtlWakeConditionVariable () returned 0x27e828 [0087.737] GetCurrentThreadId () returned 0x98c [0087.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".ldf") returned 0x0 [0087.737] lstrlenW (lpString=".vhd") returned 4 [0087.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".vhd") returned 0x0 [0087.737] lstrlenW (lpString=".vhdx") returned 5 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".vhdx") returned 0x0 [0087.738] lstrlenW (lpString=".pst") returned 4 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".pst") returned 0x0 [0087.738] lstrlenW (lpString=".ost") returned 4 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".ost") returned 0x0 [0087.738] lstrlenW (lpString=".bak") returned 4 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".bak") returned 0x0 [0087.738] lstrlenW (lpString=".bac") returned 4 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".bac") returned 0x0 [0087.738] lstrlenW (lpString=".sys") returned 4 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".sys") returned 0x0 [0087.738] lstrlenW (lpString=".v2i") returned 4 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".v2i") returned 0x0 [0087.738] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0087.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.739] lstrlenW (lpString=".sql") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".sql") returned 0x0 [0087.740] lstrlenW (lpString=".mdf") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".mdf") returned 0x0 [0087.740] lstrlenW (lpString=".txt") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".txt") returned 0x0 [0087.740] lstrlenW (lpString=".dbf") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".dbf") returned 0x0 [0087.740] lstrlenW (lpString=".ckp") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".ckp") returned 0x0 [0087.740] lstrlenW (lpString=".dacpac") returned 7 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".dacpac") returned 0x0 [0087.740] lstrlenW (lpString=".db3") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".db3") returned 0x0 [0087.740] lstrlenW (lpString=".dtxs") returned 5 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".dtxs") returned 0x0 [0087.740] lstrlenW (lpString=".mdt") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".mdt") returned 0x0 [0087.740] lstrlenW (lpString=".sdf") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".sdf") returned 0x0 [0087.740] lstrlenW (lpString=".MDF") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".MDF") returned 0x0 [0087.740] lstrlenW (lpString=".DBF") returned 4 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".DBF") returned 0x0 [0087.740] lstrlenW (lpString=".DB") returned 3 [0087.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".DB") returned 0x0 [0087.741] lstrlenW (lpString=".db") returned 3 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".db") returned 0x0 [0087.741] lstrlenW (lpString=".ndf") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".ndf") returned 0x0 [0087.741] lstrlenW (lpString=".NDF") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".NDF") returned 0x0 [0087.741] lstrlenW (lpString=".Mdf") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".Mdf") returned 0x0 [0087.741] lstrlenW (lpString=".dat") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".dat") returned 0x0 [0087.741] lstrlenW (lpString=".DAT") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".DAT") returned 0x0 [0087.741] lstrlenW (lpString=".ldf") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".ldf") returned 0x0 [0087.741] lstrlenW (lpString=".LDF") returned 4 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch=".LDF") returned 0x0 [0087.741] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.741] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.742] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.742] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20774342854) returned 1 [0087.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc31c6090, dwHighDateTime=0x1d585b4)) [0087.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d868 [0087.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d868 | out: hHeap=0x260000) returned 1 [0087.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.743] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.743] GetLastError () returned 0x0 [0087.743] GetLastError () returned 0x0 [0087.743] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.744] GetLastError () returned 0x0 [0087.744] GetLastError () returned 0x0 [0087.811] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffb51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.811] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4af, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x4af, lpOverlapped=0x0) returned 1 [0087.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.833] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.833] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.834] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.834] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.834] CloseHandle (hObject=0xe4) returned 1 [0087.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.834] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.835] GetLastError () returned 0x0 [0087.835] RtlWakeConditionVariable () returned 0x0 [0087.835] GetCurrentThreadId () returned 0x98c [0087.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".ldf") returned 0x0 [0087.836] lstrlenW (lpString=".vhd") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".vhd") returned 0x0 [0087.836] lstrlenW (lpString=".vhdx") returned 5 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".vhdx") returned 0x0 [0087.836] lstrlenW (lpString=".pst") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".pst") returned 0x0 [0087.836] lstrlenW (lpString=".ost") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".ost") returned 0x0 [0087.836] lstrlenW (lpString=".bak") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".bak") returned 0x0 [0087.836] lstrlenW (lpString=".bac") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".bac") returned 0x0 [0087.836] lstrlenW (lpString=".sys") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".sys") returned 0x0 [0087.836] lstrlenW (lpString=".v2i") returned 4 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".v2i") returned 0x0 [0087.836] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0087.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.837] lstrlenW (lpString=".sql") returned 4 [0087.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".sql") returned 0x0 [0087.837] lstrlenW (lpString=".mdf") returned 4 [0087.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".mdf") returned 0x0 [0087.837] lstrlenW (lpString=".txt") returned 4 [0087.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".txt") returned 0x0 [0087.837] lstrlenW (lpString=".dbf") returned 4 [0087.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".dbf") returned 0x0 [0087.837] lstrlenW (lpString=".ckp") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".ckp") returned 0x0 [0087.838] lstrlenW (lpString=".dacpac") returned 7 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".dacpac") returned 0x0 [0087.838] lstrlenW (lpString=".db3") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".db3") returned 0x0 [0087.838] lstrlenW (lpString=".dtxs") returned 5 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".dtxs") returned 0x0 [0087.838] lstrlenW (lpString=".mdt") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".mdt") returned 0x0 [0087.838] lstrlenW (lpString=".sdf") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".sdf") returned 0x0 [0087.838] lstrlenW (lpString=".MDF") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".MDF") returned 0x0 [0087.838] lstrlenW (lpString=".DBF") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".DBF") returned 0x0 [0087.838] lstrlenW (lpString=".DB") returned 3 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".DB") returned 0x0 [0087.838] lstrlenW (lpString=".db") returned 3 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".db") returned 0x0 [0087.838] lstrlenW (lpString=".ndf") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".ndf") returned 0x0 [0087.838] lstrlenW (lpString=".NDF") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".NDF") returned 0x0 [0087.838] lstrlenW (lpString=".Mdf") returned 4 [0087.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".Mdf") returned 0x0 [0087.838] lstrlenW (lpString=".dat") returned 4 [0087.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".dat") returned 0x0 [0087.839] lstrlenW (lpString=".DAT") returned 4 [0087.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".DAT") returned 0x0 [0087.839] lstrlenW (lpString=".ldf") returned 4 [0087.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".ldf") returned 0x0 [0087.839] lstrlenW (lpString=".LDF") returned 4 [0087.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch=".LDF") returned 0x0 [0087.839] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0087.839] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.840] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0087.840] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.840] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20784106906) returned 1 [0087.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc32aa8d0, dwHighDateTime=0x1d585b4)) [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33da28 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33da28 | out: hHeap=0x260000) returned 1 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.841] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.841] GetLastError () returned 0x0 [0087.841] GetLastError () returned 0x0 [0087.841] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.841] GetLastError () returned 0x0 [0087.841] GetLastError () returned 0x0 [0087.842] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffdf9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.842] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x207, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x207, lpOverlapped=0x0) returned 1 [0087.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.843] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.843] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.843] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.843] CloseHandle (hObject=0xe4) returned 1 [0087.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.844] GetLastError () returned 0x0 [0087.844] RtlWakeConditionVariable () returned 0x0 [0087.845] GetCurrentThreadId () returned 0x98c [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".ldf") returned 0x0 [0087.845] lstrlenW (lpString=".vhd") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".vhd") returned 0x0 [0087.845] lstrlenW (lpString=".vhdx") returned 5 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".vhdx") returned 0x0 [0087.845] lstrlenW (lpString=".pst") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".pst") returned 0x0 [0087.845] lstrlenW (lpString=".ost") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".ost") returned 0x0 [0087.845] lstrlenW (lpString=".bak") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".bak") returned 0x0 [0087.845] lstrlenW (lpString=".bac") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".bac") returned 0x0 [0087.845] lstrlenW (lpString=".sys") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".sys") returned 0x0 [0087.845] lstrlenW (lpString=".v2i") returned 4 [0087.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".v2i") returned 0x0 [0087.845] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch="s\r\n.v2i") returned 0x0 [0087.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.989] lstrlenW (lpString=".sql") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".sql") returned 0x0 [0087.989] lstrlenW (lpString=".mdf") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".mdf") returned 0x0 [0087.989] lstrlenW (lpString=".txt") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".txt") returned 0x0 [0087.989] lstrlenW (lpString=".dbf") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".dbf") returned 0x0 [0087.989] lstrlenW (lpString=".ckp") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".ckp") returned 0x0 [0087.989] lstrlenW (lpString=".dacpac") returned 7 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".dacpac") returned 0x0 [0087.989] lstrlenW (lpString=".db3") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".db3") returned 0x0 [0087.989] lstrlenW (lpString=".dtxs") returned 5 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".dtxs") returned 0x0 [0087.989] lstrlenW (lpString=".mdt") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".mdt") returned 0x0 [0087.989] lstrlenW (lpString=".sdf") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".sdf") returned 0x0 [0087.989] lstrlenW (lpString=".MDF") returned 4 [0087.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".MDF") returned 0x0 [0087.989] lstrlenW (lpString=".DBF") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".DBF") returned 0x0 [0087.990] lstrlenW (lpString=".DB") returned 3 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".DB") returned 0x0 [0087.990] lstrlenW (lpString=".db") returned 3 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".db") returned 0x0 [0087.990] lstrlenW (lpString=".ndf") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".ndf") returned 0x0 [0087.990] lstrlenW (lpString=".NDF") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".NDF") returned 0x0 [0087.990] lstrlenW (lpString=".Mdf") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".Mdf") returned 0x0 [0087.990] lstrlenW (lpString=".dat") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".dat") returned 0x0 [0087.990] lstrlenW (lpString=".DAT") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".DAT") returned 0x0 [0087.990] lstrlenW (lpString=".ldf") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".ldf") returned 0x0 [0087.990] lstrlenW (lpString=".LDF") returned 4 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch=".LDF") returned 0x0 [0087.990] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.990] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0087.991] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.991] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.991] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20799251493) returned 1 [0087.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3427690, dwHighDateTime=0x1d585b4)) [0087.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b20 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b20 | out: hHeap=0x260000) returned 1 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.992] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0087.992] GetLastError () returned 0x0 [0087.992] GetLastError () returned 0x0 [0087.992] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0087.993] GetLastError () returned 0x0 [0087.993] GetLastError () returned 0x0 [0087.995] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffffac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.995] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x54, lpOverlapped=0x0) returned 1 [0087.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.995] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.995] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.996] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.996] CloseHandle (hObject=0x11c) returned 1 [0087.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js.[deadmin@cock.li].deadmin")) returned 1 [0088.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0088.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.107] GetLastError () returned 0x0 [0088.107] RtlWakeConditionVariable () returned 0x0 [0088.156] GetCurrentThreadId () returned 0x98c [0088.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".ldf") returned 0x0 [0088.156] lstrlenW (lpString=".vhd") returned 4 [0088.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".vhd") returned 0x0 [0088.156] lstrlenW (lpString=".vhdx") returned 5 [0088.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".vhdx") returned 0x0 [0088.156] lstrlenW (lpString=".pst") returned 4 [0088.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".pst") returned 0x0 [0088.156] lstrlenW (lpString=".ost") returned 4 [0088.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".ost") returned 0x0 [0088.156] lstrlenW (lpString=".bak") returned 4 [0088.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".bak") returned 0x0 [0088.157] lstrlenW (lpString=".bac") returned 4 [0088.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".bac") returned 0x0 [0088.157] lstrlenW (lpString=".sys") returned 4 [0088.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".sys") returned 0x0 [0088.157] lstrlenW (lpString=".v2i") returned 4 [0088.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".v2i") returned 0x0 [0088.157] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.158] lstrlenW (lpString=".sql") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".sql") returned 0x0 [0088.158] lstrlenW (lpString=".mdf") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".mdf") returned 0x0 [0088.158] lstrlenW (lpString=".txt") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".txt") returned 0x0 [0088.158] lstrlenW (lpString=".dbf") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".dbf") returned 0x0 [0088.158] lstrlenW (lpString=".ckp") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".ckp") returned 0x0 [0088.158] lstrlenW (lpString=".dacpac") returned 7 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".dacpac") returned 0x0 [0088.158] lstrlenW (lpString=".db3") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".db3") returned 0x0 [0088.158] lstrlenW (lpString=".dtxs") returned 5 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".dtxs") returned 0x0 [0088.158] lstrlenW (lpString=".mdt") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".mdt") returned 0x0 [0088.158] lstrlenW (lpString=".sdf") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".sdf") returned 0x0 [0088.158] lstrlenW (lpString=".MDF") returned 4 [0088.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".MDF") returned 0x0 [0088.159] lstrlenW (lpString=".DBF") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".DBF") returned 0x0 [0088.159] lstrlenW (lpString=".DB") returned 3 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".DB") returned 0x0 [0088.159] lstrlenW (lpString=".db") returned 3 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".db") returned 0x0 [0088.159] lstrlenW (lpString=".ndf") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".ndf") returned 0x0 [0088.159] lstrlenW (lpString=".NDF") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".NDF") returned 0x0 [0088.159] lstrlenW (lpString=".Mdf") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".Mdf") returned 0x0 [0088.159] lstrlenW (lpString=".dat") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".dat") returned 0x0 [0088.159] lstrlenW (lpString=".DAT") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".DAT") returned 0x0 [0088.159] lstrlenW (lpString=".ldf") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".ldf") returned 0x0 [0088.159] lstrlenW (lpString=".LDF") returned 4 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch=".LDF") returned 0x0 [0088.159] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.159] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.160] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.160] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.160] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20816153189) returned 1 [0088.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc35ca5b0, dwHighDateTime=0x1d585b4)) [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dc90 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dc90 | out: hHeap=0x260000) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.161] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.161] GetLastError () returned 0x0 [0088.161] GetLastError () returned 0x0 [0088.162] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.162] GetLastError () returned 0x0 [0088.162] GetLastError () returned 0x0 [0088.163] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.163] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x244, lpOverlapped=0x0) returned 1 [0088.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.164] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.164] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.164] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.164] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.164] CloseHandle (hObject=0x11c) returned 1 [0088.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0088.164] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0088.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.166] GetLastError () returned 0x0 [0088.166] RtlWakeConditionVariable () returned 0x0 [0088.166] GetCurrentThreadId () returned 0x98c [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".ldf") returned 0x0 [0088.166] lstrlenW (lpString=".vhd") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".vhd") returned 0x0 [0088.166] lstrlenW (lpString=".vhdx") returned 5 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".vhdx") returned 0x0 [0088.166] lstrlenW (lpString=".pst") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".pst") returned 0x0 [0088.166] lstrlenW (lpString=".ost") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".ost") returned 0x0 [0088.166] lstrlenW (lpString=".bak") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".bak") returned 0x0 [0088.166] lstrlenW (lpString=".bac") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".bac") returned 0x0 [0088.166] lstrlenW (lpString=".sys") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".sys") returned 0x0 [0088.166] lstrlenW (lpString=".v2i") returned 4 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".v2i") returned 0x0 [0088.166] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.167] lstrlenW (lpString=".sql") returned 4 [0088.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".sql") returned 0x0 [0088.167] lstrlenW (lpString=".mdf") returned 4 [0088.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".mdf") returned 0x0 [0088.168] lstrlenW (lpString=".txt") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".txt") returned 0x0 [0088.168] lstrlenW (lpString=".dbf") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".dbf") returned 0x0 [0088.168] lstrlenW (lpString=".ckp") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".ckp") returned 0x0 [0088.168] lstrlenW (lpString=".dacpac") returned 7 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".dacpac") returned 0x0 [0088.168] lstrlenW (lpString=".db3") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".db3") returned 0x0 [0088.168] lstrlenW (lpString=".dtxs") returned 5 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".dtxs") returned 0x0 [0088.168] lstrlenW (lpString=".mdt") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".mdt") returned 0x0 [0088.168] lstrlenW (lpString=".sdf") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".sdf") returned 0x0 [0088.168] lstrlenW (lpString=".MDF") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".MDF") returned 0x0 [0088.168] lstrlenW (lpString=".DBF") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".DBF") returned 0x0 [0088.168] lstrlenW (lpString=".DB") returned 3 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".DB") returned 0x0 [0088.168] lstrlenW (lpString=".db") returned 3 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".db") returned 0x0 [0088.168] lstrlenW (lpString=".ndf") returned 4 [0088.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".ndf") returned 0x0 [0088.169] lstrlenW (lpString=".NDF") returned 4 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".NDF") returned 0x0 [0088.169] lstrlenW (lpString=".Mdf") returned 4 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".Mdf") returned 0x0 [0088.169] lstrlenW (lpString=".dat") returned 4 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".dat") returned 0x0 [0088.169] lstrlenW (lpString=".DAT") returned 4 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".DAT") returned 0x0 [0088.169] lstrlenW (lpString=".ldf") returned 4 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".ldf") returned 0x0 [0088.169] lstrlenW (lpString=".LDF") returned 4 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch=".LDF") returned 0x0 [0088.169] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.169] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.170] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.170] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.170] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20817121234) returned 1 [0088.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc35ca5b0, dwHighDateTime=0x1d585b4)) [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dcc8 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dcc8 | out: hHeap=0x260000) returned 1 [0088.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.171] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.171] GetLastError () returned 0x0 [0088.171] GetLastError () returned 0x0 [0088.171] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.192] GetLastError () returned 0x0 [0088.192] GetLastError () returned 0x0 [0088.193] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc7d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.193] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x383, lpOverlapped=0x0) returned 1 [0088.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.194] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.194] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.194] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.194] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.194] CloseHandle (hObject=0x11c) returned 1 [0088.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313650 [0088.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313650 | out: hHeap=0x260000) returned 1 [0088.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.249] GetLastError () returned 0x0 [0088.250] RtlWakeConditionVariable () returned 0x27e828 [0088.250] GetCurrentThreadId () returned 0x98c [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".ldf") returned 0x0 [0088.250] lstrlenW (lpString=".vhd") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".vhd") returned 0x0 [0088.250] lstrlenW (lpString=".vhdx") returned 5 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".vhdx") returned 0x0 [0088.250] lstrlenW (lpString=".pst") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".pst") returned 0x0 [0088.250] lstrlenW (lpString=".ost") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".ost") returned 0x0 [0088.250] lstrlenW (lpString=".bak") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".bak") returned 0x0 [0088.250] lstrlenW (lpString=".bac") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".bac") returned 0x0 [0088.250] lstrlenW (lpString=".sys") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".sys") returned 0x0 [0088.250] lstrlenW (lpString=".v2i") returned 4 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".v2i") returned 0x0 [0088.250] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.251] lstrlenW (lpString=".sql") returned 4 [0088.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".sql") returned 0x0 [0088.252] lstrlenW (lpString=".mdf") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".mdf") returned 0x0 [0088.252] lstrlenW (lpString=".txt") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".txt") returned 0x0 [0088.252] lstrlenW (lpString=".dbf") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".dbf") returned 0x0 [0088.252] lstrlenW (lpString=".ckp") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".ckp") returned 0x0 [0088.252] lstrlenW (lpString=".dacpac") returned 7 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".dacpac") returned 0x0 [0088.252] lstrlenW (lpString=".db3") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".db3") returned 0x0 [0088.252] lstrlenW (lpString=".dtxs") returned 5 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".dtxs") returned 0x0 [0088.252] lstrlenW (lpString=".mdt") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".mdt") returned 0x0 [0088.252] lstrlenW (lpString=".sdf") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".sdf") returned 0x0 [0088.252] lstrlenW (lpString=".MDF") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".MDF") returned 0x0 [0088.252] lstrlenW (lpString=".DBF") returned 4 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".DBF") returned 0x0 [0088.252] lstrlenW (lpString=".DB") returned 3 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".DB") returned 0x0 [0088.252] lstrlenW (lpString=".db") returned 3 [0088.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".db") returned 0x0 [0088.253] lstrlenW (lpString=".ndf") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".ndf") returned 0x0 [0088.253] lstrlenW (lpString=".NDF") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".NDF") returned 0x0 [0088.253] lstrlenW (lpString=".Mdf") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".Mdf") returned 0x0 [0088.253] lstrlenW (lpString=".dat") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".dat") returned 0x0 [0088.253] lstrlenW (lpString=".DAT") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".DAT") returned 0x0 [0088.253] lstrlenW (lpString=".ldf") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".ldf") returned 0x0 [0088.253] lstrlenW (lpString=".LDF") returned 4 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch=".LDF") returned 0x0 [0088.253] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.253] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.254] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.254] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20825534254) returned 1 [0088.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc36aedf0, dwHighDateTime=0x1d585b4)) [0088.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33de88 [0088.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33de88 | out: hHeap=0x260000) returned 1 [0088.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.255] GetLastError () returned 0x0 [0088.255] GetLastError () returned 0x0 [0088.255] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.255] GetLastError () returned 0x0 [0088.256] GetLastError () returned 0x0 [0088.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff36c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.267] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc94, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc94, lpOverlapped=0x0) returned 1 [0088.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.267] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.267] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.267] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.268] CloseHandle (hObject=0xf0) returned 1 [0088.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0088.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.269] GetLastError () returned 0x0 [0088.269] RtlWakeConditionVariable () returned 0x0 [0088.269] GetCurrentThreadId () returned 0x98c [0088.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".ldf") returned 0x0 [0088.269] lstrlenW (lpString=".vhd") returned 4 [0088.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".vhd") returned 0x0 [0088.269] lstrlenW (lpString=".vhdx") returned 5 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".vhdx") returned 0x0 [0088.270] lstrlenW (lpString=".pst") returned 4 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".pst") returned 0x0 [0088.270] lstrlenW (lpString=".ost") returned 4 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".ost") returned 0x0 [0088.270] lstrlenW (lpString=".bak") returned 4 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".bak") returned 0x0 [0088.270] lstrlenW (lpString=".bac") returned 4 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".bac") returned 0x0 [0088.270] lstrlenW (lpString=".sys") returned 4 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".sys") returned 0x0 [0088.270] lstrlenW (lpString=".v2i") returned 4 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".v2i") returned 0x0 [0088.270] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch="s\r\n.v2i") returned 0x0 [0088.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.271] lstrlenW (lpString=".sql") returned 4 [0088.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".sql") returned 0x0 [0088.271] lstrlenW (lpString=".mdf") returned 4 [0088.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".mdf") returned 0x0 [0088.271] lstrlenW (lpString=".txt") returned 4 [0088.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".txt") returned 0x0 [0088.271] lstrlenW (lpString=".dbf") returned 4 [0088.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".dbf") returned 0x0 [0088.271] lstrlenW (lpString=".ckp") returned 4 [0088.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".ckp") returned 0x0 [0088.271] lstrlenW (lpString=".dacpac") returned 7 [0088.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".dacpac") returned 0x0 [0088.272] lstrlenW (lpString=".db3") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".db3") returned 0x0 [0088.272] lstrlenW (lpString=".dtxs") returned 5 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".dtxs") returned 0x0 [0088.272] lstrlenW (lpString=".mdt") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".mdt") returned 0x0 [0088.272] lstrlenW (lpString=".sdf") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".sdf") returned 0x0 [0088.272] lstrlenW (lpString=".MDF") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".MDF") returned 0x0 [0088.272] lstrlenW (lpString=".DBF") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".DBF") returned 0x0 [0088.272] lstrlenW (lpString=".DB") returned 3 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".DB") returned 0x0 [0088.272] lstrlenW (lpString=".db") returned 3 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".db") returned 0x0 [0088.272] lstrlenW (lpString=".ndf") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".ndf") returned 0x0 [0088.272] lstrlenW (lpString=".NDF") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".NDF") returned 0x0 [0088.272] lstrlenW (lpString=".Mdf") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".Mdf") returned 0x0 [0088.272] lstrlenW (lpString=".dat") returned 4 [0088.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".dat") returned 0x0 [0088.272] lstrlenW (lpString=".DAT") returned 4 [0088.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".DAT") returned 0x0 [0088.273] lstrlenW (lpString=".ldf") returned 4 [0088.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".ldf") returned 0x0 [0088.273] lstrlenW (lpString=".LDF") returned 4 [0088.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch=".LDF") returned 0x0 [0088.273] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.273] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.274] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.274] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.274] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20827720621) returned 1 [0088.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc36d4f50, dwHighDateTime=0x1d585b4)) [0088.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33def8 [0088.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33def8 | out: hHeap=0x260000) returned 1 [0088.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.277] GetLastError () returned 0x0 [0088.277] GetLastError () returned 0x0 [0088.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.277] GetLastError () returned 0x0 [0088.278] GetLastError () returned 0x0 [0088.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe226, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.289] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1dda, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1dda, lpOverlapped=0x0) returned 1 [0088.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.289] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.290] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.290] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.290] CloseHandle (hObject=0xf0) returned 1 [0088.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js.[deadmin@cock.li].deadmin")) returned 1 [0088.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.291] GetLastError () returned 0x0 [0088.291] RtlWakeConditionVariable () returned 0x0 [0088.291] GetCurrentThreadId () returned 0x98c [0088.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".ldf") returned 0x0 [0088.291] lstrlenW (lpString=".vhd") returned 4 [0088.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".vhd") returned 0x0 [0088.292] lstrlenW (lpString=".vhdx") returned 5 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".vhdx") returned 0x0 [0088.292] lstrlenW (lpString=".pst") returned 4 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".pst") returned 0x0 [0088.292] lstrlenW (lpString=".ost") returned 4 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".ost") returned 0x0 [0088.292] lstrlenW (lpString=".bak") returned 4 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".bak") returned 0x0 [0088.292] lstrlenW (lpString=".bac") returned 4 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".bac") returned 0x0 [0088.292] lstrlenW (lpString=".sys") returned 4 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".sys") returned 0x0 [0088.292] lstrlenW (lpString=".v2i") returned 4 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".v2i") returned 0x0 [0088.292] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.293] lstrlenW (lpString=".sql") returned 4 [0088.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".sql") returned 0x0 [0088.293] lstrlenW (lpString=".mdf") returned 4 [0088.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".mdf") returned 0x0 [0088.293] lstrlenW (lpString=".txt") returned 4 [0088.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".txt") returned 0x0 [0088.293] lstrlenW (lpString=".dbf") returned 4 [0088.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".dbf") returned 0x0 [0088.293] lstrlenW (lpString=".ckp") returned 4 [0088.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".ckp") returned 0x0 [0088.293] lstrlenW (lpString=".dacpac") returned 7 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".dacpac") returned 0x0 [0088.294] lstrlenW (lpString=".db3") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".db3") returned 0x0 [0088.294] lstrlenW (lpString=".dtxs") returned 5 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".dtxs") returned 0x0 [0088.294] lstrlenW (lpString=".mdt") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".mdt") returned 0x0 [0088.294] lstrlenW (lpString=".sdf") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".sdf") returned 0x0 [0088.294] lstrlenW (lpString=".MDF") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".MDF") returned 0x0 [0088.294] lstrlenW (lpString=".DBF") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".DBF") returned 0x0 [0088.294] lstrlenW (lpString=".DB") returned 3 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".DB") returned 0x0 [0088.294] lstrlenW (lpString=".db") returned 3 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".db") returned 0x0 [0088.294] lstrlenW (lpString=".ndf") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".ndf") returned 0x0 [0088.294] lstrlenW (lpString=".NDF") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".NDF") returned 0x0 [0088.294] lstrlenW (lpString=".Mdf") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".Mdf") returned 0x0 [0088.294] lstrlenW (lpString=".dat") returned 4 [0088.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".dat") returned 0x0 [0088.295] lstrlenW (lpString=".DAT") returned 4 [0088.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".DAT") returned 0x0 [0088.295] lstrlenW (lpString=".ldf") returned 4 [0088.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".ldf") returned 0x0 [0088.295] lstrlenW (lpString=".LDF") returned 4 [0088.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch=".LDF") returned 0x0 [0088.295] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.295] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.296] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.296] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.296] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20829700439) returned 1 [0088.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3721210, dwHighDateTime=0x1d585b4)) [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33df68 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33df68 | out: hHeap=0x260000) returned 1 [0088.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.297] GetLastError () returned 0x0 [0088.297] GetLastError () returned 0x0 [0088.297] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.297] GetLastError () returned 0x0 [0088.297] GetLastError () returned 0x0 [0088.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff812, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.386] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7ee, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x7ee, lpOverlapped=0x0) returned 1 [0088.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.453] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.454] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.454] CloseHandle (hObject=0xf0) returned 1 [0088.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0088.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.455] GetLastError () returned 0x0 [0088.456] RtlWakeConditionVariable () returned 0x0 [0088.456] GetCurrentThreadId () returned 0x98c [0088.456] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.456] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.456] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0088.456] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0088.458] CloseHandle (hObject=0xf0) returned 1 [0088.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.459] RtlWakeConditionVariable () returned 0x0 [0088.459] GetCurrentThreadId () returned 0x98c [0088.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".ldf") returned 0x0 [0088.459] lstrlenW (lpString=".vhd") returned 4 [0088.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".vhd") returned 0x0 [0088.459] lstrlenW (lpString=".vhdx") returned 5 [0088.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".vhdx") returned 0x0 [0088.459] lstrlenW (lpString=".pst") returned 4 [0088.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".pst") returned 0x0 [0088.459] lstrlenW (lpString=".ost") returned 4 [0088.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".ost") returned 0x0 [0088.459] lstrlenW (lpString=".bak") returned 4 [0088.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".bak") returned 0x0 [0088.460] lstrlenW (lpString=".bac") returned 4 [0088.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".bac") returned 0x0 [0088.460] lstrlenW (lpString=".sys") returned 4 [0088.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".sys") returned 0x0 [0088.460] lstrlenW (lpString=".v2i") returned 4 [0088.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".v2i") returned 0x0 [0088.460] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.461] lstrlenW (lpString=".sql") returned 4 [0088.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".sql") returned 0x0 [0088.461] lstrlenW (lpString=".mdf") returned 4 [0088.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".mdf") returned 0x0 [0088.461] lstrlenW (lpString=".txt") returned 4 [0088.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".txt") returned 0x0 [0088.461] lstrlenW (lpString=".dbf") returned 4 [0088.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".dbf") returned 0x0 [0088.461] lstrlenW (lpString=".ckp") returned 4 [0088.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".ckp") returned 0x0 [0088.461] lstrlenW (lpString=".dacpac") returned 7 [0088.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".dacpac") returned 0x0 [0088.462] lstrlenW (lpString=".db3") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".db3") returned 0x0 [0088.462] lstrlenW (lpString=".dtxs") returned 5 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".dtxs") returned 0x0 [0088.462] lstrlenW (lpString=".mdt") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".mdt") returned 0x0 [0088.462] lstrlenW (lpString=".sdf") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".sdf") returned 0x0 [0088.462] lstrlenW (lpString=".MDF") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".MDF") returned 0x0 [0088.462] lstrlenW (lpString=".DBF") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".DBF") returned 0x0 [0088.462] lstrlenW (lpString=".DB") returned 3 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".DB") returned 0x0 [0088.462] lstrlenW (lpString=".db") returned 3 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".db") returned 0x0 [0088.462] lstrlenW (lpString=".ndf") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".ndf") returned 0x0 [0088.462] lstrlenW (lpString=".NDF") returned 4 [0088.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".NDF") returned 0x0 [0088.463] lstrlenW (lpString=".Mdf") returned 4 [0088.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".Mdf") returned 0x0 [0088.463] lstrlenW (lpString=".dat") returned 4 [0088.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".dat") returned 0x0 [0088.463] lstrlenW (lpString=".DAT") returned 4 [0088.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".DAT") returned 0x0 [0088.463] lstrlenW (lpString=".ldf") returned 4 [0088.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".ldf") returned 0x0 [0088.463] lstrlenW (lpString=".LDF") returned 4 [0088.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch=".LDF") returned 0x0 [0088.463] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.463] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.464] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.464] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.464] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20846559467) returned 1 [0088.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc389dfd0, dwHighDateTime=0x1d585b4)) [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ecf0 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ecf0 | out: hHeap=0x260000) returned 1 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.465] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.466] GetLastError () returned 0x0 [0088.466] GetLastError () returned 0x0 [0088.466] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.466] GetLastError () returned 0x0 [0088.466] GetLastError () returned 0x0 [0088.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.468] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd45, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xd45, lpOverlapped=0x0) returned 1 [0088.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.469] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.469] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.469] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.469] CloseHandle (hObject=0xf0) returned 1 [0088.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css.[deadmin@cock.li].deadmin")) returned 1 [0088.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.471] GetLastError () returned 0x0 [0088.471] RtlWakeConditionVariable () returned 0x0 [0088.471] GetCurrentThreadId () returned 0x98c [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ldf") returned 0x0 [0088.472] lstrlenW (lpString=".vhd") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".vhd") returned 0x0 [0088.472] lstrlenW (lpString=".vhdx") returned 5 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".vhdx") returned 0x0 [0088.472] lstrlenW (lpString=".pst") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".pst") returned 0x0 [0088.472] lstrlenW (lpString=".ost") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ost") returned 0x0 [0088.472] lstrlenW (lpString=".bak") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".bak") returned 0x0 [0088.472] lstrlenW (lpString=".bac") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".bac") returned 0x0 [0088.472] lstrlenW (lpString=".sys") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".sys") returned 0x0 [0088.472] lstrlenW (lpString=".v2i") returned 4 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".v2i") returned 0x0 [0088.472] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.474] lstrlenW (lpString=".sql") returned 4 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".sql") returned 0x0 [0088.474] lstrlenW (lpString=".mdf") returned 4 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".mdf") returned 0x0 [0088.474] lstrlenW (lpString=".txt") returned 4 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".txt") returned 0x0 [0088.474] lstrlenW (lpString=".dbf") returned 4 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dbf") returned 0x0 [0088.474] lstrlenW (lpString=".ckp") returned 4 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ckp") returned 0x0 [0088.474] lstrlenW (lpString=".dacpac") returned 7 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dacpac") returned 0x0 [0088.474] lstrlenW (lpString=".db3") returned 4 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".db3") returned 0x0 [0088.474] lstrlenW (lpString=".dtxs") returned 5 [0088.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dtxs") returned 0x0 [0088.475] lstrlenW (lpString=".mdt") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".mdt") returned 0x0 [0088.475] lstrlenW (lpString=".sdf") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".sdf") returned 0x0 [0088.475] lstrlenW (lpString=".MDF") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".MDF") returned 0x0 [0088.475] lstrlenW (lpString=".DBF") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".DBF") returned 0x0 [0088.475] lstrlenW (lpString=".DB") returned 3 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".DB") returned 0x0 [0088.475] lstrlenW (lpString=".db") returned 3 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".db") returned 0x0 [0088.475] lstrlenW (lpString=".ndf") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ndf") returned 0x0 [0088.475] lstrlenW (lpString=".NDF") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".NDF") returned 0x0 [0088.475] lstrlenW (lpString=".Mdf") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".Mdf") returned 0x0 [0088.475] lstrlenW (lpString=".dat") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dat") returned 0x0 [0088.475] lstrlenW (lpString=".DAT") returned 4 [0088.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".DAT") returned 0x0 [0088.476] lstrlenW (lpString=".ldf") returned 4 [0088.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ldf") returned 0x0 [0088.476] lstrlenW (lpString=".LDF") returned 4 [0088.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".LDF") returned 0x0 [0088.476] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.476] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.477] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.477] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20847818178) returned 1 [0088.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc38c4130, dwHighDateTime=0x1d585b4)) [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ed28 [0088.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ed28 | out: hHeap=0x260000) returned 1 [0088.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.478] GetLastError () returned 0x0 [0088.478] GetLastError () returned 0x0 [0088.478] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.479] GetLastError () returned 0x0 [0088.479] GetLastError () returned 0x0 [0088.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffebd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.480] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x143, lpOverlapped=0x0) returned 1 [0088.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.480] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.480] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.481] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.481] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.484] CloseHandle (hObject=0xf0) returned 1 [0088.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x140) returned 0x27d070 [0088.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0088.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.488] GetLastError () returned 0x0 [0088.488] RtlWakeConditionVariable () returned 0x0 [0088.488] GetCurrentThreadId () returned 0x98c [0088.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".ldf") returned 0x0 [0088.488] lstrlenW (lpString=".vhd") returned 4 [0088.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".vhd") returned 0x0 [0088.488] lstrlenW (lpString=".vhdx") returned 5 [0088.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".vhdx") returned 0x0 [0088.488] lstrlenW (lpString=".pst") returned 4 [0088.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".pst") returned 0x0 [0088.488] lstrlenW (lpString=".ost") returned 4 [0088.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".ost") returned 0x0 [0088.488] lstrlenW (lpString=".bak") returned 4 [0088.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".bak") returned 0x0 [0088.488] lstrlenW (lpString=".bac") returned 4 [0088.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".bac") returned 0x0 [0088.489] lstrlenW (lpString=".sys") returned 4 [0088.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".sys") returned 0x0 [0088.489] lstrlenW (lpString=".v2i") returned 4 [0088.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".v2i") returned 0x0 [0088.489] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.490] lstrlenW (lpString=".sql") returned 4 [0088.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".sql") returned 0x0 [0088.490] lstrlenW (lpString=".mdf") returned 4 [0088.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".mdf") returned 0x0 [0088.490] lstrlenW (lpString=".txt") returned 4 [0088.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".txt") returned 0x0 [0088.490] lstrlenW (lpString=".dbf") returned 4 [0088.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".dbf") returned 0x0 [0088.490] lstrlenW (lpString=".ckp") returned 4 [0088.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".ckp") returned 0x0 [0088.490] lstrlenW (lpString=".dacpac") returned 7 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".dacpac") returned 0x0 [0088.491] lstrlenW (lpString=".db3") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".db3") returned 0x0 [0088.491] lstrlenW (lpString=".dtxs") returned 5 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".dtxs") returned 0x0 [0088.491] lstrlenW (lpString=".mdt") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".mdt") returned 0x0 [0088.491] lstrlenW (lpString=".sdf") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".sdf") returned 0x0 [0088.491] lstrlenW (lpString=".MDF") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".MDF") returned 0x0 [0088.491] lstrlenW (lpString=".DBF") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".DBF") returned 0x0 [0088.491] lstrlenW (lpString=".DB") returned 3 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".DB") returned 0x0 [0088.491] lstrlenW (lpString=".db") returned 3 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".db") returned 0x0 [0088.491] lstrlenW (lpString=".ndf") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".ndf") returned 0x0 [0088.491] lstrlenW (lpString=".NDF") returned 4 [0088.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".NDF") returned 0x0 [0088.491] lstrlenW (lpString=".Mdf") returned 4 [0088.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".Mdf") returned 0x0 [0088.492] lstrlenW (lpString=".dat") returned 4 [0088.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".dat") returned 0x0 [0088.492] lstrlenW (lpString=".DAT") returned 4 [0088.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".DAT") returned 0x0 [0088.492] lstrlenW (lpString=".ldf") returned 4 [0088.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".ldf") returned 0x0 [0088.492] lstrlenW (lpString=".LDF") returned 4 [0088.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch=".LDF") returned 0x0 [0088.492] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.492] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.493] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.493] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20849451104) returned 1 [0088.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc38ea290, dwHighDateTime=0x1d585b4)) [0088.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ed60 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ed60 | out: hHeap=0x260000) returned 1 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.494] GetLastError () returned 0x0 [0088.494] GetLastError () returned 0x0 [0088.495] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.495] GetLastError () returned 0x0 [0088.495] GetLastError () returned 0x0 [0088.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.496] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0088.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.496] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.496] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.496] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.497] CloseHandle (hObject=0xf0) returned 1 [0088.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0088.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.499] GetLastError () returned 0x0 [0088.499] RtlWakeConditionVariable () returned 0x0 [0088.499] GetCurrentThreadId () returned 0x98c [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0088.499] lstrlenW (lpString=".vhd") returned 4 [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".vhd") returned 0x0 [0088.499] lstrlenW (lpString=".vhdx") returned 5 [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".vhdx") returned 0x0 [0088.499] lstrlenW (lpString=".pst") returned 4 [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".pst") returned 0x0 [0088.499] lstrlenW (lpString=".ost") returned 4 [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".ost") returned 0x0 [0088.499] lstrlenW (lpString=".bak") returned 4 [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".bak") returned 0x0 [0088.499] lstrlenW (lpString=".bac") returned 4 [0088.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".bac") returned 0x0 [0088.500] lstrlenW (lpString=".sys") returned 4 [0088.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".sys") returned 0x0 [0088.500] lstrlenW (lpString=".v2i") returned 4 [0088.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".v2i") returned 0x0 [0088.500] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.501] lstrlenW (lpString=".sql") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".sql") returned 0x0 [0088.501] lstrlenW (lpString=".mdf") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".mdf") returned 0x0 [0088.501] lstrlenW (lpString=".txt") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".txt") returned 0x0 [0088.501] lstrlenW (lpString=".dbf") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".dbf") returned 0x0 [0088.501] lstrlenW (lpString=".ckp") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".ckp") returned 0x0 [0088.501] lstrlenW (lpString=".dacpac") returned 7 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".dacpac") returned 0x0 [0088.501] lstrlenW (lpString=".db3") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".db3") returned 0x0 [0088.501] lstrlenW (lpString=".dtxs") returned 5 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".dtxs") returned 0x0 [0088.501] lstrlenW (lpString=".mdt") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".mdt") returned 0x0 [0088.501] lstrlenW (lpString=".sdf") returned 4 [0088.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".sdf") returned 0x0 [0088.501] lstrlenW (lpString=".MDF") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".MDF") returned 0x0 [0088.502] lstrlenW (lpString=".DBF") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".DBF") returned 0x0 [0088.502] lstrlenW (lpString=".DB") returned 3 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".DB") returned 0x0 [0088.502] lstrlenW (lpString=".db") returned 3 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".db") returned 0x0 [0088.502] lstrlenW (lpString=".ndf") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".ndf") returned 0x0 [0088.502] lstrlenW (lpString=".NDF") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".NDF") returned 0x0 [0088.502] lstrlenW (lpString=".Mdf") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".Mdf") returned 0x0 [0088.502] lstrlenW (lpString=".dat") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".dat") returned 0x0 [0088.502] lstrlenW (lpString=".DAT") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".DAT") returned 0x0 [0088.502] lstrlenW (lpString=".ldf") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0088.502] lstrlenW (lpString=".LDF") returned 4 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch=".LDF") returned 0x0 [0088.502] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.502] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.503] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.503] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.503] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20850458975) returned 1 [0088.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc39103f0, dwHighDateTime=0x1d585b4)) [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ed98 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ed98 | out: hHeap=0x260000) returned 1 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.504] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.504] GetLastError () returned 0x0 [0088.505] GetLastError () returned 0x0 [0088.505] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.505] GetLastError () returned 0x0 [0088.505] GetLastError () returned 0x0 [0088.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.506] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0088.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.506] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.506] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.506] CloseHandle (hObject=0xf0) returned 1 [0088.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0088.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.508] GetLastError () returned 0x0 [0088.508] RtlWakeConditionVariable () returned 0x27e828 [0088.508] GetCurrentThreadId () returned 0x98c [0088.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0088.508] lstrlenW (lpString=".vhd") returned 4 [0088.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".vhd") returned 0x0 [0088.508] lstrlenW (lpString=".vhdx") returned 5 [0088.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".vhdx") returned 0x0 [0088.508] lstrlenW (lpString=".pst") returned 4 [0088.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".pst") returned 0x0 [0088.508] lstrlenW (lpString=".ost") returned 4 [0088.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".ost") returned 0x0 [0088.509] lstrlenW (lpString=".bak") returned 4 [0088.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".bak") returned 0x0 [0088.509] lstrlenW (lpString=".bac") returned 4 [0088.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".bac") returned 0x0 [0088.509] lstrlenW (lpString=".sys") returned 4 [0088.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".sys") returned 0x0 [0088.509] lstrlenW (lpString=".v2i") returned 4 [0088.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".v2i") returned 0x0 [0088.509] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.510] lstrlenW (lpString=".sql") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".sql") returned 0x0 [0088.510] lstrlenW (lpString=".mdf") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".mdf") returned 0x0 [0088.510] lstrlenW (lpString=".txt") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".txt") returned 0x0 [0088.510] lstrlenW (lpString=".dbf") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".dbf") returned 0x0 [0088.510] lstrlenW (lpString=".ckp") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".ckp") returned 0x0 [0088.510] lstrlenW (lpString=".dacpac") returned 7 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".dacpac") returned 0x0 [0088.510] lstrlenW (lpString=".db3") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".db3") returned 0x0 [0088.510] lstrlenW (lpString=".dtxs") returned 5 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".dtxs") returned 0x0 [0088.510] lstrlenW (lpString=".mdt") returned 4 [0088.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".mdt") returned 0x0 [0088.511] lstrlenW (lpString=".sdf") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".sdf") returned 0x0 [0088.511] lstrlenW (lpString=".MDF") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".MDF") returned 0x0 [0088.511] lstrlenW (lpString=".DBF") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".DBF") returned 0x0 [0088.511] lstrlenW (lpString=".DB") returned 3 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".DB") returned 0x0 [0088.511] lstrlenW (lpString=".db") returned 3 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".db") returned 0x0 [0088.511] lstrlenW (lpString=".ndf") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".ndf") returned 0x0 [0088.511] lstrlenW (lpString=".NDF") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".NDF") returned 0x0 [0088.511] lstrlenW (lpString=".Mdf") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".Mdf") returned 0x0 [0088.511] lstrlenW (lpString=".dat") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".dat") returned 0x0 [0088.511] lstrlenW (lpString=".DAT") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".DAT") returned 0x0 [0088.511] lstrlenW (lpString=".ldf") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0088.511] lstrlenW (lpString=".LDF") returned 4 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch=".LDF") returned 0x0 [0088.511] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.512] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.512] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.512] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.513] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20851370416) returned 1 [0088.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc39103f0, dwHighDateTime=0x1d585b4)) [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32edd0 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32edd0 | out: hHeap=0x260000) returned 1 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.513] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.513] GetLastError () returned 0x0 [0088.514] GetLastError () returned 0x0 [0088.514] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.514] GetLastError () returned 0x0 [0088.514] GetLastError () returned 0x0 [0088.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.515] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0088.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.516] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.516] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.516] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.516] CloseHandle (hObject=0xf0) returned 1 [0088.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0088.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.517] GetLastError () returned 0x0 [0088.518] RtlWakeConditionVariable () returned 0x27e828 [0088.518] GetCurrentThreadId () returned 0x98c [0088.518] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.518] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.518] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0088.518] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0088.520] CloseHandle (hObject=0xf0) returned 1 [0088.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c2f8 | out: hHeap=0x260000) returned 1 [0088.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.520] RtlWakeConditionVariable () returned 0x27e828 [0088.520] GetCurrentThreadId () returned 0x98c [0088.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".ldf") returned 0x0 [0088.520] lstrlenW (lpString=".vhd") returned 4 [0088.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".vhd") returned 0x0 [0088.520] lstrlenW (lpString=".vhdx") returned 5 [0088.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".vhdx") returned 0x0 [0088.520] lstrlenW (lpString=".pst") returned 4 [0088.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".pst") returned 0x0 [0088.520] lstrlenW (lpString=".ost") returned 4 [0088.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".ost") returned 0x0 [0088.520] lstrlenW (lpString=".bak") returned 4 [0088.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".bak") returned 0x0 [0088.521] lstrlenW (lpString=".bac") returned 4 [0088.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".bac") returned 0x0 [0088.521] lstrlenW (lpString=".sys") returned 4 [0088.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".sys") returned 0x0 [0088.521] lstrlenW (lpString=".v2i") returned 4 [0088.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".v2i") returned 0x0 [0088.521] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.522] lstrlenW (lpString=".sql") returned 4 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".sql") returned 0x0 [0088.522] lstrlenW (lpString=".mdf") returned 4 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".mdf") returned 0x0 [0088.522] lstrlenW (lpString=".txt") returned 4 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".txt") returned 0x0 [0088.522] lstrlenW (lpString=".dbf") returned 4 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".dbf") returned 0x0 [0088.522] lstrlenW (lpString=".ckp") returned 4 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".ckp") returned 0x0 [0088.522] lstrlenW (lpString=".dacpac") returned 7 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".dacpac") returned 0x0 [0088.522] lstrlenW (lpString=".db3") returned 4 [0088.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".db3") returned 0x0 [0088.522] lstrlenW (lpString=".dtxs") returned 5 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".dtxs") returned 0x0 [0088.523] lstrlenW (lpString=".mdt") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".mdt") returned 0x0 [0088.523] lstrlenW (lpString=".sdf") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".sdf") returned 0x0 [0088.523] lstrlenW (lpString=".MDF") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".MDF") returned 0x0 [0088.523] lstrlenW (lpString=".DBF") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".DBF") returned 0x0 [0088.523] lstrlenW (lpString=".DB") returned 3 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".DB") returned 0x0 [0088.523] lstrlenW (lpString=".db") returned 3 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".db") returned 0x0 [0088.523] lstrlenW (lpString=".ndf") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".ndf") returned 0x0 [0088.523] lstrlenW (lpString=".NDF") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".NDF") returned 0x0 [0088.523] lstrlenW (lpString=".Mdf") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".Mdf") returned 0x0 [0088.523] lstrlenW (lpString=".dat") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".dat") returned 0x0 [0088.523] lstrlenW (lpString=".DAT") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".DAT") returned 0x0 [0088.523] lstrlenW (lpString=".ldf") returned 4 [0088.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".ldf") returned 0x0 [0088.523] lstrlenW (lpString=".LDF") returned 4 [0088.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch=".LDF") returned 0x0 [0088.524] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.524] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.524] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.525] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.525] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20852585361) returned 1 [0088.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3936550, dwHighDateTime=0x1d585b4)) [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ee40 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ee40 | out: hHeap=0x260000) returned 1 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.525] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.526] GetLastError () returned 0x0 [0088.526] GetLastError () returned 0x0 [0088.526] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.526] GetLastError () returned 0x0 [0088.526] GetLastError () returned 0x0 [0088.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.528] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd5b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xd5b, lpOverlapped=0x0) returned 1 [0088.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.528] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.528] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.528] CloseHandle (hObject=0xf0) returned 1 [0088.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css.[deadmin@cock.li].deadmin")) returned 1 [0088.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.542] GetLastError () returned 0x0 [0088.542] RtlWakeConditionVariable () returned 0x0 [0088.542] GetCurrentThreadId () returned 0x98c [0088.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.543] lstrlenW (lpString=".vhd") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0088.543] lstrlenW (lpString=".vhdx") returned 5 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0088.543] lstrlenW (lpString=".pst") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0088.543] lstrlenW (lpString=".ost") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0088.543] lstrlenW (lpString=".bak") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0088.543] lstrlenW (lpString=".bac") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0088.543] lstrlenW (lpString=".sys") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0088.543] lstrlenW (lpString=".v2i") returned 4 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0088.543] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.559] lstrlenW (lpString=".sql") returned 4 [0088.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0088.559] lstrlenW (lpString=".mdf") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0088.560] lstrlenW (lpString=".txt") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0088.560] lstrlenW (lpString=".dbf") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0088.560] lstrlenW (lpString=".ckp") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0088.560] lstrlenW (lpString=".dacpac") returned 7 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0088.560] lstrlenW (lpString=".db3") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0088.560] lstrlenW (lpString=".dtxs") returned 5 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0088.560] lstrlenW (lpString=".mdt") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0088.560] lstrlenW (lpString=".sdf") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0088.560] lstrlenW (lpString=".MDF") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0088.560] lstrlenW (lpString=".DBF") returned 4 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0088.560] lstrlenW (lpString=".DB") returned 3 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0088.560] lstrlenW (lpString=".db") returned 3 [0088.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0088.560] lstrlenW (lpString=".ndf") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0088.561] lstrlenW (lpString=".NDF") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0088.561] lstrlenW (lpString=".Mdf") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0088.561] lstrlenW (lpString=".dat") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0088.561] lstrlenW (lpString=".DAT") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0088.561] lstrlenW (lpString=".ldf") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.561] lstrlenW (lpString=".LDF") returned 4 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0088.561] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.561] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.562] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.562] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.562] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20856348373) returned 1 [0088.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc39a8970, dwHighDateTime=0x1d585b4)) [0088.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ef90 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ef90 | out: hHeap=0x260000) returned 1 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.563] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.563] GetLastError () returned 0x0 [0088.563] GetLastError () returned 0x0 [0088.563] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.564] GetLastError () returned 0x0 [0088.564] GetLastError () returned 0x0 [0088.565] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.565] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0088.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.565] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.565] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.565] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.565] CloseHandle (hObject=0x11c) returned 1 [0088.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0088.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.567] GetLastError () returned 0x0 [0088.567] RtlWakeConditionVariable () returned 0x0 [0088.567] GetCurrentThreadId () returned 0x98c [0088.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".ldf") returned 0x0 [0088.567] lstrlenW (lpString=".vhd") returned 4 [0088.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".vhd") returned 0x0 [0088.567] lstrlenW (lpString=".vhdx") returned 5 [0088.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".vhdx") returned 0x0 [0088.567] lstrlenW (lpString=".pst") returned 4 [0088.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".pst") returned 0x0 [0088.567] lstrlenW (lpString=".ost") returned 4 [0088.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".ost") returned 0x0 [0088.567] lstrlenW (lpString=".bak") returned 4 [0088.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".bak") returned 0x0 [0088.568] lstrlenW (lpString=".bac") returned 4 [0088.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".bac") returned 0x0 [0088.568] lstrlenW (lpString=".sys") returned 4 [0088.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".sys") returned 0x0 [0088.568] lstrlenW (lpString=".v2i") returned 4 [0088.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".v2i") returned 0x0 [0088.568] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.569] lstrlenW (lpString=".sql") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".sql") returned 0x0 [0088.569] lstrlenW (lpString=".mdf") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".mdf") returned 0x0 [0088.569] lstrlenW (lpString=".txt") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".txt") returned 0x0 [0088.569] lstrlenW (lpString=".dbf") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".dbf") returned 0x0 [0088.569] lstrlenW (lpString=".ckp") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".ckp") returned 0x0 [0088.569] lstrlenW (lpString=".dacpac") returned 7 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".dacpac") returned 0x0 [0088.569] lstrlenW (lpString=".db3") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".db3") returned 0x0 [0088.569] lstrlenW (lpString=".dtxs") returned 5 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".dtxs") returned 0x0 [0088.569] lstrlenW (lpString=".mdt") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".mdt") returned 0x0 [0088.569] lstrlenW (lpString=".sdf") returned 4 [0088.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".sdf") returned 0x0 [0088.570] lstrlenW (lpString=".MDF") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".MDF") returned 0x0 [0088.570] lstrlenW (lpString=".DBF") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".DBF") returned 0x0 [0088.570] lstrlenW (lpString=".DB") returned 3 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".DB") returned 0x0 [0088.570] lstrlenW (lpString=".db") returned 3 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".db") returned 0x0 [0088.570] lstrlenW (lpString=".ndf") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".ndf") returned 0x0 [0088.570] lstrlenW (lpString=".NDF") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".NDF") returned 0x0 [0088.570] lstrlenW (lpString=".Mdf") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".Mdf") returned 0x0 [0088.570] lstrlenW (lpString=".dat") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".dat") returned 0x0 [0088.570] lstrlenW (lpString=".DAT") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".DAT") returned 0x0 [0088.570] lstrlenW (lpString=".ldf") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".ldf") returned 0x0 [0088.570] lstrlenW (lpString=".LDF") returned 4 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch=".LDF") returned 0x0 [0088.570] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.571] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.571] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.571] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.571] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20857261934) returned 1 [0088.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc39a8970, dwHighDateTime=0x1d585b4)) [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32efc8 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32efc8 | out: hHeap=0x260000) returned 1 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.572] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.572] GetLastError () returned 0x0 [0088.572] GetLastError () returned 0x0 [0088.573] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.573] GetLastError () returned 0x0 [0088.573] GetLastError () returned 0x0 [0088.582] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff34a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.582] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcb6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xcb6, lpOverlapped=0x0) returned 1 [0088.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.582] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.582] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.583] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.583] CloseHandle (hObject=0x11c) returned 1 [0088.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27dd2d8 [0088.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css.[deadmin@cock.li].deadmin")) returned 1 [0088.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dd2d8 | out: hHeap=0x260000) returned 1 [0088.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.584] GetLastError () returned 0x0 [0088.584] RtlWakeConditionVariable () returned 0x27e828 [0088.584] GetCurrentThreadId () returned 0x98c [0088.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".ldf") returned 0x0 [0088.584] lstrlenW (lpString=".vhd") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".vhd") returned 0x0 [0088.585] lstrlenW (lpString=".vhdx") returned 5 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".vhdx") returned 0x0 [0088.585] lstrlenW (lpString=".pst") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".pst") returned 0x0 [0088.585] lstrlenW (lpString=".ost") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".ost") returned 0x0 [0088.585] lstrlenW (lpString=".bak") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".bak") returned 0x0 [0088.585] lstrlenW (lpString=".bac") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".bac") returned 0x0 [0088.585] lstrlenW (lpString=".sys") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".sys") returned 0x0 [0088.585] lstrlenW (lpString=".v2i") returned 4 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".v2i") returned 0x0 [0088.585] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.586] lstrlenW (lpString=".sql") returned 4 [0088.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".sql") returned 0x0 [0088.586] lstrlenW (lpString=".mdf") returned 4 [0088.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".mdf") returned 0x0 [0088.586] lstrlenW (lpString=".txt") returned 4 [0088.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".txt") returned 0x0 [0088.586] lstrlenW (lpString=".dbf") returned 4 [0088.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".dbf") returned 0x0 [0088.586] lstrlenW (lpString=".ckp") returned 4 [0088.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".ckp") returned 0x0 [0088.586] lstrlenW (lpString=".dacpac") returned 7 [0088.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".dacpac") returned 0x0 [0088.586] lstrlenW (lpString=".db3") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".db3") returned 0x0 [0088.587] lstrlenW (lpString=".dtxs") returned 5 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".dtxs") returned 0x0 [0088.587] lstrlenW (lpString=".mdt") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".mdt") returned 0x0 [0088.587] lstrlenW (lpString=".sdf") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".sdf") returned 0x0 [0088.587] lstrlenW (lpString=".MDF") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".MDF") returned 0x0 [0088.587] lstrlenW (lpString=".DBF") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".DBF") returned 0x0 [0088.587] lstrlenW (lpString=".DB") returned 3 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".DB") returned 0x0 [0088.587] lstrlenW (lpString=".db") returned 3 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".db") returned 0x0 [0088.587] lstrlenW (lpString=".ndf") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".ndf") returned 0x0 [0088.587] lstrlenW (lpString=".NDF") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".NDF") returned 0x0 [0088.587] lstrlenW (lpString=".Mdf") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".Mdf") returned 0x0 [0088.587] lstrlenW (lpString=".dat") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".dat") returned 0x0 [0088.587] lstrlenW (lpString=".DAT") returned 4 [0088.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".DAT") returned 0x0 [0088.587] lstrlenW (lpString=".ldf") returned 4 [0088.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".ldf") returned 0x0 [0088.588] lstrlenW (lpString=".LDF") returned 4 [0088.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch=".LDF") returned 0x0 [0088.588] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.588] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.589] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.589] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20858986475) returned 1 [0088.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc39cead0, dwHighDateTime=0x1d585b4)) [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f000 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f000 | out: hHeap=0x260000) returned 1 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.590] GetLastError () returned 0x0 [0088.590] GetLastError () returned 0x0 [0088.590] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.590] GetLastError () returned 0x0 [0088.590] GetLastError () returned 0x0 [0088.592] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc5e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.592] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3a2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3a2, lpOverlapped=0x0) returned 1 [0088.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.592] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.592] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.592] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.592] CloseHandle (hObject=0x11c) returned 1 [0088.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css.[deadmin@cock.li].deadmin")) returned 1 [0088.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.594] GetLastError () returned 0x0 [0088.594] RtlWakeConditionVariable () returned 0x27e828 [0088.594] GetCurrentThreadId () returned 0x98c [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".ldf") returned 0x0 [0088.594] lstrlenW (lpString=".vhd") returned 4 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".vhd") returned 0x0 [0088.594] lstrlenW (lpString=".vhdx") returned 5 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".vhdx") returned 0x0 [0088.594] lstrlenW (lpString=".pst") returned 4 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".pst") returned 0x0 [0088.594] lstrlenW (lpString=".ost") returned 4 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".ost") returned 0x0 [0088.594] lstrlenW (lpString=".bak") returned 4 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".bak") returned 0x0 [0088.594] lstrlenW (lpString=".bac") returned 4 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".bac") returned 0x0 [0088.594] lstrlenW (lpString=".sys") returned 4 [0088.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".sys") returned 0x0 [0088.595] lstrlenW (lpString=".v2i") returned 4 [0088.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".v2i") returned 0x0 [0088.595] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.596] lstrlenW (lpString=".sql") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".sql") returned 0x0 [0088.596] lstrlenW (lpString=".mdf") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".mdf") returned 0x0 [0088.596] lstrlenW (lpString=".txt") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".txt") returned 0x0 [0088.596] lstrlenW (lpString=".dbf") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".dbf") returned 0x0 [0088.596] lstrlenW (lpString=".ckp") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".ckp") returned 0x0 [0088.596] lstrlenW (lpString=".dacpac") returned 7 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".dacpac") returned 0x0 [0088.596] lstrlenW (lpString=".db3") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".db3") returned 0x0 [0088.596] lstrlenW (lpString=".dtxs") returned 5 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".dtxs") returned 0x0 [0088.596] lstrlenW (lpString=".mdt") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".mdt") returned 0x0 [0088.596] lstrlenW (lpString=".sdf") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".sdf") returned 0x0 [0088.596] lstrlenW (lpString=".MDF") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".MDF") returned 0x0 [0088.596] lstrlenW (lpString=".DBF") returned 4 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".DBF") returned 0x0 [0088.596] lstrlenW (lpString=".DB") returned 3 [0088.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".DB") returned 0x0 [0088.596] lstrlenW (lpString=".db") returned 3 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".db") returned 0x0 [0088.597] lstrlenW (lpString=".ndf") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".ndf") returned 0x0 [0088.597] lstrlenW (lpString=".NDF") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".NDF") returned 0x0 [0088.597] lstrlenW (lpString=".Mdf") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".Mdf") returned 0x0 [0088.597] lstrlenW (lpString=".dat") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".dat") returned 0x0 [0088.597] lstrlenW (lpString=".DAT") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".DAT") returned 0x0 [0088.597] lstrlenW (lpString=".ldf") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".ldf") returned 0x0 [0088.597] lstrlenW (lpString=".LDF") returned 4 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch=".LDF") returned 0x0 [0088.597] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.597] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0088.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.598] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.598] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20859936886) returned 1 [0088.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc39f4c30, dwHighDateTime=0x1d585b4)) [0088.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f038 [0088.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f038 | out: hHeap=0x260000) returned 1 [0088.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0088.599] GetLastError () returned 0x0 [0088.599] GetLastError () returned 0x0 [0088.599] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0088.599] GetLastError () returned 0x0 [0088.600] GetLastError () returned 0x0 [0088.861] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.861] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x373, lpOverlapped=0x0) returned 1 [0088.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.951] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.952] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.952] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.952] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.952] CloseHandle (hObject=0x11c) returned 1 [0088.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css.[deadmin@cock.li].deadmin")) returned 1 [0088.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.954] GetLastError () returned 0x0 [0088.954] RtlWakeConditionVariable () returned 0x0 [0088.955] GetCurrentThreadId () returned 0x98c [0089.155] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.155] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.156] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.156] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.159] CloseHandle (hObject=0xf0) returned 1 [0089.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0089.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.159] RtlWakeConditionVariable () returned 0x0 [0089.159] GetCurrentThreadId () returned 0x98c [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".ldf") returned 0x0 [0089.160] lstrlenW (lpString=".vhd") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".vhd") returned 0x0 [0089.160] lstrlenW (lpString=".vhdx") returned 5 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".vhdx") returned 0x0 [0089.160] lstrlenW (lpString=".pst") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".pst") returned 0x0 [0089.160] lstrlenW (lpString=".ost") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".ost") returned 0x0 [0089.160] lstrlenW (lpString=".bak") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".bak") returned 0x0 [0089.160] lstrlenW (lpString=".bac") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".bac") returned 0x0 [0089.160] lstrlenW (lpString=".sys") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".sys") returned 0x0 [0089.160] lstrlenW (lpString=".v2i") returned 4 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".v2i") returned 0x0 [0089.160] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.162] lstrlenW (lpString=".sql") returned 4 [0089.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".sql") returned 0x0 [0089.162] lstrlenW (lpString=".mdf") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".mdf") returned 0x0 [0089.163] lstrlenW (lpString=".txt") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".txt") returned 0x0 [0089.163] lstrlenW (lpString=".dbf") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".dbf") returned 0x0 [0089.163] lstrlenW (lpString=".ckp") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".ckp") returned 0x0 [0089.163] lstrlenW (lpString=".dacpac") returned 7 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".dacpac") returned 0x0 [0089.163] lstrlenW (lpString=".db3") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".db3") returned 0x0 [0089.163] lstrlenW (lpString=".dtxs") returned 5 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".dtxs") returned 0x0 [0089.163] lstrlenW (lpString=".mdt") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".mdt") returned 0x0 [0089.163] lstrlenW (lpString=".sdf") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".sdf") returned 0x0 [0089.163] lstrlenW (lpString=".MDF") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".MDF") returned 0x0 [0089.163] lstrlenW (lpString=".DBF") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".DBF") returned 0x0 [0089.163] lstrlenW (lpString=".DB") returned 3 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".DB") returned 0x0 [0089.163] lstrlenW (lpString=".db") returned 3 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".db") returned 0x0 [0089.163] lstrlenW (lpString=".ndf") returned 4 [0089.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".ndf") returned 0x0 [0089.164] lstrlenW (lpString=".NDF") returned 4 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".NDF") returned 0x0 [0089.164] lstrlenW (lpString=".Mdf") returned 4 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".Mdf") returned 0x0 [0089.164] lstrlenW (lpString=".dat") returned 4 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".dat") returned 0x0 [0089.164] lstrlenW (lpString=".DAT") returned 4 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".DAT") returned 0x0 [0089.164] lstrlenW (lpString=".ldf") returned 4 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".ldf") returned 0x0 [0089.164] lstrlenW (lpString=".LDF") returned 4 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch=".LDF") returned 0x0 [0089.164] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.164] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.165] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.165] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.165] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20916629098) returned 1 [0089.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3f4fdb0, dwHighDateTime=0x1d585b4)) [0089.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c10 [0089.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c10 | out: hHeap=0x260000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.166] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.166] GetLastError () returned 0x0 [0089.166] GetLastError () returned 0x0 [0089.166] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.167] GetLastError () returned 0x0 [0089.167] GetLastError () returned 0x0 [0089.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff40e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.171] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbf2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xbf2, lpOverlapped=0x0) returned 1 [0089.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.172] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.172] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.172] CloseHandle (hObject=0xf0) returned 1 [0089.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css.[deadmin@cock.li].deadmin")) returned 1 [0089.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.175] GetLastError () returned 0x0 [0089.175] RtlWakeConditionVariable () returned 0x0 [0089.175] GetCurrentThreadId () returned 0x98c [0089.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".ldf") returned 0x0 [0089.175] lstrlenW (lpString=".vhd") returned 4 [0089.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".vhd") returned 0x0 [0089.175] lstrlenW (lpString=".vhdx") returned 5 [0089.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".vhdx") returned 0x0 [0089.175] lstrlenW (lpString=".pst") returned 4 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".pst") returned 0x0 [0089.176] lstrlenW (lpString=".ost") returned 4 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".ost") returned 0x0 [0089.176] lstrlenW (lpString=".bak") returned 4 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".bak") returned 0x0 [0089.176] lstrlenW (lpString=".bac") returned 4 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".bac") returned 0x0 [0089.176] lstrlenW (lpString=".sys") returned 4 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".sys") returned 0x0 [0089.176] lstrlenW (lpString=".v2i") returned 4 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".v2i") returned 0x0 [0089.176] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.178] lstrlenW (lpString=".sql") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".sql") returned 0x0 [0089.178] lstrlenW (lpString=".mdf") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".mdf") returned 0x0 [0089.178] lstrlenW (lpString=".txt") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".txt") returned 0x0 [0089.178] lstrlenW (lpString=".dbf") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".dbf") returned 0x0 [0089.178] lstrlenW (lpString=".ckp") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".ckp") returned 0x0 [0089.178] lstrlenW (lpString=".dacpac") returned 7 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".dacpac") returned 0x0 [0089.178] lstrlenW (lpString=".db3") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".db3") returned 0x0 [0089.178] lstrlenW (lpString=".dtxs") returned 5 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".dtxs") returned 0x0 [0089.178] lstrlenW (lpString=".mdt") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".mdt") returned 0x0 [0089.178] lstrlenW (lpString=".sdf") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".sdf") returned 0x0 [0089.178] lstrlenW (lpString=".MDF") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".MDF") returned 0x0 [0089.178] lstrlenW (lpString=".DBF") returned 4 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".DBF") returned 0x0 [0089.178] lstrlenW (lpString=".DB") returned 3 [0089.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".DB") returned 0x0 [0089.179] lstrlenW (lpString=".db") returned 3 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".db") returned 0x0 [0089.179] lstrlenW (lpString=".ndf") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".ndf") returned 0x0 [0089.179] lstrlenW (lpString=".NDF") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".NDF") returned 0x0 [0089.179] lstrlenW (lpString=".Mdf") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".Mdf") returned 0x0 [0089.179] lstrlenW (lpString=".dat") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".dat") returned 0x0 [0089.179] lstrlenW (lpString=".DAT") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".DAT") returned 0x0 [0089.179] lstrlenW (lpString=".ldf") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".ldf") returned 0x0 [0089.179] lstrlenW (lpString=".LDF") returned 4 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch=".LDF") returned 0x0 [0089.179] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.179] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.180] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.180] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.180] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20918142291) returned 1 [0089.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3f75f10, dwHighDateTime=0x1d585b4)) [0089.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c48 [0089.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c48 | out: hHeap=0x260000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.181] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.181] GetLastError () returned 0x0 [0089.181] GetLastError () returned 0x0 [0089.181] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.182] GetLastError () returned 0x0 [0089.182] GetLastError () returned 0x0 [0089.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc73, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.183] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x38d, lpOverlapped=0x0) returned 1 [0089.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.184] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.184] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.184] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.184] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.184] CloseHandle (hObject=0xf0) returned 1 [0089.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css.[deadmin@cock.li].deadmin")) returned 1 [0089.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.186] GetLastError () returned 0x0 [0089.186] RtlWakeConditionVariable () returned 0x0 [0089.186] GetCurrentThreadId () returned 0x98c [0089.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".ldf") returned 0x0 [0089.186] lstrlenW (lpString=".vhd") returned 4 [0089.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".vhd") returned 0x0 [0089.186] lstrlenW (lpString=".vhdx") returned 5 [0089.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".vhdx") returned 0x0 [0089.186] lstrlenW (lpString=".pst") returned 4 [0089.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".pst") returned 0x0 [0089.186] lstrlenW (lpString=".ost") returned 4 [0089.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".ost") returned 0x0 [0089.186] lstrlenW (lpString=".bak") returned 4 [0089.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".bak") returned 0x0 [0089.186] lstrlenW (lpString=".bac") returned 4 [0089.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".bac") returned 0x0 [0089.187] lstrlenW (lpString=".sys") returned 4 [0089.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".sys") returned 0x0 [0089.187] lstrlenW (lpString=".v2i") returned 4 [0089.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".v2i") returned 0x0 [0089.187] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.188] lstrlenW (lpString=".sql") returned 4 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".sql") returned 0x0 [0089.188] lstrlenW (lpString=".mdf") returned 4 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".mdf") returned 0x0 [0089.188] lstrlenW (lpString=".txt") returned 4 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".txt") returned 0x0 [0089.188] lstrlenW (lpString=".dbf") returned 4 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".dbf") returned 0x0 [0089.188] lstrlenW (lpString=".ckp") returned 4 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".ckp") returned 0x0 [0089.188] lstrlenW (lpString=".dacpac") returned 7 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".dacpac") returned 0x0 [0089.188] lstrlenW (lpString=".db3") returned 4 [0089.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".db3") returned 0x0 [0089.188] lstrlenW (lpString=".dtxs") returned 5 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".dtxs") returned 0x0 [0089.189] lstrlenW (lpString=".mdt") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".mdt") returned 0x0 [0089.189] lstrlenW (lpString=".sdf") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".sdf") returned 0x0 [0089.189] lstrlenW (lpString=".MDF") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".MDF") returned 0x0 [0089.189] lstrlenW (lpString=".DBF") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".DBF") returned 0x0 [0089.189] lstrlenW (lpString=".DB") returned 3 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".DB") returned 0x0 [0089.189] lstrlenW (lpString=".db") returned 3 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".db") returned 0x0 [0089.189] lstrlenW (lpString=".ndf") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".ndf") returned 0x0 [0089.189] lstrlenW (lpString=".NDF") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".NDF") returned 0x0 [0089.189] lstrlenW (lpString=".Mdf") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".Mdf") returned 0x0 [0089.189] lstrlenW (lpString=".dat") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".dat") returned 0x0 [0089.189] lstrlenW (lpString=".DAT") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".DAT") returned 0x0 [0089.189] lstrlenW (lpString=".ldf") returned 4 [0089.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".ldf") returned 0x0 [0089.190] lstrlenW (lpString=".LDF") returned 4 [0089.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch=".LDF") returned 0x0 [0089.190] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.190] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.191] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.191] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.191] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20919188945) returned 1 [0089.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3f9c070, dwHighDateTime=0x1d585b4)) [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c80 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c80 | out: hHeap=0x260000) returned 1 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.191] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.192] GetLastError () returned 0x0 [0089.192] GetLastError () returned 0x0 [0089.192] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.192] GetLastError () returned 0x0 [0089.192] GetLastError () returned 0x0 [0089.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.205] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x348, lpOverlapped=0x0) returned 1 [0089.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.208] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.208] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.208] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.208] CloseHandle (hObject=0xf0) returned 1 [0089.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x34e430 [0089.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css.[deadmin@cock.li].deadmin")) returned 1 [0089.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e430 | out: hHeap=0x260000) returned 1 [0089.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.211] GetLastError () returned 0x0 [0089.211] RtlWakeConditionVariable () returned 0x0 [0089.211] GetCurrentThreadId () returned 0x98c [0089.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.211] lstrlenW (lpString=".vhd") returned 4 [0089.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0089.211] lstrlenW (lpString=".vhdx") returned 5 [0089.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0089.211] lstrlenW (lpString=".pst") returned 4 [0089.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0089.211] lstrlenW (lpString=".ost") returned 4 [0089.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0089.211] lstrlenW (lpString=".bak") returned 4 [0089.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0089.212] lstrlenW (lpString=".bac") returned 4 [0089.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0089.212] lstrlenW (lpString=".sys") returned 4 [0089.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0089.212] lstrlenW (lpString=".v2i") returned 4 [0089.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0089.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.214] lstrlenW (lpString=".sql") returned 4 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0089.214] lstrlenW (lpString=".mdf") returned 4 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0089.214] lstrlenW (lpString=".txt") returned 4 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0089.214] lstrlenW (lpString=".dbf") returned 4 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0089.214] lstrlenW (lpString=".ckp") returned 4 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0089.214] lstrlenW (lpString=".dacpac") returned 7 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0089.214] lstrlenW (lpString=".db3") returned 4 [0089.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0089.214] lstrlenW (lpString=".dtxs") returned 5 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0089.215] lstrlenW (lpString=".mdt") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0089.215] lstrlenW (lpString=".sdf") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0089.215] lstrlenW (lpString=".MDF") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0089.215] lstrlenW (lpString=".DBF") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0089.215] lstrlenW (lpString=".DB") returned 3 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0089.215] lstrlenW (lpString=".db") returned 3 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0089.215] lstrlenW (lpString=".ndf") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0089.215] lstrlenW (lpString=".NDF") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0089.215] lstrlenW (lpString=".Mdf") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0089.215] lstrlenW (lpString=".dat") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0089.215] lstrlenW (lpString=".DAT") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0089.215] lstrlenW (lpString=".ldf") returned 4 [0089.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.215] lstrlenW (lpString=".LDF") returned 4 [0089.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0089.216] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.216] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.217] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.217] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20921790172) returned 1 [0089.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3fe8330, dwHighDateTime=0x1d585b4)) [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1cb8 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1cb8 | out: hHeap=0x260000) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.217] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.218] GetLastError () returned 0x0 [0089.218] GetLastError () returned 0x0 [0089.218] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.218] GetLastError () returned 0x0 [0089.218] GetLastError () returned 0x0 [0089.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.221] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x16c, lpOverlapped=0x0) returned 1 [0089.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.221] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.221] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.221] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.221] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.221] CloseHandle (hObject=0xf0) returned 1 [0089.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x34e430 [0089.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e430 | out: hHeap=0x260000) returned 1 [0089.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.224] GetLastError () returned 0x0 [0089.224] RtlWakeConditionVariable () returned 0x0 [0089.224] GetCurrentThreadId () returned 0x98c [0089.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.224] lstrlenW (lpString=".vhd") returned 4 [0089.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0089.225] lstrlenW (lpString=".vhdx") returned 5 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0089.225] lstrlenW (lpString=".pst") returned 4 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0089.225] lstrlenW (lpString=".ost") returned 4 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0089.225] lstrlenW (lpString=".bak") returned 4 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0089.225] lstrlenW (lpString=".bac") returned 4 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0089.225] lstrlenW (lpString=".sys") returned 4 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0089.225] lstrlenW (lpString=".v2i") returned 4 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0089.225] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.227] lstrlenW (lpString=".sql") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0089.227] lstrlenW (lpString=".mdf") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0089.227] lstrlenW (lpString=".txt") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0089.227] lstrlenW (lpString=".dbf") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0089.227] lstrlenW (lpString=".ckp") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0089.227] lstrlenW (lpString=".dacpac") returned 7 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0089.227] lstrlenW (lpString=".db3") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0089.227] lstrlenW (lpString=".dtxs") returned 5 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0089.227] lstrlenW (lpString=".mdt") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0089.227] lstrlenW (lpString=".sdf") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0089.227] lstrlenW (lpString=".MDF") returned 4 [0089.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0089.228] lstrlenW (lpString=".DBF") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0089.228] lstrlenW (lpString=".DB") returned 3 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0089.228] lstrlenW (lpString=".db") returned 3 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0089.228] lstrlenW (lpString=".ndf") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0089.228] lstrlenW (lpString=".NDF") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0089.228] lstrlenW (lpString=".Mdf") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0089.228] lstrlenW (lpString=".dat") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0089.228] lstrlenW (lpString=".DAT") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0089.228] lstrlenW (lpString=".ldf") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.228] lstrlenW (lpString=".LDF") returned 4 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0089.228] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.228] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.229] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.229] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20923061503) returned 1 [0089.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc3fe8330, dwHighDateTime=0x1d585b4)) [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1cf0 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1cf0 | out: hHeap=0x260000) returned 1 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.230] GetLastError () returned 0x0 [0089.231] GetLastError () returned 0x0 [0089.231] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.231] GetLastError () returned 0x0 [0089.231] GetLastError () returned 0x0 [0089.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.232] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x16c, lpOverlapped=0x0) returned 1 [0089.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.232] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.233] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.233] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.233] CloseHandle (hObject=0xf0) returned 1 [0089.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x34e430 [0089.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e430 | out: hHeap=0x260000) returned 1 [0089.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.234] GetLastError () returned 0x0 [0089.234] RtlWakeConditionVariable () returned 0x0 [0089.235] GetCurrentThreadId () returned 0x98c [0089.326] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.326] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.326] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.326] WriteFile (in: hFile=0x11c, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.328] CloseHandle (hObject=0x11c) returned 1 [0089.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a530 | out: hHeap=0x260000) returned 1 [0089.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.328] RtlWakeConditionVariable () returned 0x0 [0089.332] GetCurrentThreadId () returned 0x98c [0089.333] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.333] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.333] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.333] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.334] CloseHandle (hObject=0xe4) returned 1 [0089.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e308 | out: hHeap=0x260000) returned 1 [0089.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.335] RtlWakeConditionVariable () returned 0x0 [0089.335] GetCurrentThreadId () returned 0x98c [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".ldf") returned 0x0 [0089.335] lstrlenW (lpString=".vhd") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".vhd") returned 0x0 [0089.335] lstrlenW (lpString=".vhdx") returned 5 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".vhdx") returned 0x0 [0089.335] lstrlenW (lpString=".pst") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".pst") returned 0x0 [0089.335] lstrlenW (lpString=".ost") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".ost") returned 0x0 [0089.335] lstrlenW (lpString=".bak") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".bak") returned 0x0 [0089.335] lstrlenW (lpString=".bac") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".bac") returned 0x0 [0089.335] lstrlenW (lpString=".sys") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".sys") returned 0x0 [0089.335] lstrlenW (lpString=".v2i") returned 4 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".v2i") returned 0x0 [0089.335] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.336] lstrlenW (lpString=".sql") returned 4 [0089.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".sql") returned 0x0 [0089.336] lstrlenW (lpString=".mdf") returned 4 [0089.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".mdf") returned 0x0 [0089.337] lstrlenW (lpString=".txt") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".txt") returned 0x0 [0089.337] lstrlenW (lpString=".dbf") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".dbf") returned 0x0 [0089.337] lstrlenW (lpString=".ckp") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".ckp") returned 0x0 [0089.337] lstrlenW (lpString=".dacpac") returned 7 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".dacpac") returned 0x0 [0089.337] lstrlenW (lpString=".db3") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".db3") returned 0x0 [0089.337] lstrlenW (lpString=".dtxs") returned 5 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".dtxs") returned 0x0 [0089.337] lstrlenW (lpString=".mdt") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".mdt") returned 0x0 [0089.337] lstrlenW (lpString=".sdf") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".sdf") returned 0x0 [0089.337] lstrlenW (lpString=".MDF") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".MDF") returned 0x0 [0089.337] lstrlenW (lpString=".DBF") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".DBF") returned 0x0 [0089.337] lstrlenW (lpString=".DB") returned 3 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".DB") returned 0x0 [0089.337] lstrlenW (lpString=".db") returned 3 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".db") returned 0x0 [0089.337] lstrlenW (lpString=".ndf") returned 4 [0089.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".ndf") returned 0x0 [0089.338] lstrlenW (lpString=".NDF") returned 4 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".NDF") returned 0x0 [0089.338] lstrlenW (lpString=".Mdf") returned 4 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".Mdf") returned 0x0 [0089.338] lstrlenW (lpString=".dat") returned 4 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".dat") returned 0x0 [0089.338] lstrlenW (lpString=".DAT") returned 4 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".DAT") returned 0x0 [0089.338] lstrlenW (lpString=".ldf") returned 4 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".ldf") returned 0x0 [0089.338] lstrlenW (lpString=".LDF") returned 4 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch=".LDF") returned 0x0 [0089.338] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.338] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.339] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.339] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20934021975) returned 1 [0089.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc40f2cd0, dwHighDateTime=0x1d585b4)) [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951f8 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0089.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.340] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.340] GetLastError () returned 0x0 [0089.340] GetLastError () returned 0x0 [0089.340] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.340] GetLastError () returned 0x0 [0089.340] GetLastError () returned 0x0 [0089.342] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff3c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.342] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc3a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc3a, lpOverlapped=0x0) returned 1 [0089.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.342] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.342] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.342] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.343] CloseHandle (hObject=0xe4) returned 1 [0089.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css.[deadmin@cock.li].deadmin")) returned 1 [0089.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.344] GetLastError () returned 0x0 [0089.344] RtlWakeConditionVariable () returned 0x0 [0089.344] GetCurrentThreadId () returned 0x98c [0089.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".ldf") returned 0x0 [0089.344] lstrlenW (lpString=".vhd") returned 4 [0089.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".vhd") returned 0x0 [0089.344] lstrlenW (lpString=".vhdx") returned 5 [0089.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".vhdx") returned 0x0 [0089.344] lstrlenW (lpString=".pst") returned 4 [0089.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".pst") returned 0x0 [0089.344] lstrlenW (lpString=".ost") returned 4 [0089.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".ost") returned 0x0 [0089.345] lstrlenW (lpString=".bak") returned 4 [0089.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".bak") returned 0x0 [0089.345] lstrlenW (lpString=".bac") returned 4 [0089.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".bac") returned 0x0 [0089.345] lstrlenW (lpString=".sys") returned 4 [0089.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".sys") returned 0x0 [0089.345] lstrlenW (lpString=".v2i") returned 4 [0089.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".v2i") returned 0x0 [0089.345] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.346] lstrlenW (lpString=".sql") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".sql") returned 0x0 [0089.346] lstrlenW (lpString=".mdf") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".mdf") returned 0x0 [0089.346] lstrlenW (lpString=".txt") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".txt") returned 0x0 [0089.346] lstrlenW (lpString=".dbf") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".dbf") returned 0x0 [0089.346] lstrlenW (lpString=".ckp") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".ckp") returned 0x0 [0089.346] lstrlenW (lpString=".dacpac") returned 7 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".dacpac") returned 0x0 [0089.346] lstrlenW (lpString=".db3") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".db3") returned 0x0 [0089.346] lstrlenW (lpString=".dtxs") returned 5 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".dtxs") returned 0x0 [0089.346] lstrlenW (lpString=".mdt") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".mdt") returned 0x0 [0089.346] lstrlenW (lpString=".sdf") returned 4 [0089.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".sdf") returned 0x0 [0089.346] lstrlenW (lpString=".MDF") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".MDF") returned 0x0 [0089.347] lstrlenW (lpString=".DBF") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".DBF") returned 0x0 [0089.347] lstrlenW (lpString=".DB") returned 3 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".DB") returned 0x0 [0089.347] lstrlenW (lpString=".db") returned 3 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".db") returned 0x0 [0089.347] lstrlenW (lpString=".ndf") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".ndf") returned 0x0 [0089.347] lstrlenW (lpString=".NDF") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".NDF") returned 0x0 [0089.347] lstrlenW (lpString=".Mdf") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".Mdf") returned 0x0 [0089.347] lstrlenW (lpString=".dat") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".dat") returned 0x0 [0089.347] lstrlenW (lpString=".DAT") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".DAT") returned 0x0 [0089.347] lstrlenW (lpString=".ldf") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".ldf") returned 0x0 [0089.347] lstrlenW (lpString=".LDF") returned 4 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch=".LDF") returned 0x0 [0089.347] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.347] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.348] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.348] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.348] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20934953034) returned 1 [0089.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4118e30, dwHighDateTime=0x1d585b4)) [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c98 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c98 | out: hHeap=0x260000) returned 1 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.349] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.349] GetLastError () returned 0x0 [0089.349] GetLastError () returned 0x0 [0089.350] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.350] GetLastError () returned 0x0 [0089.350] GetLastError () returned 0x0 [0089.374] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff8ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.374] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x736, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x736, lpOverlapped=0x0) returned 1 [0089.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.375] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.375] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.375] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.375] CloseHandle (hObject=0xe4) returned 1 [0089.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css.[deadmin@cock.li].deadmin")) returned 1 [0089.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.376] GetLastError () returned 0x0 [0089.376] RtlWakeConditionVariable () returned 0x0 [0089.376] GetCurrentThreadId () returned 0x98c [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0089.377] lstrlenW (lpString=".vhd") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".vhd") returned 0x0 [0089.377] lstrlenW (lpString=".vhdx") returned 5 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".vhdx") returned 0x0 [0089.377] lstrlenW (lpString=".pst") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".pst") returned 0x0 [0089.377] lstrlenW (lpString=".ost") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".ost") returned 0x0 [0089.377] lstrlenW (lpString=".bak") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".bak") returned 0x0 [0089.377] lstrlenW (lpString=".bac") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".bac") returned 0x0 [0089.377] lstrlenW (lpString=".sys") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".sys") returned 0x0 [0089.377] lstrlenW (lpString=".v2i") returned 4 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".v2i") returned 0x0 [0089.377] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.378] lstrlenW (lpString=".sql") returned 4 [0089.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".sql") returned 0x0 [0089.378] lstrlenW (lpString=".mdf") returned 4 [0089.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".mdf") returned 0x0 [0089.378] lstrlenW (lpString=".txt") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".txt") returned 0x0 [0089.379] lstrlenW (lpString=".dbf") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".dbf") returned 0x0 [0089.379] lstrlenW (lpString=".ckp") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".ckp") returned 0x0 [0089.379] lstrlenW (lpString=".dacpac") returned 7 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".dacpac") returned 0x0 [0089.379] lstrlenW (lpString=".db3") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".db3") returned 0x0 [0089.379] lstrlenW (lpString=".dtxs") returned 5 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".dtxs") returned 0x0 [0089.379] lstrlenW (lpString=".mdt") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".mdt") returned 0x0 [0089.379] lstrlenW (lpString=".sdf") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".sdf") returned 0x0 [0089.379] lstrlenW (lpString=".MDF") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".MDF") returned 0x0 [0089.379] lstrlenW (lpString=".DBF") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".DBF") returned 0x0 [0089.379] lstrlenW (lpString=".DB") returned 3 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".DB") returned 0x0 [0089.379] lstrlenW (lpString=".db") returned 3 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".db") returned 0x0 [0089.379] lstrlenW (lpString=".ndf") returned 4 [0089.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".ndf") returned 0x0 [0089.379] lstrlenW (lpString=".NDF") returned 4 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".NDF") returned 0x0 [0089.380] lstrlenW (lpString=".Mdf") returned 4 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".Mdf") returned 0x0 [0089.380] lstrlenW (lpString=".dat") returned 4 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".dat") returned 0x0 [0089.380] lstrlenW (lpString=".DAT") returned 4 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".DAT") returned 0x0 [0089.380] lstrlenW (lpString=".ldf") returned 4 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0089.380] lstrlenW (lpString=".LDF") returned 4 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch=".LDF") returned 0x0 [0089.380] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.380] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.381] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.381] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.381] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20938368277) returned 1 [0089.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc41650f0, dwHighDateTime=0x1d585b4)) [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bf0 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.383] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.383] GetLastError () returned 0x0 [0089.384] GetLastError () returned 0x0 [0089.384] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.384] GetLastError () returned 0x0 [0089.384] GetLastError () returned 0x0 [0089.385] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.385] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0089.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.385] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.385] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.386] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.386] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.386] CloseHandle (hObject=0xe4) returned 1 [0089.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.579] GetLastError () returned 0x0 [0089.579] RtlWakeConditionVariable () returned 0x0 [0089.579] GetCurrentThreadId () returned 0x98c [0089.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".ldf") returned 0x0 [0089.579] lstrlenW (lpString=".vhd") returned 4 [0089.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".vhd") returned 0x0 [0089.579] lstrlenW (lpString=".vhdx") returned 5 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".vhdx") returned 0x0 [0089.580] lstrlenW (lpString=".pst") returned 4 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".pst") returned 0x0 [0089.580] lstrlenW (lpString=".ost") returned 4 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".ost") returned 0x0 [0089.580] lstrlenW (lpString=".bak") returned 4 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".bak") returned 0x0 [0089.580] lstrlenW (lpString=".bac") returned 4 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".bac") returned 0x0 [0089.580] lstrlenW (lpString=".sys") returned 4 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".sys") returned 0x0 [0089.580] lstrlenW (lpString=".v2i") returned 4 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".v2i") returned 0x0 [0089.580] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch="s\r\n.v2i") returned 0x0 [0089.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.582] lstrlenW (lpString=".sql") returned 4 [0089.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".sql") returned 0x0 [0089.582] lstrlenW (lpString=".mdf") returned 4 [0089.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".mdf") returned 0x0 [0089.582] lstrlenW (lpString=".txt") returned 4 [0089.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".txt") returned 0x0 [0089.582] lstrlenW (lpString=".dbf") returned 4 [0089.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".dbf") returned 0x0 [0089.582] lstrlenW (lpString=".ckp") returned 4 [0089.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".ckp") returned 0x0 [0089.582] lstrlenW (lpString=".dacpac") returned 7 [0089.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".dacpac") returned 0x0 [0089.582] lstrlenW (lpString=".db3") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".db3") returned 0x0 [0089.583] lstrlenW (lpString=".dtxs") returned 5 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".dtxs") returned 0x0 [0089.583] lstrlenW (lpString=".mdt") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".mdt") returned 0x0 [0089.583] lstrlenW (lpString=".sdf") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".sdf") returned 0x0 [0089.583] lstrlenW (lpString=".MDF") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".MDF") returned 0x0 [0089.583] lstrlenW (lpString=".DBF") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".DBF") returned 0x0 [0089.583] lstrlenW (lpString=".DB") returned 3 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".DB") returned 0x0 [0089.583] lstrlenW (lpString=".db") returned 3 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".db") returned 0x0 [0089.583] lstrlenW (lpString=".ndf") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".ndf") returned 0x0 [0089.583] lstrlenW (lpString=".NDF") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".NDF") returned 0x0 [0089.583] lstrlenW (lpString=".Mdf") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".Mdf") returned 0x0 [0089.583] lstrlenW (lpString=".dat") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".dat") returned 0x0 [0089.583] lstrlenW (lpString=".DAT") returned 4 [0089.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".DAT") returned 0x0 [0089.583] lstrlenW (lpString=".ldf") returned 4 [0089.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".ldf") returned 0x0 [0089.584] lstrlenW (lpString=".LDF") returned 4 [0089.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch=".LDF") returned 0x0 [0089.584] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.584] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.585] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.585] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20958595048) returned 1 [0089.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc43542d0, dwHighDateTime=0x1d585b4)) [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762878 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762878 | out: hHeap=0x260000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.586] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.586] GetLastError () returned 0x0 [0089.586] GetLastError () returned 0x0 [0089.586] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.586] GetLastError () returned 0x0 [0089.586] GetLastError () returned 0x0 [0089.589] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdc13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.589] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x23ed, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x23ed, lpOverlapped=0x0) returned 1 [0089.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0089.589] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.590] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.590] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.590] CloseHandle (hObject=0xe4) returned 1 [0089.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0089.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js.[deadmin@cock.li].deadmin")) returned 1 [0089.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0089.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.592] GetLastError () returned 0x0 [0089.593] RtlWakeConditionVariable () returned 0x0 [0089.593] GetCurrentThreadId () returned 0x98c [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".ldf") returned 0x0 [0089.593] lstrlenW (lpString=".vhd") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".vhd") returned 0x0 [0089.593] lstrlenW (lpString=".vhdx") returned 5 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".vhdx") returned 0x0 [0089.593] lstrlenW (lpString=".pst") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".pst") returned 0x0 [0089.593] lstrlenW (lpString=".ost") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".ost") returned 0x0 [0089.593] lstrlenW (lpString=".bak") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".bak") returned 0x0 [0089.593] lstrlenW (lpString=".bac") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".bac") returned 0x0 [0089.593] lstrlenW (lpString=".sys") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".sys") returned 0x0 [0089.593] lstrlenW (lpString=".v2i") returned 4 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".v2i") returned 0x0 [0089.593] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.595] lstrlenW (lpString=".sql") returned 4 [0089.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".sql") returned 0x0 [0089.595] lstrlenW (lpString=".mdf") returned 4 [0089.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".mdf") returned 0x0 [0089.595] lstrlenW (lpString=".txt") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".txt") returned 0x0 [0089.596] lstrlenW (lpString=".dbf") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".dbf") returned 0x0 [0089.596] lstrlenW (lpString=".ckp") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".ckp") returned 0x0 [0089.596] lstrlenW (lpString=".dacpac") returned 7 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".dacpac") returned 0x0 [0089.596] lstrlenW (lpString=".db3") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".db3") returned 0x0 [0089.596] lstrlenW (lpString=".dtxs") returned 5 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".dtxs") returned 0x0 [0089.596] lstrlenW (lpString=".mdt") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".mdt") returned 0x0 [0089.596] lstrlenW (lpString=".sdf") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".sdf") returned 0x0 [0089.596] lstrlenW (lpString=".MDF") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".MDF") returned 0x0 [0089.596] lstrlenW (lpString=".DBF") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".DBF") returned 0x0 [0089.596] lstrlenW (lpString=".DB") returned 3 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".DB") returned 0x0 [0089.596] lstrlenW (lpString=".db") returned 3 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".db") returned 0x0 [0089.596] lstrlenW (lpString=".ndf") returned 4 [0089.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".ndf") returned 0x0 [0089.596] lstrlenW (lpString=".NDF") returned 4 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".NDF") returned 0x0 [0089.597] lstrlenW (lpString=".Mdf") returned 4 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".Mdf") returned 0x0 [0089.597] lstrlenW (lpString=".dat") returned 4 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".dat") returned 0x0 [0089.597] lstrlenW (lpString=".DAT") returned 4 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".DAT") returned 0x0 [0089.597] lstrlenW (lpString=".ldf") returned 4 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".ldf") returned 0x0 [0089.597] lstrlenW (lpString=".LDF") returned 4 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch=".LDF") returned 0x0 [0089.597] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.597] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.598] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.598] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20959940106) returned 1 [0089.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc437a430, dwHighDateTime=0x1d585b4)) [0089.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x290f0a8 [0089.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290f0a8 | out: hHeap=0x260000) returned 1 [0089.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.599] GetLastError () returned 0x0 [0089.599] GetLastError () returned 0x0 [0089.600] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.600] GetLastError () returned 0x0 [0089.600] GetLastError () returned 0x0 [0089.601] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.601] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x267, lpOverlapped=0x0) returned 1 [0089.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0089.601] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.601] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.601] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.601] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.602] CloseHandle (hObject=0xe4) returned 1 [0089.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0089.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0089.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.604] GetLastError () returned 0x0 [0089.604] RtlWakeConditionVariable () returned 0x27e828 [0089.604] GetCurrentThreadId () returned 0x98c [0089.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".ldf") returned 0x0 [0089.604] lstrlenW (lpString=".vhd") returned 4 [0089.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".vhd") returned 0x0 [0089.605] lstrlenW (lpString=".vhdx") returned 5 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".vhdx") returned 0x0 [0089.605] lstrlenW (lpString=".pst") returned 4 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".pst") returned 0x0 [0089.605] lstrlenW (lpString=".ost") returned 4 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".ost") returned 0x0 [0089.605] lstrlenW (lpString=".bak") returned 4 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".bak") returned 0x0 [0089.605] lstrlenW (lpString=".bac") returned 4 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".bac") returned 0x0 [0089.605] lstrlenW (lpString=".sys") returned 4 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".sys") returned 0x0 [0089.605] lstrlenW (lpString=".v2i") returned 4 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".v2i") returned 0x0 [0089.605] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.607] lstrlenW (lpString=".sql") returned 4 [0089.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".sql") returned 0x0 [0089.607] lstrlenW (lpString=".mdf") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".mdf") returned 0x0 [0089.608] lstrlenW (lpString=".txt") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".txt") returned 0x0 [0089.608] lstrlenW (lpString=".dbf") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".dbf") returned 0x0 [0089.608] lstrlenW (lpString=".ckp") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".ckp") returned 0x0 [0089.608] lstrlenW (lpString=".dacpac") returned 7 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".dacpac") returned 0x0 [0089.608] lstrlenW (lpString=".db3") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".db3") returned 0x0 [0089.608] lstrlenW (lpString=".dtxs") returned 5 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".dtxs") returned 0x0 [0089.608] lstrlenW (lpString=".mdt") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".mdt") returned 0x0 [0089.608] lstrlenW (lpString=".sdf") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".sdf") returned 0x0 [0089.608] lstrlenW (lpString=".MDF") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".MDF") returned 0x0 [0089.608] lstrlenW (lpString=".DBF") returned 4 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".DBF") returned 0x0 [0089.608] lstrlenW (lpString=".DB") returned 3 [0089.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".DB") returned 0x0 [0089.608] lstrlenW (lpString=".db") returned 3 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".db") returned 0x0 [0089.609] lstrlenW (lpString=".ndf") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".ndf") returned 0x0 [0089.609] lstrlenW (lpString=".NDF") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".NDF") returned 0x0 [0089.609] lstrlenW (lpString=".Mdf") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".Mdf") returned 0x0 [0089.609] lstrlenW (lpString=".dat") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".dat") returned 0x0 [0089.609] lstrlenW (lpString=".DAT") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".DAT") returned 0x0 [0089.609] lstrlenW (lpString=".ldf") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".ldf") returned 0x0 [0089.609] lstrlenW (lpString=".LDF") returned 4 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch=".LDF") returned 0x0 [0089.609] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.609] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.610] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.610] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20961139676) returned 1 [0089.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc43a0590, dwHighDateTime=0x1d585b4)) [0089.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d81e8 [0089.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81e8 | out: hHeap=0x260000) returned 1 [0089.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.611] GetLastError () returned 0x0 [0089.612] GetLastError () returned 0x0 [0089.612] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.612] GetLastError () returned 0x0 [0089.612] GetLastError () returned 0x0 [0089.625] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.625] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0089.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0089.629] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.629] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.630] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.630] CloseHandle (hObject=0xe4) returned 1 [0089.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.634] GetLastError () returned 0x0 [0089.634] RtlWakeConditionVariable () returned 0x0 [0089.634] GetCurrentThreadId () returned 0x98c [0089.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".ldf") returned 0x0 [0089.634] lstrlenW (lpString=".vhd") returned 4 [0089.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".vhd") returned 0x0 [0089.634] lstrlenW (lpString=".vhdx") returned 5 [0089.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".vhdx") returned 0x0 [0089.634] lstrlenW (lpString=".pst") returned 4 [0089.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".pst") returned 0x0 [0089.634] lstrlenW (lpString=".ost") returned 4 [0089.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".ost") returned 0x0 [0089.635] lstrlenW (lpString=".bak") returned 4 [0089.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".bak") returned 0x0 [0089.635] lstrlenW (lpString=".bac") returned 4 [0089.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".bac") returned 0x0 [0089.635] lstrlenW (lpString=".sys") returned 4 [0089.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".sys") returned 0x0 [0089.635] lstrlenW (lpString=".v2i") returned 4 [0089.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".v2i") returned 0x0 [0089.635] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.639] lstrlenW (lpString=".sql") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".sql") returned 0x0 [0089.639] lstrlenW (lpString=".mdf") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".mdf") returned 0x0 [0089.639] lstrlenW (lpString=".txt") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".txt") returned 0x0 [0089.639] lstrlenW (lpString=".dbf") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".dbf") returned 0x0 [0089.639] lstrlenW (lpString=".ckp") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".ckp") returned 0x0 [0089.639] lstrlenW (lpString=".dacpac") returned 7 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".dacpac") returned 0x0 [0089.639] lstrlenW (lpString=".db3") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".db3") returned 0x0 [0089.639] lstrlenW (lpString=".dtxs") returned 5 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".dtxs") returned 0x0 [0089.639] lstrlenW (lpString=".mdt") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".mdt") returned 0x0 [0089.639] lstrlenW (lpString=".sdf") returned 4 [0089.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".sdf") returned 0x0 [0089.639] lstrlenW (lpString=".MDF") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".MDF") returned 0x0 [0089.640] lstrlenW (lpString=".DBF") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".DBF") returned 0x0 [0089.640] lstrlenW (lpString=".DB") returned 3 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".DB") returned 0x0 [0089.640] lstrlenW (lpString=".db") returned 3 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".db") returned 0x0 [0089.640] lstrlenW (lpString=".ndf") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".ndf") returned 0x0 [0089.640] lstrlenW (lpString=".NDF") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".NDF") returned 0x0 [0089.640] lstrlenW (lpString=".Mdf") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".Mdf") returned 0x0 [0089.640] lstrlenW (lpString=".dat") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".dat") returned 0x0 [0089.640] lstrlenW (lpString=".DAT") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".DAT") returned 0x0 [0089.640] lstrlenW (lpString=".ldf") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".ldf") returned 0x0 [0089.640] lstrlenW (lpString=".LDF") returned 4 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch=".LDF") returned 0x0 [0089.640] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.641] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.643] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.644] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20964467605) returned 1 [0089.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc43ec850, dwHighDateTime=0x1d585b4)) [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d81b0 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81b0 | out: hHeap=0x260000) returned 1 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.644] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.644] GetLastError () returned 0x0 [0089.645] GetLastError () returned 0x0 [0089.645] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.645] GetLastError () returned 0x0 [0089.645] GetLastError () returned 0x0 [0089.649] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.649] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x350, lpOverlapped=0x0) returned 1 [0089.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.649] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.649] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.649] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.649] CloseHandle (hObject=0xe4) returned 1 [0089.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0089.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.653] GetLastError () returned 0x0 [0089.653] RtlWakeConditionVariable () returned 0x0 [0089.653] GetCurrentThreadId () returned 0x98c [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".ldf") returned 0x0 [0089.653] lstrlenW (lpString=".vhd") returned 4 [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".vhd") returned 0x0 [0089.653] lstrlenW (lpString=".vhdx") returned 5 [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".vhdx") returned 0x0 [0089.653] lstrlenW (lpString=".pst") returned 4 [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".pst") returned 0x0 [0089.653] lstrlenW (lpString=".ost") returned 4 [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".ost") returned 0x0 [0089.653] lstrlenW (lpString=".bak") returned 4 [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".bak") returned 0x0 [0089.653] lstrlenW (lpString=".bac") returned 4 [0089.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".bac") returned 0x0 [0089.654] lstrlenW (lpString=".sys") returned 4 [0089.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".sys") returned 0x0 [0089.654] lstrlenW (lpString=".v2i") returned 4 [0089.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".v2i") returned 0x0 [0089.654] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.657] lstrlenW (lpString=".sql") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".sql") returned 0x0 [0089.657] lstrlenW (lpString=".mdf") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".mdf") returned 0x0 [0089.657] lstrlenW (lpString=".txt") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".txt") returned 0x0 [0089.657] lstrlenW (lpString=".dbf") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".dbf") returned 0x0 [0089.657] lstrlenW (lpString=".ckp") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".ckp") returned 0x0 [0089.657] lstrlenW (lpString=".dacpac") returned 7 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".dacpac") returned 0x0 [0089.657] lstrlenW (lpString=".db3") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".db3") returned 0x0 [0089.657] lstrlenW (lpString=".dtxs") returned 5 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".dtxs") returned 0x0 [0089.657] lstrlenW (lpString=".mdt") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".mdt") returned 0x0 [0089.657] lstrlenW (lpString=".sdf") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".sdf") returned 0x0 [0089.657] lstrlenW (lpString=".MDF") returned 4 [0089.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".MDF") returned 0x0 [0089.658] lstrlenW (lpString=".DBF") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".DBF") returned 0x0 [0089.658] lstrlenW (lpString=".DB") returned 3 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".DB") returned 0x0 [0089.658] lstrlenW (lpString=".db") returned 3 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".db") returned 0x0 [0089.658] lstrlenW (lpString=".ndf") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".ndf") returned 0x0 [0089.658] lstrlenW (lpString=".NDF") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".NDF") returned 0x0 [0089.658] lstrlenW (lpString=".Mdf") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".Mdf") returned 0x0 [0089.658] lstrlenW (lpString=".dat") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".dat") returned 0x0 [0089.658] lstrlenW (lpString=".DAT") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".DAT") returned 0x0 [0089.658] lstrlenW (lpString=".ldf") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".ldf") returned 0x0 [0089.658] lstrlenW (lpString=".LDF") returned 4 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch=".LDF") returned 0x0 [0089.658] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.658] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.659] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.659] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.659] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20966058737) returned 1 [0089.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc44129b0, dwHighDateTime=0x1d585b4)) [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8220 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8220 | out: hHeap=0x260000) returned 1 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.660] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.660] GetLastError () returned 0x0 [0089.661] GetLastError () returned 0x0 [0089.661] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.661] GetLastError () returned 0x0 [0089.661] GetLastError () returned 0x0 [0089.703] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.703] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x34f, lpOverlapped=0x0) returned 1 [0089.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.703] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.703] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.704] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.704] CloseHandle (hObject=0xe4) returned 1 [0089.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.966] GetLastError () returned 0x0 [0089.966] RtlWakeConditionVariable () returned 0x0 [0089.966] GetCurrentThreadId () returned 0x98c [0089.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".ldf") returned 0x0 [0089.966] lstrlenW (lpString=".vhd") returned 4 [0089.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".vhd") returned 0x0 [0089.966] lstrlenW (lpString=".vhdx") returned 5 [0089.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".vhdx") returned 0x0 [0089.966] lstrlenW (lpString=".pst") returned 4 [0089.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".pst") returned 0x0 [0089.966] lstrlenW (lpString=".ost") returned 4 [0089.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".ost") returned 0x0 [0089.967] lstrlenW (lpString=".bak") returned 4 [0089.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".bak") returned 0x0 [0089.967] lstrlenW (lpString=".bac") returned 4 [0089.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".bac") returned 0x0 [0089.967] lstrlenW (lpString=".sys") returned 4 [0089.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".sys") returned 0x0 [0089.967] lstrlenW (lpString=".v2i") returned 4 [0089.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".v2i") returned 0x0 [0089.967] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.968] lstrlenW (lpString=".sql") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".sql") returned 0x0 [0089.968] lstrlenW (lpString=".mdf") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".mdf") returned 0x0 [0089.968] lstrlenW (lpString=".txt") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".txt") returned 0x0 [0089.968] lstrlenW (lpString=".dbf") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".dbf") returned 0x0 [0089.968] lstrlenW (lpString=".ckp") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".ckp") returned 0x0 [0089.968] lstrlenW (lpString=".dacpac") returned 7 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".dacpac") returned 0x0 [0089.968] lstrlenW (lpString=".db3") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".db3") returned 0x0 [0089.968] lstrlenW (lpString=".dtxs") returned 5 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".dtxs") returned 0x0 [0089.968] lstrlenW (lpString=".mdt") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".mdt") returned 0x0 [0089.968] lstrlenW (lpString=".sdf") returned 4 [0089.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".sdf") returned 0x0 [0089.969] lstrlenW (lpString=".MDF") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".MDF") returned 0x0 [0089.969] lstrlenW (lpString=".DBF") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".DBF") returned 0x0 [0089.969] lstrlenW (lpString=".DB") returned 3 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".DB") returned 0x0 [0089.969] lstrlenW (lpString=".db") returned 3 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".db") returned 0x0 [0089.969] lstrlenW (lpString=".ndf") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".ndf") returned 0x0 [0089.969] lstrlenW (lpString=".NDF") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".NDF") returned 0x0 [0089.969] lstrlenW (lpString=".Mdf") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".Mdf") returned 0x0 [0089.969] lstrlenW (lpString=".dat") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".dat") returned 0x0 [0089.969] lstrlenW (lpString=".DAT") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".DAT") returned 0x0 [0089.969] lstrlenW (lpString=".ldf") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".ldf") returned 0x0 [0089.969] lstrlenW (lpString=".LDF") returned 4 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch=".LDF") returned 0x0 [0089.969] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.970] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.970] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.970] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20997162978) returned 1 [0089.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc470c530, dwHighDateTime=0x1d585b4)) [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b42c0 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b42c0 | out: hHeap=0x260000) returned 1 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.971] GetLastError () returned 0x0 [0089.972] GetLastError () returned 0x0 [0089.972] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.972] GetLastError () returned 0x0 [0089.972] GetLastError () returned 0x0 [0089.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.973] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x352, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x352, lpOverlapped=0x0) returned 1 [0089.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.974] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.974] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.974] CloseHandle (hObject=0xf0) returned 1 [0089.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.978] GetLastError () returned 0x0 [0089.978] RtlWakeConditionVariable () returned 0x0 [0089.978] GetCurrentThreadId () returned 0x98c [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".ldf") returned 0x0 [0089.979] lstrlenW (lpString=".vhd") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".vhd") returned 0x0 [0089.979] lstrlenW (lpString=".vhdx") returned 5 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".vhdx") returned 0x0 [0089.979] lstrlenW (lpString=".pst") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".pst") returned 0x0 [0089.979] lstrlenW (lpString=".ost") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".ost") returned 0x0 [0089.979] lstrlenW (lpString=".bak") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".bak") returned 0x0 [0089.979] lstrlenW (lpString=".bac") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".bac") returned 0x0 [0089.979] lstrlenW (lpString=".sys") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".sys") returned 0x0 [0089.979] lstrlenW (lpString=".v2i") returned 4 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".v2i") returned 0x0 [0089.979] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.982] lstrlenW (lpString=".sql") returned 4 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".sql") returned 0x0 [0089.982] lstrlenW (lpString=".mdf") returned 4 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".mdf") returned 0x0 [0089.982] lstrlenW (lpString=".txt") returned 4 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".txt") returned 0x0 [0089.982] lstrlenW (lpString=".dbf") returned 4 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".dbf") returned 0x0 [0089.982] lstrlenW (lpString=".ckp") returned 4 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".ckp") returned 0x0 [0089.982] lstrlenW (lpString=".dacpac") returned 7 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".dacpac") returned 0x0 [0089.982] lstrlenW (lpString=".db3") returned 4 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".db3") returned 0x0 [0089.982] lstrlenW (lpString=".dtxs") returned 5 [0089.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".dtxs") returned 0x0 [0089.982] lstrlenW (lpString=".mdt") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".mdt") returned 0x0 [0089.983] lstrlenW (lpString=".sdf") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".sdf") returned 0x0 [0089.983] lstrlenW (lpString=".MDF") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".MDF") returned 0x0 [0089.983] lstrlenW (lpString=".DBF") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".DBF") returned 0x0 [0089.983] lstrlenW (lpString=".DB") returned 3 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".DB") returned 0x0 [0089.983] lstrlenW (lpString=".db") returned 3 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".db") returned 0x0 [0089.983] lstrlenW (lpString=".ndf") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".ndf") returned 0x0 [0089.983] lstrlenW (lpString=".NDF") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".NDF") returned 0x0 [0089.983] lstrlenW (lpString=".Mdf") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".Mdf") returned 0x0 [0089.983] lstrlenW (lpString=".dat") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".dat") returned 0x0 [0089.983] lstrlenW (lpString=".DAT") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".DAT") returned 0x0 [0089.983] lstrlenW (lpString=".ldf") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".ldf") returned 0x0 [0089.983] lstrlenW (lpString=".LDF") returned 4 [0089.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch=".LDF") returned 0x0 [0089.984] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.984] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.984] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.984] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.985] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20998580318) returned 1 [0089.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4732690, dwHighDateTime=0x1d585b4)) [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b42f8 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b42f8 | out: hHeap=0x260000) returned 1 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.985] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.986] GetLastError () returned 0x0 [0089.986] GetLastError () returned 0x0 [0089.986] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.986] GetLastError () returned 0x0 [0089.986] GetLastError () returned 0x0 [0089.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.988] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x373, lpOverlapped=0x0) returned 1 [0089.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.988] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.988] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.988] CloseHandle (hObject=0xf0) returned 1 [0089.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fbb0 [0089.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fbb0 | out: hHeap=0x260000) returned 1 [0089.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.991] GetLastError () returned 0x0 [0089.991] RtlWakeConditionVariable () returned 0x0 [0089.991] GetCurrentThreadId () returned 0x98c [0089.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".ldf") returned 0x0 [0089.991] lstrlenW (lpString=".vhd") returned 4 [0089.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".vhd") returned 0x0 [0089.991] lstrlenW (lpString=".vhdx") returned 5 [0089.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".vhdx") returned 0x0 [0089.991] lstrlenW (lpString=".pst") returned 4 [0089.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".pst") returned 0x0 [0089.991] lstrlenW (lpString=".ost") returned 4 [0089.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".ost") returned 0x0 [0089.992] lstrlenW (lpString=".bak") returned 4 [0089.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".bak") returned 0x0 [0089.992] lstrlenW (lpString=".bac") returned 4 [0089.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".bac") returned 0x0 [0089.992] lstrlenW (lpString=".sys") returned 4 [0089.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".sys") returned 0x0 [0089.992] lstrlenW (lpString=".v2i") returned 4 [0089.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".v2i") returned 0x0 [0089.992] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.994] lstrlenW (lpString=".sql") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".sql") returned 0x0 [0089.994] lstrlenW (lpString=".mdf") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".mdf") returned 0x0 [0089.994] lstrlenW (lpString=".txt") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".txt") returned 0x0 [0089.994] lstrlenW (lpString=".dbf") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".dbf") returned 0x0 [0089.994] lstrlenW (lpString=".ckp") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".ckp") returned 0x0 [0089.994] lstrlenW (lpString=".dacpac") returned 7 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".dacpac") returned 0x0 [0089.994] lstrlenW (lpString=".db3") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".db3") returned 0x0 [0089.994] lstrlenW (lpString=".dtxs") returned 5 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".dtxs") returned 0x0 [0089.994] lstrlenW (lpString=".mdt") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".mdt") returned 0x0 [0089.994] lstrlenW (lpString=".sdf") returned 4 [0089.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".sdf") returned 0x0 [0089.995] lstrlenW (lpString=".MDF") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".MDF") returned 0x0 [0089.995] lstrlenW (lpString=".DBF") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".DBF") returned 0x0 [0089.995] lstrlenW (lpString=".DB") returned 3 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".DB") returned 0x0 [0089.995] lstrlenW (lpString=".db") returned 3 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".db") returned 0x0 [0089.995] lstrlenW (lpString=".ndf") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".ndf") returned 0x0 [0089.995] lstrlenW (lpString=".NDF") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".NDF") returned 0x0 [0089.995] lstrlenW (lpString=".Mdf") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".Mdf") returned 0x0 [0089.995] lstrlenW (lpString=".dat") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".dat") returned 0x0 [0089.995] lstrlenW (lpString=".DAT") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".DAT") returned 0x0 [0089.995] lstrlenW (lpString=".ldf") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".ldf") returned 0x0 [0089.995] lstrlenW (lpString=".LDF") returned 4 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch=".LDF") returned 0x0 [0089.995] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.996] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0089.996] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.996] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.997] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=20999773375) returned 1 [0089.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc47587f0, dwHighDateTime=0x1d585b4)) [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4330 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4330 | out: hHeap=0x260000) returned 1 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.997] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0089.997] GetLastError () returned 0x0 [0089.998] GetLastError () returned 0x0 [0089.998] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0089.998] GetLastError () returned 0x0 [0089.998] GetLastError () returned 0x0 [0090.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffca4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.060] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x35c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x35c, lpOverlapped=0x0) returned 1 [0090.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.071] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.071] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.071] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.071] CloseHandle (hObject=0xf0) returned 1 [0090.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.073] GetLastError () returned 0x0 [0090.073] RtlWakeConditionVariable () returned 0x0 [0090.073] GetCurrentThreadId () returned 0x98c [0090.074] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.074] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.074] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.074] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.076] CloseHandle (hObject=0xf0) returned 1 [0090.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284d8e0 | out: hHeap=0x260000) returned 1 [0090.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284cc48 | out: hHeap=0x260000) returned 1 [0090.076] RtlWakeConditionVariable () returned 0x0 [0090.077] GetCurrentThreadId () returned 0x98c [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".ldf") returned 0x0 [0090.077] lstrlenW (lpString=".vhd") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".vhd") returned 0x0 [0090.077] lstrlenW (lpString=".vhdx") returned 5 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".vhdx") returned 0x0 [0090.077] lstrlenW (lpString=".pst") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".pst") returned 0x0 [0090.077] lstrlenW (lpString=".ost") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".ost") returned 0x0 [0090.077] lstrlenW (lpString=".bak") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".bak") returned 0x0 [0090.077] lstrlenW (lpString=".bac") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".bac") returned 0x0 [0090.077] lstrlenW (lpString=".sys") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".sys") returned 0x0 [0090.077] lstrlenW (lpString=".v2i") returned 4 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".v2i") returned 0x0 [0090.077] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.078] lstrlenW (lpString=".sql") returned 4 [0090.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".sql") returned 0x0 [0090.079] lstrlenW (lpString=".mdf") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".mdf") returned 0x0 [0090.079] lstrlenW (lpString=".txt") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".txt") returned 0x0 [0090.079] lstrlenW (lpString=".dbf") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".dbf") returned 0x0 [0090.079] lstrlenW (lpString=".ckp") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".ckp") returned 0x0 [0090.079] lstrlenW (lpString=".dacpac") returned 7 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".dacpac") returned 0x0 [0090.079] lstrlenW (lpString=".db3") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".db3") returned 0x0 [0090.079] lstrlenW (lpString=".dtxs") returned 5 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".dtxs") returned 0x0 [0090.079] lstrlenW (lpString=".mdt") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".mdt") returned 0x0 [0090.079] lstrlenW (lpString=".sdf") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".sdf") returned 0x0 [0090.079] lstrlenW (lpString=".MDF") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".MDF") returned 0x0 [0090.079] lstrlenW (lpString=".DBF") returned 4 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".DBF") returned 0x0 [0090.079] lstrlenW (lpString=".DB") returned 3 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".DB") returned 0x0 [0090.079] lstrlenW (lpString=".db") returned 3 [0090.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".db") returned 0x0 [0090.080] lstrlenW (lpString=".ndf") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".ndf") returned 0x0 [0090.080] lstrlenW (lpString=".NDF") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".NDF") returned 0x0 [0090.080] lstrlenW (lpString=".Mdf") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".Mdf") returned 0x0 [0090.080] lstrlenW (lpString=".dat") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".dat") returned 0x0 [0090.080] lstrlenW (lpString=".DAT") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".DAT") returned 0x0 [0090.080] lstrlenW (lpString=".ldf") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".ldf") returned 0x0 [0090.080] lstrlenW (lpString=".LDF") returned 4 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch=".LDF") returned 0x0 [0090.080] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.080] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.081] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.081] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.081] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21008227439) returned 1 [0090.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4816ed0, dwHighDateTime=0x1d585b4)) [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4528 [0090.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4528 | out: hHeap=0x260000) returned 1 [0090.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.082] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.082] GetLastError () returned 0x0 [0090.082] GetLastError () returned 0x0 [0090.082] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.082] GetLastError () returned 0x0 [0090.083] GetLastError () returned 0x0 [0090.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.084] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x244, lpOverlapped=0x0) returned 1 [0090.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.084] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.084] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.084] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.084] CloseHandle (hObject=0xf0) returned 1 [0090.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.085] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.086] GetLastError () returned 0x0 [0090.086] RtlWakeConditionVariable () returned 0x0 [0090.086] GetCurrentThreadId () returned 0x98c [0090.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".ldf") returned 0x0 [0090.086] lstrlenW (lpString=".vhd") returned 4 [0090.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".vhd") returned 0x0 [0090.086] lstrlenW (lpString=".vhdx") returned 5 [0090.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".vhdx") returned 0x0 [0090.086] lstrlenW (lpString=".pst") returned 4 [0090.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".pst") returned 0x0 [0090.086] lstrlenW (lpString=".ost") returned 4 [0090.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".ost") returned 0x0 [0090.087] lstrlenW (lpString=".bak") returned 4 [0090.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".bak") returned 0x0 [0090.087] lstrlenW (lpString=".bac") returned 4 [0090.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".bac") returned 0x0 [0090.087] lstrlenW (lpString=".sys") returned 4 [0090.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".sys") returned 0x0 [0090.087] lstrlenW (lpString=".v2i") returned 4 [0090.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".v2i") returned 0x0 [0090.087] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0090.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.088] lstrlenW (lpString=".sql") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".sql") returned 0x0 [0090.088] lstrlenW (lpString=".mdf") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".mdf") returned 0x0 [0090.088] lstrlenW (lpString=".txt") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".txt") returned 0x0 [0090.088] lstrlenW (lpString=".dbf") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".dbf") returned 0x0 [0090.088] lstrlenW (lpString=".ckp") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".ckp") returned 0x0 [0090.088] lstrlenW (lpString=".dacpac") returned 7 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".dacpac") returned 0x0 [0090.088] lstrlenW (lpString=".db3") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".db3") returned 0x0 [0090.088] lstrlenW (lpString=".dtxs") returned 5 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".dtxs") returned 0x0 [0090.088] lstrlenW (lpString=".mdt") returned 4 [0090.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".mdt") returned 0x0 [0090.089] lstrlenW (lpString=".sdf") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".sdf") returned 0x0 [0090.089] lstrlenW (lpString=".MDF") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".MDF") returned 0x0 [0090.089] lstrlenW (lpString=".DBF") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".DBF") returned 0x0 [0090.089] lstrlenW (lpString=".DB") returned 3 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".DB") returned 0x0 [0090.089] lstrlenW (lpString=".db") returned 3 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".db") returned 0x0 [0090.089] lstrlenW (lpString=".ndf") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".ndf") returned 0x0 [0090.089] lstrlenW (lpString=".NDF") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".NDF") returned 0x0 [0090.089] lstrlenW (lpString=".Mdf") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".Mdf") returned 0x0 [0090.089] lstrlenW (lpString=".dat") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".dat") returned 0x0 [0090.089] lstrlenW (lpString=".DAT") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".DAT") returned 0x0 [0090.089] lstrlenW (lpString=".ldf") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".ldf") returned 0x0 [0090.089] lstrlenW (lpString=".LDF") returned 4 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch=".LDF") returned 0x0 [0090.089] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.090] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.090] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.090] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.091] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21009169859) returned 1 [0090.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc483d030, dwHighDateTime=0x1d585b4)) [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4560 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4560 | out: hHeap=0x260000) returned 1 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.091] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.091] GetLastError () returned 0x0 [0090.092] GetLastError () returned 0x0 [0090.092] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.092] GetLastError () returned 0x0 [0090.092] GetLastError () returned 0x0 [0090.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff418, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.094] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbe8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xbe8, lpOverlapped=0x0) returned 1 [0090.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.094] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.094] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.094] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.094] CloseHandle (hObject=0xf0) returned 1 [0090.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0090.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.096] GetLastError () returned 0x0 [0090.096] RtlWakeConditionVariable () returned 0x0 [0090.096] GetCurrentThreadId () returned 0x98c [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".ldf") returned 0x0 [0090.096] lstrlenW (lpString=".vhd") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".vhd") returned 0x0 [0090.096] lstrlenW (lpString=".vhdx") returned 5 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".vhdx") returned 0x0 [0090.096] lstrlenW (lpString=".pst") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".pst") returned 0x0 [0090.096] lstrlenW (lpString=".ost") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".ost") returned 0x0 [0090.096] lstrlenW (lpString=".bak") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".bak") returned 0x0 [0090.096] lstrlenW (lpString=".bac") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".bac") returned 0x0 [0090.096] lstrlenW (lpString=".sys") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".sys") returned 0x0 [0090.096] lstrlenW (lpString=".v2i") returned 4 [0090.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".v2i") returned 0x0 [0090.097] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0090.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.098] lstrlenW (lpString=".sql") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".sql") returned 0x0 [0090.098] lstrlenW (lpString=".mdf") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".mdf") returned 0x0 [0090.098] lstrlenW (lpString=".txt") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".txt") returned 0x0 [0090.098] lstrlenW (lpString=".dbf") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".dbf") returned 0x0 [0090.098] lstrlenW (lpString=".ckp") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".ckp") returned 0x0 [0090.098] lstrlenW (lpString=".dacpac") returned 7 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".dacpac") returned 0x0 [0090.098] lstrlenW (lpString=".db3") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".db3") returned 0x0 [0090.098] lstrlenW (lpString=".dtxs") returned 5 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".dtxs") returned 0x0 [0090.098] lstrlenW (lpString=".mdt") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".mdt") returned 0x0 [0090.098] lstrlenW (lpString=".sdf") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".sdf") returned 0x0 [0090.098] lstrlenW (lpString=".MDF") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".MDF") returned 0x0 [0090.098] lstrlenW (lpString=".DBF") returned 4 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".DBF") returned 0x0 [0090.098] lstrlenW (lpString=".DB") returned 3 [0090.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".DB") returned 0x0 [0090.099] lstrlenW (lpString=".db") returned 3 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".db") returned 0x0 [0090.099] lstrlenW (lpString=".ndf") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".ndf") returned 0x0 [0090.099] lstrlenW (lpString=".NDF") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".NDF") returned 0x0 [0090.099] lstrlenW (lpString=".Mdf") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".Mdf") returned 0x0 [0090.099] lstrlenW (lpString=".dat") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".dat") returned 0x0 [0090.099] lstrlenW (lpString=".DAT") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".DAT") returned 0x0 [0090.099] lstrlenW (lpString=".ldf") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".ldf") returned 0x0 [0090.099] lstrlenW (lpString=".LDF") returned 4 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch=".LDF") returned 0x0 [0090.099] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.099] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.100] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.100] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.100] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21010134723) returned 1 [0090.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc483d030, dwHighDateTime=0x1d585b4)) [0090.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4598 [0090.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4598 | out: hHeap=0x260000) returned 1 [0090.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.101] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.101] GetLastError () returned 0x0 [0090.101] GetLastError () returned 0x0 [0090.101] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.101] GetLastError () returned 0x0 [0090.102] GetLastError () returned 0x0 [0090.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff6dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.103] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x924, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x924, lpOverlapped=0x0) returned 1 [0090.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.103] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.103] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.104] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.104] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.104] CloseHandle (hObject=0xf0) returned 1 [0090.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0090.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.105] GetLastError () returned 0x0 [0090.105] RtlWakeConditionVariable () returned 0x0 [0090.105] GetCurrentThreadId () returned 0x98c [0090.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".ldf") returned 0x0 [0090.105] lstrlenW (lpString=".vhd") returned 4 [0090.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".vhd") returned 0x0 [0090.106] lstrlenW (lpString=".vhdx") returned 5 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".vhdx") returned 0x0 [0090.138] lstrlenW (lpString=".pst") returned 4 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".pst") returned 0x0 [0090.138] lstrlenW (lpString=".ost") returned 4 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".ost") returned 0x0 [0090.138] lstrlenW (lpString=".bak") returned 4 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".bak") returned 0x0 [0090.138] lstrlenW (lpString=".bac") returned 4 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".bac") returned 0x0 [0090.138] lstrlenW (lpString=".sys") returned 4 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".sys") returned 0x0 [0090.138] lstrlenW (lpString=".v2i") returned 4 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".v2i") returned 0x0 [0090.138] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.139] lstrlenW (lpString=".sql") returned 4 [0090.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".sql") returned 0x0 [0090.139] lstrlenW (lpString=".mdf") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".mdf") returned 0x0 [0090.140] lstrlenW (lpString=".txt") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".txt") returned 0x0 [0090.140] lstrlenW (lpString=".dbf") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".dbf") returned 0x0 [0090.140] lstrlenW (lpString=".ckp") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".ckp") returned 0x0 [0090.140] lstrlenW (lpString=".dacpac") returned 7 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".dacpac") returned 0x0 [0090.140] lstrlenW (lpString=".db3") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".db3") returned 0x0 [0090.140] lstrlenW (lpString=".dtxs") returned 5 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".dtxs") returned 0x0 [0090.140] lstrlenW (lpString=".mdt") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".mdt") returned 0x0 [0090.140] lstrlenW (lpString=".sdf") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".sdf") returned 0x0 [0090.140] lstrlenW (lpString=".MDF") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".MDF") returned 0x0 [0090.140] lstrlenW (lpString=".DBF") returned 4 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".DBF") returned 0x0 [0090.140] lstrlenW (lpString=".DB") returned 3 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".DB") returned 0x0 [0090.140] lstrlenW (lpString=".db") returned 3 [0090.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".db") returned 0x0 [0090.140] lstrlenW (lpString=".ndf") returned 4 [0090.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".ndf") returned 0x0 [0090.141] lstrlenW (lpString=".NDF") returned 4 [0090.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".NDF") returned 0x0 [0090.232] lstrlenW (lpString=".Mdf") returned 4 [0090.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".Mdf") returned 0x0 [0090.232] lstrlenW (lpString=".dat") returned 4 [0090.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".dat") returned 0x0 [0090.254] lstrlenW (lpString=".DAT") returned 4 [0090.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".DAT") returned 0x0 [0090.254] lstrlenW (lpString=".ldf") returned 4 [0090.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".ldf") returned 0x0 [0090.254] lstrlenW (lpString=".LDF") returned 4 [0090.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch=".LDF") returned 0x0 [0090.254] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.254] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.255] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.255] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.255] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21025641626) returned 1 [0090.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc49b9df0, dwHighDateTime=0x1d585b4)) [0090.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b48a8 [0090.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b48a8 | out: hHeap=0x260000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.256] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.256] GetLastError () returned 0x0 [0090.256] GetLastError () returned 0x0 [0090.256] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.256] GetLastError () returned 0x0 [0090.257] GetLastError () returned 0x0 [0090.259] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.259] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xae8, lpOverlapped=0x0) returned 1 [0090.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.260] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.260] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.260] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.260] CloseHandle (hObject=0xf0) returned 1 [0090.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.262] GetLastError () returned 0x0 [0090.262] RtlWakeConditionVariable () returned 0x0 [0090.262] GetCurrentThreadId () returned 0x98c [0090.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".ldf") returned 0x0 [0090.262] lstrlenW (lpString=".vhd") returned 4 [0090.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".vhd") returned 0x0 [0090.262] lstrlenW (lpString=".vhdx") returned 5 [0090.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".vhdx") returned 0x0 [0090.263] lstrlenW (lpString=".pst") returned 4 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".pst") returned 0x0 [0090.263] lstrlenW (lpString=".ost") returned 4 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".ost") returned 0x0 [0090.263] lstrlenW (lpString=".bak") returned 4 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".bak") returned 0x0 [0090.263] lstrlenW (lpString=".bac") returned 4 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".bac") returned 0x0 [0090.263] lstrlenW (lpString=".sys") returned 4 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".sys") returned 0x0 [0090.263] lstrlenW (lpString=".v2i") returned 4 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".v2i") returned 0x0 [0090.263] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.264] lstrlenW (lpString=".sql") returned 4 [0090.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".sql") returned 0x0 [0090.264] lstrlenW (lpString=".mdf") returned 4 [0090.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".mdf") returned 0x0 [0090.264] lstrlenW (lpString=".txt") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".txt") returned 0x0 [0090.265] lstrlenW (lpString=".dbf") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".dbf") returned 0x0 [0090.265] lstrlenW (lpString=".ckp") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".ckp") returned 0x0 [0090.265] lstrlenW (lpString=".dacpac") returned 7 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".dacpac") returned 0x0 [0090.265] lstrlenW (lpString=".db3") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".db3") returned 0x0 [0090.265] lstrlenW (lpString=".dtxs") returned 5 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".dtxs") returned 0x0 [0090.265] lstrlenW (lpString=".mdt") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".mdt") returned 0x0 [0090.265] lstrlenW (lpString=".sdf") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".sdf") returned 0x0 [0090.265] lstrlenW (lpString=".MDF") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".MDF") returned 0x0 [0090.265] lstrlenW (lpString=".DBF") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".DBF") returned 0x0 [0090.265] lstrlenW (lpString=".DB") returned 3 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".DB") returned 0x0 [0090.265] lstrlenW (lpString=".db") returned 3 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".db") returned 0x0 [0090.265] lstrlenW (lpString=".ndf") returned 4 [0090.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".ndf") returned 0x0 [0090.265] lstrlenW (lpString=".NDF") returned 4 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".NDF") returned 0x0 [0090.266] lstrlenW (lpString=".Mdf") returned 4 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".Mdf") returned 0x0 [0090.266] lstrlenW (lpString=".dat") returned 4 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".dat") returned 0x0 [0090.266] lstrlenW (lpString=".DAT") returned 4 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".DAT") returned 0x0 [0090.266] lstrlenW (lpString=".ldf") returned 4 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".ldf") returned 0x0 [0090.266] lstrlenW (lpString=".LDF") returned 4 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch=".LDF") returned 0x0 [0090.266] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.266] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.267] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.267] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.267] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21026822507) returned 1 [0090.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc49dff50, dwHighDateTime=0x1d585b4)) [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b48e0 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b48e0 | out: hHeap=0x260000) returned 1 [0090.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.268] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.268] GetLastError () returned 0x0 [0090.268] GetLastError () returned 0x0 [0090.268] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.268] GetLastError () returned 0x0 [0090.269] GetLastError () returned 0x0 [0090.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe6c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.270] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x193c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x193c, lpOverlapped=0x0) returned 1 [0090.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.270] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.270] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.271] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.271] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.271] CloseHandle (hObject=0xf0) returned 1 [0090.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.272] GetLastError () returned 0x0 [0090.272] RtlWakeConditionVariable () returned 0x0 [0090.272] GetCurrentThreadId () returned 0x98c [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".ldf") returned 0x0 [0090.273] lstrlenW (lpString=".vhd") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".vhd") returned 0x0 [0090.273] lstrlenW (lpString=".vhdx") returned 5 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".vhdx") returned 0x0 [0090.273] lstrlenW (lpString=".pst") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".pst") returned 0x0 [0090.273] lstrlenW (lpString=".ost") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".ost") returned 0x0 [0090.273] lstrlenW (lpString=".bak") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".bak") returned 0x0 [0090.273] lstrlenW (lpString=".bac") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".bac") returned 0x0 [0090.273] lstrlenW (lpString=".sys") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".sys") returned 0x0 [0090.273] lstrlenW (lpString=".v2i") returned 4 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".v2i") returned 0x0 [0090.273] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.274] lstrlenW (lpString=".sql") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".sql") returned 0x0 [0090.275] lstrlenW (lpString=".mdf") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".mdf") returned 0x0 [0090.275] lstrlenW (lpString=".txt") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".txt") returned 0x0 [0090.275] lstrlenW (lpString=".dbf") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".dbf") returned 0x0 [0090.275] lstrlenW (lpString=".ckp") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".ckp") returned 0x0 [0090.275] lstrlenW (lpString=".dacpac") returned 7 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".dacpac") returned 0x0 [0090.275] lstrlenW (lpString=".db3") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".db3") returned 0x0 [0090.275] lstrlenW (lpString=".dtxs") returned 5 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".dtxs") returned 0x0 [0090.275] lstrlenW (lpString=".mdt") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".mdt") returned 0x0 [0090.275] lstrlenW (lpString=".sdf") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".sdf") returned 0x0 [0090.275] lstrlenW (lpString=".MDF") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".MDF") returned 0x0 [0090.275] lstrlenW (lpString=".DBF") returned 4 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".DBF") returned 0x0 [0090.275] lstrlenW (lpString=".DB") returned 3 [0090.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".DB") returned 0x0 [0090.276] lstrlenW (lpString=".db") returned 3 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".db") returned 0x0 [0090.276] lstrlenW (lpString=".ndf") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".ndf") returned 0x0 [0090.276] lstrlenW (lpString=".NDF") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".NDF") returned 0x0 [0090.276] lstrlenW (lpString=".Mdf") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".Mdf") returned 0x0 [0090.276] lstrlenW (lpString=".dat") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".dat") returned 0x0 [0090.276] lstrlenW (lpString=".DAT") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".DAT") returned 0x0 [0090.276] lstrlenW (lpString=".ldf") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".ldf") returned 0x0 [0090.276] lstrlenW (lpString=".LDF") returned 4 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch=".LDF") returned 0x0 [0090.276] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.276] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.277] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.277] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.277] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21027844987) returned 1 [0090.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a060b0, dwHighDateTime=0x1d585b4)) [0090.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4918 [0090.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4918 | out: hHeap=0x260000) returned 1 [0090.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.278] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.278] GetLastError () returned 0x0 [0090.278] GetLastError () returned 0x0 [0090.278] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.279] GetLastError () returned 0x0 [0090.279] GetLastError () returned 0x0 [0090.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc39c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.281] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x3c64, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x3c64, lpOverlapped=0x0) returned 1 [0090.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.281] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.281] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.281] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.281] CloseHandle (hObject=0xf0) returned 1 [0090.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.283] GetLastError () returned 0x0 [0090.283] RtlWakeConditionVariable () returned 0x0 [0090.283] GetCurrentThreadId () returned 0x98c [0090.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".ldf") returned 0x0 [0090.283] lstrlenW (lpString=".vhd") returned 4 [0090.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".vhd") returned 0x0 [0090.284] lstrlenW (lpString=".vhdx") returned 5 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".vhdx") returned 0x0 [0090.284] lstrlenW (lpString=".pst") returned 4 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".pst") returned 0x0 [0090.284] lstrlenW (lpString=".ost") returned 4 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".ost") returned 0x0 [0090.284] lstrlenW (lpString=".bak") returned 4 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".bak") returned 0x0 [0090.284] lstrlenW (lpString=".bac") returned 4 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".bac") returned 0x0 [0090.284] lstrlenW (lpString=".sys") returned 4 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".sys") returned 0x0 [0090.284] lstrlenW (lpString=".v2i") returned 4 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".v2i") returned 0x0 [0090.284] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.285] lstrlenW (lpString=".sql") returned 4 [0090.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".sql") returned 0x0 [0090.285] lstrlenW (lpString=".mdf") returned 4 [0090.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".mdf") returned 0x0 [0090.285] lstrlenW (lpString=".txt") returned 4 [0090.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".txt") returned 0x0 [0090.285] lstrlenW (lpString=".dbf") returned 4 [0090.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".dbf") returned 0x0 [0090.286] lstrlenW (lpString=".ckp") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".ckp") returned 0x0 [0090.286] lstrlenW (lpString=".dacpac") returned 7 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".dacpac") returned 0x0 [0090.286] lstrlenW (lpString=".db3") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".db3") returned 0x0 [0090.286] lstrlenW (lpString=".dtxs") returned 5 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".dtxs") returned 0x0 [0090.286] lstrlenW (lpString=".mdt") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".mdt") returned 0x0 [0090.286] lstrlenW (lpString=".sdf") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".sdf") returned 0x0 [0090.286] lstrlenW (lpString=".MDF") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".MDF") returned 0x0 [0090.286] lstrlenW (lpString=".DBF") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".DBF") returned 0x0 [0090.286] lstrlenW (lpString=".DB") returned 3 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".DB") returned 0x0 [0090.286] lstrlenW (lpString=".db") returned 3 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".db") returned 0x0 [0090.286] lstrlenW (lpString=".ndf") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".ndf") returned 0x0 [0090.286] lstrlenW (lpString=".NDF") returned 4 [0090.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".NDF") returned 0x0 [0090.286] lstrlenW (lpString=".Mdf") returned 4 [0090.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".Mdf") returned 0x0 [0090.287] lstrlenW (lpString=".dat") returned 4 [0090.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".dat") returned 0x0 [0090.287] lstrlenW (lpString=".DAT") returned 4 [0090.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".DAT") returned 0x0 [0090.287] lstrlenW (lpString=".ldf") returned 4 [0090.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".ldf") returned 0x0 [0090.287] lstrlenW (lpString=".LDF") returned 4 [0090.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch=".LDF") returned 0x0 [0090.287] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.287] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.288] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.288] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21028912629) returned 1 [0090.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a060b0, dwHighDateTime=0x1d585b4)) [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4950 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4950 | out: hHeap=0x260000) returned 1 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.289] GetLastError () returned 0x0 [0090.289] GetLastError () returned 0x0 [0090.289] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.289] GetLastError () returned 0x0 [0090.289] GetLastError () returned 0x0 [0090.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.291] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x171, lpOverlapped=0x0) returned 1 [0090.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.291] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.291] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.291] CloseHandle (hObject=0xf0) returned 1 [0090.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.296] GetLastError () returned 0x0 [0090.297] RtlWakeConditionVariable () returned 0x0 [0090.297] GetCurrentThreadId () returned 0x98c [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".ldf") returned 0x0 [0090.297] lstrlenW (lpString=".vhd") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".vhd") returned 0x0 [0090.297] lstrlenW (lpString=".vhdx") returned 5 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".vhdx") returned 0x0 [0090.297] lstrlenW (lpString=".pst") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".pst") returned 0x0 [0090.297] lstrlenW (lpString=".ost") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".ost") returned 0x0 [0090.297] lstrlenW (lpString=".bak") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".bak") returned 0x0 [0090.297] lstrlenW (lpString=".bac") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".bac") returned 0x0 [0090.297] lstrlenW (lpString=".sys") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".sys") returned 0x0 [0090.297] lstrlenW (lpString=".v2i") returned 4 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".v2i") returned 0x0 [0090.297] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.299] lstrlenW (lpString=".sql") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".sql") returned 0x0 [0090.299] lstrlenW (lpString=".mdf") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".mdf") returned 0x0 [0090.299] lstrlenW (lpString=".txt") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".txt") returned 0x0 [0090.299] lstrlenW (lpString=".dbf") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".dbf") returned 0x0 [0090.299] lstrlenW (lpString=".ckp") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".ckp") returned 0x0 [0090.299] lstrlenW (lpString=".dacpac") returned 7 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".dacpac") returned 0x0 [0090.299] lstrlenW (lpString=".db3") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".db3") returned 0x0 [0090.299] lstrlenW (lpString=".dtxs") returned 5 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".dtxs") returned 0x0 [0090.299] lstrlenW (lpString=".mdt") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".mdt") returned 0x0 [0090.299] lstrlenW (lpString=".sdf") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".sdf") returned 0x0 [0090.299] lstrlenW (lpString=".MDF") returned 4 [0090.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".MDF") returned 0x0 [0090.300] lstrlenW (lpString=".DBF") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".DBF") returned 0x0 [0090.300] lstrlenW (lpString=".DB") returned 3 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".DB") returned 0x0 [0090.300] lstrlenW (lpString=".db") returned 3 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".db") returned 0x0 [0090.300] lstrlenW (lpString=".ndf") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".ndf") returned 0x0 [0090.300] lstrlenW (lpString=".NDF") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".NDF") returned 0x0 [0090.300] lstrlenW (lpString=".Mdf") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".Mdf") returned 0x0 [0090.300] lstrlenW (lpString=".dat") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".dat") returned 0x0 [0090.300] lstrlenW (lpString=".DAT") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".DAT") returned 0x0 [0090.300] lstrlenW (lpString=".ldf") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".ldf") returned 0x0 [0090.300] lstrlenW (lpString=".LDF") returned 4 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch=".LDF") returned 0x0 [0090.300] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.300] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.301] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.301] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.301] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21030258501) returned 1 [0090.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a2c210, dwHighDateTime=0x1d585b4)) [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4988 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4988 | out: hHeap=0x260000) returned 1 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.302] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.302] GetLastError () returned 0x0 [0090.303] GetLastError () returned 0x0 [0090.303] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.303] GetLastError () returned 0x0 [0090.303] GetLastError () returned 0x0 [0090.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.304] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x176, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x176, lpOverlapped=0x0) returned 1 [0090.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.304] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.304] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.304] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.305] CloseHandle (hObject=0xf0) returned 1 [0090.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.306] GetLastError () returned 0x0 [0090.306] RtlWakeConditionVariable () returned 0x27e828 [0090.306] GetCurrentThreadId () returned 0x98c [0090.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".ldf") returned 0x0 [0090.307] lstrlenW (lpString=".vhd") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".vhd") returned 0x0 [0090.307] lstrlenW (lpString=".vhdx") returned 5 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".vhdx") returned 0x0 [0090.307] lstrlenW (lpString=".pst") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".pst") returned 0x0 [0090.307] lstrlenW (lpString=".ost") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".ost") returned 0x0 [0090.307] lstrlenW (lpString=".bak") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".bak") returned 0x0 [0090.307] lstrlenW (lpString=".bac") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".bac") returned 0x0 [0090.307] lstrlenW (lpString=".sys") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".sys") returned 0x0 [0090.307] lstrlenW (lpString=".v2i") returned 4 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".v2i") returned 0x0 [0090.307] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.308] lstrlenW (lpString=".sql") returned 4 [0090.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".sql") returned 0x0 [0090.308] lstrlenW (lpString=".mdf") returned 4 [0090.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".mdf") returned 0x0 [0090.308] lstrlenW (lpString=".txt") returned 4 [0090.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".txt") returned 0x0 [0090.308] lstrlenW (lpString=".dbf") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".dbf") returned 0x0 [0090.309] lstrlenW (lpString=".ckp") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".ckp") returned 0x0 [0090.309] lstrlenW (lpString=".dacpac") returned 7 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".dacpac") returned 0x0 [0090.309] lstrlenW (lpString=".db3") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".db3") returned 0x0 [0090.309] lstrlenW (lpString=".dtxs") returned 5 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".dtxs") returned 0x0 [0090.309] lstrlenW (lpString=".mdt") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".mdt") returned 0x0 [0090.309] lstrlenW (lpString=".sdf") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".sdf") returned 0x0 [0090.309] lstrlenW (lpString=".MDF") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".MDF") returned 0x0 [0090.309] lstrlenW (lpString=".DBF") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".DBF") returned 0x0 [0090.309] lstrlenW (lpString=".DB") returned 3 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".DB") returned 0x0 [0090.309] lstrlenW (lpString=".db") returned 3 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".db") returned 0x0 [0090.309] lstrlenW (lpString=".ndf") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".ndf") returned 0x0 [0090.309] lstrlenW (lpString=".NDF") returned 4 [0090.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".NDF") returned 0x0 [0090.310] lstrlenW (lpString=".Mdf") returned 4 [0090.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".Mdf") returned 0x0 [0090.310] lstrlenW (lpString=".dat") returned 4 [0090.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".dat") returned 0x0 [0090.310] lstrlenW (lpString=".DAT") returned 4 [0090.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".DAT") returned 0x0 [0090.310] lstrlenW (lpString=".ldf") returned 4 [0090.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".ldf") returned 0x0 [0090.310] lstrlenW (lpString=".LDF") returned 4 [0090.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch=".LDF") returned 0x0 [0090.310] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.310] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.311] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.311] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21031214543) returned 1 [0090.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a52370, dwHighDateTime=0x1d585b4)) [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b49c0 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b49c0 | out: hHeap=0x260000) returned 1 [0090.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.312] GetLastError () returned 0x0 [0090.312] GetLastError () returned 0x0 [0090.312] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.312] GetLastError () returned 0x0 [0090.312] GetLastError () returned 0x0 [0090.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.314] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xb5, lpOverlapped=0x0) returned 1 [0090.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.314] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.314] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.314] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.314] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.314] CloseHandle (hObject=0xf0) returned 1 [0090.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.316] GetLastError () returned 0x0 [0090.316] RtlWakeConditionVariable () returned 0x27e828 [0090.316] GetCurrentThreadId () returned 0x98c [0090.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".ldf") returned 0x0 [0090.316] lstrlenW (lpString=".vhd") returned 4 [0090.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".vhd") returned 0x0 [0090.316] lstrlenW (lpString=".vhdx") returned 5 [0090.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".vhdx") returned 0x0 [0090.316] lstrlenW (lpString=".pst") returned 4 [0090.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".pst") returned 0x0 [0090.316] lstrlenW (lpString=".ost") returned 4 [0090.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".ost") returned 0x0 [0090.316] lstrlenW (lpString=".bak") returned 4 [0090.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".bak") returned 0x0 [0090.316] lstrlenW (lpString=".bac") returned 4 [0090.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".bac") returned 0x0 [0090.317] lstrlenW (lpString=".sys") returned 4 [0090.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".sys") returned 0x0 [0090.317] lstrlenW (lpString=".v2i") returned 4 [0090.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".v2i") returned 0x0 [0090.317] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.318] lstrlenW (lpString=".sql") returned 4 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".sql") returned 0x0 [0090.318] lstrlenW (lpString=".mdf") returned 4 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".mdf") returned 0x0 [0090.318] lstrlenW (lpString=".txt") returned 4 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".txt") returned 0x0 [0090.318] lstrlenW (lpString=".dbf") returned 4 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".dbf") returned 0x0 [0090.318] lstrlenW (lpString=".ckp") returned 4 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".ckp") returned 0x0 [0090.318] lstrlenW (lpString=".dacpac") returned 7 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".dacpac") returned 0x0 [0090.318] lstrlenW (lpString=".db3") returned 4 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".db3") returned 0x0 [0090.318] lstrlenW (lpString=".dtxs") returned 5 [0090.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".dtxs") returned 0x0 [0090.318] lstrlenW (lpString=".mdt") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".mdt") returned 0x0 [0090.319] lstrlenW (lpString=".sdf") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".sdf") returned 0x0 [0090.319] lstrlenW (lpString=".MDF") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".MDF") returned 0x0 [0090.319] lstrlenW (lpString=".DBF") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".DBF") returned 0x0 [0090.319] lstrlenW (lpString=".DB") returned 3 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".DB") returned 0x0 [0090.319] lstrlenW (lpString=".db") returned 3 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".db") returned 0x0 [0090.319] lstrlenW (lpString=".ndf") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".ndf") returned 0x0 [0090.319] lstrlenW (lpString=".NDF") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".NDF") returned 0x0 [0090.319] lstrlenW (lpString=".Mdf") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".Mdf") returned 0x0 [0090.319] lstrlenW (lpString=".dat") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".dat") returned 0x0 [0090.319] lstrlenW (lpString=".DAT") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".DAT") returned 0x0 [0090.319] lstrlenW (lpString=".ldf") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".ldf") returned 0x0 [0090.319] lstrlenW (lpString=".LDF") returned 4 [0090.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch=".LDF") returned 0x0 [0090.319] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.320] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.320] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.320] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.321] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21032177765) returned 1 [0090.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a52370, dwHighDateTime=0x1d585b4)) [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b49f8 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b49f8 | out: hHeap=0x260000) returned 1 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.321] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.321] GetLastError () returned 0x0 [0090.322] GetLastError () returned 0x0 [0090.322] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.322] GetLastError () returned 0x0 [0090.322] GetLastError () returned 0x0 [0090.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.323] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xb7, lpOverlapped=0x0) returned 1 [0090.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.324] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.324] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.324] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.324] CloseHandle (hObject=0xf0) returned 1 [0090.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.326] GetLastError () returned 0x0 [0090.326] RtlWakeConditionVariable () returned 0x0 [0090.326] GetCurrentThreadId () returned 0x98c [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".ldf") returned 0x0 [0090.326] lstrlenW (lpString=".vhd") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".vhd") returned 0x0 [0090.326] lstrlenW (lpString=".vhdx") returned 5 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".vhdx") returned 0x0 [0090.326] lstrlenW (lpString=".pst") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".pst") returned 0x0 [0090.326] lstrlenW (lpString=".ost") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".ost") returned 0x0 [0090.326] lstrlenW (lpString=".bak") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".bak") returned 0x0 [0090.326] lstrlenW (lpString=".bac") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".bac") returned 0x0 [0090.326] lstrlenW (lpString=".sys") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".sys") returned 0x0 [0090.326] lstrlenW (lpString=".v2i") returned 4 [0090.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".v2i") returned 0x0 [0090.326] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.328] lstrlenW (lpString=".sql") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".sql") returned 0x0 [0090.328] lstrlenW (lpString=".mdf") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".mdf") returned 0x0 [0090.328] lstrlenW (lpString=".txt") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".txt") returned 0x0 [0090.328] lstrlenW (lpString=".dbf") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".dbf") returned 0x0 [0090.328] lstrlenW (lpString=".ckp") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".ckp") returned 0x0 [0090.328] lstrlenW (lpString=".dacpac") returned 7 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".dacpac") returned 0x0 [0090.328] lstrlenW (lpString=".db3") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".db3") returned 0x0 [0090.328] lstrlenW (lpString=".dtxs") returned 5 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".dtxs") returned 0x0 [0090.328] lstrlenW (lpString=".mdt") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".mdt") returned 0x0 [0090.328] lstrlenW (lpString=".sdf") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".sdf") returned 0x0 [0090.328] lstrlenW (lpString=".MDF") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".MDF") returned 0x0 [0090.328] lstrlenW (lpString=".DBF") returned 4 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".DBF") returned 0x0 [0090.328] lstrlenW (lpString=".DB") returned 3 [0090.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".DB") returned 0x0 [0090.329] lstrlenW (lpString=".db") returned 3 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".db") returned 0x0 [0090.329] lstrlenW (lpString=".ndf") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".ndf") returned 0x0 [0090.329] lstrlenW (lpString=".NDF") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".NDF") returned 0x0 [0090.329] lstrlenW (lpString=".Mdf") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".Mdf") returned 0x0 [0090.329] lstrlenW (lpString=".dat") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".dat") returned 0x0 [0090.329] lstrlenW (lpString=".DAT") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".DAT") returned 0x0 [0090.329] lstrlenW (lpString=".ldf") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".ldf") returned 0x0 [0090.329] lstrlenW (lpString=".LDF") returned 4 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch=".LDF") returned 0x0 [0090.329] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.329] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.330] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.330] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21033144857) returned 1 [0090.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a784d0, dwHighDateTime=0x1d585b4)) [0090.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4a30 [0090.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4a30 | out: hHeap=0x260000) returned 1 [0090.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.331] GetLastError () returned 0x0 [0090.331] GetLastError () returned 0x0 [0090.331] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.332] GetLastError () returned 0x0 [0090.332] GetLastError () returned 0x0 [0090.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.333] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x171, lpOverlapped=0x0) returned 1 [0090.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.333] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.333] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.333] CloseHandle (hObject=0xf0) returned 1 [0090.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.335] GetLastError () returned 0x0 [0090.335] RtlWakeConditionVariable () returned 0x27e828 [0090.335] GetCurrentThreadId () returned 0x98c [0090.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".ldf") returned 0x0 [0090.335] lstrlenW (lpString=".vhd") returned 4 [0090.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".vhd") returned 0x0 [0090.335] lstrlenW (lpString=".vhdx") returned 5 [0090.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".vhdx") returned 0x0 [0090.335] lstrlenW (lpString=".pst") returned 4 [0090.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".pst") returned 0x0 [0090.335] lstrlenW (lpString=".ost") returned 4 [0090.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".ost") returned 0x0 [0090.336] lstrlenW (lpString=".bak") returned 4 [0090.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".bak") returned 0x0 [0090.336] lstrlenW (lpString=".bac") returned 4 [0090.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".bac") returned 0x0 [0090.336] lstrlenW (lpString=".sys") returned 4 [0090.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".sys") returned 0x0 [0090.336] lstrlenW (lpString=".v2i") returned 4 [0090.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".v2i") returned 0x0 [0090.336] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.337] lstrlenW (lpString=".sql") returned 4 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".sql") returned 0x0 [0090.337] lstrlenW (lpString=".mdf") returned 4 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".mdf") returned 0x0 [0090.337] lstrlenW (lpString=".txt") returned 4 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".txt") returned 0x0 [0090.337] lstrlenW (lpString=".dbf") returned 4 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".dbf") returned 0x0 [0090.337] lstrlenW (lpString=".ckp") returned 4 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".ckp") returned 0x0 [0090.337] lstrlenW (lpString=".dacpac") returned 7 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".dacpac") returned 0x0 [0090.337] lstrlenW (lpString=".db3") returned 4 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".db3") returned 0x0 [0090.337] lstrlenW (lpString=".dtxs") returned 5 [0090.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".dtxs") returned 0x0 [0090.337] lstrlenW (lpString=".mdt") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".mdt") returned 0x0 [0090.338] lstrlenW (lpString=".sdf") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".sdf") returned 0x0 [0090.338] lstrlenW (lpString=".MDF") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".MDF") returned 0x0 [0090.338] lstrlenW (lpString=".DBF") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".DBF") returned 0x0 [0090.338] lstrlenW (lpString=".DB") returned 3 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".DB") returned 0x0 [0090.338] lstrlenW (lpString=".db") returned 3 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".db") returned 0x0 [0090.338] lstrlenW (lpString=".ndf") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".ndf") returned 0x0 [0090.338] lstrlenW (lpString=".NDF") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".NDF") returned 0x0 [0090.338] lstrlenW (lpString=".Mdf") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".Mdf") returned 0x0 [0090.338] lstrlenW (lpString=".dat") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".dat") returned 0x0 [0090.338] lstrlenW (lpString=".DAT") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".DAT") returned 0x0 [0090.338] lstrlenW (lpString=".ldf") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".ldf") returned 0x0 [0090.338] lstrlenW (lpString=".LDF") returned 4 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch=".LDF") returned 0x0 [0090.338] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.339] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.339] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.340] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21034069608) returned 1 [0090.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a9e630, dwHighDateTime=0x1d585b4)) [0090.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4a68 [0090.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4a68 | out: hHeap=0x260000) returned 1 [0090.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.341] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.341] GetLastError () returned 0x0 [0090.341] GetLastError () returned 0x0 [0090.341] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.341] GetLastError () returned 0x0 [0090.342] GetLastError () returned 0x0 [0090.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.343] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x244, lpOverlapped=0x0) returned 1 [0090.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.343] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.344] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.346] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.346] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.346] CloseHandle (hObject=0xf0) returned 1 [0090.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.346] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.348] GetLastError () returned 0x0 [0090.348] RtlWakeConditionVariable () returned 0x0 [0090.348] GetCurrentThreadId () returned 0x98c [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".ldf") returned 0x0 [0090.349] lstrlenW (lpString=".vhd") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".vhd") returned 0x0 [0090.349] lstrlenW (lpString=".vhdx") returned 5 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".vhdx") returned 0x0 [0090.349] lstrlenW (lpString=".pst") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".pst") returned 0x0 [0090.349] lstrlenW (lpString=".ost") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".ost") returned 0x0 [0090.349] lstrlenW (lpString=".bak") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".bak") returned 0x0 [0090.349] lstrlenW (lpString=".bac") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".bac") returned 0x0 [0090.349] lstrlenW (lpString=".sys") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".sys") returned 0x0 [0090.349] lstrlenW (lpString=".v2i") returned 4 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".v2i") returned 0x0 [0090.349] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.350] lstrlenW (lpString=".sql") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".sql") returned 0x0 [0090.351] lstrlenW (lpString=".mdf") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".mdf") returned 0x0 [0090.351] lstrlenW (lpString=".txt") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".txt") returned 0x0 [0090.351] lstrlenW (lpString=".dbf") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".dbf") returned 0x0 [0090.351] lstrlenW (lpString=".ckp") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".ckp") returned 0x0 [0090.351] lstrlenW (lpString=".dacpac") returned 7 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".dacpac") returned 0x0 [0090.351] lstrlenW (lpString=".db3") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".db3") returned 0x0 [0090.351] lstrlenW (lpString=".dtxs") returned 5 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".dtxs") returned 0x0 [0090.351] lstrlenW (lpString=".mdt") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".mdt") returned 0x0 [0090.351] lstrlenW (lpString=".sdf") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".sdf") returned 0x0 [0090.351] lstrlenW (lpString=".MDF") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".MDF") returned 0x0 [0090.351] lstrlenW (lpString=".DBF") returned 4 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".DBF") returned 0x0 [0090.351] lstrlenW (lpString=".DB") returned 3 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".DB") returned 0x0 [0090.351] lstrlenW (lpString=".db") returned 3 [0090.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".db") returned 0x0 [0090.352] lstrlenW (lpString=".ndf") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".ndf") returned 0x0 [0090.352] lstrlenW (lpString=".NDF") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".NDF") returned 0x0 [0090.352] lstrlenW (lpString=".Mdf") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".Mdf") returned 0x0 [0090.352] lstrlenW (lpString=".dat") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".dat") returned 0x0 [0090.352] lstrlenW (lpString=".DAT") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".DAT") returned 0x0 [0090.352] lstrlenW (lpString=".ldf") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".ldf") returned 0x0 [0090.352] lstrlenW (lpString=".LDF") returned 4 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch=".LDF") returned 0x0 [0090.352] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.352] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.353] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.353] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.353] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21035429808) returned 1 [0090.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4a9e630, dwHighDateTime=0x1d585b4)) [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4aa0 [0090.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4aa0 | out: hHeap=0x260000) returned 1 [0090.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.354] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.354] GetLastError () returned 0x0 [0090.354] GetLastError () returned 0x0 [0090.354] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.354] GetLastError () returned 0x0 [0090.355] GetLastError () returned 0x0 [0090.375] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc7d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.375] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x383, lpOverlapped=0x0) returned 1 [0090.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.378] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.378] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.378] CloseHandle (hObject=0xf0) returned 1 [0090.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.381] GetLastError () returned 0x0 [0090.381] RtlWakeConditionVariable () returned 0x0 [0090.381] GetCurrentThreadId () returned 0x98c [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".ldf") returned 0x0 [0090.381] lstrlenW (lpString=".vhd") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".vhd") returned 0x0 [0090.381] lstrlenW (lpString=".vhdx") returned 5 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".vhdx") returned 0x0 [0090.381] lstrlenW (lpString=".pst") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".pst") returned 0x0 [0090.381] lstrlenW (lpString=".ost") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".ost") returned 0x0 [0090.381] lstrlenW (lpString=".bak") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".bak") returned 0x0 [0090.381] lstrlenW (lpString=".bac") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".bac") returned 0x0 [0090.381] lstrlenW (lpString=".sys") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".sys") returned 0x0 [0090.381] lstrlenW (lpString=".v2i") returned 4 [0090.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".v2i") returned 0x0 [0090.382] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0090.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.384] lstrlenW (lpString=".sql") returned 4 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".sql") returned 0x0 [0090.384] lstrlenW (lpString=".mdf") returned 4 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".mdf") returned 0x0 [0090.384] lstrlenW (lpString=".txt") returned 4 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".txt") returned 0x0 [0090.384] lstrlenW (lpString=".dbf") returned 4 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".dbf") returned 0x0 [0090.384] lstrlenW (lpString=".ckp") returned 4 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".ckp") returned 0x0 [0090.384] lstrlenW (lpString=".dacpac") returned 7 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".dacpac") returned 0x0 [0090.384] lstrlenW (lpString=".db3") returned 4 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".db3") returned 0x0 [0090.384] lstrlenW (lpString=".dtxs") returned 5 [0090.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".dtxs") returned 0x0 [0090.385] lstrlenW (lpString=".mdt") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".mdt") returned 0x0 [0090.385] lstrlenW (lpString=".sdf") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".sdf") returned 0x0 [0090.385] lstrlenW (lpString=".MDF") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".MDF") returned 0x0 [0090.385] lstrlenW (lpString=".DBF") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".DBF") returned 0x0 [0090.385] lstrlenW (lpString=".DB") returned 3 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".DB") returned 0x0 [0090.385] lstrlenW (lpString=".db") returned 3 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".db") returned 0x0 [0090.385] lstrlenW (lpString=".ndf") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".ndf") returned 0x0 [0090.385] lstrlenW (lpString=".NDF") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".NDF") returned 0x0 [0090.385] lstrlenW (lpString=".Mdf") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".Mdf") returned 0x0 [0090.385] lstrlenW (lpString=".dat") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".dat") returned 0x0 [0090.385] lstrlenW (lpString=".DAT") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".DAT") returned 0x0 [0090.385] lstrlenW (lpString=".ldf") returned 4 [0090.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".ldf") returned 0x0 [0090.385] lstrlenW (lpString=".LDF") returned 4 [0090.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch=".LDF") returned 0x0 [0090.386] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.386] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.387] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.387] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.387] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21038811617) returned 1 [0090.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4b10a50, dwHighDateTime=0x1d585b4)) [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4b48 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4b48 | out: hHeap=0x260000) returned 1 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.388] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.388] GetLastError () returned 0x0 [0090.388] GetLastError () returned 0x0 [0090.388] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.388] GetLastError () returned 0x0 [0090.388] GetLastError () returned 0x0 [0090.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.391] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x13e, lpOverlapped=0x0) returned 1 [0090.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.391] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.391] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.391] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.392] CloseHandle (hObject=0xf0) returned 1 [0090.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.[deadmin@cock.li].deadmin")) returned 1 [0090.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.394] GetLastError () returned 0x0 [0090.394] RtlWakeConditionVariable () returned 0x0 [0090.394] GetCurrentThreadId () returned 0x98c [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".ldf") returned 0x0 [0090.394] lstrlenW (lpString=".vhd") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".vhd") returned 0x0 [0090.394] lstrlenW (lpString=".vhdx") returned 5 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".vhdx") returned 0x0 [0090.394] lstrlenW (lpString=".pst") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".pst") returned 0x0 [0090.394] lstrlenW (lpString=".ost") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".ost") returned 0x0 [0090.394] lstrlenW (lpString=".bak") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".bak") returned 0x0 [0090.394] lstrlenW (lpString=".bac") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".bac") returned 0x0 [0090.394] lstrlenW (lpString=".sys") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".sys") returned 0x0 [0090.394] lstrlenW (lpString=".v2i") returned 4 [0090.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".v2i") returned 0x0 [0090.394] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch="s\r\n.v2i") returned 0x0 [0090.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.396] lstrlenW (lpString=".sql") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".sql") returned 0x0 [0090.396] lstrlenW (lpString=".mdf") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".mdf") returned 0x0 [0090.396] lstrlenW (lpString=".txt") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".txt") returned 0x0 [0090.396] lstrlenW (lpString=".dbf") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".dbf") returned 0x0 [0090.396] lstrlenW (lpString=".ckp") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".ckp") returned 0x0 [0090.396] lstrlenW (lpString=".dacpac") returned 7 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".dacpac") returned 0x0 [0090.396] lstrlenW (lpString=".db3") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".db3") returned 0x0 [0090.396] lstrlenW (lpString=".dtxs") returned 5 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".dtxs") returned 0x0 [0090.396] lstrlenW (lpString=".mdt") returned 4 [0090.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".mdt") returned 0x0 [0090.396] lstrlenW (lpString=".sdf") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".sdf") returned 0x0 [0090.397] lstrlenW (lpString=".MDF") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".MDF") returned 0x0 [0090.397] lstrlenW (lpString=".DBF") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".DBF") returned 0x0 [0090.397] lstrlenW (lpString=".DB") returned 3 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".DB") returned 0x0 [0090.397] lstrlenW (lpString=".db") returned 3 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".db") returned 0x0 [0090.397] lstrlenW (lpString=".ndf") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".ndf") returned 0x0 [0090.397] lstrlenW (lpString=".NDF") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".NDF") returned 0x0 [0090.397] lstrlenW (lpString=".Mdf") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".Mdf") returned 0x0 [0090.397] lstrlenW (lpString=".dat") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".dat") returned 0x0 [0090.397] lstrlenW (lpString=".DAT") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".DAT") returned 0x0 [0090.397] lstrlenW (lpString=".ldf") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".ldf") returned 0x0 [0090.397] lstrlenW (lpString=".LDF") returned 4 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch=".LDF") returned 0x0 [0090.397] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.398] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.398] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.398] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.399] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21039971721) returned 1 [0090.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4b10a50, dwHighDateTime=0x1d585b4)) [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4b80 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4b80 | out: hHeap=0x260000) returned 1 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.399] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.400] GetLastError () returned 0x0 [0090.400] GetLastError () returned 0x0 [0090.400] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.400] GetLastError () returned 0x0 [0090.400] GetLastError () returned 0x0 [0090.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffeca0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.402] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x135f4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x135f4, lpOverlapped=0x0) returned 1 [0090.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.403] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.403] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.403] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.403] CloseHandle (hObject=0xf0) returned 1 [0090.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js.[deadmin@cock.li].deadmin")) returned 1 [0090.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.405] GetLastError () returned 0x0 [0090.405] RtlWakeConditionVariable () returned 0x0 [0090.405] GetCurrentThreadId () returned 0x98c [0090.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0090.405] lstrlenW (lpString=".vhd") returned 4 [0090.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".vhd") returned 0x0 [0090.405] lstrlenW (lpString=".vhdx") returned 5 [0090.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".vhdx") returned 0x0 [0090.405] lstrlenW (lpString=".pst") returned 4 [0090.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".pst") returned 0x0 [0090.405] lstrlenW (lpString=".ost") returned 4 [0090.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".ost") returned 0x0 [0090.406] lstrlenW (lpString=".bak") returned 4 [0090.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".bak") returned 0x0 [0090.406] lstrlenW (lpString=".bac") returned 4 [0090.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".bac") returned 0x0 [0090.406] lstrlenW (lpString=".sys") returned 4 [0090.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".sys") returned 0x0 [0090.406] lstrlenW (lpString=".v2i") returned 4 [0090.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".v2i") returned 0x0 [0090.406] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.408] lstrlenW (lpString=".sql") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".sql") returned 0x0 [0090.408] lstrlenW (lpString=".mdf") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".mdf") returned 0x0 [0090.408] lstrlenW (lpString=".txt") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".txt") returned 0x0 [0090.408] lstrlenW (lpString=".dbf") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".dbf") returned 0x0 [0090.408] lstrlenW (lpString=".ckp") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".ckp") returned 0x0 [0090.408] lstrlenW (lpString=".dacpac") returned 7 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".dacpac") returned 0x0 [0090.408] lstrlenW (lpString=".db3") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".db3") returned 0x0 [0090.408] lstrlenW (lpString=".dtxs") returned 5 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".dtxs") returned 0x0 [0090.408] lstrlenW (lpString=".mdt") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".mdt") returned 0x0 [0090.408] lstrlenW (lpString=".sdf") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".sdf") returned 0x0 [0090.408] lstrlenW (lpString=".MDF") returned 4 [0090.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".MDF") returned 0x0 [0090.408] lstrlenW (lpString=".DBF") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".DBF") returned 0x0 [0090.409] lstrlenW (lpString=".DB") returned 3 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".DB") returned 0x0 [0090.409] lstrlenW (lpString=".db") returned 3 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".db") returned 0x0 [0090.409] lstrlenW (lpString=".ndf") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".ndf") returned 0x0 [0090.409] lstrlenW (lpString=".NDF") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".NDF") returned 0x0 [0090.409] lstrlenW (lpString=".Mdf") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".Mdf") returned 0x0 [0090.409] lstrlenW (lpString=".dat") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".dat") returned 0x0 [0090.409] lstrlenW (lpString=".DAT") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".DAT") returned 0x0 [0090.409] lstrlenW (lpString=".ldf") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0090.409] lstrlenW (lpString=".LDF") returned 4 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch=".LDF") returned 0x0 [0090.409] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.409] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.410] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.410] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.410] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21041158463) returned 1 [0090.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4b36bb0, dwHighDateTime=0x1d585b4)) [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4bb8 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4bb8 | out: hHeap=0x260000) returned 1 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.411] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.411] GetLastError () returned 0x0 [0090.412] GetLastError () returned 0x0 [0090.412] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.412] GetLastError () returned 0x0 [0090.412] GetLastError () returned 0x0 [0090.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffba1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.496] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x45f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x45f, lpOverlapped=0x0) returned 1 [0090.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.496] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.497] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.497] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.497] CloseHandle (hObject=0xf0) returned 1 [0090.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.[deadmin@cock.li].deadmin")) returned 1 [0090.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.498] GetLastError () returned 0x0 [0090.498] RtlWakeConditionVariable () returned 0x0 [0090.499] GetCurrentThreadId () returned 0x98c [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".ldf") returned 0x0 [0090.499] lstrlenW (lpString=".vhd") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".vhd") returned 0x0 [0090.499] lstrlenW (lpString=".vhdx") returned 5 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".vhdx") returned 0x0 [0090.499] lstrlenW (lpString=".pst") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".pst") returned 0x0 [0090.499] lstrlenW (lpString=".ost") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".ost") returned 0x0 [0090.499] lstrlenW (lpString=".bak") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".bak") returned 0x0 [0090.499] lstrlenW (lpString=".bac") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".bac") returned 0x0 [0090.499] lstrlenW (lpString=".sys") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".sys") returned 0x0 [0090.499] lstrlenW (lpString=".v2i") returned 4 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".v2i") returned 0x0 [0090.499] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.501] lstrlenW (lpString=".sql") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".sql") returned 0x0 [0090.501] lstrlenW (lpString=".mdf") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".mdf") returned 0x0 [0090.501] lstrlenW (lpString=".txt") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".txt") returned 0x0 [0090.501] lstrlenW (lpString=".dbf") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".dbf") returned 0x0 [0090.501] lstrlenW (lpString=".ckp") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".ckp") returned 0x0 [0090.501] lstrlenW (lpString=".dacpac") returned 7 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".dacpac") returned 0x0 [0090.501] lstrlenW (lpString=".db3") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".db3") returned 0x0 [0090.501] lstrlenW (lpString=".dtxs") returned 5 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".dtxs") returned 0x0 [0090.501] lstrlenW (lpString=".mdt") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".mdt") returned 0x0 [0090.501] lstrlenW (lpString=".sdf") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".sdf") returned 0x0 [0090.501] lstrlenW (lpString=".MDF") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".MDF") returned 0x0 [0090.501] lstrlenW (lpString=".DBF") returned 4 [0090.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".DBF") returned 0x0 [0090.502] lstrlenW (lpString=".DB") returned 3 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".DB") returned 0x0 [0090.502] lstrlenW (lpString=".db") returned 3 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".db") returned 0x0 [0090.502] lstrlenW (lpString=".ndf") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".ndf") returned 0x0 [0090.502] lstrlenW (lpString=".NDF") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".NDF") returned 0x0 [0090.502] lstrlenW (lpString=".Mdf") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".Mdf") returned 0x0 [0090.502] lstrlenW (lpString=".dat") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".dat") returned 0x0 [0090.502] lstrlenW (lpString=".DAT") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".DAT") returned 0x0 [0090.502] lstrlenW (lpString=".ldf") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".ldf") returned 0x0 [0090.502] lstrlenW (lpString=".LDF") returned 4 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch=".LDF") returned 0x0 [0090.502] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.502] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.503] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.503] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.503] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21050447554) returned 1 [0090.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4c1b3f0, dwHighDateTime=0x1d585b4)) [0090.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4d78 [0090.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4d78 | out: hHeap=0x260000) returned 1 [0090.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.504] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.504] GetLastError () returned 0x0 [0090.504] GetLastError () returned 0x0 [0090.505] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.505] GetLastError () returned 0x0 [0090.505] GetLastError () returned 0x0 [0090.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff7a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.506] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x858, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x858, lpOverlapped=0x0) returned 1 [0090.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.507] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.507] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.507] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.507] CloseHandle (hObject=0xf0) returned 1 [0090.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0090.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.509] GetLastError () returned 0x0 [0090.509] RtlWakeConditionVariable () returned 0x0 [0090.509] GetCurrentThreadId () returned 0x98c [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0090.509] lstrlenW (lpString=".vhd") returned 4 [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".vhd") returned 0x0 [0090.509] lstrlenW (lpString=".vhdx") returned 5 [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".vhdx") returned 0x0 [0090.509] lstrlenW (lpString=".pst") returned 4 [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".pst") returned 0x0 [0090.509] lstrlenW (lpString=".ost") returned 4 [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".ost") returned 0x0 [0090.509] lstrlenW (lpString=".bak") returned 4 [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".bak") returned 0x0 [0090.509] lstrlenW (lpString=".bac") returned 4 [0090.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".bac") returned 0x0 [0090.509] lstrlenW (lpString=".sys") returned 4 [0090.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".sys") returned 0x0 [0090.510] lstrlenW (lpString=".v2i") returned 4 [0090.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".v2i") returned 0x0 [0090.510] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.511] lstrlenW (lpString=".sql") returned 4 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".sql") returned 0x0 [0090.511] lstrlenW (lpString=".mdf") returned 4 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".mdf") returned 0x0 [0090.511] lstrlenW (lpString=".txt") returned 4 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".txt") returned 0x0 [0090.511] lstrlenW (lpString=".dbf") returned 4 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".dbf") returned 0x0 [0090.511] lstrlenW (lpString=".ckp") returned 4 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".ckp") returned 0x0 [0090.511] lstrlenW (lpString=".dacpac") returned 7 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".dacpac") returned 0x0 [0090.511] lstrlenW (lpString=".db3") returned 4 [0090.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".db3") returned 0x0 [0090.511] lstrlenW (lpString=".dtxs") returned 5 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".dtxs") returned 0x0 [0090.512] lstrlenW (lpString=".mdt") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".mdt") returned 0x0 [0090.512] lstrlenW (lpString=".sdf") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".sdf") returned 0x0 [0090.512] lstrlenW (lpString=".MDF") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".MDF") returned 0x0 [0090.512] lstrlenW (lpString=".DBF") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".DBF") returned 0x0 [0090.512] lstrlenW (lpString=".DB") returned 3 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".DB") returned 0x0 [0090.512] lstrlenW (lpString=".db") returned 3 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".db") returned 0x0 [0090.512] lstrlenW (lpString=".ndf") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".ndf") returned 0x0 [0090.512] lstrlenW (lpString=".NDF") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".NDF") returned 0x0 [0090.512] lstrlenW (lpString=".Mdf") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".Mdf") returned 0x0 [0090.512] lstrlenW (lpString=".dat") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".dat") returned 0x0 [0090.512] lstrlenW (lpString=".DAT") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".DAT") returned 0x0 [0090.512] lstrlenW (lpString=".ldf") returned 4 [0090.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0090.513] lstrlenW (lpString=".LDF") returned 4 [0090.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch=".LDF") returned 0x0 [0090.513] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.513] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.514] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.514] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.514] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21051487152) returned 1 [0090.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4c41550, dwHighDateTime=0x1d585b4)) [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4db0 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4db0 | out: hHeap=0x260000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.514] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.515] GetLastError () returned 0x0 [0090.515] GetLastError () returned 0x0 [0090.515] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.515] GetLastError () returned 0x0 [0090.515] GetLastError () returned 0x0 [0090.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb95d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.517] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x46a3, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x46a3, lpOverlapped=0x0) returned 1 [0090.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.517] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.517] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.518] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.518] CloseHandle (hObject=0xf0) returned 1 [0090.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0090.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.520] GetLastError () returned 0x0 [0090.520] RtlWakeConditionVariable () returned 0x0 [0090.520] GetCurrentThreadId () returned 0x98c [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0090.520] lstrlenW (lpString=".vhd") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".vhd") returned 0x0 [0090.520] lstrlenW (lpString=".vhdx") returned 5 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".vhdx") returned 0x0 [0090.520] lstrlenW (lpString=".pst") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".pst") returned 0x0 [0090.520] lstrlenW (lpString=".ost") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".ost") returned 0x0 [0090.520] lstrlenW (lpString=".bak") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".bak") returned 0x0 [0090.520] lstrlenW (lpString=".bac") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".bac") returned 0x0 [0090.520] lstrlenW (lpString=".sys") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".sys") returned 0x0 [0090.520] lstrlenW (lpString=".v2i") returned 4 [0090.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".v2i") returned 0x0 [0090.521] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.522] lstrlenW (lpString=".sql") returned 4 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".sql") returned 0x0 [0090.522] lstrlenW (lpString=".mdf") returned 4 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".mdf") returned 0x0 [0090.522] lstrlenW (lpString=".txt") returned 4 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".txt") returned 0x0 [0090.522] lstrlenW (lpString=".dbf") returned 4 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".dbf") returned 0x0 [0090.522] lstrlenW (lpString=".ckp") returned 4 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".ckp") returned 0x0 [0090.522] lstrlenW (lpString=".dacpac") returned 7 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".dacpac") returned 0x0 [0090.522] lstrlenW (lpString=".db3") returned 4 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".db3") returned 0x0 [0090.522] lstrlenW (lpString=".dtxs") returned 5 [0090.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".dtxs") returned 0x0 [0090.523] lstrlenW (lpString=".mdt") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".mdt") returned 0x0 [0090.523] lstrlenW (lpString=".sdf") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".sdf") returned 0x0 [0090.523] lstrlenW (lpString=".MDF") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".MDF") returned 0x0 [0090.523] lstrlenW (lpString=".DBF") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".DBF") returned 0x0 [0090.523] lstrlenW (lpString=".DB") returned 3 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".DB") returned 0x0 [0090.523] lstrlenW (lpString=".db") returned 3 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".db") returned 0x0 [0090.523] lstrlenW (lpString=".ndf") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".ndf") returned 0x0 [0090.523] lstrlenW (lpString=".NDF") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".NDF") returned 0x0 [0090.523] lstrlenW (lpString=".Mdf") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".Mdf") returned 0x0 [0090.523] lstrlenW (lpString=".dat") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".dat") returned 0x0 [0090.523] lstrlenW (lpString=".DAT") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".DAT") returned 0x0 [0090.523] lstrlenW (lpString=".ldf") returned 4 [0090.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0090.523] lstrlenW (lpString=".LDF") returned 4 [0090.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch=".LDF") returned 0x0 [0090.524] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.524] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.524] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.525] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.525] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21052584112) returned 1 [0090.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4c41550, dwHighDateTime=0x1d585b4)) [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4de8 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4de8 | out: hHeap=0x260000) returned 1 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.525] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.526] GetLastError () returned 0x0 [0090.526] GetLastError () returned 0x0 [0090.526] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.526] GetLastError () returned 0x0 [0090.526] GetLastError () returned 0x0 [0090.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.531] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x612, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x612, lpOverlapped=0x0) returned 1 [0090.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.531] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.531] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.531] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.531] CloseHandle (hObject=0xf0) returned 1 [0090.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2762060 [0090.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0090.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762060 | out: hHeap=0x260000) returned 1 [0090.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.533] GetLastError () returned 0x0 [0090.533] RtlWakeConditionVariable () returned 0x0 [0090.534] GetCurrentThreadId () returned 0x98c [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".ldf") returned 0x0 [0090.534] lstrlenW (lpString=".vhd") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".vhd") returned 0x0 [0090.534] lstrlenW (lpString=".vhdx") returned 5 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".vhdx") returned 0x0 [0090.534] lstrlenW (lpString=".pst") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".pst") returned 0x0 [0090.534] lstrlenW (lpString=".ost") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".ost") returned 0x0 [0090.534] lstrlenW (lpString=".bak") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".bak") returned 0x0 [0090.534] lstrlenW (lpString=".bac") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".bac") returned 0x0 [0090.534] lstrlenW (lpString=".sys") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".sys") returned 0x0 [0090.534] lstrlenW (lpString=".v2i") returned 4 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".v2i") returned 0x0 [0090.534] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.536] lstrlenW (lpString=".sql") returned 4 [0090.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".sql") returned 0x0 [0090.536] lstrlenW (lpString=".mdf") returned 4 [0090.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".mdf") returned 0x0 [0090.536] lstrlenW (lpString=".txt") returned 4 [0090.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".txt") returned 0x0 [0090.536] lstrlenW (lpString=".dbf") returned 4 [0090.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".dbf") returned 0x0 [0090.536] lstrlenW (lpString=".ckp") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".ckp") returned 0x0 [0090.537] lstrlenW (lpString=".dacpac") returned 7 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".dacpac") returned 0x0 [0090.537] lstrlenW (lpString=".db3") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".db3") returned 0x0 [0090.537] lstrlenW (lpString=".dtxs") returned 5 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".dtxs") returned 0x0 [0090.537] lstrlenW (lpString=".mdt") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".mdt") returned 0x0 [0090.537] lstrlenW (lpString=".sdf") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".sdf") returned 0x0 [0090.537] lstrlenW (lpString=".MDF") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".MDF") returned 0x0 [0090.537] lstrlenW (lpString=".DBF") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".DBF") returned 0x0 [0090.537] lstrlenW (lpString=".DB") returned 3 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".DB") returned 0x0 [0090.537] lstrlenW (lpString=".db") returned 3 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".db") returned 0x0 [0090.537] lstrlenW (lpString=".ndf") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".ndf") returned 0x0 [0090.537] lstrlenW (lpString=".NDF") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".NDF") returned 0x0 [0090.537] lstrlenW (lpString=".Mdf") returned 4 [0090.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".Mdf") returned 0x0 [0090.537] lstrlenW (lpString=".dat") returned 4 [0090.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".dat") returned 0x0 [0090.538] lstrlenW (lpString=".DAT") returned 4 [0090.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".DAT") returned 0x0 [0090.538] lstrlenW (lpString=".ldf") returned 4 [0090.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".ldf") returned 0x0 [0090.538] lstrlenW (lpString=".LDF") returned 4 [0090.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch=".LDF") returned 0x0 [0090.538] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.538] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.539] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.539] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21054008532) returned 1 [0090.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4c676b0, dwHighDateTime=0x1d585b4)) [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4e20 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4e20 | out: hHeap=0x260000) returned 1 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.540] GetLastError () returned 0x0 [0090.540] GetLastError () returned 0x0 [0090.540] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.540] GetLastError () returned 0x0 [0090.540] GetLastError () returned 0x0 [0090.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.603] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x75f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x75f, lpOverlapped=0x0) returned 1 [0090.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0090.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.606] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.606] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.606] CloseHandle (hObject=0xf0) returned 1 [0090.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0090.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css.[deadmin@cock.li].deadmin")) returned 1 [0090.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.608] GetLastError () returned 0x0 [0090.608] RtlWakeConditionVariable () returned 0x0 [0090.608] GetCurrentThreadId () returned 0x98c [0090.621] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.621] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.621] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.621] WriteFile (in: hFile=0xd8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.623] CloseHandle (hObject=0xd8) returned 1 [0090.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35aaa8 | out: hHeap=0x260000) returned 1 [0090.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.623] RtlWakeConditionVariable () returned 0x0 [0090.624] GetCurrentThreadId () returned 0x98c [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.624] lstrlenW (lpString=".vhd") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.624] lstrlenW (lpString=".vhdx") returned 5 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.624] lstrlenW (lpString=".pst") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.624] lstrlenW (lpString=".ost") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.624] lstrlenW (lpString=".bak") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.624] lstrlenW (lpString=".bac") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.624] lstrlenW (lpString=".sys") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.624] lstrlenW (lpString=".v2i") returned 4 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.624] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.626] lstrlenW (lpString=".sql") returned 4 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.626] lstrlenW (lpString=".mdf") returned 4 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.626] lstrlenW (lpString=".txt") returned 4 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.626] lstrlenW (lpString=".dbf") returned 4 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.626] lstrlenW (lpString=".ckp") returned 4 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.626] lstrlenW (lpString=".dacpac") returned 7 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.626] lstrlenW (lpString=".db3") returned 4 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.626] lstrlenW (lpString=".dtxs") returned 5 [0090.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.626] lstrlenW (lpString=".mdt") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.627] lstrlenW (lpString=".sdf") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.627] lstrlenW (lpString=".MDF") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.627] lstrlenW (lpString=".DBF") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.627] lstrlenW (lpString=".DB") returned 3 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.627] lstrlenW (lpString=".db") returned 3 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.627] lstrlenW (lpString=".ndf") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.627] lstrlenW (lpString=".NDF") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.627] lstrlenW (lpString=".Mdf") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.627] lstrlenW (lpString=".dat") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.627] lstrlenW (lpString=".DAT") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.627] lstrlenW (lpString=".ldf") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.627] lstrlenW (lpString=".LDF") returned 4 [0090.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.627] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.628] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.628] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.628] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.629] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21062975924) returned 1 [0090.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4d4bef0, dwHighDateTime=0x1d585b4)) [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5088 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5088 | out: hHeap=0x260000) returned 1 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.629] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.629] GetLastError () returned 0x0 [0090.630] GetLastError () returned 0x0 [0090.630] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.630] GetLastError () returned 0x0 [0090.630] GetLastError () returned 0x0 [0090.632] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.632] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0090.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.632] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.632] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.633] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.633] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.633] CloseHandle (hObject=0xd8) returned 1 [0090.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.635] GetLastError () returned 0x0 [0090.635] RtlWakeConditionVariable () returned 0x27e828 [0090.635] GetCurrentThreadId () returned 0x98c [0090.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.635] lstrlenW (lpString=".vhd") returned 4 [0090.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.635] lstrlenW (lpString=".vhdx") returned 5 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.636] lstrlenW (lpString=".pst") returned 4 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.636] lstrlenW (lpString=".ost") returned 4 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.636] lstrlenW (lpString=".bak") returned 4 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.636] lstrlenW (lpString=".bac") returned 4 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.636] lstrlenW (lpString=".sys") returned 4 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.636] lstrlenW (lpString=".v2i") returned 4 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.636] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.638] lstrlenW (lpString=".sql") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.638] lstrlenW (lpString=".mdf") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.638] lstrlenW (lpString=".txt") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.638] lstrlenW (lpString=".dbf") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.638] lstrlenW (lpString=".ckp") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.638] lstrlenW (lpString=".dacpac") returned 7 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.638] lstrlenW (lpString=".db3") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.638] lstrlenW (lpString=".dtxs") returned 5 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.638] lstrlenW (lpString=".mdt") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.638] lstrlenW (lpString=".sdf") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.638] lstrlenW (lpString=".MDF") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.638] lstrlenW (lpString=".DBF") returned 4 [0090.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.638] lstrlenW (lpString=".DB") returned 3 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.639] lstrlenW (lpString=".db") returned 3 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.639] lstrlenW (lpString=".ndf") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.639] lstrlenW (lpString=".NDF") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.639] lstrlenW (lpString=".Mdf") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.639] lstrlenW (lpString=".dat") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.639] lstrlenW (lpString=".DAT") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.639] lstrlenW (lpString=".ldf") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.639] lstrlenW (lpString=".LDF") returned 4 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.639] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.639] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.640] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.640] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21064146957) returned 1 [0090.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4d72050, dwHighDateTime=0x1d585b4)) [0090.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b50c0 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b50c0 | out: hHeap=0x260000) returned 1 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.641] GetLastError () returned 0x0 [0090.641] GetLastError () returned 0x0 [0090.641] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.642] GetLastError () returned 0x0 [0090.642] GetLastError () returned 0x0 [0090.643] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.643] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0090.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.643] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.643] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.643] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.643] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.643] CloseHandle (hObject=0xd8) returned 1 [0090.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.645] GetLastError () returned 0x0 [0090.645] RtlWakeConditionVariable () returned 0x27e828 [0090.645] GetCurrentThreadId () returned 0x98c [0090.647] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.647] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.647] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.647] WriteFile (in: hFile=0xd8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.649] CloseHandle (hObject=0xd8) returned 1 [0090.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35abc0 | out: hHeap=0x260000) returned 1 [0090.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.649] RtlWakeConditionVariable () returned 0x0 [0090.649] GetCurrentThreadId () returned 0x98c [0090.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".ldf") returned 0x0 [0090.649] lstrlenW (lpString=".vhd") returned 4 [0090.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".vhd") returned 0x0 [0090.649] lstrlenW (lpString=".vhdx") returned 5 [0090.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".vhdx") returned 0x0 [0090.650] lstrlenW (lpString=".pst") returned 4 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".pst") returned 0x0 [0090.650] lstrlenW (lpString=".ost") returned 4 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".ost") returned 0x0 [0090.650] lstrlenW (lpString=".bak") returned 4 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".bak") returned 0x0 [0090.650] lstrlenW (lpString=".bac") returned 4 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".bac") returned 0x0 [0090.650] lstrlenW (lpString=".sys") returned 4 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".sys") returned 0x0 [0090.650] lstrlenW (lpString=".v2i") returned 4 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".v2i") returned 0x0 [0090.650] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.651] lstrlenW (lpString=".sql") returned 4 [0090.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".sql") returned 0x0 [0090.651] lstrlenW (lpString=".mdf") returned 4 [0090.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".mdf") returned 0x0 [0090.651] lstrlenW (lpString=".txt") returned 4 [0090.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".txt") returned 0x0 [0090.651] lstrlenW (lpString=".dbf") returned 4 [0090.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".dbf") returned 0x0 [0090.651] lstrlenW (lpString=".ckp") returned 4 [0090.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".ckp") returned 0x0 [0090.651] lstrlenW (lpString=".dacpac") returned 7 [0090.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".dacpac") returned 0x0 [0090.651] lstrlenW (lpString=".db3") returned 4 [0090.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".db3") returned 0x0 [0090.652] lstrlenW (lpString=".dtxs") returned 5 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".dtxs") returned 0x0 [0090.689] lstrlenW (lpString=".mdt") returned 4 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".mdt") returned 0x0 [0090.689] lstrlenW (lpString=".sdf") returned 4 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".sdf") returned 0x0 [0090.689] lstrlenW (lpString=".MDF") returned 4 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".MDF") returned 0x0 [0090.689] lstrlenW (lpString=".DBF") returned 4 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".DBF") returned 0x0 [0090.689] lstrlenW (lpString=".DB") returned 3 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".DB") returned 0x0 [0090.689] lstrlenW (lpString=".db") returned 3 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".db") returned 0x0 [0090.689] lstrlenW (lpString=".ndf") returned 4 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".ndf") returned 0x0 [0090.690] lstrlenW (lpString=".NDF") returned 4 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".NDF") returned 0x0 [0090.690] lstrlenW (lpString=".Mdf") returned 4 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".Mdf") returned 0x0 [0090.690] lstrlenW (lpString=".dat") returned 4 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".dat") returned 0x0 [0090.690] lstrlenW (lpString=".DAT") returned 4 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".DAT") returned 0x0 [0090.690] lstrlenW (lpString=".ldf") returned 4 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".ldf") returned 0x0 [0090.690] lstrlenW (lpString=".LDF") returned 4 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch=".LDF") returned 0x0 [0090.690] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.690] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.691] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.691] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.691] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21069228168) returned 1 [0090.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4de4470, dwHighDateTime=0x1d585b4)) [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b51d8 [0090.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b51d8 | out: hHeap=0x260000) returned 1 [0090.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.692] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.692] GetLastError () returned 0x0 [0090.692] GetLastError () returned 0x0 [0090.692] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.692] GetLastError () returned 0x0 [0090.693] GetLastError () returned 0x0 [0090.694] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffeefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.694] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1103, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1103, lpOverlapped=0x0) returned 1 [0090.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.695] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.695] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.695] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.695] CloseHandle (hObject=0xd8) returned 1 [0090.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0090.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css.[deadmin@cock.li].deadmin")) returned 1 [0090.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.697] GetLastError () returned 0x0 [0090.697] RtlWakeConditionVariable () returned 0x0 [0090.697] GetCurrentThreadId () returned 0x98c [0090.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.697] lstrlenW (lpString=".vhd") returned 4 [0090.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.698] lstrlenW (lpString=".vhdx") returned 5 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.698] lstrlenW (lpString=".pst") returned 4 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.698] lstrlenW (lpString=".ost") returned 4 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.698] lstrlenW (lpString=".bak") returned 4 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.698] lstrlenW (lpString=".bac") returned 4 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.698] lstrlenW (lpString=".sys") returned 4 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.698] lstrlenW (lpString=".v2i") returned 4 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.698] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.745] lstrlenW (lpString=".sql") returned 4 [0090.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.745] lstrlenW (lpString=".mdf") returned 4 [0090.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.745] lstrlenW (lpString=".txt") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.746] lstrlenW (lpString=".dbf") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.746] lstrlenW (lpString=".ckp") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.746] lstrlenW (lpString=".dacpac") returned 7 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.746] lstrlenW (lpString=".db3") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.746] lstrlenW (lpString=".dtxs") returned 5 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.746] lstrlenW (lpString=".mdt") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.746] lstrlenW (lpString=".sdf") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.746] lstrlenW (lpString=".MDF") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.746] lstrlenW (lpString=".DBF") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.746] lstrlenW (lpString=".DB") returned 3 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.746] lstrlenW (lpString=".db") returned 3 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.746] lstrlenW (lpString=".ndf") returned 4 [0090.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.746] lstrlenW (lpString=".NDF") returned 4 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.747] lstrlenW (lpString=".Mdf") returned 4 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.747] lstrlenW (lpString=".dat") returned 4 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.747] lstrlenW (lpString=".DAT") returned 4 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.747] lstrlenW (lpString=".ldf") returned 4 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.747] lstrlenW (lpString=".LDF") returned 4 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.747] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.747] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.748] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.748] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.748] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21075097929) returned 1 [0090.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4e7c9f0, dwHighDateTime=0x1d585b4)) [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b52b8 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b52b8 | out: hHeap=0x260000) returned 1 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.751] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.751] GetLastError () returned 0x0 [0090.751] GetLastError () returned 0x0 [0090.751] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.751] GetLastError () returned 0x0 [0090.751] GetLastError () returned 0x0 [0090.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.752] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0090.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.753] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.753] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.753] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.753] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.753] CloseHandle (hObject=0xf0) returned 1 [0090.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0090.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29227e8 | out: hHeap=0x260000) returned 1 [0090.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.756] GetLastError () returned 0x0 [0090.756] RtlWakeConditionVariable () returned 0x27e828 [0090.756] GetCurrentThreadId () returned 0x98c [0090.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.756] lstrlenW (lpString=".vhd") returned 4 [0090.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.756] lstrlenW (lpString=".vhdx") returned 5 [0090.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.756] lstrlenW (lpString=".pst") returned 4 [0090.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.756] lstrlenW (lpString=".ost") returned 4 [0090.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.757] lstrlenW (lpString=".bak") returned 4 [0090.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.757] lstrlenW (lpString=".bac") returned 4 [0090.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.757] lstrlenW (lpString=".sys") returned 4 [0090.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.757] lstrlenW (lpString=".v2i") returned 4 [0090.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.757] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.759] lstrlenW (lpString=".sql") returned 4 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.759] lstrlenW (lpString=".mdf") returned 4 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.759] lstrlenW (lpString=".txt") returned 4 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.759] lstrlenW (lpString=".dbf") returned 4 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.759] lstrlenW (lpString=".ckp") returned 4 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.759] lstrlenW (lpString=".dacpac") returned 7 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.759] lstrlenW (lpString=".db3") returned 4 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.759] lstrlenW (lpString=".dtxs") returned 5 [0090.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.760] lstrlenW (lpString=".mdt") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.760] lstrlenW (lpString=".sdf") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.760] lstrlenW (lpString=".MDF") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.760] lstrlenW (lpString=".DBF") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.760] lstrlenW (lpString=".DB") returned 3 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.760] lstrlenW (lpString=".db") returned 3 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.760] lstrlenW (lpString=".ndf") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.760] lstrlenW (lpString=".NDF") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.760] lstrlenW (lpString=".Mdf") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.760] lstrlenW (lpString=".dat") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.760] lstrlenW (lpString=".DAT") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.760] lstrlenW (lpString=".ldf") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.760] lstrlenW (lpString=".LDF") returned 4 [0090.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.761] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.761] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.762] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.762] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.762] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21076307758) returned 1 [0090.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4ea2b50, dwHighDateTime=0x1d585b4)) [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b52f0 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b52f0 | out: hHeap=0x260000) returned 1 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.763] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.763] GetLastError () returned 0x0 [0090.763] GetLastError () returned 0x0 [0090.763] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.763] GetLastError () returned 0x0 [0090.763] GetLastError () returned 0x0 [0090.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.765] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0090.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.765] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.765] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.765] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.765] CloseHandle (hObject=0xf0) returned 1 [0090.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0090.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29227e8 | out: hHeap=0x260000) returned 1 [0090.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.768] GetLastError () returned 0x0 [0090.768] RtlWakeConditionVariable () returned 0x27e828 [0090.768] GetCurrentThreadId () returned 0x98c [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.768] lstrlenW (lpString=".vhd") returned 4 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.768] lstrlenW (lpString=".vhdx") returned 5 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.768] lstrlenW (lpString=".pst") returned 4 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.768] lstrlenW (lpString=".ost") returned 4 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.768] lstrlenW (lpString=".bak") returned 4 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.768] lstrlenW (lpString=".bac") returned 4 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.768] lstrlenW (lpString=".sys") returned 4 [0090.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.769] lstrlenW (lpString=".v2i") returned 4 [0090.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.769] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.770] lstrlenW (lpString=".sql") returned 4 [0090.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.770] lstrlenW (lpString=".mdf") returned 4 [0090.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.771] lstrlenW (lpString=".txt") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.771] lstrlenW (lpString=".dbf") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.771] lstrlenW (lpString=".ckp") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.771] lstrlenW (lpString=".dacpac") returned 7 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.771] lstrlenW (lpString=".db3") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.771] lstrlenW (lpString=".dtxs") returned 5 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.771] lstrlenW (lpString=".mdt") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.771] lstrlenW (lpString=".sdf") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.771] lstrlenW (lpString=".MDF") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.771] lstrlenW (lpString=".DBF") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.771] lstrlenW (lpString=".DB") returned 3 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.771] lstrlenW (lpString=".db") returned 3 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.771] lstrlenW (lpString=".ndf") returned 4 [0090.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.772] lstrlenW (lpString=".NDF") returned 4 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.772] lstrlenW (lpString=".Mdf") returned 4 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.772] lstrlenW (lpString=".dat") returned 4 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.772] lstrlenW (lpString=".DAT") returned 4 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.772] lstrlenW (lpString=".ldf") returned 4 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.772] lstrlenW (lpString=".LDF") returned 4 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.772] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.772] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.773] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.773] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.773] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21077429900) returned 1 [0090.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4ea2b50, dwHighDateTime=0x1d585b4)) [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5328 [0090.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5328 | out: hHeap=0x260000) returned 1 [0090.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.774] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.774] GetLastError () returned 0x0 [0090.774] GetLastError () returned 0x0 [0090.774] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.774] GetLastError () returned 0x0 [0090.775] GetLastError () returned 0x0 [0090.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.776] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xde, lpOverlapped=0x0) returned 1 [0090.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.776] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.776] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.776] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.777] CloseHandle (hObject=0xf0) returned 1 [0090.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0090.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29227e8 | out: hHeap=0x260000) returned 1 [0090.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.781] GetLastError () returned 0x0 [0090.781] RtlWakeConditionVariable () returned 0x0 [0090.781] GetCurrentThreadId () returned 0x98c [0090.781] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.781] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.781] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.781] WriteFile (in: hFile=0xf0, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.783] CloseHandle (hObject=0xf0) returned 1 [0090.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x260000) returned 1 [0090.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.784] RtlWakeConditionVariable () returned 0x27e828 [0090.784] GetCurrentThreadId () returned 0x98c [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".ldf") returned 0x0 [0090.784] lstrlenW (lpString=".vhd") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".vhd") returned 0x0 [0090.784] lstrlenW (lpString=".vhdx") returned 5 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".vhdx") returned 0x0 [0090.784] lstrlenW (lpString=".pst") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".pst") returned 0x0 [0090.784] lstrlenW (lpString=".ost") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".ost") returned 0x0 [0090.784] lstrlenW (lpString=".bak") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".bak") returned 0x0 [0090.784] lstrlenW (lpString=".bac") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".bac") returned 0x0 [0090.784] lstrlenW (lpString=".sys") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".sys") returned 0x0 [0090.784] lstrlenW (lpString=".v2i") returned 4 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".v2i") returned 0x0 [0090.784] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.786] lstrlenW (lpString=".sql") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".sql") returned 0x0 [0090.786] lstrlenW (lpString=".mdf") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".mdf") returned 0x0 [0090.786] lstrlenW (lpString=".txt") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".txt") returned 0x0 [0090.786] lstrlenW (lpString=".dbf") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".dbf") returned 0x0 [0090.786] lstrlenW (lpString=".ckp") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".ckp") returned 0x0 [0090.786] lstrlenW (lpString=".dacpac") returned 7 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".dacpac") returned 0x0 [0090.786] lstrlenW (lpString=".db3") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".db3") returned 0x0 [0090.786] lstrlenW (lpString=".dtxs") returned 5 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".dtxs") returned 0x0 [0090.786] lstrlenW (lpString=".mdt") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".mdt") returned 0x0 [0090.786] lstrlenW (lpString=".sdf") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".sdf") returned 0x0 [0090.786] lstrlenW (lpString=".MDF") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".MDF") returned 0x0 [0090.786] lstrlenW (lpString=".DBF") returned 4 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".DBF") returned 0x0 [0090.786] lstrlenW (lpString=".DB") returned 3 [0090.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".DB") returned 0x0 [0090.787] lstrlenW (lpString=".db") returned 3 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".db") returned 0x0 [0090.787] lstrlenW (lpString=".ndf") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".ndf") returned 0x0 [0090.787] lstrlenW (lpString=".NDF") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".NDF") returned 0x0 [0090.787] lstrlenW (lpString=".Mdf") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".Mdf") returned 0x0 [0090.787] lstrlenW (lpString=".dat") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".dat") returned 0x0 [0090.787] lstrlenW (lpString=".DAT") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".DAT") returned 0x0 [0090.787] lstrlenW (lpString=".ldf") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".ldf") returned 0x0 [0090.787] lstrlenW (lpString=".LDF") returned 4 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch=".LDF") returned 0x0 [0090.787] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.787] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.788] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.788] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.788] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21078943668) returned 1 [0090.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4ec8cb0, dwHighDateTime=0x1d585b4)) [0090.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5398 [0090.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5398 | out: hHeap=0x260000) returned 1 [0090.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.789] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.789] GetLastError () returned 0x0 [0090.789] GetLastError () returned 0x0 [0090.789] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.790] GetLastError () returned 0x0 [0090.790] GetLastError () returned 0x0 [0090.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffef8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.791] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1074, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1074, lpOverlapped=0x0) returned 1 [0090.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.792] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.792] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.792] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.792] CloseHandle (hObject=0xf0) returned 1 [0090.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css.[deadmin@cock.li].deadmin")) returned 1 [0090.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.794] GetLastError () returned 0x0 [0090.794] RtlWakeConditionVariable () returned 0x0 [0090.794] GetCurrentThreadId () returned 0x98c [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".ldf") returned 0x0 [0090.794] lstrlenW (lpString=".vhd") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".vhd") returned 0x0 [0090.794] lstrlenW (lpString=".vhdx") returned 5 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".vhdx") returned 0x0 [0090.794] lstrlenW (lpString=".pst") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".pst") returned 0x0 [0090.794] lstrlenW (lpString=".ost") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".ost") returned 0x0 [0090.794] lstrlenW (lpString=".bak") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".bak") returned 0x0 [0090.794] lstrlenW (lpString=".bac") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".bac") returned 0x0 [0090.794] lstrlenW (lpString=".sys") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".sys") returned 0x0 [0090.794] lstrlenW (lpString=".v2i") returned 4 [0090.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".v2i") returned 0x0 [0090.794] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.796] lstrlenW (lpString=".sql") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".sql") returned 0x0 [0090.796] lstrlenW (lpString=".mdf") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".mdf") returned 0x0 [0090.796] lstrlenW (lpString=".txt") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".txt") returned 0x0 [0090.796] lstrlenW (lpString=".dbf") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".dbf") returned 0x0 [0090.796] lstrlenW (lpString=".ckp") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".ckp") returned 0x0 [0090.796] lstrlenW (lpString=".dacpac") returned 7 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".dacpac") returned 0x0 [0090.796] lstrlenW (lpString=".db3") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".db3") returned 0x0 [0090.796] lstrlenW (lpString=".dtxs") returned 5 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".dtxs") returned 0x0 [0090.796] lstrlenW (lpString=".mdt") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".mdt") returned 0x0 [0090.796] lstrlenW (lpString=".sdf") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".sdf") returned 0x0 [0090.796] lstrlenW (lpString=".MDF") returned 4 [0090.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".MDF") returned 0x0 [0090.796] lstrlenW (lpString=".DBF") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".DBF") returned 0x0 [0090.797] lstrlenW (lpString=".DB") returned 3 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".DB") returned 0x0 [0090.797] lstrlenW (lpString=".db") returned 3 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".db") returned 0x0 [0090.797] lstrlenW (lpString=".ndf") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".ndf") returned 0x0 [0090.797] lstrlenW (lpString=".NDF") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".NDF") returned 0x0 [0090.797] lstrlenW (lpString=".Mdf") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".Mdf") returned 0x0 [0090.797] lstrlenW (lpString=".dat") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".dat") returned 0x0 [0090.797] lstrlenW (lpString=".DAT") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".DAT") returned 0x0 [0090.797] lstrlenW (lpString=".ldf") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".ldf") returned 0x0 [0090.797] lstrlenW (lpString=".LDF") returned 4 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch=".LDF") returned 0x0 [0090.797] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.797] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.798] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.798] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.798] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21079956304) returned 1 [0090.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4eeee10, dwHighDateTime=0x1d585b4)) [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b53d0 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b53d0 | out: hHeap=0x260000) returned 1 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.799] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.799] GetLastError () returned 0x0 [0090.799] GetLastError () returned 0x0 [0090.800] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.800] GetLastError () returned 0x0 [0090.800] GetLastError () returned 0x0 [0090.802] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.802] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x760, lpOverlapped=0x0) returned 1 [0090.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.803] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.803] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.803] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.803] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.803] CloseHandle (hObject=0xf0) returned 1 [0090.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0090.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css.[deadmin@cock.li].deadmin")) returned 1 [0090.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.804] GetLastError () returned 0x0 [0090.804] RtlWakeConditionVariable () returned 0x0 [0090.804] GetCurrentThreadId () returned 0x98c [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".ldf") returned 0x0 [0090.805] lstrlenW (lpString=".vhd") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".vhd") returned 0x0 [0090.805] lstrlenW (lpString=".vhdx") returned 5 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".vhdx") returned 0x0 [0090.805] lstrlenW (lpString=".pst") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".pst") returned 0x0 [0090.805] lstrlenW (lpString=".ost") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".ost") returned 0x0 [0090.805] lstrlenW (lpString=".bak") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".bak") returned 0x0 [0090.805] lstrlenW (lpString=".bac") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".bac") returned 0x0 [0090.805] lstrlenW (lpString=".sys") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".sys") returned 0x0 [0090.805] lstrlenW (lpString=".v2i") returned 4 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".v2i") returned 0x0 [0090.805] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.806] lstrlenW (lpString=".sql") returned 4 [0090.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".sql") returned 0x0 [0090.806] lstrlenW (lpString=".mdf") returned 4 [0090.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".mdf") returned 0x0 [0090.806] lstrlenW (lpString=".txt") returned 4 [0090.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".txt") returned 0x0 [0090.806] lstrlenW (lpString=".dbf") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".dbf") returned 0x0 [0090.807] lstrlenW (lpString=".ckp") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".ckp") returned 0x0 [0090.807] lstrlenW (lpString=".dacpac") returned 7 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".dacpac") returned 0x0 [0090.807] lstrlenW (lpString=".db3") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".db3") returned 0x0 [0090.807] lstrlenW (lpString=".dtxs") returned 5 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".dtxs") returned 0x0 [0090.807] lstrlenW (lpString=".mdt") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".mdt") returned 0x0 [0090.807] lstrlenW (lpString=".sdf") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".sdf") returned 0x0 [0090.807] lstrlenW (lpString=".MDF") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".MDF") returned 0x0 [0090.807] lstrlenW (lpString=".DBF") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".DBF") returned 0x0 [0090.807] lstrlenW (lpString=".DB") returned 3 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".DB") returned 0x0 [0090.807] lstrlenW (lpString=".db") returned 3 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".db") returned 0x0 [0090.807] lstrlenW (lpString=".ndf") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".ndf") returned 0x0 [0090.807] lstrlenW (lpString=".NDF") returned 4 [0090.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".NDF") returned 0x0 [0090.807] lstrlenW (lpString=".Mdf") returned 4 [0090.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".Mdf") returned 0x0 [0090.808] lstrlenW (lpString=".dat") returned 4 [0090.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".dat") returned 0x0 [0090.808] lstrlenW (lpString=".DAT") returned 4 [0090.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".DAT") returned 0x0 [0090.808] lstrlenW (lpString=".ldf") returned 4 [0090.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".ldf") returned 0x0 [0090.808] lstrlenW (lpString=".LDF") returned 4 [0090.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch=".LDF") returned 0x0 [0090.808] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.808] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.809] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.809] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.809] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21081021674) returned 1 [0090.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc4f14f70, dwHighDateTime=0x1d585b4)) [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5408 [0090.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5408 | out: hHeap=0x260000) returned 1 [0090.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.810] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.810] GetLastError () returned 0x0 [0090.810] GetLastError () returned 0x0 [0090.810] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.810] GetLastError () returned 0x0 [0090.810] GetLastError () returned 0x0 [0090.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8cf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.838] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x731, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x731, lpOverlapped=0x0) returned 1 [0090.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.838] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.838] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.838] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.838] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.838] CloseHandle (hObject=0xf0) returned 1 [0090.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0090.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css.[deadmin@cock.li].deadmin")) returned 1 [0090.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0090.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.841] GetLastError () returned 0x0 [0090.841] RtlWakeConditionVariable () returned 0x0 [0090.841] GetCurrentThreadId () returned 0x98c [0090.866] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.898] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.935] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.935] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.939] CloseHandle (hObject=0xe4) returned 1 [0090.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35acd8 | out: hHeap=0x260000) returned 1 [0090.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.939] RtlWakeConditionVariable () returned 0x0 [0090.939] GetCurrentThreadId () returned 0x98c [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".ldf") returned 0x0 [0090.940] lstrlenW (lpString=".vhd") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".vhd") returned 0x0 [0090.940] lstrlenW (lpString=".vhdx") returned 5 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".vhdx") returned 0x0 [0090.940] lstrlenW (lpString=".pst") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".pst") returned 0x0 [0090.940] lstrlenW (lpString=".ost") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".ost") returned 0x0 [0090.940] lstrlenW (lpString=".bak") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".bak") returned 0x0 [0090.940] lstrlenW (lpString=".bac") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".bac") returned 0x0 [0090.940] lstrlenW (lpString=".sys") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".sys") returned 0x0 [0090.940] lstrlenW (lpString=".v2i") returned 4 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".v2i") returned 0x0 [0090.940] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.942] lstrlenW (lpString=".sql") returned 4 [0090.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".sql") returned 0x0 [0090.942] lstrlenW (lpString=".mdf") returned 4 [0090.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".mdf") returned 0x0 [0090.942] lstrlenW (lpString=".txt") returned 4 [0090.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".txt") returned 0x0 [0090.942] lstrlenW (lpString=".dbf") returned 4 [0090.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".dbf") returned 0x0 [0090.942] lstrlenW (lpString=".ckp") returned 4 [0090.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".ckp") returned 0x0 [0090.943] lstrlenW (lpString=".dacpac") returned 7 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".dacpac") returned 0x0 [0090.943] lstrlenW (lpString=".db3") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".db3") returned 0x0 [0090.943] lstrlenW (lpString=".dtxs") returned 5 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".dtxs") returned 0x0 [0090.943] lstrlenW (lpString=".mdt") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".mdt") returned 0x0 [0090.943] lstrlenW (lpString=".sdf") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".sdf") returned 0x0 [0090.943] lstrlenW (lpString=".MDF") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".MDF") returned 0x0 [0090.943] lstrlenW (lpString=".DBF") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".DBF") returned 0x0 [0090.943] lstrlenW (lpString=".DB") returned 3 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".DB") returned 0x0 [0090.943] lstrlenW (lpString=".db") returned 3 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".db") returned 0x0 [0090.943] lstrlenW (lpString=".ndf") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".ndf") returned 0x0 [0090.943] lstrlenW (lpString=".NDF") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".NDF") returned 0x0 [0090.943] lstrlenW (lpString=".Mdf") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".Mdf") returned 0x0 [0090.943] lstrlenW (lpString=".dat") returned 4 [0090.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".dat") returned 0x0 [0090.944] lstrlenW (lpString=".DAT") returned 4 [0090.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".DAT") returned 0x0 [0090.944] lstrlenW (lpString=".ldf") returned 4 [0090.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".ldf") returned 0x0 [0090.944] lstrlenW (lpString=".LDF") returned 4 [0090.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch=".LDF") returned 0x0 [0090.944] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.944] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.945] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.945] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21094607168) returned 1 [0090.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5045a70, dwHighDateTime=0x1d585b4)) [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b56a8 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b56a8 | out: hHeap=0x260000) returned 1 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.946] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.946] GetLastError () returned 0x0 [0090.946] GetLastError () returned 0x0 [0090.946] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.946] GetLastError () returned 0x0 [0090.946] GetLastError () returned 0x0 [0090.951] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff89e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.951] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x762, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x762, lpOverlapped=0x0) returned 1 [0090.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.951] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.951] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.951] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.951] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.952] CloseHandle (hObject=0xe4) returned 1 [0090.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0090.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css.[deadmin@cock.li].deadmin")) returned 1 [0090.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0090.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.953] GetLastError () returned 0x0 [0090.953] RtlWakeConditionVariable () returned 0x0 [0090.953] GetCurrentThreadId () returned 0x98c [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".ldf") returned 0x0 [0090.954] lstrlenW (lpString=".vhd") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".vhd") returned 0x0 [0090.954] lstrlenW (lpString=".vhdx") returned 5 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".vhdx") returned 0x0 [0090.954] lstrlenW (lpString=".pst") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".pst") returned 0x0 [0090.954] lstrlenW (lpString=".ost") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".ost") returned 0x0 [0090.954] lstrlenW (lpString=".bak") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".bak") returned 0x0 [0090.954] lstrlenW (lpString=".bac") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".bac") returned 0x0 [0090.954] lstrlenW (lpString=".sys") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".sys") returned 0x0 [0090.954] lstrlenW (lpString=".v2i") returned 4 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".v2i") returned 0x0 [0090.954] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.955] lstrlenW (lpString=".sql") returned 4 [0090.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".sql") returned 0x0 [0090.955] lstrlenW (lpString=".mdf") returned 4 [0090.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".mdf") returned 0x0 [0090.955] lstrlenW (lpString=".txt") returned 4 [0090.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".txt") returned 0x0 [0090.956] lstrlenW (lpString=".dbf") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".dbf") returned 0x0 [0090.956] lstrlenW (lpString=".ckp") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".ckp") returned 0x0 [0090.956] lstrlenW (lpString=".dacpac") returned 7 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".dacpac") returned 0x0 [0090.956] lstrlenW (lpString=".db3") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".db3") returned 0x0 [0090.956] lstrlenW (lpString=".dtxs") returned 5 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".dtxs") returned 0x0 [0090.956] lstrlenW (lpString=".mdt") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".mdt") returned 0x0 [0090.956] lstrlenW (lpString=".sdf") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".sdf") returned 0x0 [0090.956] lstrlenW (lpString=".MDF") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".MDF") returned 0x0 [0090.956] lstrlenW (lpString=".DBF") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".DBF") returned 0x0 [0090.956] lstrlenW (lpString=".DB") returned 3 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".DB") returned 0x0 [0090.956] lstrlenW (lpString=".db") returned 3 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".db") returned 0x0 [0090.956] lstrlenW (lpString=".ndf") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".ndf") returned 0x0 [0090.956] lstrlenW (lpString=".NDF") returned 4 [0090.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".NDF") returned 0x0 [0090.956] lstrlenW (lpString=".Mdf") returned 4 [0090.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".Mdf") returned 0x0 [0090.957] lstrlenW (lpString=".dat") returned 4 [0090.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".dat") returned 0x0 [0090.957] lstrlenW (lpString=".DAT") returned 4 [0090.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".DAT") returned 0x0 [0090.957] lstrlenW (lpString=".ldf") returned 4 [0090.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".ldf") returned 0x0 [0090.957] lstrlenW (lpString=".LDF") returned 4 [0090.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch=".LDF") returned 0x0 [0090.957] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.957] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.958] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.958] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.958] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21095916617) returned 1 [0090.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc506bbd0, dwHighDateTime=0x1d585b4)) [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b56e0 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b56e0 | out: hHeap=0x260000) returned 1 [0090.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.959] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.959] GetLastError () returned 0x0 [0090.959] GetLastError () returned 0x0 [0090.959] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.959] GetLastError () returned 0x0 [0090.959] GetLastError () returned 0x0 [0090.961] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff831, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.961] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x7cf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x7cf, lpOverlapped=0x0) returned 1 [0090.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.961] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.961] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.962] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.962] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.962] CloseHandle (hObject=0xe4) returned 1 [0090.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css.[deadmin@cock.li].deadmin")) returned 1 [0090.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.963] GetLastError () returned 0x0 [0090.963] RtlWakeConditionVariable () returned 0x0 [0090.963] GetCurrentThreadId () returned 0x98c [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.964] lstrlenW (lpString=".vhd") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.964] lstrlenW (lpString=".vhdx") returned 5 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.964] lstrlenW (lpString=".pst") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.964] lstrlenW (lpString=".ost") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.964] lstrlenW (lpString=".bak") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.964] lstrlenW (lpString=".bac") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.964] lstrlenW (lpString=".sys") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.964] lstrlenW (lpString=".v2i") returned 4 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.964] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.965] lstrlenW (lpString=".sql") returned 4 [0090.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.966] lstrlenW (lpString=".mdf") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.966] lstrlenW (lpString=".txt") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.966] lstrlenW (lpString=".dbf") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.966] lstrlenW (lpString=".ckp") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.966] lstrlenW (lpString=".dacpac") returned 7 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.966] lstrlenW (lpString=".db3") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.966] lstrlenW (lpString=".dtxs") returned 5 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.966] lstrlenW (lpString=".mdt") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.966] lstrlenW (lpString=".sdf") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.966] lstrlenW (lpString=".MDF") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.966] lstrlenW (lpString=".DBF") returned 4 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.966] lstrlenW (lpString=".DB") returned 3 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.966] lstrlenW (lpString=".db") returned 3 [0090.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.967] lstrlenW (lpString=".ndf") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.967] lstrlenW (lpString=".NDF") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.967] lstrlenW (lpString=".Mdf") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.967] lstrlenW (lpString=".dat") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.967] lstrlenW (lpString=".DAT") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.967] lstrlenW (lpString=".ldf") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.967] lstrlenW (lpString=".LDF") returned 4 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.967] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.967] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.968] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.968] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.968] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21096929765) returned 1 [0090.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5091d30, dwHighDateTime=0x1d585b4)) [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5718 [0090.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5718 | out: hHeap=0x260000) returned 1 [0090.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.969] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.969] GetLastError () returned 0x0 [0090.969] GetLastError () returned 0x0 [0090.969] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.969] GetLastError () returned 0x0 [0090.970] GetLastError () returned 0x0 [0090.971] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.971] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0090.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.971] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.971] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.971] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.971] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.971] CloseHandle (hObject=0xe4) returned 1 [0090.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.973] GetLastError () returned 0x0 [0090.973] RtlWakeConditionVariable () returned 0x0 [0090.973] GetCurrentThreadId () returned 0x98c [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.973] lstrlenW (lpString=".vhd") returned 4 [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.973] lstrlenW (lpString=".vhdx") returned 5 [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.973] lstrlenW (lpString=".pst") returned 4 [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.973] lstrlenW (lpString=".ost") returned 4 [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.973] lstrlenW (lpString=".bak") returned 4 [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.973] lstrlenW (lpString=".bac") returned 4 [0090.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.974] lstrlenW (lpString=".sys") returned 4 [0090.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.974] lstrlenW (lpString=".v2i") returned 4 [0090.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.974] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.975] lstrlenW (lpString=".sql") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.975] lstrlenW (lpString=".mdf") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.975] lstrlenW (lpString=".txt") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.975] lstrlenW (lpString=".dbf") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.975] lstrlenW (lpString=".ckp") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.975] lstrlenW (lpString=".dacpac") returned 7 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.975] lstrlenW (lpString=".db3") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.975] lstrlenW (lpString=".dtxs") returned 5 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.975] lstrlenW (lpString=".mdt") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.975] lstrlenW (lpString=".sdf") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.975] lstrlenW (lpString=".MDF") returned 4 [0090.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.975] lstrlenW (lpString=".DBF") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.976] lstrlenW (lpString=".DB") returned 3 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.976] lstrlenW (lpString=".db") returned 3 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.976] lstrlenW (lpString=".ndf") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.976] lstrlenW (lpString=".NDF") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.976] lstrlenW (lpString=".Mdf") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.976] lstrlenW (lpString=".dat") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.976] lstrlenW (lpString=".DAT") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.976] lstrlenW (lpString=".ldf") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.976] lstrlenW (lpString=".LDF") returned 4 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.976] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.976] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.977] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.977] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.977] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21097856233) returned 1 [0090.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5091d30, dwHighDateTime=0x1d585b4)) [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5750 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5750 | out: hHeap=0x260000) returned 1 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.978] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.978] GetLastError () returned 0x0 [0090.978] GetLastError () returned 0x0 [0090.979] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.979] GetLastError () returned 0x0 [0090.979] GetLastError () returned 0x0 [0090.980] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffef5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.980] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x10b, lpOverlapped=0x0) returned 1 [0090.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.980] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.980] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.980] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.980] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.981] CloseHandle (hObject=0xe4) returned 1 [0090.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.982] GetLastError () returned 0x0 [0090.982] RtlWakeConditionVariable () returned 0x27e828 [0090.982] GetCurrentThreadId () returned 0x98c [0090.984] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.984] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.984] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.984] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.986] CloseHandle (hObject=0xe4) returned 1 [0090.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35af08 | out: hHeap=0x260000) returned 1 [0090.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.986] RtlWakeConditionVariable () returned 0x0 [0090.986] GetCurrentThreadId () returned 0x98c [0090.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".ldf") returned 0x0 [0090.986] lstrlenW (lpString=".vhd") returned 4 [0090.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".vhd") returned 0x0 [0090.986] lstrlenW (lpString=".vhdx") returned 5 [0090.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".vhdx") returned 0x0 [0090.986] lstrlenW (lpString=".pst") returned 4 [0090.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".pst") returned 0x0 [0090.986] lstrlenW (lpString=".ost") returned 4 [0090.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".ost") returned 0x0 [0090.986] lstrlenW (lpString=".bak") returned 4 [0090.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".bak") returned 0x0 [0090.986] lstrlenW (lpString=".bac") returned 4 [0090.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".bac") returned 0x0 [0090.987] lstrlenW (lpString=".sys") returned 4 [0090.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".sys") returned 0x0 [0090.987] lstrlenW (lpString=".v2i") returned 4 [0090.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".v2i") returned 0x0 [0090.987] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.988] lstrlenW (lpString=".sql") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".sql") returned 0x0 [0090.988] lstrlenW (lpString=".mdf") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".mdf") returned 0x0 [0090.988] lstrlenW (lpString=".txt") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".txt") returned 0x0 [0090.988] lstrlenW (lpString=".dbf") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".dbf") returned 0x0 [0090.988] lstrlenW (lpString=".ckp") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".ckp") returned 0x0 [0090.988] lstrlenW (lpString=".dacpac") returned 7 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".dacpac") returned 0x0 [0090.988] lstrlenW (lpString=".db3") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".db3") returned 0x0 [0090.988] lstrlenW (lpString=".dtxs") returned 5 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".dtxs") returned 0x0 [0090.988] lstrlenW (lpString=".mdt") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".mdt") returned 0x0 [0090.988] lstrlenW (lpString=".sdf") returned 4 [0090.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".sdf") returned 0x0 [0090.988] lstrlenW (lpString=".MDF") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".MDF") returned 0x0 [0090.989] lstrlenW (lpString=".DBF") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".DBF") returned 0x0 [0090.989] lstrlenW (lpString=".DB") returned 3 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".DB") returned 0x0 [0090.989] lstrlenW (lpString=".db") returned 3 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".db") returned 0x0 [0090.989] lstrlenW (lpString=".ndf") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".ndf") returned 0x0 [0090.989] lstrlenW (lpString=".NDF") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".NDF") returned 0x0 [0090.989] lstrlenW (lpString=".Mdf") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".Mdf") returned 0x0 [0090.989] lstrlenW (lpString=".dat") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".dat") returned 0x0 [0090.989] lstrlenW (lpString=".DAT") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".DAT") returned 0x0 [0090.989] lstrlenW (lpString=".ldf") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".ldf") returned 0x0 [0090.989] lstrlenW (lpString=".LDF") returned 4 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch=".LDF") returned 0x0 [0090.989] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.990] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0090.990] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.990] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.990] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21099161764) returned 1 [0090.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc50b7e90, dwHighDateTime=0x1d585b4)) [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b57c0 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b57c0 | out: hHeap=0x260000) returned 1 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.991] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0090.991] GetLastError () returned 0x0 [0090.992] GetLastError () returned 0x0 [0090.992] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0090.992] GetLastError () returned 0x0 [0090.992] GetLastError () returned 0x0 [0090.993] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffef6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.994] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1091, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x1091, lpOverlapped=0x0) returned 1 [0090.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.994] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.994] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.994] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.994] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.994] CloseHandle (hObject=0xe4) returned 1 [0090.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0090.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css.[deadmin@cock.li].deadmin")) returned 1 [0090.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0090.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.996] GetLastError () returned 0x0 [0090.996] RtlWakeConditionVariable () returned 0x0 [0090.996] GetCurrentThreadId () returned 0x98c [0090.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".ldf") returned 0x0 [0090.996] lstrlenW (lpString=".vhd") returned 4 [0090.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".vhd") returned 0x0 [0090.996] lstrlenW (lpString=".vhdx") returned 5 [0090.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".vhdx") returned 0x0 [0090.996] lstrlenW (lpString=".pst") returned 4 [0090.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".pst") returned 0x0 [0090.996] lstrlenW (lpString=".ost") returned 4 [0090.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".ost") returned 0x0 [0090.996] lstrlenW (lpString=".bak") returned 4 [0090.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".bak") returned 0x0 [0090.997] lstrlenW (lpString=".bac") returned 4 [0090.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".bac") returned 0x0 [0090.997] lstrlenW (lpString=".sys") returned 4 [0090.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".sys") returned 0x0 [0090.997] lstrlenW (lpString=".v2i") returned 4 [0090.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".v2i") returned 0x0 [0090.997] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.998] lstrlenW (lpString=".sql") returned 4 [0090.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".sql") returned 0x0 [0090.998] lstrlenW (lpString=".mdf") returned 4 [0090.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".mdf") returned 0x0 [0090.998] lstrlenW (lpString=".txt") returned 4 [0090.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".txt") returned 0x0 [0090.998] lstrlenW (lpString=".dbf") returned 4 [0090.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".dbf") returned 0x0 [0090.998] lstrlenW (lpString=".ckp") returned 4 [0090.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".ckp") returned 0x0 [0090.998] lstrlenW (lpString=".dacpac") returned 7 [0090.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".dacpac") returned 0x0 [0090.999] lstrlenW (lpString=".db3") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".db3") returned 0x0 [0090.999] lstrlenW (lpString=".dtxs") returned 5 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".dtxs") returned 0x0 [0090.999] lstrlenW (lpString=".mdt") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".mdt") returned 0x0 [0090.999] lstrlenW (lpString=".sdf") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".sdf") returned 0x0 [0090.999] lstrlenW (lpString=".MDF") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".MDF") returned 0x0 [0090.999] lstrlenW (lpString=".DBF") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".DBF") returned 0x0 [0090.999] lstrlenW (lpString=".DB") returned 3 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".DB") returned 0x0 [0090.999] lstrlenW (lpString=".db") returned 3 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".db") returned 0x0 [0090.999] lstrlenW (lpString=".ndf") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".ndf") returned 0x0 [0090.999] lstrlenW (lpString=".NDF") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".NDF") returned 0x0 [0090.999] lstrlenW (lpString=".Mdf") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".Mdf") returned 0x0 [0090.999] lstrlenW (lpString=".dat") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".dat") returned 0x0 [0090.999] lstrlenW (lpString=".DAT") returned 4 [0090.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".DAT") returned 0x0 [0091.000] lstrlenW (lpString=".ldf") returned 4 [0091.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".ldf") returned 0x0 [0091.000] lstrlenW (lpString=".LDF") returned 4 [0091.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch=".LDF") returned 0x0 [0091.000] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.000] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.001] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.001] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.001] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21100199442) returned 1 [0091.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc50ddff0, dwHighDateTime=0x1d585b4)) [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b57f8 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b57f8 | out: hHeap=0x260000) returned 1 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.002] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.002] GetLastError () returned 0x0 [0091.002] GetLastError () returned 0x0 [0091.002] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.002] GetLastError () returned 0x0 [0091.002] GetLastError () returned 0x0 [0091.072] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff8e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.072] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x720, lpOverlapped=0x0) returned 1 [0091.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0091.075] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.075] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.075] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.075] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.075] CloseHandle (hObject=0xe4) returned 1 [0091.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css.[deadmin@cock.li].deadmin")) returned 1 [0091.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.269] GetLastError () returned 0x0 [0091.269] RtlWakeConditionVariable () returned 0x0 [0091.269] GetCurrentThreadId () returned 0x98c [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ldf") returned 0x0 [0091.269] lstrlenW (lpString=".vhd") returned 4 [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".vhd") returned 0x0 [0091.269] lstrlenW (lpString=".vhdx") returned 5 [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".vhdx") returned 0x0 [0091.269] lstrlenW (lpString=".pst") returned 4 [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".pst") returned 0x0 [0091.269] lstrlenW (lpString=".ost") returned 4 [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ost") returned 0x0 [0091.269] lstrlenW (lpString=".bak") returned 4 [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".bak") returned 0x0 [0091.269] lstrlenW (lpString=".bac") returned 4 [0091.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".bac") returned 0x0 [0091.269] lstrlenW (lpString=".sys") returned 4 [0091.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".sys") returned 0x0 [0091.270] lstrlenW (lpString=".v2i") returned 4 [0091.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".v2i") returned 0x0 [0091.270] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.615] lstrlenW (lpString=".sql") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".sql") returned 0x0 [0091.615] lstrlenW (lpString=".mdf") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".mdf") returned 0x0 [0091.615] lstrlenW (lpString=".txt") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".txt") returned 0x0 [0091.615] lstrlenW (lpString=".dbf") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dbf") returned 0x0 [0091.615] lstrlenW (lpString=".ckp") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ckp") returned 0x0 [0091.615] lstrlenW (lpString=".dacpac") returned 7 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dacpac") returned 0x0 [0091.615] lstrlenW (lpString=".db3") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".db3") returned 0x0 [0091.615] lstrlenW (lpString=".dtxs") returned 5 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dtxs") returned 0x0 [0091.615] lstrlenW (lpString=".mdt") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".mdt") returned 0x0 [0091.615] lstrlenW (lpString=".sdf") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".sdf") returned 0x0 [0091.615] lstrlenW (lpString=".MDF") returned 4 [0091.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".MDF") returned 0x0 [0091.616] lstrlenW (lpString=".DBF") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".DBF") returned 0x0 [0091.616] lstrlenW (lpString=".DB") returned 3 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".DB") returned 0x0 [0091.616] lstrlenW (lpString=".db") returned 3 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".db") returned 0x0 [0091.616] lstrlenW (lpString=".ndf") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ndf") returned 0x0 [0091.616] lstrlenW (lpString=".NDF") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".NDF") returned 0x0 [0091.616] lstrlenW (lpString=".Mdf") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".Mdf") returned 0x0 [0091.616] lstrlenW (lpString=".dat") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dat") returned 0x0 [0091.616] lstrlenW (lpString=".DAT") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".DAT") returned 0x0 [0091.616] lstrlenW (lpString=".ldf") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ldf") returned 0x0 [0091.616] lstrlenW (lpString=".LDF") returned 4 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".LDF") returned 0x0 [0091.616] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.616] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.617] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.617] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21161859943) returned 1 [0091.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc56ab590, dwHighDateTime=0x1d585b4)) [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5e50 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5e50 | out: hHeap=0x260000) returned 1 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.618] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.618] GetLastError () returned 0x0 [0091.619] GetLastError () returned 0x0 [0091.619] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.619] GetLastError () returned 0x0 [0091.619] GetLastError () returned 0x0 [0091.620] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.621] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1afa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x1afa, lpOverlapped=0x0) returned 1 [0091.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.621] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.621] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.621] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.621] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.621] CloseHandle (hObject=0xd8) returned 1 [0091.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0091.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.623] GetLastError () returned 0x0 [0091.623] RtlWakeConditionVariable () returned 0x0 [0091.623] GetCurrentThreadId () returned 0x98c [0091.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".ldf") returned 0x0 [0091.623] lstrlenW (lpString=".vhd") returned 4 [0091.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".vhd") returned 0x0 [0091.623] lstrlenW (lpString=".vhdx") returned 5 [0091.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".vhdx") returned 0x0 [0091.623] lstrlenW (lpString=".pst") returned 4 [0091.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".pst") returned 0x0 [0091.623] lstrlenW (lpString=".ost") returned 4 [0091.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".ost") returned 0x0 [0091.623] lstrlenW (lpString=".bak") returned 4 [0091.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".bak") returned 0x0 [0091.624] lstrlenW (lpString=".bac") returned 4 [0091.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".bac") returned 0x0 [0091.624] lstrlenW (lpString=".sys") returned 4 [0091.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".sys") returned 0x0 [0091.624] lstrlenW (lpString=".v2i") returned 4 [0091.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".v2i") returned 0x0 [0091.624] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.625] lstrlenW (lpString=".sql") returned 4 [0091.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".sql") returned 0x0 [0091.625] lstrlenW (lpString=".mdf") returned 4 [0091.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".mdf") returned 0x0 [0091.625] lstrlenW (lpString=".txt") returned 4 [0091.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".txt") returned 0x0 [0091.625] lstrlenW (lpString=".dbf") returned 4 [0091.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".dbf") returned 0x0 [0091.625] lstrlenW (lpString=".ckp") returned 4 [0091.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".ckp") returned 0x0 [0091.625] lstrlenW (lpString=".dacpac") returned 7 [0091.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".dacpac") returned 0x0 [0091.625] lstrlenW (lpString=".db3") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".db3") returned 0x0 [0091.626] lstrlenW (lpString=".dtxs") returned 5 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".dtxs") returned 0x0 [0091.626] lstrlenW (lpString=".mdt") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".mdt") returned 0x0 [0091.626] lstrlenW (lpString=".sdf") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".sdf") returned 0x0 [0091.626] lstrlenW (lpString=".MDF") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".MDF") returned 0x0 [0091.626] lstrlenW (lpString=".DBF") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".DBF") returned 0x0 [0091.626] lstrlenW (lpString=".DB") returned 3 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".DB") returned 0x0 [0091.626] lstrlenW (lpString=".db") returned 3 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".db") returned 0x0 [0091.626] lstrlenW (lpString=".ndf") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".ndf") returned 0x0 [0091.626] lstrlenW (lpString=".NDF") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".NDF") returned 0x0 [0091.626] lstrlenW (lpString=".Mdf") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".Mdf") returned 0x0 [0091.626] lstrlenW (lpString=".dat") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".dat") returned 0x0 [0091.626] lstrlenW (lpString=".DAT") returned 4 [0091.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".DAT") returned 0x0 [0091.626] lstrlenW (lpString=".ldf") returned 4 [0091.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".ldf") returned 0x0 [0091.627] lstrlenW (lpString=".LDF") returned 4 [0091.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch=".LDF") returned 0x0 [0091.627] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.627] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.628] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.628] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.628] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21162892203) returned 1 [0091.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc56d16f0, dwHighDateTime=0x1d585b4)) [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5e88 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5e88 | out: hHeap=0x260000) returned 1 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.628] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.629] GetLastError () returned 0x0 [0091.629] GetLastError () returned 0x0 [0091.629] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.629] GetLastError () returned 0x0 [0091.629] GetLastError () returned 0x0 [0091.631] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.631] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x32f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x32f, lpOverlapped=0x0) returned 1 [0091.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.631] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.631] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.631] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.631] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.631] CloseHandle (hObject=0xd8) returned 1 [0091.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0091.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.634] GetLastError () returned 0x0 [0091.634] RtlWakeConditionVariable () returned 0x0 [0091.634] GetCurrentThreadId () returned 0x98c [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0091.634] lstrlenW (lpString=".vhd") returned 4 [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0091.634] lstrlenW (lpString=".vhdx") returned 5 [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0091.634] lstrlenW (lpString=".pst") returned 4 [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0091.634] lstrlenW (lpString=".ost") returned 4 [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0091.634] lstrlenW (lpString=".bak") returned 4 [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0091.634] lstrlenW (lpString=".bac") returned 4 [0091.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0091.634] lstrlenW (lpString=".sys") returned 4 [0091.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0091.635] lstrlenW (lpString=".v2i") returned 4 [0091.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0091.635] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.636] lstrlenW (lpString=".sql") returned 4 [0091.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0091.636] lstrlenW (lpString=".mdf") returned 4 [0091.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0091.636] lstrlenW (lpString=".txt") returned 4 [0091.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0091.636] lstrlenW (lpString=".dbf") returned 4 [0091.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0091.636] lstrlenW (lpString=".ckp") returned 4 [0091.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0091.636] lstrlenW (lpString=".dacpac") returned 7 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0091.637] lstrlenW (lpString=".db3") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0091.637] lstrlenW (lpString=".dtxs") returned 5 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0091.637] lstrlenW (lpString=".mdt") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0091.637] lstrlenW (lpString=".sdf") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0091.637] lstrlenW (lpString=".MDF") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0091.637] lstrlenW (lpString=".DBF") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0091.637] lstrlenW (lpString=".DB") returned 3 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0091.637] lstrlenW (lpString=".db") returned 3 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".db") returned 0x0 [0091.637] lstrlenW (lpString=".ndf") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0091.637] lstrlenW (lpString=".NDF") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0091.637] lstrlenW (lpString=".Mdf") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0091.637] lstrlenW (lpString=".dat") returned 4 [0091.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0091.637] lstrlenW (lpString=".DAT") returned 4 [0091.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0091.638] lstrlenW (lpString=".ldf") returned 4 [0091.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0091.638] lstrlenW (lpString=".LDF") returned 4 [0091.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0091.638] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.638] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.639] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.639] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.639] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21164001057) returned 1 [0091.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc56f7850, dwHighDateTime=0x1d585b4)) [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5ec0 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5ec0 | out: hHeap=0x260000) returned 1 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.640] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.640] GetLastError () returned 0x0 [0091.640] GetLastError () returned 0x0 [0091.640] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.640] GetLastError () returned 0x0 [0091.640] GetLastError () returned 0x0 [0091.642] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff966d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.642] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x6993, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x6993, lpOverlapped=0x0) returned 1 [0091.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.643] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.643] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.643] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.643] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.643] CloseHandle (hObject=0xd8) returned 1 [0091.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.646] GetLastError () returned 0x0 [0091.646] RtlWakeConditionVariable () returned 0x0 [0091.646] GetCurrentThreadId () returned 0x98c [0091.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.647] lstrlenW (lpString=".vhd") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0091.647] lstrlenW (lpString=".vhdx") returned 5 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0091.647] lstrlenW (lpString=".pst") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0091.647] lstrlenW (lpString=".ost") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0091.647] lstrlenW (lpString=".bak") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0091.647] lstrlenW (lpString=".bac") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0091.647] lstrlenW (lpString=".sys") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0091.647] lstrlenW (lpString=".v2i") returned 4 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0091.647] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.649] lstrlenW (lpString=".sql") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0091.649] lstrlenW (lpString=".mdf") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0091.649] lstrlenW (lpString=".txt") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0091.649] lstrlenW (lpString=".dbf") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0091.649] lstrlenW (lpString=".ckp") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0091.649] lstrlenW (lpString=".dacpac") returned 7 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0091.649] lstrlenW (lpString=".db3") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0091.649] lstrlenW (lpString=".dtxs") returned 5 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0091.649] lstrlenW (lpString=".mdt") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0091.649] lstrlenW (lpString=".sdf") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0091.649] lstrlenW (lpString=".MDF") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0091.649] lstrlenW (lpString=".DBF") returned 4 [0091.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0091.650] lstrlenW (lpString=".DB") returned 3 [0091.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0091.650] lstrlenW (lpString=".db") returned 3 [0091.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0091.650] lstrlenW (lpString=".ndf") returned 4 [0091.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0091.650] lstrlenW (lpString=".NDF") returned 4 [0091.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0091.650] lstrlenW (lpString=".Mdf") returned 4 [0091.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0091.650] lstrlenW (lpString=".dat") returned 4 [0091.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0091.712] lstrlenW (lpString=".DAT") returned 4 [0091.712] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0091.712] lstrlenW (lpString=".ldf") returned 4 [0091.712] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.712] lstrlenW (lpString=".LDF") returned 4 [0091.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0091.744] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.744] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.745] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.745] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.745] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21174602532) returned 1 [0091.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc58021f0, dwHighDateTime=0x1d585b4)) [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b60f0 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b60f0 | out: hHeap=0x260000) returned 1 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.746] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.746] GetLastError () returned 0x0 [0091.746] GetLastError () returned 0x0 [0091.746] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.746] GetLastError () returned 0x0 [0091.746] GetLastError () returned 0x0 [0091.747] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.747] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x155, lpOverlapped=0x0) returned 1 [0091.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.748] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.748] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.748] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.748] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.748] CloseHandle (hObject=0xd8) returned 1 [0091.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.748] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.750] GetLastError () returned 0x0 [0091.751] RtlWakeConditionVariable () returned 0x0 [0091.751] GetCurrentThreadId () returned 0x98c [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0091.751] lstrlenW (lpString=".vhd") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0091.751] lstrlenW (lpString=".vhdx") returned 5 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0091.751] lstrlenW (lpString=".pst") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".pst") returned 0x0 [0091.751] lstrlenW (lpString=".ost") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ost") returned 0x0 [0091.751] lstrlenW (lpString=".bak") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bak") returned 0x0 [0091.751] lstrlenW (lpString=".bac") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bac") returned 0x0 [0091.751] lstrlenW (lpString=".sys") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sys") returned 0x0 [0091.751] lstrlenW (lpString=".v2i") returned 4 [0091.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0091.752] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0091.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.753] lstrlenW (lpString=".sql") returned 4 [0091.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sql") returned 0x0 [0091.753] lstrlenW (lpString=".mdf") returned 4 [0091.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0091.753] lstrlenW (lpString=".txt") returned 4 [0091.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".txt") returned 0x0 [0091.753] lstrlenW (lpString=".dbf") returned 4 [0091.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0091.753] lstrlenW (lpString=".ckp") returned 4 [0091.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0091.753] lstrlenW (lpString=".dacpac") returned 7 [0091.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0091.754] lstrlenW (lpString=".db3") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db3") returned 0x0 [0091.754] lstrlenW (lpString=".dtxs") returned 5 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0091.754] lstrlenW (lpString=".mdt") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0091.754] lstrlenW (lpString=".sdf") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0091.754] lstrlenW (lpString=".MDF") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0091.754] lstrlenW (lpString=".DBF") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0091.754] lstrlenW (lpString=".DB") returned 3 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DB") returned 0x0 [0091.754] lstrlenW (lpString=".db") returned 3 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db") returned 0x0 [0091.754] lstrlenW (lpString=".ndf") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0091.754] lstrlenW (lpString=".NDF") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0091.754] lstrlenW (lpString=".Mdf") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0091.754] lstrlenW (lpString=".dat") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dat") returned 0x0 [0091.754] lstrlenW (lpString=".DAT") returned 4 [0091.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0091.755] lstrlenW (lpString=".ldf") returned 4 [0091.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0091.755] lstrlenW (lpString=".LDF") returned 4 [0091.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0091.755] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.755] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.756] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.756] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.756] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21175697957) returned 1 [0091.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc58021f0, dwHighDateTime=0x1d585b4)) [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6128 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6128 | out: hHeap=0x260000) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.757] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.757] GetLastError () returned 0x0 [0091.757] GetLastError () returned 0x0 [0091.757] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.757] GetLastError () returned 0x0 [0091.757] GetLastError () returned 0x0 [0091.759] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.759] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x638, lpOverlapped=0x0) returned 1 [0091.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.760] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.760] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.760] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.760] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.760] CloseHandle (hObject=0xd8) returned 1 [0091.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0091.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922098 | out: hHeap=0x260000) returned 1 [0091.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.762] GetLastError () returned 0x0 [0091.762] RtlWakeConditionVariable () returned 0x0 [0091.762] GetCurrentThreadId () returned 0x98c [0091.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".ldf") returned 0x0 [0091.762] lstrlenW (lpString=".vhd") returned 4 [0091.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".vhd") returned 0x0 [0091.762] lstrlenW (lpString=".vhdx") returned 5 [0091.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".vhdx") returned 0x0 [0091.762] lstrlenW (lpString=".pst") returned 4 [0091.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".pst") returned 0x0 [0091.762] lstrlenW (lpString=".ost") returned 4 [0091.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".ost") returned 0x0 [0091.763] lstrlenW (lpString=".bak") returned 4 [0091.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".bak") returned 0x0 [0091.763] lstrlenW (lpString=".bac") returned 4 [0091.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".bac") returned 0x0 [0091.763] lstrlenW (lpString=".sys") returned 4 [0091.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".sys") returned 0x0 [0091.763] lstrlenW (lpString=".v2i") returned 4 [0091.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".v2i") returned 0x0 [0091.763] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch="s\r\n.v2i") returned 0x0 [0091.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.764] lstrlenW (lpString=".sql") returned 4 [0091.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".sql") returned 0x0 [0091.764] lstrlenW (lpString=".mdf") returned 4 [0091.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".mdf") returned 0x0 [0091.764] lstrlenW (lpString=".txt") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".txt") returned 0x0 [0091.765] lstrlenW (lpString=".dbf") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".dbf") returned 0x0 [0091.765] lstrlenW (lpString=".ckp") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".ckp") returned 0x0 [0091.765] lstrlenW (lpString=".dacpac") returned 7 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".dacpac") returned 0x0 [0091.765] lstrlenW (lpString=".db3") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".db3") returned 0x0 [0091.765] lstrlenW (lpString=".dtxs") returned 5 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".dtxs") returned 0x0 [0091.765] lstrlenW (lpString=".mdt") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".mdt") returned 0x0 [0091.765] lstrlenW (lpString=".sdf") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".sdf") returned 0x0 [0091.765] lstrlenW (lpString=".MDF") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".MDF") returned 0x0 [0091.765] lstrlenW (lpString=".DBF") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".DBF") returned 0x0 [0091.765] lstrlenW (lpString=".DB") returned 3 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".DB") returned 0x0 [0091.765] lstrlenW (lpString=".db") returned 3 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".db") returned 0x0 [0091.765] lstrlenW (lpString=".ndf") returned 4 [0091.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".ndf") returned 0x0 [0091.766] lstrlenW (lpString=".NDF") returned 4 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".NDF") returned 0x0 [0091.766] lstrlenW (lpString=".Mdf") returned 4 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".Mdf") returned 0x0 [0091.766] lstrlenW (lpString=".dat") returned 4 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".dat") returned 0x0 [0091.766] lstrlenW (lpString=".DAT") returned 4 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".DAT") returned 0x0 [0091.766] lstrlenW (lpString=".ldf") returned 4 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".ldf") returned 0x0 [0091.766] lstrlenW (lpString=".LDF") returned 4 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch=".LDF") returned 0x0 [0091.766] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.766] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.767] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.767] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21176845931) returned 1 [0091.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5828350, dwHighDateTime=0x1d585b4)) [0091.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6160 [0091.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6160 | out: hHeap=0x260000) returned 1 [0091.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.768] GetLastError () returned 0x0 [0091.768] GetLastError () returned 0x0 [0091.769] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.769] GetLastError () returned 0x0 [0091.769] GetLastError () returned 0x0 [0091.771] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe9b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.771] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x164a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x164a, lpOverlapped=0x0) returned 1 [0091.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.771] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.771] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.771] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.771] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.771] CloseHandle (hObject=0xd8) returned 1 [0091.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.[deadmin@cock.li].deadmin")) returned 1 [0091.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.773] GetLastError () returned 0x0 [0091.773] RtlWakeConditionVariable () returned 0x0 [0091.773] GetCurrentThreadId () returned 0x98c [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".ldf") returned 0x0 [0091.774] lstrlenW (lpString=".vhd") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".vhd") returned 0x0 [0091.774] lstrlenW (lpString=".vhdx") returned 5 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".vhdx") returned 0x0 [0091.774] lstrlenW (lpString=".pst") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".pst") returned 0x0 [0091.774] lstrlenW (lpString=".ost") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".ost") returned 0x0 [0091.774] lstrlenW (lpString=".bak") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".bak") returned 0x0 [0091.774] lstrlenW (lpString=".bac") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".bac") returned 0x0 [0091.774] lstrlenW (lpString=".sys") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".sys") returned 0x0 [0091.774] lstrlenW (lpString=".v2i") returned 4 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".v2i") returned 0x0 [0091.774] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0091.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.776] lstrlenW (lpString=".sql") returned 4 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".sql") returned 0x0 [0091.776] lstrlenW (lpString=".mdf") returned 4 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".mdf") returned 0x0 [0091.776] lstrlenW (lpString=".txt") returned 4 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".txt") returned 0x0 [0091.776] lstrlenW (lpString=".dbf") returned 4 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".dbf") returned 0x0 [0091.776] lstrlenW (lpString=".ckp") returned 4 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".ckp") returned 0x0 [0091.776] lstrlenW (lpString=".dacpac") returned 7 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".dacpac") returned 0x0 [0091.776] lstrlenW (lpString=".db3") returned 4 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".db3") returned 0x0 [0091.776] lstrlenW (lpString=".dtxs") returned 5 [0091.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".dtxs") returned 0x0 [0091.777] lstrlenW (lpString=".mdt") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".mdt") returned 0x0 [0091.777] lstrlenW (lpString=".sdf") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".sdf") returned 0x0 [0091.777] lstrlenW (lpString=".MDF") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".MDF") returned 0x0 [0091.777] lstrlenW (lpString=".DBF") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".DBF") returned 0x0 [0091.777] lstrlenW (lpString=".DB") returned 3 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".DB") returned 0x0 [0091.777] lstrlenW (lpString=".db") returned 3 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".db") returned 0x0 [0091.777] lstrlenW (lpString=".ndf") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".ndf") returned 0x0 [0091.777] lstrlenW (lpString=".NDF") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".NDF") returned 0x0 [0091.777] lstrlenW (lpString=".Mdf") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".Mdf") returned 0x0 [0091.777] lstrlenW (lpString=".dat") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".dat") returned 0x0 [0091.777] lstrlenW (lpString=".DAT") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".DAT") returned 0x0 [0091.777] lstrlenW (lpString=".ldf") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".ldf") returned 0x0 [0091.777] lstrlenW (lpString=".LDF") returned 4 [0091.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch=".LDF") returned 0x0 [0091.778] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.778] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.778] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.778] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.779] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21177982007) returned 1 [0091.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc584e4b0, dwHighDateTime=0x1d585b4)) [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6198 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6198 | out: hHeap=0x260000) returned 1 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.779] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.780] GetLastError () returned 0x0 [0091.780] GetLastError () returned 0x0 [0091.780] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.780] GetLastError () returned 0x0 [0091.780] GetLastError () returned 0x0 [0091.920] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff521, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.920] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xadf, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xadf, lpOverlapped=0x0) returned 1 [0091.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.920] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.920] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.920] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.920] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.920] CloseHandle (hObject=0xd8) returned 1 [0091.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0091.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.933] GetLastError () returned 0x0 [0091.934] RtlWakeConditionVariable () returned 0x0 [0091.934] GetCurrentThreadId () returned 0x98c [0091.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".ldf") returned 0x0 [0091.934] lstrlenW (lpString=".vhd") returned 4 [0091.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".vhd") returned 0x0 [0091.934] lstrlenW (lpString=".vhdx") returned 5 [0091.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".vhdx") returned 0x0 [0091.934] lstrlenW (lpString=".pst") returned 4 [0091.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".pst") returned 0x0 [0091.934] lstrlenW (lpString=".ost") returned 4 [0091.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".ost") returned 0x0 [0091.934] lstrlenW (lpString=".bak") returned 4 [0091.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".bak") returned 0x0 [0091.935] lstrlenW (lpString=".bac") returned 4 [0091.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".bac") returned 0x0 [0091.935] lstrlenW (lpString=".sys") returned 4 [0091.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".sys") returned 0x0 [0091.935] lstrlenW (lpString=".v2i") returned 4 [0091.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".v2i") returned 0x0 [0091.935] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.937] lstrlenW (lpString=".sql") returned 4 [0091.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".sql") returned 0x0 [0091.938] lstrlenW (lpString=".mdf") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".mdf") returned 0x0 [0091.938] lstrlenW (lpString=".txt") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".txt") returned 0x0 [0091.938] lstrlenW (lpString=".dbf") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".dbf") returned 0x0 [0091.938] lstrlenW (lpString=".ckp") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".ckp") returned 0x0 [0091.938] lstrlenW (lpString=".dacpac") returned 7 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".dacpac") returned 0x0 [0091.938] lstrlenW (lpString=".db3") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".db3") returned 0x0 [0091.938] lstrlenW (lpString=".dtxs") returned 5 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".dtxs") returned 0x0 [0091.938] lstrlenW (lpString=".mdt") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".mdt") returned 0x0 [0091.938] lstrlenW (lpString=".sdf") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".sdf") returned 0x0 [0091.938] lstrlenW (lpString=".MDF") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".MDF") returned 0x0 [0091.938] lstrlenW (lpString=".DBF") returned 4 [0091.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".DBF") returned 0x0 [0091.939] lstrlenW (lpString=".DB") returned 3 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".DB") returned 0x0 [0091.939] lstrlenW (lpString=".db") returned 3 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".db") returned 0x0 [0091.939] lstrlenW (lpString=".ndf") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".ndf") returned 0x0 [0091.939] lstrlenW (lpString=".NDF") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".NDF") returned 0x0 [0091.939] lstrlenW (lpString=".Mdf") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".Mdf") returned 0x0 [0091.939] lstrlenW (lpString=".dat") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".dat") returned 0x0 [0091.939] lstrlenW (lpString=".DAT") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".DAT") returned 0x0 [0091.939] lstrlenW (lpString=".ldf") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".ldf") returned 0x0 [0091.939] lstrlenW (lpString=".LDF") returned 4 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch=".LDF") returned 0x0 [0091.939] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.940] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.941] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.941] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.941] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21194192737) returned 1 [0091.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc59cb270, dwHighDateTime=0x1d585b4)) [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b64a8 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b64a8 | out: hHeap=0x260000) returned 1 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.942] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.942] GetLastError () returned 0x0 [0091.942] GetLastError () returned 0x0 [0091.942] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.942] GetLastError () returned 0x0 [0091.943] GetLastError () returned 0x0 [0091.944] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.944] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xf1, lpOverlapped=0x0) returned 1 [0091.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.944] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.944] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.944] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.944] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.945] CloseHandle (hObject=0xd8) returned 1 [0091.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.948] GetLastError () returned 0x0 [0091.948] RtlWakeConditionVariable () returned 0x0 [0091.948] GetCurrentThreadId () returned 0x98c [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".ldf") returned 0x0 [0091.949] lstrlenW (lpString=".vhd") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".vhd") returned 0x0 [0091.949] lstrlenW (lpString=".vhdx") returned 5 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".vhdx") returned 0x0 [0091.949] lstrlenW (lpString=".pst") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".pst") returned 0x0 [0091.949] lstrlenW (lpString=".ost") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".ost") returned 0x0 [0091.949] lstrlenW (lpString=".bak") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".bak") returned 0x0 [0091.949] lstrlenW (lpString=".bac") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".bac") returned 0x0 [0091.949] lstrlenW (lpString=".sys") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".sys") returned 0x0 [0091.949] lstrlenW (lpString=".v2i") returned 4 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".v2i") returned 0x0 [0091.949] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.951] lstrlenW (lpString=".sql") returned 4 [0091.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".sql") returned 0x0 [0091.951] lstrlenW (lpString=".mdf") returned 4 [0091.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".mdf") returned 0x0 [0091.951] lstrlenW (lpString=".txt") returned 4 [0091.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".txt") returned 0x0 [0091.951] lstrlenW (lpString=".dbf") returned 4 [0091.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".dbf") returned 0x0 [0091.951] lstrlenW (lpString=".ckp") returned 4 [0091.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".ckp") returned 0x0 [0091.951] lstrlenW (lpString=".dacpac") returned 7 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".dacpac") returned 0x0 [0091.952] lstrlenW (lpString=".db3") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".db3") returned 0x0 [0091.952] lstrlenW (lpString=".dtxs") returned 5 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".dtxs") returned 0x0 [0091.952] lstrlenW (lpString=".mdt") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".mdt") returned 0x0 [0091.952] lstrlenW (lpString=".sdf") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".sdf") returned 0x0 [0091.952] lstrlenW (lpString=".MDF") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".MDF") returned 0x0 [0091.952] lstrlenW (lpString=".DBF") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".DBF") returned 0x0 [0091.952] lstrlenW (lpString=".DB") returned 3 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".DB") returned 0x0 [0091.952] lstrlenW (lpString=".db") returned 3 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".db") returned 0x0 [0091.952] lstrlenW (lpString=".ndf") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".ndf") returned 0x0 [0091.952] lstrlenW (lpString=".NDF") returned 4 [0091.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".NDF") returned 0x0 [0091.952] lstrlenW (lpString=".Mdf") returned 4 [0091.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".Mdf") returned 0x0 [0091.953] lstrlenW (lpString=".dat") returned 4 [0091.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".dat") returned 0x0 [0091.953] lstrlenW (lpString=".DAT") returned 4 [0091.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".DAT") returned 0x0 [0091.953] lstrlenW (lpString=".ldf") returned 4 [0091.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".ldf") returned 0x0 [0091.953] lstrlenW (lpString=".LDF") returned 4 [0091.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch=".LDF") returned 0x0 [0091.953] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.953] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.954] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.954] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.954] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21195548433) returned 1 [0091.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc59f13d0, dwHighDateTime=0x1d585b4)) [0091.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b64e0 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b64e0 | out: hHeap=0x260000) returned 1 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.955] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.955] GetLastError () returned 0x0 [0091.956] GetLastError () returned 0x0 [0091.956] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.956] GetLastError () returned 0x0 [0091.956] GetLastError () returned 0x0 [0091.958] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffca3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.958] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x35d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x35d, lpOverlapped=0x0) returned 1 [0091.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.958] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.958] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.958] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.958] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.959] CloseHandle (hObject=0xd8) returned 1 [0091.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.960] GetLastError () returned 0x0 [0091.960] RtlWakeConditionVariable () returned 0x0 [0091.960] GetCurrentThreadId () returned 0x98c [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".ldf") returned 0x0 [0091.961] lstrlenW (lpString=".vhd") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".vhd") returned 0x0 [0091.961] lstrlenW (lpString=".vhdx") returned 5 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".vhdx") returned 0x0 [0091.961] lstrlenW (lpString=".pst") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".pst") returned 0x0 [0091.961] lstrlenW (lpString=".ost") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".ost") returned 0x0 [0091.961] lstrlenW (lpString=".bak") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".bak") returned 0x0 [0091.961] lstrlenW (lpString=".bac") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".bac") returned 0x0 [0091.961] lstrlenW (lpString=".sys") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".sys") returned 0x0 [0091.961] lstrlenW (lpString=".v2i") returned 4 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".v2i") returned 0x0 [0091.961] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.963] lstrlenW (lpString=".sql") returned 4 [0091.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".sql") returned 0x0 [0091.963] lstrlenW (lpString=".mdf") returned 4 [0091.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".mdf") returned 0x0 [0091.963] lstrlenW (lpString=".txt") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".txt") returned 0x0 [0091.966] lstrlenW (lpString=".dbf") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".dbf") returned 0x0 [0091.966] lstrlenW (lpString=".ckp") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".ckp") returned 0x0 [0091.966] lstrlenW (lpString=".dacpac") returned 7 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".dacpac") returned 0x0 [0091.966] lstrlenW (lpString=".db3") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".db3") returned 0x0 [0091.966] lstrlenW (lpString=".dtxs") returned 5 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".dtxs") returned 0x0 [0091.966] lstrlenW (lpString=".mdt") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".mdt") returned 0x0 [0091.966] lstrlenW (lpString=".sdf") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".sdf") returned 0x0 [0091.966] lstrlenW (lpString=".MDF") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".MDF") returned 0x0 [0091.966] lstrlenW (lpString=".DBF") returned 4 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".DBF") returned 0x0 [0091.966] lstrlenW (lpString=".DB") returned 3 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".DB") returned 0x0 [0091.966] lstrlenW (lpString=".db") returned 3 [0091.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".db") returned 0x0 [0091.966] lstrlenW (lpString=".ndf") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".ndf") returned 0x0 [0091.967] lstrlenW (lpString=".NDF") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".NDF") returned 0x0 [0091.967] lstrlenW (lpString=".Mdf") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".Mdf") returned 0x0 [0091.967] lstrlenW (lpString=".dat") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".dat") returned 0x0 [0091.967] lstrlenW (lpString=".DAT") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".DAT") returned 0x0 [0091.967] lstrlenW (lpString=".ldf") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".ldf") returned 0x0 [0091.967] lstrlenW (lpString=".LDF") returned 4 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch=".LDF") returned 0x0 [0091.967] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0091.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.967] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0091.968] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.968] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.969] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21196976650) returned 1 [0091.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5a17530, dwHighDateTime=0x1d585b4)) [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6518 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6518 | out: hHeap=0x260000) returned 1 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.969] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0091.970] GetLastError () returned 0x0 [0091.970] GetLastError () returned 0x0 [0091.970] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0091.970] GetLastError () returned 0x0 [0091.970] GetLastError () returned 0x0 [0092.087] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.087] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x354, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x354, lpOverlapped=0x0) returned 1 [0092.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.087] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.087] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.088] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.088] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.088] CloseHandle (hObject=0xd8) returned 1 [0092.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.092] GetLastError () returned 0x0 [0092.092] RtlWakeConditionVariable () returned 0x0 [0092.092] GetCurrentThreadId () returned 0x98c [0092.092] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.092] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.092] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.092] WriteFile (in: hFile=0xd8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.094] CloseHandle (hObject=0xd8) returned 1 [0092.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9658 | out: hHeap=0x260000) returned 1 [0092.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9180 | out: hHeap=0x260000) returned 1 [0092.094] RtlWakeConditionVariable () returned 0x0 [0092.094] GetCurrentThreadId () returned 0x98c [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".ldf") returned 0x0 [0092.095] lstrlenW (lpString=".vhd") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".vhd") returned 0x0 [0092.095] lstrlenW (lpString=".vhdx") returned 5 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".vhdx") returned 0x0 [0092.095] lstrlenW (lpString=".pst") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".pst") returned 0x0 [0092.095] lstrlenW (lpString=".ost") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".ost") returned 0x0 [0092.095] lstrlenW (lpString=".bak") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".bak") returned 0x0 [0092.095] lstrlenW (lpString=".bac") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".bac") returned 0x0 [0092.095] lstrlenW (lpString=".sys") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".sys") returned 0x0 [0092.095] lstrlenW (lpString=".v2i") returned 4 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".v2i") returned 0x0 [0092.095] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.097] lstrlenW (lpString=".sql") returned 4 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".sql") returned 0x0 [0092.097] lstrlenW (lpString=".mdf") returned 4 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".mdf") returned 0x0 [0092.097] lstrlenW (lpString=".txt") returned 4 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".txt") returned 0x0 [0092.097] lstrlenW (lpString=".dbf") returned 4 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".dbf") returned 0x0 [0092.097] lstrlenW (lpString=".ckp") returned 4 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".ckp") returned 0x0 [0092.097] lstrlenW (lpString=".dacpac") returned 7 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".dacpac") returned 0x0 [0092.097] lstrlenW (lpString=".db3") returned 4 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".db3") returned 0x0 [0092.097] lstrlenW (lpString=".dtxs") returned 5 [0092.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".dtxs") returned 0x0 [0092.097] lstrlenW (lpString=".mdt") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".mdt") returned 0x0 [0092.098] lstrlenW (lpString=".sdf") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".sdf") returned 0x0 [0092.098] lstrlenW (lpString=".MDF") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".MDF") returned 0x0 [0092.098] lstrlenW (lpString=".DBF") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".DBF") returned 0x0 [0092.098] lstrlenW (lpString=".DB") returned 3 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".DB") returned 0x0 [0092.098] lstrlenW (lpString=".db") returned 3 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".db") returned 0x0 [0092.098] lstrlenW (lpString=".ndf") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".ndf") returned 0x0 [0092.098] lstrlenW (lpString=".NDF") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".NDF") returned 0x0 [0092.098] lstrlenW (lpString=".Mdf") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".Mdf") returned 0x0 [0092.098] lstrlenW (lpString=".dat") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".dat") returned 0x0 [0092.098] lstrlenW (lpString=".DAT") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".DAT") returned 0x0 [0092.098] lstrlenW (lpString=".ldf") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".ldf") returned 0x0 [0092.098] lstrlenW (lpString=".LDF") returned 4 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch=".LDF") returned 0x0 [0092.098] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.099] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.099] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.099] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.100] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21210072104) returned 1 [0092.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5b48030, dwHighDateTime=0x1d585b4)) [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b67f0 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b67f0 | out: hHeap=0x260000) returned 1 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b408 [0092.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b408 | out: hHeap=0x260000) returned 1 [0092.100] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.100] GetLastError () returned 0x0 [0092.101] GetLastError () returned 0x0 [0092.101] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.101] GetLastError () returned 0x0 [0092.101] GetLastError () returned 0x0 [0092.103] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.104] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x244, lpOverlapped=0x0) returned 1 [0092.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.104] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.104] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.104] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.104] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.104] CloseHandle (hObject=0xd8) returned 1 [0092.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.105] GetLastError () returned 0x0 [0092.106] RtlWakeConditionVariable () returned 0x0 [0092.106] GetCurrentThreadId () returned 0x98c [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".ldf") returned 0x0 [0092.106] lstrlenW (lpString=".vhd") returned 4 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".vhd") returned 0x0 [0092.106] lstrlenW (lpString=".vhdx") returned 5 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".vhdx") returned 0x0 [0092.106] lstrlenW (lpString=".pst") returned 4 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".pst") returned 0x0 [0092.106] lstrlenW (lpString=".ost") returned 4 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".ost") returned 0x0 [0092.106] lstrlenW (lpString=".bak") returned 4 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".bak") returned 0x0 [0092.106] lstrlenW (lpString=".bac") returned 4 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".bac") returned 0x0 [0092.106] lstrlenW (lpString=".sys") returned 4 [0092.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".sys") returned 0x0 [0092.106] lstrlenW (lpString=".v2i") returned 4 [0092.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".v2i") returned 0x0 [0092.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.108] lstrlenW (lpString=".sql") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".sql") returned 0x0 [0092.108] lstrlenW (lpString=".mdf") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".mdf") returned 0x0 [0092.108] lstrlenW (lpString=".txt") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".txt") returned 0x0 [0092.108] lstrlenW (lpString=".dbf") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".dbf") returned 0x0 [0092.108] lstrlenW (lpString=".ckp") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".ckp") returned 0x0 [0092.108] lstrlenW (lpString=".dacpac") returned 7 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".dacpac") returned 0x0 [0092.108] lstrlenW (lpString=".db3") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".db3") returned 0x0 [0092.108] lstrlenW (lpString=".dtxs") returned 5 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".dtxs") returned 0x0 [0092.108] lstrlenW (lpString=".mdt") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".mdt") returned 0x0 [0092.108] lstrlenW (lpString=".sdf") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".sdf") returned 0x0 [0092.108] lstrlenW (lpString=".MDF") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".MDF") returned 0x0 [0092.108] lstrlenW (lpString=".DBF") returned 4 [0092.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".DBF") returned 0x0 [0092.108] lstrlenW (lpString=".DB") returned 3 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".DB") returned 0x0 [0092.109] lstrlenW (lpString=".db") returned 3 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".db") returned 0x0 [0092.109] lstrlenW (lpString=".ndf") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".ndf") returned 0x0 [0092.109] lstrlenW (lpString=".NDF") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".NDF") returned 0x0 [0092.109] lstrlenW (lpString=".Mdf") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".Mdf") returned 0x0 [0092.109] lstrlenW (lpString=".dat") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".dat") returned 0x0 [0092.109] lstrlenW (lpString=".DAT") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".DAT") returned 0x0 [0092.109] lstrlenW (lpString=".ldf") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".ldf") returned 0x0 [0092.109] lstrlenW (lpString=".LDF") returned 4 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch=".LDF") returned 0x0 [0092.109] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.109] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.110] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.110] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21211143088) returned 1 [0092.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5b6e190, dwHighDateTime=0x1d585b4)) [0092.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6828 [0092.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6828 | out: hHeap=0x260000) returned 1 [0092.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b408 [0092.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b408 | out: hHeap=0x260000) returned 1 [0092.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.111] GetLastError () returned 0x0 [0092.111] GetLastError () returned 0x0 [0092.111] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.112] GetLastError () returned 0x0 [0092.112] GetLastError () returned 0x0 [0092.113] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.113] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xae8, lpOverlapped=0x0) returned 1 [0092.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.114] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.114] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.114] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.114] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.114] CloseHandle (hObject=0xd8) returned 1 [0092.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.116] GetLastError () returned 0x0 [0092.116] RtlWakeConditionVariable () returned 0x0 [0092.116] GetCurrentThreadId () returned 0x98c [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".ldf") returned 0x0 [0092.116] lstrlenW (lpString=".vhd") returned 4 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".vhd") returned 0x0 [0092.116] lstrlenW (lpString=".vhdx") returned 5 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".vhdx") returned 0x0 [0092.116] lstrlenW (lpString=".pst") returned 4 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".pst") returned 0x0 [0092.116] lstrlenW (lpString=".ost") returned 4 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".ost") returned 0x0 [0092.116] lstrlenW (lpString=".bak") returned 4 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".bak") returned 0x0 [0092.116] lstrlenW (lpString=".bac") returned 4 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".bac") returned 0x0 [0092.116] lstrlenW (lpString=".sys") returned 4 [0092.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".sys") returned 0x0 [0092.116] lstrlenW (lpString=".v2i") returned 4 [0092.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".v2i") returned 0x0 [0092.117] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.118] lstrlenW (lpString=".sql") returned 4 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".sql") returned 0x0 [0092.118] lstrlenW (lpString=".mdf") returned 4 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".mdf") returned 0x0 [0092.118] lstrlenW (lpString=".txt") returned 4 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".txt") returned 0x0 [0092.118] lstrlenW (lpString=".dbf") returned 4 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".dbf") returned 0x0 [0092.118] lstrlenW (lpString=".ckp") returned 4 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".ckp") returned 0x0 [0092.118] lstrlenW (lpString=".dacpac") returned 7 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".dacpac") returned 0x0 [0092.118] lstrlenW (lpString=".db3") returned 4 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".db3") returned 0x0 [0092.118] lstrlenW (lpString=".dtxs") returned 5 [0092.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".dtxs") returned 0x0 [0092.118] lstrlenW (lpString=".mdt") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".mdt") returned 0x0 [0092.119] lstrlenW (lpString=".sdf") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".sdf") returned 0x0 [0092.119] lstrlenW (lpString=".MDF") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".MDF") returned 0x0 [0092.119] lstrlenW (lpString=".DBF") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".DBF") returned 0x0 [0092.119] lstrlenW (lpString=".DB") returned 3 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".DB") returned 0x0 [0092.119] lstrlenW (lpString=".db") returned 3 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".db") returned 0x0 [0092.119] lstrlenW (lpString=".ndf") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".ndf") returned 0x0 [0092.119] lstrlenW (lpString=".NDF") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".NDF") returned 0x0 [0092.119] lstrlenW (lpString=".Mdf") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".Mdf") returned 0x0 [0092.119] lstrlenW (lpString=".dat") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".dat") returned 0x0 [0092.119] lstrlenW (lpString=".DAT") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".DAT") returned 0x0 [0092.119] lstrlenW (lpString=".ldf") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".ldf") returned 0x0 [0092.119] lstrlenW (lpString=".LDF") returned 4 [0092.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch=".LDF") returned 0x0 [0092.119] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.120] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.120] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.120] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.121] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21212175598) returned 1 [0092.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5b942f0, dwHighDateTime=0x1d585b4)) [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6860 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6860 | out: hHeap=0x260000) returned 1 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0092.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0092.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0092.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0092.121] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.121] GetLastError () returned 0x0 [0092.122] GetLastError () returned 0x0 [0092.122] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.122] GetLastError () returned 0x0 [0092.122] GetLastError () returned 0x0 [0092.130] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc7d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.131] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x383, lpOverlapped=0x0) returned 1 [0092.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.133] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.133] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.133] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.133] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.133] CloseHandle (hObject=0xd8) returned 1 [0092.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.136] GetLastError () returned 0x0 [0092.136] RtlWakeConditionVariable () returned 0x0 [0092.136] GetCurrentThreadId () returned 0x98c [0092.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".ldf") returned 0x0 [0092.136] lstrlenW (lpString=".vhd") returned 4 [0092.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".vhd") returned 0x0 [0092.136] lstrlenW (lpString=".vhdx") returned 5 [0092.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".vhdx") returned 0x0 [0092.136] lstrlenW (lpString=".pst") returned 4 [0092.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".pst") returned 0x0 [0092.136] lstrlenW (lpString=".ost") returned 4 [0092.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".ost") returned 0x0 [0092.136] lstrlenW (lpString=".bak") returned 4 [0092.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".bak") returned 0x0 [0092.136] lstrlenW (lpString=".bac") returned 4 [0092.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".bac") returned 0x0 [0092.137] lstrlenW (lpString=".sys") returned 4 [0092.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".sys") returned 0x0 [0092.137] lstrlenW (lpString=".v2i") returned 4 [0092.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".v2i") returned 0x0 [0092.137] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.138] lstrlenW (lpString=".sql") returned 4 [0092.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".sql") returned 0x0 [0092.138] lstrlenW (lpString=".mdf") returned 4 [0092.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".mdf") returned 0x0 [0092.138] lstrlenW (lpString=".txt") returned 4 [0092.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".txt") returned 0x0 [0092.138] lstrlenW (lpString=".dbf") returned 4 [0092.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".dbf") returned 0x0 [0092.138] lstrlenW (lpString=".ckp") returned 4 [0092.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".ckp") returned 0x0 [0092.138] lstrlenW (lpString=".dacpac") returned 7 [0092.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".dacpac") returned 0x0 [0092.139] lstrlenW (lpString=".db3") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".db3") returned 0x0 [0092.139] lstrlenW (lpString=".dtxs") returned 5 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".dtxs") returned 0x0 [0092.139] lstrlenW (lpString=".mdt") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".mdt") returned 0x0 [0092.139] lstrlenW (lpString=".sdf") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".sdf") returned 0x0 [0092.139] lstrlenW (lpString=".MDF") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".MDF") returned 0x0 [0092.139] lstrlenW (lpString=".DBF") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".DBF") returned 0x0 [0092.139] lstrlenW (lpString=".DB") returned 3 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".DB") returned 0x0 [0092.139] lstrlenW (lpString=".db") returned 3 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".db") returned 0x0 [0092.139] lstrlenW (lpString=".ndf") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".ndf") returned 0x0 [0092.139] lstrlenW (lpString=".NDF") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".NDF") returned 0x0 [0092.139] lstrlenW (lpString=".Mdf") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".Mdf") returned 0x0 [0092.139] lstrlenW (lpString=".dat") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".dat") returned 0x0 [0092.139] lstrlenW (lpString=".DAT") returned 4 [0092.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".DAT") returned 0x0 [0092.139] lstrlenW (lpString=".ldf") returned 4 [0092.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".ldf") returned 0x0 [0092.140] lstrlenW (lpString=".LDF") returned 4 [0092.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch=".LDF") returned 0x0 [0092.140] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.140] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.141] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.141] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.141] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21214193000) returned 1 [0092.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5bba450, dwHighDateTime=0x1d585b4)) [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6898 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6898 | out: hHeap=0x260000) returned 1 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.142] GetLastError () returned 0x0 [0092.142] GetLastError () returned 0x0 [0092.142] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.142] GetLastError () returned 0x0 [0092.142] GetLastError () returned 0x0 [0092.145] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.145] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x271, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x271, lpOverlapped=0x0) returned 1 [0092.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.145] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.145] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.145] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.145] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.145] CloseHandle (hObject=0xd8) returned 1 [0092.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.147] GetLastError () returned 0x0 [0092.147] RtlWakeConditionVariable () returned 0x0 [0092.147] GetCurrentThreadId () returned 0x98c [0092.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".ldf") returned 0x0 [0092.147] lstrlenW (lpString=".vhd") returned 4 [0092.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".vhd") returned 0x0 [0092.147] lstrlenW (lpString=".vhdx") returned 5 [0092.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".vhdx") returned 0x0 [0092.147] lstrlenW (lpString=".pst") returned 4 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".pst") returned 0x0 [0092.148] lstrlenW (lpString=".ost") returned 4 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".ost") returned 0x0 [0092.148] lstrlenW (lpString=".bak") returned 4 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".bak") returned 0x0 [0092.148] lstrlenW (lpString=".bac") returned 4 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".bac") returned 0x0 [0092.148] lstrlenW (lpString=".sys") returned 4 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".sys") returned 0x0 [0092.148] lstrlenW (lpString=".v2i") returned 4 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".v2i") returned 0x0 [0092.148] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.149] lstrlenW (lpString=".sql") returned 4 [0092.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".sql") returned 0x0 [0092.149] lstrlenW (lpString=".mdf") returned 4 [0092.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".mdf") returned 0x0 [0092.149] lstrlenW (lpString=".txt") returned 4 [0092.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".txt") returned 0x0 [0092.149] lstrlenW (lpString=".dbf") returned 4 [0092.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".dbf") returned 0x0 [0092.149] lstrlenW (lpString=".ckp") returned 4 [0092.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".ckp") returned 0x0 [0092.149] lstrlenW (lpString=".dacpac") returned 7 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".dacpac") returned 0x0 [0092.150] lstrlenW (lpString=".db3") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".db3") returned 0x0 [0092.150] lstrlenW (lpString=".dtxs") returned 5 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".dtxs") returned 0x0 [0092.150] lstrlenW (lpString=".mdt") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".mdt") returned 0x0 [0092.150] lstrlenW (lpString=".sdf") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".sdf") returned 0x0 [0092.150] lstrlenW (lpString=".MDF") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".MDF") returned 0x0 [0092.150] lstrlenW (lpString=".DBF") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".DBF") returned 0x0 [0092.150] lstrlenW (lpString=".DB") returned 3 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".DB") returned 0x0 [0092.150] lstrlenW (lpString=".db") returned 3 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".db") returned 0x0 [0092.150] lstrlenW (lpString=".ndf") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".ndf") returned 0x0 [0092.150] lstrlenW (lpString=".NDF") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".NDF") returned 0x0 [0092.150] lstrlenW (lpString=".Mdf") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".Mdf") returned 0x0 [0092.150] lstrlenW (lpString=".dat") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".dat") returned 0x0 [0092.150] lstrlenW (lpString=".DAT") returned 4 [0092.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".DAT") returned 0x0 [0092.151] lstrlenW (lpString=".ldf") returned 4 [0092.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".ldf") returned 0x0 [0092.151] lstrlenW (lpString=".LDF") returned 4 [0092.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch=".LDF") returned 0x0 [0092.151] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.151] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.152] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.152] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.152] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21215294874) returned 1 [0092.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5be05b0, dwHighDateTime=0x1d585b4)) [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b68d0 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b68d0 | out: hHeap=0x260000) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.153] GetLastError () returned 0x0 [0092.153] GetLastError () returned 0x0 [0092.153] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.153] GetLastError () returned 0x0 [0092.153] GetLastError () returned 0x0 [0092.155] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.155] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x369, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x369, lpOverlapped=0x0) returned 1 [0092.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.155] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.155] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.155] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.155] CloseHandle (hObject=0xd8) returned 1 [0092.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.157] GetLastError () returned 0x0 [0092.158] RtlWakeConditionVariable () returned 0x0 [0092.158] GetCurrentThreadId () returned 0x98c [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".ldf") returned 0x0 [0092.158] lstrlenW (lpString=".vhd") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".vhd") returned 0x0 [0092.158] lstrlenW (lpString=".vhdx") returned 5 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".vhdx") returned 0x0 [0092.158] lstrlenW (lpString=".pst") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".pst") returned 0x0 [0092.158] lstrlenW (lpString=".ost") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".ost") returned 0x0 [0092.158] lstrlenW (lpString=".bak") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".bak") returned 0x0 [0092.158] lstrlenW (lpString=".bac") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".bac") returned 0x0 [0092.158] lstrlenW (lpString=".sys") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".sys") returned 0x0 [0092.158] lstrlenW (lpString=".v2i") returned 4 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".v2i") returned 0x0 [0092.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch="s\r\n.v2i") returned 0x0 [0092.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.160] lstrlenW (lpString=".sql") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".sql") returned 0x0 [0092.160] lstrlenW (lpString=".mdf") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".mdf") returned 0x0 [0092.160] lstrlenW (lpString=".txt") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".txt") returned 0x0 [0092.160] lstrlenW (lpString=".dbf") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".dbf") returned 0x0 [0092.160] lstrlenW (lpString=".ckp") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".ckp") returned 0x0 [0092.160] lstrlenW (lpString=".dacpac") returned 7 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".dacpac") returned 0x0 [0092.160] lstrlenW (lpString=".db3") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".db3") returned 0x0 [0092.160] lstrlenW (lpString=".dtxs") returned 5 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".dtxs") returned 0x0 [0092.160] lstrlenW (lpString=".mdt") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".mdt") returned 0x0 [0092.160] lstrlenW (lpString=".sdf") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".sdf") returned 0x0 [0092.160] lstrlenW (lpString=".MDF") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".MDF") returned 0x0 [0092.160] lstrlenW (lpString=".DBF") returned 4 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".DBF") returned 0x0 [0092.160] lstrlenW (lpString=".DB") returned 3 [0092.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".DB") returned 0x0 [0092.161] lstrlenW (lpString=".db") returned 3 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".db") returned 0x0 [0092.161] lstrlenW (lpString=".ndf") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".ndf") returned 0x0 [0092.161] lstrlenW (lpString=".NDF") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".NDF") returned 0x0 [0092.161] lstrlenW (lpString=".Mdf") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".Mdf") returned 0x0 [0092.161] lstrlenW (lpString=".dat") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".dat") returned 0x0 [0092.161] lstrlenW (lpString=".DAT") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".DAT") returned 0x0 [0092.161] lstrlenW (lpString=".ldf") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".ldf") returned 0x0 [0092.161] lstrlenW (lpString=".LDF") returned 4 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch=".LDF") returned 0x0 [0092.161] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.161] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.162] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.162] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21216338866) returned 1 [0092.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5be05b0, dwHighDateTime=0x1d585b4)) [0092.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6908 [0092.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6908 | out: hHeap=0x260000) returned 1 [0092.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.163] GetLastError () returned 0x0 [0092.163] GetLastError () returned 0x0 [0092.163] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.163] GetLastError () returned 0x0 [0092.164] GetLastError () returned 0x0 [0092.166] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffebb7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.166] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x14484, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x14484, lpOverlapped=0x0) returned 1 [0092.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.166] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.166] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.166] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.167] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.167] CloseHandle (hObject=0xd8) returned 1 [0092.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js.[deadmin@cock.li].deadmin")) returned 1 [0092.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.168] GetLastError () returned 0x0 [0092.168] RtlWakeConditionVariable () returned 0x0 [0092.168] GetCurrentThreadId () returned 0x98c [0092.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0092.168] lstrlenW (lpString=".vhd") returned 4 [0092.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".vhd") returned 0x0 [0092.169] lstrlenW (lpString=".vhdx") returned 5 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".vhdx") returned 0x0 [0092.169] lstrlenW (lpString=".pst") returned 4 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".pst") returned 0x0 [0092.169] lstrlenW (lpString=".ost") returned 4 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".ost") returned 0x0 [0092.169] lstrlenW (lpString=".bak") returned 4 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".bak") returned 0x0 [0092.169] lstrlenW (lpString=".bac") returned 4 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".bac") returned 0x0 [0092.169] lstrlenW (lpString=".sys") returned 4 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".sys") returned 0x0 [0092.169] lstrlenW (lpString=".v2i") returned 4 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".v2i") returned 0x0 [0092.169] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.170] lstrlenW (lpString=".sql") returned 4 [0092.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".sql") returned 0x0 [0092.170] lstrlenW (lpString=".mdf") returned 4 [0092.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".mdf") returned 0x0 [0092.170] lstrlenW (lpString=".txt") returned 4 [0092.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".txt") returned 0x0 [0092.170] lstrlenW (lpString=".dbf") returned 4 [0092.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".dbf") returned 0x0 [0092.170] lstrlenW (lpString=".ckp") returned 4 [0092.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".ckp") returned 0x0 [0092.171] lstrlenW (lpString=".dacpac") returned 7 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".dacpac") returned 0x0 [0092.171] lstrlenW (lpString=".db3") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".db3") returned 0x0 [0092.171] lstrlenW (lpString=".dtxs") returned 5 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".dtxs") returned 0x0 [0092.171] lstrlenW (lpString=".mdt") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".mdt") returned 0x0 [0092.171] lstrlenW (lpString=".sdf") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".sdf") returned 0x0 [0092.171] lstrlenW (lpString=".MDF") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".MDF") returned 0x0 [0092.171] lstrlenW (lpString=".DBF") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".DBF") returned 0x0 [0092.171] lstrlenW (lpString=".DB") returned 3 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".DB") returned 0x0 [0092.171] lstrlenW (lpString=".db") returned 3 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".db") returned 0x0 [0092.171] lstrlenW (lpString=".ndf") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".ndf") returned 0x0 [0092.171] lstrlenW (lpString=".NDF") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".NDF") returned 0x0 [0092.171] lstrlenW (lpString=".Mdf") returned 4 [0092.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".Mdf") returned 0x0 [0092.171] lstrlenW (lpString=".dat") returned 4 [0092.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".dat") returned 0x0 [0092.172] lstrlenW (lpString=".DAT") returned 4 [0092.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".DAT") returned 0x0 [0092.172] lstrlenW (lpString=".ldf") returned 4 [0092.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0092.172] lstrlenW (lpString=".LDF") returned 4 [0092.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch=".LDF") returned 0x0 [0092.172] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.172] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.173] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.173] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.173] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21217410327) returned 1 [0092.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5c06710, dwHighDateTime=0x1d585b4)) [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6940 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6940 | out: hHeap=0x260000) returned 1 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.174] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.174] GetLastError () returned 0x0 [0092.174] GetLastError () returned 0x0 [0092.174] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.174] GetLastError () returned 0x0 [0092.174] GetLastError () returned 0x0 [0092.263] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.283] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x43a, lpOverlapped=0x0) returned 1 [0092.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.284] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.284] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.284] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.284] CloseHandle (hObject=0xd8) returned 1 [0092.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.[deadmin@cock.li].deadmin")) returned 1 [0092.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.285] GetLastError () returned 0x0 [0092.286] RtlWakeConditionVariable () returned 0x0 [0092.286] GetCurrentThreadId () returned 0x98c [0092.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.286] lstrlenW (lpString=".vhd") returned 4 [0092.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0092.286] lstrlenW (lpString=".vhdx") returned 5 [0092.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.286] lstrlenW (lpString=".pst") returned 4 [0092.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".pst") returned 0x0 [0092.286] lstrlenW (lpString=".ost") returned 4 [0092.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ost") returned 0x0 [0092.286] lstrlenW (lpString=".bak") returned 4 [0092.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bak") returned 0x0 [0092.287] lstrlenW (lpString=".bac") returned 4 [0092.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bac") returned 0x0 [0092.287] lstrlenW (lpString=".sys") returned 4 [0092.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sys") returned 0x0 [0092.287] lstrlenW (lpString=".v2i") returned 4 [0092.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0092.287] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.288] lstrlenW (lpString=".sql") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sql") returned 0x0 [0092.288] lstrlenW (lpString=".mdf") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0092.288] lstrlenW (lpString=".txt") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".txt") returned 0x0 [0092.288] lstrlenW (lpString=".dbf") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0092.288] lstrlenW (lpString=".ckp") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0092.288] lstrlenW (lpString=".dacpac") returned 7 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.288] lstrlenW (lpString=".db3") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db3") returned 0x0 [0092.288] lstrlenW (lpString=".dtxs") returned 5 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.288] lstrlenW (lpString=".mdt") returned 4 [0092.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0092.289] lstrlenW (lpString=".sdf") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0092.289] lstrlenW (lpString=".MDF") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0092.289] lstrlenW (lpString=".DBF") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0092.289] lstrlenW (lpString=".DB") returned 3 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DB") returned 0x0 [0092.289] lstrlenW (lpString=".db") returned 3 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db") returned 0x0 [0092.289] lstrlenW (lpString=".ndf") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0092.289] lstrlenW (lpString=".NDF") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0092.289] lstrlenW (lpString=".Mdf") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.289] lstrlenW (lpString=".dat") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dat") returned 0x0 [0092.289] lstrlenW (lpString=".DAT") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0092.289] lstrlenW (lpString=".ldf") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.289] lstrlenW (lpString=".LDF") returned 4 [0092.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0092.289] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.290] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.291] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.291] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.291] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21229189318) returned 1 [0092.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5d37210, dwHighDateTime=0x1d585b4)) [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6be0 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6be0 | out: hHeap=0x260000) returned 1 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.292] GetLastError () returned 0x0 [0092.292] GetLastError () returned 0x0 [0092.292] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.292] GetLastError () returned 0x0 [0092.292] GetLastError () returned 0x0 [0092.294] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.294] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x638, lpOverlapped=0x0) returned 1 [0092.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.294] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.294] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.294] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.294] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.294] CloseHandle (hObject=0xd8) returned 1 [0092.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0092.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.296] GetLastError () returned 0x0 [0092.296] RtlWakeConditionVariable () returned 0x0 [0092.296] GetCurrentThreadId () returned 0x98c [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".ldf") returned 0x0 [0092.296] lstrlenW (lpString=".vhd") returned 4 [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".vhd") returned 0x0 [0092.296] lstrlenW (lpString=".vhdx") returned 5 [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".vhdx") returned 0x0 [0092.296] lstrlenW (lpString=".pst") returned 4 [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".pst") returned 0x0 [0092.296] lstrlenW (lpString=".ost") returned 4 [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".ost") returned 0x0 [0092.296] lstrlenW (lpString=".bak") returned 4 [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".bak") returned 0x0 [0092.296] lstrlenW (lpString=".bac") returned 4 [0092.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".bac") returned 0x0 [0092.297] lstrlenW (lpString=".sys") returned 4 [0092.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".sys") returned 0x0 [0092.297] lstrlenW (lpString=".v2i") returned 4 [0092.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".v2i") returned 0x0 [0092.297] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.298] lstrlenW (lpString=".sql") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".sql") returned 0x0 [0092.298] lstrlenW (lpString=".mdf") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".mdf") returned 0x0 [0092.298] lstrlenW (lpString=".txt") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".txt") returned 0x0 [0092.298] lstrlenW (lpString=".dbf") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".dbf") returned 0x0 [0092.298] lstrlenW (lpString=".ckp") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".ckp") returned 0x0 [0092.298] lstrlenW (lpString=".dacpac") returned 7 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".dacpac") returned 0x0 [0092.298] lstrlenW (lpString=".db3") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".db3") returned 0x0 [0092.298] lstrlenW (lpString=".dtxs") returned 5 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".dtxs") returned 0x0 [0092.298] lstrlenW (lpString=".mdt") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".mdt") returned 0x0 [0092.298] lstrlenW (lpString=".sdf") returned 4 [0092.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".sdf") returned 0x0 [0092.299] lstrlenW (lpString=".MDF") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".MDF") returned 0x0 [0092.299] lstrlenW (lpString=".DBF") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".DBF") returned 0x0 [0092.299] lstrlenW (lpString=".DB") returned 3 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".DB") returned 0x0 [0092.299] lstrlenW (lpString=".db") returned 3 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".db") returned 0x0 [0092.299] lstrlenW (lpString=".ndf") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".ndf") returned 0x0 [0092.299] lstrlenW (lpString=".NDF") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".NDF") returned 0x0 [0092.299] lstrlenW (lpString=".Mdf") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".Mdf") returned 0x0 [0092.299] lstrlenW (lpString=".dat") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".dat") returned 0x0 [0092.299] lstrlenW (lpString=".DAT") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".DAT") returned 0x0 [0092.299] lstrlenW (lpString=".ldf") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".ldf") returned 0x0 [0092.299] lstrlenW (lpString=".LDF") returned 4 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch=".LDF") returned 0x0 [0092.299] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.300] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.300] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.300] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21230161796) returned 1 [0092.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5d37210, dwHighDateTime=0x1d585b4)) [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6c18 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6c18 | out: hHeap=0x260000) returned 1 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.301] GetLastError () returned 0x0 [0092.302] GetLastError () returned 0x0 [0092.302] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.302] GetLastError () returned 0x0 [0092.302] GetLastError () returned 0x0 [0092.303] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd94c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.304] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x26b4, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x26b4, lpOverlapped=0x0) returned 1 [0092.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.304] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.304] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.304] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.304] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.304] CloseHandle (hObject=0xd8) returned 1 [0092.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js.[deadmin@cock.li].deadmin")) returned 1 [0092.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.306] GetLastError () returned 0x0 [0092.306] RtlWakeConditionVariable () returned 0x0 [0092.306] GetCurrentThreadId () returned 0x98c [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".ldf") returned 0x0 [0092.306] lstrlenW (lpString=".vhd") returned 4 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".vhd") returned 0x0 [0092.306] lstrlenW (lpString=".vhdx") returned 5 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".vhdx") returned 0x0 [0092.306] lstrlenW (lpString=".pst") returned 4 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".pst") returned 0x0 [0092.306] lstrlenW (lpString=".ost") returned 4 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".ost") returned 0x0 [0092.306] lstrlenW (lpString=".bak") returned 4 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".bak") returned 0x0 [0092.306] lstrlenW (lpString=".bac") returned 4 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".bac") returned 0x0 [0092.306] lstrlenW (lpString=".sys") returned 4 [0092.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".sys") returned 0x0 [0092.306] lstrlenW (lpString=".v2i") returned 4 [0092.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".v2i") returned 0x0 [0092.307] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.308] lstrlenW (lpString=".sql") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".sql") returned 0x0 [0092.308] lstrlenW (lpString=".mdf") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".mdf") returned 0x0 [0092.308] lstrlenW (lpString=".txt") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".txt") returned 0x0 [0092.308] lstrlenW (lpString=".dbf") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".dbf") returned 0x0 [0092.308] lstrlenW (lpString=".ckp") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".ckp") returned 0x0 [0092.308] lstrlenW (lpString=".dacpac") returned 7 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".dacpac") returned 0x0 [0092.308] lstrlenW (lpString=".db3") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".db3") returned 0x0 [0092.308] lstrlenW (lpString=".dtxs") returned 5 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".dtxs") returned 0x0 [0092.308] lstrlenW (lpString=".mdt") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".mdt") returned 0x0 [0092.308] lstrlenW (lpString=".sdf") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".sdf") returned 0x0 [0092.308] lstrlenW (lpString=".MDF") returned 4 [0092.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".MDF") returned 0x0 [0092.309] lstrlenW (lpString=".DBF") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".DBF") returned 0x0 [0092.309] lstrlenW (lpString=".DB") returned 3 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".DB") returned 0x0 [0092.309] lstrlenW (lpString=".db") returned 3 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".db") returned 0x0 [0092.309] lstrlenW (lpString=".ndf") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".ndf") returned 0x0 [0092.309] lstrlenW (lpString=".NDF") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".NDF") returned 0x0 [0092.309] lstrlenW (lpString=".Mdf") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".Mdf") returned 0x0 [0092.309] lstrlenW (lpString=".dat") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".dat") returned 0x0 [0092.309] lstrlenW (lpString=".DAT") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".DAT") returned 0x0 [0092.309] lstrlenW (lpString=".ldf") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".ldf") returned 0x0 [0092.309] lstrlenW (lpString=".LDF") returned 4 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch=".LDF") returned 0x0 [0092.309] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.309] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.310] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.310] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21231317479) returned 1 [0092.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5d5d370, dwHighDateTime=0x1d585b4)) [0092.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6c50 [0092.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6c50 | out: hHeap=0x260000) returned 1 [0092.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.313] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.313] GetLastError () returned 0x0 [0092.313] GetLastError () returned 0x0 [0092.313] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.313] GetLastError () returned 0x0 [0092.313] GetLastError () returned 0x0 [0092.316] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffebcea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.316] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x14316, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x14316, lpOverlapped=0x0) returned 1 [0092.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.316] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.316] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.316] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.316] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.316] CloseHandle (hObject=0xd8) returned 1 [0092.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.318] GetLastError () returned 0x0 [0092.318] RtlWakeConditionVariable () returned 0x0 [0092.318] GetCurrentThreadId () returned 0x98c [0092.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".ldf") returned 0x0 [0092.319] lstrlenW (lpString=".vhd") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".vhd") returned 0x0 [0092.319] lstrlenW (lpString=".vhdx") returned 5 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".vhdx") returned 0x0 [0092.319] lstrlenW (lpString=".pst") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".pst") returned 0x0 [0092.319] lstrlenW (lpString=".ost") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".ost") returned 0x0 [0092.319] lstrlenW (lpString=".bak") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".bak") returned 0x0 [0092.319] lstrlenW (lpString=".bac") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".bac") returned 0x0 [0092.319] lstrlenW (lpString=".sys") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".sys") returned 0x0 [0092.319] lstrlenW (lpString=".v2i") returned 4 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".v2i") returned 0x0 [0092.319] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.320] lstrlenW (lpString=".sql") returned 4 [0092.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".sql") returned 0x0 [0092.320] lstrlenW (lpString=".mdf") returned 4 [0092.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".mdf") returned 0x0 [0092.321] lstrlenW (lpString=".txt") returned 4 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".txt") returned 0x0 [0092.321] lstrlenW (lpString=".dbf") returned 4 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".dbf") returned 0x0 [0092.321] lstrlenW (lpString=".ckp") returned 4 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".ckp") returned 0x0 [0092.443] lstrlenW (lpString=".dacpac") returned 7 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".dacpac") returned 0x0 [0092.443] lstrlenW (lpString=".db3") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".db3") returned 0x0 [0092.443] lstrlenW (lpString=".dtxs") returned 5 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".dtxs") returned 0x0 [0092.443] lstrlenW (lpString=".mdt") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".mdt") returned 0x0 [0092.443] lstrlenW (lpString=".sdf") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".sdf") returned 0x0 [0092.443] lstrlenW (lpString=".MDF") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".MDF") returned 0x0 [0092.443] lstrlenW (lpString=".DBF") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".DBF") returned 0x0 [0092.443] lstrlenW (lpString=".DB") returned 3 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".DB") returned 0x0 [0092.443] lstrlenW (lpString=".db") returned 3 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".db") returned 0x0 [0092.443] lstrlenW (lpString=".ndf") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".ndf") returned 0x0 [0092.443] lstrlenW (lpString=".NDF") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".NDF") returned 0x0 [0092.443] lstrlenW (lpString=".Mdf") returned 4 [0092.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".Mdf") returned 0x0 [0092.444] lstrlenW (lpString=".dat") returned 4 [0092.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".dat") returned 0x0 [0092.444] lstrlenW (lpString=".DAT") returned 4 [0092.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".DAT") returned 0x0 [0092.444] lstrlenW (lpString=".ldf") returned 4 [0092.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".ldf") returned 0x0 [0092.444] lstrlenW (lpString=".LDF") returned 4 [0092.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch=".LDF") returned 0x0 [0092.444] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.444] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.445] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.445] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21244605982) returned 1 [0092.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5e8de70, dwHighDateTime=0x1d585b4)) [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6ef0 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6ef0 | out: hHeap=0x260000) returned 1 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.446] GetLastError () returned 0x0 [0092.446] GetLastError () returned 0x0 [0092.446] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.446] GetLastError () returned 0x0 [0092.447] GetLastError () returned 0x0 [0092.449] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.449] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x267, lpOverlapped=0x0) returned 1 [0092.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.449] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.449] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.449] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.449] CloseHandle (hObject=0xd8) returned 1 [0092.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.451] GetLastError () returned 0x0 [0092.451] RtlWakeConditionVariable () returned 0x0 [0092.451] GetCurrentThreadId () returned 0x98c [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".ldf") returned 0x0 [0092.452] lstrlenW (lpString=".vhd") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".vhd") returned 0x0 [0092.452] lstrlenW (lpString=".vhdx") returned 5 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".vhdx") returned 0x0 [0092.452] lstrlenW (lpString=".pst") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".pst") returned 0x0 [0092.452] lstrlenW (lpString=".ost") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".ost") returned 0x0 [0092.452] lstrlenW (lpString=".bak") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".bak") returned 0x0 [0092.452] lstrlenW (lpString=".bac") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".bac") returned 0x0 [0092.452] lstrlenW (lpString=".sys") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".sys") returned 0x0 [0092.452] lstrlenW (lpString=".v2i") returned 4 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".v2i") returned 0x0 [0092.452] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.454] lstrlenW (lpString=".sql") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".sql") returned 0x0 [0092.454] lstrlenW (lpString=".mdf") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".mdf") returned 0x0 [0092.454] lstrlenW (lpString=".txt") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".txt") returned 0x0 [0092.454] lstrlenW (lpString=".dbf") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".dbf") returned 0x0 [0092.454] lstrlenW (lpString=".ckp") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".ckp") returned 0x0 [0092.454] lstrlenW (lpString=".dacpac") returned 7 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".dacpac") returned 0x0 [0092.454] lstrlenW (lpString=".db3") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".db3") returned 0x0 [0092.454] lstrlenW (lpString=".dtxs") returned 5 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".dtxs") returned 0x0 [0092.454] lstrlenW (lpString=".mdt") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".mdt") returned 0x0 [0092.454] lstrlenW (lpString=".sdf") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".sdf") returned 0x0 [0092.454] lstrlenW (lpString=".MDF") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".MDF") returned 0x0 [0092.454] lstrlenW (lpString=".DBF") returned 4 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".DBF") returned 0x0 [0092.454] lstrlenW (lpString=".DB") returned 3 [0092.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".DB") returned 0x0 [0092.454] lstrlenW (lpString=".db") returned 3 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".db") returned 0x0 [0092.455] lstrlenW (lpString=".ndf") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".ndf") returned 0x0 [0092.455] lstrlenW (lpString=".NDF") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".NDF") returned 0x0 [0092.455] lstrlenW (lpString=".Mdf") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".Mdf") returned 0x0 [0092.455] lstrlenW (lpString=".dat") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".dat") returned 0x0 [0092.455] lstrlenW (lpString=".DAT") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".DAT") returned 0x0 [0092.455] lstrlenW (lpString=".ldf") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".ldf") returned 0x0 [0092.455] lstrlenW (lpString=".LDF") returned 4 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch=".LDF") returned 0x0 [0092.455] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.455] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.456] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.456] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.456] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21245735167) returned 1 [0092.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5eb3fd0, dwHighDateTime=0x1d585b4)) [0092.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6f28 [0092.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6f28 | out: hHeap=0x260000) returned 1 [0092.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.457] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.457] GetLastError () returned 0x0 [0092.457] GetLastError () returned 0x0 [0092.457] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.457] GetLastError () returned 0x0 [0092.458] GetLastError () returned 0x0 [0092.459] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.459] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x373, lpOverlapped=0x0) returned 1 [0092.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.459] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.459] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.459] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.460] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.460] CloseHandle (hObject=0xd8) returned 1 [0092.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.461] GetLastError () returned 0x0 [0092.461] RtlWakeConditionVariable () returned 0x0 [0092.461] GetCurrentThreadId () returned 0x98c [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".ldf") returned 0x0 [0092.462] lstrlenW (lpString=".vhd") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".vhd") returned 0x0 [0092.462] lstrlenW (lpString=".vhdx") returned 5 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".vhdx") returned 0x0 [0092.462] lstrlenW (lpString=".pst") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".pst") returned 0x0 [0092.462] lstrlenW (lpString=".ost") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".ost") returned 0x0 [0092.462] lstrlenW (lpString=".bak") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".bak") returned 0x0 [0092.462] lstrlenW (lpString=".bac") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".bac") returned 0x0 [0092.462] lstrlenW (lpString=".sys") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".sys") returned 0x0 [0092.462] lstrlenW (lpString=".v2i") returned 4 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".v2i") returned 0x0 [0092.462] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.463] lstrlenW (lpString=".sql") returned 4 [0092.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".sql") returned 0x0 [0092.463] lstrlenW (lpString=".mdf") returned 4 [0092.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".mdf") returned 0x0 [0092.463] lstrlenW (lpString=".txt") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".txt") returned 0x0 [0092.464] lstrlenW (lpString=".dbf") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".dbf") returned 0x0 [0092.464] lstrlenW (lpString=".ckp") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".ckp") returned 0x0 [0092.464] lstrlenW (lpString=".dacpac") returned 7 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".dacpac") returned 0x0 [0092.464] lstrlenW (lpString=".db3") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".db3") returned 0x0 [0092.464] lstrlenW (lpString=".dtxs") returned 5 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".dtxs") returned 0x0 [0092.464] lstrlenW (lpString=".mdt") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".mdt") returned 0x0 [0092.464] lstrlenW (lpString=".sdf") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".sdf") returned 0x0 [0092.464] lstrlenW (lpString=".MDF") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".MDF") returned 0x0 [0092.464] lstrlenW (lpString=".DBF") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".DBF") returned 0x0 [0092.464] lstrlenW (lpString=".DB") returned 3 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".DB") returned 0x0 [0092.464] lstrlenW (lpString=".db") returned 3 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".db") returned 0x0 [0092.464] lstrlenW (lpString=".ndf") returned 4 [0092.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".ndf") returned 0x0 [0092.464] lstrlenW (lpString=".NDF") returned 4 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".NDF") returned 0x0 [0092.465] lstrlenW (lpString=".Mdf") returned 4 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".Mdf") returned 0x0 [0092.465] lstrlenW (lpString=".dat") returned 4 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".dat") returned 0x0 [0092.465] lstrlenW (lpString=".DAT") returned 4 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".DAT") returned 0x0 [0092.465] lstrlenW (lpString=".ldf") returned 4 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".ldf") returned 0x0 [0092.465] lstrlenW (lpString=".LDF") returned 4 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch=".LDF") returned 0x0 [0092.465] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.465] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.466] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.466] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21246720252) returned 1 [0092.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5eda130, dwHighDateTime=0x1d585b4)) [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6f60 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6f60 | out: hHeap=0x260000) returned 1 [0092.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.467] GetLastError () returned 0x0 [0092.467] GetLastError () returned 0x0 [0092.467] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.467] GetLastError () returned 0x0 [0092.467] GetLastError () returned 0x0 [0092.468] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.469] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x26d, lpOverlapped=0x0) returned 1 [0092.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.469] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.469] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.469] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.469] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.469] CloseHandle (hObject=0xd8) returned 1 [0092.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.471] GetLastError () returned 0x0 [0092.471] RtlWakeConditionVariable () returned 0x27e828 [0092.471] GetCurrentThreadId () returned 0x98c [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0092.471] lstrlenW (lpString=".vhd") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".vhd") returned 0x0 [0092.471] lstrlenW (lpString=".vhdx") returned 5 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".vhdx") returned 0x0 [0092.471] lstrlenW (lpString=".pst") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".pst") returned 0x0 [0092.471] lstrlenW (lpString=".ost") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".ost") returned 0x0 [0092.471] lstrlenW (lpString=".bak") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".bak") returned 0x0 [0092.471] lstrlenW (lpString=".bac") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".bac") returned 0x0 [0092.471] lstrlenW (lpString=".sys") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".sys") returned 0x0 [0092.471] lstrlenW (lpString=".v2i") returned 4 [0092.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".v2i") returned 0x0 [0092.471] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch="s\r\n.v2i") returned 0x0 [0092.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.473] lstrlenW (lpString=".sql") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".sql") returned 0x0 [0092.473] lstrlenW (lpString=".mdf") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".mdf") returned 0x0 [0092.473] lstrlenW (lpString=".txt") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".txt") returned 0x0 [0092.473] lstrlenW (lpString=".dbf") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".dbf") returned 0x0 [0092.473] lstrlenW (lpString=".ckp") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".ckp") returned 0x0 [0092.473] lstrlenW (lpString=".dacpac") returned 7 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".dacpac") returned 0x0 [0092.473] lstrlenW (lpString=".db3") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".db3") returned 0x0 [0092.473] lstrlenW (lpString=".dtxs") returned 5 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".dtxs") returned 0x0 [0092.473] lstrlenW (lpString=".mdt") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".mdt") returned 0x0 [0092.473] lstrlenW (lpString=".sdf") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".sdf") returned 0x0 [0092.473] lstrlenW (lpString=".MDF") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".MDF") returned 0x0 [0092.473] lstrlenW (lpString=".DBF") returned 4 [0092.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".DBF") returned 0x0 [0092.473] lstrlenW (lpString=".DB") returned 3 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".DB") returned 0x0 [0092.474] lstrlenW (lpString=".db") returned 3 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".db") returned 0x0 [0092.474] lstrlenW (lpString=".ndf") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".ndf") returned 0x0 [0092.474] lstrlenW (lpString=".NDF") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".NDF") returned 0x0 [0092.474] lstrlenW (lpString=".Mdf") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".Mdf") returned 0x0 [0092.474] lstrlenW (lpString=".dat") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".dat") returned 0x0 [0092.474] lstrlenW (lpString=".DAT") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".DAT") returned 0x0 [0092.474] lstrlenW (lpString=".ldf") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0092.474] lstrlenW (lpString=".LDF") returned 4 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch=".LDF") returned 0x0 [0092.474] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.474] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.475] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.475] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.475] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21247643575) returned 1 [0092.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc5eda130, dwHighDateTime=0x1d585b4)) [0092.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6f98 [0092.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6f98 | out: hHeap=0x260000) returned 1 [0092.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.476] GetLastError () returned 0x0 [0092.476] GetLastError () returned 0x0 [0092.476] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.477] GetLastError () returned 0x0 [0092.477] GetLastError () returned 0x0 [0092.599] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffeae9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.599] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x15162, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x15162, lpOverlapped=0x0) returned 1 [0092.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.600] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.600] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.600] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.600] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.600] CloseHandle (hObject=0xd8) returned 1 [0092.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js.[deadmin@cock.li].deadmin")) returned 1 [0092.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.603] GetLastError () returned 0x0 [0092.603] RtlWakeConditionVariable () returned 0x0 [0092.603] GetCurrentThreadId () returned 0x98c [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".ldf") returned 0x0 [0092.603] lstrlenW (lpString=".vhd") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".vhd") returned 0x0 [0092.603] lstrlenW (lpString=".vhdx") returned 5 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.603] lstrlenW (lpString=".pst") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".pst") returned 0x0 [0092.603] lstrlenW (lpString=".ost") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".ost") returned 0x0 [0092.603] lstrlenW (lpString=".bak") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".bak") returned 0x0 [0092.603] lstrlenW (lpString=".bac") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".bac") returned 0x0 [0092.603] lstrlenW (lpString=".sys") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".sys") returned 0x0 [0092.603] lstrlenW (lpString=".v2i") returned 4 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".v2i") returned 0x0 [0092.603] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.605] lstrlenW (lpString=".sql") returned 4 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".sql") returned 0x0 [0092.605] lstrlenW (lpString=".mdf") returned 4 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".mdf") returned 0x0 [0092.605] lstrlenW (lpString=".txt") returned 4 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".txt") returned 0x0 [0092.605] lstrlenW (lpString=".dbf") returned 4 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".dbf") returned 0x0 [0092.605] lstrlenW (lpString=".ckp") returned 4 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".ckp") returned 0x0 [0092.605] lstrlenW (lpString=".dacpac") returned 7 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.605] lstrlenW (lpString=".db3") returned 4 [0092.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".db3") returned 0x0 [0092.605] lstrlenW (lpString=".dtxs") returned 5 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.606] lstrlenW (lpString=".mdt") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".mdt") returned 0x0 [0092.606] lstrlenW (lpString=".sdf") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".sdf") returned 0x0 [0092.606] lstrlenW (lpString=".MDF") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".MDF") returned 0x0 [0092.606] lstrlenW (lpString=".DBF") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".DBF") returned 0x0 [0092.606] lstrlenW (lpString=".DB") returned 3 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".DB") returned 0x0 [0092.606] lstrlenW (lpString=".db") returned 3 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".db") returned 0x0 [0092.606] lstrlenW (lpString=".ndf") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".ndf") returned 0x0 [0092.606] lstrlenW (lpString=".NDF") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".NDF") returned 0x0 [0092.606] lstrlenW (lpString=".Mdf") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.606] lstrlenW (lpString=".dat") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".dat") returned 0x0 [0092.606] lstrlenW (lpString=".DAT") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".DAT") returned 0x0 [0092.606] lstrlenW (lpString=".ldf") returned 4 [0092.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".ldf") returned 0x0 [0092.606] lstrlenW (lpString=".LDF") returned 4 [0092.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch=".LDF") returned 0x0 [0092.607] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.607] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.607] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.608] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.608] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21260886379) returned 1 [0092.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6030d90, dwHighDateTime=0x1d585b4)) [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7270 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7270 | out: hHeap=0x260000) returned 1 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.608] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.609] GetLastError () returned 0x0 [0092.609] GetLastError () returned 0x0 [0092.609] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.609] GetLastError () returned 0x0 [0092.609] GetLastError () returned 0x0 [0092.611] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff864, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.611] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x79c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x79c, lpOverlapped=0x0) returned 1 [0092.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.611] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.611] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.611] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.611] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.611] CloseHandle (hObject=0xd8) returned 1 [0092.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0092.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0092.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.614] GetLastError () returned 0x0 [0092.614] RtlWakeConditionVariable () returned 0x0 [0092.614] GetCurrentThreadId () returned 0x98c [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".ldf") returned 0x0 [0092.614] lstrlenW (lpString=".vhd") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".vhd") returned 0x0 [0092.614] lstrlenW (lpString=".vhdx") returned 5 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".vhdx") returned 0x0 [0092.614] lstrlenW (lpString=".pst") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".pst") returned 0x0 [0092.614] lstrlenW (lpString=".ost") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".ost") returned 0x0 [0092.614] lstrlenW (lpString=".bak") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".bak") returned 0x0 [0092.614] lstrlenW (lpString=".bac") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".bac") returned 0x0 [0092.614] lstrlenW (lpString=".sys") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".sys") returned 0x0 [0092.614] lstrlenW (lpString=".v2i") returned 4 [0092.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".v2i") returned 0x0 [0092.614] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0092.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.616] lstrlenW (lpString=".sql") returned 4 [0092.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".sql") returned 0x0 [0092.616] lstrlenW (lpString=".mdf") returned 4 [0092.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".mdf") returned 0x0 [0092.616] lstrlenW (lpString=".txt") returned 4 [0092.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".txt") returned 0x0 [0092.616] lstrlenW (lpString=".dbf") returned 4 [0092.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".dbf") returned 0x0 [0092.616] lstrlenW (lpString=".ckp") returned 4 [0092.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".ckp") returned 0x0 [0092.616] lstrlenW (lpString=".dacpac") returned 7 [0092.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".dacpac") returned 0x0 [0092.616] lstrlenW (lpString=".db3") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".db3") returned 0x0 [0092.617] lstrlenW (lpString=".dtxs") returned 5 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".dtxs") returned 0x0 [0092.617] lstrlenW (lpString=".mdt") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".mdt") returned 0x0 [0092.617] lstrlenW (lpString=".sdf") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".sdf") returned 0x0 [0092.617] lstrlenW (lpString=".MDF") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".MDF") returned 0x0 [0092.617] lstrlenW (lpString=".DBF") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".DBF") returned 0x0 [0092.617] lstrlenW (lpString=".DB") returned 3 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".DB") returned 0x0 [0092.617] lstrlenW (lpString=".db") returned 3 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".db") returned 0x0 [0092.617] lstrlenW (lpString=".ndf") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".ndf") returned 0x0 [0092.617] lstrlenW (lpString=".NDF") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".NDF") returned 0x0 [0092.617] lstrlenW (lpString=".Mdf") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".Mdf") returned 0x0 [0092.617] lstrlenW (lpString=".dat") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".dat") returned 0x0 [0092.617] lstrlenW (lpString=".DAT") returned 4 [0092.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".DAT") returned 0x0 [0092.618] lstrlenW (lpString=".ldf") returned 4 [0092.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".ldf") returned 0x0 [0092.618] lstrlenW (lpString=".LDF") returned 4 [0092.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch=".LDF") returned 0x0 [0092.618] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0092.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.618] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.619] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.619] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21261997998) returned 1 [0092.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6056ef0, dwHighDateTime=0x1d585b4)) [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b72a8 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b72a8 | out: hHeap=0x260000) returned 1 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.620] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.620] GetLastError () returned 0x0 [0092.620] GetLastError () returned 0x0 [0092.620] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.620] GetLastError () returned 0x0 [0092.620] GetLastError () returned 0x0 [0092.622] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff313, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.622] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xced, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0xced, lpOverlapped=0x0) returned 1 [0092.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.622] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.622] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.623] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.623] CloseHandle (hObject=0xd8) returned 1 [0092.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x160) returned 0x2b2d80 [0092.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl.[deadmin@cock.li].deadmin")) returned 1 [0092.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0092.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.624] GetLastError () returned 0x0 [0092.625] RtlWakeConditionVariable () returned 0x0 [0092.625] GetCurrentThreadId () returned 0x98c [0092.625] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.625] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.625] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.625] WriteFile (in: hFile=0xd8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.627] CloseHandle (hObject=0xd8) returned 1 [0092.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d51d0 | out: hHeap=0x260000) returned 1 [0092.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d5088 | out: hHeap=0x260000) returned 1 [0092.627] RtlWakeConditionVariable () returned 0x27e828 [0092.627] GetCurrentThreadId () returned 0x98c [0092.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".ldf") returned 0x0 [0092.627] lstrlenW (lpString=".vhd") returned 4 [0092.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".vhd") returned 0x0 [0092.627] lstrlenW (lpString=".vhdx") returned 5 [0092.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".vhdx") returned 0x0 [0092.628] lstrlenW (lpString=".pst") returned 4 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".pst") returned 0x0 [0092.628] lstrlenW (lpString=".ost") returned 4 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".ost") returned 0x0 [0092.628] lstrlenW (lpString=".bak") returned 4 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".bak") returned 0x0 [0092.628] lstrlenW (lpString=".bac") returned 4 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".bac") returned 0x0 [0092.628] lstrlenW (lpString=".sys") returned 4 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".sys") returned 0x0 [0092.628] lstrlenW (lpString=".v2i") returned 4 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".v2i") returned 0x0 [0092.628] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.630] lstrlenW (lpString=".sql") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".sql") returned 0x0 [0092.630] lstrlenW (lpString=".mdf") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".mdf") returned 0x0 [0092.630] lstrlenW (lpString=".txt") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".txt") returned 0x0 [0092.630] lstrlenW (lpString=".dbf") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".dbf") returned 0x0 [0092.630] lstrlenW (lpString=".ckp") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".ckp") returned 0x0 [0092.630] lstrlenW (lpString=".dacpac") returned 7 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".dacpac") returned 0x0 [0092.630] lstrlenW (lpString=".db3") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".db3") returned 0x0 [0092.630] lstrlenW (lpString=".dtxs") returned 5 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".dtxs") returned 0x0 [0092.630] lstrlenW (lpString=".mdt") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".mdt") returned 0x0 [0092.630] lstrlenW (lpString=".sdf") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".sdf") returned 0x0 [0092.630] lstrlenW (lpString=".MDF") returned 4 [0092.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".MDF") returned 0x0 [0092.631] lstrlenW (lpString=".DBF") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".DBF") returned 0x0 [0092.631] lstrlenW (lpString=".DB") returned 3 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".DB") returned 0x0 [0092.631] lstrlenW (lpString=".db") returned 3 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".db") returned 0x0 [0092.631] lstrlenW (lpString=".ndf") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".ndf") returned 0x0 [0092.631] lstrlenW (lpString=".NDF") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".NDF") returned 0x0 [0092.631] lstrlenW (lpString=".Mdf") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".Mdf") returned 0x0 [0092.631] lstrlenW (lpString=".dat") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".dat") returned 0x0 [0092.631] lstrlenW (lpString=".DAT") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".DAT") returned 0x0 [0092.631] lstrlenW (lpString=".ldf") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".ldf") returned 0x0 [0092.631] lstrlenW (lpString=".LDF") returned 4 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch=".LDF") returned 0x0 [0092.631] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a920 [0092.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.631] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.632] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.632] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.632] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21263360345) returned 1 [0092.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6056ef0, dwHighDateTime=0x1d585b4)) [0092.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7580 [0092.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7580 | out: hHeap=0x260000) returned 1 [0092.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.758] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.758] GetLastError () returned 0x0 [0092.759] GetLastError () returned 0x0 [0092.759] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.759] GetLastError () returned 0x0 [0092.759] GetLastError () returned 0x0 [0092.760] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe93b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.761] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16c5, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x16c5, lpOverlapped=0x0) returned 1 [0092.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.761] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.761] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.761] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.761] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.761] CloseHandle (hObject=0xd8) returned 1 [0092.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x160) returned 0x2b2d80 [0092.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js.[deadmin@cock.li].deadmin")) returned 1 [0092.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0092.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.763] GetLastError () returned 0x0 [0092.763] RtlWakeConditionVariable () returned 0x0 [0092.763] GetCurrentThreadId () returned 0x98c [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".ldf") returned 0x0 [0092.764] lstrlenW (lpString=".vhd") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".vhd") returned 0x0 [0092.764] lstrlenW (lpString=".vhdx") returned 5 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".vhdx") returned 0x0 [0092.764] lstrlenW (lpString=".pst") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".pst") returned 0x0 [0092.764] lstrlenW (lpString=".ost") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".ost") returned 0x0 [0092.764] lstrlenW (lpString=".bak") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".bak") returned 0x0 [0092.764] lstrlenW (lpString=".bac") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".bac") returned 0x0 [0092.764] lstrlenW (lpString=".sys") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".sys") returned 0x0 [0092.764] lstrlenW (lpString=".v2i") returned 4 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".v2i") returned 0x0 [0092.764] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0092.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.765] lstrlenW (lpString=".sql") returned 4 [0092.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".sql") returned 0x0 [0092.765] lstrlenW (lpString=".mdf") returned 4 [0092.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".mdf") returned 0x0 [0092.765] lstrlenW (lpString=".txt") returned 4 [0092.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".txt") returned 0x0 [0092.766] lstrlenW (lpString=".dbf") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".dbf") returned 0x0 [0092.766] lstrlenW (lpString=".ckp") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".ckp") returned 0x0 [0092.766] lstrlenW (lpString=".dacpac") returned 7 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".dacpac") returned 0x0 [0092.766] lstrlenW (lpString=".db3") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".db3") returned 0x0 [0092.766] lstrlenW (lpString=".dtxs") returned 5 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".dtxs") returned 0x0 [0092.766] lstrlenW (lpString=".mdt") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".mdt") returned 0x0 [0092.766] lstrlenW (lpString=".sdf") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".sdf") returned 0x0 [0092.766] lstrlenW (lpString=".MDF") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".MDF") returned 0x0 [0092.766] lstrlenW (lpString=".DBF") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".DBF") returned 0x0 [0092.766] lstrlenW (lpString=".DB") returned 3 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".DB") returned 0x0 [0092.766] lstrlenW (lpString=".db") returned 3 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".db") returned 0x0 [0092.766] lstrlenW (lpString=".ndf") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".ndf") returned 0x0 [0092.766] lstrlenW (lpString=".NDF") returned 4 [0092.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".NDF") returned 0x0 [0092.767] lstrlenW (lpString=".Mdf") returned 4 [0092.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".Mdf") returned 0x0 [0092.767] lstrlenW (lpString=".dat") returned 4 [0092.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".dat") returned 0x0 [0092.767] lstrlenW (lpString=".DAT") returned 4 [0092.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".DAT") returned 0x0 [0092.767] lstrlenW (lpString=".ldf") returned 4 [0092.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".ldf") returned 0x0 [0092.767] lstrlenW (lpString=".LDF") returned 4 [0092.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch=".LDF") returned 0x0 [0092.767] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.767] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.768] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.768] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.768] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21276974144) returned 1 [0092.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc61adb50, dwHighDateTime=0x1d585b4)) [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7660 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7660 | out: hHeap=0x260000) returned 1 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.769] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.769] GetLastError () returned 0x0 [0092.770] GetLastError () returned 0x0 [0092.770] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.770] GetLastError () returned 0x0 [0092.770] GetLastError () returned 0x0 [0092.772] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff201, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.772] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xdff, lpOverlapped=0x0) returned 1 [0092.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.772] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.772] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.772] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.772] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.772] CloseHandle (hObject=0xd8) returned 1 [0092.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.774] GetLastError () returned 0x0 [0092.774] RtlWakeConditionVariable () returned 0x0 [0092.774] GetCurrentThreadId () returned 0x98c [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".ldf") returned 0x0 [0092.775] lstrlenW (lpString=".vhd") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".vhd") returned 0x0 [0092.775] lstrlenW (lpString=".vhdx") returned 5 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.775] lstrlenW (lpString=".pst") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".pst") returned 0x0 [0092.775] lstrlenW (lpString=".ost") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".ost") returned 0x0 [0092.775] lstrlenW (lpString=".bak") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".bak") returned 0x0 [0092.775] lstrlenW (lpString=".bac") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".bac") returned 0x0 [0092.775] lstrlenW (lpString=".sys") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".sys") returned 0x0 [0092.775] lstrlenW (lpString=".v2i") returned 4 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".v2i") returned 0x0 [0092.775] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.777] lstrlenW (lpString=".sql") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".sql") returned 0x0 [0092.777] lstrlenW (lpString=".mdf") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".mdf") returned 0x0 [0092.777] lstrlenW (lpString=".txt") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".txt") returned 0x0 [0092.777] lstrlenW (lpString=".dbf") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".dbf") returned 0x0 [0092.777] lstrlenW (lpString=".ckp") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".ckp") returned 0x0 [0092.777] lstrlenW (lpString=".dacpac") returned 7 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.777] lstrlenW (lpString=".db3") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".db3") returned 0x0 [0092.777] lstrlenW (lpString=".dtxs") returned 5 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.777] lstrlenW (lpString=".mdt") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".mdt") returned 0x0 [0092.777] lstrlenW (lpString=".sdf") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".sdf") returned 0x0 [0092.777] lstrlenW (lpString=".MDF") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".MDF") returned 0x0 [0092.777] lstrlenW (lpString=".DBF") returned 4 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".DBF") returned 0x0 [0092.777] lstrlenW (lpString=".DB") returned 3 [0092.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".DB") returned 0x0 [0092.778] lstrlenW (lpString=".db") returned 3 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".db") returned 0x0 [0092.778] lstrlenW (lpString=".ndf") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".ndf") returned 0x0 [0092.778] lstrlenW (lpString=".NDF") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".NDF") returned 0x0 [0092.778] lstrlenW (lpString=".Mdf") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.778] lstrlenW (lpString=".dat") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".dat") returned 0x0 [0092.778] lstrlenW (lpString=".DAT") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".DAT") returned 0x0 [0092.778] lstrlenW (lpString=".ldf") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".ldf") returned 0x0 [0092.778] lstrlenW (lpString=".LDF") returned 4 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch=".LDF") returned 0x0 [0092.778] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.778] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.779] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.779] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.779] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21278040517) returned 1 [0092.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc61d3cb0, dwHighDateTime=0x1d585b4)) [0092.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7698 [0092.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7698 | out: hHeap=0x260000) returned 1 [0092.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.780] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.780] GetLastError () returned 0x0 [0092.780] GetLastError () returned 0x0 [0092.780] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.781] GetLastError () returned 0x0 [0092.781] GetLastError () returned 0x0 [0092.782] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffb28e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.783] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4d72, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x4d72, lpOverlapped=0x0) returned 1 [0092.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.783] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.783] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.783] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.783] CloseHandle (hObject=0xd8) returned 1 [0092.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0092.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0092.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.787] GetLastError () returned 0x0 [0092.787] RtlWakeConditionVariable () returned 0x0 [0092.788] GetCurrentThreadId () returned 0x98c [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.788] lstrlenW (lpString=".vhd") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".vhd") returned 0x0 [0092.788] lstrlenW (lpString=".vhdx") returned 5 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".vhdx") returned 0x0 [0092.788] lstrlenW (lpString=".pst") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".pst") returned 0x0 [0092.788] lstrlenW (lpString=".ost") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".ost") returned 0x0 [0092.788] lstrlenW (lpString=".bak") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".bak") returned 0x0 [0092.788] lstrlenW (lpString=".bac") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".bac") returned 0x0 [0092.788] lstrlenW (lpString=".sys") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".sys") returned 0x0 [0092.788] lstrlenW (lpString=".v2i") returned 4 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".v2i") returned 0x0 [0092.788] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.790] lstrlenW (lpString=".sql") returned 4 [0092.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".sql") returned 0x0 [0092.790] lstrlenW (lpString=".mdf") returned 4 [0092.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".mdf") returned 0x0 [0092.790] lstrlenW (lpString=".txt") returned 4 [0092.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".txt") returned 0x0 [0092.790] lstrlenW (lpString=".dbf") returned 4 [0092.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".dbf") returned 0x0 [0092.790] lstrlenW (lpString=".ckp") returned 4 [0092.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".ckp") returned 0x0 [0092.791] lstrlenW (lpString=".dacpac") returned 7 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".dacpac") returned 0x0 [0092.791] lstrlenW (lpString=".db3") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".db3") returned 0x0 [0092.791] lstrlenW (lpString=".dtxs") returned 5 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".dtxs") returned 0x0 [0092.791] lstrlenW (lpString=".mdt") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".mdt") returned 0x0 [0092.791] lstrlenW (lpString=".sdf") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".sdf") returned 0x0 [0092.791] lstrlenW (lpString=".MDF") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".MDF") returned 0x0 [0092.791] lstrlenW (lpString=".DBF") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".DBF") returned 0x0 [0092.791] lstrlenW (lpString=".DB") returned 3 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".DB") returned 0x0 [0092.791] lstrlenW (lpString=".db") returned 3 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".db") returned 0x0 [0092.791] lstrlenW (lpString=".ndf") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".ndf") returned 0x0 [0092.791] lstrlenW (lpString=".NDF") returned 4 [0092.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".NDF") returned 0x0 [0092.792] lstrlenW (lpString=".Mdf") returned 4 [0092.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".Mdf") returned 0x0 [0092.792] lstrlenW (lpString=".dat") returned 4 [0092.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".dat") returned 0x0 [0092.792] lstrlenW (lpString=".DAT") returned 4 [0092.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".DAT") returned 0x0 [0092.792] lstrlenW (lpString=".ldf") returned 4 [0092.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.792] lstrlenW (lpString=".LDF") returned 4 [0092.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch=".LDF") returned 0x0 [0092.792] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.792] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.793] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.793] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.793] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21279427635) returned 1 [0092.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc61f9e10, dwHighDateTime=0x1d585b4)) [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b76d0 [0092.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b76d0 | out: hHeap=0x260000) returned 1 [0092.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.794] GetLastError () returned 0x0 [0092.794] GetLastError () returned 0x0 [0092.794] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.794] GetLastError () returned 0x0 [0092.795] GetLastError () returned 0x0 [0092.906] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff3a7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.906] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc59, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc59, lpOverlapped=0x0) returned 1 [0092.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.907] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.907] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.907] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.907] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.907] CloseHandle (hObject=0xd8) returned 1 [0092.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.909] GetLastError () returned 0x0 [0092.909] RtlWakeConditionVariable () returned 0x0 [0092.909] GetCurrentThreadId () returned 0x98c [0092.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".ldf") returned 0x0 [0092.909] lstrlenW (lpString=".vhd") returned 4 [0092.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".vhd") returned 0x0 [0092.909] lstrlenW (lpString=".vhdx") returned 5 [0092.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".vhdx") returned 0x0 [0092.909] lstrlenW (lpString=".pst") returned 4 [0092.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".pst") returned 0x0 [0092.909] lstrlenW (lpString=".ost") returned 4 [0092.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".ost") returned 0x0 [0092.910] lstrlenW (lpString=".bak") returned 4 [0092.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".bak") returned 0x0 [0092.910] lstrlenW (lpString=".bac") returned 4 [0092.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".bac") returned 0x0 [0092.910] lstrlenW (lpString=".sys") returned 4 [0092.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".sys") returned 0x0 [0092.910] lstrlenW (lpString=".v2i") returned 4 [0092.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".v2i") returned 0x0 [0092.910] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch="s\r\n.v2i") returned 0x0 [0092.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.911] lstrlenW (lpString=".sql") returned 4 [0092.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".sql") returned 0x0 [0092.911] lstrlenW (lpString=".mdf") returned 4 [0092.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".mdf") returned 0x0 [0092.911] lstrlenW (lpString=".txt") returned 4 [0092.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".txt") returned 0x0 [0092.911] lstrlenW (lpString=".dbf") returned 4 [0092.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".dbf") returned 0x0 [0092.911] lstrlenW (lpString=".ckp") returned 4 [0092.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".ckp") returned 0x0 [0092.911] lstrlenW (lpString=".dacpac") returned 7 [0092.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".dacpac") returned 0x0 [0092.912] lstrlenW (lpString=".db3") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".db3") returned 0x0 [0092.912] lstrlenW (lpString=".dtxs") returned 5 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".dtxs") returned 0x0 [0092.912] lstrlenW (lpString=".mdt") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".mdt") returned 0x0 [0092.912] lstrlenW (lpString=".sdf") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".sdf") returned 0x0 [0092.912] lstrlenW (lpString=".MDF") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".MDF") returned 0x0 [0092.912] lstrlenW (lpString=".DBF") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".DBF") returned 0x0 [0092.912] lstrlenW (lpString=".DB") returned 3 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".DB") returned 0x0 [0092.912] lstrlenW (lpString=".db") returned 3 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".db") returned 0x0 [0092.912] lstrlenW (lpString=".ndf") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".ndf") returned 0x0 [0092.912] lstrlenW (lpString=".NDF") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".NDF") returned 0x0 [0092.912] lstrlenW (lpString=".Mdf") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".Mdf") returned 0x0 [0092.912] lstrlenW (lpString=".dat") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".dat") returned 0x0 [0092.912] lstrlenW (lpString=".DAT") returned 4 [0092.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".DAT") returned 0x0 [0092.912] lstrlenW (lpString=".ldf") returned 4 [0092.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".ldf") returned 0x0 [0092.913] lstrlenW (lpString=".LDF") returned 4 [0092.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch=".LDF") returned 0x0 [0092.913] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.913] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.914] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.914] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.914] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21291540934) returned 1 [0092.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc632a910, dwHighDateTime=0x1d585b4)) [0092.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b79a8 [0092.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b79a8 | out: hHeap=0x260000) returned 1 [0092.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b558 [0092.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b558 | out: hHeap=0x260000) returned 1 [0092.915] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.915] GetLastError () returned 0x0 [0092.915] GetLastError () returned 0x0 [0092.915] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.916] GetLastError () returned 0x0 [0092.916] GetLastError () returned 0x0 [0092.917] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff94a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.918] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x6b6, lpOverlapped=0x0) returned 1 [0092.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.918] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.918] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.918] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.918] CloseHandle (hObject=0xd8) returned 1 [0092.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755368 [0092.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755368 | out: hHeap=0x260000) returned 1 [0092.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.920] GetLastError () returned 0x0 [0092.920] RtlWakeConditionVariable () returned 0x0 [0092.920] GetCurrentThreadId () returned 0x98c [0092.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".ldf") returned 0x0 [0092.920] lstrlenW (lpString=".vhd") returned 4 [0092.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".vhd") returned 0x0 [0092.920] lstrlenW (lpString=".vhdx") returned 5 [0092.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".vhdx") returned 0x0 [0092.920] lstrlenW (lpString=".pst") returned 4 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".pst") returned 0x0 [0092.921] lstrlenW (lpString=".ost") returned 4 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".ost") returned 0x0 [0092.921] lstrlenW (lpString=".bak") returned 4 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".bak") returned 0x0 [0092.921] lstrlenW (lpString=".bac") returned 4 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".bac") returned 0x0 [0092.921] lstrlenW (lpString=".sys") returned 4 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".sys") returned 0x0 [0092.921] lstrlenW (lpString=".v2i") returned 4 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".v2i") returned 0x0 [0092.921] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0092.922] lstrlenW (lpString=".sql") returned 4 [0092.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".sql") returned 0x0 [0092.922] lstrlenW (lpString=".mdf") returned 4 [0092.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".mdf") returned 0x0 [0092.922] lstrlenW (lpString=".txt") returned 4 [0092.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".txt") returned 0x0 [0092.922] lstrlenW (lpString=".dbf") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".dbf") returned 0x0 [0092.923] lstrlenW (lpString=".ckp") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".ckp") returned 0x0 [0092.923] lstrlenW (lpString=".dacpac") returned 7 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".dacpac") returned 0x0 [0092.923] lstrlenW (lpString=".db3") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".db3") returned 0x0 [0092.923] lstrlenW (lpString=".dtxs") returned 5 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".dtxs") returned 0x0 [0092.923] lstrlenW (lpString=".mdt") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".mdt") returned 0x0 [0092.923] lstrlenW (lpString=".sdf") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".sdf") returned 0x0 [0092.923] lstrlenW (lpString=".MDF") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".MDF") returned 0x0 [0092.923] lstrlenW (lpString=".DBF") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".DBF") returned 0x0 [0092.923] lstrlenW (lpString=".DB") returned 3 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".DB") returned 0x0 [0092.923] lstrlenW (lpString=".db") returned 3 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".db") returned 0x0 [0092.923] lstrlenW (lpString=".ndf") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".ndf") returned 0x0 [0092.923] lstrlenW (lpString=".NDF") returned 4 [0092.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".NDF") returned 0x0 [0092.923] lstrlenW (lpString=".Mdf") returned 4 [0092.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".Mdf") returned 0x0 [0092.924] lstrlenW (lpString=".dat") returned 4 [0092.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".dat") returned 0x0 [0092.924] lstrlenW (lpString=".DAT") returned 4 [0092.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".DAT") returned 0x0 [0092.924] lstrlenW (lpString=".ldf") returned 4 [0092.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".ldf") returned 0x0 [0092.924] lstrlenW (lpString=".LDF") returned 4 [0092.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch=".LDF") returned 0x0 [0092.924] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.924] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0092.925] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.925] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.925] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21292615933) returned 1 [0092.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6350a70, dwHighDateTime=0x1d585b4)) [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b79e0 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b79e0 | out: hHeap=0x260000) returned 1 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b558 [0092.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0092.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b558 | out: hHeap=0x260000) returned 1 [0092.937] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0092.938] GetLastError () returned 0x0 [0092.938] GetLastError () returned 0x0 [0092.938] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0092.938] GetLastError () returned 0x0 [0092.938] GetLastError () returned 0x0 [0093.102] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.102] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.102] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.102] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.285] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.285] CloseHandle (hObject=0xd8) returned 1 [0093.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0093.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0093.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.293] GetLastError () returned 0x0 [0093.293] RtlWakeConditionVariable () returned 0x0 [0093.293] GetCurrentThreadId () returned 0x98c [0093.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".ldf") returned 0x0 [0093.293] lstrlenW (lpString=".vhd") returned 4 [0093.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".vhd") returned 0x0 [0093.293] lstrlenW (lpString=".vhdx") returned 5 [0093.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".vhdx") returned 0x0 [0093.293] lstrlenW (lpString=".pst") returned 4 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".pst") returned 0x0 [0093.294] lstrlenW (lpString=".ost") returned 4 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".ost") returned 0x0 [0093.294] lstrlenW (lpString=".bak") returned 4 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".bak") returned 0x0 [0093.294] lstrlenW (lpString=".bac") returned 4 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".bac") returned 0x0 [0093.294] lstrlenW (lpString=".sys") returned 4 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".sys") returned 0x0 [0093.294] lstrlenW (lpString=".v2i") returned 4 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".v2i") returned 0x0 [0093.294] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0093.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.296] lstrlenW (lpString=".sql") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".sql") returned 0x0 [0093.296] lstrlenW (lpString=".mdf") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".mdf") returned 0x0 [0093.296] lstrlenW (lpString=".txt") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".txt") returned 0x0 [0093.296] lstrlenW (lpString=".dbf") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".dbf") returned 0x0 [0093.296] lstrlenW (lpString=".ckp") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".ckp") returned 0x0 [0093.296] lstrlenW (lpString=".dacpac") returned 7 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".dacpac") returned 0x0 [0093.296] lstrlenW (lpString=".db3") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".db3") returned 0x0 [0093.296] lstrlenW (lpString=".dtxs") returned 5 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".dtxs") returned 0x0 [0093.296] lstrlenW (lpString=".mdt") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".mdt") returned 0x0 [0093.296] lstrlenW (lpString=".sdf") returned 4 [0093.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".sdf") returned 0x0 [0093.296] lstrlenW (lpString=".MDF") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".MDF") returned 0x0 [0093.297] lstrlenW (lpString=".DBF") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".DBF") returned 0x0 [0093.297] lstrlenW (lpString=".DB") returned 3 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".DB") returned 0x0 [0093.297] lstrlenW (lpString=".db") returned 3 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".db") returned 0x0 [0093.297] lstrlenW (lpString=".ndf") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".ndf") returned 0x0 [0093.297] lstrlenW (lpString=".NDF") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".NDF") returned 0x0 [0093.297] lstrlenW (lpString=".Mdf") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".Mdf") returned 0x0 [0093.297] lstrlenW (lpString=".dat") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".dat") returned 0x0 [0093.297] lstrlenW (lpString=".DAT") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".DAT") returned 0x0 [0093.297] lstrlenW (lpString=".ldf") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".ldf") returned 0x0 [0093.297] lstrlenW (lpString=".LDF") returned 4 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch=".LDF") returned 0x0 [0093.297] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.298] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.298] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.299] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21329968321) returned 1 [0093.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc66bca10, dwHighDateTime=0x1d585b4)) [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7cf0 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7cf0 | out: hHeap=0x260000) returned 1 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b600 [0093.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b600 | out: hHeap=0x260000) returned 1 [0093.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.299] GetLastError () returned 0x0 [0093.300] GetLastError () returned 0x0 [0093.300] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.300] GetLastError () returned 0x0 [0093.300] GetLastError () returned 0x0 [0093.303] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff94a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.303] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x6b6, lpOverlapped=0x0) returned 1 [0093.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.303] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.303] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.303] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.303] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.303] CloseHandle (hObject=0xd8) returned 1 [0093.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0093.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0093.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.305] GetLastError () returned 0x0 [0093.305] RtlWakeConditionVariable () returned 0x0 [0093.306] GetCurrentThreadId () returned 0x98c [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".ldf") returned 0x0 [0093.306] lstrlenW (lpString=".vhd") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".vhd") returned 0x0 [0093.306] lstrlenW (lpString=".vhdx") returned 5 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".vhdx") returned 0x0 [0093.306] lstrlenW (lpString=".pst") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".pst") returned 0x0 [0093.306] lstrlenW (lpString=".ost") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".ost") returned 0x0 [0093.306] lstrlenW (lpString=".bak") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".bak") returned 0x0 [0093.306] lstrlenW (lpString=".bac") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".bac") returned 0x0 [0093.306] lstrlenW (lpString=".sys") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".sys") returned 0x0 [0093.306] lstrlenW (lpString=".v2i") returned 4 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".v2i") returned 0x0 [0093.306] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.308] lstrlenW (lpString=".sql") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".sql") returned 0x0 [0093.308] lstrlenW (lpString=".mdf") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".mdf") returned 0x0 [0093.308] lstrlenW (lpString=".txt") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".txt") returned 0x0 [0093.308] lstrlenW (lpString=".dbf") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".dbf") returned 0x0 [0093.308] lstrlenW (lpString=".ckp") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".ckp") returned 0x0 [0093.308] lstrlenW (lpString=".dacpac") returned 7 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".dacpac") returned 0x0 [0093.308] lstrlenW (lpString=".db3") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".db3") returned 0x0 [0093.308] lstrlenW (lpString=".dtxs") returned 5 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".dtxs") returned 0x0 [0093.308] lstrlenW (lpString=".mdt") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".mdt") returned 0x0 [0093.308] lstrlenW (lpString=".sdf") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".sdf") returned 0x0 [0093.308] lstrlenW (lpString=".MDF") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".MDF") returned 0x0 [0093.308] lstrlenW (lpString=".DBF") returned 4 [0093.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".DBF") returned 0x0 [0093.309] lstrlenW (lpString=".DB") returned 3 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".DB") returned 0x0 [0093.309] lstrlenW (lpString=".db") returned 3 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".db") returned 0x0 [0093.309] lstrlenW (lpString=".ndf") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".ndf") returned 0x0 [0093.309] lstrlenW (lpString=".NDF") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".NDF") returned 0x0 [0093.309] lstrlenW (lpString=".Mdf") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".Mdf") returned 0x0 [0093.309] lstrlenW (lpString=".dat") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".dat") returned 0x0 [0093.309] lstrlenW (lpString=".DAT") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".DAT") returned 0x0 [0093.309] lstrlenW (lpString=".ldf") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".ldf") returned 0x0 [0093.309] lstrlenW (lpString=".LDF") returned 4 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch=".LDF") returned 0x0 [0093.309] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.309] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.310] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.310] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21331152032) returned 1 [0093.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc66e2b70, dwHighDateTime=0x1d585b4)) [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7d28 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7d28 | out: hHeap=0x260000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bd38 [0093.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bd38 | out: hHeap=0x260000) returned 1 [0093.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.311] GetLastError () returned 0x0 [0093.311] GetLastError () returned 0x0 [0093.312] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.312] GetLastError () returned 0x0 [0093.312] GetLastError () returned 0x0 [0093.313] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.313] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x13e, lpOverlapped=0x0) returned 1 [0093.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.313] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.313] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.313] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.313] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.314] CloseHandle (hObject=0xd8) returned 1 [0093.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0093.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0093.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.315] GetLastError () returned 0x0 [0093.315] RtlWakeConditionVariable () returned 0x27e828 [0093.315] GetCurrentThreadId () returned 0x98c [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".ldf") returned 0x0 [0093.316] lstrlenW (lpString=".vhd") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".vhd") returned 0x0 [0093.316] lstrlenW (lpString=".vhdx") returned 5 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".vhdx") returned 0x0 [0093.316] lstrlenW (lpString=".pst") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".pst") returned 0x0 [0093.316] lstrlenW (lpString=".ost") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".ost") returned 0x0 [0093.316] lstrlenW (lpString=".bak") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".bak") returned 0x0 [0093.316] lstrlenW (lpString=".bac") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".bac") returned 0x0 [0093.316] lstrlenW (lpString=".sys") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".sys") returned 0x0 [0093.316] lstrlenW (lpString=".v2i") returned 4 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".v2i") returned 0x0 [0093.316] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.317] lstrlenW (lpString=".sql") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".sql") returned 0x0 [0093.318] lstrlenW (lpString=".mdf") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".mdf") returned 0x0 [0093.318] lstrlenW (lpString=".txt") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".txt") returned 0x0 [0093.318] lstrlenW (lpString=".dbf") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".dbf") returned 0x0 [0093.318] lstrlenW (lpString=".ckp") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".ckp") returned 0x0 [0093.318] lstrlenW (lpString=".dacpac") returned 7 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".dacpac") returned 0x0 [0093.318] lstrlenW (lpString=".db3") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".db3") returned 0x0 [0093.318] lstrlenW (lpString=".dtxs") returned 5 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".dtxs") returned 0x0 [0093.318] lstrlenW (lpString=".mdt") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".mdt") returned 0x0 [0093.318] lstrlenW (lpString=".sdf") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".sdf") returned 0x0 [0093.318] lstrlenW (lpString=".MDF") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".MDF") returned 0x0 [0093.318] lstrlenW (lpString=".DBF") returned 4 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".DBF") returned 0x0 [0093.318] lstrlenW (lpString=".DB") returned 3 [0093.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".DB") returned 0x0 [0093.319] lstrlenW (lpString=".db") returned 3 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".db") returned 0x0 [0093.319] lstrlenW (lpString=".ndf") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".ndf") returned 0x0 [0093.319] lstrlenW (lpString=".NDF") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".NDF") returned 0x0 [0093.319] lstrlenW (lpString=".Mdf") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".Mdf") returned 0x0 [0093.319] lstrlenW (lpString=".dat") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".dat") returned 0x0 [0093.319] lstrlenW (lpString=".DAT") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".DAT") returned 0x0 [0093.319] lstrlenW (lpString=".ldf") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".ldf") returned 0x0 [0093.319] lstrlenW (lpString=".LDF") returned 4 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch=".LDF") returned 0x0 [0093.319] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.320] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.320] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.320] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.321] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21332164214) returned 1 [0093.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6708cd0, dwHighDateTime=0x1d585b4)) [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7d60 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7d60 | out: hHeap=0x260000) returned 1 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b948 [0093.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b948 | out: hHeap=0x260000) returned 1 [0093.321] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.321] GetLastError () returned 0x0 [0093.322] GetLastError () returned 0x0 [0093.322] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.322] GetLastError () returned 0x0 [0093.322] GetLastError () returned 0x0 [0093.390] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff94a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.402] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6b6, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x6b6, lpOverlapped=0x0) returned 1 [0093.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.412] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.412] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.412] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.412] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.413] CloseHandle (hObject=0xd8) returned 1 [0093.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0093.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0093.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.414] GetLastError () returned 0x0 [0093.414] RtlWakeConditionVariable () returned 0x0 [0093.415] GetCurrentThreadId () returned 0x98c [0093.415] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.415] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.415] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.415] WriteFile (in: hFile=0xd8, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.417] CloseHandle (hObject=0xd8) returned 1 [0093.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0093.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0093.417] RtlWakeConditionVariable () returned 0x0 [0093.417] GetCurrentThreadId () returned 0x98c [0093.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".ldf") returned 0x0 [0093.417] lstrlenW (lpString=".vhd") returned 4 [0093.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".vhd") returned 0x0 [0093.417] lstrlenW (lpString=".vhdx") returned 5 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".vhdx") returned 0x0 [0093.418] lstrlenW (lpString=".pst") returned 4 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".pst") returned 0x0 [0093.418] lstrlenW (lpString=".ost") returned 4 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".ost") returned 0x0 [0093.418] lstrlenW (lpString=".bak") returned 4 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".bak") returned 0x0 [0093.418] lstrlenW (lpString=".bac") returned 4 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".bac") returned 0x0 [0093.418] lstrlenW (lpString=".sys") returned 4 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".sys") returned 0x0 [0093.418] lstrlenW (lpString=".v2i") returned 4 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".v2i") returned 0x0 [0093.418] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch="s\r\n.v2i") returned 0x0 [0093.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.474] lstrlenW (lpString=".sql") returned 4 [0093.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".sql") returned 0x0 [0093.474] lstrlenW (lpString=".mdf") returned 4 [0093.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".mdf") returned 0x0 [0093.474] lstrlenW (lpString=".txt") returned 4 [0093.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".txt") returned 0x0 [0093.474] lstrlenW (lpString=".dbf") returned 4 [0093.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".dbf") returned 0x0 [0093.475] lstrlenW (lpString=".ckp") returned 4 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".ckp") returned 0x0 [0093.475] lstrlenW (lpString=".dacpac") returned 7 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".dacpac") returned 0x0 [0093.475] lstrlenW (lpString=".db3") returned 4 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".db3") returned 0x0 [0093.475] lstrlenW (lpString=".dtxs") returned 5 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".dtxs") returned 0x0 [0093.475] lstrlenW (lpString=".mdt") returned 4 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".mdt") returned 0x0 [0093.475] lstrlenW (lpString=".sdf") returned 4 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".sdf") returned 0x0 [0093.475] lstrlenW (lpString=".MDF") returned 4 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".MDF") returned 0x0 [0093.475] lstrlenW (lpString=".DBF") returned 4 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".DBF") returned 0x0 [0093.475] lstrlenW (lpString=".DB") returned 3 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".DB") returned 0x0 [0093.475] lstrlenW (lpString=".db") returned 3 [0093.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".db") returned 0x0 [0093.476] lstrlenW (lpString=".ndf") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".ndf") returned 0x0 [0093.476] lstrlenW (lpString=".NDF") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".NDF") returned 0x0 [0093.476] lstrlenW (lpString=".Mdf") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".Mdf") returned 0x0 [0093.476] lstrlenW (lpString=".dat") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".dat") returned 0x0 [0093.476] lstrlenW (lpString=".DAT") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".DAT") returned 0x0 [0093.476] lstrlenW (lpString=".ldf") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".ldf") returned 0x0 [0093.476] lstrlenW (lpString=".LDF") returned 4 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch=".LDF") returned 0x0 [0093.476] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.476] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.477] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.477] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21347823352) returned 1 [0093.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6885a90, dwHighDateTime=0x1d585b4)) [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8118 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8118 | out: hHeap=0x260000) returned 1 [0093.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b8a0 [0093.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b8a0 | out: hHeap=0x260000) returned 1 [0093.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.478] GetLastError () returned 0x0 [0093.478] GetLastError () returned 0x0 [0093.478] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.478] GetLastError () returned 0x0 [0093.478] GetLastError () returned 0x0 [0093.494] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffb79, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.494] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x487, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x487, lpOverlapped=0x0) returned 1 [0093.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.495] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.495] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.495] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.495] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.495] CloseHandle (hObject=0xe4) returned 1 [0093.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0093.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd.[deadmin@cock.li].deadmin")) returned 1 [0093.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0093.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.498] GetLastError () returned 0x0 [0093.498] RtlWakeConditionVariable () returned 0x0 [0093.498] GetCurrentThreadId () returned 0x98c [0093.499] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.499] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.499] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.499] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.501] CloseHandle (hObject=0xe4) returned 1 [0093.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342d88 | out: hHeap=0x260000) returned 1 [0093.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0093.501] RtlWakeConditionVariable () returned 0x27e828 [0093.501] GetCurrentThreadId () returned 0x98c [0093.502] lstrcpyW (in: lpString1=0x224edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.502] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.502] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.502] WriteFile (in: hFile=0xe4, lpBuffer=0x224edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x224edb8, lpOverlapped=0x0 | out: lpBuffer=0x224edbc*, lpNumberOfBytesWritten=0x224edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.504] CloseHandle (hObject=0xe4) returned 1 [0093.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d43c0 | out: hHeap=0x260000) returned 1 [0093.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.504] RtlWakeConditionVariable () returned 0x27e828 [0093.504] GetCurrentThreadId () returned 0x98c [0093.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".ldf") returned 0x0 [0093.504] lstrlenW (lpString=".vhd") returned 4 [0093.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".vhd") returned 0x0 [0093.504] lstrlenW (lpString=".vhdx") returned 5 [0093.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".vhdx") returned 0x0 [0093.504] lstrlenW (lpString=".pst") returned 4 [0093.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".pst") returned 0x0 [0093.504] lstrlenW (lpString=".ost") returned 4 [0093.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".ost") returned 0x0 [0093.504] lstrlenW (lpString=".bak") returned 4 [0093.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".bak") returned 0x0 [0093.504] lstrlenW (lpString=".bac") returned 4 [0093.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".bac") returned 0x0 [0093.505] lstrlenW (lpString=".sys") returned 4 [0093.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".sys") returned 0x0 [0093.505] lstrlenW (lpString=".v2i") returned 4 [0093.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".v2i") returned 0x0 [0093.505] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0093.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.506] lstrlenW (lpString=".sql") returned 4 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".sql") returned 0x0 [0093.506] lstrlenW (lpString=".mdf") returned 4 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".mdf") returned 0x0 [0093.506] lstrlenW (lpString=".txt") returned 4 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".txt") returned 0x0 [0093.506] lstrlenW (lpString=".dbf") returned 4 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".dbf") returned 0x0 [0093.506] lstrlenW (lpString=".ckp") returned 4 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".ckp") returned 0x0 [0093.506] lstrlenW (lpString=".dacpac") returned 7 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".dacpac") returned 0x0 [0093.506] lstrlenW (lpString=".db3") returned 4 [0093.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".db3") returned 0x0 [0093.506] lstrlenW (lpString=".dtxs") returned 5 [0093.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".dtxs") returned 0x0 [0093.574] lstrlenW (lpString=".mdt") returned 4 [0093.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".mdt") returned 0x0 [0093.574] lstrlenW (lpString=".sdf") returned 4 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".sdf") returned 0x0 [0093.575] lstrlenW (lpString=".MDF") returned 4 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".MDF") returned 0x0 [0093.575] lstrlenW (lpString=".DBF") returned 4 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".DBF") returned 0x0 [0093.575] lstrlenW (lpString=".DB") returned 3 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".DB") returned 0x0 [0093.575] lstrlenW (lpString=".db") returned 3 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".db") returned 0x0 [0093.575] lstrlenW (lpString=".ndf") returned 4 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".ndf") returned 0x0 [0093.575] lstrlenW (lpString=".NDF") returned 4 [0093.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".NDF") returned 0x0 [0093.578] lstrlenW (lpString=".Mdf") returned 4 [0093.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".Mdf") returned 0x0 [0093.578] lstrlenW (lpString=".dat") returned 4 [0093.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".dat") returned 0x0 [0093.579] lstrlenW (lpString=".DAT") returned 4 [0093.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".DAT") returned 0x0 [0093.579] lstrlenW (lpString=".ldf") returned 4 [0093.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".ldf") returned 0x0 [0093.579] lstrlenW (lpString=".LDF") returned 4 [0093.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch=".LDF") returned 0x0 [0093.579] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.579] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e738) returned 1 [0093.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.580] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0093.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.580] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21358129339) returned 1 [0093.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc696a2d0, dwHighDateTime=0x1d585b4)) [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df168 [0093.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df168 | out: hHeap=0x260000) returned 1 [0093.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.581] GetLastError () returned 0x0 [0093.581] GetLastError () returned 0x0 [0093.581] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.581] GetLastError () returned 0x0 [0093.602] GetLastError () returned 0x0 [0093.606] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.606] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.608] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.608] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.610] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.610] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.610] CloseHandle (hObject=0xe4) returned 1 [0093.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.[deadmin@cock.li].deadmin")) returned 1 [0093.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.612] GetLastError () returned 0x0 [0093.612] RtlWakeConditionVariable () returned 0x0 [0093.612] GetCurrentThreadId () returned 0x98c [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".ldf") returned 0x0 [0093.612] lstrlenW (lpString=".vhd") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".vhd") returned 0x0 [0093.612] lstrlenW (lpString=".vhdx") returned 5 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".vhdx") returned 0x0 [0093.612] lstrlenW (lpString=".pst") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".pst") returned 0x0 [0093.612] lstrlenW (lpString=".ost") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".ost") returned 0x0 [0093.612] lstrlenW (lpString=".bak") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".bak") returned 0x0 [0093.612] lstrlenW (lpString=".bac") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".bac") returned 0x0 [0093.612] lstrlenW (lpString=".sys") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".sys") returned 0x0 [0093.612] lstrlenW (lpString=".v2i") returned 4 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".v2i") returned 0x0 [0093.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.616] lstrlenW (lpString=".sql") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".sql") returned 0x0 [0093.616] lstrlenW (lpString=".mdf") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".mdf") returned 0x0 [0093.616] lstrlenW (lpString=".txt") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".txt") returned 0x0 [0093.616] lstrlenW (lpString=".dbf") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".dbf") returned 0x0 [0093.616] lstrlenW (lpString=".ckp") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".ckp") returned 0x0 [0093.616] lstrlenW (lpString=".dacpac") returned 7 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".dacpac") returned 0x0 [0093.616] lstrlenW (lpString=".db3") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".db3") returned 0x0 [0093.616] lstrlenW (lpString=".dtxs") returned 5 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".dtxs") returned 0x0 [0093.616] lstrlenW (lpString=".mdt") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".mdt") returned 0x0 [0093.616] lstrlenW (lpString=".sdf") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".sdf") returned 0x0 [0093.616] lstrlenW (lpString=".MDF") returned 4 [0093.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".MDF") returned 0x0 [0093.617] lstrlenW (lpString=".DBF") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".DBF") returned 0x0 [0093.617] lstrlenW (lpString=".DB") returned 3 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".DB") returned 0x0 [0093.617] lstrlenW (lpString=".db") returned 3 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".db") returned 0x0 [0093.617] lstrlenW (lpString=".ndf") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".ndf") returned 0x0 [0093.617] lstrlenW (lpString=".NDF") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".NDF") returned 0x0 [0093.617] lstrlenW (lpString=".Mdf") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".Mdf") returned 0x0 [0093.617] lstrlenW (lpString=".dat") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".dat") returned 0x0 [0093.617] lstrlenW (lpString=".DAT") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".DAT") returned 0x0 [0093.617] lstrlenW (lpString=".ldf") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".ldf") returned 0x0 [0093.617] lstrlenW (lpString=".LDF") returned 4 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch=".LDF") returned 0x0 [0093.617] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.617] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e5a0) returned 1 [0093.618] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.618] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0093.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.618] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21361955376) returned 1 [0093.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc69dc6f0, dwHighDateTime=0x1d585b4)) [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df210 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df210 | out: hHeap=0x260000) returned 1 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.619] GetLastError () returned 0x0 [0093.620] GetLastError () returned 0x0 [0093.620] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.620] GetLastError () returned 0x0 [0093.620] GetLastError () returned 0x0 [0093.639] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.639] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.640] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.640] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.640] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.640] CloseHandle (hObject=0xe4) returned 1 [0093.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.642] GetLastError () returned 0x0 [0093.643] RtlWakeConditionVariable () returned 0x0 [0093.643] GetCurrentThreadId () returned 0x98c [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".ldf") returned 0x0 [0093.643] lstrlenW (lpString=".vhd") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".vhd") returned 0x0 [0093.643] lstrlenW (lpString=".vhdx") returned 5 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".vhdx") returned 0x0 [0093.643] lstrlenW (lpString=".pst") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".pst") returned 0x0 [0093.643] lstrlenW (lpString=".ost") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".ost") returned 0x0 [0093.643] lstrlenW (lpString=".bak") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".bak") returned 0x0 [0093.643] lstrlenW (lpString=".bac") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".bac") returned 0x0 [0093.643] lstrlenW (lpString=".sys") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".sys") returned 0x0 [0093.643] lstrlenW (lpString=".v2i") returned 4 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".v2i") returned 0x0 [0093.643] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.645] lstrlenW (lpString=".sql") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".sql") returned 0x0 [0093.645] lstrlenW (lpString=".mdf") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".mdf") returned 0x0 [0093.645] lstrlenW (lpString=".txt") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".txt") returned 0x0 [0093.645] lstrlenW (lpString=".dbf") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".dbf") returned 0x0 [0093.645] lstrlenW (lpString=".ckp") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".ckp") returned 0x0 [0093.645] lstrlenW (lpString=".dacpac") returned 7 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".dacpac") returned 0x0 [0093.645] lstrlenW (lpString=".db3") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".db3") returned 0x0 [0093.645] lstrlenW (lpString=".dtxs") returned 5 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".dtxs") returned 0x0 [0093.645] lstrlenW (lpString=".mdt") returned 4 [0093.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".mdt") returned 0x0 [0093.646] lstrlenW (lpString=".sdf") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".sdf") returned 0x0 [0093.646] lstrlenW (lpString=".MDF") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".MDF") returned 0x0 [0093.646] lstrlenW (lpString=".DBF") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".DBF") returned 0x0 [0093.646] lstrlenW (lpString=".DB") returned 3 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".DB") returned 0x0 [0093.646] lstrlenW (lpString=".db") returned 3 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".db") returned 0x0 [0093.646] lstrlenW (lpString=".ndf") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".ndf") returned 0x0 [0093.646] lstrlenW (lpString=".NDF") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".NDF") returned 0x0 [0093.646] lstrlenW (lpString=".Mdf") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".Mdf") returned 0x0 [0093.646] lstrlenW (lpString=".dat") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".dat") returned 0x0 [0093.646] lstrlenW (lpString=".DAT") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".DAT") returned 0x0 [0093.646] lstrlenW (lpString=".ldf") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".ldf") returned 0x0 [0093.646] lstrlenW (lpString=".LDF") returned 4 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch=".LDF") returned 0x0 [0093.646] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.647] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e958) returned 1 [0093.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.647] CryptReleaseContext (hProv=0x33e958, dwFlags=0x0) returned 1 [0093.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.648] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21364871489) returned 1 [0093.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6a289b0, dwHighDateTime=0x1d585b4)) [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df248 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df248 | out: hHeap=0x260000) returned 1 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.648] GetLastError () returned 0x0 [0093.649] GetLastError () returned 0x0 [0093.649] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.649] GetLastError () returned 0x0 [0093.649] GetLastError () returned 0x0 [0093.658] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.658] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.667] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.667] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.667] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.667] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.667] CloseHandle (hObject=0xe4) returned 1 [0093.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4250 [0093.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4250 | out: hHeap=0x260000) returned 1 [0093.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.677] GetLastError () returned 0x0 [0093.677] RtlWakeConditionVariable () returned 0x0 [0093.677] GetCurrentThreadId () returned 0x98c [0093.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".ldf") returned 0x0 [0093.677] lstrlenW (lpString=".vhd") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".vhd") returned 0x0 [0093.678] lstrlenW (lpString=".vhdx") returned 5 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".vhdx") returned 0x0 [0093.678] lstrlenW (lpString=".pst") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".pst") returned 0x0 [0093.678] lstrlenW (lpString=".ost") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".ost") returned 0x0 [0093.678] lstrlenW (lpString=".bak") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".bak") returned 0x0 [0093.678] lstrlenW (lpString=".bac") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".bac") returned 0x0 [0093.678] lstrlenW (lpString=".sys") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".sys") returned 0x0 [0093.678] lstrlenW (lpString=".v2i") returned 4 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".v2i") returned 0x0 [0093.678] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0093.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.688] lstrlenW (lpString=".sql") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".sql") returned 0x0 [0093.695] lstrlenW (lpString=".mdf") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".mdf") returned 0x0 [0093.695] lstrlenW (lpString=".txt") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".txt") returned 0x0 [0093.695] lstrlenW (lpString=".dbf") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".dbf") returned 0x0 [0093.695] lstrlenW (lpString=".ckp") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".ckp") returned 0x0 [0093.695] lstrlenW (lpString=".dacpac") returned 7 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".dacpac") returned 0x0 [0093.695] lstrlenW (lpString=".db3") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".db3") returned 0x0 [0093.695] lstrlenW (lpString=".dtxs") returned 5 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".dtxs") returned 0x0 [0093.695] lstrlenW (lpString=".mdt") returned 4 [0093.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".mdt") returned 0x0 [0093.695] lstrlenW (lpString=".sdf") returned 4 [0093.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".sdf") returned 0x0 [0093.698] lstrlenW (lpString=".MDF") returned 4 [0093.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".MDF") returned 0x0 [0093.698] lstrlenW (lpString=".DBF") returned 4 [0093.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".DBF") returned 0x0 [0093.702] lstrlenW (lpString=".DB") returned 3 [0093.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".DB") returned 0x0 [0093.702] lstrlenW (lpString=".db") returned 3 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".db") returned 0x0 [0093.703] lstrlenW (lpString=".ndf") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".ndf") returned 0x0 [0093.703] lstrlenW (lpString=".NDF") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".NDF") returned 0x0 [0093.703] lstrlenW (lpString=".Mdf") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".Mdf") returned 0x0 [0093.703] lstrlenW (lpString=".dat") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".dat") returned 0x0 [0093.703] lstrlenW (lpString=".DAT") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".DAT") returned 0x0 [0093.703] lstrlenW (lpString=".ldf") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".ldf") returned 0x0 [0093.703] lstrlenW (lpString=".LDF") returned 4 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch=".LDF") returned 0x0 [0093.703] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.703] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e958) returned 1 [0093.704] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.704] CryptReleaseContext (hProv=0x33e958, dwFlags=0x0) returned 1 [0093.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.704] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21370537558) returned 1 [0093.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6a9add0, dwHighDateTime=0x1d585b4)) [0093.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df328 [0093.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df328 | out: hHeap=0x260000) returned 1 [0093.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.705] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.705] GetLastError () returned 0x0 [0093.705] GetLastError () returned 0x0 [0093.705] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.705] GetLastError () returned 0x0 [0093.706] GetLastError () returned 0x0 [0093.720] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.720] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.722] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.722] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.723] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.723] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.723] CloseHandle (hObject=0xd8) returned 1 [0093.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.724] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.[deadmin@cock.li].deadmin")) returned 1 [0093.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.726] GetLastError () returned 0x0 [0093.726] RtlWakeConditionVariable () returned 0x0 [0093.726] GetCurrentThreadId () returned 0x98c [0093.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.726] lstrlenW (lpString=".vhd") returned 4 [0093.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".vhd") returned 0x0 [0093.726] lstrlenW (lpString=".vhdx") returned 5 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".vhdx") returned 0x0 [0093.727] lstrlenW (lpString=".pst") returned 4 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".pst") returned 0x0 [0093.727] lstrlenW (lpString=".ost") returned 4 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".ost") returned 0x0 [0093.727] lstrlenW (lpString=".bak") returned 4 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".bak") returned 0x0 [0093.727] lstrlenW (lpString=".bac") returned 4 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".bac") returned 0x0 [0093.727] lstrlenW (lpString=".sys") returned 4 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".sys") returned 0x0 [0093.727] lstrlenW (lpString=".v2i") returned 4 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".v2i") returned 0x0 [0093.727] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch="s\r\n.v2i") returned 0x0 [0093.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.729] lstrlenW (lpString=".sql") returned 4 [0093.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".sql") returned 0x0 [0093.729] lstrlenW (lpString=".mdf") returned 4 [0093.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".mdf") returned 0x0 [0093.729] lstrlenW (lpString=".txt") returned 4 [0093.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".txt") returned 0x0 [0093.729] lstrlenW (lpString=".dbf") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".dbf") returned 0x0 [0093.730] lstrlenW (lpString=".ckp") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".ckp") returned 0x0 [0093.730] lstrlenW (lpString=".dacpac") returned 7 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".dacpac") returned 0x0 [0093.730] lstrlenW (lpString=".db3") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".db3") returned 0x0 [0093.730] lstrlenW (lpString=".dtxs") returned 5 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".dtxs") returned 0x0 [0093.730] lstrlenW (lpString=".mdt") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".mdt") returned 0x0 [0093.730] lstrlenW (lpString=".sdf") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".sdf") returned 0x0 [0093.730] lstrlenW (lpString=".MDF") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".MDF") returned 0x0 [0093.730] lstrlenW (lpString=".DBF") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".DBF") returned 0x0 [0093.730] lstrlenW (lpString=".DB") returned 3 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".DB") returned 0x0 [0093.730] lstrlenW (lpString=".db") returned 3 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".db") returned 0x0 [0093.730] lstrlenW (lpString=".ndf") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".ndf") returned 0x0 [0093.730] lstrlenW (lpString=".NDF") returned 4 [0093.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".NDF") returned 0x0 [0093.730] lstrlenW (lpString=".Mdf") returned 4 [0093.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".Mdf") returned 0x0 [0093.731] lstrlenW (lpString=".dat") returned 4 [0093.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".dat") returned 0x0 [0093.731] lstrlenW (lpString=".DAT") returned 4 [0093.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".DAT") returned 0x0 [0093.731] lstrlenW (lpString=".ldf") returned 4 [0093.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.731] lstrlenW (lpString=".LDF") returned 4 [0093.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch=".LDF") returned 0x0 [0093.731] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.731] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.732] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.732] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.732] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21373318339) returned 1 [0093.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6ae7090, dwHighDateTime=0x1d585b4)) [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df398 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df398 | out: hHeap=0x260000) returned 1 [0093.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.733] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.733] GetLastError () returned 0x0 [0093.733] GetLastError () returned 0x0 [0093.733] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.733] GetLastError () returned 0x0 [0093.733] GetLastError () returned 0x0 [0093.736] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff4890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.736] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb770, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xb770, lpOverlapped=0x0) returned 1 [0093.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.736] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.736] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.736] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.736] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.736] CloseHandle (hObject=0xd8) returned 1 [0093.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c550 [0093.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c550 | out: hHeap=0x260000) returned 1 [0093.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.738] GetLastError () returned 0x0 [0093.738] RtlWakeConditionVariable () returned 0x0 [0093.738] GetCurrentThreadId () returned 0x98c [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.739] lstrlenW (lpString=".vhd") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".vhd") returned 0x0 [0093.739] lstrlenW (lpString=".vhdx") returned 5 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".vhdx") returned 0x0 [0093.739] lstrlenW (lpString=".pst") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".pst") returned 0x0 [0093.739] lstrlenW (lpString=".ost") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".ost") returned 0x0 [0093.739] lstrlenW (lpString=".bak") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".bak") returned 0x0 [0093.739] lstrlenW (lpString=".bac") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".bac") returned 0x0 [0093.739] lstrlenW (lpString=".sys") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".sys") returned 0x0 [0093.739] lstrlenW (lpString=".v2i") returned 4 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".v2i") returned 0x0 [0093.739] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.741] lstrlenW (lpString=".sql") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".sql") returned 0x0 [0093.741] lstrlenW (lpString=".mdf") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".mdf") returned 0x0 [0093.741] lstrlenW (lpString=".txt") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".txt") returned 0x0 [0093.741] lstrlenW (lpString=".dbf") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".dbf") returned 0x0 [0093.741] lstrlenW (lpString=".ckp") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".ckp") returned 0x0 [0093.741] lstrlenW (lpString=".dacpac") returned 7 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".dacpac") returned 0x0 [0093.741] lstrlenW (lpString=".db3") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".db3") returned 0x0 [0093.741] lstrlenW (lpString=".dtxs") returned 5 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".dtxs") returned 0x0 [0093.741] lstrlenW (lpString=".mdt") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".mdt") returned 0x0 [0093.741] lstrlenW (lpString=".sdf") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".sdf") returned 0x0 [0093.741] lstrlenW (lpString=".MDF") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".MDF") returned 0x0 [0093.741] lstrlenW (lpString=".DBF") returned 4 [0093.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".DBF") returned 0x0 [0093.742] lstrlenW (lpString=".DB") returned 3 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".DB") returned 0x0 [0093.742] lstrlenW (lpString=".db") returned 3 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".db") returned 0x0 [0093.742] lstrlenW (lpString=".ndf") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".ndf") returned 0x0 [0093.742] lstrlenW (lpString=".NDF") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".NDF") returned 0x0 [0093.742] lstrlenW (lpString=".Mdf") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".Mdf") returned 0x0 [0093.742] lstrlenW (lpString=".dat") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".dat") returned 0x0 [0093.742] lstrlenW (lpString=".DAT") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".DAT") returned 0x0 [0093.742] lstrlenW (lpString=".ldf") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.742] lstrlenW (lpString=".LDF") returned 4 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch=".LDF") returned 0x0 [0093.742] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.745] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.746] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.746] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21374705457) returned 1 [0093.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6b0d1f0, dwHighDateTime=0x1d585b4)) [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df3d0 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df3d0 | out: hHeap=0x260000) returned 1 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.747] GetLastError () returned 0x0 [0093.747] GetLastError () returned 0x0 [0093.747] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.747] GetLastError () returned 0x0 [0093.747] GetLastError () returned 0x0 [0093.866] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.866] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.866] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.866] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.866] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.866] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.867] CloseHandle (hObject=0xd8) returned 1 [0093.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0093.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0093.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.869] GetLastError () returned 0x0 [0093.869] RtlWakeConditionVariable () returned 0x0 [0093.869] GetCurrentThreadId () returned 0x98c [0093.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".ldf") returned 0x0 [0093.869] lstrlenW (lpString=".vhd") returned 4 [0093.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".vhd") returned 0x0 [0093.869] lstrlenW (lpString=".vhdx") returned 5 [0093.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".vhdx") returned 0x0 [0093.869] lstrlenW (lpString=".pst") returned 4 [0093.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".pst") returned 0x0 [0093.869] lstrlenW (lpString=".ost") returned 4 [0093.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".ost") returned 0x0 [0093.869] lstrlenW (lpString=".bak") returned 4 [0093.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".bak") returned 0x0 [0093.870] lstrlenW (lpString=".bac") returned 4 [0093.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".bac") returned 0x0 [0093.870] lstrlenW (lpString=".sys") returned 4 [0093.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".sys") returned 0x0 [0093.870] lstrlenW (lpString=".v2i") returned 4 [0093.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".v2i") returned 0x0 [0093.870] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.871] lstrlenW (lpString=".sql") returned 4 [0093.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".sql") returned 0x0 [0093.871] lstrlenW (lpString=".mdf") returned 4 [0093.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".mdf") returned 0x0 [0093.872] lstrlenW (lpString=".txt") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".txt") returned 0x0 [0093.872] lstrlenW (lpString=".dbf") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".dbf") returned 0x0 [0093.872] lstrlenW (lpString=".ckp") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".ckp") returned 0x0 [0093.872] lstrlenW (lpString=".dacpac") returned 7 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".dacpac") returned 0x0 [0093.872] lstrlenW (lpString=".db3") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".db3") returned 0x0 [0093.872] lstrlenW (lpString=".dtxs") returned 5 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".dtxs") returned 0x0 [0093.872] lstrlenW (lpString=".mdt") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".mdt") returned 0x0 [0093.872] lstrlenW (lpString=".sdf") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".sdf") returned 0x0 [0093.872] lstrlenW (lpString=".MDF") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".MDF") returned 0x0 [0093.872] lstrlenW (lpString=".DBF") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".DBF") returned 0x0 [0093.872] lstrlenW (lpString=".DB") returned 3 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".DB") returned 0x0 [0093.872] lstrlenW (lpString=".db") returned 3 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".db") returned 0x0 [0093.872] lstrlenW (lpString=".ndf") returned 4 [0093.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".ndf") returned 0x0 [0093.873] lstrlenW (lpString=".NDF") returned 4 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".NDF") returned 0x0 [0093.873] lstrlenW (lpString=".Mdf") returned 4 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".Mdf") returned 0x0 [0093.873] lstrlenW (lpString=".dat") returned 4 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".dat") returned 0x0 [0093.873] lstrlenW (lpString=".DAT") returned 4 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".DAT") returned 0x0 [0093.873] lstrlenW (lpString=".ldf") returned 4 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".ldf") returned 0x0 [0093.873] lstrlenW (lpString=".LDF") returned 4 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch=".LDF") returned 0x0 [0093.873] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.873] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e380) returned 1 [0093.874] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.874] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.874] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21387605219) returned 1 [0093.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6c3dcf0, dwHighDateTime=0x1d585b4)) [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df638 [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df638 | out: hHeap=0x260000) returned 1 [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.876] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.876] GetLastError () returned 0x0 [0093.876] GetLastError () returned 0x0 [0093.876] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.876] GetLastError () returned 0x0 [0093.876] GetLastError () returned 0x0 [0093.879] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe8c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.879] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x17380, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x17380, lpOverlapped=0x0) returned 1 [0093.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.879] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.880] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.880] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.880] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.880] CloseHandle (hObject=0xd8) returned 1 [0093.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.882] GetLastError () returned 0x0 [0093.883] RtlWakeConditionVariable () returned 0x0 [0093.883] GetCurrentThreadId () returned 0x98c [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".ldf") returned 0x0 [0093.883] lstrlenW (lpString=".vhd") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".vhd") returned 0x0 [0093.883] lstrlenW (lpString=".vhdx") returned 5 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".vhdx") returned 0x0 [0093.883] lstrlenW (lpString=".pst") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".pst") returned 0x0 [0093.883] lstrlenW (lpString=".ost") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".ost") returned 0x0 [0093.883] lstrlenW (lpString=".bak") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".bak") returned 0x0 [0093.883] lstrlenW (lpString=".bac") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".bac") returned 0x0 [0093.883] lstrlenW (lpString=".sys") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".sys") returned 0x0 [0093.883] lstrlenW (lpString=".v2i") returned 4 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".v2i") returned 0x0 [0093.883] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.885] lstrlenW (lpString=".sql") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".sql") returned 0x0 [0093.885] lstrlenW (lpString=".mdf") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".mdf") returned 0x0 [0093.885] lstrlenW (lpString=".txt") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".txt") returned 0x0 [0093.885] lstrlenW (lpString=".dbf") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".dbf") returned 0x0 [0093.885] lstrlenW (lpString=".ckp") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".ckp") returned 0x0 [0093.885] lstrlenW (lpString=".dacpac") returned 7 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".dacpac") returned 0x0 [0093.885] lstrlenW (lpString=".db3") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".db3") returned 0x0 [0093.885] lstrlenW (lpString=".dtxs") returned 5 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".dtxs") returned 0x0 [0093.885] lstrlenW (lpString=".mdt") returned 4 [0093.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".mdt") returned 0x0 [0093.886] lstrlenW (lpString=".sdf") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".sdf") returned 0x0 [0093.886] lstrlenW (lpString=".MDF") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".MDF") returned 0x0 [0093.886] lstrlenW (lpString=".DBF") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".DBF") returned 0x0 [0093.886] lstrlenW (lpString=".DB") returned 3 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".DB") returned 0x0 [0093.886] lstrlenW (lpString=".db") returned 3 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".db") returned 0x0 [0093.886] lstrlenW (lpString=".ndf") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".ndf") returned 0x0 [0093.886] lstrlenW (lpString=".NDF") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".NDF") returned 0x0 [0093.886] lstrlenW (lpString=".Mdf") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".Mdf") returned 0x0 [0093.886] lstrlenW (lpString=".dat") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".dat") returned 0x0 [0093.886] lstrlenW (lpString=".DAT") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".DAT") returned 0x0 [0093.886] lstrlenW (lpString=".ldf") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".ldf") returned 0x0 [0093.886] lstrlenW (lpString=".LDF") returned 4 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch=".LDF") returned 0x0 [0093.886] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.887] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33ec00) returned 1 [0093.887] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.887] CryptReleaseContext (hProv=0x33ec00, dwFlags=0x0) returned 1 [0093.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.888] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21388867460) returned 1 [0093.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6c63e50, dwHighDateTime=0x1d585b4)) [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df670 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df670 | out: hHeap=0x260000) returned 1 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.888] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.888] GetLastError () returned 0x0 [0093.889] GetLastError () returned 0x0 [0093.889] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.889] GetLastError () returned 0x0 [0093.889] GetLastError () returned 0x0 [0093.892] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.892] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.893] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.894] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.895] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.895] CloseHandle (hObject=0xd8) returned 1 [0093.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.898] GetLastError () returned 0x0 [0093.898] RtlWakeConditionVariable () returned 0x0 [0093.898] GetCurrentThreadId () returned 0x98c [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".ldf") returned 0x0 [0093.898] lstrlenW (lpString=".vhd") returned 4 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".vhd") returned 0x0 [0093.898] lstrlenW (lpString=".vhdx") returned 5 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".vhdx") returned 0x0 [0093.898] lstrlenW (lpString=".pst") returned 4 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".pst") returned 0x0 [0093.898] lstrlenW (lpString=".ost") returned 4 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".ost") returned 0x0 [0093.898] lstrlenW (lpString=".bak") returned 4 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".bak") returned 0x0 [0093.898] lstrlenW (lpString=".bac") returned 4 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".bac") returned 0x0 [0093.898] lstrlenW (lpString=".sys") returned 4 [0093.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".sys") returned 0x0 [0093.899] lstrlenW (lpString=".v2i") returned 4 [0093.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".v2i") returned 0x0 [0093.899] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch="s\r\n.v2i") returned 0x0 [0093.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.900] lstrlenW (lpString=".sql") returned 4 [0093.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".sql") returned 0x0 [0093.900] lstrlenW (lpString=".mdf") returned 4 [0093.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".mdf") returned 0x0 [0093.900] lstrlenW (lpString=".txt") returned 4 [0093.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".txt") returned 0x0 [0093.900] lstrlenW (lpString=".dbf") returned 4 [0093.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".dbf") returned 0x0 [0093.901] lstrlenW (lpString=".ckp") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".ckp") returned 0x0 [0093.901] lstrlenW (lpString=".dacpac") returned 7 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".dacpac") returned 0x0 [0093.901] lstrlenW (lpString=".db3") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".db3") returned 0x0 [0093.901] lstrlenW (lpString=".dtxs") returned 5 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".dtxs") returned 0x0 [0093.901] lstrlenW (lpString=".mdt") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".mdt") returned 0x0 [0093.901] lstrlenW (lpString=".sdf") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".sdf") returned 0x0 [0093.901] lstrlenW (lpString=".MDF") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".MDF") returned 0x0 [0093.901] lstrlenW (lpString=".DBF") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".DBF") returned 0x0 [0093.901] lstrlenW (lpString=".DB") returned 3 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".DB") returned 0x0 [0093.901] lstrlenW (lpString=".db") returned 3 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".db") returned 0x0 [0093.901] lstrlenW (lpString=".ndf") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".ndf") returned 0x0 [0093.901] lstrlenW (lpString=".NDF") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".NDF") returned 0x0 [0093.901] lstrlenW (lpString=".Mdf") returned 4 [0093.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".Mdf") returned 0x0 [0093.902] lstrlenW (lpString=".dat") returned 4 [0093.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".dat") returned 0x0 [0093.902] lstrlenW (lpString=".DAT") returned 4 [0093.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".DAT") returned 0x0 [0093.902] lstrlenW (lpString=".ldf") returned 4 [0093.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".ldf") returned 0x0 [0093.902] lstrlenW (lpString=".LDF") returned 4 [0093.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch=".LDF") returned 0x0 [0093.902] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.902] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33ec88) returned 1 [0093.903] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.903] CryptReleaseContext (hProv=0x33ec88, dwFlags=0x0) returned 1 [0093.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.903] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21390408647) returned 1 [0093.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6c89fb0, dwHighDateTime=0x1d585b4)) [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df6e0 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df6e0 | out: hHeap=0x260000) returned 1 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.904] GetLastError () returned 0x0 [0093.904] GetLastError () returned 0x0 [0093.904] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.904] GetLastError () returned 0x0 [0093.904] GetLastError () returned 0x0 [0093.963] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffec8a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.964] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1375c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1375c, lpOverlapped=0x0) returned 1 [0093.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.977] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.977] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.977] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.977] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.980] CloseHandle (hObject=0xd8) returned 1 [0093.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.992] GetLastError () returned 0x0 [0093.992] RtlWakeConditionVariable () returned 0x0 [0093.992] GetCurrentThreadId () returned 0x98c [0093.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".ldf") returned 0x0 [0093.992] lstrlenW (lpString=".vhd") returned 4 [0093.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".vhd") returned 0x0 [0093.992] lstrlenW (lpString=".vhdx") returned 5 [0093.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".vhdx") returned 0x0 [0093.992] lstrlenW (lpString=".pst") returned 4 [0093.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".pst") returned 0x0 [0093.992] lstrlenW (lpString=".ost") returned 4 [0093.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".ost") returned 0x0 [0093.992] lstrlenW (lpString=".bak") returned 4 [0093.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".bak") returned 0x0 [0093.992] lstrlenW (lpString=".bac") returned 4 [0093.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".bac") returned 0x0 [0093.993] lstrlenW (lpString=".sys") returned 4 [0093.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".sys") returned 0x0 [0093.993] lstrlenW (lpString=".v2i") returned 4 [0093.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".v2i") returned 0x0 [0093.993] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch="s\r\n.v2i") returned 0x0 [0093.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.994] lstrlenW (lpString=".sql") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".sql") returned 0x0 [0093.994] lstrlenW (lpString=".mdf") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".mdf") returned 0x0 [0093.994] lstrlenW (lpString=".txt") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".txt") returned 0x0 [0093.994] lstrlenW (lpString=".dbf") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".dbf") returned 0x0 [0093.994] lstrlenW (lpString=".ckp") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".ckp") returned 0x0 [0093.994] lstrlenW (lpString=".dacpac") returned 7 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".dacpac") returned 0x0 [0093.994] lstrlenW (lpString=".db3") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".db3") returned 0x0 [0093.994] lstrlenW (lpString=".dtxs") returned 5 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".dtxs") returned 0x0 [0093.994] lstrlenW (lpString=".mdt") returned 4 [0093.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".mdt") returned 0x0 [0093.994] lstrlenW (lpString=".sdf") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".sdf") returned 0x0 [0093.995] lstrlenW (lpString=".MDF") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".MDF") returned 0x0 [0093.995] lstrlenW (lpString=".DBF") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".DBF") returned 0x0 [0093.995] lstrlenW (lpString=".DB") returned 3 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".DB") returned 0x0 [0093.995] lstrlenW (lpString=".db") returned 3 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".db") returned 0x0 [0093.995] lstrlenW (lpString=".ndf") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".ndf") returned 0x0 [0093.995] lstrlenW (lpString=".NDF") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".NDF") returned 0x0 [0093.995] lstrlenW (lpString=".Mdf") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".Mdf") returned 0x0 [0093.995] lstrlenW (lpString=".dat") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".dat") returned 0x0 [0093.995] lstrlenW (lpString=".DAT") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".DAT") returned 0x0 [0093.995] lstrlenW (lpString=".ldf") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".ldf") returned 0x0 [0093.995] lstrlenW (lpString=".LDF") returned 4 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch=".LDF") returned 0x0 [0093.995] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.996] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33ed98) returned 1 [0093.996] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.996] CryptReleaseContext (hProv=0x33ed98, dwFlags=0x0) returned 1 [0093.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.997] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21399764427) returned 1 [0093.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6d6e7f0, dwHighDateTime=0x1d585b4)) [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df7f8 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df7f8 | out: hHeap=0x260000) returned 1 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0093.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.997] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0093.997] GetLastError () returned 0x0 [0093.998] GetLastError () returned 0x0 [0093.998] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0093.998] GetLastError () returned 0x0 [0093.998] GetLastError () returned 0x0 [0094.000] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe9250, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.000] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x16db0, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x16db0, lpOverlapped=0x0) returned 1 [0094.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.001] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.001] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.001] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.001] CloseHandle (hObject=0xe4) returned 1 [0094.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.[deadmin@cock.li].deadmin")) returned 1 [0094.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.003] GetLastError () returned 0x0 [0094.003] RtlWakeConditionVariable () returned 0x0 [0094.003] GetCurrentThreadId () returned 0x98c [0094.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".ldf") returned 0x0 [0094.003] lstrlenW (lpString=".vhd") returned 4 [0094.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".vhd") returned 0x0 [0094.003] lstrlenW (lpString=".vhdx") returned 5 [0094.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".vhdx") returned 0x0 [0094.003] lstrlenW (lpString=".pst") returned 4 [0094.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".pst") returned 0x0 [0094.003] lstrlenW (lpString=".ost") returned 4 [0094.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".ost") returned 0x0 [0094.003] lstrlenW (lpString=".bak") returned 4 [0094.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".bak") returned 0x0 [0094.003] lstrlenW (lpString=".bac") returned 4 [0094.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".bac") returned 0x0 [0094.004] lstrlenW (lpString=".sys") returned 4 [0094.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".sys") returned 0x0 [0094.004] lstrlenW (lpString=".v2i") returned 4 [0094.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".v2i") returned 0x0 [0094.004] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch="s\r\n.v2i") returned 0x0 [0094.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.005] lstrlenW (lpString=".sql") returned 4 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".sql") returned 0x0 [0094.005] lstrlenW (lpString=".mdf") returned 4 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".mdf") returned 0x0 [0094.005] lstrlenW (lpString=".txt") returned 4 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".txt") returned 0x0 [0094.005] lstrlenW (lpString=".dbf") returned 4 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".dbf") returned 0x0 [0094.005] lstrlenW (lpString=".ckp") returned 4 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".ckp") returned 0x0 [0094.005] lstrlenW (lpString=".dacpac") returned 7 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".dacpac") returned 0x0 [0094.005] lstrlenW (lpString=".db3") returned 4 [0094.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".db3") returned 0x0 [0094.006] lstrlenW (lpString=".dtxs") returned 5 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".dtxs") returned 0x0 [0094.006] lstrlenW (lpString=".mdt") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".mdt") returned 0x0 [0094.006] lstrlenW (lpString=".sdf") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".sdf") returned 0x0 [0094.006] lstrlenW (lpString=".MDF") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".MDF") returned 0x0 [0094.006] lstrlenW (lpString=".DBF") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".DBF") returned 0x0 [0094.006] lstrlenW (lpString=".DB") returned 3 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".DB") returned 0x0 [0094.006] lstrlenW (lpString=".db") returned 3 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".db") returned 0x0 [0094.006] lstrlenW (lpString=".ndf") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".ndf") returned 0x0 [0094.006] lstrlenW (lpString=".NDF") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".NDF") returned 0x0 [0094.006] lstrlenW (lpString=".Mdf") returned 4 [0094.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".Mdf") returned 0x0 [0094.007] lstrlenW (lpString=".dat") returned 4 [0094.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".dat") returned 0x0 [0094.007] lstrlenW (lpString=".DAT") returned 4 [0094.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".DAT") returned 0x0 [0094.007] lstrlenW (lpString=".ldf") returned 4 [0094.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".ldf") returned 0x0 [0094.007] lstrlenW (lpString=".LDF") returned 4 [0094.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch=".LDF") returned 0x0 [0094.007] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.007] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f040) returned 1 [0094.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.008] CryptReleaseContext (hProv=0x33f040, dwFlags=0x0) returned 1 [0094.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.008] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21400910345) returned 1 [0094.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6d94950, dwHighDateTime=0x1d585b4)) [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df830 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df830 | out: hHeap=0x260000) returned 1 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.009] GetLastError () returned 0x0 [0094.009] GetLastError () returned 0x0 [0094.009] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.009] GetLastError () returned 0x0 [0094.009] GetLastError () returned 0x0 [0094.012] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.012] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.013] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.013] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.013] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.013] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.013] CloseHandle (hObject=0xe4) returned 1 [0094.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.[deadmin@cock.li].deadmin")) returned 1 [0094.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.015] GetLastError () returned 0x0 [0094.015] RtlWakeConditionVariable () returned 0x0 [0094.015] GetCurrentThreadId () returned 0x98c [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".ldf") returned 0x0 [0094.016] lstrlenW (lpString=".vhd") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".vhd") returned 0x0 [0094.016] lstrlenW (lpString=".vhdx") returned 5 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".vhdx") returned 0x0 [0094.016] lstrlenW (lpString=".pst") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".pst") returned 0x0 [0094.016] lstrlenW (lpString=".ost") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".ost") returned 0x0 [0094.016] lstrlenW (lpString=".bak") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".bak") returned 0x0 [0094.016] lstrlenW (lpString=".bac") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".bac") returned 0x0 [0094.016] lstrlenW (lpString=".sys") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".sys") returned 0x0 [0094.016] lstrlenW (lpString=".v2i") returned 4 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".v2i") returned 0x0 [0094.016] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch="s\r\n.v2i") returned 0x0 [0094.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.018] lstrlenW (lpString=".sql") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".sql") returned 0x0 [0094.018] lstrlenW (lpString=".mdf") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".mdf") returned 0x0 [0094.018] lstrlenW (lpString=".txt") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".txt") returned 0x0 [0094.018] lstrlenW (lpString=".dbf") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".dbf") returned 0x0 [0094.018] lstrlenW (lpString=".ckp") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".ckp") returned 0x0 [0094.018] lstrlenW (lpString=".dacpac") returned 7 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".dacpac") returned 0x0 [0094.018] lstrlenW (lpString=".db3") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".db3") returned 0x0 [0094.018] lstrlenW (lpString=".dtxs") returned 5 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".dtxs") returned 0x0 [0094.018] lstrlenW (lpString=".mdt") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".mdt") returned 0x0 [0094.018] lstrlenW (lpString=".sdf") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".sdf") returned 0x0 [0094.018] lstrlenW (lpString=".MDF") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".MDF") returned 0x0 [0094.018] lstrlenW (lpString=".DBF") returned 4 [0094.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".DBF") returned 0x0 [0094.019] lstrlenW (lpString=".DB") returned 3 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".DB") returned 0x0 [0094.019] lstrlenW (lpString=".db") returned 3 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".db") returned 0x0 [0094.019] lstrlenW (lpString=".ndf") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".ndf") returned 0x0 [0094.019] lstrlenW (lpString=".NDF") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".NDF") returned 0x0 [0094.019] lstrlenW (lpString=".Mdf") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".Mdf") returned 0x0 [0094.019] lstrlenW (lpString=".dat") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".dat") returned 0x0 [0094.019] lstrlenW (lpString=".DAT") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".DAT") returned 0x0 [0094.019] lstrlenW (lpString=".ldf") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".ldf") returned 0x0 [0094.019] lstrlenW (lpString=".LDF") returned 4 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch=".LDF") returned 0x0 [0094.019] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.019] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f0c8) returned 1 [0094.020] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.020] CryptReleaseContext (hProv=0x33f0c8, dwFlags=0x0) returned 1 [0094.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.020] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21402146325) returned 1 [0094.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6d94950, dwHighDateTime=0x1d585b4)) [0094.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df868 [0094.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df868 | out: hHeap=0x260000) returned 1 [0094.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.021] GetLastError () returned 0x0 [0094.021] GetLastError () returned 0x0 [0094.022] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.022] GetLastError () returned 0x0 [0094.022] GetLastError () returned 0x0 [0094.137] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.137] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.138] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.138] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.197] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.197] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.197] CloseHandle (hObject=0xe4) returned 1 [0094.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.[deadmin@cock.li].deadmin")) returned 1 [0094.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.199] GetLastError () returned 0x0 [0094.199] RtlWakeConditionVariable () returned 0x0 [0094.199] GetCurrentThreadId () returned 0x98c [0094.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".ldf") returned 0x0 [0094.199] lstrlenW (lpString=".vhd") returned 4 [0094.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".vhd") returned 0x0 [0094.199] lstrlenW (lpString=".vhdx") returned 5 [0094.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".vhdx") returned 0x0 [0094.199] lstrlenW (lpString=".pst") returned 4 [0094.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".pst") returned 0x0 [0094.199] lstrlenW (lpString=".ost") returned 4 [0094.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".ost") returned 0x0 [0094.199] lstrlenW (lpString=".bak") returned 4 [0094.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".bak") returned 0x0 [0094.199] lstrlenW (lpString=".bac") returned 4 [0094.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".bac") returned 0x0 [0094.200] lstrlenW (lpString=".sys") returned 4 [0094.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".sys") returned 0x0 [0094.200] lstrlenW (lpString=".v2i") returned 4 [0094.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".v2i") returned 0x0 [0094.200] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.201] lstrlenW (lpString=".sql") returned 4 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".sql") returned 0x0 [0094.201] lstrlenW (lpString=".mdf") returned 4 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".mdf") returned 0x0 [0094.201] lstrlenW (lpString=".txt") returned 4 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".txt") returned 0x0 [0094.201] lstrlenW (lpString=".dbf") returned 4 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".dbf") returned 0x0 [0094.201] lstrlenW (lpString=".ckp") returned 4 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".ckp") returned 0x0 [0094.201] lstrlenW (lpString=".dacpac") returned 7 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".dacpac") returned 0x0 [0094.201] lstrlenW (lpString=".db3") returned 4 [0094.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".db3") returned 0x0 [0094.202] lstrlenW (lpString=".dtxs") returned 5 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".dtxs") returned 0x0 [0094.202] lstrlenW (lpString=".mdt") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".mdt") returned 0x0 [0094.202] lstrlenW (lpString=".sdf") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".sdf") returned 0x0 [0094.202] lstrlenW (lpString=".MDF") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".MDF") returned 0x0 [0094.202] lstrlenW (lpString=".DBF") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".DBF") returned 0x0 [0094.202] lstrlenW (lpString=".DB") returned 3 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".DB") returned 0x0 [0094.202] lstrlenW (lpString=".db") returned 3 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".db") returned 0x0 [0094.202] lstrlenW (lpString=".ndf") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".ndf") returned 0x0 [0094.202] lstrlenW (lpString=".NDF") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".NDF") returned 0x0 [0094.202] lstrlenW (lpString=".Mdf") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".Mdf") returned 0x0 [0094.202] lstrlenW (lpString=".dat") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".dat") returned 0x0 [0094.202] lstrlenW (lpString=".DAT") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".DAT") returned 0x0 [0094.202] lstrlenW (lpString=".ldf") returned 4 [0094.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".ldf") returned 0x0 [0094.203] lstrlenW (lpString=".LDF") returned 4 [0094.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch=".LDF") returned 0x0 [0094.203] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.203] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f150) returned 1 [0094.204] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.204] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.204] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21420486296) returned 1 [0094.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6f5d9d0, dwHighDateTime=0x1d585b4)) [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfbe8 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfbe8 | out: hHeap=0x260000) returned 1 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.205] GetLastError () returned 0x0 [0094.205] GetLastError () returned 0x0 [0094.205] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.205] GetLastError () returned 0x0 [0094.205] GetLastError () returned 0x0 [0094.208] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.208] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.209] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.209] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.211] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.212] CloseHandle (hObject=0xe4) returned 1 [0094.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.214] GetLastError () returned 0x0 [0094.214] RtlWakeConditionVariable () returned 0x0 [0094.214] GetCurrentThreadId () returned 0x98c [0094.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".ldf") returned 0x0 [0094.214] lstrlenW (lpString=".vhd") returned 4 [0094.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".vhd") returned 0x0 [0094.214] lstrlenW (lpString=".vhdx") returned 5 [0094.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".vhdx") returned 0x0 [0094.214] lstrlenW (lpString=".pst") returned 4 [0094.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".pst") returned 0x0 [0094.214] lstrlenW (lpString=".ost") returned 4 [0094.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".ost") returned 0x0 [0094.215] lstrlenW (lpString=".bak") returned 4 [0094.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".bak") returned 0x0 [0094.215] lstrlenW (lpString=".bac") returned 4 [0094.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".bac") returned 0x0 [0094.215] lstrlenW (lpString=".sys") returned 4 [0094.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".sys") returned 0x0 [0094.215] lstrlenW (lpString=".v2i") returned 4 [0094.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".v2i") returned 0x0 [0094.215] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch="s\r\n.v2i") returned 0x0 [0094.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.216] lstrlenW (lpString=".sql") returned 4 [0094.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".sql") returned 0x0 [0094.216] lstrlenW (lpString=".mdf") returned 4 [0094.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".mdf") returned 0x0 [0094.216] lstrlenW (lpString=".txt") returned 4 [0094.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".txt") returned 0x0 [0094.216] lstrlenW (lpString=".dbf") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".dbf") returned 0x0 [0094.217] lstrlenW (lpString=".ckp") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".ckp") returned 0x0 [0094.217] lstrlenW (lpString=".dacpac") returned 7 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".dacpac") returned 0x0 [0094.217] lstrlenW (lpString=".db3") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".db3") returned 0x0 [0094.217] lstrlenW (lpString=".dtxs") returned 5 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".dtxs") returned 0x0 [0094.217] lstrlenW (lpString=".mdt") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".mdt") returned 0x0 [0094.217] lstrlenW (lpString=".sdf") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".sdf") returned 0x0 [0094.217] lstrlenW (lpString=".MDF") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".MDF") returned 0x0 [0094.217] lstrlenW (lpString=".DBF") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".DBF") returned 0x0 [0094.217] lstrlenW (lpString=".DB") returned 3 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".DB") returned 0x0 [0094.217] lstrlenW (lpString=".db") returned 3 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".db") returned 0x0 [0094.217] lstrlenW (lpString=".ndf") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".ndf") returned 0x0 [0094.217] lstrlenW (lpString=".NDF") returned 4 [0094.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".NDF") returned 0x0 [0094.218] lstrlenW (lpString=".Mdf") returned 4 [0094.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".Mdf") returned 0x0 [0094.218] lstrlenW (lpString=".dat") returned 4 [0094.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".dat") returned 0x0 [0094.218] lstrlenW (lpString=".DAT") returned 4 [0094.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".DAT") returned 0x0 [0094.218] lstrlenW (lpString=".ldf") returned 4 [0094.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".ldf") returned 0x0 [0094.218] lstrlenW (lpString=".LDF") returned 4 [0094.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch=".LDF") returned 0x0 [0094.218] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.218] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f3f8) returned 1 [0094.219] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.219] CryptReleaseContext (hProv=0x33f3f8, dwFlags=0x0) returned 1 [0094.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.219] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21422015620) returned 1 [0094.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6f83b30, dwHighDateTime=0x1d585b4)) [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfc20 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfc20 | out: hHeap=0x260000) returned 1 [0094.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.220] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.220] GetLastError () returned 0x0 [0094.220] GetLastError () returned 0x0 [0094.220] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.220] GetLastError () returned 0x0 [0094.220] GetLastError () returned 0x0 [0094.223] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff4a70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.223] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb590, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0xb590, lpOverlapped=0x0) returned 1 [0094.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.223] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.223] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.223] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.223] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.223] CloseHandle (hObject=0xe4) returned 1 [0094.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.[deadmin@cock.li].deadmin")) returned 1 [0094.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.227] GetLastError () returned 0x0 [0094.228] RtlWakeConditionVariable () returned 0x0 [0094.228] GetCurrentThreadId () returned 0x98c [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".ldf") returned 0x0 [0094.228] lstrlenW (lpString=".vhd") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".vhd") returned 0x0 [0094.228] lstrlenW (lpString=".vhdx") returned 5 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".vhdx") returned 0x0 [0094.228] lstrlenW (lpString=".pst") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".pst") returned 0x0 [0094.228] lstrlenW (lpString=".ost") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".ost") returned 0x0 [0094.228] lstrlenW (lpString=".bak") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".bak") returned 0x0 [0094.228] lstrlenW (lpString=".bac") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".bac") returned 0x0 [0094.228] lstrlenW (lpString=".sys") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".sys") returned 0x0 [0094.228] lstrlenW (lpString=".v2i") returned 4 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".v2i") returned 0x0 [0094.228] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.230] lstrlenW (lpString=".sql") returned 4 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".sql") returned 0x0 [0094.230] lstrlenW (lpString=".mdf") returned 4 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".mdf") returned 0x0 [0094.230] lstrlenW (lpString=".txt") returned 4 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".txt") returned 0x0 [0094.230] lstrlenW (lpString=".dbf") returned 4 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".dbf") returned 0x0 [0094.230] lstrlenW (lpString=".ckp") returned 4 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".ckp") returned 0x0 [0094.230] lstrlenW (lpString=".dacpac") returned 7 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".dacpac") returned 0x0 [0094.230] lstrlenW (lpString=".db3") returned 4 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".db3") returned 0x0 [0094.230] lstrlenW (lpString=".dtxs") returned 5 [0094.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".dtxs") returned 0x0 [0094.230] lstrlenW (lpString=".mdt") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".mdt") returned 0x0 [0094.231] lstrlenW (lpString=".sdf") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".sdf") returned 0x0 [0094.231] lstrlenW (lpString=".MDF") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".MDF") returned 0x0 [0094.231] lstrlenW (lpString=".DBF") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".DBF") returned 0x0 [0094.231] lstrlenW (lpString=".DB") returned 3 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".DB") returned 0x0 [0094.231] lstrlenW (lpString=".db") returned 3 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".db") returned 0x0 [0094.231] lstrlenW (lpString=".ndf") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".ndf") returned 0x0 [0094.231] lstrlenW (lpString=".NDF") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".NDF") returned 0x0 [0094.231] lstrlenW (lpString=".Mdf") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".Mdf") returned 0x0 [0094.231] lstrlenW (lpString=".dat") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".dat") returned 0x0 [0094.231] lstrlenW (lpString=".DAT") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".DAT") returned 0x0 [0094.231] lstrlenW (lpString=".ldf") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".ldf") returned 0x0 [0094.231] lstrlenW (lpString=".LDF") returned 4 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch=".LDF") returned 0x0 [0094.231] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.232] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f480) returned 1 [0094.232] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.232] CryptReleaseContext (hProv=0x33f480, dwFlags=0x0) returned 1 [0094.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.233] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21423374347) returned 1 [0094.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6fa9c90, dwHighDateTime=0x1d585b4)) [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfc58 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfc58 | out: hHeap=0x260000) returned 1 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.233] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.233] GetLastError () returned 0x0 [0094.234] GetLastError () returned 0x0 [0094.234] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.234] GetLastError () returned 0x0 [0094.234] GetLastError () returned 0x0 [0094.239] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.239] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.242] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.242] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.248] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.248] CloseHandle (hObject=0xe4) returned 1 [0094.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.258] GetLastError () returned 0x0 [0094.258] RtlWakeConditionVariable () returned 0x0 [0094.258] GetCurrentThreadId () returned 0x98c [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".ldf") returned 0x0 [0094.258] lstrlenW (lpString=".vhd") returned 4 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".vhd") returned 0x0 [0094.258] lstrlenW (lpString=".vhdx") returned 5 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".vhdx") returned 0x0 [0094.258] lstrlenW (lpString=".pst") returned 4 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".pst") returned 0x0 [0094.258] lstrlenW (lpString=".ost") returned 4 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".ost") returned 0x0 [0094.258] lstrlenW (lpString=".bak") returned 4 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".bak") returned 0x0 [0094.258] lstrlenW (lpString=".bac") returned 4 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".bac") returned 0x0 [0094.258] lstrlenW (lpString=".sys") returned 4 [0094.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".sys") returned 0x0 [0094.259] lstrlenW (lpString=".v2i") returned 4 [0094.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".v2i") returned 0x0 [0094.259] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.260] lstrlenW (lpString=".sql") returned 4 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".sql") returned 0x0 [0094.260] lstrlenW (lpString=".mdf") returned 4 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".mdf") returned 0x0 [0094.260] lstrlenW (lpString=".txt") returned 4 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".txt") returned 0x0 [0094.260] lstrlenW (lpString=".dbf") returned 4 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".dbf") returned 0x0 [0094.260] lstrlenW (lpString=".ckp") returned 4 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".ckp") returned 0x0 [0094.260] lstrlenW (lpString=".dacpac") returned 7 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".dacpac") returned 0x0 [0094.260] lstrlenW (lpString=".db3") returned 4 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".db3") returned 0x0 [0094.260] lstrlenW (lpString=".dtxs") returned 5 [0094.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".dtxs") returned 0x0 [0094.260] lstrlenW (lpString=".mdt") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".mdt") returned 0x0 [0094.261] lstrlenW (lpString=".sdf") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".sdf") returned 0x0 [0094.261] lstrlenW (lpString=".MDF") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".MDF") returned 0x0 [0094.261] lstrlenW (lpString=".DBF") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".DBF") returned 0x0 [0094.261] lstrlenW (lpString=".DB") returned 3 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".DB") returned 0x0 [0094.261] lstrlenW (lpString=".db") returned 3 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".db") returned 0x0 [0094.261] lstrlenW (lpString=".ndf") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".ndf") returned 0x0 [0094.261] lstrlenW (lpString=".NDF") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".NDF") returned 0x0 [0094.261] lstrlenW (lpString=".Mdf") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".Mdf") returned 0x0 [0094.261] lstrlenW (lpString=".dat") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".dat") returned 0x0 [0094.261] lstrlenW (lpString=".DAT") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".DAT") returned 0x0 [0094.261] lstrlenW (lpString=".ldf") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".ldf") returned 0x0 [0094.261] lstrlenW (lpString=".LDF") returned 4 [0094.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch=".LDF") returned 0x0 [0094.261] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.262] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33e8d0) returned 1 [0094.262] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.262] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0094.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.263] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21426378969) returned 1 [0094.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc6ff5f50, dwHighDateTime=0x1d585b4)) [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfd38 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfd38 | out: hHeap=0x260000) returned 1 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f550 [0094.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f550 | out: hHeap=0x260000) returned 1 [0094.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.263] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.264] GetLastError () returned 0x0 [0094.264] GetLastError () returned 0x0 [0094.264] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.264] GetLastError () returned 0x0 [0094.264] GetLastError () returned 0x0 [0094.269] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.269] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.270] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.270] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.270] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.270] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.270] CloseHandle (hObject=0xe4) returned 1 [0094.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.272] GetLastError () returned 0x0 [0094.272] RtlWakeConditionVariable () returned 0x0 [0094.272] GetCurrentThreadId () returned 0x98c [0094.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".ldf") returned 0x0 [0094.272] lstrlenW (lpString=".vhd") returned 4 [0094.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".vhd") returned 0x0 [0094.272] lstrlenW (lpString=".vhdx") returned 5 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".vhdx") returned 0x0 [0094.273] lstrlenW (lpString=".pst") returned 4 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".pst") returned 0x0 [0094.273] lstrlenW (lpString=".ost") returned 4 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".ost") returned 0x0 [0094.273] lstrlenW (lpString=".bak") returned 4 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".bak") returned 0x0 [0094.273] lstrlenW (lpString=".bac") returned 4 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".bac") returned 0x0 [0094.273] lstrlenW (lpString=".sys") returned 4 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".sys") returned 0x0 [0094.273] lstrlenW (lpString=".v2i") returned 4 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".v2i") returned 0x0 [0094.273] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.275] lstrlenW (lpString=".sql") returned 4 [0094.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".sql") returned 0x0 [0094.275] lstrlenW (lpString=".mdf") returned 4 [0094.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".mdf") returned 0x0 [0094.275] lstrlenW (lpString=".txt") returned 4 [0094.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".txt") returned 0x0 [0094.275] lstrlenW (lpString=".dbf") returned 4 [0094.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".dbf") returned 0x0 [0094.275] lstrlenW (lpString=".ckp") returned 4 [0094.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".ckp") returned 0x0 [0094.275] lstrlenW (lpString=".dacpac") returned 7 [0094.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".dacpac") returned 0x0 [0094.276] lstrlenW (lpString=".db3") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".db3") returned 0x0 [0094.276] lstrlenW (lpString=".dtxs") returned 5 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".dtxs") returned 0x0 [0094.276] lstrlenW (lpString=".mdt") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".mdt") returned 0x0 [0094.276] lstrlenW (lpString=".sdf") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".sdf") returned 0x0 [0094.276] lstrlenW (lpString=".MDF") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".MDF") returned 0x0 [0094.276] lstrlenW (lpString=".DBF") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".DBF") returned 0x0 [0094.276] lstrlenW (lpString=".DB") returned 3 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".DB") returned 0x0 [0094.276] lstrlenW (lpString=".db") returned 3 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".db") returned 0x0 [0094.276] lstrlenW (lpString=".ndf") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".ndf") returned 0x0 [0094.276] lstrlenW (lpString=".NDF") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".NDF") returned 0x0 [0094.276] lstrlenW (lpString=".Mdf") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".Mdf") returned 0x0 [0094.276] lstrlenW (lpString=".dat") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".dat") returned 0x0 [0094.276] lstrlenW (lpString=".DAT") returned 4 [0094.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".DAT") returned 0x0 [0094.276] lstrlenW (lpString=".ldf") returned 4 [0094.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".ldf") returned 0x0 [0094.277] lstrlenW (lpString=".LDF") returned 4 [0094.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch=".LDF") returned 0x0 [0094.277] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.277] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f508) returned 1 [0094.278] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.278] CryptReleaseContext (hProv=0x33f508, dwFlags=0x0) returned 1 [0094.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.278] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21427891899) returned 1 [0094.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc701c0b0, dwHighDateTime=0x1d585b4)) [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfd70 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfd70 | out: hHeap=0x260000) returned 1 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.278] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.279] GetLastError () returned 0x0 [0094.279] GetLastError () returned 0x0 [0094.279] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.279] GetLastError () returned 0x0 [0094.279] GetLastError () returned 0x0 [0094.283] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.283] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.283] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.283] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.285] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.285] CloseHandle (hObject=0xe4) returned 1 [0094.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.287] GetLastError () returned 0x0 [0094.287] RtlWakeConditionVariable () returned 0x0 [0094.287] GetCurrentThreadId () returned 0x98c [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".ldf") returned 0x0 [0094.288] lstrlenW (lpString=".vhd") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".vhd") returned 0x0 [0094.288] lstrlenW (lpString=".vhdx") returned 5 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".vhdx") returned 0x0 [0094.288] lstrlenW (lpString=".pst") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".pst") returned 0x0 [0094.288] lstrlenW (lpString=".ost") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".ost") returned 0x0 [0094.288] lstrlenW (lpString=".bak") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".bak") returned 0x0 [0094.288] lstrlenW (lpString=".bac") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".bac") returned 0x0 [0094.288] lstrlenW (lpString=".sys") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".sys") returned 0x0 [0094.288] lstrlenW (lpString=".v2i") returned 4 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".v2i") returned 0x0 [0094.288] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.333] lstrlenW (lpString=".sql") returned 4 [0094.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".sql") returned 0x0 [0094.333] lstrlenW (lpString=".mdf") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".mdf") returned 0x0 [0094.334] lstrlenW (lpString=".txt") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".txt") returned 0x0 [0094.334] lstrlenW (lpString=".dbf") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".dbf") returned 0x0 [0094.334] lstrlenW (lpString=".ckp") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".ckp") returned 0x0 [0094.334] lstrlenW (lpString=".dacpac") returned 7 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".dacpac") returned 0x0 [0094.334] lstrlenW (lpString=".db3") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".db3") returned 0x0 [0094.334] lstrlenW (lpString=".dtxs") returned 5 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".dtxs") returned 0x0 [0094.334] lstrlenW (lpString=".mdt") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".mdt") returned 0x0 [0094.334] lstrlenW (lpString=".sdf") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".sdf") returned 0x0 [0094.334] lstrlenW (lpString=".MDF") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".MDF") returned 0x0 [0094.334] lstrlenW (lpString=".DBF") returned 4 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".DBF") returned 0x0 [0094.334] lstrlenW (lpString=".DB") returned 3 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".DB") returned 0x0 [0094.334] lstrlenW (lpString=".db") returned 3 [0094.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".db") returned 0x0 [0094.334] lstrlenW (lpString=".ndf") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".ndf") returned 0x0 [0094.335] lstrlenW (lpString=".NDF") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".NDF") returned 0x0 [0094.335] lstrlenW (lpString=".Mdf") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".Mdf") returned 0x0 [0094.335] lstrlenW (lpString=".dat") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".dat") returned 0x0 [0094.335] lstrlenW (lpString=".DAT") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".DAT") returned 0x0 [0094.335] lstrlenW (lpString=".ldf") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".ldf") returned 0x0 [0094.335] lstrlenW (lpString=".LDF") returned 4 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch=".LDF") returned 0x0 [0094.335] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.335] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f7b0) returned 1 [0094.336] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.336] CryptReleaseContext (hProv=0x33f7b0, dwFlags=0x0) returned 1 [0094.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.336] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21433724647) returned 1 [0094.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc70b4630, dwHighDateTime=0x1d585b4)) [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfe18 [0094.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfe18 | out: hHeap=0x260000) returned 1 [0094.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dd90 [0094.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.337] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.337] GetLastError () returned 0x0 [0094.337] GetLastError () returned 0x0 [0094.337] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.337] GetLastError () returned 0x0 [0094.337] GetLastError () returned 0x0 [0094.339] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff9256, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.339] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6daa, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x6daa, lpOverlapped=0x0) returned 1 [0094.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.339] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.340] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.340] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.340] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.340] CloseHandle (hObject=0x11c) returned 1 [0094.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.341] GetLastError () returned 0x0 [0094.341] RtlWakeConditionVariable () returned 0x0 [0094.341] GetCurrentThreadId () returned 0x98c [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".ldf") returned 0x0 [0094.342] lstrlenW (lpString=".vhd") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".vhd") returned 0x0 [0094.342] lstrlenW (lpString=".vhdx") returned 5 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".vhdx") returned 0x0 [0094.342] lstrlenW (lpString=".pst") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".pst") returned 0x0 [0094.342] lstrlenW (lpString=".ost") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".ost") returned 0x0 [0094.342] lstrlenW (lpString=".bak") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".bak") returned 0x0 [0094.342] lstrlenW (lpString=".bac") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".bac") returned 0x0 [0094.342] lstrlenW (lpString=".sys") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".sys") returned 0x0 [0094.342] lstrlenW (lpString=".v2i") returned 4 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".v2i") returned 0x0 [0094.342] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.343] lstrlenW (lpString=".sql") returned 4 [0094.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".sql") returned 0x0 [0094.344] lstrlenW (lpString=".mdf") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".mdf") returned 0x0 [0094.344] lstrlenW (lpString=".txt") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".txt") returned 0x0 [0094.344] lstrlenW (lpString=".dbf") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".dbf") returned 0x0 [0094.344] lstrlenW (lpString=".ckp") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".ckp") returned 0x0 [0094.344] lstrlenW (lpString=".dacpac") returned 7 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".dacpac") returned 0x0 [0094.344] lstrlenW (lpString=".db3") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".db3") returned 0x0 [0094.344] lstrlenW (lpString=".dtxs") returned 5 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".dtxs") returned 0x0 [0094.344] lstrlenW (lpString=".mdt") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".mdt") returned 0x0 [0094.344] lstrlenW (lpString=".sdf") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".sdf") returned 0x0 [0094.344] lstrlenW (lpString=".MDF") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".MDF") returned 0x0 [0094.344] lstrlenW (lpString=".DBF") returned 4 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".DBF") returned 0x0 [0094.344] lstrlenW (lpString=".DB") returned 3 [0094.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".DB") returned 0x0 [0094.344] lstrlenW (lpString=".db") returned 3 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".db") returned 0x0 [0094.345] lstrlenW (lpString=".ndf") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".ndf") returned 0x0 [0094.345] lstrlenW (lpString=".NDF") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".NDF") returned 0x0 [0094.345] lstrlenW (lpString=".Mdf") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".Mdf") returned 0x0 [0094.345] lstrlenW (lpString=".dat") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".dat") returned 0x0 [0094.345] lstrlenW (lpString=".DAT") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".DAT") returned 0x0 [0094.345] lstrlenW (lpString=".ldf") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".ldf") returned 0x0 [0094.345] lstrlenW (lpString=".LDF") returned 4 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch=".LDF") returned 0x0 [0094.345] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.345] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f6a0) returned 1 [0094.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.346] CryptReleaseContext (hProv=0x33f6a0, dwFlags=0x0) returned 1 [0094.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.346] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21434734573) returned 1 [0094.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc70b4630, dwHighDateTime=0x1d585b4)) [0094.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfe50 [0094.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfe50 | out: hHeap=0x260000) returned 1 [0094.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.347] GetLastError () returned 0x0 [0094.347] GetLastError () returned 0x0 [0094.347] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.347] GetLastError () returned 0x0 [0094.348] GetLastError () returned 0x0 [0094.349] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffef3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.349] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x10c2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x10c2, lpOverlapped=0x0) returned 1 [0094.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.350] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.350] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.350] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.350] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.350] CloseHandle (hObject=0x11c) returned 1 [0094.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.351] GetLastError () returned 0x0 [0094.352] RtlWakeConditionVariable () returned 0x0 [0094.352] GetCurrentThreadId () returned 0x98c [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".ldf") returned 0x0 [0094.352] lstrlenW (lpString=".vhd") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".vhd") returned 0x0 [0094.352] lstrlenW (lpString=".vhdx") returned 5 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".vhdx") returned 0x0 [0094.352] lstrlenW (lpString=".pst") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".pst") returned 0x0 [0094.352] lstrlenW (lpString=".ost") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".ost") returned 0x0 [0094.352] lstrlenW (lpString=".bak") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".bak") returned 0x0 [0094.352] lstrlenW (lpString=".bac") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".bac") returned 0x0 [0094.352] lstrlenW (lpString=".sys") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".sys") returned 0x0 [0094.352] lstrlenW (lpString=".v2i") returned 4 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".v2i") returned 0x0 [0094.352] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.353] lstrlenW (lpString=".sql") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".sql") returned 0x0 [0094.354] lstrlenW (lpString=".mdf") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".mdf") returned 0x0 [0094.354] lstrlenW (lpString=".txt") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".txt") returned 0x0 [0094.354] lstrlenW (lpString=".dbf") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".dbf") returned 0x0 [0094.354] lstrlenW (lpString=".ckp") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".ckp") returned 0x0 [0094.354] lstrlenW (lpString=".dacpac") returned 7 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".dacpac") returned 0x0 [0094.354] lstrlenW (lpString=".db3") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".db3") returned 0x0 [0094.354] lstrlenW (lpString=".dtxs") returned 5 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".dtxs") returned 0x0 [0094.354] lstrlenW (lpString=".mdt") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".mdt") returned 0x0 [0094.354] lstrlenW (lpString=".sdf") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".sdf") returned 0x0 [0094.354] lstrlenW (lpString=".MDF") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".MDF") returned 0x0 [0094.354] lstrlenW (lpString=".DBF") returned 4 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".DBF") returned 0x0 [0094.354] lstrlenW (lpString=".DB") returned 3 [0094.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".DB") returned 0x0 [0094.354] lstrlenW (lpString=".db") returned 3 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".db") returned 0x0 [0094.355] lstrlenW (lpString=".ndf") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".ndf") returned 0x0 [0094.355] lstrlenW (lpString=".NDF") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".NDF") returned 0x0 [0094.355] lstrlenW (lpString=".Mdf") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".Mdf") returned 0x0 [0094.355] lstrlenW (lpString=".dat") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".dat") returned 0x0 [0094.355] lstrlenW (lpString=".DAT") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".DAT") returned 0x0 [0094.355] lstrlenW (lpString=".ldf") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".ldf") returned 0x0 [0094.355] lstrlenW (lpString=".LDF") returned 4 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch=".LDF") returned 0x0 [0094.355] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.355] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f8c0) returned 1 [0094.356] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.356] CryptReleaseContext (hProv=0x33f8c0, dwFlags=0x0) returned 1 [0094.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.356] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21435736675) returned 1 [0094.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc70da790, dwHighDateTime=0x1d585b4)) [0094.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfe88 [0094.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfe88 | out: hHeap=0x260000) returned 1 [0094.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.357] GetLastError () returned 0x0 [0094.357] GetLastError () returned 0x0 [0094.357] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.357] GetLastError () returned 0x0 [0094.358] GetLastError () returned 0x0 [0094.489] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffea6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.489] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1594, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x1594, lpOverlapped=0x0) returned 1 [0094.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.489] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.489] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.489] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.489] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.489] CloseHandle (hObject=0x11c) returned 1 [0094.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.492] GetLastError () returned 0x0 [0094.492] RtlWakeConditionVariable () returned 0x0 [0094.492] GetCurrentThreadId () returned 0x98c [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".ldf") returned 0x0 [0094.493] lstrlenW (lpString=".vhd") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".vhd") returned 0x0 [0094.493] lstrlenW (lpString=".vhdx") returned 5 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".vhdx") returned 0x0 [0094.493] lstrlenW (lpString=".pst") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".pst") returned 0x0 [0094.493] lstrlenW (lpString=".ost") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".ost") returned 0x0 [0094.493] lstrlenW (lpString=".bak") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".bak") returned 0x0 [0094.493] lstrlenW (lpString=".bac") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".bac") returned 0x0 [0094.493] lstrlenW (lpString=".sys") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".sys") returned 0x0 [0094.493] lstrlenW (lpString=".v2i") returned 4 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".v2i") returned 0x0 [0094.493] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.495] lstrlenW (lpString=".sql") returned 4 [0094.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".sql") returned 0x0 [0094.495] lstrlenW (lpString=".mdf") returned 4 [0094.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".mdf") returned 0x0 [0094.495] lstrlenW (lpString=".txt") returned 4 [0094.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".txt") returned 0x0 [0094.495] lstrlenW (lpString=".dbf") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".dbf") returned 0x0 [0094.496] lstrlenW (lpString=".ckp") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".ckp") returned 0x0 [0094.496] lstrlenW (lpString=".dacpac") returned 7 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".dacpac") returned 0x0 [0094.496] lstrlenW (lpString=".db3") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".db3") returned 0x0 [0094.496] lstrlenW (lpString=".dtxs") returned 5 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".dtxs") returned 0x0 [0094.496] lstrlenW (lpString=".mdt") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".mdt") returned 0x0 [0094.496] lstrlenW (lpString=".sdf") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".sdf") returned 0x0 [0094.496] lstrlenW (lpString=".MDF") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".MDF") returned 0x0 [0094.496] lstrlenW (lpString=".DBF") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".DBF") returned 0x0 [0094.496] lstrlenW (lpString=".DB") returned 3 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".DB") returned 0x0 [0094.496] lstrlenW (lpString=".db") returned 3 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".db") returned 0x0 [0094.496] lstrlenW (lpString=".ndf") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".ndf") returned 0x0 [0094.496] lstrlenW (lpString=".NDF") returned 4 [0094.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".NDF") returned 0x0 [0094.496] lstrlenW (lpString=".Mdf") returned 4 [0094.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".Mdf") returned 0x0 [0094.497] lstrlenW (lpString=".dat") returned 4 [0094.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".dat") returned 0x0 [0094.497] lstrlenW (lpString=".DAT") returned 4 [0094.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".DAT") returned 0x0 [0094.497] lstrlenW (lpString=".ldf") returned 4 [0094.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".ldf") returned 0x0 [0094.497] lstrlenW (lpString=".LDF") returned 4 [0094.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch=".LDF") returned 0x0 [0094.497] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.497] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f7b0) returned 1 [0094.498] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.498] CryptReleaseContext (hProv=0x33f7b0, dwFlags=0x0) returned 1 [0094.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.498] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21449921737) returned 1 [0094.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc72313f0, dwHighDateTime=0x1d585b4)) [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfec0 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfec0 | out: hHeap=0x260000) returned 1 [0094.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dc60 [0094.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.499] GetLastError () returned 0x0 [0094.499] GetLastError () returned 0x0 [0094.499] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.499] GetLastError () returned 0x0 [0094.500] GetLastError () returned 0x0 [0094.560] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe281, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.560] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1d7f, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x1d7f, lpOverlapped=0x0) returned 1 [0094.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.560] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.560] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.560] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.560] CloseHandle (hObject=0x11c) returned 1 [0094.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.562] GetLastError () returned 0x0 [0094.562] RtlWakeConditionVariable () returned 0x27e828 [0094.562] GetCurrentThreadId () returned 0x98c [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".ldf") returned 0x0 [0094.563] lstrlenW (lpString=".vhd") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".vhd") returned 0x0 [0094.563] lstrlenW (lpString=".vhdx") returned 5 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".vhdx") returned 0x0 [0094.563] lstrlenW (lpString=".pst") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".pst") returned 0x0 [0094.563] lstrlenW (lpString=".ost") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".ost") returned 0x0 [0094.563] lstrlenW (lpString=".bak") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".bak") returned 0x0 [0094.563] lstrlenW (lpString=".bac") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".bac") returned 0x0 [0094.563] lstrlenW (lpString=".sys") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".sys") returned 0x0 [0094.563] lstrlenW (lpString=".v2i") returned 4 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".v2i") returned 0x0 [0094.563] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.564] lstrlenW (lpString=".sql") returned 4 [0094.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".sql") returned 0x0 [0094.564] lstrlenW (lpString=".mdf") returned 4 [0094.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".mdf") returned 0x0 [0094.564] lstrlenW (lpString=".txt") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".txt") returned 0x0 [0094.565] lstrlenW (lpString=".dbf") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".dbf") returned 0x0 [0094.565] lstrlenW (lpString=".ckp") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".ckp") returned 0x0 [0094.565] lstrlenW (lpString=".dacpac") returned 7 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".dacpac") returned 0x0 [0094.565] lstrlenW (lpString=".db3") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".db3") returned 0x0 [0094.565] lstrlenW (lpString=".dtxs") returned 5 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".dtxs") returned 0x0 [0094.565] lstrlenW (lpString=".mdt") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".mdt") returned 0x0 [0094.565] lstrlenW (lpString=".sdf") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".sdf") returned 0x0 [0094.565] lstrlenW (lpString=".MDF") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".MDF") returned 0x0 [0094.565] lstrlenW (lpString=".DBF") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".DBF") returned 0x0 [0094.565] lstrlenW (lpString=".DB") returned 3 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".DB") returned 0x0 [0094.565] lstrlenW (lpString=".db") returned 3 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".db") returned 0x0 [0094.565] lstrlenW (lpString=".ndf") returned 4 [0094.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".ndf") returned 0x0 [0094.565] lstrlenW (lpString=".NDF") returned 4 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".NDF") returned 0x0 [0094.566] lstrlenW (lpString=".Mdf") returned 4 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".Mdf") returned 0x0 [0094.566] lstrlenW (lpString=".dat") returned 4 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".dat") returned 0x0 [0094.566] lstrlenW (lpString=".DAT") returned 4 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".DAT") returned 0x0 [0094.566] lstrlenW (lpString=".ldf") returned 4 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".ldf") returned 0x0 [0094.566] lstrlenW (lpString=".LDF") returned 4 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch=".LDF") returned 0x0 [0094.566] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.566] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33fa58) returned 1 [0094.568] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.568] CryptReleaseContext (hProv=0x33fa58, dwFlags=0x0) returned 1 [0094.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.568] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21456905736) returned 1 [0094.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc72efad0, dwHighDateTime=0x1d585b4)) [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dffa0 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dffa0 | out: hHeap=0x260000) returned 1 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29db30 [0094.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.569] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.569] GetLastError () returned 0x0 [0094.569] GetLastError () returned 0x0 [0094.569] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.569] GetLastError () returned 0x0 [0094.569] GetLastError () returned 0x0 [0094.574] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb41e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.574] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x4be2, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x4be2, lpOverlapped=0x0) returned 1 [0094.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.574] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.574] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.575] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.575] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.575] CloseHandle (hObject=0x11c) returned 1 [0094.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.575] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.576] GetLastError () returned 0x0 [0094.576] RtlWakeConditionVariable () returned 0x0 [0094.576] GetCurrentThreadId () returned 0x98c [0094.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".ldf") returned 0x0 [0094.577] lstrlenW (lpString=".vhd") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".vhd") returned 0x0 [0094.577] lstrlenW (lpString=".vhdx") returned 5 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".vhdx") returned 0x0 [0094.577] lstrlenW (lpString=".pst") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".pst") returned 0x0 [0094.577] lstrlenW (lpString=".ost") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".ost") returned 0x0 [0094.577] lstrlenW (lpString=".bak") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".bak") returned 0x0 [0094.577] lstrlenW (lpString=".bac") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".bac") returned 0x0 [0094.577] lstrlenW (lpString=".sys") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".sys") returned 0x0 [0094.577] lstrlenW (lpString=".v2i") returned 4 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".v2i") returned 0x0 [0094.577] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.578] lstrlenW (lpString=".sql") returned 4 [0094.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".sql") returned 0x0 [0094.578] lstrlenW (lpString=".mdf") returned 4 [0094.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".mdf") returned 0x0 [0094.578] lstrlenW (lpString=".txt") returned 4 [0094.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".txt") returned 0x0 [0094.578] lstrlenW (lpString=".dbf") returned 4 [0094.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".dbf") returned 0x0 [0094.579] lstrlenW (lpString=".ckp") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".ckp") returned 0x0 [0094.579] lstrlenW (lpString=".dacpac") returned 7 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".dacpac") returned 0x0 [0094.579] lstrlenW (lpString=".db3") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".db3") returned 0x0 [0094.579] lstrlenW (lpString=".dtxs") returned 5 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".dtxs") returned 0x0 [0094.579] lstrlenW (lpString=".mdt") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".mdt") returned 0x0 [0094.579] lstrlenW (lpString=".sdf") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".sdf") returned 0x0 [0094.579] lstrlenW (lpString=".MDF") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".MDF") returned 0x0 [0094.579] lstrlenW (lpString=".DBF") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".DBF") returned 0x0 [0094.579] lstrlenW (lpString=".DB") returned 3 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".DB") returned 0x0 [0094.579] lstrlenW (lpString=".db") returned 3 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".db") returned 0x0 [0094.579] lstrlenW (lpString=".ndf") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".ndf") returned 0x0 [0094.579] lstrlenW (lpString=".NDF") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".NDF") returned 0x0 [0094.579] lstrlenW (lpString=".Mdf") returned 4 [0094.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".Mdf") returned 0x0 [0094.580] lstrlenW (lpString=".dat") returned 4 [0094.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".dat") returned 0x0 [0094.580] lstrlenW (lpString=".DAT") returned 4 [0094.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".DAT") returned 0x0 [0094.580] lstrlenW (lpString=".ldf") returned 4 [0094.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".ldf") returned 0x0 [0094.580] lstrlenW (lpString=".LDF") returned 4 [0094.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch=".LDF") returned 0x0 [0094.580] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.580] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33fae0) returned 1 [0094.581] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.581] CryptReleaseContext (hProv=0x33fae0, dwFlags=0x0) returned 1 [0094.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.581] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21458215206) returned 1 [0094.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc72efad0, dwHighDateTime=0x1d585b4)) [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0010 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0010 | out: hHeap=0x260000) returned 1 [0094.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.582] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.582] GetLastError () returned 0x0 [0094.582] GetLastError () returned 0x0 [0094.582] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.582] GetLastError () returned 0x0 [0094.582] GetLastError () returned 0x0 [0094.584] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff044, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.584] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xfbc, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xfbc, lpOverlapped=0x0) returned 1 [0094.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.584] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.584] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.584] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.584] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.585] CloseHandle (hObject=0x11c) returned 1 [0094.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.586] GetLastError () returned 0x0 [0094.586] RtlWakeConditionVariable () returned 0x0 [0094.586] GetCurrentThreadId () returned 0x98c [0094.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".ldf") returned 0x0 [0094.586] lstrlenW (lpString=".vhd") returned 4 [0094.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".vhd") returned 0x0 [0094.587] lstrlenW (lpString=".vhdx") returned 5 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".vhdx") returned 0x0 [0094.587] lstrlenW (lpString=".pst") returned 4 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".pst") returned 0x0 [0094.587] lstrlenW (lpString=".ost") returned 4 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".ost") returned 0x0 [0094.587] lstrlenW (lpString=".bak") returned 4 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".bak") returned 0x0 [0094.587] lstrlenW (lpString=".bac") returned 4 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".bac") returned 0x0 [0094.587] lstrlenW (lpString=".sys") returned 4 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".sys") returned 0x0 [0094.587] lstrlenW (lpString=".v2i") returned 4 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".v2i") returned 0x0 [0094.587] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.588] lstrlenW (lpString=".sql") returned 4 [0094.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".sql") returned 0x0 [0094.588] lstrlenW (lpString=".mdf") returned 4 [0094.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".mdf") returned 0x0 [0094.588] lstrlenW (lpString=".txt") returned 4 [0094.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".txt") returned 0x0 [0094.588] lstrlenW (lpString=".dbf") returned 4 [0094.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".dbf") returned 0x0 [0094.588] lstrlenW (lpString=".ckp") returned 4 [0094.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".ckp") returned 0x0 [0094.589] lstrlenW (lpString=".dacpac") returned 7 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".dacpac") returned 0x0 [0094.589] lstrlenW (lpString=".db3") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".db3") returned 0x0 [0094.589] lstrlenW (lpString=".dtxs") returned 5 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".dtxs") returned 0x0 [0094.589] lstrlenW (lpString=".mdt") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".mdt") returned 0x0 [0094.589] lstrlenW (lpString=".sdf") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".sdf") returned 0x0 [0094.589] lstrlenW (lpString=".MDF") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".MDF") returned 0x0 [0094.589] lstrlenW (lpString=".DBF") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".DBF") returned 0x0 [0094.589] lstrlenW (lpString=".DB") returned 3 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".DB") returned 0x0 [0094.589] lstrlenW (lpString=".db") returned 3 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".db") returned 0x0 [0094.589] lstrlenW (lpString=".ndf") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".ndf") returned 0x0 [0094.589] lstrlenW (lpString=".NDF") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".NDF") returned 0x0 [0094.589] lstrlenW (lpString=".Mdf") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".Mdf") returned 0x0 [0094.589] lstrlenW (lpString=".dat") returned 4 [0094.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".dat") returned 0x0 [0094.590] lstrlenW (lpString=".DAT") returned 4 [0094.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".DAT") returned 0x0 [0094.590] lstrlenW (lpString=".ldf") returned 4 [0094.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".ldf") returned 0x0 [0094.590] lstrlenW (lpString=".LDF") returned 4 [0094.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch=".LDF") returned 0x0 [0094.590] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.590] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33fb68) returned 1 [0094.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.591] CryptReleaseContext (hProv=0x33fb68, dwFlags=0x0) returned 1 [0094.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.591] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21459203826) returned 1 [0094.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7315c30, dwHighDateTime=0x1d585b4)) [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0048 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0048 | out: hHeap=0x260000) returned 1 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.592] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.592] GetLastError () returned 0x0 [0094.592] GetLastError () returned 0x0 [0094.592] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.592] GetLastError () returned 0x0 [0094.592] GetLastError () returned 0x0 [0094.594] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8d3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.594] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72d, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x72d, lpOverlapped=0x0) returned 1 [0094.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.594] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.594] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.594] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.594] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.595] CloseHandle (hObject=0x11c) returned 1 [0094.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.596] GetLastError () returned 0x0 [0094.596] RtlWakeConditionVariable () returned 0x0 [0094.596] GetCurrentThreadId () returned 0x98c [0094.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".ldf") returned 0x0 [0094.596] lstrlenW (lpString=".vhd") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".vhd") returned 0x0 [0094.597] lstrlenW (lpString=".vhdx") returned 5 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".vhdx") returned 0x0 [0094.597] lstrlenW (lpString=".pst") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".pst") returned 0x0 [0094.597] lstrlenW (lpString=".ost") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".ost") returned 0x0 [0094.597] lstrlenW (lpString=".bak") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".bak") returned 0x0 [0094.597] lstrlenW (lpString=".bac") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".bac") returned 0x0 [0094.597] lstrlenW (lpString=".sys") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".sys") returned 0x0 [0094.597] lstrlenW (lpString=".v2i") returned 4 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".v2i") returned 0x0 [0094.597] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.600] lstrlenW (lpString=".sql") returned 4 [0094.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".sql") returned 0x0 [0094.600] lstrlenW (lpString=".mdf") returned 4 [0094.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".mdf") returned 0x0 [0094.600] lstrlenW (lpString=".txt") returned 4 [0094.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".txt") returned 0x0 [0094.600] lstrlenW (lpString=".dbf") returned 4 [0094.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".dbf") returned 0x0 [0094.600] lstrlenW (lpString=".ckp") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".ckp") returned 0x0 [0094.601] lstrlenW (lpString=".dacpac") returned 7 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".dacpac") returned 0x0 [0094.601] lstrlenW (lpString=".db3") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".db3") returned 0x0 [0094.601] lstrlenW (lpString=".dtxs") returned 5 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".dtxs") returned 0x0 [0094.601] lstrlenW (lpString=".mdt") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".mdt") returned 0x0 [0094.601] lstrlenW (lpString=".sdf") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".sdf") returned 0x0 [0094.601] lstrlenW (lpString=".MDF") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".MDF") returned 0x0 [0094.601] lstrlenW (lpString=".DBF") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".DBF") returned 0x0 [0094.601] lstrlenW (lpString=".DB") returned 3 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".DB") returned 0x0 [0094.601] lstrlenW (lpString=".db") returned 3 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".db") returned 0x0 [0094.601] lstrlenW (lpString=".ndf") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".ndf") returned 0x0 [0094.601] lstrlenW (lpString=".NDF") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".NDF") returned 0x0 [0094.601] lstrlenW (lpString=".Mdf") returned 4 [0094.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".Mdf") returned 0x0 [0094.601] lstrlenW (lpString=".dat") returned 4 [0094.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".dat") returned 0x0 [0094.602] lstrlenW (lpString=".DAT") returned 4 [0094.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".DAT") returned 0x0 [0094.602] lstrlenW (lpString=".ldf") returned 4 [0094.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".ldf") returned 0x0 [0094.602] lstrlenW (lpString=".LDF") returned 4 [0094.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch=".LDF") returned 0x0 [0094.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.602] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33fbf0) returned 1 [0094.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.603] CryptReleaseContext (hProv=0x33fbf0, dwFlags=0x0) returned 1 [0094.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.603] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21460407200) returned 1 [0094.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc733bd90, dwHighDateTime=0x1d585b4)) [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0080 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0080 | out: hHeap=0x260000) returned 1 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.604] GetLastError () returned 0x0 [0094.604] GetLastError () returned 0x0 [0094.604] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.604] GetLastError () returned 0x0 [0094.604] GetLastError () returned 0x0 [0094.609] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc27c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.609] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3d84, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3d84, lpOverlapped=0x0) returned 1 [0094.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.612] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.612] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.612] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.612] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.612] CloseHandle (hObject=0xd8) returned 1 [0094.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.614] GetLastError () returned 0x0 [0094.614] RtlWakeConditionVariable () returned 0x0 [0094.614] GetCurrentThreadId () returned 0x98c [0094.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".ldf") returned 0x0 [0094.614] lstrlenW (lpString=".vhd") returned 4 [0094.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".vhd") returned 0x0 [0094.614] lstrlenW (lpString=".vhdx") returned 5 [0094.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".vhdx") returned 0x0 [0094.614] lstrlenW (lpString=".pst") returned 4 [0094.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".pst") returned 0x0 [0094.614] lstrlenW (lpString=".ost") returned 4 [0094.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".ost") returned 0x0 [0094.615] lstrlenW (lpString=".bak") returned 4 [0094.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".bak") returned 0x0 [0094.615] lstrlenW (lpString=".bac") returned 4 [0094.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".bac") returned 0x0 [0094.615] lstrlenW (lpString=".sys") returned 4 [0094.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".sys") returned 0x0 [0094.615] lstrlenW (lpString=".v2i") returned 4 [0094.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".v2i") returned 0x0 [0094.615] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.616] lstrlenW (lpString=".sql") returned 4 [0094.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".sql") returned 0x0 [0094.616] lstrlenW (lpString=".mdf") returned 4 [0094.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".mdf") returned 0x0 [0094.616] lstrlenW (lpString=".txt") returned 4 [0094.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".txt") returned 0x0 [0094.616] lstrlenW (lpString=".dbf") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".dbf") returned 0x0 [0094.617] lstrlenW (lpString=".ckp") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".ckp") returned 0x0 [0094.617] lstrlenW (lpString=".dacpac") returned 7 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".dacpac") returned 0x0 [0094.617] lstrlenW (lpString=".db3") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".db3") returned 0x0 [0094.617] lstrlenW (lpString=".dtxs") returned 5 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".dtxs") returned 0x0 [0094.617] lstrlenW (lpString=".mdt") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".mdt") returned 0x0 [0094.617] lstrlenW (lpString=".sdf") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".sdf") returned 0x0 [0094.617] lstrlenW (lpString=".MDF") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".MDF") returned 0x0 [0094.617] lstrlenW (lpString=".DBF") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".DBF") returned 0x0 [0094.617] lstrlenW (lpString=".DB") returned 3 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".DB") returned 0x0 [0094.617] lstrlenW (lpString=".db") returned 3 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".db") returned 0x0 [0094.617] lstrlenW (lpString=".ndf") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".ndf") returned 0x0 [0094.617] lstrlenW (lpString=".NDF") returned 4 [0094.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".NDF") returned 0x0 [0094.617] lstrlenW (lpString=".Mdf") returned 4 [0094.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".Mdf") returned 0x0 [0094.618] lstrlenW (lpString=".dat") returned 4 [0094.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".dat") returned 0x0 [0094.618] lstrlenW (lpString=".DAT") returned 4 [0094.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".DAT") returned 0x0 [0094.618] lstrlenW (lpString=".ldf") returned 4 [0094.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".ldf") returned 0x0 [0094.618] lstrlenW (lpString=".LDF") returned 4 [0094.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch=".LDF") returned 0x0 [0094.618] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.618] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f480) returned 1 [0094.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.619] CryptReleaseContext (hProv=0x33f480, dwFlags=0x0) returned 1 [0094.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.619] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21462014383) returned 1 [0094.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7361ef0, dwHighDateTime=0x1d585b4)) [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e00b8 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e00b8 | out: hHeap=0x260000) returned 1 [0094.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.620] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.620] GetLastError () returned 0x0 [0094.620] GetLastError () returned 0x0 [0094.620] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.620] GetLastError () returned 0x0 [0094.620] GetLastError () returned 0x0 [0094.635] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe99c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.635] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1664, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1664, lpOverlapped=0x0) returned 1 [0094.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.635] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.635] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.635] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.636] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.636] CloseHandle (hObject=0xd8) returned 1 [0094.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.722] GetLastError () returned 0x0 [0094.722] RtlWakeConditionVariable () returned 0x0 [0094.722] GetCurrentThreadId () returned 0x98c [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".ldf") returned 0x0 [0094.722] lstrlenW (lpString=".vhd") returned 4 [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".vhd") returned 0x0 [0094.722] lstrlenW (lpString=".vhdx") returned 5 [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".vhdx") returned 0x0 [0094.722] lstrlenW (lpString=".pst") returned 4 [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".pst") returned 0x0 [0094.722] lstrlenW (lpString=".ost") returned 4 [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".ost") returned 0x0 [0094.722] lstrlenW (lpString=".bak") returned 4 [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".bak") returned 0x0 [0094.722] lstrlenW (lpString=".bac") returned 4 [0094.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".bac") returned 0x0 [0094.722] lstrlenW (lpString=".sys") returned 4 [0094.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".sys") returned 0x0 [0094.723] lstrlenW (lpString=".v2i") returned 4 [0094.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".v2i") returned 0x0 [0094.723] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.725] lstrlenW (lpString=".sql") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".sql") returned 0x0 [0094.725] lstrlenW (lpString=".mdf") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".mdf") returned 0x0 [0094.725] lstrlenW (lpString=".txt") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".txt") returned 0x0 [0094.725] lstrlenW (lpString=".dbf") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".dbf") returned 0x0 [0094.725] lstrlenW (lpString=".ckp") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".ckp") returned 0x0 [0094.725] lstrlenW (lpString=".dacpac") returned 7 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".dacpac") returned 0x0 [0094.725] lstrlenW (lpString=".db3") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".db3") returned 0x0 [0094.725] lstrlenW (lpString=".dtxs") returned 5 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".dtxs") returned 0x0 [0094.725] lstrlenW (lpString=".mdt") returned 4 [0094.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".mdt") returned 0x0 [0094.726] lstrlenW (lpString=".sdf") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".sdf") returned 0x0 [0094.726] lstrlenW (lpString=".MDF") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".MDF") returned 0x0 [0094.726] lstrlenW (lpString=".DBF") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".DBF") returned 0x0 [0094.726] lstrlenW (lpString=".DB") returned 3 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".DB") returned 0x0 [0094.726] lstrlenW (lpString=".db") returned 3 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".db") returned 0x0 [0094.726] lstrlenW (lpString=".ndf") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".ndf") returned 0x0 [0094.726] lstrlenW (lpString=".NDF") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".NDF") returned 0x0 [0094.726] lstrlenW (lpString=".Mdf") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".Mdf") returned 0x0 [0094.726] lstrlenW (lpString=".dat") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".dat") returned 0x0 [0094.726] lstrlenW (lpString=".DAT") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".DAT") returned 0x0 [0094.726] lstrlenW (lpString=".ldf") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".ldf") returned 0x0 [0094.726] lstrlenW (lpString=".LDF") returned 4 [0094.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch=".LDF") returned 0x0 [0094.726] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.727] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33f150) returned 1 [0094.727] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.727] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.728] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21472871757) returned 1 [0094.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc746c890, dwHighDateTime=0x1d585b4)) [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e02b0 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e02b0 | out: hHeap=0x260000) returned 1 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317f90 [0094.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317f90 | out: hHeap=0x260000) returned 1 [0094.728] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.728] GetLastError () returned 0x0 [0094.729] GetLastError () returned 0x0 [0094.729] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.729] GetLastError () returned 0x0 [0094.729] GetLastError () returned 0x0 [0094.783] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd6a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.783] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x295c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x295c, lpOverlapped=0x0) returned 1 [0094.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.783] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.783] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.783] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.784] CloseHandle (hObject=0xd8) returned 1 [0094.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.785] GetLastError () returned 0x0 [0094.785] RtlWakeConditionVariable () returned 0x0 [0094.786] GetCurrentThreadId () returned 0x98c [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".ldf") returned 0x0 [0094.786] lstrlenW (lpString=".vhd") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".vhd") returned 0x0 [0094.786] lstrlenW (lpString=".vhdx") returned 5 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".vhdx") returned 0x0 [0094.786] lstrlenW (lpString=".pst") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".pst") returned 0x0 [0094.786] lstrlenW (lpString=".ost") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".ost") returned 0x0 [0094.786] lstrlenW (lpString=".bak") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".bak") returned 0x0 [0094.786] lstrlenW (lpString=".bac") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".bac") returned 0x0 [0094.786] lstrlenW (lpString=".sys") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".sys") returned 0x0 [0094.786] lstrlenW (lpString=".v2i") returned 4 [0094.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".v2i") returned 0x0 [0094.787] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.788] lstrlenW (lpString=".sql") returned 4 [0094.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".sql") returned 0x0 [0094.788] lstrlenW (lpString=".mdf") returned 4 [0094.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".mdf") returned 0x0 [0094.788] lstrlenW (lpString=".txt") returned 4 [0094.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".txt") returned 0x0 [0094.788] lstrlenW (lpString=".dbf") returned 4 [0094.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".dbf") returned 0x0 [0094.788] lstrlenW (lpString=".ckp") returned 4 [0094.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".ckp") returned 0x0 [0094.788] lstrlenW (lpString=".dacpac") returned 7 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".dacpac") returned 0x0 [0094.822] lstrlenW (lpString=".db3") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".db3") returned 0x0 [0094.822] lstrlenW (lpString=".dtxs") returned 5 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".dtxs") returned 0x0 [0094.822] lstrlenW (lpString=".mdt") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".mdt") returned 0x0 [0094.822] lstrlenW (lpString=".sdf") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".sdf") returned 0x0 [0094.822] lstrlenW (lpString=".MDF") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".MDF") returned 0x0 [0094.822] lstrlenW (lpString=".DBF") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".DBF") returned 0x0 [0094.822] lstrlenW (lpString=".DB") returned 3 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".DB") returned 0x0 [0094.822] lstrlenW (lpString=".db") returned 3 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".db") returned 0x0 [0094.822] lstrlenW (lpString=".ndf") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".ndf") returned 0x0 [0094.822] lstrlenW (lpString=".NDF") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".NDF") returned 0x0 [0094.822] lstrlenW (lpString=".Mdf") returned 4 [0094.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".Mdf") returned 0x0 [0094.822] lstrlenW (lpString=".dat") returned 4 [0094.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".dat") returned 0x0 [0094.823] lstrlenW (lpString=".DAT") returned 4 [0094.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".DAT") returned 0x0 [0094.823] lstrlenW (lpString=".ldf") returned 4 [0094.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".ldf") returned 0x0 [0094.823] lstrlenW (lpString=".LDF") returned 4 [0094.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch=".LDF") returned 0x0 [0094.823] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.823] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33fd00) returned 1 [0094.824] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.824] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.824] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21482499847) returned 1 [0094.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc75510d0, dwHighDateTime=0x1d585b4)) [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0470 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0470 | out: hHeap=0x260000) returned 1 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.825] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.825] GetLastError () returned 0x0 [0094.825] GetLastError () returned 0x0 [0094.825] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.825] GetLastError () returned 0x0 [0094.825] GetLastError () returned 0x0 [0094.838] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffb668, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.839] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4998, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x4998, lpOverlapped=0x0) returned 1 [0094.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.839] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.839] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.839] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.839] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.839] CloseHandle (hObject=0xd8) returned 1 [0094.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.842] GetLastError () returned 0x0 [0094.842] RtlWakeConditionVariable () returned 0x0 [0094.842] GetCurrentThreadId () returned 0x98c [0094.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".ldf") returned 0x0 [0094.842] lstrlenW (lpString=".vhd") returned 4 [0094.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".vhd") returned 0x0 [0094.842] lstrlenW (lpString=".vhdx") returned 5 [0094.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".vhdx") returned 0x0 [0094.842] lstrlenW (lpString=".pst") returned 4 [0094.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".pst") returned 0x0 [0094.843] lstrlenW (lpString=".ost") returned 4 [0094.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".ost") returned 0x0 [0094.843] lstrlenW (lpString=".bak") returned 4 [0094.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".bak") returned 0x0 [0094.843] lstrlenW (lpString=".bac") returned 4 [0094.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".bac") returned 0x0 [0094.843] lstrlenW (lpString=".sys") returned 4 [0094.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".sys") returned 0x0 [0094.843] lstrlenW (lpString=".v2i") returned 4 [0094.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".v2i") returned 0x0 [0094.843] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.856] lstrlenW (lpString=".sql") returned 4 [0094.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".sql") returned 0x0 [0094.856] lstrlenW (lpString=".mdf") returned 4 [0094.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".mdf") returned 0x0 [0094.856] lstrlenW (lpString=".txt") returned 4 [0094.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".txt") returned 0x0 [0094.856] lstrlenW (lpString=".dbf") returned 4 [0094.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".dbf") returned 0x0 [0094.857] lstrlenW (lpString=".ckp") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".ckp") returned 0x0 [0094.857] lstrlenW (lpString=".dacpac") returned 7 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".dacpac") returned 0x0 [0094.857] lstrlenW (lpString=".db3") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".db3") returned 0x0 [0094.857] lstrlenW (lpString=".dtxs") returned 5 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".dtxs") returned 0x0 [0094.857] lstrlenW (lpString=".mdt") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".mdt") returned 0x0 [0094.857] lstrlenW (lpString=".sdf") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".sdf") returned 0x0 [0094.857] lstrlenW (lpString=".MDF") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".MDF") returned 0x0 [0094.857] lstrlenW (lpString=".DBF") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".DBF") returned 0x0 [0094.857] lstrlenW (lpString=".DB") returned 3 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".DB") returned 0x0 [0094.857] lstrlenW (lpString=".db") returned 3 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".db") returned 0x0 [0094.857] lstrlenW (lpString=".ndf") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".ndf") returned 0x0 [0094.857] lstrlenW (lpString=".NDF") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".NDF") returned 0x0 [0094.857] lstrlenW (lpString=".Mdf") returned 4 [0094.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".Mdf") returned 0x0 [0094.858] lstrlenW (lpString=".dat") returned 4 [0094.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".dat") returned 0x0 [0094.858] lstrlenW (lpString=".DAT") returned 4 [0094.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".DAT") returned 0x0 [0094.858] lstrlenW (lpString=".ldf") returned 4 [0094.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".ldf") returned 0x0 [0094.858] lstrlenW (lpString=".LDF") returned 4 [0094.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch=".LDF") returned 0x0 [0094.858] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.858] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33fd00) returned 1 [0094.859] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.859] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.859] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21486005263) returned 1 [0094.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc759d390, dwHighDateTime=0x1d585b4)) [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0518 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0518 | out: hHeap=0x260000) returned 1 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.860] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0094.860] GetLastError () returned 0x0 [0094.860] GetLastError () returned 0x0 [0094.860] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0094.860] GetLastError () returned 0x0 [0094.860] GetLastError () returned 0x0 [0094.889] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.889] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.891] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.891] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.962] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.962] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.036] CloseHandle (hObject=0xd8) returned 1 [0095.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0095.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.[deadmin@cock.li].deadmin")) returned 1 [0095.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0095.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.037] GetLastError () returned 0x0 [0095.037] RtlWakeConditionVariable () returned 0x0 [0095.037] GetCurrentThreadId () returned 0x98c [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".ldf") returned 0x0 [0095.038] lstrlenW (lpString=".vhd") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".vhd") returned 0x0 [0095.038] lstrlenW (lpString=".vhdx") returned 5 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".vhdx") returned 0x0 [0095.038] lstrlenW (lpString=".pst") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".pst") returned 0x0 [0095.038] lstrlenW (lpString=".ost") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".ost") returned 0x0 [0095.038] lstrlenW (lpString=".bak") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".bak") returned 0x0 [0095.038] lstrlenW (lpString=".bac") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".bac") returned 0x0 [0095.038] lstrlenW (lpString=".sys") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".sys") returned 0x0 [0095.038] lstrlenW (lpString=".v2i") returned 4 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".v2i") returned 0x0 [0095.038] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.039] lstrlenW (lpString=".sql") returned 4 [0095.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".sql") returned 0x0 [0095.039] lstrlenW (lpString=".mdf") returned 4 [0095.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".mdf") returned 0x0 [0095.040] lstrlenW (lpString=".txt") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".txt") returned 0x0 [0095.040] lstrlenW (lpString=".dbf") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".dbf") returned 0x0 [0095.040] lstrlenW (lpString=".ckp") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".ckp") returned 0x0 [0095.040] lstrlenW (lpString=".dacpac") returned 7 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".dacpac") returned 0x0 [0095.040] lstrlenW (lpString=".db3") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".db3") returned 0x0 [0095.040] lstrlenW (lpString=".dtxs") returned 5 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".dtxs") returned 0x0 [0095.040] lstrlenW (lpString=".mdt") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".mdt") returned 0x0 [0095.040] lstrlenW (lpString=".sdf") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".sdf") returned 0x0 [0095.040] lstrlenW (lpString=".MDF") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".MDF") returned 0x0 [0095.040] lstrlenW (lpString=".DBF") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".DBF") returned 0x0 [0095.040] lstrlenW (lpString=".DB") returned 3 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".DB") returned 0x0 [0095.040] lstrlenW (lpString=".db") returned 3 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".db") returned 0x0 [0095.040] lstrlenW (lpString=".ndf") returned 4 [0095.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".ndf") returned 0x0 [0095.041] lstrlenW (lpString=".NDF") returned 4 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".NDF") returned 0x0 [0095.041] lstrlenW (lpString=".Mdf") returned 4 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".Mdf") returned 0x0 [0095.041] lstrlenW (lpString=".dat") returned 4 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".dat") returned 0x0 [0095.041] lstrlenW (lpString=".DAT") returned 4 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".DAT") returned 0x0 [0095.041] lstrlenW (lpString=".ldf") returned 4 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".ldf") returned 0x0 [0095.041] lstrlenW (lpString=".LDF") returned 4 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch=".LDF") returned 0x0 [0095.041] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.041] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33ff20) returned 1 [0095.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.042] CryptReleaseContext (hProv=0x33ff20, dwFlags=0x0) returned 1 [0095.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.042] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21504328694) returned 1 [0095.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7766410, dwHighDateTime=0x1d585b4)) [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0780 [0095.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0780 | out: hHeap=0x260000) returned 1 [0095.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0095.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.043] GetLastError () returned 0x0 [0095.043] GetLastError () returned 0x0 [0095.043] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.043] GetLastError () returned 0x0 [0095.044] GetLastError () returned 0x0 [0095.046] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.046] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.047] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.047] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.050] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.050] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.050] CloseHandle (hObject=0xd8) returned 1 [0095.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.052] GetLastError () returned 0x0 [0095.052] RtlWakeConditionVariable () returned 0x0 [0095.052] GetCurrentThreadId () returned 0x98c [0095.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".ldf") returned 0x0 [0095.052] lstrlenW (lpString=".vhd") returned 4 [0095.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".vhd") returned 0x0 [0095.052] lstrlenW (lpString=".vhdx") returned 5 [0095.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".vhdx") returned 0x0 [0095.053] lstrlenW (lpString=".pst") returned 4 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".pst") returned 0x0 [0095.053] lstrlenW (lpString=".ost") returned 4 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".ost") returned 0x0 [0095.053] lstrlenW (lpString=".bak") returned 4 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".bak") returned 0x0 [0095.053] lstrlenW (lpString=".bac") returned 4 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".bac") returned 0x0 [0095.053] lstrlenW (lpString=".sys") returned 4 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".sys") returned 0x0 [0095.053] lstrlenW (lpString=".v2i") returned 4 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".v2i") returned 0x0 [0095.053] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.056] lstrlenW (lpString=".sql") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".sql") returned 0x0 [0095.056] lstrlenW (lpString=".mdf") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".mdf") returned 0x0 [0095.056] lstrlenW (lpString=".txt") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".txt") returned 0x0 [0095.056] lstrlenW (lpString=".dbf") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".dbf") returned 0x0 [0095.056] lstrlenW (lpString=".ckp") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".ckp") returned 0x0 [0095.056] lstrlenW (lpString=".dacpac") returned 7 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".dacpac") returned 0x0 [0095.056] lstrlenW (lpString=".db3") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".db3") returned 0x0 [0095.056] lstrlenW (lpString=".dtxs") returned 5 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".dtxs") returned 0x0 [0095.056] lstrlenW (lpString=".mdt") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".mdt") returned 0x0 [0095.056] lstrlenW (lpString=".sdf") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".sdf") returned 0x0 [0095.056] lstrlenW (lpString=".MDF") returned 4 [0095.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".MDF") returned 0x0 [0095.057] lstrlenW (lpString=".DBF") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".DBF") returned 0x0 [0095.057] lstrlenW (lpString=".DB") returned 3 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".DB") returned 0x0 [0095.057] lstrlenW (lpString=".db") returned 3 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".db") returned 0x0 [0095.057] lstrlenW (lpString=".ndf") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".ndf") returned 0x0 [0095.057] lstrlenW (lpString=".NDF") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".NDF") returned 0x0 [0095.057] lstrlenW (lpString=".Mdf") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".Mdf") returned 0x0 [0095.057] lstrlenW (lpString=".dat") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".dat") returned 0x0 [0095.057] lstrlenW (lpString=".DAT") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".DAT") returned 0x0 [0095.057] lstrlenW (lpString=".ldf") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".ldf") returned 0x0 [0095.057] lstrlenW (lpString=".LDF") returned 4 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch=".LDF") returned 0x0 [0095.057] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.057] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x340140) returned 1 [0095.058] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.058] CryptReleaseContext (hProv=0x340140, dwFlags=0x0) returned 1 [0095.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.058] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21505959890) returned 1 [0095.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc778c570, dwHighDateTime=0x1d585b4)) [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e07b8 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e07b8 | out: hHeap=0x260000) returned 1 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0095.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.059] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.059] GetLastError () returned 0x0 [0095.060] GetLastError () returned 0x0 [0095.060] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.060] GetLastError () returned 0x0 [0095.060] GetLastError () returned 0x0 [0095.076] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.077] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.077] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.077] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.082] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.083] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.083] CloseHandle (hObject=0xd8) returned 1 [0095.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.085] GetLastError () returned 0x0 [0095.085] RtlWakeConditionVariable () returned 0x0 [0095.085] GetCurrentThreadId () returned 0x98c [0095.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".ldf") returned 0x0 [0095.085] lstrlenW (lpString=".vhd") returned 4 [0095.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".vhd") returned 0x0 [0095.085] lstrlenW (lpString=".vhdx") returned 5 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".vhdx") returned 0x0 [0095.086] lstrlenW (lpString=".pst") returned 4 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".pst") returned 0x0 [0095.086] lstrlenW (lpString=".ost") returned 4 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".ost") returned 0x0 [0095.086] lstrlenW (lpString=".bak") returned 4 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".bak") returned 0x0 [0095.086] lstrlenW (lpString=".bac") returned 4 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".bac") returned 0x0 [0095.086] lstrlenW (lpString=".sys") returned 4 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".sys") returned 0x0 [0095.086] lstrlenW (lpString=".v2i") returned 4 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".v2i") returned 0x0 [0095.086] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch="s\r\n.v2i") returned 0x0 [0095.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.088] lstrlenW (lpString=".sql") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".sql") returned 0x0 [0095.088] lstrlenW (lpString=".mdf") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".mdf") returned 0x0 [0095.088] lstrlenW (lpString=".txt") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".txt") returned 0x0 [0095.088] lstrlenW (lpString=".dbf") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".dbf") returned 0x0 [0095.088] lstrlenW (lpString=".ckp") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".ckp") returned 0x0 [0095.088] lstrlenW (lpString=".dacpac") returned 7 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".dacpac") returned 0x0 [0095.088] lstrlenW (lpString=".db3") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".db3") returned 0x0 [0095.088] lstrlenW (lpString=".dtxs") returned 5 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".dtxs") returned 0x0 [0095.088] lstrlenW (lpString=".mdt") returned 4 [0095.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".mdt") returned 0x0 [0095.088] lstrlenW (lpString=".sdf") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".sdf") returned 0x0 [0095.089] lstrlenW (lpString=".MDF") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".MDF") returned 0x0 [0095.089] lstrlenW (lpString=".DBF") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".DBF") returned 0x0 [0095.089] lstrlenW (lpString=".DB") returned 3 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".DB") returned 0x0 [0095.089] lstrlenW (lpString=".db") returned 3 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".db") returned 0x0 [0095.089] lstrlenW (lpString=".ndf") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".ndf") returned 0x0 [0095.089] lstrlenW (lpString=".NDF") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".NDF") returned 0x0 [0095.089] lstrlenW (lpString=".Mdf") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".Mdf") returned 0x0 [0095.089] lstrlenW (lpString=".dat") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".dat") returned 0x0 [0095.089] lstrlenW (lpString=".DAT") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".DAT") returned 0x0 [0095.089] lstrlenW (lpString=".ldf") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".ldf") returned 0x0 [0095.089] lstrlenW (lpString=".LDF") returned 4 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch=".LDF") returned 0x0 [0095.089] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.090] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x3401c8) returned 1 [0095.090] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.090] CryptReleaseContext (hProv=0x3401c8, dwFlags=0x0) returned 1 [0095.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.091] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21509168618) returned 1 [0095.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc77d8830, dwHighDateTime=0x1d585b4)) [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e07f0 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e07f0 | out: hHeap=0x260000) returned 1 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0095.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.091] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.091] GetLastError () returned 0x0 [0095.092] GetLastError () returned 0x0 [0095.092] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.092] GetLastError () returned 0x0 [0095.092] GetLastError () returned 0x0 [0095.120] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.120] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.121] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.121] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.235] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.235] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.235] CloseHandle (hObject=0xd8) returned 1 [0095.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.[deadmin@cock.li].deadmin")) returned 1 [0095.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.246] GetLastError () returned 0x0 [0095.246] RtlWakeConditionVariable () returned 0x0 [0095.246] GetCurrentThreadId () returned 0x98c [0095.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".ldf") returned 0x0 [0095.246] lstrlenW (lpString=".vhd") returned 4 [0095.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".vhd") returned 0x0 [0095.246] lstrlenW (lpString=".vhdx") returned 5 [0095.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".vhdx") returned 0x0 [0095.246] lstrlenW (lpString=".pst") returned 4 [0095.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".pst") returned 0x0 [0095.247] lstrlenW (lpString=".ost") returned 4 [0095.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".ost") returned 0x0 [0095.247] lstrlenW (lpString=".bak") returned 4 [0095.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".bak") returned 0x0 [0095.247] lstrlenW (lpString=".bac") returned 4 [0095.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".bac") returned 0x0 [0095.247] lstrlenW (lpString=".sys") returned 4 [0095.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".sys") returned 0x0 [0095.247] lstrlenW (lpString=".v2i") returned 4 [0095.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".v2i") returned 0x0 [0095.247] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.249] lstrlenW (lpString=".sql") returned 4 [0095.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".sql") returned 0x0 [0095.249] lstrlenW (lpString=".mdf") returned 4 [0095.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".mdf") returned 0x0 [0095.249] lstrlenW (lpString=".txt") returned 4 [0095.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".txt") returned 0x0 [0095.249] lstrlenW (lpString=".dbf") returned 4 [0095.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".dbf") returned 0x0 [0095.250] lstrlenW (lpString=".ckp") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".ckp") returned 0x0 [0095.250] lstrlenW (lpString=".dacpac") returned 7 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".dacpac") returned 0x0 [0095.250] lstrlenW (lpString=".db3") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".db3") returned 0x0 [0095.250] lstrlenW (lpString=".dtxs") returned 5 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".dtxs") returned 0x0 [0095.250] lstrlenW (lpString=".mdt") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".mdt") returned 0x0 [0095.250] lstrlenW (lpString=".sdf") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".sdf") returned 0x0 [0095.250] lstrlenW (lpString=".MDF") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".MDF") returned 0x0 [0095.250] lstrlenW (lpString=".DBF") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".DBF") returned 0x0 [0095.250] lstrlenW (lpString=".DB") returned 3 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".DB") returned 0x0 [0095.250] lstrlenW (lpString=".db") returned 3 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".db") returned 0x0 [0095.250] lstrlenW (lpString=".ndf") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".ndf") returned 0x0 [0095.250] lstrlenW (lpString=".NDF") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".NDF") returned 0x0 [0095.250] lstrlenW (lpString=".Mdf") returned 4 [0095.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".Mdf") returned 0x0 [0095.251] lstrlenW (lpString=".dat") returned 4 [0095.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".dat") returned 0x0 [0095.251] lstrlenW (lpString=".DAT") returned 4 [0095.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".DAT") returned 0x0 [0095.251] lstrlenW (lpString=".ldf") returned 4 [0095.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".ldf") returned 0x0 [0095.251] lstrlenW (lpString=".LDF") returned 4 [0095.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch=".LDF") returned 0x0 [0095.251] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.251] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e52a8) returned 1 [0095.252] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.252] CryptReleaseContext (hProv=0x27e52a8, dwFlags=0x0) returned 1 [0095.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.252] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21525311779) returned 1 [0095.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc79555f0, dwHighDateTime=0x1d585b4)) [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0a20 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0a20 | out: hHeap=0x260000) returned 1 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.253] GetLastError () returned 0x0 [0095.253] GetLastError () returned 0x0 [0095.253] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.253] GetLastError () returned 0x0 [0095.253] GetLastError () returned 0x0 [0095.299] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.299] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.299] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.299] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.303] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.303] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.303] CloseHandle (hObject=0xd8) returned 1 [0095.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.306] GetLastError () returned 0x0 [0095.306] RtlWakeConditionVariable () returned 0x0 [0095.306] GetCurrentThreadId () returned 0x98c [0095.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".ldf") returned 0x0 [0095.306] lstrlenW (lpString=".vhd") returned 4 [0095.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".vhd") returned 0x0 [0095.307] lstrlenW (lpString=".vhdx") returned 5 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".vhdx") returned 0x0 [0095.307] lstrlenW (lpString=".pst") returned 4 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".pst") returned 0x0 [0095.307] lstrlenW (lpString=".ost") returned 4 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".ost") returned 0x0 [0095.307] lstrlenW (lpString=".bak") returned 4 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".bak") returned 0x0 [0095.307] lstrlenW (lpString=".bac") returned 4 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".bac") returned 0x0 [0095.307] lstrlenW (lpString=".sys") returned 4 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".sys") returned 0x0 [0095.307] lstrlenW (lpString=".v2i") returned 4 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".v2i") returned 0x0 [0095.307] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch="s\r\n.v2i") returned 0x0 [0095.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.309] lstrlenW (lpString=".sql") returned 4 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".sql") returned 0x0 [0095.309] lstrlenW (lpString=".mdf") returned 4 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".mdf") returned 0x0 [0095.309] lstrlenW (lpString=".txt") returned 4 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".txt") returned 0x0 [0095.309] lstrlenW (lpString=".dbf") returned 4 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".dbf") returned 0x0 [0095.309] lstrlenW (lpString=".ckp") returned 4 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".ckp") returned 0x0 [0095.309] lstrlenW (lpString=".dacpac") returned 7 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".dacpac") returned 0x0 [0095.309] lstrlenW (lpString=".db3") returned 4 [0095.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".db3") returned 0x0 [0095.310] lstrlenW (lpString=".dtxs") returned 5 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".dtxs") returned 0x0 [0095.310] lstrlenW (lpString=".mdt") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".mdt") returned 0x0 [0095.310] lstrlenW (lpString=".sdf") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".sdf") returned 0x0 [0095.310] lstrlenW (lpString=".MDF") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".MDF") returned 0x0 [0095.310] lstrlenW (lpString=".DBF") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".DBF") returned 0x0 [0095.310] lstrlenW (lpString=".DB") returned 3 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".DB") returned 0x0 [0095.310] lstrlenW (lpString=".db") returned 3 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".db") returned 0x0 [0095.310] lstrlenW (lpString=".ndf") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".ndf") returned 0x0 [0095.310] lstrlenW (lpString=".NDF") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".NDF") returned 0x0 [0095.310] lstrlenW (lpString=".Mdf") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".Mdf") returned 0x0 [0095.310] lstrlenW (lpString=".dat") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".dat") returned 0x0 [0095.310] lstrlenW (lpString=".DAT") returned 4 [0095.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".DAT") returned 0x0 [0095.310] lstrlenW (lpString=".ldf") returned 4 [0095.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".ldf") returned 0x0 [0095.311] lstrlenW (lpString=".LDF") returned 4 [0095.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch=".LDF") returned 0x0 [0095.311] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.311] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e54c8) returned 1 [0095.312] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.312] CryptReleaseContext (hProv=0x27e54c8, dwFlags=0x0) returned 1 [0095.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.312] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21531292778) returned 1 [0095.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc79edb70, dwHighDateTime=0x1d585b4)) [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0ac8 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0ac8 | out: hHeap=0x260000) returned 1 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.313] GetLastError () returned 0x0 [0095.313] GetLastError () returned 0x0 [0095.313] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.313] GetLastError () returned 0x0 [0095.313] GetLastError () returned 0x0 [0095.315] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.315] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc00, lpOverlapped=0x0) returned 1 [0095.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.315] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.315] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.315] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.315] CloseHandle (hObject=0xd8) returned 1 [0095.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.[deadmin@cock.li].deadmin")) returned 1 [0095.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.317] GetLastError () returned 0x0 [0095.318] RtlWakeConditionVariable () returned 0x27e828 [0095.318] GetCurrentThreadId () returned 0x98c [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".ldf") returned 0x0 [0095.318] lstrlenW (lpString=".vhd") returned 4 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".vhd") returned 0x0 [0095.318] lstrlenW (lpString=".vhdx") returned 5 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".vhdx") returned 0x0 [0095.318] lstrlenW (lpString=".pst") returned 4 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".pst") returned 0x0 [0095.318] lstrlenW (lpString=".ost") returned 4 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".ost") returned 0x0 [0095.318] lstrlenW (lpString=".bak") returned 4 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".bak") returned 0x0 [0095.318] lstrlenW (lpString=".bac") returned 4 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".bac") returned 0x0 [0095.318] lstrlenW (lpString=".sys") returned 4 [0095.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".sys") returned 0x0 [0095.319] lstrlenW (lpString=".v2i") returned 4 [0095.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".v2i") returned 0x0 [0095.319] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch="s\r\n.v2i") returned 0x0 [0095.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.320] lstrlenW (lpString=".sql") returned 4 [0095.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".sql") returned 0x0 [0095.320] lstrlenW (lpString=".mdf") returned 4 [0095.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".mdf") returned 0x0 [0095.320] lstrlenW (lpString=".txt") returned 4 [0095.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".txt") returned 0x0 [0095.320] lstrlenW (lpString=".dbf") returned 4 [0095.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".dbf") returned 0x0 [0095.320] lstrlenW (lpString=".ckp") returned 4 [0095.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".ckp") returned 0x0 [0095.320] lstrlenW (lpString=".dacpac") returned 7 [0095.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".dacpac") returned 0x0 [0095.320] lstrlenW (lpString=".db3") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".db3") returned 0x0 [0095.321] lstrlenW (lpString=".dtxs") returned 5 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".dtxs") returned 0x0 [0095.321] lstrlenW (lpString=".mdt") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".mdt") returned 0x0 [0095.321] lstrlenW (lpString=".sdf") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".sdf") returned 0x0 [0095.321] lstrlenW (lpString=".MDF") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".MDF") returned 0x0 [0095.321] lstrlenW (lpString=".DBF") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".DBF") returned 0x0 [0095.321] lstrlenW (lpString=".DB") returned 3 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".DB") returned 0x0 [0095.321] lstrlenW (lpString=".db") returned 3 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".db") returned 0x0 [0095.321] lstrlenW (lpString=".ndf") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".ndf") returned 0x0 [0095.321] lstrlenW (lpString=".NDF") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".NDF") returned 0x0 [0095.321] lstrlenW (lpString=".Mdf") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".Mdf") returned 0x0 [0095.321] lstrlenW (lpString=".dat") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".dat") returned 0x0 [0095.321] lstrlenW (lpString=".DAT") returned 4 [0095.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".DAT") returned 0x0 [0095.321] lstrlenW (lpString=".ldf") returned 4 [0095.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".ldf") returned 0x0 [0095.322] lstrlenW (lpString=".LDF") returned 4 [0095.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch=".LDF") returned 0x0 [0095.322] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.322] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e5660) returned 1 [0095.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.323] CryptReleaseContext (hProv=0x27e5660, dwFlags=0x0) returned 1 [0095.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.323] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21532390059) returned 1 [0095.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7a13cd0, dwHighDateTime=0x1d585b4)) [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0b00 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0b00 | out: hHeap=0x260000) returned 1 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.323] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.324] GetLastError () returned 0x0 [0095.324] GetLastError () returned 0x0 [0095.324] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.324] GetLastError () returned 0x0 [0095.324] GetLastError () returned 0x0 [0095.327] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.327] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0xc00, lpOverlapped=0x0) returned 1 [0095.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.328] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.328] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.328] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.328] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.328] CloseHandle (hObject=0xd8) returned 1 [0095.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.[deadmin@cock.li].deadmin")) returned 1 [0095.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.345] GetLastError () returned 0x0 [0095.345] RtlWakeConditionVariable () returned 0x0 [0095.345] GetCurrentThreadId () returned 0x98c [0095.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".ldf") returned 0x0 [0095.345] lstrlenW (lpString=".vhd") returned 4 [0095.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".vhd") returned 0x0 [0095.345] lstrlenW (lpString=".vhdx") returned 5 [0095.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".vhdx") returned 0x0 [0095.345] lstrlenW (lpString=".pst") returned 4 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".pst") returned 0x0 [0095.346] lstrlenW (lpString=".ost") returned 4 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".ost") returned 0x0 [0095.346] lstrlenW (lpString=".bak") returned 4 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".bak") returned 0x0 [0095.346] lstrlenW (lpString=".bac") returned 4 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".bac") returned 0x0 [0095.346] lstrlenW (lpString=".sys") returned 4 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".sys") returned 0x0 [0095.346] lstrlenW (lpString=".v2i") returned 4 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".v2i") returned 0x0 [0095.346] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch="s\r\n.v2i") returned 0x0 [0095.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.356] lstrlenW (lpString=".sql") returned 4 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".sql") returned 0x0 [0095.356] lstrlenW (lpString=".mdf") returned 4 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".mdf") returned 0x0 [0095.356] lstrlenW (lpString=".txt") returned 4 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".txt") returned 0x0 [0095.356] lstrlenW (lpString=".dbf") returned 4 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".dbf") returned 0x0 [0095.356] lstrlenW (lpString=".ckp") returned 4 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".ckp") returned 0x0 [0095.356] lstrlenW (lpString=".dacpac") returned 7 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".dacpac") returned 0x0 [0095.356] lstrlenW (lpString=".db3") returned 4 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".db3") returned 0x0 [0095.356] lstrlenW (lpString=".dtxs") returned 5 [0095.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".dtxs") returned 0x0 [0095.356] lstrlenW (lpString=".mdt") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".mdt") returned 0x0 [0095.357] lstrlenW (lpString=".sdf") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".sdf") returned 0x0 [0095.357] lstrlenW (lpString=".MDF") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".MDF") returned 0x0 [0095.357] lstrlenW (lpString=".DBF") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".DBF") returned 0x0 [0095.357] lstrlenW (lpString=".DB") returned 3 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".DB") returned 0x0 [0095.357] lstrlenW (lpString=".db") returned 3 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".db") returned 0x0 [0095.357] lstrlenW (lpString=".ndf") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".ndf") returned 0x0 [0095.357] lstrlenW (lpString=".NDF") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".NDF") returned 0x0 [0095.357] lstrlenW (lpString=".Mdf") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".Mdf") returned 0x0 [0095.357] lstrlenW (lpString=".dat") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".dat") returned 0x0 [0095.357] lstrlenW (lpString=".DAT") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".DAT") returned 0x0 [0095.357] lstrlenW (lpString=".ldf") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".ldf") returned 0x0 [0095.357] lstrlenW (lpString=".LDF") returned 4 [0095.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch=".LDF") returned 0x0 [0095.357] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.358] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e56e8) returned 1 [0095.435] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.435] CryptReleaseContext (hProv=0x27e56e8, dwFlags=0x0) returned 1 [0095.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.435] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21543656320) returned 1 [0095.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7b1e670, dwHighDateTime=0x1d585b4)) [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0b70 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0b70 | out: hHeap=0x260000) returned 1 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.436] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.436] GetLastError () returned 0x0 [0095.437] GetLastError () returned 0x0 [0095.437] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.437] GetLastError () returned 0x0 [0095.437] GetLastError () returned 0x0 [0095.501] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.501] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.501] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.501] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.502] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.502] CloseHandle (hObject=0xd8) returned 1 [0095.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.[deadmin@cock.li].deadmin")) returned 1 [0095.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.505] GetLastError () returned 0x0 [0095.505] RtlWakeConditionVariable () returned 0x0 [0095.505] GetCurrentThreadId () returned 0x98c [0095.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".ldf") returned 0x0 [0095.505] lstrlenW (lpString=".vhd") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".vhd") returned 0x0 [0095.506] lstrlenW (lpString=".vhdx") returned 5 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".vhdx") returned 0x0 [0095.506] lstrlenW (lpString=".pst") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".pst") returned 0x0 [0095.506] lstrlenW (lpString=".ost") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".ost") returned 0x0 [0095.506] lstrlenW (lpString=".bak") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".bak") returned 0x0 [0095.506] lstrlenW (lpString=".bac") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".bac") returned 0x0 [0095.506] lstrlenW (lpString=".sys") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".sys") returned 0x0 [0095.506] lstrlenW (lpString=".v2i") returned 4 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".v2i") returned 0x0 [0095.506] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch="s\r\n.v2i") returned 0x0 [0095.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.508] lstrlenW (lpString=".sql") returned 4 [0095.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".sql") returned 0x0 [0095.508] lstrlenW (lpString=".mdf") returned 4 [0095.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".mdf") returned 0x0 [0095.508] lstrlenW (lpString=".txt") returned 4 [0095.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".txt") returned 0x0 [0095.508] lstrlenW (lpString=".dbf") returned 4 [0095.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".dbf") returned 0x0 [0095.508] lstrlenW (lpString=".ckp") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".ckp") returned 0x0 [0095.509] lstrlenW (lpString=".dacpac") returned 7 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".dacpac") returned 0x0 [0095.509] lstrlenW (lpString=".db3") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".db3") returned 0x0 [0095.509] lstrlenW (lpString=".dtxs") returned 5 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".dtxs") returned 0x0 [0095.509] lstrlenW (lpString=".mdt") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".mdt") returned 0x0 [0095.509] lstrlenW (lpString=".sdf") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".sdf") returned 0x0 [0095.509] lstrlenW (lpString=".MDF") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".MDF") returned 0x0 [0095.509] lstrlenW (lpString=".DBF") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".DBF") returned 0x0 [0095.509] lstrlenW (lpString=".DB") returned 3 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".DB") returned 0x0 [0095.509] lstrlenW (lpString=".db") returned 3 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".db") returned 0x0 [0095.509] lstrlenW (lpString=".ndf") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".ndf") returned 0x0 [0095.509] lstrlenW (lpString=".NDF") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".NDF") returned 0x0 [0095.509] lstrlenW (lpString=".Mdf") returned 4 [0095.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".Mdf") returned 0x0 [0095.509] lstrlenW (lpString=".dat") returned 4 [0095.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".dat") returned 0x0 [0095.510] lstrlenW (lpString=".DAT") returned 4 [0095.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".DAT") returned 0x0 [0095.510] lstrlenW (lpString=".ldf") returned 4 [0095.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".ldf") returned 0x0 [0095.510] lstrlenW (lpString=".LDF") returned 4 [0095.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch=".LDF") returned 0x0 [0095.510] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.510] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e57f8) returned 1 [0095.511] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.511] CryptReleaseContext (hProv=0x27e57f8, dwFlags=0x0) returned 1 [0095.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.511] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21551208942) returned 1 [0095.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7bdcd50, dwHighDateTime=0x1d585b4)) [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0d68 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0d68 | out: hHeap=0x260000) returned 1 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.512] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.512] GetLastError () returned 0x0 [0095.512] GetLastError () returned 0x0 [0095.512] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.512] GetLastError () returned 0x0 [0095.512] GetLastError () returned 0x0 [0095.519] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffcc6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.519] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3392, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x3392, lpOverlapped=0x0) returned 1 [0095.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.520] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.520] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.520] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.520] CloseHandle (hObject=0xd8) returned 1 [0095.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.[deadmin@cock.li].deadmin")) returned 1 [0095.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.523] GetLastError () returned 0x0 [0095.523] RtlWakeConditionVariable () returned 0x0 [0095.523] GetCurrentThreadId () returned 0x98c [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".ldf") returned 0x0 [0095.523] lstrlenW (lpString=".vhd") returned 4 [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".vhd") returned 0x0 [0095.523] lstrlenW (lpString=".vhdx") returned 5 [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".vhdx") returned 0x0 [0095.523] lstrlenW (lpString=".pst") returned 4 [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".pst") returned 0x0 [0095.523] lstrlenW (lpString=".ost") returned 4 [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".ost") returned 0x0 [0095.523] lstrlenW (lpString=".bak") returned 4 [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".bak") returned 0x0 [0095.523] lstrlenW (lpString=".bac") returned 4 [0095.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".bac") returned 0x0 [0095.523] lstrlenW (lpString=".sys") returned 4 [0095.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".sys") returned 0x0 [0095.524] lstrlenW (lpString=".v2i") returned 4 [0095.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".v2i") returned 0x0 [0095.524] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.526] lstrlenW (lpString=".sql") returned 4 [0095.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".sql") returned 0x0 [0095.526] lstrlenW (lpString=".mdf") returned 4 [0095.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".mdf") returned 0x0 [0095.526] lstrlenW (lpString=".txt") returned 4 [0095.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".txt") returned 0x0 [0095.526] lstrlenW (lpString=".dbf") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".dbf") returned 0x0 [0095.527] lstrlenW (lpString=".ckp") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".ckp") returned 0x0 [0095.527] lstrlenW (lpString=".dacpac") returned 7 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".dacpac") returned 0x0 [0095.527] lstrlenW (lpString=".db3") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".db3") returned 0x0 [0095.527] lstrlenW (lpString=".dtxs") returned 5 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".dtxs") returned 0x0 [0095.527] lstrlenW (lpString=".mdt") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".mdt") returned 0x0 [0095.527] lstrlenW (lpString=".sdf") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".sdf") returned 0x0 [0095.527] lstrlenW (lpString=".MDF") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".MDF") returned 0x0 [0095.527] lstrlenW (lpString=".DBF") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".DBF") returned 0x0 [0095.527] lstrlenW (lpString=".DB") returned 3 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".DB") returned 0x0 [0095.527] lstrlenW (lpString=".db") returned 3 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".db") returned 0x0 [0095.527] lstrlenW (lpString=".ndf") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".ndf") returned 0x0 [0095.527] lstrlenW (lpString=".NDF") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".NDF") returned 0x0 [0095.527] lstrlenW (lpString=".Mdf") returned 4 [0095.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".Mdf") returned 0x0 [0095.528] lstrlenW (lpString=".dat") returned 4 [0095.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".dat") returned 0x0 [0095.528] lstrlenW (lpString=".DAT") returned 4 [0095.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".DAT") returned 0x0 [0095.528] lstrlenW (lpString=".ldf") returned 4 [0095.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".ldf") returned 0x0 [0095.528] lstrlenW (lpString=".LDF") returned 4 [0095.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch=".LDF") returned 0x0 [0095.528] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.528] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e5c38) returned 1 [0095.529] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.529] CryptReleaseContext (hProv=0x27e5c38, dwFlags=0x0) returned 1 [0095.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.529] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21553009351) returned 1 [0095.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7c02eb0, dwHighDateTime=0x1d585b4)) [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0da0 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0da0 | out: hHeap=0x260000) returned 1 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.530] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.530] GetLastError () returned 0x0 [0095.530] GetLastError () returned 0x0 [0095.530] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.530] GetLastError () returned 0x0 [0095.531] GetLastError () returned 0x0 [0095.533] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.533] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.534] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.534] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.538] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.538] CloseHandle (hObject=0xd8) returned 1 [0095.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.541] GetLastError () returned 0x0 [0095.541] RtlWakeConditionVariable () returned 0x0 [0095.541] GetCurrentThreadId () returned 0x98c [0095.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".ldf") returned 0x0 [0095.541] lstrlenW (lpString=".vhd") returned 4 [0095.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".vhd") returned 0x0 [0095.541] lstrlenW (lpString=".vhdx") returned 5 [0095.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".vhdx") returned 0x0 [0095.541] lstrlenW (lpString=".pst") returned 4 [0095.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".pst") returned 0x0 [0095.541] lstrlenW (lpString=".ost") returned 4 [0095.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".ost") returned 0x0 [0095.542] lstrlenW (lpString=".bak") returned 4 [0095.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".bak") returned 0x0 [0095.542] lstrlenW (lpString=".bac") returned 4 [0095.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".bac") returned 0x0 [0095.542] lstrlenW (lpString=".sys") returned 4 [0095.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".sys") returned 0x0 [0095.542] lstrlenW (lpString=".v2i") returned 4 [0095.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".v2i") returned 0x0 [0095.542] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.544] lstrlenW (lpString=".sql") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".sql") returned 0x0 [0095.544] lstrlenW (lpString=".mdf") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".mdf") returned 0x0 [0095.544] lstrlenW (lpString=".txt") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".txt") returned 0x0 [0095.544] lstrlenW (lpString=".dbf") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".dbf") returned 0x0 [0095.544] lstrlenW (lpString=".ckp") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".ckp") returned 0x0 [0095.544] lstrlenW (lpString=".dacpac") returned 7 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".dacpac") returned 0x0 [0095.544] lstrlenW (lpString=".db3") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".db3") returned 0x0 [0095.544] lstrlenW (lpString=".dtxs") returned 5 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".dtxs") returned 0x0 [0095.544] lstrlenW (lpString=".mdt") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".mdt") returned 0x0 [0095.544] lstrlenW (lpString=".sdf") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".sdf") returned 0x0 [0095.544] lstrlenW (lpString=".MDF") returned 4 [0095.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".MDF") returned 0x0 [0095.545] lstrlenW (lpString=".DBF") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".DBF") returned 0x0 [0095.545] lstrlenW (lpString=".DB") returned 3 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".DB") returned 0x0 [0095.545] lstrlenW (lpString=".db") returned 3 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".db") returned 0x0 [0095.545] lstrlenW (lpString=".ndf") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".ndf") returned 0x0 [0095.545] lstrlenW (lpString=".NDF") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".NDF") returned 0x0 [0095.545] lstrlenW (lpString=".Mdf") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".Mdf") returned 0x0 [0095.545] lstrlenW (lpString=".dat") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".dat") returned 0x0 [0095.545] lstrlenW (lpString=".DAT") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".DAT") returned 0x0 [0095.545] lstrlenW (lpString=".ldf") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".ldf") returned 0x0 [0095.545] lstrlenW (lpString=".LDF") returned 4 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch=".LDF") returned 0x0 [0095.545] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.546] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e5cc0) returned 1 [0095.546] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.546] CryptReleaseContext (hProv=0x27e5cc0, dwFlags=0x0) returned 1 [0095.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.546] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21554761780) returned 1 [0095.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7c29010, dwHighDateTime=0x1d585b4)) [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0dd8 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0dd8 | out: hHeap=0x260000) returned 1 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.547] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.547] GetLastError () returned 0x0 [0095.548] GetLastError () returned 0x0 [0095.548] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.548] GetLastError () returned 0x0 [0095.548] GetLastError () returned 0x0 [0095.631] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.631] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.634] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.634] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.699] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.699] CloseHandle (hObject=0xd8) returned 1 [0095.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.702] GetLastError () returned 0x0 [0095.702] RtlWakeConditionVariable () returned 0x0 [0095.702] GetCurrentThreadId () returned 0x98c [0095.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".ldf") returned 0x0 [0095.702] lstrlenW (lpString=".vhd") returned 4 [0095.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".vhd") returned 0x0 [0095.702] lstrlenW (lpString=".vhdx") returned 5 [0095.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".vhdx") returned 0x0 [0095.702] lstrlenW (lpString=".pst") returned 4 [0095.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".pst") returned 0x0 [0095.703] lstrlenW (lpString=".ost") returned 4 [0095.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".ost") returned 0x0 [0095.703] lstrlenW (lpString=".bak") returned 4 [0095.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".bak") returned 0x0 [0095.703] lstrlenW (lpString=".bac") returned 4 [0095.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".bac") returned 0x0 [0095.703] lstrlenW (lpString=".sys") returned 4 [0095.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".sys") returned 0x0 [0095.703] lstrlenW (lpString=".v2i") returned 4 [0095.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".v2i") returned 0x0 [0095.703] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.705] lstrlenW (lpString=".sql") returned 4 [0095.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".sql") returned 0x0 [0095.705] lstrlenW (lpString=".mdf") returned 4 [0095.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".mdf") returned 0x0 [0095.705] lstrlenW (lpString=".txt") returned 4 [0095.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".txt") returned 0x0 [0095.705] lstrlenW (lpString=".dbf") returned 4 [0095.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".dbf") returned 0x0 [0095.705] lstrlenW (lpString=".ckp") returned 4 [0095.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".ckp") returned 0x0 [0095.705] lstrlenW (lpString=".dacpac") returned 7 [0095.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".dacpac") returned 0x0 [0095.706] lstrlenW (lpString=".db3") returned 4 [0095.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".db3") returned 0x0 [0095.706] lstrlenW (lpString=".dtxs") returned 5 [0095.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".dtxs") returned 0x0 [0095.706] lstrlenW (lpString=".mdt") returned 4 [0095.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".mdt") returned 0x0 [0095.706] lstrlenW (lpString=".sdf") returned 4 [0095.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".sdf") returned 0x0 [0095.706] lstrlenW (lpString=".MDF") returned 4 [0095.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".MDF") returned 0x0 [0095.706] lstrlenW (lpString=".DBF") returned 4 [0095.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".DBF") returned 0x0 [0095.706] lstrlenW (lpString=".DB") returned 3 [0095.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".DB") returned 0x0 [0095.714] lstrlenW (lpString=".db") returned 3 [0095.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".db") returned 0x0 [0095.714] lstrlenW (lpString=".ndf") returned 4 [0095.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".ndf") returned 0x0 [0095.714] lstrlenW (lpString=".NDF") returned 4 [0095.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".NDF") returned 0x0 [0095.714] lstrlenW (lpString=".Mdf") returned 4 [0095.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".Mdf") returned 0x0 [0095.714] lstrlenW (lpString=".dat") returned 4 [0095.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".dat") returned 0x0 [0095.715] lstrlenW (lpString=".DAT") returned 4 [0095.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".DAT") returned 0x0 [0095.715] lstrlenW (lpString=".ldf") returned 4 [0095.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".ldf") returned 0x0 [0095.715] lstrlenW (lpString=".LDF") returned 4 [0095.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch=".LDF") returned 0x0 [0095.715] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.715] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e5d48) returned 1 [0095.716] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.716] CryptReleaseContext (hProv=0x27e5d48, dwFlags=0x0) returned 1 [0095.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.716] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21571714705) returned 1 [0095.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7dcbf30, dwHighDateTime=0x1d585b4)) [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0f28 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f28 | out: hHeap=0x260000) returned 1 [0095.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.717] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.717] GetLastError () returned 0x0 [0095.717] GetLastError () returned 0x0 [0095.717] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.717] GetLastError () returned 0x0 [0095.718] GetLastError () returned 0x0 [0095.721] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff5c68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.721] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa398, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0xa398, lpOverlapped=0x0) returned 1 [0095.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.721] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.721] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.721] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.721] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.721] CloseHandle (hObject=0xd8) returned 1 [0095.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.725] GetLastError () returned 0x0 [0095.725] RtlWakeConditionVariable () returned 0x0 [0095.725] GetCurrentThreadId () returned 0x98c [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".ldf") returned 0x0 [0095.725] lstrlenW (lpString=".vhd") returned 4 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".vhd") returned 0x0 [0095.725] lstrlenW (lpString=".vhdx") returned 5 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".vhdx") returned 0x0 [0095.725] lstrlenW (lpString=".pst") returned 4 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".pst") returned 0x0 [0095.725] lstrlenW (lpString=".ost") returned 4 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".ost") returned 0x0 [0095.725] lstrlenW (lpString=".bak") returned 4 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".bak") returned 0x0 [0095.725] lstrlenW (lpString=".bac") returned 4 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".bac") returned 0x0 [0095.725] lstrlenW (lpString=".sys") returned 4 [0095.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".sys") returned 0x0 [0095.726] lstrlenW (lpString=".v2i") returned 4 [0095.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".v2i") returned 0x0 [0095.726] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0095.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.728] lstrlenW (lpString=".sql") returned 4 [0095.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".sql") returned 0x0 [0095.728] lstrlenW (lpString=".mdf") returned 4 [0095.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".mdf") returned 0x0 [0095.728] lstrlenW (lpString=".txt") returned 4 [0095.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".txt") returned 0x0 [0095.728] lstrlenW (lpString=".dbf") returned 4 [0095.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".dbf") returned 0x0 [0095.728] lstrlenW (lpString=".ckp") returned 4 [0095.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".ckp") returned 0x0 [0095.728] lstrlenW (lpString=".dacpac") returned 7 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".dacpac") returned 0x0 [0095.729] lstrlenW (lpString=".db3") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".db3") returned 0x0 [0095.729] lstrlenW (lpString=".dtxs") returned 5 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".dtxs") returned 0x0 [0095.729] lstrlenW (lpString=".mdt") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".mdt") returned 0x0 [0095.729] lstrlenW (lpString=".sdf") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".sdf") returned 0x0 [0095.729] lstrlenW (lpString=".MDF") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".MDF") returned 0x0 [0095.729] lstrlenW (lpString=".DBF") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".DBF") returned 0x0 [0095.729] lstrlenW (lpString=".DB") returned 3 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".DB") returned 0x0 [0095.729] lstrlenW (lpString=".db") returned 3 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".db") returned 0x0 [0095.729] lstrlenW (lpString=".ndf") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".ndf") returned 0x0 [0095.729] lstrlenW (lpString=".NDF") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".NDF") returned 0x0 [0095.729] lstrlenW (lpString=".Mdf") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".Mdf") returned 0x0 [0095.729] lstrlenW (lpString=".dat") returned 4 [0095.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".dat") returned 0x0 [0095.730] lstrlenW (lpString=".DAT") returned 4 [0095.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".DAT") returned 0x0 [0095.730] lstrlenW (lpString=".ldf") returned 4 [0095.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".ldf") returned 0x0 [0095.730] lstrlenW (lpString=".LDF") returned 4 [0095.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch=".LDF") returned 0x0 [0095.730] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.730] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e5ff0) returned 1 [0095.731] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.731] CryptReleaseContext (hProv=0x27e5ff0, dwFlags=0x0) returned 1 [0095.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.731] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21573205785) returned 1 [0095.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7df2090, dwHighDateTime=0x1d585b4)) [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0f60 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f60 | out: hHeap=0x260000) returned 1 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.732] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.732] GetLastError () returned 0x0 [0095.732] GetLastError () returned 0x0 [0095.732] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.732] GetLastError () returned 0x0 [0095.732] GetLastError () returned 0x0 [0095.766] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.766] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.767] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.767] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.841] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.841] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.841] CloseHandle (hObject=0xd8) returned 1 [0095.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.[deadmin@cock.li].deadmin")) returned 1 [0095.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.845] GetLastError () returned 0x0 [0095.845] RtlWakeConditionVariable () returned 0x0 [0095.845] GetCurrentThreadId () returned 0x98c [0095.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".ldf") returned 0x0 [0095.845] lstrlenW (lpString=".vhd") returned 4 [0095.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".vhd") returned 0x0 [0095.845] lstrlenW (lpString=".vhdx") returned 5 [0095.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".vhdx") returned 0x0 [0095.845] lstrlenW (lpString=".pst") returned 4 [0095.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".pst") returned 0x0 [0095.845] lstrlenW (lpString=".ost") returned 4 [0095.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".ost") returned 0x0 [0095.846] lstrlenW (lpString=".bak") returned 4 [0095.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".bak") returned 0x0 [0095.846] lstrlenW (lpString=".bac") returned 4 [0095.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".bac") returned 0x0 [0095.846] lstrlenW (lpString=".sys") returned 4 [0095.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".sys") returned 0x0 [0095.846] lstrlenW (lpString=".v2i") returned 4 [0095.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".v2i") returned 0x0 [0095.846] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch="s\r\n.v2i") returned 0x0 [0095.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.848] lstrlenW (lpString=".sql") returned 4 [0095.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".sql") returned 0x0 [0095.848] lstrlenW (lpString=".mdf") returned 4 [0095.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".mdf") returned 0x0 [0095.848] lstrlenW (lpString=".txt") returned 4 [0095.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".txt") returned 0x0 [0095.848] lstrlenW (lpString=".dbf") returned 4 [0095.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".dbf") returned 0x0 [0095.848] lstrlenW (lpString=".ckp") returned 4 [0095.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".ckp") returned 0x0 [0095.848] lstrlenW (lpString=".dacpac") returned 7 [0095.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".dacpac") returned 0x0 [0095.848] lstrlenW (lpString=".db3") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".db3") returned 0x0 [0095.849] lstrlenW (lpString=".dtxs") returned 5 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".dtxs") returned 0x0 [0095.849] lstrlenW (lpString=".mdt") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".mdt") returned 0x0 [0095.849] lstrlenW (lpString=".sdf") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".sdf") returned 0x0 [0095.849] lstrlenW (lpString=".MDF") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".MDF") returned 0x0 [0095.849] lstrlenW (lpString=".DBF") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".DBF") returned 0x0 [0095.849] lstrlenW (lpString=".DB") returned 3 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".DB") returned 0x0 [0095.849] lstrlenW (lpString=".db") returned 3 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".db") returned 0x0 [0095.849] lstrlenW (lpString=".ndf") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".ndf") returned 0x0 [0095.849] lstrlenW (lpString=".NDF") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".NDF") returned 0x0 [0095.849] lstrlenW (lpString=".Mdf") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".Mdf") returned 0x0 [0095.849] lstrlenW (lpString=".dat") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".dat") returned 0x0 [0095.849] lstrlenW (lpString=".DAT") returned 4 [0095.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".DAT") returned 0x0 [0095.849] lstrlenW (lpString=".ldf") returned 4 [0095.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".ldf") returned 0x0 [0095.850] lstrlenW (lpString=".LDF") returned 4 [0095.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch=".LDF") returned 0x0 [0095.850] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.850] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6078) returned 1 [0095.851] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.851] CryptReleaseContext (hProv=0x27e6078, dwFlags=0x0) returned 1 [0095.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.851] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21585192306) returned 1 [0095.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc7f22b90, dwHighDateTime=0x1d585b4)) [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1078 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1078 | out: hHeap=0x260000) returned 1 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.852] GetLastError () returned 0x0 [0095.852] GetLastError () returned 0x0 [0095.852] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.852] GetLastError () returned 0x0 [0095.852] GetLastError () returned 0x0 [0095.884] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.884] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.884] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.884] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.901] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.901] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.901] CloseHandle (hObject=0xd8) returned 1 [0095.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.[deadmin@cock.li].deadmin")) returned 1 [0095.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.963] GetLastError () returned 0x0 [0095.963] RtlWakeConditionVariable () returned 0x27e828 [0095.963] GetCurrentThreadId () returned 0x98c [0095.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".ldf") returned 0x0 [0095.964] lstrlenW (lpString=".vhd") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".vhd") returned 0x0 [0095.964] lstrlenW (lpString=".vhdx") returned 5 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".vhdx") returned 0x0 [0095.964] lstrlenW (lpString=".pst") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".pst") returned 0x0 [0095.964] lstrlenW (lpString=".ost") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".ost") returned 0x0 [0095.964] lstrlenW (lpString=".bak") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".bak") returned 0x0 [0095.964] lstrlenW (lpString=".bac") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".bac") returned 0x0 [0095.964] lstrlenW (lpString=".sys") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".sys") returned 0x0 [0095.964] lstrlenW (lpString=".v2i") returned 4 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".v2i") returned 0x0 [0095.964] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch="s\r\n.v2i") returned 0x0 [0095.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.966] lstrlenW (lpString=".sql") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".sql") returned 0x0 [0095.966] lstrlenW (lpString=".mdf") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".mdf") returned 0x0 [0095.966] lstrlenW (lpString=".txt") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".txt") returned 0x0 [0095.966] lstrlenW (lpString=".dbf") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".dbf") returned 0x0 [0095.966] lstrlenW (lpString=".ckp") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".ckp") returned 0x0 [0095.966] lstrlenW (lpString=".dacpac") returned 7 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".dacpac") returned 0x0 [0095.966] lstrlenW (lpString=".db3") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".db3") returned 0x0 [0095.966] lstrlenW (lpString=".dtxs") returned 5 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".dtxs") returned 0x0 [0095.966] lstrlenW (lpString=".mdt") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".mdt") returned 0x0 [0095.966] lstrlenW (lpString=".sdf") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".sdf") returned 0x0 [0095.966] lstrlenW (lpString=".MDF") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".MDF") returned 0x0 [0095.966] lstrlenW (lpString=".DBF") returned 4 [0095.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".DBF") returned 0x0 [0095.967] lstrlenW (lpString=".DB") returned 3 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".DB") returned 0x0 [0095.967] lstrlenW (lpString=".db") returned 3 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".db") returned 0x0 [0095.967] lstrlenW (lpString=".ndf") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".ndf") returned 0x0 [0095.967] lstrlenW (lpString=".NDF") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".NDF") returned 0x0 [0095.967] lstrlenW (lpString=".Mdf") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".Mdf") returned 0x0 [0095.967] lstrlenW (lpString=".dat") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".dat") returned 0x0 [0095.967] lstrlenW (lpString=".DAT") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".DAT") returned 0x0 [0095.967] lstrlenW (lpString=".ldf") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".ldf") returned 0x0 [0095.967] lstrlenW (lpString=".LDF") returned 4 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch=".LDF") returned 0x0 [0095.967] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.967] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x33ffa8) returned 1 [0095.968] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.968] CryptReleaseContext (hProv=0x33ffa8, dwFlags=0x0) returned 1 [0095.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.968] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21596950555) returned 1 [0095.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc802d530, dwHighDateTime=0x1d585b4)) [0095.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1190 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1190 | out: hHeap=0x260000) returned 1 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d838 [0095.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.969] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.969] GetLastError () returned 0x0 [0095.969] GetLastError () returned 0x0 [0095.970] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.970] GetLastError () returned 0x0 [0095.970] GetLastError () returned 0x0 [0095.974] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffb49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.974] WriteFile (in: hFile=0x104, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x4b7, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x4b7, lpOverlapped=0x0) returned 1 [0095.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.974] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.974] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.974] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.974] CloseHandle (hObject=0x104) returned 1 [0095.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.[deadmin@cock.li].deadmin")) returned 1 [0095.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.976] GetLastError () returned 0x0 [0095.976] RtlWakeConditionVariable () returned 0x27e828 [0095.976] GetCurrentThreadId () returned 0x98c [0095.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".ldf") returned 0x0 [0095.976] lstrlenW (lpString=".vhd") returned 4 [0095.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".vhd") returned 0x0 [0095.976] lstrlenW (lpString=".vhdx") returned 5 [0095.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".vhdx") returned 0x0 [0095.976] lstrlenW (lpString=".pst") returned 4 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".pst") returned 0x0 [0095.977] lstrlenW (lpString=".ost") returned 4 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".ost") returned 0x0 [0095.977] lstrlenW (lpString=".bak") returned 4 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".bak") returned 0x0 [0095.977] lstrlenW (lpString=".bac") returned 4 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".bac") returned 0x0 [0095.977] lstrlenW (lpString=".sys") returned 4 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".sys") returned 0x0 [0095.977] lstrlenW (lpString=".v2i") returned 4 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".v2i") returned 0x0 [0095.977] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch="s\r\n.v2i") returned 0x0 [0095.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.978] lstrlenW (lpString=".sql") returned 4 [0095.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".sql") returned 0x0 [0095.978] lstrlenW (lpString=".mdf") returned 4 [0095.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".mdf") returned 0x0 [0095.978] lstrlenW (lpString=".txt") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".txt") returned 0x0 [0095.979] lstrlenW (lpString=".dbf") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".dbf") returned 0x0 [0095.979] lstrlenW (lpString=".ckp") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".ckp") returned 0x0 [0095.979] lstrlenW (lpString=".dacpac") returned 7 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".dacpac") returned 0x0 [0095.979] lstrlenW (lpString=".db3") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".db3") returned 0x0 [0095.979] lstrlenW (lpString=".dtxs") returned 5 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".dtxs") returned 0x0 [0095.979] lstrlenW (lpString=".mdt") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".mdt") returned 0x0 [0095.979] lstrlenW (lpString=".sdf") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".sdf") returned 0x0 [0095.979] lstrlenW (lpString=".MDF") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".MDF") returned 0x0 [0095.979] lstrlenW (lpString=".DBF") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".DBF") returned 0x0 [0095.979] lstrlenW (lpString=".DB") returned 3 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".DB") returned 0x0 [0095.979] lstrlenW (lpString=".db") returned 3 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".db") returned 0x0 [0095.979] lstrlenW (lpString=".ndf") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".ndf") returned 0x0 [0095.979] lstrlenW (lpString=".NDF") returned 4 [0095.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".NDF") returned 0x0 [0095.980] lstrlenW (lpString=".Mdf") returned 4 [0095.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".Mdf") returned 0x0 [0095.980] lstrlenW (lpString=".dat") returned 4 [0095.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".dat") returned 0x0 [0095.980] lstrlenW (lpString=".DAT") returned 4 [0095.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".DAT") returned 0x0 [0095.980] lstrlenW (lpString=".ldf") returned 4 [0095.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".ldf") returned 0x0 [0095.980] lstrlenW (lpString=".LDF") returned 4 [0095.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch=".LDF") returned 0x0 [0095.980] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0095.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.980] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6320) returned 1 [0095.981] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.981] CryptReleaseContext (hProv=0x27e6320, dwFlags=0x0) returned 1 [0095.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.981] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21598218984) returned 1 [0095.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc8053690, dwHighDateTime=0x1d585b4)) [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e11c8 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e11c8 | out: hHeap=0x260000) returned 1 [0095.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.982] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0095.982] GetLastError () returned 0x0 [0095.982] GetLastError () returned 0x0 [0095.982] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0095.982] GetLastError () returned 0x0 [0095.982] GetLastError () returned 0x0 [0095.999] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.999] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.003] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.003] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.044] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.044] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.072] CloseHandle (hObject=0x104) returned 1 [0096.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.[deadmin@cock.li].deadmin")) returned 1 [0096.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.104] GetLastError () returned 0x0 [0096.104] RtlWakeConditionVariable () returned 0x0 [0096.104] GetCurrentThreadId () returned 0x98c [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".ldf") returned 0x0 [0096.105] lstrlenW (lpString=".vhd") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".vhd") returned 0x0 [0096.105] lstrlenW (lpString=".vhdx") returned 5 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".vhdx") returned 0x0 [0096.105] lstrlenW (lpString=".pst") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".pst") returned 0x0 [0096.105] lstrlenW (lpString=".ost") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".ost") returned 0x0 [0096.105] lstrlenW (lpString=".bak") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".bak") returned 0x0 [0096.105] lstrlenW (lpString=".bac") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".bac") returned 0x0 [0096.105] lstrlenW (lpString=".sys") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".sys") returned 0x0 [0096.105] lstrlenW (lpString=".v2i") returned 4 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".v2i") returned 0x0 [0096.105] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0096.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.106] lstrlenW (lpString=".sql") returned 4 [0096.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".sql") returned 0x0 [0096.107] lstrlenW (lpString=".mdf") returned 4 [0096.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".mdf") returned 0x0 [0096.107] lstrlenW (lpString=".txt") returned 4 [0096.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".txt") returned 0x0 [0096.107] lstrlenW (lpString=".dbf") returned 4 [0096.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".dbf") returned 0x0 [0096.107] lstrlenW (lpString=".ckp") returned 4 [0096.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".ckp") returned 0x0 [0096.107] lstrlenW (lpString=".dacpac") returned 7 [0096.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".dacpac") returned 0x0 [0096.121] lstrlenW (lpString=".db3") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".db3") returned 0x0 [0096.121] lstrlenW (lpString=".dtxs") returned 5 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".dtxs") returned 0x0 [0096.121] lstrlenW (lpString=".mdt") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".mdt") returned 0x0 [0096.121] lstrlenW (lpString=".sdf") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".sdf") returned 0x0 [0096.121] lstrlenW (lpString=".MDF") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".MDF") returned 0x0 [0096.121] lstrlenW (lpString=".DBF") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".DBF") returned 0x0 [0096.121] lstrlenW (lpString=".DB") returned 3 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".DB") returned 0x0 [0096.121] lstrlenW (lpString=".db") returned 3 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".db") returned 0x0 [0096.121] lstrlenW (lpString=".ndf") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".ndf") returned 0x0 [0096.121] lstrlenW (lpString=".NDF") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".NDF") returned 0x0 [0096.121] lstrlenW (lpString=".Mdf") returned 4 [0096.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".Mdf") returned 0x0 [0096.121] lstrlenW (lpString=".dat") returned 4 [0096.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".dat") returned 0x0 [0096.122] lstrlenW (lpString=".DAT") returned 4 [0096.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".DAT") returned 0x0 [0096.122] lstrlenW (lpString=".ldf") returned 4 [0096.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".ldf") returned 0x0 [0096.122] lstrlenW (lpString=".LDF") returned 4 [0096.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch=".LDF") returned 0x0 [0096.122] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.122] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e5088) returned 1 [0096.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.123] CryptReleaseContext (hProv=0x27e5088, dwFlags=0x0) returned 1 [0096.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.123] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21612404527) returned 1 [0096.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc81aa2f0, dwHighDateTime=0x1d585b4)) [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e13c0 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e13c0 | out: hHeap=0x260000) returned 1 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0096.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0096.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.124] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.124] GetLastError () returned 0x0 [0096.124] GetLastError () returned 0x0 [0096.124] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.124] GetLastError () returned 0x0 [0096.124] GetLastError () returned 0x0 [0096.166] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeaca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.167] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1536, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x1536, lpOverlapped=0x0) returned 1 [0096.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.167] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.167] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.167] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.167] CloseHandle (hObject=0x104) returned 1 [0096.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.[deadmin@cock.li].deadmin")) returned 1 [0096.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.169] GetLastError () returned 0x0 [0096.169] RtlWakeConditionVariable () returned 0x27e828 [0096.169] GetCurrentThreadId () returned 0x98c [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".ldf") returned 0x0 [0096.169] lstrlenW (lpString=".vhd") returned 4 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".vhd") returned 0x0 [0096.169] lstrlenW (lpString=".vhdx") returned 5 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".vhdx") returned 0x0 [0096.169] lstrlenW (lpString=".pst") returned 4 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".pst") returned 0x0 [0096.169] lstrlenW (lpString=".ost") returned 4 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".ost") returned 0x0 [0096.169] lstrlenW (lpString=".bak") returned 4 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".bak") returned 0x0 [0096.169] lstrlenW (lpString=".bac") returned 4 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".bac") returned 0x0 [0096.169] lstrlenW (lpString=".sys") returned 4 [0096.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".sys") returned 0x0 [0096.170] lstrlenW (lpString=".v2i") returned 4 [0096.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".v2i") returned 0x0 [0096.170] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.171] lstrlenW (lpString=".sql") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".sql") returned 0x0 [0096.171] lstrlenW (lpString=".mdf") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".mdf") returned 0x0 [0096.171] lstrlenW (lpString=".txt") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".txt") returned 0x0 [0096.171] lstrlenW (lpString=".dbf") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".dbf") returned 0x0 [0096.171] lstrlenW (lpString=".ckp") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".ckp") returned 0x0 [0096.171] lstrlenW (lpString=".dacpac") returned 7 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".dacpac") returned 0x0 [0096.171] lstrlenW (lpString=".db3") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".db3") returned 0x0 [0096.171] lstrlenW (lpString=".dtxs") returned 5 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".dtxs") returned 0x0 [0096.171] lstrlenW (lpString=".mdt") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".mdt") returned 0x0 [0096.171] lstrlenW (lpString=".sdf") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".sdf") returned 0x0 [0096.171] lstrlenW (lpString=".MDF") returned 4 [0096.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".MDF") returned 0x0 [0096.172] lstrlenW (lpString=".DBF") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".DBF") returned 0x0 [0096.172] lstrlenW (lpString=".DB") returned 3 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".DB") returned 0x0 [0096.172] lstrlenW (lpString=".db") returned 3 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".db") returned 0x0 [0096.172] lstrlenW (lpString=".ndf") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".ndf") returned 0x0 [0096.172] lstrlenW (lpString=".NDF") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".NDF") returned 0x0 [0096.172] lstrlenW (lpString=".Mdf") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".Mdf") returned 0x0 [0096.172] lstrlenW (lpString=".dat") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".dat") returned 0x0 [0096.172] lstrlenW (lpString=".DAT") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".DAT") returned 0x0 [0096.172] lstrlenW (lpString=".ldf") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".ldf") returned 0x0 [0096.172] lstrlenW (lpString=".LDF") returned 4 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch=".LDF") returned 0x0 [0096.172] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.172] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e67e8) returned 1 [0096.173] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.173] CryptReleaseContext (hProv=0x27e67e8, dwFlags=0x0) returned 1 [0096.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.173] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21617454806) returned 1 [0096.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc821c710, dwHighDateTime=0x1d585b4)) [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e14d8 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e14d8 | out: hHeap=0x260000) returned 1 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.174] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.174] GetLastError () returned 0x0 [0096.174] GetLastError () returned 0x0 [0096.175] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.175] GetLastError () returned 0x0 [0096.175] GetLastError () returned 0x0 [0096.179] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.179] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.180] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.181] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.181] CloseHandle (hObject=0x104) returned 1 [0096.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0096.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0096.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.198] GetLastError () returned 0x0 [0096.198] RtlWakeConditionVariable () returned 0x0 [0096.198] GetCurrentThreadId () returned 0x98c [0096.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".ldf") returned 0x0 [0096.198] lstrlenW (lpString=".vhd") returned 4 [0096.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".vhd") returned 0x0 [0096.198] lstrlenW (lpString=".vhdx") returned 5 [0096.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".vhdx") returned 0x0 [0096.198] lstrlenW (lpString=".pst") returned 4 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".pst") returned 0x0 [0096.199] lstrlenW (lpString=".ost") returned 4 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".ost") returned 0x0 [0096.199] lstrlenW (lpString=".bak") returned 4 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".bak") returned 0x0 [0096.199] lstrlenW (lpString=".bac") returned 4 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".bac") returned 0x0 [0096.199] lstrlenW (lpString=".sys") returned 4 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".sys") returned 0x0 [0096.199] lstrlenW (lpString=".v2i") returned 4 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".v2i") returned 0x0 [0096.199] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.201] lstrlenW (lpString=".sql") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".sql") returned 0x0 [0096.201] lstrlenW (lpString=".mdf") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".mdf") returned 0x0 [0096.201] lstrlenW (lpString=".txt") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".txt") returned 0x0 [0096.201] lstrlenW (lpString=".dbf") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".dbf") returned 0x0 [0096.201] lstrlenW (lpString=".ckp") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".ckp") returned 0x0 [0096.201] lstrlenW (lpString=".dacpac") returned 7 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".dacpac") returned 0x0 [0096.201] lstrlenW (lpString=".db3") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".db3") returned 0x0 [0096.201] lstrlenW (lpString=".dtxs") returned 5 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".dtxs") returned 0x0 [0096.201] lstrlenW (lpString=".mdt") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".mdt") returned 0x0 [0096.201] lstrlenW (lpString=".sdf") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".sdf") returned 0x0 [0096.201] lstrlenW (lpString=".MDF") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".MDF") returned 0x0 [0096.201] lstrlenW (lpString=".DBF") returned 4 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".DBF") returned 0x0 [0096.201] lstrlenW (lpString=".DB") returned 3 [0096.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".DB") returned 0x0 [0096.202] lstrlenW (lpString=".db") returned 3 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".db") returned 0x0 [0096.202] lstrlenW (lpString=".ndf") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".ndf") returned 0x0 [0096.202] lstrlenW (lpString=".NDF") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".NDF") returned 0x0 [0096.202] lstrlenW (lpString=".Mdf") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".Mdf") returned 0x0 [0096.202] lstrlenW (lpString=".dat") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".dat") returned 0x0 [0096.202] lstrlenW (lpString=".DAT") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".DAT") returned 0x0 [0096.202] lstrlenW (lpString=".ldf") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".ldf") returned 0x0 [0096.202] lstrlenW (lpString=".LDF") returned 4 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch=".LDF") returned 0x0 [0096.202] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.202] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6980) returned 1 [0096.203] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.203] CryptReleaseContext (hProv=0x27e6980, dwFlags=0x0) returned 1 [0096.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.203] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21620434723) returned 1 [0096.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc82689d0, dwHighDateTime=0x1d585b4)) [0096.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1548 [0096.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1548 | out: hHeap=0x260000) returned 1 [0096.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d248 [0096.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.204] GetLastError () returned 0x0 [0096.204] GetLastError () returned 0x0 [0096.204] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.204] GetLastError () returned 0x0 [0096.205] GetLastError () returned 0x0 [0096.208] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.208] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.209] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.209] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.218] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.218] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.218] CloseHandle (hObject=0x104) returned 1 [0096.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.224] GetLastError () returned 0x0 [0096.225] RtlWakeConditionVariable () returned 0x0 [0096.225] GetCurrentThreadId () returned 0x98c [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".ldf") returned 0x0 [0096.225] lstrlenW (lpString=".vhd") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".vhd") returned 0x0 [0096.225] lstrlenW (lpString=".vhdx") returned 5 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".vhdx") returned 0x0 [0096.225] lstrlenW (lpString=".pst") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".pst") returned 0x0 [0096.225] lstrlenW (lpString=".ost") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".ost") returned 0x0 [0096.225] lstrlenW (lpString=".bak") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".bak") returned 0x0 [0096.225] lstrlenW (lpString=".bac") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".bac") returned 0x0 [0096.225] lstrlenW (lpString=".sys") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".sys") returned 0x0 [0096.225] lstrlenW (lpString=".v2i") returned 4 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".v2i") returned 0x0 [0096.225] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.227] lstrlenW (lpString=".sql") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".sql") returned 0x0 [0096.227] lstrlenW (lpString=".mdf") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".mdf") returned 0x0 [0096.227] lstrlenW (lpString=".txt") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".txt") returned 0x0 [0096.227] lstrlenW (lpString=".dbf") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".dbf") returned 0x0 [0096.227] lstrlenW (lpString=".ckp") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".ckp") returned 0x0 [0096.227] lstrlenW (lpString=".dacpac") returned 7 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".dacpac") returned 0x0 [0096.227] lstrlenW (lpString=".db3") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".db3") returned 0x0 [0096.227] lstrlenW (lpString=".dtxs") returned 5 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".dtxs") returned 0x0 [0096.227] lstrlenW (lpString=".mdt") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".mdt") returned 0x0 [0096.227] lstrlenW (lpString=".sdf") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".sdf") returned 0x0 [0096.227] lstrlenW (lpString=".MDF") returned 4 [0096.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".MDF") returned 0x0 [0096.227] lstrlenW (lpString=".DBF") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".DBF") returned 0x0 [0096.228] lstrlenW (lpString=".DB") returned 3 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".DB") returned 0x0 [0096.228] lstrlenW (lpString=".db") returned 3 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".db") returned 0x0 [0096.228] lstrlenW (lpString=".ndf") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".ndf") returned 0x0 [0096.228] lstrlenW (lpString=".NDF") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".NDF") returned 0x0 [0096.228] lstrlenW (lpString=".Mdf") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".Mdf") returned 0x0 [0096.228] lstrlenW (lpString=".dat") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".dat") returned 0x0 [0096.228] lstrlenW (lpString=".DAT") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".DAT") returned 0x0 [0096.228] lstrlenW (lpString=".ldf") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".ldf") returned 0x0 [0096.228] lstrlenW (lpString=".LDF") returned 4 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch=".LDF") returned 0x0 [0096.228] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.228] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6980) returned 1 [0096.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.229] CryptReleaseContext (hProv=0x27e6980, dwFlags=0x0) returned 1 [0096.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.229] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21623051188) returned 1 [0096.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc82b4c90, dwHighDateTime=0x1d585b4)) [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e15b8 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e15b8 | out: hHeap=0x260000) returned 1 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d4a8 [0096.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.230] GetLastError () returned 0x0 [0096.230] GetLastError () returned 0x0 [0096.231] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.231] GetLastError () returned 0x0 [0096.231] GetLastError () returned 0x0 [0096.245] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.245] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.246] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.246] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.248] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.248] CloseHandle (hObject=0x104) returned 1 [0096.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.253] GetLastError () returned 0x0 [0096.253] RtlWakeConditionVariable () returned 0x0 [0096.253] GetCurrentThreadId () returned 0x98c [0096.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".ldf") returned 0x0 [0096.254] lstrlenW (lpString=".vhd") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".vhd") returned 0x0 [0096.254] lstrlenW (lpString=".vhdx") returned 5 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".vhdx") returned 0x0 [0096.254] lstrlenW (lpString=".pst") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".pst") returned 0x0 [0096.254] lstrlenW (lpString=".ost") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".ost") returned 0x0 [0096.254] lstrlenW (lpString=".bak") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".bak") returned 0x0 [0096.254] lstrlenW (lpString=".bac") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".bac") returned 0x0 [0096.254] lstrlenW (lpString=".sys") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".sys") returned 0x0 [0096.254] lstrlenW (lpString=".v2i") returned 4 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".v2i") returned 0x0 [0096.254] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.256] lstrlenW (lpString=".sql") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".sql") returned 0x0 [0096.256] lstrlenW (lpString=".mdf") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".mdf") returned 0x0 [0096.256] lstrlenW (lpString=".txt") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".txt") returned 0x0 [0096.256] lstrlenW (lpString=".dbf") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".dbf") returned 0x0 [0096.256] lstrlenW (lpString=".ckp") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".ckp") returned 0x0 [0096.256] lstrlenW (lpString=".dacpac") returned 7 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".dacpac") returned 0x0 [0096.256] lstrlenW (lpString=".db3") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".db3") returned 0x0 [0096.256] lstrlenW (lpString=".dtxs") returned 5 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".dtxs") returned 0x0 [0096.256] lstrlenW (lpString=".mdt") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".mdt") returned 0x0 [0096.256] lstrlenW (lpString=".sdf") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".sdf") returned 0x0 [0096.256] lstrlenW (lpString=".MDF") returned 4 [0096.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".MDF") returned 0x0 [0096.256] lstrlenW (lpString=".DBF") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".DBF") returned 0x0 [0096.257] lstrlenW (lpString=".DB") returned 3 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".DB") returned 0x0 [0096.257] lstrlenW (lpString=".db") returned 3 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".db") returned 0x0 [0096.257] lstrlenW (lpString=".ndf") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".ndf") returned 0x0 [0096.257] lstrlenW (lpString=".NDF") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".NDF") returned 0x0 [0096.257] lstrlenW (lpString=".Mdf") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".Mdf") returned 0x0 [0096.257] lstrlenW (lpString=".dat") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".dat") returned 0x0 [0096.257] lstrlenW (lpString=".DAT") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".DAT") returned 0x0 [0096.257] lstrlenW (lpString=".ldf") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".ldf") returned 0x0 [0096.257] lstrlenW (lpString=".LDF") returned 4 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch=".LDF") returned 0x0 [0096.257] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.257] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6a08) returned 1 [0096.258] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.258] CryptReleaseContext (hProv=0x27e6a08, dwFlags=0x0) returned 1 [0096.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.258] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21625952876) returned 1 [0096.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc8300f50, dwHighDateTime=0x1d585b4)) [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1628 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1628 | out: hHeap=0x260000) returned 1 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f730 [0096.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f730 | out: hHeap=0x260000) returned 1 [0096.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0096.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.259] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.259] GetLastError () returned 0x0 [0096.259] GetLastError () returned 0x0 [0096.260] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.260] GetLastError () returned 0x0 [0096.260] GetLastError () returned 0x0 [0096.267] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.267] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0096.267] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.267] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.270] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.270] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.270] CloseHandle (hObject=0x108) returned 1 [0096.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.272] GetLastError () returned 0x0 [0096.272] RtlWakeConditionVariable () returned 0x27e828 [0096.272] GetCurrentThreadId () returned 0x98c [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".ldf") returned 0x0 [0096.272] lstrlenW (lpString=".vhd") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".vhd") returned 0x0 [0096.272] lstrlenW (lpString=".vhdx") returned 5 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".vhdx") returned 0x0 [0096.272] lstrlenW (lpString=".pst") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".pst") returned 0x0 [0096.272] lstrlenW (lpString=".ost") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".ost") returned 0x0 [0096.272] lstrlenW (lpString=".bak") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".bak") returned 0x0 [0096.272] lstrlenW (lpString=".bac") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".bac") returned 0x0 [0096.272] lstrlenW (lpString=".sys") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".sys") returned 0x0 [0096.272] lstrlenW (lpString=".v2i") returned 4 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".v2i") returned 0x0 [0096.272] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0096.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.273] lstrlenW (lpString=".sql") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".sql") returned 0x0 [0096.274] lstrlenW (lpString=".mdf") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".mdf") returned 0x0 [0096.274] lstrlenW (lpString=".txt") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".txt") returned 0x0 [0096.274] lstrlenW (lpString=".dbf") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".dbf") returned 0x0 [0096.274] lstrlenW (lpString=".ckp") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".ckp") returned 0x0 [0096.274] lstrlenW (lpString=".dacpac") returned 7 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".dacpac") returned 0x0 [0096.274] lstrlenW (lpString=".db3") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".db3") returned 0x0 [0096.274] lstrlenW (lpString=".dtxs") returned 5 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".dtxs") returned 0x0 [0096.274] lstrlenW (lpString=".mdt") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".mdt") returned 0x0 [0096.274] lstrlenW (lpString=".sdf") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".sdf") returned 0x0 [0096.274] lstrlenW (lpString=".MDF") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".MDF") returned 0x0 [0096.274] lstrlenW (lpString=".DBF") returned 4 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".DBF") returned 0x0 [0096.274] lstrlenW (lpString=".DB") returned 3 [0096.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".DB") returned 0x0 [0096.274] lstrlenW (lpString=".db") returned 3 [0096.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".db") returned 0x0 [0096.275] lstrlenW (lpString=".ndf") returned 4 [0096.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".ndf") returned 0x0 [0096.275] lstrlenW (lpString=".NDF") returned 4 [0096.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".NDF") returned 0x0 [0096.275] lstrlenW (lpString=".Mdf") returned 4 [0096.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".Mdf") returned 0x0 [0096.275] lstrlenW (lpString=".dat") returned 4 [0096.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".dat") returned 0x0 [0096.275] lstrlenW (lpString=".DAT") returned 4 [0096.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", lpSrch=".DAT") returned=".DAT" [0096.275] lstrlenW (lpString=".DAT") returned 4 [0096.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.275] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6a08) returned 1 [0096.276] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.276] CryptReleaseContext (hProv=0x27e6a08, dwFlags=0x0) returned 1 [0096.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.276] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21627713297) returned 1 [0096.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc83270b0, dwHighDateTime=0x1d585b4)) [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1698 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1698 | out: hHeap=0x260000) returned 1 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0096.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.277] GetLastError () returned 0x0 [0096.277] GetLastError () returned 0x0 [0096.277] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.277] GetLastError () returned 0x0 [0096.277] GetLastError () returned 0x0 [0096.344] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff2ff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.344] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd00c, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x224fdb0*=0xd00c, lpOverlapped=0x0) returned 1 [0096.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0096.345] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.358] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.358] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.358] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.358] CloseHandle (hObject=0x108) returned 1 [0096.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.[deadmin@cock.li].deadmin")) returned 1 [0096.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.360] GetLastError () returned 0x0 [0096.360] RtlWakeConditionVariable () returned 0x0 [0096.360] GetCurrentThreadId () returned 0x98c [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".ldf") returned 0x0 [0096.361] lstrlenW (lpString=".vhd") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".vhd") returned 0x0 [0096.361] lstrlenW (lpString=".vhdx") returned 5 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".vhdx") returned 0x0 [0096.361] lstrlenW (lpString=".pst") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".pst") returned 0x0 [0096.361] lstrlenW (lpString=".ost") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".ost") returned 0x0 [0096.361] lstrlenW (lpString=".bak") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".bak") returned 0x0 [0096.361] lstrlenW (lpString=".bac") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".bac") returned 0x0 [0096.361] lstrlenW (lpString=".sys") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".sys") returned 0x0 [0096.361] lstrlenW (lpString=".v2i") returned 4 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".v2i") returned 0x0 [0096.361] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.436] lstrlenW (lpString=".sql") returned 4 [0096.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".sql") returned 0x0 [0096.436] lstrlenW (lpString=".mdf") returned 4 [0096.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".mdf") returned 0x0 [0096.436] lstrlenW (lpString=".txt") returned 4 [0096.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".txt") returned 0x0 [0096.437] lstrlenW (lpString=".dbf") returned 4 [0096.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".dbf") returned 0x0 [0096.437] lstrlenW (lpString=".ckp") returned 4 [0096.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".ckp") returned 0x0 [0096.440] lstrlenW (lpString=".dacpac") returned 7 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".dacpac") returned 0x0 [0096.440] lstrlenW (lpString=".db3") returned 4 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".db3") returned 0x0 [0096.440] lstrlenW (lpString=".dtxs") returned 5 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".dtxs") returned 0x0 [0096.440] lstrlenW (lpString=".mdt") returned 4 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".mdt") returned 0x0 [0096.440] lstrlenW (lpString=".sdf") returned 4 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".sdf") returned 0x0 [0096.440] lstrlenW (lpString=".MDF") returned 4 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".MDF") returned 0x0 [0096.440] lstrlenW (lpString=".DBF") returned 4 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".DBF") returned 0x0 [0096.440] lstrlenW (lpString=".DB") returned 3 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".DB") returned 0x0 [0096.440] lstrlenW (lpString=".db") returned 3 [0096.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".db") returned 0x0 [0096.440] lstrlenW (lpString=".ndf") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".ndf") returned 0x0 [0096.441] lstrlenW (lpString=".NDF") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".NDF") returned 0x0 [0096.441] lstrlenW (lpString=".Mdf") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".Mdf") returned 0x0 [0096.441] lstrlenW (lpString=".dat") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".dat") returned 0x0 [0096.441] lstrlenW (lpString=".DAT") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".DAT") returned 0x0 [0096.441] lstrlenW (lpString=".ldf") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".ldf") returned 0x0 [0096.441] lstrlenW (lpString=".LDF") returned 4 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch=".LDF") returned 0x0 [0096.441] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.441] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2768060) returned 1 [0096.442] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.442] CryptReleaseContext (hProv=0x2768060, dwFlags=0x0) returned 1 [0096.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.442] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21644333672) returned 1 [0096.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc84c9fd0, dwHighDateTime=0x1d585b4)) [0096.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1900 [0096.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1900 | out: hHeap=0x260000) returned 1 [0096.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f820 [0096.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f820 | out: hHeap=0x260000) returned 1 [0096.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.443] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.443] GetLastError () returned 0x0 [0096.443] GetLastError () returned 0x0 [0096.443] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.443] GetLastError () returned 0x0 [0096.444] GetLastError () returned 0x0 [0096.446] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.447] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.448] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.448] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.450] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.450] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.450] CloseHandle (hObject=0x108) returned 1 [0096.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0096.450] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0096.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.452] GetLastError () returned 0x0 [0096.452] RtlWakeConditionVariable () returned 0x0 [0096.452] GetCurrentThreadId () returned 0x98c [0096.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".ldf") returned 0x0 [0096.453] lstrlenW (lpString=".vhd") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".vhd") returned 0x0 [0096.453] lstrlenW (lpString=".vhdx") returned 5 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".vhdx") returned 0x0 [0096.453] lstrlenW (lpString=".pst") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".pst") returned 0x0 [0096.453] lstrlenW (lpString=".ost") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".ost") returned 0x0 [0096.453] lstrlenW (lpString=".bak") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".bak") returned 0x0 [0096.453] lstrlenW (lpString=".bac") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".bac") returned 0x0 [0096.453] lstrlenW (lpString=".sys") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".sys") returned 0x0 [0096.453] lstrlenW (lpString=".v2i") returned 4 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".v2i") returned 0x0 [0096.453] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.455] lstrlenW (lpString=".sql") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".sql") returned 0x0 [0096.455] lstrlenW (lpString=".mdf") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".mdf") returned 0x0 [0096.455] lstrlenW (lpString=".txt") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".txt") returned 0x0 [0096.455] lstrlenW (lpString=".dbf") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".dbf") returned 0x0 [0096.455] lstrlenW (lpString=".ckp") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".ckp") returned 0x0 [0096.455] lstrlenW (lpString=".dacpac") returned 7 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".dacpac") returned 0x0 [0096.455] lstrlenW (lpString=".db3") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".db3") returned 0x0 [0096.455] lstrlenW (lpString=".dtxs") returned 5 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".dtxs") returned 0x0 [0096.455] lstrlenW (lpString=".mdt") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".mdt") returned 0x0 [0096.455] lstrlenW (lpString=".sdf") returned 4 [0096.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".sdf") returned 0x0 [0096.456] lstrlenW (lpString=".MDF") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".MDF") returned 0x0 [0096.456] lstrlenW (lpString=".DBF") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".DBF") returned 0x0 [0096.456] lstrlenW (lpString=".DB") returned 3 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".DB") returned 0x0 [0096.456] lstrlenW (lpString=".db") returned 3 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".db") returned 0x0 [0096.456] lstrlenW (lpString=".ndf") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".ndf") returned 0x0 [0096.456] lstrlenW (lpString=".NDF") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".NDF") returned 0x0 [0096.456] lstrlenW (lpString=".Mdf") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".Mdf") returned 0x0 [0096.456] lstrlenW (lpString=".dat") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".dat") returned 0x0 [0096.456] lstrlenW (lpString=".DAT") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".DAT") returned 0x0 [0096.456] lstrlenW (lpString=".ldf") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".ldf") returned 0x0 [0096.456] lstrlenW (lpString=".LDF") returned 4 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch=".LDF") returned 0x0 [0096.456] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.457] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x27e6ba0) returned 1 [0096.457] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.457] CryptReleaseContext (hProv=0x27e6ba0, dwFlags=0x0) returned 1 [0096.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0096.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0096.458] QueryPerformanceCounter (in: lpPerformanceCount=0x224fb10 | out: lpPerformanceCount=0x224fb10*=21645865415) returned 1 [0096.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x224fb50 | out: lpSystemTimeAsFileTime=0x224fb50*(dwLowDateTime=0xc84f0130, dwHighDateTime=0x1d585b4)) [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1938 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1938 | out: hHeap=0x260000) returned 1 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.458] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x224f9f0) [0096.458] GetLastError () returned 0x0 [0096.459] GetLastError () returned 0x0 [0096.459] RtlUnwind (TargetFrame=0x224fae8, TargetIp=0x42ae4e, ExceptionRecord=0x224f4b4, ReturnValue=0x0) [0096.459] GetLastError () returned 0x0 [0096.459] GetLastError () returned 0x0 [0096.463] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.463] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x224fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.464] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x224fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.464] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.464] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x224fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x224fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.464] CloseHandle (hObject=0x108) returned 1 [0096.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d46a0 [0096.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d46a0 | out: hHeap=0x260000) returned 1 [0096.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0096.466] GetLastError () returned 0x0 [0096.466] RtlWakeConditionVariable () returned 0x0 [0096.466] GetCurrentThreadId () returned 0x98c [0096.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".ldf") returned 0x0 [0096.466] lstrlenW (lpString=".vhd") returned 4 [0096.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".vhd") returned 0x0 [0096.466] lstrlenW (lpString=".vhdx") returned 5 [0096.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".vhdx") returned 0x0 [0096.466] lstrlenW (lpString=".pst") returned 4 [0096.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".pst") returned 0x0 [0096.467] lstrlenW (lpString=".ost") returned 4 [0096.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".ost") returned 0x0 [0096.467] lstrlenW (lpString=".bak") returned 4 [0096.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".bak") returned 0x0 [0096.467] lstrlenW (lpString=".bac") returned 4 [0096.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".bac") returned 0x0 [0096.467] lstrlenW (lpString=".sys") returned 4 [0096.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".sys") returned 0x0 [0096.467] lstrlenW (lpString=".v2i") returned 4 [0096.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".v2i") returned 0x0 [0096.467] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch="s\r\n.v2i") returned 0x0 [0096.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.468] lstrlenW (lpString=".sql") returned 4 [0096.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".sql") returned 0x0 [0096.468] lstrlenW (lpString=".mdf") returned 4 [0096.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".mdf") returned 0x0 [0096.468] lstrlenW (lpString=".txt") returned 4 [0096.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".txt") returned 0x0 [0096.468] lstrlenW (lpString=".dbf") returned 4 [0096.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".dbf") returned 0x0 [0096.468] lstrlenW (lpString=".ckp") returned 4 [0096.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".ckp") returned 0x0 [0096.468] lstrlenW (lpString=".dacpac") returned 7 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".dacpac") returned 0x0 [0096.469] lstrlenW (lpString=".db3") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".db3") returned 0x0 [0096.469] lstrlenW (lpString=".dtxs") returned 5 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".dtxs") returned 0x0 [0096.469] lstrlenW (lpString=".mdt") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".mdt") returned 0x0 [0096.469] lstrlenW (lpString=".sdf") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".sdf") returned 0x0 [0096.469] lstrlenW (lpString=".MDF") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".MDF") returned 0x0 [0096.469] lstrlenW (lpString=".DBF") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".DBF") returned 0x0 [0096.469] lstrlenW (lpString=".DB") returned 3 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".DB") returned 0x0 [0096.469] lstrlenW (lpString=".db") returned 3 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".db") returned 0x0 [0096.469] lstrlenW (lpString=".ndf") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".ndf") returned 0x0 [0096.469] lstrlenW (lpString=".NDF") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".NDF") returned 0x0 [0096.469] lstrlenW (lpString=".Mdf") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".Mdf") returned 0x0 [0096.469] lstrlenW (lpString=".dat") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".dat") returned 0x0 [0096.469] lstrlenW (lpString=".DAT") returned 4 [0096.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".DAT") returned 0x0 [0096.470] lstrlenW (lpString=".ldf") returned 4 [0096.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".ldf") returned 0x0 [0096.470] lstrlenW (lpString=".LDF") returned 4 [0096.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch=".LDF") returned 0x0 [0096.470] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0096.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.470] CryptAcquireContextA (in: phProv=0x224fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x224fb80*=0x2768170) returned 1 [0096.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.505] CryptReleaseContext (hProv=0x2768170, dwFlags=0x0) returned 1 [0096.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.543] GetLastError () returned 0x0 [0096.543] GetLastError () returned 0x0 [0096.543] GetLastError () returned 0x0 [0096.543] GetLastError () returned 0x0 Thread: id = 6 os_tid = 0x998 [0029.678] GetLastError () returned 0x57 [0029.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x364) returned 0x27d5c0 [0029.678] SetLastError (dwErrCode=0x57) [0029.678] GetCurrentThreadId () returned 0x998 [0029.678] GetCurrentThreadId () returned 0x998 [0029.678] RtlWakeConditionVariable () returned 0x1 [0029.680] GetCurrentThreadId () returned 0x998 [0029.680] GetCurrentThreadId () returned 0x998 [0029.680] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.769] GetCurrentThreadId () returned 0x998 [0029.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0029.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.769] lstrlenW (lpString=".ldf") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".ldf") returned 0x0 [0029.769] lstrlenW (lpString=".vhd") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".vhd") returned 0x0 [0029.769] lstrlenW (lpString=".vhdx") returned 5 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".vhdx") returned 0x0 [0029.769] lstrlenW (lpString=".pst") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".pst") returned 0x0 [0029.769] lstrlenW (lpString=".ost") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".ost") returned 0x0 [0029.769] lstrlenW (lpString=".bak") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".bak") returned 0x0 [0029.769] lstrlenW (lpString=".bac") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".bac") returned 0x0 [0029.769] lstrlenW (lpString=".sys") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".sys") returned 0x0 [0029.769] lstrlenW (lpString=".v2i") returned 4 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch=".v2i") returned 0x0 [0029.769] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.769] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\..", lpSrch="s\r\n.v2i") returned 0x0 [0029.769] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.770] RtlWakeConditionVariable () returned 0x27e828 [0029.770] GetCurrentThreadId () returned 0x998 [0029.770] GetCurrentThreadId () returned 0x998 [0029.770] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.813] GetCurrentThreadId () returned 0x998 [0029.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b2e58 [0029.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b2d90 [0029.813] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.815] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.815] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.815] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.815] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.816] CloseHandle (hObject=0xec) returned 1 [0029.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2e58 | out: hHeap=0x260000) returned 1 [0029.816] RtlWakeConditionVariable () returned 0x27e828 [0029.816] GetCurrentThreadId () returned 0x998 [0029.816] GetCurrentThreadId () returned 0x998 [0029.816] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.829] GetCurrentThreadId () returned 0x998 [0029.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efe8 [0029.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0029.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0029.829] lstrlenW (lpString=".ldf") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".ldf") returned 0x0 [0029.829] lstrlenW (lpString=".vhd") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".vhd") returned 0x0 [0029.829] lstrlenW (lpString=".vhdx") returned 5 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".vhdx") returned 0x0 [0029.829] lstrlenW (lpString=".pst") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".pst") returned 0x0 [0029.829] lstrlenW (lpString=".ost") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".ost") returned 0x0 [0029.829] lstrlenW (lpString=".bak") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".bak") returned 0x0 [0029.829] lstrlenW (lpString=".bac") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".bac") returned 0x0 [0029.829] lstrlenW (lpString=".sys") returned 4 [0029.829] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".sys") returned 0x0 [0029.829] lstrlenW (lpString=".v2i") returned 4 [0029.830] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch=".v2i") returned 0x0 [0029.830] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.830] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD", lpSrch="s\r\n.v2i") returned 0x0 [0029.830] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0029.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efe8 | out: hHeap=0x260000) returned 1 [0029.830] RtlWakeConditionVariable () returned 0x27e828 [0029.830] GetCurrentThreadId () returned 0x998 [0029.830] GetCurrentThreadId () returned 0x998 [0029.830] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.857] GetCurrentThreadId () returned 0x998 [0029.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0029.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0029.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0029.857] lstrlenW (lpString=".ldf") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".ldf") returned 0x0 [0029.857] lstrlenW (lpString=".vhd") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".vhd") returned 0x0 [0029.857] lstrlenW (lpString=".vhdx") returned 5 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".vhdx") returned 0x0 [0029.857] lstrlenW (lpString=".pst") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".pst") returned 0x0 [0029.857] lstrlenW (lpString=".ost") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".ost") returned 0x0 [0029.857] lstrlenW (lpString=".bak") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".bak") returned 0x0 [0029.857] lstrlenW (lpString=".bac") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".bac") returned 0x0 [0029.857] lstrlenW (lpString=".sys") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".sys") returned 0x0 [0029.857] lstrlenW (lpString=".v2i") returned 4 [0029.857] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".v2i") returned 0x0 [0029.858] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.858] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0029.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.859] lstrlenW (lpString=".sql") returned 4 [0029.859] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".sql") returned 0x0 [0029.859] lstrlenW (lpString=".mdf") returned 4 [0029.859] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".mdf") returned 0x0 [0029.859] lstrlenW (lpString=".txt") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".txt") returned 0x0 [0029.860] lstrlenW (lpString=".dbf") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".dbf") returned 0x0 [0029.860] lstrlenW (lpString=".ckp") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".ckp") returned 0x0 [0029.860] lstrlenW (lpString=".dacpac") returned 7 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".dacpac") returned 0x0 [0029.860] lstrlenW (lpString=".db3") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".db3") returned 0x0 [0029.860] lstrlenW (lpString=".dtxs") returned 5 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".dtxs") returned 0x0 [0029.860] lstrlenW (lpString=".mdt") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".mdt") returned 0x0 [0029.860] lstrlenW (lpString=".sdf") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".sdf") returned 0x0 [0029.860] lstrlenW (lpString=".MDF") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".MDF") returned 0x0 [0029.860] lstrlenW (lpString=".DBF") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".DBF") returned 0x0 [0029.860] lstrlenW (lpString=".DB") returned 3 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".DB") returned 0x0 [0029.860] lstrlenW (lpString=".db") returned 3 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".db") returned 0x0 [0029.860] lstrlenW (lpString=".ndf") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".ndf") returned 0x0 [0029.860] lstrlenW (lpString=".NDF") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".NDF") returned 0x0 [0029.860] lstrlenW (lpString=".Mdf") returned 4 [0029.860] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".Mdf") returned 0x0 [0029.861] lstrlenW (lpString=".dat") returned 4 [0029.861] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".dat") returned 0x0 [0029.861] lstrlenW (lpString=".DAT") returned 4 [0029.861] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BOOTSTAT.DAT", lpSrch=".DAT") returned=".DAT" [0029.861] lstrlenW (lpString=".DAT") returned 4 [0029.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0029.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0029.861] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e0c0) returned 1 [0029.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0029.862] CryptReleaseContext (hProv=0x27e0c0, dwFlags=0x0) returned 1 [0029.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0029.862] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=14986325700) returned 1 [0029.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa25a5470, dwHighDateTime=0x1d585b4)) [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e0c0 [0029.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b2d90 [0029.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27e0c0 [0029.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b2d90 [0029.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0029.863] GetLastError () returned 0x0 [0029.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x27e0c0 [0029.863] SetLastError (dwErrCode=0x0) [0029.863] GetLastError () returned 0x0 [0029.863] SetLastError (dwErrCode=0x0) [0029.863] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.864] GetLastError () returned 0x0 [0029.864] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] GetLastError () returned 0x0 [0029.865] SetLastError (dwErrCode=0x0) [0029.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2b4238 [0029.865] ReadFile (in: hFile=0xec, lpBuffer=0x2b4238, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesRead=0x1cffdb0*=0x10000, lpOverlapped=0x0) returned 1 [0029.868] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffff0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0029.868] WriteFile (in: hFile=0xec, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x10000, lpOverlapped=0x0) returned 1 [0029.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.868] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.868] WriteFile (in: hFile=0xec, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0029.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0029.869] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0029.869] CloseHandle (hObject=0xec) returned 1 [0029.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x27e0f0 [0029.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\boot\\bootstat.dat.[deadmin@cock.li].deadmin")) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0029.872] GetLastError () returned 0x0 [0029.872] SetLastError (dwErrCode=0x0) [0029.872] GetLastError () returned 0x0 [0029.872] SetLastError (dwErrCode=0x0) [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0029.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0029.872] RtlWakeConditionVariable () returned 0x27e828 [0029.872] GetCurrentThreadId () returned 0x998 [0029.872] GetCurrentThreadId () returned 0x998 [0029.872] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.884] GetCurrentThreadId () returned 0x998 [0029.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\da-dk\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.884] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.884] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.884] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.885] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.886] CloseHandle (hObject=0xec) returned 1 [0029.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.886] RtlWakeConditionVariable () returned 0x27e828 [0029.886] GetCurrentThreadId () returned 0x998 [0029.886] GetCurrentThreadId () returned 0x998 [0029.886] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.900] GetCurrentThreadId () returned 0x998 [0029.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.900] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\el-gr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.900] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.900] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.900] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.900] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.901] CloseHandle (hObject=0xec) returned 1 [0029.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.902] RtlWakeConditionVariable () returned 0x27e828 [0029.902] GetCurrentThreadId () returned 0x998 [0029.902] GetCurrentThreadId () returned 0x998 [0029.902] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.927] GetCurrentThreadId () returned 0x998 [0029.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.927] lstrlenW (lpString=".ldf") returned 4 [0029.927] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.927] lstrlenW (lpString=".vhd") returned 4 [0029.927] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.927] lstrlenW (lpString=".vhdx") returned 5 [0029.927] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.927] lstrlenW (lpString=".pst") returned 4 [0029.927] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.928] lstrlenW (lpString=".ost") returned 4 [0029.928] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.928] lstrlenW (lpString=".bak") returned 4 [0029.928] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.928] lstrlenW (lpString=".bac") returned 4 [0029.928] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.928] lstrlenW (lpString=".sys") returned 4 [0029.928] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.928] lstrlenW (lpString=".v2i") returned 4 [0029.928] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.928] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.928] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.928] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.928] RtlWakeConditionVariable () returned 0x27e828 [0029.928] GetCurrentThreadId () returned 0x998 [0029.928] GetCurrentThreadId () returned 0x998 [0029.928] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.999] GetCurrentThreadId () returned 0x998 [0029.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.000] lstrlenW (lpString=".ldf") returned 4 [0030.000] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".ldf") returned 0x0 [0030.000] lstrlenW (lpString=".vhd") returned 4 [0030.000] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".vhd") returned 0x0 [0030.001] lstrlenW (lpString=".vhdx") returned 5 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".vhdx") returned 0x0 [0030.001] lstrlenW (lpString=".pst") returned 4 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".pst") returned 0x0 [0030.001] lstrlenW (lpString=".ost") returned 4 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".ost") returned 0x0 [0030.001] lstrlenW (lpString=".bak") returned 4 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".bak") returned 0x0 [0030.001] lstrlenW (lpString=".bac") returned 4 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".bac") returned 0x0 [0030.001] lstrlenW (lpString=".sys") returned 4 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".sys") returned 0x0 [0030.001] lstrlenW (lpString=".v2i") returned 4 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch=".v2i") returned 0x0 [0030.001] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.001] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf", lpSrch="s\r\n.v2i") returned 0x0 [0030.001] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.001] RtlWakeConditionVariable () returned 0x27e828 [0030.001] GetCurrentThreadId () returned 0x998 [0030.001] GetCurrentThreadId () returned 0x998 [0030.001] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.007] GetCurrentThreadId () returned 0x998 [0030.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.007] lstrlenW (lpString=".ldf") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".ldf") returned 0x0 [0030.007] lstrlenW (lpString=".vhd") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".vhd") returned 0x0 [0030.007] lstrlenW (lpString=".vhdx") returned 5 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".vhdx") returned 0x0 [0030.007] lstrlenW (lpString=".pst") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".pst") returned 0x0 [0030.007] lstrlenW (lpString=".ost") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".ost") returned 0x0 [0030.007] lstrlenW (lpString=".bak") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".bak") returned 0x0 [0030.007] lstrlenW (lpString=".bac") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".bac") returned 0x0 [0030.007] lstrlenW (lpString=".sys") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".sys") returned 0x0 [0030.007] lstrlenW (lpString=".v2i") returned 4 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch=".v2i") returned 0x0 [0030.007] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.007] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf", lpSrch="s\r\n.v2i") returned 0x0 [0030.008] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.008] RtlWakeConditionVariable () returned 0x27e828 [0030.008] GetCurrentThreadId () returned 0x998 [0030.008] GetCurrentThreadId () returned 0x998 [0030.008] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.070] GetCurrentThreadId () returned 0x998 [0030.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.070] lstrlenW (lpString=".ldf") returned 4 [0030.070] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.071] lstrlenW (lpString=".vhd") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.071] lstrlenW (lpString=".vhdx") returned 5 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.071] lstrlenW (lpString=".pst") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.071] lstrlenW (lpString=".ost") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.071] lstrlenW (lpString=".bak") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.071] lstrlenW (lpString=".bac") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.071] lstrlenW (lpString=".sys") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.071] lstrlenW (lpString=".v2i") returned 4 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.071] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.071] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.071] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.071] RtlWakeConditionVariable () returned 0x27e828 [0030.071] GetCurrentThreadId () returned 0x998 [0030.071] GetCurrentThreadId () returned 0x998 [0030.071] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.085] GetCurrentThreadId () returned 0x998 [0030.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.086] lstrlenW (lpString=".ldf") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.086] lstrlenW (lpString=".vhd") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.086] lstrlenW (lpString=".vhdx") returned 5 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.086] lstrlenW (lpString=".pst") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.086] lstrlenW (lpString=".ost") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.086] lstrlenW (lpString=".bak") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.086] lstrlenW (lpString=".bac") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.086] lstrlenW (lpString=".sys") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.086] lstrlenW (lpString=".v2i") returned 4 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.086] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.086] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.086] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.086] RtlWakeConditionVariable () returned 0x27e828 [0030.086] GetCurrentThreadId () returned 0x998 [0030.086] GetCurrentThreadId () returned 0x998 [0030.087] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.103] GetCurrentThreadId () returned 0x998 [0030.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.103] lstrlenW (lpString=".ldf") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".ldf") returned 0x0 [0030.103] lstrlenW (lpString=".vhd") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".vhd") returned 0x0 [0030.103] lstrlenW (lpString=".vhdx") returned 5 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".vhdx") returned 0x0 [0030.103] lstrlenW (lpString=".pst") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".pst") returned 0x0 [0030.103] lstrlenW (lpString=".ost") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".ost") returned 0x0 [0030.103] lstrlenW (lpString=".bak") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".bak") returned 0x0 [0030.103] lstrlenW (lpString=".bac") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".bac") returned 0x0 [0030.103] lstrlenW (lpString=".sys") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".sys") returned 0x0 [0030.103] lstrlenW (lpString=".v2i") returned 4 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch=".v2i") returned 0x0 [0030.103] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.103] StrStrW (lpFirst="\\\\?\\C:\\Boot\\memtest.exe", lpSrch="s\r\n.v2i") returned 0x0 [0030.103] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.103] RtlWakeConditionVariable () returned 0x27e828 [0030.103] GetCurrentThreadId () returned 0x998 [0030.104] GetCurrentThreadId () returned 0x998 [0030.104] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.112] GetCurrentThreadId () returned 0x998 [0030.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.112] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\nl-nl\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.115] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.115] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.115] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.115] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.116] CloseHandle (hObject=0xec) returned 1 [0030.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.116] RtlWakeConditionVariable () returned 0x27e828 [0030.116] GetCurrentThreadId () returned 0x998 [0030.116] GetCurrentThreadId () returned 0x998 [0030.116] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.124] GetCurrentThreadId () returned 0x998 [0030.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.124] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\pt-br\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.125] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.125] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.125] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.125] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.126] CloseHandle (hObject=0xec) returned 1 [0030.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.126] RtlWakeConditionVariable () returned 0x27e828 [0030.126] GetCurrentThreadId () returned 0x998 [0030.126] GetCurrentThreadId () returned 0x998 [0030.126] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.136] GetCurrentThreadId () returned 0x998 [0030.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.136] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\ru-ru\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.136] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.136] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.136] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.136] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.137] CloseHandle (hObject=0xec) returned 1 [0030.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.137] RtlWakeConditionVariable () returned 0x27e828 [0030.137] GetCurrentThreadId () returned 0x998 [0030.137] GetCurrentThreadId () returned 0x998 [0030.138] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.146] GetCurrentThreadId () returned 0x998 [0030.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.146] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\tr-tr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.147] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.147] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.147] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.147] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.148] CloseHandle (hObject=0xec) returned 1 [0030.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.148] RtlWakeConditionVariable () returned 0x27e828 [0030.148] GetCurrentThreadId () returned 0x998 [0030.148] GetCurrentThreadId () returned 0x998 [0030.148] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.158] GetCurrentThreadId () returned 0x998 [0030.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.158] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\zh-hk\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.158] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.158] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.158] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.158] WriteFile (in: hFile=0xec, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.159] CloseHandle (hObject=0xec) returned 1 [0030.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.159] RtlWakeConditionVariable () returned 0x27e828 [0030.159] GetCurrentThreadId () returned 0x998 [0030.159] GetCurrentThreadId () returned 0x998 [0030.159] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.167] GetCurrentThreadId () returned 0x998 [0030.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0030.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efe8 | out: hHeap=0x260000) returned 1 [0030.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efe8 [0030.167] lstrlenW (lpString=".ldf") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".ldf") returned 0x0 [0030.167] lstrlenW (lpString=".vhd") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".vhd") returned 0x0 [0030.167] lstrlenW (lpString=".vhdx") returned 5 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".vhdx") returned 0x0 [0030.167] lstrlenW (lpString=".pst") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".pst") returned 0x0 [0030.167] lstrlenW (lpString=".ost") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".ost") returned 0x0 [0030.167] lstrlenW (lpString=".bak") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".bak") returned 0x0 [0030.167] lstrlenW (lpString=".bac") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".bac") returned 0x0 [0030.167] lstrlenW (lpString=".sys") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".sys") returned 0x0 [0030.167] lstrlenW (lpString=".v2i") returned 4 [0030.167] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch=".v2i") returned 0x0 [0030.167] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.168] StrStrW (lpFirst="\\\\?\\C:\\bootmgr", lpSrch="s\r\n.v2i") returned 0x0 [0030.168] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efe8 | out: hHeap=0x260000) returned 1 [0030.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0030.168] RtlWakeConditionVariable () returned 0x27e828 [0030.168] GetCurrentThreadId () returned 0x998 [0030.168] GetCurrentThreadId () returned 0x998 [0030.168] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.174] GetCurrentThreadId () returned 0x998 [0030.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.175] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\config.msi\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0030.175] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.175] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.175] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.175] WriteFile (in: hFile=0xe8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.176] CloseHandle (hObject=0xe8) returned 1 [0030.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.176] RtlWakeConditionVariable () returned 0x27e828 [0030.176] GetCurrentThreadId () returned 0x998 [0030.176] GetCurrentThreadId () returned 0x998 [0030.176] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.187] GetCurrentThreadId () returned 0x998 [0030.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.187] lstrlenW (lpString=".ldf") returned 4 [0030.187] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".ldf") returned 0x0 [0030.187] lstrlenW (lpString=".vhd") returned 4 [0030.187] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".vhd") returned 0x0 [0030.187] lstrlenW (lpString=".vhdx") returned 5 [0030.187] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".vhdx") returned 0x0 [0030.187] lstrlenW (lpString=".pst") returned 4 [0030.187] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".pst") returned 0x0 [0030.187] lstrlenW (lpString=".ost") returned 4 [0030.187] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".ost") returned 0x0 [0030.187] lstrlenW (lpString=".bak") returned 4 [0030.188] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".bak") returned 0x0 [0030.188] lstrlenW (lpString=".bac") returned 4 [0030.188] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".bac") returned 0x0 [0030.188] lstrlenW (lpString=".sys") returned 4 [0030.188] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".sys") returned 0x0 [0030.188] lstrlenW (lpString=".v2i") returned 4 [0030.188] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch=".v2i") returned 0x0 [0030.188] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.188] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\.", lpSrch="s\r\n.v2i") returned 0x0 [0030.188] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\." (normalized: "c:\\msocache\\all users\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.188] RtlWakeConditionVariable () returned 0x27e828 [0030.188] GetCurrentThreadId () returned 0x998 [0030.188] GetCurrentThreadId () returned 0x998 [0030.188] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.198] GetCurrentThreadId () returned 0x998 [0030.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b2e38 [0030.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0030.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b2d90 [0030.199] lstrlenW (lpString=".ldf") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".ldf") returned 0x0 [0030.199] lstrlenW (lpString=".vhd") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".vhd") returned 0x0 [0030.199] lstrlenW (lpString=".vhdx") returned 5 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".vhdx") returned 0x0 [0030.199] lstrlenW (lpString=".pst") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".pst") returned 0x0 [0030.199] lstrlenW (lpString=".ost") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".ost") returned 0x0 [0030.199] lstrlenW (lpString=".bak") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".bak") returned 0x0 [0030.199] lstrlenW (lpString=".bac") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".bac") returned 0x0 [0030.199] lstrlenW (lpString=".sys") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".sys") returned 0x0 [0030.199] lstrlenW (lpString=".v2i") returned 4 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".v2i") returned 0x0 [0030.199] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.199] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0030.199] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0030.200] lstrlenW (lpString=".sql") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".sql") returned 0x0 [0030.200] lstrlenW (lpString=".mdf") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".mdf") returned 0x0 [0030.200] lstrlenW (lpString=".txt") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".txt") returned 0x0 [0030.200] lstrlenW (lpString=".dbf") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".dbf") returned 0x0 [0030.200] lstrlenW (lpString=".ckp") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".ckp") returned 0x0 [0030.200] lstrlenW (lpString=".dacpac") returned 7 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".dacpac") returned 0x0 [0030.200] lstrlenW (lpString=".db3") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".db3") returned 0x0 [0030.200] lstrlenW (lpString=".dtxs") returned 5 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".dtxs") returned 0x0 [0030.200] lstrlenW (lpString=".mdt") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".mdt") returned 0x0 [0030.200] lstrlenW (lpString=".sdf") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".sdf") returned 0x0 [0030.200] lstrlenW (lpString=".MDF") returned 4 [0030.200] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".MDF") returned 0x0 [0030.201] lstrlenW (lpString=".DBF") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".DBF") returned 0x0 [0030.201] lstrlenW (lpString=".DB") returned 3 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".DB") returned 0x0 [0030.201] lstrlenW (lpString=".db") returned 3 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".db") returned 0x0 [0030.201] lstrlenW (lpString=".ndf") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".ndf") returned 0x0 [0030.201] lstrlenW (lpString=".NDF") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".NDF") returned 0x0 [0030.201] lstrlenW (lpString=".Mdf") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".Mdf") returned 0x0 [0030.201] lstrlenW (lpString=".dat") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".dat") returned 0x0 [0030.201] lstrlenW (lpString=".DAT") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".DAT") returned 0x0 [0030.201] lstrlenW (lpString=".ldf") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".ldf") returned 0x0 [0030.201] lstrlenW (lpString=".LDF") returned 4 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch=".LDF") returned 0x0 [0030.201] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.201] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0030.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.201] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d118) returned 1 [0030.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.202] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0030.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0030.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6258 [0030.202] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15020363832) returned 1 [0030.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa28eb2b0, dwHighDateTime=0x1d585b4)) [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d118 [0030.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3970 [0030.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b39e8 [0030.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0030.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0030.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b39e8 | out: hHeap=0x260000) returned 1 [0030.203] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0030.203] GetLastError () returned 0x0 [0030.203] SetLastError (dwErrCode=0x0) [0030.203] GetLastError () returned 0x0 [0030.203] SetLastError (dwErrCode=0x0) [0030.203] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0030.203] GetLastError () returned 0x0 [0030.203] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.204] SetLastError (dwErrCode=0x0) [0030.204] GetLastError () returned 0x0 [0030.205] SetLastError (dwErrCode=0x0) [0030.205] GetLastError () returned 0x0 [0030.205] SetLastError (dwErrCode=0x0) [0030.205] GetLastError () returned 0x0 [0030.205] SetLastError (dwErrCode=0x0) [0030.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.205] ReadFile (in: hFile=0xf4, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.209] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.209] WriteFile (in: hFile=0xf4, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.210] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.210] WriteFile (in: hFile=0xf4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.211] WriteFile (in: hFile=0xf4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.211] CloseHandle (hObject=0xf4) returned 1 [0032.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3aa8 [0032.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.[deadmin@cock.li].deadmin")) returned 1 [0032.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3aa8 | out: hHeap=0x260000) returned 1 [0032.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0032.397] GetLastError () returned 0x0 [0032.397] SetLastError (dwErrCode=0x0) [0032.397] GetLastError () returned 0x0 [0032.397] SetLastError (dwErrCode=0x0) [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6258 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2e38 | out: hHeap=0x260000) returned 1 [0032.398] RtlWakeConditionVariable () returned 0x27e828 [0032.398] GetCurrentThreadId () returned 0x998 [0032.398] GetCurrentThreadId () returned 0x998 [0032.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d58e8 | out: hHeap=0x260000) returned 1 [0032.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0032.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b798 [0032.398] lstrlenW (lpString=".ldf") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".ldf") returned 0x0 [0032.398] lstrlenW (lpString=".vhd") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".vhd") returned 0x0 [0032.398] lstrlenW (lpString=".vhdx") returned 5 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".vhdx") returned 0x0 [0032.398] lstrlenW (lpString=".pst") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".pst") returned 0x0 [0032.398] lstrlenW (lpString=".ost") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".ost") returned 0x0 [0032.398] lstrlenW (lpString=".bak") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".bak") returned 0x0 [0032.398] lstrlenW (lpString=".bac") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".bac") returned 0x0 [0032.398] lstrlenW (lpString=".sys") returned 4 [0032.398] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".sys") returned 0x0 [0032.398] lstrlenW (lpString=".v2i") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".v2i") returned 0x0 [0032.399] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0032.399] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.399] lstrlenW (lpString=".sql") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".sql") returned 0x0 [0032.399] lstrlenW (lpString=".mdf") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".mdf") returned 0x0 [0032.399] lstrlenW (lpString=".txt") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".txt") returned 0x0 [0032.399] lstrlenW (lpString=".dbf") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".dbf") returned 0x0 [0032.399] lstrlenW (lpString=".ckp") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".ckp") returned 0x0 [0032.399] lstrlenW (lpString=".dacpac") returned 7 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".dacpac") returned 0x0 [0032.399] lstrlenW (lpString=".db3") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".db3") returned 0x0 [0032.399] lstrlenW (lpString=".dtxs") returned 5 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".dtxs") returned 0x0 [0032.399] lstrlenW (lpString=".mdt") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".mdt") returned 0x0 [0032.399] lstrlenW (lpString=".sdf") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".sdf") returned 0x0 [0032.399] lstrlenW (lpString=".MDF") returned 4 [0032.399] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".MDF") returned 0x0 [0032.399] lstrlenW (lpString=".DBF") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".DBF") returned 0x0 [0032.400] lstrlenW (lpString=".DB") returned 3 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".DB") returned 0x0 [0032.400] lstrlenW (lpString=".db") returned 3 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".db") returned 0x0 [0032.400] lstrlenW (lpString=".ndf") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".ndf") returned 0x0 [0032.400] lstrlenW (lpString=".NDF") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".NDF") returned 0x0 [0032.400] lstrlenW (lpString=".Mdf") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".Mdf") returned 0x0 [0032.400] lstrlenW (lpString=".dat") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".dat") returned 0x0 [0032.400] lstrlenW (lpString=".DAT") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".DAT") returned 0x0 [0032.400] lstrlenW (lpString=".ldf") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".ldf") returned 0x0 [0032.400] lstrlenW (lpString=".LDF") returned 4 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch=".LDF") returned 0x0 [0032.400] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.400] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0032.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.400] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d54f8) returned 1 [0032.401] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.401] CryptReleaseContext (hProv=0x2d54f8, dwFlags=0x0) returned 1 [0032.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0032.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0032.401] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15240255140) returned 1 [0032.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa383e050, dwHighDateTime=0x1d585b4)) [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1758 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0032.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d028 [0032.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0032.402] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0032.402] GetLastError () returned 0x0 [0032.402] SetLastError (dwErrCode=0x0) [0032.402] GetLastError () returned 0x0 [0032.402] SetLastError (dwErrCode=0x0) [0032.402] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0032.402] GetLastError () returned 0x0 [0032.402] SetLastError (dwErrCode=0x0) [0032.402] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.403] SetLastError (dwErrCode=0x0) [0032.403] GetLastError () returned 0x0 [0032.404] SetLastError (dwErrCode=0x0) [0032.404] GetLastError () returned 0x0 [0032.404] SetLastError (dwErrCode=0x0) [0032.404] GetLastError () returned 0x0 [0032.404] SetLastError (dwErrCode=0x0) [0032.404] GetLastError () returned 0x0 [0032.404] SetLastError (dwErrCode=0x0) [0032.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d98a0 [0032.404] ReadFile (in: hFile=0xf4, lpBuffer=0x2d98a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesRead=0x1cffdb0*=0xc72, lpOverlapped=0x0) returned 1 [0032.405] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfffff38e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.405] WriteFile (in: hFile=0xf4, lpBuffer=0x2d98a0*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc72, lpOverlapped=0x0) returned 1 [0032.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0032.406] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.406] WriteFile (in: hFile=0xf4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.406] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.406] WriteFile (in: hFile=0xf4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.406] CloseHandle (hObject=0xf4) returned 1 [0032.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d5820 [0032.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0032.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0032.408] GetLastError () returned 0x0 [0032.408] SetLastError (dwErrCode=0x0) [0032.408] GetLastError () returned 0x0 [0032.408] SetLastError (dwErrCode=0x0) [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b798 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.408] RtlWakeConditionVariable () returned 0x27e828 [0032.408] GetCurrentThreadId () returned 0x998 [0032.408] GetCurrentThreadId () returned 0x998 [0032.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5778 | out: hHeap=0x260000) returned 1 [0032.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1790 | out: hHeap=0x260000) returned 1 [0032.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.408] lstrlenW (lpString=".ldf") returned 4 [0032.408] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0032.408] lstrlenW (lpString=".vhd") returned 4 [0032.408] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0032.408] lstrlenW (lpString=".vhdx") returned 5 [0032.408] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0032.408] lstrlenW (lpString=".pst") returned 4 [0032.408] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0032.408] lstrlenW (lpString=".ost") returned 4 [0032.408] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0032.408] lstrlenW (lpString=".bak") returned 4 [0032.408] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0032.408] lstrlenW (lpString=".bac") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0032.409] lstrlenW (lpString=".sys") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0032.409] lstrlenW (lpString=".v2i") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0032.409] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0032.409] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.409] lstrlenW (lpString=".sql") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0032.409] lstrlenW (lpString=".mdf") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0032.409] lstrlenW (lpString=".txt") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0032.409] lstrlenW (lpString=".dbf") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0032.409] lstrlenW (lpString=".ckp") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0032.409] lstrlenW (lpString=".dacpac") returned 7 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0032.409] lstrlenW (lpString=".db3") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0032.409] lstrlenW (lpString=".dtxs") returned 5 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0032.409] lstrlenW (lpString=".mdt") returned 4 [0032.409] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0032.410] lstrlenW (lpString=".sdf") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0032.410] lstrlenW (lpString=".MDF") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0032.410] lstrlenW (lpString=".DBF") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0032.410] lstrlenW (lpString=".DB") returned 3 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0032.410] lstrlenW (lpString=".db") returned 3 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0032.410] lstrlenW (lpString=".ndf") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0032.410] lstrlenW (lpString=".NDF") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0032.410] lstrlenW (lpString=".Mdf") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0032.410] lstrlenW (lpString=".dat") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0032.410] lstrlenW (lpString=".DAT") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0032.410] lstrlenW (lpString=".ldf") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0032.410] lstrlenW (lpString=".LDF") returned 4 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0032.410] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0032.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.410] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d54f8) returned 1 [0032.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.411] CryptReleaseContext (hProv=0x2d54f8, dwFlags=0x0) returned 1 [0032.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0032.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0032.411] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15241242787) returned 1 [0032.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa383e050, dwHighDateTime=0x1d585b4)) [0032.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0032.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0032.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0032.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1790 [0032.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0032.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1790 | out: hHeap=0x260000) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0032.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0032.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0032.412] GetLastError () returned 0x0 [0032.412] SetLastError (dwErrCode=0x0) [0032.412] GetLastError () returned 0x0 [0032.412] SetLastError (dwErrCode=0x0) [0032.412] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0032.412] GetLastError () returned 0x0 [0032.412] SetLastError (dwErrCode=0x0) [0032.412] GetLastError () returned 0x0 [0032.412] SetLastError (dwErrCode=0x0) [0032.412] GetLastError () returned 0x0 [0032.412] SetLastError (dwErrCode=0x0) [0032.412] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.413] SetLastError (dwErrCode=0x0) [0032.413] GetLastError () returned 0x0 [0032.414] SetLastError (dwErrCode=0x0) [0032.414] GetLastError () returned 0x0 [0032.414] SetLastError (dwErrCode=0x0) [0032.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d98a0 [0032.414] ReadFile (in: hFile=0xf4, lpBuffer=0x2d98a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesRead=0x1cffdb0*=0x106f, lpOverlapped=0x0) returned 1 [0032.415] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xffffef91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.415] WriteFile (in: hFile=0xf4, lpBuffer=0x2d98a0*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x106f, lpOverlapped=0x0) returned 1 [0032.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0032.416] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.416] WriteFile (in: hFile=0xf4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.416] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.416] WriteFile (in: hFile=0xf4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.416] CloseHandle (hObject=0xf4) returned 1 [0032.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0032.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0032.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0032.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0032.418] GetLastError () returned 0x0 [0032.418] SetLastError (dwErrCode=0x0) [0032.418] GetLastError () returned 0x0 [0032.418] SetLastError (dwErrCode=0x0) [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0032.418] RtlWakeConditionVariable () returned 0x27e828 [0032.418] GetCurrentThreadId () returned 0x998 [0032.418] GetCurrentThreadId () returned 0x998 [0032.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3838 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5a68 | out: hHeap=0x260000) returned 1 [0032.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a17c8 | out: hHeap=0x260000) returned 1 [0032.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5a48 [0032.418] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.418] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0032.418] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0032.419] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0032.419] WriteFile (in: hFile=0xf4, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0032.420] CloseHandle (hObject=0xf4) returned 1 [0032.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5a48 | out: hHeap=0x260000) returned 1 [0032.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0032.420] RtlWakeConditionVariable () returned 0x27e828 [0032.420] GetCurrentThreadId () returned 0x998 [0032.420] GetCurrentThreadId () returned 0x998 [0032.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0032.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0032.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0032.420] lstrlenW (lpString=".ldf") returned 4 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0032.420] lstrlenW (lpString=".vhd") returned 4 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0032.420] lstrlenW (lpString=".vhdx") returned 5 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0032.420] lstrlenW (lpString=".pst") returned 4 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0032.420] lstrlenW (lpString=".ost") returned 4 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0032.420] lstrlenW (lpString=".bak") returned 4 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0032.420] lstrlenW (lpString=".bac") returned 4 [0032.420] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0032.421] lstrlenW (lpString=".sys") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0032.421] lstrlenW (lpString=".v2i") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0032.421] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0032.421] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0032.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.421] RtlWakeConditionVariable () returned 0x27e828 [0032.421] GetCurrentThreadId () returned 0x998 [0032.421] GetCurrentThreadId () returned 0x998 [0032.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0032.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0032.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0032.421] lstrlenW (lpString=".ldf") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0032.421] lstrlenW (lpString=".vhd") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0032.421] lstrlenW (lpString=".vhdx") returned 5 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0032.421] lstrlenW (lpString=".pst") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0032.421] lstrlenW (lpString=".ost") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0032.421] lstrlenW (lpString=".bak") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0032.421] lstrlenW (lpString=".bac") returned 4 [0032.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0032.422] lstrlenW (lpString=".sys") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0032.422] lstrlenW (lpString=".v2i") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0032.422] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0032.422] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0032.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.422] RtlWakeConditionVariable () returned 0x27e828 [0032.422] GetCurrentThreadId () returned 0x998 [0032.422] GetCurrentThreadId () returned 0x998 [0032.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0032.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5598 | out: hHeap=0x260000) returned 1 [0032.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0032.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.422] lstrlenW (lpString=".ldf") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0032.422] lstrlenW (lpString=".vhd") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0032.422] lstrlenW (lpString=".vhdx") returned 5 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0032.422] lstrlenW (lpString=".pst") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0032.422] lstrlenW (lpString=".ost") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0032.422] lstrlenW (lpString=".bak") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0032.422] lstrlenW (lpString=".bac") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0032.422] lstrlenW (lpString=".sys") returned 4 [0032.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0032.423] lstrlenW (lpString=".v2i") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0032.423] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0032.423] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.423] lstrlenW (lpString=".sql") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0032.423] lstrlenW (lpString=".mdf") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0032.423] lstrlenW (lpString=".txt") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0032.423] lstrlenW (lpString=".dbf") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0032.423] lstrlenW (lpString=".ckp") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0032.423] lstrlenW (lpString=".dacpac") returned 7 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0032.423] lstrlenW (lpString=".db3") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0032.423] lstrlenW (lpString=".dtxs") returned 5 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0032.423] lstrlenW (lpString=".mdt") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0032.423] lstrlenW (lpString=".sdf") returned 4 [0032.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0032.423] lstrlenW (lpString=".MDF") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0032.424] lstrlenW (lpString=".DBF") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0032.424] lstrlenW (lpString=".DB") returned 3 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0032.424] lstrlenW (lpString=".db") returned 3 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0032.424] lstrlenW (lpString=".ndf") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0032.424] lstrlenW (lpString=".NDF") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0032.424] lstrlenW (lpString=".Mdf") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0032.424] lstrlenW (lpString=".dat") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0032.424] lstrlenW (lpString=".DAT") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0032.424] lstrlenW (lpString=".ldf") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0032.424] lstrlenW (lpString=".LDF") returned 4 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0032.424] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0032.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.424] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3e10) returned 1 [0032.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.425] CryptReleaseContext (hProv=0x2b3e10, dwFlags=0x0) returned 1 [0032.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0032.425] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15242630319) returned 1 [0032.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa38641b0, dwHighDateTime=0x1d585b4)) [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1838 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0032.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0032.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0032.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0032.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0032.426] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0032.426] GetLastError () returned 0x0 [0032.426] SetLastError (dwErrCode=0x0) [0032.426] GetLastError () returned 0x0 [0032.426] SetLastError (dwErrCode=0x0) [0032.426] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0032.426] GetLastError () returned 0x0 [0032.426] SetLastError (dwErrCode=0x0) [0032.426] GetLastError () returned 0x0 [0032.426] SetLastError (dwErrCode=0x0) [0032.426] GetLastError () returned 0x0 [0032.426] SetLastError (dwErrCode=0x0) [0032.426] GetLastError () returned 0x0 [0032.426] SetLastError (dwErrCode=0x0) [0032.426] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] GetLastError () returned 0x0 [0032.427] SetLastError (dwErrCode=0x0) [0032.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d98a0 [0032.428] ReadFile (in: hFile=0xf4, lpBuffer=0x2d98a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesRead=0x1cffdb0*=0x978, lpOverlapped=0x0) returned 1 [0032.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfffff688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.650] WriteFile (in: hFile=0xf4, lpBuffer=0x2d98a0*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x978, lpOverlapped=0x0) returned 1 [0032.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0032.650] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.650] WriteFile (in: hFile=0xf4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.650] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.650] WriteFile (in: hFile=0xf4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.650] CloseHandle (hObject=0xf4) returned 1 [0032.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0032.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0032.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0032.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0032.972] GetLastError () returned 0x0 [0032.973] SetLastError (dwErrCode=0x0) [0032.973] GetLastError () returned 0x0 [0032.973] SetLastError (dwErrCode=0x0) [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0032.973] RtlWakeConditionVariable () returned 0x27e828 [0032.973] GetCurrentThreadId () returned 0x998 [0032.973] GetCurrentThreadId () returned 0x998 [0032.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5bd8 | out: hHeap=0x260000) returned 1 [0032.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0032.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.973] lstrlenW (lpString=".ldf") returned 4 [0032.973] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".ldf") returned 0x0 [0032.973] lstrlenW (lpString=".vhd") returned 4 [0032.973] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".vhd") returned 0x0 [0032.973] lstrlenW (lpString=".vhdx") returned 5 [0032.973] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".vhdx") returned 0x0 [0032.973] lstrlenW (lpString=".pst") returned 4 [0032.973] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".pst") returned 0x0 [0032.973] lstrlenW (lpString=".ost") returned 4 [0032.973] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".ost") returned 0x0 [0032.973] lstrlenW (lpString=".bak") returned 4 [0032.973] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".bak") returned 0x0 [0032.974] lstrlenW (lpString=".bac") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".bac") returned 0x0 [0032.974] lstrlenW (lpString=".sys") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".sys") returned 0x0 [0032.974] lstrlenW (lpString=".v2i") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".v2i") returned 0x0 [0032.974] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0032.974] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.974] lstrlenW (lpString=".sql") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".sql") returned 0x0 [0032.974] lstrlenW (lpString=".mdf") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".mdf") returned 0x0 [0032.974] lstrlenW (lpString=".txt") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".txt") returned 0x0 [0032.974] lstrlenW (lpString=".dbf") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".dbf") returned 0x0 [0032.974] lstrlenW (lpString=".ckp") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".ckp") returned 0x0 [0032.974] lstrlenW (lpString=".dacpac") returned 7 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".dacpac") returned 0x0 [0032.974] lstrlenW (lpString=".db3") returned 4 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".db3") returned 0x0 [0032.974] lstrlenW (lpString=".dtxs") returned 5 [0032.974] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".dtxs") returned 0x0 [0032.975] lstrlenW (lpString=".mdt") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".mdt") returned 0x0 [0032.975] lstrlenW (lpString=".sdf") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".sdf") returned 0x0 [0032.975] lstrlenW (lpString=".MDF") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".MDF") returned 0x0 [0032.975] lstrlenW (lpString=".DBF") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".DBF") returned 0x0 [0032.975] lstrlenW (lpString=".DB") returned 3 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".DB") returned 0x0 [0032.975] lstrlenW (lpString=".db") returned 3 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".db") returned 0x0 [0032.975] lstrlenW (lpString=".ndf") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".ndf") returned 0x0 [0032.975] lstrlenW (lpString=".NDF") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".NDF") returned 0x0 [0032.975] lstrlenW (lpString=".Mdf") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".Mdf") returned 0x0 [0032.975] lstrlenW (lpString=".dat") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".dat") returned 0x0 [0032.975] lstrlenW (lpString=".DAT") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".DAT") returned 0x0 [0032.975] lstrlenW (lpString=".ldf") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".ldf") returned 0x0 [0032.975] lstrlenW (lpString=".LDF") returned 4 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch=".LDF") returned 0x0 [0032.975] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.975] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0032.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.975] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3e10) returned 1 [0032.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.976] CryptReleaseContext (hProv=0x2b3e10, dwFlags=0x0) returned 1 [0032.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0032.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0032.977] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15297766888) returned 1 [0032.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa3d26db0, dwHighDateTime=0x1d585b4)) [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18a8 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0032.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0032.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0032.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0032.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0032.977] GetLastError () returned 0x0 [0032.977] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.978] SetLastError (dwErrCode=0x0) [0032.978] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] GetLastError () returned 0x0 [0032.979] SetLastError (dwErrCode=0x0) [0032.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0032.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d98a0 [0032.979] ReadFile (in: hFile=0xf4, lpBuffer=0x2d98a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.984] WriteFile (in: hFile=0xf4, lpBuffer=0x2d98a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0032.984] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.984] WriteFile (in: hFile=0xf4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.986] WriteFile (in: hFile=0xf4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.987] CloseHandle (hObject=0xf4) returned 1 [0033.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d5de0 [0033.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0033.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5de0 | out: hHeap=0x260000) returned 1 [0033.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0033.191] GetLastError () returned 0x0 [0033.191] SetLastError (dwErrCode=0x0) [0033.191] GetLastError () returned 0x0 [0033.192] SetLastError (dwErrCode=0x0) [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.192] RtlWakeConditionVariable () returned 0x27e828 [0033.192] GetCurrentThreadId () returned 0x998 [0033.192] GetCurrentThreadId () returned 0x998 [0033.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f70 | out: hHeap=0x260000) returned 1 [0033.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0033.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bbe8 [0033.192] lstrlenW (lpString=".ldf") returned 4 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".ldf") returned 0x0 [0033.192] lstrlenW (lpString=".vhd") returned 4 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".vhd") returned 0x0 [0033.192] lstrlenW (lpString=".vhdx") returned 5 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".vhdx") returned 0x0 [0033.192] lstrlenW (lpString=".pst") returned 4 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".pst") returned 0x0 [0033.192] lstrlenW (lpString=".ost") returned 4 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".ost") returned 0x0 [0033.192] lstrlenW (lpString=".bak") returned 4 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".bak") returned 0x0 [0033.192] lstrlenW (lpString=".bac") returned 4 [0033.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".bac") returned 0x0 [0033.193] lstrlenW (lpString=".sys") returned 4 [0033.193] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".sys") returned 0x0 [0033.193] lstrlenW (lpString=".v2i") returned 4 [0033.193] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".v2i") returned 0x0 [0033.193] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.193] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch="s\r\n.v2i") returned 0x0 [0033.193] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0033.297] lstrlenW (lpString=".sql") returned 4 [0033.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".sql") returned 0x0 [0033.297] lstrlenW (lpString=".mdf") returned 4 [0033.297] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".mdf") returned 0x0 [0033.298] lstrlenW (lpString=".txt") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".txt") returned 0x0 [0033.298] lstrlenW (lpString=".dbf") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".dbf") returned 0x0 [0033.298] lstrlenW (lpString=".ckp") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".ckp") returned 0x0 [0033.298] lstrlenW (lpString=".dacpac") returned 7 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".dacpac") returned 0x0 [0033.298] lstrlenW (lpString=".db3") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".db3") returned 0x0 [0033.298] lstrlenW (lpString=".dtxs") returned 5 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".dtxs") returned 0x0 [0033.298] lstrlenW (lpString=".mdt") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".mdt") returned 0x0 [0033.298] lstrlenW (lpString=".sdf") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".sdf") returned 0x0 [0033.298] lstrlenW (lpString=".MDF") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".MDF") returned 0x0 [0033.298] lstrlenW (lpString=".DBF") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".DBF") returned 0x0 [0033.298] lstrlenW (lpString=".DB") returned 3 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".DB") returned 0x0 [0033.298] lstrlenW (lpString=".db") returned 3 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".db") returned 0x0 [0033.298] lstrlenW (lpString=".ndf") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".ndf") returned 0x0 [0033.298] lstrlenW (lpString=".NDF") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".NDF") returned 0x0 [0033.298] lstrlenW (lpString=".Mdf") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".Mdf") returned 0x0 [0033.298] lstrlenW (lpString=".dat") returned 4 [0033.298] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".dat") returned 0x0 [0033.298] lstrlenW (lpString=".DAT") returned 4 [0033.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".DAT") returned 0x0 [0033.299] lstrlenW (lpString=".ldf") returned 4 [0033.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".ldf") returned 0x0 [0033.299] lstrlenW (lpString=".LDF") returned 4 [0033.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch=".LDF") returned 0x0 [0033.299] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.299] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0033.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.299] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d5250) returned 1 [0033.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.300] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0033.300] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15330102713) returned 1 [0033.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa4046a90, dwHighDateTime=0x1d585b4)) [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d028 [0033.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296728 [0033.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.300] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.301] SetLastError (dwErrCode=0x0) [0033.301] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] GetLastError () returned 0x0 [0033.302] SetLastError (dwErrCode=0x0) [0033.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296728 | out: hHeap=0x260000) returned 1 [0033.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2db8a0 [0033.302] ReadFile (in: hFile=0x100, lpBuffer=0x2db8a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.306] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.306] WriteFile (in: hFile=0x100, lpBuffer=0x2db8a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0033.307] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.307] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0033.308] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0033.308] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0033.309] CloseHandle (hObject=0x100) returned 1 [0033.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x299988 [0033.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.[deadmin@cock.li].deadmin")) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299988 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0033.323] GetLastError () returned 0x0 [0033.323] SetLastError (dwErrCode=0x0) [0033.323] GetLastError () returned 0x0 [0033.323] SetLastError (dwErrCode=0x0) [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bbe8 | out: hHeap=0x260000) returned 1 [0033.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0033.324] RtlWakeConditionVariable () returned 0x27e828 [0033.324] GetCurrentThreadId () returned 0x998 [0033.324] GetCurrentThreadId () returned 0x998 [0033.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0033.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6028 | out: hHeap=0x260000) returned 1 [0033.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0033.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bbe8 [0033.324] lstrlenW (lpString=".ldf") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".ldf") returned 0x0 [0033.324] lstrlenW (lpString=".vhd") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".vhd") returned 0x0 [0033.324] lstrlenW (lpString=".vhdx") returned 5 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".vhdx") returned 0x0 [0033.324] lstrlenW (lpString=".pst") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".pst") returned 0x0 [0033.324] lstrlenW (lpString=".ost") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".ost") returned 0x0 [0033.324] lstrlenW (lpString=".bak") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".bak") returned 0x0 [0033.324] lstrlenW (lpString=".bac") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".bac") returned 0x0 [0033.324] lstrlenW (lpString=".sys") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".sys") returned 0x0 [0033.324] lstrlenW (lpString=".v2i") returned 4 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".v2i") returned 0x0 [0033.324] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.324] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch="s\r\n.v2i") returned 0x0 [0033.324] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0033.325] lstrlenW (lpString=".sql") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".sql") returned 0x0 [0033.325] lstrlenW (lpString=".mdf") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".mdf") returned 0x0 [0033.325] lstrlenW (lpString=".txt") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".txt") returned 0x0 [0033.325] lstrlenW (lpString=".dbf") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".dbf") returned 0x0 [0033.325] lstrlenW (lpString=".ckp") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".ckp") returned 0x0 [0033.325] lstrlenW (lpString=".dacpac") returned 7 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".dacpac") returned 0x0 [0033.325] lstrlenW (lpString=".db3") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".db3") returned 0x0 [0033.325] lstrlenW (lpString=".dtxs") returned 5 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".dtxs") returned 0x0 [0033.325] lstrlenW (lpString=".mdt") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".mdt") returned 0x0 [0033.325] lstrlenW (lpString=".sdf") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".sdf") returned 0x0 [0033.325] lstrlenW (lpString=".MDF") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".MDF") returned 0x0 [0033.325] lstrlenW (lpString=".DBF") returned 4 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".DBF") returned 0x0 [0033.325] lstrlenW (lpString=".DB") returned 3 [0033.325] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".DB") returned 0x0 [0033.325] lstrlenW (lpString=".db") returned 3 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".db") returned 0x0 [0033.326] lstrlenW (lpString=".ndf") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".ndf") returned 0x0 [0033.326] lstrlenW (lpString=".NDF") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".NDF") returned 0x0 [0033.326] lstrlenW (lpString=".Mdf") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".Mdf") returned 0x0 [0033.326] lstrlenW (lpString=".dat") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".dat") returned 0x0 [0033.326] lstrlenW (lpString=".DAT") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".DAT") returned 0x0 [0033.326] lstrlenW (lpString=".ldf") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".ldf") returned 0x0 [0033.326] lstrlenW (lpString=".LDF") returned 4 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch=".LDF") returned 0x0 [0033.326] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.326] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5f70 [0033.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.326] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d5250) returned 1 [0033.327] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.327] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0033.327] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15332829702) returned 1 [0033.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa4092d50, dwHighDateTime=0x1d585b4)) [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0033.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d028 [0033.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296728 [0033.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.328] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0033.328] GetLastError () returned 0x0 [0033.328] SetLastError (dwErrCode=0x0) [0033.328] GetLastError () returned 0x0 [0033.328] SetLastError (dwErrCode=0x0) [0033.328] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0033.328] GetLastError () returned 0x0 [0033.328] SetLastError (dwErrCode=0x0) [0033.328] GetLastError () returned 0x0 [0033.328] SetLastError (dwErrCode=0x0) [0033.328] GetLastError () returned 0x0 [0033.328] SetLastError (dwErrCode=0x0) [0033.328] GetLastError () returned 0x0 [0033.328] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.329] SetLastError (dwErrCode=0x0) [0033.329] GetLastError () returned 0x0 [0033.330] SetLastError (dwErrCode=0x0) [0033.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296728 | out: hHeap=0x260000) returned 1 [0033.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2db8a0 [0033.330] ReadFile (in: hFile=0x100, lpBuffer=0x2db8a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesRead=0x1cffdb0*=0x543, lpOverlapped=0x0) returned 1 [0033.331] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.331] WriteFile (in: hFile=0x100, lpBuffer=0x2db8a0*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x543, lpOverlapped=0x0) returned 1 [0033.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0033.331] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.331] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0033.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0033.331] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0033.332] CloseHandle (hObject=0x100) returned 1 [0033.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3b90 [0033.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.[deadmin@cock.li].deadmin")) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0033.333] GetLastError () returned 0x0 [0033.333] SetLastError (dwErrCode=0x0) [0033.333] GetLastError () returned 0x0 [0033.333] SetLastError (dwErrCode=0x0) [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f70 | out: hHeap=0x260000) returned 1 [0033.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bbe8 | out: hHeap=0x260000) returned 1 [0033.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0033.334] RtlWakeConditionVariable () returned 0x27e828 [0033.334] GetCurrentThreadId () returned 0x998 [0033.334] GetCurrentThreadId () returned 0x998 [0033.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0033.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298bd0 | out: hHeap=0x260000) returned 1 [0033.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0033.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ee60 [0033.334] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0033.336] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0033.336] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0033.336] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0033.336] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0033.337] CloseHandle (hObject=0x100) returned 1 [0033.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee60 | out: hHeap=0x260000) returned 1 [0033.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0033.337] RtlWakeConditionVariable () returned 0x27e828 [0033.337] GetCurrentThreadId () returned 0x998 [0033.543] GetCurrentThreadId () returned 0x998 [0033.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0033.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60e0 | out: hHeap=0x260000) returned 1 [0033.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1aa0 | out: hHeap=0x260000) returned 1 [0033.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bbe8 [0033.543] lstrlenW (lpString=".ldf") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".ldf") returned 0x0 [0033.543] lstrlenW (lpString=".vhd") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".vhd") returned 0x0 [0033.543] lstrlenW (lpString=".vhdx") returned 5 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".vhdx") returned 0x0 [0033.543] lstrlenW (lpString=".pst") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".pst") returned 0x0 [0033.543] lstrlenW (lpString=".ost") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".ost") returned 0x0 [0033.543] lstrlenW (lpString=".bak") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".bak") returned 0x0 [0033.543] lstrlenW (lpString=".bac") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".bac") returned 0x0 [0033.543] lstrlenW (lpString=".sys") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".sys") returned 0x0 [0033.543] lstrlenW (lpString=".v2i") returned 4 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".v2i") returned 0x0 [0033.543] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.543] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch="s\r\n.v2i") returned 0x0 [0033.543] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0033.869] lstrlenW (lpString=".sql") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".sql") returned 0x0 [0033.870] lstrlenW (lpString=".mdf") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".mdf") returned 0x0 [0033.870] lstrlenW (lpString=".txt") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".txt") returned 0x0 [0033.870] lstrlenW (lpString=".dbf") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".dbf") returned 0x0 [0033.870] lstrlenW (lpString=".ckp") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".ckp") returned 0x0 [0033.870] lstrlenW (lpString=".dacpac") returned 7 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".dacpac") returned 0x0 [0033.870] lstrlenW (lpString=".db3") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".db3") returned 0x0 [0033.870] lstrlenW (lpString=".dtxs") returned 5 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".dtxs") returned 0x0 [0033.870] lstrlenW (lpString=".mdt") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".mdt") returned 0x0 [0033.870] lstrlenW (lpString=".sdf") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".sdf") returned 0x0 [0033.870] lstrlenW (lpString=".MDF") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".MDF") returned 0x0 [0033.870] lstrlenW (lpString=".DBF") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".DBF") returned 0x0 [0033.870] lstrlenW (lpString=".DB") returned 3 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".DB") returned 0x0 [0033.870] lstrlenW (lpString=".db") returned 3 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".db") returned 0x0 [0033.870] lstrlenW (lpString=".ndf") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".ndf") returned 0x0 [0033.870] lstrlenW (lpString=".NDF") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".NDF") returned 0x0 [0033.870] lstrlenW (lpString=".Mdf") returned 4 [0033.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".Mdf") returned 0x0 [0033.871] lstrlenW (lpString=".dat") returned 4 [0033.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".dat") returned 0x0 [0033.871] lstrlenW (lpString=".DAT") returned 4 [0033.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".DAT") returned 0x0 [0033.871] lstrlenW (lpString=".ldf") returned 4 [0033.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".ldf") returned 0x0 [0033.871] lstrlenW (lpString=".LDF") returned 4 [0033.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch=".LDF") returned 0x0 [0033.871] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0033.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.871] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d5250) returned 1 [0033.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.872] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8670 [0033.872] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15387303739) returned 1 [0033.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa4555950, dwHighDateTime=0x1d585b4)) [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cd88 [0033.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0033.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0033.872] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.873] GetLastError () returned 0x0 [0033.873] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] GetLastError () returned 0x0 [0033.874] SetLastError (dwErrCode=0x0) [0033.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296858 | out: hHeap=0x260000) returned 1 [0033.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2db8a0 [0033.874] ReadFile (in: hFile=0x100, lpBuffer=0x2db8a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.877] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.877] WriteFile (in: hFile=0x100, lpBuffer=0x2db8a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0033.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.878] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0033.879] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0033.879] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0033.880] CloseHandle (hObject=0x100) returned 1 [0035.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.758] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.[deadmin@cock.li].deadmin")) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0035.759] GetLastError () returned 0x0 [0035.759] SetLastError (dwErrCode=0x0) [0035.759] GetLastError () returned 0x0 [0035.759] SetLastError (dwErrCode=0x0) [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8670 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3900 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bbe8 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0035.759] RtlWakeConditionVariable () returned 0x27e828 [0035.759] GetCurrentThreadId () returned 0x998 [0035.759] GetCurrentThreadId () returned 0x998 [0035.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298f10 | out: hHeap=0x260000) returned 1 [0035.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0035.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da538 [0035.759] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.760] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0035.760] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0035.760] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0035.760] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0035.835] CloseHandle (hObject=0x100) returned 1 [0035.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0035.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0035.835] RtlWakeConditionVariable () returned 0x27e828 [0035.835] GetCurrentThreadId () returned 0x998 [0035.835] GetCurrentThreadId () returned 0x998 [0035.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0035.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b1d8 | out: hHeap=0x260000) returned 1 [0035.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e30 | out: hHeap=0x260000) returned 1 [0035.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b1d8 [0035.835] lstrlenW (lpString=".ldf") returned 4 [0035.835] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".ldf") returned 0x0 [0035.835] lstrlenW (lpString=".vhd") returned 4 [0035.835] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".vhd") returned 0x0 [0035.835] lstrlenW (lpString=".vhdx") returned 5 [0035.835] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".vhdx") returned 0x0 [0035.836] lstrlenW (lpString=".pst") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".pst") returned 0x0 [0035.836] lstrlenW (lpString=".ost") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".ost") returned 0x0 [0035.836] lstrlenW (lpString=".bak") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".bak") returned 0x0 [0035.836] lstrlenW (lpString=".bac") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".bac") returned 0x0 [0035.836] lstrlenW (lpString=".sys") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".sys") returned 0x0 [0035.836] lstrlenW (lpString=".v2i") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".v2i") returned 0x0 [0035.836] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0035.836] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0035.836] lstrlenW (lpString=".sql") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".sql") returned 0x0 [0035.836] lstrlenW (lpString=".mdf") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".mdf") returned 0x0 [0035.836] lstrlenW (lpString=".txt") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".txt") returned 0x0 [0035.836] lstrlenW (lpString=".dbf") returned 4 [0035.836] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".dbf") returned 0x0 [0035.836] lstrlenW (lpString=".ckp") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".ckp") returned 0x0 [0035.837] lstrlenW (lpString=".dacpac") returned 7 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".dacpac") returned 0x0 [0035.837] lstrlenW (lpString=".db3") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".db3") returned 0x0 [0035.837] lstrlenW (lpString=".dtxs") returned 5 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".dtxs") returned 0x0 [0035.837] lstrlenW (lpString=".mdt") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".mdt") returned 0x0 [0035.837] lstrlenW (lpString=".sdf") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".sdf") returned 0x0 [0035.837] lstrlenW (lpString=".MDF") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".MDF") returned 0x0 [0035.837] lstrlenW (lpString=".DBF") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".DBF") returned 0x0 [0035.837] lstrlenW (lpString=".DB") returned 3 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".DB") returned 0x0 [0035.837] lstrlenW (lpString=".db") returned 3 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".db") returned 0x0 [0035.837] lstrlenW (lpString=".ndf") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".ndf") returned 0x0 [0035.837] lstrlenW (lpString=".NDF") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".NDF") returned 0x0 [0035.837] lstrlenW (lpString=".Mdf") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".Mdf") returned 0x0 [0035.837] lstrlenW (lpString=".dat") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".dat") returned 0x0 [0035.837] lstrlenW (lpString=".DAT") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".DAT") returned 0x0 [0035.837] lstrlenW (lpString=".ldf") returned 4 [0035.837] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".ldf") returned 0x0 [0035.837] lstrlenW (lpString=".LDF") returned 4 [0035.838] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch=".LDF") returned 0x0 [0035.838] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.838] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0035.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.838] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d53c0) returned 1 [0035.838] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.838] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0035.839] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15584008777) returned 1 [0035.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa572fe50, dwHighDateTime=0x1d585b4)) [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e30 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299110 [0035.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e30 | out: hHeap=0x260000) returned 1 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299110 | out: hHeap=0x260000) returned 1 [0035.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d220 [0035.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0035.840] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0035.840] GetLastError () returned 0x0 [0035.840] SetLastError (dwErrCode=0x0) [0035.840] GetLastError () returned 0x0 [0035.840] SetLastError (dwErrCode=0x0) [0035.840] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0035.840] GetLastError () returned 0x0 [0035.840] SetLastError (dwErrCode=0x0) [0035.840] GetLastError () returned 0x0 [0035.840] SetLastError (dwErrCode=0x0) [0035.840] GetLastError () returned 0x0 [0035.840] SetLastError (dwErrCode=0x0) [0035.840] GetLastError () returned 0x0 [0035.840] SetLastError (dwErrCode=0x0) [0035.840] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.841] GetLastError () returned 0x0 [0035.841] SetLastError (dwErrCode=0x0) [0035.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x3382e0 [0035.842] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.857] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.857] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0035.858] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.858] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.896] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.896] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.896] CloseHandle (hObject=0x100) returned 1 [0036.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0036.225] GetLastError () returned 0x0 [0036.225] SetLastError (dwErrCode=0x0) [0036.225] GetLastError () returned 0x0 [0036.225] SetLastError (dwErrCode=0x0) [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4108 | out: hHeap=0x260000) returned 1 [0036.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3900 | out: hHeap=0x260000) returned 1 [0036.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b1d8 | out: hHeap=0x260000) returned 1 [0036.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0036.226] RtlWakeConditionVariable () returned 0x27e828 [0036.226] GetCurrentThreadId () returned 0x998 [0036.226] GetCurrentThreadId () returned 0x998 [0036.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0036.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5640 | out: hHeap=0x260000) returned 1 [0036.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ed8 | out: hHeap=0x260000) returned 1 [0036.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0036.226] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.226] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0036.226] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0036.226] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0036.226] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0036.227] CloseHandle (hObject=0x100) returned 1 [0036.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da600 | out: hHeap=0x260000) returned 1 [0036.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0036.228] RtlWakeConditionVariable () returned 0x27e828 [0036.228] GetCurrentThreadId () returned 0x998 [0036.228] GetCurrentThreadId () returned 0x998 [0036.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296138 | out: hHeap=0x260000) returned 1 [0036.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f10 | out: hHeap=0x260000) returned 1 [0036.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0036.228] lstrlenW (lpString=".ldf") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0036.228] lstrlenW (lpString=".vhd") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0036.228] lstrlenW (lpString=".vhdx") returned 5 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0036.228] lstrlenW (lpString=".pst") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0036.228] lstrlenW (lpString=".ost") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0036.228] lstrlenW (lpString=".bak") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0036.228] lstrlenW (lpString=".bac") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0036.228] lstrlenW (lpString=".sys") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0036.228] lstrlenW (lpString=".v2i") returned 4 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0036.228] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.228] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0036.228] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296138 | out: hHeap=0x260000) returned 1 [0036.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.229] RtlWakeConditionVariable () returned 0x27e828 [0036.229] GetCurrentThreadId () returned 0x998 [0036.229] GetCurrentThreadId () returned 0x998 [0036.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2961d0 | out: hHeap=0x260000) returned 1 [0036.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f48 | out: hHeap=0x260000) returned 1 [0036.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2961d0 [0036.229] lstrlenW (lpString=".ldf") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0036.229] lstrlenW (lpString=".vhd") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0036.229] lstrlenW (lpString=".vhdx") returned 5 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0036.229] lstrlenW (lpString=".pst") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0036.229] lstrlenW (lpString=".ost") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0036.229] lstrlenW (lpString=".bak") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0036.229] lstrlenW (lpString=".bac") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0036.229] lstrlenW (lpString=".sys") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0036.229] lstrlenW (lpString=".v2i") returned 4 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0036.229] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.229] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0036.230] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2961d0 | out: hHeap=0x260000) returned 1 [0036.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.230] RtlWakeConditionVariable () returned 0x27e828 [0036.230] GetCurrentThreadId () returned 0x998 [0036.230] GetCurrentThreadId () returned 0x998 [0036.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0036.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f80 | out: hHeap=0x260000) returned 1 [0036.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d418 [0036.230] lstrlenW (lpString=".ldf") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0036.230] lstrlenW (lpString=".vhd") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0036.230] lstrlenW (lpString=".vhdx") returned 5 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0036.230] lstrlenW (lpString=".pst") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0036.230] lstrlenW (lpString=".ost") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0036.230] lstrlenW (lpString=".bak") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0036.230] lstrlenW (lpString=".bac") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0036.230] lstrlenW (lpString=".sys") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0036.230] lstrlenW (lpString=".v2i") returned 4 [0036.230] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0036.231] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0036.231] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.349] lstrlenW (lpString=".sql") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0036.349] lstrlenW (lpString=".mdf") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0036.349] lstrlenW (lpString=".txt") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0036.349] lstrlenW (lpString=".dbf") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0036.349] lstrlenW (lpString=".ckp") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0036.349] lstrlenW (lpString=".dacpac") returned 7 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0036.349] lstrlenW (lpString=".db3") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0036.349] lstrlenW (lpString=".dtxs") returned 5 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0036.349] lstrlenW (lpString=".mdt") returned 4 [0036.349] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0036.350] lstrlenW (lpString=".sdf") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0036.350] lstrlenW (lpString=".MDF") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0036.350] lstrlenW (lpString=".DBF") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0036.350] lstrlenW (lpString=".DB") returned 3 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0036.350] lstrlenW (lpString=".db") returned 3 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0036.350] lstrlenW (lpString=".ndf") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0036.350] lstrlenW (lpString=".NDF") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0036.350] lstrlenW (lpString=".Mdf") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0036.350] lstrlenW (lpString=".dat") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0036.350] lstrlenW (lpString=".DAT") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0036.350] lstrlenW (lpString=".ldf") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0036.350] lstrlenW (lpString=".LDF") returned 4 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0036.350] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.350] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0036.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.350] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d7370) returned 1 [0036.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.351] CryptReleaseContext (hProv=0x2d7370, dwFlags=0x0) returned 1 [0036.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0036.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0036.351] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15635256450) returned 1 [0036.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa5c18bb0, dwHighDateTime=0x1d585b4)) [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb20 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d7370 [0036.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb20 | out: hHeap=0x260000) returned 1 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7370 | out: hHeap=0x260000) returned 1 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30dee0 [0036.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dee0 | out: hHeap=0x260000) returned 1 [0036.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0036.352] GetLastError () returned 0x0 [0036.352] SetLastError (dwErrCode=0x0) [0036.352] GetLastError () returned 0x0 [0036.352] SetLastError (dwErrCode=0x0) [0036.352] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0036.352] GetLastError () returned 0x0 [0036.352] SetLastError (dwErrCode=0x0) [0036.352] GetLastError () returned 0x0 [0036.352] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.353] SetLastError (dwErrCode=0x0) [0036.353] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] GetLastError () returned 0x0 [0036.354] SetLastError (dwErrCode=0x0) [0036.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0036.354] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x1861, lpOverlapped=0x0) returned 1 [0036.357] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe79f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.357] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1861, lpOverlapped=0x0) returned 1 [0036.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.357] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.357] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.357] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.357] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.357] CloseHandle (hObject=0x108) returned 1 [0036.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0036.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0036.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0036.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.599] GetLastError () returned 0x0 [0036.599] SetLastError (dwErrCode=0x0) [0036.599] GetLastError () returned 0x0 [0036.599] SetLastError (dwErrCode=0x0) [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4108 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3900 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0036.599] RtlWakeConditionVariable () returned 0x27e828 [0036.599] GetCurrentThreadId () returned 0x998 [0036.599] GetCurrentThreadId () returned 0x998 [0036.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0036.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0036.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0036.599] lstrlenW (lpString=".ldf") returned 4 [0036.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".ldf") returned 0x0 [0036.599] lstrlenW (lpString=".vhd") returned 4 [0036.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".vhd") returned 0x0 [0036.599] lstrlenW (lpString=".vhdx") returned 5 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".vhdx") returned 0x0 [0036.600] lstrlenW (lpString=".pst") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".pst") returned 0x0 [0036.600] lstrlenW (lpString=".ost") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".ost") returned 0x0 [0036.600] lstrlenW (lpString=".bak") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".bak") returned 0x0 [0036.600] lstrlenW (lpString=".bac") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".bac") returned 0x0 [0036.600] lstrlenW (lpString=".sys") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".sys") returned 0x0 [0036.600] lstrlenW (lpString=".v2i") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".v2i") returned 0x0 [0036.600] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0036.600] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.600] lstrlenW (lpString=".sql") returned 4 [0036.600] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".sql") returned 0x0 [0036.601] lstrlenW (lpString=".mdf") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".mdf") returned 0x0 [0036.601] lstrlenW (lpString=".txt") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".txt") returned 0x0 [0036.601] lstrlenW (lpString=".dbf") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".dbf") returned 0x0 [0036.601] lstrlenW (lpString=".ckp") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".ckp") returned 0x0 [0036.601] lstrlenW (lpString=".dacpac") returned 7 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".dacpac") returned 0x0 [0036.601] lstrlenW (lpString=".db3") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".db3") returned 0x0 [0036.601] lstrlenW (lpString=".dtxs") returned 5 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".dtxs") returned 0x0 [0036.601] lstrlenW (lpString=".mdt") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".mdt") returned 0x0 [0036.601] lstrlenW (lpString=".sdf") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".sdf") returned 0x0 [0036.601] lstrlenW (lpString=".MDF") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".MDF") returned 0x0 [0036.601] lstrlenW (lpString=".DBF") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".DBF") returned 0x0 [0036.601] lstrlenW (lpString=".DB") returned 3 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".DB") returned 0x0 [0036.601] lstrlenW (lpString=".db") returned 3 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".db") returned 0x0 [0036.601] lstrlenW (lpString=".ndf") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".ndf") returned 0x0 [0036.601] lstrlenW (lpString=".NDF") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".NDF") returned 0x0 [0036.601] lstrlenW (lpString=".Mdf") returned 4 [0036.601] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".Mdf") returned 0x0 [0036.601] lstrlenW (lpString=".dat") returned 4 [0036.602] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".dat") returned 0x0 [0036.602] lstrlenW (lpString=".DAT") returned 4 [0036.602] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".DAT") returned 0x0 [0036.602] lstrlenW (lpString=".ldf") returned 4 [0036.602] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".ldf") returned 0x0 [0036.602] lstrlenW (lpString=".LDF") returned 4 [0036.602] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch=".LDF") returned 0x0 [0036.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.602] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0036.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.602] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d5250) returned 1 [0036.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.603] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0036.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0036.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15660397571) returned 1 [0036.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa5e07d90, dwHighDateTime=0x1d585b4)) [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ff0 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d418 [0036.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0036.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] GetLastError () returned 0x0 [0036.604] SetLastError (dwErrCode=0x0) [0036.604] GetLastError () returned 0x0 [0036.605] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.608] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.608] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.609] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.609] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.610] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.610] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.610] CloseHandle (hObject=0x108) returned 1 [0036.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.[deadmin@cock.li].deadmin")) returned 1 [0036.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.611] GetLastError () returned 0x0 [0036.611] RtlWakeConditionVariable () returned 0x27e828 [0036.611] GetCurrentThreadId () returned 0x998 [0036.611] GetCurrentThreadId () returned 0x998 [0036.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d610 | out: hHeap=0x260000) returned 1 [0036.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1028 | out: hHeap=0x260000) returned 1 [0036.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d610 [0036.611] lstrlenW (lpString=".ldf") returned 4 [0036.611] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".ldf") returned 0x0 [0036.611] lstrlenW (lpString=".vhd") returned 4 [0036.611] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".vhd") returned 0x0 [0036.611] lstrlenW (lpString=".vhdx") returned 5 [0036.611] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".vhdx") returned 0x0 [0036.611] lstrlenW (lpString=".pst") returned 4 [0036.611] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".pst") returned 0x0 [0036.611] lstrlenW (lpString=".ost") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".ost") returned 0x0 [0036.612] lstrlenW (lpString=".bak") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".bak") returned 0x0 [0036.612] lstrlenW (lpString=".bac") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".bac") returned 0x0 [0036.612] lstrlenW (lpString=".sys") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".sys") returned 0x0 [0036.612] lstrlenW (lpString=".v2i") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".v2i") returned 0x0 [0036.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0036.612] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.612] lstrlenW (lpString=".sql") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".sql") returned 0x0 [0036.612] lstrlenW (lpString=".mdf") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".mdf") returned 0x0 [0036.612] lstrlenW (lpString=".txt") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".txt") returned 0x0 [0036.612] lstrlenW (lpString=".dbf") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".dbf") returned 0x0 [0036.612] lstrlenW (lpString=".ckp") returned 4 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".ckp") returned 0x0 [0036.612] lstrlenW (lpString=".dacpac") returned 7 [0036.612] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".dacpac") returned 0x0 [0036.612] lstrlenW (lpString=".db3") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".db3") returned 0x0 [0036.613] lstrlenW (lpString=".dtxs") returned 5 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".dtxs") returned 0x0 [0036.613] lstrlenW (lpString=".mdt") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".mdt") returned 0x0 [0036.613] lstrlenW (lpString=".sdf") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".sdf") returned 0x0 [0036.613] lstrlenW (lpString=".MDF") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".MDF") returned 0x0 [0036.613] lstrlenW (lpString=".DBF") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".DBF") returned 0x0 [0036.613] lstrlenW (lpString=".DB") returned 3 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".DB") returned 0x0 [0036.613] lstrlenW (lpString=".db") returned 3 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".db") returned 0x0 [0036.613] lstrlenW (lpString=".ndf") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".ndf") returned 0x0 [0036.613] lstrlenW (lpString=".NDF") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".NDF") returned 0x0 [0036.613] lstrlenW (lpString=".Mdf") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".Mdf") returned 0x0 [0036.613] lstrlenW (lpString=".dat") returned 4 [0036.613] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".dat") returned 0x0 [0036.613] lstrlenW (lpString=".DAT") returned 4 [0036.738] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".DAT") returned 0x0 [0036.738] lstrlenW (lpString=".ldf") returned 4 [0036.738] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".ldf") returned 0x0 [0036.738] lstrlenW (lpString=".LDF") returned 4 [0036.738] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch=".LDF") returned 0x0 [0036.738] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.738] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0036.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.739] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d070) returned 1 [0036.739] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.739] CryptReleaseContext (hProv=0x27d070, dwFlags=0x0) returned 1 [0036.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0036.740] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15674067661) returned 1 [0036.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa5f5e9f0, dwHighDateTime=0x1d585b4)) [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1060 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1060 | out: hHeap=0x260000) returned 1 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d418 [0036.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0036.740] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0036.740] GetLastError () returned 0x0 [0036.740] GetLastError () returned 0x0 [0036.740] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0036.740] GetLastError () returned 0x0 [0036.741] GetLastError () returned 0x0 [0036.741] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x251f, lpOverlapped=0x0) returned 1 [0036.744] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdae1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.744] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x251f, lpOverlapped=0x0) returned 1 [0036.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0036.744] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.744] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.744] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.744] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.744] CloseHandle (hObject=0x108) returned 1 [0036.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.[deadmin@cock.li].deadmin")) returned 1 [0036.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.745] GetLastError () returned 0x0 [0036.745] RtlWakeConditionVariable () returned 0x27e828 [0036.745] GetCurrentThreadId () returned 0x998 [0036.745] GetCurrentThreadId () returned 0x998 [0036.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0036.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0036.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d760 [0036.746] lstrlenW (lpString=".ldf") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0036.746] lstrlenW (lpString=".vhd") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0036.746] lstrlenW (lpString=".vhdx") returned 5 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0036.746] lstrlenW (lpString=".pst") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0036.746] lstrlenW (lpString=".ost") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0036.746] lstrlenW (lpString=".bak") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0036.746] lstrlenW (lpString=".bac") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0036.746] lstrlenW (lpString=".sys") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0036.746] lstrlenW (lpString=".v2i") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0036.746] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0036.746] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.746] lstrlenW (lpString=".sql") returned 4 [0036.746] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0036.747] lstrlenW (lpString=".mdf") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0036.747] lstrlenW (lpString=".txt") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0036.747] lstrlenW (lpString=".dbf") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0036.747] lstrlenW (lpString=".ckp") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0036.747] lstrlenW (lpString=".dacpac") returned 7 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0036.747] lstrlenW (lpString=".db3") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0036.747] lstrlenW (lpString=".dtxs") returned 5 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0036.747] lstrlenW (lpString=".mdt") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0036.747] lstrlenW (lpString=".sdf") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0036.747] lstrlenW (lpString=".MDF") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0036.747] lstrlenW (lpString=".DBF") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0036.747] lstrlenW (lpString=".DB") returned 3 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0036.747] lstrlenW (lpString=".db") returned 3 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0036.747] lstrlenW (lpString=".ndf") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0036.747] lstrlenW (lpString=".NDF") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0036.747] lstrlenW (lpString=".Mdf") returned 4 [0036.747] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0036.747] lstrlenW (lpString=".dat") returned 4 [0036.748] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0036.748] lstrlenW (lpString=".DAT") returned 4 [0036.748] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0036.748] lstrlenW (lpString=".ldf") returned 4 [0036.748] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0036.748] lstrlenW (lpString=".LDF") returned 4 [0036.748] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0036.748] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.748] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0036.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.748] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d070) returned 1 [0036.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.749] CryptReleaseContext (hProv=0x27d070, dwFlags=0x0) returned 1 [0036.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0036.749] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15674992030) returned 1 [0036.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa5f5e9f0, dwHighDateTime=0x1d585b4)) [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11b0 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d610 [0036.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d610 | out: hHeap=0x260000) returned 1 [0036.749] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0036.749] GetLastError () returned 0x0 [0036.750] GetLastError () returned 0x0 [0036.750] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0036.750] GetLastError () returned 0x0 [0036.750] GetLastError () returned 0x0 [0036.750] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x7c4, lpOverlapped=0x0) returned 1 [0036.751] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff83c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.751] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c4, lpOverlapped=0x0) returned 1 [0036.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0036.751] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.751] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.752] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.752] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.752] CloseHandle (hObject=0x108) returned 1 [0036.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0036.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0036.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0036.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.752] GetLastError () returned 0x0 [0036.752] RtlWakeConditionVariable () returned 0x27e828 [0036.752] GetCurrentThreadId () returned 0x998 [0036.752] GetCurrentThreadId () returned 0x998 [0036.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0036.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4000 | out: hHeap=0x260000) returned 1 [0036.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11e8 | out: hHeap=0x260000) returned 1 [0036.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0036.753] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.753] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0036.753] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0036.753] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0036.753] WriteFile (in: hFile=0x108, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0036.754] CloseHandle (hObject=0x108) returned 1 [0036.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0036.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0036.754] RtlWakeConditionVariable () returned 0x27e828 [0036.754] GetCurrentThreadId () returned 0x998 [0036.754] GetCurrentThreadId () returned 0x998 [0036.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296398 | out: hHeap=0x260000) returned 1 [0036.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1220 | out: hHeap=0x260000) returned 1 [0036.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296398 [0036.755] lstrlenW (lpString=".ldf") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0036.755] lstrlenW (lpString=".vhd") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0036.755] lstrlenW (lpString=".vhdx") returned 5 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0036.755] lstrlenW (lpString=".pst") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0036.755] lstrlenW (lpString=".ost") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0036.755] lstrlenW (lpString=".bak") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0036.755] lstrlenW (lpString=".bac") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0036.755] lstrlenW (lpString=".sys") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0036.755] lstrlenW (lpString=".v2i") returned 4 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0036.755] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.755] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0036.755] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296398 | out: hHeap=0x260000) returned 1 [0036.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.755] RtlWakeConditionVariable () returned 0x27e828 [0036.755] GetCurrentThreadId () returned 0x998 [0036.755] GetCurrentThreadId () returned 0x998 [0036.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296430 | out: hHeap=0x260000) returned 1 [0036.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1258 | out: hHeap=0x260000) returned 1 [0036.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296430 [0036.756] lstrlenW (lpString=".ldf") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0036.756] lstrlenW (lpString=".vhd") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0036.756] lstrlenW (lpString=".vhdx") returned 5 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0036.756] lstrlenW (lpString=".pst") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0036.756] lstrlenW (lpString=".ost") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0036.756] lstrlenW (lpString=".bak") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0036.756] lstrlenW (lpString=".bac") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0036.756] lstrlenW (lpString=".sys") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0036.756] lstrlenW (lpString=".v2i") returned 4 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0036.756] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.756] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0036.756] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296430 | out: hHeap=0x260000) returned 1 [0036.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.756] RtlWakeConditionVariable () returned 0x27e828 [0036.756] GetCurrentThreadId () returned 0x998 [0036.756] GetCurrentThreadId () returned 0x998 [0036.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0036.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b4b8 | out: hHeap=0x260000) returned 1 [0036.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0036.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0036.757] lstrlenW (lpString=".ldf") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".ldf") returned 0x0 [0036.757] lstrlenW (lpString=".vhd") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".vhd") returned 0x0 [0036.757] lstrlenW (lpString=".vhdx") returned 5 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".vhdx") returned 0x0 [0036.757] lstrlenW (lpString=".pst") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".pst") returned 0x0 [0036.757] lstrlenW (lpString=".ost") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".ost") returned 0x0 [0036.757] lstrlenW (lpString=".bak") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".bak") returned 0x0 [0036.757] lstrlenW (lpString=".bac") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".bac") returned 0x0 [0036.757] lstrlenW (lpString=".sys") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".sys") returned 0x0 [0036.757] lstrlenW (lpString=".v2i") returned 4 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".v2i") returned 0x0 [0036.757] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0036.757] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.759] lstrlenW (lpString=".sql") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".sql") returned 0x0 [0036.759] lstrlenW (lpString=".mdf") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".mdf") returned 0x0 [0036.759] lstrlenW (lpString=".txt") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".txt") returned 0x0 [0036.759] lstrlenW (lpString=".dbf") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".dbf") returned 0x0 [0036.759] lstrlenW (lpString=".ckp") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".ckp") returned 0x0 [0036.759] lstrlenW (lpString=".dacpac") returned 7 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".dacpac") returned 0x0 [0036.759] lstrlenW (lpString=".db3") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".db3") returned 0x0 [0036.759] lstrlenW (lpString=".dtxs") returned 5 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".dtxs") returned 0x0 [0036.759] lstrlenW (lpString=".mdt") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".mdt") returned 0x0 [0036.759] lstrlenW (lpString=".sdf") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".sdf") returned 0x0 [0036.759] lstrlenW (lpString=".MDF") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".MDF") returned 0x0 [0036.759] lstrlenW (lpString=".DBF") returned 4 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".DBF") returned 0x0 [0036.759] lstrlenW (lpString=".DB") returned 3 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".DB") returned 0x0 [0036.759] lstrlenW (lpString=".db") returned 3 [0036.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".db") returned 0x0 [0036.759] lstrlenW (lpString=".ndf") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".ndf") returned 0x0 [0036.760] lstrlenW (lpString=".NDF") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".NDF") returned 0x0 [0036.760] lstrlenW (lpString=".Mdf") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".Mdf") returned 0x0 [0036.760] lstrlenW (lpString=".dat") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".dat") returned 0x0 [0036.760] lstrlenW (lpString=".DAT") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".DAT") returned 0x0 [0036.760] lstrlenW (lpString=".ldf") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".ldf") returned 0x0 [0036.760] lstrlenW (lpString=".LDF") returned 4 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch=".LDF") returned 0x0 [0036.760] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0036.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.760] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d070) returned 1 [0036.761] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.761] CryptReleaseContext (hProv=0x27d070, dwFlags=0x0) returned 1 [0036.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0036.761] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15676204675) returned 1 [0036.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa5f84b50, dwHighDateTime=0x1d585b4)) [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1290 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d178 [0036.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0036.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0036.762] GetLastError () returned 0x0 [0036.762] GetLastError () returned 0x0 [0036.762] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0036.762] GetLastError () returned 0x0 [0036.762] GetLastError () returned 0x0 [0036.762] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.765] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.765] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0036.766] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.766] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.767] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.767] CloseHandle (hObject=0x108) returned 1 [0036.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0036.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.768] GetLastError () returned 0x0 [0036.768] RtlWakeConditionVariable () returned 0x27e828 [0036.768] GetCurrentThreadId () returned 0x998 [0036.768] GetCurrentThreadId () returned 0x998 [0036.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0036.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b570 | out: hHeap=0x260000) returned 1 [0036.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0036.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b570 [0036.769] lstrlenW (lpString=".ldf") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".ldf") returned 0x0 [0036.769] lstrlenW (lpString=".vhd") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".vhd") returned 0x0 [0036.769] lstrlenW (lpString=".vhdx") returned 5 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".vhdx") returned 0x0 [0036.769] lstrlenW (lpString=".pst") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".pst") returned 0x0 [0036.769] lstrlenW (lpString=".ost") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".ost") returned 0x0 [0036.769] lstrlenW (lpString=".bak") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".bak") returned 0x0 [0036.769] lstrlenW (lpString=".bac") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".bac") returned 0x0 [0036.769] lstrlenW (lpString=".sys") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".sys") returned 0x0 [0036.769] lstrlenW (lpString=".v2i") returned 4 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".v2i") returned 0x0 [0036.769] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0036.769] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.770] lstrlenW (lpString=".sql") returned 4 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".sql") returned 0x0 [0036.770] lstrlenW (lpString=".mdf") returned 4 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".mdf") returned 0x0 [0036.770] lstrlenW (lpString=".txt") returned 4 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".txt") returned 0x0 [0036.770] lstrlenW (lpString=".dbf") returned 4 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".dbf") returned 0x0 [0036.770] lstrlenW (lpString=".ckp") returned 4 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".ckp") returned 0x0 [0036.770] lstrlenW (lpString=".dacpac") returned 7 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".dacpac") returned 0x0 [0036.770] lstrlenW (lpString=".db3") returned 4 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".db3") returned 0x0 [0036.770] lstrlenW (lpString=".dtxs") returned 5 [0036.770] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".dtxs") returned 0x0 [0036.770] lstrlenW (lpString=".mdt") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".mdt") returned 0x0 [0036.771] lstrlenW (lpString=".sdf") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".sdf") returned 0x0 [0036.771] lstrlenW (lpString=".MDF") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".MDF") returned 0x0 [0036.771] lstrlenW (lpString=".DBF") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".DBF") returned 0x0 [0036.771] lstrlenW (lpString=".DB") returned 3 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".DB") returned 0x0 [0036.771] lstrlenW (lpString=".db") returned 3 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".db") returned 0x0 [0036.771] lstrlenW (lpString=".ndf") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".ndf") returned 0x0 [0036.771] lstrlenW (lpString=".NDF") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".NDF") returned 0x0 [0036.771] lstrlenW (lpString=".Mdf") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".Mdf") returned 0x0 [0036.771] lstrlenW (lpString=".dat") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".dat") returned 0x0 [0036.771] lstrlenW (lpString=".DAT") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".DAT") returned 0x0 [0036.771] lstrlenW (lpString=".ldf") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".ldf") returned 0x0 [0036.771] lstrlenW (lpString=".LDF") returned 4 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch=".LDF") returned 0x0 [0036.771] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.771] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0036.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.771] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d070) returned 1 [0036.772] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.772] CryptReleaseContext (hProv=0x27d070, dwFlags=0x0) returned 1 [0036.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0036.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0036.772] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15677342031) returned 1 [0036.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa5faacb0, dwHighDateTime=0x1d585b4)) [0036.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0036.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0036.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0036.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0036.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0036.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d178 [0036.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0036.773] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0036.773] GetLastError () returned 0x0 [0036.773] GetLastError () returned 0x0 [0036.773] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0036.773] GetLastError () returned 0x0 [0036.773] GetLastError () returned 0x0 [0036.773] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0036.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.895] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0036.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0036.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.895] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.895] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.895] CloseHandle (hObject=0x108) returned 1 [0036.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0036.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0036.896] GetLastError () returned 0x0 [0036.896] RtlWakeConditionVariable () returned 0x27e828 [0036.896] GetCurrentThreadId () returned 0x998 [0036.896] GetCurrentThreadId () returned 0x998 [0036.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d808 | out: hHeap=0x260000) returned 1 [0036.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1300 | out: hHeap=0x260000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0036.896] lstrlenW (lpString=".ldf") returned 4 [0036.896] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".ldf") returned 0x0 [0036.897] lstrlenW (lpString=".vhd") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".vhd") returned 0x0 [0036.897] lstrlenW (lpString=".vhdx") returned 5 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".vhdx") returned 0x0 [0036.897] lstrlenW (lpString=".pst") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".pst") returned 0x0 [0036.897] lstrlenW (lpString=".ost") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".ost") returned 0x0 [0036.897] lstrlenW (lpString=".bak") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".bak") returned 0x0 [0036.897] lstrlenW (lpString=".bac") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".bac") returned 0x0 [0036.897] lstrlenW (lpString=".sys") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".sys") returned 0x0 [0036.897] lstrlenW (lpString=".v2i") returned 4 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".v2i") returned 0x0 [0036.897] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.897] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0036.897] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.974] lstrlenW (lpString=".sql") returned 4 [0038.977] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".sql") returned 0x0 [0038.985] lstrlenW (lpString=".mdf") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".mdf") returned 0x0 [0038.985] lstrlenW (lpString=".txt") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".txt") returned 0x0 [0038.985] lstrlenW (lpString=".dbf") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".dbf") returned 0x0 [0038.985] lstrlenW (lpString=".ckp") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".ckp") returned 0x0 [0038.985] lstrlenW (lpString=".dacpac") returned 7 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".dacpac") returned 0x0 [0038.985] lstrlenW (lpString=".db3") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".db3") returned 0x0 [0038.985] lstrlenW (lpString=".dtxs") returned 5 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".dtxs") returned 0x0 [0038.985] lstrlenW (lpString=".mdt") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".mdt") returned 0x0 [0038.985] lstrlenW (lpString=".sdf") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".sdf") returned 0x0 [0038.985] lstrlenW (lpString=".MDF") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".MDF") returned 0x0 [0038.985] lstrlenW (lpString=".DBF") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".DBF") returned 0x0 [0038.985] lstrlenW (lpString=".DB") returned 3 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".DB") returned 0x0 [0038.985] lstrlenW (lpString=".db") returned 3 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".db") returned 0x0 [0038.985] lstrlenW (lpString=".ndf") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".ndf") returned 0x0 [0038.985] lstrlenW (lpString=".NDF") returned 4 [0038.985] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".NDF") returned 0x0 [0038.986] lstrlenW (lpString=".Mdf") returned 4 [0038.986] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".Mdf") returned 0x0 [0038.986] lstrlenW (lpString=".dat") returned 4 [0038.986] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".dat") returned 0x0 [0038.986] lstrlenW (lpString=".DAT") returned 4 [0038.986] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".DAT") returned 0x0 [0038.986] lstrlenW (lpString=".ldf") returned 4 [0038.986] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".ldf") returned 0x0 [0038.986] lstrlenW (lpString=".LDF") returned 4 [0038.986] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch=".LDF") returned 0x0 [0038.986] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0038.986] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0038.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0038.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0038.986] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d5250) returned 1 [0038.987] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0038.987] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0038.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0038.987] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15898821926) returned 1 [0038.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6316c50, dwHighDateTime=0x1d585b4)) [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0038.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0038.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e420 [0038.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0038.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e420 | out: hHeap=0x260000) returned 1 [0038.988] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0038.988] GetLastError () returned 0x0 [0038.988] GetLastError () returned 0x0 [0038.988] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0038.988] GetLastError () returned 0x0 [0038.988] GetLastError () returned 0x0 [0038.988] ReadFile (in: hFile=0xf0, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0038.992] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0038.992] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0038.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0038.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.993] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0038.994] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0038.994] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0038.994] CloseHandle (hObject=0xf0) returned 1 [0038.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0038.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.[deadmin@cock.li].deadmin")) returned 1 [0038.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0038.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0038.995] GetLastError () returned 0x0 [0038.995] RtlWakeConditionVariable () returned 0x27e828 [0038.995] GetCurrentThreadId () returned 0x998 [0038.995] GetCurrentThreadId () returned 0x998 [0038.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0038.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29da00 | out: hHeap=0x260000) returned 1 [0038.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0038.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29da00 [0038.995] lstrlenW (lpString=".ldf") returned 4 [0038.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0038.995] lstrlenW (lpString=".vhd") returned 4 [0038.995] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0038.995] lstrlenW (lpString=".vhdx") returned 5 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0038.996] lstrlenW (lpString=".pst") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0038.996] lstrlenW (lpString=".ost") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0038.996] lstrlenW (lpString=".bak") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0038.996] lstrlenW (lpString=".bac") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0038.996] lstrlenW (lpString=".sys") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0038.996] lstrlenW (lpString=".v2i") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0038.996] lstrlenW (lpString="s\r\n.v2i") returned 7 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0038.996] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.996] lstrlenW (lpString=".sql") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0038.996] lstrlenW (lpString=".mdf") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0038.996] lstrlenW (lpString=".txt") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0038.996] lstrlenW (lpString=".dbf") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0038.996] lstrlenW (lpString=".ckp") returned 4 [0038.996] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0038.997] lstrlenW (lpString=".dacpac") returned 7 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0038.997] lstrlenW (lpString=".db3") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0038.997] lstrlenW (lpString=".dtxs") returned 5 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0038.997] lstrlenW (lpString=".mdt") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0038.997] lstrlenW (lpString=".sdf") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0038.997] lstrlenW (lpString=".MDF") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0038.997] lstrlenW (lpString=".DBF") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0038.997] lstrlenW (lpString=".DB") returned 3 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0038.997] lstrlenW (lpString=".db") returned 3 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0038.997] lstrlenW (lpString=".ndf") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0038.997] lstrlenW (lpString=".NDF") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0038.997] lstrlenW (lpString=".Mdf") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0038.997] lstrlenW (lpString=".dat") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0038.997] lstrlenW (lpString=".DAT") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0038.997] lstrlenW (lpString=".ldf") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0038.997] lstrlenW (lpString=".LDF") returned 4 [0038.997] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0038.997] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0038.998] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0038.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0038.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0038.998] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d5250) returned 1 [0038.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0038.998] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0038.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0038.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0038.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0038.998] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15899963452) returned 1 [0038.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6316c50, dwHighDateTime=0x1d585b4)) [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0038.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0038.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d808 [0038.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0038.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d808 | out: hHeap=0x260000) returned 1 [0038.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0038.999] GetLastError () returned 0x0 [0038.999] GetLastError () returned 0x0 [0038.999] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0038.999] GetLastError () returned 0x0 [0038.999] GetLastError () returned 0x0 [0038.999] ReadFile (in: hFile=0xf0, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0039.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.001] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0039.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.001] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.001] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.002] CloseHandle (hObject=0xf0) returned 1 [0039.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.002] GetLastError () returned 0x0 [0039.002] RtlWakeConditionVariable () returned 0x27e828 [0039.002] GetCurrentThreadId () returned 0x998 [0039.002] GetCurrentThreadId () returned 0x998 [0039.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d52f8 | out: hHeap=0x260000) returned 1 [0039.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0039.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0039.003] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0039.003] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.003] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.003] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0039.003] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0039.004] CloseHandle (hObject=0xf0) returned 1 [0039.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0039.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0039.004] RtlWakeConditionVariable () returned 0x27e828 [0039.004] GetCurrentThreadId () returned 0x998 [0039.004] GetCurrentThreadId () returned 0x998 [0039.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0039.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0039.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0039.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0039.004] lstrlenW (lpString=".ldf") returned 4 [0039.004] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0039.004] lstrlenW (lpString=".vhd") returned 4 [0039.004] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0039.004] lstrlenW (lpString=".vhdx") returned 5 [0039.004] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0039.005] lstrlenW (lpString=".pst") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0039.005] lstrlenW (lpString=".ost") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0039.005] lstrlenW (lpString=".bak") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0039.005] lstrlenW (lpString=".bac") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0039.005] lstrlenW (lpString=".sys") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0039.005] lstrlenW (lpString=".v2i") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0039.005] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0039.005] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0039.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0039.005] RtlWakeConditionVariable () returned 0x27e828 [0039.005] GetCurrentThreadId () returned 0x998 [0039.005] GetCurrentThreadId () returned 0x998 [0039.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0039.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0039.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0039.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0039.005] lstrlenW (lpString=".ldf") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0039.005] lstrlenW (lpString=".vhd") returned 4 [0039.005] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0039.005] lstrlenW (lpString=".vhdx") returned 5 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0039.006] lstrlenW (lpString=".pst") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0039.006] lstrlenW (lpString=".ost") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0039.006] lstrlenW (lpString=".bak") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0039.006] lstrlenW (lpString=".bac") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0039.006] lstrlenW (lpString=".sys") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0039.006] lstrlenW (lpString=".v2i") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0039.006] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0039.006] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0039.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0039.006] RtlWakeConditionVariable () returned 0x27e828 [0039.006] GetCurrentThreadId () returned 0x998 [0039.006] GetCurrentThreadId () returned 0x998 [0039.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29aef8 | out: hHeap=0x260000) returned 1 [0039.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0039.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29aef8 [0039.006] lstrlenW (lpString=".ldf") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".ldf") returned 0x0 [0039.006] lstrlenW (lpString=".vhd") returned 4 [0039.006] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".vhd") returned 0x0 [0039.006] lstrlenW (lpString=".vhdx") returned 5 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".vhdx") returned 0x0 [0039.007] lstrlenW (lpString=".pst") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".pst") returned 0x0 [0039.007] lstrlenW (lpString=".ost") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".ost") returned 0x0 [0039.007] lstrlenW (lpString=".bak") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".bak") returned 0x0 [0039.007] lstrlenW (lpString=".bac") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".bac") returned 0x0 [0039.007] lstrlenW (lpString=".sys") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".sys") returned 0x0 [0039.007] lstrlenW (lpString=".v2i") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".v2i") returned 0x0 [0039.007] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.007] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0039.007] lstrlenW (lpString=".sql") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".sql") returned 0x0 [0039.007] lstrlenW (lpString=".mdf") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".mdf") returned 0x0 [0039.007] lstrlenW (lpString=".txt") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".txt") returned 0x0 [0039.007] lstrlenW (lpString=".dbf") returned 4 [0039.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".dbf") returned 0x0 [0039.007] lstrlenW (lpString=".ckp") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".ckp") returned 0x0 [0039.008] lstrlenW (lpString=".dacpac") returned 7 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".dacpac") returned 0x0 [0039.008] lstrlenW (lpString=".db3") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".db3") returned 0x0 [0039.008] lstrlenW (lpString=".dtxs") returned 5 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".dtxs") returned 0x0 [0039.008] lstrlenW (lpString=".mdt") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".mdt") returned 0x0 [0039.008] lstrlenW (lpString=".sdf") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".sdf") returned 0x0 [0039.008] lstrlenW (lpString=".MDF") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".MDF") returned 0x0 [0039.008] lstrlenW (lpString=".DBF") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".DBF") returned 0x0 [0039.008] lstrlenW (lpString=".DB") returned 3 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".DB") returned 0x0 [0039.008] lstrlenW (lpString=".db") returned 3 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".db") returned 0x0 [0039.008] lstrlenW (lpString=".ndf") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".ndf") returned 0x0 [0039.008] lstrlenW (lpString=".NDF") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".NDF") returned 0x0 [0039.008] lstrlenW (lpString=".Mdf") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".Mdf") returned 0x0 [0039.008] lstrlenW (lpString=".dat") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".dat") returned 0x0 [0039.008] lstrlenW (lpString=".DAT") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".DAT") returned 0x0 [0039.008] lstrlenW (lpString=".ldf") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".ldf") returned 0x0 [0039.008] lstrlenW (lpString=".LDF") returned 4 [0039.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch=".LDF") returned 0x0 [0039.009] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.009] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d070) returned 1 [0039.009] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.009] CryptReleaseContext (hProv=0x27d070, dwFlags=0x0) returned 1 [0039.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.010] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15901077602) returned 1 [0039.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa633cdb0, dwHighDateTime=0x1d585b4)) [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d070 [0039.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d178 [0039.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0039.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0039.010] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.010] GetLastError () returned 0x0 [0039.010] GetLastError () returned 0x0 [0039.011] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.011] GetLastError () returned 0x0 [0039.011] GetLastError () returned 0x0 [0039.011] ReadFile (in: hFile=0xf0, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.014] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.014] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.015] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.015] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.015] CloseHandle (hObject=0xf0) returned 1 [0039.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.015] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.[deadmin@cock.li].deadmin")) returned 1 [0039.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.015] GetLastError () returned 0x0 [0039.272] RtlWakeConditionVariable () returned 0x27e828 [0039.272] GetCurrentThreadId () returned 0x998 [0039.272] GetCurrentThreadId () returned 0x998 [0039.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29df40 | out: hHeap=0x260000) returned 1 [0039.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0039.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29df40 [0039.272] lstrlenW (lpString=".ldf") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".ldf") returned 0x0 [0039.272] lstrlenW (lpString=".vhd") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".vhd") returned 0x0 [0039.272] lstrlenW (lpString=".vhdx") returned 5 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".vhdx") returned 0x0 [0039.272] lstrlenW (lpString=".pst") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".pst") returned 0x0 [0039.272] lstrlenW (lpString=".ost") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".ost") returned 0x0 [0039.272] lstrlenW (lpString=".bak") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".bak") returned 0x0 [0039.272] lstrlenW (lpString=".bac") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".bac") returned 0x0 [0039.272] lstrlenW (lpString=".sys") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".sys") returned 0x0 [0039.272] lstrlenW (lpString=".v2i") returned 4 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".v2i") returned 0x0 [0039.272] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.272] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch="s\r\n.v2i") returned 0x0 [0039.272] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.410] lstrlenW (lpString=".sql") returned 4 [0039.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".sql") returned 0x0 [0039.410] lstrlenW (lpString=".mdf") returned 4 [0039.410] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".mdf") returned 0x0 [0039.410] lstrlenW (lpString=".txt") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".txt") returned 0x0 [0039.411] lstrlenW (lpString=".dbf") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".dbf") returned 0x0 [0039.411] lstrlenW (lpString=".ckp") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".ckp") returned 0x0 [0039.411] lstrlenW (lpString=".dacpac") returned 7 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".dacpac") returned 0x0 [0039.411] lstrlenW (lpString=".db3") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".db3") returned 0x0 [0039.411] lstrlenW (lpString=".dtxs") returned 5 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".dtxs") returned 0x0 [0039.411] lstrlenW (lpString=".mdt") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".mdt") returned 0x0 [0039.411] lstrlenW (lpString=".sdf") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".sdf") returned 0x0 [0039.411] lstrlenW (lpString=".MDF") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".MDF") returned 0x0 [0039.411] lstrlenW (lpString=".DBF") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".DBF") returned 0x0 [0039.411] lstrlenW (lpString=".DB") returned 3 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".DB") returned 0x0 [0039.411] lstrlenW (lpString=".db") returned 3 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".db") returned 0x0 [0039.411] lstrlenW (lpString=".ndf") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".ndf") returned 0x0 [0039.411] lstrlenW (lpString=".NDF") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".NDF") returned 0x0 [0039.411] lstrlenW (lpString=".Mdf") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".Mdf") returned 0x0 [0039.411] lstrlenW (lpString=".dat") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".dat") returned 0x0 [0039.411] lstrlenW (lpString=".DAT") returned 4 [0039.411] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".DAT") returned 0x0 [0039.411] lstrlenW (lpString=".ldf") returned 4 [0039.412] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".ldf") returned 0x0 [0039.412] lstrlenW (lpString=".LDF") returned 4 [0039.412] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch=".LDF") returned 0x0 [0039.412] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.412] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.412] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.413] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.413] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.413] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15941384107) returned 1 [0039.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa64dfcd0, dwHighDateTime=0x1d585b4)) [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d978 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d978 | out: hHeap=0x260000) returned 1 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30eca8 [0039.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eca8 | out: hHeap=0x260000) returned 1 [0039.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.413] GetLastError () returned 0x0 [0039.414] GetLastError () returned 0x0 [0039.414] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.414] GetLastError () returned 0x0 [0039.414] GetLastError () returned 0x0 [0039.414] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.418] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.418] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.419] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.419] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.420] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.420] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.420] CloseHandle (hObject=0x104) returned 1 [0039.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.[deadmin@cock.li].deadmin")) returned 1 [0039.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.421] GetLastError () returned 0x0 [0039.421] RtlWakeConditionVariable () returned 0x27e828 [0039.421] GetCurrentThreadId () returned 0x998 [0039.421] GetCurrentThreadId () returned 0x998 [0039.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5488 | out: hHeap=0x260000) returned 1 [0039.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991a0 | out: hHeap=0x260000) returned 1 [0039.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0039.421] lstrlenW (lpString=".ldf") returned 4 [0039.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".ldf") returned 0x0 [0039.421] lstrlenW (lpString=".vhd") returned 4 [0039.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".vhd") returned 0x0 [0039.421] lstrlenW (lpString=".vhdx") returned 5 [0039.421] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".vhdx") returned 0x0 [0039.422] lstrlenW (lpString=".pst") returned 4 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".pst") returned 0x0 [0039.422] lstrlenW (lpString=".ost") returned 4 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".ost") returned 0x0 [0039.422] lstrlenW (lpString=".bak") returned 4 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".bak") returned 0x0 [0039.422] lstrlenW (lpString=".bac") returned 4 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".bac") returned 0x0 [0039.422] lstrlenW (lpString=".sys") returned 4 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".sys") returned 0x0 [0039.422] lstrlenW (lpString=".v2i") returned 4 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".v2i") returned 0x0 [0039.422] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.422] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch="s\r\n.v2i") returned 0x0 [0039.422] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.423] lstrlenW (lpString=".sql") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".sql") returned 0x0 [0039.423] lstrlenW (lpString=".mdf") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".mdf") returned 0x0 [0039.423] lstrlenW (lpString=".txt") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".txt") returned 0x0 [0039.423] lstrlenW (lpString=".dbf") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".dbf") returned 0x0 [0039.423] lstrlenW (lpString=".ckp") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".ckp") returned 0x0 [0039.423] lstrlenW (lpString=".dacpac") returned 7 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".dacpac") returned 0x0 [0039.423] lstrlenW (lpString=".db3") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".db3") returned 0x0 [0039.423] lstrlenW (lpString=".dtxs") returned 5 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".dtxs") returned 0x0 [0039.423] lstrlenW (lpString=".mdt") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".mdt") returned 0x0 [0039.423] lstrlenW (lpString=".sdf") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".sdf") returned 0x0 [0039.423] lstrlenW (lpString=".MDF") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".MDF") returned 0x0 [0039.423] lstrlenW (lpString=".DBF") returned 4 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".DBF") returned 0x0 [0039.423] lstrlenW (lpString=".DB") returned 3 [0039.423] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".DB") returned 0x0 [0039.423] lstrlenW (lpString=".db") returned 3 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".db") returned 0x0 [0039.424] lstrlenW (lpString=".ndf") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".ndf") returned 0x0 [0039.424] lstrlenW (lpString=".NDF") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".NDF") returned 0x0 [0039.424] lstrlenW (lpString=".Mdf") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".Mdf") returned 0x0 [0039.424] lstrlenW (lpString=".dat") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".dat") returned 0x0 [0039.424] lstrlenW (lpString=".DAT") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".DAT") returned 0x0 [0039.424] lstrlenW (lpString=".ldf") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".ldf") returned 0x0 [0039.424] lstrlenW (lpString=".LDF") returned 4 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch=".LDF") returned 0x0 [0039.424] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.424] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.424] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.425] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.425] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15942614643) returned 1 [0039.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6505e30, dwHighDateTime=0x1d585b4)) [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991a0 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991a0 | out: hHeap=0x260000) returned 1 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d178 [0039.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d178 | out: hHeap=0x260000) returned 1 [0039.425] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.426] GetLastError () returned 0x0 [0039.426] GetLastError () returned 0x0 [0039.426] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.426] GetLastError () returned 0x0 [0039.426] GetLastError () returned 0x0 [0039.426] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x741, lpOverlapped=0x0) returned 1 [0039.427] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff8bf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.427] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x741, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x741, lpOverlapped=0x0) returned 1 [0039.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.428] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.428] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.428] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.428] CloseHandle (hObject=0x104) returned 1 [0039.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2b3b90 [0039.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.[deadmin@cock.li].deadmin")) returned 1 [0039.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0039.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.429] GetLastError () returned 0x0 [0039.429] RtlWakeConditionVariable () returned 0x27e828 [0039.429] GetCurrentThreadId () returned 0x998 [0039.429] GetCurrentThreadId () returned 0x998 [0039.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dfe8 | out: hHeap=0x260000) returned 1 [0039.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991d8 | out: hHeap=0x260000) returned 1 [0039.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dfe8 [0039.429] lstrlenW (lpString=".ldf") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".ldf") returned 0x0 [0039.429] lstrlenW (lpString=".vhd") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".vhd") returned 0x0 [0039.429] lstrlenW (lpString=".vhdx") returned 5 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".vhdx") returned 0x0 [0039.429] lstrlenW (lpString=".pst") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".pst") returned 0x0 [0039.429] lstrlenW (lpString=".ost") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".ost") returned 0x0 [0039.429] lstrlenW (lpString=".bak") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".bak") returned 0x0 [0039.429] lstrlenW (lpString=".bac") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".bac") returned 0x0 [0039.429] lstrlenW (lpString=".sys") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".sys") returned 0x0 [0039.429] lstrlenW (lpString=".v2i") returned 4 [0039.429] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".v2i") returned 0x0 [0039.430] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.430] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.430] lstrlenW (lpString=".sql") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".sql") returned 0x0 [0039.430] lstrlenW (lpString=".mdf") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".mdf") returned 0x0 [0039.430] lstrlenW (lpString=".txt") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".txt") returned 0x0 [0039.430] lstrlenW (lpString=".dbf") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".dbf") returned 0x0 [0039.430] lstrlenW (lpString=".ckp") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".ckp") returned 0x0 [0039.430] lstrlenW (lpString=".dacpac") returned 7 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".dacpac") returned 0x0 [0039.430] lstrlenW (lpString=".db3") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".db3") returned 0x0 [0039.430] lstrlenW (lpString=".dtxs") returned 5 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".dtxs") returned 0x0 [0039.430] lstrlenW (lpString=".mdt") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".mdt") returned 0x0 [0039.430] lstrlenW (lpString=".sdf") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".sdf") returned 0x0 [0039.430] lstrlenW (lpString=".MDF") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".MDF") returned 0x0 [0039.430] lstrlenW (lpString=".DBF") returned 4 [0039.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".DBF") returned 0x0 [0039.431] lstrlenW (lpString=".DB") returned 3 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".DB") returned 0x0 [0039.431] lstrlenW (lpString=".db") returned 3 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".db") returned 0x0 [0039.431] lstrlenW (lpString=".ndf") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".ndf") returned 0x0 [0039.431] lstrlenW (lpString=".NDF") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".NDF") returned 0x0 [0039.431] lstrlenW (lpString=".Mdf") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".Mdf") returned 0x0 [0039.431] lstrlenW (lpString=".dat") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".dat") returned 0x0 [0039.431] lstrlenW (lpString=".DAT") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".DAT") returned 0x0 [0039.431] lstrlenW (lpString=".ldf") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".ldf") returned 0x0 [0039.431] lstrlenW (lpString=".LDF") returned 4 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch=".LDF") returned 0x0 [0039.431] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.431] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.432] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.432] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.432] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15943322644) returned 1 [0039.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6505e30, dwHighDateTime=0x1d585b4)) [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991d8 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991d8 | out: hHeap=0x260000) returned 1 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29df40 [0039.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29df40 | out: hHeap=0x260000) returned 1 [0039.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.433] GetLastError () returned 0x0 [0039.433] GetLastError () returned 0x0 [0039.433] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.433] GetLastError () returned 0x0 [0039.433] GetLastError () returned 0x0 [0039.433] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.436] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.436] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.436] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.436] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.438] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.438] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.438] CloseHandle (hObject=0x104) returned 1 [0039.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.[deadmin@cock.li].deadmin")) returned 1 [0039.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.439] GetLastError () returned 0x0 [0039.439] RtlWakeConditionVariable () returned 0x27e828 [0039.439] GetCurrentThreadId () returned 0x998 [0039.439] GetCurrentThreadId () returned 0x998 [0039.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e090 | out: hHeap=0x260000) returned 1 [0039.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299210 | out: hHeap=0x260000) returned 1 [0039.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e090 [0039.439] lstrlenW (lpString=".ldf") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".ldf") returned 0x0 [0039.439] lstrlenW (lpString=".vhd") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".vhd") returned 0x0 [0039.439] lstrlenW (lpString=".vhdx") returned 5 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".vhdx") returned 0x0 [0039.439] lstrlenW (lpString=".pst") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".pst") returned 0x0 [0039.439] lstrlenW (lpString=".ost") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".ost") returned 0x0 [0039.439] lstrlenW (lpString=".bak") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".bak") returned 0x0 [0039.439] lstrlenW (lpString=".bac") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".bac") returned 0x0 [0039.439] lstrlenW (lpString=".sys") returned 4 [0039.439] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".sys") returned 0x0 [0039.440] lstrlenW (lpString=".v2i") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".v2i") returned 0x0 [0039.440] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0039.440] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.440] lstrlenW (lpString=".sql") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".sql") returned 0x0 [0039.440] lstrlenW (lpString=".mdf") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".mdf") returned 0x0 [0039.440] lstrlenW (lpString=".txt") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".txt") returned 0x0 [0039.440] lstrlenW (lpString=".dbf") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".dbf") returned 0x0 [0039.440] lstrlenW (lpString=".ckp") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".ckp") returned 0x0 [0039.440] lstrlenW (lpString=".dacpac") returned 7 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".dacpac") returned 0x0 [0039.440] lstrlenW (lpString=".db3") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".db3") returned 0x0 [0039.440] lstrlenW (lpString=".dtxs") returned 5 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".dtxs") returned 0x0 [0039.440] lstrlenW (lpString=".mdt") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".mdt") returned 0x0 [0039.440] lstrlenW (lpString=".sdf") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".sdf") returned 0x0 [0039.440] lstrlenW (lpString=".MDF") returned 4 [0039.440] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".MDF") returned 0x0 [0039.441] lstrlenW (lpString=".DBF") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".DBF") returned 0x0 [0039.441] lstrlenW (lpString=".DB") returned 3 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".DB") returned 0x0 [0039.441] lstrlenW (lpString=".db") returned 3 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".db") returned 0x0 [0039.441] lstrlenW (lpString=".ndf") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".ndf") returned 0x0 [0039.441] lstrlenW (lpString=".NDF") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".NDF") returned 0x0 [0039.441] lstrlenW (lpString=".Mdf") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".Mdf") returned 0x0 [0039.441] lstrlenW (lpString=".dat") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".dat") returned 0x0 [0039.441] lstrlenW (lpString=".DAT") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".DAT") returned 0x0 [0039.441] lstrlenW (lpString=".ldf") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".ldf") returned 0x0 [0039.441] lstrlenW (lpString=".LDF") returned 4 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch=".LDF") returned 0x0 [0039.441] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.441] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.441] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.442] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.442] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.442] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15944328549) returned 1 [0039.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa652bf90, dwHighDateTime=0x1d585b4)) [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299210 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299210 | out: hHeap=0x260000) returned 1 [0039.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dfe8 [0039.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dfe8 | out: hHeap=0x260000) returned 1 [0039.443] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.443] GetLastError () returned 0x0 [0039.443] GetLastError () returned 0x0 [0039.443] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.443] GetLastError () returned 0x0 [0039.443] GetLastError () returned 0x0 [0039.443] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.446] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.446] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.446] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.446] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.619] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.619] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.619] CloseHandle (hObject=0x104) returned 1 [0039.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.[deadmin@cock.li].deadmin")) returned 1 [0039.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.619] GetLastError () returned 0x0 [0039.619] RtlWakeConditionVariable () returned 0x27e828 [0039.619] GetCurrentThreadId () returned 0x998 [0039.620] GetCurrentThreadId () returned 0x998 [0039.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dae98 [0039.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0039.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0039.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0039.620] lstrlenW (lpString=".ldf") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".ldf") returned 0x0 [0039.620] lstrlenW (lpString=".vhd") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".vhd") returned 0x0 [0039.620] lstrlenW (lpString=".vhdx") returned 5 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".vhdx") returned 0x0 [0039.620] lstrlenW (lpString=".pst") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".pst") returned 0x0 [0039.620] lstrlenW (lpString=".ost") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".ost") returned 0x0 [0039.620] lstrlenW (lpString=".bak") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".bak") returned 0x0 [0039.620] lstrlenW (lpString=".bac") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".bac") returned 0x0 [0039.620] lstrlenW (lpString=".sys") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".sys") returned 0x0 [0039.620] lstrlenW (lpString=".v2i") returned 4 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".v2i") returned 0x0 [0039.620] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.620] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.620] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.660] lstrlenW (lpString=".sql") returned 4 [0039.660] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".sql") returned 0x0 [0039.661] lstrlenW (lpString=".mdf") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".mdf") returned 0x0 [0039.661] lstrlenW (lpString=".txt") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".txt") returned 0x0 [0039.661] lstrlenW (lpString=".dbf") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".dbf") returned 0x0 [0039.661] lstrlenW (lpString=".ckp") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".ckp") returned 0x0 [0039.661] lstrlenW (lpString=".dacpac") returned 7 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".dacpac") returned 0x0 [0039.661] lstrlenW (lpString=".db3") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".db3") returned 0x0 [0039.661] lstrlenW (lpString=".dtxs") returned 5 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".dtxs") returned 0x0 [0039.661] lstrlenW (lpString=".mdt") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".mdt") returned 0x0 [0039.661] lstrlenW (lpString=".sdf") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".sdf") returned 0x0 [0039.661] lstrlenW (lpString=".MDF") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".MDF") returned 0x0 [0039.661] lstrlenW (lpString=".DBF") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".DBF") returned 0x0 [0039.661] lstrlenW (lpString=".DB") returned 3 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".DB") returned 0x0 [0039.661] lstrlenW (lpString=".db") returned 3 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".db") returned 0x0 [0039.661] lstrlenW (lpString=".ndf") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".ndf") returned 0x0 [0039.661] lstrlenW (lpString=".NDF") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".NDF") returned 0x0 [0039.661] lstrlenW (lpString=".Mdf") returned 4 [0039.661] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".Mdf") returned 0x0 [0039.662] lstrlenW (lpString=".dat") returned 4 [0039.662] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".dat") returned 0x0 [0039.662] lstrlenW (lpString=".DAT") returned 4 [0039.662] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".DAT") returned 0x0 [0039.662] lstrlenW (lpString=".ldf") returned 4 [0039.662] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".ldf") returned 0x0 [0039.662] lstrlenW (lpString=".LDF") returned 4 [0039.662] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch=".LDF") returned 0x0 [0039.662] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.662] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.662] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.663] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.663] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.663] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15966518149) returned 1 [0039.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa67412d0, dwHighDateTime=0x1d585b4)) [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0039.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0039.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.665] GetLastError () returned 0x0 [0039.665] GetLastError () returned 0x0 [0039.665] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.665] GetLastError () returned 0x0 [0039.665] GetLastError () returned 0x0 [0039.665] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x545, lpOverlapped=0x0) returned 1 [0039.668] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffabb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.668] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x545, lpOverlapped=0x0) returned 1 [0039.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.668] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.668] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.668] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.668] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.668] CloseHandle (hObject=0xfc) returned 1 [0039.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0039.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0039.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.669] GetLastError () returned 0x0 [0039.669] RtlWakeConditionVariable () returned 0x27e828 [0039.669] GetCurrentThreadId () returned 0x998 [0039.669] GetCurrentThreadId () returned 0x998 [0039.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3aa8 | out: hHeap=0x260000) returned 1 [0039.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0039.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edec0 [0039.669] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.670] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.670] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.670] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0039.670] WriteFile (in: hFile=0xfc, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0039.671] CloseHandle (hObject=0xfc) returned 1 [0039.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edec0 | out: hHeap=0x260000) returned 1 [0039.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.671] RtlWakeConditionVariable () returned 0x27e828 [0039.671] GetCurrentThreadId () returned 0x998 [0039.671] GetCurrentThreadId () returned 0x998 [0039.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29be10 | out: hHeap=0x260000) returned 1 [0039.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0039.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29be10 [0039.671] lstrlenW (lpString=".ldf") returned 4 [0039.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".ldf") returned 0x0 [0039.671] lstrlenW (lpString=".vhd") returned 4 [0039.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".vhd") returned 0x0 [0039.671] lstrlenW (lpString=".vhdx") returned 5 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".vhdx") returned 0x0 [0039.672] lstrlenW (lpString=".pst") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".pst") returned 0x0 [0039.672] lstrlenW (lpString=".ost") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".ost") returned 0x0 [0039.672] lstrlenW (lpString=".bak") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".bak") returned 0x0 [0039.672] lstrlenW (lpString=".bac") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".bac") returned 0x0 [0039.672] lstrlenW (lpString=".sys") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".sys") returned 0x0 [0039.672] lstrlenW (lpString=".v2i") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".v2i") returned 0x0 [0039.672] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.672] lstrlenW (lpString=".sql") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".sql") returned 0x0 [0039.672] lstrlenW (lpString=".mdf") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".mdf") returned 0x0 [0039.672] lstrlenW (lpString=".txt") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".txt") returned 0x0 [0039.672] lstrlenW (lpString=".dbf") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".dbf") returned 0x0 [0039.672] lstrlenW (lpString=".ckp") returned 4 [0039.672] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".ckp") returned 0x0 [0039.672] lstrlenW (lpString=".dacpac") returned 7 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".dacpac") returned 0x0 [0039.673] lstrlenW (lpString=".db3") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".db3") returned 0x0 [0039.673] lstrlenW (lpString=".dtxs") returned 5 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".dtxs") returned 0x0 [0039.673] lstrlenW (lpString=".mdt") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".mdt") returned 0x0 [0039.673] lstrlenW (lpString=".sdf") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".sdf") returned 0x0 [0039.673] lstrlenW (lpString=".MDF") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".MDF") returned 0x0 [0039.673] lstrlenW (lpString=".DBF") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".DBF") returned 0x0 [0039.673] lstrlenW (lpString=".DB") returned 3 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".DB") returned 0x0 [0039.673] lstrlenW (lpString=".db") returned 3 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".db") returned 0x0 [0039.673] lstrlenW (lpString=".ndf") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".ndf") returned 0x0 [0039.673] lstrlenW (lpString=".NDF") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".NDF") returned 0x0 [0039.673] lstrlenW (lpString=".Mdf") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".Mdf") returned 0x0 [0039.673] lstrlenW (lpString=".dat") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".dat") returned 0x0 [0039.673] lstrlenW (lpString=".DAT") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".DAT") returned 0x0 [0039.673] lstrlenW (lpString=".ldf") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".ldf") returned 0x0 [0039.673] lstrlenW (lpString=".LDF") returned 4 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch=".LDF") returned 0x0 [0039.673] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.673] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.674] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.674] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.674] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15967557230) returned 1 [0039.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6767430, dwHighDateTime=0x1d585b4)) [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299478 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0039.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0039.675] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.675] GetLastError () returned 0x0 [0039.675] GetLastError () returned 0x0 [0039.675] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.675] GetLastError () returned 0x0 [0039.675] GetLastError () returned 0x0 [0039.675] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.678] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.678] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.678] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.678] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.680] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.680] CloseHandle (hObject=0xfc) returned 1 [0039.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.[deadmin@cock.li].deadmin")) returned 1 [0039.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.681] GetLastError () returned 0x0 [0039.681] RtlWakeConditionVariable () returned 0x27e828 [0039.681] GetCurrentThreadId () returned 0x998 [0039.681] GetCurrentThreadId () returned 0x998 [0039.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bec8 | out: hHeap=0x260000) returned 1 [0039.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0039.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bec8 [0039.681] lstrlenW (lpString=".ldf") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".ldf") returned 0x0 [0039.681] lstrlenW (lpString=".vhd") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".vhd") returned 0x0 [0039.681] lstrlenW (lpString=".vhdx") returned 5 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".vhdx") returned 0x0 [0039.681] lstrlenW (lpString=".pst") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".pst") returned 0x0 [0039.681] lstrlenW (lpString=".ost") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".ost") returned 0x0 [0039.681] lstrlenW (lpString=".bak") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".bak") returned 0x0 [0039.681] lstrlenW (lpString=".bac") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".bac") returned 0x0 [0039.681] lstrlenW (lpString=".sys") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".sys") returned 0x0 [0039.681] lstrlenW (lpString=".v2i") returned 4 [0039.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".v2i") returned 0x0 [0039.682] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.682] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.682] lstrlenW (lpString=".sql") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".sql") returned 0x0 [0039.682] lstrlenW (lpString=".mdf") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".mdf") returned 0x0 [0039.682] lstrlenW (lpString=".txt") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".txt") returned 0x0 [0039.682] lstrlenW (lpString=".dbf") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".dbf") returned 0x0 [0039.682] lstrlenW (lpString=".ckp") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".ckp") returned 0x0 [0039.682] lstrlenW (lpString=".dacpac") returned 7 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".dacpac") returned 0x0 [0039.682] lstrlenW (lpString=".db3") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".db3") returned 0x0 [0039.682] lstrlenW (lpString=".dtxs") returned 5 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".dtxs") returned 0x0 [0039.682] lstrlenW (lpString=".mdt") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".mdt") returned 0x0 [0039.682] lstrlenW (lpString=".sdf") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".sdf") returned 0x0 [0039.682] lstrlenW (lpString=".MDF") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".MDF") returned 0x0 [0039.682] lstrlenW (lpString=".DBF") returned 4 [0039.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".DBF") returned 0x0 [0039.682] lstrlenW (lpString=".DB") returned 3 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".DB") returned 0x0 [0039.683] lstrlenW (lpString=".db") returned 3 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".db") returned 0x0 [0039.683] lstrlenW (lpString=".ndf") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".ndf") returned 0x0 [0039.683] lstrlenW (lpString=".NDF") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".NDF") returned 0x0 [0039.683] lstrlenW (lpString=".Mdf") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".Mdf") returned 0x0 [0039.683] lstrlenW (lpString=".dat") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".dat") returned 0x0 [0039.683] lstrlenW (lpString=".DAT") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".DAT") returned 0x0 [0039.683] lstrlenW (lpString=".ldf") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".ldf") returned 0x0 [0039.683] lstrlenW (lpString=".LDF") returned 4 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch=".LDF") returned 0x0 [0039.683] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.683] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.684] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.684] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15968513977) returned 1 [0039.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6767430, dwHighDateTime=0x1d585b4)) [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0039.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0039.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.685] GetLastError () returned 0x0 [0039.685] GetLastError () returned 0x0 [0039.685] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.685] GetLastError () returned 0x0 [0039.685] GetLastError () returned 0x0 [0039.685] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x333, lpOverlapped=0x0) returned 1 [0039.686] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffccd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.686] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x333, lpOverlapped=0x0) returned 1 [0039.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.687] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.687] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.687] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.687] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.687] CloseHandle (hObject=0xfc) returned 1 [0039.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.688] GetLastError () returned 0x0 [0039.688] RtlWakeConditionVariable () returned 0x27e828 [0039.688] GetCurrentThreadId () returned 0x998 [0039.688] GetCurrentThreadId () returned 0x998 [0039.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0039.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0039.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0039.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0039.688] lstrlenW (lpString=".ldf") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.688] lstrlenW (lpString=".vhd") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0039.688] lstrlenW (lpString=".vhdx") returned 5 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0039.688] lstrlenW (lpString=".pst") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0039.688] lstrlenW (lpString=".ost") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0039.688] lstrlenW (lpString=".bak") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0039.688] lstrlenW (lpString=".bac") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0039.688] lstrlenW (lpString=".sys") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0039.688] lstrlenW (lpString=".v2i") returned 4 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0039.688] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.688] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.689] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.689] lstrlenW (lpString=".sql") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0039.689] lstrlenW (lpString=".mdf") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0039.689] lstrlenW (lpString=".txt") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0039.689] lstrlenW (lpString=".dbf") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0039.689] lstrlenW (lpString=".ckp") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0039.689] lstrlenW (lpString=".dacpac") returned 7 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0039.689] lstrlenW (lpString=".db3") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0039.689] lstrlenW (lpString=".dtxs") returned 5 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0039.689] lstrlenW (lpString=".mdt") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0039.689] lstrlenW (lpString=".sdf") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0039.689] lstrlenW (lpString=".MDF") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0039.689] lstrlenW (lpString=".DBF") returned 4 [0039.689] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0039.689] lstrlenW (lpString=".DB") returned 3 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0039.690] lstrlenW (lpString=".db") returned 3 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0039.690] lstrlenW (lpString=".ndf") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0039.690] lstrlenW (lpString=".NDF") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0039.690] lstrlenW (lpString=".Mdf") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0039.690] lstrlenW (lpString=".dat") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0039.690] lstrlenW (lpString=".DAT") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0039.690] lstrlenW (lpString=".ldf") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.690] lstrlenW (lpString=".LDF") returned 4 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0039.690] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0039.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.690] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.691] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.691] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0039.691] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15969213542) returned 1 [0039.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa678d590, dwHighDateTime=0x1d585b4)) [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994e8 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0039.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.692] GetLastError () returned 0x0 [0039.692] GetLastError () returned 0x0 [0039.692] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.692] GetLastError () returned 0x0 [0039.692] GetLastError () returned 0x0 [0039.692] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0xa40, lpOverlapped=0x0) returned 1 [0039.789] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff5c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.796] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xa40, lpOverlapped=0x0) returned 1 [0039.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.821] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.821] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.821] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.821] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.822] CloseHandle (hObject=0xfc) returned 1 [0039.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.823] GetLastError () returned 0x0 [0039.823] RtlWakeConditionVariable () returned 0x27e828 [0039.823] GetCurrentThreadId () returned 0x998 [0039.823] GetCurrentThreadId () returned 0x998 [0039.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0039.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c0f0 | out: hHeap=0x260000) returned 1 [0039.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299750 | out: hHeap=0x260000) returned 1 [0039.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c0f0 [0039.823] lstrlenW (lpString=".ldf") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".ldf") returned 0x0 [0039.823] lstrlenW (lpString=".vhd") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".vhd") returned 0x0 [0039.823] lstrlenW (lpString=".vhdx") returned 5 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".vhdx") returned 0x0 [0039.823] lstrlenW (lpString=".pst") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".pst") returned 0x0 [0039.823] lstrlenW (lpString=".ost") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".ost") returned 0x0 [0039.823] lstrlenW (lpString=".bak") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".bak") returned 0x0 [0039.823] lstrlenW (lpString=".bac") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".bac") returned 0x0 [0039.823] lstrlenW (lpString=".sys") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".sys") returned 0x0 [0039.823] lstrlenW (lpString=".v2i") returned 4 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".v2i") returned 0x0 [0039.823] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.823] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.823] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.897] lstrlenW (lpString=".sql") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".sql") returned 0x0 [0039.908] lstrlenW (lpString=".mdf") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".mdf") returned 0x0 [0039.908] lstrlenW (lpString=".txt") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".txt") returned 0x0 [0039.908] lstrlenW (lpString=".dbf") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".dbf") returned 0x0 [0039.908] lstrlenW (lpString=".ckp") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".ckp") returned 0x0 [0039.908] lstrlenW (lpString=".dacpac") returned 7 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".dacpac") returned 0x0 [0039.908] lstrlenW (lpString=".db3") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".db3") returned 0x0 [0039.908] lstrlenW (lpString=".dtxs") returned 5 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".dtxs") returned 0x0 [0039.908] lstrlenW (lpString=".mdt") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".mdt") returned 0x0 [0039.908] lstrlenW (lpString=".sdf") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".sdf") returned 0x0 [0039.908] lstrlenW (lpString=".MDF") returned 4 [0039.908] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".MDF") returned 0x0 [0039.909] lstrlenW (lpString=".DBF") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".DBF") returned 0x0 [0039.909] lstrlenW (lpString=".DB") returned 3 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".DB") returned 0x0 [0039.909] lstrlenW (lpString=".db") returned 3 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".db") returned 0x0 [0039.909] lstrlenW (lpString=".ndf") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".ndf") returned 0x0 [0039.909] lstrlenW (lpString=".NDF") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".NDF") returned 0x0 [0039.909] lstrlenW (lpString=".Mdf") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".Mdf") returned 0x0 [0039.909] lstrlenW (lpString=".dat") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".dat") returned 0x0 [0039.909] lstrlenW (lpString=".DAT") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".DAT") returned 0x0 [0039.909] lstrlenW (lpString=".ldf") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".ldf") returned 0x0 [0039.909] lstrlenW (lpString=".LDF") returned 4 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch=".LDF") returned 0x0 [0039.909] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.909] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299ac0 [0039.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.909] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.910] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0039.910] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15991126469) returned 1 [0039.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa69a28d0, dwHighDateTime=0x1d585b4)) [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997f8 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0039.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0039.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.911] GetLastError () returned 0x0 [0039.911] GetLastError () returned 0x0 [0039.911] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.911] GetLastError () returned 0x0 [0039.911] GetLastError () returned 0x0 [0039.911] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.915] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.915] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.916] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.916] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.917] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.917] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.917] CloseHandle (hObject=0xfc) returned 1 [0039.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.[deadmin@cock.li].deadmin")) returned 1 [0039.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee260 | out: hHeap=0x260000) returned 1 [0039.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.918] GetLastError () returned 0x0 [0039.918] RtlWakeConditionVariable () returned 0x27e828 [0039.918] GetCurrentThreadId () returned 0x998 [0039.918] GetCurrentThreadId () returned 0x998 [0039.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0039.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e720 | out: hHeap=0x260000) returned 1 [0039.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0039.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e720 [0039.919] lstrlenW (lpString=".ldf") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ldf") returned 0x0 [0039.919] lstrlenW (lpString=".vhd") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".vhd") returned 0x0 [0039.919] lstrlenW (lpString=".vhdx") returned 5 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".vhdx") returned 0x0 [0039.919] lstrlenW (lpString=".pst") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".pst") returned 0x0 [0039.919] lstrlenW (lpString=".ost") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ost") returned 0x0 [0039.919] lstrlenW (lpString=".bak") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".bak") returned 0x0 [0039.919] lstrlenW (lpString=".bac") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".bac") returned 0x0 [0039.919] lstrlenW (lpString=".sys") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sys") returned 0x0 [0039.919] lstrlenW (lpString=".v2i") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".v2i") returned 0x0 [0039.919] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch="s\r\n.v2i") returned 0x0 [0039.919] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.919] lstrlenW (lpString=".sql") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sql") returned 0x0 [0039.919] lstrlenW (lpString=".mdf") returned 4 [0039.919] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".mdf") returned 0x0 [0039.919] lstrlenW (lpString=".txt") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".txt") returned 0x0 [0039.920] lstrlenW (lpString=".dbf") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dbf") returned 0x0 [0039.920] lstrlenW (lpString=".ckp") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ckp") returned 0x0 [0039.920] lstrlenW (lpString=".dacpac") returned 7 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dacpac") returned 0x0 [0039.920] lstrlenW (lpString=".db3") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".db3") returned 0x0 [0039.920] lstrlenW (lpString=".dtxs") returned 5 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dtxs") returned 0x0 [0039.920] lstrlenW (lpString=".mdt") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".mdt") returned 0x0 [0039.920] lstrlenW (lpString=".sdf") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sdf") returned 0x0 [0039.920] lstrlenW (lpString=".MDF") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".MDF") returned 0x0 [0039.920] lstrlenW (lpString=".DBF") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DBF") returned 0x0 [0039.920] lstrlenW (lpString=".DB") returned 3 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DB") returned 0x0 [0039.920] lstrlenW (lpString=".db") returned 3 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".db") returned 0x0 [0039.920] lstrlenW (lpString=".ndf") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ndf") returned 0x0 [0039.920] lstrlenW (lpString=".NDF") returned 4 [0039.920] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".NDF") returned 0x0 [0039.920] lstrlenW (lpString=".Mdf") returned 4 [0039.921] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".Mdf") returned 0x0 [0039.921] lstrlenW (lpString=".dat") returned 4 [0039.921] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dat") returned 0x0 [0039.921] lstrlenW (lpString=".DAT") returned 4 [0039.921] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DAT") returned 0x0 [0039.921] lstrlenW (lpString=".ldf") returned 4 [0039.921] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ldf") returned 0x0 [0039.921] lstrlenW (lpString=".LDF") returned 4 [0039.921] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".LDF") returned 0x0 [0039.921] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.921] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299ac0 [0039.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.921] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.922] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.922] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0039.922] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15992536306) returned 1 [0039.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa69c8a30, dwHighDateTime=0x1d585b4)) [0039.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299830 [0039.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0039.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e480 [0039.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e480 | out: hHeap=0x260000) returned 1 [0039.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.925] GetLastError () returned 0x0 [0039.925] GetLastError () returned 0x0 [0039.925] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.925] GetLastError () returned 0x0 [0039.925] GetLastError () returned 0x0 [0039.925] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.928] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.928] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.928] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.928] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.930] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.930] CloseHandle (hObject=0xfc) returned 1 [0039.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0039.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.[deadmin@cock.li].deadmin")) returned 1 [0039.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0039.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.930] GetLastError () returned 0x0 [0039.931] RtlWakeConditionVariable () returned 0x27e828 [0039.931] GetCurrentThreadId () returned 0x998 [0039.931] GetCurrentThreadId () returned 0x998 [0039.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0039.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0039.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0039.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0039.931] lstrlenW (lpString=".ldf") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.931] lstrlenW (lpString=".vhd") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0039.931] lstrlenW (lpString=".vhdx") returned 5 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0039.931] lstrlenW (lpString=".pst") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0039.931] lstrlenW (lpString=".ost") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0039.931] lstrlenW (lpString=".bak") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0039.931] lstrlenW (lpString=".bac") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0039.931] lstrlenW (lpString=".sys") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0039.931] lstrlenW (lpString=".v2i") returned 4 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0039.931] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.931] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.931] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.932] lstrlenW (lpString=".sql") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0039.932] lstrlenW (lpString=".mdf") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0039.932] lstrlenW (lpString=".txt") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0039.932] lstrlenW (lpString=".dbf") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0039.932] lstrlenW (lpString=".ckp") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0039.932] lstrlenW (lpString=".dacpac") returned 7 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0039.932] lstrlenW (lpString=".db3") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0039.932] lstrlenW (lpString=".dtxs") returned 5 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0039.932] lstrlenW (lpString=".mdt") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0039.932] lstrlenW (lpString=".sdf") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0039.932] lstrlenW (lpString=".MDF") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0039.932] lstrlenW (lpString=".DBF") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0039.932] lstrlenW (lpString=".DB") returned 3 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0039.932] lstrlenW (lpString=".db") returned 3 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0039.932] lstrlenW (lpString=".ndf") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0039.932] lstrlenW (lpString=".NDF") returned 4 [0039.932] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0039.932] lstrlenW (lpString=".Mdf") returned 4 [0039.933] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0039.933] lstrlenW (lpString=".dat") returned 4 [0039.933] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0039.933] lstrlenW (lpString=".DAT") returned 4 [0039.933] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0039.933] lstrlenW (lpString=".ldf") returned 4 [0039.933] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.933] lstrlenW (lpString=".LDF") returned 4 [0039.933] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0039.933] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.933] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299ac0 [0039.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.933] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27d0b0) returned 1 [0039.934] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.934] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0039.934] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=15993488596) returned 1 [0039.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa69c8a30, dwHighDateTime=0x1d585b4)) [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299868 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e720 [0039.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e720 | out: hHeap=0x260000) returned 1 [0039.934] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0039.934] GetLastError () returned 0x0 [0039.934] GetLastError () returned 0x0 [0039.935] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0039.935] GetLastError () returned 0x0 [0039.935] GetLastError () returned 0x0 [0039.935] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x7976, lpOverlapped=0x0) returned 1 [0039.936] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff868a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.936] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x7976, lpOverlapped=0x0) returned 1 [0039.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0039.937] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.937] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.937] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.937] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.937] CloseHandle (hObject=0xfc) returned 1 [0039.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0039.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0039.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0039.938] GetLastError () returned 0x0 [0039.938] RtlWakeConditionVariable () returned 0x27e828 [0039.938] GetCurrentThreadId () returned 0x998 [0039.938] GetCurrentThreadId () returned 0x998 [0039.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0039.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a48 | out: hHeap=0x260000) returned 1 [0039.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998a0 | out: hHeap=0x260000) returned 1 [0039.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9a48 [0039.938] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.938] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.938] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.938] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0039.938] WriteFile (in: hFile=0xfc, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0039.939] CloseHandle (hObject=0xfc) returned 1 [0039.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a48 | out: hHeap=0x260000) returned 1 [0039.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad08 | out: hHeap=0x260000) returned 1 [0039.939] RtlWakeConditionVariable () returned 0x27e828 [0039.939] GetCurrentThreadId () returned 0x998 [0039.939] GetCurrentThreadId () returned 0x998 [0039.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296728 | out: hHeap=0x260000) returned 1 [0039.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1aa0 | out: hHeap=0x260000) returned 1 [0039.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296728 [0039.940] lstrlenW (lpString=".ldf") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0039.940] lstrlenW (lpString=".vhd") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0039.940] lstrlenW (lpString=".vhdx") returned 5 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0039.940] lstrlenW (lpString=".pst") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0039.940] lstrlenW (lpString=".ost") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0039.940] lstrlenW (lpString=".bak") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0039.940] lstrlenW (lpString=".bac") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0039.940] lstrlenW (lpString=".sys") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0039.940] lstrlenW (lpString=".v2i") returned 4 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0039.940] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.940] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0039.940] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296728 | out: hHeap=0x260000) returned 1 [0039.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.940] RtlWakeConditionVariable () returned 0x27e828 [0039.940] GetCurrentThreadId () returned 0x998 [0039.940] GetCurrentThreadId () returned 0x998 [0039.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2967c0 | out: hHeap=0x260000) returned 1 [0039.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0039.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2967c0 [0039.941] lstrlenW (lpString=".ldf") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0039.941] lstrlenW (lpString=".vhd") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0039.941] lstrlenW (lpString=".vhdx") returned 5 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0039.941] lstrlenW (lpString=".pst") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0039.941] lstrlenW (lpString=".ost") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0039.941] lstrlenW (lpString=".bak") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0039.941] lstrlenW (lpString=".bac") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0039.941] lstrlenW (lpString=".sys") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0039.941] lstrlenW (lpString=".v2i") returned 4 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0039.941] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.941] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0039.941] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2967c0 | out: hHeap=0x260000) returned 1 [0039.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.941] RtlWakeConditionVariable () returned 0x27e828 [0039.941] GetCurrentThreadId () returned 0x998 [0039.941] GetCurrentThreadId () returned 0x998 [0039.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0039.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0039.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0039.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0039.941] lstrlenW (lpString=".ldf") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ldf") returned 0x0 [0039.942] lstrlenW (lpString=".vhd") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".vhd") returned 0x0 [0039.942] lstrlenW (lpString=".vhdx") returned 5 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".vhdx") returned 0x0 [0039.942] lstrlenW (lpString=".pst") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".pst") returned 0x0 [0039.942] lstrlenW (lpString=".ost") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ost") returned 0x0 [0039.942] lstrlenW (lpString=".bak") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".bak") returned 0x0 [0039.942] lstrlenW (lpString=".bac") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".bac") returned 0x0 [0039.942] lstrlenW (lpString=".sys") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sys") returned 0x0 [0039.942] lstrlenW (lpString=".v2i") returned 4 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".v2i") returned 0x0 [0039.942] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.942] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.942] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.063] lstrlenW (lpString=".sql") returned 4 [0040.063] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sql") returned 0x0 [0040.063] lstrlenW (lpString=".mdf") returned 4 [0040.073] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".mdf") returned 0x0 [0040.073] lstrlenW (lpString=".txt") returned 4 [0040.073] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".txt") returned 0x0 [0040.073] lstrlenW (lpString=".dbf") returned 4 [0040.073] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dbf") returned 0x0 [0040.076] lstrlenW (lpString=".ckp") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ckp") returned 0x0 [0040.077] lstrlenW (lpString=".dacpac") returned 7 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dacpac") returned 0x0 [0040.077] lstrlenW (lpString=".db3") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".db3") returned 0x0 [0040.077] lstrlenW (lpString=".dtxs") returned 5 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dtxs") returned 0x0 [0040.077] lstrlenW (lpString=".mdt") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".mdt") returned 0x0 [0040.077] lstrlenW (lpString=".sdf") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sdf") returned 0x0 [0040.077] lstrlenW (lpString=".MDF") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".MDF") returned 0x0 [0040.077] lstrlenW (lpString=".DBF") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DBF") returned 0x0 [0040.077] lstrlenW (lpString=".DB") returned 3 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DB") returned 0x0 [0040.077] lstrlenW (lpString=".db") returned 3 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".db") returned 0x0 [0040.077] lstrlenW (lpString=".ndf") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ndf") returned 0x0 [0040.077] lstrlenW (lpString=".NDF") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".NDF") returned 0x0 [0040.077] lstrlenW (lpString=".Mdf") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".Mdf") returned 0x0 [0040.077] lstrlenW (lpString=".dat") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dat") returned 0x0 [0040.077] lstrlenW (lpString=".DAT") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DAT") returned 0x0 [0040.077] lstrlenW (lpString=".ldf") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ldf") returned 0x0 [0040.077] lstrlenW (lpString=".LDF") returned 4 [0040.077] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".LDF") returned 0x0 [0040.077] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.078] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.078] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.078] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.078] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.078] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16007961672) returned 1 [0040.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6b457f0, dwHighDateTime=0x1d585b4)) [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946b0 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946b0 | out: hHeap=0x260000) returned 1 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0040.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0040.079] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.079] GetLastError () returned 0x0 [0040.079] GetLastError () returned 0x0 [0040.079] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.079] GetLastError () returned 0x0 [0040.079] GetLastError () returned 0x0 [0040.079] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.082] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.082] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.083] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.083] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.084] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.084] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.084] CloseHandle (hObject=0x104) returned 1 [0040.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.[deadmin@cock.li].deadmin")) returned 1 [0040.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.085] GetLastError () returned 0x0 [0040.085] RtlWakeConditionVariable () returned 0x27e828 [0040.085] GetCurrentThreadId () returned 0x998 [0040.085] GetCurrentThreadId () returned 0x998 [0040.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0040.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ebb8 | out: hHeap=0x260000) returned 1 [0040.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946e8 | out: hHeap=0x260000) returned 1 [0040.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ebb8 [0040.085] lstrlenW (lpString=".ldf") returned 4 [0040.085] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ldf") returned 0x0 [0040.085] lstrlenW (lpString=".vhd") returned 4 [0040.085] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".vhd") returned 0x0 [0040.085] lstrlenW (lpString=".vhdx") returned 5 [0040.085] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".vhdx") returned 0x0 [0040.085] lstrlenW (lpString=".pst") returned 4 [0040.085] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".pst") returned 0x0 [0040.085] lstrlenW (lpString=".ost") returned 4 [0040.085] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ost") returned 0x0 [0040.086] lstrlenW (lpString=".bak") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".bak") returned 0x0 [0040.086] lstrlenW (lpString=".bac") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".bac") returned 0x0 [0040.086] lstrlenW (lpString=".sys") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sys") returned 0x0 [0040.086] lstrlenW (lpString=".v2i") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".v2i") returned 0x0 [0040.086] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch="s\r\n.v2i") returned 0x0 [0040.086] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.086] lstrlenW (lpString=".sql") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sql") returned 0x0 [0040.086] lstrlenW (lpString=".mdf") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".mdf") returned 0x0 [0040.086] lstrlenW (lpString=".txt") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".txt") returned 0x0 [0040.086] lstrlenW (lpString=".dbf") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dbf") returned 0x0 [0040.086] lstrlenW (lpString=".ckp") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ckp") returned 0x0 [0040.086] lstrlenW (lpString=".dacpac") returned 7 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dacpac") returned 0x0 [0040.086] lstrlenW (lpString=".db3") returned 4 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".db3") returned 0x0 [0040.086] lstrlenW (lpString=".dtxs") returned 5 [0040.086] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dtxs") returned 0x0 [0040.086] lstrlenW (lpString=".mdt") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".mdt") returned 0x0 [0040.087] lstrlenW (lpString=".sdf") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sdf") returned 0x0 [0040.087] lstrlenW (lpString=".MDF") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".MDF") returned 0x0 [0040.087] lstrlenW (lpString=".DBF") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DBF") returned 0x0 [0040.087] lstrlenW (lpString=".DB") returned 3 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DB") returned 0x0 [0040.087] lstrlenW (lpString=".db") returned 3 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".db") returned 0x0 [0040.087] lstrlenW (lpString=".ndf") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ndf") returned 0x0 [0040.087] lstrlenW (lpString=".NDF") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".NDF") returned 0x0 [0040.087] lstrlenW (lpString=".Mdf") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".Mdf") returned 0x0 [0040.087] lstrlenW (lpString=".dat") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dat") returned 0x0 [0040.087] lstrlenW (lpString=".DAT") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DAT") returned 0x0 [0040.087] lstrlenW (lpString=".ldf") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ldf") returned 0x0 [0040.087] lstrlenW (lpString=".LDF") returned 4 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".LDF") returned 0x0 [0040.087] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.087] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.087] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.088] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.088] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.088] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16008937469) returned 1 [0040.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6b457f0, dwHighDateTime=0x1d585b4)) [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946e8 [0040.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946e8 | out: hHeap=0x260000) returned 1 [0040.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ea68 [0040.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ea68 | out: hHeap=0x260000) returned 1 [0040.089] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.089] GetLastError () returned 0x0 [0040.089] GetLastError () returned 0x0 [0040.089] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.089] GetLastError () returned 0x0 [0040.089] GetLastError () returned 0x0 [0040.089] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.092] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.092] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.093] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.093] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.094] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.094] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.094] CloseHandle (hObject=0x104) returned 1 [0040.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0040.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0040.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.095] GetLastError () returned 0x0 [0040.095] RtlWakeConditionVariable () returned 0x27e828 [0040.095] GetCurrentThreadId () returned 0x998 [0040.095] GetCurrentThreadId () returned 0x998 [0040.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0040.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ec60 | out: hHeap=0x260000) returned 1 [0040.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0040.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ec60 [0040.095] lstrlenW (lpString=".ldf") returned 4 [0040.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0040.095] lstrlenW (lpString=".vhd") returned 4 [0040.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0040.095] lstrlenW (lpString=".vhdx") returned 5 [0040.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0040.095] lstrlenW (lpString=".pst") returned 4 [0040.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0040.095] lstrlenW (lpString=".ost") returned 4 [0040.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0040.095] lstrlenW (lpString=".bak") returned 4 [0040.095] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0040.095] lstrlenW (lpString=".bac") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0040.096] lstrlenW (lpString=".sys") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0040.096] lstrlenW (lpString=".v2i") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0040.096] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.096] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.096] lstrlenW (lpString=".sql") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0040.096] lstrlenW (lpString=".mdf") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0040.096] lstrlenW (lpString=".txt") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0040.096] lstrlenW (lpString=".dbf") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0040.096] lstrlenW (lpString=".ckp") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0040.096] lstrlenW (lpString=".dacpac") returned 7 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0040.096] lstrlenW (lpString=".db3") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0040.096] lstrlenW (lpString=".dtxs") returned 5 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0040.096] lstrlenW (lpString=".mdt") returned 4 [0040.096] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0040.096] lstrlenW (lpString=".sdf") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0040.097] lstrlenW (lpString=".MDF") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0040.097] lstrlenW (lpString=".DBF") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0040.097] lstrlenW (lpString=".DB") returned 3 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0040.097] lstrlenW (lpString=".db") returned 3 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0040.097] lstrlenW (lpString=".ndf") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0040.097] lstrlenW (lpString=".NDF") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0040.097] lstrlenW (lpString=".Mdf") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0040.097] lstrlenW (lpString=".dat") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0040.097] lstrlenW (lpString=".DAT") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0040.097] lstrlenW (lpString=".ldf") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0040.097] lstrlenW (lpString=".LDF") returned 4 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0040.097] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.097] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.097] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.098] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.098] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.098] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16009930735) returned 1 [0040.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6b6b950, dwHighDateTime=0x1d585b4)) [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294720 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0040.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ebb8 [0040.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ebb8 | out: hHeap=0x260000) returned 1 [0040.099] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.099] GetLastError () returned 0x0 [0040.099] GetLastError () returned 0x0 [0040.099] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.099] GetLastError () returned 0x0 [0040.099] GetLastError () returned 0x0 [0040.099] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x412b, lpOverlapped=0x0) returned 1 [0040.101] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbed5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.101] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x412b, lpOverlapped=0x0) returned 1 [0040.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.101] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.101] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.101] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.101] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.101] CloseHandle (hObject=0x104) returned 1 [0040.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.101] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0040.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.102] GetLastError () returned 0x0 [0040.102] RtlWakeConditionVariable () returned 0x27e828 [0040.102] GetCurrentThreadId () returned 0x998 [0040.102] GetCurrentThreadId () returned 0x998 [0040.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9980 [0040.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9bd8 | out: hHeap=0x260000) returned 1 [0040.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0040.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9bd8 [0040.102] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.103] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.103] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.103] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.103] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.104] CloseHandle (hObject=0x104) returned 1 [0040.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9bd8 | out: hHeap=0x260000) returned 1 [0040.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9980 | out: hHeap=0x260000) returned 1 [0040.104] RtlWakeConditionVariable () returned 0x27e828 [0040.104] GetCurrentThreadId () returned 0x998 [0040.104] GetCurrentThreadId () returned 0x998 [0040.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296858 | out: hHeap=0x260000) returned 1 [0040.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0040.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.104] lstrlenW (lpString=".ldf") returned 4 [0040.104] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0040.104] lstrlenW (lpString=".vhd") returned 4 [0040.104] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0040.104] lstrlenW (lpString=".vhdx") returned 5 [0040.104] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0040.104] lstrlenW (lpString=".pst") returned 4 [0040.104] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0040.105] lstrlenW (lpString=".ost") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0040.105] lstrlenW (lpString=".bak") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0040.105] lstrlenW (lpString=".bac") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0040.105] lstrlenW (lpString=".sys") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0040.105] lstrlenW (lpString=".v2i") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0040.105] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0040.105] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296858 | out: hHeap=0x260000) returned 1 [0040.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0040.105] RtlWakeConditionVariable () returned 0x27e828 [0040.105] GetCurrentThreadId () returned 0x998 [0040.105] GetCurrentThreadId () returned 0x998 [0040.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0040.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0040.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.105] lstrlenW (lpString=".ldf") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0040.105] lstrlenW (lpString=".vhd") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0040.105] lstrlenW (lpString=".vhdx") returned 5 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0040.105] lstrlenW (lpString=".pst") returned 4 [0040.105] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0040.106] lstrlenW (lpString=".ost") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0040.106] lstrlenW (lpString=".bak") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0040.106] lstrlenW (lpString=".bac") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0040.106] lstrlenW (lpString=".sys") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0040.106] lstrlenW (lpString=".v2i") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0040.106] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0040.106] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0040.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0040.106] RtlWakeConditionVariable () returned 0x27e828 [0040.106] GetCurrentThreadId () returned 0x998 [0040.106] GetCurrentThreadId () returned 0x998 [0040.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0040.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0040.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.106] lstrlenW (lpString=".ldf") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ldf") returned 0x0 [0040.106] lstrlenW (lpString=".vhd") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".vhd") returned 0x0 [0040.106] lstrlenW (lpString=".vhdx") returned 5 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".vhdx") returned 0x0 [0040.106] lstrlenW (lpString=".pst") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".pst") returned 0x0 [0040.106] lstrlenW (lpString=".ost") returned 4 [0040.106] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ost") returned 0x0 [0040.107] lstrlenW (lpString=".bak") returned 4 [0040.107] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".bak") returned 0x0 [0040.107] lstrlenW (lpString=".bac") returned 4 [0040.107] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".bac") returned 0x0 [0040.107] lstrlenW (lpString=".sys") returned 4 [0040.107] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sys") returned 0x0 [0040.107] lstrlenW (lpString=".v2i") returned 4 [0040.107] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".v2i") returned 0x0 [0040.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.107] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch="s\r\n.v2i") returned 0x0 [0040.107] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.108] lstrlenW (lpString=".sql") returned 4 [0040.108] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sql") returned 0x0 [0040.108] lstrlenW (lpString=".mdf") returned 4 [0040.108] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".mdf") returned 0x0 [0040.108] lstrlenW (lpString=".txt") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".txt") returned 0x0 [0040.109] lstrlenW (lpString=".dbf") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dbf") returned 0x0 [0040.109] lstrlenW (lpString=".ckp") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ckp") returned 0x0 [0040.109] lstrlenW (lpString=".dacpac") returned 7 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dacpac") returned 0x0 [0040.109] lstrlenW (lpString=".db3") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".db3") returned 0x0 [0040.109] lstrlenW (lpString=".dtxs") returned 5 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dtxs") returned 0x0 [0040.109] lstrlenW (lpString=".mdt") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".mdt") returned 0x0 [0040.109] lstrlenW (lpString=".sdf") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sdf") returned 0x0 [0040.109] lstrlenW (lpString=".MDF") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".MDF") returned 0x0 [0040.109] lstrlenW (lpString=".DBF") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DBF") returned 0x0 [0040.109] lstrlenW (lpString=".DB") returned 3 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DB") returned 0x0 [0040.109] lstrlenW (lpString=".db") returned 3 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".db") returned 0x0 [0040.109] lstrlenW (lpString=".ndf") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ndf") returned 0x0 [0040.109] lstrlenW (lpString=".NDF") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".NDF") returned 0x0 [0040.109] lstrlenW (lpString=".Mdf") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".Mdf") returned 0x0 [0040.109] lstrlenW (lpString=".dat") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dat") returned 0x0 [0040.109] lstrlenW (lpString=".DAT") returned 4 [0040.109] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DAT") returned 0x0 [0040.109] lstrlenW (lpString=".ldf") returned 4 [0040.110] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ldf") returned 0x0 [0040.110] lstrlenW (lpString=".LDF") returned 4 [0040.110] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".LDF") returned 0x0 [0040.110] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.110] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.110] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.110] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.111] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16011174602) returned 1 [0040.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6b91ab0, dwHighDateTime=0x1d585b4)) [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294790 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0040.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0040.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.111] GetLastError () returned 0x0 [0040.111] GetLastError () returned 0x0 [0040.111] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.111] GetLastError () returned 0x0 [0040.112] GetLastError () returned 0x0 [0040.112] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.268] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.268] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.280] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.280] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.334] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.334] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.334] CloseHandle (hObject=0x104) returned 1 [0040.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.[deadmin@cock.li].deadmin")) returned 1 [0040.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0040.335] GetLastError () returned 0x0 [0040.335] RtlWakeConditionVariable () returned 0x27e828 [0040.335] GetCurrentThreadId () returned 0x998 [0040.335] GetCurrentThreadId () returned 0x998 [0040.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296988 | out: hHeap=0x260000) returned 1 [0040.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294cd0 | out: hHeap=0x260000) returned 1 [0040.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0040.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\designer\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.376] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.376] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.376] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.377] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.377] CloseHandle (hObject=0x10c) returned 1 [0040.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296988 | out: hHeap=0x260000) returned 1 [0040.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0040.378] RtlWakeConditionVariable () returned 0x27e828 [0040.378] GetCurrentThreadId () returned 0x998 [0040.378] GetCurrentThreadId () returned 0x998 [0040.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0040.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0040.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0040.378] lstrlenW (lpString=".ldf") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".ldf") returned 0x0 [0040.378] lstrlenW (lpString=".vhd") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".vhd") returned 0x0 [0040.378] lstrlenW (lpString=".vhdx") returned 5 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".vhdx") returned 0x0 [0040.378] lstrlenW (lpString=".pst") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".pst") returned 0x0 [0040.378] lstrlenW (lpString=".ost") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".ost") returned 0x0 [0040.378] lstrlenW (lpString=".bak") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".bak") returned 0x0 [0040.378] lstrlenW (lpString=".bac") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".bac") returned 0x0 [0040.378] lstrlenW (lpString=".sys") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".sys") returned 0x0 [0040.378] lstrlenW (lpString=".v2i") returned 4 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".v2i") returned 0x0 [0040.378] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0040.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.379] lstrlenW (lpString=".sql") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".sql") returned 0x0 [0040.379] lstrlenW (lpString=".mdf") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".mdf") returned 0x0 [0040.379] lstrlenW (lpString=".txt") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".txt") returned 0x0 [0040.379] lstrlenW (lpString=".dbf") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".dbf") returned 0x0 [0040.379] lstrlenW (lpString=".ckp") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".ckp") returned 0x0 [0040.379] lstrlenW (lpString=".dacpac") returned 7 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".dacpac") returned 0x0 [0040.379] lstrlenW (lpString=".db3") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".db3") returned 0x0 [0040.379] lstrlenW (lpString=".dtxs") returned 5 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".dtxs") returned 0x0 [0040.379] lstrlenW (lpString=".mdt") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".mdt") returned 0x0 [0040.379] lstrlenW (lpString=".sdf") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".sdf") returned 0x0 [0040.379] lstrlenW (lpString=".MDF") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".MDF") returned 0x0 [0040.379] lstrlenW (lpString=".DBF") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".DBF") returned 0x0 [0040.379] lstrlenW (lpString=".DB") returned 3 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".DB") returned 0x0 [0040.379] lstrlenW (lpString=".db") returned 3 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".db") returned 0x0 [0040.379] lstrlenW (lpString=".ndf") returned 4 [0040.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".ndf") returned 0x0 [0040.380] lstrlenW (lpString=".NDF") returned 4 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".NDF") returned 0x0 [0040.380] lstrlenW (lpString=".Mdf") returned 4 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".Mdf") returned 0x0 [0040.380] lstrlenW (lpString=".dat") returned 4 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".dat") returned 0x0 [0040.380] lstrlenW (lpString=".DAT") returned 4 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".DAT") returned 0x0 [0040.380] lstrlenW (lpString=".ldf") returned 4 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".ldf") returned 0x0 [0040.380] lstrlenW (lpString=".LDF") returned 4 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch=".LDF") returned 0x0 [0040.380] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.380] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e0f0) returned 1 [0040.381] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.381] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0040.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.381] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16038200497) returned 1 [0040.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6e19210, dwHighDateTime=0x1d585b4)) [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bb8 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cf80 [0040.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0040.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.382] GetLastError () returned 0x0 [0040.382] GetLastError () returned 0x0 [0040.382] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.382] GetLastError () returned 0x0 [0040.382] GetLastError () returned 0x0 [0040.382] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0xfa60, lpOverlapped=0x0) returned 1 [0040.384] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff05a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.384] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0xfa60, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0xfa60, lpOverlapped=0x0) returned 1 [0040.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.384] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.385] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.385] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.385] CloseHandle (hObject=0x10c) returned 1 [0040.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0040.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f7a8 | out: hHeap=0x260000) returned 1 [0040.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.385] GetLastError () returned 0x0 [0040.385] RtlWakeConditionVariable () returned 0x27e828 [0040.386] GetCurrentThreadId () returned 0x998 [0040.386] GetCurrentThreadId () returned 0x998 [0040.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0040.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.391] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.391] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.391] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.391] WriteFile (in: hFile=0xfc, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.392] CloseHandle (hObject=0xfc) returned 1 [0040.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.392] RtlWakeConditionVariable () returned 0x27e828 [0040.392] GetCurrentThreadId () returned 0x998 [0040.392] GetCurrentThreadId () returned 0x998 [0040.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0040.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0040.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0040.392] lstrlenW (lpString=".ldf") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".ldf") returned 0x0 [0040.393] lstrlenW (lpString=".vhd") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".vhd") returned 0x0 [0040.393] lstrlenW (lpString=".vhdx") returned 5 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".vhdx") returned 0x0 [0040.393] lstrlenW (lpString=".pst") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".pst") returned 0x0 [0040.393] lstrlenW (lpString=".ost") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".ost") returned 0x0 [0040.393] lstrlenW (lpString=".bak") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".bak") returned 0x0 [0040.393] lstrlenW (lpString=".bac") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".bac") returned 0x0 [0040.393] lstrlenW (lpString=".sys") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".sys") returned 0x0 [0040.393] lstrlenW (lpString=".v2i") returned 4 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".v2i") returned 0x0 [0040.393] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch="s\r\n.v2i") returned 0x0 [0040.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.397] lstrlenW (lpString=".sql") returned 4 [0040.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".sql") returned 0x0 [0040.397] lstrlenW (lpString=".mdf") returned 4 [0040.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".mdf") returned 0x0 [0040.397] lstrlenW (lpString=".txt") returned 4 [0040.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".txt") returned 0x0 [0040.397] lstrlenW (lpString=".dbf") returned 4 [0040.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".dbf") returned 0x0 [0040.397] lstrlenW (lpString=".ckp") returned 4 [0040.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".ckp") returned 0x0 [0040.397] lstrlenW (lpString=".dacpac") returned 7 [0040.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".dacpac") returned 0x0 [0040.398] lstrlenW (lpString=".db3") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".db3") returned 0x0 [0040.398] lstrlenW (lpString=".dtxs") returned 5 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".dtxs") returned 0x0 [0040.398] lstrlenW (lpString=".mdt") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".mdt") returned 0x0 [0040.398] lstrlenW (lpString=".sdf") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".sdf") returned 0x0 [0040.398] lstrlenW (lpString=".MDF") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".MDF") returned 0x0 [0040.398] lstrlenW (lpString=".DBF") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".DBF") returned 0x0 [0040.398] lstrlenW (lpString=".DB") returned 3 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".DB") returned 0x0 [0040.398] lstrlenW (lpString=".db") returned 3 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".db") returned 0x0 [0040.398] lstrlenW (lpString=".ndf") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".ndf") returned 0x0 [0040.398] lstrlenW (lpString=".NDF") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".NDF") returned 0x0 [0040.398] lstrlenW (lpString=".Mdf") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".Mdf") returned 0x0 [0040.398] lstrlenW (lpString=".dat") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".dat") returned 0x0 [0040.398] lstrlenW (lpString=".DAT") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".DAT") returned 0x0 [0040.398] lstrlenW (lpString=".ldf") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".ldf") returned 0x0 [0040.398] lstrlenW (lpString=".LDF") returned 4 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch=".LDF") returned 0x0 [0040.398] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.398] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e0f0) returned 1 [0040.399] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.399] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0040.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.400] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16040077740) returned 1 [0040.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6e3f370, dwHighDateTime=0x1d585b4)) [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0040.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0040.400] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.400] GetLastError () returned 0x0 [0040.400] GetLastError () returned 0x0 [0040.400] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.400] GetLastError () returned 0x0 [0040.401] GetLastError () returned 0x0 [0040.401] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x9fd, lpOverlapped=0x0) returned 1 [0040.410] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff603, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.410] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x9fd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x9fd, lpOverlapped=0x0) returned 1 [0040.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.410] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.410] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.410] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.410] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.411] CloseHandle (hObject=0xfc) returned 1 [0040.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0040.411] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.[deadmin@cock.li].deadmin")) returned 1 [0040.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f7a8 | out: hHeap=0x260000) returned 1 [0040.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.411] GetLastError () returned 0x0 [0040.411] RtlWakeConditionVariable () returned 0x27e828 [0040.411] GetCurrentThreadId () returned 0x998 [0040.412] GetCurrentThreadId () returned 0x998 [0040.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c990 | out: hHeap=0x260000) returned 1 [0040.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0040.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c990 [0040.412] lstrlenW (lpString=".ldf") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".ldf") returned 0x0 [0040.412] lstrlenW (lpString=".vhd") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".vhd") returned 0x0 [0040.412] lstrlenW (lpString=".vhdx") returned 5 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".vhdx") returned 0x0 [0040.412] lstrlenW (lpString=".pst") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".pst") returned 0x0 [0040.412] lstrlenW (lpString=".ost") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".ost") returned 0x0 [0040.412] lstrlenW (lpString=".bak") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".bak") returned 0x0 [0040.412] lstrlenW (lpString=".bac") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".bac") returned 0x0 [0040.412] lstrlenW (lpString=".sys") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".sys") returned 0x0 [0040.412] lstrlenW (lpString=".v2i") returned 4 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".v2i") returned 0x0 [0040.412] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch="s\r\n.v2i") returned 0x0 [0040.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.416] lstrlenW (lpString=".sql") returned 4 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".sql") returned 0x0 [0040.416] lstrlenW (lpString=".mdf") returned 4 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".mdf") returned 0x0 [0040.416] lstrlenW (lpString=".txt") returned 4 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".txt") returned 0x0 [0040.416] lstrlenW (lpString=".dbf") returned 4 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".dbf") returned 0x0 [0040.416] lstrlenW (lpString=".ckp") returned 4 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".ckp") returned 0x0 [0040.416] lstrlenW (lpString=".dacpac") returned 7 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".dacpac") returned 0x0 [0040.416] lstrlenW (lpString=".db3") returned 4 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".db3") returned 0x0 [0040.416] lstrlenW (lpString=".dtxs") returned 5 [0040.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".dtxs") returned 0x0 [0040.416] lstrlenW (lpString=".mdt") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".mdt") returned 0x0 [0040.417] lstrlenW (lpString=".sdf") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".sdf") returned 0x0 [0040.417] lstrlenW (lpString=".MDF") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".MDF") returned 0x0 [0040.417] lstrlenW (lpString=".DBF") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".DBF") returned 0x0 [0040.417] lstrlenW (lpString=".DB") returned 3 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".DB") returned 0x0 [0040.417] lstrlenW (lpString=".db") returned 3 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".db") returned 0x0 [0040.417] lstrlenW (lpString=".ndf") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".ndf") returned 0x0 [0040.417] lstrlenW (lpString=".NDF") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".NDF") returned 0x0 [0040.417] lstrlenW (lpString=".Mdf") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".Mdf") returned 0x0 [0040.417] lstrlenW (lpString=".dat") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".dat") returned 0x0 [0040.417] lstrlenW (lpString=".DAT") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".DAT") returned 0x0 [0040.417] lstrlenW (lpString=".ldf") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".ldf") returned 0x0 [0040.417] lstrlenW (lpString=".LDF") returned 4 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch=".LDF") returned 0x0 [0040.417] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.417] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.418] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.418] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.418] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16041938422) returned 1 [0040.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6e654d0, dwHighDateTime=0x1d585b4)) [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e40 [0040.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0040.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.419] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.419] GetLastError () returned 0x0 [0040.419] GetLastError () returned 0x0 [0040.419] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.419] GetLastError () returned 0x0 [0040.419] GetLastError () returned 0x0 [0040.419] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x236, lpOverlapped=0x0) returned 1 [0040.420] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.420] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x236, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x236, lpOverlapped=0x0) returned 1 [0040.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.422] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.422] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.422] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.422] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.422] CloseHandle (hObject=0xfc) returned 1 [0040.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.[deadmin@cock.li].deadmin")) returned 1 [0040.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.423] GetLastError () returned 0x0 [0040.423] RtlWakeConditionVariable () returned 0x27e828 [0040.423] GetCurrentThreadId () returned 0x998 [0040.423] GetCurrentThreadId () returned 0x998 [0040.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6018 | out: hHeap=0x260000) returned 1 [0040.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0040.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6018 [0040.423] lstrlenW (lpString=".ldf") returned 4 [0040.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".ldf") returned 0x0 [0040.423] lstrlenW (lpString=".vhd") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".vhd") returned 0x0 [0040.424] lstrlenW (lpString=".vhdx") returned 5 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".vhdx") returned 0x0 [0040.424] lstrlenW (lpString=".pst") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".pst") returned 0x0 [0040.424] lstrlenW (lpString=".ost") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".ost") returned 0x0 [0040.424] lstrlenW (lpString=".bak") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".bak") returned 0x0 [0040.424] lstrlenW (lpString=".bac") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".bac") returned 0x0 [0040.424] lstrlenW (lpString=".sys") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".sys") returned 0x0 [0040.424] lstrlenW (lpString=".v2i") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".v2i") returned 0x0 [0040.424] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch="s\r\n.v2i") returned 0x0 [0040.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.424] lstrlenW (lpString=".sql") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".sql") returned 0x0 [0040.424] lstrlenW (lpString=".mdf") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".mdf") returned 0x0 [0040.424] lstrlenW (lpString=".txt") returned 4 [0040.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".txt") returned 0x0 [0040.425] lstrlenW (lpString=".dbf") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".dbf") returned 0x0 [0040.425] lstrlenW (lpString=".ckp") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".ckp") returned 0x0 [0040.425] lstrlenW (lpString=".dacpac") returned 7 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".dacpac") returned 0x0 [0040.425] lstrlenW (lpString=".db3") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".db3") returned 0x0 [0040.425] lstrlenW (lpString=".dtxs") returned 5 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".dtxs") returned 0x0 [0040.425] lstrlenW (lpString=".mdt") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".mdt") returned 0x0 [0040.425] lstrlenW (lpString=".sdf") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".sdf") returned 0x0 [0040.425] lstrlenW (lpString=".MDF") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".MDF") returned 0x0 [0040.425] lstrlenW (lpString=".DBF") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".DBF") returned 0x0 [0040.425] lstrlenW (lpString=".DB") returned 3 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".DB") returned 0x0 [0040.425] lstrlenW (lpString=".db") returned 3 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".db") returned 0x0 [0040.425] lstrlenW (lpString=".ndf") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".ndf") returned 0x0 [0040.425] lstrlenW (lpString=".NDF") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".NDF") returned 0x0 [0040.425] lstrlenW (lpString=".Mdf") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".Mdf") returned 0x0 [0040.425] lstrlenW (lpString=".dat") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".dat") returned 0x0 [0040.425] lstrlenW (lpString=".DAT") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".DAT") returned 0x0 [0040.425] lstrlenW (lpString=".ldf") returned 4 [0040.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".ldf") returned 0x0 [0040.426] lstrlenW (lpString=".LDF") returned 4 [0040.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch=".LDF") returned 0x0 [0040.426] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.426] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.426] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.427] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16042770177) returned 1 [0040.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6e8b630, dwHighDateTime=0x1d585b4)) [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e78 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5e20 [0040.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0040.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.427] GetLastError () returned 0x0 [0040.427] GetLastError () returned 0x0 [0040.427] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.427] GetLastError () returned 0x0 [0040.427] GetLastError () returned 0x0 [0040.428] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.504] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.504] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.506] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.506] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.506] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.506] CloseHandle (hObject=0xfc) returned 1 [0040.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.[deadmin@cock.li].deadmin")) returned 1 [0040.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.510] GetLastError () returned 0x0 [0040.510] RtlWakeConditionVariable () returned 0x27e828 [0040.510] GetCurrentThreadId () returned 0x998 [0040.510] GetCurrentThreadId () returned 0x998 [0040.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296d18 | out: hHeap=0x260000) returned 1 [0040.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0040.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296d18 [0040.511] lstrlenW (lpString=".ldf") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".ldf") returned 0x0 [0040.511] lstrlenW (lpString=".vhd") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".vhd") returned 0x0 [0040.511] lstrlenW (lpString=".vhdx") returned 5 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".vhdx") returned 0x0 [0040.511] lstrlenW (lpString=".pst") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".pst") returned 0x0 [0040.511] lstrlenW (lpString=".ost") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".ost") returned 0x0 [0040.511] lstrlenW (lpString=".bak") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".bak") returned 0x0 [0040.511] lstrlenW (lpString=".bac") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".bac") returned 0x0 [0040.511] lstrlenW (lpString=".sys") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".sys") returned 0x0 [0040.511] lstrlenW (lpString=".v2i") returned 4 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".v2i") returned 0x0 [0040.511] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.535] lstrlenW (lpString=".sql") returned 4 [0040.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".sql") returned 0x0 [0040.535] lstrlenW (lpString=".mdf") returned 4 [0040.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".mdf") returned 0x0 [0040.535] lstrlenW (lpString=".txt") returned 4 [0040.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".txt") returned 0x0 [0040.535] lstrlenW (lpString=".dbf") returned 4 [0040.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".dbf") returned 0x0 [0040.536] lstrlenW (lpString=".ckp") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".ckp") returned 0x0 [0040.536] lstrlenW (lpString=".dacpac") returned 7 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".dacpac") returned 0x0 [0040.536] lstrlenW (lpString=".db3") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".db3") returned 0x0 [0040.536] lstrlenW (lpString=".dtxs") returned 5 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".dtxs") returned 0x0 [0040.536] lstrlenW (lpString=".mdt") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".mdt") returned 0x0 [0040.536] lstrlenW (lpString=".sdf") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".sdf") returned 0x0 [0040.536] lstrlenW (lpString=".MDF") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".MDF") returned 0x0 [0040.536] lstrlenW (lpString=".DBF") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".DBF") returned 0x0 [0040.536] lstrlenW (lpString=".DB") returned 3 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".DB") returned 0x0 [0040.536] lstrlenW (lpString=".db") returned 3 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".db") returned 0x0 [0040.536] lstrlenW (lpString=".ndf") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".ndf") returned 0x0 [0040.536] lstrlenW (lpString=".NDF") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".NDF") returned 0x0 [0040.536] lstrlenW (lpString=".Mdf") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".Mdf") returned 0x0 [0040.536] lstrlenW (lpString=".dat") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".dat") returned 0x0 [0040.536] lstrlenW (lpString=".DAT") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".DAT") returned 0x0 [0040.536] lstrlenW (lpString=".ldf") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".ldf") returned 0x0 [0040.536] lstrlenW (lpString=".LDF") returned 4 [0040.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch=".LDF") returned 0x0 [0040.537] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.537] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.537] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.537] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.538] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16053866876) returned 1 [0040.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6f95fd0, dwHighDateTime=0x1d585b4)) [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295000 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.538] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.538] GetLastError () returned 0x0 [0040.538] GetLastError () returned 0x0 [0040.538] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.538] GetLastError () returned 0x0 [0040.538] GetLastError () returned 0x0 [0040.539] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.544] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.544] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.544] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.544] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.550] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.550] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.550] CloseHandle (hObject=0x10c) returned 1 [0040.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.558] GetLastError () returned 0x0 [0040.558] RtlWakeConditionVariable () returned 0x27e828 [0040.558] GetCurrentThreadId () returned 0x998 [0040.558] GetCurrentThreadId () returned 0x998 [0040.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cb00 | out: hHeap=0x260000) returned 1 [0040.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295070 | out: hHeap=0x260000) returned 1 [0040.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29cb00 [0040.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.559] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.559] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.559] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.559] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.560] CloseHandle (hObject=0x10c) returned 1 [0040.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cb00 | out: hHeap=0x260000) returned 1 [0040.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.560] RtlWakeConditionVariable () returned 0x27e828 [0040.560] GetCurrentThreadId () returned 0x998 [0040.561] GetCurrentThreadId () returned 0x998 [0040.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296ee0 | out: hHeap=0x260000) returned 1 [0040.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0040.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ee0 [0040.561] lstrlenW (lpString=".ldf") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".ldf") returned 0x0 [0040.561] lstrlenW (lpString=".vhd") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".vhd") returned 0x0 [0040.561] lstrlenW (lpString=".vhdx") returned 5 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".vhdx") returned 0x0 [0040.561] lstrlenW (lpString=".pst") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".pst") returned 0x0 [0040.561] lstrlenW (lpString=".ost") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".ost") returned 0x0 [0040.561] lstrlenW (lpString=".bak") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".bak") returned 0x0 [0040.561] lstrlenW (lpString=".bac") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".bac") returned 0x0 [0040.561] lstrlenW (lpString=".sys") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".sys") returned 0x0 [0040.561] lstrlenW (lpString=".v2i") returned 4 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".v2i") returned 0x0 [0040.561] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0040.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.562] lstrlenW (lpString=".sql") returned 4 [0040.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".sql") returned 0x0 [0040.562] lstrlenW (lpString=".mdf") returned 4 [0040.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".mdf") returned 0x0 [0040.562] lstrlenW (lpString=".txt") returned 4 [0040.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".txt") returned 0x0 [0040.562] lstrlenW (lpString=".dbf") returned 4 [0040.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".dbf") returned 0x0 [0040.562] lstrlenW (lpString=".ckp") returned 4 [0040.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".ckp") returned 0x0 [0040.562] lstrlenW (lpString=".dacpac") returned 7 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".dacpac") returned 0x0 [0040.563] lstrlenW (lpString=".db3") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".db3") returned 0x0 [0040.563] lstrlenW (lpString=".dtxs") returned 5 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".dtxs") returned 0x0 [0040.563] lstrlenW (lpString=".mdt") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".mdt") returned 0x0 [0040.563] lstrlenW (lpString=".sdf") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".sdf") returned 0x0 [0040.563] lstrlenW (lpString=".MDF") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".MDF") returned 0x0 [0040.563] lstrlenW (lpString=".DBF") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".DBF") returned 0x0 [0040.563] lstrlenW (lpString=".DB") returned 3 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".DB") returned 0x0 [0040.563] lstrlenW (lpString=".db") returned 3 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".db") returned 0x0 [0040.563] lstrlenW (lpString=".ndf") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".ndf") returned 0x0 [0040.563] lstrlenW (lpString=".NDF") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".NDF") returned 0x0 [0040.563] lstrlenW (lpString=".Mdf") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".Mdf") returned 0x0 [0040.563] lstrlenW (lpString=".dat") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".dat") returned 0x0 [0040.563] lstrlenW (lpString=".DAT") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".DAT") returned 0x0 [0040.563] lstrlenW (lpString=".ldf") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".ldf") returned 0x0 [0040.563] lstrlenW (lpString=".LDF") returned 4 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch=".LDF") returned 0x0 [0040.563] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.564] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.564] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.564] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16056557470) returned 1 [0040.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa6fe2290, dwHighDateTime=0x1d585b4)) [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c28 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296d18 [0040.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.565] GetLastError () returned 0x0 [0040.565] GetLastError () returned 0x0 [0040.565] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.565] GetLastError () returned 0x0 [0040.565] GetLastError () returned 0x0 [0040.565] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x1a9b, lpOverlapped=0x0) returned 1 [0040.569] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe565, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.569] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x1a9b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x1a9b, lpOverlapped=0x0) returned 1 [0040.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.570] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.570] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.570] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.570] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.571] CloseHandle (hObject=0x10c) returned 1 [0040.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.[deadmin@cock.li].deadmin")) returned 1 [0040.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.571] GetLastError () returned 0x0 [0040.572] RtlWakeConditionVariable () returned 0x27e828 [0040.572] GetCurrentThreadId () returned 0x998 [0040.572] GetCurrentThreadId () returned 0x998 [0040.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297010 | out: hHeap=0x260000) returned 1 [0040.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950a8 | out: hHeap=0x260000) returned 1 [0040.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297010 [0040.572] lstrlenW (lpString=".ldf") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".ldf") returned 0x0 [0040.572] lstrlenW (lpString=".vhd") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".vhd") returned 0x0 [0040.572] lstrlenW (lpString=".vhdx") returned 5 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".vhdx") returned 0x0 [0040.572] lstrlenW (lpString=".pst") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".pst") returned 0x0 [0040.572] lstrlenW (lpString=".ost") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".ost") returned 0x0 [0040.572] lstrlenW (lpString=".bak") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".bak") returned 0x0 [0040.572] lstrlenW (lpString=".bac") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".bac") returned 0x0 [0040.572] lstrlenW (lpString=".sys") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".sys") returned 0x0 [0040.572] lstrlenW (lpString=".v2i") returned 4 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".v2i") returned 0x0 [0040.572] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch="s\r\n.v2i") returned 0x0 [0040.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.575] lstrlenW (lpString=".sql") returned 4 [0040.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".sql") returned 0x0 [0040.575] lstrlenW (lpString=".mdf") returned 4 [0040.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".mdf") returned 0x0 [0040.575] lstrlenW (lpString=".txt") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".txt") returned 0x0 [0040.576] lstrlenW (lpString=".dbf") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".dbf") returned 0x0 [0040.576] lstrlenW (lpString=".ckp") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".ckp") returned 0x0 [0040.576] lstrlenW (lpString=".dacpac") returned 7 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".dacpac") returned 0x0 [0040.576] lstrlenW (lpString=".db3") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".db3") returned 0x0 [0040.576] lstrlenW (lpString=".dtxs") returned 5 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".dtxs") returned 0x0 [0040.576] lstrlenW (lpString=".mdt") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".mdt") returned 0x0 [0040.576] lstrlenW (lpString=".sdf") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".sdf") returned 0x0 [0040.576] lstrlenW (lpString=".MDF") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".MDF") returned 0x0 [0040.576] lstrlenW (lpString=".DBF") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".DBF") returned 0x0 [0040.576] lstrlenW (lpString=".DB") returned 3 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".DB") returned 0x0 [0040.576] lstrlenW (lpString=".db") returned 3 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".db") returned 0x0 [0040.576] lstrlenW (lpString=".ndf") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".ndf") returned 0x0 [0040.576] lstrlenW (lpString=".NDF") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".NDF") returned 0x0 [0040.576] lstrlenW (lpString=".Mdf") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".Mdf") returned 0x0 [0040.576] lstrlenW (lpString=".dat") returned 4 [0040.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".dat") returned 0x0 [0040.576] lstrlenW (lpString=".DAT") returned 4 [0040.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".DAT") returned 0x0 [0040.577] lstrlenW (lpString=".ldf") returned 4 [0040.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".ldf") returned 0x0 [0040.577] lstrlenW (lpString=".LDF") returned 4 [0040.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch=".LDF") returned 0x0 [0040.577] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.577] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.578] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.578] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.578] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16057883171) returned 1 [0040.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa70083f0, dwHighDateTime=0x1d585b4)) [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2950a8 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950a8 | out: hHeap=0x260000) returned 1 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ee0 [0040.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.578] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.578] GetLastError () returned 0x0 [0040.578] GetLastError () returned 0x0 [0040.578] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.579] GetLastError () returned 0x0 [0040.579] GetLastError () returned 0x0 [0040.579] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.583] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.583] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.583] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.583] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.584] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.584] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.585] CloseHandle (hObject=0x10c) returned 1 [0040.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.[deadmin@cock.li].deadmin")) returned 1 [0040.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.585] GetLastError () returned 0x0 [0040.586] RtlWakeConditionVariable () returned 0x27e828 [0040.586] GetCurrentThreadId () returned 0x998 [0040.586] GetCurrentThreadId () returned 0x998 [0040.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2970a8 | out: hHeap=0x260000) returned 1 [0040.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950e0 | out: hHeap=0x260000) returned 1 [0040.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2970a8 [0040.586] lstrlenW (lpString=".ldf") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.586] lstrlenW (lpString=".vhd") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".vhd") returned 0x0 [0040.586] lstrlenW (lpString=".vhdx") returned 5 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".vhdx") returned 0x0 [0040.586] lstrlenW (lpString=".pst") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".pst") returned 0x0 [0040.586] lstrlenW (lpString=".ost") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".ost") returned 0x0 [0040.586] lstrlenW (lpString=".bak") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".bak") returned 0x0 [0040.586] lstrlenW (lpString=".bac") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".bac") returned 0x0 [0040.586] lstrlenW (lpString=".sys") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".sys") returned 0x0 [0040.586] lstrlenW (lpString=".v2i") returned 4 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".v2i") returned 0x0 [0040.586] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.587] lstrlenW (lpString=".sql") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".sql") returned 0x0 [0040.587] lstrlenW (lpString=".mdf") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".mdf") returned 0x0 [0040.587] lstrlenW (lpString=".txt") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".txt") returned 0x0 [0040.587] lstrlenW (lpString=".dbf") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".dbf") returned 0x0 [0040.587] lstrlenW (lpString=".ckp") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".ckp") returned 0x0 [0040.587] lstrlenW (lpString=".dacpac") returned 7 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".dacpac") returned 0x0 [0040.587] lstrlenW (lpString=".db3") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".db3") returned 0x0 [0040.587] lstrlenW (lpString=".dtxs") returned 5 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".dtxs") returned 0x0 [0040.587] lstrlenW (lpString=".mdt") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".mdt") returned 0x0 [0040.587] lstrlenW (lpString=".sdf") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".sdf") returned 0x0 [0040.587] lstrlenW (lpString=".MDF") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".MDF") returned 0x0 [0040.587] lstrlenW (lpString=".DBF") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".DBF") returned 0x0 [0040.587] lstrlenW (lpString=".DB") returned 3 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".DB") returned 0x0 [0040.587] lstrlenW (lpString=".db") returned 3 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".db") returned 0x0 [0040.587] lstrlenW (lpString=".ndf") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".ndf") returned 0x0 [0040.587] lstrlenW (lpString=".NDF") returned 4 [0040.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".NDF") returned 0x0 [0040.588] lstrlenW (lpString=".Mdf") returned 4 [0040.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".Mdf") returned 0x0 [0040.588] lstrlenW (lpString=".dat") returned 4 [0040.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".dat") returned 0x0 [0040.588] lstrlenW (lpString=".DAT") returned 4 [0040.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".DAT") returned 0x0 [0040.588] lstrlenW (lpString=".ldf") returned 4 [0040.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.588] lstrlenW (lpString=".LDF") returned 4 [0040.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch=".LDF") returned 0x0 [0040.588] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.588] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0040.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.589] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.589] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16058995853) returned 1 [0040.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa70083f0, dwHighDateTime=0x1d585b4)) [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2950e0 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950e0 | out: hHeap=0x260000) returned 1 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297010 [0040.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0040.589] GetLastError () returned 0x0 [0040.590] GetLastError () returned 0x0 [0040.590] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0040.590] GetLastError () returned 0x0 [0040.590] GetLastError () returned 0x0 [0040.590] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.608] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.609] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.610] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.610] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.670] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.670] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.670] CloseHandle (hObject=0x10c) returned 1 [0040.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.787] GetLastError () returned 0x0 [0040.787] RtlWakeConditionVariable () returned 0x27e828 [0040.787] GetCurrentThreadId () returned 0x998 [0040.787] GetCurrentThreadId () returned 0x998 [0040.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297990 | out: hHeap=0x260000) returned 1 [0040.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0040.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0040.787] lstrlenW (lpString=".ldf") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".ldf") returned 0x0 [0040.788] lstrlenW (lpString=".vhd") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".vhd") returned 0x0 [0040.788] lstrlenW (lpString=".vhdx") returned 5 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".vhdx") returned 0x0 [0040.788] lstrlenW (lpString=".pst") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".pst") returned 0x0 [0040.788] lstrlenW (lpString=".ost") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".ost") returned 0x0 [0040.788] lstrlenW (lpString=".bak") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".bak") returned 0x0 [0040.788] lstrlenW (lpString=".bac") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".bac") returned 0x0 [0040.788] lstrlenW (lpString=".sys") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".sys") returned 0x0 [0040.788] lstrlenW (lpString=".v2i") returned 4 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch=".v2i") returned 0x0 [0040.788] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297990 | out: hHeap=0x260000) returned 1 [0040.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0040.887] RtlWakeConditionVariable () returned 0x27e828 [0040.887] GetCurrentThreadId () returned 0x998 [0040.887] GetCurrentThreadId () returned 0x998 [0040.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0040.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7be0 | out: hHeap=0x260000) returned 1 [0040.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7128 [0040.888] lstrlenW (lpString=".ldf") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.888] lstrlenW (lpString=".vhd") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.888] lstrlenW (lpString=".vhdx") returned 5 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.888] lstrlenW (lpString=".pst") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.888] lstrlenW (lpString=".ost") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.888] lstrlenW (lpString=".bak") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.888] lstrlenW (lpString=".bac") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.888] lstrlenW (lpString=".sys") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.888] lstrlenW (lpString=".v2i") returned 4 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.888] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0040.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.888] RtlWakeConditionVariable () returned 0x27e828 [0040.888] GetCurrentThreadId () returned 0x998 [0040.889] GetCurrentThreadId () returned 0x998 [0040.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f24b8 | out: hHeap=0x260000) returned 1 [0040.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c18 | out: hHeap=0x260000) returned 1 [0040.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f24b8 [0040.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.889] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.889] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.889] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.889] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.890] CloseHandle (hObject=0x10c) returned 1 [0040.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f24b8 | out: hHeap=0x260000) returned 1 [0040.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.890] RtlWakeConditionVariable () returned 0x27e828 [0040.890] GetCurrentThreadId () returned 0x998 [0040.890] GetCurrentThreadId () returned 0x998 [0040.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0040.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0040.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0040.891] lstrlenW (lpString=".ldf") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.891] lstrlenW (lpString=".vhd") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.891] lstrlenW (lpString=".vhdx") returned 5 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.891] lstrlenW (lpString=".pst") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.891] lstrlenW (lpString=".ost") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.891] lstrlenW (lpString=".bak") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.891] lstrlenW (lpString=".bac") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.891] lstrlenW (lpString=".sys") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.891] lstrlenW (lpString=".v2i") returned 4 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.891] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0040.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0040.891] RtlWakeConditionVariable () returned 0x27e828 [0040.891] GetCurrentThreadId () returned 0x998 [0040.891] GetCurrentThreadId () returned 0x998 [0040.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2628 | out: hHeap=0x260000) returned 1 [0040.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0040.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2628 [0040.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.907] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.907] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.907] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.907] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.908] CloseHandle (hObject=0xf0) returned 1 [0040.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2628 | out: hHeap=0x260000) returned 1 [0040.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.908] RtlWakeConditionVariable () returned 0x27e828 [0040.908] GetCurrentThreadId () returned 0x998 [0040.908] GetCurrentThreadId () returned 0x998 [0040.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f26e0 | out: hHeap=0x260000) returned 1 [0040.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d08 | out: hHeap=0x260000) returned 1 [0040.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f26e0 [0040.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.918] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.918] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.918] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.918] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.920] CloseHandle (hObject=0x100) returned 1 [0040.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f26e0 | out: hHeap=0x260000) returned 1 [0040.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.920] RtlWakeConditionVariable () returned 0x27e828 [0040.920] GetCurrentThreadId () returned 0x998 [0040.920] GetCurrentThreadId () returned 0x998 [0040.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2850 | out: hHeap=0x260000) returned 1 [0040.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d50 | out: hHeap=0x260000) returned 1 [0040.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2850 [0040.920] lstrlenW (lpString=".ldf") returned 4 [0040.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".ldf") returned 0x0 [0040.920] lstrlenW (lpString=".vhd") returned 4 [0040.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".vhd") returned 0x0 [0040.921] lstrlenW (lpString=".vhdx") returned 5 [0040.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".vhdx") returned 0x0 [0040.921] lstrlenW (lpString=".pst") returned 4 [0040.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".pst") returned 0x0 [0040.921] lstrlenW (lpString=".ost") returned 4 [0040.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".ost") returned 0x0 [0040.921] lstrlenW (lpString=".bak") returned 4 [0040.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".bak") returned 0x0 [0040.921] lstrlenW (lpString=".bac") returned 4 [0040.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".bac") returned 0x0 [0040.922] lstrlenW (lpString=".sys") returned 4 [0040.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".sys") returned 0x0 [0040.922] lstrlenW (lpString=".v2i") returned 4 [0040.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch=".v2i") returned 0x0 [0040.922] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2850 | out: hHeap=0x260000) returned 1 [0040.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.923] RtlWakeConditionVariable () returned 0x27e828 [0040.923] GetCurrentThreadId () returned 0x998 [0040.923] GetCurrentThreadId () returned 0x998 [0040.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee60 | out: hHeap=0x260000) returned 1 [0040.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d88 | out: hHeap=0x260000) returned 1 [0040.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ee60 [0040.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.924] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.924] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.924] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.924] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.925] CloseHandle (hObject=0x100) returned 1 [0040.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee60 | out: hHeap=0x260000) returned 1 [0040.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.925] RtlWakeConditionVariable () returned 0x27e828 [0040.925] GetCurrentThreadId () returned 0x998 [0040.925] GetCurrentThreadId () returned 0x998 [0040.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f71d0 [0040.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f73c8 | out: hHeap=0x260000) returned 1 [0040.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7dc0 | out: hHeap=0x260000) returned 1 [0040.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f73c8 [0040.925] lstrlenW (lpString=".ldf") returned 4 [0040.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".ldf") returned 0x0 [0040.925] lstrlenW (lpString=".vhd") returned 4 [0040.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".vhd") returned 0x0 [0040.925] lstrlenW (lpString=".vhdx") returned 5 [0040.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".vhdx") returned 0x0 [0040.925] lstrlenW (lpString=".pst") returned 4 [0040.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".pst") returned 0x0 [0040.925] lstrlenW (lpString=".ost") returned 4 [0040.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".ost") returned 0x0 [0040.925] lstrlenW (lpString=".bak") returned 4 [0040.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".bak") returned 0x0 [0040.926] lstrlenW (lpString=".bac") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".bac") returned 0x0 [0040.926] lstrlenW (lpString=".sys") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".sys") returned 0x0 [0040.926] lstrlenW (lpString=".v2i") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch=".v2i") returned 0x0 [0040.926] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f73c8 | out: hHeap=0x260000) returned 1 [0040.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f71d0 | out: hHeap=0x260000) returned 1 [0040.926] RtlWakeConditionVariable () returned 0x27e828 [0040.926] GetCurrentThreadId () returned 0x998 [0040.926] GetCurrentThreadId () returned 0x998 [0040.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2908 | out: hHeap=0x260000) returned 1 [0040.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7df8 | out: hHeap=0x260000) returned 1 [0040.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0040.926] lstrlenW (lpString=".ldf") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".ldf") returned 0x0 [0040.926] lstrlenW (lpString=".vhd") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".vhd") returned 0x0 [0040.926] lstrlenW (lpString=".vhdx") returned 5 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".vhdx") returned 0x0 [0040.926] lstrlenW (lpString=".pst") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".pst") returned 0x0 [0040.926] lstrlenW (lpString=".ost") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".ost") returned 0x0 [0040.926] lstrlenW (lpString=".bak") returned 4 [0040.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".bak") returned 0x0 [0040.927] lstrlenW (lpString=".bac") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".bac") returned 0x0 [0040.927] lstrlenW (lpString=".sys") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".sys") returned 0x0 [0040.927] lstrlenW (lpString=".v2i") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch=".v2i") returned 0x0 [0040.927] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2908 | out: hHeap=0x260000) returned 1 [0040.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.927] RtlWakeConditionVariable () returned 0x27e828 [0040.927] GetCurrentThreadId () returned 0x998 [0040.927] GetCurrentThreadId () returned 0x998 [0040.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da088 | out: hHeap=0x260000) returned 1 [0040.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e30 | out: hHeap=0x260000) returned 1 [0040.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da088 [0040.927] lstrlenW (lpString=".ldf") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".ldf") returned 0x0 [0040.927] lstrlenW (lpString=".vhd") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".vhd") returned 0x0 [0040.927] lstrlenW (lpString=".vhdx") returned 5 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".vhdx") returned 0x0 [0040.927] lstrlenW (lpString=".pst") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".pst") returned 0x0 [0040.927] lstrlenW (lpString=".ost") returned 4 [0040.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".ost") returned 0x0 [0040.927] lstrlenW (lpString=".bak") returned 4 [0040.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".bak") returned 0x0 [0040.928] lstrlenW (lpString=".bac") returned 4 [0040.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".bac") returned 0x0 [0040.928] lstrlenW (lpString=".sys") returned 4 [0040.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".sys") returned 0x0 [0040.928] lstrlenW (lpString=".v2i") returned 4 [0040.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch=".v2i") returned 0x0 [0040.928] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da088 | out: hHeap=0x260000) returned 1 [0040.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.929] RtlWakeConditionVariable () returned 0x27e828 [0040.929] GetCurrentThreadId () returned 0x998 [0040.929] GetCurrentThreadId () returned 0x998 [0040.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f29c0 | out: hHeap=0x260000) returned 1 [0040.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e68 | out: hHeap=0x260000) returned 1 [0040.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f29c0 [0040.929] lstrlenW (lpString=".ldf") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".ldf") returned 0x0 [0040.929] lstrlenW (lpString=".vhd") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".vhd") returned 0x0 [0040.929] lstrlenW (lpString=".vhdx") returned 5 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".vhdx") returned 0x0 [0040.929] lstrlenW (lpString=".pst") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".pst") returned 0x0 [0040.929] lstrlenW (lpString=".ost") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".ost") returned 0x0 [0040.929] lstrlenW (lpString=".bak") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".bak") returned 0x0 [0040.929] lstrlenW (lpString=".bac") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".bac") returned 0x0 [0040.929] lstrlenW (lpString=".sys") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".sys") returned 0x0 [0040.929] lstrlenW (lpString=".v2i") returned 4 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch=".v2i") returned 0x0 [0040.929] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f29c0 | out: hHeap=0x260000) returned 1 [0040.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.930] RtlWakeConditionVariable () returned 0x27e828 [0040.930] GetCurrentThreadId () returned 0x998 [0040.930] GetCurrentThreadId () returned 0x998 [0040.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef38 | out: hHeap=0x260000) returned 1 [0040.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ea0 | out: hHeap=0x260000) returned 1 [0040.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ef38 [0040.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.931] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.931] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.931] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.931] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.932] CloseHandle (hObject=0x100) returned 1 [0040.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef38 | out: hHeap=0x260000) returned 1 [0040.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.932] RtlWakeConditionVariable () returned 0x27e828 [0040.932] GetCurrentThreadId () returned 0x998 [0040.932] GetCurrentThreadId () returned 0x998 [0040.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f71d0 [0040.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7470 | out: hHeap=0x260000) returned 1 [0040.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ed8 | out: hHeap=0x260000) returned 1 [0040.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7470 [0040.932] lstrlenW (lpString=".ldf") returned 4 [0040.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".ldf") returned 0x0 [0040.932] lstrlenW (lpString=".vhd") returned 4 [0040.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".vhd") returned 0x0 [0040.932] lstrlenW (lpString=".vhdx") returned 5 [0040.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".vhdx") returned 0x0 [0040.932] lstrlenW (lpString=".pst") returned 4 [0040.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".pst") returned 0x0 [0040.932] lstrlenW (lpString=".ost") returned 4 [0040.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".ost") returned 0x0 [0040.932] lstrlenW (lpString=".bak") returned 4 [0040.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".bak") returned 0x0 [0040.932] lstrlenW (lpString=".bac") returned 4 [0040.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".bac") returned 0x0 [0040.933] lstrlenW (lpString=".sys") returned 4 [0040.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".sys") returned 0x0 [0040.933] lstrlenW (lpString=".v2i") returned 4 [0040.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch=".v2i") returned 0x0 [0040.933] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7470 | out: hHeap=0x260000) returned 1 [0040.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f71d0 | out: hHeap=0x260000) returned 1 [0040.933] RtlWakeConditionVariable () returned 0x27e828 [0040.933] GetCurrentThreadId () returned 0x998 [0040.933] GetCurrentThreadId () returned 0x998 [0040.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2a78 | out: hHeap=0x260000) returned 1 [0040.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f10 | out: hHeap=0x260000) returned 1 [0040.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2a78 [0040.934] lstrlenW (lpString=".ldf") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".ldf") returned 0x0 [0040.934] lstrlenW (lpString=".vhd") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".vhd") returned 0x0 [0040.934] lstrlenW (lpString=".vhdx") returned 5 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".vhdx") returned 0x0 [0040.934] lstrlenW (lpString=".pst") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".pst") returned 0x0 [0040.934] lstrlenW (lpString=".ost") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".ost") returned 0x0 [0040.934] lstrlenW (lpString=".bak") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".bak") returned 0x0 [0040.934] lstrlenW (lpString=".bac") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".bac") returned 0x0 [0040.934] lstrlenW (lpString=".sys") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".sys") returned 0x0 [0040.934] lstrlenW (lpString=".v2i") returned 4 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch=".v2i") returned 0x0 [0040.934] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2a78 | out: hHeap=0x260000) returned 1 [0040.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.981] RtlWakeConditionVariable () returned 0x27e828 [0040.981] GetCurrentThreadId () returned 0x998 [0040.981] GetCurrentThreadId () returned 0x998 [0040.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0040.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da6c8 | out: hHeap=0x260000) returned 1 [0040.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0040.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da6c8 [0040.981] lstrlenW (lpString=".ldf") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".ldf") returned 0x0 [0040.981] lstrlenW (lpString=".vhd") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".vhd") returned 0x0 [0040.981] lstrlenW (lpString=".vhdx") returned 5 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".vhdx") returned 0x0 [0040.981] lstrlenW (lpString=".pst") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".pst") returned 0x0 [0040.981] lstrlenW (lpString=".ost") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".ost") returned 0x0 [0040.981] lstrlenW (lpString=".bak") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".bak") returned 0x0 [0040.981] lstrlenW (lpString=".bac") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".bac") returned 0x0 [0040.981] lstrlenW (lpString=".sys") returned 4 [0040.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".sys") returned 0x0 [0040.982] lstrlenW (lpString=".v2i") returned 4 [0040.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch=".v2i") returned 0x0 [0040.982] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da6c8 | out: hHeap=0x260000) returned 1 [0040.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0040.995] RtlWakeConditionVariable () returned 0x27e828 [0040.995] GetCurrentThreadId () returned 0x998 [0040.995] GetCurrentThreadId () returned 0x998 [0040.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0040.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8300 | out: hHeap=0x260000) returned 1 [0040.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0040.995] lstrlenW (lpString=".ldf") returned 4 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".ldf") returned 0x0 [0040.995] lstrlenW (lpString=".vhd") returned 4 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".vhd") returned 0x0 [0040.995] lstrlenW (lpString=".vhdx") returned 5 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".vhdx") returned 0x0 [0040.995] lstrlenW (lpString=".pst") returned 4 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".pst") returned 0x0 [0040.995] lstrlenW (lpString=".ost") returned 4 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".ost") returned 0x0 [0040.995] lstrlenW (lpString=".bak") returned 4 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".bak") returned 0x0 [0040.995] lstrlenW (lpString=".bac") returned 4 [0040.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".bac") returned 0x0 [0040.995] lstrlenW (lpString=".sys") returned 4 [0040.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".sys") returned 0x0 [0040.996] lstrlenW (lpString=".v2i") returned 4 [0040.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch=".v2i") returned 0x0 [0040.996] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0041.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0041.009] RtlWakeConditionVariable () returned 0x27e828 [0041.009] GetCurrentThreadId () returned 0x998 [0041.010] GetCurrentThreadId () returned 0x998 [0041.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0041.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2570 | out: hHeap=0x260000) returned 1 [0041.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d83e0 | out: hHeap=0x260000) returned 1 [0041.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0041.010] lstrlenW (lpString=".ldf") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".ldf") returned 0x0 [0041.010] lstrlenW (lpString=".vhd") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".vhd") returned 0x0 [0041.010] lstrlenW (lpString=".vhdx") returned 5 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".vhdx") returned 0x0 [0041.010] lstrlenW (lpString=".pst") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".pst") returned 0x0 [0041.010] lstrlenW (lpString=".ost") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".ost") returned 0x0 [0041.010] lstrlenW (lpString=".bak") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".bak") returned 0x0 [0041.010] lstrlenW (lpString=".bac") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".bac") returned 0x0 [0041.010] lstrlenW (lpString=".sys") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".sys") returned 0x0 [0041.010] lstrlenW (lpString=".v2i") returned 4 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch=".v2i") returned 0x0 [0041.010] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2570 | out: hHeap=0x260000) returned 1 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0041.026] RtlWakeConditionVariable () returned 0x27e828 [0041.026] GetCurrentThreadId () returned 0x998 [0041.026] GetCurrentThreadId () returned 0x998 [0041.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0041.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0041.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0041.027] lstrlenW (lpString=".ldf") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".ldf") returned 0x0 [0041.027] lstrlenW (lpString=".vhd") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".vhd") returned 0x0 [0041.027] lstrlenW (lpString=".vhdx") returned 5 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".vhdx") returned 0x0 [0041.027] lstrlenW (lpString=".pst") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".pst") returned 0x0 [0041.027] lstrlenW (lpString=".ost") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".ost") returned 0x0 [0041.027] lstrlenW (lpString=".bak") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".bak") returned 0x0 [0041.027] lstrlenW (lpString=".bac") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".bac") returned 0x0 [0041.027] lstrlenW (lpString=".sys") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".sys") returned 0x0 [0041.027] lstrlenW (lpString=".v2i") returned 4 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch=".v2i") returned 0x0 [0041.027] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0041.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.033] RtlWakeConditionVariable () returned 0x27e828 [0041.033] GetCurrentThreadId () returned 0x998 [0041.034] GetCurrentThreadId () returned 0x998 [0041.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f75c0 | out: hHeap=0x260000) returned 1 [0041.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ba0 | out: hHeap=0x260000) returned 1 [0041.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.034] lstrlenW (lpString=".ldf") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.034] lstrlenW (lpString=".vhd") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.034] lstrlenW (lpString=".vhdx") returned 5 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.034] lstrlenW (lpString=".pst") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.034] lstrlenW (lpString=".ost") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.034] lstrlenW (lpString=".bak") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.034] lstrlenW (lpString=".bac") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.034] lstrlenW (lpString=".sys") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.034] lstrlenW (lpString=".v2i") returned 4 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.034] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f75c0 | out: hHeap=0x260000) returned 1 [0041.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.035] RtlWakeConditionVariable () returned 0x27e828 [0041.035] GetCurrentThreadId () returned 0x998 [0041.035] GetCurrentThreadId () returned 0x998 [0041.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3318 | out: hHeap=0x260000) returned 1 [0041.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337bd8 | out: hHeap=0x260000) returned 1 [0041.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3318 [0041.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.035] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.035] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.036] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.036] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.037] CloseHandle (hObject=0x100) returned 1 [0041.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3318 | out: hHeap=0x260000) returned 1 [0041.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.037] RtlWakeConditionVariable () returned 0x27e828 [0041.037] GetCurrentThreadId () returned 0x998 [0041.037] GetCurrentThreadId () returned 0x998 [0041.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7668 | out: hHeap=0x260000) returned 1 [0041.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c10 | out: hHeap=0x260000) returned 1 [0041.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7668 [0041.037] lstrlenW (lpString=".ldf") returned 4 [0041.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.037] lstrlenW (lpString=".vhd") returned 4 [0041.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.037] lstrlenW (lpString=".vhdx") returned 5 [0041.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.038] lstrlenW (lpString=".pst") returned 4 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.038] lstrlenW (lpString=".ost") returned 4 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.038] lstrlenW (lpString=".bak") returned 4 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.038] lstrlenW (lpString=".bac") returned 4 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.038] lstrlenW (lpString=".sys") returned 4 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.038] lstrlenW (lpString=".v2i") returned 4 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.038] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7668 | out: hHeap=0x260000) returned 1 [0041.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.038] RtlWakeConditionVariable () returned 0x27e828 [0041.038] GetCurrentThreadId () returned 0x998 [0041.038] GetCurrentThreadId () returned 0x998 [0041.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f33d0 | out: hHeap=0x260000) returned 1 [0041.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c48 | out: hHeap=0x260000) returned 1 [0041.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f33d0 [0041.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.047] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.047] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.047] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.047] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.048] CloseHandle (hObject=0x100) returned 1 [0041.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f33d0 | out: hHeap=0x260000) returned 1 [0041.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.048] RtlWakeConditionVariable () returned 0x27e828 [0041.048] GetCurrentThreadId () returned 0x998 [0041.048] GetCurrentThreadId () returned 0x998 [0041.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296008 | out: hHeap=0x260000) returned 1 [0041.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d60 | out: hHeap=0x260000) returned 1 [0041.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296008 [0041.048] lstrlenW (lpString=".ldf") returned 4 [0041.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".ldf") returned 0x0 [0041.048] lstrlenW (lpString=".vhd") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".vhd") returned 0x0 [0041.049] lstrlenW (lpString=".vhdx") returned 5 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".vhdx") returned 0x0 [0041.049] lstrlenW (lpString=".pst") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".pst") returned 0x0 [0041.049] lstrlenW (lpString=".ost") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".ost") returned 0x0 [0041.049] lstrlenW (lpString=".bak") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".bak") returned 0x0 [0041.049] lstrlenW (lpString=".bac") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".bac") returned 0x0 [0041.049] lstrlenW (lpString=".sys") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".sys") returned 0x0 [0041.049] lstrlenW (lpString=".v2i") returned 4 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch=".v2i") returned 0x0 [0041.049] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296008 | out: hHeap=0x260000) returned 1 [0041.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.114] RtlWakeConditionVariable () returned 0x27e828 [0041.114] GetCurrentThreadId () returned 0x998 [0041.114] GetCurrentThreadId () returned 0x998 [0041.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9b80 | out: hHeap=0x260000) returned 1 [0041.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe78 | out: hHeap=0x260000) returned 1 [0041.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9b80 [0041.114] lstrlenW (lpString=".ldf") returned 4 [0041.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".ldf") returned 0x0 [0041.114] lstrlenW (lpString=".vhd") returned 4 [0041.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".vhd") returned 0x0 [0041.114] lstrlenW (lpString=".vhdx") returned 5 [0041.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".vhdx") returned 0x0 [0041.114] lstrlenW (lpString=".pst") returned 4 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".pst") returned 0x0 [0041.115] lstrlenW (lpString=".ost") returned 4 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".ost") returned 0x0 [0041.115] lstrlenW (lpString=".bak") returned 4 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".bak") returned 0x0 [0041.115] lstrlenW (lpString=".bac") returned 4 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".bac") returned 0x0 [0041.115] lstrlenW (lpString=".sys") returned 4 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".sys") returned 0x0 [0041.115] lstrlenW (lpString=".v2i") returned 4 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch=".v2i") returned 0x0 [0041.115] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9b80 | out: hHeap=0x260000) returned 1 [0041.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.127] RtlWakeConditionVariable () returned 0x27e828 [0041.127] GetCurrentThreadId () returned 0x998 [0041.127] GetCurrentThreadId () returned 0x998 [0041.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9de0 | out: hHeap=0x260000) returned 1 [0041.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff58 | out: hHeap=0x260000) returned 1 [0041.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9de0 [0041.127] lstrlenW (lpString=".ldf") returned 4 [0041.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".ldf") returned 0x0 [0041.127] lstrlenW (lpString=".vhd") returned 4 [0041.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".vhd") returned 0x0 [0041.127] lstrlenW (lpString=".vhdx") returned 5 [0041.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".vhdx") returned 0x0 [0041.127] lstrlenW (lpString=".pst") returned 4 [0041.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".pst") returned 0x0 [0041.127] lstrlenW (lpString=".ost") returned 4 [0041.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".ost") returned 0x0 [0041.127] lstrlenW (lpString=".bak") returned 4 [0041.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".bak") returned 0x0 [0041.127] lstrlenW (lpString=".bac") returned 4 [0041.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".bac") returned 0x0 [0041.128] lstrlenW (lpString=".sys") returned 4 [0041.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".sys") returned 0x0 [0041.128] lstrlenW (lpString=".v2i") returned 4 [0041.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch=".v2i") returned 0x0 [0041.128] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9de0 | out: hHeap=0x260000) returned 1 [0041.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2968f0 | out: hHeap=0x260000) returned 1 [0041.139] RtlWakeConditionVariable () returned 0x27e828 [0041.139] GetCurrentThreadId () returned 0x998 [0041.139] GetCurrentThreadId () returned 0x998 [0041.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0041.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0041.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0041.139] lstrlenW (lpString=".ldf") returned 4 [0041.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.139] lstrlenW (lpString=".vhd") returned 4 [0041.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.139] lstrlenW (lpString=".vhdx") returned 5 [0041.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.139] lstrlenW (lpString=".pst") returned 4 [0041.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.139] lstrlenW (lpString=".ost") returned 4 [0041.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.139] lstrlenW (lpString=".bak") returned 4 [0041.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.140] lstrlenW (lpString=".bac") returned 4 [0041.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.140] lstrlenW (lpString=".sys") returned 4 [0041.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.140] lstrlenW (lpString=".v2i") returned 4 [0041.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.140] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0041.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.180] RtlWakeConditionVariable () returned 0x27e828 [0041.180] GetCurrentThreadId () returned 0x998 [0041.180] GetCurrentThreadId () returned 0x998 [0041.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3b00 | out: hHeap=0x260000) returned 1 [0041.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb58 | out: hHeap=0x260000) returned 1 [0041.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0041.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.252] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.252] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.252] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.252] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.253] CloseHandle (hObject=0x10c) returned 1 [0041.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3b00 | out: hHeap=0x260000) returned 1 [0041.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.253] RtlWakeConditionVariable () returned 0x27e828 [0041.253] GetCurrentThreadId () returned 0x998 [0041.253] GetCurrentThreadId () returned 0x998 [0041.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0041.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce68 | out: hHeap=0x260000) returned 1 [0041.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.253] lstrlenW (lpString=".ldf") returned 4 [0041.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".ldf") returned 0x0 [0041.253] lstrlenW (lpString=".vhd") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".vhd") returned 0x0 [0041.254] lstrlenW (lpString=".vhdx") returned 5 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".vhdx") returned 0x0 [0041.254] lstrlenW (lpString=".pst") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".pst") returned 0x0 [0041.254] lstrlenW (lpString=".ost") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".ost") returned 0x0 [0041.254] lstrlenW (lpString=".bak") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".bak") returned 0x0 [0041.254] lstrlenW (lpString=".bac") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".bac") returned 0x0 [0041.254] lstrlenW (lpString=".sys") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".sys") returned 0x0 [0041.254] lstrlenW (lpString=".v2i") returned 4 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch=".v2i") returned 0x0 [0041.254] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", lpSrch="s\r\n.v2i") returned 0x0 [0041.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295d10 | out: hHeap=0x260000) returned 1 [0041.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296138 | out: hHeap=0x260000) returned 1 [0041.254] RtlWakeConditionVariable () returned 0x27e828 [0041.254] GetCurrentThreadId () returned 0x998 [0041.254] GetCurrentThreadId () returned 0x998 [0041.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4008 | out: hHeap=0x260000) returned 1 [0041.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cea0 | out: hHeap=0x260000) returned 1 [0041.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f4008 [0041.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.255] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.255] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.255] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.255] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.256] CloseHandle (hObject=0x10c) returned 1 [0041.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4008 | out: hHeap=0x260000) returned 1 [0041.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.257] RtlWakeConditionVariable () returned 0x27e828 [0041.257] GetCurrentThreadId () returned 0x998 [0041.257] GetCurrentThreadId () returned 0x998 [0041.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d808 | out: hHeap=0x260000) returned 1 [0041.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0041.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0041.257] lstrlenW (lpString=".ldf") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".ldf") returned 0x0 [0041.257] lstrlenW (lpString=".vhd") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".vhd") returned 0x0 [0041.257] lstrlenW (lpString=".vhdx") returned 5 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".vhdx") returned 0x0 [0041.257] lstrlenW (lpString=".pst") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".pst") returned 0x0 [0041.257] lstrlenW (lpString=".ost") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".ost") returned 0x0 [0041.257] lstrlenW (lpString=".bak") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".bak") returned 0x0 [0041.257] lstrlenW (lpString=".bac") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".bac") returned 0x0 [0041.257] lstrlenW (lpString=".sys") returned 4 [0041.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".sys") returned 0x0 [0041.258] lstrlenW (lpString=".v2i") returned 4 [0041.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".v2i") returned 0x0 [0041.258] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.259] lstrlenW (lpString=".sql") returned 4 [0041.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".sql") returned 0x0 [0041.259] lstrlenW (lpString=".mdf") returned 4 [0041.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".mdf") returned 0x0 [0041.259] lstrlenW (lpString=".txt") returned 4 [0041.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".txt") returned 0x0 [0041.259] lstrlenW (lpString=".dbf") returned 4 [0041.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".dbf") returned 0x0 [0041.259] lstrlenW (lpString=".ckp") returned 4 [0041.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".ckp") returned 0x0 [0041.259] lstrlenW (lpString=".dacpac") returned 7 [0041.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".dacpac") returned 0x0 [0041.259] lstrlenW (lpString=".db3") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".db3") returned 0x0 [0041.260] lstrlenW (lpString=".dtxs") returned 5 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".dtxs") returned 0x0 [0041.260] lstrlenW (lpString=".mdt") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".mdt") returned 0x0 [0041.260] lstrlenW (lpString=".sdf") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".sdf") returned 0x0 [0041.260] lstrlenW (lpString=".MDF") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".MDF") returned 0x0 [0041.260] lstrlenW (lpString=".DBF") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".DBF") returned 0x0 [0041.260] lstrlenW (lpString=".DB") returned 3 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".DB") returned 0x0 [0041.260] lstrlenW (lpString=".db") returned 3 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".db") returned 0x0 [0041.260] lstrlenW (lpString=".ndf") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".ndf") returned 0x0 [0041.260] lstrlenW (lpString=".NDF") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".NDF") returned 0x0 [0041.260] lstrlenW (lpString=".Mdf") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".Mdf") returned 0x0 [0041.260] lstrlenW (lpString=".dat") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".dat") returned 0x0 [0041.260] lstrlenW (lpString=".DAT") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".DAT") returned 0x0 [0041.260] lstrlenW (lpString=".ldf") returned 4 [0041.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".ldf") returned 0x0 [0041.261] lstrlenW (lpString=".LDF") returned 4 [0041.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch=".LDF") returned 0x0 [0041.261] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.261] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.262] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.262] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.262] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16126336888) returned 1 [0041.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7694070, dwHighDateTime=0x1d585b4)) [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ced8 [0041.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0041.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0041.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.263] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.263] GetLastError () returned 0x0 [0041.263] GetLastError () returned 0x0 [0041.263] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.263] GetLastError () returned 0x0 [0041.263] GetLastError () returned 0x0 [0041.263] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.266] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.267] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.267] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.267] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.267] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.267] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.267] CloseHandle (hObject=0x10c) returned 1 [0041.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.268] GetLastError () returned 0x0 [0041.268] RtlWakeConditionVariable () returned 0x27e828 [0041.268] GetCurrentThreadId () returned 0x998 [0041.268] GetCurrentThreadId () returned 0x998 [0041.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0041.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0041.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0041.269] lstrlenW (lpString=".ldf") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".ldf") returned 0x0 [0041.269] lstrlenW (lpString=".vhd") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".vhd") returned 0x0 [0041.269] lstrlenW (lpString=".vhdx") returned 5 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".vhdx") returned 0x0 [0041.269] lstrlenW (lpString=".pst") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".pst") returned 0x0 [0041.269] lstrlenW (lpString=".ost") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".ost") returned 0x0 [0041.269] lstrlenW (lpString=".bak") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".bak") returned 0x0 [0041.269] lstrlenW (lpString=".bac") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".bac") returned 0x0 [0041.269] lstrlenW (lpString=".sys") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".sys") returned 0x0 [0041.269] lstrlenW (lpString=".v2i") returned 4 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".v2i") returned 0x0 [0041.269] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.270] lstrlenW (lpString=".sql") returned 4 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".sql") returned 0x0 [0041.270] lstrlenW (lpString=".mdf") returned 4 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".mdf") returned 0x0 [0041.270] lstrlenW (lpString=".txt") returned 4 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".txt") returned 0x0 [0041.270] lstrlenW (lpString=".dbf") returned 4 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".dbf") returned 0x0 [0041.270] lstrlenW (lpString=".ckp") returned 4 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".ckp") returned 0x0 [0041.270] lstrlenW (lpString=".dacpac") returned 7 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".dacpac") returned 0x0 [0041.270] lstrlenW (lpString=".db3") returned 4 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".db3") returned 0x0 [0041.270] lstrlenW (lpString=".dtxs") returned 5 [0041.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".dtxs") returned 0x0 [0041.270] lstrlenW (lpString=".mdt") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".mdt") returned 0x0 [0041.271] lstrlenW (lpString=".sdf") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".sdf") returned 0x0 [0041.271] lstrlenW (lpString=".MDF") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".MDF") returned 0x0 [0041.271] lstrlenW (lpString=".DBF") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".DBF") returned 0x0 [0041.271] lstrlenW (lpString=".DB") returned 3 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".DB") returned 0x0 [0041.271] lstrlenW (lpString=".db") returned 3 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".db") returned 0x0 [0041.271] lstrlenW (lpString=".ndf") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".ndf") returned 0x0 [0041.271] lstrlenW (lpString=".NDF") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".NDF") returned 0x0 [0041.271] lstrlenW (lpString=".Mdf") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".Mdf") returned 0x0 [0041.271] lstrlenW (lpString=".dat") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".dat") returned 0x0 [0041.271] lstrlenW (lpString=".DAT") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".DAT") returned 0x0 [0041.271] lstrlenW (lpString=".ldf") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".ldf") returned 0x0 [0041.271] lstrlenW (lpString=".LDF") returned 4 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch=".LDF") returned 0x0 [0041.271] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.272] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.273] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.273] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.273] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16127387707) returned 1 [0041.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7694070, dwHighDateTime=0x1d585b4)) [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf10 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d808 [0041.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d808 | out: hHeap=0x260000) returned 1 [0041.273] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.273] GetLastError () returned 0x0 [0041.274] GetLastError () returned 0x0 [0041.274] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.274] GetLastError () returned 0x0 [0041.274] GetLastError () returned 0x0 [0041.274] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0xcdb0, lpOverlapped=0x0) returned 1 [0041.276] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff3250, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.276] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xcdb0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xcdb0, lpOverlapped=0x0) returned 1 [0041.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.277] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.277] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.277] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.277] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.277] CloseHandle (hObject=0x10c) returned 1 [0041.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.278] GetLastError () returned 0x0 [0041.278] RtlWakeConditionVariable () returned 0x27e828 [0041.278] GetCurrentThreadId () returned 0x998 [0041.278] GetCurrentThreadId () returned 0x998 [0041.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d958 | out: hHeap=0x260000) returned 1 [0041.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf48 | out: hHeap=0x260000) returned 1 [0041.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d958 [0041.279] lstrlenW (lpString=".ldf") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".ldf") returned 0x0 [0041.279] lstrlenW (lpString=".vhd") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".vhd") returned 0x0 [0041.279] lstrlenW (lpString=".vhdx") returned 5 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".vhdx") returned 0x0 [0041.279] lstrlenW (lpString=".pst") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".pst") returned 0x0 [0041.279] lstrlenW (lpString=".ost") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".ost") returned 0x0 [0041.279] lstrlenW (lpString=".bak") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".bak") returned 0x0 [0041.279] lstrlenW (lpString=".bac") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".bac") returned 0x0 [0041.279] lstrlenW (lpString=".sys") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".sys") returned 0x0 [0041.279] lstrlenW (lpString=".v2i") returned 4 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".v2i") returned 0x0 [0041.279] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.280] lstrlenW (lpString=".sql") returned 4 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".sql") returned 0x0 [0041.280] lstrlenW (lpString=".mdf") returned 4 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".mdf") returned 0x0 [0041.280] lstrlenW (lpString=".txt") returned 4 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".txt") returned 0x0 [0041.280] lstrlenW (lpString=".dbf") returned 4 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".dbf") returned 0x0 [0041.280] lstrlenW (lpString=".ckp") returned 4 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".ckp") returned 0x0 [0041.280] lstrlenW (lpString=".dacpac") returned 7 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".dacpac") returned 0x0 [0041.280] lstrlenW (lpString=".db3") returned 4 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".db3") returned 0x0 [0041.280] lstrlenW (lpString=".dtxs") returned 5 [0041.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".dtxs") returned 0x0 [0041.280] lstrlenW (lpString=".mdt") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".mdt") returned 0x0 [0041.281] lstrlenW (lpString=".sdf") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".sdf") returned 0x0 [0041.281] lstrlenW (lpString=".MDF") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".MDF") returned 0x0 [0041.281] lstrlenW (lpString=".DBF") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".DBF") returned 0x0 [0041.281] lstrlenW (lpString=".DB") returned 3 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".DB") returned 0x0 [0041.281] lstrlenW (lpString=".db") returned 3 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".db") returned 0x0 [0041.281] lstrlenW (lpString=".ndf") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".ndf") returned 0x0 [0041.281] lstrlenW (lpString=".NDF") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".NDF") returned 0x0 [0041.281] lstrlenW (lpString=".Mdf") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".Mdf") returned 0x0 [0041.281] lstrlenW (lpString=".dat") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".dat") returned 0x0 [0041.281] lstrlenW (lpString=".DAT") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".DAT") returned 0x0 [0041.281] lstrlenW (lpString=".ldf") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".ldf") returned 0x0 [0041.281] lstrlenW (lpString=".LDF") returned 4 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch=".LDF") returned 0x0 [0041.281] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.282] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.283] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.283] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.283] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16128387133) returned 1 [0041.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa76ba1d0, dwHighDateTime=0x1d585b4)) [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf48 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf48 | out: hHeap=0x260000) returned 1 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d568 [0041.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0041.283] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.283] GetLastError () returned 0x0 [0041.284] GetLastError () returned 0x0 [0041.284] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.284] GetLastError () returned 0x0 [0041.284] GetLastError () returned 0x0 [0041.284] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x51d0, lpOverlapped=0x0) returned 1 [0041.364] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffae30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.364] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x51d0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x51d0, lpOverlapped=0x0) returned 1 [0041.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.366] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.366] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.366] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.366] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.366] CloseHandle (hObject=0x10c) returned 1 [0041.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.367] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.386] GetLastError () returned 0x0 [0041.387] RtlWakeConditionVariable () returned 0x27e828 [0041.387] GetCurrentThreadId () returned 0x998 [0041.387] GetCurrentThreadId () returned 0x998 [0041.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e810 | out: hHeap=0x260000) returned 1 [0041.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d108 | out: hHeap=0x260000) returned 1 [0041.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e810 [0041.387] lstrlenW (lpString=".ldf") returned 4 [0041.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".ldf") returned 0x0 [0041.387] lstrlenW (lpString=".vhd") returned 4 [0041.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".vhd") returned 0x0 [0041.387] lstrlenW (lpString=".vhdx") returned 5 [0041.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".vhdx") returned 0x0 [0041.388] lstrlenW (lpString=".pst") returned 4 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".pst") returned 0x0 [0041.388] lstrlenW (lpString=".ost") returned 4 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".ost") returned 0x0 [0041.388] lstrlenW (lpString=".bak") returned 4 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".bak") returned 0x0 [0041.388] lstrlenW (lpString=".bac") returned 4 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".bac") returned 0x0 [0041.388] lstrlenW (lpString=".sys") returned 4 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".sys") returned 0x0 [0041.388] lstrlenW (lpString=".v2i") returned 4 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".v2i") returned 0x0 [0041.388] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.389] lstrlenW (lpString=".sql") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".sql") returned 0x0 [0041.389] lstrlenW (lpString=".mdf") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".mdf") returned 0x0 [0041.389] lstrlenW (lpString=".txt") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".txt") returned 0x0 [0041.389] lstrlenW (lpString=".dbf") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".dbf") returned 0x0 [0041.389] lstrlenW (lpString=".ckp") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".ckp") returned 0x0 [0041.389] lstrlenW (lpString=".dacpac") returned 7 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".dacpac") returned 0x0 [0041.389] lstrlenW (lpString=".db3") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".db3") returned 0x0 [0041.389] lstrlenW (lpString=".dtxs") returned 5 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".dtxs") returned 0x0 [0041.389] lstrlenW (lpString=".mdt") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".mdt") returned 0x0 [0041.389] lstrlenW (lpString=".sdf") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".sdf") returned 0x0 [0041.389] lstrlenW (lpString=".MDF") returned 4 [0041.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".MDF") returned 0x0 [0041.390] lstrlenW (lpString=".DBF") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".DBF") returned 0x0 [0041.390] lstrlenW (lpString=".DB") returned 3 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".DB") returned 0x0 [0041.390] lstrlenW (lpString=".db") returned 3 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".db") returned 0x0 [0041.390] lstrlenW (lpString=".ndf") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".ndf") returned 0x0 [0041.390] lstrlenW (lpString=".NDF") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".NDF") returned 0x0 [0041.390] lstrlenW (lpString=".Mdf") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".Mdf") returned 0x0 [0041.390] lstrlenW (lpString=".dat") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".dat") returned 0x0 [0041.390] lstrlenW (lpString=".DAT") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".DAT") returned 0x0 [0041.390] lstrlenW (lpString=".ldf") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".ldf") returned 0x0 [0041.390] lstrlenW (lpString=".LDF") returned 4 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch=".LDF") returned 0x0 [0041.390] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.390] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.391] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.391] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.392] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16139269032) returned 1 [0041.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa77c4b70, dwHighDateTime=0x1d585b4)) [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d108 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d108 | out: hHeap=0x260000) returned 1 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e618 [0041.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e618 | out: hHeap=0x260000) returned 1 [0041.392] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.392] GetLastError () returned 0x0 [0041.392] GetLastError () returned 0x0 [0041.393] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.393] GetLastError () returned 0x0 [0041.393] GetLastError () returned 0x0 [0041.393] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x2d88, lpOverlapped=0x0) returned 1 [0041.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd278, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.396] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x2d88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x2d88, lpOverlapped=0x0) returned 1 [0041.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.396] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.396] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.396] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.397] CloseHandle (hObject=0x10c) returned 1 [0041.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.398] GetLastError () returned 0x0 [0041.398] RtlWakeConditionVariable () returned 0x27e828 [0041.398] GetCurrentThreadId () returned 0x998 [0041.398] GetCurrentThreadId () returned 0x998 [0041.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e8b8 | out: hHeap=0x260000) returned 1 [0041.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d140 | out: hHeap=0x260000) returned 1 [0041.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e8b8 [0041.398] lstrlenW (lpString=".ldf") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".ldf") returned 0x0 [0041.398] lstrlenW (lpString=".vhd") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".vhd") returned 0x0 [0041.398] lstrlenW (lpString=".vhdx") returned 5 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".vhdx") returned 0x0 [0041.398] lstrlenW (lpString=".pst") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".pst") returned 0x0 [0041.398] lstrlenW (lpString=".ost") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".ost") returned 0x0 [0041.398] lstrlenW (lpString=".bak") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".bak") returned 0x0 [0041.398] lstrlenW (lpString=".bac") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".bac") returned 0x0 [0041.398] lstrlenW (lpString=".sys") returned 4 [0041.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".sys") returned 0x0 [0041.398] lstrlenW (lpString=".v2i") returned 4 [0041.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".v2i") returned 0x0 [0041.399] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch="s\r\n.v2i") returned 0x0 [0041.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.400] lstrlenW (lpString=".sql") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".sql") returned 0x0 [0041.400] lstrlenW (lpString=".mdf") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".mdf") returned 0x0 [0041.400] lstrlenW (lpString=".txt") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".txt") returned 0x0 [0041.400] lstrlenW (lpString=".dbf") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".dbf") returned 0x0 [0041.400] lstrlenW (lpString=".ckp") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".ckp") returned 0x0 [0041.400] lstrlenW (lpString=".dacpac") returned 7 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".dacpac") returned 0x0 [0041.400] lstrlenW (lpString=".db3") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".db3") returned 0x0 [0041.400] lstrlenW (lpString=".dtxs") returned 5 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".dtxs") returned 0x0 [0041.400] lstrlenW (lpString=".mdt") returned 4 [0041.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".mdt") returned 0x0 [0041.400] lstrlenW (lpString=".sdf") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".sdf") returned 0x0 [0041.401] lstrlenW (lpString=".MDF") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".MDF") returned 0x0 [0041.401] lstrlenW (lpString=".DBF") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".DBF") returned 0x0 [0041.401] lstrlenW (lpString=".DB") returned 3 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".DB") returned 0x0 [0041.401] lstrlenW (lpString=".db") returned 3 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".db") returned 0x0 [0041.401] lstrlenW (lpString=".ndf") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".ndf") returned 0x0 [0041.401] lstrlenW (lpString=".NDF") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".NDF") returned 0x0 [0041.401] lstrlenW (lpString=".Mdf") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".Mdf") returned 0x0 [0041.401] lstrlenW (lpString=".dat") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".dat") returned 0x0 [0041.401] lstrlenW (lpString=".DAT") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".DAT") returned 0x0 [0041.401] lstrlenW (lpString=".ldf") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".ldf") returned 0x0 [0041.401] lstrlenW (lpString=".LDF") returned 4 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch=".LDF") returned 0x0 [0041.401] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.402] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.403] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.403] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.403] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16140397473) returned 1 [0041.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa77eacd0, dwHighDateTime=0x1d585b4)) [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d140 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d140 | out: hHeap=0x260000) returned 1 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e810 [0041.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e810 | out: hHeap=0x260000) returned 1 [0041.403] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.404] GetLastError () returned 0x0 [0041.404] GetLastError () returned 0x0 [0041.404] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.404] GetLastError () returned 0x0 [0041.404] GetLastError () returned 0x0 [0041.404] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x795, lpOverlapped=0x0) returned 1 [0041.406] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff86b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.406] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x795, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x795, lpOverlapped=0x0) returned 1 [0041.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.406] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.406] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.406] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.406] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.406] CloseHandle (hObject=0x10c) returned 1 [0041.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.[deadmin@cock.li].deadmin")) returned 1 [0041.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.408] GetLastError () returned 0x0 [0041.408] RtlWakeConditionVariable () returned 0x27e828 [0041.408] GetCurrentThreadId () returned 0x998 [0041.408] GetCurrentThreadId () returned 0x998 [0041.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0041.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d178 | out: hHeap=0x260000) returned 1 [0041.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0041.408] lstrlenW (lpString=".ldf") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".ldf") returned 0x0 [0041.408] lstrlenW (lpString=".vhd") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".vhd") returned 0x0 [0041.408] lstrlenW (lpString=".vhdx") returned 5 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".vhdx") returned 0x0 [0041.408] lstrlenW (lpString=".pst") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".pst") returned 0x0 [0041.408] lstrlenW (lpString=".ost") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".ost") returned 0x0 [0041.408] lstrlenW (lpString=".bak") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".bak") returned 0x0 [0041.408] lstrlenW (lpString=".bac") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".bac") returned 0x0 [0041.408] lstrlenW (lpString=".sys") returned 4 [0041.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".sys") returned 0x0 [0041.408] lstrlenW (lpString=".v2i") returned 4 [0041.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".v2i") returned 0x0 [0041.409] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.415] lstrlenW (lpString=".sql") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".sql") returned 0x0 [0041.415] lstrlenW (lpString=".mdf") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".mdf") returned 0x0 [0041.415] lstrlenW (lpString=".txt") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".txt") returned 0x0 [0041.415] lstrlenW (lpString=".dbf") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".dbf") returned 0x0 [0041.415] lstrlenW (lpString=".ckp") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".ckp") returned 0x0 [0041.415] lstrlenW (lpString=".dacpac") returned 7 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".dacpac") returned 0x0 [0041.415] lstrlenW (lpString=".db3") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".db3") returned 0x0 [0041.415] lstrlenW (lpString=".dtxs") returned 5 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".dtxs") returned 0x0 [0041.415] lstrlenW (lpString=".mdt") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".mdt") returned 0x0 [0041.415] lstrlenW (lpString=".sdf") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".sdf") returned 0x0 [0041.415] lstrlenW (lpString=".MDF") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".MDF") returned 0x0 [0041.415] lstrlenW (lpString=".DBF") returned 4 [0041.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".DBF") returned 0x0 [0041.416] lstrlenW (lpString=".DB") returned 3 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".DB") returned 0x0 [0041.416] lstrlenW (lpString=".db") returned 3 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".db") returned 0x0 [0041.416] lstrlenW (lpString=".ndf") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".ndf") returned 0x0 [0041.416] lstrlenW (lpString=".NDF") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".NDF") returned 0x0 [0041.416] lstrlenW (lpString=".Mdf") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".Mdf") returned 0x0 [0041.416] lstrlenW (lpString=".dat") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".dat") returned 0x0 [0041.416] lstrlenW (lpString=".DAT") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".DAT") returned 0x0 [0041.416] lstrlenW (lpString=".ldf") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".ldf") returned 0x0 [0041.416] lstrlenW (lpString=".LDF") returned 4 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch=".LDF") returned 0x0 [0041.416] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0041.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.416] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.417] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.417] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0041.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0041.418] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16142056803) returned 1 [0041.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7810e30, dwHighDateTime=0x1d585b4)) [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3381c0 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381c0 | out: hHeap=0x260000) returned 1 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e8b8 [0041.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e8b8 | out: hHeap=0x260000) returned 1 [0041.420] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.420] GetLastError () returned 0x0 [0041.421] GetLastError () returned 0x0 [0041.421] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.421] GetLastError () returned 0x0 [0041.421] GetLastError () returned 0x0 [0041.421] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.425] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.425] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.426] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.426] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.426] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.426] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.426] CloseHandle (hObject=0x10c) returned 1 [0041.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0041.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0041.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0041.427] GetLastError () returned 0x0 [0041.427] RtlWakeConditionVariable () returned 0x27e828 [0041.427] GetCurrentThreadId () returned 0x998 [0041.427] GetCurrentThreadId () returned 0x998 [0041.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab78 | out: hHeap=0x260000) returned 1 [0041.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1b0 | out: hHeap=0x260000) returned 1 [0041.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dab78 [0041.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.428] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.428] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.428] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.428] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.430] CloseHandle (hObject=0x10c) returned 1 [0041.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab78 | out: hHeap=0x260000) returned 1 [0041.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.430] RtlWakeConditionVariable () returned 0x27e828 [0041.430] GetCurrentThreadId () returned 0x998 [0041.430] GetCurrentThreadId () returned 0x998 [0041.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0041.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1e8 | out: hHeap=0x260000) returned 1 [0041.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0041.430] lstrlenW (lpString=".ldf") returned 4 [0041.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".ldf") returned 0x0 [0041.430] lstrlenW (lpString=".vhd") returned 4 [0041.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".vhd") returned 0x0 [0041.430] lstrlenW (lpString=".vhdx") returned 5 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".vhdx") returned 0x0 [0041.431] lstrlenW (lpString=".pst") returned 4 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".pst") returned 0x0 [0041.431] lstrlenW (lpString=".ost") returned 4 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".ost") returned 0x0 [0041.431] lstrlenW (lpString=".bak") returned 4 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".bak") returned 0x0 [0041.431] lstrlenW (lpString=".bac") returned 4 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".bac") returned 0x0 [0041.431] lstrlenW (lpString=".sys") returned 4 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".sys") returned 0x0 [0041.431] lstrlenW (lpString=".v2i") returned 4 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".v2i") returned 0x0 [0041.431] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.503] lstrlenW (lpString=".sql") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".sql") returned 0x0 [0041.503] lstrlenW (lpString=".mdf") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".mdf") returned 0x0 [0041.503] lstrlenW (lpString=".txt") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".txt") returned 0x0 [0041.503] lstrlenW (lpString=".dbf") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".dbf") returned 0x0 [0041.503] lstrlenW (lpString=".ckp") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".ckp") returned 0x0 [0041.503] lstrlenW (lpString=".dacpac") returned 7 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".dacpac") returned 0x0 [0041.503] lstrlenW (lpString=".db3") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".db3") returned 0x0 [0041.503] lstrlenW (lpString=".dtxs") returned 5 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".dtxs") returned 0x0 [0041.503] lstrlenW (lpString=".mdt") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".mdt") returned 0x0 [0041.503] lstrlenW (lpString=".sdf") returned 4 [0041.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".sdf") returned 0x0 [0041.504] lstrlenW (lpString=".MDF") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".MDF") returned 0x0 [0041.504] lstrlenW (lpString=".DBF") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".DBF") returned 0x0 [0041.504] lstrlenW (lpString=".DB") returned 3 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".DB") returned 0x0 [0041.504] lstrlenW (lpString=".db") returned 3 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".db") returned 0x0 [0041.504] lstrlenW (lpString=".ndf") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".ndf") returned 0x0 [0041.504] lstrlenW (lpString=".NDF") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".NDF") returned 0x0 [0041.504] lstrlenW (lpString=".Mdf") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".Mdf") returned 0x0 [0041.504] lstrlenW (lpString=".dat") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".dat") returned 0x0 [0041.504] lstrlenW (lpString=".DAT") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".DAT") returned 0x0 [0041.504] lstrlenW (lpString=".ldf") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".ldf") returned 0x0 [0041.504] lstrlenW (lpString=".LDF") returned 4 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch=".LDF") returned 0x0 [0041.504] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.505] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.505] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.506] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16150682780) returned 1 [0041.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa78cf510, dwHighDateTime=0x1d585b4)) [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.506] GetLastError () returned 0x0 [0041.507] GetLastError () returned 0x0 [0041.507] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.507] GetLastError () returned 0x0 [0041.507] GetLastError () returned 0x0 [0041.507] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.511] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.511] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.512] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.512] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.516] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.516] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.516] CloseHandle (hObject=0x108) returned 1 [0041.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f5f8 [0041.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.518] GetLastError () returned 0x0 [0041.518] RtlWakeConditionVariable () returned 0x27e828 [0041.518] GetCurrentThreadId () returned 0x998 [0041.518] GetCurrentThreadId () returned 0x998 [0041.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa630 | out: hHeap=0x260000) returned 1 [0041.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0041.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa630 [0041.518] lstrlenW (lpString=".ldf") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".ldf") returned 0x0 [0041.518] lstrlenW (lpString=".vhd") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".vhd") returned 0x0 [0041.518] lstrlenW (lpString=".vhdx") returned 5 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".vhdx") returned 0x0 [0041.518] lstrlenW (lpString=".pst") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".pst") returned 0x0 [0041.518] lstrlenW (lpString=".ost") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".ost") returned 0x0 [0041.518] lstrlenW (lpString=".bak") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".bak") returned 0x0 [0041.518] lstrlenW (lpString=".bac") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".bac") returned 0x0 [0041.518] lstrlenW (lpString=".sys") returned 4 [0041.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".sys") returned 0x0 [0041.518] lstrlenW (lpString=".v2i") returned 4 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".v2i") returned 0x0 [0041.519] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.519] lstrlenW (lpString=".sql") returned 4 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".sql") returned 0x0 [0041.519] lstrlenW (lpString=".mdf") returned 4 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".mdf") returned 0x0 [0041.519] lstrlenW (lpString=".txt") returned 4 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".txt") returned 0x0 [0041.519] lstrlenW (lpString=".dbf") returned 4 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".dbf") returned 0x0 [0041.519] lstrlenW (lpString=".ckp") returned 4 [0041.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".ckp") returned 0x0 [0041.520] lstrlenW (lpString=".dacpac") returned 7 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".dacpac") returned 0x0 [0041.520] lstrlenW (lpString=".db3") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".db3") returned 0x0 [0041.520] lstrlenW (lpString=".dtxs") returned 5 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".dtxs") returned 0x0 [0041.520] lstrlenW (lpString=".mdt") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".mdt") returned 0x0 [0041.520] lstrlenW (lpString=".sdf") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".sdf") returned 0x0 [0041.520] lstrlenW (lpString=".MDF") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".MDF") returned 0x0 [0041.520] lstrlenW (lpString=".DBF") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".DBF") returned 0x0 [0041.520] lstrlenW (lpString=".DB") returned 3 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".DB") returned 0x0 [0041.520] lstrlenW (lpString=".db") returned 3 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".db") returned 0x0 [0041.520] lstrlenW (lpString=".ndf") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".ndf") returned 0x0 [0041.520] lstrlenW (lpString=".NDF") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".NDF") returned 0x0 [0041.520] lstrlenW (lpString=".Mdf") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".Mdf") returned 0x0 [0041.520] lstrlenW (lpString=".dat") returned 4 [0041.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".dat") returned 0x0 [0041.520] lstrlenW (lpString=".DAT") returned 4 [0041.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".DAT") returned 0x0 [0041.521] lstrlenW (lpString=".ldf") returned 4 [0041.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".ldf") returned 0x0 [0041.521] lstrlenW (lpString=".LDF") returned 4 [0041.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch=".LDF") returned 0x0 [0041.521] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.521] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.522] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.522] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.522] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16152313096) returned 1 [0041.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa78f5670, dwHighDateTime=0x1d585b4)) [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa500 [0041.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.523] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.523] GetLastError () returned 0x0 [0041.523] GetLastError () returned 0x0 [0041.523] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.523] GetLastError () returned 0x0 [0041.523] GetLastError () returned 0x0 [0041.523] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.527] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.527] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.527] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.528] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.529] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.529] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.529] CloseHandle (hObject=0x108) returned 1 [0041.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f5f8 [0041.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.531] GetLastError () returned 0x0 [0041.531] RtlWakeConditionVariable () returned 0x27e828 [0041.531] GetCurrentThreadId () returned 0x998 [0041.531] GetCurrentThreadId () returned 0x998 [0041.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ea08 | out: hHeap=0x260000) returned 1 [0041.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0041.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ea08 [0041.531] lstrlenW (lpString=".ldf") returned 4 [0041.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".ldf") returned 0x0 [0041.531] lstrlenW (lpString=".vhd") returned 4 [0041.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".vhd") returned 0x0 [0041.531] lstrlenW (lpString=".vhdx") returned 5 [0041.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".vhdx") returned 0x0 [0041.531] lstrlenW (lpString=".pst") returned 4 [0041.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".pst") returned 0x0 [0041.532] lstrlenW (lpString=".ost") returned 4 [0041.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".ost") returned 0x0 [0041.532] lstrlenW (lpString=".bak") returned 4 [0041.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".bak") returned 0x0 [0041.532] lstrlenW (lpString=".bac") returned 4 [0041.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".bac") returned 0x0 [0041.532] lstrlenW (lpString=".sys") returned 4 [0041.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".sys") returned 0x0 [0041.532] lstrlenW (lpString=".v2i") returned 4 [0041.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".v2i") returned 0x0 [0041.532] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.533] lstrlenW (lpString=".sql") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".sql") returned 0x0 [0041.533] lstrlenW (lpString=".mdf") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".mdf") returned 0x0 [0041.533] lstrlenW (lpString=".txt") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".txt") returned 0x0 [0041.533] lstrlenW (lpString=".dbf") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".dbf") returned 0x0 [0041.533] lstrlenW (lpString=".ckp") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".ckp") returned 0x0 [0041.533] lstrlenW (lpString=".dacpac") returned 7 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".dacpac") returned 0x0 [0041.533] lstrlenW (lpString=".db3") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".db3") returned 0x0 [0041.533] lstrlenW (lpString=".dtxs") returned 5 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".dtxs") returned 0x0 [0041.533] lstrlenW (lpString=".mdt") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".mdt") returned 0x0 [0041.533] lstrlenW (lpString=".sdf") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".sdf") returned 0x0 [0041.533] lstrlenW (lpString=".MDF") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".MDF") returned 0x0 [0041.533] lstrlenW (lpString=".DBF") returned 4 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".DBF") returned 0x0 [0041.533] lstrlenW (lpString=".DB") returned 3 [0041.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".DB") returned 0x0 [0041.533] lstrlenW (lpString=".db") returned 3 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".db") returned 0x0 [0041.534] lstrlenW (lpString=".ndf") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".ndf") returned 0x0 [0041.534] lstrlenW (lpString=".NDF") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".NDF") returned 0x0 [0041.534] lstrlenW (lpString=".Mdf") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".Mdf") returned 0x0 [0041.534] lstrlenW (lpString=".dat") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".dat") returned 0x0 [0041.534] lstrlenW (lpString=".DAT") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".DAT") returned 0x0 [0041.534] lstrlenW (lpString=".ldf") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".ldf") returned 0x0 [0041.534] lstrlenW (lpString=".LDF") returned 4 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch=".LDF") returned 0x0 [0041.534] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.534] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.535] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.535] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.535] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16153655597) returned 1 [0041.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa791b7d0, dwHighDateTime=0x1d585b4)) [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1450 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e768 [0041.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e768 | out: hHeap=0x260000) returned 1 [0041.536] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.536] GetLastError () returned 0x0 [0041.536] GetLastError () returned 0x0 [0041.536] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.536] GetLastError () returned 0x0 [0041.537] GetLastError () returned 0x0 [0041.537] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x3db8, lpOverlapped=0x0) returned 1 [0041.560] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.560] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x3db8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x3db8, lpOverlapped=0x0) returned 1 [0041.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.561] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.561] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.561] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.561] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.561] CloseHandle (hObject=0x108) returned 1 [0041.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.581] GetLastError () returned 0x0 [0041.581] RtlWakeConditionVariable () returned 0x27e828 [0041.581] GetCurrentThreadId () returned 0x998 [0041.581] GetCurrentThreadId () returned 0x998 [0041.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eb58 | out: hHeap=0x260000) returned 1 [0041.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0041.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eb58 [0041.581] lstrlenW (lpString=".ldf") returned 4 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".ldf") returned 0x0 [0041.581] lstrlenW (lpString=".vhd") returned 4 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".vhd") returned 0x0 [0041.581] lstrlenW (lpString=".vhdx") returned 5 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".vhdx") returned 0x0 [0041.581] lstrlenW (lpString=".pst") returned 4 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".pst") returned 0x0 [0041.581] lstrlenW (lpString=".ost") returned 4 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".ost") returned 0x0 [0041.581] lstrlenW (lpString=".bak") returned 4 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".bak") returned 0x0 [0041.581] lstrlenW (lpString=".bac") returned 4 [0041.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".bac") returned 0x0 [0041.581] lstrlenW (lpString=".sys") returned 4 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".sys") returned 0x0 [0041.582] lstrlenW (lpString=".v2i") returned 4 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".v2i") returned 0x0 [0041.582] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.582] lstrlenW (lpString=".sql") returned 4 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".sql") returned 0x0 [0041.582] lstrlenW (lpString=".mdf") returned 4 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".mdf") returned 0x0 [0041.582] lstrlenW (lpString=".txt") returned 4 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".txt") returned 0x0 [0041.582] lstrlenW (lpString=".dbf") returned 4 [0041.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".dbf") returned 0x0 [0041.582] lstrlenW (lpString=".ckp") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".ckp") returned 0x0 [0041.583] lstrlenW (lpString=".dacpac") returned 7 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".dacpac") returned 0x0 [0041.583] lstrlenW (lpString=".db3") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".db3") returned 0x0 [0041.583] lstrlenW (lpString=".dtxs") returned 5 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".dtxs") returned 0x0 [0041.583] lstrlenW (lpString=".mdt") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".mdt") returned 0x0 [0041.583] lstrlenW (lpString=".sdf") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".sdf") returned 0x0 [0041.583] lstrlenW (lpString=".MDF") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".MDF") returned 0x0 [0041.583] lstrlenW (lpString=".DBF") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".DBF") returned 0x0 [0041.583] lstrlenW (lpString=".DB") returned 3 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".DB") returned 0x0 [0041.583] lstrlenW (lpString=".db") returned 3 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".db") returned 0x0 [0041.583] lstrlenW (lpString=".ndf") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".ndf") returned 0x0 [0041.583] lstrlenW (lpString=".NDF") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".NDF") returned 0x0 [0041.583] lstrlenW (lpString=".Mdf") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".Mdf") returned 0x0 [0041.583] lstrlenW (lpString=".dat") returned 4 [0041.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".dat") returned 0x0 [0041.584] lstrlenW (lpString=".DAT") returned 4 [0041.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".DAT") returned 0x0 [0041.584] lstrlenW (lpString=".ldf") returned 4 [0041.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".ldf") returned 0x0 [0041.584] lstrlenW (lpString=".LDF") returned 4 [0041.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch=".LDF") returned 0x0 [0041.584] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.584] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.585] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.585] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16158622680) returned 1 [0041.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa798dbf0, dwHighDateTime=0x1d585b4)) [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13e0 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0041.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ea08 [0041.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ea08 | out: hHeap=0x260000) returned 1 [0041.586] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.586] GetLastError () returned 0x0 [0041.586] GetLastError () returned 0x0 [0041.586] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.586] GetLastError () returned 0x0 [0041.586] GetLastError () returned 0x0 [0041.587] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x3db8, lpOverlapped=0x0) returned 1 [0041.590] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.590] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3db8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3db8, lpOverlapped=0x0) returned 1 [0041.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.590] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.590] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.590] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.591] CloseHandle (hObject=0x10c) returned 1 [0041.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.592] GetLastError () returned 0x0 [0041.592] RtlWakeConditionVariable () returned 0x27e828 [0041.592] GetCurrentThreadId () returned 0x998 [0041.592] GetCurrentThreadId () returned 0x998 [0041.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ec00 | out: hHeap=0x260000) returned 1 [0041.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13a8 | out: hHeap=0x260000) returned 1 [0041.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ec00 [0041.592] lstrlenW (lpString=".ldf") returned 4 [0041.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".ldf") returned 0x0 [0041.592] lstrlenW (lpString=".vhd") returned 4 [0041.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".vhd") returned 0x0 [0041.592] lstrlenW (lpString=".vhdx") returned 5 [0041.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".vhdx") returned 0x0 [0041.592] lstrlenW (lpString=".pst") returned 4 [0041.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".pst") returned 0x0 [0041.592] lstrlenW (lpString=".ost") returned 4 [0041.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".ost") returned 0x0 [0041.592] lstrlenW (lpString=".bak") returned 4 [0041.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".bak") returned 0x0 [0041.593] lstrlenW (lpString=".bac") returned 4 [0041.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".bac") returned 0x0 [0041.593] lstrlenW (lpString=".sys") returned 4 [0041.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".sys") returned 0x0 [0041.593] lstrlenW (lpString=".v2i") returned 4 [0041.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".v2i") returned 0x0 [0041.593] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.594] lstrlenW (lpString=".sql") returned 4 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".sql") returned 0x0 [0041.594] lstrlenW (lpString=".mdf") returned 4 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".mdf") returned 0x0 [0041.594] lstrlenW (lpString=".txt") returned 4 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".txt") returned 0x0 [0041.594] lstrlenW (lpString=".dbf") returned 4 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".dbf") returned 0x0 [0041.594] lstrlenW (lpString=".ckp") returned 4 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".ckp") returned 0x0 [0041.594] lstrlenW (lpString=".dacpac") returned 7 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".dacpac") returned 0x0 [0041.594] lstrlenW (lpString=".db3") returned 4 [0041.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".db3") returned 0x0 [0041.594] lstrlenW (lpString=".dtxs") returned 5 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".dtxs") returned 0x0 [0041.595] lstrlenW (lpString=".mdt") returned 4 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".mdt") returned 0x0 [0041.595] lstrlenW (lpString=".sdf") returned 4 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".sdf") returned 0x0 [0041.595] lstrlenW (lpString=".MDF") returned 4 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".MDF") returned 0x0 [0041.595] lstrlenW (lpString=".DBF") returned 4 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".DBF") returned 0x0 [0041.595] lstrlenW (lpString=".DB") returned 3 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".DB") returned 0x0 [0041.595] lstrlenW (lpString=".db") returned 3 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".db") returned 0x0 [0041.595] lstrlenW (lpString=".ndf") returned 4 [0041.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".ndf") returned 0x0 [0041.596] lstrlenW (lpString=".NDF") returned 4 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".NDF") returned 0x0 [0041.596] lstrlenW (lpString=".Mdf") returned 4 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".Mdf") returned 0x0 [0041.596] lstrlenW (lpString=".dat") returned 4 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".dat") returned 0x0 [0041.596] lstrlenW (lpString=".DAT") returned 4 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".DAT") returned 0x0 [0041.596] lstrlenW (lpString=".ldf") returned 4 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".ldf") returned 0x0 [0041.596] lstrlenW (lpString=".LDF") returned 4 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch=".LDF") returned 0x0 [0041.596] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.596] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.597] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.597] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.597] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16159843056) returned 1 [0041.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa79b3d50, dwHighDateTime=0x1d585b4)) [0041.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13a8 [0041.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13a8 | out: hHeap=0x260000) returned 1 [0041.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30eb58 [0041.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eb58 | out: hHeap=0x260000) returned 1 [0041.598] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.598] GetLastError () returned 0x0 [0041.598] GetLastError () returned 0x0 [0041.598] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.598] GetLastError () returned 0x0 [0041.598] GetLastError () returned 0x0 [0041.599] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.602] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.602] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.602] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.602] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.604] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.604] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.604] CloseHandle (hObject=0x10c) returned 1 [0041.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.606] GetLastError () returned 0x0 [0041.606] RtlWakeConditionVariable () returned 0x27e828 [0041.606] GetCurrentThreadId () returned 0x998 [0041.606] GetCurrentThreadId () returned 0x998 [0041.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa6c8 | out: hHeap=0x260000) returned 1 [0041.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d2e8 | out: hHeap=0x260000) returned 1 [0041.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa6c8 [0041.606] lstrlenW (lpString=".ldf") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".ldf") returned 0x0 [0041.606] lstrlenW (lpString=".vhd") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".vhd") returned 0x0 [0041.606] lstrlenW (lpString=".vhdx") returned 5 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".vhdx") returned 0x0 [0041.606] lstrlenW (lpString=".pst") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".pst") returned 0x0 [0041.606] lstrlenW (lpString=".ost") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".ost") returned 0x0 [0041.606] lstrlenW (lpString=".bak") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".bak") returned 0x0 [0041.606] lstrlenW (lpString=".bac") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".bac") returned 0x0 [0041.606] lstrlenW (lpString=".sys") returned 4 [0041.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".sys") returned 0x0 [0041.607] lstrlenW (lpString=".v2i") returned 4 [0041.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".v2i") returned 0x0 [0041.607] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.607] lstrlenW (lpString=".sql") returned 4 [0041.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".sql") returned 0x0 [0041.607] lstrlenW (lpString=".mdf") returned 4 [0041.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".mdf") returned 0x0 [0041.607] lstrlenW (lpString=".txt") returned 4 [0041.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".txt") returned 0x0 [0041.607] lstrlenW (lpString=".dbf") returned 4 [0041.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".dbf") returned 0x0 [0041.607] lstrlenW (lpString=".ckp") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".ckp") returned 0x0 [0041.608] lstrlenW (lpString=".dacpac") returned 7 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".dacpac") returned 0x0 [0041.608] lstrlenW (lpString=".db3") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".db3") returned 0x0 [0041.608] lstrlenW (lpString=".dtxs") returned 5 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".dtxs") returned 0x0 [0041.608] lstrlenW (lpString=".mdt") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".mdt") returned 0x0 [0041.608] lstrlenW (lpString=".sdf") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".sdf") returned 0x0 [0041.608] lstrlenW (lpString=".MDF") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".MDF") returned 0x0 [0041.608] lstrlenW (lpString=".DBF") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".DBF") returned 0x0 [0041.608] lstrlenW (lpString=".DB") returned 3 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".DB") returned 0x0 [0041.608] lstrlenW (lpString=".db") returned 3 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".db") returned 0x0 [0041.608] lstrlenW (lpString=".ndf") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".ndf") returned 0x0 [0041.608] lstrlenW (lpString=".NDF") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".NDF") returned 0x0 [0041.608] lstrlenW (lpString=".Mdf") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".Mdf") returned 0x0 [0041.608] lstrlenW (lpString=".dat") returned 4 [0041.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".dat") returned 0x0 [0041.609] lstrlenW (lpString=".DAT") returned 4 [0041.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".DAT") returned 0x0 [0041.609] lstrlenW (lpString=".ldf") returned 4 [0041.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".ldf") returned 0x0 [0041.609] lstrlenW (lpString=".LDF") returned 4 [0041.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch=".LDF") returned 0x0 [0041.609] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.609] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.610] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.610] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16161120839) returned 1 [0041.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa79d9eb0, dwHighDateTime=0x1d585b4)) [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d2e8 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d2e8 | out: hHeap=0x260000) returned 1 [0041.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa630 [0041.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.611] GetLastError () returned 0x0 [0041.611] GetLastError () returned 0x0 [0041.611] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.611] GetLastError () returned 0x0 [0041.611] GetLastError () returned 0x0 [0041.611] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.614] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.615] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.615] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.615] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.618] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.618] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.618] CloseHandle (hObject=0x10c) returned 1 [0041.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.619] GetLastError () returned 0x0 [0041.619] RtlWakeConditionVariable () returned 0x27e828 [0041.619] GetCurrentThreadId () returned 0x998 [0041.619] GetCurrentThreadId () returned 0x998 [0041.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa760 | out: hHeap=0x260000) returned 1 [0041.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d320 | out: hHeap=0x260000) returned 1 [0041.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa760 [0041.620] lstrlenW (lpString=".ldf") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".ldf") returned 0x0 [0041.620] lstrlenW (lpString=".vhd") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".vhd") returned 0x0 [0041.620] lstrlenW (lpString=".vhdx") returned 5 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".vhdx") returned 0x0 [0041.620] lstrlenW (lpString=".pst") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".pst") returned 0x0 [0041.620] lstrlenW (lpString=".ost") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".ost") returned 0x0 [0041.620] lstrlenW (lpString=".bak") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".bak") returned 0x0 [0041.620] lstrlenW (lpString=".bac") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".bac") returned 0x0 [0041.620] lstrlenW (lpString=".sys") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".sys") returned 0x0 [0041.620] lstrlenW (lpString=".v2i") returned 4 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".v2i") returned 0x0 [0041.620] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.622] lstrlenW (lpString=".sql") returned 4 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".sql") returned 0x0 [0041.622] lstrlenW (lpString=".mdf") returned 4 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".mdf") returned 0x0 [0041.622] lstrlenW (lpString=".txt") returned 4 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".txt") returned 0x0 [0041.622] lstrlenW (lpString=".dbf") returned 4 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".dbf") returned 0x0 [0041.622] lstrlenW (lpString=".ckp") returned 4 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".ckp") returned 0x0 [0041.622] lstrlenW (lpString=".dacpac") returned 7 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".dacpac") returned 0x0 [0041.622] lstrlenW (lpString=".db3") returned 4 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".db3") returned 0x0 [0041.622] lstrlenW (lpString=".dtxs") returned 5 [0041.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".dtxs") returned 0x0 [0041.622] lstrlenW (lpString=".mdt") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".mdt") returned 0x0 [0041.623] lstrlenW (lpString=".sdf") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".sdf") returned 0x0 [0041.623] lstrlenW (lpString=".MDF") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".MDF") returned 0x0 [0041.623] lstrlenW (lpString=".DBF") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".DBF") returned 0x0 [0041.623] lstrlenW (lpString=".DB") returned 3 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".DB") returned 0x0 [0041.623] lstrlenW (lpString=".db") returned 3 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".db") returned 0x0 [0041.623] lstrlenW (lpString=".ndf") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".ndf") returned 0x0 [0041.623] lstrlenW (lpString=".NDF") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".NDF") returned 0x0 [0041.623] lstrlenW (lpString=".Mdf") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".Mdf") returned 0x0 [0041.623] lstrlenW (lpString=".dat") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".dat") returned 0x0 [0041.623] lstrlenW (lpString=".DAT") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".DAT") returned 0x0 [0041.623] lstrlenW (lpString=".ldf") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".ldf") returned 0x0 [0041.623] lstrlenW (lpString=".LDF") returned 4 [0041.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch=".LDF") returned 0x0 [0041.623] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.624] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.625] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.625] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.625] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16162590232) returned 1 [0041.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7a00010, dwHighDateTime=0x1d585b4)) [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d320 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d320 | out: hHeap=0x260000) returned 1 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa6c8 [0041.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.625] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.626] GetLastError () returned 0x0 [0041.626] GetLastError () returned 0x0 [0041.626] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.626] GetLastError () returned 0x0 [0041.626] GetLastError () returned 0x0 [0041.626] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0xd9c0, lpOverlapped=0x0) returned 1 [0041.628] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff2640, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.628] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xd9c0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd9c0, lpOverlapped=0x0) returned 1 [0041.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.629] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.629] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.630] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.630] CloseHandle (hObject=0x10c) returned 1 [0041.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.631] GetLastError () returned 0x0 [0041.631] RtlWakeConditionVariable () returned 0x27e828 [0041.631] GetCurrentThreadId () returned 0x998 [0041.631] GetCurrentThreadId () returned 0x998 [0041.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa7f8 [0041.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa890 | out: hHeap=0x260000) returned 1 [0041.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d390 | out: hHeap=0x260000) returned 1 [0041.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa890 [0041.632] lstrlenW (lpString=".ldf") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".ldf") returned 0x0 [0041.632] lstrlenW (lpString=".vhd") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".vhd") returned 0x0 [0041.632] lstrlenW (lpString=".vhdx") returned 5 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".vhdx") returned 0x0 [0041.632] lstrlenW (lpString=".pst") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".pst") returned 0x0 [0041.632] lstrlenW (lpString=".ost") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".ost") returned 0x0 [0041.632] lstrlenW (lpString=".bak") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".bak") returned 0x0 [0041.632] lstrlenW (lpString=".bac") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".bac") returned 0x0 [0041.632] lstrlenW (lpString=".sys") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".sys") returned 0x0 [0041.632] lstrlenW (lpString=".v2i") returned 4 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".v2i") returned 0x0 [0041.632] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.633] lstrlenW (lpString=".sql") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".sql") returned 0x0 [0041.633] lstrlenW (lpString=".mdf") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".mdf") returned 0x0 [0041.633] lstrlenW (lpString=".txt") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".txt") returned 0x0 [0041.633] lstrlenW (lpString=".dbf") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".dbf") returned 0x0 [0041.633] lstrlenW (lpString=".ckp") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".ckp") returned 0x0 [0041.633] lstrlenW (lpString=".dacpac") returned 7 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".dacpac") returned 0x0 [0041.633] lstrlenW (lpString=".db3") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".db3") returned 0x0 [0041.633] lstrlenW (lpString=".dtxs") returned 5 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".dtxs") returned 0x0 [0041.633] lstrlenW (lpString=".mdt") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".mdt") returned 0x0 [0041.633] lstrlenW (lpString=".sdf") returned 4 [0041.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".sdf") returned 0x0 [0041.634] lstrlenW (lpString=".MDF") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".MDF") returned 0x0 [0041.634] lstrlenW (lpString=".DBF") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".DBF") returned 0x0 [0041.634] lstrlenW (lpString=".DB") returned 3 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".DB") returned 0x0 [0041.634] lstrlenW (lpString=".db") returned 3 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".db") returned 0x0 [0041.634] lstrlenW (lpString=".ndf") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".ndf") returned 0x0 [0041.634] lstrlenW (lpString=".NDF") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".NDF") returned 0x0 [0041.634] lstrlenW (lpString=".Mdf") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".Mdf") returned 0x0 [0041.634] lstrlenW (lpString=".dat") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".dat") returned 0x0 [0041.634] lstrlenW (lpString=".DAT") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".DAT") returned 0x0 [0041.634] lstrlenW (lpString=".ldf") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".ldf") returned 0x0 [0041.634] lstrlenW (lpString=".LDF") returned 4 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch=".LDF") returned 0x0 [0041.634] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.634] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.635] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.635] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.636] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16163672168) returned 1 [0041.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7a00010, dwHighDateTime=0x1d585b4)) [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d390 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d390 | out: hHeap=0x260000) returned 1 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa760 [0041.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.636] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.636] GetLastError () returned 0x0 [0041.637] GetLastError () returned 0x0 [0041.637] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.637] GetLastError () returned 0x0 [0041.637] GetLastError () returned 0x0 [0041.637] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.642] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.642] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.642] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.643] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.644] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.644] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.644] CloseHandle (hObject=0x10c) returned 1 [0041.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.646] GetLastError () returned 0x0 [0041.646] RtlWakeConditionVariable () returned 0x27e828 [0041.646] GetCurrentThreadId () returned 0x998 [0041.646] GetCurrentThreadId () returned 0x998 [0041.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa7f8 [0041.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa928 | out: hHeap=0x260000) returned 1 [0041.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0041.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa928 [0041.646] lstrlenW (lpString=".ldf") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".ldf") returned 0x0 [0041.646] lstrlenW (lpString=".vhd") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".vhd") returned 0x0 [0041.646] lstrlenW (lpString=".vhdx") returned 5 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".vhdx") returned 0x0 [0041.646] lstrlenW (lpString=".pst") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".pst") returned 0x0 [0041.646] lstrlenW (lpString=".ost") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".ost") returned 0x0 [0041.646] lstrlenW (lpString=".bak") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".bak") returned 0x0 [0041.646] lstrlenW (lpString=".bac") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".bac") returned 0x0 [0041.646] lstrlenW (lpString=".sys") returned 4 [0041.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".sys") returned 0x0 [0041.646] lstrlenW (lpString=".v2i") returned 4 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".v2i") returned 0x0 [0041.647] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.647] lstrlenW (lpString=".sql") returned 4 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".sql") returned 0x0 [0041.647] lstrlenW (lpString=".mdf") returned 4 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".mdf") returned 0x0 [0041.647] lstrlenW (lpString=".txt") returned 4 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".txt") returned 0x0 [0041.647] lstrlenW (lpString=".dbf") returned 4 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".dbf") returned 0x0 [0041.647] lstrlenW (lpString=".ckp") returned 4 [0041.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".ckp") returned 0x0 [0041.647] lstrlenW (lpString=".dacpac") returned 7 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".dacpac") returned 0x0 [0041.648] lstrlenW (lpString=".db3") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".db3") returned 0x0 [0041.648] lstrlenW (lpString=".dtxs") returned 5 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".dtxs") returned 0x0 [0041.648] lstrlenW (lpString=".mdt") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".mdt") returned 0x0 [0041.648] lstrlenW (lpString=".sdf") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".sdf") returned 0x0 [0041.648] lstrlenW (lpString=".MDF") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".MDF") returned 0x0 [0041.648] lstrlenW (lpString=".DBF") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".DBF") returned 0x0 [0041.648] lstrlenW (lpString=".DB") returned 3 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".DB") returned 0x0 [0041.648] lstrlenW (lpString=".db") returned 3 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".db") returned 0x0 [0041.648] lstrlenW (lpString=".ndf") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".ndf") returned 0x0 [0041.648] lstrlenW (lpString=".NDF") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".NDF") returned 0x0 [0041.648] lstrlenW (lpString=".Mdf") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".Mdf") returned 0x0 [0041.648] lstrlenW (lpString=".dat") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".dat") returned 0x0 [0041.648] lstrlenW (lpString=".DAT") returned 4 [0041.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".DAT") returned 0x0 [0041.649] lstrlenW (lpString=".ldf") returned 4 [0041.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".ldf") returned 0x0 [0041.649] lstrlenW (lpString=".LDF") returned 4 [0041.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch=".LDF") returned 0x0 [0041.649] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.649] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.650] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.650] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.650] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16165119532) returned 1 [0041.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7a26170, dwHighDateTime=0x1d585b4)) [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d3c8 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa890 [0041.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.651] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.651] GetLastError () returned 0x0 [0041.651] GetLastError () returned 0x0 [0041.651] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.651] GetLastError () returned 0x0 [0041.651] GetLastError () returned 0x0 [0041.651] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.692] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.692] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.692] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.692] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.695] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.695] CloseHandle (hObject=0x10c) returned 1 [0041.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.784] GetLastError () returned 0x0 [0041.784] RtlWakeConditionVariable () returned 0x27e828 [0041.812] GetCurrentThreadId () returned 0x998 [0041.812] GetCurrentThreadId () returned 0x998 [0041.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312df0 | out: hHeap=0x260000) returned 1 [0041.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d588 | out: hHeap=0x260000) returned 1 [0041.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312df0 [0041.812] lstrlenW (lpString=".ldf") returned 4 [0041.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".ldf") returned 0x0 [0041.812] lstrlenW (lpString=".vhd") returned 4 [0041.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".vhd") returned 0x0 [0041.813] lstrlenW (lpString=".vhdx") returned 5 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".vhdx") returned 0x0 [0041.813] lstrlenW (lpString=".pst") returned 4 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".pst") returned 0x0 [0041.813] lstrlenW (lpString=".ost") returned 4 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".ost") returned 0x0 [0041.813] lstrlenW (lpString=".bak") returned 4 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".bak") returned 0x0 [0041.813] lstrlenW (lpString=".bac") returned 4 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".bac") returned 0x0 [0041.813] lstrlenW (lpString=".sys") returned 4 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".sys") returned 0x0 [0041.813] lstrlenW (lpString=".v2i") returned 4 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".v2i") returned 0x0 [0041.813] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.814] lstrlenW (lpString=".sql") returned 4 [0041.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".sql") returned 0x0 [0041.814] lstrlenW (lpString=".mdf") returned 4 [0041.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".mdf") returned 0x0 [0041.815] lstrlenW (lpString=".txt") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".txt") returned 0x0 [0041.815] lstrlenW (lpString=".dbf") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".dbf") returned 0x0 [0041.815] lstrlenW (lpString=".ckp") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".ckp") returned 0x0 [0041.815] lstrlenW (lpString=".dacpac") returned 7 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".dacpac") returned 0x0 [0041.815] lstrlenW (lpString=".db3") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".db3") returned 0x0 [0041.815] lstrlenW (lpString=".dtxs") returned 5 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".dtxs") returned 0x0 [0041.815] lstrlenW (lpString=".mdt") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".mdt") returned 0x0 [0041.815] lstrlenW (lpString=".sdf") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".sdf") returned 0x0 [0041.815] lstrlenW (lpString=".MDF") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".MDF") returned 0x0 [0041.815] lstrlenW (lpString=".DBF") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".DBF") returned 0x0 [0041.815] lstrlenW (lpString=".DB") returned 3 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".DB") returned 0x0 [0041.815] lstrlenW (lpString=".db") returned 3 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".db") returned 0x0 [0041.815] lstrlenW (lpString=".ndf") returned 4 [0041.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".ndf") returned 0x0 [0041.816] lstrlenW (lpString=".NDF") returned 4 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".NDF") returned 0x0 [0041.816] lstrlenW (lpString=".Mdf") returned 4 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".Mdf") returned 0x0 [0041.816] lstrlenW (lpString=".dat") returned 4 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".dat") returned 0x0 [0041.816] lstrlenW (lpString=".DAT") returned 4 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".DAT") returned 0x0 [0041.816] lstrlenW (lpString=".ldf") returned 4 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".ldf") returned 0x0 [0041.816] lstrlenW (lpString=".LDF") returned 4 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch=".LDF") returned 0x0 [0041.816] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.816] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.817] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.817] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.817] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16181842546) returned 1 [0041.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7bc9090, dwHighDateTime=0x1d585b4)) [0041.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d588 [0041.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d588 | out: hHeap=0x260000) returned 1 [0041.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312c28 [0041.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.818] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.818] GetLastError () returned 0x0 [0041.818] GetLastError () returned 0x0 [0041.818] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] GetLastError () returned 0x0 [0041.819] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.823] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.823] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.823] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.824] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.824] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.824] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.824] CloseHandle (hObject=0x100) returned 1 [0041.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.825] GetLastError () returned 0x0 [0041.825] RtlWakeConditionVariable () returned 0x27e828 [0041.825] GetCurrentThreadId () returned 0x998 [0041.826] GetCurrentThreadId () returned 0x998 [0041.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e88 | out: hHeap=0x260000) returned 1 [0041.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x260000) returned 1 [0041.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312e88 [0041.826] lstrlenW (lpString=".ldf") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".ldf") returned 0x0 [0041.826] lstrlenW (lpString=".vhd") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".vhd") returned 0x0 [0041.826] lstrlenW (lpString=".vhdx") returned 5 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".vhdx") returned 0x0 [0041.826] lstrlenW (lpString=".pst") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".pst") returned 0x0 [0041.826] lstrlenW (lpString=".ost") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".ost") returned 0x0 [0041.826] lstrlenW (lpString=".bak") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".bak") returned 0x0 [0041.826] lstrlenW (lpString=".bac") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".bac") returned 0x0 [0041.826] lstrlenW (lpString=".sys") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".sys") returned 0x0 [0041.826] lstrlenW (lpString=".v2i") returned 4 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".v2i") returned 0x0 [0041.826] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.828] lstrlenW (lpString=".sql") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".sql") returned 0x0 [0041.828] lstrlenW (lpString=".mdf") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".mdf") returned 0x0 [0041.828] lstrlenW (lpString=".txt") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".txt") returned 0x0 [0041.828] lstrlenW (lpString=".dbf") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".dbf") returned 0x0 [0041.828] lstrlenW (lpString=".ckp") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".ckp") returned 0x0 [0041.828] lstrlenW (lpString=".dacpac") returned 7 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".dacpac") returned 0x0 [0041.828] lstrlenW (lpString=".db3") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".db3") returned 0x0 [0041.828] lstrlenW (lpString=".dtxs") returned 5 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".dtxs") returned 0x0 [0041.828] lstrlenW (lpString=".mdt") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".mdt") returned 0x0 [0041.828] lstrlenW (lpString=".sdf") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".sdf") returned 0x0 [0041.828] lstrlenW (lpString=".MDF") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".MDF") returned 0x0 [0041.828] lstrlenW (lpString=".DBF") returned 4 [0041.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".DBF") returned 0x0 [0041.829] lstrlenW (lpString=".DB") returned 3 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".DB") returned 0x0 [0041.829] lstrlenW (lpString=".db") returned 3 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".db") returned 0x0 [0041.829] lstrlenW (lpString=".ndf") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".ndf") returned 0x0 [0041.829] lstrlenW (lpString=".NDF") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".NDF") returned 0x0 [0041.829] lstrlenW (lpString=".Mdf") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".Mdf") returned 0x0 [0041.829] lstrlenW (lpString=".dat") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".dat") returned 0x0 [0041.829] lstrlenW (lpString=".DAT") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".DAT") returned 0x0 [0041.829] lstrlenW (lpString=".ldf") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".ldf") returned 0x0 [0041.829] lstrlenW (lpString=".LDF") returned 4 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch=".LDF") returned 0x0 [0041.829] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.829] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.830] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.830] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.830] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16183160407) returned 1 [0041.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7bef1f0, dwHighDateTime=0x1d585b4)) [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5c0 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x260000) returned 1 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312df0 [0041.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.831] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.831] GetLastError () returned 0x0 [0041.831] GetLastError () returned 0x0 [0041.831] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.832] GetLastError () returned 0x0 [0041.832] GetLastError () returned 0x0 [0041.832] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x11578, lpOverlapped=0x0) returned 1 [0041.834] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffeea88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.834] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x11578, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x11578, lpOverlapped=0x0) returned 1 [0041.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.834] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.834] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.834] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.834] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.835] CloseHandle (hObject=0x100) returned 1 [0041.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.836] GetLastError () returned 0x0 [0041.836] RtlWakeConditionVariable () returned 0x27e828 [0041.836] GetCurrentThreadId () returned 0x998 [0041.836] GetCurrentThreadId () returned 0x998 [0041.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f20 | out: hHeap=0x260000) returned 1 [0041.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5f8 | out: hHeap=0x260000) returned 1 [0041.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312f20 [0041.836] lstrlenW (lpString=".ldf") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".ldf") returned 0x0 [0041.836] lstrlenW (lpString=".vhd") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".vhd") returned 0x0 [0041.836] lstrlenW (lpString=".vhdx") returned 5 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".vhdx") returned 0x0 [0041.836] lstrlenW (lpString=".pst") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".pst") returned 0x0 [0041.836] lstrlenW (lpString=".ost") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".ost") returned 0x0 [0041.836] lstrlenW (lpString=".bak") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".bak") returned 0x0 [0041.836] lstrlenW (lpString=".bac") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".bac") returned 0x0 [0041.836] lstrlenW (lpString=".sys") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".sys") returned 0x0 [0041.836] lstrlenW (lpString=".v2i") returned 4 [0041.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".v2i") returned 0x0 [0041.837] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0041.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.838] lstrlenW (lpString=".sql") returned 4 [0041.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".sql") returned 0x0 [0041.838] lstrlenW (lpString=".mdf") returned 4 [0041.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".mdf") returned 0x0 [0041.838] lstrlenW (lpString=".txt") returned 4 [0041.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".txt") returned 0x0 [0041.838] lstrlenW (lpString=".dbf") returned 4 [0041.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".dbf") returned 0x0 [0041.838] lstrlenW (lpString=".ckp") returned 4 [0041.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".ckp") returned 0x0 [0041.838] lstrlenW (lpString=".dacpac") returned 7 [0041.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".dacpac") returned 0x0 [0041.839] lstrlenW (lpString=".db3") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".db3") returned 0x0 [0041.839] lstrlenW (lpString=".dtxs") returned 5 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".dtxs") returned 0x0 [0041.839] lstrlenW (lpString=".mdt") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".mdt") returned 0x0 [0041.839] lstrlenW (lpString=".sdf") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".sdf") returned 0x0 [0041.839] lstrlenW (lpString=".MDF") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".MDF") returned 0x0 [0041.839] lstrlenW (lpString=".DBF") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".DBF") returned 0x0 [0041.839] lstrlenW (lpString=".DB") returned 3 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".DB") returned 0x0 [0041.839] lstrlenW (lpString=".db") returned 3 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".db") returned 0x0 [0041.839] lstrlenW (lpString=".ndf") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".ndf") returned 0x0 [0041.839] lstrlenW (lpString=".NDF") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".NDF") returned 0x0 [0041.839] lstrlenW (lpString=".Mdf") returned 4 [0041.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".Mdf") returned 0x0 [0041.840] lstrlenW (lpString=".dat") returned 4 [0041.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".dat") returned 0x0 [0041.840] lstrlenW (lpString=".DAT") returned 4 [0041.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".DAT") returned 0x0 [0041.840] lstrlenW (lpString=".ldf") returned 4 [0041.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".ldf") returned 0x0 [0041.840] lstrlenW (lpString=".LDF") returned 4 [0041.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch=".LDF") returned 0x0 [0041.840] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.840] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.841] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.841] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.841] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16184224643) returned 1 [0041.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7c15350, dwHighDateTime=0x1d585b4)) [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5f8 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5f8 | out: hHeap=0x260000) returned 1 [0041.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312e88 [0041.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.842] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.842] GetLastError () returned 0x0 [0041.842] GetLastError () returned 0x0 [0041.842] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] GetLastError () returned 0x0 [0041.842] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.928] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.928] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.929] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.929] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.929] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.929] CloseHandle (hObject=0x100) returned 1 [0041.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f520 [0041.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.[deadmin@cock.li].deadmin")) returned 1 [0041.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f520 | out: hHeap=0x260000) returned 1 [0041.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.949] GetLastError () returned 0x0 [0041.949] RtlWakeConditionVariable () returned 0x27e828 [0041.949] GetCurrentThreadId () returned 0x998 [0041.949] GetCurrentThreadId () returned 0x998 [0041.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313180 | out: hHeap=0x260000) returned 1 [0041.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d710 | out: hHeap=0x260000) returned 1 [0041.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313180 [0041.950] lstrlenW (lpString=".ldf") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".ldf") returned 0x0 [0041.950] lstrlenW (lpString=".vhd") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".vhd") returned 0x0 [0041.950] lstrlenW (lpString=".vhdx") returned 5 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".vhdx") returned 0x0 [0041.950] lstrlenW (lpString=".pst") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".pst") returned 0x0 [0041.950] lstrlenW (lpString=".ost") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".ost") returned 0x0 [0041.950] lstrlenW (lpString=".bak") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".bak") returned 0x0 [0041.950] lstrlenW (lpString=".bac") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".bac") returned 0x0 [0041.950] lstrlenW (lpString=".sys") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".sys") returned 0x0 [0041.950] lstrlenW (lpString=".v2i") returned 4 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".v2i") returned 0x0 [0041.950] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.951] lstrlenW (lpString=".sql") returned 4 [0041.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".sql") returned 0x0 [0041.951] lstrlenW (lpString=".mdf") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".mdf") returned 0x0 [0041.952] lstrlenW (lpString=".txt") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".txt") returned 0x0 [0041.952] lstrlenW (lpString=".dbf") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".dbf") returned 0x0 [0041.952] lstrlenW (lpString=".ckp") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".ckp") returned 0x0 [0041.952] lstrlenW (lpString=".dacpac") returned 7 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".dacpac") returned 0x0 [0041.952] lstrlenW (lpString=".db3") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".db3") returned 0x0 [0041.952] lstrlenW (lpString=".dtxs") returned 5 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".dtxs") returned 0x0 [0041.952] lstrlenW (lpString=".mdt") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".mdt") returned 0x0 [0041.952] lstrlenW (lpString=".sdf") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".sdf") returned 0x0 [0041.952] lstrlenW (lpString=".MDF") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".MDF") returned 0x0 [0041.952] lstrlenW (lpString=".DBF") returned 4 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".DBF") returned 0x0 [0041.952] lstrlenW (lpString=".DB") returned 3 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".DB") returned 0x0 [0041.952] lstrlenW (lpString=".db") returned 3 [0041.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".db") returned 0x0 [0041.953] lstrlenW (lpString=".ndf") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".ndf") returned 0x0 [0041.953] lstrlenW (lpString=".NDF") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".NDF") returned 0x0 [0041.953] lstrlenW (lpString=".Mdf") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".Mdf") returned 0x0 [0041.953] lstrlenW (lpString=".dat") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".dat") returned 0x0 [0041.953] lstrlenW (lpString=".DAT") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".DAT") returned 0x0 [0041.953] lstrlenW (lpString=".ldf") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".ldf") returned 0x0 [0041.953] lstrlenW (lpString=".LDF") returned 4 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch=".LDF") returned 0x0 [0041.953] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.953] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.954] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.954] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.954] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16195553441) returned 1 [0041.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7d1fcf0, dwHighDateTime=0x1d585b4)) [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d710 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d710 | out: hHeap=0x260000) returned 1 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0041.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312f20 [0041.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0041.955] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.955] GetLastError () returned 0x0 [0041.955] GetLastError () returned 0x0 [0041.955] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.956] GetLastError () returned 0x0 [0041.956] GetLastError () returned 0x0 [0041.956] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.961] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.962] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.962] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.962] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.964] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.964] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.964] CloseHandle (hObject=0xfc) returned 1 [0041.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0041.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.966] GetLastError () returned 0x0 [0041.966] RtlWakeConditionVariable () returned 0x27e828 [0041.966] GetCurrentThreadId () returned 0x998 [0041.966] GetCurrentThreadId () returned 0x998 [0041.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0041.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d748 | out: hHeap=0x260000) returned 1 [0041.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.966] lstrlenW (lpString=".ldf") returned 4 [0041.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".ldf") returned 0x0 [0041.966] lstrlenW (lpString=".vhd") returned 4 [0041.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".vhd") returned 0x0 [0041.966] lstrlenW (lpString=".vhdx") returned 5 [0041.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".vhdx") returned 0x0 [0041.966] lstrlenW (lpString=".pst") returned 4 [0041.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".pst") returned 0x0 [0041.966] lstrlenW (lpString=".ost") returned 4 [0041.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".ost") returned 0x0 [0041.967] lstrlenW (lpString=".bak") returned 4 [0041.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".bak") returned 0x0 [0041.967] lstrlenW (lpString=".bac") returned 4 [0041.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".bac") returned 0x0 [0041.967] lstrlenW (lpString=".sys") returned 4 [0041.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".sys") returned 0x0 [0041.967] lstrlenW (lpString=".v2i") returned 4 [0041.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch=".v2i") returned 0x0 [0041.967] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0041.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0041.967] RtlWakeConditionVariable () returned 0x27e828 [0041.967] GetCurrentThreadId () returned 0x998 [0041.967] GetCurrentThreadId () returned 0x998 [0041.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313218 | out: hHeap=0x260000) returned 1 [0041.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d780 | out: hHeap=0x260000) returned 1 [0041.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313218 [0041.968] lstrlenW (lpString=".ldf") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".ldf") returned 0x0 [0041.968] lstrlenW (lpString=".vhd") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".vhd") returned 0x0 [0041.968] lstrlenW (lpString=".vhdx") returned 5 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".vhdx") returned 0x0 [0041.968] lstrlenW (lpString=".pst") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".pst") returned 0x0 [0041.968] lstrlenW (lpString=".ost") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".ost") returned 0x0 [0041.968] lstrlenW (lpString=".bak") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".bak") returned 0x0 [0041.968] lstrlenW (lpString=".bac") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".bac") returned 0x0 [0041.968] lstrlenW (lpString=".sys") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".sys") returned 0x0 [0041.968] lstrlenW (lpString=".v2i") returned 4 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".v2i") returned 0x0 [0041.968] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.969] lstrlenW (lpString=".sql") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".sql") returned 0x0 [0041.970] lstrlenW (lpString=".mdf") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".mdf") returned 0x0 [0041.970] lstrlenW (lpString=".txt") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".txt") returned 0x0 [0041.970] lstrlenW (lpString=".dbf") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".dbf") returned 0x0 [0041.970] lstrlenW (lpString=".ckp") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".ckp") returned 0x0 [0041.970] lstrlenW (lpString=".dacpac") returned 7 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".dacpac") returned 0x0 [0041.970] lstrlenW (lpString=".db3") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".db3") returned 0x0 [0041.970] lstrlenW (lpString=".dtxs") returned 5 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".dtxs") returned 0x0 [0041.970] lstrlenW (lpString=".mdt") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".mdt") returned 0x0 [0041.970] lstrlenW (lpString=".sdf") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".sdf") returned 0x0 [0041.970] lstrlenW (lpString=".MDF") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".MDF") returned 0x0 [0041.970] lstrlenW (lpString=".DBF") returned 4 [0041.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".DBF") returned 0x0 [0041.970] lstrlenW (lpString=".DB") returned 3 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".DB") returned 0x0 [0041.971] lstrlenW (lpString=".db") returned 3 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".db") returned 0x0 [0041.971] lstrlenW (lpString=".ndf") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".ndf") returned 0x0 [0041.971] lstrlenW (lpString=".NDF") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".NDF") returned 0x0 [0041.971] lstrlenW (lpString=".Mdf") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".Mdf") returned 0x0 [0041.971] lstrlenW (lpString=".dat") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".dat") returned 0x0 [0041.971] lstrlenW (lpString=".DAT") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".DAT") returned 0x0 [0041.971] lstrlenW (lpString=".ldf") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".ldf") returned 0x0 [0041.971] lstrlenW (lpString=".LDF") returned 4 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch=".LDF") returned 0x0 [0041.971] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.971] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.972] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.972] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.973] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16197376884) returned 1 [0041.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7d45e50, dwHighDateTime=0x1d585b4)) [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d780 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d780 | out: hHeap=0x260000) returned 1 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0041.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313180 [0041.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0041.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.973] GetLastError () returned 0x0 [0041.974] GetLastError () returned 0x0 [0041.974] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.974] GetLastError () returned 0x0 [0041.974] GetLastError () returned 0x0 [0041.974] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0xdb50, lpOverlapped=0x0) returned 1 [0041.976] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff24b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.976] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xdb50, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xdb50, lpOverlapped=0x0) returned 1 [0041.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.977] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.977] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.977] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.977] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.977] CloseHandle (hObject=0xfc) returned 1 [0041.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f0e8 [0041.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0e8 | out: hHeap=0x260000) returned 1 [0041.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0041.978] GetLastError () returned 0x0 [0041.978] RtlWakeConditionVariable () returned 0x27e828 [0041.978] GetCurrentThreadId () returned 0x998 [0041.978] GetCurrentThreadId () returned 0x998 [0041.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eff0 | out: hHeap=0x260000) returned 1 [0041.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7b8 | out: hHeap=0x260000) returned 1 [0041.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eff0 [0041.979] lstrlenW (lpString=".ldf") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".ldf") returned 0x0 [0041.979] lstrlenW (lpString=".vhd") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".vhd") returned 0x0 [0041.979] lstrlenW (lpString=".vhdx") returned 5 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".vhdx") returned 0x0 [0041.979] lstrlenW (lpString=".pst") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".pst") returned 0x0 [0041.979] lstrlenW (lpString=".ost") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".ost") returned 0x0 [0041.979] lstrlenW (lpString=".bak") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".bak") returned 0x0 [0041.979] lstrlenW (lpString=".bac") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".bac") returned 0x0 [0041.979] lstrlenW (lpString=".sys") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".sys") returned 0x0 [0041.979] lstrlenW (lpString=".v2i") returned 4 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".v2i") returned 0x0 [0041.979] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0041.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.981] lstrlenW (lpString=".sql") returned 4 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".sql") returned 0x0 [0041.981] lstrlenW (lpString=".mdf") returned 4 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".mdf") returned 0x0 [0041.981] lstrlenW (lpString=".txt") returned 4 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".txt") returned 0x0 [0041.981] lstrlenW (lpString=".dbf") returned 4 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".dbf") returned 0x0 [0041.981] lstrlenW (lpString=".ckp") returned 4 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".ckp") returned 0x0 [0041.981] lstrlenW (lpString=".dacpac") returned 7 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".dacpac") returned 0x0 [0041.981] lstrlenW (lpString=".db3") returned 4 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".db3") returned 0x0 [0041.981] lstrlenW (lpString=".dtxs") returned 5 [0041.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".dtxs") returned 0x0 [0041.982] lstrlenW (lpString=".mdt") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".mdt") returned 0x0 [0041.982] lstrlenW (lpString=".sdf") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".sdf") returned 0x0 [0041.982] lstrlenW (lpString=".MDF") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".MDF") returned 0x0 [0041.982] lstrlenW (lpString=".DBF") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".DBF") returned 0x0 [0041.982] lstrlenW (lpString=".DB") returned 3 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".DB") returned 0x0 [0041.982] lstrlenW (lpString=".db") returned 3 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".db") returned 0x0 [0041.982] lstrlenW (lpString=".ndf") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".ndf") returned 0x0 [0041.982] lstrlenW (lpString=".NDF") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".NDF") returned 0x0 [0041.982] lstrlenW (lpString=".Mdf") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".Mdf") returned 0x0 [0041.982] lstrlenW (lpString=".dat") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".dat") returned 0x0 [0041.982] lstrlenW (lpString=".DAT") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".DAT") returned 0x0 [0041.982] lstrlenW (lpString=".ldf") returned 4 [0041.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".ldf") returned 0x0 [0041.983] lstrlenW (lpString=".LDF") returned 4 [0041.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch=".LDF") returned 0x0 [0041.983] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.983] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0041.984] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.984] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.984] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16198509594) returned 1 [0041.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7d6bfb0, dwHighDateTime=0x1d585b4)) [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7b8 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7b8 | out: hHeap=0x260000) returned 1 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0041.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0041.985] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0041.985] GetLastError () returned 0x0 [0041.985] GetLastError () returned 0x0 [0041.985] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0041.985] GetLastError () returned 0x0 [0041.985] GetLastError () returned 0x0 [0041.985] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.995] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.995] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.996] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.996] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.997] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.997] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.997] CloseHandle (hObject=0xfc) returned 1 [0042.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f520 [0042.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f520 | out: hHeap=0x260000) returned 1 [0042.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.145] GetLastError () returned 0x0 [0042.146] RtlWakeConditionVariable () returned 0x27e828 [0042.146] GetCurrentThreadId () returned 0x998 [0042.146] GetCurrentThreadId () returned 0x998 [0042.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee518 | out: hHeap=0x260000) returned 1 [0042.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0042.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee518 [0042.146] lstrlenW (lpString=".ldf") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.146] lstrlenW (lpString=".vhd") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.146] lstrlenW (lpString=".vhdx") returned 5 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.146] lstrlenW (lpString=".pst") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.146] lstrlenW (lpString=".ost") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.146] lstrlenW (lpString=".bak") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.146] lstrlenW (lpString=".bac") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.146] lstrlenW (lpString=".sys") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.146] lstrlenW (lpString=".v2i") returned 4 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.146] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.147] lstrlenW (lpString=".sql") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.147] lstrlenW (lpString=".mdf") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.147] lstrlenW (lpString=".txt") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.147] lstrlenW (lpString=".dbf") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.147] lstrlenW (lpString=".ckp") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.147] lstrlenW (lpString=".dacpac") returned 7 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.147] lstrlenW (lpString=".db3") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.147] lstrlenW (lpString=".dtxs") returned 5 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.147] lstrlenW (lpString=".mdt") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.147] lstrlenW (lpString=".sdf") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.147] lstrlenW (lpString=".MDF") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.147] lstrlenW (lpString=".DBF") returned 4 [0042.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.147] lstrlenW (lpString=".DB") returned 3 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.148] lstrlenW (lpString=".db") returned 3 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.148] lstrlenW (lpString=".ndf") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.148] lstrlenW (lpString=".NDF") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.148] lstrlenW (lpString=".Mdf") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.148] lstrlenW (lpString=".dat") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.148] lstrlenW (lpString=".DAT") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.148] lstrlenW (lpString=".ldf") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.148] lstrlenW (lpString=".LDF") returned 4 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.148] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.148] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0042.149] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.149] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0042.149] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16215022247) returned 1 [0042.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7ee8d70, dwHighDateTime=0x1d585b4)) [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0042.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0042.150] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.150] GetLastError () returned 0x0 [0042.150] GetLastError () returned 0x0 [0042.150] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.150] GetLastError () returned 0x0 [0042.150] GetLastError () returned 0x0 [0042.150] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x73c, lpOverlapped=0x0) returned 1 [0042.153] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff8c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.153] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x73c, lpOverlapped=0x0) returned 1 [0042.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.153] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.153] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.153] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.153] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.154] CloseHandle (hObject=0x100) returned 1 [0042.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x299a90 [0042.154] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299a90 | out: hHeap=0x260000) returned 1 [0042.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.154] GetLastError () returned 0x0 [0042.154] RtlWakeConditionVariable () returned 0x27e828 [0042.154] GetCurrentThreadId () returned 0x998 [0042.154] GetCurrentThreadId () returned 0x998 [0042.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299bb8 | out: hHeap=0x260000) returned 1 [0042.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1aa0 | out: hHeap=0x260000) returned 1 [0042.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.157] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.157] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.157] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.157] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.158] CloseHandle (hObject=0x100) returned 1 [0042.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.158] RtlWakeConditionVariable () returned 0x27e828 [0042.158] GetCurrentThreadId () returned 0x998 [0042.158] GetCurrentThreadId () returned 0x998 [0042.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a48 | out: hHeap=0x260000) returned 1 [0042.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0042.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9a48 [0042.158] lstrlenW (lpString=".ldf") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".ldf") returned 0x0 [0042.158] lstrlenW (lpString=".vhd") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".vhd") returned 0x0 [0042.158] lstrlenW (lpString=".vhdx") returned 5 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".vhdx") returned 0x0 [0042.158] lstrlenW (lpString=".pst") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".pst") returned 0x0 [0042.158] lstrlenW (lpString=".ost") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".ost") returned 0x0 [0042.158] lstrlenW (lpString=".bak") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".bak") returned 0x0 [0042.158] lstrlenW (lpString=".bac") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".bac") returned 0x0 [0042.158] lstrlenW (lpString=".sys") returned 4 [0042.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".sys") returned 0x0 [0042.158] lstrlenW (lpString=".v2i") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".v2i") returned 0x0 [0042.159] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch="s\r\n.v2i") returned 0x0 [0042.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.159] lstrlenW (lpString=".sql") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".sql") returned 0x0 [0042.159] lstrlenW (lpString=".mdf") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".mdf") returned 0x0 [0042.159] lstrlenW (lpString=".txt") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".txt") returned 0x0 [0042.159] lstrlenW (lpString=".dbf") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".dbf") returned 0x0 [0042.159] lstrlenW (lpString=".ckp") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".ckp") returned 0x0 [0042.159] lstrlenW (lpString=".dacpac") returned 7 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".dacpac") returned 0x0 [0042.159] lstrlenW (lpString=".db3") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".db3") returned 0x0 [0042.159] lstrlenW (lpString=".dtxs") returned 5 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".dtxs") returned 0x0 [0042.159] lstrlenW (lpString=".mdt") returned 4 [0042.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".mdt") returned 0x0 [0042.159] lstrlenW (lpString=".sdf") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".sdf") returned 0x0 [0042.160] lstrlenW (lpString=".MDF") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".MDF") returned 0x0 [0042.160] lstrlenW (lpString=".DBF") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".DBF") returned 0x0 [0042.160] lstrlenW (lpString=".DB") returned 3 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".DB") returned 0x0 [0042.160] lstrlenW (lpString=".db") returned 3 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".db") returned 0x0 [0042.160] lstrlenW (lpString=".ndf") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".ndf") returned 0x0 [0042.160] lstrlenW (lpString=".NDF") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".NDF") returned 0x0 [0042.160] lstrlenW (lpString=".Mdf") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".Mdf") returned 0x0 [0042.160] lstrlenW (lpString=".dat") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".dat") returned 0x0 [0042.160] lstrlenW (lpString=".DAT") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".DAT") returned 0x0 [0042.160] lstrlenW (lpString=".ldf") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".ldf") returned 0x0 [0042.160] lstrlenW (lpString=".LDF") returned 4 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch=".LDF") returned 0x0 [0042.160] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.160] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0042.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.161] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0042.161] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16216240589) returned 1 [0042.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7f0eed0, dwHighDateTime=0x1d585b4)) [0042.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18a8 [0042.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0042.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0042.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0042.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.162] GetLastError () returned 0x0 [0042.162] GetLastError () returned 0x0 [0042.162] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.162] GetLastError () returned 0x0 [0042.162] GetLastError () returned 0x0 [0042.162] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.165] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.165] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.167] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.167] CloseHandle (hObject=0x100) returned 1 [0042.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.168] GetLastError () returned 0x0 [0042.168] RtlWakeConditionVariable () returned 0x27e828 [0042.168] GetCurrentThreadId () returned 0x998 [0042.168] GetCurrentThreadId () returned 0x998 [0042.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee260 | out: hHeap=0x260000) returned 1 [0042.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299910 | out: hHeap=0x260000) returned 1 [0042.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0042.168] lstrlenW (lpString=".ldf") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".ldf") returned 0x0 [0042.168] lstrlenW (lpString=".vhd") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".vhd") returned 0x0 [0042.168] lstrlenW (lpString=".vhdx") returned 5 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".vhdx") returned 0x0 [0042.168] lstrlenW (lpString=".pst") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".pst") returned 0x0 [0042.168] lstrlenW (lpString=".ost") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".ost") returned 0x0 [0042.168] lstrlenW (lpString=".bak") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".bak") returned 0x0 [0042.168] lstrlenW (lpString=".bac") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".bac") returned 0x0 [0042.168] lstrlenW (lpString=".sys") returned 4 [0042.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".sys") returned 0x0 [0042.169] lstrlenW (lpString=".v2i") returned 4 [0042.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".v2i") returned 0x0 [0042.169] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.170] lstrlenW (lpString=".sql") returned 4 [0042.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".sql") returned 0x0 [0042.170] lstrlenW (lpString=".mdf") returned 4 [0042.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".mdf") returned 0x0 [0042.170] lstrlenW (lpString=".txt") returned 4 [0042.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".txt") returned 0x0 [0042.170] lstrlenW (lpString=".dbf") returned 4 [0042.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".dbf") returned 0x0 [0042.170] lstrlenW (lpString=".ckp") returned 4 [0042.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".ckp") returned 0x0 [0042.171] lstrlenW (lpString=".dacpac") returned 7 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".dacpac") returned 0x0 [0042.171] lstrlenW (lpString=".db3") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".db3") returned 0x0 [0042.171] lstrlenW (lpString=".dtxs") returned 5 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".dtxs") returned 0x0 [0042.171] lstrlenW (lpString=".mdt") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".mdt") returned 0x0 [0042.171] lstrlenW (lpString=".sdf") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".sdf") returned 0x0 [0042.171] lstrlenW (lpString=".MDF") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".MDF") returned 0x0 [0042.171] lstrlenW (lpString=".DBF") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".DBF") returned 0x0 [0042.171] lstrlenW (lpString=".DB") returned 3 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".DB") returned 0x0 [0042.171] lstrlenW (lpString=".db") returned 3 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".db") returned 0x0 [0042.171] lstrlenW (lpString=".ndf") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".ndf") returned 0x0 [0042.171] lstrlenW (lpString=".NDF") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".NDF") returned 0x0 [0042.171] lstrlenW (lpString=".Mdf") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".Mdf") returned 0x0 [0042.171] lstrlenW (lpString=".dat") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".dat") returned 0x0 [0042.171] lstrlenW (lpString=".DAT") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".DAT") returned 0x0 [0042.171] lstrlenW (lpString=".ldf") returned 4 [0042.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".ldf") returned 0x0 [0042.171] lstrlenW (lpString=".LDF") returned 4 [0042.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch=".LDF") returned 0x0 [0042.172] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.172] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b3f18) returned 1 [0042.172] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.172] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0042.173] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16217369867) returned 1 [0042.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa7f35030, dwHighDateTime=0x1d585b4)) [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299910 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299910 | out: hHeap=0x260000) returned 1 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0042.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0042.173] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.173] GetLastError () returned 0x0 [0042.173] GetLastError () returned 0x0 [0042.173] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.173] GetLastError () returned 0x0 [0042.174] GetLastError () returned 0x0 [0042.174] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x3b78, lpOverlapped=0x0) returned 1 [0042.175] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc488, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.175] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3b78, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3b78, lpOverlapped=0x0) returned 1 [0042.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.175] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.175] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.176] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.176] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.176] CloseHandle (hObject=0x100) returned 1 [0042.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.176] GetLastError () returned 0x0 [0042.176] RtlWakeConditionVariable () returned 0x27e828 [0042.176] GetCurrentThreadId () returned 0x998 [0042.177] GetCurrentThreadId () returned 0x998 [0042.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee600 | out: hHeap=0x260000) returned 1 [0042.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0042.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee600 [0042.177] lstrlenW (lpString=".ldf") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".ldf") returned 0x0 [0042.177] lstrlenW (lpString=".vhd") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".vhd") returned 0x0 [0042.177] lstrlenW (lpString=".vhdx") returned 5 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".vhdx") returned 0x0 [0042.177] lstrlenW (lpString=".pst") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".pst") returned 0x0 [0042.177] lstrlenW (lpString=".ost") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".ost") returned 0x0 [0042.177] lstrlenW (lpString=".bak") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".bak") returned 0x0 [0042.177] lstrlenW (lpString=".bac") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".bac") returned 0x0 [0042.177] lstrlenW (lpString=".sys") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".sys") returned 0x0 [0042.177] lstrlenW (lpString=".v2i") returned 4 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".v2i") returned 0x0 [0042.177] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.306] lstrlenW (lpString=".sql") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".sql") returned 0x0 [0042.306] lstrlenW (lpString=".mdf") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".mdf") returned 0x0 [0042.306] lstrlenW (lpString=".txt") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".txt") returned 0x0 [0042.306] lstrlenW (lpString=".dbf") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".dbf") returned 0x0 [0042.306] lstrlenW (lpString=".ckp") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".ckp") returned 0x0 [0042.306] lstrlenW (lpString=".dacpac") returned 7 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".dacpac") returned 0x0 [0042.306] lstrlenW (lpString=".db3") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".db3") returned 0x0 [0042.306] lstrlenW (lpString=".dtxs") returned 5 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".dtxs") returned 0x0 [0042.306] lstrlenW (lpString=".mdt") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".mdt") returned 0x0 [0042.306] lstrlenW (lpString=".sdf") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".sdf") returned 0x0 [0042.306] lstrlenW (lpString=".MDF") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".MDF") returned 0x0 [0042.306] lstrlenW (lpString=".DBF") returned 4 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".DBF") returned 0x0 [0042.306] lstrlenW (lpString=".DB") returned 3 [0042.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".DB") returned 0x0 [0042.306] lstrlenW (lpString=".db") returned 3 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".db") returned 0x0 [0042.307] lstrlenW (lpString=".ndf") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".ndf") returned 0x0 [0042.307] lstrlenW (lpString=".NDF") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".NDF") returned 0x0 [0042.307] lstrlenW (lpString=".Mdf") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".Mdf") returned 0x0 [0042.307] lstrlenW (lpString=".dat") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".dat") returned 0x0 [0042.307] lstrlenW (lpString=".DAT") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".DAT") returned 0x0 [0042.307] lstrlenW (lpString=".ldf") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".ldf") returned 0x0 [0042.307] lstrlenW (lpString=".LDF") returned 4 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch=".LDF") returned 0x0 [0042.307] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.307] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b4118) returned 1 [0042.308] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.308] CryptReleaseContext (hProv=0x2b4118, dwFlags=0x0) returned 1 [0042.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0042.308] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16230937540) returned 1 [0042.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa808bc90, dwHighDateTime=0x1d585b4)) [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0380 [0042.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0380 | out: hHeap=0x260000) returned 1 [0042.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.309] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.309] GetLastError () returned 0x0 [0042.309] GetLastError () returned 0x0 [0042.309] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.309] GetLastError () returned 0x0 [0042.309] GetLastError () returned 0x0 [0042.310] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.313] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.313] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0042.314] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.314] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.315] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.315] CloseHandle (hObject=0x100) returned 1 [0042.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2ed9b0 [0042.316] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ed9b0 | out: hHeap=0x260000) returned 1 [0042.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.316] GetLastError () returned 0x0 [0042.316] RtlWakeConditionVariable () returned 0x27e828 [0042.316] GetCurrentThreadId () returned 0x998 [0042.316] GetCurrentThreadId () returned 0x998 [0042.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edad8 | out: hHeap=0x260000) returned 1 [0042.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0042.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.318] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.318] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.318] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.318] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.319] CloseHandle (hObject=0x100) returned 1 [0042.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.320] RtlWakeConditionVariable () returned 0x27e828 [0042.320] GetCurrentThreadId () returned 0x998 [0042.320] GetCurrentThreadId () returned 0x998 [0042.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eeff8 | out: hHeap=0x260000) returned 1 [0042.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0042.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eeff8 [0042.320] lstrlenW (lpString=".ldf") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".ldf") returned 0x0 [0042.320] lstrlenW (lpString=".vhd") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".vhd") returned 0x0 [0042.320] lstrlenW (lpString=".vhdx") returned 5 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".vhdx") returned 0x0 [0042.320] lstrlenW (lpString=".pst") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".pst") returned 0x0 [0042.320] lstrlenW (lpString=".ost") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".ost") returned 0x0 [0042.320] lstrlenW (lpString=".bak") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".bak") returned 0x0 [0042.320] lstrlenW (lpString=".bac") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".bac") returned 0x0 [0042.320] lstrlenW (lpString=".sys") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".sys") returned 0x0 [0042.320] lstrlenW (lpString=".v2i") returned 4 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".v2i") returned 0x0 [0042.320] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.321] lstrlenW (lpString=".sql") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".sql") returned 0x0 [0042.321] lstrlenW (lpString=".mdf") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".mdf") returned 0x0 [0042.321] lstrlenW (lpString=".txt") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".txt") returned 0x0 [0042.321] lstrlenW (lpString=".dbf") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".dbf") returned 0x0 [0042.321] lstrlenW (lpString=".ckp") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".ckp") returned 0x0 [0042.321] lstrlenW (lpString=".dacpac") returned 7 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".dacpac") returned 0x0 [0042.321] lstrlenW (lpString=".db3") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".db3") returned 0x0 [0042.321] lstrlenW (lpString=".dtxs") returned 5 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".dtxs") returned 0x0 [0042.321] lstrlenW (lpString=".mdt") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".mdt") returned 0x0 [0042.321] lstrlenW (lpString=".sdf") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".sdf") returned 0x0 [0042.321] lstrlenW (lpString=".MDF") returned 4 [0042.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".MDF") returned 0x0 [0042.322] lstrlenW (lpString=".DBF") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".DBF") returned 0x0 [0042.322] lstrlenW (lpString=".DB") returned 3 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".DB") returned 0x0 [0042.322] lstrlenW (lpString=".db") returned 3 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".db") returned 0x0 [0042.322] lstrlenW (lpString=".ndf") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".ndf") returned 0x0 [0042.322] lstrlenW (lpString=".NDF") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".NDF") returned 0x0 [0042.322] lstrlenW (lpString=".Mdf") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".Mdf") returned 0x0 [0042.322] lstrlenW (lpString=".dat") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".dat") returned 0x0 [0042.322] lstrlenW (lpString=".DAT") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".DAT") returned 0x0 [0042.322] lstrlenW (lpString=".ldf") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".ldf") returned 0x0 [0042.322] lstrlenW (lpString=".LDF") returned 4 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch=".LDF") returned 0x0 [0042.322] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.322] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b4118) returned 1 [0042.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.323] CryptReleaseContext (hProv=0x2b4118, dwFlags=0x0) returned 1 [0042.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0042.323] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16232435809) returned 1 [0042.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa80b1df0, dwHighDateTime=0x1d585b4)) [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949c0 [0042.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0042.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.324] GetLastError () returned 0x0 [0042.324] GetLastError () returned 0x0 [0042.324] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.324] GetLastError () returned 0x0 [0042.324] GetLastError () returned 0x0 [0042.324] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x1cffdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0042.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.326] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0042.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0042.326] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.326] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.326] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.326] CloseHandle (hObject=0x100) returned 1 [0042.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2f5320 [0042.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0042.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.327] GetLastError () returned 0x0 [0042.327] RtlWakeConditionVariable () returned 0x27e828 [0042.327] GetCurrentThreadId () returned 0x998 [0042.327] GetCurrentThreadId () returned 0x998 [0042.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3aa8 | out: hHeap=0x260000) returned 1 [0042.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294988 | out: hHeap=0x260000) returned 1 [0042.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.328] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.328] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.328] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.328] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.329] CloseHandle (hObject=0x100) returned 1 [0042.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.329] RtlWakeConditionVariable () returned 0x27e828 [0042.329] GetCurrentThreadId () returned 0x998 [0042.330] GetCurrentThreadId () returned 0x998 [0042.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3a28 [0042.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0042.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294cd0 | out: hHeap=0x260000) returned 1 [0042.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.330] lstrlenW (lpString=".ldf") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".ldf") returned 0x0 [0042.330] lstrlenW (lpString=".vhd") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".vhd") returned 0x0 [0042.330] lstrlenW (lpString=".vhdx") returned 5 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.330] lstrlenW (lpString=".pst") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".pst") returned 0x0 [0042.330] lstrlenW (lpString=".ost") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".ost") returned 0x0 [0042.330] lstrlenW (lpString=".bak") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".bak") returned 0x0 [0042.330] lstrlenW (lpString=".bac") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".bac") returned 0x0 [0042.330] lstrlenW (lpString=".sys") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".sys") returned 0x0 [0042.330] lstrlenW (lpString=".v2i") returned 4 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".v2i") returned 0x0 [0042.330] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.331] lstrlenW (lpString=".sql") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".sql") returned 0x0 [0042.331] lstrlenW (lpString=".mdf") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".mdf") returned 0x0 [0042.331] lstrlenW (lpString=".txt") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".txt") returned 0x0 [0042.331] lstrlenW (lpString=".dbf") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".dbf") returned 0x0 [0042.331] lstrlenW (lpString=".ckp") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".ckp") returned 0x0 [0042.331] lstrlenW (lpString=".dacpac") returned 7 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.331] lstrlenW (lpString=".db3") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".db3") returned 0x0 [0042.331] lstrlenW (lpString=".dtxs") returned 5 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.331] lstrlenW (lpString=".mdt") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".mdt") returned 0x0 [0042.331] lstrlenW (lpString=".sdf") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".sdf") returned 0x0 [0042.331] lstrlenW (lpString=".MDF") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".MDF") returned 0x0 [0042.331] lstrlenW (lpString=".DBF") returned 4 [0042.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".DBF") returned 0x0 [0042.331] lstrlenW (lpString=".DB") returned 3 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".DB") returned 0x0 [0042.332] lstrlenW (lpString=".db") returned 3 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".db") returned 0x0 [0042.332] lstrlenW (lpString=".ndf") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".ndf") returned 0x0 [0042.332] lstrlenW (lpString=".NDF") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".NDF") returned 0x0 [0042.332] lstrlenW (lpString=".Mdf") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.332] lstrlenW (lpString=".dat") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".dat") returned 0x0 [0042.332] lstrlenW (lpString=".DAT") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".DAT") returned 0x0 [0042.332] lstrlenW (lpString=".ldf") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".ldf") returned 0x0 [0042.332] lstrlenW (lpString=".LDF") returned 4 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch=".LDF") returned 0x0 [0042.332] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.332] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2b4118) returned 1 [0042.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.333] CryptReleaseContext (hProv=0x2b4118, dwFlags=0x0) returned 1 [0042.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0042.333] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16233424577) returned 1 [0042.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa80b1df0, dwHighDateTime=0x1d585b4)) [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294cd0 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294cd0 | out: hHeap=0x260000) returned 1 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.334] GetLastError () returned 0x0 [0042.334] GetLastError () returned 0x0 [0042.334] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.334] GetLastError () returned 0x0 [0042.334] GetLastError () returned 0x0 [0042.334] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x1cffdb0*=0x646, lpOverlapped=0x0) returned 1 [0042.335] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff9ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.336] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x646, lpOverlapped=0x0) returned 1 [0042.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0042.336] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.336] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.336] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.336] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.336] CloseHandle (hObject=0x100) returned 1 [0042.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2f5320 [0042.336] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0042.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.337] GetLastError () returned 0x0 [0042.337] RtlWakeConditionVariable () returned 0x27e828 [0042.337] GetCurrentThreadId () returned 0x998 [0042.337] GetCurrentThreadId () returned 0x998 [0042.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef0e0 | out: hHeap=0x260000) returned 1 [0042.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0042.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef0e0 [0042.337] lstrlenW (lpString=".ldf") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.337] lstrlenW (lpString=".vhd") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.337] lstrlenW (lpString=".vhdx") returned 5 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.337] lstrlenW (lpString=".pst") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.337] lstrlenW (lpString=".ost") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.337] lstrlenW (lpString=".bak") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.337] lstrlenW (lpString=".bac") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.337] lstrlenW (lpString=".sys") returned 4 [0042.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.338] lstrlenW (lpString=".v2i") returned 4 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.338] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.338] lstrlenW (lpString=".sql") returned 4 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.338] lstrlenW (lpString=".mdf") returned 4 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.338] lstrlenW (lpString=".txt") returned 4 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.338] lstrlenW (lpString=".dbf") returned 4 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.338] lstrlenW (lpString=".ckp") returned 4 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.338] lstrlenW (lpString=".dacpac") returned 7 [0042.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.339] lstrlenW (lpString=".db3") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.339] lstrlenW (lpString=".dtxs") returned 5 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.339] lstrlenW (lpString=".mdt") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.339] lstrlenW (lpString=".sdf") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.339] lstrlenW (lpString=".MDF") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.339] lstrlenW (lpString=".DBF") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.339] lstrlenW (lpString=".DB") returned 3 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.339] lstrlenW (lpString=".db") returned 3 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.339] lstrlenW (lpString=".ndf") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.339] lstrlenW (lpString=".NDF") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.339] lstrlenW (lpString=".Mdf") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.339] lstrlenW (lpString=".dat") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.339] lstrlenW (lpString=".DAT") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.339] lstrlenW (lpString=".ldf") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.339] lstrlenW (lpString=".LDF") returned 4 [0042.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.340] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3a28 [0042.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.340] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.340] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.340] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2794278 [0042.341] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16234168685) returned 1 [0042.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa80d7f50, dwHighDateTime=0x1d585b4)) [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.341] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.341] GetLastError () returned 0x0 [0042.341] GetLastError () returned 0x0 [0042.341] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.341] GetLastError () returned 0x0 [0042.342] GetLastError () returned 0x0 [0042.342] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x1cffdb0*=0x7c4, lpOverlapped=0x0) returned 1 [0042.356] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff83c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.357] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c4, lpOverlapped=0x0) returned 1 [0042.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0042.357] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.357] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.357] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.357] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.357] CloseHandle (hObject=0x100) returned 1 [0042.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b2d90 [0042.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0042.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.395] GetLastError () returned 0x0 [0042.395] RtlWakeConditionVariable () returned 0x27e828 [0042.395] GetCurrentThreadId () returned 0x998 [0042.395] GetCurrentThreadId () returned 0x998 [0042.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef2b0 | out: hHeap=0x260000) returned 1 [0042.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0042.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef2b0 [0042.395] lstrlenW (lpString=".ldf") returned 4 [0042.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0042.395] lstrlenW (lpString=".vhd") returned 4 [0042.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".vhd") returned 0x0 [0042.395] lstrlenW (lpString=".vhdx") returned 5 [0042.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".vhdx") returned 0x0 [0042.395] lstrlenW (lpString=".pst") returned 4 [0042.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".pst") returned 0x0 [0042.395] lstrlenW (lpString=".ost") returned 4 [0042.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".ost") returned 0x0 [0042.395] lstrlenW (lpString=".bak") returned 4 [0042.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".bak") returned 0x0 [0042.396] lstrlenW (lpString=".bac") returned 4 [0042.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".bac") returned 0x0 [0042.396] lstrlenW (lpString=".sys") returned 4 [0042.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".sys") returned 0x0 [0042.396] lstrlenW (lpString=".v2i") returned 4 [0042.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".v2i") returned 0x0 [0042.396] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch="s\r\n.v2i") returned 0x0 [0042.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.398] lstrlenW (lpString=".sql") returned 4 [0042.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".sql") returned 0x0 [0042.398] lstrlenW (lpString=".mdf") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".mdf") returned 0x0 [0042.399] lstrlenW (lpString=".txt") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0042.399] lstrlenW (lpString=".dbf") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".dbf") returned 0x0 [0042.399] lstrlenW (lpString=".ckp") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".ckp") returned 0x0 [0042.399] lstrlenW (lpString=".dacpac") returned 7 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".dacpac") returned 0x0 [0042.399] lstrlenW (lpString=".db3") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".db3") returned 0x0 [0042.399] lstrlenW (lpString=".dtxs") returned 5 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".dtxs") returned 0x0 [0042.399] lstrlenW (lpString=".mdt") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".mdt") returned 0x0 [0042.399] lstrlenW (lpString=".sdf") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".sdf") returned 0x0 [0042.399] lstrlenW (lpString=".MDF") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".MDF") returned 0x0 [0042.399] lstrlenW (lpString=".DBF") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".DBF") returned 0x0 [0042.399] lstrlenW (lpString=".DB") returned 3 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".DB") returned 0x0 [0042.399] lstrlenW (lpString=".db") returned 3 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".db") returned 0x0 [0042.399] lstrlenW (lpString=".ndf") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".ndf") returned 0x0 [0042.399] lstrlenW (lpString=".NDF") returned 4 [0042.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".NDF") returned 0x0 [0042.399] lstrlenW (lpString=".Mdf") returned 4 [0042.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".Mdf") returned 0x0 [0042.400] lstrlenW (lpString=".dat") returned 4 [0042.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".dat") returned 0x0 [0042.400] lstrlenW (lpString=".DAT") returned 4 [0042.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".DAT") returned 0x0 [0042.400] lstrlenW (lpString=".ldf") returned 4 [0042.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0042.400] lstrlenW (lpString=".LDF") returned 4 [0042.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch=".LDF") returned 0x0 [0042.400] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.400] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.401] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.401] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.401] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16240253308) returned 1 [0042.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa81704d0, dwHighDateTime=0x1d585b4)) [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294aa0 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.402] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.402] GetLastError () returned 0x0 [0042.402] GetLastError () returned 0x0 [0042.402] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.402] GetLastError () returned 0x0 [0042.402] GetLastError () returned 0x0 [0042.403] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.407] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.407] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.408] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.408] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.409] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.409] CloseHandle (hObject=0x100) returned 1 [0042.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.[deadmin@cock.li].deadmin")) returned 1 [0042.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.410] GetLastError () returned 0x0 [0042.410] RtlWakeConditionVariable () returned 0x27e828 [0042.410] GetCurrentThreadId () returned 0x998 [0042.410] GetCurrentThreadId () returned 0x998 [0042.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef398 | out: hHeap=0x260000) returned 1 [0042.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0042.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef398 [0042.411] lstrlenW (lpString=".ldf") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".ldf") returned 0x0 [0042.411] lstrlenW (lpString=".vhd") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".vhd") returned 0x0 [0042.411] lstrlenW (lpString=".vhdx") returned 5 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".vhdx") returned 0x0 [0042.411] lstrlenW (lpString=".pst") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".pst") returned 0x0 [0042.411] lstrlenW (lpString=".ost") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".ost") returned 0x0 [0042.411] lstrlenW (lpString=".bak") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".bak") returned 0x0 [0042.411] lstrlenW (lpString=".bac") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".bac") returned 0x0 [0042.411] lstrlenW (lpString=".sys") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".sys") returned 0x0 [0042.411] lstrlenW (lpString=".v2i") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".v2i") returned 0x0 [0042.411] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch="s\r\n.v2i") returned 0x0 [0042.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.411] lstrlenW (lpString=".sql") returned 4 [0042.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".sql") returned 0x0 [0042.412] lstrlenW (lpString=".mdf") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".mdf") returned 0x0 [0042.412] lstrlenW (lpString=".txt") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".txt") returned 0x0 [0042.412] lstrlenW (lpString=".dbf") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".dbf") returned 0x0 [0042.412] lstrlenW (lpString=".ckp") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".ckp") returned 0x0 [0042.412] lstrlenW (lpString=".dacpac") returned 7 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".dacpac") returned 0x0 [0042.412] lstrlenW (lpString=".db3") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".db3") returned 0x0 [0042.412] lstrlenW (lpString=".dtxs") returned 5 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".dtxs") returned 0x0 [0042.412] lstrlenW (lpString=".mdt") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".mdt") returned 0x0 [0042.412] lstrlenW (lpString=".sdf") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".sdf") returned 0x0 [0042.412] lstrlenW (lpString=".MDF") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".MDF") returned 0x0 [0042.412] lstrlenW (lpString=".DBF") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".DBF") returned 0x0 [0042.412] lstrlenW (lpString=".DB") returned 3 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".DB") returned 0x0 [0042.412] lstrlenW (lpString=".db") returned 3 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".db") returned 0x0 [0042.412] lstrlenW (lpString=".ndf") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".ndf") returned 0x0 [0042.412] lstrlenW (lpString=".NDF") returned 4 [0042.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".NDF") returned 0x0 [0042.412] lstrlenW (lpString=".Mdf") returned 4 [0042.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".Mdf") returned 0x0 [0042.413] lstrlenW (lpString=".dat") returned 4 [0042.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".dat") returned 0x0 [0042.413] lstrlenW (lpString=".DAT") returned 4 [0042.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".DAT") returned 0x0 [0042.413] lstrlenW (lpString=".ldf") returned 4 [0042.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".ldf") returned 0x0 [0042.413] lstrlenW (lpString=".LDF") returned 4 [0042.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch=".LDF") returned 0x0 [0042.413] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.413] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.414] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.414] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.414] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16241499896) returned 1 [0042.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa81704d0, dwHighDateTime=0x1d585b4)) [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b10 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.414] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.415] GetLastError () returned 0x0 [0042.415] GetLastError () returned 0x0 [0042.415] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.415] GetLastError () returned 0x0 [0042.415] GetLastError () returned 0x0 [0042.415] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x3d78, lpOverlapped=0x0) returned 1 [0042.418] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.418] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3d78, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3d78, lpOverlapped=0x0) returned 1 [0042.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.418] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.418] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.418] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.418] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.418] CloseHandle (hObject=0x100) returned 1 [0042.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.419] GetLastError () returned 0x0 [0042.419] RtlWakeConditionVariable () returned 0x27e828 [0042.419] GetCurrentThreadId () returned 0x998 [0042.419] GetCurrentThreadId () returned 0x998 [0042.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0042.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0042.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3838 [0042.419] lstrlenW (lpString=".ldf") returned 4 [0042.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".ldf") returned 0x0 [0042.419] lstrlenW (lpString=".vhd") returned 4 [0042.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".vhd") returned 0x0 [0042.419] lstrlenW (lpString=".vhdx") returned 5 [0042.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.419] lstrlenW (lpString=".pst") returned 4 [0042.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".pst") returned 0x0 [0042.420] lstrlenW (lpString=".ost") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".ost") returned 0x0 [0042.420] lstrlenW (lpString=".bak") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".bak") returned 0x0 [0042.420] lstrlenW (lpString=".bac") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".bac") returned 0x0 [0042.420] lstrlenW (lpString=".sys") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".sys") returned 0x0 [0042.420] lstrlenW (lpString=".v2i") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".v2i") returned 0x0 [0042.420] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.420] lstrlenW (lpString=".sql") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".sql") returned 0x0 [0042.420] lstrlenW (lpString=".mdf") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".mdf") returned 0x0 [0042.420] lstrlenW (lpString=".txt") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".txt") returned 0x0 [0042.420] lstrlenW (lpString=".dbf") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".dbf") returned 0x0 [0042.420] lstrlenW (lpString=".ckp") returned 4 [0042.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".ckp") returned 0x0 [0042.421] lstrlenW (lpString=".dacpac") returned 7 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.421] lstrlenW (lpString=".db3") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".db3") returned 0x0 [0042.421] lstrlenW (lpString=".dtxs") returned 5 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.421] lstrlenW (lpString=".mdt") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".mdt") returned 0x0 [0042.421] lstrlenW (lpString=".sdf") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".sdf") returned 0x0 [0042.421] lstrlenW (lpString=".MDF") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".MDF") returned 0x0 [0042.421] lstrlenW (lpString=".DBF") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".DBF") returned 0x0 [0042.421] lstrlenW (lpString=".DB") returned 3 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".DB") returned 0x0 [0042.421] lstrlenW (lpString=".db") returned 3 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".db") returned 0x0 [0042.421] lstrlenW (lpString=".ndf") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".ndf") returned 0x0 [0042.421] lstrlenW (lpString=".NDF") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".NDF") returned 0x0 [0042.421] lstrlenW (lpString=".Mdf") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.421] lstrlenW (lpString=".dat") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".dat") returned 0x0 [0042.421] lstrlenW (lpString=".DAT") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".DAT") returned 0x0 [0042.421] lstrlenW (lpString=".ldf") returned 4 [0042.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".ldf") returned 0x0 [0042.421] lstrlenW (lpString=".LDF") returned 4 [0042.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch=".LDF") returned 0x0 [0042.422] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.422] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.422] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.422] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.423] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16242372479) returned 1 [0042.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8196630, dwHighDateTime=0x1d585b4)) [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f58 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.423] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.423] GetLastError () returned 0x0 [0042.423] GetLastError () returned 0x0 [0042.423] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.423] GetLastError () returned 0x0 [0042.424] GetLastError () returned 0x0 [0042.424] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0042.425] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffa56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.425] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0042.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.425] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.425] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.425] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.426] CloseHandle (hObject=0x100) returned 1 [0042.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.426] GetLastError () returned 0x0 [0042.426] RtlWakeConditionVariable () returned 0x27e828 [0042.426] GetCurrentThreadId () returned 0x998 [0042.426] GetCurrentThreadId () returned 0x998 [0042.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef480 | out: hHeap=0x260000) returned 1 [0042.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0042.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef480 [0042.427] lstrlenW (lpString=".ldf") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.427] lstrlenW (lpString=".vhd") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.427] lstrlenW (lpString=".vhdx") returned 5 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.427] lstrlenW (lpString=".pst") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.427] lstrlenW (lpString=".ost") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.427] lstrlenW (lpString=".bak") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.427] lstrlenW (lpString=".bac") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.427] lstrlenW (lpString=".sys") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.427] lstrlenW (lpString=".v2i") returned 4 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.427] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.513] lstrlenW (lpString=".sql") returned 4 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.513] lstrlenW (lpString=".mdf") returned 4 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.513] lstrlenW (lpString=".txt") returned 4 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.513] lstrlenW (lpString=".dbf") returned 4 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.513] lstrlenW (lpString=".ckp") returned 4 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.513] lstrlenW (lpString=".dacpac") returned 7 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.513] lstrlenW (lpString=".db3") returned 4 [0042.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.513] lstrlenW (lpString=".dtxs") returned 5 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.514] lstrlenW (lpString=".mdt") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.514] lstrlenW (lpString=".sdf") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.514] lstrlenW (lpString=".MDF") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.514] lstrlenW (lpString=".DBF") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.514] lstrlenW (lpString=".DB") returned 3 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.514] lstrlenW (lpString=".db") returned 3 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.514] lstrlenW (lpString=".ndf") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.514] lstrlenW (lpString=".NDF") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.514] lstrlenW (lpString=".Mdf") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.514] lstrlenW (lpString=".dat") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.514] lstrlenW (lpString=".DAT") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.514] lstrlenW (lpString=".ldf") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.514] lstrlenW (lpString=".LDF") returned 4 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.514] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed9b0 [0042.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.515] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.515] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.515] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16251657785) returned 1 [0042.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa827ae70, dwHighDateTime=0x1d585b4)) [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295188 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.516] GetLastError () returned 0x0 [0042.516] GetLastError () returned 0x0 [0042.516] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.516] GetLastError () returned 0x0 [0042.516] GetLastError () returned 0x0 [0042.516] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x1cffdb0*=0x75e, lpOverlapped=0x0) returned 1 [0042.518] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.518] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x75e, lpOverlapped=0x0) returned 1 [0042.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.518] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.518] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.518] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.518] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.518] CloseHandle (hObject=0x100) returned 1 [0042.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2edae8 [0042.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edae8 | out: hHeap=0x260000) returned 1 [0042.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.521] GetLastError () returned 0x0 [0042.521] RtlWakeConditionVariable () returned 0x27e828 [0042.521] GetCurrentThreadId () returned 0x998 [0042.521] GetCurrentThreadId () returned 0x998 [0042.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0042.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fb08 | out: hHeap=0x260000) returned 1 [0042.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0042.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fb08 [0042.522] lstrlenW (lpString=".ldf") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".ldf") returned 0x0 [0042.522] lstrlenW (lpString=".vhd") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".vhd") returned 0x0 [0042.522] lstrlenW (lpString=".vhdx") returned 5 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".vhdx") returned 0x0 [0042.522] lstrlenW (lpString=".pst") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".pst") returned 0x0 [0042.522] lstrlenW (lpString=".ost") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".ost") returned 0x0 [0042.522] lstrlenW (lpString=".bak") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".bak") returned 0x0 [0042.522] lstrlenW (lpString=".bac") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".bac") returned 0x0 [0042.522] lstrlenW (lpString=".sys") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".sys") returned 0x0 [0042.522] lstrlenW (lpString=".v2i") returned 4 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".v2i") returned 0x0 [0042.522] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.523] lstrlenW (lpString=".sql") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".sql") returned 0x0 [0042.523] lstrlenW (lpString=".mdf") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".mdf") returned 0x0 [0042.523] lstrlenW (lpString=".txt") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".txt") returned 0x0 [0042.523] lstrlenW (lpString=".dbf") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".dbf") returned 0x0 [0042.523] lstrlenW (lpString=".ckp") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".ckp") returned 0x0 [0042.523] lstrlenW (lpString=".dacpac") returned 7 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".dacpac") returned 0x0 [0042.523] lstrlenW (lpString=".db3") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".db3") returned 0x0 [0042.523] lstrlenW (lpString=".dtxs") returned 5 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".dtxs") returned 0x0 [0042.523] lstrlenW (lpString=".mdt") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".mdt") returned 0x0 [0042.523] lstrlenW (lpString=".sdf") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".sdf") returned 0x0 [0042.523] lstrlenW (lpString=".MDF") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".MDF") returned 0x0 [0042.523] lstrlenW (lpString=".DBF") returned 4 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".DBF") returned 0x0 [0042.523] lstrlenW (lpString=".DB") returned 3 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".DB") returned 0x0 [0042.523] lstrlenW (lpString=".db") returned 3 [0042.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".db") returned 0x0 [0042.524] lstrlenW (lpString=".ndf") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".ndf") returned 0x0 [0042.524] lstrlenW (lpString=".NDF") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".NDF") returned 0x0 [0042.524] lstrlenW (lpString=".Mdf") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".Mdf") returned 0x0 [0042.524] lstrlenW (lpString=".dat") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".dat") returned 0x0 [0042.524] lstrlenW (lpString=".DAT") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".DAT") returned 0x0 [0042.524] lstrlenW (lpString=".ldf") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".ldf") returned 0x0 [0042.524] lstrlenW (lpString=".LDF") returned 4 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch=".LDF") returned 0x0 [0042.524] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed9b0 [0042.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.524] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.525] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.525] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16252736677) returned 1 [0042.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa82a0fd0, dwHighDateTime=0x1d585b4)) [0042.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295150 [0042.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0042.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.529] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.529] GetLastError () returned 0x0 [0042.529] GetLastError () returned 0x0 [0042.529] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.529] GetLastError () returned 0x0 [0042.529] GetLastError () returned 0x0 [0042.529] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x1cffdb0*=0x5b2, lpOverlapped=0x0) returned 1 [0042.531] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffa4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.531] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x5b2, lpOverlapped=0x0) returned 1 [0042.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.531] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.531] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.531] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.531] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.531] CloseHandle (hObject=0x100) returned 1 [0042.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2edae8 [0042.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edae8 | out: hHeap=0x260000) returned 1 [0042.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.532] GetLastError () returned 0x0 [0042.532] RtlWakeConditionVariable () returned 0x27e828 [0042.532] GetCurrentThreadId () returned 0x998 [0042.532] GetCurrentThreadId () returned 0x998 [0042.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2ed9b0 [0042.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295a98 | out: hHeap=0x260000) returned 1 [0042.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295070 | out: hHeap=0x260000) returned 1 [0042.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edaa8 [0042.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.533] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.533] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.533] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.533] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.534] CloseHandle (hObject=0x100) returned 1 [0042.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edaa8 | out: hHeap=0x260000) returned 1 [0042.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ed9b0 | out: hHeap=0x260000) returned 1 [0042.534] RtlWakeConditionVariable () returned 0x27e828 [0042.534] GetCurrentThreadId () returned 0x998 [0042.534] GetCurrentThreadId () returned 0x998 [0042.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef738 | out: hHeap=0x260000) returned 1 [0042.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0042.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef738 [0042.534] lstrlenW (lpString=".ldf") returned 4 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".ldf") returned 0x0 [0042.534] lstrlenW (lpString=".vhd") returned 4 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".vhd") returned 0x0 [0042.534] lstrlenW (lpString=".vhdx") returned 5 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".vhdx") returned 0x0 [0042.534] lstrlenW (lpString=".pst") returned 4 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".pst") returned 0x0 [0042.534] lstrlenW (lpString=".ost") returned 4 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".ost") returned 0x0 [0042.534] lstrlenW (lpString=".bak") returned 4 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".bak") returned 0x0 [0042.534] lstrlenW (lpString=".bac") returned 4 [0042.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".bac") returned 0x0 [0042.535] lstrlenW (lpString=".sys") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".sys") returned 0x0 [0042.535] lstrlenW (lpString=".v2i") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".v2i") returned 0x0 [0042.535] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.535] lstrlenW (lpString=".sql") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".sql") returned 0x0 [0042.535] lstrlenW (lpString=".mdf") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".mdf") returned 0x0 [0042.535] lstrlenW (lpString=".txt") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".txt") returned 0x0 [0042.535] lstrlenW (lpString=".dbf") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".dbf") returned 0x0 [0042.535] lstrlenW (lpString=".ckp") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".ckp") returned 0x0 [0042.535] lstrlenW (lpString=".dacpac") returned 7 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".dacpac") returned 0x0 [0042.535] lstrlenW (lpString=".db3") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".db3") returned 0x0 [0042.535] lstrlenW (lpString=".dtxs") returned 5 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".dtxs") returned 0x0 [0042.535] lstrlenW (lpString=".mdt") returned 4 [0042.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".mdt") returned 0x0 [0042.536] lstrlenW (lpString=".sdf") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".sdf") returned 0x0 [0042.536] lstrlenW (lpString=".MDF") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".MDF") returned 0x0 [0042.536] lstrlenW (lpString=".DBF") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".DBF") returned 0x0 [0042.536] lstrlenW (lpString=".DB") returned 3 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".DB") returned 0x0 [0042.536] lstrlenW (lpString=".db") returned 3 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".db") returned 0x0 [0042.536] lstrlenW (lpString=".ndf") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".ndf") returned 0x0 [0042.536] lstrlenW (lpString=".NDF") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".NDF") returned 0x0 [0042.536] lstrlenW (lpString=".Mdf") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".Mdf") returned 0x0 [0042.536] lstrlenW (lpString=".dat") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".dat") returned 0x0 [0042.536] lstrlenW (lpString=".DAT") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".DAT") returned 0x0 [0042.536] lstrlenW (lpString=".ldf") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".ldf") returned 0x0 [0042.536] lstrlenW (lpString=".LDF") returned 4 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch=".LDF") returned 0x0 [0042.536] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed9b0 [0042.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.536] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.537] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.537] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.537] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16253853812) returned 1 [0042.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa82a0fd0, dwHighDateTime=0x1d585b4)) [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295038 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.538] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.538] GetLastError () returned 0x0 [0042.538] GetLastError () returned 0x0 [0042.538] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.538] GetLastError () returned 0x0 [0042.538] GetLastError () returned 0x0 [0042.538] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x1cffdb0*=0x32b, lpOverlapped=0x0) returned 1 [0042.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffcd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.540] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x32b, lpOverlapped=0x0) returned 1 [0042.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.540] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.540] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.540] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.541] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.541] CloseHandle (hObject=0x100) returned 1 [0042.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2edae8 [0042.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edae8 | out: hHeap=0x260000) returned 1 [0042.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.541] GetLastError () returned 0x0 [0042.541] RtlWakeConditionVariable () returned 0x27e828 [0042.541] GetCurrentThreadId () returned 0x998 [0042.541] GetCurrentThreadId () returned 0x998 [0042.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef820 | out: hHeap=0x260000) returned 1 [0042.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0042.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef820 [0042.542] lstrlenW (lpString=".ldf") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.542] lstrlenW (lpString=".vhd") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.542] lstrlenW (lpString=".vhdx") returned 5 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.542] lstrlenW (lpString=".pst") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.542] lstrlenW (lpString=".ost") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.542] lstrlenW (lpString=".bak") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.542] lstrlenW (lpString=".bac") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.542] lstrlenW (lpString=".sys") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.542] lstrlenW (lpString=".v2i") returned 4 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.542] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.543] lstrlenW (lpString=".sql") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.543] lstrlenW (lpString=".mdf") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.543] lstrlenW (lpString=".txt") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.543] lstrlenW (lpString=".dbf") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.543] lstrlenW (lpString=".ckp") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.543] lstrlenW (lpString=".dacpac") returned 7 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.543] lstrlenW (lpString=".db3") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.543] lstrlenW (lpString=".dtxs") returned 5 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.543] lstrlenW (lpString=".mdt") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.543] lstrlenW (lpString=".sdf") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.543] lstrlenW (lpString=".MDF") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.543] lstrlenW (lpString=".DBF") returned 4 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.543] lstrlenW (lpString=".DB") returned 3 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.543] lstrlenW (lpString=".db") returned 3 [0042.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.543] lstrlenW (lpString=".ndf") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.544] lstrlenW (lpString=".NDF") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.544] lstrlenW (lpString=".Mdf") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.544] lstrlenW (lpString=".dat") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.544] lstrlenW (lpString=".DAT") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.544] lstrlenW (lpString=".ldf") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.544] lstrlenW (lpString=".LDF") returned 4 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.544] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed9b0 [0042.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.544] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.545] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.545] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16254615579) returned 1 [0042.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa82c7130, dwHighDateTime=0x1d585b4)) [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295000 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.546] GetLastError () returned 0x0 [0042.546] GetLastError () returned 0x0 [0042.546] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.546] GetLastError () returned 0x0 [0042.546] GetLastError () returned 0x0 [0042.546] ReadFile (in: hFile=0x100, lpBuffer=0x277c058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesRead=0x1cffdb0*=0x16fc, lpOverlapped=0x0) returned 1 [0042.626] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe904, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.626] WriteFile (in: hFile=0x100, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x16fc, lpOverlapped=0x0) returned 1 [0042.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0042.627] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.627] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.627] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.627] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.627] CloseHandle (hObject=0x100) returned 1 [0042.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.681] GetLastError () returned 0x0 [0042.681] RtlWakeConditionVariable () returned 0x27e828 [0042.681] GetCurrentThreadId () returned 0x998 [0042.681] GetCurrentThreadId () returned 0x998 [0042.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5590 | out: hHeap=0x260000) returned 1 [0042.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0042.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0042.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.793] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.793] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.793] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.793] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.794] CloseHandle (hObject=0x100) returned 1 [0042.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0042.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.794] RtlWakeConditionVariable () returned 0x27e828 [0042.794] GetCurrentThreadId () returned 0x998 [0042.794] GetCurrentThreadId () returned 0x998 [0042.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7128 [0042.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6fd8 | out: hHeap=0x260000) returned 1 [0042.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0042.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6fd8 [0042.794] lstrlenW (lpString=".ldf") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".ldf") returned 0x0 [0042.795] lstrlenW (lpString=".vhd") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".vhd") returned 0x0 [0042.795] lstrlenW (lpString=".vhdx") returned 5 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".vhdx") returned 0x0 [0042.795] lstrlenW (lpString=".pst") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".pst") returned 0x0 [0042.795] lstrlenW (lpString=".ost") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".ost") returned 0x0 [0042.795] lstrlenW (lpString=".bak") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".bak") returned 0x0 [0042.795] lstrlenW (lpString=".bac") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".bac") returned 0x0 [0042.795] lstrlenW (lpString=".sys") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".sys") returned 0x0 [0042.795] lstrlenW (lpString=".v2i") returned 4 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".v2i") returned 0x0 [0042.795] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.796] lstrlenW (lpString=".sql") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".sql") returned 0x0 [0042.796] lstrlenW (lpString=".mdf") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".mdf") returned 0x0 [0042.796] lstrlenW (lpString=".txt") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".txt") returned 0x0 [0042.796] lstrlenW (lpString=".dbf") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".dbf") returned 0x0 [0042.796] lstrlenW (lpString=".ckp") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".ckp") returned 0x0 [0042.796] lstrlenW (lpString=".dacpac") returned 7 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".dacpac") returned 0x0 [0042.796] lstrlenW (lpString=".db3") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".db3") returned 0x0 [0042.796] lstrlenW (lpString=".dtxs") returned 5 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".dtxs") returned 0x0 [0042.796] lstrlenW (lpString=".mdt") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".mdt") returned 0x0 [0042.796] lstrlenW (lpString=".sdf") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".sdf") returned 0x0 [0042.796] lstrlenW (lpString=".MDF") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".MDF") returned 0x0 [0042.796] lstrlenW (lpString=".DBF") returned 4 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".DBF") returned 0x0 [0042.796] lstrlenW (lpString=".DB") returned 3 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".DB") returned 0x0 [0042.796] lstrlenW (lpString=".db") returned 3 [0042.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".db") returned 0x0 [0042.796] lstrlenW (lpString=".ndf") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".ndf") returned 0x0 [0042.797] lstrlenW (lpString=".NDF") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".NDF") returned 0x0 [0042.797] lstrlenW (lpString=".Mdf") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".Mdf") returned 0x0 [0042.797] lstrlenW (lpString=".dat") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".dat") returned 0x0 [0042.797] lstrlenW (lpString=".DAT") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".DAT") returned 0x0 [0042.797] lstrlenW (lpString=".ldf") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".ldf") returned 0x0 [0042.797] lstrlenW (lpString=".LDF") returned 4 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch=".LDF") returned 0x0 [0042.797] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.797] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.798] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.798] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c058 [0042.798] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16279946938) returned 1 [0042.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8528730, dwHighDateTime=0x1d585b4)) [0042.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b10 [0042.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0042.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0042.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0042.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0042.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0042.799] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.799] GetLastError () returned 0x0 [0042.799] GetLastError () returned 0x0 [0042.799] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.799] GetLastError () returned 0x0 [0042.799] GetLastError () returned 0x0 [0042.800] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.878] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.878] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.880] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.880] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.898] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.898] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.898] CloseHandle (hObject=0x100) returned 1 [0042.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.899] GetLastError () returned 0x0 [0042.900] RtlWakeConditionVariable () returned 0x27e828 [0042.900] GetCurrentThreadId () returned 0x998 [0042.900] GetCurrentThreadId () returned 0x998 [0042.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7128 [0042.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6f30 | out: hHeap=0x260000) returned 1 [0042.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0042.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6f30 [0042.900] lstrlenW (lpString=".ldf") returned 4 [0042.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".ldf") returned 0x0 [0042.900] lstrlenW (lpString=".vhd") returned 4 [0042.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".vhd") returned 0x0 [0042.900] lstrlenW (lpString=".vhdx") returned 5 [0042.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".vhdx") returned 0x0 [0042.900] lstrlenW (lpString=".pst") returned 4 [0042.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".pst") returned 0x0 [0042.900] lstrlenW (lpString=".ost") returned 4 [0042.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".ost") returned 0x0 [0042.900] lstrlenW (lpString=".bak") returned 4 [0042.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".bak") returned 0x0 [0042.901] lstrlenW (lpString=".bac") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".bac") returned 0x0 [0042.901] lstrlenW (lpString=".sys") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".sys") returned 0x0 [0042.901] lstrlenW (lpString=".v2i") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".v2i") returned 0x0 [0042.901] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.901] lstrlenW (lpString=".sql") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".sql") returned 0x0 [0042.901] lstrlenW (lpString=".mdf") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".mdf") returned 0x0 [0042.901] lstrlenW (lpString=".txt") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".txt") returned 0x0 [0042.901] lstrlenW (lpString=".dbf") returned 4 [0042.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".dbf") returned 0x0 [0042.901] lstrlenW (lpString=".ckp") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".ckp") returned 0x0 [0042.902] lstrlenW (lpString=".dacpac") returned 7 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".dacpac") returned 0x0 [0042.902] lstrlenW (lpString=".db3") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".db3") returned 0x0 [0042.902] lstrlenW (lpString=".dtxs") returned 5 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".dtxs") returned 0x0 [0042.902] lstrlenW (lpString=".mdt") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".mdt") returned 0x0 [0042.902] lstrlenW (lpString=".sdf") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".sdf") returned 0x0 [0042.902] lstrlenW (lpString=".MDF") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".MDF") returned 0x0 [0042.902] lstrlenW (lpString=".DBF") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".DBF") returned 0x0 [0042.902] lstrlenW (lpString=".DB") returned 3 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".DB") returned 0x0 [0042.902] lstrlenW (lpString=".db") returned 3 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".db") returned 0x0 [0042.902] lstrlenW (lpString=".ndf") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".ndf") returned 0x0 [0042.902] lstrlenW (lpString=".NDF") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".NDF") returned 0x0 [0042.902] lstrlenW (lpString=".Mdf") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".Mdf") returned 0x0 [0042.902] lstrlenW (lpString=".dat") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".dat") returned 0x0 [0042.902] lstrlenW (lpString=".DAT") returned 4 [0042.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".DAT") returned 0x0 [0042.902] lstrlenW (lpString=".ldf") returned 4 [0042.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".ldf") returned 0x0 [0042.903] lstrlenW (lpString=".LDF") returned 4 [0042.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch=".LDF") returned 0x0 [0042.903] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.903] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.904] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.904] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x276a058 [0042.904] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16290486917) returned 1 [0042.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa86330d0, dwHighDateTime=0x1d585b4)) [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1950 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6fd8 [0042.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6fd8 | out: hHeap=0x260000) returned 1 [0042.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.904] GetLastError () returned 0x0 [0042.905] GetLastError () returned 0x0 [0042.905] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.905] GetLastError () returned 0x0 [0042.905] GetLastError () returned 0x0 [0042.905] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0xc150, lpOverlapped=0x0) returned 1 [0042.911] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff3eb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.911] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xc150, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xc150, lpOverlapped=0x0) returned 1 [0042.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.912] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.912] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.912] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.912] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.912] CloseHandle (hObject=0x100) returned 1 [0042.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.913] GetLastError () returned 0x0 [0042.913] RtlWakeConditionVariable () returned 0x27e828 [0042.913] GetCurrentThreadId () returned 0x998 [0042.913] GetCurrentThreadId () returned 0x998 [0042.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0042.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1988 | out: hHeap=0x260000) returned 1 [0042.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0042.913] lstrlenW (lpString=".ldf") returned 4 [0042.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".ldf") returned 0x0 [0042.913] lstrlenW (lpString=".vhd") returned 4 [0042.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".vhd") returned 0x0 [0042.913] lstrlenW (lpString=".vhdx") returned 5 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".vhdx") returned 0x0 [0042.914] lstrlenW (lpString=".pst") returned 4 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".pst") returned 0x0 [0042.914] lstrlenW (lpString=".ost") returned 4 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".ost") returned 0x0 [0042.914] lstrlenW (lpString=".bak") returned 4 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".bak") returned 0x0 [0042.914] lstrlenW (lpString=".bac") returned 4 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".bac") returned 0x0 [0042.914] lstrlenW (lpString=".sys") returned 4 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".sys") returned 0x0 [0042.914] lstrlenW (lpString=".v2i") returned 4 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".v2i") returned 0x0 [0042.914] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.915] lstrlenW (lpString=".sql") returned 4 [0042.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".sql") returned 0x0 [0042.915] lstrlenW (lpString=".mdf") returned 4 [0042.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".mdf") returned 0x0 [0042.915] lstrlenW (lpString=".txt") returned 4 [0042.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".txt") returned 0x0 [0042.915] lstrlenW (lpString=".dbf") returned 4 [0042.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".dbf") returned 0x0 [0042.915] lstrlenW (lpString=".ckp") returned 4 [0042.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".ckp") returned 0x0 [0042.915] lstrlenW (lpString=".dacpac") returned 7 [0042.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".dacpac") returned 0x0 [0042.915] lstrlenW (lpString=".db3") returned 4 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".db3") returned 0x0 [0042.916] lstrlenW (lpString=".dtxs") returned 5 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".dtxs") returned 0x0 [0042.916] lstrlenW (lpString=".mdt") returned 4 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".mdt") returned 0x0 [0042.916] lstrlenW (lpString=".sdf") returned 4 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".sdf") returned 0x0 [0042.916] lstrlenW (lpString=".MDF") returned 4 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".MDF") returned 0x0 [0042.916] lstrlenW (lpString=".DBF") returned 4 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".DBF") returned 0x0 [0042.916] lstrlenW (lpString=".DB") returned 3 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".DB") returned 0x0 [0042.916] lstrlenW (lpString=".db") returned 3 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".db") returned 0x0 [0042.916] lstrlenW (lpString=".ndf") returned 4 [0042.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".ndf") returned 0x0 [0042.917] lstrlenW (lpString=".NDF") returned 4 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".NDF") returned 0x0 [0042.917] lstrlenW (lpString=".Mdf") returned 4 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".Mdf") returned 0x0 [0042.917] lstrlenW (lpString=".dat") returned 4 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".dat") returned 0x0 [0042.917] lstrlenW (lpString=".DAT") returned 4 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".DAT") returned 0x0 [0042.917] lstrlenW (lpString=".ldf") returned 4 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".ldf") returned 0x0 [0042.917] lstrlenW (lpString=".LDF") returned 4 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch=".LDF") returned 0x0 [0042.917] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.917] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.918] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.918] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2769050 [0042.918] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16292010919) returned 1 [0042.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8659230, dwHighDateTime=0x1d585b4)) [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1988 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1988 | out: hHeap=0x260000) returned 1 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296398 [0042.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.919] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.920] GetLastError () returned 0x0 [0042.920] GetLastError () returned 0x0 [0042.920] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.920] GetLastError () returned 0x0 [0042.920] GetLastError () returned 0x0 [0042.920] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.922] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.922] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.923] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.923] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.923] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.923] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.923] CloseHandle (hObject=0x100) returned 1 [0042.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.925] GetLastError () returned 0x0 [0042.925] RtlWakeConditionVariable () returned 0x27e828 [0042.925] GetCurrentThreadId () returned 0x998 [0042.925] GetCurrentThreadId () returned 0x998 [0042.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2120 | out: hHeap=0x260000) returned 1 [0042.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19c0 | out: hHeap=0x260000) returned 1 [0042.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2120 [0042.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.926] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.926] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.926] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.926] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.927] CloseHandle (hObject=0x100) returned 1 [0042.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2120 | out: hHeap=0x260000) returned 1 [0042.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0042.927] RtlWakeConditionVariable () returned 0x27e828 [0042.927] GetCurrentThreadId () returned 0x998 [0042.927] GetCurrentThreadId () returned 0x998 [0042.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9fc0 | out: hHeap=0x260000) returned 1 [0042.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0042.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9fc0 [0042.928] lstrlenW (lpString=".ldf") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".ldf") returned 0x0 [0042.928] lstrlenW (lpString=".vhd") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".vhd") returned 0x0 [0042.928] lstrlenW (lpString=".vhdx") returned 5 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".vhdx") returned 0x0 [0042.928] lstrlenW (lpString=".pst") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".pst") returned 0x0 [0042.928] lstrlenW (lpString=".ost") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".ost") returned 0x0 [0042.928] lstrlenW (lpString=".bak") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".bak") returned 0x0 [0042.928] lstrlenW (lpString=".bac") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".bac") returned 0x0 [0042.928] lstrlenW (lpString=".sys") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".sys") returned 0x0 [0042.928] lstrlenW (lpString=".v2i") returned 4 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".v2i") returned 0x0 [0042.928] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.929] lstrlenW (lpString=".sql") returned 4 [0042.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".sql") returned 0x0 [0042.929] lstrlenW (lpString=".mdf") returned 4 [0042.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".mdf") returned 0x0 [0042.929] lstrlenW (lpString=".txt") returned 4 [0042.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".txt") returned 0x0 [0042.929] lstrlenW (lpString=".dbf") returned 4 [0042.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".dbf") returned 0x0 [0042.929] lstrlenW (lpString=".ckp") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".ckp") returned 0x0 [0042.930] lstrlenW (lpString=".dacpac") returned 7 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".dacpac") returned 0x0 [0042.930] lstrlenW (lpString=".db3") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".db3") returned 0x0 [0042.930] lstrlenW (lpString=".dtxs") returned 5 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".dtxs") returned 0x0 [0042.930] lstrlenW (lpString=".mdt") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".mdt") returned 0x0 [0042.930] lstrlenW (lpString=".sdf") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".sdf") returned 0x0 [0042.930] lstrlenW (lpString=".MDF") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".MDF") returned 0x0 [0042.930] lstrlenW (lpString=".DBF") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".DBF") returned 0x0 [0042.930] lstrlenW (lpString=".DB") returned 3 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".DB") returned 0x0 [0042.930] lstrlenW (lpString=".db") returned 3 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".db") returned 0x0 [0042.930] lstrlenW (lpString=".ndf") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".ndf") returned 0x0 [0042.930] lstrlenW (lpString=".NDF") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".NDF") returned 0x0 [0042.930] lstrlenW (lpString=".Mdf") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".Mdf") returned 0x0 [0042.930] lstrlenW (lpString=".dat") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".dat") returned 0x0 [0042.930] lstrlenW (lpString=".DAT") returned 4 [0042.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".DAT") returned 0x0 [0042.930] lstrlenW (lpString=".ldf") returned 4 [0042.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".ldf") returned 0x0 [0042.931] lstrlenW (lpString=".LDF") returned 4 [0042.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch=".LDF") returned 0x0 [0042.931] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.931] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.932] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.932] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2769050 [0042.932] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16293299180) returned 1 [0042.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa867f390, dwHighDateTime=0x1d585b4)) [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19f8 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.932] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.933] GetLastError () returned 0x0 [0042.933] GetLastError () returned 0x0 [0042.933] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.933] GetLastError () returned 0x0 [0042.933] GetLastError () returned 0x0 [0042.933] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.935] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.935] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.936] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.936] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.936] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.936] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.936] CloseHandle (hObject=0x100) returned 1 [0042.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3fe0 [0042.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.937] GetLastError () returned 0x0 [0042.937] RtlWakeConditionVariable () returned 0x27e828 [0042.937] GetCurrentThreadId () returned 0x998 [0042.937] GetCurrentThreadId () returned 0x998 [0042.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0042.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0042.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0042.937] lstrlenW (lpString=".ldf") returned 4 [0042.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".ldf") returned 0x0 [0042.937] lstrlenW (lpString=".vhd") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".vhd") returned 0x0 [0042.938] lstrlenW (lpString=".vhdx") returned 5 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".vhdx") returned 0x0 [0042.938] lstrlenW (lpString=".pst") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".pst") returned 0x0 [0042.938] lstrlenW (lpString=".ost") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".ost") returned 0x0 [0042.938] lstrlenW (lpString=".bak") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".bak") returned 0x0 [0042.938] lstrlenW (lpString=".bac") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".bac") returned 0x0 [0042.938] lstrlenW (lpString=".sys") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".sys") returned 0x0 [0042.938] lstrlenW (lpString=".v2i") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".v2i") returned 0x0 [0042.938] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.938] lstrlenW (lpString=".sql") returned 4 [0042.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".sql") returned 0x0 [0042.938] lstrlenW (lpString=".mdf") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".mdf") returned 0x0 [0042.939] lstrlenW (lpString=".txt") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".txt") returned 0x0 [0042.939] lstrlenW (lpString=".dbf") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".dbf") returned 0x0 [0042.939] lstrlenW (lpString=".ckp") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".ckp") returned 0x0 [0042.939] lstrlenW (lpString=".dacpac") returned 7 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".dacpac") returned 0x0 [0042.939] lstrlenW (lpString=".db3") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".db3") returned 0x0 [0042.939] lstrlenW (lpString=".dtxs") returned 5 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".dtxs") returned 0x0 [0042.939] lstrlenW (lpString=".mdt") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".mdt") returned 0x0 [0042.939] lstrlenW (lpString=".sdf") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".sdf") returned 0x0 [0042.939] lstrlenW (lpString=".MDF") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".MDF") returned 0x0 [0042.939] lstrlenW (lpString=".DBF") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".DBF") returned 0x0 [0042.939] lstrlenW (lpString=".DB") returned 3 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".DB") returned 0x0 [0042.939] lstrlenW (lpString=".db") returned 3 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".db") returned 0x0 [0042.939] lstrlenW (lpString=".ndf") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".ndf") returned 0x0 [0042.939] lstrlenW (lpString=".NDF") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".NDF") returned 0x0 [0042.939] lstrlenW (lpString=".Mdf") returned 4 [0042.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".Mdf") returned 0x0 [0042.940] lstrlenW (lpString=".dat") returned 4 [0042.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".dat") returned 0x0 [0042.940] lstrlenW (lpString=".DAT") returned 4 [0042.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".DAT") returned 0x0 [0042.940] lstrlenW (lpString=".ldf") returned 4 [0042.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".ldf") returned 0x0 [0042.940] lstrlenW (lpString=".LDF") returned 4 [0042.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch=".LDF") returned 0x0 [0042.940] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.940] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0042.941] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.941] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2769050 [0042.941] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16294190835) returned 1 [0042.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa867f390, dwHighDateTime=0x1d585b4)) [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1758 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.941] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.941] GetLastError () returned 0x0 [0042.942] GetLastError () returned 0x0 [0042.942] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0042.942] GetLastError () returned 0x0 [0042.942] GetLastError () returned 0x0 [0042.942] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.945] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.945] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.946] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.994] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.994] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.994] CloseHandle (hObject=0x100) returned 1 [0042.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.995] GetLastError () returned 0x0 [0042.995] RtlWakeConditionVariable () returned 0x27e828 [0042.995] GetCurrentThreadId () returned 0x998 [0042.995] GetCurrentThreadId () returned 0x998 [0042.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9fc0 [0042.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b10 | out: hHeap=0x260000) returned 1 [0042.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b48 | out: hHeap=0x260000) returned 1 [0042.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9b10 [0042.995] lstrlenW (lpString=".ldf") returned 4 [0042.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".ldf") returned 0x0 [0042.995] lstrlenW (lpString=".vhd") returned 4 [0042.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".vhd") returned 0x0 [0042.995] lstrlenW (lpString=".vhdx") returned 5 [0042.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".vhdx") returned 0x0 [0042.996] lstrlenW (lpString=".pst") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".pst") returned 0x0 [0042.996] lstrlenW (lpString=".ost") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".ost") returned 0x0 [0042.996] lstrlenW (lpString=".bak") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".bak") returned 0x0 [0042.996] lstrlenW (lpString=".bac") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".bac") returned 0x0 [0042.996] lstrlenW (lpString=".sys") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".sys") returned 0x0 [0042.996] lstrlenW (lpString=".v2i") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".v2i") returned 0x0 [0042.996] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.996] lstrlenW (lpString=".sql") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".sql") returned 0x0 [0042.996] lstrlenW (lpString=".mdf") returned 4 [0042.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".mdf") returned 0x0 [0042.996] lstrlenW (lpString=".txt") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".txt") returned 0x0 [0042.997] lstrlenW (lpString=".dbf") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".dbf") returned 0x0 [0042.997] lstrlenW (lpString=".ckp") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".ckp") returned 0x0 [0042.997] lstrlenW (lpString=".dacpac") returned 7 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".dacpac") returned 0x0 [0042.997] lstrlenW (lpString=".db3") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".db3") returned 0x0 [0042.997] lstrlenW (lpString=".dtxs") returned 5 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".dtxs") returned 0x0 [0042.997] lstrlenW (lpString=".mdt") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".mdt") returned 0x0 [0042.997] lstrlenW (lpString=".sdf") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".sdf") returned 0x0 [0042.997] lstrlenW (lpString=".MDF") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".MDF") returned 0x0 [0042.997] lstrlenW (lpString=".DBF") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".DBF") returned 0x0 [0042.997] lstrlenW (lpString=".DB") returned 3 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".DB") returned 0x0 [0042.997] lstrlenW (lpString=".db") returned 3 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".db") returned 0x0 [0042.997] lstrlenW (lpString=".ndf") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".ndf") returned 0x0 [0042.997] lstrlenW (lpString=".NDF") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".NDF") returned 0x0 [0042.997] lstrlenW (lpString=".Mdf") returned 4 [0042.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".Mdf") returned 0x0 [0042.997] lstrlenW (lpString=".dat") returned 4 [0042.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".dat") returned 0x0 [0042.998] lstrlenW (lpString=".DAT") returned 4 [0042.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".DAT") returned 0x0 [0042.998] lstrlenW (lpString=".ldf") returned 4 [0042.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".ldf") returned 0x0 [0042.998] lstrlenW (lpString=".LDF") returned 4 [0042.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch=".LDF") returned 0x0 [0042.998] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.998] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310c08) returned 1 [0042.999] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.999] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0042.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2769050 [0042.999] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16299990870) returned 1 [0042.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8717910, dwHighDateTime=0x1d585b4)) [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b48 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b48 | out: hHeap=0x260000) returned 1 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0042.999] GetLastError () returned 0x0 [0043.000] GetLastError () returned 0x0 [0043.000] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.000] GetLastError () returned 0x0 [0043.000] GetLastError () returned 0x0 [0043.000] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.123] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.124] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.124] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.146] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.146] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.146] CloseHandle (hObject=0x100) returned 1 [0043.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0043.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0043.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.147] GetLastError () returned 0x0 [0043.147] RtlWakeConditionVariable () returned 0x27e828 [0043.147] GetCurrentThreadId () returned 0x998 [0043.147] GetCurrentThreadId () returned 0x998 [0043.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0043.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0043.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8178 | out: hHeap=0x260000) returned 1 [0043.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0043.148] lstrlenW (lpString=".ldf") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".ldf") returned 0x0 [0043.148] lstrlenW (lpString=".vhd") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".vhd") returned 0x0 [0043.148] lstrlenW (lpString=".vhdx") returned 5 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".vhdx") returned 0x0 [0043.148] lstrlenW (lpString=".pst") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".pst") returned 0x0 [0043.148] lstrlenW (lpString=".ost") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".ost") returned 0x0 [0043.148] lstrlenW (lpString=".bak") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".bak") returned 0x0 [0043.148] lstrlenW (lpString=".bac") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".bac") returned 0x0 [0043.148] lstrlenW (lpString=".sys") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".sys") returned 0x0 [0043.148] lstrlenW (lpString=".v2i") returned 4 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".v2i") returned 0x0 [0043.148] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.358] lstrlenW (lpString=".sql") returned 4 [0043.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".sql") returned 0x0 [0043.358] lstrlenW (lpString=".mdf") returned 4 [0043.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".mdf") returned 0x0 [0043.358] lstrlenW (lpString=".txt") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".txt") returned 0x0 [0043.359] lstrlenW (lpString=".dbf") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".dbf") returned 0x0 [0043.359] lstrlenW (lpString=".ckp") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".ckp") returned 0x0 [0043.359] lstrlenW (lpString=".dacpac") returned 7 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".dacpac") returned 0x0 [0043.359] lstrlenW (lpString=".db3") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".db3") returned 0x0 [0043.359] lstrlenW (lpString=".dtxs") returned 5 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".dtxs") returned 0x0 [0043.359] lstrlenW (lpString=".mdt") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".mdt") returned 0x0 [0043.359] lstrlenW (lpString=".sdf") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".sdf") returned 0x0 [0043.359] lstrlenW (lpString=".MDF") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".MDF") returned 0x0 [0043.359] lstrlenW (lpString=".DBF") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".DBF") returned 0x0 [0043.359] lstrlenW (lpString=".DB") returned 3 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".DB") returned 0x0 [0043.359] lstrlenW (lpString=".db") returned 3 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".db") returned 0x0 [0043.359] lstrlenW (lpString=".ndf") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".ndf") returned 0x0 [0043.359] lstrlenW (lpString=".NDF") returned 4 [0043.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".NDF") returned 0x0 [0043.359] lstrlenW (lpString=".Mdf") returned 4 [0043.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".Mdf") returned 0x0 [0043.360] lstrlenW (lpString=".dat") returned 4 [0043.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".dat") returned 0x0 [0043.360] lstrlenW (lpString=".DAT") returned 4 [0043.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".DAT") returned 0x0 [0043.360] lstrlenW (lpString=".ldf") returned 4 [0043.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".ldf") returned 0x0 [0043.360] lstrlenW (lpString=".LDF") returned 4 [0043.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch=".LDF") returned 0x0 [0043.360] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.360] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.361] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.361] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.361] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16336232931) returned 1 [0043.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8a838b0, dwHighDateTime=0x1d585b4)) [0043.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8108 [0043.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8108 | out: hHeap=0x260000) returned 1 [0043.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b880 [0043.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b880 | out: hHeap=0x260000) returned 1 [0043.362] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.362] GetLastError () returned 0x0 [0043.362] GetLastError () returned 0x0 [0043.362] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.362] GetLastError () returned 0x0 [0043.362] GetLastError () returned 0x0 [0043.363] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.366] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.367] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.367] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.367] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.367] CloseHandle (hObject=0xf0) returned 1 [0043.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.367] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.368] GetLastError () returned 0x0 [0043.368] RtlWakeConditionVariable () returned 0x27e828 [0043.368] GetCurrentThreadId () returned 0x998 [0043.368] GetCurrentThreadId () returned 0x998 [0043.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2971d8 | out: hHeap=0x260000) returned 1 [0043.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d80d0 | out: hHeap=0x260000) returned 1 [0043.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.369] lstrlenW (lpString=".ldf") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".ldf") returned 0x0 [0043.369] lstrlenW (lpString=".vhd") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".vhd") returned 0x0 [0043.369] lstrlenW (lpString=".vhdx") returned 5 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".vhdx") returned 0x0 [0043.369] lstrlenW (lpString=".pst") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".pst") returned 0x0 [0043.369] lstrlenW (lpString=".ost") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".ost") returned 0x0 [0043.369] lstrlenW (lpString=".bak") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".bak") returned 0x0 [0043.369] lstrlenW (lpString=".bac") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".bac") returned 0x0 [0043.369] lstrlenW (lpString=".sys") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".sys") returned 0x0 [0043.369] lstrlenW (lpString=".v2i") returned 4 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".v2i") returned 0x0 [0043.369] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.370] lstrlenW (lpString=".sql") returned 4 [0043.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".sql") returned 0x0 [0043.370] lstrlenW (lpString=".mdf") returned 4 [0043.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".mdf") returned 0x0 [0043.370] lstrlenW (lpString=".txt") returned 4 [0043.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".txt") returned 0x0 [0043.370] lstrlenW (lpString=".dbf") returned 4 [0043.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".dbf") returned 0x0 [0043.370] lstrlenW (lpString=".ckp") returned 4 [0043.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".ckp") returned 0x0 [0043.371] lstrlenW (lpString=".dacpac") returned 7 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".dacpac") returned 0x0 [0043.371] lstrlenW (lpString=".db3") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".db3") returned 0x0 [0043.371] lstrlenW (lpString=".dtxs") returned 5 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".dtxs") returned 0x0 [0043.371] lstrlenW (lpString=".mdt") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".mdt") returned 0x0 [0043.371] lstrlenW (lpString=".sdf") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".sdf") returned 0x0 [0043.371] lstrlenW (lpString=".MDF") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".MDF") returned 0x0 [0043.371] lstrlenW (lpString=".DBF") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".DBF") returned 0x0 [0043.371] lstrlenW (lpString=".DB") returned 3 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".DB") returned 0x0 [0043.371] lstrlenW (lpString=".db") returned 3 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".db") returned 0x0 [0043.371] lstrlenW (lpString=".ndf") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".ndf") returned 0x0 [0043.371] lstrlenW (lpString=".NDF") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".NDF") returned 0x0 [0043.371] lstrlenW (lpString=".Mdf") returned 4 [0043.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".Mdf") returned 0x0 [0043.372] lstrlenW (lpString=".dat") returned 4 [0043.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".dat") returned 0x0 [0043.372] lstrlenW (lpString=".DAT") returned 4 [0043.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".DAT") returned 0x0 [0043.372] lstrlenW (lpString=".ldf") returned 4 [0043.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".ldf") returned 0x0 [0043.372] lstrlenW (lpString=".LDF") returned 4 [0043.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch=".LDF") returned 0x0 [0043.372] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.372] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.373] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.373] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.373] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16337525543) returned 1 [0043.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8aa9a10, dwHighDateTime=0x1d585b4)) [0043.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d80d0 [0043.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d80d0 | out: hHeap=0x260000) returned 1 [0043.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0043.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0043.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0043.375] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.375] GetLastError () returned 0x0 [0043.375] GetLastError () returned 0x0 [0043.375] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.375] GetLastError () returned 0x0 [0043.375] GetLastError () returned 0x0 [0043.375] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.380] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.381] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.381] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.381] CloseHandle (hObject=0xf0) returned 1 [0043.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.382] GetLastError () returned 0x0 [0043.382] RtlWakeConditionVariable () returned 0x27e828 [0043.382] GetCurrentThreadId () returned 0x998 [0043.382] GetCurrentThreadId () returned 0x998 [0043.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2977c8 | out: hHeap=0x260000) returned 1 [0043.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8098 | out: hHeap=0x260000) returned 1 [0043.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.383] lstrlenW (lpString=".ldf") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".ldf") returned 0x0 [0043.383] lstrlenW (lpString=".vhd") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".vhd") returned 0x0 [0043.383] lstrlenW (lpString=".vhdx") returned 5 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".vhdx") returned 0x0 [0043.383] lstrlenW (lpString=".pst") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".pst") returned 0x0 [0043.383] lstrlenW (lpString=".ost") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".ost") returned 0x0 [0043.383] lstrlenW (lpString=".bak") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".bak") returned 0x0 [0043.383] lstrlenW (lpString=".bac") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".bac") returned 0x0 [0043.383] lstrlenW (lpString=".sys") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".sys") returned 0x0 [0043.383] lstrlenW (lpString=".v2i") returned 4 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".v2i") returned 0x0 [0043.383] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.384] lstrlenW (lpString=".sql") returned 4 [0043.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".sql") returned 0x0 [0043.384] lstrlenW (lpString=".mdf") returned 4 [0043.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".mdf") returned 0x0 [0043.384] lstrlenW (lpString=".txt") returned 4 [0043.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".txt") returned 0x0 [0043.384] lstrlenW (lpString=".dbf") returned 4 [0043.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".dbf") returned 0x0 [0043.384] lstrlenW (lpString=".ckp") returned 4 [0043.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".ckp") returned 0x0 [0043.384] lstrlenW (lpString=".dacpac") returned 7 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".dacpac") returned 0x0 [0043.385] lstrlenW (lpString=".db3") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".db3") returned 0x0 [0043.385] lstrlenW (lpString=".dtxs") returned 5 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".dtxs") returned 0x0 [0043.385] lstrlenW (lpString=".mdt") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".mdt") returned 0x0 [0043.385] lstrlenW (lpString=".sdf") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".sdf") returned 0x0 [0043.385] lstrlenW (lpString=".MDF") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".MDF") returned 0x0 [0043.385] lstrlenW (lpString=".DBF") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".DBF") returned 0x0 [0043.385] lstrlenW (lpString=".DB") returned 3 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".DB") returned 0x0 [0043.385] lstrlenW (lpString=".db") returned 3 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".db") returned 0x0 [0043.385] lstrlenW (lpString=".ndf") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".ndf") returned 0x0 [0043.385] lstrlenW (lpString=".NDF") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".NDF") returned 0x0 [0043.385] lstrlenW (lpString=".Mdf") returned 4 [0043.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".Mdf") returned 0x0 [0043.385] lstrlenW (lpString=".dat") returned 4 [0043.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".dat") returned 0x0 [0043.386] lstrlenW (lpString=".DAT") returned 4 [0043.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".DAT") returned 0x0 [0043.386] lstrlenW (lpString=".ldf") returned 4 [0043.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".ldf") returned 0x0 [0043.386] lstrlenW (lpString=".LDF") returned 4 [0043.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch=".LDF") returned 0x0 [0043.386] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.386] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.387] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.387] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.387] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16338820207) returned 1 [0043.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8acfb70, dwHighDateTime=0x1d585b4)) [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8098 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8098 | out: hHeap=0x260000) returned 1 [0043.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0043.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0043.388] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.388] GetLastError () returned 0x0 [0043.388] GetLastError () returned 0x0 [0043.388] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.388] GetLastError () returned 0x0 [0043.388] GetLastError () returned 0x0 [0043.388] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.493] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.493] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.494] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.494] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.494] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.494] CloseHandle (hObject=0xf0) returned 1 [0043.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.495] GetLastError () returned 0x0 [0043.495] RtlWakeConditionVariable () returned 0x27e828 [0043.495] GetCurrentThreadId () returned 0x998 [0043.495] GetCurrentThreadId () returned 0x998 [0043.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0043.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f48 | out: hHeap=0x260000) returned 1 [0043.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0043.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.496] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.496] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.496] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.496] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.497] CloseHandle (hObject=0xf0) returned 1 [0043.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0043.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.497] RtlWakeConditionVariable () returned 0x27e828 [0043.497] GetCurrentThreadId () returned 0x998 [0043.497] GetCurrentThreadId () returned 0x998 [0043.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0043.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f10 | out: hHeap=0x260000) returned 1 [0043.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29eb10 [0043.497] lstrlenW (lpString=".ldf") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".ldf") returned 0x0 [0043.497] lstrlenW (lpString=".vhd") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".vhd") returned 0x0 [0043.497] lstrlenW (lpString=".vhdx") returned 5 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".vhdx") returned 0x0 [0043.497] lstrlenW (lpString=".pst") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".pst") returned 0x0 [0043.497] lstrlenW (lpString=".ost") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".ost") returned 0x0 [0043.497] lstrlenW (lpString=".bak") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".bak") returned 0x0 [0043.497] lstrlenW (lpString=".bac") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".bac") returned 0x0 [0043.497] lstrlenW (lpString=".sys") returned 4 [0043.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".sys") returned 0x0 [0043.498] lstrlenW (lpString=".v2i") returned 4 [0043.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".v2i") returned 0x0 [0043.498] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.521] lstrlenW (lpString=".sql") returned 4 [0043.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".sql") returned 0x0 [0043.521] lstrlenW (lpString=".mdf") returned 4 [0043.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".mdf") returned 0x0 [0043.521] lstrlenW (lpString=".txt") returned 4 [0043.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".txt") returned 0x0 [0043.521] lstrlenW (lpString=".dbf") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".dbf") returned 0x0 [0043.522] lstrlenW (lpString=".ckp") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".ckp") returned 0x0 [0043.522] lstrlenW (lpString=".dacpac") returned 7 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".dacpac") returned 0x0 [0043.522] lstrlenW (lpString=".db3") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".db3") returned 0x0 [0043.522] lstrlenW (lpString=".dtxs") returned 5 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".dtxs") returned 0x0 [0043.522] lstrlenW (lpString=".mdt") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".mdt") returned 0x0 [0043.522] lstrlenW (lpString=".sdf") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".sdf") returned 0x0 [0043.522] lstrlenW (lpString=".MDF") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".MDF") returned 0x0 [0043.522] lstrlenW (lpString=".DBF") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".DBF") returned 0x0 [0043.522] lstrlenW (lpString=".DB") returned 3 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".DB") returned 0x0 [0043.522] lstrlenW (lpString=".db") returned 3 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".db") returned 0x0 [0043.522] lstrlenW (lpString=".ndf") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".ndf") returned 0x0 [0043.522] lstrlenW (lpString=".NDF") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".NDF") returned 0x0 [0043.522] lstrlenW (lpString=".Mdf") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".Mdf") returned 0x0 [0043.522] lstrlenW (lpString=".dat") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".dat") returned 0x0 [0043.522] lstrlenW (lpString=".DAT") returned 4 [0043.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".DAT") returned 0x0 [0043.523] lstrlenW (lpString=".ldf") returned 4 [0043.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".ldf") returned 0x0 [0043.523] lstrlenW (lpString=".LDF") returned 4 [0043.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch=".LDF") returned 0x0 [0043.523] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.523] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.524] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.524] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.524] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16352483029) returned 1 [0043.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8c00670, dwHighDateTime=0x1d585b4)) [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ff0 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ff0 | out: hHeap=0x260000) returned 1 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cf80 [0043.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0043.524] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.525] GetLastError () returned 0x0 [0043.525] GetLastError () returned 0x0 [0043.525] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.525] GetLastError () returned 0x0 [0043.525] GetLastError () returned 0x0 [0043.525] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.529] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.530] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.530] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.530] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.530] CloseHandle (hObject=0xf0) returned 1 [0043.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ff40 [0043.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ff40 | out: hHeap=0x260000) returned 1 [0043.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.531] GetLastError () returned 0x0 [0043.531] RtlWakeConditionVariable () returned 0x27e828 [0043.531] GetCurrentThreadId () returned 0x998 [0043.531] GetCurrentThreadId () returned 0x998 [0043.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297698 | out: hHeap=0x260000) returned 1 [0043.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ea0 | out: hHeap=0x260000) returned 1 [0043.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297698 [0043.531] lstrlenW (lpString=".ldf") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".ldf") returned 0x0 [0043.531] lstrlenW (lpString=".vhd") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".vhd") returned 0x0 [0043.531] lstrlenW (lpString=".vhdx") returned 5 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".vhdx") returned 0x0 [0043.531] lstrlenW (lpString=".pst") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".pst") returned 0x0 [0043.531] lstrlenW (lpString=".ost") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".ost") returned 0x0 [0043.531] lstrlenW (lpString=".bak") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".bak") returned 0x0 [0043.531] lstrlenW (lpString=".bac") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".bac") returned 0x0 [0043.531] lstrlenW (lpString=".sys") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".sys") returned 0x0 [0043.531] lstrlenW (lpString=".v2i") returned 4 [0043.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".v2i") returned 0x0 [0043.532] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.532] lstrlenW (lpString=".sql") returned 4 [0043.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".sql") returned 0x0 [0043.532] lstrlenW (lpString=".mdf") returned 4 [0043.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".mdf") returned 0x0 [0043.532] lstrlenW (lpString=".txt") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".txt") returned 0x0 [0043.533] lstrlenW (lpString=".dbf") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".dbf") returned 0x0 [0043.533] lstrlenW (lpString=".ckp") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".ckp") returned 0x0 [0043.533] lstrlenW (lpString=".dacpac") returned 7 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".dacpac") returned 0x0 [0043.533] lstrlenW (lpString=".db3") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".db3") returned 0x0 [0043.533] lstrlenW (lpString=".dtxs") returned 5 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".dtxs") returned 0x0 [0043.533] lstrlenW (lpString=".mdt") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".mdt") returned 0x0 [0043.533] lstrlenW (lpString=".sdf") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".sdf") returned 0x0 [0043.533] lstrlenW (lpString=".MDF") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".MDF") returned 0x0 [0043.533] lstrlenW (lpString=".DBF") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".DBF") returned 0x0 [0043.533] lstrlenW (lpString=".DB") returned 3 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".DB") returned 0x0 [0043.533] lstrlenW (lpString=".db") returned 3 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".db") returned 0x0 [0043.533] lstrlenW (lpString=".ndf") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".ndf") returned 0x0 [0043.533] lstrlenW (lpString=".NDF") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".NDF") returned 0x0 [0043.533] lstrlenW (lpString=".Mdf") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".Mdf") returned 0x0 [0043.533] lstrlenW (lpString=".dat") returned 4 [0043.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".dat") returned 0x0 [0043.534] lstrlenW (lpString=".DAT") returned 4 [0043.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".DAT") returned 0x0 [0043.534] lstrlenW (lpString=".ldf") returned 4 [0043.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".ldf") returned 0x0 [0043.534] lstrlenW (lpString=".LDF") returned 4 [0043.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch=".LDF") returned 0x0 [0043.534] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.534] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.535] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.535] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.535] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16353588812) returned 1 [0043.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8c267d0, dwHighDateTime=0x1d585b4)) [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ea0 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ea0 | out: hHeap=0x260000) returned 1 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0043.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0043.535] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.535] GetLastError () returned 0x0 [0043.536] GetLastError () returned 0x0 [0043.536] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.536] GetLastError () returned 0x0 [0043.536] GetLastError () returned 0x0 [0043.536] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.539] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.539] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.541] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.541] CloseHandle (hObject=0xf0) returned 1 [0043.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.541] GetLastError () returned 0x0 [0043.541] RtlWakeConditionVariable () returned 0x27e828 [0043.541] GetCurrentThreadId () returned 0x998 [0043.541] GetCurrentThreadId () returned 0x998 [0043.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297600 | out: hHeap=0x260000) returned 1 [0043.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e68 | out: hHeap=0x260000) returned 1 [0043.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297600 [0043.542] lstrlenW (lpString=".ldf") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".ldf") returned 0x0 [0043.542] lstrlenW (lpString=".vhd") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".vhd") returned 0x0 [0043.542] lstrlenW (lpString=".vhdx") returned 5 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".vhdx") returned 0x0 [0043.542] lstrlenW (lpString=".pst") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".pst") returned 0x0 [0043.542] lstrlenW (lpString=".ost") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".ost") returned 0x0 [0043.542] lstrlenW (lpString=".bak") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".bak") returned 0x0 [0043.542] lstrlenW (lpString=".bac") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".bac") returned 0x0 [0043.542] lstrlenW (lpString=".sys") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".sys") returned 0x0 [0043.542] lstrlenW (lpString=".v2i") returned 4 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".v2i") returned 0x0 [0043.542] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch="s\r\n.v2i") returned 0x0 [0043.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.543] lstrlenW (lpString=".sql") returned 4 [0043.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".sql") returned 0x0 [0043.543] lstrlenW (lpString=".mdf") returned 4 [0043.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".mdf") returned 0x0 [0043.543] lstrlenW (lpString=".txt") returned 4 [0043.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".txt") returned 0x0 [0043.543] lstrlenW (lpString=".dbf") returned 4 [0043.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".dbf") returned 0x0 [0043.543] lstrlenW (lpString=".ckp") returned 4 [0043.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".ckp") returned 0x0 [0043.543] lstrlenW (lpString=".dacpac") returned 7 [0043.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".dacpac") returned 0x0 [0043.544] lstrlenW (lpString=".db3") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".db3") returned 0x0 [0043.544] lstrlenW (lpString=".dtxs") returned 5 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".dtxs") returned 0x0 [0043.544] lstrlenW (lpString=".mdt") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".mdt") returned 0x0 [0043.544] lstrlenW (lpString=".sdf") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".sdf") returned 0x0 [0043.544] lstrlenW (lpString=".MDF") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".MDF") returned 0x0 [0043.544] lstrlenW (lpString=".DBF") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".DBF") returned 0x0 [0043.544] lstrlenW (lpString=".DB") returned 3 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".DB") returned 0x0 [0043.544] lstrlenW (lpString=".db") returned 3 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".db") returned 0x0 [0043.544] lstrlenW (lpString=".ndf") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".ndf") returned 0x0 [0043.544] lstrlenW (lpString=".NDF") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".NDF") returned 0x0 [0043.544] lstrlenW (lpString=".Mdf") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".Mdf") returned 0x0 [0043.544] lstrlenW (lpString=".dat") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".dat") returned 0x0 [0043.544] lstrlenW (lpString=".DAT") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".DAT") returned 0x0 [0043.544] lstrlenW (lpString=".ldf") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".ldf") returned 0x0 [0043.544] lstrlenW (lpString=".LDF") returned 4 [0043.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch=".LDF") returned 0x0 [0043.545] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.545] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.545] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.546] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16354668500) returned 1 [0043.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8c4c930, dwHighDateTime=0x1d585b4)) [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7e68 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e68 | out: hHeap=0x260000) returned 1 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0043.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297698 [0043.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0043.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.546] GetLastError () returned 0x0 [0043.546] GetLastError () returned 0x0 [0043.546] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.546] GetLastError () returned 0x0 [0043.547] GetLastError () returned 0x0 [0043.547] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x1cffdb0*=0x3574, lpOverlapped=0x0) returned 1 [0043.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffca8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.548] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3574, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3574, lpOverlapped=0x0) returned 1 [0043.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.548] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.549] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.549] CloseHandle (hObject=0xf0) returned 1 [0043.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ff40 [0043.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.[deadmin@cock.li].deadmin")) returned 1 [0043.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ff40 | out: hHeap=0x260000) returned 1 [0043.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.549] GetLastError () returned 0x0 [0043.549] RtlWakeConditionVariable () returned 0x27e828 [0043.549] GetCurrentThreadId () returned 0x998 [0043.549] GetCurrentThreadId () returned 0x998 [0043.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2d58 | out: hHeap=0x260000) returned 1 [0043.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e30 | out: hHeap=0x260000) returned 1 [0043.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2d58 [0043.550] lstrlenW (lpString=".ldf") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".ldf") returned 0x0 [0043.550] lstrlenW (lpString=".vhd") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".vhd") returned 0x0 [0043.550] lstrlenW (lpString=".vhdx") returned 5 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".vhdx") returned 0x0 [0043.550] lstrlenW (lpString=".pst") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".pst") returned 0x0 [0043.550] lstrlenW (lpString=".ost") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".ost") returned 0x0 [0043.550] lstrlenW (lpString=".bak") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".bak") returned 0x0 [0043.550] lstrlenW (lpString=".bac") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".bac") returned 0x0 [0043.550] lstrlenW (lpString=".sys") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".sys") returned 0x0 [0043.550] lstrlenW (lpString=".v2i") returned 4 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".v2i") returned 0x0 [0043.550] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch="s\r\n.v2i") returned 0x0 [0043.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.631] lstrlenW (lpString=".sql") returned 4 [0043.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".sql") returned 0x0 [0043.637] lstrlenW (lpString=".mdf") returned 4 [0043.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".mdf") returned 0x0 [0043.645] lstrlenW (lpString=".txt") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".txt") returned 0x0 [0043.645] lstrlenW (lpString=".dbf") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".dbf") returned 0x0 [0043.645] lstrlenW (lpString=".ckp") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".ckp") returned 0x0 [0043.645] lstrlenW (lpString=".dacpac") returned 7 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".dacpac") returned 0x0 [0043.645] lstrlenW (lpString=".db3") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".db3") returned 0x0 [0043.645] lstrlenW (lpString=".dtxs") returned 5 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".dtxs") returned 0x0 [0043.645] lstrlenW (lpString=".mdt") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".mdt") returned 0x0 [0043.645] lstrlenW (lpString=".sdf") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".sdf") returned 0x0 [0043.645] lstrlenW (lpString=".MDF") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".MDF") returned 0x0 [0043.645] lstrlenW (lpString=".DBF") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".DBF") returned 0x0 [0043.645] lstrlenW (lpString=".DB") returned 3 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".DB") returned 0x0 [0043.645] lstrlenW (lpString=".db") returned 3 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".db") returned 0x0 [0043.645] lstrlenW (lpString=".ndf") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".ndf") returned 0x0 [0043.645] lstrlenW (lpString=".NDF") returned 4 [0043.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".NDF") returned 0x0 [0043.645] lstrlenW (lpString=".Mdf") returned 4 [0043.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".Mdf") returned 0x0 [0043.646] lstrlenW (lpString=".dat") returned 4 [0043.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".dat") returned 0x0 [0043.646] lstrlenW (lpString=".DAT") returned 4 [0043.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".DAT") returned 0x0 [0043.646] lstrlenW (lpString=".ldf") returned 4 [0043.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".ldf") returned 0x0 [0043.646] lstrlenW (lpString=".LDF") returned 4 [0043.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch=".LDF") returned 0x0 [0043.646] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.646] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.647] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.647] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16364800213) returned 1 [0043.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8d31170, dwHighDateTime=0x1d585b4)) [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992b8 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992b8 | out: hHeap=0x260000) returned 1 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.647] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.648] GetLastError () returned 0x0 [0043.648] GetLastError () returned 0x0 [0043.648] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.648] GetLastError () returned 0x0 [0043.648] GetLastError () returned 0x0 [0043.650] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc280, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.650] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3d80, lpOverlapped=0x0) returned 1 [0043.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.650] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.650] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.650] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.651] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.651] CloseHandle (hObject=0x108) returned 1 [0043.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.[deadmin@cock.li].deadmin")) returned 1 [0043.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.651] GetLastError () returned 0x0 [0043.651] RtlWakeConditionVariable () returned 0x27e828 [0043.651] GetCurrentThreadId () returned 0x998 [0043.652] GetCurrentThreadId () returned 0x998 [0043.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296e48 | out: hHeap=0x260000) returned 1 [0043.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299280 | out: hHeap=0x260000) returned 1 [0043.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296e48 [0043.652] lstrlenW (lpString=".ldf") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".ldf") returned 0x0 [0043.652] lstrlenW (lpString=".vhd") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".vhd") returned 0x0 [0043.652] lstrlenW (lpString=".vhdx") returned 5 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".vhdx") returned 0x0 [0043.652] lstrlenW (lpString=".pst") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".pst") returned 0x0 [0043.652] lstrlenW (lpString=".ost") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".ost") returned 0x0 [0043.652] lstrlenW (lpString=".bak") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".bak") returned 0x0 [0043.652] lstrlenW (lpString=".bac") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".bac") returned 0x0 [0043.652] lstrlenW (lpString=".sys") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".sys") returned 0x0 [0043.652] lstrlenW (lpString=".v2i") returned 4 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch=".v2i") returned 0x0 [0043.652] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296e48 | out: hHeap=0x260000) returned 1 [0043.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.653] RtlWakeConditionVariable () returned 0x27e828 [0043.653] GetCurrentThreadId () returned 0x998 [0043.653] GetCurrentThreadId () returned 0x998 [0043.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6948 | out: hHeap=0x260000) returned 1 [0043.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299248 | out: hHeap=0x260000) returned 1 [0043.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6948 [0043.653] lstrlenW (lpString=".ldf") returned 4 [0043.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".ldf") returned 0x0 [0043.653] lstrlenW (lpString=".vhd") returned 4 [0043.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".vhd") returned 0x0 [0043.653] lstrlenW (lpString=".vhdx") returned 5 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".vhdx") returned 0x0 [0043.654] lstrlenW (lpString=".pst") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".pst") returned 0x0 [0043.654] lstrlenW (lpString=".ost") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".ost") returned 0x0 [0043.654] lstrlenW (lpString=".bak") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".bak") returned 0x0 [0043.654] lstrlenW (lpString=".bac") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".bac") returned 0x0 [0043.654] lstrlenW (lpString=".sys") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".sys") returned 0x0 [0043.654] lstrlenW (lpString=".v2i") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch=".v2i") returned 0x0 [0043.654] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6948 | out: hHeap=0x260000) returned 1 [0043.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.654] RtlWakeConditionVariable () returned 0x27e828 [0043.654] GetCurrentThreadId () returned 0x998 [0043.654] GetCurrentThreadId () returned 0x998 [0043.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296c80 | out: hHeap=0x260000) returned 1 [0043.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299210 | out: hHeap=0x260000) returned 1 [0043.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296c80 [0043.654] lstrlenW (lpString=".ldf") returned 4 [0043.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".ldf") returned 0x0 [0043.654] lstrlenW (lpString=".vhd") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".vhd") returned 0x0 [0043.655] lstrlenW (lpString=".vhdx") returned 5 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".vhdx") returned 0x0 [0043.655] lstrlenW (lpString=".pst") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".pst") returned 0x0 [0043.655] lstrlenW (lpString=".ost") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".ost") returned 0x0 [0043.655] lstrlenW (lpString=".bak") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".bak") returned 0x0 [0043.655] lstrlenW (lpString=".bac") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".bac") returned 0x0 [0043.655] lstrlenW (lpString=".sys") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".sys") returned 0x0 [0043.655] lstrlenW (lpString=".v2i") returned 4 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch=".v2i") returned 0x0 [0043.655] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296c80 | out: hHeap=0x260000) returned 1 [0043.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.655] RtlWakeConditionVariable () returned 0x27e828 [0043.655] GetCurrentThreadId () returned 0x998 [0043.655] GetCurrentThreadId () returned 0x998 [0043.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f30f0 | out: hHeap=0x260000) returned 1 [0043.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991d8 | out: hHeap=0x260000) returned 1 [0043.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f30f0 [0043.655] lstrlenW (lpString=".ldf") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".ldf") returned 0x0 [0043.656] lstrlenW (lpString=".vhd") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".vhd") returned 0x0 [0043.656] lstrlenW (lpString=".vhdx") returned 5 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".vhdx") returned 0x0 [0043.656] lstrlenW (lpString=".pst") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".pst") returned 0x0 [0043.656] lstrlenW (lpString=".ost") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".ost") returned 0x0 [0043.656] lstrlenW (lpString=".bak") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".bak") returned 0x0 [0043.656] lstrlenW (lpString=".bac") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".bac") returned 0x0 [0043.656] lstrlenW (lpString=".sys") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".sys") returned 0x0 [0043.656] lstrlenW (lpString=".v2i") returned 4 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch=".v2i") returned 0x0 [0043.656] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f30f0 | out: hHeap=0x260000) returned 1 [0043.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0043.656] RtlWakeConditionVariable () returned 0x27e828 [0043.656] GetCurrentThreadId () returned 0x998 [0043.656] GetCurrentThreadId () returned 0x998 [0043.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f68a0 | out: hHeap=0x260000) returned 1 [0043.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991a0 | out: hHeap=0x260000) returned 1 [0043.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f68a0 [0043.657] lstrlenW (lpString=".ldf") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".ldf") returned 0x0 [0043.657] lstrlenW (lpString=".vhd") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".vhd") returned 0x0 [0043.657] lstrlenW (lpString=".vhdx") returned 5 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".vhdx") returned 0x0 [0043.657] lstrlenW (lpString=".pst") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".pst") returned 0x0 [0043.657] lstrlenW (lpString=".ost") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".ost") returned 0x0 [0043.657] lstrlenW (lpString=".bak") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".bak") returned 0x0 [0043.657] lstrlenW (lpString=".bac") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".bac") returned 0x0 [0043.657] lstrlenW (lpString=".sys") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".sys") returned 0x0 [0043.657] lstrlenW (lpString=".v2i") returned 4 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch=".v2i") returned 0x0 [0043.657] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f68a0 | out: hHeap=0x260000) returned 1 [0043.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.658] RtlWakeConditionVariable () returned 0x27e828 [0043.658] GetCurrentThreadId () returned 0x998 [0043.658] GetCurrentThreadId () returned 0x998 [0043.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f67f8 | out: hHeap=0x260000) returned 1 [0043.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8418 | out: hHeap=0x260000) returned 1 [0043.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f67f8 [0043.658] lstrlenW (lpString=".ldf") returned 4 [0043.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".ldf") returned 0x0 [0043.658] lstrlenW (lpString=".vhd") returned 4 [0043.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".vhd") returned 0x0 [0043.658] lstrlenW (lpString=".vhdx") returned 5 [0043.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".vhdx") returned 0x0 [0043.658] lstrlenW (lpString=".pst") returned 4 [0043.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".pst") returned 0x0 [0043.658] lstrlenW (lpString=".ost") returned 4 [0043.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".ost") returned 0x0 [0043.658] lstrlenW (lpString=".bak") returned 4 [0043.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".bak") returned 0x0 [0043.659] lstrlenW (lpString=".bac") returned 4 [0043.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".bac") returned 0x0 [0043.659] lstrlenW (lpString=".sys") returned 4 [0043.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".sys") returned 0x0 [0043.659] lstrlenW (lpString=".v2i") returned 4 [0043.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch=".v2i") returned 0x0 [0043.659] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f67f8 | out: hHeap=0x260000) returned 1 [0043.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.659] RtlWakeConditionVariable () returned 0x27e828 [0043.659] GetCurrentThreadId () returned 0x998 [0043.659] GetCurrentThreadId () returned 0x998 [0043.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0043.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d83e0 | out: hHeap=0x260000) returned 1 [0043.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6750 [0043.660] lstrlenW (lpString=".ldf") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".ldf") returned 0x0 [0043.660] lstrlenW (lpString=".vhd") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".vhd") returned 0x0 [0043.660] lstrlenW (lpString=".vhdx") returned 5 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".vhdx") returned 0x0 [0043.660] lstrlenW (lpString=".pst") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".pst") returned 0x0 [0043.660] lstrlenW (lpString=".ost") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".ost") returned 0x0 [0043.660] lstrlenW (lpString=".bak") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".bak") returned 0x0 [0043.660] lstrlenW (lpString=".bac") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".bac") returned 0x0 [0043.660] lstrlenW (lpString=".sys") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".sys") returned 0x0 [0043.660] lstrlenW (lpString=".v2i") returned 4 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch=".v2i") returned 0x0 [0043.660] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0043.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.660] RtlWakeConditionVariable () returned 0x27e828 [0043.661] GetCurrentThreadId () returned 0x998 [0043.661] GetCurrentThreadId () returned 0x998 [0043.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6168 | out: hHeap=0x260000) returned 1 [0043.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d83a8 | out: hHeap=0x260000) returned 1 [0043.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6168 [0043.661] lstrlenW (lpString=".ldf") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".ldf") returned 0x0 [0043.661] lstrlenW (lpString=".vhd") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".vhd") returned 0x0 [0043.661] lstrlenW (lpString=".vhdx") returned 5 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".vhdx") returned 0x0 [0043.661] lstrlenW (lpString=".pst") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".pst") returned 0x0 [0043.661] lstrlenW (lpString=".ost") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".ost") returned 0x0 [0043.661] lstrlenW (lpString=".bak") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".bak") returned 0x0 [0043.661] lstrlenW (lpString=".bac") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".bac") returned 0x0 [0043.661] lstrlenW (lpString=".sys") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".sys") returned 0x0 [0043.661] lstrlenW (lpString=".v2i") returned 4 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch=".v2i") returned 0x0 [0043.661] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6168 | out: hHeap=0x260000) returned 1 [0043.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.662] RtlWakeConditionVariable () returned 0x27e828 [0043.662] GetCurrentThreadId () returned 0x998 [0043.662] GetCurrentThreadId () returned 0x998 [0043.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f60c0 | out: hHeap=0x260000) returned 1 [0043.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8370 | out: hHeap=0x260000) returned 1 [0043.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f60c0 [0043.662] lstrlenW (lpString=".ldf") returned 4 [0043.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".ldf") returned 0x0 [0043.662] lstrlenW (lpString=".vhd") returned 4 [0043.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".vhd") returned 0x0 [0043.662] lstrlenW (lpString=".vhdx") returned 5 [0043.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".vhdx") returned 0x0 [0043.663] lstrlenW (lpString=".pst") returned 4 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".pst") returned 0x0 [0043.663] lstrlenW (lpString=".ost") returned 4 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".ost") returned 0x0 [0043.663] lstrlenW (lpString=".bak") returned 4 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".bak") returned 0x0 [0043.663] lstrlenW (lpString=".bac") returned 4 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".bac") returned 0x0 [0043.663] lstrlenW (lpString=".sys") returned 4 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".sys") returned 0x0 [0043.663] lstrlenW (lpString=".v2i") returned 4 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch=".v2i") returned 0x0 [0043.663] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f60c0 | out: hHeap=0x260000) returned 1 [0043.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.664] RtlWakeConditionVariable () returned 0x27e828 [0043.664] GetCurrentThreadId () returned 0x998 [0043.664] GetCurrentThreadId () returned 0x998 [0043.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297010 | out: hHeap=0x260000) returned 1 [0043.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7dc0 | out: hHeap=0x260000) returned 1 [0043.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297010 [0043.664] lstrlenW (lpString=".ldf") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".ldf") returned 0x0 [0043.664] lstrlenW (lpString=".vhd") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".vhd") returned 0x0 [0043.664] lstrlenW (lpString=".vhdx") returned 5 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".vhdx") returned 0x0 [0043.664] lstrlenW (lpString=".pst") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".pst") returned 0x0 [0043.664] lstrlenW (lpString=".ost") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".ost") returned 0x0 [0043.664] lstrlenW (lpString=".bak") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".bak") returned 0x0 [0043.664] lstrlenW (lpString=".bac") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".bac") returned 0x0 [0043.664] lstrlenW (lpString=".sys") returned 4 [0043.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".sys") returned 0x0 [0043.664] lstrlenW (lpString=".v2i") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch=".v2i") returned 0x0 [0043.665] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297010 | out: hHeap=0x260000) returned 1 [0043.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.665] RtlWakeConditionVariable () returned 0x27e828 [0043.665] GetCurrentThreadId () returned 0x998 [0043.665] GetCurrentThreadId () returned 0x998 [0043.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296ee0 | out: hHeap=0x260000) returned 1 [0043.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d88 | out: hHeap=0x260000) returned 1 [0043.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ee0 [0043.665] lstrlenW (lpString=".ldf") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".ldf") returned 0x0 [0043.665] lstrlenW (lpString=".vhd") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".vhd") returned 0x0 [0043.665] lstrlenW (lpString=".vhdx") returned 5 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".vhdx") returned 0x0 [0043.665] lstrlenW (lpString=".pst") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".pst") returned 0x0 [0043.665] lstrlenW (lpString=".ost") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".ost") returned 0x0 [0043.665] lstrlenW (lpString=".bak") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".bak") returned 0x0 [0043.665] lstrlenW (lpString=".bac") returned 4 [0043.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".bac") returned 0x0 [0043.666] lstrlenW (lpString=".sys") returned 4 [0043.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".sys") returned 0x0 [0043.666] lstrlenW (lpString=".v2i") returned 4 [0043.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch=".v2i") returned 0x0 [0043.666] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296ee0 | out: hHeap=0x260000) returned 1 [0043.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.666] RtlWakeConditionVariable () returned 0x27e828 [0043.666] GetCurrentThreadId () returned 0x998 [0043.666] GetCurrentThreadId () returned 0x998 [0043.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6018 | out: hHeap=0x260000) returned 1 [0043.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d50 | out: hHeap=0x260000) returned 1 [0043.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6018 [0043.667] lstrlenW (lpString=".ldf") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".ldf") returned 0x0 [0043.667] lstrlenW (lpString=".vhd") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".vhd") returned 0x0 [0043.667] lstrlenW (lpString=".vhdx") returned 5 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".vhdx") returned 0x0 [0043.667] lstrlenW (lpString=".pst") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".pst") returned 0x0 [0043.667] lstrlenW (lpString=".ost") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".ost") returned 0x0 [0043.667] lstrlenW (lpString=".bak") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".bak") returned 0x0 [0043.667] lstrlenW (lpString=".bac") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".bac") returned 0x0 [0043.667] lstrlenW (lpString=".sys") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".sys") returned 0x0 [0043.667] lstrlenW (lpString=".v2i") returned 4 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch=".v2i") returned 0x0 [0043.667] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", lpSrch="s\r\n.v2i") returned 0x0 [0043.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6018 | out: hHeap=0x260000) returned 1 [0043.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.667] RtlWakeConditionVariable () returned 0x27e828 [0043.667] GetCurrentThreadId () returned 0x998 [0043.668] GetCurrentThreadId () returned 0x998 [0043.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5f70 | out: hHeap=0x260000) returned 1 [0043.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d18 | out: hHeap=0x260000) returned 1 [0043.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5f70 [0043.668] lstrlenW (lpString=".ldf") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".ldf") returned 0x0 [0043.668] lstrlenW (lpString=".vhd") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".vhd") returned 0x0 [0043.668] lstrlenW (lpString=".vhdx") returned 5 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".vhdx") returned 0x0 [0043.668] lstrlenW (lpString=".pst") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".pst") returned 0x0 [0043.668] lstrlenW (lpString=".ost") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".ost") returned 0x0 [0043.668] lstrlenW (lpString=".bak") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".bak") returned 0x0 [0043.668] lstrlenW (lpString=".bac") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".bac") returned 0x0 [0043.668] lstrlenW (lpString=".sys") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".sys") returned 0x0 [0043.668] lstrlenW (lpString=".v2i") returned 4 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch=".v2i") returned 0x0 [0043.668] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5f70 | out: hHeap=0x260000) returned 1 [0043.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.669] RtlWakeConditionVariable () returned 0x27e828 [0043.669] GetCurrentThreadId () returned 0x998 [0043.669] GetCurrentThreadId () returned 0x998 [0043.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296d18 | out: hHeap=0x260000) returned 1 [0043.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ce0 | out: hHeap=0x260000) returned 1 [0043.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296d18 [0043.669] lstrlenW (lpString=".ldf") returned 4 [0043.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".ldf") returned 0x0 [0043.669] lstrlenW (lpString=".vhd") returned 4 [0043.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".vhd") returned 0x0 [0043.669] lstrlenW (lpString=".vhdx") returned 5 [0043.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".vhdx") returned 0x0 [0043.669] lstrlenW (lpString=".pst") returned 4 [0043.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".pst") returned 0x0 [0043.670] lstrlenW (lpString=".ost") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".ost") returned 0x0 [0043.670] lstrlenW (lpString=".bak") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".bak") returned 0x0 [0043.670] lstrlenW (lpString=".bac") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".bac") returned 0x0 [0043.670] lstrlenW (lpString=".sys") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".sys") returned 0x0 [0043.670] lstrlenW (lpString=".v2i") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch=".v2i") returned 0x0 [0043.670] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", lpSrch="s\r\n.v2i") returned 0x0 [0043.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296d18 | out: hHeap=0x260000) returned 1 [0043.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.670] RtlWakeConditionVariable () returned 0x27e828 [0043.670] GetCurrentThreadId () returned 0x998 [0043.670] GetCurrentThreadId () returned 0x998 [0043.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0043.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ca8 | out: hHeap=0x260000) returned 1 [0043.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5e20 [0043.670] lstrlenW (lpString=".ldf") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".ldf") returned 0x0 [0043.670] lstrlenW (lpString=".vhd") returned 4 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".vhd") returned 0x0 [0043.670] lstrlenW (lpString=".vhdx") returned 5 [0043.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".vhdx") returned 0x0 [0043.671] lstrlenW (lpString=".pst") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".pst") returned 0x0 [0043.671] lstrlenW (lpString=".ost") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".ost") returned 0x0 [0043.671] lstrlenW (lpString=".bak") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".bak") returned 0x0 [0043.671] lstrlenW (lpString=".bac") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".bac") returned 0x0 [0043.671] lstrlenW (lpString=".sys") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".sys") returned 0x0 [0043.671] lstrlenW (lpString=".v2i") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch=".v2i") returned 0x0 [0043.671] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0043.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.671] RtlWakeConditionVariable () returned 0x27e828 [0043.671] GetCurrentThreadId () returned 0x998 [0043.671] GetCurrentThreadId () returned 0x998 [0043.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2570 | out: hHeap=0x260000) returned 1 [0043.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c70 | out: hHeap=0x260000) returned 1 [0043.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0043.671] lstrlenW (lpString=".ldf") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".ldf") returned 0x0 [0043.671] lstrlenW (lpString=".vhd") returned 4 [0043.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".vhd") returned 0x0 [0043.672] lstrlenW (lpString=".vhdx") returned 5 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".vhdx") returned 0x0 [0043.672] lstrlenW (lpString=".pst") returned 4 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".pst") returned 0x0 [0043.672] lstrlenW (lpString=".ost") returned 4 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".ost") returned 0x0 [0043.672] lstrlenW (lpString=".bak") returned 4 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".bak") returned 0x0 [0043.672] lstrlenW (lpString=".bac") returned 4 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".bac") returned 0x0 [0043.672] lstrlenW (lpString=".sys") returned 4 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".sys") returned 0x0 [0043.672] lstrlenW (lpString=".v2i") returned 4 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch=".v2i") returned 0x0 [0043.672] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2570 | out: hHeap=0x260000) returned 1 [0043.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0043.673] RtlWakeConditionVariable () returned 0x27e828 [0043.673] GetCurrentThreadId () returned 0x998 [0043.673] GetCurrentThreadId () returned 0x998 [0043.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2be8 | out: hHeap=0x260000) returned 1 [0043.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d978 | out: hHeap=0x260000) returned 1 [0043.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2be8 [0043.673] lstrlenW (lpString=".ldf") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".ldf") returned 0x0 [0043.673] lstrlenW (lpString=".vhd") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".vhd") returned 0x0 [0043.673] lstrlenW (lpString=".vhdx") returned 5 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".vhdx") returned 0x0 [0043.673] lstrlenW (lpString=".pst") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".pst") returned 0x0 [0043.673] lstrlenW (lpString=".ost") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".ost") returned 0x0 [0043.673] lstrlenW (lpString=".bak") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".bak") returned 0x0 [0043.673] lstrlenW (lpString=".bac") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".bac") returned 0x0 [0043.673] lstrlenW (lpString=".sys") returned 4 [0043.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".sys") returned 0x0 [0043.673] lstrlenW (lpString=".v2i") returned 4 [0043.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch=".v2i") returned 0x0 [0043.674] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", lpSrch="s\r\n.v2i") returned 0x0 [0043.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2be8 | out: hHeap=0x260000) returned 1 [0043.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0043.674] RtlWakeConditionVariable () returned 0x27e828 [0043.674] GetCurrentThreadId () returned 0x998 [0043.674] GetCurrentThreadId () returned 0x998 [0043.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0043.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9b0 | out: hHeap=0x260000) returned 1 [0043.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da538 [0043.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.787] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.787] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.787] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.787] WriteFile (in: hFile=0xf8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.788] CloseHandle (hObject=0xf8) returned 1 [0043.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0043.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.788] RtlWakeConditionVariable () returned 0x27e828 [0043.788] GetCurrentThreadId () returned 0x998 [0043.788] GetCurrentThreadId () returned 0x998 [0043.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da470 | out: hHeap=0x260000) returned 1 [0043.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e30 | out: hHeap=0x260000) returned 1 [0043.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da470 [0043.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.790] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.790] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.790] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.790] WriteFile (in: hFile=0xf8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.791] CloseHandle (hObject=0xf8) returned 1 [0043.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da470 | out: hHeap=0x260000) returned 1 [0043.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.791] RtlWakeConditionVariable () returned 0x27e828 [0043.791] GetCurrentThreadId () returned 0x998 [0043.791] GetCurrentThreadId () returned 0x998 [0043.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5e20 [0043.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0043.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb58 | out: hHeap=0x260000) returned 1 [0043.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0043.791] lstrlenW (lpString=".ldf") returned 4 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".ldf") returned 0x0 [0043.791] lstrlenW (lpString=".vhd") returned 4 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".vhd") returned 0x0 [0043.791] lstrlenW (lpString=".vhdx") returned 5 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".vhdx") returned 0x0 [0043.791] lstrlenW (lpString=".pst") returned 4 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".pst") returned 0x0 [0043.791] lstrlenW (lpString=".ost") returned 4 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".ost") returned 0x0 [0043.791] lstrlenW (lpString=".bak") returned 4 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".bak") returned 0x0 [0043.791] lstrlenW (lpString=".bac") returned 4 [0043.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".bac") returned 0x0 [0043.791] lstrlenW (lpString=".sys") returned 4 [0043.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".sys") returned 0x0 [0043.792] lstrlenW (lpString=".v2i") returned 4 [0043.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".v2i") returned 0x0 [0043.792] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0043.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.793] lstrlenW (lpString=".sql") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".sql") returned 0x0 [0043.793] lstrlenW (lpString=".mdf") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".mdf") returned 0x0 [0043.793] lstrlenW (lpString=".txt") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".txt") returned 0x0 [0043.793] lstrlenW (lpString=".dbf") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".dbf") returned 0x0 [0043.793] lstrlenW (lpString=".ckp") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".ckp") returned 0x0 [0043.793] lstrlenW (lpString=".dacpac") returned 7 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".dacpac") returned 0x0 [0043.793] lstrlenW (lpString=".db3") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".db3") returned 0x0 [0043.793] lstrlenW (lpString=".dtxs") returned 5 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".dtxs") returned 0x0 [0043.793] lstrlenW (lpString=".mdt") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".mdt") returned 0x0 [0043.793] lstrlenW (lpString=".sdf") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".sdf") returned 0x0 [0043.793] lstrlenW (lpString=".MDF") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".MDF") returned 0x0 [0043.793] lstrlenW (lpString=".DBF") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".DBF") returned 0x0 [0043.793] lstrlenW (lpString=".DB") returned 3 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".DB") returned 0x0 [0043.793] lstrlenW (lpString=".db") returned 3 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".db") returned 0x0 [0043.793] lstrlenW (lpString=".ndf") returned 4 [0043.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".ndf") returned 0x0 [0043.794] lstrlenW (lpString=".NDF") returned 4 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".NDF") returned 0x0 [0043.794] lstrlenW (lpString=".Mdf") returned 4 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".Mdf") returned 0x0 [0043.794] lstrlenW (lpString=".dat") returned 4 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".dat") returned 0x0 [0043.794] lstrlenW (lpString=".DAT") returned 4 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".DAT") returned 0x0 [0043.794] lstrlenW (lpString=".ldf") returned 4 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".ldf") returned 0x0 [0043.794] lstrlenW (lpString=".LDF") returned 4 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch=".LDF") returned 0x0 [0043.794] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.794] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.795] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.795] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.795] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16379623605) returned 1 [0043.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8eadf30, dwHighDateTime=0x1d585b4)) [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb58 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb58 | out: hHeap=0x260000) returned 1 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.796] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.796] GetLastError () returned 0x0 [0043.796] GetLastError () returned 0x0 [0043.796] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.796] GetLastError () returned 0x0 [0043.796] GetLastError () returned 0x0 [0043.799] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffef039, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.799] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x10fc7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x10fc7, lpOverlapped=0x0) returned 1 [0043.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.800] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.800] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.800] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.800] CloseHandle (hObject=0xf8) returned 1 [0043.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.800] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.[deadmin@cock.li].deadmin")) returned 1 [0043.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.801] GetLastError () returned 0x0 [0043.801] RtlWakeConditionVariable () returned 0x27e828 [0043.801] GetCurrentThreadId () returned 0x998 [0043.801] GetCurrentThreadId () returned 0x998 [0043.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0043.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ec60 | out: hHeap=0x260000) returned 1 [0043.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cae8 | out: hHeap=0x260000) returned 1 [0043.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ec60 [0043.801] lstrlenW (lpString=".ldf") returned 4 [0043.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.801] lstrlenW (lpString=".vhd") returned 4 [0043.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0043.801] lstrlenW (lpString=".vhdx") returned 5 [0043.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0043.801] lstrlenW (lpString=".pst") returned 4 [0043.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0043.802] lstrlenW (lpString=".ost") returned 4 [0043.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0043.802] lstrlenW (lpString=".bak") returned 4 [0043.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0043.802] lstrlenW (lpString=".bac") returned 4 [0043.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0043.802] lstrlenW (lpString=".sys") returned 4 [0043.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0043.802] lstrlenW (lpString=".v2i") returned 4 [0043.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0043.802] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0043.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.817] lstrlenW (lpString=".sql") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0043.817] lstrlenW (lpString=".mdf") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0043.817] lstrlenW (lpString=".txt") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0043.817] lstrlenW (lpString=".dbf") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0043.817] lstrlenW (lpString=".ckp") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0043.817] lstrlenW (lpString=".dacpac") returned 7 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0043.817] lstrlenW (lpString=".db3") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0043.817] lstrlenW (lpString=".dtxs") returned 5 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0043.817] lstrlenW (lpString=".mdt") returned 4 [0043.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0043.818] lstrlenW (lpString=".sdf") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0043.818] lstrlenW (lpString=".MDF") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0043.818] lstrlenW (lpString=".DBF") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0043.818] lstrlenW (lpString=".DB") returned 3 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0043.818] lstrlenW (lpString=".db") returned 3 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0043.818] lstrlenW (lpString=".ndf") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0043.818] lstrlenW (lpString=".NDF") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0043.818] lstrlenW (lpString=".Mdf") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0043.818] lstrlenW (lpString=".dat") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0043.818] lstrlenW (lpString=".DAT") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0043.818] lstrlenW (lpString=".ldf") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.818] lstrlenW (lpString=".LDF") returned 4 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0043.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0043.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.818] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.819] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.819] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16382052400) returned 1 [0043.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8ed4090, dwHighDateTime=0x1d585b4)) [0043.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cae8 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cae8 | out: hHeap=0x260000) returned 1 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d220 [0043.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0043.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.820] GetLastError () returned 0x0 [0043.820] GetLastError () returned 0x0 [0043.820] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.834] GetLastError () returned 0x0 [0043.835] GetLastError () returned 0x0 [0043.836] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff457, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.836] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xba9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xba9, lpOverlapped=0x0) returned 1 [0043.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.837] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.837] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.837] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.837] CloseHandle (hObject=0xf8) returned 1 [0043.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0043.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.862] GetLastError () returned 0x0 [0043.862] RtlWakeConditionVariable () returned 0x27e828 [0043.862] GetCurrentThreadId () returned 0x998 [0043.862] GetCurrentThreadId () returned 0x998 [0043.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0043.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0043.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1370 | out: hHeap=0x260000) returned 1 [0043.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d760 [0043.862] lstrlenW (lpString=".ldf") returned 4 [0043.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".ldf") returned 0x0 [0043.862] lstrlenW (lpString=".vhd") returned 4 [0043.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".vhd") returned 0x0 [0043.870] lstrlenW (lpString=".vhdx") returned 5 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".vhdx") returned 0x0 [0043.883] lstrlenW (lpString=".pst") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".pst") returned 0x0 [0043.883] lstrlenW (lpString=".ost") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".ost") returned 0x0 [0043.883] lstrlenW (lpString=".bak") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".bak") returned 0x0 [0043.883] lstrlenW (lpString=".bac") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".bac") returned 0x0 [0043.883] lstrlenW (lpString=".sys") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".sys") returned 0x0 [0043.883] lstrlenW (lpString=".v2i") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".v2i") returned 0x0 [0043.883] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch="s\r\n.v2i") returned 0x0 [0043.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.884] lstrlenW (lpString=".sql") returned 4 [0043.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".sql") returned 0x0 [0043.884] lstrlenW (lpString=".mdf") returned 4 [0043.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".mdf") returned 0x0 [0043.885] lstrlenW (lpString=".txt") returned 4 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".txt") returned 0x0 [0043.885] lstrlenW (lpString=".dbf") returned 4 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".dbf") returned 0x0 [0043.885] lstrlenW (lpString=".ckp") returned 4 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".ckp") returned 0x0 [0043.885] lstrlenW (lpString=".dacpac") returned 7 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".dacpac") returned 0x0 [0043.885] lstrlenW (lpString=".db3") returned 4 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".db3") returned 0x0 [0043.885] lstrlenW (lpString=".dtxs") returned 5 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".dtxs") returned 0x0 [0043.885] lstrlenW (lpString=".mdt") returned 4 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".mdt") returned 0x0 [0043.885] lstrlenW (lpString=".sdf") returned 4 [0043.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".sdf") returned 0x0 [0043.886] lstrlenW (lpString=".MDF") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".MDF") returned 0x0 [0043.886] lstrlenW (lpString=".DBF") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".DBF") returned 0x0 [0043.886] lstrlenW (lpString=".DB") returned 3 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".DB") returned 0x0 [0043.886] lstrlenW (lpString=".db") returned 3 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".db") returned 0x0 [0043.886] lstrlenW (lpString=".ndf") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".ndf") returned 0x0 [0043.886] lstrlenW (lpString=".NDF") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".NDF") returned 0x0 [0043.886] lstrlenW (lpString=".Mdf") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".Mdf") returned 0x0 [0043.886] lstrlenW (lpString=".dat") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".dat") returned 0x0 [0043.886] lstrlenW (lpString=".DAT") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".DAT") returned 0x0 [0043.886] lstrlenW (lpString=".ldf") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".ldf") returned 0x0 [0043.886] lstrlenW (lpString=".LDF") returned 4 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch=".LDF") returned 0x0 [0043.886] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.886] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.887] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.887] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.887] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16388837462) returned 1 [0043.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8f92770, dwHighDateTime=0x1d585b4)) [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf48 [0043.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf48 | out: hHeap=0x260000) returned 1 [0043.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ea68 [0043.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ea68 | out: hHeap=0x260000) returned 1 [0043.888] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.888] GetLastError () returned 0x0 [0043.888] GetLastError () returned 0x0 [0043.888] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.888] GetLastError () returned 0x0 [0043.888] GetLastError () returned 0x0 [0043.889] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffdef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.889] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x211, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x211, lpOverlapped=0x0) returned 1 [0043.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.889] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.889] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.890] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.890] CloseHandle (hObject=0x104) returned 1 [0043.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.[deadmin@cock.li].deadmin")) returned 1 [0043.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.890] GetLastError () returned 0x0 [0043.890] RtlWakeConditionVariable () returned 0x27e828 [0043.890] GetCurrentThreadId () returned 0x998 [0043.891] GetCurrentThreadId () returned 0x998 [0043.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0043.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0043.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0043.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0043.891] lstrlenW (lpString=".ldf") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".ldf") returned 0x0 [0043.891] lstrlenW (lpString=".vhd") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".vhd") returned 0x0 [0043.891] lstrlenW (lpString=".vhdx") returned 5 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".vhdx") returned 0x0 [0043.891] lstrlenW (lpString=".pst") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".pst") returned 0x0 [0043.891] lstrlenW (lpString=".ost") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".ost") returned 0x0 [0043.891] lstrlenW (lpString=".bak") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".bak") returned 0x0 [0043.891] lstrlenW (lpString=".bac") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".bac") returned 0x0 [0043.891] lstrlenW (lpString=".sys") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".sys") returned 0x0 [0043.891] lstrlenW (lpString=".v2i") returned 4 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".v2i") returned 0x0 [0043.891] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch="s\r\n.v2i") returned 0x0 [0043.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.895] lstrlenW (lpString=".sql") returned 4 [0043.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".sql") returned 0x0 [0043.895] lstrlenW (lpString=".mdf") returned 4 [0043.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".mdf") returned 0x0 [0043.895] lstrlenW (lpString=".txt") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".txt") returned 0x0 [0043.896] lstrlenW (lpString=".dbf") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".dbf") returned 0x0 [0043.896] lstrlenW (lpString=".ckp") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".ckp") returned 0x0 [0043.896] lstrlenW (lpString=".dacpac") returned 7 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".dacpac") returned 0x0 [0043.896] lstrlenW (lpString=".db3") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".db3") returned 0x0 [0043.896] lstrlenW (lpString=".dtxs") returned 5 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".dtxs") returned 0x0 [0043.896] lstrlenW (lpString=".mdt") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".mdt") returned 0x0 [0043.896] lstrlenW (lpString=".sdf") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".sdf") returned 0x0 [0043.896] lstrlenW (lpString=".MDF") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".MDF") returned 0x0 [0043.896] lstrlenW (lpString=".DBF") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".DBF") returned 0x0 [0043.896] lstrlenW (lpString=".DB") returned 3 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".DB") returned 0x0 [0043.896] lstrlenW (lpString=".db") returned 3 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".db") returned 0x0 [0043.896] lstrlenW (lpString=".ndf") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".ndf") returned 0x0 [0043.896] lstrlenW (lpString=".NDF") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".NDF") returned 0x0 [0043.896] lstrlenW (lpString=".Mdf") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".Mdf") returned 0x0 [0043.896] lstrlenW (lpString=".dat") returned 4 [0043.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".dat") returned 0x0 [0043.897] lstrlenW (lpString=".DAT") returned 4 [0043.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".DAT") returned 0x0 [0043.897] lstrlenW (lpString=".ldf") returned 4 [0043.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".ldf") returned 0x0 [0043.897] lstrlenW (lpString=".LDF") returned 4 [0043.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch=".LDF") returned 0x0 [0043.897] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.897] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.898] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.898] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.898] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16389888923) returned 1 [0043.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8f92770, dwHighDateTime=0x1d585b4)) [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf10 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d760 [0043.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0043.898] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.899] GetLastError () returned 0x0 [0043.899] GetLastError () returned 0x0 [0043.899] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.899] GetLastError () returned 0x0 [0043.899] GetLastError () returned 0x0 [0043.900] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffdea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.900] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x216, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x216, lpOverlapped=0x0) returned 1 [0043.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.900] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.900] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.900] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.900] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.900] CloseHandle (hObject=0x104) returned 1 [0043.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.[deadmin@cock.li].deadmin")) returned 1 [0043.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.901] GetLastError () returned 0x0 [0043.901] RtlWakeConditionVariable () returned 0x27e828 [0043.901] GetCurrentThreadId () returned 0x998 [0043.901] GetCurrentThreadId () returned 0x998 [0043.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0043.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d6b8 | out: hHeap=0x260000) returned 1 [0043.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0043.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d6b8 [0043.901] lstrlenW (lpString=".ldf") returned 4 [0043.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.901] lstrlenW (lpString=".vhd") returned 4 [0043.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0043.901] lstrlenW (lpString=".vhdx") returned 5 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0043.902] lstrlenW (lpString=".pst") returned 4 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0043.902] lstrlenW (lpString=".ost") returned 4 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0043.902] lstrlenW (lpString=".bak") returned 4 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0043.902] lstrlenW (lpString=".bac") returned 4 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0043.902] lstrlenW (lpString=".sys") returned 4 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0043.902] lstrlenW (lpString=".v2i") returned 4 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0043.902] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0043.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.903] lstrlenW (lpString=".sql") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0043.903] lstrlenW (lpString=".mdf") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0043.903] lstrlenW (lpString=".txt") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0043.903] lstrlenW (lpString=".dbf") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0043.903] lstrlenW (lpString=".ckp") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0043.903] lstrlenW (lpString=".dacpac") returned 7 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0043.903] lstrlenW (lpString=".db3") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0043.903] lstrlenW (lpString=".dtxs") returned 5 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0043.903] lstrlenW (lpString=".mdt") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0043.903] lstrlenW (lpString=".sdf") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0043.903] lstrlenW (lpString=".MDF") returned 4 [0043.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0043.904] lstrlenW (lpString=".DBF") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0043.904] lstrlenW (lpString=".DB") returned 3 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0043.904] lstrlenW (lpString=".db") returned 3 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0043.904] lstrlenW (lpString=".ndf") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0043.904] lstrlenW (lpString=".NDF") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0043.904] lstrlenW (lpString=".Mdf") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0043.904] lstrlenW (lpString=".dat") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0043.904] lstrlenW (lpString=".DAT") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0043.904] lstrlenW (lpString=".ldf") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.904] lstrlenW (lpString=".LDF") returned 4 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0043.904] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.904] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.905] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.905] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.905] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16390630164) returned 1 [0043.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8fb88d0, dwHighDateTime=0x1d585b4)) [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ced8 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0043.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0043.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0043.906] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0043.906] GetLastError () returned 0x0 [0043.906] GetLastError () returned 0x0 [0043.906] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0043.906] GetLastError () returned 0x0 [0043.906] GetLastError () returned 0x0 [0043.907] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff77b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.908] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x885, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x885, lpOverlapped=0x0) returned 1 [0043.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.908] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.908] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.908] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.908] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.908] CloseHandle (hObject=0x104) returned 1 [0043.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0043.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.910] GetLastError () returned 0x0 [0043.910] RtlWakeConditionVariable () returned 0x27e828 [0043.910] GetCurrentThreadId () returned 0x998 [0043.910] GetCurrentThreadId () returned 0x998 [0043.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0043.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0043.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cea0 | out: hHeap=0x260000) returned 1 [0043.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d418 [0043.910] lstrlenW (lpString=".ldf") returned 4 [0043.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.910] lstrlenW (lpString=".vhd") returned 4 [0043.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0043.911] lstrlenW (lpString=".vhdx") returned 5 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0043.911] lstrlenW (lpString=".pst") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0043.911] lstrlenW (lpString=".ost") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0043.911] lstrlenW (lpString=".bak") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0043.911] lstrlenW (lpString=".bac") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0043.911] lstrlenW (lpString=".sys") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0043.911] lstrlenW (lpString=".v2i") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0043.911] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0043.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.911] lstrlenW (lpString=".sql") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0043.911] lstrlenW (lpString=".mdf") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0043.911] lstrlenW (lpString=".txt") returned 4 [0043.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0043.911] lstrlenW (lpString=".dbf") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0043.912] lstrlenW (lpString=".ckp") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0043.912] lstrlenW (lpString=".dacpac") returned 7 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0043.912] lstrlenW (lpString=".db3") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0043.912] lstrlenW (lpString=".dtxs") returned 5 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0043.912] lstrlenW (lpString=".mdt") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0043.912] lstrlenW (lpString=".sdf") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0043.912] lstrlenW (lpString=".MDF") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0043.912] lstrlenW (lpString=".DBF") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0043.912] lstrlenW (lpString=".DB") returned 3 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0043.912] lstrlenW (lpString=".db") returned 3 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0043.912] lstrlenW (lpString=".ndf") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0043.912] lstrlenW (lpString=".NDF") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0043.912] lstrlenW (lpString=".Mdf") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0043.912] lstrlenW (lpString=".dat") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0043.912] lstrlenW (lpString=".DAT") returned 4 [0043.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0043.913] lstrlenW (lpString=".ldf") returned 4 [0043.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.913] lstrlenW (lpString=".LDF") returned 4 [0043.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0043.913] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.913] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0043.914] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.914] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.914] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16391481331) returned 1 [0043.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa8fb88d0, dwHighDateTime=0x1d585b4)) [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cea0 [0043.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cea0 | out: hHeap=0x260000) returned 1 [0043.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0043.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0043.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.992] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.006] GetLastError () returned 0x0 [0044.007] GetLastError () returned 0x0 [0044.007] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.007] GetLastError () returned 0x0 [0044.020] GetLastError () returned 0x0 [0044.026] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffaf6d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.026] WriteFile (in: hFile=0x104, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x5093, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x5093, lpOverlapped=0x0) returned 1 [0044.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0044.026] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.026] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.026] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.027] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.027] CloseHandle (hObject=0x104) returned 1 [0044.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.027] GetLastError () returned 0x0 [0044.027] RtlWakeConditionVariable () returned 0x27e828 [0044.027] GetCurrentThreadId () returned 0x998 [0044.028] GetCurrentThreadId () returned 0x998 [0044.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3820 [0044.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f31a8 | out: hHeap=0x260000) returned 1 [0044.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf80 | out: hHeap=0x260000) returned 1 [0044.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0044.028] lstrlenW (lpString=".ldf") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".ldf") returned 0x0 [0044.028] lstrlenW (lpString=".vhd") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".vhd") returned 0x0 [0044.028] lstrlenW (lpString=".vhdx") returned 5 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".vhdx") returned 0x0 [0044.028] lstrlenW (lpString=".pst") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".pst") returned 0x0 [0044.028] lstrlenW (lpString=".ost") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".ost") returned 0x0 [0044.028] lstrlenW (lpString=".bak") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".bak") returned 0x0 [0044.028] lstrlenW (lpString=".bac") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".bac") returned 0x0 [0044.028] lstrlenW (lpString=".sys") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".sys") returned 0x0 [0044.028] lstrlenW (lpString=".v2i") returned 4 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".v2i") returned 0x0 [0044.028] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.029] lstrlenW (lpString=".sql") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".sql") returned 0x0 [0044.029] lstrlenW (lpString=".mdf") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".mdf") returned 0x0 [0044.029] lstrlenW (lpString=".txt") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".txt") returned 0x0 [0044.029] lstrlenW (lpString=".dbf") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".dbf") returned 0x0 [0044.029] lstrlenW (lpString=".ckp") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".ckp") returned 0x0 [0044.029] lstrlenW (lpString=".dacpac") returned 7 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".dacpac") returned 0x0 [0044.029] lstrlenW (lpString=".db3") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".db3") returned 0x0 [0044.029] lstrlenW (lpString=".dtxs") returned 5 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".dtxs") returned 0x0 [0044.029] lstrlenW (lpString=".mdt") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".mdt") returned 0x0 [0044.029] lstrlenW (lpString=".sdf") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".sdf") returned 0x0 [0044.029] lstrlenW (lpString=".MDF") returned 4 [0044.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".MDF") returned 0x0 [0044.029] lstrlenW (lpString=".DBF") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".DBF") returned 0x0 [0044.030] lstrlenW (lpString=".DB") returned 3 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".DB") returned 0x0 [0044.030] lstrlenW (lpString=".db") returned 3 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".db") returned 0x0 [0044.030] lstrlenW (lpString=".ndf") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".ndf") returned 0x0 [0044.030] lstrlenW (lpString=".NDF") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".NDF") returned 0x0 [0044.030] lstrlenW (lpString=".Mdf") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".Mdf") returned 0x0 [0044.030] lstrlenW (lpString=".dat") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".dat") returned 0x0 [0044.030] lstrlenW (lpString=".DAT") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".DAT") returned 0x0 [0044.030] lstrlenW (lpString=".ldf") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".ldf") returned 0x0 [0044.030] lstrlenW (lpString=".LDF") returned 4 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch=".LDF") returned 0x0 [0044.030] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0044.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.030] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.031] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.031] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16403246390) returned 1 [0044.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa90e93d0, dwHighDateTime=0x1d585b4)) [0044.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf80 [0044.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf80 | out: hHeap=0x260000) returned 1 [0044.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0044.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0044.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0044.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0044.032] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.032] GetLastError () returned 0x0 [0044.032] GetLastError () returned 0x0 [0044.032] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.032] GetLastError () returned 0x0 [0044.032] GetLastError () returned 0x0 [0044.033] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffdac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.033] WriteFile (in: hFile=0x104, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x254, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x254, lpOverlapped=0x0) returned 1 [0044.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0044.034] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.034] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.034] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.034] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.034] CloseHandle (hObject=0x104) returned 1 [0044.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.035] GetLastError () returned 0x0 [0044.035] RtlWakeConditionVariable () returned 0x27e828 [0044.035] GetCurrentThreadId () returned 0x998 [0044.035] GetCurrentThreadId () returned 0x998 [0044.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3820 [0044.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3990 | out: hHeap=0x260000) returned 1 [0044.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd18 | out: hHeap=0x260000) returned 1 [0044.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3990 [0044.035] lstrlenW (lpString=".ldf") returned 4 [0044.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.035] lstrlenW (lpString=".vhd") returned 4 [0044.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.035] lstrlenW (lpString=".vhdx") returned 5 [0044.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.035] lstrlenW (lpString=".pst") returned 4 [0044.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.035] lstrlenW (lpString=".ost") returned 4 [0044.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.035] lstrlenW (lpString=".bak") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.036] lstrlenW (lpString=".bac") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.036] lstrlenW (lpString=".sys") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.036] lstrlenW (lpString=".v2i") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.036] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.036] lstrlenW (lpString=".sql") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.036] lstrlenW (lpString=".mdf") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.036] lstrlenW (lpString=".txt") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.036] lstrlenW (lpString=".dbf") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.036] lstrlenW (lpString=".ckp") returned 4 [0044.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.036] lstrlenW (lpString=".dacpac") returned 7 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.037] lstrlenW (lpString=".db3") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.037] lstrlenW (lpString=".dtxs") returned 5 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.037] lstrlenW (lpString=".mdt") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.037] lstrlenW (lpString=".sdf") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.037] lstrlenW (lpString=".MDF") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.037] lstrlenW (lpString=".DBF") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.037] lstrlenW (lpString=".DB") returned 3 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.037] lstrlenW (lpString=".db") returned 3 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.037] lstrlenW (lpString=".ndf") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.037] lstrlenW (lpString=".NDF") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.037] lstrlenW (lpString=".Mdf") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.037] lstrlenW (lpString=".dat") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.037] lstrlenW (lpString=".DAT") returned 4 [0044.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.038] lstrlenW (lpString=".ldf") returned 4 [0044.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.038] lstrlenW (lpString=".LDF") returned 4 [0044.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.038] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0044.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.038] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.039] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.039] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.039] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16403995078) returned 1 [0044.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa910f530, dwHighDateTime=0x1d585b4)) [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd18 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd18 | out: hHeap=0x260000) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0044.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0044.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0044.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0044.039] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.040] GetLastError () returned 0x0 [0044.040] GetLastError () returned 0x0 [0044.040] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.040] GetLastError () returned 0x0 [0044.040] GetLastError () returned 0x0 [0044.041] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff269, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.042] WriteFile (in: hFile=0x104, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0xd97, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0xd97, lpOverlapped=0x0) returned 1 [0044.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0044.042] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.042] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.042] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.042] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.042] CloseHandle (hObject=0x104) returned 1 [0044.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.042] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.044] GetLastError () returned 0x0 [0044.044] RtlWakeConditionVariable () returned 0x27e828 [0044.044] GetCurrentThreadId () returned 0x998 [0044.044] GetCurrentThreadId () returned 0x998 [0044.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3820 [0044.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f38d8 | out: hHeap=0x260000) returned 1 [0044.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cce0 | out: hHeap=0x260000) returned 1 [0044.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f38d8 [0044.045] lstrlenW (lpString=".ldf") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.045] lstrlenW (lpString=".vhd") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.045] lstrlenW (lpString=".vhdx") returned 5 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.045] lstrlenW (lpString=".pst") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.045] lstrlenW (lpString=".ost") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.045] lstrlenW (lpString=".bak") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.045] lstrlenW (lpString=".bac") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.045] lstrlenW (lpString=".sys") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.045] lstrlenW (lpString=".v2i") returned 4 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.045] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.046] lstrlenW (lpString=".sql") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.046] lstrlenW (lpString=".mdf") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.046] lstrlenW (lpString=".txt") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.046] lstrlenW (lpString=".dbf") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.046] lstrlenW (lpString=".ckp") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.046] lstrlenW (lpString=".dacpac") returned 7 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.046] lstrlenW (lpString=".db3") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.046] lstrlenW (lpString=".dtxs") returned 5 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.046] lstrlenW (lpString=".mdt") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.046] lstrlenW (lpString=".sdf") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.046] lstrlenW (lpString=".MDF") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.046] lstrlenW (lpString=".DBF") returned 4 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.046] lstrlenW (lpString=".DB") returned 3 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.046] lstrlenW (lpString=".db") returned 3 [0044.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.047] lstrlenW (lpString=".ndf") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.047] lstrlenW (lpString=".NDF") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.047] lstrlenW (lpString=".Mdf") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.047] lstrlenW (lpString=".dat") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.047] lstrlenW (lpString=".DAT") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.047] lstrlenW (lpString=".ldf") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.047] lstrlenW (lpString=".LDF") returned 4 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.047] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0044.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.047] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.048] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.048] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.048] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16404911304) returned 1 [0044.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa910f530, dwHighDateTime=0x1d585b4)) [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cce0 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cce0 | out: hHeap=0x260000) returned 1 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0044.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0044.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0044.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0044.048] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.049] GetLastError () returned 0x0 [0044.049] GetLastError () returned 0x0 [0044.049] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.049] GetLastError () returned 0x0 [0044.049] GetLastError () returned 0x0 [0044.051] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff83a3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.051] WriteFile (in: hFile=0x104, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x7c5d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c5d, lpOverlapped=0x0) returned 1 [0044.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0044.051] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.051] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.051] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.051] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.051] CloseHandle (hObject=0x104) returned 1 [0044.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.052] GetLastError () returned 0x0 [0044.052] RtlWakeConditionVariable () returned 0x27e828 [0044.052] GetCurrentThreadId () returned 0x998 [0044.052] GetCurrentThreadId () returned 0x998 [0044.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0044.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0044.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cca8 | out: hHeap=0x260000) returned 1 [0044.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0044.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.053] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.053] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.053] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.053] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.114] CloseHandle (hObject=0x104) returned 1 [0044.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0044.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0044.139] RtlWakeConditionVariable () returned 0x27e828 [0044.139] GetCurrentThreadId () returned 0x998 [0044.139] GetCurrentThreadId () returned 0x998 [0044.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0044.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da088 | out: hHeap=0x260000) returned 1 [0044.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381f8 | out: hHeap=0x260000) returned 1 [0044.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da088 [0044.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.140] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.140] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.140] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.140] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.141] CloseHandle (hObject=0x104) returned 1 [0044.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da088 | out: hHeap=0x260000) returned 1 [0044.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0044.141] RtlWakeConditionVariable () returned 0x27e828 [0044.141] GetCurrentThreadId () returned 0x998 [0044.141] GetCurrentThreadId () returned 0x998 [0044.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3c70 [0044.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2628 | out: hHeap=0x260000) returned 1 [0044.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1e8 | out: hHeap=0x260000) returned 1 [0044.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2628 [0044.141] lstrlenW (lpString=".ldf") returned 4 [0044.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".ldf") returned 0x0 [0044.141] lstrlenW (lpString=".vhd") returned 4 [0044.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".vhd") returned 0x0 [0044.141] lstrlenW (lpString=".vhdx") returned 5 [0044.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".vhdx") returned 0x0 [0044.141] lstrlenW (lpString=".pst") returned 4 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".pst") returned 0x0 [0044.142] lstrlenW (lpString=".ost") returned 4 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".ost") returned 0x0 [0044.142] lstrlenW (lpString=".bak") returned 4 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".bak") returned 0x0 [0044.142] lstrlenW (lpString=".bac") returned 4 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".bac") returned 0x0 [0044.142] lstrlenW (lpString=".sys") returned 4 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".sys") returned 0x0 [0044.142] lstrlenW (lpString=".v2i") returned 4 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".v2i") returned 0x0 [0044.142] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0044.180] lstrlenW (lpString=".sql") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".sql") returned 0x0 [0044.180] lstrlenW (lpString=".mdf") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".mdf") returned 0x0 [0044.180] lstrlenW (lpString=".txt") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".txt") returned 0x0 [0044.180] lstrlenW (lpString=".dbf") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".dbf") returned 0x0 [0044.180] lstrlenW (lpString=".ckp") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".ckp") returned 0x0 [0044.180] lstrlenW (lpString=".dacpac") returned 7 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".dacpac") returned 0x0 [0044.180] lstrlenW (lpString=".db3") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".db3") returned 0x0 [0044.180] lstrlenW (lpString=".dtxs") returned 5 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".dtxs") returned 0x0 [0044.180] lstrlenW (lpString=".mdt") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".mdt") returned 0x0 [0044.180] lstrlenW (lpString=".sdf") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".sdf") returned 0x0 [0044.180] lstrlenW (lpString=".MDF") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".MDF") returned 0x0 [0044.180] lstrlenW (lpString=".DBF") returned 4 [0044.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".DBF") returned 0x0 [0044.181] lstrlenW (lpString=".DB") returned 3 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".DB") returned 0x0 [0044.181] lstrlenW (lpString=".db") returned 3 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".db") returned 0x0 [0044.181] lstrlenW (lpString=".ndf") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".ndf") returned 0x0 [0044.181] lstrlenW (lpString=".NDF") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".NDF") returned 0x0 [0044.181] lstrlenW (lpString=".Mdf") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".Mdf") returned 0x0 [0044.181] lstrlenW (lpString=".dat") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".dat") returned 0x0 [0044.181] lstrlenW (lpString=".DAT") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".DAT") returned 0x0 [0044.181] lstrlenW (lpString=".ldf") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".ldf") returned 0x0 [0044.181] lstrlenW (lpString=".LDF") returned 4 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch=".LDF") returned 0x0 [0044.181] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.181] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.182] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.182] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16418332167) returned 1 [0044.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9266190, dwHighDateTime=0x1d585b4)) [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299248 [0044.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299248 | out: hHeap=0x260000) returned 1 [0044.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.183] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.183] GetLastError () returned 0x0 [0044.183] GetLastError () returned 0x0 [0044.183] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.183] GetLastError () returned 0x0 [0044.183] GetLastError () returned 0x0 [0044.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff1e46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.186] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xe1ba, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xe1ba, lpOverlapped=0x0) returned 1 [0044.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.187] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.187] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.187] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.187] CloseHandle (hObject=0xf0) returned 1 [0044.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.188] GetLastError () returned 0x0 [0044.188] RtlWakeConditionVariable () returned 0x27e828 [0044.188] GetCurrentThreadId () returned 0x998 [0044.188] GetCurrentThreadId () returned 0x998 [0044.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab78 | out: hHeap=0x260000) returned 1 [0044.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338150 | out: hHeap=0x260000) returned 1 [0044.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dab78 [0044.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0044.190] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.190] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.190] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.190] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.191] CloseHandle (hObject=0xf0) returned 1 [0044.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab78 | out: hHeap=0x260000) returned 1 [0044.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.191] RtlWakeConditionVariable () returned 0x27e828 [0044.191] GetCurrentThreadId () returned 0x998 [0044.191] GetCurrentThreadId () returned 0x998 [0044.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e570 | out: hHeap=0x260000) returned 1 [0044.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0044.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e570 [0044.191] lstrlenW (lpString=".ldf") returned 4 [0044.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".ldf") returned 0x0 [0044.191] lstrlenW (lpString=".vhd") returned 4 [0044.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".vhd") returned 0x0 [0044.192] lstrlenW (lpString=".vhdx") returned 5 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".vhdx") returned 0x0 [0044.192] lstrlenW (lpString=".pst") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".pst") returned 0x0 [0044.192] lstrlenW (lpString=".ost") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".ost") returned 0x0 [0044.192] lstrlenW (lpString=".bak") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".bak") returned 0x0 [0044.192] lstrlenW (lpString=".bac") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".bac") returned 0x0 [0044.192] lstrlenW (lpString=".sys") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".sys") returned 0x0 [0044.192] lstrlenW (lpString=".v2i") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".v2i") returned 0x0 [0044.192] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0044.192] lstrlenW (lpString=".sql") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".sql") returned 0x0 [0044.192] lstrlenW (lpString=".mdf") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".mdf") returned 0x0 [0044.192] lstrlenW (lpString=".txt") returned 4 [0044.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".txt") returned 0x0 [0044.193] lstrlenW (lpString=".dbf") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".dbf") returned 0x0 [0044.193] lstrlenW (lpString=".ckp") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".ckp") returned 0x0 [0044.193] lstrlenW (lpString=".dacpac") returned 7 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".dacpac") returned 0x0 [0044.193] lstrlenW (lpString=".db3") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".db3") returned 0x0 [0044.193] lstrlenW (lpString=".dtxs") returned 5 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".dtxs") returned 0x0 [0044.193] lstrlenW (lpString=".mdt") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".mdt") returned 0x0 [0044.193] lstrlenW (lpString=".sdf") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".sdf") returned 0x0 [0044.193] lstrlenW (lpString=".MDF") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".MDF") returned 0x0 [0044.193] lstrlenW (lpString=".DBF") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".DBF") returned 0x0 [0044.193] lstrlenW (lpString=".DB") returned 3 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".DB") returned 0x0 [0044.193] lstrlenW (lpString=".db") returned 3 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".db") returned 0x0 [0044.193] lstrlenW (lpString=".ndf") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".ndf") returned 0x0 [0044.193] lstrlenW (lpString=".NDF") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".NDF") returned 0x0 [0044.193] lstrlenW (lpString=".Mdf") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".Mdf") returned 0x0 [0044.193] lstrlenW (lpString=".dat") returned 4 [0044.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".dat") returned 0x0 [0044.193] lstrlenW (lpString=".DAT") returned 4 [0044.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".DAT") returned 0x0 [0044.194] lstrlenW (lpString=".ldf") returned 4 [0044.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".ldf") returned 0x0 [0044.194] lstrlenW (lpString=".LDF") returned 4 [0044.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch=".LDF") returned 0x0 [0044.194] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.194] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.195] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.195] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.195] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16419606884) returned 1 [0044.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa928c2f0, dwHighDateTime=0x1d585b4)) [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1450 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30db98 [0044.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30db98 | out: hHeap=0x260000) returned 1 [0044.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.196] GetLastError () returned 0x0 [0044.196] GetLastError () returned 0x0 [0044.196] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.196] GetLastError () returned 0x0 [0044.196] GetLastError () returned 0x0 [0044.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff45bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.198] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xba44, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0xba44, lpOverlapped=0x0) returned 1 [0044.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.198] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.198] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.198] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.198] CloseHandle (hObject=0xf0) returned 1 [0044.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.199] GetLastError () returned 0x0 [0044.199] RtlWakeConditionVariable () returned 0x27e828 [0044.199] GetCurrentThreadId () returned 0x998 [0044.199] GetCurrentThreadId () returned 0x998 [0044.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0044.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0044.199] lstrlenW (lpString=".ldf") returned 4 [0044.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".ldf") returned 0x0 [0044.199] lstrlenW (lpString=".vhd") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".vhd") returned 0x0 [0044.200] lstrlenW (lpString=".vhdx") returned 5 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".vhdx") returned 0x0 [0044.200] lstrlenW (lpString=".pst") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".pst") returned 0x0 [0044.200] lstrlenW (lpString=".ost") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".ost") returned 0x0 [0044.200] lstrlenW (lpString=".bak") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".bak") returned 0x0 [0044.200] lstrlenW (lpString=".bac") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".bac") returned 0x0 [0044.200] lstrlenW (lpString=".sys") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".sys") returned 0x0 [0044.200] lstrlenW (lpString=".v2i") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".v2i") returned 0x0 [0044.200] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0044.200] lstrlenW (lpString=".sql") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".sql") returned 0x0 [0044.200] lstrlenW (lpString=".mdf") returned 4 [0044.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".mdf") returned 0x0 [0044.201] lstrlenW (lpString=".txt") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".txt") returned 0x0 [0044.201] lstrlenW (lpString=".dbf") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".dbf") returned 0x0 [0044.201] lstrlenW (lpString=".ckp") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".ckp") returned 0x0 [0044.201] lstrlenW (lpString=".dacpac") returned 7 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".dacpac") returned 0x0 [0044.201] lstrlenW (lpString=".db3") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".db3") returned 0x0 [0044.201] lstrlenW (lpString=".dtxs") returned 5 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".dtxs") returned 0x0 [0044.201] lstrlenW (lpString=".mdt") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".mdt") returned 0x0 [0044.201] lstrlenW (lpString=".sdf") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".sdf") returned 0x0 [0044.201] lstrlenW (lpString=".MDF") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".MDF") returned 0x0 [0044.201] lstrlenW (lpString=".DBF") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".DBF") returned 0x0 [0044.201] lstrlenW (lpString=".DB") returned 3 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".DB") returned 0x0 [0044.201] lstrlenW (lpString=".db") returned 3 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".db") returned 0x0 [0044.201] lstrlenW (lpString=".ndf") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".ndf") returned 0x0 [0044.201] lstrlenW (lpString=".NDF") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".NDF") returned 0x0 [0044.201] lstrlenW (lpString=".Mdf") returned 4 [0044.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".Mdf") returned 0x0 [0044.201] lstrlenW (lpString=".dat") returned 4 [0044.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".dat") returned 0x0 [0044.202] lstrlenW (lpString=".DAT") returned 4 [0044.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".DAT") returned 0x0 [0044.202] lstrlenW (lpString=".ldf") returned 4 [0044.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".ldf") returned 0x0 [0044.202] lstrlenW (lpString=".LDF") returned 4 [0044.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch=".LDF") returned 0x0 [0044.202] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.202] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.203] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.203] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.203] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16420387135) returned 1 [0044.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa928c2f0, dwHighDateTime=0x1d585b4)) [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e570 [0044.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e570 | out: hHeap=0x260000) returned 1 [0044.203] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.203] GetLastError () returned 0x0 [0044.203] GetLastError () returned 0x0 [0044.204] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.204] GetLastError () returned 0x0 [0044.204] GetLastError () returned 0x0 [0044.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.205] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x262, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x262, lpOverlapped=0x0) returned 1 [0044.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.205] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.205] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.205] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.205] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.205] CloseHandle (hObject=0xf0) returned 1 [0044.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.207] GetLastError () returned 0x0 [0044.207] RtlWakeConditionVariable () returned 0x27e828 [0044.207] GetCurrentThreadId () returned 0x998 [0044.207] GetCurrentThreadId () returned 0x998 [0044.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0044.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.208] lstrlenW (lpString=".ldf") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.208] lstrlenW (lpString=".vhd") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.208] lstrlenW (lpString=".vhdx") returned 5 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.208] lstrlenW (lpString=".pst") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.208] lstrlenW (lpString=".ost") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.208] lstrlenW (lpString=".bak") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.208] lstrlenW (lpString=".bac") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.208] lstrlenW (lpString=".sys") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.208] lstrlenW (lpString=".v2i") returned 4 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.208] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0044.208] lstrlenW (lpString=".sql") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.209] lstrlenW (lpString=".mdf") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.209] lstrlenW (lpString=".txt") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.209] lstrlenW (lpString=".dbf") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.209] lstrlenW (lpString=".ckp") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.209] lstrlenW (lpString=".dacpac") returned 7 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.209] lstrlenW (lpString=".db3") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.209] lstrlenW (lpString=".dtxs") returned 5 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.209] lstrlenW (lpString=".mdt") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.209] lstrlenW (lpString=".sdf") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.209] lstrlenW (lpString=".MDF") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.209] lstrlenW (lpString=".DBF") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.209] lstrlenW (lpString=".DB") returned 3 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.209] lstrlenW (lpString=".db") returned 3 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.209] lstrlenW (lpString=".ndf") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.209] lstrlenW (lpString=".NDF") returned 4 [0044.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.210] lstrlenW (lpString=".Mdf") returned 4 [0044.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.210] lstrlenW (lpString=".dat") returned 4 [0044.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.210] lstrlenW (lpString=".DAT") returned 4 [0044.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.210] lstrlenW (lpString=".ldf") returned 4 [0044.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.210] lstrlenW (lpString=".LDF") returned 4 [0044.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.210] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.210] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.298] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0044.298] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16429948057) returned 1 [0044.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9370b30, dwHighDateTime=0x1d585b4)) [0044.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0044.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0044.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.299] GetLastError () returned 0x0 [0044.299] GetLastError () returned 0x0 [0044.299] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.299] GetLastError () returned 0x0 [0044.299] GetLastError () returned 0x0 [0044.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffaad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.302] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x553, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x1cffdb0*=0x553, lpOverlapped=0x0) returned 1 [0044.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.302] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.302] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.302] CloseHandle (hObject=0xf0) returned 1 [0044.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.305] GetLastError () returned 0x0 [0044.305] RtlWakeConditionVariable () returned 0x27e828 [0044.306] GetCurrentThreadId () returned 0x998 [0044.306] GetCurrentThreadId () returned 0x998 [0044.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db348 | out: hHeap=0x260000) returned 1 [0044.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1108 | out: hHeap=0x260000) returned 1 [0044.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db348 [0044.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.325] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.325] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.325] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.325] WriteFile (in: hFile=0x108, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.367] CloseHandle (hObject=0x108) returned 1 [0044.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db348 | out: hHeap=0x260000) returned 1 [0044.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.367] RtlWakeConditionVariable () returned 0x27e828 [0044.367] GetCurrentThreadId () returned 0x998 [0044.367] GetCurrentThreadId () returned 0x998 [0044.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e0d8 | out: hHeap=0x260000) returned 1 [0044.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338118 | out: hHeap=0x260000) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e0d8 [0044.367] lstrlenW (lpString=".ldf") returned 4 [0044.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.367] lstrlenW (lpString=".vhd") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.368] lstrlenW (lpString=".vhdx") returned 5 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.368] lstrlenW (lpString=".pst") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.368] lstrlenW (lpString=".ost") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.368] lstrlenW (lpString=".bak") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.368] lstrlenW (lpString=".bac") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.368] lstrlenW (lpString=".sys") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.368] lstrlenW (lpString=".v2i") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.368] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.368] lstrlenW (lpString=".sql") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.368] lstrlenW (lpString=".mdf") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.368] lstrlenW (lpString=".txt") returned 4 [0044.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.369] lstrlenW (lpString=".dbf") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.369] lstrlenW (lpString=".ckp") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.369] lstrlenW (lpString=".dacpac") returned 7 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.369] lstrlenW (lpString=".db3") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.369] lstrlenW (lpString=".dtxs") returned 5 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.369] lstrlenW (lpString=".mdt") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.369] lstrlenW (lpString=".sdf") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.369] lstrlenW (lpString=".MDF") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.369] lstrlenW (lpString=".DBF") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.369] lstrlenW (lpString=".DB") returned 3 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.369] lstrlenW (lpString=".db") returned 3 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.369] lstrlenW (lpString=".ndf") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.369] lstrlenW (lpString=".NDF") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.369] lstrlenW (lpString=".Mdf") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.369] lstrlenW (lpString=".dat") returned 4 [0044.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.370] lstrlenW (lpString=".DAT") returned 4 [0044.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.370] lstrlenW (lpString=".ldf") returned 4 [0044.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.370] lstrlenW (lpString=".LDF") returned 4 [0044.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.370] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.370] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.371] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.371] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16437184488) returned 1 [0044.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa942f210, dwHighDateTime=0x1d585b4)) [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338118 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338118 | out: hHeap=0x260000) returned 1 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.371] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.371] GetLastError () returned 0x0 [0044.371] GetLastError () returned 0x0 [0044.372] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.372] GetLastError () returned 0x0 [0044.372] GetLastError () returned 0x0 [0044.373] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.373] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x5ad, lpOverlapped=0x0) returned 1 [0044.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.373] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.373] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.374] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.374] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.374] CloseHandle (hObject=0x108) returned 1 [0044.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.376] GetLastError () returned 0x0 [0044.377] RtlWakeConditionVariable () returned 0x27e828 [0044.377] GetCurrentThreadId () returned 0x998 [0044.377] GetCurrentThreadId () returned 0x998 [0044.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0044.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380e0 | out: hHeap=0x260000) returned 1 [0044.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.377] lstrlenW (lpString=".ldf") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.377] lstrlenW (lpString=".vhd") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.377] lstrlenW (lpString=".vhdx") returned 5 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.377] lstrlenW (lpString=".pst") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.377] lstrlenW (lpString=".ost") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.377] lstrlenW (lpString=".bak") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.377] lstrlenW (lpString=".bac") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.377] lstrlenW (lpString=".sys") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.377] lstrlenW (lpString=".v2i") returned 4 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.377] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.378] lstrlenW (lpString=".sql") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.378] lstrlenW (lpString=".mdf") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.378] lstrlenW (lpString=".txt") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.378] lstrlenW (lpString=".dbf") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.378] lstrlenW (lpString=".ckp") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.378] lstrlenW (lpString=".dacpac") returned 7 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.378] lstrlenW (lpString=".db3") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.378] lstrlenW (lpString=".dtxs") returned 5 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.378] lstrlenW (lpString=".mdt") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.378] lstrlenW (lpString=".sdf") returned 4 [0044.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.378] lstrlenW (lpString=".MDF") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.379] lstrlenW (lpString=".DBF") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.379] lstrlenW (lpString=".DB") returned 3 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.379] lstrlenW (lpString=".db") returned 3 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.379] lstrlenW (lpString=".ndf") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.379] lstrlenW (lpString=".NDF") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.379] lstrlenW (lpString=".Mdf") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.379] lstrlenW (lpString=".dat") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.379] lstrlenW (lpString=".DAT") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.379] lstrlenW (lpString=".ldf") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.379] lstrlenW (lpString=".LDF") returned 4 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.379] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.379] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.380] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.380] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16438161381) returned 1 [0044.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa942f210, dwHighDateTime=0x1d585b4)) [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3380e0 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380e0 | out: hHeap=0x260000) returned 1 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e0d8 [0044.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e0d8 | out: hHeap=0x260000) returned 1 [0044.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.381] GetLastError () returned 0x0 [0044.381] GetLastError () returned 0x0 [0044.381] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.381] GetLastError () returned 0x0 [0044.381] GetLastError () returned 0x0 [0044.384] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9dee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.384] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x6212, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x6212, lpOverlapped=0x0) returned 1 [0044.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.384] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.385] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.385] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.385] CloseHandle (hObject=0x108) returned 1 [0044.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.385] GetLastError () returned 0x0 [0044.386] RtlWakeConditionVariable () returned 0x27e828 [0044.386] GetCurrentThreadId () returned 0x998 [0044.386] GetCurrentThreadId () returned 0x998 [0044.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db0f0 | out: hHeap=0x260000) returned 1 [0044.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380a8 | out: hHeap=0x260000) returned 1 [0044.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db0f0 [0044.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.387] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.387] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.387] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.387] WriteFile (in: hFile=0x108, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.388] CloseHandle (hObject=0x108) returned 1 [0044.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db0f0 | out: hHeap=0x260000) returned 1 [0044.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.388] RtlWakeConditionVariable () returned 0x27e828 [0044.388] GetCurrentThreadId () returned 0x998 [0044.388] GetCurrentThreadId () returned 0x998 [0044.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ec00 | out: hHeap=0x260000) returned 1 [0044.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0044.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ec00 [0044.388] lstrlenW (lpString=".ldf") returned 4 [0044.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".ldf") returned 0x0 [0044.388] lstrlenW (lpString=".vhd") returned 4 [0044.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".vhd") returned 0x0 [0044.388] lstrlenW (lpString=".vhdx") returned 5 [0044.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".vhdx") returned 0x0 [0044.388] lstrlenW (lpString=".pst") returned 4 [0044.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".pst") returned 0x0 [0044.389] lstrlenW (lpString=".ost") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".ost") returned 0x0 [0044.389] lstrlenW (lpString=".bak") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".bak") returned 0x0 [0044.389] lstrlenW (lpString=".bac") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".bac") returned 0x0 [0044.389] lstrlenW (lpString=".sys") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".sys") returned 0x0 [0044.389] lstrlenW (lpString=".v2i") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".v2i") returned 0x0 [0044.389] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.389] lstrlenW (lpString=".sql") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".sql") returned 0x0 [0044.389] lstrlenW (lpString=".mdf") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".mdf") returned 0x0 [0044.389] lstrlenW (lpString=".txt") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".txt") returned 0x0 [0044.389] lstrlenW (lpString=".dbf") returned 4 [0044.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".dbf") returned 0x0 [0044.390] lstrlenW (lpString=".ckp") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".ckp") returned 0x0 [0044.390] lstrlenW (lpString=".dacpac") returned 7 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".dacpac") returned 0x0 [0044.390] lstrlenW (lpString=".db3") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".db3") returned 0x0 [0044.390] lstrlenW (lpString=".dtxs") returned 5 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".dtxs") returned 0x0 [0044.390] lstrlenW (lpString=".mdt") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".mdt") returned 0x0 [0044.390] lstrlenW (lpString=".sdf") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".sdf") returned 0x0 [0044.390] lstrlenW (lpString=".MDF") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".MDF") returned 0x0 [0044.390] lstrlenW (lpString=".DBF") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".DBF") returned 0x0 [0044.390] lstrlenW (lpString=".DB") returned 3 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".DB") returned 0x0 [0044.390] lstrlenW (lpString=".db") returned 3 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".db") returned 0x0 [0044.390] lstrlenW (lpString=".ndf") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".ndf") returned 0x0 [0044.390] lstrlenW (lpString=".NDF") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".NDF") returned 0x0 [0044.390] lstrlenW (lpString=".Mdf") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".Mdf") returned 0x0 [0044.390] lstrlenW (lpString=".dat") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".dat") returned 0x0 [0044.390] lstrlenW (lpString=".DAT") returned 4 [0044.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".DAT") returned 0x0 [0044.390] lstrlenW (lpString=".ldf") returned 4 [0044.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".ldf") returned 0x0 [0044.391] lstrlenW (lpString=".LDF") returned 4 [0044.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch=".LDF") returned 0x0 [0044.391] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.391] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.391] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.392] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.392] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16439308515) returned 1 [0044.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9455370, dwHighDateTime=0x1d585b4)) [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d400 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e030 [0044.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0044.392] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.393] GetLastError () returned 0x0 [0044.393] GetLastError () returned 0x0 [0044.393] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.393] GetLastError () returned 0x0 [0044.393] GetLastError () returned 0x0 [0044.469] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.469] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0044.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.470] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.470] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.470] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.470] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.470] CloseHandle (hObject=0x108) returned 1 [0044.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.471] GetLastError () returned 0x0 [0044.471] RtlWakeConditionVariable () returned 0x27e828 [0044.471] GetCurrentThreadId () returned 0x998 [0044.471] GetCurrentThreadId () returned 0x998 [0044.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b400 | out: hHeap=0x260000) returned 1 [0044.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d470 | out: hHeap=0x260000) returned 1 [0044.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b400 [0044.471] lstrlenW (lpString=".ldf") returned 4 [0044.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".ldf") returned 0x0 [0044.471] lstrlenW (lpString=".vhd") returned 4 [0044.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".vhd") returned 0x0 [0044.471] lstrlenW (lpString=".vhdx") returned 5 [0044.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".vhdx") returned 0x0 [0044.471] lstrlenW (lpString=".pst") returned 4 [0044.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".pst") returned 0x0 [0044.472] lstrlenW (lpString=".ost") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".ost") returned 0x0 [0044.472] lstrlenW (lpString=".bak") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".bak") returned 0x0 [0044.472] lstrlenW (lpString=".bac") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".bac") returned 0x0 [0044.472] lstrlenW (lpString=".sys") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".sys") returned 0x0 [0044.472] lstrlenW (lpString=".v2i") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".v2i") returned 0x0 [0044.472] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.472] lstrlenW (lpString=".sql") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".sql") returned 0x0 [0044.472] lstrlenW (lpString=".mdf") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".mdf") returned 0x0 [0044.472] lstrlenW (lpString=".txt") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".txt") returned 0x0 [0044.472] lstrlenW (lpString=".dbf") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".dbf") returned 0x0 [0044.472] lstrlenW (lpString=".ckp") returned 4 [0044.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".ckp") returned 0x0 [0044.473] lstrlenW (lpString=".dacpac") returned 7 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".dacpac") returned 0x0 [0044.473] lstrlenW (lpString=".db3") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".db3") returned 0x0 [0044.473] lstrlenW (lpString=".dtxs") returned 5 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".dtxs") returned 0x0 [0044.473] lstrlenW (lpString=".mdt") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".mdt") returned 0x0 [0044.473] lstrlenW (lpString=".sdf") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".sdf") returned 0x0 [0044.473] lstrlenW (lpString=".MDF") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".MDF") returned 0x0 [0044.473] lstrlenW (lpString=".DBF") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".DBF") returned 0x0 [0044.473] lstrlenW (lpString=".DB") returned 3 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".DB") returned 0x0 [0044.473] lstrlenW (lpString=".db") returned 3 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".db") returned 0x0 [0044.473] lstrlenW (lpString=".ndf") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".ndf") returned 0x0 [0044.473] lstrlenW (lpString=".NDF") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".NDF") returned 0x0 [0044.473] lstrlenW (lpString=".Mdf") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".Mdf") returned 0x0 [0044.473] lstrlenW (lpString=".dat") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".dat") returned 0x0 [0044.473] lstrlenW (lpString=".DAT") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".DAT") returned 0x0 [0044.473] lstrlenW (lpString=".ldf") returned 4 [0044.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".ldf") returned 0x0 [0044.473] lstrlenW (lpString=".LDF") returned 4 [0044.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch=".LDF") returned 0x0 [0044.474] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.474] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.474] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.475] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16447569003) returned 1 [0044.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9513a50, dwHighDateTime=0x1d585b4)) [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d470 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d470 | out: hHeap=0x260000) returned 1 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.475] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.475] GetLastError () returned 0x0 [0044.475] GetLastError () returned 0x0 [0044.475] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.475] GetLastError () returned 0x0 [0044.476] GetLastError () returned 0x0 [0044.478] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffed212, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.478] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x12dee, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x12dee, lpOverlapped=0x0) returned 1 [0044.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.478] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.478] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.478] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.478] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.478] CloseHandle (hObject=0x108) returned 1 [0044.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.479] GetLastError () returned 0x0 [0044.479] RtlWakeConditionVariable () returned 0x27e828 [0044.479] GetCurrentThreadId () returned 0x998 [0044.479] GetCurrentThreadId () returned 0x998 [0044.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0044.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d438 | out: hHeap=0x260000) returned 1 [0044.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0044.479] lstrlenW (lpString=".ldf") returned 4 [0044.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".ldf") returned 0x0 [0044.479] lstrlenW (lpString=".vhd") returned 4 [0044.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".vhd") returned 0x0 [0044.479] lstrlenW (lpString=".vhdx") returned 5 [0044.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".vhdx") returned 0x0 [0044.479] lstrlenW (lpString=".pst") returned 4 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".pst") returned 0x0 [0044.480] lstrlenW (lpString=".ost") returned 4 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".ost") returned 0x0 [0044.480] lstrlenW (lpString=".bak") returned 4 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".bak") returned 0x0 [0044.480] lstrlenW (lpString=".bac") returned 4 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".bac") returned 0x0 [0044.480] lstrlenW (lpString=".sys") returned 4 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".sys") returned 0x0 [0044.480] lstrlenW (lpString=".v2i") returned 4 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".v2i") returned 0x0 [0044.480] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.481] lstrlenW (lpString=".sql") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".sql") returned 0x0 [0044.481] lstrlenW (lpString=".mdf") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".mdf") returned 0x0 [0044.481] lstrlenW (lpString=".txt") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".txt") returned 0x0 [0044.481] lstrlenW (lpString=".dbf") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".dbf") returned 0x0 [0044.481] lstrlenW (lpString=".ckp") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".ckp") returned 0x0 [0044.481] lstrlenW (lpString=".dacpac") returned 7 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".dacpac") returned 0x0 [0044.481] lstrlenW (lpString=".db3") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".db3") returned 0x0 [0044.481] lstrlenW (lpString=".dtxs") returned 5 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".dtxs") returned 0x0 [0044.481] lstrlenW (lpString=".mdt") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".mdt") returned 0x0 [0044.481] lstrlenW (lpString=".sdf") returned 4 [0044.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".sdf") returned 0x0 [0044.481] lstrlenW (lpString=".MDF") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".MDF") returned 0x0 [0044.482] lstrlenW (lpString=".DBF") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".DBF") returned 0x0 [0044.482] lstrlenW (lpString=".DB") returned 3 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".DB") returned 0x0 [0044.482] lstrlenW (lpString=".db") returned 3 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".db") returned 0x0 [0044.482] lstrlenW (lpString=".ndf") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".ndf") returned 0x0 [0044.482] lstrlenW (lpString=".NDF") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".NDF") returned 0x0 [0044.482] lstrlenW (lpString=".Mdf") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".Mdf") returned 0x0 [0044.482] lstrlenW (lpString=".dat") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".dat") returned 0x0 [0044.482] lstrlenW (lpString=".DAT") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".DAT") returned 0x0 [0044.482] lstrlenW (lpString=".ldf") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".ldf") returned 0x0 [0044.482] lstrlenW (lpString=".LDF") returned 4 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch=".LDF") returned 0x0 [0044.482] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.482] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.483] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.483] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16448434340) returned 1 [0044.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9539bb0, dwHighDateTime=0x1d585b4)) [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d438 [0044.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d438 | out: hHeap=0x260000) returned 1 [0044.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.484] GetLastError () returned 0x0 [0044.484] GetLastError () returned 0x0 [0044.484] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.484] GetLastError () returned 0x0 [0044.484] GetLastError () returned 0x0 [0044.485] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffddd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.485] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x223, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x223, lpOverlapped=0x0) returned 1 [0044.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.486] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.486] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.486] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.486] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.486] CloseHandle (hObject=0x108) returned 1 [0044.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.488] GetLastError () returned 0x0 [0044.488] RtlWakeConditionVariable () returned 0x27e828 [0044.488] GetCurrentThreadId () returned 0x998 [0044.488] GetCurrentThreadId () returned 0x998 [0044.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b290 | out: hHeap=0x260000) returned 1 [0044.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0044.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b290 [0044.488] lstrlenW (lpString=".ldf") returned 4 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.488] lstrlenW (lpString=".vhd") returned 4 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.488] lstrlenW (lpString=".vhdx") returned 5 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.488] lstrlenW (lpString=".pst") returned 4 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.488] lstrlenW (lpString=".ost") returned 4 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.488] lstrlenW (lpString=".bak") returned 4 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.488] lstrlenW (lpString=".bac") returned 4 [0044.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.489] lstrlenW (lpString=".sys") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.489] lstrlenW (lpString=".v2i") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.489] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.489] lstrlenW (lpString=".sql") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.489] lstrlenW (lpString=".mdf") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.489] lstrlenW (lpString=".txt") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.489] lstrlenW (lpString=".dbf") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.489] lstrlenW (lpString=".ckp") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.489] lstrlenW (lpString=".dacpac") returned 7 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.489] lstrlenW (lpString=".db3") returned 4 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.489] lstrlenW (lpString=".dtxs") returned 5 [0044.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.490] lstrlenW (lpString=".mdt") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.490] lstrlenW (lpString=".sdf") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.490] lstrlenW (lpString=".MDF") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.490] lstrlenW (lpString=".DBF") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.490] lstrlenW (lpString=".DB") returned 3 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.490] lstrlenW (lpString=".db") returned 3 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.490] lstrlenW (lpString=".ndf") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.490] lstrlenW (lpString=".NDF") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.490] lstrlenW (lpString=".Mdf") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.490] lstrlenW (lpString=".dat") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.490] lstrlenW (lpString=".DAT") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.490] lstrlenW (lpString=".ldf") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.490] lstrlenW (lpString=".LDF") returned 4 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.490] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.490] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.491] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.491] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.492] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16449267414) returned 1 [0044.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa955fd10, dwHighDateTime=0x1d585b4)) [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f90 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.492] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.492] GetLastError () returned 0x0 [0044.492] GetLastError () returned 0x0 [0044.492] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.492] GetLastError () returned 0x0 [0044.493] GetLastError () returned 0x0 [0044.494] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffab6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.494] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x54a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x54a, lpOverlapped=0x0) returned 1 [0044.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.494] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.494] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.494] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.494] CloseHandle (hObject=0x108) returned 1 [0044.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.495] GetLastError () returned 0x0 [0044.495] RtlWakeConditionVariable () returned 0x27e828 [0044.495] GetCurrentThreadId () returned 0x998 [0044.495] GetCurrentThreadId () returned 0x998 [0044.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0044.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b1d8 | out: hHeap=0x260000) returned 1 [0044.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f58 | out: hHeap=0x260000) returned 1 [0044.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b1d8 [0044.495] lstrlenW (lpString=".ldf") returned 4 [0044.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.495] lstrlenW (lpString=".vhd") returned 4 [0044.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.496] lstrlenW (lpString=".vhdx") returned 5 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.496] lstrlenW (lpString=".pst") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.496] lstrlenW (lpString=".ost") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.496] lstrlenW (lpString=".bak") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.496] lstrlenW (lpString=".bac") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.496] lstrlenW (lpString=".sys") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.496] lstrlenW (lpString=".v2i") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.496] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.496] lstrlenW (lpString=".sql") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.496] lstrlenW (lpString=".mdf") returned 4 [0044.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.496] lstrlenW (lpString=".txt") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.497] lstrlenW (lpString=".dbf") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.497] lstrlenW (lpString=".ckp") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.497] lstrlenW (lpString=".dacpac") returned 7 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.497] lstrlenW (lpString=".db3") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.497] lstrlenW (lpString=".dtxs") returned 5 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.497] lstrlenW (lpString=".mdt") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.497] lstrlenW (lpString=".sdf") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.497] lstrlenW (lpString=".MDF") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.497] lstrlenW (lpString=".DBF") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.497] lstrlenW (lpString=".DB") returned 3 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.497] lstrlenW (lpString=".db") returned 3 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.497] lstrlenW (lpString=".ndf") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.497] lstrlenW (lpString=".NDF") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.497] lstrlenW (lpString=".Mdf") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.497] lstrlenW (lpString=".dat") returned 4 [0044.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.498] lstrlenW (lpString=".DAT") returned 4 [0044.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.498] lstrlenW (lpString=".ldf") returned 4 [0044.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.498] lstrlenW (lpString=".LDF") returned 4 [0044.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.498] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.498] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.499] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.499] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.499] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16449988008) returned 1 [0044.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa955fd10, dwHighDateTime=0x1d585b4)) [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f58 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f58 | out: hHeap=0x260000) returned 1 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.499] GetLastError () returned 0x0 [0044.500] GetLastError () returned 0x0 [0044.500] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.500] GetLastError () returned 0x0 [0044.500] GetLastError () returned 0x0 [0044.501] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff814f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.501] WriteFile (in: hFile=0x108, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x7eb1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x7eb1, lpOverlapped=0x0) returned 1 [0044.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.501] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.501] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.502] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.502] CloseHandle (hObject=0x108) returned 1 [0044.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.502] GetLastError () returned 0x0 [0044.502] RtlWakeConditionVariable () returned 0x27e828 [0044.502] GetCurrentThreadId () returned 0x998 [0044.503] GetCurrentThreadId () returned 0x998 [0044.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0044.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db1b8 | out: hHeap=0x260000) returned 1 [0044.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f20 | out: hHeap=0x260000) returned 1 [0044.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db1b8 [0044.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.542] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.542] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.542] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.542] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.543] CloseHandle (hObject=0x104) returned 1 [0044.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db1b8 | out: hHeap=0x260000) returned 1 [0044.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad08 | out: hHeap=0x260000) returned 1 [0044.543] RtlWakeConditionVariable () returned 0x27e828 [0044.543] GetCurrentThreadId () returned 0x998 [0044.543] GetCurrentThreadId () returned 0x998 [0044.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0044.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dae98 | out: hHeap=0x260000) returned 1 [0044.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e08 | out: hHeap=0x260000) returned 1 [0044.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dae98 [0044.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.544] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.544] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.544] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.544] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.545] CloseHandle (hObject=0x104) returned 1 [0044.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dae98 | out: hHeap=0x260000) returned 1 [0044.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad08 | out: hHeap=0x260000) returned 1 [0044.546] RtlWakeConditionVariable () returned 0x27e828 [0044.546] GetCurrentThreadId () returned 0x998 [0044.546] GetCurrentThreadId () returned 0x998 [0044.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2964c8 | out: hHeap=0x260000) returned 1 [0044.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337dd0 | out: hHeap=0x260000) returned 1 [0044.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2964c8 [0044.546] lstrlenW (lpString=".ldf") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".ldf") returned 0x0 [0044.546] lstrlenW (lpString=".vhd") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".vhd") returned 0x0 [0044.546] lstrlenW (lpString=".vhdx") returned 5 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".vhdx") returned 0x0 [0044.546] lstrlenW (lpString=".pst") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".pst") returned 0x0 [0044.546] lstrlenW (lpString=".ost") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".ost") returned 0x0 [0044.546] lstrlenW (lpString=".bak") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".bak") returned 0x0 [0044.546] lstrlenW (lpString=".bac") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".bac") returned 0x0 [0044.546] lstrlenW (lpString=".sys") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".sys") returned 0x0 [0044.546] lstrlenW (lpString=".v2i") returned 4 [0044.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".v2i") returned 0x0 [0044.546] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.571] lstrlenW (lpString=".sql") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".sql") returned 0x0 [0044.572] lstrlenW (lpString=".mdf") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".mdf") returned 0x0 [0044.572] lstrlenW (lpString=".txt") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".txt") returned 0x0 [0044.572] lstrlenW (lpString=".dbf") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".dbf") returned 0x0 [0044.572] lstrlenW (lpString=".ckp") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".ckp") returned 0x0 [0044.572] lstrlenW (lpString=".dacpac") returned 7 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".dacpac") returned 0x0 [0044.572] lstrlenW (lpString=".db3") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".db3") returned 0x0 [0044.572] lstrlenW (lpString=".dtxs") returned 5 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".dtxs") returned 0x0 [0044.572] lstrlenW (lpString=".mdt") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".mdt") returned 0x0 [0044.572] lstrlenW (lpString=".sdf") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".sdf") returned 0x0 [0044.572] lstrlenW (lpString=".MDF") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".MDF") returned 0x0 [0044.572] lstrlenW (lpString=".DBF") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".DBF") returned 0x0 [0044.572] lstrlenW (lpString=".DB") returned 3 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".DB") returned 0x0 [0044.572] lstrlenW (lpString=".db") returned 3 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".db") returned 0x0 [0044.572] lstrlenW (lpString=".ndf") returned 4 [0044.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".ndf") returned 0x0 [0044.572] lstrlenW (lpString=".NDF") returned 4 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".NDF") returned 0x0 [0044.573] lstrlenW (lpString=".Mdf") returned 4 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".Mdf") returned 0x0 [0044.573] lstrlenW (lpString=".dat") returned 4 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".dat") returned 0x0 [0044.573] lstrlenW (lpString=".DAT") returned 4 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".DAT") returned 0x0 [0044.573] lstrlenW (lpString=".ldf") returned 4 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".ldf") returned 0x0 [0044.573] lstrlenW (lpString=".LDF") returned 4 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch=".LDF") returned 0x0 [0044.573] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.573] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.574] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.574] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.574] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16457548360) returned 1 [0044.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa961e3f0, dwHighDateTime=0x1d585b4)) [0044.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299328 [0044.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299328 | out: hHeap=0x260000) returned 1 [0044.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d808 [0044.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297438 [0044.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d808 | out: hHeap=0x260000) returned 1 [0044.575] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.575] GetLastError () returned 0x0 [0044.575] GetLastError () returned 0x0 [0044.576] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.576] GetLastError () returned 0x0 [0044.576] GetLastError () returned 0x0 [0044.578] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffef630, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.578] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x109d0, lpOverlapped=0x0) returned 1 [0044.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.578] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.578] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.579] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.579] CloseHandle (hObject=0x104) returned 1 [0044.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.579] GetLastError () returned 0x0 [0044.579] RtlWakeConditionVariable () returned 0x27e828 [0044.579] GetCurrentThreadId () returned 0x998 [0044.580] GetCurrentThreadId () returned 0x998 [0044.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf60 | out: hHeap=0x260000) returned 1 [0044.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0044.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.581] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.582] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.582] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.582] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.583] CloseHandle (hObject=0x104) returned 1 [0044.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf60 | out: hHeap=0x260000) returned 1 [0044.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.583] RtlWakeConditionVariable () returned 0x27e828 [0044.583] GetCurrentThreadId () returned 0x998 [0044.583] GetCurrentThreadId () returned 0x998 [0044.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0044.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d668 | out: hHeap=0x260000) returned 1 [0044.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0044.583] lstrlenW (lpString=".ldf") returned 4 [0044.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".ldf") returned 0x0 [0044.583] lstrlenW (lpString=".vhd") returned 4 [0044.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".vhd") returned 0x0 [0044.583] lstrlenW (lpString=".vhdx") returned 5 [0044.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".vhdx") returned 0x0 [0044.583] lstrlenW (lpString=".pst") returned 4 [0044.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".pst") returned 0x0 [0044.583] lstrlenW (lpString=".ost") returned 4 [0044.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".ost") returned 0x0 [0044.583] lstrlenW (lpString=".bak") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".bak") returned 0x0 [0044.584] lstrlenW (lpString=".bac") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".bac") returned 0x0 [0044.584] lstrlenW (lpString=".sys") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".sys") returned 0x0 [0044.584] lstrlenW (lpString=".v2i") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".v2i") returned 0x0 [0044.584] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.584] lstrlenW (lpString=".sql") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".sql") returned 0x0 [0044.584] lstrlenW (lpString=".mdf") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".mdf") returned 0x0 [0044.584] lstrlenW (lpString=".txt") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".txt") returned 0x0 [0044.584] lstrlenW (lpString=".dbf") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".dbf") returned 0x0 [0044.584] lstrlenW (lpString=".ckp") returned 4 [0044.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".ckp") returned 0x0 [0044.584] lstrlenW (lpString=".dacpac") returned 7 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".dacpac") returned 0x0 [0044.585] lstrlenW (lpString=".db3") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".db3") returned 0x0 [0044.585] lstrlenW (lpString=".dtxs") returned 5 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".dtxs") returned 0x0 [0044.585] lstrlenW (lpString=".mdt") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".mdt") returned 0x0 [0044.585] lstrlenW (lpString=".sdf") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".sdf") returned 0x0 [0044.585] lstrlenW (lpString=".MDF") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".MDF") returned 0x0 [0044.585] lstrlenW (lpString=".DBF") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".DBF") returned 0x0 [0044.585] lstrlenW (lpString=".DB") returned 3 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".DB") returned 0x0 [0044.585] lstrlenW (lpString=".db") returned 3 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".db") returned 0x0 [0044.585] lstrlenW (lpString=".ndf") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".ndf") returned 0x0 [0044.585] lstrlenW (lpString=".NDF") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".NDF") returned 0x0 [0044.585] lstrlenW (lpString=".Mdf") returned 4 [0044.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".Mdf") returned 0x0 [0044.585] lstrlenW (lpString=".dat") returned 4 [0044.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".dat") returned 0x0 [0044.586] lstrlenW (lpString=".DAT") returned 4 [0044.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".DAT") returned 0x0 [0044.586] lstrlenW (lpString=".ldf") returned 4 [0044.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".ldf") returned 0x0 [0044.586] lstrlenW (lpString=".LDF") returned 4 [0044.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch=".LDF") returned 0x0 [0044.586] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.586] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.587] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.587] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.587] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16458793862) returned 1 [0044.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9644550, dwHighDateTime=0x1d585b4)) [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d668 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d668 | out: hHeap=0x260000) returned 1 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d760 [0044.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0044.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.587] GetLastError () returned 0x0 [0044.588] GetLastError () returned 0x0 [0044.588] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.588] GetLastError () returned 0x0 [0044.588] GetLastError () returned 0x0 [0044.590] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7b17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.590] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x184e9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x184e9, lpOverlapped=0x0) returned 1 [0044.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.591] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.591] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.591] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.591] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.591] CloseHandle (hObject=0x104) returned 1 [0044.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.592] GetLastError () returned 0x0 [0044.592] RtlWakeConditionVariable () returned 0x27e828 [0044.592] GetCurrentThreadId () returned 0x998 [0044.592] GetCurrentThreadId () returned 0x998 [0044.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e9c0 | out: hHeap=0x260000) returned 1 [0044.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0044.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e9c0 [0044.592] lstrlenW (lpString=".ldf") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".ldf") returned 0x0 [0044.592] lstrlenW (lpString=".vhd") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".vhd") returned 0x0 [0044.592] lstrlenW (lpString=".vhdx") returned 5 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".vhdx") returned 0x0 [0044.592] lstrlenW (lpString=".pst") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".pst") returned 0x0 [0044.592] lstrlenW (lpString=".ost") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".ost") returned 0x0 [0044.592] lstrlenW (lpString=".bak") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".bak") returned 0x0 [0044.592] lstrlenW (lpString=".bac") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".bac") returned 0x0 [0044.592] lstrlenW (lpString=".sys") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".sys") returned 0x0 [0044.592] lstrlenW (lpString=".v2i") returned 4 [0044.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".v2i") returned 0x0 [0044.592] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.593] lstrlenW (lpString=".sql") returned 4 [0044.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".sql") returned 0x0 [0044.593] lstrlenW (lpString=".mdf") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".mdf") returned 0x0 [0044.594] lstrlenW (lpString=".txt") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".txt") returned 0x0 [0044.594] lstrlenW (lpString=".dbf") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".dbf") returned 0x0 [0044.594] lstrlenW (lpString=".ckp") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".ckp") returned 0x0 [0044.594] lstrlenW (lpString=".dacpac") returned 7 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".dacpac") returned 0x0 [0044.594] lstrlenW (lpString=".db3") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".db3") returned 0x0 [0044.594] lstrlenW (lpString=".dtxs") returned 5 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".dtxs") returned 0x0 [0044.594] lstrlenW (lpString=".mdt") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".mdt") returned 0x0 [0044.594] lstrlenW (lpString=".sdf") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".sdf") returned 0x0 [0044.594] lstrlenW (lpString=".MDF") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".MDF") returned 0x0 [0044.594] lstrlenW (lpString=".DBF") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".DBF") returned 0x0 [0044.594] lstrlenW (lpString=".DB") returned 3 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".DB") returned 0x0 [0044.594] lstrlenW (lpString=".db") returned 3 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".db") returned 0x0 [0044.594] lstrlenW (lpString=".ndf") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".ndf") returned 0x0 [0044.594] lstrlenW (lpString=".NDF") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".NDF") returned 0x0 [0044.594] lstrlenW (lpString=".Mdf") returned 4 [0044.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".Mdf") returned 0x0 [0044.595] lstrlenW (lpString=".dat") returned 4 [0044.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".dat") returned 0x0 [0044.595] lstrlenW (lpString=".DAT") returned 4 [0044.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".DAT") returned 0x0 [0044.595] lstrlenW (lpString=".ldf") returned 4 [0044.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".ldf") returned 0x0 [0044.595] lstrlenW (lpString=".LDF") returned 4 [0044.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch=".LDF") returned 0x0 [0044.595] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.595] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0044.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.596] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.596] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16459694703) returned 1 [0044.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9644550, dwHighDateTime=0x1d585b4)) [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d630 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d568 [0044.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0044.596] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0044.596] GetLastError () returned 0x0 [0044.597] GetLastError () returned 0x0 [0044.597] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0044.597] GetLastError () returned 0x0 [0044.597] GetLastError () returned 0x0 [0044.598] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffddb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.598] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x225, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x225, lpOverlapped=0x0) returned 1 [0044.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.598] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.598] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.598] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.598] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.598] CloseHandle (hObject=0x104) returned 1 [0044.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.858] GetLastError () returned 0x0 [0044.858] RtlWakeConditionVariable () returned 0x27e828 [0044.858] GetCurrentThreadId () returned 0x998 [0044.858] GetCurrentThreadId () returned 0x998 [0044.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db5a0 | out: hHeap=0x260000) returned 1 [0044.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d258 | out: hHeap=0x260000) returned 1 [0044.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db5a0 [0044.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.924] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.924] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.924] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.924] WriteFile (in: hFile=0x10c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.925] CloseHandle (hObject=0x10c) returned 1 [0044.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db5a0 | out: hHeap=0x260000) returned 1 [0044.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.925] RtlWakeConditionVariable () returned 0x27e828 [0044.925] GetCurrentThreadId () returned 0x998 [0044.925] GetCurrentThreadId () returned 0x998 [0044.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f5d8 [0044.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f7d0 | out: hHeap=0x260000) returned 1 [0044.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d710 | out: hHeap=0x260000) returned 1 [0044.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f7d0 [0044.925] lstrlenW (lpString=".ldf") returned 4 [0044.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.925] lstrlenW (lpString=".vhd") returned 4 [0044.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.925] lstrlenW (lpString=".vhdx") returned 5 [0044.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.925] lstrlenW (lpString=".pst") returned 4 [0044.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.925] lstrlenW (lpString=".ost") returned 4 [0044.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.925] lstrlenW (lpString=".bak") returned 4 [0044.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.925] lstrlenW (lpString=".bac") returned 4 [0044.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.926] lstrlenW (lpString=".sys") returned 4 [0044.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.926] lstrlenW (lpString=".v2i") returned 4 [0044.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.926] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.142] lstrlenW (lpString=".sql") returned 4 [0045.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.142] lstrlenW (lpString=".mdf") returned 4 [0045.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.143] lstrlenW (lpString=".txt") returned 4 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.152] lstrlenW (lpString=".dbf") returned 4 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.152] lstrlenW (lpString=".ckp") returned 4 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.152] lstrlenW (lpString=".dacpac") returned 7 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.152] lstrlenW (lpString=".db3") returned 4 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.152] lstrlenW (lpString=".dtxs") returned 5 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.152] lstrlenW (lpString=".mdt") returned 4 [0045.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.152] lstrlenW (lpString=".sdf") returned 4 [0045.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.161] lstrlenW (lpString=".MDF") returned 4 [0045.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.162] lstrlenW (lpString=".DBF") returned 4 [0045.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.162] lstrlenW (lpString=".DB") returned 3 [0045.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.162] lstrlenW (lpString=".db") returned 3 [0045.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.162] lstrlenW (lpString=".ndf") returned 4 [0045.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.162] lstrlenW (lpString=".NDF") returned 4 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.163] lstrlenW (lpString=".Mdf") returned 4 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.163] lstrlenW (lpString=".dat") returned 4 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.163] lstrlenW (lpString=".DAT") returned 4 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.163] lstrlenW (lpString=".ldf") returned 4 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.163] lstrlenW (lpString=".LDF") returned 4 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.163] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0045.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.163] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3128b8) returned 1 [0045.164] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.164] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x330d00 [0045.164] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16516534084) returned 1 [0045.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9bc5830, dwHighDateTime=0x1d585b4)) [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe40 [0045.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe40 | out: hHeap=0x260000) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0045.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0045.165] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.165] GetLastError () returned 0x0 [0045.165] GetLastError () returned 0x0 [0045.165] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.165] GetLastError () returned 0x0 [0045.165] GetLastError () returned 0x0 [0045.167] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffaac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.167] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x554, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x554, lpOverlapped=0x0) returned 1 [0045.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.167] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.167] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.167] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.167] CloseHandle (hObject=0x104) returned 1 [0045.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0045.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0045.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.168] GetLastError () returned 0x0 [0045.169] RtlWakeConditionVariable () returned 0x27e828 [0045.169] GetCurrentThreadId () returned 0x998 [0045.169] GetCurrentThreadId () returned 0x998 [0045.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f5d8 [0045.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e090 | out: hHeap=0x260000) returned 1 [0045.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe78 | out: hHeap=0x260000) returned 1 [0045.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e090 [0045.170] lstrlenW (lpString=".ldf") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.170] lstrlenW (lpString=".vhd") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.170] lstrlenW (lpString=".vhdx") returned 5 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.170] lstrlenW (lpString=".pst") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.170] lstrlenW (lpString=".ost") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.170] lstrlenW (lpString=".bak") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.170] lstrlenW (lpString=".bac") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.170] lstrlenW (lpString=".sys") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.170] lstrlenW (lpString=".v2i") returned 4 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.170] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.171] lstrlenW (lpString=".sql") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.171] lstrlenW (lpString=".mdf") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.171] lstrlenW (lpString=".txt") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.171] lstrlenW (lpString=".dbf") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.171] lstrlenW (lpString=".ckp") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.171] lstrlenW (lpString=".dacpac") returned 7 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.171] lstrlenW (lpString=".db3") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.171] lstrlenW (lpString=".dtxs") returned 5 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.171] lstrlenW (lpString=".mdt") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.171] lstrlenW (lpString=".sdf") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.171] lstrlenW (lpString=".MDF") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.171] lstrlenW (lpString=".DBF") returned 4 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.171] lstrlenW (lpString=".DB") returned 3 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.171] lstrlenW (lpString=".db") returned 3 [0045.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.172] lstrlenW (lpString=".ndf") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.172] lstrlenW (lpString=".NDF") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.172] lstrlenW (lpString=".Mdf") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.172] lstrlenW (lpString=".dat") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.172] lstrlenW (lpString=".DAT") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.172] lstrlenW (lpString=".ldf") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.172] lstrlenW (lpString=".LDF") returned 4 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.172] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0045.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.172] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3128b8) returned 1 [0045.173] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.173] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x330d00 [0045.173] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16517438437) returned 1 [0045.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9bc5830, dwHighDateTime=0x1d585b4)) [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe78 [0045.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe78 | out: hHeap=0x260000) returned 1 [0045.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0045.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0045.174] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.174] GetLastError () returned 0x0 [0045.174] GetLastError () returned 0x0 [0045.174] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.174] GetLastError () returned 0x0 [0045.174] GetLastError () returned 0x0 [0045.177] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff9c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.177] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x639, lpOverlapped=0x0) returned 1 [0045.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.177] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.177] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.178] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.178] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.178] CloseHandle (hObject=0x104) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f880 [0045.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f880 | out: hHeap=0x260000) returned 1 [0045.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.178] GetLastError () returned 0x0 [0045.179] RtlWakeConditionVariable () returned 0x27e828 [0045.179] GetCurrentThreadId () returned 0x998 [0045.179] GetCurrentThreadId () returned 0x998 [0045.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f5d8 [0045.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0045.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efeb0 | out: hHeap=0x260000) returned 1 [0045.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0045.179] lstrlenW (lpString=".ldf") returned 4 [0045.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.179] lstrlenW (lpString=".vhd") returned 4 [0045.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.180] lstrlenW (lpString=".vhdx") returned 5 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.180] lstrlenW (lpString=".pst") returned 4 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.180] lstrlenW (lpString=".ost") returned 4 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.180] lstrlenW (lpString=".bak") returned 4 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.180] lstrlenW (lpString=".bac") returned 4 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.180] lstrlenW (lpString=".sys") returned 4 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.180] lstrlenW (lpString=".v2i") returned 4 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.180] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.181] lstrlenW (lpString=".sql") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.181] lstrlenW (lpString=".mdf") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.181] lstrlenW (lpString=".txt") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.181] lstrlenW (lpString=".dbf") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.181] lstrlenW (lpString=".ckp") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.181] lstrlenW (lpString=".dacpac") returned 7 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.181] lstrlenW (lpString=".db3") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.181] lstrlenW (lpString=".dtxs") returned 5 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.181] lstrlenW (lpString=".mdt") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.181] lstrlenW (lpString=".sdf") returned 4 [0045.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.181] lstrlenW (lpString=".MDF") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.182] lstrlenW (lpString=".DBF") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.182] lstrlenW (lpString=".DB") returned 3 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.182] lstrlenW (lpString=".db") returned 3 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.182] lstrlenW (lpString=".ndf") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.182] lstrlenW (lpString=".NDF") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.182] lstrlenW (lpString=".Mdf") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.182] lstrlenW (lpString=".dat") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.182] lstrlenW (lpString=".DAT") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.182] lstrlenW (lpString=".ldf") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.182] lstrlenW (lpString=".LDF") returned 4 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.182] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0045.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.182] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.183] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.183] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x330d00 [0045.183] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16518456265) returned 1 [0045.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9beb990, dwHighDateTime=0x1d585b4)) [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efeb0 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efeb0 | out: hHeap=0x260000) returned 1 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e090 [0045.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e090 | out: hHeap=0x260000) returned 1 [0045.184] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.184] GetLastError () returned 0x0 [0045.184] GetLastError () returned 0x0 [0045.184] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.184] GetLastError () returned 0x0 [0045.184] GetLastError () returned 0x0 [0045.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffab0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.188] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x54f1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x54f1, lpOverlapped=0x0) returned 1 [0045.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.188] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.188] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.188] CloseHandle (hObject=0x104) returned 1 [0045.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0045.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0045.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.189] GetLastError () returned 0x0 [0045.189] RtlWakeConditionVariable () returned 0x27e828 [0045.189] GetCurrentThreadId () returned 0x998 [0045.189] GetCurrentThreadId () returned 0x998 [0045.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ba8 | out: hHeap=0x260000) returned 1 [0045.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efee8 | out: hHeap=0x260000) returned 1 [0045.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8ba8 [0045.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.190] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.190] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.190] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.190] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.191] CloseHandle (hObject=0x104) returned 1 [0045.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ba8 | out: hHeap=0x260000) returned 1 [0045.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.191] RtlWakeConditionVariable () returned 0x27e828 [0045.191] GetCurrentThreadId () returned 0x998 [0045.191] GetCurrentThreadId () returned 0x998 [0045.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f5d8 [0045.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f140 | out: hHeap=0x260000) returned 1 [0045.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d898 | out: hHeap=0x260000) returned 1 [0045.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f140 [0045.191] lstrlenW (lpString=".ldf") returned 4 [0045.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.191] lstrlenW (lpString=".vhd") returned 4 [0045.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.191] lstrlenW (lpString=".vhdx") returned 5 [0045.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.191] lstrlenW (lpString=".pst") returned 4 [0045.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.191] lstrlenW (lpString=".ost") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.192] lstrlenW (lpString=".bak") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.192] lstrlenW (lpString=".bac") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.192] lstrlenW (lpString=".sys") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.192] lstrlenW (lpString=".v2i") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.192] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.192] lstrlenW (lpString=".sql") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.192] lstrlenW (lpString=".mdf") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.192] lstrlenW (lpString=".txt") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.192] lstrlenW (lpString=".dbf") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.192] lstrlenW (lpString=".ckp") returned 4 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.192] lstrlenW (lpString=".dacpac") returned 7 [0045.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.192] lstrlenW (lpString=".db3") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.193] lstrlenW (lpString=".dtxs") returned 5 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.193] lstrlenW (lpString=".mdt") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.193] lstrlenW (lpString=".sdf") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.193] lstrlenW (lpString=".MDF") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.193] lstrlenW (lpString=".DBF") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.193] lstrlenW (lpString=".DB") returned 3 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.193] lstrlenW (lpString=".db") returned 3 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.193] lstrlenW (lpString=".ndf") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.193] lstrlenW (lpString=".NDF") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.193] lstrlenW (lpString=".Mdf") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.193] lstrlenW (lpString=".dat") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.193] lstrlenW (lpString=".DAT") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.193] lstrlenW (lpString=".ldf") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.193] lstrlenW (lpString=".LDF") returned 4 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.193] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0045.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.194] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.194] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.194] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x330d00 [0045.194] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16519559004) returned 1 [0045.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9c11af0, dwHighDateTime=0x1d585b4)) [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d898 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d898 | out: hHeap=0x260000) returned 1 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f7d0 [0045.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f7d0 | out: hHeap=0x260000) returned 1 [0045.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.195] GetLastError () returned 0x0 [0045.195] GetLastError () returned 0x0 [0045.195] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.195] GetLastError () returned 0x0 [0045.195] GetLastError () returned 0x0 [0045.212] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffac5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.212] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x53b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x53b, lpOverlapped=0x0) returned 1 [0045.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.213] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.213] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.213] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.213] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.213] CloseHandle (hObject=0x104) returned 1 [0045.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.255] GetLastError () returned 0x0 [0045.275] RtlWakeConditionVariable () returned 0x27e828 [0045.291] GetCurrentThreadId () returned 0x998 [0045.307] GetCurrentThreadId () returned 0x998 [0045.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29de98 [0045.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d4c0 | out: hHeap=0x260000) returned 1 [0045.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299750 | out: hHeap=0x260000) returned 1 [0045.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d4c0 [0045.316] lstrlenW (lpString=".ldf") returned 4 [0045.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".ldf") returned 0x0 [0045.316] lstrlenW (lpString=".vhd") returned 4 [0045.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".vhd") returned 0x0 [0045.316] lstrlenW (lpString=".vhdx") returned 5 [0045.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".vhdx") returned 0x0 [0045.316] lstrlenW (lpString=".pst") returned 4 [0045.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".pst") returned 0x0 [0045.316] lstrlenW (lpString=".ost") returned 4 [0045.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".ost") returned 0x0 [0045.318] lstrlenW (lpString=".bak") returned 4 [0045.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".bak") returned 0x0 [0045.318] lstrlenW (lpString=".bac") returned 4 [0045.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".bac") returned 0x0 [0045.318] lstrlenW (lpString=".sys") returned 4 [0045.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".sys") returned 0x0 [0045.318] lstrlenW (lpString=".v2i") returned 4 [0045.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".v2i") returned 0x0 [0045.318] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.319] lstrlenW (lpString=".sql") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".sql") returned 0x0 [0045.319] lstrlenW (lpString=".mdf") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".mdf") returned 0x0 [0045.319] lstrlenW (lpString=".txt") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".txt") returned 0x0 [0045.319] lstrlenW (lpString=".dbf") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".dbf") returned 0x0 [0045.319] lstrlenW (lpString=".ckp") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".ckp") returned 0x0 [0045.319] lstrlenW (lpString=".dacpac") returned 7 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".dacpac") returned 0x0 [0045.319] lstrlenW (lpString=".db3") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".db3") returned 0x0 [0045.319] lstrlenW (lpString=".dtxs") returned 5 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".dtxs") returned 0x0 [0045.319] lstrlenW (lpString=".mdt") returned 4 [0045.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".mdt") returned 0x0 [0045.320] lstrlenW (lpString=".sdf") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".sdf") returned 0x0 [0045.320] lstrlenW (lpString=".MDF") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".MDF") returned 0x0 [0045.320] lstrlenW (lpString=".DBF") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".DBF") returned 0x0 [0045.320] lstrlenW (lpString=".DB") returned 3 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".DB") returned 0x0 [0045.320] lstrlenW (lpString=".db") returned 3 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".db") returned 0x0 [0045.320] lstrlenW (lpString=".ndf") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".ndf") returned 0x0 [0045.320] lstrlenW (lpString=".NDF") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".NDF") returned 0x0 [0045.320] lstrlenW (lpString=".Mdf") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".Mdf") returned 0x0 [0045.320] lstrlenW (lpString=".dat") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".dat") returned 0x0 [0045.320] lstrlenW (lpString=".DAT") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".DAT") returned 0x0 [0045.320] lstrlenW (lpString=".ldf") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".ldf") returned 0x0 [0045.320] lstrlenW (lpString=".LDF") returned 4 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch=".LDF") returned 0x0 [0045.320] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.320] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.321] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.321] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.321] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16532257620) returned 1 [0045.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9d425f0, dwHighDateTime=0x1d585b4)) [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29df40 [0045.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29df40 | out: hHeap=0x260000) returned 1 [0045.322] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.323] GetLastError () returned 0x0 [0045.323] GetLastError () returned 0x0 [0045.323] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.323] GetLastError () returned 0x0 [0045.323] GetLastError () returned 0x0 [0045.324] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffdb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.324] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x24a, lpOverlapped=0x0) returned 1 [0045.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.324] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.325] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.325] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.325] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.325] CloseHandle (hObject=0x108) returned 1 [0045.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.325] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.326] GetLastError () returned 0x0 [0045.326] RtlWakeConditionVariable () returned 0x27e828 [0045.326] GetCurrentThreadId () returned 0x998 [0045.338] GetCurrentThreadId () returned 0x998 [0045.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0045.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0045.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.339] lstrlenW (lpString=".ldf") returned 4 [0045.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.339] lstrlenW (lpString=".vhd") returned 4 [0045.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.339] lstrlenW (lpString=".vhdx") returned 5 [0045.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.339] lstrlenW (lpString=".pst") returned 4 [0045.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.340] lstrlenW (lpString=".ost") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.340] lstrlenW (lpString=".bak") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.340] lstrlenW (lpString=".bac") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.340] lstrlenW (lpString=".sys") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.340] lstrlenW (lpString=".v2i") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.340] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.340] lstrlenW (lpString=".sql") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.340] lstrlenW (lpString=".mdf") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.340] lstrlenW (lpString=".txt") returned 4 [0045.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.342] lstrlenW (lpString=".dbf") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.342] lstrlenW (lpString=".ckp") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.342] lstrlenW (lpString=".dacpac") returned 7 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.342] lstrlenW (lpString=".db3") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.342] lstrlenW (lpString=".dtxs") returned 5 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.342] lstrlenW (lpString=".mdt") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.342] lstrlenW (lpString=".sdf") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.342] lstrlenW (lpString=".MDF") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.342] lstrlenW (lpString=".DBF") returned 4 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.342] lstrlenW (lpString=".DB") returned 3 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.342] lstrlenW (lpString=".db") returned 3 [0045.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.342] lstrlenW (lpString=".ndf") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.343] lstrlenW (lpString=".NDF") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.343] lstrlenW (lpString=".Mdf") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.343] lstrlenW (lpString=".dat") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.343] lstrlenW (lpString=".DAT") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.343] lstrlenW (lpString=".ldf") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.343] lstrlenW (lpString=".LDF") returned 4 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.343] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.343] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.344] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.344] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.344] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16534550540) returned 1 [0045.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9d68750, dwHighDateTime=0x1d585b4)) [0045.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299520 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ced8 [0045.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0045.345] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.345] GetLastError () returned 0x0 [0045.345] GetLastError () returned 0x0 [0045.345] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.345] GetLastError () returned 0x0 [0045.345] GetLastError () returned 0x0 [0045.352] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff07e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.353] WriteFile (in: hFile=0xfc, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xf82, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0xf82, lpOverlapped=0x0) returned 1 [0045.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.353] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.353] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.353] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.353] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.353] CloseHandle (hObject=0xfc) returned 1 [0045.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.405] GetLastError () returned 0x0 [0045.405] RtlWakeConditionVariable () returned 0x27e828 [0045.405] GetCurrentThreadId () returned 0x998 [0045.405] GetCurrentThreadId () returned 0x998 [0045.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f67f8 [0045.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7710 | out: hHeap=0x260000) returned 1 [0045.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0118 | out: hHeap=0x260000) returned 1 [0045.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.405] lstrlenW (lpString=".ldf") returned 4 [0045.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".ldf") returned 0x0 [0045.405] lstrlenW (lpString=".vhd") returned 4 [0045.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".vhd") returned 0x0 [0045.406] lstrlenW (lpString=".vhdx") returned 5 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".vhdx") returned 0x0 [0045.406] lstrlenW (lpString=".pst") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".pst") returned 0x0 [0045.406] lstrlenW (lpString=".ost") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".ost") returned 0x0 [0045.406] lstrlenW (lpString=".bak") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".bak") returned 0x0 [0045.406] lstrlenW (lpString=".bac") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".bac") returned 0x0 [0045.406] lstrlenW (lpString=".sys") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".sys") returned 0x0 [0045.406] lstrlenW (lpString=".v2i") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".v2i") returned 0x0 [0045.406] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.406] lstrlenW (lpString=".sql") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".sql") returned 0x0 [0045.406] lstrlenW (lpString=".mdf") returned 4 [0045.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".mdf") returned 0x0 [0045.407] lstrlenW (lpString=".txt") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".txt") returned 0x0 [0045.407] lstrlenW (lpString=".dbf") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".dbf") returned 0x0 [0045.407] lstrlenW (lpString=".ckp") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".ckp") returned 0x0 [0045.407] lstrlenW (lpString=".dacpac") returned 7 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".dacpac") returned 0x0 [0045.407] lstrlenW (lpString=".db3") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".db3") returned 0x0 [0045.407] lstrlenW (lpString=".dtxs") returned 5 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".dtxs") returned 0x0 [0045.407] lstrlenW (lpString=".mdt") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".mdt") returned 0x0 [0045.407] lstrlenW (lpString=".sdf") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".sdf") returned 0x0 [0045.407] lstrlenW (lpString=".MDF") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".MDF") returned 0x0 [0045.407] lstrlenW (lpString=".DBF") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".DBF") returned 0x0 [0045.407] lstrlenW (lpString=".DB") returned 3 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".DB") returned 0x0 [0045.407] lstrlenW (lpString=".db") returned 3 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".db") returned 0x0 [0045.407] lstrlenW (lpString=".ndf") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".ndf") returned 0x0 [0045.407] lstrlenW (lpString=".NDF") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".NDF") returned 0x0 [0045.407] lstrlenW (lpString=".Mdf") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".Mdf") returned 0x0 [0045.407] lstrlenW (lpString=".dat") returned 4 [0045.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".dat") returned 0x0 [0045.407] lstrlenW (lpString=".DAT") returned 4 [0045.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".DAT") returned 0x0 [0045.408] lstrlenW (lpString=".ldf") returned 4 [0045.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".ldf") returned 0x0 [0045.408] lstrlenW (lpString=".LDF") returned 4 [0045.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch=".LDF") returned 0x0 [0045.408] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.408] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3128b8) returned 1 [0045.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.409] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.409] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16540981013) returned 1 [0045.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9e00cd0, dwHighDateTime=0x1d585b4)) [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0118 [0045.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0118 | out: hHeap=0x260000) returned 1 [0045.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f69f0 [0045.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f69f0 | out: hHeap=0x260000) returned 1 [0045.422] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.422] GetLastError () returned 0x0 [0045.422] GetLastError () returned 0x0 [0045.422] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.422] GetLastError () returned 0x0 [0045.422] GetLastError () returned 0x0 [0045.424] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffe19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.424] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x1e7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x1e7, lpOverlapped=0x0) returned 1 [0045.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0045.424] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.424] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.424] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.424] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.424] CloseHandle (hObject=0x104) returned 1 [0045.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.425] GetLastError () returned 0x0 [0045.425] RtlWakeConditionVariable () returned 0x27e828 [0045.425] GetCurrentThreadId () returned 0x998 [0045.425] GetCurrentThreadId () returned 0x998 [0045.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f67f8 [0045.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7860 | out: hHeap=0x260000) returned 1 [0045.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0150 | out: hHeap=0x260000) returned 1 [0045.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7860 [0045.426] lstrlenW (lpString=".ldf") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.426] lstrlenW (lpString=".vhd") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.426] lstrlenW (lpString=".vhdx") returned 5 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.426] lstrlenW (lpString=".pst") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.426] lstrlenW (lpString=".ost") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.426] lstrlenW (lpString=".bak") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.426] lstrlenW (lpString=".bac") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.426] lstrlenW (lpString=".sys") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.426] lstrlenW (lpString=".v2i") returned 4 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.426] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.452] lstrlenW (lpString=".sql") returned 4 [0045.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.452] lstrlenW (lpString=".mdf") returned 4 [0045.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.452] lstrlenW (lpString=".txt") returned 4 [0045.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.453] lstrlenW (lpString=".dbf") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.453] lstrlenW (lpString=".ckp") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.453] lstrlenW (lpString=".dacpac") returned 7 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.453] lstrlenW (lpString=".db3") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.453] lstrlenW (lpString=".dtxs") returned 5 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.453] lstrlenW (lpString=".mdt") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.453] lstrlenW (lpString=".sdf") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.453] lstrlenW (lpString=".MDF") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.453] lstrlenW (lpString=".DBF") returned 4 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.453] lstrlenW (lpString=".DB") returned 3 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.453] lstrlenW (lpString=".db") returned 3 [0045.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.454] lstrlenW (lpString=".ndf") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.454] lstrlenW (lpString=".NDF") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.454] lstrlenW (lpString=".Mdf") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.454] lstrlenW (lpString=".dat") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.454] lstrlenW (lpString=".DAT") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.454] lstrlenW (lpString=".ldf") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.454] lstrlenW (lpString=".LDF") returned 4 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.454] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.454] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3128b8) returned 1 [0045.455] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.455] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.455] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16545634668) returned 1 [0045.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xa9e730f0, dwHighDateTime=0x1d585b4)) [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294790 [0045.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0045.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7710 [0045.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7710 | out: hHeap=0x260000) returned 1 [0045.456] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.456] GetLastError () returned 0x0 [0045.456] GetLastError () returned 0x0 [0045.456] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.456] GetLastError () returned 0x0 [0045.456] GetLastError () returned 0x0 [0045.484] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8319, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.484] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x7ce7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x7ce7, lpOverlapped=0x0) returned 1 [0045.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0045.485] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.485] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.485] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.485] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.485] CloseHandle (hObject=0x10c) returned 1 [0045.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.486] GetLastError () returned 0x0 [0045.486] RtlWakeConditionVariable () returned 0x27e828 [0045.486] GetCurrentThreadId () returned 0x998 [0045.486] GetCurrentThreadId () returned 0x998 [0045.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9058 | out: hHeap=0x260000) returned 1 [0045.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0230 | out: hHeap=0x260000) returned 1 [0045.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9058 [0045.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.547] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.547] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.556] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.556] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.565] CloseHandle (hObject=0x104) returned 1 [0045.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9058 | out: hHeap=0x260000) returned 1 [0045.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.591] RtlWakeConditionVariable () returned 0x27e828 [0045.591] GetCurrentThreadId () returned 0x998 [0045.598] GetCurrentThreadId () returned 0x998 [0045.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0045.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0045.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0045.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0045.598] lstrlenW (lpString=".ldf") returned 4 [0045.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".ldf") returned 0x0 [0045.598] lstrlenW (lpString=".vhd") returned 4 [0045.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".vhd") returned 0x0 [0045.598] lstrlenW (lpString=".vhdx") returned 5 [0045.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".vhdx") returned 0x0 [0045.598] lstrlenW (lpString=".pst") returned 4 [0045.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".pst") returned 0x0 [0045.598] lstrlenW (lpString=".ost") returned 4 [0045.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".ost") returned 0x0 [0045.601] lstrlenW (lpString=".bak") returned 4 [0045.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".bak") returned 0x0 [0045.615] lstrlenW (lpString=".bac") returned 4 [0045.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".bac") returned 0x0 [0045.615] lstrlenW (lpString=".sys") returned 4 [0045.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".sys") returned 0x0 [0045.615] lstrlenW (lpString=".v2i") returned 4 [0045.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".v2i") returned 0x0 [0045.615] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0045.631] lstrlenW (lpString=".sql") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".sql") returned 0x0 [0045.632] lstrlenW (lpString=".mdf") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".mdf") returned 0x0 [0045.632] lstrlenW (lpString=".txt") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".txt") returned 0x0 [0045.632] lstrlenW (lpString=".dbf") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".dbf") returned 0x0 [0045.632] lstrlenW (lpString=".ckp") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".ckp") returned 0x0 [0045.632] lstrlenW (lpString=".dacpac") returned 7 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".dacpac") returned 0x0 [0045.632] lstrlenW (lpString=".db3") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".db3") returned 0x0 [0045.632] lstrlenW (lpString=".dtxs") returned 5 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".dtxs") returned 0x0 [0045.632] lstrlenW (lpString=".mdt") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".mdt") returned 0x0 [0045.632] lstrlenW (lpString=".sdf") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".sdf") returned 0x0 [0045.632] lstrlenW (lpString=".MDF") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".MDF") returned 0x0 [0045.632] lstrlenW (lpString=".DBF") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".DBF") returned 0x0 [0045.632] lstrlenW (lpString=".DB") returned 3 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".DB") returned 0x0 [0045.632] lstrlenW (lpString=".db") returned 3 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".db") returned 0x0 [0045.632] lstrlenW (lpString=".ndf") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".ndf") returned 0x0 [0045.632] lstrlenW (lpString=".NDF") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".NDF") returned 0x0 [0045.632] lstrlenW (lpString=".Mdf") returned 4 [0045.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".Mdf") returned 0x0 [0045.632] lstrlenW (lpString=".dat") returned 4 [0045.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".dat") returned 0x0 [0045.633] lstrlenW (lpString=".DAT") returned 4 [0045.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".DAT") returned 0x0 [0045.633] lstrlenW (lpString=".ldf") returned 4 [0045.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".ldf") returned 0x0 [0045.633] lstrlenW (lpString=".LDF") returned 4 [0045.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch=".LDF") returned 0x0 [0045.633] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.633] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.634] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.634] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16563488020) returned 1 [0045.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa03c170, dwHighDateTime=0x1d585b4)) [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f58 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e1e0 [0045.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e1e0 | out: hHeap=0x260000) returned 1 [0045.634] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.634] GetLastError () returned 0x0 [0045.634] GetLastError () returned 0x0 [0045.635] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.635] GetLastError () returned 0x0 [0045.635] GetLastError () returned 0x0 [0045.636] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.636] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1f4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f4, lpOverlapped=0x0) returned 1 [0045.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.636] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.636] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.636] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.636] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.636] CloseHandle (hObject=0x10c) returned 1 [0045.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.637] GetLastError () returned 0x0 [0045.637] RtlWakeConditionVariable () returned 0x27e828 [0045.637] GetCurrentThreadId () returned 0x998 [0045.637] GetCurrentThreadId () returned 0x998 [0045.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0045.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319d98 | out: hHeap=0x260000) returned 1 [0045.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0380 | out: hHeap=0x260000) returned 1 [0045.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.637] lstrlenW (lpString=".ldf") returned 4 [0045.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.637] lstrlenW (lpString=".vhd") returned 4 [0045.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.637] lstrlenW (lpString=".vhdx") returned 5 [0045.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.637] lstrlenW (lpString=".pst") returned 4 [0045.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.637] lstrlenW (lpString=".ost") returned 4 [0045.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.637] lstrlenW (lpString=".bak") returned 4 [0045.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.637] lstrlenW (lpString=".bac") returned 4 [0045.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.638] lstrlenW (lpString=".sys") returned 4 [0045.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.638] lstrlenW (lpString=".v2i") returned 4 [0045.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.638] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.676] lstrlenW (lpString=".sql") returned 4 [0045.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.688] lstrlenW (lpString=".mdf") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.689] lstrlenW (lpString=".txt") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.689] lstrlenW (lpString=".dbf") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.689] lstrlenW (lpString=".ckp") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.689] lstrlenW (lpString=".dacpac") returned 7 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.689] lstrlenW (lpString=".db3") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.689] lstrlenW (lpString=".dtxs") returned 5 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.689] lstrlenW (lpString=".mdt") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.689] lstrlenW (lpString=".sdf") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.689] lstrlenW (lpString=".MDF") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.689] lstrlenW (lpString=".DBF") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.689] lstrlenW (lpString=".DB") returned 3 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.689] lstrlenW (lpString=".db") returned 3 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.689] lstrlenW (lpString=".ndf") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.689] lstrlenW (lpString=".NDF") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.689] lstrlenW (lpString=".Mdf") returned 4 [0045.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.689] lstrlenW (lpString=".dat") returned 4 [0045.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.690] lstrlenW (lpString=".DAT") returned 4 [0045.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.690] lstrlenW (lpString=".ldf") returned 4 [0045.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.690] lstrlenW (lpString=".LDF") returned 4 [0045.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.690] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.690] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.691] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.691] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.691] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16569182855) returned 1 [0045.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa0ae590, dwHighDateTime=0x1d585b4)) [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295150 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319f90 [0045.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319f90 | out: hHeap=0x260000) returned 1 [0045.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.691] GetLastError () returned 0x0 [0045.691] GetLastError () returned 0x0 [0045.691] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.692] GetLastError () returned 0x0 [0045.692] GetLastError () returned 0x0 [0045.694] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffaacc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.694] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x5534, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x5534, lpOverlapped=0x0) returned 1 [0045.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.694] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.694] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.694] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.694] CloseHandle (hObject=0x108) returned 1 [0045.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.695] GetLastError () returned 0x0 [0045.695] RtlWakeConditionVariable () returned 0x27e828 [0045.695] GetCurrentThreadId () returned 0x998 [0045.695] GetCurrentThreadId () returned 0x998 [0045.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9058 [0045.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d68 | out: hHeap=0x260000) returned 1 [0045.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0045.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9d68 [0045.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.696] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.696] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.696] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.696] WriteFile (in: hFile=0x108, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.697] CloseHandle (hObject=0x108) returned 1 [0045.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d68 | out: hHeap=0x260000) returned 1 [0045.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9058 | out: hHeap=0x260000) returned 1 [0045.697] RtlWakeConditionVariable () returned 0x27e828 [0045.697] GetCurrentThreadId () returned 0x998 [0045.697] GetCurrentThreadId () returned 0x998 [0045.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0045.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0045.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.697] lstrlenW (lpString=".ldf") returned 4 [0045.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.697] lstrlenW (lpString=".vhd") returned 4 [0045.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.697] lstrlenW (lpString=".vhdx") returned 5 [0045.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.697] lstrlenW (lpString=".pst") returned 4 [0045.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.697] lstrlenW (lpString=".ost") returned 4 [0045.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.697] lstrlenW (lpString=".bak") returned 4 [0045.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.698] lstrlenW (lpString=".bac") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.698] lstrlenW (lpString=".sys") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.698] lstrlenW (lpString=".v2i") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.698] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.698] lstrlenW (lpString=".sql") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.698] lstrlenW (lpString=".mdf") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.698] lstrlenW (lpString=".txt") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.698] lstrlenW (lpString=".dbf") returned 4 [0045.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.698] lstrlenW (lpString=".ckp") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.699] lstrlenW (lpString=".dacpac") returned 7 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.699] lstrlenW (lpString=".db3") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.699] lstrlenW (lpString=".dtxs") returned 5 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.699] lstrlenW (lpString=".mdt") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.699] lstrlenW (lpString=".sdf") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.699] lstrlenW (lpString=".MDF") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.699] lstrlenW (lpString=".DBF") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.699] lstrlenW (lpString=".DB") returned 3 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.699] lstrlenW (lpString=".db") returned 3 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.699] lstrlenW (lpString=".ndf") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.699] lstrlenW (lpString=".NDF") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.699] lstrlenW (lpString=".Mdf") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.699] lstrlenW (lpString=".dat") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.699] lstrlenW (lpString=".DAT") returned 4 [0045.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.699] lstrlenW (lpString=".ldf") returned 4 [0045.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.700] lstrlenW (lpString=".LDF") returned 4 [0045.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.700] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.700] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.701] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.701] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.701] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16570206588) returned 1 [0045.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa0d46f0, dwHighDateTime=0x1d585b4)) [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295460 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30edf8 [0045.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0045.702] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.702] GetLastError () returned 0x0 [0045.702] GetLastError () returned 0x0 [0045.702] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.702] GetLastError () returned 0x0 [0045.702] GetLastError () returned 0x0 [0045.704] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff937, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.704] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x6c9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x6c9, lpOverlapped=0x0) returned 1 [0045.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.704] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.704] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.704] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.704] CloseHandle (hObject=0x108) returned 1 [0045.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.705] GetLastError () returned 0x0 [0045.705] RtlWakeConditionVariable () returned 0x27e828 [0045.705] GetCurrentThreadId () returned 0x998 [0045.705] GetCurrentThreadId () returned 0x998 [0045.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ca48 | out: hHeap=0x260000) returned 1 [0045.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0045.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ca48 [0045.706] lstrlenW (lpString=".ldf") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".ldf") returned 0x0 [0045.706] lstrlenW (lpString=".vhd") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".vhd") returned 0x0 [0045.706] lstrlenW (lpString=".vhdx") returned 5 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".vhdx") returned 0x0 [0045.706] lstrlenW (lpString=".pst") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".pst") returned 0x0 [0045.706] lstrlenW (lpString=".ost") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".ost") returned 0x0 [0045.706] lstrlenW (lpString=".bak") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".bak") returned 0x0 [0045.706] lstrlenW (lpString=".bac") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".bac") returned 0x0 [0045.706] lstrlenW (lpString=".sys") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".sys") returned 0x0 [0045.706] lstrlenW (lpString=".v2i") returned 4 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".v2i") returned 0x0 [0045.706] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.707] lstrlenW (lpString=".sql") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".sql") returned 0x0 [0045.707] lstrlenW (lpString=".mdf") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".mdf") returned 0x0 [0045.707] lstrlenW (lpString=".txt") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".txt") returned 0x0 [0045.707] lstrlenW (lpString=".dbf") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".dbf") returned 0x0 [0045.707] lstrlenW (lpString=".ckp") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".ckp") returned 0x0 [0045.707] lstrlenW (lpString=".dacpac") returned 7 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".dacpac") returned 0x0 [0045.707] lstrlenW (lpString=".db3") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".db3") returned 0x0 [0045.707] lstrlenW (lpString=".dtxs") returned 5 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".dtxs") returned 0x0 [0045.707] lstrlenW (lpString=".mdt") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".mdt") returned 0x0 [0045.707] lstrlenW (lpString=".sdf") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".sdf") returned 0x0 [0045.707] lstrlenW (lpString=".MDF") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".MDF") returned 0x0 [0045.707] lstrlenW (lpString=".DBF") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".DBF") returned 0x0 [0045.707] lstrlenW (lpString=".DB") returned 3 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".DB") returned 0x0 [0045.707] lstrlenW (lpString=".db") returned 3 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".db") returned 0x0 [0045.707] lstrlenW (lpString=".ndf") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".ndf") returned 0x0 [0045.707] lstrlenW (lpString=".NDF") returned 4 [0045.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".NDF") returned 0x0 [0045.708] lstrlenW (lpString=".Mdf") returned 4 [0045.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".Mdf") returned 0x0 [0045.708] lstrlenW (lpString=".dat") returned 4 [0045.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".dat") returned 0x0 [0045.708] lstrlenW (lpString=".DAT") returned 4 [0045.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".DAT") returned 0x0 [0045.708] lstrlenW (lpString=".ldf") returned 4 [0045.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".ldf") returned 0x0 [0045.708] lstrlenW (lpString=".LDF") returned 4 [0045.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch=".LDF") returned 0x0 [0045.708] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.781] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.782] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0045.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.782] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16578342169) returned 1 [0045.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa192dd0, dwHighDateTime=0x1d585b4)) [0045.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0045.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295310 [0045.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0045.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0045.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.783] GetLastError () returned 0x0 [0045.783] GetLastError () returned 0x0 [0045.783] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.783] GetLastError () returned 0x0 [0045.783] GetLastError () returned 0x0 [0045.785] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff1dce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.785] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xe232, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xe232, lpOverlapped=0x0) returned 1 [0045.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.786] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.786] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.786] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.787] CloseHandle (hObject=0x108) returned 1 [0045.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x316238 [0045.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x316238 | out: hHeap=0x260000) returned 1 [0045.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.787] GetLastError () returned 0x0 [0045.787] RtlWakeConditionVariable () returned 0x27e828 [0045.787] GetCurrentThreadId () returned 0x998 [0045.787] GetCurrentThreadId () returned 0x998 [0045.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319c48 [0045.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a2d8 | out: hHeap=0x260000) returned 1 [0045.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295348 | out: hHeap=0x260000) returned 1 [0045.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a2d8 [0045.788] lstrlenW (lpString=".ldf") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.788] lstrlenW (lpString=".vhd") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.788] lstrlenW (lpString=".vhdx") returned 5 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.788] lstrlenW (lpString=".pst") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.788] lstrlenW (lpString=".ost") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.788] lstrlenW (lpString=".bak") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.788] lstrlenW (lpString=".bac") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.788] lstrlenW (lpString=".sys") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.788] lstrlenW (lpString=".v2i") returned 4 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.788] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.916] lstrlenW (lpString=".sql") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.916] lstrlenW (lpString=".mdf") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.916] lstrlenW (lpString=".txt") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.916] lstrlenW (lpString=".dbf") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.916] lstrlenW (lpString=".ckp") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.916] lstrlenW (lpString=".dacpac") returned 7 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.916] lstrlenW (lpString=".db3") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.916] lstrlenW (lpString=".dtxs") returned 5 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.916] lstrlenW (lpString=".mdt") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.916] lstrlenW (lpString=".sdf") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.916] lstrlenW (lpString=".MDF") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.916] lstrlenW (lpString=".DBF") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.916] lstrlenW (lpString=".DB") returned 3 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.916] lstrlenW (lpString=".db") returned 3 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.916] lstrlenW (lpString=".ndf") returned 4 [0045.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.916] lstrlenW (lpString=".NDF") returned 4 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.917] lstrlenW (lpString=".Mdf") returned 4 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.917] lstrlenW (lpString=".dat") returned 4 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.917] lstrlenW (lpString=".DAT") returned 4 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.917] lstrlenW (lpString=".ldf") returned 4 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.917] lstrlenW (lpString=".LDF") returned 4 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.917] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.917] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.918] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.918] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.918] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16591901671) returned 1 [0045.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa2e9a30, dwHighDateTime=0x1d585b4)) [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1aa0 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1aa0 | out: hHeap=0x260000) returned 1 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0045.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0045.918] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.919] GetLastError () returned 0x0 [0045.919] GetLastError () returned 0x0 [0045.919] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.919] GetLastError () returned 0x0 [0045.919] GetLastError () returned 0x0 [0045.922] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb834, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.922] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x47cc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x47cc, lpOverlapped=0x0) returned 1 [0045.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.922] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.922] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.922] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.922] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.922] CloseHandle (hObject=0x104) returned 1 [0045.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.923] GetLastError () returned 0x0 [0045.923] RtlWakeConditionVariable () returned 0x27e828 [0045.923] GetCurrentThreadId () returned 0x998 [0045.923] GetCurrentThreadId () returned 0x998 [0045.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c260 | out: hHeap=0x260000) returned 1 [0045.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0045.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c260 [0045.923] lstrlenW (lpString=".ldf") returned 4 [0045.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.923] lstrlenW (lpString=".vhd") returned 4 [0045.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.923] lstrlenW (lpString=".vhdx") returned 5 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.924] lstrlenW (lpString=".pst") returned 4 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.924] lstrlenW (lpString=".ost") returned 4 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.924] lstrlenW (lpString=".bak") returned 4 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.924] lstrlenW (lpString=".bac") returned 4 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.924] lstrlenW (lpString=".sys") returned 4 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.924] lstrlenW (lpString=".v2i") returned 4 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.924] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.925] lstrlenW (lpString=".sql") returned 4 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.925] lstrlenW (lpString=".mdf") returned 4 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.925] lstrlenW (lpString=".txt") returned 4 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.925] lstrlenW (lpString=".dbf") returned 4 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.925] lstrlenW (lpString=".ckp") returned 4 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.925] lstrlenW (lpString=".dacpac") returned 7 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.925] lstrlenW (lpString=".db3") returned 4 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.925] lstrlenW (lpString=".dtxs") returned 5 [0045.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.925] lstrlenW (lpString=".mdt") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.926] lstrlenW (lpString=".sdf") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.926] lstrlenW (lpString=".MDF") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.926] lstrlenW (lpString=".DBF") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.926] lstrlenW (lpString=".DB") returned 3 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.926] lstrlenW (lpString=".db") returned 3 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.926] lstrlenW (lpString=".ndf") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.926] lstrlenW (lpString=".NDF") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.926] lstrlenW (lpString=".Mdf") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.926] lstrlenW (lpString=".dat") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.926] lstrlenW (lpString=".DAT") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.926] lstrlenW (lpString=".ldf") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.926] lstrlenW (lpString=".LDF") returned 4 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.926] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.927] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.927] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.927] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16592862567) returned 1 [0045.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa30fb90, dwHighDateTime=0x1d585b4)) [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0045.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.928] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.928] GetLastError () returned 0x0 [0045.928] GetLastError () returned 0x0 [0045.928] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.928] GetLastError () returned 0x0 [0045.928] GetLastError () returned 0x0 [0045.930] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff9dd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.930] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x623, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x623, lpOverlapped=0x0) returned 1 [0045.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.930] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.930] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.930] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.930] CloseHandle (hObject=0x104) returned 1 [0045.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.931] GetLastError () returned 0x0 [0045.931] RtlWakeConditionVariable () returned 0x27e828 [0045.931] GetCurrentThreadId () returned 0x998 [0045.931] GetCurrentThreadId () returned 0x998 [0045.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b628 | out: hHeap=0x260000) returned 1 [0045.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03f0 | out: hHeap=0x260000) returned 1 [0045.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0045.931] lstrlenW (lpString=".ldf") returned 4 [0045.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.931] lstrlenW (lpString=".vhd") returned 4 [0045.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.931] lstrlenW (lpString=".vhdx") returned 5 [0045.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.931] lstrlenW (lpString=".pst") returned 4 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.932] lstrlenW (lpString=".ost") returned 4 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.932] lstrlenW (lpString=".bak") returned 4 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.932] lstrlenW (lpString=".bac") returned 4 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.932] lstrlenW (lpString=".sys") returned 4 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.932] lstrlenW (lpString=".v2i") returned 4 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.932] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.933] lstrlenW (lpString=".sql") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.933] lstrlenW (lpString=".mdf") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.933] lstrlenW (lpString=".txt") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.933] lstrlenW (lpString=".dbf") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.933] lstrlenW (lpString=".ckp") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.933] lstrlenW (lpString=".dacpac") returned 7 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.933] lstrlenW (lpString=".db3") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.933] lstrlenW (lpString=".dtxs") returned 5 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.933] lstrlenW (lpString=".mdt") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.933] lstrlenW (lpString=".sdf") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.933] lstrlenW (lpString=".MDF") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.933] lstrlenW (lpString=".DBF") returned 4 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.933] lstrlenW (lpString=".DB") returned 3 [0045.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.934] lstrlenW (lpString=".db") returned 3 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.934] lstrlenW (lpString=".ndf") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.934] lstrlenW (lpString=".NDF") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.934] lstrlenW (lpString=".Mdf") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.934] lstrlenW (lpString=".dat") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.934] lstrlenW (lpString=".DAT") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.934] lstrlenW (lpString=".ldf") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.934] lstrlenW (lpString=".LDF") returned 4 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.934] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.934] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.935] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.935] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.935] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16593614888) returned 1 [0045.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa30fb90, dwHighDateTime=0x1d585b4)) [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f03f0 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03f0 | out: hHeap=0x260000) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0045.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.935] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.936] GetLastError () returned 0x0 [0045.936] GetLastError () returned 0x0 [0045.936] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.936] GetLastError () returned 0x0 [0045.936] GetLastError () returned 0x0 [0045.938] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff8a26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.938] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x75da, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x75da, lpOverlapped=0x0) returned 1 [0045.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.938] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.938] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.938] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.938] CloseHandle (hObject=0x104) returned 1 [0045.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.938] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.940] GetLastError () returned 0x0 [0045.940] RtlWakeConditionVariable () returned 0x27e828 [0045.940] GetCurrentThreadId () returned 0x998 [0045.940] GetCurrentThreadId () returned 0x998 [0045.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c038 | out: hHeap=0x260000) returned 1 [0045.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0428 | out: hHeap=0x260000) returned 1 [0045.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c038 [0045.940] lstrlenW (lpString=".ldf") returned 4 [0045.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".ldf") returned 0x0 [0045.940] lstrlenW (lpString=".vhd") returned 4 [0045.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".vhd") returned 0x0 [0045.940] lstrlenW (lpString=".vhdx") returned 5 [0045.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".vhdx") returned 0x0 [0045.940] lstrlenW (lpString=".pst") returned 4 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".pst") returned 0x0 [0045.941] lstrlenW (lpString=".ost") returned 4 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".ost") returned 0x0 [0045.941] lstrlenW (lpString=".bak") returned 4 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".bak") returned 0x0 [0045.941] lstrlenW (lpString=".bac") returned 4 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".bac") returned 0x0 [0045.941] lstrlenW (lpString=".sys") returned 4 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".sys") returned 0x0 [0045.941] lstrlenW (lpString=".v2i") returned 4 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".v2i") returned 0x0 [0045.941] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.942] lstrlenW (lpString=".sql") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".sql") returned 0x0 [0045.942] lstrlenW (lpString=".mdf") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".mdf") returned 0x0 [0045.942] lstrlenW (lpString=".txt") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".txt") returned 0x0 [0045.942] lstrlenW (lpString=".dbf") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".dbf") returned 0x0 [0045.942] lstrlenW (lpString=".ckp") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".ckp") returned 0x0 [0045.942] lstrlenW (lpString=".dacpac") returned 7 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".dacpac") returned 0x0 [0045.942] lstrlenW (lpString=".db3") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".db3") returned 0x0 [0045.942] lstrlenW (lpString=".dtxs") returned 5 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".dtxs") returned 0x0 [0045.942] lstrlenW (lpString=".mdt") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".mdt") returned 0x0 [0045.942] lstrlenW (lpString=".sdf") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".sdf") returned 0x0 [0045.942] lstrlenW (lpString=".MDF") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".MDF") returned 0x0 [0045.942] lstrlenW (lpString=".DBF") returned 4 [0045.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".DBF") returned 0x0 [0045.943] lstrlenW (lpString=".DB") returned 3 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".DB") returned 0x0 [0045.943] lstrlenW (lpString=".db") returned 3 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".db") returned 0x0 [0045.943] lstrlenW (lpString=".ndf") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".ndf") returned 0x0 [0045.943] lstrlenW (lpString=".NDF") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".NDF") returned 0x0 [0045.943] lstrlenW (lpString=".Mdf") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".Mdf") returned 0x0 [0045.943] lstrlenW (lpString=".dat") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".dat") returned 0x0 [0045.943] lstrlenW (lpString=".DAT") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".DAT") returned 0x0 [0045.943] lstrlenW (lpString=".ldf") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".ldf") returned 0x0 [0045.943] lstrlenW (lpString=".LDF") returned 4 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch=".LDF") returned 0x0 [0045.943] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.943] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.944] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.944] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.944] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16594517915) returned 1 [0045.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa335cf0, dwHighDateTime=0x1d585b4)) [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0428 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0428 | out: hHeap=0x260000) returned 1 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0045.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.945] GetLastError () returned 0x0 [0045.945] GetLastError () returned 0x0 [0045.945] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.945] GetLastError () returned 0x0 [0045.945] GetLastError () returned 0x0 [0045.947] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff403a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.947] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xbfc6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0xbfc6, lpOverlapped=0x0) returned 1 [0045.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.948] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.948] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.948] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.948] CloseHandle (hObject=0x104) returned 1 [0045.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.949] GetLastError () returned 0x0 [0045.949] RtlWakeConditionVariable () returned 0x27e828 [0045.949] GetCurrentThreadId () returned 0x998 [0045.949] GetCurrentThreadId () returned 0x998 [0045.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bec8 | out: hHeap=0x260000) returned 1 [0045.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0460 | out: hHeap=0x260000) returned 1 [0045.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bec8 [0045.949] lstrlenW (lpString=".ldf") returned 4 [0045.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".ldf") returned 0x0 [0045.949] lstrlenW (lpString=".vhd") returned 4 [0045.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".vhd") returned 0x0 [0045.949] lstrlenW (lpString=".vhdx") returned 5 [0045.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".vhdx") returned 0x0 [0045.949] lstrlenW (lpString=".pst") returned 4 [0045.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".pst") returned 0x0 [0045.949] lstrlenW (lpString=".ost") returned 4 [0045.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".ost") returned 0x0 [0045.949] lstrlenW (lpString=".bak") returned 4 [0045.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".bak") returned 0x0 [0045.949] lstrlenW (lpString=".bac") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".bac") returned 0x0 [0045.950] lstrlenW (lpString=".sys") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".sys") returned 0x0 [0045.950] lstrlenW (lpString=".v2i") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".v2i") returned 0x0 [0045.950] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.950] lstrlenW (lpString=".sql") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".sql") returned 0x0 [0045.950] lstrlenW (lpString=".mdf") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".mdf") returned 0x0 [0045.950] lstrlenW (lpString=".txt") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".txt") returned 0x0 [0045.950] lstrlenW (lpString=".dbf") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".dbf") returned 0x0 [0045.950] lstrlenW (lpString=".ckp") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".ckp") returned 0x0 [0045.950] lstrlenW (lpString=".dacpac") returned 7 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".dacpac") returned 0x0 [0045.950] lstrlenW (lpString=".db3") returned 4 [0045.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".db3") returned 0x0 [0045.950] lstrlenW (lpString=".dtxs") returned 5 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".dtxs") returned 0x0 [0045.951] lstrlenW (lpString=".mdt") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".mdt") returned 0x0 [0045.951] lstrlenW (lpString=".sdf") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".sdf") returned 0x0 [0045.951] lstrlenW (lpString=".MDF") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".MDF") returned 0x0 [0045.951] lstrlenW (lpString=".DBF") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".DBF") returned 0x0 [0045.951] lstrlenW (lpString=".DB") returned 3 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".DB") returned 0x0 [0045.951] lstrlenW (lpString=".db") returned 3 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".db") returned 0x0 [0045.951] lstrlenW (lpString=".ndf") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".ndf") returned 0x0 [0045.951] lstrlenW (lpString=".NDF") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".NDF") returned 0x0 [0045.951] lstrlenW (lpString=".Mdf") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".Mdf") returned 0x0 [0045.951] lstrlenW (lpString=".dat") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".dat") returned 0x0 [0045.951] lstrlenW (lpString=".DAT") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".DAT") returned 0x0 [0045.951] lstrlenW (lpString=".ldf") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".ldf") returned 0x0 [0045.951] lstrlenW (lpString=".LDF") returned 4 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch=".LDF") returned 0x0 [0045.951] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.951] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.952] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.952] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.952] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16595345566) returned 1 [0045.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa335cf0, dwHighDateTime=0x1d585b4)) [0045.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0460 [0045.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0460 | out: hHeap=0x260000) returned 1 [0045.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0045.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.953] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.953] GetLastError () returned 0x0 [0045.953] GetLastError () returned 0x0 [0045.953] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.953] GetLastError () returned 0x0 [0045.953] GetLastError () returned 0x0 [0045.954] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.954] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x2ab, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ab, lpOverlapped=0x0) returned 1 [0045.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.955] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.955] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.955] CloseHandle (hObject=0x104) returned 1 [0045.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.956] GetLastError () returned 0x0 [0045.956] RtlWakeConditionVariable () returned 0x27e828 [0045.956] GetCurrentThreadId () returned 0x998 [0045.956] GetCurrentThreadId () returned 0x998 [0045.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9508 | out: hHeap=0x260000) returned 1 [0045.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0498 | out: hHeap=0x260000) returned 1 [0045.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9508 [0045.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.956] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.956] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.956] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.957] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.957] CloseHandle (hObject=0x104) returned 1 [0045.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9508 | out: hHeap=0x260000) returned 1 [0045.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0045.958] RtlWakeConditionVariable () returned 0x27e828 [0045.958] GetCurrentThreadId () returned 0x998 [0045.958] GetCurrentThreadId () returned 0x998 [0045.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c1a8 | out: hHeap=0x260000) returned 1 [0045.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0045.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c1a8 [0045.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.958] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.958] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.958] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.958] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.959] CloseHandle (hObject=0x104) returned 1 [0045.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c1a8 | out: hHeap=0x260000) returned 1 [0045.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0045.960] RtlWakeConditionVariable () returned 0x27e828 [0045.960] GetCurrentThreadId () returned 0x998 [0045.960] GetCurrentThreadId () returned 0x998 [0045.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319c48 [0045.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a6c8 | out: hHeap=0x260000) returned 1 [0045.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0045.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a6c8 [0045.960] lstrlenW (lpString=".ldf") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".ldf") returned 0x0 [0045.960] lstrlenW (lpString=".vhd") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".vhd") returned 0x0 [0045.960] lstrlenW (lpString=".vhdx") returned 5 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".vhdx") returned 0x0 [0045.960] lstrlenW (lpString=".pst") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".pst") returned 0x0 [0045.960] lstrlenW (lpString=".ost") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".ost") returned 0x0 [0045.960] lstrlenW (lpString=".bak") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".bak") returned 0x0 [0045.960] lstrlenW (lpString=".bac") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".bac") returned 0x0 [0045.960] lstrlenW (lpString=".sys") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".sys") returned 0x0 [0045.960] lstrlenW (lpString=".v2i") returned 4 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".v2i") returned 0x0 [0045.960] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch="s\r\n.v2i") returned 0x0 [0045.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.961] lstrlenW (lpString=".sql") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".sql") returned 0x0 [0045.961] lstrlenW (lpString=".mdf") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".mdf") returned 0x0 [0045.961] lstrlenW (lpString=".txt") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".txt") returned 0x0 [0045.961] lstrlenW (lpString=".dbf") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".dbf") returned 0x0 [0045.961] lstrlenW (lpString=".ckp") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".ckp") returned 0x0 [0045.961] lstrlenW (lpString=".dacpac") returned 7 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".dacpac") returned 0x0 [0045.961] lstrlenW (lpString=".db3") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".db3") returned 0x0 [0045.961] lstrlenW (lpString=".dtxs") returned 5 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".dtxs") returned 0x0 [0045.961] lstrlenW (lpString=".mdt") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".mdt") returned 0x0 [0045.961] lstrlenW (lpString=".sdf") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".sdf") returned 0x0 [0045.961] lstrlenW (lpString=".MDF") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".MDF") returned 0x0 [0045.961] lstrlenW (lpString=".DBF") returned 4 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".DBF") returned 0x0 [0045.961] lstrlenW (lpString=".DB") returned 3 [0045.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".DB") returned 0x0 [0045.962] lstrlenW (lpString=".db") returned 3 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".db") returned 0x0 [0045.962] lstrlenW (lpString=".ndf") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".ndf") returned 0x0 [0045.962] lstrlenW (lpString=".NDF") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".NDF") returned 0x0 [0045.962] lstrlenW (lpString=".Mdf") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".Mdf") returned 0x0 [0045.962] lstrlenW (lpString=".dat") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".dat") returned 0x0 [0045.962] lstrlenW (lpString=".DAT") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".DAT") returned 0x0 [0045.962] lstrlenW (lpString=".ldf") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".ldf") returned 0x0 [0045.962] lstrlenW (lpString=".LDF") returned 4 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch=".LDF") returned 0x0 [0045.962] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.962] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.963] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.963] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.963] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16596422296) returned 1 [0045.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa35be50, dwHighDateTime=0x1d585b4)) [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a2d8 [0045.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a2d8 | out: hHeap=0x260000) returned 1 [0045.964] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.964] GetLastError () returned 0x0 [0045.964] GetLastError () returned 0x0 [0045.964] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.964] GetLastError () returned 0x0 [0045.964] GetLastError () returned 0x0 [0045.967] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.967] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0045.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.970] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.970] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.971] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.971] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.971] CloseHandle (hObject=0x104) returned 1 [0045.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.[deadmin@cock.li].deadmin")) returned 1 [0045.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.972] GetLastError () returned 0x0 [0045.972] RtlWakeConditionVariable () returned 0x27e828 [0045.972] GetCurrentThreadId () returned 0x998 [0045.972] GetCurrentThreadId () returned 0x998 [0045.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9698 | out: hHeap=0x260000) returned 1 [0045.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0045.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9698 [0045.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.973] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.973] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.973] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.973] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.974] CloseHandle (hObject=0x104) returned 1 [0045.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9698 | out: hHeap=0x260000) returned 1 [0045.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0045.974] RtlWakeConditionVariable () returned 0x27e828 [0045.974] GetCurrentThreadId () returned 0x998 [0045.974] GetCurrentThreadId () returned 0x998 [0045.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319c48 [0045.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a770 | out: hHeap=0x260000) returned 1 [0045.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0045.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a770 [0045.974] lstrlenW (lpString=".ldf") returned 4 [0045.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".ldf") returned 0x0 [0045.974] lstrlenW (lpString=".vhd") returned 4 [0045.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".vhd") returned 0x0 [0045.974] lstrlenW (lpString=".vhdx") returned 5 [0045.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".vhdx") returned 0x0 [0045.974] lstrlenW (lpString=".pst") returned 4 [0045.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".pst") returned 0x0 [0045.975] lstrlenW (lpString=".ost") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".ost") returned 0x0 [0045.975] lstrlenW (lpString=".bak") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".bak") returned 0x0 [0045.975] lstrlenW (lpString=".bac") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".bac") returned 0x0 [0045.975] lstrlenW (lpString=".sys") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".sys") returned 0x0 [0045.975] lstrlenW (lpString=".v2i") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".v2i") returned 0x0 [0045.975] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch="s\r\n.v2i") returned 0x0 [0045.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.975] lstrlenW (lpString=".sql") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".sql") returned 0x0 [0045.975] lstrlenW (lpString=".mdf") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".mdf") returned 0x0 [0045.975] lstrlenW (lpString=".txt") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".txt") returned 0x0 [0045.975] lstrlenW (lpString=".dbf") returned 4 [0045.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".dbf") returned 0x0 [0045.975] lstrlenW (lpString=".ckp") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".ckp") returned 0x0 [0045.976] lstrlenW (lpString=".dacpac") returned 7 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".dacpac") returned 0x0 [0045.976] lstrlenW (lpString=".db3") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".db3") returned 0x0 [0045.976] lstrlenW (lpString=".dtxs") returned 5 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".dtxs") returned 0x0 [0045.976] lstrlenW (lpString=".mdt") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".mdt") returned 0x0 [0045.976] lstrlenW (lpString=".sdf") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".sdf") returned 0x0 [0045.976] lstrlenW (lpString=".MDF") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".MDF") returned 0x0 [0045.976] lstrlenW (lpString=".DBF") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".DBF") returned 0x0 [0045.976] lstrlenW (lpString=".DB") returned 3 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".DB") returned 0x0 [0045.976] lstrlenW (lpString=".db") returned 3 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".db") returned 0x0 [0045.976] lstrlenW (lpString=".ndf") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".ndf") returned 0x0 [0045.976] lstrlenW (lpString=".NDF") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".NDF") returned 0x0 [0045.976] lstrlenW (lpString=".Mdf") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".Mdf") returned 0x0 [0045.976] lstrlenW (lpString=".dat") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".dat") returned 0x0 [0045.976] lstrlenW (lpString=".DAT") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".DAT") returned 0x0 [0045.976] lstrlenW (lpString=".ldf") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".ldf") returned 0x0 [0045.976] lstrlenW (lpString=".LDF") returned 4 [0045.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch=".LDF") returned 0x0 [0045.977] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.977] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.977] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.977] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.978] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16597873248) returned 1 [0045.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa381fb0, dwHighDateTime=0x1d585b4)) [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a6c8 [0045.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a6c8 | out: hHeap=0x260000) returned 1 [0045.978] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.978] GetLastError () returned 0x0 [0045.978] GetLastError () returned 0x0 [0045.978] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.978] GetLastError () returned 0x0 [0045.979] GetLastError () returned 0x0 [0045.981] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.981] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0045.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.982] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.983] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.984] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.984] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.984] CloseHandle (hObject=0x104) returned 1 [0045.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.[deadmin@cock.li].deadmin")) returned 1 [0045.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.985] GetLastError () returned 0x0 [0045.985] RtlWakeConditionVariable () returned 0x27e828 [0045.985] GetCurrentThreadId () returned 0x998 [0045.985] GetCurrentThreadId () returned 0x998 [0045.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9760 | out: hHeap=0x260000) returned 1 [0045.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0045.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9760 [0045.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.985] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.986] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.986] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.986] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.987] CloseHandle (hObject=0x104) returned 1 [0045.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9760 | out: hHeap=0x260000) returned 1 [0045.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0045.987] RtlWakeConditionVariable () returned 0x27e828 [0045.987] GetCurrentThreadId () returned 0x998 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".ldf") returned 0x0 [0045.987] lstrlenW (lpString=".vhd") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".vhd") returned 0x0 [0045.987] lstrlenW (lpString=".vhdx") returned 5 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".vhdx") returned 0x0 [0045.987] lstrlenW (lpString=".pst") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".pst") returned 0x0 [0045.987] lstrlenW (lpString=".ost") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".ost") returned 0x0 [0045.987] lstrlenW (lpString=".bak") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".bak") returned 0x0 [0045.987] lstrlenW (lpString=".bac") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".bac") returned 0x0 [0045.987] lstrlenW (lpString=".sys") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".sys") returned 0x0 [0045.987] lstrlenW (lpString=".v2i") returned 4 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".v2i") returned 0x0 [0045.987] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch="s\r\n.v2i") returned 0x0 [0045.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.988] lstrlenW (lpString=".sql") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".sql") returned 0x0 [0045.988] lstrlenW (lpString=".mdf") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".mdf") returned 0x0 [0045.988] lstrlenW (lpString=".txt") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".txt") returned 0x0 [0045.988] lstrlenW (lpString=".dbf") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".dbf") returned 0x0 [0045.988] lstrlenW (lpString=".ckp") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".ckp") returned 0x0 [0045.988] lstrlenW (lpString=".dacpac") returned 7 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".dacpac") returned 0x0 [0045.988] lstrlenW (lpString=".db3") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".db3") returned 0x0 [0045.988] lstrlenW (lpString=".dtxs") returned 5 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".dtxs") returned 0x0 [0045.988] lstrlenW (lpString=".mdt") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".mdt") returned 0x0 [0045.988] lstrlenW (lpString=".sdf") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".sdf") returned 0x0 [0045.988] lstrlenW (lpString=".MDF") returned 4 [0045.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".MDF") returned 0x0 [0045.988] lstrlenW (lpString=".DBF") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".DBF") returned 0x0 [0045.989] lstrlenW (lpString=".DB") returned 3 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".DB") returned 0x0 [0045.989] lstrlenW (lpString=".db") returned 3 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".db") returned 0x0 [0045.989] lstrlenW (lpString=".ndf") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".ndf") returned 0x0 [0045.989] lstrlenW (lpString=".NDF") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".NDF") returned 0x0 [0045.989] lstrlenW (lpString=".Mdf") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".Mdf") returned 0x0 [0045.989] lstrlenW (lpString=".dat") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".dat") returned 0x0 [0045.989] lstrlenW (lpString=".DAT") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".DAT") returned 0x0 [0045.989] lstrlenW (lpString=".ldf") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".ldf") returned 0x0 [0045.989] lstrlenW (lpString=".LDF") returned 4 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch=".LDF") returned 0x0 [0045.989] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.989] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0045.990] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.990] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.990] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16599153447) returned 1 [0045.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa3a8110, dwHighDateTime=0x1d585b4)) [0045.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bb8 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a770 [0045.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a770 | out: hHeap=0x260000) returned 1 [0045.991] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0045.991] GetLastError () returned 0x0 [0045.991] GetLastError () returned 0x0 [0045.991] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0045.991] GetLastError () returned 0x0 [0045.991] GetLastError () returned 0x0 [0046.144] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.144] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.156] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.164] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.207] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.207] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.207] CloseHandle (hObject=0x104) returned 1 [0046.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.[deadmin@cock.li].deadmin")) returned 1 [0046.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.208] GetLastError () returned 0x0 [0046.208] RtlWakeConditionVariable () returned 0x27e828 [0046.208] GetCurrentThreadId () returned 0x998 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".ldf") returned 0x0 [0046.208] lstrlenW (lpString=".vhd") returned 4 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".vhd") returned 0x0 [0046.208] lstrlenW (lpString=".vhdx") returned 5 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".vhdx") returned 0x0 [0046.208] lstrlenW (lpString=".pst") returned 4 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".pst") returned 0x0 [0046.208] lstrlenW (lpString=".ost") returned 4 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".ost") returned 0x0 [0046.208] lstrlenW (lpString=".bak") returned 4 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".bak") returned 0x0 [0046.208] lstrlenW (lpString=".bac") returned 4 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".bac") returned 0x0 [0046.208] lstrlenW (lpString=".sys") returned 4 [0046.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".sys") returned 0x0 [0046.209] lstrlenW (lpString=".v2i") returned 4 [0046.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".v2i") returned 0x0 [0046.209] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.247] lstrlenW (lpString=".sql") returned 4 [0046.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".sql") returned 0x0 [0046.247] lstrlenW (lpString=".mdf") returned 4 [0046.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".mdf") returned 0x0 [0046.247] lstrlenW (lpString=".txt") returned 4 [0046.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".txt") returned 0x0 [0046.247] lstrlenW (lpString=".dbf") returned 4 [0046.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".dbf") returned 0x0 [0046.247] lstrlenW (lpString=".ckp") returned 4 [0046.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".ckp") returned 0x0 [0046.254] lstrlenW (lpString=".dacpac") returned 7 [0046.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".dacpac") returned 0x0 [0046.259] lstrlenW (lpString=".db3") returned 4 [0046.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".db3") returned 0x0 [0046.259] lstrlenW (lpString=".dtxs") returned 5 [0046.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".dtxs") returned 0x0 [0046.259] lstrlenW (lpString=".mdt") returned 4 [0046.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".mdt") returned 0x0 [0046.259] lstrlenW (lpString=".sdf") returned 4 [0046.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".sdf") returned 0x0 [0046.259] lstrlenW (lpString=".MDF") returned 4 [0046.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".MDF") returned 0x0 [0046.259] lstrlenW (lpString=".DBF") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".DBF") returned 0x0 [0046.260] lstrlenW (lpString=".DB") returned 3 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".DB") returned 0x0 [0046.260] lstrlenW (lpString=".db") returned 3 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".db") returned 0x0 [0046.260] lstrlenW (lpString=".ndf") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".ndf") returned 0x0 [0046.260] lstrlenW (lpString=".NDF") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".NDF") returned 0x0 [0046.260] lstrlenW (lpString=".Mdf") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".Mdf") returned 0x0 [0046.260] lstrlenW (lpString=".dat") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".dat") returned 0x0 [0046.260] lstrlenW (lpString=".DAT") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".DAT") returned 0x0 [0046.260] lstrlenW (lpString=".ldf") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".ldf") returned 0x0 [0046.260] lstrlenW (lpString=".LDF") returned 4 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch=".LDF") returned 0x0 [0046.260] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.260] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.261] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.261] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.261] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16626220905) returned 1 [0046.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa62f870, dwHighDateTime=0x1d585b4)) [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7518 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7518 | out: hHeap=0x260000) returned 1 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ab60 [0046.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ab60 | out: hHeap=0x260000) returned 1 [0046.262] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.262] GetLastError () returned 0x0 [0046.262] GetLastError () returned 0x0 [0046.262] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.262] GetLastError () returned 0x0 [0046.262] GetLastError () returned 0x0 [0046.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.266] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.267] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.269] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.269] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.269] CloseHandle (hObject=0xf0) returned 1 [0046.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.269] GetLastError () returned 0x0 [0046.269] RtlWakeConditionVariable () returned 0x27e828 [0046.269] GetCurrentThreadId () returned 0x998 [0046.270] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.270] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.270] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.270] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.271] CloseHandle (hObject=0xf0) returned 1 [0046.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b850 | out: hHeap=0x260000) returned 1 [0046.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0046.271] RtlWakeConditionVariable () returned 0x27e828 [0046.271] GetCurrentThreadId () returned 0x998 [0046.271] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.272] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.272] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.272] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.273] CloseHandle (hObject=0xf0) returned 1 [0046.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b798 | out: hHeap=0x260000) returned 1 [0046.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0046.273] RtlWakeConditionVariable () returned 0x27e828 [0046.273] GetCurrentThreadId () returned 0x998 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".ldf") returned 0x0 [0046.273] lstrlenW (lpString=".vhd") returned 4 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".vhd") returned 0x0 [0046.273] lstrlenW (lpString=".vhdx") returned 5 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".vhdx") returned 0x0 [0046.273] lstrlenW (lpString=".pst") returned 4 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".pst") returned 0x0 [0046.273] lstrlenW (lpString=".ost") returned 4 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".ost") returned 0x0 [0046.273] lstrlenW (lpString=".bak") returned 4 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".bak") returned 0x0 [0046.273] lstrlenW (lpString=".bac") returned 4 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".bac") returned 0x0 [0046.273] lstrlenW (lpString=".sys") returned 4 [0046.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".sys") returned 0x0 [0046.273] lstrlenW (lpString=".v2i") returned 4 [0046.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".v2i") returned 0x0 [0046.274] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.274] lstrlenW (lpString=".sql") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".sql") returned 0x0 [0046.275] lstrlenW (lpString=".mdf") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".mdf") returned 0x0 [0046.275] lstrlenW (lpString=".txt") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".txt") returned 0x0 [0046.275] lstrlenW (lpString=".dbf") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".dbf") returned 0x0 [0046.275] lstrlenW (lpString=".ckp") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".ckp") returned 0x0 [0046.275] lstrlenW (lpString=".dacpac") returned 7 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".dacpac") returned 0x0 [0046.275] lstrlenW (lpString=".db3") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".db3") returned 0x0 [0046.275] lstrlenW (lpString=".dtxs") returned 5 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".dtxs") returned 0x0 [0046.275] lstrlenW (lpString=".mdt") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".mdt") returned 0x0 [0046.275] lstrlenW (lpString=".sdf") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".sdf") returned 0x0 [0046.275] lstrlenW (lpString=".MDF") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".MDF") returned 0x0 [0046.275] lstrlenW (lpString=".DBF") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".DBF") returned 0x0 [0046.275] lstrlenW (lpString=".DB") returned 3 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".DB") returned 0x0 [0046.275] lstrlenW (lpString=".db") returned 3 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".db") returned 0x0 [0046.275] lstrlenW (lpString=".ndf") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".ndf") returned 0x0 [0046.275] lstrlenW (lpString=".NDF") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".NDF") returned 0x0 [0046.275] lstrlenW (lpString=".Mdf") returned 4 [0046.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".Mdf") returned 0x0 [0046.275] lstrlenW (lpString=".dat") returned 4 [0046.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".dat") returned 0x0 [0046.276] lstrlenW (lpString=".DAT") returned 4 [0046.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".DAT") returned 0x0 [0046.276] lstrlenW (lpString=".ldf") returned 4 [0046.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".ldf") returned 0x0 [0046.276] lstrlenW (lpString=".LDF") returned 4 [0046.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch=".LDF") returned 0x0 [0046.276] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.276] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.277] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.277] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.277] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16627786432) returned 1 [0046.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa6559d0, dwHighDateTime=0x1d585b4)) [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d75c0 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75c0 | out: hHeap=0x260000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0046.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331c88 [0046.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0046.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.277] GetLastError () returned 0x0 [0046.277] GetLastError () returned 0x0 [0046.278] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.278] GetLastError () returned 0x0 [0046.278] GetLastError () returned 0x0 [0046.280] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.280] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.281] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.282] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.283] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.283] CloseHandle (hObject=0xf0) returned 1 [0046.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0046.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0046.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.284] GetLastError () returned 0x0 [0046.284] RtlWakeConditionVariable () returned 0x27e828 [0046.284] GetCurrentThreadId () returned 0x998 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".ldf") returned 0x0 [0046.284] lstrlenW (lpString=".vhd") returned 4 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".vhd") returned 0x0 [0046.284] lstrlenW (lpString=".vhdx") returned 5 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".vhdx") returned 0x0 [0046.284] lstrlenW (lpString=".pst") returned 4 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".pst") returned 0x0 [0046.284] lstrlenW (lpString=".ost") returned 4 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".ost") returned 0x0 [0046.284] lstrlenW (lpString=".bak") returned 4 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".bak") returned 0x0 [0046.284] lstrlenW (lpString=".bac") returned 4 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".bac") returned 0x0 [0046.284] lstrlenW (lpString=".sys") returned 4 [0046.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".sys") returned 0x0 [0046.284] lstrlenW (lpString=".v2i") returned 4 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".v2i") returned 0x0 [0046.285] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.285] lstrlenW (lpString=".sql") returned 4 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".sql") returned 0x0 [0046.285] lstrlenW (lpString=".mdf") returned 4 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".mdf") returned 0x0 [0046.285] lstrlenW (lpString=".txt") returned 4 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".txt") returned 0x0 [0046.285] lstrlenW (lpString=".dbf") returned 4 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".dbf") returned 0x0 [0046.285] lstrlenW (lpString=".ckp") returned 4 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".ckp") returned 0x0 [0046.285] lstrlenW (lpString=".dacpac") returned 7 [0046.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".dacpac") returned 0x0 [0046.285] lstrlenW (lpString=".db3") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".db3") returned 0x0 [0046.286] lstrlenW (lpString=".dtxs") returned 5 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".dtxs") returned 0x0 [0046.286] lstrlenW (lpString=".mdt") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".mdt") returned 0x0 [0046.286] lstrlenW (lpString=".sdf") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".sdf") returned 0x0 [0046.286] lstrlenW (lpString=".MDF") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".MDF") returned 0x0 [0046.286] lstrlenW (lpString=".DBF") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".DBF") returned 0x0 [0046.286] lstrlenW (lpString=".DB") returned 3 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".DB") returned 0x0 [0046.286] lstrlenW (lpString=".db") returned 3 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".db") returned 0x0 [0046.286] lstrlenW (lpString=".ndf") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".ndf") returned 0x0 [0046.286] lstrlenW (lpString=".NDF") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".NDF") returned 0x0 [0046.286] lstrlenW (lpString=".Mdf") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".Mdf") returned 0x0 [0046.286] lstrlenW (lpString=".dat") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".dat") returned 0x0 [0046.286] lstrlenW (lpString=".DAT") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".DAT") returned 0x0 [0046.286] lstrlenW (lpString=".ldf") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".ldf") returned 0x0 [0046.286] lstrlenW (lpString=".LDF") returned 4 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch=".LDF") returned 0x0 [0046.286] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.287] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.287] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.287] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.287] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16628851243) returned 1 [0046.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa67bb30, dwHighDateTime=0x1d585b4)) [0046.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d75f8 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75f8 | out: hHeap=0x260000) returned 1 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0046.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0046.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.288] GetLastError () returned 0x0 [0046.288] GetLastError () returned 0x0 [0046.288] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.288] GetLastError () returned 0x0 [0046.288] GetLastError () returned 0x0 [0046.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.357] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.360] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.413] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.413] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.413] CloseHandle (hObject=0xf0) returned 1 [0046.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0046.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0046.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.459] GetLastError () returned 0x0 [0046.459] RtlWakeConditionVariable () returned 0x27e828 [0046.459] GetCurrentThreadId () returned 0x998 [0046.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".ldf") returned 0x0 [0046.459] lstrlenW (lpString=".vhd") returned 4 [0046.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".vhd") returned 0x0 [0046.460] lstrlenW (lpString=".vhdx") returned 5 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".vhdx") returned 0x0 [0046.460] lstrlenW (lpString=".pst") returned 4 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".pst") returned 0x0 [0046.460] lstrlenW (lpString=".ost") returned 4 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".ost") returned 0x0 [0046.460] lstrlenW (lpString=".bak") returned 4 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".bak") returned 0x0 [0046.460] lstrlenW (lpString=".bac") returned 4 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".bac") returned 0x0 [0046.460] lstrlenW (lpString=".sys") returned 4 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".sys") returned 0x0 [0046.460] lstrlenW (lpString=".v2i") returned 4 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".v2i") returned 0x0 [0046.460] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch="s\r\n.v2i") returned 0x0 [0046.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.486] lstrlenW (lpString=".sql") returned 4 [0046.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".sql") returned 0x0 [0046.486] lstrlenW (lpString=".mdf") returned 4 [0046.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".mdf") returned 0x0 [0046.486] lstrlenW (lpString=".txt") returned 4 [0046.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".txt") returned 0x0 [0046.486] lstrlenW (lpString=".dbf") returned 4 [0046.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".dbf") returned 0x0 [0046.489] lstrlenW (lpString=".ckp") returned 4 [0046.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".ckp") returned 0x0 [0046.489] lstrlenW (lpString=".dacpac") returned 7 [0046.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".dacpac") returned 0x0 [0046.497] lstrlenW (lpString=".db3") returned 4 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".db3") returned 0x0 [0046.497] lstrlenW (lpString=".dtxs") returned 5 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".dtxs") returned 0x0 [0046.497] lstrlenW (lpString=".mdt") returned 4 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".mdt") returned 0x0 [0046.497] lstrlenW (lpString=".sdf") returned 4 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".sdf") returned 0x0 [0046.497] lstrlenW (lpString=".MDF") returned 4 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".MDF") returned 0x0 [0046.497] lstrlenW (lpString=".DBF") returned 4 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".DBF") returned 0x0 [0046.497] lstrlenW (lpString=".DB") returned 3 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".DB") returned 0x0 [0046.497] lstrlenW (lpString=".db") returned 3 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".db") returned 0x0 [0046.497] lstrlenW (lpString=".ndf") returned 4 [0046.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".ndf") returned 0x0 [0046.498] lstrlenW (lpString=".NDF") returned 4 [0046.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".NDF") returned 0x0 [0046.509] lstrlenW (lpString=".Mdf") returned 4 [0046.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".Mdf") returned 0x0 [0046.509] lstrlenW (lpString=".dat") returned 4 [0046.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".dat") returned 0x0 [0046.509] lstrlenW (lpString=".DAT") returned 4 [0046.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".DAT") returned 0x0 [0046.509] lstrlenW (lpString=".ldf") returned 4 [0046.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".ldf") returned 0x0 [0046.510] lstrlenW (lpString=".LDF") returned 4 [0046.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch=".LDF") returned 0x0 [0046.510] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.510] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.511] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.511] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.511] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16651201084) returned 1 [0046.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa890e70, dwHighDateTime=0x1d585b4)) [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d79e8 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d79e8 | out: hHeap=0x260000) returned 1 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0046.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320050 [0046.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0046.511] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.511] GetLastError () returned 0x0 [0046.512] GetLastError () returned 0x0 [0046.512] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.512] GetLastError () returned 0x0 [0046.512] GetLastError () returned 0x0 [0046.516] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7aa8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.516] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x18558, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x18558, lpOverlapped=0x0) returned 1 [0046.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.516] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.516] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.516] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.517] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.517] CloseHandle (hObject=0x104) returned 1 [0046.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.[deadmin@cock.li].deadmin")) returned 1 [0046.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.518] GetLastError () returned 0x0 [0046.518] RtlWakeConditionVariable () returned 0x27e828 [0046.518] GetCurrentThreadId () returned 0x998 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".ldf") returned 0x0 [0046.518] lstrlenW (lpString=".vhd") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".vhd") returned 0x0 [0046.518] lstrlenW (lpString=".vhdx") returned 5 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".vhdx") returned 0x0 [0046.518] lstrlenW (lpString=".pst") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".pst") returned 0x0 [0046.518] lstrlenW (lpString=".ost") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".ost") returned 0x0 [0046.518] lstrlenW (lpString=".bak") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".bak") returned 0x0 [0046.518] lstrlenW (lpString=".bac") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".bac") returned 0x0 [0046.518] lstrlenW (lpString=".sys") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".sys") returned 0x0 [0046.518] lstrlenW (lpString=".v2i") returned 4 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".v2i") returned 0x0 [0046.518] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch="s\r\n.v2i") returned 0x0 [0046.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.519] lstrlenW (lpString=".sql") returned 4 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".sql") returned 0x0 [0046.519] lstrlenW (lpString=".mdf") returned 4 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".mdf") returned 0x0 [0046.519] lstrlenW (lpString=".txt") returned 4 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".txt") returned 0x0 [0046.519] lstrlenW (lpString=".dbf") returned 4 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".dbf") returned 0x0 [0046.519] lstrlenW (lpString=".ckp") returned 4 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".ckp") returned 0x0 [0046.519] lstrlenW (lpString=".dacpac") returned 7 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".dacpac") returned 0x0 [0046.519] lstrlenW (lpString=".db3") returned 4 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".db3") returned 0x0 [0046.519] lstrlenW (lpString=".dtxs") returned 5 [0046.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".dtxs") returned 0x0 [0046.519] lstrlenW (lpString=".mdt") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".mdt") returned 0x0 [0046.520] lstrlenW (lpString=".sdf") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".sdf") returned 0x0 [0046.520] lstrlenW (lpString=".MDF") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".MDF") returned 0x0 [0046.520] lstrlenW (lpString=".DBF") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".DBF") returned 0x0 [0046.520] lstrlenW (lpString=".DB") returned 3 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".DB") returned 0x0 [0046.520] lstrlenW (lpString=".db") returned 3 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".db") returned 0x0 [0046.520] lstrlenW (lpString=".ndf") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".ndf") returned 0x0 [0046.520] lstrlenW (lpString=".NDF") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".NDF") returned 0x0 [0046.520] lstrlenW (lpString=".Mdf") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".Mdf") returned 0x0 [0046.520] lstrlenW (lpString=".dat") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".dat") returned 0x0 [0046.520] lstrlenW (lpString=".DAT") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".DAT") returned 0x0 [0046.520] lstrlenW (lpString=".ldf") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".ldf") returned 0x0 [0046.520] lstrlenW (lpString=".LDF") returned 4 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch=".LDF") returned 0x0 [0046.520] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.520] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.521] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.521] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.521] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16652357368) returned 1 [0046.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa8b6fd0, dwHighDateTime=0x1d585b4)) [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a20 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a20 | out: hHeap=0x260000) returned 1 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.523] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.523] GetLastError () returned 0x0 [0046.523] GetLastError () returned 0x0 [0046.523] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.523] GetLastError () returned 0x0 [0046.523] GetLastError () returned 0x0 [0046.525] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc0b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.525] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x3f50, lpOverlapped=0x0) returned 1 [0046.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.525] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.525] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.526] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.526] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.526] CloseHandle (hObject=0x104) returned 1 [0046.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0046.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.[deadmin@cock.li].deadmin")) returned 1 [0046.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.527] GetLastError () returned 0x0 [0046.527] RtlWakeConditionVariable () returned 0x27e828 [0046.527] GetCurrentThreadId () returned 0x998 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".ldf") returned 0x0 [0046.527] lstrlenW (lpString=".vhd") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".vhd") returned 0x0 [0046.527] lstrlenW (lpString=".vhdx") returned 5 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".vhdx") returned 0x0 [0046.527] lstrlenW (lpString=".pst") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".pst") returned 0x0 [0046.527] lstrlenW (lpString=".ost") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".ost") returned 0x0 [0046.527] lstrlenW (lpString=".bak") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".bak") returned 0x0 [0046.527] lstrlenW (lpString=".bac") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".bac") returned 0x0 [0046.527] lstrlenW (lpString=".sys") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".sys") returned 0x0 [0046.527] lstrlenW (lpString=".v2i") returned 4 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".v2i") returned 0x0 [0046.527] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch="s\r\n.v2i") returned 0x0 [0046.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.528] lstrlenW (lpString=".sql") returned 4 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".sql") returned 0x0 [0046.528] lstrlenW (lpString=".mdf") returned 4 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".mdf") returned 0x0 [0046.528] lstrlenW (lpString=".txt") returned 4 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".txt") returned 0x0 [0046.528] lstrlenW (lpString=".dbf") returned 4 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".dbf") returned 0x0 [0046.528] lstrlenW (lpString=".ckp") returned 4 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".ckp") returned 0x0 [0046.528] lstrlenW (lpString=".dacpac") returned 7 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".dacpac") returned 0x0 [0046.528] lstrlenW (lpString=".db3") returned 4 [0046.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".db3") returned 0x0 [0046.529] lstrlenW (lpString=".dtxs") returned 5 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".dtxs") returned 0x0 [0046.529] lstrlenW (lpString=".mdt") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".mdt") returned 0x0 [0046.529] lstrlenW (lpString=".sdf") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".sdf") returned 0x0 [0046.529] lstrlenW (lpString=".MDF") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".MDF") returned 0x0 [0046.529] lstrlenW (lpString=".DBF") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".DBF") returned 0x0 [0046.529] lstrlenW (lpString=".DB") returned 3 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".DB") returned 0x0 [0046.529] lstrlenW (lpString=".db") returned 3 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".db") returned 0x0 [0046.529] lstrlenW (lpString=".ndf") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".ndf") returned 0x0 [0046.529] lstrlenW (lpString=".NDF") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".NDF") returned 0x0 [0046.529] lstrlenW (lpString=".Mdf") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".Mdf") returned 0x0 [0046.529] lstrlenW (lpString=".dat") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".dat") returned 0x0 [0046.529] lstrlenW (lpString=".DAT") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".DAT") returned 0x0 [0046.529] lstrlenW (lpString=".ldf") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".ldf") returned 0x0 [0046.529] lstrlenW (lpString=".LDF") returned 4 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch=".LDF") returned 0x0 [0046.529] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.529] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.530] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.530] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.530] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16653151185) returned 1 [0046.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa8b6fd0, dwHighDateTime=0x1d585b4)) [0046.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a58 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a58 | out: hHeap=0x260000) returned 1 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0046.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.531] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.531] GetLastError () returned 0x0 [0046.531] GetLastError () returned 0x0 [0046.531] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.531] GetLastError () returned 0x0 [0046.531] GetLastError () returned 0x0 [0046.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffaab0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.533] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x5550, lpOverlapped=0x0) returned 1 [0046.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.533] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.533] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.533] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.533] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.533] CloseHandle (hObject=0x104) returned 1 [0046.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0046.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.[deadmin@cock.li].deadmin")) returned 1 [0046.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.591] GetLastError () returned 0x0 [0046.591] RtlWakeConditionVariable () returned 0x27e828 [0046.591] GetCurrentThreadId () returned 0x998 [0046.592] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.592] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.592] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.592] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.593] CloseHandle (hObject=0x104) returned 1 [0046.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315cc8 | out: hHeap=0x260000) returned 1 [0046.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.593] RtlWakeConditionVariable () returned 0x27e828 [0046.593] GetCurrentThreadId () returned 0x998 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".ldf") returned 0x0 [0046.593] lstrlenW (lpString=".vhd") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".vhd") returned 0x0 [0046.593] lstrlenW (lpString=".vhdx") returned 5 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".vhdx") returned 0x0 [0046.593] lstrlenW (lpString=".pst") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".pst") returned 0x0 [0046.593] lstrlenW (lpString=".ost") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".ost") returned 0x0 [0046.593] lstrlenW (lpString=".bak") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".bak") returned 0x0 [0046.593] lstrlenW (lpString=".bac") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".bac") returned 0x0 [0046.593] lstrlenW (lpString=".sys") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".sys") returned 0x0 [0046.593] lstrlenW (lpString=".v2i") returned 4 [0046.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".v2i") returned 0x0 [0046.593] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.594] lstrlenW (lpString=".sql") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".sql") returned 0x0 [0046.594] lstrlenW (lpString=".mdf") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".mdf") returned 0x0 [0046.594] lstrlenW (lpString=".txt") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".txt") returned 0x0 [0046.594] lstrlenW (lpString=".dbf") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".dbf") returned 0x0 [0046.594] lstrlenW (lpString=".ckp") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".ckp") returned 0x0 [0046.594] lstrlenW (lpString=".dacpac") returned 7 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".dacpac") returned 0x0 [0046.594] lstrlenW (lpString=".db3") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".db3") returned 0x0 [0046.594] lstrlenW (lpString=".dtxs") returned 5 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".dtxs") returned 0x0 [0046.594] lstrlenW (lpString=".mdt") returned 4 [0046.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".mdt") returned 0x0 [0046.594] lstrlenW (lpString=".sdf") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".sdf") returned 0x0 [0046.595] lstrlenW (lpString=".MDF") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".MDF") returned 0x0 [0046.595] lstrlenW (lpString=".DBF") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".DBF") returned 0x0 [0046.595] lstrlenW (lpString=".DB") returned 3 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".DB") returned 0x0 [0046.595] lstrlenW (lpString=".db") returned 3 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".db") returned 0x0 [0046.595] lstrlenW (lpString=".ndf") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".ndf") returned 0x0 [0046.595] lstrlenW (lpString=".NDF") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".NDF") returned 0x0 [0046.595] lstrlenW (lpString=".Mdf") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".Mdf") returned 0x0 [0046.595] lstrlenW (lpString=".dat") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".dat") returned 0x0 [0046.595] lstrlenW (lpString=".DAT") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".DAT") returned 0x0 [0046.595] lstrlenW (lpString=".ldf") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".ldf") returned 0x0 [0046.595] lstrlenW (lpString=".LDF") returned 4 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch=".LDF") returned 0x0 [0046.595] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.595] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.596] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.596] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16659742183) returned 1 [0046.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa94f550, dwHighDateTime=0x1d585b4)) [0046.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7f10 [0046.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f10 | out: hHeap=0x260000) returned 1 [0046.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320050 [0046.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.597] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.597] GetLastError () returned 0x0 [0046.597] GetLastError () returned 0x0 [0046.597] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.597] GetLastError () returned 0x0 [0046.597] GetLastError () returned 0x0 [0046.602] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.602] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.603] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.603] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.604] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.604] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.604] CloseHandle (hObject=0x104) returned 1 [0046.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x298fd0 [0046.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0046.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.605] GetLastError () returned 0x0 [0046.605] RtlWakeConditionVariable () returned 0x27e828 [0046.605] GetCurrentThreadId () returned 0x998 [0046.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".ldf") returned 0x0 [0046.605] lstrlenW (lpString=".vhd") returned 4 [0046.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".vhd") returned 0x0 [0046.605] lstrlenW (lpString=".vhdx") returned 5 [0046.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".vhdx") returned 0x0 [0046.605] lstrlenW (lpString=".pst") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".pst") returned 0x0 [0046.606] lstrlenW (lpString=".ost") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".ost") returned 0x0 [0046.606] lstrlenW (lpString=".bak") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".bak") returned 0x0 [0046.606] lstrlenW (lpString=".bac") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".bac") returned 0x0 [0046.606] lstrlenW (lpString=".sys") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".sys") returned 0x0 [0046.606] lstrlenW (lpString=".v2i") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".v2i") returned 0x0 [0046.606] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.606] lstrlenW (lpString=".sql") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".sql") returned 0x0 [0046.606] lstrlenW (lpString=".mdf") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".mdf") returned 0x0 [0046.606] lstrlenW (lpString=".txt") returned 4 [0046.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".txt") returned 0x0 [0046.607] lstrlenW (lpString=".dbf") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".dbf") returned 0x0 [0046.607] lstrlenW (lpString=".ckp") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".ckp") returned 0x0 [0046.607] lstrlenW (lpString=".dacpac") returned 7 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".dacpac") returned 0x0 [0046.607] lstrlenW (lpString=".db3") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".db3") returned 0x0 [0046.607] lstrlenW (lpString=".dtxs") returned 5 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".dtxs") returned 0x0 [0046.607] lstrlenW (lpString=".mdt") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".mdt") returned 0x0 [0046.607] lstrlenW (lpString=".sdf") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".sdf") returned 0x0 [0046.607] lstrlenW (lpString=".MDF") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".MDF") returned 0x0 [0046.607] lstrlenW (lpString=".DBF") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".DBF") returned 0x0 [0046.607] lstrlenW (lpString=".DB") returned 3 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".DB") returned 0x0 [0046.607] lstrlenW (lpString=".db") returned 3 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".db") returned 0x0 [0046.607] lstrlenW (lpString=".ndf") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".ndf") returned 0x0 [0046.607] lstrlenW (lpString=".NDF") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".NDF") returned 0x0 [0046.607] lstrlenW (lpString=".Mdf") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".Mdf") returned 0x0 [0046.607] lstrlenW (lpString=".dat") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".dat") returned 0x0 [0046.607] lstrlenW (lpString=".DAT") returned 4 [0046.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".DAT") returned 0x0 [0046.607] lstrlenW (lpString=".ldf") returned 4 [0046.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".ldf") returned 0x0 [0046.608] lstrlenW (lpString=".LDF") returned 4 [0046.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch=".LDF") returned 0x0 [0046.608] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.608] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0046.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.608] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.609] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16660975780) returned 1 [0046.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaa9756b0, dwHighDateTime=0x1d585b4)) [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7f48 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f48 | out: hHeap=0x260000) returned 1 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320050 [0046.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.609] GetLastError () returned 0x0 [0046.609] GetLastError () returned 0x0 [0046.609] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.610] GetLastError () returned 0x0 [0046.610] GetLastError () returned 0x0 [0046.612] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.612] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.614] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.614] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.616] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.616] CloseHandle (hObject=0x104) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x298fd0 [0046.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0046.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.686] GetLastError () returned 0x0 [0046.686] RtlWakeConditionVariable () returned 0x27e828 [0046.686] GetCurrentThreadId () returned 0x998 [0046.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".ldf") returned 0x0 [0046.686] lstrlenW (lpString=".vhd") returned 4 [0046.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".vhd") returned 0x0 [0046.686] lstrlenW (lpString=".vhdx") returned 5 [0046.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".vhdx") returned 0x0 [0046.686] lstrlenW (lpString=".pst") returned 4 [0046.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".pst") returned 0x0 [0046.686] lstrlenW (lpString=".ost") returned 4 [0046.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".ost") returned 0x0 [0046.686] lstrlenW (lpString=".bak") returned 4 [0046.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".bak") returned 0x0 [0046.687] lstrlenW (lpString=".bac") returned 4 [0046.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".bac") returned 0x0 [0046.687] lstrlenW (lpString=".sys") returned 4 [0046.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".sys") returned 0x0 [0046.687] lstrlenW (lpString=".v2i") returned 4 [0046.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch=".v2i") returned 0x0 [0046.687] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpSrch="s\r\n.v2i") returned 0x0 [0046.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310da0 | out: hHeap=0x260000) returned 1 [0046.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310c08 | out: hHeap=0x260000) returned 1 [0046.694] RtlWakeConditionVariable () returned 0x27e828 [0046.694] GetCurrentThreadId () returned 0x998 [0046.766] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.766] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.767] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.767] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.768] CloseHandle (hObject=0x104) returned 1 [0046.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296e48 | out: hHeap=0x260000) returned 1 [0046.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329180 | out: hHeap=0x260000) returned 1 [0046.768] RtlWakeConditionVariable () returned 0x27e828 [0046.768] GetCurrentThreadId () returned 0x998 [0046.768] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.768] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.768] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.768] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.769] CloseHandle (hObject=0x104) returned 1 [0046.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312610 | out: hHeap=0x260000) returned 1 [0046.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x311488 | out: hHeap=0x260000) returned 1 [0046.769] RtlWakeConditionVariable () returned 0x27e828 [0046.770] GetCurrentThreadId () returned 0x998 [0046.770] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0046.770] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.770] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0046.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0046.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.771] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16677281950) returned 1 [0046.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaab185d0, dwHighDateTime=0x1d585b4)) [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8338 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8338 | out: hHeap=0x260000) returned 1 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0046.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e228 [0046.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0046.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329180 [0046.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e228 | out: hHeap=0x260000) returned 1 [0046.772] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0046.772] GetLastError () returned 0x0 [0046.772] GetLastError () returned 0x0 [0046.773] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0046.773] GetLastError () returned 0x0 [0046.773] GetLastError () returned 0x0 [0046.774] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.774] WriteFile (in: hFile=0x104, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x1cffdb0*=0xae, lpOverlapped=0x0) returned 1 [0046.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.774] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.774] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.774] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.774] CloseHandle (hObject=0x104) returned 1 [0046.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0046.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\desktop.ini.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\desktop.ini.[deadmin@cock.li].deadmin")) returned 1 [0046.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x311488 | out: hHeap=0x260000) returned 1 [0046.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0046.798] GetLastError () returned 0x0 [0047.197] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.197] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.197] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.197] WriteFile (in: hFile=0xf8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.199] CloseHandle (hObject=0xf8) returned 1 [0047.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b290 | out: hHeap=0x260000) returned 1 [0047.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef280 | out: hHeap=0x260000) returned 1 [0047.199] RtlWakeConditionVariable () returned 0x27e828 [0047.199] GetCurrentThreadId () returned 0x998 [0047.261] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.261] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.261] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.261] WriteFile (in: hFile=0xf8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.262] CloseHandle (hObject=0xf8) returned 1 [0047.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ca48 | out: hHeap=0x260000) returned 1 [0047.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0047.263] RtlWakeConditionVariable () returned 0x27e828 [0047.263] GetCurrentThreadId () returned 0x998 [0047.297] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.297] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.297] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.297] WriteFile (in: hFile=0xf8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.298] CloseHandle (hObject=0xf8) returned 1 [0047.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x333898 | out: hHeap=0x260000) returned 1 [0047.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0047.298] RtlWakeConditionVariable () returned 0x27e828 [0047.298] GetCurrentThreadId () returned 0x998 [0047.312] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.312] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.312] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.312] WriteFile (in: hFile=0x104, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.313] CloseHandle (hObject=0x104) returned 1 [0047.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a230 | out: hHeap=0x260000) returned 1 [0047.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.314] RtlWakeConditionVariable () returned 0x27e828 [0047.314] GetCurrentThreadId () returned 0x998 [0047.350] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.351] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.351] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16735215184) returned 1 [0047.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab0998b0, dwHighDateTime=0x1d585b4)) [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3371e8 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3371e8 | out: hHeap=0x260000) returned 1 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.352] GetLastError () returned 0x0 [0047.352] GetLastError () returned 0x0 [0047.352] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.352] GetLastError () returned 0x0 [0047.352] GetLastError () returned 0x0 [0047.360] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff871c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.360] WriteFile (in: hFile=0x100, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x78e4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x78e4, lpOverlapped=0x0) returned 1 [0047.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0047.361] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.361] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.361] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.361] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.361] CloseHandle (hObject=0x100) returned 1 [0047.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30dbd8 [0047.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dbd8 | out: hHeap=0x260000) returned 1 [0047.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.377] GetLastError () returned 0x0 [0047.377] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.378] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.378] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.378] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16738253181) returned 1 [0047.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab0e5b70, dwHighDateTime=0x1d585b4)) [0047.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337300 [0047.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337300 | out: hHeap=0x260000) returned 1 [0047.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.387] GetLastError () returned 0x0 [0047.387] GetLastError () returned 0x0 [0047.387] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.387] GetLastError () returned 0x0 [0047.387] GetLastError () returned 0x0 [0047.392] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.392] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0047.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.394] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.394] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.398] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.398] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.399] CloseHandle (hObject=0xf8) returned 1 [0047.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0047.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.[deadmin@cock.li].deadmin")) returned 1 [0047.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0047.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.399] GetLastError () returned 0x0 [0047.400] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.400] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.400] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.401] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16740168215) returned 1 [0047.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab10bcd0, dwHighDateTime=0x1d585b4)) [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337370 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337370 | out: hHeap=0x260000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a230 [0047.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a230 | out: hHeap=0x260000) returned 1 [0047.401] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.401] GetLastError () returned 0x0 [0047.401] GetLastError () returned 0x0 [0047.401] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.401] GetLastError () returned 0x0 [0047.401] GetLastError () returned 0x0 [0047.461] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.461] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0047.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0047.462] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.462] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.466] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.466] CloseHandle (hObject=0xf8) returned 1 [0047.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0047.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.[deadmin@cock.li].deadmin")) returned 1 [0047.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0047.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.523] GetLastError () returned 0x0 [0047.578] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.579] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.579] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.579] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16758013710) returned 1 [0047.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab2aebf0, dwHighDateTime=0x1d585b4)) [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db7c8 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db7c8 | out: hHeap=0x260000) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332998 [0047.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.579] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.580] GetLastError () returned 0x0 [0047.580] GetLastError () returned 0x0 [0047.580] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.580] GetLastError () returned 0x0 [0047.580] GetLastError () returned 0x0 [0047.582] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc434, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.582] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3bcc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3bcc, lpOverlapped=0x0) returned 1 [0047.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.582] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.582] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.582] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.582] CloseHandle (hObject=0x100) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.610] GetLastError () returned 0x0 [0047.610] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.611] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.611] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.611] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16761196168) returned 1 [0047.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab2faeb0, dwHighDateTime=0x1d585b4)) [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d74a8 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d74a8 | out: hHeap=0x260000) returned 1 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316df8 [0047.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.612] GetLastError () returned 0x0 [0047.612] GetLastError () returned 0x0 [0047.612] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.612] GetLastError () returned 0x0 [0047.612] GetLastError () returned 0x0 [0047.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff082, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.615] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xf7e, lpOverlapped=0x0) returned 1 [0047.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.615] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.615] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.615] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.615] CloseHandle (hObject=0xf0) returned 1 [0047.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.616] GetLastError () returned 0x0 [0047.616] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.617] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.617] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16761817998) returned 1 [0047.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab321010, dwHighDateTime=0x1d585b4)) [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7470 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ec20 [0047.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.618] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.618] GetLastError () returned 0x0 [0047.618] GetLastError () returned 0x0 [0047.618] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.618] GetLastError () returned 0x0 [0047.618] GetLastError () returned 0x0 [0047.619] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.619] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xd32, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd32, lpOverlapped=0x0) returned 1 [0047.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.620] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.620] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.620] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.620] CloseHandle (hObject=0xf0) returned 1 [0047.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.621] GetLastError () returned 0x0 [0047.621] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.622] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.622] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.622] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16762320554) returned 1 [0047.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab321010, dwHighDateTime=0x1d585b4)) [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8258 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8258 | out: hHeap=0x260000) returned 1 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316df8 [0047.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.623] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.623] GetLastError () returned 0x0 [0047.623] GetLastError () returned 0x0 [0047.623] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.623] GetLastError () returned 0x0 [0047.623] GetLastError () returned 0x0 [0047.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff3d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.624] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc30, lpOverlapped=0x0) returned 1 [0047.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.625] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.625] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.625] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.625] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.625] CloseHandle (hObject=0xf0) returned 1 [0047.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.626] GetLastError () returned 0x0 [0047.626] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.627] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.627] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.627] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16762845249) returned 1 [0047.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab347170, dwHighDateTime=0x1d585b4)) [0047.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294fc8 [0047.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0047.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296300 [0047.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.628] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.628] GetLastError () returned 0x0 [0047.628] GetLastError () returned 0x0 [0047.628] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.628] GetLastError () returned 0x0 [0047.628] GetLastError () returned 0x0 [0047.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff42e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.630] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xbd2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xbd2, lpOverlapped=0x0) returned 1 [0047.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.630] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.630] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.630] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.631] CloseHandle (hObject=0xf0) returned 1 [0047.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.631] GetLastError () returned 0x0 [0047.632] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.632] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0047.632] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0047.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.632] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16763350368) returned 1 [0047.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab347170, dwHighDateTime=0x1d585b4)) [0047.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f90 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f90 | out: hHeap=0x260000) returned 1 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ecb8 [0047.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.633] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.633] GetLastError () returned 0x0 [0047.633] GetLastError () returned 0x0 [0047.633] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.633] GetLastError () returned 0x0 [0047.633] GetLastError () returned 0x0 [0047.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffed82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.664] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x127e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x127e, lpOverlapped=0x0) returned 1 [0047.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.664] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.664] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.664] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.664] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.664] CloseHandle (hObject=0xf0) returned 1 [0047.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.672] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.899] GetLastError () returned 0x0 [0047.899] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.900] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.900] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.900] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16790140533) returned 1 [0047.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab5ce8d0, dwHighDateTime=0x1d585b4)) [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0838 [0047.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0838 | out: hHeap=0x260000) returned 1 [0047.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ed50 [0047.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.901] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.901] GetLastError () returned 0x0 [0047.901] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.901] GetLastError () returned 0x0 [0047.904] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe184, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.904] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1e7c, lpOverlapped=0x0) returned 1 [0047.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.905] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.905] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.906] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.906] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.906] CloseHandle (hObject=0xf0) returned 1 [0047.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.907] GetLastError () returned 0x0 [0047.907] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.908] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.908] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.908] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16790933199) returned 1 [0047.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab5f4a30, dwHighDateTime=0x1d585b4)) [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a90 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a90 | out: hHeap=0x260000) returned 1 [0047.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ffb8 [0047.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.909] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.909] GetLastError () returned 0x0 [0047.909] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.909] GetLastError () returned 0x0 [0047.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff820, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.912] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x7e0, lpOverlapped=0x0) returned 1 [0047.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.912] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.912] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.912] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.912] CloseHandle (hObject=0xf0) returned 1 [0047.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.913] GetLastError () returned 0x0 [0047.914] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.914] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.915] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.915] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16791579345) returned 1 [0047.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab5f4a30, dwHighDateTime=0x1d585b4)) [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a58 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a58 | out: hHeap=0x260000) returned 1 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0047.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.915] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.915] GetLastError () returned 0x0 [0047.915] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.915] GetLastError () returned 0x0 [0047.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff644, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.917] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x9bc, lpOverlapped=0x0) returned 1 [0047.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.917] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.917] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.917] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.917] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.917] CloseHandle (hObject=0xf0) returned 1 [0047.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.918] GetLastError () returned 0x0 [0047.918] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.919] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.919] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.919] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16792029578) returned 1 [0047.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab5f4a30, dwHighDateTime=0x1d585b4)) [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a20 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a20 | out: hHeap=0x260000) returned 1 [0047.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320218 [0047.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.920] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.920] GetLastError () returned 0x0 [0047.920] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.920] GetLastError () returned 0x0 [0047.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.921] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd14, lpOverlapped=0x0) returned 1 [0047.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.922] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.922] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.922] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.922] CloseHandle (hObject=0xf0) returned 1 [0047.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.923] GetLastError () returned 0x0 [0047.923] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.924] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.924] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.924] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16792546265) returned 1 [0047.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab61ab90, dwHighDateTime=0x1d585b4)) [0047.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d79e8 [0047.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d79e8 | out: hHeap=0x260000) returned 1 [0047.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3202b0 [0047.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.925] GetLastError () returned 0x0 [0047.925] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.925] GetLastError () returned 0x0 [0047.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffef38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.926] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x10c8, lpOverlapped=0x0) returned 1 [0047.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.927] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.927] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.927] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.927] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.927] CloseHandle (hObject=0xf0) returned 1 [0047.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0047.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0047.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.928] GetLastError () returned 0x0 [0047.928] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.929] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.929] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.929] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16793040562) returned 1 [0047.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab61ab90, dwHighDateTime=0x1d585b4)) [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d79b0 [0047.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d79b0 | out: hHeap=0x260000) returned 1 [0047.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0047.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.930] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0047.930] GetLastError () returned 0x0 [0047.930] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0047.930] GetLastError () returned 0x0 [0047.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff364, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.940] WriteFile (in: hFile=0xf0, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc9c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc9c, lpOverlapped=0x0) returned 1 [0047.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.942] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.942] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.942] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.942] CloseHandle (hObject=0xf0) returned 1 [0047.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.995] GetLastError () returned 0x0 [0047.995] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0047.996] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.996] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.996] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16799803284) returned 1 [0047.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab6b3110, dwHighDateTime=0x1d585b4)) [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0aa0 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0aa0 | out: hHeap=0x260000) returned 1 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320af0 [0048.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.003] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.003] GetLastError () returned 0x0 [0048.003] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.003] GetLastError () returned 0x0 [0048.006] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc110, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.006] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x3ef0, lpOverlapped=0x0) returned 1 [0048.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.007] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.007] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.007] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.007] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.007] CloseHandle (hObject=0x10c) returned 1 [0048.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.008] GetLastError () returned 0x0 [0048.009] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.010] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.010] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.010] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16801112765) returned 1 [0048.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab6d9270, dwHighDateTime=0x1d585b4)) [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0ad8 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0ad8 | out: hHeap=0x260000) returned 1 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320b88 [0048.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.010] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.011] GetLastError () returned 0x0 [0048.011] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.011] GetLastError () returned 0x0 [0048.017] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9784, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.017] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x687c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x687c, lpOverlapped=0x0) returned 1 [0048.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.018] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.018] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.018] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.018] CloseHandle (hObject=0x10c) returned 1 [0048.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.019] GetLastError () returned 0x0 [0048.020] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.021] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.021] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.021] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16802193793) returned 1 [0048.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab6ff3d0, dwHighDateTime=0x1d585b4)) [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b48 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b48 | out: hHeap=0x260000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320cb8 [0048.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.021] GetLastError () returned 0x0 [0048.022] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.022] GetLastError () returned 0x0 [0048.024] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff01e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.024] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xfe2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xfe2, lpOverlapped=0x0) returned 1 [0048.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.026] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.026] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.026] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.026] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.027] CloseHandle (hObject=0x10c) returned 1 [0048.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.027] GetLastError () returned 0x0 [0048.027] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.028] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.028] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.028] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16802948897) returned 1 [0048.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab6ff3d0, dwHighDateTime=0x1d585b4)) [0048.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b80 [0048.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b80 | out: hHeap=0x260000) returned 1 [0048.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320de8 [0048.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.029] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.029] GetLastError () returned 0x0 [0048.029] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.029] GetLastError () returned 0x0 [0048.032] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffa100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.032] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5f00, lpOverlapped=0x0) returned 1 [0048.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.032] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.032] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.032] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.033] CloseHandle (hObject=0x10c) returned 1 [0048.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.033] GetLastError () returned 0x0 [0048.034] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.034] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.034] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16803550441) returned 1 [0048.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab725530, dwHighDateTime=0x1d585b4)) [0048.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0bb8 [0048.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0bb8 | out: hHeap=0x260000) returned 1 [0048.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320e80 [0048.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.035] GetLastError () returned 0x0 [0048.035] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.035] GetLastError () returned 0x0 [0048.142] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9f36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.142] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x60ca, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x60ca, lpOverlapped=0x0) returned 1 [0048.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.143] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.143] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.143] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.143] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.144] CloseHandle (hObject=0x10c) returned 1 [0048.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.144] GetLastError () returned 0x0 [0048.145] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.145] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.145] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.146] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16814673596) returned 1 [0048.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab82fed0, dwHighDateTime=0x1d585b4)) [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f00 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f00 | out: hHeap=0x260000) returned 1 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320f18 [0048.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.146] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.146] GetLastError () returned 0x0 [0048.146] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.146] GetLastError () returned 0x0 [0048.149] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffc0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.149] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3f4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3f4, lpOverlapped=0x0) returned 1 [0048.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.149] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.149] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.150] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.150] CloseHandle (hObject=0x10c) returned 1 [0048.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.150] GetLastError () returned 0x0 [0048.151] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.152] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.152] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.152] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16815319754) returned 1 [0048.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab82fed0, dwHighDateTime=0x1d585b4)) [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f38 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f38 | out: hHeap=0x260000) returned 1 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321af8 [0048.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.153] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.153] GetLastError () returned 0x0 [0048.153] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.153] GetLastError () returned 0x0 [0048.154] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffc90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.154] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x370, lpOverlapped=0x0) returned 1 [0048.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.154] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.155] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.155] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.155] CloseHandle (hObject=0x10c) returned 1 [0048.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.156] GetLastError () returned 0x0 [0048.156] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.157] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.157] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.157] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16815822646) returned 1 [0048.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab856030, dwHighDateTime=0x1d585b4)) [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f70 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f70 | out: hHeap=0x260000) returned 1 [0048.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321b90 [0048.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.158] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.158] GetLastError () returned 0x0 [0048.158] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.158] GetLastError () returned 0x0 [0048.159] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd85e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.159] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x27a2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x27a2, lpOverlapped=0x0) returned 1 [0048.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.160] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.160] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.160] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.160] CloseHandle (hObject=0x10c) returned 1 [0048.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.161] GetLastError () returned 0x0 [0048.161] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.162] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.162] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16816296840) returned 1 [0048.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab856030, dwHighDateTime=0x1d585b4)) [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0fa8 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0fa8 | out: hHeap=0x260000) returned 1 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0048.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.162] GetLastError () returned 0x0 [0048.163] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.163] GetLastError () returned 0x0 [0048.164] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffa48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.164] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5b8, lpOverlapped=0x0) returned 1 [0048.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.164] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.164] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.164] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.164] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.165] CloseHandle (hObject=0x10c) returned 1 [0048.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.165] GetLastError () returned 0x0 [0048.166] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.166] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.166] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.166] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16816749589) returned 1 [0048.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab856030, dwHighDateTime=0x1d585b4)) [0048.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0fe0 [0048.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0fe0 | out: hHeap=0x260000) returned 1 [0048.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0048.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.167] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.167] GetLastError () returned 0x0 [0048.167] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.167] GetLastError () returned 0x0 [0048.168] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff960, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.168] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x6a0, lpOverlapped=0x0) returned 1 [0048.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.169] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.169] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.169] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.169] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.169] CloseHandle (hObject=0x10c) returned 1 [0048.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.170] GetLastError () returned 0x0 [0048.170] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.171] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.171] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.171] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16817228179) returned 1 [0048.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab856030, dwHighDateTime=0x1d585b4)) [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1018 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1018 | out: hHeap=0x260000) returned 1 [0048.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321d58 [0048.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.172] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.172] GetLastError () returned 0x0 [0048.172] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.172] GetLastError () returned 0x0 [0048.174] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffa14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.174] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5ec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5ec, lpOverlapped=0x0) returned 1 [0048.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.174] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.174] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.174] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.174] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.174] CloseHandle (hObject=0x10c) returned 1 [0048.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.175] GetLastError () returned 0x0 [0048.175] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.176] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.176] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.176] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16817733031) returned 1 [0048.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab87c190, dwHighDateTime=0x1d585b4)) [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1050 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1050 | out: hHeap=0x260000) returned 1 [0048.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321df0 [0048.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.177] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.177] GetLastError () returned 0x0 [0048.177] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.177] GetLastError () returned 0x0 [0048.186] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff06e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.186] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xf92, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xf92, lpOverlapped=0x0) returned 1 [0048.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.188] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.188] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.191] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.191] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.191] CloseHandle (hObject=0x10c) returned 1 [0048.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.214] GetLastError () returned 0x0 [0048.215] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.215] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.215] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.215] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16821663809) returned 1 [0048.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab8c8450, dwHighDateTime=0x1d585b4)) [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1168 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1168 | out: hHeap=0x260000) returned 1 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321e88 [0048.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.216] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.216] GetLastError () returned 0x0 [0048.216] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.216] GetLastError () returned 0x0 [0048.278] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffa00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.278] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x600, lpOverlapped=0x0) returned 1 [0048.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.278] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.278] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.278] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.278] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.278] CloseHandle (hObject=0x104) returned 1 [0048.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.279] GetLastError () returned 0x0 [0048.279] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.280] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.280] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.280] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16828125831) returned 1 [0048.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9609d0, dwHighDateTime=0x1d585b4)) [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1398 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1398 | out: hHeap=0x260000) returned 1 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322180 [0048.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.281] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.281] GetLastError () returned 0x0 [0048.281] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.281] GetLastError () returned 0x0 [0048.289] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffefbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.289] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1044, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1044, lpOverlapped=0x0) returned 1 [0048.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.289] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.289] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.290] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.290] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.290] CloseHandle (hObject=0x104) returned 1 [0048.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.313] GetLastError () returned 0x0 [0048.314] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.314] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.314] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.315] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16831570413) returned 1 [0048.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9d2df0, dwHighDateTime=0x1d585b4)) [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7f10 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f10 | out: hHeap=0x260000) returned 1 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354308 [0048.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.315] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.315] GetLastError () returned 0x0 [0048.315] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.315] GetLastError () returned 0x0 [0048.319] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd314, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.320] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2cec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x2cec, lpOverlapped=0x0) returned 1 [0048.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.320] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.320] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.320] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.320] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.320] CloseHandle (hObject=0x104) returned 1 [0048.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.320] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.323] GetLastError () returned 0x0 [0048.323] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.323] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.324] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16832471976) returned 1 [0048.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9d2df0, dwHighDateTime=0x1d585b4)) [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8470 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8470 | out: hHeap=0x260000) returned 1 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fc28 [0048.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.324] GetLastError () returned 0x0 [0048.324] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.324] GetLastError () returned 0x0 [0048.326] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe790, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.326] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1870, lpOverlapped=0x0) returned 1 [0048.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.326] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.326] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.326] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.327] CloseHandle (hObject=0x104) returned 1 [0048.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.327] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.327] GetLastError () returned 0x0 [0048.328] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.328] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.328] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.328] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16832958033) returned 1 [0048.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9d2df0, dwHighDateTime=0x1d585b4)) [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d84a8 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d84a8 | out: hHeap=0x260000) returned 1 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354308 [0048.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.329] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.329] GetLastError () returned 0x0 [0048.329] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.329] GetLastError () returned 0x0 [0048.331] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb3ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.331] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4c14, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x4c14, lpOverlapped=0x0) returned 1 [0048.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.331] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.331] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.331] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.332] CloseHandle (hObject=0x104) returned 1 [0048.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.332] GetLastError () returned 0x0 [0048.333] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.333] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.334] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16833464384) returned 1 [0048.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9f8f50, dwHighDateTime=0x1d585b4)) [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d84e0 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d84e0 | out: hHeap=0x260000) returned 1 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322af0 [0048.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.334] GetLastError () returned 0x0 [0048.334] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.334] GetLastError () returned 0x0 [0048.336] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff148, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.336] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xeb8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xeb8, lpOverlapped=0x0) returned 1 [0048.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.336] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.336] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.336] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.336] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.336] CloseHandle (hObject=0x104) returned 1 [0048.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.337] GetLastError () returned 0x0 [0048.338] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312940) returned 1 [0048.338] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.338] CryptReleaseContext (hProv=0x312940, dwFlags=0x0) returned 1 [0048.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.338] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16833952044) returned 1 [0048.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9f8f50, dwHighDateTime=0x1d585b4)) [0048.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8518 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8518 | out: hHeap=0x260000) returned 1 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332440 [0048.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.339] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.339] GetLastError () returned 0x0 [0048.339] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.339] GetLastError () returned 0x0 [0048.340] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff2ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.341] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xd16, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xd16, lpOverlapped=0x0) returned 1 [0048.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.341] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.341] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.341] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.341] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.341] CloseHandle (hObject=0x104) returned 1 [0048.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.342] GetLastError () returned 0x0 [0048.342] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.343] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.343] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16834416690) returned 1 [0048.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xab9f8f50, dwHighDateTime=0x1d585b4)) [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8550 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8550 | out: hHeap=0x260000) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322b88 [0048.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.344] GetLastError () returned 0x0 [0048.344] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.344] GetLastError () returned 0x0 [0048.439] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff8eb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.439] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x714c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x714c, lpOverlapped=0x0) returned 1 [0048.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.439] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.439] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.440] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.440] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.440] CloseHandle (hObject=0x104) returned 1 [0048.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.441] GetLastError () returned 0x0 [0048.441] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.442] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.442] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.442] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16844292136) returned 1 [0048.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb038f0, dwHighDateTime=0x1d585b4)) [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8940 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8940 | out: hHeap=0x260000) returned 1 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322c20 [0048.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.442] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.442] GetLastError () returned 0x0 [0048.442] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.443] GetLastError () returned 0x0 [0048.444] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff974, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.444] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x68c, lpOverlapped=0x0) returned 1 [0048.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.444] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.444] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.444] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.444] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.445] CloseHandle (hObject=0x104) returned 1 [0048.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.445] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.445] GetLastError () returned 0x0 [0048.446] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.447] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.447] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.447] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16844820747) returned 1 [0048.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb038f0, dwHighDateTime=0x1d585b4)) [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8978 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8978 | out: hHeap=0x260000) returned 1 [0048.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3236d0 [0048.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.448] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.448] GetLastError () returned 0x0 [0048.448] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.448] GetLastError () returned 0x0 [0048.450] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.450] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xf38, lpOverlapped=0x0) returned 1 [0048.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.450] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.450] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.450] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.450] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.450] CloseHandle (hObject=0x104) returned 1 [0048.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.453] GetLastError () returned 0x0 [0048.453] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.454] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.454] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16845513190) returned 1 [0048.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb29a50, dwHighDateTime=0x1d585b4)) [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d89b0 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d89b0 | out: hHeap=0x260000) returned 1 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323768 [0048.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.454] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.455] GetLastError () returned 0x0 [0048.455] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.455] GetLastError () returned 0x0 [0048.456] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff12c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.456] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xed4, lpOverlapped=0x0) returned 1 [0048.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.456] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.456] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.457] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.457] CloseHandle (hObject=0x104) returned 1 [0048.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.458] GetLastError () returned 0x0 [0048.458] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.459] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.459] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16845989857) returned 1 [0048.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb29a50, dwHighDateTime=0x1d585b4)) [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d89e8 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d89e8 | out: hHeap=0x260000) returned 1 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323800 [0048.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.459] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.459] GetLastError () returned 0x0 [0048.459] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.460] GetLastError () returned 0x0 [0048.461] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff67c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.461] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x984, lpOverlapped=0x0) returned 1 [0048.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.461] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.461] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.461] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.461] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.462] CloseHandle (hObject=0x104) returned 1 [0048.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.462] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.462] GetLastError () returned 0x0 [0048.462] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.463] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.463] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.463] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16846448789) returned 1 [0048.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb29a50, dwHighDateTime=0x1d585b4)) [0048.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8a20 [0048.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8a20 | out: hHeap=0x260000) returned 1 [0048.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323898 [0048.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.464] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.464] GetLastError () returned 0x0 [0048.464] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.464] GetLastError () returned 0x0 [0048.465] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff554, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.465] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xaac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xaac, lpOverlapped=0x0) returned 1 [0048.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.466] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.466] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.466] CloseHandle (hObject=0x104) returned 1 [0048.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.467] GetLastError () returned 0x0 [0048.468] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.468] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.468] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.468] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16846963429) returned 1 [0048.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb29a50, dwHighDateTime=0x1d585b4)) [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8a58 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8a58 | out: hHeap=0x260000) returned 1 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323930 [0048.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.469] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.469] GetLastError () returned 0x0 [0048.469] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.469] GetLastError () returned 0x0 [0048.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe3f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.471] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1c08, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c08, lpOverlapped=0x0) returned 1 [0048.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.471] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.471] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.471] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.472] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.472] CloseHandle (hObject=0x104) returned 1 [0048.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.472] GetLastError () returned 0x0 [0048.473] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.473] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.473] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.473] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16847463295) returned 1 [0048.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabb4fbb0, dwHighDateTime=0x1d585b4)) [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8a90 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8a90 | out: hHeap=0x260000) returned 1 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3239c8 [0048.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.474] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.474] GetLastError () returned 0x0 [0048.474] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.474] GetLastError () returned 0x0 [0048.525] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff25a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.525] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xda6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xda6, lpOverlapped=0x0) returned 1 [0048.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.526] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.526] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.526] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.526] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.526] CloseHandle (hObject=0x104) returned 1 [0048.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.537] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.550] GetLastError () returned 0x0 [0048.609] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312940) returned 1 [0048.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.610] CryptReleaseContext (hProv=0x312940, dwFlags=0x0) returned 1 [0048.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.610] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16861136179) returned 1 [0048.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabca6810, dwHighDateTime=0x1d585b4)) [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8f28 [0048.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8f28 | out: hHeap=0x260000) returned 1 [0048.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323f20 [0048.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.611] GetLastError () returned 0x0 [0048.611] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.611] GetLastError () returned 0x0 [0048.612] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff46a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.612] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xb96, lpOverlapped=0x0) returned 1 [0048.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.613] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.613] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.613] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.613] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.613] CloseHandle (hObject=0x104) returned 1 [0048.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.614] GetLastError () returned 0x0 [0048.614] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.615] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.615] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16861620118) returned 1 [0048.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabca6810, dwHighDateTime=0x1d585b4)) [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8f60 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8f60 | out: hHeap=0x260000) returned 1 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324510 [0048.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.616] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.616] GetLastError () returned 0x0 [0048.616] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.616] GetLastError () returned 0x0 [0048.617] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbb50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.618] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x44b0, lpOverlapped=0x0) returned 1 [0048.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.618] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.618] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.618] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.618] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.618] CloseHandle (hObject=0x104) returned 1 [0048.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.619] GetLastError () returned 0x0 [0048.619] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.620] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.620] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.620] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16862135753) returned 1 [0048.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabca6810, dwHighDateTime=0x1d585b4)) [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8f98 [0048.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8f98 | out: hHeap=0x260000) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3246d8 [0048.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.621] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.621] GetLastError () returned 0x0 [0048.621] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.621] GetLastError () returned 0x0 [0048.623] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe16c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.623] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1e94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1e94, lpOverlapped=0x0) returned 1 [0048.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.623] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.623] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.623] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.623] CloseHandle (hObject=0x104) returned 1 [0048.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.627] GetLastError () returned 0x0 [0048.628] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.629] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.629] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.629] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16863004977) returned 1 [0048.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabccc970, dwHighDateTime=0x1d585b4)) [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8fd0 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8fd0 | out: hHeap=0x260000) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324770 [0048.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.629] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.630] GetLastError () returned 0x0 [0048.630] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.630] GetLastError () returned 0x0 [0048.631] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff5810, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.631] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xa7f0, lpOverlapped=0x0) returned 1 [0048.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.632] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.632] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.632] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.632] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.632] CloseHandle (hObject=0x108) returned 1 [0048.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.633] GetLastError () returned 0x0 [0048.633] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.634] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.634] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16863505310) returned 1 [0048.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabccc970, dwHighDateTime=0x1d585b4)) [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9008 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0048.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9008 | out: hHeap=0x260000) returned 1 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324808 [0048.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.634] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.635] GetLastError () returned 0x0 [0048.635] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.635] GetLastError () returned 0x0 [0048.636] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff5864, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.636] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xa79c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xa79c, lpOverlapped=0x0) returned 1 [0048.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.637] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.637] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.637] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.637] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.637] CloseHandle (hObject=0x108) returned 1 [0048.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.638] GetLastError () returned 0x0 [0048.638] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.639] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0048.639] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.639] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16863997567) returned 1 [0048.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabccc970, dwHighDateTime=0x1d585b4)) [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9040 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9040 | out: hHeap=0x260000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3248a0 [0048.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.639] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.639] GetLastError () returned 0x0 [0048.640] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.640] GetLastError () returned 0x0 [0048.640] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.641] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x2c8, lpOverlapped=0x0) returned 1 [0048.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.641] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.641] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.641] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.641] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.642] CloseHandle (hObject=0x108) returned 1 [0048.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.642] GetLastError () returned 0x0 [0048.643] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0048.643] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0048.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.644] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16864464292) returned 1 [0048.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabcf2ad0, dwHighDateTime=0x1d585b4)) [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9078 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9078 | out: hHeap=0x260000) returned 1 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324938 [0048.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.644] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.644] GetLastError () returned 0x0 [0048.644] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.644] GetLastError () returned 0x0 [0048.648] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff874, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.648] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x78c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x78c, lpOverlapped=0x0) returned 1 [0048.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.648] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.648] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.648] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.649] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.649] CloseHandle (hObject=0x108) returned 1 [0048.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.649] GetLastError () returned 0x0 [0048.650] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0048.651] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.651] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16865222967) returned 1 [0048.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabcf2ad0, dwHighDateTime=0x1d585b4)) [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d90b0 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d90b0 | out: hHeap=0x260000) returned 1 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355868 [0048.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.652] GetLastError () returned 0x0 [0048.652] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.652] GetLastError () returned 0x0 [0048.653] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff478, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.653] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xb88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xb88, lpOverlapped=0x0) returned 1 [0048.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.654] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.654] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.654] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.654] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.654] CloseHandle (hObject=0x108) returned 1 [0048.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.654] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.655] GetLastError () returned 0x0 [0048.655] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.656] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0048.656] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.656] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16865702734) returned 1 [0048.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabcf2ad0, dwHighDateTime=0x1d585b4)) [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d90e8 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d90e8 | out: hHeap=0x260000) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324af0 [0048.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.657] GetLastError () returned 0x0 [0048.657] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.657] GetLastError () returned 0x0 [0048.658] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.658] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2708, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x2708, lpOverlapped=0x0) returned 1 [0048.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.659] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.659] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.659] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.659] CloseHandle (hObject=0x108) returned 1 [0048.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.660] GetLastError () returned 0x0 [0048.660] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f088 | out: pbBuffer=0x27f088) returned 1 [0048.661] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f088 | out: hHeap=0x260000) returned 1 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.661] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16866210670) returned 1 [0048.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabd18c30, dwHighDateTime=0x1d585b4)) [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9120 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9120 | out: hHeap=0x260000) returned 1 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324b88 [0048.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.661] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.662] GetLastError () returned 0x0 [0048.662] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.662] GetLastError () returned 0x0 [0048.663] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffaed0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.664] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x5130, lpOverlapped=0x0) returned 1 [0048.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.664] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.664] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.664] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.664] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.664] CloseHandle (hObject=0x108) returned 1 [0048.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.665] GetLastError () returned 0x0 [0048.665] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.666] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.666] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.666] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16866726750) returned 1 [0048.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabd18c30, dwHighDateTime=0x1d585b4)) [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9158 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9158 | out: hHeap=0x260000) returned 1 [0048.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324c20 [0048.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.667] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.667] GetLastError () returned 0x0 [0048.667] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.667] GetLastError () returned 0x0 [0048.669] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9ff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.669] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x600c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x600c, lpOverlapped=0x0) returned 1 [0048.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.669] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.669] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.669] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.669] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.669] CloseHandle (hObject=0x108) returned 1 [0048.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.670] GetLastError () returned 0x0 [0048.670] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.671] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.671] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.671] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16867236517) returned 1 [0048.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabd18c30, dwHighDateTime=0x1d585b4)) [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9190 [0048.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9190 | out: hHeap=0x260000) returned 1 [0048.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324cb8 [0048.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.672] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.672] GetLastError () returned 0x0 [0048.672] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.672] GetLastError () returned 0x0 [0048.674] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff74e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.674] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x8b2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x8b2, lpOverlapped=0x0) returned 1 [0048.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.674] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.674] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.674] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.674] CloseHandle (hObject=0x108) returned 1 [0048.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.684] GetLastError () returned 0x0 [0048.685] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.685] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.685] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.685] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16868659204) returned 1 [0048.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabd3ed90, dwHighDateTime=0x1d585b4)) [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d91c8 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d91c8 | out: hHeap=0x260000) returned 1 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324d50 [0048.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.686] GetLastError () returned 0x0 [0048.686] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.686] GetLastError () returned 0x0 [0048.787] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc61c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.796] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x39e4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x39e4, lpOverlapped=0x0) returned 1 [0048.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.797] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.797] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.797] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.797] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.797] CloseHandle (hObject=0x108) returned 1 [0048.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.798] GetLastError () returned 0x0 [0048.798] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.799] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.799] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.799] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16880040395) returned 1 [0048.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabe6f890, dwHighDateTime=0x1d585b4)) [0048.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7b70 [0048.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b70 | out: hHeap=0x260000) returned 1 [0048.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324de8 [0048.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.800] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.800] GetLastError () returned 0x0 [0048.800] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.800] GetLastError () returned 0x0 [0048.801] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff748, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.801] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x8b8, lpOverlapped=0x0) returned 1 [0048.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.802] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.802] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.802] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.802] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.802] CloseHandle (hObject=0x108) returned 1 [0048.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.803] GetLastError () returned 0x0 [0048.804] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.805] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.805] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.805] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16880601758) returned 1 [0048.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabe6f890, dwHighDateTime=0x1d585b4)) [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7b38 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b38 | out: hHeap=0x260000) returned 1 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325898 [0048.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.806] GetLastError () returned 0x0 [0048.806] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.806] GetLastError () returned 0x0 [0048.807] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.807] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x70c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x70c, lpOverlapped=0x0) returned 1 [0048.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.807] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.807] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.808] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.808] CloseHandle (hObject=0x108) returned 1 [0048.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.809] GetLastError () returned 0x0 [0048.809] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.810] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.810] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.810] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16881090226) returned 1 [0048.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabe6f890, dwHighDateTime=0x1d585b4)) [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7b00 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b00 | out: hHeap=0x260000) returned 1 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325930 [0048.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.810] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.810] GetLastError () returned 0x0 [0048.810] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.811] GetLastError () returned 0x0 [0048.825] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.826] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x760, lpOverlapped=0x0) returned 1 [0048.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.826] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.826] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.826] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.827] CloseHandle (hObject=0x108) returned 1 [0048.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.828] GetLastError () returned 0x0 [0048.828] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0048.829] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.829] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.829] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16883002736) returned 1 [0048.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabebbb50, dwHighDateTime=0x1d585b4)) [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ac8 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ac8 | out: hHeap=0x260000) returned 1 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3259c8 [0048.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.829] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.830] GetLastError () returned 0x0 [0048.830] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.830] GetLastError () returned 0x0 [0048.874] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff12c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.874] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xed4, lpOverlapped=0x0) returned 1 [0048.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0048.874] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.874] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.875] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.875] CloseHandle (hObject=0x108) returned 1 [0048.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.877] GetLastError () returned 0x0 [0048.878] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.878] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.878] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16887961051) returned 1 [0048.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf2df70, dwHighDateTime=0x1d585b4)) [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326b28 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326b28 | out: hHeap=0x260000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325a60 [0048.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.879] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.879] GetLastError () returned 0x0 [0048.879] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.879] GetLastError () returned 0x0 [0048.882] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffc7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.882] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x384, lpOverlapped=0x0) returned 1 [0048.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.884] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.884] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.885] CloseHandle (hObject=0x108) returned 1 [0048.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0048.885] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0048.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.885] GetLastError () returned 0x0 [0048.886] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.886] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.887] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16888771857) returned 1 [0048.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf2df70, dwHighDateTime=0x1d585b4)) [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326b60 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326b60 | out: hHeap=0x260000) returned 1 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325f20 [0048.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.887] GetLastError () returned 0x0 [0048.887] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.887] GetLastError () returned 0x0 [0048.890] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff624, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.890] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9dc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x9dc, lpOverlapped=0x0) returned 1 [0048.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.890] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.890] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.891] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.891] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.891] CloseHandle (hObject=0x108) returned 1 [0048.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0048.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0048.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.892] GetLastError () returned 0x0 [0048.892] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.893] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.893] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.893] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16889401198) returned 1 [0048.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf540d0, dwHighDateTime=0x1d585b4)) [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326b98 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326b98 | out: hHeap=0x260000) returned 1 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325fb8 [0048.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.893] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.894] GetLastError () returned 0x0 [0048.894] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.894] GetLastError () returned 0x0 [0048.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff6ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.895] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x914, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x914, lpOverlapped=0x0) returned 1 [0048.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.895] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.896] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.896] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.896] CloseHandle (hObject=0x108) returned 1 [0048.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.897] GetLastError () returned 0x0 [0048.897] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.898] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.898] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.898] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16889890928) returned 1 [0048.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf540d0, dwHighDateTime=0x1d585b4)) [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326bd0 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326bd0 | out: hHeap=0x260000) returned 1 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326050 [0048.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.898] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.898] GetLastError () returned 0x0 [0048.898] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.899] GetLastError () returned 0x0 [0048.900] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb584, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.900] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4a7c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x4a7c, lpOverlapped=0x0) returned 1 [0048.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.900] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.900] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.901] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.901] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.901] CloseHandle (hObject=0x108) returned 1 [0048.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.902] GetLastError () returned 0x0 [0048.902] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.902] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.903] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.903] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16890379011) returned 1 [0048.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf540d0, dwHighDateTime=0x1d585b4)) [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326c08 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326c08 | out: hHeap=0x260000) returned 1 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3260e8 [0048.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.903] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.903] GetLastError () returned 0x0 [0048.903] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.903] GetLastError () returned 0x0 [0048.905] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.905] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x244, lpOverlapped=0x0) returned 1 [0048.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.905] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.905] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.905] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.905] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.905] CloseHandle (hObject=0x108) returned 1 [0048.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.907] GetLastError () returned 0x0 [0048.907] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.908] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.908] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.908] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16891051542) returned 1 [0048.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf7a230, dwHighDateTime=0x1d585b4)) [0048.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c48 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c48 | out: hHeap=0x260000) returned 1 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326180 [0048.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.910] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.910] GetLastError () returned 0x0 [0048.910] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.910] GetLastError () returned 0x0 [0048.911] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffed8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.911] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x128, lpOverlapped=0x0) returned 1 [0048.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.911] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.911] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.912] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.912] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.912] CloseHandle (hObject=0x108) returned 1 [0048.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.913] GetLastError () returned 0x0 [0048.913] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.914] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.914] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.914] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16891504471) returned 1 [0048.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf7a230, dwHighDateTime=0x1d585b4)) [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c10 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c10 | out: hHeap=0x260000) returned 1 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326218 [0048.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.914] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.915] GetLastError () returned 0x0 [0048.915] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.915] GetLastError () returned 0x0 [0048.916] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffdd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.916] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x228, lpOverlapped=0x0) returned 1 [0048.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.916] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.916] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.916] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.916] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.917] CloseHandle (hObject=0x108) returned 1 [0048.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.917] GetLastError () returned 0x0 [0048.918] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.918] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.919] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.919] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16891978015) returned 1 [0048.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabf7a230, dwHighDateTime=0x1d585b4)) [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326c40 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326c40 | out: hHeap=0x260000) returned 1 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3262b0 [0048.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.919] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.919] GetLastError () returned 0x0 [0048.919] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.919] GetLastError () returned 0x0 [0048.921] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffefcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.921] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1034, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1034, lpOverlapped=0x0) returned 1 [0048.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.921] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.921] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.921] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.921] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.922] CloseHandle (hObject=0x108) returned 1 [0048.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.923] GetLastError () returned 0x0 [0048.923] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.924] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.925] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.925] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16892626212) returned 1 [0048.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabfa0390, dwHighDateTime=0x1d585b4)) [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326c78 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326c78 | out: hHeap=0x260000) returned 1 [0048.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326348 [0048.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.926] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.926] GetLastError () returned 0x0 [0048.926] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.926] GetLastError () returned 0x0 [0048.927] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.928] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x8fc, lpOverlapped=0x0) returned 1 [0048.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.928] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.928] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.928] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.928] CloseHandle (hObject=0x108) returned 1 [0048.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0048.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0048.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.929] GetLastError () returned 0x0 [0048.929] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.930] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.930] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.930] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16893142441) returned 1 [0048.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabfa0390, dwHighDateTime=0x1d585b4)) [0048.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326cb0 [0048.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326cb0 | out: hHeap=0x260000) returned 1 [0048.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3263e0 [0048.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.931] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.931] GetLastError () returned 0x0 [0048.931] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.931] GetLastError () returned 0x0 [0048.932] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff34c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.933] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xcb4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xcb4, lpOverlapped=0x0) returned 1 [0048.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.933] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.933] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.933] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.933] CloseHandle (hObject=0x108) returned 1 [0048.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0048.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0048.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.934] GetLastError () returned 0x0 [0048.934] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.935] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.935] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.935] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16893634457) returned 1 [0048.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabfa0390, dwHighDateTime=0x1d585b4)) [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ce8 [0048.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ce8 | out: hHeap=0x260000) returned 1 [0048.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326478 [0048.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.936] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.936] GetLastError () returned 0x0 [0048.936] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.936] GetLastError () returned 0x0 [0048.937] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe7eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.937] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1815, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1815, lpOverlapped=0x0) returned 1 [0048.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.938] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.938] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.938] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.938] CloseHandle (hObject=0x108) returned 1 [0048.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.938] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0048.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.939] GetLastError () returned 0x0 [0048.939] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.940] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.940] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.940] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16894124315) returned 1 [0048.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabfc64f0, dwHighDateTime=0x1d585b4)) [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326d20 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326d20 | out: hHeap=0x260000) returned 1 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326510 [0048.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.941] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.941] GetLastError () returned 0x0 [0048.941] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.941] GetLastError () returned 0x0 [0048.942] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.942] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x566, lpOverlapped=0x0) returned 1 [0048.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.942] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.943] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.943] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.943] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.943] CloseHandle (hObject=0x108) returned 1 [0048.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0048.944] GetLastError () returned 0x0 [0048.944] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0048.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.945] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0048.945] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16894595129) returned 1 [0048.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xabfc64f0, dwHighDateTime=0x1d585b4)) [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326d58 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326d58 | out: hHeap=0x260000) returned 1 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3265a8 [0048.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0048.945] GetLastError () returned 0x0 [0048.946] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0048.946] GetLastError () returned 0x0 [0049.021] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffcd0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.021] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x32f2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x32f2, lpOverlapped=0x0) returned 1 [0049.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.022] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.022] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.022] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.022] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.023] CloseHandle (hObject=0x108) returned 1 [0049.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.023] GetLastError () returned 0x0 [0049.024] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.024] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.025] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16902568696) returned 1 [0049.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac084bd0, dwHighDateTime=0x1d585b4)) [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327068 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327068 | out: hHeap=0x260000) returned 1 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebbb8 [0049.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.025] GetLastError () returned 0x0 [0049.025] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.025] GetLastError () returned 0x0 [0049.028] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd126, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.028] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2eda, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2eda, lpOverlapped=0x0) returned 1 [0049.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.028] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.028] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.028] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.029] CloseHandle (hObject=0x108) returned 1 [0049.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.029] GetLastError () returned 0x0 [0049.030] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.031] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.031] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16903207270) returned 1 [0049.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac0aad30, dwHighDateTime=0x1d585b4)) [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3270a0 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3270a0 | out: hHeap=0x260000) returned 1 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebce8 [0049.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.031] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.032] GetLastError () returned 0x0 [0049.032] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.032] GetLastError () returned 0x0 [0049.033] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff89e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.033] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x7620, lpOverlapped=0x0) returned 1 [0049.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.033] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.034] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.034] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.034] CloseHandle (hObject=0x108) returned 1 [0049.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.035] GetLastError () returned 0x0 [0049.035] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.036] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.036] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.036] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16903687461) returned 1 [0049.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac0aad30, dwHighDateTime=0x1d585b4)) [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3270d8 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3270d8 | out: hHeap=0x260000) returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebd80 [0049.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.036] GetLastError () returned 0x0 [0049.036] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.037] GetLastError () returned 0x0 [0049.040] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8de4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.040] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x721c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x721c, lpOverlapped=0x0) returned 1 [0049.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.041] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.041] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.041] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.041] CloseHandle (hObject=0x108) returned 1 [0049.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.042] GetLastError () returned 0x0 [0049.042] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.043] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.043] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.043] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16904416975) returned 1 [0049.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac0aad30, dwHighDateTime=0x1d585b4)) [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327110 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327110 | out: hHeap=0x260000) returned 1 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebe18 [0049.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.044] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.044] GetLastError () returned 0x0 [0049.044] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.044] GetLastError () returned 0x0 [0049.045] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc88e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.045] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3772, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3772, lpOverlapped=0x0) returned 1 [0049.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.046] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.046] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.046] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.046] CloseHandle (hObject=0x108) returned 1 [0049.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.047] GetLastError () returned 0x0 [0049.047] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.048] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.048] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.048] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16904914782) returned 1 [0049.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac0d0e90, dwHighDateTime=0x1d585b4)) [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327148 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327148 | out: hHeap=0x260000) returned 1 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebeb0 [0049.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.049] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.049] GetLastError () returned 0x0 [0049.049] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.049] GetLastError () returned 0x0 [0049.050] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6df2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.050] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x920e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x920e, lpOverlapped=0x0) returned 1 [0049.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.051] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.051] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.051] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.051] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.051] CloseHandle (hObject=0x108) returned 1 [0049.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.052] GetLastError () returned 0x0 [0049.052] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.053] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.053] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0049.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.053] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16905419470) returned 1 [0049.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac0d0e90, dwHighDateTime=0x1d585b4)) [0049.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0049.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0049.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0049.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327180 [0049.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327180 | out: hHeap=0x260000) returned 1 [0049.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebf48 [0049.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.055] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.055] GetLastError () returned 0x0 [0049.056] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.056] GetLastError () returned 0x0 [0049.133] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc210, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.133] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3df0, lpOverlapped=0x0) returned 1 [0049.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.135] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.135] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.136] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.136] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.136] CloseHandle (hObject=0x108) returned 1 [0049.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0049.136] GetLastError () returned 0x0 [0049.191] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.192] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.192] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.192] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16919313560) returned 1 [0049.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac227af0, dwHighDateTime=0x1d585b4)) [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327570 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327570 | out: hHeap=0x260000) returned 1 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec668 [0049.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.192] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.193] GetLastError () returned 0x0 [0049.193] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.193] GetLastError () returned 0x0 [0049.200] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.200] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x83c, lpOverlapped=0x0) returned 1 [0049.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.201] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.201] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.201] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.201] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.201] CloseHandle (hObject=0x10c) returned 1 [0049.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.202] GetLastError () returned 0x0 [0049.213] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.225] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.225] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.225] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16922612941) returned 1 [0049.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac273db0, dwHighDateTime=0x1d585b4)) [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3276c0 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3276c0 | out: hHeap=0x260000) returned 1 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ece20 [0049.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.225] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.226] GetLastError () returned 0x0 [0049.226] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.226] GetLastError () returned 0x0 [0049.236] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdcce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.236] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2332, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x2332, lpOverlapped=0x0) returned 1 [0049.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.237] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.237] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.237] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.237] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.238] CloseHandle (hObject=0x10c) returned 1 [0049.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.239] GetLastError () returned 0x0 [0049.239] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.241] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.241] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.241] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16924202464) returned 1 [0049.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac299f10, dwHighDateTime=0x1d585b4)) [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3276f8 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3276f8 | out: hHeap=0x260000) returned 1 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecc58 [0049.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.242] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.242] GetLastError () returned 0x0 [0049.242] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.242] GetLastError () returned 0x0 [0049.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff694, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.243] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x96c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x96c, lpOverlapped=0x0) returned 1 [0049.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.244] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.244] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.244] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.244] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.244] CloseHandle (hObject=0x10c) returned 1 [0049.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.245] GetLastError () returned 0x0 [0049.245] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.246] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.246] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16924733323) returned 1 [0049.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac299f10, dwHighDateTime=0x1d585b4)) [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327730 [0049.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327730 | out: hHeap=0x260000) returned 1 [0049.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecf50 [0049.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.247] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.247] GetLastError () returned 0x0 [0049.247] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.247] GetLastError () returned 0x0 [0049.391] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffec88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.391] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1378, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1378, lpOverlapped=0x0) returned 1 [0049.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.392] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.392] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.393] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.393] CloseHandle (hObject=0x10c) returned 1 [0049.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.396] GetLastError () returned 0x0 [0049.396] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.397] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.397] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.397] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16939862875) returned 1 [0049.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac416cd0, dwHighDateTime=0x1d585b4)) [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3277a0 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3277a0 | out: hHeap=0x260000) returned 1 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecfe8 [0049.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.398] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.398] GetLastError () returned 0x0 [0049.398] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.398] GetLastError () returned 0x0 [0049.401] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffb78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.401] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x488, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x488, lpOverlapped=0x0) returned 1 [0049.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.403] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.403] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.403] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.403] CloseHandle (hObject=0x10c) returned 1 [0049.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.404] GetLastError () returned 0x0 [0049.404] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.405] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.405] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16940659880) returned 1 [0049.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac43ce30, dwHighDateTime=0x1d585b4)) [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3277d8 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3277d8 | out: hHeap=0x260000) returned 1 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed118 [0049.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.406] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.406] GetLastError () returned 0x0 [0049.406] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.406] GetLastError () returned 0x0 [0049.409] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff6e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.409] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x91c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x91c, lpOverlapped=0x0) returned 1 [0049.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.409] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.409] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.409] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.410] CloseHandle (hObject=0x10c) returned 1 [0049.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.410] GetLastError () returned 0x0 [0049.411] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.412] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16941271032) returned 1 [0049.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac43ce30, dwHighDateTime=0x1d585b4)) [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327810 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327810 | out: hHeap=0x260000) returned 1 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed1b0 [0049.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.412] GetLastError () returned 0x0 [0049.412] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.412] GetLastError () returned 0x0 [0049.414] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd7b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.414] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x284c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x284c, lpOverlapped=0x0) returned 1 [0049.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.414] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.414] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.415] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.415] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.415] CloseHandle (hObject=0x10c) returned 1 [0049.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.416] GetLastError () returned 0x0 [0049.416] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.417] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.417] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.417] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16941788266) returned 1 [0049.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac43ce30, dwHighDateTime=0x1d585b4)) [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327848 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327848 | out: hHeap=0x260000) returned 1 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed248 [0049.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.417] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.417] GetLastError () returned 0x0 [0049.417] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.418] GetLastError () returned 0x0 [0049.419] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8932, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.419] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x76ce, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x76ce, lpOverlapped=0x0) returned 1 [0049.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.419] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.419] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.420] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.420] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.420] CloseHandle (hObject=0x10c) returned 1 [0049.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.421] GetLastError () returned 0x0 [0049.422] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.422] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.422] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.422] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16942361087) returned 1 [0049.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac462f90, dwHighDateTime=0x1d585b4)) [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327880 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327880 | out: hHeap=0x260000) returned 1 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed2e0 [0049.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.423] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.423] GetLastError () returned 0x0 [0049.423] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.423] GetLastError () returned 0x0 [0049.425] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb9fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.425] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4604, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x4604, lpOverlapped=0x0) returned 1 [0049.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.425] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.425] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.425] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.425] CloseHandle (hObject=0x10c) returned 1 [0049.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.426] GetLastError () returned 0x0 [0049.427] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.428] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.428] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.428] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16943061358) returned 1 [0049.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac462f90, dwHighDateTime=0x1d585b4)) [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3278b8 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3278b8 | out: hHeap=0x260000) returned 1 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed378 [0049.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.430] GetLastError () returned 0x0 [0049.430] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.430] GetLastError () returned 0x0 [0049.492] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8634, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.492] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x79cc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x79cc, lpOverlapped=0x0) returned 1 [0049.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.494] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.494] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.495] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.495] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.495] CloseHandle (hObject=0x10c) returned 1 [0049.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.534] GetLastError () returned 0x0 [0049.782] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.783] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.783] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.783] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16978420817) returned 1 [0049.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac7cef30, dwHighDateTime=0x1d585b4)) [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c57f8 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c57f8 | out: hHeap=0x260000) returned 1 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329478 [0049.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.784] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.784] GetLastError () returned 0x0 [0049.784] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.784] GetLastError () returned 0x0 [0049.785] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdb9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.785] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2466, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2466, lpOverlapped=0x0) returned 1 [0049.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.786] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.786] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.786] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.786] CloseHandle (hObject=0x104) returned 1 [0049.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.827] GetLastError () returned 0x0 [0049.828] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.828] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.829] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.829] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16982980083) returned 1 [0049.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac841350, dwHighDateTime=0x1d585b4)) [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a030 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a030 | out: hHeap=0x260000) returned 1 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328048 [0049.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.829] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.829] GetLastError () returned 0x0 [0049.829] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.830] GetLastError () returned 0x0 [0049.831] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc242, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.831] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3dbe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3dbe, lpOverlapped=0x0) returned 1 [0049.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.831] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.832] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.832] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.832] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.832] CloseHandle (hObject=0x104) returned 1 [0049.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.833] GetLastError () returned 0x0 [0049.833] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.834] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.834] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.834] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16983537518) returned 1 [0049.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac841350, dwHighDateTime=0x1d585b4)) [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a068 [0049.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a068 | out: hHeap=0x260000) returned 1 [0049.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3298a0 [0049.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.835] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.835] GetLastError () returned 0x0 [0049.835] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.835] GetLastError () returned 0x0 [0049.836] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.836] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1780, lpOverlapped=0x0) returned 1 [0049.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.837] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.837] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.837] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.837] CloseHandle (hObject=0x104) returned 1 [0049.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.838] GetLastError () returned 0x0 [0049.838] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.839] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.839] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.839] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16984043401) returned 1 [0049.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac841350, dwHighDateTime=0x1d585b4)) [0049.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a0a0 [0049.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a0a0 | out: hHeap=0x260000) returned 1 [0049.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329938 [0049.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.840] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.840] GetLastError () returned 0x0 [0049.840] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.840] GetLastError () returned 0x0 [0049.842] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe8ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.842] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1746, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1746, lpOverlapped=0x0) returned 1 [0049.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.842] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.843] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.843] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.843] CloseHandle (hObject=0x104) returned 1 [0049.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.844] GetLastError () returned 0x0 [0049.844] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.845] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.845] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.845] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16984603861) returned 1 [0049.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac8674b0, dwHighDateTime=0x1d585b4)) [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a0d8 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a0d8 | out: hHeap=0x260000) returned 1 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3209d0 [0049.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.845] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.846] GetLastError () returned 0x0 [0049.846] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.846] GetLastError () returned 0x0 [0049.847] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe380, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.847] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c80, lpOverlapped=0x0) returned 1 [0049.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.848] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.848] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.848] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.848] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.848] CloseHandle (hObject=0x104) returned 1 [0049.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.849] GetLastError () returned 0x0 [0049.850] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.850] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.850] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.851] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16985174963) returned 1 [0049.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac8674b0, dwHighDateTime=0x1d585b4)) [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a110 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a110 | out: hHeap=0x260000) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32aaf0 [0049.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.851] GetLastError () returned 0x0 [0049.851] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.851] GetLastError () returned 0x0 [0049.892] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeada, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.892] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1526, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1526, lpOverlapped=0x0) returned 1 [0049.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.893] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.893] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.893] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.893] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.893] CloseHandle (hObject=0x104) returned 1 [0049.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.895] GetLastError () returned 0x0 [0049.896] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.897] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.897] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.897] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16989817574) returned 1 [0049.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac8d98d0, dwHighDateTime=0x1d585b4)) [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a298 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a298 | out: hHeap=0x260000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ab88 [0049.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.898] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.898] GetLastError () returned 0x0 [0049.898] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.898] GetLastError () returned 0x0 [0049.900] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffec96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.901] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x136a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x136a, lpOverlapped=0x0) returned 1 [0049.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.901] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.901] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.901] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.901] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.901] CloseHandle (hObject=0x104) returned 1 [0049.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.902] GetLastError () returned 0x0 [0049.902] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.903] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.903] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.903] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16990453120) returned 1 [0049.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac8d98d0, dwHighDateTime=0x1d585b4)) [0049.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a2d0 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a2d0 | out: hHeap=0x260000) returned 1 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32afb0 [0049.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.904] GetLastError () returned 0x0 [0049.904] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.904] GetLastError () returned 0x0 [0049.906] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.906] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc0a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc0a, lpOverlapped=0x0) returned 1 [0049.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.906] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.906] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.907] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.907] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.907] CloseHandle (hObject=0x104) returned 1 [0049.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.908] GetLastError () returned 0x0 [0049.908] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.909] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.909] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.909] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16991049085) returned 1 [0049.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac8ffa30, dwHighDateTime=0x1d585b4)) [0049.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a308 [0049.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a308 | out: hHeap=0x260000) returned 1 [0049.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b048 [0049.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.910] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.910] GetLastError () returned 0x0 [0049.910] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.910] GetLastError () returned 0x0 [0049.912] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffa4fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.912] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5b04, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5b04, lpOverlapped=0x0) returned 1 [0049.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.912] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.912] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.913] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.913] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.913] CloseHandle (hObject=0x104) returned 1 [0049.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.913] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.914] GetLastError () returned 0x0 [0049.915] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.915] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.915] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.915] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16991656246) returned 1 [0049.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac8ffa30, dwHighDateTime=0x1d585b4)) [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a340 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a340 | out: hHeap=0x260000) returned 1 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b0e0 [0049.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.916] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.916] GetLastError () returned 0x0 [0049.916] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.916] GetLastError () returned 0x0 [0049.918] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffa99c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.918] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5664, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5664, lpOverlapped=0x0) returned 1 [0049.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.918] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.918] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.918] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.919] CloseHandle (hObject=0x104) returned 1 [0049.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.920] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.921] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.921] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.921] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.921] GetLastError () returned 0x0 [0049.923] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc214, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.923] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3dec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3dec, lpOverlapped=0x0) returned 1 [0049.923] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.923] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.924] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.924] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.924] CloseHandle (hObject=0x104) returned 1 [0049.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.925] GetLastError () returned 0x0 [0049.926] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0049.926] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.926] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.927] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=16992776967) returned 1 [0049.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xac925b90, dwHighDateTime=0x1d585b4)) [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a3b0 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a3b0 | out: hHeap=0x260000) returned 1 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b210 [0049.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.927] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0049.927] GetLastError () returned 0x0 [0049.928] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0049.928] GetLastError () returned 0x0 [0050.030] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff4f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.030] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x1cffdb0*=0xb10, lpOverlapped=0x0) returned 1 [0050.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.030] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.030] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.030] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.030] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.031] CloseHandle (hObject=0x104) returned 1 [0050.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.032] GetLastError () returned 0x0 [0050.147] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.148] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.148] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17014895581) returned 1 [0050.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacb3aed0, dwHighDateTime=0x1d585b4)) [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5ef8 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5ef8 | out: hHeap=0x260000) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c510 [0050.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.148] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.149] GetLastError () returned 0x0 [0050.149] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.149] GetLastError () returned 0x0 [0050.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffb3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.151] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x4c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x4c4, lpOverlapped=0x0) returned 1 [0050.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.152] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.152] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.152] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.152] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.152] CloseHandle (hObject=0x100) returned 1 [0050.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.153] GetLastError () returned 0x0 [0050.154] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.155] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.155] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.155] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17015595028) returned 1 [0050.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacb61030, dwHighDateTime=0x1d585b4)) [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2947c8 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2947c8 | out: hHeap=0x260000) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32baf8 [0050.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.155] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.156] GetLastError () returned 0x0 [0050.156] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.156] GetLastError () returned 0x0 [0050.157] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff5bbe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.157] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xa442, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0xa442, lpOverlapped=0x0) returned 1 [0050.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.158] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.158] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.158] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.158] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.158] CloseHandle (hObject=0x100) returned 1 [0050.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.159] GetLastError () returned 0x0 [0050.159] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.160] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.160] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.160] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17016138669) returned 1 [0050.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacb61030, dwHighDateTime=0x1d585b4)) [0050.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32caf0 [0050.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32caf0 | out: hHeap=0x260000) returned 1 [0050.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c640 [0050.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.161] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.161] GetLastError () returned 0x0 [0050.161] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.161] GetLastError () returned 0x0 [0050.162] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffec96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.163] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x136a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x136a, lpOverlapped=0x0) returned 1 [0050.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.163] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.163] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.163] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.163] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.163] CloseHandle (hObject=0x100) returned 1 [0050.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.164] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.164] GetLastError () returned 0x0 [0050.165] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.165] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.165] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.166] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17016672833) returned 1 [0050.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacb61030, dwHighDateTime=0x1d585b4)) [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cb28 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cb28 | out: hHeap=0x260000) returned 1 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c6d8 [0050.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.166] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.166] GetLastError () returned 0x0 [0050.166] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.166] GetLastError () returned 0x0 [0050.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff9f49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.168] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x60b7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x60b7, lpOverlapped=0x0) returned 1 [0050.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.168] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.168] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.169] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.169] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.169] CloseHandle (hObject=0x100) returned 1 [0050.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.170] GetLastError () returned 0x0 [0050.170] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.171] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.171] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.171] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17017220530) returned 1 [0050.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacb87190, dwHighDateTime=0x1d585b4)) [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cb60 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cb60 | out: hHeap=0x260000) returned 1 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c770 [0050.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.172] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.172] GetLastError () returned 0x0 [0050.172] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.172] GetLastError () returned 0x0 [0050.173] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffbf2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.173] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x40d4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x40d4, lpOverlapped=0x0) returned 1 [0050.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.174] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.174] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.174] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.174] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.174] CloseHandle (hObject=0x100) returned 1 [0050.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.175] GetLastError () returned 0x0 [0050.176] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.176] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.176] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.176] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17017757683) returned 1 [0050.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacb87190, dwHighDateTime=0x1d585b4)) [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cb98 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cb98 | out: hHeap=0x260000) returned 1 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c808 [0050.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.177] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.177] GetLastError () returned 0x0 [0050.177] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.177] GetLastError () returned 0x0 [0050.223] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffa0c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.223] WriteFile (in: hFile=0x100, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x5f39, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x5f39, lpOverlapped=0x0) returned 1 [0050.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.224] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.224] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.224] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.224] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.225] CloseHandle (hObject=0x100) returned 1 [0050.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.264] GetLastError () returned 0x0 [0050.326] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.342] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.342] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17034343410) returned 1 [0050.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacd2a0b0, dwHighDateTime=0x1d585b4)) [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d068 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d068 | out: hHeap=0x260000) returned 1 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750650 [0050.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.344] GetLastError () returned 0x0 [0050.344] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.344] GetLastError () returned 0x0 [0050.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc4d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.346] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3b29, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x3b29, lpOverlapped=0x0) returned 1 [0050.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.346] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.347] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.347] CloseHandle (hObject=0x100) returned 1 [0050.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.397] GetLastError () returned 0x0 [0050.419] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.432] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.432] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.432] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17043332212) returned 1 [0050.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacde8790, dwHighDateTime=0x1d585b4)) [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d0d0 [0050.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d0d0 | out: hHeap=0x260000) returned 1 [0050.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750d70 [0050.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.433] GetLastError () returned 0x0 [0050.433] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.433] GetLastError () returned 0x0 [0050.436] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.436] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x23c2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x23c2, lpOverlapped=0x0) returned 1 [0050.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.437] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.437] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.437] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.437] CloseHandle (hObject=0x108) returned 1 [0050.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.438] GetLastError () returned 0x0 [0050.439] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.439] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.439] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.440] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17044074091) returned 1 [0050.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace0e8f0, dwHighDateTime=0x1d585b4)) [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d098 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d098 | out: hHeap=0x260000) returned 1 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750b10 [0050.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.440] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.440] GetLastError () returned 0x0 [0050.440] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.440] GetLastError () returned 0x0 [0050.442] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff32e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.442] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xcd2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xcd2, lpOverlapped=0x0) returned 1 [0050.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.442] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.442] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.443] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.443] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.443] CloseHandle (hObject=0x108) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.444] GetLastError () returned 0x0 [0050.444] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.445] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.445] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17044625533) returned 1 [0050.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace0e8f0, dwHighDateTime=0x1d585b4)) [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d060 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0050.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750ea0 [0050.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.446] GetLastError () returned 0x0 [0050.446] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.446] GetLastError () returned 0x0 [0050.447] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbe9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.448] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4162, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x4162, lpOverlapped=0x0) returned 1 [0050.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.448] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.448] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.448] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.449] CloseHandle (hObject=0x108) returned 1 [0050.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.450] GetLastError () returned 0x0 [0050.450] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.451] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.451] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.451] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17045207151) returned 1 [0050.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace34a50, dwHighDateTime=0x1d585b4)) [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cea0 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cea0 | out: hHeap=0x260000) returned 1 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750f38 [0050.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.451] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.452] GetLastError () returned 0x0 [0050.452] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.452] GetLastError () returned 0x0 [0050.453] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffa030, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.453] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x5fd0, lpOverlapped=0x0) returned 1 [0050.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.454] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.454] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.454] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.454] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.455] CloseHandle (hObject=0x108) returned 1 [0050.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.456] GetLastError () returned 0x0 [0050.456] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.457] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.457] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.457] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17045801605) returned 1 [0050.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace34a50, dwHighDateTime=0x1d585b4)) [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d028 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d028 | out: hHeap=0x260000) returned 1 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750fd0 [0050.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.457] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.458] GetLastError () returned 0x0 [0050.458] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.458] GetLastError () returned 0x0 [0050.459] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdc88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.459] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2378, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x2378, lpOverlapped=0x0) returned 1 [0050.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.460] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.460] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.460] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.460] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.460] CloseHandle (hObject=0x108) returned 1 [0050.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.461] GetLastError () returned 0x0 [0050.462] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.463] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.463] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.463] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17046433427) returned 1 [0050.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace34a50, dwHighDateTime=0x1d585b4)) [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d308 [0050.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d308 | out: hHeap=0x260000) returned 1 [0050.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751068 [0050.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.464] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.464] GetLastError () returned 0x0 [0050.464] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.464] GetLastError () returned 0x0 [0050.465] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe074, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.466] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1f8c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f8c, lpOverlapped=0x0) returned 1 [0050.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.466] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.466] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.466] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.467] CloseHandle (hObject=0x108) returned 1 [0050.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.468] GetLastError () returned 0x0 [0050.477] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.477] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.478] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17047877246) returned 1 [0050.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace5abb0, dwHighDateTime=0x1d585b4)) [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d228 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d228 | out: hHeap=0x260000) returned 1 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751100 [0050.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.478] GetLastError () returned 0x0 [0050.479] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.479] GetLastError () returned 0x0 [0050.481] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff548c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.481] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0xab74, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0xab74, lpOverlapped=0x0) returned 1 [0050.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.481] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.481] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.482] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.482] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.482] CloseHandle (hObject=0x100) returned 1 [0050.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.482] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.483] GetLastError () returned 0x0 [0050.483] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.484] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.484] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.484] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17048527225) returned 1 [0050.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace80d10, dwHighDateTime=0x1d585b4)) [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d378 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d378 | out: hHeap=0x260000) returned 1 [0050.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751198 [0050.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.485] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.485] GetLastError () returned 0x0 [0050.485] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.485] GetLastError () returned 0x0 [0050.487] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff0c61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.487] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0xf39f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0xf39f, lpOverlapped=0x0) returned 1 [0050.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.487] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.487] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.488] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.488] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.488] CloseHandle (hObject=0x100) returned 1 [0050.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.489] GetLastError () returned 0x0 [0050.489] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.490] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.490] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.490] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17049125573) returned 1 [0050.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace80d10, dwHighDateTime=0x1d585b4)) [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d3b0 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d3b0 | out: hHeap=0x260000) returned 1 [0050.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751230 [0050.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.491] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.491] GetLastError () returned 0x0 [0050.491] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.491] GetLastError () returned 0x0 [0050.493] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffb9d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.493] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x462c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x462c, lpOverlapped=0x0) returned 1 [0050.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.493] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.493] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.493] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.493] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.494] CloseHandle (hObject=0x100) returned 1 [0050.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.495] GetLastError () returned 0x0 [0050.495] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.495] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.496] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.496] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17049681231) returned 1 [0050.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xace80d10, dwHighDateTime=0x1d585b4)) [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d3e8 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d3e8 | out: hHeap=0x260000) returned 1 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27512c8 [0050.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.496] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.496] GetLastError () returned 0x0 [0050.496] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.497] GetLastError () returned 0x0 [0050.498] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff7526, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.498] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x8ada, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x8ada, lpOverlapped=0x0) returned 1 [0050.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.499] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.499] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.499] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.499] CloseHandle (hObject=0x100) returned 1 [0050.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.500] GetLastError () returned 0x0 [0050.500] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.501] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.501] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.501] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17050231262) returned 1 [0050.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacea6e70, dwHighDateTime=0x1d585b4)) [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d420 [0050.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d420 | out: hHeap=0x260000) returned 1 [0050.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751360 [0050.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.502] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.502] GetLastError () returned 0x0 [0050.502] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.502] GetLastError () returned 0x0 [0050.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff9d4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.504] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x62b1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x62b1, lpOverlapped=0x0) returned 1 [0050.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.504] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.504] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.505] CloseHandle (hObject=0x100) returned 1 [0050.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f6e8 [0050.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6e8 | out: hHeap=0x260000) returned 1 [0050.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.506] GetLastError () returned 0x0 [0050.506] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.507] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.507] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17050798109) returned 1 [0050.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacea6e70, dwHighDateTime=0x1d585b4)) [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d458 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d458 | out: hHeap=0x260000) returned 1 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27513f8 [0050.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.507] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.508] GetLastError () returned 0x0 [0050.508] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.508] GetLastError () returned 0x0 [0050.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffb22d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.509] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x4dd3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x4dd3, lpOverlapped=0x0) returned 1 [0050.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.510] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.510] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.510] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.510] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.510] CloseHandle (hObject=0x100) returned 1 [0050.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f6e8 [0050.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6e8 | out: hHeap=0x260000) returned 1 [0050.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.511] GetLastError () returned 0x0 [0050.544] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.545] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.545] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17054631462) returned 1 [0050.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf19290, dwHighDateTime=0x1d585b4)) [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d5a8 [0050.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d5a8 | out: hHeap=0x260000) returned 1 [0050.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751788 [0050.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.546] GetLastError () returned 0x0 [0050.546] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.546] GetLastError () returned 0x0 [0050.547] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffc7ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.547] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x3801, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x3801, lpOverlapped=0x0) returned 1 [0050.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.548] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.548] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.548] CloseHandle (hObject=0x100) returned 1 [0050.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.549] GetLastError () returned 0x0 [0050.550] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.550] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.550] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.551] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17055165582) returned 1 [0050.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf19290, dwHighDateTime=0x1d585b4)) [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d5e0 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d5e0 | out: hHeap=0x260000) returned 1 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751528 [0050.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.551] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.551] GetLastError () returned 0x0 [0050.551] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.551] GetLastError () returned 0x0 [0050.553] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffec99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.553] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x1367, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1367, lpOverlapped=0x0) returned 1 [0050.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.553] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.553] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.553] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.554] CloseHandle (hObject=0x100) returned 1 [0050.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.554] GetLastError () returned 0x0 [0050.555] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.555] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.555] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.556] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17055675171) returned 1 [0050.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf19290, dwHighDateTime=0x1d585b4)) [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d618 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d618 | out: hHeap=0x260000) returned 1 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27518b8 [0050.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.556] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.556] GetLastError () returned 0x0 [0050.556] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.556] GetLastError () returned 0x0 [0050.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff0c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.558] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0xf40, lpOverlapped=0x0) returned 1 [0050.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.558] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.558] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.558] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.559] CloseHandle (hObject=0x100) returned 1 [0050.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.[deadmin@cock.li].deadmin")) returned 1 [0050.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.560] GetLastError () returned 0x0 [0050.560] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.561] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.561] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17056253117) returned 1 [0050.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf3f3f0, dwHighDateTime=0x1d585b4)) [0050.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d650 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d650 | out: hHeap=0x260000) returned 1 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751950 [0050.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.562] GetLastError () returned 0x0 [0050.562] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.562] GetLastError () returned 0x0 [0050.564] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffba42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.564] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x45be, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x45be, lpOverlapped=0x0) returned 1 [0050.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.564] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.564] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.565] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.565] CloseHandle (hObject=0x100) returned 1 [0050.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.566] GetLastError () returned 0x0 [0050.566] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.567] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.567] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.567] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17056817163) returned 1 [0050.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf3f3f0, dwHighDateTime=0x1d585b4)) [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d688 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d688 | out: hHeap=0x260000) returned 1 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27519e8 [0050.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.568] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.568] GetLastError () returned 0x0 [0050.568] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.568] GetLastError () returned 0x0 [0050.569] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffba42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.569] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x45be, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x45be, lpOverlapped=0x0) returned 1 [0050.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.570] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.570] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.570] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.570] CloseHandle (hObject=0x100) returned 1 [0050.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.571] GetLastError () returned 0x0 [0050.572] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.573] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.573] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.573] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17057396030) returned 1 [0050.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf3f3f0, dwHighDateTime=0x1d585b4)) [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d6c0 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d6c0 | out: hHeap=0x260000) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751a80 [0050.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.573] GetLastError () returned 0x0 [0050.574] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.574] GetLastError () returned 0x0 [0050.576] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffecc08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.576] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x133f8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x133f8, lpOverlapped=0x0) returned 1 [0050.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.577] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.577] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.577] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.577] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.577] CloseHandle (hObject=0x100) returned 1 [0050.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.577] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.578] GetLastError () returned 0x0 [0050.578] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.579] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.579] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.579] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17058026738) returned 1 [0050.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xacf65550, dwHighDateTime=0x1d585b4)) [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d6f8 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d6f8 | out: hHeap=0x260000) returned 1 [0050.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751b18 [0050.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.580] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.580] GetLastError () returned 0x0 [0050.580] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.580] GetLastError () returned 0x0 [0050.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.680] WriteFile (in: hFile=0x100, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0050.691] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.691] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.691] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.691] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.692] CloseHandle (hObject=0x100) returned 1 [0050.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.692] GetLastError () returned 0x0 [0050.826] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.827] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.827] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.827] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17082811629) returned 1 [0050.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad1c6b50, dwHighDateTime=0x1d585b4)) [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dd20 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dd20 | out: hHeap=0x260000) returned 1 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752e08 [0050.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.828] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.828] GetLastError () returned 0x0 [0050.828] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.828] GetLastError () returned 0x0 [0050.837] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff506c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.837] WriteFile (in: hFile=0x118, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xaf94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xaf94, lpOverlapped=0x0) returned 1 [0050.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.838] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.838] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.839] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.839] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.839] CloseHandle (hObject=0x118) returned 1 [0050.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.872] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.873] GetLastError () returned 0x0 [0050.873] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.874] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.874] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.875] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17087574493) returned 1 [0050.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad238f70, dwHighDateTime=0x1d585b4)) [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32de38 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32de38 | out: hHeap=0x260000) returned 1 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27526e8 [0050.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.875] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.876] GetLastError () returned 0x0 [0050.876] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.876] GetLastError () returned 0x0 [0050.886] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc5ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.886] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3a14, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x3a14, lpOverlapped=0x0) returned 1 [0050.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.886] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.887] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.887] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.887] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.888] CloseHandle (hObject=0x104) returned 1 [0050.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.889] GetLastError () returned 0x0 [0050.920] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.921] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.921] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.922] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17092268780) returned 1 [0050.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad2ab390, dwHighDateTime=0x1d585b4)) [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32df88 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32df88 | out: hHeap=0x260000) returned 1 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753490 [0050.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.922] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.922] GetLastError () returned 0x0 [0050.923] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.923] GetLastError () returned 0x0 [0050.925] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe750, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.925] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x18b0, lpOverlapped=0x0) returned 1 [0050.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.925] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.925] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.926] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.926] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.926] CloseHandle (hObject=0x104) returned 1 [0050.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.928] GetLastError () returned 0x0 [0050.928] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0050.929] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.929] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.929] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17093043907) returned 1 [0050.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad2ab390, dwHighDateTime=0x1d585b4)) [0050.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dfc0 [0050.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dfc0 | out: hHeap=0x260000) returned 1 [0050.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27532c8 [0050.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.930] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0050.930] GetLastError () returned 0x0 [0050.930] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0050.930] GetLastError () returned 0x0 [0051.065] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff4ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.065] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xb54, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xb54, lpOverlapped=0x0) returned 1 [0051.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.066] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.066] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.066] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.066] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.066] CloseHandle (hObject=0x104) returned 1 [0051.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.068] GetLastError () returned 0x0 [0051.068] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.069] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.069] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.069] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17106999972) returned 1 [0051.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad401ff0, dwHighDateTime=0x1d585b4)) [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e378 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e378 | out: hHeap=0x260000) returned 1 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a070 [0051.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.070] GetLastError () returned 0x0 [0051.070] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.070] GetLastError () returned 0x0 [0051.071] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffebdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.071] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1424, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1424, lpOverlapped=0x0) returned 1 [0051.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.072] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.072] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.072] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.072] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.072] CloseHandle (hObject=0x104) returned 1 [0051.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.073] GetLastError () returned 0x0 [0051.074] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.075] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.075] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.075] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17107612140) returned 1 [0051.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad428150, dwHighDateTime=0x1d585b4)) [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e3b0 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e3b0 | out: hHeap=0x260000) returned 1 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a1a0 [0051.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.076] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.076] GetLastError () returned 0x0 [0051.076] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.076] GetLastError () returned 0x0 [0051.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.077] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1560, lpOverlapped=0x0) returned 1 [0051.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.078] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.078] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.078] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.078] CloseHandle (hObject=0x104) returned 1 [0051.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.079] GetLastError () returned 0x0 [0051.080] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.081] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.081] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.081] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17108185622) returned 1 [0051.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad428150, dwHighDateTime=0x1d585b4)) [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e3e8 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e3e8 | out: hHeap=0x260000) returned 1 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a238 [0051.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.081] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.081] GetLastError () returned 0x0 [0051.081] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.082] GetLastError () returned 0x0 [0051.083] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffefcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.083] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1034, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1034, lpOverlapped=0x0) returned 1 [0051.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.083] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.083] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.084] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.084] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.084] CloseHandle (hObject=0x104) returned 1 [0051.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.085] GetLastError () returned 0x0 [0051.085] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.086] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.086] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17108702554) returned 1 [0051.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad428150, dwHighDateTime=0x1d585b4)) [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e420 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e420 | out: hHeap=0x260000) returned 1 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a2d0 [0051.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.087] GetLastError () returned 0x0 [0051.087] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.087] GetLastError () returned 0x0 [0051.088] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff4a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.088] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xb60, lpOverlapped=0x0) returned 1 [0051.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.088] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.089] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.089] CloseHandle (hObject=0x104) returned 1 [0051.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.090] GetLastError () returned 0x0 [0051.090] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.091] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.091] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.091] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17109223804) returned 1 [0051.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad44e2b0, dwHighDateTime=0x1d585b4)) [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e458 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e458 | out: hHeap=0x260000) returned 1 [0051.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a368 [0051.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.092] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.092] GetLastError () returned 0x0 [0051.092] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.092] GetLastError () returned 0x0 [0051.093] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff83bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.093] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x7c44, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c44, lpOverlapped=0x0) returned 1 [0051.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.094] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.094] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.094] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.094] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.094] CloseHandle (hObject=0x104) returned 1 [0051.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.095] GetLastError () returned 0x0 [0051.096] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.096] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.096] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.097] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17109765434) returned 1 [0051.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad44e2b0, dwHighDateTime=0x1d585b4)) [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e490 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e490 | out: hHeap=0x260000) returned 1 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a400 [0051.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.097] GetLastError () returned 0x0 [0051.097] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.097] GetLastError () returned 0x0 [0051.099] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbc4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.099] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x43b4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x43b4, lpOverlapped=0x0) returned 1 [0051.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.099] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.099] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.099] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.099] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.100] CloseHandle (hObject=0x104) returned 1 [0051.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.103] GetLastError () returned 0x0 [0051.104] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.104] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.104] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.104] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17110557605) returned 1 [0051.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad44e2b0, dwHighDateTime=0x1d585b4)) [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e4c8 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e4c8 | out: hHeap=0x260000) returned 1 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a498 [0051.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.105] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.105] GetLastError () returned 0x0 [0051.105] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.105] GetLastError () returned 0x0 [0051.350] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe328, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.350] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1cd8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1cd8, lpOverlapped=0x0) returned 1 [0051.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.350] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.350] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.350] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.350] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.351] CloseHandle (hObject=0x104) returned 1 [0051.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.352] GetLastError () returned 0x0 [0051.352] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.352] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.353] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.353] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17135378646) returned 1 [0051.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad6af8b0, dwHighDateTime=0x1d585b4)) [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8370 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8370 | out: hHeap=0x260000) returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a530 [0051.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.353] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.353] GetLastError () returned 0x0 [0051.353] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.353] GetLastError () returned 0x0 [0051.355] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff9634, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.355] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x69cc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x69cc, lpOverlapped=0x0) returned 1 [0051.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.356] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.356] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.356] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.356] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.356] CloseHandle (hObject=0x104) returned 1 [0051.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.357] GetLastError () returned 0x0 [0051.358] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.358] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.358] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17135962818) returned 1 [0051.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad6d5a10, dwHighDateTime=0x1d585b4)) [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7dc0 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7dc0 | out: hHeap=0x260000) returned 1 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b110 [0051.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.359] GetLastError () returned 0x0 [0051.359] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.359] GetLastError () returned 0x0 [0051.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff4304, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.361] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xbcfc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xbcfc, lpOverlapped=0x0) returned 1 [0051.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.361] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.362] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.362] CloseHandle (hObject=0x104) returned 1 [0051.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.363] GetLastError () returned 0x0 [0051.363] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.364] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.364] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.364] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17136519217) returned 1 [0051.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad6d5a10, dwHighDateTime=0x1d585b4)) [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7d88 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d88 | out: hHeap=0x260000) returned 1 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b1a8 [0051.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.365] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.365] GetLastError () returned 0x0 [0051.365] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.365] GetLastError () returned 0x0 [0051.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff42fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.367] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xbd04, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xbd04, lpOverlapped=0x0) returned 1 [0051.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.368] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.369] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.369] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.369] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.369] CloseHandle (hObject=0x104) returned 1 [0051.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.370] GetLastError () returned 0x0 [0051.371] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.372] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.372] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17137280364) returned 1 [0051.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad6fbb70, dwHighDateTime=0x1d585b4)) [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7d50 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d50 | out: hHeap=0x260000) returned 1 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b240 [0051.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.372] GetLastError () returned 0x0 [0051.372] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.372] GetLastError () returned 0x0 [0051.375] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbcd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.375] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x4330, lpOverlapped=0x0) returned 1 [0051.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.375] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.375] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.376] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.376] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.376] CloseHandle (hObject=0x104) returned 1 [0051.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.377] GetLastError () returned 0x0 [0051.377] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.378] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.378] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.378] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17137913909) returned 1 [0051.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad6fbb70, dwHighDateTime=0x1d585b4)) [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7d18 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d18 | out: hHeap=0x260000) returned 1 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b2d8 [0051.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.379] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.379] GetLastError () returned 0x0 [0051.379] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.379] GetLastError () returned 0x0 [0051.380] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc56c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.380] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3a94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x3a94, lpOverlapped=0x0) returned 1 [0051.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0051.381] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.381] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.381] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.381] CloseHandle (hObject=0x104) returned 1 [0051.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.382] GetLastError () returned 0x0 [0051.496] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.497] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.497] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.497] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17149804304) returned 1 [0051.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad82c670, dwHighDateTime=0x1d585b4)) [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e8b8 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e8b8 | out: hHeap=0x260000) returned 1 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b8c8 [0051.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.498] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.498] GetLastError () returned 0x0 [0051.498] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.498] GetLastError () returned 0x0 [0051.499] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb158, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.499] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x4ea8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x1cffdb0*=0x4ea8, lpOverlapped=0x0) returned 1 [0051.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.500] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.500] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.500] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.500] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.501] CloseHandle (hObject=0x118) returned 1 [0051.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.574] GetLastError () returned 0x0 [0051.574] RtlWakeConditionVariable () returned 0x27e828 [0051.574] GetCurrentThreadId () returned 0x998 [0051.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".ldf") returned 0x0 [0051.575] lstrlenW (lpString=".vhd") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".vhd") returned 0x0 [0051.575] lstrlenW (lpString=".vhdx") returned 5 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".vhdx") returned 0x0 [0051.575] lstrlenW (lpString=".pst") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".pst") returned 0x0 [0051.575] lstrlenW (lpString=".ost") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".ost") returned 0x0 [0051.575] lstrlenW (lpString=".bak") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".bak") returned 0x0 [0051.575] lstrlenW (lpString=".bac") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".bac") returned 0x0 [0051.575] lstrlenW (lpString=".sys") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".sys") returned 0x0 [0051.575] lstrlenW (lpString=".v2i") returned 4 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".v2i") returned 0x0 [0051.575] lstrlenW (lpString="s\r\n.v2i") returned 7 [0051.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch="s\r\n.v2i") returned 0x0 [0051.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0051.576] lstrlenW (lpString=".sql") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".sql") returned 0x0 [0051.576] lstrlenW (lpString=".mdf") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".mdf") returned 0x0 [0051.576] lstrlenW (lpString=".txt") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".txt") returned 0x0 [0051.576] lstrlenW (lpString=".dbf") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".dbf") returned 0x0 [0051.576] lstrlenW (lpString=".ckp") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".ckp") returned 0x0 [0051.576] lstrlenW (lpString=".dacpac") returned 7 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".dacpac") returned 0x0 [0051.576] lstrlenW (lpString=".db3") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".db3") returned 0x0 [0051.576] lstrlenW (lpString=".dtxs") returned 5 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".dtxs") returned 0x0 [0051.576] lstrlenW (lpString=".mdt") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".mdt") returned 0x0 [0051.576] lstrlenW (lpString=".sdf") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".sdf") returned 0x0 [0051.576] lstrlenW (lpString=".MDF") returned 4 [0051.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".MDF") returned 0x0 [0051.577] lstrlenW (lpString=".DBF") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".DBF") returned 0x0 [0051.577] lstrlenW (lpString=".DB") returned 3 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".DB") returned 0x0 [0051.577] lstrlenW (lpString=".db") returned 3 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".db") returned 0x0 [0051.577] lstrlenW (lpString=".ndf") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".ndf") returned 0x0 [0051.577] lstrlenW (lpString=".NDF") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".NDF") returned 0x0 [0051.577] lstrlenW (lpString=".Mdf") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".Mdf") returned 0x0 [0051.577] lstrlenW (lpString=".dat") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".dat") returned 0x0 [0051.577] lstrlenW (lpString=".DAT") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".DAT") returned 0x0 [0051.577] lstrlenW (lpString=".ldf") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".ldf") returned 0x0 [0051.577] lstrlenW (lpString=".LDF") returned 4 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch=".LDF") returned 0x0 [0051.577] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0051.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0051.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a578 [0051.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0051.578] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.578] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.578] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.579] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17157967761) returned 1 [0051.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad8ead50, dwHighDateTime=0x1d585b4)) [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e9d0 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0051.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e9d0 | out: hHeap=0x260000) returned 1 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0051.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0051.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b408 [0051.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.579] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.579] GetLastError () returned 0x0 [0051.580] GetLastError () returned 0x0 [0051.580] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.580] GetLastError () returned 0x0 [0051.580] GetLastError () returned 0x0 [0051.582] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.582] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x3734, lpOverlapped=0x0) returned 1 [0051.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.582] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.582] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.582] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.582] CloseHandle (hObject=0x110) returned 1 [0051.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.583] GetLastError () returned 0x0 [0051.583] RtlWakeConditionVariable () returned 0x27e828 [0051.583] GetCurrentThreadId () returned 0x998 [0051.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".ldf") returned 0x0 [0051.583] lstrlenW (lpString=".vhd") returned 4 [0051.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".vhd") returned 0x0 [0051.583] lstrlenW (lpString=".vhdx") returned 5 [0051.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".vhdx") returned 0x0 [0051.583] lstrlenW (lpString=".pst") returned 4 [0051.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".pst") returned 0x0 [0051.583] lstrlenW (lpString=".ost") returned 4 [0051.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".ost") returned 0x0 [0051.583] lstrlenW (lpString=".bak") returned 4 [0051.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".bak") returned 0x0 [0051.583] lstrlenW (lpString=".bac") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".bac") returned 0x0 [0051.584] lstrlenW (lpString=".sys") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".sys") returned 0x0 [0051.584] lstrlenW (lpString=".v2i") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".v2i") returned 0x0 [0051.584] lstrlenW (lpString="s\r\n.v2i") returned 7 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch="s\r\n.v2i") returned 0x0 [0051.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0051.584] lstrlenW (lpString=".sql") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".sql") returned 0x0 [0051.584] lstrlenW (lpString=".mdf") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".mdf") returned 0x0 [0051.584] lstrlenW (lpString=".txt") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".txt") returned 0x0 [0051.584] lstrlenW (lpString=".dbf") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".dbf") returned 0x0 [0051.584] lstrlenW (lpString=".ckp") returned 4 [0051.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".ckp") returned 0x0 [0051.584] lstrlenW (lpString=".dacpac") returned 7 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".dacpac") returned 0x0 [0051.585] lstrlenW (lpString=".db3") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".db3") returned 0x0 [0051.585] lstrlenW (lpString=".dtxs") returned 5 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".dtxs") returned 0x0 [0051.585] lstrlenW (lpString=".mdt") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".mdt") returned 0x0 [0051.585] lstrlenW (lpString=".sdf") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".sdf") returned 0x0 [0051.585] lstrlenW (lpString=".MDF") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".MDF") returned 0x0 [0051.585] lstrlenW (lpString=".DBF") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".DBF") returned 0x0 [0051.585] lstrlenW (lpString=".DB") returned 3 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".DB") returned 0x0 [0051.585] lstrlenW (lpString=".db") returned 3 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".db") returned 0x0 [0051.585] lstrlenW (lpString=".ndf") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".ndf") returned 0x0 [0051.585] lstrlenW (lpString=".NDF") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".NDF") returned 0x0 [0051.585] lstrlenW (lpString=".Mdf") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".Mdf") returned 0x0 [0051.585] lstrlenW (lpString=".dat") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".dat") returned 0x0 [0051.585] lstrlenW (lpString=".DAT") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".DAT") returned 0x0 [0051.585] lstrlenW (lpString=".ldf") returned 4 [0051.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".ldf") returned 0x0 [0051.586] lstrlenW (lpString=".LDF") returned 4 [0051.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch=".LDF") returned 0x0 [0051.586] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0051.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0051.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a578 [0051.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0051.586] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.586] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.587] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17158776054) returned 1 [0051.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad8ead50, dwHighDateTime=0x1d585b4)) [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ea08 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0051.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ea08 | out: hHeap=0x260000) returned 1 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0051.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0051.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bc58 [0051.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.587] GetLastError () returned 0x0 [0051.587] GetLastError () returned 0x0 [0051.588] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.588] GetLastError () returned 0x0 [0051.588] GetLastError () returned 0x0 [0051.589] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcb84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.589] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x347c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x347c, lpOverlapped=0x0) returned 1 [0051.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.589] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.589] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.590] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.590] CloseHandle (hObject=0x110) returned 1 [0051.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.590] GetLastError () returned 0x0 [0051.591] RtlWakeConditionVariable () returned 0x27e828 [0051.591] GetCurrentThreadId () returned 0x998 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".ldf") returned 0x0 [0051.591] lstrlenW (lpString=".vhd") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".vhd") returned 0x0 [0051.591] lstrlenW (lpString=".vhdx") returned 5 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".vhdx") returned 0x0 [0051.591] lstrlenW (lpString=".pst") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".pst") returned 0x0 [0051.591] lstrlenW (lpString=".ost") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".ost") returned 0x0 [0051.591] lstrlenW (lpString=".bak") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".bak") returned 0x0 [0051.591] lstrlenW (lpString=".bac") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".bac") returned 0x0 [0051.591] lstrlenW (lpString=".sys") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".sys") returned 0x0 [0051.591] lstrlenW (lpString=".v2i") returned 4 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".v2i") returned 0x0 [0051.591] lstrlenW (lpString="s\r\n.v2i") returned 7 [0051.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch="s\r\n.v2i") returned 0x0 [0051.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0051.592] lstrlenW (lpString=".sql") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".sql") returned 0x0 [0051.592] lstrlenW (lpString=".mdf") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".mdf") returned 0x0 [0051.592] lstrlenW (lpString=".txt") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".txt") returned 0x0 [0051.592] lstrlenW (lpString=".dbf") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".dbf") returned 0x0 [0051.592] lstrlenW (lpString=".ckp") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".ckp") returned 0x0 [0051.592] lstrlenW (lpString=".dacpac") returned 7 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".dacpac") returned 0x0 [0051.592] lstrlenW (lpString=".db3") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".db3") returned 0x0 [0051.592] lstrlenW (lpString=".dtxs") returned 5 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".dtxs") returned 0x0 [0051.592] lstrlenW (lpString=".mdt") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".mdt") returned 0x0 [0051.592] lstrlenW (lpString=".sdf") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".sdf") returned 0x0 [0051.592] lstrlenW (lpString=".MDF") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".MDF") returned 0x0 [0051.592] lstrlenW (lpString=".DBF") returned 4 [0051.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".DBF") returned 0x0 [0051.593] lstrlenW (lpString=".DB") returned 3 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".DB") returned 0x0 [0051.593] lstrlenW (lpString=".db") returned 3 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".db") returned 0x0 [0051.593] lstrlenW (lpString=".ndf") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".ndf") returned 0x0 [0051.593] lstrlenW (lpString=".NDF") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".NDF") returned 0x0 [0051.593] lstrlenW (lpString=".Mdf") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".Mdf") returned 0x0 [0051.593] lstrlenW (lpString=".dat") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".dat") returned 0x0 [0051.593] lstrlenW (lpString=".DAT") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".DAT") returned 0x0 [0051.593] lstrlenW (lpString=".ldf") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".ldf") returned 0x0 [0051.593] lstrlenW (lpString=".LDF") returned 4 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch=".LDF") returned 0x0 [0051.593] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0051.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0051.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a578 [0051.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0051.593] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.594] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.594] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.594] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17159532759) returned 1 [0051.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad910eb0, dwHighDateTime=0x1d585b4)) [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ea40 [0051.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0051.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ea40 | out: hHeap=0x260000) returned 1 [0051.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0051.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0051.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0051.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bcf0 [0051.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.595] GetLastError () returned 0x0 [0051.595] GetLastError () returned 0x0 [0051.595] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.595] GetLastError () returned 0x0 [0051.595] GetLastError () returned 0x0 [0051.597] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcfec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.597] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3014, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x3014, lpOverlapped=0x0) returned 1 [0051.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.597] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.597] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.597] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.597] CloseHandle (hObject=0x110) returned 1 [0051.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.598] GetLastError () returned 0x0 [0051.598] RtlWakeConditionVariable () returned 0x27e828 [0051.598] GetCurrentThreadId () returned 0x998 [0051.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".ldf") returned 0x0 [0051.598] lstrlenW (lpString=".vhd") returned 4 [0051.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".vhd") returned 0x0 [0051.598] lstrlenW (lpString=".vhdx") returned 5 [0051.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".vhdx") returned 0x0 [0051.598] lstrlenW (lpString=".pst") returned 4 [0051.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".pst") returned 0x0 [0051.599] lstrlenW (lpString=".ost") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".ost") returned 0x0 [0051.599] lstrlenW (lpString=".bak") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".bak") returned 0x0 [0051.599] lstrlenW (lpString=".bac") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".bac") returned 0x0 [0051.599] lstrlenW (lpString=".sys") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".sys") returned 0x0 [0051.599] lstrlenW (lpString=".v2i") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".v2i") returned 0x0 [0051.599] lstrlenW (lpString="s\r\n.v2i") returned 7 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch="s\r\n.v2i") returned 0x0 [0051.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0051.599] lstrlenW (lpString=".sql") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".sql") returned 0x0 [0051.599] lstrlenW (lpString=".mdf") returned 4 [0051.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".mdf") returned 0x0 [0051.599] lstrlenW (lpString=".txt") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".txt") returned 0x0 [0051.600] lstrlenW (lpString=".dbf") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".dbf") returned 0x0 [0051.600] lstrlenW (lpString=".ckp") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".ckp") returned 0x0 [0051.600] lstrlenW (lpString=".dacpac") returned 7 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".dacpac") returned 0x0 [0051.600] lstrlenW (lpString=".db3") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".db3") returned 0x0 [0051.600] lstrlenW (lpString=".dtxs") returned 5 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".dtxs") returned 0x0 [0051.600] lstrlenW (lpString=".mdt") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".mdt") returned 0x0 [0051.600] lstrlenW (lpString=".sdf") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".sdf") returned 0x0 [0051.600] lstrlenW (lpString=".MDF") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".MDF") returned 0x0 [0051.600] lstrlenW (lpString=".DBF") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".DBF") returned 0x0 [0051.600] lstrlenW (lpString=".DB") returned 3 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".DB") returned 0x0 [0051.600] lstrlenW (lpString=".db") returned 3 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".db") returned 0x0 [0051.600] lstrlenW (lpString=".ndf") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".ndf") returned 0x0 [0051.600] lstrlenW (lpString=".NDF") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".NDF") returned 0x0 [0051.600] lstrlenW (lpString=".Mdf") returned 4 [0051.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".Mdf") returned 0x0 [0051.600] lstrlenW (lpString=".dat") returned 4 [0051.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".dat") returned 0x0 [0051.601] lstrlenW (lpString=".DAT") returned 4 [0051.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".DAT") returned 0x0 [0051.601] lstrlenW (lpString=".ldf") returned 4 [0051.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".ldf") returned 0x0 [0051.601] lstrlenW (lpString=".LDF") returned 4 [0051.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch=".LDF") returned 0x0 [0051.601] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0051.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0051.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a578 [0051.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0051.601] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.602] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.602] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17160296430) returned 1 [0051.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xad910eb0, dwHighDateTime=0x1d585b4)) [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ea78 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0051.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ea78 | out: hHeap=0x260000) returned 1 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0051.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0051.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bd88 [0051.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.602] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.603] GetLastError () returned 0x0 [0051.603] GetLastError () returned 0x0 [0051.603] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.603] GetLastError () returned 0x0 [0051.603] GetLastError () returned 0x0 [0051.629] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff664, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.629] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x99c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x99c, lpOverlapped=0x0) returned 1 [0051.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.631] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.631] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.631] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.631] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.631] CloseHandle (hObject=0x110) returned 1 [0051.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.711] GetLastError () returned 0x0 [0051.711] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.712] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.712] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.712] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17171320224) returned 1 [0051.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xada1b850, dwHighDateTime=0x1d585b4)) [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299590 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299590 | out: hHeap=0x260000) returned 1 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0051.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.713] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.713] GetLastError () returned 0x0 [0051.713] GetLastError () returned 0x0 [0051.713] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.713] GetLastError () returned 0x0 [0051.713] GetLastError () returned 0x0 [0051.724] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffec2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.724] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x13d4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x13d4, lpOverlapped=0x0) returned 1 [0051.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.724] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.724] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.725] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.725] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.725] CloseHandle (hObject=0x118) returned 1 [0051.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.726] GetLastError () returned 0x0 [0051.743] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.744] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.744] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.744] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17174521789) returned 1 [0051.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xada67b10, dwHighDateTime=0x1d585b4)) [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299440 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299440 | out: hHeap=0x260000) returned 1 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297698 [0051.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.745] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.745] GetLastError () returned 0x0 [0051.745] GetLastError () returned 0x0 [0051.745] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.745] GetLastError () returned 0x0 [0051.745] GetLastError () returned 0x0 [0051.747] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffa388, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.747] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5c78, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x5c78, lpOverlapped=0x0) returned 1 [0051.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.747] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.747] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.748] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.748] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.748] CloseHandle (hObject=0x108) returned 1 [0051.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0051.748] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0051.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.749] GetLastError () returned 0x0 [0051.749] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.750] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.750] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.750] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17175112239) returned 1 [0051.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xada8dc70, dwHighDateTime=0x1d585b4)) [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299408 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299408 | out: hHeap=0x260000) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296c80 [0051.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.751] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.751] GetLastError () returned 0x0 [0051.751] GetLastError () returned 0x0 [0051.751] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.751] GetLastError () returned 0x0 [0051.751] GetLastError () returned 0x0 [0051.752] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe0e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.753] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1f1c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f1c, lpOverlapped=0x0) returned 1 [0051.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.753] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.753] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.753] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.753] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.754] CloseHandle (hObject=0x108) returned 1 [0051.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0051.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0051.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.755] GetLastError () returned 0x0 [0051.755] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.756] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.756] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.756] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17175689720) returned 1 [0051.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xada8dc70, dwHighDateTime=0x1d585b4)) [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2993d0 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2993d0 | out: hHeap=0x260000) returned 1 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297010 [0051.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.756] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.756] GetLastError () returned 0x0 [0051.757] GetLastError () returned 0x0 [0051.757] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.757] GetLastError () returned 0x0 [0051.757] GetLastError () returned 0x0 [0051.758] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbf34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.759] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x40cc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x40cc, lpOverlapped=0x0) returned 1 [0051.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.759] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.759] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.759] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.759] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.760] CloseHandle (hObject=0x108) returned 1 [0051.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0051.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0051.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.760] GetLastError () returned 0x0 [0051.761] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.762] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.762] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.762] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17176292411) returned 1 [0051.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadab3dd0, dwHighDateTime=0x1d585b4)) [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299398 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299398 | out: hHeap=0x260000) returned 1 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2961d0 [0051.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.762] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.762] GetLastError () returned 0x0 [0051.763] GetLastError () returned 0x0 [0051.763] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.763] GetLastError () returned 0x0 [0051.763] GetLastError () returned 0x0 [0051.764] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd31c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.764] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2ce4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ce4, lpOverlapped=0x0) returned 1 [0051.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.765] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.765] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.765] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.765] CloseHandle (hObject=0x108) returned 1 [0051.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0051.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0051.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.766] GetLastError () returned 0x0 [0051.767] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.767] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.768] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17176864116) returned 1 [0051.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadab3dd0, dwHighDateTime=0x1d585b4)) [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299360 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299360 | out: hHeap=0x260000) returned 1 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296430 [0051.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.768] GetLastError () returned 0x0 [0051.768] GetLastError () returned 0x0 [0051.768] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.768] GetLastError () returned 0x0 [0051.769] GetLastError () returned 0x0 [0051.770] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8980, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.770] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7680, lpOverlapped=0x0) returned 1 [0051.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.773] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.773] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.774] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.774] CloseHandle (hObject=0x108) returned 1 [0051.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0051.775] GetLastError () returned 0x0 [0051.776] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.777] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.777] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17177830004) returned 1 [0051.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadad9f30, dwHighDateTime=0x1d585b4)) [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299328 [0051.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299328 | out: hHeap=0x260000) returned 1 [0051.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296398 [0051.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.778] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.778] GetLastError () returned 0x0 [0051.778] GetLastError () returned 0x0 [0051.778] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.778] GetLastError () returned 0x0 [0051.778] GetLastError () returned 0x0 [0051.780] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffecc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.780] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1338, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1338, lpOverlapped=0x0) returned 1 [0051.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.780] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.780] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.780] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.781] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.781] CloseHandle (hObject=0x108) returned 1 [0051.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.782] GetLastError () returned 0x0 [0051.783] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.784] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.784] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.784] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17178484682) returned 1 [0051.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadad9f30, dwHighDateTime=0x1d585b4)) [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992f0 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992f0 | out: hHeap=0x260000) returned 1 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0051.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.784] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.784] GetLastError () returned 0x0 [0051.785] GetLastError () returned 0x0 [0051.785] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.785] GetLastError () returned 0x0 [0051.785] GetLastError () returned 0x0 [0051.786] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffad20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.786] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x52e0, lpOverlapped=0x0) returned 1 [0051.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.787] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.787] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.787] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.787] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.787] CloseHandle (hObject=0x108) returned 1 [0051.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.788] GetLastError () returned 0x0 [0051.788] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.789] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.789] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.789] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17179054325) returned 1 [0051.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadad9f30, dwHighDateTime=0x1d585b4)) [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992b8 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992b8 | out: hHeap=0x260000) returned 1 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0051.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.790] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.790] GetLastError () returned 0x0 [0051.790] GetLastError () returned 0x0 [0051.790] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.790] GetLastError () returned 0x0 [0051.790] GetLastError () returned 0x0 [0051.792] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff174, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.792] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xe8c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xe8c, lpOverlapped=0x0) returned 1 [0051.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.792] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.793] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.793] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.793] CloseHandle (hObject=0x108) returned 1 [0051.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.794] GetLastError () returned 0x0 [0051.795] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.795] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.795] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.795] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17179660159) returned 1 [0051.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadb00090, dwHighDateTime=0x1d585b4)) [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299280 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299280 | out: hHeap=0x260000) returned 1 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296560 [0051.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.796] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.796] GetLastError () returned 0x0 [0051.796] GetLastError () returned 0x0 [0051.796] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.796] GetLastError () returned 0x0 [0051.797] GetLastError () returned 0x0 [0051.798] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff210, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.798] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xdf0, lpOverlapped=0x0) returned 1 [0051.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.799] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.799] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.799] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.799] CloseHandle (hObject=0x108) returned 1 [0051.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.800] GetLastError () returned 0x0 [0051.800] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.801] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.801] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.801] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17180247302) returned 1 [0051.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadb00090, dwHighDateTime=0x1d585b4)) [0051.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299248 [0051.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299248 | out: hHeap=0x260000) returned 1 [0051.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0051.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.802] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.802] GetLastError () returned 0x0 [0051.802] GetLastError () returned 0x0 [0051.802] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.802] GetLastError () returned 0x0 [0051.802] GetLastError () returned 0x0 [0051.804] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffda74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.804] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x258c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x258c, lpOverlapped=0x0) returned 1 [0051.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.804] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.805] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.805] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.805] CloseHandle (hObject=0x108) returned 1 [0051.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.805] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.806] GetLastError () returned 0x0 [0051.806] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.807] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.807] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.807] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17180814275) returned 1 [0051.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadb00090, dwHighDateTime=0x1d585b4)) [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991d8 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991d8 | out: hHeap=0x260000) returned 1 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0051.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.808] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.808] GetLastError () returned 0x0 [0051.808] GetLastError () returned 0x0 [0051.808] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.808] GetLastError () returned 0x0 [0051.808] GetLastError () returned 0x0 [0051.810] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffec8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.810] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1374, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1374, lpOverlapped=0x0) returned 1 [0051.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.810] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.810] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.810] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.811] CloseHandle (hObject=0x108) returned 1 [0051.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.812] GetLastError () returned 0x0 [0051.824] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.825] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.825] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.825] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17182652689) returned 1 [0051.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadb4c350, dwHighDateTime=0x1d585b4)) [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991a0 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991a0 | out: hHeap=0x260000) returned 1 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2974d0 [0051.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.826] GetLastError () returned 0x0 [0051.826] GetLastError () returned 0x0 [0051.826] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.826] GetLastError () returned 0x0 [0051.827] GetLastError () returned 0x0 [0051.828] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff420, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.828] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xbe0, lpOverlapped=0x0) returned 1 [0051.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.829] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.829] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.829] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.829] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.830] CloseHandle (hObject=0x108) returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.831] GetLastError () returned 0x0 [0051.831] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.832] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.832] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.832] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17183298293) returned 1 [0051.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadb4c350, dwHighDateTime=0x1d585b4)) [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294a30 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a30 | out: hHeap=0x260000) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2964c8 [0051.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.832] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.833] GetLastError () returned 0x0 [0051.833] GetLastError () returned 0x0 [0051.833] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.833] GetLastError () returned 0x0 [0051.833] GetLastError () returned 0x0 [0051.945] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe0c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.945] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f40, lpOverlapped=0x0) returned 1 [0051.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.947] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.947] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.947] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.947] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.948] CloseHandle (hObject=0x108) returned 1 [0051.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.949] GetLastError () returned 0x0 [0051.949] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.950] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.950] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.950] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17195118975) returned 1 [0051.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadc7ce50, dwHighDateTime=0x1d585b4)) [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2effc8 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2effc8 | out: hHeap=0x260000) returned 1 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a2d8 [0051.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.951] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.951] GetLastError () returned 0x0 [0051.951] GetLastError () returned 0x0 [0051.951] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.951] GetLastError () returned 0x0 [0051.951] GetLastError () returned 0x0 [0051.954] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdfbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.954] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2044, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2044, lpOverlapped=0x0) returned 1 [0051.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.954] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.954] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.954] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.954] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.955] CloseHandle (hObject=0x108) returned 1 [0051.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.956] GetLastError () returned 0x0 [0051.956] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.957] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.957] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17195785921) returned 1 [0051.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadc7ce50, dwHighDateTime=0x1d585b4)) [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0000 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0000 | out: hHeap=0x260000) returned 1 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a4a0 [0051.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.957] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.957] GetLastError () returned 0x0 [0051.958] GetLastError () returned 0x0 [0051.958] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.958] GetLastError () returned 0x0 [0051.958] GetLastError () returned 0x0 [0051.959] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe498, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.959] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1b68, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1b68, lpOverlapped=0x0) returned 1 [0051.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.960] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.960] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.960] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.960] CloseHandle (hObject=0x108) returned 1 [0051.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.961] GetLastError () returned 0x0 [0051.961] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.962] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.962] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.962] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17196352480) returned 1 [0051.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadc7ce50, dwHighDateTime=0x1d585b4)) [0051.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0038 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0038 | out: hHeap=0x260000) returned 1 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a538 [0051.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.963] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.963] GetLastError () returned 0x0 [0051.963] GetLastError () returned 0x0 [0051.963] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.963] GetLastError () returned 0x0 [0051.963] GetLastError () returned 0x0 [0051.965] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffea8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.965] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1574, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1574, lpOverlapped=0x0) returned 1 [0051.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.965] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.966] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.966] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.966] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.966] CloseHandle (hObject=0x108) returned 1 [0051.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.969] GetLastError () returned 0x0 [0051.969] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.970] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.970] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17197147638) returned 1 [0051.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadca2fb0, dwHighDateTime=0x1d585b4)) [0051.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0070 [0051.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0070 | out: hHeap=0x260000) returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a5d0 [0051.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.971] GetLastError () returned 0x0 [0051.971] GetLastError () returned 0x0 [0051.971] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.971] GetLastError () returned 0x0 [0051.971] GetLastError () returned 0x0 [0051.973] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff40c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.973] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xbf4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xbf4, lpOverlapped=0x0) returned 1 [0051.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.973] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.973] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.974] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.974] CloseHandle (hObject=0x108) returned 1 [0051.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.975] GetLastError () returned 0x0 [0051.975] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0051.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.976] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0051.976] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17197711330) returned 1 [0051.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadca2fb0, dwHighDateTime=0x1d585b4)) [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd98 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd98 | out: hHeap=0x260000) returned 1 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a668 [0051.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0051.977] GetLastError () returned 0x0 [0051.977] GetLastError () returned 0x0 [0051.977] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0051.977] GetLastError () returned 0x0 [0051.977] GetLastError () returned 0x0 [0052.018] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff3bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.018] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xc44, lpOverlapped=0x0) returned 1 [0052.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.018] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.018] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.019] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.019] CloseHandle (hObject=0x108) returned 1 [0052.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.058] GetLastError () returned 0x0 [0052.058] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.059] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.059] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.059] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17206034333) returned 1 [0052.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadd877f0, dwHighDateTime=0x1d585b4)) [0052.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f80 [0052.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f80 | out: hHeap=0x260000) returned 1 [0052.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27560f8 [0052.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.060] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.060] GetLastError () returned 0x0 [0052.060] GetLastError () returned 0x0 [0052.060] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.061] GetLastError () returned 0x0 [0052.061] GetLastError () returned 0x0 [0052.063] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff8396, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.063] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7c6a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c6a, lpOverlapped=0x0) returned 1 [0052.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.064] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.064] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.064] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.064] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.065] CloseHandle (hObject=0x118) returned 1 [0052.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.066] GetLastError () returned 0x0 [0052.066] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.067] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.067] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.067] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17206855981) returned 1 [0052.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadd877f0, dwHighDateTime=0x1d585b4)) [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0fb8 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0fb8 | out: hHeap=0x260000) returned 1 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756228 [0052.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.068] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.068] GetLastError () returned 0x0 [0052.069] GetLastError () returned 0x0 [0052.069] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.069] GetLastError () returned 0x0 [0052.069] GetLastError () returned 0x0 [0052.071] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff702c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.071] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8fd4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8fd4, lpOverlapped=0x0) returned 1 [0052.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.072] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.072] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.072] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.072] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.073] CloseHandle (hObject=0x118) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.075] GetLastError () returned 0x0 [0052.076] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.077] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.077] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.077] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17207813158) returned 1 [0052.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaddad950, dwHighDateTime=0x1d585b4)) [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1028 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1028 | out: hHeap=0x260000) returned 1 [0052.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27562c0 [0052.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.078] GetLastError () returned 0x0 [0052.078] GetLastError () returned 0x0 [0052.078] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.078] GetLastError () returned 0x0 [0052.078] GetLastError () returned 0x0 [0052.081] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff7048, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.081] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8fb8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8fb8, lpOverlapped=0x0) returned 1 [0052.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.081] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.081] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.082] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.082] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.082] CloseHandle (hObject=0x118) returned 1 [0052.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.084] GetLastError () returned 0x0 [0052.085] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.086] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.086] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17208703629) returned 1 [0052.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaddad950, dwHighDateTime=0x1d585b4)) [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14c0 | out: hHeap=0x260000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756358 [0052.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.087] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.087] GetLastError () returned 0x0 [0052.087] GetLastError () returned 0x0 [0052.087] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] GetLastError () returned 0x0 [0052.089] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff75a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.089] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8a5b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8a5b, lpOverlapped=0x0) returned 1 [0052.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.090] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.090] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.090] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.090] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.091] CloseHandle (hObject=0x118) returned 1 [0052.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.092] GetLastError () returned 0x0 [0052.092] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.093] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.093] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.094] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17209478505) returned 1 [0052.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaddd3ab0, dwHighDateTime=0x1d585b4)) [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1108 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1108 | out: hHeap=0x260000) returned 1 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27563f0 [0052.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.094] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.095] GetLastError () returned 0x0 [0052.095] GetLastError () returned 0x0 [0052.095] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.095] GetLastError () returned 0x0 [0052.095] GetLastError () returned 0x0 [0052.239] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff7b5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.239] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x84a6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x84a6, lpOverlapped=0x0) returned 1 [0052.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.239] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.240] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.240] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.240] CloseHandle (hObject=0x118) returned 1 [0052.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.241] GetLastError () returned 0x0 [0052.242] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.242] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.242] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.243] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17224370415) returned 1 [0052.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadf2a710, dwHighDateTime=0x1d585b4)) [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a10d0 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a10d0 | out: hHeap=0x260000) returned 1 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756488 [0052.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.243] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.243] GetLastError () returned 0x0 [0052.243] GetLastError () returned 0x0 [0052.244] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.244] GetLastError () returned 0x0 [0052.244] GetLastError () returned 0x0 [0052.245] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffcc6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.245] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3394, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x3394, lpOverlapped=0x0) returned 1 [0052.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.246] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.246] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.246] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.246] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.247] CloseHandle (hObject=0x118) returned 1 [0052.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.248] GetLastError () returned 0x0 [0052.248] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.249] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.249] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.249] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17225020904) returned 1 [0052.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadf50870, dwHighDateTime=0x1d585b4)) [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d898 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d898 | out: hHeap=0x260000) returned 1 [0052.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756cd8 [0052.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.250] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.250] GetLastError () returned 0x0 [0052.250] GetLastError () returned 0x0 [0052.250] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.250] GetLastError () returned 0x0 [0052.250] GetLastError () returned 0x0 [0052.253] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffcbe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.253] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3418, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x3418, lpOverlapped=0x0) returned 1 [0052.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.253] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.253] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.254] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.254] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.254] CloseHandle (hObject=0x118) returned 1 [0052.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.255] GetLastError () returned 0x0 [0052.256] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.257] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.257] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.257] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17225812273) returned 1 [0052.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadf50870, dwHighDateTime=0x1d585b4)) [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d828 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d828 | out: hHeap=0x260000) returned 1 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756d70 [0052.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.258] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.258] GetLastError () returned 0x0 [0052.258] GetLastError () returned 0x0 [0052.258] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.258] GetLastError () returned 0x0 [0052.258] GetLastError () returned 0x0 [0052.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.260] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2a00, lpOverlapped=0x0) returned 1 [0052.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.260] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.261] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.261] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.261] CloseHandle (hObject=0x118) returned 1 [0052.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.261] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.262] GetLastError () returned 0x0 [0052.263] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.263] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.264] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17226476796) returned 1 [0052.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadf769d0, dwHighDateTime=0x1d585b4)) [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7f0 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7f0 | out: hHeap=0x260000) returned 1 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756e08 [0052.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.264] GetLastError () returned 0x0 [0052.265] GetLastError () returned 0x0 [0052.265] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.265] GetLastError () returned 0x0 [0052.265] GetLastError () returned 0x0 [0052.267] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff9ef4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.267] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x610c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x610c, lpOverlapped=0x0) returned 1 [0052.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.268] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.268] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.268] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.268] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.269] CloseHandle (hObject=0x118) returned 1 [0052.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.270] GetLastError () returned 0x0 [0052.271] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.271] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.271] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.272] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17227271950) returned 1 [0052.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xadf769d0, dwHighDateTime=0x1d585b4)) [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7b8 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7b8 | out: hHeap=0x260000) returned 1 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756ea0 [0052.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.272] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.272] GetLastError () returned 0x0 [0052.272] GetLastError () returned 0x0 [0052.273] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.273] GetLastError () returned 0x0 [0052.273] GetLastError () returned 0x0 [0052.315] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.316] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x3734, lpOverlapped=0x0) returned 1 [0052.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.317] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.317] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.317] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.317] CloseHandle (hObject=0x118) returned 1 [0052.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.417] GetLastError () returned 0x0 [0052.418] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.418] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.418] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.419] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17241970771) returned 1 [0052.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae0f3790, dwHighDateTime=0x1d585b4)) [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d320 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d320 | out: hHeap=0x260000) returned 1 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756f38 [0052.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.419] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.419] GetLastError () returned 0x0 [0052.419] GetLastError () returned 0x0 [0052.420] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.420] GetLastError () returned 0x0 [0052.420] GetLastError () returned 0x0 [0052.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffabc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.424] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x544, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x544, lpOverlapped=0x0) returned 1 [0052.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.424] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.425] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.425] CloseHandle (hObject=0x10c) returned 1 [0052.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.426] GetLastError () returned 0x0 [0052.427] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.428] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.428] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.428] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17242903305) returned 1 [0052.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae0f3790, dwHighDateTime=0x1d585b4)) [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d2e8 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d2e8 | out: hHeap=0x260000) returned 1 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757b18 [0052.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.429] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.429] GetLastError () returned 0x0 [0052.429] GetLastError () returned 0x0 [0052.429] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.429] GetLastError () returned 0x0 [0052.429] GetLastError () returned 0x0 [0052.431] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe368, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.431] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1c98, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c98, lpOverlapped=0x0) returned 1 [0052.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.431] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.431] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.431] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.431] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.432] CloseHandle (hObject=0x10c) returned 1 [0052.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.434] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.434] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.434] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17243523703) returned 1 [0052.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae1198f0, dwHighDateTime=0x1d585b4)) [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d470 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d470 | out: hHeap=0x260000) returned 1 [0052.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757bb0 [0052.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.435] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.435] GetLastError () returned 0x0 [0052.435] GetLastError () returned 0x0 [0052.435] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.435] GetLastError () returned 0x0 [0052.435] GetLastError () returned 0x0 [0052.437] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.437] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x4b8, lpOverlapped=0x0) returned 1 [0052.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.437] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.437] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.438] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.438] CloseHandle (hObject=0x10c) returned 1 [0052.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.439] GetLastError () returned 0x0 [0052.440] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.440] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.441] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.441] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17244181506) returned 1 [0052.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae1198f0, dwHighDateTime=0x1d585b4)) [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d438 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d438 | out: hHeap=0x260000) returned 1 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757c48 [0052.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.441] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.441] GetLastError () returned 0x0 [0052.442] GetLastError () returned 0x0 [0052.442] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.442] GetLastError () returned 0x0 [0052.442] GetLastError () returned 0x0 [0052.443] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.443] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x4b8, lpOverlapped=0x0) returned 1 [0052.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.444] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.444] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.444] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.444] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.444] CloseHandle (hObject=0x10c) returned 1 [0052.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.445] GetLastError () returned 0x0 [0052.446] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.446] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.446] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.447] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17244771445) returned 1 [0052.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae1198f0, dwHighDateTime=0x1d585b4)) [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d358 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d358 | out: hHeap=0x260000) returned 1 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757ce0 [0052.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.447] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.447] GetLastError () returned 0x0 [0052.448] GetLastError () returned 0x0 [0052.448] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.448] GetLastError () returned 0x0 [0052.448] GetLastError () returned 0x0 [0052.449] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff98c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.449] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x674, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x674, lpOverlapped=0x0) returned 1 [0052.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.450] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.450] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.450] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.450] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.450] CloseHandle (hObject=0x10c) returned 1 [0052.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.451] GetLastError () returned 0x0 [0052.452] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.452] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.452] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.453] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17245375109) returned 1 [0052.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae13fa50, dwHighDateTime=0x1d585b4)) [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d668 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d668 | out: hHeap=0x260000) returned 1 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757d78 [0052.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.453] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.453] GetLastError () returned 0x0 [0052.454] GetLastError () returned 0x0 [0052.454] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.454] GetLastError () returned 0x0 [0052.454] GetLastError () returned 0x0 [0052.526] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffecd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.526] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x132c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x132c, lpOverlapped=0x0) returned 1 [0052.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.527] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.527] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.528] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.528] CloseHandle (hObject=0x10c) returned 1 [0052.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.641] GetLastError () returned 0x0 [0052.642] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.642] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.642] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.643] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17264370502) returned 1 [0052.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae308ad0, dwHighDateTime=0x1d585b4)) [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1720 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758c40 [0052.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.643] GetLastError () returned 0x0 [0052.643] GetLastError () returned 0x0 [0052.644] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.644] GetLastError () returned 0x0 [0052.644] GetLastError () returned 0x0 [0052.645] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffcf10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.645] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x30f0, lpOverlapped=0x0) returned 1 [0052.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.647] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.648] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.648] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.648] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.648] CloseHandle (hObject=0x10c) returned 1 [0052.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.649] GetLastError () returned 0x0 [0052.650] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.651] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.651] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17265222460) returned 1 [0052.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae32ec30, dwHighDateTime=0x1d585b4)) [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758d70 [0052.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.652] GetLastError () returned 0x0 [0052.652] GetLastError () returned 0x0 [0052.652] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.652] GetLastError () returned 0x0 [0052.652] GetLastError () returned 0x0 [0052.655] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.655] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x560, lpOverlapped=0x0) returned 1 [0052.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.656] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.656] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.656] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.656] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.656] CloseHandle (hObject=0x10c) returned 1 [0052.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.657] GetLastError () returned 0x0 [0052.658] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.659] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.659] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.659] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17266036889) returned 1 [0052.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae32ec30, dwHighDateTime=0x1d585b4)) [0052.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1988 [0052.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1988 | out: hHeap=0x260000) returned 1 [0052.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758e08 [0052.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.660] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.660] GetLastError () returned 0x0 [0052.660] GetLastError () returned 0x0 [0052.660] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.660] GetLastError () returned 0x0 [0052.660] GetLastError () returned 0x0 [0052.662] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff4992, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.662] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xb66e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xb66e, lpOverlapped=0x0) returned 1 [0052.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.663] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.663] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.663] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.663] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.663] CloseHandle (hObject=0x10c) returned 1 [0052.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.664] GetLastError () returned 0x0 [0052.665] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.665] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.665] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.666] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17266707414) returned 1 [0052.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae354d90, dwHighDateTime=0x1d585b4)) [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19c0 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19c0 | out: hHeap=0x260000) returned 1 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758ea0 [0052.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.667] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.667] GetLastError () returned 0x0 [0052.667] GetLastError () returned 0x0 [0052.667] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.667] GetLastError () returned 0x0 [0052.667] GetLastError () returned 0x0 [0052.668] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffab2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.669] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x54d4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x54d4, lpOverlapped=0x0) returned 1 [0052.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.669] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.669] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.669] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.669] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.670] CloseHandle (hObject=0x10c) returned 1 [0052.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.671] GetLastError () returned 0x0 [0052.671] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.672] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.672] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.672] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17267361273) returned 1 [0052.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae354d90, dwHighDateTime=0x1d585b4)) [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19f8 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758f38 [0052.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.673] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.673] GetLastError () returned 0x0 [0052.673] GetLastError () returned 0x0 [0052.673] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.674] GetLastError () returned 0x0 [0052.674] GetLastError () returned 0x0 [0052.808] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffba08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.808] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x45f8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x45f8, lpOverlapped=0x0) returned 1 [0052.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.809] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.809] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.809] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.809] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.809] CloseHandle (hObject=0x10c) returned 1 [0052.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.861] GetLastError () returned 0x0 [0052.862] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.862] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.862] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17286364051) returned 1 [0052.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae51de10, dwHighDateTime=0x1d585b4)) [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758fd0 [0052.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.863] GetLastError () returned 0x0 [0052.863] GetLastError () returned 0x0 [0052.863] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.864] GetLastError () returned 0x0 [0052.864] GetLastError () returned 0x0 [0052.865] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff4a83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.866] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xb57d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xb57d, lpOverlapped=0x0) returned 1 [0052.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.868] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.868] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.868] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.869] CloseHandle (hObject=0x10c) returned 1 [0052.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.870] GetLastError () returned 0x0 [0052.870] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.871] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.871] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.871] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17287198181) returned 1 [0052.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae543f70, dwHighDateTime=0x1d585b4)) [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d08 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d08 | out: hHeap=0x260000) returned 1 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759950 [0052.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.872] GetLastError () returned 0x0 [0052.872] GetLastError () returned 0x0 [0052.872] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.872] GetLastError () returned 0x0 [0052.872] GetLastError () returned 0x0 [0052.875] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc728, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.875] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x38d8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x38d8, lpOverlapped=0x0) returned 1 [0052.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.875] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.875] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.876] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.876] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.876] CloseHandle (hObject=0x10c) returned 1 [0052.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.877] GetLastError () returned 0x0 [0052.878] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.879] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.879] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17287999598) returned 1 [0052.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae543f70, dwHighDateTime=0x1d585b4)) [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27599e8 [0052.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.879] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.880] GetLastError () returned 0x0 [0052.880] GetLastError () returned 0x0 [0052.880] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.880] GetLastError () returned 0x0 [0052.880] GetLastError () returned 0x0 [0052.883] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff4ed2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.883] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xb12e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xb12e, lpOverlapped=0x0) returned 1 [0052.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.883] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.883] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.884] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.884] CloseHandle (hObject=0x10c) returned 1 [0052.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.885] GetLastError () returned 0x0 [0052.886] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.887] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.887] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.887] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17288807816) returned 1 [0052.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae56a0d0, dwHighDateTime=0x1d585b4)) [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d40 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759a80 [0052.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.888] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.888] GetLastError () returned 0x0 [0052.888] GetLastError () returned 0x0 [0052.888] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.888] GetLastError () returned 0x0 [0052.888] GetLastError () returned 0x0 [0052.890] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff26fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.890] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xd902, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xd902, lpOverlapped=0x0) returned 1 [0052.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.890] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.891] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.891] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.891] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.891] CloseHandle (hObject=0x10c) returned 1 [0052.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0052.892] GetLastError () returned 0x0 [0052.893] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0052.893] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.894] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0052.894] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17289484008) returned 1 [0052.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae56a0d0, dwHighDateTime=0x1d585b4)) [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759b18 [0052.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.894] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0052.894] GetLastError () returned 0x0 [0052.895] GetLastError () returned 0x0 [0052.895] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0052.895] GetLastError () returned 0x0 [0052.895] GetLastError () returned 0x0 [0052.950] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff6f83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.950] WriteFile (in: hFile=0x10c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x907d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x907d, lpOverlapped=0x0) returned 1 [0052.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.951] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.951] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.951] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.951] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.952] CloseHandle (hObject=0x10c) returned 1 [0052.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.[deadmin@cock.li].deadmin")) returned 1 [0053.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.042] GetLastError () returned 0x0 [0053.043] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756858) returned 1 [0053.043] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.044] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.044] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17304482419) returned 1 [0053.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae6e6e90, dwHighDateTime=0x1d585b4)) [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cae8 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cae8 | out: hHeap=0x260000) returned 1 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a060 [0053.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.044] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.044] GetLastError () returned 0x0 [0053.045] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.045] GetLastError () returned 0x0 [0053.046] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffa092, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.046] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5f6e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x5f6e, lpOverlapped=0x0) returned 1 [0053.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.047] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.047] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.047] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.047] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.048] CloseHandle (hObject=0x10c) returned 1 [0053.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.049] GetLastError () returned 0x0 [0053.050] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756858) returned 1 [0053.051] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.051] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.051] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17305205402) returned 1 [0053.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae6e6e90, dwHighDateTime=0x1d585b4)) [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf48 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf48 | out: hHeap=0x260000) returned 1 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a520 [0053.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.052] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.052] GetLastError () returned 0x0 [0053.052] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.052] GetLastError () returned 0x0 [0053.054] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb4b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.054] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4b4a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x4b4a, lpOverlapped=0x0) returned 1 [0053.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.055] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.055] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.055] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.056] CloseHandle (hObject=0x10c) returned 1 [0053.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.057] GetLastError () returned 0x0 [0053.057] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756858) returned 1 [0053.058] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0053.058] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.058] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17305903748) returned 1 [0053.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae70cff0, dwHighDateTime=0x1d585b4)) [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf10 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a5b8 [0053.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.059] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.059] GetLastError () returned 0x0 [0053.059] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.059] GetLastError () returned 0x0 [0053.060] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe378, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.060] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1c88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c88, lpOverlapped=0x0) returned 1 [0053.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.061] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.061] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.061] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.062] CloseHandle (hObject=0x10c) returned 1 [0053.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.063] GetLastError () returned 0x0 [0053.063] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27568e0) returned 1 [0053.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.064] CryptReleaseContext (hProv=0x27568e0, dwFlags=0x0) returned 1 [0053.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.064] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17306541408) returned 1 [0053.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae70cff0, dwHighDateTime=0x1d585b4)) [0053.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5470 [0053.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5470 | out: hHeap=0x260000) returned 1 [0053.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a650 [0053.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.065] GetLastError () returned 0x0 [0053.065] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.065] GetLastError () returned 0x0 [0053.067] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb1ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.067] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4e46, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x4e46, lpOverlapped=0x0) returned 1 [0053.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.068] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.068] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.068] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.068] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.069] CloseHandle (hObject=0x10c) returned 1 [0053.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.070] GetLastError () returned 0x0 [0053.070] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756858) returned 1 [0053.071] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.071] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.071] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17307206031) returned 1 [0053.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae70cff0, dwHighDateTime=0x1d585b4)) [0053.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5438 [0053.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5438 | out: hHeap=0x260000) returned 1 [0053.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a6e8 [0053.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.072] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.072] GetLastError () returned 0x0 [0053.072] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.072] GetLastError () returned 0x0 [0053.077] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9628, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.077] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x69d8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x69d8, lpOverlapped=0x0) returned 1 [0053.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.078] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.078] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.079] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.079] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.079] CloseHandle (hObject=0x10c) returned 1 [0053.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.080] GetLastError () returned 0x0 [0053.107] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.108] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.108] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.108] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17310909473) returned 1 [0053.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae77f410, dwHighDateTime=0x1d585b4)) [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f90 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0053.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a780 [0053.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.109] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.109] GetLastError () returned 0x0 [0053.109] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.109] GetLastError () returned 0x0 [0053.138] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9d20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.138] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x62e0, lpOverlapped=0x0) returned 1 [0053.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.141] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.141] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.142] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.142] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.142] CloseHandle (hObject=0x10c) returned 1 [0053.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.147] GetLastError () returned 0x0 [0053.147] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.148] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.148] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17314963596) returned 1 [0053.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae7cb6d0, dwHighDateTime=0x1d585b4)) [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a818 [0053.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.149] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.150] GetLastError () returned 0x0 [0053.150] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.150] GetLastError () returned 0x0 [0053.160] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffaf4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.160] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x50b6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x50b6, lpOverlapped=0x0) returned 1 [0053.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.161] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.161] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.161] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.162] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.162] CloseHandle (hObject=0x10c) returned 1 [0053.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.163] GetLastError () returned 0x0 [0053.164] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.165] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.165] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.165] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17316629030) returned 1 [0053.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae817990, dwHighDateTime=0x1d585b4)) [0053.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299830 [0053.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0053.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a9e0 [0053.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.166] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.166] GetLastError () returned 0x0 [0053.166] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.166] GetLastError () returned 0x0 [0053.179] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff7be0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.180] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8420, lpOverlapped=0x0) returned 1 [0053.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.181] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.181] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.181] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.182] CloseHandle (hObject=0x10c) returned 1 [0053.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.184] GetLastError () returned 0x0 [0053.222] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756858) returned 1 [0053.223] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.223] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.223] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17322461601) returned 1 [0053.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae889db0, dwHighDateTime=0x1d585b4)) [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a948 [0053.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.224] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.224] GetLastError () returned 0x0 [0053.225] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.225] GetLastError () returned 0x0 [0053.252] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffa152, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.252] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5eae, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x5eae, lpOverlapped=0x0) returned 1 [0053.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.253] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.253] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.253] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.253] CloseHandle (hObject=0x10c) returned 1 [0053.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.270] GetLastError () returned 0x0 [0053.270] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.271] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.271] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.271] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17327331303) returned 1 [0053.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae8fc1d0, dwHighDateTime=0x1d585b4)) [0053.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0053.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0053.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275aba8 [0053.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.273] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.273] GetLastError () returned 0x0 [0053.273] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.273] GetLastError () returned 0x0 [0053.280] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff7bc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.280] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x843a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x843a, lpOverlapped=0x0) returned 1 [0053.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.281] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.281] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.281] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.281] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.281] CloseHandle (hObject=0x10c) returned 1 [0053.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.285] GetLastError () returned 0x0 [0053.286] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.286] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.287] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17328766353) returned 1 [0053.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae922330, dwHighDateTime=0x1d585b4)) [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00a8 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00a8 | out: hHeap=0x260000) returned 1 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275afd0 [0053.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.287] GetLastError () returned 0x0 [0053.287] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.287] GetLastError () returned 0x0 [0053.296] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffbb02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.296] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x44fe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x44fe, lpOverlapped=0x0) returned 1 [0053.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.296] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.296] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.297] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.297] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.297] CloseHandle (hObject=0x10c) returned 1 [0053.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.298] GetLastError () returned 0x0 [0053.299] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.300] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.300] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17330110882) returned 1 [0053.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae948490, dwHighDateTime=0x1d585b4)) [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efcf0 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efcf0 | out: hHeap=0x260000) returned 1 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b068 [0053.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.301] GetLastError () returned 0x0 [0053.301] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.301] GetLastError () returned 0x0 [0053.310] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe63c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.310] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x19c4, lpOverlapped=0x0) returned 1 [0053.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.313] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.313] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.313] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.313] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.313] CloseHandle (hObject=0x10c) returned 1 [0053.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cec0 [0053.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0053.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.315] GetLastError () returned 0x0 [0053.315] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.316] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.316] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.316] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17331697818) returned 1 [0053.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xae96e5f0, dwHighDateTime=0x1d585b4)) [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd60 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd60 | out: hHeap=0x260000) returned 1 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b198 [0053.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.317] GetLastError () returned 0x0 [0053.317] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.317] GetLastError () returned 0x0 [0053.369] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd284, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.370] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2d7c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2d7c, lpOverlapped=0x0) returned 1 [0053.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.386] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.386] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.392] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.392] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.393] CloseHandle (hObject=0x10c) returned 1 [0053.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.394] GetLastError () returned 0x0 [0053.394] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.397] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.397] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.397] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17339825706) returned 1 [0053.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaea2ccd0, dwHighDateTime=0x1d585b4)) [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d98 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d98 | out: hHeap=0x260000) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b2c8 [0053.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.398] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.398] GetLastError () returned 0x0 [0053.398] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.398] GetLastError () returned 0x0 [0053.419] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffeb04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.419] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x14fc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x14fc, lpOverlapped=0x0) returned 1 [0053.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.420] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.420] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.421] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.422] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.423] CloseHandle (hObject=0x10c) returned 1 [0053.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.427] GetLastError () returned 0x0 [0053.434] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.434] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.435] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.435] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17343580258) returned 1 [0053.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaea9f0f0, dwHighDateTime=0x1d585b4)) [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13e0 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b658 [0053.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.435] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.435] GetLastError () returned 0x0 [0053.436] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.436] GetLastError () returned 0x0 [0053.463] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe26c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.463] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1d94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1d94, lpOverlapped=0x0) returned 1 [0053.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.464] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.470] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.470] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.470] CloseHandle (hObject=0x104) returned 1 [0053.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.474] GetLastError () returned 0x0 [0053.474] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.475] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.475] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.475] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17347661181) returned 1 [0053.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaeaeb3b0, dwHighDateTime=0x1d585b4)) [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c140 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c140 | out: hHeap=0x260000) returned 1 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b788 [0053.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.476] GetLastError () returned 0x0 [0053.476] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.477] GetLastError () returned 0x0 [0053.486] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeda8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.486] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1258, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1258, lpOverlapped=0x0) returned 1 [0053.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.487] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.487] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.487] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.487] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.488] CloseHandle (hObject=0x104) returned 1 [0053.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.489] GetLastError () returned 0x0 [0053.489] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.490] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.490] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.490] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17349113802) returned 1 [0053.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaeb11510, dwHighDateTime=0x1d585b4)) [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5630 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5630 | out: hHeap=0x260000) returned 1 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0053.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.491] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.491] GetLastError () returned 0x0 [0053.491] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.491] GetLastError () returned 0x0 [0053.494] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff7cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.494] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x834, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x834, lpOverlapped=0x0) returned 1 [0053.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.496] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.496] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.496] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.496] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.496] CloseHandle (hObject=0x104) returned 1 [0053.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.498] GetLastError () returned 0x0 [0053.498] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.499] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.499] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.499] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17350014570) returned 1 [0053.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaeb37670, dwHighDateTime=0x1d585b4)) [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f55f8 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f55f8 | out: hHeap=0x260000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ba80 [0053.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.500] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.500] GetLastError () returned 0x0 [0053.500] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.500] GetLastError () returned 0x0 [0053.685] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffea0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.685] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x15f4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x15f4, lpOverlapped=0x0) returned 1 [0053.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.686] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.686] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.686] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.687] CloseHandle (hObject=0x104) returned 1 [0053.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.693] GetLastError () returned 0x0 [0053.775] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.776] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.776] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.776] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17377701402) returned 1 [0053.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaede4f30, dwHighDateTime=0x1d585b4)) [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbfa0 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbfa0 | out: hHeap=0x260000) returned 1 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2a08 [0053.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.776] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.777] GetLastError () returned 0x0 [0053.777] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.777] GetLastError () returned 0x0 [0053.780] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff9974, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.780] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x668c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x668c, lpOverlapped=0x0) returned 1 [0053.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.781] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.781] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.782] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.782] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.782] CloseHandle (hObject=0x118) returned 1 [0053.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0053.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0053.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.783] GetLastError () returned 0x0 [0053.783] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.784] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.784] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.784] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17378533195) returned 1 [0053.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaede4f30, dwHighDateTime=0x1d585b4)) [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c5a0 [0053.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c5a0 | out: hHeap=0x260000) returned 1 [0053.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2b38 [0053.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.785] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.785] GetLastError () returned 0x0 [0053.785] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.785] GetLastError () returned 0x0 [0053.787] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff7b64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.787] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x849c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x849c, lpOverlapped=0x0) returned 1 [0053.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.787] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.787] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.788] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.788] CloseHandle (hObject=0x118) returned 1 [0053.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0053.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0053.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.789] GetLastError () returned 0x0 [0053.790] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.790] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.790] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17379192368) returned 1 [0053.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaee0b090, dwHighDateTime=0x1d585b4)) [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c5d8 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c5d8 | out: hHeap=0x260000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2bd0 [0053.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.793] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.793] GetLastError () returned 0x0 [0053.793] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.794] GetLastError () returned 0x0 [0053.795] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffa352, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.795] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5cae, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x5cae, lpOverlapped=0x0) returned 1 [0053.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.796] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.796] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.796] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.796] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.797] CloseHandle (hObject=0x118) returned 1 [0053.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0053.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0053.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.798] GetLastError () returned 0x0 [0053.798] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.799] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.799] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.799] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17380052050) returned 1 [0053.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaee0b090, dwHighDateTime=0x1d585b4)) [0053.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c610 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c610 | out: hHeap=0x260000) returned 1 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2c68 [0053.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.800] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.800] GetLastError () returned 0x0 [0053.800] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.800] GetLastError () returned 0x0 [0053.802] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff77a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.802] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8860, lpOverlapped=0x0) returned 1 [0053.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.803] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.803] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.803] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.803] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.803] CloseHandle (hObject=0x118) returned 1 [0053.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.872] GetLastError () returned 0x0 [0053.878] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.879] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.879] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17388055671) returned 1 [0053.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaeec9770, dwHighDateTime=0x1d585b4)) [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f56a0 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f56a0 | out: hHeap=0x260000) returned 1 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2d00 [0053.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.880] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.880] GetLastError () returned 0x0 [0053.880] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.880] GetLastError () returned 0x0 [0053.882] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff3df4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.883] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc20c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xc20c, lpOverlapped=0x0) returned 1 [0053.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.883] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.883] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.883] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.883] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.884] CloseHandle (hObject=0x10c) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0053.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0053.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.885] GetLastError () returned 0x0 [0053.886] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.886] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.886] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17388759305) returned 1 [0053.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaeeef8d0, dwHighDateTime=0x1d585b4)) [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5668 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5668 | out: hHeap=0x260000) returned 1 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3258 [0053.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.887] GetLastError () returned 0x0 [0053.887] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.887] GetLastError () returned 0x0 [0053.889] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff51f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.890] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xae08, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xae08, lpOverlapped=0x0) returned 1 [0053.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.890] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.890] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.891] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.891] CloseHandle (hObject=0x10c) returned 1 [0053.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0053.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0053.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.892] GetLastError () returned 0x0 [0053.892] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0053.893] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.893] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.893] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17389428473) returned 1 [0053.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaeeef8d0, dwHighDateTime=0x1d585b4)) [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c728 [0053.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c728 | out: hHeap=0x260000) returned 1 [0053.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f32f0 [0053.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.894] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0053.894] GetLastError () returned 0x0 [0053.894] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0053.894] GetLastError () returned 0x0 [0053.896] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff1e86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.896] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xe17a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xe17a, lpOverlapped=0x0) returned 1 [0053.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.897] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.897] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.897] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.897] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.898] CloseHandle (hObject=0x10c) returned 1 [0053.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.076] GetLastError () returned 0x0 [0054.076] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.077] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.077] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.077] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17407839951) returned 1 [0054.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf0b8950, dwHighDateTime=0x1d585b4)) [0054.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f57b8 [0054.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f57b8 | out: hHeap=0x260000) returned 1 [0054.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d358 [0054.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.078] GetLastError () returned 0x0 [0054.078] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.078] GetLastError () returned 0x0 [0054.081] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff7f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.081] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x80c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x80c, lpOverlapped=0x0) returned 1 [0054.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.081] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.081] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.082] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.082] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.082] CloseHandle (hObject=0x10c) returned 1 [0054.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.083] GetLastError () returned 0x0 [0054.083] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.084] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.084] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.084] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17408519840) returned 1 [0054.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf0b8950, dwHighDateTime=0x1d585b4)) [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cd48 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd48 | out: hHeap=0x260000) returned 1 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d3f0 [0054.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.085] GetLastError () returned 0x0 [0054.085] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.085] GetLastError () returned 0x0 [0054.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe2b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.087] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1d4a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1d4a, lpOverlapped=0x0) returned 1 [0054.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.088] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.088] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.088] CloseHandle (hObject=0x10c) returned 1 [0054.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.089] GetLastError () returned 0x0 [0054.089] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.090] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.090] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.090] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17409121639) returned 1 [0054.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf0deab0, dwHighDateTime=0x1d585b4)) [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cd80 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd80 | out: hHeap=0x260000) returned 1 [0054.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d488 [0054.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.091] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.091] GetLastError () returned 0x0 [0054.091] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.091] GetLastError () returned 0x0 [0054.093] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff5a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.093] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xa5c, lpOverlapped=0x0) returned 1 [0054.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.093] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.093] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.093] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.093] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.094] CloseHandle (hObject=0x10c) returned 1 [0054.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.095] GetLastError () returned 0x0 [0054.095] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.096] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.096] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.096] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17409719892) returned 1 [0054.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf0deab0, dwHighDateTime=0x1d585b4)) [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cdb8 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cdb8 | out: hHeap=0x260000) returned 1 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d520 [0054.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.097] GetLastError () returned 0x0 [0054.097] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.097] GetLastError () returned 0x0 [0054.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.099] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0xf00, lpOverlapped=0x0) returned 1 [0054.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.099] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.100] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.100] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.100] CloseHandle (hObject=0x10c) returned 1 [0054.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.101] GetLastError () returned 0x0 [0054.102] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.102] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.102] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.103] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17410365568) returned 1 [0054.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf104c10, dwHighDateTime=0x1d585b4)) [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cdf0 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cdf0 | out: hHeap=0x260000) returned 1 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d5b8 [0054.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.103] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.103] GetLastError () returned 0x0 [0054.103] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.103] GetLastError () returned 0x0 [0054.105] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff834a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.105] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x7cb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7cb6, lpOverlapped=0x0) returned 1 [0054.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.108] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.108] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.108] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.108] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.108] CloseHandle (hObject=0x10c) returned 1 [0054.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.109] GetLastError () returned 0x0 [0054.110] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.111] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.111] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.111] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17411236432) returned 1 [0054.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf104c10, dwHighDateTime=0x1d585b4)) [0054.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ce28 [0054.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ce28 | out: hHeap=0x260000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d650 [0054.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.112] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.112] GetLastError () returned 0x0 [0054.112] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.112] GetLastError () returned 0x0 [0054.251] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff5106, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.251] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xaefa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xaefa, lpOverlapped=0x0) returned 1 [0054.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.252] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.252] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.252] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.252] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.253] CloseHandle (hObject=0x10c) returned 1 [0054.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.254] GetLastError () returned 0x0 [0054.254] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.255] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.255] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.255] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17425646368) returned 1 [0054.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf25b870, dwHighDateTime=0x1d585b4)) [0054.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761220 [0054.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761220 | out: hHeap=0x260000) returned 1 [0054.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d6e8 [0054.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.256] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.256] GetLastError () returned 0x0 [0054.256] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.256] GetLastError () returned 0x0 [0054.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff752a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.259] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8ad6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8ad6, lpOverlapped=0x0) returned 1 [0054.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.259] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.260] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.260] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.260] CloseHandle (hObject=0x10c) returned 1 [0054.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.[deadmin@cock.li].deadmin")) returned 1 [0054.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.261] GetLastError () returned 0x0 [0054.262] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.263] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.263] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17426423518) returned 1 [0054.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf2819d0, dwHighDateTime=0x1d585b4)) [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761258 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761258 | out: hHeap=0x260000) returned 1 [0054.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e100 [0054.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.264] GetLastError () returned 0x0 [0054.264] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.264] GetLastError () returned 0x0 [0054.266] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff1d17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.266] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xe2e9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xe2e9, lpOverlapped=0x0) returned 1 [0054.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.267] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.267] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.267] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.267] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.267] CloseHandle (hObject=0x10c) returned 1 [0054.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.[deadmin@cock.li].deadmin")) returned 1 [0054.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.268] GetLastError () returned 0x0 [0054.269] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.270] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.270] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.270] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17427109257) returned 1 [0054.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf2819d0, dwHighDateTime=0x1d585b4)) [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761290 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761290 | out: hHeap=0x260000) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e198 [0054.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.271] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.271] GetLastError () returned 0x0 [0054.271] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.271] GetLastError () returned 0x0 [0054.273] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9a5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.273] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x65a6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x65a6, lpOverlapped=0x0) returned 1 [0054.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.273] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.274] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.274] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.274] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.274] CloseHandle (hObject=0x10c) returned 1 [0054.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.275] GetLastError () returned 0x0 [0054.275] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.276] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.276] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.276] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17427755052) returned 1 [0054.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf2a7b30, dwHighDateTime=0x1d585b4)) [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27612c8 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27612c8 | out: hHeap=0x260000) returned 1 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e230 [0054.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.277] GetLastError () returned 0x0 [0054.277] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.277] GetLastError () returned 0x0 [0054.280] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff6e74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.280] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x918c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x918c, lpOverlapped=0x0) returned 1 [0054.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0054.283] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.283] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.283] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.283] CloseHandle (hObject=0x10c) returned 1 [0054.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.285] GetLastError () returned 0x0 [0054.285] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.286] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.286] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17428737326) returned 1 [0054.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf2a7b30, dwHighDateTime=0x1d585b4)) [0054.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761300 [0054.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761300 | out: hHeap=0x260000) returned 1 [0054.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e2c8 [0054.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.287] GetLastError () returned 0x0 [0054.287] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.287] GetLastError () returned 0x0 [0054.396] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe256, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.396] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1daa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x1cffdb0*=0x1daa, lpOverlapped=0x0) returned 1 [0054.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0054.397] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.397] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.398] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.398] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.398] CloseHandle (hObject=0x10c) returned 1 [0054.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.616] GetLastError () returned 0x0 [0054.635] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.636] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.636] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.636] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17463686075) returned 1 [0054.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf613ad0, dwHighDateTime=0x1d585b4)) [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27615a0 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27615a0 | out: hHeap=0x260000) returned 1 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e360 [0054.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.636] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.636] GetLastError () returned 0x0 [0054.637] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.637] GetLastError () returned 0x0 [0054.640] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffecec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.640] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1314, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1314, lpOverlapped=0x0) returned 1 [0054.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.641] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.641] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.641] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.641] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.641] CloseHandle (hObject=0x110) returned 1 [0054.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.643] GetLastError () returned 0x0 [0054.643] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.644] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.644] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.644] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17464485468) returned 1 [0054.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf613ad0, dwHighDateTime=0x1d585b4)) [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27618b0 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27618b0 | out: hHeap=0x260000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f2d0 [0054.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.644] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.644] GetLastError () returned 0x0 [0054.645] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.645] GetLastError () returned 0x0 [0054.646] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffebe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.646] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1418, lpOverlapped=0x0) returned 1 [0054.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.647] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.647] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.647] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.647] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.647] CloseHandle (hObject=0x110) returned 1 [0054.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.649] GetLastError () returned 0x0 [0054.649] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.649] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.649] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.650] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17465075581) returned 1 [0054.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf639c30, dwHighDateTime=0x1d585b4)) [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27618e8 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27618e8 | out: hHeap=0x260000) returned 1 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f368 [0054.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.650] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.650] GetLastError () returned 0x0 [0054.650] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.651] GetLastError () returned 0x0 [0054.652] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe668, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.652] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1998, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1998, lpOverlapped=0x0) returned 1 [0054.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.652] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.653] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.653] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.653] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.653] CloseHandle (hObject=0x110) returned 1 [0054.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.654] GetLastError () returned 0x0 [0054.655] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.655] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.655] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17465657064) returned 1 [0054.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf639c30, dwHighDateTime=0x1d585b4)) [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761958 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761958 | out: hHeap=0x260000) returned 1 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0054.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.656] GetLastError () returned 0x0 [0054.656] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.656] GetLastError () returned 0x0 [0054.658] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.658] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1bc8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1bc8, lpOverlapped=0x0) returned 1 [0054.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.659] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.659] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.659] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.659] CloseHandle (hObject=0x110) returned 1 [0054.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.660] GetLastError () returned 0x0 [0054.661] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.662] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.662] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.662] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17466306298) returned 1 [0054.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf639c30, dwHighDateTime=0x1d585b4)) [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761990 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761990 | out: hHeap=0x260000) returned 1 [0054.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f530 [0054.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.663] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.663] GetLastError () returned 0x0 [0054.663] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.663] GetLastError () returned 0x0 [0054.664] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffecb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.664] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1348, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1348, lpOverlapped=0x0) returned 1 [0054.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.665] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.665] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.665] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.666] CloseHandle (hObject=0x110) returned 1 [0054.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.667] GetLastError () returned 0x0 [0054.667] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.668] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.668] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.668] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17466900037) returned 1 [0054.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf65fd90, dwHighDateTime=0x1d585b4)) [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27619c8 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27619c8 | out: hHeap=0x260000) returned 1 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f5c8 [0054.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.669] GetLastError () returned 0x0 [0054.669] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.669] GetLastError () returned 0x0 [0054.802] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe8e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.802] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1720, lpOverlapped=0x0) returned 1 [0054.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.802] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.803] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.803] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.803] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.803] CloseHandle (hObject=0x110) returned 1 [0054.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.804] GetLastError () returned 0x0 [0054.830] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2718) returned 1 [0054.831] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.831] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.831] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17483296699) returned 1 [0054.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf802cb0, dwHighDateTime=0x1d585b4)) [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338410 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338410 | out: hHeap=0x260000) returned 1 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f660 [0054.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.835] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.835] GetLastError () returned 0x0 [0054.835] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.835] GetLastError () returned 0x0 [0054.839] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff342, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.839] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xcbe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xcbe, lpOverlapped=0x0) returned 1 [0054.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.840] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.840] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.840] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.840] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.841] CloseHandle (hObject=0x118) returned 1 [0054.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.842] GetLastError () returned 0x0 [0054.842] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2718) returned 1 [0054.843] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.843] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.843] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17484426099) returned 1 [0054.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf802cb0, dwHighDateTime=0x1d585b4)) [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761c30 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761c30 | out: hHeap=0x260000) returned 1 [0054.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275feb0 [0054.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.844] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.844] GetLastError () returned 0x0 [0054.844] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.844] GetLastError () returned 0x0 [0054.846] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff84e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.846] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7b2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7b2, lpOverlapped=0x0) returned 1 [0054.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.846] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.846] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.847] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.847] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.847] CloseHandle (hObject=0x118) returned 1 [0054.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.848] GetLastError () returned 0x0 [0054.848] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2718) returned 1 [0054.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.849] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.849] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17485032393) returned 1 [0054.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf802cb0, dwHighDateTime=0x1d585b4)) [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761c68 [0054.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761c68 | out: hHeap=0x260000) returned 1 [0054.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ff48 [0054.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.850] GetLastError () returned 0x0 [0054.850] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.850] GetLastError () returned 0x0 [0054.852] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff86c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.852] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7938, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7938, lpOverlapped=0x0) returned 1 [0054.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.853] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.853] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.854] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.854] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.854] CloseHandle (hObject=0x118) returned 1 [0054.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.856] GetLastError () returned 0x0 [0054.856] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2718) returned 1 [0054.857] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.857] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.857] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17485839975) returned 1 [0054.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf828e10, dwHighDateTime=0x1d585b4)) [0054.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761ca0 [0054.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761ca0 | out: hHeap=0x260000) returned 1 [0054.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ffe0 [0054.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.858] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.858] GetLastError () returned 0x0 [0054.858] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.858] GetLastError () returned 0x0 [0054.860] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff96a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.860] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6958, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x6958, lpOverlapped=0x0) returned 1 [0054.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.861] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.861] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.861] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.861] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.862] CloseHandle (hObject=0x118) returned 1 [0054.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.863] GetLastError () returned 0x0 [0054.864] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2718) returned 1 [0054.864] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.864] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0054.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.865] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17486574963) returned 1 [0054.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf828e10, dwHighDateTime=0x1d585b4)) [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761d10 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0054.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761d10 | out: hHeap=0x260000) returned 1 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fce8 [0054.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.884] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.885] GetLastError () returned 0x0 [0054.885] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.885] GetLastError () returned 0x0 [0054.887] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff51e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.887] WriteFile (in: hFile=0x118, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xae2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xae2, lpOverlapped=0x0) returned 1 [0054.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.888] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.888] WriteFile (in: hFile=0x118, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.888] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.888] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.889] CloseHandle (hObject=0x118) returned 1 [0054.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.914] GetLastError () returned 0x0 [0054.914] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.915] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.915] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.915] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17491628034) returned 1 [0054.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf8c1390, dwHighDateTime=0x1d585b4)) [0054.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e60 [0054.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e60 | out: hHeap=0x260000) returned 1 [0054.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0054.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.929] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.929] GetLastError () returned 0x0 [0054.938] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.938] GetLastError () returned 0x0 [0054.940] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff6b3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.940] WriteFile (in: hFile=0xf0, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x94c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x1cffdb0*=0x94c4, lpOverlapped=0x0) returned 1 [0054.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0054.941] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.941] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.941] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.941] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.942] CloseHandle (hObject=0xf0) returned 1 [0054.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.943] GetLastError () returned 0x0 [0054.944] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.944] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.944] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.944] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17494563326) returned 1 [0054.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf90d650, dwHighDateTime=0x1d585b4)) [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761f08 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761f08 | out: hHeap=0x260000) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27604a0 [0054.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.945] GetLastError () returned 0x0 [0054.945] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.945] GetLastError () returned 0x0 [0054.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd178, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.947] WriteFile (in: hFile=0xf0, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x2e88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x1cffdb0*=0x2e88, lpOverlapped=0x0) returned 1 [0054.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0054.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.948] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.948] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.949] CloseHandle (hObject=0xf0) returned 1 [0054.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0054.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0054.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.950] GetLastError () returned 0x0 [0054.950] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.951] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.951] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.951] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17495192945) returned 1 [0054.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf90d650, dwHighDateTime=0x1d585b4)) [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761f40 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761f40 | out: hHeap=0x260000) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0054.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.951] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.952] GetLastError () returned 0x0 [0054.952] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.952] GetLastError () returned 0x0 [0054.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcf0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.953] WriteFile (in: hFile=0xf0, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x30f2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x1cffdb0*=0x30f2, lpOverlapped=0x0) returned 1 [0054.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0054.954] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.954] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.954] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.954] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.955] CloseHandle (hObject=0xf0) returned 1 [0054.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.956] GetLastError () returned 0x0 [0054.956] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0054.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.957] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0054.957] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17495796571) returned 1 [0054.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaf90d650, dwHighDateTime=0x1d585b4)) [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761f78 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761f78 | out: hHeap=0x260000) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760798 [0054.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.957] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0054.958] GetLastError () returned 0x0 [0054.958] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0054.958] GetLastError () returned 0x0 [0054.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc362, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.960] WriteFile (in: hFile=0xf0, lpBuffer=0x2814080*, nNumberOfBytesToWrite=0x3c9e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2814080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3c9e, lpOverlapped=0x0) returned 1 [0054.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2814080 | out: hHeap=0x260000) returned 1 [0054.960] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.960] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.961] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.961] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.961] CloseHandle (hObject=0xf0) returned 1 [0054.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.962] GetLastError () returned 0x0 [0055.203] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.222] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.222] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.222] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17522562518) returned 1 [0055.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafbbaf10, dwHighDateTime=0x1d585b4)) [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f01c0 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01c0 | out: hHeap=0x260000) returned 1 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0055.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.231] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.232] GetLastError () returned 0x0 [0055.232] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.232] GetLastError () returned 0x0 [0055.235] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff7e9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.235] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x8166, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x8166, lpOverlapped=0x0) returned 1 [0055.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.235] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.236] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.236] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.236] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.236] CloseHandle (hObject=0x118) returned 1 [0055.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.238] GetLastError () returned 0x0 [0055.238] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.239] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.239] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17524012528) returned 1 [0055.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafbbaf10, dwHighDateTime=0x1d585b4)) [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f01f8 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01f8 | out: hHeap=0x260000) returned 1 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0055.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.240] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.240] GetLastError () returned 0x0 [0055.240] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.240] GetLastError () returned 0x0 [0055.242] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff6ce6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.242] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x931a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x931a, lpOverlapped=0x0) returned 1 [0055.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.242] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.243] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.243] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.243] CloseHandle (hObject=0x118) returned 1 [0055.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.243] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.244] GetLastError () returned 0x0 [0055.245] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2c68) returned 1 [0055.245] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0055.245] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0055.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0055.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.246] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17524669247) returned 1 [0055.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafbe1070, dwHighDateTime=0x1d585b4)) [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0230 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0230 | out: hHeap=0x260000) returned 1 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27642c0 [0055.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.246] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.246] GetLastError () returned 0x0 [0055.246] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.246] GetLastError () returned 0x0 [0055.248] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff7f28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.248] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x80d8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x80d8, lpOverlapped=0x0) returned 1 [0055.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.249] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.249] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.249] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.250] CloseHandle (hObject=0x118) returned 1 [0055.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.251] GetLastError () returned 0x0 [0055.251] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2c68) returned 1 [0055.252] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.252] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0055.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.252] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17525292834) returned 1 [0055.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafbe1070, dwHighDateTime=0x1d585b4)) [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27620d0 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27620d0 | out: hHeap=0x260000) returned 1 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764358 [0055.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.252] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.253] GetLastError () returned 0x0 [0055.253] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.253] GetLastError () returned 0x0 [0055.255] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff392e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.255] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xc6d2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0xc6d2, lpOverlapped=0x0) returned 1 [0055.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.255] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.256] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.256] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.256] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.256] CloseHandle (hObject=0x118) returned 1 [0055.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.257] GetLastError () returned 0x0 [0055.258] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.258] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.258] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.259] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17525966923) returned 1 [0055.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafc071d0, dwHighDateTime=0x1d585b4)) [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762108 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762108 | out: hHeap=0x260000) returned 1 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27643f0 [0055.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.259] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.259] GetLastError () returned 0x0 [0055.259] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.259] GetLastError () returned 0x0 [0055.261] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff32f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.261] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0xcd10, lpOverlapped=0x0) returned 1 [0055.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.262] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.262] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.262] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.262] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.263] CloseHandle (hObject=0x118) returned 1 [0055.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.264] GetLastError () returned 0x0 [0055.264] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.265] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.265] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.265] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17526602627) returned 1 [0055.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafc071d0, dwHighDateTime=0x1d585b4)) [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762140 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762140 | out: hHeap=0x260000) returned 1 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a2f8 [0055.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764488 [0055.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a2f8 | out: hHeap=0x260000) returned 1 [0055.266] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.266] GetLastError () returned 0x0 [0055.266] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.266] GetLastError () returned 0x0 [0055.400] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff57f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.400] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa80c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0xa80c, lpOverlapped=0x0) returned 1 [0055.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.401] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.401] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.401] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.401] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.402] CloseHandle (hObject=0x118) returned 1 [0055.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.458] GetLastError () returned 0x0 [0055.458] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d34e8) returned 1 [0055.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.459] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.459] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17546049315) returned 1 [0055.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafdf63b0, dwHighDateTime=0x1d585b4)) [0055.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27624c0 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27624c0 | out: hHeap=0x260000) returned 1 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764520 [0055.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.460] GetLastError () returned 0x0 [0055.460] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.460] GetLastError () returned 0x0 [0055.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe842, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.462] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x17be, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x17be, lpOverlapped=0x0) returned 1 [0055.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.463] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.463] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.463] CloseHandle (hObject=0xf0) returned 1 [0055.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.464] GetLastError () returned 0x0 [0055.465] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d34e8) returned 1 [0055.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.466] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.466] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17546719218) returned 1 [0055.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafdf63b0, dwHighDateTime=0x1d585b4)) [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27624f8 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27624f8 | out: hHeap=0x260000) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764ea0 [0055.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.467] GetLastError () returned 0x0 [0055.467] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.467] GetLastError () returned 0x0 [0055.468] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc822, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.468] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x37de, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x37de, lpOverlapped=0x0) returned 1 [0055.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.469] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.469] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.469] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.470] CloseHandle (hObject=0xf0) returned 1 [0055.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.471] GetLastError () returned 0x0 [0055.471] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d34e8) returned 1 [0055.472] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.472] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.472] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17547348511) returned 1 [0055.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xafdf63b0, dwHighDateTime=0x1d585b4)) [0055.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762530 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762530 | out: hHeap=0x260000) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764f38 [0055.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.473] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.473] GetLastError () returned 0x0 [0055.473] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.473] GetLastError () returned 0x0 [0055.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff9e80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.476] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x6180, lpOverlapped=0x0) returned 1 [0055.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.476] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.477] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.477] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.477] CloseHandle (hObject=0xf0) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.597] GetLastError () returned 0x0 [0055.604] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.617] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.618] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17561882632) returned 1 [0055.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaff73170, dwHighDateTime=0x1d585b4)) [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1a18 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1a18 | out: hHeap=0x260000) returned 1 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0055.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.618] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.618] GetLastError () returned 0x0 [0055.618] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.619] GetLastError () returned 0x0 [0055.622] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb6c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.622] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x493e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x493e, lpOverlapped=0x0) returned 1 [0055.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.623] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.623] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.623] CloseHandle (hObject=0xf0) returned 1 [0055.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.625] GetLastError () returned 0x0 [0055.625] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.626] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.626] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.626] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17562689692) returned 1 [0055.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaff73170, dwHighDateTime=0x1d585b4)) [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f19a8 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f19a8 | out: hHeap=0x260000) returned 1 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765528 [0055.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.626] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.627] GetLastError () returned 0x0 [0055.627] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.627] GetLastError () returned 0x0 [0055.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.628] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2ae8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ae8, lpOverlapped=0x0) returned 1 [0055.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.629] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.629] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.630] CloseHandle (hObject=0xf0) returned 1 [0055.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.631] GetLastError () returned 0x0 [0055.632] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.632] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.632] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.633] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17563364164) returned 1 [0055.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaff992d0, dwHighDateTime=0x1d585b4)) [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1970 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1970 | out: hHeap=0x260000) returned 1 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765658 [0055.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.633] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.633] GetLastError () returned 0x0 [0055.633] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.633] GetLastError () returned 0x0 [0055.635] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb5a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.635] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4a5a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x4a5a, lpOverlapped=0x0) returned 1 [0055.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.636] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.636] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.636] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.636] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.636] CloseHandle (hObject=0xf0) returned 1 [0055.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.638] GetLastError () returned 0x0 [0055.638] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.639] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.639] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.639] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17563984475) returned 1 [0055.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaff992d0, dwHighDateTime=0x1d585b4)) [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1938 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1938 | out: hHeap=0x260000) returned 1 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27656f0 [0055.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.639] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.639] GetLastError () returned 0x0 [0055.640] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.640] GetLastError () returned 0x0 [0055.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb206, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.641] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4dfa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x4dfa, lpOverlapped=0x0) returned 1 [0055.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.642] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.642] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.642] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.642] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.643] CloseHandle (hObject=0xf0) returned 1 [0055.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.644] GetLastError () returned 0x0 [0055.644] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d4120) returned 1 [0055.645] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0055.645] CryptReleaseContext (hProv=0x2d4120, dwFlags=0x0) returned 1 [0055.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.645] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17564619545) returned 1 [0055.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaffbf430, dwHighDateTime=0x1d585b4)) [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1900 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1900 | out: hHeap=0x260000) returned 1 [0055.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765788 [0055.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.646] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.646] GetLastError () returned 0x0 [0055.646] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.646] GetLastError () returned 0x0 [0055.647] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.648] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0xe20, lpOverlapped=0x0) returned 1 [0055.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.648] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.648] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.648] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.648] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.649] CloseHandle (hObject=0xf0) returned 1 [0055.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.650] GetLastError () returned 0x0 [0055.650] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d4120) returned 1 [0055.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0055.651] CryptReleaseContext (hProv=0x2d4120, dwFlags=0x0) returned 1 [0055.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.651] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17565226287) returned 1 [0055.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xaffbf430, dwHighDateTime=0x1d585b4)) [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f18c8 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f18c8 | out: hHeap=0x260000) returned 1 [0055.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765820 [0055.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.652] GetLastError () returned 0x0 [0055.652] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.652] GetLastError () returned 0x0 [0055.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffefc2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.692] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x103e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x103e, lpOverlapped=0x0) returned 1 [0055.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.693] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.693] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.693] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.693] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.694] CloseHandle (hObject=0xf0) returned 1 [0055.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.727] GetLastError () returned 0x0 [0055.736] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.740] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.740] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.740] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17574112979) returned 1 [0055.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb00a3c70, dwHighDateTime=0x1d585b4)) [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762920 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762920 | out: hHeap=0x260000) returned 1 [0055.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27658b8 [0055.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.741] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.741] GetLastError () returned 0x0 [0055.741] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.741] GetLastError () returned 0x0 [0055.743] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.743] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1a00, lpOverlapped=0x0) returned 1 [0055.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.744] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.744] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.744] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.744] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.744] CloseHandle (hObject=0x104) returned 1 [0055.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.744] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.745] GetLastError () returned 0x0 [0055.746] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.746] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.747] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17574778854) returned 1 [0055.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb00a3c70, dwHighDateTime=0x1d585b4)) [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762958 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762958 | out: hHeap=0x260000) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765ea8 [0055.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.747] GetLastError () returned 0x0 [0055.747] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.748] GetLastError () returned 0x0 [0055.749] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdf1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.749] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x20e4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x20e4, lpOverlapped=0x0) returned 1 [0055.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.750] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.750] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.750] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.751] CloseHandle (hObject=0x104) returned 1 [0055.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.752] GetLastError () returned 0x0 [0055.752] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.753] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.753] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.753] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17575399974) returned 1 [0055.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb00a3c70, dwHighDateTime=0x1d585b4)) [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762990 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762990 | out: hHeap=0x260000) returned 1 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765f40 [0055.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.753] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.754] GetLastError () returned 0x0 [0055.754] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.754] GetLastError () returned 0x0 [0055.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd4c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.756] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2b38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2b38, lpOverlapped=0x0) returned 1 [0055.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.756] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.756] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.757] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.757] CloseHandle (hObject=0x104) returned 1 [0055.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.758] GetLastError () returned 0x0 [0055.758] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.759] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.759] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.759] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17576031549) returned 1 [0055.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb00c9dd0, dwHighDateTime=0x1d585b4)) [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762a00 [0055.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762a00 | out: hHeap=0x260000) returned 1 [0055.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765fd8 [0055.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.760] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.760] GetLastError () returned 0x0 [0055.760] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.760] GetLastError () returned 0x0 [0055.762] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff58a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.762] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xa75a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xa75a, lpOverlapped=0x0) returned 1 [0055.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.763] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.763] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.763] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.763] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.763] CloseHandle (hObject=0x104) returned 1 [0055.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.777] GetLastError () returned 0x0 [0055.792] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.806] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.806] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17580718971) returned 1 [0055.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb013c1f0, dwHighDateTime=0x1d585b4)) [0055.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762b88 [0055.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762b88 | out: hHeap=0x260000) returned 1 [0055.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766498 [0055.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.813] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.813] GetLastError () returned 0x0 [0055.813] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.813] GetLastError () returned 0x0 [0055.828] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbf0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.828] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x40f2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x40f2, lpOverlapped=0x0) returned 1 [0055.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.829] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.829] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.830] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.831] CloseHandle (hObject=0x104) returned 1 [0055.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.832] GetLastError () returned 0x0 [0055.832] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.833] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.833] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.833] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17583432811) returned 1 [0055.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01884b0, dwHighDateTime=0x1d585b4)) [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762bc0 [0055.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762bc0 | out: hHeap=0x260000) returned 1 [0055.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27662d0 [0055.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.834] GetLastError () returned 0x0 [0055.834] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.834] GetLastError () returned 0x0 [0055.836] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.836] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x28be, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x28be, lpOverlapped=0x0) returned 1 [0055.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.836] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.837] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.837] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.837] CloseHandle (hObject=0x104) returned 1 [0055.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.838] GetLastError () returned 0x0 [0055.850] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.851] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.851] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.851] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17585247386) returned 1 [0055.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01ae610, dwHighDateTime=0x1d585b4)) [0055.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762bc0 [0055.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762bc0 | out: hHeap=0x260000) returned 1 [0055.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27665c8 [0055.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.852] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.852] GetLastError () returned 0x0 [0055.852] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.852] GetLastError () returned 0x0 [0055.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdb29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.855] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x24d7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x24d7, lpOverlapped=0x0) returned 1 [0055.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.855] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.856] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.856] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.856] CloseHandle (hObject=0xf0) returned 1 [0055.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d500 [0055.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x260000) returned 1 [0055.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.857] GetLastError () returned 0x0 [0055.857] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.858] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.858] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17585938903) returned 1 [0055.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01ae610, dwHighDateTime=0x1d585b4)) [0055.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762c30 [0055.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762c30 | out: hHeap=0x260000) returned 1 [0055.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766660 [0055.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.859] GetLastError () returned 0x0 [0055.859] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.859] GetLastError () returned 0x0 [0055.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd008, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.861] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2ff8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ff8, lpOverlapped=0x0) returned 1 [0055.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.861] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.861] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.861] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.862] CloseHandle (hObject=0xf0) returned 1 [0055.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d500 [0055.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x260000) returned 1 [0055.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.863] GetLastError () returned 0x0 [0055.863] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.864] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.864] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.864] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17586548070) returned 1 [0055.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01d4770, dwHighDateTime=0x1d585b4)) [0055.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762c68 [0055.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762c68 | out: hHeap=0x260000) returned 1 [0055.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27666f8 [0055.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.865] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.865] GetLastError () returned 0x0 [0055.865] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.865] GetLastError () returned 0x0 [0055.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd182, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.868] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2e7e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x2e7e, lpOverlapped=0x0) returned 1 [0055.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.868] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.869] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.869] CloseHandle (hObject=0xf0) returned 1 [0055.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.870] GetLastError () returned 0x0 [0055.871] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.872] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.872] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17587304472) returned 1 [0055.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01d4770, dwHighDateTime=0x1d585b4)) [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762cd8 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762cd8 | out: hHeap=0x260000) returned 1 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766790 [0055.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.873] GetLastError () returned 0x0 [0055.873] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.873] GetLastError () returned 0x0 [0055.874] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd82c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.874] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x27d4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x27d4, lpOverlapped=0x0) returned 1 [0055.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.875] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.875] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.876] CloseHandle (hObject=0xf0) returned 1 [0055.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.877] GetLastError () returned 0x0 [0055.878] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.878] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.878] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17588065092) returned 1 [0055.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01fa8d0, dwHighDateTime=0x1d585b4)) [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bcf0 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bcf0 | out: hHeap=0x260000) returned 1 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332a30 [0055.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.880] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.880] GetLastError () returned 0x0 [0055.881] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.881] GetLastError () returned 0x0 [0055.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd323, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.882] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2cdd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x2cdd, lpOverlapped=0x0) returned 1 [0055.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.883] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.883] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.883] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.883] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.884] CloseHandle (hObject=0xf0) returned 1 [0055.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.885] GetLastError () returned 0x0 [0055.885] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0055.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.886] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.886] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17588702776) returned 1 [0055.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb01fa8d0, dwHighDateTime=0x1d585b4)) [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bcb8 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bcb8 | out: hHeap=0x260000) returned 1 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27668c0 [0055.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0055.887] GetLastError () returned 0x0 [0055.887] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0055.887] GetLastError () returned 0x0 [0055.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb393, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.985] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4c6d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x1cffdb0*=0x4c6d, lpOverlapped=0x0) returned 1 [0055.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.986] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.986] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.986] CloseHandle (hObject=0xf0) returned 1 [0055.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.987] GetLastError () returned 0x0 [0056.088] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.089] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.089] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.089] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17609097923) returned 1 [0056.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb03e9ab0, dwHighDateTime=0x1d585b4)) [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763090 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763090 | out: hHeap=0x260000) returned 1 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767798 [0056.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.090] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.091] GetLastError () returned 0x0 [0056.091] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.091] GetLastError () returned 0x0 [0056.094] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdfda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.094] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x2026, lpOverlapped=0x0) returned 1 [0056.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.165] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.165] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.165] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.165] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.166] CloseHandle (hObject=0xf8) returned 1 [0056.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.167] GetLastError () returned 0x0 [0056.167] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.168] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.168] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.168] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17616951858) returned 1 [0056.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb04a8190, dwHighDateTime=0x1d585b4)) [0056.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295498 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27671a8 [0056.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.169] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.169] GetLastError () returned 0x0 [0056.169] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.169] GetLastError () returned 0x0 [0056.184] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffea011, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.184] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x15fef, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x15fef, lpOverlapped=0x0) returned 1 [0056.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.185] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.185] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.185] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.186] CloseHandle (hObject=0xf8) returned 1 [0056.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.187] GetLastError () returned 0x0 [0056.187] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.188] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.188] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.188] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17618932046) returned 1 [0056.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb04ce2f0, dwHighDateTime=0x1d585b4)) [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763288 [0056.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763288 | out: hHeap=0x260000) returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767d88 [0056.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.189] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.189] GetLastError () returned 0x0 [0056.189] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.189] GetLastError () returned 0x0 [0056.196] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.197] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.197] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.197] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.198] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.198] CloseHandle (hObject=0xf8) returned 1 [0056.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.199] GetLastError () returned 0x0 [0056.200] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.201] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.201] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.201] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17620226340) returned 1 [0056.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb04f4450, dwHighDateTime=0x1d585b4)) [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27632f8 [0056.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27632f8 | out: hHeap=0x260000) returned 1 [0056.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x330db0 [0056.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.202] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.202] GetLastError () returned 0x0 [0056.202] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.202] GetLastError () returned 0x0 [0056.206] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.206] WriteFile (in: hFile=0xf8, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.207] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.207] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.208] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.208] CloseHandle (hObject=0xf8) returned 1 [0056.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.209] GetLastError () returned 0x0 [0056.209] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.210] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.210] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.210] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17621156809) returned 1 [0056.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb051a5b0, dwHighDateTime=0x1d585b4)) [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763330 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763330 | out: hHeap=0x260000) returned 1 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331140 [0056.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.211] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.211] GetLastError () returned 0x0 [0056.211] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.211] GetLastError () returned 0x0 [0056.214] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe753c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.214] WriteFile (in: hFile=0xf8, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x18ac4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x18ac4, lpOverlapped=0x0) returned 1 [0056.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.215] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.215] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.215] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.215] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.215] CloseHandle (hObject=0xf8) returned 1 [0056.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.217] GetLastError () returned 0x0 [0056.217] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0056.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0056.218] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.218] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17621904228) returned 1 [0056.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb051a5b0, dwHighDateTime=0x1d585b4)) [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763368 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763368 | out: hHeap=0x260000) returned 1 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x330ee0 [0056.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.219] GetLastError () returned 0x0 [0056.219] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.219] GetLastError () returned 0x0 [0056.271] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.272] WriteFile (in: hFile=0xf8, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.273] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.273] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.273] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.273] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.274] CloseHandle (hObject=0xf8) returned 1 [0056.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.316] GetLastError () returned 0x0 [0056.317] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.317] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.317] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.318] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17631865816) returned 1 [0056.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0624f50, dwHighDateTime=0x1d585b4)) [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27635d0 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27635d0 | out: hHeap=0x260000) returned 1 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bcc0 [0056.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.318] GetLastError () returned 0x0 [0056.318] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.318] GetLastError () returned 0x0 [0056.322] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff270a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.322] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0xd8f6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x1cffdb0*=0xd8f6, lpOverlapped=0x0) returned 1 [0056.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.323] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.323] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.323] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.323] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.323] CloseHandle (hObject=0x108) returned 1 [0056.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.325] GetLastError () returned 0x0 [0056.329] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.352] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.352] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.359] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17635985302) returned 1 [0056.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0671210, dwHighDateTime=0x1d585b4)) [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763720 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763720 | out: hHeap=0x260000) returned 1 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5dd0 [0056.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.360] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.360] GetLastError () returned 0x0 [0056.360] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.360] GetLastError () returned 0x0 [0056.364] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffee880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.364] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x11780, lpOverlapped=0x0) returned 1 [0056.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.365] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.365] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.366] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.366] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.366] CloseHandle (hObject=0x108) returned 1 [0056.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.367] GetLastError () returned 0x0 [0056.367] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.368] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.368] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.368] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17636955372) returned 1 [0056.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0697370, dwHighDateTime=0x1d585b4)) [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763758 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0056.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763758 | out: hHeap=0x260000) returned 1 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5b70 [0056.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.369] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.369] GetLastError () returned 0x0 [0056.369] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.369] GetLastError () returned 0x0 [0056.371] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff34f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.371] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xcb0a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xcb0a, lpOverlapped=0x0) returned 1 [0056.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.372] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.372] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.372] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.372] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.373] CloseHandle (hObject=0x108) returned 1 [0056.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.374] GetLastError () returned 0x0 [0056.374] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.375] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.375] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.375] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17637618186) returned 1 [0056.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0697370, dwHighDateTime=0x1d585b4)) [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763790 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763790 | out: hHeap=0x260000) returned 1 [0056.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5f00 [0056.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.376] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.376] GetLastError () returned 0x0 [0056.376] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.376] GetLastError () returned 0x0 [0056.378] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9314, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.378] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6cec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x6cec, lpOverlapped=0x0) returned 1 [0056.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.431] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.431] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.431] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.431] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.432] CloseHandle (hObject=0x108) returned 1 [0056.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.488] GetLastError () returned 0x0 [0056.488] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0056.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.489] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.489] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17648988905) returned 1 [0056.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb07c7e70, dwHighDateTime=0x1d585b4)) [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bf0 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5f98 [0056.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.490] GetLastError () returned 0x0 [0056.490] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.490] GetLastError () returned 0x0 [0056.492] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffef70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.492] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1090, lpOverlapped=0x0) returned 1 [0056.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.494] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.494] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.495] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.495] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.495] CloseHandle (hObject=0x108) returned 1 [0056.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.496] GetLastError () returned 0x0 [0056.496] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0056.497] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.497] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.497] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17649855325) returned 1 [0056.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb07c7e70, dwHighDateTime=0x1d585b4)) [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d08 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f67e8 [0056.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.498] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.498] GetLastError () returned 0x0 [0056.498] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.498] GetLastError () returned 0x0 [0056.502] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffce1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.502] WriteFile (in: hFile=0x108, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x31e2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x31e2, lpOverlapped=0x0) returned 1 [0056.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.503] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.503] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.504] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.504] CloseHandle (hObject=0x108) returned 1 [0056.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.505] GetLastError () returned 0x0 [0056.505] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0056.506] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.506] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.506] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17650745347) returned 1 [0056.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb07edfd0, dwHighDateTime=0x1d585b4)) [0056.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763950 [0056.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763950 | out: hHeap=0x260000) returned 1 [0056.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6880 [0056.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.507] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.507] GetLastError () returned 0x0 [0056.507] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.507] GetLastError () returned 0x0 [0056.510] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffafbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.510] WriteFile (in: hFile=0x108, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x5044, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x5044, lpOverlapped=0x0) returned 1 [0056.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.510] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.511] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.511] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.511] CloseHandle (hObject=0x108) returned 1 [0056.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.512] GetLastError () returned 0x0 [0056.513] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0056.513] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.513] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.514] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17651470785) returned 1 [0056.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb07edfd0, dwHighDateTime=0x1d585b4)) [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763988 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763988 | out: hHeap=0x260000) returned 1 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f69b0 [0056.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.514] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.514] GetLastError () returned 0x0 [0056.514] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.515] GetLastError () returned 0x0 [0056.516] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd5be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.516] WriteFile (in: hFile=0x108, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x2a42, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x2a42, lpOverlapped=0x0) returned 1 [0056.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.517] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.517] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.517] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.517] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.518] CloseHandle (hObject=0x108) returned 1 [0056.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.519] GetLastError () returned 0x0 [0056.519] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0056.520] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.520] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.520] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17652114735) returned 1 [0056.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0814130, dwHighDateTime=0x1d585b4)) [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27639c0 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27639c0 | out: hHeap=0x260000) returned 1 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0056.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6a48 [0056.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0056.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.521] GetLastError () returned 0x0 [0056.521] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.521] GetLastError () returned 0x0 [0056.523] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff156, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.523] WriteFile (in: hFile=0x108, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0xeaa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0xeaa, lpOverlapped=0x0) returned 1 [0056.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.523] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.523] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.524] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.524] CloseHandle (hObject=0x108) returned 1 [0056.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.525] GetLastError () returned 0x0 [0056.601] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.602] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.602] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17660293938) returned 1 [0056.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb08d2810, dwHighDateTime=0x1d585b4)) [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c28 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c28 | out: hHeap=0x260000) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7038 [0056.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.602] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.604] GetLastError () returned 0x0 [0056.604] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.604] GetLastError () returned 0x0 [0056.624] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffecdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.624] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1324, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1324, lpOverlapped=0x0) returned 1 [0056.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.625] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.625] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.625] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.625] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.625] CloseHandle (hObject=0x108) returned 1 [0056.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.650] GetLastError () returned 0x0 [0056.650] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.651] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.651] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17665213968) returned 1 [0056.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0944c30, dwHighDateTime=0x1d585b4)) [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763d78 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763d78 | out: hHeap=0x260000) returned 1 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6b78 [0056.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.652] GetLastError () returned 0x0 [0056.652] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.652] GetLastError () returned 0x0 [0056.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb094, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.654] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x4f6c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x1cffdb0*=0x4f6c, lpOverlapped=0x0) returned 1 [0056.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.657] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.657] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.657] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.657] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.658] CloseHandle (hObject=0x10c) returned 1 [0056.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.658] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.659] GetLastError () returned 0x0 [0056.660] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.660] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.660] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.660] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17666158342) returned 1 [0056.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb096ad90, dwHighDateTime=0x1d585b4)) [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763de8 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763de8 | out: hHeap=0x260000) returned 1 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f74f8 [0056.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.661] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.661] GetLastError () returned 0x0 [0056.661] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.661] GetLastError () returned 0x0 [0056.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff6c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.664] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x1cffdb0*=0x938, lpOverlapped=0x0) returned 1 [0056.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.665] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.665] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.665] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.665] CloseHandle (hObject=0x10c) returned 1 [0056.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.667] GetLastError () returned 0x0 [0056.667] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.668] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.668] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.668] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17666897715) returned 1 [0056.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb096ad90, dwHighDateTime=0x1d585b4)) [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763e20 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0056.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763e20 | out: hHeap=0x260000) returned 1 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7628 [0056.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.669] GetLastError () returned 0x0 [0056.669] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.669] GetLastError () returned 0x0 [0056.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff4a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.670] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x1cffdb0*=0xb60, lpOverlapped=0x0) returned 1 [0056.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.671] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.671] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.671] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.672] CloseHandle (hObject=0x10c) returned 1 [0056.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.672] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.673] GetLastError () returned 0x0 [0056.673] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.674] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.674] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17667506592) returned 1 [0056.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb096ad90, dwHighDateTime=0x1d585b4)) [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763e58 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763e58 | out: hHeap=0x260000) returned 1 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f76c0 [0056.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.675] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.675] GetLastError () returned 0x0 [0056.675] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.675] GetLastError () returned 0x0 [0056.753] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9106, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.753] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x6efa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x1cffdb0*=0x6efa, lpOverlapped=0x0) returned 1 [0056.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.754] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.754] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.755] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.755] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.764] CloseHandle (hObject=0x10c) returned 1 [0056.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.782] GetLastError () returned 0x0 [0056.782] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.783] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.783] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.783] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17678436518) returned 1 [0056.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0a75730, dwHighDateTime=0x1d585b4)) [0056.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c1f8 [0056.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c1f8 | out: hHeap=0x260000) returned 1 [0056.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b45e0 [0056.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.784] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.784] GetLastError () returned 0x0 [0056.784] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.784] GetLastError () returned 0x0 [0056.787] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffcdf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.787] WriteFile (in: hFile=0x10c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x3210, lpOverlapped=0x0) returned 1 [0056.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.787] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.788] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.788] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.788] CloseHandle (hObject=0x10c) returned 1 [0056.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.790] GetLastError () returned 0x0 [0056.790] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.791] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.791] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17679183786) returned 1 [0056.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0a9b890, dwHighDateTime=0x1d585b4)) [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c1c0 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c1c0 | out: hHeap=0x260000) returned 1 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4710 [0056.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.791] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.791] GetLastError () returned 0x0 [0056.792] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.792] GetLastError () returned 0x0 [0056.793] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff83ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.793] WriteFile (in: hFile=0x10c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x7c46, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c46, lpOverlapped=0x0) returned 1 [0056.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.794] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.794] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.794] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.794] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.794] CloseHandle (hObject=0x10c) returned 1 [0056.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.796] GetLastError () returned 0x0 [0056.796] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.797] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.797] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.797] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17679857797) returned 1 [0056.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0a9b890, dwHighDateTime=0x1d585b4)) [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c188 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c188 | out: hHeap=0x260000) returned 1 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b47a8 [0056.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.798] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.798] GetLastError () returned 0x0 [0056.798] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.798] GetLastError () returned 0x0 [0056.800] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffab58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.800] WriteFile (in: hFile=0x10c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x54a8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x54a8, lpOverlapped=0x0) returned 1 [0056.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.801] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.801] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.801] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.801] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.802] CloseHandle (hObject=0x10c) returned 1 [0056.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.803] GetLastError () returned 0x0 [0056.803] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.804] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.804] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17680589573) returned 1 [0056.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0ac19f0, dwHighDateTime=0x1d585b4)) [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c150 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c150 | out: hHeap=0x260000) returned 1 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4840 [0056.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.806] GetLastError () returned 0x0 [0056.806] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.806] GetLastError () returned 0x0 [0056.807] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe582, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.807] WriteFile (in: hFile=0x10c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x1a7e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x1cffdb0*=0x1a7e, lpOverlapped=0x0) returned 1 [0056.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.808] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.808] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.808] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.809] CloseHandle (hObject=0x10c) returned 1 [0056.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.810] GetLastError () returned 0x0 [0056.810] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.811] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.811] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.811] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17681222256) returned 1 [0056.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0ac19f0, dwHighDateTime=0x1d585b4)) [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c118 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c118 | out: hHeap=0x260000) returned 1 [0056.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b48d8 [0056.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.812] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.812] GetLastError () returned 0x0 [0056.812] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.812] GetLastError () returned 0x0 [0056.891] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.891] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1e00, lpOverlapped=0x0) returned 1 [0056.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.892] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.892] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.892] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.892] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.893] CloseHandle (hObject=0x10c) returned 1 [0056.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0056.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0056.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.968] GetLastError () returned 0x0 [0056.968] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.969] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.969] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.969] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17697031124) returned 1 [0056.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0c3e7b0, dwHighDateTime=0x1d585b4)) [0056.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ec10 [0056.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ec10 | out: hHeap=0x260000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4970 [0056.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.970] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.970] GetLastError () returned 0x0 [0056.970] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.970] GetLastError () returned 0x0 [0056.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.974] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.975] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.975] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.975] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.975] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.976] CloseHandle (hObject=0xf0) returned 1 [0056.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341a00 [0056.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341a00 | out: hHeap=0x260000) returned 1 [0056.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.977] GetLastError () returned 0x0 [0056.978] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.978] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.979] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17697974842) returned 1 [0056.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0c64910, dwHighDateTime=0x1d585b4)) [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ebd8 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ebd8 | out: hHeap=0x260000) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b54b8 [0056.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.979] GetLastError () returned 0x0 [0056.980] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.980] GetLastError () returned 0x0 [0056.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb17e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.981] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4e82, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x4e82, lpOverlapped=0x0) returned 1 [0056.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.982] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.982] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.982] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.983] CloseHandle (hObject=0xf0) returned 1 [0056.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341a00 [0056.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341a00 | out: hHeap=0x260000) returned 1 [0056.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.984] GetLastError () returned 0x0 [0056.984] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.985] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.985] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.985] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17698600191) returned 1 [0056.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0c64910, dwHighDateTime=0x1d585b4)) [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eba0 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eba0 | out: hHeap=0x260000) returned 1 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5550 [0056.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.986] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.986] GetLastError () returned 0x0 [0056.986] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.986] GetLastError () returned 0x0 [0056.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb526, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.987] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4ada, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x4ada, lpOverlapped=0x0) returned 1 [0056.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.988] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.988] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.989] CloseHandle (hObject=0xf0) returned 1 [0056.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.992] GetLastError () returned 0x0 [0056.993] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0056.993] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.993] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0056.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.993] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17699459696) returned 1 [0056.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0c8aa70, dwHighDateTime=0x1d585b4)) [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eb68 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eb68 | out: hHeap=0x260000) returned 1 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b55e8 [0056.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.994] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0056.994] GetLastError () returned 0x0 [0056.994] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0056.994] GetLastError () returned 0x0 [0056.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdfd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.996] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2028, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x2028, lpOverlapped=0x0) returned 1 [0056.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0056.997] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.997] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.997] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.997] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.998] CloseHandle (hObject=0xf0) returned 1 [0056.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.999] GetLastError () returned 0x0 [0056.999] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.000] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.000] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.000] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17700134858) returned 1 [0057.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0c8aa70, dwHighDateTime=0x1d585b4)) [0057.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1e78 [0057.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1e78 | out: hHeap=0x260000) returned 1 [0057.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5680 [0057.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.001] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.001] GetLastError () returned 0x0 [0057.001] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.001] GetLastError () returned 0x0 [0057.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcb64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.003] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x349c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x349c, lpOverlapped=0x0) returned 1 [0057.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.003] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.004] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.004] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.004] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.004] CloseHandle (hObject=0xf0) returned 1 [0057.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.006] GetLastError () returned 0x0 [0057.006] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.007] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.007] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17700787093) returned 1 [0057.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0cb0bd0, dwHighDateTime=0x1d585b4)) [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1e40 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0057.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1e40 | out: hHeap=0x260000) returned 1 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b57b0 [0057.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.007] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.008] GetLastError () returned 0x0 [0057.008] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.008] GetLastError () returned 0x0 [0057.009] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.009] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xce0, lpOverlapped=0x0) returned 1 [0057.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.010] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.010] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.011] CloseHandle (hObject=0xf0) returned 1 [0057.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.012] GetLastError () returned 0x0 [0057.012] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0057.013] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0057.013] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0057.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.013] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17701413369) returned 1 [0057.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0cb0bd0, dwHighDateTime=0x1d585b4)) [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1e08 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1e08 | out: hHeap=0x260000) returned 1 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5848 [0057.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.014] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.014] GetLastError () returned 0x0 [0057.014] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.014] GetLastError () returned 0x0 [0057.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff462, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.016] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xb9e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xb9e, lpOverlapped=0x0) returned 1 [0057.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.016] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.016] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.017] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.017] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.017] CloseHandle (hObject=0xf0) returned 1 [0057.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.018] GetLastError () returned 0x0 [0057.018] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0057.019] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0057.019] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0057.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0057.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.019] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17702046414) returned 1 [0057.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0d95410, dwHighDateTime=0x1d585b4)) [0057.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1bd8 [0057.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1bd8 | out: hHeap=0x260000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5da0 [0057.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.099] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.099] GetLastError () returned 0x0 [0057.099] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.099] GetLastError () returned 0x0 [0057.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff378, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.101] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xc88, lpOverlapped=0x0) returned 1 [0057.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.102] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.102] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.102] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.102] CloseHandle (hObject=0xf0) returned 1 [0057.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.103] GetLastError () returned 0x0 [0057.104] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.104] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.105] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.105] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17710583606) returned 1 [0057.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0d95410, dwHighDateTime=0x1d585b4)) [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1ba0 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1ba0 | out: hHeap=0x260000) returned 1 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5978 [0057.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.105] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.106] GetLastError () returned 0x0 [0057.106] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.106] GetLastError () returned 0x0 [0057.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffb8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.107] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x474, lpOverlapped=0x0) returned 1 [0057.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.108] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.108] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.108] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.109] CloseHandle (hObject=0xf0) returned 1 [0057.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.109] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.110] GetLastError () returned 0x0 [0057.110] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.111] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.111] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.111] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17711216836) returned 1 [0057.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0d95410, dwHighDateTime=0x1d585b4)) [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1b68 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1b68 | out: hHeap=0x260000) returned 1 [0057.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5f68 [0057.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.112] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.112] GetLastError () returned 0x0 [0057.112] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.112] GetLastError () returned 0x0 [0057.113] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff994, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.113] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x66c, lpOverlapped=0x0) returned 1 [0057.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.115] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.115] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.115] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.115] CloseHandle (hObject=0xf0) returned 1 [0057.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.117] GetLastError () returned 0x0 [0057.117] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.118] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17711888138) returned 1 [0057.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0dbb570, dwHighDateTime=0x1d585b4)) [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1b30 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1b30 | out: hHeap=0x260000) returned 1 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6000 [0057.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.118] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.119] GetLastError () returned 0x0 [0057.119] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.119] GetLastError () returned 0x0 [0057.120] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.120] WriteFile (in: hFile=0xf0, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2a0, lpOverlapped=0x0) returned 1 [0057.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.122] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.122] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.123] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.123] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.123] CloseHandle (hObject=0xf0) returned 1 [0057.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.124] GetLastError () returned 0x0 [0057.124] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.125] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.125] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.125] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17712656088) returned 1 [0057.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0dbb570, dwHighDateTime=0x1d585b4)) [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1af8 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1af8 | out: hHeap=0x260000) returned 1 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6098 [0057.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.126] GetLastError () returned 0x0 [0057.126] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.126] GetLastError () returned 0x0 [0057.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe018, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.130] WriteFile (in: hFile=0xf0, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x1fe8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1fe8, lpOverlapped=0x0) returned 1 [0057.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.130] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.131] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.131] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.131] CloseHandle (hObject=0xf0) returned 1 [0057.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.132] GetLastError () returned 0x0 [0057.304] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.308] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.308] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.308] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17731074328) returned 1 [0057.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0f845f0, dwHighDateTime=0x1d585b4)) [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1ac0 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1ac0 | out: hHeap=0x260000) returned 1 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5e38 [0057.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.310] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.310] GetLastError () returned 0x0 [0057.311] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.311] GetLastError () returned 0x0 [0057.312] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb7ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.312] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x4816, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x1cffdb0*=0x4816, lpOverlapped=0x0) returned 1 [0057.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.313] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.313] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.313] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.313] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.314] CloseHandle (hObject=0xf8) returned 1 [0057.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0057.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0057.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.315] GetLastError () returned 0x0 [0057.316] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.316] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.317] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.317] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17731784090) returned 1 [0057.317] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb0faa750, dwHighDateTime=0x1d585b4)) [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1a88 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1a88 | out: hHeap=0x260000) returned 1 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b61c8 [0057.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.318] GetLastError () returned 0x0 [0057.318] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.318] GetLastError () returned 0x0 [0057.320] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff83b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.320] WriteFile (in: hFile=0xf8, lpBuffer=0x27cc070*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27cc070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c50, lpOverlapped=0x0) returned 1 [0057.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc070 | out: hHeap=0x260000) returned 1 [0057.321] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.321] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.321] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.322] CloseHandle (hObject=0xf8) returned 1 [0057.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0057.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0057.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.323] GetLastError () returned 0x0 [0057.413] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.414] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.414] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.414] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17741537057) returned 1 [0057.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb108ef90, dwHighDateTime=0x1d585b4)) [0057.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f230 [0057.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f230 | out: hHeap=0x260000) returned 1 [0057.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6688 [0057.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.415] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.416] GetLastError () returned 0x0 [0057.416] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.417] GetLastError () returned 0x0 [0057.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff01c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.470] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xfe4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0xfe4, lpOverlapped=0x0) returned 1 [0057.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.471] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.471] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.471] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.472] CloseHandle (hObject=0xf0) returned 1 [0057.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.473] GetLastError () returned 0x0 [0057.473] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.474] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.474] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17747544847) returned 1 [0057.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1127510, dwHighDateTime=0x1d585b4)) [0057.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f0a8 [0057.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f0a8 | out: hHeap=0x260000) returned 1 [0057.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b62f8 [0057.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.475] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.475] GetLastError () returned 0x0 [0057.475] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.475] GetLastError () returned 0x0 [0057.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd048, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.484] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2fb8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x2fb8, lpOverlapped=0x0) returned 1 [0057.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.485] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.485] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.485] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.486] CloseHandle (hObject=0xf0) returned 1 [0057.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.506] GetLastError () returned 0x0 [0057.512] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.525] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.525] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17752636765) returned 1 [0057.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1199930, dwHighDateTime=0x1d585b4)) [0057.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ef58 [0057.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ef58 | out: hHeap=0x260000) returned 1 [0057.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b71d0 [0057.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.526] GetLastError () returned 0x0 [0057.526] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.526] GetLastError () returned 0x0 [0057.625] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff008, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.632] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xff8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xff8, lpOverlapped=0x0) returned 1 [0057.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.639] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.639] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.640] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.640] CloseHandle (hObject=0x108) returned 1 [0057.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.642] GetLastError () returned 0x0 [0057.642] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.643] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.643] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17764386573) returned 1 [0057.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb12ca430, dwHighDateTime=0x1d585b4)) [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997f8 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331ac0 [0057.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.644] GetLastError () returned 0x0 [0057.644] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.644] GetLastError () returned 0x0 [0057.645] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe65c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.645] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19a4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x19a4, lpOverlapped=0x0) returned 1 [0057.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.646] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.646] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.646] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.646] CloseHandle (hObject=0x108) returned 1 [0057.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.648] GetLastError () returned 0x0 [0057.648] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.649] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.649] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.649] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17765005048) returned 1 [0057.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb12ca430, dwHighDateTime=0x1d585b4)) [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299948 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331bf0 [0057.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.650] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.650] GetLastError () returned 0x0 [0057.650] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.650] GetLastError () returned 0x0 [0057.651] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe34d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.651] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1cb3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1cb3, lpOverlapped=0x0) returned 1 [0057.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.652] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.652] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.653] CloseHandle (hObject=0x108) returned 1 [0057.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.654] GetLastError () returned 0x0 [0057.654] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.655] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.655] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17765642474) returned 1 [0057.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb12ca430, dwHighDateTime=0x1d585b4)) [0057.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299478 [0057.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0057.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331b58 [0057.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.656] GetLastError () returned 0x0 [0057.656] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.657] GetLastError () returned 0x0 [0057.658] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe594, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.658] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1a6c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1a6c, lpOverlapped=0x0) returned 1 [0057.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.659] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.659] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.660] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.660] CloseHandle (hObject=0x108) returned 1 [0057.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.661] GetLastError () returned 0x0 [0057.661] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.662] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.662] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.662] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17766348181) returned 1 [0057.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb12f0590, dwHighDateTime=0x1d585b4)) [0057.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295230 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295230 | out: hHeap=0x260000) returned 1 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331a28 [0057.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.663] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.663] GetLastError () returned 0x0 [0057.663] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.663] GetLastError () returned 0x0 [0057.665] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffeaef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.665] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1511, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1511, lpOverlapped=0x0) returned 1 [0057.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.666] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.666] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.666] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.667] CloseHandle (hObject=0x108) returned 1 [0057.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.668] GetLastError () returned 0x0 [0057.668] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.669] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.669] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17767028631) returned 1 [0057.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb12f0590, dwHighDateTime=0x1d585b4)) [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951c0 [0057.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951c0 | out: hHeap=0x260000) returned 1 [0057.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331860 [0057.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.670] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.670] GetLastError () returned 0x0 [0057.670] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.670] GetLastError () returned 0x0 [0057.672] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9ec0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.672] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x6140, lpOverlapped=0x0) returned 1 [0057.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.673] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.673] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.828] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.828] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.829] CloseHandle (hObject=0x108) returned 1 [0057.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.854] GetLastError () returned 0x0 [0057.855] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.855] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.855] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.856] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17785680359) returned 1 [0057.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb14b9610, dwHighDateTime=0x1d585b4)) [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1ad8 | out: hHeap=0x260000) returned 1 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7d18 [0057.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.856] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.856] GetLastError () returned 0x0 [0057.857] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.857] GetLastError () returned 0x0 [0057.873] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffa990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.873] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x5670, lpOverlapped=0x0) returned 1 [0057.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.874] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.874] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.874] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.874] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.875] CloseHandle (hObject=0x108) returned 1 [0057.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.938] GetLastError () returned 0x0 [0057.939] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.939] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.940] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.940] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17794082928) returned 1 [0057.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb159de50, dwHighDateTime=0x1d585b4)) [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0460 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0460 | out: hHeap=0x260000) returned 1 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767c58 [0057.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.940] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.941] GetLastError () returned 0x0 [0057.941] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.941] GetLastError () returned 0x0 [0057.949] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc6da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.949] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x3926, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3926, lpOverlapped=0x0) returned 1 [0057.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.950] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.950] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.950] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.951] CloseHandle (hObject=0x108) returned 1 [0057.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.952] GetLastError () returned 0x0 [0057.952] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.953] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.953] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.953] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17795449900) returned 1 [0057.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb159de50, dwHighDateTime=0x1d585b4)) [0057.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0268 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0268 | out: hHeap=0x260000) returned 1 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bcc0 [0057.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.954] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.954] GetLastError () returned 0x0 [0057.954] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.955] GetLastError () returned 0x0 [0057.959] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff4e5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.959] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0xb1a4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x1cffdb0*=0xb1a4, lpOverlapped=0x0) returned 1 [0057.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.960] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.960] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.960] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.961] CloseHandle (hObject=0x108) returned 1 [0057.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.962] GetLastError () returned 0x0 [0057.963] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.963] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.963] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.963] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17796463626) returned 1 [0057.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb15c3fb0, dwHighDateTime=0x1d585b4)) [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f02d8 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02d8 | out: hHeap=0x260000) returned 1 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ce20 [0057.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.964] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.964] GetLastError () returned 0x0 [0057.964] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.964] GetLastError () returned 0x0 [0057.966] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe360, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.966] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x1ca0, lpOverlapped=0x0) returned 1 [0057.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.967] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.967] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.967] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.967] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.967] CloseHandle (hObject=0x108) returned 1 [0057.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.969] GetLastError () returned 0x0 [0057.969] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.970] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.970] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17797117584) returned 1 [0057.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb15ea110, dwHighDateTime=0x1d585b4)) [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0057.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0057.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0057.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3318f8 [0057.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.971] GetLastError () returned 0x0 [0057.971] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.971] GetLastError () returned 0x0 [0057.973] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe6f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.973] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1908, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x1908, lpOverlapped=0x0) returned 1 [0057.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.973] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.973] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.974] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.974] CloseHandle (hObject=0x108) returned 1 [0057.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.975] GetLastError () returned 0x0 [0057.975] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0057.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0057.976] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0057.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.976] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17797745222) returned 1 [0057.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb15ea110, dwHighDateTime=0x1d585b4)) [0057.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0057.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0057.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332018 [0057.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.977] GetLastError () returned 0x0 [0057.977] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.977] GetLastError () returned 0x0 [0057.979] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffcf00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.979] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x3100, lpOverlapped=0x0) returned 1 [0057.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.979] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.980] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.980] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.980] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.980] CloseHandle (hObject=0x108) returned 1 [0057.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0057.982] GetLastError () returned 0x0 [0057.982] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0057.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0057.983] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0057.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0057.983] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17798382926) returned 1 [0057.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb15ea110, dwHighDateTime=0x1d585b4)) [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331f80 [0057.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0057.984] GetLastError () returned 0x0 [0057.984] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0057.984] GetLastError () returned 0x0 [0058.037] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd6fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.037] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2904, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x2904, lpOverlapped=0x0) returned 1 [0058.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.044] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.044] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.055] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.056] CloseHandle (hObject=0x108) returned 1 [0058.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.067] GetLastError () returned 0x0 [0058.130] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.156] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.156] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.163] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17816419832) returned 1 [0058.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb17b3190, dwHighDateTime=0x1d585b4)) [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a08 [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a08 | out: hHeap=0x260000) returned 1 [0058.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d8d0 [0058.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.164] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.164] GetLastError () returned 0x0 [0058.164] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.164] GetLastError () returned 0x0 [0058.167] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff8720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.167] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x78e0, lpOverlapped=0x0) returned 1 [0058.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.168] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.168] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.168] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.169] CloseHandle (hObject=0x104) returned 1 [0058.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.170] GetLastError () returned 0x0 [0058.170] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.171] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.171] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.171] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17817233018) returned 1 [0058.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb17b3190, dwHighDateTime=0x1d585b4)) [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a40 [0058.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a40 | out: hHeap=0x260000) returned 1 [0058.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d5d8 [0058.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.172] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.172] GetLastError () returned 0x0 [0058.172] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.172] GetLastError () returned 0x0 [0058.174] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff390, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.174] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xc70, lpOverlapped=0x0) returned 1 [0058.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.175] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.175] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.175] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.175] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.176] CloseHandle (hObject=0x104) returned 1 [0058.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.177] GetLastError () returned 0x0 [0058.177] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.178] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.178] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17817911391) returned 1 [0058.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb17d92f0, dwHighDateTime=0x1d585b4)) [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a78 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a78 | out: hHeap=0x260000) returned 1 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0058.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.179] GetLastError () returned 0x0 [0058.179] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.179] GetLastError () returned 0x0 [0058.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff9ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.181] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x614, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x614, lpOverlapped=0x0) returned 1 [0058.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.181] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.182] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.182] CloseHandle (hObject=0x104) returned 1 [0058.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.183] GetLastError () returned 0x0 [0058.184] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.185] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.185] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.185] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17818590056) returned 1 [0058.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb17d92f0, dwHighDateTime=0x1d585b4)) [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ab0 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ab0 | out: hHeap=0x260000) returned 1 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da98 [0058.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.186] GetLastError () returned 0x0 [0058.186] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.186] GetLastError () returned 0x0 [0058.187] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.187] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x8b4, lpOverlapped=0x0) returned 1 [0058.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.189] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.189] CloseHandle (hObject=0x104) returned 1 [0058.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.190] GetLastError () returned 0x0 [0058.191] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.192] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.192] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.192] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17819295808) returned 1 [0058.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb17ff450, dwHighDateTime=0x1d585b4)) [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b20 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b20 | out: hHeap=0x260000) returned 1 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29db30 [0058.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.192] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.193] GetLastError () returned 0x0 [0058.193] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.193] GetLastError () returned 0x0 [0058.194] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff96e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.194] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x692, lpOverlapped=0x0) returned 1 [0058.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.195] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.195] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.195] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.195] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.196] CloseHandle (hObject=0x104) returned 1 [0058.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.197] GetLastError () returned 0x0 [0058.197] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.198] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.198] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.198] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17819921641) returned 1 [0058.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb17ff450, dwHighDateTime=0x1d585b4)) [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b58 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0058.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b58 | out: hHeap=0x260000) returned 1 [0058.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0058.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dc60 [0058.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.199] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.199] GetLastError () returned 0x0 [0058.199] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.199] GetLastError () returned 0x0 [0058.201] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd7d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.201] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x282c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x282c, lpOverlapped=0x0) returned 1 [0058.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.202] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.202] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.202] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.202] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.203] CloseHandle (hObject=0x104) returned 1 [0058.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.204] GetLastError () returned 0x0 [0058.204] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0058.205] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.205] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0058.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.205] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17820607861) returned 1 [0058.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb18255b0, dwHighDateTime=0x1d585b4)) [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b90 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b90 | out: hHeap=0x260000) returned 1 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0058.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.206] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.206] GetLastError () returned 0x0 [0058.206] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.206] GetLastError () returned 0x0 [0058.208] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.208] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2108, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2108, lpOverlapped=0x0) returned 1 [0058.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.208] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.208] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.209] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.209] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.209] CloseHandle (hObject=0x104) returned 1 [0058.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.211] GetLastError () returned 0x0 [0058.211] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0058.212] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.212] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0058.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.212] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17821341000) returned 1 [0058.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb18255b0, dwHighDateTime=0x1d585b4)) [0058.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9bc8 [0058.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x260000) returned 1 [0058.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dd90 [0058.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.213] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.213] GetLastError () returned 0x0 [0058.213] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.213] GetLastError () returned 0x0 [0058.215] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe0dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.215] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1f24, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f24, lpOverlapped=0x0) returned 1 [0058.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.215] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.215] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.216] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.216] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.216] CloseHandle (hObject=0x104) returned 1 [0058.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.217] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.218] GetLastError () returned 0x0 [0058.218] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0058.219] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.219] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0058.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.219] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17822050235) returned 1 [0058.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb184b710, dwHighDateTime=0x1d585b4)) [0058.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77b8 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29de28 [0058.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.220] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.220] GetLastError () returned 0x0 [0058.220] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.220] GetLastError () returned 0x0 [0058.400] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffde88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.400] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2178, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x2178, lpOverlapped=0x0) returned 1 [0058.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.402] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.402] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.402] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.402] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.403] CloseHandle (hObject=0x104) returned 1 [0058.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.404] GetLastError () returned 0x0 [0058.404] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.405] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.406] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17840772629) returned 1 [0058.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1b45290, dwHighDateTime=0x1d585b4)) [0058.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9d18 [0058.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d18 | out: hHeap=0x260000) returned 1 [0058.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29eb38 [0058.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.534] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.534] GetLastError () returned 0x0 [0058.534] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.534] GetLastError () returned 0x0 [0058.540] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe798, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.540] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1868, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x1cffdb0*=0x1868, lpOverlapped=0x0) returned 1 [0058.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.540] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.540] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.541] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.541] CloseHandle (hObject=0x104) returned 1 [0058.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.543] GetLastError () returned 0x0 [0058.543] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.544] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.544] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.544] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17854531852) returned 1 [0058.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1b45290, dwHighDateTime=0x1d585b4)) [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da098 [0058.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da098 | out: hHeap=0x260000) returned 1 [0058.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e250 [0058.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.545] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.545] GetLastError () returned 0x0 [0058.545] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.545] GetLastError () returned 0x0 [0058.552] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe36c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.552] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1c94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c94, lpOverlapped=0x0) returned 1 [0058.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.553] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.553] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.553] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.554] CloseHandle (hObject=0x104) returned 1 [0058.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.555] GetLastError () returned 0x0 [0058.555] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.556] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.556] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.556] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17855713671) returned 1 [0058.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1b6b3f0, dwHighDateTime=0x1d585b4)) [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da108 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da108 | out: hHeap=0x260000) returned 1 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0058.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.557] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.557] GetLastError () returned 0x0 [0058.557] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.557] GetLastError () returned 0x0 [0058.559] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.559] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.559] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.559] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.560] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.560] CloseHandle (hObject=0x104) returned 1 [0058.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.562] GetLastError () returned 0x0 [0058.563] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.563] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.563] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.564] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17856475872) returned 1 [0058.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1b91550, dwHighDateTime=0x1d585b4)) [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da140 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da140 | out: hHeap=0x260000) returned 1 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ae20 [0058.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.564] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.564] GetLastError () returned 0x0 [0058.564] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.565] GetLastError () returned 0x0 [0058.567] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe89c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.567] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1764, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1764, lpOverlapped=0x0) returned 1 [0058.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.570] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.570] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.570] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.570] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.570] CloseHandle (hObject=0x104) returned 1 [0058.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.572] GetLastError () returned 0x0 [0058.572] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.573] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.573] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.573] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17857406300) returned 1 [0058.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1b91550, dwHighDateTime=0x1d585b4)) [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da178 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da178 | out: hHeap=0x260000) returned 1 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29aeb8 [0058.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.574] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.574] GetLastError () returned 0x0 [0058.574] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.574] GetLastError () returned 0x0 [0058.656] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.657] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x7c08, lpOverlapped=0x0) returned 1 [0058.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.658] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.658] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.658] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.658] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.659] CloseHandle (hObject=0x104) returned 1 [0058.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.664] GetLastError () returned 0x0 [0058.665] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.665] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.665] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.666] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17866782428) returned 1 [0058.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1c75d90, dwHighDateTime=0x1d585b4)) [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da418 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da418 | out: hHeap=0x260000) returned 1 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29af50 [0058.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.667] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.668] GetLastError () returned 0x0 [0058.668] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.668] GetLastError () returned 0x0 [0058.670] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.670] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.671] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.671] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.672] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.672] CloseHandle (hObject=0x110) returned 1 [0058.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.672] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.673] GetLastError () returned 0x0 [0058.673] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.674] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.674] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17867556908) returned 1 [0058.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1c9bef0, dwHighDateTime=0x1d585b4)) [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da450 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da450 | out: hHeap=0x260000) returned 1 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b670 [0058.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.675] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.675] GetLastError () returned 0x0 [0058.675] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.675] GetLastError () returned 0x0 [0058.677] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.678] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.678] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.678] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.679] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.679] CloseHandle (hObject=0x110) returned 1 [0058.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0058.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.680] GetLastError () returned 0x0 [0058.680] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.681] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.681] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.681] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17868249119) returned 1 [0058.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1c9bef0, dwHighDateTime=0x1d585b4)) [0058.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da488 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da488 | out: hHeap=0x260000) returned 1 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b708 [0058.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.682] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.682] GetLastError () returned 0x0 [0058.682] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.682] GetLastError () returned 0x0 [0058.700] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8d69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.700] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7297, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7297, lpOverlapped=0x0) returned 1 [0058.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.701] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.701] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.701] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.701] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.702] CloseHandle (hObject=0x110) returned 1 [0058.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.703] GetLastError () returned 0x0 [0058.703] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.704] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.704] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.704] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17870532340) returned 1 [0058.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1ce81b0, dwHighDateTime=0x1d585b4)) [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da568 [0058.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da568 | out: hHeap=0x260000) returned 1 [0058.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b7a0 [0058.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.705] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.705] GetLastError () returned 0x0 [0058.705] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.705] GetLastError () returned 0x0 [0058.713] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.713] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.714] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.714] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.714] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.715] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.715] CloseHandle (hObject=0x110) returned 1 [0058.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.715] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.716] GetLastError () returned 0x0 [0058.716] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.717] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.717] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.717] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17871847785) returned 1 [0058.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1ce81b0, dwHighDateTime=0x1d585b4)) [0058.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da5d8 [0058.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da5d8 | out: hHeap=0x260000) returned 1 [0058.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ba00 [0058.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.718] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.718] GetLastError () returned 0x0 [0058.718] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.718] GetLastError () returned 0x0 [0058.727] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.727] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.727] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.727] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.728] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.728] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.728] CloseHandle (hObject=0x110) returned 1 [0058.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.728] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.730] GetLastError () returned 0x0 [0058.730] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.731] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.731] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.731] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17873279264) returned 1 [0058.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1d0e310, dwHighDateTime=0x1d585b4)) [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da610 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da610 | out: hHeap=0x260000) returned 1 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bb30 [0058.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.732] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.732] GetLastError () returned 0x0 [0058.733] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.733] GetLastError () returned 0x0 [0058.789] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff22b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.789] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xdd5, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0xdd5, lpOverlapped=0x0) returned 1 [0058.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.790] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.790] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.791] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.791] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.791] CloseHandle (hObject=0x110) returned 1 [0058.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.791] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.792] GetLastError () returned 0x0 [0058.793] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.793] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.793] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.794] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17879483769) returned 1 [0058.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1da6890, dwHighDateTime=0x1d585b4)) [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da7d0 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da7d0 | out: hHeap=0x260000) returned 1 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bbc8 [0058.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.795] GetLastError () returned 0x0 [0058.795] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.795] GetLastError () returned 0x0 [0058.801] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff7ee8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.801] WriteFile (in: hFile=0x110, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x8118, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x1cffdb0*=0x8118, lpOverlapped=0x0) returned 1 [0058.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.803] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.803] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.804] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.804] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.804] CloseHandle (hObject=0x110) returned 1 [0058.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.805] GetLastError () returned 0x0 [0058.815] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.836] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.836] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17883760586) returned 1 [0058.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1e18cb0, dwHighDateTime=0x1d585b4)) [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da878 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da878 | out: hHeap=0x260000) returned 1 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c1b8 [0058.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.837] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.838] GetLastError () returned 0x0 [0058.838] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.838] GetLastError () returned 0x0 [0058.841] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa0d5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.841] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5f2b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x5f2b, lpOverlapped=0x0) returned 1 [0058.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.842] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.842] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.843] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.844] CloseHandle (hObject=0x110) returned 1 [0058.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.845] GetLastError () returned 0x0 [0058.845] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.846] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.846] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.846] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17884722703) returned 1 [0058.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1e3ee10, dwHighDateTime=0x1d585b4)) [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da8e8 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da8e8 | out: hHeap=0x260000) returned 1 [0058.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c120 [0058.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.847] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.847] GetLastError () returned 0x0 [0058.847] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.847] GetLastError () returned 0x0 [0058.849] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff927a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.849] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x6d86, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x6d86, lpOverlapped=0x0) returned 1 [0058.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.849] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.849] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.850] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.850] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.850] CloseHandle (hObject=0x110) returned 1 [0058.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.852] GetLastError () returned 0x0 [0058.852] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0058.853] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.853] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.853] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17885395263) returned 1 [0058.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1e3ee10, dwHighDateTime=0x1d585b4)) [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da920 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da920 | out: hHeap=0x260000) returned 1 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c380 [0058.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.853] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0058.854] GetLastError () returned 0x0 [0058.854] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0058.854] GetLastError () returned 0x0 [0058.857] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa185, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.857] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5e7b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x5e7b, lpOverlapped=0x0) returned 1 [0058.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.858] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.858] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.940] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.941] CloseHandle (hObject=0x110) returned 1 [0058.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.[deadmin@cock.li].deadmin")) returned 1 [0059.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0059.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.017] GetLastError () returned 0x0 [0059.021] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.022] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.022] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.022] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17902286067) returned 1 [0059.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb1fe1d30, dwHighDateTime=0x1d585b4)) [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dab50 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab50 | out: hHeap=0x260000) returned 1 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c418 [0059.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.022] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.023] GetLastError () returned 0x0 [0059.023] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.023] GetLastError () returned 0x0 [0059.027] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.027] WriteFile (in: hFile=0x104, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0059.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.028] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.028] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.030] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.030] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.031] CloseHandle (hObject=0x104) returned 1 [0059.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.032] GetLastError () returned 0x0 [0059.033] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.033] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.033] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.034] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17903471416) returned 1 [0059.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2007e90, dwHighDateTime=0x1d585b4)) [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dabc0 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dabc0 | out: hHeap=0x260000) returned 1 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29caa0 [0059.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.034] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.034] GetLastError () returned 0x0 [0059.034] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.035] GetLastError () returned 0x0 [0059.036] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.036] WriteFile (in: hFile=0x104, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0059.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.037] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.037] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.041] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.041] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.041] CloseHandle (hObject=0x104) returned 1 [0059.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.042] GetLastError () returned 0x0 [0059.043] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.043] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.043] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.044] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17904467917) returned 1 [0059.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2007e90, dwHighDateTime=0x1d585b4)) [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dabf8 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dabf8 | out: hHeap=0x260000) returned 1 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29cbd0 [0059.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.044] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.044] GetLastError () returned 0x0 [0059.044] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.045] GetLastError () returned 0x0 [0059.050] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.050] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0059.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.053] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.053] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.062] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.062] CloseHandle (hObject=0x104) returned 1 [0059.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.063] GetLastError () returned 0x0 [0059.064] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.064] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.065] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17906579441) returned 1 [0059.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2054150, dwHighDateTime=0x1d585b4)) [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dac68 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dac68 | out: hHeap=0x260000) returned 1 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0059.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.066] GetLastError () returned 0x0 [0059.066] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.066] GetLastError () returned 0x0 [0059.212] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff5f2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.213] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xa0d2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xa0d2, lpOverlapped=0x0) returned 1 [0059.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.213] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.213] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.214] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.214] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.214] CloseHandle (hObject=0x104) returned 1 [0059.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.215] GetLastError () returned 0x0 [0059.229] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283ae70) returned 1 [0059.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.229] CryptReleaseContext (hProv=0x283ae70, dwFlags=0x0) returned 1 [0059.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.230] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17923074654) returned 1 [0059.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb21d0f10, dwHighDateTime=0x1d585b4)) [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2846a48 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2846a48 | out: hHeap=0x260000) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332d18 [0059.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.230] GetLastError () returned 0x0 [0059.231] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.231] GetLastError () returned 0x0 [0059.232] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffc2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.232] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3d6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x3d6, lpOverlapped=0x0) returned 1 [0059.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.233] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.233] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.234] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.234] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.234] CloseHandle (hObject=0x104) returned 1 [0059.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.235] GetLastError () returned 0x0 [0059.236] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283ae70) returned 1 [0059.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.237] CryptReleaseContext (hProv=0x283ae70, dwFlags=0x0) returned 1 [0059.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0059.237] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17923823945) returned 1 [0059.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb21f7070, dwHighDateTime=0x1d585b4)) [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db058 [0059.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db058 | out: hHeap=0x260000) returned 1 [0059.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333698 [0059.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.238] GetLastError () returned 0x0 [0059.238] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.238] GetLastError () returned 0x0 [0059.287] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff1f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.287] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xe0a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0xe0a, lpOverlapped=0x0) returned 1 [0059.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.288] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.289] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.289] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.289] CloseHandle (hObject=0x104) returned 1 [0059.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869838 [0059.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869838 | out: hHeap=0x260000) returned 1 [0059.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.291] GetLastError () returned 0x0 [0059.293] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.294] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.294] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.294] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17929563293) returned 1 [0059.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2269490, dwHighDateTime=0x1d585b4)) [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db100 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db100 | out: hHeap=0x260000) returned 1 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333600 [0059.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.295] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.295] GetLastError () returned 0x0 [0059.295] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.296] GetLastError () returned 0x0 [0059.302] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff4ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.302] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xb12, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xb12, lpOverlapped=0x0) returned 1 [0059.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.303] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.303] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.303] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.303] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.304] CloseHandle (hObject=0x108) returned 1 [0059.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.305] GetLastError () returned 0x0 [0059.305] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.306] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.306] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.308] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17930877848) returned 1 [0059.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb228f5f0, dwHighDateTime=0x1d585b4)) [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db138 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db138 | out: hHeap=0x260000) returned 1 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333860 [0059.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.308] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.308] GetLastError () returned 0x0 [0059.309] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.309] GetLastError () returned 0x0 [0059.345] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff2ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.346] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xd16, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xd16, lpOverlapped=0x0) returned 1 [0059.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.348] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.348] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.348] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.348] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.349] CloseHandle (hObject=0x108) returned 1 [0059.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.350] GetLastError () returned 0x0 [0059.350] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.351] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.351] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17935224360) returned 1 [0059.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2301a10, dwHighDateTime=0x1d585b4)) [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db250 [0059.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db250 | out: hHeap=0x260000) returned 1 [0059.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333990 [0059.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.352] GetLastError () returned 0x0 [0059.352] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.352] GetLastError () returned 0x0 [0059.466] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff835c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.466] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7ca4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x7ca4, lpOverlapped=0x0) returned 1 [0059.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.467] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.468] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.468] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.470] CloseHandle (hObject=0x108) returned 1 [0059.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.471] GetLastError () returned 0x0 [0059.485] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.485] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.485] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.486] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17948681098) returned 1 [0059.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2458670, dwHighDateTime=0x1d585b4)) [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db3d8 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db3d8 | out: hHeap=0x260000) returned 1 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333c88 [0059.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.486] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.487] GetLastError () returned 0x0 [0059.487] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.487] GetLastError () returned 0x0 [0059.489] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc956, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.489] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x36aa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x36aa, lpOverlapped=0x0) returned 1 [0059.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.492] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.492] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.492] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.492] CloseHandle (hObject=0x11c) returned 1 [0059.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0059.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0059.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.494] GetLastError () returned 0x0 [0059.494] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.495] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.495] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.495] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17949610357) returned 1 [0059.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2458670, dwHighDateTime=0x1d585b4)) [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db410 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db410 | out: hHeap=0x260000) returned 1 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3340b0 [0059.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.496] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.496] GetLastError () returned 0x0 [0059.496] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.496] GetLastError () returned 0x0 [0059.498] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffcd0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.499] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x32f6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x32f6, lpOverlapped=0x0) returned 1 [0059.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.499] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.499] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.500] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.500] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.500] CloseHandle (hObject=0x11c) returned 1 [0059.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0059.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0059.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.502] GetLastError () returned 0x0 [0059.502] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.503] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.503] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.503] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17950395182) returned 1 [0059.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb247e7d0, dwHighDateTime=0x1d585b4)) [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db448 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db448 | out: hHeap=0x260000) returned 1 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334148 [0059.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.503] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.504] GetLastError () returned 0x0 [0059.504] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.504] GetLastError () returned 0x0 [0059.508] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8580, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.508] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x7a80, lpOverlapped=0x0) returned 1 [0059.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.550] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.550] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.552] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.552] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.553] CloseHandle (hObject=0x11c) returned 1 [0059.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.554] GetLastError () returned 0x0 [0059.555] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.556] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.556] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.556] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17955733618) returned 1 [0059.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb24f0bf0, dwHighDateTime=0x1d585b4)) [0059.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db4b8 [0059.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db4b8 | out: hHeap=0x260000) returned 1 [0059.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3341e0 [0059.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.557] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.557] GetLastError () returned 0x0 [0059.557] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.557] GetLastError () returned 0x0 [0059.559] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffdfda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.559] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x2026, lpOverlapped=0x0) returned 1 [0059.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.560] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.560] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.560] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.561] CloseHandle (hObject=0x11c) returned 1 [0059.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.562] GetLastError () returned 0x0 [0059.563] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.563] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.563] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.564] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17956467766) returned 1 [0059.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2516d50, dwHighDateTime=0x1d585b4)) [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db4f0 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db4f0 | out: hHeap=0x260000) returned 1 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334310 [0059.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.564] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.564] GetLastError () returned 0x0 [0059.564] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.565] GetLastError () returned 0x0 [0059.579] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffca4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.579] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x35b2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x35b2, lpOverlapped=0x0) returned 1 [0059.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.580] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.580] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.580] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.580] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.581] CloseHandle (hObject=0x11c) returned 1 [0059.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.699] GetLastError () returned 0x0 [0059.699] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.700] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.700] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.700] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17970120873) returned 1 [0059.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2647850, dwHighDateTime=0x1d585b4)) [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db838 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db838 | out: hHeap=0x260000) returned 1 [0059.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0059.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.701] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.701] GetLastError () returned 0x0 [0059.701] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.701] GetLastError () returned 0x0 [0059.710] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe1a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.710] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1e5c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x1cffdb0*=0x1e5c, lpOverlapped=0x0) returned 1 [0059.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.711] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.711] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.711] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.712] CloseHandle (hObject=0x110) returned 1 [0059.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.932] GetLastError () returned 0x0 [0059.933] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.933] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.933] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.934] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17993464242) returned 1 [0059.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2882cf0, dwHighDateTime=0x1d585b4)) [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b84b8 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b84b8 | out: hHeap=0x260000) returned 1 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315af8 [0059.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.936] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.936] GetLastError () returned 0x0 [0059.936] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.936] GetLastError () returned 0x0 [0059.939] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffccf8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.939] WriteFile (in: hFile=0x110, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x3308, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x3308, lpOverlapped=0x0) returned 1 [0059.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0059.939] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.939] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.948] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.948] CloseHandle (hObject=0x110) returned 1 [0059.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0059.950] GetLastError () returned 0x0 [0059.950] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0059.951] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.951] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0059.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0059.951] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=17995233867) returned 1 [0059.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb28cefb0, dwHighDateTime=0x1d585b4)) [0059.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0059.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0059.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0059.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8528 [0059.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8528 | out: hHeap=0x260000) returned 1 [0059.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316218 [0059.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.952] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0059.952] GetLastError () returned 0x0 [0059.952] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0059.952] GetLastError () returned 0x0 [0059.994] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff484, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.994] WriteFile (in: hFile=0x110, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xb7c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0xb7c, lpOverlapped=0x0) returned 1 [0059.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0059.995] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.995] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.997] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.997] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.997] CloseHandle (hObject=0x110) returned 1 [0060.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0060.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0060.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.030] GetLastError () returned 0x0 [0060.030] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.031] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.031] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18003214508) returned 1 [0060.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb298d690, dwHighDateTime=0x1d585b4)) [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8720 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8720 | out: hHeap=0x260000) returned 1 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316348 [0060.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.032] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.032] GetLastError () returned 0x0 [0060.032] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.032] GetLastError () returned 0x0 [0060.044] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff040, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.044] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xfc0, lpOverlapped=0x0) returned 1 [0060.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.045] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.045] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.047] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.047] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.048] CloseHandle (hObject=0x11c) returned 1 [0060.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.049] GetLastError () returned 0x0 [0060.050] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.050] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.051] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18005169894) returned 1 [0060.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb29b37f0, dwHighDateTime=0x1d585b4)) [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8790 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8790 | out: hHeap=0x260000) returned 1 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3168a0 [0060.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.051] GetLastError () returned 0x0 [0060.051] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.052] GetLastError () returned 0x0 [0060.058] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd448, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.058] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2bb8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x2bb8, lpOverlapped=0x0) returned 1 [0060.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.059] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.059] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.059] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.059] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.060] CloseHandle (hObject=0x11c) returned 1 [0060.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.062] GetLastError () returned 0x0 [0060.062] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.063] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.063] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.063] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18006455669) returned 1 [0060.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb29d9950, dwHighDateTime=0x1d585b4)) [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8800 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8800 | out: hHeap=0x260000) returned 1 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3169d0 [0060.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.064] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.064] GetLastError () returned 0x0 [0060.065] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.065] GetLastError () returned 0x0 [0060.068] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff55c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.068] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xaa4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xaa4, lpOverlapped=0x0) returned 1 [0060.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.068] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.069] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.069] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.069] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.070] CloseHandle (hObject=0x11c) returned 1 [0060.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.071] GetLastError () returned 0x0 [0060.072] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.073] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.073] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.073] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18007394782) returned 1 [0060.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb29d9950, dwHighDateTime=0x1d585b4)) [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8838 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8838 | out: hHeap=0x260000) returned 1 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316b00 [0060.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.074] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.074] GetLastError () returned 0x0 [0060.074] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.074] GetLastError () returned 0x0 [0060.083] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe8dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.083] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1724, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x1724, lpOverlapped=0x0) returned 1 [0060.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.084] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.084] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.085] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.085] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.085] CloseHandle (hObject=0x11c) returned 1 [0060.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.085] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.087] GetLastError () returned 0x0 [0060.125] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.128] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.128] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18012896873) returned 1 [0060.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2a71ed0, dwHighDateTime=0x1d585b4)) [0060.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db218 [0060.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db218 | out: hHeap=0x260000) returned 1 [0060.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315f20 [0060.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.130] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.130] GetLastError () returned 0x0 [0060.130] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.130] GetLastError () returned 0x0 [0060.141] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd9fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.142] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x2602, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x2602, lpOverlapped=0x0) returned 1 [0060.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.142] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.142] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.143] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.143] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.144] CloseHandle (hObject=0xfc) returned 1 [0060.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc930 [0060.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc930 | out: hHeap=0x260000) returned 1 [0060.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.145] GetLastError () returned 0x0 [0060.145] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.146] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.146] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.146] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18014726711) returned 1 [0060.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2a98030, dwHighDateTime=0x1d585b4)) [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b88a8 [0060.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b88a8 | out: hHeap=0x260000) returned 1 [0060.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316c30 [0060.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.147] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.147] GetLastError () returned 0x0 [0060.147] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.147] GetLastError () returned 0x0 [0060.148] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff9da0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.149] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x6260, lpOverlapped=0x0) returned 1 [0060.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.149] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.149] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.150] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.150] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.150] CloseHandle (hObject=0xfc) returned 1 [0060.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc930 [0060.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc930 | out: hHeap=0x260000) returned 1 [0060.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.151] GetLastError () returned 0x0 [0060.152] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.152] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.152] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.153] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18015374970) returned 1 [0060.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2a98030, dwHighDateTime=0x1d585b4)) [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b88e0 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b88e0 | out: hHeap=0x260000) returned 1 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316cc8 [0060.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.153] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.153] GetLastError () returned 0x0 [0060.154] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.154] GetLastError () returned 0x0 [0060.155] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff6380, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.155] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x9c80, lpOverlapped=0x0) returned 1 [0060.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.156] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.156] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.156] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.157] CloseHandle (hObject=0xfc) returned 1 [0060.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc930 [0060.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc930 | out: hHeap=0x260000) returned 1 [0060.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.158] GetLastError () returned 0x0 [0060.158] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.159] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.159] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.159] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18016057353) returned 1 [0060.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2abe190, dwHighDateTime=0x1d585b4)) [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295118 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c120 [0060.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.160] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.160] GetLastError () returned 0x0 [0060.160] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.160] GetLastError () returned 0x0 [0060.162] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff01a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.162] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xfe6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0xfe6, lpOverlapped=0x0) returned 1 [0060.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.162] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.162] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.163] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.163] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.164] CloseHandle (hObject=0xfc) returned 1 [0060.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc930 [0060.164] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc930 | out: hHeap=0x260000) returned 1 [0060.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.165] GetLastError () returned 0x0 [0060.165] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.166] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.166] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.166] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18016725562) returned 1 [0060.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2abe190, dwHighDateTime=0x1d585b4)) [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953f0 [0060.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0060.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31eb88 [0060.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.167] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.167] GetLastError () returned 0x0 [0060.167] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.167] GetLastError () returned 0x0 [0060.171] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffaffa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.171] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x5006, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x5006, lpOverlapped=0x0) returned 1 [0060.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.172] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.172] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.172] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.173] CloseHandle (hObject=0xfc) returned 1 [0060.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0060.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0060.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.174] GetLastError () returned 0x0 [0060.174] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.175] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.175] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.175] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18017608860) returned 1 [0060.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2ae42f0, dwHighDateTime=0x1d585b4)) [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294eb0 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ede8 [0060.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.176] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.176] GetLastError () returned 0x0 [0060.176] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.176] GetLastError () returned 0x0 [0060.207] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.207] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x584, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x584, lpOverlapped=0x0) returned 1 [0060.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.207] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.207] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.208] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.208] CloseHandle (hObject=0xfc) returned 1 [0060.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.272] GetLastError () returned 0x0 [0060.272] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.273] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.273] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.273] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18027452380) returned 1 [0060.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2bc8b30, dwHighDateTime=0x1d585b4)) [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8ad8 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8ad8 | out: hHeap=0x260000) returned 1 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317058 [0060.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.274] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.274] GetLastError () returned 0x0 [0060.274] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.274] GetLastError () returned 0x0 [0060.361] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffa34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.361] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x5cc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x5cc, lpOverlapped=0x0) returned 1 [0060.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0060.362] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.362] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.362] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.364] CloseHandle (hObject=0x11c) returned 1 [0060.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.365] GetLastError () returned 0x0 [0060.388] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.389] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.389] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.389] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18038998782) returned 1 [0060.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2cf9630, dwHighDateTime=0x1d585b4)) [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8db0 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8db0 | out: hHeap=0x260000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3327d0 [0060.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.390] GetLastError () returned 0x0 [0060.390] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.390] GetLastError () returned 0x0 [0060.391] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.391] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x28b4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x28b4, lpOverlapped=0x0) returned 1 [0060.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.392] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.392] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.392] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.393] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.393] CloseHandle (hObject=0x11c) returned 1 [0060.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.402] GetLastError () returned 0x0 [0060.402] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.403] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.403] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.403] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18040455874) returned 1 [0060.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2d1f790, dwHighDateTime=0x1d585b4)) [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8de8 [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8de8 | out: hHeap=0x260000) returned 1 [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3327d0 [0060.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.405] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.405] GetLastError () returned 0x0 [0060.405] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.405] GetLastError () returned 0x0 [0060.407] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffda54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.407] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x25ac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x25ac, lpOverlapped=0x0) returned 1 [0060.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.407] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.407] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.408] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.408] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.408] CloseHandle (hObject=0x11c) returned 1 [0060.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.410] GetLastError () returned 0x0 [0060.411] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.412] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18041269646) returned 1 [0060.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2d1f790, dwHighDateTime=0x1d585b4)) [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8e20 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8e20 | out: hHeap=0x260000) returned 1 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332bf8 [0060.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.412] GetLastError () returned 0x0 [0060.412] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.413] GetLastError () returned 0x0 [0060.414] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe0a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.414] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1f5c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f5c, lpOverlapped=0x0) returned 1 [0060.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.415] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.415] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.415] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.415] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.416] CloseHandle (hObject=0x11c) returned 1 [0060.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.417] GetLastError () returned 0x0 [0060.418] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.418] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.419] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.419] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18041983906) returned 1 [0060.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2d458f0, dwHighDateTime=0x1d585b4)) [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8e58 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8e58 | out: hHeap=0x260000) returned 1 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332b60 [0060.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.420] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.420] GetLastError () returned 0x0 [0060.420] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.420] GetLastError () returned 0x0 [0060.471] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd6bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.471] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2944, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x2944, lpOverlapped=0x0) returned 1 [0060.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.472] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.472] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.472] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.472] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.473] CloseHandle (hObject=0x11c) returned 1 [0060.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.474] GetLastError () returned 0x0 [0060.474] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.475] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.475] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.475] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18047628895) returned 1 [0060.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2db7d10, dwHighDateTime=0x1d585b4)) [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8fa8 [0060.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8fa8 | out: hHeap=0x260000) returned 1 [0060.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c120 [0060.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.476] GetLastError () returned 0x0 [0060.476] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.476] GetLastError () returned 0x0 [0060.540] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa4c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.540] WriteFile (in: hFile=0x11c, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5b38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x5b38, lpOverlapped=0x0) returned 1 [0060.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.541] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.541] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.541] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.542] CloseHandle (hObject=0x11c) returned 1 [0060.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.580] GetLastError () returned 0x0 [0060.580] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283bff8) returned 1 [0060.581] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.581] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.581] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18058208452) returned 1 [0060.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2ec26b0, dwHighDateTime=0x1d585b4)) [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9210 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9210 | out: hHeap=0x260000) returned 1 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba2e8 [0060.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.582] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.582] GetLastError () returned 0x0 [0060.582] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.582] GetLastError () returned 0x0 [0060.596] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffef78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.596] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1088, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1088, lpOverlapped=0x0) returned 1 [0060.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.597] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.598] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.598] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.598] CloseHandle (hObject=0x11c) returned 1 [0060.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.599] GetLastError () returned 0x0 [0060.607] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283bff8) returned 1 [0060.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.608] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.608] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18060901005) returned 1 [0060.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2f0e970, dwHighDateTime=0x1d585b4)) [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9280 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9280 | out: hHeap=0x260000) returned 1 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba970 [0060.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.609] GetLastError () returned 0x0 [0060.609] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.609] GetLastError () returned 0x0 [0060.611] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffcf7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.612] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3086, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x3086, lpOverlapped=0x0) returned 1 [0060.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.612] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.612] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.613] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.613] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.613] CloseHandle (hObject=0xfc) returned 1 [0060.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28334f8 [0060.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28334f8 | out: hHeap=0x260000) returned 1 [0060.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.614] GetLastError () returned 0x0 [0060.615] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283bff8) returned 1 [0060.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.616] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.616] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18061738656) returned 1 [0060.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2f0e970, dwHighDateTime=0x1d585b4)) [0060.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b92b8 [0060.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b92b8 | out: hHeap=0x260000) returned 1 [0060.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2baaa0 [0060.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.617] GetLastError () returned 0x0 [0060.617] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.617] GetLastError () returned 0x0 [0060.621] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe2ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.621] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1d14, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x1d14, lpOverlapped=0x0) returned 1 [0060.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.622] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.622] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.623] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.623] CloseHandle (hObject=0xfc) returned 1 [0060.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28334f8 [0060.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28334f8 | out: hHeap=0x260000) returned 1 [0060.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.624] GetLastError () returned 0x0 [0060.625] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283bff8) returned 1 [0060.626] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.626] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.626] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18062690869) returned 1 [0060.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2f34ad0, dwHighDateTime=0x1d585b4)) [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b92f0 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b92f0 | out: hHeap=0x260000) returned 1 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bab38 [0060.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.626] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.627] GetLastError () returned 0x0 [0060.627] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.627] GetLastError () returned 0x0 [0060.632] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe298, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.632] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1d68, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x1d68, lpOverlapped=0x0) returned 1 [0060.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.633] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.633] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.633] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.633] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.634] CloseHandle (hObject=0xfc) returned 1 [0060.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28334f8 [0060.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28334f8 | out: hHeap=0x260000) returned 1 [0060.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.635] GetLastError () returned 0x0 [0060.635] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x283bff8) returned 1 [0060.636] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.636] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.636] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18063741232) returned 1 [0060.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb2f34ad0, dwHighDateTime=0x1d585b4)) [0060.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9360 [0060.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9360 | out: hHeap=0x260000) returned 1 [0060.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2babd0 [0060.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.637] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.637] GetLastError () returned 0x0 [0060.729] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.729] GetLastError () returned 0x0 [0060.744] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdfea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.744] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2016, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x2016, lpOverlapped=0x0) returned 1 [0060.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0060.744] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.744] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.745] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.745] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.745] CloseHandle (hObject=0xfc) returned 1 [0060.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.747] GetLastError () returned 0x0 [0060.747] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.748] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.748] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.748] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18074911742) returned 1 [0060.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30655d0, dwHighDateTime=0x1d585b4)) [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9558 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9558 | out: hHeap=0x260000) returned 1 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bad00 [0060.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.749] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.749] GetLastError () returned 0x0 [0060.749] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.749] GetLastError () returned 0x0 [0060.751] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.751] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x540, lpOverlapped=0x0) returned 1 [0060.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.752] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.752] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.753] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.753] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.753] CloseHandle (hObject=0xfc) returned 1 [0060.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.754] GetLastError () returned 0x0 [0060.755] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.755] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.755] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.756] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18075676264) returned 1 [0060.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30655d0, dwHighDateTime=0x1d585b4)) [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9590 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9590 | out: hHeap=0x260000) returned 1 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb258 [0060.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.756] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.756] GetLastError () returned 0x0 [0060.757] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.757] GetLastError () returned 0x0 [0060.758] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffccc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.758] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x334, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x334, lpOverlapped=0x0) returned 1 [0060.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.759] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.759] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.759] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.760] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.760] CloseHandle (hObject=0xfc) returned 1 [0060.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.761] GetLastError () returned 0x0 [0060.762] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.762] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.762] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.763] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18076364946) returned 1 [0060.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb308b730, dwHighDateTime=0x1d585b4)) [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b95c8 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b95c8 | out: hHeap=0x260000) returned 1 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb2f0 [0060.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.763] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.763] GetLastError () returned 0x0 [0060.763] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.764] GetLastError () returned 0x0 [0060.765] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff700, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.765] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x900, lpOverlapped=0x0) returned 1 [0060.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.767] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.767] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.768] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.768] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.768] CloseHandle (hObject=0xfc) returned 1 [0060.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.769] GetLastError () returned 0x0 [0060.770] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.771] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.771] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.771] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18077233915) returned 1 [0060.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb308b730, dwHighDateTime=0x1d585b4)) [0060.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9600 [0060.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9600 | out: hHeap=0x260000) returned 1 [0060.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb388 [0060.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.772] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.772] GetLastError () returned 0x0 [0060.772] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.772] GetLastError () returned 0x0 [0060.775] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff178, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.775] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xe88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0xe88, lpOverlapped=0x0) returned 1 [0060.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.778] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.778] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.779] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.779] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.779] CloseHandle (hObject=0xfc) returned 1 [0060.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.781] GetLastError () returned 0x0 [0060.781] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.782] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.782] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18078319528) returned 1 [0060.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30b1890, dwHighDateTime=0x1d585b4)) [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9638 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9638 | out: hHeap=0x260000) returned 1 [0060.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb420 [0060.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.783] GetLastError () returned 0x0 [0060.783] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.783] GetLastError () returned 0x0 [0060.785] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff720, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.785] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x8e0, lpOverlapped=0x0) returned 1 [0060.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.785] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.785] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.786] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.786] CloseHandle (hObject=0xfc) returned 1 [0060.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.788] GetLastError () returned 0x0 [0060.789] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.789] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.789] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.790] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18079069947) returned 1 [0060.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30b1890, dwHighDateTime=0x1d585b4)) [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9670 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9670 | out: hHeap=0x260000) returned 1 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb4b8 [0060.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.790] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.790] GetLastError () returned 0x0 [0060.791] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.791] GetLastError () returned 0x0 [0060.792] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff7e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.792] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x818, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x818, lpOverlapped=0x0) returned 1 [0060.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.793] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.793] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.793] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.793] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.794] CloseHandle (hObject=0xfc) returned 1 [0060.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.795] GetLastError () returned 0x0 [0060.795] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.796] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.796] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18079746701) returned 1 [0060.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30d79f0, dwHighDateTime=0x1d585b4)) [0060.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b80 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ecb8 [0060.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.797] GetLastError () returned 0x0 [0060.797] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.797] GetLastError () returned 0x0 [0060.799] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff56c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.799] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xa94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0xa94, lpOverlapped=0x0) returned 1 [0060.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.799] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.799] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.800] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.800] CloseHandle (hObject=0xfc) returned 1 [0060.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.800] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.802] GetLastError () returned 0x0 [0060.802] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.803] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.803] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18080392121) returned 1 [0060.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30d79f0, dwHighDateTime=0x1d585b4)) [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c28 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f2a8 [0060.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.803] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.804] GetLastError () returned 0x0 [0060.804] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.804] GetLastError () returned 0x0 [0060.805] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.805] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x38c, lpOverlapped=0x0) returned 1 [0060.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.806] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.806] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.809] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.809] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.810] CloseHandle (hObject=0xfc) returned 1 [0060.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0060.811] GetLastError () returned 0x0 [0060.813] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0060.814] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.814] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0060.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0060.814] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18081740072) returned 1 [0060.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb30fdb50, dwHighDateTime=0x1d585b4)) [0060.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0060.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0060.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0060.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bf0 [0060.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0060.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f210 [0060.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.817] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0060.817] GetLastError () returned 0x0 [0060.817] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0060.817] GetLastError () returned 0x0 [0060.981] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff9e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.993] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x61c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x61c, lpOverlapped=0x0) returned 1 [0061.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.000] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.006] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.011] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.017] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.024] CloseHandle (hObject=0xfc) returned 1 [0061.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.026] GetLastError () returned 0x0 [0061.026] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.027] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.027] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18102815115) returned 1 [0061.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb32ecd30, dwHighDateTime=0x1d585b4)) [0061.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9868 [0061.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9868 | out: hHeap=0x260000) returned 1 [0061.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb978 [0061.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.028] GetLastError () returned 0x0 [0061.028] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.028] GetLastError () returned 0x0 [0061.030] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff80b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.030] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7f4e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x7f4e, lpOverlapped=0x0) returned 1 [0061.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.031] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.031] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.031] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.031] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.032] CloseHandle (hObject=0xfc) returned 1 [0061.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.033] GetLastError () returned 0x0 [0061.034] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.034] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.035] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18103574541) returned 1 [0061.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3312e90, dwHighDateTime=0x1d585b4)) [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b98a0 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b98a0 | out: hHeap=0x260000) returned 1 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbaa8 [0061.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.035] GetLastError () returned 0x0 [0061.036] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.036] GetLastError () returned 0x0 [0061.037] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffbcf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.037] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x430c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x430c, lpOverlapped=0x0) returned 1 [0061.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.038] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.038] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.038] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.038] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.039] CloseHandle (hObject=0xfc) returned 1 [0061.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.040] GetLastError () returned 0x0 [0061.041] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.042] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.042] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18104295354) returned 1 [0061.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3312e90, dwHighDateTime=0x1d585b4)) [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b98d8 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b98d8 | out: hHeap=0x260000) returned 1 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbb40 [0061.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.042] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.043] GetLastError () returned 0x0 [0061.043] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.043] GetLastError () returned 0x0 [0061.044] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffa490, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.044] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x5b70, lpOverlapped=0x0) returned 1 [0061.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.045] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.045] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.045] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.045] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.046] CloseHandle (hObject=0xfc) returned 1 [0061.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.047] GetLastError () returned 0x0 [0061.048] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.049] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.049] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.049] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18105003718) returned 1 [0061.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3338ff0, dwHighDateTime=0x1d585b4)) [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9910 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9910 | out: hHeap=0x260000) returned 1 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbbd8 [0061.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.050] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.050] GetLastError () returned 0x0 [0061.050] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.050] GetLastError () returned 0x0 [0061.051] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffb486, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.051] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x4b7a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x4b7a, lpOverlapped=0x0) returned 1 [0061.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.052] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.052] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.052] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.052] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.053] CloseHandle (hObject=0xfc) returned 1 [0061.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.055] GetLastError () returned 0x0 [0061.056] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.056] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.056] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.057] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18105764491) returned 1 [0061.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3338ff0, dwHighDateTime=0x1d585b4)) [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9948 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9948 | out: hHeap=0x260000) returned 1 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbc70 [0061.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.057] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.057] GetLastError () returned 0x0 [0061.057] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.058] GetLastError () returned 0x0 [0061.185] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffed9d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.185] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1262e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1262e, lpOverlapped=0x0) returned 1 [0061.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.186] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.186] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.187] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.187] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.187] CloseHandle (hObject=0xfc) returned 1 [0061.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.214] GetLastError () returned 0x0 [0061.214] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.216] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.216] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.216] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18121689610) returned 1 [0061.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb34dbf10, dwHighDateTime=0x1d585b4)) [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b99f0 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b99f0 | out: hHeap=0x260000) returned 1 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbd08 [0061.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.216] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.217] GetLastError () returned 0x0 [0061.217] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.217] GetLastError () returned 0x0 [0061.219] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffef85, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.219] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x107b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x107b, lpOverlapped=0x0) returned 1 [0061.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.220] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.220] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.220] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.221] CloseHandle (hObject=0xf0) returned 1 [0061.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895850 [0061.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0061.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895850 | out: hHeap=0x260000) returned 1 [0061.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.222] GetLastError () returned 0x0 [0061.222] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.223] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.223] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.223] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18122437898) returned 1 [0061.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb34dbf10, dwHighDateTime=0x1d585b4)) [0061.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9a28 [0061.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9a28 | out: hHeap=0x260000) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbed0 [0061.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.224] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.224] GetLastError () returned 0x0 [0061.224] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.224] GetLastError () returned 0x0 [0061.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe5d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.226] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1a2c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x1a2c, lpOverlapped=0x0) returned 1 [0061.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.226] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.227] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.227] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.227] CloseHandle (hObject=0xf0) returned 1 [0061.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895850 [0061.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0061.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895850 | out: hHeap=0x260000) returned 1 [0061.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.228] GetLastError () returned 0x0 [0061.229] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.230] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.230] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.230] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18123147326) returned 1 [0061.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3502070, dwHighDateTime=0x1d585b4)) [0061.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9a60 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9a60 | out: hHeap=0x260000) returned 1 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbf68 [0061.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.231] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.231] GetLastError () returned 0x0 [0061.231] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.231] GetLastError () returned 0x0 [0061.233] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff42a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.233] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xbd6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0xbd6, lpOverlapped=0x0) returned 1 [0061.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.234] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.234] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.234] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.234] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.235] CloseHandle (hObject=0xf0) returned 1 [0061.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895850 [0061.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895850 | out: hHeap=0x260000) returned 1 [0061.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.236] GetLastError () returned 0x0 [0061.236] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.237] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.237] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18123831978) returned 1 [0061.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3502070, dwHighDateTime=0x1d585b4)) [0061.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9a98 [0061.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9a98 | out: hHeap=0x260000) returned 1 [0061.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc000 [0061.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.238] GetLastError () returned 0x0 [0061.238] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.238] GetLastError () returned 0x0 [0061.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff5ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.240] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0xa16, lpOverlapped=0x0) returned 1 [0061.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.240] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.240] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.241] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.241] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.241] CloseHandle (hObject=0xf0) returned 1 [0061.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.243] GetLastError () returned 0x0 [0061.243] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.244] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.244] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.244] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18124521446) returned 1 [0061.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3502070, dwHighDateTime=0x1d585b4)) [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9ad0 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9ad0 | out: hHeap=0x260000) returned 1 [0061.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc098 [0061.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.245] GetLastError () returned 0x0 [0061.245] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.245] GetLastError () returned 0x0 [0061.504] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc924, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.504] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x36dc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x36dc, lpOverlapped=0x0) returned 1 [0061.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.505] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.505] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.505] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.505] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.506] CloseHandle (hObject=0xf0) returned 1 [0061.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.506] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0061.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.507] GetLastError () returned 0x0 [0061.507] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.508] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.508] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.508] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18150922901) returned 1 [0061.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb37897d0, dwHighDateTime=0x1d585b4)) [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9c90 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9c90 | out: hHeap=0x260000) returned 1 [0061.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f5a0 [0061.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.509] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.509] GetLastError () returned 0x0 [0061.509] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.509] GetLastError () returned 0x0 [0061.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.511] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x78a, lpOverlapped=0x0) returned 1 [0061.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.511] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.512] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.512] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.512] CloseHandle (hObject=0xf0) returned 1 [0061.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.512] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.514] GetLastError () returned 0x0 [0061.514] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.515] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.515] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18151655614) returned 1 [0061.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb37af930, dwHighDateTime=0x1d585b4)) [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9cc8 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9cc8 | out: hHeap=0x260000) returned 1 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc130 [0061.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.516] GetLastError () returned 0x0 [0061.516] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.516] GetLastError () returned 0x0 [0061.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.518] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x326, lpOverlapped=0x0) returned 1 [0061.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.518] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.519] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.519] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.519] CloseHandle (hObject=0xf0) returned 1 [0061.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.521] GetLastError () returned 0x0 [0061.521] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.522] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.522] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.522] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18152329659) returned 1 [0061.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb37af930, dwHighDateTime=0x1d585b4)) [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9d00 [0061.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9d00 | out: hHeap=0x260000) returned 1 [0061.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc4c0 [0061.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.523] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.523] GetLastError () returned 0x0 [0061.523] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.523] GetLastError () returned 0x0 [0061.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffb90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.525] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x470, lpOverlapped=0x0) returned 1 [0061.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.525] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.526] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.526] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.526] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.527] CloseHandle (hObject=0xf0) returned 1 [0061.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.528] GetLastError () returned 0x0 [0061.528] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.529] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.529] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.529] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18153031486) returned 1 [0061.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb37d5a90, dwHighDateTime=0x1d585b4)) [0061.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9d38 [0061.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9d38 | out: hHeap=0x260000) returned 1 [0061.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc558 [0061.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.530] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.530] GetLastError () returned 0x0 [0061.530] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.530] GetLastError () returned 0x0 [0061.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffec3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.535] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x13c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x1cffdb0*=0x13c4, lpOverlapped=0x0) returned 1 [0061.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.535] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.536] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.536] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.536] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.537] CloseHandle (hObject=0xf0) returned 1 [0061.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.537] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.538] GetLastError () returned 0x0 [0061.685] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.686] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.686] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18168750739) returned 1 [0061.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3952850, dwHighDateTime=0x1d585b4)) [0061.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba080 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba080 | out: hHeap=0x260000) returned 1 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcda8 [0061.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.687] GetLastError () returned 0x0 [0061.687] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.687] GetLastError () returned 0x0 [0061.690] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff318, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.690] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xce8, lpOverlapped=0x0) returned 1 [0061.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.691] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.691] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.692] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.692] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.692] CloseHandle (hObject=0x118) returned 1 [0061.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.694] GetLastError () returned 0x0 [0061.694] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.695] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.695] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.695] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18169601780) returned 1 [0061.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3952850, dwHighDateTime=0x1d585b4)) [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba0b8 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba0b8 | out: hHeap=0x260000) returned 1 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc688 [0061.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.696] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.696] GetLastError () returned 0x0 [0061.696] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.696] GetLastError () returned 0x0 [0061.697] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe258, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.697] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1da8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1da8, lpOverlapped=0x0) returned 1 [0061.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.698] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.698] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.699] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.699] CloseHandle (hObject=0x118) returned 1 [0061.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.701] GetLastError () returned 0x0 [0061.702] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.703] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.703] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.703] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18170398614) returned 1 [0061.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb39789b0, dwHighDateTime=0x1d585b4)) [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba0f0 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba0f0 | out: hHeap=0x260000) returned 1 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bced8 [0061.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.704] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.704] GetLastError () returned 0x0 [0061.704] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.704] GetLastError () returned 0x0 [0061.706] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff824, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.706] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7dc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x7dc, lpOverlapped=0x0) returned 1 [0061.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.707] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.707] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.708] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.708] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.708] CloseHandle (hObject=0x118) returned 1 [0061.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.709] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.710] GetLastError () returned 0x0 [0061.711] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.711] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.712] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.712] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18171291888) returned 1 [0061.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb39789b0, dwHighDateTime=0x1d585b4)) [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba128 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba128 | out: hHeap=0x260000) returned 1 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcf70 [0061.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.713] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.713] GetLastError () returned 0x0 [0061.713] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.713] GetLastError () returned 0x0 [0061.730] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff08e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.730] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xf72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xf72, lpOverlapped=0x0) returned 1 [0061.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.731] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.731] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.732] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.732] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.732] CloseHandle (hObject=0x118) returned 1 [0061.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.734] GetLastError () returned 0x0 [0061.758] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.759] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.759] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.759] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18176032236) returned 1 [0061.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb39eadd0, dwHighDateTime=0x1d585b4)) [0061.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba0b8 [0061.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba0b8 | out: hHeap=0x260000) returned 1 [0061.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd008 [0061.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.760] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.760] GetLastError () returned 0x0 [0061.760] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.760] GetLastError () returned 0x0 [0061.762] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff62e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.762] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x9d2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x9d2, lpOverlapped=0x0) returned 1 [0061.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.763] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.763] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.763] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.763] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.764] CloseHandle (hObject=0xfc) returned 1 [0061.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895aa8 [0061.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895aa8 | out: hHeap=0x260000) returned 1 [0061.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.768] GetLastError () returned 0x0 [0061.768] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.769] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.769] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.769] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18177051105) returned 1 [0061.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3a10f30, dwHighDateTime=0x1d585b4)) [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba198 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba198 | out: hHeap=0x260000) returned 1 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd0a0 [0061.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.770] GetLastError () returned 0x0 [0061.771] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.771] GetLastError () returned 0x0 [0061.772] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.772] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x236, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x236, lpOverlapped=0x0) returned 1 [0061.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.773] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.773] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.774] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.774] CloseHandle (hObject=0xfc) returned 1 [0061.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895aa8 [0061.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895aa8 | out: hHeap=0x260000) returned 1 [0061.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.777] GetLastError () returned 0x0 [0061.777] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.778] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.778] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.778] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18177944072) returned 1 [0061.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3a37090, dwHighDateTime=0x1d585b4)) [0061.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba1d0 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba1d0 | out: hHeap=0x260000) returned 1 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd138 [0061.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.779] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.779] GetLastError () returned 0x0 [0061.779] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.780] GetLastError () returned 0x0 [0061.782] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff996, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.782] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x66a, lpOverlapped=0x0) returned 1 [0061.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.783] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.783] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.783] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.784] CloseHandle (hObject=0xfc) returned 1 [0061.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895aa8 [0061.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895aa8 | out: hHeap=0x260000) returned 1 [0061.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.786] GetLastError () returned 0x0 [0061.787] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.788] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.788] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.788] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18178902185) returned 1 [0061.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3a37090, dwHighDateTime=0x1d585b4)) [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7470 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd1d0 [0061.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.789] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.789] GetLastError () returned 0x0 [0061.789] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.789] GetLastError () returned 0x0 [0061.791] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffb1fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.791] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x4e02, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x4e02, lpOverlapped=0x0) returned 1 [0061.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.792] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.792] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.793] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.793] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.794] CloseHandle (hObject=0xfc) returned 1 [0061.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.894] GetLastError () returned 0x0 [0061.895] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.896] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.896] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18189693350) returned 1 [0061.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3b41a30, dwHighDateTime=0x1d585b4)) [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0678 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0678 | out: hHeap=0x260000) returned 1 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31faf8 [0061.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.897] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.897] GetLastError () returned 0x0 [0061.897] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.897] GetLastError () returned 0x0 [0061.900] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdfac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.900] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2054, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x2054, lpOverlapped=0x0) returned 1 [0061.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.901] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.901] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.902] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.902] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.902] CloseHandle (hObject=0xfc) returned 1 [0061.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.904] GetLastError () returned 0x0 [0061.904] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.905] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.905] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.905] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18190655116) returned 1 [0061.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3b67b90, dwHighDateTime=0x1d585b4)) [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0640 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0640 | out: hHeap=0x260000) returned 1 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f9c8 [0061.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.906] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.906] GetLastError () returned 0x0 [0061.906] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.906] GetLastError () returned 0x0 [0061.908] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.908] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x1800, lpOverlapped=0x0) returned 1 [0061.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.909] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.909] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.910] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.910] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.910] CloseHandle (hObject=0xfc) returned 1 [0061.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895aa8 [0061.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895aa8 | out: hHeap=0x260000) returned 1 [0061.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.912] GetLastError () returned 0x0 [0061.912] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.913] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.913] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.913] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18191426551) returned 1 [0061.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3b67b90, dwHighDateTime=0x1d585b4)) [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0608 [0061.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0608 | out: hHeap=0x260000) returned 1 [0061.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f930 [0061.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.914] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.914] GetLastError () returned 0x0 [0061.914] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.914] GetLastError () returned 0x0 [0061.916] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffcbd2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.916] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x342e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x342e, lpOverlapped=0x0) returned 1 [0061.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.916] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.917] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.917] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.917] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.918] CloseHandle (hObject=0xfc) returned 1 [0061.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0061.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0061.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0061.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0061.919] GetLastError () returned 0x0 [0061.920] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0061.921] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.921] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0061.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0061.921] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18192512013) returned 1 [0061.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3b8dcf0, dwHighDateTime=0x1d585b4)) [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f05d0 [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f05d0 | out: hHeap=0x260000) returned 1 [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f898 [0061.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0061.925] GetLastError () returned 0x0 [0061.925] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0061.925] GetLastError () returned 0x0 [0061.926] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffec9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.926] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1361, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x1361, lpOverlapped=0x0) returned 1 [0061.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0061.927] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.927] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.928] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.928] CloseHandle (hObject=0xfc) returned 1 [0061.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0061.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0062.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.367] GetLastError () returned 0x0 [0062.368] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.368] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.368] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.368] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18236959493) returned 1 [0062.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3fb8370, dwHighDateTime=0x1d585b4)) [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351a70 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351a70 | out: hHeap=0x260000) returned 1 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353d18 [0062.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.369] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.370] GetLastError () returned 0x0 [0062.370] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.370] GetLastError () returned 0x0 [0062.372] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff894, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.372] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x76c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x76c, lpOverlapped=0x0) returned 1 [0062.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.373] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.373] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.374] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.374] CloseHandle (hObject=0xf0) returned 1 [0062.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.375] GetLastError () returned 0x0 [0062.376] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.376] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.377] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18237764475) returned 1 [0062.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb3fde4d0, dwHighDateTime=0x1d585b4)) [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351aa8 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351aa8 | out: hHeap=0x260000) returned 1 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353e48 [0062.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.377] GetLastError () returned 0x0 [0062.377] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.378] GetLastError () returned 0x0 [0062.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffed2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.381] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x12d1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x12d1, lpOverlapped=0x0) returned 1 [0062.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.382] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.382] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.382] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.383] CloseHandle (hObject=0xf0) returned 1 [0062.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.384] GetLastError () returned 0x0 [0062.385] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.386] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.386] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.386] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18238695736) returned 1 [0062.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4004630, dwHighDateTime=0x1d585b4)) [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351ae0 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351ae0 | out: hHeap=0x260000) returned 1 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353ee0 [0062.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.387] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.387] GetLastError () returned 0x0 [0062.387] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.387] GetLastError () returned 0x0 [0062.388] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffefd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.388] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x102b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x102b, lpOverlapped=0x0) returned 1 [0062.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.389] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.390] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.390] CloseHandle (hObject=0xf0) returned 1 [0062.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.392] GetLastError () returned 0x0 [0062.393] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.393] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.393] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.394] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18239478870) returned 1 [0062.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4004630, dwHighDateTime=0x1d585b4)) [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351b18 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351b18 | out: hHeap=0x260000) returned 1 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353f78 [0062.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.394] GetLastError () returned 0x0 [0062.395] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.395] GetLastError () returned 0x0 [0062.396] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff5ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.397] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xa16, lpOverlapped=0x0) returned 1 [0062.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.397] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.398] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.398] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.398] CloseHandle (hObject=0xf0) returned 1 [0062.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.[deadmin@cock.li].deadmin")) returned 1 [0062.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.400] GetLastError () returned 0x0 [0062.400] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.401] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.401] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.401] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18240208003) returned 1 [0062.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb402a790, dwHighDateTime=0x1d585b4)) [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351b50 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351b50 | out: hHeap=0x260000) returned 1 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354010 [0062.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.402] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.402] GetLastError () returned 0x0 [0062.402] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.402] GetLastError () returned 0x0 [0062.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff46a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.545] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xb96, lpOverlapped=0x0) returned 1 [0062.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.546] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.546] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.547] CloseHandle (hObject=0xf0) returned 1 [0062.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.[deadmin@cock.li].deadmin")) returned 1 [0062.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.548] GetLastError () returned 0x0 [0062.549] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.549] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.549] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.550] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18255072661) returned 1 [0062.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb41813f0, dwHighDateTime=0x1d585b4)) [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0838 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0838 | out: hHeap=0x260000) returned 1 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.550] GetLastError () returned 0x0 [0062.551] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.551] GetLastError () returned 0x0 [0062.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe071, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.552] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x1f8f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f8f, lpOverlapped=0x0) returned 1 [0062.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.553] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.554] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.554] CloseHandle (hObject=0xf0) returned 1 [0062.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.555] GetLastError () returned 0x0 [0062.556] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.557] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.557] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18255806585) returned 1 [0062.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb41a7550, dwHighDateTime=0x1d585b4)) [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351c30 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351c30 | out: hHeap=0x260000) returned 1 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.558] GetLastError () returned 0x0 [0062.558] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.558] GetLastError () returned 0x0 [0062.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.560] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe1d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xe1d, lpOverlapped=0x0) returned 1 [0062.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.560] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.560] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.561] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.561] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.561] CloseHandle (hObject=0xf0) returned 1 [0062.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.563] GetLastError () returned 0x0 [0062.563] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.564] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.564] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18256542045) returned 1 [0062.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb41a7550, dwHighDateTime=0x1d585b4)) [0062.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351c68 [0062.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351c68 | out: hHeap=0x260000) returned 1 [0062.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.565] GetLastError () returned 0x0 [0062.565] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.565] GetLastError () returned 0x0 [0062.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.567] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x38c, lpOverlapped=0x0) returned 1 [0062.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.568] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.568] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.568] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.569] CloseHandle (hObject=0xf0) returned 1 [0062.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.570] GetLastError () returned 0x0 [0062.571] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.572] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.572] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18257302488) returned 1 [0062.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb41cd6b0, dwHighDateTime=0x1d585b4)) [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351ca0 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351ca0 | out: hHeap=0x260000) returned 1 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.573] GetLastError () returned 0x0 [0062.573] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.573] GetLastError () returned 0x0 [0062.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff679, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.576] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x987, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x987, lpOverlapped=0x0) returned 1 [0062.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.577] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.577] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.577] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.578] CloseHandle (hObject=0xf0) returned 1 [0062.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.579] GetLastError () returned 0x0 [0062.579] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0062.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.580] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.580] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18258154500) returned 1 [0062.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb41cd6b0, dwHighDateTime=0x1d585b4)) [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351cd8 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351cd8 | out: hHeap=0x260000) returned 1 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.581] GetLastError () returned 0x0 [0062.581] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.581] GetLastError () returned 0x0 [0062.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.663] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x37d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0x37d, lpOverlapped=0x0) returned 1 [0062.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.666] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.666] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.666] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.667] CloseHandle (hObject=0xf0) returned 1 [0062.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0062.741] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0062.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.746] GetLastError () returned 0x0 [0062.912] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0062.913] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.913] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.913] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18291457117) returned 1 [0062.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb44ed390, dwHighDateTime=0x1d585b4)) [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f38 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f38 | out: hHeap=0x260000) returned 1 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321fb8 [0062.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.914] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.914] GetLastError () returned 0x0 [0062.914] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.914] GetLastError () returned 0x0 [0062.917] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffef61b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.917] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x109e5, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x109e5, lpOverlapped=0x0) returned 1 [0062.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.918] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.918] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.918] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.919] CloseHandle (hObject=0x118) returned 1 [0062.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.920] GetLastError () returned 0x0 [0062.921] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0062.922] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.922] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.922] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18292303996) returned 1 [0062.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb45134f0, dwHighDateTime=0x1d585b4)) [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0d08 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0d08 | out: hHeap=0x260000) returned 1 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321f20 [0062.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.923] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.923] GetLastError () returned 0x0 [0062.923] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.923] GetLastError () returned 0x0 [0062.925] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffeb959, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.925] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x146a7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x146a7, lpOverlapped=0x0) returned 1 [0062.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.926] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.926] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.927] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.927] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.927] CloseHandle (hObject=0x118) returned 1 [0062.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.928] GetLastError () returned 0x0 [0062.929] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0062.930] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.930] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.930] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18293166065) returned 1 [0062.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4539650, dwHighDateTime=0x1d585b4)) [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0cd0 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0cd0 | out: hHeap=0x260000) returned 1 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321508 [0062.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.931] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.931] GetLastError () returned 0x0 [0062.931] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.932] GetLastError () returned 0x0 [0062.934] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffec50f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.934] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x13af1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x13af1, lpOverlapped=0x0) returned 1 [0062.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.935] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.935] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.936] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.936] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.936] CloseHandle (hObject=0x118) returned 1 [0062.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.938] GetLastError () returned 0x0 [0062.939] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0062.939] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.939] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.940] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18294079920) returned 1 [0062.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4539650, dwHighDateTime=0x1d585b4)) [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0c98 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0c98 | out: hHeap=0x260000) returned 1 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321470 [0062.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.940] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0062.941] GetLastError () returned 0x0 [0062.941] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0062.941] GetLastError () returned 0x0 [0063.142] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffea7c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.142] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1583a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x1583a, lpOverlapped=0x0) returned 1 [0063.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.150] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.150] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.153] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.153] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.153] CloseHandle (hObject=0x118) returned 1 [0063.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bb2d0 [0063.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb2d0 | out: hHeap=0x260000) returned 1 [0063.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.270] GetLastError () returned 0x0 [0063.271] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0063.272] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.272] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.273] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18327380197) returned 1 [0063.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4859330, dwHighDateTime=0x1d585b4)) [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352090 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352090 | out: hHeap=0x260000) returned 1 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0063.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3213d8 [0063.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0063.274] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0063.274] GetLastError () returned 0x0 [0063.274] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0063.275] GetLastError () returned 0x0 [0063.284] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffeabf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.284] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1540b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x1540b, lpOverlapped=0x0) returned 1 [0063.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.287] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.287] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.287] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.288] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.288] CloseHandle (hObject=0x118) returned 1 [0063.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bb2d0 [0063.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb2d0 | out: hHeap=0x260000) returned 1 [0063.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.293] GetLastError () returned 0x0 [0063.295] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0063.296] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.296] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0063.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0063.296] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18329751604) returned 1 [0063.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb48a55f0, dwHighDateTime=0x1d585b4)) [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3520c8 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3520c8 | out: hHeap=0x260000) returned 1 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0063.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3210e0 [0063.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0063.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0063.298] GetLastError () returned 0x0 [0063.298] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0063.298] GetLastError () returned 0x0 [0063.434] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.434] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0063.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.435] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.435] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.515] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.515] CloseHandle (hObject=0x118) returned 1 [0063.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0063.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0063.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.516] GetLastError () returned 0x0 [0063.593] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0063.601] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.601] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0063.602] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18360275643) returned 1 [0063.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4b9f170, dwHighDateTime=0x1d585b4)) [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3526b0 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3526b0 | out: hHeap=0x260000) returned 1 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.602] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0063.602] GetLastError () returned 0x0 [0063.603] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0063.603] GetLastError () returned 0x0 [0063.606] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.606] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3c2, lpOverlapped=0x0) returned 1 [0063.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.606] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.606] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.607] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.607] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.607] CloseHandle (hObject=0x100) returned 1 [0063.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.609] GetLastError () returned 0x0 [0063.609] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0063.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.610] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0063.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0063.610] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18361134155) returned 1 [0063.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4b9f170, dwHighDateTime=0x1d585b4)) [0063.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0063.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0063.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3526e8 [0063.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3526e8 | out: hHeap=0x260000) returned 1 [0063.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0063.611] GetLastError () returned 0x0 [0063.611] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0063.611] GetLastError () returned 0x0 [0063.613] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.613] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x39e, lpOverlapped=0x0) returned 1 [0063.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.614] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.614] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.615] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.615] CloseHandle (hObject=0x100) returned 1 [0063.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.616] GetLastError () returned 0x0 [0063.617] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0063.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.617] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0063.618] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18361906235) returned 1 [0063.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4bc52d0, dwHighDateTime=0x1d585b4)) [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352720 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352720 | out: hHeap=0x260000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0063.619] GetLastError () returned 0x0 [0063.619] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0063.619] GetLastError () returned 0x0 [0063.629] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.651] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.768] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.769] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.769] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.769] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.769] CloseHandle (hObject=0x100) returned 1 [0063.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0063.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.023] GetLastError () returned 0x0 [0064.023] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0064.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.024] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.024] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18402491995) returned 1 [0064.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4fa3690, dwHighDateTime=0x1d585b4)) [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352db0 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352db0 | out: hHeap=0x260000) returned 1 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.024] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.025] GetLastError () returned 0x0 [0064.025] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.025] GetLastError () returned 0x0 [0064.029] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.029] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.031] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.031] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.033] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.033] CloseHandle (hObject=0x120) returned 1 [0064.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.034] GetLastError () returned 0x0 [0064.035] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0064.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.036] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.036] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18403682887) returned 1 [0064.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4fa3690, dwHighDateTime=0x1d585b4)) [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352de8 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352de8 | out: hHeap=0x260000) returned 1 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.037] GetLastError () returned 0x0 [0064.037] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.037] GetLastError () returned 0x0 [0064.040] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.040] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.041] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.041] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.043] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.043] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.043] CloseHandle (hObject=0x120) returned 1 [0064.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.045] GetLastError () returned 0x0 [0064.045] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2897900) returned 1 [0064.046] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.046] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.046] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18404753679) returned 1 [0064.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb4fc97f0, dwHighDateTime=0x1d585b4)) [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352e20 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352e20 | out: hHeap=0x260000) returned 1 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.047] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.047] GetLastError () returned 0x0 [0064.047] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.047] GetLastError () returned 0x0 [0064.049] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff9fdd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.049] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6023, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x6023, lpOverlapped=0x0) returned 1 [0064.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.050] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.050] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.051] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.051] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.051] CloseHandle (hObject=0x120) returned 1 [0064.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.052] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.053] GetLastError () returned 0x0 [0064.053] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.178] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.178] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18417938727) returned 1 [0064.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5120450, dwHighDateTime=0x1d585b4)) [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353130 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353130 | out: hHeap=0x260000) returned 1 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.179] GetLastError () returned 0x0 [0064.179] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.179] GetLastError () returned 0x0 [0064.182] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffc022, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.182] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3fde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3fde, lpOverlapped=0x0) returned 1 [0064.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.183] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.183] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.184] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.184] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.184] CloseHandle (hObject=0x120) returned 1 [0064.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.186] GetLastError () returned 0x0 [0064.186] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.187] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.187] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.187] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18418808733) returned 1 [0064.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5120450, dwHighDateTime=0x1d585b4)) [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353168 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353168 | out: hHeap=0x260000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.188] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.188] GetLastError () returned 0x0 [0064.188] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.188] GetLastError () returned 0x0 [0064.190] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.191] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.192] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.192] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.193] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.193] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.193] CloseHandle (hObject=0x120) returned 1 [0064.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.195] GetLastError () returned 0x0 [0064.195] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.196] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.196] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.196] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18419713949) returned 1 [0064.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb51465b0, dwHighDateTime=0x1d585b4)) [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3531a0 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3531a0 | out: hHeap=0x260000) returned 1 [0064.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.197] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.197] GetLastError () returned 0x0 [0064.197] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.197] GetLastError () returned 0x0 [0064.199] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffac51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.199] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x53af, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x53af, lpOverlapped=0x0) returned 1 [0064.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.199] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.199] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.200] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.200] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.200] CloseHandle (hObject=0x120) returned 1 [0064.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0064.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0064.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.202] GetLastError () returned 0x0 [0064.202] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.203] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.203] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.203] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18420622289) returned 1 [0064.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb51465b0, dwHighDateTime=0x1d585b4)) [0064.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3531d8 [0064.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3531d8 | out: hHeap=0x260000) returned 1 [0064.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.206] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.206] GetLastError () returned 0x0 [0064.206] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.206] GetLastError () returned 0x0 [0064.209] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.209] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.210] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.210] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.212] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.212] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.213] CloseHandle (hObject=0x120) returned 1 [0064.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.213] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.217] GetLastError () returned 0x0 [0064.217] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.218] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.218] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18421903051) returned 1 [0064.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb516c710, dwHighDateTime=0x1d585b4)) [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353210 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353210 | out: hHeap=0x260000) returned 1 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.219] GetLastError () returned 0x0 [0064.219] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.219] GetLastError () returned 0x0 [0064.266] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff9373, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.266] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6c8d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x6c8d, lpOverlapped=0x0) returned 1 [0064.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.267] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.267] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.267] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.267] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.268] CloseHandle (hObject=0x120) returned 1 [0064.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0064.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0064.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.314] GetLastError () returned 0x0 [0064.314] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.315] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.315] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18431652008) returned 1 [0064.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5250f50, dwHighDateTime=0x1d585b4)) [0064.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8b00 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8b00 | out: hHeap=0x260000) returned 1 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a4d0 [0064.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a4d0 | out: hHeap=0x260000) returned 1 [0064.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.316] GetLastError () returned 0x0 [0064.316] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.316] GetLastError () returned 0x0 [0064.320] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff1e1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.320] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe1f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xe1f, lpOverlapped=0x0) returned 1 [0064.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.320] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.320] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.321] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.322] CloseHandle (hObject=0xa4) returned 1 [0064.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.323] GetLastError () returned 0x0 [0064.323] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.324] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.324] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18432526418) returned 1 [0064.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb52770b0, dwHighDateTime=0x1d585b4)) [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8ac8 [0064.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8ac8 | out: hHeap=0x260000) returned 1 [0064.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27cd080 [0064.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cd080 | out: hHeap=0x260000) returned 1 [0064.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.325] GetLastError () returned 0x0 [0064.325] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.325] GetLastError () returned 0x0 [0064.327] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff1f5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.327] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe0b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xe0b, lpOverlapped=0x0) returned 1 [0064.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.327] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.327] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.328] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.328] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.328] CloseHandle (hObject=0xa4) returned 1 [0064.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0064.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0064.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.330] GetLastError () returned 0x0 [0064.331] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.331] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.331] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.332] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18433273352) returned 1 [0064.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb52770b0, dwHighDateTime=0x1d585b4)) [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8a90 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8a90 | out: hHeap=0x260000) returned 1 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.332] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.332] GetLastError () returned 0x0 [0064.333] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.333] GetLastError () returned 0x0 [0064.336] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff1ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.337] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xe16, lpOverlapped=0x0) returned 1 [0064.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.337] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.338] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.338] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.339] CloseHandle (hObject=0xa4) returned 1 [0064.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0064.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0064.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.340] GetLastError () returned 0x0 [0064.340] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.341] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.341] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.341] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18434251921) returned 1 [0064.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb529d210, dwHighDateTime=0x1d585b4)) [0064.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8a58 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8a58 | out: hHeap=0x260000) returned 1 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a4d0 [0064.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a4d0 | out: hHeap=0x260000) returned 1 [0064.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.342] GetLastError () returned 0x0 [0064.342] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.342] GetLastError () returned 0x0 [0064.344] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff105, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.344] WriteFile (in: hFile=0xa4, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xefb, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x1cffdb0*=0xefb, lpOverlapped=0x0) returned 1 [0064.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.345] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.345] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.345] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.345] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.346] CloseHandle (hObject=0xa4) returned 1 [0064.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.346] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.347] GetLastError () returned 0x0 [0064.469] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.469] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.469] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.470] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18447068370) returned 1 [0064.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb53cdd10, dwHighDateTime=0x1d585b4)) [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8748 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8748 | out: hHeap=0x260000) returned 1 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a6c8 [0064.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a6c8 | out: hHeap=0x260000) returned 1 [0064.470] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.470] GetLastError () returned 0x0 [0064.470] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.471] GetLastError () returned 0x0 [0064.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1e1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.474] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe1f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xe1f, lpOverlapped=0x0) returned 1 [0064.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.475] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.475] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.475] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.475] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.476] CloseHandle (hObject=0xf0) returned 1 [0064.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.477] GetLastError () returned 0x0 [0064.477] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.478] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.478] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.478] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18447955176) returned 1 [0064.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb53f3e70, dwHighDateTime=0x1d585b4)) [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8710 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8710 | out: hHeap=0x260000) returned 1 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a770 [0064.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a770 | out: hHeap=0x260000) returned 1 [0064.479] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.479] GetLastError () returned 0x0 [0064.479] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.479] GetLastError () returned 0x0 [0064.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff113, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.481] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xeed, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xeed, lpOverlapped=0x0) returned 1 [0064.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.482] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.482] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.482] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.483] CloseHandle (hObject=0xf0) returned 1 [0064.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.484] GetLastError () returned 0x0 [0064.484] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.485] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.485] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.485] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18448635338) returned 1 [0064.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb53f3e70, dwHighDateTime=0x1d585b4)) [0064.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d86d8 [0064.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d86d8 | out: hHeap=0x260000) returned 1 [0064.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aa10 [0064.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aa10 | out: hHeap=0x260000) returned 1 [0064.486] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.486] GetLastError () returned 0x0 [0064.486] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.486] GetLastError () returned 0x0 [0064.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.488] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe13, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xe13, lpOverlapped=0x0) returned 1 [0064.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.488] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.489] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.489] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.490] CloseHandle (hObject=0xf0) returned 1 [0064.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.491] GetLastError () returned 0x0 [0064.492] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.493] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.493] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18449425759) returned 1 [0064.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5419fd0, dwHighDateTime=0x1d585b4)) [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d86a0 [0064.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d86a0 | out: hHeap=0x260000) returned 1 [0064.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0064.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0064.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.494] GetLastError () returned 0x0 [0064.494] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.494] GetLastError () returned 0x0 [0064.495] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1fb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.496] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe05, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xe05, lpOverlapped=0x0) returned 1 [0064.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.496] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.497] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.497] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.497] CloseHandle (hObject=0xf0) returned 1 [0064.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.499] GetLastError () returned 0x0 [0064.499] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.500] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.500] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18450100624) returned 1 [0064.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5419fd0, dwHighDateTime=0x1d585b4)) [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8668 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8668 | out: hHeap=0x260000) returned 1 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a4d0 [0064.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a4d0 | out: hHeap=0x260000) returned 1 [0064.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.501] GetLastError () returned 0x0 [0064.501] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.501] GetLastError () returned 0x0 [0064.542] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.543] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe39, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xe39, lpOverlapped=0x0) returned 1 [0064.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.544] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.544] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.545] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.545] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.545] CloseHandle (hObject=0xf0) returned 1 [0064.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.570] GetLastError () returned 0x0 [0064.570] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.571] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.571] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.571] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18457197504) returned 1 [0064.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb54d86b0, dwHighDateTime=0x1d585b4)) [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8518 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8518 | out: hHeap=0x260000) returned 1 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a4d0 [0064.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a4d0 | out: hHeap=0x260000) returned 1 [0064.572] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.572] GetLastError () returned 0x0 [0064.572] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.572] GetLastError () returned 0x0 [0064.575] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff113, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.575] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xeed, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xeed, lpOverlapped=0x0) returned 1 [0064.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.576] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.577] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.577] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.578] CloseHandle (hObject=0xf0) returned 1 [0064.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.636] GetLastError () returned 0x0 [0064.637] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.638] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.638] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.638] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18463894031) returned 1 [0064.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5570c30, dwHighDateTime=0x1d585b4)) [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1440 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1440 | out: hHeap=0x260000) returned 1 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.639] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.639] GetLastError () returned 0x0 [0064.639] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.639] GetLastError () returned 0x0 [0064.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.643] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe13, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xe13, lpOverlapped=0x0) returned 1 [0064.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.643] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.644] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.644] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.644] CloseHandle (hObject=0xf0) returned 1 [0064.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.646] GetLastError () returned 0x0 [0064.646] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.647] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.647] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18464842883) returned 1 [0064.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5596d90, dwHighDateTime=0x1d585b4)) [0064.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f13d0 [0064.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f13d0 | out: hHeap=0x260000) returned 1 [0064.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a4d0 [0064.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a4d0 | out: hHeap=0x260000) returned 1 [0064.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.648] GetLastError () returned 0x0 [0064.648] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.648] GetLastError () returned 0x0 [0064.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.651] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xe20, lpOverlapped=0x0) returned 1 [0064.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.652] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.653] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.653] CloseHandle (hObject=0xf0) returned 1 [0064.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0064.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.655] GetLastError () returned 0x0 [0064.655] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.656] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.656] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.656] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18465740473) returned 1 [0064.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5596d90, dwHighDateTime=0x1d585b4)) [0064.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1398 [0064.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1398 | out: hHeap=0x260000) returned 1 [0064.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aea8 [0064.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aea8 | out: hHeap=0x260000) returned 1 [0064.657] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.657] GetLastError () returned 0x0 [0064.657] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.657] GetLastError () returned 0x0 [0064.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff1e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.776] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe19, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xe19, lpOverlapped=0x0) returned 1 [0064.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.777] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.777] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.777] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.778] CloseHandle (hObject=0xf0) returned 1 [0064.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.782] GetLastError () returned 0x0 [0064.782] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.797] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.797] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.797] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18479805233) returned 1 [0064.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb56ed9f0, dwHighDateTime=0x1d585b4)) [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8060 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779110 [0064.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779110 | out: hHeap=0x260000) returned 1 [0064.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323cc0 [0064.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.798] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.798] GetLastError () returned 0x0 [0064.798] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.798] GetLastError () returned 0x0 [0064.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.814] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.815] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.847] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.847] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.847] CloseHandle (hObject=0xf0) returned 1 [0064.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bcd60 [0064.866] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.[deadmin@cock.li].deadmin")) returned 1 [0064.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bcd60 | out: hHeap=0x260000) returned 1 [0064.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.867] GetLastError () returned 0x0 [0064.884] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.885] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.885] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.885] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18488620472) returned 1 [0064.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb57d2230, dwHighDateTime=0x1d585b4)) [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d978 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d978 | out: hHeap=0x260000) returned 1 [0064.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323898 [0064.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.886] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.886] GetLastError () returned 0x0 [0064.886] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.886] GetLastError () returned 0x0 [0064.913] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff78f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.913] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x870a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x870a, lpOverlapped=0x0) returned 1 [0064.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.915] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.915] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.915] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.915] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.916] CloseHandle (hObject=0xa4) returned 1 [0064.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.917] GetLastError () returned 0x0 [0064.918] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0064.918] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.918] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.919] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18492134087) returned 1 [0064.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb581e4f0, dwHighDateTime=0x1d585b4)) [0064.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9130 [0064.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9130 | out: hHeap=0x260000) returned 1 [0064.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3236d0 [0064.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.921] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0064.921] GetLastError () returned 0x0 [0064.921] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0064.921] GetLastError () returned 0x0 [0064.928] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffebda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.928] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1426, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x1426, lpOverlapped=0x0) returned 1 [0064.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.928] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.928] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.929] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.929] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.929] CloseHandle (hObject=0xa4) returned 1 [0064.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.125] GetLastError () returned 0x0 [0065.125] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.126] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.127] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18512772481) returned 1 [0065.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5a0d6d0, dwHighDateTime=0x1d585b4)) [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e92b8 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e92b8 | out: hHeap=0x260000) returned 1 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323340 [0065.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.127] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.128] GetLastError () returned 0x0 [0065.128] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.128] GetLastError () returned 0x0 [0065.296] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffb8ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.296] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x4746, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x4746, lpOverlapped=0x0) returned 1 [0065.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.297] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.297] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.297] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.297] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.298] CloseHandle (hObject=0xa4) returned 1 [0065.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.327] GetLastError () returned 0x0 [0065.330] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.331] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.331] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.331] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18533220963) returned 1 [0065.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5bfc8b0, dwHighDateTime=0x1d585b4)) [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9408 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9408 | out: hHeap=0x260000) returned 1 [0065.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3540a8 [0065.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.332] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.332] GetLastError () returned 0x0 [0065.332] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.332] GetLastError () returned 0x0 [0065.341] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff7342, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.341] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8cbe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x8cbe, lpOverlapped=0x0) returned 1 [0065.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.341] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.342] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.342] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.342] CloseHandle (hObject=0x118) returned 1 [0065.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.344] GetLastError () returned 0x0 [0065.344] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.345] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.345] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18534620127) returned 1 [0065.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5c22a10, dwHighDateTime=0x1d585b4)) [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9478 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9478 | out: hHeap=0x260000) returned 1 [0065.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3543a0 [0065.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.346] GetLastError () returned 0x0 [0065.346] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.346] GetLastError () returned 0x0 [0065.356] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff713c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.356] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8ec4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0x8ec4, lpOverlapped=0x0) returned 1 [0065.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.357] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.357] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.357] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.357] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.358] CloseHandle (hObject=0x118) returned 1 [0065.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.359] GetLastError () returned 0x0 [0065.392] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.393] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.393] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.393] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18539452080) returned 1 [0065.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5c94e30, dwHighDateTime=0x1d585b4)) [0065.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8cf8 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8cf8 | out: hHeap=0x260000) returned 1 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354730 [0065.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.394] GetLastError () returned 0x0 [0065.394] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.394] GetLastError () returned 0x0 [0065.417] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffcbe2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.417] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x341e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x341e, lpOverlapped=0x0) returned 1 [0065.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.418] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.418] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.419] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.419] CloseHandle (hObject=0xfc) returned 1 [0065.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.421] GetLastError () returned 0x0 [0065.421] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.422] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.422] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.422] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18542296250) returned 1 [0065.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5ce10f0, dwHighDateTime=0x1d585b4)) [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8c50 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8c50 | out: hHeap=0x260000) returned 1 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354600 [0065.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.423] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.423] GetLastError () returned 0x0 [0065.423] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.423] GetLastError () returned 0x0 [0065.448] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff4cb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.448] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xb34e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0xb34e, lpOverlapped=0x0) returned 1 [0065.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.451] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.451] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.452] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.452] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.452] CloseHandle (hObject=0xfc) returned 1 [0065.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.462] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.463] GetLastError () returned 0x0 [0065.464] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.464] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.464] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.465] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18546581187) returned 1 [0065.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5d53510, dwHighDateTime=0x1d585b4)) [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e95c8 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e95c8 | out: hHeap=0x260000) returned 1 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354a28 [0065.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.465] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.466] GetLastError () returned 0x0 [0065.466] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.466] GetLastError () returned 0x0 [0065.494] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff486, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.494] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xb7a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x1cffdb0*=0xb7a, lpOverlapped=0x0) returned 1 [0065.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.495] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.495] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.495] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.495] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.496] CloseHandle (hObject=0xfc) returned 1 [0065.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.527] GetLastError () returned 0x0 [0065.527] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.528] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.528] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.528] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18552938288) returned 1 [0065.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5deba90, dwHighDateTime=0x1d585b4)) [0065.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e96e0 [0065.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e96e0 | out: hHeap=0x260000) returned 1 [0065.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354bf0 [0065.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.529] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.529] GetLastError () returned 0x0 [0065.529] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.537] GetLastError () returned 0x0 [0065.566] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe3fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.566] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1c06, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c06, lpOverlapped=0x0) returned 1 [0065.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.567] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.567] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.568] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.568] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.568] CloseHandle (hObject=0xfc) returned 1 [0065.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.570] GetLastError () returned 0x0 [0065.570] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.571] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.571] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.571] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18557250311) returned 1 [0065.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5e5deb0, dwHighDateTime=0x1d585b4)) [0065.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e97f8 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e97f8 | out: hHeap=0x260000) returned 1 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354ee8 [0065.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.572] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.572] GetLastError () returned 0x0 [0065.572] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.572] GetLastError () returned 0x0 [0065.581] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.581] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x78a, lpOverlapped=0x0) returned 1 [0065.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.582] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.582] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.583] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.583] CloseHandle (hObject=0xfc) returned 1 [0065.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.584] GetLastError () returned 0x0 [0065.585] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2898428) returned 1 [0065.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0065.585] CryptReleaseContext (hProv=0x2898428, dwFlags=0x0) returned 1 [0065.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.586] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18558674529) returned 1 [0065.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5e84010, dwHighDateTime=0x1d585b4)) [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9868 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9868 | out: hHeap=0x260000) returned 1 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3551e0 [0065.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.586] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.586] GetLastError () returned 0x0 [0065.587] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.587] GetLastError () returned 0x0 [0065.662] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.662] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x58e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x58e, lpOverlapped=0x0) returned 1 [0065.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.670] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.678] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.678] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.678] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.679] CloseHandle (hObject=0xfc) returned 1 [0065.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.688] GetLastError () returned 0x0 [0065.688] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.689] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.689] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.689] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18569000485) returned 1 [0065.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5f68850, dwHighDateTime=0x1d585b4)) [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9ad0 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9ad0 | out: hHeap=0x260000) returned 1 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355310 [0065.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.690] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.690] GetLastError () returned 0x0 [0065.690] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.690] GetLastError () returned 0x0 [0065.692] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe7e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.692] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1820, lpOverlapped=0x0) returned 1 [0065.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.693] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.693] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.694] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.694] CloseHandle (hObject=0xfc) returned 1 [0065.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.695] GetLastError () returned 0x0 [0065.696] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.696] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.696] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.697] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18569772033) returned 1 [0065.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5f8e9b0, dwHighDateTime=0x1d585b4)) [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9b08 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9b08 | out: hHeap=0x260000) returned 1 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3556a0 [0065.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.697] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.697] GetLastError () returned 0x0 [0065.698] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.698] GetLastError () returned 0x0 [0065.699] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff5dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.699] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xa24, lpOverlapped=0x0) returned 1 [0065.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.700] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.700] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.700] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.701] CloseHandle (hObject=0xfc) returned 1 [0065.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.702] GetLastError () returned 0x0 [0065.703] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.704] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.704] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.704] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18570487529) returned 1 [0065.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5f8e9b0, dwHighDateTime=0x1d585b4)) [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9b40 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9b40 | out: hHeap=0x260000) returned 1 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355738 [0065.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.704] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.705] GetLastError () returned 0x0 [0065.705] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.705] GetLastError () returned 0x0 [0065.716] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffec2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.716] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x13d6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x13d6, lpOverlapped=0x0) returned 1 [0065.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.717] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.717] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.717] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.717] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.718] CloseHandle (hObject=0xfc) returned 1 [0065.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.719] GetLastError () returned 0x0 [0065.720] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.720] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.720] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.721] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18572165394) returned 1 [0065.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5fb4b10, dwHighDateTime=0x1d585b4)) [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337bd8 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337bd8 | out: hHeap=0x260000) returned 1 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296300 [0065.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.721] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.721] GetLastError () returned 0x0 [0065.721] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.722] GetLastError () returned 0x0 [0065.727] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe55e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.727] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1aa2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1aa2, lpOverlapped=0x0) returned 1 [0065.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.728] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.728] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.728] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.728] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.729] CloseHandle (hObject=0xfc) returned 1 [0065.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6928 [0065.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6928 | out: hHeap=0x260000) returned 1 [0065.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.730] GetLastError () returned 0x0 [0065.730] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.731] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.731] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.731] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18573240608) returned 1 [0065.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb5fdac70, dwHighDateTime=0x1d585b4)) [0065.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9b78 [0065.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9b78 | out: hHeap=0x260000) returned 1 [0065.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2973a0 [0065.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.732] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.732] GetLastError () returned 0x0 [0065.732] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.732] GetLastError () returned 0x0 [0065.781] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffeb68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.781] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1498, lpOverlapped=0x0) returned 1 [0065.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.781] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.781] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.782] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.782] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.782] CloseHandle (hObject=0xfc) returned 1 [0065.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.861] GetLastError () returned 0x0 [0065.913] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.914] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.936] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.936] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18593728411) returned 1 [0065.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb61c9e50, dwHighDateTime=0x1d585b4)) [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9fa0 [0065.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9fa0 | out: hHeap=0x260000) returned 1 [0065.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355f88 [0065.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.937] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.937] GetLastError () returned 0x0 [0065.937] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.937] GetLastError () returned 0x0 [0065.943] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff620, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.943] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x9e0, lpOverlapped=0x0) returned 1 [0065.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.946] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.946] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.949] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.949] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.950] CloseHandle (hObject=0xfc) returned 1 [0065.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.950] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.951] GetLastError () returned 0x0 [0065.952] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.955] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.955] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.955] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18595651719) returned 1 [0065.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb61effb0, dwHighDateTime=0x1d585b4)) [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9fd8 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9fd8 | out: hHeap=0x260000) returned 1 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355d28 [0065.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.956] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.957] GetLastError () returned 0x0 [0065.957] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.957] GetLastError () returned 0x0 [0065.959] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.959] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x5ba, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x5ba, lpOverlapped=0x0) returned 1 [0065.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.960] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.960] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.961] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.961] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.962] CloseHandle (hObject=0xfc) returned 1 [0065.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.964] GetLastError () returned 0x0 [0065.964] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.965] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.965] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.965] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18596662967) returned 1 [0065.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6216110, dwHighDateTime=0x1d585b4)) [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea010 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea010 | out: hHeap=0x260000) returned 1 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356150 [0065.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.966] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.966] GetLastError () returned 0x0 [0065.966] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.967] GetLastError () returned 0x0 [0065.969] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff89a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.969] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x766, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x766, lpOverlapped=0x0) returned 1 [0065.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.970] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.970] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.970] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.970] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.971] CloseHandle (hObject=0xfc) returned 1 [0065.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.972] GetLastError () returned 0x0 [0065.973] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0065.973] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.973] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.974] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18597471542) returned 1 [0065.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb623c270, dwHighDateTime=0x1d585b4)) [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea048 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea048 | out: hHeap=0x260000) returned 1 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3561e8 [0065.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.974] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0065.974] GetLastError () returned 0x0 [0065.975] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0065.975] GetLastError () returned 0x0 [0066.010] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.010] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x78a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x78a, lpOverlapped=0x0) returned 1 [0066.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.013] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.013] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.014] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.014] CloseHandle (hObject=0xfc) returned 1 [0066.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.019] GetLastError () returned 0x0 [0066.019] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.020] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.020] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.020] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18602121005) returned 1 [0066.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb62ae690, dwHighDateTime=0x1d585b4)) [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea128 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea128 | out: hHeap=0x260000) returned 1 [0066.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356280 [0066.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.021] GetLastError () returned 0x0 [0066.021] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.021] GetLastError () returned 0x0 [0066.026] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff7ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.027] WriteFile (in: hFile=0xfc, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x812, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x812, lpOverlapped=0x0) returned 1 [0066.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0066.028] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.028] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.028] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.029] CloseHandle (hObject=0xfc) returned 1 [0066.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.030] GetLastError () returned 0x0 [0066.030] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.031] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.031] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18603250029) returned 1 [0066.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb62ae690, dwHighDateTime=0x1d585b4)) [0066.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea160 [0066.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea160 | out: hHeap=0x260000) returned 1 [0066.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3564e0 [0066.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.040] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.040] GetLastError () returned 0x0 [0066.040] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.040] GetLastError () returned 0x0 [0066.042] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd61b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.042] WriteFile (in: hFile=0xfc, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x29e5, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x29e5, lpOverlapped=0x0) returned 1 [0066.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0066.042] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.042] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.043] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.043] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.043] CloseHandle (hObject=0xfc) returned 1 [0066.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.[deadmin@cock.li].deadmin")) returned 1 [0066.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.045] GetLastError () returned 0x0 [0066.045] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.046] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.046] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.046] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18604723224) returned 1 [0066.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb62d47f0, dwHighDateTime=0x1d585b4)) [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea198 [0066.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea198 | out: hHeap=0x260000) returned 1 [0066.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356578 [0066.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.047] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.047] GetLastError () returned 0x0 [0066.047] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.047] GetLastError () returned 0x0 [0066.050] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff32ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.051] WriteFile (in: hFile=0xfc, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xcd52, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xcd52, lpOverlapped=0x0) returned 1 [0066.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0066.051] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.051] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.064] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.064] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.065] CloseHandle (hObject=0xfc) returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.066] GetLastError () returned 0x0 [0066.067] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.068] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.068] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.069] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18606979514) returned 1 [0066.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6320ab0, dwHighDateTime=0x1d585b4)) [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea208 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea208 | out: hHeap=0x260000) returned 1 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356610 [0066.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.070] GetLastError () returned 0x0 [0066.070] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.070] GetLastError () returned 0x0 [0066.074] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff583e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.074] WriteFile (in: hFile=0xfc, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xa7c2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xa7c2, lpOverlapped=0x0) returned 1 [0066.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0066.075] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.075] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.075] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.075] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.076] CloseHandle (hObject=0xfc) returned 1 [0066.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.077] GetLastError () returned 0x0 [0066.078] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.078] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.078] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.079] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18607968851) returned 1 [0066.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6320ab0, dwHighDateTime=0x1d585b4)) [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea240 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea240 | out: hHeap=0x260000) returned 1 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356740 [0066.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.079] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.079] GetLastError () returned 0x0 [0066.080] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.080] GetLastError () returned 0x0 [0066.099] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd846, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.099] WriteFile (in: hFile=0xfc, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x27ba, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x27ba, lpOverlapped=0x0) returned 1 [0066.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0066.100] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.101] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.101] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.101] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.104] CloseHandle (hObject=0xfc) returned 1 [0066.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.194] GetLastError () returned 0x0 [0066.195] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.195] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.195] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.195] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18619662125) returned 1 [0066.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb64515b0, dwHighDateTime=0x1d585b4)) [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea4e0 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea4e0 | out: hHeap=0x260000) returned 1 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3567d8 [0066.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.196] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.196] GetLastError () returned 0x0 [0066.196] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.197] GetLastError () returned 0x0 [0066.198] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff6ac6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.198] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x953a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x953a, lpOverlapped=0x0) returned 1 [0066.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.199] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.199] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.200] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.200] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.200] CloseHandle (hObject=0xfc) returned 1 [0066.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.202] GetLastError () returned 0x0 [0066.202] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.203] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.203] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.204] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18620480746) returned 1 [0066.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb64515b0, dwHighDateTime=0x1d585b4)) [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea518 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea518 | out: hHeap=0x260000) returned 1 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356ef8 [0066.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.205] GetLastError () returned 0x0 [0066.205] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.205] GetLastError () returned 0x0 [0066.227] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe0c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.228] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f40, lpOverlapped=0x0) returned 1 [0066.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.228] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.228] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.229] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.229] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.229] CloseHandle (hObject=0xfc) returned 1 [0066.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.231] GetLastError () returned 0x0 [0066.231] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.232] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.232] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.232] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18623340648) returned 1 [0066.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb649d870, dwHighDateTime=0x1d585b4)) [0066.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea5c0 [0066.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea5c0 | out: hHeap=0x260000) returned 1 [0066.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0066.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356f90 [0066.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0066.233] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.233] GetLastError () returned 0x0 [0066.233] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.233] GetLastError () returned 0x0 [0066.284] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffb27c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.284] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4d84, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x4d84, lpOverlapped=0x0) returned 1 [0066.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.284] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.284] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.285] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.286] CloseHandle (hObject=0xfc) returned 1 [0066.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.287] GetLastError () returned 0x0 [0066.287] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.288] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.288] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18628941166) returned 1 [0066.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6535df0, dwHighDateTime=0x1d585b4)) [0066.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea6d8 [0066.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea6d8 | out: hHeap=0x260000) returned 1 [0066.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f800 [0066.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.289] GetLastError () returned 0x0 [0066.289] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.289] GetLastError () returned 0x0 [0066.291] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffb83e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.291] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x47c2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x47c2, lpOverlapped=0x0) returned 1 [0066.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.292] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.292] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.292] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.292] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.293] CloseHandle (hObject=0xfc) returned 1 [0066.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.294] GetLastError () returned 0x0 [0066.295] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.295] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.295] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.295] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18629662777) returned 1 [0066.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6535df0, dwHighDateTime=0x1d585b4)) [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea710 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea710 | out: hHeap=0x260000) returned 1 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ff20 [0066.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.296] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.296] GetLastError () returned 0x0 [0066.296] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.297] GetLastError () returned 0x0 [0066.305] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe09c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.305] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1f64, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f64, lpOverlapped=0x0) returned 1 [0066.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.306] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.306] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.306] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.306] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.307] CloseHandle (hObject=0xfc) returned 1 [0066.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.308] GetLastError () returned 0x0 [0066.309] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0066.309] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0066.309] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0066.309] WriteFile (in: hFile=0xfc, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0066.311] CloseHandle (hObject=0xfc) returned 1 [0066.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0066.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.311] RtlWakeConditionVariable () returned 0x27e828 [0066.311] GetCurrentThreadId () returned 0x998 [0066.311] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.312] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.312] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.312] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18631340080) returned 1 [0066.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb655bf50, dwHighDateTime=0x1d585b4)) [0066.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3382a0 [0066.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382a0 | out: hHeap=0x260000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324d50 [0066.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.313] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.313] GetLastError () returned 0x0 [0066.313] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.313] GetLastError () returned 0x0 [0066.331] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.331] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0066.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.332] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.332] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.359] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.359] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.359] CloseHandle (hObject=0xfc) returned 1 [0066.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.[deadmin@cock.li].deadmin")) returned 1 [0066.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.369] GetLastError () returned 0x0 [0066.369] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.378] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.378] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.378] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18637904631) returned 1 [0066.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb661a630, dwHighDateTime=0x1d585b4)) [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ce8 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ce8 | out: hHeap=0x260000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b3e8 [0066.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b3e8 | out: hHeap=0x260000) returned 1 [0066.379] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.379] GetLastError () returned 0x0 [0066.379] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.379] GetLastError () returned 0x0 [0066.443] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff2be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.444] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xd42, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xd42, lpOverlapped=0x0) returned 1 [0066.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.444] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.444] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.445] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.445] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.445] CloseHandle (hObject=0xfc) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.447] GetLastError () returned 0x0 [0066.447] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.448] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.448] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.448] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18644923986) returned 1 [0066.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb66b2bb0, dwHighDateTime=0x1d585b4)) [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326af0 [0066.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326af0 | out: hHeap=0x260000) returned 1 [0066.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d3558 [0066.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d3558 | out: hHeap=0x260000) returned 1 [0066.449] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.449] GetLastError () returned 0x0 [0066.449] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.449] GetLastError () returned 0x0 [0066.476] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.476] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x5c4, lpOverlapped=0x0) returned 1 [0066.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.479] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.479] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.479] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.479] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.480] CloseHandle (hObject=0xfc) returned 1 [0066.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x284a0a8 [0066.480] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284a0a8 | out: hHeap=0x260000) returned 1 [0066.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.482] GetLastError () returned 0x0 [0066.482] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.483] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.483] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18648404243) returned 1 [0066.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb66fee70, dwHighDateTime=0x1d585b4)) [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea860 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea860 | out: hHeap=0x260000) returned 1 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x334dc0 [0066.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x334dc0 | out: hHeap=0x260000) returned 1 [0066.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.484] GetLastError () returned 0x0 [0066.484] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.484] GetLastError () returned 0x0 [0066.517] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.517] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x56c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x56c, lpOverlapped=0x0) returned 1 [0066.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.518] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.518] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.519] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.519] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.520] CloseHandle (hObject=0xfc) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.521] GetLastError () returned 0x0 [0066.521] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.522] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.522] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.522] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18652352824) returned 1 [0066.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6771290, dwHighDateTime=0x1d585b4)) [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea978 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea978 | out: hHeap=0x260000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335060 [0066.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335060 | out: hHeap=0x260000) returned 1 [0066.523] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.523] GetLastError () returned 0x0 [0066.523] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.523] GetLastError () returned 0x0 [0066.552] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff044, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.552] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xfbc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0xfbc, lpOverlapped=0x0) returned 1 [0066.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.553] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.553] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.553] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.554] CloseHandle (hObject=0xfc) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.556] GetLastError () returned 0x0 [0066.556] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x28985c0) returned 1 [0066.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.557] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.557] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18655817676) returned 1 [0066.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb67bd550, dwHighDateTime=0x1d585b4)) [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaa58 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaa58 | out: hHeap=0x260000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3353a8 [0066.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3353a8 | out: hHeap=0x260000) returned 1 [0066.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.558] GetLastError () returned 0x0 [0066.558] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.558] GetLastError () returned 0x0 [0066.600] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.600] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x738, lpOverlapped=0x0) returned 1 [0066.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.602] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.602] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.603] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.603] CloseHandle (hObject=0xfc) returned 1 [0066.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.605] GetLastError () returned 0x0 [0066.605] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.606] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.606] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.606] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18660719465) returned 1 [0066.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb682f970, dwHighDateTime=0x1d585b4)) [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eab00 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eab00 | out: hHeap=0x260000) returned 1 [0066.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335648 [0066.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335648 | out: hHeap=0x260000) returned 1 [0066.607] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.607] GetLastError () returned 0x0 [0066.607] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.607] GetLastError () returned 0x0 [0066.635] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff804, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.635] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x7fc, lpOverlapped=0x0) returned 1 [0066.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.636] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.636] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.636] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.636] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.637] CloseHandle (hObject=0xfc) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.638] GetLastError () returned 0x0 [0066.638] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.639] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.639] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.639] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18664046680) returned 1 [0066.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb687bc30, dwHighDateTime=0x1d585b4)) [0066.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327298 [0066.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327298 | out: hHeap=0x260000) returned 1 [0066.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335840 [0066.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335840 | out: hHeap=0x260000) returned 1 [0066.640] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.640] GetLastError () returned 0x0 [0066.640] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.640] GetLastError () returned 0x0 [0066.660] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffedee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.660] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1212, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x1212, lpOverlapped=0x0) returned 1 [0066.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.660] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.661] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.661] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.661] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.662] CloseHandle (hObject=0xfc) returned 1 [0066.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.663] GetLastError () returned 0x0 [0066.664] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.664] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.664] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.664] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18666563419) returned 1 [0066.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb68c7ef0, dwHighDateTime=0x1d585b4)) [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3271b8 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3271b8 | out: hHeap=0x260000) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335ae0 [0066.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335ae0 | out: hHeap=0x260000) returned 1 [0066.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.665] GetLastError () returned 0x0 [0066.666] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.666] GetLastError () returned 0x0 [0066.703] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.703] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x756, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x756, lpOverlapped=0x0) returned 1 [0066.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.704] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.704] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.704] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.705] CloseHandle (hObject=0xfc) returned 1 [0066.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.715] GetLastError () returned 0x0 [0066.715] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.716] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.716] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.716] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18671805708) returned 1 [0066.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb693a310, dwHighDateTime=0x1d585b4)) [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3270d8 [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3270d8 | out: hHeap=0x260000) returned 1 [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335d80 [0066.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335d80 | out: hHeap=0x260000) returned 1 [0066.718] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.718] GetLastError () returned 0x0 [0066.718] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.718] GetLastError () returned 0x0 [0066.720] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff84c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.720] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x7b4, lpOverlapped=0x0) returned 1 [0066.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.720] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.720] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.721] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.721] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.722] CloseHandle (hObject=0xfc) returned 1 [0066.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.723] GetLastError () returned 0x0 [0066.723] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.724] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.724] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.724] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18672544396) returned 1 [0066.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6960470, dwHighDateTime=0x1d585b4)) [0066.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327340 [0066.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327340 | out: hHeap=0x260000) returned 1 [0066.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336020 [0066.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336020 | out: hHeap=0x260000) returned 1 [0066.725] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.725] GetLastError () returned 0x0 [0066.725] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.725] GetLastError () returned 0x0 [0066.727] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff214, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.727] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xdec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0xdec, lpOverlapped=0x0) returned 1 [0066.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.727] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.727] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.728] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.728] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.729] CloseHandle (hObject=0xfc) returned 1 [0066.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.730] GetLastError () returned 0x0 [0066.730] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.731] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.731] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.731] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18673245662) returned 1 [0066.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6960470, dwHighDateTime=0x1d585b4)) [0066.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3270a0 [0066.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3270a0 | out: hHeap=0x260000) returned 1 [0066.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3360c8 [0066.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3360c8 | out: hHeap=0x260000) returned 1 [0066.732] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.732] GetLastError () returned 0x0 [0066.732] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.732] GetLastError () returned 0x0 [0066.796] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff77c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.797] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x884, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x1cffdb0*=0x884, lpOverlapped=0x0) returned 1 [0066.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.806] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.806] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.806] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.806] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.807] CloseHandle (hObject=0xfc) returned 1 [0066.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.808] GetLastError () returned 0x0 [0066.820] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.820] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.820] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.821] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18682178065) returned 1 [0066.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6a44cb0, dwHighDateTime=0x1d585b4)) [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326f88 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326f88 | out: hHeap=0x260000) returned 1 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336170 [0066.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336170 | out: hHeap=0x260000) returned 1 [0066.821] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.822] GetLastError () returned 0x0 [0066.822] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.822] GetLastError () returned 0x0 [0066.891] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff9b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.892] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x64c, lpOverlapped=0x0) returned 1 [0066.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.893] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.893] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.895] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.895] CloseHandle (hObject=0x118) returned 1 [0066.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.897] GetLastError () returned 0x0 [0066.898] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.899] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.899] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18690006978) returned 1 [0066.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6b03390, dwHighDateTime=0x1d585b4)) [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eab70 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eab70 | out: hHeap=0x260000) returned 1 [0066.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3364b8 [0066.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3364b8 | out: hHeap=0x260000) returned 1 [0066.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.900] GetLastError () returned 0x0 [0066.900] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.900] GetLastError () returned 0x0 [0066.933] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.933] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x634, lpOverlapped=0x0) returned 1 [0066.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.934] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.934] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.935] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.935] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.935] CloseHandle (hObject=0x118) returned 1 [0066.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0066.937] GetLastError () returned 0x0 [0066.938] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0066.938] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.938] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0066.939] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18693970458) returned 1 [0066.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6b4f650, dwHighDateTime=0x1d585b4)) [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327730 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327730 | out: hHeap=0x260000) returned 1 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336800 [0066.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336800 | out: hHeap=0x260000) returned 1 [0066.939] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0066.940] GetLastError () returned 0x0 [0066.940] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0066.940] GetLastError () returned 0x0 [0067.013] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff7de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.013] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x822, lpOverlapped=0x0) returned 1 [0067.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.018] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.018] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.019] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.019] CloseHandle (hObject=0x118) returned 1 [0067.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.021] GetLastError () returned 0x0 [0067.021] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.022] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.022] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.022] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18702315254) returned 1 [0067.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6c33e90, dwHighDateTime=0x1d585b4)) [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3276f8 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3276f8 | out: hHeap=0x260000) returned 1 [0067.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0067.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0067.023] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.023] GetLastError () returned 0x0 [0067.023] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.023] GetLastError () returned 0x0 [0067.079] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.079] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x6ec, lpOverlapped=0x0) returned 1 [0067.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.080] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.080] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.081] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.081] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.083] CloseHandle (hObject=0x118) returned 1 [0067.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.086] GetLastError () returned 0x0 [0067.086] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.087] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.087] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.087] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18708841884) returned 1 [0067.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6ccc410, dwHighDateTime=0x1d585b4)) [0067.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327618 [0067.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327618 | out: hHeap=0x260000) returned 1 [0067.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x354560 [0067.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x354560 | out: hHeap=0x260000) returned 1 [0067.088] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.088] GetLastError () returned 0x0 [0067.088] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.088] GetLastError () returned 0x0 [0067.114] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff290, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.114] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0xd70, lpOverlapped=0x0) returned 1 [0067.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.114] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.114] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.115] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.115] CloseHandle (hObject=0x118) returned 1 [0067.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.117] GetLastError () returned 0x0 [0067.117] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.118] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18711917075) returned 1 [0067.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6d186d0, dwHighDateTime=0x1d585b4)) [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327570 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327570 | out: hHeap=0x260000) returned 1 [0067.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be3a0 [0067.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be3a0 | out: hHeap=0x260000) returned 1 [0067.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.119] GetLastError () returned 0x0 [0067.119] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.119] GetLastError () returned 0x0 [0067.134] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff6f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.134] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x90c, lpOverlapped=0x0) returned 1 [0067.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.134] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.134] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.135] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.135] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.135] CloseHandle (hObject=0x118) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.138] GetLastError () returned 0x0 [0067.144] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.144] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.144] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.145] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18714566992) returned 1 [0067.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6d64990, dwHighDateTime=0x1d585b4)) [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3274c8 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3274c8 | out: hHeap=0x260000) returned 1 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be598 [0067.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be598 | out: hHeap=0x260000) returned 1 [0067.145] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.145] GetLastError () returned 0x0 [0067.146] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.146] GetLastError () returned 0x0 [0067.164] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff86a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.164] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x796, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x796, lpOverlapped=0x0) returned 1 [0067.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.165] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.165] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.165] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.165] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.166] CloseHandle (hObject=0x118) returned 1 [0067.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.167] GetLastError () returned 0x0 [0067.168] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0067.168] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0067.168] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0067.168] WriteFile (in: hFile=0x118, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0067.169] CloseHandle (hObject=0x118) returned 1 [0067.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0067.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0067.170] RtlWakeConditionVariable () returned 0x27e828 [0067.170] GetCurrentThreadId () returned 0x998 [0067.254] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.255] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.255] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.255] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18725599690) returned 1 [0067.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6e6f330, dwHighDateTime=0x1d585b4)) [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327880 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327880 | out: hHeap=0x260000) returned 1 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2beec8 [0067.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2beec8 | out: hHeap=0x260000) returned 1 [0067.256] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.256] GetLastError () returned 0x0 [0067.256] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.256] GetLastError () returned 0x0 [0067.283] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff699, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.283] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x967, lpOverlapped=0x0) returned 1 [0067.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.284] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.284] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.284] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.285] CloseHandle (hObject=0x118) returned 1 [0067.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.286] GetLastError () returned 0x0 [0067.286] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.287] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.287] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.287] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18728849111) returned 1 [0067.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6ebb5f0, dwHighDateTime=0x1d585b4)) [0067.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327768 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327768 | out: hHeap=0x260000) returned 1 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bea30 [0067.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bea30 | out: hHeap=0x260000) returned 1 [0067.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.288] GetLastError () returned 0x0 [0067.288] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.288] GetLastError () returned 0x0 [0067.290] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffef7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.290] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0x109, lpOverlapped=0x0) returned 1 [0067.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.290] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.290] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.291] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.292] CloseHandle (hObject=0x118) returned 1 [0067.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.295] GetLastError () returned 0x0 [0067.296] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.297] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.297] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18729790284) returned 1 [0067.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb6ebb5f0, dwHighDateTime=0x1d585b4)) [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3273b0 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3273b0 | out: hHeap=0x260000) returned 1 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf2b8 [0067.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf2b8 | out: hHeap=0x260000) returned 1 [0067.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.298] GetLastError () returned 0x0 [0067.298] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.298] GetLastError () returned 0x0 [0067.323] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.323] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0xfd, lpOverlapped=0x0) returned 1 [0067.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.324] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.324] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.325] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.325] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.325] CloseHandle (hObject=0x118) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0067.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0067.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.531] GetLastError () returned 0x0 [0067.532] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.532] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.533] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.533] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18753385322) returned 1 [0067.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb711cbf0, dwHighDateTime=0x1d585b4)) [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d93c0 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d93c0 | out: hHeap=0x260000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c02f8 [0067.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c02f8 | out: hHeap=0x260000) returned 1 [0067.533] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.534] GetLastError () returned 0x0 [0067.534] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.534] GetLastError () returned 0x0 [0067.535] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.535] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0xad, lpOverlapped=0x0) returned 1 [0067.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.536] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.536] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.537] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.537] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.537] CloseHandle (hObject=0x118) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0067.537] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0067.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0067.583] GetLastError () returned 0x0 [0067.634] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0067.635] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.635] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0067.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0067.635] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18763646126) returned 1 [0067.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7201430, dwHighDateTime=0x1d585b4)) [0067.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0067.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0067.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0067.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9158 [0067.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9158 | out: hHeap=0x260000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0ad8 [0067.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0ad8 | out: hHeap=0x260000) returned 1 [0067.636] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0067.636] GetLastError () returned 0x0 [0067.636] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0067.636] GetLastError () returned 0x0 [0067.637] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.638] WriteFile (in: hFile=0x118, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xbf, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x1cffdb0*=0xbf, lpOverlapped=0x0) returned 1 [0067.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.638] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.638] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.639] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.639] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.639] CloseHandle (hObject=0x118) returned 1 [0067.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0067.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.126] GetLastError () returned 0x0 [0068.267] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.268] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.268] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.268] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18826933563) returned 1 [0068.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb781ac90, dwHighDateTime=0x1d585b4)) [0068.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c43a0 [0068.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c43a0 | out: hHeap=0x260000) returned 1 [0068.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2838 [0068.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2838 | out: hHeap=0x260000) returned 1 [0068.269] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.269] GetLastError () returned 0x0 [0068.269] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.270] GetLastError () returned 0x0 [0068.271] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffeb5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.271] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x14b, lpOverlapped=0x0) returned 1 [0068.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.272] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.272] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.272] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.272] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.273] CloseHandle (hObject=0x118) returned 1 [0068.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.275] GetLastError () returned 0x0 [0068.275] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.286] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.286] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18828695429) returned 1 [0068.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7840df0, dwHighDateTime=0x1d585b4)) [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c43d8 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c43d8 | out: hHeap=0x260000) returned 1 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2448 [0068.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2448 | out: hHeap=0x260000) returned 1 [0068.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.287] GetLastError () returned 0x0 [0068.287] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.287] GetLastError () returned 0x0 [0068.288] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.288] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xd0, lpOverlapped=0x0) returned 1 [0068.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.289] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.289] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.290] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.290] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.291] CloseHandle (hObject=0x118) returned 1 [0068.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.293] GetLastError () returned 0x0 [0068.293] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.294] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.294] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.294] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18829532776) returned 1 [0068.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7840df0, dwHighDateTime=0x1d585b4)) [0068.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4410 [0068.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4410 | out: hHeap=0x260000) returned 1 [0068.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2988 [0068.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2988 | out: hHeap=0x260000) returned 1 [0068.295] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.295] GetLastError () returned 0x0 [0068.295] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.295] GetLastError () returned 0x0 [0068.297] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffffc1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.297] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3f, lpOverlapped=0x0) returned 1 [0068.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.298] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.298] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.298] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.299] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.299] CloseHandle (hObject=0x118) returned 1 [0068.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.302] GetLastError () returned 0x0 [0068.302] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.303] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.303] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.303] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18830447334) returned 1 [0068.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7866f50, dwHighDateTime=0x1d585b4)) [0068.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4448 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4448 | out: hHeap=0x260000) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2834a80 [0068.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2a30 [0068.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2834a80 | out: hHeap=0x260000) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2a30 | out: hHeap=0x260000) returned 1 [0068.304] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.304] GetLastError () returned 0x0 [0068.305] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.305] GetLastError () returned 0x0 [0068.306] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffffb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.306] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x49, lpOverlapped=0x0) returned 1 [0068.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.307] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.307] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.307] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.307] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.308] CloseHandle (hObject=0x118) returned 1 [0068.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.342] GetLastError () returned 0x0 [0068.342] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.343] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.344] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18834486827) returned 1 [0068.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb78d9370, dwHighDateTime=0x1d585b4)) [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4480 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4480 | out: hHeap=0x260000) returned 1 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2ad8 [0068.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2ad8 | out: hHeap=0x260000) returned 1 [0068.345] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.345] GetLastError () returned 0x0 [0068.345] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.345] GetLastError () returned 0x0 [0068.346] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffffc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.346] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3c, lpOverlapped=0x0) returned 1 [0068.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.348] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.348] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.349] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.349] CloseHandle (hObject=0x118) returned 1 [0068.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.352] GetLastError () returned 0x0 [0068.353] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.354] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.354] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.354] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18835536685) returned 1 [0068.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb78d9370, dwHighDateTime=0x1d585b4)) [0068.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c44b8 [0068.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c44b8 | out: hHeap=0x260000) returned 1 [0068.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2b80 [0068.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2b80 | out: hHeap=0x260000) returned 1 [0068.355] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.355] GetLastError () returned 0x0 [0068.355] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.356] GetLastError () returned 0x0 [0068.357] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.357] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x7a, lpOverlapped=0x0) returned 1 [0068.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.358] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.358] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.358] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.358] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.359] CloseHandle (hObject=0x118) returned 1 [0068.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.362] GetLastError () returned 0x0 [0068.362] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.363] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.363] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.364] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18836470192) returned 1 [0068.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb78ff4d0, dwHighDateTime=0x1d585b4)) [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c44f0 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c44f0 | out: hHeap=0x260000) returned 1 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2c28 [0068.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2c28 | out: hHeap=0x260000) returned 1 [0068.364] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.365] GetLastError () returned 0x0 [0068.365] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.365] GetLastError () returned 0x0 [0068.366] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.366] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x96, lpOverlapped=0x0) returned 1 [0068.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.367] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.367] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.368] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.368] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.368] CloseHandle (hObject=0x118) returned 1 [0068.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.371] GetLastError () returned 0x0 [0068.371] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.372] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.372] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18837339730) returned 1 [0068.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb78ff4d0, dwHighDateTime=0x1d585b4)) [0068.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329d20 [0068.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329d20 | out: hHeap=0x260000) returned 1 [0068.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2cd0 [0068.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2cd0 | out: hHeap=0x260000) returned 1 [0068.373] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.373] GetLastError () returned 0x0 [0068.373] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.374] GetLastError () returned 0x0 [0068.375] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.385] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x94, lpOverlapped=0x0) returned 1 [0068.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.387] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.387] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.388] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.388] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.391] CloseHandle (hObject=0x118) returned 1 [0068.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.577] GetLastError () returned 0x0 [0068.578] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.579] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.579] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.579] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18857997220) returned 1 [0068.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7b14810, dwHighDateTime=0x1d585b4)) [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4758 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4758 | out: hHeap=0x260000) returned 1 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2d78 [0068.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2d78 | out: hHeap=0x260000) returned 1 [0068.580] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.580] GetLastError () returned 0x0 [0068.580] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.580] GetLastError () returned 0x0 [0068.582] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffef6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.582] WriteFile (in: hFile=0x118, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x10a, lpOverlapped=0x0) returned 1 [0068.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.583] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.583] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.584] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.584] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.584] CloseHandle (hObject=0x118) returned 1 [0068.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.586] GetLastError () returned 0x0 [0068.586] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.587] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.587] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.587] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18858806884) returned 1 [0068.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7b14810, dwHighDateTime=0x1d585b4)) [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4790 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4790 | out: hHeap=0x260000) returned 1 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3b40 [0068.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3b40 | out: hHeap=0x260000) returned 1 [0068.588] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.588] GetLastError () returned 0x0 [0068.588] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.588] GetLastError () returned 0x0 [0068.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.589] WriteFile (in: hFile=0x118, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xb6, lpOverlapped=0x0) returned 1 [0068.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.590] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.590] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.590] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.590] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.591] CloseHandle (hObject=0x118) returned 1 [0068.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.867] GetLastError () returned 0x0 [0068.867] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.868] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.868] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.868] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18886977996) returned 1 [0068.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7dc20d0, dwHighDateTime=0x1d585b4)) [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4e20 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4e20 | out: hHeap=0x260000) returned 1 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6ec8 [0068.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6ec8 | out: hHeap=0x260000) returned 1 [0068.869] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.870] GetLastError () returned 0x0 [0068.870] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.870] GetLastError () returned 0x0 [0068.871] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.871] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xb9, lpOverlapped=0x0) returned 1 [0068.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.871] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.872] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.872] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.873] CloseHandle (hObject=0x118) returned 1 [0068.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.890] GetLastError () returned 0x0 [0068.891] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.892] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.892] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.892] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18889327604) returned 1 [0068.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e0e390, dwHighDateTime=0x1d585b4)) [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4e90 [0068.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4e90 | out: hHeap=0x260000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7018 [0068.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7018 | out: hHeap=0x260000) returned 1 [0068.893] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.893] GetLastError () returned 0x0 [0068.893] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.893] GetLastError () returned 0x0 [0068.895] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.895] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xad, lpOverlapped=0x0) returned 1 [0068.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.896] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.896] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.896] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.896] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.897] CloseHandle (hObject=0x118) returned 1 [0068.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.899] GetLastError () returned 0x0 [0068.899] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.900] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.900] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.900] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18890128196) returned 1 [0068.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e0e390, dwHighDateTime=0x1d585b4)) [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4ec8 [0068.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4ec8 | out: hHeap=0x260000) returned 1 [0068.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7168 [0068.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7168 | out: hHeap=0x260000) returned 1 [0068.901] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.901] GetLastError () returned 0x0 [0068.901] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.901] GetLastError () returned 0x0 [0068.902] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.902] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xbe, lpOverlapped=0x0) returned 1 [0068.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.903] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.903] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.903] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.904] CloseHandle (hObject=0x118) returned 1 [0068.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.906] GetLastError () returned 0x0 [0068.907] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.908] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.908] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.908] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18890891734) returned 1 [0068.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e344f0, dwHighDateTime=0x1d585b4)) [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4f00 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4f00 | out: hHeap=0x260000) returned 1 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7210 [0068.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7210 | out: hHeap=0x260000) returned 1 [0068.908] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.909] GetLastError () returned 0x0 [0068.909] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.909] GetLastError () returned 0x0 [0068.910] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.910] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xbe, lpOverlapped=0x0) returned 1 [0068.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.911] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.911] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.911] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.911] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.912] CloseHandle (hObject=0x118) returned 1 [0068.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.914] GetLastError () returned 0x0 [0068.914] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.915] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.915] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.915] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18891624752) returned 1 [0068.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e344f0, dwHighDateTime=0x1d585b4)) [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4f38 [0068.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4f38 | out: hHeap=0x260000) returned 1 [0068.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c72b8 [0068.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c72b8 | out: hHeap=0x260000) returned 1 [0068.916] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.916] GetLastError () returned 0x0 [0068.916] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.916] GetLastError () returned 0x0 [0068.917] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.917] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xb1, lpOverlapped=0x0) returned 1 [0068.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.918] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.918] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.919] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.919] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.919] CloseHandle (hObject=0x118) returned 1 [0068.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.922] GetLastError () returned 0x0 [0068.922] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.923] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.923] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.923] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18892439095) returned 1 [0068.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e5a650, dwHighDateTime=0x1d585b4)) [0068.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4f70 [0068.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4f70 | out: hHeap=0x260000) returned 1 [0068.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7360 [0068.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7360 | out: hHeap=0x260000) returned 1 [0068.924] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.924] GetLastError () returned 0x0 [0068.924] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.924] GetLastError () returned 0x0 [0068.925] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.925] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xb0, lpOverlapped=0x0) returned 1 [0068.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.926] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.926] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.927] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.927] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.927] CloseHandle (hObject=0x118) returned 1 [0068.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.929] GetLastError () returned 0x0 [0068.929] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.930] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.930] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.930] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18893150536) returned 1 [0068.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e5a650, dwHighDateTime=0x1d585b4)) [0068.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4fa8 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4fa8 | out: hHeap=0x260000) returned 1 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7408 [0068.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7408 | out: hHeap=0x260000) returned 1 [0068.931] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.931] GetLastError () returned 0x0 [0068.931] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.931] GetLastError () returned 0x0 [0068.932] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.932] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xb0, lpOverlapped=0x0) returned 1 [0068.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.933] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.933] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.934] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.934] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.934] CloseHandle (hObject=0x118) returned 1 [0068.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.936] GetLastError () returned 0x0 [0068.936] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0068.937] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.937] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0068.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0068.937] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18893861811) returned 1 [0068.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7e807b0, dwHighDateTime=0x1d585b4)) [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4fe0 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4fe0 | out: hHeap=0x260000) returned 1 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c74b0 [0068.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c74b0 | out: hHeap=0x260000) returned 1 [0068.938] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0068.938] GetLastError () returned 0x0 [0068.938] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0068.939] GetLastError () returned 0x0 [0068.939] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.940] WriteFile (in: hFile=0x118, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xb0, lpOverlapped=0x0) returned 1 [0068.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0068.940] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.940] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.941] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.941] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.941] CloseHandle (hObject=0x118) returned 1 [0068.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0068.943] GetLastError () returned 0x0 [0069.002] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.030] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.030] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.030] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18903143339) returned 1 [0069.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7f64ff0, dwHighDateTime=0x1d585b4)) [0069.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c51a0 [0069.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c51a0 | out: hHeap=0x260000) returned 1 [0069.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0069.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328fb8 [0069.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0069.031] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.031] GetLastError () returned 0x0 [0069.031] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.031] GetLastError () returned 0x0 [0069.032] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.032] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xed, lpOverlapped=0x0) returned 1 [0069.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.033] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.033] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.034] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.034] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.034] CloseHandle (hObject=0x100) returned 1 [0069.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.036] GetLastError () returned 0x0 [0069.036] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.037] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.037] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.037] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18903815363) returned 1 [0069.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7f64ff0, dwHighDateTime=0x1d585b4)) [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c51d8 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c51d8 | out: hHeap=0x260000) returned 1 [0069.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0069.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329348 [0069.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0069.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.038] GetLastError () returned 0x0 [0069.038] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.038] GetLastError () returned 0x0 [0069.039] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffd83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.039] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x27d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x27d, lpOverlapped=0x0) returned 1 [0069.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.040] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.040] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.041] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.041] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.041] CloseHandle (hObject=0x100) returned 1 [0069.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.043] GetLastError () returned 0x0 [0069.043] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.044] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.044] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.044] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18904506352) returned 1 [0069.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7f64ff0, dwHighDateTime=0x1d585b4)) [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5210 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5210 | out: hHeap=0x260000) returned 1 [0069.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0069.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328df0 [0069.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0069.046] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.046] GetLastError () returned 0x0 [0069.047] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.047] GetLastError () returned 0x0 [0069.048] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.048] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3a4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x3a4, lpOverlapped=0x0) returned 1 [0069.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.049] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.049] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.050] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.050] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.050] CloseHandle (hObject=0x100) returned 1 [0069.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.052] GetLastError () returned 0x0 [0069.053] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.055] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.055] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.055] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18905591469) returned 1 [0069.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7f8b150, dwHighDateTime=0x1d585b4)) [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5248 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0069.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0069.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0069.055] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.056] GetLastError () returned 0x0 [0069.056] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.056] GetLastError () returned 0x0 [0069.057] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffea0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.057] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x160, lpOverlapped=0x0) returned 1 [0069.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.057] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.058] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.058] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.058] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.059] CloseHandle (hObject=0x100) returned 1 [0069.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.061] GetLastError () returned 0x0 [0069.061] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.062] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.062] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.062] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18906479829) returned 1 [0069.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb7fb12b0, dwHighDateTime=0x1d585b4)) [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5280 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5280 | out: hHeap=0x260000) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0069.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328cc0 [0069.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0069.064] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.065] GetLastError () returned 0x0 [0069.065] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.065] GetLastError () returned 0x0 [0069.117] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff9e9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.117] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x617, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x617, lpOverlapped=0x0) returned 1 [0069.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.118] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.118] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.118] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.118] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.119] CloseHandle (hObject=0x100) returned 1 [0069.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.120] GetLastError () returned 0x0 [0069.121] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.121] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.121] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.122] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18912274599) returned 1 [0069.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb80236d0, dwHighDateTime=0x1d585b4)) [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5408 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5408 | out: hHeap=0x260000) returned 1 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328c28 [0069.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.122] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.122] GetLastError () returned 0x0 [0069.123] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.123] GetLastError () returned 0x0 [0069.123] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.124] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1a7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1a7, lpOverlapped=0x0) returned 1 [0069.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.124] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.124] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.125] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.125] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.126] CloseHandle (hObject=0x100) returned 1 [0069.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.129] GetLastError () returned 0x0 [0069.130] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.130] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.130] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.131] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18913164535) returned 1 [0069.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8049830, dwHighDateTime=0x1d585b4)) [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5440 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5440 | out: hHeap=0x260000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328800 [0069.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.131] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.131] GetLastError () returned 0x0 [0069.131] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.132] GetLastError () returned 0x0 [0069.132] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.133] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x16a, lpOverlapped=0x0) returned 1 [0069.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.133] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.133] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.134] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.134] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.134] CloseHandle (hObject=0x100) returned 1 [0069.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.136] GetLastError () returned 0x0 [0069.136] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.137] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.137] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.137] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18913823085) returned 1 [0069.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8049830, dwHighDateTime=0x1d585b4)) [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5478 [0069.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5478 | out: hHeap=0x260000) returned 1 [0069.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328768 [0069.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.138] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.138] GetLastError () returned 0x0 [0069.138] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.138] GetLastError () returned 0x0 [0069.139] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.139] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f3, lpOverlapped=0x0) returned 1 [0069.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.140] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.140] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.140] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.141] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.141] CloseHandle (hObject=0x100) returned 1 [0069.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.143] GetLastError () returned 0x0 [0069.143] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.144] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.144] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.144] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18914501266) returned 1 [0069.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb806f990, dwHighDateTime=0x1d585b4)) [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c54b0 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c54b0 | out: hHeap=0x260000) returned 1 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3286d0 [0069.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.145] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.145] GetLastError () returned 0x0 [0069.145] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.145] GetLastError () returned 0x0 [0069.170] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.170] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x384, lpOverlapped=0x0) returned 1 [0069.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.170] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.170] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.171] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.171] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.172] CloseHandle (hObject=0x100) returned 1 [0069.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0069.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0069.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.281] GetLastError () returned 0x0 [0069.282] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.282] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.282] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.283] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18928366410) returned 1 [0069.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb81c65f0, dwHighDateTime=0x1d585b4)) [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a260 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a260 | out: hHeap=0x260000) returned 1 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0069.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.283] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.283] GetLastError () returned 0x0 [0069.283] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.284] GetLastError () returned 0x0 [0069.286] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffd02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.286] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2fe, lpOverlapped=0x0) returned 1 [0069.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.287] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.287] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.287] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.287] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.288] CloseHandle (hObject=0x100) returned 1 [0069.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0069.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0069.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.289] GetLastError () returned 0x0 [0069.290] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.291] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.291] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18929184656) returned 1 [0069.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb81c65f0, dwHighDateTime=0x1d585b4)) [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a228 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a228 | out: hHeap=0x260000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ade8 [0069.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.292] GetLastError () returned 0x0 [0069.292] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.292] GetLastError () returned 0x0 [0069.293] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe46, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.293] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x1ba, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1ba, lpOverlapped=0x0) returned 1 [0069.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.293] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.294] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.294] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.294] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.295] CloseHandle (hObject=0x100) returned 1 [0069.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0069.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0069.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.296] GetLastError () returned 0x0 [0069.297] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.298] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.298] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18929890569) returned 1 [0069.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb81ec750, dwHighDateTime=0x1d585b4)) [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a1f0 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a1f0 | out: hHeap=0x260000) returned 1 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ad50 [0069.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.299] GetLastError () returned 0x0 [0069.299] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.299] GetLastError () returned 0x0 [0069.486] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff4fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.486] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xb04, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xb04, lpOverlapped=0x0) returned 1 [0069.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.500] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.501] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.501] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.502] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.502] CloseHandle (hObject=0x100) returned 1 [0069.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.504] GetLastError () returned 0x0 [0069.505] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.506] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.506] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.506] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18950720793) returned 1 [0069.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb83db930, dwHighDateTime=0x1d585b4)) [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ee0 [0069.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ee0 | out: hHeap=0x260000) returned 1 [0069.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0069.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.507] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.507] GetLastError () returned 0x0 [0069.507] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.508] GetLastError () returned 0x0 [0069.610] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffa20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.611] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5e0, lpOverlapped=0x0) returned 1 [0069.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.611] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.611] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.612] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.612] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.612] CloseHandle (hObject=0x100) returned 1 [0069.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.614] GetLastError () returned 0x0 [0069.614] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.615] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.615] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18961628597) returned 1 [0069.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb84e62d0, dwHighDateTime=0x1d585b4)) [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c58a0 [0069.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c58a0 | out: hHeap=0x260000) returned 1 [0069.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eca90 [0069.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.616] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.616] GetLastError () returned 0x0 [0069.616] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.616] GetLastError () returned 0x0 [0069.617] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.617] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x15e, lpOverlapped=0x0) returned 1 [0069.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.618] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.618] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.618] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.618] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.619] CloseHandle (hObject=0x100) returned 1 [0069.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.621] GetLastError () returned 0x0 [0069.621] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.622] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.622] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.622] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18962297126) returned 1 [0069.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb84e62d0, dwHighDateTime=0x1d585b4)) [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c58d8 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c58d8 | out: hHeap=0x260000) returned 1 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed670 [0069.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.623] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.623] GetLastError () returned 0x0 [0069.623] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.623] GetLastError () returned 0x0 [0069.637] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.637] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3de, lpOverlapped=0x0) returned 1 [0069.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.638] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.638] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.639] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.639] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.639] CloseHandle (hObject=0x100) returned 1 [0069.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.654] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.656] GetLastError () returned 0x0 [0069.656] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.657] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.657] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18965803958) returned 1 [0069.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb85586f0, dwHighDateTime=0x1d585b4)) [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c59b8 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c59b8 | out: hHeap=0x260000) returned 1 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed5d8 [0069.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.658] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.658] GetLastError () returned 0x0 [0069.658] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.658] GetLastError () returned 0x0 [0069.844] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffcb3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.844] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x34d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x34d, lpOverlapped=0x0) returned 1 [0069.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.846] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.847] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.847] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.847] CloseHandle (hObject=0x100) returned 1 [0069.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.849] GetLastError () returned 0x0 [0069.849] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0069.850] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.850] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.850] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18985152983) returned 1 [0069.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8721770, dwHighDateTime=0x1d585b4)) [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a688 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a688 | out: hHeap=0x260000) returned 1 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ac20 [0069.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.851] GetLastError () returned 0x0 [0069.851] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.852] GetLastError () returned 0x0 [0069.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.854] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0069.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0069.855] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.864] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.865] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.873] CloseHandle (hObject=0x100) returned 1 [0069.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.[deadmin@cock.li].deadmin")) returned 1 [0069.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.874] GetLastError () returned 0x0 [0069.875] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0069.875] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.875] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0069.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.876] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18987669747) returned 1 [0069.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb876da30, dwHighDateTime=0x1d585b4)) [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a5e0 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a5e0 | out: hHeap=0x260000) returned 1 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328fb8 [0069.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.876] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.876] GetLastError () returned 0x0 [0069.877] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.877] GetLastError () returned 0x0 [0069.879] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.879] WriteFile (in: hFile=0x100, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0069.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.880] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.880] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.883] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.883] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.883] CloseHandle (hObject=0x100) returned 1 [0069.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.[deadmin@cock.li].deadmin")) returned 1 [0069.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.885] GetLastError () returned 0x0 [0069.885] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310b80) returned 1 [0069.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.886] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0069.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.886] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18988746984) returned 1 [0069.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb876da30, dwHighDateTime=0x1d585b4)) [0069.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a5a8 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a5a8 | out: hHeap=0x260000) returned 1 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328fb8 [0069.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.887] GetLastError () returned 0x0 [0069.887] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.887] GetLastError () returned 0x0 [0069.895] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.896] WriteFile (in: hFile=0x100, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0069.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.896] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.897] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.902] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.902] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.903] CloseHandle (hObject=0x100) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0069.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.[deadmin@cock.li].deadmin")) returned 1 [0069.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0069.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0069.992] GetLastError () returned 0x0 [0069.993] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312940) returned 1 [0069.994] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.994] CryptReleaseContext (hProv=0x312940, dwFlags=0x0) returned 1 [0069.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0069.994] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=18999513916) returned 1 [0069.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb88783d0, dwHighDateTime=0x1d585b4)) [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a458 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a458 | out: hHeap=0x260000) returned 1 [0069.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b800 [0069.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.995] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0069.995] GetLastError () returned 0x0 [0069.995] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0069.995] GetLastError () returned 0x0 [0070.002] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffd888, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.003] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x2778, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x2778, lpOverlapped=0x0) returned 1 [0070.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.007] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.007] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.008] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.008] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.009] CloseHandle (hObject=0xfc) returned 1 [0070.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.011] GetLastError () returned 0x0 [0070.012] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0070.013] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.013] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.013] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19001445728) returned 1 [0070.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb88c4690, dwHighDateTime=0x1d585b4)) [0070.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32aa08 [0070.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32aa08 | out: hHeap=0x260000) returned 1 [0070.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c79f0 [0070.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b800 [0070.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c79f0 | out: hHeap=0x260000) returned 1 [0070.014] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.014] GetLastError () returned 0x0 [0070.014] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.014] GetLastError () returned 0x0 [0070.020] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe9a1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.020] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x165e2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x165e2, lpOverlapped=0x0) returned 1 [0070.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.022] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.023] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.023] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.023] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.024] CloseHandle (hObject=0xfc) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml.[deadmin@cock.li].deadmin")) returned 1 [0070.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.026] GetLastError () returned 0x0 [0070.026] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.026] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.026] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0070.026] WriteFile (in: hFile=0xfc, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0070.027] CloseHandle (hObject=0xfc) returned 1 [0070.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0070.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.028] RtlWakeConditionVariable () returned 0x27e828 [0070.028] GetCurrentThreadId () returned 0x998 [0070.029] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3111e0) returned 1 [0070.029] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.030] CryptReleaseContext (hProv=0x3111e0, dwFlags=0x0) returned 1 [0070.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.030] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19003085718) returned 1 [0070.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb88ea7f0, dwHighDateTime=0x1d585b4)) [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5c90 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5c90 | out: hHeap=0x260000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b800 [0070.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.031] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.031] GetLastError () returned 0x0 [0070.031] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.031] GetLastError () returned 0x0 [0070.058] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff4c70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.058] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xb390, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xb390, lpOverlapped=0x0) returned 1 [0070.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.126] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.126] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.127] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.127] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.128] CloseHandle (hObject=0xfc) returned 1 [0070.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2817ac8 [0070.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817ac8 | out: hHeap=0x260000) returned 1 [0070.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.135] GetLastError () returned 0x0 [0070.136] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312588) returned 1 [0070.136] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.136] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.137] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19013776064) returned 1 [0070.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb89cf030, dwHighDateTime=0x1d585b4)) [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5de0 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5de0 | out: hHeap=0x260000) returned 1 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b898 [0070.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.137] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.138] GetLastError () returned 0x0 [0070.138] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.138] GetLastError () returned 0x0 [0070.141] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.141] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0070.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.142] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.142] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.142] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.142] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.143] CloseHandle (hObject=0x120) returned 1 [0070.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2817ac8 [0070.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.[deadmin@cock.li].deadmin")) returned 1 [0070.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817ac8 | out: hHeap=0x260000) returned 1 [0070.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.145] GetLastError () returned 0x0 [0070.145] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0070.146] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.146] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.146] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19014710719) returned 1 [0070.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb89f5190, dwHighDateTime=0x1d585b4)) [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5e18 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5e18 | out: hHeap=0x260000) returned 1 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7a98 [0070.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b898 [0070.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7a98 | out: hHeap=0x260000) returned 1 [0070.147] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.147] GetLastError () returned 0x0 [0070.147] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.147] GetLastError () returned 0x0 [0070.156] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffca42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.156] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x35be, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x35be, lpOverlapped=0x0) returned 1 [0070.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.156] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.156] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.157] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.157] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.158] CloseHandle (hObject=0x120) returned 1 [0070.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.[deadmin@cock.li].deadmin")) returned 1 [0070.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.162] GetLastError () returned 0x0 [0070.162] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0070.163] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.163] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.163] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19016411060) returned 1 [0070.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8a1b2f0, dwHighDateTime=0x1d585b4)) [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5e88 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5e88 | out: hHeap=0x260000) returned 1 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7b40 [0070.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0070.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7b40 | out: hHeap=0x260000) returned 1 [0070.164] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.164] GetLastError () returned 0x0 [0070.164] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.164] GetLastError () returned 0x0 [0070.174] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffc080, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.174] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x3f80, lpOverlapped=0x0) returned 1 [0070.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.175] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.175] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.176] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.176] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.177] CloseHandle (hObject=0x120) returned 1 [0070.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.177] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.178] GetLastError () returned 0x0 [0070.180] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0070.180] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.181] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.181] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19018189976) returned 1 [0070.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8a41450, dwHighDateTime=0x1d585b4)) [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cc78 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cc78 | out: hHeap=0x260000) returned 1 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32af18 [0070.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.182] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.182] GetLastError () returned 0x0 [0070.182] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.182] GetLastError () returned 0x0 [0070.200] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.201] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xbe, lpOverlapped=0x0) returned 1 [0070.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.201] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.201] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.202] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.202] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.203] CloseHandle (hObject=0x120) returned 1 [0070.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0070.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc.[deadmin@cock.li].deadmin")) returned 1 [0070.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0070.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.226] GetLastError () returned 0x0 [0070.233] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311488) returned 1 [0070.242] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.242] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.242] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19024326893) returned 1 [0070.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8ad99d0, dwHighDateTime=0x1d585b4)) [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5ef8 [0070.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5ef8 | out: hHeap=0x260000) returned 1 [0070.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ece20 [0070.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.245] GetLastError () returned 0x0 [0070.246] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.246] GetLastError () returned 0x0 [0070.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.260] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.263] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.263] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.372] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.372] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.373] CloseHandle (hObject=0xf0) returned 1 [0070.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.375] GetLastError () returned 0x0 [0070.375] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312588) returned 1 [0070.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.376] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.376] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19037752788) returned 1 [0070.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8c30630, dwHighDateTime=0x1d585b4)) [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c60b8 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c60b8 | out: hHeap=0x260000) returned 1 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.377] GetLastError () returned 0x0 [0070.377] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.377] GetLastError () returned 0x0 [0070.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffca80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.381] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3580, lpOverlapped=0x0) returned 1 [0070.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0070.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.381] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.382] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.382] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.383] CloseHandle (hObject=0xf0) returned 1 [0070.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0070.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.384] GetLastError () returned 0x0 [0070.385] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311b70) returned 1 [0070.386] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.386] CryptReleaseContext (hProv=0x311b70, dwFlags=0x0) returned 1 [0070.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.386] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19038743611) returned 1 [0070.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8c30630, dwHighDateTime=0x1d585b4)) [0070.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c60f0 [0070.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c60f0 | out: hHeap=0x260000) returned 1 [0070.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.387] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.387] GetLastError () returned 0x0 [0070.387] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.388] GetLastError () returned 0x0 [0070.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff95d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.390] WriteFile (in: hFile=0xf0, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6a3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x6a3, lpOverlapped=0x0) returned 1 [0070.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.390] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.390] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.391] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.391] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.391] CloseHandle (hObject=0xf0) returned 1 [0070.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.[deadmin@cock.li].deadmin")) returned 1 [0070.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.393] GetLastError () returned 0x0 [0070.394] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312588) returned 1 [0070.395] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.395] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.395] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19039639527) returned 1 [0070.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8c56790, dwHighDateTime=0x1d585b4)) [0070.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c6128 [0070.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6128 | out: hHeap=0x260000) returned 1 [0070.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecbc0 [0070.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.396] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.396] GetLastError () returned 0x0 [0070.396] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.396] GetLastError () returned 0x0 [0070.404] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.405] WriteFile (in: hFile=0xf0, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.406] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.411] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.411] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.412] CloseHandle (hObject=0xf0) returned 1 [0070.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0070.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.414] GetLastError () returned 0x0 [0070.415] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312588) returned 1 [0070.416] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.416] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.416] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19041692550) returned 1 [0070.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8c7c8f0, dwHighDateTime=0x1d585b4)) [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c6198 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6198 | out: hHeap=0x260000) returned 1 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec700 [0070.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.417] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.417] GetLastError () returned 0x0 [0070.417] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.417] GetLastError () returned 0x0 [0070.418] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.418] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xd1, lpOverlapped=0x0) returned 1 [0070.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.419] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.420] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.420] CloseHandle (hObject=0xf0) returned 1 [0070.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0070.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.422] GetLastError () returned 0x0 [0070.423] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312588) returned 1 [0070.423] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.423] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.424] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19042477284) returned 1 [0070.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8ca2a50, dwHighDateTime=0x1d585b4)) [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c61d0 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c61d0 | out: hHeap=0x260000) returned 1 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec668 [0070.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.424] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.425] GetLastError () returned 0x0 [0070.425] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.425] GetLastError () returned 0x0 [0070.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.426] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x72, lpOverlapped=0x0) returned 1 [0070.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.427] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.427] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.428] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.428] CloseHandle (hObject=0xf0) returned 1 [0070.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0070.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.430] GetLastError () returned 0x0 [0070.431] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312588) returned 1 [0070.431] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.431] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.432] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19043445742) returned 1 [0070.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8ca2a50, dwHighDateTime=0x1d585b4)) [0070.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32aa78 [0070.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32aa78 | out: hHeap=0x260000) returned 1 [0070.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec538 [0070.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.485] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.486] GetLastError () returned 0x0 [0070.486] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.486] GetLastError () returned 0x0 [0070.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.488] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0070.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.489] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.489] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.489] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.490] CloseHandle (hObject=0xf0) returned 1 [0070.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0070.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.510] GetLastError () returned 0x0 [0070.516] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3122e0) returned 1 [0070.517] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.517] CryptReleaseContext (hProv=0x3122e0, dwFlags=0x0) returned 1 [0070.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.517] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19051859560) returned 1 [0070.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8d87290, dwHighDateTime=0x1d585b4)) [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a848 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a848 | out: hHeap=0x260000) returned 1 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec960 [0070.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.518] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.518] GetLastError () returned 0x0 [0070.519] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.519] GetLastError () returned 0x0 [0070.536] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffec098, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.536] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x13f68, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x13f68, lpOverlapped=0x0) returned 1 [0070.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.537] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.538] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.539] CloseHandle (hObject=0xf0) returned 1 [0070.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.544] GetLastError () returned 0x0 [0070.545] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3122e0) returned 1 [0070.546] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.546] CryptReleaseContext (hProv=0x3122e0, dwFlags=0x0) returned 1 [0070.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.546] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19054706097) returned 1 [0070.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8dd3550, dwHighDateTime=0x1d585b4)) [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a7a0 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a7a0 | out: hHeap=0x260000) returned 1 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.547] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.547] GetLastError () returned 0x0 [0070.547] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.547] GetLastError () returned 0x0 [0070.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff805, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.549] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7fb, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x7fb, lpOverlapped=0x0) returned 1 [0070.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.549] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.550] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.550] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.550] CloseHandle (hObject=0xf0) returned 1 [0070.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.[deadmin@cock.li].deadmin")) returned 1 [0070.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.552] GetLastError () returned 0x0 [0070.553] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311fb0) returned 1 [0070.555] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.555] CryptReleaseContext (hProv=0x311fb0, dwFlags=0x0) returned 1 [0070.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.555] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19055644818) returned 1 [0070.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8dd3550, dwHighDateTime=0x1d585b4)) [0070.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a7a0 [0070.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a7a0 | out: hHeap=0x260000) returned 1 [0070.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.556] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.557] GetLastError () returned 0x0 [0070.557] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.557] GetLastError () returned 0x0 [0070.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.591] WriteFile (in: hFile=0xf0, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.593] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.593] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.607] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.607] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.608] CloseHandle (hObject=0xf0) returned 1 [0070.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.609] GetLastError () returned 0x0 [0070.610] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3121d0) returned 1 [0070.611] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.611] CryptReleaseContext (hProv=0x3121d0, dwFlags=0x0) returned 1 [0070.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.611] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19061203251) returned 1 [0070.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8e6bad0, dwHighDateTime=0x1d585b4)) [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d068 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d068 | out: hHeap=0x260000) returned 1 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328cc0 [0070.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.612] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.612] GetLastError () returned 0x0 [0070.612] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.612] GetLastError () returned 0x0 [0070.613] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.613] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xcd, lpOverlapped=0x0) returned 1 [0070.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.614] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.614] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.614] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.615] CloseHandle (hObject=0xf0) returned 1 [0070.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0070.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.617] GetLastError () returned 0x0 [0070.617] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3121d0) returned 1 [0070.618] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.618] CryptReleaseContext (hProv=0x3121d0, dwFlags=0x0) returned 1 [0070.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.618] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19061923614) returned 1 [0070.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8e6bad0, dwHighDateTime=0x1d585b4)) [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d030 [0070.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d030 | out: hHeap=0x260000) returned 1 [0070.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27505b8 [0070.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.619] GetLastError () returned 0x0 [0070.619] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.619] GetLastError () returned 0x0 [0070.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.620] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x72, lpOverlapped=0x0) returned 1 [0070.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.621] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.622] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.622] CloseHandle (hObject=0xf0) returned 1 [0070.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0070.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.624] GetLastError () returned 0x0 [0070.633] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3121d0) returned 1 [0070.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.634] CryptReleaseContext (hProv=0x3121d0, dwFlags=0x0) returned 1 [0070.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.634] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19063490023) returned 1 [0070.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8e91c30, dwHighDateTime=0x1d585b4)) [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cfc0 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cfc0 | out: hHeap=0x260000) returned 1 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750520 [0070.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.634] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.635] GetLastError () returned 0x0 [0070.635] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.635] GetLastError () returned 0x0 [0070.636] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.636] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0070.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.637] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.638] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.638] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.639] CloseHandle (hObject=0xf0) returned 1 [0070.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0070.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.640] GetLastError () returned 0x0 [0070.641] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3121d0) returned 1 [0070.641] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.641] CryptReleaseContext (hProv=0x3121d0, dwFlags=0x0) returned 1 [0070.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.642] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19064279826) returned 1 [0070.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8eb7d90, dwHighDateTime=0x1d585b4)) [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cf88 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cf88 | out: hHeap=0x260000) returned 1 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eb8c0 [0070.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.642] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.643] GetLastError () returned 0x0 [0070.643] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.643] GetLastError () returned 0x0 [0070.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff6c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.650] WriteFile (in: hFile=0xf0, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x9380, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x9380, lpOverlapped=0x0) returned 1 [0070.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.651] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.652] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.652] CloseHandle (hObject=0xf0) returned 1 [0070.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0070.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0070.694] GetLastError () returned 0x0 [0070.705] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311e18) returned 1 [0070.706] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.706] CryptReleaseContext (hProv=0x311e18, dwFlags=0x0) returned 1 [0070.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.706] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19070733382) returned 1 [0070.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8f50310, dwHighDateTime=0x1d585b4)) [0070.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28584d8 [0070.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28584d8 | out: hHeap=0x260000) returned 1 [0070.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x356eb8 [0070.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x356eb8 | out: hHeap=0x260000) returned 1 [0070.707] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.707] GetLastError () returned 0x0 [0070.707] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.707] GetLastError () returned 0x0 [0070.736] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff9eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.736] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x614e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x614e, lpOverlapped=0x0) returned 1 [0070.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.737] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.737] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.738] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.738] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.739] CloseHandle (hObject=0x120) returned 1 [0070.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.741] GetLastError () returned 0x0 [0070.741] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311e18) returned 1 [0070.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.742] CryptReleaseContext (hProv=0x311e18, dwFlags=0x0) returned 1 [0070.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.742] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19074302610) returned 1 [0070.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb8f9c5d0, dwHighDateTime=0x1d585b4)) [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a3b0 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a3b0 | out: hHeap=0x260000) returned 1 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.743] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.743] GetLastError () returned 0x0 [0070.743] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.743] GetLastError () returned 0x0 [0070.745] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffa970, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.745] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x5690, lpOverlapped=0x0) returned 1 [0070.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.746] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.746] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.747] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.747] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.748] CloseHandle (hObject=0x120) returned 1 [0070.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.748] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.751] GetLastError () returned 0x0 [0070.867] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0070.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.879] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.888] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19088953852) returned 1 [0070.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9119390, dwHighDateTime=0x1d585b4)) [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d458 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d458 | out: hHeap=0x260000) returned 1 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314ba0 [0070.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314ba0 | out: hHeap=0x260000) returned 1 [0070.889] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.889] GetLastError () returned 0x0 [0070.889] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.889] GetLastError () returned 0x0 [0070.890] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.891] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x6a, lpOverlapped=0x0) returned 1 [0070.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.891] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.891] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.892] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.892] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.893] CloseHandle (hObject=0x108) returned 1 [0070.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.894] GetLastError () returned 0x0 [0070.913] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0070.923] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.923] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.924] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19092481126) returned 1 [0070.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9165650, dwHighDateTime=0x1d585b4)) [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d378 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d378 | out: hHeap=0x260000) returned 1 [0070.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.943] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.943] GetLastError () returned 0x0 [0070.944] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.944] GetLastError () returned 0x0 [0070.945] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.945] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0070.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.945] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.946] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.946] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.946] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.947] CloseHandle (hObject=0x104) returned 1 [0070.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0070.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0070.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.948] GetLastError () returned 0x0 [0070.949] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0070.950] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.950] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0070.950] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19095107667) returned 1 [0070.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb91b1910, dwHighDateTime=0x1d585b4)) [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d650 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d650 | out: hHeap=0x260000) returned 1 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.951] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0070.951] GetLastError () returned 0x0 [0070.951] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0070.951] GetLastError () returned 0x0 [0070.987] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff280, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.987] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xd80, lpOverlapped=0x0) returned 1 [0070.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.992] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.992] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.993] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.993] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.994] CloseHandle (hObject=0x104) returned 1 [0070.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0070.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css.[deadmin@cock.li].deadmin")) returned 1 [0070.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0070.996] GetLastError () returned 0x0 [0071.106] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.107] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.107] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.107] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19110827236) returned 1 [0071.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb932e6d0, dwHighDateTime=0x1d585b4)) [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d810 [0071.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d810 | out: hHeap=0x260000) returned 1 [0071.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31beb8 [0071.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31beb8 | out: hHeap=0x260000) returned 1 [0071.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.108] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.108] GetLastError () returned 0x0 [0071.108] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.108] GetLastError () returned 0x0 [0071.109] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.109] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0071.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.110] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.110] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.111] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.111] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.112] CloseHandle (hObject=0x100) returned 1 [0071.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0071.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0071.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.113] GetLastError () returned 0x0 [0071.115] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.115] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.115] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.115] WriteFile (in: hFile=0x100, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.117] CloseHandle (hObject=0x100) returned 1 [0071.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28201a0 | out: hHeap=0x260000) returned 1 [0071.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.117] RtlWakeConditionVariable () returned 0x27e828 [0071.117] GetCurrentThreadId () returned 0x998 [0071.117] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.118] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.118] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19111923039) returned 1 [0071.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb932e6d0, dwHighDateTime=0x1d585b4)) [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d7d8 [0071.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d7d8 | out: hHeap=0x260000) returned 1 [0071.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31beb8 [0071.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31beb8 | out: hHeap=0x260000) returned 1 [0071.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.119] GetLastError () returned 0x0 [0071.119] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.119] GetLastError () returned 0x0 [0071.121] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff2fd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.121] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd03, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xd03, lpOverlapped=0x0) returned 1 [0071.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.121] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.121] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.122] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.122] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.123] CloseHandle (hObject=0x100) returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css.[deadmin@cock.li].deadmin")) returned 1 [0071.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.124] GetLastError () returned 0x0 [0071.124] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.125] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.125] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.125] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19112650262) returned 1 [0071.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9354830, dwHighDateTime=0x1d585b4)) [0071.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d7a0 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d7a0 | out: hHeap=0x260000) returned 1 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31beb8 [0071.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31beb8 | out: hHeap=0x260000) returned 1 [0071.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.126] GetLastError () returned 0x0 [0071.126] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.126] GetLastError () returned 0x0 [0071.145] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff89a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.145] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x766, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x766, lpOverlapped=0x0) returned 1 [0071.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.148] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.148] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.148] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.148] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.149] CloseHandle (hObject=0x100) returned 1 [0071.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css.[deadmin@cock.li].deadmin")) returned 1 [0071.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.151] GetLastError () returned 0x0 [0071.273] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.274] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.274] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.274] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19127522339) returned 1 [0071.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb94ab490, dwHighDateTime=0x1d585b4)) [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dd20 [0071.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dd20 | out: hHeap=0x260000) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.275] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.275] GetLastError () returned 0x0 [0071.275] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.275] GetLastError () returned 0x0 [0071.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.296] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x401, lpOverlapped=0x0) returned 1 [0071.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0071.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.299] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.299] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.299] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.300] CloseHandle (hObject=0xf0) returned 1 [0071.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.306] GetLastError () returned 0x0 [0071.325] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.348] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.348] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.356] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19135675655) returned 1 [0071.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb958fcd0, dwHighDateTime=0x1d585b4)) [0071.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e3e8 [0071.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e3e8 | out: hHeap=0x260000) returned 1 [0071.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.358] GetLastError () returned 0x0 [0071.358] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.358] GetLastError () returned 0x0 [0071.360] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.360] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0071.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.361] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.362] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.363] CloseHandle (hObject=0x104) returned 1 [0071.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0071.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0071.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.366] GetLastError () returned 0x0 [0071.366] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.367] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.367] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.367] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19136858452) returned 1 [0071.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb958fcd0, dwHighDateTime=0x1d585b4)) [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7d88 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d88 | out: hHeap=0x260000) returned 1 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.368] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.368] GetLastError () returned 0x0 [0071.368] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.369] GetLastError () returned 0x0 [0071.370] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff794, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.370] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x86c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x86c, lpOverlapped=0x0) returned 1 [0071.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.371] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.371] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.371] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.371] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.372] CloseHandle (hObject=0x104) returned 1 [0071.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0071.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0071.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.373] GetLastError () returned 0x0 [0071.374] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.375] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.375] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.375] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19137593888) returned 1 [0071.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb95b5e30, dwHighDateTime=0x1d585b4)) [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7dc0 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7dc0 | out: hHeap=0x260000) returned 1 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.375] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.376] GetLastError () returned 0x0 [0071.376] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.376] GetLastError () returned 0x0 [0071.377] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffe10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.377] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f0, lpOverlapped=0x0) returned 1 [0071.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.377] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.377] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.378] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.379] CloseHandle (hObject=0x104) returned 1 [0071.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.380] GetLastError () returned 0x0 [0071.380] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.381] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.381] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0071.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0071.381] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19138250977) returned 1 [0071.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb95b5e30, dwHighDateTime=0x1d585b4)) [0071.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8370 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8370 | out: hHeap=0x260000) returned 1 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.382] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.382] GetLastError () returned 0x0 [0071.382] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.382] GetLastError () returned 0x0 [0071.423] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.423] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x401, lpOverlapped=0x0) returned 1 [0071.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.512] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.532] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.533] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.533] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.534] CloseHandle (hObject=0x104) returned 1 [0071.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.594] GetLastError () returned 0x0 [0071.823] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.849] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.849] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19185013463) returned 1 [0071.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9a2c770, dwHighDateTime=0x1d585b4)) [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e538 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e538 | out: hHeap=0x260000) returned 1 [0071.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.850] GetLastError () returned 0x0 [0071.850] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.850] GetLastError () returned 0x0 [0071.853] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff696, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.853] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x96a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x96a, lpOverlapped=0x0) returned 1 [0071.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.854] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.855] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.855] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.856] CloseHandle (hObject=0x100) returned 1 [0071.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.858] GetLastError () returned 0x0 [0071.858] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.859] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.859] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.859] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19186013945) returned 1 [0071.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9a528d0, dwHighDateTime=0x1d585b4)) [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e378 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e378 | out: hHeap=0x260000) returned 1 [0071.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.860] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.860] GetLastError () returned 0x0 [0071.860] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.860] GetLastError () returned 0x0 [0071.861] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff09, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.861] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xf7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xf7, lpOverlapped=0x0) returned 1 [0071.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.862] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.862] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.862] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.862] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.863] CloseHandle (hObject=0x100) returned 1 [0071.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css.[deadmin@cock.li].deadmin")) returned 1 [0071.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.864] GetLastError () returned 0x0 [0071.865] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0071.865] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.865] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.866] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19186682750) returned 1 [0071.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9a528d0, dwHighDateTime=0x1d585b4)) [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e340 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e340 | out: hHeap=0x260000) returned 1 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.867] GetLastError () returned 0x0 [0071.867] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.867] GetLastError () returned 0x0 [0071.869] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffaa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.869] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x55c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x55c, lpOverlapped=0x0) returned 1 [0071.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.869] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.870] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.870] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.870] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.871] CloseHandle (hObject=0x100) returned 1 [0071.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css.[deadmin@cock.li].deadmin")) returned 1 [0071.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.872] GetLastError () returned 0x0 [0071.873] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0071.873] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0071.873] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0071.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0071.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.874] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19187471569) returned 1 [0071.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9a78a30, dwHighDateTime=0x1d585b4)) [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e308 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e308 | out: hHeap=0x260000) returned 1 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.874] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.874] GetLastError () returned 0x0 [0071.875] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.875] GetLastError () returned 0x0 [0071.875] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.876] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xa7, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xa7, lpOverlapped=0x0) returned 1 [0071.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.876] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.876] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.877] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.877] CloseHandle (hObject=0x100) returned 1 [0071.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css.[deadmin@cock.li].deadmin")) returned 1 [0071.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0071.879] GetLastError () returned 0x0 [0071.879] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0071.880] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0071.880] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0071.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0071.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0071.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0071.880] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19188139116) returned 1 [0071.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9a78a30, dwHighDateTime=0x1d585b4)) [0071.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0071.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0071.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0071.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e2d0 [0071.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e2d0 | out: hHeap=0x260000) returned 1 [0071.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0071.881] GetLastError () returned 0x0 [0071.881] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0071.881] GetLastError () returned 0x0 [0071.882] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffff55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.882] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xab, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xab, lpOverlapped=0x0) returned 1 [0071.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.883] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.883] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.884] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.884] CloseHandle (hObject=0x100) returned 1 [0071.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css.[deadmin@cock.li].deadmin")) returned 1 [0072.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0072.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.194] GetLastError () returned 0x0 [0072.262] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.263] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.263] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19226441919) returned 1 [0072.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9e30c90, dwHighDateTime=0x1d585b4)) [0072.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e8b8 [0072.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e8b8 | out: hHeap=0x260000) returned 1 [0072.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.264] GetLastError () returned 0x0 [0072.264] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.264] GetLastError () returned 0x0 [0072.267] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.267] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x108, lpOverlapped=0x0) returned 1 [0072.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.268] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.268] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.269] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.269] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.270] CloseHandle (hObject=0x108) returned 1 [0072.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0072.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.272] GetLastError () returned 0x0 [0072.272] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.273] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.273] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.273] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19227405063) returned 1 [0072.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9e30c90, dwHighDateTime=0x1d585b4)) [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e030 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e030 | out: hHeap=0x260000) returned 1 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.274] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.274] GetLastError () returned 0x0 [0072.274] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.274] GetLastError () returned 0x0 [0072.275] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff296, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.276] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd6a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xd6a, lpOverlapped=0x0) returned 1 [0072.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.276] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.276] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.277] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.277] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.277] CloseHandle (hObject=0x108) returned 1 [0072.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30de90 [0072.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css.[deadmin@cock.li].deadmin")) returned 1 [0072.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de90 | out: hHeap=0x260000) returned 1 [0072.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.279] GetLastError () returned 0x0 [0072.279] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.280] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.280] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.280] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19228149705) returned 1 [0072.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9e56df0, dwHighDateTime=0x1d585b4)) [0072.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dff8 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dff8 | out: hHeap=0x260000) returned 1 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.281] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.281] GetLastError () returned 0x0 [0072.281] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.281] GetLastError () returned 0x0 [0072.283] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.283] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x32f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x32f, lpOverlapped=0x0) returned 1 [0072.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.284] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.284] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.284] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.285] CloseHandle (hObject=0x108) returned 1 [0072.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0072.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0072.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.287] GetLastError () returned 0x0 [0072.287] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.288] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.288] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19228898731) returned 1 [0072.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9e56df0, dwHighDateTime=0x1d585b4)) [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dcb0 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dcb0 | out: hHeap=0x260000) returned 1 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.289] GetLastError () returned 0x0 [0072.289] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.289] GetLastError () returned 0x0 [0072.291] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff966d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.291] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6993, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x6993, lpOverlapped=0x0) returned 1 [0072.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.292] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.292] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.293] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.293] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.293] CloseHandle (hObject=0x108) returned 1 [0072.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0072.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.296] GetLastError () returned 0x0 [0072.296] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0072.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0072.297] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0072.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.297] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19229860277) returned 1 [0072.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9e7cf50, dwHighDateTime=0x1d585b4)) [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dc78 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dc78 | out: hHeap=0x260000) returned 1 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.298] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.298] GetLastError () returned 0x0 [0072.298] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.299] GetLastError () returned 0x0 [0072.299] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.300] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0072.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.300] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.300] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.301] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.301] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.302] CloseHandle (hObject=0x108) returned 1 [0072.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0072.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0072.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.303] GetLastError () returned 0x0 [0072.303] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0072.304] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0072.304] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0072.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.304] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19230544528) returned 1 [0072.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9e7cf50, dwHighDateTime=0x1d585b4)) [0072.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dc40 [0072.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dc40 | out: hHeap=0x260000) returned 1 [0072.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.305] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.305] GetLastError () returned 0x0 [0072.305] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.305] GetLastError () returned 0x0 [0072.307] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.307] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0072.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.308] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.308] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.308] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.308] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.309] CloseHandle (hObject=0x108) returned 1 [0072.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0072.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.310] GetLastError () returned 0x0 [0072.311] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.311] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.311] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0072.311] WriteFile (in: hFile=0x108, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0072.312] CloseHandle (hObject=0x108) returned 1 [0072.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e230 | out: hHeap=0x260000) returned 1 [0072.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de90 | out: hHeap=0x260000) returned 1 [0072.312] RtlWakeConditionVariable () returned 0x27e828 [0072.313] GetCurrentThreadId () returned 0x998 [0072.313] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0072.314] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0072.314] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.314] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19231493248) returned 1 [0072.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9ea30b0, dwHighDateTime=0x1d585b4)) [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dbd0 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dbd0 | out: hHeap=0x260000) returned 1 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.315] GetLastError () returned 0x0 [0072.315] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.315] GetLastError () returned 0x0 [0072.317] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff2fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.317] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0xd04, lpOverlapped=0x0) returned 1 [0072.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.318] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.318] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.318] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.318] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.319] CloseHandle (hObject=0x108) returned 1 [0072.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0072.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css.[deadmin@cock.li].deadmin")) returned 1 [0072.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.320] GetLastError () returned 0x0 [0072.323] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.324] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.324] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19232504315) returned 1 [0072.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9ec9210, dwHighDateTime=0x1d585b4)) [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db98 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db98 | out: hHeap=0x260000) returned 1 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.325] GetLastError () returned 0x0 [0072.325] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.325] GetLastError () returned 0x0 [0072.327] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.327] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x73c, lpOverlapped=0x0) returned 1 [0072.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.328] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.328] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.328] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.328] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.329] CloseHandle (hObject=0x108) returned 1 [0072.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30de90 [0072.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css.[deadmin@cock.li].deadmin")) returned 1 [0072.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de90 | out: hHeap=0x260000) returned 1 [0072.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.330] GetLastError () returned 0x0 [0072.331] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.331] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.331] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.332] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19233276896) returned 1 [0072.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xb9ec9210, dwHighDateTime=0x1d585b4)) [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db60 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db60 | out: hHeap=0x260000) returned 1 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336800 [0072.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336800 | out: hHeap=0x260000) returned 1 [0072.332] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.332] GetLastError () returned 0x0 [0072.333] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.333] GetLastError () returned 0x0 [0072.413] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8d9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.413] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x727, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x1cffdb0*=0x727, lpOverlapped=0x0) returned 1 [0072.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.414] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.414] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.414] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.414] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.415] CloseHandle (hObject=0x108) returned 1 [0072.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0072.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css.[deadmin@cock.li].deadmin")) returned 1 [0072.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0072.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.416] GetLastError () returned 0x0 [0072.590] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311268) returned 1 [0072.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.591] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.591] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19259230649) returned 1 [0072.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba150970, dwHighDateTime=0x1d585b4)) [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d40 [0072.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d40 | out: hHeap=0x260000) returned 1 [0072.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b700 [0072.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.592] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.592] GetLastError () returned 0x0 [0072.592] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.592] GetLastError () returned 0x0 [0072.621] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.621] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.622] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.622] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.636] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.637] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.637] CloseHandle (hObject=0x11c) returned 1 [0072.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.[deadmin@cock.li].deadmin")) returned 1 [0072.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.639] GetLastError () returned 0x0 [0072.639] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311bf8) returned 1 [0072.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.640] CryptReleaseContext (hProv=0x311bf8, dwFlags=0x0) returned 1 [0072.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.640] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19264155224) returned 1 [0072.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba1c2d90, dwHighDateTime=0x1d585b4)) [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d538 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d538 | out: hHeap=0x260000) returned 1 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b078 [0072.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.641] GetLastError () returned 0x0 [0072.641] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.641] GetLastError () returned 0x0 [0072.672] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.672] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.673] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.674] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.674] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.675] CloseHandle (hObject=0x11c) returned 1 [0072.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.676] GetLastError () returned 0x0 [0072.683] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311bf8) returned 1 [0072.683] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.683] CryptReleaseContext (hProv=0x311bf8, dwFlags=0x0) returned 1 [0072.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.684] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19268470349) returned 1 [0072.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba2351b0, dwHighDateTime=0x1d585b4)) [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d1f0 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d1f0 | out: hHeap=0x260000) returned 1 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b5d0 [0072.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.684] GetLastError () returned 0x0 [0072.685] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.685] GetLastError () returned 0x0 [0072.695] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff6680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.695] WriteFile (in: hFile=0x104, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x9980, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x9980, lpOverlapped=0x0) returned 1 [0072.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0072.696] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.696] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.697] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.697] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.697] CloseHandle (hObject=0x104) returned 1 [0072.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.[deadmin@cock.li].deadmin")) returned 1 [0072.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.699] GetLastError () returned 0x0 [0072.700] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0072.701] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.701] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.701] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19270204784) returned 1 [0072.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba25b310, dwHighDateTime=0x1d585b4)) [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d180 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d180 | out: hHeap=0x260000) returned 1 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bc58 [0072.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.702] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.702] GetLastError () returned 0x0 [0072.702] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.702] GetLastError () returned 0x0 [0072.783] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.783] WriteFile (in: hFile=0x104, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0072.784] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.785] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.785] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.785] CloseHandle (hObject=0x104) returned 1 [0072.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0072.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.787] GetLastError () returned 0x0 [0072.788] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x312478) returned 1 [0072.788] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.788] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.788] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19278961593) returned 1 [0072.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba3199f0, dwHighDateTime=0x1d585b4)) [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e9d0 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e9d0 | out: hHeap=0x260000) returned 1 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b408 [0072.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.789] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.789] GetLastError () returned 0x0 [0072.789] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.790] GetLastError () returned 0x0 [0072.867] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.867] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x290, lpOverlapped=0x0) returned 1 [0072.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0072.868] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.868] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.869] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.869] CloseHandle (hObject=0x104) returned 1 [0072.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.871] GetLastError () returned 0x0 [0072.871] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0072.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.872] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.872] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19287330632) returned 1 [0072.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba3fe230, dwHighDateTime=0x1d585b4)) [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c80 [0072.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c80 | out: hHeap=0x260000) returned 1 [0072.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a958 [0072.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.873] GetLastError () returned 0x0 [0072.873] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.873] GetLastError () returned 0x0 [0072.875] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.875] WriteFile (in: hFile=0x104, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd0, lpOverlapped=0x0) returned 1 [0072.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0072.876] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.876] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.877] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.877] CloseHandle (hObject=0x104) returned 1 [0072.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0072.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.879] GetLastError () returned 0x0 [0072.880] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0072.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.881] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.881] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19288193800) returned 1 [0072.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba3fe230, dwHighDateTime=0x1d585b4)) [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337cb8 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cb8 | out: hHeap=0x260000) returned 1 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277af48 [0072.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.882] GetLastError () returned 0x0 [0072.882] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.882] GetLastError () returned 0x0 [0072.883] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.883] WriteFile (in: hFile=0x104, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x72, lpOverlapped=0x0) returned 1 [0072.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0072.884] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.884] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.884] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.885] CloseHandle (hObject=0x104) returned 1 [0072.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.885] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.887] GetLastError () returned 0x0 [0072.887] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0072.888] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.888] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.888] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19288929562) returned 1 [0072.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba424390, dwHighDateTime=0x1d585b4)) [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337cf0 [0072.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cf0 | out: hHeap=0x260000) returned 1 [0072.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277aeb0 [0072.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.889] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.889] GetLastError () returned 0x0 [0072.889] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.889] GetLastError () returned 0x0 [0072.890] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.890] WriteFile (in: hFile=0x104, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0072.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0072.891] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.891] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.892] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.892] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.892] CloseHandle (hObject=0x104) returned 1 [0072.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.894] GetLastError () returned 0x0 [0072.894] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x295d148) returned 1 [0072.895] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.895] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0072.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.895] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19289641959) returned 1 [0072.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba424390, dwHighDateTime=0x1d585b4)) [0072.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337d28 [0072.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d28 | out: hHeap=0x260000) returned 1 [0072.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ba90 [0072.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.896] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0072.896] GetLastError () returned 0x0 [0072.896] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0072.896] GetLastError () returned 0x0 [0073.003] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.003] WriteFile (in: hFile=0x104, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0073.004] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.005] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.020] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.020] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.020] CloseHandle (hObject=0x104) returned 1 [0073.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0073.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0073.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.022] GetLastError () returned 0x0 [0073.023] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3118c8) returned 1 [0073.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.024] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.024] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19302541130) returned 1 [0073.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba57aff0, dwHighDateTime=0x1d585b4)) [0073.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0d88 [0073.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0d88 | out: hHeap=0x260000) returned 1 [0073.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a408 [0073.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.025] GetLastError () returned 0x0 [0073.025] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.025] GetLastError () returned 0x0 [0073.068] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd108, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.068] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x2ef8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ef8, lpOverlapped=0x0) returned 1 [0073.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.068] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.069] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.069] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.070] CloseHandle (hObject=0x104) returned 1 [0073.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0073.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.[deadmin@cock.li].deadmin")) returned 1 [0073.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0073.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.072] GetLastError () returned 0x0 [0073.073] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3116a8) returned 1 [0073.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.074] CryptReleaseContext (hProv=0x3116a8, dwFlags=0x0) returned 1 [0073.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.074] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19307507273) returned 1 [0073.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba5ed410, dwHighDateTime=0x1d585b4)) [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299210 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299210 | out: hHeap=0x260000) returned 1 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.075] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.075] GetLastError () returned 0x0 [0073.075] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.075] GetLastError () returned 0x0 [0073.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffea2a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.077] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x15d58, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x15d58, lpOverlapped=0x0) returned 1 [0073.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.078] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.078] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.079] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.079] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.079] CloseHandle (hObject=0x104) returned 1 [0073.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.081] GetLastError () returned 0x0 [0073.082] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311620) returned 1 [0073.082] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.082] CryptReleaseContext (hProv=0x311620, dwFlags=0x0) returned 1 [0073.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.083] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19308368051) returned 1 [0073.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba5ed410, dwHighDateTime=0x1d585b4)) [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299248 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299248 | out: hHeap=0x260000) returned 1 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.083] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.083] GetLastError () returned 0x0 [0073.083] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.084] GetLastError () returned 0x0 [0073.086] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.086] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.087] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.093] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.093] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.093] CloseHandle (hObject=0x104) returned 1 [0073.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.095] GetLastError () returned 0x0 [0073.095] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0073.096] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.096] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0073.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.096] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19309758532) returned 1 [0073.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba613570, dwHighDateTime=0x1d585b4)) [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299280 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299280 | out: hHeap=0x260000) returned 1 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a4a0 [0073.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.097] GetLastError () returned 0x0 [0073.097] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.098] GetLastError () returned 0x0 [0073.099] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.102] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x272, lpOverlapped=0x0) returned 1 [0073.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.103] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.103] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.104] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.104] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.104] CloseHandle (hObject=0x104) returned 1 [0073.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0073.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.106] GetLastError () returned 0x0 [0073.107] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0073.107] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.107] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0073.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.108] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19310864880) returned 1 [0073.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba6396d0, dwHighDateTime=0x1d585b4)) [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992b8 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992b8 | out: hHeap=0x260000) returned 1 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a2d8 [0073.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.108] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.108] GetLastError () returned 0x0 [0073.108] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.109] GetLastError () returned 0x0 [0073.109] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.109] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xce, lpOverlapped=0x0) returned 1 [0073.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.110] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.110] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.111] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.111] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.111] CloseHandle (hObject=0x104) returned 1 [0073.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.113] GetLastError () returned 0x0 [0073.114] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311510) returned 1 [0073.114] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.114] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0073.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.115] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19311573205) returned 1 [0073.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba6396d0, dwHighDateTime=0x1d585b4)) [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992f0 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992f0 | out: hHeap=0x260000) returned 1 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a240 [0073.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.115] GetLastError () returned 0x0 [0073.116] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.116] GetLastError () returned 0x0 [0073.116] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.117] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x72, lpOverlapped=0x0) returned 1 [0073.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.149] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.149] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.149] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.150] CloseHandle (hObject=0x104) returned 1 [0073.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.341] GetLastError () returned 0x0 [0073.342] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311378) returned 1 [0073.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.342] CryptReleaseContext (hProv=0x311378, dwFlags=0x0) returned 1 [0073.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.343] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19334379628) returned 1 [0073.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba874b70, dwHighDateTime=0x1d585b4)) [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efee8 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efee8 | out: hHeap=0x260000) returned 1 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.344] GetLastError () returned 0x0 [0073.344] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.344] GetLastError () returned 0x0 [0073.345] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffffd9d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.345] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x263, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x263, lpOverlapped=0x0) returned 1 [0073.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.346] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.346] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.347] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.348] CloseHandle (hObject=0xec) returned 1 [0073.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0073.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.350] GetLastError () returned 0x0 [0073.350] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311158) returned 1 [0073.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.351] CryptReleaseContext (hProv=0x311158, dwFlags=0x0) returned 1 [0073.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.351] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19335261668) returned 1 [0073.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba89acd0, dwHighDateTime=0x1d585b4)) [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efeb0 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efeb0 | out: hHeap=0x260000) returned 1 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.352] GetLastError () returned 0x0 [0073.352] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.353] GetLastError () returned 0x0 [0073.353] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.353] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xcb, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0xcb, lpOverlapped=0x0) returned 1 [0073.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.354] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.354] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.355] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.355] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.356] CloseHandle (hObject=0xec) returned 1 [0073.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.420] GetLastError () returned 0x0 [0073.420] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0073.422] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.422] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.422] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19342316958) returned 1 [0073.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba933250, dwHighDateTime=0x1d585b4)) [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19f8 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0073.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751f40 [0073.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.423] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.423] GetLastError () returned 0x0 [0073.423] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.423] GetLastError () returned 0x0 [0073.466] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffff2078, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.466] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xdf88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xdf88, lpOverlapped=0x0) returned 1 [0073.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.469] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.469] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.470] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.470] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.471] CloseHandle (hObject=0xec) returned 1 [0073.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.[deadmin@cock.li].deadmin")) returned 1 [0073.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.472] GetLastError () returned 0x0 [0073.473] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310c90) returned 1 [0073.475] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.475] CryptReleaseContext (hProv=0x310c90, dwFlags=0x0) returned 1 [0073.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.476] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19347676291) returned 1 [0073.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xba9a5670, dwHighDateTime=0x1d585b4)) [0073.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1988 [0073.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1988 | out: hHeap=0x260000) returned 1 [0073.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.571] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.572] GetLastError () returned 0x0 [0073.572] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.572] GetLastError () returned 0x0 [0073.603] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffda18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.603] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x25e8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x25e8, lpOverlapped=0x0) returned 1 [0073.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.604] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.604] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.604] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.605] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.605] CloseHandle (hObject=0xec) returned 1 [0073.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.605] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.607] GetLastError () returned 0x0 [0073.607] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310af8) returned 1 [0073.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.608] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0073.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.608] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19360931476) returned 1 [0073.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbaafc2d0, dwHighDateTime=0x1d585b4)) [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d860 [0073.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d860 | out: hHeap=0x260000) returned 1 [0073.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.609] GetLastError () returned 0x0 [0073.609] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.609] GetLastError () returned 0x0 [0073.621] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffefa50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.622] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x105b0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x105b0, lpOverlapped=0x0) returned 1 [0073.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.623] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.623] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.624] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.624] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.624] CloseHandle (hObject=0xec) returned 1 [0073.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.[deadmin@cock.li].deadmin")) returned 1 [0073.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.653] GetLastError () returned 0x0 [0073.654] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x310e28) returned 1 [0073.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.655] CryptReleaseContext (hProv=0x310e28, dwFlags=0x0) returned 1 [0073.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.655] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19365592379) returned 1 [0073.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbab6e6f0, dwHighDateTime=0x1d585b4)) [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d438 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d438 | out: hHeap=0x260000) returned 1 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27589e0 [0073.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.655] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.656] GetLastError () returned 0x0 [0073.656] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.656] GetLastError () returned 0x0 [0073.669] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.670] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.670] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.670] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.674] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.675] CloseHandle (hObject=0xec) returned 1 [0073.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c498 [0073.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c498 | out: hHeap=0x260000) returned 1 [0073.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.677] GetLastError () returned 0x0 [0073.677] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0073.678] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.678] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.678] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19367920476) returned 1 [0073.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbab94850, dwHighDateTime=0x1d585b4)) [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d2e8 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d2e8 | out: hHeap=0x260000) returned 1 [0073.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0073.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.679] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.679] GetLastError () returned 0x0 [0073.679] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.679] GetLastError () returned 0x0 [0073.693] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.693] WriteFile (in: hFile=0xec, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.694] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.694] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.817] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.818] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.819] CloseHandle (hObject=0xec) returned 1 [0073.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.820] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0073.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.823] GetLastError () returned 0x0 [0073.823] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0073.825] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.825] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.825] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19382603662) returned 1 [0073.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbad11610, dwHighDateTime=0x1d585b4)) [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4a8 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4a8 | out: hHeap=0x260000) returned 1 [0073.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x28162f8 [0073.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28162f8 | out: hHeap=0x260000) returned 1 [0073.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27582c0 [0073.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.826] GetLastError () returned 0x0 [0073.826] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.827] GetLastError () returned 0x0 [0073.828] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.828] WriteFile (in: hFile=0xec, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0073.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.829] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.829] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.830] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.831] CloseHandle (hObject=0xec) returned 1 [0073.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0073.834] GetLastError () returned 0x0 [0073.834] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756280) returned 1 [0073.855] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.855] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0073.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0073.856] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19385686822) returned 1 [0073.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbad5d8d0, dwHighDateTime=0x1d585b4)) [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d140 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d140 | out: hHeap=0x260000) returned 1 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x28162f8 [0073.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28162f8 | out: hHeap=0x260000) returned 1 [0073.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758520 [0073.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0073.857] GetLastError () returned 0x0 [0073.857] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0073.857] GetLastError () returned 0x0 [0073.859] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffffdd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.859] WriteFile (in: hFile=0xec, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x227, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x227, lpOverlapped=0x0) returned 1 [0073.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.861] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.861] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.863] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.863] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.864] CloseHandle (hObject=0xec) returned 1 [0073.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.[deadmin@cock.li].deadmin")) returned 1 [0074.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.006] GetLastError () returned 0x0 [0074.085] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756308) returned 1 [0074.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.086] CryptReleaseContext (hProv=0x2756308, dwFlags=0x0) returned 1 [0074.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.086] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19408693464) returned 1 [0074.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbaf98d70, dwHighDateTime=0x1d585b4)) [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7f0 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7f0 | out: hHeap=0x260000) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0074.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.087] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.087] GetLastError () returned 0x0 [0074.087] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.087] GetLastError () returned 0x0 [0074.089] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.089] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.090] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.090] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.092] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.092] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.092] CloseHandle (hObject=0xec) returned 1 [0074.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.092] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.[deadmin@cock.li].deadmin")) returned 1 [0074.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.094] GetLastError () returned 0x0 [0074.094] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0074.095] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.095] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0074.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.095] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19409655231) returned 1 [0074.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbaf98d70, dwHighDateTime=0x1d585b4)) [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d828 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d828 | out: hHeap=0x260000) returned 1 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325e88 [0074.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.096] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.096] GetLastError () returned 0x0 [0074.096] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.097] GetLastError () returned 0x0 [0074.099] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.099] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.100] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.100] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.102] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.102] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.103] CloseHandle (hObject=0xec) returned 1 [0074.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0074.103] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.[deadmin@cock.li].deadmin")) returned 1 [0074.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0074.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.105] GetLastError () returned 0x0 [0074.105] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0074.106] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.106] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0074.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.106] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19410745994) returned 1 [0074.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbafbeed0, dwHighDateTime=0x1d585b4)) [0074.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d898 [0074.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d898 | out: hHeap=0x260000) returned 1 [0074.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326770 [0074.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.107] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.107] GetLastError () returned 0x0 [0074.107] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.107] GetLastError () returned 0x0 [0074.109] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffffd84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.109] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x27c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x27c, lpOverlapped=0x0) returned 1 [0074.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.110] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.110] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.110] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.110] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.111] CloseHandle (hObject=0xec) returned 1 [0074.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0074.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0074.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0074.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.113] GetLastError () returned 0x0 [0074.113] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0074.114] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.114] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0074.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.114] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19411524878) returned 1 [0074.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbafbeed0, dwHighDateTime=0x1d585b4)) [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a10d0 [0074.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a10d0 | out: hHeap=0x260000) returned 1 [0074.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3266d8 [0074.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.115] GetLastError () returned 0x0 [0074.115] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.115] GetLastError () returned 0x0 [0074.116] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.116] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd0, lpOverlapped=0x0) returned 1 [0074.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.117] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.117] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.118] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.118] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.118] CloseHandle (hObject=0xec) returned 1 [0074.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0074.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0074.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0074.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.120] GetLastError () returned 0x0 [0074.121] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0074.121] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.121] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0074.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.122] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19412277884) returned 1 [0074.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbafe5030, dwHighDateTime=0x1d585b4)) [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1098 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1098 | out: hHeap=0x260000) returned 1 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325800 [0074.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.122] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.123] GetLastError () returned 0x0 [0074.123] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.123] GetLastError () returned 0x0 [0074.124] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.124] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x72, lpOverlapped=0x0) returned 1 [0074.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.124] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.124] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.125] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.125] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.126] CloseHandle (hObject=0xec) returned 1 [0074.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0074.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.128] GetLastError () returned 0x0 [0074.128] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x3110d0) returned 1 [0074.129] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.129] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0074.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.129] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19413028427) returned 1 [0074.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbafe5030, dwHighDateTime=0x1d585b4)) [0074.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0074.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0074.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3265a8 [0074.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.130] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.130] GetLastError () returned 0x0 [0074.130] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.130] GetLastError () returned 0x0 [0074.131] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.232] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0074.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.249] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.249] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.250] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.251] CloseHandle (hObject=0xec) returned 1 [0074.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0074.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.253] GetLastError () returned 0x0 [0074.253] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27561f8) returned 1 [0074.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.254] CryptReleaseContext (hProv=0x27561f8, dwFlags=0x0) returned 1 [0074.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.254] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19425544926) returned 1 [0074.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb115b30, dwHighDateTime=0x1d585b4)) [0074.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11b0 [0074.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11b0 | out: hHeap=0x260000) returned 1 [0074.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0074.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.255] GetLastError () returned 0x0 [0074.255] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.255] GetLastError () returned 0x0 [0074.259] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffa400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.259] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5c00, lpOverlapped=0x0) returned 1 [0074.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.261] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.261] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.263] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.263] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.264] CloseHandle (hObject=0xec) returned 1 [0074.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.[deadmin@cock.li].deadmin")) returned 1 [0074.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.265] GetLastError () returned 0x0 [0074.266] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27566c0) returned 1 [0074.267] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.267] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.267] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19426861973) returned 1 [0074.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb13bc90, dwHighDateTime=0x1d585b4)) [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1418 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326510 [0074.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.268] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.268] GetLastError () returned 0x0 [0074.268] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.269] GetLastError () returned 0x0 [0074.271] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffb200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.271] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x4e00, lpOverlapped=0x0) returned 1 [0074.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.271] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.272] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.272] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.272] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.273] CloseHandle (hObject=0xec) returned 1 [0074.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.[deadmin@cock.li].deadmin")) returned 1 [0074.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.277] GetLastError () returned 0x0 [0074.277] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27566c0) returned 1 [0074.278] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.278] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.278] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19427928634) returned 1 [0074.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb161df0, dwHighDateTime=0x1d585b4)) [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1300 [0074.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1300 | out: hHeap=0x260000) returned 1 [0074.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326348 [0074.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.279] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.279] GetLastError () returned 0x0 [0074.279] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.279] GetLastError () returned 0x0 [0074.281] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffd000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.281] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3000, lpOverlapped=0x0) returned 1 [0074.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.282] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.282] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.283] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.284] CloseHandle (hObject=0xec) returned 1 [0074.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.[deadmin@cock.li].deadmin")) returned 1 [0074.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.285] GetLastError () returned 0x0 [0074.286] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27566c0) returned 1 [0074.287] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.287] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.287] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19428796341) returned 1 [0074.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb161df0, dwHighDateTime=0x1d585b4)) [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14f8 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0074.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3262b0 [0074.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.288] GetLastError () returned 0x0 [0074.288] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.288] GetLastError () returned 0x0 [0074.382] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffde00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.382] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2200, lpOverlapped=0x0) returned 1 [0074.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.385] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.385] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.385] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.386] CloseHandle (hObject=0xec) returned 1 [0074.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.[deadmin@cock.li].deadmin")) returned 1 [0074.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.388] GetLastError () returned 0x0 [0074.388] RtlWakeConditionVariable () returned 0x27e828 [0074.388] GetCurrentThreadId () returned 0x998 [0074.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".ldf") returned 0x0 [0074.388] lstrlenW (lpString=".vhd") returned 4 [0074.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".vhd") returned 0x0 [0074.388] lstrlenW (lpString=".vhdx") returned 5 [0074.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".vhdx") returned 0x0 [0074.388] lstrlenW (lpString=".pst") returned 4 [0074.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".pst") returned 0x0 [0074.388] lstrlenW (lpString=".ost") returned 4 [0074.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".ost") returned 0x0 [0074.388] lstrlenW (lpString=".bak") returned 4 [0074.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".bak") returned 0x0 [0074.388] lstrlenW (lpString=".bac") returned 4 [0074.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".bac") returned 0x0 [0074.389] lstrlenW (lpString=".sys") returned 4 [0074.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".sys") returned 0x0 [0074.389] lstrlenW (lpString=".v2i") returned 4 [0074.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".v2i") returned 0x0 [0074.389] lstrlenW (lpString="s\r\n.v2i") returned 7 [0074.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0074.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0074.390] lstrlenW (lpString=".sql") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".sql") returned 0x0 [0074.390] lstrlenW (lpString=".mdf") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".mdf") returned 0x0 [0074.390] lstrlenW (lpString=".txt") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".txt") returned 0x0 [0074.390] lstrlenW (lpString=".dbf") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".dbf") returned 0x0 [0074.390] lstrlenW (lpString=".ckp") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".ckp") returned 0x0 [0074.390] lstrlenW (lpString=".dacpac") returned 7 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".dacpac") returned 0x0 [0074.390] lstrlenW (lpString=".db3") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".db3") returned 0x0 [0074.390] lstrlenW (lpString=".dtxs") returned 5 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".dtxs") returned 0x0 [0074.390] lstrlenW (lpString=".mdt") returned 4 [0074.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".mdt") returned 0x0 [0074.390] lstrlenW (lpString=".sdf") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".sdf") returned 0x0 [0074.391] lstrlenW (lpString=".MDF") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".MDF") returned 0x0 [0074.391] lstrlenW (lpString=".DBF") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".DBF") returned 0x0 [0074.391] lstrlenW (lpString=".DB") returned 3 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".DB") returned 0x0 [0074.391] lstrlenW (lpString=".db") returned 3 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".db") returned 0x0 [0074.391] lstrlenW (lpString=".ndf") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".ndf") returned 0x0 [0074.391] lstrlenW (lpString=".NDF") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".NDF") returned 0x0 [0074.391] lstrlenW (lpString=".Mdf") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".Mdf") returned 0x0 [0074.391] lstrlenW (lpString=".dat") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".dat") returned 0x0 [0074.391] lstrlenW (lpString=".DAT") returned 4 [0074.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", lpSrch=".DAT") returned=".DAT" [0074.391] lstrlenW (lpString=".DAT") returned 4 [0074.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a308 [0074.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0074.391] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756528) returned 1 [0074.392] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.392] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.392] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19439361315) returned 1 [0074.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb26c790, dwHighDateTime=0x1d585b4)) [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d1b0 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1b0 | out: hHeap=0x260000) returned 1 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0074.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.393] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.393] GetLastError () returned 0x0 [0074.394] GetLastError () returned 0x0 [0074.394] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.394] GetLastError () returned 0x0 [0074.394] GetLastError () returned 0x0 [0074.399] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffff329c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.399] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xcd64, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xcd64, lpOverlapped=0x0) returned 1 [0074.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0074.399] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.399] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.399] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.399] CloseHandle (hObject=0xec) returned 1 [0074.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.[deadmin@cock.li].deadmin")) returned 1 [0074.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.401] GetLastError () returned 0x0 [0074.401] RtlWakeConditionVariable () returned 0x27e828 [0074.401] GetCurrentThreadId () returned 0x998 [0074.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".ldf") returned 0x0 [0074.401] lstrlenW (lpString=".vhd") returned 4 [0074.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".vhd") returned 0x0 [0074.401] lstrlenW (lpString=".vhdx") returned 5 [0074.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".vhdx") returned 0x0 [0074.401] lstrlenW (lpString=".pst") returned 4 [0074.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".pst") returned 0x0 [0074.401] lstrlenW (lpString=".ost") returned 4 [0074.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".ost") returned 0x0 [0074.401] lstrlenW (lpString=".bak") returned 4 [0074.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".bak") returned 0x0 [0074.401] lstrlenW (lpString=".bac") returned 4 [0074.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".bac") returned 0x0 [0074.402] lstrlenW (lpString=".sys") returned 4 [0074.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".sys") returned 0x0 [0074.402] lstrlenW (lpString=".v2i") returned 4 [0074.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".v2i") returned 0x0 [0074.402] lstrlenW (lpString="s\r\n.v2i") returned 7 [0074.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0074.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0074.403] lstrlenW (lpString=".sql") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".sql") returned 0x0 [0074.403] lstrlenW (lpString=".mdf") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".mdf") returned 0x0 [0074.403] lstrlenW (lpString=".txt") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".txt") returned 0x0 [0074.403] lstrlenW (lpString=".dbf") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".dbf") returned 0x0 [0074.403] lstrlenW (lpString=".ckp") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".ckp") returned 0x0 [0074.403] lstrlenW (lpString=".dacpac") returned 7 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".dacpac") returned 0x0 [0074.403] lstrlenW (lpString=".db3") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".db3") returned 0x0 [0074.403] lstrlenW (lpString=".dtxs") returned 5 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".dtxs") returned 0x0 [0074.403] lstrlenW (lpString=".mdt") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".mdt") returned 0x0 [0074.403] lstrlenW (lpString=".sdf") returned 4 [0074.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".sdf") returned 0x0 [0074.403] lstrlenW (lpString=".MDF") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".MDF") returned 0x0 [0074.404] lstrlenW (lpString=".DBF") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".DBF") returned 0x0 [0074.404] lstrlenW (lpString=".DB") returned 3 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".DB") returned 0x0 [0074.404] lstrlenW (lpString=".db") returned 3 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".db") returned 0x0 [0074.404] lstrlenW (lpString=".ndf") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".ndf") returned 0x0 [0074.404] lstrlenW (lpString=".NDF") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".NDF") returned 0x0 [0074.404] lstrlenW (lpString=".Mdf") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".Mdf") returned 0x0 [0074.404] lstrlenW (lpString=".dat") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".dat") returned 0x0 [0074.404] lstrlenW (lpString=".DAT") returned 4 [0074.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", lpSrch=".DAT") returned=".DAT" [0074.404] lstrlenW (lpString=".DAT") returned 4 [0074.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a308 [0074.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0074.404] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756528) returned 1 [0074.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.405] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.405] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19440701858) returned 1 [0074.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb2928f0, dwHighDateTime=0x1d585b4)) [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d1e8 [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1e8 | out: hHeap=0x260000) returned 1 [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a190 [0074.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.407] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.407] GetLastError () returned 0x0 [0074.407] GetLastError () returned 0x0 [0074.407] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.407] GetLastError () returned 0x0 [0074.407] GetLastError () returned 0x0 [0074.409] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffff2e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.409] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xd18, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd18, lpOverlapped=0x0) returned 1 [0074.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0074.409] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.409] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.409] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.409] CloseHandle (hObject=0xec) returned 1 [0074.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.[deadmin@cock.li].deadmin")) returned 1 [0074.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0074.411] GetLastError () returned 0x0 [0074.411] RtlWakeConditionVariable () returned 0x27e828 [0074.411] GetCurrentThreadId () returned 0x998 [0074.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".ldf") returned 0x0 [0074.411] lstrlenW (lpString=".vhd") returned 4 [0074.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".vhd") returned 0x0 [0074.411] lstrlenW (lpString=".vhdx") returned 5 [0074.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".vhdx") returned 0x0 [0074.411] lstrlenW (lpString=".pst") returned 4 [0074.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".pst") returned 0x0 [0074.411] lstrlenW (lpString=".ost") returned 4 [0074.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".ost") returned 0x0 [0074.411] lstrlenW (lpString=".bak") returned 4 [0074.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".bak") returned 0x0 [0074.412] lstrlenW (lpString=".bac") returned 4 [0074.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".bac") returned 0x0 [0074.412] lstrlenW (lpString=".sys") returned 4 [0074.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".sys") returned 0x0 [0074.412] lstrlenW (lpString=".v2i") returned 4 [0074.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".v2i") returned 0x0 [0074.412] lstrlenW (lpString="s\r\n.v2i") returned 7 [0074.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0074.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0074.413] lstrlenW (lpString=".sql") returned 4 [0074.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".sql") returned 0x0 [0074.413] lstrlenW (lpString=".mdf") returned 4 [0074.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".mdf") returned 0x0 [0074.413] lstrlenW (lpString=".txt") returned 4 [0074.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".txt") returned 0x0 [0074.413] lstrlenW (lpString=".dbf") returned 4 [0074.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".dbf") returned 0x0 [0074.413] lstrlenW (lpString=".ckp") returned 4 [0074.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".ckp") returned 0x0 [0074.413] lstrlenW (lpString=".dacpac") returned 7 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".dacpac") returned 0x0 [0074.414] lstrlenW (lpString=".db3") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".db3") returned 0x0 [0074.414] lstrlenW (lpString=".dtxs") returned 5 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".dtxs") returned 0x0 [0074.414] lstrlenW (lpString=".mdt") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".mdt") returned 0x0 [0074.414] lstrlenW (lpString=".sdf") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".sdf") returned 0x0 [0074.414] lstrlenW (lpString=".MDF") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".MDF") returned 0x0 [0074.414] lstrlenW (lpString=".DBF") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".DBF") returned 0x0 [0074.414] lstrlenW (lpString=".DB") returned 3 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".DB") returned 0x0 [0074.414] lstrlenW (lpString=".db") returned 3 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".db") returned 0x0 [0074.414] lstrlenW (lpString=".ndf") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".ndf") returned 0x0 [0074.414] lstrlenW (lpString=".NDF") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".NDF") returned 0x0 [0074.414] lstrlenW (lpString=".Mdf") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".Mdf") returned 0x0 [0074.414] lstrlenW (lpString=".dat") returned 4 [0074.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".dat") returned 0x0 [0074.415] lstrlenW (lpString=".DAT") returned 4 [0074.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", lpSrch=".DAT") returned=".DAT" [0074.415] lstrlenW (lpString=".DAT") returned 4 [0074.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a308 [0074.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0074.415] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756528) returned 1 [0074.416] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.416] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0074.416] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19441693563) returned 1 [0074.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbb2b8a50, dwHighDateTime=0x1d585b4)) [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d108 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d108 | out: hHeap=0x260000) returned 1 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326218 [0074.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.417] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0074.417] GetLastError () returned 0x0 [0074.417] GetLastError () returned 0x0 [0074.417] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0074.417] GetLastError () returned 0x0 [0074.417] GetLastError () returned 0x0 [0074.482] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.482] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.483] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.484] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.484] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.486] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.489] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.489] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.489] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.492] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.492] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.492] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.493] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.493] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.493] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.496] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.496] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.496] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.497] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.497] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.497] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.500] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.500] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.500] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.501] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.501] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.501] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.502] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.502] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.502] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.513] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.513] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.514] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.515] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.515] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.515] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.516] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.516] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.516] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.517] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.517] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.518] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.518] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.518] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.518] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.519] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.521] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.522] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.524] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.524] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.524] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.525] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.525] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.525] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.528] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.528] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.528] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.529] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.529] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.529] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.572] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.572] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.573] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.573] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.574] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.574] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.574] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.574] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.575] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.577] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.578] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.578] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.578] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.578] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.579] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.582] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.582] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.582] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.582] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.583] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.583] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.583] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.583] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.584] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.585] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.585] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.587] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.587] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.587] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.588] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.600] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.600] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.601] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.601] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.601] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.602] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.602] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.602] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.602] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.605] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.605] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.606] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.606] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.606] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.606] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.607] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.607] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.607] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.608] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.610] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.610] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.611] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.611] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.611] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.765] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.765] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.766] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.766] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.766] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.767] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.777] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.777] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.778] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.779] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.779] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.781] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.782] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.782] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.782] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.785] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.785] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.785] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.786] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.786] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.786] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.787] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.787] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.787] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.790] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.790] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.790] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.791] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.791] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.791] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.792] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.794] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.794] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.794] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.795] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.795] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.795] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.795] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.795] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.891] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.891] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.892] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.892] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.892] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.893] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.893] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.893] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.893] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.896] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.896] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.897] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.897] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.897] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.897] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.899] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.900] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.901] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.901] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.901] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.901] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.902] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.902] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.902] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.903] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.903] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.905] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.906] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.906] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.906] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.919] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.919] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.920] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.921] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.921] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.921] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.921] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.922] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.922] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.925] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.925] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.925] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.925] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.926] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.926] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.929] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.929] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.929] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.929] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.930] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.930] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.930] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.930] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.931] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.933] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.933] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.934] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.934] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.934] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.935] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.086] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.086] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.087] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.087] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.088] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.088] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.088] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.088] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.089] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.089] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.089] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.090] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.090] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.090] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.091] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.091] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.091] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.091] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.092] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.092] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.092] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.094] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.095] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.095] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.097] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.098] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.098] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.100] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.100] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.100] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.112] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.112] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.113] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.115] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.115] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.115] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.120] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.120] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.121] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.127] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.127] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.127] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.128] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.128] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.128] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.128] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.128] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.129] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.129] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.129] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.130] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.130] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.130] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.131] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.132] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.133] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.133] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.134] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.134] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.135] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.136] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.136] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.136] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.148] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.148] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.149] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.157] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.157] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.157] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.158] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.158] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.158] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.158] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.159] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.159] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.159] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.159] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.160] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.162] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.162] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.162] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.164] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.164] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.164] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.166] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.166] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.166] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.168] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.168] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.168] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.170] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.170] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.170] ReadFile (in: hFile=0xec, lpBuffer=0x29250a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesRead=0x1cffdb0*=0xda47, lpOverlapped=0x0) returned 1 [0075.373] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffff25b9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.373] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xda47, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x1cffdb0*=0xda47, lpOverlapped=0x0) returned 1 [0075.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0075.377] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.377] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.377] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.377] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.377] CloseHandle (hObject=0xec) returned 1 [0075.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0075.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.[deadmin@cock.li].deadmin")) returned 1 [0075.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0075.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0075.379] GetLastError () returned 0x0 [0075.380] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.381] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.381] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0075.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0075.381] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19538393680) returned 1 [0075.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbbf1f90, dwHighDateTime=0x1d585b4)) [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338230 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338230 | out: hHeap=0x260000) returned 1 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752f78 [0075.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752f78 | out: hHeap=0x260000) returned 1 [0075.384] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.384] GetLastError () returned 0x0 [0075.384] GetLastError () returned 0x0 [0075.384] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.384] GetLastError () returned 0x0 [0075.384] GetLastError () returned 0x0 [0075.388] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.388] WriteFile (in: hFile=0xec, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.390] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.390] WriteFile (in: hFile=0xec, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.391] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.391] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.392] CloseHandle (hObject=0xec) returned 1 [0075.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css.[deadmin@cock.li].deadmin")) returned 1 [0075.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0075.393] GetLastError () returned 0x0 [0075.394] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.441] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.441] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.441] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19544195688) returned 1 [0075.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbc643b0, dwHighDateTime=0x1d585b4)) [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338188 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338188 | out: hHeap=0x260000) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753410 [0075.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753410 | out: hHeap=0x260000) returned 1 [0075.442] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.442] GetLastError () returned 0x0 [0075.442] GetLastError () returned 0x0 [0075.442] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.442] GetLastError () returned 0x0 [0075.443] GetLastError () returned 0x0 [0075.446] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.446] WriteFile (in: hFile=0xec, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.447] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.447] WriteFile (in: hFile=0xec, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.450] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.450] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.452] CloseHandle (hObject=0xec) returned 1 [0075.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css.[deadmin@cock.li].deadmin")) returned 1 [0075.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.625] GetLastError () returned 0x0 [0075.625] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.626] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.626] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.626] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19562757444) returned 1 [0075.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbe2d430, dwHighDateTime=0x1d585b4)) [0075.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f20 [0075.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f20 | out: hHeap=0x260000) returned 1 [0075.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753218 [0075.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753218 | out: hHeap=0x260000) returned 1 [0075.632] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.632] GetLastError () returned 0x0 [0075.632] GetLastError () returned 0x0 [0075.632] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.632] GetLastError () returned 0x0 [0075.632] GetLastError () returned 0x0 [0075.635] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.635] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.636] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.636] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.638] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.638] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.639] CloseHandle (hObject=0x108) returned 1 [0075.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css.[deadmin@cock.li].deadmin")) returned 1 [0075.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.640] GetLastError () returned 0x0 [0075.641] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.641] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.641] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.642] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19564267404) returned 1 [0075.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbe53590, dwHighDateTime=0x1d585b4)) [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f58 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f58 | out: hHeap=0x260000) returned 1 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753560 [0075.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753560 | out: hHeap=0x260000) returned 1 [0075.642] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.642] GetLastError () returned 0x0 [0075.643] GetLastError () returned 0x0 [0075.643] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.643] GetLastError () returned 0x0 [0075.643] GetLastError () returned 0x0 [0075.645] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.645] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.646] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.647] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.647] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.648] CloseHandle (hObject=0x108) returned 1 [0075.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css.[deadmin@cock.li].deadmin")) returned 1 [0075.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.650] GetLastError () returned 0x0 [0075.650] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.651] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.651] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19565254804) returned 1 [0075.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbe796f0, dwHighDateTime=0x1d585b4)) [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337d98 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d98 | out: hHeap=0x260000) returned 1 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753608 [0075.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753608 | out: hHeap=0x260000) returned 1 [0075.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.652] GetLastError () returned 0x0 [0075.652] GetLastError () returned 0x0 [0075.653] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.653] GetLastError () returned 0x0 [0075.653] GetLastError () returned 0x0 [0075.655] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.655] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.656] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.656] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.658] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.658] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.658] CloseHandle (hObject=0x108) returned 1 [0075.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css.[deadmin@cock.li].deadmin")) returned 1 [0075.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.663] GetLastError () returned 0x0 [0075.663] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.664] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.664] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.664] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19566539715) returned 1 [0075.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbe9f850, dwHighDateTime=0x1d585b4)) [0075.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e08 [0075.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e08 | out: hHeap=0x260000) returned 1 [0075.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27536b0 [0075.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27536b0 | out: hHeap=0x260000) returned 1 [0075.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.665] GetLastError () returned 0x0 [0075.665] GetLastError () returned 0x0 [0075.665] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.666] GetLastError () returned 0x0 [0075.666] GetLastError () returned 0x0 [0075.668] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.668] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.669] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.669] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.670] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.670] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.671] CloseHandle (hObject=0x108) returned 1 [0075.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css.[deadmin@cock.li].deadmin")) returned 1 [0075.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.673] GetLastError () returned 0x0 [0075.673] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0075.674] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.674] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19567511602) returned 1 [0075.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbbe9f850, dwHighDateTime=0x1d585b4)) [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299868 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0075.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0075.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753800 [0075.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753800 | out: hHeap=0x260000) returned 1 [0075.675] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.675] GetLastError () returned 0x0 [0075.675] GetLastError () returned 0x0 [0075.675] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.675] GetLastError () returned 0x0 [0075.675] GetLastError () returned 0x0 [0075.751] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.751] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.753] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.753] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.807] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.808] CloseHandle (hObject=0x108) returned 1 [0075.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0075.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css.[deadmin@cock.li].deadmin")) returned 1 [0075.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0075.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.880] GetLastError () returned 0x0 [0075.880] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.881] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.881] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19588260510) returned 1 [0075.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc0b4b90, dwHighDateTime=0x1d585b4)) [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338118 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338118 | out: hHeap=0x260000) returned 1 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0075.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0075.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.882] GetLastError () returned 0x0 [0075.883] GetLastError () returned 0x0 [0075.883] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.883] GetLastError () returned 0x0 [0075.883] GetLastError () returned 0x0 [0075.887] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.888] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.888] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.889] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.889] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.889] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.890] CloseHandle (hObject=0x108) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0075.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css.[deadmin@cock.li].deadmin")) returned 1 [0075.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0075.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.891] GetLastError () returned 0x0 [0075.892] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.893] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.893] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.893] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19589391291) returned 1 [0075.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc0b4b90, dwHighDateTime=0x1d585b4)) [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338150 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338150 | out: hHeap=0x260000) returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8250 [0075.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8250 | out: hHeap=0x260000) returned 1 [0075.893] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.894] GetLastError () returned 0x0 [0075.894] GetLastError () returned 0x0 [0075.894] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.894] GetLastError () returned 0x0 [0075.894] GetLastError () returned 0x0 [0075.897] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.898] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.899] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.899] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.899] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.900] CloseHandle (hObject=0x108) returned 1 [0075.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css.[deadmin@cock.li].deadmin")) returned 1 [0075.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0075.902] GetLastError () returned 0x0 [0075.903] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0075.903] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.903] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.904] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19590475540) returned 1 [0075.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc0dacf0, dwHighDateTime=0x1d585b4)) [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294758 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c82f8 [0075.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c82f8 | out: hHeap=0x260000) returned 1 [0075.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0075.905] GetLastError () returned 0x0 [0075.905] GetLastError () returned 0x0 [0075.905] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0075.905] GetLastError () returned 0x0 [0075.905] GetLastError () returned 0x0 [0075.908] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.908] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.909] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.011] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.011] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.011] CloseHandle (hObject=0x108) returned 1 [0076.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css.[deadmin@cock.li].deadmin")) returned 1 [0076.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.013] GetLastError () returned 0x0 [0076.081] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.082] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.082] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.082] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19608307232) returned 1 [0076.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc2a3d70, dwHighDateTime=0x1d585b4)) [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1838 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8e20 [0076.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8e20 | out: hHeap=0x260000) returned 1 [0076.083] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.083] GetLastError () returned 0x0 [0076.083] GetLastError () returned 0x0 [0076.083] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.083] GetLastError () returned 0x0 [0076.083] GetLastError () returned 0x0 [0076.086] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffebd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.086] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x142f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x142f, lpOverlapped=0x0) returned 1 [0076.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.087] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.087] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.088] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.088] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.089] CloseHandle (hObject=0xd8) returned 1 [0076.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.090] GetLastError () returned 0x0 [0076.091] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.092] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.092] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.092] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19609290717) returned 1 [0076.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc2a3d70, dwHighDateTime=0x1d585b4)) [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1cd0 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8ad8 [0076.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8ad8 | out: hHeap=0x260000) returned 1 [0076.092] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.093] GetLastError () returned 0x0 [0076.093] GetLastError () returned 0x0 [0076.093] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.093] GetLastError () returned 0x0 [0076.093] GetLastError () returned 0x0 [0076.095] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffbe0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.095] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x41f4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x41f4, lpOverlapped=0x0) returned 1 [0076.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.096] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.096] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.096] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.097] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.097] CloseHandle (hObject=0xd8) returned 1 [0076.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.099] GetLastError () returned 0x0 [0076.099] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.100] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.100] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.100] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19610145284) returned 1 [0076.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc2c9ed0, dwHighDateTime=0x1d585b4)) [0076.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0076.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0076.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8f70 [0076.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8f70 | out: hHeap=0x260000) returned 1 [0076.101] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.101] GetLastError () returned 0x0 [0076.101] GetLastError () returned 0x0 [0076.101] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.102] GetLastError () returned 0x0 [0076.102] GetLastError () returned 0x0 [0076.103] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff3b1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.103] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc4f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc4f, lpOverlapped=0x0) returned 1 [0076.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.104] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.104] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.105] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.105] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.106] CloseHandle (hObject=0xd8) returned 1 [0076.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.110] GetLastError () returned 0x0 [0076.111] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.112] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.112] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.112] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19611289405) returned 1 [0076.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc2c9ed0, dwHighDateTime=0x1d585b4)) [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d40 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d40 | out: hHeap=0x260000) returned 1 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753020 [0076.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0076.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753020 | out: hHeap=0x260000) returned 1 [0076.151] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.151] GetLastError () returned 0x0 [0076.151] GetLastError () returned 0x0 [0076.151] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.151] GetLastError () returned 0x0 [0076.151] GetLastError () returned 0x0 [0076.153] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff268, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.153] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd98, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd98, lpOverlapped=0x0) returned 1 [0076.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.154] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.154] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.155] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.155] CloseHandle (hObject=0xd8) returned 1 [0076.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.156] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.161] GetLastError () returned 0x0 [0076.161] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.162] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.162] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19616349693) returned 1 [0076.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc362450, dwHighDateTime=0x1d585b4)) [0076.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1758 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8cd0 [0076.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8cd0 | out: hHeap=0x260000) returned 1 [0076.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.163] GetLastError () returned 0x0 [0076.163] GetLastError () returned 0x0 [0076.164] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.164] GetLastError () returned 0x0 [0076.164] GetLastError () returned 0x0 [0076.165] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe953, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.165] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16ad, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x16ad, lpOverlapped=0x0) returned 1 [0076.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.166] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.166] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.167] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.167] CloseHandle (hObject=0xd8) returned 1 [0076.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.169] GetLastError () returned 0x0 [0076.169] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.170] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.170] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.170] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19617157414) returned 1 [0076.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc362450, dwHighDateTime=0x1d585b4)) [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ced8 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ced8 | out: hHeap=0x260000) returned 1 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9360 [0076.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9360 | out: hHeap=0x260000) returned 1 [0076.171] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.171] GetLastError () returned 0x0 [0076.171] GetLastError () returned 0x0 [0076.172] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.172] GetLastError () returned 0x0 [0076.172] GetLastError () returned 0x0 [0076.173] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffce79, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.173] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3187, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3187, lpOverlapped=0x0) returned 1 [0076.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.174] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.174] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.175] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.175] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.176] CloseHandle (hObject=0xd8) returned 1 [0076.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.177] GetLastError () returned 0x0 [0076.178] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.178] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.178] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19617962539) returned 1 [0076.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc3885b0, dwHighDateTime=0x1d585b4)) [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf10 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9408 [0076.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9408 | out: hHeap=0x260000) returned 1 [0076.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.179] GetLastError () returned 0x0 [0076.180] GetLastError () returned 0x0 [0076.180] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.180] GetLastError () returned 0x0 [0076.180] GetLastError () returned 0x0 [0076.182] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe67b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.182] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1985, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1985, lpOverlapped=0x0) returned 1 [0076.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.183] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.183] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.183] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.183] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.184] CloseHandle (hObject=0xd8) returned 1 [0076.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.186] GetLastError () returned 0x0 [0076.187] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.187] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.187] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.187] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19618863489) returned 1 [0076.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc3885b0, dwHighDateTime=0x1d585b4)) [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf48 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf48 | out: hHeap=0x260000) returned 1 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c94b0 [0076.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c94b0 | out: hHeap=0x260000) returned 1 [0076.188] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.188] GetLastError () returned 0x0 [0076.189] GetLastError () returned 0x0 [0076.189] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.189] GetLastError () returned 0x0 [0076.189] GetLastError () returned 0x0 [0076.226] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe32d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.227] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1cd3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1cd3, lpOverlapped=0x0) returned 1 [0076.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.227] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.227] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.228] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.228] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.229] CloseHandle (hObject=0xd8) returned 1 [0076.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.270] GetLastError () returned 0x0 [0076.270] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.271] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.271] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.271] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19627272450) returned 1 [0076.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc46cdf0, dwHighDateTime=0x1d585b4)) [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca3d8 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca3d8 | out: hHeap=0x260000) returned 1 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9558 [0076.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9558 | out: hHeap=0x260000) returned 1 [0076.272] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.272] GetLastError () returned 0x0 [0076.273] GetLastError () returned 0x0 [0076.273] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.273] GetLastError () returned 0x0 [0076.273] GetLastError () returned 0x0 [0076.275] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffad26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.275] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x52da, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x52da, lpOverlapped=0x0) returned 1 [0076.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.276] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.276] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.277] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.277] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.277] CloseHandle (hObject=0x108) returned 1 [0076.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.279] GetLastError () returned 0x0 [0076.279] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.280] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.280] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.280] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19628159028) returned 1 [0076.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc46cdf0, dwHighDateTime=0x1d585b4)) [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca410 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca410 | out: hHeap=0x260000) returned 1 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9a98 [0076.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9a98 | out: hHeap=0x260000) returned 1 [0076.281] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.281] GetLastError () returned 0x0 [0076.282] GetLastError () returned 0x0 [0076.282] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.282] GetLastError () returned 0x0 [0076.282] GetLastError () returned 0x0 [0076.284] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff0b9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.284] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xf47, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xf47, lpOverlapped=0x0) returned 1 [0076.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.285] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.285] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.285] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.286] CloseHandle (hObject=0x108) returned 1 [0076.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.288] GetLastError () returned 0x0 [0076.289] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.290] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.290] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19629097003) returned 1 [0076.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc492f50, dwHighDateTime=0x1d585b4)) [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca448 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca448 | out: hHeap=0x260000) returned 1 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9b40 [0076.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9b40 | out: hHeap=0x260000) returned 1 [0076.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.291] GetLastError () returned 0x0 [0076.291] GetLastError () returned 0x0 [0076.291] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.291] GetLastError () returned 0x0 [0076.291] GetLastError () returned 0x0 [0076.293] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6ef5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.293] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x910b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x910b, lpOverlapped=0x0) returned 1 [0076.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.294] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.294] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.295] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.295] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.296] CloseHandle (hObject=0x108) returned 1 [0076.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.297] GetLastError () returned 0x0 [0076.298] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756170) returned 1 [0076.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0076.299] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0076.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.299] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19629983784) returned 1 [0076.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc492f50, dwHighDateTime=0x1d585b4)) [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d98 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d98 | out: hHeap=0x260000) returned 1 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9be8 [0076.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9be8 | out: hHeap=0x260000) returned 1 [0076.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.300] GetLastError () returned 0x0 [0076.372] GetLastError () returned 0x0 [0076.372] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.372] GetLastError () returned 0x0 [0076.372] GetLastError () returned 0x0 [0076.374] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe9cf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.374] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1631, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1631, lpOverlapped=0x0) returned 1 [0076.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.375] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.375] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.376] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.376] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.376] CloseHandle (hObject=0x108) returned 1 [0076.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.399] GetLastError () returned 0x0 [0076.408] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.426] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.427] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19642769268) returned 1 [0076.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc5e9bb0, dwHighDateTime=0x1d585b4)) [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca608 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca608 | out: hHeap=0x260000) returned 1 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752258 [0076.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b490 [0076.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752258 | out: hHeap=0x260000) returned 1 [0076.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.427] GetLastError () returned 0x0 [0076.428] GetLastError () returned 0x0 [0076.428] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.428] GetLastError () returned 0x0 [0076.428] GetLastError () returned 0x0 [0076.430] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff47e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.431] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb819, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xb819, lpOverlapped=0x0) returned 1 [0076.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.431] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.432] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.432] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.433] CloseHandle (hObject=0xe4) returned 1 [0076.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.434] GetLastError () returned 0x0 [0076.435] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.436] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.436] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19643692687) returned 1 [0076.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc5e9bb0, dwHighDateTime=0x1d585b4)) [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca640 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca640 | out: hHeap=0x260000) returned 1 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc2f8 [0076.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b490 [0076.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc2f8 | out: hHeap=0x260000) returned 1 [0076.437] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.437] GetLastError () returned 0x0 [0076.437] GetLastError () returned 0x0 [0076.437] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.437] GetLastError () returned 0x0 [0076.437] GetLastError () returned 0x0 [0076.439] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffef0e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.439] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10f19, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x10f19, lpOverlapped=0x0) returned 1 [0076.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.441] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.441] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.441] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.442] CloseHandle (hObject=0xe4) returned 1 [0076.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.444] GetLastError () returned 0x0 [0076.444] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.445] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.445] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19644613610) returned 1 [0076.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc60fd10, dwHighDateTime=0x1d585b4)) [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca678 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca678 | out: hHeap=0x260000) returned 1 [0076.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc448 [0076.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b490 [0076.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc448 | out: hHeap=0x260000) returned 1 [0076.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.446] GetLastError () returned 0x0 [0076.446] GetLastError () returned 0x0 [0076.446] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.446] GetLastError () returned 0x0 [0076.446] GetLastError () returned 0x0 [0076.449] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff82a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.449] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7d5b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x7d5b, lpOverlapped=0x0) returned 1 [0076.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.450] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.450] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.450] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.450] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.451] CloseHandle (hObject=0xe4) returned 1 [0076.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.455] GetLastError () returned 0x0 [0076.590] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.590] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.590] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.591] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19659169387) returned 1 [0076.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc766970, dwHighDateTime=0x1d585b4)) [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca950 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca950 | out: hHeap=0x260000) returned 1 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cccd0 [0076.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cccd0 | out: hHeap=0x260000) returned 1 [0076.591] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.591] GetLastError () returned 0x0 [0076.592] GetLastError () returned 0x0 [0076.592] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.592] GetLastError () returned 0x0 [0076.592] GetLastError () returned 0x0 [0076.597] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff208d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.597] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xdf73, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xdf73, lpOverlapped=0x0) returned 1 [0076.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.664] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.665] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.665] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.666] CloseHandle (hObject=0xe4) returned 1 [0076.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.795] GetLastError () returned 0x0 [0076.796] RtlWakeConditionVariable () returned 0x0 [0076.796] GetCurrentThreadId () returned 0x998 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".ldf") returned 0x0 [0076.796] lstrlenW (lpString=".vhd") returned 4 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".vhd") returned 0x0 [0076.796] lstrlenW (lpString=".vhdx") returned 5 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".vhdx") returned 0x0 [0076.796] lstrlenW (lpString=".pst") returned 4 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".pst") returned 0x0 [0076.796] lstrlenW (lpString=".ost") returned 4 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".ost") returned 0x0 [0076.796] lstrlenW (lpString=".bak") returned 4 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".bak") returned 0x0 [0076.796] lstrlenW (lpString=".bac") returned 4 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".bac") returned 0x0 [0076.796] lstrlenW (lpString=".sys") returned 4 [0076.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".sys") returned 0x0 [0076.796] lstrlenW (lpString=".v2i") returned 4 [0076.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".v2i") returned 0x0 [0076.797] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0076.798] lstrlenW (lpString=".sql") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".sql") returned 0x0 [0076.798] lstrlenW (lpString=".mdf") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".mdf") returned 0x0 [0076.798] lstrlenW (lpString=".txt") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".txt") returned 0x0 [0076.798] lstrlenW (lpString=".dbf") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".dbf") returned 0x0 [0076.798] lstrlenW (lpString=".ckp") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".ckp") returned 0x0 [0076.798] lstrlenW (lpString=".dacpac") returned 7 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".dacpac") returned 0x0 [0076.798] lstrlenW (lpString=".db3") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".db3") returned 0x0 [0076.798] lstrlenW (lpString=".dtxs") returned 5 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".dtxs") returned 0x0 [0076.798] lstrlenW (lpString=".mdt") returned 4 [0076.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".mdt") returned 0x0 [0076.799] lstrlenW (lpString=".sdf") returned 4 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".sdf") returned 0x0 [0076.799] lstrlenW (lpString=".MDF") returned 4 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".MDF") returned 0x0 [0076.799] lstrlenW (lpString=".DBF") returned 4 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".DBF") returned 0x0 [0076.799] lstrlenW (lpString=".DB") returned 3 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".DB") returned 0x0 [0076.799] lstrlenW (lpString=".db") returned 3 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".db") returned 0x0 [0076.799] lstrlenW (lpString=".ndf") returned 4 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".ndf") returned 0x0 [0076.799] lstrlenW (lpString=".NDF") returned 4 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".NDF") returned 0x0 [0076.799] lstrlenW (lpString=".Mdf") returned 4 [0076.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".Mdf") returned 0x0 [0076.800] lstrlenW (lpString=".dat") returned 4 [0076.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".dat") returned 0x0 [0076.800] lstrlenW (lpString=".DAT") returned 4 [0076.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".DAT") returned 0x0 [0076.800] lstrlenW (lpString=".ldf") returned 4 [0076.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".ldf") returned 0x0 [0076.800] lstrlenW (lpString=".LDF") returned 4 [0076.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch=".LDF") returned 0x0 [0076.800] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0076.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.800] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.801] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.801] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.801] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19680220608) returned 1 [0076.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc97bcb0, dwHighDateTime=0x1d585b4)) [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cac28 [0076.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cac28 | out: hHeap=0x260000) returned 1 [0076.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc598 [0076.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b658 [0076.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc598 | out: hHeap=0x260000) returned 1 [0076.802] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.802] GetLastError () returned 0x0 [0076.802] GetLastError () returned 0x0 [0076.802] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.802] GetLastError () returned 0x0 [0076.803] GetLastError () returned 0x0 [0076.806] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffbba3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.806] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x445d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x445d, lpOverlapped=0x0) returned 1 [0076.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.806] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.806] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.806] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.806] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.807] CloseHandle (hObject=0xe4) returned 1 [0076.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.809] GetLastError () returned 0x0 [0076.809] RtlWakeConditionVariable () returned 0x0 [0076.809] GetCurrentThreadId () returned 0x998 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".ldf") returned 0x0 [0076.809] lstrlenW (lpString=".vhd") returned 4 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".vhd") returned 0x0 [0076.809] lstrlenW (lpString=".vhdx") returned 5 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".vhdx") returned 0x0 [0076.809] lstrlenW (lpString=".pst") returned 4 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".pst") returned 0x0 [0076.809] lstrlenW (lpString=".ost") returned 4 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".ost") returned 0x0 [0076.809] lstrlenW (lpString=".bak") returned 4 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".bak") returned 0x0 [0076.809] lstrlenW (lpString=".bac") returned 4 [0076.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".bac") returned 0x0 [0076.809] lstrlenW (lpString=".sys") returned 4 [0076.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".sys") returned 0x0 [0076.810] lstrlenW (lpString=".v2i") returned 4 [0076.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".v2i") returned 0x0 [0076.810] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0076.811] lstrlenW (lpString=".sql") returned 4 [0076.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".sql") returned 0x0 [0076.811] lstrlenW (lpString=".mdf") returned 4 [0076.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".mdf") returned 0x0 [0076.811] lstrlenW (lpString=".txt") returned 4 [0076.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".txt") returned 0x0 [0076.811] lstrlenW (lpString=".dbf") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".dbf") returned 0x0 [0076.812] lstrlenW (lpString=".ckp") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".ckp") returned 0x0 [0076.812] lstrlenW (lpString=".dacpac") returned 7 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".dacpac") returned 0x0 [0076.812] lstrlenW (lpString=".db3") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".db3") returned 0x0 [0076.812] lstrlenW (lpString=".dtxs") returned 5 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".dtxs") returned 0x0 [0076.812] lstrlenW (lpString=".mdt") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".mdt") returned 0x0 [0076.812] lstrlenW (lpString=".sdf") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".sdf") returned 0x0 [0076.812] lstrlenW (lpString=".MDF") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".MDF") returned 0x0 [0076.812] lstrlenW (lpString=".DBF") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".DBF") returned 0x0 [0076.812] lstrlenW (lpString=".DB") returned 3 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".DB") returned 0x0 [0076.812] lstrlenW (lpString=".db") returned 3 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".db") returned 0x0 [0076.812] lstrlenW (lpString=".ndf") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".ndf") returned 0x0 [0076.812] lstrlenW (lpString=".NDF") returned 4 [0076.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".NDF") returned 0x0 [0076.812] lstrlenW (lpString=".Mdf") returned 4 [0076.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".Mdf") returned 0x0 [0076.813] lstrlenW (lpString=".dat") returned 4 [0076.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".dat") returned 0x0 [0076.813] lstrlenW (lpString=".DAT") returned 4 [0076.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".DAT") returned 0x0 [0076.813] lstrlenW (lpString=".ldf") returned 4 [0076.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".ldf") returned 0x0 [0076.813] lstrlenW (lpString=".LDF") returned 4 [0076.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch=".LDF") returned 0x0 [0076.813] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0076.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.813] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.814] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.814] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.814] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19681522578) returned 1 [0076.814] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbc97bcb0, dwHighDateTime=0x1d585b4)) [0076.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cad08 [0076.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cad08 | out: hHeap=0x260000) returned 1 [0076.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd0c0 [0076.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b2c8 [0076.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd0c0 | out: hHeap=0x260000) returned 1 [0076.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.866] GetLastError () returned 0x0 [0076.866] GetLastError () returned 0x0 [0076.866] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.866] GetLastError () returned 0x0 [0076.866] GetLastError () returned 0x0 [0076.870] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffa514, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.870] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5aec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x5aec, lpOverlapped=0x0) returned 1 [0076.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.870] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.870] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.870] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.870] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.870] CloseHandle (hObject=0xe4) returned 1 [0076.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.903] GetLastError () returned 0x0 [0076.903] RtlWakeConditionVariable () returned 0x27e828 [0076.903] GetCurrentThreadId () returned 0x998 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".ldf") returned 0x0 [0076.903] lstrlenW (lpString=".vhd") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".vhd") returned 0x0 [0076.903] lstrlenW (lpString=".vhdx") returned 5 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".vhdx") returned 0x0 [0076.903] lstrlenW (lpString=".pst") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".pst") returned 0x0 [0076.903] lstrlenW (lpString=".ost") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".ost") returned 0x0 [0076.903] lstrlenW (lpString=".bak") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".bak") returned 0x0 [0076.903] lstrlenW (lpString=".bac") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".bac") returned 0x0 [0076.903] lstrlenW (lpString=".sys") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".sys") returned 0x0 [0076.903] lstrlenW (lpString=".v2i") returned 4 [0076.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".v2i") returned 0x0 [0076.903] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0076.904] lstrlenW (lpString=".sql") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".sql") returned 0x0 [0076.905] lstrlenW (lpString=".mdf") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".mdf") returned 0x0 [0076.905] lstrlenW (lpString=".txt") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".txt") returned 0x0 [0076.905] lstrlenW (lpString=".dbf") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".dbf") returned 0x0 [0076.905] lstrlenW (lpString=".ckp") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".ckp") returned 0x0 [0076.905] lstrlenW (lpString=".dacpac") returned 7 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".dacpac") returned 0x0 [0076.905] lstrlenW (lpString=".db3") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".db3") returned 0x0 [0076.905] lstrlenW (lpString=".dtxs") returned 5 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".dtxs") returned 0x0 [0076.905] lstrlenW (lpString=".mdt") returned 4 [0076.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".mdt") returned 0x0 [0076.905] lstrlenW (lpString=".sdf") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".sdf") returned 0x0 [0076.906] lstrlenW (lpString=".MDF") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".MDF") returned 0x0 [0076.906] lstrlenW (lpString=".DBF") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".DBF") returned 0x0 [0076.906] lstrlenW (lpString=".DB") returned 3 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".DB") returned 0x0 [0076.906] lstrlenW (lpString=".db") returned 3 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".db") returned 0x0 [0076.906] lstrlenW (lpString=".ndf") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".ndf") returned 0x0 [0076.906] lstrlenW (lpString=".NDF") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".NDF") returned 0x0 [0076.906] lstrlenW (lpString=".Mdf") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".Mdf") returned 0x0 [0076.906] lstrlenW (lpString=".dat") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".dat") returned 0x0 [0076.906] lstrlenW (lpString=".DAT") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".DAT") returned 0x0 [0076.906] lstrlenW (lpString=".ldf") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".ldf") returned 0x0 [0076.906] lstrlenW (lpString=".LDF") returned 4 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch=".LDF") returned 0x0 [0076.906] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0076.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.907] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.907] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.907] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.908] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19690870109) returned 1 [0076.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbca604f0, dwHighDateTime=0x1d585b4)) [0076.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cadb0 [0076.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cadb0 | out: hHeap=0x260000) returned 1 [0076.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd360 [0076.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0076.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd360 | out: hHeap=0x260000) returned 1 [0076.909] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.909] GetLastError () returned 0x0 [0076.909] GetLastError () returned 0x0 [0076.909] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.909] GetLastError () returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.912] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc318, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.912] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3ce8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3ce8, lpOverlapped=0x0) returned 1 [0076.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.912] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.913] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.913] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.913] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.913] CloseHandle (hObject=0x108) returned 1 [0076.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.913] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.915] GetLastError () returned 0x0 [0076.915] RtlWakeConditionVariable () returned 0x0 [0076.915] GetCurrentThreadId () returned 0x998 [0076.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".ldf") returned 0x0 [0076.915] lstrlenW (lpString=".vhd") returned 4 [0076.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".vhd") returned 0x0 [0076.915] lstrlenW (lpString=".vhdx") returned 5 [0076.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".vhdx") returned 0x0 [0076.915] lstrlenW (lpString=".pst") returned 4 [0076.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".pst") returned 0x0 [0076.915] lstrlenW (lpString=".ost") returned 4 [0076.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".ost") returned 0x0 [0076.916] lstrlenW (lpString=".bak") returned 4 [0076.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".bak") returned 0x0 [0076.916] lstrlenW (lpString=".bac") returned 4 [0076.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".bac") returned 0x0 [0076.916] lstrlenW (lpString=".sys") returned 4 [0076.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".sys") returned 0x0 [0076.916] lstrlenW (lpString=".v2i") returned 4 [0076.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".v2i") returned 0x0 [0076.916] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0076.918] lstrlenW (lpString=".sql") returned 4 [0076.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".sql") returned 0x0 [0076.918] lstrlenW (lpString=".mdf") returned 4 [0076.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".mdf") returned 0x0 [0076.918] lstrlenW (lpString=".txt") returned 4 [0076.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".txt") returned 0x0 [0076.918] lstrlenW (lpString=".dbf") returned 4 [0076.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".dbf") returned 0x0 [0076.919] lstrlenW (lpString=".ckp") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".ckp") returned 0x0 [0076.919] lstrlenW (lpString=".dacpac") returned 7 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".dacpac") returned 0x0 [0076.919] lstrlenW (lpString=".db3") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".db3") returned 0x0 [0076.919] lstrlenW (lpString=".dtxs") returned 5 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".dtxs") returned 0x0 [0076.919] lstrlenW (lpString=".mdt") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".mdt") returned 0x0 [0076.919] lstrlenW (lpString=".sdf") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".sdf") returned 0x0 [0076.919] lstrlenW (lpString=".MDF") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".MDF") returned 0x0 [0076.919] lstrlenW (lpString=".DBF") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".DBF") returned 0x0 [0076.919] lstrlenW (lpString=".DB") returned 3 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".DB") returned 0x0 [0076.919] lstrlenW (lpString=".db") returned 3 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".db") returned 0x0 [0076.919] lstrlenW (lpString=".ndf") returned 4 [0076.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".ndf") returned 0x0 [0076.919] lstrlenW (lpString=".NDF") returned 4 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".NDF") returned 0x0 [0076.920] lstrlenW (lpString=".Mdf") returned 4 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".Mdf") returned 0x0 [0076.920] lstrlenW (lpString=".dat") returned 4 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".dat") returned 0x0 [0076.920] lstrlenW (lpString=".DAT") returned 4 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".DAT") returned 0x0 [0076.920] lstrlenW (lpString=".ldf") returned 4 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".ldf") returned 0x0 [0076.920] lstrlenW (lpString=".LDF") returned 4 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch=".LDF") returned 0x0 [0076.920] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0076.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.920] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.921] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.921] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.921] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19692242683) returned 1 [0076.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbca86650, dwHighDateTime=0x1d585b4)) [0076.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cade8 [0076.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cade8 | out: hHeap=0x260000) returned 1 [0076.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd558 [0076.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0076.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd558 | out: hHeap=0x260000) returned 1 [0076.922] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.922] GetLastError () returned 0x0 [0076.922] GetLastError () returned 0x0 [0076.923] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.923] GetLastError () returned 0x0 [0076.923] GetLastError () returned 0x0 [0076.925] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9ba5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.925] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x645b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x645b, lpOverlapped=0x0) returned 1 [0076.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.925] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.925] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.925] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.925] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.925] CloseHandle (hObject=0x108) returned 1 [0076.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.926] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.930] GetLastError () returned 0x0 [0076.930] RtlWakeConditionVariable () returned 0x0 [0076.930] GetCurrentThreadId () returned 0x998 [0076.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".ldf") returned 0x0 [0076.930] lstrlenW (lpString=".vhd") returned 4 [0076.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".vhd") returned 0x0 [0076.930] lstrlenW (lpString=".vhdx") returned 5 [0076.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".vhdx") returned 0x0 [0076.930] lstrlenW (lpString=".pst") returned 4 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".pst") returned 0x0 [0076.931] lstrlenW (lpString=".ost") returned 4 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".ost") returned 0x0 [0076.931] lstrlenW (lpString=".bak") returned 4 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".bak") returned 0x0 [0076.931] lstrlenW (lpString=".bac") returned 4 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".bac") returned 0x0 [0076.931] lstrlenW (lpString=".sys") returned 4 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".sys") returned 0x0 [0076.931] lstrlenW (lpString=".v2i") returned 4 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".v2i") returned 0x0 [0076.931] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0076.933] lstrlenW (lpString=".sql") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".sql") returned 0x0 [0076.933] lstrlenW (lpString=".mdf") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".mdf") returned 0x0 [0076.933] lstrlenW (lpString=".txt") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".txt") returned 0x0 [0076.933] lstrlenW (lpString=".dbf") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".dbf") returned 0x0 [0076.933] lstrlenW (lpString=".ckp") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".ckp") returned 0x0 [0076.933] lstrlenW (lpString=".dacpac") returned 7 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".dacpac") returned 0x0 [0076.933] lstrlenW (lpString=".db3") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".db3") returned 0x0 [0076.933] lstrlenW (lpString=".dtxs") returned 5 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".dtxs") returned 0x0 [0076.933] lstrlenW (lpString=".mdt") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".mdt") returned 0x0 [0076.933] lstrlenW (lpString=".sdf") returned 4 [0076.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".sdf") returned 0x0 [0076.933] lstrlenW (lpString=".MDF") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".MDF") returned 0x0 [0076.934] lstrlenW (lpString=".DBF") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".DBF") returned 0x0 [0076.934] lstrlenW (lpString=".DB") returned 3 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".DB") returned 0x0 [0076.934] lstrlenW (lpString=".db") returned 3 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".db") returned 0x0 [0076.934] lstrlenW (lpString=".ndf") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".ndf") returned 0x0 [0076.934] lstrlenW (lpString=".NDF") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".NDF") returned 0x0 [0076.934] lstrlenW (lpString=".Mdf") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".Mdf") returned 0x0 [0076.934] lstrlenW (lpString=".dat") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".dat") returned 0x0 [0076.934] lstrlenW (lpString=".DAT") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".DAT") returned 0x0 [0076.934] lstrlenW (lpString=".ldf") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".ldf") returned 0x0 [0076.934] lstrlenW (lpString=".LDF") returned 4 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch=".LDF") returned 0x0 [0076.934] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0076.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.935] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0076.935] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.935] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0076.936] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19693672096) returned 1 [0076.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcaac7b0, dwHighDateTime=0x1d585b4)) [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cae20 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cae20 | out: hHeap=0x260000) returned 1 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd600 [0076.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0076.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd600 | out: hHeap=0x260000) returned 1 [0076.936] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0076.936] GetLastError () returned 0x0 [0076.937] GetLastError () returned 0x0 [0076.937] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0076.937] GetLastError () returned 0x0 [0076.937] GetLastError () returned 0x0 [0076.982] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbad5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.982] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x452b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x452b, lpOverlapped=0x0) returned 1 [0076.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.982] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.983] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.983] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.983] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.983] CloseHandle (hObject=0x108) returned 1 [0077.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0077.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0077.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.038] GetLastError () returned 0x0 [0077.038] RtlWakeConditionVariable () returned 0x0 [0077.038] GetCurrentThreadId () returned 0x998 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".ldf") returned 0x0 [0077.038] lstrlenW (lpString=".vhd") returned 4 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".vhd") returned 0x0 [0077.038] lstrlenW (lpString=".vhdx") returned 5 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".vhdx") returned 0x0 [0077.038] lstrlenW (lpString=".pst") returned 4 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".pst") returned 0x0 [0077.038] lstrlenW (lpString=".ost") returned 4 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".ost") returned 0x0 [0077.038] lstrlenW (lpString=".bak") returned 4 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".bak") returned 0x0 [0077.038] lstrlenW (lpString=".bac") returned 4 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".bac") returned 0x0 [0077.038] lstrlenW (lpString=".sys") returned 4 [0077.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".sys") returned 0x0 [0077.039] lstrlenW (lpString=".v2i") returned 4 [0077.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".v2i") returned 0x0 [0077.039] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.040] lstrlenW (lpString=".sql") returned 4 [0077.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".sql") returned 0x0 [0077.040] lstrlenW (lpString=".mdf") returned 4 [0077.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".mdf") returned 0x0 [0077.040] lstrlenW (lpString=".txt") returned 4 [0077.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".txt") returned 0x0 [0077.040] lstrlenW (lpString=".dbf") returned 4 [0077.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".dbf") returned 0x0 [0077.041] lstrlenW (lpString=".ckp") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".ckp") returned 0x0 [0077.041] lstrlenW (lpString=".dacpac") returned 7 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".dacpac") returned 0x0 [0077.041] lstrlenW (lpString=".db3") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".db3") returned 0x0 [0077.041] lstrlenW (lpString=".dtxs") returned 5 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".dtxs") returned 0x0 [0077.041] lstrlenW (lpString=".mdt") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".mdt") returned 0x0 [0077.041] lstrlenW (lpString=".sdf") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".sdf") returned 0x0 [0077.041] lstrlenW (lpString=".MDF") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".MDF") returned 0x0 [0077.041] lstrlenW (lpString=".DBF") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".DBF") returned 0x0 [0077.041] lstrlenW (lpString=".DB") returned 3 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".DB") returned 0x0 [0077.041] lstrlenW (lpString=".db") returned 3 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".db") returned 0x0 [0077.041] lstrlenW (lpString=".ndf") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".ndf") returned 0x0 [0077.041] lstrlenW (lpString=".NDF") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".NDF") returned 0x0 [0077.041] lstrlenW (lpString=".Mdf") returned 4 [0077.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".Mdf") returned 0x0 [0077.042] lstrlenW (lpString=".dat") returned 4 [0077.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".dat") returned 0x0 [0077.042] lstrlenW (lpString=".DAT") returned 4 [0077.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".DAT") returned 0x0 [0077.042] lstrlenW (lpString=".ldf") returned 4 [0077.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".ldf") returned 0x0 [0077.042] lstrlenW (lpString=".LDF") returned 4 [0077.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch=".LDF") returned 0x0 [0077.042] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.042] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.043] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.043] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.043] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19704415427) returned 1 [0077.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcbb7150, dwHighDateTime=0x1d585b4)) [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cae58 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cae58 | out: hHeap=0x260000) returned 1 [0077.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd6a8 [0077.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0077.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd6a8 | out: hHeap=0x260000) returned 1 [0077.044] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.044] GetLastError () returned 0x0 [0077.044] GetLastError () returned 0x0 [0077.044] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.044] GetLastError () returned 0x0 [0077.044] GetLastError () returned 0x0 [0077.048] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd03f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.048] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2fc1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x2fc1, lpOverlapped=0x0) returned 1 [0077.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.048] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.048] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.048] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.048] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.049] CloseHandle (hObject=0x108) returned 1 [0077.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dfe0 [0077.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dfe0 | out: hHeap=0x260000) returned 1 [0077.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.050] GetLastError () returned 0x0 [0077.050] RtlWakeConditionVariable () returned 0x0 [0077.050] GetCurrentThreadId () returned 0x998 [0077.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".ldf") returned 0x0 [0077.050] lstrlenW (lpString=".vhd") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".vhd") returned 0x0 [0077.051] lstrlenW (lpString=".vhdx") returned 5 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".vhdx") returned 0x0 [0077.051] lstrlenW (lpString=".pst") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".pst") returned 0x0 [0077.051] lstrlenW (lpString=".ost") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".ost") returned 0x0 [0077.051] lstrlenW (lpString=".bak") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".bak") returned 0x0 [0077.051] lstrlenW (lpString=".bac") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".bac") returned 0x0 [0077.051] lstrlenW (lpString=".sys") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".sys") returned 0x0 [0077.051] lstrlenW (lpString=".v2i") returned 4 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".v2i") returned 0x0 [0077.051] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.052] lstrlenW (lpString=".sql") returned 4 [0077.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".sql") returned 0x0 [0077.052] lstrlenW (lpString=".mdf") returned 4 [0077.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".mdf") returned 0x0 [0077.052] lstrlenW (lpString=".txt") returned 4 [0077.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".txt") returned 0x0 [0077.052] lstrlenW (lpString=".dbf") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".dbf") returned 0x0 [0077.053] lstrlenW (lpString=".ckp") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".ckp") returned 0x0 [0077.053] lstrlenW (lpString=".dacpac") returned 7 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".dacpac") returned 0x0 [0077.053] lstrlenW (lpString=".db3") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".db3") returned 0x0 [0077.053] lstrlenW (lpString=".dtxs") returned 5 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".dtxs") returned 0x0 [0077.053] lstrlenW (lpString=".mdt") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".mdt") returned 0x0 [0077.053] lstrlenW (lpString=".sdf") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".sdf") returned 0x0 [0077.053] lstrlenW (lpString=".MDF") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".MDF") returned 0x0 [0077.053] lstrlenW (lpString=".DBF") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".DBF") returned 0x0 [0077.053] lstrlenW (lpString=".DB") returned 3 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".DB") returned 0x0 [0077.053] lstrlenW (lpString=".db") returned 3 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".db") returned 0x0 [0077.053] lstrlenW (lpString=".ndf") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".ndf") returned 0x0 [0077.053] lstrlenW (lpString=".NDF") returned 4 [0077.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".NDF") returned 0x0 [0077.054] lstrlenW (lpString=".Mdf") returned 4 [0077.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".Mdf") returned 0x0 [0077.054] lstrlenW (lpString=".dat") returned 4 [0077.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".dat") returned 0x0 [0077.054] lstrlenW (lpString=".DAT") returned 4 [0077.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".DAT") returned 0x0 [0077.054] lstrlenW (lpString=".ldf") returned 4 [0077.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".ldf") returned 0x0 [0077.054] lstrlenW (lpString=".LDF") returned 4 [0077.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch=".LDF") returned 0x0 [0077.054] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.054] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.055] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.055] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.055] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19705619489) returned 1 [0077.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcbdd2b0, dwHighDateTime=0x1d585b4)) [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cae90 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cae90 | out: hHeap=0x260000) returned 1 [0077.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd750 [0077.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0077.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd750 | out: hHeap=0x260000) returned 1 [0077.056] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.056] GetLastError () returned 0x0 [0077.056] GetLastError () returned 0x0 [0077.056] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.056] GetLastError () returned 0x0 [0077.057] GetLastError () returned 0x0 [0077.058] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffcb31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.058] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x34cf, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x34cf, lpOverlapped=0x0) returned 1 [0077.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.058] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.059] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.059] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.059] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.059] CloseHandle (hObject=0x108) returned 1 [0077.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dfe0 [0077.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dfe0 | out: hHeap=0x260000) returned 1 [0077.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.061] GetLastError () returned 0x0 [0077.061] RtlWakeConditionVariable () returned 0x0 [0077.061] GetCurrentThreadId () returned 0x998 [0077.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".ldf") returned 0x0 [0077.061] lstrlenW (lpString=".vhd") returned 4 [0077.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".vhd") returned 0x0 [0077.061] lstrlenW (lpString=".vhdx") returned 5 [0077.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".vhdx") returned 0x0 [0077.061] lstrlenW (lpString=".pst") returned 4 [0077.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".pst") returned 0x0 [0077.062] lstrlenW (lpString=".ost") returned 4 [0077.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".ost") returned 0x0 [0077.062] lstrlenW (lpString=".bak") returned 4 [0077.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".bak") returned 0x0 [0077.062] lstrlenW (lpString=".bac") returned 4 [0077.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".bac") returned 0x0 [0077.062] lstrlenW (lpString=".sys") returned 4 [0077.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".sys") returned 0x0 [0077.062] lstrlenW (lpString=".v2i") returned 4 [0077.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".v2i") returned 0x0 [0077.062] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.063] lstrlenW (lpString=".sql") returned 4 [0077.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".sql") returned 0x0 [0077.063] lstrlenW (lpString=".mdf") returned 4 [0077.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".mdf") returned 0x0 [0077.064] lstrlenW (lpString=".txt") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".txt") returned 0x0 [0077.064] lstrlenW (lpString=".dbf") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".dbf") returned 0x0 [0077.064] lstrlenW (lpString=".ckp") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".ckp") returned 0x0 [0077.064] lstrlenW (lpString=".dacpac") returned 7 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".dacpac") returned 0x0 [0077.064] lstrlenW (lpString=".db3") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".db3") returned 0x0 [0077.064] lstrlenW (lpString=".dtxs") returned 5 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".dtxs") returned 0x0 [0077.064] lstrlenW (lpString=".mdt") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".mdt") returned 0x0 [0077.064] lstrlenW (lpString=".sdf") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".sdf") returned 0x0 [0077.064] lstrlenW (lpString=".MDF") returned 4 [0077.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".MDF") returned 0x0 [0077.064] lstrlenW (lpString=".DBF") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".DBF") returned 0x0 [0077.065] lstrlenW (lpString=".DB") returned 3 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".DB") returned 0x0 [0077.065] lstrlenW (lpString=".db") returned 3 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".db") returned 0x0 [0077.065] lstrlenW (lpString=".ndf") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".ndf") returned 0x0 [0077.065] lstrlenW (lpString=".NDF") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".NDF") returned 0x0 [0077.065] lstrlenW (lpString=".Mdf") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".Mdf") returned 0x0 [0077.065] lstrlenW (lpString=".dat") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".dat") returned 0x0 [0077.065] lstrlenW (lpString=".DAT") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".DAT") returned 0x0 [0077.065] lstrlenW (lpString=".ldf") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".ldf") returned 0x0 [0077.065] lstrlenW (lpString=".LDF") returned 4 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch=".LDF") returned 0x0 [0077.065] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.065] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.068] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.068] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.068] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19706911970) returned 1 [0077.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcc03410, dwHighDateTime=0x1d585b4)) [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caec8 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caec8 | out: hHeap=0x260000) returned 1 [0077.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd7f8 [0077.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0077.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd7f8 | out: hHeap=0x260000) returned 1 [0077.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.070] GetLastError () returned 0x0 [0077.070] GetLastError () returned 0x0 [0077.070] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.070] GetLastError () returned 0x0 [0077.070] GetLastError () returned 0x0 [0077.239] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb417, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.262] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4be9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x4be9, lpOverlapped=0x0) returned 1 [0077.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.263] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.263] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.263] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.263] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.263] CloseHandle (hObject=0x108) returned 1 [0077.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.265] GetLastError () returned 0x0 [0077.265] RtlWakeConditionVariable () returned 0x0 [0077.265] GetCurrentThreadId () returned 0x998 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".ldf") returned 0x0 [0077.265] lstrlenW (lpString=".vhd") returned 4 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".vhd") returned 0x0 [0077.265] lstrlenW (lpString=".vhdx") returned 5 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".vhdx") returned 0x0 [0077.265] lstrlenW (lpString=".pst") returned 4 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".pst") returned 0x0 [0077.265] lstrlenW (lpString=".ost") returned 4 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".ost") returned 0x0 [0077.265] lstrlenW (lpString=".bak") returned 4 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".bak") returned 0x0 [0077.265] lstrlenW (lpString=".bac") returned 4 [0077.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".bac") returned 0x0 [0077.266] lstrlenW (lpString=".sys") returned 4 [0077.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".sys") returned 0x0 [0077.266] lstrlenW (lpString=".v2i") returned 4 [0077.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".v2i") returned 0x0 [0077.266] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.267] lstrlenW (lpString=".sql") returned 4 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".sql") returned 0x0 [0077.267] lstrlenW (lpString=".mdf") returned 4 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".mdf") returned 0x0 [0077.267] lstrlenW (lpString=".txt") returned 4 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".txt") returned 0x0 [0077.267] lstrlenW (lpString=".dbf") returned 4 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".dbf") returned 0x0 [0077.267] lstrlenW (lpString=".ckp") returned 4 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".ckp") returned 0x0 [0077.267] lstrlenW (lpString=".dacpac") returned 7 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".dacpac") returned 0x0 [0077.267] lstrlenW (lpString=".db3") returned 4 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".db3") returned 0x0 [0077.267] lstrlenW (lpString=".dtxs") returned 5 [0077.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".dtxs") returned 0x0 [0077.268] lstrlenW (lpString=".mdt") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".mdt") returned 0x0 [0077.268] lstrlenW (lpString=".sdf") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".sdf") returned 0x0 [0077.268] lstrlenW (lpString=".MDF") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".MDF") returned 0x0 [0077.268] lstrlenW (lpString=".DBF") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".DBF") returned 0x0 [0077.268] lstrlenW (lpString=".DB") returned 3 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".DB") returned 0x0 [0077.268] lstrlenW (lpString=".db") returned 3 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".db") returned 0x0 [0077.268] lstrlenW (lpString=".ndf") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".ndf") returned 0x0 [0077.268] lstrlenW (lpString=".NDF") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".NDF") returned 0x0 [0077.268] lstrlenW (lpString=".Mdf") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".Mdf") returned 0x0 [0077.268] lstrlenW (lpString=".dat") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".dat") returned 0x0 [0077.268] lstrlenW (lpString=".DAT") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".DAT") returned 0x0 [0077.268] lstrlenW (lpString=".ldf") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".ldf") returned 0x0 [0077.268] lstrlenW (lpString=".LDF") returned 4 [0077.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch=".LDF") returned 0x0 [0077.269] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.269] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.269] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.269] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.270] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19727080776) returned 1 [0077.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcdf25f0, dwHighDateTime=0x1d585b4)) [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb130 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb130 | out: hHeap=0x260000) returned 1 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd8a0 [0077.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd8a0 | out: hHeap=0x260000) returned 1 [0077.270] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.271] GetLastError () returned 0x0 [0077.271] GetLastError () returned 0x0 [0077.271] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.271] GetLastError () returned 0x0 [0077.271] GetLastError () returned 0x0 [0077.272] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdf10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.273] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x20f0, lpOverlapped=0x0) returned 1 [0077.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.273] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.273] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.273] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.273] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.273] CloseHandle (hObject=0x108) returned 1 [0077.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.275] GetLastError () returned 0x0 [0077.275] RtlWakeConditionVariable () returned 0x0 [0077.275] GetCurrentThreadId () returned 0x998 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".ldf") returned 0x0 [0077.275] lstrlenW (lpString=".vhd") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".vhd") returned 0x0 [0077.275] lstrlenW (lpString=".vhdx") returned 5 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".vhdx") returned 0x0 [0077.275] lstrlenW (lpString=".pst") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".pst") returned 0x0 [0077.275] lstrlenW (lpString=".ost") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".ost") returned 0x0 [0077.275] lstrlenW (lpString=".bak") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".bak") returned 0x0 [0077.275] lstrlenW (lpString=".bac") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".bac") returned 0x0 [0077.275] lstrlenW (lpString=".sys") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".sys") returned 0x0 [0077.275] lstrlenW (lpString=".v2i") returned 4 [0077.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".v2i") returned 0x0 [0077.275] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.276] lstrlenW (lpString=".sql") returned 4 [0077.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".sql") returned 0x0 [0077.277] lstrlenW (lpString=".mdf") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".mdf") returned 0x0 [0077.277] lstrlenW (lpString=".txt") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".txt") returned 0x0 [0077.277] lstrlenW (lpString=".dbf") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".dbf") returned 0x0 [0077.277] lstrlenW (lpString=".ckp") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".ckp") returned 0x0 [0077.277] lstrlenW (lpString=".dacpac") returned 7 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".dacpac") returned 0x0 [0077.277] lstrlenW (lpString=".db3") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".db3") returned 0x0 [0077.277] lstrlenW (lpString=".dtxs") returned 5 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".dtxs") returned 0x0 [0077.277] lstrlenW (lpString=".mdt") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".mdt") returned 0x0 [0077.277] lstrlenW (lpString=".sdf") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".sdf") returned 0x0 [0077.277] lstrlenW (lpString=".MDF") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".MDF") returned 0x0 [0077.277] lstrlenW (lpString=".DBF") returned 4 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".DBF") returned 0x0 [0077.277] lstrlenW (lpString=".DB") returned 3 [0077.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".DB") returned 0x0 [0077.277] lstrlenW (lpString=".db") returned 3 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".db") returned 0x0 [0077.278] lstrlenW (lpString=".ndf") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".ndf") returned 0x0 [0077.278] lstrlenW (lpString=".NDF") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".NDF") returned 0x0 [0077.278] lstrlenW (lpString=".Mdf") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".Mdf") returned 0x0 [0077.278] lstrlenW (lpString=".dat") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".dat") returned 0x0 [0077.278] lstrlenW (lpString=".DAT") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".DAT") returned 0x0 [0077.278] lstrlenW (lpString=".ldf") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".ldf") returned 0x0 [0077.278] lstrlenW (lpString=".LDF") returned 4 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch=".LDF") returned 0x0 [0077.278] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.278] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.279] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.279] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.279] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19728038716) returned 1 [0077.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcdf25f0, dwHighDateTime=0x1d585b4)) [0077.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c3a8 [0077.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c3a8 | out: hHeap=0x260000) returned 1 [0077.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cdfd8 [0077.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cdfd8 | out: hHeap=0x260000) returned 1 [0077.280] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.280] GetLastError () returned 0x0 [0077.280] GetLastError () returned 0x0 [0077.280] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.280] GetLastError () returned 0x0 [0077.281] GetLastError () returned 0x0 [0077.282] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffef5d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.282] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10a3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x10a3, lpOverlapped=0x0) returned 1 [0077.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.283] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.283] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.283] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.283] CloseHandle (hObject=0x108) returned 1 [0077.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.285] GetLastError () returned 0x0 [0077.285] RtlWakeConditionVariable () returned 0x0 [0077.285] GetCurrentThreadId () returned 0x998 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".ldf") returned 0x0 [0077.285] lstrlenW (lpString=".vhd") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".vhd") returned 0x0 [0077.285] lstrlenW (lpString=".vhdx") returned 5 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".vhdx") returned 0x0 [0077.285] lstrlenW (lpString=".pst") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".pst") returned 0x0 [0077.285] lstrlenW (lpString=".ost") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".ost") returned 0x0 [0077.285] lstrlenW (lpString=".bak") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".bak") returned 0x0 [0077.285] lstrlenW (lpString=".bac") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".bac") returned 0x0 [0077.285] lstrlenW (lpString=".sys") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".sys") returned 0x0 [0077.285] lstrlenW (lpString=".v2i") returned 4 [0077.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".v2i") returned 0x0 [0077.286] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.287] lstrlenW (lpString=".sql") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".sql") returned 0x0 [0077.287] lstrlenW (lpString=".mdf") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".mdf") returned 0x0 [0077.287] lstrlenW (lpString=".txt") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".txt") returned 0x0 [0077.287] lstrlenW (lpString=".dbf") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".dbf") returned 0x0 [0077.287] lstrlenW (lpString=".ckp") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".ckp") returned 0x0 [0077.287] lstrlenW (lpString=".dacpac") returned 7 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".dacpac") returned 0x0 [0077.287] lstrlenW (lpString=".db3") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".db3") returned 0x0 [0077.287] lstrlenW (lpString=".dtxs") returned 5 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".dtxs") returned 0x0 [0077.287] lstrlenW (lpString=".mdt") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".mdt") returned 0x0 [0077.287] lstrlenW (lpString=".sdf") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".sdf") returned 0x0 [0077.287] lstrlenW (lpString=".MDF") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".MDF") returned 0x0 [0077.287] lstrlenW (lpString=".DBF") returned 4 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".DBF") returned 0x0 [0077.287] lstrlenW (lpString=".DB") returned 3 [0077.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".DB") returned 0x0 [0077.288] lstrlenW (lpString=".db") returned 3 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".db") returned 0x0 [0077.288] lstrlenW (lpString=".ndf") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".ndf") returned 0x0 [0077.288] lstrlenW (lpString=".NDF") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".NDF") returned 0x0 [0077.288] lstrlenW (lpString=".Mdf") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".Mdf") returned 0x0 [0077.288] lstrlenW (lpString=".dat") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".dat") returned 0x0 [0077.288] lstrlenW (lpString=".DAT") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".DAT") returned 0x0 [0077.288] lstrlenW (lpString=".ldf") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".ldf") returned 0x0 [0077.288] lstrlenW (lpString=".LDF") returned 4 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch=".LDF") returned 0x0 [0077.288] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.288] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.289] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.289] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.289] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19729042308) returned 1 [0077.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbce18750, dwHighDateTime=0x1d585b4)) [0077.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c3e0 [0077.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c3e0 | out: hHeap=0x260000) returned 1 [0077.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce080 [0077.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce080 | out: hHeap=0x260000) returned 1 [0077.290] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.290] GetLastError () returned 0x0 [0077.290] GetLastError () returned 0x0 [0077.290] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.291] GetLastError () returned 0x0 [0077.291] GetLastError () returned 0x0 [0077.292] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffebbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.292] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1444, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1444, lpOverlapped=0x0) returned 1 [0077.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.293] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.293] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.293] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.293] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.293] CloseHandle (hObject=0x108) returned 1 [0077.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.294] GetLastError () returned 0x0 [0077.294] RtlWakeConditionVariable () returned 0x0 [0077.294] GetCurrentThreadId () returned 0x998 [0077.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".ldf") returned 0x0 [0077.294] lstrlenW (lpString=".vhd") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".vhd") returned 0x0 [0077.295] lstrlenW (lpString=".vhdx") returned 5 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".vhdx") returned 0x0 [0077.295] lstrlenW (lpString=".pst") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".pst") returned 0x0 [0077.295] lstrlenW (lpString=".ost") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".ost") returned 0x0 [0077.295] lstrlenW (lpString=".bak") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".bak") returned 0x0 [0077.295] lstrlenW (lpString=".bac") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".bac") returned 0x0 [0077.295] lstrlenW (lpString=".sys") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".sys") returned 0x0 [0077.295] lstrlenW (lpString=".v2i") returned 4 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".v2i") returned 0x0 [0077.295] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.471] lstrlenW (lpString=".sql") returned 4 [0077.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".sql") returned 0x0 [0077.481] lstrlenW (lpString=".mdf") returned 4 [0077.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".mdf") returned 0x0 [0077.481] lstrlenW (lpString=".txt") returned 4 [0077.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".txt") returned 0x0 [0077.481] lstrlenW (lpString=".dbf") returned 4 [0077.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".dbf") returned 0x0 [0077.481] lstrlenW (lpString=".ckp") returned 4 [0077.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".ckp") returned 0x0 [0077.481] lstrlenW (lpString=".dacpac") returned 7 [0077.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".dacpac") returned 0x0 [0077.481] lstrlenW (lpString=".db3") returned 4 [0077.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".db3") returned 0x0 [0077.481] lstrlenW (lpString=".dtxs") returned 5 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".dtxs") returned 0x0 [0077.482] lstrlenW (lpString=".mdt") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".mdt") returned 0x0 [0077.482] lstrlenW (lpString=".sdf") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".sdf") returned 0x0 [0077.482] lstrlenW (lpString=".MDF") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".MDF") returned 0x0 [0077.482] lstrlenW (lpString=".DBF") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".DBF") returned 0x0 [0077.482] lstrlenW (lpString=".DB") returned 3 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".DB") returned 0x0 [0077.482] lstrlenW (lpString=".db") returned 3 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".db") returned 0x0 [0077.482] lstrlenW (lpString=".ndf") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".ndf") returned 0x0 [0077.482] lstrlenW (lpString=".NDF") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".NDF") returned 0x0 [0077.482] lstrlenW (lpString=".Mdf") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".Mdf") returned 0x0 [0077.482] lstrlenW (lpString=".dat") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".dat") returned 0x0 [0077.482] lstrlenW (lpString=".DAT") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".DAT") returned 0x0 [0077.482] lstrlenW (lpString=".ldf") returned 4 [0077.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".ldf") returned 0x0 [0077.482] lstrlenW (lpString=".LDF") returned 4 [0077.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch=".LDF") returned 0x0 [0077.483] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.483] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.484] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.484] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19748483034) returned 1 [0077.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbcfe17d0, dwHighDateTime=0x1d585b4)) [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c220 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c220 | out: hHeap=0x260000) returned 1 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce6e8 [0077.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce6e8 | out: hHeap=0x260000) returned 1 [0077.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.485] GetLastError () returned 0x0 [0077.485] GetLastError () returned 0x0 [0077.485] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.485] GetLastError () returned 0x0 [0077.485] GetLastError () returned 0x0 [0077.488] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff3b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.488] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc49, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc49, lpOverlapped=0x0) returned 1 [0077.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.489] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.489] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.489] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.489] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.489] CloseHandle (hObject=0x11c) returned 1 [0077.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.490] GetLastError () returned 0x0 [0077.490] RtlWakeConditionVariable () returned 0x0 [0077.490] GetCurrentThreadId () returned 0x998 [0077.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".ldf") returned 0x0 [0077.490] lstrlenW (lpString=".vhd") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".vhd") returned 0x0 [0077.491] lstrlenW (lpString=".vhdx") returned 5 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".vhdx") returned 0x0 [0077.491] lstrlenW (lpString=".pst") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".pst") returned 0x0 [0077.491] lstrlenW (lpString=".ost") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".ost") returned 0x0 [0077.491] lstrlenW (lpString=".bak") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".bak") returned 0x0 [0077.491] lstrlenW (lpString=".bac") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".bac") returned 0x0 [0077.491] lstrlenW (lpString=".sys") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".sys") returned 0x0 [0077.491] lstrlenW (lpString=".v2i") returned 4 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".v2i") returned 0x0 [0077.491] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.492] lstrlenW (lpString=".sql") returned 4 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".sql") returned 0x0 [0077.492] lstrlenW (lpString=".mdf") returned 4 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".mdf") returned 0x0 [0077.492] lstrlenW (lpString=".txt") returned 4 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".txt") returned 0x0 [0077.492] lstrlenW (lpString=".dbf") returned 4 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".dbf") returned 0x0 [0077.492] lstrlenW (lpString=".ckp") returned 4 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".ckp") returned 0x0 [0077.492] lstrlenW (lpString=".dacpac") returned 7 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".dacpac") returned 0x0 [0077.492] lstrlenW (lpString=".db3") returned 4 [0077.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".db3") returned 0x0 [0077.492] lstrlenW (lpString=".dtxs") returned 5 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".dtxs") returned 0x0 [0077.493] lstrlenW (lpString=".mdt") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".mdt") returned 0x0 [0077.493] lstrlenW (lpString=".sdf") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".sdf") returned 0x0 [0077.493] lstrlenW (lpString=".MDF") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".MDF") returned 0x0 [0077.493] lstrlenW (lpString=".DBF") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".DBF") returned 0x0 [0077.493] lstrlenW (lpString=".DB") returned 3 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".DB") returned 0x0 [0077.493] lstrlenW (lpString=".db") returned 3 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".db") returned 0x0 [0077.493] lstrlenW (lpString=".ndf") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".ndf") returned 0x0 [0077.493] lstrlenW (lpString=".NDF") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".NDF") returned 0x0 [0077.493] lstrlenW (lpString=".Mdf") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".Mdf") returned 0x0 [0077.493] lstrlenW (lpString=".dat") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".dat") returned 0x0 [0077.493] lstrlenW (lpString=".DAT") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".DAT") returned 0x0 [0077.493] lstrlenW (lpString=".ldf") returned 4 [0077.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".ldf") returned 0x0 [0077.494] lstrlenW (lpString=".LDF") returned 4 [0077.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch=".LDF") returned 0x0 [0077.494] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.494] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.494] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.495] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.495] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19749584783) returned 1 [0077.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd007930, dwHighDateTime=0x1d585b4)) [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c1b0 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c1b0 | out: hHeap=0x260000) returned 1 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce250 [0077.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce250 | out: hHeap=0x260000) returned 1 [0077.495] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.496] GetLastError () returned 0x0 [0077.496] GetLastError () returned 0x0 [0077.496] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.496] GetLastError () returned 0x0 [0077.496] GetLastError () returned 0x0 [0077.498] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff2e54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.498] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd1ac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd1ac, lpOverlapped=0x0) returned 1 [0077.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.499] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.499] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.499] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.499] CloseHandle (hObject=0x11c) returned 1 [0077.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.500] GetLastError () returned 0x0 [0077.500] RtlWakeConditionVariable () returned 0x0 [0077.500] GetCurrentThreadId () returned 0x998 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".ldf") returned 0x0 [0077.501] lstrlenW (lpString=".vhd") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".vhd") returned 0x0 [0077.501] lstrlenW (lpString=".vhdx") returned 5 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".vhdx") returned 0x0 [0077.501] lstrlenW (lpString=".pst") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".pst") returned 0x0 [0077.501] lstrlenW (lpString=".ost") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".ost") returned 0x0 [0077.501] lstrlenW (lpString=".bak") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".bak") returned 0x0 [0077.501] lstrlenW (lpString=".bac") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".bac") returned 0x0 [0077.501] lstrlenW (lpString=".sys") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".sys") returned 0x0 [0077.501] lstrlenW (lpString=".v2i") returned 4 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".v2i") returned 0x0 [0077.501] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.502] lstrlenW (lpString=".sql") returned 4 [0077.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".sql") returned 0x0 [0077.502] lstrlenW (lpString=".mdf") returned 4 [0077.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".mdf") returned 0x0 [0077.502] lstrlenW (lpString=".txt") returned 4 [0077.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".txt") returned 0x0 [0077.502] lstrlenW (lpString=".dbf") returned 4 [0077.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".dbf") returned 0x0 [0077.502] lstrlenW (lpString=".ckp") returned 4 [0077.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".ckp") returned 0x0 [0077.503] lstrlenW (lpString=".dacpac") returned 7 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".dacpac") returned 0x0 [0077.503] lstrlenW (lpString=".db3") returned 4 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".db3") returned 0x0 [0077.503] lstrlenW (lpString=".dtxs") returned 5 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".dtxs") returned 0x0 [0077.503] lstrlenW (lpString=".mdt") returned 4 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".mdt") returned 0x0 [0077.503] lstrlenW (lpString=".sdf") returned 4 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".sdf") returned 0x0 [0077.503] lstrlenW (lpString=".MDF") returned 4 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".MDF") returned 0x0 [0077.503] lstrlenW (lpString=".DBF") returned 4 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".DBF") returned 0x0 [0077.503] lstrlenW (lpString=".DB") returned 3 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".DB") returned 0x0 [0077.503] lstrlenW (lpString=".db") returned 3 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".db") returned 0x0 [0077.503] lstrlenW (lpString=".ndf") returned 4 [0077.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".ndf") returned 0x0 [0077.503] lstrlenW (lpString=".NDF") returned 4 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".NDF") returned 0x0 [0077.504] lstrlenW (lpString=".Mdf") returned 4 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".Mdf") returned 0x0 [0077.504] lstrlenW (lpString=".dat") returned 4 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".dat") returned 0x0 [0077.504] lstrlenW (lpString=".DAT") returned 4 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".DAT") returned 0x0 [0077.504] lstrlenW (lpString=".ldf") returned 4 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".ldf") returned 0x0 [0077.504] lstrlenW (lpString=".LDF") returned 4 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch=".LDF") returned 0x0 [0077.504] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.504] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.505] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.505] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19750621331) returned 1 [0077.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd02da90, dwHighDateTime=0x1d585b4)) [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c178 [0077.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c178 | out: hHeap=0x260000) returned 1 [0077.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce838 [0077.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce838 | out: hHeap=0x260000) returned 1 [0077.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.506] GetLastError () returned 0x0 [0077.506] GetLastError () returned 0x0 [0077.506] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.506] GetLastError () returned 0x0 [0077.506] GetLastError () returned 0x0 [0077.508] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff343d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.508] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcbc3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xcbc3, lpOverlapped=0x0) returned 1 [0077.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.509] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.509] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.509] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.509] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.509] CloseHandle (hObject=0x11c) returned 1 [0077.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.510] GetLastError () returned 0x0 [0077.510] RtlWakeConditionVariable () returned 0x0 [0077.510] GetCurrentThreadId () returned 0x998 [0077.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".ldf") returned 0x0 [0077.510] lstrlenW (lpString=".vhd") returned 4 [0077.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".vhd") returned 0x0 [0077.510] lstrlenW (lpString=".vhdx") returned 5 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".vhdx") returned 0x0 [0077.511] lstrlenW (lpString=".pst") returned 4 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".pst") returned 0x0 [0077.511] lstrlenW (lpString=".ost") returned 4 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".ost") returned 0x0 [0077.511] lstrlenW (lpString=".bak") returned 4 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".bak") returned 0x0 [0077.511] lstrlenW (lpString=".bac") returned 4 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".bac") returned 0x0 [0077.511] lstrlenW (lpString=".sys") returned 4 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".sys") returned 0x0 [0077.511] lstrlenW (lpString=".v2i") returned 4 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".v2i") returned 0x0 [0077.511] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.512] lstrlenW (lpString=".sql") returned 4 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".sql") returned 0x0 [0077.512] lstrlenW (lpString=".mdf") returned 4 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".mdf") returned 0x0 [0077.512] lstrlenW (lpString=".txt") returned 4 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".txt") returned 0x0 [0077.512] lstrlenW (lpString=".dbf") returned 4 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".dbf") returned 0x0 [0077.512] lstrlenW (lpString=".ckp") returned 4 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".ckp") returned 0x0 [0077.512] lstrlenW (lpString=".dacpac") returned 7 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".dacpac") returned 0x0 [0077.512] lstrlenW (lpString=".db3") returned 4 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".db3") returned 0x0 [0077.512] lstrlenW (lpString=".dtxs") returned 5 [0077.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".dtxs") returned 0x0 [0077.513] lstrlenW (lpString=".mdt") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".mdt") returned 0x0 [0077.513] lstrlenW (lpString=".sdf") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".sdf") returned 0x0 [0077.513] lstrlenW (lpString=".MDF") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".MDF") returned 0x0 [0077.513] lstrlenW (lpString=".DBF") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".DBF") returned 0x0 [0077.513] lstrlenW (lpString=".DB") returned 3 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".DB") returned 0x0 [0077.513] lstrlenW (lpString=".db") returned 3 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".db") returned 0x0 [0077.513] lstrlenW (lpString=".ndf") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".ndf") returned 0x0 [0077.513] lstrlenW (lpString=".NDF") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".NDF") returned 0x0 [0077.513] lstrlenW (lpString=".Mdf") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".Mdf") returned 0x0 [0077.513] lstrlenW (lpString=".dat") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".dat") returned 0x0 [0077.513] lstrlenW (lpString=".DAT") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".DAT") returned 0x0 [0077.513] lstrlenW (lpString=".ldf") returned 4 [0077.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".ldf") returned 0x0 [0077.514] lstrlenW (lpString=".LDF") returned 4 [0077.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch=".LDF") returned 0x0 [0077.514] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.514] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.515] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.515] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19751586831) returned 1 [0077.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd02da90, dwHighDateTime=0x1d585b4)) [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c140 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c140 | out: hHeap=0x260000) returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce8e0 [0077.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce8e0 | out: hHeap=0x260000) returned 1 [0077.515] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.516] GetLastError () returned 0x0 [0077.516] GetLastError () returned 0x0 [0077.516] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.516] GetLastError () returned 0x0 [0077.516] GetLastError () returned 0x0 [0077.620] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff2366, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.620] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xdc9a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xdc9a, lpOverlapped=0x0) returned 1 [0077.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.620] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.620] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.620] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.621] CloseHandle (hObject=0x11c) returned 1 [0077.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.660] GetLastError () returned 0x0 [0077.663] RtlWakeConditionVariable () returned 0x27e828 [0077.670] GetCurrentThreadId () returned 0x998 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".ldf") returned 0x0 [0077.670] lstrlenW (lpString=".vhd") returned 4 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".vhd") returned 0x0 [0077.670] lstrlenW (lpString=".vhdx") returned 5 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".vhdx") returned 0x0 [0077.670] lstrlenW (lpString=".pst") returned 4 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".pst") returned 0x0 [0077.670] lstrlenW (lpString=".ost") returned 4 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".ost") returned 0x0 [0077.670] lstrlenW (lpString=".bak") returned 4 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".bak") returned 0x0 [0077.670] lstrlenW (lpString=".bac") returned 4 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".bac") returned 0x0 [0077.670] lstrlenW (lpString=".sys") returned 4 [0077.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".sys") returned 0x0 [0077.671] lstrlenW (lpString=".v2i") returned 4 [0077.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".v2i") returned 0x0 [0077.671] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.672] lstrlenW (lpString=".sql") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".sql") returned 0x0 [0077.672] lstrlenW (lpString=".mdf") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".mdf") returned 0x0 [0077.672] lstrlenW (lpString=".txt") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".txt") returned 0x0 [0077.672] lstrlenW (lpString=".dbf") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".dbf") returned 0x0 [0077.672] lstrlenW (lpString=".ckp") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".ckp") returned 0x0 [0077.672] lstrlenW (lpString=".dacpac") returned 7 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".dacpac") returned 0x0 [0077.672] lstrlenW (lpString=".db3") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".db3") returned 0x0 [0077.672] lstrlenW (lpString=".dtxs") returned 5 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".dtxs") returned 0x0 [0077.672] lstrlenW (lpString=".mdt") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".mdt") returned 0x0 [0077.672] lstrlenW (lpString=".sdf") returned 4 [0077.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".sdf") returned 0x0 [0077.672] lstrlenW (lpString=".MDF") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".MDF") returned 0x0 [0077.673] lstrlenW (lpString=".DBF") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".DBF") returned 0x0 [0077.673] lstrlenW (lpString=".DB") returned 3 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".DB") returned 0x0 [0077.673] lstrlenW (lpString=".db") returned 3 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".db") returned 0x0 [0077.673] lstrlenW (lpString=".ndf") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".ndf") returned 0x0 [0077.673] lstrlenW (lpString=".NDF") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".NDF") returned 0x0 [0077.673] lstrlenW (lpString=".Mdf") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".Mdf") returned 0x0 [0077.673] lstrlenW (lpString=".dat") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".dat") returned 0x0 [0077.673] lstrlenW (lpString=".DAT") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".DAT") returned 0x0 [0077.673] lstrlenW (lpString=".ldf") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".ldf") returned 0x0 [0077.673] lstrlenW (lpString=".LDF") returned 4 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch=".LDF") returned 0x0 [0077.673] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.674] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.674] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.674] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19767563380) returned 1 [0077.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd1d09b0, dwHighDateTime=0x1d585b4)) [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb440 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb440 | out: hHeap=0x260000) returned 1 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce988 [0077.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce988 | out: hHeap=0x260000) returned 1 [0077.675] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.675] GetLastError () returned 0x0 [0077.676] GetLastError () returned 0x0 [0077.676] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.676] GetLastError () returned 0x0 [0077.676] GetLastError () returned 0x0 [0077.679] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8ae9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.679] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x7517, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x7517, lpOverlapped=0x0) returned 1 [0077.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.679] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.679] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.679] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.680] CloseHandle (hObject=0x11c) returned 1 [0077.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.681] GetLastError () returned 0x0 [0077.681] RtlWakeConditionVariable () returned 0x0 [0077.681] GetCurrentThreadId () returned 0x998 [0077.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".ldf") returned 0x0 [0077.681] lstrlenW (lpString=".vhd") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".vhd") returned 0x0 [0077.682] lstrlenW (lpString=".vhdx") returned 5 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".vhdx") returned 0x0 [0077.682] lstrlenW (lpString=".pst") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".pst") returned 0x0 [0077.682] lstrlenW (lpString=".ost") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".ost") returned 0x0 [0077.682] lstrlenW (lpString=".bak") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".bak") returned 0x0 [0077.682] lstrlenW (lpString=".bac") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".bac") returned 0x0 [0077.682] lstrlenW (lpString=".sys") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".sys") returned 0x0 [0077.682] lstrlenW (lpString=".v2i") returned 4 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".v2i") returned 0x0 [0077.682] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.683] lstrlenW (lpString=".sql") returned 4 [0077.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".sql") returned 0x0 [0077.683] lstrlenW (lpString=".mdf") returned 4 [0077.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".mdf") returned 0x0 [0077.683] lstrlenW (lpString=".txt") returned 4 [0077.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".txt") returned 0x0 [0077.683] lstrlenW (lpString=".dbf") returned 4 [0077.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".dbf") returned 0x0 [0077.683] lstrlenW (lpString=".ckp") returned 4 [0077.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".ckp") returned 0x0 [0077.684] lstrlenW (lpString=".dacpac") returned 7 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".dacpac") returned 0x0 [0077.684] lstrlenW (lpString=".db3") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".db3") returned 0x0 [0077.684] lstrlenW (lpString=".dtxs") returned 5 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".dtxs") returned 0x0 [0077.684] lstrlenW (lpString=".mdt") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".mdt") returned 0x0 [0077.684] lstrlenW (lpString=".sdf") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".sdf") returned 0x0 [0077.684] lstrlenW (lpString=".MDF") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".MDF") returned 0x0 [0077.684] lstrlenW (lpString=".DBF") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".DBF") returned 0x0 [0077.684] lstrlenW (lpString=".DB") returned 3 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".DB") returned 0x0 [0077.684] lstrlenW (lpString=".db") returned 3 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".db") returned 0x0 [0077.684] lstrlenW (lpString=".ndf") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".ndf") returned 0x0 [0077.684] lstrlenW (lpString=".NDF") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".NDF") returned 0x0 [0077.684] lstrlenW (lpString=".Mdf") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".Mdf") returned 0x0 [0077.684] lstrlenW (lpString=".dat") returned 4 [0077.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".dat") returned 0x0 [0077.685] lstrlenW (lpString=".DAT") returned 4 [0077.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".DAT") returned 0x0 [0077.685] lstrlenW (lpString=".ldf") returned 4 [0077.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".ldf") returned 0x0 [0077.685] lstrlenW (lpString=".LDF") returned 4 [0077.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch=".LDF") returned 0x0 [0077.685] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.685] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.686] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.686] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19768704576) returned 1 [0077.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd1d09b0, dwHighDateTime=0x1d585b4)) [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb478 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb478 | out: hHeap=0x260000) returned 1 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf2b8 [0077.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf2b8 | out: hHeap=0x260000) returned 1 [0077.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.687] GetLastError () returned 0x0 [0077.687] GetLastError () returned 0x0 [0077.687] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.687] GetLastError () returned 0x0 [0077.687] GetLastError () returned 0x0 [0077.689] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffac62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.689] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x539e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x539e, lpOverlapped=0x0) returned 1 [0077.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.689] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.690] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.690] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.690] CloseHandle (hObject=0x11c) returned 1 [0077.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.691] GetLastError () returned 0x0 [0077.691] RtlWakeConditionVariable () returned 0x0 [0077.691] GetCurrentThreadId () returned 0x998 [0077.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".ldf") returned 0x0 [0077.691] lstrlenW (lpString=".vhd") returned 4 [0077.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".vhd") returned 0x0 [0077.691] lstrlenW (lpString=".vhdx") returned 5 [0077.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".vhdx") returned 0x0 [0077.691] lstrlenW (lpString=".pst") returned 4 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".pst") returned 0x0 [0077.692] lstrlenW (lpString=".ost") returned 4 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".ost") returned 0x0 [0077.692] lstrlenW (lpString=".bak") returned 4 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".bak") returned 0x0 [0077.692] lstrlenW (lpString=".bac") returned 4 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".bac") returned 0x0 [0077.692] lstrlenW (lpString=".sys") returned 4 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".sys") returned 0x0 [0077.692] lstrlenW (lpString=".v2i") returned 4 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".v2i") returned 0x0 [0077.692] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.694] lstrlenW (lpString=".sql") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".sql") returned 0x0 [0077.694] lstrlenW (lpString=".mdf") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".mdf") returned 0x0 [0077.694] lstrlenW (lpString=".txt") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".txt") returned 0x0 [0077.694] lstrlenW (lpString=".dbf") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".dbf") returned 0x0 [0077.694] lstrlenW (lpString=".ckp") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".ckp") returned 0x0 [0077.694] lstrlenW (lpString=".dacpac") returned 7 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".dacpac") returned 0x0 [0077.694] lstrlenW (lpString=".db3") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".db3") returned 0x0 [0077.694] lstrlenW (lpString=".dtxs") returned 5 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".dtxs") returned 0x0 [0077.694] lstrlenW (lpString=".mdt") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".mdt") returned 0x0 [0077.694] lstrlenW (lpString=".sdf") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".sdf") returned 0x0 [0077.694] lstrlenW (lpString=".MDF") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".MDF") returned 0x0 [0077.694] lstrlenW (lpString=".DBF") returned 4 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".DBF") returned 0x0 [0077.694] lstrlenW (lpString=".DB") returned 3 [0077.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".DB") returned 0x0 [0077.695] lstrlenW (lpString=".db") returned 3 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".db") returned 0x0 [0077.695] lstrlenW (lpString=".ndf") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".ndf") returned 0x0 [0077.695] lstrlenW (lpString=".NDF") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".NDF") returned 0x0 [0077.695] lstrlenW (lpString=".Mdf") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".Mdf") returned 0x0 [0077.695] lstrlenW (lpString=".dat") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".dat") returned 0x0 [0077.695] lstrlenW (lpString=".DAT") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".DAT") returned 0x0 [0077.695] lstrlenW (lpString=".ldf") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".ldf") returned 0x0 [0077.695] lstrlenW (lpString=".LDF") returned 4 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch=".LDF") returned 0x0 [0077.695] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.695] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.696] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.696] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.696] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19769740881) returned 1 [0077.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd1f6b10, dwHighDateTime=0x1d585b4)) [0077.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb4b0 [0077.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb4b0 | out: hHeap=0x260000) returned 1 [0077.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf360 [0077.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf360 | out: hHeap=0x260000) returned 1 [0077.697] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.697] GetLastError () returned 0x0 [0077.697] GetLastError () returned 0x0 [0077.697] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.697] GetLastError () returned 0x0 [0077.698] GetLastError () returned 0x0 [0077.700] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff9807, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.700] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x67f9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x67f9, lpOverlapped=0x0) returned 1 [0077.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.700] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.700] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.701] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.701] CloseHandle (hObject=0x11c) returned 1 [0077.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.702] GetLastError () returned 0x0 [0077.702] RtlWakeConditionVariable () returned 0x0 [0077.702] GetCurrentThreadId () returned 0x998 [0077.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".ldf") returned 0x0 [0077.702] lstrlenW (lpString=".vhd") returned 4 [0077.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".vhd") returned 0x0 [0077.702] lstrlenW (lpString=".vhdx") returned 5 [0077.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".vhdx") returned 0x0 [0077.703] lstrlenW (lpString=".pst") returned 4 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".pst") returned 0x0 [0077.703] lstrlenW (lpString=".ost") returned 4 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".ost") returned 0x0 [0077.703] lstrlenW (lpString=".bak") returned 4 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".bak") returned 0x0 [0077.703] lstrlenW (lpString=".bac") returned 4 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".bac") returned 0x0 [0077.703] lstrlenW (lpString=".sys") returned 4 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".sys") returned 0x0 [0077.703] lstrlenW (lpString=".v2i") returned 4 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".v2i") returned 0x0 [0077.703] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.774] lstrlenW (lpString=".sql") returned 4 [0077.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".sql") returned 0x0 [0077.794] lstrlenW (lpString=".mdf") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".mdf") returned 0x0 [0077.794] lstrlenW (lpString=".txt") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".txt") returned 0x0 [0077.794] lstrlenW (lpString=".dbf") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".dbf") returned 0x0 [0077.794] lstrlenW (lpString=".ckp") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".ckp") returned 0x0 [0077.794] lstrlenW (lpString=".dacpac") returned 7 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".dacpac") returned 0x0 [0077.794] lstrlenW (lpString=".db3") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".db3") returned 0x0 [0077.794] lstrlenW (lpString=".dtxs") returned 5 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".dtxs") returned 0x0 [0077.794] lstrlenW (lpString=".mdt") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".mdt") returned 0x0 [0077.794] lstrlenW (lpString=".sdf") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".sdf") returned 0x0 [0077.794] lstrlenW (lpString=".MDF") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".MDF") returned 0x0 [0077.794] lstrlenW (lpString=".DBF") returned 4 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".DBF") returned 0x0 [0077.794] lstrlenW (lpString=".DB") returned 3 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".DB") returned 0x0 [0077.794] lstrlenW (lpString=".db") returned 3 [0077.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".db") returned 0x0 [0077.795] lstrlenW (lpString=".ndf") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".ndf") returned 0x0 [0077.795] lstrlenW (lpString=".NDF") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".NDF") returned 0x0 [0077.795] lstrlenW (lpString=".Mdf") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".Mdf") returned 0x0 [0077.795] lstrlenW (lpString=".dat") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".dat") returned 0x0 [0077.795] lstrlenW (lpString=".DAT") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".DAT") returned 0x0 [0077.795] lstrlenW (lpString=".ldf") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".ldf") returned 0x0 [0077.795] lstrlenW (lpString=".LDF") returned 4 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch=".LDF") returned 0x0 [0077.795] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.795] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.796] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.796] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19779732599) returned 1 [0077.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd2db350, dwHighDateTime=0x1d585b4)) [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb670 [0077.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb670 | out: hHeap=0x260000) returned 1 [0077.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf8a0 [0077.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf8a0 | out: hHeap=0x260000) returned 1 [0077.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.797] GetLastError () returned 0x0 [0077.797] GetLastError () returned 0x0 [0077.797] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.797] GetLastError () returned 0x0 [0077.798] GetLastError () returned 0x0 [0077.801] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe45f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.801] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1ba1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1ba1, lpOverlapped=0x0) returned 1 [0077.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.801] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.801] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.801] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.801] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.801] CloseHandle (hObject=0x11c) returned 1 [0077.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.803] GetLastError () returned 0x0 [0077.803] RtlWakeConditionVariable () returned 0x0 [0077.803] GetCurrentThreadId () returned 0x998 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".ldf") returned 0x0 [0077.803] lstrlenW (lpString=".vhd") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".vhd") returned 0x0 [0077.803] lstrlenW (lpString=".vhdx") returned 5 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".vhdx") returned 0x0 [0077.803] lstrlenW (lpString=".pst") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".pst") returned 0x0 [0077.803] lstrlenW (lpString=".ost") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".ost") returned 0x0 [0077.803] lstrlenW (lpString=".bak") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".bak") returned 0x0 [0077.803] lstrlenW (lpString=".bac") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".bac") returned 0x0 [0077.803] lstrlenW (lpString=".sys") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".sys") returned 0x0 [0077.803] lstrlenW (lpString=".v2i") returned 4 [0077.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".v2i") returned 0x0 [0077.804] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.805] lstrlenW (lpString=".sql") returned 4 [0077.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".sql") returned 0x0 [0077.805] lstrlenW (lpString=".mdf") returned 4 [0077.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".mdf") returned 0x0 [0077.805] lstrlenW (lpString=".txt") returned 4 [0077.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".txt") returned 0x0 [0077.805] lstrlenW (lpString=".dbf") returned 4 [0077.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".dbf") returned 0x0 [0077.805] lstrlenW (lpString=".ckp") returned 4 [0077.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".ckp") returned 0x0 [0077.805] lstrlenW (lpString=".dacpac") returned 7 [0077.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".dacpac") returned 0x0 [0077.805] lstrlenW (lpString=".db3") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".db3") returned 0x0 [0077.806] lstrlenW (lpString=".dtxs") returned 5 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".dtxs") returned 0x0 [0077.806] lstrlenW (lpString=".mdt") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".mdt") returned 0x0 [0077.806] lstrlenW (lpString=".sdf") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".sdf") returned 0x0 [0077.806] lstrlenW (lpString=".MDF") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".MDF") returned 0x0 [0077.806] lstrlenW (lpString=".DBF") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".DBF") returned 0x0 [0077.806] lstrlenW (lpString=".DB") returned 3 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".DB") returned 0x0 [0077.806] lstrlenW (lpString=".db") returned 3 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".db") returned 0x0 [0077.806] lstrlenW (lpString=".ndf") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".ndf") returned 0x0 [0077.806] lstrlenW (lpString=".NDF") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".NDF") returned 0x0 [0077.806] lstrlenW (lpString=".Mdf") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".Mdf") returned 0x0 [0077.806] lstrlenW (lpString=".dat") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".dat") returned 0x0 [0077.806] lstrlenW (lpString=".DAT") returned 4 [0077.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".DAT") returned 0x0 [0077.806] lstrlenW (lpString=".ldf") returned 4 [0077.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".ldf") returned 0x0 [0077.807] lstrlenW (lpString=".LDF") returned 4 [0077.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch=".LDF") returned 0x0 [0077.807] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.807] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.808] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.808] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.808] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19780890151) returned 1 [0077.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd3014b0, dwHighDateTime=0x1d585b4)) [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb6a8 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb6a8 | out: hHeap=0x260000) returned 1 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf4b0 [0077.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf4b0 | out: hHeap=0x260000) returned 1 [0077.808] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.809] GetLastError () returned 0x0 [0077.809] GetLastError () returned 0x0 [0077.809] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.809] GetLastError () returned 0x0 [0077.809] GetLastError () returned 0x0 [0077.811] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffee87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.811] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1179, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1179, lpOverlapped=0x0) returned 1 [0077.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.811] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.811] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.811] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.811] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.811] CloseHandle (hObject=0x11c) returned 1 [0077.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.813] GetLastError () returned 0x0 [0077.813] RtlWakeConditionVariable () returned 0x0 [0077.813] GetCurrentThreadId () returned 0x998 [0077.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".ldf") returned 0x0 [0077.813] lstrlenW (lpString=".vhd") returned 4 [0077.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".vhd") returned 0x0 [0077.813] lstrlenW (lpString=".vhdx") returned 5 [0077.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".vhdx") returned 0x0 [0077.813] lstrlenW (lpString=".pst") returned 4 [0077.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".pst") returned 0x0 [0077.813] lstrlenW (lpString=".ost") returned 4 [0077.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".ost") returned 0x0 [0077.814] lstrlenW (lpString=".bak") returned 4 [0077.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".bak") returned 0x0 [0077.814] lstrlenW (lpString=".bac") returned 4 [0077.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".bac") returned 0x0 [0077.814] lstrlenW (lpString=".sys") returned 4 [0077.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".sys") returned 0x0 [0077.814] lstrlenW (lpString=".v2i") returned 4 [0077.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".v2i") returned 0x0 [0077.814] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.815] lstrlenW (lpString=".sql") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".sql") returned 0x0 [0077.815] lstrlenW (lpString=".mdf") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".mdf") returned 0x0 [0077.815] lstrlenW (lpString=".txt") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".txt") returned 0x0 [0077.815] lstrlenW (lpString=".dbf") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".dbf") returned 0x0 [0077.815] lstrlenW (lpString=".ckp") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".ckp") returned 0x0 [0077.815] lstrlenW (lpString=".dacpac") returned 7 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".dacpac") returned 0x0 [0077.815] lstrlenW (lpString=".db3") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".db3") returned 0x0 [0077.815] lstrlenW (lpString=".dtxs") returned 5 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".dtxs") returned 0x0 [0077.815] lstrlenW (lpString=".mdt") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".mdt") returned 0x0 [0077.815] lstrlenW (lpString=".sdf") returned 4 [0077.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".sdf") returned 0x0 [0077.816] lstrlenW (lpString=".MDF") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".MDF") returned 0x0 [0077.816] lstrlenW (lpString=".DBF") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".DBF") returned 0x0 [0077.816] lstrlenW (lpString=".DB") returned 3 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".DB") returned 0x0 [0077.816] lstrlenW (lpString=".db") returned 3 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".db") returned 0x0 [0077.816] lstrlenW (lpString=".ndf") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".ndf") returned 0x0 [0077.816] lstrlenW (lpString=".NDF") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".NDF") returned 0x0 [0077.816] lstrlenW (lpString=".Mdf") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".Mdf") returned 0x0 [0077.816] lstrlenW (lpString=".dat") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".dat") returned 0x0 [0077.816] lstrlenW (lpString=".DAT") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".DAT") returned 0x0 [0077.816] lstrlenW (lpString=".ldf") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".ldf") returned 0x0 [0077.816] lstrlenW (lpString=".LDF") returned 4 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch=".LDF") returned 0x0 [0077.816] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.817] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.817] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.817] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.818] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19781871590) returned 1 [0077.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd327610, dwHighDateTime=0x1d585b4)) [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb6e0 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb6e0 | out: hHeap=0x260000) returned 1 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf9f0 [0077.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf9f0 | out: hHeap=0x260000) returned 1 [0077.818] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.818] GetLastError () returned 0x0 [0077.819] GetLastError () returned 0x0 [0077.819] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.819] GetLastError () returned 0x0 [0077.819] GetLastError () returned 0x0 [0077.821] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa6d5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.821] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x592b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x592b, lpOverlapped=0x0) returned 1 [0077.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.821] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.821] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.821] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.821] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.821] CloseHandle (hObject=0x11c) returned 1 [0077.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0077.823] GetLastError () returned 0x0 [0077.823] RtlWakeConditionVariable () returned 0x0 [0077.823] GetCurrentThreadId () returned 0x998 [0077.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".ldf") returned 0x0 [0077.823] lstrlenW (lpString=".vhd") returned 4 [0077.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".vhd") returned 0x0 [0077.823] lstrlenW (lpString=".vhdx") returned 5 [0077.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".vhdx") returned 0x0 [0077.823] lstrlenW (lpString=".pst") returned 4 [0077.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".pst") returned 0x0 [0077.823] lstrlenW (lpString=".ost") returned 4 [0077.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".ost") returned 0x0 [0077.823] lstrlenW (lpString=".bak") returned 4 [0077.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".bak") returned 0x0 [0077.823] lstrlenW (lpString=".bac") returned 4 [0077.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".bac") returned 0x0 [0077.824] lstrlenW (lpString=".sys") returned 4 [0077.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".sys") returned 0x0 [0077.824] lstrlenW (lpString=".v2i") returned 4 [0077.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".v2i") returned 0x0 [0077.824] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.827] lstrlenW (lpString=".sql") returned 4 [0077.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".sql") returned 0x0 [0077.827] lstrlenW (lpString=".mdf") returned 4 [0077.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".mdf") returned 0x0 [0077.827] lstrlenW (lpString=".txt") returned 4 [0077.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".txt") returned 0x0 [0077.827] lstrlenW (lpString=".dbf") returned 4 [0077.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".dbf") returned 0x0 [0077.827] lstrlenW (lpString=".ckp") returned 4 [0077.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".ckp") returned 0x0 [0077.827] lstrlenW (lpString=".dacpac") returned 7 [0077.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".dacpac") returned 0x0 [0077.827] lstrlenW (lpString=".db3") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".db3") returned 0x0 [0077.828] lstrlenW (lpString=".dtxs") returned 5 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".dtxs") returned 0x0 [0077.828] lstrlenW (lpString=".mdt") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".mdt") returned 0x0 [0077.828] lstrlenW (lpString=".sdf") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".sdf") returned 0x0 [0077.828] lstrlenW (lpString=".MDF") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".MDF") returned 0x0 [0077.828] lstrlenW (lpString=".DBF") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".DBF") returned 0x0 [0077.828] lstrlenW (lpString=".DB") returned 3 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".DB") returned 0x0 [0077.828] lstrlenW (lpString=".db") returned 3 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".db") returned 0x0 [0077.828] lstrlenW (lpString=".ndf") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".ndf") returned 0x0 [0077.828] lstrlenW (lpString=".NDF") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".NDF") returned 0x0 [0077.828] lstrlenW (lpString=".Mdf") returned 4 [0077.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".Mdf") returned 0x0 [0077.893] lstrlenW (lpString=".dat") returned 4 [0077.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".dat") returned 0x0 [0077.893] lstrlenW (lpString=".DAT") returned 4 [0077.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".DAT") returned 0x0 [0077.893] lstrlenW (lpString=".ldf") returned 4 [0077.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".ldf") returned 0x0 [0077.893] lstrlenW (lpString=".LDF") returned 4 [0077.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch=".LDF") returned 0x0 [0077.893] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.893] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.894] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.894] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.894] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19789537615) returned 1 [0077.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd3e5cf0, dwHighDateTime=0x1d585b4)) [0077.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb830 [0077.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb830 | out: hHeap=0x260000) returned 1 [0077.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf948 [0077.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf948 | out: hHeap=0x260000) returned 1 [0077.895] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.895] GetLastError () returned 0x0 [0077.895] GetLastError () returned 0x0 [0077.895] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.895] GetLastError () returned 0x0 [0077.896] GetLastError () returned 0x0 [0077.897] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd522, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.897] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2ade, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ade, lpOverlapped=0x0) returned 1 [0077.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.897] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.898] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.898] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.898] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.898] CloseHandle (hObject=0x11c) returned 1 [0077.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.937] GetLastError () returned 0x0 [0077.937] RtlWakeConditionVariable () returned 0x27e828 [0077.937] GetCurrentThreadId () returned 0x998 [0077.938] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0077.938] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0077.938] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0077.938] WriteFile (in: hFile=0xd8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0077.940] CloseHandle (hObject=0xd8) returned 1 [0077.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0077.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0077.940] RtlWakeConditionVariable () returned 0x27e828 [0077.940] GetCurrentThreadId () returned 0x998 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".ldf") returned 0x0 [0077.940] lstrlenW (lpString=".vhd") returned 4 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".vhd") returned 0x0 [0077.940] lstrlenW (lpString=".vhdx") returned 5 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".vhdx") returned 0x0 [0077.940] lstrlenW (lpString=".pst") returned 4 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".pst") returned 0x0 [0077.940] lstrlenW (lpString=".ost") returned 4 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".ost") returned 0x0 [0077.940] lstrlenW (lpString=".bak") returned 4 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".bak") returned 0x0 [0077.940] lstrlenW (lpString=".bac") returned 4 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".bac") returned 0x0 [0077.940] lstrlenW (lpString=".sys") returned 4 [0077.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".sys") returned 0x0 [0077.941] lstrlenW (lpString=".v2i") returned 4 [0077.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".v2i") returned 0x0 [0077.941] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0077.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.942] lstrlenW (lpString=".sql") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".sql") returned 0x0 [0077.942] lstrlenW (lpString=".mdf") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".mdf") returned 0x0 [0077.942] lstrlenW (lpString=".txt") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".txt") returned 0x0 [0077.942] lstrlenW (lpString=".dbf") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".dbf") returned 0x0 [0077.942] lstrlenW (lpString=".ckp") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".ckp") returned 0x0 [0077.942] lstrlenW (lpString=".dacpac") returned 7 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".dacpac") returned 0x0 [0077.942] lstrlenW (lpString=".db3") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".db3") returned 0x0 [0077.942] lstrlenW (lpString=".dtxs") returned 5 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".dtxs") returned 0x0 [0077.942] lstrlenW (lpString=".mdt") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".mdt") returned 0x0 [0077.942] lstrlenW (lpString=".sdf") returned 4 [0077.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".sdf") returned 0x0 [0077.942] lstrlenW (lpString=".MDF") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".MDF") returned 0x0 [0077.943] lstrlenW (lpString=".DBF") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".DBF") returned 0x0 [0077.943] lstrlenW (lpString=".DB") returned 3 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".DB") returned 0x0 [0077.943] lstrlenW (lpString=".db") returned 3 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".db") returned 0x0 [0077.943] lstrlenW (lpString=".ndf") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".ndf") returned 0x0 [0077.943] lstrlenW (lpString=".NDF") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".NDF") returned 0x0 [0077.943] lstrlenW (lpString=".Mdf") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".Mdf") returned 0x0 [0077.943] lstrlenW (lpString=".dat") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".dat") returned 0x0 [0077.943] lstrlenW (lpString=".DAT") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".DAT") returned 0x0 [0077.943] lstrlenW (lpString=".ldf") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".ldf") returned 0x0 [0077.943] lstrlenW (lpString=".LDF") returned 4 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch=".LDF") returned 0x0 [0077.943] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.944] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.944] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.944] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.944] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19794561742) returned 1 [0077.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd458110, dwHighDateTime=0x1d585b4)) [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c450 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c450 | out: hHeap=0x260000) returned 1 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd408 [0077.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0077.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd408 | out: hHeap=0x260000) returned 1 [0077.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.945] GetLastError () returned 0x0 [0077.946] GetLastError () returned 0x0 [0077.946] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.946] GetLastError () returned 0x0 [0077.946] GetLastError () returned 0x0 [0077.949] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.949] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0077.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.950] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.951] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.951] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.951] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.951] CloseHandle (hObject=0xd8) returned 1 [0077.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0077.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.[deadmin@cock.li].deadmin")) returned 1 [0077.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0077.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.952] GetLastError () returned 0x0 [0077.953] RtlWakeConditionVariable () returned 0x0 [0077.953] GetCurrentThreadId () returned 0x998 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0077.953] lstrlenW (lpString=".vhd") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".vhd") returned 0x0 [0077.953] lstrlenW (lpString=".vhdx") returned 5 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0077.953] lstrlenW (lpString=".pst") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".pst") returned 0x0 [0077.953] lstrlenW (lpString=".ost") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".ost") returned 0x0 [0077.953] lstrlenW (lpString=".bak") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".bak") returned 0x0 [0077.953] lstrlenW (lpString=".bac") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".bac") returned 0x0 [0077.953] lstrlenW (lpString=".sys") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".sys") returned 0x0 [0077.953] lstrlenW (lpString=".v2i") returned 4 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".v2i") returned 0x0 [0077.953] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0077.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.954] lstrlenW (lpString=".sql") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".sql") returned 0x0 [0077.955] lstrlenW (lpString=".mdf") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".mdf") returned 0x0 [0077.955] lstrlenW (lpString=".txt") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".txt") returned 0x0 [0077.955] lstrlenW (lpString=".dbf") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".dbf") returned 0x0 [0077.955] lstrlenW (lpString=".ckp") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".ckp") returned 0x0 [0077.955] lstrlenW (lpString=".dacpac") returned 7 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0077.955] lstrlenW (lpString=".db3") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".db3") returned 0x0 [0077.955] lstrlenW (lpString=".dtxs") returned 5 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0077.955] lstrlenW (lpString=".mdt") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".mdt") returned 0x0 [0077.955] lstrlenW (lpString=".sdf") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".sdf") returned 0x0 [0077.955] lstrlenW (lpString=".MDF") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".MDF") returned 0x0 [0077.955] lstrlenW (lpString=".DBF") returned 4 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".DBF") returned 0x0 [0077.955] lstrlenW (lpString=".DB") returned 3 [0077.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".DB") returned 0x0 [0077.956] lstrlenW (lpString=".db") returned 3 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".db") returned 0x0 [0077.956] lstrlenW (lpString=".ndf") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".ndf") returned 0x0 [0077.956] lstrlenW (lpString=".NDF") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".NDF") returned 0x0 [0077.956] lstrlenW (lpString=".Mdf") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0077.956] lstrlenW (lpString=".dat") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".dat") returned 0x0 [0077.956] lstrlenW (lpString=".DAT") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".DAT") returned 0x0 [0077.956] lstrlenW (lpString=".ldf") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0077.956] lstrlenW (lpString=".LDF") returned 4 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch=".LDF") returned 0x0 [0077.956] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.956] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0077.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.957] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.957] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19795841413) returned 1 [0077.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd47e270, dwHighDateTime=0x1d585b4)) [0077.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb910 [0077.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb910 | out: hHeap=0x260000) returned 1 [0077.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cfbe8 [0077.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cfbe8 | out: hHeap=0x260000) returned 1 [0077.958] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0077.958] GetLastError () returned 0x0 [0077.958] GetLastError () returned 0x0 [0077.958] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0077.958] GetLastError () returned 0x0 [0077.959] GetLastError () returned 0x0 [0077.962] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.962] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0077.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.963] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.963] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.963] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.963] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.963] CloseHandle (hObject=0xd8) returned 1 [0077.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.963] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0077.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.965] GetLastError () returned 0x0 [0077.965] RtlWakeConditionVariable () returned 0x0 [0077.965] GetCurrentThreadId () returned 0x998 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".ldf") returned 0x0 [0077.965] lstrlenW (lpString=".vhd") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".vhd") returned 0x0 [0077.965] lstrlenW (lpString=".vhdx") returned 5 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".vhdx") returned 0x0 [0077.965] lstrlenW (lpString=".pst") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".pst") returned 0x0 [0077.965] lstrlenW (lpString=".ost") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".ost") returned 0x0 [0077.965] lstrlenW (lpString=".bak") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".bak") returned 0x0 [0077.965] lstrlenW (lpString=".bac") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".bac") returned 0x0 [0077.965] lstrlenW (lpString=".sys") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".sys") returned 0x0 [0077.965] lstrlenW (lpString=".v2i") returned 4 [0077.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".v2i") returned 0x0 [0077.966] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0077.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.036] lstrlenW (lpString=".sql") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".sql") returned 0x0 [0078.036] lstrlenW (lpString=".mdf") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".mdf") returned 0x0 [0078.036] lstrlenW (lpString=".txt") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".txt") returned 0x0 [0078.036] lstrlenW (lpString=".dbf") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".dbf") returned 0x0 [0078.036] lstrlenW (lpString=".ckp") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".ckp") returned 0x0 [0078.036] lstrlenW (lpString=".dacpac") returned 7 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".dacpac") returned 0x0 [0078.036] lstrlenW (lpString=".db3") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".db3") returned 0x0 [0078.036] lstrlenW (lpString=".dtxs") returned 5 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".dtxs") returned 0x0 [0078.036] lstrlenW (lpString=".mdt") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".mdt") returned 0x0 [0078.036] lstrlenW (lpString=".sdf") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".sdf") returned 0x0 [0078.036] lstrlenW (lpString=".MDF") returned 4 [0078.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".MDF") returned 0x0 [0078.036] lstrlenW (lpString=".DBF") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".DBF") returned 0x0 [0078.037] lstrlenW (lpString=".DB") returned 3 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".DB") returned 0x0 [0078.037] lstrlenW (lpString=".db") returned 3 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".db") returned 0x0 [0078.037] lstrlenW (lpString=".ndf") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".ndf") returned 0x0 [0078.037] lstrlenW (lpString=".NDF") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".NDF") returned 0x0 [0078.037] lstrlenW (lpString=".Mdf") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".Mdf") returned 0x0 [0078.037] lstrlenW (lpString=".dat") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".dat") returned 0x0 [0078.037] lstrlenW (lpString=".DAT") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".DAT") returned 0x0 [0078.037] lstrlenW (lpString=".ldf") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".ldf") returned 0x0 [0078.037] lstrlenW (lpString=".LDF") returned 4 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch=".LDF") returned 0x0 [0078.037] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.037] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0078.038] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.038] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.038] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19803951105) returned 1 [0078.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd53c950, dwHighDateTime=0x1d585b4)) [0078.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cba28 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cba28 | out: hHeap=0x260000) returned 1 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0078.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.039] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.039] GetLastError () returned 0x0 [0078.039] GetLastError () returned 0x0 [0078.040] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.040] GetLastError () returned 0x0 [0078.040] GetLastError () returned 0x0 [0078.042] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffeb8a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.042] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x14760, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x14760, lpOverlapped=0x0) returned 1 [0078.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.043] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.043] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.043] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.043] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.043] CloseHandle (hObject=0x11c) returned 1 [0078.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.043] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.044] GetLastError () returned 0x0 [0078.045] RtlWakeConditionVariable () returned 0x0 [0078.045] GetCurrentThreadId () returned 0x998 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".ldf") returned 0x0 [0078.045] lstrlenW (lpString=".vhd") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".vhd") returned 0x0 [0078.045] lstrlenW (lpString=".vhdx") returned 5 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".vhdx") returned 0x0 [0078.045] lstrlenW (lpString=".pst") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".pst") returned 0x0 [0078.045] lstrlenW (lpString=".ost") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".ost") returned 0x0 [0078.045] lstrlenW (lpString=".bak") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".bak") returned 0x0 [0078.045] lstrlenW (lpString=".bac") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".bac") returned 0x0 [0078.045] lstrlenW (lpString=".sys") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".sys") returned 0x0 [0078.045] lstrlenW (lpString=".v2i") returned 4 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".v2i") returned 0x0 [0078.045] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.053] lstrlenW (lpString=".sql") returned 4 [0078.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".sql") returned 0x0 [0078.053] lstrlenW (lpString=".mdf") returned 4 [0078.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".mdf") returned 0x0 [0078.053] lstrlenW (lpString=".txt") returned 4 [0078.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".txt") returned 0x0 [0078.053] lstrlenW (lpString=".dbf") returned 4 [0078.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".dbf") returned 0x0 [0078.053] lstrlenW (lpString=".ckp") returned 4 [0078.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".ckp") returned 0x0 [0078.053] lstrlenW (lpString=".dacpac") returned 7 [0078.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".dacpac") returned 0x0 [0078.054] lstrlenW (lpString=".db3") returned 4 [0078.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".db3") returned 0x0 [0078.054] lstrlenW (lpString=".dtxs") returned 5 [0078.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".dtxs") returned 0x0 [0078.054] lstrlenW (lpString=".mdt") returned 4 [0078.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".mdt") returned 0x0 [0078.054] lstrlenW (lpString=".sdf") returned 4 [0078.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".sdf") returned 0x0 [0078.054] lstrlenW (lpString=".MDF") returned 4 [0078.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".MDF") returned 0x0 [0078.055] lstrlenW (lpString=".DBF") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".DBF") returned 0x0 [0078.055] lstrlenW (lpString=".DB") returned 3 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".DB") returned 0x0 [0078.055] lstrlenW (lpString=".db") returned 3 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".db") returned 0x0 [0078.055] lstrlenW (lpString=".ndf") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".ndf") returned 0x0 [0078.055] lstrlenW (lpString=".NDF") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".NDF") returned 0x0 [0078.055] lstrlenW (lpString=".Mdf") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".Mdf") returned 0x0 [0078.055] lstrlenW (lpString=".dat") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".dat") returned 0x0 [0078.055] lstrlenW (lpString=".DAT") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".DAT") returned 0x0 [0078.055] lstrlenW (lpString=".ldf") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".ldf") returned 0x0 [0078.055] lstrlenW (lpString=".LDF") returned 4 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch=".LDF") returned 0x0 [0078.055] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.055] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0078.056] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.056] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.056] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19805760059) returned 1 [0078.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd562ab0, dwHighDateTime=0x1d585b4)) [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cba60 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cba60 | out: hHeap=0x260000) returned 1 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d02f8 [0078.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d02f8 | out: hHeap=0x260000) returned 1 [0078.057] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.057] GetLastError () returned 0x0 [0078.058] GetLastError () returned 0x0 [0078.058] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.058] GetLastError () returned 0x0 [0078.058] GetLastError () returned 0x0 [0078.064] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffde54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.064] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x21ac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x21ac, lpOverlapped=0x0) returned 1 [0078.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.064] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.065] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.065] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.065] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.065] CloseHandle (hObject=0x11c) returned 1 [0078.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.067] GetLastError () returned 0x0 [0078.067] RtlWakeConditionVariable () returned 0x0 [0078.067] GetCurrentThreadId () returned 0x998 [0078.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".ldf") returned 0x0 [0078.067] lstrlenW (lpString=".vhd") returned 4 [0078.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".vhd") returned 0x0 [0078.067] lstrlenW (lpString=".vhdx") returned 5 [0078.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".vhdx") returned 0x0 [0078.067] lstrlenW (lpString=".pst") returned 4 [0078.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".pst") returned 0x0 [0078.068] lstrlenW (lpString=".ost") returned 4 [0078.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".ost") returned 0x0 [0078.068] lstrlenW (lpString=".bak") returned 4 [0078.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".bak") returned 0x0 [0078.068] lstrlenW (lpString=".bac") returned 4 [0078.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".bac") returned 0x0 [0078.068] lstrlenW (lpString=".sys") returned 4 [0078.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".sys") returned 0x0 [0078.068] lstrlenW (lpString=".v2i") returned 4 [0078.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".v2i") returned 0x0 [0078.068] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.069] lstrlenW (lpString=".sql") returned 4 [0078.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".sql") returned 0x0 [0078.069] lstrlenW (lpString=".mdf") returned 4 [0078.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".mdf") returned 0x0 [0078.069] lstrlenW (lpString=".txt") returned 4 [0078.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".txt") returned 0x0 [0078.069] lstrlenW (lpString=".dbf") returned 4 [0078.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".dbf") returned 0x0 [0078.069] lstrlenW (lpString=".ckp") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".ckp") returned 0x0 [0078.070] lstrlenW (lpString=".dacpac") returned 7 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".dacpac") returned 0x0 [0078.070] lstrlenW (lpString=".db3") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".db3") returned 0x0 [0078.070] lstrlenW (lpString=".dtxs") returned 5 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".dtxs") returned 0x0 [0078.070] lstrlenW (lpString=".mdt") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".mdt") returned 0x0 [0078.070] lstrlenW (lpString=".sdf") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".sdf") returned 0x0 [0078.070] lstrlenW (lpString=".MDF") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".MDF") returned 0x0 [0078.070] lstrlenW (lpString=".DBF") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".DBF") returned 0x0 [0078.070] lstrlenW (lpString=".DB") returned 3 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".DB") returned 0x0 [0078.070] lstrlenW (lpString=".db") returned 3 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".db") returned 0x0 [0078.070] lstrlenW (lpString=".ndf") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".ndf") returned 0x0 [0078.070] lstrlenW (lpString=".NDF") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".NDF") returned 0x0 [0078.070] lstrlenW (lpString=".Mdf") returned 4 [0078.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".Mdf") returned 0x0 [0078.070] lstrlenW (lpString=".dat") returned 4 [0078.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".dat") returned 0x0 [0078.071] lstrlenW (lpString=".DAT") returned 4 [0078.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".DAT") returned 0x0 [0078.071] lstrlenW (lpString=".ldf") returned 4 [0078.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".ldf") returned 0x0 [0078.071] lstrlenW (lpString=".LDF") returned 4 [0078.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch=".LDF") returned 0x0 [0078.071] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.071] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0078.072] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.072] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.072] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19807311148) returned 1 [0078.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd588c10, dwHighDateTime=0x1d585b4)) [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbad0 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbad0 | out: hHeap=0x260000) returned 1 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.073] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.073] GetLastError () returned 0x0 [0078.073] GetLastError () returned 0x0 [0078.073] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.073] GetLastError () returned 0x0 [0078.073] GetLastError () returned 0x0 [0078.076] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa521, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.076] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5adf, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x5adf, lpOverlapped=0x0) returned 1 [0078.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.076] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.076] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.076] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.076] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.077] CloseHandle (hObject=0x11c) returned 1 [0078.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0078.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0078.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.078] GetLastError () returned 0x0 [0078.078] RtlWakeConditionVariable () returned 0x27e828 [0078.078] GetCurrentThreadId () returned 0x998 [0078.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".ldf") returned 0x0 [0078.078] lstrlenW (lpString=".vhd") returned 4 [0078.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".vhd") returned 0x0 [0078.078] lstrlenW (lpString=".vhdx") returned 5 [0078.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".vhdx") returned 0x0 [0078.078] lstrlenW (lpString=".pst") returned 4 [0078.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".pst") returned 0x0 [0078.078] lstrlenW (lpString=".ost") returned 4 [0078.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".ost") returned 0x0 [0078.079] lstrlenW (lpString=".bak") returned 4 [0078.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".bak") returned 0x0 [0078.079] lstrlenW (lpString=".bac") returned 4 [0078.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".bac") returned 0x0 [0078.079] lstrlenW (lpString=".sys") returned 4 [0078.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".sys") returned 0x0 [0078.079] lstrlenW (lpString=".v2i") returned 4 [0078.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".v2i") returned 0x0 [0078.079] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.080] lstrlenW (lpString=".sql") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".sql") returned 0x0 [0078.080] lstrlenW (lpString=".mdf") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".mdf") returned 0x0 [0078.080] lstrlenW (lpString=".txt") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".txt") returned 0x0 [0078.080] lstrlenW (lpString=".dbf") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".dbf") returned 0x0 [0078.080] lstrlenW (lpString=".ckp") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".ckp") returned 0x0 [0078.080] lstrlenW (lpString=".dacpac") returned 7 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".dacpac") returned 0x0 [0078.080] lstrlenW (lpString=".db3") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".db3") returned 0x0 [0078.080] lstrlenW (lpString=".dtxs") returned 5 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".dtxs") returned 0x0 [0078.080] lstrlenW (lpString=".mdt") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".mdt") returned 0x0 [0078.080] lstrlenW (lpString=".sdf") returned 4 [0078.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".sdf") returned 0x0 [0078.080] lstrlenW (lpString=".MDF") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".MDF") returned 0x0 [0078.081] lstrlenW (lpString=".DBF") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".DBF") returned 0x0 [0078.081] lstrlenW (lpString=".DB") returned 3 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".DB") returned 0x0 [0078.081] lstrlenW (lpString=".db") returned 3 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".db") returned 0x0 [0078.081] lstrlenW (lpString=".ndf") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".ndf") returned 0x0 [0078.081] lstrlenW (lpString=".NDF") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".NDF") returned 0x0 [0078.081] lstrlenW (lpString=".Mdf") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".Mdf") returned 0x0 [0078.081] lstrlenW (lpString=".dat") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".dat") returned 0x0 [0078.081] lstrlenW (lpString=".DAT") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".DAT") returned 0x0 [0078.081] lstrlenW (lpString=".ldf") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".ldf") returned 0x0 [0078.081] lstrlenW (lpString=".LDF") returned 4 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch=".LDF") returned 0x0 [0078.081] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.082] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x311400) returned 1 [0078.082] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.082] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.082] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19808363542) returned 1 [0078.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd5aed70, dwHighDateTime=0x1d585b4)) [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbb08 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbb08 | out: hHeap=0x260000) returned 1 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0640 [0078.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0640 | out: hHeap=0x260000) returned 1 [0078.083] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.083] GetLastError () returned 0x0 [0078.084] GetLastError () returned 0x0 [0078.084] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.084] GetLastError () returned 0x0 [0078.084] GetLastError () returned 0x0 [0078.175] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffdf08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.177] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x20f8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x20f8, lpOverlapped=0x0) returned 1 [0078.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.181] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.181] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.181] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.181] CloseHandle (hObject=0x11c) returned 1 [0078.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.398] GetLastError () returned 0x0 [0078.398] RtlWakeConditionVariable () returned 0x0 [0078.410] GetCurrentThreadId () returned 0x998 [0078.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".ldf") returned 0x0 [0078.410] lstrlenW (lpString=".vhd") returned 4 [0078.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".vhd") returned 0x0 [0078.410] lstrlenW (lpString=".vhdx") returned 5 [0078.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".vhdx") returned 0x0 [0078.410] lstrlenW (lpString=".pst") returned 4 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".pst") returned 0x0 [0078.411] lstrlenW (lpString=".ost") returned 4 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".ost") returned 0x0 [0078.411] lstrlenW (lpString=".bak") returned 4 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".bak") returned 0x0 [0078.411] lstrlenW (lpString=".bac") returned 4 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".bac") returned 0x0 [0078.411] lstrlenW (lpString=".sys") returned 4 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".sys") returned 0x0 [0078.411] lstrlenW (lpString=".v2i") returned 4 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".v2i") returned 0x0 [0078.411] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.412] lstrlenW (lpString=".sql") returned 4 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".sql") returned 0x0 [0078.412] lstrlenW (lpString=".mdf") returned 4 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".mdf") returned 0x0 [0078.412] lstrlenW (lpString=".txt") returned 4 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".txt") returned 0x0 [0078.412] lstrlenW (lpString=".dbf") returned 4 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".dbf") returned 0x0 [0078.412] lstrlenW (lpString=".ckp") returned 4 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".ckp") returned 0x0 [0078.412] lstrlenW (lpString=".dacpac") returned 7 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".dacpac") returned 0x0 [0078.412] lstrlenW (lpString=".db3") returned 4 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".db3") returned 0x0 [0078.412] lstrlenW (lpString=".dtxs") returned 5 [0078.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".dtxs") returned 0x0 [0078.412] lstrlenW (lpString=".mdt") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".mdt") returned 0x0 [0078.413] lstrlenW (lpString=".sdf") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".sdf") returned 0x0 [0078.413] lstrlenW (lpString=".MDF") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".MDF") returned 0x0 [0078.413] lstrlenW (lpString=".DBF") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".DBF") returned 0x0 [0078.413] lstrlenW (lpString=".DB") returned 3 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".DB") returned 0x0 [0078.413] lstrlenW (lpString=".db") returned 3 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".db") returned 0x0 [0078.413] lstrlenW (lpString=".ndf") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".ndf") returned 0x0 [0078.413] lstrlenW (lpString=".NDF") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".NDF") returned 0x0 [0078.413] lstrlenW (lpString=".Mdf") returned 4 [0078.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".Mdf") returned 0x0 [0078.414] lstrlenW (lpString=".dat") returned 4 [0078.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".dat") returned 0x0 [0078.414] lstrlenW (lpString=".DAT") returned 4 [0078.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".DAT") returned 0x0 [0078.414] lstrlenW (lpString=".ldf") returned 4 [0078.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".ldf") returned 0x0 [0078.414] lstrlenW (lpString=".LDF") returned 4 [0078.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch=".LDF") returned 0x0 [0078.414] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.414] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756c10) returned 1 [0078.415] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.415] CryptReleaseContext (hProv=0x2756c10, dwFlags=0x0) returned 1 [0078.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.415] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19841606720) returned 1 [0078.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd8cea50, dwHighDateTime=0x1d585b4)) [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c878 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c878 | out: hHeap=0x260000) returned 1 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f27a8 [0078.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.416] GetLastError () returned 0x0 [0078.416] GetLastError () returned 0x0 [0078.416] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.416] GetLastError () returned 0x0 [0078.416] GetLastError () returned 0x0 [0078.419] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.419] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.420] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.420] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.420] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.420] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.420] CloseHandle (hObject=0x11c) returned 1 [0078.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.[deadmin@cock.li].deadmin")) returned 1 [0078.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.423] GetLastError () returned 0x0 [0078.423] RtlWakeConditionVariable () returned 0x0 [0078.423] GetCurrentThreadId () returned 0x998 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".ldf") returned 0x0 [0078.423] lstrlenW (lpString=".vhd") returned 4 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".vhd") returned 0x0 [0078.423] lstrlenW (lpString=".vhdx") returned 5 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".vhdx") returned 0x0 [0078.423] lstrlenW (lpString=".pst") returned 4 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".pst") returned 0x0 [0078.423] lstrlenW (lpString=".ost") returned 4 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".ost") returned 0x0 [0078.423] lstrlenW (lpString=".bak") returned 4 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".bak") returned 0x0 [0078.423] lstrlenW (lpString=".bac") returned 4 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".bac") returned 0x0 [0078.423] lstrlenW (lpString=".sys") returned 4 [0078.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".sys") returned 0x0 [0078.424] lstrlenW (lpString=".v2i") returned 4 [0078.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".v2i") returned 0x0 [0078.424] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.425] lstrlenW (lpString=".sql") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".sql") returned 0x0 [0078.426] lstrlenW (lpString=".mdf") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".mdf") returned 0x0 [0078.426] lstrlenW (lpString=".txt") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".txt") returned 0x0 [0078.426] lstrlenW (lpString=".dbf") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".dbf") returned 0x0 [0078.426] lstrlenW (lpString=".ckp") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".ckp") returned 0x0 [0078.426] lstrlenW (lpString=".dacpac") returned 7 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".dacpac") returned 0x0 [0078.426] lstrlenW (lpString=".db3") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".db3") returned 0x0 [0078.426] lstrlenW (lpString=".dtxs") returned 5 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".dtxs") returned 0x0 [0078.426] lstrlenW (lpString=".mdt") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".mdt") returned 0x0 [0078.426] lstrlenW (lpString=".sdf") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".sdf") returned 0x0 [0078.426] lstrlenW (lpString=".MDF") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".MDF") returned 0x0 [0078.426] lstrlenW (lpString=".DBF") returned 4 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".DBF") returned 0x0 [0078.426] lstrlenW (lpString=".DB") returned 3 [0078.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".DB") returned 0x0 [0078.427] lstrlenW (lpString=".db") returned 3 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".db") returned 0x0 [0078.427] lstrlenW (lpString=".ndf") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".ndf") returned 0x0 [0078.427] lstrlenW (lpString=".NDF") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".NDF") returned 0x0 [0078.427] lstrlenW (lpString=".Mdf") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".Mdf") returned 0x0 [0078.427] lstrlenW (lpString=".dat") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".dat") returned 0x0 [0078.427] lstrlenW (lpString=".DAT") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".DAT") returned 0x0 [0078.427] lstrlenW (lpString=".ldf") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".ldf") returned 0x0 [0078.427] lstrlenW (lpString=".LDF") returned 4 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch=".LDF") returned 0x0 [0078.427] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.427] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756da8) returned 1 [0078.428] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.428] CryptReleaseContext (hProv=0x2756da8, dwFlags=0x0) returned 1 [0078.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.428] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19842940938) returned 1 [0078.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd8f4bb0, dwHighDateTime=0x1d585b4)) [0078.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c840 [0078.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c840 | out: hHeap=0x260000) returned 1 [0078.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.429] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.429] GetLastError () returned 0x0 [0078.429] GetLastError () returned 0x0 [0078.429] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.430] GetLastError () returned 0x0 [0078.430] GetLastError () returned 0x0 [0078.431] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.431] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.432] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.432] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.432] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.432] CloseHandle (hObject=0x11c) returned 1 [0078.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.[deadmin@cock.li].deadmin")) returned 1 [0078.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.434] GetLastError () returned 0x0 [0078.434] RtlWakeConditionVariable () returned 0x0 [0078.434] GetCurrentThreadId () returned 0x998 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".ldf") returned 0x0 [0078.434] lstrlenW (lpString=".vhd") returned 4 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".vhd") returned 0x0 [0078.434] lstrlenW (lpString=".vhdx") returned 5 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".vhdx") returned 0x0 [0078.434] lstrlenW (lpString=".pst") returned 4 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".pst") returned 0x0 [0078.434] lstrlenW (lpString=".ost") returned 4 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".ost") returned 0x0 [0078.434] lstrlenW (lpString=".bak") returned 4 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".bak") returned 0x0 [0078.434] lstrlenW (lpString=".bac") returned 4 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".bac") returned 0x0 [0078.434] lstrlenW (lpString=".sys") returned 4 [0078.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".sys") returned 0x0 [0078.434] lstrlenW (lpString=".v2i") returned 4 [0078.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".v2i") returned 0x0 [0078.435] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.436] lstrlenW (lpString=".sql") returned 4 [0078.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".sql") returned 0x0 [0078.436] lstrlenW (lpString=".mdf") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".mdf") returned 0x0 [0078.437] lstrlenW (lpString=".txt") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".txt") returned 0x0 [0078.437] lstrlenW (lpString=".dbf") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".dbf") returned 0x0 [0078.437] lstrlenW (lpString=".ckp") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".ckp") returned 0x0 [0078.437] lstrlenW (lpString=".dacpac") returned 7 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".dacpac") returned 0x0 [0078.437] lstrlenW (lpString=".db3") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".db3") returned 0x0 [0078.437] lstrlenW (lpString=".dtxs") returned 5 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".dtxs") returned 0x0 [0078.437] lstrlenW (lpString=".mdt") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".mdt") returned 0x0 [0078.437] lstrlenW (lpString=".sdf") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".sdf") returned 0x0 [0078.437] lstrlenW (lpString=".MDF") returned 4 [0078.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".MDF") returned 0x0 [0078.437] lstrlenW (lpString=".DBF") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".DBF") returned 0x0 [0078.438] lstrlenW (lpString=".DB") returned 3 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".DB") returned 0x0 [0078.438] lstrlenW (lpString=".db") returned 3 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".db") returned 0x0 [0078.438] lstrlenW (lpString=".ndf") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".ndf") returned 0x0 [0078.438] lstrlenW (lpString=".NDF") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".NDF") returned 0x0 [0078.438] lstrlenW (lpString=".Mdf") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".Mdf") returned 0x0 [0078.438] lstrlenW (lpString=".dat") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".dat") returned 0x0 [0078.438] lstrlenW (lpString=".DAT") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".DAT") returned 0x0 [0078.438] lstrlenW (lpString=".ldf") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".ldf") returned 0x0 [0078.438] lstrlenW (lpString=".LDF") returned 4 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch=".LDF") returned 0x0 [0078.438] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.438] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756da8) returned 1 [0078.439] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.439] CryptReleaseContext (hProv=0x2756da8, dwFlags=0x0) returned 1 [0078.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.439] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19844064266) returned 1 [0078.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbd91ad10, dwHighDateTime=0x1d585b4)) [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c7d0 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c7d0 | out: hHeap=0x260000) returned 1 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.440] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.440] GetLastError () returned 0x0 [0078.441] GetLastError () returned 0x0 [0078.441] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.441] GetLastError () returned 0x0 [0078.441] GetLastError () returned 0x0 [0078.554] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.554] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.556] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.556] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.686] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.686] CloseHandle (hObject=0x11c) returned 1 [0078.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.714] GetLastError () returned 0x0 [0078.714] RtlWakeConditionVariable () returned 0x27e828 [0078.714] GetCurrentThreadId () returned 0x998 [0078.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.714] lstrlenW (lpString=".vhd") returned 4 [0078.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".vhd") returned 0x0 [0078.715] lstrlenW (lpString=".vhdx") returned 5 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".vhdx") returned 0x0 [0078.715] lstrlenW (lpString=".pst") returned 4 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".pst") returned 0x0 [0078.715] lstrlenW (lpString=".ost") returned 4 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".ost") returned 0x0 [0078.715] lstrlenW (lpString=".bak") returned 4 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".bak") returned 0x0 [0078.715] lstrlenW (lpString=".bac") returned 4 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".bac") returned 0x0 [0078.715] lstrlenW (lpString=".sys") returned 4 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".sys") returned 0x0 [0078.715] lstrlenW (lpString=".v2i") returned 4 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".v2i") returned 0x0 [0078.715] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0078.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.716] lstrlenW (lpString=".sql") returned 4 [0078.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".sql") returned 0x0 [0078.716] lstrlenW (lpString=".mdf") returned 4 [0078.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".mdf") returned 0x0 [0078.716] lstrlenW (lpString=".txt") returned 4 [0078.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".txt") returned 0x0 [0078.716] lstrlenW (lpString=".dbf") returned 4 [0078.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".dbf") returned 0x0 [0078.716] lstrlenW (lpString=".ckp") returned 4 [0078.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".ckp") returned 0x0 [0078.716] lstrlenW (lpString=".dacpac") returned 7 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".dacpac") returned 0x0 [0078.717] lstrlenW (lpString=".db3") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".db3") returned 0x0 [0078.717] lstrlenW (lpString=".dtxs") returned 5 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".dtxs") returned 0x0 [0078.717] lstrlenW (lpString=".mdt") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".mdt") returned 0x0 [0078.717] lstrlenW (lpString=".sdf") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".sdf") returned 0x0 [0078.717] lstrlenW (lpString=".MDF") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".MDF") returned 0x0 [0078.717] lstrlenW (lpString=".DBF") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".DBF") returned 0x0 [0078.717] lstrlenW (lpString=".DB") returned 3 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".DB") returned 0x0 [0078.717] lstrlenW (lpString=".db") returned 3 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".db") returned 0x0 [0078.717] lstrlenW (lpString=".ndf") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".ndf") returned 0x0 [0078.717] lstrlenW (lpString=".NDF") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".NDF") returned 0x0 [0078.717] lstrlenW (lpString=".Mdf") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".Mdf") returned 0x0 [0078.717] lstrlenW (lpString=".dat") returned 4 [0078.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".dat") returned 0x0 [0078.717] lstrlenW (lpString=".DAT") returned 4 [0078.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".DAT") returned 0x0 [0078.725] lstrlenW (lpString=".ldf") returned 4 [0078.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.725] lstrlenW (lpString=".LDF") returned 4 [0078.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch=".LDF") returned 0x0 [0078.725] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.725] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756f40) returned 1 [0078.726] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.726] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.726] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19872726824) returned 1 [0078.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdbc85d0, dwHighDateTime=0x1d585b4)) [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbfa0 [0078.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbfa0 | out: hHeap=0x260000) returned 1 [0078.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3848 [0078.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.727] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.727] GetLastError () returned 0x0 [0078.727] GetLastError () returned 0x0 [0078.727] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] GetLastError () returned 0x0 [0078.730] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.730] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x281, lpOverlapped=0x0) returned 1 [0078.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.730] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.730] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.731] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.731] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.731] CloseHandle (hObject=0x11c) returned 1 [0078.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0078.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.732] GetLastError () returned 0x0 [0078.732] RtlWakeConditionVariable () returned 0x0 [0078.732] GetCurrentThreadId () returned 0x998 [0078.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.732] lstrlenW (lpString=".vhd") returned 4 [0078.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".vhd") returned 0x0 [0078.732] lstrlenW (lpString=".vhdx") returned 5 [0078.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".vhdx") returned 0x0 [0078.733] lstrlenW (lpString=".pst") returned 4 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".pst") returned 0x0 [0078.733] lstrlenW (lpString=".ost") returned 4 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".ost") returned 0x0 [0078.733] lstrlenW (lpString=".bak") returned 4 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".bak") returned 0x0 [0078.733] lstrlenW (lpString=".bac") returned 4 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".bac") returned 0x0 [0078.733] lstrlenW (lpString=".sys") returned 4 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".sys") returned 0x0 [0078.733] lstrlenW (lpString=".v2i") returned 4 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".v2i") returned 0x0 [0078.733] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0078.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.734] lstrlenW (lpString=".sql") returned 4 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".sql") returned 0x0 [0078.734] lstrlenW (lpString=".mdf") returned 4 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".mdf") returned 0x0 [0078.734] lstrlenW (lpString=".txt") returned 4 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".txt") returned 0x0 [0078.734] lstrlenW (lpString=".dbf") returned 4 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".dbf") returned 0x0 [0078.734] lstrlenW (lpString=".ckp") returned 4 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".ckp") returned 0x0 [0078.734] lstrlenW (lpString=".dacpac") returned 7 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".dacpac") returned 0x0 [0078.734] lstrlenW (lpString=".db3") returned 4 [0078.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".db3") returned 0x0 [0078.735] lstrlenW (lpString=".dtxs") returned 5 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".dtxs") returned 0x0 [0078.735] lstrlenW (lpString=".mdt") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".mdt") returned 0x0 [0078.735] lstrlenW (lpString=".sdf") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".sdf") returned 0x0 [0078.735] lstrlenW (lpString=".MDF") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".MDF") returned 0x0 [0078.735] lstrlenW (lpString=".DBF") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".DBF") returned 0x0 [0078.735] lstrlenW (lpString=".DB") returned 3 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".DB") returned 0x0 [0078.735] lstrlenW (lpString=".db") returned 3 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".db") returned 0x0 [0078.735] lstrlenW (lpString=".ndf") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".ndf") returned 0x0 [0078.735] lstrlenW (lpString=".NDF") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".NDF") returned 0x0 [0078.735] lstrlenW (lpString=".Mdf") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".Mdf") returned 0x0 [0078.735] lstrlenW (lpString=".dat") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".dat") returned 0x0 [0078.735] lstrlenW (lpString=".DAT") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".DAT") returned 0x0 [0078.735] lstrlenW (lpString=".ldf") returned 4 [0078.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".ldf") returned 0x0 [0078.736] lstrlenW (lpString=".LDF") returned 4 [0078.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch=".LDF") returned 0x0 [0078.736] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.736] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756f40) returned 1 [0078.737] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.737] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.737] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19873870121) returned 1 [0078.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdbee730, dwHighDateTime=0x1d585b4)) [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbfd8 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbfd8 | out: hHeap=0x260000) returned 1 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f34b8 [0078.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.738] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.738] GetLastError () returned 0x0 [0078.739] GetLastError () returned 0x0 [0078.739] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.739] GetLastError () returned 0x0 [0078.739] GetLastError () returned 0x0 [0078.740] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.740] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd1, lpOverlapped=0x0) returned 1 [0078.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.740] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.740] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.740] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.740] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.741] CloseHandle (hObject=0x11c) returned 1 [0078.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.741] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0078.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.742] GetLastError () returned 0x0 [0078.742] RtlWakeConditionVariable () returned 0x27e828 [0078.742] GetCurrentThreadId () returned 0x998 [0078.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.742] lstrlenW (lpString=".vhd") returned 4 [0078.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.742] lstrlenW (lpString=".vhdx") returned 5 [0078.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.742] lstrlenW (lpString=".pst") returned 4 [0078.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".pst") returned 0x0 [0078.742] lstrlenW (lpString=".ost") returned 4 [0078.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".ost") returned 0x0 [0078.742] lstrlenW (lpString=".bak") returned 4 [0078.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".bak") returned 0x0 [0078.743] lstrlenW (lpString=".bac") returned 4 [0078.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".bac") returned 0x0 [0078.743] lstrlenW (lpString=".sys") returned 4 [0078.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".sys") returned 0x0 [0078.743] lstrlenW (lpString=".v2i") returned 4 [0078.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.743] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.744] lstrlenW (lpString=".sql") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".sql") returned 0x0 [0078.744] lstrlenW (lpString=".mdf") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.744] lstrlenW (lpString=".txt") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".txt") returned 0x0 [0078.744] lstrlenW (lpString=".dbf") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.744] lstrlenW (lpString=".ckp") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.744] lstrlenW (lpString=".dacpac") returned 7 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.744] lstrlenW (lpString=".db3") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".db3") returned 0x0 [0078.744] lstrlenW (lpString=".dtxs") returned 5 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.744] lstrlenW (lpString=".mdt") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.744] lstrlenW (lpString=".sdf") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.744] lstrlenW (lpString=".MDF") returned 4 [0078.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.745] lstrlenW (lpString=".DBF") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.745] lstrlenW (lpString=".DB") returned 3 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".DB") returned 0x0 [0078.745] lstrlenW (lpString=".db") returned 3 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".db") returned 0x0 [0078.745] lstrlenW (lpString=".ndf") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.745] lstrlenW (lpString=".NDF") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.745] lstrlenW (lpString=".Mdf") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.745] lstrlenW (lpString=".dat") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".dat") returned 0x0 [0078.745] lstrlenW (lpString=".DAT") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.745] lstrlenW (lpString=".ldf") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.745] lstrlenW (lpString=".LDF") returned 4 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.745] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.745] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756f40) returned 1 [0078.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.746] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.746] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19874756659) returned 1 [0078.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdbee730, dwHighDateTime=0x1d585b4)) [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc010 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc010 | out: hHeap=0x260000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f31c0 [0078.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.747] GetLastError () returned 0x0 [0078.747] GetLastError () returned 0x0 [0078.748] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.748] GetLastError () returned 0x0 [0078.748] GetLastError () returned 0x0 [0078.749] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.749] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x72, lpOverlapped=0x0) returned 1 [0078.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.749] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.749] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.750] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.750] CloseHandle (hObject=0x11c) returned 1 [0078.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.751] GetLastError () returned 0x0 [0078.751] RtlWakeConditionVariable () returned 0x27e828 [0078.751] GetCurrentThreadId () returned 0x998 [0078.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.751] lstrlenW (lpString=".vhd") returned 4 [0078.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.751] lstrlenW (lpString=".vhdx") returned 5 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.752] lstrlenW (lpString=".pst") returned 4 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".pst") returned 0x0 [0078.752] lstrlenW (lpString=".ost") returned 4 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".ost") returned 0x0 [0078.752] lstrlenW (lpString=".bak") returned 4 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".bak") returned 0x0 [0078.752] lstrlenW (lpString=".bac") returned 4 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".bac") returned 0x0 [0078.752] lstrlenW (lpString=".sys") returned 4 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".sys") returned 0x0 [0078.752] lstrlenW (lpString=".v2i") returned 4 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.752] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.753] lstrlenW (lpString=".sql") returned 4 [0078.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".sql") returned 0x0 [0078.753] lstrlenW (lpString=".mdf") returned 4 [0078.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.753] lstrlenW (lpString=".txt") returned 4 [0078.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".txt") returned 0x0 [0078.753] lstrlenW (lpString=".dbf") returned 4 [0078.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.753] lstrlenW (lpString=".ckp") returned 4 [0078.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.753] lstrlenW (lpString=".dacpac") returned 7 [0078.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.754] lstrlenW (lpString=".db3") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".db3") returned 0x0 [0078.754] lstrlenW (lpString=".dtxs") returned 5 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.754] lstrlenW (lpString=".mdt") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.754] lstrlenW (lpString=".sdf") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.754] lstrlenW (lpString=".MDF") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.754] lstrlenW (lpString=".DBF") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.754] lstrlenW (lpString=".DB") returned 3 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".DB") returned 0x0 [0078.754] lstrlenW (lpString=".db") returned 3 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".db") returned 0x0 [0078.754] lstrlenW (lpString=".ndf") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.754] lstrlenW (lpString=".NDF") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.754] lstrlenW (lpString=".Mdf") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.754] lstrlenW (lpString=".dat") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".dat") returned 0x0 [0078.754] lstrlenW (lpString=".DAT") returned 4 [0078.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.755] lstrlenW (lpString=".ldf") returned 4 [0078.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.755] lstrlenW (lpString=".LDF") returned 4 [0078.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.755] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.755] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756f40) returned 1 [0078.756] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.756] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.756] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19875691926) returned 1 [0078.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdc14890, dwHighDateTime=0x1d585b4)) [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc048 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc048 | out: hHeap=0x260000) returned 1 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3420 [0078.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.756] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.757] GetLastError () returned 0x0 [0078.757] GetLastError () returned 0x0 [0078.757] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.757] GetLastError () returned 0x0 [0078.757] GetLastError () returned 0x0 [0078.760] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.760] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0078.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.760] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.760] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.760] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.760] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.761] CloseHandle (hObject=0x11c) returned 1 [0078.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.763] GetLastError () returned 0x0 [0078.766] RtlWakeConditionVariable () returned 0x0 [0078.766] GetCurrentThreadId () returned 0x998 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".ldf") returned 0x0 [0078.776] lstrlenW (lpString=".vhd") returned 4 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".vhd") returned 0x0 [0078.776] lstrlenW (lpString=".vhdx") returned 5 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".vhdx") returned 0x0 [0078.776] lstrlenW (lpString=".pst") returned 4 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".pst") returned 0x0 [0078.776] lstrlenW (lpString=".ost") returned 4 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".ost") returned 0x0 [0078.776] lstrlenW (lpString=".bak") returned 4 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".bak") returned 0x0 [0078.776] lstrlenW (lpString=".bac") returned 4 [0078.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".bac") returned 0x0 [0078.776] lstrlenW (lpString=".sys") returned 4 [0078.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".sys") returned 0x0 [0078.777] lstrlenW (lpString=".v2i") returned 4 [0078.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".v2i") returned 0x0 [0078.777] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0078.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.781] lstrlenW (lpString=".sql") returned 4 [0078.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".sql") returned 0x0 [0078.781] lstrlenW (lpString=".mdf") returned 4 [0078.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".mdf") returned 0x0 [0078.781] lstrlenW (lpString=".txt") returned 4 [0078.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".txt") returned 0x0 [0078.781] lstrlenW (lpString=".dbf") returned 4 [0078.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".dbf") returned 0x0 [0078.781] lstrlenW (lpString=".ckp") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".ckp") returned 0x0 [0078.782] lstrlenW (lpString=".dacpac") returned 7 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".dacpac") returned 0x0 [0078.782] lstrlenW (lpString=".db3") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".db3") returned 0x0 [0078.782] lstrlenW (lpString=".dtxs") returned 5 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".dtxs") returned 0x0 [0078.782] lstrlenW (lpString=".mdt") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".mdt") returned 0x0 [0078.782] lstrlenW (lpString=".sdf") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".sdf") returned 0x0 [0078.782] lstrlenW (lpString=".MDF") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".MDF") returned 0x0 [0078.782] lstrlenW (lpString=".DBF") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".DBF") returned 0x0 [0078.782] lstrlenW (lpString=".DB") returned 3 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".DB") returned 0x0 [0078.782] lstrlenW (lpString=".db") returned 3 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".db") returned 0x0 [0078.782] lstrlenW (lpString=".ndf") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".ndf") returned 0x0 [0078.782] lstrlenW (lpString=".NDF") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".NDF") returned 0x0 [0078.782] lstrlenW (lpString=".Mdf") returned 4 [0078.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".Mdf") returned 0x0 [0078.782] lstrlenW (lpString=".dat") returned 4 [0078.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".dat") returned 0x0 [0078.783] lstrlenW (lpString=".DAT") returned 4 [0078.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".DAT") returned 0x0 [0078.783] lstrlenW (lpString=".ldf") returned 4 [0078.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".ldf") returned 0x0 [0078.783] lstrlenW (lpString=".LDF") returned 4 [0078.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch=".LDF") returned 0x0 [0078.783] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.783] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27570d8) returned 1 [0078.784] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.784] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.784] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19878506813) returned 1 [0078.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdc60b50, dwHighDateTime=0x1d585b4)) [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc0b8 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc0b8 | out: hHeap=0x260000) returned 1 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.785] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.785] GetLastError () returned 0x0 [0078.785] GetLastError () returned 0x0 [0078.785] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.785] GetLastError () returned 0x0 [0078.785] GetLastError () returned 0x0 [0078.796] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.796] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.797] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.797] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.827] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.827] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.827] CloseHandle (hObject=0x11c) returned 1 [0078.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.[deadmin@cock.li].deadmin")) returned 1 [0078.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.829] GetLastError () returned 0x0 [0078.829] RtlWakeConditionVariable () returned 0x27e828 [0078.829] GetCurrentThreadId () returned 0x998 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.829] lstrlenW (lpString=".vhd") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".vhd") returned 0x0 [0078.829] lstrlenW (lpString=".vhdx") returned 5 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".vhdx") returned 0x0 [0078.829] lstrlenW (lpString=".pst") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".pst") returned 0x0 [0078.829] lstrlenW (lpString=".ost") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".ost") returned 0x0 [0078.829] lstrlenW (lpString=".bak") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".bak") returned 0x0 [0078.829] lstrlenW (lpString=".bac") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".bac") returned 0x0 [0078.829] lstrlenW (lpString=".sys") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".sys") returned 0x0 [0078.829] lstrlenW (lpString=".v2i") returned 4 [0078.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".v2i") returned 0x0 [0078.830] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0078.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.830] lstrlenW (lpString=".sql") returned 4 [0078.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".sql") returned 0x0 [0078.831] lstrlenW (lpString=".mdf") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".mdf") returned 0x0 [0078.831] lstrlenW (lpString=".txt") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".txt") returned 0x0 [0078.831] lstrlenW (lpString=".dbf") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".dbf") returned 0x0 [0078.831] lstrlenW (lpString=".ckp") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".ckp") returned 0x0 [0078.831] lstrlenW (lpString=".dacpac") returned 7 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".dacpac") returned 0x0 [0078.831] lstrlenW (lpString=".db3") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".db3") returned 0x0 [0078.831] lstrlenW (lpString=".dtxs") returned 5 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".dtxs") returned 0x0 [0078.831] lstrlenW (lpString=".mdt") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".mdt") returned 0x0 [0078.831] lstrlenW (lpString=".sdf") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".sdf") returned 0x0 [0078.831] lstrlenW (lpString=".MDF") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".MDF") returned 0x0 [0078.831] lstrlenW (lpString=".DBF") returned 4 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".DBF") returned 0x0 [0078.831] lstrlenW (lpString=".DB") returned 3 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".DB") returned 0x0 [0078.831] lstrlenW (lpString=".db") returned 3 [0078.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".db") returned 0x0 [0078.832] lstrlenW (lpString=".ndf") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".ndf") returned 0x0 [0078.832] lstrlenW (lpString=".NDF") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".NDF") returned 0x0 [0078.832] lstrlenW (lpString=".Mdf") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".Mdf") returned 0x0 [0078.832] lstrlenW (lpString=".dat") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".dat") returned 0x0 [0078.832] lstrlenW (lpString=".DAT") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".DAT") returned 0x0 [0078.832] lstrlenW (lpString=".ldf") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.832] lstrlenW (lpString=".LDF") returned 4 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch=".LDF") returned 0x0 [0078.832] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.832] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27570d8) returned 1 [0078.833] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.833] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.833] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19883431942) returned 1 [0078.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdcd2f70, dwHighDateTime=0x1d585b4)) [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x290f0a8 [0078.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290f0a8 | out: hHeap=0x260000) returned 1 [0078.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3680 [0078.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.834] GetLastError () returned 0x0 [0078.834] GetLastError () returned 0x0 [0078.834] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.834] GetLastError () returned 0x0 [0078.835] GetLastError () returned 0x0 [0078.870] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.870] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x26d, lpOverlapped=0x0) returned 1 [0078.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.870] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.871] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.871] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.871] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.871] CloseHandle (hObject=0x11c) returned 1 [0078.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0078.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.872] GetLastError () returned 0x0 [0078.873] RtlWakeConditionVariable () returned 0x27e828 [0078.873] GetCurrentThreadId () returned 0x998 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.873] lstrlenW (lpString=".vhd") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0078.873] lstrlenW (lpString=".vhdx") returned 5 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0078.873] lstrlenW (lpString=".pst") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".pst") returned 0x0 [0078.873] lstrlenW (lpString=".ost") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".ost") returned 0x0 [0078.873] lstrlenW (lpString=".bak") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".bak") returned 0x0 [0078.873] lstrlenW (lpString=".bac") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".bac") returned 0x0 [0078.873] lstrlenW (lpString=".sys") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".sys") returned 0x0 [0078.873] lstrlenW (lpString=".v2i") returned 4 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0078.873] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0078.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.875] lstrlenW (lpString=".sql") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".sql") returned 0x0 [0078.875] lstrlenW (lpString=".mdf") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0078.875] lstrlenW (lpString=".txt") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".txt") returned 0x0 [0078.875] lstrlenW (lpString=".dbf") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0078.875] lstrlenW (lpString=".ckp") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0078.875] lstrlenW (lpString=".dacpac") returned 7 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0078.875] lstrlenW (lpString=".db3") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".db3") returned 0x0 [0078.875] lstrlenW (lpString=".dtxs") returned 5 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0078.875] lstrlenW (lpString=".mdt") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0078.875] lstrlenW (lpString=".sdf") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0078.875] lstrlenW (lpString=".MDF") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0078.875] lstrlenW (lpString=".DBF") returned 4 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0078.875] lstrlenW (lpString=".DB") returned 3 [0078.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".DB") returned 0x0 [0078.876] lstrlenW (lpString=".db") returned 3 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".db") returned 0x0 [0078.876] lstrlenW (lpString=".ndf") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0078.876] lstrlenW (lpString=".NDF") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0078.876] lstrlenW (lpString=".Mdf") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0078.876] lstrlenW (lpString=".dat") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".dat") returned 0x0 [0078.876] lstrlenW (lpString=".DAT") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0078.876] lstrlenW (lpString=".ldf") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0078.876] lstrlenW (lpString=".LDF") returned 4 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0078.876] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.876] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27570d8) returned 1 [0078.877] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.877] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.877] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19887842367) returned 1 [0078.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdd45390, dwHighDateTime=0x1d585b4)) [0078.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761450 [0078.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761450 | out: hHeap=0x260000) returned 1 [0078.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0078.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.878] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.878] GetLastError () returned 0x0 [0078.878] GetLastError () returned 0x0 [0078.878] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.878] GetLastError () returned 0x0 [0078.879] GetLastError () returned 0x0 [0078.880] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.880] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x71, lpOverlapped=0x0) returned 1 [0078.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.880] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.880] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.880] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.880] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.880] CloseHandle (hObject=0x11c) returned 1 [0078.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0078.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.882] GetLastError () returned 0x0 [0078.882] RtlWakeConditionVariable () returned 0x27e828 [0078.882] GetCurrentThreadId () returned 0x998 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".ldf") returned 0x0 [0078.882] lstrlenW (lpString=".vhd") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".vhd") returned 0x0 [0078.882] lstrlenW (lpString=".vhdx") returned 5 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".vhdx") returned 0x0 [0078.882] lstrlenW (lpString=".pst") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".pst") returned 0x0 [0078.882] lstrlenW (lpString=".ost") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".ost") returned 0x0 [0078.882] lstrlenW (lpString=".bak") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".bak") returned 0x0 [0078.882] lstrlenW (lpString=".bac") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".bac") returned 0x0 [0078.882] lstrlenW (lpString=".sys") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".sys") returned 0x0 [0078.882] lstrlenW (lpString=".v2i") returned 4 [0078.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".v2i") returned 0x0 [0078.883] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0078.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0078.883] lstrlenW (lpString=".sql") returned 4 [0078.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".sql") returned 0x0 [0078.884] lstrlenW (lpString=".mdf") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".mdf") returned 0x0 [0078.884] lstrlenW (lpString=".txt") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".txt") returned 0x0 [0078.884] lstrlenW (lpString=".dbf") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".dbf") returned 0x0 [0078.884] lstrlenW (lpString=".ckp") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".ckp") returned 0x0 [0078.884] lstrlenW (lpString=".dacpac") returned 7 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".dacpac") returned 0x0 [0078.884] lstrlenW (lpString=".db3") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".db3") returned 0x0 [0078.884] lstrlenW (lpString=".dtxs") returned 5 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".dtxs") returned 0x0 [0078.884] lstrlenW (lpString=".mdt") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".mdt") returned 0x0 [0078.884] lstrlenW (lpString=".sdf") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".sdf") returned 0x0 [0078.884] lstrlenW (lpString=".MDF") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".MDF") returned 0x0 [0078.884] lstrlenW (lpString=".DBF") returned 4 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".DBF") returned 0x0 [0078.884] lstrlenW (lpString=".DB") returned 3 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".DB") returned 0x0 [0078.884] lstrlenW (lpString=".db") returned 3 [0078.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".db") returned 0x0 [0078.885] lstrlenW (lpString=".ndf") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".ndf") returned 0x0 [0078.885] lstrlenW (lpString=".NDF") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".NDF") returned 0x0 [0078.885] lstrlenW (lpString=".Mdf") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".Mdf") returned 0x0 [0078.885] lstrlenW (lpString=".dat") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".dat") returned 0x0 [0078.885] lstrlenW (lpString=".DAT") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".DAT") returned 0x0 [0078.885] lstrlenW (lpString=".ldf") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".ldf") returned 0x0 [0078.885] lstrlenW (lpString=".LDF") returned 4 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch=".LDF") returned 0x0 [0078.885] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.885] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27570d8) returned 1 [0078.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.886] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.886] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19888733575) returned 1 [0078.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdd45390, dwHighDateTime=0x1d585b4)) [0078.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761418 [0078.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761418 | out: hHeap=0x260000) returned 1 [0078.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0078.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dcd8 [0078.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0078.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0078.887] GetLastError () returned 0x0 [0078.887] GetLastError () returned 0x0 [0078.887] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0078.887] GetLastError () returned 0x0 [0078.888] GetLastError () returned 0x0 [0079.003] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.003] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.006] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.006] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.161] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.161] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.161] CloseHandle (hObject=0x11c) returned 1 [0079.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.[deadmin@cock.li].deadmin")) returned 1 [0079.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.164] GetLastError () returned 0x0 [0079.164] RtlWakeConditionVariable () returned 0x0 [0079.164] GetCurrentThreadId () returned 0x998 [0079.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".ldf") returned 0x0 [0079.164] lstrlenW (lpString=".vhd") returned 4 [0079.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".vhd") returned 0x0 [0079.164] lstrlenW (lpString=".vhdx") returned 5 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".vhdx") returned 0x0 [0079.165] lstrlenW (lpString=".pst") returned 4 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".pst") returned 0x0 [0079.165] lstrlenW (lpString=".ost") returned 4 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".ost") returned 0x0 [0079.165] lstrlenW (lpString=".bak") returned 4 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".bak") returned 0x0 [0079.165] lstrlenW (lpString=".bac") returned 4 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".bac") returned 0x0 [0079.165] lstrlenW (lpString=".sys") returned 4 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".sys") returned 0x0 [0079.165] lstrlenW (lpString=".v2i") returned 4 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".v2i") returned 0x0 [0079.165] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch="s\r\n.v2i") returned 0x0 [0079.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.167] lstrlenW (lpString=".sql") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".sql") returned 0x0 [0079.167] lstrlenW (lpString=".mdf") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".mdf") returned 0x0 [0079.167] lstrlenW (lpString=".txt") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".txt") returned 0x0 [0079.167] lstrlenW (lpString=".dbf") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".dbf") returned 0x0 [0079.167] lstrlenW (lpString=".ckp") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".ckp") returned 0x0 [0079.167] lstrlenW (lpString=".dacpac") returned 7 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".dacpac") returned 0x0 [0079.167] lstrlenW (lpString=".db3") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".db3") returned 0x0 [0079.167] lstrlenW (lpString=".dtxs") returned 5 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".dtxs") returned 0x0 [0079.167] lstrlenW (lpString=".mdt") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".mdt") returned 0x0 [0079.167] lstrlenW (lpString=".sdf") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".sdf") returned 0x0 [0079.167] lstrlenW (lpString=".MDF") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".MDF") returned 0x0 [0079.167] lstrlenW (lpString=".DBF") returned 4 [0079.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".DBF") returned 0x0 [0079.167] lstrlenW (lpString=".DB") returned 3 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".DB") returned 0x0 [0079.168] lstrlenW (lpString=".db") returned 3 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".db") returned 0x0 [0079.168] lstrlenW (lpString=".ndf") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".ndf") returned 0x0 [0079.168] lstrlenW (lpString=".NDF") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".NDF") returned 0x0 [0079.168] lstrlenW (lpString=".Mdf") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".Mdf") returned 0x0 [0079.168] lstrlenW (lpString=".dat") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".dat") returned 0x0 [0079.168] lstrlenW (lpString=".DAT") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".DAT") returned 0x0 [0079.168] lstrlenW (lpString=".ldf") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".ldf") returned 0x0 [0079.168] lstrlenW (lpString=".LDF") returned 4 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch=".LDF") returned 0x0 [0079.168] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.168] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756fc8) returned 1 [0079.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.169] CryptReleaseContext (hProv=0x2756fc8, dwFlags=0x0) returned 1 [0079.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0079.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0079.169] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19917050080) returned 1 [0079.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbdff2c50, dwHighDateTime=0x1d585b4)) [0079.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761178 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761178 | out: hHeap=0x260000) returned 1 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0ec8 [0079.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0079.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0ec8 | out: hHeap=0x260000) returned 1 [0079.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0079.170] GetLastError () returned 0x0 [0079.171] GetLastError () returned 0x0 [0079.171] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0079.171] GetLastError () returned 0x0 [0079.171] GetLastError () returned 0x0 [0079.173] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.173] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x99, lpOverlapped=0x0) returned 1 [0079.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.173] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.173] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.173] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.173] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.173] CloseHandle (hObject=0x11c) returned 1 [0079.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.[deadmin@cock.li].deadmin")) returned 1 [0079.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.175] GetLastError () returned 0x0 [0079.175] RtlWakeConditionVariable () returned 0x27e828 [0079.175] GetCurrentThreadId () returned 0x998 [0079.176] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0079.176] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0079.176] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0079.176] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0079.177] CloseHandle (hObject=0x11c) returned 1 [0079.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348f38 | out: hHeap=0x260000) returned 1 [0079.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0079.178] RtlWakeConditionVariable () returned 0x27e828 [0079.178] GetCurrentThreadId () returned 0x998 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".ldf") returned 0x0 [0079.178] lstrlenW (lpString=".vhd") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".vhd") returned 0x0 [0079.178] lstrlenW (lpString=".vhdx") returned 5 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".vhdx") returned 0x0 [0079.178] lstrlenW (lpString=".pst") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".pst") returned 0x0 [0079.178] lstrlenW (lpString=".ost") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".ost") returned 0x0 [0079.178] lstrlenW (lpString=".bak") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".bak") returned 0x0 [0079.178] lstrlenW (lpString=".bac") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".bac") returned 0x0 [0079.178] lstrlenW (lpString=".sys") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".sys") returned 0x0 [0079.178] lstrlenW (lpString=".v2i") returned 4 [0079.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".v2i") returned 0x0 [0079.178] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.179] lstrlenW (lpString=".sql") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".sql") returned 0x0 [0079.180] lstrlenW (lpString=".mdf") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".mdf") returned 0x0 [0079.180] lstrlenW (lpString=".txt") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".txt") returned 0x0 [0079.180] lstrlenW (lpString=".dbf") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".dbf") returned 0x0 [0079.180] lstrlenW (lpString=".ckp") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".ckp") returned 0x0 [0079.180] lstrlenW (lpString=".dacpac") returned 7 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".dacpac") returned 0x0 [0079.180] lstrlenW (lpString=".db3") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".db3") returned 0x0 [0079.180] lstrlenW (lpString=".dtxs") returned 5 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".dtxs") returned 0x0 [0079.180] lstrlenW (lpString=".mdt") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".mdt") returned 0x0 [0079.180] lstrlenW (lpString=".sdf") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".sdf") returned 0x0 [0079.180] lstrlenW (lpString=".MDF") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".MDF") returned 0x0 [0079.180] lstrlenW (lpString=".DBF") returned 4 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".DBF") returned 0x0 [0079.180] lstrlenW (lpString=".DB") returned 3 [0079.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".DB") returned 0x0 [0079.180] lstrlenW (lpString=".db") returned 3 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".db") returned 0x0 [0079.181] lstrlenW (lpString=".ndf") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".ndf") returned 0x0 [0079.181] lstrlenW (lpString=".NDF") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".NDF") returned 0x0 [0079.181] lstrlenW (lpString=".Mdf") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".Mdf") returned 0x0 [0079.181] lstrlenW (lpString=".dat") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".dat") returned 0x0 [0079.181] lstrlenW (lpString=".DAT") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".DAT") returned 0x0 [0079.181] lstrlenW (lpString=".ldf") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".ldf") returned 0x0 [0079.181] lstrlenW (lpString=".LDF") returned 4 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch=".LDF") returned 0x0 [0079.181] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.181] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756fc8) returned 1 [0079.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.182] CryptReleaseContext (hProv=0x2756fc8, dwFlags=0x0) returned 1 [0079.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0079.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0079.182] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19918342269) returned 1 [0079.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe018db0, dwHighDateTime=0x1d585b4)) [0079.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0079.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0079.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0079.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761108 [0079.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761108 | out: hHeap=0x260000) returned 1 [0079.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e5c0 [0079.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.183] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0079.183] GetLastError () returned 0x0 [0079.183] GetLastError () returned 0x0 [0079.183] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0079.183] GetLastError () returned 0x0 [0079.184] GetLastError () returned 0x0 [0079.186] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.186] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.187] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.187] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.655] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.655] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.655] CloseHandle (hObject=0x11c) returned 1 [0079.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.[deadmin@cock.li].deadmin")) returned 1 [0079.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.679] GetLastError () returned 0x0 [0079.679] RtlWakeConditionVariable () returned 0x0 [0079.679] GetCurrentThreadId () returned 0x998 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.680] lstrlenW (lpString=".vhd") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0079.680] lstrlenW (lpString=".vhdx") returned 5 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0079.680] lstrlenW (lpString=".pst") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0079.680] lstrlenW (lpString=".ost") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0079.680] lstrlenW (lpString=".bak") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0079.680] lstrlenW (lpString=".bac") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0079.680] lstrlenW (lpString=".sys") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0079.680] lstrlenW (lpString=".v2i") returned 4 [0079.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0079.680] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.683] lstrlenW (lpString=".sql") returned 4 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0079.683] lstrlenW (lpString=".mdf") returned 4 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0079.683] lstrlenW (lpString=".txt") returned 4 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0079.683] lstrlenW (lpString=".dbf") returned 4 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0079.683] lstrlenW (lpString=".ckp") returned 4 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0079.683] lstrlenW (lpString=".dacpac") returned 7 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0079.683] lstrlenW (lpString=".db3") returned 4 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0079.683] lstrlenW (lpString=".dtxs") returned 5 [0079.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0079.684] lstrlenW (lpString=".mdt") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0079.684] lstrlenW (lpString=".sdf") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0079.684] lstrlenW (lpString=".MDF") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0079.684] lstrlenW (lpString=".DBF") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0079.684] lstrlenW (lpString=".DB") returned 3 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0079.684] lstrlenW (lpString=".db") returned 3 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0079.684] lstrlenW (lpString=".ndf") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0079.684] lstrlenW (lpString=".NDF") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0079.684] lstrlenW (lpString=".Mdf") returned 4 [0079.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0079.684] lstrlenW (lpString=".dat") returned 4 [0079.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0079.685] lstrlenW (lpString=".DAT") returned 4 [0079.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0079.685] lstrlenW (lpString=".ldf") returned 4 [0079.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.685] lstrlenW (lpString=".LDF") returned 4 [0079.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0079.685] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.685] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757380) returned 1 [0079.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.686] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0079.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0079.687] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19968772886) returned 1 [0079.687] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe501b10, dwHighDateTime=0x1d585b4)) [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ce28 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ce28 | out: hHeap=0x260000) returned 1 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275df38 [0079.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0079.688] GetLastError () returned 0x0 [0079.688] GetLastError () returned 0x0 [0079.688] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0079.688] GetLastError () returned 0x0 [0079.688] GetLastError () returned 0x0 [0079.692] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.692] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.693] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.693] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.693] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.693] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.693] CloseHandle (hObject=0x11c) returned 1 [0079.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0079.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.696] GetLastError () returned 0x0 [0079.696] RtlWakeConditionVariable () returned 0x0 [0079.696] GetCurrentThreadId () returned 0x998 [0079.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.696] lstrlenW (lpString=".vhd") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".vhd") returned 0x0 [0079.697] lstrlenW (lpString=".vhdx") returned 5 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0079.697] lstrlenW (lpString=".pst") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".pst") returned 0x0 [0079.697] lstrlenW (lpString=".ost") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".ost") returned 0x0 [0079.697] lstrlenW (lpString=".bak") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".bak") returned 0x0 [0079.697] lstrlenW (lpString=".bac") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".bac") returned 0x0 [0079.697] lstrlenW (lpString=".sys") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".sys") returned 0x0 [0079.697] lstrlenW (lpString=".v2i") returned 4 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".v2i") returned 0x0 [0079.697] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.699] lstrlenW (lpString=".sql") returned 4 [0079.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".sql") returned 0x0 [0079.699] lstrlenW (lpString=".mdf") returned 4 [0079.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".mdf") returned 0x0 [0079.699] lstrlenW (lpString=".txt") returned 4 [0079.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".txt") returned 0x0 [0079.699] lstrlenW (lpString=".dbf") returned 4 [0079.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".dbf") returned 0x0 [0079.699] lstrlenW (lpString=".ckp") returned 4 [0079.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".ckp") returned 0x0 [0079.700] lstrlenW (lpString=".dacpac") returned 7 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0079.700] lstrlenW (lpString=".db3") returned 4 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".db3") returned 0x0 [0079.700] lstrlenW (lpString=".dtxs") returned 5 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0079.700] lstrlenW (lpString=".mdt") returned 4 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".mdt") returned 0x0 [0079.700] lstrlenW (lpString=".sdf") returned 4 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".sdf") returned 0x0 [0079.700] lstrlenW (lpString=".MDF") returned 4 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".MDF") returned 0x0 [0079.700] lstrlenW (lpString=".DBF") returned 4 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".DBF") returned 0x0 [0079.700] lstrlenW (lpString=".DB") returned 3 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".DB") returned 0x0 [0079.700] lstrlenW (lpString=".db") returned 3 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".db") returned 0x0 [0079.700] lstrlenW (lpString=".ndf") returned 4 [0079.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".ndf") returned 0x0 [0079.701] lstrlenW (lpString=".NDF") returned 4 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".NDF") returned 0x0 [0079.701] lstrlenW (lpString=".Mdf") returned 4 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0079.701] lstrlenW (lpString=".dat") returned 4 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".dat") returned 0x0 [0079.701] lstrlenW (lpString=".DAT") returned 4 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".DAT") returned 0x0 [0079.701] lstrlenW (lpString=".ldf") returned 4 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.701] lstrlenW (lpString=".LDF") returned 4 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch=".LDF") returned 0x0 [0079.701] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.701] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757380) returned 1 [0079.702] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.702] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0079.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0079.703] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19970375224) returned 1 [0079.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe527c70, dwHighDateTime=0x1d585b4)) [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cdf0 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cdf0 | out: hHeap=0x260000) returned 1 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d2c0 [0079.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.703] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0079.704] GetLastError () returned 0x0 [0079.704] GetLastError () returned 0x0 [0079.704] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0079.704] GetLastError () returned 0x0 [0079.704] GetLastError () returned 0x0 [0079.708] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.708] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.709] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.710] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.895] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.895] CloseHandle (hObject=0x11c) returned 1 [0079.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0079.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.931] GetLastError () returned 0x0 [0079.931] RtlWakeConditionVariable () returned 0x27e828 [0079.931] GetCurrentThreadId () returned 0x998 [0079.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".ldf") returned 0x0 [0079.931] lstrlenW (lpString=".vhd") returned 4 [0079.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".vhd") returned 0x0 [0079.931] lstrlenW (lpString=".vhdx") returned 5 [0079.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".vhdx") returned 0x0 [0079.931] lstrlenW (lpString=".pst") returned 4 [0079.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".pst") returned 0x0 [0079.931] lstrlenW (lpString=".ost") returned 4 [0079.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".ost") returned 0x0 [0079.932] lstrlenW (lpString=".bak") returned 4 [0079.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".bak") returned 0x0 [0079.932] lstrlenW (lpString=".bac") returned 4 [0079.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".bac") returned 0x0 [0079.932] lstrlenW (lpString=".sys") returned 4 [0079.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".sys") returned 0x0 [0079.932] lstrlenW (lpString=".v2i") returned 4 [0079.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".v2i") returned 0x0 [0079.932] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch="s\r\n.v2i") returned 0x0 [0079.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.933] lstrlenW (lpString=".sql") returned 4 [0079.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".sql") returned 0x0 [0079.934] lstrlenW (lpString=".mdf") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".mdf") returned 0x0 [0079.934] lstrlenW (lpString=".txt") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".txt") returned 0x0 [0079.934] lstrlenW (lpString=".dbf") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".dbf") returned 0x0 [0079.934] lstrlenW (lpString=".ckp") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".ckp") returned 0x0 [0079.934] lstrlenW (lpString=".dacpac") returned 7 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".dacpac") returned 0x0 [0079.934] lstrlenW (lpString=".db3") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".db3") returned 0x0 [0079.934] lstrlenW (lpString=".dtxs") returned 5 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".dtxs") returned 0x0 [0079.934] lstrlenW (lpString=".mdt") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".mdt") returned 0x0 [0079.934] lstrlenW (lpString=".sdf") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".sdf") returned 0x0 [0079.934] lstrlenW (lpString=".MDF") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".MDF") returned 0x0 [0079.934] lstrlenW (lpString=".DBF") returned 4 [0079.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".DBF") returned 0x0 [0079.935] lstrlenW (lpString=".DB") returned 3 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".DB") returned 0x0 [0079.935] lstrlenW (lpString=".db") returned 3 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".db") returned 0x0 [0079.935] lstrlenW (lpString=".ndf") returned 4 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".ndf") returned 0x0 [0079.935] lstrlenW (lpString=".NDF") returned 4 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".NDF") returned 0x0 [0079.935] lstrlenW (lpString=".Mdf") returned 4 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".Mdf") returned 0x0 [0079.935] lstrlenW (lpString=".dat") returned 4 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".dat") returned 0x0 [0079.935] lstrlenW (lpString=".DAT") returned 4 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".DAT") returned 0x0 [0079.935] lstrlenW (lpString=".ldf") returned 4 [0079.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".ldf") returned 0x0 [0079.935] lstrlenW (lpString=".LDF") returned 4 [0079.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch=".LDF") returned 0x0 [0079.936] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.936] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757490) returned 1 [0079.937] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.937] CryptReleaseContext (hProv=0x2757490, dwFlags=0x0) returned 1 [0079.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0079.937] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19993789994) returned 1 [0079.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe763110, dwHighDateTime=0x1d585b4)) [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cd10 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd10 | out: hHeap=0x260000) returned 1 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d228 [0079.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.937] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0079.938] GetLastError () returned 0x0 [0079.938] GetLastError () returned 0x0 [0079.938] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0079.938] GetLastError () returned 0x0 [0079.938] GetLastError () returned 0x0 [0079.952] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffcd7d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.952] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3283, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3283, lpOverlapped=0x0) returned 1 [0079.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.953] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.953] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.953] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.953] CloseHandle (hObject=0xd8) returned 1 [0079.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.[deadmin@cock.li].deadmin")) returned 1 [0079.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.955] GetLastError () returned 0x0 [0079.955] RtlWakeConditionVariable () returned 0x0 [0079.955] GetCurrentThreadId () returned 0x998 [0079.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".ldf") returned 0x0 [0079.955] lstrlenW (lpString=".vhd") returned 4 [0079.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".vhd") returned 0x0 [0079.955] lstrlenW (lpString=".vhdx") returned 5 [0079.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".vhdx") returned 0x0 [0079.955] lstrlenW (lpString=".pst") returned 4 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".pst") returned 0x0 [0079.956] lstrlenW (lpString=".ost") returned 4 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".ost") returned 0x0 [0079.956] lstrlenW (lpString=".bak") returned 4 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".bak") returned 0x0 [0079.956] lstrlenW (lpString=".bac") returned 4 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".bac") returned 0x0 [0079.956] lstrlenW (lpString=".sys") returned 4 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".sys") returned 0x0 [0079.956] lstrlenW (lpString=".v2i") returned 4 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".v2i") returned 0x0 [0079.956] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.983] lstrlenW (lpString=".sql") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".sql") returned 0x0 [0079.983] lstrlenW (lpString=".mdf") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".mdf") returned 0x0 [0079.983] lstrlenW (lpString=".txt") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".txt") returned 0x0 [0079.983] lstrlenW (lpString=".dbf") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".dbf") returned 0x0 [0079.983] lstrlenW (lpString=".ckp") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".ckp") returned 0x0 [0079.983] lstrlenW (lpString=".dacpac") returned 7 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".dacpac") returned 0x0 [0079.983] lstrlenW (lpString=".db3") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".db3") returned 0x0 [0079.983] lstrlenW (lpString=".dtxs") returned 5 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".dtxs") returned 0x0 [0079.983] lstrlenW (lpString=".mdt") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".mdt") returned 0x0 [0079.983] lstrlenW (lpString=".sdf") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".sdf") returned 0x0 [0079.983] lstrlenW (lpString=".MDF") returned 4 [0079.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".MDF") returned 0x0 [0079.984] lstrlenW (lpString=".DBF") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".DBF") returned 0x0 [0079.984] lstrlenW (lpString=".DB") returned 3 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".DB") returned 0x0 [0079.984] lstrlenW (lpString=".db") returned 3 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".db") returned 0x0 [0079.984] lstrlenW (lpString=".ndf") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".ndf") returned 0x0 [0079.984] lstrlenW (lpString=".NDF") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".NDF") returned 0x0 [0079.984] lstrlenW (lpString=".Mdf") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".Mdf") returned 0x0 [0079.984] lstrlenW (lpString=".dat") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".dat") returned 0x0 [0079.984] lstrlenW (lpString=".DAT") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".DAT") returned 0x0 [0079.984] lstrlenW (lpString=".ldf") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".ldf") returned 0x0 [0079.984] lstrlenW (lpString=".LDF") returned 4 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch=".LDF") returned 0x0 [0079.984] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.984] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756f40) returned 1 [0079.985] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.985] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0079.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0079.985] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=19998658424) returned 1 [0079.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe7d5530, dwHighDateTime=0x1d585b4)) [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cc68 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cc68 | out: hHeap=0x260000) returned 1 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d12b8 [0079.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d228 [0079.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d12b8 | out: hHeap=0x260000) returned 1 [0079.986] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0079.986] GetLastError () returned 0x0 [0079.986] GetLastError () returned 0x0 [0079.987] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0079.987] GetLastError () returned 0x0 [0079.987] GetLastError () returned 0x0 [0079.990] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.990] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.991] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.991] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.992] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.992] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.992] CloseHandle (hObject=0xd8) returned 1 [0079.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.[deadmin@cock.li].deadmin")) returned 1 [0079.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0079.995] GetLastError () returned 0x0 [0079.995] RtlWakeConditionVariable () returned 0x0 [0079.995] GetCurrentThreadId () returned 0x998 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".ldf") returned 0x0 [0079.995] lstrlenW (lpString=".vhd") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".vhd") returned 0x0 [0079.995] lstrlenW (lpString=".vhdx") returned 5 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".vhdx") returned 0x0 [0079.995] lstrlenW (lpString=".pst") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".pst") returned 0x0 [0079.995] lstrlenW (lpString=".ost") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".ost") returned 0x0 [0079.995] lstrlenW (lpString=".bak") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".bak") returned 0x0 [0079.995] lstrlenW (lpString=".bac") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".bac") returned 0x0 [0079.995] lstrlenW (lpString=".sys") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".sys") returned 0x0 [0079.995] lstrlenW (lpString=".v2i") returned 4 [0079.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".v2i") returned 0x0 [0079.996] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.997] lstrlenW (lpString=".sql") returned 4 [0079.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".sql") returned 0x0 [0079.997] lstrlenW (lpString=".mdf") returned 4 [0079.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".mdf") returned 0x0 [0079.997] lstrlenW (lpString=".txt") returned 4 [0079.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".txt") returned 0x0 [0079.997] lstrlenW (lpString=".dbf") returned 4 [0079.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".dbf") returned 0x0 [0079.998] lstrlenW (lpString=".ckp") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".ckp") returned 0x0 [0079.998] lstrlenW (lpString=".dacpac") returned 7 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".dacpac") returned 0x0 [0079.998] lstrlenW (lpString=".db3") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".db3") returned 0x0 [0079.998] lstrlenW (lpString=".dtxs") returned 5 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".dtxs") returned 0x0 [0079.998] lstrlenW (lpString=".mdt") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".mdt") returned 0x0 [0079.998] lstrlenW (lpString=".sdf") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".sdf") returned 0x0 [0079.998] lstrlenW (lpString=".MDF") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".MDF") returned 0x0 [0079.998] lstrlenW (lpString=".DBF") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".DBF") returned 0x0 [0079.998] lstrlenW (lpString=".DB") returned 3 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".DB") returned 0x0 [0079.998] lstrlenW (lpString=".db") returned 3 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".db") returned 0x0 [0079.998] lstrlenW (lpString=".ndf") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".ndf") returned 0x0 [0079.998] lstrlenW (lpString=".NDF") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".NDF") returned 0x0 [0079.998] lstrlenW (lpString=".Mdf") returned 4 [0079.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".Mdf") returned 0x0 [0079.999] lstrlenW (lpString=".dat") returned 4 [0079.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".dat") returned 0x0 [0079.999] lstrlenW (lpString=".DAT") returned 4 [0079.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".DAT") returned 0x0 [0079.999] lstrlenW (lpString=".ldf") returned 4 [0079.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".ldf") returned 0x0 [0079.999] lstrlenW (lpString=".LDF") returned 4 [0079.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch=".LDF") returned 0x0 [0079.999] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0079.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.999] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757408) returned 1 [0080.000] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.000] CryptReleaseContext (hProv=0x2757408, dwFlags=0x0) returned 1 [0080.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.000] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20000114554) returned 1 [0080.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe7fb690, dwHighDateTime=0x1d585b4)) [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cc30 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cc30 | out: hHeap=0x260000) returned 1 [0080.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d12b8 [0080.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d12b8 | out: hHeap=0x260000) returned 1 [0080.001] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.001] GetLastError () returned 0x0 [0080.001] GetLastError () returned 0x0 [0080.001] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.001] GetLastError () returned 0x0 [0080.001] GetLastError () returned 0x0 [0080.016] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff6c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.016] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x9380, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x9380, lpOverlapped=0x0) returned 1 [0080.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0080.018] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.018] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.018] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.018] CloseHandle (hObject=0xd8) returned 1 [0080.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.070] GetLastError () returned 0x0 [0080.070] RtlWakeConditionVariable () returned 0x0 [0080.070] GetCurrentThreadId () returned 0x998 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".ldf") returned 0x0 [0080.071] lstrlenW (lpString=".vhd") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".vhd") returned 0x0 [0080.071] lstrlenW (lpString=".vhdx") returned 5 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".vhdx") returned 0x0 [0080.071] lstrlenW (lpString=".pst") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".pst") returned 0x0 [0080.071] lstrlenW (lpString=".ost") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".ost") returned 0x0 [0080.071] lstrlenW (lpString=".bak") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".bak") returned 0x0 [0080.071] lstrlenW (lpString=".bac") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".bac") returned 0x0 [0080.071] lstrlenW (lpString=".sys") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".sys") returned 0x0 [0080.071] lstrlenW (lpString=".v2i") returned 4 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".v2i") returned 0x0 [0080.071] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch="s\r\n.v2i") returned 0x0 [0080.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.072] lstrlenW (lpString=".sql") returned 4 [0080.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".sql") returned 0x0 [0080.072] lstrlenW (lpString=".mdf") returned 4 [0080.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".mdf") returned 0x0 [0080.072] lstrlenW (lpString=".txt") returned 4 [0080.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".txt") returned 0x0 [0080.072] lstrlenW (lpString=".dbf") returned 4 [0080.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".dbf") returned 0x0 [0080.073] lstrlenW (lpString=".ckp") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".ckp") returned 0x0 [0080.073] lstrlenW (lpString=".dacpac") returned 7 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".dacpac") returned 0x0 [0080.073] lstrlenW (lpString=".db3") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".db3") returned 0x0 [0080.073] lstrlenW (lpString=".dtxs") returned 5 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".dtxs") returned 0x0 [0080.073] lstrlenW (lpString=".mdt") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".mdt") returned 0x0 [0080.073] lstrlenW (lpString=".sdf") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".sdf") returned 0x0 [0080.073] lstrlenW (lpString=".MDF") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".MDF") returned 0x0 [0080.073] lstrlenW (lpString=".DBF") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".DBF") returned 0x0 [0080.073] lstrlenW (lpString=".DB") returned 3 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".DB") returned 0x0 [0080.073] lstrlenW (lpString=".db") returned 3 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".db") returned 0x0 [0080.073] lstrlenW (lpString=".ndf") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".ndf") returned 0x0 [0080.073] lstrlenW (lpString=".NDF") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".NDF") returned 0x0 [0080.073] lstrlenW (lpString=".Mdf") returned 4 [0080.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".Mdf") returned 0x0 [0080.074] lstrlenW (lpString=".dat") returned 4 [0080.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".dat") returned 0x0 [0080.074] lstrlenW (lpString=".DAT") returned 4 [0080.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".DAT") returned 0x0 [0080.074] lstrlenW (lpString=".ldf") returned 4 [0080.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".ldf") returned 0x0 [0080.074] lstrlenW (lpString=".LDF") returned 4 [0080.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch=".LDF") returned 0x0 [0080.074] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.074] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27575a0) returned 1 [0080.075] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.075] CryptReleaseContext (hProv=0x27575a0, dwFlags=0x0) returned 1 [0080.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.075] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20007630930) returned 1 [0080.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe8b9d70, dwHighDateTime=0x1d585b4)) [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761840 [0080.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761840 | out: hHeap=0x260000) returned 1 [0080.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1408 [0080.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.076] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.076] GetLastError () returned 0x0 [0080.076] GetLastError () returned 0x0 [0080.076] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.076] GetLastError () returned 0x0 [0080.077] GetLastError () returned 0x0 [0080.078] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff55da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.079] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xaa26, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xaa26, lpOverlapped=0x0) returned 1 [0080.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.079] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.079] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.079] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.079] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.079] CloseHandle (hObject=0x11c) returned 1 [0080.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.[deadmin@cock.li].deadmin")) returned 1 [0080.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.081] GetLastError () returned 0x0 [0080.081] RtlWakeConditionVariable () returned 0x0 [0080.081] GetCurrentThreadId () returned 0x998 [0080.082] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.082] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.082] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0080.082] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0080.101] CloseHandle (hObject=0x11c) returned 1 [0080.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1558 | out: hHeap=0x260000) returned 1 [0080.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.101] RtlWakeConditionVariable () returned 0x0 [0080.101] GetCurrentThreadId () returned 0x998 [0080.101] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.102] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.102] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0080.102] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0080.104] CloseHandle (hObject=0x11c) returned 1 [0080.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1600 | out: hHeap=0x260000) returned 1 [0080.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.104] RtlWakeConditionVariable () returned 0x27e828 [0080.104] GetCurrentThreadId () returned 0x998 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".ldf") returned 0x0 [0080.105] lstrlenW (lpString=".vhd") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".vhd") returned 0x0 [0080.105] lstrlenW (lpString=".vhdx") returned 5 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".vhdx") returned 0x0 [0080.105] lstrlenW (lpString=".pst") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".pst") returned 0x0 [0080.105] lstrlenW (lpString=".ost") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".ost") returned 0x0 [0080.105] lstrlenW (lpString=".bak") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".bak") returned 0x0 [0080.105] lstrlenW (lpString=".bac") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".bac") returned 0x0 [0080.105] lstrlenW (lpString=".sys") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".sys") returned 0x0 [0080.105] lstrlenW (lpString=".v2i") returned 4 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".v2i") returned 0x0 [0080.105] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.107] lstrlenW (lpString=".sql") returned 4 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".sql") returned 0x0 [0080.107] lstrlenW (lpString=".mdf") returned 4 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".mdf") returned 0x0 [0080.107] lstrlenW (lpString=".txt") returned 4 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".txt") returned 0x0 [0080.107] lstrlenW (lpString=".dbf") returned 4 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".dbf") returned 0x0 [0080.107] lstrlenW (lpString=".ckp") returned 4 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".ckp") returned 0x0 [0080.107] lstrlenW (lpString=".dacpac") returned 7 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".dacpac") returned 0x0 [0080.107] lstrlenW (lpString=".db3") returned 4 [0080.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".db3") returned 0x0 [0080.108] lstrlenW (lpString=".dtxs") returned 5 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".dtxs") returned 0x0 [0080.108] lstrlenW (lpString=".mdt") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".mdt") returned 0x0 [0080.108] lstrlenW (lpString=".sdf") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".sdf") returned 0x0 [0080.108] lstrlenW (lpString=".MDF") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".MDF") returned 0x0 [0080.108] lstrlenW (lpString=".DBF") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".DBF") returned 0x0 [0080.108] lstrlenW (lpString=".DB") returned 3 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".DB") returned 0x0 [0080.108] lstrlenW (lpString=".db") returned 3 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".db") returned 0x0 [0080.108] lstrlenW (lpString=".ndf") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".ndf") returned 0x0 [0080.108] lstrlenW (lpString=".NDF") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".NDF") returned 0x0 [0080.108] lstrlenW (lpString=".Mdf") returned 4 [0080.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".Mdf") returned 0x0 [0080.109] lstrlenW (lpString=".dat") returned 4 [0080.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".dat") returned 0x0 [0080.109] lstrlenW (lpString=".DAT") returned 4 [0080.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".DAT") returned 0x0 [0080.109] lstrlenW (lpString=".ldf") returned 4 [0080.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".ldf") returned 0x0 [0080.109] lstrlenW (lpString=".LDF") returned 4 [0080.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch=".LDF") returned 0x0 [0080.109] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.109] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2756f40) returned 1 [0080.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.110] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0080.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.110] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20011135682) returned 1 [0080.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbe906030, dwHighDateTime=0x1d585b4)) [0080.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761798 [0080.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761798 | out: hHeap=0x260000) returned 1 [0080.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1408 [0080.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.111] GetLastError () returned 0x0 [0080.112] GetLastError () returned 0x0 [0080.112] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.112] GetLastError () returned 0x0 [0080.112] GetLastError () returned 0x0 [0080.120] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.121] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.199] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.199] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.313] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.313] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.313] CloseHandle (hObject=0x11c) returned 1 [0080.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.315] GetLastError () returned 0x0 [0080.315] RtlWakeConditionVariable () returned 0x0 [0080.315] GetCurrentThreadId () returned 0x998 [0080.323] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.323] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.323] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0080.323] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0080.325] CloseHandle (hObject=0x11c) returned 1 [0080.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3490a8 | out: hHeap=0x260000) returned 1 [0080.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.325] RtlWakeConditionVariable () returned 0x0 [0080.325] GetCurrentThreadId () returned 0x998 [0080.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".ldf") returned 0x0 [0080.325] lstrlenW (lpString=".vhd") returned 4 [0080.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".vhd") returned 0x0 [0080.325] lstrlenW (lpString=".vhdx") returned 5 [0080.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".vhdx") returned 0x0 [0080.325] lstrlenW (lpString=".pst") returned 4 [0080.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".pst") returned 0x0 [0080.326] lstrlenW (lpString=".ost") returned 4 [0080.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".ost") returned 0x0 [0080.326] lstrlenW (lpString=".bak") returned 4 [0080.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".bak") returned 0x0 [0080.326] lstrlenW (lpString=".bac") returned 4 [0080.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".bac") returned 0x0 [0080.326] lstrlenW (lpString=".sys") returned 4 [0080.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".sys") returned 0x0 [0080.326] lstrlenW (lpString=".v2i") returned 4 [0080.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".v2i") returned 0x0 [0080.326] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.327] lstrlenW (lpString=".sql") returned 4 [0080.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".sql") returned 0x0 [0080.328] lstrlenW (lpString=".mdf") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".mdf") returned 0x0 [0080.328] lstrlenW (lpString=".txt") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".txt") returned 0x0 [0080.328] lstrlenW (lpString=".dbf") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".dbf") returned 0x0 [0080.328] lstrlenW (lpString=".ckp") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".ckp") returned 0x0 [0080.328] lstrlenW (lpString=".dacpac") returned 7 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".dacpac") returned 0x0 [0080.328] lstrlenW (lpString=".db3") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".db3") returned 0x0 [0080.328] lstrlenW (lpString=".dtxs") returned 5 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".dtxs") returned 0x0 [0080.328] lstrlenW (lpString=".mdt") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".mdt") returned 0x0 [0080.328] lstrlenW (lpString=".sdf") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".sdf") returned 0x0 [0080.328] lstrlenW (lpString=".MDF") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".MDF") returned 0x0 [0080.328] lstrlenW (lpString=".DBF") returned 4 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".DBF") returned 0x0 [0080.328] lstrlenW (lpString=".DB") returned 3 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".DB") returned 0x0 [0080.328] lstrlenW (lpString=".db") returned 3 [0080.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".db") returned 0x0 [0080.329] lstrlenW (lpString=".ndf") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".ndf") returned 0x0 [0080.329] lstrlenW (lpString=".NDF") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".NDF") returned 0x0 [0080.329] lstrlenW (lpString=".Mdf") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".Mdf") returned 0x0 [0080.329] lstrlenW (lpString=".dat") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".dat") returned 0x0 [0080.329] lstrlenW (lpString=".DAT") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".DAT") returned 0x0 [0080.329] lstrlenW (lpString=".ldf") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".ldf") returned 0x0 [0080.329] lstrlenW (lpString=".LDF") returned 4 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch=".LDF") returned 0x0 [0080.329] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.329] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757848) returned 1 [0080.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.330] CryptReleaseContext (hProv=0x2757848, dwFlags=0x0) returned 1 [0080.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.330] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20033137306) returned 1 [0080.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbeb1b370, dwHighDateTime=0x1d585b4)) [0080.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761a38 [0080.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761a38 | out: hHeap=0x260000) returned 1 [0080.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0080.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.331] GetLastError () returned 0x0 [0080.331] GetLastError () returned 0x0 [0080.331] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.331] GetLastError () returned 0x0 [0080.332] GetLastError () returned 0x0 [0080.335] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.335] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.336] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.336] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.336] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.336] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.337] CloseHandle (hObject=0x11c) returned 1 [0080.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.338] GetLastError () returned 0x0 [0080.338] RtlWakeConditionVariable () returned 0x27e828 [0080.338] GetCurrentThreadId () returned 0x998 [0080.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".ldf") returned 0x0 [0080.338] lstrlenW (lpString=".vhd") returned 4 [0080.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".vhd") returned 0x0 [0080.338] lstrlenW (lpString=".vhdx") returned 5 [0080.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".vhdx") returned 0x0 [0080.338] lstrlenW (lpString=".pst") returned 4 [0080.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".pst") returned 0x0 [0080.338] lstrlenW (lpString=".ost") returned 4 [0080.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".ost") returned 0x0 [0080.338] lstrlenW (lpString=".bak") returned 4 [0080.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".bak") returned 0x0 [0080.339] lstrlenW (lpString=".bac") returned 4 [0080.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".bac") returned 0x0 [0080.339] lstrlenW (lpString=".sys") returned 4 [0080.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".sys") returned 0x0 [0080.339] lstrlenW (lpString=".v2i") returned 4 [0080.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".v2i") returned 0x0 [0080.339] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.340] lstrlenW (lpString=".sql") returned 4 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".sql") returned 0x0 [0080.340] lstrlenW (lpString=".mdf") returned 4 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".mdf") returned 0x0 [0080.340] lstrlenW (lpString=".txt") returned 4 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".txt") returned 0x0 [0080.340] lstrlenW (lpString=".dbf") returned 4 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".dbf") returned 0x0 [0080.340] lstrlenW (lpString=".ckp") returned 4 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".ckp") returned 0x0 [0080.340] lstrlenW (lpString=".dacpac") returned 7 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".dacpac") returned 0x0 [0080.340] lstrlenW (lpString=".db3") returned 4 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".db3") returned 0x0 [0080.340] lstrlenW (lpString=".dtxs") returned 5 [0080.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".dtxs") returned 0x0 [0080.340] lstrlenW (lpString=".mdt") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".mdt") returned 0x0 [0080.341] lstrlenW (lpString=".sdf") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".sdf") returned 0x0 [0080.341] lstrlenW (lpString=".MDF") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".MDF") returned 0x0 [0080.341] lstrlenW (lpString=".DBF") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".DBF") returned 0x0 [0080.341] lstrlenW (lpString=".DB") returned 3 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".DB") returned 0x0 [0080.341] lstrlenW (lpString=".db") returned 3 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".db") returned 0x0 [0080.341] lstrlenW (lpString=".ndf") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".ndf") returned 0x0 [0080.341] lstrlenW (lpString=".NDF") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".NDF") returned 0x0 [0080.341] lstrlenW (lpString=".Mdf") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".Mdf") returned 0x0 [0080.341] lstrlenW (lpString=".dat") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".dat") returned 0x0 [0080.341] lstrlenW (lpString=".DAT") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".DAT") returned 0x0 [0080.341] lstrlenW (lpString=".ldf") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".ldf") returned 0x0 [0080.341] lstrlenW (lpString=".LDF") returned 4 [0080.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch=".LDF") returned 0x0 [0080.341] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.342] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0080.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.342] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0080.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.343] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20034376687) returned 1 [0080.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbeb414d0, dwHighDateTime=0x1d585b4)) [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761a00 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761a00 | out: hHeap=0x260000) returned 1 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0080.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.343] GetLastError () returned 0x0 [0080.344] GetLastError () returned 0x0 [0080.344] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.344] GetLastError () returned 0x0 [0080.344] GetLastError () returned 0x0 [0080.346] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.346] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.348] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.348] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.349] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.349] CloseHandle (hObject=0x11c) returned 1 [0080.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.351] GetLastError () returned 0x0 [0080.351] RtlWakeConditionVariable () returned 0x27e828 [0080.351] GetCurrentThreadId () returned 0x998 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".ldf") returned 0x0 [0080.351] lstrlenW (lpString=".vhd") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".vhd") returned 0x0 [0080.351] lstrlenW (lpString=".vhdx") returned 5 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".vhdx") returned 0x0 [0080.351] lstrlenW (lpString=".pst") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".pst") returned 0x0 [0080.351] lstrlenW (lpString=".ost") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".ost") returned 0x0 [0080.351] lstrlenW (lpString=".bak") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".bak") returned 0x0 [0080.351] lstrlenW (lpString=".bac") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".bac") returned 0x0 [0080.351] lstrlenW (lpString=".sys") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".sys") returned 0x0 [0080.351] lstrlenW (lpString=".v2i") returned 4 [0080.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".v2i") returned 0x0 [0080.352] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.353] lstrlenW (lpString=".sql") returned 4 [0080.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".sql") returned 0x0 [0080.353] lstrlenW (lpString=".mdf") returned 4 [0080.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".mdf") returned 0x0 [0080.353] lstrlenW (lpString=".txt") returned 4 [0080.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".txt") returned 0x0 [0080.353] lstrlenW (lpString=".dbf") returned 4 [0080.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".dbf") returned 0x0 [0080.353] lstrlenW (lpString=".ckp") returned 4 [0080.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".ckp") returned 0x0 [0080.353] lstrlenW (lpString=".dacpac") returned 7 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".dacpac") returned 0x0 [0080.354] lstrlenW (lpString=".db3") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".db3") returned 0x0 [0080.354] lstrlenW (lpString=".dtxs") returned 5 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".dtxs") returned 0x0 [0080.354] lstrlenW (lpString=".mdt") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".mdt") returned 0x0 [0080.354] lstrlenW (lpString=".sdf") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".sdf") returned 0x0 [0080.354] lstrlenW (lpString=".MDF") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".MDF") returned 0x0 [0080.354] lstrlenW (lpString=".DBF") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".DBF") returned 0x0 [0080.354] lstrlenW (lpString=".DB") returned 3 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".DB") returned 0x0 [0080.354] lstrlenW (lpString=".db") returned 3 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".db") returned 0x0 [0080.354] lstrlenW (lpString=".ndf") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".ndf") returned 0x0 [0080.354] lstrlenW (lpString=".NDF") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".NDF") returned 0x0 [0080.354] lstrlenW (lpString=".Mdf") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".Mdf") returned 0x0 [0080.354] lstrlenW (lpString=".dat") returned 4 [0080.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".dat") returned 0x0 [0080.354] lstrlenW (lpString=".DAT") returned 4 [0080.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".DAT") returned 0x0 [0080.355] lstrlenW (lpString=".ldf") returned 4 [0080.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".ldf") returned 0x0 [0080.355] lstrlenW (lpString=".LDF") returned 4 [0080.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch=".LDF") returned 0x0 [0080.355] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.355] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27576b0) returned 1 [0080.424] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.424] CryptReleaseContext (hProv=0x27576b0, dwFlags=0x0) returned 1 [0080.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.424] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20045158605) returned 1 [0080.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbec4be70, dwHighDateTime=0x1d585b4)) [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27615a0 [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27615a0 | out: hHeap=0x260000) returned 1 [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e5c0 [0080.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.456] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.457] GetLastError () returned 0x0 [0080.457] GetLastError () returned 0x0 [0080.457] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.457] GetLastError () returned 0x0 [0080.457] GetLastError () returned 0x0 [0080.460] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.460] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.460] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.460] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.460] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.460] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.461] CloseHandle (hObject=0x11c) returned 1 [0080.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.497] GetLastError () returned 0x0 [0080.498] RtlWakeConditionVariable () returned 0x27e828 [0080.498] GetCurrentThreadId () returned 0x998 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".ldf") returned 0x0 [0080.498] lstrlenW (lpString=".vhd") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".vhd") returned 0x0 [0080.498] lstrlenW (lpString=".vhdx") returned 5 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".vhdx") returned 0x0 [0080.498] lstrlenW (lpString=".pst") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".pst") returned 0x0 [0080.498] lstrlenW (lpString=".ost") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".ost") returned 0x0 [0080.498] lstrlenW (lpString=".bak") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".bak") returned 0x0 [0080.498] lstrlenW (lpString=".bac") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".bac") returned 0x0 [0080.498] lstrlenW (lpString=".sys") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".sys") returned 0x0 [0080.498] lstrlenW (lpString=".v2i") returned 4 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".v2i") returned 0x0 [0080.498] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.500] lstrlenW (lpString=".sql") returned 4 [0080.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".sql") returned 0x0 [0080.500] lstrlenW (lpString=".mdf") returned 4 [0080.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".mdf") returned 0x0 [0080.500] lstrlenW (lpString=".txt") returned 4 [0080.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".txt") returned 0x0 [0080.500] lstrlenW (lpString=".dbf") returned 4 [0080.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".dbf") returned 0x0 [0080.500] lstrlenW (lpString=".ckp") returned 4 [0080.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".ckp") returned 0x0 [0080.501] lstrlenW (lpString=".dacpac") returned 7 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".dacpac") returned 0x0 [0080.501] lstrlenW (lpString=".db3") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".db3") returned 0x0 [0080.501] lstrlenW (lpString=".dtxs") returned 5 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".dtxs") returned 0x0 [0080.501] lstrlenW (lpString=".mdt") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".mdt") returned 0x0 [0080.501] lstrlenW (lpString=".sdf") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".sdf") returned 0x0 [0080.501] lstrlenW (lpString=".MDF") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".MDF") returned 0x0 [0080.501] lstrlenW (lpString=".DBF") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".DBF") returned 0x0 [0080.501] lstrlenW (lpString=".DB") returned 3 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".DB") returned 0x0 [0080.501] lstrlenW (lpString=".db") returned 3 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".db") returned 0x0 [0080.501] lstrlenW (lpString=".ndf") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".ndf") returned 0x0 [0080.501] lstrlenW (lpString=".NDF") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".NDF") returned 0x0 [0080.501] lstrlenW (lpString=".Mdf") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".Mdf") returned 0x0 [0080.501] lstrlenW (lpString=".dat") returned 4 [0080.501] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".dat") returned 0x0 [0080.502] lstrlenW (lpString=".DAT") returned 4 [0080.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".DAT") returned 0x0 [0080.502] lstrlenW (lpString=".ldf") returned 4 [0080.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".ldf") returned 0x0 [0080.502] lstrlenW (lpString=".LDF") returned 4 [0080.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch=".LDF") returned 0x0 [0080.502] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.502] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757b78) returned 1 [0080.503] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.503] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.503] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20050402565) returned 1 [0080.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbecbe290, dwHighDateTime=0x1d585b4)) [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275caa8 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275caa8 | out: hHeap=0x260000) returned 1 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0080.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0080.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0080.504] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.504] GetLastError () returned 0x0 [0080.504] GetLastError () returned 0x0 [0080.504] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.504] GetLastError () returned 0x0 [0080.504] GetLastError () returned 0x0 [0080.508] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.508] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.509] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.509] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.511] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.511] CloseHandle (hObject=0x11c) returned 1 [0080.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.513] GetLastError () returned 0x0 [0080.513] RtlWakeConditionVariable () returned 0x0 [0080.513] GetCurrentThreadId () returned 0x998 [0080.513] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.513] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.513] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0080.513] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0080.515] CloseHandle (hObject=0x11c) returned 1 [0080.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0080.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.515] RtlWakeConditionVariable () returned 0x27e828 [0080.515] GetCurrentThreadId () returned 0x998 [0080.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".ldf") returned 0x0 [0080.515] lstrlenW (lpString=".vhd") returned 4 [0080.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".vhd") returned 0x0 [0080.515] lstrlenW (lpString=".vhdx") returned 5 [0080.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".vhdx") returned 0x0 [0080.516] lstrlenW (lpString=".pst") returned 4 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".pst") returned 0x0 [0080.516] lstrlenW (lpString=".ost") returned 4 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".ost") returned 0x0 [0080.516] lstrlenW (lpString=".bak") returned 4 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".bak") returned 0x0 [0080.516] lstrlenW (lpString=".bac") returned 4 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".bac") returned 0x0 [0080.516] lstrlenW (lpString=".sys") returned 4 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".sys") returned 0x0 [0080.516] lstrlenW (lpString=".v2i") returned 4 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".v2i") returned 0x0 [0080.516] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch="s\r\n.v2i") returned 0x0 [0080.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.517] lstrlenW (lpString=".sql") returned 4 [0080.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".sql") returned 0x0 [0080.517] lstrlenW (lpString=".mdf") returned 4 [0080.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".mdf") returned 0x0 [0080.517] lstrlenW (lpString=".txt") returned 4 [0080.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".txt") returned 0x0 [0080.517] lstrlenW (lpString=".dbf") returned 4 [0080.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".dbf") returned 0x0 [0080.517] lstrlenW (lpString=".ckp") returned 4 [0080.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".ckp") returned 0x0 [0080.517] lstrlenW (lpString=".dacpac") returned 7 [0080.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".dacpac") returned 0x0 [0080.518] lstrlenW (lpString=".db3") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".db3") returned 0x0 [0080.518] lstrlenW (lpString=".dtxs") returned 5 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".dtxs") returned 0x0 [0080.518] lstrlenW (lpString=".mdt") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".mdt") returned 0x0 [0080.518] lstrlenW (lpString=".sdf") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".sdf") returned 0x0 [0080.518] lstrlenW (lpString=".MDF") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".MDF") returned 0x0 [0080.518] lstrlenW (lpString=".DBF") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".DBF") returned 0x0 [0080.518] lstrlenW (lpString=".DB") returned 3 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".DB") returned 0x0 [0080.518] lstrlenW (lpString=".db") returned 3 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".db") returned 0x0 [0080.518] lstrlenW (lpString=".ndf") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".ndf") returned 0x0 [0080.518] lstrlenW (lpString=".NDF") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".NDF") returned 0x0 [0080.518] lstrlenW (lpString=".Mdf") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".Mdf") returned 0x0 [0080.518] lstrlenW (lpString=".dat") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".dat") returned 0x0 [0080.518] lstrlenW (lpString=".DAT") returned 4 [0080.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".DAT") returned 0x0 [0080.519] lstrlenW (lpString=".ldf") returned 4 [0080.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".ldf") returned 0x0 [0080.519] lstrlenW (lpString=".LDF") returned 4 [0080.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch=".LDF") returned 0x0 [0080.519] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.519] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0080.520] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.520] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0080.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.520] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20052102548) returned 1 [0080.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbece43f0, dwHighDateTime=0x1d585b4)) [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ca38 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ca38 | out: hHeap=0x260000) returned 1 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0080.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.521] GetLastError () returned 0x0 [0080.521] GetLastError () returned 0x0 [0080.521] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.521] GetLastError () returned 0x0 [0080.521] GetLastError () returned 0x0 [0080.524] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.524] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.525] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.525] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.527] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.527] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.527] CloseHandle (hObject=0x11c) returned 1 [0080.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.[deadmin@cock.li].deadmin")) returned 1 [0080.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.528] GetLastError () returned 0x0 [0080.528] RtlWakeConditionVariable () returned 0x0 [0080.528] GetCurrentThreadId () returned 0x998 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".ldf") returned 0x0 [0080.529] lstrlenW (lpString=".vhd") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".vhd") returned 0x0 [0080.529] lstrlenW (lpString=".vhdx") returned 5 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".vhdx") returned 0x0 [0080.529] lstrlenW (lpString=".pst") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".pst") returned 0x0 [0080.529] lstrlenW (lpString=".ost") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".ost") returned 0x0 [0080.529] lstrlenW (lpString=".bak") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".bak") returned 0x0 [0080.529] lstrlenW (lpString=".bac") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".bac") returned 0x0 [0080.529] lstrlenW (lpString=".sys") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".sys") returned 0x0 [0080.529] lstrlenW (lpString=".v2i") returned 4 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".v2i") returned 0x0 [0080.529] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch="s\r\n.v2i") returned 0x0 [0080.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.530] lstrlenW (lpString=".sql") returned 4 [0080.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".sql") returned 0x0 [0080.530] lstrlenW (lpString=".mdf") returned 4 [0080.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".mdf") returned 0x0 [0080.530] lstrlenW (lpString=".txt") returned 4 [0080.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".txt") returned 0x0 [0080.530] lstrlenW (lpString=".dbf") returned 4 [0080.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".dbf") returned 0x0 [0080.531] lstrlenW (lpString=".ckp") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".ckp") returned 0x0 [0080.531] lstrlenW (lpString=".dacpac") returned 7 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".dacpac") returned 0x0 [0080.531] lstrlenW (lpString=".db3") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".db3") returned 0x0 [0080.531] lstrlenW (lpString=".dtxs") returned 5 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".dtxs") returned 0x0 [0080.531] lstrlenW (lpString=".mdt") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".mdt") returned 0x0 [0080.531] lstrlenW (lpString=".sdf") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".sdf") returned 0x0 [0080.531] lstrlenW (lpString=".MDF") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".MDF") returned 0x0 [0080.531] lstrlenW (lpString=".DBF") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".DBF") returned 0x0 [0080.531] lstrlenW (lpString=".DB") returned 3 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".DB") returned 0x0 [0080.531] lstrlenW (lpString=".db") returned 3 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".db") returned 0x0 [0080.531] lstrlenW (lpString=".ndf") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".ndf") returned 0x0 [0080.531] lstrlenW (lpString=".NDF") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".NDF") returned 0x0 [0080.531] lstrlenW (lpString=".Mdf") returned 4 [0080.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".Mdf") returned 0x0 [0080.532] lstrlenW (lpString=".dat") returned 4 [0080.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".dat") returned 0x0 [0080.532] lstrlenW (lpString=".DAT") returned 4 [0080.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".DAT") returned 0x0 [0080.532] lstrlenW (lpString=".ldf") returned 4 [0080.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".ldf") returned 0x0 [0080.532] lstrlenW (lpString=".LDF") returned 4 [0080.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch=".LDF") returned 0x0 [0080.532] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.532] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757d10) returned 1 [0080.533] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.533] CryptReleaseContext (hProv=0x2757d10, dwFlags=0x0) returned 1 [0080.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.533] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20053407938) returned 1 [0080.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbed0a550, dwHighDateTime=0x1d585b4)) [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff20 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff20 | out: hHeap=0x260000) returned 1 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.534] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.534] GetLastError () returned 0x0 [0080.534] GetLastError () returned 0x0 [0080.534] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.534] GetLastError () returned 0x0 [0080.534] GetLastError () returned 0x0 [0080.554] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.555] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.556] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.556] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.558] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.558] CloseHandle (hObject=0x11c) returned 1 [0080.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.[deadmin@cock.li].deadmin")) returned 1 [0080.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.643] GetLastError () returned 0x0 [0080.652] RtlWakeConditionVariable () returned 0x0 [0080.652] GetCurrentThreadId () returned 0x998 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".ldf") returned 0x0 [0080.653] lstrlenW (lpString=".vhd") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".vhd") returned 0x0 [0080.653] lstrlenW (lpString=".vhdx") returned 5 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".vhdx") returned 0x0 [0080.653] lstrlenW (lpString=".pst") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".pst") returned 0x0 [0080.653] lstrlenW (lpString=".ost") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".ost") returned 0x0 [0080.653] lstrlenW (lpString=".bak") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".bak") returned 0x0 [0080.653] lstrlenW (lpString=".bac") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".bac") returned 0x0 [0080.653] lstrlenW (lpString=".sys") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".sys") returned 0x0 [0080.653] lstrlenW (lpString=".v2i") returned 4 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".v2i") returned 0x0 [0080.653] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.654] lstrlenW (lpString=".sql") returned 4 [0080.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".sql") returned 0x0 [0080.654] lstrlenW (lpString=".mdf") returned 4 [0080.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".mdf") returned 0x0 [0080.654] lstrlenW (lpString=".txt") returned 4 [0080.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".txt") returned 0x0 [0080.655] lstrlenW (lpString=".dbf") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".dbf") returned 0x0 [0080.655] lstrlenW (lpString=".ckp") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".ckp") returned 0x0 [0080.655] lstrlenW (lpString=".dacpac") returned 7 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".dacpac") returned 0x0 [0080.655] lstrlenW (lpString=".db3") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".db3") returned 0x0 [0080.655] lstrlenW (lpString=".dtxs") returned 5 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".dtxs") returned 0x0 [0080.655] lstrlenW (lpString=".mdt") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".mdt") returned 0x0 [0080.655] lstrlenW (lpString=".sdf") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".sdf") returned 0x0 [0080.655] lstrlenW (lpString=".MDF") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".MDF") returned 0x0 [0080.655] lstrlenW (lpString=".DBF") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".DBF") returned 0x0 [0080.655] lstrlenW (lpString=".DB") returned 3 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".DB") returned 0x0 [0080.655] lstrlenW (lpString=".db") returned 3 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".db") returned 0x0 [0080.655] lstrlenW (lpString=".ndf") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".ndf") returned 0x0 [0080.655] lstrlenW (lpString=".NDF") returned 4 [0080.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".NDF") returned 0x0 [0080.656] lstrlenW (lpString=".Mdf") returned 4 [0080.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".Mdf") returned 0x0 [0080.656] lstrlenW (lpString=".dat") returned 4 [0080.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".dat") returned 0x0 [0080.656] lstrlenW (lpString=".DAT") returned 4 [0080.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".DAT") returned 0x0 [0080.656] lstrlenW (lpString=".ldf") returned 4 [0080.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".ldf") returned 0x0 [0080.656] lstrlenW (lpString=".LDF") returned 4 [0080.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch=".LDF") returned 0x0 [0080.656] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.656] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757b78) returned 1 [0080.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.657] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.657] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20065815261) returned 1 [0080.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbee3b050, dwHighDateTime=0x1d585b4)) [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1820 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1820 | out: hHeap=0x260000) returned 1 [0080.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f828 [0080.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.658] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.658] GetLastError () returned 0x0 [0080.658] GetLastError () returned 0x0 [0080.658] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.658] GetLastError () returned 0x0 [0080.658] GetLastError () returned 0x0 [0080.660] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff64a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.660] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x9b60, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x9b60, lpOverlapped=0x0) returned 1 [0080.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.660] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.660] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.660] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.661] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.661] CloseHandle (hObject=0x108) returned 1 [0080.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.662] GetLastError () returned 0x0 [0080.662] RtlWakeConditionVariable () returned 0x0 [0080.662] GetCurrentThreadId () returned 0x998 [0080.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".ldf") returned 0x0 [0080.662] lstrlenW (lpString=".vhd") returned 4 [0080.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".vhd") returned 0x0 [0080.662] lstrlenW (lpString=".vhdx") returned 5 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".vhdx") returned 0x0 [0080.663] lstrlenW (lpString=".pst") returned 4 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".pst") returned 0x0 [0080.663] lstrlenW (lpString=".ost") returned 4 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".ost") returned 0x0 [0080.663] lstrlenW (lpString=".bak") returned 4 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".bak") returned 0x0 [0080.663] lstrlenW (lpString=".bac") returned 4 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".bac") returned 0x0 [0080.663] lstrlenW (lpString=".sys") returned 4 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".sys") returned 0x0 [0080.663] lstrlenW (lpString=".v2i") returned 4 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".v2i") returned 0x0 [0080.663] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch="s\r\n.v2i") returned 0x0 [0080.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.665] lstrlenW (lpString=".sql") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".sql") returned 0x0 [0080.665] lstrlenW (lpString=".mdf") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".mdf") returned 0x0 [0080.665] lstrlenW (lpString=".txt") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".txt") returned 0x0 [0080.665] lstrlenW (lpString=".dbf") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".dbf") returned 0x0 [0080.665] lstrlenW (lpString=".ckp") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".ckp") returned 0x0 [0080.665] lstrlenW (lpString=".dacpac") returned 7 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".dacpac") returned 0x0 [0080.665] lstrlenW (lpString=".db3") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".db3") returned 0x0 [0080.665] lstrlenW (lpString=".dtxs") returned 5 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".dtxs") returned 0x0 [0080.665] lstrlenW (lpString=".mdt") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".mdt") returned 0x0 [0080.665] lstrlenW (lpString=".sdf") returned 4 [0080.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".sdf") returned 0x0 [0080.665] lstrlenW (lpString=".MDF") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".MDF") returned 0x0 [0080.666] lstrlenW (lpString=".DBF") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".DBF") returned 0x0 [0080.666] lstrlenW (lpString=".DB") returned 3 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".DB") returned 0x0 [0080.666] lstrlenW (lpString=".db") returned 3 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".db") returned 0x0 [0080.666] lstrlenW (lpString=".ndf") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".ndf") returned 0x0 [0080.666] lstrlenW (lpString=".NDF") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".NDF") returned 0x0 [0080.666] lstrlenW (lpString=".Mdf") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".Mdf") returned 0x0 [0080.666] lstrlenW (lpString=".dat") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".dat") returned 0x0 [0080.666] lstrlenW (lpString=".DAT") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".DAT") returned 0x0 [0080.666] lstrlenW (lpString=".ldf") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".ldf") returned 0x0 [0080.666] lstrlenW (lpString=".LDF") returned 4 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch=".LDF") returned 0x0 [0080.666] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.666] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757b78) returned 1 [0080.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.667] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.667] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20066858298) returned 1 [0080.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbee3b050, dwHighDateTime=0x1d585b4)) [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1708 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1708 | out: hHeap=0x260000) returned 1 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f2d0 [0080.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.668] GetLastError () returned 0x0 [0080.669] GetLastError () returned 0x0 [0080.669] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.669] GetLastError () returned 0x0 [0080.669] GetLastError () returned 0x0 [0080.670] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff977a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.671] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x6886, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x6886, lpOverlapped=0x0) returned 1 [0080.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.671] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.671] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.671] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.671] CloseHandle (hObject=0x108) returned 1 [0080.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.[deadmin@cock.li].deadmin")) returned 1 [0080.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.673] GetLastError () returned 0x0 [0080.673] RtlWakeConditionVariable () returned 0x0 [0080.673] GetCurrentThreadId () returned 0x998 [0080.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".ldf") returned 0x0 [0080.673] lstrlenW (lpString=".vhd") returned 4 [0080.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".vhd") returned 0x0 [0080.673] lstrlenW (lpString=".vhdx") returned 5 [0080.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".vhdx") returned 0x0 [0080.673] lstrlenW (lpString=".pst") returned 4 [0080.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".pst") returned 0x0 [0080.673] lstrlenW (lpString=".ost") returned 4 [0080.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".ost") returned 0x0 [0080.673] lstrlenW (lpString=".bak") returned 4 [0080.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".bak") returned 0x0 [0080.673] lstrlenW (lpString=".bac") returned 4 [0080.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".bac") returned 0x0 [0080.674] lstrlenW (lpString=".sys") returned 4 [0080.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".sys") returned 0x0 [0080.674] lstrlenW (lpString=".v2i") returned 4 [0080.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".v2i") returned 0x0 [0080.674] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch="s\r\n.v2i") returned 0x0 [0080.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.675] lstrlenW (lpString=".sql") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".sql") returned 0x0 [0080.675] lstrlenW (lpString=".mdf") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".mdf") returned 0x0 [0080.675] lstrlenW (lpString=".txt") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".txt") returned 0x0 [0080.675] lstrlenW (lpString=".dbf") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".dbf") returned 0x0 [0080.675] lstrlenW (lpString=".ckp") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".ckp") returned 0x0 [0080.675] lstrlenW (lpString=".dacpac") returned 7 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".dacpac") returned 0x0 [0080.675] lstrlenW (lpString=".db3") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".db3") returned 0x0 [0080.675] lstrlenW (lpString=".dtxs") returned 5 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".dtxs") returned 0x0 [0080.675] lstrlenW (lpString=".mdt") returned 4 [0080.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".mdt") returned 0x0 [0080.675] lstrlenW (lpString=".sdf") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".sdf") returned 0x0 [0080.676] lstrlenW (lpString=".MDF") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".MDF") returned 0x0 [0080.676] lstrlenW (lpString=".DBF") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".DBF") returned 0x0 [0080.676] lstrlenW (lpString=".DB") returned 3 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".DB") returned 0x0 [0080.676] lstrlenW (lpString=".db") returned 3 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".db") returned 0x0 [0080.676] lstrlenW (lpString=".ndf") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".ndf") returned 0x0 [0080.676] lstrlenW (lpString=".NDF") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".NDF") returned 0x0 [0080.676] lstrlenW (lpString=".Mdf") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".Mdf") returned 0x0 [0080.676] lstrlenW (lpString=".dat") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".dat") returned 0x0 [0080.676] lstrlenW (lpString=".DAT") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".DAT") returned 0x0 [0080.676] lstrlenW (lpString=".ldf") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".ldf") returned 0x0 [0080.676] lstrlenW (lpString=".LDF") returned 4 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch=".LDF") returned 0x0 [0080.676] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.677] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757e20) returned 1 [0080.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.677] CryptReleaseContext (hProv=0x2757e20, dwFlags=0x0) returned 1 [0080.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.678] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20067867888) returned 1 [0080.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbee611b0, dwHighDateTime=0x1d585b4)) [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1740 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1740 | out: hHeap=0x260000) returned 1 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.678] GetLastError () returned 0x0 [0080.679] GetLastError () returned 0x0 [0080.679] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.679] GetLastError () returned 0x0 [0080.679] GetLastError () returned 0x0 [0080.681] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff72af, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.681] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x8d51, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x8d51, lpOverlapped=0x0) returned 1 [0080.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.681] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.681] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.681] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.681] CloseHandle (hObject=0x108) returned 1 [0080.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.[deadmin@cock.li].deadmin")) returned 1 [0080.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.683] GetLastError () returned 0x0 [0080.683] RtlWakeConditionVariable () returned 0x0 [0080.683] GetCurrentThreadId () returned 0x998 [0080.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".ldf") returned 0x0 [0080.683] lstrlenW (lpString=".vhd") returned 4 [0080.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".vhd") returned 0x0 [0080.779] lstrlenW (lpString=".vhdx") returned 5 [0080.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".vhdx") returned 0x0 [0080.779] lstrlenW (lpString=".pst") returned 4 [0080.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".pst") returned 0x0 [0080.779] lstrlenW (lpString=".ost") returned 4 [0080.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".ost") returned 0x0 [0080.783] lstrlenW (lpString=".bak") returned 4 [0080.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".bak") returned 0x0 [0080.783] lstrlenW (lpString=".bac") returned 4 [0080.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".bac") returned 0x0 [0080.783] lstrlenW (lpString=".sys") returned 4 [0080.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".sys") returned 0x0 [0080.794] lstrlenW (lpString=".v2i") returned 4 [0080.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".v2i") returned 0x0 [0080.794] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.890] lstrlenW (lpString=".sql") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".sql") returned 0x0 [0080.890] lstrlenW (lpString=".mdf") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".mdf") returned 0x0 [0080.890] lstrlenW (lpString=".txt") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".txt") returned 0x0 [0080.890] lstrlenW (lpString=".dbf") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".dbf") returned 0x0 [0080.890] lstrlenW (lpString=".ckp") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".ckp") returned 0x0 [0080.890] lstrlenW (lpString=".dacpac") returned 7 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".dacpac") returned 0x0 [0080.890] lstrlenW (lpString=".db3") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".db3") returned 0x0 [0080.890] lstrlenW (lpString=".dtxs") returned 5 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".dtxs") returned 0x0 [0080.890] lstrlenW (lpString=".mdt") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".mdt") returned 0x0 [0080.890] lstrlenW (lpString=".sdf") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".sdf") returned 0x0 [0080.890] lstrlenW (lpString=".MDF") returned 4 [0080.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".MDF") returned 0x0 [0080.891] lstrlenW (lpString=".DBF") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".DBF") returned 0x0 [0080.891] lstrlenW (lpString=".DB") returned 3 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".DB") returned 0x0 [0080.891] lstrlenW (lpString=".db") returned 3 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".db") returned 0x0 [0080.891] lstrlenW (lpString=".ndf") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".ndf") returned 0x0 [0080.891] lstrlenW (lpString=".NDF") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".NDF") returned 0x0 [0080.891] lstrlenW (lpString=".Mdf") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".Mdf") returned 0x0 [0080.891] lstrlenW (lpString=".dat") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".dat") returned 0x0 [0080.891] lstrlenW (lpString=".DAT") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".DAT") returned 0x0 [0080.891] lstrlenW (lpString=".ldf") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".ldf") returned 0x0 [0080.891] lstrlenW (lpString=".LDF") returned 4 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch=".LDF") returned 0x0 [0080.891] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.891] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d24f8) returned 1 [0080.892] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.892] CryptReleaseContext (hProv=0x2d24f8, dwFlags=0x0) returned 1 [0080.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.892] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20089362369) returned 1 [0080.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf0764f0, dwHighDateTime=0x1d585b4)) [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761db8 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761db8 | out: hHeap=0x260000) returned 1 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1750 [0080.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1750 | out: hHeap=0x260000) returned 1 [0080.893] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.893] GetLastError () returned 0x0 [0080.894] GetLastError () returned 0x0 [0080.894] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.894] GetLastError () returned 0x0 [0080.894] GetLastError () returned 0x0 [0080.898] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffeec80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.898] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x11380, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x11380, lpOverlapped=0x0) returned 1 [0080.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0080.899] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.899] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.899] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.899] CloseHandle (hObject=0x108) returned 1 [0080.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.899] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.901] GetLastError () returned 0x0 [0080.901] RtlWakeConditionVariable () returned 0x0 [0080.901] GetCurrentThreadId () returned 0x998 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".ldf") returned 0x0 [0080.902] lstrlenW (lpString=".vhd") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".vhd") returned 0x0 [0080.902] lstrlenW (lpString=".vhdx") returned 5 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".vhdx") returned 0x0 [0080.902] lstrlenW (lpString=".pst") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".pst") returned 0x0 [0080.902] lstrlenW (lpString=".ost") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".ost") returned 0x0 [0080.902] lstrlenW (lpString=".bak") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".bak") returned 0x0 [0080.902] lstrlenW (lpString=".bac") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".bac") returned 0x0 [0080.902] lstrlenW (lpString=".sys") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".sys") returned 0x0 [0080.902] lstrlenW (lpString=".v2i") returned 4 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".v2i") returned 0x0 [0080.902] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0080.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.904] lstrlenW (lpString=".sql") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".sql") returned 0x0 [0080.904] lstrlenW (lpString=".mdf") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".mdf") returned 0x0 [0080.904] lstrlenW (lpString=".txt") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".txt") returned 0x0 [0080.904] lstrlenW (lpString=".dbf") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".dbf") returned 0x0 [0080.904] lstrlenW (lpString=".ckp") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".ckp") returned 0x0 [0080.904] lstrlenW (lpString=".dacpac") returned 7 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".dacpac") returned 0x0 [0080.904] lstrlenW (lpString=".db3") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".db3") returned 0x0 [0080.904] lstrlenW (lpString=".dtxs") returned 5 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".dtxs") returned 0x0 [0080.904] lstrlenW (lpString=".mdt") returned 4 [0080.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".mdt") returned 0x0 [0080.905] lstrlenW (lpString=".sdf") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".sdf") returned 0x0 [0080.905] lstrlenW (lpString=".MDF") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".MDF") returned 0x0 [0080.905] lstrlenW (lpString=".DBF") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".DBF") returned 0x0 [0080.905] lstrlenW (lpString=".DB") returned 3 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".DB") returned 0x0 [0080.905] lstrlenW (lpString=".db") returned 3 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".db") returned 0x0 [0080.905] lstrlenW (lpString=".ndf") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".ndf") returned 0x0 [0080.905] lstrlenW (lpString=".NDF") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".NDF") returned 0x0 [0080.905] lstrlenW (lpString=".Mdf") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".Mdf") returned 0x0 [0080.905] lstrlenW (lpString=".dat") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".dat") returned 0x0 [0080.905] lstrlenW (lpString=".DAT") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".DAT") returned 0x0 [0080.905] lstrlenW (lpString=".ldf") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".ldf") returned 0x0 [0080.905] lstrlenW (lpString=".LDF") returned 4 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch=".LDF") returned 0x0 [0080.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.906] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757b78) returned 1 [0080.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.906] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.907] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20090774889) returned 1 [0080.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf09c650, dwHighDateTime=0x1d585b4)) [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761d80 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761d80 | out: hHeap=0x260000) returned 1 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0080.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0080.907] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.907] GetLastError () returned 0x0 [0080.908] GetLastError () returned 0x0 [0080.908] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.908] GetLastError () returned 0x0 [0080.908] GetLastError () returned 0x0 [0080.910] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff01a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.910] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xfe6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xfe6, lpOverlapped=0x0) returned 1 [0080.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0080.910] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.910] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.910] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.910] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.911] CloseHandle (hObject=0x108) returned 1 [0080.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.[deadmin@cock.li].deadmin")) returned 1 [0080.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.913] GetLastError () returned 0x0 [0080.913] RtlWakeConditionVariable () returned 0x0 [0080.913] GetCurrentThreadId () returned 0x998 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".ldf") returned 0x0 [0080.913] lstrlenW (lpString=".vhd") returned 4 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".vhd") returned 0x0 [0080.913] lstrlenW (lpString=".vhdx") returned 5 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".vhdx") returned 0x0 [0080.913] lstrlenW (lpString=".pst") returned 4 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".pst") returned 0x0 [0080.913] lstrlenW (lpString=".ost") returned 4 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".ost") returned 0x0 [0080.913] lstrlenW (lpString=".bak") returned 4 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".bak") returned 0x0 [0080.913] lstrlenW (lpString=".bac") returned 4 [0080.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".bac") returned 0x0 [0080.914] lstrlenW (lpString=".sys") returned 4 [0080.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".sys") returned 0x0 [0080.914] lstrlenW (lpString=".v2i") returned 4 [0080.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".v2i") returned 0x0 [0080.914] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0080.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.915] lstrlenW (lpString=".sql") returned 4 [0080.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".sql") returned 0x0 [0080.915] lstrlenW (lpString=".mdf") returned 4 [0080.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".mdf") returned 0x0 [0080.916] lstrlenW (lpString=".txt") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".txt") returned 0x0 [0080.916] lstrlenW (lpString=".dbf") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".dbf") returned 0x0 [0080.916] lstrlenW (lpString=".ckp") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".ckp") returned 0x0 [0080.916] lstrlenW (lpString=".dacpac") returned 7 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".dacpac") returned 0x0 [0080.916] lstrlenW (lpString=".db3") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".db3") returned 0x0 [0080.916] lstrlenW (lpString=".dtxs") returned 5 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".dtxs") returned 0x0 [0080.916] lstrlenW (lpString=".mdt") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".mdt") returned 0x0 [0080.916] lstrlenW (lpString=".sdf") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".sdf") returned 0x0 [0080.916] lstrlenW (lpString=".MDF") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".MDF") returned 0x0 [0080.916] lstrlenW (lpString=".DBF") returned 4 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".DBF") returned 0x0 [0080.916] lstrlenW (lpString=".DB") returned 3 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".DB") returned 0x0 [0080.916] lstrlenW (lpString=".db") returned 3 [0080.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".db") returned 0x0 [0080.916] lstrlenW (lpString=".ndf") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".ndf") returned 0x0 [0080.917] lstrlenW (lpString=".NDF") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".NDF") returned 0x0 [0080.917] lstrlenW (lpString=".Mdf") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".Mdf") returned 0x0 [0080.917] lstrlenW (lpString=".dat") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".dat") returned 0x0 [0080.917] lstrlenW (lpString=".DAT") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".DAT") returned 0x0 [0080.917] lstrlenW (lpString=".ldf") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".ldf") returned 0x0 [0080.917] lstrlenW (lpString=".LDF") returned 4 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch=".LDF") returned 0x0 [0080.917] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.918] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757b78) returned 1 [0080.919] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.919] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.919] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20092032222) returned 1 [0080.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf0c27b0, dwHighDateTime=0x1d585b4)) [0080.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761d48 [0080.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761d48 | out: hHeap=0x260000) returned 1 [0080.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d18a0 [0080.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d18a0 | out: hHeap=0x260000) returned 1 [0080.920] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0080.920] GetLastError () returned 0x0 [0080.921] GetLastError () returned 0x0 [0080.921] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0080.921] GetLastError () returned 0x0 [0080.922] GetLastError () returned 0x0 [0081.114] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff749e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.114] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x8b62, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x8b62, lpOverlapped=0x0) returned 1 [0081.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0081.195] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.202] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.218] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.218] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.218] CloseHandle (hObject=0x108) returned 1 [0081.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.607] GetLastError () returned 0x0 [0081.607] RtlWakeConditionVariable () returned 0x0 [0081.607] GetCurrentThreadId () returned 0x998 [0081.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".ldf") returned 0x0 [0081.607] lstrlenW (lpString=".vhd") returned 4 [0081.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".vhd") returned 0x0 [0081.607] lstrlenW (lpString=".vhdx") returned 5 [0081.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".vhdx") returned 0x0 [0081.607] lstrlenW (lpString=".pst") returned 4 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".pst") returned 0x0 [0081.608] lstrlenW (lpString=".ost") returned 4 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".ost") returned 0x0 [0081.608] lstrlenW (lpString=".bak") returned 4 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".bak") returned 0x0 [0081.608] lstrlenW (lpString=".bac") returned 4 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".bac") returned 0x0 [0081.608] lstrlenW (lpString=".sys") returned 4 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".sys") returned 0x0 [0081.608] lstrlenW (lpString=".v2i") returned 4 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".v2i") returned 0x0 [0081.608] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.631] lstrlenW (lpString=".sql") returned 4 [0081.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".sql") returned 0x0 [0081.631] lstrlenW (lpString=".mdf") returned 4 [0081.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".mdf") returned 0x0 [0081.631] lstrlenW (lpString=".txt") returned 4 [0081.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".txt") returned 0x0 [0081.631] lstrlenW (lpString=".dbf") returned 4 [0081.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".dbf") returned 0x0 [0081.631] lstrlenW (lpString=".ckp") returned 4 [0081.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".ckp") returned 0x0 [0081.644] lstrlenW (lpString=".dacpac") returned 7 [0081.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".dacpac") returned 0x0 [0081.644] lstrlenW (lpString=".db3") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".db3") returned 0x0 [0081.645] lstrlenW (lpString=".dtxs") returned 5 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".dtxs") returned 0x0 [0081.645] lstrlenW (lpString=".mdt") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".mdt") returned 0x0 [0081.645] lstrlenW (lpString=".sdf") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".sdf") returned 0x0 [0081.645] lstrlenW (lpString=".MDF") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".MDF") returned 0x0 [0081.645] lstrlenW (lpString=".DBF") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".DBF") returned 0x0 [0081.645] lstrlenW (lpString=".DB") returned 3 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".DB") returned 0x0 [0081.645] lstrlenW (lpString=".db") returned 3 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".db") returned 0x0 [0081.645] lstrlenW (lpString=".ndf") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".ndf") returned 0x0 [0081.645] lstrlenW (lpString=".NDF") returned 4 [0081.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".NDF") returned 0x0 [0081.646] lstrlenW (lpString=".Mdf") returned 4 [0081.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".Mdf") returned 0x0 [0081.646] lstrlenW (lpString=".dat") returned 4 [0081.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".dat") returned 0x0 [0081.646] lstrlenW (lpString=".DAT") returned 4 [0081.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".DAT") returned 0x0 [0081.646] lstrlenW (lpString=".ldf") returned 4 [0081.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".ldf") returned 0x0 [0081.646] lstrlenW (lpString=".LDF") returned 4 [0081.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch=".LDF") returned 0x0 [0081.646] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.646] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0081.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.647] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.647] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20164816727) returned 1 [0081.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf79a6f0, dwHighDateTime=0x1d585b4)) [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e28 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e28 | out: hHeap=0x260000) returned 1 [0081.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1fd8 [0081.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1fd8 | out: hHeap=0x260000) returned 1 [0081.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.648] GetLastError () returned 0x0 [0081.648] GetLastError () returned 0x0 [0081.648] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.648] GetLastError () returned 0x0 [0081.648] GetLastError () returned 0x0 [0081.652] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.653] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.654] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.655] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.656] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.656] CloseHandle (hObject=0x11c) returned 1 [0081.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.657] GetLastError () returned 0x0 [0081.657] RtlWakeConditionVariable () returned 0x0 [0081.657] GetCurrentThreadId () returned 0x998 [0081.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".ldf") returned 0x0 [0081.657] lstrlenW (lpString=".vhd") returned 4 [0081.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".vhd") returned 0x0 [0081.657] lstrlenW (lpString=".vhdx") returned 5 [0081.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".vhdx") returned 0x0 [0081.657] lstrlenW (lpString=".pst") returned 4 [0081.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".pst") returned 0x0 [0081.658] lstrlenW (lpString=".ost") returned 4 [0081.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".ost") returned 0x0 [0081.658] lstrlenW (lpString=".bak") returned 4 [0081.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".bak") returned 0x0 [0081.658] lstrlenW (lpString=".bac") returned 4 [0081.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".bac") returned 0x0 [0081.658] lstrlenW (lpString=".sys") returned 4 [0081.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".sys") returned 0x0 [0081.658] lstrlenW (lpString=".v2i") returned 4 [0081.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".v2i") returned 0x0 [0081.658] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.659] lstrlenW (lpString=".sql") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".sql") returned 0x0 [0081.660] lstrlenW (lpString=".mdf") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".mdf") returned 0x0 [0081.660] lstrlenW (lpString=".txt") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".txt") returned 0x0 [0081.660] lstrlenW (lpString=".dbf") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".dbf") returned 0x0 [0081.660] lstrlenW (lpString=".ckp") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".ckp") returned 0x0 [0081.660] lstrlenW (lpString=".dacpac") returned 7 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".dacpac") returned 0x0 [0081.660] lstrlenW (lpString=".db3") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".db3") returned 0x0 [0081.660] lstrlenW (lpString=".dtxs") returned 5 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".dtxs") returned 0x0 [0081.660] lstrlenW (lpString=".mdt") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".mdt") returned 0x0 [0081.660] lstrlenW (lpString=".sdf") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".sdf") returned 0x0 [0081.660] lstrlenW (lpString=".MDF") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".MDF") returned 0x0 [0081.660] lstrlenW (lpString=".DBF") returned 4 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".DBF") returned 0x0 [0081.660] lstrlenW (lpString=".DB") returned 3 [0081.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".DB") returned 0x0 [0081.661] lstrlenW (lpString=".db") returned 3 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".db") returned 0x0 [0081.661] lstrlenW (lpString=".ndf") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".ndf") returned 0x0 [0081.661] lstrlenW (lpString=".NDF") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".NDF") returned 0x0 [0081.661] lstrlenW (lpString=".Mdf") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".Mdf") returned 0x0 [0081.661] lstrlenW (lpString=".dat") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".dat") returned 0x0 [0081.661] lstrlenW (lpString=".DAT") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".DAT") returned 0x0 [0081.661] lstrlenW (lpString=".ldf") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".ldf") returned 0x0 [0081.661] lstrlenW (lpString=".LDF") returned 4 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch=".LDF") returned 0x0 [0081.661] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.661] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0081.662] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.662] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.662] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20166342278) returned 1 [0081.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf7c0850, dwHighDateTime=0x1d585b4)) [0081.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761df0 [0081.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761df0 | out: hHeap=0x260000) returned 1 [0081.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1f30 [0081.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1f30 | out: hHeap=0x260000) returned 1 [0081.663] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.663] GetLastError () returned 0x0 [0081.663] GetLastError () returned 0x0 [0081.663] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.664] GetLastError () returned 0x0 [0081.664] GetLastError () returned 0x0 [0081.666] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.666] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.668] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.668] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.671] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.671] CloseHandle (hObject=0x11c) returned 1 [0081.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0081.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0081.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.672] GetLastError () returned 0x0 [0081.672] RtlWakeConditionVariable () returned 0x0 [0081.672] GetCurrentThreadId () returned 0x998 [0081.673] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.673] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.673] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0081.673] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0081.675] CloseHandle (hObject=0x11c) returned 1 [0081.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0081.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.675] RtlWakeConditionVariable () returned 0x27e828 [0081.675] GetCurrentThreadId () returned 0x998 [0081.675] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.675] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.675] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0081.675] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0081.679] CloseHandle (hObject=0x11c) returned 1 [0081.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2778068 | out: hHeap=0x260000) returned 1 [0081.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3490a8 | out: hHeap=0x260000) returned 1 [0081.680] RtlWakeConditionVariable () returned 0x27e828 [0081.680] GetCurrentThreadId () returned 0x998 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".ldf") returned 0x0 [0081.680] lstrlenW (lpString=".vhd") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".vhd") returned 0x0 [0081.680] lstrlenW (lpString=".vhdx") returned 5 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".vhdx") returned 0x0 [0081.680] lstrlenW (lpString=".pst") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".pst") returned 0x0 [0081.680] lstrlenW (lpString=".ost") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".ost") returned 0x0 [0081.680] lstrlenW (lpString=".bak") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".bak") returned 0x0 [0081.680] lstrlenW (lpString=".bac") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".bac") returned 0x0 [0081.680] lstrlenW (lpString=".sys") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".sys") returned 0x0 [0081.680] lstrlenW (lpString=".v2i") returned 4 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".v2i") returned 0x0 [0081.680] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.809] lstrlenW (lpString=".sql") returned 4 [0081.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".sql") returned 0x0 [0081.809] lstrlenW (lpString=".mdf") returned 4 [0081.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".mdf") returned 0x0 [0081.809] lstrlenW (lpString=".txt") returned 4 [0081.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".txt") returned 0x0 [0081.809] lstrlenW (lpString=".dbf") returned 4 [0081.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".dbf") returned 0x0 [0081.809] lstrlenW (lpString=".ckp") returned 4 [0081.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".ckp") returned 0x0 [0081.810] lstrlenW (lpString=".dacpac") returned 7 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".dacpac") returned 0x0 [0081.810] lstrlenW (lpString=".db3") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".db3") returned 0x0 [0081.810] lstrlenW (lpString=".dtxs") returned 5 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".dtxs") returned 0x0 [0081.810] lstrlenW (lpString=".mdt") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".mdt") returned 0x0 [0081.810] lstrlenW (lpString=".sdf") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".sdf") returned 0x0 [0081.810] lstrlenW (lpString=".MDF") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".MDF") returned 0x0 [0081.810] lstrlenW (lpString=".DBF") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".DBF") returned 0x0 [0081.810] lstrlenW (lpString=".DB") returned 3 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".DB") returned 0x0 [0081.810] lstrlenW (lpString=".db") returned 3 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".db") returned 0x0 [0081.810] lstrlenW (lpString=".ndf") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".ndf") returned 0x0 [0081.810] lstrlenW (lpString=".NDF") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".NDF") returned 0x0 [0081.810] lstrlenW (lpString=".Mdf") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".Mdf") returned 0x0 [0081.810] lstrlenW (lpString=".dat") returned 4 [0081.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".dat") returned 0x0 [0081.811] lstrlenW (lpString=".DAT") returned 4 [0081.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".DAT") returned 0x0 [0081.811] lstrlenW (lpString=".ldf") returned 4 [0081.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".ldf") returned 0x0 [0081.811] lstrlenW (lpString=".LDF") returned 4 [0081.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch=".LDF") returned 0x0 [0081.811] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.811] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0081.812] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.812] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.812] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20181300548) returned 1 [0081.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf93d610, dwHighDateTime=0x1d585b4)) [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338640 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338640 | out: hHeap=0x260000) returned 1 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760370 [0081.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.813] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.813] GetLastError () returned 0x0 [0081.813] GetLastError () returned 0x0 [0081.813] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.813] GetLastError () returned 0x0 [0081.813] GetLastError () returned 0x0 [0081.816] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff820a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.816] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x7df6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x7df6, lpOverlapped=0x0) returned 1 [0081.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0081.816] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.816] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.817] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.817] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.817] CloseHandle (hObject=0x11c) returned 1 [0081.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0081.818] GetLastError () returned 0x0 [0081.818] RtlWakeConditionVariable () returned 0x0 [0081.818] GetCurrentThreadId () returned 0x998 [0081.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".ldf") returned 0x0 [0081.819] lstrlenW (lpString=".vhd") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".vhd") returned 0x0 [0081.819] lstrlenW (lpString=".vhdx") returned 5 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".vhdx") returned 0x0 [0081.819] lstrlenW (lpString=".pst") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".pst") returned 0x0 [0081.819] lstrlenW (lpString=".ost") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".ost") returned 0x0 [0081.819] lstrlenW (lpString=".bak") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".bak") returned 0x0 [0081.819] lstrlenW (lpString=".bac") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".bac") returned 0x0 [0081.819] lstrlenW (lpString=".sys") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".sys") returned 0x0 [0081.819] lstrlenW (lpString=".v2i") returned 4 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".v2i") returned 0x0 [0081.819] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.820] lstrlenW (lpString=".sql") returned 4 [0081.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".sql") returned 0x0 [0081.820] lstrlenW (lpString=".mdf") returned 4 [0081.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".mdf") returned 0x0 [0081.820] lstrlenW (lpString=".txt") returned 4 [0081.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".txt") returned 0x0 [0081.820] lstrlenW (lpString=".dbf") returned 4 [0081.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".dbf") returned 0x0 [0081.820] lstrlenW (lpString=".ckp") returned 4 [0081.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".ckp") returned 0x0 [0081.821] lstrlenW (lpString=".dacpac") returned 7 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".dacpac") returned 0x0 [0081.821] lstrlenW (lpString=".db3") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".db3") returned 0x0 [0081.821] lstrlenW (lpString=".dtxs") returned 5 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".dtxs") returned 0x0 [0081.821] lstrlenW (lpString=".mdt") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".mdt") returned 0x0 [0081.821] lstrlenW (lpString=".sdf") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".sdf") returned 0x0 [0081.821] lstrlenW (lpString=".MDF") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".MDF") returned 0x0 [0081.821] lstrlenW (lpString=".DBF") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".DBF") returned 0x0 [0081.821] lstrlenW (lpString=".DB") returned 3 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".DB") returned 0x0 [0081.821] lstrlenW (lpString=".db") returned 3 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".db") returned 0x0 [0081.821] lstrlenW (lpString=".ndf") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".ndf") returned 0x0 [0081.821] lstrlenW (lpString=".NDF") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".NDF") returned 0x0 [0081.821] lstrlenW (lpString=".Mdf") returned 4 [0081.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".Mdf") returned 0x0 [0081.821] lstrlenW (lpString=".dat") returned 4 [0081.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".dat") returned 0x0 [0081.822] lstrlenW (lpString=".DAT") returned 4 [0081.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".DAT") returned 0x0 [0081.822] lstrlenW (lpString=".ldf") returned 4 [0081.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".ldf") returned 0x0 [0081.822] lstrlenW (lpString=".LDF") returned 4 [0081.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch=".LDF") returned 0x0 [0081.822] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.822] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0081.823] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.823] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.823] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20182422728) returned 1 [0081.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf963770, dwHighDateTime=0x1d585b4)) [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338678 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338678 | out: hHeap=0x260000) returned 1 [0081.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760830 [0081.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.824] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.824] GetLastError () returned 0x0 [0081.824] GetLastError () returned 0x0 [0081.824] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.824] GetLastError () returned 0x0 [0081.824] GetLastError () returned 0x0 [0081.826] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc254, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.826] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x3dac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3dac, lpOverlapped=0x0) returned 1 [0081.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0081.826] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.826] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.827] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.827] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.827] CloseHandle (hObject=0x11c) returned 1 [0081.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0081.828] GetLastError () returned 0x0 [0081.828] RtlWakeConditionVariable () returned 0x0 [0081.828] GetCurrentThreadId () returned 0x998 [0081.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".ldf") returned 0x0 [0081.828] lstrlenW (lpString=".vhd") returned 4 [0081.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".vhd") returned 0x0 [0081.828] lstrlenW (lpString=".vhdx") returned 5 [0081.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".vhdx") returned 0x0 [0081.829] lstrlenW (lpString=".pst") returned 4 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".pst") returned 0x0 [0081.829] lstrlenW (lpString=".ost") returned 4 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".ost") returned 0x0 [0081.829] lstrlenW (lpString=".bak") returned 4 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".bak") returned 0x0 [0081.829] lstrlenW (lpString=".bac") returned 4 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".bac") returned 0x0 [0081.829] lstrlenW (lpString=".sys") returned 4 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".sys") returned 0x0 [0081.829] lstrlenW (lpString=".v2i") returned 4 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".v2i") returned 0x0 [0081.829] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.830] lstrlenW (lpString=".sql") returned 4 [0081.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".sql") returned 0x0 [0081.830] lstrlenW (lpString=".mdf") returned 4 [0081.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".mdf") returned 0x0 [0081.830] lstrlenW (lpString=".txt") returned 4 [0081.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".txt") returned 0x0 [0081.830] lstrlenW (lpString=".dbf") returned 4 [0081.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".dbf") returned 0x0 [0081.830] lstrlenW (lpString=".ckp") returned 4 [0081.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".ckp") returned 0x0 [0081.830] lstrlenW (lpString=".dacpac") returned 7 [0081.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".dacpac") returned 0x0 [0081.830] lstrlenW (lpString=".db3") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".db3") returned 0x0 [0081.831] lstrlenW (lpString=".dtxs") returned 5 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".dtxs") returned 0x0 [0081.831] lstrlenW (lpString=".mdt") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".mdt") returned 0x0 [0081.831] lstrlenW (lpString=".sdf") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".sdf") returned 0x0 [0081.831] lstrlenW (lpString=".MDF") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".MDF") returned 0x0 [0081.831] lstrlenW (lpString=".DBF") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".DBF") returned 0x0 [0081.831] lstrlenW (lpString=".DB") returned 3 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".DB") returned 0x0 [0081.831] lstrlenW (lpString=".db") returned 3 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".db") returned 0x0 [0081.831] lstrlenW (lpString=".ndf") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".ndf") returned 0x0 [0081.831] lstrlenW (lpString=".NDF") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".NDF") returned 0x0 [0081.831] lstrlenW (lpString=".Mdf") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".Mdf") returned 0x0 [0081.831] lstrlenW (lpString=".dat") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".dat") returned 0x0 [0081.831] lstrlenW (lpString=".DAT") returned 4 [0081.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".DAT") returned 0x0 [0081.831] lstrlenW (lpString=".ldf") returned 4 [0081.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".ldf") returned 0x0 [0081.832] lstrlenW (lpString=".LDF") returned 4 [0081.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch=".LDF") returned 0x0 [0081.832] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.832] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0081.833] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.833] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.833] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20183392322) returned 1 [0081.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf963770, dwHighDateTime=0x1d585b4)) [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3386b0 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3386b0 | out: hHeap=0x260000) returned 1 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760240 [0081.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.833] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.834] GetLastError () returned 0x0 [0081.834] GetLastError () returned 0x0 [0081.834] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.834] GetLastError () returned 0x0 [0081.834] GetLastError () returned 0x0 [0081.836] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff284a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.836] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xd7b6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xd7b6, lpOverlapped=0x0) returned 1 [0081.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0081.837] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.837] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.837] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.837] CloseHandle (hObject=0x11c) returned 1 [0081.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0081.839] GetLastError () returned 0x0 [0081.839] RtlWakeConditionVariable () returned 0x0 [0081.839] GetCurrentThreadId () returned 0x998 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".ldf") returned 0x0 [0081.839] lstrlenW (lpString=".vhd") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".vhd") returned 0x0 [0081.839] lstrlenW (lpString=".vhdx") returned 5 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".vhdx") returned 0x0 [0081.839] lstrlenW (lpString=".pst") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".pst") returned 0x0 [0081.839] lstrlenW (lpString=".ost") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".ost") returned 0x0 [0081.839] lstrlenW (lpString=".bak") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".bak") returned 0x0 [0081.839] lstrlenW (lpString=".bac") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".bac") returned 0x0 [0081.839] lstrlenW (lpString=".sys") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".sys") returned 0x0 [0081.839] lstrlenW (lpString=".v2i") returned 4 [0081.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".v2i") returned 0x0 [0081.839] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.840] lstrlenW (lpString=".sql") returned 4 [0081.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".sql") returned 0x0 [0081.841] lstrlenW (lpString=".mdf") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".mdf") returned 0x0 [0081.841] lstrlenW (lpString=".txt") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".txt") returned 0x0 [0081.841] lstrlenW (lpString=".dbf") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".dbf") returned 0x0 [0081.841] lstrlenW (lpString=".ckp") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".ckp") returned 0x0 [0081.841] lstrlenW (lpString=".dacpac") returned 7 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".dacpac") returned 0x0 [0081.841] lstrlenW (lpString=".db3") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".db3") returned 0x0 [0081.841] lstrlenW (lpString=".dtxs") returned 5 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".dtxs") returned 0x0 [0081.841] lstrlenW (lpString=".mdt") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".mdt") returned 0x0 [0081.841] lstrlenW (lpString=".sdf") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".sdf") returned 0x0 [0081.841] lstrlenW (lpString=".MDF") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".MDF") returned 0x0 [0081.841] lstrlenW (lpString=".DBF") returned 4 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".DBF") returned 0x0 [0081.841] lstrlenW (lpString=".DB") returned 3 [0081.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".DB") returned 0x0 [0081.841] lstrlenW (lpString=".db") returned 3 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".db") returned 0x0 [0081.842] lstrlenW (lpString=".ndf") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".ndf") returned 0x0 [0081.842] lstrlenW (lpString=".NDF") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".NDF") returned 0x0 [0081.842] lstrlenW (lpString=".Mdf") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".Mdf") returned 0x0 [0081.842] lstrlenW (lpString=".dat") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".dat") returned 0x0 [0081.842] lstrlenW (lpString=".DAT") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".DAT") returned 0x0 [0081.842] lstrlenW (lpString=".ldf") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".ldf") returned 0x0 [0081.842] lstrlenW (lpString=".LDF") returned 4 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch=".LDF") returned 0x0 [0081.842] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.842] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0081.843] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.843] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.843] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20184437958) returned 1 [0081.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbf9898d0, dwHighDateTime=0x1d585b4)) [0081.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3386e8 [0081.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3386e8 | out: hHeap=0x260000) returned 1 [0081.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760110 [0081.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.844] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.844] GetLastError () returned 0x0 [0081.844] GetLastError () returned 0x0 [0081.844] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.844] GetLastError () returned 0x0 [0081.845] GetLastError () returned 0x0 [0081.889] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff0dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.889] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xf24, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xf24, lpOverlapped=0x0) returned 1 [0081.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0081.892] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.892] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.892] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.892] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.892] CloseHandle (hObject=0x11c) returned 1 [0081.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0081.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0081.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0081.970] GetLastError () returned 0x0 [0081.971] RtlWakeConditionVariable () returned 0x0 [0081.971] GetCurrentThreadId () returned 0x998 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".ldf") returned 0x0 [0081.971] lstrlenW (lpString=".vhd") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".vhd") returned 0x0 [0081.971] lstrlenW (lpString=".vhdx") returned 5 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".vhdx") returned 0x0 [0081.971] lstrlenW (lpString=".pst") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".pst") returned 0x0 [0081.971] lstrlenW (lpString=".ost") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".ost") returned 0x0 [0081.971] lstrlenW (lpString=".bak") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".bak") returned 0x0 [0081.971] lstrlenW (lpString=".bac") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".bac") returned 0x0 [0081.971] lstrlenW (lpString=".sys") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".sys") returned 0x0 [0081.971] lstrlenW (lpString=".v2i") returned 4 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".v2i") returned 0x0 [0081.971] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0081.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.972] lstrlenW (lpString=".sql") returned 4 [0081.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".sql") returned 0x0 [0081.972] lstrlenW (lpString=".mdf") returned 4 [0081.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".mdf") returned 0x0 [0081.972] lstrlenW (lpString=".txt") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".txt") returned 0x0 [0081.973] lstrlenW (lpString=".dbf") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".dbf") returned 0x0 [0081.973] lstrlenW (lpString=".ckp") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".ckp") returned 0x0 [0081.973] lstrlenW (lpString=".dacpac") returned 7 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".dacpac") returned 0x0 [0081.973] lstrlenW (lpString=".db3") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".db3") returned 0x0 [0081.973] lstrlenW (lpString=".dtxs") returned 5 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".dtxs") returned 0x0 [0081.973] lstrlenW (lpString=".mdt") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".mdt") returned 0x0 [0081.973] lstrlenW (lpString=".sdf") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".sdf") returned 0x0 [0081.973] lstrlenW (lpString=".MDF") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".MDF") returned 0x0 [0081.973] lstrlenW (lpString=".DBF") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".DBF") returned 0x0 [0081.973] lstrlenW (lpString=".DB") returned 3 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".DB") returned 0x0 [0081.973] lstrlenW (lpString=".db") returned 3 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".db") returned 0x0 [0081.973] lstrlenW (lpString=".ndf") returned 4 [0081.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".ndf") returned 0x0 [0081.973] lstrlenW (lpString=".NDF") returned 4 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".NDF") returned 0x0 [0081.974] lstrlenW (lpString=".Mdf") returned 4 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".Mdf") returned 0x0 [0081.974] lstrlenW (lpString=".dat") returned 4 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".dat") returned 0x0 [0081.974] lstrlenW (lpString=".DAT") returned 4 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".DAT") returned 0x0 [0081.974] lstrlenW (lpString=".ldf") returned 4 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".ldf") returned 0x0 [0081.974] lstrlenW (lpString=".LDF") returned 4 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch=".LDF") returned 0x0 [0081.974] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.974] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2938) returned 1 [0081.975] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.975] CryptReleaseContext (hProv=0x2d2938, dwFlags=0x0) returned 1 [0081.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.975] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20197623572) returned 1 [0081.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfaba3d0, dwHighDateTime=0x1d585b4)) [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338950 [0081.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338950 | out: hHeap=0x260000) returned 1 [0081.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.976] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.976] GetLastError () returned 0x0 [0081.976] GetLastError () returned 0x0 [0081.976] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.976] GetLastError () returned 0x0 [0081.976] GetLastError () returned 0x0 [0081.979] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.979] WriteFile (in: hFile=0xe8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.981] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.981] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.981] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.981] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.981] CloseHandle (hObject=0xe8) returned 1 [0081.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0081.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.[deadmin@cock.li].deadmin")) returned 1 [0081.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0081.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0081.982] GetLastError () returned 0x0 [0081.983] RtlWakeConditionVariable () returned 0x0 [0081.983] GetCurrentThreadId () returned 0x998 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".ldf") returned 0x0 [0081.983] lstrlenW (lpString=".vhd") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".vhd") returned 0x0 [0081.983] lstrlenW (lpString=".vhdx") returned 5 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".vhdx") returned 0x0 [0081.983] lstrlenW (lpString=".pst") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".pst") returned 0x0 [0081.983] lstrlenW (lpString=".ost") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".ost") returned 0x0 [0081.983] lstrlenW (lpString=".bak") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".bak") returned 0x0 [0081.983] lstrlenW (lpString=".bac") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".bac") returned 0x0 [0081.983] lstrlenW (lpString=".sys") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".sys") returned 0x0 [0081.983] lstrlenW (lpString=".v2i") returned 4 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".v2i") returned 0x0 [0081.983] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0081.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.984] lstrlenW (lpString=".sql") returned 4 [0081.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".sql") returned 0x0 [0081.984] lstrlenW (lpString=".mdf") returned 4 [0081.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".mdf") returned 0x0 [0081.985] lstrlenW (lpString=".txt") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".txt") returned 0x0 [0081.985] lstrlenW (lpString=".dbf") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".dbf") returned 0x0 [0081.985] lstrlenW (lpString=".ckp") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".ckp") returned 0x0 [0081.985] lstrlenW (lpString=".dacpac") returned 7 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".dacpac") returned 0x0 [0081.985] lstrlenW (lpString=".db3") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".db3") returned 0x0 [0081.985] lstrlenW (lpString=".dtxs") returned 5 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".dtxs") returned 0x0 [0081.985] lstrlenW (lpString=".mdt") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".mdt") returned 0x0 [0081.985] lstrlenW (lpString=".sdf") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".sdf") returned 0x0 [0081.985] lstrlenW (lpString=".MDF") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".MDF") returned 0x0 [0081.985] lstrlenW (lpString=".DBF") returned 4 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".DBF") returned 0x0 [0081.985] lstrlenW (lpString=".DB") returned 3 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".DB") returned 0x0 [0081.985] lstrlenW (lpString=".db") returned 3 [0081.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".db") returned 0x0 [0081.985] lstrlenW (lpString=".ndf") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".ndf") returned 0x0 [0081.986] lstrlenW (lpString=".NDF") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".NDF") returned 0x0 [0081.986] lstrlenW (lpString=".Mdf") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".Mdf") returned 0x0 [0081.986] lstrlenW (lpString=".dat") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".dat") returned 0x0 [0081.986] lstrlenW (lpString=".DAT") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".DAT") returned 0x0 [0081.986] lstrlenW (lpString=".ldf") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".ldf") returned 0x0 [0081.986] lstrlenW (lpString=".LDF") returned 4 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch=".LDF") returned 0x0 [0081.986] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.986] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2ad0) returned 1 [0081.987] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.987] CryptReleaseContext (hProv=0x2d2ad0, dwFlags=0x0) returned 1 [0081.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.987] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20198828569) returned 1 [0081.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfae0530, dwHighDateTime=0x1d585b4)) [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338988 [0081.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338988 | out: hHeap=0x260000) returned 1 [0081.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.988] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.988] GetLastError () returned 0x0 [0081.988] GetLastError () returned 0x0 [0081.988] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.988] GetLastError () returned 0x0 [0081.989] GetLastError () returned 0x0 [0081.990] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffff3078, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.990] WriteFile (in: hFile=0xe8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcf88, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xcf88, lpOverlapped=0x0) returned 1 [0081.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.991] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.991] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.991] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.991] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.991] CloseHandle (hObject=0xe8) returned 1 [0081.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0081.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.[deadmin@cock.li].deadmin")) returned 1 [0081.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0081.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0081.992] GetLastError () returned 0x0 [0081.993] RtlWakeConditionVariable () returned 0x0 [0081.993] GetCurrentThreadId () returned 0x998 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".ldf") returned 0x0 [0081.993] lstrlenW (lpString=".vhd") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".vhd") returned 0x0 [0081.993] lstrlenW (lpString=".vhdx") returned 5 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".vhdx") returned 0x0 [0081.993] lstrlenW (lpString=".pst") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".pst") returned 0x0 [0081.993] lstrlenW (lpString=".ost") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".ost") returned 0x0 [0081.993] lstrlenW (lpString=".bak") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".bak") returned 0x0 [0081.993] lstrlenW (lpString=".bac") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".bac") returned 0x0 [0081.993] lstrlenW (lpString=".sys") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".sys") returned 0x0 [0081.993] lstrlenW (lpString=".v2i") returned 4 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".v2i") returned 0x0 [0081.993] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0081.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.994] lstrlenW (lpString=".sql") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".sql") returned 0x0 [0081.995] lstrlenW (lpString=".mdf") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".mdf") returned 0x0 [0081.995] lstrlenW (lpString=".txt") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".txt") returned 0x0 [0081.995] lstrlenW (lpString=".dbf") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".dbf") returned 0x0 [0081.995] lstrlenW (lpString=".ckp") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".ckp") returned 0x0 [0081.995] lstrlenW (lpString=".dacpac") returned 7 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".dacpac") returned 0x0 [0081.995] lstrlenW (lpString=".db3") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".db3") returned 0x0 [0081.995] lstrlenW (lpString=".dtxs") returned 5 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".dtxs") returned 0x0 [0081.995] lstrlenW (lpString=".mdt") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".mdt") returned 0x0 [0081.995] lstrlenW (lpString=".sdf") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".sdf") returned 0x0 [0081.995] lstrlenW (lpString=".MDF") returned 4 [0081.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".MDF") returned 0x0 [0081.995] lstrlenW (lpString=".DBF") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".DBF") returned 0x0 [0081.996] lstrlenW (lpString=".DB") returned 3 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".DB") returned 0x0 [0081.996] lstrlenW (lpString=".db") returned 3 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".db") returned 0x0 [0081.996] lstrlenW (lpString=".ndf") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".ndf") returned 0x0 [0081.996] lstrlenW (lpString=".NDF") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".NDF") returned 0x0 [0081.996] lstrlenW (lpString=".Mdf") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".Mdf") returned 0x0 [0081.996] lstrlenW (lpString=".dat") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".dat") returned 0x0 [0081.996] lstrlenW (lpString=".DAT") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".DAT") returned 0x0 [0081.996] lstrlenW (lpString=".ldf") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".ldf") returned 0x0 [0081.996] lstrlenW (lpString=".LDF") returned 4 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch=".LDF") returned 0x0 [0081.996] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0081.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.996] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2b58) returned 1 [0081.997] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.997] CryptReleaseContext (hProv=0x2d2b58, dwFlags=0x0) returned 1 [0081.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0081.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0081.997] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20199852405) returned 1 [0081.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfb06690, dwHighDateTime=0x1d585b4)) [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3389c0 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3389c0 | out: hHeap=0x260000) returned 1 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.998] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0081.998] GetLastError () returned 0x0 [0081.998] GetLastError () returned 0x0 [0081.999] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0081.999] GetLastError () returned 0x0 [0081.999] GetLastError () returned 0x0 [0082.001] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.001] WriteFile (in: hFile=0xe8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.002] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.003] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.003] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.003] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.003] CloseHandle (hObject=0xe8) returned 1 [0082.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0082.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0082.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.004] GetLastError () returned 0x0 [0082.005] RtlWakeConditionVariable () returned 0x0 [0082.005] GetCurrentThreadId () returned 0x998 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".ldf") returned 0x0 [0082.005] lstrlenW (lpString=".vhd") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".vhd") returned 0x0 [0082.005] lstrlenW (lpString=".vhdx") returned 5 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".vhdx") returned 0x0 [0082.005] lstrlenW (lpString=".pst") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".pst") returned 0x0 [0082.005] lstrlenW (lpString=".ost") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".ost") returned 0x0 [0082.005] lstrlenW (lpString=".bak") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".bak") returned 0x0 [0082.005] lstrlenW (lpString=".bac") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".bac") returned 0x0 [0082.005] lstrlenW (lpString=".sys") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".sys") returned 0x0 [0082.005] lstrlenW (lpString=".v2i") returned 4 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".v2i") returned 0x0 [0082.005] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch="s\r\n.v2i") returned 0x0 [0082.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.083] lstrlenW (lpString=".sql") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".sql") returned 0x0 [0082.083] lstrlenW (lpString=".mdf") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".mdf") returned 0x0 [0082.083] lstrlenW (lpString=".txt") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".txt") returned 0x0 [0082.083] lstrlenW (lpString=".dbf") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".dbf") returned 0x0 [0082.083] lstrlenW (lpString=".ckp") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".ckp") returned 0x0 [0082.083] lstrlenW (lpString=".dacpac") returned 7 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".dacpac") returned 0x0 [0082.083] lstrlenW (lpString=".db3") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".db3") returned 0x0 [0082.083] lstrlenW (lpString=".dtxs") returned 5 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".dtxs") returned 0x0 [0082.083] lstrlenW (lpString=".mdt") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".mdt") returned 0x0 [0082.083] lstrlenW (lpString=".sdf") returned 4 [0082.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".sdf") returned 0x0 [0082.083] lstrlenW (lpString=".MDF") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".MDF") returned 0x0 [0082.084] lstrlenW (lpString=".DBF") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".DBF") returned 0x0 [0082.084] lstrlenW (lpString=".DB") returned 3 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".DB") returned 0x0 [0082.084] lstrlenW (lpString=".db") returned 3 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".db") returned 0x0 [0082.084] lstrlenW (lpString=".ndf") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".ndf") returned 0x0 [0082.084] lstrlenW (lpString=".NDF") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".NDF") returned 0x0 [0082.084] lstrlenW (lpString=".Mdf") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".Mdf") returned 0x0 [0082.084] lstrlenW (lpString=".dat") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".dat") returned 0x0 [0082.084] lstrlenW (lpString=".DAT") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".DAT") returned 0x0 [0082.084] lstrlenW (lpString=".ldf") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".ldf") returned 0x0 [0082.084] lstrlenW (lpString=".LDF") returned 4 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch=".LDF") returned 0x0 [0082.084] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.085] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0082.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.085] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.085] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20208660412) returned 1 [0082.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfbc4d70, dwHighDateTime=0x1d585b4)) [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762258 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762258 | out: hHeap=0x260000) returned 1 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27646e8 [0082.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.086] GetLastError () returned 0x0 [0082.087] GetLastError () returned 0x0 [0082.087] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.087] GetLastError () returned 0x0 [0082.087] GetLastError () returned 0x0 [0082.090] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.090] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.091] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.091] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.091] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.091] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.091] CloseHandle (hObject=0xd8) returned 1 [0082.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.093] GetLastError () returned 0x0 [0082.093] RtlWakeConditionVariable () returned 0x0 [0082.093] GetCurrentThreadId () returned 0x998 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".ldf") returned 0x0 [0082.093] lstrlenW (lpString=".vhd") returned 4 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".vhd") returned 0x0 [0082.093] lstrlenW (lpString=".vhdx") returned 5 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".vhdx") returned 0x0 [0082.093] lstrlenW (lpString=".pst") returned 4 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".pst") returned 0x0 [0082.093] lstrlenW (lpString=".ost") returned 4 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".ost") returned 0x0 [0082.093] lstrlenW (lpString=".bak") returned 4 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".bak") returned 0x0 [0082.093] lstrlenW (lpString=".bac") returned 4 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".bac") returned 0x0 [0082.093] lstrlenW (lpString=".sys") returned 4 [0082.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".sys") returned 0x0 [0082.094] lstrlenW (lpString=".v2i") returned 4 [0082.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".v2i") returned 0x0 [0082.094] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.095] lstrlenW (lpString=".sql") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".sql") returned 0x0 [0082.095] lstrlenW (lpString=".mdf") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".mdf") returned 0x0 [0082.095] lstrlenW (lpString=".txt") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".txt") returned 0x0 [0082.095] lstrlenW (lpString=".dbf") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".dbf") returned 0x0 [0082.095] lstrlenW (lpString=".ckp") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".ckp") returned 0x0 [0082.095] lstrlenW (lpString=".dacpac") returned 7 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".dacpac") returned 0x0 [0082.095] lstrlenW (lpString=".db3") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".db3") returned 0x0 [0082.095] lstrlenW (lpString=".dtxs") returned 5 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".dtxs") returned 0x0 [0082.095] lstrlenW (lpString=".mdt") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".mdt") returned 0x0 [0082.095] lstrlenW (lpString=".sdf") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".sdf") returned 0x0 [0082.095] lstrlenW (lpString=".MDF") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".MDF") returned 0x0 [0082.095] lstrlenW (lpString=".DBF") returned 4 [0082.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".DBF") returned 0x0 [0082.095] lstrlenW (lpString=".DB") returned 3 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".DB") returned 0x0 [0082.096] lstrlenW (lpString=".db") returned 3 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".db") returned 0x0 [0082.096] lstrlenW (lpString=".ndf") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".ndf") returned 0x0 [0082.096] lstrlenW (lpString=".NDF") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".NDF") returned 0x0 [0082.096] lstrlenW (lpString=".Mdf") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".Mdf") returned 0x0 [0082.096] lstrlenW (lpString=".dat") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".dat") returned 0x0 [0082.096] lstrlenW (lpString=".DAT") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".DAT") returned 0x0 [0082.096] lstrlenW (lpString=".ldf") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".ldf") returned 0x0 [0082.096] lstrlenW (lpString=".LDF") returned 4 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch=".LDF") returned 0x0 [0082.096] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.096] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0082.097] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.097] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.097] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20209846278) returned 1 [0082.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfbeaed0, dwHighDateTime=0x1d585b4)) [0082.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27621e8 [0082.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27621e8 | out: hHeap=0x260000) returned 1 [0082.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27646e8 [0082.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.098] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.098] GetLastError () returned 0x0 [0082.098] GetLastError () returned 0x0 [0082.099] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.099] GetLastError () returned 0x0 [0082.099] GetLastError () returned 0x0 [0082.101] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd850, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.101] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x27b0, lpOverlapped=0x0) returned 1 [0082.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.101] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.101] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.101] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.101] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.101] CloseHandle (hObject=0xd8) returned 1 [0082.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.101] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.103] GetLastError () returned 0x0 [0082.103] RtlWakeConditionVariable () returned 0x0 [0082.103] GetCurrentThreadId () returned 0x998 [0082.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".ldf") returned 0x0 [0082.103] lstrlenW (lpString=".vhd") returned 4 [0082.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".vhd") returned 0x0 [0082.103] lstrlenW (lpString=".vhdx") returned 5 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".vhdx") returned 0x0 [0082.104] lstrlenW (lpString=".pst") returned 4 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".pst") returned 0x0 [0082.104] lstrlenW (lpString=".ost") returned 4 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".ost") returned 0x0 [0082.104] lstrlenW (lpString=".bak") returned 4 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".bak") returned 0x0 [0082.104] lstrlenW (lpString=".bac") returned 4 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".bac") returned 0x0 [0082.104] lstrlenW (lpString=".sys") returned 4 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".sys") returned 0x0 [0082.104] lstrlenW (lpString=".v2i") returned 4 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".v2i") returned 0x0 [0082.104] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.105] lstrlenW (lpString=".sql") returned 4 [0082.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".sql") returned 0x0 [0082.105] lstrlenW (lpString=".mdf") returned 4 [0082.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".mdf") returned 0x0 [0082.105] lstrlenW (lpString=".txt") returned 4 [0082.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".txt") returned 0x0 [0082.106] lstrlenW (lpString=".dbf") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".dbf") returned 0x0 [0082.106] lstrlenW (lpString=".ckp") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".ckp") returned 0x0 [0082.106] lstrlenW (lpString=".dacpac") returned 7 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".dacpac") returned 0x0 [0082.106] lstrlenW (lpString=".db3") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".db3") returned 0x0 [0082.106] lstrlenW (lpString=".dtxs") returned 5 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".dtxs") returned 0x0 [0082.106] lstrlenW (lpString=".mdt") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".mdt") returned 0x0 [0082.106] lstrlenW (lpString=".sdf") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".sdf") returned 0x0 [0082.106] lstrlenW (lpString=".MDF") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".MDF") returned 0x0 [0082.106] lstrlenW (lpString=".DBF") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".DBF") returned 0x0 [0082.106] lstrlenW (lpString=".DB") returned 3 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".DB") returned 0x0 [0082.106] lstrlenW (lpString=".db") returned 3 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".db") returned 0x0 [0082.106] lstrlenW (lpString=".ndf") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".ndf") returned 0x0 [0082.106] lstrlenW (lpString=".NDF") returned 4 [0082.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".NDF") returned 0x0 [0082.107] lstrlenW (lpString=".Mdf") returned 4 [0082.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".Mdf") returned 0x0 [0082.107] lstrlenW (lpString=".dat") returned 4 [0082.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".dat") returned 0x0 [0082.107] lstrlenW (lpString=".DAT") returned 4 [0082.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".DAT") returned 0x0 [0082.107] lstrlenW (lpString=".ldf") returned 4 [0082.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".ldf") returned 0x0 [0082.107] lstrlenW (lpString=".LDF") returned 4 [0082.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch=".LDF") returned 0x0 [0082.107] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.107] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0082.108] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.108] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.108] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20210927408) returned 1 [0082.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfc11030, dwHighDateTime=0x1d585b4)) [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27621b0 [0082.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27621b0 | out: hHeap=0x260000) returned 1 [0082.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27643f0 [0082.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.109] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.109] GetLastError () returned 0x0 [0082.109] GetLastError () returned 0x0 [0082.109] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.109] GetLastError () returned 0x0 [0082.110] GetLastError () returned 0x0 [0082.111] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffda50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.112] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x25b0, lpOverlapped=0x0) returned 1 [0082.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.112] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.112] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.112] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.112] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.112] CloseHandle (hObject=0xd8) returned 1 [0082.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.114] GetLastError () returned 0x0 [0082.114] RtlWakeConditionVariable () returned 0x0 [0082.114] GetCurrentThreadId () returned 0x998 [0082.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".ldf") returned 0x0 [0082.114] lstrlenW (lpString=".vhd") returned 4 [0082.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".vhd") returned 0x0 [0082.114] lstrlenW (lpString=".vhdx") returned 5 [0082.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".vhdx") returned 0x0 [0082.114] lstrlenW (lpString=".pst") returned 4 [0082.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".pst") returned 0x0 [0082.114] lstrlenW (lpString=".ost") returned 4 [0082.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".ost") returned 0x0 [0082.114] lstrlenW (lpString=".bak") returned 4 [0082.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".bak") returned 0x0 [0082.114] lstrlenW (lpString=".bac") returned 4 [0082.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".bac") returned 0x0 [0082.115] lstrlenW (lpString=".sys") returned 4 [0082.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".sys") returned 0x0 [0082.115] lstrlenW (lpString=".v2i") returned 4 [0082.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".v2i") returned 0x0 [0082.115] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.116] lstrlenW (lpString=".sql") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".sql") returned 0x0 [0082.116] lstrlenW (lpString=".mdf") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".mdf") returned 0x0 [0082.116] lstrlenW (lpString=".txt") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".txt") returned 0x0 [0082.116] lstrlenW (lpString=".dbf") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".dbf") returned 0x0 [0082.116] lstrlenW (lpString=".ckp") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".ckp") returned 0x0 [0082.116] lstrlenW (lpString=".dacpac") returned 7 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".dacpac") returned 0x0 [0082.116] lstrlenW (lpString=".db3") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".db3") returned 0x0 [0082.116] lstrlenW (lpString=".dtxs") returned 5 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".dtxs") returned 0x0 [0082.116] lstrlenW (lpString=".mdt") returned 4 [0082.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".mdt") returned 0x0 [0082.117] lstrlenW (lpString=".sdf") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".sdf") returned 0x0 [0082.117] lstrlenW (lpString=".MDF") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".MDF") returned 0x0 [0082.117] lstrlenW (lpString=".DBF") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".DBF") returned 0x0 [0082.117] lstrlenW (lpString=".DB") returned 3 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".DB") returned 0x0 [0082.117] lstrlenW (lpString=".db") returned 3 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".db") returned 0x0 [0082.117] lstrlenW (lpString=".ndf") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".ndf") returned 0x0 [0082.117] lstrlenW (lpString=".NDF") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".NDF") returned 0x0 [0082.117] lstrlenW (lpString=".Mdf") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".Mdf") returned 0x0 [0082.117] lstrlenW (lpString=".dat") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".dat") returned 0x0 [0082.117] lstrlenW (lpString=".DAT") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".DAT") returned 0x0 [0082.117] lstrlenW (lpString=".ldf") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".ldf") returned 0x0 [0082.117] lstrlenW (lpString=".LDF") returned 4 [0082.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch=".LDF") returned 0x0 [0082.117] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.118] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2690) returned 1 [0082.191] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.191] CryptReleaseContext (hProv=0x2d2690, dwFlags=0x0) returned 1 [0082.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.191] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20219262263) returned 1 [0082.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfccf710, dwHighDateTime=0x1d585b4)) [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762178 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762178 | out: hHeap=0x260000) returned 1 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0082.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.192] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.192] GetLastError () returned 0x0 [0082.193] GetLastError () returned 0x0 [0082.193] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.193] GetLastError () returned 0x0 [0082.193] GetLastError () returned 0x0 [0082.194] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.194] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3d90, lpOverlapped=0x0) returned 1 [0082.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.195] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.195] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.195] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.195] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.195] CloseHandle (hObject=0xd8) returned 1 [0082.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.197] GetLastError () returned 0x0 [0082.197] RtlWakeConditionVariable () returned 0x0 [0082.197] GetCurrentThreadId () returned 0x998 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".ldf") returned 0x0 [0082.197] lstrlenW (lpString=".vhd") returned 4 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".vhd") returned 0x0 [0082.197] lstrlenW (lpString=".vhdx") returned 5 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".vhdx") returned 0x0 [0082.197] lstrlenW (lpString=".pst") returned 4 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".pst") returned 0x0 [0082.197] lstrlenW (lpString=".ost") returned 4 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".ost") returned 0x0 [0082.197] lstrlenW (lpString=".bak") returned 4 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".bak") returned 0x0 [0082.197] lstrlenW (lpString=".bac") returned 4 [0082.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".bac") returned 0x0 [0082.197] lstrlenW (lpString=".sys") returned 4 [0082.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".sys") returned 0x0 [0082.198] lstrlenW (lpString=".v2i") returned 4 [0082.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".v2i") returned 0x0 [0082.198] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.209] lstrlenW (lpString=".sql") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".sql") returned 0x0 [0082.209] lstrlenW (lpString=".mdf") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".mdf") returned 0x0 [0082.209] lstrlenW (lpString=".txt") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".txt") returned 0x0 [0082.209] lstrlenW (lpString=".dbf") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".dbf") returned 0x0 [0082.209] lstrlenW (lpString=".ckp") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".ckp") returned 0x0 [0082.209] lstrlenW (lpString=".dacpac") returned 7 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".dacpac") returned 0x0 [0082.209] lstrlenW (lpString=".db3") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".db3") returned 0x0 [0082.209] lstrlenW (lpString=".dtxs") returned 5 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".dtxs") returned 0x0 [0082.209] lstrlenW (lpString=".mdt") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".mdt") returned 0x0 [0082.209] lstrlenW (lpString=".sdf") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".sdf") returned 0x0 [0082.209] lstrlenW (lpString=".MDF") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".MDF") returned 0x0 [0082.209] lstrlenW (lpString=".DBF") returned 4 [0082.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".DBF") returned 0x0 [0082.210] lstrlenW (lpString=".DB") returned 3 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".DB") returned 0x0 [0082.210] lstrlenW (lpString=".db") returned 3 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".db") returned 0x0 [0082.210] lstrlenW (lpString=".ndf") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".ndf") returned 0x0 [0082.210] lstrlenW (lpString=".NDF") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".NDF") returned 0x0 [0082.210] lstrlenW (lpString=".Mdf") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".Mdf") returned 0x0 [0082.210] lstrlenW (lpString=".dat") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".dat") returned 0x0 [0082.210] lstrlenW (lpString=".DAT") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".DAT") returned 0x0 [0082.210] lstrlenW (lpString=".ldf") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".ldf") returned 0x0 [0082.210] lstrlenW (lpString=".LDF") returned 4 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch=".LDF") returned 0x0 [0082.210] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.210] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2c68) returned 1 [0082.211] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.211] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.211] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20221252909) returned 1 [0082.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfcf5870, dwHighDateTime=0x1d585b4)) [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338b10 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338b10 | out: hHeap=0x260000) returned 1 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764488 [0082.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.212] GetLastError () returned 0x0 [0082.213] GetLastError () returned 0x0 [0082.213] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.213] GetLastError () returned 0x0 [0082.213] GetLastError () returned 0x0 [0082.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.216] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5b80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x5b80, lpOverlapped=0x0) returned 1 [0082.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.216] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.216] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.216] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.217] CloseHandle (hObject=0xf0) returned 1 [0082.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.217] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.218] GetLastError () returned 0x0 [0082.218] RtlWakeConditionVariable () returned 0x0 [0082.218] GetCurrentThreadId () returned 0x998 [0082.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".ldf") returned 0x0 [0082.218] lstrlenW (lpString=".vhd") returned 4 [0082.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".vhd") returned 0x0 [0082.218] lstrlenW (lpString=".vhdx") returned 5 [0082.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".vhdx") returned 0x0 [0082.219] lstrlenW (lpString=".pst") returned 4 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".pst") returned 0x0 [0082.219] lstrlenW (lpString=".ost") returned 4 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".ost") returned 0x0 [0082.219] lstrlenW (lpString=".bak") returned 4 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".bak") returned 0x0 [0082.219] lstrlenW (lpString=".bac") returned 4 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".bac") returned 0x0 [0082.219] lstrlenW (lpString=".sys") returned 4 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".sys") returned 0x0 [0082.219] lstrlenW (lpString=".v2i") returned 4 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".v2i") returned 0x0 [0082.219] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.248] lstrlenW (lpString=".sql") returned 4 [0082.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".sql") returned 0x0 [0082.248] lstrlenW (lpString=".mdf") returned 4 [0082.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".mdf") returned 0x0 [0082.248] lstrlenW (lpString=".txt") returned 4 [0082.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".txt") returned 0x0 [0082.248] lstrlenW (lpString=".dbf") returned 4 [0082.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".dbf") returned 0x0 [0082.248] lstrlenW (lpString=".ckp") returned 4 [0082.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".ckp") returned 0x0 [0082.248] lstrlenW (lpString=".dacpac") returned 7 [0082.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".dacpac") returned 0x0 [0082.262] lstrlenW (lpString=".db3") returned 4 [0082.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".db3") returned 0x0 [0082.272] lstrlenW (lpString=".dtxs") returned 5 [0082.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".dtxs") returned 0x0 [0082.273] lstrlenW (lpString=".mdt") returned 4 [0082.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".mdt") returned 0x0 [0082.273] lstrlenW (lpString=".sdf") returned 4 [0082.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".sdf") returned 0x0 [0082.273] lstrlenW (lpString=".MDF") returned 4 [0082.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".MDF") returned 0x0 [0082.283] lstrlenW (lpString=".DBF") returned 4 [0082.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".DBF") returned 0x0 [0082.283] lstrlenW (lpString=".DB") returned 3 [0082.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".DB") returned 0x0 [0082.283] lstrlenW (lpString=".db") returned 3 [0082.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".db") returned 0x0 [0082.283] lstrlenW (lpString=".ndf") returned 4 [0082.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".ndf") returned 0x0 [0082.284] lstrlenW (lpString=".NDF") returned 4 [0082.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".NDF") returned 0x0 [0082.284] lstrlenW (lpString=".Mdf") returned 4 [0082.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".Mdf") returned 0x0 [0082.284] lstrlenW (lpString=".dat") returned 4 [0082.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".dat") returned 0x0 [0082.284] lstrlenW (lpString=".DAT") returned 4 [0082.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".DAT") returned 0x0 [0082.284] lstrlenW (lpString=".ldf") returned 4 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".ldf") returned 0x0 [0082.290] lstrlenW (lpString=".LDF") returned 4 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch=".LDF") returned 0x0 [0082.290] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0082.290] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2a48) returned 1 [0082.291] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0082.291] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0082.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.291] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20229247413) returned 1 [0082.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfdda0b0, dwHighDateTime=0x1d585b4)) [0082.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338c98 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338c98 | out: hHeap=0x260000) returned 1 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324de8 [0082.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.292] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.292] GetLastError () returned 0x0 [0082.292] GetLastError () returned 0x0 [0082.292] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.293] GetLastError () returned 0x0 [0082.293] GetLastError () returned 0x0 [0082.295] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff8e80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.295] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7180, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x7180, lpOverlapped=0x0) returned 1 [0082.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.295] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.295] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.295] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.295] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.295] CloseHandle (hObject=0xe4) returned 1 [0082.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.297] GetLastError () returned 0x0 [0082.297] RtlWakeConditionVariable () returned 0x0 [0082.297] GetCurrentThreadId () returned 0x998 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".ldf") returned 0x0 [0082.297] lstrlenW (lpString=".vhd") returned 4 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".vhd") returned 0x0 [0082.297] lstrlenW (lpString=".vhdx") returned 5 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".vhdx") returned 0x0 [0082.297] lstrlenW (lpString=".pst") returned 4 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".pst") returned 0x0 [0082.297] lstrlenW (lpString=".ost") returned 4 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".ost") returned 0x0 [0082.297] lstrlenW (lpString=".bak") returned 4 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".bak") returned 0x0 [0082.297] lstrlenW (lpString=".bac") returned 4 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".bac") returned 0x0 [0082.297] lstrlenW (lpString=".sys") returned 4 [0082.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".sys") returned 0x0 [0082.297] lstrlenW (lpString=".v2i") returned 4 [0082.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".v2i") returned 0x0 [0082.298] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.299] lstrlenW (lpString=".sql") returned 4 [0082.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".sql") returned 0x0 [0082.299] lstrlenW (lpString=".mdf") returned 4 [0082.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".mdf") returned 0x0 [0082.299] lstrlenW (lpString=".txt") returned 4 [0082.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".txt") returned 0x0 [0082.299] lstrlenW (lpString=".dbf") returned 4 [0082.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".dbf") returned 0x0 [0082.299] lstrlenW (lpString=".ckp") returned 4 [0082.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".ckp") returned 0x0 [0082.299] lstrlenW (lpString=".dacpac") returned 7 [0082.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".dacpac") returned 0x0 [0082.300] lstrlenW (lpString=".db3") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".db3") returned 0x0 [0082.300] lstrlenW (lpString=".dtxs") returned 5 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".dtxs") returned 0x0 [0082.300] lstrlenW (lpString=".mdt") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".mdt") returned 0x0 [0082.300] lstrlenW (lpString=".sdf") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".sdf") returned 0x0 [0082.300] lstrlenW (lpString=".MDF") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".MDF") returned 0x0 [0082.300] lstrlenW (lpString=".DBF") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".DBF") returned 0x0 [0082.300] lstrlenW (lpString=".DB") returned 3 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".DB") returned 0x0 [0082.300] lstrlenW (lpString=".db") returned 3 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".db") returned 0x0 [0082.300] lstrlenW (lpString=".ndf") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".ndf") returned 0x0 [0082.300] lstrlenW (lpString=".NDF") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".NDF") returned 0x0 [0082.300] lstrlenW (lpString=".Mdf") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".Mdf") returned 0x0 [0082.300] lstrlenW (lpString=".dat") returned 4 [0082.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".dat") returned 0x0 [0082.300] lstrlenW (lpString=".DAT") returned 4 [0082.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".DAT") returned 0x0 [0082.301] lstrlenW (lpString=".ldf") returned 4 [0082.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".ldf") returned 0x0 [0082.301] lstrlenW (lpString=".LDF") returned 4 [0082.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch=".LDF") returned 0x0 [0082.301] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0082.301] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2c68) returned 1 [0082.302] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0082.302] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.302] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20230303728) returned 1 [0082.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfdda0b0, dwHighDateTime=0x1d585b4)) [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338cd0 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338cd0 | out: hHeap=0x260000) returned 1 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325898 [0082.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.303] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.303] GetLastError () returned 0x0 [0082.303] GetLastError () returned 0x0 [0082.303] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.303] GetLastError () returned 0x0 [0082.303] GetLastError () returned 0x0 [0082.312] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff3a78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.314] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc588, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xc588, lpOverlapped=0x0) returned 1 [0082.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.315] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.315] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.315] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.315] CloseHandle (hObject=0xe4) returned 1 [0082.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.382] GetLastError () returned 0x0 [0082.383] RtlWakeConditionVariable () returned 0x0 [0082.383] GetCurrentThreadId () returned 0x998 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".ldf") returned 0x0 [0082.383] lstrlenW (lpString=".vhd") returned 4 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".vhd") returned 0x0 [0082.383] lstrlenW (lpString=".vhdx") returned 5 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".vhdx") returned 0x0 [0082.383] lstrlenW (lpString=".pst") returned 4 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".pst") returned 0x0 [0082.383] lstrlenW (lpString=".ost") returned 4 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".ost") returned 0x0 [0082.383] lstrlenW (lpString=".bak") returned 4 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".bak") returned 0x0 [0082.383] lstrlenW (lpString=".bac") returned 4 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".bac") returned 0x0 [0082.383] lstrlenW (lpString=".sys") returned 4 [0082.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".sys") returned 0x0 [0082.384] lstrlenW (lpString=".v2i") returned 4 [0082.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".v2i") returned 0x0 [0082.384] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch="s\r\n.v2i") returned 0x0 [0082.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.385] lstrlenW (lpString=".sql") returned 4 [0082.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".sql") returned 0x0 [0082.386] lstrlenW (lpString=".mdf") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".mdf") returned 0x0 [0082.386] lstrlenW (lpString=".txt") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".txt") returned 0x0 [0082.386] lstrlenW (lpString=".dbf") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".dbf") returned 0x0 [0082.386] lstrlenW (lpString=".ckp") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".ckp") returned 0x0 [0082.386] lstrlenW (lpString=".dacpac") returned 7 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".dacpac") returned 0x0 [0082.386] lstrlenW (lpString=".db3") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".db3") returned 0x0 [0082.386] lstrlenW (lpString=".dtxs") returned 5 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".dtxs") returned 0x0 [0082.386] lstrlenW (lpString=".mdt") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".mdt") returned 0x0 [0082.386] lstrlenW (lpString=".sdf") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".sdf") returned 0x0 [0082.386] lstrlenW (lpString=".MDF") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".MDF") returned 0x0 [0082.386] lstrlenW (lpString=".DBF") returned 4 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".DBF") returned 0x0 [0082.386] lstrlenW (lpString=".DB") returned 3 [0082.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".DB") returned 0x0 [0082.386] lstrlenW (lpString=".db") returned 3 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".db") returned 0x0 [0082.387] lstrlenW (lpString=".ndf") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".ndf") returned 0x0 [0082.387] lstrlenW (lpString=".NDF") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".NDF") returned 0x0 [0082.387] lstrlenW (lpString=".Mdf") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".Mdf") returned 0x0 [0082.387] lstrlenW (lpString=".dat") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".dat") returned 0x0 [0082.387] lstrlenW (lpString=".DAT") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".DAT") returned 0x0 [0082.387] lstrlenW (lpString=".ldf") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".ldf") returned 0x0 [0082.387] lstrlenW (lpString=".LDF") returned 4 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch=".LDF") returned 0x0 [0082.387] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.387] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2f10) returned 1 [0082.388] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.388] CryptReleaseContext (hProv=0x2d2f10, dwFlags=0x0) returned 1 [0082.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.388] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20238940986) returned 1 [0082.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfebe8f0, dwHighDateTime=0x1d585b4)) [0082.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338e90 [0082.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338e90 | out: hHeap=0x260000) returned 1 [0082.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324de8 [0082.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.389] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.389] GetLastError () returned 0x0 [0082.389] GetLastError () returned 0x0 [0082.389] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.390] GetLastError () returned 0x0 [0082.390] GetLastError () returned 0x0 [0082.404] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffac1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.405] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x53f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x53f, lpOverlapped=0x0) returned 1 [0082.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.405] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.405] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.405] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.405] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.405] CloseHandle (hObject=0xd8) returned 1 [0082.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.[deadmin@cock.li].deadmin")) returned 1 [0082.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.407] GetLastError () returned 0x0 [0082.407] RtlWakeConditionVariable () returned 0x0 [0082.407] GetCurrentThreadId () returned 0x998 [0082.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".ldf") returned 0x0 [0082.407] lstrlenW (lpString=".vhd") returned 4 [0082.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".vhd") returned 0x0 [0082.407] lstrlenW (lpString=".vhdx") returned 5 [0082.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".vhdx") returned 0x0 [0082.407] lstrlenW (lpString=".pst") returned 4 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".pst") returned 0x0 [0082.408] lstrlenW (lpString=".ost") returned 4 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".ost") returned 0x0 [0082.408] lstrlenW (lpString=".bak") returned 4 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".bak") returned 0x0 [0082.408] lstrlenW (lpString=".bac") returned 4 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".bac") returned 0x0 [0082.408] lstrlenW (lpString=".sys") returned 4 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".sys") returned 0x0 [0082.408] lstrlenW (lpString=".v2i") returned 4 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".v2i") returned 0x0 [0082.408] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.409] lstrlenW (lpString=".sql") returned 4 [0082.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".sql") returned 0x0 [0082.409] lstrlenW (lpString=".mdf") returned 4 [0082.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".mdf") returned 0x0 [0082.409] lstrlenW (lpString=".txt") returned 4 [0082.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".txt") returned 0x0 [0082.410] lstrlenW (lpString=".dbf") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".dbf") returned 0x0 [0082.410] lstrlenW (lpString=".ckp") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".ckp") returned 0x0 [0082.410] lstrlenW (lpString=".dacpac") returned 7 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".dacpac") returned 0x0 [0082.410] lstrlenW (lpString=".db3") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".db3") returned 0x0 [0082.410] lstrlenW (lpString=".dtxs") returned 5 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".dtxs") returned 0x0 [0082.410] lstrlenW (lpString=".mdt") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".mdt") returned 0x0 [0082.410] lstrlenW (lpString=".sdf") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".sdf") returned 0x0 [0082.410] lstrlenW (lpString=".MDF") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".MDF") returned 0x0 [0082.410] lstrlenW (lpString=".DBF") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".DBF") returned 0x0 [0082.410] lstrlenW (lpString=".DB") returned 3 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".DB") returned 0x0 [0082.410] lstrlenW (lpString=".db") returned 3 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".db") returned 0x0 [0082.410] lstrlenW (lpString=".ndf") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".ndf") returned 0x0 [0082.410] lstrlenW (lpString=".NDF") returned 4 [0082.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".NDF") returned 0x0 [0082.411] lstrlenW (lpString=".Mdf") returned 4 [0082.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".Mdf") returned 0x0 [0082.411] lstrlenW (lpString=".dat") returned 4 [0082.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".dat") returned 0x0 [0082.411] lstrlenW (lpString=".DAT") returned 4 [0082.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".DAT") returned 0x0 [0082.411] lstrlenW (lpString=".ldf") returned 4 [0082.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".ldf") returned 0x0 [0082.411] lstrlenW (lpString=".LDF") returned 4 [0082.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch=".LDF") returned 0x0 [0082.411] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.411] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0082.412] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.412] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0082.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.412] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20241320242) returned 1 [0082.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbfee4a50, dwHighDateTime=0x1d585b4)) [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338ec8 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338ec8 | out: hHeap=0x260000) returned 1 [0082.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324de8 [0082.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.413] GetLastError () returned 0x0 [0082.413] GetLastError () returned 0x0 [0082.413] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.413] GetLastError () returned 0x0 [0082.414] GetLastError () returned 0x0 [0082.437] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.437] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.438] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.439] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.451] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.451] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.451] CloseHandle (hObject=0xd8) returned 1 [0082.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.454] GetLastError () returned 0x0 [0082.454] RtlWakeConditionVariable () returned 0x0 [0082.454] GetCurrentThreadId () returned 0x998 [0082.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".ldf") returned 0x0 [0082.454] lstrlenW (lpString=".vhd") returned 4 [0082.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".vhd") returned 0x0 [0082.454] lstrlenW (lpString=".vhdx") returned 5 [0082.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".vhdx") returned 0x0 [0082.454] lstrlenW (lpString=".pst") returned 4 [0082.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".pst") returned 0x0 [0082.454] lstrlenW (lpString=".ost") returned 4 [0082.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".ost") returned 0x0 [0082.454] lstrlenW (lpString=".bak") returned 4 [0082.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".bak") returned 0x0 [0082.454] lstrlenW (lpString=".bac") returned 4 [0082.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".bac") returned 0x0 [0082.455] lstrlenW (lpString=".sys") returned 4 [0082.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".sys") returned 0x0 [0082.455] lstrlenW (lpString=".v2i") returned 4 [0082.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".v2i") returned 0x0 [0082.455] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.458] lstrlenW (lpString=".sql") returned 4 [0082.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".sql") returned 0x0 [0082.458] lstrlenW (lpString=".mdf") returned 4 [0082.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".mdf") returned 0x0 [0082.458] lstrlenW (lpString=".txt") returned 4 [0082.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".txt") returned 0x0 [0082.458] lstrlenW (lpString=".dbf") returned 4 [0082.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".dbf") returned 0x0 [0082.458] lstrlenW (lpString=".ckp") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".ckp") returned 0x0 [0082.459] lstrlenW (lpString=".dacpac") returned 7 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".dacpac") returned 0x0 [0082.459] lstrlenW (lpString=".db3") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".db3") returned 0x0 [0082.459] lstrlenW (lpString=".dtxs") returned 5 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".dtxs") returned 0x0 [0082.459] lstrlenW (lpString=".mdt") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".mdt") returned 0x0 [0082.459] lstrlenW (lpString=".sdf") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".sdf") returned 0x0 [0082.459] lstrlenW (lpString=".MDF") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".MDF") returned 0x0 [0082.459] lstrlenW (lpString=".DBF") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".DBF") returned 0x0 [0082.459] lstrlenW (lpString=".DB") returned 3 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".DB") returned 0x0 [0082.459] lstrlenW (lpString=".db") returned 3 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".db") returned 0x0 [0082.459] lstrlenW (lpString=".ndf") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".ndf") returned 0x0 [0082.459] lstrlenW (lpString=".NDF") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".NDF") returned 0x0 [0082.459] lstrlenW (lpString=".Mdf") returned 4 [0082.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".Mdf") returned 0x0 [0082.459] lstrlenW (lpString=".dat") returned 4 [0082.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".dat") returned 0x0 [0082.460] lstrlenW (lpString=".DAT") returned 4 [0082.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".DAT") returned 0x0 [0082.460] lstrlenW (lpString=".ldf") returned 4 [0082.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".ldf") returned 0x0 [0082.460] lstrlenW (lpString=".LDF") returned 4 [0082.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch=".LDF") returned 0x0 [0082.460] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.460] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3130) returned 1 [0082.461] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.461] CryptReleaseContext (hProv=0x2d3130, dwFlags=0x0) returned 1 [0082.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.461] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20246209988) returned 1 [0082.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbff56e70, dwHighDateTime=0x1d585b4)) [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338f70 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338f70 | out: hHeap=0x260000) returned 1 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.462] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.462] GetLastError () returned 0x0 [0082.462] GetLastError () returned 0x0 [0082.462] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.462] GetLastError () returned 0x0 [0082.463] GetLastError () returned 0x0 [0082.465] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7c38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.465] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x183c8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x183c8, lpOverlapped=0x0) returned 1 [0082.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.466] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.466] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.466] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.466] CloseHandle (hObject=0xe4) returned 1 [0082.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x3490a8 [0082.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3490a8 | out: hHeap=0x260000) returned 1 [0082.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.468] GetLastError () returned 0x0 [0082.468] RtlWakeConditionVariable () returned 0x0 [0082.468] GetCurrentThreadId () returned 0x998 [0082.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".ldf") returned 0x0 [0082.468] lstrlenW (lpString=".vhd") returned 4 [0082.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".vhd") returned 0x0 [0082.468] lstrlenW (lpString=".vhdx") returned 5 [0082.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".vhdx") returned 0x0 [0082.468] lstrlenW (lpString=".pst") returned 4 [0082.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".pst") returned 0x0 [0082.468] lstrlenW (lpString=".ost") returned 4 [0082.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".ost") returned 0x0 [0082.468] lstrlenW (lpString=".bak") returned 4 [0082.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".bak") returned 0x0 [0082.468] lstrlenW (lpString=".bac") returned 4 [0082.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".bac") returned 0x0 [0082.469] lstrlenW (lpString=".sys") returned 4 [0082.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".sys") returned 0x0 [0082.469] lstrlenW (lpString=".v2i") returned 4 [0082.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".v2i") returned 0x0 [0082.469] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.470] lstrlenW (lpString=".sql") returned 4 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".sql") returned 0x0 [0082.470] lstrlenW (lpString=".mdf") returned 4 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".mdf") returned 0x0 [0082.470] lstrlenW (lpString=".txt") returned 4 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".txt") returned 0x0 [0082.470] lstrlenW (lpString=".dbf") returned 4 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".dbf") returned 0x0 [0082.470] lstrlenW (lpString=".ckp") returned 4 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".ckp") returned 0x0 [0082.470] lstrlenW (lpString=".dacpac") returned 7 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".dacpac") returned 0x0 [0082.470] lstrlenW (lpString=".db3") returned 4 [0082.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".db3") returned 0x0 [0082.470] lstrlenW (lpString=".dtxs") returned 5 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".dtxs") returned 0x0 [0082.471] lstrlenW (lpString=".mdt") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".mdt") returned 0x0 [0082.471] lstrlenW (lpString=".sdf") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".sdf") returned 0x0 [0082.471] lstrlenW (lpString=".MDF") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".MDF") returned 0x0 [0082.471] lstrlenW (lpString=".DBF") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".DBF") returned 0x0 [0082.471] lstrlenW (lpString=".DB") returned 3 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".DB") returned 0x0 [0082.471] lstrlenW (lpString=".db") returned 3 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".db") returned 0x0 [0082.471] lstrlenW (lpString=".ndf") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".ndf") returned 0x0 [0082.471] lstrlenW (lpString=".NDF") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".NDF") returned 0x0 [0082.471] lstrlenW (lpString=".Mdf") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".Mdf") returned 0x0 [0082.471] lstrlenW (lpString=".dat") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".dat") returned 0x0 [0082.471] lstrlenW (lpString=".DAT") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".DAT") returned 0x0 [0082.471] lstrlenW (lpString=".ldf") returned 4 [0082.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".ldf") returned 0x0 [0082.471] lstrlenW (lpString=".LDF") returned 4 [0082.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch=".LDF") returned 0x0 [0082.472] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0082.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.472] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d32c8) returned 1 [0082.472] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.473] CryptReleaseContext (hProv=0x2d32c8, dwFlags=0x0) returned 1 [0082.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.473] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20247384442) returned 1 [0082.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbff7cfd0, dwHighDateTime=0x1d585b4)) [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338fa8 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338fa8 | out: hHeap=0x260000) returned 1 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.473] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.474] GetLastError () returned 0x0 [0082.474] GetLastError () returned 0x0 [0082.474] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.474] GetLastError () returned 0x0 [0082.474] GetLastError () returned 0x0 [0082.477] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.478] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.478] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.479] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.483] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.483] CloseHandle (hObject=0xe4) returned 1 [0082.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349218 [0082.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349218 | out: hHeap=0x260000) returned 1 [0082.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.484] GetLastError () returned 0x0 [0082.485] RtlWakeConditionVariable () returned 0x27e828 [0082.485] GetCurrentThreadId () returned 0x998 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".ldf") returned 0x0 [0082.485] lstrlenW (lpString=".vhd") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".vhd") returned 0x0 [0082.485] lstrlenW (lpString=".vhdx") returned 5 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".vhdx") returned 0x0 [0082.485] lstrlenW (lpString=".pst") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".pst") returned 0x0 [0082.485] lstrlenW (lpString=".ost") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".ost") returned 0x0 [0082.485] lstrlenW (lpString=".bak") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".bak") returned 0x0 [0082.485] lstrlenW (lpString=".bac") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".bac") returned 0x0 [0082.485] lstrlenW (lpString=".sys") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".sys") returned 0x0 [0082.485] lstrlenW (lpString=".v2i") returned 4 [0082.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".v2i") returned 0x0 [0082.485] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.496] lstrlenW (lpString=".sql") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".sql") returned 0x0 [0082.496] lstrlenW (lpString=".mdf") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".mdf") returned 0x0 [0082.496] lstrlenW (lpString=".txt") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".txt") returned 0x0 [0082.496] lstrlenW (lpString=".dbf") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".dbf") returned 0x0 [0082.496] lstrlenW (lpString=".ckp") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".ckp") returned 0x0 [0082.496] lstrlenW (lpString=".dacpac") returned 7 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".dacpac") returned 0x0 [0082.496] lstrlenW (lpString=".db3") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".db3") returned 0x0 [0082.496] lstrlenW (lpString=".dtxs") returned 5 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".dtxs") returned 0x0 [0082.496] lstrlenW (lpString=".mdt") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".mdt") returned 0x0 [0082.496] lstrlenW (lpString=".sdf") returned 4 [0082.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".sdf") returned 0x0 [0082.496] lstrlenW (lpString=".MDF") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".MDF") returned 0x0 [0082.497] lstrlenW (lpString=".DBF") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".DBF") returned 0x0 [0082.497] lstrlenW (lpString=".DB") returned 3 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".DB") returned 0x0 [0082.497] lstrlenW (lpString=".db") returned 3 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".db") returned 0x0 [0082.497] lstrlenW (lpString=".ndf") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".ndf") returned 0x0 [0082.497] lstrlenW (lpString=".NDF") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".NDF") returned 0x0 [0082.497] lstrlenW (lpString=".Mdf") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".Mdf") returned 0x0 [0082.497] lstrlenW (lpString=".dat") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".dat") returned 0x0 [0082.497] lstrlenW (lpString=".DAT") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".DAT") returned 0x0 [0082.497] lstrlenW (lpString=".ldf") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".ldf") returned 0x0 [0082.497] lstrlenW (lpString=".LDF") returned 4 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch=".LDF") returned 0x0 [0082.497] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.498] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3240) returned 1 [0082.498] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.498] CryptReleaseContext (hProv=0x2d3240, dwFlags=0x0) returned 1 [0082.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.499] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20249964534) returned 1 [0082.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbffc9290, dwHighDateTime=0x1d585b4)) [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339018 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339018 | out: hHeap=0x260000) returned 1 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.499] GetLastError () returned 0x0 [0082.500] GetLastError () returned 0x0 [0082.500] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.500] GetLastError () returned 0x0 [0082.500] GetLastError () returned 0x0 [0082.505] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.506] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.506] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.506] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.506] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.507] CloseHandle (hObject=0xe4) returned 1 [0082.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349218 [0082.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349218 | out: hHeap=0x260000) returned 1 [0082.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.509] GetLastError () returned 0x0 [0082.509] RtlWakeConditionVariable () returned 0x0 [0082.509] GetCurrentThreadId () returned 0x998 [0082.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".ldf") returned 0x0 [0082.509] lstrlenW (lpString=".vhd") returned 4 [0082.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".vhd") returned 0x0 [0082.509] lstrlenW (lpString=".vhdx") returned 5 [0082.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".vhdx") returned 0x0 [0082.509] lstrlenW (lpString=".pst") returned 4 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".pst") returned 0x0 [0082.510] lstrlenW (lpString=".ost") returned 4 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".ost") returned 0x0 [0082.510] lstrlenW (lpString=".bak") returned 4 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".bak") returned 0x0 [0082.510] lstrlenW (lpString=".bac") returned 4 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".bac") returned 0x0 [0082.510] lstrlenW (lpString=".sys") returned 4 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".sys") returned 0x0 [0082.510] lstrlenW (lpString=".v2i") returned 4 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".v2i") returned 0x0 [0082.510] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0082.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.511] lstrlenW (lpString=".sql") returned 4 [0082.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".sql") returned 0x0 [0082.511] lstrlenW (lpString=".mdf") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".mdf") returned 0x0 [0082.512] lstrlenW (lpString=".txt") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".txt") returned 0x0 [0082.512] lstrlenW (lpString=".dbf") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".dbf") returned 0x0 [0082.512] lstrlenW (lpString=".ckp") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".ckp") returned 0x0 [0082.512] lstrlenW (lpString=".dacpac") returned 7 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".dacpac") returned 0x0 [0082.512] lstrlenW (lpString=".db3") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".db3") returned 0x0 [0082.512] lstrlenW (lpString=".dtxs") returned 5 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".dtxs") returned 0x0 [0082.512] lstrlenW (lpString=".mdt") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".mdt") returned 0x0 [0082.512] lstrlenW (lpString=".sdf") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".sdf") returned 0x0 [0082.512] lstrlenW (lpString=".MDF") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".MDF") returned 0x0 [0082.512] lstrlenW (lpString=".DBF") returned 4 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".DBF") returned 0x0 [0082.512] lstrlenW (lpString=".DB") returned 3 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".DB") returned 0x0 [0082.512] lstrlenW (lpString=".db") returned 3 [0082.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".db") returned 0x0 [0082.512] lstrlenW (lpString=".ndf") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".ndf") returned 0x0 [0082.513] lstrlenW (lpString=".NDF") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".NDF") returned 0x0 [0082.513] lstrlenW (lpString=".Mdf") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".Mdf") returned 0x0 [0082.513] lstrlenW (lpString=".dat") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".dat") returned 0x0 [0082.513] lstrlenW (lpString=".DAT") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".DAT") returned 0x0 [0082.513] lstrlenW (lpString=".ldf") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".ldf") returned 0x0 [0082.513] lstrlenW (lpString=".LDF") returned 4 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch=".LDF") returned 0x0 [0082.513] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.513] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.513] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2f98) returned 1 [0082.514] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.514] CryptReleaseContext (hProv=0x2d2f98, dwFlags=0x0) returned 1 [0082.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.514] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20251532110) returned 1 [0082.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xbffef3f0, dwHighDateTime=0x1d585b4)) [0082.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762568 [0082.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762568 | out: hHeap=0x260000) returned 1 [0082.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.515] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.515] GetLastError () returned 0x0 [0082.515] GetLastError () returned 0x0 [0082.515] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.515] GetLastError () returned 0x0 [0082.516] GetLastError () returned 0x0 [0082.519] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.519] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.520] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.521] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.522] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.522] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.522] CloseHandle (hObject=0xe4) returned 1 [0082.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c348 [0082.522] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.[deadmin@cock.li].deadmin")) returned 1 [0082.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c348 | out: hHeap=0x260000) returned 1 [0082.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.524] GetLastError () returned 0x0 [0082.525] RtlWakeConditionVariable () returned 0x27e828 [0082.525] GetCurrentThreadId () returned 0x998 [0082.525] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.525] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.525] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0082.525] WriteFile (in: hFile=0xe4, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0082.527] CloseHandle (hObject=0xe4) returned 1 [0082.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e4b8 | out: hHeap=0x260000) returned 1 [0082.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0082.527] RtlWakeConditionVariable () returned 0x27e828 [0082.527] GetCurrentThreadId () returned 0x998 [0082.528] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.528] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.528] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0082.528] WriteFile (in: hFile=0xe4, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0082.530] CloseHandle (hObject=0xe4) returned 1 [0082.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0082.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0082.530] RtlWakeConditionVariable () returned 0x27e828 [0082.530] GetCurrentThreadId () returned 0x998 [0082.530] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.531] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.531] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0082.531] WriteFile (in: hFile=0xe4, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0082.534] CloseHandle (hObject=0xe4) returned 1 [0082.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0082.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0082.535] RtlWakeConditionVariable () returned 0x27e828 [0082.535] GetCurrentThreadId () returned 0x998 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".ldf") returned 0x0 [0082.535] lstrlenW (lpString=".vhd") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".vhd") returned 0x0 [0082.535] lstrlenW (lpString=".vhdx") returned 5 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".vhdx") returned 0x0 [0082.535] lstrlenW (lpString=".pst") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".pst") returned 0x0 [0082.535] lstrlenW (lpString=".ost") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".ost") returned 0x0 [0082.535] lstrlenW (lpString=".bak") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".bak") returned 0x0 [0082.535] lstrlenW (lpString=".bac") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".bac") returned 0x0 [0082.535] lstrlenW (lpString=".sys") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".sys") returned 0x0 [0082.535] lstrlenW (lpString=".v2i") returned 4 [0082.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".v2i") returned 0x0 [0082.536] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.537] lstrlenW (lpString=".sql") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".sql") returned 0x0 [0082.537] lstrlenW (lpString=".mdf") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".mdf") returned 0x0 [0082.537] lstrlenW (lpString=".txt") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".txt") returned 0x0 [0082.537] lstrlenW (lpString=".dbf") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".dbf") returned 0x0 [0082.537] lstrlenW (lpString=".ckp") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".ckp") returned 0x0 [0082.537] lstrlenW (lpString=".dacpac") returned 7 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".dacpac") returned 0x0 [0082.537] lstrlenW (lpString=".db3") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".db3") returned 0x0 [0082.537] lstrlenW (lpString=".dtxs") returned 5 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".dtxs") returned 0x0 [0082.537] lstrlenW (lpString=".mdt") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".mdt") returned 0x0 [0082.537] lstrlenW (lpString=".sdf") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".sdf") returned 0x0 [0082.537] lstrlenW (lpString=".MDF") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".MDF") returned 0x0 [0082.537] lstrlenW (lpString=".DBF") returned 4 [0082.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".DBF") returned 0x0 [0082.538] lstrlenW (lpString=".DB") returned 3 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".DB") returned 0x0 [0082.538] lstrlenW (lpString=".db") returned 3 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".db") returned 0x0 [0082.538] lstrlenW (lpString=".ndf") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".ndf") returned 0x0 [0082.538] lstrlenW (lpString=".NDF") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".NDF") returned 0x0 [0082.538] lstrlenW (lpString=".Mdf") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".Mdf") returned 0x0 [0082.538] lstrlenW (lpString=".dat") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".dat") returned 0x0 [0082.538] lstrlenW (lpString=".DAT") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".DAT") returned 0x0 [0082.538] lstrlenW (lpString=".ldf") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".ldf") returned 0x0 [0082.538] lstrlenW (lpString=".LDF") returned 4 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch=".LDF") returned 0x0 [0082.538] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.538] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d33d8) returned 1 [0082.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.539] CryptReleaseContext (hProv=0x2d33d8, dwFlags=0x0) returned 1 [0082.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.539] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20254050889) returned 1 [0082.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0015550, dwHighDateTime=0x1d585b4)) [0082.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339050 [0082.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339050 | out: hHeap=0x260000) returned 1 [0082.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.606] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.618] GetLastError () returned 0x0 [0082.618] GetLastError () returned 0x0 [0082.618] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.618] GetLastError () returned 0x0 [0082.618] GetLastError () returned 0x0 [0082.623] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.623] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.625] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.625] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.626] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.626] CloseHandle (hObject=0xe4) returned 1 [0082.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.628] GetLastError () returned 0x0 [0082.628] RtlWakeConditionVariable () returned 0x0 [0082.628] GetCurrentThreadId () returned 0x998 [0082.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".ldf") returned 0x0 [0082.629] lstrlenW (lpString=".vhd") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".vhd") returned 0x0 [0082.629] lstrlenW (lpString=".vhdx") returned 5 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".vhdx") returned 0x0 [0082.629] lstrlenW (lpString=".pst") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".pst") returned 0x0 [0082.629] lstrlenW (lpString=".ost") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".ost") returned 0x0 [0082.629] lstrlenW (lpString=".bak") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".bak") returned 0x0 [0082.629] lstrlenW (lpString=".bac") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".bac") returned 0x0 [0082.629] lstrlenW (lpString=".sys") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".sys") returned 0x0 [0082.629] lstrlenW (lpString=".v2i") returned 4 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".v2i") returned 0x0 [0082.629] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.631] lstrlenW (lpString=".sql") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".sql") returned 0x0 [0082.631] lstrlenW (lpString=".mdf") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".mdf") returned 0x0 [0082.631] lstrlenW (lpString=".txt") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".txt") returned 0x0 [0082.631] lstrlenW (lpString=".dbf") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".dbf") returned 0x0 [0082.631] lstrlenW (lpString=".ckp") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".ckp") returned 0x0 [0082.631] lstrlenW (lpString=".dacpac") returned 7 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".dacpac") returned 0x0 [0082.631] lstrlenW (lpString=".db3") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".db3") returned 0x0 [0082.631] lstrlenW (lpString=".dtxs") returned 5 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".dtxs") returned 0x0 [0082.631] lstrlenW (lpString=".mdt") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".mdt") returned 0x0 [0082.631] lstrlenW (lpString=".sdf") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".sdf") returned 0x0 [0082.631] lstrlenW (lpString=".MDF") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".MDF") returned 0x0 [0082.631] lstrlenW (lpString=".DBF") returned 4 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".DBF") returned 0x0 [0082.631] lstrlenW (lpString=".DB") returned 3 [0082.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".DB") returned 0x0 [0082.632] lstrlenW (lpString=".db") returned 3 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".db") returned 0x0 [0082.632] lstrlenW (lpString=".ndf") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".ndf") returned 0x0 [0082.632] lstrlenW (lpString=".NDF") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".NDF") returned 0x0 [0082.632] lstrlenW (lpString=".Mdf") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".Mdf") returned 0x0 [0082.632] lstrlenW (lpString=".dat") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".dat") returned 0x0 [0082.632] lstrlenW (lpString=".DAT") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".DAT") returned 0x0 [0082.632] lstrlenW (lpString=".ldf") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".ldf") returned 0x0 [0082.632] lstrlenW (lpString=".LDF") returned 4 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch=".LDF") returned 0x0 [0082.632] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.632] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d34e8) returned 1 [0082.633] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.633] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0082.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.633] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20263460913) returned 1 [0082.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc011fef0, dwHighDateTime=0x1d585b4)) [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3390c0 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3390c0 | out: hHeap=0x260000) returned 1 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.634] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.634] GetLastError () returned 0x0 [0082.635] GetLastError () returned 0x0 [0082.635] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.635] GetLastError () returned 0x0 [0082.635] GetLastError () returned 0x0 [0082.638] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.638] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.639] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.639] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.639] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.639] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.639] CloseHandle (hObject=0xe4) returned 1 [0082.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.641] GetLastError () returned 0x0 [0082.641] RtlWakeConditionVariable () returned 0x0 [0082.641] GetCurrentThreadId () returned 0x998 [0082.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".ldf") returned 0x0 [0082.641] lstrlenW (lpString=".vhd") returned 4 [0082.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".vhd") returned 0x0 [0082.641] lstrlenW (lpString=".vhdx") returned 5 [0082.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".vhdx") returned 0x0 [0082.641] lstrlenW (lpString=".pst") returned 4 [0082.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".pst") returned 0x0 [0082.641] lstrlenW (lpString=".ost") returned 4 [0082.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".ost") returned 0x0 [0082.641] lstrlenW (lpString=".bak") returned 4 [0082.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".bak") returned 0x0 [0082.642] lstrlenW (lpString=".bac") returned 4 [0082.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".bac") returned 0x0 [0082.642] lstrlenW (lpString=".sys") returned 4 [0082.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".sys") returned 0x0 [0082.642] lstrlenW (lpString=".v2i") returned 4 [0082.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".v2i") returned 0x0 [0082.642] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.643] lstrlenW (lpString=".sql") returned 4 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".sql") returned 0x0 [0082.643] lstrlenW (lpString=".mdf") returned 4 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".mdf") returned 0x0 [0082.643] lstrlenW (lpString=".txt") returned 4 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".txt") returned 0x0 [0082.643] lstrlenW (lpString=".dbf") returned 4 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".dbf") returned 0x0 [0082.643] lstrlenW (lpString=".ckp") returned 4 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".ckp") returned 0x0 [0082.643] lstrlenW (lpString=".dacpac") returned 7 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".dacpac") returned 0x0 [0082.643] lstrlenW (lpString=".db3") returned 4 [0082.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".db3") returned 0x0 [0082.643] lstrlenW (lpString=".dtxs") returned 5 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".dtxs") returned 0x0 [0082.644] lstrlenW (lpString=".mdt") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".mdt") returned 0x0 [0082.644] lstrlenW (lpString=".sdf") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".sdf") returned 0x0 [0082.644] lstrlenW (lpString=".MDF") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".MDF") returned 0x0 [0082.644] lstrlenW (lpString=".DBF") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".DBF") returned 0x0 [0082.644] lstrlenW (lpString=".DB") returned 3 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".DB") returned 0x0 [0082.644] lstrlenW (lpString=".db") returned 3 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".db") returned 0x0 [0082.644] lstrlenW (lpString=".ndf") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".ndf") returned 0x0 [0082.644] lstrlenW (lpString=".NDF") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".NDF") returned 0x0 [0082.644] lstrlenW (lpString=".Mdf") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".Mdf") returned 0x0 [0082.644] lstrlenW (lpString=".dat") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".dat") returned 0x0 [0082.644] lstrlenW (lpString=".DAT") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".DAT") returned 0x0 [0082.644] lstrlenW (lpString=".ldf") returned 4 [0082.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".ldf") returned 0x0 [0082.644] lstrlenW (lpString=".LDF") returned 4 [0082.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch=".LDF") returned 0x0 [0082.645] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.645] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d38a0) returned 1 [0082.645] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.646] CryptReleaseContext (hProv=0x2d38a0, dwFlags=0x0) returned 1 [0082.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.646] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20264835982) returned 1 [0082.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc011fef0, dwHighDateTime=0x1d585b4)) [0082.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3390f8 [0082.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3390f8 | out: hHeap=0x260000) returned 1 [0082.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.648] GetLastError () returned 0x0 [0082.648] GetLastError () returned 0x0 [0082.648] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.649] GetLastError () returned 0x0 [0082.649] GetLastError () returned 0x0 [0082.652] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.653] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.653] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.653] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.704] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.704] CloseHandle (hObject=0xe4) returned 1 [0082.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.821] GetLastError () returned 0x0 [0082.821] RtlWakeConditionVariable () returned 0x0 [0082.821] GetCurrentThreadId () returned 0x998 [0082.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".ldf") returned 0x0 [0082.821] lstrlenW (lpString=".vhd") returned 4 [0082.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".vhd") returned 0x0 [0082.821] lstrlenW (lpString=".vhdx") returned 5 [0082.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".vhdx") returned 0x0 [0082.822] lstrlenW (lpString=".pst") returned 4 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".pst") returned 0x0 [0082.822] lstrlenW (lpString=".ost") returned 4 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".ost") returned 0x0 [0082.822] lstrlenW (lpString=".bak") returned 4 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".bak") returned 0x0 [0082.822] lstrlenW (lpString=".bac") returned 4 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".bac") returned 0x0 [0082.822] lstrlenW (lpString=".sys") returned 4 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".sys") returned 0x0 [0082.822] lstrlenW (lpString=".v2i") returned 4 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".v2i") returned 0x0 [0082.822] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch="s\r\n.v2i") returned 0x0 [0082.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.823] lstrlenW (lpString=".sql") returned 4 [0082.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".sql") returned 0x0 [0082.823] lstrlenW (lpString=".mdf") returned 4 [0082.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".mdf") returned 0x0 [0082.823] lstrlenW (lpString=".txt") returned 4 [0082.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".txt") returned 0x0 [0082.823] lstrlenW (lpString=".dbf") returned 4 [0082.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".dbf") returned 0x0 [0082.823] lstrlenW (lpString=".ckp") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".ckp") returned 0x0 [0082.824] lstrlenW (lpString=".dacpac") returned 7 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".dacpac") returned 0x0 [0082.824] lstrlenW (lpString=".db3") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".db3") returned 0x0 [0082.824] lstrlenW (lpString=".dtxs") returned 5 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".dtxs") returned 0x0 [0082.824] lstrlenW (lpString=".mdt") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".mdt") returned 0x0 [0082.824] lstrlenW (lpString=".sdf") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".sdf") returned 0x0 [0082.824] lstrlenW (lpString=".MDF") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".MDF") returned 0x0 [0082.824] lstrlenW (lpString=".DBF") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".DBF") returned 0x0 [0082.824] lstrlenW (lpString=".DB") returned 3 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".DB") returned 0x0 [0082.824] lstrlenW (lpString=".db") returned 3 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".db") returned 0x0 [0082.824] lstrlenW (lpString=".ndf") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".ndf") returned 0x0 [0082.824] lstrlenW (lpString=".NDF") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".NDF") returned 0x0 [0082.824] lstrlenW (lpString=".Mdf") returned 4 [0082.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".Mdf") returned 0x0 [0082.825] lstrlenW (lpString=".dat") returned 4 [0082.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".dat") returned 0x0 [0082.825] lstrlenW (lpString=".DAT") returned 4 [0082.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".DAT") returned 0x0 [0082.825] lstrlenW (lpString=".ldf") returned 4 [0082.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".ldf") returned 0x0 [0082.825] lstrlenW (lpString=".LDF") returned 4 [0082.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch=".LDF") returned 0x0 [0082.825] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.825] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3928) returned 1 [0082.826] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.826] CryptReleaseContext (hProv=0x2d3928, dwFlags=0x0) returned 1 [0082.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.826] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20282712502) returned 1 [0082.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc02e8f70, dwHighDateTime=0x1d585b4)) [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339398 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339398 | out: hHeap=0x260000) returned 1 [0082.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0082.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.827] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.827] GetLastError () returned 0x0 [0082.827] GetLastError () returned 0x0 [0082.827] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.827] GetLastError () returned 0x0 [0082.827] GetLastError () returned 0x0 [0082.829] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffec8d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.830] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1372c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1372c, lpOverlapped=0x0) returned 1 [0082.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.830] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.830] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.830] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.830] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.830] CloseHandle (hObject=0xe4) returned 1 [0082.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.[deadmin@cock.li].deadmin")) returned 1 [0082.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.832] GetLastError () returned 0x0 [0082.832] RtlWakeConditionVariable () returned 0x0 [0082.832] GetCurrentThreadId () returned 0x998 [0082.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".ldf") returned 0x0 [0082.832] lstrlenW (lpString=".vhd") returned 4 [0082.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".vhd") returned 0x0 [0082.832] lstrlenW (lpString=".vhdx") returned 5 [0082.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".vhdx") returned 0x0 [0082.832] lstrlenW (lpString=".pst") returned 4 [0082.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".pst") returned 0x0 [0082.833] lstrlenW (lpString=".ost") returned 4 [0082.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".ost") returned 0x0 [0082.833] lstrlenW (lpString=".bak") returned 4 [0082.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".bak") returned 0x0 [0082.833] lstrlenW (lpString=".bac") returned 4 [0082.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".bac") returned 0x0 [0082.833] lstrlenW (lpString=".sys") returned 4 [0082.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".sys") returned 0x0 [0082.833] lstrlenW (lpString=".v2i") returned 4 [0082.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".v2i") returned 0x0 [0082.833] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch="s\r\n.v2i") returned 0x0 [0082.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.835] lstrlenW (lpString=".sql") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".sql") returned 0x0 [0082.835] lstrlenW (lpString=".mdf") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".mdf") returned 0x0 [0082.835] lstrlenW (lpString=".txt") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".txt") returned 0x0 [0082.835] lstrlenW (lpString=".dbf") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".dbf") returned 0x0 [0082.835] lstrlenW (lpString=".ckp") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".ckp") returned 0x0 [0082.835] lstrlenW (lpString=".dacpac") returned 7 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".dacpac") returned 0x0 [0082.835] lstrlenW (lpString=".db3") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".db3") returned 0x0 [0082.835] lstrlenW (lpString=".dtxs") returned 5 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".dtxs") returned 0x0 [0082.835] lstrlenW (lpString=".mdt") returned 4 [0082.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".mdt") returned 0x0 [0082.835] lstrlenW (lpString=".sdf") returned 4 [0082.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".sdf") returned 0x0 [0082.836] lstrlenW (lpString=".MDF") returned 4 [0082.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".MDF") returned 0x0 [0082.836] lstrlenW (lpString=".DBF") returned 4 [0082.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".DBF") returned 0x0 [0082.836] lstrlenW (lpString=".DB") returned 3 [0082.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".DB") returned 0x0 [0082.836] lstrlenW (lpString=".db") returned 3 [0082.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".db") returned 0x0 [0082.836] lstrlenW (lpString=".ndf") returned 4 [0082.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".ndf") returned 0x0 [0082.837] lstrlenW (lpString=".NDF") returned 4 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".NDF") returned 0x0 [0082.837] lstrlenW (lpString=".Mdf") returned 4 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".Mdf") returned 0x0 [0082.837] lstrlenW (lpString=".dat") returned 4 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".dat") returned 0x0 [0082.837] lstrlenW (lpString=".DAT") returned 4 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".DAT") returned 0x0 [0082.837] lstrlenW (lpString=".ldf") returned 4 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".ldf") returned 0x0 [0082.837] lstrlenW (lpString=".LDF") returned 4 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch=".LDF") returned 0x0 [0082.837] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.837] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3e78) returned 1 [0082.838] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.838] CryptReleaseContext (hProv=0x2d3e78, dwFlags=0x0) returned 1 [0082.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.838] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20283951829) returned 1 [0082.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc030f0d0, dwHighDateTime=0x1d585b4)) [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3393d0 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3393d0 | out: hHeap=0x260000) returned 1 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0082.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.839] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.839] GetLastError () returned 0x0 [0082.839] GetLastError () returned 0x0 [0082.840] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.840] GetLastError () returned 0x0 [0082.840] GetLastError () returned 0x0 [0082.843] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffeca8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.843] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x13574, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x13574, lpOverlapped=0x0) returned 1 [0082.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.844] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.844] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.844] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.844] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.844] CloseHandle (hObject=0xe4) returned 1 [0082.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.[deadmin@cock.li].deadmin")) returned 1 [0082.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.846] GetLastError () returned 0x0 [0082.846] RtlWakeConditionVariable () returned 0x0 [0082.846] GetCurrentThreadId () returned 0x998 [0082.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".ldf") returned 0x0 [0082.846] lstrlenW (lpString=".vhd") returned 4 [0082.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".vhd") returned 0x0 [0082.846] lstrlenW (lpString=".vhdx") returned 5 [0082.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".vhdx") returned 0x0 [0082.846] lstrlenW (lpString=".pst") returned 4 [0082.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".pst") returned 0x0 [0082.846] lstrlenW (lpString=".ost") returned 4 [0082.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".ost") returned 0x0 [0082.846] lstrlenW (lpString=".bak") returned 4 [0082.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".bak") returned 0x0 [0082.847] lstrlenW (lpString=".bac") returned 4 [0082.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".bac") returned 0x0 [0082.847] lstrlenW (lpString=".sys") returned 4 [0082.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".sys") returned 0x0 [0082.847] lstrlenW (lpString=".v2i") returned 4 [0082.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".v2i") returned 0x0 [0082.847] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.848] lstrlenW (lpString=".sql") returned 4 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".sql") returned 0x0 [0082.848] lstrlenW (lpString=".mdf") returned 4 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".mdf") returned 0x0 [0082.848] lstrlenW (lpString=".txt") returned 4 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".txt") returned 0x0 [0082.848] lstrlenW (lpString=".dbf") returned 4 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".dbf") returned 0x0 [0082.848] lstrlenW (lpString=".ckp") returned 4 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".ckp") returned 0x0 [0082.848] lstrlenW (lpString=".dacpac") returned 7 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".dacpac") returned 0x0 [0082.848] lstrlenW (lpString=".db3") returned 4 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".db3") returned 0x0 [0082.848] lstrlenW (lpString=".dtxs") returned 5 [0082.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".dtxs") returned 0x0 [0082.849] lstrlenW (lpString=".mdt") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".mdt") returned 0x0 [0082.849] lstrlenW (lpString=".sdf") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".sdf") returned 0x0 [0082.849] lstrlenW (lpString=".MDF") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".MDF") returned 0x0 [0082.849] lstrlenW (lpString=".DBF") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".DBF") returned 0x0 [0082.849] lstrlenW (lpString=".DB") returned 3 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".DB") returned 0x0 [0082.849] lstrlenW (lpString=".db") returned 3 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".db") returned 0x0 [0082.849] lstrlenW (lpString=".ndf") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".ndf") returned 0x0 [0082.849] lstrlenW (lpString=".NDF") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".NDF") returned 0x0 [0082.849] lstrlenW (lpString=".Mdf") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".Mdf") returned 0x0 [0082.849] lstrlenW (lpString=".dat") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".dat") returned 0x0 [0082.849] lstrlenW (lpString=".DAT") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".DAT") returned 0x0 [0082.849] lstrlenW (lpString=".ldf") returned 4 [0082.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".ldf") returned 0x0 [0082.849] lstrlenW (lpString=".LDF") returned 4 [0082.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch=".LDF") returned 0x0 [0082.850] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.850] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3f00) returned 1 [0082.850] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.851] CryptReleaseContext (hProv=0x2d3f00, dwFlags=0x0) returned 1 [0082.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.851] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20285182975) returned 1 [0082.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc030f0d0, dwHighDateTime=0x1d585b4)) [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339408 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339408 | out: hHeap=0x260000) returned 1 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0082.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.942] GetLastError () returned 0x0 [0082.942] GetLastError () returned 0x0 [0082.942] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.942] GetLastError () returned 0x0 [0082.942] GetLastError () returned 0x0 [0082.946] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.946] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.946] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.946] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.948] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.948] CloseHandle (hObject=0xe4) returned 1 [0082.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.950] GetLastError () returned 0x0 [0082.950] RtlWakeConditionVariable () returned 0x0 [0082.950] GetCurrentThreadId () returned 0x998 [0082.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".ldf") returned 0x0 [0082.950] lstrlenW (lpString=".vhd") returned 4 [0082.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".vhd") returned 0x0 [0082.950] lstrlenW (lpString=".vhdx") returned 5 [0082.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".vhdx") returned 0x0 [0082.950] lstrlenW (lpString=".pst") returned 4 [0082.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".pst") returned 0x0 [0082.950] lstrlenW (lpString=".ost") returned 4 [0082.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".ost") returned 0x0 [0082.950] lstrlenW (lpString=".bak") returned 4 [0082.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".bak") returned 0x0 [0082.951] lstrlenW (lpString=".bac") returned 4 [0082.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".bac") returned 0x0 [0082.951] lstrlenW (lpString=".sys") returned 4 [0082.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".sys") returned 0x0 [0082.951] lstrlenW (lpString=".v2i") returned 4 [0082.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".v2i") returned 0x0 [0082.951] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0082.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.952] lstrlenW (lpString=".sql") returned 4 [0082.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".sql") returned 0x0 [0082.952] lstrlenW (lpString=".mdf") returned 4 [0082.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".mdf") returned 0x0 [0082.952] lstrlenW (lpString=".txt") returned 4 [0082.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".txt") returned 0x0 [0082.952] lstrlenW (lpString=".dbf") returned 4 [0082.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".dbf") returned 0x0 [0082.952] lstrlenW (lpString=".ckp") returned 4 [0082.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".ckp") returned 0x0 [0082.952] lstrlenW (lpString=".dacpac") returned 7 [0082.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".dacpac") returned 0x0 [0082.953] lstrlenW (lpString=".db3") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".db3") returned 0x0 [0082.953] lstrlenW (lpString=".dtxs") returned 5 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".dtxs") returned 0x0 [0082.953] lstrlenW (lpString=".mdt") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".mdt") returned 0x0 [0082.953] lstrlenW (lpString=".sdf") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".sdf") returned 0x0 [0082.953] lstrlenW (lpString=".MDF") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".MDF") returned 0x0 [0082.953] lstrlenW (lpString=".DBF") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".DBF") returned 0x0 [0082.953] lstrlenW (lpString=".DB") returned 3 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".DB") returned 0x0 [0082.953] lstrlenW (lpString=".db") returned 3 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".db") returned 0x0 [0082.953] lstrlenW (lpString=".ndf") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".ndf") returned 0x0 [0082.953] lstrlenW (lpString=".NDF") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".NDF") returned 0x0 [0082.953] lstrlenW (lpString=".Mdf") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".Mdf") returned 0x0 [0082.953] lstrlenW (lpString=".dat") returned 4 [0082.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".dat") returned 0x0 [0082.953] lstrlenW (lpString=".DAT") returned 4 [0082.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".DAT") returned 0x0 [0082.954] lstrlenW (lpString=".ldf") returned 4 [0082.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".ldf") returned 0x0 [0082.954] lstrlenW (lpString=".LDF") returned 4 [0082.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch=".LDF") returned 0x0 [0082.954] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.954] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2f98) returned 1 [0082.955] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.955] CryptReleaseContext (hProv=0x2d2f98, dwFlags=0x0) returned 1 [0082.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.955] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20295602548) returned 1 [0082.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0419a70, dwHighDateTime=0x1d585b4)) [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3394e8 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3394e8 | out: hHeap=0x260000) returned 1 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27655c0 [0082.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.956] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.956] GetLastError () returned 0x0 [0082.956] GetLastError () returned 0x0 [0082.956] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.956] GetLastError () returned 0x0 [0082.956] GetLastError () returned 0x0 [0082.958] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.958] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3c8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3c8, lpOverlapped=0x0) returned 1 [0082.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.958] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.958] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.958] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.958] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.959] CloseHandle (hObject=0xe4) returned 1 [0082.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.[deadmin@cock.li].deadmin")) returned 1 [0082.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.960] GetLastError () returned 0x0 [0082.960] RtlWakeConditionVariable () returned 0x0 [0082.960] GetCurrentThreadId () returned 0x998 [0082.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".ldf") returned 0x0 [0082.960] lstrlenW (lpString=".vhd") returned 4 [0082.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".vhd") returned 0x0 [0082.960] lstrlenW (lpString=".vhdx") returned 5 [0082.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".vhdx") returned 0x0 [0082.960] lstrlenW (lpString=".pst") returned 4 [0082.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".pst") returned 0x0 [0082.960] lstrlenW (lpString=".ost") returned 4 [0082.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".ost") returned 0x0 [0082.961] lstrlenW (lpString=".bak") returned 4 [0082.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".bak") returned 0x0 [0082.961] lstrlenW (lpString=".bac") returned 4 [0082.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".bac") returned 0x0 [0082.961] lstrlenW (lpString=".sys") returned 4 [0082.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".sys") returned 0x0 [0082.961] lstrlenW (lpString=".v2i") returned 4 [0082.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".v2i") returned 0x0 [0082.961] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0082.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.962] lstrlenW (lpString=".sql") returned 4 [0082.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".sql") returned 0x0 [0082.962] lstrlenW (lpString=".mdf") returned 4 [0082.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".mdf") returned 0x0 [0082.962] lstrlenW (lpString=".txt") returned 4 [0082.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".txt") returned 0x0 [0082.962] lstrlenW (lpString=".dbf") returned 4 [0082.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".dbf") returned 0x0 [0082.963] lstrlenW (lpString=".ckp") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".ckp") returned 0x0 [0082.963] lstrlenW (lpString=".dacpac") returned 7 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".dacpac") returned 0x0 [0082.963] lstrlenW (lpString=".db3") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".db3") returned 0x0 [0082.963] lstrlenW (lpString=".dtxs") returned 5 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".dtxs") returned 0x0 [0082.963] lstrlenW (lpString=".mdt") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".mdt") returned 0x0 [0082.963] lstrlenW (lpString=".sdf") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".sdf") returned 0x0 [0082.963] lstrlenW (lpString=".MDF") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".MDF") returned 0x0 [0082.963] lstrlenW (lpString=".DBF") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".DBF") returned 0x0 [0082.963] lstrlenW (lpString=".DB") returned 3 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".DB") returned 0x0 [0082.963] lstrlenW (lpString=".db") returned 3 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".db") returned 0x0 [0082.963] lstrlenW (lpString=".ndf") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".ndf") returned 0x0 [0082.963] lstrlenW (lpString=".NDF") returned 4 [0082.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".NDF") returned 0x0 [0082.963] lstrlenW (lpString=".Mdf") returned 4 [0082.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".Mdf") returned 0x0 [0082.964] lstrlenW (lpString=".dat") returned 4 [0082.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".dat") returned 0x0 [0082.964] lstrlenW (lpString=".DAT") returned 4 [0082.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".DAT") returned 0x0 [0082.964] lstrlenW (lpString=".ldf") returned 4 [0082.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".ldf") returned 0x0 [0082.964] lstrlenW (lpString=".LDF") returned 4 [0082.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch=".LDF") returned 0x0 [0082.964] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.964] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2f98) returned 1 [0082.965] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.965] CryptReleaseContext (hProv=0x2d2f98, dwFlags=0x0) returned 1 [0082.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.965] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20296616909) returned 1 [0082.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc043fbd0, dwHighDateTime=0x1d585b4)) [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339520 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339520 | out: hHeap=0x260000) returned 1 [0082.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764fd0 [0082.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.966] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.966] GetLastError () returned 0x0 [0082.966] GetLastError () returned 0x0 [0082.966] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.966] GetLastError () returned 0x0 [0082.966] GetLastError () returned 0x0 [0082.968] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffceb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.968] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x315, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x315, lpOverlapped=0x0) returned 1 [0082.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.968] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.968] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.968] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.969] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.969] CloseHandle (hObject=0xe4) returned 1 [0082.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.[deadmin@cock.li].deadmin")) returned 1 [0082.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.970] GetLastError () returned 0x0 [0082.970] RtlWakeConditionVariable () returned 0x0 [0082.970] GetCurrentThreadId () returned 0x998 [0082.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".ldf") returned 0x0 [0082.970] lstrlenW (lpString=".vhd") returned 4 [0082.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".vhd") returned 0x0 [0082.970] lstrlenW (lpString=".vhdx") returned 5 [0082.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".vhdx") returned 0x0 [0082.970] lstrlenW (lpString=".pst") returned 4 [0082.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".pst") returned 0x0 [0082.971] lstrlenW (lpString=".ost") returned 4 [0082.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".ost") returned 0x0 [0082.971] lstrlenW (lpString=".bak") returned 4 [0082.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".bak") returned 0x0 [0082.971] lstrlenW (lpString=".bac") returned 4 [0082.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".bac") returned 0x0 [0082.971] lstrlenW (lpString=".sys") returned 4 [0082.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".sys") returned 0x0 [0082.971] lstrlenW (lpString=".v2i") returned 4 [0082.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".v2i") returned 0x0 [0082.971] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0082.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.974] lstrlenW (lpString=".sql") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".sql") returned 0x0 [0082.974] lstrlenW (lpString=".mdf") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".mdf") returned 0x0 [0082.974] lstrlenW (lpString=".txt") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".txt") returned 0x0 [0082.974] lstrlenW (lpString=".dbf") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".dbf") returned 0x0 [0082.974] lstrlenW (lpString=".ckp") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".ckp") returned 0x0 [0082.974] lstrlenW (lpString=".dacpac") returned 7 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".dacpac") returned 0x0 [0082.974] lstrlenW (lpString=".db3") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".db3") returned 0x0 [0082.974] lstrlenW (lpString=".dtxs") returned 5 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".dtxs") returned 0x0 [0082.974] lstrlenW (lpString=".mdt") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".mdt") returned 0x0 [0082.974] lstrlenW (lpString=".sdf") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".sdf") returned 0x0 [0082.974] lstrlenW (lpString=".MDF") returned 4 [0082.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".MDF") returned 0x0 [0082.975] lstrlenW (lpString=".DBF") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".DBF") returned 0x0 [0082.975] lstrlenW (lpString=".DB") returned 3 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".DB") returned 0x0 [0082.975] lstrlenW (lpString=".db") returned 3 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".db") returned 0x0 [0082.975] lstrlenW (lpString=".ndf") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".ndf") returned 0x0 [0082.975] lstrlenW (lpString=".NDF") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".NDF") returned 0x0 [0082.975] lstrlenW (lpString=".Mdf") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".Mdf") returned 0x0 [0082.975] lstrlenW (lpString=".dat") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".dat") returned 0x0 [0082.975] lstrlenW (lpString=".DAT") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".DAT") returned 0x0 [0082.975] lstrlenW (lpString=".ldf") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".ldf") returned 0x0 [0082.975] lstrlenW (lpString=".LDF") returned 4 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch=".LDF") returned 0x0 [0082.975] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0082.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.975] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d2f98) returned 1 [0082.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.976] CryptReleaseContext (hProv=0x2d2f98, dwFlags=0x0) returned 1 [0082.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.977] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20297794079) returned 1 [0082.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0465d30, dwHighDateTime=0x1d585b4)) [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339558 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339558 | out: hHeap=0x260000) returned 1 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0082.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.978] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0082.978] GetLastError () returned 0x0 [0082.978] GetLastError () returned 0x0 [0082.978] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0082.978] GetLastError () returned 0x0 [0082.978] GetLastError () returned 0x0 [0083.082] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.083] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0083.083] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.083] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.083] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.083] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.083] CloseHandle (hObject=0xe4) returned 1 [0083.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.146] GetLastError () returned 0x0 [0083.146] RtlWakeConditionVariable () returned 0x0 [0083.147] GetCurrentThreadId () returned 0x998 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".ldf") returned 0x0 [0083.147] lstrlenW (lpString=".vhd") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".vhd") returned 0x0 [0083.147] lstrlenW (lpString=".vhdx") returned 5 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".vhdx") returned 0x0 [0083.147] lstrlenW (lpString=".pst") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".pst") returned 0x0 [0083.147] lstrlenW (lpString=".ost") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".ost") returned 0x0 [0083.147] lstrlenW (lpString=".bak") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".bak") returned 0x0 [0083.147] lstrlenW (lpString=".bac") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".bac") returned 0x0 [0083.147] lstrlenW (lpString=".sys") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".sys") returned 0x0 [0083.147] lstrlenW (lpString=".v2i") returned 4 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".v2i") returned 0x0 [0083.147] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.148] lstrlenW (lpString=".sql") returned 4 [0083.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".sql") returned 0x0 [0083.148] lstrlenW (lpString=".mdf") returned 4 [0083.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".mdf") returned 0x0 [0083.148] lstrlenW (lpString=".txt") returned 4 [0083.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".txt") returned 0x0 [0083.149] lstrlenW (lpString=".dbf") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".dbf") returned 0x0 [0083.149] lstrlenW (lpString=".ckp") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".ckp") returned 0x0 [0083.149] lstrlenW (lpString=".dacpac") returned 7 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".dacpac") returned 0x0 [0083.149] lstrlenW (lpString=".db3") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".db3") returned 0x0 [0083.149] lstrlenW (lpString=".dtxs") returned 5 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".dtxs") returned 0x0 [0083.149] lstrlenW (lpString=".mdt") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".mdt") returned 0x0 [0083.149] lstrlenW (lpString=".sdf") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".sdf") returned 0x0 [0083.149] lstrlenW (lpString=".MDF") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".MDF") returned 0x0 [0083.149] lstrlenW (lpString=".DBF") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".DBF") returned 0x0 [0083.149] lstrlenW (lpString=".DB") returned 3 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".DB") returned 0x0 [0083.149] lstrlenW (lpString=".db") returned 3 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".db") returned 0x0 [0083.149] lstrlenW (lpString=".ndf") returned 4 [0083.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".ndf") returned 0x0 [0083.149] lstrlenW (lpString=".NDF") returned 4 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".NDF") returned 0x0 [0083.150] lstrlenW (lpString=".Mdf") returned 4 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".Mdf") returned 0x0 [0083.150] lstrlenW (lpString=".dat") returned 4 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".dat") returned 0x0 [0083.150] lstrlenW (lpString=".DAT") returned 4 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".DAT") returned 0x0 [0083.150] lstrlenW (lpString=".ldf") returned 4 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".ldf") returned 0x0 [0083.150] lstrlenW (lpString=".LDF") returned 4 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch=".LDF") returned 0x0 [0083.150] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.150] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.151] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.151] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.151] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20315220323) returned 1 [0083.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0608c50, dwHighDateTime=0x1d585b4)) [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339718 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339718 | out: hHeap=0x260000) returned 1 [0083.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764b10 [0083.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.152] GetLastError () returned 0x0 [0083.152] GetLastError () returned 0x0 [0083.152] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.152] GetLastError () returned 0x0 [0083.152] GetLastError () returned 0x0 [0083.155] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.155] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0083.155] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.155] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.155] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.155] CloseHandle (hObject=0xe4) returned 1 [0083.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0083.156] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0083.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.157] GetLastError () returned 0x0 [0083.157] RtlWakeConditionVariable () returned 0x0 [0083.157] GetCurrentThreadId () returned 0x998 [0083.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".ldf") returned 0x0 [0083.157] lstrlenW (lpString=".vhd") returned 4 [0083.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".vhd") returned 0x0 [0083.157] lstrlenW (lpString=".vhdx") returned 5 [0083.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".vhdx") returned 0x0 [0083.157] lstrlenW (lpString=".pst") returned 4 [0083.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".pst") returned 0x0 [0083.157] lstrlenW (lpString=".ost") returned 4 [0083.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".ost") returned 0x0 [0083.158] lstrlenW (lpString=".bak") returned 4 [0083.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".bak") returned 0x0 [0083.158] lstrlenW (lpString=".bac") returned 4 [0083.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".bac") returned 0x0 [0083.158] lstrlenW (lpString=".sys") returned 4 [0083.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".sys") returned 0x0 [0083.158] lstrlenW (lpString=".v2i") returned 4 [0083.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".v2i") returned 0x0 [0083.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.159] lstrlenW (lpString=".sql") returned 4 [0083.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".sql") returned 0x0 [0083.159] lstrlenW (lpString=".mdf") returned 4 [0083.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".mdf") returned 0x0 [0083.159] lstrlenW (lpString=".txt") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".txt") returned 0x0 [0083.160] lstrlenW (lpString=".dbf") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".dbf") returned 0x0 [0083.160] lstrlenW (lpString=".ckp") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".ckp") returned 0x0 [0083.160] lstrlenW (lpString=".dacpac") returned 7 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".dacpac") returned 0x0 [0083.160] lstrlenW (lpString=".db3") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".db3") returned 0x0 [0083.160] lstrlenW (lpString=".dtxs") returned 5 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".dtxs") returned 0x0 [0083.160] lstrlenW (lpString=".mdt") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".mdt") returned 0x0 [0083.160] lstrlenW (lpString=".sdf") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".sdf") returned 0x0 [0083.160] lstrlenW (lpString=".MDF") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".MDF") returned 0x0 [0083.160] lstrlenW (lpString=".DBF") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".DBF") returned 0x0 [0083.160] lstrlenW (lpString=".DB") returned 3 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".DB") returned 0x0 [0083.160] lstrlenW (lpString=".db") returned 3 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".db") returned 0x0 [0083.160] lstrlenW (lpString=".ndf") returned 4 [0083.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".ndf") returned 0x0 [0083.160] lstrlenW (lpString=".NDF") returned 4 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".NDF") returned 0x0 [0083.161] lstrlenW (lpString=".Mdf") returned 4 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".Mdf") returned 0x0 [0083.161] lstrlenW (lpString=".dat") returned 4 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".dat") returned 0x0 [0083.161] lstrlenW (lpString=".DAT") returned 4 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".DAT") returned 0x0 [0083.161] lstrlenW (lpString=".ldf") returned 4 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".ldf") returned 0x0 [0083.161] lstrlenW (lpString=".LDF") returned 4 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch=".LDF") returned 0x0 [0083.161] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.161] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.162] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.162] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20316323424) returned 1 [0083.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0608c50, dwHighDateTime=0x1d585b4)) [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339750 [0083.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339750 | out: hHeap=0x260000) returned 1 [0083.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764d70 [0083.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.163] GetLastError () returned 0x0 [0083.163] GetLastError () returned 0x0 [0083.163] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.163] GetLastError () returned 0x0 [0083.164] GetLastError () returned 0x0 [0083.168] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcdb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.168] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x325, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x325, lpOverlapped=0x0) returned 1 [0083.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0083.168] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.168] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.168] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.168] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.168] CloseHandle (hObject=0xe4) returned 1 [0083.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0083.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0083.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.170] GetLastError () returned 0x0 [0083.170] RtlWakeConditionVariable () returned 0x0 [0083.170] GetCurrentThreadId () returned 0x998 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".ldf") returned 0x0 [0083.170] lstrlenW (lpString=".vhd") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".vhd") returned 0x0 [0083.170] lstrlenW (lpString=".vhdx") returned 5 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".vhdx") returned 0x0 [0083.170] lstrlenW (lpString=".pst") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".pst") returned 0x0 [0083.170] lstrlenW (lpString=".ost") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".ost") returned 0x0 [0083.170] lstrlenW (lpString=".bak") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".bak") returned 0x0 [0083.170] lstrlenW (lpString=".bac") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".bac") returned 0x0 [0083.170] lstrlenW (lpString=".sys") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".sys") returned 0x0 [0083.170] lstrlenW (lpString=".v2i") returned 4 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".v2i") returned 0x0 [0083.170] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.171] lstrlenW (lpString=".sql") returned 4 [0083.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".sql") returned 0x0 [0083.171] lstrlenW (lpString=".mdf") returned 4 [0083.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".mdf") returned 0x0 [0083.171] lstrlenW (lpString=".txt") returned 4 [0083.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".txt") returned 0x0 [0083.172] lstrlenW (lpString=".dbf") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".dbf") returned 0x0 [0083.172] lstrlenW (lpString=".ckp") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".ckp") returned 0x0 [0083.172] lstrlenW (lpString=".dacpac") returned 7 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".dacpac") returned 0x0 [0083.172] lstrlenW (lpString=".db3") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".db3") returned 0x0 [0083.172] lstrlenW (lpString=".dtxs") returned 5 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".dtxs") returned 0x0 [0083.172] lstrlenW (lpString=".mdt") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".mdt") returned 0x0 [0083.172] lstrlenW (lpString=".sdf") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".sdf") returned 0x0 [0083.172] lstrlenW (lpString=".MDF") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".MDF") returned 0x0 [0083.172] lstrlenW (lpString=".DBF") returned 4 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".DBF") returned 0x0 [0083.172] lstrlenW (lpString=".DB") returned 3 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".DB") returned 0x0 [0083.172] lstrlenW (lpString=".db") returned 3 [0083.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".db") returned 0x0 [0083.173] lstrlenW (lpString=".ndf") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".ndf") returned 0x0 [0083.173] lstrlenW (lpString=".NDF") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".NDF") returned 0x0 [0083.173] lstrlenW (lpString=".Mdf") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".Mdf") returned 0x0 [0083.173] lstrlenW (lpString=".dat") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".dat") returned 0x0 [0083.173] lstrlenW (lpString=".DAT") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".DAT") returned 0x0 [0083.173] lstrlenW (lpString=".ldf") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".ldf") returned 0x0 [0083.173] lstrlenW (lpString=".LDF") returned 4 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch=".LDF") returned 0x0 [0083.173] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.173] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.174] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.174] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.175] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20317567915) returned 1 [0083.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc062edb0, dwHighDateTime=0x1d585b4)) [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339788 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339788 | out: hHeap=0x260000) returned 1 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764cd8 [0083.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.175] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.175] GetLastError () returned 0x0 [0083.176] GetLastError () returned 0x0 [0083.176] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.176] GetLastError () returned 0x0 [0083.176] GetLastError () returned 0x0 [0083.184] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.184] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0083.184] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.184] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.185] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.185] CloseHandle (hObject=0xe4) returned 1 [0083.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0083.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0083.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.187] GetLastError () returned 0x0 [0083.187] RtlWakeConditionVariable () returned 0x0 [0083.187] GetCurrentThreadId () returned 0x998 [0083.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".ldf") returned 0x0 [0083.187] lstrlenW (lpString=".vhd") returned 4 [0083.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".vhd") returned 0x0 [0083.188] lstrlenW (lpString=".vhdx") returned 5 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".vhdx") returned 0x0 [0083.188] lstrlenW (lpString=".pst") returned 4 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".pst") returned 0x0 [0083.188] lstrlenW (lpString=".ost") returned 4 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".ost") returned 0x0 [0083.188] lstrlenW (lpString=".bak") returned 4 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".bak") returned 0x0 [0083.188] lstrlenW (lpString=".bac") returned 4 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".bac") returned 0x0 [0083.188] lstrlenW (lpString=".sys") returned 4 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".sys") returned 0x0 [0083.188] lstrlenW (lpString=".v2i") returned 4 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".v2i") returned 0x0 [0083.188] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.189] lstrlenW (lpString=".sql") returned 4 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".sql") returned 0x0 [0083.189] lstrlenW (lpString=".mdf") returned 4 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".mdf") returned 0x0 [0083.189] lstrlenW (lpString=".txt") returned 4 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".txt") returned 0x0 [0083.189] lstrlenW (lpString=".dbf") returned 4 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".dbf") returned 0x0 [0083.189] lstrlenW (lpString=".ckp") returned 4 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".ckp") returned 0x0 [0083.189] lstrlenW (lpString=".dacpac") returned 7 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".dacpac") returned 0x0 [0083.189] lstrlenW (lpString=".db3") returned 4 [0083.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".db3") returned 0x0 [0083.190] lstrlenW (lpString=".dtxs") returned 5 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".dtxs") returned 0x0 [0083.190] lstrlenW (lpString=".mdt") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".mdt") returned 0x0 [0083.190] lstrlenW (lpString=".sdf") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".sdf") returned 0x0 [0083.190] lstrlenW (lpString=".MDF") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".MDF") returned 0x0 [0083.190] lstrlenW (lpString=".DBF") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".DBF") returned 0x0 [0083.190] lstrlenW (lpString=".DB") returned 3 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".DB") returned 0x0 [0083.190] lstrlenW (lpString=".db") returned 3 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".db") returned 0x0 [0083.190] lstrlenW (lpString=".ndf") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".ndf") returned 0x0 [0083.190] lstrlenW (lpString=".NDF") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".NDF") returned 0x0 [0083.190] lstrlenW (lpString=".Mdf") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".Mdf") returned 0x0 [0083.190] lstrlenW (lpString=".dat") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".dat") returned 0x0 [0083.190] lstrlenW (lpString=".DAT") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".DAT") returned 0x0 [0083.190] lstrlenW (lpString=".ldf") returned 4 [0083.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".ldf") returned 0x0 [0083.191] lstrlenW (lpString=".LDF") returned 4 [0083.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch=".LDF") returned 0x0 [0083.191] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.191] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.192] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.192] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.192] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20319297649) returned 1 [0083.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0654f10, dwHighDateTime=0x1d585b4)) [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3397f8 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3397f8 | out: hHeap=0x260000) returned 1 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764c40 [0083.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.193] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.193] GetLastError () returned 0x0 [0083.193] GetLastError () returned 0x0 [0083.193] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.193] GetLastError () returned 0x0 [0083.193] GetLastError () returned 0x0 [0083.354] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.374] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2fd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2fd, lpOverlapped=0x0) returned 1 [0083.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0083.382] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.383] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.383] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.383] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.383] CloseHandle (hObject=0xe4) returned 1 [0083.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.384] GetLastError () returned 0x0 [0083.385] RtlWakeConditionVariable () returned 0x0 [0083.385] GetCurrentThreadId () returned 0x998 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".ldf") returned 0x0 [0083.385] lstrlenW (lpString=".vhd") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".vhd") returned 0x0 [0083.385] lstrlenW (lpString=".vhdx") returned 5 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".vhdx") returned 0x0 [0083.385] lstrlenW (lpString=".pst") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".pst") returned 0x0 [0083.385] lstrlenW (lpString=".ost") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".ost") returned 0x0 [0083.385] lstrlenW (lpString=".bak") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".bak") returned 0x0 [0083.385] lstrlenW (lpString=".bac") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".bac") returned 0x0 [0083.385] lstrlenW (lpString=".sys") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".sys") returned 0x0 [0083.385] lstrlenW (lpString=".v2i") returned 4 [0083.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".v2i") returned 0x0 [0083.386] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.387] lstrlenW (lpString=".sql") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".sql") returned 0x0 [0083.387] lstrlenW (lpString=".mdf") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".mdf") returned 0x0 [0083.387] lstrlenW (lpString=".txt") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".txt") returned 0x0 [0083.387] lstrlenW (lpString=".dbf") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".dbf") returned 0x0 [0083.387] lstrlenW (lpString=".ckp") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".ckp") returned 0x0 [0083.387] lstrlenW (lpString=".dacpac") returned 7 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".dacpac") returned 0x0 [0083.387] lstrlenW (lpString=".db3") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".db3") returned 0x0 [0083.387] lstrlenW (lpString=".dtxs") returned 5 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".dtxs") returned 0x0 [0083.387] lstrlenW (lpString=".mdt") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".mdt") returned 0x0 [0083.387] lstrlenW (lpString=".sdf") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".sdf") returned 0x0 [0083.387] lstrlenW (lpString=".MDF") returned 4 [0083.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".MDF") returned 0x0 [0083.387] lstrlenW (lpString=".DBF") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".DBF") returned 0x0 [0083.388] lstrlenW (lpString=".DB") returned 3 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".DB") returned 0x0 [0083.388] lstrlenW (lpString=".db") returned 3 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".db") returned 0x0 [0083.388] lstrlenW (lpString=".ndf") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".ndf") returned 0x0 [0083.388] lstrlenW (lpString=".NDF") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".NDF") returned 0x0 [0083.388] lstrlenW (lpString=".Mdf") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".Mdf") returned 0x0 [0083.388] lstrlenW (lpString=".dat") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".dat") returned 0x0 [0083.388] lstrlenW (lpString=".DAT") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".DAT") returned 0x0 [0083.388] lstrlenW (lpString=".ldf") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".ldf") returned 0x0 [0083.388] lstrlenW (lpString=".LDF") returned 4 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch=".LDF") returned 0x0 [0083.388] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.388] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.389] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.389] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.389] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20339051866) returned 1 [0083.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc08440f0, dwHighDateTime=0x1d585b4)) [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3399f0 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3399f0 | out: hHeap=0x260000) returned 1 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325210 [0083.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.390] GetLastError () returned 0x0 [0083.390] GetLastError () returned 0x0 [0083.391] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.391] GetLastError () returned 0x0 [0083.391] GetLastError () returned 0x0 [0083.392] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffce5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.392] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x31b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x31b, lpOverlapped=0x0) returned 1 [0083.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.392] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.393] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.393] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.393] CloseHandle (hObject=0xe4) returned 1 [0083.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.394] GetLastError () returned 0x0 [0083.394] RtlWakeConditionVariable () returned 0x0 [0083.394] GetCurrentThreadId () returned 0x998 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".ldf") returned 0x0 [0083.395] lstrlenW (lpString=".vhd") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".vhd") returned 0x0 [0083.395] lstrlenW (lpString=".vhdx") returned 5 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".vhdx") returned 0x0 [0083.395] lstrlenW (lpString=".pst") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".pst") returned 0x0 [0083.395] lstrlenW (lpString=".ost") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".ost") returned 0x0 [0083.395] lstrlenW (lpString=".bak") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".bak") returned 0x0 [0083.395] lstrlenW (lpString=".bac") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".bac") returned 0x0 [0083.395] lstrlenW (lpString=".sys") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".sys") returned 0x0 [0083.395] lstrlenW (lpString=".v2i") returned 4 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".v2i") returned 0x0 [0083.395] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.397] lstrlenW (lpString=".sql") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".sql") returned 0x0 [0083.397] lstrlenW (lpString=".mdf") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".mdf") returned 0x0 [0083.397] lstrlenW (lpString=".txt") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".txt") returned 0x0 [0083.397] lstrlenW (lpString=".dbf") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".dbf") returned 0x0 [0083.397] lstrlenW (lpString=".ckp") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".ckp") returned 0x0 [0083.397] lstrlenW (lpString=".dacpac") returned 7 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".dacpac") returned 0x0 [0083.397] lstrlenW (lpString=".db3") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".db3") returned 0x0 [0083.397] lstrlenW (lpString=".dtxs") returned 5 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".dtxs") returned 0x0 [0083.397] lstrlenW (lpString=".mdt") returned 4 [0083.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".mdt") returned 0x0 [0083.398] lstrlenW (lpString=".sdf") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".sdf") returned 0x0 [0083.398] lstrlenW (lpString=".MDF") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".MDF") returned 0x0 [0083.398] lstrlenW (lpString=".DBF") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".DBF") returned 0x0 [0083.398] lstrlenW (lpString=".DB") returned 3 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".DB") returned 0x0 [0083.398] lstrlenW (lpString=".db") returned 3 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".db") returned 0x0 [0083.398] lstrlenW (lpString=".ndf") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".ndf") returned 0x0 [0083.398] lstrlenW (lpString=".NDF") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".NDF") returned 0x0 [0083.398] lstrlenW (lpString=".Mdf") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".Mdf") returned 0x0 [0083.398] lstrlenW (lpString=".dat") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".dat") returned 0x0 [0083.398] lstrlenW (lpString=".DAT") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".DAT") returned 0x0 [0083.398] lstrlenW (lpString=".ldf") returned 4 [0083.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".ldf") returned 0x0 [0083.399] lstrlenW (lpString=".LDF") returned 4 [0083.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch=".LDF") returned 0x0 [0083.399] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.399] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.400] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.400] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.400] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20340085668) returned 1 [0083.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc086a250, dwHighDateTime=0x1d585b4)) [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339a28 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339a28 | out: hHeap=0x260000) returned 1 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3250e0 [0083.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.400] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.401] GetLastError () returned 0x0 [0083.401] GetLastError () returned 0x0 [0083.401] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.401] GetLastError () returned 0x0 [0083.401] GetLastError () returned 0x0 [0083.402] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.403] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.403] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.403] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.403] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.403] CloseHandle (hObject=0xe4) returned 1 [0083.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.404] GetLastError () returned 0x0 [0083.404] RtlWakeConditionVariable () returned 0x0 [0083.404] GetCurrentThreadId () returned 0x998 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".ldf") returned 0x0 [0083.405] lstrlenW (lpString=".vhd") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".vhd") returned 0x0 [0083.405] lstrlenW (lpString=".vhdx") returned 5 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".vhdx") returned 0x0 [0083.405] lstrlenW (lpString=".pst") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".pst") returned 0x0 [0083.405] lstrlenW (lpString=".ost") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".ost") returned 0x0 [0083.405] lstrlenW (lpString=".bak") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".bak") returned 0x0 [0083.405] lstrlenW (lpString=".bac") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".bac") returned 0x0 [0083.405] lstrlenW (lpString=".sys") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".sys") returned 0x0 [0083.405] lstrlenW (lpString=".v2i") returned 4 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".v2i") returned 0x0 [0083.405] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.406] lstrlenW (lpString=".sql") returned 4 [0083.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".sql") returned 0x0 [0083.407] lstrlenW (lpString=".mdf") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".mdf") returned 0x0 [0083.407] lstrlenW (lpString=".txt") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".txt") returned 0x0 [0083.407] lstrlenW (lpString=".dbf") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".dbf") returned 0x0 [0083.407] lstrlenW (lpString=".ckp") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".ckp") returned 0x0 [0083.407] lstrlenW (lpString=".dacpac") returned 7 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".dacpac") returned 0x0 [0083.407] lstrlenW (lpString=".db3") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".db3") returned 0x0 [0083.407] lstrlenW (lpString=".dtxs") returned 5 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".dtxs") returned 0x0 [0083.407] lstrlenW (lpString=".mdt") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".mdt") returned 0x0 [0083.407] lstrlenW (lpString=".sdf") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".sdf") returned 0x0 [0083.407] lstrlenW (lpString=".MDF") returned 4 [0083.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".MDF") returned 0x0 [0083.407] lstrlenW (lpString=".DBF") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".DBF") returned 0x0 [0083.408] lstrlenW (lpString=".DB") returned 3 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".DB") returned 0x0 [0083.408] lstrlenW (lpString=".db") returned 3 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".db") returned 0x0 [0083.408] lstrlenW (lpString=".ndf") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".ndf") returned 0x0 [0083.408] lstrlenW (lpString=".NDF") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".NDF") returned 0x0 [0083.408] lstrlenW (lpString=".Mdf") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".Mdf") returned 0x0 [0083.408] lstrlenW (lpString=".dat") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".dat") returned 0x0 [0083.408] lstrlenW (lpString=".DAT") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".DAT") returned 0x0 [0083.408] lstrlenW (lpString=".ldf") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".ldf") returned 0x0 [0083.408] lstrlenW (lpString=".LDF") returned 4 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch=".LDF") returned 0x0 [0083.408] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.408] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.409] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.409] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20341055623) returned 1 [0083.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc086a250, dwHighDateTime=0x1d585b4)) [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339a60 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339a60 | out: hHeap=0x260000) returned 1 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325048 [0083.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.410] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.410] GetLastError () returned 0x0 [0083.410] GetLastError () returned 0x0 [0083.411] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.411] GetLastError () returned 0x0 [0083.411] GetLastError () returned 0x0 [0083.412] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.413] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.413] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.413] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.413] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.413] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.413] CloseHandle (hObject=0xe4) returned 1 [0083.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.415] GetLastError () returned 0x0 [0083.415] RtlWakeConditionVariable () returned 0x0 [0083.415] GetCurrentThreadId () returned 0x998 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".ldf") returned 0x0 [0083.415] lstrlenW (lpString=".vhd") returned 4 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".vhd") returned 0x0 [0083.415] lstrlenW (lpString=".vhdx") returned 5 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".vhdx") returned 0x0 [0083.415] lstrlenW (lpString=".pst") returned 4 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".pst") returned 0x0 [0083.415] lstrlenW (lpString=".ost") returned 4 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".ost") returned 0x0 [0083.415] lstrlenW (lpString=".bak") returned 4 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".bak") returned 0x0 [0083.415] lstrlenW (lpString=".bac") returned 4 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".bac") returned 0x0 [0083.415] lstrlenW (lpString=".sys") returned 4 [0083.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".sys") returned 0x0 [0083.415] lstrlenW (lpString=".v2i") returned 4 [0083.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".v2i") returned 0x0 [0083.416] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.416] lstrlenW (lpString=".sql") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".sql") returned 0x0 [0083.417] lstrlenW (lpString=".mdf") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".mdf") returned 0x0 [0083.417] lstrlenW (lpString=".txt") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".txt") returned 0x0 [0083.417] lstrlenW (lpString=".dbf") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".dbf") returned 0x0 [0083.417] lstrlenW (lpString=".ckp") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".ckp") returned 0x0 [0083.417] lstrlenW (lpString=".dacpac") returned 7 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".dacpac") returned 0x0 [0083.417] lstrlenW (lpString=".db3") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".db3") returned 0x0 [0083.417] lstrlenW (lpString=".dtxs") returned 5 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".dtxs") returned 0x0 [0083.417] lstrlenW (lpString=".mdt") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".mdt") returned 0x0 [0083.417] lstrlenW (lpString=".sdf") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".sdf") returned 0x0 [0083.417] lstrlenW (lpString=".MDF") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".MDF") returned 0x0 [0083.417] lstrlenW (lpString=".DBF") returned 4 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".DBF") returned 0x0 [0083.417] lstrlenW (lpString=".DB") returned 3 [0083.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".DB") returned 0x0 [0083.418] lstrlenW (lpString=".db") returned 3 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".db") returned 0x0 [0083.418] lstrlenW (lpString=".ndf") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".ndf") returned 0x0 [0083.418] lstrlenW (lpString=".NDF") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".NDF") returned 0x0 [0083.418] lstrlenW (lpString=".Mdf") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".Mdf") returned 0x0 [0083.418] lstrlenW (lpString=".dat") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".dat") returned 0x0 [0083.418] lstrlenW (lpString=".DAT") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".DAT") returned 0x0 [0083.418] lstrlenW (lpString=".ldf") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".ldf") returned 0x0 [0083.418] lstrlenW (lpString=".LDF") returned 4 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch=".LDF") returned 0x0 [0083.418] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.418] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.419] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.419] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.419] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20342040558) returned 1 [0083.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc08903b0, dwHighDateTime=0x1d585b4)) [0083.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339a98 [0083.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339a98 | out: hHeap=0x260000) returned 1 [0083.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751820 [0083.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.420] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.420] GetLastError () returned 0x0 [0083.421] GetLastError () returned 0x0 [0083.421] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.422] GetLastError () returned 0x0 [0083.422] GetLastError () returned 0x0 [0083.575] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd86a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.575] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x2796, lpOverlapped=0x0) returned 1 [0083.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.578] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.578] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.579] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.579] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.579] CloseHandle (hObject=0xe4) returned 1 [0083.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0083.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0083.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0083.657] GetLastError () returned 0x0 [0083.657] RtlWakeConditionVariable () returned 0x0 [0083.657] GetCurrentThreadId () returned 0x998 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".ldf") returned 0x0 [0083.658] lstrlenW (lpString=".vhd") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".vhd") returned 0x0 [0083.658] lstrlenW (lpString=".vhdx") returned 5 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".vhdx") returned 0x0 [0083.658] lstrlenW (lpString=".pst") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".pst") returned 0x0 [0083.658] lstrlenW (lpString=".ost") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".ost") returned 0x0 [0083.658] lstrlenW (lpString=".bak") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".bak") returned 0x0 [0083.658] lstrlenW (lpString=".bac") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".bac") returned 0x0 [0083.658] lstrlenW (lpString=".sys") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".sys") returned 0x0 [0083.658] lstrlenW (lpString=".v2i") returned 4 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".v2i") returned 0x0 [0083.658] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.683] lstrlenW (lpString=".sql") returned 4 [0083.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".sql") returned 0x0 [0083.684] lstrlenW (lpString=".mdf") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".mdf") returned 0x0 [0083.684] lstrlenW (lpString=".txt") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".txt") returned 0x0 [0083.684] lstrlenW (lpString=".dbf") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".dbf") returned 0x0 [0083.684] lstrlenW (lpString=".ckp") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".ckp") returned 0x0 [0083.684] lstrlenW (lpString=".dacpac") returned 7 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".dacpac") returned 0x0 [0083.684] lstrlenW (lpString=".db3") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".db3") returned 0x0 [0083.684] lstrlenW (lpString=".dtxs") returned 5 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".dtxs") returned 0x0 [0083.684] lstrlenW (lpString=".mdt") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".mdt") returned 0x0 [0083.684] lstrlenW (lpString=".sdf") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".sdf") returned 0x0 [0083.684] lstrlenW (lpString=".MDF") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".MDF") returned 0x0 [0083.684] lstrlenW (lpString=".DBF") returned 4 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".DBF") returned 0x0 [0083.684] lstrlenW (lpString=".DB") returned 3 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".DB") returned 0x0 [0083.684] lstrlenW (lpString=".db") returned 3 [0083.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".db") returned 0x0 [0083.685] lstrlenW (lpString=".ndf") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".ndf") returned 0x0 [0083.685] lstrlenW (lpString=".NDF") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".NDF") returned 0x0 [0083.685] lstrlenW (lpString=".Mdf") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".Mdf") returned 0x0 [0083.685] lstrlenW (lpString=".dat") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".dat") returned 0x0 [0083.685] lstrlenW (lpString=".DAT") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".DAT") returned 0x0 [0083.685] lstrlenW (lpString=".ldf") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".ldf") returned 0x0 [0083.685] lstrlenW (lpString=".LDF") returned 4 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch=".LDF") returned 0x0 [0083.685] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0083.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.685] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0083.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.686] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0083.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0083.686] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20368963673) returned 1 [0083.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0b17b10, dwHighDateTime=0x1d585b4)) [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762680 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762680 | out: hHeap=0x260000) returned 1 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765068 [0083.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0083.689] GetLastError () returned 0x0 [0083.690] GetLastError () returned 0x0 [0083.690] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0083.690] GetLastError () returned 0x0 [0083.690] GetLastError () returned 0x0 [0083.999] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcf7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.000] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x309, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x309, lpOverlapped=0x0) returned 1 [0084.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.000] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.000] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.000] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.000] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.000] CloseHandle (hObject=0xd8) returned 1 [0084.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.003] GetLastError () returned 0x0 [0084.003] RtlWakeConditionVariable () returned 0x0 [0084.003] GetCurrentThreadId () returned 0x998 [0084.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".ldf") returned 0x0 [0084.004] lstrlenW (lpString=".vhd") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".vhd") returned 0x0 [0084.004] lstrlenW (lpString=".vhdx") returned 5 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".vhdx") returned 0x0 [0084.004] lstrlenW (lpString=".pst") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".pst") returned 0x0 [0084.004] lstrlenW (lpString=".ost") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".ost") returned 0x0 [0084.004] lstrlenW (lpString=".bak") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".bak") returned 0x0 [0084.004] lstrlenW (lpString=".bac") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".bac") returned 0x0 [0084.004] lstrlenW (lpString=".sys") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".sys") returned 0x0 [0084.004] lstrlenW (lpString=".v2i") returned 4 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".v2i") returned 0x0 [0084.004] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.006] lstrlenW (lpString=".sql") returned 4 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".sql") returned 0x0 [0084.006] lstrlenW (lpString=".mdf") returned 4 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".mdf") returned 0x0 [0084.006] lstrlenW (lpString=".txt") returned 4 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".txt") returned 0x0 [0084.006] lstrlenW (lpString=".dbf") returned 4 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".dbf") returned 0x0 [0084.006] lstrlenW (lpString=".ckp") returned 4 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".ckp") returned 0x0 [0084.006] lstrlenW (lpString=".dacpac") returned 7 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".dacpac") returned 0x0 [0084.006] lstrlenW (lpString=".db3") returned 4 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".db3") returned 0x0 [0084.006] lstrlenW (lpString=".dtxs") returned 5 [0084.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".dtxs") returned 0x0 [0084.007] lstrlenW (lpString=".mdt") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".mdt") returned 0x0 [0084.007] lstrlenW (lpString=".sdf") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".sdf") returned 0x0 [0084.007] lstrlenW (lpString=".MDF") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".MDF") returned 0x0 [0084.007] lstrlenW (lpString=".DBF") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".DBF") returned 0x0 [0084.007] lstrlenW (lpString=".DB") returned 3 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".DB") returned 0x0 [0084.007] lstrlenW (lpString=".db") returned 3 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".db") returned 0x0 [0084.007] lstrlenW (lpString=".ndf") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".ndf") returned 0x0 [0084.007] lstrlenW (lpString=".NDF") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".NDF") returned 0x0 [0084.007] lstrlenW (lpString=".Mdf") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".Mdf") returned 0x0 [0084.007] lstrlenW (lpString=".dat") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".dat") returned 0x0 [0084.007] lstrlenW (lpString=".DAT") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".DAT") returned 0x0 [0084.007] lstrlenW (lpString=".ldf") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".ldf") returned 0x0 [0084.007] lstrlenW (lpString=".LDF") returned 4 [0084.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch=".LDF") returned 0x0 [0084.008] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.008] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.009] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.009] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20400983502) returned 1 [0084.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0e377f0, dwHighDateTime=0x1d585b4)) [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762648 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762648 | out: hHeap=0x260000) returned 1 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765788 [0084.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.010] GetLastError () returned 0x0 [0084.010] GetLastError () returned 0x0 [0084.010] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.010] GetLastError () returned 0x0 [0084.010] GetLastError () returned 0x0 [0084.141] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.141] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.141] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.141] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.141] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.142] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.142] CloseHandle (hObject=0xd8) returned 1 [0084.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.144] GetLastError () returned 0x0 [0084.144] RtlWakeConditionVariable () returned 0x0 [0084.145] GetCurrentThreadId () returned 0x998 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".ldf") returned 0x0 [0084.145] lstrlenW (lpString=".vhd") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".vhd") returned 0x0 [0084.145] lstrlenW (lpString=".vhdx") returned 5 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".vhdx") returned 0x0 [0084.145] lstrlenW (lpString=".pst") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".pst") returned 0x0 [0084.145] lstrlenW (lpString=".ost") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".ost") returned 0x0 [0084.145] lstrlenW (lpString=".bak") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".bak") returned 0x0 [0084.145] lstrlenW (lpString=".bac") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".bac") returned 0x0 [0084.145] lstrlenW (lpString=".sys") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".sys") returned 0x0 [0084.145] lstrlenW (lpString=".v2i") returned 4 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".v2i") returned 0x0 [0084.145] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.148] lstrlenW (lpString=".sql") returned 4 [0084.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".sql") returned 0x0 [0084.150] lstrlenW (lpString=".mdf") returned 4 [0084.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".mdf") returned 0x0 [0084.150] lstrlenW (lpString=".txt") returned 4 [0084.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".txt") returned 0x0 [0084.153] lstrlenW (lpString=".dbf") returned 4 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".dbf") returned 0x0 [0084.153] lstrlenW (lpString=".ckp") returned 4 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".ckp") returned 0x0 [0084.153] lstrlenW (lpString=".dacpac") returned 7 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".dacpac") returned 0x0 [0084.153] lstrlenW (lpString=".db3") returned 4 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".db3") returned 0x0 [0084.153] lstrlenW (lpString=".dtxs") returned 5 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".dtxs") returned 0x0 [0084.153] lstrlenW (lpString=".mdt") returned 4 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".mdt") returned 0x0 [0084.153] lstrlenW (lpString=".sdf") returned 4 [0084.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".sdf") returned 0x0 [0084.153] lstrlenW (lpString=".MDF") returned 4 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".MDF") returned 0x0 [0084.155] lstrlenW (lpString=".DBF") returned 4 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".DBF") returned 0x0 [0084.155] lstrlenW (lpString=".DB") returned 3 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".DB") returned 0x0 [0084.155] lstrlenW (lpString=".db") returned 3 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".db") returned 0x0 [0084.155] lstrlenW (lpString=".ndf") returned 4 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".ndf") returned 0x0 [0084.155] lstrlenW (lpString=".NDF") returned 4 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".NDF") returned 0x0 [0084.155] lstrlenW (lpString=".Mdf") returned 4 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".Mdf") returned 0x0 [0084.155] lstrlenW (lpString=".dat") returned 4 [0084.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".dat") returned 0x0 [0084.155] lstrlenW (lpString=".DAT") returned 4 [0084.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".DAT") returned 0x0 [0084.157] lstrlenW (lpString=".ldf") returned 4 [0084.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".ldf") returned 0x0 [0084.157] lstrlenW (lpString=".LDF") returned 4 [0084.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch=".LDF") returned 0x0 [0084.157] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.157] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.158] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.158] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.158] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20415915270) returned 1 [0084.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc0f8e450, dwHighDateTime=0x1d585b4)) [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339cc8 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339cc8 | out: hHeap=0x260000) returned 1 [0084.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27519e8 [0084.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.159] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.159] GetLastError () returned 0x0 [0084.159] GetLastError () returned 0x0 [0084.159] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.159] GetLastError () returned 0x0 [0084.160] GetLastError () returned 0x0 [0084.188] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.188] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.188] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.188] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.188] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.188] CloseHandle (hObject=0xd8) returned 1 [0084.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0084.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0084.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.222] GetLastError () returned 0x0 [0084.223] RtlWakeConditionVariable () returned 0x27e828 [0084.223] GetCurrentThreadId () returned 0x998 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".ldf") returned 0x0 [0084.223] lstrlenW (lpString=".vhd") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".vhd") returned 0x0 [0084.223] lstrlenW (lpString=".vhdx") returned 5 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".vhdx") returned 0x0 [0084.223] lstrlenW (lpString=".pst") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".pst") returned 0x0 [0084.223] lstrlenW (lpString=".ost") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".ost") returned 0x0 [0084.223] lstrlenW (lpString=".bak") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".bak") returned 0x0 [0084.223] lstrlenW (lpString=".bac") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".bac") returned 0x0 [0084.223] lstrlenW (lpString=".sys") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".sys") returned 0x0 [0084.223] lstrlenW (lpString=".v2i") returned 4 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".v2i") returned 0x0 [0084.223] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.225] lstrlenW (lpString=".sql") returned 4 [0084.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".sql") returned 0x0 [0084.225] lstrlenW (lpString=".mdf") returned 4 [0084.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".mdf") returned 0x0 [0084.225] lstrlenW (lpString=".txt") returned 4 [0084.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".txt") returned 0x0 [0084.225] lstrlenW (lpString=".dbf") returned 4 [0084.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".dbf") returned 0x0 [0084.225] lstrlenW (lpString=".ckp") returned 4 [0084.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".ckp") returned 0x0 [0084.225] lstrlenW (lpString=".dacpac") returned 7 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".dacpac") returned 0x0 [0084.226] lstrlenW (lpString=".db3") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".db3") returned 0x0 [0084.226] lstrlenW (lpString=".dtxs") returned 5 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".dtxs") returned 0x0 [0084.226] lstrlenW (lpString=".mdt") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".mdt") returned 0x0 [0084.226] lstrlenW (lpString=".sdf") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".sdf") returned 0x0 [0084.226] lstrlenW (lpString=".MDF") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".MDF") returned 0x0 [0084.226] lstrlenW (lpString=".DBF") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".DBF") returned 0x0 [0084.226] lstrlenW (lpString=".DB") returned 3 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".DB") returned 0x0 [0084.226] lstrlenW (lpString=".db") returned 3 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".db") returned 0x0 [0084.226] lstrlenW (lpString=".ndf") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".ndf") returned 0x0 [0084.226] lstrlenW (lpString=".NDF") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".NDF") returned 0x0 [0084.226] lstrlenW (lpString=".Mdf") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".Mdf") returned 0x0 [0084.226] lstrlenW (lpString=".dat") returned 4 [0084.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".dat") returned 0x0 [0084.226] lstrlenW (lpString=".DAT") returned 4 [0084.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".DAT") returned 0x0 [0084.227] lstrlenW (lpString=".ldf") returned 4 [0084.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".ldf") returned 0x0 [0084.227] lstrlenW (lpString=".LDF") returned 4 [0084.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch=".LDF") returned 0x0 [0084.227] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.227] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.228] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.228] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.228] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20422903287) returned 1 [0084.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc104cb30, dwHighDateTime=0x1d585b4)) [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339de0 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339de0 | out: hHeap=0x260000) returned 1 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751528 [0084.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.229] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.229] GetLastError () returned 0x0 [0084.229] GetLastError () returned 0x0 [0084.229] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.229] GetLastError () returned 0x0 [0084.229] GetLastError () returned 0x0 [0084.253] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.253] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x30b, lpOverlapped=0x0) returned 1 [0084.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.254] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.254] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.254] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.254] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.254] CloseHandle (hObject=0xd8) returned 1 [0084.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.256] GetLastError () returned 0x0 [0084.256] RtlWakeConditionVariable () returned 0x0 [0084.256] GetCurrentThreadId () returned 0x998 [0084.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".ldf") returned 0x0 [0084.256] lstrlenW (lpString=".vhd") returned 4 [0084.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".vhd") returned 0x0 [0084.256] lstrlenW (lpString=".vhdx") returned 5 [0084.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".vhdx") returned 0x0 [0084.256] lstrlenW (lpString=".pst") returned 4 [0084.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".pst") returned 0x0 [0084.256] lstrlenW (lpString=".ost") returned 4 [0084.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".ost") returned 0x0 [0084.256] lstrlenW (lpString=".bak") returned 4 [0084.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".bak") returned 0x0 [0084.257] lstrlenW (lpString=".bac") returned 4 [0084.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".bac") returned 0x0 [0084.257] lstrlenW (lpString=".sys") returned 4 [0084.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".sys") returned 0x0 [0084.257] lstrlenW (lpString=".v2i") returned 4 [0084.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".v2i") returned 0x0 [0084.257] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.261] lstrlenW (lpString=".sql") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".sql") returned 0x0 [0084.261] lstrlenW (lpString=".mdf") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".mdf") returned 0x0 [0084.261] lstrlenW (lpString=".txt") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".txt") returned 0x0 [0084.261] lstrlenW (lpString=".dbf") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".dbf") returned 0x0 [0084.261] lstrlenW (lpString=".ckp") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".ckp") returned 0x0 [0084.261] lstrlenW (lpString=".dacpac") returned 7 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".dacpac") returned 0x0 [0084.261] lstrlenW (lpString=".db3") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".db3") returned 0x0 [0084.261] lstrlenW (lpString=".dtxs") returned 5 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".dtxs") returned 0x0 [0084.261] lstrlenW (lpString=".mdt") returned 4 [0084.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".mdt") returned 0x0 [0084.262] lstrlenW (lpString=".sdf") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".sdf") returned 0x0 [0084.262] lstrlenW (lpString=".MDF") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".MDF") returned 0x0 [0084.262] lstrlenW (lpString=".DBF") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".DBF") returned 0x0 [0084.262] lstrlenW (lpString=".DB") returned 3 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".DB") returned 0x0 [0084.262] lstrlenW (lpString=".db") returned 3 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".db") returned 0x0 [0084.262] lstrlenW (lpString=".ndf") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".ndf") returned 0x0 [0084.262] lstrlenW (lpString=".NDF") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".NDF") returned 0x0 [0084.262] lstrlenW (lpString=".Mdf") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".Mdf") returned 0x0 [0084.262] lstrlenW (lpString=".dat") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".dat") returned 0x0 [0084.262] lstrlenW (lpString=".DAT") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".DAT") returned 0x0 [0084.262] lstrlenW (lpString=".ldf") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".ldf") returned 0x0 [0084.262] lstrlenW (lpString=".LDF") returned 4 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch=".LDF") returned 0x0 [0084.262] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.263] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.263] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.264] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20426474531) returned 1 [0084.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1098df0, dwHighDateTime=0x1d585b4)) [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339e88 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339e88 | out: hHeap=0x260000) returned 1 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27503f0 [0084.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.265] GetLastError () returned 0x0 [0084.265] GetLastError () returned 0x0 [0084.265] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.265] GetLastError () returned 0x0 [0084.265] GetLastError () returned 0x0 [0084.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.267] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x314, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x314, lpOverlapped=0x0) returned 1 [0084.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.267] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.267] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.267] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.267] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.267] CloseHandle (hObject=0xf0) returned 1 [0084.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.269] GetLastError () returned 0x0 [0084.269] RtlWakeConditionVariable () returned 0x0 [0084.269] GetCurrentThreadId () returned 0x998 [0084.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".ldf") returned 0x0 [0084.269] lstrlenW (lpString=".vhd") returned 4 [0084.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".vhd") returned 0x0 [0084.270] lstrlenW (lpString=".vhdx") returned 5 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".vhdx") returned 0x0 [0084.270] lstrlenW (lpString=".pst") returned 4 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".pst") returned 0x0 [0084.270] lstrlenW (lpString=".ost") returned 4 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".ost") returned 0x0 [0084.270] lstrlenW (lpString=".bak") returned 4 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".bak") returned 0x0 [0084.270] lstrlenW (lpString=".bac") returned 4 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".bac") returned 0x0 [0084.270] lstrlenW (lpString=".sys") returned 4 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".sys") returned 0x0 [0084.270] lstrlenW (lpString=".v2i") returned 4 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".v2i") returned 0x0 [0084.270] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.274] lstrlenW (lpString=".sql") returned 4 [0084.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".sql") returned 0x0 [0084.274] lstrlenW (lpString=".mdf") returned 4 [0084.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".mdf") returned 0x0 [0084.274] lstrlenW (lpString=".txt") returned 4 [0084.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".txt") returned 0x0 [0084.274] lstrlenW (lpString=".dbf") returned 4 [0084.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".dbf") returned 0x0 [0084.274] lstrlenW (lpString=".ckp") returned 4 [0084.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".ckp") returned 0x0 [0084.274] lstrlenW (lpString=".dacpac") returned 7 [0084.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".dacpac") returned 0x0 [0084.275] lstrlenW (lpString=".db3") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".db3") returned 0x0 [0084.275] lstrlenW (lpString=".dtxs") returned 5 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".dtxs") returned 0x0 [0084.275] lstrlenW (lpString=".mdt") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".mdt") returned 0x0 [0084.275] lstrlenW (lpString=".sdf") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".sdf") returned 0x0 [0084.275] lstrlenW (lpString=".MDF") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".MDF") returned 0x0 [0084.275] lstrlenW (lpString=".DBF") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".DBF") returned 0x0 [0084.275] lstrlenW (lpString=".DB") returned 3 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".DB") returned 0x0 [0084.275] lstrlenW (lpString=".db") returned 3 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".db") returned 0x0 [0084.275] lstrlenW (lpString=".ndf") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".ndf") returned 0x0 [0084.275] lstrlenW (lpString=".NDF") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".NDF") returned 0x0 [0084.275] lstrlenW (lpString=".Mdf") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".Mdf") returned 0x0 [0084.275] lstrlenW (lpString=".dat") returned 4 [0084.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".dat") returned 0x0 [0084.275] lstrlenW (lpString=".DAT") returned 4 [0084.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".DAT") returned 0x0 [0084.276] lstrlenW (lpString=".ldf") returned 4 [0084.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".ldf") returned 0x0 [0084.276] lstrlenW (lpString=".LDF") returned 4 [0084.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch=".LDF") returned 0x0 [0084.276] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.276] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.277] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.277] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.277] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20427807540) returned 1 [0084.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc10bef50, dwHighDateTime=0x1d585b4)) [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339ec0 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339ec0 | out: hHeap=0x260000) returned 1 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751360 [0084.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.278] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.278] GetLastError () returned 0x0 [0084.278] GetLastError () returned 0x0 [0084.278] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.278] GetLastError () returned 0x0 [0084.278] GetLastError () returned 0x0 [0084.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.342] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.342] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.342] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.342] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.343] CloseHandle (hObject=0xf0) returned 1 [0084.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.345] GetLastError () returned 0x0 [0084.345] RtlWakeConditionVariable () returned 0x0 [0084.345] GetCurrentThreadId () returned 0x998 [0084.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".ldf") returned 0x0 [0084.345] lstrlenW (lpString=".vhd") returned 4 [0084.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".vhd") returned 0x0 [0084.345] lstrlenW (lpString=".vhdx") returned 5 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".vhdx") returned 0x0 [0084.346] lstrlenW (lpString=".pst") returned 4 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".pst") returned 0x0 [0084.346] lstrlenW (lpString=".ost") returned 4 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".ost") returned 0x0 [0084.346] lstrlenW (lpString=".bak") returned 4 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".bak") returned 0x0 [0084.346] lstrlenW (lpString=".bac") returned 4 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".bac") returned 0x0 [0084.346] lstrlenW (lpString=".sys") returned 4 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".sys") returned 0x0 [0084.346] lstrlenW (lpString=".v2i") returned 4 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".v2i") returned 0x0 [0084.346] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.360] lstrlenW (lpString=".sql") returned 4 [0084.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".sql") returned 0x0 [0084.360] lstrlenW (lpString=".mdf") returned 4 [0084.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".mdf") returned 0x0 [0084.360] lstrlenW (lpString=".txt") returned 4 [0084.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".txt") returned 0x0 [0084.360] lstrlenW (lpString=".dbf") returned 4 [0084.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".dbf") returned 0x0 [0084.360] lstrlenW (lpString=".ckp") returned 4 [0084.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".ckp") returned 0x0 [0084.360] lstrlenW (lpString=".dacpac") returned 7 [0084.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".dacpac") returned 0x0 [0084.361] lstrlenW (lpString=".db3") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".db3") returned 0x0 [0084.361] lstrlenW (lpString=".dtxs") returned 5 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".dtxs") returned 0x0 [0084.361] lstrlenW (lpString=".mdt") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".mdt") returned 0x0 [0084.361] lstrlenW (lpString=".sdf") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".sdf") returned 0x0 [0084.361] lstrlenW (lpString=".MDF") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".MDF") returned 0x0 [0084.361] lstrlenW (lpString=".DBF") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".DBF") returned 0x0 [0084.361] lstrlenW (lpString=".DB") returned 3 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".DB") returned 0x0 [0084.361] lstrlenW (lpString=".db") returned 3 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".db") returned 0x0 [0084.361] lstrlenW (lpString=".ndf") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".ndf") returned 0x0 [0084.361] lstrlenW (lpString=".NDF") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".NDF") returned 0x0 [0084.361] lstrlenW (lpString=".Mdf") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".Mdf") returned 0x0 [0084.361] lstrlenW (lpString=".dat") returned 4 [0084.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".dat") returned 0x0 [0084.361] lstrlenW (lpString=".DAT") returned 4 [0084.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".DAT") returned 0x0 [0084.362] lstrlenW (lpString=".ldf") returned 4 [0084.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".ldf") returned 0x0 [0084.362] lstrlenW (lpString=".LDF") returned 4 [0084.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch=".LDF") returned 0x0 [0084.362] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0084.362] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3ce0) returned 1 [0084.363] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0084.363] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.363] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20436405902) returned 1 [0084.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc117d630, dwHighDateTime=0x1d585b4)) [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a010 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a010 | out: hHeap=0x260000) returned 1 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27512c8 [0084.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.364] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.364] GetLastError () returned 0x0 [0084.364] GetLastError () returned 0x0 [0084.364] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.364] GetLastError () returned 0x0 [0084.364] GetLastError () returned 0x0 [0084.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.380] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.380] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.380] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.380] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.381] CloseHandle (hObject=0xf0) returned 1 [0084.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.429] GetLastError () returned 0x0 [0084.430] RtlWakeConditionVariable () returned 0x27e828 [0084.430] GetCurrentThreadId () returned 0x998 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".ldf") returned 0x0 [0084.430] lstrlenW (lpString=".vhd") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".vhd") returned 0x0 [0084.430] lstrlenW (lpString=".vhdx") returned 5 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".vhdx") returned 0x0 [0084.430] lstrlenW (lpString=".pst") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".pst") returned 0x0 [0084.430] lstrlenW (lpString=".ost") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".ost") returned 0x0 [0084.430] lstrlenW (lpString=".bak") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".bak") returned 0x0 [0084.430] lstrlenW (lpString=".bac") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".bac") returned 0x0 [0084.430] lstrlenW (lpString=".sys") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".sys") returned 0x0 [0084.430] lstrlenW (lpString=".v2i") returned 4 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".v2i") returned 0x0 [0084.430] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.465] lstrlenW (lpString=".sql") returned 4 [0084.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".sql") returned 0x0 [0084.466] lstrlenW (lpString=".mdf") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".mdf") returned 0x0 [0084.466] lstrlenW (lpString=".txt") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".txt") returned 0x0 [0084.466] lstrlenW (lpString=".dbf") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".dbf") returned 0x0 [0084.466] lstrlenW (lpString=".ckp") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".ckp") returned 0x0 [0084.466] lstrlenW (lpString=".dacpac") returned 7 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".dacpac") returned 0x0 [0084.466] lstrlenW (lpString=".db3") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".db3") returned 0x0 [0084.466] lstrlenW (lpString=".dtxs") returned 5 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".dtxs") returned 0x0 [0084.466] lstrlenW (lpString=".mdt") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".mdt") returned 0x0 [0084.466] lstrlenW (lpString=".sdf") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".sdf") returned 0x0 [0084.466] lstrlenW (lpString=".MDF") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".MDF") returned 0x0 [0084.466] lstrlenW (lpString=".DBF") returned 4 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".DBF") returned 0x0 [0084.466] lstrlenW (lpString=".DB") returned 3 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".DB") returned 0x0 [0084.466] lstrlenW (lpString=".db") returned 3 [0084.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".db") returned 0x0 [0084.467] lstrlenW (lpString=".ndf") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".ndf") returned 0x0 [0084.467] lstrlenW (lpString=".NDF") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".NDF") returned 0x0 [0084.467] lstrlenW (lpString=".Mdf") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".Mdf") returned 0x0 [0084.467] lstrlenW (lpString=".dat") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".dat") returned 0x0 [0084.467] lstrlenW (lpString=".DAT") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".DAT") returned 0x0 [0084.467] lstrlenW (lpString=".ldf") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".ldf") returned 0x0 [0084.467] lstrlenW (lpString=".LDF") returned 4 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch=".LDF") returned 0x0 [0084.467] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.467] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.468] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.468] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.468] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20446988648) returned 1 [0084.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1287fd0, dwHighDateTime=0x1d585b4)) [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a1d0 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a1d0 | out: hHeap=0x260000) returned 1 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750fd0 [0084.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.469] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.470] GetLastError () returned 0x0 [0084.470] GetLastError () returned 0x0 [0084.470] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.470] GetLastError () returned 0x0 [0084.470] GetLastError () returned 0x0 [0084.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.472] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.472] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.472] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.472] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.472] CloseHandle (hObject=0xf0) returned 1 [0084.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.474] GetLastError () returned 0x0 [0084.475] RtlWakeConditionVariable () returned 0x0 [0084.475] GetCurrentThreadId () returned 0x998 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".ldf") returned 0x0 [0084.475] lstrlenW (lpString=".vhd") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".vhd") returned 0x0 [0084.475] lstrlenW (lpString=".vhdx") returned 5 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".vhdx") returned 0x0 [0084.475] lstrlenW (lpString=".pst") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".pst") returned 0x0 [0084.475] lstrlenW (lpString=".ost") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".ost") returned 0x0 [0084.475] lstrlenW (lpString=".bak") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".bak") returned 0x0 [0084.475] lstrlenW (lpString=".bac") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".bac") returned 0x0 [0084.475] lstrlenW (lpString=".sys") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".sys") returned 0x0 [0084.475] lstrlenW (lpString=".v2i") returned 4 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".v2i") returned 0x0 [0084.475] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.477] lstrlenW (lpString=".sql") returned 4 [0084.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".sql") returned 0x0 [0084.477] lstrlenW (lpString=".mdf") returned 4 [0084.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".mdf") returned 0x0 [0084.477] lstrlenW (lpString=".txt") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".txt") returned 0x0 [0084.478] lstrlenW (lpString=".dbf") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".dbf") returned 0x0 [0084.478] lstrlenW (lpString=".ckp") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".ckp") returned 0x0 [0084.478] lstrlenW (lpString=".dacpac") returned 7 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".dacpac") returned 0x0 [0084.478] lstrlenW (lpString=".db3") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".db3") returned 0x0 [0084.478] lstrlenW (lpString=".dtxs") returned 5 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".dtxs") returned 0x0 [0084.478] lstrlenW (lpString=".mdt") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".mdt") returned 0x0 [0084.478] lstrlenW (lpString=".sdf") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".sdf") returned 0x0 [0084.478] lstrlenW (lpString=".MDF") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".MDF") returned 0x0 [0084.478] lstrlenW (lpString=".DBF") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".DBF") returned 0x0 [0084.478] lstrlenW (lpString=".DB") returned 3 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".DB") returned 0x0 [0084.478] lstrlenW (lpString=".db") returned 3 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".db") returned 0x0 [0084.478] lstrlenW (lpString=".ndf") returned 4 [0084.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".ndf") returned 0x0 [0084.479] lstrlenW (lpString=".NDF") returned 4 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".NDF") returned 0x0 [0084.479] lstrlenW (lpString=".Mdf") returned 4 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".Mdf") returned 0x0 [0084.479] lstrlenW (lpString=".dat") returned 4 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".dat") returned 0x0 [0084.479] lstrlenW (lpString=".DAT") returned 4 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".DAT") returned 0x0 [0084.479] lstrlenW (lpString=".ldf") returned 4 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".ldf") returned 0x0 [0084.479] lstrlenW (lpString=".LDF") returned 4 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch=".LDF") returned 0x0 [0084.479] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.479] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.480] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.480] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.480] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20448127236) returned 1 [0084.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc12ae130, dwHighDateTime=0x1d585b4)) [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a208 [0084.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a208 | out: hHeap=0x260000) returned 1 [0084.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750c40 [0084.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.481] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.481] GetLastError () returned 0x0 [0084.481] GetLastError () returned 0x0 [0084.481] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.481] GetLastError () returned 0x0 [0084.482] GetLastError () returned 0x0 [0084.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcbf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.631] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x341, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x341, lpOverlapped=0x0) returned 1 [0084.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.631] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.631] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.631] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.631] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.631] CloseHandle (hObject=0xf0) returned 1 [0084.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.633] GetLastError () returned 0x0 [0084.633] RtlWakeConditionVariable () returned 0x0 [0084.633] GetCurrentThreadId () returned 0x998 [0084.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".ldf") returned 0x0 [0084.633] lstrlenW (lpString=".vhd") returned 4 [0084.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".vhd") returned 0x0 [0084.633] lstrlenW (lpString=".vhdx") returned 5 [0084.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".vhdx") returned 0x0 [0084.633] lstrlenW (lpString=".pst") returned 4 [0084.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".pst") returned 0x0 [0084.634] lstrlenW (lpString=".ost") returned 4 [0084.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".ost") returned 0x0 [0084.634] lstrlenW (lpString=".bak") returned 4 [0084.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".bak") returned 0x0 [0084.634] lstrlenW (lpString=".bac") returned 4 [0084.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".bac") returned 0x0 [0084.634] lstrlenW (lpString=".sys") returned 4 [0084.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".sys") returned 0x0 [0084.634] lstrlenW (lpString=".v2i") returned 4 [0084.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".v2i") returned 0x0 [0084.634] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.635] lstrlenW (lpString=".sql") returned 4 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".sql") returned 0x0 [0084.635] lstrlenW (lpString=".mdf") returned 4 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".mdf") returned 0x0 [0084.635] lstrlenW (lpString=".txt") returned 4 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".txt") returned 0x0 [0084.635] lstrlenW (lpString=".dbf") returned 4 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".dbf") returned 0x0 [0084.635] lstrlenW (lpString=".ckp") returned 4 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".ckp") returned 0x0 [0084.635] lstrlenW (lpString=".dacpac") returned 7 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".dacpac") returned 0x0 [0084.635] lstrlenW (lpString=".db3") returned 4 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".db3") returned 0x0 [0084.635] lstrlenW (lpString=".dtxs") returned 5 [0084.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".dtxs") returned 0x0 [0084.636] lstrlenW (lpString=".mdt") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".mdt") returned 0x0 [0084.636] lstrlenW (lpString=".sdf") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".sdf") returned 0x0 [0084.636] lstrlenW (lpString=".MDF") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".MDF") returned 0x0 [0084.636] lstrlenW (lpString=".DBF") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".DBF") returned 0x0 [0084.636] lstrlenW (lpString=".DB") returned 3 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".DB") returned 0x0 [0084.636] lstrlenW (lpString=".db") returned 3 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".db") returned 0x0 [0084.636] lstrlenW (lpString=".ndf") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".ndf") returned 0x0 [0084.636] lstrlenW (lpString=".NDF") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".NDF") returned 0x0 [0084.636] lstrlenW (lpString=".Mdf") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".Mdf") returned 0x0 [0084.636] lstrlenW (lpString=".dat") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".dat") returned 0x0 [0084.636] lstrlenW (lpString=".DAT") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".DAT") returned 0x0 [0084.636] lstrlenW (lpString=".ldf") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".ldf") returned 0x0 [0084.636] lstrlenW (lpString=".LDF") returned 4 [0084.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch=".LDF") returned 0x0 [0084.637] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.637] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.637] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.637] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.638] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20463881326) returned 1 [0084.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc142aef0, dwHighDateTime=0x1d585b4)) [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0118 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0118 | out: hHeap=0x260000) returned 1 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c9d0 [0084.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.638] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.639] GetLastError () returned 0x0 [0084.639] GetLastError () returned 0x0 [0084.639] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.639] GetLastError () returned 0x0 [0084.639] GetLastError () returned 0x0 [0084.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.641] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x8be, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x8be, lpOverlapped=0x0) returned 1 [0084.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.641] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.641] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.641] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.641] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.641] CloseHandle (hObject=0xf0) returned 1 [0084.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.643] GetLastError () returned 0x0 [0084.643] RtlWakeConditionVariable () returned 0x0 [0084.643] GetCurrentThreadId () returned 0x998 [0084.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".ldf") returned 0x0 [0084.643] lstrlenW (lpString=".vhd") returned 4 [0084.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".vhd") returned 0x0 [0084.643] lstrlenW (lpString=".vhdx") returned 5 [0084.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".vhdx") returned 0x0 [0084.643] lstrlenW (lpString=".pst") returned 4 [0084.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".pst") returned 0x0 [0084.643] lstrlenW (lpString=".ost") returned 4 [0084.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".ost") returned 0x0 [0084.643] lstrlenW (lpString=".bak") returned 4 [0084.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".bak") returned 0x0 [0084.643] lstrlenW (lpString=".bac") returned 4 [0084.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".bac") returned 0x0 [0084.644] lstrlenW (lpString=".sys") returned 4 [0084.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".sys") returned 0x0 [0084.644] lstrlenW (lpString=".v2i") returned 4 [0084.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".v2i") returned 0x0 [0084.644] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.645] lstrlenW (lpString=".sql") returned 4 [0084.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".sql") returned 0x0 [0084.645] lstrlenW (lpString=".mdf") returned 4 [0084.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".mdf") returned 0x0 [0084.645] lstrlenW (lpString=".txt") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".txt") returned 0x0 [0084.646] lstrlenW (lpString=".dbf") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".dbf") returned 0x0 [0084.646] lstrlenW (lpString=".ckp") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".ckp") returned 0x0 [0084.646] lstrlenW (lpString=".dacpac") returned 7 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".dacpac") returned 0x0 [0084.646] lstrlenW (lpString=".db3") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".db3") returned 0x0 [0084.646] lstrlenW (lpString=".dtxs") returned 5 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".dtxs") returned 0x0 [0084.646] lstrlenW (lpString=".mdt") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".mdt") returned 0x0 [0084.646] lstrlenW (lpString=".sdf") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".sdf") returned 0x0 [0084.646] lstrlenW (lpString=".MDF") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".MDF") returned 0x0 [0084.646] lstrlenW (lpString=".DBF") returned 4 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".DBF") returned 0x0 [0084.646] lstrlenW (lpString=".DB") returned 3 [0084.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".DB") returned 0x0 [0084.646] lstrlenW (lpString=".db") returned 3 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".db") returned 0x0 [0084.647] lstrlenW (lpString=".ndf") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".ndf") returned 0x0 [0084.647] lstrlenW (lpString=".NDF") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".NDF") returned 0x0 [0084.647] lstrlenW (lpString=".Mdf") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".Mdf") returned 0x0 [0084.647] lstrlenW (lpString=".dat") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".dat") returned 0x0 [0084.647] lstrlenW (lpString=".DAT") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".DAT") returned 0x0 [0084.647] lstrlenW (lpString=".ldf") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".ldf") returned 0x0 [0084.647] lstrlenW (lpString=".LDF") returned 4 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch=".LDF") returned 0x0 [0084.647] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.647] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.648] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.648] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.648] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20464936490) returned 1 [0084.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1451050, dwHighDateTime=0x1d585b4)) [0084.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5828 [0084.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5828 | out: hHeap=0x260000) returned 1 [0084.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32be88 [0084.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.649] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.649] GetLastError () returned 0x0 [0084.649] GetLastError () returned 0x0 [0084.649] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.650] GetLastError () returned 0x0 [0084.650] GetLastError () returned 0x0 [0084.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.651] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x300, lpOverlapped=0x0) returned 1 [0084.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.652] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.652] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.652] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.652] CloseHandle (hObject=0xf0) returned 1 [0084.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.653] GetLastError () returned 0x0 [0084.653] RtlWakeConditionVariable () returned 0x0 [0084.653] GetCurrentThreadId () returned 0x998 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".ldf") returned 0x0 [0084.654] lstrlenW (lpString=".vhd") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".vhd") returned 0x0 [0084.654] lstrlenW (lpString=".vhdx") returned 5 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".vhdx") returned 0x0 [0084.654] lstrlenW (lpString=".pst") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".pst") returned 0x0 [0084.654] lstrlenW (lpString=".ost") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".ost") returned 0x0 [0084.654] lstrlenW (lpString=".bak") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".bak") returned 0x0 [0084.654] lstrlenW (lpString=".bac") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".bac") returned 0x0 [0084.654] lstrlenW (lpString=".sys") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".sys") returned 0x0 [0084.654] lstrlenW (lpString=".v2i") returned 4 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".v2i") returned 0x0 [0084.654] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.655] lstrlenW (lpString=".sql") returned 4 [0084.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".sql") returned 0x0 [0084.655] lstrlenW (lpString=".mdf") returned 4 [0084.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".mdf") returned 0x0 [0084.655] lstrlenW (lpString=".txt") returned 4 [0084.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".txt") returned 0x0 [0084.655] lstrlenW (lpString=".dbf") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".dbf") returned 0x0 [0084.656] lstrlenW (lpString=".ckp") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".ckp") returned 0x0 [0084.656] lstrlenW (lpString=".dacpac") returned 7 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".dacpac") returned 0x0 [0084.656] lstrlenW (lpString=".db3") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".db3") returned 0x0 [0084.656] lstrlenW (lpString=".dtxs") returned 5 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".dtxs") returned 0x0 [0084.656] lstrlenW (lpString=".mdt") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".mdt") returned 0x0 [0084.656] lstrlenW (lpString=".sdf") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".sdf") returned 0x0 [0084.656] lstrlenW (lpString=".MDF") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".MDF") returned 0x0 [0084.656] lstrlenW (lpString=".DBF") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".DBF") returned 0x0 [0084.656] lstrlenW (lpString=".DB") returned 3 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".DB") returned 0x0 [0084.656] lstrlenW (lpString=".db") returned 3 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".db") returned 0x0 [0084.656] lstrlenW (lpString=".ndf") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".ndf") returned 0x0 [0084.656] lstrlenW (lpString=".NDF") returned 4 [0084.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".NDF") returned 0x0 [0084.657] lstrlenW (lpString=".Mdf") returned 4 [0084.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".Mdf") returned 0x0 [0084.657] lstrlenW (lpString=".dat") returned 4 [0084.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".dat") returned 0x0 [0084.657] lstrlenW (lpString=".DAT") returned 4 [0084.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".DAT") returned 0x0 [0084.657] lstrlenW (lpString=".ldf") returned 4 [0084.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".ldf") returned 0x0 [0084.657] lstrlenW (lpString=".LDF") returned 4 [0084.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch=".LDF") returned 0x0 [0084.657] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.657] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.658] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.658] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.658] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20465921899) returned 1 [0084.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1451050, dwHighDateTime=0x1d585b4)) [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5860 [0084.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5860 | out: hHeap=0x260000) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c808 [0084.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.659] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.659] GetLastError () returned 0x0 [0084.659] GetLastError () returned 0x0 [0084.659] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.659] GetLastError () returned 0x0 [0084.660] GetLastError () returned 0x0 [0084.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.661] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x324, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x324, lpOverlapped=0x0) returned 1 [0084.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.661] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.662] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.662] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.662] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.662] CloseHandle (hObject=0xf0) returned 1 [0084.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.663] GetLastError () returned 0x0 [0084.664] RtlWakeConditionVariable () returned 0x0 [0084.664] GetCurrentThreadId () returned 0x998 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".ldf") returned 0x0 [0084.664] lstrlenW (lpString=".vhd") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".vhd") returned 0x0 [0084.664] lstrlenW (lpString=".vhdx") returned 5 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".vhdx") returned 0x0 [0084.664] lstrlenW (lpString=".pst") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".pst") returned 0x0 [0084.664] lstrlenW (lpString=".ost") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".ost") returned 0x0 [0084.664] lstrlenW (lpString=".bak") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".bak") returned 0x0 [0084.664] lstrlenW (lpString=".bac") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".bac") returned 0x0 [0084.664] lstrlenW (lpString=".sys") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".sys") returned 0x0 [0084.664] lstrlenW (lpString=".v2i") returned 4 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".v2i") returned 0x0 [0084.664] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.666] lstrlenW (lpString=".sql") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".sql") returned 0x0 [0084.666] lstrlenW (lpString=".mdf") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".mdf") returned 0x0 [0084.666] lstrlenW (lpString=".txt") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".txt") returned 0x0 [0084.666] lstrlenW (lpString=".dbf") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".dbf") returned 0x0 [0084.666] lstrlenW (lpString=".ckp") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".ckp") returned 0x0 [0084.666] lstrlenW (lpString=".dacpac") returned 7 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".dacpac") returned 0x0 [0084.666] lstrlenW (lpString=".db3") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".db3") returned 0x0 [0084.666] lstrlenW (lpString=".dtxs") returned 5 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".dtxs") returned 0x0 [0084.666] lstrlenW (lpString=".mdt") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".mdt") returned 0x0 [0084.666] lstrlenW (lpString=".sdf") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".sdf") returned 0x0 [0084.666] lstrlenW (lpString=".MDF") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".MDF") returned 0x0 [0084.666] lstrlenW (lpString=".DBF") returned 4 [0084.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".DBF") returned 0x0 [0084.666] lstrlenW (lpString=".DB") returned 3 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".DB") returned 0x0 [0084.667] lstrlenW (lpString=".db") returned 3 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".db") returned 0x0 [0084.667] lstrlenW (lpString=".ndf") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".ndf") returned 0x0 [0084.667] lstrlenW (lpString=".NDF") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".NDF") returned 0x0 [0084.667] lstrlenW (lpString=".Mdf") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".Mdf") returned 0x0 [0084.667] lstrlenW (lpString=".dat") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".dat") returned 0x0 [0084.667] lstrlenW (lpString=".DAT") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".DAT") returned 0x0 [0084.667] lstrlenW (lpString=".ldf") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".ldf") returned 0x0 [0084.667] lstrlenW (lpString=".LDF") returned 4 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch=".LDF") returned 0x0 [0084.667] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.667] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.668] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.668] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.668] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20466949291) returned 1 [0084.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc14771b0, dwHighDateTime=0x1d585b4)) [0084.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5898 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5898 | out: hHeap=0x260000) returned 1 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c770 [0084.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.669] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.669] GetLastError () returned 0x0 [0084.669] GetLastError () returned 0x0 [0084.670] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.670] GetLastError () returned 0x0 [0084.670] GetLastError () returned 0x0 [0084.756] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.756] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.757] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.757] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.757] CloseHandle (hObject=0xf0) returned 1 [0084.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.758] GetLastError () returned 0x0 [0084.758] RtlWakeConditionVariable () returned 0x0 [0084.758] GetCurrentThreadId () returned 0x998 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".ldf") returned 0x0 [0084.759] lstrlenW (lpString=".vhd") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".vhd") returned 0x0 [0084.759] lstrlenW (lpString=".vhdx") returned 5 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".vhdx") returned 0x0 [0084.759] lstrlenW (lpString=".pst") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".pst") returned 0x0 [0084.759] lstrlenW (lpString=".ost") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".ost") returned 0x0 [0084.759] lstrlenW (lpString=".bak") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".bak") returned 0x0 [0084.759] lstrlenW (lpString=".bac") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".bac") returned 0x0 [0084.759] lstrlenW (lpString=".sys") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".sys") returned 0x0 [0084.759] lstrlenW (lpString=".v2i") returned 4 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".v2i") returned 0x0 [0084.759] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.760] lstrlenW (lpString=".sql") returned 4 [0084.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".sql") returned 0x0 [0084.760] lstrlenW (lpString=".mdf") returned 4 [0084.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".mdf") returned 0x0 [0084.760] lstrlenW (lpString=".txt") returned 4 [0084.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".txt") returned 0x0 [0084.760] lstrlenW (lpString=".dbf") returned 4 [0084.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".dbf") returned 0x0 [0084.760] lstrlenW (lpString=".ckp") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".ckp") returned 0x0 [0084.761] lstrlenW (lpString=".dacpac") returned 7 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".dacpac") returned 0x0 [0084.761] lstrlenW (lpString=".db3") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".db3") returned 0x0 [0084.761] lstrlenW (lpString=".dtxs") returned 5 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".dtxs") returned 0x0 [0084.761] lstrlenW (lpString=".mdt") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".mdt") returned 0x0 [0084.761] lstrlenW (lpString=".sdf") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".sdf") returned 0x0 [0084.761] lstrlenW (lpString=".MDF") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".MDF") returned 0x0 [0084.761] lstrlenW (lpString=".DBF") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".DBF") returned 0x0 [0084.761] lstrlenW (lpString=".DB") returned 3 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".DB") returned 0x0 [0084.761] lstrlenW (lpString=".db") returned 3 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".db") returned 0x0 [0084.761] lstrlenW (lpString=".ndf") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".ndf") returned 0x0 [0084.761] lstrlenW (lpString=".NDF") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".NDF") returned 0x0 [0084.761] lstrlenW (lpString=".Mdf") returned 4 [0084.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".Mdf") returned 0x0 [0084.762] lstrlenW (lpString=".dat") returned 4 [0084.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".dat") returned 0x0 [0084.762] lstrlenW (lpString=".DAT") returned 4 [0084.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".DAT") returned 0x0 [0084.762] lstrlenW (lpString=".ldf") returned 4 [0084.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".ldf") returned 0x0 [0084.762] lstrlenW (lpString=".LDF") returned 4 [0084.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch=".LDF") returned 0x0 [0084.762] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.762] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d30a8) returned 1 [0084.763] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.763] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.763] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20476408090) returned 1 [0084.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc155b9f0, dwHighDateTime=0x1d585b4)) [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c480 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c480 | out: hHeap=0x260000) returned 1 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c6d8 [0084.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.764] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.764] GetLastError () returned 0x0 [0084.764] GetLastError () returned 0x0 [0084.764] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.764] GetLastError () returned 0x0 [0084.764] GetLastError () returned 0x0 [0084.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.781] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.782] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.782] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.782] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.782] CloseHandle (hObject=0xf0) returned 1 [0084.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.786] GetLastError () returned 0x0 [0084.786] RtlWakeConditionVariable () returned 0x27e828 [0084.786] GetCurrentThreadId () returned 0x998 [0084.786] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.786] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.786] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0084.786] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0084.788] CloseHandle (hObject=0xf0) returned 1 [0084.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2778348 | out: hHeap=0x260000) returned 1 [0084.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0084.788] RtlWakeConditionVariable () returned 0x27e828 [0084.788] GetCurrentThreadId () returned 0x998 [0084.788] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.788] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.789] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0084.789] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0084.790] CloseHandle (hObject=0xf0) returned 1 [0084.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a3a0 | out: hHeap=0x260000) returned 1 [0084.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.790] RtlWakeConditionVariable () returned 0x27e828 [0084.790] GetCurrentThreadId () returned 0x998 [0084.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".ldf") returned 0x0 [0084.790] lstrlenW (lpString=".vhd") returned 4 [0084.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".vhd") returned 0x0 [0084.791] lstrlenW (lpString=".vhdx") returned 5 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".vhdx") returned 0x0 [0084.791] lstrlenW (lpString=".pst") returned 4 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".pst") returned 0x0 [0084.791] lstrlenW (lpString=".ost") returned 4 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".ost") returned 0x0 [0084.791] lstrlenW (lpString=".bak") returned 4 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".bak") returned 0x0 [0084.791] lstrlenW (lpString=".bac") returned 4 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".bac") returned 0x0 [0084.791] lstrlenW (lpString=".sys") returned 4 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".sys") returned 0x0 [0084.791] lstrlenW (lpString=".v2i") returned 4 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".v2i") returned 0x0 [0084.791] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch="s\r\n.v2i") returned 0x0 [0084.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.792] lstrlenW (lpString=".sql") returned 4 [0084.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".sql") returned 0x0 [0084.792] lstrlenW (lpString=".mdf") returned 4 [0084.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".mdf") returned 0x0 [0084.792] lstrlenW (lpString=".txt") returned 4 [0084.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".txt") returned 0x0 [0084.792] lstrlenW (lpString=".dbf") returned 4 [0084.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".dbf") returned 0x0 [0084.792] lstrlenW (lpString=".ckp") returned 4 [0084.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".ckp") returned 0x0 [0084.792] lstrlenW (lpString=".dacpac") returned 7 [0084.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".dacpac") returned 0x0 [0084.792] lstrlenW (lpString=".db3") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".db3") returned 0x0 [0084.793] lstrlenW (lpString=".dtxs") returned 5 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".dtxs") returned 0x0 [0084.793] lstrlenW (lpString=".mdt") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".mdt") returned 0x0 [0084.793] lstrlenW (lpString=".sdf") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".sdf") returned 0x0 [0084.793] lstrlenW (lpString=".MDF") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".MDF") returned 0x0 [0084.793] lstrlenW (lpString=".DBF") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".DBF") returned 0x0 [0084.793] lstrlenW (lpString=".DB") returned 3 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".DB") returned 0x0 [0084.793] lstrlenW (lpString=".db") returned 3 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".db") returned 0x0 [0084.793] lstrlenW (lpString=".ndf") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".ndf") returned 0x0 [0084.793] lstrlenW (lpString=".NDF") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".NDF") returned 0x0 [0084.793] lstrlenW (lpString=".Mdf") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".Mdf") returned 0x0 [0084.793] lstrlenW (lpString=".dat") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".dat") returned 0x0 [0084.793] lstrlenW (lpString=".DAT") returned 4 [0084.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".DAT") returned 0x0 [0084.794] lstrlenW (lpString=".ldf") returned 4 [0084.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".ldf") returned 0x0 [0084.794] lstrlenW (lpString=".LDF") returned 4 [0084.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch=".LDF") returned 0x0 [0084.794] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.794] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2d3ce0) returned 1 [0084.795] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.795] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.795] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20479593752) returned 1 [0084.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc15a7cb0, dwHighDateTime=0x1d585b4)) [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c560 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c560 | out: hHeap=0x260000) returned 1 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0084.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.796] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.796] GetLastError () returned 0x0 [0084.796] GetLastError () returned 0x0 [0084.796] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.796] GetLastError () returned 0x0 [0084.796] GetLastError () returned 0x0 [0084.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.818] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.819] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.827] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.827] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.827] CloseHandle (hObject=0xf0) returned 1 [0084.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0084.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.[deadmin@cock.li].deadmin")) returned 1 [0084.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0084.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.828] GetLastError () returned 0x0 [0084.829] RtlWakeConditionVariable () returned 0x0 [0084.829] GetCurrentThreadId () returned 0x998 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".ldf") returned 0x0 [0084.829] lstrlenW (lpString=".vhd") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".vhd") returned 0x0 [0084.829] lstrlenW (lpString=".vhdx") returned 5 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".vhdx") returned 0x0 [0084.829] lstrlenW (lpString=".pst") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".pst") returned 0x0 [0084.829] lstrlenW (lpString=".ost") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".ost") returned 0x0 [0084.829] lstrlenW (lpString=".bak") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".bak") returned 0x0 [0084.829] lstrlenW (lpString=".bac") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".bac") returned 0x0 [0084.829] lstrlenW (lpString=".sys") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".sys") returned 0x0 [0084.829] lstrlenW (lpString=".v2i") returned 4 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".v2i") returned 0x0 [0084.829] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch="s\r\n.v2i") returned 0x0 [0084.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.833] lstrlenW (lpString=".sql") returned 4 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".sql") returned 0x0 [0084.833] lstrlenW (lpString=".mdf") returned 4 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".mdf") returned 0x0 [0084.833] lstrlenW (lpString=".txt") returned 4 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".txt") returned 0x0 [0084.833] lstrlenW (lpString=".dbf") returned 4 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".dbf") returned 0x0 [0084.833] lstrlenW (lpString=".ckp") returned 4 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".ckp") returned 0x0 [0084.833] lstrlenW (lpString=".dacpac") returned 7 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".dacpac") returned 0x0 [0084.833] lstrlenW (lpString=".db3") returned 4 [0084.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".db3") returned 0x0 [0084.834] lstrlenW (lpString=".dtxs") returned 5 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".dtxs") returned 0x0 [0084.834] lstrlenW (lpString=".mdt") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".mdt") returned 0x0 [0084.834] lstrlenW (lpString=".sdf") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".sdf") returned 0x0 [0084.834] lstrlenW (lpString=".MDF") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".MDF") returned 0x0 [0084.834] lstrlenW (lpString=".DBF") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".DBF") returned 0x0 [0084.834] lstrlenW (lpString=".DB") returned 3 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".DB") returned 0x0 [0084.834] lstrlenW (lpString=".db") returned 3 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".db") returned 0x0 [0084.834] lstrlenW (lpString=".ndf") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".ndf") returned 0x0 [0084.834] lstrlenW (lpString=".NDF") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".NDF") returned 0x0 [0084.834] lstrlenW (lpString=".Mdf") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".Mdf") returned 0x0 [0084.834] lstrlenW (lpString=".dat") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".dat") returned 0x0 [0084.834] lstrlenW (lpString=".DAT") returned 4 [0084.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".DAT") returned 0x0 [0084.834] lstrlenW (lpString=".ldf") returned 4 [0084.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".ldf") returned 0x0 [0084.835] lstrlenW (lpString=".LDF") returned 4 [0084.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch=".LDF") returned 0x0 [0084.835] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.835] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2757af0) returned 1 [0084.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.836] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0084.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.836] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20483694981) returned 1 [0084.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc161a0d0, dwHighDateTime=0x1d585b4)) [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c608 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c608 | out: hHeap=0x260000) returned 1 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.837] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.837] GetLastError () returned 0x0 [0084.837] GetLastError () returned 0x0 [0084.837] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.837] GetLastError () returned 0x0 [0084.837] GetLastError () returned 0x0 [0084.840] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.841] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.841] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.841] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.842] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.843] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.843] CloseHandle (hObject=0xe4) returned 1 [0084.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0084.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.[deadmin@cock.li].deadmin")) returned 1 [0084.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0084.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.844] GetLastError () returned 0x0 [0084.845] RtlWakeConditionVariable () returned 0x0 [0084.845] GetCurrentThreadId () returned 0x998 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".ldf") returned 0x0 [0084.845] lstrlenW (lpString=".vhd") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".vhd") returned 0x0 [0084.845] lstrlenW (lpString=".vhdx") returned 5 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".vhdx") returned 0x0 [0084.845] lstrlenW (lpString=".pst") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".pst") returned 0x0 [0084.845] lstrlenW (lpString=".ost") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".ost") returned 0x0 [0084.845] lstrlenW (lpString=".bak") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".bak") returned 0x0 [0084.845] lstrlenW (lpString=".bac") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".bac") returned 0x0 [0084.845] lstrlenW (lpString=".sys") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".sys") returned 0x0 [0084.845] lstrlenW (lpString=".v2i") returned 4 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".v2i") returned 0x0 [0084.845] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch="s\r\n.v2i") returned 0x0 [0084.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.847] lstrlenW (lpString=".sql") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".sql") returned 0x0 [0084.847] lstrlenW (lpString=".mdf") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".mdf") returned 0x0 [0084.847] lstrlenW (lpString=".txt") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".txt") returned 0x0 [0084.847] lstrlenW (lpString=".dbf") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".dbf") returned 0x0 [0084.847] lstrlenW (lpString=".ckp") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".ckp") returned 0x0 [0084.847] lstrlenW (lpString=".dacpac") returned 7 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".dacpac") returned 0x0 [0084.847] lstrlenW (lpString=".db3") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".db3") returned 0x0 [0084.847] lstrlenW (lpString=".dtxs") returned 5 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".dtxs") returned 0x0 [0084.847] lstrlenW (lpString=".mdt") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".mdt") returned 0x0 [0084.847] lstrlenW (lpString=".sdf") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".sdf") returned 0x0 [0084.847] lstrlenW (lpString=".MDF") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".MDF") returned 0x0 [0084.847] lstrlenW (lpString=".DBF") returned 4 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".DBF") returned 0x0 [0084.847] lstrlenW (lpString=".DB") returned 3 [0084.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".DB") returned 0x0 [0084.848] lstrlenW (lpString=".db") returned 3 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".db") returned 0x0 [0084.848] lstrlenW (lpString=".ndf") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".ndf") returned 0x0 [0084.848] lstrlenW (lpString=".NDF") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".NDF") returned 0x0 [0084.848] lstrlenW (lpString=".Mdf") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".Mdf") returned 0x0 [0084.848] lstrlenW (lpString=".dat") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".dat") returned 0x0 [0084.848] lstrlenW (lpString=".DAT") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".DAT") returned 0x0 [0084.848] lstrlenW (lpString=".ldf") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".ldf") returned 0x0 [0084.848] lstrlenW (lpString=".LDF") returned 4 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch=".LDF") returned 0x0 [0084.848] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.848] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e2f8) returned 1 [0084.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.849] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.849] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20485044730) returned 1 [0084.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1640230, dwHighDateTime=0x1d585b4)) [0084.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c640 [0084.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c640 | out: hHeap=0x260000) returned 1 [0084.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.850] GetLastError () returned 0x0 [0084.850] GetLastError () returned 0x0 [0084.850] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.851] GetLastError () returned 0x0 [0084.851] GetLastError () returned 0x0 [0084.928] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.928] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.930] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.930] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.986] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.986] CloseHandle (hObject=0xe4) returned 1 [0084.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0084.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.[deadmin@cock.li].deadmin")) returned 1 [0084.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0084.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0084.989] GetLastError () returned 0x0 [0084.989] RtlWakeConditionVariable () returned 0x0 [0084.989] GetCurrentThreadId () returned 0x998 [0084.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".ldf") returned 0x0 [0084.989] lstrlenW (lpString=".vhd") returned 4 [0084.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".vhd") returned 0x0 [0084.989] lstrlenW (lpString=".vhdx") returned 5 [0084.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".vhdx") returned 0x0 [0084.989] lstrlenW (lpString=".pst") returned 4 [0084.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".pst") returned 0x0 [0084.990] lstrlenW (lpString=".ost") returned 4 [0084.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".ost") returned 0x0 [0084.990] lstrlenW (lpString=".bak") returned 4 [0084.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".bak") returned 0x0 [0084.990] lstrlenW (lpString=".bac") returned 4 [0084.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".bac") returned 0x0 [0084.990] lstrlenW (lpString=".sys") returned 4 [0084.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".sys") returned 0x0 [0084.990] lstrlenW (lpString=".v2i") returned 4 [0084.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".v2i") returned 0x0 [0084.990] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch="s\r\n.v2i") returned 0x0 [0084.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.992] lstrlenW (lpString=".sql") returned 4 [0084.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".sql") returned 0x0 [0084.992] lstrlenW (lpString=".mdf") returned 4 [0084.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".mdf") returned 0x0 [0084.992] lstrlenW (lpString=".txt") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".txt") returned 0x0 [0084.993] lstrlenW (lpString=".dbf") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".dbf") returned 0x0 [0084.993] lstrlenW (lpString=".ckp") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".ckp") returned 0x0 [0084.993] lstrlenW (lpString=".dacpac") returned 7 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".dacpac") returned 0x0 [0084.993] lstrlenW (lpString=".db3") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".db3") returned 0x0 [0084.993] lstrlenW (lpString=".dtxs") returned 5 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".dtxs") returned 0x0 [0084.993] lstrlenW (lpString=".mdt") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".mdt") returned 0x0 [0084.993] lstrlenW (lpString=".sdf") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".sdf") returned 0x0 [0084.993] lstrlenW (lpString=".MDF") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".MDF") returned 0x0 [0084.993] lstrlenW (lpString=".DBF") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".DBF") returned 0x0 [0084.993] lstrlenW (lpString=".DB") returned 3 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".DB") returned 0x0 [0084.993] lstrlenW (lpString=".db") returned 3 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".db") returned 0x0 [0084.993] lstrlenW (lpString=".ndf") returned 4 [0084.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".ndf") returned 0x0 [0084.994] lstrlenW (lpString=".NDF") returned 4 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".NDF") returned 0x0 [0084.994] lstrlenW (lpString=".Mdf") returned 4 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".Mdf") returned 0x0 [0084.994] lstrlenW (lpString=".dat") returned 4 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".dat") returned 0x0 [0084.994] lstrlenW (lpString=".DAT") returned 4 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".DAT") returned 0x0 [0084.994] lstrlenW (lpString=".ldf") returned 4 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".ldf") returned 0x0 [0084.994] lstrlenW (lpString=".LDF") returned 4 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch=".LDF") returned 0x0 [0084.994] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0084.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.994] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0084.995] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.995] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0084.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0084.995] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20499628378) returned 1 [0084.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1796e90, dwHighDateTime=0x1d585b4)) [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762e28 [0084.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762e28 | out: hHeap=0x260000) returned 1 [0084.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.996] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0084.996] GetLastError () returned 0x0 [0084.996] GetLastError () returned 0x0 [0084.996] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0084.996] GetLastError () returned 0x0 [0084.997] GetLastError () returned 0x0 [0084.998] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.998] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x3ae, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3ae, lpOverlapped=0x0) returned 1 [0084.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.999] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.999] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.999] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.999] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.999] CloseHandle (hObject=0xe4) returned 1 [0084.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x140) returned 0x27d070 [0084.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.[deadmin@cock.li].deadmin")) returned 1 [0085.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0085.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.001] GetLastError () returned 0x0 [0085.001] RtlWakeConditionVariable () returned 0x0 [0085.001] GetCurrentThreadId () returned 0x998 [0085.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".ldf") returned 0x0 [0085.002] lstrlenW (lpString=".vhd") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".vhd") returned 0x0 [0085.002] lstrlenW (lpString=".vhdx") returned 5 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".vhdx") returned 0x0 [0085.002] lstrlenW (lpString=".pst") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".pst") returned 0x0 [0085.002] lstrlenW (lpString=".ost") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".ost") returned 0x0 [0085.002] lstrlenW (lpString=".bak") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".bak") returned 0x0 [0085.002] lstrlenW (lpString=".bac") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".bac") returned 0x0 [0085.002] lstrlenW (lpString=".sys") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".sys") returned 0x0 [0085.002] lstrlenW (lpString=".v2i") returned 4 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".v2i") returned 0x0 [0085.002] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch="s\r\n.v2i") returned 0x0 [0085.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.004] lstrlenW (lpString=".sql") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".sql") returned 0x0 [0085.004] lstrlenW (lpString=".mdf") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".mdf") returned 0x0 [0085.004] lstrlenW (lpString=".txt") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".txt") returned 0x0 [0085.004] lstrlenW (lpString=".dbf") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".dbf") returned 0x0 [0085.004] lstrlenW (lpString=".ckp") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".ckp") returned 0x0 [0085.004] lstrlenW (lpString=".dacpac") returned 7 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".dacpac") returned 0x0 [0085.004] lstrlenW (lpString=".db3") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".db3") returned 0x0 [0085.004] lstrlenW (lpString=".dtxs") returned 5 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".dtxs") returned 0x0 [0085.004] lstrlenW (lpString=".mdt") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".mdt") returned 0x0 [0085.004] lstrlenW (lpString=".sdf") returned 4 [0085.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".sdf") returned 0x0 [0085.004] lstrlenW (lpString=".MDF") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".MDF") returned 0x0 [0085.005] lstrlenW (lpString=".DBF") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".DBF") returned 0x0 [0085.005] lstrlenW (lpString=".DB") returned 3 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".DB") returned 0x0 [0085.005] lstrlenW (lpString=".db") returned 3 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".db") returned 0x0 [0085.005] lstrlenW (lpString=".ndf") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".ndf") returned 0x0 [0085.005] lstrlenW (lpString=".NDF") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".NDF") returned 0x0 [0085.005] lstrlenW (lpString=".Mdf") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".Mdf") returned 0x0 [0085.005] lstrlenW (lpString=".dat") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".dat") returned 0x0 [0085.005] lstrlenW (lpString=".DAT") returned 4 [0085.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".DAT") returned 0x0 [0085.005] lstrlenW (lpString=".ldf") returned 4 [0085.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".ldf") returned 0x0 [0085.006] lstrlenW (lpString=".LDF") returned 4 [0085.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch=".LDF") returned 0x0 [0085.006] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.006] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.007] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.007] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20500795320) returned 1 [0085.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc17bcff0, dwHighDateTime=0x1d585b4)) [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762df0 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762df0 | out: hHeap=0x260000) returned 1 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0085.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0085.008] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.008] GetLastError () returned 0x0 [0085.008] GetLastError () returned 0x0 [0085.008] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.008] GetLastError () returned 0x0 [0085.008] GetLastError () returned 0x0 [0085.010] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffdc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.010] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x240, lpOverlapped=0x0) returned 1 [0085.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0085.010] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.010] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.010] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.011] CloseHandle (hObject=0xe4) returned 1 [0085.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.[deadmin@cock.li].deadmin")) returned 1 [0085.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922440 | out: hHeap=0x260000) returned 1 [0085.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.012] GetLastError () returned 0x0 [0085.012] RtlWakeConditionVariable () returned 0x0 [0085.012] GetCurrentThreadId () returned 0x998 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".ldf") returned 0x0 [0085.013] lstrlenW (lpString=".vhd") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".vhd") returned 0x0 [0085.013] lstrlenW (lpString=".vhdx") returned 5 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".vhdx") returned 0x0 [0085.013] lstrlenW (lpString=".pst") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".pst") returned 0x0 [0085.013] lstrlenW (lpString=".ost") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".ost") returned 0x0 [0085.013] lstrlenW (lpString=".bak") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".bak") returned 0x0 [0085.013] lstrlenW (lpString=".bac") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".bac") returned 0x0 [0085.013] lstrlenW (lpString=".sys") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".sys") returned 0x0 [0085.013] lstrlenW (lpString=".v2i") returned 4 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".v2i") returned 0x0 [0085.013] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch="s\r\n.v2i") returned 0x0 [0085.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.015] lstrlenW (lpString=".sql") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".sql") returned 0x0 [0085.015] lstrlenW (lpString=".mdf") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".mdf") returned 0x0 [0085.015] lstrlenW (lpString=".txt") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".txt") returned 0x0 [0085.015] lstrlenW (lpString=".dbf") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".dbf") returned 0x0 [0085.015] lstrlenW (lpString=".ckp") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".ckp") returned 0x0 [0085.015] lstrlenW (lpString=".dacpac") returned 7 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".dacpac") returned 0x0 [0085.015] lstrlenW (lpString=".db3") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".db3") returned 0x0 [0085.015] lstrlenW (lpString=".dtxs") returned 5 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".dtxs") returned 0x0 [0085.015] lstrlenW (lpString=".mdt") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".mdt") returned 0x0 [0085.015] lstrlenW (lpString=".sdf") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".sdf") returned 0x0 [0085.015] lstrlenW (lpString=".MDF") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".MDF") returned 0x0 [0085.015] lstrlenW (lpString=".DBF") returned 4 [0085.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".DBF") returned 0x0 [0085.015] lstrlenW (lpString=".DB") returned 3 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".DB") returned 0x0 [0085.016] lstrlenW (lpString=".db") returned 3 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".db") returned 0x0 [0085.016] lstrlenW (lpString=".ndf") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".ndf") returned 0x0 [0085.016] lstrlenW (lpString=".NDF") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".NDF") returned 0x0 [0085.016] lstrlenW (lpString=".Mdf") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".Mdf") returned 0x0 [0085.016] lstrlenW (lpString=".dat") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".dat") returned 0x0 [0085.016] lstrlenW (lpString=".DAT") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".DAT") returned 0x0 [0085.016] lstrlenW (lpString=".ldf") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".ldf") returned 0x0 [0085.016] lstrlenW (lpString=".LDF") returned 4 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch=".LDF") returned 0x0 [0085.016] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.016] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.017] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.017] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.017] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20501846972) returned 1 [0085.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc17bcff0, dwHighDateTime=0x1d585b4)) [0085.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762c68 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762c68 | out: hHeap=0x260000) returned 1 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0085.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0085.018] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.018] GetLastError () returned 0x0 [0085.018] GetLastError () returned 0x0 [0085.019] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.019] GetLastError () returned 0x0 [0085.019] GetLastError () returned 0x0 [0085.266] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.266] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x38b, lpOverlapped=0x0) returned 1 [0085.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0085.266] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.266] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.267] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.267] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.267] CloseHandle (hObject=0xe4) returned 1 [0085.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0085.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.[deadmin@cock.li].deadmin")) returned 1 [0085.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0085.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.269] GetLastError () returned 0x0 [0085.269] RtlWakeConditionVariable () returned 0x0 [0085.270] GetCurrentThreadId () returned 0x998 [0085.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".ldf") returned 0x0 [0085.270] lstrlenW (lpString=".vhd") returned 4 [0085.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".vhd") returned 0x0 [0085.270] lstrlenW (lpString=".vhdx") returned 5 [0085.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".vhdx") returned 0x0 [0085.270] lstrlenW (lpString=".pst") returned 4 [0085.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".pst") returned 0x0 [0085.271] lstrlenW (lpString=".ost") returned 4 [0085.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".ost") returned 0x0 [0085.271] lstrlenW (lpString=".bak") returned 4 [0085.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".bak") returned 0x0 [0085.271] lstrlenW (lpString=".bac") returned 4 [0085.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".bac") returned 0x0 [0085.271] lstrlenW (lpString=".sys") returned 4 [0085.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".sys") returned 0x0 [0085.271] lstrlenW (lpString=".v2i") returned 4 [0085.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".v2i") returned 0x0 [0085.271] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch="s\r\n.v2i") returned 0x0 [0085.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.296] lstrlenW (lpString=".sql") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".sql") returned 0x0 [0085.296] lstrlenW (lpString=".mdf") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".mdf") returned 0x0 [0085.296] lstrlenW (lpString=".txt") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".txt") returned 0x0 [0085.296] lstrlenW (lpString=".dbf") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".dbf") returned 0x0 [0085.296] lstrlenW (lpString=".ckp") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".ckp") returned 0x0 [0085.296] lstrlenW (lpString=".dacpac") returned 7 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".dacpac") returned 0x0 [0085.296] lstrlenW (lpString=".db3") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".db3") returned 0x0 [0085.296] lstrlenW (lpString=".dtxs") returned 5 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".dtxs") returned 0x0 [0085.296] lstrlenW (lpString=".mdt") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".mdt") returned 0x0 [0085.296] lstrlenW (lpString=".sdf") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".sdf") returned 0x0 [0085.296] lstrlenW (lpString=".MDF") returned 4 [0085.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".MDF") returned 0x0 [0085.297] lstrlenW (lpString=".DBF") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".DBF") returned 0x0 [0085.297] lstrlenW (lpString=".DB") returned 3 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".DB") returned 0x0 [0085.297] lstrlenW (lpString=".db") returned 3 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".db") returned 0x0 [0085.297] lstrlenW (lpString=".ndf") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".ndf") returned 0x0 [0085.297] lstrlenW (lpString=".NDF") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".NDF") returned 0x0 [0085.297] lstrlenW (lpString=".Mdf") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".Mdf") returned 0x0 [0085.297] lstrlenW (lpString=".dat") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".dat") returned 0x0 [0085.297] lstrlenW (lpString=".DAT") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".DAT") returned 0x0 [0085.297] lstrlenW (lpString=".ldf") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".ldf") returned 0x0 [0085.297] lstrlenW (lpString=".LDF") returned 4 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch=".LDF") returned 0x0 [0085.297] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.297] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.298] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.298] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20529960379) returned 1 [0085.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1a6a8b0, dwHighDateTime=0x1d585b4)) [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762f08 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762f08 | out: hHeap=0x260000) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a640 [0085.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a640 | out: hHeap=0x260000) returned 1 [0085.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.299] GetLastError () returned 0x0 [0085.300] GetLastError () returned 0x0 [0085.300] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.300] GetLastError () returned 0x0 [0085.300] GetLastError () returned 0x0 [0085.302] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8cfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.302] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7302, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x7302, lpOverlapped=0x0) returned 1 [0085.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.302] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.302] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.302] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.302] CloseHandle (hObject=0x11c) returned 1 [0085.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d590 [0085.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d590 | out: hHeap=0x260000) returned 1 [0085.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.304] GetLastError () returned 0x0 [0085.305] RtlWakeConditionVariable () returned 0x0 [0085.305] GetCurrentThreadId () returned 0x998 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".ldf") returned 0x0 [0085.305] lstrlenW (lpString=".vhd") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".vhd") returned 0x0 [0085.305] lstrlenW (lpString=".vhdx") returned 5 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".vhdx") returned 0x0 [0085.305] lstrlenW (lpString=".pst") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".pst") returned 0x0 [0085.305] lstrlenW (lpString=".ost") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".ost") returned 0x0 [0085.305] lstrlenW (lpString=".bak") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".bak") returned 0x0 [0085.305] lstrlenW (lpString=".bac") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".bac") returned 0x0 [0085.305] lstrlenW (lpString=".sys") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".sys") returned 0x0 [0085.305] lstrlenW (lpString=".v2i") returned 4 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".v2i") returned 0x0 [0085.305] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.307] lstrlenW (lpString=".sql") returned 4 [0085.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".sql") returned 0x0 [0085.307] lstrlenW (lpString=".mdf") returned 4 [0085.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".mdf") returned 0x0 [0085.307] lstrlenW (lpString=".txt") returned 4 [0085.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".txt") returned 0x0 [0085.307] lstrlenW (lpString=".dbf") returned 4 [0085.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".dbf") returned 0x0 [0085.307] lstrlenW (lpString=".ckp") returned 4 [0085.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".ckp") returned 0x0 [0085.307] lstrlenW (lpString=".dacpac") returned 7 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".dacpac") returned 0x0 [0085.308] lstrlenW (lpString=".db3") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".db3") returned 0x0 [0085.308] lstrlenW (lpString=".dtxs") returned 5 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".dtxs") returned 0x0 [0085.308] lstrlenW (lpString=".mdt") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".mdt") returned 0x0 [0085.308] lstrlenW (lpString=".sdf") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".sdf") returned 0x0 [0085.308] lstrlenW (lpString=".MDF") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".MDF") returned 0x0 [0085.308] lstrlenW (lpString=".DBF") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".DBF") returned 0x0 [0085.308] lstrlenW (lpString=".DB") returned 3 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".DB") returned 0x0 [0085.308] lstrlenW (lpString=".db") returned 3 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".db") returned 0x0 [0085.308] lstrlenW (lpString=".ndf") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".ndf") returned 0x0 [0085.308] lstrlenW (lpString=".NDF") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".NDF") returned 0x0 [0085.308] lstrlenW (lpString=".Mdf") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".Mdf") returned 0x0 [0085.308] lstrlenW (lpString=".dat") returned 4 [0085.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".dat") returned 0x0 [0085.308] lstrlenW (lpString=".DAT") returned 4 [0085.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".DAT") returned 0x0 [0085.309] lstrlenW (lpString=".ldf") returned 4 [0085.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".ldf") returned 0x0 [0085.309] lstrlenW (lpString=".LDF") returned 4 [0085.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch=".LDF") returned 0x0 [0085.309] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.309] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.310] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.310] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20531100593) returned 1 [0085.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1a90a10, dwHighDateTime=0x1d585b4)) [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27633d8 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27633d8 | out: hHeap=0x260000) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0085.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0085.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.311] GetLastError () returned 0x0 [0085.311] GetLastError () returned 0x0 [0085.311] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.311] GetLastError () returned 0x0 [0085.311] GetLastError () returned 0x0 [0085.316] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff7b20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.316] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x84e0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x84e0, lpOverlapped=0x0) returned 1 [0085.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.317] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.317] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.317] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.317] CloseHandle (hObject=0x11c) returned 1 [0085.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.318] GetLastError () returned 0x0 [0085.319] RtlWakeConditionVariable () returned 0x27e828 [0085.319] GetCurrentThreadId () returned 0x998 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".ldf") returned 0x0 [0085.319] lstrlenW (lpString=".vhd") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".vhd") returned 0x0 [0085.319] lstrlenW (lpString=".vhdx") returned 5 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".vhdx") returned 0x0 [0085.319] lstrlenW (lpString=".pst") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".pst") returned 0x0 [0085.319] lstrlenW (lpString=".ost") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".ost") returned 0x0 [0085.319] lstrlenW (lpString=".bak") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".bak") returned 0x0 [0085.319] lstrlenW (lpString=".bac") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".bac") returned 0x0 [0085.319] lstrlenW (lpString=".sys") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".sys") returned 0x0 [0085.319] lstrlenW (lpString=".v2i") returned 4 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".v2i") returned 0x0 [0085.319] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.320] lstrlenW (lpString=".sql") returned 4 [0085.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".sql") returned 0x0 [0085.320] lstrlenW (lpString=".mdf") returned 4 [0085.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".mdf") returned 0x0 [0085.320] lstrlenW (lpString=".txt") returned 4 [0085.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".txt") returned 0x0 [0085.320] lstrlenW (lpString=".dbf") returned 4 [0085.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".dbf") returned 0x0 [0085.321] lstrlenW (lpString=".ckp") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".ckp") returned 0x0 [0085.321] lstrlenW (lpString=".dacpac") returned 7 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".dacpac") returned 0x0 [0085.321] lstrlenW (lpString=".db3") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".db3") returned 0x0 [0085.321] lstrlenW (lpString=".dtxs") returned 5 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".dtxs") returned 0x0 [0085.321] lstrlenW (lpString=".mdt") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".mdt") returned 0x0 [0085.321] lstrlenW (lpString=".sdf") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".sdf") returned 0x0 [0085.321] lstrlenW (lpString=".MDF") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".MDF") returned 0x0 [0085.321] lstrlenW (lpString=".DBF") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".DBF") returned 0x0 [0085.321] lstrlenW (lpString=".DB") returned 3 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".DB") returned 0x0 [0085.321] lstrlenW (lpString=".db") returned 3 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".db") returned 0x0 [0085.321] lstrlenW (lpString=".ndf") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".ndf") returned 0x0 [0085.321] lstrlenW (lpString=".NDF") returned 4 [0085.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".NDF") returned 0x0 [0085.321] lstrlenW (lpString=".Mdf") returned 4 [0085.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".Mdf") returned 0x0 [0085.322] lstrlenW (lpString=".dat") returned 4 [0085.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".dat") returned 0x0 [0085.322] lstrlenW (lpString=".DAT") returned 4 [0085.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".DAT") returned 0x0 [0085.322] lstrlenW (lpString=".ldf") returned 4 [0085.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".ldf") returned 0x0 [0085.322] lstrlenW (lpString=".LDF") returned 4 [0085.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch=".LDF") returned 0x0 [0085.322] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.322] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.323] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.323] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20532414855) returned 1 [0085.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1ab6b70, dwHighDateTime=0x1d585b4)) [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27633a0 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27633a0 | out: hHeap=0x260000) returned 1 [0085.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a838 [0085.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a838 | out: hHeap=0x260000) returned 1 [0085.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.324] GetLastError () returned 0x0 [0085.324] GetLastError () returned 0x0 [0085.324] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.324] GetLastError () returned 0x0 [0085.324] GetLastError () returned 0x0 [0085.373] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff1488, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.373] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xeb78, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xeb78, lpOverlapped=0x0) returned 1 [0085.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.374] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.374] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.374] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.374] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.374] CloseHandle (hObject=0x11c) returned 1 [0085.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.420] GetLastError () returned 0x0 [0085.420] RtlWakeConditionVariable () returned 0x0 [0085.420] GetCurrentThreadId () returned 0x998 [0085.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".ldf") returned 0x0 [0085.421] lstrlenW (lpString=".vhd") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".vhd") returned 0x0 [0085.421] lstrlenW (lpString=".vhdx") returned 5 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".vhdx") returned 0x0 [0085.421] lstrlenW (lpString=".pst") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".pst") returned 0x0 [0085.421] lstrlenW (lpString=".ost") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".ost") returned 0x0 [0085.421] lstrlenW (lpString=".bak") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".bak") returned 0x0 [0085.421] lstrlenW (lpString=".bac") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".bac") returned 0x0 [0085.421] lstrlenW (lpString=".sys") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".sys") returned 0x0 [0085.421] lstrlenW (lpString=".v2i") returned 4 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".v2i") returned 0x0 [0085.421] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.447] lstrlenW (lpString=".sql") returned 4 [0085.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".sql") returned 0x0 [0085.447] lstrlenW (lpString=".mdf") returned 4 [0085.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".mdf") returned 0x0 [0085.447] lstrlenW (lpString=".txt") returned 4 [0085.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".txt") returned 0x0 [0085.448] lstrlenW (lpString=".dbf") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".dbf") returned 0x0 [0085.448] lstrlenW (lpString=".ckp") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".ckp") returned 0x0 [0085.448] lstrlenW (lpString=".dacpac") returned 7 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".dacpac") returned 0x0 [0085.448] lstrlenW (lpString=".db3") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".db3") returned 0x0 [0085.448] lstrlenW (lpString=".dtxs") returned 5 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".dtxs") returned 0x0 [0085.448] lstrlenW (lpString=".mdt") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".mdt") returned 0x0 [0085.448] lstrlenW (lpString=".sdf") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".sdf") returned 0x0 [0085.448] lstrlenW (lpString=".MDF") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".MDF") returned 0x0 [0085.448] lstrlenW (lpString=".DBF") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".DBF") returned 0x0 [0085.448] lstrlenW (lpString=".DB") returned 3 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".DB") returned 0x0 [0085.448] lstrlenW (lpString=".db") returned 3 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".db") returned 0x0 [0085.448] lstrlenW (lpString=".ndf") returned 4 [0085.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".ndf") returned 0x0 [0085.448] lstrlenW (lpString=".NDF") returned 4 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".NDF") returned 0x0 [0085.449] lstrlenW (lpString=".Mdf") returned 4 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".Mdf") returned 0x0 [0085.449] lstrlenW (lpString=".dat") returned 4 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".dat") returned 0x0 [0085.449] lstrlenW (lpString=".DAT") returned 4 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".DAT") returned 0x0 [0085.449] lstrlenW (lpString=".ldf") returned 4 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".ldf") returned 0x0 [0085.449] lstrlenW (lpString=".LDF") returned 4 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch=".LDF") returned 0x0 [0085.449] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.449] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.450] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.450] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.450] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20545119971) returned 1 [0085.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1be7670, dwHighDateTime=0x1d585b4)) [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27631e0 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27631e0 | out: hHeap=0x260000) returned 1 [0085.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a8e0 [0085.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a8e0 | out: hHeap=0x260000) returned 1 [0085.451] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.451] GetLastError () returned 0x0 [0085.451] GetLastError () returned 0x0 [0085.451] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.451] GetLastError () returned 0x0 [0085.452] GetLastError () returned 0x0 [0085.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff4eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.454] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb14e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xb14e, lpOverlapped=0x0) returned 1 [0085.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.454] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.454] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.455] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.455] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.455] CloseHandle (hObject=0xf0) returned 1 [0085.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.456] GetLastError () returned 0x0 [0085.456] RtlWakeConditionVariable () returned 0x0 [0085.456] GetCurrentThreadId () returned 0x998 [0085.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".ldf") returned 0x0 [0085.456] lstrlenW (lpString=".vhd") returned 4 [0085.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".vhd") returned 0x0 [0085.456] lstrlenW (lpString=".vhdx") returned 5 [0085.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".vhdx") returned 0x0 [0085.456] lstrlenW (lpString=".pst") returned 4 [0085.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".pst") returned 0x0 [0085.456] lstrlenW (lpString=".ost") returned 4 [0085.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".ost") returned 0x0 [0085.457] lstrlenW (lpString=".bak") returned 4 [0085.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".bak") returned 0x0 [0085.457] lstrlenW (lpString=".bac") returned 4 [0085.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".bac") returned 0x0 [0085.457] lstrlenW (lpString=".sys") returned 4 [0085.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".sys") returned 0x0 [0085.457] lstrlenW (lpString=".v2i") returned 4 [0085.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".v2i") returned 0x0 [0085.457] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.459] lstrlenW (lpString=".sql") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".sql") returned 0x0 [0085.459] lstrlenW (lpString=".mdf") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".mdf") returned 0x0 [0085.459] lstrlenW (lpString=".txt") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".txt") returned 0x0 [0085.459] lstrlenW (lpString=".dbf") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".dbf") returned 0x0 [0085.459] lstrlenW (lpString=".ckp") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".ckp") returned 0x0 [0085.459] lstrlenW (lpString=".dacpac") returned 7 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".dacpac") returned 0x0 [0085.459] lstrlenW (lpString=".db3") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".db3") returned 0x0 [0085.459] lstrlenW (lpString=".dtxs") returned 5 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".dtxs") returned 0x0 [0085.459] lstrlenW (lpString=".mdt") returned 4 [0085.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".mdt") returned 0x0 [0085.460] lstrlenW (lpString=".sdf") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".sdf") returned 0x0 [0085.460] lstrlenW (lpString=".MDF") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".MDF") returned 0x0 [0085.460] lstrlenW (lpString=".DBF") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".DBF") returned 0x0 [0085.460] lstrlenW (lpString=".DB") returned 3 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".DB") returned 0x0 [0085.460] lstrlenW (lpString=".db") returned 3 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".db") returned 0x0 [0085.460] lstrlenW (lpString=".ndf") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".ndf") returned 0x0 [0085.460] lstrlenW (lpString=".NDF") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".NDF") returned 0x0 [0085.460] lstrlenW (lpString=".Mdf") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".Mdf") returned 0x0 [0085.460] lstrlenW (lpString=".dat") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".dat") returned 0x0 [0085.460] lstrlenW (lpString=".DAT") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".DAT") returned 0x0 [0085.460] lstrlenW (lpString=".ldf") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".ldf") returned 0x0 [0085.460] lstrlenW (lpString=".LDF") returned 4 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch=".LDF") returned 0x0 [0085.460] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.461] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.461] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.461] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.462] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20546274959) returned 1 [0085.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1c0d7d0, dwHighDateTime=0x1d585b4)) [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27631a8 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27631a8 | out: hHeap=0x260000) returned 1 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33aec8 [0085.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33aec8 | out: hHeap=0x260000) returned 1 [0085.462] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.463] GetLastError () returned 0x0 [0085.463] GetLastError () returned 0x0 [0085.463] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.463] GetLastError () returned 0x0 [0085.463] GetLastError () returned 0x0 [0085.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff9444, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.465] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6bbc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6bbc, lpOverlapped=0x0) returned 1 [0085.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.466] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.466] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.466] CloseHandle (hObject=0xf0) returned 1 [0085.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.467] GetLastError () returned 0x0 [0085.467] RtlWakeConditionVariable () returned 0x27e828 [0085.467] GetCurrentThreadId () returned 0x998 [0085.468] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.468] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.468] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.468] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.470] CloseHandle (hObject=0xf0) returned 1 [0085.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d690 | out: hHeap=0x260000) returned 1 [0085.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0085.470] RtlWakeConditionVariable () returned 0x27e828 [0085.470] GetCurrentThreadId () returned 0x998 [0085.470] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.470] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.470] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.470] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.472] CloseHandle (hObject=0xf0) returned 1 [0085.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27784b8 | out: hHeap=0x260000) returned 1 [0085.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0085.472] RtlWakeConditionVariable () returned 0x27e828 [0085.472] GetCurrentThreadId () returned 0x998 [0085.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.472] lstrlenW (lpString=".vhd") returned 4 [0085.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.472] lstrlenW (lpString=".vhdx") returned 5 [0085.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.473] lstrlenW (lpString=".pst") returned 4 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.473] lstrlenW (lpString=".ost") returned 4 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.473] lstrlenW (lpString=".bak") returned 4 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.473] lstrlenW (lpString=".bac") returned 4 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.473] lstrlenW (lpString=".sys") returned 4 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.473] lstrlenW (lpString=".v2i") returned 4 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.473] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.475] lstrlenW (lpString=".sql") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.475] lstrlenW (lpString=".mdf") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.475] lstrlenW (lpString=".txt") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.475] lstrlenW (lpString=".dbf") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.475] lstrlenW (lpString=".ckp") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.475] lstrlenW (lpString=".dacpac") returned 7 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.475] lstrlenW (lpString=".db3") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.475] lstrlenW (lpString=".dtxs") returned 5 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.475] lstrlenW (lpString=".mdt") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.475] lstrlenW (lpString=".sdf") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.475] lstrlenW (lpString=".MDF") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.475] lstrlenW (lpString=".DBF") returned 4 [0085.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.476] lstrlenW (lpString=".DB") returned 3 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.476] lstrlenW (lpString=".db") returned 3 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".db") returned 0x0 [0085.476] lstrlenW (lpString=".ndf") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.476] lstrlenW (lpString=".NDF") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.476] lstrlenW (lpString=".Mdf") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.476] lstrlenW (lpString=".dat") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.476] lstrlenW (lpString=".DAT") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.476] lstrlenW (lpString=".ldf") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.476] lstrlenW (lpString=".LDF") returned 4 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.476] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.476] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.477] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.477] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20547849068) returned 1 [0085.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1c33930, dwHighDateTime=0x1d585b4)) [0085.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27639f8 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27639f8 | out: hHeap=0x260000) returned 1 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a640 [0085.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a640 | out: hHeap=0x260000) returned 1 [0085.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.478] GetLastError () returned 0x0 [0085.478] GetLastError () returned 0x0 [0085.479] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.479] GetLastError () returned 0x0 [0085.479] GetLastError () returned 0x0 [0085.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeb37, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.545] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x14c9, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x14c9, lpOverlapped=0x0) returned 1 [0085.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.551] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.551] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.551] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.551] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.551] CloseHandle (hObject=0xf0) returned 1 [0085.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.552] GetLastError () returned 0x0 [0085.552] RtlWakeConditionVariable () returned 0x0 [0085.553] GetCurrentThreadId () returned 0x998 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.553] lstrlenW (lpString=".vhd") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.553] lstrlenW (lpString=".vhdx") returned 5 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.553] lstrlenW (lpString=".pst") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.553] lstrlenW (lpString=".ost") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.553] lstrlenW (lpString=".bak") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.553] lstrlenW (lpString=".bac") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.553] lstrlenW (lpString=".sys") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.553] lstrlenW (lpString=".v2i") returned 4 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.553] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.554] lstrlenW (lpString=".sql") returned 4 [0085.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.554] lstrlenW (lpString=".mdf") returned 4 [0085.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.554] lstrlenW (lpString=".txt") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.555] lstrlenW (lpString=".dbf") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.555] lstrlenW (lpString=".ckp") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.555] lstrlenW (lpString=".dacpac") returned 7 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.555] lstrlenW (lpString=".db3") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.555] lstrlenW (lpString=".dtxs") returned 5 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.555] lstrlenW (lpString=".mdt") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.555] lstrlenW (lpString=".sdf") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.555] lstrlenW (lpString=".MDF") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.555] lstrlenW (lpString=".DBF") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.555] lstrlenW (lpString=".DB") returned 3 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.555] lstrlenW (lpString=".db") returned 3 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.555] lstrlenW (lpString=".ndf") returned 4 [0085.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.555] lstrlenW (lpString=".NDF") returned 4 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.556] lstrlenW (lpString=".Mdf") returned 4 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.556] lstrlenW (lpString=".dat") returned 4 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.556] lstrlenW (lpString=".DAT") returned 4 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.556] lstrlenW (lpString=".ldf") returned 4 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.556] lstrlenW (lpString=".LDF") returned 4 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.556] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.556] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.557] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.557] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20555821998) returned 1 [0085.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1cf2010, dwHighDateTime=0x1d585b4)) [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763870 [0085.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763870 | out: hHeap=0x260000) returned 1 [0085.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.558] GetLastError () returned 0x0 [0085.558] GetLastError () returned 0x0 [0085.558] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.558] GetLastError () returned 0x0 [0085.559] GetLastError () returned 0x0 [0085.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.571] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x708, lpOverlapped=0x0) returned 1 [0085.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.571] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.571] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.571] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.571] CloseHandle (hObject=0xf0) returned 1 [0085.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.573] GetLastError () returned 0x0 [0085.573] RtlWakeConditionVariable () returned 0x0 [0085.573] GetCurrentThreadId () returned 0x998 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.573] lstrlenW (lpString=".vhd") returned 4 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.573] lstrlenW (lpString=".vhdx") returned 5 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.573] lstrlenW (lpString=".pst") returned 4 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.573] lstrlenW (lpString=".ost") returned 4 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.573] lstrlenW (lpString=".bak") returned 4 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.573] lstrlenW (lpString=".bac") returned 4 [0085.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.573] lstrlenW (lpString=".sys") returned 4 [0085.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.574] lstrlenW (lpString=".v2i") returned 4 [0085.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.574] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.575] lstrlenW (lpString=".sql") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.575] lstrlenW (lpString=".mdf") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.575] lstrlenW (lpString=".txt") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.575] lstrlenW (lpString=".dbf") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.575] lstrlenW (lpString=".ckp") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.575] lstrlenW (lpString=".dacpac") returned 7 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.575] lstrlenW (lpString=".db3") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.575] lstrlenW (lpString=".dtxs") returned 5 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.575] lstrlenW (lpString=".mdt") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.575] lstrlenW (lpString=".sdf") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.575] lstrlenW (lpString=".MDF") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.575] lstrlenW (lpString=".DBF") returned 4 [0085.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.576] lstrlenW (lpString=".DB") returned 3 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.576] lstrlenW (lpString=".db") returned 3 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.576] lstrlenW (lpString=".ndf") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.576] lstrlenW (lpString=".NDF") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.576] lstrlenW (lpString=".Mdf") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.576] lstrlenW (lpString=".dat") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.576] lstrlenW (lpString=".DAT") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.576] lstrlenW (lpString=".ldf") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.576] lstrlenW (lpString=".LDF") returned 4 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.576] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.576] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.577] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.577] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20557855710) returned 1 [0085.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1d18170, dwHighDateTime=0x1d585b4)) [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763800 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763800 | out: hHeap=0x260000) returned 1 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.578] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.578] GetLastError () returned 0x0 [0085.579] GetLastError () returned 0x0 [0085.579] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.579] GetLastError () returned 0x0 [0085.579] GetLastError () returned 0x0 [0085.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.591] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x708, lpOverlapped=0x0) returned 1 [0085.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.591] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.591] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.591] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.591] CloseHandle (hObject=0xf0) returned 1 [0085.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.593] GetLastError () returned 0x0 [0085.593] RtlWakeConditionVariable () returned 0x0 [0085.593] GetCurrentThreadId () returned 0x998 [0085.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.594] lstrlenW (lpString=".vhd") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.594] lstrlenW (lpString=".vhdx") returned 5 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.594] lstrlenW (lpString=".pst") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.594] lstrlenW (lpString=".ost") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.594] lstrlenW (lpString=".bak") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.594] lstrlenW (lpString=".bac") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.594] lstrlenW (lpString=".sys") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.594] lstrlenW (lpString=".v2i") returned 4 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.594] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.595] lstrlenW (lpString=".sql") returned 4 [0085.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.596] lstrlenW (lpString=".mdf") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.596] lstrlenW (lpString=".txt") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.596] lstrlenW (lpString=".dbf") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.596] lstrlenW (lpString=".ckp") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.596] lstrlenW (lpString=".dacpac") returned 7 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.596] lstrlenW (lpString=".db3") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.596] lstrlenW (lpString=".dtxs") returned 5 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.596] lstrlenW (lpString=".mdt") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.596] lstrlenW (lpString=".sdf") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.596] lstrlenW (lpString=".MDF") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.596] lstrlenW (lpString=".DBF") returned 4 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.596] lstrlenW (lpString=".DB") returned 3 [0085.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.596] lstrlenW (lpString=".db") returned 3 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.597] lstrlenW (lpString=".ndf") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.597] lstrlenW (lpString=".NDF") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.597] lstrlenW (lpString=".Mdf") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.597] lstrlenW (lpString=".dat") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.597] lstrlenW (lpString=".DAT") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.597] lstrlenW (lpString=".ldf") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.597] lstrlenW (lpString=".LDF") returned 4 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.597] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.597] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.598] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.598] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20559958182) returned 1 [0085.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1d64430, dwHighDateTime=0x1d585b4)) [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763758 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763758 | out: hHeap=0x260000) returned 1 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.599] GetLastError () returned 0x0 [0085.600] GetLastError () returned 0x0 [0085.600] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.600] GetLastError () returned 0x0 [0085.600] GetLastError () returned 0x0 [0085.606] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.606] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x638, lpOverlapped=0x0) returned 1 [0085.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.608] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.608] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.609] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.609] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.609] CloseHandle (hObject=0xf0) returned 1 [0085.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0085.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0085.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.611] GetLastError () returned 0x0 [0085.611] RtlWakeConditionVariable () returned 0x0 [0085.611] GetCurrentThreadId () returned 0x998 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".ldf") returned 0x0 [0085.611] lstrlenW (lpString=".vhd") returned 4 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".vhd") returned 0x0 [0085.611] lstrlenW (lpString=".vhdx") returned 5 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.611] lstrlenW (lpString=".pst") returned 4 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".pst") returned 0x0 [0085.611] lstrlenW (lpString=".ost") returned 4 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".ost") returned 0x0 [0085.611] lstrlenW (lpString=".bak") returned 4 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".bak") returned 0x0 [0085.611] lstrlenW (lpString=".bac") returned 4 [0085.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".bac") returned 0x0 [0085.611] lstrlenW (lpString=".sys") returned 4 [0085.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".sys") returned 0x0 [0085.612] lstrlenW (lpString=".v2i") returned 4 [0085.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".v2i") returned 0x0 [0085.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.613] lstrlenW (lpString=".sql") returned 4 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".sql") returned 0x0 [0085.613] lstrlenW (lpString=".mdf") returned 4 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".mdf") returned 0x0 [0085.613] lstrlenW (lpString=".txt") returned 4 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".txt") returned 0x0 [0085.613] lstrlenW (lpString=".dbf") returned 4 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".dbf") returned 0x0 [0085.613] lstrlenW (lpString=".ckp") returned 4 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".ckp") returned 0x0 [0085.613] lstrlenW (lpString=".dacpac") returned 7 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.613] lstrlenW (lpString=".db3") returned 4 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".db3") returned 0x0 [0085.613] lstrlenW (lpString=".dtxs") returned 5 [0085.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.614] lstrlenW (lpString=".mdt") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".mdt") returned 0x0 [0085.614] lstrlenW (lpString=".sdf") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".sdf") returned 0x0 [0085.614] lstrlenW (lpString=".MDF") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".MDF") returned 0x0 [0085.614] lstrlenW (lpString=".DBF") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".DBF") returned 0x0 [0085.614] lstrlenW (lpString=".DB") returned 3 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".DB") returned 0x0 [0085.614] lstrlenW (lpString=".db") returned 3 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".db") returned 0x0 [0085.614] lstrlenW (lpString=".ndf") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".ndf") returned 0x0 [0085.614] lstrlenW (lpString=".NDF") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".NDF") returned 0x0 [0085.614] lstrlenW (lpString=".Mdf") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.614] lstrlenW (lpString=".dat") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".dat") returned 0x0 [0085.614] lstrlenW (lpString=".DAT") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".DAT") returned 0x0 [0085.614] lstrlenW (lpString=".ldf") returned 4 [0085.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".ldf") returned 0x0 [0085.614] lstrlenW (lpString=".LDF") returned 4 [0085.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch=".LDF") returned 0x0 [0085.615] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.615] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.616] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.616] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20561688800) returned 1 [0085.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1d8a590, dwHighDateTime=0x1d585b4)) [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763720 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763720 | out: hHeap=0x260000) returned 1 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.616] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.617] GetLastError () returned 0x0 [0085.617] GetLastError () returned 0x0 [0085.617] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.617] GetLastError () returned 0x0 [0085.617] GetLastError () returned 0x0 [0085.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc9e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.621] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3618, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3618, lpOverlapped=0x0) returned 1 [0085.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.621] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.622] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.622] CloseHandle (hObject=0xf0) returned 1 [0085.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.623] GetLastError () returned 0x0 [0085.623] RtlWakeConditionVariable () returned 0x27e828 [0085.623] GetCurrentThreadId () returned 0x998 [0085.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".ldf") returned 0x0 [0085.623] lstrlenW (lpString=".vhd") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".vhd") returned 0x0 [0085.624] lstrlenW (lpString=".vhdx") returned 5 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".vhdx") returned 0x0 [0085.624] lstrlenW (lpString=".pst") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".pst") returned 0x0 [0085.624] lstrlenW (lpString=".ost") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".ost") returned 0x0 [0085.624] lstrlenW (lpString=".bak") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".bak") returned 0x0 [0085.624] lstrlenW (lpString=".bac") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".bac") returned 0x0 [0085.624] lstrlenW (lpString=".sys") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".sys") returned 0x0 [0085.624] lstrlenW (lpString=".v2i") returned 4 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".v2i") returned 0x0 [0085.624] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0085.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.626] lstrlenW (lpString=".sql") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".sql") returned 0x0 [0085.626] lstrlenW (lpString=".mdf") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".mdf") returned 0x0 [0085.626] lstrlenW (lpString=".txt") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".txt") returned 0x0 [0085.626] lstrlenW (lpString=".dbf") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".dbf") returned 0x0 [0085.626] lstrlenW (lpString=".ckp") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".ckp") returned 0x0 [0085.626] lstrlenW (lpString=".dacpac") returned 7 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".dacpac") returned 0x0 [0085.626] lstrlenW (lpString=".db3") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".db3") returned 0x0 [0085.626] lstrlenW (lpString=".dtxs") returned 5 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".dtxs") returned 0x0 [0085.626] lstrlenW (lpString=".mdt") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".mdt") returned 0x0 [0085.626] lstrlenW (lpString=".sdf") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".sdf") returned 0x0 [0085.626] lstrlenW (lpString=".MDF") returned 4 [0085.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".MDF") returned 0x0 [0085.626] lstrlenW (lpString=".DBF") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".DBF") returned 0x0 [0085.627] lstrlenW (lpString=".DB") returned 3 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".DB") returned 0x0 [0085.627] lstrlenW (lpString=".db") returned 3 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".db") returned 0x0 [0085.627] lstrlenW (lpString=".ndf") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".ndf") returned 0x0 [0085.627] lstrlenW (lpString=".NDF") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".NDF") returned 0x0 [0085.627] lstrlenW (lpString=".Mdf") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".Mdf") returned 0x0 [0085.627] lstrlenW (lpString=".dat") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".dat") returned 0x0 [0085.627] lstrlenW (lpString=".DAT") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".DAT") returned 0x0 [0085.627] lstrlenW (lpString=".ldf") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".ldf") returned 0x0 [0085.627] lstrlenW (lpString=".LDF") returned 4 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch=".LDF") returned 0x0 [0085.627] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.627] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.628] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.628] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.629] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20562979939) returned 1 [0085.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1db06f0, dwHighDateTime=0x1d585b4)) [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763640 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763640 | out: hHeap=0x260000) returned 1 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0085.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.629] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.630] GetLastError () returned 0x0 [0085.630] GetLastError () returned 0x0 [0085.630] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.630] GetLastError () returned 0x0 [0085.630] GetLastError () returned 0x0 [0085.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe2d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.632] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1d29, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1d29, lpOverlapped=0x0) returned 1 [0085.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.632] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.632] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.632] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.632] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.632] CloseHandle (hObject=0xf0) returned 1 [0085.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.634] GetLastError () returned 0x0 [0085.634] RtlWakeConditionVariable () returned 0x27e828 [0085.634] GetCurrentThreadId () returned 0x998 [0085.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".ldf") returned 0x0 [0085.634] lstrlenW (lpString=".vhd") returned 4 [0085.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".vhd") returned 0x0 [0085.634] lstrlenW (lpString=".vhdx") returned 5 [0085.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".vhdx") returned 0x0 [0085.634] lstrlenW (lpString=".pst") returned 4 [0085.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".pst") returned 0x0 [0085.635] lstrlenW (lpString=".ost") returned 4 [0085.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".ost") returned 0x0 [0085.635] lstrlenW (lpString=".bak") returned 4 [0085.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".bak") returned 0x0 [0085.635] lstrlenW (lpString=".bac") returned 4 [0085.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".bac") returned 0x0 [0085.635] lstrlenW (lpString=".sys") returned 4 [0085.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".sys") returned 0x0 [0085.635] lstrlenW (lpString=".v2i") returned 4 [0085.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".v2i") returned 0x0 [0085.635] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch="s\r\n.v2i") returned 0x0 [0085.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.636] lstrlenW (lpString=".sql") returned 4 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".sql") returned 0x0 [0085.636] lstrlenW (lpString=".mdf") returned 4 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".mdf") returned 0x0 [0085.636] lstrlenW (lpString=".txt") returned 4 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".txt") returned 0x0 [0085.636] lstrlenW (lpString=".dbf") returned 4 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".dbf") returned 0x0 [0085.636] lstrlenW (lpString=".ckp") returned 4 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".ckp") returned 0x0 [0085.636] lstrlenW (lpString=".dacpac") returned 7 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".dacpac") returned 0x0 [0085.636] lstrlenW (lpString=".db3") returned 4 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".db3") returned 0x0 [0085.636] lstrlenW (lpString=".dtxs") returned 5 [0085.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".dtxs") returned 0x0 [0085.637] lstrlenW (lpString=".mdt") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".mdt") returned 0x0 [0085.637] lstrlenW (lpString=".sdf") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".sdf") returned 0x0 [0085.637] lstrlenW (lpString=".MDF") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".MDF") returned 0x0 [0085.637] lstrlenW (lpString=".DBF") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".DBF") returned 0x0 [0085.637] lstrlenW (lpString=".DB") returned 3 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".DB") returned 0x0 [0085.637] lstrlenW (lpString=".db") returned 3 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".db") returned 0x0 [0085.637] lstrlenW (lpString=".ndf") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".ndf") returned 0x0 [0085.637] lstrlenW (lpString=".NDF") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".NDF") returned 0x0 [0085.637] lstrlenW (lpString=".Mdf") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".Mdf") returned 0x0 [0085.637] lstrlenW (lpString=".dat") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".dat") returned 0x0 [0085.637] lstrlenW (lpString=".DAT") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".DAT") returned 0x0 [0085.637] lstrlenW (lpString=".ldf") returned 4 [0085.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".ldf") returned 0x0 [0085.638] lstrlenW (lpString=".LDF") returned 4 [0085.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch=".LDF") returned 0x0 [0085.638] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.638] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.639] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.639] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.639] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20563992207) returned 1 [0085.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1db06f0, dwHighDateTime=0x1d585b4)) [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27636e8 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27636e8 | out: hHeap=0x260000) returned 1 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.639] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.640] GetLastError () returned 0x0 [0085.640] GetLastError () returned 0x0 [0085.640] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.640] GetLastError () returned 0x0 [0085.640] GetLastError () returned 0x0 [0085.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff3c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.643] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xc38, lpOverlapped=0x0) returned 1 [0085.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.643] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.643] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.643] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.644] CloseHandle (hObject=0xf0) returned 1 [0085.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.739] GetLastError () returned 0x0 [0085.739] RtlWakeConditionVariable () returned 0x0 [0085.739] GetCurrentThreadId () returned 0x998 [0085.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.739] lstrlenW (lpString=".vhd") returned 4 [0085.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.739] lstrlenW (lpString=".vhdx") returned 5 [0085.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.739] lstrlenW (lpString=".pst") returned 4 [0085.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.739] lstrlenW (lpString=".ost") returned 4 [0085.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.739] lstrlenW (lpString=".bak") returned 4 [0085.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.740] lstrlenW (lpString=".bac") returned 4 [0085.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.740] lstrlenW (lpString=".sys") returned 4 [0085.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.740] lstrlenW (lpString=".v2i") returned 4 [0085.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.740] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.757] lstrlenW (lpString=".sql") returned 4 [0085.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.757] lstrlenW (lpString=".mdf") returned 4 [0085.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.757] lstrlenW (lpString=".txt") returned 4 [0085.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.757] lstrlenW (lpString=".dbf") returned 4 [0085.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.757] lstrlenW (lpString=".ckp") returned 4 [0085.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.757] lstrlenW (lpString=".dacpac") returned 7 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.758] lstrlenW (lpString=".db3") returned 4 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.758] lstrlenW (lpString=".dtxs") returned 5 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.758] lstrlenW (lpString=".mdt") returned 4 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.758] lstrlenW (lpString=".sdf") returned 4 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.758] lstrlenW (lpString=".MDF") returned 4 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.758] lstrlenW (lpString=".DBF") returned 4 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.758] lstrlenW (lpString=".DB") returned 3 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.758] lstrlenW (lpString=".db") returned 3 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.758] lstrlenW (lpString=".ndf") returned 4 [0085.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.758] lstrlenW (lpString=".NDF") returned 4 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.759] lstrlenW (lpString=".Mdf") returned 4 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.759] lstrlenW (lpString=".dat") returned 4 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.759] lstrlenW (lpString=".DAT") returned 4 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.759] lstrlenW (lpString=".ldf") returned 4 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.759] lstrlenW (lpString=".LDF") returned 4 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.759] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.759] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.760] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.761] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20576175265) returned 1 [0085.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1ee11f0, dwHighDateTime=0x1d585b4)) [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763528 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763528 | out: hHeap=0x260000) returned 1 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.762] GetLastError () returned 0x0 [0085.762] GetLastError () returned 0x0 [0085.762] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.762] GetLastError () returned 0x0 [0085.763] GetLastError () returned 0x0 [0085.774] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.775] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x838, lpOverlapped=0x0) returned 1 [0085.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.775] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.775] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.775] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.775] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.775] CloseHandle (hObject=0x11c) returned 1 [0085.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0085.776] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0085.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.777] GetLastError () returned 0x0 [0085.778] RtlWakeConditionVariable () returned 0x27e828 [0085.778] GetCurrentThreadId () returned 0x998 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.778] lstrlenW (lpString=".vhd") returned 4 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.778] lstrlenW (lpString=".vhdx") returned 5 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.778] lstrlenW (lpString=".pst") returned 4 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.778] lstrlenW (lpString=".ost") returned 4 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.778] lstrlenW (lpString=".bak") returned 4 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.778] lstrlenW (lpString=".bac") returned 4 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.778] lstrlenW (lpString=".sys") returned 4 [0085.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.779] lstrlenW (lpString=".v2i") returned 4 [0085.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.779] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.780] lstrlenW (lpString=".sql") returned 4 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.780] lstrlenW (lpString=".mdf") returned 4 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.780] lstrlenW (lpString=".txt") returned 4 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.780] lstrlenW (lpString=".dbf") returned 4 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.780] lstrlenW (lpString=".ckp") returned 4 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.780] lstrlenW (lpString=".dacpac") returned 7 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.780] lstrlenW (lpString=".db3") returned 4 [0085.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.780] lstrlenW (lpString=".dtxs") returned 5 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.781] lstrlenW (lpString=".mdt") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.781] lstrlenW (lpString=".sdf") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.781] lstrlenW (lpString=".MDF") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.781] lstrlenW (lpString=".DBF") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.781] lstrlenW (lpString=".DB") returned 3 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.781] lstrlenW (lpString=".db") returned 3 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.781] lstrlenW (lpString=".ndf") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.781] lstrlenW (lpString=".NDF") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.781] lstrlenW (lpString=".Mdf") returned 4 [0085.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.781] lstrlenW (lpString=".dat") returned 4 [0085.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.782] lstrlenW (lpString=".DAT") returned 4 [0085.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.782] lstrlenW (lpString=".ldf") returned 4 [0085.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.782] lstrlenW (lpString=".LDF") returned 4 [0085.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.782] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.782] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.783] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.783] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.783] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20578452040) returned 1 [0085.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1f07350, dwHighDateTime=0x1d585b4)) [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763100 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763100 | out: hHeap=0x260000) returned 1 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.784] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.784] GetLastError () returned 0x0 [0085.785] GetLastError () returned 0x0 [0085.785] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.785] GetLastError () returned 0x0 [0085.785] GetLastError () returned 0x0 [0085.787] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffec0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.787] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x140, lpOverlapped=0x0) returned 1 [0085.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.787] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.787] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.787] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.787] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.788] CloseHandle (hObject=0x11c) returned 1 [0085.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0085.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0085.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.789] GetLastError () returned 0x0 [0085.790] RtlWakeConditionVariable () returned 0x27e828 [0085.790] GetCurrentThreadId () returned 0x998 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".ldf") returned 0x0 [0085.790] lstrlenW (lpString=".vhd") returned 4 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".vhd") returned 0x0 [0085.790] lstrlenW (lpString=".vhdx") returned 5 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".vhdx") returned 0x0 [0085.790] lstrlenW (lpString=".pst") returned 4 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".pst") returned 0x0 [0085.790] lstrlenW (lpString=".ost") returned 4 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".ost") returned 0x0 [0085.790] lstrlenW (lpString=".bak") returned 4 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".bak") returned 0x0 [0085.790] lstrlenW (lpString=".bac") returned 4 [0085.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".bac") returned 0x0 [0085.790] lstrlenW (lpString=".sys") returned 4 [0085.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".sys") returned 0x0 [0085.791] lstrlenW (lpString=".v2i") returned 4 [0085.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".v2i") returned 0x0 [0085.791] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.793] lstrlenW (lpString=".sql") returned 4 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".sql") returned 0x0 [0085.793] lstrlenW (lpString=".mdf") returned 4 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".mdf") returned 0x0 [0085.793] lstrlenW (lpString=".txt") returned 4 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".txt") returned 0x0 [0085.793] lstrlenW (lpString=".dbf") returned 4 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".dbf") returned 0x0 [0085.793] lstrlenW (lpString=".ckp") returned 4 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".ckp") returned 0x0 [0085.793] lstrlenW (lpString=".dacpac") returned 7 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".dacpac") returned 0x0 [0085.793] lstrlenW (lpString=".db3") returned 4 [0085.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".db3") returned 0x0 [0085.794] lstrlenW (lpString=".dtxs") returned 5 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".dtxs") returned 0x0 [0085.794] lstrlenW (lpString=".mdt") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".mdt") returned 0x0 [0085.794] lstrlenW (lpString=".sdf") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".sdf") returned 0x0 [0085.794] lstrlenW (lpString=".MDF") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".MDF") returned 0x0 [0085.794] lstrlenW (lpString=".DBF") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".DBF") returned 0x0 [0085.794] lstrlenW (lpString=".DB") returned 3 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".DB") returned 0x0 [0085.794] lstrlenW (lpString=".db") returned 3 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".db") returned 0x0 [0085.794] lstrlenW (lpString=".ndf") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".ndf") returned 0x0 [0085.794] lstrlenW (lpString=".NDF") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".NDF") returned 0x0 [0085.794] lstrlenW (lpString=".Mdf") returned 4 [0085.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".Mdf") returned 0x0 [0085.795] lstrlenW (lpString=".dat") returned 4 [0085.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".dat") returned 0x0 [0085.795] lstrlenW (lpString=".DAT") returned 4 [0085.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".DAT") returned 0x0 [0085.795] lstrlenW (lpString=".ldf") returned 4 [0085.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".ldf") returned 0x0 [0085.795] lstrlenW (lpString=".LDF") returned 4 [0085.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch=".LDF") returned 0x0 [0085.795] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.795] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.796] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.796] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20579754186) returned 1 [0085.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc1f2d4b0, dwHighDateTime=0x1d585b4)) [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27630c8 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27630c8 | out: hHeap=0x260000) returned 1 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.797] GetLastError () returned 0x0 [0085.798] GetLastError () returned 0x0 [0085.798] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.798] GetLastError () returned 0x0 [0085.798] GetLastError () returned 0x0 [0085.821] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc103, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.821] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3efd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3efd, lpOverlapped=0x0) returned 1 [0085.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.822] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.822] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.822] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.822] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.822] CloseHandle (hObject=0x11c) returned 1 [0085.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d590 [0085.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d590 | out: hHeap=0x260000) returned 1 [0085.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.891] GetLastError () returned 0x0 [0085.891] RtlWakeConditionVariable () returned 0x0 [0085.891] GetCurrentThreadId () returned 0x998 [0085.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".ldf") returned 0x0 [0085.891] lstrlenW (lpString=".vhd") returned 4 [0085.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".vhd") returned 0x0 [0085.891] lstrlenW (lpString=".vhdx") returned 5 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.892] lstrlenW (lpString=".pst") returned 4 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".pst") returned 0x0 [0085.892] lstrlenW (lpString=".ost") returned 4 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".ost") returned 0x0 [0085.892] lstrlenW (lpString=".bak") returned 4 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".bak") returned 0x0 [0085.892] lstrlenW (lpString=".bac") returned 4 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".bac") returned 0x0 [0085.892] lstrlenW (lpString=".sys") returned 4 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".sys") returned 0x0 [0085.892] lstrlenW (lpString=".v2i") returned 4 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".v2i") returned 0x0 [0085.892] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.907] lstrlenW (lpString=".sql") returned 4 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".sql") returned 0x0 [0085.907] lstrlenW (lpString=".mdf") returned 4 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".mdf") returned 0x0 [0085.907] lstrlenW (lpString=".txt") returned 4 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".txt") returned 0x0 [0085.907] lstrlenW (lpString=".dbf") returned 4 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".dbf") returned 0x0 [0085.907] lstrlenW (lpString=".ckp") returned 4 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".ckp") returned 0x0 [0085.907] lstrlenW (lpString=".dacpac") returned 7 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.907] lstrlenW (lpString=".db3") returned 4 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".db3") returned 0x0 [0085.907] lstrlenW (lpString=".dtxs") returned 5 [0085.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.907] lstrlenW (lpString=".mdt") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".mdt") returned 0x0 [0085.908] lstrlenW (lpString=".sdf") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".sdf") returned 0x0 [0085.908] lstrlenW (lpString=".MDF") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".MDF") returned 0x0 [0085.908] lstrlenW (lpString=".DBF") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".DBF") returned 0x0 [0085.908] lstrlenW (lpString=".DB") returned 3 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".DB") returned 0x0 [0085.908] lstrlenW (lpString=".db") returned 3 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".db") returned 0x0 [0085.908] lstrlenW (lpString=".ndf") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".ndf") returned 0x0 [0085.908] lstrlenW (lpString=".NDF") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".NDF") returned 0x0 [0085.908] lstrlenW (lpString=".Mdf") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.908] lstrlenW (lpString=".dat") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".dat") returned 0x0 [0085.908] lstrlenW (lpString=".DAT") returned 4 [0085.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".DAT") returned 0x0 [0085.909] lstrlenW (lpString=".ldf") returned 4 [0085.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".ldf") returned 0x0 [0085.909] lstrlenW (lpString=".LDF") returned 4 [0085.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch=".LDF") returned 0x0 [0085.909] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.909] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.910] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.911] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20591185830) returned 1 [0085.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc205dfb0, dwHighDateTime=0x1d585b4)) [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763db0 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763db0 | out: hHeap=0x260000) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.912] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.912] GetLastError () returned 0x0 [0085.912] GetLastError () returned 0x0 [0085.912] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.912] GetLastError () returned 0x0 [0085.913] GetLastError () returned 0x0 [0085.929] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffecc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.929] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x133a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x133a, lpOverlapped=0x0) returned 1 [0085.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.929] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.929] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.929] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.929] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.930] CloseHandle (hObject=0x11c) returned 1 [0085.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d590 [0085.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d590 | out: hHeap=0x260000) returned 1 [0085.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.933] GetLastError () returned 0x0 [0085.933] RtlWakeConditionVariable () returned 0x0 [0085.933] GetCurrentThreadId () returned 0x998 [0085.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".ldf") returned 0x0 [0085.933] lstrlenW (lpString=".vhd") returned 4 [0085.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".vhd") returned 0x0 [0085.933] lstrlenW (lpString=".vhdx") returned 5 [0085.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".vhdx") returned 0x0 [0085.933] lstrlenW (lpString=".pst") returned 4 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".pst") returned 0x0 [0085.934] lstrlenW (lpString=".ost") returned 4 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".ost") returned 0x0 [0085.934] lstrlenW (lpString=".bak") returned 4 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".bak") returned 0x0 [0085.934] lstrlenW (lpString=".bac") returned 4 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".bac") returned 0x0 [0085.934] lstrlenW (lpString=".sys") returned 4 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".sys") returned 0x0 [0085.934] lstrlenW (lpString=".v2i") returned 4 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".v2i") returned 0x0 [0085.934] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.937] lstrlenW (lpString=".sql") returned 4 [0085.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".sql") returned 0x0 [0085.938] lstrlenW (lpString=".mdf") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".mdf") returned 0x0 [0085.938] lstrlenW (lpString=".txt") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".txt") returned 0x0 [0085.938] lstrlenW (lpString=".dbf") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".dbf") returned 0x0 [0085.938] lstrlenW (lpString=".ckp") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".ckp") returned 0x0 [0085.938] lstrlenW (lpString=".dacpac") returned 7 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".dacpac") returned 0x0 [0085.938] lstrlenW (lpString=".db3") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".db3") returned 0x0 [0085.938] lstrlenW (lpString=".dtxs") returned 5 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".dtxs") returned 0x0 [0085.938] lstrlenW (lpString=".mdt") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".mdt") returned 0x0 [0085.938] lstrlenW (lpString=".sdf") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".sdf") returned 0x0 [0085.938] lstrlenW (lpString=".MDF") returned 4 [0085.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".MDF") returned 0x0 [0085.938] lstrlenW (lpString=".DBF") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".DBF") returned 0x0 [0085.939] lstrlenW (lpString=".DB") returned 3 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".DB") returned 0x0 [0085.939] lstrlenW (lpString=".db") returned 3 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".db") returned 0x0 [0085.939] lstrlenW (lpString=".ndf") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".ndf") returned 0x0 [0085.939] lstrlenW (lpString=".NDF") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".NDF") returned 0x0 [0085.939] lstrlenW (lpString=".Mdf") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".Mdf") returned 0x0 [0085.939] lstrlenW (lpString=".dat") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".dat") returned 0x0 [0085.939] lstrlenW (lpString=".DAT") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".DAT") returned 0x0 [0085.939] lstrlenW (lpString=".ldf") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".ldf") returned 0x0 [0085.939] lstrlenW (lpString=".LDF") returned 4 [0085.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch=".LDF") returned 0x0 [0085.939] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.940] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0085.941] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.941] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.941] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20594235815) returned 1 [0085.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc20aa270, dwHighDateTime=0x1d585b4)) [0085.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763d78 [0085.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763d78 | out: hHeap=0x260000) returned 1 [0085.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.942] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0085.942] GetLastError () returned 0x0 [0085.943] GetLastError () returned 0x0 [0085.943] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0085.943] GetLastError () returned 0x0 [0085.943] GetLastError () returned 0x0 [0085.947] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffecc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.948] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x133a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x133a, lpOverlapped=0x0) returned 1 [0085.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.948] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.948] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.948] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.948] CloseHandle (hObject=0x11c) returned 1 [0085.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2aed18 [0085.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0085.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.951] GetLastError () returned 0x0 [0085.951] RtlWakeConditionVariable () returned 0x27e828 [0085.951] GetCurrentThreadId () returned 0x998 [0085.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.951] lstrlenW (lpString=".vhd") returned 4 [0085.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.952] lstrlenW (lpString=".vhdx") returned 5 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.952] lstrlenW (lpString=".pst") returned 4 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.952] lstrlenW (lpString=".ost") returned 4 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.952] lstrlenW (lpString=".bak") returned 4 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.952] lstrlenW (lpString=".bac") returned 4 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.952] lstrlenW (lpString=".sys") returned 4 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.952] lstrlenW (lpString=".v2i") returned 4 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.952] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.954] lstrlenW (lpString=".sql") returned 4 [0085.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.954] lstrlenW (lpString=".mdf") returned 4 [0085.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.954] lstrlenW (lpString=".txt") returned 4 [0085.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.954] lstrlenW (lpString=".dbf") returned 4 [0085.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.954] lstrlenW (lpString=".ckp") returned 4 [0085.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.955] lstrlenW (lpString=".dacpac") returned 7 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.955] lstrlenW (lpString=".db3") returned 4 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.955] lstrlenW (lpString=".dtxs") returned 5 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.955] lstrlenW (lpString=".mdt") returned 4 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.955] lstrlenW (lpString=".sdf") returned 4 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.955] lstrlenW (lpString=".MDF") returned 4 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.955] lstrlenW (lpString=".DBF") returned 4 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.955] lstrlenW (lpString=".DB") returned 3 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.955] lstrlenW (lpString=".db") returned 3 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".db") returned 0x0 [0085.955] lstrlenW (lpString=".ndf") returned 4 [0085.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.955] lstrlenW (lpString=".NDF") returned 4 [0085.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.956] lstrlenW (lpString=".Mdf") returned 4 [0085.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.956] lstrlenW (lpString=".dat") returned 4 [0085.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.956] lstrlenW (lpString=".DAT") returned 4 [0085.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.956] lstrlenW (lpString=".ldf") returned 4 [0085.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.040] lstrlenW (lpString=".LDF") returned 4 [0086.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.050] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.050] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.051] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.051] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.051] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20605255482) returned 1 [0086.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc21b4c10, dwHighDateTime=0x1d585b4)) [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b80 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b80 | out: hHeap=0x260000) returned 1 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.052] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.052] GetLastError () returned 0x0 [0086.052] GetLastError () returned 0x0 [0086.053] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.053] GetLastError () returned 0x0 [0086.053] GetLastError () returned 0x0 [0086.056] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe1cb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.056] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1e35, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1e35, lpOverlapped=0x0) returned 1 [0086.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.057] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.057] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.057] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.057] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.057] CloseHandle (hObject=0x11c) returned 1 [0086.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.057] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.059] GetLastError () returned 0x0 [0086.059] RtlWakeConditionVariable () returned 0x0 [0086.059] GetCurrentThreadId () returned 0x998 [0086.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".ldf") returned 0x0 [0086.059] lstrlenW (lpString=".vhd") returned 4 [0086.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".vhd") returned 0x0 [0086.059] lstrlenW (lpString=".vhdx") returned 5 [0086.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".vhdx") returned 0x0 [0086.059] lstrlenW (lpString=".pst") returned 4 [0086.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".pst") returned 0x0 [0086.059] lstrlenW (lpString=".ost") returned 4 [0086.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".ost") returned 0x0 [0086.060] lstrlenW (lpString=".bak") returned 4 [0086.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".bak") returned 0x0 [0086.060] lstrlenW (lpString=".bac") returned 4 [0086.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".bac") returned 0x0 [0086.060] lstrlenW (lpString=".sys") returned 4 [0086.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".sys") returned 0x0 [0086.060] lstrlenW (lpString=".v2i") returned 4 [0086.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".v2i") returned 0x0 [0086.060] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.061] lstrlenW (lpString=".sql") returned 4 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".sql") returned 0x0 [0086.061] lstrlenW (lpString=".mdf") returned 4 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".mdf") returned 0x0 [0086.061] lstrlenW (lpString=".txt") returned 4 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".txt") returned 0x0 [0086.061] lstrlenW (lpString=".dbf") returned 4 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".dbf") returned 0x0 [0086.061] lstrlenW (lpString=".ckp") returned 4 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".ckp") returned 0x0 [0086.061] lstrlenW (lpString=".dacpac") returned 7 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".dacpac") returned 0x0 [0086.061] lstrlenW (lpString=".db3") returned 4 [0086.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".db3") returned 0x0 [0086.062] lstrlenW (lpString=".dtxs") returned 5 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".dtxs") returned 0x0 [0086.062] lstrlenW (lpString=".mdt") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".mdt") returned 0x0 [0086.062] lstrlenW (lpString=".sdf") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".sdf") returned 0x0 [0086.062] lstrlenW (lpString=".MDF") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".MDF") returned 0x0 [0086.062] lstrlenW (lpString=".DBF") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".DBF") returned 0x0 [0086.062] lstrlenW (lpString=".DB") returned 3 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".DB") returned 0x0 [0086.062] lstrlenW (lpString=".db") returned 3 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".db") returned 0x0 [0086.062] lstrlenW (lpString=".ndf") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".ndf") returned 0x0 [0086.062] lstrlenW (lpString=".NDF") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".NDF") returned 0x0 [0086.062] lstrlenW (lpString=".Mdf") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".Mdf") returned 0x0 [0086.062] lstrlenW (lpString=".dat") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".dat") returned 0x0 [0086.062] lstrlenW (lpString=".DAT") returned 4 [0086.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".DAT") returned 0x0 [0086.062] lstrlenW (lpString=".ldf") returned 4 [0086.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".ldf") returned 0x0 [0086.063] lstrlenW (lpString=".LDF") returned 4 [0086.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch=".LDF") returned 0x0 [0086.063] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.063] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.064] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.064] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20606492406) returned 1 [0086.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc21b4c10, dwHighDateTime=0x1d585b4)) [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b10 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b10 | out: hHeap=0x260000) returned 1 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.065] GetLastError () returned 0x0 [0086.065] GetLastError () returned 0x0 [0086.065] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.065] GetLastError () returned 0x0 [0086.065] GetLastError () returned 0x0 [0086.067] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe69d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.067] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1963, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1963, lpOverlapped=0x0) returned 1 [0086.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.067] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.067] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.067] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.067] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.068] CloseHandle (hObject=0x11c) returned 1 [0086.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.069] GetLastError () returned 0x0 [0086.069] RtlWakeConditionVariable () returned 0x0 [0086.069] GetCurrentThreadId () returned 0x998 [0086.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.069] lstrlenW (lpString=".vhd") returned 4 [0086.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.070] lstrlenW (lpString=".vhdx") returned 5 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.070] lstrlenW (lpString=".pst") returned 4 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.070] lstrlenW (lpString=".ost") returned 4 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.070] lstrlenW (lpString=".bak") returned 4 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.070] lstrlenW (lpString=".bac") returned 4 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.070] lstrlenW (lpString=".sys") returned 4 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.070] lstrlenW (lpString=".v2i") returned 4 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.070] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.071] lstrlenW (lpString=".sql") returned 4 [0086.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.071] lstrlenW (lpString=".mdf") returned 4 [0086.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.071] lstrlenW (lpString=".txt") returned 4 [0086.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.071] lstrlenW (lpString=".dbf") returned 4 [0086.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.071] lstrlenW (lpString=".ckp") returned 4 [0086.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.071] lstrlenW (lpString=".dacpac") returned 7 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.072] lstrlenW (lpString=".db3") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.072] lstrlenW (lpString=".dtxs") returned 5 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.072] lstrlenW (lpString=".mdt") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.072] lstrlenW (lpString=".sdf") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.072] lstrlenW (lpString=".MDF") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.072] lstrlenW (lpString=".DBF") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.072] lstrlenW (lpString=".DB") returned 3 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.072] lstrlenW (lpString=".db") returned 3 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.072] lstrlenW (lpString=".ndf") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.072] lstrlenW (lpString=".NDF") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.072] lstrlenW (lpString=".Mdf") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.072] lstrlenW (lpString=".dat") returned 4 [0086.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.073] lstrlenW (lpString=".DAT") returned 4 [0086.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.073] lstrlenW (lpString=".ldf") returned 4 [0086.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.073] lstrlenW (lpString=".LDF") returned 4 [0086.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.073] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.073] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.074] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.074] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20607503788) returned 1 [0086.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc21dad70, dwHighDateTime=0x1d585b4)) [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763ad8 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763ad8 | out: hHeap=0x260000) returned 1 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.075] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.075] GetLastError () returned 0x0 [0086.075] GetLastError () returned 0x0 [0086.075] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.075] GetLastError () returned 0x0 [0086.075] GetLastError () returned 0x0 [0086.077] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.077] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1638, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1638, lpOverlapped=0x0) returned 1 [0086.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.078] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.078] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.078] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.078] CloseHandle (hObject=0x11c) returned 1 [0086.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.080] GetLastError () returned 0x0 [0086.080] RtlWakeConditionVariable () returned 0x0 [0086.080] GetCurrentThreadId () returned 0x998 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".ldf") returned 0x0 [0086.080] lstrlenW (lpString=".vhd") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".vhd") returned 0x0 [0086.080] lstrlenW (lpString=".vhdx") returned 5 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".vhdx") returned 0x0 [0086.080] lstrlenW (lpString=".pst") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".pst") returned 0x0 [0086.080] lstrlenW (lpString=".ost") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".ost") returned 0x0 [0086.080] lstrlenW (lpString=".bak") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".bak") returned 0x0 [0086.080] lstrlenW (lpString=".bac") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".bac") returned 0x0 [0086.080] lstrlenW (lpString=".sys") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".sys") returned 0x0 [0086.080] lstrlenW (lpString=".v2i") returned 4 [0086.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".v2i") returned 0x0 [0086.080] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.082] lstrlenW (lpString=".sql") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".sql") returned 0x0 [0086.082] lstrlenW (lpString=".mdf") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".mdf") returned 0x0 [0086.082] lstrlenW (lpString=".txt") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".txt") returned 0x0 [0086.082] lstrlenW (lpString=".dbf") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".dbf") returned 0x0 [0086.082] lstrlenW (lpString=".ckp") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".ckp") returned 0x0 [0086.082] lstrlenW (lpString=".dacpac") returned 7 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".dacpac") returned 0x0 [0086.082] lstrlenW (lpString=".db3") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".db3") returned 0x0 [0086.082] lstrlenW (lpString=".dtxs") returned 5 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".dtxs") returned 0x0 [0086.082] lstrlenW (lpString=".mdt") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".mdt") returned 0x0 [0086.082] lstrlenW (lpString=".sdf") returned 4 [0086.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".sdf") returned 0x0 [0086.083] lstrlenW (lpString=".MDF") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".MDF") returned 0x0 [0086.083] lstrlenW (lpString=".DBF") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".DBF") returned 0x0 [0086.083] lstrlenW (lpString=".DB") returned 3 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".DB") returned 0x0 [0086.083] lstrlenW (lpString=".db") returned 3 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".db") returned 0x0 [0086.083] lstrlenW (lpString=".ndf") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".ndf") returned 0x0 [0086.083] lstrlenW (lpString=".NDF") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".NDF") returned 0x0 [0086.083] lstrlenW (lpString=".Mdf") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".Mdf") returned 0x0 [0086.083] lstrlenW (lpString=".dat") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".dat") returned 0x0 [0086.083] lstrlenW (lpString=".DAT") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".DAT") returned 0x0 [0086.083] lstrlenW (lpString=".ldf") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".ldf") returned 0x0 [0086.083] lstrlenW (lpString=".LDF") returned 4 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch=".LDF") returned 0x0 [0086.083] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.084] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.084] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.084] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.085] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20608569108) returned 1 [0086.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2200ed0, dwHighDateTime=0x1d585b4)) [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763aa0 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763aa0 | out: hHeap=0x260000) returned 1 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.085] GetLastError () returned 0x0 [0086.086] GetLastError () returned 0x0 [0086.086] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.086] GetLastError () returned 0x0 [0086.086] GetLastError () returned 0x0 [0086.125] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd2c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.125] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x2d38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2d38, lpOverlapped=0x0) returned 1 [0086.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.127] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.127] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.127] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.127] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.128] CloseHandle (hObject=0x11c) returned 1 [0086.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d4a8 [0086.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0086.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.130] GetLastError () returned 0x0 [0086.130] RtlWakeConditionVariable () returned 0x0 [0086.130] GetCurrentThreadId () returned 0x998 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".ldf") returned 0x0 [0086.130] lstrlenW (lpString=".vhd") returned 4 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".vhd") returned 0x0 [0086.130] lstrlenW (lpString=".vhdx") returned 5 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".vhdx") returned 0x0 [0086.130] lstrlenW (lpString=".pst") returned 4 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".pst") returned 0x0 [0086.130] lstrlenW (lpString=".ost") returned 4 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".ost") returned 0x0 [0086.130] lstrlenW (lpString=".bak") returned 4 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".bak") returned 0x0 [0086.130] lstrlenW (lpString=".bac") returned 4 [0086.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".bac") returned 0x0 [0086.130] lstrlenW (lpString=".sys") returned 4 [0086.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".sys") returned 0x0 [0086.131] lstrlenW (lpString=".v2i") returned 4 [0086.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".v2i") returned 0x0 [0086.131] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.132] lstrlenW (lpString=".sql") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".sql") returned 0x0 [0086.132] lstrlenW (lpString=".mdf") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".mdf") returned 0x0 [0086.132] lstrlenW (lpString=".txt") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".txt") returned 0x0 [0086.132] lstrlenW (lpString=".dbf") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".dbf") returned 0x0 [0086.132] lstrlenW (lpString=".ckp") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".ckp") returned 0x0 [0086.132] lstrlenW (lpString=".dacpac") returned 7 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".dacpac") returned 0x0 [0086.132] lstrlenW (lpString=".db3") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".db3") returned 0x0 [0086.132] lstrlenW (lpString=".dtxs") returned 5 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".dtxs") returned 0x0 [0086.132] lstrlenW (lpString=".mdt") returned 4 [0086.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".mdt") returned 0x0 [0086.133] lstrlenW (lpString=".sdf") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".sdf") returned 0x0 [0086.133] lstrlenW (lpString=".MDF") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".MDF") returned 0x0 [0086.133] lstrlenW (lpString=".DBF") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".DBF") returned 0x0 [0086.133] lstrlenW (lpString=".DB") returned 3 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".DB") returned 0x0 [0086.133] lstrlenW (lpString=".db") returned 3 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".db") returned 0x0 [0086.133] lstrlenW (lpString=".ndf") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".ndf") returned 0x0 [0086.133] lstrlenW (lpString=".NDF") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".NDF") returned 0x0 [0086.133] lstrlenW (lpString=".Mdf") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".Mdf") returned 0x0 [0086.133] lstrlenW (lpString=".dat") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".dat") returned 0x0 [0086.133] lstrlenW (lpString=".DAT") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".DAT") returned 0x0 [0086.133] lstrlenW (lpString=".ldf") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".ldf") returned 0x0 [0086.133] lstrlenW (lpString=".LDF") returned 4 [0086.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch=".LDF") returned 0x0 [0086.133] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.134] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.134] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.134] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.135] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20613576877) returned 1 [0086.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc22732f0, dwHighDateTime=0x1d585b4)) [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762e60 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762e60 | out: hHeap=0x260000) returned 1 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.135] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.136] GetLastError () returned 0x0 [0086.136] GetLastError () returned 0x0 [0086.136] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.136] GetLastError () returned 0x0 [0086.136] GetLastError () returned 0x0 [0086.139] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.139] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xf38, lpOverlapped=0x0) returned 1 [0086.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.139] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.140] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.140] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.140] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.140] CloseHandle (hObject=0x11c) returned 1 [0086.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2aed18 [0086.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0086.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.143] GetLastError () returned 0x0 [0086.144] RtlWakeConditionVariable () returned 0x0 [0086.144] GetCurrentThreadId () returned 0x998 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".ldf") returned 0x0 [0086.144] lstrlenW (lpString=".vhd") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".vhd") returned 0x0 [0086.144] lstrlenW (lpString=".vhdx") returned 5 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".vhdx") returned 0x0 [0086.144] lstrlenW (lpString=".pst") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".pst") returned 0x0 [0086.144] lstrlenW (lpString=".ost") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".ost") returned 0x0 [0086.144] lstrlenW (lpString=".bak") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".bak") returned 0x0 [0086.144] lstrlenW (lpString=".bac") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".bac") returned 0x0 [0086.144] lstrlenW (lpString=".sys") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".sys") returned 0x0 [0086.144] lstrlenW (lpString=".v2i") returned 4 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".v2i") returned 0x0 [0086.144] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.146] lstrlenW (lpString=".sql") returned 4 [0086.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".sql") returned 0x0 [0086.146] lstrlenW (lpString=".mdf") returned 4 [0086.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".mdf") returned 0x0 [0086.146] lstrlenW (lpString=".txt") returned 4 [0086.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".txt") returned 0x0 [0086.146] lstrlenW (lpString=".dbf") returned 4 [0086.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".dbf") returned 0x0 [0086.146] lstrlenW (lpString=".ckp") returned 4 [0086.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".ckp") returned 0x0 [0086.146] lstrlenW (lpString=".dacpac") returned 7 [0086.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".dacpac") returned 0x0 [0086.147] lstrlenW (lpString=".db3") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".db3") returned 0x0 [0086.147] lstrlenW (lpString=".dtxs") returned 5 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".dtxs") returned 0x0 [0086.147] lstrlenW (lpString=".mdt") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".mdt") returned 0x0 [0086.147] lstrlenW (lpString=".sdf") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".sdf") returned 0x0 [0086.147] lstrlenW (lpString=".MDF") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".MDF") returned 0x0 [0086.147] lstrlenW (lpString=".DBF") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".DBF") returned 0x0 [0086.147] lstrlenW (lpString=".DB") returned 3 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".DB") returned 0x0 [0086.147] lstrlenW (lpString=".db") returned 3 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".db") returned 0x0 [0086.147] lstrlenW (lpString=".ndf") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".ndf") returned 0x0 [0086.147] lstrlenW (lpString=".NDF") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".NDF") returned 0x0 [0086.147] lstrlenW (lpString=".Mdf") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".Mdf") returned 0x0 [0086.147] lstrlenW (lpString=".dat") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".dat") returned 0x0 [0086.147] lstrlenW (lpString=".DAT") returned 4 [0086.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".DAT") returned 0x0 [0086.148] lstrlenW (lpString=".ldf") returned 4 [0086.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".ldf") returned 0x0 [0086.148] lstrlenW (lpString=".LDF") returned 4 [0086.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch=".LDF") returned 0x0 [0086.148] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.148] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.149] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.149] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.149] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20614999026) returned 1 [0086.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2299450, dwHighDateTime=0x1d585b4)) [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762b50 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762b50 | out: hHeap=0x260000) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.150] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.150] GetLastError () returned 0x0 [0086.150] GetLastError () returned 0x0 [0086.150] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.150] GetLastError () returned 0x0 [0086.150] GetLastError () returned 0x0 [0086.152] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.152] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x540, lpOverlapped=0x0) returned 1 [0086.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.153] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.153] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.153] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.153] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.153] CloseHandle (hObject=0x11c) returned 1 [0086.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0086.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0086.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.155] GetLastError () returned 0x0 [0086.156] RtlWakeConditionVariable () returned 0x0 [0086.156] GetCurrentThreadId () returned 0x998 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".ldf") returned 0x0 [0086.156] lstrlenW (lpString=".vhd") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".vhd") returned 0x0 [0086.156] lstrlenW (lpString=".vhdx") returned 5 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".vhdx") returned 0x0 [0086.156] lstrlenW (lpString=".pst") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".pst") returned 0x0 [0086.156] lstrlenW (lpString=".ost") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".ost") returned 0x0 [0086.156] lstrlenW (lpString=".bak") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".bak") returned 0x0 [0086.156] lstrlenW (lpString=".bac") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".bac") returned 0x0 [0086.156] lstrlenW (lpString=".sys") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".sys") returned 0x0 [0086.156] lstrlenW (lpString=".v2i") returned 4 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".v2i") returned 0x0 [0086.156] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.158] lstrlenW (lpString=".sql") returned 4 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".sql") returned 0x0 [0086.158] lstrlenW (lpString=".mdf") returned 4 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".mdf") returned 0x0 [0086.158] lstrlenW (lpString=".txt") returned 4 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".txt") returned 0x0 [0086.158] lstrlenW (lpString=".dbf") returned 4 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".dbf") returned 0x0 [0086.158] lstrlenW (lpString=".ckp") returned 4 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".ckp") returned 0x0 [0086.158] lstrlenW (lpString=".dacpac") returned 7 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".dacpac") returned 0x0 [0086.158] lstrlenW (lpString=".db3") returned 4 [0086.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".db3") returned 0x0 [0086.158] lstrlenW (lpString=".dtxs") returned 5 [0086.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".dtxs") returned 0x0 [0086.159] lstrlenW (lpString=".mdt") returned 4 [0086.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".mdt") returned 0x0 [0086.159] lstrlenW (lpString=".sdf") returned 4 [0086.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".sdf") returned 0x0 [0086.159] lstrlenW (lpString=".MDF") returned 4 [0086.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".MDF") returned 0x0 [0086.159] lstrlenW (lpString=".DBF") returned 4 [0086.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".DBF") returned 0x0 [0086.240] lstrlenW (lpString=".DB") returned 3 [0086.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".DB") returned 0x0 [0086.240] lstrlenW (lpString=".db") returned 3 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".db") returned 0x0 [0086.241] lstrlenW (lpString=".ndf") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".ndf") returned 0x0 [0086.241] lstrlenW (lpString=".NDF") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".NDF") returned 0x0 [0086.241] lstrlenW (lpString=".Mdf") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".Mdf") returned 0x0 [0086.241] lstrlenW (lpString=".dat") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".dat") returned 0x0 [0086.241] lstrlenW (lpString=".DAT") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".DAT") returned 0x0 [0086.241] lstrlenW (lpString=".ldf") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".ldf") returned 0x0 [0086.241] lstrlenW (lpString=".LDF") returned 4 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch=".LDF") returned 0x0 [0086.241] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.241] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.242] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.242] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.242] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20624335494) returned 1 [0086.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc237dc90, dwHighDateTime=0x1d585b4)) [0086.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762920 [0086.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762920 | out: hHeap=0x260000) returned 1 [0086.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0086.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0086.243] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.243] GetLastError () returned 0x0 [0086.243] GetLastError () returned 0x0 [0086.243] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.243] GetLastError () returned 0x0 [0086.244] GetLastError () returned 0x0 [0086.245] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd9fb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.245] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2605, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2605, lpOverlapped=0x0) returned 1 [0086.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.245] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.245] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.246] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.246] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.246] CloseHandle (hObject=0x11c) returned 1 [0086.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0086.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0086.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.292] GetLastError () returned 0x0 [0086.292] RtlWakeConditionVariable () returned 0x27e828 [0086.292] GetCurrentThreadId () returned 0x998 [0086.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.292] lstrlenW (lpString=".vhd") returned 4 [0086.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".vhd") returned 0x0 [0086.292] lstrlenW (lpString=".vhdx") returned 5 [0086.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.292] lstrlenW (lpString=".pst") returned 4 [0086.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".pst") returned 0x0 [0086.292] lstrlenW (lpString=".ost") returned 4 [0086.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".ost") returned 0x0 [0086.293] lstrlenW (lpString=".bak") returned 4 [0086.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".bak") returned 0x0 [0086.293] lstrlenW (lpString=".bac") returned 4 [0086.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".bac") returned 0x0 [0086.293] lstrlenW (lpString=".sys") returned 4 [0086.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".sys") returned 0x0 [0086.293] lstrlenW (lpString=".v2i") returned 4 [0086.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".v2i") returned 0x0 [0086.293] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.294] lstrlenW (lpString=".sql") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".sql") returned 0x0 [0086.294] lstrlenW (lpString=".mdf") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".mdf") returned 0x0 [0086.294] lstrlenW (lpString=".txt") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".txt") returned 0x0 [0086.294] lstrlenW (lpString=".dbf") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".dbf") returned 0x0 [0086.294] lstrlenW (lpString=".ckp") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".ckp") returned 0x0 [0086.294] lstrlenW (lpString=".dacpac") returned 7 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.294] lstrlenW (lpString=".db3") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".db3") returned 0x0 [0086.294] lstrlenW (lpString=".dtxs") returned 5 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.294] lstrlenW (lpString=".mdt") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".mdt") returned 0x0 [0086.294] lstrlenW (lpString=".sdf") returned 4 [0086.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".sdf") returned 0x0 [0086.295] lstrlenW (lpString=".MDF") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".MDF") returned 0x0 [0086.295] lstrlenW (lpString=".DBF") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".DBF") returned 0x0 [0086.295] lstrlenW (lpString=".DB") returned 3 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".DB") returned 0x0 [0086.295] lstrlenW (lpString=".db") returned 3 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".db") returned 0x0 [0086.295] lstrlenW (lpString=".ndf") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".ndf") returned 0x0 [0086.295] lstrlenW (lpString=".NDF") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".NDF") returned 0x0 [0086.295] lstrlenW (lpString=".Mdf") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.295] lstrlenW (lpString=".dat") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".dat") returned 0x0 [0086.295] lstrlenW (lpString=".DAT") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".DAT") returned 0x0 [0086.295] lstrlenW (lpString=".ldf") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.295] lstrlenW (lpString=".LDF") returned 4 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch=".LDF") returned 0x0 [0086.295] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.296] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.296] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.296] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.296] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20629760994) returned 1 [0086.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc23f00b0, dwHighDateTime=0x1d585b4)) [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1eb0 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1eb0 | out: hHeap=0x260000) returned 1 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.297] GetLastError () returned 0x0 [0086.298] GetLastError () returned 0x0 [0086.298] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.298] GetLastError () returned 0x0 [0086.298] GetLastError () returned 0x0 [0086.306] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff888, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.306] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x778, lpOverlapped=0x0) returned 1 [0086.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.306] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.306] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.306] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.306] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.307] CloseHandle (hObject=0xd8) returned 1 [0086.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.308] GetLastError () returned 0x0 [0086.308] RtlWakeConditionVariable () returned 0x27e828 [0086.308] GetCurrentThreadId () returned 0x998 [0086.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".ldf") returned 0x0 [0086.308] lstrlenW (lpString=".vhd") returned 4 [0086.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".vhd") returned 0x0 [0086.308] lstrlenW (lpString=".vhdx") returned 5 [0086.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.308] lstrlenW (lpString=".pst") returned 4 [0086.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".pst") returned 0x0 [0086.309] lstrlenW (lpString=".ost") returned 4 [0086.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".ost") returned 0x0 [0086.309] lstrlenW (lpString=".bak") returned 4 [0086.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".bak") returned 0x0 [0086.309] lstrlenW (lpString=".bac") returned 4 [0086.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".bac") returned 0x0 [0086.309] lstrlenW (lpString=".sys") returned 4 [0086.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".sys") returned 0x0 [0086.309] lstrlenW (lpString=".v2i") returned 4 [0086.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".v2i") returned 0x0 [0086.309] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.326] lstrlenW (lpString=".sql") returned 4 [0086.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".sql") returned 0x0 [0086.326] lstrlenW (lpString=".mdf") returned 4 [0086.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".mdf") returned 0x0 [0086.326] lstrlenW (lpString=".txt") returned 4 [0086.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".txt") returned 0x0 [0086.326] lstrlenW (lpString=".dbf") returned 4 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".dbf") returned 0x0 [0086.331] lstrlenW (lpString=".ckp") returned 4 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".ckp") returned 0x0 [0086.331] lstrlenW (lpString=".dacpac") returned 7 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.331] lstrlenW (lpString=".db3") returned 4 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".db3") returned 0x0 [0086.331] lstrlenW (lpString=".dtxs") returned 5 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.331] lstrlenW (lpString=".mdt") returned 4 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".mdt") returned 0x0 [0086.331] lstrlenW (lpString=".sdf") returned 4 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".sdf") returned 0x0 [0086.331] lstrlenW (lpString=".MDF") returned 4 [0086.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".MDF") returned 0x0 [0086.332] lstrlenW (lpString=".DBF") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".DBF") returned 0x0 [0086.332] lstrlenW (lpString=".DB") returned 3 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".DB") returned 0x0 [0086.332] lstrlenW (lpString=".db") returned 3 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".db") returned 0x0 [0086.332] lstrlenW (lpString=".ndf") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".ndf") returned 0x0 [0086.332] lstrlenW (lpString=".NDF") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".NDF") returned 0x0 [0086.332] lstrlenW (lpString=".Mdf") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.332] lstrlenW (lpString=".dat") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".dat") returned 0x0 [0086.332] lstrlenW (lpString=".DAT") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".DAT") returned 0x0 [0086.332] lstrlenW (lpString=".ldf") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".ldf") returned 0x0 [0086.332] lstrlenW (lpString=".LDF") returned 4 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch=".LDF") returned 0x0 [0086.332] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.332] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.333] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.333] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20633455868) returned 1 [0086.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc24624d0, dwHighDateTime=0x1d585b4)) [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f58 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.334] GetLastError () returned 0x0 [0086.334] GetLastError () returned 0x0 [0086.335] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.335] GetLastError () returned 0x0 [0086.335] GetLastError () returned 0x0 [0086.337] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.337] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1c6e, lpOverlapped=0x0) returned 1 [0086.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.337] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.337] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.337] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.337] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.337] CloseHandle (hObject=0xe4) returned 1 [0086.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.339] GetLastError () returned 0x0 [0086.339] RtlWakeConditionVariable () returned 0x0 [0086.339] GetCurrentThreadId () returned 0x998 [0086.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".ldf") returned 0x0 [0086.339] lstrlenW (lpString=".vhd") returned 4 [0086.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".vhd") returned 0x0 [0086.339] lstrlenW (lpString=".vhdx") returned 5 [0086.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".vhdx") returned 0x0 [0086.339] lstrlenW (lpString=".pst") returned 4 [0086.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".pst") returned 0x0 [0086.339] lstrlenW (lpString=".ost") returned 4 [0086.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".ost") returned 0x0 [0086.339] lstrlenW (lpString=".bak") returned 4 [0086.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".bak") returned 0x0 [0086.340] lstrlenW (lpString=".bac") returned 4 [0086.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".bac") returned 0x0 [0086.340] lstrlenW (lpString=".sys") returned 4 [0086.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".sys") returned 0x0 [0086.340] lstrlenW (lpString=".v2i") returned 4 [0086.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".v2i") returned 0x0 [0086.340] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.341] lstrlenW (lpString=".sql") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".sql") returned 0x0 [0086.341] lstrlenW (lpString=".mdf") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".mdf") returned 0x0 [0086.341] lstrlenW (lpString=".txt") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".txt") returned 0x0 [0086.341] lstrlenW (lpString=".dbf") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".dbf") returned 0x0 [0086.341] lstrlenW (lpString=".ckp") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".ckp") returned 0x0 [0086.341] lstrlenW (lpString=".dacpac") returned 7 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".dacpac") returned 0x0 [0086.341] lstrlenW (lpString=".db3") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".db3") returned 0x0 [0086.341] lstrlenW (lpString=".dtxs") returned 5 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".dtxs") returned 0x0 [0086.341] lstrlenW (lpString=".mdt") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".mdt") returned 0x0 [0086.341] lstrlenW (lpString=".sdf") returned 4 [0086.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".sdf") returned 0x0 [0086.342] lstrlenW (lpString=".MDF") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".MDF") returned 0x0 [0086.342] lstrlenW (lpString=".DBF") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".DBF") returned 0x0 [0086.342] lstrlenW (lpString=".DB") returned 3 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".DB") returned 0x0 [0086.342] lstrlenW (lpString=".db") returned 3 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".db") returned 0x0 [0086.342] lstrlenW (lpString=".ndf") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".ndf") returned 0x0 [0086.342] lstrlenW (lpString=".NDF") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".NDF") returned 0x0 [0086.342] lstrlenW (lpString=".Mdf") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".Mdf") returned 0x0 [0086.342] lstrlenW (lpString=".dat") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".dat") returned 0x0 [0086.342] lstrlenW (lpString=".DAT") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".DAT") returned 0x0 [0086.342] lstrlenW (lpString=".ldf") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".ldf") returned 0x0 [0086.342] lstrlenW (lpString=".LDF") returned 4 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch=".LDF") returned 0x0 [0086.342] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.343] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.343] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.344] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20634464838) returned 1 [0086.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc24624d0, dwHighDateTime=0x1d585b4)) [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f20 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.344] GetLastError () returned 0x0 [0086.345] GetLastError () returned 0x0 [0086.345] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.345] GetLastError () returned 0x0 [0086.345] GetLastError () returned 0x0 [0086.364] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd087, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.365] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2f79, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x2f79, lpOverlapped=0x0) returned 1 [0086.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.365] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.365] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.366] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.366] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.366] CloseHandle (hObject=0xe4) returned 1 [0086.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.472] GetLastError () returned 0x0 [0086.472] RtlWakeConditionVariable () returned 0x0 [0086.473] GetCurrentThreadId () returned 0x998 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".ldf") returned 0x0 [0086.473] lstrlenW (lpString=".vhd") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".vhd") returned 0x0 [0086.473] lstrlenW (lpString=".vhdx") returned 5 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".vhdx") returned 0x0 [0086.473] lstrlenW (lpString=".pst") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".pst") returned 0x0 [0086.473] lstrlenW (lpString=".ost") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".ost") returned 0x0 [0086.473] lstrlenW (lpString=".bak") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".bak") returned 0x0 [0086.473] lstrlenW (lpString=".bac") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".bac") returned 0x0 [0086.473] lstrlenW (lpString=".sys") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".sys") returned 0x0 [0086.473] lstrlenW (lpString=".v2i") returned 4 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".v2i") returned 0x0 [0086.473] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.474] lstrlenW (lpString=".sql") returned 4 [0086.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".sql") returned 0x0 [0086.474] lstrlenW (lpString=".mdf") returned 4 [0086.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".mdf") returned 0x0 [0086.474] lstrlenW (lpString=".txt") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".txt") returned 0x0 [0086.475] lstrlenW (lpString=".dbf") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".dbf") returned 0x0 [0086.475] lstrlenW (lpString=".ckp") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".ckp") returned 0x0 [0086.475] lstrlenW (lpString=".dacpac") returned 7 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".dacpac") returned 0x0 [0086.475] lstrlenW (lpString=".db3") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".db3") returned 0x0 [0086.475] lstrlenW (lpString=".dtxs") returned 5 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".dtxs") returned 0x0 [0086.475] lstrlenW (lpString=".mdt") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".mdt") returned 0x0 [0086.475] lstrlenW (lpString=".sdf") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".sdf") returned 0x0 [0086.475] lstrlenW (lpString=".MDF") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".MDF") returned 0x0 [0086.475] lstrlenW (lpString=".DBF") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".DBF") returned 0x0 [0086.475] lstrlenW (lpString=".DB") returned 3 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".DB") returned 0x0 [0086.475] lstrlenW (lpString=".db") returned 3 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".db") returned 0x0 [0086.475] lstrlenW (lpString=".ndf") returned 4 [0086.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".ndf") returned 0x0 [0086.475] lstrlenW (lpString=".NDF") returned 4 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".NDF") returned 0x0 [0086.476] lstrlenW (lpString=".Mdf") returned 4 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".Mdf") returned 0x0 [0086.476] lstrlenW (lpString=".dat") returned 4 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".dat") returned 0x0 [0086.476] lstrlenW (lpString=".DAT") returned 4 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".DAT") returned 0x0 [0086.476] lstrlenW (lpString=".ldf") returned 4 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".ldf") returned 0x0 [0086.476] lstrlenW (lpString=".LDF") returned 4 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch=".LDF") returned 0x0 [0086.476] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.476] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.477] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.477] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20647820628) returned 1 [0086.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc25b9130, dwHighDateTime=0x1d585b4)) [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c918 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c918 | out: hHeap=0x260000) returned 1 [0086.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.478] GetLastError () returned 0x0 [0086.478] GetLastError () returned 0x0 [0086.478] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.478] GetLastError () returned 0x0 [0086.478] GetLastError () returned 0x0 [0086.481] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffddaa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.481] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x2256, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2256, lpOverlapped=0x0) returned 1 [0086.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.482] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.482] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.482] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.482] CloseHandle (hObject=0xf0) returned 1 [0086.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.482] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.483] GetLastError () returned 0x0 [0086.483] RtlWakeConditionVariable () returned 0x0 [0086.483] GetCurrentThreadId () returned 0x998 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.484] lstrlenW (lpString=".vhd") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".vhd") returned 0x0 [0086.484] lstrlenW (lpString=".vhdx") returned 5 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.484] lstrlenW (lpString=".pst") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".pst") returned 0x0 [0086.484] lstrlenW (lpString=".ost") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".ost") returned 0x0 [0086.484] lstrlenW (lpString=".bak") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".bak") returned 0x0 [0086.484] lstrlenW (lpString=".bac") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".bac") returned 0x0 [0086.484] lstrlenW (lpString=".sys") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".sys") returned 0x0 [0086.484] lstrlenW (lpString=".v2i") returned 4 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".v2i") returned 0x0 [0086.484] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.485] lstrlenW (lpString=".sql") returned 4 [0086.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".sql") returned 0x0 [0086.485] lstrlenW (lpString=".mdf") returned 4 [0086.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".mdf") returned 0x0 [0086.485] lstrlenW (lpString=".txt") returned 4 [0086.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".txt") returned 0x0 [0086.485] lstrlenW (lpString=".dbf") returned 4 [0086.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".dbf") returned 0x0 [0086.485] lstrlenW (lpString=".ckp") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".ckp") returned 0x0 [0086.486] lstrlenW (lpString=".dacpac") returned 7 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.486] lstrlenW (lpString=".db3") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".db3") returned 0x0 [0086.486] lstrlenW (lpString=".dtxs") returned 5 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.486] lstrlenW (lpString=".mdt") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".mdt") returned 0x0 [0086.486] lstrlenW (lpString=".sdf") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".sdf") returned 0x0 [0086.486] lstrlenW (lpString=".MDF") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".MDF") returned 0x0 [0086.486] lstrlenW (lpString=".DBF") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".DBF") returned 0x0 [0086.486] lstrlenW (lpString=".DB") returned 3 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".DB") returned 0x0 [0086.486] lstrlenW (lpString=".db") returned 3 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".db") returned 0x0 [0086.486] lstrlenW (lpString=".ndf") returned 4 [0086.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".ndf") returned 0x0 [0086.486] lstrlenW (lpString=".NDF") returned 4 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".NDF") returned 0x0 [0086.487] lstrlenW (lpString=".Mdf") returned 4 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.487] lstrlenW (lpString=".dat") returned 4 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".dat") returned 0x0 [0086.487] lstrlenW (lpString=".DAT") returned 4 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".DAT") returned 0x0 [0086.487] lstrlenW (lpString=".ldf") returned 4 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.487] lstrlenW (lpString=".LDF") returned 4 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch=".LDF") returned 0x0 [0086.487] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.487] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.488] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.488] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20648950067) returned 1 [0086.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc25df290, dwHighDateTime=0x1d585b4)) [0086.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c950 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c950 | out: hHeap=0x260000) returned 1 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.489] GetLastError () returned 0x0 [0086.489] GetLastError () returned 0x0 [0086.490] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.490] GetLastError () returned 0x0 [0086.490] GetLastError () returned 0x0 [0086.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff628, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.491] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x9d8, lpOverlapped=0x0) returned 1 [0086.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.492] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.492] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.492] CloseHandle (hObject=0xf0) returned 1 [0086.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.493] GetLastError () returned 0x0 [0086.493] RtlWakeConditionVariable () returned 0x0 [0086.493] GetCurrentThreadId () returned 0x998 [0086.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".ldf") returned 0x0 [0086.493] lstrlenW (lpString=".vhd") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".vhd") returned 0x0 [0086.494] lstrlenW (lpString=".vhdx") returned 5 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".vhdx") returned 0x0 [0086.494] lstrlenW (lpString=".pst") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".pst") returned 0x0 [0086.494] lstrlenW (lpString=".ost") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".ost") returned 0x0 [0086.494] lstrlenW (lpString=".bak") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".bak") returned 0x0 [0086.494] lstrlenW (lpString=".bac") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".bac") returned 0x0 [0086.494] lstrlenW (lpString=".sys") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".sys") returned 0x0 [0086.494] lstrlenW (lpString=".v2i") returned 4 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".v2i") returned 0x0 [0086.494] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.495] lstrlenW (lpString=".sql") returned 4 [0086.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".sql") returned 0x0 [0086.495] lstrlenW (lpString=".mdf") returned 4 [0086.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".mdf") returned 0x0 [0086.495] lstrlenW (lpString=".txt") returned 4 [0086.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".txt") returned 0x0 [0086.495] lstrlenW (lpString=".dbf") returned 4 [0086.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".dbf") returned 0x0 [0086.495] lstrlenW (lpString=".ckp") returned 4 [0086.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".ckp") returned 0x0 [0086.495] lstrlenW (lpString=".dacpac") returned 7 [0086.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".dacpac") returned 0x0 [0086.495] lstrlenW (lpString=".db3") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".db3") returned 0x0 [0086.496] lstrlenW (lpString=".dtxs") returned 5 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".dtxs") returned 0x0 [0086.496] lstrlenW (lpString=".mdt") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".mdt") returned 0x0 [0086.496] lstrlenW (lpString=".sdf") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".sdf") returned 0x0 [0086.496] lstrlenW (lpString=".MDF") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".MDF") returned 0x0 [0086.496] lstrlenW (lpString=".DBF") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".DBF") returned 0x0 [0086.496] lstrlenW (lpString=".DB") returned 3 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".DB") returned 0x0 [0086.496] lstrlenW (lpString=".db") returned 3 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".db") returned 0x0 [0086.496] lstrlenW (lpString=".ndf") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".ndf") returned 0x0 [0086.496] lstrlenW (lpString=".NDF") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".NDF") returned 0x0 [0086.496] lstrlenW (lpString=".Mdf") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".Mdf") returned 0x0 [0086.496] lstrlenW (lpString=".dat") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".dat") returned 0x0 [0086.496] lstrlenW (lpString=".DAT") returned 4 [0086.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".DAT") returned 0x0 [0086.496] lstrlenW (lpString=".ldf") returned 4 [0086.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".ldf") returned 0x0 [0086.497] lstrlenW (lpString=".LDF") returned 4 [0086.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch=".LDF") returned 0x0 [0086.497] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.497] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.498] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.498] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.498] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20649888780) returned 1 [0086.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc25df290, dwHighDateTime=0x1d585b4)) [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c988 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c988 | out: hHeap=0x260000) returned 1 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.498] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.499] GetLastError () returned 0x0 [0086.499] GetLastError () returned 0x0 [0086.499] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.499] GetLastError () returned 0x0 [0086.499] GetLastError () returned 0x0 [0086.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.501] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x630, lpOverlapped=0x0) returned 1 [0086.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.501] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.501] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.501] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.501] CloseHandle (hObject=0xf0) returned 1 [0086.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.503] GetLastError () returned 0x0 [0086.503] RtlWakeConditionVariable () returned 0x0 [0086.503] GetCurrentThreadId () returned 0x998 [0086.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".ldf") returned 0x0 [0086.503] lstrlenW (lpString=".vhd") returned 4 [0086.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".vhd") returned 0x0 [0086.503] lstrlenW (lpString=".vhdx") returned 5 [0086.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".vhdx") returned 0x0 [0086.503] lstrlenW (lpString=".pst") returned 4 [0086.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".pst") returned 0x0 [0086.503] lstrlenW (lpString=".ost") returned 4 [0086.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".ost") returned 0x0 [0086.504] lstrlenW (lpString=".bak") returned 4 [0086.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".bak") returned 0x0 [0086.504] lstrlenW (lpString=".bac") returned 4 [0086.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".bac") returned 0x0 [0086.504] lstrlenW (lpString=".sys") returned 4 [0086.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".sys") returned 0x0 [0086.504] lstrlenW (lpString=".v2i") returned 4 [0086.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".v2i") returned 0x0 [0086.504] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.505] lstrlenW (lpString=".sql") returned 4 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".sql") returned 0x0 [0086.505] lstrlenW (lpString=".mdf") returned 4 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".mdf") returned 0x0 [0086.505] lstrlenW (lpString=".txt") returned 4 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".txt") returned 0x0 [0086.505] lstrlenW (lpString=".dbf") returned 4 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".dbf") returned 0x0 [0086.505] lstrlenW (lpString=".ckp") returned 4 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".ckp") returned 0x0 [0086.505] lstrlenW (lpString=".dacpac") returned 7 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".dacpac") returned 0x0 [0086.505] lstrlenW (lpString=".db3") returned 4 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".db3") returned 0x0 [0086.505] lstrlenW (lpString=".dtxs") returned 5 [0086.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".dtxs") returned 0x0 [0086.505] lstrlenW (lpString=".mdt") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".mdt") returned 0x0 [0086.506] lstrlenW (lpString=".sdf") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".sdf") returned 0x0 [0086.506] lstrlenW (lpString=".MDF") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".MDF") returned 0x0 [0086.506] lstrlenW (lpString=".DBF") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".DBF") returned 0x0 [0086.506] lstrlenW (lpString=".DB") returned 3 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".DB") returned 0x0 [0086.506] lstrlenW (lpString=".db") returned 3 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".db") returned 0x0 [0086.506] lstrlenW (lpString=".ndf") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".ndf") returned 0x0 [0086.506] lstrlenW (lpString=".NDF") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".NDF") returned 0x0 [0086.506] lstrlenW (lpString=".Mdf") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".Mdf") returned 0x0 [0086.506] lstrlenW (lpString=".dat") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".dat") returned 0x0 [0086.506] lstrlenW (lpString=".DAT") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".DAT") returned 0x0 [0086.506] lstrlenW (lpString=".ldf") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".ldf") returned 0x0 [0086.506] lstrlenW (lpString=".LDF") returned 4 [0086.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch=".LDF") returned 0x0 [0086.507] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.507] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.508] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.508] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20650884919) returned 1 [0086.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc26053f0, dwHighDateTime=0x1d585b4)) [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c9c0 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c9c0 | out: hHeap=0x260000) returned 1 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.508] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.509] GetLastError () returned 0x0 [0086.509] GetLastError () returned 0x0 [0086.509] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.509] GetLastError () returned 0x0 [0086.509] GetLastError () returned 0x0 [0086.517] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe21d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.517] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1de3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1de3, lpOverlapped=0x0) returned 1 [0086.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.520] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.520] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.520] CloseHandle (hObject=0xf0) returned 1 [0086.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d24a0 [0086.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d24a0 | out: hHeap=0x260000) returned 1 [0086.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.523] GetLastError () returned 0x0 [0086.523] RtlWakeConditionVariable () returned 0x0 [0086.523] GetCurrentThreadId () returned 0x998 [0086.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".ldf") returned 0x0 [0086.524] lstrlenW (lpString=".vhd") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".vhd") returned 0x0 [0086.524] lstrlenW (lpString=".vhdx") returned 5 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".vhdx") returned 0x0 [0086.524] lstrlenW (lpString=".pst") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".pst") returned 0x0 [0086.524] lstrlenW (lpString=".ost") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".ost") returned 0x0 [0086.524] lstrlenW (lpString=".bak") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".bak") returned 0x0 [0086.524] lstrlenW (lpString=".bac") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".bac") returned 0x0 [0086.524] lstrlenW (lpString=".sys") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".sys") returned 0x0 [0086.524] lstrlenW (lpString=".v2i") returned 4 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".v2i") returned 0x0 [0086.524] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.526] lstrlenW (lpString=".sql") returned 4 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".sql") returned 0x0 [0086.526] lstrlenW (lpString=".mdf") returned 4 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".mdf") returned 0x0 [0086.526] lstrlenW (lpString=".txt") returned 4 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".txt") returned 0x0 [0086.526] lstrlenW (lpString=".dbf") returned 4 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".dbf") returned 0x0 [0086.526] lstrlenW (lpString=".ckp") returned 4 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".ckp") returned 0x0 [0086.526] lstrlenW (lpString=".dacpac") returned 7 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".dacpac") returned 0x0 [0086.526] lstrlenW (lpString=".db3") returned 4 [0086.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".db3") returned 0x0 [0086.526] lstrlenW (lpString=".dtxs") returned 5 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".dtxs") returned 0x0 [0086.527] lstrlenW (lpString=".mdt") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".mdt") returned 0x0 [0086.527] lstrlenW (lpString=".sdf") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".sdf") returned 0x0 [0086.527] lstrlenW (lpString=".MDF") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".MDF") returned 0x0 [0086.527] lstrlenW (lpString=".DBF") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".DBF") returned 0x0 [0086.527] lstrlenW (lpString=".DB") returned 3 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".DB") returned 0x0 [0086.527] lstrlenW (lpString=".db") returned 3 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".db") returned 0x0 [0086.527] lstrlenW (lpString=".ndf") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".ndf") returned 0x0 [0086.527] lstrlenW (lpString=".NDF") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".NDF") returned 0x0 [0086.527] lstrlenW (lpString=".Mdf") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".Mdf") returned 0x0 [0086.527] lstrlenW (lpString=".dat") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".dat") returned 0x0 [0086.527] lstrlenW (lpString=".DAT") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".DAT") returned 0x0 [0086.527] lstrlenW (lpString=".ldf") returned 4 [0086.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".ldf") returned 0x0 [0086.527] lstrlenW (lpString=".LDF") returned 4 [0086.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch=".LDF") returned 0x0 [0086.528] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.528] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.529] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.529] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.529] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20653047406) returned 1 [0086.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc262b550, dwHighDateTime=0x1d585b4)) [0086.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c9f8 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c9f8 | out: hHeap=0x260000) returned 1 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.530] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.530] GetLastError () returned 0x0 [0086.531] GetLastError () returned 0x0 [0086.531] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.531] GetLastError () returned 0x0 [0086.531] GetLastError () returned 0x0 [0086.534] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdd40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.534] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x22c0, lpOverlapped=0x0) returned 1 [0086.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.535] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.535] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.535] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.535] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.535] CloseHandle (hObject=0xe4) returned 1 [0086.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f868 [0086.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f868 | out: hHeap=0x260000) returned 1 [0086.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.540] GetLastError () returned 0x0 [0086.540] RtlWakeConditionVariable () returned 0x27e828 [0086.540] GetCurrentThreadId () returned 0x998 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.540] lstrlenW (lpString=".vhd") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".vhd") returned 0x0 [0086.540] lstrlenW (lpString=".vhdx") returned 5 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.540] lstrlenW (lpString=".pst") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".pst") returned 0x0 [0086.540] lstrlenW (lpString=".ost") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".ost") returned 0x0 [0086.540] lstrlenW (lpString=".bak") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".bak") returned 0x0 [0086.540] lstrlenW (lpString=".bac") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".bac") returned 0x0 [0086.540] lstrlenW (lpString=".sys") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".sys") returned 0x0 [0086.540] lstrlenW (lpString=".v2i") returned 4 [0086.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".v2i") returned 0x0 [0086.541] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.542] lstrlenW (lpString=".sql") returned 4 [0086.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".sql") returned 0x0 [0086.542] lstrlenW (lpString=".mdf") returned 4 [0086.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".mdf") returned 0x0 [0086.542] lstrlenW (lpString=".txt") returned 4 [0086.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".txt") returned 0x0 [0086.542] lstrlenW (lpString=".dbf") returned 4 [0086.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".dbf") returned 0x0 [0086.542] lstrlenW (lpString=".ckp") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".ckp") returned 0x0 [0086.543] lstrlenW (lpString=".dacpac") returned 7 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.543] lstrlenW (lpString=".db3") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".db3") returned 0x0 [0086.543] lstrlenW (lpString=".dtxs") returned 5 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.543] lstrlenW (lpString=".mdt") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".mdt") returned 0x0 [0086.543] lstrlenW (lpString=".sdf") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".sdf") returned 0x0 [0086.543] lstrlenW (lpString=".MDF") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".MDF") returned 0x0 [0086.543] lstrlenW (lpString=".DBF") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".DBF") returned 0x0 [0086.543] lstrlenW (lpString=".DB") returned 3 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".DB") returned 0x0 [0086.543] lstrlenW (lpString=".db") returned 3 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".db") returned 0x0 [0086.543] lstrlenW (lpString=".ndf") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".ndf") returned 0x0 [0086.543] lstrlenW (lpString=".NDF") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".NDF") returned 0x0 [0086.543] lstrlenW (lpString=".Mdf") returned 4 [0086.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.543] lstrlenW (lpString=".dat") returned 4 [0086.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".dat") returned 0x0 [0086.544] lstrlenW (lpString=".DAT") returned 4 [0086.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".DAT") returned 0x0 [0086.544] lstrlenW (lpString=".ldf") returned 4 [0086.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.544] lstrlenW (lpString=".LDF") returned 4 [0086.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch=".LDF") returned 0x0 [0086.544] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.544] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.545] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.545] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20654610192) returned 1 [0086.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc26516b0, dwHighDateTime=0x1d585b4)) [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ca30 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ca30 | out: hHeap=0x260000) returned 1 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.546] GetLastError () returned 0x0 [0086.546] GetLastError () returned 0x0 [0086.546] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.546] GetLastError () returned 0x0 [0086.546] GetLastError () returned 0x0 [0086.548] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff628, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.548] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x9d8, lpOverlapped=0x0) returned 1 [0086.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.548] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.548] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.549] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.549] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.549] CloseHandle (hObject=0xe4) returned 1 [0086.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d2378 [0086.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d2378 | out: hHeap=0x260000) returned 1 [0086.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.551] GetLastError () returned 0x0 [0086.551] RtlWakeConditionVariable () returned 0x27e828 [0086.551] GetCurrentThreadId () returned 0x998 [0086.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".ldf") returned 0x0 [0086.551] lstrlenW (lpString=".vhd") returned 4 [0086.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".vhd") returned 0x0 [0086.551] lstrlenW (lpString=".vhdx") returned 5 [0086.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".vhdx") returned 0x0 [0086.551] lstrlenW (lpString=".pst") returned 4 [0086.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".pst") returned 0x0 [0086.551] lstrlenW (lpString=".ost") returned 4 [0086.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".ost") returned 0x0 [0086.551] lstrlenW (lpString=".bak") returned 4 [0086.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".bak") returned 0x0 [0086.551] lstrlenW (lpString=".bac") returned 4 [0086.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".bac") returned 0x0 [0086.552] lstrlenW (lpString=".sys") returned 4 [0086.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".sys") returned 0x0 [0086.552] lstrlenW (lpString=".v2i") returned 4 [0086.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".v2i") returned 0x0 [0086.552] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.553] lstrlenW (lpString=".sql") returned 4 [0086.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".sql") returned 0x0 [0086.553] lstrlenW (lpString=".mdf") returned 4 [0086.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".mdf") returned 0x0 [0086.553] lstrlenW (lpString=".txt") returned 4 [0086.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".txt") returned 0x0 [0086.553] lstrlenW (lpString=".dbf") returned 4 [0086.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".dbf") returned 0x0 [0086.553] lstrlenW (lpString=".ckp") returned 4 [0086.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".ckp") returned 0x0 [0086.554] lstrlenW (lpString=".dacpac") returned 7 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".dacpac") returned 0x0 [0086.554] lstrlenW (lpString=".db3") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".db3") returned 0x0 [0086.554] lstrlenW (lpString=".dtxs") returned 5 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".dtxs") returned 0x0 [0086.554] lstrlenW (lpString=".mdt") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".mdt") returned 0x0 [0086.554] lstrlenW (lpString=".sdf") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".sdf") returned 0x0 [0086.554] lstrlenW (lpString=".MDF") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".MDF") returned 0x0 [0086.554] lstrlenW (lpString=".DBF") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".DBF") returned 0x0 [0086.554] lstrlenW (lpString=".DB") returned 3 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".DB") returned 0x0 [0086.554] lstrlenW (lpString=".db") returned 3 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".db") returned 0x0 [0086.554] lstrlenW (lpString=".ndf") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".ndf") returned 0x0 [0086.554] lstrlenW (lpString=".NDF") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".NDF") returned 0x0 [0086.554] lstrlenW (lpString=".Mdf") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".Mdf") returned 0x0 [0086.554] lstrlenW (lpString=".dat") returned 4 [0086.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".dat") returned 0x0 [0086.555] lstrlenW (lpString=".DAT") returned 4 [0086.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".DAT") returned 0x0 [0086.555] lstrlenW (lpString=".ldf") returned 4 [0086.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".ldf") returned 0x0 [0086.555] lstrlenW (lpString=".LDF") returned 4 [0086.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch=".LDF") returned 0x0 [0086.555] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.555] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.556] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.556] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.556] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20655703452) returned 1 [0086.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2677810, dwHighDateTime=0x1d585b4)) [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ca68 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ca68 | out: hHeap=0x260000) returned 1 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.557] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.557] GetLastError () returned 0x0 [0086.557] GetLastError () returned 0x0 [0086.557] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.557] GetLastError () returned 0x0 [0086.557] GetLastError () returned 0x0 [0086.633] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff9d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.633] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x630, lpOverlapped=0x0) returned 1 [0086.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.633] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.633] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.633] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.633] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.633] CloseHandle (hObject=0xe4) returned 1 [0086.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.635] GetLastError () returned 0x0 [0086.635] RtlWakeConditionVariable () returned 0x0 [0086.635] GetCurrentThreadId () returned 0x998 [0086.740] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.740] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.740] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.740] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.741] CloseHandle (hObject=0x11c) returned 1 [0086.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3453f0 | out: hHeap=0x260000) returned 1 [0086.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0086.742] RtlWakeConditionVariable () returned 0x0 [0086.742] GetCurrentThreadId () returned 0x998 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.742] lstrlenW (lpString=".vhd") returned 4 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".vhd") returned 0x0 [0086.742] lstrlenW (lpString=".vhdx") returned 5 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.742] lstrlenW (lpString=".pst") returned 4 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".pst") returned 0x0 [0086.742] lstrlenW (lpString=".ost") returned 4 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".ost") returned 0x0 [0086.742] lstrlenW (lpString=".bak") returned 4 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".bak") returned 0x0 [0086.742] lstrlenW (lpString=".bac") returned 4 [0086.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".bac") returned 0x0 [0086.742] lstrlenW (lpString=".sys") returned 4 [0086.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".sys") returned 0x0 [0086.743] lstrlenW (lpString=".v2i") returned 4 [0086.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".v2i") returned 0x0 [0086.743] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.744] lstrlenW (lpString=".sql") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".sql") returned 0x0 [0086.744] lstrlenW (lpString=".mdf") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".mdf") returned 0x0 [0086.744] lstrlenW (lpString=".txt") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".txt") returned 0x0 [0086.744] lstrlenW (lpString=".dbf") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".dbf") returned 0x0 [0086.744] lstrlenW (lpString=".ckp") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".ckp") returned 0x0 [0086.744] lstrlenW (lpString=".dacpac") returned 7 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.744] lstrlenW (lpString=".db3") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".db3") returned 0x0 [0086.744] lstrlenW (lpString=".dtxs") returned 5 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.744] lstrlenW (lpString=".mdt") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".mdt") returned 0x0 [0086.744] lstrlenW (lpString=".sdf") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".sdf") returned 0x0 [0086.744] lstrlenW (lpString=".MDF") returned 4 [0086.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".MDF") returned 0x0 [0086.744] lstrlenW (lpString=".DBF") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".DBF") returned 0x0 [0086.745] lstrlenW (lpString=".DB") returned 3 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".DB") returned 0x0 [0086.745] lstrlenW (lpString=".db") returned 3 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".db") returned 0x0 [0086.745] lstrlenW (lpString=".ndf") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".ndf") returned 0x0 [0086.745] lstrlenW (lpString=".NDF") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".NDF") returned 0x0 [0086.745] lstrlenW (lpString=".Mdf") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.745] lstrlenW (lpString=".dat") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".dat") returned 0x0 [0086.745] lstrlenW (lpString=".DAT") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".DAT") returned 0x0 [0086.745] lstrlenW (lpString=".ldf") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.745] lstrlenW (lpString=".LDF") returned 4 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch=".LDF") returned 0x0 [0086.745] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.745] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.746] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.746] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20674754626) returned 1 [0086.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2840890, dwHighDateTime=0x1d585b4)) [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33ccd0 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ccd0 | out: hHeap=0x260000) returned 1 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.747] GetLastError () returned 0x0 [0086.747] GetLastError () returned 0x0 [0086.748] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.748] GetLastError () returned 0x0 [0086.748] GetLastError () returned 0x0 [0086.751] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.751] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xca8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xca8, lpOverlapped=0x0) returned 1 [0086.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.751] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.751] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.752] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.752] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.752] CloseHandle (hObject=0x11c) returned 1 [0086.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0086.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.753] GetLastError () returned 0x0 [0086.753] RtlWakeConditionVariable () returned 0x0 [0086.754] GetCurrentThreadId () returned 0x998 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.754] lstrlenW (lpString=".vhd") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.754] lstrlenW (lpString=".vhdx") returned 5 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.754] lstrlenW (lpString=".pst") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.754] lstrlenW (lpString=".ost") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.754] lstrlenW (lpString=".bak") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.754] lstrlenW (lpString=".bac") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.754] lstrlenW (lpString=".sys") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.754] lstrlenW (lpString=".v2i") returned 4 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.754] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.756] lstrlenW (lpString=".sql") returned 4 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.756] lstrlenW (lpString=".mdf") returned 4 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.756] lstrlenW (lpString=".txt") returned 4 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.756] lstrlenW (lpString=".dbf") returned 4 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.756] lstrlenW (lpString=".ckp") returned 4 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.756] lstrlenW (lpString=".dacpac") returned 7 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.756] lstrlenW (lpString=".db3") returned 4 [0086.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.756] lstrlenW (lpString=".dtxs") returned 5 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.757] lstrlenW (lpString=".mdt") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.757] lstrlenW (lpString=".sdf") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.757] lstrlenW (lpString=".MDF") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.757] lstrlenW (lpString=".DBF") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.757] lstrlenW (lpString=".DB") returned 3 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.757] lstrlenW (lpString=".db") returned 3 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".db") returned 0x0 [0086.757] lstrlenW (lpString=".ndf") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.757] lstrlenW (lpString=".NDF") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.757] lstrlenW (lpString=".Mdf") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.757] lstrlenW (lpString=".dat") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.757] lstrlenW (lpString=".DAT") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.757] lstrlenW (lpString=".ldf") returned 4 [0086.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.757] lstrlenW (lpString=".LDF") returned 4 [0086.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.758] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.758] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.758] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.759] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.759] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20675985691) returned 1 [0086.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc28669f0, dwHighDateTime=0x1d585b4)) [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cd08 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cd08 | out: hHeap=0x260000) returned 1 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.759] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.760] GetLastError () returned 0x0 [0086.760] GetLastError () returned 0x0 [0086.760] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.760] GetLastError () returned 0x0 [0086.760] GetLastError () returned 0x0 [0086.762] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff675, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.762] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x98b, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x98b, lpOverlapped=0x0) returned 1 [0086.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.762] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.762] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.762] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.762] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.762] CloseHandle (hObject=0x11c) returned 1 [0086.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.764] GetLastError () returned 0x0 [0086.764] RtlWakeConditionVariable () returned 0x0 [0086.764] GetCurrentThreadId () returned 0x998 [0086.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.764] lstrlenW (lpString=".vhd") returned 4 [0086.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.764] lstrlenW (lpString=".vhdx") returned 5 [0086.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.764] lstrlenW (lpString=".pst") returned 4 [0086.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.764] lstrlenW (lpString=".ost") returned 4 [0086.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.764] lstrlenW (lpString=".bak") returned 4 [0086.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.764] lstrlenW (lpString=".bac") returned 4 [0086.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.765] lstrlenW (lpString=".sys") returned 4 [0086.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.765] lstrlenW (lpString=".v2i") returned 4 [0086.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.765] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.766] lstrlenW (lpString=".sql") returned 4 [0086.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.766] lstrlenW (lpString=".mdf") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.767] lstrlenW (lpString=".txt") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.767] lstrlenW (lpString=".dbf") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.767] lstrlenW (lpString=".ckp") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.767] lstrlenW (lpString=".dacpac") returned 7 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.767] lstrlenW (lpString=".db3") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.767] lstrlenW (lpString=".dtxs") returned 5 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.767] lstrlenW (lpString=".mdt") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.767] lstrlenW (lpString=".sdf") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.767] lstrlenW (lpString=".MDF") returned 4 [0086.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.767] lstrlenW (lpString=".DBF") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.768] lstrlenW (lpString=".DB") returned 3 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.768] lstrlenW (lpString=".db") returned 3 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.768] lstrlenW (lpString=".ndf") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.768] lstrlenW (lpString=".NDF") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.768] lstrlenW (lpString=".Mdf") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.768] lstrlenW (lpString=".dat") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.768] lstrlenW (lpString=".DAT") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.768] lstrlenW (lpString=".ldf") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.768] lstrlenW (lpString=".LDF") returned 4 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.768] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.768] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.769] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.769] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.769] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20677053258) returned 1 [0086.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc288cb50, dwHighDateTime=0x1d585b4)) [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cd40 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cd40 | out: hHeap=0x260000) returned 1 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.770] GetLastError () returned 0x0 [0086.770] GetLastError () returned 0x0 [0086.771] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.771] GetLastError () returned 0x0 [0086.771] GetLastError () returned 0x0 [0086.772] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.772] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x74, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x74, lpOverlapped=0x0) returned 1 [0086.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.772] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.772] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.772] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.772] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.772] CloseHandle (hObject=0x11c) returned 1 [0086.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0086.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.774] GetLastError () returned 0x0 [0086.774] RtlWakeConditionVariable () returned 0x0 [0086.774] GetCurrentThreadId () returned 0x998 [0086.774] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.774] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.774] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.774] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.776] CloseHandle (hObject=0x11c) returned 1 [0086.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313020 | out: hHeap=0x260000) returned 1 [0086.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.776] RtlWakeConditionVariable () returned 0x27e828 [0086.776] GetCurrentThreadId () returned 0x998 [0086.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".ldf") returned 0x0 [0086.777] lstrlenW (lpString=".vhd") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".vhd") returned 0x0 [0086.777] lstrlenW (lpString=".vhdx") returned 5 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".vhdx") returned 0x0 [0086.777] lstrlenW (lpString=".pst") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".pst") returned 0x0 [0086.777] lstrlenW (lpString=".ost") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".ost") returned 0x0 [0086.777] lstrlenW (lpString=".bak") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".bak") returned 0x0 [0086.777] lstrlenW (lpString=".bac") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".bac") returned 0x0 [0086.777] lstrlenW (lpString=".sys") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".sys") returned 0x0 [0086.777] lstrlenW (lpString=".v2i") returned 4 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".v2i") returned 0x0 [0086.777] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.778] lstrlenW (lpString=".sql") returned 4 [0086.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".sql") returned 0x0 [0086.778] lstrlenW (lpString=".mdf") returned 4 [0086.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".mdf") returned 0x0 [0086.778] lstrlenW (lpString=".txt") returned 4 [0086.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".txt") returned 0x0 [0086.778] lstrlenW (lpString=".dbf") returned 4 [0086.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".dbf") returned 0x0 [0086.778] lstrlenW (lpString=".ckp") returned 4 [0086.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".ckp") returned 0x0 [0086.778] lstrlenW (lpString=".dacpac") returned 7 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".dacpac") returned 0x0 [0086.779] lstrlenW (lpString=".db3") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".db3") returned 0x0 [0086.779] lstrlenW (lpString=".dtxs") returned 5 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".dtxs") returned 0x0 [0086.779] lstrlenW (lpString=".mdt") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".mdt") returned 0x0 [0086.779] lstrlenW (lpString=".sdf") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".sdf") returned 0x0 [0086.779] lstrlenW (lpString=".MDF") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".MDF") returned 0x0 [0086.779] lstrlenW (lpString=".DBF") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".DBF") returned 0x0 [0086.779] lstrlenW (lpString=".DB") returned 3 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".DB") returned 0x0 [0086.779] lstrlenW (lpString=".db") returned 3 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".db") returned 0x0 [0086.779] lstrlenW (lpString=".ndf") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".ndf") returned 0x0 [0086.779] lstrlenW (lpString=".NDF") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".NDF") returned 0x0 [0086.779] lstrlenW (lpString=".Mdf") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".Mdf") returned 0x0 [0086.779] lstrlenW (lpString=".dat") returned 4 [0086.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".dat") returned 0x0 [0086.779] lstrlenW (lpString=".DAT") returned 4 [0086.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".DAT") returned 0x0 [0086.780] lstrlenW (lpString=".ldf") returned 4 [0086.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".ldf") returned 0x0 [0086.780] lstrlenW (lpString=".LDF") returned 4 [0086.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch=".LDF") returned 0x0 [0086.780] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.780] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.781] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.781] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.781] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20678201058) returned 1 [0086.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc288cb50, dwHighDateTime=0x1d585b4)) [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.782] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.782] GetLastError () returned 0x0 [0086.782] GetLastError () returned 0x0 [0086.782] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.782] GetLastError () returned 0x0 [0086.782] GetLastError () returned 0x0 [0086.784] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff418, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.784] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xbe8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xbe8, lpOverlapped=0x0) returned 1 [0086.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.784] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.785] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.785] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.785] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.785] CloseHandle (hObject=0x11c) returned 1 [0086.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.785] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.786] GetLastError () returned 0x0 [0086.786] RtlWakeConditionVariable () returned 0x0 [0086.786] GetCurrentThreadId () returned 0x998 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".ldf") returned 0x0 [0086.787] lstrlenW (lpString=".vhd") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".vhd") returned 0x0 [0086.787] lstrlenW (lpString=".vhdx") returned 5 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.787] lstrlenW (lpString=".pst") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".pst") returned 0x0 [0086.787] lstrlenW (lpString=".ost") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".ost") returned 0x0 [0086.787] lstrlenW (lpString=".bak") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".bak") returned 0x0 [0086.787] lstrlenW (lpString=".bac") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".bac") returned 0x0 [0086.787] lstrlenW (lpString=".sys") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".sys") returned 0x0 [0086.787] lstrlenW (lpString=".v2i") returned 4 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".v2i") returned 0x0 [0086.787] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.788] lstrlenW (lpString=".sql") returned 4 [0086.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".sql") returned 0x0 [0086.788] lstrlenW (lpString=".mdf") returned 4 [0086.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".mdf") returned 0x0 [0086.788] lstrlenW (lpString=".txt") returned 4 [0086.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".txt") returned 0x0 [0086.789] lstrlenW (lpString=".dbf") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".dbf") returned 0x0 [0086.789] lstrlenW (lpString=".ckp") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".ckp") returned 0x0 [0086.789] lstrlenW (lpString=".dacpac") returned 7 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.789] lstrlenW (lpString=".db3") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".db3") returned 0x0 [0086.789] lstrlenW (lpString=".dtxs") returned 5 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.789] lstrlenW (lpString=".mdt") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".mdt") returned 0x0 [0086.789] lstrlenW (lpString=".sdf") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".sdf") returned 0x0 [0086.789] lstrlenW (lpString=".MDF") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".MDF") returned 0x0 [0086.789] lstrlenW (lpString=".DBF") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".DBF") returned 0x0 [0086.789] lstrlenW (lpString=".DB") returned 3 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".DB") returned 0x0 [0086.789] lstrlenW (lpString=".db") returned 3 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".db") returned 0x0 [0086.789] lstrlenW (lpString=".ndf") returned 4 [0086.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".ndf") returned 0x0 [0086.789] lstrlenW (lpString=".NDF") returned 4 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".NDF") returned 0x0 [0086.790] lstrlenW (lpString=".Mdf") returned 4 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.790] lstrlenW (lpString=".dat") returned 4 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".dat") returned 0x0 [0086.790] lstrlenW (lpString=".DAT") returned 4 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".DAT") returned 0x0 [0086.790] lstrlenW (lpString=".ldf") returned 4 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".ldf") returned 0x0 [0086.790] lstrlenW (lpString=".LDF") returned 4 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch=".LDF") returned 0x0 [0086.790] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.790] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.791] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.791] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.791] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20679222140) returned 1 [0086.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc28b2cb0, dwHighDateTime=0x1d585b4)) [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0086.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.792] GetLastError () returned 0x0 [0086.792] GetLastError () returned 0x0 [0086.792] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.792] GetLastError () returned 0x0 [0086.792] GetLastError () returned 0x0 [0086.794] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff6dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.794] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x924, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x924, lpOverlapped=0x0) returned 1 [0086.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.794] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.795] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.795] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.795] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.795] CloseHandle (hObject=0x11c) returned 1 [0086.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.796] GetLastError () returned 0x0 [0086.796] RtlWakeConditionVariable () returned 0x0 [0086.796] GetCurrentThreadId () returned 0x998 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".ldf") returned 0x0 [0086.797] lstrlenW (lpString=".vhd") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".vhd") returned 0x0 [0086.797] lstrlenW (lpString=".vhdx") returned 5 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".vhdx") returned 0x0 [0086.797] lstrlenW (lpString=".pst") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".pst") returned 0x0 [0086.797] lstrlenW (lpString=".ost") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".ost") returned 0x0 [0086.797] lstrlenW (lpString=".bak") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".bak") returned 0x0 [0086.797] lstrlenW (lpString=".bac") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".bac") returned 0x0 [0086.797] lstrlenW (lpString=".sys") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".sys") returned 0x0 [0086.797] lstrlenW (lpString=".v2i") returned 4 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".v2i") returned 0x0 [0086.797] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.799] lstrlenW (lpString=".sql") returned 4 [0086.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".sql") returned 0x0 [0086.799] lstrlenW (lpString=".mdf") returned 4 [0086.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".mdf") returned 0x0 [0086.799] lstrlenW (lpString=".txt") returned 4 [0086.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".txt") returned 0x0 [0086.799] lstrlenW (lpString=".dbf") returned 4 [0086.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".dbf") returned 0x0 [0086.799] lstrlenW (lpString=".ckp") returned 4 [0086.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".ckp") returned 0x0 [0086.799] lstrlenW (lpString=".dacpac") returned 7 [0086.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".dacpac") returned 0x0 [0086.799] lstrlenW (lpString=".db3") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".db3") returned 0x0 [0086.800] lstrlenW (lpString=".dtxs") returned 5 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".dtxs") returned 0x0 [0086.800] lstrlenW (lpString=".mdt") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".mdt") returned 0x0 [0086.800] lstrlenW (lpString=".sdf") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".sdf") returned 0x0 [0086.800] lstrlenW (lpString=".MDF") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".MDF") returned 0x0 [0086.800] lstrlenW (lpString=".DBF") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".DBF") returned 0x0 [0086.800] lstrlenW (lpString=".DB") returned 3 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".DB") returned 0x0 [0086.800] lstrlenW (lpString=".db") returned 3 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".db") returned 0x0 [0086.800] lstrlenW (lpString=".ndf") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".ndf") returned 0x0 [0086.800] lstrlenW (lpString=".NDF") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".NDF") returned 0x0 [0086.800] lstrlenW (lpString=".Mdf") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".Mdf") returned 0x0 [0086.800] lstrlenW (lpString=".dat") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".dat") returned 0x0 [0086.800] lstrlenW (lpString=".DAT") returned 4 [0086.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".DAT") returned 0x0 [0086.801] lstrlenW (lpString=".ldf") returned 4 [0086.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".ldf") returned 0x0 [0086.801] lstrlenW (lpString=".LDF") returned 4 [0086.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch=".LDF") returned 0x0 [0086.801] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.801] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.802] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.802] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.802] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20680299432) returned 1 [0086.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc28d8e10, dwHighDateTime=0x1d585b4)) [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c98 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.803] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.803] GetLastError () returned 0x0 [0086.803] GetLastError () returned 0x0 [0086.803] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.803] GetLastError () returned 0x0 [0086.803] GetLastError () returned 0x0 [0086.805] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.805] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0xae8, lpOverlapped=0x0) returned 1 [0086.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.805] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.805] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.805] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.805] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.806] CloseHandle (hObject=0x11c) returned 1 [0086.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.806] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.807] GetLastError () returned 0x0 [0086.807] RtlWakeConditionVariable () returned 0x0 [0086.807] GetCurrentThreadId () returned 0x998 [0086.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".ldf") returned 0x0 [0086.807] lstrlenW (lpString=".vhd") returned 4 [0086.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".vhd") returned 0x0 [0086.807] lstrlenW (lpString=".vhdx") returned 5 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".vhdx") returned 0x0 [0086.808] lstrlenW (lpString=".pst") returned 4 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".pst") returned 0x0 [0086.808] lstrlenW (lpString=".ost") returned 4 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".ost") returned 0x0 [0086.808] lstrlenW (lpString=".bak") returned 4 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".bak") returned 0x0 [0086.808] lstrlenW (lpString=".bac") returned 4 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".bac") returned 0x0 [0086.808] lstrlenW (lpString=".sys") returned 4 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".sys") returned 0x0 [0086.808] lstrlenW (lpString=".v2i") returned 4 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".v2i") returned 0x0 [0086.808] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0086.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.809] lstrlenW (lpString=".sql") returned 4 [0086.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".sql") returned 0x0 [0086.809] lstrlenW (lpString=".mdf") returned 4 [0086.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".mdf") returned 0x0 [0086.809] lstrlenW (lpString=".txt") returned 4 [0086.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".txt") returned 0x0 [0086.809] lstrlenW (lpString=".dbf") returned 4 [0086.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".dbf") returned 0x0 [0086.809] lstrlenW (lpString=".ckp") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".ckp") returned 0x0 [0086.810] lstrlenW (lpString=".dacpac") returned 7 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".dacpac") returned 0x0 [0086.810] lstrlenW (lpString=".db3") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".db3") returned 0x0 [0086.810] lstrlenW (lpString=".dtxs") returned 5 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".dtxs") returned 0x0 [0086.810] lstrlenW (lpString=".mdt") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".mdt") returned 0x0 [0086.810] lstrlenW (lpString=".sdf") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".sdf") returned 0x0 [0086.810] lstrlenW (lpString=".MDF") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".MDF") returned 0x0 [0086.810] lstrlenW (lpString=".DBF") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".DBF") returned 0x0 [0086.810] lstrlenW (lpString=".DB") returned 3 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".DB") returned 0x0 [0086.810] lstrlenW (lpString=".db") returned 3 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".db") returned 0x0 [0086.810] lstrlenW (lpString=".ndf") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".ndf") returned 0x0 [0086.810] lstrlenW (lpString=".NDF") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".NDF") returned 0x0 [0086.810] lstrlenW (lpString=".Mdf") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".Mdf") returned 0x0 [0086.810] lstrlenW (lpString=".dat") returned 4 [0086.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".dat") returned 0x0 [0086.811] lstrlenW (lpString=".DAT") returned 4 [0086.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".DAT") returned 0x0 [0086.811] lstrlenW (lpString=".ldf") returned 4 [0086.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".ldf") returned 0x0 [0086.811] lstrlenW (lpString=".LDF") returned 4 [0086.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch=".LDF") returned 0x0 [0086.811] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.811] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.812] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.812] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.812] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20681305592) returned 1 [0086.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc28d8e10, dwHighDateTime=0x1d585b4)) [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bb8 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.813] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.813] GetLastError () returned 0x0 [0086.813] GetLastError () returned 0x0 [0086.813] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.813] GetLastError () returned 0x0 [0086.813] GetLastError () returned 0x0 [0086.825] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff9eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.826] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x614e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x614e, lpOverlapped=0x0) returned 1 [0086.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0086.828] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.828] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.828] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.828] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.828] CloseHandle (hObject=0x11c) returned 1 [0086.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.852] GetLastError () returned 0x0 [0086.852] RtlWakeConditionVariable () returned 0x27e828 [0086.857] GetCurrentThreadId () returned 0x998 [0086.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".ldf") returned 0x0 [0086.864] lstrlenW (lpString=".vhd") returned 4 [0086.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".vhd") returned 0x0 [0086.864] lstrlenW (lpString=".vhdx") returned 5 [0086.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".vhdx") returned 0x0 [0086.864] lstrlenW (lpString=".pst") returned 4 [0086.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".pst") returned 0x0 [0086.864] lstrlenW (lpString=".ost") returned 4 [0086.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".ost") returned 0x0 [0086.864] lstrlenW (lpString=".bak") returned 4 [0086.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".bak") returned 0x0 [0086.864] lstrlenW (lpString=".bac") returned 4 [0086.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".bac") returned 0x0 [0086.865] lstrlenW (lpString=".sys") returned 4 [0086.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".sys") returned 0x0 [0086.865] lstrlenW (lpString=".v2i") returned 4 [0086.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".v2i") returned 0x0 [0086.865] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.867] lstrlenW (lpString=".sql") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".sql") returned 0x0 [0086.867] lstrlenW (lpString=".mdf") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".mdf") returned 0x0 [0086.867] lstrlenW (lpString=".txt") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".txt") returned 0x0 [0086.867] lstrlenW (lpString=".dbf") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".dbf") returned 0x0 [0086.867] lstrlenW (lpString=".ckp") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".ckp") returned 0x0 [0086.867] lstrlenW (lpString=".dacpac") returned 7 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".dacpac") returned 0x0 [0086.867] lstrlenW (lpString=".db3") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".db3") returned 0x0 [0086.867] lstrlenW (lpString=".dtxs") returned 5 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".dtxs") returned 0x0 [0086.867] lstrlenW (lpString=".mdt") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".mdt") returned 0x0 [0086.867] lstrlenW (lpString=".sdf") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".sdf") returned 0x0 [0086.867] lstrlenW (lpString=".MDF") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".MDF") returned 0x0 [0086.867] lstrlenW (lpString=".DBF") returned 4 [0086.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".DBF") returned 0x0 [0086.868] lstrlenW (lpString=".DB") returned 3 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".DB") returned 0x0 [0086.868] lstrlenW (lpString=".db") returned 3 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".db") returned 0x0 [0086.868] lstrlenW (lpString=".ndf") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".ndf") returned 0x0 [0086.868] lstrlenW (lpString=".NDF") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".NDF") returned 0x0 [0086.868] lstrlenW (lpString=".Mdf") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".Mdf") returned 0x0 [0086.868] lstrlenW (lpString=".dat") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".dat") returned 0x0 [0086.868] lstrlenW (lpString=".DAT") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".DAT") returned 0x0 [0086.868] lstrlenW (lpString=".ldf") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".ldf") returned 0x0 [0086.868] lstrlenW (lpString=".LDF") returned 4 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch=".LDF") returned 0x0 [0086.868] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.868] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.869] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.869] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.869] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20687050288) returned 1 [0086.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2971390, dwHighDateTime=0x1d585b4)) [0086.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1aa0 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1aa0 | out: hHeap=0x260000) returned 1 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.870] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.870] GetLastError () returned 0x0 [0086.870] GetLastError () returned 0x0 [0086.871] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.871] GetLastError () returned 0x0 [0086.871] GetLastError () returned 0x0 [0086.874] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa970, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.875] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x5690, lpOverlapped=0x0) returned 1 [0086.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.875] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.875] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.875] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.875] CloseHandle (hObject=0x11c) returned 1 [0086.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.877] GetLastError () returned 0x0 [0086.877] RtlWakeConditionVariable () returned 0x0 [0086.877] GetCurrentThreadId () returned 0x998 [0086.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".ldf") returned 0x0 [0086.877] lstrlenW (lpString=".vhd") returned 4 [0086.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".vhd") returned 0x0 [0086.877] lstrlenW (lpString=".vhdx") returned 5 [0086.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".vhdx") returned 0x0 [0086.877] lstrlenW (lpString=".pst") returned 4 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".pst") returned 0x0 [0086.878] lstrlenW (lpString=".ost") returned 4 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".ost") returned 0x0 [0086.878] lstrlenW (lpString=".bak") returned 4 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".bak") returned 0x0 [0086.878] lstrlenW (lpString=".bac") returned 4 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".bac") returned 0x0 [0086.878] lstrlenW (lpString=".sys") returned 4 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".sys") returned 0x0 [0086.878] lstrlenW (lpString=".v2i") returned 4 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".v2i") returned 0x0 [0086.878] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.879] lstrlenW (lpString=".sql") returned 4 [0086.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".sql") returned 0x0 [0086.879] lstrlenW (lpString=".mdf") returned 4 [0086.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".mdf") returned 0x0 [0086.879] lstrlenW (lpString=".txt") returned 4 [0086.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".txt") returned 0x0 [0086.879] lstrlenW (lpString=".dbf") returned 4 [0086.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".dbf") returned 0x0 [0086.879] lstrlenW (lpString=".ckp") returned 4 [0086.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".ckp") returned 0x0 [0086.879] lstrlenW (lpString=".dacpac") returned 7 [0086.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".dacpac") returned 0x0 [0086.879] lstrlenW (lpString=".db3") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".db3") returned 0x0 [0086.880] lstrlenW (lpString=".dtxs") returned 5 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".dtxs") returned 0x0 [0086.880] lstrlenW (lpString=".mdt") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".mdt") returned 0x0 [0086.880] lstrlenW (lpString=".sdf") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".sdf") returned 0x0 [0086.880] lstrlenW (lpString=".MDF") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".MDF") returned 0x0 [0086.880] lstrlenW (lpString=".DBF") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".DBF") returned 0x0 [0086.880] lstrlenW (lpString=".DB") returned 3 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".DB") returned 0x0 [0086.880] lstrlenW (lpString=".db") returned 3 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".db") returned 0x0 [0086.880] lstrlenW (lpString=".ndf") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".ndf") returned 0x0 [0086.880] lstrlenW (lpString=".NDF") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".NDF") returned 0x0 [0086.880] lstrlenW (lpString=".Mdf") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".Mdf") returned 0x0 [0086.880] lstrlenW (lpString=".dat") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".dat") returned 0x0 [0086.880] lstrlenW (lpString=".DAT") returned 4 [0086.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".DAT") returned 0x0 [0086.881] lstrlenW (lpString=".ldf") returned 4 [0086.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".ldf") returned 0x0 [0086.881] lstrlenW (lpString=".LDF") returned 4 [0086.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch=".LDF") returned 0x0 [0086.881] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.881] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.882] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.882] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.882] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20688298111) returned 1 [0086.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc29974f0, dwHighDateTime=0x1d585b4)) [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cd78 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cd78 | out: hHeap=0x260000) returned 1 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.883] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.883] GetLastError () returned 0x0 [0086.883] GetLastError () returned 0x0 [0086.883] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.883] GetLastError () returned 0x0 [0086.883] GetLastError () returned 0x0 [0086.884] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.884] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x6a, lpOverlapped=0x0) returned 1 [0086.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.885] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.885] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.885] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.887] CloseHandle (hObject=0x11c) returned 1 [0086.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.889] GetLastError () returned 0x0 [0086.889] RtlWakeConditionVariable () returned 0x27e828 [0086.889] GetCurrentThreadId () returned 0x998 [0086.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".ldf") returned 0x0 [0086.890] lstrlenW (lpString=".vhd") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".vhd") returned 0x0 [0086.890] lstrlenW (lpString=".vhdx") returned 5 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".vhdx") returned 0x0 [0086.890] lstrlenW (lpString=".pst") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".pst") returned 0x0 [0086.890] lstrlenW (lpString=".ost") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".ost") returned 0x0 [0086.890] lstrlenW (lpString=".bak") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".bak") returned 0x0 [0086.890] lstrlenW (lpString=".bac") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".bac") returned 0x0 [0086.890] lstrlenW (lpString=".sys") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".sys") returned 0x0 [0086.890] lstrlenW (lpString=".v2i") returned 4 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".v2i") returned 0x0 [0086.890] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.891] lstrlenW (lpString=".sql") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".sql") returned 0x0 [0086.892] lstrlenW (lpString=".mdf") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".mdf") returned 0x0 [0086.892] lstrlenW (lpString=".txt") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".txt") returned 0x0 [0086.892] lstrlenW (lpString=".dbf") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".dbf") returned 0x0 [0086.892] lstrlenW (lpString=".ckp") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".ckp") returned 0x0 [0086.892] lstrlenW (lpString=".dacpac") returned 7 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".dacpac") returned 0x0 [0086.964] lstrlenW (lpString=".db3") returned 4 [0086.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".db3") returned 0x0 [0086.964] lstrlenW (lpString=".dtxs") returned 5 [0086.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".dtxs") returned 0x0 [0086.975] lstrlenW (lpString=".mdt") returned 4 [0086.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".mdt") returned 0x0 [0086.975] lstrlenW (lpString=".sdf") returned 4 [0086.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".sdf") returned 0x0 [0086.988] lstrlenW (lpString=".MDF") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".MDF") returned 0x0 [0086.989] lstrlenW (lpString=".DBF") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".DBF") returned 0x0 [0086.989] lstrlenW (lpString=".DB") returned 3 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".DB") returned 0x0 [0086.989] lstrlenW (lpString=".db") returned 3 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".db") returned 0x0 [0086.989] lstrlenW (lpString=".ndf") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".ndf") returned 0x0 [0086.989] lstrlenW (lpString=".NDF") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".NDF") returned 0x0 [0086.989] lstrlenW (lpString=".Mdf") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".Mdf") returned 0x0 [0086.989] lstrlenW (lpString=".dat") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".dat") returned 0x0 [0086.989] lstrlenW (lpString=".DAT") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".DAT") returned 0x0 [0086.989] lstrlenW (lpString=".ldf") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".ldf") returned 0x0 [0086.989] lstrlenW (lpString=".LDF") returned 4 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch=".LDF") returned 0x0 [0086.989] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0086.990] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0086.990] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0086.990] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0086.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.990] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20699159408) returned 1 [0086.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2aa1e90, dwHighDateTime=0x1d585b4)) [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cf70 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cf70 | out: hHeap=0x260000) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.991] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0086.991] GetLastError () returned 0x0 [0086.991] GetLastError () returned 0x0 [0086.992] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0086.992] GetLastError () returned 0x0 [0086.992] GetLastError () returned 0x0 [0086.998] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffde5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.998] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x21a6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x21a6, lpOverlapped=0x0) returned 1 [0086.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.998] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.998] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.998] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.999] CloseHandle (hObject=0x11c) returned 1 [0086.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.087] GetLastError () returned 0x0 [0087.088] RtlWakeConditionVariable () returned 0x27e828 [0087.088] GetCurrentThreadId () returned 0x998 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".ldf") returned 0x0 [0087.088] lstrlenW (lpString=".vhd") returned 4 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".vhd") returned 0x0 [0087.088] lstrlenW (lpString=".vhdx") returned 5 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".vhdx") returned 0x0 [0087.088] lstrlenW (lpString=".pst") returned 4 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".pst") returned 0x0 [0087.088] lstrlenW (lpString=".ost") returned 4 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".ost") returned 0x0 [0087.088] lstrlenW (lpString=".bak") returned 4 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".bak") returned 0x0 [0087.088] lstrlenW (lpString=".bac") returned 4 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".bac") returned 0x0 [0087.088] lstrlenW (lpString=".sys") returned 4 [0087.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".sys") returned 0x0 [0087.088] lstrlenW (lpString=".v2i") returned 4 [0087.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".v2i") returned 0x0 [0087.089] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.090] lstrlenW (lpString=".sql") returned 4 [0087.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".sql") returned 0x0 [0087.090] lstrlenW (lpString=".mdf") returned 4 [0087.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".mdf") returned 0x0 [0087.090] lstrlenW (lpString=".txt") returned 4 [0087.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".txt") returned 0x0 [0087.090] lstrlenW (lpString=".dbf") returned 4 [0087.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".dbf") returned 0x0 [0087.090] lstrlenW (lpString=".ckp") returned 4 [0087.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".ckp") returned 0x0 [0087.090] lstrlenW (lpString=".dacpac") returned 7 [0087.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".dacpac") returned 0x0 [0087.091] lstrlenW (lpString=".db3") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".db3") returned 0x0 [0087.091] lstrlenW (lpString=".dtxs") returned 5 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".dtxs") returned 0x0 [0087.091] lstrlenW (lpString=".mdt") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".mdt") returned 0x0 [0087.091] lstrlenW (lpString=".sdf") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".sdf") returned 0x0 [0087.091] lstrlenW (lpString=".MDF") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".MDF") returned 0x0 [0087.091] lstrlenW (lpString=".DBF") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".DBF") returned 0x0 [0087.091] lstrlenW (lpString=".DB") returned 3 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".DB") returned 0x0 [0087.091] lstrlenW (lpString=".db") returned 3 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".db") returned 0x0 [0087.091] lstrlenW (lpString=".ndf") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".ndf") returned 0x0 [0087.091] lstrlenW (lpString=".NDF") returned 4 [0087.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".NDF") returned 0x0 [0087.091] lstrlenW (lpString=".Mdf") returned 4 [0087.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".Mdf") returned 0x0 [0087.092] lstrlenW (lpString=".dat") returned 4 [0087.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".dat") returned 0x0 [0087.092] lstrlenW (lpString=".DAT") returned 4 [0087.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".DAT") returned 0x0 [0087.092] lstrlenW (lpString=".ldf") returned 4 [0087.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".ldf") returned 0x0 [0087.092] lstrlenW (lpString=".LDF") returned 4 [0087.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch=".LDF") returned 0x0 [0087.092] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.092] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.093] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.093] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.093] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20709453200) returned 1 [0087.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2b866d0, dwHighDateTime=0x1d585b4)) [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f02d8 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02d8 | out: hHeap=0x260000) returned 1 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.094] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.094] GetLastError () returned 0x0 [0087.095] GetLastError () returned 0x0 [0087.095] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.095] GetLastError () returned 0x0 [0087.095] GetLastError () returned 0x0 [0087.112] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc598, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.113] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3a68, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3a68, lpOverlapped=0x0) returned 1 [0087.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.113] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.113] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.113] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.113] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.114] CloseHandle (hObject=0x11c) returned 1 [0087.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.116] GetLastError () returned 0x0 [0087.117] RtlWakeConditionVariable () returned 0x27e828 [0087.117] GetCurrentThreadId () returned 0x998 [0087.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.117] lstrlenW (lpString=".vhd") returned 4 [0087.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".vhd") returned 0x0 [0087.117] lstrlenW (lpString=".vhdx") returned 5 [0087.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".vhdx") returned 0x0 [0087.117] lstrlenW (lpString=".pst") returned 4 [0087.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".pst") returned 0x0 [0087.117] lstrlenW (lpString=".ost") returned 4 [0087.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".ost") returned 0x0 [0087.117] lstrlenW (lpString=".bak") returned 4 [0087.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".bak") returned 0x0 [0087.118] lstrlenW (lpString=".bac") returned 4 [0087.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".bac") returned 0x0 [0087.118] lstrlenW (lpString=".sys") returned 4 [0087.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".sys") returned 0x0 [0087.118] lstrlenW (lpString=".v2i") returned 4 [0087.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".v2i") returned 0x0 [0087.118] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.119] lstrlenW (lpString=".sql") returned 4 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".sql") returned 0x0 [0087.120] lstrlenW (lpString=".mdf") returned 4 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".mdf") returned 0x0 [0087.120] lstrlenW (lpString=".txt") returned 4 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".txt") returned 0x0 [0087.120] lstrlenW (lpString=".dbf") returned 4 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".dbf") returned 0x0 [0087.120] lstrlenW (lpString=".ckp") returned 4 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".ckp") returned 0x0 [0087.120] lstrlenW (lpString=".dacpac") returned 7 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".dacpac") returned 0x0 [0087.120] lstrlenW (lpString=".db3") returned 4 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".db3") returned 0x0 [0087.120] lstrlenW (lpString=".dtxs") returned 5 [0087.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".dtxs") returned 0x0 [0087.120] lstrlenW (lpString=".mdt") returned 4 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".mdt") returned 0x0 [0087.121] lstrlenW (lpString=".sdf") returned 4 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".sdf") returned 0x0 [0087.121] lstrlenW (lpString=".MDF") returned 4 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".MDF") returned 0x0 [0087.121] lstrlenW (lpString=".DBF") returned 4 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".DBF") returned 0x0 [0087.121] lstrlenW (lpString=".DB") returned 3 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".DB") returned 0x0 [0087.121] lstrlenW (lpString=".db") returned 3 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".db") returned 0x0 [0087.121] lstrlenW (lpString=".ndf") returned 4 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".ndf") returned 0x0 [0087.121] lstrlenW (lpString=".NDF") returned 4 [0087.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".NDF") returned 0x0 [0087.121] lstrlenW (lpString=".Mdf") returned 4 [0087.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".Mdf") returned 0x0 [0087.122] lstrlenW (lpString=".dat") returned 4 [0087.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".dat") returned 0x0 [0087.122] lstrlenW (lpString=".DAT") returned 4 [0087.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".DAT") returned 0x0 [0087.122] lstrlenW (lpString=".ldf") returned 4 [0087.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.122] lstrlenW (lpString=".LDF") returned 4 [0087.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch=".LDF") returned 0x0 [0087.122] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.122] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.123] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.124] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20712477457) returned 1 [0087.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2bd2990, dwHighDateTime=0x1d585b4)) [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0268 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0268 | out: hHeap=0x260000) returned 1 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.125] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.125] GetLastError () returned 0x0 [0087.125] GetLastError () returned 0x0 [0087.125] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.126] GetLastError () returned 0x0 [0087.126] GetLastError () returned 0x0 [0087.204] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffcc2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.204] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x33d6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x33d6, lpOverlapped=0x0) returned 1 [0087.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.205] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.205] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.205] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.205] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.205] CloseHandle (hObject=0x11c) returned 1 [0087.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.221] GetLastError () returned 0x0 [0087.221] RtlWakeConditionVariable () returned 0x0 [0087.221] GetCurrentThreadId () returned 0x998 [0087.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".ldf") returned 0x0 [0087.221] lstrlenW (lpString=".vhd") returned 4 [0087.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".vhd") returned 0x0 [0087.222] lstrlenW (lpString=".vhdx") returned 5 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".vhdx") returned 0x0 [0087.222] lstrlenW (lpString=".pst") returned 4 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".pst") returned 0x0 [0087.222] lstrlenW (lpString=".ost") returned 4 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".ost") returned 0x0 [0087.222] lstrlenW (lpString=".bak") returned 4 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".bak") returned 0x0 [0087.222] lstrlenW (lpString=".bac") returned 4 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".bac") returned 0x0 [0087.222] lstrlenW (lpString=".sys") returned 4 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".sys") returned 0x0 [0087.222] lstrlenW (lpString=".v2i") returned 4 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".v2i") returned 0x0 [0087.222] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.223] lstrlenW (lpString=".sql") returned 4 [0087.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".sql") returned 0x0 [0087.223] lstrlenW (lpString=".mdf") returned 4 [0087.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".mdf") returned 0x0 [0087.224] lstrlenW (lpString=".txt") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".txt") returned 0x0 [0087.224] lstrlenW (lpString=".dbf") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".dbf") returned 0x0 [0087.224] lstrlenW (lpString=".ckp") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".ckp") returned 0x0 [0087.224] lstrlenW (lpString=".dacpac") returned 7 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".dacpac") returned 0x0 [0087.224] lstrlenW (lpString=".db3") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".db3") returned 0x0 [0087.224] lstrlenW (lpString=".dtxs") returned 5 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".dtxs") returned 0x0 [0087.224] lstrlenW (lpString=".mdt") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".mdt") returned 0x0 [0087.224] lstrlenW (lpString=".sdf") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".sdf") returned 0x0 [0087.224] lstrlenW (lpString=".MDF") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".MDF") returned 0x0 [0087.224] lstrlenW (lpString=".DBF") returned 4 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".DBF") returned 0x0 [0087.224] lstrlenW (lpString=".DB") returned 3 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".DB") returned 0x0 [0087.224] lstrlenW (lpString=".db") returned 3 [0087.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".db") returned 0x0 [0087.224] lstrlenW (lpString=".ndf") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".ndf") returned 0x0 [0087.225] lstrlenW (lpString=".NDF") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".NDF") returned 0x0 [0087.225] lstrlenW (lpString=".Mdf") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".Mdf") returned 0x0 [0087.225] lstrlenW (lpString=".dat") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".dat") returned 0x0 [0087.225] lstrlenW (lpString=".DAT") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".DAT") returned 0x0 [0087.225] lstrlenW (lpString=".ldf") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".ldf") returned 0x0 [0087.225] lstrlenW (lpString=".LDF") returned 4 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch=".LDF") returned 0x0 [0087.225] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.225] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.226] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.226] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.226] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20722732767) returned 1 [0087.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2cdd330, dwHighDateTime=0x1d585b4)) [0087.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d168 [0087.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d168 | out: hHeap=0x260000) returned 1 [0087.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.227] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.227] GetLastError () returned 0x0 [0087.227] GetLastError () returned 0x0 [0087.227] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.227] GetLastError () returned 0x0 [0087.228] GetLastError () returned 0x0 [0087.229] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc18e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.230] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3e72, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3e72, lpOverlapped=0x0) returned 1 [0087.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.230] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.230] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.230] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.230] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.230] CloseHandle (hObject=0x11c) returned 1 [0087.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.232] GetLastError () returned 0x0 [0087.232] RtlWakeConditionVariable () returned 0x0 [0087.232] GetCurrentThreadId () returned 0x998 [0087.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".ldf") returned 0x0 [0087.232] lstrlenW (lpString=".vhd") returned 4 [0087.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".vhd") returned 0x0 [0087.232] lstrlenW (lpString=".vhdx") returned 5 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".vhdx") returned 0x0 [0087.233] lstrlenW (lpString=".pst") returned 4 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".pst") returned 0x0 [0087.233] lstrlenW (lpString=".ost") returned 4 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".ost") returned 0x0 [0087.233] lstrlenW (lpString=".bak") returned 4 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".bak") returned 0x0 [0087.233] lstrlenW (lpString=".bac") returned 4 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".bac") returned 0x0 [0087.233] lstrlenW (lpString=".sys") returned 4 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".sys") returned 0x0 [0087.233] lstrlenW (lpString=".v2i") returned 4 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".v2i") returned 0x0 [0087.233] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.234] lstrlenW (lpString=".sql") returned 4 [0087.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".sql") returned 0x0 [0087.234] lstrlenW (lpString=".mdf") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".mdf") returned 0x0 [0087.235] lstrlenW (lpString=".txt") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".txt") returned 0x0 [0087.235] lstrlenW (lpString=".dbf") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".dbf") returned 0x0 [0087.235] lstrlenW (lpString=".ckp") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".ckp") returned 0x0 [0087.235] lstrlenW (lpString=".dacpac") returned 7 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".dacpac") returned 0x0 [0087.235] lstrlenW (lpString=".db3") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".db3") returned 0x0 [0087.235] lstrlenW (lpString=".dtxs") returned 5 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".dtxs") returned 0x0 [0087.235] lstrlenW (lpString=".mdt") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".mdt") returned 0x0 [0087.235] lstrlenW (lpString=".sdf") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".sdf") returned 0x0 [0087.235] lstrlenW (lpString=".MDF") returned 4 [0087.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".MDF") returned 0x0 [0087.235] lstrlenW (lpString=".DBF") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".DBF") returned 0x0 [0087.236] lstrlenW (lpString=".DB") returned 3 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".DB") returned 0x0 [0087.236] lstrlenW (lpString=".db") returned 3 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".db") returned 0x0 [0087.236] lstrlenW (lpString=".ndf") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".ndf") returned 0x0 [0087.236] lstrlenW (lpString=".NDF") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".NDF") returned 0x0 [0087.236] lstrlenW (lpString=".Mdf") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".Mdf") returned 0x0 [0087.236] lstrlenW (lpString=".dat") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".dat") returned 0x0 [0087.236] lstrlenW (lpString=".DAT") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".DAT") returned 0x0 [0087.236] lstrlenW (lpString=".ldf") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".ldf") returned 0x0 [0087.236] lstrlenW (lpString=".LDF") returned 4 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch=".LDF") returned 0x0 [0087.236] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.236] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.237] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.237] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20723854881) returned 1 [0087.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2d03490, dwHighDateTime=0x1d585b4)) [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d1a0 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d1a0 | out: hHeap=0x260000) returned 1 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.238] GetLastError () returned 0x0 [0087.239] GetLastError () returned 0x0 [0087.239] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.239] GetLastError () returned 0x0 [0087.239] GetLastError () returned 0x0 [0087.241] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffec66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.241] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x139a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x139a, lpOverlapped=0x0) returned 1 [0087.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.241] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.241] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.241] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.241] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.241] CloseHandle (hObject=0x11c) returned 1 [0087.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.243] GetLastError () returned 0x0 [0087.243] RtlWakeConditionVariable () returned 0x0 [0087.243] GetCurrentThreadId () returned 0x998 [0087.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".ldf") returned 0x0 [0087.243] lstrlenW (lpString=".vhd") returned 4 [0087.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".vhd") returned 0x0 [0087.244] lstrlenW (lpString=".vhdx") returned 5 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".vhdx") returned 0x0 [0087.244] lstrlenW (lpString=".pst") returned 4 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".pst") returned 0x0 [0087.244] lstrlenW (lpString=".ost") returned 4 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".ost") returned 0x0 [0087.244] lstrlenW (lpString=".bak") returned 4 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".bak") returned 0x0 [0087.244] lstrlenW (lpString=".bac") returned 4 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".bac") returned 0x0 [0087.244] lstrlenW (lpString=".sys") returned 4 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".sys") returned 0x0 [0087.244] lstrlenW (lpString=".v2i") returned 4 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".v2i") returned 0x0 [0087.244] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.245] lstrlenW (lpString=".sql") returned 4 [0087.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".sql") returned 0x0 [0087.245] lstrlenW (lpString=".mdf") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".mdf") returned 0x0 [0087.246] lstrlenW (lpString=".txt") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".txt") returned 0x0 [0087.246] lstrlenW (lpString=".dbf") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".dbf") returned 0x0 [0087.246] lstrlenW (lpString=".ckp") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".ckp") returned 0x0 [0087.246] lstrlenW (lpString=".dacpac") returned 7 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".dacpac") returned 0x0 [0087.246] lstrlenW (lpString=".db3") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".db3") returned 0x0 [0087.246] lstrlenW (lpString=".dtxs") returned 5 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".dtxs") returned 0x0 [0087.246] lstrlenW (lpString=".mdt") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".mdt") returned 0x0 [0087.246] lstrlenW (lpString=".sdf") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".sdf") returned 0x0 [0087.246] lstrlenW (lpString=".MDF") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".MDF") returned 0x0 [0087.246] lstrlenW (lpString=".DBF") returned 4 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".DBF") returned 0x0 [0087.246] lstrlenW (lpString=".DB") returned 3 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".DB") returned 0x0 [0087.246] lstrlenW (lpString=".db") returned 3 [0087.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".db") returned 0x0 [0087.246] lstrlenW (lpString=".ndf") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".ndf") returned 0x0 [0087.247] lstrlenW (lpString=".NDF") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".NDF") returned 0x0 [0087.247] lstrlenW (lpString=".Mdf") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".Mdf") returned 0x0 [0087.247] lstrlenW (lpString=".dat") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".dat") returned 0x0 [0087.247] lstrlenW (lpString=".DAT") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".DAT") returned 0x0 [0087.247] lstrlenW (lpString=".ldf") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".ldf") returned 0x0 [0087.247] lstrlenW (lpString=".LDF") returned 4 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch=".LDF") returned 0x0 [0087.247] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.247] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.248] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.248] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.248] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20724930345) returned 1 [0087.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2d03490, dwHighDateTime=0x1d585b4)) [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d1d8 [0087.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d1d8 | out: hHeap=0x260000) returned 1 [0087.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.249] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.249] GetLastError () returned 0x0 [0087.249] GetLastError () returned 0x0 [0087.249] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.249] GetLastError () returned 0x0 [0087.250] GetLastError () returned 0x0 [0087.359] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff19b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.371] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe65, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xe65, lpOverlapped=0x0) returned 1 [0087.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.384] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.384] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.385] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.385] CloseHandle (hObject=0x11c) returned 1 [0087.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.387] GetLastError () returned 0x0 [0087.387] RtlWakeConditionVariable () returned 0x0 [0087.388] GetCurrentThreadId () returned 0x998 [0087.388] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0087.388] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0087.388] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0087.388] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0087.391] CloseHandle (hObject=0x11c) returned 1 [0087.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0087.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.391] RtlWakeConditionVariable () returned 0x0 [0087.391] GetCurrentThreadId () returned 0x998 [0087.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".ldf") returned 0x0 [0087.391] lstrlenW (lpString=".vhd") returned 4 [0087.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".vhd") returned 0x0 [0087.391] lstrlenW (lpString=".vhdx") returned 5 [0087.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".vhdx") returned 0x0 [0087.391] lstrlenW (lpString=".pst") returned 4 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".pst") returned 0x0 [0087.392] lstrlenW (lpString=".ost") returned 4 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".ost") returned 0x0 [0087.392] lstrlenW (lpString=".bak") returned 4 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".bak") returned 0x0 [0087.392] lstrlenW (lpString=".bac") returned 4 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".bac") returned 0x0 [0087.392] lstrlenW (lpString=".sys") returned 4 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".sys") returned 0x0 [0087.392] lstrlenW (lpString=".v2i") returned 4 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".v2i") returned 0x0 [0087.392] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0087.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.393] lstrlenW (lpString=".sql") returned 4 [0087.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".sql") returned 0x0 [0087.393] lstrlenW (lpString=".mdf") returned 4 [0087.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".mdf") returned 0x0 [0087.393] lstrlenW (lpString=".txt") returned 4 [0087.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".txt") returned 0x0 [0087.394] lstrlenW (lpString=".dbf") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".dbf") returned 0x0 [0087.394] lstrlenW (lpString=".ckp") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".ckp") returned 0x0 [0087.394] lstrlenW (lpString=".dacpac") returned 7 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".dacpac") returned 0x0 [0087.394] lstrlenW (lpString=".db3") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".db3") returned 0x0 [0087.394] lstrlenW (lpString=".dtxs") returned 5 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".dtxs") returned 0x0 [0087.394] lstrlenW (lpString=".mdt") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".mdt") returned 0x0 [0087.394] lstrlenW (lpString=".sdf") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".sdf") returned 0x0 [0087.394] lstrlenW (lpString=".MDF") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".MDF") returned 0x0 [0087.394] lstrlenW (lpString=".DBF") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".DBF") returned 0x0 [0087.394] lstrlenW (lpString=".DB") returned 3 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".DB") returned 0x0 [0087.394] lstrlenW (lpString=".db") returned 3 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".db") returned 0x0 [0087.394] lstrlenW (lpString=".ndf") returned 4 [0087.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".ndf") returned 0x0 [0087.394] lstrlenW (lpString=".NDF") returned 4 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".NDF") returned 0x0 [0087.395] lstrlenW (lpString=".Mdf") returned 4 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".Mdf") returned 0x0 [0087.395] lstrlenW (lpString=".dat") returned 4 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".dat") returned 0x0 [0087.395] lstrlenW (lpString=".DAT") returned 4 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".DAT") returned 0x0 [0087.395] lstrlenW (lpString=".ldf") returned 4 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".ldf") returned 0x0 [0087.395] lstrlenW (lpString=".LDF") returned 4 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch=".LDF") returned 0x0 [0087.395] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0087.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.395] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.396] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.396] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20739724599) returned 1 [0087.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc2e80250, dwHighDateTime=0x1d585b4)) [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d440 [0087.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d440 | out: hHeap=0x260000) returned 1 [0087.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.397] GetLastError () returned 0x0 [0087.397] GetLastError () returned 0x0 [0087.397] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.397] GetLastError () returned 0x0 [0087.398] GetLastError () returned 0x0 [0087.399] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.399] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x13e, lpOverlapped=0x0) returned 1 [0087.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.399] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.399] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.399] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.399] CloseHandle (hObject=0x11c) returned 1 [0087.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312d08 [0087.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.[deadmin@cock.li].deadmin")) returned 1 [0087.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312d08 | out: hHeap=0x260000) returned 1 [0087.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0087.401] GetLastError () returned 0x0 [0087.401] RtlWakeConditionVariable () returned 0x0 [0087.401] GetCurrentThreadId () returned 0x998 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0087.402] lstrlenW (lpString=".vhd") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".vhd") returned 0x0 [0087.402] lstrlenW (lpString=".vhdx") returned 5 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".vhdx") returned 0x0 [0087.402] lstrlenW (lpString=".pst") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".pst") returned 0x0 [0087.402] lstrlenW (lpString=".ost") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".ost") returned 0x0 [0087.402] lstrlenW (lpString=".bak") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".bak") returned 0x0 [0087.402] lstrlenW (lpString=".bac") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".bac") returned 0x0 [0087.402] lstrlenW (lpString=".sys") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".sys") returned 0x0 [0087.402] lstrlenW (lpString=".v2i") returned 4 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".v2i") returned 0x0 [0087.402] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.579] lstrlenW (lpString=".sql") returned 4 [0087.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".sql") returned 0x0 [0087.579] lstrlenW (lpString=".mdf") returned 4 [0087.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".mdf") returned 0x0 [0087.579] lstrlenW (lpString=".txt") returned 4 [0087.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".txt") returned 0x0 [0087.579] lstrlenW (lpString=".dbf") returned 4 [0087.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".dbf") returned 0x0 [0087.591] lstrlenW (lpString=".ckp") returned 4 [0087.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".ckp") returned 0x0 [0087.601] lstrlenW (lpString=".dacpac") returned 7 [0087.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".dacpac") returned 0x0 [0087.601] lstrlenW (lpString=".db3") returned 4 [0087.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".db3") returned 0x0 [0087.601] lstrlenW (lpString=".dtxs") returned 5 [0087.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".dtxs") returned 0x0 [0087.612] lstrlenW (lpString=".mdt") returned 4 [0087.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".mdt") returned 0x0 [0087.612] lstrlenW (lpString=".sdf") returned 4 [0087.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".sdf") returned 0x0 [0087.612] lstrlenW (lpString=".MDF") returned 4 [0087.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".MDF") returned 0x0 [0087.612] lstrlenW (lpString=".DBF") returned 4 [0087.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".DBF") returned 0x0 [0087.612] lstrlenW (lpString=".DB") returned 3 [0087.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".DB") returned 0x0 [0087.623] lstrlenW (lpString=".db") returned 3 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".db") returned 0x0 [0087.623] lstrlenW (lpString=".ndf") returned 4 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".ndf") returned 0x0 [0087.623] lstrlenW (lpString=".NDF") returned 4 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".NDF") returned 0x0 [0087.623] lstrlenW (lpString=".Mdf") returned 4 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".Mdf") returned 0x0 [0087.623] lstrlenW (lpString=".dat") returned 4 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".dat") returned 0x0 [0087.623] lstrlenW (lpString=".DAT") returned 4 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".DAT") returned 0x0 [0087.623] lstrlenW (lpString=".ldf") returned 4 [0087.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0087.623] lstrlenW (lpString=".LDF") returned 4 [0087.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch=".LDF") returned 0x0 [0087.624] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.624] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.624] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.624] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.625] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20762750058) returned 1 [0087.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc30bb6f0, dwHighDateTime=0x1d585b4)) [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d638 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d638 | out: hHeap=0x260000) returned 1 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.627] GetLastError () returned 0x0 [0087.628] GetLastError () returned 0x0 [0087.628] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.628] GetLastError () returned 0x0 [0087.628] GetLastError () returned 0x0 [0087.629] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffb4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.630] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4b2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x4b2, lpOverlapped=0x0) returned 1 [0087.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.630] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.630] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.630] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.630] CloseHandle (hObject=0xe4) returned 1 [0087.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.[deadmin@cock.li].deadmin")) returned 1 [0087.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.632] GetLastError () returned 0x0 [0087.632] RtlWakeConditionVariable () returned 0x0 [0087.632] GetCurrentThreadId () returned 0x998 [0087.632] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0087.632] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0087.633] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0087.633] WriteFile (in: hFile=0xe4, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0087.634] CloseHandle (hObject=0xe4) returned 1 [0087.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313650 | out: hHeap=0x260000) returned 1 [0087.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.635] RtlWakeConditionVariable () returned 0x27e828 [0087.635] GetCurrentThreadId () returned 0x998 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".ldf") returned 0x0 [0087.635] lstrlenW (lpString=".vhd") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".vhd") returned 0x0 [0087.635] lstrlenW (lpString=".vhdx") returned 5 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".vhdx") returned 0x0 [0087.635] lstrlenW (lpString=".pst") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".pst") returned 0x0 [0087.635] lstrlenW (lpString=".ost") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".ost") returned 0x0 [0087.635] lstrlenW (lpString=".bak") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".bak") returned 0x0 [0087.635] lstrlenW (lpString=".bac") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".bac") returned 0x0 [0087.635] lstrlenW (lpString=".sys") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".sys") returned 0x0 [0087.635] lstrlenW (lpString=".v2i") returned 4 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".v2i") returned 0x0 [0087.635] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch="s\r\n.v2i") returned 0x0 [0087.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.637] lstrlenW (lpString=".sql") returned 4 [0087.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".sql") returned 0x0 [0087.637] lstrlenW (lpString=".mdf") returned 4 [0087.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".mdf") returned 0x0 [0087.637] lstrlenW (lpString=".txt") returned 4 [0087.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".txt") returned 0x0 [0087.637] lstrlenW (lpString=".dbf") returned 4 [0087.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".dbf") returned 0x0 [0087.637] lstrlenW (lpString=".ckp") returned 4 [0087.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".ckp") returned 0x0 [0087.637] lstrlenW (lpString=".dacpac") returned 7 [0087.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".dacpac") returned 0x0 [0087.638] lstrlenW (lpString=".db3") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".db3") returned 0x0 [0087.638] lstrlenW (lpString=".dtxs") returned 5 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".dtxs") returned 0x0 [0087.638] lstrlenW (lpString=".mdt") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".mdt") returned 0x0 [0087.638] lstrlenW (lpString=".sdf") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".sdf") returned 0x0 [0087.638] lstrlenW (lpString=".MDF") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".MDF") returned 0x0 [0087.638] lstrlenW (lpString=".DBF") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".DBF") returned 0x0 [0087.638] lstrlenW (lpString=".DB") returned 3 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".DB") returned 0x0 [0087.638] lstrlenW (lpString=".db") returned 3 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".db") returned 0x0 [0087.638] lstrlenW (lpString=".ndf") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".ndf") returned 0x0 [0087.638] lstrlenW (lpString=".NDF") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".NDF") returned 0x0 [0087.638] lstrlenW (lpString=".Mdf") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".Mdf") returned 0x0 [0087.638] lstrlenW (lpString=".dat") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".dat") returned 0x0 [0087.638] lstrlenW (lpString=".DAT") returned 4 [0087.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".DAT") returned 0x0 [0087.639] lstrlenW (lpString=".ldf") returned 4 [0087.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".ldf") returned 0x0 [0087.639] lstrlenW (lpString=".LDF") returned 4 [0087.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch=".LDF") returned 0x0 [0087.639] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.639] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.640] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.640] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20764091176) returned 1 [0087.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc30bb6f0, dwHighDateTime=0x1d585b4)) [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d6a8 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d6a8 | out: hHeap=0x260000) returned 1 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.640] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.641] GetLastError () returned 0x0 [0087.687] GetLastError () returned 0x0 [0087.687] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.687] GetLastError () returned 0x0 [0087.688] GetLastError () returned 0x0 [0087.691] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff904, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.691] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6fc, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6fc, lpOverlapped=0x0) returned 1 [0087.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.691] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.691] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.692] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.692] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.692] CloseHandle (hObject=0xe4) returned 1 [0087.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.[deadmin@cock.li].deadmin")) returned 1 [0087.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.748] GetLastError () returned 0x0 [0087.748] RtlWakeConditionVariable () returned 0x27e828 [0087.748] GetCurrentThreadId () returned 0x998 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".ldf") returned 0x0 [0087.749] lstrlenW (lpString=".vhd") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".vhd") returned 0x0 [0087.749] lstrlenW (lpString=".vhdx") returned 5 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".vhdx") returned 0x0 [0087.749] lstrlenW (lpString=".pst") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".pst") returned 0x0 [0087.749] lstrlenW (lpString=".ost") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".ost") returned 0x0 [0087.749] lstrlenW (lpString=".bak") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".bak") returned 0x0 [0087.749] lstrlenW (lpString=".bac") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".bac") returned 0x0 [0087.749] lstrlenW (lpString=".sys") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".sys") returned 0x0 [0087.749] lstrlenW (lpString=".v2i") returned 4 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".v2i") returned 0x0 [0087.749] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0087.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.751] lstrlenW (lpString=".sql") returned 4 [0087.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".sql") returned 0x0 [0087.751] lstrlenW (lpString=".mdf") returned 4 [0087.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".mdf") returned 0x0 [0087.751] lstrlenW (lpString=".txt") returned 4 [0087.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".txt") returned 0x0 [0087.751] lstrlenW (lpString=".dbf") returned 4 [0087.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".dbf") returned 0x0 [0087.752] lstrlenW (lpString=".ckp") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".ckp") returned 0x0 [0087.752] lstrlenW (lpString=".dacpac") returned 7 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".dacpac") returned 0x0 [0087.752] lstrlenW (lpString=".db3") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".db3") returned 0x0 [0087.752] lstrlenW (lpString=".dtxs") returned 5 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".dtxs") returned 0x0 [0087.752] lstrlenW (lpString=".mdt") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".mdt") returned 0x0 [0087.752] lstrlenW (lpString=".sdf") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".sdf") returned 0x0 [0087.752] lstrlenW (lpString=".MDF") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".MDF") returned 0x0 [0087.752] lstrlenW (lpString=".DBF") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".DBF") returned 0x0 [0087.752] lstrlenW (lpString=".DB") returned 3 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".DB") returned 0x0 [0087.752] lstrlenW (lpString=".db") returned 3 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".db") returned 0x0 [0087.752] lstrlenW (lpString=".ndf") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".ndf") returned 0x0 [0087.752] lstrlenW (lpString=".NDF") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".NDF") returned 0x0 [0087.752] lstrlenW (lpString=".Mdf") returned 4 [0087.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".Mdf") returned 0x0 [0087.753] lstrlenW (lpString=".dat") returned 4 [0087.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".dat") returned 0x0 [0087.753] lstrlenW (lpString=".DAT") returned 4 [0087.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".DAT") returned 0x0 [0087.753] lstrlenW (lpString=".ldf") returned 4 [0087.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".ldf") returned 0x0 [0087.753] lstrlenW (lpString=".LDF") returned 4 [0087.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch=".LDF") returned 0x0 [0087.753] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.753] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.754] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.754] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20775660363) returned 1 [0087.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc31ec1f0, dwHighDateTime=0x1d585b4)) [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d8a0 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d8a0 | out: hHeap=0x260000) returned 1 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.756] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.756] GetLastError () returned 0x0 [0087.757] GetLastError () returned 0x0 [0087.757] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.757] GetLastError () returned 0x0 [0087.757] GetLastError () returned 0x0 [0087.758] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffffcf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.758] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x31, lpOverlapped=0x0) returned 1 [0087.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.758] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.758] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.758] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.758] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.759] CloseHandle (hObject=0xd8) returned 1 [0087.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.759] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.781] GetLastError () returned 0x0 [0087.781] RtlWakeConditionVariable () returned 0x27e828 [0087.781] GetCurrentThreadId () returned 0x998 [0087.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".ldf") returned 0x0 [0087.781] lstrlenW (lpString=".vhd") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".vhd") returned 0x0 [0087.782] lstrlenW (lpString=".vhdx") returned 5 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".vhdx") returned 0x0 [0087.782] lstrlenW (lpString=".pst") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".pst") returned 0x0 [0087.782] lstrlenW (lpString=".ost") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".ost") returned 0x0 [0087.782] lstrlenW (lpString=".bak") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".bak") returned 0x0 [0087.782] lstrlenW (lpString=".bac") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".bac") returned 0x0 [0087.782] lstrlenW (lpString=".sys") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".sys") returned 0x0 [0087.782] lstrlenW (lpString=".v2i") returned 4 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".v2i") returned 0x0 [0087.782] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch="s\r\n.v2i") returned 0x0 [0087.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.784] lstrlenW (lpString=".sql") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".sql") returned 0x0 [0087.784] lstrlenW (lpString=".mdf") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".mdf") returned 0x0 [0087.784] lstrlenW (lpString=".txt") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".txt") returned 0x0 [0087.784] lstrlenW (lpString=".dbf") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".dbf") returned 0x0 [0087.784] lstrlenW (lpString=".ckp") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".ckp") returned 0x0 [0087.784] lstrlenW (lpString=".dacpac") returned 7 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".dacpac") returned 0x0 [0087.784] lstrlenW (lpString=".db3") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".db3") returned 0x0 [0087.784] lstrlenW (lpString=".dtxs") returned 5 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".dtxs") returned 0x0 [0087.784] lstrlenW (lpString=".mdt") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".mdt") returned 0x0 [0087.784] lstrlenW (lpString=".sdf") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".sdf") returned 0x0 [0087.784] lstrlenW (lpString=".MDF") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".MDF") returned 0x0 [0087.784] lstrlenW (lpString=".DBF") returned 4 [0087.784] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".DBF") returned 0x0 [0087.785] lstrlenW (lpString=".DB") returned 3 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".DB") returned 0x0 [0087.785] lstrlenW (lpString=".db") returned 3 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".db") returned 0x0 [0087.785] lstrlenW (lpString=".ndf") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".ndf") returned 0x0 [0087.785] lstrlenW (lpString=".NDF") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".NDF") returned 0x0 [0087.785] lstrlenW (lpString=".Mdf") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".Mdf") returned 0x0 [0087.785] lstrlenW (lpString=".dat") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".dat") returned 0x0 [0087.785] lstrlenW (lpString=".DAT") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".DAT") returned 0x0 [0087.785] lstrlenW (lpString=".ldf") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".ldf") returned 0x0 [0087.785] lstrlenW (lpString=".LDF") returned 4 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch=".LDF") returned 0x0 [0087.785] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.785] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.786] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.786] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.786] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20778751253) returned 1 [0087.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc32384b0, dwHighDateTime=0x1d585b4)) [0087.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d948 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d948 | out: hHeap=0x260000) returned 1 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.787] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.787] GetLastError () returned 0x0 [0087.787] GetLastError () returned 0x0 [0087.788] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.788] GetLastError () returned 0x0 [0087.788] GetLastError () returned 0x0 [0087.790] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffca2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.790] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x35d6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x35d6, lpOverlapped=0x0) returned 1 [0087.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.791] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.791] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.791] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.791] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.791] CloseHandle (hObject=0xd8) returned 1 [0087.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.791] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js.[deadmin@cock.li].deadmin")) returned 1 [0087.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.792] GetLastError () returned 0x0 [0087.792] RtlWakeConditionVariable () returned 0x0 [0087.792] GetCurrentThreadId () returned 0x998 [0087.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".ldf") returned 0x0 [0087.792] lstrlenW (lpString=".vhd") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".vhd") returned 0x0 [0087.793] lstrlenW (lpString=".vhdx") returned 5 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".vhdx") returned 0x0 [0087.793] lstrlenW (lpString=".pst") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".pst") returned 0x0 [0087.793] lstrlenW (lpString=".ost") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".ost") returned 0x0 [0087.793] lstrlenW (lpString=".bak") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".bak") returned 0x0 [0087.793] lstrlenW (lpString=".bac") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".bac") returned 0x0 [0087.793] lstrlenW (lpString=".sys") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".sys") returned 0x0 [0087.793] lstrlenW (lpString=".v2i") returned 4 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".v2i") returned 0x0 [0087.793] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0087.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.794] lstrlenW (lpString=".sql") returned 4 [0087.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".sql") returned 0x0 [0087.794] lstrlenW (lpString=".mdf") returned 4 [0087.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".mdf") returned 0x0 [0087.794] lstrlenW (lpString=".txt") returned 4 [0087.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".txt") returned 0x0 [0087.794] lstrlenW (lpString=".dbf") returned 4 [0087.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".dbf") returned 0x0 [0087.794] lstrlenW (lpString=".ckp") returned 4 [0087.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".ckp") returned 0x0 [0087.795] lstrlenW (lpString=".dacpac") returned 7 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".dacpac") returned 0x0 [0087.795] lstrlenW (lpString=".db3") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".db3") returned 0x0 [0087.795] lstrlenW (lpString=".dtxs") returned 5 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".dtxs") returned 0x0 [0087.795] lstrlenW (lpString=".mdt") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".mdt") returned 0x0 [0087.795] lstrlenW (lpString=".sdf") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".sdf") returned 0x0 [0087.795] lstrlenW (lpString=".MDF") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".MDF") returned 0x0 [0087.795] lstrlenW (lpString=".DBF") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".DBF") returned 0x0 [0087.795] lstrlenW (lpString=".DB") returned 3 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".DB") returned 0x0 [0087.795] lstrlenW (lpString=".db") returned 3 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".db") returned 0x0 [0087.795] lstrlenW (lpString=".ndf") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".ndf") returned 0x0 [0087.795] lstrlenW (lpString=".NDF") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".NDF") returned 0x0 [0087.795] lstrlenW (lpString=".Mdf") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".Mdf") returned 0x0 [0087.795] lstrlenW (lpString=".dat") returned 4 [0087.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".dat") returned 0x0 [0087.796] lstrlenW (lpString=".DAT") returned 4 [0087.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".DAT") returned 0x0 [0087.796] lstrlenW (lpString=".ldf") returned 4 [0087.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".ldf") returned 0x0 [0087.796] lstrlenW (lpString=".LDF") returned 4 [0087.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch=".LDF") returned 0x0 [0087.796] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.796] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.797] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.797] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.846] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20784743097) returned 1 [0087.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc32d0a30, dwHighDateTime=0x1d585b4)) [0087.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33da60 [0087.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33da60 | out: hHeap=0x260000) returned 1 [0087.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.847] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.847] GetLastError () returned 0x0 [0087.847] GetLastError () returned 0x0 [0087.847] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.848] GetLastError () returned 0x0 [0087.848] GetLastError () returned 0x0 [0087.849] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.849] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x295, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x295, lpOverlapped=0x0) returned 1 [0087.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.849] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.849] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.849] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.849] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.849] CloseHandle (hObject=0xd8) returned 1 [0087.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css.[deadmin@cock.li].deadmin")) returned 1 [0087.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.939] GetLastError () returned 0x0 [0087.939] RtlWakeConditionVariable () returned 0x0 [0087.939] GetCurrentThreadId () returned 0x998 [0087.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".ldf") returned 0x0 [0087.939] lstrlenW (lpString=".vhd") returned 4 [0087.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".vhd") returned 0x0 [0087.939] lstrlenW (lpString=".vhdx") returned 5 [0087.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".vhdx") returned 0x0 [0087.939] lstrlenW (lpString=".pst") returned 4 [0087.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".pst") returned 0x0 [0087.940] lstrlenW (lpString=".ost") returned 4 [0087.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".ost") returned 0x0 [0087.940] lstrlenW (lpString=".bak") returned 4 [0087.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".bak") returned 0x0 [0087.940] lstrlenW (lpString=".bac") returned 4 [0087.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".bac") returned 0x0 [0087.940] lstrlenW (lpString=".sys") returned 4 [0087.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".sys") returned 0x0 [0087.940] lstrlenW (lpString=".v2i") returned 4 [0087.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".v2i") returned 0x0 [0087.940] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0087.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.941] lstrlenW (lpString=".sql") returned 4 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".sql") returned 0x0 [0087.941] lstrlenW (lpString=".mdf") returned 4 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".mdf") returned 0x0 [0087.941] lstrlenW (lpString=".txt") returned 4 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".txt") returned 0x0 [0087.941] lstrlenW (lpString=".dbf") returned 4 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".dbf") returned 0x0 [0087.941] lstrlenW (lpString=".ckp") returned 4 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".ckp") returned 0x0 [0087.941] lstrlenW (lpString=".dacpac") returned 7 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".dacpac") returned 0x0 [0087.941] lstrlenW (lpString=".db3") returned 4 [0087.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".db3") returned 0x0 [0087.942] lstrlenW (lpString=".dtxs") returned 5 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".dtxs") returned 0x0 [0087.942] lstrlenW (lpString=".mdt") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".mdt") returned 0x0 [0087.942] lstrlenW (lpString=".sdf") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".sdf") returned 0x0 [0087.942] lstrlenW (lpString=".MDF") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".MDF") returned 0x0 [0087.942] lstrlenW (lpString=".DBF") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".DBF") returned 0x0 [0087.942] lstrlenW (lpString=".DB") returned 3 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".DB") returned 0x0 [0087.942] lstrlenW (lpString=".db") returned 3 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".db") returned 0x0 [0087.942] lstrlenW (lpString=".ndf") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".ndf") returned 0x0 [0087.942] lstrlenW (lpString=".NDF") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".NDF") returned 0x0 [0087.942] lstrlenW (lpString=".Mdf") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".Mdf") returned 0x0 [0087.942] lstrlenW (lpString=".dat") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".dat") returned 0x0 [0087.942] lstrlenW (lpString=".DAT") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".DAT") returned 0x0 [0087.942] lstrlenW (lpString=".ldf") returned 4 [0087.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".ldf") returned 0x0 [0087.943] lstrlenW (lpString=".LDF") returned 4 [0087.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch=".LDF") returned 0x0 [0087.943] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.943] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.944] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.944] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.944] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20794487886) returned 1 [0087.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc33b5270, dwHighDateTime=0x1d585b4)) [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9bc8 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9bc8 | out: hHeap=0x260000) returned 1 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.944] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.945] GetLastError () returned 0x0 [0087.945] GetLastError () returned 0x0 [0087.945] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.945] GetLastError () returned 0x0 [0087.945] GetLastError () returned 0x0 [0087.948] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff9eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.948] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x614e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x614e, lpOverlapped=0x0) returned 1 [0087.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.948] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.948] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.948] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.948] CloseHandle (hObject=0xd8) returned 1 [0087.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.950] GetLastError () returned 0x0 [0087.950] RtlWakeConditionVariable () returned 0x0 [0087.950] GetCurrentThreadId () returned 0x998 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".ldf") returned 0x0 [0087.950] lstrlenW (lpString=".vhd") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".vhd") returned 0x0 [0087.950] lstrlenW (lpString=".vhdx") returned 5 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".vhdx") returned 0x0 [0087.950] lstrlenW (lpString=".pst") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".pst") returned 0x0 [0087.950] lstrlenW (lpString=".ost") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".ost") returned 0x0 [0087.950] lstrlenW (lpString=".bak") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".bak") returned 0x0 [0087.950] lstrlenW (lpString=".bac") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".bac") returned 0x0 [0087.950] lstrlenW (lpString=".sys") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".sys") returned 0x0 [0087.950] lstrlenW (lpString=".v2i") returned 4 [0087.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".v2i") returned 0x0 [0087.951] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.951] lstrlenW (lpString=".sql") returned 4 [0087.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".sql") returned 0x0 [0087.952] lstrlenW (lpString=".mdf") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".mdf") returned 0x0 [0087.952] lstrlenW (lpString=".txt") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".txt") returned 0x0 [0087.952] lstrlenW (lpString=".dbf") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".dbf") returned 0x0 [0087.952] lstrlenW (lpString=".ckp") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".ckp") returned 0x0 [0087.952] lstrlenW (lpString=".dacpac") returned 7 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".dacpac") returned 0x0 [0087.952] lstrlenW (lpString=".db3") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".db3") returned 0x0 [0087.952] lstrlenW (lpString=".dtxs") returned 5 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".dtxs") returned 0x0 [0087.952] lstrlenW (lpString=".mdt") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".mdt") returned 0x0 [0087.952] lstrlenW (lpString=".sdf") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".sdf") returned 0x0 [0087.952] lstrlenW (lpString=".MDF") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".MDF") returned 0x0 [0087.952] lstrlenW (lpString=".DBF") returned 4 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".DBF") returned 0x0 [0087.952] lstrlenW (lpString=".DB") returned 3 [0087.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".DB") returned 0x0 [0087.952] lstrlenW (lpString=".db") returned 3 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".db") returned 0x0 [0087.953] lstrlenW (lpString=".ndf") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".ndf") returned 0x0 [0087.953] lstrlenW (lpString=".NDF") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".NDF") returned 0x0 [0087.953] lstrlenW (lpString=".Mdf") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".Mdf") returned 0x0 [0087.953] lstrlenW (lpString=".dat") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".dat") returned 0x0 [0087.953] lstrlenW (lpString=".DAT") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".DAT") returned 0x0 [0087.953] lstrlenW (lpString=".ldf") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".ldf") returned 0x0 [0087.953] lstrlenW (lpString=".LDF") returned 4 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch=".LDF") returned 0x0 [0087.953] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.953] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.954] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.954] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.954] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20795554195) returned 1 [0087.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc33db3d0, dwHighDateTime=0x1d585b4)) [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b58 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b58 | out: hHeap=0x260000) returned 1 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.955] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.955] GetLastError () returned 0x0 [0087.955] GetLastError () returned 0x0 [0087.956] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.956] GetLastError () returned 0x0 [0087.956] GetLastError () returned 0x0 [0087.958] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.958] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x161d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x161d, lpOverlapped=0x0) returned 1 [0087.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.958] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.958] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.958] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.958] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.958] CloseHandle (hObject=0xd8) returned 1 [0087.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.960] GetLastError () returned 0x0 [0087.960] RtlWakeConditionVariable () returned 0x0 [0087.960] GetCurrentThreadId () returned 0x998 [0087.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".ldf") returned 0x0 [0087.960] lstrlenW (lpString=".vhd") returned 4 [0087.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".vhd") returned 0x0 [0087.960] lstrlenW (lpString=".vhdx") returned 5 [0087.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".vhdx") returned 0x0 [0087.960] lstrlenW (lpString=".pst") returned 4 [0087.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".pst") returned 0x0 [0087.960] lstrlenW (lpString=".ost") returned 4 [0087.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".ost") returned 0x0 [0087.960] lstrlenW (lpString=".bak") returned 4 [0087.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".bak") returned 0x0 [0087.960] lstrlenW (lpString=".bac") returned 4 [0087.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".bac") returned 0x0 [0087.961] lstrlenW (lpString=".sys") returned 4 [0087.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".sys") returned 0x0 [0087.961] lstrlenW (lpString=".v2i") returned 4 [0087.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".v2i") returned 0x0 [0087.961] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.962] lstrlenW (lpString=".sql") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".sql") returned 0x0 [0087.962] lstrlenW (lpString=".mdf") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".mdf") returned 0x0 [0087.962] lstrlenW (lpString=".txt") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".txt") returned 0x0 [0087.962] lstrlenW (lpString=".dbf") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".dbf") returned 0x0 [0087.962] lstrlenW (lpString=".ckp") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".ckp") returned 0x0 [0087.962] lstrlenW (lpString=".dacpac") returned 7 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".dacpac") returned 0x0 [0087.962] lstrlenW (lpString=".db3") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".db3") returned 0x0 [0087.962] lstrlenW (lpString=".dtxs") returned 5 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".dtxs") returned 0x0 [0087.962] lstrlenW (lpString=".mdt") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".mdt") returned 0x0 [0087.962] lstrlenW (lpString=".sdf") returned 4 [0087.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".sdf") returned 0x0 [0087.963] lstrlenW (lpString=".MDF") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".MDF") returned 0x0 [0087.963] lstrlenW (lpString=".DBF") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".DBF") returned 0x0 [0087.963] lstrlenW (lpString=".DB") returned 3 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".DB") returned 0x0 [0087.963] lstrlenW (lpString=".db") returned 3 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".db") returned 0x0 [0087.963] lstrlenW (lpString=".ndf") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".ndf") returned 0x0 [0087.963] lstrlenW (lpString=".NDF") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".NDF") returned 0x0 [0087.963] lstrlenW (lpString=".Mdf") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".Mdf") returned 0x0 [0087.963] lstrlenW (lpString=".dat") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".dat") returned 0x0 [0087.963] lstrlenW (lpString=".DAT") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".DAT") returned 0x0 [0087.963] lstrlenW (lpString=".ldf") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".ldf") returned 0x0 [0087.963] lstrlenW (lpString=".LDF") returned 4 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch=".LDF") returned 0x0 [0087.963] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.964] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0087.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.964] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.965] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20796566710) returned 1 [0087.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc33db3d0, dwHighDateTime=0x1d585b4)) [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b90 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b90 | out: hHeap=0x260000) returned 1 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0087.965] GetLastError () returned 0x0 [0087.966] GetLastError () returned 0x0 [0087.966] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0087.966] GetLastError () returned 0x0 [0087.966] GetLastError () returned 0x0 [0088.009] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff822d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.009] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7dd3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x7dd3, lpOverlapped=0x0) returned 1 [0088.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.020] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.039] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.039] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.039] CloseHandle (hObject=0xd8) returned 1 [0088.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313548 [0088.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313548 | out: hHeap=0x260000) returned 1 [0088.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.041] GetLastError () returned 0x0 [0088.041] RtlWakeConditionVariable () returned 0x0 [0088.041] GetCurrentThreadId () returned 0x998 [0088.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".ldf") returned 0x0 [0088.042] lstrlenW (lpString=".vhd") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".vhd") returned 0x0 [0088.042] lstrlenW (lpString=".vhdx") returned 5 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".vhdx") returned 0x0 [0088.042] lstrlenW (lpString=".pst") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".pst") returned 0x0 [0088.042] lstrlenW (lpString=".ost") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".ost") returned 0x0 [0088.042] lstrlenW (lpString=".bak") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".bak") returned 0x0 [0088.042] lstrlenW (lpString=".bac") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".bac") returned 0x0 [0088.042] lstrlenW (lpString=".sys") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".sys") returned 0x0 [0088.042] lstrlenW (lpString=".v2i") returned 4 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".v2i") returned 0x0 [0088.042] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0088.043] lstrlenW (lpString=".sql") returned 4 [0088.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".sql") returned 0x0 [0088.043] lstrlenW (lpString=".mdf") returned 4 [0088.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".mdf") returned 0x0 [0088.043] lstrlenW (lpString=".txt") returned 4 [0088.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".txt") returned 0x0 [0088.043] lstrlenW (lpString=".dbf") returned 4 [0088.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".dbf") returned 0x0 [0088.043] lstrlenW (lpString=".ckp") returned 4 [0088.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".ckp") returned 0x0 [0088.043] lstrlenW (lpString=".dacpac") returned 7 [0088.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".dacpac") returned 0x0 [0088.044] lstrlenW (lpString=".db3") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".db3") returned 0x0 [0088.044] lstrlenW (lpString=".dtxs") returned 5 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".dtxs") returned 0x0 [0088.044] lstrlenW (lpString=".mdt") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".mdt") returned 0x0 [0088.044] lstrlenW (lpString=".sdf") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".sdf") returned 0x0 [0088.044] lstrlenW (lpString=".MDF") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".MDF") returned 0x0 [0088.044] lstrlenW (lpString=".DBF") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".DBF") returned 0x0 [0088.044] lstrlenW (lpString=".DB") returned 3 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".DB") returned 0x0 [0088.044] lstrlenW (lpString=".db") returned 3 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".db") returned 0x0 [0088.044] lstrlenW (lpString=".ndf") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".ndf") returned 0x0 [0088.044] lstrlenW (lpString=".NDF") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".NDF") returned 0x0 [0088.044] lstrlenW (lpString=".Mdf") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".Mdf") returned 0x0 [0088.044] lstrlenW (lpString=".dat") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".dat") returned 0x0 [0088.044] lstrlenW (lpString=".DAT") returned 4 [0088.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".DAT") returned 0x0 [0088.045] lstrlenW (lpString=".ldf") returned 4 [0088.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".ldf") returned 0x0 [0088.045] lstrlenW (lpString=".LDF") returned 4 [0088.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch=".LDF") returned 0x0 [0088.045] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.045] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.046] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.046] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.046] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20804694907) returned 1 [0088.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3499ab0, dwHighDateTime=0x1d585b4)) [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a08 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a08 | out: hHeap=0x260000) returned 1 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.047] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.047] GetLastError () returned 0x0 [0088.047] GetLastError () returned 0x0 [0088.047] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.048] GetLastError () returned 0x0 [0088.048] GetLastError () returned 0x0 [0088.049] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.049] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6a, lpOverlapped=0x0) returned 1 [0088.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.049] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.049] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.049] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.049] CloseHandle (hObject=0xd8) returned 1 [0088.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313548 [0088.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313548 | out: hHeap=0x260000) returned 1 [0088.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.051] GetLastError () returned 0x0 [0088.051] RtlWakeConditionVariable () returned 0x0 [0088.051] GetCurrentThreadId () returned 0x998 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".ldf") returned 0x0 [0088.051] lstrlenW (lpString=".vhd") returned 4 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".vhd") returned 0x0 [0088.051] lstrlenW (lpString=".vhdx") returned 5 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".vhdx") returned 0x0 [0088.051] lstrlenW (lpString=".pst") returned 4 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".pst") returned 0x0 [0088.051] lstrlenW (lpString=".ost") returned 4 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".ost") returned 0x0 [0088.051] lstrlenW (lpString=".bak") returned 4 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".bak") returned 0x0 [0088.051] lstrlenW (lpString=".bac") returned 4 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".bac") returned 0x0 [0088.051] lstrlenW (lpString=".sys") returned 4 [0088.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".sys") returned 0x0 [0088.052] lstrlenW (lpString=".v2i") returned 4 [0088.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".v2i") returned 0x0 [0088.052] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0088.052] lstrlenW (lpString=".sql") returned 4 [0088.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".sql") returned 0x0 [0088.053] lstrlenW (lpString=".mdf") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".mdf") returned 0x0 [0088.053] lstrlenW (lpString=".txt") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".txt") returned 0x0 [0088.053] lstrlenW (lpString=".dbf") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".dbf") returned 0x0 [0088.053] lstrlenW (lpString=".ckp") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".ckp") returned 0x0 [0088.053] lstrlenW (lpString=".dacpac") returned 7 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".dacpac") returned 0x0 [0088.053] lstrlenW (lpString=".db3") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".db3") returned 0x0 [0088.053] lstrlenW (lpString=".dtxs") returned 5 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".dtxs") returned 0x0 [0088.053] lstrlenW (lpString=".mdt") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".mdt") returned 0x0 [0088.053] lstrlenW (lpString=".sdf") returned 4 [0088.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".sdf") returned 0x0 [0088.054] lstrlenW (lpString=".MDF") returned 4 [0088.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".MDF") returned 0x0 [0088.054] lstrlenW (lpString=".DBF") returned 4 [0088.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".DBF") returned 0x0 [0088.054] lstrlenW (lpString=".DB") returned 3 [0088.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".DB") returned 0x0 [0088.055] lstrlenW (lpString=".db") returned 3 [0088.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".db") returned 0x0 [0088.055] lstrlenW (lpString=".ndf") returned 4 [0088.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".ndf") returned 0x0 [0088.055] lstrlenW (lpString=".NDF") returned 4 [0088.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".NDF") returned 0x0 [0088.055] lstrlenW (lpString=".Mdf") returned 4 [0088.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".Mdf") returned 0x0 [0088.055] lstrlenW (lpString=".dat") returned 4 [0088.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".dat") returned 0x0 [0088.056] lstrlenW (lpString=".DAT") returned 4 [0088.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".DAT") returned 0x0 [0088.056] lstrlenW (lpString=".ldf") returned 4 [0088.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".ldf") returned 0x0 [0088.056] lstrlenW (lpString=".LDF") returned 4 [0088.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch=".LDF") returned 0x0 [0088.056] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.056] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.057] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.057] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20805798798) returned 1 [0088.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc34bfc10, dwHighDateTime=0x1d585b4)) [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d99d0 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d99d0 | out: hHeap=0x260000) returned 1 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.058] GetLastError () returned 0x0 [0088.058] GetLastError () returned 0x0 [0088.058] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.058] GetLastError () returned 0x0 [0088.058] GetLastError () returned 0x0 [0088.060] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffde5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.060] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x21a6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x21a6, lpOverlapped=0x0) returned 1 [0088.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.060] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.060] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.060] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.061] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.061] CloseHandle (hObject=0xd8) returned 1 [0088.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0088.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.062] GetLastError () returned 0x0 [0088.062] RtlWakeConditionVariable () returned 0x0 [0088.062] GetCurrentThreadId () returned 0x998 [0088.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".ldf") returned 0x0 [0088.062] lstrlenW (lpString=".vhd") returned 4 [0088.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".vhd") returned 0x0 [0088.062] lstrlenW (lpString=".vhdx") returned 5 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".vhdx") returned 0x0 [0088.063] lstrlenW (lpString=".pst") returned 4 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".pst") returned 0x0 [0088.063] lstrlenW (lpString=".ost") returned 4 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".ost") returned 0x0 [0088.063] lstrlenW (lpString=".bak") returned 4 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".bak") returned 0x0 [0088.063] lstrlenW (lpString=".bac") returned 4 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".bac") returned 0x0 [0088.063] lstrlenW (lpString=".sys") returned 4 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".sys") returned 0x0 [0088.063] lstrlenW (lpString=".v2i") returned 4 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".v2i") returned 0x0 [0088.063] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0088.064] lstrlenW (lpString=".sql") returned 4 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".sql") returned 0x0 [0088.064] lstrlenW (lpString=".mdf") returned 4 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".mdf") returned 0x0 [0088.064] lstrlenW (lpString=".txt") returned 4 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".txt") returned 0x0 [0088.064] lstrlenW (lpString=".dbf") returned 4 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".dbf") returned 0x0 [0088.064] lstrlenW (lpString=".ckp") returned 4 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".ckp") returned 0x0 [0088.064] lstrlenW (lpString=".dacpac") returned 7 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".dacpac") returned 0x0 [0088.064] lstrlenW (lpString=".db3") returned 4 [0088.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".db3") returned 0x0 [0088.064] lstrlenW (lpString=".dtxs") returned 5 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".dtxs") returned 0x0 [0088.065] lstrlenW (lpString=".mdt") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".mdt") returned 0x0 [0088.065] lstrlenW (lpString=".sdf") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".sdf") returned 0x0 [0088.065] lstrlenW (lpString=".MDF") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".MDF") returned 0x0 [0088.065] lstrlenW (lpString=".DBF") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".DBF") returned 0x0 [0088.065] lstrlenW (lpString=".DB") returned 3 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".DB") returned 0x0 [0088.065] lstrlenW (lpString=".db") returned 3 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".db") returned 0x0 [0088.065] lstrlenW (lpString=".ndf") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".ndf") returned 0x0 [0088.065] lstrlenW (lpString=".NDF") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".NDF") returned 0x0 [0088.065] lstrlenW (lpString=".Mdf") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".Mdf") returned 0x0 [0088.065] lstrlenW (lpString=".dat") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".dat") returned 0x0 [0088.065] lstrlenW (lpString=".DAT") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".DAT") returned 0x0 [0088.065] lstrlenW (lpString=".ldf") returned 4 [0088.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".ldf") returned 0x0 [0088.065] lstrlenW (lpString=".LDF") returned 4 [0088.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch=".LDF") returned 0x0 [0088.066] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.066] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.066] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.067] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20806781462) returned 1 [0088.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc34e5d70, dwHighDateTime=0x1d585b4)) [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9928 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9928 | out: hHeap=0x260000) returned 1 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.068] GetLastError () returned 0x0 [0088.068] GetLastError () returned 0x0 [0088.068] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.068] GetLastError () returned 0x0 [0088.068] GetLastError () returned 0x0 [0088.070] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc2a9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.070] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3d57, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3d57, lpOverlapped=0x0) returned 1 [0088.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.071] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.071] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.071] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.071] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.071] CloseHandle (hObject=0xd8) returned 1 [0088.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0088.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.072] GetLastError () returned 0x0 [0088.072] RtlWakeConditionVariable () returned 0x0 [0088.072] GetCurrentThreadId () returned 0x998 [0088.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".ldf") returned 0x0 [0088.072] lstrlenW (lpString=".vhd") returned 4 [0088.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".vhd") returned 0x0 [0088.073] lstrlenW (lpString=".vhdx") returned 5 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".vhdx") returned 0x0 [0088.073] lstrlenW (lpString=".pst") returned 4 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".pst") returned 0x0 [0088.073] lstrlenW (lpString=".ost") returned 4 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".ost") returned 0x0 [0088.073] lstrlenW (lpString=".bak") returned 4 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".bak") returned 0x0 [0088.073] lstrlenW (lpString=".bac") returned 4 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".bac") returned 0x0 [0088.073] lstrlenW (lpString=".sys") returned 4 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".sys") returned 0x0 [0088.073] lstrlenW (lpString=".v2i") returned 4 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".v2i") returned 0x0 [0088.073] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0088.074] lstrlenW (lpString=".sql") returned 4 [0088.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".sql") returned 0x0 [0088.074] lstrlenW (lpString=".mdf") returned 4 [0088.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".mdf") returned 0x0 [0088.074] lstrlenW (lpString=".txt") returned 4 [0088.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".txt") returned 0x0 [0088.074] lstrlenW (lpString=".dbf") returned 4 [0088.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".dbf") returned 0x0 [0088.074] lstrlenW (lpString=".ckp") returned 4 [0088.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".ckp") returned 0x0 [0088.074] lstrlenW (lpString=".dacpac") returned 7 [0088.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".dacpac") returned 0x0 [0088.075] lstrlenW (lpString=".db3") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".db3") returned 0x0 [0088.075] lstrlenW (lpString=".dtxs") returned 5 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".dtxs") returned 0x0 [0088.075] lstrlenW (lpString=".mdt") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".mdt") returned 0x0 [0088.075] lstrlenW (lpString=".sdf") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".sdf") returned 0x0 [0088.075] lstrlenW (lpString=".MDF") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".MDF") returned 0x0 [0088.075] lstrlenW (lpString=".DBF") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".DBF") returned 0x0 [0088.075] lstrlenW (lpString=".DB") returned 3 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".DB") returned 0x0 [0088.075] lstrlenW (lpString=".db") returned 3 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".db") returned 0x0 [0088.075] lstrlenW (lpString=".ndf") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".ndf") returned 0x0 [0088.075] lstrlenW (lpString=".NDF") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".NDF") returned 0x0 [0088.075] lstrlenW (lpString=".Mdf") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".Mdf") returned 0x0 [0088.075] lstrlenW (lpString=".dat") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".dat") returned 0x0 [0088.075] lstrlenW (lpString=".DAT") returned 4 [0088.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".DAT") returned 0x0 [0088.076] lstrlenW (lpString=".ldf") returned 4 [0088.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".ldf") returned 0x0 [0088.076] lstrlenW (lpString=".LDF") returned 4 [0088.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch=".LDF") returned 0x0 [0088.076] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.076] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.077] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.077] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.077] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20807791845) returned 1 [0088.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc34e5d70, dwHighDateTime=0x1d585b4)) [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9998 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9998 | out: hHeap=0x260000) returned 1 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.077] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.186] GetLastError () returned 0x0 [0088.187] GetLastError () returned 0x0 [0088.187] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.187] GetLastError () returned 0x0 [0088.187] GetLastError () returned 0x0 [0088.189] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe7bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.189] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1845, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1845, lpOverlapped=0x0) returned 1 [0088.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.189] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.189] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.189] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.189] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.189] CloseHandle (hObject=0xd8) returned 1 [0088.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313440 [0088.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313440 | out: hHeap=0x260000) returned 1 [0088.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.258] GetLastError () returned 0x0 [0088.258] RtlWakeConditionVariable () returned 0x27e828 [0088.258] GetCurrentThreadId () returned 0x998 [0088.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".ldf") returned 0x0 [0088.258] lstrlenW (lpString=".vhd") returned 4 [0088.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".vhd") returned 0x0 [0088.258] lstrlenW (lpString=".vhdx") returned 5 [0088.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".vhdx") returned 0x0 [0088.259] lstrlenW (lpString=".pst") returned 4 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".pst") returned 0x0 [0088.259] lstrlenW (lpString=".ost") returned 4 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".ost") returned 0x0 [0088.259] lstrlenW (lpString=".bak") returned 4 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".bak") returned 0x0 [0088.259] lstrlenW (lpString=".bac") returned 4 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".bac") returned 0x0 [0088.259] lstrlenW (lpString=".sys") returned 4 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".sys") returned 0x0 [0088.259] lstrlenW (lpString=".v2i") returned 4 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".v2i") returned 0x0 [0088.259] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.260] lstrlenW (lpString=".sql") returned 4 [0088.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".sql") returned 0x0 [0088.260] lstrlenW (lpString=".mdf") returned 4 [0088.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".mdf") returned 0x0 [0088.260] lstrlenW (lpString=".txt") returned 4 [0088.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".txt") returned 0x0 [0088.260] lstrlenW (lpString=".dbf") returned 4 [0088.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".dbf") returned 0x0 [0088.260] lstrlenW (lpString=".ckp") returned 4 [0088.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".ckp") returned 0x0 [0088.260] lstrlenW (lpString=".dacpac") returned 7 [0088.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".dacpac") returned 0x0 [0088.261] lstrlenW (lpString=".db3") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".db3") returned 0x0 [0088.261] lstrlenW (lpString=".dtxs") returned 5 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".dtxs") returned 0x0 [0088.261] lstrlenW (lpString=".mdt") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".mdt") returned 0x0 [0088.261] lstrlenW (lpString=".sdf") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".sdf") returned 0x0 [0088.261] lstrlenW (lpString=".MDF") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".MDF") returned 0x0 [0088.261] lstrlenW (lpString=".DBF") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".DBF") returned 0x0 [0088.261] lstrlenW (lpString=".DB") returned 3 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".DB") returned 0x0 [0088.261] lstrlenW (lpString=".db") returned 3 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".db") returned 0x0 [0088.261] lstrlenW (lpString=".ndf") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".ndf") returned 0x0 [0088.261] lstrlenW (lpString=".NDF") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".NDF") returned 0x0 [0088.261] lstrlenW (lpString=".Mdf") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".Mdf") returned 0x0 [0088.261] lstrlenW (lpString=".dat") returned 4 [0088.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".dat") returned 0x0 [0088.261] lstrlenW (lpString=".DAT") returned 4 [0088.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".DAT") returned 0x0 [0088.262] lstrlenW (lpString=".ldf") returned 4 [0088.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".ldf") returned 0x0 [0088.262] lstrlenW (lpString=".LDF") returned 4 [0088.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch=".LDF") returned 0x0 [0088.262] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.262] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.263] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.263] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.263] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20826399616) returned 1 [0088.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc36aedf0, dwHighDateTime=0x1d585b4)) [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dec0 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dec0 | out: hHeap=0x260000) returned 1 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.264] GetLastError () returned 0x0 [0088.264] GetLastError () returned 0x0 [0088.264] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.264] GetLastError () returned 0x0 [0088.264] GetLastError () returned 0x0 [0088.279] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff384, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.279] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xc7c, lpOverlapped=0x0) returned 1 [0088.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.279] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.279] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.280] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.280] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.280] CloseHandle (hObject=0xe4) returned 1 [0088.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.[deadmin@cock.li].deadmin")) returned 1 [0088.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.281] GetLastError () returned 0x0 [0088.281] RtlWakeConditionVariable () returned 0x27e828 [0088.282] GetCurrentThreadId () returned 0x998 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".ldf") returned 0x0 [0088.282] lstrlenW (lpString=".vhd") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".vhd") returned 0x0 [0088.282] lstrlenW (lpString=".vhdx") returned 5 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".vhdx") returned 0x0 [0088.282] lstrlenW (lpString=".pst") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".pst") returned 0x0 [0088.282] lstrlenW (lpString=".ost") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".ost") returned 0x0 [0088.282] lstrlenW (lpString=".bak") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".bak") returned 0x0 [0088.282] lstrlenW (lpString=".bac") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".bac") returned 0x0 [0088.282] lstrlenW (lpString=".sys") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".sys") returned 0x0 [0088.282] lstrlenW (lpString=".v2i") returned 4 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".v2i") returned 0x0 [0088.282] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.283] lstrlenW (lpString=".sql") returned 4 [0088.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".sql") returned 0x0 [0088.283] lstrlenW (lpString=".mdf") returned 4 [0088.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".mdf") returned 0x0 [0088.283] lstrlenW (lpString=".txt") returned 4 [0088.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".txt") returned 0x0 [0088.284] lstrlenW (lpString=".dbf") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".dbf") returned 0x0 [0088.284] lstrlenW (lpString=".ckp") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".ckp") returned 0x0 [0088.284] lstrlenW (lpString=".dacpac") returned 7 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".dacpac") returned 0x0 [0088.284] lstrlenW (lpString=".db3") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".db3") returned 0x0 [0088.284] lstrlenW (lpString=".dtxs") returned 5 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".dtxs") returned 0x0 [0088.284] lstrlenW (lpString=".mdt") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".mdt") returned 0x0 [0088.284] lstrlenW (lpString=".sdf") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".sdf") returned 0x0 [0088.284] lstrlenW (lpString=".MDF") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".MDF") returned 0x0 [0088.284] lstrlenW (lpString=".DBF") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".DBF") returned 0x0 [0088.284] lstrlenW (lpString=".DB") returned 3 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".DB") returned 0x0 [0088.284] lstrlenW (lpString=".db") returned 3 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".db") returned 0x0 [0088.284] lstrlenW (lpString=".ndf") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".ndf") returned 0x0 [0088.284] lstrlenW (lpString=".NDF") returned 4 [0088.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".NDF") returned 0x0 [0088.285] lstrlenW (lpString=".Mdf") returned 4 [0088.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".Mdf") returned 0x0 [0088.285] lstrlenW (lpString=".dat") returned 4 [0088.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".dat") returned 0x0 [0088.285] lstrlenW (lpString=".DAT") returned 4 [0088.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".DAT") returned 0x0 [0088.285] lstrlenW (lpString=".ldf") returned 4 [0088.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".ldf") returned 0x0 [0088.285] lstrlenW (lpString=".LDF") returned 4 [0088.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch=".LDF") returned 0x0 [0088.285] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.285] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.286] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.286] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20828720447) returned 1 [0088.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc36fb0b0, dwHighDateTime=0x1d585b4)) [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33df30 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33df30 | out: hHeap=0x260000) returned 1 [0088.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.287] GetLastError () returned 0x0 [0088.287] GetLastError () returned 0x0 [0088.287] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.287] GetLastError () returned 0x0 [0088.287] GetLastError () returned 0x0 [0088.299] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.299] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2ec, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ec, lpOverlapped=0x0) returned 1 [0088.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.299] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.299] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.299] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.299] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.299] CloseHandle (hObject=0xe4) returned 1 [0088.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css.[deadmin@cock.li].deadmin")) returned 1 [0088.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.301] GetLastError () returned 0x0 [0088.301] RtlWakeConditionVariable () returned 0x27e828 [0088.301] GetCurrentThreadId () returned 0x998 [0088.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".ldf") returned 0x0 [0088.301] lstrlenW (lpString=".vhd") returned 4 [0088.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".vhd") returned 0x0 [0088.301] lstrlenW (lpString=".vhdx") returned 5 [0088.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".vhdx") returned 0x0 [0088.301] lstrlenW (lpString=".pst") returned 4 [0088.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".pst") returned 0x0 [0088.301] lstrlenW (lpString=".ost") returned 4 [0088.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".ost") returned 0x0 [0088.301] lstrlenW (lpString=".bak") returned 4 [0088.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".bak") returned 0x0 [0088.302] lstrlenW (lpString=".bac") returned 4 [0088.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".bac") returned 0x0 [0088.302] lstrlenW (lpString=".sys") returned 4 [0088.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".sys") returned 0x0 [0088.302] lstrlenW (lpString=".v2i") returned 4 [0088.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".v2i") returned 0x0 [0088.302] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.303] lstrlenW (lpString=".sql") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".sql") returned 0x0 [0088.303] lstrlenW (lpString=".mdf") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".mdf") returned 0x0 [0088.303] lstrlenW (lpString=".txt") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".txt") returned 0x0 [0088.303] lstrlenW (lpString=".dbf") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".dbf") returned 0x0 [0088.303] lstrlenW (lpString=".ckp") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".ckp") returned 0x0 [0088.303] lstrlenW (lpString=".dacpac") returned 7 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".dacpac") returned 0x0 [0088.303] lstrlenW (lpString=".db3") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".db3") returned 0x0 [0088.303] lstrlenW (lpString=".dtxs") returned 5 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".dtxs") returned 0x0 [0088.303] lstrlenW (lpString=".mdt") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".mdt") returned 0x0 [0088.303] lstrlenW (lpString=".sdf") returned 4 [0088.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".sdf") returned 0x0 [0088.304] lstrlenW (lpString=".MDF") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".MDF") returned 0x0 [0088.304] lstrlenW (lpString=".DBF") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".DBF") returned 0x0 [0088.304] lstrlenW (lpString=".DB") returned 3 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".DB") returned 0x0 [0088.304] lstrlenW (lpString=".db") returned 3 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".db") returned 0x0 [0088.304] lstrlenW (lpString=".ndf") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".ndf") returned 0x0 [0088.304] lstrlenW (lpString=".NDF") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".NDF") returned 0x0 [0088.304] lstrlenW (lpString=".Mdf") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".Mdf") returned 0x0 [0088.304] lstrlenW (lpString=".dat") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".dat") returned 0x0 [0088.304] lstrlenW (lpString=".DAT") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".DAT") returned 0x0 [0088.304] lstrlenW (lpString=".ldf") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".ldf") returned 0x0 [0088.304] lstrlenW (lpString=".LDF") returned 4 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch=".LDF") returned 0x0 [0088.304] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.305] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.305] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.305] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.306] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20830668007) returned 1 [0088.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3721210, dwHighDateTime=0x1d585b4)) [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dfa0 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dfa0 | out: hHeap=0x260000) returned 1 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.306] GetLastError () returned 0x0 [0088.307] GetLastError () returned 0x0 [0088.307] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.307] GetLastError () returned 0x0 [0088.307] GetLastError () returned 0x0 [0088.308] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff7aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.309] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x856, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x856, lpOverlapped=0x0) returned 1 [0088.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.309] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.309] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.309] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.309] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.309] CloseHandle (hObject=0xe4) returned 1 [0088.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0088.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.311] GetLastError () returned 0x0 [0088.311] RtlWakeConditionVariable () returned 0x0 [0088.311] GetCurrentThreadId () returned 0x998 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0088.311] lstrlenW (lpString=".vhd") returned 4 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".vhd") returned 0x0 [0088.311] lstrlenW (lpString=".vhdx") returned 5 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".vhdx") returned 0x0 [0088.311] lstrlenW (lpString=".pst") returned 4 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".pst") returned 0x0 [0088.311] lstrlenW (lpString=".ost") returned 4 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".ost") returned 0x0 [0088.311] lstrlenW (lpString=".bak") returned 4 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".bak") returned 0x0 [0088.311] lstrlenW (lpString=".bac") returned 4 [0088.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".bac") returned 0x0 [0088.311] lstrlenW (lpString=".sys") returned 4 [0088.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".sys") returned 0x0 [0088.312] lstrlenW (lpString=".v2i") returned 4 [0088.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".v2i") returned 0x0 [0088.468] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.545] lstrlenW (lpString=".sql") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".sql") returned 0x0 [0088.545] lstrlenW (lpString=".mdf") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".mdf") returned 0x0 [0088.545] lstrlenW (lpString=".txt") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".txt") returned 0x0 [0088.545] lstrlenW (lpString=".dbf") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".dbf") returned 0x0 [0088.545] lstrlenW (lpString=".ckp") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".ckp") returned 0x0 [0088.545] lstrlenW (lpString=".dacpac") returned 7 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".dacpac") returned 0x0 [0088.545] lstrlenW (lpString=".db3") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".db3") returned 0x0 [0088.545] lstrlenW (lpString=".dtxs") returned 5 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".dtxs") returned 0x0 [0088.545] lstrlenW (lpString=".mdt") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".mdt") returned 0x0 [0088.545] lstrlenW (lpString=".sdf") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".sdf") returned 0x0 [0088.545] lstrlenW (lpString=".MDF") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".MDF") returned 0x0 [0088.545] lstrlenW (lpString=".DBF") returned 4 [0088.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".DBF") returned 0x0 [0088.546] lstrlenW (lpString=".DB") returned 3 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".DB") returned 0x0 [0088.546] lstrlenW (lpString=".db") returned 3 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".db") returned 0x0 [0088.546] lstrlenW (lpString=".ndf") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".ndf") returned 0x0 [0088.546] lstrlenW (lpString=".NDF") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".NDF") returned 0x0 [0088.546] lstrlenW (lpString=".Mdf") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".Mdf") returned 0x0 [0088.546] lstrlenW (lpString=".dat") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".dat") returned 0x0 [0088.546] lstrlenW (lpString=".DAT") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".DAT") returned 0x0 [0088.546] lstrlenW (lpString=".ldf") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0088.546] lstrlenW (lpString=".LDF") returned 4 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch=".LDF") returned 0x0 [0088.546] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.547] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.547] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.547] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.547] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20854862740) returned 1 [0088.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3982810, dwHighDateTime=0x1d585b4)) [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eeb0 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eeb0 | out: hHeap=0x260000) returned 1 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.548] GetLastError () returned 0x0 [0088.549] GetLastError () returned 0x0 [0088.549] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.549] GetLastError () returned 0x0 [0088.549] GetLastError () returned 0x0 [0088.550] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffb902, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.551] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x46fe, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x46fe, lpOverlapped=0x0) returned 1 [0088.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.551] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.551] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.551] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.551] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.551] CloseHandle (hObject=0xe4) returned 1 [0088.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27dd1b0 [0088.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0088.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dd1b0 | out: hHeap=0x260000) returned 1 [0088.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.553] GetLastError () returned 0x0 [0088.553] RtlWakeConditionVariable () returned 0x0 [0088.553] GetCurrentThreadId () returned 0x998 [0088.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.553] lstrlenW (lpString=".vhd") returned 4 [0088.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0088.553] lstrlenW (lpString=".vhdx") returned 5 [0088.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0088.553] lstrlenW (lpString=".pst") returned 4 [0088.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0088.553] lstrlenW (lpString=".ost") returned 4 [0088.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0088.553] lstrlenW (lpString=".bak") returned 4 [0088.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0088.554] lstrlenW (lpString=".bac") returned 4 [0088.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0088.554] lstrlenW (lpString=".sys") returned 4 [0088.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0088.554] lstrlenW (lpString=".v2i") returned 4 [0088.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0088.554] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.574] lstrlenW (lpString=".sql") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0088.575] lstrlenW (lpString=".mdf") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0088.575] lstrlenW (lpString=".txt") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0088.575] lstrlenW (lpString=".dbf") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0088.575] lstrlenW (lpString=".ckp") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0088.575] lstrlenW (lpString=".dacpac") returned 7 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0088.575] lstrlenW (lpString=".db3") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0088.575] lstrlenW (lpString=".dtxs") returned 5 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0088.575] lstrlenW (lpString=".mdt") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0088.575] lstrlenW (lpString=".sdf") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0088.575] lstrlenW (lpString=".MDF") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0088.575] lstrlenW (lpString=".DBF") returned 4 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0088.575] lstrlenW (lpString=".DB") returned 3 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0088.575] lstrlenW (lpString=".db") returned 3 [0088.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0088.576] lstrlenW (lpString=".ndf") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0088.576] lstrlenW (lpString=".NDF") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0088.576] lstrlenW (lpString=".Mdf") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0088.576] lstrlenW (lpString=".dat") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0088.576] lstrlenW (lpString=".DAT") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0088.576] lstrlenW (lpString=".ldf") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.576] lstrlenW (lpString=".LDF") returned 4 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0088.576] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.576] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.577] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.577] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20857851132) returned 1 [0088.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc39cead0, dwHighDateTime=0x1d585b4)) [0088.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32efc8 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32efc8 | out: hHeap=0x260000) returned 1 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.578] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.578] GetLastError () returned 0x0 [0088.578] GetLastError () returned 0x0 [0088.579] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.579] GetLastError () returned 0x0 [0088.579] GetLastError () returned 0x0 [0088.580] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.580] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0088.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.580] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.580] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.580] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.580] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.580] CloseHandle (hObject=0xe4) returned 1 [0088.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0088.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.602] GetLastError () returned 0x0 [0088.602] RtlWakeConditionVariable () returned 0x27e828 [0088.602] GetCurrentThreadId () returned 0x998 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.603] lstrlenW (lpString=".vhd") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0088.603] lstrlenW (lpString=".vhdx") returned 5 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0088.603] lstrlenW (lpString=".pst") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0088.603] lstrlenW (lpString=".ost") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0088.603] lstrlenW (lpString=".bak") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0088.603] lstrlenW (lpString=".bac") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0088.603] lstrlenW (lpString=".sys") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0088.603] lstrlenW (lpString=".v2i") returned 4 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0088.603] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.604] lstrlenW (lpString=".sql") returned 4 [0088.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0088.604] lstrlenW (lpString=".mdf") returned 4 [0088.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0088.604] lstrlenW (lpString=".txt") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0088.605] lstrlenW (lpString=".dbf") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0088.605] lstrlenW (lpString=".ckp") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0088.605] lstrlenW (lpString=".dacpac") returned 7 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0088.605] lstrlenW (lpString=".db3") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0088.605] lstrlenW (lpString=".dtxs") returned 5 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0088.605] lstrlenW (lpString=".mdt") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0088.605] lstrlenW (lpString=".sdf") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0088.605] lstrlenW (lpString=".MDF") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0088.605] lstrlenW (lpString=".DBF") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0088.605] lstrlenW (lpString=".DB") returned 3 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0088.605] lstrlenW (lpString=".db") returned 3 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".db") returned 0x0 [0088.605] lstrlenW (lpString=".ndf") returned 4 [0088.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0088.605] lstrlenW (lpString=".NDF") returned 4 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0088.606] lstrlenW (lpString=".Mdf") returned 4 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0088.606] lstrlenW (lpString=".dat") returned 4 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0088.606] lstrlenW (lpString=".DAT") returned 4 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0088.606] lstrlenW (lpString=".ldf") returned 4 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.606] lstrlenW (lpString=".LDF") returned 4 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0088.606] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.606] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.607] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.607] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.607] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20860819394) returned 1 [0088.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc39f4c30, dwHighDateTime=0x1d585b4)) [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f070 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f070 | out: hHeap=0x260000) returned 1 [0088.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.608] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.608] GetLastError () returned 0x0 [0088.608] GetLastError () returned 0x0 [0088.608] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.608] GetLastError () returned 0x0 [0088.609] GetLastError () returned 0x0 [0088.610] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.610] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x94, lpOverlapped=0x0) returned 1 [0088.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.610] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.610] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.610] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.610] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.610] CloseHandle (hObject=0xe4) returned 1 [0088.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27dd2d8 [0088.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dd2d8 | out: hHeap=0x260000) returned 1 [0088.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.613] GetLastError () returned 0x0 [0088.613] RtlWakeConditionVariable () returned 0x0 [0088.613] GetCurrentThreadId () returned 0x998 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.613] lstrlenW (lpString=".vhd") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0088.613] lstrlenW (lpString=".vhdx") returned 5 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0088.613] lstrlenW (lpString=".pst") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0088.613] lstrlenW (lpString=".ost") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0088.613] lstrlenW (lpString=".bak") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0088.613] lstrlenW (lpString=".bac") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0088.613] lstrlenW (lpString=".sys") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0088.613] lstrlenW (lpString=".v2i") returned 4 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0088.613] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.614] lstrlenW (lpString=".sql") returned 4 [0088.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0088.614] lstrlenW (lpString=".mdf") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0088.615] lstrlenW (lpString=".txt") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0088.615] lstrlenW (lpString=".dbf") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0088.615] lstrlenW (lpString=".ckp") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0088.615] lstrlenW (lpString=".dacpac") returned 7 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0088.615] lstrlenW (lpString=".db3") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0088.615] lstrlenW (lpString=".dtxs") returned 5 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0088.615] lstrlenW (lpString=".mdt") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0088.615] lstrlenW (lpString=".sdf") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0088.615] lstrlenW (lpString=".MDF") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0088.615] lstrlenW (lpString=".DBF") returned 4 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0088.615] lstrlenW (lpString=".DB") returned 3 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0088.615] lstrlenW (lpString=".db") returned 3 [0088.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0088.615] lstrlenW (lpString=".ndf") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0088.616] lstrlenW (lpString=".NDF") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0088.616] lstrlenW (lpString=".Mdf") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0088.616] lstrlenW (lpString=".dat") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0088.616] lstrlenW (lpString=".DAT") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0088.616] lstrlenW (lpString=".ldf") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.616] lstrlenW (lpString=".LDF") returned 4 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0088.616] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.616] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.617] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.617] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20861823831) returned 1 [0088.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3a1ad90, dwHighDateTime=0x1d585b4)) [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f0a8 [0088.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f0a8 | out: hHeap=0x260000) returned 1 [0088.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.618] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.618] GetLastError () returned 0x0 [0088.618] GetLastError () returned 0x0 [0088.618] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.618] GetLastError () returned 0x0 [0088.618] GetLastError () returned 0x0 [0088.620] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffe10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.620] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f0, lpOverlapped=0x0) returned 1 [0088.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.620] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.620] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.620] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.620] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.620] CloseHandle (hObject=0xe4) returned 1 [0088.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27dd2d8 [0088.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dd2d8 | out: hHeap=0x260000) returned 1 [0088.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.622] GetLastError () returned 0x0 [0088.622] RtlWakeConditionVariable () returned 0x0 [0088.622] GetCurrentThreadId () returned 0x998 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.622] lstrlenW (lpString=".vhd") returned 4 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0088.622] lstrlenW (lpString=".vhdx") returned 5 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0088.622] lstrlenW (lpString=".pst") returned 4 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0088.622] lstrlenW (lpString=".ost") returned 4 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0088.622] lstrlenW (lpString=".bak") returned 4 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0088.622] lstrlenW (lpString=".bac") returned 4 [0088.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0088.623] lstrlenW (lpString=".sys") returned 4 [0088.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0088.623] lstrlenW (lpString=".v2i") returned 4 [0088.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0088.623] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.624] lstrlenW (lpString=".sql") returned 4 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0088.624] lstrlenW (lpString=".mdf") returned 4 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0088.624] lstrlenW (lpString=".txt") returned 4 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0088.624] lstrlenW (lpString=".dbf") returned 4 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0088.624] lstrlenW (lpString=".ckp") returned 4 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0088.624] lstrlenW (lpString=".dacpac") returned 7 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0088.624] lstrlenW (lpString=".db3") returned 4 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0088.624] lstrlenW (lpString=".dtxs") returned 5 [0088.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0088.624] lstrlenW (lpString=".mdt") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0088.625] lstrlenW (lpString=".sdf") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0088.625] lstrlenW (lpString=".MDF") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0088.625] lstrlenW (lpString=".DBF") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0088.625] lstrlenW (lpString=".DB") returned 3 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0088.625] lstrlenW (lpString=".db") returned 3 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0088.625] lstrlenW (lpString=".ndf") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0088.625] lstrlenW (lpString=".NDF") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0088.625] lstrlenW (lpString=".Mdf") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0088.625] lstrlenW (lpString=".dat") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0088.625] lstrlenW (lpString=".DAT") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0088.625] lstrlenW (lpString=".ldf") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.625] lstrlenW (lpString=".LDF") returned 4 [0088.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0088.625] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.626] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.626] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.626] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.627] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20862773954) returned 1 [0088.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3a40ef0, dwHighDateTime=0x1d585b4)) [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f0e0 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f0e0 | out: hHeap=0x260000) returned 1 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.628] GetLastError () returned 0x0 [0088.628] GetLastError () returned 0x0 [0088.628] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.628] GetLastError () returned 0x0 [0088.628] GetLastError () returned 0x0 [0088.630] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.630] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x401, lpOverlapped=0x0) returned 1 [0088.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.630] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.630] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.630] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.630] CloseHandle (hObject=0xe4) returned 1 [0088.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27dd2d8 [0088.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dd2d8 | out: hHeap=0x260000) returned 1 [0088.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.633] GetLastError () returned 0x0 [0088.633] RtlWakeConditionVariable () returned 0x0 [0088.633] GetCurrentThreadId () returned 0x998 [0088.634] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.634] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.634] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0088.634] WriteFile (in: hFile=0xe4, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0088.636] CloseHandle (hObject=0xe4) returned 1 [0088.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.636] RtlWakeConditionVariable () returned 0x27e828 [0088.636] GetCurrentThreadId () returned 0x998 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".ldf") returned 0x0 [0088.636] lstrlenW (lpString=".vhd") returned 4 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".vhd") returned 0x0 [0088.636] lstrlenW (lpString=".vhdx") returned 5 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".vhdx") returned 0x0 [0088.636] lstrlenW (lpString=".pst") returned 4 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".pst") returned 0x0 [0088.636] lstrlenW (lpString=".ost") returned 4 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".ost") returned 0x0 [0088.636] lstrlenW (lpString=".bak") returned 4 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".bak") returned 0x0 [0088.636] lstrlenW (lpString=".bac") returned 4 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".bac") returned 0x0 [0088.636] lstrlenW (lpString=".sys") returned 4 [0088.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".sys") returned 0x0 [0088.637] lstrlenW (lpString=".v2i") returned 4 [0088.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".v2i") returned 0x0 [0088.637] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.638] lstrlenW (lpString=".sql") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".sql") returned 0x0 [0088.638] lstrlenW (lpString=".mdf") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".mdf") returned 0x0 [0088.638] lstrlenW (lpString=".txt") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".txt") returned 0x0 [0088.638] lstrlenW (lpString=".dbf") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".dbf") returned 0x0 [0088.638] lstrlenW (lpString=".ckp") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".ckp") returned 0x0 [0088.638] lstrlenW (lpString=".dacpac") returned 7 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".dacpac") returned 0x0 [0088.638] lstrlenW (lpString=".db3") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".db3") returned 0x0 [0088.638] lstrlenW (lpString=".dtxs") returned 5 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".dtxs") returned 0x0 [0088.638] lstrlenW (lpString=".mdt") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".mdt") returned 0x0 [0088.638] lstrlenW (lpString=".sdf") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".sdf") returned 0x0 [0088.638] lstrlenW (lpString=".MDF") returned 4 [0088.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".MDF") returned 0x0 [0088.638] lstrlenW (lpString=".DBF") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".DBF") returned 0x0 [0088.639] lstrlenW (lpString=".DB") returned 3 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".DB") returned 0x0 [0088.639] lstrlenW (lpString=".db") returned 3 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".db") returned 0x0 [0088.639] lstrlenW (lpString=".ndf") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".ndf") returned 0x0 [0088.639] lstrlenW (lpString=".NDF") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".NDF") returned 0x0 [0088.639] lstrlenW (lpString=".Mdf") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".Mdf") returned 0x0 [0088.639] lstrlenW (lpString=".dat") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".dat") returned 0x0 [0088.639] lstrlenW (lpString=".DAT") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".DAT") returned 0x0 [0088.639] lstrlenW (lpString=".ldf") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".ldf") returned 0x0 [0088.639] lstrlenW (lpString=".LDF") returned 4 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch=".LDF") returned 0x0 [0088.639] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.640] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.640] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.641] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20864166655) returned 1 [0088.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3a67050, dwHighDateTime=0x1d585b4)) [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f150 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f150 | out: hHeap=0x260000) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.641] GetLastError () returned 0x0 [0088.642] GetLastError () returned 0x0 [0088.642] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.642] GetLastError () returned 0x0 [0088.642] GetLastError () returned 0x0 [0088.644] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff689, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.644] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x977, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x977, lpOverlapped=0x0) returned 1 [0088.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.644] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.644] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.644] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.644] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.644] CloseHandle (hObject=0xe4) returned 1 [0088.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css.[deadmin@cock.li].deadmin")) returned 1 [0088.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.646] GetLastError () returned 0x0 [0088.646] RtlWakeConditionVariable () returned 0x0 [0088.646] GetCurrentThreadId () returned 0x998 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".ldf") returned 0x0 [0088.646] lstrlenW (lpString=".vhd") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".vhd") returned 0x0 [0088.646] lstrlenW (lpString=".vhdx") returned 5 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".vhdx") returned 0x0 [0088.646] lstrlenW (lpString=".pst") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".pst") returned 0x0 [0088.646] lstrlenW (lpString=".ost") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".ost") returned 0x0 [0088.646] lstrlenW (lpString=".bak") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".bak") returned 0x0 [0088.646] lstrlenW (lpString=".bac") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".bac") returned 0x0 [0088.646] lstrlenW (lpString=".sys") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".sys") returned 0x0 [0088.646] lstrlenW (lpString=".v2i") returned 4 [0088.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".v2i") returned 0x0 [0088.646] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.647] lstrlenW (lpString=".sql") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".sql") returned 0x0 [0088.648] lstrlenW (lpString=".mdf") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".mdf") returned 0x0 [0088.648] lstrlenW (lpString=".txt") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".txt") returned 0x0 [0088.648] lstrlenW (lpString=".dbf") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".dbf") returned 0x0 [0088.648] lstrlenW (lpString=".ckp") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".ckp") returned 0x0 [0088.648] lstrlenW (lpString=".dacpac") returned 7 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".dacpac") returned 0x0 [0088.648] lstrlenW (lpString=".db3") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".db3") returned 0x0 [0088.648] lstrlenW (lpString=".dtxs") returned 5 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".dtxs") returned 0x0 [0088.648] lstrlenW (lpString=".mdt") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".mdt") returned 0x0 [0088.648] lstrlenW (lpString=".sdf") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".sdf") returned 0x0 [0088.648] lstrlenW (lpString=".MDF") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".MDF") returned 0x0 [0088.648] lstrlenW (lpString=".DBF") returned 4 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".DBF") returned 0x0 [0088.648] lstrlenW (lpString=".DB") returned 3 [0088.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".DB") returned 0x0 [0088.648] lstrlenW (lpString=".db") returned 3 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".db") returned 0x0 [0088.649] lstrlenW (lpString=".ndf") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".ndf") returned 0x0 [0088.649] lstrlenW (lpString=".NDF") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".NDF") returned 0x0 [0088.649] lstrlenW (lpString=".Mdf") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".Mdf") returned 0x0 [0088.649] lstrlenW (lpString=".dat") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".dat") returned 0x0 [0088.649] lstrlenW (lpString=".DAT") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".DAT") returned 0x0 [0088.649] lstrlenW (lpString=".ldf") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".ldf") returned 0x0 [0088.649] lstrlenW (lpString=".LDF") returned 4 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch=".LDF") returned 0x0 [0088.649] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.649] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.650] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.650] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.650] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20865134690) returned 1 [0088.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3a67050, dwHighDateTime=0x1d585b4)) [0088.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f188 [0088.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f188 | out: hHeap=0x260000) returned 1 [0088.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.651] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.651] GetLastError () returned 0x0 [0088.651] GetLastError () returned 0x0 [0088.651] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.651] GetLastError () returned 0x0 [0088.652] GetLastError () returned 0x0 [0088.861] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.861] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x370, lpOverlapped=0x0) returned 1 [0088.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.957] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.957] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.957] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.958] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.958] CloseHandle (hObject=0xe4) returned 1 [0088.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0088.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css.[deadmin@cock.li].deadmin")) returned 1 [0088.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0088.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.960] GetLastError () returned 0x0 [0088.960] RtlWakeConditionVariable () returned 0x0 [0088.960] GetCurrentThreadId () returned 0x998 [0088.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".ldf") returned 0x0 [0088.960] lstrlenW (lpString=".vhd") returned 4 [0088.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".vhd") returned 0x0 [0088.961] lstrlenW (lpString=".vhdx") returned 5 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".vhdx") returned 0x0 [0088.961] lstrlenW (lpString=".pst") returned 4 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".pst") returned 0x0 [0088.961] lstrlenW (lpString=".ost") returned 4 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".ost") returned 0x0 [0088.961] lstrlenW (lpString=".bak") returned 4 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".bak") returned 0x0 [0088.961] lstrlenW (lpString=".bac") returned 4 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".bac") returned 0x0 [0088.961] lstrlenW (lpString=".sys") returned 4 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".sys") returned 0x0 [0088.961] lstrlenW (lpString=".v2i") returned 4 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".v2i") returned 0x0 [0088.961] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.963] lstrlenW (lpString=".sql") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".sql") returned 0x0 [0088.963] lstrlenW (lpString=".mdf") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".mdf") returned 0x0 [0088.963] lstrlenW (lpString=".txt") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".txt") returned 0x0 [0088.963] lstrlenW (lpString=".dbf") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".dbf") returned 0x0 [0088.963] lstrlenW (lpString=".ckp") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".ckp") returned 0x0 [0088.963] lstrlenW (lpString=".dacpac") returned 7 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".dacpac") returned 0x0 [0088.963] lstrlenW (lpString=".db3") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".db3") returned 0x0 [0088.963] lstrlenW (lpString=".dtxs") returned 5 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".dtxs") returned 0x0 [0088.963] lstrlenW (lpString=".mdt") returned 4 [0088.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".mdt") returned 0x0 [0088.964] lstrlenW (lpString=".sdf") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".sdf") returned 0x0 [0088.964] lstrlenW (lpString=".MDF") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".MDF") returned 0x0 [0088.964] lstrlenW (lpString=".DBF") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".DBF") returned 0x0 [0088.964] lstrlenW (lpString=".DB") returned 3 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".DB") returned 0x0 [0088.964] lstrlenW (lpString=".db") returned 3 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".db") returned 0x0 [0088.964] lstrlenW (lpString=".ndf") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".ndf") returned 0x0 [0088.964] lstrlenW (lpString=".NDF") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".NDF") returned 0x0 [0088.964] lstrlenW (lpString=".Mdf") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".Mdf") returned 0x0 [0088.964] lstrlenW (lpString=".dat") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".dat") returned 0x0 [0088.964] lstrlenW (lpString=".DAT") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".DAT") returned 0x0 [0088.964] lstrlenW (lpString=".ldf") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".ldf") returned 0x0 [0088.964] lstrlenW (lpString=".LDF") returned 4 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch=".LDF") returned 0x0 [0088.964] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.965] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.965] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.965] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.966] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20896675748) returned 1 [0088.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3d60bd0, dwHighDateTime=0x1d585b4)) [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ebd8 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ebd8 | out: hHeap=0x260000) returned 1 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.966] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.967] GetLastError () returned 0x0 [0088.967] GetLastError () returned 0x0 [0088.967] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.967] GetLastError () returned 0x0 [0088.967] GetLastError () returned 0x0 [0088.972] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff50e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.972] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xaf2, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xaf2, lpOverlapped=0x0) returned 1 [0088.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.972] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.972] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.975] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.975] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.975] CloseHandle (hObject=0xe4) returned 1 [0088.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css.[deadmin@cock.li].deadmin")) returned 1 [0088.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.978] GetLastError () returned 0x0 [0088.978] RtlWakeConditionVariable () returned 0x0 [0088.978] GetCurrentThreadId () returned 0x998 [0088.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".ldf") returned 0x0 [0088.978] lstrlenW (lpString=".vhd") returned 4 [0088.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".vhd") returned 0x0 [0088.978] lstrlenW (lpString=".vhdx") returned 5 [0088.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".vhdx") returned 0x0 [0088.978] lstrlenW (lpString=".pst") returned 4 [0088.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".pst") returned 0x0 [0088.978] lstrlenW (lpString=".ost") returned 4 [0088.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".ost") returned 0x0 [0088.979] lstrlenW (lpString=".bak") returned 4 [0088.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".bak") returned 0x0 [0088.979] lstrlenW (lpString=".bac") returned 4 [0088.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".bac") returned 0x0 [0088.979] lstrlenW (lpString=".sys") returned 4 [0088.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".sys") returned 0x0 [0088.979] lstrlenW (lpString=".v2i") returned 4 [0088.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".v2i") returned 0x0 [0088.979] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.982] lstrlenW (lpString=".sql") returned 4 [0088.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".sql") returned 0x0 [0088.982] lstrlenW (lpString=".mdf") returned 4 [0088.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".mdf") returned 0x0 [0088.982] lstrlenW (lpString=".txt") returned 4 [0088.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".txt") returned 0x0 [0088.982] lstrlenW (lpString=".dbf") returned 4 [0088.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".dbf") returned 0x0 [0088.982] lstrlenW (lpString=".ckp") returned 4 [0088.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".ckp") returned 0x0 [0088.983] lstrlenW (lpString=".dacpac") returned 7 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".dacpac") returned 0x0 [0088.983] lstrlenW (lpString=".db3") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".db3") returned 0x0 [0088.983] lstrlenW (lpString=".dtxs") returned 5 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".dtxs") returned 0x0 [0088.983] lstrlenW (lpString=".mdt") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".mdt") returned 0x0 [0088.983] lstrlenW (lpString=".sdf") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".sdf") returned 0x0 [0088.983] lstrlenW (lpString=".MDF") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".MDF") returned 0x0 [0088.983] lstrlenW (lpString=".DBF") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".DBF") returned 0x0 [0088.983] lstrlenW (lpString=".DB") returned 3 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".DB") returned 0x0 [0088.983] lstrlenW (lpString=".db") returned 3 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".db") returned 0x0 [0088.983] lstrlenW (lpString=".ndf") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".ndf") returned 0x0 [0088.983] lstrlenW (lpString=".NDF") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".NDF") returned 0x0 [0088.983] lstrlenW (lpString=".Mdf") returned 4 [0088.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".Mdf") returned 0x0 [0088.983] lstrlenW (lpString=".dat") returned 4 [0088.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".dat") returned 0x0 [0088.984] lstrlenW (lpString=".DAT") returned 4 [0088.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".DAT") returned 0x0 [0088.984] lstrlenW (lpString=".ldf") returned 4 [0088.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".ldf") returned 0x0 [0088.984] lstrlenW (lpString=".LDF") returned 4 [0088.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch=".LDF") returned 0x0 [0088.984] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.984] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0088.985] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.985] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0088.985] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20898611479) returned 1 [0088.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3dace90, dwHighDateTime=0x1d585b4)) [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ec10 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ec10 | out: hHeap=0x260000) returned 1 [0088.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.986] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0088.986] GetLastError () returned 0x0 [0088.986] GetLastError () returned 0x0 [0088.986] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0088.986] GetLastError () returned 0x0 [0088.987] GetLastError () returned 0x0 [0088.988] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.988] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3a4, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3a4, lpOverlapped=0x0) returned 1 [0088.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.988] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.988] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.988] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.989] CloseHandle (hObject=0xe4) returned 1 [0088.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css.[deadmin@cock.li].deadmin")) returned 1 [0088.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0088.991] GetLastError () returned 0x0 [0088.991] RtlWakeConditionVariable () returned 0x0 [0088.991] GetCurrentThreadId () returned 0x998 [0088.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".ldf") returned 0x0 [0088.991] lstrlenW (lpString=".vhd") returned 4 [0088.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".vhd") returned 0x0 [0088.992] lstrlenW (lpString=".vhdx") returned 5 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".vhdx") returned 0x0 [0088.992] lstrlenW (lpString=".pst") returned 4 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".pst") returned 0x0 [0088.992] lstrlenW (lpString=".ost") returned 4 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".ost") returned 0x0 [0088.992] lstrlenW (lpString=".bak") returned 4 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".bak") returned 0x0 [0088.992] lstrlenW (lpString=".bac") returned 4 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".bac") returned 0x0 [0088.992] lstrlenW (lpString=".sys") returned 4 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".sys") returned 0x0 [0088.992] lstrlenW (lpString=".v2i") returned 4 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".v2i") returned 0x0 [0088.992] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.007] lstrlenW (lpString=".sql") returned 4 [0089.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".sql") returned 0x0 [0089.007] lstrlenW (lpString=".mdf") returned 4 [0089.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".mdf") returned 0x0 [0089.007] lstrlenW (lpString=".txt") returned 4 [0089.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".txt") returned 0x0 [0089.007] lstrlenW (lpString=".dbf") returned 4 [0089.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".dbf") returned 0x0 [0089.008] lstrlenW (lpString=".ckp") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".ckp") returned 0x0 [0089.008] lstrlenW (lpString=".dacpac") returned 7 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".dacpac") returned 0x0 [0089.008] lstrlenW (lpString=".db3") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".db3") returned 0x0 [0089.008] lstrlenW (lpString=".dtxs") returned 5 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".dtxs") returned 0x0 [0089.008] lstrlenW (lpString=".mdt") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".mdt") returned 0x0 [0089.008] lstrlenW (lpString=".sdf") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".sdf") returned 0x0 [0089.008] lstrlenW (lpString=".MDF") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".MDF") returned 0x0 [0089.008] lstrlenW (lpString=".DBF") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".DBF") returned 0x0 [0089.008] lstrlenW (lpString=".DB") returned 3 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".DB") returned 0x0 [0089.008] lstrlenW (lpString=".db") returned 3 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".db") returned 0x0 [0089.008] lstrlenW (lpString=".ndf") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".ndf") returned 0x0 [0089.008] lstrlenW (lpString=".NDF") returned 4 [0089.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".NDF") returned 0x0 [0089.008] lstrlenW (lpString=".Mdf") returned 4 [0089.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".Mdf") returned 0x0 [0089.009] lstrlenW (lpString=".dat") returned 4 [0089.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".dat") returned 0x0 [0089.009] lstrlenW (lpString=".DAT") returned 4 [0089.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".DAT") returned 0x0 [0089.009] lstrlenW (lpString=".ldf") returned 4 [0089.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".ldf") returned 0x0 [0089.009] lstrlenW (lpString=".LDF") returned 4 [0089.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch=".LDF") returned 0x0 [0089.009] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.009] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.010] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.010] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.010] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20901121090) returned 1 [0089.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3dd2ff0, dwHighDateTime=0x1d585b4)) [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eaf8 [0089.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eaf8 | out: hHeap=0x260000) returned 1 [0089.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.011] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.011] GetLastError () returned 0x0 [0089.011] GetLastError () returned 0x0 [0089.011] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.011] GetLastError () returned 0x0 [0089.012] GetLastError () returned 0x0 [0089.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.013] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x411, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x411, lpOverlapped=0x0) returned 1 [0089.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.014] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.014] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.014] CloseHandle (hObject=0xf0) returned 1 [0089.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css.[deadmin@cock.li].deadmin")) returned 1 [0089.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.017] GetLastError () returned 0x0 [0089.017] RtlWakeConditionVariable () returned 0x0 [0089.017] GetCurrentThreadId () returned 0x998 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.017] lstrlenW (lpString=".vhd") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0089.017] lstrlenW (lpString=".vhdx") returned 5 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0089.017] lstrlenW (lpString=".pst") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0089.017] lstrlenW (lpString=".ost") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0089.017] lstrlenW (lpString=".bak") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0089.017] lstrlenW (lpString=".bac") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0089.017] lstrlenW (lpString=".sys") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0089.017] lstrlenW (lpString=".v2i") returned 4 [0089.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0089.018] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.022] lstrlenW (lpString=".sql") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0089.022] lstrlenW (lpString=".mdf") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0089.022] lstrlenW (lpString=".txt") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0089.022] lstrlenW (lpString=".dbf") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0089.022] lstrlenW (lpString=".ckp") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0089.022] lstrlenW (lpString=".dacpac") returned 7 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0089.022] lstrlenW (lpString=".db3") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0089.022] lstrlenW (lpString=".dtxs") returned 5 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0089.022] lstrlenW (lpString=".mdt") returned 4 [0089.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0089.023] lstrlenW (lpString=".sdf") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0089.023] lstrlenW (lpString=".MDF") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0089.023] lstrlenW (lpString=".DBF") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0089.023] lstrlenW (lpString=".DB") returned 3 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0089.023] lstrlenW (lpString=".db") returned 3 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0089.023] lstrlenW (lpString=".ndf") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0089.023] lstrlenW (lpString=".NDF") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0089.023] lstrlenW (lpString=".Mdf") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0089.023] lstrlenW (lpString=".dat") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0089.023] lstrlenW (lpString=".DAT") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0089.023] lstrlenW (lpString=".ldf") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.023] lstrlenW (lpString=".LDF") returned 4 [0089.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0089.024] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.024] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.024] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.025] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20902583084) returned 1 [0089.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3df9150, dwHighDateTime=0x1d585b4)) [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1a50 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1a50 | out: hHeap=0x260000) returned 1 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.026] GetLastError () returned 0x0 [0089.026] GetLastError () returned 0x0 [0089.026] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.026] GetLastError () returned 0x0 [0089.026] GetLastError () returned 0x0 [0089.027] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.027] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0089.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.027] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.027] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.028] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.028] CloseHandle (hObject=0xd8) returned 1 [0089.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.029] GetLastError () returned 0x0 [0089.030] RtlWakeConditionVariable () returned 0x0 [0089.030] GetCurrentThreadId () returned 0x998 [0089.030] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.030] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.030] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.030] WriteFile (in: hFile=0xd8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.032] CloseHandle (hObject=0xd8) returned 1 [0089.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fbb0 | out: hHeap=0x260000) returned 1 [0089.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.032] RtlWakeConditionVariable () returned 0x27e828 [0089.032] GetCurrentThreadId () returned 0x998 [0089.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".ldf") returned 0x0 [0089.032] lstrlenW (lpString=".vhd") returned 4 [0089.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".vhd") returned 0x0 [0089.032] lstrlenW (lpString=".vhdx") returned 5 [0089.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".vhdx") returned 0x0 [0089.032] lstrlenW (lpString=".pst") returned 4 [0089.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".pst") returned 0x0 [0089.032] lstrlenW (lpString=".ost") returned 4 [0089.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".ost") returned 0x0 [0089.032] lstrlenW (lpString=".bak") returned 4 [0089.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".bak") returned 0x0 [0089.033] lstrlenW (lpString=".bac") returned 4 [0089.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".bac") returned 0x0 [0089.033] lstrlenW (lpString=".sys") returned 4 [0089.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".sys") returned 0x0 [0089.033] lstrlenW (lpString=".v2i") returned 4 [0089.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".v2i") returned 0x0 [0089.033] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.034] lstrlenW (lpString=".sql") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".sql") returned 0x0 [0089.034] lstrlenW (lpString=".mdf") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".mdf") returned 0x0 [0089.034] lstrlenW (lpString=".txt") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".txt") returned 0x0 [0089.034] lstrlenW (lpString=".dbf") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".dbf") returned 0x0 [0089.034] lstrlenW (lpString=".ckp") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".ckp") returned 0x0 [0089.034] lstrlenW (lpString=".dacpac") returned 7 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".dacpac") returned 0x0 [0089.034] lstrlenW (lpString=".db3") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".db3") returned 0x0 [0089.034] lstrlenW (lpString=".dtxs") returned 5 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".dtxs") returned 0x0 [0089.034] lstrlenW (lpString=".mdt") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".mdt") returned 0x0 [0089.034] lstrlenW (lpString=".sdf") returned 4 [0089.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".sdf") returned 0x0 [0089.034] lstrlenW (lpString=".MDF") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".MDF") returned 0x0 [0089.035] lstrlenW (lpString=".DBF") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".DBF") returned 0x0 [0089.035] lstrlenW (lpString=".DB") returned 3 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".DB") returned 0x0 [0089.035] lstrlenW (lpString=".db") returned 3 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".db") returned 0x0 [0089.035] lstrlenW (lpString=".ndf") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".ndf") returned 0x0 [0089.035] lstrlenW (lpString=".NDF") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".NDF") returned 0x0 [0089.035] lstrlenW (lpString=".Mdf") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".Mdf") returned 0x0 [0089.035] lstrlenW (lpString=".dat") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".dat") returned 0x0 [0089.035] lstrlenW (lpString=".DAT") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".DAT") returned 0x0 [0089.035] lstrlenW (lpString=".ldf") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".ldf") returned 0x0 [0089.035] lstrlenW (lpString=".LDF") returned 4 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch=".LDF") returned 0x0 [0089.035] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.036] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.036] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.036] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.037] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20903768092) returned 1 [0089.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3e1f2b0, dwHighDateTime=0x1d585b4)) [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1ac0 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1ac0 | out: hHeap=0x260000) returned 1 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.037] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.037] GetLastError () returned 0x0 [0089.038] GetLastError () returned 0x0 [0089.038] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.038] GetLastError () returned 0x0 [0089.038] GetLastError () returned 0x0 [0089.040] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff305, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.041] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcfb, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xcfb, lpOverlapped=0x0) returned 1 [0089.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.041] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.041] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.044] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.044] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.044] CloseHandle (hObject=0xd8) returned 1 [0089.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0089.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css.[deadmin@cock.li].deadmin")) returned 1 [0089.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.048] GetLastError () returned 0x0 [0089.048] RtlWakeConditionVariable () returned 0x0 [0089.048] GetCurrentThreadId () returned 0x998 [0089.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".ldf") returned 0x0 [0089.048] lstrlenW (lpString=".vhd") returned 4 [0089.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".vhd") returned 0x0 [0089.048] lstrlenW (lpString=".vhdx") returned 5 [0089.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".vhdx") returned 0x0 [0089.048] lstrlenW (lpString=".pst") returned 4 [0089.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".pst") returned 0x0 [0089.048] lstrlenW (lpString=".ost") returned 4 [0089.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".ost") returned 0x0 [0089.048] lstrlenW (lpString=".bak") returned 4 [0089.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".bak") returned 0x0 [0089.049] lstrlenW (lpString=".bac") returned 4 [0089.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".bac") returned 0x0 [0089.049] lstrlenW (lpString=".sys") returned 4 [0089.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".sys") returned 0x0 [0089.049] lstrlenW (lpString=".v2i") returned 4 [0089.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".v2i") returned 0x0 [0089.049] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.050] lstrlenW (lpString=".sql") returned 4 [0089.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".sql") returned 0x0 [0089.050] lstrlenW (lpString=".mdf") returned 4 [0089.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".mdf") returned 0x0 [0089.050] lstrlenW (lpString=".txt") returned 4 [0089.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".txt") returned 0x0 [0089.050] lstrlenW (lpString=".dbf") returned 4 [0089.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".dbf") returned 0x0 [0089.050] lstrlenW (lpString=".ckp") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".ckp") returned 0x0 [0089.051] lstrlenW (lpString=".dacpac") returned 7 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".dacpac") returned 0x0 [0089.051] lstrlenW (lpString=".db3") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".db3") returned 0x0 [0089.051] lstrlenW (lpString=".dtxs") returned 5 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".dtxs") returned 0x0 [0089.051] lstrlenW (lpString=".mdt") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".mdt") returned 0x0 [0089.051] lstrlenW (lpString=".sdf") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".sdf") returned 0x0 [0089.051] lstrlenW (lpString=".MDF") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".MDF") returned 0x0 [0089.051] lstrlenW (lpString=".DBF") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".DBF") returned 0x0 [0089.051] lstrlenW (lpString=".DB") returned 3 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".DB") returned 0x0 [0089.051] lstrlenW (lpString=".db") returned 3 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".db") returned 0x0 [0089.051] lstrlenW (lpString=".ndf") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".ndf") returned 0x0 [0089.051] lstrlenW (lpString=".NDF") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".NDF") returned 0x0 [0089.051] lstrlenW (lpString=".Mdf") returned 4 [0089.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".Mdf") returned 0x0 [0089.051] lstrlenW (lpString=".dat") returned 4 [0089.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".dat") returned 0x0 [0089.052] lstrlenW (lpString=".DAT") returned 4 [0089.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".DAT") returned 0x0 [0089.052] lstrlenW (lpString=".ldf") returned 4 [0089.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".ldf") returned 0x0 [0089.052] lstrlenW (lpString=".LDF") returned 4 [0089.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch=".LDF") returned 0x0 [0089.052] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.052] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.053] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.053] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.053] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20905410282) returned 1 [0089.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3e45410, dwHighDateTime=0x1d585b4)) [0089.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1af8 [0089.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1af8 | out: hHeap=0x260000) returned 1 [0089.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.054] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.055] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.055] GetLastError () returned 0x0 [0089.055] GetLastError () returned 0x0 [0089.055] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.055] GetLastError () returned 0x0 [0089.055] GetLastError () returned 0x0 [0089.059] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.059] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x362, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x362, lpOverlapped=0x0) returned 1 [0089.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.059] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.059] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.059] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.059] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.059] CloseHandle (hObject=0xd8) returned 1 [0089.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0089.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css.[deadmin@cock.li].deadmin")) returned 1 [0089.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.062] GetLastError () returned 0x0 [0089.062] RtlWakeConditionVariable () returned 0x0 [0089.062] GetCurrentThreadId () returned 0x998 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0089.062] lstrlenW (lpString=".vhd") returned 4 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0089.062] lstrlenW (lpString=".vhdx") returned 5 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0089.062] lstrlenW (lpString=".pst") returned 4 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0089.062] lstrlenW (lpString=".ost") returned 4 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0089.062] lstrlenW (lpString=".bak") returned 4 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0089.062] lstrlenW (lpString=".bac") returned 4 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0089.062] lstrlenW (lpString=".sys") returned 4 [0089.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0089.063] lstrlenW (lpString=".v2i") returned 4 [0089.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0089.063] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.064] lstrlenW (lpString=".sql") returned 4 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0089.064] lstrlenW (lpString=".mdf") returned 4 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0089.064] lstrlenW (lpString=".txt") returned 4 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0089.064] lstrlenW (lpString=".dbf") returned 4 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0089.064] lstrlenW (lpString=".ckp") returned 4 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0089.064] lstrlenW (lpString=".dacpac") returned 7 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0089.064] lstrlenW (lpString=".db3") returned 4 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0089.064] lstrlenW (lpString=".dtxs") returned 5 [0089.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0089.065] lstrlenW (lpString=".mdt") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0089.065] lstrlenW (lpString=".sdf") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0089.065] lstrlenW (lpString=".MDF") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0089.065] lstrlenW (lpString=".DBF") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0089.065] lstrlenW (lpString=".DB") returned 3 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0089.065] lstrlenW (lpString=".db") returned 3 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".db") returned 0x0 [0089.065] lstrlenW (lpString=".ndf") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0089.065] lstrlenW (lpString=".NDF") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0089.065] lstrlenW (lpString=".Mdf") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0089.065] lstrlenW (lpString=".dat") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0089.065] lstrlenW (lpString=".DAT") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0089.065] lstrlenW (lpString=".ldf") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0089.065] lstrlenW (lpString=".LDF") returned 4 [0089.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0089.066] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.066] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.066] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.067] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20906782351) returned 1 [0089.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3e6b570, dwHighDateTime=0x1d585b4)) [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1b30 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1b30 | out: hHeap=0x260000) returned 1 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.068] GetLastError () returned 0x0 [0089.068] GetLastError () returned 0x0 [0089.068] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.068] GetLastError () returned 0x0 [0089.068] GetLastError () returned 0x0 [0089.070] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff794, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.070] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x86c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x86c, lpOverlapped=0x0) returned 1 [0089.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.070] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.070] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.070] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.070] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.070] CloseHandle (hObject=0xd8) returned 1 [0089.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.072] GetLastError () returned 0x0 [0089.072] RtlWakeConditionVariable () returned 0x0 [0089.072] GetCurrentThreadId () returned 0x998 [0089.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.072] lstrlenW (lpString=".vhd") returned 4 [0089.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0089.072] lstrlenW (lpString=".vhdx") returned 5 [0089.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0089.072] lstrlenW (lpString=".pst") returned 4 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0089.073] lstrlenW (lpString=".ost") returned 4 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0089.073] lstrlenW (lpString=".bak") returned 4 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0089.073] lstrlenW (lpString=".bac") returned 4 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0089.073] lstrlenW (lpString=".sys") returned 4 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0089.073] lstrlenW (lpString=".v2i") returned 4 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0089.073] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.074] lstrlenW (lpString=".sql") returned 4 [0089.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0089.074] lstrlenW (lpString=".mdf") returned 4 [0089.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0089.074] lstrlenW (lpString=".txt") returned 4 [0089.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0089.074] lstrlenW (lpString=".dbf") returned 4 [0089.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0089.075] lstrlenW (lpString=".ckp") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0089.075] lstrlenW (lpString=".dacpac") returned 7 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0089.075] lstrlenW (lpString=".db3") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0089.075] lstrlenW (lpString=".dtxs") returned 5 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0089.075] lstrlenW (lpString=".mdt") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0089.075] lstrlenW (lpString=".sdf") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0089.075] lstrlenW (lpString=".MDF") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0089.075] lstrlenW (lpString=".DBF") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0089.075] lstrlenW (lpString=".DB") returned 3 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0089.075] lstrlenW (lpString=".db") returned 3 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0089.075] lstrlenW (lpString=".ndf") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0089.075] lstrlenW (lpString=".NDF") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0089.075] lstrlenW (lpString=".Mdf") returned 4 [0089.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0089.076] lstrlenW (lpString=".dat") returned 4 [0089.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0089.076] lstrlenW (lpString=".DAT") returned 4 [0089.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0089.076] lstrlenW (lpString=".ldf") returned 4 [0089.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.076] lstrlenW (lpString=".LDF") returned 4 [0089.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0089.076] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.076] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.077] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.077] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.077] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20907827147) returned 1 [0089.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3e916d0, dwHighDateTime=0x1d585b4)) [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1b68 [0089.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1b68 | out: hHeap=0x260000) returned 1 [0089.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.078] GetLastError () returned 0x0 [0089.078] GetLastError () returned 0x0 [0089.078] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.078] GetLastError () returned 0x0 [0089.079] GetLastError () returned 0x0 [0089.079] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffe10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.079] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f0, lpOverlapped=0x0) returned 1 [0089.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.080] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.080] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.080] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.080] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.080] CloseHandle (hObject=0xd8) returned 1 [0089.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.082] GetLastError () returned 0x0 [0089.082] RtlWakeConditionVariable () returned 0x27e828 [0089.082] GetCurrentThreadId () returned 0x998 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.082] lstrlenW (lpString=".vhd") returned 4 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0089.082] lstrlenW (lpString=".vhdx") returned 5 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0089.082] lstrlenW (lpString=".pst") returned 4 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0089.082] lstrlenW (lpString=".ost") returned 4 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0089.082] lstrlenW (lpString=".bak") returned 4 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0089.082] lstrlenW (lpString=".bac") returned 4 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0089.082] lstrlenW (lpString=".sys") returned 4 [0089.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0089.083] lstrlenW (lpString=".v2i") returned 4 [0089.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0089.083] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.084] lstrlenW (lpString=".sql") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0089.084] lstrlenW (lpString=".mdf") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0089.084] lstrlenW (lpString=".txt") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0089.084] lstrlenW (lpString=".dbf") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0089.084] lstrlenW (lpString=".ckp") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0089.084] lstrlenW (lpString=".dacpac") returned 7 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0089.084] lstrlenW (lpString=".db3") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0089.084] lstrlenW (lpString=".dtxs") returned 5 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0089.084] lstrlenW (lpString=".mdt") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0089.084] lstrlenW (lpString=".sdf") returned 4 [0089.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0089.084] lstrlenW (lpString=".MDF") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0089.085] lstrlenW (lpString=".DBF") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0089.085] lstrlenW (lpString=".DB") returned 3 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0089.085] lstrlenW (lpString=".db") returned 3 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0089.085] lstrlenW (lpString=".ndf") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0089.085] lstrlenW (lpString=".NDF") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0089.085] lstrlenW (lpString=".Mdf") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0089.085] lstrlenW (lpString=".dat") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0089.085] lstrlenW (lpString=".DAT") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0089.085] lstrlenW (lpString=".ldf") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.085] lstrlenW (lpString=".LDF") returned 4 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0089.085] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.086] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.086] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.086] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20908762417) returned 1 [0089.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc3e916d0, dwHighDateTime=0x1d585b4)) [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1ba0 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1ba0 | out: hHeap=0x260000) returned 1 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.087] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.087] GetLastError () returned 0x0 [0089.088] GetLastError () returned 0x0 [0089.088] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.088] GetLastError () returned 0x0 [0089.088] GetLastError () returned 0x0 [0089.202] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.202] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x401, lpOverlapped=0x0) returned 1 [0089.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.202] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.202] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.203] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.203] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.203] CloseHandle (hObject=0xd8) returned 1 [0089.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.258] GetLastError () returned 0x0 [0089.258] RtlWakeConditionVariable () returned 0x0 [0089.258] GetCurrentThreadId () returned 0x998 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ldf") returned 0x0 [0089.258] lstrlenW (lpString=".vhd") returned 4 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".vhd") returned 0x0 [0089.258] lstrlenW (lpString=".vhdx") returned 5 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".vhdx") returned 0x0 [0089.258] lstrlenW (lpString=".pst") returned 4 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".pst") returned 0x0 [0089.258] lstrlenW (lpString=".ost") returned 4 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ost") returned 0x0 [0089.258] lstrlenW (lpString=".bak") returned 4 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".bak") returned 0x0 [0089.258] lstrlenW (lpString=".bac") returned 4 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".bac") returned 0x0 [0089.258] lstrlenW (lpString=".sys") returned 4 [0089.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".sys") returned 0x0 [0089.259] lstrlenW (lpString=".v2i") returned 4 [0089.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".v2i") returned 0x0 [0089.259] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.260] lstrlenW (lpString=".sql") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".sql") returned 0x0 [0089.260] lstrlenW (lpString=".mdf") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".mdf") returned 0x0 [0089.260] lstrlenW (lpString=".txt") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".txt") returned 0x0 [0089.260] lstrlenW (lpString=".dbf") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dbf") returned 0x0 [0089.260] lstrlenW (lpString=".ckp") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ckp") returned 0x0 [0089.260] lstrlenW (lpString=".dacpac") returned 7 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dacpac") returned 0x0 [0089.260] lstrlenW (lpString=".db3") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".db3") returned 0x0 [0089.260] lstrlenW (lpString=".dtxs") returned 5 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dtxs") returned 0x0 [0089.260] lstrlenW (lpString=".mdt") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".mdt") returned 0x0 [0089.260] lstrlenW (lpString=".sdf") returned 4 [0089.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".sdf") returned 0x0 [0089.261] lstrlenW (lpString=".MDF") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".MDF") returned 0x0 [0089.261] lstrlenW (lpString=".DBF") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".DBF") returned 0x0 [0089.261] lstrlenW (lpString=".DB") returned 3 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".DB") returned 0x0 [0089.261] lstrlenW (lpString=".db") returned 3 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".db") returned 0x0 [0089.261] lstrlenW (lpString=".ndf") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ndf") returned 0x0 [0089.261] lstrlenW (lpString=".NDF") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".NDF") returned 0x0 [0089.261] lstrlenW (lpString=".Mdf") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".Mdf") returned 0x0 [0089.261] lstrlenW (lpString=".dat") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".dat") returned 0x0 [0089.261] lstrlenW (lpString=".DAT") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".DAT") returned 0x0 [0089.261] lstrlenW (lpString=".ldf") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".ldf") returned 0x0 [0089.261] lstrlenW (lpString=".LDF") returned 4 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch=".LDF") returned 0x0 [0089.261] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.262] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.262] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.262] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.262] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20926362039) returned 1 [0089.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc40345f0, dwHighDateTime=0x1d585b4)) [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295310 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.264] GetLastError () returned 0x0 [0089.264] GetLastError () returned 0x0 [0089.264] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.264] GetLastError () returned 0x0 [0089.264] GetLastError () returned 0x0 [0089.267] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.267] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1afa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1afa, lpOverlapped=0x0) returned 1 [0089.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.267] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.267] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.268] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.268] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.268] CloseHandle (hObject=0xd8) returned 1 [0089.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0089.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.269] GetLastError () returned 0x0 [0089.269] RtlWakeConditionVariable () returned 0x0 [0089.269] GetCurrentThreadId () returned 0x998 [0089.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0089.269] lstrlenW (lpString=".vhd") returned 4 [0089.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".vhd") returned 0x0 [0089.270] lstrlenW (lpString=".vhdx") returned 5 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".vhdx") returned 0x0 [0089.270] lstrlenW (lpString=".pst") returned 4 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".pst") returned 0x0 [0089.270] lstrlenW (lpString=".ost") returned 4 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".ost") returned 0x0 [0089.270] lstrlenW (lpString=".bak") returned 4 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".bak") returned 0x0 [0089.270] lstrlenW (lpString=".bac") returned 4 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".bac") returned 0x0 [0089.270] lstrlenW (lpString=".sys") returned 4 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".sys") returned 0x0 [0089.270] lstrlenW (lpString=".v2i") returned 4 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".v2i") returned 0x0 [0089.270] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.272] lstrlenW (lpString=".sql") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".sql") returned 0x0 [0089.272] lstrlenW (lpString=".mdf") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".mdf") returned 0x0 [0089.272] lstrlenW (lpString=".txt") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".txt") returned 0x0 [0089.272] lstrlenW (lpString=".dbf") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".dbf") returned 0x0 [0089.272] lstrlenW (lpString=".ckp") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".ckp") returned 0x0 [0089.272] lstrlenW (lpString=".dacpac") returned 7 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".dacpac") returned 0x0 [0089.272] lstrlenW (lpString=".db3") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".db3") returned 0x0 [0089.272] lstrlenW (lpString=".dtxs") returned 5 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".dtxs") returned 0x0 [0089.272] lstrlenW (lpString=".mdt") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".mdt") returned 0x0 [0089.272] lstrlenW (lpString=".sdf") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".sdf") returned 0x0 [0089.272] lstrlenW (lpString=".MDF") returned 4 [0089.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".MDF") returned 0x0 [0089.273] lstrlenW (lpString=".DBF") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".DBF") returned 0x0 [0089.273] lstrlenW (lpString=".DB") returned 3 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".DB") returned 0x0 [0089.273] lstrlenW (lpString=".db") returned 3 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".db") returned 0x0 [0089.273] lstrlenW (lpString=".ndf") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".ndf") returned 0x0 [0089.273] lstrlenW (lpString=".NDF") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".NDF") returned 0x0 [0089.273] lstrlenW (lpString=".Mdf") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".Mdf") returned 0x0 [0089.273] lstrlenW (lpString=".dat") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".dat") returned 0x0 [0089.273] lstrlenW (lpString=".DAT") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".DAT") returned 0x0 [0089.273] lstrlenW (lpString=".ldf") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0089.273] lstrlenW (lpString=".LDF") returned 4 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch=".LDF") returned 0x0 [0089.273] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.273] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.274] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.274] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.274] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20927556304) returned 1 [0089.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc405a750, dwHighDateTime=0x1d585b4)) [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952d8 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952d8 | out: hHeap=0x260000) returned 1 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.275] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.275] GetLastError () returned 0x0 [0089.275] GetLastError () returned 0x0 [0089.276] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.276] GetLastError () returned 0x0 [0089.276] GetLastError () returned 0x0 [0089.277] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.277] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0089.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.277] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.277] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.277] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.277] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.278] CloseHandle (hObject=0xd8) returned 1 [0089.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0089.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.279] GetLastError () returned 0x0 [0089.279] RtlWakeConditionVariable () returned 0x0 [0089.279] GetCurrentThreadId () returned 0x998 [0089.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0089.279] lstrlenW (lpString=".vhd") returned 4 [0089.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".vhd") returned 0x0 [0089.279] lstrlenW (lpString=".vhdx") returned 5 [0089.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".vhdx") returned 0x0 [0089.279] lstrlenW (lpString=".pst") returned 4 [0089.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".pst") returned 0x0 [0089.279] lstrlenW (lpString=".ost") returned 4 [0089.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".ost") returned 0x0 [0089.280] lstrlenW (lpString=".bak") returned 4 [0089.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".bak") returned 0x0 [0089.280] lstrlenW (lpString=".bac") returned 4 [0089.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".bac") returned 0x0 [0089.280] lstrlenW (lpString=".sys") returned 4 [0089.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".sys") returned 0x0 [0089.280] lstrlenW (lpString=".v2i") returned 4 [0089.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".v2i") returned 0x0 [0089.280] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.281] lstrlenW (lpString=".sql") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".sql") returned 0x0 [0089.281] lstrlenW (lpString=".mdf") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".mdf") returned 0x0 [0089.281] lstrlenW (lpString=".txt") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".txt") returned 0x0 [0089.281] lstrlenW (lpString=".dbf") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".dbf") returned 0x0 [0089.281] lstrlenW (lpString=".ckp") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".ckp") returned 0x0 [0089.281] lstrlenW (lpString=".dacpac") returned 7 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".dacpac") returned 0x0 [0089.281] lstrlenW (lpString=".db3") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".db3") returned 0x0 [0089.281] lstrlenW (lpString=".dtxs") returned 5 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".dtxs") returned 0x0 [0089.281] lstrlenW (lpString=".mdt") returned 4 [0089.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".mdt") returned 0x0 [0089.281] lstrlenW (lpString=".sdf") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".sdf") returned 0x0 [0089.282] lstrlenW (lpString=".MDF") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".MDF") returned 0x0 [0089.282] lstrlenW (lpString=".DBF") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".DBF") returned 0x0 [0089.282] lstrlenW (lpString=".DB") returned 3 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".DB") returned 0x0 [0089.282] lstrlenW (lpString=".db") returned 3 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".db") returned 0x0 [0089.282] lstrlenW (lpString=".ndf") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".ndf") returned 0x0 [0089.282] lstrlenW (lpString=".NDF") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".NDF") returned 0x0 [0089.282] lstrlenW (lpString=".Mdf") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".Mdf") returned 0x0 [0089.282] lstrlenW (lpString=".dat") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".dat") returned 0x0 [0089.282] lstrlenW (lpString=".DAT") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".DAT") returned 0x0 [0089.282] lstrlenW (lpString=".ldf") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0089.282] lstrlenW (lpString=".LDF") returned 4 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch=".LDF") returned 0x0 [0089.282] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.283] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.283] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.283] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.284] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20928851186) returned 1 [0089.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc40808b0, dwHighDateTime=0x1d585b4)) [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952a0 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.288] GetLastError () returned 0x0 [0089.288] GetLastError () returned 0x0 [0089.289] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.289] GetLastError () returned 0x0 [0089.289] GetLastError () returned 0x0 [0089.290] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.290] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0089.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.290] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.291] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.291] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.291] CloseHandle (hObject=0xd8) returned 1 [0089.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0089.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.294] GetLastError () returned 0x0 [0089.294] RtlWakeConditionVariable () returned 0x0 [0089.294] GetCurrentThreadId () returned 0x998 [0089.295] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.295] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.295] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.295] WriteFile (in: hFile=0xd8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.296] CloseHandle (hObject=0xd8) returned 1 [0089.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a648 | out: hHeap=0x260000) returned 1 [0089.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.297] RtlWakeConditionVariable () returned 0x27e828 [0089.297] GetCurrentThreadId () returned 0x998 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".ldf") returned 0x0 [0089.297] lstrlenW (lpString=".vhd") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".vhd") returned 0x0 [0089.297] lstrlenW (lpString=".vhdx") returned 5 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".vhdx") returned 0x0 [0089.297] lstrlenW (lpString=".pst") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".pst") returned 0x0 [0089.297] lstrlenW (lpString=".ost") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".ost") returned 0x0 [0089.297] lstrlenW (lpString=".bak") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".bak") returned 0x0 [0089.297] lstrlenW (lpString=".bac") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".bac") returned 0x0 [0089.297] lstrlenW (lpString=".sys") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".sys") returned 0x0 [0089.297] lstrlenW (lpString=".v2i") returned 4 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".v2i") returned 0x0 [0089.297] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.298] lstrlenW (lpString=".sql") returned 4 [0089.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".sql") returned 0x0 [0089.299] lstrlenW (lpString=".mdf") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".mdf") returned 0x0 [0089.299] lstrlenW (lpString=".txt") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".txt") returned 0x0 [0089.299] lstrlenW (lpString=".dbf") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".dbf") returned 0x0 [0089.299] lstrlenW (lpString=".ckp") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".ckp") returned 0x0 [0089.299] lstrlenW (lpString=".dacpac") returned 7 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".dacpac") returned 0x0 [0089.299] lstrlenW (lpString=".db3") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".db3") returned 0x0 [0089.299] lstrlenW (lpString=".dtxs") returned 5 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".dtxs") returned 0x0 [0089.299] lstrlenW (lpString=".mdt") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".mdt") returned 0x0 [0089.299] lstrlenW (lpString=".sdf") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".sdf") returned 0x0 [0089.299] lstrlenW (lpString=".MDF") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".MDF") returned 0x0 [0089.299] lstrlenW (lpString=".DBF") returned 4 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".DBF") returned 0x0 [0089.299] lstrlenW (lpString=".DB") returned 3 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".DB") returned 0x0 [0089.299] lstrlenW (lpString=".db") returned 3 [0089.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".db") returned 0x0 [0089.300] lstrlenW (lpString=".ndf") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".ndf") returned 0x0 [0089.300] lstrlenW (lpString=".NDF") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".NDF") returned 0x0 [0089.300] lstrlenW (lpString=".Mdf") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".Mdf") returned 0x0 [0089.300] lstrlenW (lpString=".dat") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".dat") returned 0x0 [0089.300] lstrlenW (lpString=".DAT") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".DAT") returned 0x0 [0089.300] lstrlenW (lpString=".ldf") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".ldf") returned 0x0 [0089.300] lstrlenW (lpString=".LDF") returned 4 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch=".LDF") returned 0x0 [0089.300] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.300] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.301] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.301] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.301] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20930248642) returned 1 [0089.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc40a6a10, dwHighDateTime=0x1d585b4)) [0089.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e40 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.302] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.302] GetLastError () returned 0x0 [0089.302] GetLastError () returned 0x0 [0089.302] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.303] GetLastError () returned 0x0 [0089.303] GetLastError () returned 0x0 [0089.304] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff1cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.304] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xe34, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xe34, lpOverlapped=0x0) returned 1 [0089.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.304] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.305] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.305] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.305] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.305] CloseHandle (hObject=0xd8) returned 1 [0089.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css.[deadmin@cock.li].deadmin")) returned 1 [0089.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.306] GetLastError () returned 0x0 [0089.306] RtlWakeConditionVariable () returned 0x0 [0089.306] GetCurrentThreadId () returned 0x998 [0089.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0089.307] lstrlenW (lpString=".vhd") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".vhd") returned 0x0 [0089.307] lstrlenW (lpString=".vhdx") returned 5 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".vhdx") returned 0x0 [0089.307] lstrlenW (lpString=".pst") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".pst") returned 0x0 [0089.307] lstrlenW (lpString=".ost") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ost") returned 0x0 [0089.307] lstrlenW (lpString=".bak") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".bak") returned 0x0 [0089.307] lstrlenW (lpString=".bac") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".bac") returned 0x0 [0089.307] lstrlenW (lpString=".sys") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".sys") returned 0x0 [0089.307] lstrlenW (lpString=".v2i") returned 4 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".v2i") returned 0x0 [0089.307] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.308] lstrlenW (lpString=".sql") returned 4 [0089.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".sql") returned 0x0 [0089.308] lstrlenW (lpString=".mdf") returned 4 [0089.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".mdf") returned 0x0 [0089.308] lstrlenW (lpString=".txt") returned 4 [0089.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".txt") returned 0x0 [0089.308] lstrlenW (lpString=".dbf") returned 4 [0089.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dbf") returned 0x0 [0089.308] lstrlenW (lpString=".ckp") returned 4 [0089.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ckp") returned 0x0 [0089.309] lstrlenW (lpString=".dacpac") returned 7 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dacpac") returned 0x0 [0089.309] lstrlenW (lpString=".db3") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".db3") returned 0x0 [0089.309] lstrlenW (lpString=".dtxs") returned 5 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dtxs") returned 0x0 [0089.309] lstrlenW (lpString=".mdt") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".mdt") returned 0x0 [0089.309] lstrlenW (lpString=".sdf") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".sdf") returned 0x0 [0089.309] lstrlenW (lpString=".MDF") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".MDF") returned 0x0 [0089.309] lstrlenW (lpString=".DBF") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".DBF") returned 0x0 [0089.309] lstrlenW (lpString=".DB") returned 3 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".DB") returned 0x0 [0089.309] lstrlenW (lpString=".db") returned 3 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".db") returned 0x0 [0089.309] lstrlenW (lpString=".ndf") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ndf") returned 0x0 [0089.309] lstrlenW (lpString=".NDF") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".NDF") returned 0x0 [0089.309] lstrlenW (lpString=".Mdf") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".Mdf") returned 0x0 [0089.309] lstrlenW (lpString=".dat") returned 4 [0089.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dat") returned 0x0 [0089.310] lstrlenW (lpString=".DAT") returned 4 [0089.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".DAT") returned 0x0 [0089.310] lstrlenW (lpString=".ldf") returned 4 [0089.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0089.310] lstrlenW (lpString=".LDF") returned 4 [0089.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".LDF") returned 0x0 [0089.310] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.310] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.311] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.311] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20931256171) returned 1 [0089.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc40ccb70, dwHighDateTime=0x1d585b4)) [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e08 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.312] GetLastError () returned 0x0 [0089.312] GetLastError () returned 0x0 [0089.313] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.313] GetLastError () returned 0x0 [0089.313] GetLastError () returned 0x0 [0089.314] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffe54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.314] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1ac, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1ac, lpOverlapped=0x0) returned 1 [0089.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.314] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.314] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.314] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.314] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.314] CloseHandle (hObject=0xd8) returned 1 [0089.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0089.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.316] GetLastError () returned 0x0 [0089.316] RtlWakeConditionVariable () returned 0x27e828 [0089.316] GetCurrentThreadId () returned 0x998 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.316] lstrlenW (lpString=".vhd") returned 4 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0089.316] lstrlenW (lpString=".vhdx") returned 5 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0089.316] lstrlenW (lpString=".pst") returned 4 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0089.316] lstrlenW (lpString=".ost") returned 4 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0089.316] lstrlenW (lpString=".bak") returned 4 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0089.316] lstrlenW (lpString=".bac") returned 4 [0089.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0089.316] lstrlenW (lpString=".sys") returned 4 [0089.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0089.317] lstrlenW (lpString=".v2i") returned 4 [0089.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0089.317] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.318] lstrlenW (lpString=".sql") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0089.318] lstrlenW (lpString=".mdf") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0089.318] lstrlenW (lpString=".txt") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0089.318] lstrlenW (lpString=".dbf") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0089.318] lstrlenW (lpString=".ckp") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0089.318] lstrlenW (lpString=".dacpac") returned 7 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0089.318] lstrlenW (lpString=".db3") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0089.318] lstrlenW (lpString=".dtxs") returned 5 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0089.318] lstrlenW (lpString=".mdt") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0089.318] lstrlenW (lpString=".sdf") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0089.318] lstrlenW (lpString=".MDF") returned 4 [0089.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0089.318] lstrlenW (lpString=".DBF") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0089.319] lstrlenW (lpString=".DB") returned 3 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0089.319] lstrlenW (lpString=".db") returned 3 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0089.319] lstrlenW (lpString=".ndf") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0089.319] lstrlenW (lpString=".NDF") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0089.319] lstrlenW (lpString=".Mdf") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0089.319] lstrlenW (lpString=".dat") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0089.319] lstrlenW (lpString=".DAT") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0089.319] lstrlenW (lpString=".ldf") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0089.319] lstrlenW (lpString=".LDF") returned 4 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0089.319] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.319] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.320] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.320] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.320] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20932153843) returned 1 [0089.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc40ccb70, dwHighDateTime=0x1d585b4)) [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e78 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.321] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.321] GetLastError () returned 0x0 [0089.321] GetLastError () returned 0x0 [0089.322] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.322] GetLastError () returned 0x0 [0089.322] GetLastError () returned 0x0 [0089.323] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.323] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0089.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.323] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.323] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.323] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.323] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.323] CloseHandle (hObject=0xd8) returned 1 [0089.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0089.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.405] GetLastError () returned 0x0 [0089.406] RtlWakeConditionVariable () returned 0x0 [0089.406] GetCurrentThreadId () returned 0x998 [0089.406] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.406] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.406] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.406] WriteFile (in: hFile=0xd8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.408] CloseHandle (hObject=0xd8) returned 1 [0089.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0089.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.408] RtlWakeConditionVariable () returned 0x0 [0089.408] GetCurrentThreadId () returned 0x998 [0089.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".ldf") returned 0x0 [0089.408] lstrlenW (lpString=".vhd") returned 4 [0089.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".vhd") returned 0x0 [0089.408] lstrlenW (lpString=".vhdx") returned 5 [0089.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".vhdx") returned 0x0 [0089.409] lstrlenW (lpString=".pst") returned 4 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".pst") returned 0x0 [0089.409] lstrlenW (lpString=".ost") returned 4 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".ost") returned 0x0 [0089.409] lstrlenW (lpString=".bak") returned 4 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".bak") returned 0x0 [0089.409] lstrlenW (lpString=".bac") returned 4 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".bac") returned 0x0 [0089.409] lstrlenW (lpString=".sys") returned 4 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".sys") returned 0x0 [0089.409] lstrlenW (lpString=".v2i") returned 4 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".v2i") returned 0x0 [0089.409] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.410] lstrlenW (lpString=".sql") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".sql") returned 0x0 [0089.410] lstrlenW (lpString=".mdf") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".mdf") returned 0x0 [0089.410] lstrlenW (lpString=".txt") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".txt") returned 0x0 [0089.410] lstrlenW (lpString=".dbf") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".dbf") returned 0x0 [0089.410] lstrlenW (lpString=".ckp") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".ckp") returned 0x0 [0089.410] lstrlenW (lpString=".dacpac") returned 7 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".dacpac") returned 0x0 [0089.410] lstrlenW (lpString=".db3") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".db3") returned 0x0 [0089.410] lstrlenW (lpString=".dtxs") returned 5 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".dtxs") returned 0x0 [0089.410] lstrlenW (lpString=".mdt") returned 4 [0089.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".mdt") returned 0x0 [0089.411] lstrlenW (lpString=".sdf") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".sdf") returned 0x0 [0089.411] lstrlenW (lpString=".MDF") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".MDF") returned 0x0 [0089.411] lstrlenW (lpString=".DBF") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".DBF") returned 0x0 [0089.411] lstrlenW (lpString=".DB") returned 3 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".DB") returned 0x0 [0089.411] lstrlenW (lpString=".db") returned 3 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".db") returned 0x0 [0089.411] lstrlenW (lpString=".ndf") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".ndf") returned 0x0 [0089.411] lstrlenW (lpString=".NDF") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".NDF") returned 0x0 [0089.411] lstrlenW (lpString=".Mdf") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".Mdf") returned 0x0 [0089.411] lstrlenW (lpString=".dat") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".dat") returned 0x0 [0089.411] lstrlenW (lpString=".DAT") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".DAT") returned 0x0 [0089.411] lstrlenW (lpString=".ldf") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".ldf") returned 0x0 [0089.411] lstrlenW (lpString=".LDF") returned 4 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch=".LDF") returned 0x0 [0089.411] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.412] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.412] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.412] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.413] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20941368920) returned 1 [0089.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc41b13b0, dwHighDateTime=0x1d585b4)) [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294cd0 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294cd0 | out: hHeap=0x260000) returned 1 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.413] GetLastError () returned 0x0 [0089.414] GetLastError () returned 0x0 [0089.414] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.414] GetLastError () returned 0x0 [0089.414] GetLastError () returned 0x0 [0089.416] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff318, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.416] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xce8, lpOverlapped=0x0) returned 1 [0089.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.416] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.416] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.416] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.416] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.416] CloseHandle (hObject=0xd8) returned 1 [0089.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css.[deadmin@cock.li].deadmin")) returned 1 [0089.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.418] GetLastError () returned 0x0 [0089.418] RtlWakeConditionVariable () returned 0x0 [0089.418] GetCurrentThreadId () returned 0x998 [0089.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".ldf") returned 0x0 [0089.418] lstrlenW (lpString=".vhd") returned 4 [0089.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".vhd") returned 0x0 [0089.418] lstrlenW (lpString=".vhdx") returned 5 [0089.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".vhdx") returned 0x0 [0089.418] lstrlenW (lpString=".pst") returned 4 [0089.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".pst") returned 0x0 [0089.418] lstrlenW (lpString=".ost") returned 4 [0089.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".ost") returned 0x0 [0089.418] lstrlenW (lpString=".bak") returned 4 [0089.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".bak") returned 0x0 [0089.418] lstrlenW (lpString=".bac") returned 4 [0089.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".bac") returned 0x0 [0089.419] lstrlenW (lpString=".sys") returned 4 [0089.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".sys") returned 0x0 [0089.419] lstrlenW (lpString=".v2i") returned 4 [0089.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".v2i") returned 0x0 [0089.419] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.420] lstrlenW (lpString=".sql") returned 4 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".sql") returned 0x0 [0089.420] lstrlenW (lpString=".mdf") returned 4 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".mdf") returned 0x0 [0089.420] lstrlenW (lpString=".txt") returned 4 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".txt") returned 0x0 [0089.420] lstrlenW (lpString=".dbf") returned 4 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".dbf") returned 0x0 [0089.420] lstrlenW (lpString=".ckp") returned 4 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".ckp") returned 0x0 [0089.420] lstrlenW (lpString=".dacpac") returned 7 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".dacpac") returned 0x0 [0089.420] lstrlenW (lpString=".db3") returned 4 [0089.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".db3") returned 0x0 [0089.420] lstrlenW (lpString=".dtxs") returned 5 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".dtxs") returned 0x0 [0089.421] lstrlenW (lpString=".mdt") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".mdt") returned 0x0 [0089.421] lstrlenW (lpString=".sdf") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".sdf") returned 0x0 [0089.421] lstrlenW (lpString=".MDF") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".MDF") returned 0x0 [0089.421] lstrlenW (lpString=".DBF") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".DBF") returned 0x0 [0089.421] lstrlenW (lpString=".DB") returned 3 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".DB") returned 0x0 [0089.421] lstrlenW (lpString=".db") returned 3 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".db") returned 0x0 [0089.421] lstrlenW (lpString=".ndf") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".ndf") returned 0x0 [0089.421] lstrlenW (lpString=".NDF") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".NDF") returned 0x0 [0089.421] lstrlenW (lpString=".Mdf") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".Mdf") returned 0x0 [0089.421] lstrlenW (lpString=".dat") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".dat") returned 0x0 [0089.421] lstrlenW (lpString=".DAT") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".DAT") returned 0x0 [0089.421] lstrlenW (lpString=".ldf") returned 4 [0089.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".ldf") returned 0x0 [0089.422] lstrlenW (lpString=".LDF") returned 4 [0089.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch=".LDF") returned 0x0 [0089.422] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.422] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.423] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.423] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.423] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20942397050) returned 1 [0089.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc41d7510, dwHighDateTime=0x1d585b4)) [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.424] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.424] GetLastError () returned 0x0 [0089.424] GetLastError () returned 0x0 [0089.424] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.424] GetLastError () returned 0x0 [0089.424] GetLastError () returned 0x0 [0089.427] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.427] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x32f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x32f, lpOverlapped=0x0) returned 1 [0089.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.427] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.427] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.427] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.427] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.427] CloseHandle (hObject=0xd8) returned 1 [0089.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0089.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.429] GetLastError () returned 0x0 [0089.429] RtlWakeConditionVariable () returned 0x0 [0089.429] GetCurrentThreadId () returned 0x998 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".ldf") returned 0x0 [0089.429] lstrlenW (lpString=".vhd") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".vhd") returned 0x0 [0089.429] lstrlenW (lpString=".vhdx") returned 5 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".vhdx") returned 0x0 [0089.429] lstrlenW (lpString=".pst") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".pst") returned 0x0 [0089.429] lstrlenW (lpString=".ost") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".ost") returned 0x0 [0089.429] lstrlenW (lpString=".bak") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".bak") returned 0x0 [0089.429] lstrlenW (lpString=".bac") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".bac") returned 0x0 [0089.429] lstrlenW (lpString=".sys") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".sys") returned 0x0 [0089.429] lstrlenW (lpString=".v2i") returned 4 [0089.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".v2i") returned 0x0 [0089.429] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.430] lstrlenW (lpString=".sql") returned 4 [0089.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".sql") returned 0x0 [0089.430] lstrlenW (lpString=".mdf") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".mdf") returned 0x0 [0089.431] lstrlenW (lpString=".txt") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".txt") returned 0x0 [0089.431] lstrlenW (lpString=".dbf") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".dbf") returned 0x0 [0089.431] lstrlenW (lpString=".ckp") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".ckp") returned 0x0 [0089.431] lstrlenW (lpString=".dacpac") returned 7 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".dacpac") returned 0x0 [0089.431] lstrlenW (lpString=".db3") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".db3") returned 0x0 [0089.431] lstrlenW (lpString=".dtxs") returned 5 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".dtxs") returned 0x0 [0089.431] lstrlenW (lpString=".mdt") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".mdt") returned 0x0 [0089.431] lstrlenW (lpString=".sdf") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".sdf") returned 0x0 [0089.431] lstrlenW (lpString=".MDF") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".MDF") returned 0x0 [0089.431] lstrlenW (lpString=".DBF") returned 4 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".DBF") returned 0x0 [0089.431] lstrlenW (lpString=".DB") returned 3 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".DB") returned 0x0 [0089.431] lstrlenW (lpString=".db") returned 3 [0089.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".db") returned 0x0 [0089.431] lstrlenW (lpString=".ndf") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".ndf") returned 0x0 [0089.432] lstrlenW (lpString=".NDF") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".NDF") returned 0x0 [0089.432] lstrlenW (lpString=".Mdf") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".Mdf") returned 0x0 [0089.432] lstrlenW (lpString=".dat") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".dat") returned 0x0 [0089.432] lstrlenW (lpString=".DAT") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".DAT") returned 0x0 [0089.432] lstrlenW (lpString=".ldf") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".ldf") returned 0x0 [0089.432] lstrlenW (lpString=".LDF") returned 4 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch=".LDF") returned 0x0 [0089.432] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.432] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.433] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.433] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.433] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20943430108) returned 1 [0089.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc41d7510, dwHighDateTime=0x1d585b4)) [0089.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b80 [0089.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0089.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.434] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.434] GetLastError () returned 0x0 [0089.434] GetLastError () returned 0x0 [0089.434] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.434] GetLastError () returned 0x0 [0089.435] GetLastError () returned 0x0 [0089.437] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff966d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.437] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6993, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6993, lpOverlapped=0x0) returned 1 [0089.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.437] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.437] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.437] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.437] CloseHandle (hObject=0xd8) returned 1 [0089.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.440] GetLastError () returned 0x0 [0089.440] RtlWakeConditionVariable () returned 0x0 [0089.440] GetCurrentThreadId () returned 0x998 [0089.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0089.440] lstrlenW (lpString=".vhd") returned 4 [0089.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".vhd") returned 0x0 [0089.440] lstrlenW (lpString=".vhdx") returned 5 [0089.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".vhdx") returned 0x0 [0089.440] lstrlenW (lpString=".pst") returned 4 [0089.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".pst") returned 0x0 [0089.440] lstrlenW (lpString=".ost") returned 4 [0089.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".ost") returned 0x0 [0089.441] lstrlenW (lpString=".bak") returned 4 [0089.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".bak") returned 0x0 [0089.441] lstrlenW (lpString=".bac") returned 4 [0089.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".bac") returned 0x0 [0089.441] lstrlenW (lpString=".sys") returned 4 [0089.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".sys") returned 0x0 [0089.441] lstrlenW (lpString=".v2i") returned 4 [0089.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".v2i") returned 0x0 [0089.441] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.442] lstrlenW (lpString=".sql") returned 4 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".sql") returned 0x0 [0089.442] lstrlenW (lpString=".mdf") returned 4 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".mdf") returned 0x0 [0089.442] lstrlenW (lpString=".txt") returned 4 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".txt") returned 0x0 [0089.442] lstrlenW (lpString=".dbf") returned 4 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".dbf") returned 0x0 [0089.442] lstrlenW (lpString=".ckp") returned 4 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".ckp") returned 0x0 [0089.442] lstrlenW (lpString=".dacpac") returned 7 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".dacpac") returned 0x0 [0089.442] lstrlenW (lpString=".db3") returned 4 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".db3") returned 0x0 [0089.442] lstrlenW (lpString=".dtxs") returned 5 [0089.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".dtxs") returned 0x0 [0089.443] lstrlenW (lpString=".mdt") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".mdt") returned 0x0 [0089.443] lstrlenW (lpString=".sdf") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".sdf") returned 0x0 [0089.443] lstrlenW (lpString=".MDF") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".MDF") returned 0x0 [0089.443] lstrlenW (lpString=".DBF") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".DBF") returned 0x0 [0089.443] lstrlenW (lpString=".DB") returned 3 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".DB") returned 0x0 [0089.443] lstrlenW (lpString=".db") returned 3 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".db") returned 0x0 [0089.443] lstrlenW (lpString=".ndf") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".ndf") returned 0x0 [0089.443] lstrlenW (lpString=".NDF") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".NDF") returned 0x0 [0089.443] lstrlenW (lpString=".Mdf") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".Mdf") returned 0x0 [0089.443] lstrlenW (lpString=".dat") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".dat") returned 0x0 [0089.443] lstrlenW (lpString=".DAT") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".DAT") returned 0x0 [0089.443] lstrlenW (lpString=".ldf") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".ldf") returned 0x0 [0089.443] lstrlenW (lpString=".LDF") returned 4 [0089.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch=".LDF") returned 0x0 [0089.444] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.444] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.444] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.444] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.445] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20944573441) returned 1 [0089.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc41fd670, dwHighDateTime=0x1d585b4)) [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c60 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.445] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.445] GetLastError () returned 0x0 [0089.446] GetLastError () returned 0x0 [0089.446] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.446] GetLastError () returned 0x0 [0089.446] GetLastError () returned 0x0 [0089.447] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.447] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0089.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.447] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.448] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.448] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.448] CloseHandle (hObject=0xd8) returned 1 [0089.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.450] GetLastError () returned 0x0 [0089.450] RtlWakeConditionVariable () returned 0x0 [0089.450] GetCurrentThreadId () returned 0x998 [0089.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0089.450] lstrlenW (lpString=".vhd") returned 4 [0089.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".vhd") returned 0x0 [0089.450] lstrlenW (lpString=".vhdx") returned 5 [0089.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".vhdx") returned 0x0 [0089.450] lstrlenW (lpString=".pst") returned 4 [0089.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".pst") returned 0x0 [0089.450] lstrlenW (lpString=".ost") returned 4 [0089.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".ost") returned 0x0 [0089.450] lstrlenW (lpString=".bak") returned 4 [0089.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".bak") returned 0x0 [0089.450] lstrlenW (lpString=".bac") returned 4 [0089.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".bac") returned 0x0 [0089.451] lstrlenW (lpString=".sys") returned 4 [0089.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".sys") returned 0x0 [0089.451] lstrlenW (lpString=".v2i") returned 4 [0089.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".v2i") returned 0x0 [0089.451] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.452] lstrlenW (lpString=".sql") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".sql") returned 0x0 [0089.452] lstrlenW (lpString=".mdf") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".mdf") returned 0x0 [0089.452] lstrlenW (lpString=".txt") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".txt") returned 0x0 [0089.452] lstrlenW (lpString=".dbf") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".dbf") returned 0x0 [0089.452] lstrlenW (lpString=".ckp") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".ckp") returned 0x0 [0089.452] lstrlenW (lpString=".dacpac") returned 7 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".dacpac") returned 0x0 [0089.452] lstrlenW (lpString=".db3") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".db3") returned 0x0 [0089.452] lstrlenW (lpString=".dtxs") returned 5 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".dtxs") returned 0x0 [0089.452] lstrlenW (lpString=".mdt") returned 4 [0089.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".mdt") returned 0x0 [0089.452] lstrlenW (lpString=".sdf") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".sdf") returned 0x0 [0089.453] lstrlenW (lpString=".MDF") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".MDF") returned 0x0 [0089.453] lstrlenW (lpString=".DBF") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".DBF") returned 0x0 [0089.453] lstrlenW (lpString=".DB") returned 3 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".DB") returned 0x0 [0089.453] lstrlenW (lpString=".db") returned 3 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".db") returned 0x0 [0089.453] lstrlenW (lpString=".ndf") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".ndf") returned 0x0 [0089.453] lstrlenW (lpString=".NDF") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".NDF") returned 0x0 [0089.453] lstrlenW (lpString=".Mdf") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".Mdf") returned 0x0 [0089.453] lstrlenW (lpString=".dat") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".dat") returned 0x0 [0089.453] lstrlenW (lpString=".DAT") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".DAT") returned 0x0 [0089.453] lstrlenW (lpString=".ldf") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0089.453] lstrlenW (lpString=".LDF") returned 4 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch=".LDF") returned 0x0 [0089.453] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.454] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.454] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.454] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20945562047) returned 1 [0089.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc42237d0, dwHighDateTime=0x1d585b4)) [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.455] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.455] GetLastError () returned 0x0 [0089.456] GetLastError () returned 0x0 [0089.456] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.456] GetLastError () returned 0x0 [0089.456] GetLastError () returned 0x0 [0089.457] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.457] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0089.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.457] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.457] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.457] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.457] CloseHandle (hObject=0xd8) returned 1 [0089.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.459] GetLastError () returned 0x0 [0089.459] RtlWakeConditionVariable () returned 0x27e828 [0089.459] GetCurrentThreadId () returned 0x998 [0089.459] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.459] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.459] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.459] WriteFile (in: hFile=0xd8, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.461] CloseHandle (hObject=0xd8) returned 1 [0089.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a878 | out: hHeap=0x260000) returned 1 [0089.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.461] RtlWakeConditionVariable () returned 0x27e828 [0089.461] GetCurrentThreadId () returned 0x998 [0089.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".ldf") returned 0x0 [0089.461] lstrlenW (lpString=".vhd") returned 4 [0089.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".vhd") returned 0x0 [0089.461] lstrlenW (lpString=".vhdx") returned 5 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".vhdx") returned 0x0 [0089.462] lstrlenW (lpString=".pst") returned 4 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".pst") returned 0x0 [0089.462] lstrlenW (lpString=".ost") returned 4 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".ost") returned 0x0 [0089.462] lstrlenW (lpString=".bak") returned 4 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".bak") returned 0x0 [0089.462] lstrlenW (lpString=".bac") returned 4 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".bac") returned 0x0 [0089.462] lstrlenW (lpString=".sys") returned 4 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".sys") returned 0x0 [0089.462] lstrlenW (lpString=".v2i") returned 4 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".v2i") returned 0x0 [0089.462] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.463] lstrlenW (lpString=".sql") returned 4 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".sql") returned 0x0 [0089.463] lstrlenW (lpString=".mdf") returned 4 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".mdf") returned 0x0 [0089.463] lstrlenW (lpString=".txt") returned 4 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".txt") returned 0x0 [0089.463] lstrlenW (lpString=".dbf") returned 4 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".dbf") returned 0x0 [0089.463] lstrlenW (lpString=".ckp") returned 4 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".ckp") returned 0x0 [0089.463] lstrlenW (lpString=".dacpac") returned 7 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".dacpac") returned 0x0 [0089.463] lstrlenW (lpString=".db3") returned 4 [0089.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".db3") returned 0x0 [0089.464] lstrlenW (lpString=".dtxs") returned 5 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".dtxs") returned 0x0 [0089.464] lstrlenW (lpString=".mdt") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".mdt") returned 0x0 [0089.464] lstrlenW (lpString=".sdf") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".sdf") returned 0x0 [0089.464] lstrlenW (lpString=".MDF") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".MDF") returned 0x0 [0089.464] lstrlenW (lpString=".DBF") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".DBF") returned 0x0 [0089.464] lstrlenW (lpString=".DB") returned 3 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".DB") returned 0x0 [0089.464] lstrlenW (lpString=".db") returned 3 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".db") returned 0x0 [0089.464] lstrlenW (lpString=".ndf") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".ndf") returned 0x0 [0089.464] lstrlenW (lpString=".NDF") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".NDF") returned 0x0 [0089.464] lstrlenW (lpString=".Mdf") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".Mdf") returned 0x0 [0089.464] lstrlenW (lpString=".dat") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".dat") returned 0x0 [0089.464] lstrlenW (lpString=".DAT") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".DAT") returned 0x0 [0089.464] lstrlenW (lpString=".ldf") returned 4 [0089.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".ldf") returned 0x0 [0089.465] lstrlenW (lpString=".LDF") returned 4 [0089.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch=".LDF") returned 0x0 [0089.465] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.465] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.466] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.466] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20946687898) returned 1 [0089.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc42237d0, dwHighDateTime=0x1d585b4)) [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.467] GetLastError () returned 0x0 [0089.467] GetLastError () returned 0x0 [0089.467] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.467] GetLastError () returned 0x0 [0089.467] GetLastError () returned 0x0 [0089.469] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff3dd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.469] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc23, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xc23, lpOverlapped=0x0) returned 1 [0089.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.469] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.470] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.470] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.470] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.470] CloseHandle (hObject=0xd8) returned 1 [0089.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css.[deadmin@cock.li].deadmin")) returned 1 [0089.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.471] GetLastError () returned 0x0 [0089.471] RtlWakeConditionVariable () returned 0x0 [0089.471] GetCurrentThreadId () returned 0x998 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".ldf") returned 0x0 [0089.472] lstrlenW (lpString=".vhd") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".vhd") returned 0x0 [0089.472] lstrlenW (lpString=".vhdx") returned 5 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".vhdx") returned 0x0 [0089.472] lstrlenW (lpString=".pst") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".pst") returned 0x0 [0089.472] lstrlenW (lpString=".ost") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".ost") returned 0x0 [0089.472] lstrlenW (lpString=".bak") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".bak") returned 0x0 [0089.472] lstrlenW (lpString=".bac") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".bac") returned 0x0 [0089.472] lstrlenW (lpString=".sys") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".sys") returned 0x0 [0089.472] lstrlenW (lpString=".v2i") returned 4 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".v2i") returned 0x0 [0089.472] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.474] lstrlenW (lpString=".sql") returned 4 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".sql") returned 0x0 [0089.474] lstrlenW (lpString=".mdf") returned 4 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".mdf") returned 0x0 [0089.474] lstrlenW (lpString=".txt") returned 4 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".txt") returned 0x0 [0089.474] lstrlenW (lpString=".dbf") returned 4 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".dbf") returned 0x0 [0089.474] lstrlenW (lpString=".ckp") returned 4 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".ckp") returned 0x0 [0089.474] lstrlenW (lpString=".dacpac") returned 7 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".dacpac") returned 0x0 [0089.474] lstrlenW (lpString=".db3") returned 4 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".db3") returned 0x0 [0089.474] lstrlenW (lpString=".dtxs") returned 5 [0089.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".dtxs") returned 0x0 [0089.475] lstrlenW (lpString=".mdt") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".mdt") returned 0x0 [0089.475] lstrlenW (lpString=".sdf") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".sdf") returned 0x0 [0089.475] lstrlenW (lpString=".MDF") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".MDF") returned 0x0 [0089.475] lstrlenW (lpString=".DBF") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".DBF") returned 0x0 [0089.475] lstrlenW (lpString=".DB") returned 3 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".DB") returned 0x0 [0089.475] lstrlenW (lpString=".db") returned 3 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".db") returned 0x0 [0089.475] lstrlenW (lpString=".ndf") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".ndf") returned 0x0 [0089.475] lstrlenW (lpString=".NDF") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".NDF") returned 0x0 [0089.475] lstrlenW (lpString=".Mdf") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".Mdf") returned 0x0 [0089.475] lstrlenW (lpString=".dat") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".dat") returned 0x0 [0089.475] lstrlenW (lpString=".DAT") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".DAT") returned 0x0 [0089.475] lstrlenW (lpString=".ldf") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".ldf") returned 0x0 [0089.475] lstrlenW (lpString=".LDF") returned 4 [0089.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch=".LDF") returned 0x0 [0089.476] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.476] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.476] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.476] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.477] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20947776057) returned 1 [0089.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4249930, dwHighDateTime=0x1d585b4)) [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.477] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.477] GetLastError () returned 0x0 [0089.478] GetLastError () returned 0x0 [0089.478] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.478] GetLastError () returned 0x0 [0089.478] GetLastError () returned 0x0 [0089.480] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.480] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x37a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x37a, lpOverlapped=0x0) returned 1 [0089.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.480] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.480] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.480] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.480] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.480] CloseHandle (hObject=0xd8) returned 1 [0089.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.480] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css.[deadmin@cock.li].deadmin")) returned 1 [0089.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.542] GetLastError () returned 0x0 [0089.542] RtlWakeConditionVariable () returned 0x0 [0089.542] GetCurrentThreadId () returned 0x998 [0089.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".ldf") returned 0x0 [0089.542] lstrlenW (lpString=".vhd") returned 4 [0089.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".vhd") returned 0x0 [0089.542] lstrlenW (lpString=".vhdx") returned 5 [0089.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".vhdx") returned 0x0 [0089.543] lstrlenW (lpString=".pst") returned 4 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".pst") returned 0x0 [0089.543] lstrlenW (lpString=".ost") returned 4 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".ost") returned 0x0 [0089.543] lstrlenW (lpString=".bak") returned 4 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".bak") returned 0x0 [0089.543] lstrlenW (lpString=".bac") returned 4 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".bac") returned 0x0 [0089.543] lstrlenW (lpString=".sys") returned 4 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".sys") returned 0x0 [0089.543] lstrlenW (lpString=".v2i") returned 4 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".v2i") returned 0x0 [0089.543] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch="s\r\n.v2i") returned 0x0 [0089.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.545] lstrlenW (lpString=".sql") returned 4 [0089.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".sql") returned 0x0 [0089.545] lstrlenW (lpString=".mdf") returned 4 [0089.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".mdf") returned 0x0 [0089.545] lstrlenW (lpString=".txt") returned 4 [0089.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".txt") returned 0x0 [0089.545] lstrlenW (lpString=".dbf") returned 4 [0089.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".dbf") returned 0x0 [0089.545] lstrlenW (lpString=".ckp") returned 4 [0089.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".ckp") returned 0x0 [0089.545] lstrlenW (lpString=".dacpac") returned 7 [0089.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".dacpac") returned 0x0 [0089.545] lstrlenW (lpString=".db3") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".db3") returned 0x0 [0089.546] lstrlenW (lpString=".dtxs") returned 5 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".dtxs") returned 0x0 [0089.546] lstrlenW (lpString=".mdt") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".mdt") returned 0x0 [0089.546] lstrlenW (lpString=".sdf") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".sdf") returned 0x0 [0089.546] lstrlenW (lpString=".MDF") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".MDF") returned 0x0 [0089.546] lstrlenW (lpString=".DBF") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".DBF") returned 0x0 [0089.546] lstrlenW (lpString=".DB") returned 3 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".DB") returned 0x0 [0089.546] lstrlenW (lpString=".db") returned 3 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".db") returned 0x0 [0089.546] lstrlenW (lpString=".ndf") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".ndf") returned 0x0 [0089.546] lstrlenW (lpString=".NDF") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".NDF") returned 0x0 [0089.546] lstrlenW (lpString=".Mdf") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".Mdf") returned 0x0 [0089.546] lstrlenW (lpString=".dat") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".dat") returned 0x0 [0089.546] lstrlenW (lpString=".DAT") returned 4 [0089.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".DAT") returned 0x0 [0089.546] lstrlenW (lpString=".ldf") returned 4 [0089.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".ldf") returned 0x0 [0089.547] lstrlenW (lpString=".LDF") returned 4 [0089.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch=".LDF") returned 0x0 [0089.547] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.547] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.548] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.548] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.548] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20954892790) returned 1 [0089.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4308010, dwHighDateTime=0x1d585b4)) [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763f70 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763f70 | out: hHeap=0x260000) returned 1 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.549] GetLastError () returned 0x0 [0089.549] GetLastError () returned 0x0 [0089.549] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.549] GetLastError () returned 0x0 [0089.549] GetLastError () returned 0x0 [0089.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeced, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.552] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1313, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1313, lpOverlapped=0x0) returned 1 [0089.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.553] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.553] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.553] CloseHandle (hObject=0xf0) returned 1 [0089.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.[deadmin@cock.li].deadmin")) returned 1 [0089.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.555] GetLastError () returned 0x0 [0089.555] RtlWakeConditionVariable () returned 0x0 [0089.555] GetCurrentThreadId () returned 0x998 [0089.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".ldf") returned 0x0 [0089.555] lstrlenW (lpString=".vhd") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".vhd") returned 0x0 [0089.556] lstrlenW (lpString=".vhdx") returned 5 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".vhdx") returned 0x0 [0089.556] lstrlenW (lpString=".pst") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".pst") returned 0x0 [0089.556] lstrlenW (lpString=".ost") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".ost") returned 0x0 [0089.556] lstrlenW (lpString=".bak") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".bak") returned 0x0 [0089.556] lstrlenW (lpString=".bac") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".bac") returned 0x0 [0089.556] lstrlenW (lpString=".sys") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".sys") returned 0x0 [0089.556] lstrlenW (lpString=".v2i") returned 4 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".v2i") returned 0x0 [0089.556] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0089.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.558] lstrlenW (lpString=".sql") returned 4 [0089.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".sql") returned 0x0 [0089.558] lstrlenW (lpString=".mdf") returned 4 [0089.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".mdf") returned 0x0 [0089.559] lstrlenW (lpString=".txt") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".txt") returned 0x0 [0089.559] lstrlenW (lpString=".dbf") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".dbf") returned 0x0 [0089.559] lstrlenW (lpString=".ckp") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".ckp") returned 0x0 [0089.559] lstrlenW (lpString=".dacpac") returned 7 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".dacpac") returned 0x0 [0089.559] lstrlenW (lpString=".db3") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".db3") returned 0x0 [0089.559] lstrlenW (lpString=".dtxs") returned 5 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".dtxs") returned 0x0 [0089.559] lstrlenW (lpString=".mdt") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".mdt") returned 0x0 [0089.559] lstrlenW (lpString=".sdf") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".sdf") returned 0x0 [0089.559] lstrlenW (lpString=".MDF") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".MDF") returned 0x0 [0089.559] lstrlenW (lpString=".DBF") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".DBF") returned 0x0 [0089.559] lstrlenW (lpString=".DB") returned 3 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".DB") returned 0x0 [0089.559] lstrlenW (lpString=".db") returned 3 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".db") returned 0x0 [0089.559] lstrlenW (lpString=".ndf") returned 4 [0089.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".ndf") returned 0x0 [0089.560] lstrlenW (lpString=".NDF") returned 4 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".NDF") returned 0x0 [0089.560] lstrlenW (lpString=".Mdf") returned 4 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".Mdf") returned 0x0 [0089.560] lstrlenW (lpString=".dat") returned 4 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".dat") returned 0x0 [0089.560] lstrlenW (lpString=".DAT") returned 4 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".DAT") returned 0x0 [0089.560] lstrlenW (lpString=".ldf") returned 4 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".ldf") returned 0x0 [0089.560] lstrlenW (lpString=".LDF") returned 4 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch=".LDF") returned 0x0 [0089.560] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.560] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.561] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.561] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20956246617) returned 1 [0089.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc432e170, dwHighDateTime=0x1d585b4)) [0089.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27628e8 [0089.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27628e8 | out: hHeap=0x260000) returned 1 [0089.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.562] GetLastError () returned 0x0 [0089.562] GetLastError () returned 0x0 [0089.563] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.563] GetLastError () returned 0x0 [0089.563] GetLastError () returned 0x0 [0089.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff577, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.564] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa89, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xa89, lpOverlapped=0x0) returned 1 [0089.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.565] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.565] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.565] CloseHandle (hObject=0xf0) returned 1 [0089.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0089.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.567] GetLastError () returned 0x0 [0089.567] RtlWakeConditionVariable () returned 0x0 [0089.567] GetCurrentThreadId () returned 0x998 [0089.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".ldf") returned 0x0 [0089.567] lstrlenW (lpString=".vhd") returned 4 [0089.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".vhd") returned 0x0 [0089.567] lstrlenW (lpString=".vhdx") returned 5 [0089.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".vhdx") returned 0x0 [0089.568] lstrlenW (lpString=".pst") returned 4 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".pst") returned 0x0 [0089.568] lstrlenW (lpString=".ost") returned 4 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".ost") returned 0x0 [0089.568] lstrlenW (lpString=".bak") returned 4 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".bak") returned 0x0 [0089.568] lstrlenW (lpString=".bac") returned 4 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".bac") returned 0x0 [0089.568] lstrlenW (lpString=".sys") returned 4 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".sys") returned 0x0 [0089.568] lstrlenW (lpString=".v2i") returned 4 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".v2i") returned 0x0 [0089.568] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0089.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.569] lstrlenW (lpString=".sql") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".sql") returned 0x0 [0089.570] lstrlenW (lpString=".mdf") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".mdf") returned 0x0 [0089.570] lstrlenW (lpString=".txt") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".txt") returned 0x0 [0089.570] lstrlenW (lpString=".dbf") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".dbf") returned 0x0 [0089.570] lstrlenW (lpString=".ckp") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".ckp") returned 0x0 [0089.570] lstrlenW (lpString=".dacpac") returned 7 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".dacpac") returned 0x0 [0089.570] lstrlenW (lpString=".db3") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".db3") returned 0x0 [0089.570] lstrlenW (lpString=".dtxs") returned 5 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".dtxs") returned 0x0 [0089.570] lstrlenW (lpString=".mdt") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".mdt") returned 0x0 [0089.570] lstrlenW (lpString=".sdf") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".sdf") returned 0x0 [0089.570] lstrlenW (lpString=".MDF") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".MDF") returned 0x0 [0089.570] lstrlenW (lpString=".DBF") returned 4 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".DBF") returned 0x0 [0089.570] lstrlenW (lpString=".DB") returned 3 [0089.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".DB") returned 0x0 [0089.571] lstrlenW (lpString=".db") returned 3 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".db") returned 0x0 [0089.571] lstrlenW (lpString=".ndf") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".ndf") returned 0x0 [0089.571] lstrlenW (lpString=".NDF") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".NDF") returned 0x0 [0089.571] lstrlenW (lpString=".Mdf") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".Mdf") returned 0x0 [0089.571] lstrlenW (lpString=".dat") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".dat") returned 0x0 [0089.571] lstrlenW (lpString=".DAT") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".DAT") returned 0x0 [0089.571] lstrlenW (lpString=".ldf") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".ldf") returned 0x0 [0089.571] lstrlenW (lpString=".LDF") returned 4 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch=".LDF") returned 0x0 [0089.571] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.571] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.572] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.572] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20957343559) returned 1 [0089.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc432e170, dwHighDateTime=0x1d585b4)) [0089.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27628b0 [0089.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27628b0 | out: hHeap=0x260000) returned 1 [0089.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.573] GetLastError () returned 0x0 [0089.573] GetLastError () returned 0x0 [0089.574] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.574] GetLastError () returned 0x0 [0089.574] GetLastError () returned 0x0 [0089.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe405, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.623] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1bfb, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1bfb, lpOverlapped=0x0) returned 1 [0089.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.623] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.623] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.623] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.624] CloseHandle (hObject=0xf0) returned 1 [0089.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0089.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.665] GetLastError () returned 0x0 [0089.665] RtlWakeConditionVariable () returned 0x0 [0089.665] GetCurrentThreadId () returned 0x998 [0089.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".ldf") returned 0x0 [0089.665] lstrlenW (lpString=".vhd") returned 4 [0089.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".vhd") returned 0x0 [0089.665] lstrlenW (lpString=".vhdx") returned 5 [0089.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".vhdx") returned 0x0 [0089.665] lstrlenW (lpString=".pst") returned 4 [0089.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".pst") returned 0x0 [0089.665] lstrlenW (lpString=".ost") returned 4 [0089.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".ost") returned 0x0 [0089.665] lstrlenW (lpString=".bak") returned 4 [0089.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".bak") returned 0x0 [0089.666] lstrlenW (lpString=".bac") returned 4 [0089.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".bac") returned 0x0 [0089.666] lstrlenW (lpString=".sys") returned 4 [0089.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".sys") returned 0x0 [0089.666] lstrlenW (lpString=".v2i") returned 4 [0089.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".v2i") returned 0x0 [0089.666] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.668] lstrlenW (lpString=".sql") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".sql") returned 0x0 [0089.668] lstrlenW (lpString=".mdf") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".mdf") returned 0x0 [0089.668] lstrlenW (lpString=".txt") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".txt") returned 0x0 [0089.668] lstrlenW (lpString=".dbf") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".dbf") returned 0x0 [0089.668] lstrlenW (lpString=".ckp") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".ckp") returned 0x0 [0089.668] lstrlenW (lpString=".dacpac") returned 7 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".dacpac") returned 0x0 [0089.668] lstrlenW (lpString=".db3") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".db3") returned 0x0 [0089.668] lstrlenW (lpString=".dtxs") returned 5 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".dtxs") returned 0x0 [0089.668] lstrlenW (lpString=".mdt") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".mdt") returned 0x0 [0089.668] lstrlenW (lpString=".sdf") returned 4 [0089.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".sdf") returned 0x0 [0089.669] lstrlenW (lpString=".MDF") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".MDF") returned 0x0 [0089.669] lstrlenW (lpString=".DBF") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".DBF") returned 0x0 [0089.669] lstrlenW (lpString=".DB") returned 3 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".DB") returned 0x0 [0089.669] lstrlenW (lpString=".db") returned 3 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".db") returned 0x0 [0089.669] lstrlenW (lpString=".ndf") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".ndf") returned 0x0 [0089.669] lstrlenW (lpString=".NDF") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".NDF") returned 0x0 [0089.669] lstrlenW (lpString=".Mdf") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".Mdf") returned 0x0 [0089.669] lstrlenW (lpString=".dat") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".dat") returned 0x0 [0089.669] lstrlenW (lpString=".DAT") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".DAT") returned 0x0 [0089.669] lstrlenW (lpString=".ldf") returned 4 [0089.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".ldf") returned 0x0 [0089.670] lstrlenW (lpString=".LDF") returned 4 [0089.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch=".LDF") returned 0x0 [0089.670] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.670] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.671] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.671] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.671] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20967189627) returned 1 [0089.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4438b10, dwHighDateTime=0x1d585b4)) [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d8d0 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d8d0 | out: hHeap=0x260000) returned 1 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.671] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.672] GetLastError () returned 0x0 [0089.672] GetLastError () returned 0x0 [0089.672] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.672] GetLastError () returned 0x0 [0089.672] GetLastError () returned 0x0 [0089.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.677] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x366, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x366, lpOverlapped=0x0) returned 1 [0089.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.677] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.677] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.677] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.677] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.678] CloseHandle (hObject=0xf0) returned 1 [0089.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0089.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0089.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.680] GetLastError () returned 0x0 [0089.680] RtlWakeConditionVariable () returned 0x0 [0089.680] GetCurrentThreadId () returned 0x998 [0089.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".ldf") returned 0x0 [0089.680] lstrlenW (lpString=".vhd") returned 4 [0089.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".vhd") returned 0x0 [0089.680] lstrlenW (lpString=".vhdx") returned 5 [0089.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".vhdx") returned 0x0 [0089.680] lstrlenW (lpString=".pst") returned 4 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".pst") returned 0x0 [0089.681] lstrlenW (lpString=".ost") returned 4 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".ost") returned 0x0 [0089.681] lstrlenW (lpString=".bak") returned 4 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".bak") returned 0x0 [0089.681] lstrlenW (lpString=".bac") returned 4 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".bac") returned 0x0 [0089.681] lstrlenW (lpString=".sys") returned 4 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".sys") returned 0x0 [0089.681] lstrlenW (lpString=".v2i") returned 4 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".v2i") returned 0x0 [0089.681] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.683] lstrlenW (lpString=".sql") returned 4 [0089.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".sql") returned 0x0 [0089.683] lstrlenW (lpString=".mdf") returned 4 [0089.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".mdf") returned 0x0 [0089.684] lstrlenW (lpString=".txt") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".txt") returned 0x0 [0089.684] lstrlenW (lpString=".dbf") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".dbf") returned 0x0 [0089.684] lstrlenW (lpString=".ckp") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".ckp") returned 0x0 [0089.684] lstrlenW (lpString=".dacpac") returned 7 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".dacpac") returned 0x0 [0089.684] lstrlenW (lpString=".db3") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".db3") returned 0x0 [0089.684] lstrlenW (lpString=".dtxs") returned 5 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".dtxs") returned 0x0 [0089.684] lstrlenW (lpString=".mdt") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".mdt") returned 0x0 [0089.684] lstrlenW (lpString=".sdf") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".sdf") returned 0x0 [0089.684] lstrlenW (lpString=".MDF") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".MDF") returned 0x0 [0089.684] lstrlenW (lpString=".DBF") returned 4 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".DBF") returned 0x0 [0089.684] lstrlenW (lpString=".DB") returned 3 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".DB") returned 0x0 [0089.684] lstrlenW (lpString=".db") returned 3 [0089.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".db") returned 0x0 [0089.685] lstrlenW (lpString=".ndf") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".ndf") returned 0x0 [0089.685] lstrlenW (lpString=".NDF") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".NDF") returned 0x0 [0089.685] lstrlenW (lpString=".Mdf") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".Mdf") returned 0x0 [0089.685] lstrlenW (lpString=".dat") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".dat") returned 0x0 [0089.685] lstrlenW (lpString=".DAT") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".DAT") returned 0x0 [0089.685] lstrlenW (lpString=".ldf") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".ldf") returned 0x0 [0089.685] lstrlenW (lpString=".LDF") returned 4 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch=".LDF") returned 0x0 [0089.685] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.685] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.686] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.686] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20968752294) returned 1 [0089.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc445ec70, dwHighDateTime=0x1d585b4)) [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d908 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d908 | out: hHeap=0x260000) returned 1 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.687] GetLastError () returned 0x0 [0089.688] GetLastError () returned 0x0 [0089.688] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.688] GetLastError () returned 0x0 [0089.688] GetLastError () returned 0x0 [0089.689] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.690] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x365, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x365, lpOverlapped=0x0) returned 1 [0089.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.690] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.690] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.690] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.690] CloseHandle (hObject=0xf0) returned 1 [0089.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.693] GetLastError () returned 0x0 [0089.693] RtlWakeConditionVariable () returned 0x0 [0089.693] GetCurrentThreadId () returned 0x998 [0089.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".ldf") returned 0x0 [0089.693] lstrlenW (lpString=".vhd") returned 4 [0089.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".vhd") returned 0x0 [0089.693] lstrlenW (lpString=".vhdx") returned 5 [0089.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".vhdx") returned 0x0 [0089.693] lstrlenW (lpString=".pst") returned 4 [0089.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".pst") returned 0x0 [0089.693] lstrlenW (lpString=".ost") returned 4 [0089.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".ost") returned 0x0 [0089.693] lstrlenW (lpString=".bak") returned 4 [0089.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".bak") returned 0x0 [0089.693] lstrlenW (lpString=".bac") returned 4 [0089.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".bac") returned 0x0 [0089.694] lstrlenW (lpString=".sys") returned 4 [0089.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".sys") returned 0x0 [0089.694] lstrlenW (lpString=".v2i") returned 4 [0089.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".v2i") returned 0x0 [0089.694] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.696] lstrlenW (lpString=".sql") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".sql") returned 0x0 [0089.696] lstrlenW (lpString=".mdf") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".mdf") returned 0x0 [0089.696] lstrlenW (lpString=".txt") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".txt") returned 0x0 [0089.696] lstrlenW (lpString=".dbf") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".dbf") returned 0x0 [0089.696] lstrlenW (lpString=".ckp") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".ckp") returned 0x0 [0089.696] lstrlenW (lpString=".dacpac") returned 7 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".dacpac") returned 0x0 [0089.696] lstrlenW (lpString=".db3") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".db3") returned 0x0 [0089.696] lstrlenW (lpString=".dtxs") returned 5 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".dtxs") returned 0x0 [0089.696] lstrlenW (lpString=".mdt") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".mdt") returned 0x0 [0089.696] lstrlenW (lpString=".sdf") returned 4 [0089.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".sdf") returned 0x0 [0089.697] lstrlenW (lpString=".MDF") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".MDF") returned 0x0 [0089.697] lstrlenW (lpString=".DBF") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".DBF") returned 0x0 [0089.697] lstrlenW (lpString=".DB") returned 3 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".DB") returned 0x0 [0089.697] lstrlenW (lpString=".db") returned 3 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".db") returned 0x0 [0089.697] lstrlenW (lpString=".ndf") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".ndf") returned 0x0 [0089.697] lstrlenW (lpString=".NDF") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".NDF") returned 0x0 [0089.697] lstrlenW (lpString=".Mdf") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".Mdf") returned 0x0 [0089.697] lstrlenW (lpString=".dat") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".dat") returned 0x0 [0089.697] lstrlenW (lpString=".DAT") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".DAT") returned 0x0 [0089.697] lstrlenW (lpString=".ldf") returned 4 [0089.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".ldf") returned 0x0 [0089.697] lstrlenW (lpString=".LDF") returned 4 [0089.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch=".LDF") returned 0x0 [0089.698] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.698] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.699] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.699] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.699] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20970008095) returned 1 [0089.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc445ec70, dwHighDateTime=0x1d585b4)) [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d940 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d940 | out: hHeap=0x260000) returned 1 [0089.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.700] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.700] GetLastError () returned 0x0 [0089.704] GetLastError () returned 0x0 [0089.704] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.704] GetLastError () returned 0x0 [0089.704] GetLastError () returned 0x0 [0089.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.706] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x34f, lpOverlapped=0x0) returned 1 [0089.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.706] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.706] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.706] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.706] CloseHandle (hObject=0xf0) returned 1 [0089.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0089.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0089.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.763] GetLastError () returned 0x0 [0089.763] RtlWakeConditionVariable () returned 0x0 [0089.763] GetCurrentThreadId () returned 0x998 [0089.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".ldf") returned 0x0 [0089.763] lstrlenW (lpString=".vhd") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".vhd") returned 0x0 [0089.764] lstrlenW (lpString=".vhdx") returned 5 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".vhdx") returned 0x0 [0089.764] lstrlenW (lpString=".pst") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".pst") returned 0x0 [0089.764] lstrlenW (lpString=".ost") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".ost") returned 0x0 [0089.764] lstrlenW (lpString=".bak") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".bak") returned 0x0 [0089.764] lstrlenW (lpString=".bac") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".bac") returned 0x0 [0089.764] lstrlenW (lpString=".sys") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".sys") returned 0x0 [0089.764] lstrlenW (lpString=".v2i") returned 4 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".v2i") returned 0x0 [0089.764] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.937] lstrlenW (lpString=".sql") returned 4 [0089.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".sql") returned 0x0 [0089.937] lstrlenW (lpString=".mdf") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".mdf") returned 0x0 [0089.938] lstrlenW (lpString=".txt") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".txt") returned 0x0 [0089.938] lstrlenW (lpString=".dbf") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".dbf") returned 0x0 [0089.938] lstrlenW (lpString=".ckp") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".ckp") returned 0x0 [0089.938] lstrlenW (lpString=".dacpac") returned 7 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".dacpac") returned 0x0 [0089.938] lstrlenW (lpString=".db3") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".db3") returned 0x0 [0089.938] lstrlenW (lpString=".dtxs") returned 5 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".dtxs") returned 0x0 [0089.938] lstrlenW (lpString=".mdt") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".mdt") returned 0x0 [0089.938] lstrlenW (lpString=".sdf") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".sdf") returned 0x0 [0089.938] lstrlenW (lpString=".MDF") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".MDF") returned 0x0 [0089.938] lstrlenW (lpString=".DBF") returned 4 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".DBF") returned 0x0 [0089.938] lstrlenW (lpString=".DB") returned 3 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".DB") returned 0x0 [0089.938] lstrlenW (lpString=".db") returned 3 [0089.938] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".db") returned 0x0 [0089.939] lstrlenW (lpString=".ndf") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".ndf") returned 0x0 [0089.939] lstrlenW (lpString=".NDF") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".NDF") returned 0x0 [0089.939] lstrlenW (lpString=".Mdf") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".Mdf") returned 0x0 [0089.939] lstrlenW (lpString=".dat") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".dat") returned 0x0 [0089.939] lstrlenW (lpString=".DAT") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".DAT") returned 0x0 [0089.939] lstrlenW (lpString=".ldf") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".ldf") returned 0x0 [0089.939] lstrlenW (lpString=".LDF") returned 4 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch=".LDF") returned 0x0 [0089.939] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.939] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.940] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.940] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.940] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20994131582) returned 1 [0089.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc46c0270, dwHighDateTime=0x1d585b4)) [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0380 [0089.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0380 | out: hHeap=0x260000) returned 1 [0089.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.941] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.941] GetLastError () returned 0x0 [0089.941] GetLastError () returned 0x0 [0089.941] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.941] GetLastError () returned 0x0 [0089.942] GetLastError () returned 0x0 [0089.943] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.943] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x37a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x37a, lpOverlapped=0x0) returned 1 [0089.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.943] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.943] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.944] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.944] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.944] CloseHandle (hObject=0x11c) returned 1 [0089.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fbb0 [0089.944] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fbb0 | out: hHeap=0x260000) returned 1 [0089.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.946] GetLastError () returned 0x0 [0089.946] RtlWakeConditionVariable () returned 0x27e828 [0089.946] GetCurrentThreadId () returned 0x998 [0089.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".ldf") returned 0x0 [0089.946] lstrlenW (lpString=".vhd") returned 4 [0089.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".vhd") returned 0x0 [0089.946] lstrlenW (lpString=".vhdx") returned 5 [0089.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".vhdx") returned 0x0 [0089.946] lstrlenW (lpString=".pst") returned 4 [0089.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".pst") returned 0x0 [0089.946] lstrlenW (lpString=".ost") returned 4 [0089.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".ost") returned 0x0 [0089.946] lstrlenW (lpString=".bak") returned 4 [0089.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".bak") returned 0x0 [0089.947] lstrlenW (lpString=".bac") returned 4 [0089.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".bac") returned 0x0 [0089.947] lstrlenW (lpString=".sys") returned 4 [0089.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".sys") returned 0x0 [0089.947] lstrlenW (lpString=".v2i") returned 4 [0089.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".v2i") returned 0x0 [0089.947] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.948] lstrlenW (lpString=".sql") returned 4 [0089.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".sql") returned 0x0 [0089.948] lstrlenW (lpString=".mdf") returned 4 [0089.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".mdf") returned 0x0 [0089.948] lstrlenW (lpString=".txt") returned 4 [0089.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".txt") returned 0x0 [0089.949] lstrlenW (lpString=".dbf") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".dbf") returned 0x0 [0089.949] lstrlenW (lpString=".ckp") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".ckp") returned 0x0 [0089.949] lstrlenW (lpString=".dacpac") returned 7 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".dacpac") returned 0x0 [0089.949] lstrlenW (lpString=".db3") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".db3") returned 0x0 [0089.949] lstrlenW (lpString=".dtxs") returned 5 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".dtxs") returned 0x0 [0089.949] lstrlenW (lpString=".mdt") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".mdt") returned 0x0 [0089.949] lstrlenW (lpString=".sdf") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".sdf") returned 0x0 [0089.949] lstrlenW (lpString=".MDF") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".MDF") returned 0x0 [0089.949] lstrlenW (lpString=".DBF") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".DBF") returned 0x0 [0089.949] lstrlenW (lpString=".DB") returned 3 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".DB") returned 0x0 [0089.949] lstrlenW (lpString=".db") returned 3 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".db") returned 0x0 [0089.949] lstrlenW (lpString=".ndf") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".ndf") returned 0x0 [0089.949] lstrlenW (lpString=".NDF") returned 4 [0089.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".NDF") returned 0x0 [0089.949] lstrlenW (lpString=".Mdf") returned 4 [0089.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".Mdf") returned 0x0 [0089.950] lstrlenW (lpString=".dat") returned 4 [0089.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".dat") returned 0x0 [0089.950] lstrlenW (lpString=".DAT") returned 4 [0089.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".DAT") returned 0x0 [0089.950] lstrlenW (lpString=".ldf") returned 4 [0089.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".ldf") returned 0x0 [0089.950] lstrlenW (lpString=".LDF") returned 4 [0089.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch=".LDF") returned 0x0 [0089.950] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.950] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.951] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.951] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.951] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20995240543) returned 1 [0089.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc46e63d0, dwHighDateTime=0x1d585b4)) [0089.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4250 [0089.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4250 | out: hHeap=0x260000) returned 1 [0089.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.952] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.952] GetLastError () returned 0x0 [0089.952] GetLastError () returned 0x0 [0089.952] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.953] GetLastError () returned 0x0 [0089.953] GetLastError () returned 0x0 [0089.954] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffca3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.954] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x35d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x35d, lpOverlapped=0x0) returned 1 [0089.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.954] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.954] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.955] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.955] CloseHandle (hObject=0x11c) returned 1 [0089.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fbb0 [0089.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fbb0 | out: hHeap=0x260000) returned 1 [0089.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.956] GetLastError () returned 0x0 [0089.956] RtlWakeConditionVariable () returned 0x0 [0089.956] GetCurrentThreadId () returned 0x998 [0089.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".ldf") returned 0x0 [0089.956] lstrlenW (lpString=".vhd") returned 4 [0089.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".vhd") returned 0x0 [0089.956] lstrlenW (lpString=".vhdx") returned 5 [0089.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".vhdx") returned 0x0 [0089.957] lstrlenW (lpString=".pst") returned 4 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".pst") returned 0x0 [0089.957] lstrlenW (lpString=".ost") returned 4 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".ost") returned 0x0 [0089.957] lstrlenW (lpString=".bak") returned 4 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".bak") returned 0x0 [0089.957] lstrlenW (lpString=".bac") returned 4 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".bac") returned 0x0 [0089.957] lstrlenW (lpString=".sys") returned 4 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".sys") returned 0x0 [0089.957] lstrlenW (lpString=".v2i") returned 4 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".v2i") returned 0x0 [0089.957] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.958] lstrlenW (lpString=".sql") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".sql") returned 0x0 [0089.959] lstrlenW (lpString=".mdf") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".mdf") returned 0x0 [0089.959] lstrlenW (lpString=".txt") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".txt") returned 0x0 [0089.959] lstrlenW (lpString=".dbf") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".dbf") returned 0x0 [0089.959] lstrlenW (lpString=".ckp") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".ckp") returned 0x0 [0089.959] lstrlenW (lpString=".dacpac") returned 7 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".dacpac") returned 0x0 [0089.959] lstrlenW (lpString=".db3") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".db3") returned 0x0 [0089.959] lstrlenW (lpString=".dtxs") returned 5 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".dtxs") returned 0x0 [0089.959] lstrlenW (lpString=".mdt") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".mdt") returned 0x0 [0089.959] lstrlenW (lpString=".sdf") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".sdf") returned 0x0 [0089.959] lstrlenW (lpString=".MDF") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".MDF") returned 0x0 [0089.959] lstrlenW (lpString=".DBF") returned 4 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".DBF") returned 0x0 [0089.959] lstrlenW (lpString=".DB") returned 3 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".DB") returned 0x0 [0089.959] lstrlenW (lpString=".db") returned 3 [0089.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".db") returned 0x0 [0089.960] lstrlenW (lpString=".ndf") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".ndf") returned 0x0 [0089.960] lstrlenW (lpString=".NDF") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".NDF") returned 0x0 [0089.960] lstrlenW (lpString=".Mdf") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".Mdf") returned 0x0 [0089.960] lstrlenW (lpString=".dat") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".dat") returned 0x0 [0089.960] lstrlenW (lpString=".DAT") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".DAT") returned 0x0 [0089.960] lstrlenW (lpString=".ldf") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".ldf") returned 0x0 [0089.960] lstrlenW (lpString=".LDF") returned 4 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch=".LDF") returned 0x0 [0089.960] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.960] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0089.961] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.961] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.961] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=20996227010) returned 1 [0089.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc46e63d0, dwHighDateTime=0x1d585b4)) [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4288 [0089.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4288 | out: hHeap=0x260000) returned 1 [0089.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.962] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0089.962] GetLastError () returned 0x0 [0089.962] GetLastError () returned 0x0 [0089.962] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0089.962] GetLastError () returned 0x0 [0089.963] GetLastError () returned 0x0 [0090.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.028] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x354, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x354, lpOverlapped=0x0) returned 1 [0090.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.028] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.029] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.029] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.029] CloseHandle (hObject=0x11c) returned 1 [0090.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.031] GetLastError () returned 0x0 [0090.031] RtlWakeConditionVariable () returned 0x0 [0090.031] GetCurrentThreadId () returned 0x998 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".ldf") returned 0x0 [0090.031] lstrlenW (lpString=".vhd") returned 4 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".vhd") returned 0x0 [0090.031] lstrlenW (lpString=".vhdx") returned 5 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".vhdx") returned 0x0 [0090.031] lstrlenW (lpString=".pst") returned 4 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".pst") returned 0x0 [0090.031] lstrlenW (lpString=".ost") returned 4 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".ost") returned 0x0 [0090.031] lstrlenW (lpString=".bak") returned 4 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".bak") returned 0x0 [0090.031] lstrlenW (lpString=".bac") returned 4 [0090.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".bac") returned 0x0 [0090.031] lstrlenW (lpString=".sys") returned 4 [0090.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".sys") returned 0x0 [0090.032] lstrlenW (lpString=".v2i") returned 4 [0090.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".v2i") returned 0x0 [0090.032] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch="s\r\n.v2i") returned 0x0 [0090.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.033] lstrlenW (lpString=".sql") returned 4 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".sql") returned 0x0 [0090.033] lstrlenW (lpString=".mdf") returned 4 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".mdf") returned 0x0 [0090.033] lstrlenW (lpString=".txt") returned 4 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".txt") returned 0x0 [0090.033] lstrlenW (lpString=".dbf") returned 4 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".dbf") returned 0x0 [0090.033] lstrlenW (lpString=".ckp") returned 4 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".ckp") returned 0x0 [0090.033] lstrlenW (lpString=".dacpac") returned 7 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".dacpac") returned 0x0 [0090.033] lstrlenW (lpString=".db3") returned 4 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".db3") returned 0x0 [0090.033] lstrlenW (lpString=".dtxs") returned 5 [0090.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".dtxs") returned 0x0 [0090.034] lstrlenW (lpString=".mdt") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".mdt") returned 0x0 [0090.034] lstrlenW (lpString=".sdf") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".sdf") returned 0x0 [0090.034] lstrlenW (lpString=".MDF") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".MDF") returned 0x0 [0090.034] lstrlenW (lpString=".DBF") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".DBF") returned 0x0 [0090.034] lstrlenW (lpString=".DB") returned 3 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".DB") returned 0x0 [0090.034] lstrlenW (lpString=".db") returned 3 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".db") returned 0x0 [0090.034] lstrlenW (lpString=".ndf") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".ndf") returned 0x0 [0090.034] lstrlenW (lpString=".NDF") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".NDF") returned 0x0 [0090.034] lstrlenW (lpString=".Mdf") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".Mdf") returned 0x0 [0090.034] lstrlenW (lpString=".dat") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".dat") returned 0x0 [0090.034] lstrlenW (lpString=".DAT") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".DAT") returned 0x0 [0090.034] lstrlenW (lpString=".ldf") returned 4 [0090.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".ldf") returned 0x0 [0090.034] lstrlenW (lpString=".LDF") returned 4 [0090.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch=".LDF") returned 0x0 [0090.035] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.035] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.035] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.036] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21003680845) returned 1 [0090.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc47a4ab0, dwHighDateTime=0x1d585b4)) [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4410 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4410 | out: hHeap=0x260000) returned 1 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.037] GetLastError () returned 0x0 [0090.037] GetLastError () returned 0x0 [0090.037] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.037] GetLastError () returned 0x0 [0090.037] GetLastError () returned 0x0 [0090.039] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff9bd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.039] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6427, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6427, lpOverlapped=0x0) returned 1 [0090.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.039] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.039] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.040] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.040] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.040] CloseHandle (hObject=0x11c) returned 1 [0090.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js.[deadmin@cock.li].deadmin")) returned 1 [0090.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.042] GetLastError () returned 0x0 [0090.042] RtlWakeConditionVariable () returned 0x0 [0090.042] GetCurrentThreadId () returned 0x998 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".ldf") returned 0x0 [0090.042] lstrlenW (lpString=".vhd") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".vhd") returned 0x0 [0090.042] lstrlenW (lpString=".vhdx") returned 5 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".vhdx") returned 0x0 [0090.042] lstrlenW (lpString=".pst") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".pst") returned 0x0 [0090.042] lstrlenW (lpString=".ost") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".ost") returned 0x0 [0090.042] lstrlenW (lpString=".bak") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".bak") returned 0x0 [0090.042] lstrlenW (lpString=".bac") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".bac") returned 0x0 [0090.042] lstrlenW (lpString=".sys") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".sys") returned 0x0 [0090.042] lstrlenW (lpString=".v2i") returned 4 [0090.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".v2i") returned 0x0 [0090.042] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0090.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.044] lstrlenW (lpString=".sql") returned 4 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".sql") returned 0x0 [0090.044] lstrlenW (lpString=".mdf") returned 4 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".mdf") returned 0x0 [0090.044] lstrlenW (lpString=".txt") returned 4 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".txt") returned 0x0 [0090.044] lstrlenW (lpString=".dbf") returned 4 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".dbf") returned 0x0 [0090.044] lstrlenW (lpString=".ckp") returned 4 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".ckp") returned 0x0 [0090.044] lstrlenW (lpString=".dacpac") returned 7 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".dacpac") returned 0x0 [0090.044] lstrlenW (lpString=".db3") returned 4 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".db3") returned 0x0 [0090.044] lstrlenW (lpString=".dtxs") returned 5 [0090.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".dtxs") returned 0x0 [0090.045] lstrlenW (lpString=".mdt") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".mdt") returned 0x0 [0090.045] lstrlenW (lpString=".sdf") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".sdf") returned 0x0 [0090.045] lstrlenW (lpString=".MDF") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".MDF") returned 0x0 [0090.045] lstrlenW (lpString=".DBF") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".DBF") returned 0x0 [0090.045] lstrlenW (lpString=".DB") returned 3 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".DB") returned 0x0 [0090.045] lstrlenW (lpString=".db") returned 3 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".db") returned 0x0 [0090.045] lstrlenW (lpString=".ndf") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".ndf") returned 0x0 [0090.045] lstrlenW (lpString=".NDF") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".NDF") returned 0x0 [0090.045] lstrlenW (lpString=".Mdf") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".Mdf") returned 0x0 [0090.045] lstrlenW (lpString=".dat") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".dat") returned 0x0 [0090.045] lstrlenW (lpString=".DAT") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".DAT") returned 0x0 [0090.045] lstrlenW (lpString=".ldf") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".ldf") returned 0x0 [0090.045] lstrlenW (lpString=".LDF") returned 4 [0090.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch=".LDF") returned 0x0 [0090.045] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.046] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.046] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.046] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.047] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21004775456) returned 1 [0090.047] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc47cac10, dwHighDateTime=0x1d585b4)) [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4448 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4448 | out: hHeap=0x260000) returned 1 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.047] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.047] GetLastError () returned 0x0 [0090.048] GetLastError () returned 0x0 [0090.048] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.048] GetLastError () returned 0x0 [0090.048] GetLastError () returned 0x0 [0090.049] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.049] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x13e, lpOverlapped=0x0) returned 1 [0090.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.049] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.049] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.050] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.050] CloseHandle (hObject=0x11c) returned 1 [0090.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.[deadmin@cock.li].deadmin")) returned 1 [0090.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.051] GetLastError () returned 0x0 [0090.051] RtlWakeConditionVariable () returned 0x27e828 [0090.051] GetCurrentThreadId () returned 0x998 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".ldf") returned 0x0 [0090.052] lstrlenW (lpString=".vhd") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".vhd") returned 0x0 [0090.052] lstrlenW (lpString=".vhdx") returned 5 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".vhdx") returned 0x0 [0090.052] lstrlenW (lpString=".pst") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".pst") returned 0x0 [0090.052] lstrlenW (lpString=".ost") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".ost") returned 0x0 [0090.052] lstrlenW (lpString=".bak") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".bak") returned 0x0 [0090.052] lstrlenW (lpString=".bac") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".bac") returned 0x0 [0090.052] lstrlenW (lpString=".sys") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".sys") returned 0x0 [0090.052] lstrlenW (lpString=".v2i") returned 4 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".v2i") returned 0x0 [0090.052] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch="s\r\n.v2i") returned 0x0 [0090.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.054] lstrlenW (lpString=".sql") returned 4 [0090.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".sql") returned 0x0 [0090.054] lstrlenW (lpString=".mdf") returned 4 [0090.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".mdf") returned 0x0 [0090.054] lstrlenW (lpString=".txt") returned 4 [0090.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".txt") returned 0x0 [0090.054] lstrlenW (lpString=".dbf") returned 4 [0090.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".dbf") returned 0x0 [0090.055] lstrlenW (lpString=".ckp") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".ckp") returned 0x0 [0090.055] lstrlenW (lpString=".dacpac") returned 7 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".dacpac") returned 0x0 [0090.055] lstrlenW (lpString=".db3") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".db3") returned 0x0 [0090.055] lstrlenW (lpString=".dtxs") returned 5 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".dtxs") returned 0x0 [0090.055] lstrlenW (lpString=".mdt") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".mdt") returned 0x0 [0090.055] lstrlenW (lpString=".sdf") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".sdf") returned 0x0 [0090.055] lstrlenW (lpString=".MDF") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".MDF") returned 0x0 [0090.055] lstrlenW (lpString=".DBF") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".DBF") returned 0x0 [0090.055] lstrlenW (lpString=".DB") returned 3 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".DB") returned 0x0 [0090.055] lstrlenW (lpString=".db") returned 3 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".db") returned 0x0 [0090.055] lstrlenW (lpString=".ndf") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".ndf") returned 0x0 [0090.055] lstrlenW (lpString=".NDF") returned 4 [0090.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".NDF") returned 0x0 [0090.055] lstrlenW (lpString=".Mdf") returned 4 [0090.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".Mdf") returned 0x0 [0090.056] lstrlenW (lpString=".dat") returned 4 [0090.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".dat") returned 0x0 [0090.056] lstrlenW (lpString=".DAT") returned 4 [0090.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".DAT") returned 0x0 [0090.056] lstrlenW (lpString=".ldf") returned 4 [0090.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".ldf") returned 0x0 [0090.056] lstrlenW (lpString=".LDF") returned 4 [0090.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch=".LDF") returned 0x0 [0090.056] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.056] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.057] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.057] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21005814300) returned 1 [0090.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc47cac10, dwHighDateTime=0x1d585b4)) [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4480 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4480 | out: hHeap=0x260000) returned 1 [0090.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.058] GetLastError () returned 0x0 [0090.058] GetLastError () returned 0x0 [0090.058] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.058] GetLastError () returned 0x0 [0090.058] GetLastError () returned 0x0 [0090.061] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe24f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.061] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1db1, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1db1, lpOverlapped=0x0) returned 1 [0090.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.061] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.061] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.061] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.061] CloseHandle (hObject=0x11c) returned 1 [0090.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js.[deadmin@cock.li].deadmin")) returned 1 [0090.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.063] GetLastError () returned 0x0 [0090.063] RtlWakeConditionVariable () returned 0x0 [0090.063] GetCurrentThreadId () returned 0x998 [0090.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".ldf") returned 0x0 [0090.063] lstrlenW (lpString=".vhd") returned 4 [0090.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".vhd") returned 0x0 [0090.064] lstrlenW (lpString=".vhdx") returned 5 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".vhdx") returned 0x0 [0090.064] lstrlenW (lpString=".pst") returned 4 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".pst") returned 0x0 [0090.064] lstrlenW (lpString=".ost") returned 4 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".ost") returned 0x0 [0090.064] lstrlenW (lpString=".bak") returned 4 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".bak") returned 0x0 [0090.064] lstrlenW (lpString=".bac") returned 4 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".bac") returned 0x0 [0090.064] lstrlenW (lpString=".sys") returned 4 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".sys") returned 0x0 [0090.064] lstrlenW (lpString=".v2i") returned 4 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".v2i") returned 0x0 [0090.064] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0090.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.065] lstrlenW (lpString=".sql") returned 4 [0090.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".sql") returned 0x0 [0090.065] lstrlenW (lpString=".mdf") returned 4 [0090.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".mdf") returned 0x0 [0090.066] lstrlenW (lpString=".txt") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".txt") returned 0x0 [0090.066] lstrlenW (lpString=".dbf") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".dbf") returned 0x0 [0090.066] lstrlenW (lpString=".ckp") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".ckp") returned 0x0 [0090.066] lstrlenW (lpString=".dacpac") returned 7 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".dacpac") returned 0x0 [0090.066] lstrlenW (lpString=".db3") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".db3") returned 0x0 [0090.066] lstrlenW (lpString=".dtxs") returned 5 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".dtxs") returned 0x0 [0090.066] lstrlenW (lpString=".mdt") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".mdt") returned 0x0 [0090.066] lstrlenW (lpString=".sdf") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".sdf") returned 0x0 [0090.066] lstrlenW (lpString=".MDF") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".MDF") returned 0x0 [0090.066] lstrlenW (lpString=".DBF") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".DBF") returned 0x0 [0090.066] lstrlenW (lpString=".DB") returned 3 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".DB") returned 0x0 [0090.066] lstrlenW (lpString=".db") returned 3 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".db") returned 0x0 [0090.066] lstrlenW (lpString=".ndf") returned 4 [0090.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".ndf") returned 0x0 [0090.067] lstrlenW (lpString=".NDF") returned 4 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".NDF") returned 0x0 [0090.067] lstrlenW (lpString=".Mdf") returned 4 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".Mdf") returned 0x0 [0090.067] lstrlenW (lpString=".dat") returned 4 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".dat") returned 0x0 [0090.067] lstrlenW (lpString=".DAT") returned 4 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".DAT") returned 0x0 [0090.067] lstrlenW (lpString=".ldf") returned 4 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".ldf") returned 0x0 [0090.067] lstrlenW (lpString=".LDF") returned 4 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch=".LDF") returned 0x0 [0090.067] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.067] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.068] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.068] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.068] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21006926575) returned 1 [0090.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc47f0d70, dwHighDateTime=0x1d585b4)) [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b44b8 [0090.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b44b8 | out: hHeap=0x260000) returned 1 [0090.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.069] GetLastError () returned 0x0 [0090.069] GetLastError () returned 0x0 [0090.069] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.069] GetLastError () returned 0x0 [0090.070] GetLastError () returned 0x0 [0090.128] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.128] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd78, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd78, lpOverlapped=0x0) returned 1 [0090.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.128] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.128] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.128] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.128] CloseHandle (hObject=0x11c) returned 1 [0090.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.[deadmin@cock.li].deadmin")) returned 1 [0090.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.130] GetLastError () returned 0x0 [0090.130] RtlWakeConditionVariable () returned 0x0 [0090.130] GetCurrentThreadId () returned 0x998 [0090.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".ldf") returned 0x0 [0090.130] lstrlenW (lpString=".vhd") returned 4 [0090.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".vhd") returned 0x0 [0090.130] lstrlenW (lpString=".vhdx") returned 5 [0090.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".vhdx") returned 0x0 [0090.130] lstrlenW (lpString=".pst") returned 4 [0090.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".pst") returned 0x0 [0090.131] lstrlenW (lpString=".ost") returned 4 [0090.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".ost") returned 0x0 [0090.131] lstrlenW (lpString=".bak") returned 4 [0090.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".bak") returned 0x0 [0090.131] lstrlenW (lpString=".bac") returned 4 [0090.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".bac") returned 0x0 [0090.131] lstrlenW (lpString=".sys") returned 4 [0090.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".sys") returned 0x0 [0090.131] lstrlenW (lpString=".v2i") returned 4 [0090.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".v2i") returned 0x0 [0090.131] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.132] lstrlenW (lpString=".sql") returned 4 [0090.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".sql") returned 0x0 [0090.132] lstrlenW (lpString=".mdf") returned 4 [0090.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".mdf") returned 0x0 [0090.132] lstrlenW (lpString=".txt") returned 4 [0090.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".txt") returned 0x0 [0090.132] lstrlenW (lpString=".dbf") returned 4 [0090.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".dbf") returned 0x0 [0090.132] lstrlenW (lpString=".ckp") returned 4 [0090.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".ckp") returned 0x0 [0090.132] lstrlenW (lpString=".dacpac") returned 7 [0090.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".dacpac") returned 0x0 [0090.133] lstrlenW (lpString=".db3") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".db3") returned 0x0 [0090.133] lstrlenW (lpString=".dtxs") returned 5 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".dtxs") returned 0x0 [0090.133] lstrlenW (lpString=".mdt") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".mdt") returned 0x0 [0090.133] lstrlenW (lpString=".sdf") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".sdf") returned 0x0 [0090.133] lstrlenW (lpString=".MDF") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".MDF") returned 0x0 [0090.133] lstrlenW (lpString=".DBF") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".DBF") returned 0x0 [0090.133] lstrlenW (lpString=".DB") returned 3 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".DB") returned 0x0 [0090.133] lstrlenW (lpString=".db") returned 3 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".db") returned 0x0 [0090.133] lstrlenW (lpString=".ndf") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".ndf") returned 0x0 [0090.133] lstrlenW (lpString=".NDF") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".NDF") returned 0x0 [0090.133] lstrlenW (lpString=".Mdf") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".Mdf") returned 0x0 [0090.133] lstrlenW (lpString=".dat") returned 4 [0090.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".dat") returned 0x0 [0090.133] lstrlenW (lpString=".DAT") returned 4 [0090.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".DAT") returned 0x0 [0090.134] lstrlenW (lpString=".ldf") returned 4 [0090.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".ldf") returned 0x0 [0090.134] lstrlenW (lpString=".LDF") returned 4 [0090.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch=".LDF") returned 0x0 [0090.134] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.134] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.135] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.135] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21013607967) returned 1 [0090.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc48892f0, dwHighDateTime=0x1d585b4)) [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4678 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4678 | out: hHeap=0x260000) returned 1 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.136] GetLastError () returned 0x0 [0090.136] GetLastError () returned 0x0 [0090.136] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.136] GetLastError () returned 0x0 [0090.136] GetLastError () returned 0x0 [0090.162] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff822d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.162] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7dd3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x7dd3, lpOverlapped=0x0) returned 1 [0090.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.162] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.162] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.162] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.162] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.162] CloseHandle (hObject=0x11c) returned 1 [0090.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.164] GetLastError () returned 0x0 [0090.164] RtlWakeConditionVariable () returned 0x27e828 [0090.164] GetCurrentThreadId () returned 0x998 [0090.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".ldf") returned 0x0 [0090.164] lstrlenW (lpString=".vhd") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".vhd") returned 0x0 [0090.165] lstrlenW (lpString=".vhdx") returned 5 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".vhdx") returned 0x0 [0090.165] lstrlenW (lpString=".pst") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".pst") returned 0x0 [0090.165] lstrlenW (lpString=".ost") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".ost") returned 0x0 [0090.165] lstrlenW (lpString=".bak") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".bak") returned 0x0 [0090.165] lstrlenW (lpString=".bac") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".bac") returned 0x0 [0090.165] lstrlenW (lpString=".sys") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".sys") returned 0x0 [0090.165] lstrlenW (lpString=".v2i") returned 4 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".v2i") returned 0x0 [0090.165] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.166] lstrlenW (lpString=".sql") returned 4 [0090.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".sql") returned 0x0 [0090.166] lstrlenW (lpString=".mdf") returned 4 [0090.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".mdf") returned 0x0 [0090.166] lstrlenW (lpString=".txt") returned 4 [0090.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".txt") returned 0x0 [0090.167] lstrlenW (lpString=".dbf") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".dbf") returned 0x0 [0090.167] lstrlenW (lpString=".ckp") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".ckp") returned 0x0 [0090.167] lstrlenW (lpString=".dacpac") returned 7 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".dacpac") returned 0x0 [0090.167] lstrlenW (lpString=".db3") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".db3") returned 0x0 [0090.167] lstrlenW (lpString=".dtxs") returned 5 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".dtxs") returned 0x0 [0090.167] lstrlenW (lpString=".mdt") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".mdt") returned 0x0 [0090.167] lstrlenW (lpString=".sdf") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".sdf") returned 0x0 [0090.167] lstrlenW (lpString=".MDF") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".MDF") returned 0x0 [0090.167] lstrlenW (lpString=".DBF") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".DBF") returned 0x0 [0090.167] lstrlenW (lpString=".DB") returned 3 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".DB") returned 0x0 [0090.167] lstrlenW (lpString=".db") returned 3 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".db") returned 0x0 [0090.167] lstrlenW (lpString=".ndf") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".ndf") returned 0x0 [0090.167] lstrlenW (lpString=".NDF") returned 4 [0090.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".NDF") returned 0x0 [0090.168] lstrlenW (lpString=".Mdf") returned 4 [0090.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".Mdf") returned 0x0 [0090.168] lstrlenW (lpString=".dat") returned 4 [0090.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".dat") returned 0x0 [0090.168] lstrlenW (lpString=".DAT") returned 4 [0090.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".DAT") returned 0x0 [0090.168] lstrlenW (lpString=".ldf") returned 4 [0090.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".ldf") returned 0x0 [0090.168] lstrlenW (lpString=".LDF") returned 4 [0090.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch=".LDF") returned 0x0 [0090.168] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.168] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.169] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.169] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21017042125) returned 1 [0090.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc48fb710, dwHighDateTime=0x1d585b4)) [0090.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4720 [0090.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4720 | out: hHeap=0x260000) returned 1 [0090.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.170] GetLastError () returned 0x0 [0090.170] GetLastError () returned 0x0 [0090.170] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.171] GetLastError () returned 0x0 [0090.171] GetLastError () returned 0x0 [0090.193] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb145, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.193] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4ebb, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x4ebb, lpOverlapped=0x0) returned 1 [0090.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.194] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.194] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.194] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.194] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.194] CloseHandle (hObject=0x11c) returned 1 [0090.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.196] GetLastError () returned 0x0 [0090.196] RtlWakeConditionVariable () returned 0x27e828 [0090.196] GetCurrentThreadId () returned 0x998 [0090.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".ldf") returned 0x0 [0090.196] lstrlenW (lpString=".vhd") returned 4 [0090.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".vhd") returned 0x0 [0090.196] lstrlenW (lpString=".vhdx") returned 5 [0090.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".vhdx") returned 0x0 [0090.196] lstrlenW (lpString=".pst") returned 4 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".pst") returned 0x0 [0090.197] lstrlenW (lpString=".ost") returned 4 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".ost") returned 0x0 [0090.197] lstrlenW (lpString=".bak") returned 4 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".bak") returned 0x0 [0090.197] lstrlenW (lpString=".bac") returned 4 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".bac") returned 0x0 [0090.197] lstrlenW (lpString=".sys") returned 4 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".sys") returned 0x0 [0090.197] lstrlenW (lpString=".v2i") returned 4 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".v2i") returned 0x0 [0090.197] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.199] lstrlenW (lpString=".sql") returned 4 [0090.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".sql") returned 0x0 [0090.199] lstrlenW (lpString=".mdf") returned 4 [0090.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".mdf") returned 0x0 [0090.199] lstrlenW (lpString=".txt") returned 4 [0090.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".txt") returned 0x0 [0090.199] lstrlenW (lpString=".dbf") returned 4 [0090.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".dbf") returned 0x0 [0090.200] lstrlenW (lpString=".ckp") returned 4 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".ckp") returned 0x0 [0090.200] lstrlenW (lpString=".dacpac") returned 7 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".dacpac") returned 0x0 [0090.200] lstrlenW (lpString=".db3") returned 4 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".db3") returned 0x0 [0090.200] lstrlenW (lpString=".dtxs") returned 5 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".dtxs") returned 0x0 [0090.200] lstrlenW (lpString=".mdt") returned 4 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".mdt") returned 0x0 [0090.200] lstrlenW (lpString=".sdf") returned 4 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".sdf") returned 0x0 [0090.200] lstrlenW (lpString=".MDF") returned 4 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".MDF") returned 0x0 [0090.200] lstrlenW (lpString=".DBF") returned 4 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".DBF") returned 0x0 [0090.200] lstrlenW (lpString=".DB") returned 3 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".DB") returned 0x0 [0090.200] lstrlenW (lpString=".db") returned 3 [0090.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".db") returned 0x0 [0090.201] lstrlenW (lpString=".ndf") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".ndf") returned 0x0 [0090.201] lstrlenW (lpString=".NDF") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".NDF") returned 0x0 [0090.201] lstrlenW (lpString=".Mdf") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".Mdf") returned 0x0 [0090.201] lstrlenW (lpString=".dat") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".dat") returned 0x0 [0090.201] lstrlenW (lpString=".DAT") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".DAT") returned 0x0 [0090.201] lstrlenW (lpString=".ldf") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".ldf") returned 0x0 [0090.201] lstrlenW (lpString=".LDF") returned 4 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch=".LDF") returned 0x0 [0090.201] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.201] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.203] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.203] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21020393957) returned 1 [0090.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc49479d0, dwHighDateTime=0x1d585b4)) [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b47c8 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b47c8 | out: hHeap=0x260000) returned 1 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.204] GetLastError () returned 0x0 [0090.204] GetLastError () returned 0x0 [0090.204] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.204] GetLastError () returned 0x0 [0090.205] GetLastError () returned 0x0 [0090.220] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.220] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6a, lpOverlapped=0x0) returned 1 [0090.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.220] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.220] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.221] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.221] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.221] CloseHandle (hObject=0x11c) returned 1 [0090.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.223] GetLastError () returned 0x0 [0090.223] RtlWakeConditionVariable () returned 0x27e828 [0090.223] GetCurrentThreadId () returned 0x998 [0090.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".ldf") returned 0x0 [0090.223] lstrlenW (lpString=".vhd") returned 4 [0090.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".vhd") returned 0x0 [0090.224] lstrlenW (lpString=".vhdx") returned 5 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".vhdx") returned 0x0 [0090.224] lstrlenW (lpString=".pst") returned 4 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".pst") returned 0x0 [0090.224] lstrlenW (lpString=".ost") returned 4 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".ost") returned 0x0 [0090.224] lstrlenW (lpString=".bak") returned 4 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".bak") returned 0x0 [0090.224] lstrlenW (lpString=".bac") returned 4 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".bac") returned 0x0 [0090.224] lstrlenW (lpString=".sys") returned 4 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".sys") returned 0x0 [0090.224] lstrlenW (lpString=".v2i") returned 4 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".v2i") returned 0x0 [0090.224] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.226] lstrlenW (lpString=".sql") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".sql") returned 0x0 [0090.226] lstrlenW (lpString=".mdf") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".mdf") returned 0x0 [0090.226] lstrlenW (lpString=".txt") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".txt") returned 0x0 [0090.226] lstrlenW (lpString=".dbf") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".dbf") returned 0x0 [0090.226] lstrlenW (lpString=".ckp") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".ckp") returned 0x0 [0090.226] lstrlenW (lpString=".dacpac") returned 7 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".dacpac") returned 0x0 [0090.226] lstrlenW (lpString=".db3") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".db3") returned 0x0 [0090.226] lstrlenW (lpString=".dtxs") returned 5 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".dtxs") returned 0x0 [0090.226] lstrlenW (lpString=".mdt") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".mdt") returned 0x0 [0090.226] lstrlenW (lpString=".sdf") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".sdf") returned 0x0 [0090.226] lstrlenW (lpString=".MDF") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".MDF") returned 0x0 [0090.226] lstrlenW (lpString=".DBF") returned 4 [0090.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".DBF") returned 0x0 [0090.226] lstrlenW (lpString=".DB") returned 3 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".DB") returned 0x0 [0090.227] lstrlenW (lpString=".db") returned 3 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".db") returned 0x0 [0090.227] lstrlenW (lpString=".ndf") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".ndf") returned 0x0 [0090.227] lstrlenW (lpString=".NDF") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".NDF") returned 0x0 [0090.227] lstrlenW (lpString=".Mdf") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".Mdf") returned 0x0 [0090.227] lstrlenW (lpString=".dat") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".dat") returned 0x0 [0090.227] lstrlenW (lpString=".DAT") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".DAT") returned 0x0 [0090.227] lstrlenW (lpString=".ldf") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".ldf") returned 0x0 [0090.227] lstrlenW (lpString=".LDF") returned 4 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch=".LDF") returned 0x0 [0090.227] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.227] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.228] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.228] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.228] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21022996074) returned 1 [0090.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc496db30, dwHighDateTime=0x1d585b4)) [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4838 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4838 | out: hHeap=0x260000) returned 1 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.230] GetLastError () returned 0x0 [0090.230] GetLastError () returned 0x0 [0090.230] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.230] GetLastError () returned 0x0 [0090.230] GetLastError () returned 0x0 [0090.232] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc2a9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.232] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3d57, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x3d57, lpOverlapped=0x0) returned 1 [0090.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.233] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.233] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.233] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.233] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.233] CloseHandle (hObject=0x11c) returned 1 [0090.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.235] GetLastError () returned 0x0 [0090.235] RtlWakeConditionVariable () returned 0x0 [0090.235] GetCurrentThreadId () returned 0x998 [0090.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".ldf") returned 0x0 [0090.235] lstrlenW (lpString=".vhd") returned 4 [0090.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".vhd") returned 0x0 [0090.235] lstrlenW (lpString=".vhdx") returned 5 [0090.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".vhdx") returned 0x0 [0090.235] lstrlenW (lpString=".pst") returned 4 [0090.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".pst") returned 0x0 [0090.235] lstrlenW (lpString=".ost") returned 4 [0090.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".ost") returned 0x0 [0090.236] lstrlenW (lpString=".bak") returned 4 [0090.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".bak") returned 0x0 [0090.236] lstrlenW (lpString=".bac") returned 4 [0090.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".bac") returned 0x0 [0090.236] lstrlenW (lpString=".sys") returned 4 [0090.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".sys") returned 0x0 [0090.236] lstrlenW (lpString=".v2i") returned 4 [0090.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".v2i") returned 0x0 [0090.236] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.237] lstrlenW (lpString=".sql") returned 4 [0090.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".sql") returned 0x0 [0090.237] lstrlenW (lpString=".mdf") returned 4 [0090.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".mdf") returned 0x0 [0090.237] lstrlenW (lpString=".txt") returned 4 [0090.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".txt") returned 0x0 [0090.237] lstrlenW (lpString=".dbf") returned 4 [0090.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".dbf") returned 0x0 [0090.237] lstrlenW (lpString=".ckp") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".ckp") returned 0x0 [0090.238] lstrlenW (lpString=".dacpac") returned 7 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".dacpac") returned 0x0 [0090.238] lstrlenW (lpString=".db3") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".db3") returned 0x0 [0090.238] lstrlenW (lpString=".dtxs") returned 5 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".dtxs") returned 0x0 [0090.238] lstrlenW (lpString=".mdt") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".mdt") returned 0x0 [0090.238] lstrlenW (lpString=".sdf") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".sdf") returned 0x0 [0090.238] lstrlenW (lpString=".MDF") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".MDF") returned 0x0 [0090.238] lstrlenW (lpString=".DBF") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".DBF") returned 0x0 [0090.238] lstrlenW (lpString=".DB") returned 3 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".DB") returned 0x0 [0090.238] lstrlenW (lpString=".db") returned 3 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".db") returned 0x0 [0090.238] lstrlenW (lpString=".ndf") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".ndf") returned 0x0 [0090.238] lstrlenW (lpString=".NDF") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".NDF") returned 0x0 [0090.238] lstrlenW (lpString=".Mdf") returned 4 [0090.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".Mdf") returned 0x0 [0090.238] lstrlenW (lpString=".dat") returned 4 [0090.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".dat") returned 0x0 [0090.239] lstrlenW (lpString=".DAT") returned 4 [0090.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".DAT") returned 0x0 [0090.239] lstrlenW (lpString=".ldf") returned 4 [0090.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".ldf") returned 0x0 [0090.239] lstrlenW (lpString=".LDF") returned 4 [0090.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch=".LDF") returned 0x0 [0090.239] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.239] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.240] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.240] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.240] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21024108835) returned 1 [0090.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4993c90, dwHighDateTime=0x1d585b4)) [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4870 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4870 | out: hHeap=0x260000) returned 1 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.241] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.241] GetLastError () returned 0x0 [0090.241] GetLastError () returned 0x0 [0090.241] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.241] GetLastError () returned 0x0 [0090.241] GetLastError () returned 0x0 [0090.243] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe7bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.243] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1845, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x1845, lpOverlapped=0x0) returned 1 [0090.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.243] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.243] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.243] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.244] CloseHandle (hObject=0x11c) returned 1 [0090.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.245] GetLastError () returned 0x0 [0090.246] RtlWakeConditionVariable () returned 0x0 [0090.246] GetCurrentThreadId () returned 0x998 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".ldf") returned 0x0 [0090.246] lstrlenW (lpString=".vhd") returned 4 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".vhd") returned 0x0 [0090.246] lstrlenW (lpString=".vhdx") returned 5 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".vhdx") returned 0x0 [0090.246] lstrlenW (lpString=".pst") returned 4 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".pst") returned 0x0 [0090.246] lstrlenW (lpString=".ost") returned 4 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".ost") returned 0x0 [0090.246] lstrlenW (lpString=".bak") returned 4 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".bak") returned 0x0 [0090.246] lstrlenW (lpString=".bac") returned 4 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".bac") returned 0x0 [0090.246] lstrlenW (lpString=".sys") returned 4 [0090.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".sys") returned 0x0 [0090.247] lstrlenW (lpString=".v2i") returned 4 [0090.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".v2i") returned 0x0 [0090.247] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.248] lstrlenW (lpString=".sql") returned 4 [0090.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".sql") returned 0x0 [0090.248] lstrlenW (lpString=".mdf") returned 4 [0090.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".mdf") returned 0x0 [0090.248] lstrlenW (lpString=".txt") returned 4 [0090.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".txt") returned 0x0 [0090.248] lstrlenW (lpString=".dbf") returned 4 [0090.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".dbf") returned 0x0 [0090.248] lstrlenW (lpString=".ckp") returned 4 [0090.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".ckp") returned 0x0 [0090.248] lstrlenW (lpString=".dacpac") returned 7 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".dacpac") returned 0x0 [0090.249] lstrlenW (lpString=".db3") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".db3") returned 0x0 [0090.249] lstrlenW (lpString=".dtxs") returned 5 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".dtxs") returned 0x0 [0090.249] lstrlenW (lpString=".mdt") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".mdt") returned 0x0 [0090.249] lstrlenW (lpString=".sdf") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".sdf") returned 0x0 [0090.249] lstrlenW (lpString=".MDF") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".MDF") returned 0x0 [0090.249] lstrlenW (lpString=".DBF") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".DBF") returned 0x0 [0090.249] lstrlenW (lpString=".DB") returned 3 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".DB") returned 0x0 [0090.249] lstrlenW (lpString=".db") returned 3 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".db") returned 0x0 [0090.249] lstrlenW (lpString=".ndf") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".ndf") returned 0x0 [0090.249] lstrlenW (lpString=".NDF") returned 4 [0090.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".NDF") returned 0x0 [0090.250] lstrlenW (lpString=".Mdf") returned 4 [0090.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".Mdf") returned 0x0 [0090.250] lstrlenW (lpString=".dat") returned 4 [0090.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".dat") returned 0x0 [0090.250] lstrlenW (lpString=".DAT") returned 4 [0090.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".DAT") returned 0x0 [0090.250] lstrlenW (lpString=".ldf") returned 4 [0090.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".ldf") returned 0x0 [0090.250] lstrlenW (lpString=".LDF") returned 4 [0090.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch=".LDF") returned 0x0 [0090.250] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.250] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.251] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.251] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.251] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21025224963) returned 1 [0090.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc49b9df0, dwHighDateTime=0x1d585b4)) [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b48a8 [0090.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b48a8 | out: hHeap=0x260000) returned 1 [0090.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.252] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.252] GetLastError () returned 0x0 [0090.252] GetLastError () returned 0x0 [0090.252] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.252] GetLastError () returned 0x0 [0090.253] GetLastError () returned 0x0 [0090.374] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffaebf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.374] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5141, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x5141, lpOverlapped=0x0) returned 1 [0090.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.375] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.375] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.375] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.375] CloseHandle (hObject=0x11c) returned 1 [0090.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0090.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0090.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.415] GetLastError () returned 0x0 [0090.415] RtlWakeConditionVariable () returned 0x0 [0090.415] GetCurrentThreadId () returned 0x998 [0090.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0090.415] lstrlenW (lpString=".vhd") returned 4 [0090.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".vhd") returned 0x0 [0090.415] lstrlenW (lpString=".vhdx") returned 5 [0090.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".vhdx") returned 0x0 [0090.415] lstrlenW (lpString=".pst") returned 4 [0090.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".pst") returned 0x0 [0090.416] lstrlenW (lpString=".ost") returned 4 [0090.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".ost") returned 0x0 [0090.416] lstrlenW (lpString=".bak") returned 4 [0090.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".bak") returned 0x0 [0090.416] lstrlenW (lpString=".bac") returned 4 [0090.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".bac") returned 0x0 [0090.416] lstrlenW (lpString=".sys") returned 4 [0090.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".sys") returned 0x0 [0090.416] lstrlenW (lpString=".v2i") returned 4 [0090.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".v2i") returned 0x0 [0090.416] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.417] lstrlenW (lpString=".sql") returned 4 [0090.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".sql") returned 0x0 [0090.417] lstrlenW (lpString=".mdf") returned 4 [0090.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".mdf") returned 0x0 [0090.418] lstrlenW (lpString=".txt") returned 4 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".txt") returned 0x0 [0090.418] lstrlenW (lpString=".dbf") returned 4 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".dbf") returned 0x0 [0090.418] lstrlenW (lpString=".ckp") returned 4 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".ckp") returned 0x0 [0090.418] lstrlenW (lpString=".dacpac") returned 7 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".dacpac") returned 0x0 [0090.418] lstrlenW (lpString=".db3") returned 4 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".db3") returned 0x0 [0090.418] lstrlenW (lpString=".dtxs") returned 5 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".dtxs") returned 0x0 [0090.418] lstrlenW (lpString=".mdt") returned 4 [0090.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".mdt") returned 0x0 [0090.419] lstrlenW (lpString=".sdf") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".sdf") returned 0x0 [0090.419] lstrlenW (lpString=".MDF") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".MDF") returned 0x0 [0090.419] lstrlenW (lpString=".DBF") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".DBF") returned 0x0 [0090.419] lstrlenW (lpString=".DB") returned 3 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".DB") returned 0x0 [0090.419] lstrlenW (lpString=".db") returned 3 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".db") returned 0x0 [0090.419] lstrlenW (lpString=".ndf") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".ndf") returned 0x0 [0090.419] lstrlenW (lpString=".NDF") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".NDF") returned 0x0 [0090.419] lstrlenW (lpString=".Mdf") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".Mdf") returned 0x0 [0090.419] lstrlenW (lpString=".dat") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".dat") returned 0x0 [0090.419] lstrlenW (lpString=".DAT") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".DAT") returned 0x0 [0090.419] lstrlenW (lpString=".ldf") returned 4 [0090.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0090.420] lstrlenW (lpString=".LDF") returned 4 [0090.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch=".LDF") returned 0x0 [0090.420] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.420] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.421] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.421] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.421] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21042188122) returned 1 [0090.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4b5cd10, dwHighDateTime=0x1d585b4)) [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4bf0 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4bf0 | out: hHeap=0x260000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.421] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.422] GetLastError () returned 0x0 [0090.422] GetLastError () returned 0x0 [0090.422] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.422] GetLastError () returned 0x0 [0090.422] GetLastError () returned 0x0 [0090.425] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff7ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.425] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x852, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x852, lpOverlapped=0x0) returned 1 [0090.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.425] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.425] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.425] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.425] CloseHandle (hObject=0x11c) returned 1 [0090.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2762060 [0090.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.[deadmin@cock.li].deadmin")) returned 1 [0090.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762060 | out: hHeap=0x260000) returned 1 [0090.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.427] GetLastError () returned 0x0 [0090.427] RtlWakeConditionVariable () returned 0x0 [0090.427] GetCurrentThreadId () returned 0x998 [0090.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".ldf") returned 0x0 [0090.427] lstrlenW (lpString=".vhd") returned 4 [0090.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".vhd") returned 0x0 [0090.428] lstrlenW (lpString=".vhdx") returned 5 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".vhdx") returned 0x0 [0090.428] lstrlenW (lpString=".pst") returned 4 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".pst") returned 0x0 [0090.428] lstrlenW (lpString=".ost") returned 4 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".ost") returned 0x0 [0090.428] lstrlenW (lpString=".bak") returned 4 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".bak") returned 0x0 [0090.428] lstrlenW (lpString=".bac") returned 4 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".bac") returned 0x0 [0090.428] lstrlenW (lpString=".sys") returned 4 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".sys") returned 0x0 [0090.428] lstrlenW (lpString=".v2i") returned 4 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".v2i") returned 0x0 [0090.428] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.429] lstrlenW (lpString=".sql") returned 4 [0090.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".sql") returned 0x0 [0090.429] lstrlenW (lpString=".mdf") returned 4 [0090.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".mdf") returned 0x0 [0090.429] lstrlenW (lpString=".txt") returned 4 [0090.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".txt") returned 0x0 [0090.429] lstrlenW (lpString=".dbf") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".dbf") returned 0x0 [0090.430] lstrlenW (lpString=".ckp") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".ckp") returned 0x0 [0090.430] lstrlenW (lpString=".dacpac") returned 7 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".dacpac") returned 0x0 [0090.430] lstrlenW (lpString=".db3") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".db3") returned 0x0 [0090.430] lstrlenW (lpString=".dtxs") returned 5 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".dtxs") returned 0x0 [0090.430] lstrlenW (lpString=".mdt") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".mdt") returned 0x0 [0090.430] lstrlenW (lpString=".sdf") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".sdf") returned 0x0 [0090.430] lstrlenW (lpString=".MDF") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".MDF") returned 0x0 [0090.430] lstrlenW (lpString=".DBF") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".DBF") returned 0x0 [0090.430] lstrlenW (lpString=".DB") returned 3 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".DB") returned 0x0 [0090.430] lstrlenW (lpString=".db") returned 3 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".db") returned 0x0 [0090.430] lstrlenW (lpString=".ndf") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".ndf") returned 0x0 [0090.430] lstrlenW (lpString=".NDF") returned 4 [0090.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".NDF") returned 0x0 [0090.431] lstrlenW (lpString=".Mdf") returned 4 [0090.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".Mdf") returned 0x0 [0090.431] lstrlenW (lpString=".dat") returned 4 [0090.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".dat") returned 0x0 [0090.431] lstrlenW (lpString=".DAT") returned 4 [0090.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".DAT") returned 0x0 [0090.431] lstrlenW (lpString=".ldf") returned 4 [0090.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".ldf") returned 0x0 [0090.431] lstrlenW (lpString=".LDF") returned 4 [0090.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch=".LDF") returned 0x0 [0090.431] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.431] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.432] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.432] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.432] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21043318743) returned 1 [0090.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4b5cd10, dwHighDateTime=0x1d585b4)) [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4c28 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4c28 | out: hHeap=0x260000) returned 1 [0090.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.433] GetLastError () returned 0x0 [0090.433] GetLastError () returned 0x0 [0090.433] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.433] GetLastError () returned 0x0 [0090.434] GetLastError () returned 0x0 [0090.435] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd11, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.435] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2ef, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2ef, lpOverlapped=0x0) returned 1 [0090.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.435] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.435] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.436] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.436] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.436] CloseHandle (hObject=0x11c) returned 1 [0090.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0090.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.[deadmin@cock.li].deadmin")) returned 1 [0090.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0090.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.437] GetLastError () returned 0x0 [0090.438] RtlWakeConditionVariable () returned 0x0 [0090.438] GetCurrentThreadId () returned 0x998 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".ldf") returned 0x0 [0090.438] lstrlenW (lpString=".vhd") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".vhd") returned 0x0 [0090.438] lstrlenW (lpString=".vhdx") returned 5 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".vhdx") returned 0x0 [0090.438] lstrlenW (lpString=".pst") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".pst") returned 0x0 [0090.438] lstrlenW (lpString=".ost") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".ost") returned 0x0 [0090.438] lstrlenW (lpString=".bak") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".bak") returned 0x0 [0090.438] lstrlenW (lpString=".bac") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".bac") returned 0x0 [0090.438] lstrlenW (lpString=".sys") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".sys") returned 0x0 [0090.438] lstrlenW (lpString=".v2i") returned 4 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".v2i") returned 0x0 [0090.438] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.440] lstrlenW (lpString=".sql") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".sql") returned 0x0 [0090.440] lstrlenW (lpString=".mdf") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".mdf") returned 0x0 [0090.440] lstrlenW (lpString=".txt") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".txt") returned 0x0 [0090.440] lstrlenW (lpString=".dbf") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".dbf") returned 0x0 [0090.440] lstrlenW (lpString=".ckp") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".ckp") returned 0x0 [0090.440] lstrlenW (lpString=".dacpac") returned 7 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".dacpac") returned 0x0 [0090.440] lstrlenW (lpString=".db3") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".db3") returned 0x0 [0090.440] lstrlenW (lpString=".dtxs") returned 5 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".dtxs") returned 0x0 [0090.440] lstrlenW (lpString=".mdt") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".mdt") returned 0x0 [0090.440] lstrlenW (lpString=".sdf") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".sdf") returned 0x0 [0090.440] lstrlenW (lpString=".MDF") returned 4 [0090.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".MDF") returned 0x0 [0090.440] lstrlenW (lpString=".DBF") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".DBF") returned 0x0 [0090.441] lstrlenW (lpString=".DB") returned 3 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".DB") returned 0x0 [0090.441] lstrlenW (lpString=".db") returned 3 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".db") returned 0x0 [0090.441] lstrlenW (lpString=".ndf") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".ndf") returned 0x0 [0090.441] lstrlenW (lpString=".NDF") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".NDF") returned 0x0 [0090.441] lstrlenW (lpString=".Mdf") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".Mdf") returned 0x0 [0090.441] lstrlenW (lpString=".dat") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".dat") returned 0x0 [0090.441] lstrlenW (lpString=".DAT") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".DAT") returned 0x0 [0090.441] lstrlenW (lpString=".ldf") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".ldf") returned 0x0 [0090.441] lstrlenW (lpString=".LDF") returned 4 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch=".LDF") returned 0x0 [0090.441] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.441] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.442] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.442] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.442] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21044354512) returned 1 [0090.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4b82e70, dwHighDateTime=0x1d585b4)) [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4c60 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4c60 | out: hHeap=0x260000) returned 1 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.443] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.443] GetLastError () returned 0x0 [0090.443] GetLastError () returned 0x0 [0090.444] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.444] GetLastError () returned 0x0 [0090.444] GetLastError () returned 0x0 [0090.516] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffeea6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.527] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x115a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x115a, lpOverlapped=0x0) returned 1 [0090.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.528] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.528] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.528] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.528] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.528] CloseHandle (hObject=0x11c) returned 1 [0090.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0090.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.543] GetLastError () returned 0x0 [0090.543] RtlWakeConditionVariable () returned 0x0 [0090.543] GetCurrentThreadId () returned 0x998 [0090.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.543] lstrlenW (lpString=".vhd") returned 4 [0090.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.544] lstrlenW (lpString=".vhdx") returned 5 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.544] lstrlenW (lpString=".pst") returned 4 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.544] lstrlenW (lpString=".ost") returned 4 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.544] lstrlenW (lpString=".bak") returned 4 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.544] lstrlenW (lpString=".bac") returned 4 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.544] lstrlenW (lpString=".sys") returned 4 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.544] lstrlenW (lpString=".v2i") returned 4 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.544] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.546] lstrlenW (lpString=".sql") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.546] lstrlenW (lpString=".mdf") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.546] lstrlenW (lpString=".txt") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.546] lstrlenW (lpString=".dbf") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.546] lstrlenW (lpString=".ckp") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.546] lstrlenW (lpString=".dacpac") returned 7 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.546] lstrlenW (lpString=".db3") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.546] lstrlenW (lpString=".dtxs") returned 5 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.546] lstrlenW (lpString=".mdt") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.546] lstrlenW (lpString=".sdf") returned 4 [0090.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.546] lstrlenW (lpString=".MDF") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.547] lstrlenW (lpString=".DBF") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.547] lstrlenW (lpString=".DB") returned 3 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.547] lstrlenW (lpString=".db") returned 3 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.547] lstrlenW (lpString=".ndf") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.547] lstrlenW (lpString=".NDF") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.547] lstrlenW (lpString=".Mdf") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.547] lstrlenW (lpString=".dat") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.547] lstrlenW (lpString=".DAT") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.547] lstrlenW (lpString=".ldf") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.547] lstrlenW (lpString=".LDF") returned 4 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.547] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.548] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.548] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.548] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.548] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21054964077) returned 1 [0090.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4c8d810, dwHighDateTime=0x1d585b4)) [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4e58 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4e58 | out: hHeap=0x260000) returned 1 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.549] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.549] GetLastError () returned 0x0 [0090.550] GetLastError () returned 0x0 [0090.550] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.550] GetLastError () returned 0x0 [0090.550] GetLastError () returned 0x0 [0090.551] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.551] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0090.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.551] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.551] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.551] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.551] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.552] CloseHandle (hObject=0x11c) returned 1 [0090.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0090.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.554] GetLastError () returned 0x0 [0090.554] RtlWakeConditionVariable () returned 0x0 [0090.554] GetCurrentThreadId () returned 0x998 [0090.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.554] lstrlenW (lpString=".vhd") returned 4 [0090.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.554] lstrlenW (lpString=".vhdx") returned 5 [0090.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.554] lstrlenW (lpString=".pst") returned 4 [0090.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.554] lstrlenW (lpString=".ost") returned 4 [0090.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.554] lstrlenW (lpString=".bak") returned 4 [0090.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.554] lstrlenW (lpString=".bac") returned 4 [0090.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.555] lstrlenW (lpString=".sys") returned 4 [0090.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.555] lstrlenW (lpString=".v2i") returned 4 [0090.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.555] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.556] lstrlenW (lpString=".sql") returned 4 [0090.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.556] lstrlenW (lpString=".mdf") returned 4 [0090.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.556] lstrlenW (lpString=".txt") returned 4 [0090.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.556] lstrlenW (lpString=".dbf") returned 4 [0090.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.556] lstrlenW (lpString=".ckp") returned 4 [0090.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.556] lstrlenW (lpString=".dacpac") returned 7 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.557] lstrlenW (lpString=".db3") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.557] lstrlenW (lpString=".dtxs") returned 5 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.557] lstrlenW (lpString=".mdt") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.557] lstrlenW (lpString=".sdf") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.557] lstrlenW (lpString=".MDF") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.557] lstrlenW (lpString=".DBF") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.557] lstrlenW (lpString=".DB") returned 3 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.557] lstrlenW (lpString=".db") returned 3 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.557] lstrlenW (lpString=".ndf") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.557] lstrlenW (lpString=".NDF") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.557] lstrlenW (lpString=".Mdf") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.557] lstrlenW (lpString=".dat") returned 4 [0090.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.558] lstrlenW (lpString=".DAT") returned 4 [0090.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.558] lstrlenW (lpString=".ldf") returned 4 [0090.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.558] lstrlenW (lpString=".LDF") returned 4 [0090.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.558] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.558] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.559] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.559] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21056004411) returned 1 [0090.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4cb3970, dwHighDateTime=0x1d585b4)) [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4e90 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4e90 | out: hHeap=0x260000) returned 1 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.560] GetLastError () returned 0x0 [0090.560] GetLastError () returned 0x0 [0090.560] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.560] GetLastError () returned 0x0 [0090.560] GetLastError () returned 0x0 [0090.561] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.561] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0090.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.562] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.562] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.562] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.562] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.562] CloseHandle (hObject=0x11c) returned 1 [0090.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0090.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.564] GetLastError () returned 0x0 [0090.564] RtlWakeConditionVariable () returned 0x0 [0090.564] GetCurrentThreadId () returned 0x998 [0090.609] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.609] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.609] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.609] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.611] CloseHandle (hObject=0xf0) returned 1 [0090.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a990 | out: hHeap=0x260000) returned 1 [0090.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.611] RtlWakeConditionVariable () returned 0x0 [0090.611] GetCurrentThreadId () returned 0x998 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".ldf") returned 0x0 [0090.612] lstrlenW (lpString=".vhd") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".vhd") returned 0x0 [0090.612] lstrlenW (lpString=".vhdx") returned 5 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".vhdx") returned 0x0 [0090.612] lstrlenW (lpString=".pst") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".pst") returned 0x0 [0090.612] lstrlenW (lpString=".ost") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".ost") returned 0x0 [0090.612] lstrlenW (lpString=".bak") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".bak") returned 0x0 [0090.612] lstrlenW (lpString=".bac") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".bac") returned 0x0 [0090.612] lstrlenW (lpString=".sys") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".sys") returned 0x0 [0090.612] lstrlenW (lpString=".v2i") returned 4 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".v2i") returned 0x0 [0090.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.613] lstrlenW (lpString=".sql") returned 4 [0090.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".sql") returned 0x0 [0090.614] lstrlenW (lpString=".mdf") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".mdf") returned 0x0 [0090.614] lstrlenW (lpString=".txt") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".txt") returned 0x0 [0090.614] lstrlenW (lpString=".dbf") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".dbf") returned 0x0 [0090.614] lstrlenW (lpString=".ckp") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".ckp") returned 0x0 [0090.614] lstrlenW (lpString=".dacpac") returned 7 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".dacpac") returned 0x0 [0090.614] lstrlenW (lpString=".db3") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".db3") returned 0x0 [0090.614] lstrlenW (lpString=".dtxs") returned 5 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".dtxs") returned 0x0 [0090.614] lstrlenW (lpString=".mdt") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".mdt") returned 0x0 [0090.614] lstrlenW (lpString=".sdf") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".sdf") returned 0x0 [0090.614] lstrlenW (lpString=".MDF") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".MDF") returned 0x0 [0090.614] lstrlenW (lpString=".DBF") returned 4 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".DBF") returned 0x0 [0090.614] lstrlenW (lpString=".DB") returned 3 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".DB") returned 0x0 [0090.614] lstrlenW (lpString=".db") returned 3 [0090.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".db") returned 0x0 [0090.615] lstrlenW (lpString=".ndf") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".ndf") returned 0x0 [0090.615] lstrlenW (lpString=".NDF") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".NDF") returned 0x0 [0090.615] lstrlenW (lpString=".Mdf") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".Mdf") returned 0x0 [0090.615] lstrlenW (lpString=".dat") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".dat") returned 0x0 [0090.615] lstrlenW (lpString=".DAT") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".DAT") returned 0x0 [0090.615] lstrlenW (lpString=".ldf") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".ldf") returned 0x0 [0090.615] lstrlenW (lpString=".LDF") returned 4 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch=".LDF") returned 0x0 [0090.615] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.615] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.616] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.616] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21061737193) returned 1 [0090.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4d25d90, dwHighDateTime=0x1d585b4)) [0090.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5050 [0090.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5050 | out: hHeap=0x260000) returned 1 [0090.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.617] GetLastError () returned 0x0 [0090.617] GetLastError () returned 0x0 [0090.618] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.618] GetLastError () returned 0x0 [0090.618] GetLastError () returned 0x0 [0090.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeff3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.680] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x100d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x100d, lpOverlapped=0x0) returned 1 [0090.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.680] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.681] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.681] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.681] CloseHandle (hObject=0xf0) returned 1 [0090.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css.[deadmin@cock.li].deadmin")) returned 1 [0090.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.687] GetLastError () returned 0x0 [0090.688] RtlWakeConditionVariable () returned 0x0 [0090.688] GetCurrentThreadId () returned 0x998 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.688] lstrlenW (lpString=".vhd") returned 4 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.688] lstrlenW (lpString=".vhdx") returned 5 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.688] lstrlenW (lpString=".pst") returned 4 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.688] lstrlenW (lpString=".ost") returned 4 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.688] lstrlenW (lpString=".bak") returned 4 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.688] lstrlenW (lpString=".bac") returned 4 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.688] lstrlenW (lpString=".sys") returned 4 [0090.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.689] lstrlenW (lpString=".v2i") returned 4 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.689] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.812] lstrlenW (lpString=".sql") returned 4 [0090.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.812] lstrlenW (lpString=".mdf") returned 4 [0090.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.812] lstrlenW (lpString=".txt") returned 4 [0090.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.812] lstrlenW (lpString=".dbf") returned 4 [0090.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.812] lstrlenW (lpString=".ckp") returned 4 [0090.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.812] lstrlenW (lpString=".dacpac") returned 7 [0090.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.812] lstrlenW (lpString=".db3") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.813] lstrlenW (lpString=".dtxs") returned 5 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.813] lstrlenW (lpString=".mdt") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.813] lstrlenW (lpString=".sdf") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.813] lstrlenW (lpString=".MDF") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.813] lstrlenW (lpString=".DBF") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.813] lstrlenW (lpString=".DB") returned 3 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.813] lstrlenW (lpString=".db") returned 3 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.813] lstrlenW (lpString=".ndf") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.813] lstrlenW (lpString=".NDF") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.813] lstrlenW (lpString=".Mdf") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.813] lstrlenW (lpString=".dat") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.813] lstrlenW (lpString=".DAT") returned 4 [0090.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.814] lstrlenW (lpString=".ldf") returned 4 [0090.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.814] lstrlenW (lpString=".LDF") returned 4 [0090.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.814] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0090.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.814] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.815] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.815] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.815] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21081592016) returned 1 [0090.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4f14f70, dwHighDateTime=0x1d585b4)) [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5408 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5408 | out: hHeap=0x260000) returned 1 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.815] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.816] GetLastError () returned 0x0 [0090.816] GetLastError () returned 0x0 [0090.816] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.816] GetLastError () returned 0x0 [0090.816] GetLastError () returned 0x0 [0090.817] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.817] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0090.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.818] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.818] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.818] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.818] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.818] CloseHandle (hObject=0xd8) returned 1 [0090.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0090.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922098 | out: hHeap=0x260000) returned 1 [0090.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.820] GetLastError () returned 0x0 [0090.820] RtlWakeConditionVariable () returned 0x0 [0090.820] GetCurrentThreadId () returned 0x998 [0090.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.820] lstrlenW (lpString=".vhd") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0090.821] lstrlenW (lpString=".vhdx") returned 5 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0090.821] lstrlenW (lpString=".pst") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0090.821] lstrlenW (lpString=".ost") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0090.821] lstrlenW (lpString=".bak") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0090.821] lstrlenW (lpString=".bac") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0090.821] lstrlenW (lpString=".sys") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0090.821] lstrlenW (lpString=".v2i") returned 4 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0090.821] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.825] lstrlenW (lpString=".sql") returned 4 [0090.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0090.825] lstrlenW (lpString=".mdf") returned 4 [0090.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0090.825] lstrlenW (lpString=".txt") returned 4 [0090.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0090.825] lstrlenW (lpString=".dbf") returned 4 [0090.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0090.826] lstrlenW (lpString=".ckp") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0090.826] lstrlenW (lpString=".dacpac") returned 7 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0090.826] lstrlenW (lpString=".db3") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0090.826] lstrlenW (lpString=".dtxs") returned 5 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0090.826] lstrlenW (lpString=".mdt") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0090.826] lstrlenW (lpString=".sdf") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0090.826] lstrlenW (lpString=".MDF") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0090.826] lstrlenW (lpString=".DBF") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0090.826] lstrlenW (lpString=".DB") returned 3 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0090.826] lstrlenW (lpString=".db") returned 3 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".db") returned 0x0 [0090.826] lstrlenW (lpString=".ndf") returned 4 [0090.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0090.826] lstrlenW (lpString=".NDF") returned 4 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0090.827] lstrlenW (lpString=".Mdf") returned 4 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0090.827] lstrlenW (lpString=".dat") returned 4 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0090.827] lstrlenW (lpString=".DAT") returned 4 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0090.827] lstrlenW (lpString=".ldf") returned 4 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.827] lstrlenW (lpString=".LDF") returned 4 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0090.827] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0090.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.827] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0090.828] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.828] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0090.828] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21082925376) returned 1 [0090.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc4f3b0d0, dwHighDateTime=0x1d585b4)) [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5440 [0090.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5440 | out: hHeap=0x260000) returned 1 [0090.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.829] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0090.829] GetLastError () returned 0x0 [0090.829] GetLastError () returned 0x0 [0090.829] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0090.829] GetLastError () returned 0x0 [0090.830] GetLastError () returned 0x0 [0090.831] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.831] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x94, lpOverlapped=0x0) returned 1 [0090.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.831] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.831] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.831] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.831] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.831] CloseHandle (hObject=0xd8) returned 1 [0090.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.993] GetLastError () returned 0x0 [0090.993] RtlWakeConditionVariable () returned 0x0 [0091.004] GetCurrentThreadId () returned 0x998 [0091.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0091.004] lstrlenW (lpString=".vhd") returned 4 [0091.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0091.004] lstrlenW (lpString=".vhdx") returned 5 [0091.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0091.004] lstrlenW (lpString=".pst") returned 4 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0091.005] lstrlenW (lpString=".ost") returned 4 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0091.005] lstrlenW (lpString=".bak") returned 4 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0091.005] lstrlenW (lpString=".bac") returned 4 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0091.005] lstrlenW (lpString=".sys") returned 4 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0091.005] lstrlenW (lpString=".v2i") returned 4 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0091.005] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.007] lstrlenW (lpString=".sql") returned 4 [0091.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0091.007] lstrlenW (lpString=".mdf") returned 4 [0091.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0091.007] lstrlenW (lpString=".txt") returned 4 [0091.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0091.007] lstrlenW (lpString=".dbf") returned 4 [0091.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0091.007] lstrlenW (lpString=".ckp") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0091.008] lstrlenW (lpString=".dacpac") returned 7 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0091.008] lstrlenW (lpString=".db3") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0091.008] lstrlenW (lpString=".dtxs") returned 5 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0091.008] lstrlenW (lpString=".mdt") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0091.008] lstrlenW (lpString=".sdf") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0091.008] lstrlenW (lpString=".MDF") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0091.008] lstrlenW (lpString=".DBF") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0091.008] lstrlenW (lpString=".DB") returned 3 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0091.008] lstrlenW (lpString=".db") returned 3 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".db") returned 0x0 [0091.008] lstrlenW (lpString=".ndf") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0091.008] lstrlenW (lpString=".NDF") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0091.008] lstrlenW (lpString=".Mdf") returned 4 [0091.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0091.008] lstrlenW (lpString=".dat") returned 4 [0091.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0091.009] lstrlenW (lpString=".DAT") returned 4 [0091.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0091.009] lstrlenW (lpString=".ldf") returned 4 [0091.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0091.009] lstrlenW (lpString=".LDF") returned 4 [0091.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0091.009] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.009] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.010] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.010] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.010] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21101114324) returned 1 [0091.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc50ddff0, dwHighDateTime=0x1d585b4)) [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5830 [0091.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5830 | out: hHeap=0x260000) returned 1 [0091.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.011] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.011] GetLastError () returned 0x0 [0091.011] GetLastError () returned 0x0 [0091.012] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.012] GetLastError () returned 0x0 [0091.012] GetLastError () returned 0x0 [0091.014] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff794, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.015] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x86c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x86c, lpOverlapped=0x0) returned 1 [0091.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0091.015] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.015] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.015] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.015] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.015] CloseHandle (hObject=0xd8) returned 1 [0091.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.015] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.018] GetLastError () returned 0x0 [0091.018] RtlWakeConditionVariable () returned 0x0 [0091.018] GetCurrentThreadId () returned 0x998 [0091.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.018] lstrlenW (lpString=".vhd") returned 4 [0091.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0091.018] lstrlenW (lpString=".vhdx") returned 5 [0091.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0091.018] lstrlenW (lpString=".pst") returned 4 [0091.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0091.018] lstrlenW (lpString=".ost") returned 4 [0091.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0091.018] lstrlenW (lpString=".bak") returned 4 [0091.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0091.018] lstrlenW (lpString=".bac") returned 4 [0091.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0091.019] lstrlenW (lpString=".sys") returned 4 [0091.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0091.019] lstrlenW (lpString=".v2i") returned 4 [0091.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0091.019] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.021] lstrlenW (lpString=".sql") returned 4 [0091.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0091.021] lstrlenW (lpString=".mdf") returned 4 [0091.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0091.022] lstrlenW (lpString=".txt") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0091.022] lstrlenW (lpString=".dbf") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0091.022] lstrlenW (lpString=".ckp") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0091.022] lstrlenW (lpString=".dacpac") returned 7 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0091.022] lstrlenW (lpString=".db3") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0091.022] lstrlenW (lpString=".dtxs") returned 5 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0091.022] lstrlenW (lpString=".mdt") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0091.022] lstrlenW (lpString=".sdf") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0091.022] lstrlenW (lpString=".MDF") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0091.022] lstrlenW (lpString=".DBF") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0091.022] lstrlenW (lpString=".DB") returned 3 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0091.022] lstrlenW (lpString=".db") returned 3 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0091.022] lstrlenW (lpString=".ndf") returned 4 [0091.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0091.023] lstrlenW (lpString=".NDF") returned 4 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0091.023] lstrlenW (lpString=".Mdf") returned 4 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0091.023] lstrlenW (lpString=".dat") returned 4 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0091.023] lstrlenW (lpString=".DAT") returned 4 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0091.023] lstrlenW (lpString=".ldf") returned 4 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.023] lstrlenW (lpString=".LDF") returned 4 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0091.023] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.023] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.024] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.024] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21102528763) returned 1 [0091.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5104150, dwHighDateTime=0x1d585b4)) [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5868 [0091.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5868 | out: hHeap=0x260000) returned 1 [0091.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.025] GetLastError () returned 0x0 [0091.025] GetLastError () returned 0x0 [0091.025] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.025] GetLastError () returned 0x0 [0091.026] GetLastError () returned 0x0 [0091.076] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffe10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.076] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x1f0, lpOverlapped=0x0) returned 1 [0091.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0091.076] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.077] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.077] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.077] CloseHandle (hObject=0xd8) returned 1 [0091.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x345308 [0091.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x345308 | out: hHeap=0x260000) returned 1 [0091.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.258] GetLastError () returned 0x0 [0091.259] RtlWakeConditionVariable () returned 0x0 [0091.259] GetCurrentThreadId () returned 0x998 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".ldf") returned 0x0 [0091.259] lstrlenW (lpString=".vhd") returned 4 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".vhd") returned 0x0 [0091.259] lstrlenW (lpString=".vhdx") returned 5 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".vhdx") returned 0x0 [0091.259] lstrlenW (lpString=".pst") returned 4 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".pst") returned 0x0 [0091.259] lstrlenW (lpString=".ost") returned 4 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".ost") returned 0x0 [0091.259] lstrlenW (lpString=".bak") returned 4 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".bak") returned 0x0 [0091.259] lstrlenW (lpString=".bac") returned 4 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".bac") returned 0x0 [0091.259] lstrlenW (lpString=".sys") returned 4 [0091.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".sys") returned 0x0 [0091.260] lstrlenW (lpString=".v2i") returned 4 [0091.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".v2i") returned 0x0 [0091.260] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.261] lstrlenW (lpString=".sql") returned 4 [0091.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".sql") returned 0x0 [0091.261] lstrlenW (lpString=".mdf") returned 4 [0091.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".mdf") returned 0x0 [0091.261] lstrlenW (lpString=".txt") returned 4 [0091.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".txt") returned 0x0 [0091.261] lstrlenW (lpString=".dbf") returned 4 [0091.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".dbf") returned 0x0 [0091.261] lstrlenW (lpString=".ckp") returned 4 [0091.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".ckp") returned 0x0 [0091.261] lstrlenW (lpString=".dacpac") returned 7 [0091.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".dacpac") returned 0x0 [0091.261] lstrlenW (lpString=".db3") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".db3") returned 0x0 [0091.262] lstrlenW (lpString=".dtxs") returned 5 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".dtxs") returned 0x0 [0091.262] lstrlenW (lpString=".mdt") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".mdt") returned 0x0 [0091.262] lstrlenW (lpString=".sdf") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".sdf") returned 0x0 [0091.262] lstrlenW (lpString=".MDF") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".MDF") returned 0x0 [0091.262] lstrlenW (lpString=".DBF") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".DBF") returned 0x0 [0091.262] lstrlenW (lpString=".DB") returned 3 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".DB") returned 0x0 [0091.262] lstrlenW (lpString=".db") returned 3 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".db") returned 0x0 [0091.262] lstrlenW (lpString=".ndf") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".ndf") returned 0x0 [0091.262] lstrlenW (lpString=".NDF") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".NDF") returned 0x0 [0091.262] lstrlenW (lpString=".Mdf") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".Mdf") returned 0x0 [0091.262] lstrlenW (lpString=".dat") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".dat") returned 0x0 [0091.262] lstrlenW (lpString=".DAT") returned 4 [0091.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".DAT") returned 0x0 [0091.262] lstrlenW (lpString=".ldf") returned 4 [0091.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".ldf") returned 0x0 [0091.263] lstrlenW (lpString=".LDF") returned 4 [0091.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch=".LDF") returned 0x0 [0091.263] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.263] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.264] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.264] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.264] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21126493779) returned 1 [0091.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5365750, dwHighDateTime=0x1d585b4)) [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5a98 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5a98 | out: hHeap=0x260000) returned 1 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.264] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.265] GetLastError () returned 0x0 [0091.265] GetLastError () returned 0x0 [0091.265] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.265] GetLastError () returned 0x0 [0091.265] GetLastError () returned 0x0 [0091.270] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff8b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.270] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x74a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x74a, lpOverlapped=0x0) returned 1 [0091.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.270] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.270] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.271] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.271] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.271] CloseHandle (hObject=0xd8) returned 1 [0091.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css.[deadmin@cock.li].deadmin")) returned 1 [0091.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.272] GetLastError () returned 0x0 [0091.273] RtlWakeConditionVariable () returned 0x0 [0091.273] GetCurrentThreadId () returned 0x998 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.273] lstrlenW (lpString=".vhd") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0091.273] lstrlenW (lpString=".vhdx") returned 5 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0091.273] lstrlenW (lpString=".pst") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0091.273] lstrlenW (lpString=".ost") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0091.273] lstrlenW (lpString=".bak") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0091.273] lstrlenW (lpString=".bac") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0091.273] lstrlenW (lpString=".sys") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0091.273] lstrlenW (lpString=".v2i") returned 4 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0091.273] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.273] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.275] lstrlenW (lpString=".sql") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0091.275] lstrlenW (lpString=".mdf") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0091.275] lstrlenW (lpString=".txt") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0091.275] lstrlenW (lpString=".dbf") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0091.275] lstrlenW (lpString=".ckp") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0091.275] lstrlenW (lpString=".dacpac") returned 7 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0091.275] lstrlenW (lpString=".db3") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0091.275] lstrlenW (lpString=".dtxs") returned 5 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0091.275] lstrlenW (lpString=".mdt") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0091.275] lstrlenW (lpString=".sdf") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0091.275] lstrlenW (lpString=".MDF") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0091.275] lstrlenW (lpString=".DBF") returned 4 [0091.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0091.276] lstrlenW (lpString=".DB") returned 3 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0091.276] lstrlenW (lpString=".db") returned 3 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0091.276] lstrlenW (lpString=".ndf") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0091.276] lstrlenW (lpString=".NDF") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0091.276] lstrlenW (lpString=".Mdf") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0091.276] lstrlenW (lpString=".dat") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0091.276] lstrlenW (lpString=".DAT") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0091.276] lstrlenW (lpString=".ldf") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.276] lstrlenW (lpString=".LDF") returned 4 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0091.276] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.276] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.277] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.277] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.277] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21127857440) returned 1 [0091.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc538b8b0, dwHighDateTime=0x1d585b4)) [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5b08 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5b08 | out: hHeap=0x260000) returned 1 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.278] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.278] GetLastError () returned 0x0 [0091.279] GetLastError () returned 0x0 [0091.279] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.279] GetLastError () returned 0x0 [0091.279] GetLastError () returned 0x0 [0091.280] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.280] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x155, lpOverlapped=0x0) returned 1 [0091.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.280] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.280] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.280] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.280] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.281] CloseHandle (hObject=0xd8) returned 1 [0091.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0091.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.282] GetLastError () returned 0x0 [0091.283] RtlWakeConditionVariable () returned 0x27e828 [0091.283] GetCurrentThreadId () returned 0x998 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.283] lstrlenW (lpString=".vhd") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0091.283] lstrlenW (lpString=".vhdx") returned 5 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0091.283] lstrlenW (lpString=".pst") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0091.283] lstrlenW (lpString=".ost") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0091.283] lstrlenW (lpString=".bak") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0091.283] lstrlenW (lpString=".bac") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0091.283] lstrlenW (lpString=".sys") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0091.283] lstrlenW (lpString=".v2i") returned 4 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0091.283] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.285] lstrlenW (lpString=".sql") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0091.285] lstrlenW (lpString=".mdf") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0091.285] lstrlenW (lpString=".txt") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0091.285] lstrlenW (lpString=".dbf") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0091.285] lstrlenW (lpString=".ckp") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0091.285] lstrlenW (lpString=".dacpac") returned 7 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0091.285] lstrlenW (lpString=".db3") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0091.285] lstrlenW (lpString=".dtxs") returned 5 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0091.285] lstrlenW (lpString=".mdt") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0091.285] lstrlenW (lpString=".sdf") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0091.285] lstrlenW (lpString=".MDF") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0091.285] lstrlenW (lpString=".DBF") returned 4 [0091.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0091.286] lstrlenW (lpString=".DB") returned 3 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0091.286] lstrlenW (lpString=".db") returned 3 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0091.286] lstrlenW (lpString=".ndf") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0091.286] lstrlenW (lpString=".NDF") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0091.286] lstrlenW (lpString=".Mdf") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0091.286] lstrlenW (lpString=".dat") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0091.286] lstrlenW (lpString=".DAT") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0091.286] lstrlenW (lpString=".ldf") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.286] lstrlenW (lpString=".LDF") returned 4 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0091.286] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.286] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.287] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.287] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.287] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21128851307) returned 1 [0091.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc538b8b0, dwHighDateTime=0x1d585b4)) [0091.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5b40 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5b40 | out: hHeap=0x260000) returned 1 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.288] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.288] GetLastError () returned 0x0 [0091.288] GetLastError () returned 0x0 [0091.289] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.289] GetLastError () returned 0x0 [0091.289] GetLastError () returned 0x0 [0091.290] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.290] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xde, lpOverlapped=0x0) returned 1 [0091.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.290] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.290] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.290] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.291] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.291] CloseHandle (hObject=0xd8) returned 1 [0091.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0091.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.550] GetLastError () returned 0x0 [0091.550] RtlWakeConditionVariable () returned 0x0 [0091.550] GetCurrentThreadId () returned 0x998 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".ldf") returned 0x0 [0091.550] lstrlenW (lpString=".vhd") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".vhd") returned 0x0 [0091.550] lstrlenW (lpString=".vhdx") returned 5 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".vhdx") returned 0x0 [0091.550] lstrlenW (lpString=".pst") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".pst") returned 0x0 [0091.550] lstrlenW (lpString=".ost") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".ost") returned 0x0 [0091.550] lstrlenW (lpString=".bak") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".bak") returned 0x0 [0091.550] lstrlenW (lpString=".bac") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".bac") returned 0x0 [0091.550] lstrlenW (lpString=".sys") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".sys") returned 0x0 [0091.550] lstrlenW (lpString=".v2i") returned 4 [0091.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".v2i") returned 0x0 [0091.550] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.552] lstrlenW (lpString=".sql") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".sql") returned 0x0 [0091.552] lstrlenW (lpString=".mdf") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".mdf") returned 0x0 [0091.552] lstrlenW (lpString=".txt") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".txt") returned 0x0 [0091.552] lstrlenW (lpString=".dbf") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".dbf") returned 0x0 [0091.552] lstrlenW (lpString=".ckp") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".ckp") returned 0x0 [0091.552] lstrlenW (lpString=".dacpac") returned 7 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".dacpac") returned 0x0 [0091.552] lstrlenW (lpString=".db3") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".db3") returned 0x0 [0091.552] lstrlenW (lpString=".dtxs") returned 5 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".dtxs") returned 0x0 [0091.552] lstrlenW (lpString=".mdt") returned 4 [0091.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".mdt") returned 0x0 [0091.552] lstrlenW (lpString=".sdf") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".sdf") returned 0x0 [0091.553] lstrlenW (lpString=".MDF") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".MDF") returned 0x0 [0091.553] lstrlenW (lpString=".DBF") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".DBF") returned 0x0 [0091.553] lstrlenW (lpString=".DB") returned 3 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".DB") returned 0x0 [0091.553] lstrlenW (lpString=".db") returned 3 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".db") returned 0x0 [0091.553] lstrlenW (lpString=".ndf") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".ndf") returned 0x0 [0091.553] lstrlenW (lpString=".NDF") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".NDF") returned 0x0 [0091.553] lstrlenW (lpString=".Mdf") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".Mdf") returned 0x0 [0091.553] lstrlenW (lpString=".dat") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".dat") returned 0x0 [0091.553] lstrlenW (lpString=".DAT") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".DAT") returned 0x0 [0091.553] lstrlenW (lpString=".ldf") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".ldf") returned 0x0 [0091.553] lstrlenW (lpString=".LDF") returned 4 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch=".LDF") returned 0x0 [0091.553] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.554] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.554] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.554] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.555] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21155571108) returned 1 [0091.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5613010, dwHighDateTime=0x1d585b4)) [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5d00 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5d00 | out: hHeap=0x260000) returned 1 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.555] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.555] GetLastError () returned 0x0 [0091.556] GetLastError () returned 0x0 [0091.556] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.556] GetLastError () returned 0x0 [0091.556] GetLastError () returned 0x0 [0091.568] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff523, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.568] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xadd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xadd, lpOverlapped=0x0) returned 1 [0091.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.568] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.568] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.568] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.568] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.569] CloseHandle (hObject=0xd8) returned 1 [0091.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35af08 [0091.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css.[deadmin@cock.li].deadmin")) returned 1 [0091.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35af08 | out: hHeap=0x260000) returned 1 [0091.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.570] GetLastError () returned 0x0 [0091.570] RtlWakeConditionVariable () returned 0x0 [0091.570] GetCurrentThreadId () returned 0x998 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0091.571] lstrlenW (lpString=".vhd") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0091.571] lstrlenW (lpString=".vhdx") returned 5 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0091.571] lstrlenW (lpString=".pst") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0091.571] lstrlenW (lpString=".ost") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0091.571] lstrlenW (lpString=".bak") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0091.571] lstrlenW (lpString=".bac") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0091.571] lstrlenW (lpString=".sys") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0091.571] lstrlenW (lpString=".v2i") returned 4 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0091.571] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0091.573] lstrlenW (lpString=".sql") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0091.573] lstrlenW (lpString=".mdf") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0091.573] lstrlenW (lpString=".txt") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0091.573] lstrlenW (lpString=".dbf") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0091.573] lstrlenW (lpString=".ckp") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0091.573] lstrlenW (lpString=".dacpac") returned 7 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0091.573] lstrlenW (lpString=".db3") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0091.573] lstrlenW (lpString=".dtxs") returned 5 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0091.573] lstrlenW (lpString=".mdt") returned 4 [0091.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0091.574] lstrlenW (lpString=".sdf") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0091.574] lstrlenW (lpString=".MDF") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0091.574] lstrlenW (lpString=".DBF") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0091.574] lstrlenW (lpString=".DB") returned 3 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0091.574] lstrlenW (lpString=".db") returned 3 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".db") returned 0x0 [0091.574] lstrlenW (lpString=".ndf") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0091.574] lstrlenW (lpString=".NDF") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0091.574] lstrlenW (lpString=".Mdf") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0091.574] lstrlenW (lpString=".dat") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0091.574] lstrlenW (lpString=".DAT") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0091.574] lstrlenW (lpString=".ldf") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0091.574] lstrlenW (lpString=".LDF") returned 4 [0091.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0091.574] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.575] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.575] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.575] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.576] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21157675344) returned 1 [0091.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc565f2d0, dwHighDateTime=0x1d585b4)) [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5d70 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5d70 | out: hHeap=0x260000) returned 1 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.576] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.576] GetLastError () returned 0x0 [0091.577] GetLastError () returned 0x0 [0091.577] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.577] GetLastError () returned 0x0 [0091.577] GetLastError () returned 0x0 [0091.590] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff343, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.590] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcbd, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xcbd, lpOverlapped=0x0) returned 1 [0091.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.590] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.591] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.591] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.591] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.591] CloseHandle (hObject=0xd8) returned 1 [0091.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.691] GetLastError () returned 0x0 [0091.691] RtlWakeConditionVariable () returned 0x0 [0091.691] GetCurrentThreadId () returned 0x998 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".ldf") returned 0x0 [0091.692] lstrlenW (lpString=".vhd") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".vhd") returned 0x0 [0091.692] lstrlenW (lpString=".vhdx") returned 5 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".vhdx") returned 0x0 [0091.692] lstrlenW (lpString=".pst") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".pst") returned 0x0 [0091.692] lstrlenW (lpString=".ost") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".ost") returned 0x0 [0091.692] lstrlenW (lpString=".bak") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".bak") returned 0x0 [0091.692] lstrlenW (lpString=".bac") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".bac") returned 0x0 [0091.692] lstrlenW (lpString=".sys") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".sys") returned 0x0 [0091.692] lstrlenW (lpString=".v2i") returned 4 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".v2i") returned 0x0 [0091.692] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.694] lstrlenW (lpString=".sql") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".sql") returned 0x0 [0091.694] lstrlenW (lpString=".mdf") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".mdf") returned 0x0 [0091.694] lstrlenW (lpString=".txt") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".txt") returned 0x0 [0091.694] lstrlenW (lpString=".dbf") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".dbf") returned 0x0 [0091.694] lstrlenW (lpString=".ckp") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".ckp") returned 0x0 [0091.694] lstrlenW (lpString=".dacpac") returned 7 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".dacpac") returned 0x0 [0091.694] lstrlenW (lpString=".db3") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".db3") returned 0x0 [0091.694] lstrlenW (lpString=".dtxs") returned 5 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".dtxs") returned 0x0 [0091.694] lstrlenW (lpString=".mdt") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".mdt") returned 0x0 [0091.694] lstrlenW (lpString=".sdf") returned 4 [0091.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".sdf") returned 0x0 [0091.695] lstrlenW (lpString=".MDF") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".MDF") returned 0x0 [0091.695] lstrlenW (lpString=".DBF") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".DBF") returned 0x0 [0091.695] lstrlenW (lpString=".DB") returned 3 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".DB") returned 0x0 [0091.695] lstrlenW (lpString=".db") returned 3 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".db") returned 0x0 [0091.695] lstrlenW (lpString=".ndf") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".ndf") returned 0x0 [0091.695] lstrlenW (lpString=".NDF") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".NDF") returned 0x0 [0091.695] lstrlenW (lpString=".Mdf") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".Mdf") returned 0x0 [0091.695] lstrlenW (lpString=".dat") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".dat") returned 0x0 [0091.695] lstrlenW (lpString=".DAT") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".DAT") returned 0x0 [0091.695] lstrlenW (lpString=".ldf") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".ldf") returned 0x0 [0091.695] lstrlenW (lpString=".LDF") returned 4 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch=".LDF") returned 0x0 [0091.695] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.696] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.696] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.696] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.697] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21169767663) returned 1 [0091.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5769c70, dwHighDateTime=0x1d585b4)) [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6010 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6010 | out: hHeap=0x260000) returned 1 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.698] GetLastError () returned 0x0 [0091.698] GetLastError () returned 0x0 [0091.698] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.698] GetLastError () returned 0x0 [0091.698] GetLastError () returned 0x0 [0091.805] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.806] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x739, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x739, lpOverlapped=0x0) returned 1 [0091.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0091.806] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.806] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.806] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.806] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.806] CloseHandle (hObject=0x11c) returned 1 [0091.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.806] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css.[deadmin@cock.li].deadmin")) returned 1 [0091.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.854] GetLastError () returned 0x0 [0091.854] RtlWakeConditionVariable () returned 0x0 [0091.854] GetCurrentThreadId () returned 0x998 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".ldf") returned 0x0 [0091.854] lstrlenW (lpString=".vhd") returned 4 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".vhd") returned 0x0 [0091.854] lstrlenW (lpString=".vhdx") returned 5 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".vhdx") returned 0x0 [0091.854] lstrlenW (lpString=".pst") returned 4 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".pst") returned 0x0 [0091.854] lstrlenW (lpString=".ost") returned 4 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".ost") returned 0x0 [0091.854] lstrlenW (lpString=".bak") returned 4 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".bak") returned 0x0 [0091.854] lstrlenW (lpString=".bac") returned 4 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".bac") returned 0x0 [0091.854] lstrlenW (lpString=".sys") returned 4 [0091.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".sys") returned 0x0 [0091.855] lstrlenW (lpString=".v2i") returned 4 [0091.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".v2i") returned 0x0 [0091.855] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.856] lstrlenW (lpString=".sql") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".sql") returned 0x0 [0091.856] lstrlenW (lpString=".mdf") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".mdf") returned 0x0 [0091.856] lstrlenW (lpString=".txt") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".txt") returned 0x0 [0091.856] lstrlenW (lpString=".dbf") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".dbf") returned 0x0 [0091.856] lstrlenW (lpString=".ckp") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".ckp") returned 0x0 [0091.856] lstrlenW (lpString=".dacpac") returned 7 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".dacpac") returned 0x0 [0091.856] lstrlenW (lpString=".db3") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".db3") returned 0x0 [0091.856] lstrlenW (lpString=".dtxs") returned 5 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".dtxs") returned 0x0 [0091.856] lstrlenW (lpString=".mdt") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".mdt") returned 0x0 [0091.856] lstrlenW (lpString=".sdf") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".sdf") returned 0x0 [0091.856] lstrlenW (lpString=".MDF") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".MDF") returned 0x0 [0091.856] lstrlenW (lpString=".DBF") returned 4 [0091.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".DBF") returned 0x0 [0091.857] lstrlenW (lpString=".DB") returned 3 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".DB") returned 0x0 [0091.857] lstrlenW (lpString=".db") returned 3 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".db") returned 0x0 [0091.857] lstrlenW (lpString=".ndf") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".ndf") returned 0x0 [0091.857] lstrlenW (lpString=".NDF") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".NDF") returned 0x0 [0091.857] lstrlenW (lpString=".Mdf") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".Mdf") returned 0x0 [0091.857] lstrlenW (lpString=".dat") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".dat") returned 0x0 [0091.857] lstrlenW (lpString=".DAT") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".DAT") returned 0x0 [0091.857] lstrlenW (lpString=".ldf") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".ldf") returned 0x0 [0091.857] lstrlenW (lpString=".LDF") returned 4 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch=".LDF") returned 0x0 [0091.857] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.857] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.858] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.858] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21185949245) returned 1 [0091.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc590cb90, dwHighDateTime=0x1d585b4)) [0091.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6358 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6358 | out: hHeap=0x260000) returned 1 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.859] GetLastError () returned 0x0 [0091.859] GetLastError () returned 0x0 [0091.859] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.860] GetLastError () returned 0x0 [0091.860] GetLastError () returned 0x0 [0091.861] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.861] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x366, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x366, lpOverlapped=0x0) returned 1 [0091.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.861] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.862] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.862] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.862] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.862] CloseHandle (hObject=0x11c) returned 1 [0091.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0091.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0091.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.863] GetLastError () returned 0x0 [0091.863] RtlWakeConditionVariable () returned 0x0 [0091.863] GetCurrentThreadId () returned 0x998 [0091.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".ldf") returned 0x0 [0091.864] lstrlenW (lpString=".vhd") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".vhd") returned 0x0 [0091.864] lstrlenW (lpString=".vhdx") returned 5 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".vhdx") returned 0x0 [0091.864] lstrlenW (lpString=".pst") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".pst") returned 0x0 [0091.864] lstrlenW (lpString=".ost") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".ost") returned 0x0 [0091.864] lstrlenW (lpString=".bak") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".bak") returned 0x0 [0091.864] lstrlenW (lpString=".bac") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".bac") returned 0x0 [0091.864] lstrlenW (lpString=".sys") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".sys") returned 0x0 [0091.864] lstrlenW (lpString=".v2i") returned 4 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".v2i") returned 0x0 [0091.864] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.865] lstrlenW (lpString=".sql") returned 4 [0091.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".sql") returned 0x0 [0091.865] lstrlenW (lpString=".mdf") returned 4 [0091.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".mdf") returned 0x0 [0091.865] lstrlenW (lpString=".txt") returned 4 [0091.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".txt") returned 0x0 [0091.865] lstrlenW (lpString=".dbf") returned 4 [0091.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".dbf") returned 0x0 [0091.865] lstrlenW (lpString=".ckp") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".ckp") returned 0x0 [0091.866] lstrlenW (lpString=".dacpac") returned 7 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".dacpac") returned 0x0 [0091.866] lstrlenW (lpString=".db3") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".db3") returned 0x0 [0091.866] lstrlenW (lpString=".dtxs") returned 5 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".dtxs") returned 0x0 [0091.866] lstrlenW (lpString=".mdt") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".mdt") returned 0x0 [0091.866] lstrlenW (lpString=".sdf") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".sdf") returned 0x0 [0091.866] lstrlenW (lpString=".MDF") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".MDF") returned 0x0 [0091.866] lstrlenW (lpString=".DBF") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".DBF") returned 0x0 [0091.866] lstrlenW (lpString=".DB") returned 3 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".DB") returned 0x0 [0091.866] lstrlenW (lpString=".db") returned 3 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".db") returned 0x0 [0091.866] lstrlenW (lpString=".ndf") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".ndf") returned 0x0 [0091.866] lstrlenW (lpString=".NDF") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".NDF") returned 0x0 [0091.866] lstrlenW (lpString=".Mdf") returned 4 [0091.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".Mdf") returned 0x0 [0091.866] lstrlenW (lpString=".dat") returned 4 [0091.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".dat") returned 0x0 [0091.867] lstrlenW (lpString=".DAT") returned 4 [0091.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".DAT") returned 0x0 [0091.867] lstrlenW (lpString=".ldf") returned 4 [0091.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".ldf") returned 0x0 [0091.867] lstrlenW (lpString=".LDF") returned 4 [0091.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch=".LDF") returned 0x0 [0091.867] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.867] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.868] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.868] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.868] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21186903889) returned 1 [0091.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc590cb90, dwHighDateTime=0x1d585b4)) [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6390 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6390 | out: hHeap=0x260000) returned 1 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.869] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.869] GetLastError () returned 0x0 [0091.869] GetLastError () returned 0x0 [0091.869] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.869] GetLastError () returned 0x0 [0091.869] GetLastError () returned 0x0 [0091.871] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.871] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x365, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x365, lpOverlapped=0x0) returned 1 [0091.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.871] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.871] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.872] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.872] CloseHandle (hObject=0x11c) returned 1 [0091.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.872] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0091.874] GetLastError () returned 0x0 [0091.874] RtlWakeConditionVariable () returned 0x0 [0091.874] GetCurrentThreadId () returned 0x998 [0091.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".ldf") returned 0x0 [0091.874] lstrlenW (lpString=".vhd") returned 4 [0091.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".vhd") returned 0x0 [0091.874] lstrlenW (lpString=".vhdx") returned 5 [0091.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".vhdx") returned 0x0 [0091.874] lstrlenW (lpString=".pst") returned 4 [0091.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".pst") returned 0x0 [0091.874] lstrlenW (lpString=".ost") returned 4 [0091.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".ost") returned 0x0 [0091.874] lstrlenW (lpString=".bak") returned 4 [0091.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".bak") returned 0x0 [0091.874] lstrlenW (lpString=".bac") returned 4 [0091.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".bac") returned 0x0 [0091.875] lstrlenW (lpString=".sys") returned 4 [0091.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".sys") returned 0x0 [0091.875] lstrlenW (lpString=".v2i") returned 4 [0091.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".v2i") returned 0x0 [0091.875] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0091.876] lstrlenW (lpString=".sql") returned 4 [0091.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".sql") returned 0x0 [0091.876] lstrlenW (lpString=".mdf") returned 4 [0091.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".mdf") returned 0x0 [0091.876] lstrlenW (lpString=".txt") returned 4 [0091.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".txt") returned 0x0 [0091.876] lstrlenW (lpString=".dbf") returned 4 [0091.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".dbf") returned 0x0 [0091.876] lstrlenW (lpString=".ckp") returned 4 [0091.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".ckp") returned 0x0 [0091.877] lstrlenW (lpString=".dacpac") returned 7 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".dacpac") returned 0x0 [0091.877] lstrlenW (lpString=".db3") returned 4 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".db3") returned 0x0 [0091.877] lstrlenW (lpString=".dtxs") returned 5 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".dtxs") returned 0x0 [0091.877] lstrlenW (lpString=".mdt") returned 4 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".mdt") returned 0x0 [0091.877] lstrlenW (lpString=".sdf") returned 4 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".sdf") returned 0x0 [0091.877] lstrlenW (lpString=".MDF") returned 4 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".MDF") returned 0x0 [0091.877] lstrlenW (lpString=".DBF") returned 4 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".DBF") returned 0x0 [0091.877] lstrlenW (lpString=".DB") returned 3 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".DB") returned 0x0 [0091.877] lstrlenW (lpString=".db") returned 3 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".db") returned 0x0 [0091.877] lstrlenW (lpString=".ndf") returned 4 [0091.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".ndf") returned 0x0 [0091.877] lstrlenW (lpString=".NDF") returned 4 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".NDF") returned 0x0 [0091.878] lstrlenW (lpString=".Mdf") returned 4 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".Mdf") returned 0x0 [0091.878] lstrlenW (lpString=".dat") returned 4 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".dat") returned 0x0 [0091.878] lstrlenW (lpString=".DAT") returned 4 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".DAT") returned 0x0 [0091.878] lstrlenW (lpString=".ldf") returned 4 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".ldf") returned 0x0 [0091.878] lstrlenW (lpString=".LDF") returned 4 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch=".LDF") returned 0x0 [0091.878] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0091.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.878] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0091.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.879] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0091.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0091.879] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21188048489) returned 1 [0091.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5932cf0, dwHighDateTime=0x1d585b4)) [0091.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b63c8 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b63c8 | out: hHeap=0x260000) returned 1 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.880] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0091.880] GetLastError () returned 0x0 [0091.880] GetLastError () returned 0x0 [0091.881] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0091.881] GetLastError () returned 0x0 [0091.881] GetLastError () returned 0x0 [0091.882] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.882] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x34f, lpOverlapped=0x0) returned 1 [0091.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.883] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.883] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.883] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.883] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.883] CloseHandle (hObject=0x11c) returned 1 [0091.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0091.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.009] GetLastError () returned 0x0 [0092.009] RtlWakeConditionVariable () returned 0x0 [0092.010] GetCurrentThreadId () returned 0x998 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".ldf") returned 0x0 [0092.010] lstrlenW (lpString=".vhd") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".vhd") returned 0x0 [0092.010] lstrlenW (lpString=".vhdx") returned 5 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".vhdx") returned 0x0 [0092.010] lstrlenW (lpString=".pst") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".pst") returned 0x0 [0092.010] lstrlenW (lpString=".ost") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".ost") returned 0x0 [0092.010] lstrlenW (lpString=".bak") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".bak") returned 0x0 [0092.010] lstrlenW (lpString=".bac") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".bac") returned 0x0 [0092.010] lstrlenW (lpString=".sys") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".sys") returned 0x0 [0092.010] lstrlenW (lpString=".v2i") returned 4 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".v2i") returned 0x0 [0092.010] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.011] lstrlenW (lpString=".sql") returned 4 [0092.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".sql") returned 0x0 [0092.012] lstrlenW (lpString=".mdf") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".mdf") returned 0x0 [0092.012] lstrlenW (lpString=".txt") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".txt") returned 0x0 [0092.012] lstrlenW (lpString=".dbf") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".dbf") returned 0x0 [0092.012] lstrlenW (lpString=".ckp") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".ckp") returned 0x0 [0092.012] lstrlenW (lpString=".dacpac") returned 7 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".dacpac") returned 0x0 [0092.012] lstrlenW (lpString=".db3") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".db3") returned 0x0 [0092.012] lstrlenW (lpString=".dtxs") returned 5 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".dtxs") returned 0x0 [0092.012] lstrlenW (lpString=".mdt") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".mdt") returned 0x0 [0092.012] lstrlenW (lpString=".sdf") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".sdf") returned 0x0 [0092.012] lstrlenW (lpString=".MDF") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".MDF") returned 0x0 [0092.012] lstrlenW (lpString=".DBF") returned 4 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".DBF") returned 0x0 [0092.012] lstrlenW (lpString=".DB") returned 3 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".DB") returned 0x0 [0092.012] lstrlenW (lpString=".db") returned 3 [0092.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".db") returned 0x0 [0092.013] lstrlenW (lpString=".ndf") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".ndf") returned 0x0 [0092.013] lstrlenW (lpString=".NDF") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".NDF") returned 0x0 [0092.013] lstrlenW (lpString=".Mdf") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".Mdf") returned 0x0 [0092.013] lstrlenW (lpString=".dat") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".dat") returned 0x0 [0092.013] lstrlenW (lpString=".DAT") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".DAT") returned 0x0 [0092.013] lstrlenW (lpString=".ldf") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".ldf") returned 0x0 [0092.013] lstrlenW (lpString=".LDF") returned 4 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch=".LDF") returned 0x0 [0092.013] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.013] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.014] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.014] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.014] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21201535100) returned 1 [0092.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5a89950, dwHighDateTime=0x1d585b4)) [0092.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b65f8 [0092.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b65f8 | out: hHeap=0x260000) returned 1 [0092.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.015] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.015] GetLastError () returned 0x0 [0092.015] GetLastError () returned 0x0 [0092.015] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.015] GetLastError () returned 0x0 [0092.016] GetLastError () returned 0x0 [0092.017] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffca4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.017] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x35c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x35c, lpOverlapped=0x0) returned 1 [0092.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.017] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.017] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.018] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.018] CloseHandle (hObject=0x11c) returned 1 [0092.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.020] GetLastError () returned 0x0 [0092.020] RtlWakeConditionVariable () returned 0x0 [0092.020] GetCurrentThreadId () returned 0x998 [0092.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".ldf") returned 0x0 [0092.020] lstrlenW (lpString=".vhd") returned 4 [0092.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".vhd") returned 0x0 [0092.020] lstrlenW (lpString=".vhdx") returned 5 [0092.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".vhdx") returned 0x0 [0092.020] lstrlenW (lpString=".pst") returned 4 [0092.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".pst") returned 0x0 [0092.020] lstrlenW (lpString=".ost") returned 4 [0092.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".ost") returned 0x0 [0092.021] lstrlenW (lpString=".bak") returned 4 [0092.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".bak") returned 0x0 [0092.021] lstrlenW (lpString=".bac") returned 4 [0092.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".bac") returned 0x0 [0092.021] lstrlenW (lpString=".sys") returned 4 [0092.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".sys") returned 0x0 [0092.021] lstrlenW (lpString=".v2i") returned 4 [0092.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".v2i") returned 0x0 [0092.021] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.022] lstrlenW (lpString=".sql") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".sql") returned 0x0 [0092.023] lstrlenW (lpString=".mdf") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".mdf") returned 0x0 [0092.023] lstrlenW (lpString=".txt") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".txt") returned 0x0 [0092.023] lstrlenW (lpString=".dbf") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".dbf") returned 0x0 [0092.023] lstrlenW (lpString=".ckp") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".ckp") returned 0x0 [0092.023] lstrlenW (lpString=".dacpac") returned 7 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".dacpac") returned 0x0 [0092.023] lstrlenW (lpString=".db3") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".db3") returned 0x0 [0092.023] lstrlenW (lpString=".dtxs") returned 5 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".dtxs") returned 0x0 [0092.023] lstrlenW (lpString=".mdt") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".mdt") returned 0x0 [0092.023] lstrlenW (lpString=".sdf") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".sdf") returned 0x0 [0092.023] lstrlenW (lpString=".MDF") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".MDF") returned 0x0 [0092.023] lstrlenW (lpString=".DBF") returned 4 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".DBF") returned 0x0 [0092.023] lstrlenW (lpString=".DB") returned 3 [0092.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".DB") returned 0x0 [0092.023] lstrlenW (lpString=".db") returned 3 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".db") returned 0x0 [0092.024] lstrlenW (lpString=".ndf") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".ndf") returned 0x0 [0092.024] lstrlenW (lpString=".NDF") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".NDF") returned 0x0 [0092.024] lstrlenW (lpString=".Mdf") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".Mdf") returned 0x0 [0092.024] lstrlenW (lpString=".dat") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".dat") returned 0x0 [0092.024] lstrlenW (lpString=".DAT") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".DAT") returned 0x0 [0092.024] lstrlenW (lpString=".ldf") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".ldf") returned 0x0 [0092.024] lstrlenW (lpString=".LDF") returned 4 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch=".LDF") returned 0x0 [0092.024] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.024] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.025] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.025] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.025] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21202641495) returned 1 [0092.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5aafab0, dwHighDateTime=0x1d585b4)) [0092.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6630 [0092.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6630 | out: hHeap=0x260000) returned 1 [0092.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.026] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.026] GetLastError () returned 0x0 [0092.026] GetLastError () returned 0x0 [0092.026] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.027] GetLastError () returned 0x0 [0092.027] GetLastError () returned 0x0 [0092.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.028] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x267, lpOverlapped=0x0) returned 1 [0092.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.028] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.028] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.028] CloseHandle (hObject=0x11c) returned 1 [0092.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.030] GetLastError () returned 0x0 [0092.030] RtlWakeConditionVariable () returned 0x27e828 [0092.030] GetCurrentThreadId () returned 0x998 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0092.031] lstrlenW (lpString=".vhd") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".vhd") returned 0x0 [0092.031] lstrlenW (lpString=".vhdx") returned 5 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".vhdx") returned 0x0 [0092.031] lstrlenW (lpString=".pst") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".pst") returned 0x0 [0092.031] lstrlenW (lpString=".ost") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".ost") returned 0x0 [0092.031] lstrlenW (lpString=".bak") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".bak") returned 0x0 [0092.031] lstrlenW (lpString=".bac") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".bac") returned 0x0 [0092.031] lstrlenW (lpString=".sys") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".sys") returned 0x0 [0092.031] lstrlenW (lpString=".v2i") returned 4 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".v2i") returned 0x0 [0092.031] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch="s\r\n.v2i") returned 0x0 [0092.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.032] lstrlenW (lpString=".sql") returned 4 [0092.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".sql") returned 0x0 [0092.032] lstrlenW (lpString=".mdf") returned 4 [0092.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".mdf") returned 0x0 [0092.033] lstrlenW (lpString=".txt") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".txt") returned 0x0 [0092.033] lstrlenW (lpString=".dbf") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".dbf") returned 0x0 [0092.033] lstrlenW (lpString=".ckp") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".ckp") returned 0x0 [0092.033] lstrlenW (lpString=".dacpac") returned 7 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".dacpac") returned 0x0 [0092.033] lstrlenW (lpString=".db3") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".db3") returned 0x0 [0092.033] lstrlenW (lpString=".dtxs") returned 5 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".dtxs") returned 0x0 [0092.033] lstrlenW (lpString=".mdt") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".mdt") returned 0x0 [0092.033] lstrlenW (lpString=".sdf") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".sdf") returned 0x0 [0092.033] lstrlenW (lpString=".MDF") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".MDF") returned 0x0 [0092.033] lstrlenW (lpString=".DBF") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".DBF") returned 0x0 [0092.033] lstrlenW (lpString=".DB") returned 3 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".DB") returned 0x0 [0092.033] lstrlenW (lpString=".db") returned 3 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".db") returned 0x0 [0092.033] lstrlenW (lpString=".ndf") returned 4 [0092.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".ndf") returned 0x0 [0092.034] lstrlenW (lpString=".NDF") returned 4 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".NDF") returned 0x0 [0092.034] lstrlenW (lpString=".Mdf") returned 4 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".Mdf") returned 0x0 [0092.034] lstrlenW (lpString=".dat") returned 4 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".dat") returned 0x0 [0092.034] lstrlenW (lpString=".DAT") returned 4 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".DAT") returned 0x0 [0092.034] lstrlenW (lpString=".ldf") returned 4 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0092.034] lstrlenW (lpString=".LDF") returned 4 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch=".LDF") returned 0x0 [0092.034] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.034] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.035] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.035] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21203624628) returned 1 [0092.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5aafab0, dwHighDateTime=0x1d585b4)) [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6668 [0092.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6668 | out: hHeap=0x260000) returned 1 [0092.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.036] GetLastError () returned 0x0 [0092.036] GetLastError () returned 0x0 [0092.036] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.036] GetLastError () returned 0x0 [0092.036] GetLastError () returned 0x0 [0092.038] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffebcf9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.038] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x14307, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x14307, lpOverlapped=0x0) returned 1 [0092.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.039] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.039] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.039] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.039] CloseHandle (hObject=0x11c) returned 1 [0092.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js.[deadmin@cock.li].deadmin")) returned 1 [0092.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.041] GetLastError () returned 0x0 [0092.041] RtlWakeConditionVariable () returned 0x0 [0092.041] GetCurrentThreadId () returned 0x998 [0092.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0092.041] lstrlenW (lpString=".vhd") returned 4 [0092.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".vhd") returned 0x0 [0092.041] lstrlenW (lpString=".vhdx") returned 5 [0092.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".vhdx") returned 0x0 [0092.041] lstrlenW (lpString=".pst") returned 4 [0092.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".pst") returned 0x0 [0092.041] lstrlenW (lpString=".ost") returned 4 [0092.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".ost") returned 0x0 [0092.041] lstrlenW (lpString=".bak") returned 4 [0092.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".bak") returned 0x0 [0092.041] lstrlenW (lpString=".bac") returned 4 [0092.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".bac") returned 0x0 [0092.042] lstrlenW (lpString=".sys") returned 4 [0092.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".sys") returned 0x0 [0092.042] lstrlenW (lpString=".v2i") returned 4 [0092.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".v2i") returned 0x0 [0092.042] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.043] lstrlenW (lpString=".sql") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".sql") returned 0x0 [0092.043] lstrlenW (lpString=".mdf") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".mdf") returned 0x0 [0092.043] lstrlenW (lpString=".txt") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".txt") returned 0x0 [0092.043] lstrlenW (lpString=".dbf") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".dbf") returned 0x0 [0092.043] lstrlenW (lpString=".ckp") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".ckp") returned 0x0 [0092.043] lstrlenW (lpString=".dacpac") returned 7 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".dacpac") returned 0x0 [0092.043] lstrlenW (lpString=".db3") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".db3") returned 0x0 [0092.043] lstrlenW (lpString=".dtxs") returned 5 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".dtxs") returned 0x0 [0092.043] lstrlenW (lpString=".mdt") returned 4 [0092.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".mdt") returned 0x0 [0092.043] lstrlenW (lpString=".sdf") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".sdf") returned 0x0 [0092.044] lstrlenW (lpString=".MDF") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".MDF") returned 0x0 [0092.044] lstrlenW (lpString=".DBF") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".DBF") returned 0x0 [0092.044] lstrlenW (lpString=".DB") returned 3 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".DB") returned 0x0 [0092.044] lstrlenW (lpString=".db") returned 3 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".db") returned 0x0 [0092.044] lstrlenW (lpString=".ndf") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".ndf") returned 0x0 [0092.044] lstrlenW (lpString=".NDF") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".NDF") returned 0x0 [0092.044] lstrlenW (lpString=".Mdf") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".Mdf") returned 0x0 [0092.044] lstrlenW (lpString=".dat") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".dat") returned 0x0 [0092.044] lstrlenW (lpString=".DAT") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".DAT") returned 0x0 [0092.044] lstrlenW (lpString=".ldf") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0092.044] lstrlenW (lpString=".LDF") returned 4 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch=".LDF") returned 0x0 [0092.044] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.045] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.045] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.045] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.046] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21204672060) returned 1 [0092.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5ad5c10, dwHighDateTime=0x1d585b4)) [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b66a0 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b66a0 | out: hHeap=0x260000) returned 1 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.046] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.046] GetLastError () returned 0x0 [0092.047] GetLastError () returned 0x0 [0092.047] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.047] GetLastError () returned 0x0 [0092.047] GetLastError () returned 0x0 [0092.127] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff35a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.127] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xca5a, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xca5a, lpOverlapped=0x0) returned 1 [0092.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.127] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.127] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.128] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.128] CloseHandle (hObject=0x11c) returned 1 [0092.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b250 [0092.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0092.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b250 | out: hHeap=0x260000) returned 1 [0092.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.213] GetLastError () returned 0x0 [0092.213] RtlWakeConditionVariable () returned 0x0 [0092.214] GetCurrentThreadId () returned 0x998 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".ldf") returned 0x0 [0092.214] lstrlenW (lpString=".vhd") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".vhd") returned 0x0 [0092.214] lstrlenW (lpString=".vhdx") returned 5 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".vhdx") returned 0x0 [0092.214] lstrlenW (lpString=".pst") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".pst") returned 0x0 [0092.214] lstrlenW (lpString=".ost") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".ost") returned 0x0 [0092.214] lstrlenW (lpString=".bak") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".bak") returned 0x0 [0092.214] lstrlenW (lpString=".bac") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".bac") returned 0x0 [0092.214] lstrlenW (lpString=".sys") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".sys") returned 0x0 [0092.214] lstrlenW (lpString=".v2i") returned 4 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".v2i") returned 0x0 [0092.214] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.215] lstrlenW (lpString=".sql") returned 4 [0092.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".sql") returned 0x0 [0092.215] lstrlenW (lpString=".mdf") returned 4 [0092.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".mdf") returned 0x0 [0092.216] lstrlenW (lpString=".txt") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".txt") returned 0x0 [0092.216] lstrlenW (lpString=".dbf") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".dbf") returned 0x0 [0092.216] lstrlenW (lpString=".ckp") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".ckp") returned 0x0 [0092.216] lstrlenW (lpString=".dacpac") returned 7 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".dacpac") returned 0x0 [0092.216] lstrlenW (lpString=".db3") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".db3") returned 0x0 [0092.216] lstrlenW (lpString=".dtxs") returned 5 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".dtxs") returned 0x0 [0092.216] lstrlenW (lpString=".mdt") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".mdt") returned 0x0 [0092.216] lstrlenW (lpString=".sdf") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".sdf") returned 0x0 [0092.216] lstrlenW (lpString=".MDF") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".MDF") returned 0x0 [0092.216] lstrlenW (lpString=".DBF") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".DBF") returned 0x0 [0092.216] lstrlenW (lpString=".DB") returned 3 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".DB") returned 0x0 [0092.216] lstrlenW (lpString=".db") returned 3 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".db") returned 0x0 [0092.216] lstrlenW (lpString=".ndf") returned 4 [0092.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".ndf") returned 0x0 [0092.217] lstrlenW (lpString=".NDF") returned 4 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".NDF") returned 0x0 [0092.217] lstrlenW (lpString=".Mdf") returned 4 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".Mdf") returned 0x0 [0092.217] lstrlenW (lpString=".dat") returned 4 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".dat") returned 0x0 [0092.217] lstrlenW (lpString=".DAT") returned 4 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".DAT") returned 0x0 [0092.217] lstrlenW (lpString=".ldf") returned 4 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".ldf") returned 0x0 [0092.217] lstrlenW (lpString=".LDF") returned 4 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch=".LDF") returned 0x0 [0092.217] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.217] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.218] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.218] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21221927651) returned 1 [0092.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5c78b30, dwHighDateTime=0x1d585b4)) [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6a58 [0092.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6a58 | out: hHeap=0x260000) returned 1 [0092.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.219] GetLastError () returned 0x0 [0092.219] GetLastError () returned 0x0 [0092.219] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.219] GetLastError () returned 0x0 [0092.220] GetLastError () returned 0x0 [0092.221] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff755, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.221] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x8ab, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x8ab, lpOverlapped=0x0) returned 1 [0092.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.221] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.221] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.221] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.222] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.222] CloseHandle (hObject=0x11c) returned 1 [0092.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28380a0 [0092.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0092.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28380a0 | out: hHeap=0x260000) returned 1 [0092.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.223] GetLastError () returned 0x0 [0092.223] RtlWakeConditionVariable () returned 0x0 [0092.223] GetCurrentThreadId () returned 0x998 [0092.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".ldf") returned 0x0 [0092.223] lstrlenW (lpString=".vhd") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".vhd") returned 0x0 [0092.224] lstrlenW (lpString=".vhdx") returned 5 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".vhdx") returned 0x0 [0092.224] lstrlenW (lpString=".pst") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".pst") returned 0x0 [0092.224] lstrlenW (lpString=".ost") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".ost") returned 0x0 [0092.224] lstrlenW (lpString=".bak") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".bak") returned 0x0 [0092.224] lstrlenW (lpString=".bac") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".bac") returned 0x0 [0092.224] lstrlenW (lpString=".sys") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".sys") returned 0x0 [0092.224] lstrlenW (lpString=".v2i") returned 4 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".v2i") returned 0x0 [0092.224] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.225] lstrlenW (lpString=".sql") returned 4 [0092.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".sql") returned 0x0 [0092.225] lstrlenW (lpString=".mdf") returned 4 [0092.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".mdf") returned 0x0 [0092.225] lstrlenW (lpString=".txt") returned 4 [0092.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".txt") returned 0x0 [0092.225] lstrlenW (lpString=".dbf") returned 4 [0092.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".dbf") returned 0x0 [0092.225] lstrlenW (lpString=".ckp") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".ckp") returned 0x0 [0092.226] lstrlenW (lpString=".dacpac") returned 7 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".dacpac") returned 0x0 [0092.226] lstrlenW (lpString=".db3") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".db3") returned 0x0 [0092.226] lstrlenW (lpString=".dtxs") returned 5 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".dtxs") returned 0x0 [0092.226] lstrlenW (lpString=".mdt") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".mdt") returned 0x0 [0092.226] lstrlenW (lpString=".sdf") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".sdf") returned 0x0 [0092.226] lstrlenW (lpString=".MDF") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".MDF") returned 0x0 [0092.226] lstrlenW (lpString=".DBF") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".DBF") returned 0x0 [0092.226] lstrlenW (lpString=".DB") returned 3 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".DB") returned 0x0 [0092.226] lstrlenW (lpString=".db") returned 3 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".db") returned 0x0 [0092.226] lstrlenW (lpString=".ndf") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".ndf") returned 0x0 [0092.226] lstrlenW (lpString=".NDF") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".NDF") returned 0x0 [0092.226] lstrlenW (lpString=".Mdf") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".Mdf") returned 0x0 [0092.226] lstrlenW (lpString=".dat") returned 4 [0092.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".dat") returned 0x0 [0092.227] lstrlenW (lpString=".DAT") returned 4 [0092.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".DAT") returned 0x0 [0092.227] lstrlenW (lpString=".ldf") returned 4 [0092.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".ldf") returned 0x0 [0092.227] lstrlenW (lpString=".LDF") returned 4 [0092.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch=".LDF") returned 0x0 [0092.227] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.227] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.228] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.228] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.228] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21222915561) returned 1 [0092.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5c9ec90, dwHighDateTime=0x1d585b4)) [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6a90 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6a90 | out: hHeap=0x260000) returned 1 [0092.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.229] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.229] GetLastError () returned 0x0 [0092.229] GetLastError () returned 0x0 [0092.229] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.229] GetLastError () returned 0x0 [0092.229] GetLastError () returned 0x0 [0092.231] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff7a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.231] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x858, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x858, lpOverlapped=0x0) returned 1 [0092.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.231] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.231] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.232] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.232] CloseHandle (hObject=0x11c) returned 1 [0092.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28380a0 [0092.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0092.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28380a0 | out: hHeap=0x260000) returned 1 [0092.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.233] GetLastError () returned 0x0 [0092.234] RtlWakeConditionVariable () returned 0x0 [0092.234] GetCurrentThreadId () returned 0x998 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0092.234] lstrlenW (lpString=".vhd") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".vhd") returned 0x0 [0092.234] lstrlenW (lpString=".vhdx") returned 5 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".vhdx") returned 0x0 [0092.234] lstrlenW (lpString=".pst") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".pst") returned 0x0 [0092.234] lstrlenW (lpString=".ost") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".ost") returned 0x0 [0092.234] lstrlenW (lpString=".bak") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".bak") returned 0x0 [0092.234] lstrlenW (lpString=".bac") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".bac") returned 0x0 [0092.234] lstrlenW (lpString=".sys") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".sys") returned 0x0 [0092.234] lstrlenW (lpString=".v2i") returned 4 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".v2i") returned 0x0 [0092.234] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.236] lstrlenW (lpString=".sql") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".sql") returned 0x0 [0092.236] lstrlenW (lpString=".mdf") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".mdf") returned 0x0 [0092.236] lstrlenW (lpString=".txt") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".txt") returned 0x0 [0092.236] lstrlenW (lpString=".dbf") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".dbf") returned 0x0 [0092.236] lstrlenW (lpString=".ckp") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".ckp") returned 0x0 [0092.236] lstrlenW (lpString=".dacpac") returned 7 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".dacpac") returned 0x0 [0092.236] lstrlenW (lpString=".db3") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".db3") returned 0x0 [0092.236] lstrlenW (lpString=".dtxs") returned 5 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".dtxs") returned 0x0 [0092.236] lstrlenW (lpString=".mdt") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".mdt") returned 0x0 [0092.236] lstrlenW (lpString=".sdf") returned 4 [0092.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".sdf") returned 0x0 [0092.236] lstrlenW (lpString=".MDF") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".MDF") returned 0x0 [0092.237] lstrlenW (lpString=".DBF") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".DBF") returned 0x0 [0092.237] lstrlenW (lpString=".DB") returned 3 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".DB") returned 0x0 [0092.237] lstrlenW (lpString=".db") returned 3 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".db") returned 0x0 [0092.237] lstrlenW (lpString=".ndf") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".ndf") returned 0x0 [0092.237] lstrlenW (lpString=".NDF") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".NDF") returned 0x0 [0092.237] lstrlenW (lpString=".Mdf") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".Mdf") returned 0x0 [0092.237] lstrlenW (lpString=".dat") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".dat") returned 0x0 [0092.237] lstrlenW (lpString=".DAT") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".DAT") returned 0x0 [0092.237] lstrlenW (lpString=".ldf") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0092.237] lstrlenW (lpString=".LDF") returned 4 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch=".LDF") returned 0x0 [0092.237] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.238] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.238] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.239] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21223964871) returned 1 [0092.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5c9ec90, dwHighDateTime=0x1d585b4)) [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6ac8 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6ac8 | out: hHeap=0x260000) returned 1 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.239] GetLastError () returned 0x0 [0092.240] GetLastError () returned 0x0 [0092.240] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.240] GetLastError () returned 0x0 [0092.240] GetLastError () returned 0x0 [0092.243] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb901, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.243] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x46ff, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x46ff, lpOverlapped=0x0) returned 1 [0092.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.243] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.243] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.243] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.243] CloseHandle (hObject=0x11c) returned 1 [0092.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c300 [0092.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0092.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x260000) returned 1 [0092.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.245] GetLastError () returned 0x0 [0092.245] RtlWakeConditionVariable () returned 0x0 [0092.245] GetCurrentThreadId () returned 0x998 [0092.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".ldf") returned 0x0 [0092.245] lstrlenW (lpString=".vhd") returned 4 [0092.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".vhd") returned 0x0 [0092.246] lstrlenW (lpString=".vhdx") returned 5 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".vhdx") returned 0x0 [0092.246] lstrlenW (lpString=".pst") returned 4 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".pst") returned 0x0 [0092.246] lstrlenW (lpString=".ost") returned 4 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".ost") returned 0x0 [0092.246] lstrlenW (lpString=".bak") returned 4 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".bak") returned 0x0 [0092.246] lstrlenW (lpString=".bac") returned 4 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".bac") returned 0x0 [0092.246] lstrlenW (lpString=".sys") returned 4 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".sys") returned 0x0 [0092.246] lstrlenW (lpString=".v2i") returned 4 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".v2i") returned 0x0 [0092.246] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.247] lstrlenW (lpString=".sql") returned 4 [0092.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".sql") returned 0x0 [0092.247] lstrlenW (lpString=".mdf") returned 4 [0092.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".mdf") returned 0x0 [0092.247] lstrlenW (lpString=".txt") returned 4 [0092.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".txt") returned 0x0 [0092.247] lstrlenW (lpString=".dbf") returned 4 [0092.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".dbf") returned 0x0 [0092.247] lstrlenW (lpString=".ckp") returned 4 [0092.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".ckp") returned 0x0 [0092.248] lstrlenW (lpString=".dacpac") returned 7 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".dacpac") returned 0x0 [0092.248] lstrlenW (lpString=".db3") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".db3") returned 0x0 [0092.248] lstrlenW (lpString=".dtxs") returned 5 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".dtxs") returned 0x0 [0092.248] lstrlenW (lpString=".mdt") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".mdt") returned 0x0 [0092.248] lstrlenW (lpString=".sdf") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".sdf") returned 0x0 [0092.248] lstrlenW (lpString=".MDF") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".MDF") returned 0x0 [0092.248] lstrlenW (lpString=".DBF") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".DBF") returned 0x0 [0092.248] lstrlenW (lpString=".DB") returned 3 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".DB") returned 0x0 [0092.248] lstrlenW (lpString=".db") returned 3 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".db") returned 0x0 [0092.248] lstrlenW (lpString=".ndf") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".ndf") returned 0x0 [0092.248] lstrlenW (lpString=".NDF") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".NDF") returned 0x0 [0092.248] lstrlenW (lpString=".Mdf") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".Mdf") returned 0x0 [0092.248] lstrlenW (lpString=".dat") returned 4 [0092.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".dat") returned 0x0 [0092.248] lstrlenW (lpString=".DAT") returned 4 [0092.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".DAT") returned 0x0 [0092.249] lstrlenW (lpString=".ldf") returned 4 [0092.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".ldf") returned 0x0 [0092.249] lstrlenW (lpString=".LDF") returned 4 [0092.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch=".LDF") returned 0x0 [0092.249] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.249] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.250] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.250] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.250] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21225101001) returned 1 [0092.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5cc4df0, dwHighDateTime=0x1d585b4)) [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6b00 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6b00 | out: hHeap=0x260000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.251] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.251] GetLastError () returned 0x0 [0092.251] GetLastError () returned 0x0 [0092.251] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.251] GetLastError () returned 0x0 [0092.251] GetLastError () returned 0x0 [0092.336] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb8f7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.336] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4709, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x4709, lpOverlapped=0x0) returned 1 [0092.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.358] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.358] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.358] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.358] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.358] CloseHandle (hObject=0x11c) returned 1 [0092.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.[deadmin@cock.li].deadmin")) returned 1 [0092.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.359] GetLastError () returned 0x0 [0092.360] RtlWakeConditionVariable () returned 0x0 [0092.360] GetCurrentThreadId () returned 0x998 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".ldf") returned 0x0 [0092.360] lstrlenW (lpString=".vhd") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".vhd") returned 0x0 [0092.360] lstrlenW (lpString=".vhdx") returned 5 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".vhdx") returned 0x0 [0092.360] lstrlenW (lpString=".pst") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".pst") returned 0x0 [0092.360] lstrlenW (lpString=".ost") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".ost") returned 0x0 [0092.360] lstrlenW (lpString=".bak") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".bak") returned 0x0 [0092.360] lstrlenW (lpString=".bac") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".bac") returned 0x0 [0092.360] lstrlenW (lpString=".sys") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".sys") returned 0x0 [0092.360] lstrlenW (lpString=".v2i") returned 4 [0092.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".v2i") returned 0x0 [0092.361] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.361] lstrlenW (lpString=".sql") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".sql") returned 0x0 [0092.362] lstrlenW (lpString=".mdf") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".mdf") returned 0x0 [0092.362] lstrlenW (lpString=".txt") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".txt") returned 0x0 [0092.362] lstrlenW (lpString=".dbf") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".dbf") returned 0x0 [0092.362] lstrlenW (lpString=".ckp") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".ckp") returned 0x0 [0092.362] lstrlenW (lpString=".dacpac") returned 7 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".dacpac") returned 0x0 [0092.362] lstrlenW (lpString=".db3") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".db3") returned 0x0 [0092.362] lstrlenW (lpString=".dtxs") returned 5 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".dtxs") returned 0x0 [0092.362] lstrlenW (lpString=".mdt") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".mdt") returned 0x0 [0092.362] lstrlenW (lpString=".sdf") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".sdf") returned 0x0 [0092.362] lstrlenW (lpString=".MDF") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".MDF") returned 0x0 [0092.362] lstrlenW (lpString=".DBF") returned 4 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".DBF") returned 0x0 [0092.362] lstrlenW (lpString=".DB") returned 3 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".DB") returned 0x0 [0092.362] lstrlenW (lpString=".db") returned 3 [0092.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".db") returned 0x0 [0092.363] lstrlenW (lpString=".ndf") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".ndf") returned 0x0 [0092.363] lstrlenW (lpString=".NDF") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".NDF") returned 0x0 [0092.363] lstrlenW (lpString=".Mdf") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".Mdf") returned 0x0 [0092.363] lstrlenW (lpString=".dat") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".dat") returned 0x0 [0092.363] lstrlenW (lpString=".DAT") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".DAT") returned 0x0 [0092.363] lstrlenW (lpString=".ldf") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".ldf") returned 0x0 [0092.363] lstrlenW (lpString=".LDF") returned 4 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch=".LDF") returned 0x0 [0092.363] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.363] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.364] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.364] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.364] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21236527821) returned 1 [0092.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5dcf790, dwHighDateTime=0x1d585b4)) [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6d68 [0092.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6d68 | out: hHeap=0x260000) returned 1 [0092.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.365] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.365] GetLastError () returned 0x0 [0092.365] GetLastError () returned 0x0 [0092.365] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.365] GetLastError () returned 0x0 [0092.365] GetLastError () returned 0x0 [0092.367] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.367] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x34f, lpOverlapped=0x0) returned 1 [0092.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.367] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.367] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.367] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.368] CloseHandle (hObject=0x11c) returned 1 [0092.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.369] GetLastError () returned 0x0 [0092.369] RtlWakeConditionVariable () returned 0x0 [0092.369] GetCurrentThreadId () returned 0x998 [0092.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".ldf") returned 0x0 [0092.369] lstrlenW (lpString=".vhd") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".vhd") returned 0x0 [0092.370] lstrlenW (lpString=".vhdx") returned 5 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".vhdx") returned 0x0 [0092.370] lstrlenW (lpString=".pst") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".pst") returned 0x0 [0092.370] lstrlenW (lpString=".ost") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".ost") returned 0x0 [0092.370] lstrlenW (lpString=".bak") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".bak") returned 0x0 [0092.370] lstrlenW (lpString=".bac") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".bac") returned 0x0 [0092.370] lstrlenW (lpString=".sys") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".sys") returned 0x0 [0092.370] lstrlenW (lpString=".v2i") returned 4 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".v2i") returned 0x0 [0092.370] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.371] lstrlenW (lpString=".sql") returned 4 [0092.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".sql") returned 0x0 [0092.371] lstrlenW (lpString=".mdf") returned 4 [0092.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".mdf") returned 0x0 [0092.371] lstrlenW (lpString=".txt") returned 4 [0092.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".txt") returned 0x0 [0092.371] lstrlenW (lpString=".dbf") returned 4 [0092.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".dbf") returned 0x0 [0092.371] lstrlenW (lpString=".ckp") returned 4 [0092.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".ckp") returned 0x0 [0092.372] lstrlenW (lpString=".dacpac") returned 7 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".dacpac") returned 0x0 [0092.372] lstrlenW (lpString=".db3") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".db3") returned 0x0 [0092.372] lstrlenW (lpString=".dtxs") returned 5 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".dtxs") returned 0x0 [0092.372] lstrlenW (lpString=".mdt") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".mdt") returned 0x0 [0092.372] lstrlenW (lpString=".sdf") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".sdf") returned 0x0 [0092.372] lstrlenW (lpString=".MDF") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".MDF") returned 0x0 [0092.372] lstrlenW (lpString=".DBF") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".DBF") returned 0x0 [0092.372] lstrlenW (lpString=".DB") returned 3 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".DB") returned 0x0 [0092.372] lstrlenW (lpString=".db") returned 3 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".db") returned 0x0 [0092.372] lstrlenW (lpString=".ndf") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".ndf") returned 0x0 [0092.372] lstrlenW (lpString=".NDF") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".NDF") returned 0x0 [0092.372] lstrlenW (lpString=".Mdf") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".Mdf") returned 0x0 [0092.372] lstrlenW (lpString=".dat") returned 4 [0092.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".dat") returned 0x0 [0092.373] lstrlenW (lpString=".DAT") returned 4 [0092.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".DAT") returned 0x0 [0092.373] lstrlenW (lpString=".ldf") returned 4 [0092.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".ldf") returned 0x0 [0092.373] lstrlenW (lpString=".LDF") returned 4 [0092.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch=".LDF") returned 0x0 [0092.373] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.373] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.374] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.374] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.374] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21237507521) returned 1 [0092.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5df58f0, dwHighDateTime=0x1d585b4)) [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6da0 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6da0 | out: hHeap=0x260000) returned 1 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.375] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.375] GetLastError () returned 0x0 [0092.375] GetLastError () returned 0x0 [0092.375] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.375] GetLastError () returned 0x0 [0092.375] GetLastError () returned 0x0 [0092.378] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.378] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x365, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x365, lpOverlapped=0x0) returned 1 [0092.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.378] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.378] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.378] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.379] CloseHandle (hObject=0x11c) returned 1 [0092.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.381] GetLastError () returned 0x0 [0092.381] RtlWakeConditionVariable () returned 0x0 [0092.381] GetCurrentThreadId () returned 0x998 [0092.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".ldf") returned 0x0 [0092.381] lstrlenW (lpString=".vhd") returned 4 [0092.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".vhd") returned 0x0 [0092.381] lstrlenW (lpString=".vhdx") returned 5 [0092.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".vhdx") returned 0x0 [0092.381] lstrlenW (lpString=".pst") returned 4 [0092.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".pst") returned 0x0 [0092.381] lstrlenW (lpString=".ost") returned 4 [0092.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".ost") returned 0x0 [0092.381] lstrlenW (lpString=".bak") returned 4 [0092.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".bak") returned 0x0 [0092.382] lstrlenW (lpString=".bac") returned 4 [0092.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".bac") returned 0x0 [0092.382] lstrlenW (lpString=".sys") returned 4 [0092.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".sys") returned 0x0 [0092.382] lstrlenW (lpString=".v2i") returned 4 [0092.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".v2i") returned 0x0 [0092.382] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.383] lstrlenW (lpString=".sql") returned 4 [0092.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".sql") returned 0x0 [0092.383] lstrlenW (lpString=".mdf") returned 4 [0092.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".mdf") returned 0x0 [0092.384] lstrlenW (lpString=".txt") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".txt") returned 0x0 [0092.384] lstrlenW (lpString=".dbf") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".dbf") returned 0x0 [0092.384] lstrlenW (lpString=".ckp") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".ckp") returned 0x0 [0092.384] lstrlenW (lpString=".dacpac") returned 7 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".dacpac") returned 0x0 [0092.384] lstrlenW (lpString=".db3") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".db3") returned 0x0 [0092.384] lstrlenW (lpString=".dtxs") returned 5 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".dtxs") returned 0x0 [0092.384] lstrlenW (lpString=".mdt") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".mdt") returned 0x0 [0092.384] lstrlenW (lpString=".sdf") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".sdf") returned 0x0 [0092.384] lstrlenW (lpString=".MDF") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".MDF") returned 0x0 [0092.384] lstrlenW (lpString=".DBF") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".DBF") returned 0x0 [0092.384] lstrlenW (lpString=".DB") returned 3 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".DB") returned 0x0 [0092.384] lstrlenW (lpString=".db") returned 3 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".db") returned 0x0 [0092.384] lstrlenW (lpString=".ndf") returned 4 [0092.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".ndf") returned 0x0 [0092.385] lstrlenW (lpString=".NDF") returned 4 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".NDF") returned 0x0 [0092.385] lstrlenW (lpString=".Mdf") returned 4 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".Mdf") returned 0x0 [0092.385] lstrlenW (lpString=".dat") returned 4 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".dat") returned 0x0 [0092.385] lstrlenW (lpString=".DAT") returned 4 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".DAT") returned 0x0 [0092.385] lstrlenW (lpString=".ldf") returned 4 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".ldf") returned 0x0 [0092.385] lstrlenW (lpString=".LDF") returned 4 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch=".LDF") returned 0x0 [0092.385] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.385] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.386] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.386] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.386] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21238726921) returned 1 [0092.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5e1ba50, dwHighDateTime=0x1d585b4)) [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6dd8 [0092.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6dd8 | out: hHeap=0x260000) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.387] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.387] GetLastError () returned 0x0 [0092.387] GetLastError () returned 0x0 [0092.387] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.387] GetLastError () returned 0x0 [0092.387] GetLastError () returned 0x0 [0092.389] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.389] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x34f, lpOverlapped=0x0) returned 1 [0092.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.389] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.390] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.390] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.390] CloseHandle (hObject=0x11c) returned 1 [0092.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.392] GetLastError () returned 0x0 [0092.392] RtlWakeConditionVariable () returned 0x0 [0092.392] GetCurrentThreadId () returned 0x998 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".ldf") returned 0x0 [0092.392] lstrlenW (lpString=".vhd") returned 4 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".vhd") returned 0x0 [0092.392] lstrlenW (lpString=".vhdx") returned 5 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".vhdx") returned 0x0 [0092.392] lstrlenW (lpString=".pst") returned 4 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".pst") returned 0x0 [0092.392] lstrlenW (lpString=".ost") returned 4 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".ost") returned 0x0 [0092.392] lstrlenW (lpString=".bak") returned 4 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".bak") returned 0x0 [0092.392] lstrlenW (lpString=".bac") returned 4 [0092.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".bac") returned 0x0 [0092.392] lstrlenW (lpString=".sys") returned 4 [0092.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".sys") returned 0x0 [0092.393] lstrlenW (lpString=".v2i") returned 4 [0092.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".v2i") returned 0x0 [0092.393] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.394] lstrlenW (lpString=".sql") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".sql") returned 0x0 [0092.394] lstrlenW (lpString=".mdf") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".mdf") returned 0x0 [0092.394] lstrlenW (lpString=".txt") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".txt") returned 0x0 [0092.394] lstrlenW (lpString=".dbf") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".dbf") returned 0x0 [0092.394] lstrlenW (lpString=".ckp") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".ckp") returned 0x0 [0092.394] lstrlenW (lpString=".dacpac") returned 7 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".dacpac") returned 0x0 [0092.394] lstrlenW (lpString=".db3") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".db3") returned 0x0 [0092.394] lstrlenW (lpString=".dtxs") returned 5 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".dtxs") returned 0x0 [0092.394] lstrlenW (lpString=".mdt") returned 4 [0092.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".mdt") returned 0x0 [0092.394] lstrlenW (lpString=".sdf") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".sdf") returned 0x0 [0092.395] lstrlenW (lpString=".MDF") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".MDF") returned 0x0 [0092.395] lstrlenW (lpString=".DBF") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".DBF") returned 0x0 [0092.395] lstrlenW (lpString=".DB") returned 3 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".DB") returned 0x0 [0092.395] lstrlenW (lpString=".db") returned 3 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".db") returned 0x0 [0092.395] lstrlenW (lpString=".ndf") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".ndf") returned 0x0 [0092.395] lstrlenW (lpString=".NDF") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".NDF") returned 0x0 [0092.395] lstrlenW (lpString=".Mdf") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".Mdf") returned 0x0 [0092.395] lstrlenW (lpString=".dat") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".dat") returned 0x0 [0092.395] lstrlenW (lpString=".DAT") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".DAT") returned 0x0 [0092.395] lstrlenW (lpString=".ldf") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".ldf") returned 0x0 [0092.395] lstrlenW (lpString=".LDF") returned 4 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch=".LDF") returned 0x0 [0092.395] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.396] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.396] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.397] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21239771081) returned 1 [0092.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5e1ba50, dwHighDateTime=0x1d585b4)) [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6e10 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6e10 | out: hHeap=0x260000) returned 1 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.397] GetLastError () returned 0x0 [0092.398] GetLastError () returned 0x0 [0092.398] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.398] GetLastError () returned 0x0 [0092.398] GetLastError () returned 0x0 [0092.489] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffc12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.490] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x3ee, lpOverlapped=0x0) returned 1 [0092.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.490] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.490] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.490] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.490] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.490] CloseHandle (hObject=0x11c) returned 1 [0092.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.492] GetLastError () returned 0x0 [0092.492] RtlWakeConditionVariable () returned 0x0 [0092.492] GetCurrentThreadId () returned 0x998 [0092.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".ldf") returned 0x0 [0092.492] lstrlenW (lpString=".vhd") returned 4 [0092.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".vhd") returned 0x0 [0092.492] lstrlenW (lpString=".vhdx") returned 5 [0092.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".vhdx") returned 0x0 [0092.492] lstrlenW (lpString=".pst") returned 4 [0092.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".pst") returned 0x0 [0092.492] lstrlenW (lpString=".ost") returned 4 [0092.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".ost") returned 0x0 [0092.492] lstrlenW (lpString=".bak") returned 4 [0092.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".bak") returned 0x0 [0092.492] lstrlenW (lpString=".bac") returned 4 [0092.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".bac") returned 0x0 [0092.493] lstrlenW (lpString=".sys") returned 4 [0092.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".sys") returned 0x0 [0092.493] lstrlenW (lpString=".v2i") returned 4 [0092.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".v2i") returned 0x0 [0092.493] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.494] lstrlenW (lpString=".sql") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".sql") returned 0x0 [0092.494] lstrlenW (lpString=".mdf") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".mdf") returned 0x0 [0092.494] lstrlenW (lpString=".txt") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".txt") returned 0x0 [0092.494] lstrlenW (lpString=".dbf") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".dbf") returned 0x0 [0092.494] lstrlenW (lpString=".ckp") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".ckp") returned 0x0 [0092.494] lstrlenW (lpString=".dacpac") returned 7 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".dacpac") returned 0x0 [0092.494] lstrlenW (lpString=".db3") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".db3") returned 0x0 [0092.494] lstrlenW (lpString=".dtxs") returned 5 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".dtxs") returned 0x0 [0092.494] lstrlenW (lpString=".mdt") returned 4 [0092.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".mdt") returned 0x0 [0092.494] lstrlenW (lpString=".sdf") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".sdf") returned 0x0 [0092.495] lstrlenW (lpString=".MDF") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".MDF") returned 0x0 [0092.495] lstrlenW (lpString=".DBF") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".DBF") returned 0x0 [0092.495] lstrlenW (lpString=".DB") returned 3 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".DB") returned 0x0 [0092.495] lstrlenW (lpString=".db") returned 3 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".db") returned 0x0 [0092.495] lstrlenW (lpString=".ndf") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".ndf") returned 0x0 [0092.495] lstrlenW (lpString=".NDF") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".NDF") returned 0x0 [0092.495] lstrlenW (lpString=".Mdf") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".Mdf") returned 0x0 [0092.495] lstrlenW (lpString=".dat") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".dat") returned 0x0 [0092.495] lstrlenW (lpString=".DAT") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".DAT") returned 0x0 [0092.495] lstrlenW (lpString=".ldf") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".ldf") returned 0x0 [0092.495] lstrlenW (lpString=".LDF") returned 4 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch=".LDF") returned 0x0 [0092.495] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.496] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.496] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.497] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21249764473) returned 1 [0092.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5f263f0, dwHighDateTime=0x1d585b4)) [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7008 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7008 | out: hHeap=0x260000) returned 1 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.497] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.497] GetLastError () returned 0x0 [0092.498] GetLastError () returned 0x0 [0092.498] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.498] GetLastError () returned 0x0 [0092.498] GetLastError () returned 0x0 [0092.512] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8a56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.512] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x75aa, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x75aa, lpOverlapped=0x0) returned 1 [0092.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.512] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.513] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.513] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.513] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.513] CloseHandle (hObject=0x11c) returned 1 [0092.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.513] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js.[deadmin@cock.li].deadmin")) returned 1 [0092.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.514] GetLastError () returned 0x0 [0092.514] RtlWakeConditionVariable () returned 0x0 [0092.514] GetCurrentThreadId () returned 0x998 [0092.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".ldf") returned 0x0 [0092.515] lstrlenW (lpString=".vhd") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".vhd") returned 0x0 [0092.515] lstrlenW (lpString=".vhdx") returned 5 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.515] lstrlenW (lpString=".pst") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".pst") returned 0x0 [0092.515] lstrlenW (lpString=".ost") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".ost") returned 0x0 [0092.515] lstrlenW (lpString=".bak") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".bak") returned 0x0 [0092.515] lstrlenW (lpString=".bac") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".bac") returned 0x0 [0092.515] lstrlenW (lpString=".sys") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".sys") returned 0x0 [0092.515] lstrlenW (lpString=".v2i") returned 4 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".v2i") returned 0x0 [0092.515] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.516] lstrlenW (lpString=".sql") returned 4 [0092.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".sql") returned 0x0 [0092.516] lstrlenW (lpString=".mdf") returned 4 [0092.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".mdf") returned 0x0 [0092.516] lstrlenW (lpString=".txt") returned 4 [0092.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".txt") returned 0x0 [0092.516] lstrlenW (lpString=".dbf") returned 4 [0092.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".dbf") returned 0x0 [0092.516] lstrlenW (lpString=".ckp") returned 4 [0092.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".ckp") returned 0x0 [0092.517] lstrlenW (lpString=".dacpac") returned 7 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.517] lstrlenW (lpString=".db3") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".db3") returned 0x0 [0092.517] lstrlenW (lpString=".dtxs") returned 5 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.517] lstrlenW (lpString=".mdt") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".mdt") returned 0x0 [0092.517] lstrlenW (lpString=".sdf") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".sdf") returned 0x0 [0092.517] lstrlenW (lpString=".MDF") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".MDF") returned 0x0 [0092.517] lstrlenW (lpString=".DBF") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".DBF") returned 0x0 [0092.517] lstrlenW (lpString=".DB") returned 3 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".DB") returned 0x0 [0092.517] lstrlenW (lpString=".db") returned 3 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".db") returned 0x0 [0092.517] lstrlenW (lpString=".ndf") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".ndf") returned 0x0 [0092.517] lstrlenW (lpString=".NDF") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".NDF") returned 0x0 [0092.517] lstrlenW (lpString=".Mdf") returned 4 [0092.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.517] lstrlenW (lpString=".dat") returned 4 [0092.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".dat") returned 0x0 [0092.518] lstrlenW (lpString=".DAT") returned 4 [0092.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".DAT") returned 0x0 [0092.518] lstrlenW (lpString=".ldf") returned 4 [0092.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".ldf") returned 0x0 [0092.518] lstrlenW (lpString=".LDF") returned 4 [0092.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch=".LDF") returned 0x0 [0092.518] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.518] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.519] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.519] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21252009336) returned 1 [0092.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5f4c550, dwHighDateTime=0x1d585b4)) [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b70b0 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b70b0 | out: hHeap=0x260000) returned 1 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.520] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.520] GetLastError () returned 0x0 [0092.520] GetLastError () returned 0x0 [0092.520] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.520] GetLastError () returned 0x0 [0092.520] GetLastError () returned 0x0 [0092.527] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff08a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.527] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xf76, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xf76, lpOverlapped=0x0) returned 1 [0092.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.527] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.527] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.527] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.527] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.528] CloseHandle (hObject=0x11c) returned 1 [0092.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.530] GetLastError () returned 0x0 [0092.530] RtlWakeConditionVariable () returned 0x0 [0092.530] GetCurrentThreadId () returned 0x998 [0092.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.530] lstrlenW (lpString=".vhd") returned 4 [0092.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0092.530] lstrlenW (lpString=".vhdx") returned 5 [0092.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.530] lstrlenW (lpString=".pst") returned 4 [0092.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".pst") returned 0x0 [0092.530] lstrlenW (lpString=".ost") returned 4 [0092.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".ost") returned 0x0 [0092.530] lstrlenW (lpString=".bak") returned 4 [0092.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".bak") returned 0x0 [0092.530] lstrlenW (lpString=".bac") returned 4 [0092.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".bac") returned 0x0 [0092.531] lstrlenW (lpString=".sys") returned 4 [0092.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".sys") returned 0x0 [0092.531] lstrlenW (lpString=".v2i") returned 4 [0092.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0092.531] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.532] lstrlenW (lpString=".sql") returned 4 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".sql") returned 0x0 [0092.532] lstrlenW (lpString=".mdf") returned 4 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0092.532] lstrlenW (lpString=".txt") returned 4 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".txt") returned 0x0 [0092.532] lstrlenW (lpString=".dbf") returned 4 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0092.532] lstrlenW (lpString=".ckp") returned 4 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0092.532] lstrlenW (lpString=".dacpac") returned 7 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.532] lstrlenW (lpString=".db3") returned 4 [0092.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".db3") returned 0x0 [0092.533] lstrlenW (lpString=".dtxs") returned 5 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.533] lstrlenW (lpString=".mdt") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0092.533] lstrlenW (lpString=".sdf") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0092.533] lstrlenW (lpString=".MDF") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0092.533] lstrlenW (lpString=".DBF") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0092.533] lstrlenW (lpString=".DB") returned 3 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".DB") returned 0x0 [0092.533] lstrlenW (lpString=".db") returned 3 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".db") returned 0x0 [0092.533] lstrlenW (lpString=".ndf") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0092.533] lstrlenW (lpString=".NDF") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0092.533] lstrlenW (lpString=".Mdf") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.533] lstrlenW (lpString=".dat") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".dat") returned 0x0 [0092.533] lstrlenW (lpString=".DAT") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0092.533] lstrlenW (lpString=".ldf") returned 4 [0092.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.533] lstrlenW (lpString=".LDF") returned 4 [0092.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0092.534] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.534] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.534] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.535] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.535] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21253584238) returned 1 [0092.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5f726b0, dwHighDateTime=0x1d585b4)) [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7120 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7120 | out: hHeap=0x260000) returned 1 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.535] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.536] GetLastError () returned 0x0 [0092.536] GetLastError () returned 0x0 [0092.536] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.536] GetLastError () returned 0x0 [0092.536] GetLastError () returned 0x0 [0092.539] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffeeb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.539] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x114c, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x114c, lpOverlapped=0x0) returned 1 [0092.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.539] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.539] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.539] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.539] CloseHandle (hObject=0x11c) returned 1 [0092.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.541] GetLastError () returned 0x0 [0092.541] RtlWakeConditionVariable () returned 0x27e828 [0092.541] GetCurrentThreadId () returned 0x998 [0092.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".ldf") returned 0x0 [0092.541] lstrlenW (lpString=".vhd") returned 4 [0092.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".vhd") returned 0x0 [0092.541] lstrlenW (lpString=".vhdx") returned 5 [0092.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".vhdx") returned 0x0 [0092.541] lstrlenW (lpString=".pst") returned 4 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".pst") returned 0x0 [0092.542] lstrlenW (lpString=".ost") returned 4 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".ost") returned 0x0 [0092.542] lstrlenW (lpString=".bak") returned 4 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".bak") returned 0x0 [0092.542] lstrlenW (lpString=".bac") returned 4 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".bac") returned 0x0 [0092.542] lstrlenW (lpString=".sys") returned 4 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".sys") returned 0x0 [0092.542] lstrlenW (lpString=".v2i") returned 4 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".v2i") returned 0x0 [0092.542] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.543] lstrlenW (lpString=".sql") returned 4 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".sql") returned 0x0 [0092.543] lstrlenW (lpString=".mdf") returned 4 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".mdf") returned 0x0 [0092.543] lstrlenW (lpString=".txt") returned 4 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".txt") returned 0x0 [0092.543] lstrlenW (lpString=".dbf") returned 4 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".dbf") returned 0x0 [0092.543] lstrlenW (lpString=".ckp") returned 4 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".ckp") returned 0x0 [0092.543] lstrlenW (lpString=".dacpac") returned 7 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".dacpac") returned 0x0 [0092.543] lstrlenW (lpString=".db3") returned 4 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".db3") returned 0x0 [0092.543] lstrlenW (lpString=".dtxs") returned 5 [0092.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".dtxs") returned 0x0 [0092.543] lstrlenW (lpString=".mdt") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".mdt") returned 0x0 [0092.544] lstrlenW (lpString=".sdf") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".sdf") returned 0x0 [0092.544] lstrlenW (lpString=".MDF") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".MDF") returned 0x0 [0092.544] lstrlenW (lpString=".DBF") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".DBF") returned 0x0 [0092.544] lstrlenW (lpString=".DB") returned 3 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".DB") returned 0x0 [0092.544] lstrlenW (lpString=".db") returned 3 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".db") returned 0x0 [0092.544] lstrlenW (lpString=".ndf") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".ndf") returned 0x0 [0092.544] lstrlenW (lpString=".NDF") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".NDF") returned 0x0 [0092.544] lstrlenW (lpString=".Mdf") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".Mdf") returned 0x0 [0092.544] lstrlenW (lpString=".dat") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".dat") returned 0x0 [0092.544] lstrlenW (lpString=".DAT") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".DAT") returned 0x0 [0092.544] lstrlenW (lpString=".ldf") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".ldf") returned 0x0 [0092.544] lstrlenW (lpString=".LDF") returned 4 [0092.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch=".LDF") returned 0x0 [0092.544] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.545] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.545] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.546] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21254675624) returned 1 [0092.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc5f98810, dwHighDateTime=0x1d585b4)) [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7158 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7158 | out: hHeap=0x260000) returned 1 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.546] GetLastError () returned 0x0 [0092.547] GetLastError () returned 0x0 [0092.547] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.547] GetLastError () returned 0x0 [0092.547] GetLastError () returned 0x0 [0092.598] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd946, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.610] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x26ba, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x26ba, lpOverlapped=0x0) returned 1 [0092.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.622] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.633] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.633] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.633] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.634] CloseHandle (hObject=0x11c) returned 1 [0092.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.635] GetLastError () returned 0x0 [0092.635] RtlWakeConditionVariable () returned 0x0 [0092.635] GetCurrentThreadId () returned 0x998 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".ldf") returned 0x0 [0092.636] lstrlenW (lpString=".vhd") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".vhd") returned 0x0 [0092.636] lstrlenW (lpString=".vhdx") returned 5 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".vhdx") returned 0x0 [0092.636] lstrlenW (lpString=".pst") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".pst") returned 0x0 [0092.636] lstrlenW (lpString=".ost") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".ost") returned 0x0 [0092.636] lstrlenW (lpString=".bak") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".bak") returned 0x0 [0092.636] lstrlenW (lpString=".bac") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".bac") returned 0x0 [0092.636] lstrlenW (lpString=".sys") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".sys") returned 0x0 [0092.636] lstrlenW (lpString=".v2i") returned 4 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".v2i") returned 0x0 [0092.636] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch="s\r\n.v2i") returned 0x0 [0092.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.637] lstrlenW (lpString=".sql") returned 4 [0092.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".sql") returned 0x0 [0092.637] lstrlenW (lpString=".mdf") returned 4 [0092.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".mdf") returned 0x0 [0092.637] lstrlenW (lpString=".txt") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".txt") returned 0x0 [0092.638] lstrlenW (lpString=".dbf") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".dbf") returned 0x0 [0092.638] lstrlenW (lpString=".ckp") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".ckp") returned 0x0 [0092.638] lstrlenW (lpString=".dacpac") returned 7 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".dacpac") returned 0x0 [0092.638] lstrlenW (lpString=".db3") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".db3") returned 0x0 [0092.638] lstrlenW (lpString=".dtxs") returned 5 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".dtxs") returned 0x0 [0092.638] lstrlenW (lpString=".mdt") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".mdt") returned 0x0 [0092.638] lstrlenW (lpString=".sdf") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".sdf") returned 0x0 [0092.638] lstrlenW (lpString=".MDF") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".MDF") returned 0x0 [0092.638] lstrlenW (lpString=".DBF") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".DBF") returned 0x0 [0092.638] lstrlenW (lpString=".DB") returned 3 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".DB") returned 0x0 [0092.638] lstrlenW (lpString=".db") returned 3 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".db") returned 0x0 [0092.638] lstrlenW (lpString=".ndf") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".ndf") returned 0x0 [0092.638] lstrlenW (lpString=".NDF") returned 4 [0092.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".NDF") returned 0x0 [0092.639] lstrlenW (lpString=".Mdf") returned 4 [0092.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".Mdf") returned 0x0 [0092.639] lstrlenW (lpString=".dat") returned 4 [0092.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".dat") returned 0x0 [0092.639] lstrlenW (lpString=".DAT") returned 4 [0092.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".DAT") returned 0x0 [0092.639] lstrlenW (lpString=".ldf") returned 4 [0092.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".ldf") returned 0x0 [0092.639] lstrlenW (lpString=".LDF") returned 4 [0092.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch=".LDF") returned 0x0 [0092.639] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0092.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.639] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.640] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.640] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21264119517) returned 1 [0092.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc607d050, dwHighDateTime=0x1d585b4)) [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7350 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7350 | out: hHeap=0x260000) returned 1 [0092.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.641] GetLastError () returned 0x0 [0092.641] GetLastError () returned 0x0 [0092.641] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.641] GetLastError () returned 0x0 [0092.641] GetLastError () returned 0x0 [0092.643] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffea82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.643] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x157e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x157e, lpOverlapped=0x0) returned 1 [0092.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.643] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.644] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.644] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.644] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.644] CloseHandle (hObject=0x11c) returned 1 [0092.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x160) returned 0x35f418 [0092.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl.[deadmin@cock.li].deadmin")) returned 1 [0092.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35f418 | out: hHeap=0x260000) returned 1 [0092.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.646] GetLastError () returned 0x0 [0092.646] RtlWakeConditionVariable () returned 0x0 [0092.646] GetCurrentThreadId () returned 0x998 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".ldf") returned 0x0 [0092.646] lstrlenW (lpString=".vhd") returned 4 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".vhd") returned 0x0 [0092.646] lstrlenW (lpString=".vhdx") returned 5 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".vhdx") returned 0x0 [0092.646] lstrlenW (lpString=".pst") returned 4 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".pst") returned 0x0 [0092.646] lstrlenW (lpString=".ost") returned 4 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".ost") returned 0x0 [0092.646] lstrlenW (lpString=".bak") returned 4 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".bak") returned 0x0 [0092.646] lstrlenW (lpString=".bac") returned 4 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".bac") returned 0x0 [0092.646] lstrlenW (lpString=".sys") returned 4 [0092.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".sys") returned 0x0 [0092.646] lstrlenW (lpString=".v2i") returned 4 [0092.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".v2i") returned 0x0 [0092.647] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.648] lstrlenW (lpString=".sql") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".sql") returned 0x0 [0092.648] lstrlenW (lpString=".mdf") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".mdf") returned 0x0 [0092.648] lstrlenW (lpString=".txt") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".txt") returned 0x0 [0092.648] lstrlenW (lpString=".dbf") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".dbf") returned 0x0 [0092.648] lstrlenW (lpString=".ckp") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".ckp") returned 0x0 [0092.648] lstrlenW (lpString=".dacpac") returned 7 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".dacpac") returned 0x0 [0092.648] lstrlenW (lpString=".db3") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".db3") returned 0x0 [0092.648] lstrlenW (lpString=".dtxs") returned 5 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".dtxs") returned 0x0 [0092.648] lstrlenW (lpString=".mdt") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".mdt") returned 0x0 [0092.648] lstrlenW (lpString=".sdf") returned 4 [0092.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".sdf") returned 0x0 [0092.648] lstrlenW (lpString=".MDF") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".MDF") returned 0x0 [0092.649] lstrlenW (lpString=".DBF") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".DBF") returned 0x0 [0092.649] lstrlenW (lpString=".DB") returned 3 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".DB") returned 0x0 [0092.649] lstrlenW (lpString=".db") returned 3 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".db") returned 0x0 [0092.649] lstrlenW (lpString=".ndf") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".ndf") returned 0x0 [0092.649] lstrlenW (lpString=".NDF") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".NDF") returned 0x0 [0092.649] lstrlenW (lpString=".Mdf") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".Mdf") returned 0x0 [0092.649] lstrlenW (lpString=".dat") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".dat") returned 0x0 [0092.649] lstrlenW (lpString=".DAT") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".DAT") returned 0x0 [0092.649] lstrlenW (lpString=".ldf") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".ldf") returned 0x0 [0092.649] lstrlenW (lpString=".LDF") returned 4 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch=".LDF") returned 0x0 [0092.649] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.650] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.650] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.650] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.650] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21265163527) returned 1 [0092.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc60a31b0, dwHighDateTime=0x1d585b4)) [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7388 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7388 | out: hHeap=0x260000) returned 1 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.651] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.651] GetLastError () returned 0x0 [0092.652] GetLastError () returned 0x0 [0092.652] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.652] GetLastError () returned 0x0 [0092.652] GetLastError () returned 0x0 [0092.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcbb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.654] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x345, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x345, lpOverlapped=0x0) returned 1 [0092.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.654] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.654] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.654] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.654] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.654] CloseHandle (hObject=0x11c) returned 1 [0092.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x160) returned 0x2b2d80 [0092.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0092.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.656] GetLastError () returned 0x0 [0092.656] RtlWakeConditionVariable () returned 0x0 [0092.656] GetCurrentThreadId () returned 0x998 [0092.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".ldf") returned 0x0 [0092.656] lstrlenW (lpString=".vhd") returned 4 [0092.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".vhd") returned 0x0 [0092.656] lstrlenW (lpString=".vhdx") returned 5 [0092.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".vhdx") returned 0x0 [0092.656] lstrlenW (lpString=".pst") returned 4 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".pst") returned 0x0 [0092.657] lstrlenW (lpString=".ost") returned 4 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".ost") returned 0x0 [0092.657] lstrlenW (lpString=".bak") returned 4 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".bak") returned 0x0 [0092.657] lstrlenW (lpString=".bac") returned 4 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".bac") returned 0x0 [0092.657] lstrlenW (lpString=".sys") returned 4 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".sys") returned 0x0 [0092.657] lstrlenW (lpString=".v2i") returned 4 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".v2i") returned 0x0 [0092.657] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.658] lstrlenW (lpString=".sql") returned 4 [0092.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".sql") returned 0x0 [0092.658] lstrlenW (lpString=".mdf") returned 4 [0092.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".mdf") returned 0x0 [0092.658] lstrlenW (lpString=".txt") returned 4 [0092.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".txt") returned 0x0 [0092.658] lstrlenW (lpString=".dbf") returned 4 [0092.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".dbf") returned 0x0 [0092.658] lstrlenW (lpString=".ckp") returned 4 [0092.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".ckp") returned 0x0 [0092.659] lstrlenW (lpString=".dacpac") returned 7 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".dacpac") returned 0x0 [0092.659] lstrlenW (lpString=".db3") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".db3") returned 0x0 [0092.659] lstrlenW (lpString=".dtxs") returned 5 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".dtxs") returned 0x0 [0092.659] lstrlenW (lpString=".mdt") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".mdt") returned 0x0 [0092.659] lstrlenW (lpString=".sdf") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".sdf") returned 0x0 [0092.659] lstrlenW (lpString=".MDF") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".MDF") returned 0x0 [0092.659] lstrlenW (lpString=".DBF") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".DBF") returned 0x0 [0092.659] lstrlenW (lpString=".DB") returned 3 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".DB") returned 0x0 [0092.659] lstrlenW (lpString=".db") returned 3 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".db") returned 0x0 [0092.659] lstrlenW (lpString=".ndf") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".ndf") returned 0x0 [0092.659] lstrlenW (lpString=".NDF") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".NDF") returned 0x0 [0092.659] lstrlenW (lpString=".Mdf") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".Mdf") returned 0x0 [0092.659] lstrlenW (lpString=".dat") returned 4 [0092.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".dat") returned 0x0 [0092.660] lstrlenW (lpString=".DAT") returned 4 [0092.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".DAT") returned 0x0 [0092.660] lstrlenW (lpString=".ldf") returned 4 [0092.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".ldf") returned 0x0 [0092.660] lstrlenW (lpString=".LDF") returned 4 [0092.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch=".LDF") returned 0x0 [0092.660] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.660] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.661] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.661] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21266199968) returned 1 [0092.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc60a31b0, dwHighDateTime=0x1d585b4)) [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b73c0 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b73c0 | out: hHeap=0x260000) returned 1 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.662] GetLastError () returned 0x0 [0092.662] GetLastError () returned 0x0 [0092.662] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.662] GetLastError () returned 0x0 [0092.662] GetLastError () returned 0x0 [0092.664] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.664] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x349, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x349, lpOverlapped=0x0) returned 1 [0092.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.664] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.664] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.665] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.665] CloseHandle (hObject=0x11c) returned 1 [0092.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x150) returned 0x2b2d80 [0092.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0092.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.666] GetLastError () returned 0x0 [0092.666] RtlWakeConditionVariable () returned 0x0 [0092.666] GetCurrentThreadId () returned 0x998 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".ldf") returned 0x0 [0092.667] lstrlenW (lpString=".vhd") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".vhd") returned 0x0 [0092.667] lstrlenW (lpString=".vhdx") returned 5 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".vhdx") returned 0x0 [0092.667] lstrlenW (lpString=".pst") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".pst") returned 0x0 [0092.667] lstrlenW (lpString=".ost") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".ost") returned 0x0 [0092.667] lstrlenW (lpString=".bak") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".bak") returned 0x0 [0092.667] lstrlenW (lpString=".bac") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".bac") returned 0x0 [0092.667] lstrlenW (lpString=".sys") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".sys") returned 0x0 [0092.667] lstrlenW (lpString=".v2i") returned 4 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".v2i") returned 0x0 [0092.667] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0092.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.668] lstrlenW (lpString=".sql") returned 4 [0092.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".sql") returned 0x0 [0092.669] lstrlenW (lpString=".mdf") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".mdf") returned 0x0 [0092.669] lstrlenW (lpString=".txt") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".txt") returned 0x0 [0092.669] lstrlenW (lpString=".dbf") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".dbf") returned 0x0 [0092.669] lstrlenW (lpString=".ckp") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".ckp") returned 0x0 [0092.669] lstrlenW (lpString=".dacpac") returned 7 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".dacpac") returned 0x0 [0092.669] lstrlenW (lpString=".db3") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".db3") returned 0x0 [0092.669] lstrlenW (lpString=".dtxs") returned 5 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".dtxs") returned 0x0 [0092.669] lstrlenW (lpString=".mdt") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".mdt") returned 0x0 [0092.669] lstrlenW (lpString=".sdf") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".sdf") returned 0x0 [0092.669] lstrlenW (lpString=".MDF") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".MDF") returned 0x0 [0092.669] lstrlenW (lpString=".DBF") returned 4 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".DBF") returned 0x0 [0092.669] lstrlenW (lpString=".DB") returned 3 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".DB") returned 0x0 [0092.669] lstrlenW (lpString=".db") returned 3 [0092.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".db") returned 0x0 [0092.670] lstrlenW (lpString=".ndf") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".ndf") returned 0x0 [0092.670] lstrlenW (lpString=".NDF") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".NDF") returned 0x0 [0092.670] lstrlenW (lpString=".Mdf") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".Mdf") returned 0x0 [0092.670] lstrlenW (lpString=".dat") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".dat") returned 0x0 [0092.670] lstrlenW (lpString=".DAT") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".DAT") returned 0x0 [0092.670] lstrlenW (lpString=".ldf") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".ldf") returned 0x0 [0092.670] lstrlenW (lpString=".LDF") returned 4 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch=".LDF") returned 0x0 [0092.670] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.670] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.671] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.671] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.671] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21267233076) returned 1 [0092.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc60c9310, dwHighDateTime=0x1d585b4)) [0092.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b73f8 [0092.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b73f8 | out: hHeap=0x260000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.672] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.672] GetLastError () returned 0x0 [0092.672] GetLastError () returned 0x0 [0092.672] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.672] GetLastError () returned 0x0 [0092.673] GetLastError () returned 0x0 [0092.771] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.771] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x327, lpOverlapped=0x0) returned 1 [0092.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.796] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.796] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.796] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.796] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.796] CloseHandle (hObject=0x11c) returned 1 [0092.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x160) returned 0x2b2d80 [0092.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0092.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.799] GetLastError () returned 0x0 [0092.799] RtlWakeConditionVariable () returned 0x0 [0092.799] GetCurrentThreadId () returned 0x998 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.799] lstrlenW (lpString=".vhd") returned 4 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0092.799] lstrlenW (lpString=".vhdx") returned 5 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.799] lstrlenW (lpString=".pst") returned 4 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".pst") returned 0x0 [0092.799] lstrlenW (lpString=".ost") returned 4 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".ost") returned 0x0 [0092.799] lstrlenW (lpString=".bak") returned 4 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".bak") returned 0x0 [0092.799] lstrlenW (lpString=".bac") returned 4 [0092.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".bac") returned 0x0 [0092.799] lstrlenW (lpString=".sys") returned 4 [0092.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".sys") returned 0x0 [0092.800] lstrlenW (lpString=".v2i") returned 4 [0092.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0092.800] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.801] lstrlenW (lpString=".sql") returned 4 [0092.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".sql") returned 0x0 [0092.801] lstrlenW (lpString=".mdf") returned 4 [0092.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0092.801] lstrlenW (lpString=".txt") returned 4 [0092.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".txt") returned 0x0 [0092.802] lstrlenW (lpString=".dbf") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0092.802] lstrlenW (lpString=".ckp") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0092.802] lstrlenW (lpString=".dacpac") returned 7 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.802] lstrlenW (lpString=".db3") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".db3") returned 0x0 [0092.802] lstrlenW (lpString=".dtxs") returned 5 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.802] lstrlenW (lpString=".mdt") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0092.802] lstrlenW (lpString=".sdf") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0092.802] lstrlenW (lpString=".MDF") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0092.802] lstrlenW (lpString=".DBF") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0092.802] lstrlenW (lpString=".DB") returned 3 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".DB") returned 0x0 [0092.802] lstrlenW (lpString=".db") returned 3 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".db") returned 0x0 [0092.802] lstrlenW (lpString=".ndf") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0092.802] lstrlenW (lpString=".NDF") returned 4 [0092.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0092.803] lstrlenW (lpString=".Mdf") returned 4 [0092.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.803] lstrlenW (lpString=".dat") returned 4 [0092.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".dat") returned 0x0 [0092.803] lstrlenW (lpString=".DAT") returned 4 [0092.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0092.803] lstrlenW (lpString=".ldf") returned 4 [0092.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.803] lstrlenW (lpString=".LDF") returned 4 [0092.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0092.803] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.803] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.803] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.804] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.804] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21280521777) returned 1 [0092.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc61f9e10, dwHighDateTime=0x1d585b4)) [0092.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7708 [0092.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7708 | out: hHeap=0x260000) returned 1 [0092.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.805] GetLastError () returned 0x0 [0092.806] GetLastError () returned 0x0 [0092.806] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.806] GetLastError () returned 0x0 [0092.806] GetLastError () returned 0x0 [0092.808] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.808] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x638, lpOverlapped=0x0) returned 1 [0092.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.808] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.808] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.808] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.808] CloseHandle (hObject=0x11c) returned 1 [0092.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.811] GetLastError () returned 0x0 [0092.811] RtlWakeConditionVariable () returned 0x0 [0092.811] GetCurrentThreadId () returned 0x998 [0092.811] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.811] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.811] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.811] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.814] CloseHandle (hObject=0x11c) returned 1 [0092.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d7df0 | out: hHeap=0x260000) returned 1 [0092.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.814] RtlWakeConditionVariable () returned 0x27e828 [0092.814] GetCurrentThreadId () returned 0x998 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".ldf") returned 0x0 [0092.814] lstrlenW (lpString=".vhd") returned 4 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".vhd") returned 0x0 [0092.814] lstrlenW (lpString=".vhdx") returned 5 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".vhdx") returned 0x0 [0092.814] lstrlenW (lpString=".pst") returned 4 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".pst") returned 0x0 [0092.814] lstrlenW (lpString=".ost") returned 4 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".ost") returned 0x0 [0092.814] lstrlenW (lpString=".bak") returned 4 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".bak") returned 0x0 [0092.814] lstrlenW (lpString=".bac") returned 4 [0092.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".bac") returned 0x0 [0092.815] lstrlenW (lpString=".sys") returned 4 [0092.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".sys") returned 0x0 [0092.815] lstrlenW (lpString=".v2i") returned 4 [0092.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".v2i") returned 0x0 [0092.815] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.816] lstrlenW (lpString=".sql") returned 4 [0092.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".sql") returned 0x0 [0092.816] lstrlenW (lpString=".mdf") returned 4 [0092.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".mdf") returned 0x0 [0092.817] lstrlenW (lpString=".txt") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".txt") returned 0x0 [0092.817] lstrlenW (lpString=".dbf") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".dbf") returned 0x0 [0092.817] lstrlenW (lpString=".ckp") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".ckp") returned 0x0 [0092.817] lstrlenW (lpString=".dacpac") returned 7 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".dacpac") returned 0x0 [0092.817] lstrlenW (lpString=".db3") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".db3") returned 0x0 [0092.817] lstrlenW (lpString=".dtxs") returned 5 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".dtxs") returned 0x0 [0092.817] lstrlenW (lpString=".mdt") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".mdt") returned 0x0 [0092.817] lstrlenW (lpString=".sdf") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".sdf") returned 0x0 [0092.817] lstrlenW (lpString=".MDF") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".MDF") returned 0x0 [0092.817] lstrlenW (lpString=".DBF") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".DBF") returned 0x0 [0092.817] lstrlenW (lpString=".DB") returned 3 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".DB") returned 0x0 [0092.817] lstrlenW (lpString=".db") returned 3 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".db") returned 0x0 [0092.817] lstrlenW (lpString=".ndf") returned 4 [0092.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".ndf") returned 0x0 [0092.818] lstrlenW (lpString=".NDF") returned 4 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".NDF") returned 0x0 [0092.818] lstrlenW (lpString=".Mdf") returned 4 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".Mdf") returned 0x0 [0092.818] lstrlenW (lpString=".dat") returned 4 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".dat") returned 0x0 [0092.818] lstrlenW (lpString=".DAT") returned 4 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".DAT") returned 0x0 [0092.818] lstrlenW (lpString=".ldf") returned 4 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".ldf") returned 0x0 [0092.818] lstrlenW (lpString=".LDF") returned 4 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch=".LDF") returned 0x0 [0092.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.818] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.819] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.819] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21282028525) returned 1 [0092.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc621ff70, dwHighDateTime=0x1d585b4)) [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7778 [0092.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7778 | out: hHeap=0x260000) returned 1 [0092.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.820] GetLastError () returned 0x0 [0092.820] GetLastError () returned 0x0 [0092.821] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] GetLastError () returned 0x0 [0092.822] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffef0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.822] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x10f3, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x10f3, lpOverlapped=0x0) returned 1 [0092.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.823] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.823] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.823] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.823] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.823] CloseHandle (hObject=0x11c) returned 1 [0092.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.823] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.825] GetLastError () returned 0x0 [0092.825] RtlWakeConditionVariable () returned 0x0 [0092.825] GetCurrentThreadId () returned 0x998 [0092.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0092.825] lstrlenW (lpString=".vhd") returned 4 [0092.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0092.825] lstrlenW (lpString=".vhdx") returned 5 [0092.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.826] lstrlenW (lpString=".pst") returned 4 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0092.826] lstrlenW (lpString=".ost") returned 4 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0092.826] lstrlenW (lpString=".bak") returned 4 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0092.826] lstrlenW (lpString=".bac") returned 4 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0092.826] lstrlenW (lpString=".sys") returned 4 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0092.826] lstrlenW (lpString=".v2i") returned 4 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0092.826] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.827] lstrlenW (lpString=".sql") returned 4 [0092.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0092.827] lstrlenW (lpString=".mdf") returned 4 [0092.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0092.827] lstrlenW (lpString=".txt") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0092.828] lstrlenW (lpString=".dbf") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0092.828] lstrlenW (lpString=".ckp") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0092.828] lstrlenW (lpString=".dacpac") returned 7 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.828] lstrlenW (lpString=".db3") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0092.828] lstrlenW (lpString=".dtxs") returned 5 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.828] lstrlenW (lpString=".mdt") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0092.828] lstrlenW (lpString=".sdf") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0092.828] lstrlenW (lpString=".MDF") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0092.828] lstrlenW (lpString=".DBF") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0092.828] lstrlenW (lpString=".DB") returned 3 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0092.828] lstrlenW (lpString=".db") returned 3 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".db") returned 0x0 [0092.828] lstrlenW (lpString=".ndf") returned 4 [0092.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0092.828] lstrlenW (lpString=".NDF") returned 4 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0092.829] lstrlenW (lpString=".Mdf") returned 4 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.829] lstrlenW (lpString=".dat") returned 4 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0092.829] lstrlenW (lpString=".DAT") returned 4 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0092.829] lstrlenW (lpString=".ldf") returned 4 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0092.829] lstrlenW (lpString=".LDF") returned 4 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0092.829] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.829] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.830] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.830] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.830] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21283129659) returned 1 [0092.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc62460d0, dwHighDateTime=0x1d585b4)) [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b77b0 [0092.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b77b0 | out: hHeap=0x260000) returned 1 [0092.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.831] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.831] GetLastError () returned 0x0 [0092.831] GetLastError () returned 0x0 [0092.831] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.831] GetLastError () returned 0x0 [0092.832] GetLastError () returned 0x0 [0092.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff5c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.940] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xa38, lpOverlapped=0x0) returned 1 [0092.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.940] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.940] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.940] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.940] CloseHandle (hObject=0x11c) returned 1 [0092.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.943] GetLastError () returned 0x0 [0092.943] RtlWakeConditionVariable () returned 0x0 [0092.944] GetCurrentThreadId () returned 0x998 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".ldf") returned 0x0 [0092.944] lstrlenW (lpString=".vhd") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".vhd") returned 0x0 [0092.944] lstrlenW (lpString=".vhdx") returned 5 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".vhdx") returned 0x0 [0092.944] lstrlenW (lpString=".pst") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".pst") returned 0x0 [0092.944] lstrlenW (lpString=".ost") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".ost") returned 0x0 [0092.944] lstrlenW (lpString=".bak") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".bak") returned 0x0 [0092.944] lstrlenW (lpString=".bac") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".bac") returned 0x0 [0092.944] lstrlenW (lpString=".sys") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".sys") returned 0x0 [0092.944] lstrlenW (lpString=".v2i") returned 4 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".v2i") returned 0x0 [0092.944] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.946] lstrlenW (lpString=".sql") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".sql") returned 0x0 [0092.947] lstrlenW (lpString=".mdf") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".mdf") returned 0x0 [0092.947] lstrlenW (lpString=".txt") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".txt") returned 0x0 [0092.947] lstrlenW (lpString=".dbf") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".dbf") returned 0x0 [0092.947] lstrlenW (lpString=".ckp") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".ckp") returned 0x0 [0092.947] lstrlenW (lpString=".dacpac") returned 7 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".dacpac") returned 0x0 [0092.947] lstrlenW (lpString=".db3") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".db3") returned 0x0 [0092.947] lstrlenW (lpString=".dtxs") returned 5 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".dtxs") returned 0x0 [0092.947] lstrlenW (lpString=".mdt") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".mdt") returned 0x0 [0092.947] lstrlenW (lpString=".sdf") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".sdf") returned 0x0 [0092.947] lstrlenW (lpString=".MDF") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".MDF") returned 0x0 [0092.947] lstrlenW (lpString=".DBF") returned 4 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".DBF") returned 0x0 [0092.947] lstrlenW (lpString=".DB") returned 3 [0092.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".DB") returned 0x0 [0092.948] lstrlenW (lpString=".db") returned 3 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".db") returned 0x0 [0092.948] lstrlenW (lpString=".ndf") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".ndf") returned 0x0 [0092.948] lstrlenW (lpString=".NDF") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".NDF") returned 0x0 [0092.948] lstrlenW (lpString=".Mdf") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".Mdf") returned 0x0 [0092.948] lstrlenW (lpString=".dat") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".dat") returned 0x0 [0092.948] lstrlenW (lpString=".DAT") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".DAT") returned 0x0 [0092.948] lstrlenW (lpString=".ldf") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".ldf") returned 0x0 [0092.948] lstrlenW (lpString=".LDF") returned 4 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch=".LDF") returned 0x0 [0092.948] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.948] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.949] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.949] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.949] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21295046074) returned 1 [0092.949] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6376bd0, dwHighDateTime=0x1d585b4)) [0092.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7a18 [0092.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7a18 | out: hHeap=0x260000) returned 1 [0092.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b6a8 [0092.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0092.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b6a8 | out: hHeap=0x260000) returned 1 [0092.950] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.950] GetLastError () returned 0x0 [0092.950] GetLastError () returned 0x0 [0092.951] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.951] GetLastError () returned 0x0 [0092.951] GetLastError () returned 0x0 [0092.952] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff94a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.953] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x6b6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x6b6, lpOverlapped=0x0) returned 1 [0092.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.953] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.953] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.953] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.953] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.953] CloseHandle (hObject=0x11c) returned 1 [0092.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0092.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.955] GetLastError () returned 0x0 [0092.955] RtlWakeConditionVariable () returned 0x0 [0092.955] GetCurrentThreadId () returned 0x998 [0092.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".ldf") returned 0x0 [0092.956] lstrlenW (lpString=".vhd") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".vhd") returned 0x0 [0092.956] lstrlenW (lpString=".vhdx") returned 5 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".vhdx") returned 0x0 [0092.956] lstrlenW (lpString=".pst") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".pst") returned 0x0 [0092.956] lstrlenW (lpString=".ost") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".ost") returned 0x0 [0092.956] lstrlenW (lpString=".bak") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".bak") returned 0x0 [0092.956] lstrlenW (lpString=".bac") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".bac") returned 0x0 [0092.956] lstrlenW (lpString=".sys") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".sys") returned 0x0 [0092.956] lstrlenW (lpString=".v2i") returned 4 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".v2i") returned 0x0 [0092.956] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.958] lstrlenW (lpString=".sql") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".sql") returned 0x0 [0092.958] lstrlenW (lpString=".mdf") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".mdf") returned 0x0 [0092.958] lstrlenW (lpString=".txt") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".txt") returned 0x0 [0092.958] lstrlenW (lpString=".dbf") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".dbf") returned 0x0 [0092.958] lstrlenW (lpString=".ckp") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".ckp") returned 0x0 [0092.958] lstrlenW (lpString=".dacpac") returned 7 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".dacpac") returned 0x0 [0092.958] lstrlenW (lpString=".db3") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".db3") returned 0x0 [0092.958] lstrlenW (lpString=".dtxs") returned 5 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".dtxs") returned 0x0 [0092.958] lstrlenW (lpString=".mdt") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".mdt") returned 0x0 [0092.958] lstrlenW (lpString=".sdf") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".sdf") returned 0x0 [0092.958] lstrlenW (lpString=".MDF") returned 4 [0092.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".MDF") returned 0x0 [0092.958] lstrlenW (lpString=".DBF") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".DBF") returned 0x0 [0092.959] lstrlenW (lpString=".DB") returned 3 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".DB") returned 0x0 [0092.959] lstrlenW (lpString=".db") returned 3 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".db") returned 0x0 [0092.959] lstrlenW (lpString=".ndf") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".ndf") returned 0x0 [0092.959] lstrlenW (lpString=".NDF") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".NDF") returned 0x0 [0092.959] lstrlenW (lpString=".Mdf") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".Mdf") returned 0x0 [0092.959] lstrlenW (lpString=".dat") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".dat") returned 0x0 [0092.959] lstrlenW (lpString=".DAT") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".DAT") returned 0x0 [0092.959] lstrlenW (lpString=".ldf") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".ldf") returned 0x0 [0092.959] lstrlenW (lpString=".LDF") returned 4 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch=".LDF") returned 0x0 [0092.959] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.959] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.960] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.960] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.960] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21296161161) returned 1 [0092.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc639cd30, dwHighDateTime=0x1d585b4)) [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7a50 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7a50 | out: hHeap=0x260000) returned 1 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b750 [0092.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0092.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b750 | out: hHeap=0x260000) returned 1 [0092.961] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.961] GetLastError () returned 0x0 [0092.962] GetLastError () returned 0x0 [0092.962] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.962] GetLastError () returned 0x0 [0092.962] GetLastError () returned 0x0 [0092.963] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.963] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x13e, lpOverlapped=0x0) returned 1 [0092.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.963] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.963] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.963] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.964] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.964] CloseHandle (hObject=0x11c) returned 1 [0092.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0092.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0092.966] GetLastError () returned 0x0 [0092.966] RtlWakeConditionVariable () returned 0x27e828 [0092.966] GetCurrentThreadId () returned 0x998 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".ldf") returned 0x0 [0092.966] lstrlenW (lpString=".vhd") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".vhd") returned 0x0 [0092.966] lstrlenW (lpString=".vhdx") returned 5 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".vhdx") returned 0x0 [0092.966] lstrlenW (lpString=".pst") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".pst") returned 0x0 [0092.966] lstrlenW (lpString=".ost") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".ost") returned 0x0 [0092.966] lstrlenW (lpString=".bak") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".bak") returned 0x0 [0092.966] lstrlenW (lpString=".bac") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".bac") returned 0x0 [0092.966] lstrlenW (lpString=".sys") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".sys") returned 0x0 [0092.966] lstrlenW (lpString=".v2i") returned 4 [0092.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".v2i") returned 0x0 [0092.966] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0092.968] lstrlenW (lpString=".sql") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".sql") returned 0x0 [0092.968] lstrlenW (lpString=".mdf") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".mdf") returned 0x0 [0092.968] lstrlenW (lpString=".txt") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".txt") returned 0x0 [0092.968] lstrlenW (lpString=".dbf") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".dbf") returned 0x0 [0092.968] lstrlenW (lpString=".ckp") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".ckp") returned 0x0 [0092.968] lstrlenW (lpString=".dacpac") returned 7 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".dacpac") returned 0x0 [0092.968] lstrlenW (lpString=".db3") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".db3") returned 0x0 [0092.968] lstrlenW (lpString=".dtxs") returned 5 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".dtxs") returned 0x0 [0092.968] lstrlenW (lpString=".mdt") returned 4 [0092.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".mdt") returned 0x0 [0092.968] lstrlenW (lpString=".sdf") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".sdf") returned 0x0 [0092.969] lstrlenW (lpString=".MDF") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".MDF") returned 0x0 [0092.969] lstrlenW (lpString=".DBF") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".DBF") returned 0x0 [0092.969] lstrlenW (lpString=".DB") returned 3 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".DB") returned 0x0 [0092.969] lstrlenW (lpString=".db") returned 3 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".db") returned 0x0 [0092.969] lstrlenW (lpString=".ndf") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".ndf") returned 0x0 [0092.969] lstrlenW (lpString=".NDF") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".NDF") returned 0x0 [0092.969] lstrlenW (lpString=".Mdf") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".Mdf") returned 0x0 [0092.969] lstrlenW (lpString=".dat") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".dat") returned 0x0 [0092.969] lstrlenW (lpString=".DAT") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".DAT") returned 0x0 [0092.969] lstrlenW (lpString=".ldf") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".ldf") returned 0x0 [0092.969] lstrlenW (lpString=".LDF") returned 4 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch=".LDF") returned 0x0 [0092.969] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0092.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.970] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0092.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.970] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0092.971] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21297177106) returned 1 [0092.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc639cd30, dwHighDateTime=0x1d585b4)) [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7a88 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7a88 | out: hHeap=0x260000) returned 1 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b7f8 [0092.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0092.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b7f8 | out: hHeap=0x260000) returned 1 [0092.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0092.972] GetLastError () returned 0x0 [0092.972] GetLastError () returned 0x0 [0092.972] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0092.972] GetLastError () returned 0x0 [0092.972] GetLastError () returned 0x0 [0093.103] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff5d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.103] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa2e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xa2e, lpOverlapped=0x0) returned 1 [0093.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.103] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.103] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.103] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.103] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.104] CloseHandle (hObject=0x11c) returned 1 [0093.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0093.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.106] GetLastError () returned 0x0 [0093.106] RtlWakeConditionVariable () returned 0x0 [0093.106] GetCurrentThreadId () returned 0x998 [0093.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".ldf") returned 0x0 [0093.106] lstrlenW (lpString=".vhd") returned 4 [0093.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".vhd") returned 0x0 [0093.106] lstrlenW (lpString=".vhdx") returned 5 [0093.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".vhdx") returned 0x0 [0093.106] lstrlenW (lpString=".pst") returned 4 [0093.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".pst") returned 0x0 [0093.107] lstrlenW (lpString=".ost") returned 4 [0093.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".ost") returned 0x0 [0093.107] lstrlenW (lpString=".bak") returned 4 [0093.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".bak") returned 0x0 [0093.107] lstrlenW (lpString=".bac") returned 4 [0093.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".bac") returned 0x0 [0093.107] lstrlenW (lpString=".sys") returned 4 [0093.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".sys") returned 0x0 [0093.107] lstrlenW (lpString=".v2i") returned 4 [0093.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".v2i") returned 0x0 [0093.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0093.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.109] lstrlenW (lpString=".sql") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".sql") returned 0x0 [0093.109] lstrlenW (lpString=".mdf") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".mdf") returned 0x0 [0093.109] lstrlenW (lpString=".txt") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".txt") returned 0x0 [0093.109] lstrlenW (lpString=".dbf") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".dbf") returned 0x0 [0093.109] lstrlenW (lpString=".ckp") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".ckp") returned 0x0 [0093.109] lstrlenW (lpString=".dacpac") returned 7 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".dacpac") returned 0x0 [0093.109] lstrlenW (lpString=".db3") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".db3") returned 0x0 [0093.109] lstrlenW (lpString=".dtxs") returned 5 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".dtxs") returned 0x0 [0093.109] lstrlenW (lpString=".mdt") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".mdt") returned 0x0 [0093.109] lstrlenW (lpString=".sdf") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".sdf") returned 0x0 [0093.109] lstrlenW (lpString=".MDF") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".MDF") returned 0x0 [0093.109] lstrlenW (lpString=".DBF") returned 4 [0093.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".DBF") returned 0x0 [0093.109] lstrlenW (lpString=".DB") returned 3 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".DB") returned 0x0 [0093.110] lstrlenW (lpString=".db") returned 3 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".db") returned 0x0 [0093.110] lstrlenW (lpString=".ndf") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".ndf") returned 0x0 [0093.110] lstrlenW (lpString=".NDF") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".NDF") returned 0x0 [0093.110] lstrlenW (lpString=".Mdf") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".Mdf") returned 0x0 [0093.110] lstrlenW (lpString=".dat") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".dat") returned 0x0 [0093.110] lstrlenW (lpString=".DAT") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".DAT") returned 0x0 [0093.110] lstrlenW (lpString=".ldf") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".ldf") returned 0x0 [0093.110] lstrlenW (lpString=".LDF") returned 4 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch=".LDF") returned 0x0 [0093.110] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.110] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0093.111] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.111] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.111] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21311251930) returned 1 [0093.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc64f3990, dwHighDateTime=0x1d585b4)) [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7c10 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7c10 | out: hHeap=0x260000) returned 1 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b8a0 [0093.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b8a0 | out: hHeap=0x260000) returned 1 [0093.112] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.112] GetLastError () returned 0x0 [0093.112] GetLastError () returned 0x0 [0093.113] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.113] GetLastError () returned 0x0 [0093.113] GetLastError () returned 0x0 [0093.115] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.115] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd6e, lpOverlapped=0x0) returned 1 [0093.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.115] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.115] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.115] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.115] CloseHandle (hObject=0x11c) returned 1 [0093.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0093.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.118] GetLastError () returned 0x0 [0093.118] RtlWakeConditionVariable () returned 0x0 [0093.118] GetCurrentThreadId () returned 0x998 [0093.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".ldf") returned 0x0 [0093.118] lstrlenW (lpString=".vhd") returned 4 [0093.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".vhd") returned 0x0 [0093.118] lstrlenW (lpString=".vhdx") returned 5 [0093.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".vhdx") returned 0x0 [0093.118] lstrlenW (lpString=".pst") returned 4 [0093.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".pst") returned 0x0 [0093.118] lstrlenW (lpString=".ost") returned 4 [0093.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".ost") returned 0x0 [0093.119] lstrlenW (lpString=".bak") returned 4 [0093.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".bak") returned 0x0 [0093.119] lstrlenW (lpString=".bac") returned 4 [0093.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".bac") returned 0x0 [0093.119] lstrlenW (lpString=".sys") returned 4 [0093.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".sys") returned 0x0 [0093.119] lstrlenW (lpString=".v2i") returned 4 [0093.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".v2i") returned 0x0 [0093.119] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.122] lstrlenW (lpString=".sql") returned 4 [0093.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".sql") returned 0x0 [0093.122] lstrlenW (lpString=".mdf") returned 4 [0093.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".mdf") returned 0x0 [0093.122] lstrlenW (lpString=".txt") returned 4 [0093.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".txt") returned 0x0 [0093.123] lstrlenW (lpString=".dbf") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".dbf") returned 0x0 [0093.123] lstrlenW (lpString=".ckp") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".ckp") returned 0x0 [0093.123] lstrlenW (lpString=".dacpac") returned 7 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".dacpac") returned 0x0 [0093.123] lstrlenW (lpString=".db3") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".db3") returned 0x0 [0093.123] lstrlenW (lpString=".dtxs") returned 5 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".dtxs") returned 0x0 [0093.123] lstrlenW (lpString=".mdt") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".mdt") returned 0x0 [0093.123] lstrlenW (lpString=".sdf") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".sdf") returned 0x0 [0093.123] lstrlenW (lpString=".MDF") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".MDF") returned 0x0 [0093.123] lstrlenW (lpString=".DBF") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".DBF") returned 0x0 [0093.123] lstrlenW (lpString=".DB") returned 3 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".DB") returned 0x0 [0093.123] lstrlenW (lpString=".db") returned 3 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".db") returned 0x0 [0093.123] lstrlenW (lpString=".ndf") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".ndf") returned 0x0 [0093.123] lstrlenW (lpString=".NDF") returned 4 [0093.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".NDF") returned 0x0 [0093.123] lstrlenW (lpString=".Mdf") returned 4 [0093.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".Mdf") returned 0x0 [0093.124] lstrlenW (lpString=".dat") returned 4 [0093.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".dat") returned 0x0 [0093.124] lstrlenW (lpString=".DAT") returned 4 [0093.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".DAT") returned 0x0 [0093.124] lstrlenW (lpString=".ldf") returned 4 [0093.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".ldf") returned 0x0 [0093.124] lstrlenW (lpString=".LDF") returned 4 [0093.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch=".LDF") returned 0x0 [0093.124] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.124] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0093.125] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.125] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.125] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21312612494) returned 1 [0093.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6519af0, dwHighDateTime=0x1d585b4)) [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7c48 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7c48 | out: hHeap=0x260000) returned 1 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ba98 [0093.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ba98 | out: hHeap=0x260000) returned 1 [0093.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.126] GetLastError () returned 0x0 [0093.126] GetLastError () returned 0x0 [0093.126] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.126] GetLastError () returned 0x0 [0093.126] GetLastError () returned 0x0 [0093.128] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.128] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd6e, lpOverlapped=0x0) returned 1 [0093.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.128] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.128] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.129] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.129] CloseHandle (hObject=0x11c) returned 1 [0093.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755620 [0093.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755620 | out: hHeap=0x260000) returned 1 [0093.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.131] GetLastError () returned 0x0 [0093.131] RtlWakeConditionVariable () returned 0x0 [0093.131] GetCurrentThreadId () returned 0x998 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".ldf") returned 0x0 [0093.131] lstrlenW (lpString=".vhd") returned 4 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".vhd") returned 0x0 [0093.131] lstrlenW (lpString=".vhdx") returned 5 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".vhdx") returned 0x0 [0093.131] lstrlenW (lpString=".pst") returned 4 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".pst") returned 0x0 [0093.131] lstrlenW (lpString=".ost") returned 4 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".ost") returned 0x0 [0093.131] lstrlenW (lpString=".bak") returned 4 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".bak") returned 0x0 [0093.131] lstrlenW (lpString=".bac") returned 4 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".bac") returned 0x0 [0093.131] lstrlenW (lpString=".sys") returned 4 [0093.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".sys") returned 0x0 [0093.132] lstrlenW (lpString=".v2i") returned 4 [0093.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".v2i") returned 0x0 [0093.132] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.133] lstrlenW (lpString=".sql") returned 4 [0093.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".sql") returned 0x0 [0093.133] lstrlenW (lpString=".mdf") returned 4 [0093.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".mdf") returned 0x0 [0093.133] lstrlenW (lpString=".txt") returned 4 [0093.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".txt") returned 0x0 [0093.133] lstrlenW (lpString=".dbf") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".dbf") returned 0x0 [0093.134] lstrlenW (lpString=".ckp") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".ckp") returned 0x0 [0093.134] lstrlenW (lpString=".dacpac") returned 7 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".dacpac") returned 0x0 [0093.134] lstrlenW (lpString=".db3") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".db3") returned 0x0 [0093.134] lstrlenW (lpString=".dtxs") returned 5 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".dtxs") returned 0x0 [0093.134] lstrlenW (lpString=".mdt") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".mdt") returned 0x0 [0093.134] lstrlenW (lpString=".sdf") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".sdf") returned 0x0 [0093.134] lstrlenW (lpString=".MDF") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".MDF") returned 0x0 [0093.134] lstrlenW (lpString=".DBF") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".DBF") returned 0x0 [0093.134] lstrlenW (lpString=".DB") returned 3 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".DB") returned 0x0 [0093.134] lstrlenW (lpString=".db") returned 3 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".db") returned 0x0 [0093.134] lstrlenW (lpString=".ndf") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".ndf") returned 0x0 [0093.134] lstrlenW (lpString=".NDF") returned 4 [0093.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".NDF") returned 0x0 [0093.134] lstrlenW (lpString=".Mdf") returned 4 [0093.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".Mdf") returned 0x0 [0093.135] lstrlenW (lpString=".dat") returned 4 [0093.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".dat") returned 0x0 [0093.135] lstrlenW (lpString=".DAT") returned 4 [0093.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".DAT") returned 0x0 [0093.135] lstrlenW (lpString=".ldf") returned 4 [0093.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".ldf") returned 0x0 [0093.135] lstrlenW (lpString=".LDF") returned 4 [0093.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch=".LDF") returned 0x0 [0093.135] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.135] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0093.136] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.136] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.136] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21313714757) returned 1 [0093.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc653fc50, dwHighDateTime=0x1d585b4)) [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7c80 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7c80 | out: hHeap=0x260000) returned 1 [0093.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bb40 [0093.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bb40 | out: hHeap=0x260000) returned 1 [0093.137] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.137] GetLastError () returned 0x0 [0093.137] GetLastError () returned 0x0 [0093.137] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.137] GetLastError () returned 0x0 [0093.137] GetLastError () returned 0x0 [0093.285] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.285] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0xd6e, lpOverlapped=0x0) returned 1 [0093.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.288] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.288] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.288] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.288] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.288] CloseHandle (hObject=0x11c) returned 1 [0093.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0093.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0093.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.382] GetLastError () returned 0x0 [0093.382] RtlWakeConditionVariable () returned 0x0 [0093.382] GetCurrentThreadId () returned 0x998 [0093.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".ldf") returned 0x0 [0093.382] lstrlenW (lpString=".vhd") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".vhd") returned 0x0 [0093.383] lstrlenW (lpString=".vhdx") returned 5 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".vhdx") returned 0x0 [0093.383] lstrlenW (lpString=".pst") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".pst") returned 0x0 [0093.383] lstrlenW (lpString=".ost") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".ost") returned 0x0 [0093.383] lstrlenW (lpString=".bak") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".bak") returned 0x0 [0093.383] lstrlenW (lpString=".bac") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".bac") returned 0x0 [0093.383] lstrlenW (lpString=".sys") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".sys") returned 0x0 [0093.383] lstrlenW (lpString=".v2i") returned 4 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".v2i") returned 0x0 [0093.383] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0093.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.385] lstrlenW (lpString=".sql") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".sql") returned 0x0 [0093.385] lstrlenW (lpString=".mdf") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".mdf") returned 0x0 [0093.385] lstrlenW (lpString=".txt") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".txt") returned 0x0 [0093.385] lstrlenW (lpString=".dbf") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".dbf") returned 0x0 [0093.385] lstrlenW (lpString=".ckp") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".ckp") returned 0x0 [0093.385] lstrlenW (lpString=".dacpac") returned 7 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".dacpac") returned 0x0 [0093.385] lstrlenW (lpString=".db3") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".db3") returned 0x0 [0093.385] lstrlenW (lpString=".dtxs") returned 5 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".dtxs") returned 0x0 [0093.385] lstrlenW (lpString=".mdt") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".mdt") returned 0x0 [0093.385] lstrlenW (lpString=".sdf") returned 4 [0093.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".sdf") returned 0x0 [0093.385] lstrlenW (lpString=".MDF") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".MDF") returned 0x0 [0093.386] lstrlenW (lpString=".DBF") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".DBF") returned 0x0 [0093.386] lstrlenW (lpString=".DB") returned 3 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".DB") returned 0x0 [0093.386] lstrlenW (lpString=".db") returned 3 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".db") returned 0x0 [0093.386] lstrlenW (lpString=".ndf") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".ndf") returned 0x0 [0093.386] lstrlenW (lpString=".NDF") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".NDF") returned 0x0 [0093.386] lstrlenW (lpString=".Mdf") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".Mdf") returned 0x0 [0093.386] lstrlenW (lpString=".dat") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".dat") returned 0x0 [0093.386] lstrlenW (lpString=".DAT") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".DAT") returned 0x0 [0093.386] lstrlenW (lpString=".ldf") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".ldf") returned 0x0 [0093.386] lstrlenW (lpString=".LDF") returned 4 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch=".LDF") returned 0x0 [0093.386] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.387] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0093.387] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.387] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.388] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21338864643) returned 1 [0093.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc67a1250, dwHighDateTime=0x1d585b4)) [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7ee8 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7ee8 | out: hHeap=0x260000) returned 1 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bbe8 [0093.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bbe8 | out: hHeap=0x260000) returned 1 [0093.388] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.388] GetLastError () returned 0x0 [0093.389] GetLastError () returned 0x0 [0093.389] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.389] GetLastError () returned 0x0 [0093.389] GetLastError () returned 0x0 [0093.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd86a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.391] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x2796, lpOverlapped=0x0) returned 1 [0093.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.391] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.391] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.391] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.391] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.391] CloseHandle (hObject=0xf0) returned 1 [0093.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0093.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.394] GetLastError () returned 0x0 [0093.394] RtlWakeConditionVariable () returned 0x0 [0093.394] GetCurrentThreadId () returned 0x998 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".ldf") returned 0x0 [0093.394] lstrlenW (lpString=".vhd") returned 4 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".vhd") returned 0x0 [0093.394] lstrlenW (lpString=".vhdx") returned 5 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".vhdx") returned 0x0 [0093.394] lstrlenW (lpString=".pst") returned 4 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".pst") returned 0x0 [0093.394] lstrlenW (lpString=".ost") returned 4 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".ost") returned 0x0 [0093.394] lstrlenW (lpString=".bak") returned 4 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".bak") returned 0x0 [0093.394] lstrlenW (lpString=".bac") returned 4 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".bac") returned 0x0 [0093.394] lstrlenW (lpString=".sys") returned 4 [0093.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".sys") returned 0x0 [0093.395] lstrlenW (lpString=".v2i") returned 4 [0093.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".v2i") returned 0x0 [0093.395] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0093.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.396] lstrlenW (lpString=".sql") returned 4 [0093.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".sql") returned 0x0 [0093.396] lstrlenW (lpString=".mdf") returned 4 [0093.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".mdf") returned 0x0 [0093.396] lstrlenW (lpString=".txt") returned 4 [0093.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".txt") returned 0x0 [0093.396] lstrlenW (lpString=".dbf") returned 4 [0093.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".dbf") returned 0x0 [0093.396] lstrlenW (lpString=".ckp") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".ckp") returned 0x0 [0093.397] lstrlenW (lpString=".dacpac") returned 7 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".dacpac") returned 0x0 [0093.397] lstrlenW (lpString=".db3") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".db3") returned 0x0 [0093.397] lstrlenW (lpString=".dtxs") returned 5 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".dtxs") returned 0x0 [0093.397] lstrlenW (lpString=".mdt") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".mdt") returned 0x0 [0093.397] lstrlenW (lpString=".sdf") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".sdf") returned 0x0 [0093.397] lstrlenW (lpString=".MDF") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".MDF") returned 0x0 [0093.397] lstrlenW (lpString=".DBF") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".DBF") returned 0x0 [0093.397] lstrlenW (lpString=".DB") returned 3 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".DB") returned 0x0 [0093.397] lstrlenW (lpString=".db") returned 3 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".db") returned 0x0 [0093.397] lstrlenW (lpString=".ndf") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".ndf") returned 0x0 [0093.397] lstrlenW (lpString=".NDF") returned 4 [0093.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".NDF") returned 0x0 [0093.397] lstrlenW (lpString=".Mdf") returned 4 [0093.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".Mdf") returned 0x0 [0093.398] lstrlenW (lpString=".dat") returned 4 [0093.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".dat") returned 0x0 [0093.398] lstrlenW (lpString=".DAT") returned 4 [0093.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".DAT") returned 0x0 [0093.398] lstrlenW (lpString=".ldf") returned 4 [0093.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".ldf") returned 0x0 [0093.398] lstrlenW (lpString=".LDF") returned 4 [0093.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch=".LDF") returned 0x0 [0093.398] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.398] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0093.399] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.399] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.399] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21340015560) returned 1 [0093.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc67c73b0, dwHighDateTime=0x1d585b4)) [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7f20 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7f20 | out: hHeap=0x260000) returned 1 [0093.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b558 [0093.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d968 [0093.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b558 | out: hHeap=0x260000) returned 1 [0093.400] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.400] GetLastError () returned 0x0 [0093.400] GetLastError () returned 0x0 [0093.400] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.400] GetLastError () returned 0x0 [0093.400] GetLastError () returned 0x0 [0093.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdc9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.402] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x2366, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x2366, lpOverlapped=0x0) returned 1 [0093.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.403] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.403] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.403] CloseHandle (hObject=0xf0) returned 1 [0093.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0093.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.404] GetLastError () returned 0x0 [0093.405] RtlWakeConditionVariable () returned 0x0 [0093.405] GetCurrentThreadId () returned 0x998 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".ldf") returned 0x0 [0093.405] lstrlenW (lpString=".vhd") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".vhd") returned 0x0 [0093.405] lstrlenW (lpString=".vhdx") returned 5 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".vhdx") returned 0x0 [0093.405] lstrlenW (lpString=".pst") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".pst") returned 0x0 [0093.405] lstrlenW (lpString=".ost") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".ost") returned 0x0 [0093.405] lstrlenW (lpString=".bak") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".bak") returned 0x0 [0093.405] lstrlenW (lpString=".bac") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".bac") returned 0x0 [0093.405] lstrlenW (lpString=".sys") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".sys") returned 0x0 [0093.405] lstrlenW (lpString=".v2i") returned 4 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".v2i") returned 0x0 [0093.405] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.407] lstrlenW (lpString=".sql") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".sql") returned 0x0 [0093.407] lstrlenW (lpString=".mdf") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".mdf") returned 0x0 [0093.407] lstrlenW (lpString=".txt") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".txt") returned 0x0 [0093.407] lstrlenW (lpString=".dbf") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".dbf") returned 0x0 [0093.407] lstrlenW (lpString=".ckp") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".ckp") returned 0x0 [0093.407] lstrlenW (lpString=".dacpac") returned 7 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".dacpac") returned 0x0 [0093.407] lstrlenW (lpString=".db3") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".db3") returned 0x0 [0093.407] lstrlenW (lpString=".dtxs") returned 5 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".dtxs") returned 0x0 [0093.407] lstrlenW (lpString=".mdt") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".mdt") returned 0x0 [0093.407] lstrlenW (lpString=".sdf") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".sdf") returned 0x0 [0093.407] lstrlenW (lpString=".MDF") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".MDF") returned 0x0 [0093.407] lstrlenW (lpString=".DBF") returned 4 [0093.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".DBF") returned 0x0 [0093.407] lstrlenW (lpString=".DB") returned 3 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".DB") returned 0x0 [0093.408] lstrlenW (lpString=".db") returned 3 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".db") returned 0x0 [0093.408] lstrlenW (lpString=".ndf") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".ndf") returned 0x0 [0093.408] lstrlenW (lpString=".NDF") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".NDF") returned 0x0 [0093.408] lstrlenW (lpString=".Mdf") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".Mdf") returned 0x0 [0093.408] lstrlenW (lpString=".dat") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".dat") returned 0x0 [0093.408] lstrlenW (lpString=".DAT") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".DAT") returned 0x0 [0093.408] lstrlenW (lpString=".ldf") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".ldf") returned 0x0 [0093.408] lstrlenW (lpString=".LDF") returned 4 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch=".LDF") returned 0x0 [0093.408] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.408] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e380) returned 1 [0093.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.409] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.409] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21341048448) returned 1 [0093.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc67c73b0, dwHighDateTime=0x1d585b4)) [0093.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7f58 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7f58 | out: hHeap=0x260000) returned 1 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.410] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.410] GetLastError () returned 0x0 [0093.410] GetLastError () returned 0x0 [0093.410] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] GetLastError () returned 0x0 [0093.437] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.437] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.439] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.439] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.439] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.439] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.439] CloseHandle (hObject=0xf0) returned 1 [0093.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0093.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0093.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.441] GetLastError () returned 0x0 [0093.441] RtlWakeConditionVariable () returned 0x0 [0093.441] GetCurrentThreadId () returned 0x998 [0093.442] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.442] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.442] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.442] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.444] CloseHandle (hObject=0xf0) returned 1 [0093.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27558d8 | out: hHeap=0x260000) returned 1 [0093.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0093.444] RtlWakeConditionVariable () returned 0x0 [0093.444] GetCurrentThreadId () returned 0x998 [0093.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".ldf") returned 0x0 [0093.444] lstrlenW (lpString=".vhd") returned 4 [0093.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".vhd") returned 0x0 [0093.444] lstrlenW (lpString=".vhdx") returned 5 [0093.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".vhdx") returned 0x0 [0093.444] lstrlenW (lpString=".pst") returned 4 [0093.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".pst") returned 0x0 [0093.444] lstrlenW (lpString=".ost") returned 4 [0093.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".ost") returned 0x0 [0093.445] lstrlenW (lpString=".bak") returned 4 [0093.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".bak") returned 0x0 [0093.445] lstrlenW (lpString=".bac") returned 4 [0093.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".bac") returned 0x0 [0093.445] lstrlenW (lpString=".sys") returned 4 [0093.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".sys") returned 0x0 [0093.445] lstrlenW (lpString=".v2i") returned 4 [0093.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".v2i") returned 0x0 [0093.445] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.526] lstrlenW (lpString=".sql") returned 4 [0093.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".sql") returned 0x0 [0093.526] lstrlenW (lpString=".mdf") returned 4 [0093.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".mdf") returned 0x0 [0093.526] lstrlenW (lpString=".txt") returned 4 [0093.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".txt") returned 0x0 [0093.526] lstrlenW (lpString=".dbf") returned 4 [0093.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".dbf") returned 0x0 [0093.529] lstrlenW (lpString=".ckp") returned 4 [0093.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".ckp") returned 0x0 [0093.530] lstrlenW (lpString=".dacpac") returned 7 [0093.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".dacpac") returned 0x0 [0093.530] lstrlenW (lpString=".db3") returned 4 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".db3") returned 0x0 [0093.538] lstrlenW (lpString=".dtxs") returned 5 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".dtxs") returned 0x0 [0093.538] lstrlenW (lpString=".mdt") returned 4 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".mdt") returned 0x0 [0093.538] lstrlenW (lpString=".sdf") returned 4 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".sdf") returned 0x0 [0093.538] lstrlenW (lpString=".MDF") returned 4 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".MDF") returned 0x0 [0093.538] lstrlenW (lpString=".DBF") returned 4 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".DBF") returned 0x0 [0093.538] lstrlenW (lpString=".DB") returned 3 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".DB") returned 0x0 [0093.538] lstrlenW (lpString=".db") returned 3 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".db") returned 0x0 [0093.538] lstrlenW (lpString=".ndf") returned 4 [0093.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".ndf") returned 0x0 [0093.539] lstrlenW (lpString=".NDF") returned 4 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".NDF") returned 0x0 [0093.539] lstrlenW (lpString=".Mdf") returned 4 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".Mdf") returned 0x0 [0093.539] lstrlenW (lpString=".dat") returned 4 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".dat") returned 0x0 [0093.539] lstrlenW (lpString=".DAT") returned 4 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".DAT") returned 0x0 [0093.539] lstrlenW (lpString=".ldf") returned 4 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".ldf") returned 0x0 [0093.539] lstrlenW (lpString=".LDF") returned 4 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch=".LDF") returned 0x0 [0093.539] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.539] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e490) returned 1 [0093.540] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.540] CryptReleaseContext (hProv=0x33e490, dwFlags=0x0) returned 1 [0093.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.540] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21354117261) returned 1 [0093.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc691e010, dwHighDateTime=0x1d585b4)) [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df0c0 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df0c0 | out: hHeap=0x260000) returned 1 [0093.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0093.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.541] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.541] GetLastError () returned 0x0 [0093.541] GetLastError () returned 0x0 [0093.541] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.541] GetLastError () returned 0x0 [0093.541] GetLastError () returned 0x0 [0093.545] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe81d3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.545] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x17e2d, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x17e2d, lpOverlapped=0x0) returned 1 [0093.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.546] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.546] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.546] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.546] CloseHandle (hObject=0x11c) returned 1 [0093.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0093.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0093.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.548] GetLastError () returned 0x0 [0093.548] RtlWakeConditionVariable () returned 0x0 [0093.548] GetCurrentThreadId () returned 0x998 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".ldf") returned 0x0 [0093.549] lstrlenW (lpString=".vhd") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".vhd") returned 0x0 [0093.549] lstrlenW (lpString=".vhdx") returned 5 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".vhdx") returned 0x0 [0093.549] lstrlenW (lpString=".pst") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".pst") returned 0x0 [0093.549] lstrlenW (lpString=".ost") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".ost") returned 0x0 [0093.549] lstrlenW (lpString=".bak") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".bak") returned 0x0 [0093.549] lstrlenW (lpString=".bac") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".bac") returned 0x0 [0093.549] lstrlenW (lpString=".sys") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".sys") returned 0x0 [0093.549] lstrlenW (lpString=".v2i") returned 4 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".v2i") returned 0x0 [0093.549] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.551] lstrlenW (lpString=".sql") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".sql") returned 0x0 [0093.551] lstrlenW (lpString=".mdf") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".mdf") returned 0x0 [0093.551] lstrlenW (lpString=".txt") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".txt") returned 0x0 [0093.551] lstrlenW (lpString=".dbf") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".dbf") returned 0x0 [0093.551] lstrlenW (lpString=".ckp") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".ckp") returned 0x0 [0093.551] lstrlenW (lpString=".dacpac") returned 7 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".dacpac") returned 0x0 [0093.551] lstrlenW (lpString=".db3") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".db3") returned 0x0 [0093.551] lstrlenW (lpString=".dtxs") returned 5 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".dtxs") returned 0x0 [0093.551] lstrlenW (lpString=".mdt") returned 4 [0093.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".mdt") returned 0x0 [0093.551] lstrlenW (lpString=".sdf") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".sdf") returned 0x0 [0093.552] lstrlenW (lpString=".MDF") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".MDF") returned 0x0 [0093.552] lstrlenW (lpString=".DBF") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".DBF") returned 0x0 [0093.552] lstrlenW (lpString=".DB") returned 3 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".DB") returned 0x0 [0093.552] lstrlenW (lpString=".db") returned 3 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".db") returned 0x0 [0093.552] lstrlenW (lpString=".ndf") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".ndf") returned 0x0 [0093.552] lstrlenW (lpString=".NDF") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".NDF") returned 0x0 [0093.552] lstrlenW (lpString=".Mdf") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".Mdf") returned 0x0 [0093.552] lstrlenW (lpString=".dat") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".dat") returned 0x0 [0093.552] lstrlenW (lpString=".DAT") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".DAT") returned 0x0 [0093.552] lstrlenW (lpString=".ldf") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".ldf") returned 0x0 [0093.552] lstrlenW (lpString=".LDF") returned 4 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch=".LDF") returned 0x0 [0093.552] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.553] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e6b0) returned 1 [0093.553] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.553] CryptReleaseContext (hProv=0x33e6b0, dwFlags=0x0) returned 1 [0093.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.554] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21355474509) returned 1 [0093.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6944170, dwHighDateTime=0x1d585b4)) [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df0f8 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df0f8 | out: hHeap=0x260000) returned 1 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0093.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.554] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.554] GetLastError () returned 0x0 [0093.555] GetLastError () returned 0x0 [0093.555] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.555] GetLastError () returned 0x0 [0093.555] GetLastError () returned 0x0 [0093.559] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.560] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.560] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.560] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.564] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.564] CloseHandle (hObject=0x11c) returned 1 [0093.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.565] GetLastError () returned 0x0 [0093.565] RtlWakeConditionVariable () returned 0x0 [0093.565] GetCurrentThreadId () returned 0x998 [0093.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".ldf") returned 0x0 [0093.565] lstrlenW (lpString=".vhd") returned 4 [0093.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".vhd") returned 0x0 [0093.565] lstrlenW (lpString=".vhdx") returned 5 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".vhdx") returned 0x0 [0093.566] lstrlenW (lpString=".pst") returned 4 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".pst") returned 0x0 [0093.566] lstrlenW (lpString=".ost") returned 4 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".ost") returned 0x0 [0093.566] lstrlenW (lpString=".bak") returned 4 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".bak") returned 0x0 [0093.566] lstrlenW (lpString=".bac") returned 4 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".bac") returned 0x0 [0093.566] lstrlenW (lpString=".sys") returned 4 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".sys") returned 0x0 [0093.566] lstrlenW (lpString=".v2i") returned 4 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".v2i") returned 0x0 [0093.566] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.567] lstrlenW (lpString=".sql") returned 4 [0093.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".sql") returned 0x0 [0093.567] lstrlenW (lpString=".mdf") returned 4 [0093.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".mdf") returned 0x0 [0093.567] lstrlenW (lpString=".txt") returned 4 [0093.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".txt") returned 0x0 [0093.567] lstrlenW (lpString=".dbf") returned 4 [0093.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".dbf") returned 0x0 [0093.567] lstrlenW (lpString=".ckp") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".ckp") returned 0x0 [0093.568] lstrlenW (lpString=".dacpac") returned 7 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".dacpac") returned 0x0 [0093.568] lstrlenW (lpString=".db3") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".db3") returned 0x0 [0093.568] lstrlenW (lpString=".dtxs") returned 5 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".dtxs") returned 0x0 [0093.568] lstrlenW (lpString=".mdt") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".mdt") returned 0x0 [0093.568] lstrlenW (lpString=".sdf") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".sdf") returned 0x0 [0093.568] lstrlenW (lpString=".MDF") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".MDF") returned 0x0 [0093.568] lstrlenW (lpString=".DBF") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".DBF") returned 0x0 [0093.568] lstrlenW (lpString=".DB") returned 3 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".DB") returned 0x0 [0093.568] lstrlenW (lpString=".db") returned 3 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".db") returned 0x0 [0093.568] lstrlenW (lpString=".ndf") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".ndf") returned 0x0 [0093.568] lstrlenW (lpString=".NDF") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".NDF") returned 0x0 [0093.568] lstrlenW (lpString=".Mdf") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".Mdf") returned 0x0 [0093.568] lstrlenW (lpString=".dat") returned 4 [0093.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".dat") returned 0x0 [0093.569] lstrlenW (lpString=".DAT") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".DAT") returned 0x0 [0093.569] lstrlenW (lpString=".ldf") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".ldf") returned 0x0 [0093.569] lstrlenW (lpString=".LDF") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch=".LDF") returned 0x0 [0093.569] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.623] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e5a0) returned 1 [0093.623] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.623] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0093.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.624] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21362468389) returned 1 [0093.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc69dc6f0, dwHighDateTime=0x1d585b4)) [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df210 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df210 | out: hHeap=0x260000) returned 1 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.624] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.624] GetLastError () returned 0x0 [0093.625] GetLastError () returned 0x0 [0093.625] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.625] GetLastError () returned 0x0 [0093.625] GetLastError () returned 0x0 [0093.655] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.655] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0093.656] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.656] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.665] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.665] CloseHandle (hObject=0x11c) returned 1 [0093.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.709] GetLastError () returned 0x0 [0093.709] RtlWakeConditionVariable () returned 0x27e828 [0093.709] GetCurrentThreadId () returned 0x998 [0093.793] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.793] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.793] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.793] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.795] CloseHandle (hObject=0x11c) returned 1 [0093.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b6b0 | out: hHeap=0x260000) returned 1 [0093.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0093.795] RtlWakeConditionVariable () returned 0x0 [0093.795] GetCurrentThreadId () returned 0x998 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.796] lstrlenW (lpString=".vhd") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".vhd") returned 0x0 [0093.796] lstrlenW (lpString=".vhdx") returned 5 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".vhdx") returned 0x0 [0093.796] lstrlenW (lpString=".pst") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".pst") returned 0x0 [0093.796] lstrlenW (lpString=".ost") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".ost") returned 0x0 [0093.796] lstrlenW (lpString=".bak") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".bak") returned 0x0 [0093.796] lstrlenW (lpString=".bac") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".bac") returned 0x0 [0093.796] lstrlenW (lpString=".sys") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".sys") returned 0x0 [0093.796] lstrlenW (lpString=".v2i") returned 4 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".v2i") returned 0x0 [0093.796] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch="s\r\n.v2i") returned 0x0 [0093.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.797] lstrlenW (lpString=".sql") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".sql") returned 0x0 [0093.798] lstrlenW (lpString=".mdf") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".mdf") returned 0x0 [0093.798] lstrlenW (lpString=".txt") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".txt") returned 0x0 [0093.798] lstrlenW (lpString=".dbf") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".dbf") returned 0x0 [0093.798] lstrlenW (lpString=".ckp") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".ckp") returned 0x0 [0093.798] lstrlenW (lpString=".dacpac") returned 7 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".dacpac") returned 0x0 [0093.798] lstrlenW (lpString=".db3") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".db3") returned 0x0 [0093.798] lstrlenW (lpString=".dtxs") returned 5 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".dtxs") returned 0x0 [0093.798] lstrlenW (lpString=".mdt") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".mdt") returned 0x0 [0093.798] lstrlenW (lpString=".sdf") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".sdf") returned 0x0 [0093.798] lstrlenW (lpString=".MDF") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".MDF") returned 0x0 [0093.798] lstrlenW (lpString=".DBF") returned 4 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".DBF") returned 0x0 [0093.798] lstrlenW (lpString=".DB") returned 3 [0093.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".DB") returned 0x0 [0093.798] lstrlenW (lpString=".db") returned 3 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".db") returned 0x0 [0093.799] lstrlenW (lpString=".ndf") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".ndf") returned 0x0 [0093.799] lstrlenW (lpString=".NDF") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".NDF") returned 0x0 [0093.799] lstrlenW (lpString=".Mdf") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".Mdf") returned 0x0 [0093.799] lstrlenW (lpString=".dat") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".dat") returned 0x0 [0093.799] lstrlenW (lpString=".DAT") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".DAT") returned 0x0 [0093.799] lstrlenW (lpString=".ldf") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.799] lstrlenW (lpString=".LDF") returned 4 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch=".LDF") returned 0x0 [0093.799] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.799] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e738) returned 1 [0093.800] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.800] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0093.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.800] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21380139746) returned 1 [0093.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6b7f610, dwHighDateTime=0x1d585b4)) [0093.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df4e8 [0093.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df4e8 | out: hHeap=0x260000) returned 1 [0093.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.801] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.801] GetLastError () returned 0x0 [0093.801] GetLastError () returned 0x0 [0093.802] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.802] GetLastError () returned 0x0 [0093.802] GetLastError () returned 0x0 [0093.805] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff1890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.805] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xe770, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0xe770, lpOverlapped=0x0) returned 1 [0093.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.805] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.805] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.805] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.806] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.806] CloseHandle (hObject=0x11c) returned 1 [0093.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0093.806] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0093.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.807] GetLastError () returned 0x0 [0093.807] RtlWakeConditionVariable () returned 0x0 [0093.807] GetCurrentThreadId () returned 0x998 [0093.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.808] lstrlenW (lpString=".vhd") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".vhd") returned 0x0 [0093.808] lstrlenW (lpString=".vhdx") returned 5 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".vhdx") returned 0x0 [0093.808] lstrlenW (lpString=".pst") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".pst") returned 0x0 [0093.808] lstrlenW (lpString=".ost") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".ost") returned 0x0 [0093.808] lstrlenW (lpString=".bak") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".bak") returned 0x0 [0093.808] lstrlenW (lpString=".bac") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".bac") returned 0x0 [0093.808] lstrlenW (lpString=".sys") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".sys") returned 0x0 [0093.808] lstrlenW (lpString=".v2i") returned 4 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".v2i") returned 0x0 [0093.808] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.809] lstrlenW (lpString=".sql") returned 4 [0093.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".sql") returned 0x0 [0093.809] lstrlenW (lpString=".mdf") returned 4 [0093.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".mdf") returned 0x0 [0093.809] lstrlenW (lpString=".txt") returned 4 [0093.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".txt") returned 0x0 [0093.809] lstrlenW (lpString=".dbf") returned 4 [0093.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".dbf") returned 0x0 [0093.810] lstrlenW (lpString=".ckp") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".ckp") returned 0x0 [0093.810] lstrlenW (lpString=".dacpac") returned 7 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".dacpac") returned 0x0 [0093.810] lstrlenW (lpString=".db3") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".db3") returned 0x0 [0093.810] lstrlenW (lpString=".dtxs") returned 5 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".dtxs") returned 0x0 [0093.810] lstrlenW (lpString=".mdt") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".mdt") returned 0x0 [0093.810] lstrlenW (lpString=".sdf") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".sdf") returned 0x0 [0093.810] lstrlenW (lpString=".MDF") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".MDF") returned 0x0 [0093.810] lstrlenW (lpString=".DBF") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".DBF") returned 0x0 [0093.810] lstrlenW (lpString=".DB") returned 3 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".DB") returned 0x0 [0093.810] lstrlenW (lpString=".db") returned 3 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".db") returned 0x0 [0093.810] lstrlenW (lpString=".ndf") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".ndf") returned 0x0 [0093.810] lstrlenW (lpString=".NDF") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".NDF") returned 0x0 [0093.810] lstrlenW (lpString=".Mdf") returned 4 [0093.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".Mdf") returned 0x0 [0093.811] lstrlenW (lpString=".dat") returned 4 [0093.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".dat") returned 0x0 [0093.811] lstrlenW (lpString=".DAT") returned 4 [0093.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".DAT") returned 0x0 [0093.811] lstrlenW (lpString=".ldf") returned 4 [0093.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.811] lstrlenW (lpString=".LDF") returned 4 [0093.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch=".LDF") returned 0x0 [0093.811] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.811] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e738) returned 1 [0093.812] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.812] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0093.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.812] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21381313485) returned 1 [0093.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6ba5770, dwHighDateTime=0x1d585b4)) [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df520 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df520 | out: hHeap=0x260000) returned 1 [0093.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.813] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.813] GetLastError () returned 0x0 [0093.813] GetLastError () returned 0x0 [0093.813] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.813] GetLastError () returned 0x0 [0093.813] GetLastError () returned 0x0 [0093.816] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.816] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.817] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.817] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.818] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.818] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.818] CloseHandle (hObject=0x11c) returned 1 [0093.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0093.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0093.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.820] GetLastError () returned 0x0 [0093.820] RtlWakeConditionVariable () returned 0x0 [0093.820] GetCurrentThreadId () returned 0x998 [0093.820] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.820] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.820] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.820] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.822] CloseHandle (hObject=0x11c) returned 1 [0093.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0093.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.822] RtlWakeConditionVariable () returned 0x27e828 [0093.822] GetCurrentThreadId () returned 0x998 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".ldf") returned 0x0 [0093.823] lstrlenW (lpString=".vhd") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".vhd") returned 0x0 [0093.823] lstrlenW (lpString=".vhdx") returned 5 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".vhdx") returned 0x0 [0093.823] lstrlenW (lpString=".pst") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".pst") returned 0x0 [0093.823] lstrlenW (lpString=".ost") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".ost") returned 0x0 [0093.823] lstrlenW (lpString=".bak") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".bak") returned 0x0 [0093.823] lstrlenW (lpString=".bac") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".bac") returned 0x0 [0093.823] lstrlenW (lpString=".sys") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".sys") returned 0x0 [0093.823] lstrlenW (lpString=".v2i") returned 4 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".v2i") returned 0x0 [0093.823] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0093.825] lstrlenW (lpString=".sql") returned 4 [0093.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".sql") returned 0x0 [0093.825] lstrlenW (lpString=".mdf") returned 4 [0093.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".mdf") returned 0x0 [0093.825] lstrlenW (lpString=".txt") returned 4 [0093.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".txt") returned 0x0 [0093.825] lstrlenW (lpString=".dbf") returned 4 [0093.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".dbf") returned 0x0 [0093.825] lstrlenW (lpString=".ckp") returned 4 [0093.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".ckp") returned 0x0 [0093.825] lstrlenW (lpString=".dacpac") returned 7 [0093.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".dacpac") returned 0x0 [0093.826] lstrlenW (lpString=".db3") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".db3") returned 0x0 [0093.826] lstrlenW (lpString=".dtxs") returned 5 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".dtxs") returned 0x0 [0093.826] lstrlenW (lpString=".mdt") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".mdt") returned 0x0 [0093.826] lstrlenW (lpString=".sdf") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".sdf") returned 0x0 [0093.826] lstrlenW (lpString=".MDF") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".MDF") returned 0x0 [0093.826] lstrlenW (lpString=".DBF") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".DBF") returned 0x0 [0093.826] lstrlenW (lpString=".DB") returned 3 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".DB") returned 0x0 [0093.826] lstrlenW (lpString=".db") returned 3 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".db") returned 0x0 [0093.826] lstrlenW (lpString=".ndf") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".ndf") returned 0x0 [0093.826] lstrlenW (lpString=".NDF") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".NDF") returned 0x0 [0093.826] lstrlenW (lpString=".Mdf") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".Mdf") returned 0x0 [0093.826] lstrlenW (lpString=".dat") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".dat") returned 0x0 [0093.826] lstrlenW (lpString=".DAT") returned 4 [0093.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".DAT") returned 0x0 [0093.827] lstrlenW (lpString=".ldf") returned 4 [0093.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".ldf") returned 0x0 [0093.827] lstrlenW (lpString=".LDF") returned 4 [0093.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch=".LDF") returned 0x0 [0093.827] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.827] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e8d0) returned 1 [0093.828] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.828] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0093.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.828] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21382902555) returned 1 [0093.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6bcb8d0, dwHighDateTime=0x1d585b4)) [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df590 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df590 | out: hHeap=0x260000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.829] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0093.829] GetLastError () returned 0x0 [0093.829] GetLastError () returned 0x0 [0093.829] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0093.829] GetLastError () returned 0x0 [0093.829] GetLastError () returned 0x0 [0093.945] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.945] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.946] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.946] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.034] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.034] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.034] CloseHandle (hObject=0x11c) returned 1 [0094.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.065] GetLastError () returned 0x0 [0094.065] RtlWakeConditionVariable () returned 0x0 [0094.066] GetCurrentThreadId () returned 0x998 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".ldf") returned 0x0 [0094.066] lstrlenW (lpString=".vhd") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".vhd") returned 0x0 [0094.066] lstrlenW (lpString=".vhdx") returned 5 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".vhdx") returned 0x0 [0094.066] lstrlenW (lpString=".pst") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".pst") returned 0x0 [0094.066] lstrlenW (lpString=".ost") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".ost") returned 0x0 [0094.066] lstrlenW (lpString=".bak") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".bak") returned 0x0 [0094.066] lstrlenW (lpString=".bac") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".bac") returned 0x0 [0094.066] lstrlenW (lpString=".sys") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".sys") returned 0x0 [0094.066] lstrlenW (lpString=".v2i") returned 4 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".v2i") returned 0x0 [0094.066] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch="s\r\n.v2i") returned 0x0 [0094.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.068] lstrlenW (lpString=".sql") returned 4 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".sql") returned 0x0 [0094.068] lstrlenW (lpString=".mdf") returned 4 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".mdf") returned 0x0 [0094.068] lstrlenW (lpString=".txt") returned 4 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".txt") returned 0x0 [0094.068] lstrlenW (lpString=".dbf") returned 4 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".dbf") returned 0x0 [0094.068] lstrlenW (lpString=".ckp") returned 4 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".ckp") returned 0x0 [0094.068] lstrlenW (lpString=".dacpac") returned 7 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".dacpac") returned 0x0 [0094.068] lstrlenW (lpString=".db3") returned 4 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".db3") returned 0x0 [0094.068] lstrlenW (lpString=".dtxs") returned 5 [0094.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".dtxs") returned 0x0 [0094.068] lstrlenW (lpString=".mdt") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".mdt") returned 0x0 [0094.069] lstrlenW (lpString=".sdf") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".sdf") returned 0x0 [0094.069] lstrlenW (lpString=".MDF") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".MDF") returned 0x0 [0094.069] lstrlenW (lpString=".DBF") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".DBF") returned 0x0 [0094.069] lstrlenW (lpString=".DB") returned 3 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".DB") returned 0x0 [0094.069] lstrlenW (lpString=".db") returned 3 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".db") returned 0x0 [0094.069] lstrlenW (lpString=".ndf") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".ndf") returned 0x0 [0094.069] lstrlenW (lpString=".NDF") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".NDF") returned 0x0 [0094.069] lstrlenW (lpString=".Mdf") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".Mdf") returned 0x0 [0094.069] lstrlenW (lpString=".dat") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".dat") returned 0x0 [0094.069] lstrlenW (lpString=".DAT") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".DAT") returned 0x0 [0094.069] lstrlenW (lpString=".ldf") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".ldf") returned 0x0 [0094.069] lstrlenW (lpString=".LDF") returned 4 [0094.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch=".LDF") returned 0x0 [0094.070] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.070] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33eb78) returned 1 [0094.071] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.071] CryptReleaseContext (hProv=0x33eb78, dwFlags=0x0) returned 1 [0094.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.071] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21407207307) returned 1 [0094.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6e2ced0, dwHighDateTime=0x1d585b4)) [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df948 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df948 | out: hHeap=0x260000) returned 1 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.072] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.072] GetLastError () returned 0x0 [0094.072] GetLastError () returned 0x0 [0094.072] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.072] GetLastError () returned 0x0 [0094.072] GetLastError () returned 0x0 [0094.075] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.076] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.076] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.076] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.078] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.078] CloseHandle (hObject=0x11c) returned 1 [0094.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.[deadmin@cock.li].deadmin")) returned 1 [0094.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.080] GetLastError () returned 0x0 [0094.080] RtlWakeConditionVariable () returned 0x0 [0094.080] GetCurrentThreadId () returned 0x998 [0094.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".ldf") returned 0x0 [0094.080] lstrlenW (lpString=".vhd") returned 4 [0094.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".vhd") returned 0x0 [0094.080] lstrlenW (lpString=".vhdx") returned 5 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".vhdx") returned 0x0 [0094.081] lstrlenW (lpString=".pst") returned 4 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".pst") returned 0x0 [0094.081] lstrlenW (lpString=".ost") returned 4 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".ost") returned 0x0 [0094.081] lstrlenW (lpString=".bak") returned 4 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".bak") returned 0x0 [0094.081] lstrlenW (lpString=".bac") returned 4 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".bac") returned 0x0 [0094.081] lstrlenW (lpString=".sys") returned 4 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".sys") returned 0x0 [0094.081] lstrlenW (lpString=".v2i") returned 4 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".v2i") returned 0x0 [0094.081] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.082] lstrlenW (lpString=".sql") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".sql") returned 0x0 [0094.083] lstrlenW (lpString=".mdf") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".mdf") returned 0x0 [0094.083] lstrlenW (lpString=".txt") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".txt") returned 0x0 [0094.083] lstrlenW (lpString=".dbf") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".dbf") returned 0x0 [0094.083] lstrlenW (lpString=".ckp") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".ckp") returned 0x0 [0094.083] lstrlenW (lpString=".dacpac") returned 7 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".dacpac") returned 0x0 [0094.083] lstrlenW (lpString=".db3") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".db3") returned 0x0 [0094.083] lstrlenW (lpString=".dtxs") returned 5 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".dtxs") returned 0x0 [0094.083] lstrlenW (lpString=".mdt") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".mdt") returned 0x0 [0094.083] lstrlenW (lpString=".sdf") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".sdf") returned 0x0 [0094.083] lstrlenW (lpString=".MDF") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".MDF") returned 0x0 [0094.083] lstrlenW (lpString=".DBF") returned 4 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".DBF") returned 0x0 [0094.083] lstrlenW (lpString=".DB") returned 3 [0094.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".DB") returned 0x0 [0094.083] lstrlenW (lpString=".db") returned 3 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".db") returned 0x0 [0094.084] lstrlenW (lpString=".ndf") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".ndf") returned 0x0 [0094.084] lstrlenW (lpString=".NDF") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".NDF") returned 0x0 [0094.084] lstrlenW (lpString=".Mdf") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".Mdf") returned 0x0 [0094.084] lstrlenW (lpString=".dat") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".dat") returned 0x0 [0094.084] lstrlenW (lpString=".DAT") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".DAT") returned 0x0 [0094.084] lstrlenW (lpString=".ldf") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".ldf") returned 0x0 [0094.084] lstrlenW (lpString=".LDF") returned 4 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch=".LDF") returned 0x0 [0094.084] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.084] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e738) returned 1 [0094.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.085] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0094.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.085] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21408639414) returned 1 [0094.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6e53030, dwHighDateTime=0x1d585b4)) [0094.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df980 [0094.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df980 | out: hHeap=0x260000) returned 1 [0094.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0094.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0094.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.086] GetLastError () returned 0x0 [0094.086] GetLastError () returned 0x0 [0094.086] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.086] GetLastError () returned 0x0 [0094.087] GetLastError () returned 0x0 [0094.089] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.090] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.091] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.091] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.092] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.093] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.093] CloseHandle (hObject=0x11c) returned 1 [0094.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.095] GetLastError () returned 0x0 [0094.095] RtlWakeConditionVariable () returned 0x0 [0094.095] GetCurrentThreadId () returned 0x998 [0094.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".ldf") returned 0x0 [0094.095] lstrlenW (lpString=".vhd") returned 4 [0094.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".vhd") returned 0x0 [0094.095] lstrlenW (lpString=".vhdx") returned 5 [0094.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".vhdx") returned 0x0 [0094.095] lstrlenW (lpString=".pst") returned 4 [0094.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".pst") returned 0x0 [0094.095] lstrlenW (lpString=".ost") returned 4 [0094.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".ost") returned 0x0 [0094.095] lstrlenW (lpString=".bak") returned 4 [0094.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".bak") returned 0x0 [0094.095] lstrlenW (lpString=".bac") returned 4 [0094.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".bac") returned 0x0 [0094.096] lstrlenW (lpString=".sys") returned 4 [0094.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".sys") returned 0x0 [0094.096] lstrlenW (lpString=".v2i") returned 4 [0094.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".v2i") returned 0x0 [0094.096] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.098] lstrlenW (lpString=".sql") returned 4 [0094.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".sql") returned 0x0 [0094.098] lstrlenW (lpString=".mdf") returned 4 [0094.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".mdf") returned 0x0 [0094.098] lstrlenW (lpString=".txt") returned 4 [0094.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".txt") returned 0x0 [0094.098] lstrlenW (lpString=".dbf") returned 4 [0094.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".dbf") returned 0x0 [0094.098] lstrlenW (lpString=".ckp") returned 4 [0094.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".ckp") returned 0x0 [0094.098] lstrlenW (lpString=".dacpac") returned 7 [0094.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".dacpac") returned 0x0 [0094.098] lstrlenW (lpString=".db3") returned 4 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".db3") returned 0x0 [0094.099] lstrlenW (lpString=".dtxs") returned 5 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".dtxs") returned 0x0 [0094.099] lstrlenW (lpString=".mdt") returned 4 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".mdt") returned 0x0 [0094.099] lstrlenW (lpString=".sdf") returned 4 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".sdf") returned 0x0 [0094.099] lstrlenW (lpString=".MDF") returned 4 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".MDF") returned 0x0 [0094.099] lstrlenW (lpString=".DBF") returned 4 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".DBF") returned 0x0 [0094.099] lstrlenW (lpString=".DB") returned 3 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".DB") returned 0x0 [0094.099] lstrlenW (lpString=".db") returned 3 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".db") returned 0x0 [0094.099] lstrlenW (lpString=".ndf") returned 4 [0094.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".ndf") returned 0x0 [0094.099] lstrlenW (lpString=".NDF") returned 4 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".NDF") returned 0x0 [0094.153] lstrlenW (lpString=".Mdf") returned 4 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".Mdf") returned 0x0 [0094.153] lstrlenW (lpString=".dat") returned 4 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".dat") returned 0x0 [0094.153] lstrlenW (lpString=".DAT") returned 4 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".DAT") returned 0x0 [0094.153] lstrlenW (lpString=".ldf") returned 4 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".ldf") returned 0x0 [0094.153] lstrlenW (lpString=".LDF") returned 4 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch=".LDF") returned 0x0 [0094.153] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0094.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.153] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33ec00) returned 1 [0094.154] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.157] CryptReleaseContext (hProv=0x33ec00, dwFlags=0x0) returned 1 [0094.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0094.157] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21415829666) returned 1 [0094.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc6eeb5b0, dwHighDateTime=0x1d585b4)) [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfad0 [0094.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfad0 | out: hHeap=0x260000) returned 1 [0094.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dd90 [0094.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.158] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.158] GetLastError () returned 0x0 [0094.158] GetLastError () returned 0x0 [0094.158] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.158] GetLastError () returned 0x0 [0094.159] GetLastError () returned 0x0 [0094.187] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.188] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.189] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.189] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.189] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.189] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.189] CloseHandle (hObject=0x11c) returned 1 [0094.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0094.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.[deadmin@cock.li].deadmin")) returned 1 [0094.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0094.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0094.191] GetLastError () returned 0x0 [0094.191] RtlWakeConditionVariable () returned 0x0 [0094.191] GetCurrentThreadId () returned 0x998 [0094.192] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.192] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.192] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0094.192] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0094.194] CloseHandle (hObject=0x11c) returned 1 [0094.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342f18 | out: hHeap=0x260000) returned 1 [0094.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.194] RtlWakeConditionVariable () returned 0x0 [0094.194] GetCurrentThreadId () returned 0x998 [0094.252] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.252] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.252] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0094.252] WriteFile (in: hFile=0xf0, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0094.254] CloseHandle (hObject=0xf0) returned 1 [0094.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d46a0 | out: hHeap=0x260000) returned 1 [0094.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.254] RtlWakeConditionVariable () returned 0x0 [0094.255] GetCurrentThreadId () returned 0x998 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".ldf") returned 0x0 [0094.255] lstrlenW (lpString=".vhd") returned 4 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".vhd") returned 0x0 [0094.255] lstrlenW (lpString=".vhdx") returned 5 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".vhdx") returned 0x0 [0094.255] lstrlenW (lpString=".pst") returned 4 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".pst") returned 0x0 [0094.255] lstrlenW (lpString=".ost") returned 4 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".ost") returned 0x0 [0094.255] lstrlenW (lpString=".bak") returned 4 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".bak") returned 0x0 [0094.255] lstrlenW (lpString=".bac") returned 4 [0094.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".bac") returned 0x0 [0094.255] lstrlenW (lpString=".sys") returned 4 [0094.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".sys") returned 0x0 [0094.256] lstrlenW (lpString=".v2i") returned 4 [0094.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".v2i") returned 0x0 [0094.256] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.280] lstrlenW (lpString=".sql") returned 4 [0094.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".sql") returned 0x0 [0094.280] lstrlenW (lpString=".mdf") returned 4 [0094.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".mdf") returned 0x0 [0094.280] lstrlenW (lpString=".txt") returned 4 [0094.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".txt") returned 0x0 [0094.280] lstrlenW (lpString=".dbf") returned 4 [0094.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".dbf") returned 0x0 [0094.280] lstrlenW (lpString=".ckp") returned 4 [0094.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".ckp") returned 0x0 [0094.281] lstrlenW (lpString=".dacpac") returned 7 [0094.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".dacpac") returned 0x0 [0094.281] lstrlenW (lpString=".db3") returned 4 [0094.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".db3") returned 0x0 [0094.281] lstrlenW (lpString=".dtxs") returned 5 [0094.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".dtxs") returned 0x0 [0094.284] lstrlenW (lpString=".mdt") returned 4 [0094.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".mdt") returned 0x0 [0094.284] lstrlenW (lpString=".sdf") returned 4 [0094.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".sdf") returned 0x0 [0094.284] lstrlenW (lpString=".MDF") returned 4 [0094.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".MDF") returned 0x0 [0094.284] lstrlenW (lpString=".DBF") returned 4 [0094.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".DBF") returned 0x0 [0094.284] lstrlenW (lpString=".DB") returned 3 [0094.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".DB") returned 0x0 [0094.290] lstrlenW (lpString=".db") returned 3 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".db") returned 0x0 [0094.290] lstrlenW (lpString=".ndf") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".ndf") returned 0x0 [0094.290] lstrlenW (lpString=".NDF") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".NDF") returned 0x0 [0094.290] lstrlenW (lpString=".Mdf") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".Mdf") returned 0x0 [0094.290] lstrlenW (lpString=".dat") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".dat") returned 0x0 [0094.290] lstrlenW (lpString=".DAT") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".DAT") returned 0x0 [0094.290] lstrlenW (lpString=".ldf") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".ldf") returned 0x0 [0094.290] lstrlenW (lpString=".LDF") returned 4 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch=".LDF") returned 0x0 [0094.290] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.290] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33e8d0) returned 1 [0094.291] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.291] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0094.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.291] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21429255369) returned 1 [0094.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7042210, dwHighDateTime=0x1d585b4)) [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfda8 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfda8 | out: hHeap=0x260000) returned 1 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.292] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.292] GetLastError () returned 0x0 [0094.292] GetLastError () returned 0x0 [0094.293] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.293] GetLastError () returned 0x0 [0094.293] GetLastError () returned 0x0 [0094.296] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.296] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.298] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.299] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.299] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.299] CloseHandle (hObject=0xf0) returned 1 [0094.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.301] GetLastError () returned 0x0 [0094.301] RtlWakeConditionVariable () returned 0x0 [0094.301] GetCurrentThreadId () returned 0x998 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".ldf") returned 0x0 [0094.302] lstrlenW (lpString=".vhd") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".vhd") returned 0x0 [0094.302] lstrlenW (lpString=".vhdx") returned 5 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".vhdx") returned 0x0 [0094.302] lstrlenW (lpString=".pst") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".pst") returned 0x0 [0094.302] lstrlenW (lpString=".ost") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".ost") returned 0x0 [0094.302] lstrlenW (lpString=".bak") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".bak") returned 0x0 [0094.302] lstrlenW (lpString=".bac") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".bac") returned 0x0 [0094.302] lstrlenW (lpString=".sys") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".sys") returned 0x0 [0094.302] lstrlenW (lpString=".v2i") returned 4 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".v2i") returned 0x0 [0094.302] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.317] lstrlenW (lpString=".sql") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".sql") returned 0x0 [0094.317] lstrlenW (lpString=".mdf") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".mdf") returned 0x0 [0094.317] lstrlenW (lpString=".txt") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".txt") returned 0x0 [0094.317] lstrlenW (lpString=".dbf") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".dbf") returned 0x0 [0094.317] lstrlenW (lpString=".ckp") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".ckp") returned 0x0 [0094.317] lstrlenW (lpString=".dacpac") returned 7 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".dacpac") returned 0x0 [0094.317] lstrlenW (lpString=".db3") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".db3") returned 0x0 [0094.317] lstrlenW (lpString=".dtxs") returned 5 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".dtxs") returned 0x0 [0094.317] lstrlenW (lpString=".mdt") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".mdt") returned 0x0 [0094.317] lstrlenW (lpString=".sdf") returned 4 [0094.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".sdf") returned 0x0 [0094.317] lstrlenW (lpString=".MDF") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".MDF") returned 0x0 [0094.318] lstrlenW (lpString=".DBF") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".DBF") returned 0x0 [0094.318] lstrlenW (lpString=".DB") returned 3 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".DB") returned 0x0 [0094.318] lstrlenW (lpString=".db") returned 3 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".db") returned 0x0 [0094.318] lstrlenW (lpString=".ndf") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".ndf") returned 0x0 [0094.318] lstrlenW (lpString=".NDF") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".NDF") returned 0x0 [0094.318] lstrlenW (lpString=".Mdf") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".Mdf") returned 0x0 [0094.318] lstrlenW (lpString=".dat") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".dat") returned 0x0 [0094.318] lstrlenW (lpString=".DAT") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".DAT") returned 0x0 [0094.318] lstrlenW (lpString=".ldf") returned 4 [0094.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".ldf") returned 0x0 [0094.318] lstrlenW (lpString=".LDF") returned 4 [0094.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch=".LDF") returned 0x0 [0094.319] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.319] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33f6a0) returned 1 [0094.319] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.319] CryptReleaseContext (hProv=0x33f6a0, dwFlags=0x0) returned 1 [0094.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.320] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21432081586) returned 1 [0094.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc708e4d0, dwHighDateTime=0x1d585b4)) [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfde0 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfde0 | out: hHeap=0x260000) returned 1 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.320] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.321] GetLastError () returned 0x0 [0094.321] GetLastError () returned 0x0 [0094.321] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.321] GetLastError () returned 0x0 [0094.321] GetLastError () returned 0x0 [0094.325] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffa60a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.325] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x59f6, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x59f6, lpOverlapped=0x0) returned 1 [0094.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.326] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.326] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.326] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.326] CloseHandle (hObject=0xd8) returned 1 [0094.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.327] GetLastError () returned 0x0 [0094.328] RtlWakeConditionVariable () returned 0x0 [0094.328] GetCurrentThreadId () returned 0x998 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".ldf") returned 0x0 [0094.328] lstrlenW (lpString=".vhd") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".vhd") returned 0x0 [0094.328] lstrlenW (lpString=".vhdx") returned 5 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".vhdx") returned 0x0 [0094.328] lstrlenW (lpString=".pst") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".pst") returned 0x0 [0094.328] lstrlenW (lpString=".ost") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".ost") returned 0x0 [0094.328] lstrlenW (lpString=".bak") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".bak") returned 0x0 [0094.328] lstrlenW (lpString=".bac") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".bac") returned 0x0 [0094.328] lstrlenW (lpString=".sys") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".sys") returned 0x0 [0094.328] lstrlenW (lpString=".v2i") returned 4 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".v2i") returned 0x0 [0094.328] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.329] lstrlenW (lpString=".sql") returned 4 [0094.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".sql") returned 0x0 [0094.329] lstrlenW (lpString=".mdf") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".mdf") returned 0x0 [0094.330] lstrlenW (lpString=".txt") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".txt") returned 0x0 [0094.330] lstrlenW (lpString=".dbf") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".dbf") returned 0x0 [0094.330] lstrlenW (lpString=".ckp") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".ckp") returned 0x0 [0094.330] lstrlenW (lpString=".dacpac") returned 7 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".dacpac") returned 0x0 [0094.330] lstrlenW (lpString=".db3") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".db3") returned 0x0 [0094.330] lstrlenW (lpString=".dtxs") returned 5 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".dtxs") returned 0x0 [0094.330] lstrlenW (lpString=".mdt") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".mdt") returned 0x0 [0094.330] lstrlenW (lpString=".sdf") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".sdf") returned 0x0 [0094.330] lstrlenW (lpString=".MDF") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".MDF") returned 0x0 [0094.330] lstrlenW (lpString=".DBF") returned 4 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".DBF") returned 0x0 [0094.330] lstrlenW (lpString=".DB") returned 3 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".DB") returned 0x0 [0094.330] lstrlenW (lpString=".db") returned 3 [0094.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".db") returned 0x0 [0094.331] lstrlenW (lpString=".ndf") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".ndf") returned 0x0 [0094.331] lstrlenW (lpString=".NDF") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".NDF") returned 0x0 [0094.331] lstrlenW (lpString=".Mdf") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".Mdf") returned 0x0 [0094.331] lstrlenW (lpString=".dat") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".dat") returned 0x0 [0094.331] lstrlenW (lpString=".DAT") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".DAT") returned 0x0 [0094.331] lstrlenW (lpString=".ldf") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".ldf") returned 0x0 [0094.331] lstrlenW (lpString=".LDF") returned 4 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch=".LDF") returned 0x0 [0094.331] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.331] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33f7b0) returned 1 [0094.332] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.332] CryptReleaseContext (hProv=0x33f7b0, dwFlags=0x0) returned 1 [0094.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.332] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21433332178) returned 1 [0094.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc708e4d0, dwHighDateTime=0x1d585b4)) [0094.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfe18 [0094.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfe18 | out: hHeap=0x260000) returned 1 [0094.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.333] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.333] GetLastError () returned 0x0 [0094.359] GetLastError () returned 0x0 [0094.359] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.359] GetLastError () returned 0x0 [0094.359] GetLastError () returned 0x0 [0094.488] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.488] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.488] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.488] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.599] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.599] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.599] CloseHandle (hObject=0xd8) returned 1 [0094.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.658] GetLastError () returned 0x0 [0094.658] RtlWakeConditionVariable () returned 0x0 [0094.658] GetCurrentThreadId () returned 0x998 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".ldf") returned 0x0 [0094.659] lstrlenW (lpString=".vhd") returned 4 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".vhd") returned 0x0 [0094.659] lstrlenW (lpString=".vhdx") returned 5 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".vhdx") returned 0x0 [0094.659] lstrlenW (lpString=".pst") returned 4 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".pst") returned 0x0 [0094.659] lstrlenW (lpString=".ost") returned 4 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".ost") returned 0x0 [0094.659] lstrlenW (lpString=".bak") returned 4 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".bak") returned 0x0 [0094.659] lstrlenW (lpString=".bac") returned 4 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".bac") returned 0x0 [0094.659] lstrlenW (lpString=".sys") returned 4 [0094.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".sys") returned 0x0 [0094.660] lstrlenW (lpString=".v2i") returned 4 [0094.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".v2i") returned 0x0 [0094.660] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.661] lstrlenW (lpString=".sql") returned 4 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".sql") returned 0x0 [0094.661] lstrlenW (lpString=".mdf") returned 4 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".mdf") returned 0x0 [0094.661] lstrlenW (lpString=".txt") returned 4 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".txt") returned 0x0 [0094.661] lstrlenW (lpString=".dbf") returned 4 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".dbf") returned 0x0 [0094.661] lstrlenW (lpString=".ckp") returned 4 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".ckp") returned 0x0 [0094.661] lstrlenW (lpString=".dacpac") returned 7 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".dacpac") returned 0x0 [0094.661] lstrlenW (lpString=".db3") returned 4 [0094.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".db3") returned 0x0 [0094.661] lstrlenW (lpString=".dtxs") returned 5 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".dtxs") returned 0x0 [0094.662] lstrlenW (lpString=".mdt") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".mdt") returned 0x0 [0094.662] lstrlenW (lpString=".sdf") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".sdf") returned 0x0 [0094.662] lstrlenW (lpString=".MDF") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".MDF") returned 0x0 [0094.662] lstrlenW (lpString=".DBF") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".DBF") returned 0x0 [0094.662] lstrlenW (lpString=".DB") returned 3 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".DB") returned 0x0 [0094.662] lstrlenW (lpString=".db") returned 3 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".db") returned 0x0 [0094.662] lstrlenW (lpString=".ndf") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".ndf") returned 0x0 [0094.662] lstrlenW (lpString=".NDF") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".NDF") returned 0x0 [0094.662] lstrlenW (lpString=".Mdf") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".Mdf") returned 0x0 [0094.662] lstrlenW (lpString=".dat") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".dat") returned 0x0 [0094.662] lstrlenW (lpString=".DAT") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".DAT") returned 0x0 [0094.662] lstrlenW (lpString=".ldf") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".ldf") returned 0x0 [0094.662] lstrlenW (lpString=".LDF") returned 4 [0094.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch=".LDF") returned 0x0 [0094.663] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.663] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33f838) returned 1 [0094.663] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.663] CryptReleaseContext (hProv=0x33f838, dwFlags=0x0) returned 1 [0094.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.664] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21466477793) returned 1 [0094.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc73d4310, dwHighDateTime=0x1d585b4)) [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0198 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0198 | out: hHeap=0x260000) returned 1 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.664] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.664] GetLastError () returned 0x0 [0094.665] GetLastError () returned 0x0 [0094.665] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.665] GetLastError () returned 0x0 [0094.665] GetLastError () returned 0x0 [0094.667] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd47c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.667] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2b84, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x2b84, lpOverlapped=0x0) returned 1 [0094.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.668] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.668] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.668] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.668] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.668] CloseHandle (hObject=0x11c) returned 1 [0094.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.669] GetLastError () returned 0x0 [0094.669] RtlWakeConditionVariable () returned 0x0 [0094.669] GetCurrentThreadId () returned 0x998 [0094.670] lstrcpyW (in: lpString1=0x1cfedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.670] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.670] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0094.670] WriteFile (in: hFile=0x11c, lpBuffer=0x1cfedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x1cfedb8, lpOverlapped=0x0 | out: lpBuffer=0x1cfedbc*, lpNumberOfBytesWritten=0x1cfedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0094.671] CloseHandle (hObject=0x11c) returned 1 [0094.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317ee8 | out: hHeap=0x260000) returned 1 [0094.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.672] RtlWakeConditionVariable () returned 0x27e828 [0094.672] GetCurrentThreadId () returned 0x998 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".ldf") returned 0x0 [0094.672] lstrlenW (lpString=".vhd") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".vhd") returned 0x0 [0094.672] lstrlenW (lpString=".vhdx") returned 5 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".vhdx") returned 0x0 [0094.672] lstrlenW (lpString=".pst") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".pst") returned 0x0 [0094.672] lstrlenW (lpString=".ost") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".ost") returned 0x0 [0094.672] lstrlenW (lpString=".bak") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".bak") returned 0x0 [0094.672] lstrlenW (lpString=".bac") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".bac") returned 0x0 [0094.672] lstrlenW (lpString=".sys") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".sys") returned 0x0 [0094.672] lstrlenW (lpString=".v2i") returned 4 [0094.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".v2i") returned 0x0 [0094.672] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.674] lstrlenW (lpString=".sql") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".sql") returned 0x0 [0094.674] lstrlenW (lpString=".mdf") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".mdf") returned 0x0 [0094.674] lstrlenW (lpString=".txt") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".txt") returned 0x0 [0094.674] lstrlenW (lpString=".dbf") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".dbf") returned 0x0 [0094.674] lstrlenW (lpString=".ckp") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".ckp") returned 0x0 [0094.674] lstrlenW (lpString=".dacpac") returned 7 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".dacpac") returned 0x0 [0094.674] lstrlenW (lpString=".db3") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".db3") returned 0x0 [0094.674] lstrlenW (lpString=".dtxs") returned 5 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".dtxs") returned 0x0 [0094.674] lstrlenW (lpString=".mdt") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".mdt") returned 0x0 [0094.674] lstrlenW (lpString=".sdf") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".sdf") returned 0x0 [0094.674] lstrlenW (lpString=".MDF") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".MDF") returned 0x0 [0094.674] lstrlenW (lpString=".DBF") returned 4 [0094.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".DBF") returned 0x0 [0094.675] lstrlenW (lpString=".DB") returned 3 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".DB") returned 0x0 [0094.675] lstrlenW (lpString=".db") returned 3 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".db") returned 0x0 [0094.675] lstrlenW (lpString=".ndf") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".ndf") returned 0x0 [0094.675] lstrlenW (lpString=".NDF") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".NDF") returned 0x0 [0094.675] lstrlenW (lpString=".Mdf") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".Mdf") returned 0x0 [0094.675] lstrlenW (lpString=".dat") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".dat") returned 0x0 [0094.675] lstrlenW (lpString=".DAT") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".DAT") returned 0x0 [0094.675] lstrlenW (lpString=".ldf") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".ldf") returned 0x0 [0094.675] lstrlenW (lpString=".LDF") returned 4 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch=".LDF") returned 0x0 [0094.675] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.675] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33f150) returned 1 [0094.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.676] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.676] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21467742487) returned 1 [0094.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc73fa470, dwHighDateTime=0x1d585b4)) [0094.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0208 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0208 | out: hHeap=0x260000) returned 1 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317ee8 [0094.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317ee8 | out: hHeap=0x260000) returned 1 [0094.677] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.677] GetLastError () returned 0x0 [0094.677] GetLastError () returned 0x0 [0094.678] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.678] GetLastError () returned 0x0 [0094.678] GetLastError () returned 0x0 [0094.680] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.680] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.681] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.681] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.681] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.681] CloseHandle (hObject=0x11c) returned 1 [0094.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0094.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0094.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.682] GetLastError () returned 0x0 [0094.683] RtlWakeConditionVariable () returned 0x0 [0094.683] GetCurrentThreadId () returned 0x998 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".ldf") returned 0x0 [0094.683] lstrlenW (lpString=".vhd") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".vhd") returned 0x0 [0094.683] lstrlenW (lpString=".vhdx") returned 5 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".vhdx") returned 0x0 [0094.683] lstrlenW (lpString=".pst") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".pst") returned 0x0 [0094.683] lstrlenW (lpString=".ost") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".ost") returned 0x0 [0094.683] lstrlenW (lpString=".bak") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".bak") returned 0x0 [0094.683] lstrlenW (lpString=".bac") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".bac") returned 0x0 [0094.683] lstrlenW (lpString=".sys") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".sys") returned 0x0 [0094.683] lstrlenW (lpString=".v2i") returned 4 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".v2i") returned 0x0 [0094.683] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.684] lstrlenW (lpString=".sql") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".sql") returned 0x0 [0094.685] lstrlenW (lpString=".mdf") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".mdf") returned 0x0 [0094.685] lstrlenW (lpString=".txt") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".txt") returned 0x0 [0094.685] lstrlenW (lpString=".dbf") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".dbf") returned 0x0 [0094.685] lstrlenW (lpString=".ckp") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".ckp") returned 0x0 [0094.685] lstrlenW (lpString=".dacpac") returned 7 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".dacpac") returned 0x0 [0094.685] lstrlenW (lpString=".db3") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".db3") returned 0x0 [0094.685] lstrlenW (lpString=".dtxs") returned 5 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".dtxs") returned 0x0 [0094.685] lstrlenW (lpString=".mdt") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".mdt") returned 0x0 [0094.685] lstrlenW (lpString=".sdf") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".sdf") returned 0x0 [0094.685] lstrlenW (lpString=".MDF") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".MDF") returned 0x0 [0094.685] lstrlenW (lpString=".DBF") returned 4 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".DBF") returned 0x0 [0094.685] lstrlenW (lpString=".DB") returned 3 [0094.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".DB") returned 0x0 [0094.685] lstrlenW (lpString=".db") returned 3 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".db") returned 0x0 [0094.686] lstrlenW (lpString=".ndf") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".ndf") returned 0x0 [0094.686] lstrlenW (lpString=".NDF") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".NDF") returned 0x0 [0094.686] lstrlenW (lpString=".Mdf") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".Mdf") returned 0x0 [0094.686] lstrlenW (lpString=".dat") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".dat") returned 0x0 [0094.686] lstrlenW (lpString=".DAT") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".DAT") returned 0x0 [0094.686] lstrlenW (lpString=".ldf") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".ldf") returned 0x0 [0094.686] lstrlenW (lpString=".LDF") returned 4 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch=".LDF") returned 0x0 [0094.686] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.686] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33f150) returned 1 [0094.687] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.687] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.687] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21468838098) returned 1 [0094.687] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc73fa470, dwHighDateTime=0x1d585b4)) [0094.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0240 [0094.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0240 | out: hHeap=0x260000) returned 1 [0094.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317f90 [0094.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317f90 | out: hHeap=0x260000) returned 1 [0094.688] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.688] GetLastError () returned 0x0 [0094.688] GetLastError () returned 0x0 [0094.688] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.688] GetLastError () returned 0x0 [0094.689] GetLastError () returned 0x0 [0094.691] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.691] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.692] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.692] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.748] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.748] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.748] CloseHandle (hObject=0x11c) returned 1 [0094.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27dc318 [0094.748] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc318 | out: hHeap=0x260000) returned 1 [0094.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.750] GetLastError () returned 0x0 [0094.750] RtlWakeConditionVariable () returned 0x0 [0094.750] GetCurrentThreadId () returned 0x998 [0094.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".ldf") returned 0x0 [0094.772] lstrlenW (lpString=".vhd") returned 4 [0094.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".vhd") returned 0x0 [0094.772] lstrlenW (lpString=".vhdx") returned 5 [0094.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".vhdx") returned 0x0 [0094.772] lstrlenW (lpString=".pst") returned 4 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".pst") returned 0x0 [0094.773] lstrlenW (lpString=".ost") returned 4 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".ost") returned 0x0 [0094.773] lstrlenW (lpString=".bak") returned 4 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".bak") returned 0x0 [0094.773] lstrlenW (lpString=".bac") returned 4 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".bac") returned 0x0 [0094.773] lstrlenW (lpString=".sys") returned 4 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".sys") returned 0x0 [0094.773] lstrlenW (lpString=".v2i") returned 4 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".v2i") returned 0x0 [0094.773] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.778] lstrlenW (lpString=".sql") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".sql") returned 0x0 [0094.778] lstrlenW (lpString=".mdf") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".mdf") returned 0x0 [0094.778] lstrlenW (lpString=".txt") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".txt") returned 0x0 [0094.778] lstrlenW (lpString=".dbf") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".dbf") returned 0x0 [0094.778] lstrlenW (lpString=".ckp") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".ckp") returned 0x0 [0094.778] lstrlenW (lpString=".dacpac") returned 7 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".dacpac") returned 0x0 [0094.778] lstrlenW (lpString=".db3") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".db3") returned 0x0 [0094.778] lstrlenW (lpString=".dtxs") returned 5 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".dtxs") returned 0x0 [0094.778] lstrlenW (lpString=".mdt") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".mdt") returned 0x0 [0094.778] lstrlenW (lpString=".sdf") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".sdf") returned 0x0 [0094.778] lstrlenW (lpString=".MDF") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".MDF") returned 0x0 [0094.778] lstrlenW (lpString=".DBF") returned 4 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".DBF") returned 0x0 [0094.778] lstrlenW (lpString=".DB") returned 3 [0094.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".DB") returned 0x0 [0094.779] lstrlenW (lpString=".db") returned 3 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".db") returned 0x0 [0094.779] lstrlenW (lpString=".ndf") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".ndf") returned 0x0 [0094.779] lstrlenW (lpString=".NDF") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".NDF") returned 0x0 [0094.779] lstrlenW (lpString=".Mdf") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".Mdf") returned 0x0 [0094.779] lstrlenW (lpString=".dat") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".dat") returned 0x0 [0094.779] lstrlenW (lpString=".DAT") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".DAT") returned 0x0 [0094.779] lstrlenW (lpString=".ldf") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".ldf") returned 0x0 [0094.779] lstrlenW (lpString=".LDF") returned 4 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch=".LDF") returned 0x0 [0094.779] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.779] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33fd00) returned 1 [0094.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.780] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.780] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21478134633) returned 1 [0094.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc74decb0, dwHighDateTime=0x1d585b4)) [0094.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0390 [0094.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0390 | out: hHeap=0x260000) returned 1 [0094.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.781] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.781] GetLastError () returned 0x0 [0094.781] GetLastError () returned 0x0 [0094.781] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.781] GetLastError () returned 0x0 [0094.782] GetLastError () returned 0x0 [0094.799] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.799] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.800] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.800] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.800] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.800] CloseHandle (hObject=0x11c) returned 1 [0094.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0094.800] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0094.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.804] GetLastError () returned 0x0 [0094.804] RtlWakeConditionVariable () returned 0x27e828 [0094.804] GetCurrentThreadId () returned 0x998 [0094.804] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".ldf") returned 0x0 [0094.805] lstrlenW (lpString=".vhd") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".vhd") returned 0x0 [0094.805] lstrlenW (lpString=".vhdx") returned 5 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".vhdx") returned 0x0 [0094.805] lstrlenW (lpString=".pst") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".pst") returned 0x0 [0094.805] lstrlenW (lpString=".ost") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".ost") returned 0x0 [0094.805] lstrlenW (lpString=".bak") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".bak") returned 0x0 [0094.805] lstrlenW (lpString=".bac") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".bac") returned 0x0 [0094.805] lstrlenW (lpString=".sys") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".sys") returned 0x0 [0094.805] lstrlenW (lpString=".v2i") returned 4 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".v2i") returned 0x0 [0094.805] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.806] lstrlenW (lpString=".sql") returned 4 [0094.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".sql") returned 0x0 [0094.806] lstrlenW (lpString=".mdf") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".mdf") returned 0x0 [0094.807] lstrlenW (lpString=".txt") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".txt") returned 0x0 [0094.807] lstrlenW (lpString=".dbf") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".dbf") returned 0x0 [0094.807] lstrlenW (lpString=".ckp") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".ckp") returned 0x0 [0094.807] lstrlenW (lpString=".dacpac") returned 7 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".dacpac") returned 0x0 [0094.807] lstrlenW (lpString=".db3") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".db3") returned 0x0 [0094.807] lstrlenW (lpString=".dtxs") returned 5 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".dtxs") returned 0x0 [0094.807] lstrlenW (lpString=".mdt") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".mdt") returned 0x0 [0094.807] lstrlenW (lpString=".sdf") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".sdf") returned 0x0 [0094.807] lstrlenW (lpString=".MDF") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".MDF") returned 0x0 [0094.807] lstrlenW (lpString=".DBF") returned 4 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".DBF") returned 0x0 [0094.807] lstrlenW (lpString=".DB") returned 3 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".DB") returned 0x0 [0094.807] lstrlenW (lpString=".db") returned 3 [0094.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".db") returned 0x0 [0094.807] lstrlenW (lpString=".ndf") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".ndf") returned 0x0 [0094.808] lstrlenW (lpString=".NDF") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".NDF") returned 0x0 [0094.808] lstrlenW (lpString=".Mdf") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".Mdf") returned 0x0 [0094.808] lstrlenW (lpString=".dat") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".dat") returned 0x0 [0094.808] lstrlenW (lpString=".DAT") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".DAT") returned 0x0 [0094.808] lstrlenW (lpString=".ldf") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".ldf") returned 0x0 [0094.808] lstrlenW (lpString=".LDF") returned 4 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch=".LDF") returned 0x0 [0094.808] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.808] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.808] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33fd00) returned 1 [0094.809] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.809] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.809] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21481022635) returned 1 [0094.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc752af70, dwHighDateTime=0x1d585b4)) [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0438 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0438 | out: hHeap=0x260000) returned 1 [0094.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.810] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.810] GetLastError () returned 0x0 [0094.810] GetLastError () returned 0x0 [0094.810] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.810] GetLastError () returned 0x0 [0094.810] GetLastError () returned 0x0 [0094.837] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.837] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.837] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.837] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.844] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.844] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.844] CloseHandle (hObject=0x11c) returned 1 [0094.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.846] GetLastError () returned 0x0 [0094.846] RtlWakeConditionVariable () returned 0x0 [0094.846] GetCurrentThreadId () returned 0x998 [0094.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".ldf") returned 0x0 [0094.846] lstrlenW (lpString=".vhd") returned 4 [0094.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".vhd") returned 0x0 [0094.846] lstrlenW (lpString=".vhdx") returned 5 [0094.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".vhdx") returned 0x0 [0094.846] lstrlenW (lpString=".pst") returned 4 [0094.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".pst") returned 0x0 [0094.846] lstrlenW (lpString=".ost") returned 4 [0094.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".ost") returned 0x0 [0094.846] lstrlenW (lpString=".bak") returned 4 [0094.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".bak") returned 0x0 [0094.847] lstrlenW (lpString=".bac") returned 4 [0094.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".bac") returned 0x0 [0094.847] lstrlenW (lpString=".sys") returned 4 [0094.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".sys") returned 0x0 [0094.847] lstrlenW (lpString=".v2i") returned 4 [0094.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".v2i") returned 0x0 [0094.847] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.848] lstrlenW (lpString=".sql") returned 4 [0094.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".sql") returned 0x0 [0094.848] lstrlenW (lpString=".mdf") returned 4 [0094.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".mdf") returned 0x0 [0094.848] lstrlenW (lpString=".txt") returned 4 [0094.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".txt") returned 0x0 [0094.848] lstrlenW (lpString=".dbf") returned 4 [0094.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".dbf") returned 0x0 [0094.848] lstrlenW (lpString=".ckp") returned 4 [0094.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".ckp") returned 0x0 [0094.848] lstrlenW (lpString=".dacpac") returned 7 [0094.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".dacpac") returned 0x0 [0094.849] lstrlenW (lpString=".db3") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".db3") returned 0x0 [0094.849] lstrlenW (lpString=".dtxs") returned 5 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".dtxs") returned 0x0 [0094.849] lstrlenW (lpString=".mdt") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".mdt") returned 0x0 [0094.849] lstrlenW (lpString=".sdf") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".sdf") returned 0x0 [0094.849] lstrlenW (lpString=".MDF") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".MDF") returned 0x0 [0094.849] lstrlenW (lpString=".DBF") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".DBF") returned 0x0 [0094.849] lstrlenW (lpString=".DB") returned 3 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".DB") returned 0x0 [0094.849] lstrlenW (lpString=".db") returned 3 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".db") returned 0x0 [0094.849] lstrlenW (lpString=".ndf") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".ndf") returned 0x0 [0094.849] lstrlenW (lpString=".NDF") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".NDF") returned 0x0 [0094.849] lstrlenW (lpString=".Mdf") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".Mdf") returned 0x0 [0094.849] lstrlenW (lpString=".dat") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".dat") returned 0x0 [0094.849] lstrlenW (lpString=".DAT") returned 4 [0094.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".DAT") returned 0x0 [0094.850] lstrlenW (lpString=".ldf") returned 4 [0094.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".ldf") returned 0x0 [0094.850] lstrlenW (lpString=".LDF") returned 4 [0094.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch=".LDF") returned 0x0 [0094.850] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.850] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33fd00) returned 1 [0094.851] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.851] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.851] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21485421691) returned 1 [0094.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc759d390, dwHighDateTime=0x1d585b4)) [0094.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0518 [0094.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0518 | out: hHeap=0x260000) returned 1 [0094.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.854] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.854] GetLastError () returned 0x0 [0094.854] GetLastError () returned 0x0 [0094.854] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.854] GetLastError () returned 0x0 [0094.854] GetLastError () returned 0x0 [0094.875] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffed868, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.875] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x12798, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x12798, lpOverlapped=0x0) returned 1 [0094.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.875] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.876] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.876] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.876] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.876] CloseHandle (hObject=0x11c) returned 1 [0094.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.878] GetLastError () returned 0x0 [0094.878] RtlWakeConditionVariable () returned 0x0 [0094.878] GetCurrentThreadId () returned 0x998 [0094.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".ldf") returned 0x0 [0094.878] lstrlenW (lpString=".vhd") returned 4 [0094.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".vhd") returned 0x0 [0094.879] lstrlenW (lpString=".vhdx") returned 5 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".vhdx") returned 0x0 [0094.879] lstrlenW (lpString=".pst") returned 4 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".pst") returned 0x0 [0094.879] lstrlenW (lpString=".ost") returned 4 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".ost") returned 0x0 [0094.879] lstrlenW (lpString=".bak") returned 4 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".bak") returned 0x0 [0094.879] lstrlenW (lpString=".bac") returned 4 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".bac") returned 0x0 [0094.879] lstrlenW (lpString=".sys") returned 4 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".sys") returned 0x0 [0094.879] lstrlenW (lpString=".v2i") returned 4 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".v2i") returned 0x0 [0094.879] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.881] lstrlenW (lpString=".sql") returned 4 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".sql") returned 0x0 [0094.881] lstrlenW (lpString=".mdf") returned 4 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".mdf") returned 0x0 [0094.881] lstrlenW (lpString=".txt") returned 4 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".txt") returned 0x0 [0094.881] lstrlenW (lpString=".dbf") returned 4 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".dbf") returned 0x0 [0094.881] lstrlenW (lpString=".ckp") returned 4 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".ckp") returned 0x0 [0094.881] lstrlenW (lpString=".dacpac") returned 7 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".dacpac") returned 0x0 [0094.881] lstrlenW (lpString=".db3") returned 4 [0094.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".db3") returned 0x0 [0094.881] lstrlenW (lpString=".dtxs") returned 5 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".dtxs") returned 0x0 [0094.882] lstrlenW (lpString=".mdt") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".mdt") returned 0x0 [0094.882] lstrlenW (lpString=".sdf") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".sdf") returned 0x0 [0094.882] lstrlenW (lpString=".MDF") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".MDF") returned 0x0 [0094.882] lstrlenW (lpString=".DBF") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".DBF") returned 0x0 [0094.882] lstrlenW (lpString=".DB") returned 3 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".DB") returned 0x0 [0094.882] lstrlenW (lpString=".db") returned 3 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".db") returned 0x0 [0094.882] lstrlenW (lpString=".ndf") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".ndf") returned 0x0 [0094.882] lstrlenW (lpString=".NDF") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".NDF") returned 0x0 [0094.882] lstrlenW (lpString=".Mdf") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".Mdf") returned 0x0 [0094.882] lstrlenW (lpString=".dat") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".dat") returned 0x0 [0094.882] lstrlenW (lpString=".DAT") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".DAT") returned 0x0 [0094.882] lstrlenW (lpString=".ldf") returned 4 [0094.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".ldf") returned 0x0 [0094.882] lstrlenW (lpString=".LDF") returned 4 [0094.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch=".LDF") returned 0x0 [0094.883] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.883] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33fd00) returned 1 [0094.883] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.884] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.884] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21488481881) returned 1 [0094.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc75e9650, dwHighDateTime=0x1d585b4)) [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0550 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0550 | out: hHeap=0x260000) returned 1 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.884] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.885] GetLastError () returned 0x0 [0094.885] GetLastError () returned 0x0 [0094.885] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.885] GetLastError () returned 0x0 [0094.885] GetLastError () returned 0x0 [0094.887] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.887] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.888] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.888] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.890] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.890] CloseHandle (hObject=0x11c) returned 1 [0094.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0094.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0094.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.910] GetLastError () returned 0x0 [0094.910] RtlWakeConditionVariable () returned 0x0 [0094.911] GetCurrentThreadId () returned 0x998 [0094.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".ldf") returned 0x0 [0094.911] lstrlenW (lpString=".vhd") returned 4 [0094.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".vhd") returned 0x0 [0094.911] lstrlenW (lpString=".vhdx") returned 5 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".vhdx") returned 0x0 [0094.912] lstrlenW (lpString=".pst") returned 4 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".pst") returned 0x0 [0094.912] lstrlenW (lpString=".ost") returned 4 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".ost") returned 0x0 [0094.912] lstrlenW (lpString=".bak") returned 4 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".bak") returned 0x0 [0094.912] lstrlenW (lpString=".bac") returned 4 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".bac") returned 0x0 [0094.912] lstrlenW (lpString=".sys") returned 4 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".sys") returned 0x0 [0094.912] lstrlenW (lpString=".v2i") returned 4 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".v2i") returned 0x0 [0094.912] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.914] lstrlenW (lpString=".sql") returned 4 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".sql") returned 0x0 [0094.914] lstrlenW (lpString=".mdf") returned 4 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".mdf") returned 0x0 [0094.914] lstrlenW (lpString=".txt") returned 4 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".txt") returned 0x0 [0094.914] lstrlenW (lpString=".dbf") returned 4 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".dbf") returned 0x0 [0094.914] lstrlenW (lpString=".ckp") returned 4 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".ckp") returned 0x0 [0094.914] lstrlenW (lpString=".dacpac") returned 7 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".dacpac") returned 0x0 [0094.914] lstrlenW (lpString=".db3") returned 4 [0094.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".db3") returned 0x0 [0094.915] lstrlenW (lpString=".dtxs") returned 5 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".dtxs") returned 0x0 [0094.915] lstrlenW (lpString=".mdt") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".mdt") returned 0x0 [0094.915] lstrlenW (lpString=".sdf") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".sdf") returned 0x0 [0094.915] lstrlenW (lpString=".MDF") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".MDF") returned 0x0 [0094.915] lstrlenW (lpString=".DBF") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".DBF") returned 0x0 [0094.915] lstrlenW (lpString=".DB") returned 3 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".DB") returned 0x0 [0094.915] lstrlenW (lpString=".db") returned 3 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".db") returned 0x0 [0094.915] lstrlenW (lpString=".ndf") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".ndf") returned 0x0 [0094.915] lstrlenW (lpString=".NDF") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".NDF") returned 0x0 [0094.915] lstrlenW (lpString=".Mdf") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".Mdf") returned 0x0 [0094.915] lstrlenW (lpString=".dat") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".dat") returned 0x0 [0094.915] lstrlenW (lpString=".DAT") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".DAT") returned 0x0 [0094.915] lstrlenW (lpString=".ldf") returned 4 [0094.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".ldf") returned 0x0 [0094.916] lstrlenW (lpString=".LDF") returned 4 [0094.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch=".LDF") returned 0x0 [0094.916] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.916] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33fd00) returned 1 [0094.917] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.917] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.917] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21491933898) returned 1 [0094.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7635910, dwHighDateTime=0x1d585b4)) [0094.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0588 [0094.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0588 | out: hHeap=0x260000) returned 1 [0094.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.919] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.919] GetLastError () returned 0x0 [0094.919] GetLastError () returned 0x0 [0094.919] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.920] GetLastError () returned 0x0 [0094.920] GetLastError () returned 0x0 [0094.957] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.957] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.957] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.957] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.971] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.971] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.971] CloseHandle (hObject=0xe4) returned 1 [0094.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0094.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0094.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.973] GetLastError () returned 0x0 [0094.974] RtlWakeConditionVariable () returned 0x27e828 [0094.974] GetCurrentThreadId () returned 0x998 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".ldf") returned 0x0 [0094.974] lstrlenW (lpString=".vhd") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".vhd") returned 0x0 [0094.974] lstrlenW (lpString=".vhdx") returned 5 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".vhdx") returned 0x0 [0094.974] lstrlenW (lpString=".pst") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".pst") returned 0x0 [0094.974] lstrlenW (lpString=".ost") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".ost") returned 0x0 [0094.974] lstrlenW (lpString=".bak") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".bak") returned 0x0 [0094.974] lstrlenW (lpString=".bac") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".bac") returned 0x0 [0094.974] lstrlenW (lpString=".sys") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".sys") returned 0x0 [0094.974] lstrlenW (lpString=".v2i") returned 4 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".v2i") returned 0x0 [0094.974] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch="s\r\n.v2i") returned 0x0 [0094.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.976] lstrlenW (lpString=".sql") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".sql") returned 0x0 [0094.976] lstrlenW (lpString=".mdf") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".mdf") returned 0x0 [0094.976] lstrlenW (lpString=".txt") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".txt") returned 0x0 [0094.976] lstrlenW (lpString=".dbf") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".dbf") returned 0x0 [0094.976] lstrlenW (lpString=".ckp") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".ckp") returned 0x0 [0094.976] lstrlenW (lpString=".dacpac") returned 7 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".dacpac") returned 0x0 [0094.976] lstrlenW (lpString=".db3") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".db3") returned 0x0 [0094.976] lstrlenW (lpString=".dtxs") returned 5 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".dtxs") returned 0x0 [0094.976] lstrlenW (lpString=".mdt") returned 4 [0094.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".mdt") returned 0x0 [0094.976] lstrlenW (lpString=".sdf") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".sdf") returned 0x0 [0094.977] lstrlenW (lpString=".MDF") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".MDF") returned 0x0 [0094.977] lstrlenW (lpString=".DBF") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".DBF") returned 0x0 [0094.977] lstrlenW (lpString=".DB") returned 3 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".DB") returned 0x0 [0094.977] lstrlenW (lpString=".db") returned 3 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".db") returned 0x0 [0094.977] lstrlenW (lpString=".ndf") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".ndf") returned 0x0 [0094.977] lstrlenW (lpString=".NDF") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".NDF") returned 0x0 [0094.977] lstrlenW (lpString=".Mdf") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".Mdf") returned 0x0 [0094.977] lstrlenW (lpString=".dat") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".dat") returned 0x0 [0094.977] lstrlenW (lpString=".DAT") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".DAT") returned 0x0 [0094.977] lstrlenW (lpString=".ldf") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".ldf") returned 0x0 [0094.977] lstrlenW (lpString=".LDF") returned 4 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch=".LDF") returned 0x0 [0094.977] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.978] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33fd88) returned 1 [0094.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.978] CryptReleaseContext (hProv=0x33fd88, dwFlags=0x0) returned 1 [0094.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.979] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21497968420) returned 1 [0094.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc76cde90, dwHighDateTime=0x1d585b4)) [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0668 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0668 | out: hHeap=0x260000) returned 1 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f5c8 [0094.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f5c8 | out: hHeap=0x260000) returned 1 [0094.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.979] GetLastError () returned 0x0 [0094.980] GetLastError () returned 0x0 [0094.980] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.980] GetLastError () returned 0x0 [0094.980] GetLastError () returned 0x0 [0094.986] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.986] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.989] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.989] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.990] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.990] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.990] CloseHandle (hObject=0xe4) returned 1 [0094.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0094.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe.[deadmin@cock.li].deadmin")) returned 1 [0094.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0094.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.993] GetLastError () returned 0x0 [0094.993] RtlWakeConditionVariable () returned 0x0 [0094.993] GetCurrentThreadId () returned 0x998 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".ldf") returned 0x0 [0094.993] lstrlenW (lpString=".vhd") returned 4 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".vhd") returned 0x0 [0094.993] lstrlenW (lpString=".vhdx") returned 5 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".vhdx") returned 0x0 [0094.993] lstrlenW (lpString=".pst") returned 4 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".pst") returned 0x0 [0094.993] lstrlenW (lpString=".ost") returned 4 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".ost") returned 0x0 [0094.993] lstrlenW (lpString=".bak") returned 4 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".bak") returned 0x0 [0094.993] lstrlenW (lpString=".bac") returned 4 [0094.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".bac") returned 0x0 [0094.994] lstrlenW (lpString=".sys") returned 4 [0094.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".sys") returned 0x0 [0094.994] lstrlenW (lpString=".v2i") returned 4 [0094.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".v2i") returned 0x0 [0094.994] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch="s\r\n.v2i") returned 0x0 [0094.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.995] lstrlenW (lpString=".sql") returned 4 [0094.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".sql") returned 0x0 [0094.995] lstrlenW (lpString=".mdf") returned 4 [0094.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".mdf") returned 0x0 [0094.995] lstrlenW (lpString=".txt") returned 4 [0094.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".txt") returned 0x0 [0094.995] lstrlenW (lpString=".dbf") returned 4 [0094.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".dbf") returned 0x0 [0094.996] lstrlenW (lpString=".ckp") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".ckp") returned 0x0 [0094.996] lstrlenW (lpString=".dacpac") returned 7 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".dacpac") returned 0x0 [0094.996] lstrlenW (lpString=".db3") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".db3") returned 0x0 [0094.996] lstrlenW (lpString=".dtxs") returned 5 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".dtxs") returned 0x0 [0094.996] lstrlenW (lpString=".mdt") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".mdt") returned 0x0 [0094.996] lstrlenW (lpString=".sdf") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".sdf") returned 0x0 [0094.996] lstrlenW (lpString=".MDF") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".MDF") returned 0x0 [0094.996] lstrlenW (lpString=".DBF") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".DBF") returned 0x0 [0094.996] lstrlenW (lpString=".DB") returned 3 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".DB") returned 0x0 [0094.996] lstrlenW (lpString=".db") returned 3 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".db") returned 0x0 [0094.996] lstrlenW (lpString=".ndf") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".ndf") returned 0x0 [0094.996] lstrlenW (lpString=".NDF") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".NDF") returned 0x0 [0094.996] lstrlenW (lpString=".Mdf") returned 4 [0094.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".Mdf") returned 0x0 [0094.997] lstrlenW (lpString=".dat") returned 4 [0094.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".dat") returned 0x0 [0094.997] lstrlenW (lpString=".DAT") returned 4 [0094.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".DAT") returned 0x0 [0094.997] lstrlenW (lpString=".ldf") returned 4 [0094.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".ldf") returned 0x0 [0094.997] lstrlenW (lpString=".LDF") returned 4 [0094.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch=".LDF") returned 0x0 [0094.997] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.997] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33f150) returned 1 [0094.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.998] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.998] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21499915568) returned 1 [0094.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc76f3ff0, dwHighDateTime=0x1d585b4)) [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e06a0 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e06a0 | out: hHeap=0x260000) returned 1 [0094.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0094.999] GetLastError () returned 0x0 [0094.999] GetLastError () returned 0x0 [0094.999] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0094.999] GetLastError () returned 0x0 [0094.999] GetLastError () returned 0x0 [0095.017] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffeda78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.017] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x12588, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x12588, lpOverlapped=0x0) returned 1 [0095.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.018] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.018] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.018] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.018] CloseHandle (hObject=0xe4) returned 1 [0095.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.[deadmin@cock.li].deadmin")) returned 1 [0095.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.020] GetLastError () returned 0x0 [0095.020] RtlWakeConditionVariable () returned 0x0 [0095.020] GetCurrentThreadId () returned 0x998 [0095.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".ldf") returned 0x0 [0095.020] lstrlenW (lpString=".vhd") returned 4 [0095.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".vhd") returned 0x0 [0095.020] lstrlenW (lpString=".vhdx") returned 5 [0095.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".vhdx") returned 0x0 [0095.020] lstrlenW (lpString=".pst") returned 4 [0095.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".pst") returned 0x0 [0095.020] lstrlenW (lpString=".ost") returned 4 [0095.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".ost") returned 0x0 [0095.020] lstrlenW (lpString=".bak") returned 4 [0095.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".bak") returned 0x0 [0095.021] lstrlenW (lpString=".bac") returned 4 [0095.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".bac") returned 0x0 [0095.021] lstrlenW (lpString=".sys") returned 4 [0095.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".sys") returned 0x0 [0095.021] lstrlenW (lpString=".v2i") returned 4 [0095.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".v2i") returned 0x0 [0095.021] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0095.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.022] lstrlenW (lpString=".sql") returned 4 [0095.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".sql") returned 0x0 [0095.022] lstrlenW (lpString=".mdf") returned 4 [0095.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".mdf") returned 0x0 [0095.022] lstrlenW (lpString=".txt") returned 4 [0095.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".txt") returned 0x0 [0095.022] lstrlenW (lpString=".dbf") returned 4 [0095.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".dbf") returned 0x0 [0095.022] lstrlenW (lpString=".ckp") returned 4 [0095.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".ckp") returned 0x0 [0095.022] lstrlenW (lpString=".dacpac") returned 7 [0095.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".dacpac") returned 0x0 [0095.022] lstrlenW (lpString=".db3") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".db3") returned 0x0 [0095.023] lstrlenW (lpString=".dtxs") returned 5 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".dtxs") returned 0x0 [0095.023] lstrlenW (lpString=".mdt") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".mdt") returned 0x0 [0095.023] lstrlenW (lpString=".sdf") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".sdf") returned 0x0 [0095.023] lstrlenW (lpString=".MDF") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".MDF") returned 0x0 [0095.023] lstrlenW (lpString=".DBF") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".DBF") returned 0x0 [0095.023] lstrlenW (lpString=".DB") returned 3 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".DB") returned 0x0 [0095.023] lstrlenW (lpString=".db") returned 3 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".db") returned 0x0 [0095.023] lstrlenW (lpString=".ndf") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".ndf") returned 0x0 [0095.023] lstrlenW (lpString=".NDF") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".NDF") returned 0x0 [0095.023] lstrlenW (lpString=".Mdf") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".Mdf") returned 0x0 [0095.023] lstrlenW (lpString=".dat") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".dat") returned 0x0 [0095.023] lstrlenW (lpString=".DAT") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".DAT") returned 0x0 [0095.023] lstrlenW (lpString=".ldf") returned 4 [0095.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".ldf") returned 0x0 [0095.024] lstrlenW (lpString=".LDF") returned 4 [0095.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch=".LDF") returned 0x0 [0095.024] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.024] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x33ff20) returned 1 [0095.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.025] CryptReleaseContext (hProv=0x33ff20, dwFlags=0x0) returned 1 [0095.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.025] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21502583990) returned 1 [0095.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc77402b0, dwHighDateTime=0x1d585b4)) [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0710 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0710 | out: hHeap=0x260000) returned 1 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.026] GetLastError () returned 0x0 [0095.026] GetLastError () returned 0x0 [0095.026] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.026] GetLastError () returned 0x0 [0095.026] GetLastError () returned 0x0 [0095.119] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.119] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.119] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.120] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.232] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.232] CloseHandle (hObject=0xe4) returned 1 [0095.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.[deadmin@cock.li].deadmin")) returned 1 [0095.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.265] GetLastError () returned 0x0 [0095.266] RtlWakeConditionVariable () returned 0x0 [0095.266] GetCurrentThreadId () returned 0x998 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".ldf") returned 0x0 [0095.266] lstrlenW (lpString=".vhd") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".vhd") returned 0x0 [0095.266] lstrlenW (lpString=".vhdx") returned 5 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".vhdx") returned 0x0 [0095.266] lstrlenW (lpString=".pst") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".pst") returned 0x0 [0095.266] lstrlenW (lpString=".ost") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".ost") returned 0x0 [0095.266] lstrlenW (lpString=".bak") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".bak") returned 0x0 [0095.266] lstrlenW (lpString=".bac") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".bac") returned 0x0 [0095.266] lstrlenW (lpString=".sys") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".sys") returned 0x0 [0095.266] lstrlenW (lpString=".v2i") returned 4 [0095.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".v2i") returned 0x0 [0095.267] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch="s\r\n.v2i") returned 0x0 [0095.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.268] lstrlenW (lpString=".sql") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".sql") returned 0x0 [0095.268] lstrlenW (lpString=".mdf") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".mdf") returned 0x0 [0095.268] lstrlenW (lpString=".txt") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".txt") returned 0x0 [0095.268] lstrlenW (lpString=".dbf") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".dbf") returned 0x0 [0095.268] lstrlenW (lpString=".ckp") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".ckp") returned 0x0 [0095.268] lstrlenW (lpString=".dacpac") returned 7 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".dacpac") returned 0x0 [0095.268] lstrlenW (lpString=".db3") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".db3") returned 0x0 [0095.268] lstrlenW (lpString=".dtxs") returned 5 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".dtxs") returned 0x0 [0095.268] lstrlenW (lpString=".mdt") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".mdt") returned 0x0 [0095.268] lstrlenW (lpString=".sdf") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".sdf") returned 0x0 [0095.268] lstrlenW (lpString=".MDF") returned 4 [0095.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".MDF") returned 0x0 [0095.268] lstrlenW (lpString=".DBF") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".DBF") returned 0x0 [0095.269] lstrlenW (lpString=".DB") returned 3 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".DB") returned 0x0 [0095.269] lstrlenW (lpString=".db") returned 3 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".db") returned 0x0 [0095.269] lstrlenW (lpString=".ndf") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".ndf") returned 0x0 [0095.269] lstrlenW (lpString=".NDF") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".NDF") returned 0x0 [0095.269] lstrlenW (lpString=".Mdf") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".Mdf") returned 0x0 [0095.269] lstrlenW (lpString=".dat") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".dat") returned 0x0 [0095.269] lstrlenW (lpString=".DAT") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".DAT") returned 0x0 [0095.269] lstrlenW (lpString=".ldf") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".ldf") returned 0x0 [0095.269] lstrlenW (lpString=".LDF") returned 4 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch=".LDF") returned 0x0 [0095.269] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.269] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e5330) returned 1 [0095.270] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.270] CryptReleaseContext (hProv=0x27e5330, dwFlags=0x0) returned 1 [0095.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.270] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21527161192) returned 1 [0095.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc79a18b0, dwHighDateTime=0x1d585b4)) [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0a90 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0a90 | out: hHeap=0x260000) returned 1 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.271] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.271] GetLastError () returned 0x0 [0095.271] GetLastError () returned 0x0 [0095.272] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.272] GetLastError () returned 0x0 [0095.272] GetLastError () returned 0x0 [0095.355] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.355] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.356] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.356] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.387] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.387] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.387] CloseHandle (hObject=0xe4) returned 1 [0095.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.[deadmin@cock.li].deadmin")) returned 1 [0095.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.390] GetLastError () returned 0x0 [0095.390] RtlWakeConditionVariable () returned 0x0 [0095.390] GetCurrentThreadId () returned 0x998 [0095.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".ldf") returned 0x0 [0095.390] lstrlenW (lpString=".vhd") returned 4 [0095.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".vhd") returned 0x0 [0095.390] lstrlenW (lpString=".vhdx") returned 5 [0095.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".vhdx") returned 0x0 [0095.391] lstrlenW (lpString=".pst") returned 4 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".pst") returned 0x0 [0095.391] lstrlenW (lpString=".ost") returned 4 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".ost") returned 0x0 [0095.391] lstrlenW (lpString=".bak") returned 4 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".bak") returned 0x0 [0095.391] lstrlenW (lpString=".bac") returned 4 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".bac") returned 0x0 [0095.391] lstrlenW (lpString=".sys") returned 4 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".sys") returned 0x0 [0095.391] lstrlenW (lpString=".v2i") returned 4 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".v2i") returned 0x0 [0095.391] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch="s\r\n.v2i") returned 0x0 [0095.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.393] lstrlenW (lpString=".sql") returned 4 [0095.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".sql") returned 0x0 [0095.394] lstrlenW (lpString=".mdf") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".mdf") returned 0x0 [0095.394] lstrlenW (lpString=".txt") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".txt") returned 0x0 [0095.394] lstrlenW (lpString=".dbf") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".dbf") returned 0x0 [0095.394] lstrlenW (lpString=".ckp") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".ckp") returned 0x0 [0095.394] lstrlenW (lpString=".dacpac") returned 7 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".dacpac") returned 0x0 [0095.394] lstrlenW (lpString=".db3") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".db3") returned 0x0 [0095.394] lstrlenW (lpString=".dtxs") returned 5 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".dtxs") returned 0x0 [0095.394] lstrlenW (lpString=".mdt") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".mdt") returned 0x0 [0095.394] lstrlenW (lpString=".sdf") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".sdf") returned 0x0 [0095.394] lstrlenW (lpString=".MDF") returned 4 [0095.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".MDF") returned 0x0 [0095.394] lstrlenW (lpString=".DBF") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".DBF") returned 0x0 [0095.395] lstrlenW (lpString=".DB") returned 3 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".DB") returned 0x0 [0095.395] lstrlenW (lpString=".db") returned 3 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".db") returned 0x0 [0095.395] lstrlenW (lpString=".ndf") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".ndf") returned 0x0 [0095.395] lstrlenW (lpString=".NDF") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".NDF") returned 0x0 [0095.395] lstrlenW (lpString=".Mdf") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".Mdf") returned 0x0 [0095.395] lstrlenW (lpString=".dat") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".dat") returned 0x0 [0095.395] lstrlenW (lpString=".DAT") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".DAT") returned 0x0 [0095.395] lstrlenW (lpString=".ldf") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".ldf") returned 0x0 [0095.395] lstrlenW (lpString=".LDF") returned 4 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch=".LDF") returned 0x0 [0095.395] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0095.395] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e55d8) returned 1 [0095.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0095.396] CryptReleaseContext (hProv=0x27e55d8, dwFlags=0x0) returned 1 [0095.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0095.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.396] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21539757877) returned 1 [0095.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7ad23b0, dwHighDateTime=0x1d585b4)) [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0be0 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0be0 | out: hHeap=0x260000) returned 1 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.397] GetLastError () returned 0x0 [0095.398] GetLastError () returned 0x0 [0095.398] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.398] GetLastError () returned 0x0 [0095.398] GetLastError () returned 0x0 [0095.419] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.419] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.422] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.422] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.441] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.441] CloseHandle (hObject=0xe4) returned 1 [0095.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.[deadmin@cock.li].deadmin")) returned 1 [0095.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.456] GetLastError () returned 0x0 [0095.456] RtlWakeConditionVariable () returned 0x0 [0095.456] GetCurrentThreadId () returned 0x998 [0095.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".ldf") returned 0x0 [0095.456] lstrlenW (lpString=".vhd") returned 4 [0095.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".vhd") returned 0x0 [0095.456] lstrlenW (lpString=".vhdx") returned 5 [0095.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".vhdx") returned 0x0 [0095.456] lstrlenW (lpString=".pst") returned 4 [0095.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".pst") returned 0x0 [0095.456] lstrlenW (lpString=".ost") returned 4 [0095.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".ost") returned 0x0 [0095.458] lstrlenW (lpString=".bak") returned 4 [0095.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".bak") returned 0x0 [0095.458] lstrlenW (lpString=".bac") returned 4 [0095.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".bac") returned 0x0 [0095.458] lstrlenW (lpString=".sys") returned 4 [0095.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".sys") returned 0x0 [0095.458] lstrlenW (lpString=".v2i") returned 4 [0095.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".v2i") returned 0x0 [0095.458] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.460] lstrlenW (lpString=".sql") returned 4 [0095.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".sql") returned 0x0 [0095.460] lstrlenW (lpString=".mdf") returned 4 [0095.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".mdf") returned 0x0 [0095.460] lstrlenW (lpString=".txt") returned 4 [0095.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".txt") returned 0x0 [0095.461] lstrlenW (lpString=".dbf") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".dbf") returned 0x0 [0095.461] lstrlenW (lpString=".ckp") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".ckp") returned 0x0 [0095.461] lstrlenW (lpString=".dacpac") returned 7 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".dacpac") returned 0x0 [0095.461] lstrlenW (lpString=".db3") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".db3") returned 0x0 [0095.461] lstrlenW (lpString=".dtxs") returned 5 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".dtxs") returned 0x0 [0095.461] lstrlenW (lpString=".mdt") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".mdt") returned 0x0 [0095.461] lstrlenW (lpString=".sdf") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".sdf") returned 0x0 [0095.461] lstrlenW (lpString=".MDF") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".MDF") returned 0x0 [0095.461] lstrlenW (lpString=".DBF") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".DBF") returned 0x0 [0095.461] lstrlenW (lpString=".DB") returned 3 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".DB") returned 0x0 [0095.461] lstrlenW (lpString=".db") returned 3 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".db") returned 0x0 [0095.461] lstrlenW (lpString=".ndf") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".ndf") returned 0x0 [0095.461] lstrlenW (lpString=".NDF") returned 4 [0095.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".NDF") returned 0x0 [0095.462] lstrlenW (lpString=".Mdf") returned 4 [0095.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".Mdf") returned 0x0 [0095.462] lstrlenW (lpString=".dat") returned 4 [0095.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".dat") returned 0x0 [0095.462] lstrlenW (lpString=".DAT") returned 4 [0095.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".DAT") returned 0x0 [0095.462] lstrlenW (lpString=".ldf") returned 4 [0095.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".ldf") returned 0x0 [0095.462] lstrlenW (lpString=".LDF") returned 4 [0095.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch=".LDF") returned 0x0 [0095.462] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.462] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e5908) returned 1 [0095.463] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.463] CryptReleaseContext (hProv=0x27e5908, dwFlags=0x0) returned 1 [0095.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.463] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21546420248) returned 1 [0095.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7b6a930, dwHighDateTime=0x1d585b4)) [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0cc0 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0cc0 | out: hHeap=0x260000) returned 1 [0095.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.464] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.464] GetLastError () returned 0x0 [0095.464] GetLastError () returned 0x0 [0095.464] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.464] GetLastError () returned 0x0 [0095.465] GetLastError () returned 0x0 [0095.485] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.485] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.486] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.486] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.630] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.631] CloseHandle (hObject=0xe4) returned 1 [0095.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.665] GetLastError () returned 0x0 [0095.665] RtlWakeConditionVariable () returned 0x0 [0095.665] GetCurrentThreadId () returned 0x998 [0095.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".ldf") returned 0x0 [0095.665] lstrlenW (lpString=".vhd") returned 4 [0095.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".vhd") returned 0x0 [0095.665] lstrlenW (lpString=".vhdx") returned 5 [0095.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".vhdx") returned 0x0 [0095.665] lstrlenW (lpString=".pst") returned 4 [0095.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".pst") returned 0x0 [0095.666] lstrlenW (lpString=".ost") returned 4 [0095.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".ost") returned 0x0 [0095.666] lstrlenW (lpString=".bak") returned 4 [0095.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".bak") returned 0x0 [0095.666] lstrlenW (lpString=".bac") returned 4 [0095.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".bac") returned 0x0 [0095.666] lstrlenW (lpString=".sys") returned 4 [0095.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".sys") returned 0x0 [0095.666] lstrlenW (lpString=".v2i") returned 4 [0095.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".v2i") returned 0x0 [0095.666] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.669] lstrlenW (lpString=".sql") returned 4 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".sql") returned 0x0 [0095.669] lstrlenW (lpString=".mdf") returned 4 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".mdf") returned 0x0 [0095.669] lstrlenW (lpString=".txt") returned 4 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".txt") returned 0x0 [0095.669] lstrlenW (lpString=".dbf") returned 4 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".dbf") returned 0x0 [0095.669] lstrlenW (lpString=".ckp") returned 4 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".ckp") returned 0x0 [0095.669] lstrlenW (lpString=".dacpac") returned 7 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".dacpac") returned 0x0 [0095.669] lstrlenW (lpString=".db3") returned 4 [0095.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".db3") returned 0x0 [0095.670] lstrlenW (lpString=".dtxs") returned 5 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".dtxs") returned 0x0 [0095.670] lstrlenW (lpString=".mdt") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".mdt") returned 0x0 [0095.670] lstrlenW (lpString=".sdf") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".sdf") returned 0x0 [0095.670] lstrlenW (lpString=".MDF") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".MDF") returned 0x0 [0095.670] lstrlenW (lpString=".DBF") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".DBF") returned 0x0 [0095.670] lstrlenW (lpString=".DB") returned 3 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".DB") returned 0x0 [0095.670] lstrlenW (lpString=".db") returned 3 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".db") returned 0x0 [0095.670] lstrlenW (lpString=".ndf") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".ndf") returned 0x0 [0095.670] lstrlenW (lpString=".NDF") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".NDF") returned 0x0 [0095.670] lstrlenW (lpString=".Mdf") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".Mdf") returned 0x0 [0095.670] lstrlenW (lpString=".dat") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".dat") returned 0x0 [0095.670] lstrlenW (lpString=".DAT") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".DAT") returned 0x0 [0095.670] lstrlenW (lpString=".ldf") returned 4 [0095.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".ldf") returned 0x0 [0095.671] lstrlenW (lpString=".LDF") returned 4 [0095.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch=".LDF") returned 0x0 [0095.671] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.671] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e5b28) returned 1 [0095.672] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.672] CryptReleaseContext (hProv=0x27e5b28, dwFlags=0x0) returned 1 [0095.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.672] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21567294839) returned 1 [0095.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7d59b10, dwHighDateTime=0x1d585b4)) [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0eb8 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0eb8 | out: hHeap=0x260000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.673] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.673] GetLastError () returned 0x0 [0095.673] GetLastError () returned 0x0 [0095.673] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.673] GetLastError () returned 0x0 [0095.673] GetLastError () returned 0x0 [0095.680] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffed280, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.680] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x12d80, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x12d80, lpOverlapped=0x0) returned 1 [0095.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.680] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.680] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.680] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.681] CloseHandle (hObject=0xe4) returned 1 [0095.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.683] GetLastError () returned 0x0 [0095.683] RtlWakeConditionVariable () returned 0x0 [0095.683] GetCurrentThreadId () returned 0x998 [0095.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".ldf") returned 0x0 [0095.684] lstrlenW (lpString=".vhd") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".vhd") returned 0x0 [0095.684] lstrlenW (lpString=".vhdx") returned 5 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".vhdx") returned 0x0 [0095.684] lstrlenW (lpString=".pst") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".pst") returned 0x0 [0095.684] lstrlenW (lpString=".ost") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".ost") returned 0x0 [0095.684] lstrlenW (lpString=".bak") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".bak") returned 0x0 [0095.684] lstrlenW (lpString=".bac") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".bac") returned 0x0 [0095.684] lstrlenW (lpString=".sys") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".sys") returned 0x0 [0095.684] lstrlenW (lpString=".v2i") returned 4 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".v2i") returned 0x0 [0095.684] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0095.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.686] lstrlenW (lpString=".sql") returned 4 [0095.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".sql") returned 0x0 [0095.686] lstrlenW (lpString=".mdf") returned 4 [0095.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".mdf") returned 0x0 [0095.686] lstrlenW (lpString=".txt") returned 4 [0095.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".txt") returned 0x0 [0095.686] lstrlenW (lpString=".dbf") returned 4 [0095.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".dbf") returned 0x0 [0095.686] lstrlenW (lpString=".ckp") returned 4 [0095.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".ckp") returned 0x0 [0095.687] lstrlenW (lpString=".dacpac") returned 7 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".dacpac") returned 0x0 [0095.687] lstrlenW (lpString=".db3") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".db3") returned 0x0 [0095.687] lstrlenW (lpString=".dtxs") returned 5 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".dtxs") returned 0x0 [0095.687] lstrlenW (lpString=".mdt") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".mdt") returned 0x0 [0095.687] lstrlenW (lpString=".sdf") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".sdf") returned 0x0 [0095.687] lstrlenW (lpString=".MDF") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".MDF") returned 0x0 [0095.687] lstrlenW (lpString=".DBF") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".DBF") returned 0x0 [0095.687] lstrlenW (lpString=".DB") returned 3 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".DB") returned 0x0 [0095.687] lstrlenW (lpString=".db") returned 3 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".db") returned 0x0 [0095.687] lstrlenW (lpString=".ndf") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".ndf") returned 0x0 [0095.687] lstrlenW (lpString=".NDF") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".NDF") returned 0x0 [0095.687] lstrlenW (lpString=".Mdf") returned 4 [0095.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".Mdf") returned 0x0 [0095.687] lstrlenW (lpString=".dat") returned 4 [0095.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".dat") returned 0x0 [0095.688] lstrlenW (lpString=".DAT") returned 4 [0095.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".DAT") returned 0x0 [0095.688] lstrlenW (lpString=".ldf") returned 4 [0095.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".ldf") returned 0x0 [0095.688] lstrlenW (lpString=".LDF") returned 4 [0095.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch=".LDF") returned 0x0 [0095.688] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.688] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e5ee0) returned 1 [0095.689] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.689] CryptReleaseContext (hProv=0x27e5ee0, dwFlags=0x0) returned 1 [0095.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.689] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21569012251) returned 1 [0095.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7d7fc70, dwHighDateTime=0x1d585b4)) [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0ef0 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0ef0 | out: hHeap=0x260000) returned 1 [0095.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.690] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.690] GetLastError () returned 0x0 [0095.690] GetLastError () returned 0x0 [0095.690] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.691] GetLastError () returned 0x0 [0095.691] GetLastError () returned 0x0 [0095.750] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffea880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.751] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x15780, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x15780, lpOverlapped=0x0) returned 1 [0095.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.751] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.751] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.751] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.751] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.751] CloseHandle (hObject=0xe4) returned 1 [0095.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4810 [0095.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.[deadmin@cock.li].deadmin")) returned 1 [0095.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4810 | out: hHeap=0x260000) returned 1 [0095.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.755] GetLastError () returned 0x0 [0095.755] RtlWakeConditionVariable () returned 0x0 [0095.755] GetCurrentThreadId () returned 0x998 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".ldf") returned 0x0 [0095.755] lstrlenW (lpString=".vhd") returned 4 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".vhd") returned 0x0 [0095.755] lstrlenW (lpString=".vhdx") returned 5 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".vhdx") returned 0x0 [0095.755] lstrlenW (lpString=".pst") returned 4 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".pst") returned 0x0 [0095.755] lstrlenW (lpString=".ost") returned 4 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".ost") returned 0x0 [0095.755] lstrlenW (lpString=".bak") returned 4 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".bak") returned 0x0 [0095.755] lstrlenW (lpString=".bac") returned 4 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".bac") returned 0x0 [0095.755] lstrlenW (lpString=".sys") returned 4 [0095.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".sys") returned 0x0 [0095.756] lstrlenW (lpString=".v2i") returned 4 [0095.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".v2i") returned 0x0 [0095.756] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch="s\r\n.v2i") returned 0x0 [0095.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.758] lstrlenW (lpString=".sql") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".sql") returned 0x0 [0095.758] lstrlenW (lpString=".mdf") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".mdf") returned 0x0 [0095.758] lstrlenW (lpString=".txt") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".txt") returned 0x0 [0095.758] lstrlenW (lpString=".dbf") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".dbf") returned 0x0 [0095.758] lstrlenW (lpString=".ckp") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".ckp") returned 0x0 [0095.758] lstrlenW (lpString=".dacpac") returned 7 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".dacpac") returned 0x0 [0095.758] lstrlenW (lpString=".db3") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".db3") returned 0x0 [0095.758] lstrlenW (lpString=".dtxs") returned 5 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".dtxs") returned 0x0 [0095.758] lstrlenW (lpString=".mdt") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".mdt") returned 0x0 [0095.758] lstrlenW (lpString=".sdf") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".sdf") returned 0x0 [0095.758] lstrlenW (lpString=".MDF") returned 4 [0095.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".MDF") returned 0x0 [0095.759] lstrlenW (lpString=".DBF") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".DBF") returned 0x0 [0095.759] lstrlenW (lpString=".DB") returned 3 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".DB") returned 0x0 [0095.759] lstrlenW (lpString=".db") returned 3 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".db") returned 0x0 [0095.759] lstrlenW (lpString=".ndf") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".ndf") returned 0x0 [0095.759] lstrlenW (lpString=".NDF") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".NDF") returned 0x0 [0095.759] lstrlenW (lpString=".Mdf") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".Mdf") returned 0x0 [0095.759] lstrlenW (lpString=".dat") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".dat") returned 0x0 [0095.759] lstrlenW (lpString=".DAT") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".DAT") returned 0x0 [0095.759] lstrlenW (lpString=".ldf") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".ldf") returned 0x0 [0095.759] lstrlenW (lpString=".LDF") returned 4 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch=".LDF") returned 0x0 [0095.759] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.759] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e5f68) returned 1 [0095.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.760] CryptReleaseContext (hProv=0x27e5f68, dwFlags=0x0) returned 1 [0095.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.760] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21576160167) returned 1 [0095.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7e3e350, dwHighDateTime=0x1d585b4)) [0095.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0fd0 [0095.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0fd0 | out: hHeap=0x260000) returned 1 [0095.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.768] GetLastError () returned 0x0 [0095.769] GetLastError () returned 0x0 [0095.769] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.769] GetLastError () returned 0x0 [0095.769] GetLastError () returned 0x0 [0095.821] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.821] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.822] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.822] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.887] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.888] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.888] CloseHandle (hObject=0xe4) returned 1 [0095.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.[deadmin@cock.li].deadmin")) returned 1 [0095.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0095.893] GetLastError () returned 0x0 [0095.893] RtlWakeConditionVariable () returned 0x27e828 [0095.894] GetCurrentThreadId () returned 0x998 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".ldf") returned 0x0 [0095.894] lstrlenW (lpString=".vhd") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".vhd") returned 0x0 [0095.894] lstrlenW (lpString=".vhdx") returned 5 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".vhdx") returned 0x0 [0095.894] lstrlenW (lpString=".pst") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".pst") returned 0x0 [0095.894] lstrlenW (lpString=".ost") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".ost") returned 0x0 [0095.894] lstrlenW (lpString=".bak") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".bak") returned 0x0 [0095.894] lstrlenW (lpString=".bac") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".bac") returned 0x0 [0095.894] lstrlenW (lpString=".sys") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".sys") returned 0x0 [0095.894] lstrlenW (lpString=".v2i") returned 4 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".v2i") returned 0x0 [0095.894] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.896] lstrlenW (lpString=".sql") returned 4 [0095.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".sql") returned 0x0 [0095.896] lstrlenW (lpString=".mdf") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".mdf") returned 0x0 [0095.897] lstrlenW (lpString=".txt") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".txt") returned 0x0 [0095.897] lstrlenW (lpString=".dbf") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".dbf") returned 0x0 [0095.897] lstrlenW (lpString=".ckp") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".ckp") returned 0x0 [0095.897] lstrlenW (lpString=".dacpac") returned 7 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".dacpac") returned 0x0 [0095.897] lstrlenW (lpString=".db3") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".db3") returned 0x0 [0095.897] lstrlenW (lpString=".dtxs") returned 5 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".dtxs") returned 0x0 [0095.897] lstrlenW (lpString=".mdt") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".mdt") returned 0x0 [0095.897] lstrlenW (lpString=".sdf") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".sdf") returned 0x0 [0095.897] lstrlenW (lpString=".MDF") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".MDF") returned 0x0 [0095.897] lstrlenW (lpString=".DBF") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".DBF") returned 0x0 [0095.897] lstrlenW (lpString=".DB") returned 3 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".DB") returned 0x0 [0095.897] lstrlenW (lpString=".db") returned 3 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".db") returned 0x0 [0095.897] lstrlenW (lpString=".ndf") returned 4 [0095.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".ndf") returned 0x0 [0095.898] lstrlenW (lpString=".NDF") returned 4 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".NDF") returned 0x0 [0095.898] lstrlenW (lpString=".Mdf") returned 4 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".Mdf") returned 0x0 [0095.898] lstrlenW (lpString=".dat") returned 4 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".dat") returned 0x0 [0095.898] lstrlenW (lpString=".DAT") returned 4 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".DAT") returned 0x0 [0095.898] lstrlenW (lpString=".ldf") returned 4 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".ldf") returned 0x0 [0095.898] lstrlenW (lpString=".LDF") returned 4 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch=".LDF") returned 0x0 [0095.898] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0095.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.898] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6188) returned 1 [0095.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.899] CryptReleaseContext (hProv=0x27e6188, dwFlags=0x0) returned 1 [0095.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0095.899] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21590028293) returned 1 [0095.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc7f94fb0, dwHighDateTime=0x1d585b4)) [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1120 [0095.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1120 | out: hHeap=0x260000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0095.900] GetLastError () returned 0x0 [0095.900] GetLastError () returned 0x0 [0095.900] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0095.900] GetLastError () returned 0x0 [0095.901] GetLastError () returned 0x0 [0095.987] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.987] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.987] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.987] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.021] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.021] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.021] CloseHandle (hObject=0xe4) returned 1 [0096.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.024] GetLastError () returned 0x0 [0096.024] RtlWakeConditionVariable () returned 0x0 [0096.024] GetCurrentThreadId () returned 0x998 [0096.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".ldf") returned 0x0 [0096.024] lstrlenW (lpString=".vhd") returned 4 [0096.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".vhd") returned 0x0 [0096.024] lstrlenW (lpString=".vhdx") returned 5 [0096.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".vhdx") returned 0x0 [0096.024] lstrlenW (lpString=".pst") returned 4 [0096.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".pst") returned 0x0 [0096.024] lstrlenW (lpString=".ost") returned 4 [0096.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".ost") returned 0x0 [0096.025] lstrlenW (lpString=".bak") returned 4 [0096.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".bak") returned 0x0 [0096.025] lstrlenW (lpString=".bac") returned 4 [0096.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".bac") returned 0x0 [0096.025] lstrlenW (lpString=".sys") returned 4 [0096.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".sys") returned 0x0 [0096.025] lstrlenW (lpString=".v2i") returned 4 [0096.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".v2i") returned 0x0 [0096.025] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.027] lstrlenW (lpString=".sql") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".sql") returned 0x0 [0096.027] lstrlenW (lpString=".mdf") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".mdf") returned 0x0 [0096.027] lstrlenW (lpString=".txt") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".txt") returned 0x0 [0096.027] lstrlenW (lpString=".dbf") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".dbf") returned 0x0 [0096.027] lstrlenW (lpString=".ckp") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".ckp") returned 0x0 [0096.027] lstrlenW (lpString=".dacpac") returned 7 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".dacpac") returned 0x0 [0096.027] lstrlenW (lpString=".db3") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".db3") returned 0x0 [0096.027] lstrlenW (lpString=".dtxs") returned 5 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".dtxs") returned 0x0 [0096.027] lstrlenW (lpString=".mdt") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".mdt") returned 0x0 [0096.027] lstrlenW (lpString=".sdf") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".sdf") returned 0x0 [0096.027] lstrlenW (lpString=".MDF") returned 4 [0096.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".MDF") returned 0x0 [0096.027] lstrlenW (lpString=".DBF") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".DBF") returned 0x0 [0096.028] lstrlenW (lpString=".DB") returned 3 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".DB") returned 0x0 [0096.028] lstrlenW (lpString=".db") returned 3 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".db") returned 0x0 [0096.028] lstrlenW (lpString=".ndf") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".ndf") returned 0x0 [0096.028] lstrlenW (lpString=".NDF") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".NDF") returned 0x0 [0096.028] lstrlenW (lpString=".Mdf") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".Mdf") returned 0x0 [0096.028] lstrlenW (lpString=".dat") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".dat") returned 0x0 [0096.028] lstrlenW (lpString=".DAT") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".DAT") returned 0x0 [0096.028] lstrlenW (lpString=".ldf") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".ldf") returned 0x0 [0096.028] lstrlenW (lpString=".LDF") returned 4 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch=".LDF") returned 0x0 [0096.028] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.028] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e64b8) returned 1 [0096.029] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.029] CryptReleaseContext (hProv=0x27e64b8, dwFlags=0x0) returned 1 [0096.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.029] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21603057508) returned 1 [0096.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc80c5ab0, dwHighDateTime=0x1d585b4)) [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1238 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1238 | out: hHeap=0x260000) returned 1 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.030] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.030] GetLastError () returned 0x0 [0096.031] GetLastError () returned 0x0 [0096.031] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.031] GetLastError () returned 0x0 [0096.031] GetLastError () returned 0x0 [0096.049] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.049] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.049] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.050] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.050] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.050] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.050] CloseHandle (hObject=0xe4) returned 1 [0096.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.064] GetLastError () returned 0x0 [0096.064] RtlWakeConditionVariable () returned 0x27e828 [0096.064] GetCurrentThreadId () returned 0x998 [0096.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".ldf") returned 0x0 [0096.064] lstrlenW (lpString=".vhd") returned 4 [0096.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".vhd") returned 0x0 [0096.065] lstrlenW (lpString=".vhdx") returned 5 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".vhdx") returned 0x0 [0096.065] lstrlenW (lpString=".pst") returned 4 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".pst") returned 0x0 [0096.065] lstrlenW (lpString=".ost") returned 4 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".ost") returned 0x0 [0096.065] lstrlenW (lpString=".bak") returned 4 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".bak") returned 0x0 [0096.065] lstrlenW (lpString=".bac") returned 4 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".bac") returned 0x0 [0096.065] lstrlenW (lpString=".sys") returned 4 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".sys") returned 0x0 [0096.065] lstrlenW (lpString=".v2i") returned 4 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".v2i") returned 0x0 [0096.065] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.067] lstrlenW (lpString=".sql") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".sql") returned 0x0 [0096.067] lstrlenW (lpString=".mdf") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".mdf") returned 0x0 [0096.067] lstrlenW (lpString=".txt") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".txt") returned 0x0 [0096.067] lstrlenW (lpString=".dbf") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".dbf") returned 0x0 [0096.067] lstrlenW (lpString=".ckp") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".ckp") returned 0x0 [0096.067] lstrlenW (lpString=".dacpac") returned 7 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".dacpac") returned 0x0 [0096.067] lstrlenW (lpString=".db3") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".db3") returned 0x0 [0096.067] lstrlenW (lpString=".dtxs") returned 5 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".dtxs") returned 0x0 [0096.067] lstrlenW (lpString=".mdt") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".mdt") returned 0x0 [0096.067] lstrlenW (lpString=".sdf") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".sdf") returned 0x0 [0096.067] lstrlenW (lpString=".MDF") returned 4 [0096.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".MDF") returned 0x0 [0096.067] lstrlenW (lpString=".DBF") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".DBF") returned 0x0 [0096.068] lstrlenW (lpString=".DB") returned 3 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".DB") returned 0x0 [0096.068] lstrlenW (lpString=".db") returned 3 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".db") returned 0x0 [0096.068] lstrlenW (lpString=".ndf") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".ndf") returned 0x0 [0096.068] lstrlenW (lpString=".NDF") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".NDF") returned 0x0 [0096.068] lstrlenW (lpString=".Mdf") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".Mdf") returned 0x0 [0096.068] lstrlenW (lpString=".dat") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".dat") returned 0x0 [0096.068] lstrlenW (lpString=".DAT") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".DAT") returned 0x0 [0096.068] lstrlenW (lpString=".ldf") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".ldf") returned 0x0 [0096.068] lstrlenW (lpString=".LDF") returned 4 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch=".LDF") returned 0x0 [0096.068] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.068] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e66d8) returned 1 [0096.069] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.069] CryptReleaseContext (hProv=0x27e66d8, dwFlags=0x0) returned 1 [0096.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.069] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21607049124) returned 1 [0096.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc8137ed0, dwHighDateTime=0x1d585b4)) [0096.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e12e0 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e12e0 | out: hHeap=0x260000) returned 1 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.070] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.070] GetLastError () returned 0x0 [0096.070] GetLastError () returned 0x0 [0096.071] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.071] GetLastError () returned 0x0 [0096.071] GetLastError () returned 0x0 [0096.085] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.085] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.085] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.085] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.094] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.094] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.094] CloseHandle (hObject=0xe4) returned 1 [0096.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.096] GetLastError () returned 0x0 [0096.096] RtlWakeConditionVariable () returned 0x0 [0096.096] GetCurrentThreadId () returned 0x998 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".ldf") returned 0x0 [0096.097] lstrlenW (lpString=".vhd") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".vhd") returned 0x0 [0096.097] lstrlenW (lpString=".vhdx") returned 5 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".vhdx") returned 0x0 [0096.097] lstrlenW (lpString=".pst") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".pst") returned 0x0 [0096.097] lstrlenW (lpString=".ost") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".ost") returned 0x0 [0096.097] lstrlenW (lpString=".bak") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".bak") returned 0x0 [0096.097] lstrlenW (lpString=".bac") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".bac") returned 0x0 [0096.097] lstrlenW (lpString=".sys") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".sys") returned 0x0 [0096.097] lstrlenW (lpString=".v2i") returned 4 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".v2i") returned 0x0 [0096.097] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.099] lstrlenW (lpString=".sql") returned 4 [0096.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".sql") returned 0x0 [0096.099] lstrlenW (lpString=".mdf") returned 4 [0096.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".mdf") returned 0x0 [0096.099] lstrlenW (lpString=".txt") returned 4 [0096.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".txt") returned 0x0 [0096.099] lstrlenW (lpString=".dbf") returned 4 [0096.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".dbf") returned 0x0 [0096.099] lstrlenW (lpString=".ckp") returned 4 [0096.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".ckp") returned 0x0 [0096.099] lstrlenW (lpString=".dacpac") returned 7 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".dacpac") returned 0x0 [0096.100] lstrlenW (lpString=".db3") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".db3") returned 0x0 [0096.100] lstrlenW (lpString=".dtxs") returned 5 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".dtxs") returned 0x0 [0096.100] lstrlenW (lpString=".mdt") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".mdt") returned 0x0 [0096.100] lstrlenW (lpString=".sdf") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".sdf") returned 0x0 [0096.100] lstrlenW (lpString=".MDF") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".MDF") returned 0x0 [0096.100] lstrlenW (lpString=".DBF") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".DBF") returned 0x0 [0096.100] lstrlenW (lpString=".DB") returned 3 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".DB") returned 0x0 [0096.100] lstrlenW (lpString=".db") returned 3 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".db") returned 0x0 [0096.100] lstrlenW (lpString=".ndf") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".ndf") returned 0x0 [0096.100] lstrlenW (lpString=".NDF") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".NDF") returned 0x0 [0096.100] lstrlenW (lpString=".Mdf") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".Mdf") returned 0x0 [0096.100] lstrlenW (lpString=".dat") returned 4 [0096.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".dat") returned 0x0 [0096.100] lstrlenW (lpString=".DAT") returned 4 [0096.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".DAT") returned 0x0 [0096.101] lstrlenW (lpString=".ldf") returned 4 [0096.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".ldf") returned 0x0 [0096.101] lstrlenW (lpString=".LDF") returned 4 [0096.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch=".LDF") returned 0x0 [0096.101] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.101] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6870) returned 1 [0096.102] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.102] CryptReleaseContext (hProv=0x27e6870, dwFlags=0x0) returned 1 [0096.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.102] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21610298892) returned 1 [0096.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc8184190, dwHighDateTime=0x1d585b4)) [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1350 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1350 | out: hHeap=0x260000) returned 1 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.103] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.103] GetLastError () returned 0x0 [0096.103] GetLastError () returned 0x0 [0096.103] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.103] GetLastError () returned 0x0 [0096.103] GetLastError () returned 0x0 [0096.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.118] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.118] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.119] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.120] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.120] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.121] CloseHandle (hObject=0xe4) returned 1 [0096.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.131] GetLastError () returned 0x0 [0096.131] RtlWakeConditionVariable () returned 0x27e828 [0096.131] GetCurrentThreadId () returned 0x998 [0096.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".ldf") returned 0x0 [0096.131] lstrlenW (lpString=".vhd") returned 4 [0096.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".vhd") returned 0x0 [0096.132] lstrlenW (lpString=".vhdx") returned 5 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".vhdx") returned 0x0 [0096.132] lstrlenW (lpString=".pst") returned 4 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".pst") returned 0x0 [0096.132] lstrlenW (lpString=".ost") returned 4 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".ost") returned 0x0 [0096.132] lstrlenW (lpString=".bak") returned 4 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".bak") returned 0x0 [0096.132] lstrlenW (lpString=".bac") returned 4 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".bac") returned 0x0 [0096.132] lstrlenW (lpString=".sys") returned 4 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".sys") returned 0x0 [0096.132] lstrlenW (lpString=".v2i") returned 4 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".v2i") returned 0x0 [0096.132] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.133] lstrlenW (lpString=".sql") returned 4 [0096.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".sql") returned 0x0 [0096.133] lstrlenW (lpString=".mdf") returned 4 [0096.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".mdf") returned 0x0 [0096.133] lstrlenW (lpString=".txt") returned 4 [0096.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".txt") returned 0x0 [0096.133] lstrlenW (lpString=".dbf") returned 4 [0096.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".dbf") returned 0x0 [0096.134] lstrlenW (lpString=".ckp") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".ckp") returned 0x0 [0096.134] lstrlenW (lpString=".dacpac") returned 7 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".dacpac") returned 0x0 [0096.134] lstrlenW (lpString=".db3") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".db3") returned 0x0 [0096.134] lstrlenW (lpString=".dtxs") returned 5 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".dtxs") returned 0x0 [0096.134] lstrlenW (lpString=".mdt") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".mdt") returned 0x0 [0096.134] lstrlenW (lpString=".sdf") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".sdf") returned 0x0 [0096.134] lstrlenW (lpString=".MDF") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".MDF") returned 0x0 [0096.134] lstrlenW (lpString=".DBF") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".DBF") returned 0x0 [0096.134] lstrlenW (lpString=".DB") returned 3 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".DB") returned 0x0 [0096.134] lstrlenW (lpString=".db") returned 3 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".db") returned 0x0 [0096.134] lstrlenW (lpString=".ndf") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".ndf") returned 0x0 [0096.134] lstrlenW (lpString=".NDF") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".NDF") returned 0x0 [0096.134] lstrlenW (lpString=".Mdf") returned 4 [0096.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".Mdf") returned 0x0 [0096.135] lstrlenW (lpString=".dat") returned 4 [0096.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".dat") returned 0x0 [0096.135] lstrlenW (lpString=".DAT") returned 4 [0096.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".DAT") returned 0x0 [0096.135] lstrlenW (lpString=".ldf") returned 4 [0096.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".ldf") returned 0x0 [0096.135] lstrlenW (lpString=".LDF") returned 4 [0096.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch=".LDF") returned 0x0 [0096.135] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.135] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6980) returned 1 [0096.136] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.136] CryptReleaseContext (hProv=0x27e6980, dwFlags=0x0) returned 1 [0096.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.136] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21613707873) returned 1 [0096.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc81d0450, dwHighDateTime=0x1d585b4)) [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e13f8 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e13f8 | out: hHeap=0x260000) returned 1 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f6b8 [0096.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f6b8 | out: hHeap=0x260000) returned 1 [0096.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.137] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.137] GetLastError () returned 0x0 [0096.137] GetLastError () returned 0x0 [0096.137] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.137] GetLastError () returned 0x0 [0096.137] GetLastError () returned 0x0 [0096.139] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.139] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x4780, lpOverlapped=0x0) returned 1 [0096.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.139] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.139] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.139] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.139] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.139] CloseHandle (hObject=0x108) returned 1 [0096.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.141] GetLastError () returned 0x0 [0096.141] RtlWakeConditionVariable () returned 0x27e828 [0096.141] GetCurrentThreadId () returned 0x998 [0096.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".ldf") returned 0x0 [0096.141] lstrlenW (lpString=".vhd") returned 4 [0096.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".vhd") returned 0x0 [0096.141] lstrlenW (lpString=".vhdx") returned 5 [0096.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".vhdx") returned 0x0 [0096.141] lstrlenW (lpString=".pst") returned 4 [0096.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".pst") returned 0x0 [0096.142] lstrlenW (lpString=".ost") returned 4 [0096.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".ost") returned 0x0 [0096.142] lstrlenW (lpString=".bak") returned 4 [0096.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".bak") returned 0x0 [0096.142] lstrlenW (lpString=".bac") returned 4 [0096.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".bac") returned 0x0 [0096.142] lstrlenW (lpString=".sys") returned 4 [0096.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".sys") returned 0x0 [0096.142] lstrlenW (lpString=".v2i") returned 4 [0096.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".v2i") returned 0x0 [0096.142] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0096.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.143] lstrlenW (lpString=".sql") returned 4 [0096.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".sql") returned 0x0 [0096.143] lstrlenW (lpString=".mdf") returned 4 [0096.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".mdf") returned 0x0 [0096.143] lstrlenW (lpString=".txt") returned 4 [0096.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".txt") returned 0x0 [0096.143] lstrlenW (lpString=".dbf") returned 4 [0096.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".dbf") returned 0x0 [0096.143] lstrlenW (lpString=".ckp") returned 4 [0096.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".ckp") returned 0x0 [0096.143] lstrlenW (lpString=".dacpac") returned 7 [0096.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".dacpac") returned 0x0 [0096.144] lstrlenW (lpString=".db3") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".db3") returned 0x0 [0096.144] lstrlenW (lpString=".dtxs") returned 5 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".dtxs") returned 0x0 [0096.144] lstrlenW (lpString=".mdt") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".mdt") returned 0x0 [0096.144] lstrlenW (lpString=".sdf") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".sdf") returned 0x0 [0096.144] lstrlenW (lpString=".MDF") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".MDF") returned 0x0 [0096.144] lstrlenW (lpString=".DBF") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".DBF") returned 0x0 [0096.144] lstrlenW (lpString=".DB") returned 3 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".DB") returned 0x0 [0096.144] lstrlenW (lpString=".db") returned 3 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".db") returned 0x0 [0096.144] lstrlenW (lpString=".ndf") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".ndf") returned 0x0 [0096.144] lstrlenW (lpString=".NDF") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".NDF") returned 0x0 [0096.144] lstrlenW (lpString=".Mdf") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".Mdf") returned 0x0 [0096.144] lstrlenW (lpString=".dat") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".dat") returned 0x0 [0096.144] lstrlenW (lpString=".DAT") returned 4 [0096.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".DAT") returned 0x0 [0096.145] lstrlenW (lpString=".ldf") returned 4 [0096.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".ldf") returned 0x0 [0096.145] lstrlenW (lpString=".LDF") returned 4 [0096.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch=".LDF") returned 0x0 [0096.145] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.145] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6980) returned 1 [0096.146] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.146] CryptReleaseContext (hProv=0x27e6980, dwFlags=0x0) returned 1 [0096.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.146] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21614692218) returned 1 [0096.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc81f65b0, dwHighDateTime=0x1d585b4)) [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1430 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1430 | out: hHeap=0x260000) returned 1 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f6b8 [0096.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f6b8 | out: hHeap=0x260000) returned 1 [0096.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0096.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.146] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.147] GetLastError () returned 0x0 [0096.147] GetLastError () returned 0x0 [0096.147] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.147] GetLastError () returned 0x0 [0096.147] GetLastError () returned 0x0 [0096.183] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.194] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.194] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.194] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.194] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.194] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.194] CloseHandle (hObject=0x108) returned 1 [0096.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.[deadmin@cock.li].deadmin")) returned 1 [0096.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.206] GetLastError () returned 0x0 [0096.206] RtlWakeConditionVariable () returned 0x0 [0096.206] GetCurrentThreadId () returned 0x998 [0096.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".ldf") returned 0x0 [0096.206] lstrlenW (lpString=".vhd") returned 4 [0096.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".vhd") returned 0x0 [0096.206] lstrlenW (lpString=".vhdx") returned 5 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".vhdx") returned 0x0 [0096.207] lstrlenW (lpString=".pst") returned 4 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".pst") returned 0x0 [0096.207] lstrlenW (lpString=".ost") returned 4 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".ost") returned 0x0 [0096.207] lstrlenW (lpString=".bak") returned 4 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".bak") returned 0x0 [0096.207] lstrlenW (lpString=".bac") returned 4 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".bac") returned 0x0 [0096.207] lstrlenW (lpString=".sys") returned 4 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".sys") returned 0x0 [0096.207] lstrlenW (lpString=".v2i") returned 4 [0096.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".v2i") returned 0x0 [0096.210] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.211] lstrlenW (lpString=".sql") returned 4 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".sql") returned 0x0 [0096.211] lstrlenW (lpString=".mdf") returned 4 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".mdf") returned 0x0 [0096.211] lstrlenW (lpString=".txt") returned 4 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".txt") returned 0x0 [0096.211] lstrlenW (lpString=".dbf") returned 4 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".dbf") returned 0x0 [0096.211] lstrlenW (lpString=".ckp") returned 4 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".ckp") returned 0x0 [0096.211] lstrlenW (lpString=".dacpac") returned 7 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".dacpac") returned 0x0 [0096.211] lstrlenW (lpString=".db3") returned 4 [0096.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".db3") returned 0x0 [0096.211] lstrlenW (lpString=".dtxs") returned 5 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".dtxs") returned 0x0 [0096.212] lstrlenW (lpString=".mdt") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".mdt") returned 0x0 [0096.212] lstrlenW (lpString=".sdf") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".sdf") returned 0x0 [0096.212] lstrlenW (lpString=".MDF") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".MDF") returned 0x0 [0096.212] lstrlenW (lpString=".DBF") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".DBF") returned 0x0 [0096.212] lstrlenW (lpString=".DB") returned 3 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".DB") returned 0x0 [0096.212] lstrlenW (lpString=".db") returned 3 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".db") returned 0x0 [0096.212] lstrlenW (lpString=".ndf") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".ndf") returned 0x0 [0096.212] lstrlenW (lpString=".NDF") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".NDF") returned 0x0 [0096.212] lstrlenW (lpString=".Mdf") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".Mdf") returned 0x0 [0096.212] lstrlenW (lpString=".dat") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".dat") returned 0x0 [0096.212] lstrlenW (lpString=".DAT") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".DAT") returned 0x0 [0096.212] lstrlenW (lpString=".ldf") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".ldf") returned 0x0 [0096.212] lstrlenW (lpString=".LDF") returned 4 [0096.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch=".LDF") returned 0x0 [0096.213] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.213] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6980) returned 1 [0096.214] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.214] CryptReleaseContext (hProv=0x27e6980, dwFlags=0x0) returned 1 [0096.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.214] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21621487460) returned 1 [0096.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc828eb30, dwHighDateTime=0x1d585b4)) [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1580 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1580 | out: hHeap=0x260000) returned 1 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d670 [0096.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.214] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.215] GetLastError () returned 0x0 [0096.215] GetLastError () returned 0x0 [0096.215] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.215] GetLastError () returned 0x0 [0096.215] GetLastError () returned 0x0 [0096.219] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.219] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.219] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.219] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.232] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.232] CloseHandle (hObject=0x108) returned 1 [0096.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.234] GetLastError () returned 0x0 [0096.234] RtlWakeConditionVariable () returned 0x27e828 [0096.234] GetCurrentThreadId () returned 0x998 [0096.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".ldf") returned 0x0 [0096.234] lstrlenW (lpString=".vhd") returned 4 [0096.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".vhd") returned 0x0 [0096.234] lstrlenW (lpString=".vhdx") returned 5 [0096.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".vhdx") returned 0x0 [0096.234] lstrlenW (lpString=".pst") returned 4 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".pst") returned 0x0 [0096.235] lstrlenW (lpString=".ost") returned 4 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".ost") returned 0x0 [0096.235] lstrlenW (lpString=".bak") returned 4 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".bak") returned 0x0 [0096.235] lstrlenW (lpString=".bac") returned 4 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".bac") returned 0x0 [0096.235] lstrlenW (lpString=".sys") returned 4 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".sys") returned 0x0 [0096.235] lstrlenW (lpString=".v2i") returned 4 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".v2i") returned 0x0 [0096.235] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.236] lstrlenW (lpString=".sql") returned 4 [0096.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".sql") returned 0x0 [0096.237] lstrlenW (lpString=".mdf") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".mdf") returned 0x0 [0096.237] lstrlenW (lpString=".txt") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".txt") returned 0x0 [0096.237] lstrlenW (lpString=".dbf") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".dbf") returned 0x0 [0096.237] lstrlenW (lpString=".ckp") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".ckp") returned 0x0 [0096.237] lstrlenW (lpString=".dacpac") returned 7 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".dacpac") returned 0x0 [0096.237] lstrlenW (lpString=".db3") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".db3") returned 0x0 [0096.237] lstrlenW (lpString=".dtxs") returned 5 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".dtxs") returned 0x0 [0096.237] lstrlenW (lpString=".mdt") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".mdt") returned 0x0 [0096.237] lstrlenW (lpString=".sdf") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".sdf") returned 0x0 [0096.237] lstrlenW (lpString=".MDF") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".MDF") returned 0x0 [0096.237] lstrlenW (lpString=".DBF") returned 4 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".DBF") returned 0x0 [0096.237] lstrlenW (lpString=".DB") returned 3 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".DB") returned 0x0 [0096.237] lstrlenW (lpString=".db") returned 3 [0096.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".db") returned 0x0 [0096.238] lstrlenW (lpString=".ndf") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".ndf") returned 0x0 [0096.238] lstrlenW (lpString=".NDF") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".NDF") returned 0x0 [0096.238] lstrlenW (lpString=".Mdf") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".Mdf") returned 0x0 [0096.238] lstrlenW (lpString=".dat") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".dat") returned 0x0 [0096.238] lstrlenW (lpString=".DAT") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".DAT") returned 0x0 [0096.238] lstrlenW (lpString=".ldf") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".ldf") returned 0x0 [0096.238] lstrlenW (lpString=".LDF") returned 4 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch=".LDF") returned 0x0 [0096.238] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.238] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6a08) returned 1 [0096.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.239] CryptReleaseContext (hProv=0x27e6a08, dwFlags=0x0) returned 1 [0096.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.239] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21624039285) returned 1 [0096.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc82dadf0, dwHighDateTime=0x1d585b4)) [0096.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e15f0 [0096.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e15f0 | out: hHeap=0x260000) returned 1 [0096.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.240] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.240] GetLastError () returned 0x0 [0096.240] GetLastError () returned 0x0 [0096.240] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.240] GetLastError () returned 0x0 [0096.241] GetLastError () returned 0x0 [0096.250] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb860, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.250] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x1cffdb0*=0x47a0, lpOverlapped=0x0) returned 1 [0096.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.250] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.250] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.250] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.250] CloseHandle (hObject=0x108) returned 1 [0096.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.263] GetLastError () returned 0x0 [0096.263] RtlWakeConditionVariable () returned 0x27e828 [0096.263] GetCurrentThreadId () returned 0x998 [0096.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".ldf") returned 0x0 [0096.264] lstrlenW (lpString=".vhd") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".vhd") returned 0x0 [0096.264] lstrlenW (lpString=".vhdx") returned 5 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".vhdx") returned 0x0 [0096.264] lstrlenW (lpString=".pst") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".pst") returned 0x0 [0096.264] lstrlenW (lpString=".ost") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".ost") returned 0x0 [0096.264] lstrlenW (lpString=".bak") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".bak") returned 0x0 [0096.264] lstrlenW (lpString=".bac") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".bac") returned 0x0 [0096.264] lstrlenW (lpString=".sys") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".sys") returned 0x0 [0096.264] lstrlenW (lpString=".v2i") returned 4 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".v2i") returned 0x0 [0096.264] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.269] lstrlenW (lpString=".sql") returned 4 [0096.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".sql") returned 0x0 [0096.269] lstrlenW (lpString=".mdf") returned 4 [0096.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".mdf") returned 0x0 [0096.278] lstrlenW (lpString=".txt") returned 4 [0096.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".txt") returned 0x0 [0096.279] lstrlenW (lpString=".dbf") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".dbf") returned 0x0 [0096.279] lstrlenW (lpString=".ckp") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".ckp") returned 0x0 [0096.279] lstrlenW (lpString=".dacpac") returned 7 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".dacpac") returned 0x0 [0096.279] lstrlenW (lpString=".db3") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".db3") returned 0x0 [0096.279] lstrlenW (lpString=".dtxs") returned 5 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".dtxs") returned 0x0 [0096.279] lstrlenW (lpString=".mdt") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".mdt") returned 0x0 [0096.279] lstrlenW (lpString=".sdf") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".sdf") returned 0x0 [0096.279] lstrlenW (lpString=".MDF") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".MDF") returned 0x0 [0096.279] lstrlenW (lpString=".DBF") returned 4 [0096.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".DBF") returned 0x0 [0096.280] lstrlenW (lpString=".DB") returned 3 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".DB") returned 0x0 [0096.280] lstrlenW (lpString=".db") returned 3 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".db") returned 0x0 [0096.280] lstrlenW (lpString=".ndf") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".ndf") returned 0x0 [0096.280] lstrlenW (lpString=".NDF") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".NDF") returned 0x0 [0096.280] lstrlenW (lpString=".Mdf") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".Mdf") returned 0x0 [0096.280] lstrlenW (lpString=".dat") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".dat") returned 0x0 [0096.280] lstrlenW (lpString=".DAT") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".DAT") returned 0x0 [0096.280] lstrlenW (lpString=".ldf") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".ldf") returned 0x0 [0096.280] lstrlenW (lpString=".LDF") returned 4 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch=".LDF") returned 0x0 [0096.280] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.280] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6a08) returned 1 [0096.281] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.281] CryptReleaseContext (hProv=0x27e6a08, dwFlags=0x0) returned 1 [0096.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.281] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21628244592) returned 1 [0096.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc83270b0, dwHighDateTime=0x1d585b4)) [0096.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1698 [0096.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1698 | out: hHeap=0x260000) returned 1 [0096.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0096.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.282] GetLastError () returned 0x0 [0096.282] GetLastError () returned 0x0 [0096.282] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.283] GetLastError () returned 0x0 [0096.283] GetLastError () returned 0x0 [0096.364] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.364] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.366] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.366] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.368] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.368] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.368] CloseHandle (hObject=0x104) returned 1 [0096.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.403] GetLastError () returned 0x0 [0096.403] RtlWakeConditionVariable () returned 0x27e828 [0096.403] GetCurrentThreadId () returned 0x998 [0096.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".ldf") returned 0x0 [0096.403] lstrlenW (lpString=".vhd") returned 4 [0096.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".vhd") returned 0x0 [0096.410] lstrlenW (lpString=".vhdx") returned 5 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".vhdx") returned 0x0 [0096.410] lstrlenW (lpString=".pst") returned 4 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".pst") returned 0x0 [0096.410] lstrlenW (lpString=".ost") returned 4 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".ost") returned 0x0 [0096.410] lstrlenW (lpString=".bak") returned 4 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".bak") returned 0x0 [0096.410] lstrlenW (lpString=".bac") returned 4 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".bac") returned 0x0 [0096.410] lstrlenW (lpString=".sys") returned 4 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".sys") returned 0x0 [0096.410] lstrlenW (lpString=".v2i") returned 4 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".v2i") returned 0x0 [0096.410] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.412] lstrlenW (lpString=".sql") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".sql") returned 0x0 [0096.413] lstrlenW (lpString=".mdf") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".mdf") returned 0x0 [0096.413] lstrlenW (lpString=".txt") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".txt") returned 0x0 [0096.413] lstrlenW (lpString=".dbf") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".dbf") returned 0x0 [0096.413] lstrlenW (lpString=".ckp") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".ckp") returned 0x0 [0096.413] lstrlenW (lpString=".dacpac") returned 7 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".dacpac") returned 0x0 [0096.413] lstrlenW (lpString=".db3") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".db3") returned 0x0 [0096.413] lstrlenW (lpString=".dtxs") returned 5 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".dtxs") returned 0x0 [0096.413] lstrlenW (lpString=".mdt") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".mdt") returned 0x0 [0096.413] lstrlenW (lpString=".sdf") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".sdf") returned 0x0 [0096.413] lstrlenW (lpString=".MDF") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".MDF") returned 0x0 [0096.413] lstrlenW (lpString=".DBF") returned 4 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".DBF") returned 0x0 [0096.413] lstrlenW (lpString=".DB") returned 3 [0096.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".DB") returned 0x0 [0096.413] lstrlenW (lpString=".db") returned 3 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".db") returned 0x0 [0096.414] lstrlenW (lpString=".ndf") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".ndf") returned 0x0 [0096.414] lstrlenW (lpString=".NDF") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".NDF") returned 0x0 [0096.414] lstrlenW (lpString=".Mdf") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".Mdf") returned 0x0 [0096.414] lstrlenW (lpString=".dat") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".dat") returned 0x0 [0096.414] lstrlenW (lpString=".DAT") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".DAT") returned 0x0 [0096.414] lstrlenW (lpString=".ldf") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".ldf") returned 0x0 [0096.414] lstrlenW (lpString=".LDF") returned 4 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch=".LDF") returned 0x0 [0096.414] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.414] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x27e6ba0) returned 1 [0096.415] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.415] CryptReleaseContext (hProv=0x27e6ba0, dwFlags=0x0) returned 1 [0096.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.415] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21641640413) returned 1 [0096.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc847dd10, dwHighDateTime=0x1d585b4)) [0096.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e18c8 [0096.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e18c8 | out: hHeap=0x260000) returned 1 [0096.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f730 [0096.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f730 | out: hHeap=0x260000) returned 1 [0096.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.416] GetLastError () returned 0x0 [0096.416] GetLastError () returned 0x0 [0096.417] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.417] GetLastError () returned 0x0 [0096.417] GetLastError () returned 0x0 [0096.419] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff9678, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.419] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6988, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x6988, lpOverlapped=0x0) returned 1 [0096.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.419] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.419] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.419] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.419] CloseHandle (hObject=0x104) returned 1 [0096.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4810 [0096.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4810 | out: hHeap=0x260000) returned 1 [0096.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0096.422] GetLastError () returned 0x0 [0096.422] RtlWakeConditionVariable () returned 0x0 [0096.422] GetCurrentThreadId () returned 0x998 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".ldf") returned 0x0 [0096.422] lstrlenW (lpString=".vhd") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".vhd") returned 0x0 [0096.422] lstrlenW (lpString=".vhdx") returned 5 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".vhdx") returned 0x0 [0096.422] lstrlenW (lpString=".pst") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".pst") returned 0x0 [0096.422] lstrlenW (lpString=".ost") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".ost") returned 0x0 [0096.422] lstrlenW (lpString=".bak") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".bak") returned 0x0 [0096.422] lstrlenW (lpString=".bac") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".bac") returned 0x0 [0096.422] lstrlenW (lpString=".sys") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".sys") returned 0x0 [0096.422] lstrlenW (lpString=".v2i") returned 4 [0096.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".v2i") returned 0x0 [0096.423] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0096.425] lstrlenW (lpString=".sql") returned 4 [0096.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".sql") returned 0x0 [0096.425] lstrlenW (lpString=".mdf") returned 4 [0096.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".mdf") returned 0x0 [0096.425] lstrlenW (lpString=".txt") returned 4 [0096.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".txt") returned 0x0 [0096.425] lstrlenW (lpString=".dbf") returned 4 [0096.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".dbf") returned 0x0 [0096.425] lstrlenW (lpString=".ckp") returned 4 [0096.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".ckp") returned 0x0 [0096.425] lstrlenW (lpString=".dacpac") returned 7 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".dacpac") returned 0x0 [0096.426] lstrlenW (lpString=".db3") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".db3") returned 0x0 [0096.426] lstrlenW (lpString=".dtxs") returned 5 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".dtxs") returned 0x0 [0096.426] lstrlenW (lpString=".mdt") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".mdt") returned 0x0 [0096.426] lstrlenW (lpString=".sdf") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".sdf") returned 0x0 [0096.426] lstrlenW (lpString=".MDF") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".MDF") returned 0x0 [0096.426] lstrlenW (lpString=".DBF") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".DBF") returned 0x0 [0096.426] lstrlenW (lpString=".DB") returned 3 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".DB") returned 0x0 [0096.426] lstrlenW (lpString=".db") returned 3 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".db") returned 0x0 [0096.426] lstrlenW (lpString=".ndf") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".ndf") returned 0x0 [0096.426] lstrlenW (lpString=".NDF") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".NDF") returned 0x0 [0096.426] lstrlenW (lpString=".Mdf") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".Mdf") returned 0x0 [0096.426] lstrlenW (lpString=".dat") returned 4 [0096.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".dat") returned 0x0 [0096.426] lstrlenW (lpString=".DAT") returned 4 [0096.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".DAT") returned 0x0 [0096.427] lstrlenW (lpString=".ldf") returned 4 [0096.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".ldf") returned 0x0 [0096.427] lstrlenW (lpString=".LDF") returned 4 [0096.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch=".LDF") returned 0x0 [0096.427] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0096.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.427] CryptAcquireContextA (in: phProv=0x1cffb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1cffb80*=0x2768060) returned 1 [0096.428] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.428] CryptReleaseContext (hProv=0x2768060, dwFlags=0x0) returned 1 [0096.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0096.428] QueryPerformanceCounter (in: lpPerformanceCount=0x1cffb10 | out: lpPerformanceCount=0x1cffb10*=21642899371) returned 1 [0096.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cffb50 | out: lpSystemTimeAsFileTime=0x1cffb50*(dwLowDateTime=0xc84a3e70, dwHighDateTime=0x1d585b4)) [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1900 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1900 | out: hHeap=0x260000) returned 1 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f730 [0096.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f730 | out: hHeap=0x260000) returned 1 [0096.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.429] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x1cff9f0) [0096.429] GetLastError () returned 0x0 [0096.429] GetLastError () returned 0x0 [0096.429] RtlUnwind (TargetFrame=0x1cffae8, TargetIp=0x42ae4e, ExceptionRecord=0x1cff4b4, ReturnValue=0x0) [0096.429] GetLastError () returned 0x0 [0096.429] GetLastError () returned 0x0 [0096.434] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.434] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x1cffdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.435] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.435] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x1cffdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.437] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1cffdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x1cffdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.437] CloseHandle (hObject=0x104) returned 1 [0096.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4810 [0096.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.544] GetLastError () returned 0x0 [0096.544] GetLastError () returned 0x0 [0096.544] GetLastError () returned 0x0 [0096.544] GetLastError () returned 0x0 [0096.544] GetLastError () returned 0x0 Thread: id = 7 os_tid = 0x99c [0029.712] GetLastError () returned 0x57 [0029.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x364) returned 0x27db40 [0029.713] SetLastError (dwErrCode=0x57) [0029.713] GetCurrentThreadId () returned 0x99c [0029.713] GetCurrentThreadId () returned 0x99c [0029.713] RtlWakeConditionVariable () returned 0x1 [0029.715] GetCurrentThreadId () returned 0x99c [0029.715] GetCurrentThreadId () returned 0x99c [0029.715] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.772] GetCurrentThreadId () returned 0x99c [0029.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b2d90 [0029.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0029.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a15d0 | out: hHeap=0x260000) returned 1 [0029.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0029.772] lstrlenW (lpString=".ldf") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".ldf") returned 0x0 [0029.772] lstrlenW (lpString=".vhd") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".vhd") returned 0x0 [0029.772] lstrlenW (lpString=".vhdx") returned 5 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".vhdx") returned 0x0 [0029.772] lstrlenW (lpString=".pst") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".pst") returned 0x0 [0029.772] lstrlenW (lpString=".ost") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".ost") returned 0x0 [0029.772] lstrlenW (lpString=".bak") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".bak") returned 0x0 [0029.772] lstrlenW (lpString=".bac") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".bac") returned 0x0 [0029.772] lstrlenW (lpString=".sys") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".sys") returned 0x0 [0029.772] lstrlenW (lpString=".v2i") returned 4 [0029.772] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch=".v2i") returned 0x0 [0029.772] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.773] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", lpSrch="s\r\n.v2i") returned 0x0 [0029.773] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\." (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0029.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.773] RtlWakeConditionVariable () returned 0x27e828 [0029.773] GetCurrentThreadId () returned 0x99c [0029.773] GetCurrentThreadId () returned 0x99c [0029.773] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.817] GetCurrentThreadId () returned 0x99c [0029.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.817] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\$recycle.bin\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0029.818] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.819] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.819] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.819] WriteFile (in: hFile=0xe8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.820] CloseHandle (hObject=0xe8) returned 1 [0029.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.820] RtlWakeConditionVariable () returned 0x27e828 [0029.820] GetCurrentThreadId () returned 0x99c [0029.820] GetCurrentThreadId () returned 0x99c [0029.820] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.831] GetCurrentThreadId () returned 0x99c [0029.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0029.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0029.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.831] lstrlenW (lpString=".ldf") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".ldf") returned 0x0 [0029.831] lstrlenW (lpString=".vhd") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".vhd") returned 0x0 [0029.831] lstrlenW (lpString=".vhdx") returned 5 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".vhdx") returned 0x0 [0029.831] lstrlenW (lpString=".pst") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".pst") returned 0x0 [0029.831] lstrlenW (lpString=".ost") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".ost") returned 0x0 [0029.831] lstrlenW (lpString=".bak") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".bak") returned 0x0 [0029.831] lstrlenW (lpString=".bac") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".bac") returned 0x0 [0029.831] lstrlenW (lpString=".sys") returned 4 [0029.831] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".sys") returned 0x0 [0029.832] lstrlenW (lpString=".v2i") returned 4 [0029.832] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch=".v2i") returned 0x0 [0029.832] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.832] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG", lpSrch="s\r\n.v2i") returned 0x0 [0029.832] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0029.832] RtlWakeConditionVariable () returned 0x27e828 [0029.832] GetCurrentThreadId () returned 0x99c [0029.832] GetCurrentThreadId () returned 0x99c [0029.832] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.875] GetCurrentThreadId () returned 0x99c [0029.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.875] lstrlenW (lpString=".ldf") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.875] lstrlenW (lpString=".vhd") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.875] lstrlenW (lpString=".vhdx") returned 5 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.875] lstrlenW (lpString=".pst") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.875] lstrlenW (lpString=".ost") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.875] lstrlenW (lpString=".bak") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.875] lstrlenW (lpString=".bac") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.875] lstrlenW (lpString=".sys") returned 4 [0029.875] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.875] lstrlenW (lpString=".v2i") returned 4 [0029.876] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.876] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.876] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.876] RtlWakeConditionVariable () returned 0x27e828 [0029.876] GetCurrentThreadId () returned 0x99c [0029.876] GetCurrentThreadId () returned 0x99c [0029.876] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.891] GetCurrentThreadId () returned 0x99c [0029.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.891] lstrlenW (lpString=".ldf") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.891] lstrlenW (lpString=".vhd") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.891] lstrlenW (lpString=".vhdx") returned 5 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.891] lstrlenW (lpString=".pst") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.891] lstrlenW (lpString=".ost") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.891] lstrlenW (lpString=".bak") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.891] lstrlenW (lpString=".bac") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.891] lstrlenW (lpString=".sys") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.891] lstrlenW (lpString=".v2i") returned 4 [0029.891] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.892] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.892] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.892] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.892] RtlWakeConditionVariable () returned 0x27e828 [0029.892] GetCurrentThreadId () returned 0x99c [0029.892] GetCurrentThreadId () returned 0x99c [0029.892] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.904] GetCurrentThreadId () returned 0x99c [0029.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.904] lstrlenW (lpString=".ldf") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.904] lstrlenW (lpString=".vhd") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.904] lstrlenW (lpString=".vhdx") returned 5 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.904] lstrlenW (lpString=".pst") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.904] lstrlenW (lpString=".ost") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.904] lstrlenW (lpString=".bak") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.904] lstrlenW (lpString=".bac") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.904] lstrlenW (lpString=".sys") returned 4 [0029.904] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.905] lstrlenW (lpString=".v2i") returned 4 [0029.905] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.905] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.905] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.905] RtlWakeConditionVariable () returned 0x27e828 [0029.905] GetCurrentThreadId () returned 0x99c [0029.905] GetCurrentThreadId () returned 0x99c [0029.905] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.986] GetCurrentThreadId () returned 0x99c [0029.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.986] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\es-es\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.987] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.987] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.987] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.987] WriteFile (in: hFile=0xec, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.988] CloseHandle (hObject=0xec) returned 1 [0029.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.988] RtlWakeConditionVariable () returned 0x27e828 [0029.988] GetCurrentThreadId () returned 0x99c [0029.988] GetCurrentThreadId () returned 0x99c [0029.988] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.002] GetCurrentThreadId () returned 0x99c [0030.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.002] lstrlenW (lpString=".ldf") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".ldf") returned 0x0 [0030.002] lstrlenW (lpString=".vhd") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".vhd") returned 0x0 [0030.002] lstrlenW (lpString=".vhdx") returned 5 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".vhdx") returned 0x0 [0030.002] lstrlenW (lpString=".pst") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".pst") returned 0x0 [0030.002] lstrlenW (lpString=".ost") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".ost") returned 0x0 [0030.002] lstrlenW (lpString=".bak") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".bak") returned 0x0 [0030.002] lstrlenW (lpString=".bac") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".bac") returned 0x0 [0030.002] lstrlenW (lpString=".sys") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".sys") returned 0x0 [0030.002] lstrlenW (lpString=".v2i") returned 4 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch=".v2i") returned 0x0 [0030.002] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.002] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf", lpSrch="s\r\n.v2i") returned 0x0 [0030.003] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.003] RtlWakeConditionVariable () returned 0x27e828 [0030.003] GetCurrentThreadId () returned 0x99c [0030.003] GetCurrentThreadId () returned 0x99c [0030.003] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.008] GetCurrentThreadId () returned 0x99c [0030.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.008] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\fonts\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.010] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.010] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.010] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.010] WriteFile (in: hFile=0xec, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.011] CloseHandle (hObject=0xec) returned 1 [0030.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.012] RtlWakeConditionVariable () returned 0x27e828 [0030.012] GetCurrentThreadId () returned 0x99c [0030.012] GetCurrentThreadId () returned 0x99c [0030.012] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.072] GetCurrentThreadId () returned 0x99c [0030.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.072] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\hu-hu\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.072] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.072] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.072] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.072] WriteFile (in: hFile=0xec, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.073] CloseHandle (hObject=0xec) returned 1 [0030.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.074] RtlWakeConditionVariable () returned 0x27e828 [0030.074] GetCurrentThreadId () returned 0x99c [0030.074] GetCurrentThreadId () returned 0x99c [0030.074] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.087] GetCurrentThreadId () returned 0x99c [0030.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.087] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\ja-jp\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.087] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.088] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.088] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.088] WriteFile (in: hFile=0xec, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.089] CloseHandle (hObject=0xec) returned 1 [0030.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.089] RtlWakeConditionVariable () returned 0x27e828 [0030.089] GetCurrentThreadId () returned 0x99c [0030.089] GetCurrentThreadId () returned 0x99c [0030.089] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.105] GetCurrentThreadId () returned 0x99c [0030.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.105] lstrlenW (lpString=".ldf") returned 4 [0030.105] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.105] lstrlenW (lpString=".vhd") returned 4 [0030.105] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.105] lstrlenW (lpString=".vhdx") returned 5 [0030.105] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.105] lstrlenW (lpString=".pst") returned 4 [0030.105] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.105] lstrlenW (lpString=".ost") returned 4 [0030.105] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.105] lstrlenW (lpString=".bak") returned 4 [0030.105] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.106] lstrlenW (lpString=".bac") returned 4 [0030.106] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.106] lstrlenW (lpString=".sys") returned 4 [0030.106] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.106] lstrlenW (lpString=".v2i") returned 4 [0030.106] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.106] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.106] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.106] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.106] RtlWakeConditionVariable () returned 0x27e828 [0030.106] GetCurrentThreadId () returned 0x99c [0030.106] GetCurrentThreadId () returned 0x99c [0030.107] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.118] GetCurrentThreadId () returned 0x99c [0030.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.118] lstrlenW (lpString=".ldf") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.118] lstrlenW (lpString=".vhd") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.118] lstrlenW (lpString=".vhdx") returned 5 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.118] lstrlenW (lpString=".pst") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.118] lstrlenW (lpString=".ost") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.118] lstrlenW (lpString=".bak") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.118] lstrlenW (lpString=".bac") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.118] lstrlenW (lpString=".sys") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.118] lstrlenW (lpString=".v2i") returned 4 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.118] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.118] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.118] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.119] RtlWakeConditionVariable () returned 0x27e828 [0030.119] GetCurrentThreadId () returned 0x99c [0030.119] GetCurrentThreadId () returned 0x99c [0030.119] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.128] GetCurrentThreadId () returned 0x99c [0030.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.128] lstrlenW (lpString=".ldf") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.128] lstrlenW (lpString=".vhd") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.128] lstrlenW (lpString=".vhdx") returned 5 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.128] lstrlenW (lpString=".pst") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.128] lstrlenW (lpString=".ost") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.128] lstrlenW (lpString=".bak") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.128] lstrlenW (lpString=".bac") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.128] lstrlenW (lpString=".sys") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.128] lstrlenW (lpString=".v2i") returned 4 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.128] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.128] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.128] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.129] RtlWakeConditionVariable () returned 0x27e828 [0030.129] GetCurrentThreadId () returned 0x99c [0030.129] GetCurrentThreadId () returned 0x99c [0030.129] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.139] GetCurrentThreadId () returned 0x99c [0030.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.140] lstrlenW (lpString=".ldf") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.140] lstrlenW (lpString=".vhd") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.140] lstrlenW (lpString=".vhdx") returned 5 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.140] lstrlenW (lpString=".pst") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.140] lstrlenW (lpString=".ost") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.140] lstrlenW (lpString=".bak") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.140] lstrlenW (lpString=".bac") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.140] lstrlenW (lpString=".sys") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.140] lstrlenW (lpString=".v2i") returned 4 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.140] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.140] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.140] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.141] RtlWakeConditionVariable () returned 0x27e828 [0030.141] GetCurrentThreadId () returned 0x99c [0030.141] GetCurrentThreadId () returned 0x99c [0030.141] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.151] GetCurrentThreadId () returned 0x99c [0030.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.151] lstrlenW (lpString=".ldf") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.151] lstrlenW (lpString=".vhd") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.151] lstrlenW (lpString=".vhdx") returned 5 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.151] lstrlenW (lpString=".pst") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.151] lstrlenW (lpString=".ost") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.151] lstrlenW (lpString=".bak") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.151] lstrlenW (lpString=".bac") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.151] lstrlenW (lpString=".sys") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.151] lstrlenW (lpString=".v2i") returned 4 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.151] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.151] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.151] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.152] RtlWakeConditionVariable () returned 0x27e828 [0030.152] GetCurrentThreadId () returned 0x99c [0030.152] GetCurrentThreadId () returned 0x99c [0030.152] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.161] GetCurrentThreadId () returned 0x99c [0030.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.161] lstrlenW (lpString=".ldf") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.161] lstrlenW (lpString=".vhd") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.161] lstrlenW (lpString=".vhdx") returned 5 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.161] lstrlenW (lpString=".pst") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.161] lstrlenW (lpString=".ost") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.161] lstrlenW (lpString=".bak") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.161] lstrlenW (lpString=".bac") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.161] lstrlenW (lpString=".sys") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.161] lstrlenW (lpString=".v2i") returned 4 [0030.161] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.161] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.162] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.162] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.162] RtlWakeConditionVariable () returned 0x27e828 [0030.162] GetCurrentThreadId () returned 0x99c [0030.162] GetCurrentThreadId () returned 0x99c [0030.162] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.168] GetCurrentThreadId () returned 0x99c [0030.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.168] lstrlenW (lpString=".ldf") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".ldf") returned 0x0 [0030.169] lstrlenW (lpString=".vhd") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".vhd") returned 0x0 [0030.169] lstrlenW (lpString=".vhdx") returned 5 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".vhdx") returned 0x0 [0030.169] lstrlenW (lpString=".pst") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".pst") returned 0x0 [0030.169] lstrlenW (lpString=".ost") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".ost") returned 0x0 [0030.169] lstrlenW (lpString=".bak") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".bak") returned 0x0 [0030.169] lstrlenW (lpString=".bac") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".bac") returned 0x0 [0030.169] lstrlenW (lpString=".sys") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".sys") returned 0x0 [0030.169] lstrlenW (lpString=".v2i") returned 4 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch=".v2i") returned 0x0 [0030.169] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.169] StrStrW (lpFirst="\\\\?\\C:\\BOOTSECT.BAK", lpSrch="s\r\n.v2i") returned 0x0 [0030.169] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.170] RtlWakeConditionVariable () returned 0x27e828 [0030.170] GetCurrentThreadId () returned 0x99c [0030.170] GetCurrentThreadId () returned 0x99c [0030.170] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.178] GetCurrentThreadId () returned 0x99c [0030.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.178] lstrlenW (lpString=".ldf") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".ldf") returned 0x0 [0030.178] lstrlenW (lpString=".vhd") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".vhd") returned 0x0 [0030.178] lstrlenW (lpString=".vhdx") returned 5 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".vhdx") returned 0x0 [0030.178] lstrlenW (lpString=".pst") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".pst") returned 0x0 [0030.178] lstrlenW (lpString=".ost") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".ost") returned 0x0 [0030.178] lstrlenW (lpString=".bak") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".bak") returned 0x0 [0030.178] lstrlenW (lpString=".bac") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".bac") returned 0x0 [0030.178] lstrlenW (lpString=".sys") returned 4 [0030.178] StrStrW (lpFirst="\\\\?\\C:\\hiberfil.sys", lpSrch=".sys") returned=".sys" [0030.178] lstrlenW (lpString=".sys") returned 4 [0030.178] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.178] RtlWakeConditionVariable () returned 0x27e828 [0030.178] GetCurrentThreadId () returned 0x99c [0030.178] GetCurrentThreadId () returned 0x99c [0030.178] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.192] GetCurrentThreadId () returned 0x99c [0030.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.192] lstrlenW (lpString=".ldf") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".ldf") returned 0x0 [0030.192] lstrlenW (lpString=".vhd") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".vhd") returned 0x0 [0030.192] lstrlenW (lpString=".vhdx") returned 5 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".vhdx") returned 0x0 [0030.192] lstrlenW (lpString=".pst") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".pst") returned 0x0 [0030.192] lstrlenW (lpString=".ost") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".ost") returned 0x0 [0030.192] lstrlenW (lpString=".bak") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".bak") returned 0x0 [0030.192] lstrlenW (lpString=".bac") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".bac") returned 0x0 [0030.192] lstrlenW (lpString=".sys") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".sys") returned 0x0 [0030.192] lstrlenW (lpString=".v2i") returned 4 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch=".v2i") returned 0x0 [0030.192] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\..", lpSrch="s\r\n.v2i") returned 0x0 [0030.193] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\.." (normalized: "c:\\msocache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.193] RtlWakeConditionVariable () returned 0x27e828 [0030.193] GetCurrentThreadId () returned 0x99c [0030.193] GetCurrentThreadId () returned 0x99c [0030.193] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.218] GetCurrentThreadId () returned 0x99c [0030.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3a18 [0030.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0030.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3970 [0030.218] lstrlenW (lpString=".ldf") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".ldf") returned 0x0 [0030.218] lstrlenW (lpString=".vhd") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".vhd") returned 0x0 [0030.218] lstrlenW (lpString=".vhdx") returned 5 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".vhdx") returned 0x0 [0030.218] lstrlenW (lpString=".pst") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".pst") returned 0x0 [0030.218] lstrlenW (lpString=".ost") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".ost") returned 0x0 [0030.218] lstrlenW (lpString=".bak") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".bak") returned 0x0 [0030.218] lstrlenW (lpString=".bac") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".bac") returned 0x0 [0030.218] lstrlenW (lpString=".sys") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".sys") returned 0x0 [0030.218] lstrlenW (lpString=".v2i") returned 4 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".v2i") returned 0x0 [0030.218] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.218] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0030.218] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.219] lstrlenW (lpString=".sql") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".sql") returned 0x0 [0030.219] lstrlenW (lpString=".mdf") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".mdf") returned 0x0 [0030.219] lstrlenW (lpString=".txt") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".txt") returned 0x0 [0030.219] lstrlenW (lpString=".dbf") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".dbf") returned 0x0 [0030.219] lstrlenW (lpString=".ckp") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".ckp") returned 0x0 [0030.219] lstrlenW (lpString=".dacpac") returned 7 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".dacpac") returned 0x0 [0030.219] lstrlenW (lpString=".db3") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".db3") returned 0x0 [0030.219] lstrlenW (lpString=".dtxs") returned 5 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".dtxs") returned 0x0 [0030.219] lstrlenW (lpString=".mdt") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".mdt") returned 0x0 [0030.219] lstrlenW (lpString=".sdf") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".sdf") returned 0x0 [0030.219] lstrlenW (lpString=".MDF") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".MDF") returned 0x0 [0030.219] lstrlenW (lpString=".DBF") returned 4 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".DBF") returned 0x0 [0030.219] lstrlenW (lpString=".DB") returned 3 [0030.219] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".DB") returned 0x0 [0030.219] lstrlenW (lpString=".db") returned 3 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".db") returned 0x0 [0030.220] lstrlenW (lpString=".ndf") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".ndf") returned 0x0 [0030.220] lstrlenW (lpString=".NDF") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".NDF") returned 0x0 [0030.220] lstrlenW (lpString=".Mdf") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".Mdf") returned 0x0 [0030.220] lstrlenW (lpString=".dat") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".dat") returned 0x0 [0030.220] lstrlenW (lpString=".DAT") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".DAT") returned 0x0 [0030.220] lstrlenW (lpString=".ldf") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".ldf") returned 0x0 [0030.220] lstrlenW (lpString=".LDF") returned 4 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch=".LDF") returned 0x0 [0030.220] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.220] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3ac0 [0030.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.220] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d118) returned 1 [0030.221] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.221] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0030.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0030.221] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15022221649) returned 1 [0030.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa2911410, dwHighDateTime=0x1d585b4)) [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d118 [0030.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3bf8 [0030.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3c70 [0030.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0030.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c70 | out: hHeap=0x260000) returned 1 [0030.222] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0030.222] GetLastError () returned 0x0 [0030.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x2b3050 [0030.222] SetLastError (dwErrCode=0x0) [0030.222] GetLastError () returned 0x0 [0030.222] SetLastError (dwErrCode=0x0) [0030.222] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0030.222] GetLastError () returned 0x0 [0030.222] SetLastError (dwErrCode=0x0) [0030.222] GetLastError () returned 0x0 [0030.222] SetLastError (dwErrCode=0x0) [0030.222] GetLastError () returned 0x0 [0030.222] SetLastError (dwErrCode=0x0) [0030.222] GetLastError () returned 0x0 [0030.222] SetLastError (dwErrCode=0x0) [0030.222] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] GetLastError () returned 0x0 [0030.223] SetLastError (dwErrCode=0x0) [0030.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.223] ReadFile (in: hFile=0xf8, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.226] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.226] WriteFile (in: hFile=0xf8, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.227] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.227] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.228] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.228] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.229] CloseHandle (hObject=0xf8) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3bf8 [0030.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.416] GetLastError () returned 0x0 [0030.416] SetLastError (dwErrCode=0x0) [0030.416] GetLastError () returned 0x0 [0030.416] SetLastError (dwErrCode=0x0) [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ac0 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0030.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a18 | out: hHeap=0x260000) returned 1 [0030.416] RtlWakeConditionVariable () returned 0x27e828 [0030.416] GetCurrentThreadId () returned 0x99c [0030.416] GetCurrentThreadId () returned 0x99c [0030.416] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.720] GetCurrentThreadId () returned 0x99c [0030.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3ec8 [0030.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3e10 [0030.721] lstrlenW (lpString=".ldf") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".ldf") returned 0x0 [0030.721] lstrlenW (lpString=".vhd") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".vhd") returned 0x0 [0030.721] lstrlenW (lpString=".vhdx") returned 5 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".vhdx") returned 0x0 [0030.721] lstrlenW (lpString=".pst") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".pst") returned 0x0 [0030.721] lstrlenW (lpString=".ost") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".ost") returned 0x0 [0030.721] lstrlenW (lpString=".bak") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".bak") returned 0x0 [0030.721] lstrlenW (lpString=".bac") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".bac") returned 0x0 [0030.721] lstrlenW (lpString=".sys") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".sys") returned 0x0 [0030.721] lstrlenW (lpString=".v2i") returned 4 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".v2i") returned 0x0 [0030.721] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.721] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0030.721] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0030.721] lstrlenW (lpString=".sql") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".sql") returned 0x0 [0030.722] lstrlenW (lpString=".mdf") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".mdf") returned 0x0 [0030.722] lstrlenW (lpString=".txt") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".txt") returned 0x0 [0030.722] lstrlenW (lpString=".dbf") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".dbf") returned 0x0 [0030.722] lstrlenW (lpString=".ckp") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".ckp") returned 0x0 [0030.722] lstrlenW (lpString=".dacpac") returned 7 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".dacpac") returned 0x0 [0030.722] lstrlenW (lpString=".db3") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".db3") returned 0x0 [0030.722] lstrlenW (lpString=".dtxs") returned 5 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".dtxs") returned 0x0 [0030.722] lstrlenW (lpString=".mdt") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".mdt") returned 0x0 [0030.722] lstrlenW (lpString=".sdf") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".sdf") returned 0x0 [0030.722] lstrlenW (lpString=".MDF") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".MDF") returned 0x0 [0030.722] lstrlenW (lpString=".DBF") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".DBF") returned 0x0 [0030.722] lstrlenW (lpString=".DB") returned 3 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".DB") returned 0x0 [0030.722] lstrlenW (lpString=".db") returned 3 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".db") returned 0x0 [0030.722] lstrlenW (lpString=".ndf") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".ndf") returned 0x0 [0030.722] lstrlenW (lpString=".NDF") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".NDF") returned 0x0 [0030.722] lstrlenW (lpString=".Mdf") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".Mdf") returned 0x0 [0030.722] lstrlenW (lpString=".dat") returned 4 [0030.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".dat") returned 0x0 [0030.722] lstrlenW (lpString=".DAT") returned 4 [0030.723] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".DAT") returned 0x0 [0030.723] lstrlenW (lpString=".ldf") returned 4 [0030.723] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".ldf") returned 0x0 [0030.723] lstrlenW (lpString=".LDF") returned 4 [0030.723] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch=".LDF") returned 0x0 [0030.723] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.723] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3f80 [0030.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.723] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d128) returned 1 [0030.724] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.724] CryptReleaseContext (hProv=0x27d128, dwFlags=0x0) returned 1 [0030.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0030.724] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15072491471) returned 1 [0030.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa2b72a10, dwHighDateTime=0x1d585b4)) [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d128 [0030.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b40b8 [0030.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d128 | out: hHeap=0x260000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3970 [0030.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40b8 | out: hHeap=0x260000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b40b8 [0030.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0030.724] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0030.724] GetLastError () returned 0x0 [0030.724] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.725] GetLastError () returned 0x0 [0030.725] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] GetLastError () returned 0x0 [0030.726] SetLastError (dwErrCode=0x0) [0030.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40b8 | out: hHeap=0x260000) returned 1 [0030.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.727] ReadFile (in: hFile=0xf0, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.732] WriteFile (in: hFile=0xf0, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.733] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.733] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.734] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.734] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.735] CloseHandle (hObject=0xf0) returned 1 [0030.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3b50 [0030.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.995] GetLastError () returned 0x0 [0030.995] SetLastError (dwErrCode=0x0) [0030.995] GetLastError () returned 0x0 [0030.995] SetLastError (dwErrCode=0x0) [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279328 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279308 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a38 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f80 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ec8 | out: hHeap=0x260000) returned 1 [0030.995] RtlWakeConditionVariable () returned 0x27e828 [0030.995] GetCurrentThreadId () returned 0x99c [0030.995] GetCurrentThreadId () returned 0x99c [0030.995] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0031.014] GetCurrentThreadId () returned 0x99c [0031.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3e10 [0031.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c18 | out: hHeap=0x260000) returned 1 [0031.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0031.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3c18 [0031.014] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.015] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0031.015] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0031.015] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0031.015] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0031.016] CloseHandle (hObject=0xf8) returned 1 [0031.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c18 | out: hHeap=0x260000) returned 1 [0031.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0031.016] RtlWakeConditionVariable () returned 0x27e828 [0031.016] GetCurrentThreadId () returned 0x99c [0031.016] GetCurrentThreadId () returned 0x99c [0031.016] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0031.658] GetCurrentThreadId () returned 0x99c [0031.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5250 [0031.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ec8 | out: hHeap=0x260000) returned 1 [0031.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0031.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3ec8 [0031.659] lstrlenW (lpString=".ldf") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".ldf") returned 0x0 [0031.659] lstrlenW (lpString=".vhd") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".vhd") returned 0x0 [0031.659] lstrlenW (lpString=".vhdx") returned 5 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".vhdx") returned 0x0 [0031.659] lstrlenW (lpString=".pst") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".pst") returned 0x0 [0031.659] lstrlenW (lpString=".ost") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".ost") returned 0x0 [0031.659] lstrlenW (lpString=".bak") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".bak") returned 0x0 [0031.659] lstrlenW (lpString=".bac") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".bac") returned 0x0 [0031.659] lstrlenW (lpString=".sys") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".sys") returned 0x0 [0031.659] lstrlenW (lpString=".v2i") returned 4 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".v2i") returned 0x0 [0031.659] lstrlenW (lpString="s\r\n.v2i") returned 7 [0031.659] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0031.659] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.730] lstrlenW (lpString=".sql") returned 4 [0031.730] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".sql") returned 0x0 [0031.731] lstrlenW (lpString=".mdf") returned 4 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".mdf") returned 0x0 [0031.731] lstrlenW (lpString=".txt") returned 4 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".txt") returned 0x0 [0031.731] lstrlenW (lpString=".dbf") returned 4 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".dbf") returned 0x0 [0031.731] lstrlenW (lpString=".ckp") returned 4 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".ckp") returned 0x0 [0031.731] lstrlenW (lpString=".dacpac") returned 7 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".dacpac") returned 0x0 [0031.731] lstrlenW (lpString=".db3") returned 4 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".db3") returned 0x0 [0031.731] lstrlenW (lpString=".dtxs") returned 5 [0031.731] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".dtxs") returned 0x0 [0031.731] lstrlenW (lpString=".mdt") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".mdt") returned 0x0 [0031.732] lstrlenW (lpString=".sdf") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".sdf") returned 0x0 [0031.732] lstrlenW (lpString=".MDF") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".MDF") returned 0x0 [0031.732] lstrlenW (lpString=".DBF") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".DBF") returned 0x0 [0031.732] lstrlenW (lpString=".DB") returned 3 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".DB") returned 0x0 [0031.732] lstrlenW (lpString=".db") returned 3 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".db") returned 0x0 [0031.732] lstrlenW (lpString=".ndf") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".ndf") returned 0x0 [0031.732] lstrlenW (lpString=".NDF") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".NDF") returned 0x0 [0031.732] lstrlenW (lpString=".Mdf") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".Mdf") returned 0x0 [0031.732] lstrlenW (lpString=".dat") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".dat") returned 0x0 [0031.732] lstrlenW (lpString=".DAT") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".DAT") returned 0x0 [0031.732] lstrlenW (lpString=".ldf") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".ldf") returned 0x0 [0031.732] lstrlenW (lpString=".LDF") returned 4 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch=".LDF") returned 0x0 [0031.732] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0031.732] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0031.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d54f0 [0031.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0031.732] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d5308) returned 1 [0031.734] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0031.734] CryptReleaseContext (hProv=0x2d5308, dwFlags=0x0) returned 1 [0031.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2949b0 [0031.735] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15173616818) returned 1 [0031.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa3270ab0, dwHighDateTime=0x1d585b4)) [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0031.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2d5308 [0031.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3b50 [0031.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5308 | out: hHeap=0x260000) returned 1 [0031.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2d5308 [0031.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.735] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.737] GetLastError () returned 0x0 [0031.737] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] GetLastError () returned 0x0 [0031.738] SetLastError (dwErrCode=0x0) [0031.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5308 | out: hHeap=0x260000) returned 1 [0031.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0031.738] ReadFile (in: hFile=0x100, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x238fdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0031.750] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffa56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.750] WriteFile (in: hFile=0x100, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x238fdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0031.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0031.751] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.751] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0031.751] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0031.751] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0031.751] CloseHandle (hObject=0x100) returned 1 [0031.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d5b30 [0031.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.[deadmin@cock.li].deadmin")) returned 1 [0031.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5b30 | out: hHeap=0x260000) returned 1 [0031.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0031.755] GetLastError () returned 0x0 [0031.755] SetLastError (dwErrCode=0x0) [0031.755] GetLastError () returned 0x0 [0031.755] SetLastError (dwErrCode=0x0) [0031.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0031.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0031.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0031.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949b0 | out: hHeap=0x260000) returned 1 [0031.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ec8 | out: hHeap=0x260000) returned 1 [0031.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0031.757] RtlWakeConditionVariable () returned 0x27e828 [0031.757] GetCurrentThreadId () returned 0x99c [0031.757] GetCurrentThreadId () returned 0x99c [0031.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5250 [0031.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f80 | out: hHeap=0x260000) returned 1 [0031.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0031.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d59a0 [0031.757] lstrlenW (lpString=".ldf") returned 4 [0031.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".ldf") returned 0x0 [0031.757] lstrlenW (lpString=".vhd") returned 4 [0031.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".vhd") returned 0x0 [0031.757] lstrlenW (lpString=".vhdx") returned 5 [0031.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".vhdx") returned 0x0 [0031.757] lstrlenW (lpString=".pst") returned 4 [0031.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".pst") returned 0x0 [0031.757] lstrlenW (lpString=".ost") returned 4 [0031.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".ost") returned 0x0 [0031.757] lstrlenW (lpString=".bak") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".bak") returned 0x0 [0031.758] lstrlenW (lpString=".bac") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".bac") returned 0x0 [0031.758] lstrlenW (lpString=".sys") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".sys") returned 0x0 [0031.758] lstrlenW (lpString=".v2i") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".v2i") returned 0x0 [0031.758] lstrlenW (lpString="s\r\n.v2i") returned 7 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0031.758] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.758] lstrlenW (lpString=".sql") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".sql") returned 0x0 [0031.758] lstrlenW (lpString=".mdf") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".mdf") returned 0x0 [0031.758] lstrlenW (lpString=".txt") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".txt") returned 0x0 [0031.758] lstrlenW (lpString=".dbf") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".dbf") returned 0x0 [0031.758] lstrlenW (lpString=".ckp") returned 4 [0031.758] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".ckp") returned 0x0 [0031.759] lstrlenW (lpString=".dacpac") returned 7 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".dacpac") returned 0x0 [0031.759] lstrlenW (lpString=".db3") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".db3") returned 0x0 [0031.759] lstrlenW (lpString=".dtxs") returned 5 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".dtxs") returned 0x0 [0031.759] lstrlenW (lpString=".mdt") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".mdt") returned 0x0 [0031.759] lstrlenW (lpString=".sdf") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".sdf") returned 0x0 [0031.759] lstrlenW (lpString=".MDF") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".MDF") returned 0x0 [0031.759] lstrlenW (lpString=".DBF") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".DBF") returned 0x0 [0031.759] lstrlenW (lpString=".DB") returned 3 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".DB") returned 0x0 [0031.759] lstrlenW (lpString=".db") returned 3 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".db") returned 0x0 [0031.759] lstrlenW (lpString=".ndf") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".ndf") returned 0x0 [0031.759] lstrlenW (lpString=".NDF") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".NDF") returned 0x0 [0031.759] lstrlenW (lpString=".Mdf") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".Mdf") returned 0x0 [0031.759] lstrlenW (lpString=".dat") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".dat") returned 0x0 [0031.759] lstrlenW (lpString=".DAT") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".DAT") returned 0x0 [0031.759] lstrlenW (lpString=".ldf") returned 4 [0031.759] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".ldf") returned 0x0 [0031.760] lstrlenW (lpString=".LDF") returned 4 [0031.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch=".LDF") returned 0x0 [0031.760] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0031.760] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0031.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3ec8 [0031.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0031.760] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d118) returned 1 [0031.761] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0031.761] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0031.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0031.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0031.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2949b0 [0031.761] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15176247378) returned 1 [0031.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa3296c10, dwHighDateTime=0x1d585b4)) [0031.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0031.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0031.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0031.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0031.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0031.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0031.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d118 [0031.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0031.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d54f0 [0031.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0031.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.762] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.763] SetLastError (dwErrCode=0x0) [0031.763] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] GetLastError () returned 0x0 [0031.764] SetLastError (dwErrCode=0x0) [0031.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0031.765] ReadFile (in: hFile=0x100, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.130] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.130] WriteFile (in: hFile=0x100, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0032.130] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.130] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.138] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.138] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.138] CloseHandle (hObject=0x100) returned 1 [0033.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0033.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.[deadmin@cock.li].deadmin")) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0033.028] GetLastError () returned 0x0 [0033.028] SetLastError (dwErrCode=0x0) [0033.028] GetLastError () returned 0x0 [0033.028] SetLastError (dwErrCode=0x0) [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949b0 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ec8 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d59a0 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0033.028] RtlWakeConditionVariable () returned 0x27e828 [0033.028] GetCurrentThreadId () returned 0x99c [0033.028] GetCurrentThreadId () returned 0x99c [0033.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dbf8 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5c80 | out: hHeap=0x260000) returned 1 [0033.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0033.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0033.028] lstrlenW (lpString=".ldf") returned 4 [0033.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".ldf") returned 0x0 [0033.028] lstrlenW (lpString=".vhd") returned 4 [0033.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".vhd") returned 0x0 [0033.028] lstrlenW (lpString=".vhdx") returned 5 [0033.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".vhdx") returned 0x0 [0033.028] lstrlenW (lpString=".pst") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".pst") returned 0x0 [0033.029] lstrlenW (lpString=".ost") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".ost") returned 0x0 [0033.029] lstrlenW (lpString=".bak") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".bak") returned 0x0 [0033.029] lstrlenW (lpString=".bac") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".bac") returned 0x0 [0033.029] lstrlenW (lpString=".sys") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".sys") returned 0x0 [0033.029] lstrlenW (lpString=".v2i") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".v2i") returned 0x0 [0033.029] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0033.029] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0033.029] lstrlenW (lpString=".sql") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".sql") returned 0x0 [0033.029] lstrlenW (lpString=".mdf") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".mdf") returned 0x0 [0033.029] lstrlenW (lpString=".txt") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".txt") returned 0x0 [0033.029] lstrlenW (lpString=".dbf") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".dbf") returned 0x0 [0033.029] lstrlenW (lpString=".ckp") returned 4 [0033.029] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".ckp") returned 0x0 [0033.030] lstrlenW (lpString=".dacpac") returned 7 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".dacpac") returned 0x0 [0033.030] lstrlenW (lpString=".db3") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".db3") returned 0x0 [0033.030] lstrlenW (lpString=".dtxs") returned 5 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".dtxs") returned 0x0 [0033.030] lstrlenW (lpString=".mdt") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".mdt") returned 0x0 [0033.030] lstrlenW (lpString=".sdf") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".sdf") returned 0x0 [0033.030] lstrlenW (lpString=".MDF") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".MDF") returned 0x0 [0033.030] lstrlenW (lpString=".DBF") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".DBF") returned 0x0 [0033.030] lstrlenW (lpString=".DB") returned 3 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".DB") returned 0x0 [0033.030] lstrlenW (lpString=".db") returned 3 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".db") returned 0x0 [0033.030] lstrlenW (lpString=".ndf") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".ndf") returned 0x0 [0033.030] lstrlenW (lpString=".NDF") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".NDF") returned 0x0 [0033.030] lstrlenW (lpString=".Mdf") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".Mdf") returned 0x0 [0033.030] lstrlenW (lpString=".dat") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".dat") returned 0x0 [0033.030] lstrlenW (lpString=".DAT") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".DAT") returned 0x0 [0033.030] lstrlenW (lpString=".ldf") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".ldf") returned 0x0 [0033.030] lstrlenW (lpString=".LDF") returned 4 [0033.030] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch=".LDF") returned 0x0 [0033.031] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.031] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0033.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.031] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d5250) returned 1 [0033.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.032] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x294580 [0033.032] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15303277582) returned 1 [0033.032] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa3dbf330, dwHighDateTime=0x1d585b4)) [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e480 [0033.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0033.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e480 | out: hHeap=0x260000) returned 1 [0033.032] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0033.032] GetLastError () returned 0x0 [0033.032] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.033] SetLastError (dwErrCode=0x0) [0033.033] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] GetLastError () returned 0x0 [0033.034] SetLastError (dwErrCode=0x0) [0033.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0033.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d98a0 [0033.034] ReadFile (in: hFile=0x100, lpBuffer=0x2d98a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesRead=0x238fdb0*=0x708, lpOverlapped=0x0) returned 1 [0033.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.036] WriteFile (in: hFile=0x100, lpBuffer=0x2d98a0*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d98a0*, lpNumberOfBytesWritten=0x238fdb0*=0x708, lpOverlapped=0x0) returned 1 [0033.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0033.036] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.036] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0033.036] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0033.036] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0033.036] CloseHandle (hObject=0x100) returned 1 [0033.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3aa8 [0033.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3aa8 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0033.038] GetLastError () returned 0x0 [0033.038] SetLastError (dwErrCode=0x0) [0033.038] GetLastError () returned 0x0 [0033.038] SetLastError (dwErrCode=0x0) [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294580 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0033.038] RtlWakeConditionVariable () returned 0x27e828 [0033.038] GetCurrentThreadId () returned 0x99c [0033.038] GetCurrentThreadId () returned 0x99c [0033.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5df0 | out: hHeap=0x260000) returned 1 [0033.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1918 | out: hHeap=0x260000) returned 1 [0033.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5de0 [0033.038] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0033.039] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0033.039] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0033.039] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0033.039] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0033.040] CloseHandle (hObject=0x100) returned 1 [0033.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5de0 | out: hHeap=0x260000) returned 1 [0033.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0033.040] RtlWakeConditionVariable () returned 0x27e828 [0033.040] GetCurrentThreadId () returned 0x99c [0033.040] GetCurrentThreadId () returned 0x99c [0033.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0033.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295da8 | out: hHeap=0x260000) returned 1 [0033.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0033.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295da8 [0033.040] lstrlenW (lpString=".ldf") returned 4 [0033.040] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0033.040] lstrlenW (lpString=".vhd") returned 4 [0033.040] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0033.040] lstrlenW (lpString=".vhdx") returned 5 [0033.040] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0033.040] lstrlenW (lpString=".pst") returned 4 [0033.040] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0033.041] lstrlenW (lpString=".ost") returned 4 [0033.041] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0033.041] lstrlenW (lpString=".bak") returned 4 [0033.041] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0033.041] lstrlenW (lpString=".bac") returned 4 [0033.041] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0033.041] lstrlenW (lpString=".sys") returned 4 [0033.041] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0033.041] lstrlenW (lpString=".v2i") returned 4 [0033.041] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0033.041] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.041] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0033.041] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295da8 | out: hHeap=0x260000) returned 1 [0033.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0033.041] RtlWakeConditionVariable () returned 0x27e828 [0033.041] GetCurrentThreadId () returned 0x99c [0033.041] GetCurrentThreadId () returned 0x99c [0033.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0033.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295e40 | out: hHeap=0x260000) returned 1 [0033.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1988 | out: hHeap=0x260000) returned 1 [0033.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295e40 [0033.042] lstrlenW (lpString=".ldf") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0033.042] lstrlenW (lpString=".vhd") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0033.042] lstrlenW (lpString=".vhdx") returned 5 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0033.042] lstrlenW (lpString=".pst") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0033.042] lstrlenW (lpString=".ost") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0033.042] lstrlenW (lpString=".bak") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0033.042] lstrlenW (lpString=".bac") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0033.042] lstrlenW (lpString=".sys") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0033.042] lstrlenW (lpString=".v2i") returned 4 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0033.042] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.042] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0033.042] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295e40 | out: hHeap=0x260000) returned 1 [0033.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0033.043] RtlWakeConditionVariable () returned 0x27e828 [0033.043] GetCurrentThreadId () returned 0x99c [0033.043] GetCurrentThreadId () returned 0x99c [0033.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0033.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5eb8 | out: hHeap=0x260000) returned 1 [0033.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19c0 | out: hHeap=0x260000) returned 1 [0033.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b9c0 [0033.043] lstrlenW (lpString=".ldf") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".ldf") returned 0x0 [0033.043] lstrlenW (lpString=".vhd") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".vhd") returned 0x0 [0033.043] lstrlenW (lpString=".vhdx") returned 5 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".vhdx") returned 0x0 [0033.043] lstrlenW (lpString=".pst") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".pst") returned 0x0 [0033.043] lstrlenW (lpString=".ost") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".ost") returned 0x0 [0033.043] lstrlenW (lpString=".bak") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".bak") returned 0x0 [0033.043] lstrlenW (lpString=".bac") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".bac") returned 0x0 [0033.043] lstrlenW (lpString=".sys") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".sys") returned 0x0 [0033.043] lstrlenW (lpString=".v2i") returned 4 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".v2i") returned 0x0 [0033.043] lstrlenW (lpString="s\r\n.v2i") returned 7 [0033.043] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch="s\r\n.v2i") returned 0x0 [0033.044] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0033.304] lstrlenW (lpString=".sql") returned 4 [0033.304] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".sql") returned 0x0 [0033.304] lstrlenW (lpString=".mdf") returned 4 [0033.304] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".mdf") returned 0x0 [0033.304] lstrlenW (lpString=".txt") returned 4 [0033.334] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".txt") returned 0x0 [0033.341] lstrlenW (lpString=".dbf") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".dbf") returned 0x0 [0033.341] lstrlenW (lpString=".ckp") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".ckp") returned 0x0 [0033.341] lstrlenW (lpString=".dacpac") returned 7 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".dacpac") returned 0x0 [0033.341] lstrlenW (lpString=".db3") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".db3") returned 0x0 [0033.341] lstrlenW (lpString=".dtxs") returned 5 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".dtxs") returned 0x0 [0033.341] lstrlenW (lpString=".mdt") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".mdt") returned 0x0 [0033.341] lstrlenW (lpString=".sdf") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".sdf") returned 0x0 [0033.341] lstrlenW (lpString=".MDF") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".MDF") returned 0x0 [0033.341] lstrlenW (lpString=".DBF") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".DBF") returned 0x0 [0033.341] lstrlenW (lpString=".DB") returned 3 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".DB") returned 0x0 [0033.341] lstrlenW (lpString=".db") returned 3 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".db") returned 0x0 [0033.341] lstrlenW (lpString=".ndf") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".ndf") returned 0x0 [0033.341] lstrlenW (lpString=".NDF") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".NDF") returned 0x0 [0033.341] lstrlenW (lpString=".Mdf") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".Mdf") returned 0x0 [0033.341] lstrlenW (lpString=".dat") returned 4 [0033.341] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".dat") returned 0x0 [0033.341] lstrlenW (lpString=".DAT") returned 4 [0033.342] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".DAT") returned 0x0 [0033.342] lstrlenW (lpString=".ldf") returned 4 [0033.342] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".ldf") returned 0x0 [0033.342] lstrlenW (lpString=".LDF") returned 4 [0033.342] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch=".LDF") returned 0x0 [0033.342] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0033.342] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0033.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5f70 [0033.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0033.342] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d5250) returned 1 [0033.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0033.343] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0033.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d6240 [0033.343] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15334395336) returned 1 [0033.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa40b8eb0, dwHighDateTime=0x1d585b4)) [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0033.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0033.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d028 [0033.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0033.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296728 [0033.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.344] SetLastError (dwErrCode=0x0) [0033.344] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] GetLastError () returned 0x0 [0033.345] SetLastError (dwErrCode=0x0) [0033.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296728 | out: hHeap=0x260000) returned 1 [0033.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2db8a0 [0033.345] ReadFile (in: hFile=0xf4, lpBuffer=0x2db8a0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.349] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.349] WriteFile (in: hFile=0xf4, lpBuffer=0x2db8a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2db8a0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0033.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0033.349] SetFilePointerEx (in: hFile=0xf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.350] WriteFile (in: hFile=0xf4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0033.351] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0033.351] WriteFile (in: hFile=0xf4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0033.351] CloseHandle (hObject=0xf4) returned 1 [0034.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x298fd8 [0034.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.[deadmin@cock.li].deadmin")) returned 1 [0034.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd8 | out: hHeap=0x260000) returned 1 [0034.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0034.868] GetLastError () returned 0x0 [0034.868] SetLastError (dwErrCode=0x0) [0034.868] GetLastError () returned 0x0 [0034.868] SetLastError (dwErrCode=0x0) [0034.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6240 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f70 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b9c0 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0034.869] RtlWakeConditionVariable () returned 0x27e828 [0034.869] GetCurrentThreadId () returned 0x99c [0034.869] GetCurrentThreadId () returned 0x99c [0034.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6198 | out: hHeap=0x260000) returned 1 [0034.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c60 | out: hHeap=0x260000) returned 1 [0034.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6360 [0034.869] lstrlenW (lpString=".ldf") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".ldf") returned 0x0 [0034.869] lstrlenW (lpString=".vhd") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".vhd") returned 0x0 [0034.869] lstrlenW (lpString=".vhdx") returned 5 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".vhdx") returned 0x0 [0034.869] lstrlenW (lpString=".pst") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".pst") returned 0x0 [0034.869] lstrlenW (lpString=".ost") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".ost") returned 0x0 [0034.869] lstrlenW (lpString=".bak") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".bak") returned 0x0 [0034.869] lstrlenW (lpString=".bac") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".bac") returned 0x0 [0034.869] lstrlenW (lpString=".sys") returned 4 [0034.869] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".sys") returned 0x0 [0034.869] lstrlenW (lpString=".v2i") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".v2i") returned 0x0 [0034.870] lstrlenW (lpString="s\r\n.v2i") returned 7 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch="s\r\n.v2i") returned 0x0 [0034.870] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.870] lstrlenW (lpString=".sql") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".sql") returned 0x0 [0034.870] lstrlenW (lpString=".mdf") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".mdf") returned 0x0 [0034.870] lstrlenW (lpString=".txt") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".txt") returned 0x0 [0034.870] lstrlenW (lpString=".dbf") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".dbf") returned 0x0 [0034.870] lstrlenW (lpString=".ckp") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".ckp") returned 0x0 [0034.870] lstrlenW (lpString=".dacpac") returned 7 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".dacpac") returned 0x0 [0034.870] lstrlenW (lpString=".db3") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".db3") returned 0x0 [0034.870] lstrlenW (lpString=".dtxs") returned 5 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".dtxs") returned 0x0 [0034.870] lstrlenW (lpString=".mdt") returned 4 [0034.870] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".mdt") returned 0x0 [0034.870] lstrlenW (lpString=".sdf") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".sdf") returned 0x0 [0034.871] lstrlenW (lpString=".MDF") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".MDF") returned 0x0 [0034.871] lstrlenW (lpString=".DBF") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".DBF") returned 0x0 [0034.871] lstrlenW (lpString=".DB") returned 3 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".DB") returned 0x0 [0034.871] lstrlenW (lpString=".db") returned 3 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".db") returned 0x0 [0034.871] lstrlenW (lpString=".ndf") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".ndf") returned 0x0 [0034.871] lstrlenW (lpString=".NDF") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".NDF") returned 0x0 [0034.871] lstrlenW (lpString=".Mdf") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".Mdf") returned 0x0 [0034.871] lstrlenW (lpString=".dat") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".dat") returned 0x0 [0034.871] lstrlenW (lpString=".DAT") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".DAT") returned 0x0 [0034.871] lstrlenW (lpString=".ldf") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".ldf") returned 0x0 [0034.871] lstrlenW (lpString=".LDF") returned 4 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch=".LDF") returned 0x0 [0034.871] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0034.871] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0034.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0034.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0034.871] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d5250) returned 1 [0034.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0034.872] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0034.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0034.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0034.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2efcd8 [0034.872] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15487345323) returned 1 [0034.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa4e42bd0, dwHighDateTime=0x1d585b4)) [0034.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0034.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0034.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0034.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c60 [0034.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5250 [0034.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c60 | out: hHeap=0x260000) returned 1 [0034.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0034.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0034.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0034.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0034.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0034.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0034.873] GetLastError () returned 0x0 [0034.873] SetLastError (dwErrCode=0x0) [0034.873] GetLastError () returned 0x0 [0034.873] SetLastError (dwErrCode=0x0) [0034.873] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0034.873] GetLastError () returned 0x0 [0034.873] SetLastError (dwErrCode=0x0) [0034.873] GetLastError () returned 0x0 [0034.873] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.874] SetLastError (dwErrCode=0x0) [0034.874] GetLastError () returned 0x0 [0034.875] SetLastError (dwErrCode=0x0) [0034.875] GetLastError () returned 0x0 [0034.875] SetLastError (dwErrCode=0x0) [0034.875] GetLastError () returned 0x0 [0034.875] SetLastError (dwErrCode=0x0) [0034.875] GetLastError () returned 0x0 [0034.875] SetLastError (dwErrCode=0x0) [0034.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0034.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2f8ac8 [0034.875] ReadFile (in: hFile=0xfc, lpBuffer=0x2f8ac8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.102] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.102] WriteFile (in: hFile=0xfc, lpBuffer=0x2f8ac8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ac8 | out: hHeap=0x260000) returned 1 [0035.103] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.103] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.115] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.115] CloseHandle (hObject=0xfc) returned 1 [0035.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.[deadmin@cock.li].deadmin")) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0035.127] GetLastError () returned 0x0 [0035.127] SetLastError (dwErrCode=0x0) [0035.127] GetLastError () returned 0x0 [0035.127] SetLastError (dwErrCode=0x0) [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efcd8 | out: hHeap=0x260000) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0035.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0035.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0035.128] RtlWakeConditionVariable () returned 0x27e828 [0035.128] GetCurrentThreadId () returned 0x99c [0035.128] GetCurrentThreadId () returned 0x99c [0035.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2990c0 | out: hHeap=0x260000) returned 1 [0035.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d08 | out: hHeap=0x260000) returned 1 [0035.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da088 [0035.128] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.128] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0035.128] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0035.128] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0035.128] WriteFile (in: hFile=0xfc, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0035.129] CloseHandle (hObject=0xfc) returned 1 [0035.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da088 | out: hHeap=0x260000) returned 1 [0035.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0035.129] RtlWakeConditionVariable () returned 0x27e828 [0035.129] GetCurrentThreadId () returned 0x99c [0035.130] GetCurrentThreadId () returned 0x99c [0035.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0035.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0035.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0035.130] lstrlenW (lpString=".ldf") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0035.130] lstrlenW (lpString=".vhd") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0035.130] lstrlenW (lpString=".vhdx") returned 5 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0035.130] lstrlenW (lpString=".pst") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0035.130] lstrlenW (lpString=".ost") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0035.130] lstrlenW (lpString=".bak") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0035.130] lstrlenW (lpString=".bac") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0035.130] lstrlenW (lpString=".sys") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0035.130] lstrlenW (lpString=".v2i") returned 4 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0035.130] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.130] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0035.130] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0035.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.131] RtlWakeConditionVariable () returned 0x27e828 [0035.131] GetCurrentThreadId () returned 0x99c [0035.131] GetCurrentThreadId () returned 0x99c [0035.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295f70 | out: hHeap=0x260000) returned 1 [0035.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0035.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295f70 [0035.131] lstrlenW (lpString=".ldf") returned 4 [0035.131] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0035.131] lstrlenW (lpString=".vhd") returned 4 [0035.131] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0035.131] lstrlenW (lpString=".vhdx") returned 5 [0035.131] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0035.131] lstrlenW (lpString=".pst") returned 4 [0035.131] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0035.131] lstrlenW (lpString=".ost") returned 4 [0035.131] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0035.131] lstrlenW (lpString=".bak") returned 4 [0035.131] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0035.132] lstrlenW (lpString=".bac") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0035.132] lstrlenW (lpString=".sys") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0035.132] lstrlenW (lpString=".v2i") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0035.132] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0035.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295f70 | out: hHeap=0x260000) returned 1 [0035.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.132] RtlWakeConditionVariable () returned 0x27e828 [0035.132] GetCurrentThreadId () returned 0x99c [0035.132] GetCurrentThreadId () returned 0x99c [0035.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b068 | out: hHeap=0x260000) returned 1 [0035.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0035.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b068 [0035.132] lstrlenW (lpString=".ldf") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".ldf") returned 0x0 [0035.132] lstrlenW (lpString=".vhd") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".vhd") returned 0x0 [0035.132] lstrlenW (lpString=".vhdx") returned 5 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".vhdx") returned 0x0 [0035.132] lstrlenW (lpString=".pst") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".pst") returned 0x0 [0035.132] lstrlenW (lpString=".ost") returned 4 [0035.132] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".ost") returned 0x0 [0035.132] lstrlenW (lpString=".bak") returned 4 [0035.133] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".bak") returned 0x0 [0035.133] lstrlenW (lpString=".bac") returned 4 [0035.133] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".bac") returned 0x0 [0035.133] lstrlenW (lpString=".sys") returned 4 [0035.133] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".sys") returned 0x0 [0035.133] lstrlenW (lpString=".v2i") returned 4 [0035.133] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".v2i") returned 0x0 [0035.133] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.133] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0035.133] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.134] lstrlenW (lpString=".sql") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".sql") returned 0x0 [0035.134] lstrlenW (lpString=".mdf") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".mdf") returned 0x0 [0035.134] lstrlenW (lpString=".txt") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".txt") returned 0x0 [0035.134] lstrlenW (lpString=".dbf") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".dbf") returned 0x0 [0035.134] lstrlenW (lpString=".ckp") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".ckp") returned 0x0 [0035.134] lstrlenW (lpString=".dacpac") returned 7 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".dacpac") returned 0x0 [0035.134] lstrlenW (lpString=".db3") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".db3") returned 0x0 [0035.134] lstrlenW (lpString=".dtxs") returned 5 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".dtxs") returned 0x0 [0035.134] lstrlenW (lpString=".mdt") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".mdt") returned 0x0 [0035.134] lstrlenW (lpString=".sdf") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".sdf") returned 0x0 [0035.134] lstrlenW (lpString=".MDF") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".MDF") returned 0x0 [0035.134] lstrlenW (lpString=".DBF") returned 4 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".DBF") returned 0x0 [0035.134] lstrlenW (lpString=".DB") returned 3 [0035.134] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".DB") returned 0x0 [0035.135] lstrlenW (lpString=".db") returned 3 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".db") returned 0x0 [0035.135] lstrlenW (lpString=".ndf") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".ndf") returned 0x0 [0035.135] lstrlenW (lpString=".NDF") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".NDF") returned 0x0 [0035.135] lstrlenW (lpString=".Mdf") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".Mdf") returned 0x0 [0035.135] lstrlenW (lpString=".dat") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".dat") returned 0x0 [0035.135] lstrlenW (lpString=".DAT") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".DAT") returned 0x0 [0035.135] lstrlenW (lpString=".ldf") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".ldf") returned 0x0 [0035.135] lstrlenW (lpString=".LDF") returned 4 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch=".LDF") returned 0x0 [0035.135] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.135] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0035.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f060 [0035.135] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2ec9e8) returned 1 [0035.136] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f060 | out: pbBuffer=0x27f060) returned 1 [0035.136] CryptReleaseContext (hProv=0x2ec9e8, dwFlags=0x0) returned 1 [0035.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f060 | out: hHeap=0x260000) returned 1 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0035.136] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15513721715) returned 1 [0035.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa50ca330, dwHighDateTime=0x1d585b4)) [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2ec9e8 [0035.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ec9e8 | out: hHeap=0x260000) returned 1 [0035.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0035.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0035.137] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0035.137] GetLastError () returned 0x0 [0035.137] SetLastError (dwErrCode=0x0) [0035.137] GetLastError () returned 0x0 [0035.137] SetLastError (dwErrCode=0x0) [0035.137] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0035.137] GetLastError () returned 0x0 [0035.137] SetLastError (dwErrCode=0x0) [0035.137] GetLastError () returned 0x0 [0035.137] SetLastError (dwErrCode=0x0) [0035.137] GetLastError () returned 0x0 [0035.137] SetLastError (dwErrCode=0x0) [0035.137] GetLastError () returned 0x0 [0035.137] SetLastError (dwErrCode=0x0) [0035.137] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.138] SetLastError (dwErrCode=0x0) [0035.138] GetLastError () returned 0x0 [0035.139] SetLastError (dwErrCode=0x0) [0035.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x30cad0 [0035.139] ReadFile (in: hFile=0xfc, lpBuffer=0x30cad0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x30cad0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.150] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.151] WriteFile (in: hFile=0xfc, lpBuffer=0x30cad0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x30cad0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cad0 | out: hHeap=0x260000) returned 1 [0035.151] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.151] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.154] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.154] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.154] CloseHandle (hObject=0xfc) returned 1 [0035.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.[deadmin@cock.li].deadmin")) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0035.429] GetLastError () returned 0x0 [0035.429] SetLastError (dwErrCode=0x0) [0035.429] GetLastError () returned 0x0 [0035.429] SetLastError (dwErrCode=0x0) [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4108 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b068 | out: hHeap=0x260000) returned 1 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0035.429] RtlWakeConditionVariable () returned 0x27e828 [0035.429] GetCurrentThreadId () returned 0x99c [0035.429] GetCurrentThreadId () returned 0x99c [0035.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0035.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0035.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0035.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.430] lstrlenW (lpString=".ldf") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0035.430] lstrlenW (lpString=".vhd") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0035.430] lstrlenW (lpString=".vhdx") returned 5 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0035.430] lstrlenW (lpString=".pst") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0035.430] lstrlenW (lpString=".ost") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0035.430] lstrlenW (lpString=".bak") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0035.430] lstrlenW (lpString=".bac") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0035.430] lstrlenW (lpString=".sys") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0035.430] lstrlenW (lpString=".v2i") returned 4 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0035.430] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.430] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0035.430] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.431] lstrlenW (lpString=".sql") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0035.431] lstrlenW (lpString=".mdf") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0035.431] lstrlenW (lpString=".txt") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0035.431] lstrlenW (lpString=".dbf") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0035.431] lstrlenW (lpString=".ckp") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0035.431] lstrlenW (lpString=".dacpac") returned 7 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0035.431] lstrlenW (lpString=".db3") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0035.431] lstrlenW (lpString=".dtxs") returned 5 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0035.431] lstrlenW (lpString=".mdt") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0035.431] lstrlenW (lpString=".sdf") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0035.431] lstrlenW (lpString=".MDF") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0035.431] lstrlenW (lpString=".DBF") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0035.431] lstrlenW (lpString=".DB") returned 3 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0035.431] lstrlenW (lpString=".db") returned 3 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0035.431] lstrlenW (lpString=".ndf") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0035.431] lstrlenW (lpString=".NDF") returned 4 [0035.431] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0035.431] lstrlenW (lpString=".Mdf") returned 4 [0035.432] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0035.432] lstrlenW (lpString=".dat") returned 4 [0035.432] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0035.432] lstrlenW (lpString=".DAT") returned 4 [0035.432] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0035.432] lstrlenW (lpString=".ldf") returned 4 [0035.432] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0035.432] lstrlenW (lpString=".LDF") returned 4 [0035.432] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0035.432] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.432] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0035.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.432] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d53c0) returned 1 [0035.433] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.433] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0035.433] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15543407191) returned 1 [0035.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa5351a90, dwHighDateTime=0x1d585b4)) [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299110 [0035.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299110 | out: hHeap=0x260000) returned 1 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f75c0 [0035.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f75c0 | out: hHeap=0x260000) returned 1 [0035.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.434] SetLastError (dwErrCode=0x0) [0035.434] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] GetLastError () returned 0x0 [0035.435] SetLastError (dwErrCode=0x0) [0035.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0035.435] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x93a, lpOverlapped=0x0) returned 1 [0035.787] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff6c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.787] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x93a, lpOverlapped=0x0) returned 1 [0035.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0035.788] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.788] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.788] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.788] CloseHandle (hObject=0xfc) returned 1 [0035.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0035.790] GetLastError () returned 0x0 [0035.790] SetLastError (dwErrCode=0x0) [0035.790] GetLastError () returned 0x0 [0035.790] SetLastError (dwErrCode=0x0) [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4108 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0035.790] RtlWakeConditionVariable () returned 0x27e828 [0035.790] GetCurrentThreadId () returned 0x99c [0035.790] GetCurrentThreadId () returned 0x99c [0035.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296008 | out: hHeap=0x260000) returned 1 [0035.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0d88 | out: hHeap=0x260000) returned 1 [0035.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296008 [0035.790] lstrlenW (lpString=".ldf") returned 4 [0035.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0035.790] lstrlenW (lpString=".vhd") returned 4 [0035.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0035.790] lstrlenW (lpString=".vhdx") returned 5 [0035.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0035.791] lstrlenW (lpString=".pst") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0035.791] lstrlenW (lpString=".ost") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0035.791] lstrlenW (lpString=".bak") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0035.791] lstrlenW (lpString=".bac") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0035.791] lstrlenW (lpString=".sys") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0035.791] lstrlenW (lpString=".v2i") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0035.791] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0035.791] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296008 | out: hHeap=0x260000) returned 1 [0035.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.791] RtlWakeConditionVariable () returned 0x27e828 [0035.791] GetCurrentThreadId () returned 0x99c [0035.791] GetCurrentThreadId () returned 0x99c [0035.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0035.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0035.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0035.791] lstrlenW (lpString=".ldf") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0035.791] lstrlenW (lpString=".vhd") returned 4 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0035.791] lstrlenW (lpString=".vhdx") returned 5 [0035.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0035.792] lstrlenW (lpString=".pst") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0035.792] lstrlenW (lpString=".ost") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0035.792] lstrlenW (lpString=".bak") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0035.792] lstrlenW (lpString=".bac") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0035.792] lstrlenW (lpString=".sys") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0035.792] lstrlenW (lpString=".v2i") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0035.792] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0035.792] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0035.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.792] RtlWakeConditionVariable () returned 0x27e828 [0035.792] GetCurrentThreadId () returned 0x99c [0035.792] GetCurrentThreadId () returned 0x99c [0035.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0035.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d2c8 | out: hHeap=0x260000) returned 1 [0035.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d2c8 [0035.792] lstrlenW (lpString=".ldf") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".ldf") returned 0x0 [0035.792] lstrlenW (lpString=".vhd") returned 4 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".vhd") returned 0x0 [0035.792] lstrlenW (lpString=".vhdx") returned 5 [0035.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".vhdx") returned 0x0 [0035.793] lstrlenW (lpString=".pst") returned 4 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".pst") returned 0x0 [0035.793] lstrlenW (lpString=".ost") returned 4 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".ost") returned 0x0 [0035.793] lstrlenW (lpString=".bak") returned 4 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".bak") returned 0x0 [0035.793] lstrlenW (lpString=".bac") returned 4 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".bac") returned 0x0 [0035.793] lstrlenW (lpString=".sys") returned 4 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".sys") returned 0x0 [0035.793] lstrlenW (lpString=".v2i") returned 4 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".v2i") returned 0x0 [0035.793] lstrlenW (lpString="s\r\n.v2i") returned 7 [0035.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0035.793] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.794] lstrlenW (lpString=".sql") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".sql") returned 0x0 [0035.794] lstrlenW (lpString=".mdf") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".mdf") returned 0x0 [0035.794] lstrlenW (lpString=".txt") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".txt") returned 0x0 [0035.794] lstrlenW (lpString=".dbf") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".dbf") returned 0x0 [0035.794] lstrlenW (lpString=".ckp") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".ckp") returned 0x0 [0035.794] lstrlenW (lpString=".dacpac") returned 7 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".dacpac") returned 0x0 [0035.794] lstrlenW (lpString=".db3") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".db3") returned 0x0 [0035.794] lstrlenW (lpString=".dtxs") returned 5 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".dtxs") returned 0x0 [0035.794] lstrlenW (lpString=".mdt") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".mdt") returned 0x0 [0035.794] lstrlenW (lpString=".sdf") returned 4 [0035.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".sdf") returned 0x0 [0035.794] lstrlenW (lpString=".MDF") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".MDF") returned 0x0 [0035.795] lstrlenW (lpString=".DBF") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".DBF") returned 0x0 [0035.795] lstrlenW (lpString=".DB") returned 3 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".DB") returned 0x0 [0035.795] lstrlenW (lpString=".db") returned 3 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".db") returned 0x0 [0035.795] lstrlenW (lpString=".ndf") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".ndf") returned 0x0 [0035.795] lstrlenW (lpString=".NDF") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".NDF") returned 0x0 [0035.795] lstrlenW (lpString=".Mdf") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".Mdf") returned 0x0 [0035.795] lstrlenW (lpString=".dat") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".dat") returned 0x0 [0035.795] lstrlenW (lpString=".DAT") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".DAT") returned 0x0 [0035.795] lstrlenW (lpString=".ldf") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".ldf") returned 0x0 [0035.795] lstrlenW (lpString=".LDF") returned 4 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch=".LDF") returned 0x0 [0035.795] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0035.795] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0035.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0035.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0035.795] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d53c0) returned 1 [0035.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0035.796] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0035.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0035.796] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15579736995) returned 1 [0035.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa56bda30, dwHighDateTime=0x1d585b4)) [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0df8 [0035.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299110 [0035.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0035.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0035.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299110 | out: hHeap=0x260000) returned 1 [0035.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d220 [0035.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0035.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0035.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0035.797] GetLastError () returned 0x0 [0035.797] SetLastError (dwErrCode=0x0) [0035.797] GetLastError () returned 0x0 [0035.797] SetLastError (dwErrCode=0x0) [0035.797] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0035.797] GetLastError () returned 0x0 [0035.797] SetLastError (dwErrCode=0x0) [0035.797] GetLastError () returned 0x0 [0035.797] SetLastError (dwErrCode=0x0) [0035.797] GetLastError () returned 0x0 [0035.797] SetLastError (dwErrCode=0x0) [0035.797] GetLastError () returned 0x0 [0035.797] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.798] GetLastError () returned 0x0 [0035.798] SetLastError (dwErrCode=0x0) [0035.799] GetLastError () returned 0x0 [0035.799] SetLastError (dwErrCode=0x0) [0035.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0035.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0035.799] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.854] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.854] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0035.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0035.855] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.855] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0035.879] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0035.879] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0035.879] CloseHandle (hObject=0xfc) returned 1 [0039.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.[deadmin@cock.li].deadmin")) returned 1 [0039.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.253] GetLastError () returned 0x0 [0039.253] SetLastError (dwErrCode=0x0) [0039.253] GetLastError () returned 0x0 [0039.253] SetLastError (dwErrCode=0x0) [0039.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0039.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8458 | out: hHeap=0x260000) returned 1 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b90 | out: hHeap=0x260000) returned 1 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d2c8 | out: hHeap=0x260000) returned 1 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0039.254] RtlWakeConditionVariable () returned 0x27e828 [0039.254] GetCurrentThreadId () returned 0x99c [0039.254] GetCurrentThreadId () returned 0x99c [0039.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0039.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0039.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0039.254] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.254] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.254] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.254] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0039.254] WriteFile (in: hFile=0xfc, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0039.255] CloseHandle (hObject=0xfc) returned 1 [0039.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0039.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.256] RtlWakeConditionVariable () returned 0x27e828 [0039.256] GetCurrentThreadId () returned 0x99c [0039.256] GetCurrentThreadId () returned 0x99c [0039.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0039.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dd48 | out: hHeap=0x260000) returned 1 [0039.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a17c8 | out: hHeap=0x260000) returned 1 [0039.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dd48 [0039.256] lstrlenW (lpString=".ldf") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".ldf") returned 0x0 [0039.256] lstrlenW (lpString=".vhd") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".vhd") returned 0x0 [0039.256] lstrlenW (lpString=".vhdx") returned 5 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".vhdx") returned 0x0 [0039.256] lstrlenW (lpString=".pst") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".pst") returned 0x0 [0039.256] lstrlenW (lpString=".ost") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".ost") returned 0x0 [0039.256] lstrlenW (lpString=".bak") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".bak") returned 0x0 [0039.256] lstrlenW (lpString=".bac") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".bac") returned 0x0 [0039.256] lstrlenW (lpString=".sys") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".sys") returned 0x0 [0039.256] lstrlenW (lpString=".v2i") returned 4 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".v2i") returned 0x0 [0039.256] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.256] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.256] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.584] lstrlenW (lpString=".sql") returned 4 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".sql") returned 0x0 [0039.584] lstrlenW (lpString=".mdf") returned 4 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".mdf") returned 0x0 [0039.584] lstrlenW (lpString=".txt") returned 4 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".txt") returned 0x0 [0039.584] lstrlenW (lpString=".dbf") returned 4 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".dbf") returned 0x0 [0039.584] lstrlenW (lpString=".ckp") returned 4 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".ckp") returned 0x0 [0039.584] lstrlenW (lpString=".dacpac") returned 7 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".dacpac") returned 0x0 [0039.584] lstrlenW (lpString=".db3") returned 4 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".db3") returned 0x0 [0039.584] lstrlenW (lpString=".dtxs") returned 5 [0039.584] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".dtxs") returned 0x0 [0039.584] lstrlenW (lpString=".mdt") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".mdt") returned 0x0 [0039.585] lstrlenW (lpString=".sdf") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".sdf") returned 0x0 [0039.585] lstrlenW (lpString=".MDF") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".MDF") returned 0x0 [0039.585] lstrlenW (lpString=".DBF") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".DBF") returned 0x0 [0039.585] lstrlenW (lpString=".DB") returned 3 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".DB") returned 0x0 [0039.585] lstrlenW (lpString=".db") returned 3 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".db") returned 0x0 [0039.585] lstrlenW (lpString=".ndf") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".ndf") returned 0x0 [0039.585] lstrlenW (lpString=".NDF") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".NDF") returned 0x0 [0039.585] lstrlenW (lpString=".Mdf") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".Mdf") returned 0x0 [0039.585] lstrlenW (lpString=".dat") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".dat") returned 0x0 [0039.585] lstrlenW (lpString=".DAT") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".DAT") returned 0x0 [0039.585] lstrlenW (lpString=".ldf") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".ldf") returned 0x0 [0039.585] lstrlenW (lpString=".LDF") returned 4 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch=".LDF") returned 0x0 [0039.585] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.585] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0039.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.585] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d0b0) returned 1 [0039.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.586] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0039.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2760050 [0039.586] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15958749029) returned 1 [0039.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6682bf0, dwHighDateTime=0x1d585b4)) [0039.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0039.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0039.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0039.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299398 [0039.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0039.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299398 | out: hHeap=0x260000) returned 1 [0039.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0039.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d2c8 [0039.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d2c8 | out: hHeap=0x260000) returned 1 [0039.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0039.587] GetLastError () returned 0x0 [0039.587] SetLastError (dwErrCode=0x0) [0039.587] GetLastError () returned 0x0 [0039.587] SetLastError (dwErrCode=0x0) [0039.587] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0039.587] GetLastError () returned 0x0 [0039.587] SetLastError (dwErrCode=0x0) [0039.587] GetLastError () returned 0x0 [0039.587] SetLastError (dwErrCode=0x0) [0039.587] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.588] GetLastError () returned 0x0 [0039.588] SetLastError (dwErrCode=0x0) [0039.589] GetLastError () returned 0x0 [0039.589] SetLastError (dwErrCode=0x0) [0039.589] GetLastError () returned 0x0 [0039.589] SetLastError (dwErrCode=0x0) [0039.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2761268 [0039.589] ReadFile (in: hFile=0x10c, lpBuffer=0x2761268, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2761268*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.593] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.593] WriteFile (in: hFile=0x10c, lpBuffer=0x2761268*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2761268*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761268 | out: hHeap=0x260000) returned 1 [0039.594] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.594] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.595] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.595] CloseHandle (hObject=0x10c) returned 1 [0039.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0039.596] GetLastError () returned 0x0 [0039.596] SetLastError (dwErrCode=0x0) [0039.596] GetLastError () returned 0x0 [0039.596] SetLastError (dwErrCode=0x0) [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2793a8 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279388 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a58 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2760050 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3900 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dd48 | out: hHeap=0x260000) returned 1 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ced8 | out: hHeap=0x260000) returned 1 [0039.596] RtlWakeConditionVariable () returned 0x27e828 [0039.596] GetCurrentThreadId () returned 0x99c [0039.596] GetCurrentThreadId () returned 0x99c [0039.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0039.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e330 | out: hHeap=0x260000) returned 1 [0039.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2993d0 | out: hHeap=0x260000) returned 1 [0039.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0039.597] lstrlenW (lpString=".ldf") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.597] lstrlenW (lpString=".vhd") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhd") returned 0x0 [0039.597] lstrlenW (lpString=".vhdx") returned 5 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".vhdx") returned 0x0 [0039.597] lstrlenW (lpString=".pst") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".pst") returned 0x0 [0039.597] lstrlenW (lpString=".ost") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ost") returned 0x0 [0039.597] lstrlenW (lpString=".bak") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bak") returned 0x0 [0039.597] lstrlenW (lpString=".bac") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".bac") returned 0x0 [0039.597] lstrlenW (lpString=".sys") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sys") returned 0x0 [0039.597] lstrlenW (lpString=".v2i") returned 4 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".v2i") returned 0x0 [0039.597] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.597] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.597] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.598] lstrlenW (lpString=".sql") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sql") returned 0x0 [0039.598] lstrlenW (lpString=".mdf") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdf") returned 0x0 [0039.598] lstrlenW (lpString=".txt") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".txt") returned 0x0 [0039.598] lstrlenW (lpString=".dbf") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dbf") returned 0x0 [0039.598] lstrlenW (lpString=".ckp") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ckp") returned 0x0 [0039.598] lstrlenW (lpString=".dacpac") returned 7 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dacpac") returned 0x0 [0039.598] lstrlenW (lpString=".db3") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db3") returned 0x0 [0039.598] lstrlenW (lpString=".dtxs") returned 5 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dtxs") returned 0x0 [0039.598] lstrlenW (lpString=".mdt") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".mdt") returned 0x0 [0039.598] lstrlenW (lpString=".sdf") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".sdf") returned 0x0 [0039.598] lstrlenW (lpString=".MDF") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".MDF") returned 0x0 [0039.598] lstrlenW (lpString=".DBF") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DBF") returned 0x0 [0039.598] lstrlenW (lpString=".DB") returned 3 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DB") returned 0x0 [0039.598] lstrlenW (lpString=".db") returned 3 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".db") returned 0x0 [0039.598] lstrlenW (lpString=".ndf") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ndf") returned 0x0 [0039.598] lstrlenW (lpString=".NDF") returned 4 [0039.598] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".NDF") returned 0x0 [0039.598] lstrlenW (lpString=".Mdf") returned 4 [0039.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".Mdf") returned 0x0 [0039.599] lstrlenW (lpString=".dat") returned 4 [0039.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".dat") returned 0x0 [0039.599] lstrlenW (lpString=".DAT") returned 4 [0039.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".DAT") returned 0x0 [0039.599] lstrlenW (lpString=".ldf") returned 4 [0039.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".ldf") returned 0x0 [0039.599] lstrlenW (lpString=".LDF") returned 4 [0039.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch=".LDF") returned 0x0 [0039.599] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.599] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0039.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.599] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d0b0) returned 1 [0039.600] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.600] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315cf8 [0039.600] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15960102494) returned 1 [0039.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa66a8d50, dwHighDateTime=0x1d585b4)) [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2993d0 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0039.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2993d0 | out: hHeap=0x260000) returned 1 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dd48 [0039.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dd48 | out: hHeap=0x260000) returned 1 [0039.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] SetLastError (dwErrCode=0x0) [0039.601] GetLastError () returned 0x0 [0039.601] ReadFile (in: hFile=0x10c, lpBuffer=0x2760050, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesRead=0x238fdb0*=0x2488, lpOverlapped=0x0) returned 1 [0039.603] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdb78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.603] WriteFile (in: hFile=0x10c, lpBuffer=0x2760050*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesWritten=0x238fdb0*=0x2488, lpOverlapped=0x0) returned 1 [0039.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2760050 | out: hHeap=0x260000) returned 1 [0039.603] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.603] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.603] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.603] CloseHandle (hObject=0x10c) returned 1 [0039.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0039.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0039.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0039.604] GetLastError () returned 0x0 [0039.604] RtlWakeConditionVariable () returned 0x27e828 [0039.604] GetCurrentThreadId () returned 0x99c [0039.604] GetCurrentThreadId () returned 0x99c [0039.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0039.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e3d8 | out: hHeap=0x260000) returned 1 [0039.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299408 | out: hHeap=0x260000) returned 1 [0039.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e3d8 [0039.604] lstrlenW (lpString=".ldf") returned 4 [0039.604] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".ldf") returned 0x0 [0039.604] lstrlenW (lpString=".vhd") returned 4 [0039.604] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".vhd") returned 0x0 [0039.604] lstrlenW (lpString=".vhdx") returned 5 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".vhdx") returned 0x0 [0039.605] lstrlenW (lpString=".pst") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".pst") returned 0x0 [0039.605] lstrlenW (lpString=".ost") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".ost") returned 0x0 [0039.605] lstrlenW (lpString=".bak") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".bak") returned 0x0 [0039.605] lstrlenW (lpString=".bac") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".bac") returned 0x0 [0039.605] lstrlenW (lpString=".sys") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".sys") returned 0x0 [0039.605] lstrlenW (lpString=".v2i") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".v2i") returned 0x0 [0039.605] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch="s\r\n.v2i") returned 0x0 [0039.605] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.605] lstrlenW (lpString=".sql") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".sql") returned 0x0 [0039.605] lstrlenW (lpString=".mdf") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".mdf") returned 0x0 [0039.605] lstrlenW (lpString=".txt") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".txt") returned 0x0 [0039.605] lstrlenW (lpString=".dbf") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".dbf") returned 0x0 [0039.605] lstrlenW (lpString=".ckp") returned 4 [0039.605] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".ckp") returned 0x0 [0039.606] lstrlenW (lpString=".dacpac") returned 7 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".dacpac") returned 0x0 [0039.606] lstrlenW (lpString=".db3") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".db3") returned 0x0 [0039.606] lstrlenW (lpString=".dtxs") returned 5 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".dtxs") returned 0x0 [0039.606] lstrlenW (lpString=".mdt") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".mdt") returned 0x0 [0039.606] lstrlenW (lpString=".sdf") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".sdf") returned 0x0 [0039.606] lstrlenW (lpString=".MDF") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".MDF") returned 0x0 [0039.606] lstrlenW (lpString=".DBF") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".DBF") returned 0x0 [0039.606] lstrlenW (lpString=".DB") returned 3 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".DB") returned 0x0 [0039.606] lstrlenW (lpString=".db") returned 3 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".db") returned 0x0 [0039.606] lstrlenW (lpString=".ndf") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".ndf") returned 0x0 [0039.606] lstrlenW (lpString=".NDF") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".NDF") returned 0x0 [0039.606] lstrlenW (lpString=".Mdf") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".Mdf") returned 0x0 [0039.606] lstrlenW (lpString=".dat") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".dat") returned 0x0 [0039.606] lstrlenW (lpString=".DAT") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".DAT") returned 0x0 [0039.606] lstrlenW (lpString=".ldf") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".ldf") returned 0x0 [0039.606] lstrlenW (lpString=".LDF") returned 4 [0039.606] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch=".LDF") returned 0x0 [0039.607] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.607] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3900 [0039.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.607] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d0b0) returned 1 [0039.607] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.607] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0039.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315cf8 [0039.608] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15960865064) returned 1 [0039.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa66a8d50, dwHighDateTime=0x1d585b4)) [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299408 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b3a38 [0039.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299408 | out: hHeap=0x260000) returned 1 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a38 | out: hHeap=0x260000) returned 1 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e330 [0039.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e330 | out: hHeap=0x260000) returned 1 [0039.608] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0039.608] GetLastError () returned 0x0 [0039.608] GetLastError () returned 0x0 [0039.608] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0039.608] GetLastError () returned 0x0 [0039.609] GetLastError () returned 0x0 [0039.609] ReadFile (in: hFile=0x10c, lpBuffer=0x2760050, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesRead=0x238fdb0*=0xe00, lpOverlapped=0x0) returned 1 [0039.610] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.610] WriteFile (in: hFile=0x10c, lpBuffer=0x2760050*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesWritten=0x238fdb0*=0xe00, lpOverlapped=0x0) returned 1 [0039.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2760050 | out: hHeap=0x260000) returned 1 [0039.610] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.610] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.610] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.610] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.611] CloseHandle (hObject=0x10c) returned 1 [0039.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.[deadmin@cock.li].deadmin")) returned 1 [0039.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0039.612] GetLastError () returned 0x0 [0039.612] RtlWakeConditionVariable () returned 0x27e828 [0039.612] GetCurrentThreadId () returned 0x99c [0039.612] GetCurrentThreadId () returned 0x99c [0039.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5550 | out: hHeap=0x260000) returned 1 [0039.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299440 | out: hHeap=0x260000) returned 1 [0039.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0039.613] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.613] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.613] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.613] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0039.613] WriteFile (in: hFile=0x10c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0039.614] CloseHandle (hObject=0x10c) returned 1 [0039.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad08 | out: hHeap=0x260000) returned 1 [0039.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0039.614] RtlWakeConditionVariable () returned 0x27e828 [0039.614] GetCurrentThreadId () returned 0x99c [0039.615] GetCurrentThreadId () returned 0x99c [0039.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0039.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19f8 | out: hHeap=0x260000) returned 1 [0039.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0039.615] lstrlenW (lpString=".ldf") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0039.615] lstrlenW (lpString=".vhd") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0039.615] lstrlenW (lpString=".vhdx") returned 5 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0039.615] lstrlenW (lpString=".pst") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0039.615] lstrlenW (lpString=".ost") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0039.615] lstrlenW (lpString=".bak") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0039.615] lstrlenW (lpString=".bac") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0039.615] lstrlenW (lpString=".sys") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0039.615] lstrlenW (lpString=".v2i") returned 4 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0039.615] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0039.615] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295c78 | out: hHeap=0x260000) returned 1 [0039.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.615] RtlWakeConditionVariable () returned 0x27e828 [0039.616] GetCurrentThreadId () returned 0x99c [0039.616] GetCurrentThreadId () returned 0x99c [0039.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295e40 | out: hHeap=0x260000) returned 1 [0039.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a19c0 | out: hHeap=0x260000) returned 1 [0039.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295e40 [0039.616] lstrlenW (lpString=".ldf") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0039.616] lstrlenW (lpString=".vhd") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0039.616] lstrlenW (lpString=".vhdx") returned 5 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0039.616] lstrlenW (lpString=".pst") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0039.616] lstrlenW (lpString=".ost") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0039.616] lstrlenW (lpString=".bak") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0039.616] lstrlenW (lpString=".bac") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0039.616] lstrlenW (lpString=".sys") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0039.616] lstrlenW (lpString=".v2i") returned 4 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0039.616] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.616] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0039.616] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295e40 | out: hHeap=0x260000) returned 1 [0039.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.616] RtlWakeConditionVariable () returned 0x27e828 [0039.616] GetCurrentThreadId () returned 0x99c [0039.617] GetCurrentThreadId () returned 0x99c [0039.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0039.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1988 | out: hHeap=0x260000) returned 1 [0039.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0039.617] lstrlenW (lpString=".ldf") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".ldf") returned 0x0 [0039.617] lstrlenW (lpString=".vhd") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".vhd") returned 0x0 [0039.617] lstrlenW (lpString=".vhdx") returned 5 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".vhdx") returned 0x0 [0039.617] lstrlenW (lpString=".pst") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".pst") returned 0x0 [0039.617] lstrlenW (lpString=".ost") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".ost") returned 0x0 [0039.617] lstrlenW (lpString=".bak") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".bak") returned 0x0 [0039.617] lstrlenW (lpString=".bac") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".bac") returned 0x0 [0039.617] lstrlenW (lpString=".sys") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".sys") returned 0x0 [0039.617] lstrlenW (lpString=".v2i") returned 4 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".v2i") returned 0x0 [0039.617] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.617] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.617] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.759] lstrlenW (lpString=".sql") returned 4 [0039.764] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".sql") returned 0x0 [0039.769] lstrlenW (lpString=".mdf") returned 4 [0039.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".mdf") returned 0x0 [0039.769] lstrlenW (lpString=".txt") returned 4 [0039.769] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".txt") returned 0x0 [0039.780] lstrlenW (lpString=".dbf") returned 4 [0039.780] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".dbf") returned 0x0 [0039.781] lstrlenW (lpString=".ckp") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".ckp") returned 0x0 [0039.781] lstrlenW (lpString=".dacpac") returned 7 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".dacpac") returned 0x0 [0039.781] lstrlenW (lpString=".db3") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".db3") returned 0x0 [0039.781] lstrlenW (lpString=".dtxs") returned 5 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".dtxs") returned 0x0 [0039.781] lstrlenW (lpString=".mdt") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".mdt") returned 0x0 [0039.781] lstrlenW (lpString=".sdf") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".sdf") returned 0x0 [0039.781] lstrlenW (lpString=".MDF") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".MDF") returned 0x0 [0039.781] lstrlenW (lpString=".DBF") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".DBF") returned 0x0 [0039.781] lstrlenW (lpString=".DB") returned 3 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".DB") returned 0x0 [0039.781] lstrlenW (lpString=".db") returned 3 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".db") returned 0x0 [0039.781] lstrlenW (lpString=".ndf") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".ndf") returned 0x0 [0039.781] lstrlenW (lpString=".NDF") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".NDF") returned 0x0 [0039.781] lstrlenW (lpString=".Mdf") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".Mdf") returned 0x0 [0039.781] lstrlenW (lpString=".dat") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".dat") returned 0x0 [0039.781] lstrlenW (lpString=".DAT") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".DAT") returned 0x0 [0039.781] lstrlenW (lpString=".ldf") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".ldf") returned 0x0 [0039.781] lstrlenW (lpString=".LDF") returned 4 [0039.781] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch=".LDF") returned 0x0 [0039.782] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.782] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0039.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.782] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d0b0) returned 1 [0039.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.782] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0039.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.783] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15978395178) returned 1 [0039.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6871dd0, dwHighDateTime=0x1d585b4)) [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dca0 [0039.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0039.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0039.783] GetLastError () returned 0x0 [0039.784] GetLastError () returned 0x0 [0039.784] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0039.784] GetLastError () returned 0x0 [0039.784] GetLastError () returned 0x0 [0039.784] ReadFile (in: hFile=0x10c, lpBuffer=0x277b270, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277b270*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.788] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.788] WriteFile (in: hFile=0x10c, lpBuffer=0x277b270*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277b270*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277b270 | out: hHeap=0x260000) returned 1 [0039.788] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.788] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.790] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.790] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.790] CloseHandle (hObject=0x10c) returned 1 [0039.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d9568 [0039.790] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0039.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9568 | out: hHeap=0x260000) returned 1 [0039.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0039.791] GetLastError () returned 0x0 [0039.791] RtlWakeConditionVariable () returned 0x27e828 [0039.791] GetCurrentThreadId () returned 0x99c [0039.791] GetCurrentThreadId () returned 0x99c [0039.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0039.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e528 | out: hHeap=0x260000) returned 1 [0039.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996e0 | out: hHeap=0x260000) returned 1 [0039.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e528 [0039.791] lstrlenW (lpString=".ldf") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ldf") returned 0x0 [0039.791] lstrlenW (lpString=".vhd") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".vhd") returned 0x0 [0039.791] lstrlenW (lpString=".vhdx") returned 5 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".vhdx") returned 0x0 [0039.791] lstrlenW (lpString=".pst") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".pst") returned 0x0 [0039.791] lstrlenW (lpString=".ost") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ost") returned 0x0 [0039.791] lstrlenW (lpString=".bak") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".bak") returned 0x0 [0039.791] lstrlenW (lpString=".bac") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".bac") returned 0x0 [0039.791] lstrlenW (lpString=".sys") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sys") returned 0x0 [0039.791] lstrlenW (lpString=".v2i") returned 4 [0039.791] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".v2i") returned 0x0 [0039.791] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.792] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.792] lstrlenW (lpString=".sql") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sql") returned 0x0 [0039.792] lstrlenW (lpString=".mdf") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".mdf") returned 0x0 [0039.792] lstrlenW (lpString=".txt") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".txt") returned 0x0 [0039.792] lstrlenW (lpString=".dbf") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dbf") returned 0x0 [0039.792] lstrlenW (lpString=".ckp") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ckp") returned 0x0 [0039.792] lstrlenW (lpString=".dacpac") returned 7 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dacpac") returned 0x0 [0039.792] lstrlenW (lpString=".db3") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".db3") returned 0x0 [0039.792] lstrlenW (lpString=".dtxs") returned 5 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dtxs") returned 0x0 [0039.792] lstrlenW (lpString=".mdt") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".mdt") returned 0x0 [0039.792] lstrlenW (lpString=".sdf") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sdf") returned 0x0 [0039.792] lstrlenW (lpString=".MDF") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".MDF") returned 0x0 [0039.792] lstrlenW (lpString=".DBF") returned 4 [0039.792] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DBF") returned 0x0 [0039.793] lstrlenW (lpString=".DB") returned 3 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DB") returned 0x0 [0039.793] lstrlenW (lpString=".db") returned 3 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".db") returned 0x0 [0039.793] lstrlenW (lpString=".ndf") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ndf") returned 0x0 [0039.793] lstrlenW (lpString=".NDF") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".NDF") returned 0x0 [0039.793] lstrlenW (lpString=".Mdf") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".Mdf") returned 0x0 [0039.793] lstrlenW (lpString=".dat") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dat") returned 0x0 [0039.793] lstrlenW (lpString=".DAT") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DAT") returned 0x0 [0039.793] lstrlenW (lpString=".ldf") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ldf") returned 0x0 [0039.793] lstrlenW (lpString=".LDF") returned 4 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".LDF") returned 0x0 [0039.793] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.793] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0039.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.793] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d0b0) returned 1 [0039.794] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.794] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.794] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15979522050) returned 1 [0039.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6871dd0, dwHighDateTime=0x1d585b4)) [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996e0 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996e0 | out: hHeap=0x260000) returned 1 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0039.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0039.795] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0039.795] GetLastError () returned 0x0 [0039.795] GetLastError () returned 0x0 [0039.795] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0039.795] GetLastError () returned 0x0 [0039.795] GetLastError () returned 0x0 [0039.795] ReadFile (in: hFile=0x10c, lpBuffer=0x277b270, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277b270*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.798] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.798] WriteFile (in: hFile=0x10c, lpBuffer=0x277b270*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277b270*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277b270 | out: hHeap=0x260000) returned 1 [0039.798] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.798] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.815] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.815] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.815] CloseHandle (hObject=0x10c) returned 1 [0039.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.[deadmin@cock.li].deadmin")) returned 1 [0039.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0039.816] GetLastError () returned 0x0 [0039.816] RtlWakeConditionVariable () returned 0x27e828 [0039.816] GetCurrentThreadId () returned 0x99c [0039.816] GetCurrentThreadId () returned 0x99c [0039.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9980 | out: hHeap=0x260000) returned 1 [0039.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299718 | out: hHeap=0x260000) returned 1 [0039.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9980 [0039.816] lstrlenW (lpString=".ldf") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0039.816] lstrlenW (lpString=".vhd") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".vhd") returned 0x0 [0039.816] lstrlenW (lpString=".vhdx") returned 5 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".vhdx") returned 0x0 [0039.816] lstrlenW (lpString=".pst") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".pst") returned 0x0 [0039.816] lstrlenW (lpString=".ost") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ost") returned 0x0 [0039.816] lstrlenW (lpString=".bak") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".bak") returned 0x0 [0039.816] lstrlenW (lpString=".bac") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".bac") returned 0x0 [0039.816] lstrlenW (lpString=".sys") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sys") returned 0x0 [0039.816] lstrlenW (lpString=".v2i") returned 4 [0039.816] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".v2i") returned 0x0 [0039.817] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch="s\r\n.v2i") returned 0x0 [0039.817] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.817] lstrlenW (lpString=".sql") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sql") returned 0x0 [0039.817] lstrlenW (lpString=".mdf") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".mdf") returned 0x0 [0039.817] lstrlenW (lpString=".txt") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0039.817] lstrlenW (lpString=".dbf") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dbf") returned 0x0 [0039.817] lstrlenW (lpString=".ckp") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ckp") returned 0x0 [0039.817] lstrlenW (lpString=".dacpac") returned 7 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dacpac") returned 0x0 [0039.817] lstrlenW (lpString=".db3") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".db3") returned 0x0 [0039.817] lstrlenW (lpString=".dtxs") returned 5 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dtxs") returned 0x0 [0039.817] lstrlenW (lpString=".mdt") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".mdt") returned 0x0 [0039.817] lstrlenW (lpString=".sdf") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sdf") returned 0x0 [0039.817] lstrlenW (lpString=".MDF") returned 4 [0039.817] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".MDF") returned 0x0 [0039.817] lstrlenW (lpString=".DBF") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DBF") returned 0x0 [0039.818] lstrlenW (lpString=".DB") returned 3 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DB") returned 0x0 [0039.818] lstrlenW (lpString=".db") returned 3 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".db") returned 0x0 [0039.818] lstrlenW (lpString=".ndf") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ndf") returned 0x0 [0039.818] lstrlenW (lpString=".NDF") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".NDF") returned 0x0 [0039.818] lstrlenW (lpString=".Mdf") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".Mdf") returned 0x0 [0039.818] lstrlenW (lpString=".dat") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dat") returned 0x0 [0039.818] lstrlenW (lpString=".DAT") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DAT") returned 0x0 [0039.818] lstrlenW (lpString=".ldf") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0039.818] lstrlenW (lpString=".LDF") returned 4 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".LDF") returned 0x0 [0039.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.818] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0039.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.818] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27d0b0) returned 1 [0039.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.819] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0039.819] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=15982025502) returned 1 [0039.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa68be090, dwHighDateTime=0x1d585b4)) [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299718 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0039.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299718 | out: hHeap=0x260000) returned 1 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0039.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dca0 [0039.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0039.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0039.820] GetLastError () returned 0x0 [0039.820] GetLastError () returned 0x0 [0039.820] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0039.820] GetLastError () returned 0x0 [0039.820] GetLastError () returned 0x0 [0039.820] ReadFile (in: hFile=0x10c, lpBuffer=0x277b270, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277b270*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.872] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.873] WriteFile (in: hFile=0x10c, lpBuffer=0x277b270*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277b270*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277b270 | out: hHeap=0x260000) returned 1 [0039.875] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.875] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.955] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.955] CloseHandle (hObject=0x10c) returned 1 [0039.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d9568 [0039.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[deadmin@cock.li].deadmin")) returned 1 [0039.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9568 | out: hHeap=0x260000) returned 1 [0039.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0039.956] GetLastError () returned 0x0 [0039.956] RtlWakeConditionVariable () returned 0x27e828 [0039.956] GetCurrentThreadId () returned 0x99c [0039.956] GetCurrentThreadId () returned 0x99c [0039.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c0f0 [0039.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c260 | out: hHeap=0x260000) returned 1 [0039.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0039.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c260 [0039.956] lstrlenW (lpString=".ldf") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ldf") returned 0x0 [0039.956] lstrlenW (lpString=".vhd") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".vhd") returned 0x0 [0039.956] lstrlenW (lpString=".vhdx") returned 5 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".vhdx") returned 0x0 [0039.956] lstrlenW (lpString=".pst") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".pst") returned 0x0 [0039.956] lstrlenW (lpString=".ost") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ost") returned 0x0 [0039.956] lstrlenW (lpString=".bak") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".bak") returned 0x0 [0039.956] lstrlenW (lpString=".bac") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".bac") returned 0x0 [0039.956] lstrlenW (lpString=".sys") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sys") returned 0x0 [0039.956] lstrlenW (lpString=".v2i") returned 4 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".v2i") returned 0x0 [0039.956] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.956] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.957] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.007] lstrlenW (lpString=".sql") returned 4 [0040.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sql") returned 0x0 [0040.007] lstrlenW (lpString=".mdf") returned 4 [0040.007] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".mdf") returned 0x0 [0040.007] lstrlenW (lpString=".txt") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".txt") returned 0x0 [0040.008] lstrlenW (lpString=".dbf") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dbf") returned 0x0 [0040.008] lstrlenW (lpString=".ckp") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ckp") returned 0x0 [0040.008] lstrlenW (lpString=".dacpac") returned 7 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dacpac") returned 0x0 [0040.008] lstrlenW (lpString=".db3") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".db3") returned 0x0 [0040.008] lstrlenW (lpString=".dtxs") returned 5 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dtxs") returned 0x0 [0040.008] lstrlenW (lpString=".mdt") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".mdt") returned 0x0 [0040.008] lstrlenW (lpString=".sdf") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sdf") returned 0x0 [0040.008] lstrlenW (lpString=".MDF") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".MDF") returned 0x0 [0040.008] lstrlenW (lpString=".DBF") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DBF") returned 0x0 [0040.008] lstrlenW (lpString=".DB") returned 3 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DB") returned 0x0 [0040.008] lstrlenW (lpString=".db") returned 3 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".db") returned 0x0 [0040.008] lstrlenW (lpString=".ndf") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ndf") returned 0x0 [0040.008] lstrlenW (lpString=".NDF") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".NDF") returned 0x0 [0040.008] lstrlenW (lpString=".Mdf") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".Mdf") returned 0x0 [0040.008] lstrlenW (lpString=".dat") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dat") returned 0x0 [0040.008] lstrlenW (lpString=".DAT") returned 4 [0040.008] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DAT") returned 0x0 [0040.008] lstrlenW (lpString=".ldf") returned 4 [0040.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ldf") returned 0x0 [0040.009] lstrlenW (lpString=".LDF") returned 4 [0040.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".LDF") returned 0x0 [0040.009] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.009] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.009] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.009] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.010] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.010] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16001079879) returned 1 [0040.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6a87110, dwHighDateTime=0x1d585b4)) [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299440 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299440 | out: hHeap=0x260000) returned 1 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0040.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0040.010] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.010] GetLastError () returned 0x0 [0040.010] GetLastError () returned 0x0 [0040.010] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.011] GetLastError () returned 0x0 [0040.011] GetLastError () returned 0x0 [0040.011] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0040.013] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.013] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0040.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.014] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.014] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.014] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.014] CloseHandle (hObject=0xfc) returned 1 [0040.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.[deadmin@cock.li].deadmin")) returned 1 [0040.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.015] GetLastError () returned 0x0 [0040.015] RtlWakeConditionVariable () returned 0x27e828 [0040.015] GetCurrentThreadId () returned 0x99c [0040.015] GetCurrentThreadId () returned 0x99c [0040.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0040.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e9c0 | out: hHeap=0x260000) returned 1 [0040.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294598 | out: hHeap=0x260000) returned 1 [0040.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e9c0 [0040.015] lstrlenW (lpString=".ldf") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ldf") returned 0x0 [0040.015] lstrlenW (lpString=".vhd") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".vhd") returned 0x0 [0040.015] lstrlenW (lpString=".vhdx") returned 5 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".vhdx") returned 0x0 [0040.015] lstrlenW (lpString=".pst") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".pst") returned 0x0 [0040.015] lstrlenW (lpString=".ost") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ost") returned 0x0 [0040.015] lstrlenW (lpString=".bak") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".bak") returned 0x0 [0040.015] lstrlenW (lpString=".bac") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".bac") returned 0x0 [0040.015] lstrlenW (lpString=".sys") returned 4 [0040.015] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sys") returned 0x0 [0040.016] lstrlenW (lpString=".v2i") returned 4 [0040.016] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".v2i") returned 0x0 [0040.016] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.016] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch="s\r\n.v2i") returned 0x0 [0040.016] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.017] lstrlenW (lpString=".sql") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sql") returned 0x0 [0040.017] lstrlenW (lpString=".mdf") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".mdf") returned 0x0 [0040.017] lstrlenW (lpString=".txt") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".txt") returned 0x0 [0040.017] lstrlenW (lpString=".dbf") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dbf") returned 0x0 [0040.017] lstrlenW (lpString=".ckp") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ckp") returned 0x0 [0040.017] lstrlenW (lpString=".dacpac") returned 7 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dacpac") returned 0x0 [0040.017] lstrlenW (lpString=".db3") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".db3") returned 0x0 [0040.017] lstrlenW (lpString=".dtxs") returned 5 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dtxs") returned 0x0 [0040.017] lstrlenW (lpString=".mdt") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".mdt") returned 0x0 [0040.017] lstrlenW (lpString=".sdf") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sdf") returned 0x0 [0040.017] lstrlenW (lpString=".MDF") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".MDF") returned 0x0 [0040.017] lstrlenW (lpString=".DBF") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DBF") returned 0x0 [0040.017] lstrlenW (lpString=".DB") returned 3 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DB") returned 0x0 [0040.017] lstrlenW (lpString=".db") returned 3 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".db") returned 0x0 [0040.017] lstrlenW (lpString=".ndf") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ndf") returned 0x0 [0040.017] lstrlenW (lpString=".NDF") returned 4 [0040.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".NDF") returned 0x0 [0040.018] lstrlenW (lpString=".Mdf") returned 4 [0040.018] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".Mdf") returned 0x0 [0040.018] lstrlenW (lpString=".dat") returned 4 [0040.018] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dat") returned 0x0 [0040.018] lstrlenW (lpString=".DAT") returned 4 [0040.018] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DAT") returned 0x0 [0040.018] lstrlenW (lpString=".ldf") returned 4 [0040.018] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ldf") returned 0x0 [0040.018] lstrlenW (lpString=".LDF") returned 4 [0040.018] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".LDF") returned 0x0 [0040.018] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.018] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.018] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.019] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.019] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.019] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16001997085) returned 1 [0040.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6aad270, dwHighDateTime=0x1d585b4)) [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294598 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294598 | out: hHeap=0x260000) returned 1 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e720 [0040.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e720 | out: hHeap=0x260000) returned 1 [0040.019] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.019] GetLastError () returned 0x0 [0040.020] GetLastError () returned 0x0 [0040.020] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.020] GetLastError () returned 0x0 [0040.020] GetLastError () returned 0x0 [0040.020] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.023] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.023] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.024] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.024] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.025] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.025] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.025] CloseHandle (hObject=0xfc) returned 1 [0040.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[deadmin@cock.li].deadmin")) returned 1 [0040.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.026] GetLastError () returned 0x0 [0040.026] RtlWakeConditionVariable () returned 0x27e828 [0040.026] GetCurrentThreadId () returned 0x99c [0040.026] GetCurrentThreadId () returned 0x99c [0040.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0040.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ea68 | out: hHeap=0x260000) returned 1 [0040.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2945d0 | out: hHeap=0x260000) returned 1 [0040.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ea68 [0040.026] lstrlenW (lpString=".ldf") returned 4 [0040.026] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ldf") returned 0x0 [0040.026] lstrlenW (lpString=".vhd") returned 4 [0040.026] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".vhd") returned 0x0 [0040.026] lstrlenW (lpString=".vhdx") returned 5 [0040.026] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".vhdx") returned 0x0 [0040.026] lstrlenW (lpString=".pst") returned 4 [0040.026] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".pst") returned 0x0 [0040.027] lstrlenW (lpString=".ost") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ost") returned 0x0 [0040.027] lstrlenW (lpString=".bak") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".bak") returned 0x0 [0040.027] lstrlenW (lpString=".bac") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".bac") returned 0x0 [0040.027] lstrlenW (lpString=".sys") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sys") returned 0x0 [0040.027] lstrlenW (lpString=".v2i") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".v2i") returned 0x0 [0040.027] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.027] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.027] lstrlenW (lpString=".sql") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sql") returned 0x0 [0040.027] lstrlenW (lpString=".mdf") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".mdf") returned 0x0 [0040.027] lstrlenW (lpString=".txt") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".txt") returned 0x0 [0040.027] lstrlenW (lpString=".dbf") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dbf") returned 0x0 [0040.027] lstrlenW (lpString=".ckp") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ckp") returned 0x0 [0040.027] lstrlenW (lpString=".dacpac") returned 7 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dacpac") returned 0x0 [0040.027] lstrlenW (lpString=".db3") returned 4 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".db3") returned 0x0 [0040.027] lstrlenW (lpString=".dtxs") returned 5 [0040.027] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dtxs") returned 0x0 [0040.028] lstrlenW (lpString=".mdt") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".mdt") returned 0x0 [0040.028] lstrlenW (lpString=".sdf") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sdf") returned 0x0 [0040.028] lstrlenW (lpString=".MDF") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".MDF") returned 0x0 [0040.028] lstrlenW (lpString=".DBF") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DBF") returned 0x0 [0040.028] lstrlenW (lpString=".DB") returned 3 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DB") returned 0x0 [0040.028] lstrlenW (lpString=".db") returned 3 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".db") returned 0x0 [0040.028] lstrlenW (lpString=".ndf") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ndf") returned 0x0 [0040.028] lstrlenW (lpString=".NDF") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".NDF") returned 0x0 [0040.028] lstrlenW (lpString=".Mdf") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".Mdf") returned 0x0 [0040.028] lstrlenW (lpString=".dat") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dat") returned 0x0 [0040.028] lstrlenW (lpString=".DAT") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DAT") returned 0x0 [0040.028] lstrlenW (lpString=".ldf") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ldf") returned 0x0 [0040.028] lstrlenW (lpString=".LDF") returned 4 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".LDF") returned 0x0 [0040.028] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.028] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.028] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.029] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.029] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.029] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16003042754) returned 1 [0040.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6aad270, dwHighDateTime=0x1d585b4)) [0040.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2945d0 [0040.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2945d0 | out: hHeap=0x260000) returned 1 [0040.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e9c0 [0040.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e9c0 | out: hHeap=0x260000) returned 1 [0040.030] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.030] GetLastError () returned 0x0 [0040.030] GetLastError () returned 0x0 [0040.030] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.030] GetLastError () returned 0x0 [0040.030] GetLastError () returned 0x0 [0040.030] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.033] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.033] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.034] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.034] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.035] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.035] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.035] CloseHandle (hObject=0xfc) returned 1 [0040.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.036] GetLastError () returned 0x0 [0040.036] RtlWakeConditionVariable () returned 0x27e828 [0040.036] GetCurrentThreadId () returned 0x99c [0040.036] GetCurrentThreadId () returned 0x99c [0040.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b10 | out: hHeap=0x260000) returned 1 [0040.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294608 | out: hHeap=0x260000) returned 1 [0040.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9b10 [0040.036] lstrlenW (lpString=".ldf") returned 4 [0040.036] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0040.037] lstrlenW (lpString=".vhd") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".vhd") returned 0x0 [0040.037] lstrlenW (lpString=".vhdx") returned 5 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".vhdx") returned 0x0 [0040.037] lstrlenW (lpString=".pst") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".pst") returned 0x0 [0040.037] lstrlenW (lpString=".ost") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ost") returned 0x0 [0040.037] lstrlenW (lpString=".bak") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".bak") returned 0x0 [0040.037] lstrlenW (lpString=".bac") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".bac") returned 0x0 [0040.037] lstrlenW (lpString=".sys") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sys") returned 0x0 [0040.037] lstrlenW (lpString=".v2i") returned 4 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".v2i") returned 0x0 [0040.037] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.037] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch="s\r\n.v2i") returned 0x0 [0040.037] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.038] lstrlenW (lpString=".sql") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sql") returned 0x0 [0040.038] lstrlenW (lpString=".mdf") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".mdf") returned 0x0 [0040.038] lstrlenW (lpString=".txt") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0040.038] lstrlenW (lpString=".dbf") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dbf") returned 0x0 [0040.038] lstrlenW (lpString=".ckp") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ckp") returned 0x0 [0040.038] lstrlenW (lpString=".dacpac") returned 7 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dacpac") returned 0x0 [0040.038] lstrlenW (lpString=".db3") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".db3") returned 0x0 [0040.038] lstrlenW (lpString=".dtxs") returned 5 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dtxs") returned 0x0 [0040.038] lstrlenW (lpString=".mdt") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".mdt") returned 0x0 [0040.038] lstrlenW (lpString=".sdf") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sdf") returned 0x0 [0040.038] lstrlenW (lpString=".MDF") returned 4 [0040.038] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".MDF") returned 0x0 [0040.039] lstrlenW (lpString=".DBF") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DBF") returned 0x0 [0040.039] lstrlenW (lpString=".DB") returned 3 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DB") returned 0x0 [0040.039] lstrlenW (lpString=".db") returned 3 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".db") returned 0x0 [0040.039] lstrlenW (lpString=".ndf") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ndf") returned 0x0 [0040.039] lstrlenW (lpString=".NDF") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".NDF") returned 0x0 [0040.039] lstrlenW (lpString=".Mdf") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".Mdf") returned 0x0 [0040.039] lstrlenW (lpString=".dat") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dat") returned 0x0 [0040.039] lstrlenW (lpString=".DAT") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DAT") returned 0x0 [0040.039] lstrlenW (lpString=".ldf") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0040.039] lstrlenW (lpString=".LDF") returned 4 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".LDF") returned 0x0 [0040.039] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.039] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.039] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.040] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.040] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.040] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16004125028) returned 1 [0040.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6ad33d0, dwHighDateTime=0x1d585b4)) [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294608 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294608 | out: hHeap=0x260000) returned 1 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0040.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0040.041] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.041] GetLastError () returned 0x0 [0040.041] GetLastError () returned 0x0 [0040.041] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.041] GetLastError () returned 0x0 [0040.041] GetLastError () returned 0x0 [0040.041] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.044] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.044] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.044] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.044] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.200] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.200] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.201] CloseHandle (hObject=0xfc) returned 1 [0040.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[deadmin@cock.li].deadmin")) returned 1 [0040.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edbe0 | out: hHeap=0x260000) returned 1 [0040.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.201] GetLastError () returned 0x0 [0040.202] RtlWakeConditionVariable () returned 0x27e828 [0040.202] GetCurrentThreadId () returned 0x99c [0040.202] GetCurrentThreadId () returned 0x99c [0040.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0040.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5ad8 | out: hHeap=0x260000) returned 1 [0040.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294870 | out: hHeap=0x260000) returned 1 [0040.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5ad8 [0040.202] lstrlenW (lpString=".ldf") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ldf") returned 0x0 [0040.202] lstrlenW (lpString=".vhd") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".vhd") returned 0x0 [0040.202] lstrlenW (lpString=".vhdx") returned 5 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".vhdx") returned 0x0 [0040.202] lstrlenW (lpString=".pst") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".pst") returned 0x0 [0040.202] lstrlenW (lpString=".ost") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ost") returned 0x0 [0040.202] lstrlenW (lpString=".bak") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".bak") returned 0x0 [0040.202] lstrlenW (lpString=".bac") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".bac") returned 0x0 [0040.202] lstrlenW (lpString=".sys") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sys") returned 0x0 [0040.202] lstrlenW (lpString=".v2i") returned 4 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".v2i") returned 0x0 [0040.202] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.202] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch="s\r\n.v2i") returned 0x0 [0040.202] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.203] lstrlenW (lpString=".sql") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sql") returned 0x0 [0040.203] lstrlenW (lpString=".mdf") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".mdf") returned 0x0 [0040.203] lstrlenW (lpString=".txt") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".txt") returned 0x0 [0040.203] lstrlenW (lpString=".dbf") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dbf") returned 0x0 [0040.203] lstrlenW (lpString=".ckp") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ckp") returned 0x0 [0040.203] lstrlenW (lpString=".dacpac") returned 7 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dacpac") returned 0x0 [0040.203] lstrlenW (lpString=".db3") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".db3") returned 0x0 [0040.203] lstrlenW (lpString=".dtxs") returned 5 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dtxs") returned 0x0 [0040.203] lstrlenW (lpString=".mdt") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".mdt") returned 0x0 [0040.203] lstrlenW (lpString=".sdf") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".sdf") returned 0x0 [0040.203] lstrlenW (lpString=".MDF") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".MDF") returned 0x0 [0040.203] lstrlenW (lpString=".DBF") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DBF") returned 0x0 [0040.203] lstrlenW (lpString=".DB") returned 3 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DB") returned 0x0 [0040.203] lstrlenW (lpString=".db") returned 3 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".db") returned 0x0 [0040.203] lstrlenW (lpString=".ndf") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ndf") returned 0x0 [0040.203] lstrlenW (lpString=".NDF") returned 4 [0040.203] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".NDF") returned 0x0 [0040.203] lstrlenW (lpString=".Mdf") returned 4 [0040.204] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".Mdf") returned 0x0 [0040.204] lstrlenW (lpString=".dat") returned 4 [0040.204] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".dat") returned 0x0 [0040.204] lstrlenW (lpString=".DAT") returned 4 [0040.204] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".DAT") returned 0x0 [0040.204] lstrlenW (lpString=".ldf") returned 4 [0040.204] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".ldf") returned 0x0 [0040.204] lstrlenW (lpString=".LDF") returned 4 [0040.204] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch=".LDF") returned 0x0 [0040.204] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.204] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.204] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.205] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.205] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.205] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16020589227) returned 1 [0040.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6c762f0, dwHighDateTime=0x1d585b4)) [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294870 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294870 | out: hHeap=0x260000) returned 1 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6408 [0040.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6408 | out: hHeap=0x260000) returned 1 [0040.205] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.205] GetLastError () returned 0x0 [0040.205] GetLastError () returned 0x0 [0040.206] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.206] GetLastError () returned 0x0 [0040.206] GetLastError () returned 0x0 [0040.206] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.209] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.209] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.209] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.209] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.211] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.211] CloseHandle (hObject=0xfc) returned 1 [0040.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[deadmin@cock.li].deadmin")) returned 1 [0040.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.212] GetLastError () returned 0x0 [0040.212] RtlWakeConditionVariable () returned 0x27e828 [0040.212] GetCurrentThreadId () returned 0x99c [0040.212] GetCurrentThreadId () returned 0x99c [0040.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0040.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0040.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948a8 | out: hHeap=0x260000) returned 1 [0040.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0040.212] lstrlenW (lpString=".ldf") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ldf") returned 0x0 [0040.212] lstrlenW (lpString=".vhd") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".vhd") returned 0x0 [0040.212] lstrlenW (lpString=".vhdx") returned 5 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".vhdx") returned 0x0 [0040.212] lstrlenW (lpString=".pst") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".pst") returned 0x0 [0040.212] lstrlenW (lpString=".ost") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ost") returned 0x0 [0040.212] lstrlenW (lpString=".bak") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".bak") returned 0x0 [0040.212] lstrlenW (lpString=".bac") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".bac") returned 0x0 [0040.212] lstrlenW (lpString=".sys") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sys") returned 0x0 [0040.212] lstrlenW (lpString=".v2i") returned 4 [0040.212] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".v2i") returned 0x0 [0040.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.213] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.213] lstrlenW (lpString=".sql") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sql") returned 0x0 [0040.213] lstrlenW (lpString=".mdf") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".mdf") returned 0x0 [0040.213] lstrlenW (lpString=".txt") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".txt") returned 0x0 [0040.213] lstrlenW (lpString=".dbf") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dbf") returned 0x0 [0040.213] lstrlenW (lpString=".ckp") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ckp") returned 0x0 [0040.213] lstrlenW (lpString=".dacpac") returned 7 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dacpac") returned 0x0 [0040.213] lstrlenW (lpString=".db3") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".db3") returned 0x0 [0040.213] lstrlenW (lpString=".dtxs") returned 5 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dtxs") returned 0x0 [0040.213] lstrlenW (lpString=".mdt") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".mdt") returned 0x0 [0040.213] lstrlenW (lpString=".sdf") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".sdf") returned 0x0 [0040.213] lstrlenW (lpString=".MDF") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".MDF") returned 0x0 [0040.213] lstrlenW (lpString=".DBF") returned 4 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DBF") returned 0x0 [0040.213] lstrlenW (lpString=".DB") returned 3 [0040.213] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DB") returned 0x0 [0040.214] lstrlenW (lpString=".db") returned 3 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".db") returned 0x0 [0040.214] lstrlenW (lpString=".ndf") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ndf") returned 0x0 [0040.214] lstrlenW (lpString=".NDF") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".NDF") returned 0x0 [0040.214] lstrlenW (lpString=".Mdf") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".Mdf") returned 0x0 [0040.214] lstrlenW (lpString=".dat") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".dat") returned 0x0 [0040.214] lstrlenW (lpString=".DAT") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".DAT") returned 0x0 [0040.214] lstrlenW (lpString=".ldf") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".ldf") returned 0x0 [0040.214] lstrlenW (lpString=".LDF") returned 4 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch=".LDF") returned 0x0 [0040.214] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.214] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.214] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.215] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.215] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.215] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16021607647) returned 1 [0040.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6c762f0, dwHighDateTime=0x1d585b4)) [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948a8 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948a8 | out: hHeap=0x260000) returned 1 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5ad8 [0040.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5ad8 | out: hHeap=0x260000) returned 1 [0040.215] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.216] GetLastError () returned 0x0 [0040.216] GetLastError () returned 0x0 [0040.216] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.216] GetLastError () returned 0x0 [0040.216] GetLastError () returned 0x0 [0040.216] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.219] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.219] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.219] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.219] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.221] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.221] CloseHandle (hObject=0xfc) returned 1 [0040.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.221] GetLastError () returned 0x0 [0040.221] RtlWakeConditionVariable () returned 0x27e828 [0040.221] GetCurrentThreadId () returned 0x99c [0040.221] GetCurrentThreadId () returned 0x99c [0040.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca0 | out: hHeap=0x260000) returned 1 [0040.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948e0 | out: hHeap=0x260000) returned 1 [0040.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ca0 [0040.222] lstrlenW (lpString=".ldf") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0040.222] lstrlenW (lpString=".vhd") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".vhd") returned 0x0 [0040.222] lstrlenW (lpString=".vhdx") returned 5 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".vhdx") returned 0x0 [0040.222] lstrlenW (lpString=".pst") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".pst") returned 0x0 [0040.222] lstrlenW (lpString=".ost") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ost") returned 0x0 [0040.222] lstrlenW (lpString=".bak") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".bak") returned 0x0 [0040.222] lstrlenW (lpString=".bac") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".bac") returned 0x0 [0040.222] lstrlenW (lpString=".sys") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sys") returned 0x0 [0040.222] lstrlenW (lpString=".v2i") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".v2i") returned 0x0 [0040.222] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch="s\r\n.v2i") returned 0x0 [0040.222] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.222] lstrlenW (lpString=".sql") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sql") returned 0x0 [0040.222] lstrlenW (lpString=".mdf") returned 4 [0040.222] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".mdf") returned 0x0 [0040.223] lstrlenW (lpString=".txt") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0040.223] lstrlenW (lpString=".dbf") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dbf") returned 0x0 [0040.223] lstrlenW (lpString=".ckp") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ckp") returned 0x0 [0040.223] lstrlenW (lpString=".dacpac") returned 7 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dacpac") returned 0x0 [0040.223] lstrlenW (lpString=".db3") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".db3") returned 0x0 [0040.223] lstrlenW (lpString=".dtxs") returned 5 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dtxs") returned 0x0 [0040.223] lstrlenW (lpString=".mdt") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".mdt") returned 0x0 [0040.223] lstrlenW (lpString=".sdf") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".sdf") returned 0x0 [0040.223] lstrlenW (lpString=".MDF") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".MDF") returned 0x0 [0040.223] lstrlenW (lpString=".DBF") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DBF") returned 0x0 [0040.223] lstrlenW (lpString=".DB") returned 3 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DB") returned 0x0 [0040.223] lstrlenW (lpString=".db") returned 3 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".db") returned 0x0 [0040.223] lstrlenW (lpString=".ndf") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ndf") returned 0x0 [0040.223] lstrlenW (lpString=".NDF") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".NDF") returned 0x0 [0040.223] lstrlenW (lpString=".Mdf") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".Mdf") returned 0x0 [0040.223] lstrlenW (lpString=".dat") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".dat") returned 0x0 [0040.223] lstrlenW (lpString=".DAT") returned 4 [0040.223] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".DAT") returned 0x0 [0040.224] lstrlenW (lpString=".ldf") returned 4 [0040.224] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".ldf") returned 0x0 [0040.224] lstrlenW (lpString=".LDF") returned 4 [0040.224] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch=".LDF") returned 0x0 [0040.224] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.224] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.224] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.224] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.225] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.225] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16022576875) returned 1 [0040.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6c9c450, dwHighDateTime=0x1d585b4)) [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948e0 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948e0 | out: hHeap=0x260000) returned 1 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cf80 [0040.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0040.225] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.225] GetLastError () returned 0x0 [0040.225] GetLastError () returned 0x0 [0040.225] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.225] GetLastError () returned 0x0 [0040.226] GetLastError () returned 0x0 [0040.226] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.228] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.228] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.228] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.229] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.230] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.230] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.230] CloseHandle (hObject=0xfc) returned 1 [0040.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[deadmin@cock.li].deadmin")) returned 1 [0040.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edbe0 | out: hHeap=0x260000) returned 1 [0040.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.231] GetLastError () returned 0x0 [0040.231] RtlWakeConditionVariable () returned 0x27e828 [0040.231] GetCurrentThreadId () returned 0x99c [0040.231] GetCurrentThreadId () returned 0x99c [0040.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0040.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5c28 | out: hHeap=0x260000) returned 1 [0040.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294918 | out: hHeap=0x260000) returned 1 [0040.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5c28 [0040.231] lstrlenW (lpString=".ldf") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ldf") returned 0x0 [0040.231] lstrlenW (lpString=".vhd") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".vhd") returned 0x0 [0040.231] lstrlenW (lpString=".vhdx") returned 5 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".vhdx") returned 0x0 [0040.231] lstrlenW (lpString=".pst") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".pst") returned 0x0 [0040.231] lstrlenW (lpString=".ost") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ost") returned 0x0 [0040.231] lstrlenW (lpString=".bak") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".bak") returned 0x0 [0040.231] lstrlenW (lpString=".bac") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".bac") returned 0x0 [0040.231] lstrlenW (lpString=".sys") returned 4 [0040.231] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sys") returned 0x0 [0040.231] lstrlenW (lpString=".v2i") returned 4 [0040.232] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".v2i") returned 0x0 [0040.232] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.232] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch="s\r\n.v2i") returned 0x0 [0040.232] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.232] lstrlenW (lpString=".sql") returned 4 [0040.232] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sql") returned 0x0 [0040.232] lstrlenW (lpString=".mdf") returned 4 [0040.232] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".mdf") returned 0x0 [0040.232] lstrlenW (lpString=".txt") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".txt") returned 0x0 [0040.233] lstrlenW (lpString=".dbf") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dbf") returned 0x0 [0040.233] lstrlenW (lpString=".ckp") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ckp") returned 0x0 [0040.233] lstrlenW (lpString=".dacpac") returned 7 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dacpac") returned 0x0 [0040.233] lstrlenW (lpString=".db3") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".db3") returned 0x0 [0040.233] lstrlenW (lpString=".dtxs") returned 5 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dtxs") returned 0x0 [0040.233] lstrlenW (lpString=".mdt") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".mdt") returned 0x0 [0040.233] lstrlenW (lpString=".sdf") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".sdf") returned 0x0 [0040.233] lstrlenW (lpString=".MDF") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".MDF") returned 0x0 [0040.233] lstrlenW (lpString=".DBF") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DBF") returned 0x0 [0040.233] lstrlenW (lpString=".DB") returned 3 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DB") returned 0x0 [0040.233] lstrlenW (lpString=".db") returned 3 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".db") returned 0x0 [0040.233] lstrlenW (lpString=".ndf") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ndf") returned 0x0 [0040.233] lstrlenW (lpString=".NDF") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".NDF") returned 0x0 [0040.233] lstrlenW (lpString=".Mdf") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".Mdf") returned 0x0 [0040.233] lstrlenW (lpString=".dat") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".dat") returned 0x0 [0040.233] lstrlenW (lpString=".DAT") returned 4 [0040.233] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".DAT") returned 0x0 [0040.233] lstrlenW (lpString=".ldf") returned 4 [0040.234] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".ldf") returned 0x0 [0040.234] lstrlenW (lpString=".LDF") returned 4 [0040.234] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch=".LDF") returned 0x0 [0040.234] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.234] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x299988 [0040.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.234] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.234] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.234] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.235] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16023571124) returned 1 [0040.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6cc25b0, dwHighDateTime=0x1d585b4)) [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294918 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294918 | out: hHeap=0x260000) returned 1 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0040.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0040.235] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.235] GetLastError () returned 0x0 [0040.235] GetLastError () returned 0x0 [0040.235] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.235] GetLastError () returned 0x0 [0040.235] GetLastError () returned 0x0 [0040.236] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.327] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.327] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.328] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.328] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.344] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.344] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.344] CloseHandle (hObject=0xfc) returned 1 [0040.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.344] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.345] GetLastError () returned 0x0 [0040.345] RtlWakeConditionVariable () returned 0x27e828 [0040.345] GetCurrentThreadId () returned 0x99c [0040.345] GetCurrentThreadId () returned 0x99c [0040.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296a20 | out: hHeap=0x260000) returned 1 [0040.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0040.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296a20 [0040.345] lstrlenW (lpString=".ldf") returned 4 [0040.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".ldf") returned 0x0 [0040.345] lstrlenW (lpString=".vhd") returned 4 [0040.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".vhd") returned 0x0 [0040.345] lstrlenW (lpString=".vhdx") returned 5 [0040.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".vhdx") returned 0x0 [0040.345] lstrlenW (lpString=".pst") returned 4 [0040.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".pst") returned 0x0 [0040.345] lstrlenW (lpString=".ost") returned 4 [0040.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".ost") returned 0x0 [0040.345] lstrlenW (lpString=".bak") returned 4 [0040.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".bak") returned 0x0 [0040.345] lstrlenW (lpString=".bac") returned 4 [0040.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".bac") returned 0x0 [0040.346] lstrlenW (lpString=".sys") returned 4 [0040.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".sys") returned 0x0 [0040.346] lstrlenW (lpString=".v2i") returned 4 [0040.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".v2i") returned 0x0 [0040.346] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0040.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.355] lstrlenW (lpString=".sql") returned 4 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".sql") returned 0x0 [0040.355] lstrlenW (lpString=".mdf") returned 4 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".mdf") returned 0x0 [0040.355] lstrlenW (lpString=".txt") returned 4 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".txt") returned 0x0 [0040.355] lstrlenW (lpString=".dbf") returned 4 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".dbf") returned 0x0 [0040.355] lstrlenW (lpString=".ckp") returned 4 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".ckp") returned 0x0 [0040.355] lstrlenW (lpString=".dacpac") returned 7 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".dacpac") returned 0x0 [0040.355] lstrlenW (lpString=".db3") returned 4 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".db3") returned 0x0 [0040.355] lstrlenW (lpString=".dtxs") returned 5 [0040.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".dtxs") returned 0x0 [0040.356] lstrlenW (lpString=".mdt") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".mdt") returned 0x0 [0040.356] lstrlenW (lpString=".sdf") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".sdf") returned 0x0 [0040.356] lstrlenW (lpString=".MDF") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".MDF") returned 0x0 [0040.356] lstrlenW (lpString=".DBF") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".DBF") returned 0x0 [0040.356] lstrlenW (lpString=".DB") returned 3 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".DB") returned 0x0 [0040.356] lstrlenW (lpString=".db") returned 3 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".db") returned 0x0 [0040.356] lstrlenW (lpString=".ndf") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".ndf") returned 0x0 [0040.356] lstrlenW (lpString=".NDF") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".NDF") returned 0x0 [0040.356] lstrlenW (lpString=".Mdf") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".Mdf") returned 0x0 [0040.356] lstrlenW (lpString=".dat") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".dat") returned 0x0 [0040.356] lstrlenW (lpString=".DAT") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".DAT") returned 0x0 [0040.356] lstrlenW (lpString=".ldf") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".ldf") returned 0x0 [0040.356] lstrlenW (lpString=".LDF") returned 4 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch=".LDF") returned 0x0 [0040.356] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.356] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e0f0) returned 1 [0040.357] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.357] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0040.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.357] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16035848503) returned 1 [0040.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6df30b0, dwHighDateTime=0x1d585b4)) [0040.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b48 [0040.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b48 | out: hHeap=0x260000) returned 1 [0040.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2967c0 [0040.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.358] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.358] GetLastError () returned 0x0 [0040.358] GetLastError () returned 0x0 [0040.358] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.358] GetLastError () returned 0x0 [0040.358] GetLastError () returned 0x0 [0040.358] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.362] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.362] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.362] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.362] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.364] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.364] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.364] CloseHandle (hObject=0x10c) returned 1 [0040.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.365] GetLastError () returned 0x0 [0040.365] RtlWakeConditionVariable () returned 0x27e828 [0040.365] GetCurrentThreadId () returned 0x99c [0040.365] GetCurrentThreadId () returned 0x99c [0040.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296ab8 | out: hHeap=0x260000) returned 1 [0040.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d40 | out: hHeap=0x260000) returned 1 [0040.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296ab8 [0040.365] lstrlenW (lpString=".ldf") returned 4 [0040.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".ldf") returned 0x0 [0040.365] lstrlenW (lpString=".vhd") returned 4 [0040.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".vhd") returned 0x0 [0040.365] lstrlenW (lpString=".vhdx") returned 5 [0040.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".vhdx") returned 0x0 [0040.365] lstrlenW (lpString=".pst") returned 4 [0040.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".pst") returned 0x0 [0040.365] lstrlenW (lpString=".ost") returned 4 [0040.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".ost") returned 0x0 [0040.365] lstrlenW (lpString=".bak") returned 4 [0040.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".bak") returned 0x0 [0040.365] lstrlenW (lpString=".bac") returned 4 [0040.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".bac") returned 0x0 [0040.366] lstrlenW (lpString=".sys") returned 4 [0040.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".sys") returned 0x0 [0040.366] lstrlenW (lpString=".v2i") returned 4 [0040.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".v2i") returned 0x0 [0040.366] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0040.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.366] lstrlenW (lpString=".sql") returned 4 [0040.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".sql") returned 0x0 [0040.366] lstrlenW (lpString=".mdf") returned 4 [0040.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".mdf") returned 0x0 [0040.367] lstrlenW (lpString=".txt") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".txt") returned 0x0 [0040.367] lstrlenW (lpString=".dbf") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".dbf") returned 0x0 [0040.367] lstrlenW (lpString=".ckp") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".ckp") returned 0x0 [0040.367] lstrlenW (lpString=".dacpac") returned 7 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".dacpac") returned 0x0 [0040.367] lstrlenW (lpString=".db3") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".db3") returned 0x0 [0040.367] lstrlenW (lpString=".dtxs") returned 5 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".dtxs") returned 0x0 [0040.367] lstrlenW (lpString=".mdt") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".mdt") returned 0x0 [0040.367] lstrlenW (lpString=".sdf") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".sdf") returned 0x0 [0040.367] lstrlenW (lpString=".MDF") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".MDF") returned 0x0 [0040.367] lstrlenW (lpString=".DBF") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".DBF") returned 0x0 [0040.367] lstrlenW (lpString=".DB") returned 3 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".DB") returned 0x0 [0040.367] lstrlenW (lpString=".db") returned 3 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".db") returned 0x0 [0040.367] lstrlenW (lpString=".ndf") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".ndf") returned 0x0 [0040.367] lstrlenW (lpString=".NDF") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".NDF") returned 0x0 [0040.367] lstrlenW (lpString=".Mdf") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".Mdf") returned 0x0 [0040.367] lstrlenW (lpString=".dat") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".dat") returned 0x0 [0040.367] lstrlenW (lpString=".DAT") returned 4 [0040.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".DAT") returned 0x0 [0040.368] lstrlenW (lpString=".ldf") returned 4 [0040.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".ldf") returned 0x0 [0040.368] lstrlenW (lpString=".LDF") returned 4 [0040.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch=".LDF") returned 0x0 [0040.368] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3970 [0040.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.368] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e0f0) returned 1 [0040.368] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.369] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0040.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.369] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16036978302) returned 1 [0040.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6df30b0, dwHighDateTime=0x1d585b4)) [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d40 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d40 | out: hHeap=0x260000) returned 1 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296a20 [0040.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.369] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.369] GetLastError () returned 0x0 [0040.369] GetLastError () returned 0x0 [0040.369] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.370] GetLastError () returned 0x0 [0040.370] GetLastError () returned 0x0 [0040.370] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.372] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.372] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.373] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.373] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.374] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.375] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.375] CloseHandle (hObject=0x10c) returned 1 [0040.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.375] GetLastError () returned 0x0 [0040.375] RtlWakeConditionVariable () returned 0x27e828 [0040.375] GetCurrentThreadId () returned 0x99c [0040.375] GetCurrentThreadId () returned 0x99c [0040.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0040.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0040.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d98 | out: hHeap=0x260000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0040.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.500] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.500] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.500] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.500] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.502] CloseHandle (hObject=0x108) returned 1 [0040.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0040.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bf80 | out: hHeap=0x260000) returned 1 [0040.502] RtlWakeConditionVariable () returned 0x27e828 [0040.502] GetCurrentThreadId () returned 0x99c [0040.502] GetCurrentThreadId () returned 0x99c [0040.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296c80 | out: hHeap=0x260000) returned 1 [0040.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f90 | out: hHeap=0x260000) returned 1 [0040.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296c80 [0040.502] lstrlenW (lpString=".ldf") returned 4 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".ldf") returned 0x0 [0040.502] lstrlenW (lpString=".vhd") returned 4 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".vhd") returned 0x0 [0040.502] lstrlenW (lpString=".vhdx") returned 5 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".vhdx") returned 0x0 [0040.502] lstrlenW (lpString=".pst") returned 4 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".pst") returned 0x0 [0040.502] lstrlenW (lpString=".ost") returned 4 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".ost") returned 0x0 [0040.502] lstrlenW (lpString=".bak") returned 4 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".bak") returned 0x0 [0040.502] lstrlenW (lpString=".bac") returned 4 [0040.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".bac") returned 0x0 [0040.502] lstrlenW (lpString=".sys") returned 4 [0040.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".sys") returned 0x0 [0040.503] lstrlenW (lpString=".v2i") returned 4 [0040.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".v2i") returned 0x0 [0040.503] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.526] lstrlenW (lpString=".sql") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".sql") returned 0x0 [0040.526] lstrlenW (lpString=".mdf") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".mdf") returned 0x0 [0040.526] lstrlenW (lpString=".txt") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".txt") returned 0x0 [0040.526] lstrlenW (lpString=".dbf") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".dbf") returned 0x0 [0040.526] lstrlenW (lpString=".ckp") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".ckp") returned 0x0 [0040.526] lstrlenW (lpString=".dacpac") returned 7 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".dacpac") returned 0x0 [0040.526] lstrlenW (lpString=".db3") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".db3") returned 0x0 [0040.526] lstrlenW (lpString=".dtxs") returned 5 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".dtxs") returned 0x0 [0040.526] lstrlenW (lpString=".mdt") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".mdt") returned 0x0 [0040.526] lstrlenW (lpString=".sdf") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".sdf") returned 0x0 [0040.526] lstrlenW (lpString=".MDF") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".MDF") returned 0x0 [0040.526] lstrlenW (lpString=".DBF") returned 4 [0040.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".DBF") returned 0x0 [0040.526] lstrlenW (lpString=".DB") returned 3 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".DB") returned 0x0 [0040.527] lstrlenW (lpString=".db") returned 3 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".db") returned 0x0 [0040.527] lstrlenW (lpString=".ndf") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".ndf") returned 0x0 [0040.527] lstrlenW (lpString=".NDF") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".NDF") returned 0x0 [0040.527] lstrlenW (lpString=".Mdf") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".Mdf") returned 0x0 [0040.527] lstrlenW (lpString=".dat") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".dat") returned 0x0 [0040.527] lstrlenW (lpString=".DAT") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".DAT") returned 0x0 [0040.527] lstrlenW (lpString=".ldf") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".ldf") returned 0x0 [0040.527] lstrlenW (lpString=".LDF") returned 4 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch=".LDF") returned 0x0 [0040.527] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2ed8a8 [0040.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.527] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.528] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.528] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0040.528] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16052934874) returned 1 [0040.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa6f6fe70, dwHighDateTime=0x1d585b4)) [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e78 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0040.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0040.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.529] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.529] GetLastError () returned 0x0 [0040.529] GetLastError () returned 0x0 [0040.529] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.529] GetLastError () returned 0x0 [0040.529] GetLastError () returned 0x0 [0040.530] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x9770, lpOverlapped=0x0) returned 1 [0040.532] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff6890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.532] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x9770, lpOverlapped=0x0) returned 1 [0040.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.533] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.533] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.533] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.533] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.533] CloseHandle (hObject=0x10c) returned 1 [0040.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.534] GetLastError () returned 0x0 [0040.534] RtlWakeConditionVariable () returned 0x27e828 [0040.534] GetCurrentThreadId () returned 0x99c [0040.534] GetCurrentThreadId () returned 0x99c [0040.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296db0 | out: hHeap=0x260000) returned 1 [0040.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0040.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296db0 [0040.534] lstrlenW (lpString=".ldf") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".ldf") returned 0x0 [0040.534] lstrlenW (lpString=".vhd") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".vhd") returned 0x0 [0040.534] lstrlenW (lpString=".vhdx") returned 5 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".vhdx") returned 0x0 [0040.534] lstrlenW (lpString=".pst") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".pst") returned 0x0 [0040.534] lstrlenW (lpString=".ost") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".ost") returned 0x0 [0040.534] lstrlenW (lpString=".bak") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".bak") returned 0x0 [0040.534] lstrlenW (lpString=".bac") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".bac") returned 0x0 [0040.534] lstrlenW (lpString=".sys") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".sys") returned 0x0 [0040.534] lstrlenW (lpString=".v2i") returned 4 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".v2i") returned 0x0 [0040.534] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.597] lstrlenW (lpString=".sql") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".sql") returned 0x0 [0040.597] lstrlenW (lpString=".mdf") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".mdf") returned 0x0 [0040.597] lstrlenW (lpString=".txt") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".txt") returned 0x0 [0040.597] lstrlenW (lpString=".dbf") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".dbf") returned 0x0 [0040.597] lstrlenW (lpString=".ckp") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".ckp") returned 0x0 [0040.597] lstrlenW (lpString=".dacpac") returned 7 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".dacpac") returned 0x0 [0040.597] lstrlenW (lpString=".db3") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".db3") returned 0x0 [0040.597] lstrlenW (lpString=".dtxs") returned 5 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".dtxs") returned 0x0 [0040.597] lstrlenW (lpString=".mdt") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".mdt") returned 0x0 [0040.597] lstrlenW (lpString=".sdf") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".sdf") returned 0x0 [0040.597] lstrlenW (lpString=".MDF") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".MDF") returned 0x0 [0040.597] lstrlenW (lpString=".DBF") returned 4 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".DBF") returned 0x0 [0040.597] lstrlenW (lpString=".DB") returned 3 [0040.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".DB") returned 0x0 [0040.597] lstrlenW (lpString=".db") returned 3 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".db") returned 0x0 [0040.598] lstrlenW (lpString=".ndf") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".ndf") returned 0x0 [0040.598] lstrlenW (lpString=".NDF") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".NDF") returned 0x0 [0040.598] lstrlenW (lpString=".Mdf") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".Mdf") returned 0x0 [0040.598] lstrlenW (lpString=".dat") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".dat") returned 0x0 [0040.598] lstrlenW (lpString=".DAT") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".DAT") returned 0x0 [0040.598] lstrlenW (lpString=".ldf") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".ldf") returned 0x0 [0040.598] lstrlenW (lpString=".LDF") returned 4 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch=".LDF") returned 0x0 [0040.598] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2959a0 [0040.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.598] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.599] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.599] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16060061747) returned 1 [0040.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa702e550, dwHighDateTime=0x1d585b4)) [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295070 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295070 | out: hHeap=0x260000) returned 1 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296c80 [0040.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.600] GetLastError () returned 0x0 [0040.600] GetLastError () returned 0x0 [0040.600] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.600] GetLastError () returned 0x0 [0040.601] GetLastError () returned 0x0 [0040.601] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.605] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.605] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.606] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.606] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.667] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.667] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.667] CloseHandle (hObject=0xfc) returned 1 [0040.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.668] GetLastError () returned 0x0 [0040.668] RtlWakeConditionVariable () returned 0x27e828 [0040.668] GetCurrentThreadId () returned 0x99c [0040.668] GetCurrentThreadId () returned 0x99c [0040.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297438 | out: hHeap=0x260000) returned 1 [0040.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295230 | out: hHeap=0x260000) returned 1 [0040.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297438 [0040.668] lstrlenW (lpString=".ldf") returned 4 [0040.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".ldf") returned 0x0 [0040.669] lstrlenW (lpString=".vhd") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".vhd") returned 0x0 [0040.669] lstrlenW (lpString=".vhdx") returned 5 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".vhdx") returned 0x0 [0040.669] lstrlenW (lpString=".pst") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".pst") returned 0x0 [0040.669] lstrlenW (lpString=".ost") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".ost") returned 0x0 [0040.669] lstrlenW (lpString=".bak") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".bak") returned 0x0 [0040.669] lstrlenW (lpString=".bac") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".bac") returned 0x0 [0040.669] lstrlenW (lpString=".sys") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".sys") returned 0x0 [0040.669] lstrlenW (lpString=".v2i") returned 4 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".v2i") returned 0x0 [0040.669] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0040.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.682] lstrlenW (lpString=".sql") returned 4 [0040.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".sql") returned 0x0 [0040.682] lstrlenW (lpString=".mdf") returned 4 [0040.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".mdf") returned 0x0 [0040.682] lstrlenW (lpString=".txt") returned 4 [0040.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".txt") returned 0x0 [0040.682] lstrlenW (lpString=".dbf") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".dbf") returned 0x0 [0040.683] lstrlenW (lpString=".ckp") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".ckp") returned 0x0 [0040.683] lstrlenW (lpString=".dacpac") returned 7 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".dacpac") returned 0x0 [0040.683] lstrlenW (lpString=".db3") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".db3") returned 0x0 [0040.683] lstrlenW (lpString=".dtxs") returned 5 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".dtxs") returned 0x0 [0040.683] lstrlenW (lpString=".mdt") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".mdt") returned 0x0 [0040.683] lstrlenW (lpString=".sdf") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".sdf") returned 0x0 [0040.683] lstrlenW (lpString=".MDF") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".MDF") returned 0x0 [0040.683] lstrlenW (lpString=".DBF") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".DBF") returned 0x0 [0040.683] lstrlenW (lpString=".DB") returned 3 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".DB") returned 0x0 [0040.683] lstrlenW (lpString=".db") returned 3 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".db") returned 0x0 [0040.683] lstrlenW (lpString=".ndf") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".ndf") returned 0x0 [0040.683] lstrlenW (lpString=".NDF") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".NDF") returned 0x0 [0040.683] lstrlenW (lpString=".Mdf") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".Mdf") returned 0x0 [0040.683] lstrlenW (lpString=".dat") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".dat") returned 0x0 [0040.683] lstrlenW (lpString=".DAT") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".DAT") returned 0x0 [0040.683] lstrlenW (lpString=".ldf") returned 4 [0040.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".ldf") returned 0x0 [0040.683] lstrlenW (lpString=".LDF") returned 4 [0040.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch=".LDF") returned 0x0 [0040.684] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5668 [0040.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.684] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.684] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.685] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16068569955) returned 1 [0040.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa70ecc30, dwHighDateTime=0x1d585b4)) [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e40 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0040.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.685] GetLastError () returned 0x0 [0040.686] GetLastError () returned 0x0 [0040.686] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.686] GetLastError () returned 0x0 [0040.686] GetLastError () returned 0x0 [0040.686] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x425, lpOverlapped=0x0) returned 1 [0040.688] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffbdb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.688] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x425, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x425, lpOverlapped=0x0) returned 1 [0040.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.689] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.689] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.689] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.689] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.689] CloseHandle (hObject=0x108) returned 1 [0040.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.[deadmin@cock.li].deadmin")) returned 1 [0040.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.690] GetLastError () returned 0x0 [0040.690] RtlWakeConditionVariable () returned 0x27e828 [0040.690] GetCurrentThreadId () returned 0x99c [0040.690] GetCurrentThreadId () returned 0x99c [0040.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2974d0 | out: hHeap=0x260000) returned 1 [0040.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295268 | out: hHeap=0x260000) returned 1 [0040.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2974d0 [0040.690] lstrlenW (lpString=".ldf") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".ldf") returned 0x0 [0040.690] lstrlenW (lpString=".vhd") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".vhd") returned 0x0 [0040.690] lstrlenW (lpString=".vhdx") returned 5 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".vhdx") returned 0x0 [0040.690] lstrlenW (lpString=".pst") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".pst") returned 0x0 [0040.690] lstrlenW (lpString=".ost") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".ost") returned 0x0 [0040.690] lstrlenW (lpString=".bak") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".bak") returned 0x0 [0040.690] lstrlenW (lpString=".bac") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".bac") returned 0x0 [0040.690] lstrlenW (lpString=".sys") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".sys") returned 0x0 [0040.690] lstrlenW (lpString=".v2i") returned 4 [0040.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".v2i") returned 0x0 [0040.691] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0040.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.691] lstrlenW (lpString=".sql") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".sql") returned 0x0 [0040.691] lstrlenW (lpString=".mdf") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".mdf") returned 0x0 [0040.691] lstrlenW (lpString=".txt") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".txt") returned 0x0 [0040.691] lstrlenW (lpString=".dbf") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".dbf") returned 0x0 [0040.691] lstrlenW (lpString=".ckp") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".ckp") returned 0x0 [0040.691] lstrlenW (lpString=".dacpac") returned 7 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".dacpac") returned 0x0 [0040.691] lstrlenW (lpString=".db3") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".db3") returned 0x0 [0040.691] lstrlenW (lpString=".dtxs") returned 5 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".dtxs") returned 0x0 [0040.691] lstrlenW (lpString=".mdt") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".mdt") returned 0x0 [0040.691] lstrlenW (lpString=".sdf") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".sdf") returned 0x0 [0040.691] lstrlenW (lpString=".MDF") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".MDF") returned 0x0 [0040.691] lstrlenW (lpString=".DBF") returned 4 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".DBF") returned 0x0 [0040.691] lstrlenW (lpString=".DB") returned 3 [0040.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".DB") returned 0x0 [0040.692] lstrlenW (lpString=".db") returned 3 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".db") returned 0x0 [0040.692] lstrlenW (lpString=".ndf") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".ndf") returned 0x0 [0040.692] lstrlenW (lpString=".NDF") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".NDF") returned 0x0 [0040.692] lstrlenW (lpString=".Mdf") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".Mdf") returned 0x0 [0040.692] lstrlenW (lpString=".dat") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".dat") returned 0x0 [0040.692] lstrlenW (lpString=".DAT") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".DAT") returned 0x0 [0040.692] lstrlenW (lpString=".ldf") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".ldf") returned 0x0 [0040.692] lstrlenW (lpString=".LDF") returned 4 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch=".LDF") returned 0x0 [0040.692] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5668 [0040.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.692] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.693] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.693] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.693] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16069413938) returned 1 [0040.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7112d90, dwHighDateTime=0x1d585b4)) [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295268 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295268 | out: hHeap=0x260000) returned 1 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297438 [0040.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.693] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.694] GetLastError () returned 0x0 [0040.694] GetLastError () returned 0x0 [0040.694] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.694] GetLastError () returned 0x0 [0040.694] GetLastError () returned 0x0 [0040.694] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x692, lpOverlapped=0x0) returned 1 [0040.695] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff96e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.695] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x692, lpOverlapped=0x0) returned 1 [0040.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.695] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.696] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.696] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.696] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.696] CloseHandle (hObject=0x108) returned 1 [0040.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.[deadmin@cock.li].deadmin")) returned 1 [0040.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.696] GetLastError () returned 0x0 [0040.696] RtlWakeConditionVariable () returned 0x27e828 [0040.696] GetCurrentThreadId () returned 0x99c [0040.697] GetCurrentThreadId () returned 0x99c [0040.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297568 | out: hHeap=0x260000) returned 1 [0040.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0040.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297568 [0040.697] lstrlenW (lpString=".ldf") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".ldf") returned 0x0 [0040.697] lstrlenW (lpString=".vhd") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".vhd") returned 0x0 [0040.697] lstrlenW (lpString=".vhdx") returned 5 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".vhdx") returned 0x0 [0040.697] lstrlenW (lpString=".pst") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".pst") returned 0x0 [0040.697] lstrlenW (lpString=".ost") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".ost") returned 0x0 [0040.697] lstrlenW (lpString=".bak") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".bak") returned 0x0 [0040.697] lstrlenW (lpString=".bac") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".bac") returned 0x0 [0040.697] lstrlenW (lpString=".sys") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".sys") returned 0x0 [0040.697] lstrlenW (lpString=".v2i") returned 4 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".v2i") returned 0x0 [0040.697] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch="s\r\n.v2i") returned 0x0 [0040.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.698] lstrlenW (lpString=".sql") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".sql") returned 0x0 [0040.698] lstrlenW (lpString=".mdf") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".mdf") returned 0x0 [0040.698] lstrlenW (lpString=".txt") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".txt") returned 0x0 [0040.698] lstrlenW (lpString=".dbf") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".dbf") returned 0x0 [0040.698] lstrlenW (lpString=".ckp") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".ckp") returned 0x0 [0040.698] lstrlenW (lpString=".dacpac") returned 7 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".dacpac") returned 0x0 [0040.698] lstrlenW (lpString=".db3") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".db3") returned 0x0 [0040.698] lstrlenW (lpString=".dtxs") returned 5 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".dtxs") returned 0x0 [0040.698] lstrlenW (lpString=".mdt") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".mdt") returned 0x0 [0040.698] lstrlenW (lpString=".sdf") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".sdf") returned 0x0 [0040.698] lstrlenW (lpString=".MDF") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".MDF") returned 0x0 [0040.698] lstrlenW (lpString=".DBF") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".DBF") returned 0x0 [0040.698] lstrlenW (lpString=".DB") returned 3 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".DB") returned 0x0 [0040.698] lstrlenW (lpString=".db") returned 3 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".db") returned 0x0 [0040.698] lstrlenW (lpString=".ndf") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".ndf") returned 0x0 [0040.698] lstrlenW (lpString=".NDF") returned 4 [0040.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".NDF") returned 0x0 [0040.698] lstrlenW (lpString=".Mdf") returned 4 [0040.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".Mdf") returned 0x0 [0040.699] lstrlenW (lpString=".dat") returned 4 [0040.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".dat") returned 0x0 [0040.699] lstrlenW (lpString=".DAT") returned 4 [0040.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".DAT") returned 0x0 [0040.699] lstrlenW (lpString=".ldf") returned 4 [0040.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".ldf") returned 0x0 [0040.699] lstrlenW (lpString=".LDF") returned 4 [0040.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch=".LDF") returned 0x0 [0040.699] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5668 [0040.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.699] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.700] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.700] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.700] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16070091606) returned 1 [0040.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7112d90, dwHighDateTime=0x1d585b4)) [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952a0 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2974d0 [0040.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.700] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.700] GetLastError () returned 0x0 [0040.701] GetLastError () returned 0x0 [0040.701] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.701] GetLastError () returned 0x0 [0040.701] GetLastError () returned 0x0 [0040.701] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x566, lpOverlapped=0x0) returned 1 [0040.705] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.705] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x566, lpOverlapped=0x0) returned 1 [0040.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.705] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.705] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.706] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.706] CloseHandle (hObject=0x108) returned 1 [0040.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9e30 [0040.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.[deadmin@cock.li].deadmin")) returned 1 [0040.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0040.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.706] GetLastError () returned 0x0 [0040.706] RtlWakeConditionVariable () returned 0x27e828 [0040.706] GetCurrentThreadId () returned 0x99c [0040.706] GetCurrentThreadId () returned 0x99c [0040.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297600 | out: hHeap=0x260000) returned 1 [0040.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952d8 | out: hHeap=0x260000) returned 1 [0040.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297600 [0040.707] lstrlenW (lpString=".ldf") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".ldf") returned 0x0 [0040.707] lstrlenW (lpString=".vhd") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".vhd") returned 0x0 [0040.707] lstrlenW (lpString=".vhdx") returned 5 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".vhdx") returned 0x0 [0040.707] lstrlenW (lpString=".pst") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".pst") returned 0x0 [0040.707] lstrlenW (lpString=".ost") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".ost") returned 0x0 [0040.707] lstrlenW (lpString=".bak") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".bak") returned 0x0 [0040.707] lstrlenW (lpString=".bac") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".bac") returned 0x0 [0040.707] lstrlenW (lpString=".sys") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".sys") returned 0x0 [0040.707] lstrlenW (lpString=".v2i") returned 4 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".v2i") returned 0x0 [0040.707] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.708] lstrlenW (lpString=".sql") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".sql") returned 0x0 [0040.708] lstrlenW (lpString=".mdf") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".mdf") returned 0x0 [0040.708] lstrlenW (lpString=".txt") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".txt") returned 0x0 [0040.708] lstrlenW (lpString=".dbf") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".dbf") returned 0x0 [0040.708] lstrlenW (lpString=".ckp") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".ckp") returned 0x0 [0040.708] lstrlenW (lpString=".dacpac") returned 7 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".dacpac") returned 0x0 [0040.708] lstrlenW (lpString=".db3") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".db3") returned 0x0 [0040.708] lstrlenW (lpString=".dtxs") returned 5 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".dtxs") returned 0x0 [0040.708] lstrlenW (lpString=".mdt") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".mdt") returned 0x0 [0040.708] lstrlenW (lpString=".sdf") returned 4 [0040.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".sdf") returned 0x0 [0040.709] lstrlenW (lpString=".MDF") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".MDF") returned 0x0 [0040.709] lstrlenW (lpString=".DBF") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".DBF") returned 0x0 [0040.709] lstrlenW (lpString=".DB") returned 3 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".DB") returned 0x0 [0040.709] lstrlenW (lpString=".db") returned 3 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".db") returned 0x0 [0040.709] lstrlenW (lpString=".ndf") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".ndf") returned 0x0 [0040.709] lstrlenW (lpString=".NDF") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".NDF") returned 0x0 [0040.709] lstrlenW (lpString=".Mdf") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".Mdf") returned 0x0 [0040.709] lstrlenW (lpString=".dat") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".dat") returned 0x0 [0040.709] lstrlenW (lpString=".DAT") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".DAT") returned 0x0 [0040.709] lstrlenW (lpString=".ldf") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".ldf") returned 0x0 [0040.709] lstrlenW (lpString=".LDF") returned 4 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch=".LDF") returned 0x0 [0040.709] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5668 [0040.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.709] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.710] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.710] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0040.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.710] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16071147247) returned 1 [0040.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7138ef0, dwHighDateTime=0x1d585b4)) [0040.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0040.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0040.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0040.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952d8 [0040.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952d8 | out: hHeap=0x260000) returned 1 [0040.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297568 [0040.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.711] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.711] GetLastError () returned 0x0 [0040.711] GetLastError () returned 0x0 [0040.711] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.711] GetLastError () returned 0x0 [0040.711] GetLastError () returned 0x0 [0040.712] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x11d78, lpOverlapped=0x0) returned 1 [0040.713] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffee288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.714] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x11d78, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x11d78, lpOverlapped=0x0) returned 1 [0040.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.714] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.714] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.714] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.714] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.714] CloseHandle (hObject=0x108) returned 1 [0040.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0040.715] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0040.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0040.715] GetLastError () returned 0x0 [0040.715] RtlWakeConditionVariable () returned 0x27e828 [0040.715] GetCurrentThreadId () returned 0x99c [0040.715] GetCurrentThreadId () returned 0x99c [0040.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297698 | out: hHeap=0x260000) returned 1 [0040.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0040.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297698 [0040.716] lstrlenW (lpString=".ldf") returned 4 [0040.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".ldf") returned 0x0 [0040.716] lstrlenW (lpString=".vhd") returned 4 [0040.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".vhd") returned 0x0 [0040.716] lstrlenW (lpString=".vhdx") returned 5 [0040.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".vhdx") returned 0x0 [0040.716] lstrlenW (lpString=".pst") returned 4 [0040.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".pst") returned 0x0 [0040.716] lstrlenW (lpString=".ost") returned 4 [0040.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".ost") returned 0x0 [0040.716] lstrlenW (lpString=".bak") returned 4 [0040.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".bak") returned 0x0 [0040.733] lstrlenW (lpString=".bac") returned 4 [0040.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".bac") returned 0x0 [0040.733] lstrlenW (lpString=".sys") returned 4 [0040.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".sys") returned 0x0 [0040.733] lstrlenW (lpString=".v2i") returned 4 [0040.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".v2i") returned 0x0 [0040.733] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.740] lstrlenW (lpString=".sql") returned 4 [0040.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".sql") returned 0x0 [0040.740] lstrlenW (lpString=".mdf") returned 4 [0040.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".mdf") returned 0x0 [0040.740] lstrlenW (lpString=".txt") returned 4 [0040.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".txt") returned 0x0 [0040.741] lstrlenW (lpString=".dbf") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".dbf") returned 0x0 [0040.741] lstrlenW (lpString=".ckp") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".ckp") returned 0x0 [0040.741] lstrlenW (lpString=".dacpac") returned 7 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".dacpac") returned 0x0 [0040.741] lstrlenW (lpString=".db3") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".db3") returned 0x0 [0040.741] lstrlenW (lpString=".dtxs") returned 5 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".dtxs") returned 0x0 [0040.741] lstrlenW (lpString=".mdt") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".mdt") returned 0x0 [0040.741] lstrlenW (lpString=".sdf") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".sdf") returned 0x0 [0040.741] lstrlenW (lpString=".MDF") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".MDF") returned 0x0 [0040.741] lstrlenW (lpString=".DBF") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".DBF") returned 0x0 [0040.741] lstrlenW (lpString=".DB") returned 3 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".DB") returned 0x0 [0040.741] lstrlenW (lpString=".db") returned 3 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".db") returned 0x0 [0040.741] lstrlenW (lpString=".ndf") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".ndf") returned 0x0 [0040.741] lstrlenW (lpString=".NDF") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".NDF") returned 0x0 [0040.741] lstrlenW (lpString=".Mdf") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".Mdf") returned 0x0 [0040.741] lstrlenW (lpString=".dat") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".dat") returned 0x0 [0040.741] lstrlenW (lpString=".DAT") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".DAT") returned 0x0 [0040.741] lstrlenW (lpString=".ldf") returned 4 [0040.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".ldf") returned 0x0 [0040.742] lstrlenW (lpString=".LDF") returned 4 [0040.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch=".LDF") returned 0x0 [0040.742] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f16f0 [0040.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.742] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.743] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.743] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16074377021) returned 1 [0040.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa71851b0, dwHighDateTime=0x1d585b4)) [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297600 [0040.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.743] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.743] GetLastError () returned 0x0 [0040.743] GetLastError () returned 0x0 [0040.743] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.744] GetLastError () returned 0x0 [0040.744] GetLastError () returned 0x0 [0040.744] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.748] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.748] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.748] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.748] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.750] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.750] CloseHandle (hObject=0xfc) returned 1 [0040.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.751] GetLastError () returned 0x0 [0040.751] RtlWakeConditionVariable () returned 0x27e828 [0040.751] GetCurrentThreadId () returned 0x99c [0040.751] GetCurrentThreadId () returned 0x99c [0040.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0040.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295380 | out: hHeap=0x260000) returned 1 [0040.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0040.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.752] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.752] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.752] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.752] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.753] CloseHandle (hObject=0x108) returned 1 [0040.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0040.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.753] RtlWakeConditionVariable () returned 0x27e828 [0040.753] GetCurrentThreadId () returned 0x99c [0040.753] GetCurrentThreadId () returned 0x99c [0040.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2977c8 | out: hHeap=0x260000) returned 1 [0040.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953b8 | out: hHeap=0x260000) returned 1 [0040.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0040.753] lstrlenW (lpString=".ldf") returned 4 [0040.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".ldf") returned 0x0 [0040.753] lstrlenW (lpString=".vhd") returned 4 [0040.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".vhd") returned 0x0 [0040.753] lstrlenW (lpString=".vhdx") returned 5 [0040.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".vhdx") returned 0x0 [0040.754] lstrlenW (lpString=".pst") returned 4 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".pst") returned 0x0 [0040.754] lstrlenW (lpString=".ost") returned 4 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".ost") returned 0x0 [0040.754] lstrlenW (lpString=".bak") returned 4 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".bak") returned 0x0 [0040.754] lstrlenW (lpString=".bac") returned 4 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".bac") returned 0x0 [0040.754] lstrlenW (lpString=".sys") returned 4 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".sys") returned 0x0 [0040.754] lstrlenW (lpString=".v2i") returned 4 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".v2i") returned 0x0 [0040.754] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.755] lstrlenW (lpString=".sql") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".sql") returned 0x0 [0040.755] lstrlenW (lpString=".mdf") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".mdf") returned 0x0 [0040.755] lstrlenW (lpString=".txt") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".txt") returned 0x0 [0040.755] lstrlenW (lpString=".dbf") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".dbf") returned 0x0 [0040.755] lstrlenW (lpString=".ckp") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".ckp") returned 0x0 [0040.755] lstrlenW (lpString=".dacpac") returned 7 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".dacpac") returned 0x0 [0040.755] lstrlenW (lpString=".db3") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".db3") returned 0x0 [0040.755] lstrlenW (lpString=".dtxs") returned 5 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".dtxs") returned 0x0 [0040.755] lstrlenW (lpString=".mdt") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".mdt") returned 0x0 [0040.755] lstrlenW (lpString=".sdf") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".sdf") returned 0x0 [0040.755] lstrlenW (lpString=".MDF") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".MDF") returned 0x0 [0040.755] lstrlenW (lpString=".DBF") returned 4 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".DBF") returned 0x0 [0040.755] lstrlenW (lpString=".DB") returned 3 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".DB") returned 0x0 [0040.755] lstrlenW (lpString=".db") returned 3 [0040.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".db") returned 0x0 [0040.756] lstrlenW (lpString=".ndf") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".ndf") returned 0x0 [0040.756] lstrlenW (lpString=".NDF") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".NDF") returned 0x0 [0040.756] lstrlenW (lpString=".Mdf") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".Mdf") returned 0x0 [0040.756] lstrlenW (lpString=".dat") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".dat") returned 0x0 [0040.756] lstrlenW (lpString=".DAT") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".DAT") returned 0x0 [0040.756] lstrlenW (lpString=".ldf") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".ldf") returned 0x0 [0040.756] lstrlenW (lpString=".LDF") returned 4 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch=".LDF") returned 0x0 [0040.756] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f16f0 [0040.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.756] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.757] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.757] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.757] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16075808923) returned 1 [0040.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa71ab310, dwHighDateTime=0x1d585b4)) [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953b8 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953b8 | out: hHeap=0x260000) returned 1 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297698 [0040.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.757] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.758] GetLastError () returned 0x0 [0040.758] GetLastError () returned 0x0 [0040.758] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.758] GetLastError () returned 0x0 [0040.758] GetLastError () returned 0x0 [0040.758] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.761] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.761] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.761] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.761] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.765] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.765] CloseHandle (hObject=0x108) returned 1 [0040.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.766] GetLastError () returned 0x0 [0040.766] RtlWakeConditionVariable () returned 0x27e828 [0040.766] GetCurrentThreadId () returned 0x99c [0040.766] GetCurrentThreadId () returned 0x99c [0040.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0040.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0040.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0040.766] lstrlenW (lpString=".ldf") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".ldf") returned 0x0 [0040.766] lstrlenW (lpString=".vhd") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".vhd") returned 0x0 [0040.766] lstrlenW (lpString=".vhdx") returned 5 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".vhdx") returned 0x0 [0040.766] lstrlenW (lpString=".pst") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".pst") returned 0x0 [0040.766] lstrlenW (lpString=".ost") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".ost") returned 0x0 [0040.766] lstrlenW (lpString=".bak") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".bak") returned 0x0 [0040.766] lstrlenW (lpString=".bac") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".bac") returned 0x0 [0040.766] lstrlenW (lpString=".sys") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".sys") returned 0x0 [0040.766] lstrlenW (lpString=".v2i") returned 4 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".v2i") returned 0x0 [0040.766] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0040.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.767] lstrlenW (lpString=".sql") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".sql") returned 0x0 [0040.767] lstrlenW (lpString=".mdf") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".mdf") returned 0x0 [0040.767] lstrlenW (lpString=".txt") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".txt") returned 0x0 [0040.767] lstrlenW (lpString=".dbf") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".dbf") returned 0x0 [0040.767] lstrlenW (lpString=".ckp") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".ckp") returned 0x0 [0040.767] lstrlenW (lpString=".dacpac") returned 7 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".dacpac") returned 0x0 [0040.767] lstrlenW (lpString=".db3") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".db3") returned 0x0 [0040.767] lstrlenW (lpString=".dtxs") returned 5 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".dtxs") returned 0x0 [0040.767] lstrlenW (lpString=".mdt") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".mdt") returned 0x0 [0040.767] lstrlenW (lpString=".sdf") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".sdf") returned 0x0 [0040.767] lstrlenW (lpString=".MDF") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".MDF") returned 0x0 [0040.767] lstrlenW (lpString=".DBF") returned 4 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".DBF") returned 0x0 [0040.767] lstrlenW (lpString=".DB") returned 3 [0040.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".DB") returned 0x0 [0040.767] lstrlenW (lpString=".db") returned 3 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".db") returned 0x0 [0040.768] lstrlenW (lpString=".ndf") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".ndf") returned 0x0 [0040.768] lstrlenW (lpString=".NDF") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".NDF") returned 0x0 [0040.768] lstrlenW (lpString=".Mdf") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".Mdf") returned 0x0 [0040.768] lstrlenW (lpString=".dat") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".dat") returned 0x0 [0040.768] lstrlenW (lpString=".DAT") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".DAT") returned 0x0 [0040.768] lstrlenW (lpString=".ldf") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".ldf") returned 0x0 [0040.768] lstrlenW (lpString=".LDF") returned 4 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch=".LDF") returned 0x0 [0040.768] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f16f0 [0040.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.768] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.769] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.769] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.769] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16077052559) returned 1 [0040.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa71d1470, dwHighDateTime=0x1d585b4)) [0040.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953f0 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0040.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.770] GetLastError () returned 0x0 [0040.770] GetLastError () returned 0x0 [0040.770] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.770] GetLastError () returned 0x0 [0040.770] GetLastError () returned 0x0 [0040.770] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.773] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.773] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.774] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.774] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.775] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.775] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.776] CloseHandle (hObject=0x108) returned 1 [0040.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.776] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.777] GetLastError () returned 0x0 [0040.777] RtlWakeConditionVariable () returned 0x27e828 [0040.777] GetCurrentThreadId () returned 0x99c [0040.777] GetCurrentThreadId () returned 0x99c [0040.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2978f8 | out: hHeap=0x260000) returned 1 [0040.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0040.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2978f8 [0040.777] lstrlenW (lpString=".ldf") returned 4 [0040.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".ldf") returned 0x0 [0040.777] lstrlenW (lpString=".vhd") returned 4 [0040.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".vhd") returned 0x0 [0040.777] lstrlenW (lpString=".vhdx") returned 5 [0040.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".vhdx") returned 0x0 [0040.777] lstrlenW (lpString=".pst") returned 4 [0040.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".pst") returned 0x0 [0040.777] lstrlenW (lpString=".ost") returned 4 [0040.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".ost") returned 0x0 [0040.777] lstrlenW (lpString=".bak") returned 4 [0040.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".bak") returned 0x0 [0040.777] lstrlenW (lpString=".bac") returned 4 [0040.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".bac") returned 0x0 [0040.778] lstrlenW (lpString=".sys") returned 4 [0040.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".sys") returned 0x0 [0040.778] lstrlenW (lpString=".v2i") returned 4 [0040.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".v2i") returned 0x0 [0040.778] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.827] lstrlenW (lpString=".sql") returned 4 [0040.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".sql") returned 0x0 [0040.827] lstrlenW (lpString=".mdf") returned 4 [0040.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".mdf") returned 0x0 [0040.827] lstrlenW (lpString=".txt") returned 4 [0040.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".txt") returned 0x0 [0040.827] lstrlenW (lpString=".dbf") returned 4 [0040.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".dbf") returned 0x0 [0040.827] lstrlenW (lpString=".ckp") returned 4 [0040.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".ckp") returned 0x0 [0040.828] lstrlenW (lpString=".dacpac") returned 7 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".dacpac") returned 0x0 [0040.828] lstrlenW (lpString=".db3") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".db3") returned 0x0 [0040.828] lstrlenW (lpString=".dtxs") returned 5 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".dtxs") returned 0x0 [0040.828] lstrlenW (lpString=".mdt") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".mdt") returned 0x0 [0040.828] lstrlenW (lpString=".sdf") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".sdf") returned 0x0 [0040.828] lstrlenW (lpString=".MDF") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".MDF") returned 0x0 [0040.828] lstrlenW (lpString=".DBF") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".DBF") returned 0x0 [0040.828] lstrlenW (lpString=".DB") returned 3 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".DB") returned 0x0 [0040.828] lstrlenW (lpString=".db") returned 3 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".db") returned 0x0 [0040.828] lstrlenW (lpString=".ndf") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".ndf") returned 0x0 [0040.828] lstrlenW (lpString=".NDF") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".NDF") returned 0x0 [0040.828] lstrlenW (lpString=".Mdf") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".Mdf") returned 0x0 [0040.828] lstrlenW (lpString=".dat") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".dat") returned 0x0 [0040.828] lstrlenW (lpString=".DAT") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".DAT") returned 0x0 [0040.828] lstrlenW (lpString=".ldf") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".ldf") returned 0x0 [0040.828] lstrlenW (lpString=".LDF") returned 4 [0040.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch=".LDF") returned 0x0 [0040.828] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5488 [0040.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.829] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0040.829] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.829] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.830] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16083067263) returned 1 [0040.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa72699f0, dwHighDateTime=0x1d585b4)) [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7470 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0040.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.830] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0040.830] GetLastError () returned 0x0 [0040.830] GetLastError () returned 0x0 [0040.830] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0040.830] GetLastError () returned 0x0 [0040.830] GetLastError () returned 0x0 [0040.831] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.836] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.836] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.836] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.836] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.837] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.838] CloseHandle (hObject=0x10c) returned 1 [0040.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0040.838] GetLastError () returned 0x0 [0040.839] RtlWakeConditionVariable () returned 0x27e828 [0040.839] GetCurrentThreadId () returned 0x99c [0040.839] GetCurrentThreadId () returned 0x99c [0040.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297a28 | out: hHeap=0x260000) returned 1 [0040.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d74a8 | out: hHeap=0x260000) returned 1 [0040.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0040.839] lstrlenW (lpString=".ldf") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".ldf") returned 0x0 [0040.839] lstrlenW (lpString=".vhd") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".vhd") returned 0x0 [0040.839] lstrlenW (lpString=".vhdx") returned 5 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".vhdx") returned 0x0 [0040.839] lstrlenW (lpString=".pst") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".pst") returned 0x0 [0040.839] lstrlenW (lpString=".ost") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".ost") returned 0x0 [0040.839] lstrlenW (lpString=".bak") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".bak") returned 0x0 [0040.839] lstrlenW (lpString=".bac") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".bac") returned 0x0 [0040.839] lstrlenW (lpString=".sys") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".sys") returned 0x0 [0040.839] lstrlenW (lpString=".v2i") returned 4 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch=".v2i") returned 0x0 [0040.839] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297a28 | out: hHeap=0x260000) returned 1 [0040.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296b50 | out: hHeap=0x260000) returned 1 [0040.848] RtlWakeConditionVariable () returned 0x27e828 [0040.848] GetCurrentThreadId () returned 0x99c [0040.848] GetCurrentThreadId () returned 0x99c [0040.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6600 | out: hHeap=0x260000) returned 1 [0040.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0040.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6600 [0040.848] lstrlenW (lpString=".ldf") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.848] lstrlenW (lpString=".vhd") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.848] lstrlenW (lpString=".vhdx") returned 5 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.848] lstrlenW (lpString=".pst") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.848] lstrlenW (lpString=".ost") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.848] lstrlenW (lpString=".bak") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.848] lstrlenW (lpString=".bac") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.848] lstrlenW (lpString=".sys") returned 4 [0040.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.848] lstrlenW (lpString=".v2i") returned 4 [0040.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.849] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6600 | out: hHeap=0x260000) returned 1 [0040.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.856] RtlWakeConditionVariable () returned 0x27e828 [0040.856] GetCurrentThreadId () returned 0x99c [0040.856] GetCurrentThreadId () returned 0x99c [0040.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6558 | out: hHeap=0x260000) returned 1 [0040.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7668 | out: hHeap=0x260000) returned 1 [0040.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6558 [0040.856] lstrlenW (lpString=".ldf") returned 4 [0040.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".ldf") returned 0x0 [0040.856] lstrlenW (lpString=".vhd") returned 4 [0040.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".vhd") returned 0x0 [0040.856] lstrlenW (lpString=".vhdx") returned 5 [0040.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".vhdx") returned 0x0 [0040.856] lstrlenW (lpString=".pst") returned 4 [0040.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".pst") returned 0x0 [0040.856] lstrlenW (lpString=".ost") returned 4 [0040.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".ost") returned 0x0 [0040.857] lstrlenW (lpString=".bak") returned 4 [0040.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".bak") returned 0x0 [0040.857] lstrlenW (lpString=".bac") returned 4 [0040.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".bac") returned 0x0 [0040.857] lstrlenW (lpString=".sys") returned 4 [0040.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".sys") returned 0x0 [0040.857] lstrlenW (lpString=".v2i") returned 4 [0040.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch=".v2i") returned 0x0 [0040.857] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6558 | out: hHeap=0x260000) returned 1 [0040.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.882] RtlWakeConditionVariable () returned 0x27e828 [0040.882] GetCurrentThreadId () returned 0x99c [0040.882] GetCurrentThreadId () returned 0x99c [0040.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6e88 | out: hHeap=0x260000) returned 1 [0040.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ac8 | out: hHeap=0x260000) returned 1 [0040.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6e88 [0040.883] lstrlenW (lpString=".ldf") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".ldf") returned 0x0 [0040.883] lstrlenW (lpString=".vhd") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".vhd") returned 0x0 [0040.883] lstrlenW (lpString=".vhdx") returned 5 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.883] lstrlenW (lpString=".pst") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".pst") returned 0x0 [0040.883] lstrlenW (lpString=".ost") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".ost") returned 0x0 [0040.883] lstrlenW (lpString=".bak") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".bak") returned 0x0 [0040.883] lstrlenW (lpString=".bac") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".bac") returned 0x0 [0040.883] lstrlenW (lpString=".sys") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".sys") returned 0x0 [0040.883] lstrlenW (lpString=".v2i") returned 4 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch=".v2i") returned 0x0 [0040.883] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6e88 | out: hHeap=0x260000) returned 1 [0040.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.912] RtlWakeConditionVariable () returned 0x27e828 [0040.912] GetCurrentThreadId () returned 0x99c [0040.912] GetCurrentThreadId () returned 0x99c [0040.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f71d0 | out: hHeap=0x260000) returned 1 [0040.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c70 | out: hHeap=0x260000) returned 1 [0040.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f71d0 [0040.912] lstrlenW (lpString=".ldf") returned 4 [0040.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".ldf") returned 0x0 [0040.912] lstrlenW (lpString=".vhd") returned 4 [0040.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".vhd") returned 0x0 [0040.913] lstrlenW (lpString=".vhdx") returned 5 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".vhdx") returned 0x0 [0040.913] lstrlenW (lpString=".pst") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".pst") returned 0x0 [0040.913] lstrlenW (lpString=".ost") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".ost") returned 0x0 [0040.913] lstrlenW (lpString=".bak") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".bak") returned 0x0 [0040.913] lstrlenW (lpString=".bac") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".bac") returned 0x0 [0040.913] lstrlenW (lpString=".sys") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".sys") returned 0x0 [0040.913] lstrlenW (lpString=".v2i") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch=".v2i") returned 0x0 [0040.913] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f71d0 | out: hHeap=0x260000) returned 1 [0040.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.913] RtlWakeConditionVariable () returned 0x27e828 [0040.913] GetCurrentThreadId () returned 0x99c [0040.913] GetCurrentThreadId () returned 0x99c [0040.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7278 | out: hHeap=0x260000) returned 1 [0040.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ca8 | out: hHeap=0x260000) returned 1 [0040.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7278 [0040.913] lstrlenW (lpString=".ldf") returned 4 [0040.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".ldf") returned 0x0 [0040.914] lstrlenW (lpString=".vhd") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".vhd") returned 0x0 [0040.914] lstrlenW (lpString=".vhdx") returned 5 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".vhdx") returned 0x0 [0040.914] lstrlenW (lpString=".pst") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".pst") returned 0x0 [0040.914] lstrlenW (lpString=".ost") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".ost") returned 0x0 [0040.914] lstrlenW (lpString=".bak") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".bak") returned 0x0 [0040.914] lstrlenW (lpString=".bac") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".bac") returned 0x0 [0040.914] lstrlenW (lpString=".sys") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".sys") returned 0x0 [0040.914] lstrlenW (lpString=".v2i") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch=".v2i") returned 0x0 [0040.914] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", lpSrch="s\r\n.v2i") returned 0x0 [0040.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7278 | out: hHeap=0x260000) returned 1 [0040.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.914] RtlWakeConditionVariable () returned 0x27e828 [0040.914] GetCurrentThreadId () returned 0x99c [0040.914] GetCurrentThreadId () returned 0x99c [0040.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7320 | out: hHeap=0x260000) returned 1 [0040.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ce0 | out: hHeap=0x260000) returned 1 [0040.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7320 [0040.914] lstrlenW (lpString=".ldf") returned 4 [0040.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.914] lstrlenW (lpString=".vhd") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.915] lstrlenW (lpString=".vhdx") returned 5 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.915] lstrlenW (lpString=".pst") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.915] lstrlenW (lpString=".ost") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.915] lstrlenW (lpString=".bak") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.915] lstrlenW (lpString=".bac") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.915] lstrlenW (lpString=".sys") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.915] lstrlenW (lpString=".v2i") returned 4 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.915] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7320 | out: hHeap=0x260000) returned 1 [0040.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.958] RtlWakeConditionVariable () returned 0x27e828 [0040.958] GetCurrentThreadId () returned 0x99c [0040.958] GetCurrentThreadId () returned 0x99c [0040.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7518 | out: hHeap=0x260000) returned 1 [0040.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8220 | out: hHeap=0x260000) returned 1 [0040.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7518 [0040.958] lstrlenW (lpString=".ldf") returned 4 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".ldf") returned 0x0 [0040.958] lstrlenW (lpString=".vhd") returned 4 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".vhd") returned 0x0 [0040.958] lstrlenW (lpString=".vhdx") returned 5 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".vhdx") returned 0x0 [0040.958] lstrlenW (lpString=".pst") returned 4 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".pst") returned 0x0 [0040.958] lstrlenW (lpString=".ost") returned 4 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".ost") returned 0x0 [0040.958] lstrlenW (lpString=".bak") returned 4 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".bak") returned 0x0 [0040.958] lstrlenW (lpString=".bac") returned 4 [0040.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".bac") returned 0x0 [0040.958] lstrlenW (lpString=".sys") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".sys") returned 0x0 [0040.959] lstrlenW (lpString=".v2i") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch=".v2i") returned 0x0 [0040.959] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7518 | out: hHeap=0x260000) returned 1 [0040.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.959] RtlWakeConditionVariable () returned 0x27e828 [0040.959] GetCurrentThreadId () returned 0x99c [0040.959] GetCurrentThreadId () returned 0x99c [0040.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0040.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da470 | out: hHeap=0x260000) returned 1 [0040.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0040.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da470 [0040.959] lstrlenW (lpString=".ldf") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".ldf") returned 0x0 [0040.959] lstrlenW (lpString=".vhd") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".vhd") returned 0x0 [0040.959] lstrlenW (lpString=".vhdx") returned 5 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".vhdx") returned 0x0 [0040.959] lstrlenW (lpString=".pst") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".pst") returned 0x0 [0040.959] lstrlenW (lpString=".ost") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".ost") returned 0x0 [0040.959] lstrlenW (lpString=".bak") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".bak") returned 0x0 [0040.959] lstrlenW (lpString=".bac") returned 4 [0040.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".bac") returned 0x0 [0040.960] lstrlenW (lpString=".sys") returned 4 [0040.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".sys") returned 0x0 [0040.960] lstrlenW (lpString=".v2i") returned 4 [0040.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch=".v2i") returned 0x0 [0040.960] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da470 | out: hHeap=0x260000) returned 1 [0040.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0040.960] RtlWakeConditionVariable () returned 0x27e828 [0040.960] GetCurrentThreadId () returned 0x99c [0040.960] GetCurrentThreadId () returned 0x99c [0040.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ee60 [0040.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f1c0 | out: hHeap=0x260000) returned 1 [0040.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0040.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f1c0 [0040.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.960] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.961] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.961] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.961] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.962] CloseHandle (hObject=0x100) returned 1 [0040.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f1c0 | out: hHeap=0x260000) returned 1 [0040.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee60 | out: hHeap=0x260000) returned 1 [0040.962] RtlWakeConditionVariable () returned 0x27e828 [0040.962] GetCurrentThreadId () returned 0x99c [0040.962] GetCurrentThreadId () returned 0x99c [0040.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b068 | out: hHeap=0x260000) returned 1 [0040.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0040.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b068 [0040.962] lstrlenW (lpString=".ldf") returned 4 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".ldf") returned 0x0 [0040.962] lstrlenW (lpString=".vhd") returned 4 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".vhd") returned 0x0 [0040.962] lstrlenW (lpString=".vhdx") returned 5 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".vhdx") returned 0x0 [0040.962] lstrlenW (lpString=".pst") returned 4 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".pst") returned 0x0 [0040.962] lstrlenW (lpString=".ost") returned 4 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".ost") returned 0x0 [0040.962] lstrlenW (lpString=".bak") returned 4 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".bak") returned 0x0 [0040.962] lstrlenW (lpString=".bac") returned 4 [0040.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".bac") returned 0x0 [0040.963] lstrlenW (lpString=".sys") returned 4 [0040.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".sys") returned 0x0 [0040.963] lstrlenW (lpString=".v2i") returned 4 [0040.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch=".v2i") returned 0x0 [0040.963] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b068 | out: hHeap=0x260000) returned 1 [0040.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.991] RtlWakeConditionVariable () returned 0x27e828 [0040.991] GetCurrentThreadId () returned 0x99c [0040.991] GetCurrentThreadId () returned 0x99c [0040.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ef38 [0040.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f370 | out: hHeap=0x260000) returned 1 [0040.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8290 | out: hHeap=0x260000) returned 1 [0040.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f370 [0040.991] lstrlenW (lpString=".ldf") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".ldf") returned 0x0 [0040.991] lstrlenW (lpString=".vhd") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".vhd") returned 0x0 [0040.991] lstrlenW (lpString=".vhdx") returned 5 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".vhdx") returned 0x0 [0040.991] lstrlenW (lpString=".pst") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".pst") returned 0x0 [0040.991] lstrlenW (lpString=".ost") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".ost") returned 0x0 [0040.991] lstrlenW (lpString=".bak") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".bak") returned 0x0 [0040.991] lstrlenW (lpString=".bac") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".bac") returned 0x0 [0040.991] lstrlenW (lpString=".sys") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".sys") returned 0x0 [0040.991] lstrlenW (lpString=".v2i") returned 4 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch=".v2i") returned 0x0 [0040.991] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f370 | out: hHeap=0x260000) returned 1 [0041.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef38 | out: hHeap=0x260000) returned 1 [0041.008] RtlWakeConditionVariable () returned 0x27e828 [0041.008] GetCurrentThreadId () returned 0x99c [0041.008] GetCurrentThreadId () returned 0x99c [0041.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b120 | out: hHeap=0x260000) returned 1 [0041.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d83a8 | out: hHeap=0x260000) returned 1 [0041.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b120 [0041.008] lstrlenW (lpString=".ldf") returned 4 [0041.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".ldf") returned 0x0 [0041.008] lstrlenW (lpString=".vhd") returned 4 [0041.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".vhd") returned 0x0 [0041.008] lstrlenW (lpString=".vhdx") returned 5 [0041.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".vhdx") returned 0x0 [0041.008] lstrlenW (lpString=".pst") returned 4 [0041.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".pst") returned 0x0 [0041.008] lstrlenW (lpString=".ost") returned 4 [0041.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".ost") returned 0x0 [0041.008] lstrlenW (lpString=".bak") returned 4 [0041.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".bak") returned 0x0 [0041.009] lstrlenW (lpString=".bac") returned 4 [0041.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".bac") returned 0x0 [0041.009] lstrlenW (lpString=".sys") returned 4 [0041.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".sys") returned 0x0 [0041.009] lstrlenW (lpString=".v2i") returned 4 [0041.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch=".v2i") returned 0x0 [0041.009] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b120 | out: hHeap=0x260000) returned 1 [0041.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0041.021] RtlWakeConditionVariable () returned 0x27e828 [0041.022] GetCurrentThreadId () returned 0x99c [0041.022] GetCurrentThreadId () returned 0x99c [0041.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3260 | out: hHeap=0x260000) returned 1 [0041.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e30 | out: hHeap=0x260000) returned 1 [0041.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3260 [0041.022] lstrlenW (lpString=".ldf") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".ldf") returned 0x0 [0041.022] lstrlenW (lpString=".vhd") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".vhd") returned 0x0 [0041.022] lstrlenW (lpString=".vhdx") returned 5 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".vhdx") returned 0x0 [0041.022] lstrlenW (lpString=".pst") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".pst") returned 0x0 [0041.022] lstrlenW (lpString=".ost") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".ost") returned 0x0 [0041.022] lstrlenW (lpString=".bak") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".bak") returned 0x0 [0041.022] lstrlenW (lpString=".bac") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".bac") returned 0x0 [0041.022] lstrlenW (lpString=".sys") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".sys") returned 0x0 [0041.022] lstrlenW (lpString=".v2i") returned 4 [0041.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch=".v2i") returned 0x0 [0041.022] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3260 | out: hHeap=0x260000) returned 1 [0041.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0041.043] RtlWakeConditionVariable () returned 0x27e828 [0041.043] GetCurrentThreadId () returned 0x99c [0041.043] GetCurrentThreadId () returned 0x99c [0041.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cb8 | out: hHeap=0x260000) returned 1 [0041.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.072] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.072] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.072] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.072] WriteFile (in: hFile=0xf0, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.073] CloseHandle (hObject=0xf0) returned 1 [0041.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0041.073] RtlWakeConditionVariable () returned 0x27e828 [0041.073] GetCurrentThreadId () returned 0x99c [0041.073] GetCurrentThreadId () returned 0x99c [0041.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295f70 | out: hHeap=0x260000) returned 1 [0041.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d98 | out: hHeap=0x260000) returned 1 [0041.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295f70 [0041.073] lstrlenW (lpString=".ldf") returned 4 [0041.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".ldf") returned 0x0 [0041.073] lstrlenW (lpString=".vhd") returned 4 [0041.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".vhd") returned 0x0 [0041.073] lstrlenW (lpString=".vhdx") returned 5 [0041.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".vhdx") returned 0x0 [0041.073] lstrlenW (lpString=".pst") returned 4 [0041.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".pst") returned 0x0 [0041.073] lstrlenW (lpString=".ost") returned 4 [0041.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".ost") returned 0x0 [0041.073] lstrlenW (lpString=".bak") returned 4 [0041.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".bak") returned 0x0 [0041.074] lstrlenW (lpString=".bac") returned 4 [0041.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".bac") returned 0x0 [0041.074] lstrlenW (lpString=".sys") returned 4 [0041.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".sys") returned 0x0 [0041.074] lstrlenW (lpString=".v2i") returned 4 [0041.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch=".v2i") returned 0x0 [0041.074] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295f70 | out: hHeap=0x260000) returned 1 [0041.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.075] RtlWakeConditionVariable () returned 0x27e828 [0041.075] GetCurrentThreadId () returned 0x99c [0041.075] GetCurrentThreadId () returned 0x99c [0041.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0041.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337dd0 | out: hHeap=0x260000) returned 1 [0041.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0041.075] lstrlenW (lpString=".ldf") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".ldf") returned 0x0 [0041.075] lstrlenW (lpString=".vhd") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".vhd") returned 0x0 [0041.075] lstrlenW (lpString=".vhdx") returned 5 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".vhdx") returned 0x0 [0041.075] lstrlenW (lpString=".pst") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".pst") returned 0x0 [0041.075] lstrlenW (lpString=".ost") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".ost") returned 0x0 [0041.075] lstrlenW (lpString=".bak") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".bak") returned 0x0 [0041.075] lstrlenW (lpString=".bac") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".bac") returned 0x0 [0041.075] lstrlenW (lpString=".sys") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".sys") returned 0x0 [0041.075] lstrlenW (lpString=".v2i") returned 4 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch=".v2i") returned 0x0 [0041.075] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295ed8 | out: hHeap=0x260000) returned 1 [0041.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.076] RtlWakeConditionVariable () returned 0x27e828 [0041.076] GetCurrentThreadId () returned 0x99c [0041.076] GetCurrentThreadId () returned 0x99c [0041.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8c10 | out: hHeap=0x260000) returned 1 [0041.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e08 | out: hHeap=0x260000) returned 1 [0041.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8c10 [0041.076] lstrlenW (lpString=".ldf") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".ldf") returned 0x0 [0041.076] lstrlenW (lpString=".vhd") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".vhd") returned 0x0 [0041.076] lstrlenW (lpString=".vhdx") returned 5 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".vhdx") returned 0x0 [0041.076] lstrlenW (lpString=".pst") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".pst") returned 0x0 [0041.076] lstrlenW (lpString=".ost") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".ost") returned 0x0 [0041.076] lstrlenW (lpString=".bak") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".bak") returned 0x0 [0041.076] lstrlenW (lpString=".bac") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".bac") returned 0x0 [0041.076] lstrlenW (lpString=".sys") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".sys") returned 0x0 [0041.076] lstrlenW (lpString=".v2i") returned 4 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch=".v2i") returned 0x0 [0041.076] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8c10 | out: hHeap=0x260000) returned 1 [0041.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.077] RtlWakeConditionVariable () returned 0x27e828 [0041.077] GetCurrentThreadId () returned 0x99c [0041.077] GetCurrentThreadId () returned 0x99c [0041.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ca8 | out: hHeap=0x260000) returned 1 [0041.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e40 | out: hHeap=0x260000) returned 1 [0041.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8ca8 [0041.077] lstrlenW (lpString=".ldf") returned 4 [0041.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".ldf") returned 0x0 [0041.077] lstrlenW (lpString=".vhd") returned 4 [0041.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".vhd") returned 0x0 [0041.077] lstrlenW (lpString=".vhdx") returned 5 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".vhdx") returned 0x0 [0041.078] lstrlenW (lpString=".pst") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".pst") returned 0x0 [0041.078] lstrlenW (lpString=".ost") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".ost") returned 0x0 [0041.078] lstrlenW (lpString=".bak") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".bak") returned 0x0 [0041.078] lstrlenW (lpString=".bac") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".bac") returned 0x0 [0041.078] lstrlenW (lpString=".sys") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".sys") returned 0x0 [0041.078] lstrlenW (lpString=".v2i") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch=".v2i") returned 0x0 [0041.078] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ca8 | out: hHeap=0x260000) returned 1 [0041.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.078] RtlWakeConditionVariable () returned 0x27e828 [0041.078] GetCurrentThreadId () returned 0x99c [0041.078] GetCurrentThreadId () returned 0x99c [0041.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8d40 | out: hHeap=0x260000) returned 1 [0041.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e78 | out: hHeap=0x260000) returned 1 [0041.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8d40 [0041.078] lstrlenW (lpString=".ldf") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".ldf") returned 0x0 [0041.078] lstrlenW (lpString=".vhd") returned 4 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".vhd") returned 0x0 [0041.078] lstrlenW (lpString=".vhdx") returned 5 [0041.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".vhdx") returned 0x0 [0041.079] lstrlenW (lpString=".pst") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".pst") returned 0x0 [0041.079] lstrlenW (lpString=".ost") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".ost") returned 0x0 [0041.079] lstrlenW (lpString=".bak") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".bak") returned 0x0 [0041.079] lstrlenW (lpString=".bac") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".bac") returned 0x0 [0041.079] lstrlenW (lpString=".sys") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".sys") returned 0x0 [0041.079] lstrlenW (lpString=".v2i") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch=".v2i") returned 0x0 [0041.079] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8d40 | out: hHeap=0x260000) returned 1 [0041.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.079] RtlWakeConditionVariable () returned 0x27e828 [0041.079] GetCurrentThreadId () returned 0x99c [0041.079] GetCurrentThreadId () returned 0x99c [0041.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8dd8 | out: hHeap=0x260000) returned 1 [0041.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337eb0 | out: hHeap=0x260000) returned 1 [0041.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8dd8 [0041.079] lstrlenW (lpString=".ldf") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".ldf") returned 0x0 [0041.079] lstrlenW (lpString=".vhd") returned 4 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".vhd") returned 0x0 [0041.079] lstrlenW (lpString=".vhdx") returned 5 [0041.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".vhdx") returned 0x0 [0041.079] lstrlenW (lpString=".pst") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".pst") returned 0x0 [0041.080] lstrlenW (lpString=".ost") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".ost") returned 0x0 [0041.080] lstrlenW (lpString=".bak") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".bak") returned 0x0 [0041.080] lstrlenW (lpString=".bac") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".bac") returned 0x0 [0041.080] lstrlenW (lpString=".sys") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".sys") returned 0x0 [0041.080] lstrlenW (lpString=".v2i") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch=".v2i") returned 0x0 [0041.080] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", lpSrch="s\r\n.v2i") returned 0x0 [0041.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8dd8 | out: hHeap=0x260000) returned 1 [0041.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.080] RtlWakeConditionVariable () returned 0x27e828 [0041.080] GetCurrentThreadId () returned 0x99c [0041.080] GetCurrentThreadId () returned 0x99c [0041.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e70 | out: hHeap=0x260000) returned 1 [0041.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ee8 | out: hHeap=0x260000) returned 1 [0041.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8e70 [0041.080] lstrlenW (lpString=".ldf") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".ldf") returned 0x0 [0041.080] lstrlenW (lpString=".vhd") returned 4 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".vhd") returned 0x0 [0041.080] lstrlenW (lpString=".vhdx") returned 5 [0041.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".vhdx") returned 0x0 [0041.081] lstrlenW (lpString=".pst") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".pst") returned 0x0 [0041.081] lstrlenW (lpString=".ost") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".ost") returned 0x0 [0041.081] lstrlenW (lpString=".bak") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".bak") returned 0x0 [0041.081] lstrlenW (lpString=".bac") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".bac") returned 0x0 [0041.081] lstrlenW (lpString=".sys") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".sys") returned 0x0 [0041.081] lstrlenW (lpString=".v2i") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch=".v2i") returned 0x0 [0041.081] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e70 | out: hHeap=0x260000) returned 1 [0041.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.081] RtlWakeConditionVariable () returned 0x27e828 [0041.081] GetCurrentThreadId () returned 0x99c [0041.081] GetCurrentThreadId () returned 0x99c [0041.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8f08 | out: hHeap=0x260000) returned 1 [0041.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f20 | out: hHeap=0x260000) returned 1 [0041.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8f08 [0041.081] lstrlenW (lpString=".ldf") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".ldf") returned 0x0 [0041.081] lstrlenW (lpString=".vhd") returned 4 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".vhd") returned 0x0 [0041.081] lstrlenW (lpString=".vhdx") returned 5 [0041.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".vhdx") returned 0x0 [0041.082] lstrlenW (lpString=".pst") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".pst") returned 0x0 [0041.082] lstrlenW (lpString=".ost") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".ost") returned 0x0 [0041.082] lstrlenW (lpString=".bak") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".bak") returned 0x0 [0041.082] lstrlenW (lpString=".bac") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".bac") returned 0x0 [0041.082] lstrlenW (lpString=".sys") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".sys") returned 0x0 [0041.082] lstrlenW (lpString=".v2i") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch=".v2i") returned 0x0 [0041.082] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8f08 | out: hHeap=0x260000) returned 1 [0041.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.082] RtlWakeConditionVariable () returned 0x27e828 [0041.082] GetCurrentThreadId () returned 0x99c [0041.082] GetCurrentThreadId () returned 0x99c [0041.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8fa0 | out: hHeap=0x260000) returned 1 [0041.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f58 | out: hHeap=0x260000) returned 1 [0041.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8fa0 [0041.082] lstrlenW (lpString=".ldf") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".ldf") returned 0x0 [0041.082] lstrlenW (lpString=".vhd") returned 4 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".vhd") returned 0x0 [0041.082] lstrlenW (lpString=".vhdx") returned 5 [0041.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".vhdx") returned 0x0 [0041.083] lstrlenW (lpString=".pst") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".pst") returned 0x0 [0041.083] lstrlenW (lpString=".ost") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".ost") returned 0x0 [0041.083] lstrlenW (lpString=".bak") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".bak") returned 0x0 [0041.083] lstrlenW (lpString=".bac") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".bac") returned 0x0 [0041.083] lstrlenW (lpString=".sys") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".sys") returned 0x0 [0041.083] lstrlenW (lpString=".v2i") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch=".v2i") returned 0x0 [0041.083] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", lpSrch="s\r\n.v2i") returned 0x0 [0041.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8fa0 | out: hHeap=0x260000) returned 1 [0041.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.083] RtlWakeConditionVariable () returned 0x27e828 [0041.083] GetCurrentThreadId () returned 0x99c [0041.083] GetCurrentThreadId () returned 0x99c [0041.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7668 [0041.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f77b8 | out: hHeap=0x260000) returned 1 [0041.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0041.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f77b8 [0041.083] lstrlenW (lpString=".ldf") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".ldf") returned 0x0 [0041.083] lstrlenW (lpString=".vhd") returned 4 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".vhd") returned 0x0 [0041.083] lstrlenW (lpString=".vhdx") returned 5 [0041.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".vhdx") returned 0x0 [0041.083] lstrlenW (lpString=".pst") returned 4 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".pst") returned 0x0 [0041.084] lstrlenW (lpString=".ost") returned 4 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".ost") returned 0x0 [0041.084] lstrlenW (lpString=".bak") returned 4 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".bak") returned 0x0 [0041.084] lstrlenW (lpString=".bac") returned 4 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".bac") returned 0x0 [0041.084] lstrlenW (lpString=".sys") returned 4 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".sys") returned 0x0 [0041.084] lstrlenW (lpString=".v2i") returned 4 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch=".v2i") returned 0x0 [0041.084] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", lpSrch="s\r\n.v2i") returned 0x0 [0041.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f77b8 | out: hHeap=0x260000) returned 1 [0041.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7668 | out: hHeap=0x260000) returned 1 [0041.084] RtlWakeConditionVariable () returned 0x27e828 [0041.084] GetCurrentThreadId () returned 0x99c [0041.084] GetCurrentThreadId () returned 0x99c [0041.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9038 | out: hHeap=0x260000) returned 1 [0041.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337fc8 | out: hHeap=0x260000) returned 1 [0041.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9038 [0041.085] lstrlenW (lpString=".ldf") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".ldf") returned 0x0 [0041.085] lstrlenW (lpString=".vhd") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".vhd") returned 0x0 [0041.085] lstrlenW (lpString=".vhdx") returned 5 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".vhdx") returned 0x0 [0041.085] lstrlenW (lpString=".pst") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".pst") returned 0x0 [0041.085] lstrlenW (lpString=".ost") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".ost") returned 0x0 [0041.085] lstrlenW (lpString=".bak") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".bak") returned 0x0 [0041.085] lstrlenW (lpString=".bac") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".bac") returned 0x0 [0041.085] lstrlenW (lpString=".sys") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".sys") returned 0x0 [0041.085] lstrlenW (lpString=".v2i") returned 4 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch=".v2i") returned 0x0 [0041.085] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9038 | out: hHeap=0x260000) returned 1 [0041.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.085] RtlWakeConditionVariable () returned 0x27e828 [0041.085] GetCurrentThreadId () returned 0x99c [0041.085] GetCurrentThreadId () returned 0x99c [0041.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f90d0 | out: hHeap=0x260000) returned 1 [0041.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338000 | out: hHeap=0x260000) returned 1 [0041.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f90d0 [0041.086] lstrlenW (lpString=".ldf") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".ldf") returned 0x0 [0041.086] lstrlenW (lpString=".vhd") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".vhd") returned 0x0 [0041.086] lstrlenW (lpString=".vhdx") returned 5 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".vhdx") returned 0x0 [0041.086] lstrlenW (lpString=".pst") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".pst") returned 0x0 [0041.086] lstrlenW (lpString=".ost") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".ost") returned 0x0 [0041.086] lstrlenW (lpString=".bak") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".bak") returned 0x0 [0041.086] lstrlenW (lpString=".bac") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".bac") returned 0x0 [0041.086] lstrlenW (lpString=".sys") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".sys") returned 0x0 [0041.086] lstrlenW (lpString=".v2i") returned 4 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch=".v2i") returned 0x0 [0041.086] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f90d0 | out: hHeap=0x260000) returned 1 [0041.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.086] RtlWakeConditionVariable () returned 0x27e828 [0041.086] GetCurrentThreadId () returned 0x99c [0041.086] GetCurrentThreadId () returned 0x99c [0041.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9168 | out: hHeap=0x260000) returned 1 [0041.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338038 | out: hHeap=0x260000) returned 1 [0041.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9168 [0041.087] lstrlenW (lpString=".ldf") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".ldf") returned 0x0 [0041.087] lstrlenW (lpString=".vhd") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".vhd") returned 0x0 [0041.087] lstrlenW (lpString=".vhdx") returned 5 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".vhdx") returned 0x0 [0041.087] lstrlenW (lpString=".pst") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".pst") returned 0x0 [0041.087] lstrlenW (lpString=".ost") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".ost") returned 0x0 [0041.087] lstrlenW (lpString=".bak") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".bak") returned 0x0 [0041.087] lstrlenW (lpString=".bac") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".bac") returned 0x0 [0041.087] lstrlenW (lpString=".sys") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".sys") returned 0x0 [0041.087] lstrlenW (lpString=".v2i") returned 4 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch=".v2i") returned 0x0 [0041.087] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9168 | out: hHeap=0x260000) returned 1 [0041.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.088] RtlWakeConditionVariable () returned 0x27e828 [0041.088] GetCurrentThreadId () returned 0x99c [0041.088] GetCurrentThreadId () returned 0x99c [0041.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9200 | out: hHeap=0x260000) returned 1 [0041.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338070 | out: hHeap=0x260000) returned 1 [0041.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9200 [0041.088] lstrlenW (lpString=".ldf") returned 4 [0041.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".ldf") returned 0x0 [0041.088] lstrlenW (lpString=".vhd") returned 4 [0041.088] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".vhd") returned 0x0 [0041.088] lstrlenW (lpString=".vhdx") returned 5 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".vhdx") returned 0x0 [0041.089] lstrlenW (lpString=".pst") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".pst") returned 0x0 [0041.089] lstrlenW (lpString=".ost") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".ost") returned 0x0 [0041.089] lstrlenW (lpString=".bak") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".bak") returned 0x0 [0041.089] lstrlenW (lpString=".bac") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".bac") returned 0x0 [0041.089] lstrlenW (lpString=".sys") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".sys") returned 0x0 [0041.089] lstrlenW (lpString=".v2i") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch=".v2i") returned 0x0 [0041.089] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9200 | out: hHeap=0x260000) returned 1 [0041.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.089] RtlWakeConditionVariable () returned 0x27e828 [0041.089] GetCurrentThreadId () returned 0x99c [0041.089] GetCurrentThreadId () returned 0x99c [0041.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9298 | out: hHeap=0x260000) returned 1 [0041.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380a8 | out: hHeap=0x260000) returned 1 [0041.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9298 [0041.089] lstrlenW (lpString=".ldf") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".ldf") returned 0x0 [0041.089] lstrlenW (lpString=".vhd") returned 4 [0041.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".vhd") returned 0x0 [0041.090] lstrlenW (lpString=".vhdx") returned 5 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".vhdx") returned 0x0 [0041.090] lstrlenW (lpString=".pst") returned 4 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".pst") returned 0x0 [0041.090] lstrlenW (lpString=".ost") returned 4 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".ost") returned 0x0 [0041.090] lstrlenW (lpString=".bak") returned 4 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".bak") returned 0x0 [0041.090] lstrlenW (lpString=".bac") returned 4 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".bac") returned 0x0 [0041.090] lstrlenW (lpString=".sys") returned 4 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".sys") returned 0x0 [0041.090] lstrlenW (lpString=".v2i") returned 4 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch=".v2i") returned 0x0 [0041.090] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9298 | out: hHeap=0x260000) returned 1 [0041.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.090] RtlWakeConditionVariable () returned 0x27e828 [0041.090] GetCurrentThreadId () returned 0x99c [0041.090] GetCurrentThreadId () returned 0x99c [0041.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9330 | out: hHeap=0x260000) returned 1 [0041.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380e0 | out: hHeap=0x260000) returned 1 [0041.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9330 [0041.091] lstrlenW (lpString=".ldf") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".ldf") returned 0x0 [0041.091] lstrlenW (lpString=".vhd") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".vhd") returned 0x0 [0041.091] lstrlenW (lpString=".vhdx") returned 5 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".vhdx") returned 0x0 [0041.091] lstrlenW (lpString=".pst") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".pst") returned 0x0 [0041.091] lstrlenW (lpString=".ost") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".ost") returned 0x0 [0041.091] lstrlenW (lpString=".bak") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".bak") returned 0x0 [0041.091] lstrlenW (lpString=".bac") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".bac") returned 0x0 [0041.091] lstrlenW (lpString=".sys") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".sys") returned 0x0 [0041.091] lstrlenW (lpString=".v2i") returned 4 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch=".v2i") returned 0x0 [0041.091] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9330 | out: hHeap=0x260000) returned 1 [0041.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.091] RtlWakeConditionVariable () returned 0x27e828 [0041.091] GetCurrentThreadId () returned 0x99c [0041.091] GetCurrentThreadId () returned 0x99c [0041.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f93c8 | out: hHeap=0x260000) returned 1 [0041.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338118 | out: hHeap=0x260000) returned 1 [0041.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f93c8 [0041.092] lstrlenW (lpString=".ldf") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".ldf") returned 0x0 [0041.092] lstrlenW (lpString=".vhd") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".vhd") returned 0x0 [0041.092] lstrlenW (lpString=".vhdx") returned 5 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".vhdx") returned 0x0 [0041.092] lstrlenW (lpString=".pst") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".pst") returned 0x0 [0041.092] lstrlenW (lpString=".ost") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".ost") returned 0x0 [0041.092] lstrlenW (lpString=".bak") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".bak") returned 0x0 [0041.092] lstrlenW (lpString=".bac") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".bac") returned 0x0 [0041.092] lstrlenW (lpString=".sys") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".sys") returned 0x0 [0041.092] lstrlenW (lpString=".v2i") returned 4 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch=".v2i") returned 0x0 [0041.092] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f93c8 | out: hHeap=0x260000) returned 1 [0041.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.095] RtlWakeConditionVariable () returned 0x27e828 [0041.095] GetCurrentThreadId () returned 0x99c [0041.095] GetCurrentThreadId () returned 0x99c [0041.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9460 | out: hHeap=0x260000) returned 1 [0041.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338150 | out: hHeap=0x260000) returned 1 [0041.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9460 [0041.095] lstrlenW (lpString=".ldf") returned 4 [0041.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".ldf") returned 0x0 [0041.095] lstrlenW (lpString=".vhd") returned 4 [0041.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".vhd") returned 0x0 [0041.095] lstrlenW (lpString=".vhdx") returned 5 [0041.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".vhdx") returned 0x0 [0041.095] lstrlenW (lpString=".pst") returned 4 [0041.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".pst") returned 0x0 [0041.096] lstrlenW (lpString=".ost") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".ost") returned 0x0 [0041.096] lstrlenW (lpString=".bak") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".bak") returned 0x0 [0041.096] lstrlenW (lpString=".bac") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".bac") returned 0x0 [0041.096] lstrlenW (lpString=".sys") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".sys") returned 0x0 [0041.096] lstrlenW (lpString=".v2i") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch=".v2i") returned 0x0 [0041.096] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9460 | out: hHeap=0x260000) returned 1 [0041.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.096] RtlWakeConditionVariable () returned 0x27e828 [0041.096] GetCurrentThreadId () returned 0x99c [0041.096] GetCurrentThreadId () returned 0x99c [0041.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0041.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7860 | out: hHeap=0x260000) returned 1 [0041.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338188 | out: hHeap=0x260000) returned 1 [0041.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7860 [0041.096] lstrlenW (lpString=".ldf") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".ldf") returned 0x0 [0041.096] lstrlenW (lpString=".vhd") returned 4 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".vhd") returned 0x0 [0041.096] lstrlenW (lpString=".vhdx") returned 5 [0041.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".vhdx") returned 0x0 [0041.096] lstrlenW (lpString=".pst") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".pst") returned 0x0 [0041.097] lstrlenW (lpString=".ost") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".ost") returned 0x0 [0041.097] lstrlenW (lpString=".bak") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".bak") returned 0x0 [0041.097] lstrlenW (lpString=".bac") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".bac") returned 0x0 [0041.097] lstrlenW (lpString=".sys") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".sys") returned 0x0 [0041.097] lstrlenW (lpString=".v2i") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch=".v2i") returned 0x0 [0041.097] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7860 | out: hHeap=0x260000) returned 1 [0041.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7710 | out: hHeap=0x260000) returned 1 [0041.097] RtlWakeConditionVariable () returned 0x27e828 [0041.097] GetCurrentThreadId () returned 0x99c [0041.097] GetCurrentThreadId () returned 0x99c [0041.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f94f8 | out: hHeap=0x260000) returned 1 [0041.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381c0 | out: hHeap=0x260000) returned 1 [0041.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f94f8 [0041.097] lstrlenW (lpString=".ldf") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".ldf") returned 0x0 [0041.097] lstrlenW (lpString=".vhd") returned 4 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".vhd") returned 0x0 [0041.097] lstrlenW (lpString=".vhdx") returned 5 [0041.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".vhdx") returned 0x0 [0041.098] lstrlenW (lpString=".pst") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".pst") returned 0x0 [0041.098] lstrlenW (lpString=".ost") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".ost") returned 0x0 [0041.098] lstrlenW (lpString=".bak") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".bak") returned 0x0 [0041.098] lstrlenW (lpString=".bac") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".bac") returned 0x0 [0041.098] lstrlenW (lpString=".sys") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".sys") returned 0x0 [0041.098] lstrlenW (lpString=".v2i") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch=".v2i") returned 0x0 [0041.098] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f94f8 | out: hHeap=0x260000) returned 1 [0041.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.098] RtlWakeConditionVariable () returned 0x27e828 [0041.098] GetCurrentThreadId () returned 0x99c [0041.098] GetCurrentThreadId () returned 0x99c [0041.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9590 | out: hHeap=0x260000) returned 1 [0041.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381f8 | out: hHeap=0x260000) returned 1 [0041.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9590 [0041.098] lstrlenW (lpString=".ldf") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".ldf") returned 0x0 [0041.098] lstrlenW (lpString=".vhd") returned 4 [0041.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".vhd") returned 0x0 [0041.098] lstrlenW (lpString=".vhdx") returned 5 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".vhdx") returned 0x0 [0041.099] lstrlenW (lpString=".pst") returned 4 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".pst") returned 0x0 [0041.099] lstrlenW (lpString=".ost") returned 4 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".ost") returned 0x0 [0041.099] lstrlenW (lpString=".bak") returned 4 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".bak") returned 0x0 [0041.099] lstrlenW (lpString=".bac") returned 4 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".bac") returned 0x0 [0041.099] lstrlenW (lpString=".sys") returned 4 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".sys") returned 0x0 [0041.099] lstrlenW (lpString=".v2i") returned 4 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch=".v2i") returned 0x0 [0041.099] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9590 | out: hHeap=0x260000) returned 1 [0041.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.100] RtlWakeConditionVariable () returned 0x27e828 [0041.100] GetCurrentThreadId () returned 0x99c [0041.100] GetCurrentThreadId () returned 0x99c [0041.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9628 | out: hHeap=0x260000) returned 1 [0041.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338230 | out: hHeap=0x260000) returned 1 [0041.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9628 [0041.100] lstrlenW (lpString=".ldf") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".ldf") returned 0x0 [0041.100] lstrlenW (lpString=".vhd") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".vhd") returned 0x0 [0041.100] lstrlenW (lpString=".vhdx") returned 5 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".vhdx") returned 0x0 [0041.100] lstrlenW (lpString=".pst") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".pst") returned 0x0 [0041.100] lstrlenW (lpString=".ost") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".ost") returned 0x0 [0041.100] lstrlenW (lpString=".bak") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".bak") returned 0x0 [0041.100] lstrlenW (lpString=".bac") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".bac") returned 0x0 [0041.100] lstrlenW (lpString=".sys") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".sys") returned 0x0 [0041.100] lstrlenW (lpString=".v2i") returned 4 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch=".v2i") returned 0x0 [0041.100] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9628 | out: hHeap=0x260000) returned 1 [0041.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.101] RtlWakeConditionVariable () returned 0x27e828 [0041.101] GetCurrentThreadId () returned 0x99c [0041.101] GetCurrentThreadId () returned 0x99c [0041.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f96c0 | out: hHeap=0x260000) returned 1 [0041.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338268 | out: hHeap=0x260000) returned 1 [0041.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f96c0 [0041.101] lstrlenW (lpString=".ldf") returned 4 [0041.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".ldf") returned 0x0 [0041.101] lstrlenW (lpString=".vhd") returned 4 [0041.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".vhd") returned 0x0 [0041.101] lstrlenW (lpString=".vhdx") returned 5 [0041.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".vhdx") returned 0x0 [0041.101] lstrlenW (lpString=".pst") returned 4 [0041.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".pst") returned 0x0 [0041.102] lstrlenW (lpString=".ost") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".ost") returned 0x0 [0041.102] lstrlenW (lpString=".bak") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".bak") returned 0x0 [0041.102] lstrlenW (lpString=".bac") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".bac") returned 0x0 [0041.102] lstrlenW (lpString=".sys") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".sys") returned 0x0 [0041.102] lstrlenW (lpString=".v2i") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch=".v2i") returned 0x0 [0041.102] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f96c0 | out: hHeap=0x260000) returned 1 [0041.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.102] RtlWakeConditionVariable () returned 0x27e828 [0041.102] GetCurrentThreadId () returned 0x99c [0041.102] GetCurrentThreadId () returned 0x99c [0041.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9758 | out: hHeap=0x260000) returned 1 [0041.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382a0 | out: hHeap=0x260000) returned 1 [0041.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9758 [0041.102] lstrlenW (lpString=".ldf") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".ldf") returned 0x0 [0041.102] lstrlenW (lpString=".vhd") returned 4 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".vhd") returned 0x0 [0041.102] lstrlenW (lpString=".vhdx") returned 5 [0041.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".vhdx") returned 0x0 [0041.103] lstrlenW (lpString=".pst") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".pst") returned 0x0 [0041.103] lstrlenW (lpString=".ost") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".ost") returned 0x0 [0041.103] lstrlenW (lpString=".bak") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".bak") returned 0x0 [0041.103] lstrlenW (lpString=".bac") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".bac") returned 0x0 [0041.103] lstrlenW (lpString=".sys") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".sys") returned 0x0 [0041.103] lstrlenW (lpString=".v2i") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch=".v2i") returned 0x0 [0041.103] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9758 | out: hHeap=0x260000) returned 1 [0041.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.103] RtlWakeConditionVariable () returned 0x27e828 [0041.103] GetCurrentThreadId () returned 0x99c [0041.103] GetCurrentThreadId () returned 0x99c [0041.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f97f0 | out: hHeap=0x260000) returned 1 [0041.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efcf0 | out: hHeap=0x260000) returned 1 [0041.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f97f0 [0041.103] lstrlenW (lpString=".ldf") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".ldf") returned 0x0 [0041.103] lstrlenW (lpString=".vhd") returned 4 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".vhd") returned 0x0 [0041.103] lstrlenW (lpString=".vhdx") returned 5 [0041.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".vhdx") returned 0x0 [0041.104] lstrlenW (lpString=".pst") returned 4 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".pst") returned 0x0 [0041.104] lstrlenW (lpString=".ost") returned 4 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".ost") returned 0x0 [0041.104] lstrlenW (lpString=".bak") returned 4 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".bak") returned 0x0 [0041.104] lstrlenW (lpString=".bac") returned 4 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".bac") returned 0x0 [0041.104] lstrlenW (lpString=".sys") returned 4 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".sys") returned 0x0 [0041.104] lstrlenW (lpString=".v2i") returned 4 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch=".v2i") returned 0x0 [0041.104] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f97f0 | out: hHeap=0x260000) returned 1 [0041.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.105] RtlWakeConditionVariable () returned 0x27e828 [0041.105] GetCurrentThreadId () returned 0x99c [0041.105] GetCurrentThreadId () returned 0x99c [0041.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9888 | out: hHeap=0x260000) returned 1 [0041.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd60 | out: hHeap=0x260000) returned 1 [0041.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9888 [0041.105] lstrlenW (lpString=".ldf") returned 4 [0041.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".ldf") returned 0x0 [0041.105] lstrlenW (lpString=".vhd") returned 4 [0041.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".vhd") returned 0x0 [0041.105] lstrlenW (lpString=".vhdx") returned 5 [0041.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".vhdx") returned 0x0 [0041.105] lstrlenW (lpString=".pst") returned 4 [0041.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".pst") returned 0x0 [0041.105] lstrlenW (lpString=".ost") returned 4 [0041.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".ost") returned 0x0 [0041.105] lstrlenW (lpString=".bak") returned 4 [0041.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".bak") returned 0x0 [0041.105] lstrlenW (lpString=".bac") returned 4 [0041.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".bac") returned 0x0 [0041.106] lstrlenW (lpString=".sys") returned 4 [0041.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".sys") returned 0x0 [0041.106] lstrlenW (lpString=".v2i") returned 4 [0041.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch=".v2i") returned 0x0 [0041.106] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9888 | out: hHeap=0x260000) returned 1 [0041.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.106] RtlWakeConditionVariable () returned 0x27e828 [0041.106] GetCurrentThreadId () returned 0x99c [0041.118] GetCurrentThreadId () returned 0x99c [0041.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c18 | out: hHeap=0x260000) returned 1 [0041.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efeb0 | out: hHeap=0x260000) returned 1 [0041.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9c18 [0041.118] lstrlenW (lpString=".ldf") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".ldf") returned 0x0 [0041.118] lstrlenW (lpString=".vhd") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".vhd") returned 0x0 [0041.118] lstrlenW (lpString=".vhdx") returned 5 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".vhdx") returned 0x0 [0041.118] lstrlenW (lpString=".pst") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".pst") returned 0x0 [0041.118] lstrlenW (lpString=".ost") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".ost") returned 0x0 [0041.118] lstrlenW (lpString=".bak") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".bak") returned 0x0 [0041.118] lstrlenW (lpString=".bac") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".bac") returned 0x0 [0041.118] lstrlenW (lpString=".sys") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".sys") returned 0x0 [0041.118] lstrlenW (lpString=".v2i") returned 4 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch=".v2i") returned 0x0 [0041.118] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c18 | out: hHeap=0x260000) returned 1 [0041.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.129] RtlWakeConditionVariable () returned 0x27e828 [0041.129] GetCurrentThreadId () returned 0x99c [0041.129] GetCurrentThreadId () returned 0x99c [0041.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9e78 | out: hHeap=0x260000) returned 1 [0041.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff90 | out: hHeap=0x260000) returned 1 [0041.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9e78 [0041.129] lstrlenW (lpString=".ldf") returned 4 [0041.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".ldf") returned 0x0 [0041.129] lstrlenW (lpString=".vhd") returned 4 [0041.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".vhd") returned 0x0 [0041.129] lstrlenW (lpString=".vhdx") returned 5 [0041.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".vhdx") returned 0x0 [0041.129] lstrlenW (lpString=".pst") returned 4 [0041.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".pst") returned 0x0 [0041.130] lstrlenW (lpString=".ost") returned 4 [0041.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".ost") returned 0x0 [0041.130] lstrlenW (lpString=".bak") returned 4 [0041.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".bak") returned 0x0 [0041.130] lstrlenW (lpString=".bac") returned 4 [0041.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".bac") returned 0x0 [0041.130] lstrlenW (lpString=".sys") returned 4 [0041.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".sys") returned 0x0 [0041.130] lstrlenW (lpString=".v2i") returned 4 [0041.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch=".v2i") returned 0x0 [0041.130] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9e78 | out: hHeap=0x260000) returned 1 [0041.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.144] RtlWakeConditionVariable () returned 0x27e828 [0041.144] GetCurrentThreadId () returned 0x99c [0041.144] GetCurrentThreadId () returned 0x99c [0041.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3768 | out: hHeap=0x260000) returned 1 [0041.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0150 | out: hHeap=0x260000) returned 1 [0041.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3768 [0041.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.150] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.150] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.150] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.150] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.151] CloseHandle (hObject=0x100) returned 1 [0041.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3768 | out: hHeap=0x260000) returned 1 [0041.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.151] RtlWakeConditionVariable () returned 0x27e828 [0041.151] GetCurrentThreadId () returned 0x99c [0041.151] GetCurrentThreadId () returned 0x99c [0041.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9fa8 | out: hHeap=0x260000) returned 1 [0041.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01f8 | out: hHeap=0x260000) returned 1 [0041.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9fa8 [0041.151] lstrlenW (lpString=".ldf") returned 4 [0041.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".ldf") returned 0x0 [0041.151] lstrlenW (lpString=".vhd") returned 4 [0041.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".vhd") returned 0x0 [0041.151] lstrlenW (lpString=".vhdx") returned 5 [0041.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".vhdx") returned 0x0 [0041.151] lstrlenW (lpString=".pst") returned 4 [0041.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".pst") returned 0x0 [0041.152] lstrlenW (lpString=".ost") returned 4 [0041.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".ost") returned 0x0 [0041.152] lstrlenW (lpString=".bak") returned 4 [0041.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".bak") returned 0x0 [0041.152] lstrlenW (lpString=".bac") returned 4 [0041.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".bac") returned 0x0 [0041.152] lstrlenW (lpString=".sys") returned 4 [0041.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".sys") returned 0x0 [0041.152] lstrlenW (lpString=".v2i") returned 4 [0041.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch=".v2i") returned 0x0 [0041.152] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9fa8 | out: hHeap=0x260000) returned 1 [0041.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.153] RtlWakeConditionVariable () returned 0x27e828 [0041.153] GetCurrentThreadId () returned 0x99c [0041.153] GetCurrentThreadId () returned 0x99c [0041.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dce8 | out: hHeap=0x260000) returned 1 [0041.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0230 | out: hHeap=0x260000) returned 1 [0041.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dce8 [0041.153] lstrlenW (lpString=".ldf") returned 4 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".ldf") returned 0x0 [0041.153] lstrlenW (lpString=".vhd") returned 4 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".vhd") returned 0x0 [0041.153] lstrlenW (lpString=".vhdx") returned 5 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".vhdx") returned 0x0 [0041.153] lstrlenW (lpString=".pst") returned 4 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".pst") returned 0x0 [0041.153] lstrlenW (lpString=".ost") returned 4 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".ost") returned 0x0 [0041.153] lstrlenW (lpString=".bak") returned 4 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".bak") returned 0x0 [0041.153] lstrlenW (lpString=".bac") returned 4 [0041.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".bac") returned 0x0 [0041.153] lstrlenW (lpString=".sys") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".sys") returned 0x0 [0041.154] lstrlenW (lpString=".v2i") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch=".v2i") returned 0x0 [0041.154] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dce8 | out: hHeap=0x260000) returned 1 [0041.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.154] RtlWakeConditionVariable () returned 0x27e828 [0041.154] GetCurrentThreadId () returned 0x99c [0041.154] GetCurrentThreadId () returned 0x99c [0041.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x2b3f18 [0041.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0041.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0268 | out: hHeap=0x260000) returned 1 [0041.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x27e0f0 [0041.154] lstrlenW (lpString=".ldf") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".ldf") returned 0x0 [0041.154] lstrlenW (lpString=".vhd") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".vhd") returned 0x0 [0041.154] lstrlenW (lpString=".vhdx") returned 5 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".vhdx") returned 0x0 [0041.154] lstrlenW (lpString=".pst") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".pst") returned 0x0 [0041.154] lstrlenW (lpString=".ost") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".ost") returned 0x0 [0041.154] lstrlenW (lpString=".bak") returned 4 [0041.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".bak") returned 0x0 [0041.154] lstrlenW (lpString=".bac") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".bac") returned 0x0 [0041.155] lstrlenW (lpString=".sys") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".sys") returned 0x0 [0041.155] lstrlenW (lpString=".v2i") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch=".v2i") returned 0x0 [0041.155] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", lpSrch="s\r\n.v2i") returned 0x0 [0041.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0041.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f18 | out: hHeap=0x260000) returned 1 [0041.155] RtlWakeConditionVariable () returned 0x27e828 [0041.155] GetCurrentThreadId () returned 0x99c [0041.155] GetCurrentThreadId () returned 0x99c [0041.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa040 | out: hHeap=0x260000) returned 1 [0041.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02a0 | out: hHeap=0x260000) returned 1 [0041.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa040 [0041.155] lstrlenW (lpString=".ldf") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".ldf") returned 0x0 [0041.155] lstrlenW (lpString=".vhd") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".vhd") returned 0x0 [0041.155] lstrlenW (lpString=".vhdx") returned 5 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".vhdx") returned 0x0 [0041.155] lstrlenW (lpString=".pst") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".pst") returned 0x0 [0041.155] lstrlenW (lpString=".ost") returned 4 [0041.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".ost") returned 0x0 [0041.155] lstrlenW (lpString=".bak") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".bak") returned 0x0 [0041.156] lstrlenW (lpString=".bac") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".bac") returned 0x0 [0041.156] lstrlenW (lpString=".sys") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".sys") returned 0x0 [0041.156] lstrlenW (lpString=".v2i") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch=".v2i") returned 0x0 [0041.156] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa040 | out: hHeap=0x260000) returned 1 [0041.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.156] RtlWakeConditionVariable () returned 0x27e828 [0041.156] GetCurrentThreadId () returned 0x99c [0041.156] GetCurrentThreadId () returned 0x99c [0041.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa0d8 | out: hHeap=0x260000) returned 1 [0041.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02d8 | out: hHeap=0x260000) returned 1 [0041.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa0d8 [0041.156] lstrlenW (lpString=".ldf") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".ldf") returned 0x0 [0041.156] lstrlenW (lpString=".vhd") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".vhd") returned 0x0 [0041.156] lstrlenW (lpString=".vhdx") returned 5 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".vhdx") returned 0x0 [0041.156] lstrlenW (lpString=".pst") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".pst") returned 0x0 [0041.156] lstrlenW (lpString=".ost") returned 4 [0041.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".ost") returned 0x0 [0041.157] lstrlenW (lpString=".bak") returned 4 [0041.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".bak") returned 0x0 [0041.157] lstrlenW (lpString=".bac") returned 4 [0041.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".bac") returned 0x0 [0041.157] lstrlenW (lpString=".sys") returned 4 [0041.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".sys") returned 0x0 [0041.157] lstrlenW (lpString=".v2i") returned 4 [0041.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch=".v2i") returned 0x0 [0041.157] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa0d8 | out: hHeap=0x260000) returned 1 [0041.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.157] RtlWakeConditionVariable () returned 0x27e828 [0041.157] GetCurrentThreadId () returned 0x99c [0041.157] GetCurrentThreadId () returned 0x99c [0041.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa170 | out: hHeap=0x260000) returned 1 [0041.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0310 | out: hHeap=0x260000) returned 1 [0041.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa170 [0041.158] lstrlenW (lpString=".ldf") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".ldf") returned 0x0 [0041.158] lstrlenW (lpString=".vhd") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".vhd") returned 0x0 [0041.158] lstrlenW (lpString=".vhdx") returned 5 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".vhdx") returned 0x0 [0041.158] lstrlenW (lpString=".pst") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".pst") returned 0x0 [0041.158] lstrlenW (lpString=".ost") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".ost") returned 0x0 [0041.158] lstrlenW (lpString=".bak") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".bak") returned 0x0 [0041.158] lstrlenW (lpString=".bac") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".bac") returned 0x0 [0041.158] lstrlenW (lpString=".sys") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".sys") returned 0x0 [0041.158] lstrlenW (lpString=".v2i") returned 4 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch=".v2i") returned 0x0 [0041.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa170 | out: hHeap=0x260000) returned 1 [0041.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.158] RtlWakeConditionVariable () returned 0x27e828 [0041.158] GetCurrentThreadId () returned 0x99c [0041.158] GetCurrentThreadId () returned 0x99c [0041.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dd90 | out: hHeap=0x260000) returned 1 [0041.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0348 | out: hHeap=0x260000) returned 1 [0041.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dd90 [0041.159] lstrlenW (lpString=".ldf") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.159] lstrlenW (lpString=".vhd") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.159] lstrlenW (lpString=".vhdx") returned 5 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.159] lstrlenW (lpString=".pst") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.159] lstrlenW (lpString=".ost") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.159] lstrlenW (lpString=".bak") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.159] lstrlenW (lpString=".bac") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.159] lstrlenW (lpString=".sys") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.159] lstrlenW (lpString=".v2i") returned 4 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.159] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dd90 | out: hHeap=0x260000) returned 1 [0041.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.159] RtlWakeConditionVariable () returned 0x27e828 [0041.159] GetCurrentThreadId () returned 0x99c [0041.160] GetCurrentThreadId () returned 0x99c [0041.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f38d8 | out: hHeap=0x260000) returned 1 [0041.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0380 | out: hHeap=0x260000) returned 1 [0041.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f38d8 [0041.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.161] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.161] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.161] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.161] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.162] CloseHandle (hObject=0x100) returned 1 [0041.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f38d8 | out: hHeap=0x260000) returned 1 [0041.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.162] RtlWakeConditionVariable () returned 0x27e828 [0041.162] GetCurrentThreadId () returned 0x99c [0041.162] GetCurrentThreadId () returned 0x99c [0041.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de38 | out: hHeap=0x260000) returned 1 [0041.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03b8 | out: hHeap=0x260000) returned 1 [0041.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30de38 [0041.162] lstrlenW (lpString=".ldf") returned 4 [0041.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.162] lstrlenW (lpString=".vhd") returned 4 [0041.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.162] lstrlenW (lpString=".vhdx") returned 5 [0041.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.162] lstrlenW (lpString=".pst") returned 4 [0041.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.162] lstrlenW (lpString=".ost") returned 4 [0041.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.163] lstrlenW (lpString=".bak") returned 4 [0041.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.163] lstrlenW (lpString=".bac") returned 4 [0041.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.163] lstrlenW (lpString=".sys") returned 4 [0041.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.163] lstrlenW (lpString=".v2i") returned 4 [0041.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.163] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30de38 | out: hHeap=0x260000) returned 1 [0041.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.163] RtlWakeConditionVariable () returned 0x27e828 [0041.163] GetCurrentThreadId () returned 0x99c [0041.163] GetCurrentThreadId () returned 0x99c [0041.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3990 | out: hHeap=0x260000) returned 1 [0041.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03f0 | out: hHeap=0x260000) returned 1 [0041.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3990 [0041.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.164] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.164] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.164] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.164] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.165] CloseHandle (hObject=0x100) returned 1 [0041.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3990 | out: hHeap=0x260000) returned 1 [0041.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.165] RtlWakeConditionVariable () returned 0x27e828 [0041.165] GetCurrentThreadId () returned 0x99c [0041.165] GetCurrentThreadId () returned 0x99c [0041.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0041.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0fb8 | out: hHeap=0x260000) returned 1 [0041.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0041.165] lstrlenW (lpString=".ldf") returned 4 [0041.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.165] lstrlenW (lpString=".vhd") returned 4 [0041.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.165] lstrlenW (lpString=".vhdx") returned 5 [0041.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.165] lstrlenW (lpString=".pst") returned 4 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.166] lstrlenW (lpString=".ost") returned 4 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.166] lstrlenW (lpString=".bak") returned 4 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.166] lstrlenW (lpString=".bac") returned 4 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.166] lstrlenW (lpString=".sys") returned 4 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.166] lstrlenW (lpString=".v2i") returned 4 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.166] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0041.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.167] RtlWakeConditionVariable () returned 0x27e828 [0041.167] GetCurrentThreadId () returned 0x99c [0041.167] GetCurrentThreadId () returned 0x99c [0041.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b1d8 | out: hHeap=0x260000) returned 1 [0041.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f80 | out: hHeap=0x260000) returned 1 [0041.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b1d8 [0041.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.167] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.167] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.167] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.167] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.168] CloseHandle (hObject=0x100) returned 1 [0041.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b1d8 | out: hHeap=0x260000) returned 1 [0041.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.169] RtlWakeConditionVariable () returned 0x27e828 [0041.169] GetCurrentThreadId () returned 0x99c [0041.169] GetCurrentThreadId () returned 0x99c [0041.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e0d8 | out: hHeap=0x260000) returned 1 [0041.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f48 | out: hHeap=0x260000) returned 1 [0041.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e0d8 [0041.169] lstrlenW (lpString=".ldf") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.169] lstrlenW (lpString=".vhd") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.169] lstrlenW (lpString=".vhdx") returned 5 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.169] lstrlenW (lpString=".pst") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.169] lstrlenW (lpString=".ost") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.169] lstrlenW (lpString=".bak") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.169] lstrlenW (lpString=".bac") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.169] lstrlenW (lpString=".sys") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.169] lstrlenW (lpString=".v2i") returned 4 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.169] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e0d8 | out: hHeap=0x260000) returned 1 [0041.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.170] RtlWakeConditionVariable () returned 0x27e828 [0041.170] GetCurrentThreadId () returned 0x99c [0041.170] GetCurrentThreadId () returned 0x99c [0041.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b290 | out: hHeap=0x260000) returned 1 [0041.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f10 | out: hHeap=0x260000) returned 1 [0041.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b290 [0041.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.171] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.171] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.171] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.171] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.172] CloseHandle (hObject=0x100) returned 1 [0041.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b290 | out: hHeap=0x260000) returned 1 [0041.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.172] RtlWakeConditionVariable () returned 0x27e828 [0041.172] GetCurrentThreadId () returned 0x99c [0041.172] GetCurrentThreadId () returned 0x99c [0041.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e180 | out: hHeap=0x260000) returned 1 [0041.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ed8 | out: hHeap=0x260000) returned 1 [0041.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e180 [0041.172] lstrlenW (lpString=".ldf") returned 4 [0041.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.172] lstrlenW (lpString=".vhd") returned 4 [0041.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.172] lstrlenW (lpString=".vhdx") returned 5 [0041.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.172] lstrlenW (lpString=".pst") returned 4 [0041.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.172] lstrlenW (lpString=".ost") returned 4 [0041.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.173] lstrlenW (lpString=".bak") returned 4 [0041.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.173] lstrlenW (lpString=".bac") returned 4 [0041.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.173] lstrlenW (lpString=".sys") returned 4 [0041.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.173] lstrlenW (lpString=".v2i") returned 4 [0041.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.173] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e180 | out: hHeap=0x260000) returned 1 [0041.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.173] RtlWakeConditionVariable () returned 0x27e828 [0041.173] GetCurrentThreadId () returned 0x99c [0041.173] GetCurrentThreadId () returned 0x99c [0041.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f31a8 | out: hHeap=0x260000) returned 1 [0041.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0428 | out: hHeap=0x260000) returned 1 [0041.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0041.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.174] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.174] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.174] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.174] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.175] CloseHandle (hObject=0x100) returned 1 [0041.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f31a8 | out: hHeap=0x260000) returned 1 [0041.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.175] RtlWakeConditionVariable () returned 0x27e828 [0041.175] GetCurrentThreadId () returned 0x99c [0041.175] GetCurrentThreadId () returned 0x99c [0041.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e228 | out: hHeap=0x260000) returned 1 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.176] lstrlenW (lpString=".vhd") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.176] lstrlenW (lpString=".vhdx") returned 5 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.176] lstrlenW (lpString=".pst") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.176] lstrlenW (lpString=".ost") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.176] lstrlenW (lpString=".bak") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.176] lstrlenW (lpString=".bac") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.176] lstrlenW (lpString=".sys") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.176] lstrlenW (lpString=".v2i") returned 4 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.176] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.176] RtlWakeConditionVariable () returned 0x27e828 [0041.176] GetCurrentThreadId () returned 0x99c [0041.176] GetCurrentThreadId () returned 0x99c [0041.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.177] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.177] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.177] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.177] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.178] CloseHandle (hObject=0x100) returned 1 [0041.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3a48 | out: hHeap=0x260000) returned 1 [0041.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.178] RtlWakeConditionVariable () returned 0x27e828 [0041.178] GetCurrentThreadId () returned 0x99c [0041.178] GetCurrentThreadId () returned 0x99c [0041.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9a50 [0041.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2961d0 | out: hHeap=0x260000) returned 1 [0041.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cae8 | out: hHeap=0x260000) returned 1 [0041.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2961d0 [0041.178] lstrlenW (lpString=".ldf") returned 4 [0041.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".ldf") returned 0x0 [0041.178] lstrlenW (lpString=".vhd") returned 4 [0041.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".vhd") returned 0x0 [0041.178] lstrlenW (lpString=".vhdx") returned 5 [0041.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".vhdx") returned 0x0 [0041.178] lstrlenW (lpString=".pst") returned 4 [0041.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".pst") returned 0x0 [0041.178] lstrlenW (lpString=".ost") returned 4 [0041.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".ost") returned 0x0 [0041.178] lstrlenW (lpString=".bak") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".bak") returned 0x0 [0041.179] lstrlenW (lpString=".bac") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".bac") returned 0x0 [0041.179] lstrlenW (lpString=".sys") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".sys") returned 0x0 [0041.179] lstrlenW (lpString=".v2i") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch=".v2i") returned 0x0 [0041.179] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2961d0 | out: hHeap=0x260000) returned 1 [0041.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a50 | out: hHeap=0x260000) returned 1 [0041.179] RtlWakeConditionVariable () returned 0x27e828 [0041.179] GetCurrentThreadId () returned 0x99c [0041.179] GetCurrentThreadId () returned 0x99c [0041.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb20 | out: hHeap=0x260000) returned 1 [0041.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.179] lstrlenW (lpString=".ldf") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.179] lstrlenW (lpString=".vhd") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.179] lstrlenW (lpString=".vhdx") returned 5 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.179] lstrlenW (lpString=".pst") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.179] lstrlenW (lpString=".ost") returned 4 [0041.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.180] lstrlenW (lpString=".bak") returned 4 [0041.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.180] lstrlenW (lpString=".bac") returned 4 [0041.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.180] lstrlenW (lpString=".sys") returned 4 [0041.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.180] lstrlenW (lpString=".v2i") returned 4 [0041.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.180] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.251] RtlWakeConditionVariable () returned 0x27e828 [0041.251] GetCurrentThreadId () returned 0x99c [0041.251] GetCurrentThreadId () returned 0x99c [0041.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0041.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce30 | out: hHeap=0x260000) returned 1 [0041.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0041.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.306] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.306] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.306] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.306] WriteFile (in: hFile=0xfc, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.307] CloseHandle (hObject=0xfc) returned 1 [0041.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0041.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.307] RtlWakeConditionVariable () returned 0x27e828 [0041.307] GetCurrentThreadId () returned 0x99c [0041.307] GetCurrentThreadId () returned 0x99c [0041.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e570 | out: hHeap=0x260000) returned 1 [0041.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cfb8 | out: hHeap=0x260000) returned 1 [0041.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e570 [0041.307] lstrlenW (lpString=".ldf") returned 4 [0041.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".ldf") returned 0x0 [0041.307] lstrlenW (lpString=".vhd") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".vhd") returned 0x0 [0041.308] lstrlenW (lpString=".vhdx") returned 5 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".vhdx") returned 0x0 [0041.308] lstrlenW (lpString=".pst") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".pst") returned 0x0 [0041.308] lstrlenW (lpString=".ost") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".ost") returned 0x0 [0041.308] lstrlenW (lpString=".bak") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".bak") returned 0x0 [0041.308] lstrlenW (lpString=".bac") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".bac") returned 0x0 [0041.308] lstrlenW (lpString=".sys") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".sys") returned 0x0 [0041.308] lstrlenW (lpString=".v2i") returned 4 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".v2i") returned 0x0 [0041.308] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0041.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.309] lstrlenW (lpString=".sql") returned 4 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".sql") returned 0x0 [0041.309] lstrlenW (lpString=".mdf") returned 4 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".mdf") returned 0x0 [0041.309] lstrlenW (lpString=".txt") returned 4 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".txt") returned 0x0 [0041.309] lstrlenW (lpString=".dbf") returned 4 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".dbf") returned 0x0 [0041.309] lstrlenW (lpString=".ckp") returned 4 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".ckp") returned 0x0 [0041.309] lstrlenW (lpString=".dacpac") returned 7 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".dacpac") returned 0x0 [0041.309] lstrlenW (lpString=".db3") returned 4 [0041.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".db3") returned 0x0 [0041.309] lstrlenW (lpString=".dtxs") returned 5 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".dtxs") returned 0x0 [0041.310] lstrlenW (lpString=".mdt") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".mdt") returned 0x0 [0041.310] lstrlenW (lpString=".sdf") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".sdf") returned 0x0 [0041.310] lstrlenW (lpString=".MDF") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".MDF") returned 0x0 [0041.310] lstrlenW (lpString=".DBF") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".DBF") returned 0x0 [0041.310] lstrlenW (lpString=".DB") returned 3 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".DB") returned 0x0 [0041.310] lstrlenW (lpString=".db") returned 3 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".db") returned 0x0 [0041.310] lstrlenW (lpString=".ndf") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".ndf") returned 0x0 [0041.310] lstrlenW (lpString=".NDF") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".NDF") returned 0x0 [0041.310] lstrlenW (lpString=".Mdf") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".Mdf") returned 0x0 [0041.310] lstrlenW (lpString=".dat") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".dat") returned 0x0 [0041.310] lstrlenW (lpString=".DAT") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".DAT") returned 0x0 [0041.310] lstrlenW (lpString=".ldf") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".ldf") returned 0x0 [0041.310] lstrlenW (lpString=".LDF") returned 4 [0041.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch=".LDF") returned 0x0 [0041.310] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.311] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.312] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.312] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.312] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16131293390) returned 1 [0041.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7706490, dwHighDateTime=0x1d585b4)) [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cfb8 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cfb8 | out: hHeap=0x260000) returned 1 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e228 [0041.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e228 | out: hHeap=0x260000) returned 1 [0041.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.313] GetLastError () returned 0x0 [0041.313] GetLastError () returned 0x0 [0041.313] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.313] GetLastError () returned 0x0 [0041.313] GetLastError () returned 0x0 [0041.313] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.327] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.327] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.327] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.327] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.340] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.340] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.340] CloseHandle (hObject=0xfc) returned 1 [0041.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.[deadmin@cock.li].deadmin")) returned 1 [0041.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.342] GetLastError () returned 0x0 [0041.342] RtlWakeConditionVariable () returned 0x27e828 [0041.342] GetCurrentThreadId () returned 0x99c [0041.342] GetCurrentThreadId () returned 0x99c [0041.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310af8 | out: hHeap=0x260000) returned 1 [0041.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0041.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x310af8 [0041.342] lstrlenW (lpString=".ldf") returned 4 [0041.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0041.342] lstrlenW (lpString=".vhd") returned 4 [0041.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0041.342] lstrlenW (lpString=".vhdx") returned 5 [0041.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0041.342] lstrlenW (lpString=".pst") returned 4 [0041.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0041.342] lstrlenW (lpString=".ost") returned 4 [0041.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0041.343] lstrlenW (lpString=".bak") returned 4 [0041.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0041.343] lstrlenW (lpString=".bac") returned 4 [0041.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0041.343] lstrlenW (lpString=".sys") returned 4 [0041.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0041.343] lstrlenW (lpString=".v2i") returned 4 [0041.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0041.343] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.343] lstrlenW (lpString=".sql") returned 4 [0041.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0041.344] lstrlenW (lpString=".mdf") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0041.344] lstrlenW (lpString=".txt") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0041.344] lstrlenW (lpString=".dbf") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0041.344] lstrlenW (lpString=".ckp") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0041.344] lstrlenW (lpString=".dacpac") returned 7 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0041.344] lstrlenW (lpString=".db3") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0041.344] lstrlenW (lpString=".dtxs") returned 5 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0041.344] lstrlenW (lpString=".mdt") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0041.344] lstrlenW (lpString=".sdf") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0041.344] lstrlenW (lpString=".MDF") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0041.344] lstrlenW (lpString=".DBF") returned 4 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0041.344] lstrlenW (lpString=".DB") returned 3 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0041.344] lstrlenW (lpString=".db") returned 3 [0041.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0041.344] lstrlenW (lpString=".ndf") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0041.345] lstrlenW (lpString=".NDF") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0041.345] lstrlenW (lpString=".Mdf") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0041.345] lstrlenW (lpString=".dat") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0041.345] lstrlenW (lpString=".DAT") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0041.345] lstrlenW (lpString=".ldf") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0041.345] lstrlenW (lpString=".LDF") returned 4 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0041.345] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.345] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.346] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0041.346] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16134745046) returned 1 [0041.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7752750, dwHighDateTime=0x1d585b4)) [0041.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d060 [0041.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0041.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.347] GetLastError () returned 0x0 [0041.347] GetLastError () returned 0x0 [0041.347] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.347] GetLastError () returned 0x0 [0041.347] GetLastError () returned 0x0 [0041.347] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0xd980, lpOverlapped=0x0) returned 1 [0041.350] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff2680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.350] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xd980, lpOverlapped=0x0) returned 1 [0041.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.350] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.350] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.350] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.350] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.350] CloseHandle (hObject=0xfc) returned 1 [0041.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0041.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0041.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0041.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.351] GetLastError () returned 0x0 [0041.352] RtlWakeConditionVariable () returned 0x27e828 [0041.352] GetCurrentThreadId () returned 0x99c [0041.352] GetCurrentThreadId () returned 0x99c [0041.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310bb0 | out: hHeap=0x260000) returned 1 [0041.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d098 | out: hHeap=0x260000) returned 1 [0041.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3d28 [0041.352] lstrlenW (lpString=".ldf") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0041.352] lstrlenW (lpString=".vhd") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".vhd") returned 0x0 [0041.352] lstrlenW (lpString=".vhdx") returned 5 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0041.352] lstrlenW (lpString=".pst") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".pst") returned 0x0 [0041.352] lstrlenW (lpString=".ost") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".ost") returned 0x0 [0041.352] lstrlenW (lpString=".bak") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".bak") returned 0x0 [0041.352] lstrlenW (lpString=".bac") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".bac") returned 0x0 [0041.352] lstrlenW (lpString=".sys") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".sys") returned 0x0 [0041.352] lstrlenW (lpString=".v2i") returned 4 [0041.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".v2i") returned 0x0 [0041.353] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.353] lstrlenW (lpString=".sql") returned 4 [0041.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".sql") returned 0x0 [0041.353] lstrlenW (lpString=".mdf") returned 4 [0041.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".mdf") returned 0x0 [0041.353] lstrlenW (lpString=".txt") returned 4 [0041.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".txt") returned 0x0 [0041.353] lstrlenW (lpString=".dbf") returned 4 [0041.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".dbf") returned 0x0 [0041.353] lstrlenW (lpString=".ckp") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".ckp") returned 0x0 [0041.354] lstrlenW (lpString=".dacpac") returned 7 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0041.354] lstrlenW (lpString=".db3") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".db3") returned 0x0 [0041.354] lstrlenW (lpString=".dtxs") returned 5 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0041.354] lstrlenW (lpString=".mdt") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".mdt") returned 0x0 [0041.354] lstrlenW (lpString=".sdf") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".sdf") returned 0x0 [0041.354] lstrlenW (lpString=".MDF") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".MDF") returned 0x0 [0041.354] lstrlenW (lpString=".DBF") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".DBF") returned 0x0 [0041.354] lstrlenW (lpString=".DB") returned 3 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".DB") returned 0x0 [0041.354] lstrlenW (lpString=".db") returned 3 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".db") returned 0x0 [0041.354] lstrlenW (lpString=".ndf") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".ndf") returned 0x0 [0041.354] lstrlenW (lpString=".NDF") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".NDF") returned 0x0 [0041.354] lstrlenW (lpString=".Mdf") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0041.354] lstrlenW (lpString=".dat") returned 4 [0041.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".dat") returned 0x0 [0041.355] lstrlenW (lpString=".DAT") returned 4 [0041.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".DAT") returned 0x0 [0041.355] lstrlenW (lpString=".ldf") returned 4 [0041.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0041.355] lstrlenW (lpString=".LDF") returned 4 [0041.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch=".LDF") returned 0x0 [0041.355] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.355] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.356] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.356] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0041.356] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16135716627) returned 1 [0041.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa77788b0, dwHighDateTime=0x1d585b4)) [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d098 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d098 | out: hHeap=0x260000) returned 1 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.357] GetLastError () returned 0x0 [0041.357] GetLastError () returned 0x0 [0041.357] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.357] GetLastError () returned 0x0 [0041.357] GetLastError () returned 0x0 [0041.357] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.360] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.361] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.361] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.361] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.375] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.376] CloseHandle (hObject=0xfc) returned 1 [0041.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0041.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0041.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eddd8 | out: hHeap=0x260000) returned 1 [0041.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.446] GetLastError () returned 0x0 [0041.447] RtlWakeConditionVariable () returned 0x27e828 [0041.447] GetCurrentThreadId () returned 0x99c [0041.447] GetCurrentThreadId () returned 0x99c [0041.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296560 | out: hHeap=0x260000) returned 1 [0041.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d220 | out: hHeap=0x260000) returned 1 [0041.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296560 [0041.447] lstrlenW (lpString=".ldf") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".ldf") returned 0x0 [0041.447] lstrlenW (lpString=".vhd") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".vhd") returned 0x0 [0041.447] lstrlenW (lpString=".vhdx") returned 5 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".vhdx") returned 0x0 [0041.447] lstrlenW (lpString=".pst") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".pst") returned 0x0 [0041.447] lstrlenW (lpString=".ost") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".ost") returned 0x0 [0041.447] lstrlenW (lpString=".bak") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".bak") returned 0x0 [0041.447] lstrlenW (lpString=".bac") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".bac") returned 0x0 [0041.447] lstrlenW (lpString=".sys") returned 4 [0041.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".sys") returned 0x0 [0041.447] lstrlenW (lpString=".v2i") returned 4 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".v2i") returned 0x0 [0041.448] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.448] lstrlenW (lpString=".sql") returned 4 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".sql") returned 0x0 [0041.448] lstrlenW (lpString=".mdf") returned 4 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".mdf") returned 0x0 [0041.448] lstrlenW (lpString=".txt") returned 4 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".txt") returned 0x0 [0041.448] lstrlenW (lpString=".dbf") returned 4 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".dbf") returned 0x0 [0041.448] lstrlenW (lpString=".ckp") returned 4 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".ckp") returned 0x0 [0041.448] lstrlenW (lpString=".dacpac") returned 7 [0041.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".dacpac") returned 0x0 [0041.449] lstrlenW (lpString=".db3") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".db3") returned 0x0 [0041.449] lstrlenW (lpString=".dtxs") returned 5 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".dtxs") returned 0x0 [0041.449] lstrlenW (lpString=".mdt") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".mdt") returned 0x0 [0041.449] lstrlenW (lpString=".sdf") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".sdf") returned 0x0 [0041.449] lstrlenW (lpString=".MDF") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".MDF") returned 0x0 [0041.449] lstrlenW (lpString=".DBF") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".DBF") returned 0x0 [0041.449] lstrlenW (lpString=".DB") returned 3 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".DB") returned 0x0 [0041.449] lstrlenW (lpString=".db") returned 3 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".db") returned 0x0 [0041.449] lstrlenW (lpString=".ndf") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".ndf") returned 0x0 [0041.449] lstrlenW (lpString=".NDF") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".NDF") returned 0x0 [0041.449] lstrlenW (lpString=".Mdf") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".Mdf") returned 0x0 [0041.449] lstrlenW (lpString=".dat") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".dat") returned 0x0 [0041.449] lstrlenW (lpString=".DAT") returned 4 [0041.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".DAT") returned 0x0 [0041.450] lstrlenW (lpString=".ldf") returned 4 [0041.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".ldf") returned 0x0 [0041.450] lstrlenW (lpString=".LDF") returned 4 [0041.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch=".LDF") returned 0x0 [0041.450] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.450] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.451] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.451] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.451] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16145239000) returned 1 [0041.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa785d0f0, dwHighDateTime=0x1d585b4)) [0041.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d220 [0041.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d220 | out: hHeap=0x260000) returned 1 [0041.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0041.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296300 [0041.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.452] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.452] GetLastError () returned 0x0 [0041.452] GetLastError () returned 0x0 [0041.452] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.452] GetLastError () returned 0x0 [0041.452] GetLastError () returned 0x0 [0041.453] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.457] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.459] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.459] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.461] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.461] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.461] CloseHandle (hObject=0x100) returned 1 [0041.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0041.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.462] GetLastError () returned 0x0 [0041.462] RtlWakeConditionVariable () returned 0x27e828 [0041.462] GetCurrentThreadId () returned 0x99c [0041.462] GetCurrentThreadId () returned 0x99c [0041.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2964c8 | out: hHeap=0x260000) returned 1 [0041.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d258 | out: hHeap=0x260000) returned 1 [0041.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2964c8 [0041.462] lstrlenW (lpString=".ldf") returned 4 [0041.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".ldf") returned 0x0 [0041.462] lstrlenW (lpString=".vhd") returned 4 [0041.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".vhd") returned 0x0 [0041.462] lstrlenW (lpString=".vhdx") returned 5 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".vhdx") returned 0x0 [0041.463] lstrlenW (lpString=".pst") returned 4 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".pst") returned 0x0 [0041.463] lstrlenW (lpString=".ost") returned 4 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".ost") returned 0x0 [0041.463] lstrlenW (lpString=".bak") returned 4 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".bak") returned 0x0 [0041.463] lstrlenW (lpString=".bac") returned 4 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".bac") returned 0x0 [0041.463] lstrlenW (lpString=".sys") returned 4 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".sys") returned 0x0 [0041.463] lstrlenW (lpString=".v2i") returned 4 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".v2i") returned 0x0 [0041.463] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.464] lstrlenW (lpString=".sql") returned 4 [0041.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".sql") returned 0x0 [0041.464] lstrlenW (lpString=".mdf") returned 4 [0041.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".mdf") returned 0x0 [0041.464] lstrlenW (lpString=".txt") returned 4 [0041.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".txt") returned 0x0 [0041.464] lstrlenW (lpString=".dbf") returned 4 [0041.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".dbf") returned 0x0 [0041.465] lstrlenW (lpString=".ckp") returned 4 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".ckp") returned 0x0 [0041.465] lstrlenW (lpString=".dacpac") returned 7 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".dacpac") returned 0x0 [0041.465] lstrlenW (lpString=".db3") returned 4 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".db3") returned 0x0 [0041.465] lstrlenW (lpString=".dtxs") returned 5 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".dtxs") returned 0x0 [0041.465] lstrlenW (lpString=".mdt") returned 4 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".mdt") returned 0x0 [0041.465] lstrlenW (lpString=".sdf") returned 4 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".sdf") returned 0x0 [0041.465] lstrlenW (lpString=".MDF") returned 4 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".MDF") returned 0x0 [0041.465] lstrlenW (lpString=".DBF") returned 4 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".DBF") returned 0x0 [0041.465] lstrlenW (lpString=".DB") returned 3 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".DB") returned 0x0 [0041.465] lstrlenW (lpString=".db") returned 3 [0041.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".db") returned 0x0 [0041.465] lstrlenW (lpString=".ndf") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".ndf") returned 0x0 [0041.466] lstrlenW (lpString=".NDF") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".NDF") returned 0x0 [0041.466] lstrlenW (lpString=".Mdf") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".Mdf") returned 0x0 [0041.466] lstrlenW (lpString=".dat") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".dat") returned 0x0 [0041.466] lstrlenW (lpString=".DAT") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".DAT") returned 0x0 [0041.466] lstrlenW (lpString=".ldf") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".ldf") returned 0x0 [0041.466] lstrlenW (lpString=".LDF") returned 4 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch=".LDF") returned 0x0 [0041.466] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.466] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.467] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.467] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.467] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16146845379) returned 1 [0041.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7883250, dwHighDateTime=0x1d585b4)) [0041.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d258 [0041.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d258 | out: hHeap=0x260000) returned 1 [0041.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0041.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296560 [0041.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.468] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.468] GetLastError () returned 0x0 [0041.468] GetLastError () returned 0x0 [0041.468] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.468] GetLastError () returned 0x0 [0041.468] GetLastError () returned 0x0 [0041.469] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0xa990, lpOverlapped=0x0) returned 1 [0041.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff5670, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.472] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0xa990, lpOverlapped=0x0) returned 1 [0041.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.472] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.473] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.473] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.473] CloseHandle (hObject=0x100) returned 1 [0041.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0041.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.474] GetLastError () returned 0x0 [0041.474] RtlWakeConditionVariable () returned 0x27e828 [0041.474] GetCurrentThreadId () returned 0x99c [0041.474] GetCurrentThreadId () returned 0x99c [0041.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0041.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d290 | out: hHeap=0x260000) returned 1 [0041.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0041.474] lstrlenW (lpString=".ldf") returned 4 [0041.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".ldf") returned 0x0 [0041.474] lstrlenW (lpString=".vhd") returned 4 [0041.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".vhd") returned 0x0 [0041.474] lstrlenW (lpString=".vhdx") returned 5 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".vhdx") returned 0x0 [0041.475] lstrlenW (lpString=".pst") returned 4 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".pst") returned 0x0 [0041.475] lstrlenW (lpString=".ost") returned 4 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".ost") returned 0x0 [0041.475] lstrlenW (lpString=".bak") returned 4 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".bak") returned 0x0 [0041.475] lstrlenW (lpString=".bac") returned 4 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".bac") returned 0x0 [0041.475] lstrlenW (lpString=".sys") returned 4 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".sys") returned 0x0 [0041.475] lstrlenW (lpString=".v2i") returned 4 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".v2i") returned 0x0 [0041.475] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.476] lstrlenW (lpString=".sql") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".sql") returned 0x0 [0041.477] lstrlenW (lpString=".mdf") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".mdf") returned 0x0 [0041.477] lstrlenW (lpString=".txt") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".txt") returned 0x0 [0041.477] lstrlenW (lpString=".dbf") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".dbf") returned 0x0 [0041.477] lstrlenW (lpString=".ckp") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".ckp") returned 0x0 [0041.477] lstrlenW (lpString=".dacpac") returned 7 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".dacpac") returned 0x0 [0041.477] lstrlenW (lpString=".db3") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".db3") returned 0x0 [0041.477] lstrlenW (lpString=".dtxs") returned 5 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".dtxs") returned 0x0 [0041.477] lstrlenW (lpString=".mdt") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".mdt") returned 0x0 [0041.477] lstrlenW (lpString=".sdf") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".sdf") returned 0x0 [0041.477] lstrlenW (lpString=".MDF") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".MDF") returned 0x0 [0041.477] lstrlenW (lpString=".DBF") returned 4 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".DBF") returned 0x0 [0041.477] lstrlenW (lpString=".DB") returned 3 [0041.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".DB") returned 0x0 [0041.477] lstrlenW (lpString=".db") returned 3 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".db") returned 0x0 [0041.478] lstrlenW (lpString=".ndf") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".ndf") returned 0x0 [0041.478] lstrlenW (lpString=".NDF") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".NDF") returned 0x0 [0041.478] lstrlenW (lpString=".Mdf") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".Mdf") returned 0x0 [0041.478] lstrlenW (lpString=".dat") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".dat") returned 0x0 [0041.478] lstrlenW (lpString=".DAT") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".DAT") returned 0x0 [0041.478] lstrlenW (lpString=".ldf") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".ldf") returned 0x0 [0041.478] lstrlenW (lpString=".LDF") returned 4 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch=".LDF") returned 0x0 [0041.478] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.478] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.478] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.479] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.479] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.479] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16148049388) returned 1 [0041.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7883250, dwHighDateTime=0x1d585b4)) [0041.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d290 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d290 | out: hHeap=0x260000) returned 1 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0041.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa3d0 [0041.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.480] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.480] GetLastError () returned 0x0 [0041.480] GetLastError () returned 0x0 [0041.480] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.545] GetLastError () returned 0x0 [0041.545] GetLastError () returned 0x0 [0041.545] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.550] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.550] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.551] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.551] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.553] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.553] CloseHandle (hObject=0x100) returned 1 [0041.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.627] GetLastError () returned 0x0 [0041.627] RtlWakeConditionVariable () returned 0x27e828 [0041.627] GetCurrentThreadId () returned 0x99c [0041.627] GetCurrentThreadId () returned 0x99c [0041.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa7f8 | out: hHeap=0x260000) returned 1 [0041.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d358 | out: hHeap=0x260000) returned 1 [0041.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa760 [0041.640] lstrlenW (lpString=".ldf") returned 4 [0041.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".ldf") returned 0x0 [0041.652] lstrlenW (lpString=".vhd") returned 4 [0041.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".vhd") returned 0x0 [0041.652] lstrlenW (lpString=".vhdx") returned 5 [0041.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".vhdx") returned 0x0 [0041.652] lstrlenW (lpString=".pst") returned 4 [0041.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".pst") returned 0x0 [0041.652] lstrlenW (lpString=".ost") returned 4 [0041.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".ost") returned 0x0 [0041.653] lstrlenW (lpString=".bak") returned 4 [0041.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".bak") returned 0x0 [0041.653] lstrlenW (lpString=".bac") returned 4 [0041.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".bac") returned 0x0 [0041.653] lstrlenW (lpString=".sys") returned 4 [0041.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".sys") returned 0x0 [0041.653] lstrlenW (lpString=".v2i") returned 4 [0041.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".v2i") returned 0x0 [0041.653] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.653] lstrlenW (lpString=".sql") returned 4 [0041.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".sql") returned 0x0 [0041.653] lstrlenW (lpString=".mdf") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".mdf") returned 0x0 [0041.654] lstrlenW (lpString=".txt") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".txt") returned 0x0 [0041.654] lstrlenW (lpString=".dbf") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".dbf") returned 0x0 [0041.654] lstrlenW (lpString=".ckp") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".ckp") returned 0x0 [0041.654] lstrlenW (lpString=".dacpac") returned 7 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".dacpac") returned 0x0 [0041.654] lstrlenW (lpString=".db3") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".db3") returned 0x0 [0041.654] lstrlenW (lpString=".dtxs") returned 5 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".dtxs") returned 0x0 [0041.654] lstrlenW (lpString=".mdt") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".mdt") returned 0x0 [0041.654] lstrlenW (lpString=".sdf") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".sdf") returned 0x0 [0041.654] lstrlenW (lpString=".MDF") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".MDF") returned 0x0 [0041.654] lstrlenW (lpString=".DBF") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".DBF") returned 0x0 [0041.654] lstrlenW (lpString=".DB") returned 3 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".DB") returned 0x0 [0041.654] lstrlenW (lpString=".db") returned 3 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".db") returned 0x0 [0041.654] lstrlenW (lpString=".ndf") returned 4 [0041.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".ndf") returned 0x0 [0041.655] lstrlenW (lpString=".NDF") returned 4 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".NDF") returned 0x0 [0041.655] lstrlenW (lpString=".Mdf") returned 4 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".Mdf") returned 0x0 [0041.655] lstrlenW (lpString=".dat") returned 4 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".dat") returned 0x0 [0041.655] lstrlenW (lpString=".DAT") returned 4 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".DAT") returned 0x0 [0041.655] lstrlenW (lpString=".ldf") returned 4 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".ldf") returned 0x0 [0041.655] lstrlenW (lpString=".LDF") returned 4 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch=".LDF") returned 0x0 [0041.655] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.655] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.656] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.656] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.657] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16165772651) returned 1 [0041.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7a4c2d0, dwHighDateTime=0x1d585b4)) [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d3c8 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa890 [0041.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.657] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.657] GetLastError () returned 0x0 [0041.658] GetLastError () returned 0x0 [0041.658] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.658] GetLastError () returned 0x0 [0041.658] GetLastError () returned 0x0 [0041.658] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.663] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.663] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.663] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.665] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.665] CloseHandle (hObject=0x100) returned 1 [0041.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.667] GetLastError () returned 0x0 [0041.667] RtlWakeConditionVariable () returned 0x27e828 [0041.667] GetCurrentThreadId () returned 0x99c [0041.667] GetCurrentThreadId () returned 0x99c [0041.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa9c0 | out: hHeap=0x260000) returned 1 [0041.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0041.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa9c0 [0041.667] lstrlenW (lpString=".ldf") returned 4 [0041.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".ldf") returned 0x0 [0041.667] lstrlenW (lpString=".vhd") returned 4 [0041.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".vhd") returned 0x0 [0041.667] lstrlenW (lpString=".vhdx") returned 5 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".vhdx") returned 0x0 [0041.668] lstrlenW (lpString=".pst") returned 4 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".pst") returned 0x0 [0041.668] lstrlenW (lpString=".ost") returned 4 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".ost") returned 0x0 [0041.668] lstrlenW (lpString=".bak") returned 4 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".bak") returned 0x0 [0041.668] lstrlenW (lpString=".bac") returned 4 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".bac") returned 0x0 [0041.668] lstrlenW (lpString=".sys") returned 4 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".sys") returned 0x0 [0041.668] lstrlenW (lpString=".v2i") returned 4 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".v2i") returned 0x0 [0041.668] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.670] lstrlenW (lpString=".sql") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".sql") returned 0x0 [0041.671] lstrlenW (lpString=".mdf") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".mdf") returned 0x0 [0041.671] lstrlenW (lpString=".txt") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".txt") returned 0x0 [0041.671] lstrlenW (lpString=".dbf") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".dbf") returned 0x0 [0041.671] lstrlenW (lpString=".ckp") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".ckp") returned 0x0 [0041.671] lstrlenW (lpString=".dacpac") returned 7 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".dacpac") returned 0x0 [0041.671] lstrlenW (lpString=".db3") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".db3") returned 0x0 [0041.671] lstrlenW (lpString=".dtxs") returned 5 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".dtxs") returned 0x0 [0041.671] lstrlenW (lpString=".mdt") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".mdt") returned 0x0 [0041.671] lstrlenW (lpString=".sdf") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".sdf") returned 0x0 [0041.671] lstrlenW (lpString=".MDF") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".MDF") returned 0x0 [0041.671] lstrlenW (lpString=".DBF") returned 4 [0041.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".DBF") returned 0x0 [0041.671] lstrlenW (lpString=".DB") returned 3 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".DB") returned 0x0 [0041.672] lstrlenW (lpString=".db") returned 3 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".db") returned 0x0 [0041.672] lstrlenW (lpString=".ndf") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".ndf") returned 0x0 [0041.672] lstrlenW (lpString=".NDF") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".NDF") returned 0x0 [0041.672] lstrlenW (lpString=".Mdf") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".Mdf") returned 0x0 [0041.672] lstrlenW (lpString=".dat") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".dat") returned 0x0 [0041.672] lstrlenW (lpString=".DAT") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".DAT") returned 0x0 [0041.672] lstrlenW (lpString=".ldf") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".ldf") returned 0x0 [0041.672] lstrlenW (lpString=".LDF") returned 4 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch=".LDF") returned 0x0 [0041.672] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.672] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.673] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.673] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.674] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16167475701) returned 1 [0041.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7a72430, dwHighDateTime=0x1d585b4)) [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d400 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa760 [0041.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.674] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.674] GetLastError () returned 0x0 [0041.675] GetLastError () returned 0x0 [0041.675] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.675] GetLastError () returned 0x0 [0041.675] GetLastError () returned 0x0 [0041.675] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.679] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.679] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.679] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.680] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.695] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.695] CloseHandle (hObject=0x100) returned 1 [0041.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f5f8 [0041.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f5f8 | out: hHeap=0x260000) returned 1 [0041.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.762] GetLastError () returned 0x0 [0041.762] RtlWakeConditionVariable () returned 0x27e828 [0041.762] GetCurrentThreadId () returned 0x99c [0041.762] GetCurrentThreadId () returned 0x99c [0041.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c28 | out: hHeap=0x260000) returned 1 [0041.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4a8 | out: hHeap=0x260000) returned 1 [0041.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312c28 [0041.763] lstrlenW (lpString=".ldf") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".ldf") returned 0x0 [0041.763] lstrlenW (lpString=".vhd") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".vhd") returned 0x0 [0041.763] lstrlenW (lpString=".vhdx") returned 5 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".vhdx") returned 0x0 [0041.763] lstrlenW (lpString=".pst") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".pst") returned 0x0 [0041.763] lstrlenW (lpString=".ost") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".ost") returned 0x0 [0041.763] lstrlenW (lpString=".bak") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".bak") returned 0x0 [0041.763] lstrlenW (lpString=".bac") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".bac") returned 0x0 [0041.763] lstrlenW (lpString=".sys") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".sys") returned 0x0 [0041.763] lstrlenW (lpString=".v2i") returned 4 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".v2i") returned 0x0 [0041.763] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.765] lstrlenW (lpString=".sql") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".sql") returned 0x0 [0041.765] lstrlenW (lpString=".mdf") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".mdf") returned 0x0 [0041.765] lstrlenW (lpString=".txt") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".txt") returned 0x0 [0041.765] lstrlenW (lpString=".dbf") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".dbf") returned 0x0 [0041.765] lstrlenW (lpString=".ckp") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".ckp") returned 0x0 [0041.765] lstrlenW (lpString=".dacpac") returned 7 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".dacpac") returned 0x0 [0041.765] lstrlenW (lpString=".db3") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".db3") returned 0x0 [0041.765] lstrlenW (lpString=".dtxs") returned 5 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".dtxs") returned 0x0 [0041.765] lstrlenW (lpString=".mdt") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".mdt") returned 0x0 [0041.765] lstrlenW (lpString=".sdf") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".sdf") returned 0x0 [0041.765] lstrlenW (lpString=".MDF") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".MDF") returned 0x0 [0041.765] lstrlenW (lpString=".DBF") returned 4 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".DBF") returned 0x0 [0041.765] lstrlenW (lpString=".DB") returned 3 [0041.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".DB") returned 0x0 [0041.766] lstrlenW (lpString=".db") returned 3 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".db") returned 0x0 [0041.766] lstrlenW (lpString=".ndf") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".ndf") returned 0x0 [0041.766] lstrlenW (lpString=".NDF") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".NDF") returned 0x0 [0041.766] lstrlenW (lpString=".Mdf") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".Mdf") returned 0x0 [0041.766] lstrlenW (lpString=".dat") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".dat") returned 0x0 [0041.766] lstrlenW (lpString=".DAT") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".DAT") returned 0x0 [0041.766] lstrlenW (lpString=".ldf") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".ldf") returned 0x0 [0041.766] lstrlenW (lpString=".LDF") returned 4 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch=".LDF") returned 0x0 [0041.766] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.766] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.767] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.767] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16176856138) returned 1 [0041.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7b56c70, dwHighDateTime=0x1d585b4)) [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4a8 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4a8 | out: hHeap=0x260000) returned 1 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313510 [0041.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.768] GetLastError () returned 0x0 [0041.768] GetLastError () returned 0x0 [0041.768] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.768] GetLastError () returned 0x0 [0041.769] GetLastError () returned 0x0 [0041.769] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.774] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.774] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.774] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.774] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.776] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.776] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.776] CloseHandle (hObject=0x10c) returned 1 [0041.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.778] GetLastError () returned 0x0 [0041.778] RtlWakeConditionVariable () returned 0x27e828 [0041.778] GetCurrentThreadId () returned 0x99c [0041.778] GetCurrentThreadId () returned 0x99c [0041.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312cc0 | out: hHeap=0x260000) returned 1 [0041.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x260000) returned 1 [0041.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.778] lstrlenW (lpString=".ldf") returned 4 [0041.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".ldf") returned 0x0 [0041.778] lstrlenW (lpString=".vhd") returned 4 [0041.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".vhd") returned 0x0 [0041.778] lstrlenW (lpString=".vhdx") returned 5 [0041.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".vhdx") returned 0x0 [0041.778] lstrlenW (lpString=".pst") returned 4 [0041.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".pst") returned 0x0 [0041.778] lstrlenW (lpString=".ost") returned 4 [0041.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".ost") returned 0x0 [0041.778] lstrlenW (lpString=".bak") returned 4 [0041.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".bak") returned 0x0 [0041.779] lstrlenW (lpString=".bac") returned 4 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".bac") returned 0x0 [0041.779] lstrlenW (lpString=".sys") returned 4 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".sys") returned 0x0 [0041.779] lstrlenW (lpString=".v2i") returned 4 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".v2i") returned 0x0 [0041.779] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.779] lstrlenW (lpString=".sql") returned 4 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".sql") returned 0x0 [0041.779] lstrlenW (lpString=".mdf") returned 4 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".mdf") returned 0x0 [0041.779] lstrlenW (lpString=".txt") returned 4 [0041.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".txt") returned 0x0 [0041.779] lstrlenW (lpString=".dbf") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".dbf") returned 0x0 [0041.780] lstrlenW (lpString=".ckp") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".ckp") returned 0x0 [0041.780] lstrlenW (lpString=".dacpac") returned 7 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".dacpac") returned 0x0 [0041.780] lstrlenW (lpString=".db3") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".db3") returned 0x0 [0041.780] lstrlenW (lpString=".dtxs") returned 5 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".dtxs") returned 0x0 [0041.780] lstrlenW (lpString=".mdt") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".mdt") returned 0x0 [0041.780] lstrlenW (lpString=".sdf") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".sdf") returned 0x0 [0041.780] lstrlenW (lpString=".MDF") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".MDF") returned 0x0 [0041.780] lstrlenW (lpString=".DBF") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".DBF") returned 0x0 [0041.780] lstrlenW (lpString=".DB") returned 3 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".DB") returned 0x0 [0041.780] lstrlenW (lpString=".db") returned 3 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".db") returned 0x0 [0041.780] lstrlenW (lpString=".ndf") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".ndf") returned 0x0 [0041.780] lstrlenW (lpString=".NDF") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".NDF") returned 0x0 [0041.780] lstrlenW (lpString=".Mdf") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".Mdf") returned 0x0 [0041.780] lstrlenW (lpString=".dat") returned 4 [0041.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".dat") returned 0x0 [0041.780] lstrlenW (lpString=".DAT") returned 4 [0041.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".DAT") returned 0x0 [0041.781] lstrlenW (lpString=".ldf") returned 4 [0041.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".ldf") returned 0x0 [0041.781] lstrlenW (lpString=".LDF") returned 4 [0041.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch=".LDF") returned 0x0 [0041.781] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d57a0 [0041.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.781] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.782] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x319ae0 [0041.782] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16178313681) returned 1 [0041.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7b7cdd0, dwHighDateTime=0x1d585b4)) [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4e0 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x260000) returned 1 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312c28 [0041.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.783] GetLastError () returned 0x0 [0041.783] GetLastError () returned 0x0 [0041.783] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.783] GetLastError () returned 0x0 [0041.783] GetLastError () returned 0x0 [0041.783] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.786] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.786] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.787] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.787] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.789] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.789] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.789] CloseHandle (hObject=0x10c) returned 1 [0041.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.790] GetLastError () returned 0x0 [0041.790] RtlWakeConditionVariable () returned 0x27e828 [0041.790] GetCurrentThreadId () returned 0x99c [0041.790] GetCurrentThreadId () returned 0x99c [0041.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0041.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0041.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.790] lstrlenW (lpString=".ldf") returned 4 [0041.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".ldf") returned 0x0 [0041.790] lstrlenW (lpString=".vhd") returned 4 [0041.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".vhd") returned 0x0 [0041.790] lstrlenW (lpString=".vhdx") returned 5 [0041.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".vhdx") returned 0x0 [0041.791] lstrlenW (lpString=".pst") returned 4 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".pst") returned 0x0 [0041.791] lstrlenW (lpString=".ost") returned 4 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".ost") returned 0x0 [0041.791] lstrlenW (lpString=".bak") returned 4 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".bak") returned 0x0 [0041.791] lstrlenW (lpString=".bac") returned 4 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".bac") returned 0x0 [0041.791] lstrlenW (lpString=".sys") returned 4 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".sys") returned 0x0 [0041.791] lstrlenW (lpString=".v2i") returned 4 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch=".v2i") returned 0x0 [0041.791] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", lpSrch="s\r\n.v2i") returned 0x0 [0041.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30edf8 | out: hHeap=0x260000) returned 1 [0041.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.791] RtlWakeConditionVariable () returned 0x27e828 [0041.791] GetCurrentThreadId () returned 0x99c [0041.791] GetCurrentThreadId () returned 0x99c [0041.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dac40 | out: hHeap=0x260000) returned 1 [0041.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d518 | out: hHeap=0x260000) returned 1 [0041.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dac40 [0041.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.792] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.792] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.792] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.792] WriteFile (in: hFile=0x10c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.793] CloseHandle (hObject=0x10c) returned 1 [0041.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dac40 | out: hHeap=0x260000) returned 1 [0041.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.794] RtlWakeConditionVariable () returned 0x27e828 [0041.794] GetCurrentThreadId () returned 0x99c [0041.794] GetCurrentThreadId () returned 0x99c [0041.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312d58 | out: hHeap=0x260000) returned 1 [0041.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x260000) returned 1 [0041.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312d58 [0041.794] lstrlenW (lpString=".ldf") returned 4 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".ldf") returned 0x0 [0041.794] lstrlenW (lpString=".vhd") returned 4 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".vhd") returned 0x0 [0041.794] lstrlenW (lpString=".vhdx") returned 5 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".vhdx") returned 0x0 [0041.794] lstrlenW (lpString=".pst") returned 4 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".pst") returned 0x0 [0041.794] lstrlenW (lpString=".ost") returned 4 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".ost") returned 0x0 [0041.794] lstrlenW (lpString=".bak") returned 4 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".bak") returned 0x0 [0041.794] lstrlenW (lpString=".bac") returned 4 [0041.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".bac") returned 0x0 [0041.794] lstrlenW (lpString=".sys") returned 4 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".sys") returned 0x0 [0041.795] lstrlenW (lpString=".v2i") returned 4 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".v2i") returned 0x0 [0041.795] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0041.795] lstrlenW (lpString=".sql") returned 4 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".sql") returned 0x0 [0041.795] lstrlenW (lpString=".mdf") returned 4 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".mdf") returned 0x0 [0041.795] lstrlenW (lpString=".txt") returned 4 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".txt") returned 0x0 [0041.795] lstrlenW (lpString=".dbf") returned 4 [0041.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".dbf") returned 0x0 [0041.795] lstrlenW (lpString=".ckp") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".ckp") returned 0x0 [0041.796] lstrlenW (lpString=".dacpac") returned 7 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".dacpac") returned 0x0 [0041.796] lstrlenW (lpString=".db3") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".db3") returned 0x0 [0041.796] lstrlenW (lpString=".dtxs") returned 5 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".dtxs") returned 0x0 [0041.796] lstrlenW (lpString=".mdt") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".mdt") returned 0x0 [0041.796] lstrlenW (lpString=".sdf") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".sdf") returned 0x0 [0041.796] lstrlenW (lpString=".MDF") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".MDF") returned 0x0 [0041.796] lstrlenW (lpString=".DBF") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".DBF") returned 0x0 [0041.796] lstrlenW (lpString=".DB") returned 3 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".DB") returned 0x0 [0041.796] lstrlenW (lpString=".db") returned 3 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".db") returned 0x0 [0041.796] lstrlenW (lpString=".ndf") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".ndf") returned 0x0 [0041.796] lstrlenW (lpString=".NDF") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".NDF") returned 0x0 [0041.796] lstrlenW (lpString=".Mdf") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".Mdf") returned 0x0 [0041.796] lstrlenW (lpString=".dat") returned 4 [0041.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".dat") returned 0x0 [0041.797] lstrlenW (lpString=".DAT") returned 4 [0041.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".DAT") returned 0x0 [0041.797] lstrlenW (lpString=".ldf") returned 4 [0041.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".ldf") returned 0x0 [0041.797] lstrlenW (lpString=".LDF") returned 4 [0041.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch=".LDF") returned 0x0 [0041.797] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.797] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.797] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0041.798] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.798] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.798] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16179919900) returned 1 [0041.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7ba2f30, dwHighDateTime=0x1d585b4)) [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d550 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x260000) returned 1 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312cc0 [0041.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.799] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0041.799] GetLastError () returned 0x0 [0041.799] GetLastError () returned 0x0 [0041.799] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0041.799] GetLastError () returned 0x0 [0041.799] GetLastError () returned 0x0 [0041.799] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.923] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.923] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.925] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.926] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.939] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.939] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.939] CloseHandle (hObject=0x10c) returned 1 [0041.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f520 [0041.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f520 | out: hHeap=0x260000) returned 1 [0041.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0041.987] GetLastError () returned 0x0 [0041.987] RtlWakeConditionVariable () returned 0x27e828 [0041.987] GetCurrentThreadId () returned 0x99c [0041.987] GetCurrentThreadId () returned 0x99c [0041.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f098 | out: hHeap=0x260000) returned 1 [0041.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7f0 | out: hHeap=0x260000) returned 1 [0041.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f098 [0041.987] lstrlenW (lpString=".ldf") returned 4 [0041.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".ldf") returned 0x0 [0041.987] lstrlenW (lpString=".vhd") returned 4 [0041.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".vhd") returned 0x0 [0041.987] lstrlenW (lpString=".vhdx") returned 5 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".vhdx") returned 0x0 [0041.988] lstrlenW (lpString=".pst") returned 4 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".pst") returned 0x0 [0041.988] lstrlenW (lpString=".ost") returned 4 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".ost") returned 0x0 [0041.988] lstrlenW (lpString=".bak") returned 4 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".bak") returned 0x0 [0041.988] lstrlenW (lpString=".bac") returned 4 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".bac") returned 0x0 [0041.988] lstrlenW (lpString=".sys") returned 4 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".sys") returned 0x0 [0041.988] lstrlenW (lpString=".v2i") returned 4 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch=".v2i") returned 0x0 [0041.988] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f098 | out: hHeap=0x260000) returned 1 [0041.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0041.988] RtlWakeConditionVariable () returned 0x27e828 [0041.988] GetCurrentThreadId () returned 0x99c [0041.988] GetCurrentThreadId () returned 0x99c [0041.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3132b0 | out: hHeap=0x260000) returned 1 [0041.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d828 | out: hHeap=0x260000) returned 1 [0041.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3132b0 [0041.989] lstrlenW (lpString=".ldf") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".ldf") returned 0x0 [0041.989] lstrlenW (lpString=".vhd") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".vhd") returned 0x0 [0041.989] lstrlenW (lpString=".vhdx") returned 5 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".vhdx") returned 0x0 [0041.989] lstrlenW (lpString=".pst") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".pst") returned 0x0 [0041.989] lstrlenW (lpString=".ost") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".ost") returned 0x0 [0041.989] lstrlenW (lpString=".bak") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".bak") returned 0x0 [0041.989] lstrlenW (lpString=".bac") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".bac") returned 0x0 [0041.989] lstrlenW (lpString=".sys") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".sys") returned 0x0 [0041.989] lstrlenW (lpString=".v2i") returned 4 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".v2i") returned 0x0 [0041.989] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.003] lstrlenW (lpString=".sql") returned 4 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".sql") returned 0x0 [0042.003] lstrlenW (lpString=".mdf") returned 4 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".mdf") returned 0x0 [0042.003] lstrlenW (lpString=".txt") returned 4 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".txt") returned 0x0 [0042.003] lstrlenW (lpString=".dbf") returned 4 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".dbf") returned 0x0 [0042.003] lstrlenW (lpString=".ckp") returned 4 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".ckp") returned 0x0 [0042.003] lstrlenW (lpString=".dacpac") returned 7 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".dacpac") returned 0x0 [0042.003] lstrlenW (lpString=".db3") returned 4 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".db3") returned 0x0 [0042.003] lstrlenW (lpString=".dtxs") returned 5 [0042.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".dtxs") returned 0x0 [0042.003] lstrlenW (lpString=".mdt") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".mdt") returned 0x0 [0042.004] lstrlenW (lpString=".sdf") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".sdf") returned 0x0 [0042.004] lstrlenW (lpString=".MDF") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".MDF") returned 0x0 [0042.004] lstrlenW (lpString=".DBF") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".DBF") returned 0x0 [0042.004] lstrlenW (lpString=".DB") returned 3 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".DB") returned 0x0 [0042.004] lstrlenW (lpString=".db") returned 3 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".db") returned 0x0 [0042.004] lstrlenW (lpString=".ndf") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".ndf") returned 0x0 [0042.004] lstrlenW (lpString=".NDF") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".NDF") returned 0x0 [0042.004] lstrlenW (lpString=".Mdf") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".Mdf") returned 0x0 [0042.004] lstrlenW (lpString=".dat") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".dat") returned 0x0 [0042.004] lstrlenW (lpString=".DAT") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".DAT") returned 0x0 [0042.004] lstrlenW (lpString=".ldf") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".ldf") returned 0x0 [0042.004] lstrlenW (lpString=".LDF") returned 4 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch=".LDF") returned 0x0 [0042.004] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0042.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.004] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.005] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.005] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16200853486) returned 1 [0042.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7d92110, dwHighDateTime=0x1d585b4)) [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff20 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff20 | out: hHeap=0x260000) returned 1 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312d58 [0042.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.008] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.008] GetLastError () returned 0x0 [0042.008] GetLastError () returned 0x0 [0042.008] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.008] GetLastError () returned 0x0 [0042.008] GetLastError () returned 0x0 [0042.009] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.012] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.012] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.013] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.013] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.017] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.017] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.017] CloseHandle (hObject=0xfc) returned 1 [0042.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f520 [0042.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f520 | out: hHeap=0x260000) returned 1 [0042.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.018] GetLastError () returned 0x0 [0042.018] RtlWakeConditionVariable () returned 0x27e828 [0042.018] GetCurrentThreadId () returned 0x99c [0042.018] GetCurrentThreadId () returned 0x99c [0042.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f140 | out: hHeap=0x260000) returned 1 [0042.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d860 | out: hHeap=0x260000) returned 1 [0042.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f140 [0042.018] lstrlenW (lpString=".ldf") returned 4 [0042.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".ldf") returned 0x0 [0042.018] lstrlenW (lpString=".vhd") returned 4 [0042.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".vhd") returned 0x0 [0042.018] lstrlenW (lpString=".vhdx") returned 5 [0042.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".vhdx") returned 0x0 [0042.018] lstrlenW (lpString=".pst") returned 4 [0042.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".pst") returned 0x0 [0042.018] lstrlenW (lpString=".ost") returned 4 [0042.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".ost") returned 0x0 [0042.018] lstrlenW (lpString=".bak") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".bak") returned 0x0 [0042.019] lstrlenW (lpString=".bac") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".bac") returned 0x0 [0042.019] lstrlenW (lpString=".sys") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".sys") returned 0x0 [0042.019] lstrlenW (lpString=".v2i") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".v2i") returned 0x0 [0042.019] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.019] lstrlenW (lpString=".sql") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".sql") returned 0x0 [0042.019] lstrlenW (lpString=".mdf") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".mdf") returned 0x0 [0042.019] lstrlenW (lpString=".txt") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".txt") returned 0x0 [0042.019] lstrlenW (lpString=".dbf") returned 4 [0042.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".dbf") returned 0x0 [0042.020] lstrlenW (lpString=".ckp") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".ckp") returned 0x0 [0042.020] lstrlenW (lpString=".dacpac") returned 7 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".dacpac") returned 0x0 [0042.020] lstrlenW (lpString=".db3") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".db3") returned 0x0 [0042.020] lstrlenW (lpString=".dtxs") returned 5 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".dtxs") returned 0x0 [0042.020] lstrlenW (lpString=".mdt") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".mdt") returned 0x0 [0042.020] lstrlenW (lpString=".sdf") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".sdf") returned 0x0 [0042.020] lstrlenW (lpString=".MDF") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".MDF") returned 0x0 [0042.020] lstrlenW (lpString=".DBF") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".DBF") returned 0x0 [0042.020] lstrlenW (lpString=".DB") returned 3 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".DB") returned 0x0 [0042.020] lstrlenW (lpString=".db") returned 3 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".db") returned 0x0 [0042.020] lstrlenW (lpString=".ndf") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".ndf") returned 0x0 [0042.020] lstrlenW (lpString=".NDF") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".NDF") returned 0x0 [0042.020] lstrlenW (lpString=".Mdf") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".Mdf") returned 0x0 [0042.020] lstrlenW (lpString=".dat") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".dat") returned 0x0 [0042.020] lstrlenW (lpString=".DAT") returned 4 [0042.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".DAT") returned 0x0 [0042.020] lstrlenW (lpString=".ldf") returned 4 [0042.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".ldf") returned 0x0 [0042.021] lstrlenW (lpString=".LDF") returned 4 [0042.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch=".LDF") returned 0x0 [0042.021] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0042.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.021] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.021] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.022] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.022] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16202280111) returned 1 [0042.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7db8270, dwHighDateTime=0x1d585b4)) [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d860 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d860 | out: hHeap=0x260000) returned 1 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e3d8 [0042.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e3d8 | out: hHeap=0x260000) returned 1 [0042.022] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.022] GetLastError () returned 0x0 [0042.022] GetLastError () returned 0x0 [0042.022] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.023] GetLastError () returned 0x0 [0042.023] GetLastError () returned 0x0 [0042.023] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.025] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.025] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.026] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.026] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.027] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.028] CloseHandle (hObject=0xfc) returned 1 [0042.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0042.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0042.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.028] GetLastError () returned 0x0 [0042.028] RtlWakeConditionVariable () returned 0x27e828 [0042.028] GetCurrentThreadId () returned 0x99c [0042.029] GetCurrentThreadId () returned 0x99c [0042.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313348 | out: hHeap=0x260000) returned 1 [0042.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d898 | out: hHeap=0x260000) returned 1 [0042.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313348 [0042.029] lstrlenW (lpString=".ldf") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".ldf") returned 0x0 [0042.029] lstrlenW (lpString=".vhd") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".vhd") returned 0x0 [0042.029] lstrlenW (lpString=".vhdx") returned 5 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".vhdx") returned 0x0 [0042.029] lstrlenW (lpString=".pst") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".pst") returned 0x0 [0042.029] lstrlenW (lpString=".ost") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".ost") returned 0x0 [0042.029] lstrlenW (lpString=".bak") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".bak") returned 0x0 [0042.029] lstrlenW (lpString=".bac") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".bac") returned 0x0 [0042.029] lstrlenW (lpString=".sys") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".sys") returned 0x0 [0042.029] lstrlenW (lpString=".v2i") returned 4 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".v2i") returned 0x0 [0042.029] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch="s\r\n.v2i") returned 0x0 [0042.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.073] lstrlenW (lpString=".sql") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".sql") returned 0x0 [0042.073] lstrlenW (lpString=".mdf") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".mdf") returned 0x0 [0042.073] lstrlenW (lpString=".txt") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".txt") returned 0x0 [0042.073] lstrlenW (lpString=".dbf") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".dbf") returned 0x0 [0042.073] lstrlenW (lpString=".ckp") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".ckp") returned 0x0 [0042.073] lstrlenW (lpString=".dacpac") returned 7 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".dacpac") returned 0x0 [0042.073] lstrlenW (lpString=".db3") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".db3") returned 0x0 [0042.073] lstrlenW (lpString=".dtxs") returned 5 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".dtxs") returned 0x0 [0042.073] lstrlenW (lpString=".mdt") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".mdt") returned 0x0 [0042.073] lstrlenW (lpString=".sdf") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".sdf") returned 0x0 [0042.073] lstrlenW (lpString=".MDF") returned 4 [0042.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".MDF") returned 0x0 [0042.074] lstrlenW (lpString=".DBF") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".DBF") returned 0x0 [0042.074] lstrlenW (lpString=".DB") returned 3 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".DB") returned 0x0 [0042.074] lstrlenW (lpString=".db") returned 3 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".db") returned 0x0 [0042.074] lstrlenW (lpString=".ndf") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".ndf") returned 0x0 [0042.074] lstrlenW (lpString=".NDF") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".NDF") returned 0x0 [0042.074] lstrlenW (lpString=".Mdf") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".Mdf") returned 0x0 [0042.074] lstrlenW (lpString=".dat") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".dat") returned 0x0 [0042.074] lstrlenW (lpString=".DAT") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".DAT") returned 0x0 [0042.074] lstrlenW (lpString=".ldf") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".ldf") returned 0x0 [0042.074] lstrlenW (lpString=".LDF") returned 4 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch=".LDF") returned 0x0 [0042.074] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0042.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.074] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.075] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.075] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.075] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16207657792) returned 1 [0042.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7e507f0, dwHighDateTime=0x1d585b4)) [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299600 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3132b0 [0042.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.076] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.076] GetLastError () returned 0x0 [0042.076] GetLastError () returned 0x0 [0042.076] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.076] GetLastError () returned 0x0 [0042.077] GetLastError () returned 0x0 [0042.077] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x1a5b, lpOverlapped=0x0) returned 1 [0042.079] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe5a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.079] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x1a5b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x1a5b, lpOverlapped=0x0) returned 1 [0042.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.079] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.080] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.080] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.080] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.080] CloseHandle (hObject=0xfc) returned 1 [0042.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0042.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.[deadmin@cock.li].deadmin")) returned 1 [0042.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0042.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.081] GetLastError () returned 0x0 [0042.081] RtlWakeConditionVariable () returned 0x27e828 [0042.081] GetCurrentThreadId () returned 0x99c [0042.081] GetCurrentThreadId () returned 0x99c [0042.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0042.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0042.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d5480 [0042.081] lstrlenW (lpString=".ldf") returned 4 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".ldf") returned 0x0 [0042.081] lstrlenW (lpString=".vhd") returned 4 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".vhd") returned 0x0 [0042.081] lstrlenW (lpString=".vhdx") returned 5 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".vhdx") returned 0x0 [0042.081] lstrlenW (lpString=".pst") returned 4 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".pst") returned 0x0 [0042.081] lstrlenW (lpString=".ost") returned 4 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".ost") returned 0x0 [0042.081] lstrlenW (lpString=".bak") returned 4 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".bak") returned 0x0 [0042.081] lstrlenW (lpString=".bac") returned 4 [0042.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".bac") returned 0x0 [0042.082] lstrlenW (lpString=".sys") returned 4 [0042.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".sys") returned 0x0 [0042.082] lstrlenW (lpString=".v2i") returned 4 [0042.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".v2i") returned 0x0 [0042.082] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.083] lstrlenW (lpString=".sql") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".sql") returned 0x0 [0042.083] lstrlenW (lpString=".mdf") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".mdf") returned 0x0 [0042.083] lstrlenW (lpString=".txt") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".txt") returned 0x0 [0042.083] lstrlenW (lpString=".dbf") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".dbf") returned 0x0 [0042.083] lstrlenW (lpString=".ckp") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".ckp") returned 0x0 [0042.083] lstrlenW (lpString=".dacpac") returned 7 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".dacpac") returned 0x0 [0042.083] lstrlenW (lpString=".db3") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".db3") returned 0x0 [0042.083] lstrlenW (lpString=".dtxs") returned 5 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".dtxs") returned 0x0 [0042.083] lstrlenW (lpString=".mdt") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".mdt") returned 0x0 [0042.083] lstrlenW (lpString=".sdf") returned 4 [0042.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".sdf") returned 0x0 [0042.083] lstrlenW (lpString=".MDF") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".MDF") returned 0x0 [0042.084] lstrlenW (lpString=".DBF") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".DBF") returned 0x0 [0042.084] lstrlenW (lpString=".DB") returned 3 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".DB") returned 0x0 [0042.084] lstrlenW (lpString=".db") returned 3 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".db") returned 0x0 [0042.084] lstrlenW (lpString=".ndf") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".ndf") returned 0x0 [0042.084] lstrlenW (lpString=".NDF") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".NDF") returned 0x0 [0042.084] lstrlenW (lpString=".Mdf") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".Mdf") returned 0x0 [0042.084] lstrlenW (lpString=".dat") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".dat") returned 0x0 [0042.084] lstrlenW (lpString=".DAT") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".DAT") returned 0x0 [0042.084] lstrlenW (lpString=".ldf") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".ldf") returned 0x0 [0042.084] lstrlenW (lpString=".LDF") returned 4 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch=".LDF") returned 0x0 [0042.084] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.085] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.085] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.086] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16208665283) returned 1 [0042.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7e507f0, dwHighDateTime=0x1d585b4)) [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.086] GetLastError () returned 0x0 [0042.086] GetLastError () returned 0x0 [0042.086] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.087] GetLastError () returned 0x0 [0042.087] GetLastError () returned 0x0 [0042.087] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x333, lpOverlapped=0x0) returned 1 [0042.088] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffccd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.088] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x333, lpOverlapped=0x0) returned 1 [0042.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.088] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.088] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.089] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.089] CloseHandle (hObject=0xfc) returned 1 [0042.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d58d8 [0042.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d58d8 | out: hHeap=0x260000) returned 1 [0042.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.090] GetLastError () returned 0x0 [0042.090] RtlWakeConditionVariable () returned 0x27e828 [0042.090] GetCurrentThreadId () returned 0x99c [0042.090] GetCurrentThreadId () returned 0x99c [0042.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edfa8 | out: hHeap=0x260000) returned 1 [0042.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299590 | out: hHeap=0x260000) returned 1 [0042.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edfa8 [0042.090] lstrlenW (lpString=".ldf") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.090] lstrlenW (lpString=".vhd") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.090] lstrlenW (lpString=".vhdx") returned 5 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.090] lstrlenW (lpString=".pst") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.090] lstrlenW (lpString=".ost") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.090] lstrlenW (lpString=".bak") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.090] lstrlenW (lpString=".bac") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.090] lstrlenW (lpString=".sys") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.090] lstrlenW (lpString=".v2i") returned 4 [0042.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.091] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.091] lstrlenW (lpString=".sql") returned 4 [0042.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.091] lstrlenW (lpString=".mdf") returned 4 [0042.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.091] lstrlenW (lpString=".txt") returned 4 [0042.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.091] lstrlenW (lpString=".dbf") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.092] lstrlenW (lpString=".ckp") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.092] lstrlenW (lpString=".dacpac") returned 7 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.092] lstrlenW (lpString=".db3") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.092] lstrlenW (lpString=".dtxs") returned 5 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.092] lstrlenW (lpString=".mdt") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.092] lstrlenW (lpString=".sdf") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.092] lstrlenW (lpString=".MDF") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.092] lstrlenW (lpString=".DBF") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.092] lstrlenW (lpString=".DB") returned 3 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.092] lstrlenW (lpString=".db") returned 3 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.092] lstrlenW (lpString=".ndf") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.092] lstrlenW (lpString=".NDF") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.092] lstrlenW (lpString=".Mdf") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.092] lstrlenW (lpString=".dat") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.092] lstrlenW (lpString=".DAT") returned 4 [0042.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.093] lstrlenW (lpString=".ldf") returned 4 [0042.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.093] lstrlenW (lpString=".LDF") returned 4 [0042.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.093] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.093] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.094] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.094] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.094] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16209482272) returned 1 [0042.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7e76950, dwHighDateTime=0x1d585b4)) [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299590 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299590 | out: hHeap=0x260000) returned 1 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.094] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.094] GetLastError () returned 0x0 [0042.094] GetLastError () returned 0x0 [0042.094] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.095] GetLastError () returned 0x0 [0042.095] GetLastError () returned 0x0 [0042.095] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0xa40, lpOverlapped=0x0) returned 1 [0042.096] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff5c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.096] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0xa40, lpOverlapped=0x0) returned 1 [0042.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.096] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.096] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.096] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.096] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.097] CloseHandle (hObject=0xfc) returned 1 [0042.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2d58d8 [0042.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d58d8 | out: hHeap=0x260000) returned 1 [0042.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.097] GetLastError () returned 0x0 [0042.097] RtlWakeConditionVariable () returned 0x27e828 [0042.097] GetCurrentThreadId () returned 0x99c [0042.097] GetCurrentThreadId () returned 0x99c [0042.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299558 | out: hHeap=0x260000) returned 1 [0042.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.098] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.098] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.098] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.099] WriteFile (in: hFile=0xfc, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.099] CloseHandle (hObject=0xfc) returned 1 [0042.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.100] RtlWakeConditionVariable () returned 0x27e828 [0042.100] GetCurrentThreadId () returned 0x99c [0042.100] GetCurrentThreadId () returned 0x99c [0042.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee090 | out: hHeap=0x260000) returned 1 [0042.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0042.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee090 [0042.100] lstrlenW (lpString=".ldf") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".ldf") returned 0x0 [0042.100] lstrlenW (lpString=".vhd") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".vhd") returned 0x0 [0042.100] lstrlenW (lpString=".vhdx") returned 5 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.100] lstrlenW (lpString=".pst") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".pst") returned 0x0 [0042.100] lstrlenW (lpString=".ost") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".ost") returned 0x0 [0042.100] lstrlenW (lpString=".bak") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".bak") returned 0x0 [0042.100] lstrlenW (lpString=".bac") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".bac") returned 0x0 [0042.100] lstrlenW (lpString=".sys") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".sys") returned 0x0 [0042.100] lstrlenW (lpString=".v2i") returned 4 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".v2i") returned 0x0 [0042.100] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.101] lstrlenW (lpString=".sql") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".sql") returned 0x0 [0042.101] lstrlenW (lpString=".mdf") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".mdf") returned 0x0 [0042.101] lstrlenW (lpString=".txt") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".txt") returned 0x0 [0042.101] lstrlenW (lpString=".dbf") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".dbf") returned 0x0 [0042.101] lstrlenW (lpString=".ckp") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".ckp") returned 0x0 [0042.101] lstrlenW (lpString=".dacpac") returned 7 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.101] lstrlenW (lpString=".db3") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".db3") returned 0x0 [0042.101] lstrlenW (lpString=".dtxs") returned 5 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.101] lstrlenW (lpString=".mdt") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".mdt") returned 0x0 [0042.101] lstrlenW (lpString=".sdf") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".sdf") returned 0x0 [0042.101] lstrlenW (lpString=".MDF") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".MDF") returned 0x0 [0042.101] lstrlenW (lpString=".DBF") returned 4 [0042.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".DBF") returned 0x0 [0042.102] lstrlenW (lpString=".DB") returned 3 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".DB") returned 0x0 [0042.102] lstrlenW (lpString=".db") returned 3 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".db") returned 0x0 [0042.102] lstrlenW (lpString=".ndf") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".ndf") returned 0x0 [0042.102] lstrlenW (lpString=".NDF") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".NDF") returned 0x0 [0042.102] lstrlenW (lpString=".Mdf") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.102] lstrlenW (lpString=".dat") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".dat") returned 0x0 [0042.102] lstrlenW (lpString=".DAT") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".DAT") returned 0x0 [0042.102] lstrlenW (lpString=".ldf") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".ldf") returned 0x0 [0042.102] lstrlenW (lpString=".LDF") returned 4 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch=".LDF") returned 0x0 [0042.102] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.102] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.103] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.103] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.103] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16210424514) returned 1 [0042.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7e76950, dwHighDateTime=0x1d585b4)) [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299520 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.104] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.104] GetLastError () returned 0x0 [0042.104] GetLastError () returned 0x0 [0042.104] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.104] GetLastError () returned 0x0 [0042.104] GetLastError () returned 0x0 [0042.104] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x61d, lpOverlapped=0x0) returned 1 [0042.105] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.106] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x61d, lpOverlapped=0x0) returned 1 [0042.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.106] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.106] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.106] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.106] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.106] CloseHandle (hObject=0xfc) returned 1 [0042.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.107] GetLastError () returned 0x0 [0042.107] RtlWakeConditionVariable () returned 0x27e828 [0042.107] GetCurrentThreadId () returned 0x99c [0042.107] GetCurrentThreadId () returned 0x99c [0042.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee178 | out: hHeap=0x260000) returned 1 [0042.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0042.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee178 [0042.107] lstrlenW (lpString=".ldf") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.107] lstrlenW (lpString=".vhd") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.107] lstrlenW (lpString=".vhdx") returned 5 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.107] lstrlenW (lpString=".pst") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.107] lstrlenW (lpString=".ost") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.107] lstrlenW (lpString=".bak") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.107] lstrlenW (lpString=".bac") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.107] lstrlenW (lpString=".sys") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.107] lstrlenW (lpString=".v2i") returned 4 [0042.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.108] lstrlenW (lpString=".sql") returned 4 [0042.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.108] lstrlenW (lpString=".mdf") returned 4 [0042.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.108] lstrlenW (lpString=".txt") returned 4 [0042.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.108] lstrlenW (lpString=".dbf") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.109] lstrlenW (lpString=".ckp") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.109] lstrlenW (lpString=".dacpac") returned 7 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.109] lstrlenW (lpString=".db3") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.109] lstrlenW (lpString=".dtxs") returned 5 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.109] lstrlenW (lpString=".mdt") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.109] lstrlenW (lpString=".sdf") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.109] lstrlenW (lpString=".MDF") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.109] lstrlenW (lpString=".DBF") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.109] lstrlenW (lpString=".DB") returned 3 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.109] lstrlenW (lpString=".db") returned 3 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.109] lstrlenW (lpString=".ndf") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.109] lstrlenW (lpString=".NDF") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.109] lstrlenW (lpString=".Mdf") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.109] lstrlenW (lpString=".dat") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.109] lstrlenW (lpString=".DAT") returned 4 [0042.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.109] lstrlenW (lpString=".ldf") returned 4 [0042.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.110] lstrlenW (lpString=".LDF") returned 4 [0042.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.110] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.110] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.110] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.111] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16211176263) returned 1 [0042.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7e9cab0, dwHighDateTime=0x1d585b4)) [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994e8 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.111] GetLastError () returned 0x0 [0042.111] GetLastError () returned 0x0 [0042.111] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.111] GetLastError () returned 0x0 [0042.112] GetLastError () returned 0x0 [0042.112] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0042.113] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.113] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0042.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.113] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.113] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.114] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.114] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.114] CloseHandle (hObject=0xfc) returned 1 [0042.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.114] GetLastError () returned 0x0 [0042.114] RtlWakeConditionVariable () returned 0x27e828 [0042.114] GetCurrentThreadId () returned 0x99c [0042.114] GetCurrentThreadId () returned 0x99c [0042.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9460 | out: hHeap=0x260000) returned 1 [0042.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0042.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.116] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.116] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.116] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.116] WriteFile (in: hFile=0x104, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.117] CloseHandle (hObject=0x104) returned 1 [0042.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.117] RtlWakeConditionVariable () returned 0x27e828 [0042.118] GetCurrentThreadId () returned 0x99c [0042.118] GetCurrentThreadId () returned 0x99c [0042.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee348 | out: hHeap=0x260000) returned 1 [0042.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299750 | out: hHeap=0x260000) returned 1 [0042.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee348 [0042.118] lstrlenW (lpString=".ldf") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".ldf") returned 0x0 [0042.118] lstrlenW (lpString=".vhd") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".vhd") returned 0x0 [0042.118] lstrlenW (lpString=".vhdx") returned 5 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.118] lstrlenW (lpString=".pst") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".pst") returned 0x0 [0042.118] lstrlenW (lpString=".ost") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".ost") returned 0x0 [0042.118] lstrlenW (lpString=".bak") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".bak") returned 0x0 [0042.118] lstrlenW (lpString=".bac") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".bac") returned 0x0 [0042.118] lstrlenW (lpString=".sys") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".sys") returned 0x0 [0042.118] lstrlenW (lpString=".v2i") returned 4 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".v2i") returned 0x0 [0042.118] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.119] lstrlenW (lpString=".sql") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".sql") returned 0x0 [0042.119] lstrlenW (lpString=".mdf") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".mdf") returned 0x0 [0042.119] lstrlenW (lpString=".txt") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".txt") returned 0x0 [0042.119] lstrlenW (lpString=".dbf") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".dbf") returned 0x0 [0042.119] lstrlenW (lpString=".ckp") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".ckp") returned 0x0 [0042.119] lstrlenW (lpString=".dacpac") returned 7 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.119] lstrlenW (lpString=".db3") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".db3") returned 0x0 [0042.119] lstrlenW (lpString=".dtxs") returned 5 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.119] lstrlenW (lpString=".mdt") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".mdt") returned 0x0 [0042.119] lstrlenW (lpString=".sdf") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".sdf") returned 0x0 [0042.119] lstrlenW (lpString=".MDF") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".MDF") returned 0x0 [0042.119] lstrlenW (lpString=".DBF") returned 4 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".DBF") returned 0x0 [0042.119] lstrlenW (lpString=".DB") returned 3 [0042.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".DB") returned 0x0 [0042.119] lstrlenW (lpString=".db") returned 3 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".db") returned 0x0 [0042.120] lstrlenW (lpString=".ndf") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".ndf") returned 0x0 [0042.120] lstrlenW (lpString=".NDF") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".NDF") returned 0x0 [0042.120] lstrlenW (lpString=".Mdf") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.120] lstrlenW (lpString=".dat") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".dat") returned 0x0 [0042.120] lstrlenW (lpString=".DAT") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".DAT") returned 0x0 [0042.120] lstrlenW (lpString=".ldf") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".ldf") returned 0x0 [0042.120] lstrlenW (lpString=".LDF") returned 4 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch=".LDF") returned 0x0 [0042.120] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.120] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.121] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.121] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.121] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16212242499) returned 1 [0042.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7ec2c10, dwHighDateTime=0x1d585b4)) [0042.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299750 [0042.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299750 | out: hHeap=0x260000) returned 1 [0042.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.122] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.122] GetLastError () returned 0x0 [0042.122] GetLastError () returned 0x0 [0042.122] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.122] GetLastError () returned 0x0 [0042.122] GetLastError () returned 0x0 [0042.122] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x391, lpOverlapped=0x0) returned 1 [0042.124] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffc6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.124] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x391, lpOverlapped=0x0) returned 1 [0042.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.124] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.124] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.124] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.124] CloseHandle (hObject=0x104) returned 1 [0042.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2b3fe0 [0042.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.125] GetLastError () returned 0x0 [0042.125] RtlWakeConditionVariable () returned 0x27e828 [0042.125] GetCurrentThreadId () returned 0x99c [0042.125] GetCurrentThreadId () returned 0x99c [0042.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee430 | out: hHeap=0x260000) returned 1 [0042.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299718 | out: hHeap=0x260000) returned 1 [0042.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee430 [0042.125] lstrlenW (lpString=".ldf") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.126] lstrlenW (lpString=".vhd") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.126] lstrlenW (lpString=".vhdx") returned 5 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.126] lstrlenW (lpString=".pst") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.126] lstrlenW (lpString=".ost") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.126] lstrlenW (lpString=".bak") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.126] lstrlenW (lpString=".bac") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.126] lstrlenW (lpString=".sys") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.126] lstrlenW (lpString=".v2i") returned 4 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.126] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.127] lstrlenW (lpString=".sql") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.127] lstrlenW (lpString=".mdf") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.127] lstrlenW (lpString=".txt") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.127] lstrlenW (lpString=".dbf") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.127] lstrlenW (lpString=".ckp") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.127] lstrlenW (lpString=".dacpac") returned 7 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.127] lstrlenW (lpString=".db3") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.127] lstrlenW (lpString=".dtxs") returned 5 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.127] lstrlenW (lpString=".mdt") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.127] lstrlenW (lpString=".sdf") returned 4 [0042.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.128] lstrlenW (lpString=".MDF") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.128] lstrlenW (lpString=".DBF") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.128] lstrlenW (lpString=".DB") returned 3 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.128] lstrlenW (lpString=".db") returned 3 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.128] lstrlenW (lpString=".ndf") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.128] lstrlenW (lpString=".NDF") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.128] lstrlenW (lpString=".Mdf") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.128] lstrlenW (lpString=".dat") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.128] lstrlenW (lpString=".DAT") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.128] lstrlenW (lpString=".ldf") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.128] lstrlenW (lpString=".LDF") returned 4 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.128] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0042.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.128] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.129] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.129] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.129] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16213040357) returned 1 [0042.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7ec2c10, dwHighDateTime=0x1d585b4)) [0042.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299718 [0042.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299718 | out: hHeap=0x260000) returned 1 [0042.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.130] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.130] GetLastError () returned 0x0 [0042.130] GetLastError () returned 0x0 [0042.130] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.130] GetLastError () returned 0x0 [0042.130] GetLastError () returned 0x0 [0042.130] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0042.132] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.132] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0042.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.132] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.132] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.132] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.132] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.132] CloseHandle (hObject=0x104) returned 1 [0042.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.133] GetLastError () returned 0x0 [0042.133] RtlWakeConditionVariable () returned 0x27e828 [0042.133] GetCurrentThreadId () returned 0x99c [0042.133] GetCurrentThreadId () returned 0x99c [0042.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0042.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996e0 | out: hHeap=0x260000) returned 1 [0042.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.135] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.135] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.135] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.135] WriteFile (in: hFile=0x104, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.136] CloseHandle (hObject=0x104) returned 1 [0042.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.136] RtlWakeConditionVariable () returned 0x27e828 [0042.137] GetCurrentThreadId () returned 0x99c [0042.137] GetCurrentThreadId () returned 0x99c [0042.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0042.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299ac0 | out: hHeap=0x260000) returned 1 [0042.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0042.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d9460 [0042.137] lstrlenW (lpString=".ldf") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".ldf") returned 0x0 [0042.137] lstrlenW (lpString=".vhd") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".vhd") returned 0x0 [0042.137] lstrlenW (lpString=".vhdx") returned 5 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.137] lstrlenW (lpString=".pst") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".pst") returned 0x0 [0042.137] lstrlenW (lpString=".ost") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".ost") returned 0x0 [0042.137] lstrlenW (lpString=".bak") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".bak") returned 0x0 [0042.137] lstrlenW (lpString=".bac") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".bac") returned 0x0 [0042.137] lstrlenW (lpString=".sys") returned 4 [0042.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".sys") returned 0x0 [0042.137] lstrlenW (lpString=".v2i") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".v2i") returned 0x0 [0042.138] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.138] lstrlenW (lpString=".sql") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".sql") returned 0x0 [0042.138] lstrlenW (lpString=".mdf") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".mdf") returned 0x0 [0042.138] lstrlenW (lpString=".txt") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".txt") returned 0x0 [0042.138] lstrlenW (lpString=".dbf") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".dbf") returned 0x0 [0042.138] lstrlenW (lpString=".ckp") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".ckp") returned 0x0 [0042.138] lstrlenW (lpString=".dacpac") returned 7 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.138] lstrlenW (lpString=".db3") returned 4 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".db3") returned 0x0 [0042.138] lstrlenW (lpString=".dtxs") returned 5 [0042.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.138] lstrlenW (lpString=".mdt") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".mdt") returned 0x0 [0042.139] lstrlenW (lpString=".sdf") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".sdf") returned 0x0 [0042.139] lstrlenW (lpString=".MDF") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".MDF") returned 0x0 [0042.139] lstrlenW (lpString=".DBF") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".DBF") returned 0x0 [0042.139] lstrlenW (lpString=".DB") returned 3 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".DB") returned 0x0 [0042.139] lstrlenW (lpString=".db") returned 3 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".db") returned 0x0 [0042.139] lstrlenW (lpString=".ndf") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".ndf") returned 0x0 [0042.139] lstrlenW (lpString=".NDF") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".NDF") returned 0x0 [0042.139] lstrlenW (lpString=".Mdf") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.139] lstrlenW (lpString=".dat") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".dat") returned 0x0 [0042.139] lstrlenW (lpString=".DAT") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".DAT") returned 0x0 [0042.139] lstrlenW (lpString=".ldf") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".ldf") returned 0x0 [0042.139] lstrlenW (lpString=".LDF") returned 4 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch=".LDF") returned 0x0 [0042.139] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.139] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.140] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.140] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0042.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0042.140] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16214149347) returned 1 [0042.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7ee8d70, dwHighDateTime=0x1d585b4)) [0042.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0042.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0042.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0042.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0042.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0042.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.141] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.141] GetLastError () returned 0x0 [0042.141] GetLastError () returned 0x0 [0042.141] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.141] GetLastError () returned 0x0 [0042.141] GetLastError () returned 0x0 [0042.141] ReadFile (in: hFile=0x104, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x4cf, lpOverlapped=0x0) returned 1 [0042.184] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffb31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.184] WriteFile (in: hFile=0x104, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x4cf, lpOverlapped=0x0) returned 1 [0042.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.185] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.185] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.185] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.185] CloseHandle (hObject=0x104) returned 1 [0042.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x298fd0 [0042.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0042.188] GetLastError () returned 0x0 [0042.188] RtlWakeConditionVariable () returned 0x27e828 [0042.188] GetCurrentThreadId () returned 0x99c [0042.188] GetCurrentThreadId () returned 0x99c [0042.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0042.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0042.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0042.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0042.188] lstrlenW (lpString=".ldf") returned 4 [0042.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".ldf") returned 0x0 [0042.188] lstrlenW (lpString=".vhd") returned 4 [0042.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".vhd") returned 0x0 [0042.188] lstrlenW (lpString=".vhdx") returned 5 [0042.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".vhdx") returned 0x0 [0042.188] lstrlenW (lpString=".pst") returned 4 [0042.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".pst") returned 0x0 [0042.189] lstrlenW (lpString=".ost") returned 4 [0042.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".ost") returned 0x0 [0042.189] lstrlenW (lpString=".bak") returned 4 [0042.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".bak") returned 0x0 [0042.189] lstrlenW (lpString=".bac") returned 4 [0042.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".bac") returned 0x0 [0042.189] lstrlenW (lpString=".sys") returned 4 [0042.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".sys") returned 0x0 [0042.189] lstrlenW (lpString=".v2i") returned 4 [0042.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".v2i") returned 0x0 [0042.189] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.235] lstrlenW (lpString=".sql") returned 4 [0042.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".sql") returned 0x0 [0042.235] lstrlenW (lpString=".mdf") returned 4 [0042.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".mdf") returned 0x0 [0042.235] lstrlenW (lpString=".txt") returned 4 [0042.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".txt") returned 0x0 [0042.235] lstrlenW (lpString=".dbf") returned 4 [0042.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".dbf") returned 0x0 [0042.235] lstrlenW (lpString=".ckp") returned 4 [0042.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".ckp") returned 0x0 [0042.235] lstrlenW (lpString=".dacpac") returned 7 [0042.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".dacpac") returned 0x0 [0042.236] lstrlenW (lpString=".db3") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".db3") returned 0x0 [0042.236] lstrlenW (lpString=".dtxs") returned 5 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".dtxs") returned 0x0 [0042.236] lstrlenW (lpString=".mdt") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".mdt") returned 0x0 [0042.236] lstrlenW (lpString=".sdf") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".sdf") returned 0x0 [0042.236] lstrlenW (lpString=".MDF") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".MDF") returned 0x0 [0042.236] lstrlenW (lpString=".DBF") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".DBF") returned 0x0 [0042.236] lstrlenW (lpString=".DB") returned 3 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".DB") returned 0x0 [0042.236] lstrlenW (lpString=".db") returned 3 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".db") returned 0x0 [0042.236] lstrlenW (lpString=".ndf") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".ndf") returned 0x0 [0042.236] lstrlenW (lpString=".NDF") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".NDF") returned 0x0 [0042.236] lstrlenW (lpString=".Mdf") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".Mdf") returned 0x0 [0042.236] lstrlenW (lpString=".dat") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".dat") returned 0x0 [0042.236] lstrlenW (lpString=".DAT") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".DAT") returned 0x0 [0042.236] lstrlenW (lpString=".ldf") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".ldf") returned 0x0 [0042.236] lstrlenW (lpString=".LDF") returned 4 [0042.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch=".LDF") returned 0x0 [0042.236] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.237] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.237] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.238] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16223887835) returned 1 [0042.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7fcd5b0, dwHighDateTime=0x1d585b4)) [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.238] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.238] GetLastError () returned 0x0 [0042.238] GetLastError () returned 0x0 [0042.239] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.239] GetLastError () returned 0x0 [0042.239] GetLastError () returned 0x0 [0042.239] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x333, lpOverlapped=0x0) returned 1 [0042.241] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffccd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.242] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x333, lpOverlapped=0x0) returned 1 [0042.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.242] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.242] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.242] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.242] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.242] CloseHandle (hObject=0x10c) returned 1 [0042.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2f5320 [0042.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0042.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.243] GetLastError () returned 0x0 [0042.243] RtlWakeConditionVariable () returned 0x27e828 [0042.243] GetCurrentThreadId () returned 0x99c [0042.243] GetCurrentThreadId () returned 0x99c [0042.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee9a0 [0042.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eeb70 | out: hHeap=0x260000) returned 1 [0042.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0042.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eeb70 [0042.243] lstrlenW (lpString=".ldf") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".ldf") returned 0x0 [0042.243] lstrlenW (lpString=".vhd") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".vhd") returned 0x0 [0042.243] lstrlenW (lpString=".vhdx") returned 5 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".vhdx") returned 0x0 [0042.243] lstrlenW (lpString=".pst") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".pst") returned 0x0 [0042.243] lstrlenW (lpString=".ost") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".ost") returned 0x0 [0042.243] lstrlenW (lpString=".bak") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".bak") returned 0x0 [0042.243] lstrlenW (lpString=".bac") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".bac") returned 0x0 [0042.243] lstrlenW (lpString=".sys") returned 4 [0042.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".sys") returned 0x0 [0042.244] lstrlenW (lpString=".v2i") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".v2i") returned 0x0 [0042.244] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0042.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.244] lstrlenW (lpString=".sql") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".sql") returned 0x0 [0042.244] lstrlenW (lpString=".mdf") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".mdf") returned 0x0 [0042.244] lstrlenW (lpString=".txt") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".txt") returned 0x0 [0042.244] lstrlenW (lpString=".dbf") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".dbf") returned 0x0 [0042.244] lstrlenW (lpString=".ckp") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".ckp") returned 0x0 [0042.244] lstrlenW (lpString=".dacpac") returned 7 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".dacpac") returned 0x0 [0042.244] lstrlenW (lpString=".db3") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".db3") returned 0x0 [0042.244] lstrlenW (lpString=".dtxs") returned 5 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".dtxs") returned 0x0 [0042.244] lstrlenW (lpString=".mdt") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".mdt") returned 0x0 [0042.244] lstrlenW (lpString=".sdf") returned 4 [0042.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".sdf") returned 0x0 [0042.245] lstrlenW (lpString=".MDF") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".MDF") returned 0x0 [0042.245] lstrlenW (lpString=".DBF") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".DBF") returned 0x0 [0042.245] lstrlenW (lpString=".DB") returned 3 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".DB") returned 0x0 [0042.245] lstrlenW (lpString=".db") returned 3 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".db") returned 0x0 [0042.245] lstrlenW (lpString=".ndf") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".ndf") returned 0x0 [0042.245] lstrlenW (lpString=".NDF") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".NDF") returned 0x0 [0042.245] lstrlenW (lpString=".Mdf") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".Mdf") returned 0x0 [0042.245] lstrlenW (lpString=".dat") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".dat") returned 0x0 [0042.245] lstrlenW (lpString=".DAT") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".DAT") returned 0x0 [0042.245] lstrlenW (lpString=".ldf") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".ldf") returned 0x0 [0042.245] lstrlenW (lpString=".LDF") returned 4 [0042.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch=".LDF") returned 0x0 [0042.246] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.246] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.246] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.247] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16224817370) returned 1 [0042.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7ff3710, dwHighDateTime=0x1d585b4)) [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299788 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.248] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.248] GetLastError () returned 0x0 [0042.248] GetLastError () returned 0x0 [0042.248] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.248] GetLastError () returned 0x0 [0042.248] GetLastError () returned 0x0 [0042.248] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x6931, lpOverlapped=0x0) returned 1 [0042.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff96cf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.250] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x6931, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x6931, lpOverlapped=0x0) returned 1 [0042.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.250] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.250] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.250] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.250] CloseHandle (hObject=0x10c) returned 1 [0042.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.[deadmin@cock.li].deadmin")) returned 1 [0042.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.251] GetLastError () returned 0x0 [0042.251] RtlWakeConditionVariable () returned 0x27e828 [0042.251] GetCurrentThreadId () returned 0x99c [0042.251] GetCurrentThreadId () returned 0x99c [0042.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee9a0 [0042.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eec58 | out: hHeap=0x260000) returned 1 [0042.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0042.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eec58 [0042.251] lstrlenW (lpString=".ldf") returned 4 [0042.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".ldf") returned 0x0 [0042.251] lstrlenW (lpString=".vhd") returned 4 [0042.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".vhd") returned 0x0 [0042.251] lstrlenW (lpString=".vhdx") returned 5 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".vhdx") returned 0x0 [0042.252] lstrlenW (lpString=".pst") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".pst") returned 0x0 [0042.252] lstrlenW (lpString=".ost") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".ost") returned 0x0 [0042.252] lstrlenW (lpString=".bak") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".bak") returned 0x0 [0042.252] lstrlenW (lpString=".bac") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".bac") returned 0x0 [0042.252] lstrlenW (lpString=".sys") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".sys") returned 0x0 [0042.252] lstrlenW (lpString=".v2i") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".v2i") returned 0x0 [0042.252] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0042.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.253] lstrlenW (lpString=".sql") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".sql") returned 0x0 [0042.253] lstrlenW (lpString=".mdf") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".mdf") returned 0x0 [0042.253] lstrlenW (lpString=".txt") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".txt") returned 0x0 [0042.253] lstrlenW (lpString=".dbf") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".dbf") returned 0x0 [0042.253] lstrlenW (lpString=".ckp") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".ckp") returned 0x0 [0042.253] lstrlenW (lpString=".dacpac") returned 7 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".dacpac") returned 0x0 [0042.253] lstrlenW (lpString=".db3") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".db3") returned 0x0 [0042.253] lstrlenW (lpString=".dtxs") returned 5 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".dtxs") returned 0x0 [0042.253] lstrlenW (lpString=".mdt") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".mdt") returned 0x0 [0042.253] lstrlenW (lpString=".sdf") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".sdf") returned 0x0 [0042.253] lstrlenW (lpString=".MDF") returned 4 [0042.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".MDF") returned 0x0 [0042.254] lstrlenW (lpString=".DBF") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".DBF") returned 0x0 [0042.254] lstrlenW (lpString=".DB") returned 3 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".DB") returned 0x0 [0042.254] lstrlenW (lpString=".db") returned 3 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".db") returned 0x0 [0042.254] lstrlenW (lpString=".ndf") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".ndf") returned 0x0 [0042.254] lstrlenW (lpString=".NDF") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".NDF") returned 0x0 [0042.254] lstrlenW (lpString=".Mdf") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".Mdf") returned 0x0 [0042.254] lstrlenW (lpString=".dat") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".dat") returned 0x0 [0042.254] lstrlenW (lpString=".DAT") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".DAT") returned 0x0 [0042.254] lstrlenW (lpString=".ldf") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".ldf") returned 0x0 [0042.254] lstrlenW (lpString=".LDF") returned 4 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch=".LDF") returned 0x0 [0042.254] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.254] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.255] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.255] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.255] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16225626713) returned 1 [0042.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa7ff3710, dwHighDateTime=0x1d585b4)) [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.256] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.256] GetLastError () returned 0x0 [0042.256] GetLastError () returned 0x0 [0042.256] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.256] GetLastError () returned 0x0 [0042.256] GetLastError () returned 0x0 [0042.256] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x6a3b, lpOverlapped=0x0) returned 1 [0042.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff95c5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.258] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x6a3b, lpOverlapped=0x0) returned 1 [0042.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.258] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.258] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.258] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.258] CloseHandle (hObject=0x10c) returned 1 [0042.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3fe0 [0042.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.[deadmin@cock.li].deadmin")) returned 1 [0042.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.259] GetLastError () returned 0x0 [0042.259] RtlWakeConditionVariable () returned 0x27e828 [0042.259] GetCurrentThreadId () returned 0x99c [0042.259] GetCurrentThreadId () returned 0x99c [0042.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee9a0 [0042.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eed40 | out: hHeap=0x260000) returned 1 [0042.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0042.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eed40 [0042.259] lstrlenW (lpString=".ldf") returned 4 [0042.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".ldf") returned 0x0 [0042.259] lstrlenW (lpString=".vhd") returned 4 [0042.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".vhd") returned 0x0 [0042.260] lstrlenW (lpString=".vhdx") returned 5 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".vhdx") returned 0x0 [0042.260] lstrlenW (lpString=".pst") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".pst") returned 0x0 [0042.260] lstrlenW (lpString=".ost") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".ost") returned 0x0 [0042.260] lstrlenW (lpString=".bak") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".bak") returned 0x0 [0042.260] lstrlenW (lpString=".bac") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".bac") returned 0x0 [0042.260] lstrlenW (lpString=".sys") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".sys") returned 0x0 [0042.260] lstrlenW (lpString=".v2i") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".v2i") returned 0x0 [0042.260] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0042.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.263] lstrlenW (lpString=".sql") returned 4 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".sql") returned 0x0 [0042.263] lstrlenW (lpString=".mdf") returned 4 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".mdf") returned 0x0 [0042.263] lstrlenW (lpString=".txt") returned 4 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".txt") returned 0x0 [0042.263] lstrlenW (lpString=".dbf") returned 4 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".dbf") returned 0x0 [0042.263] lstrlenW (lpString=".ckp") returned 4 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".ckp") returned 0x0 [0042.263] lstrlenW (lpString=".dacpac") returned 7 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".dacpac") returned 0x0 [0042.263] lstrlenW (lpString=".db3") returned 4 [0042.263] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".db3") returned 0x0 [0042.264] lstrlenW (lpString=".dtxs") returned 5 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".dtxs") returned 0x0 [0042.264] lstrlenW (lpString=".mdt") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".mdt") returned 0x0 [0042.264] lstrlenW (lpString=".sdf") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".sdf") returned 0x0 [0042.264] lstrlenW (lpString=".MDF") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".MDF") returned 0x0 [0042.264] lstrlenW (lpString=".DBF") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".DBF") returned 0x0 [0042.264] lstrlenW (lpString=".DB") returned 3 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".DB") returned 0x0 [0042.264] lstrlenW (lpString=".db") returned 3 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".db") returned 0x0 [0042.264] lstrlenW (lpString=".ndf") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".ndf") returned 0x0 [0042.264] lstrlenW (lpString=".NDF") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".NDF") returned 0x0 [0042.264] lstrlenW (lpString=".Mdf") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".Mdf") returned 0x0 [0042.264] lstrlenW (lpString=".dat") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".dat") returned 0x0 [0042.264] lstrlenW (lpString=".DAT") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".DAT") returned 0x0 [0042.264] lstrlenW (lpString=".ldf") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".ldf") returned 0x0 [0042.264] lstrlenW (lpString=".LDF") returned 4 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch=".LDF") returned 0x0 [0042.264] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.265] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2b3f18) returned 1 [0042.266] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.266] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0042.266] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16226904496) returned 1 [0042.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8019870, dwHighDateTime=0x1d585b4)) [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.268] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.269] GetLastError () returned 0x0 [0042.269] GetLastError () returned 0x0 [0042.269] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.269] GetLastError () returned 0x0 [0042.269] GetLastError () returned 0x0 [0042.269] ReadFile (in: hFile=0x10c, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x238fdb0*=0x10676, lpOverlapped=0x0) returned 1 [0042.346] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffef98a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.347] WriteFile (in: hFile=0x10c, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x238fdb0*=0x10676, lpOverlapped=0x0) returned 1 [0042.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0042.347] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.347] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.347] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.347] CloseHandle (hObject=0x10c) returned 1 [0042.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x298fd0 [0042.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.[deadmin@cock.li].deadmin")) returned 1 [0042.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.348] GetLastError () returned 0x0 [0042.348] RtlWakeConditionVariable () returned 0x27e828 [0042.348] GetCurrentThreadId () returned 0x99c [0042.348] GetCurrentThreadId () returned 0x99c [0042.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d68 | out: hHeap=0x260000) returned 1 [0042.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0042.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9d68 [0042.348] lstrlenW (lpString=".ldf") returned 4 [0042.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".ldf") returned 0x0 [0042.348] lstrlenW (lpString=".vhd") returned 4 [0042.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".vhd") returned 0x0 [0042.348] lstrlenW (lpString=".vhdx") returned 5 [0042.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".vhdx") returned 0x0 [0042.348] lstrlenW (lpString=".pst") returned 4 [0042.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".pst") returned 0x0 [0042.349] lstrlenW (lpString=".ost") returned 4 [0042.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".ost") returned 0x0 [0042.349] lstrlenW (lpString=".bak") returned 4 [0042.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".bak") returned 0x0 [0042.349] lstrlenW (lpString=".bac") returned 4 [0042.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".bac") returned 0x0 [0042.349] lstrlenW (lpString=".sys") returned 4 [0042.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".sys") returned 0x0 [0042.349] lstrlenW (lpString=".v2i") returned 4 [0042.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".v2i") returned 0x0 [0042.349] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.441] lstrlenW (lpString=".sql") returned 4 [0042.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".sql") returned 0x0 [0042.441] lstrlenW (lpString=".mdf") returned 4 [0042.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".mdf") returned 0x0 [0042.441] lstrlenW (lpString=".txt") returned 4 [0042.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".txt") returned 0x0 [0042.441] lstrlenW (lpString=".dbf") returned 4 [0042.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".dbf") returned 0x0 [0042.442] lstrlenW (lpString=".ckp") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".ckp") returned 0x0 [0042.442] lstrlenW (lpString=".dacpac") returned 7 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".dacpac") returned 0x0 [0042.442] lstrlenW (lpString=".db3") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".db3") returned 0x0 [0042.442] lstrlenW (lpString=".dtxs") returned 5 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".dtxs") returned 0x0 [0042.442] lstrlenW (lpString=".mdt") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".mdt") returned 0x0 [0042.442] lstrlenW (lpString=".sdf") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".sdf") returned 0x0 [0042.442] lstrlenW (lpString=".MDF") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".MDF") returned 0x0 [0042.442] lstrlenW (lpString=".DBF") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".DBF") returned 0x0 [0042.442] lstrlenW (lpString=".DB") returned 3 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".DB") returned 0x0 [0042.442] lstrlenW (lpString=".db") returned 3 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".db") returned 0x0 [0042.442] lstrlenW (lpString=".ndf") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".ndf") returned 0x0 [0042.442] lstrlenW (lpString=".NDF") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".NDF") returned 0x0 [0042.442] lstrlenW (lpString=".Mdf") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".Mdf") returned 0x0 [0042.442] lstrlenW (lpString=".dat") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".dat") returned 0x0 [0042.442] lstrlenW (lpString=".DAT") returned 4 [0042.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".DAT") returned 0x0 [0042.442] lstrlenW (lpString=".ldf") returned 4 [0042.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".ldf") returned 0x0 [0042.443] lstrlenW (lpString=".LDF") returned 4 [0042.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch=".LDF") returned 0x0 [0042.443] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.443] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.443] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.444] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.444] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16244481892) returned 1 [0042.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa81bc790, dwHighDateTime=0x1d585b4)) [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f03f0 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03f0 | out: hHeap=0x260000) returned 1 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.444] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.444] GetLastError () returned 0x0 [0042.444] GetLastError () returned 0x0 [0042.445] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.445] GetLastError () returned 0x0 [0042.445] GetLastError () returned 0x0 [0042.445] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.449] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.449] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.450] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.450] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.453] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.453] CloseHandle (hObject=0x108) returned 1 [0042.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313128 [0042.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313128 | out: hHeap=0x260000) returned 1 [0042.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.454] GetLastError () returned 0x0 [0042.454] RtlWakeConditionVariable () returned 0x27e828 [0042.454] GetCurrentThreadId () returned 0x99c [0042.454] GetCurrentThreadId () returned 0x99c [0042.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef2b0 [0042.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef568 | out: hHeap=0x260000) returned 1 [0042.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0042.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef568 [0042.454] lstrlenW (lpString=".ldf") returned 4 [0042.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".ldf") returned 0x0 [0042.454] lstrlenW (lpString=".vhd") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".vhd") returned 0x0 [0042.455] lstrlenW (lpString=".vhdx") returned 5 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".vhdx") returned 0x0 [0042.455] lstrlenW (lpString=".pst") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".pst") returned 0x0 [0042.455] lstrlenW (lpString=".ost") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".ost") returned 0x0 [0042.455] lstrlenW (lpString=".bak") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".bak") returned 0x0 [0042.455] lstrlenW (lpString=".bac") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".bac") returned 0x0 [0042.455] lstrlenW (lpString=".sys") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".sys") returned 0x0 [0042.455] lstrlenW (lpString=".v2i") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".v2i") returned 0x0 [0042.455] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.455] lstrlenW (lpString=".sql") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".sql") returned 0x0 [0042.455] lstrlenW (lpString=".mdf") returned 4 [0042.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".mdf") returned 0x0 [0042.455] lstrlenW (lpString=".txt") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".txt") returned 0x0 [0042.456] lstrlenW (lpString=".dbf") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".dbf") returned 0x0 [0042.456] lstrlenW (lpString=".ckp") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".ckp") returned 0x0 [0042.456] lstrlenW (lpString=".dacpac") returned 7 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".dacpac") returned 0x0 [0042.456] lstrlenW (lpString=".db3") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".db3") returned 0x0 [0042.456] lstrlenW (lpString=".dtxs") returned 5 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".dtxs") returned 0x0 [0042.456] lstrlenW (lpString=".mdt") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".mdt") returned 0x0 [0042.456] lstrlenW (lpString=".sdf") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".sdf") returned 0x0 [0042.456] lstrlenW (lpString=".MDF") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".MDF") returned 0x0 [0042.456] lstrlenW (lpString=".DBF") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".DBF") returned 0x0 [0042.456] lstrlenW (lpString=".DB") returned 3 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".DB") returned 0x0 [0042.456] lstrlenW (lpString=".db") returned 3 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".db") returned 0x0 [0042.456] lstrlenW (lpString=".ndf") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".ndf") returned 0x0 [0042.456] lstrlenW (lpString=".NDF") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".NDF") returned 0x0 [0042.456] lstrlenW (lpString=".Mdf") returned 4 [0042.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".Mdf") returned 0x0 [0042.456] lstrlenW (lpString=".dat") returned 4 [0042.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".dat") returned 0x0 [0042.457] lstrlenW (lpString=".DAT") returned 4 [0042.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".DAT") returned 0x0 [0042.457] lstrlenW (lpString=".ldf") returned 4 [0042.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".ldf") returned 0x0 [0042.457] lstrlenW (lpString=".LDF") returned 4 [0042.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch=".LDF") returned 0x0 [0042.457] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.457] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.458] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.458] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.458] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16245893760) returned 1 [0042.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa81e28f0, dwHighDateTime=0x1d585b4)) [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294fc8 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.458] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.458] GetLastError () returned 0x0 [0042.459] GetLastError () returned 0x0 [0042.459] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.459] GetLastError () returned 0x0 [0042.459] GetLastError () returned 0x0 [0042.459] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x1915, lpOverlapped=0x0) returned 1 [0042.463] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe6eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.463] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x1915, lpOverlapped=0x0) returned 1 [0042.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.463] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.463] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.463] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.464] CloseHandle (hObject=0x108) returned 1 [0042.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x295678 [0042.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295678 | out: hHeap=0x260000) returned 1 [0042.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.464] GetLastError () returned 0x0 [0042.464] RtlWakeConditionVariable () returned 0x27e828 [0042.464] GetCurrentThreadId () returned 0x99c [0042.464] GetCurrentThreadId () returned 0x99c [0042.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3838 [0042.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295580 | out: hHeap=0x260000) returned 1 [0042.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0042.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.465] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.465] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.465] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.465] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.466] CloseHandle (hObject=0x108) returned 1 [0042.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0042.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3838 | out: hHeap=0x260000) returned 1 [0042.466] RtlWakeConditionVariable () returned 0x27e828 [0042.466] GetCurrentThreadId () returned 0x99c [0042.466] GetCurrentThreadId () returned 0x99c [0042.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3838 [0042.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3930 | out: hHeap=0x260000) returned 1 [0042.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0042.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.466] lstrlenW (lpString=".ldf") returned 4 [0042.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".ldf") returned 0x0 [0042.466] lstrlenW (lpString=".vhd") returned 4 [0042.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".vhd") returned 0x0 [0042.466] lstrlenW (lpString=".vhdx") returned 5 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.467] lstrlenW (lpString=".pst") returned 4 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".pst") returned 0x0 [0042.467] lstrlenW (lpString=".ost") returned 4 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".ost") returned 0x0 [0042.467] lstrlenW (lpString=".bak") returned 4 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".bak") returned 0x0 [0042.467] lstrlenW (lpString=".bac") returned 4 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".bac") returned 0x0 [0042.467] lstrlenW (lpString=".sys") returned 4 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".sys") returned 0x0 [0042.467] lstrlenW (lpString=".v2i") returned 4 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".v2i") returned 0x0 [0042.467] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.472] lstrlenW (lpString=".sql") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".sql") returned 0x0 [0042.472] lstrlenW (lpString=".mdf") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".mdf") returned 0x0 [0042.472] lstrlenW (lpString=".txt") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".txt") returned 0x0 [0042.472] lstrlenW (lpString=".dbf") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".dbf") returned 0x0 [0042.472] lstrlenW (lpString=".ckp") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".ckp") returned 0x0 [0042.472] lstrlenW (lpString=".dacpac") returned 7 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.472] lstrlenW (lpString=".db3") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".db3") returned 0x0 [0042.472] lstrlenW (lpString=".dtxs") returned 5 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.472] lstrlenW (lpString=".mdt") returned 4 [0042.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".mdt") returned 0x0 [0042.473] lstrlenW (lpString=".sdf") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".sdf") returned 0x0 [0042.473] lstrlenW (lpString=".MDF") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".MDF") returned 0x0 [0042.473] lstrlenW (lpString=".DBF") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".DBF") returned 0x0 [0042.473] lstrlenW (lpString=".DB") returned 3 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".DB") returned 0x0 [0042.473] lstrlenW (lpString=".db") returned 3 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".db") returned 0x0 [0042.473] lstrlenW (lpString=".ndf") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".ndf") returned 0x0 [0042.473] lstrlenW (lpString=".NDF") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".NDF") returned 0x0 [0042.473] lstrlenW (lpString=".Mdf") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.473] lstrlenW (lpString=".dat") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".dat") returned 0x0 [0042.473] lstrlenW (lpString=".DAT") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".DAT") returned 0x0 [0042.473] lstrlenW (lpString=".ldf") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".ldf") returned 0x0 [0042.473] lstrlenW (lpString=".LDF") returned 4 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch=".LDF") returned 0x0 [0042.473] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.473] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.474] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.474] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16247547328) returned 1 [0042.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8208a50, dwHighDateTime=0x1d585b4)) [0042.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295118 [0042.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0042.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.475] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.475] GetLastError () returned 0x0 [0042.475] GetLastError () returned 0x0 [0042.475] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.475] GetLastError () returned 0x0 [0042.475] GetLastError () returned 0x0 [0042.475] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0042.551] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.551] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0042.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.551] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.551] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.551] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.551] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.551] CloseHandle (hObject=0x108) returned 1 [0042.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2edae8 [0042.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edae8 | out: hHeap=0x260000) returned 1 [0042.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.552] GetLastError () returned 0x0 [0042.552] RtlWakeConditionVariable () returned 0x27e828 [0042.552] GetCurrentThreadId () returned 0x99c [0042.552] GetCurrentThreadId () returned 0x99c [0042.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5560 | out: hHeap=0x260000) returned 1 [0042.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0042.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0042.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.645] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.645] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.645] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.645] WriteFile (in: hFile=0x10c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.646] CloseHandle (hObject=0x10c) returned 1 [0042.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0042.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.646] RtlWakeConditionVariable () returned 0x27e828 [0042.646] GetCurrentThreadId () returned 0x99c [0042.646] GetCurrentThreadId () returned 0x99c [0042.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0042.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0042.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0042.646] lstrlenW (lpString=".ldf") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.647] lstrlenW (lpString=".vhd") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.647] lstrlenW (lpString=".vhdx") returned 5 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.647] lstrlenW (lpString=".pst") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.647] lstrlenW (lpString=".ost") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.647] lstrlenW (lpString=".bak") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.647] lstrlenW (lpString=".bac") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.647] lstrlenW (lpString=".sys") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.647] lstrlenW (lpString=".v2i") returned 4 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.647] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.648] lstrlenW (lpString=".sql") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.648] lstrlenW (lpString=".mdf") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.648] lstrlenW (lpString=".txt") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.648] lstrlenW (lpString=".dbf") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.648] lstrlenW (lpString=".ckp") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.648] lstrlenW (lpString=".dacpac") returned 7 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.648] lstrlenW (lpString=".db3") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.648] lstrlenW (lpString=".dtxs") returned 5 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.648] lstrlenW (lpString=".mdt") returned 4 [0042.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.649] lstrlenW (lpString=".sdf") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.649] lstrlenW (lpString=".MDF") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.649] lstrlenW (lpString=".DBF") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.649] lstrlenW (lpString=".DB") returned 3 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.649] lstrlenW (lpString=".db") returned 3 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.649] lstrlenW (lpString=".ndf") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.649] lstrlenW (lpString=".NDF") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.649] lstrlenW (lpString=".Mdf") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.649] lstrlenW (lpString=".dat") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.649] lstrlenW (lpString=".DAT") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.649] lstrlenW (lpString=".ldf") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.649] lstrlenW (lpString=".LDF") returned 4 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.649] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.649] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.650] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.650] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.650] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16265160161) returned 1 [0042.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa83d1ad0, dwHighDateTime=0x1d585b4)) [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953f0 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.651] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.651] GetLastError () returned 0x0 [0042.651] GetLastError () returned 0x0 [0042.651] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.651] GetLastError () returned 0x0 [0042.651] GetLastError () returned 0x0 [0042.652] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x5061, lpOverlapped=0x0) returned 1 [0042.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffaf9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.654] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x5061, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x5061, lpOverlapped=0x0) returned 1 [0042.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.654] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.655] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.655] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.655] CloseHandle (hObject=0x10c) returned 1 [0042.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.655] GetLastError () returned 0x0 [0042.655] RtlWakeConditionVariable () returned 0x27e828 [0042.655] GetCurrentThreadId () returned 0x99c [0042.656] GetCurrentThreadId () returned 0x99c [0042.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fcb8 | out: hHeap=0x260000) returned 1 [0042.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953b8 | out: hHeap=0x260000) returned 1 [0042.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fcb8 [0042.656] lstrlenW (lpString=".ldf") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".ldf") returned 0x0 [0042.656] lstrlenW (lpString=".vhd") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".vhd") returned 0x0 [0042.656] lstrlenW (lpString=".vhdx") returned 5 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".vhdx") returned 0x0 [0042.656] lstrlenW (lpString=".pst") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".pst") returned 0x0 [0042.656] lstrlenW (lpString=".ost") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".ost") returned 0x0 [0042.656] lstrlenW (lpString=".bak") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".bak") returned 0x0 [0042.656] lstrlenW (lpString=".bac") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".bac") returned 0x0 [0042.656] lstrlenW (lpString=".sys") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".sys") returned 0x0 [0042.656] lstrlenW (lpString=".v2i") returned 4 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".v2i") returned 0x0 [0042.656] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.657] lstrlenW (lpString=".sql") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".sql") returned 0x0 [0042.657] lstrlenW (lpString=".mdf") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".mdf") returned 0x0 [0042.657] lstrlenW (lpString=".txt") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".txt") returned 0x0 [0042.657] lstrlenW (lpString=".dbf") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".dbf") returned 0x0 [0042.657] lstrlenW (lpString=".ckp") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".ckp") returned 0x0 [0042.657] lstrlenW (lpString=".dacpac") returned 7 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".dacpac") returned 0x0 [0042.657] lstrlenW (lpString=".db3") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".db3") returned 0x0 [0042.657] lstrlenW (lpString=".dtxs") returned 5 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".dtxs") returned 0x0 [0042.657] lstrlenW (lpString=".mdt") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".mdt") returned 0x0 [0042.657] lstrlenW (lpString=".sdf") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".sdf") returned 0x0 [0042.657] lstrlenW (lpString=".MDF") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".MDF") returned 0x0 [0042.657] lstrlenW (lpString=".DBF") returned 4 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".DBF") returned 0x0 [0042.657] lstrlenW (lpString=".DB") returned 3 [0042.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".DB") returned 0x0 [0042.657] lstrlenW (lpString=".db") returned 3 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".db") returned 0x0 [0042.658] lstrlenW (lpString=".ndf") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".ndf") returned 0x0 [0042.658] lstrlenW (lpString=".NDF") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".NDF") returned 0x0 [0042.658] lstrlenW (lpString=".Mdf") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".Mdf") returned 0x0 [0042.658] lstrlenW (lpString=".dat") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".dat") returned 0x0 [0042.658] lstrlenW (lpString=".DAT") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".DAT") returned 0x0 [0042.658] lstrlenW (lpString=".ldf") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".ldf") returned 0x0 [0042.658] lstrlenW (lpString=".LDF") returned 4 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch=".LDF") returned 0x0 [0042.658] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.658] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.659] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.659] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.659] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16266016873) returned 1 [0042.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa83d1ad0, dwHighDateTime=0x1d585b4)) [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953b8 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953b8 | out: hHeap=0x260000) returned 1 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.660] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.660] GetLastError () returned 0x0 [0042.660] GetLastError () returned 0x0 [0042.660] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.660] GetLastError () returned 0x0 [0042.660] GetLastError () returned 0x0 [0042.660] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x2213, lpOverlapped=0x0) returned 1 [0042.661] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdded, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.662] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x2213, lpOverlapped=0x0) returned 1 [0042.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.662] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.662] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.662] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.662] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.662] CloseHandle (hObject=0x10c) returned 1 [0042.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x298fd0 [0042.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.663] GetLastError () returned 0x0 [0042.663] RtlWakeConditionVariable () returned 0x27e828 [0042.663] GetCurrentThreadId () returned 0x99c [0042.663] GetCurrentThreadId () returned 0x99c [0042.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5858 | out: hHeap=0x260000) returned 1 [0042.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295380 | out: hHeap=0x260000) returned 1 [0042.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0042.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.665] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.665] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.665] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.665] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.666] CloseHandle (hObject=0x108) returned 1 [0042.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0042.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0042.667] RtlWakeConditionVariable () returned 0x27e828 [0042.667] GetCurrentThreadId () returned 0x99c [0042.667] GetCurrentThreadId () returned 0x99c [0042.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef9f0 [0042.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315af8 | out: hHeap=0x260000) returned 1 [0042.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0042.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315af8 [0042.667] lstrlenW (lpString=".ldf") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.667] lstrlenW (lpString=".vhd") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.667] lstrlenW (lpString=".vhdx") returned 5 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.667] lstrlenW (lpString=".pst") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.667] lstrlenW (lpString=".ost") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.667] lstrlenW (lpString=".bak") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.667] lstrlenW (lpString=".bac") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.667] lstrlenW (lpString=".sys") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.667] lstrlenW (lpString=".v2i") returned 4 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.667] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.668] lstrlenW (lpString=".sql") returned 4 [0042.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.668] lstrlenW (lpString=".mdf") returned 4 [0042.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.668] lstrlenW (lpString=".txt") returned 4 [0042.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.668] lstrlenW (lpString=".dbf") returned 4 [0042.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.668] lstrlenW (lpString=".ckp") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.669] lstrlenW (lpString=".dacpac") returned 7 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.669] lstrlenW (lpString=".db3") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.669] lstrlenW (lpString=".dtxs") returned 5 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.669] lstrlenW (lpString=".mdt") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.669] lstrlenW (lpString=".sdf") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.669] lstrlenW (lpString=".MDF") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.669] lstrlenW (lpString=".DBF") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.669] lstrlenW (lpString=".DB") returned 3 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.669] lstrlenW (lpString=".db") returned 3 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.669] lstrlenW (lpString=".ndf") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.669] lstrlenW (lpString=".NDF") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.669] lstrlenW (lpString=".Mdf") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.669] lstrlenW (lpString=".dat") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.669] lstrlenW (lpString=".DAT") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.669] lstrlenW (lpString=".ldf") returned 4 [0042.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.670] lstrlenW (lpString=".LDF") returned 4 [0042.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.670] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.670] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.670] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.671] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.671] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16267177072) returned 1 [0042.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa83f7c30, dwHighDateTime=0x1d585b4)) [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.671] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.671] GetLastError () returned 0x0 [0042.671] GetLastError () returned 0x0 [0042.671] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.672] GetLastError () returned 0x0 [0042.672] GetLastError () returned 0x0 [0042.672] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x978, lpOverlapped=0x0) returned 1 [0042.673] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.673] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x978, lpOverlapped=0x0) returned 1 [0042.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.673] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.673] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.673] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.673] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.674] CloseHandle (hObject=0x108) returned 1 [0042.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2edae8 [0042.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edae8 | out: hHeap=0x260000) returned 1 [0042.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.674] GetLastError () returned 0x0 [0042.674] RtlWakeConditionVariable () returned 0x27e828 [0042.674] GetCurrentThreadId () returned 0x99c [0042.674] GetCurrentThreadId () returned 0x99c [0042.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef9f0 [0042.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0042.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0042.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0042.675] lstrlenW (lpString=".ldf") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".ldf") returned 0x0 [0042.675] lstrlenW (lpString=".vhd") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".vhd") returned 0x0 [0042.675] lstrlenW (lpString=".vhdx") returned 5 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.675] lstrlenW (lpString=".pst") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".pst") returned 0x0 [0042.675] lstrlenW (lpString=".ost") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".ost") returned 0x0 [0042.675] lstrlenW (lpString=".bak") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".bak") returned 0x0 [0042.675] lstrlenW (lpString=".bac") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".bac") returned 0x0 [0042.675] lstrlenW (lpString=".sys") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".sys") returned 0x0 [0042.675] lstrlenW (lpString=".v2i") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".v2i") returned 0x0 [0042.675] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.675] lstrlenW (lpString=".sql") returned 4 [0042.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".sql") returned 0x0 [0042.675] lstrlenW (lpString=".mdf") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".mdf") returned 0x0 [0042.676] lstrlenW (lpString=".txt") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".txt") returned 0x0 [0042.676] lstrlenW (lpString=".dbf") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".dbf") returned 0x0 [0042.676] lstrlenW (lpString=".ckp") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".ckp") returned 0x0 [0042.676] lstrlenW (lpString=".dacpac") returned 7 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.676] lstrlenW (lpString=".db3") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".db3") returned 0x0 [0042.676] lstrlenW (lpString=".dtxs") returned 5 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.676] lstrlenW (lpString=".mdt") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".mdt") returned 0x0 [0042.676] lstrlenW (lpString=".sdf") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".sdf") returned 0x0 [0042.676] lstrlenW (lpString=".MDF") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".MDF") returned 0x0 [0042.676] lstrlenW (lpString=".DBF") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".DBF") returned 0x0 [0042.676] lstrlenW (lpString=".DB") returned 3 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".DB") returned 0x0 [0042.676] lstrlenW (lpString=".db") returned 3 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".db") returned 0x0 [0042.676] lstrlenW (lpString=".ndf") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".ndf") returned 0x0 [0042.676] lstrlenW (lpString=".NDF") returned 4 [0042.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".NDF") returned 0x0 [0042.676] lstrlenW (lpString=".Mdf") returned 4 [0042.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.677] lstrlenW (lpString=".dat") returned 4 [0042.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".dat") returned 0x0 [0042.677] lstrlenW (lpString=".DAT") returned 4 [0042.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".DAT") returned 0x0 [0042.677] lstrlenW (lpString=".ldf") returned 4 [0042.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".ldf") returned 0x0 [0042.677] lstrlenW (lpString=".LDF") returned 4 [0042.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch=".LDF") returned 0x0 [0042.677] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.677] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.678] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.678] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.678] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16267902142) returned 1 [0042.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa83f7c30, dwHighDateTime=0x1d585b4)) [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.679] GetLastError () returned 0x0 [0042.679] GetLastError () returned 0x0 [0042.679] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.679] GetLastError () returned 0x0 [0042.679] GetLastError () returned 0x0 [0042.679] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x708, lpOverlapped=0x0) returned 1 [0042.690] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.690] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x708, lpOverlapped=0x0) returned 1 [0042.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.691] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.691] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.691] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.691] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.691] CloseHandle (hObject=0x108) returned 1 [0042.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x299988 [0042.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299988 | out: hHeap=0x260000) returned 1 [0042.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.819] GetLastError () returned 0x0 [0042.819] RtlWakeConditionVariable () returned 0x27e828 [0042.819] GetCurrentThreadId () returned 0x99c [0042.819] GetCurrentThreadId () returned 0x99c [0042.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2978f8 | out: hHeap=0x260000) returned 1 [0042.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0042.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2978f8 [0042.819] lstrlenW (lpString=".ldf") returned 4 [0042.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".ldf") returned 0x0 [0042.820] lstrlenW (lpString=".vhd") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".vhd") returned 0x0 [0042.820] lstrlenW (lpString=".vhdx") returned 5 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".vhdx") returned 0x0 [0042.820] lstrlenW (lpString=".pst") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".pst") returned 0x0 [0042.820] lstrlenW (lpString=".ost") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".ost") returned 0x0 [0042.820] lstrlenW (lpString=".bak") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".bak") returned 0x0 [0042.820] lstrlenW (lpString=".bac") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".bac") returned 0x0 [0042.820] lstrlenW (lpString=".sys") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".sys") returned 0x0 [0042.820] lstrlenW (lpString=".v2i") returned 4 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".v2i") returned 0x0 [0042.820] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.821] lstrlenW (lpString=".sql") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".sql") returned 0x0 [0042.821] lstrlenW (lpString=".mdf") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".mdf") returned 0x0 [0042.821] lstrlenW (lpString=".txt") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".txt") returned 0x0 [0042.821] lstrlenW (lpString=".dbf") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".dbf") returned 0x0 [0042.821] lstrlenW (lpString=".ckp") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".ckp") returned 0x0 [0042.821] lstrlenW (lpString=".dacpac") returned 7 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".dacpac") returned 0x0 [0042.821] lstrlenW (lpString=".db3") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".db3") returned 0x0 [0042.821] lstrlenW (lpString=".dtxs") returned 5 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".dtxs") returned 0x0 [0042.821] lstrlenW (lpString=".mdt") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".mdt") returned 0x0 [0042.821] lstrlenW (lpString=".sdf") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".sdf") returned 0x0 [0042.821] lstrlenW (lpString=".MDF") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".MDF") returned 0x0 [0042.821] lstrlenW (lpString=".DBF") returned 4 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".DBF") returned 0x0 [0042.821] lstrlenW (lpString=".DB") returned 3 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".DB") returned 0x0 [0042.821] lstrlenW (lpString=".db") returned 3 [0042.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".db") returned 0x0 [0042.821] lstrlenW (lpString=".ndf") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".ndf") returned 0x0 [0042.822] lstrlenW (lpString=".NDF") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".NDF") returned 0x0 [0042.822] lstrlenW (lpString=".Mdf") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".Mdf") returned 0x0 [0042.822] lstrlenW (lpString=".dat") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".dat") returned 0x0 [0042.822] lstrlenW (lpString=".DAT") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".DAT") returned 0x0 [0042.822] lstrlenW (lpString=".ldf") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".ldf") returned 0x0 [0042.822] lstrlenW (lpString=".LDF") returned 4 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch=".LDF") returned 0x0 [0042.822] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.822] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0042.823] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.823] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.823] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16282413904) returned 1 [0042.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa85749f0, dwHighDateTime=0x1d585b4)) [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297d48 [0042.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0042.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0042.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0042.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0042.823] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.824] GetLastError () returned 0x0 [0042.824] GetLastError () returned 0x0 [0042.824] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.824] GetLastError () returned 0x0 [0042.824] GetLastError () returned 0x0 [0042.824] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.882] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.882] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.883] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.883] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.884] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.884] CloseHandle (hObject=0x104) returned 1 [0042.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0042.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0042.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.948] GetLastError () returned 0x0 [0042.948] RtlWakeConditionVariable () returned 0x27e828 [0042.948] GetCurrentThreadId () returned 0x99c [0042.948] GetCurrentThreadId () returned 0x99c [0042.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5698 | out: hHeap=0x260000) returned 1 [0042.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1790 | out: hHeap=0x260000) returned 1 [0042.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0042.948] lstrlenW (lpString=".ldf") returned 4 [0042.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".ldf") returned 0x0 [0042.948] lstrlenW (lpString=".vhd") returned 4 [0042.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".vhd") returned 0x0 [0042.948] lstrlenW (lpString=".vhdx") returned 5 [0042.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".vhdx") returned 0x0 [0042.948] lstrlenW (lpString=".pst") returned 4 [0042.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".pst") returned 0x0 [0042.948] lstrlenW (lpString=".ost") returned 4 [0042.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".ost") returned 0x0 [0042.948] lstrlenW (lpString=".bak") returned 4 [0042.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".bak") returned 0x0 [0042.949] lstrlenW (lpString=".bac") returned 4 [0042.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".bac") returned 0x0 [0042.949] lstrlenW (lpString=".sys") returned 4 [0042.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".sys") returned 0x0 [0042.949] lstrlenW (lpString=".v2i") returned 4 [0042.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".v2i") returned 0x0 [0042.949] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch="s\r\n.v2i") returned 0x0 [0042.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.950] lstrlenW (lpString=".sql") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".sql") returned 0x0 [0042.950] lstrlenW (lpString=".mdf") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".mdf") returned 0x0 [0042.950] lstrlenW (lpString=".txt") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".txt") returned 0x0 [0042.950] lstrlenW (lpString=".dbf") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".dbf") returned 0x0 [0042.950] lstrlenW (lpString=".ckp") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".ckp") returned 0x0 [0042.950] lstrlenW (lpString=".dacpac") returned 7 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".dacpac") returned 0x0 [0042.950] lstrlenW (lpString=".db3") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".db3") returned 0x0 [0042.950] lstrlenW (lpString=".dtxs") returned 5 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".dtxs") returned 0x0 [0042.950] lstrlenW (lpString=".mdt") returned 4 [0042.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".mdt") returned 0x0 [0042.950] lstrlenW (lpString=".sdf") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".sdf") returned 0x0 [0042.951] lstrlenW (lpString=".MDF") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".MDF") returned 0x0 [0042.951] lstrlenW (lpString=".DBF") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".DBF") returned 0x0 [0042.951] lstrlenW (lpString=".DB") returned 3 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".DB") returned 0x0 [0042.951] lstrlenW (lpString=".db") returned 3 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".db") returned 0x0 [0042.951] lstrlenW (lpString=".ndf") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".ndf") returned 0x0 [0042.951] lstrlenW (lpString=".NDF") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".NDF") returned 0x0 [0042.951] lstrlenW (lpString=".Mdf") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".Mdf") returned 0x0 [0042.951] lstrlenW (lpString=".dat") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".dat") returned 0x0 [0042.951] lstrlenW (lpString=".DAT") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".DAT") returned 0x0 [0042.951] lstrlenW (lpString=".ldf") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".ldf") returned 0x0 [0042.951] lstrlenW (lpString=".LDF") returned 4 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".LDF") returned 0x0 [0042.951] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.951] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310c08) returned 1 [0042.952] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.952] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0042.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.952] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16295341960) returned 1 [0042.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa86a54f0, dwHighDateTime=0x1d585b4)) [0042.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1790 [0042.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1790 | out: hHeap=0x260000) returned 1 [0042.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.953] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.953] GetLastError () returned 0x0 [0042.953] GetLastError () returned 0x0 [0042.953] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.953] GetLastError () returned 0x0 [0042.953] GetLastError () returned 0x0 [0042.953] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x2d7e, lpOverlapped=0x0) returned 1 [0042.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd282, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.955] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x2d7e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x2d7e, lpOverlapped=0x0) returned 1 [0042.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.955] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.955] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.955] CloseHandle (hObject=0x104) returned 1 [0042.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x140) returned 0x2b3fe0 [0042.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[deadmin@cock.li].deadmin")) returned 1 [0042.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.958] GetLastError () returned 0x0 [0042.958] RtlWakeConditionVariable () returned 0x27e828 [0042.958] GetCurrentThreadId () returned 0x99c [0042.958] GetCurrentThreadId () returned 0x99c [0042.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0042.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fe68 | out: hHeap=0x260000) returned 1 [0042.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a17c8 | out: hHeap=0x260000) returned 1 [0042.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fe68 [0042.959] lstrlenW (lpString=".ldf") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".ldf") returned 0x0 [0042.959] lstrlenW (lpString=".vhd") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".vhd") returned 0x0 [0042.959] lstrlenW (lpString=".vhdx") returned 5 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".vhdx") returned 0x0 [0042.959] lstrlenW (lpString=".pst") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".pst") returned 0x0 [0042.959] lstrlenW (lpString=".ost") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".ost") returned 0x0 [0042.959] lstrlenW (lpString=".bak") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".bak") returned 0x0 [0042.959] lstrlenW (lpString=".bac") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".bac") returned 0x0 [0042.959] lstrlenW (lpString=".sys") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".sys") returned 0x0 [0042.959] lstrlenW (lpString=".v2i") returned 4 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".v2i") returned 0x0 [0042.959] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.960] lstrlenW (lpString=".sql") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".sql") returned 0x0 [0042.960] lstrlenW (lpString=".mdf") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".mdf") returned 0x0 [0042.960] lstrlenW (lpString=".txt") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".txt") returned 0x0 [0042.960] lstrlenW (lpString=".dbf") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".dbf") returned 0x0 [0042.960] lstrlenW (lpString=".ckp") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".ckp") returned 0x0 [0042.960] lstrlenW (lpString=".dacpac") returned 7 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".dacpac") returned 0x0 [0042.960] lstrlenW (lpString=".db3") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".db3") returned 0x0 [0042.960] lstrlenW (lpString=".dtxs") returned 5 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".dtxs") returned 0x0 [0042.960] lstrlenW (lpString=".mdt") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".mdt") returned 0x0 [0042.960] lstrlenW (lpString=".sdf") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".sdf") returned 0x0 [0042.960] lstrlenW (lpString=".MDF") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".MDF") returned 0x0 [0042.960] lstrlenW (lpString=".DBF") returned 4 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".DBF") returned 0x0 [0042.960] lstrlenW (lpString=".DB") returned 3 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".DB") returned 0x0 [0042.960] lstrlenW (lpString=".db") returned 3 [0042.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".db") returned 0x0 [0042.960] lstrlenW (lpString=".ndf") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".ndf") returned 0x0 [0042.961] lstrlenW (lpString=".NDF") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".NDF") returned 0x0 [0042.961] lstrlenW (lpString=".Mdf") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".Mdf") returned 0x0 [0042.961] lstrlenW (lpString=".dat") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".dat") returned 0x0 [0042.961] lstrlenW (lpString=".DAT") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".DAT") returned 0x0 [0042.961] lstrlenW (lpString=".ldf") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".ldf") returned 0x0 [0042.961] lstrlenW (lpString=".LDF") returned 4 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch=".LDF") returned 0x0 [0042.961] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.961] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310c08) returned 1 [0042.962] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.962] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0042.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.962] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16296310207) returned 1 [0042.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa86a54f0, dwHighDateTime=0x1d585b4)) [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a17c8 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a17c8 | out: hHeap=0x260000) returned 1 [0042.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.963] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.963] GetLastError () returned 0x0 [0042.963] GetLastError () returned 0x0 [0042.963] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.963] GetLastError () returned 0x0 [0042.963] GetLastError () returned 0x0 [0042.963] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.966] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.966] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.966] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.966] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.973] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.973] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.974] CloseHandle (hObject=0x104) returned 1 [0042.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.975] GetLastError () returned 0x0 [0042.975] RtlWakeConditionVariable () returned 0x27e828 [0042.975] GetCurrentThreadId () returned 0x99c [0042.975] GetCurrentThreadId () returned 0x99c [0042.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0042.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ff40 | out: hHeap=0x260000) returned 1 [0042.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0042.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ff40 [0042.975] lstrlenW (lpString=".ldf") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".ldf") returned 0x0 [0042.975] lstrlenW (lpString=".vhd") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".vhd") returned 0x0 [0042.975] lstrlenW (lpString=".vhdx") returned 5 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".vhdx") returned 0x0 [0042.975] lstrlenW (lpString=".pst") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".pst") returned 0x0 [0042.975] lstrlenW (lpString=".ost") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".ost") returned 0x0 [0042.975] lstrlenW (lpString=".bak") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".bak") returned 0x0 [0042.975] lstrlenW (lpString=".bac") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".bac") returned 0x0 [0042.975] lstrlenW (lpString=".sys") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".sys") returned 0x0 [0042.975] lstrlenW (lpString=".v2i") returned 4 [0042.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".v2i") returned 0x0 [0042.976] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0042.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.976] lstrlenW (lpString=".sql") returned 4 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".sql") returned 0x0 [0042.976] lstrlenW (lpString=".mdf") returned 4 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".mdf") returned 0x0 [0042.976] lstrlenW (lpString=".txt") returned 4 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".txt") returned 0x0 [0042.976] lstrlenW (lpString=".dbf") returned 4 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".dbf") returned 0x0 [0042.976] lstrlenW (lpString=".ckp") returned 4 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".ckp") returned 0x0 [0042.976] lstrlenW (lpString=".dacpac") returned 7 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".dacpac") returned 0x0 [0042.976] lstrlenW (lpString=".db3") returned 4 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".db3") returned 0x0 [0042.976] lstrlenW (lpString=".dtxs") returned 5 [0042.976] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".dtxs") returned 0x0 [0042.977] lstrlenW (lpString=".mdt") returned 4 [0042.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".mdt") returned 0x0 [0042.977] lstrlenW (lpString=".sdf") returned 4 [0042.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".sdf") returned 0x0 [0042.977] lstrlenW (lpString=".MDF") returned 4 [0042.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".MDF") returned 0x0 [0042.977] lstrlenW (lpString=".DBF") returned 4 [0042.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".DBF") returned 0x0 [0042.977] lstrlenW (lpString=".DB") returned 3 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".DB") returned 0x0 [0042.978] lstrlenW (lpString=".db") returned 3 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".db") returned 0x0 [0042.978] lstrlenW (lpString=".ndf") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".ndf") returned 0x0 [0042.978] lstrlenW (lpString=".NDF") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".NDF") returned 0x0 [0042.978] lstrlenW (lpString=".Mdf") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".Mdf") returned 0x0 [0042.978] lstrlenW (lpString=".dat") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".dat") returned 0x0 [0042.978] lstrlenW (lpString=".DAT") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".DAT") returned 0x0 [0042.978] lstrlenW (lpString=".ldf") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".ldf") returned 0x0 [0042.978] lstrlenW (lpString=".LDF") returned 4 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch=".LDF") returned 0x0 [0042.978] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.978] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310c08) returned 1 [0042.979] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.979] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0042.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.979] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16298026430) returned 1 [0042.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa86f17b0, dwHighDateTime=0x1d585b4)) [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16b0 | out: hHeap=0x260000) returned 1 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.980] GetLastError () returned 0x0 [0042.980] GetLastError () returned 0x0 [0042.980] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.980] GetLastError () returned 0x0 [0042.980] GetLastError () returned 0x0 [0042.980] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x238fdb0*=0x3d60, lpOverlapped=0x0) returned 1 [0042.986] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc2a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.986] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x3d60, lpOverlapped=0x0) returned 1 [0042.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0042.986] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.986] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.986] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.986] CloseHandle (hObject=0x104) returned 1 [0042.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.987] GetLastError () returned 0x0 [0042.987] RtlWakeConditionVariable () returned 0x27e828 [0042.987] GetCurrentThreadId () returned 0x99c [0042.987] GetCurrentThreadId () returned 0x99c [0042.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ef8 | out: hHeap=0x260000) returned 1 [0042.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d40 | out: hHeap=0x260000) returned 1 [0042.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ef8 [0042.987] lstrlenW (lpString=".ldf") returned 4 [0042.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".ldf") returned 0x0 [0042.987] lstrlenW (lpString=".vhd") returned 4 [0042.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".vhd") returned 0x0 [0042.987] lstrlenW (lpString=".vhdx") returned 5 [0042.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".vhdx") returned 0x0 [0042.987] lstrlenW (lpString=".pst") returned 4 [0042.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".pst") returned 0x0 [0042.987] lstrlenW (lpString=".ost") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".ost") returned 0x0 [0042.988] lstrlenW (lpString=".bak") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".bak") returned 0x0 [0042.988] lstrlenW (lpString=".bac") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".bac") returned 0x0 [0042.988] lstrlenW (lpString=".sys") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".sys") returned 0x0 [0042.988] lstrlenW (lpString=".v2i") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".v2i") returned 0x0 [0042.988] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0042.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.988] lstrlenW (lpString=".sql") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".sql") returned 0x0 [0042.988] lstrlenW (lpString=".mdf") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".mdf") returned 0x0 [0042.988] lstrlenW (lpString=".txt") returned 4 [0042.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".txt") returned 0x0 [0042.989] lstrlenW (lpString=".dbf") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".dbf") returned 0x0 [0042.989] lstrlenW (lpString=".ckp") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".ckp") returned 0x0 [0042.989] lstrlenW (lpString=".dacpac") returned 7 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".dacpac") returned 0x0 [0042.989] lstrlenW (lpString=".db3") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".db3") returned 0x0 [0042.989] lstrlenW (lpString=".dtxs") returned 5 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".dtxs") returned 0x0 [0042.989] lstrlenW (lpString=".mdt") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".mdt") returned 0x0 [0042.989] lstrlenW (lpString=".sdf") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".sdf") returned 0x0 [0042.989] lstrlenW (lpString=".MDF") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".MDF") returned 0x0 [0042.989] lstrlenW (lpString=".DBF") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".DBF") returned 0x0 [0042.989] lstrlenW (lpString=".DB") returned 3 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".DB") returned 0x0 [0042.989] lstrlenW (lpString=".db") returned 3 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".db") returned 0x0 [0042.989] lstrlenW (lpString=".ndf") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".ndf") returned 0x0 [0042.989] lstrlenW (lpString=".NDF") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".NDF") returned 0x0 [0042.989] lstrlenW (lpString=".Mdf") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".Mdf") returned 0x0 [0042.989] lstrlenW (lpString=".dat") returned 4 [0042.989] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".dat") returned 0x0 [0042.990] lstrlenW (lpString=".DAT") returned 4 [0042.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".DAT") returned 0x0 [0042.990] lstrlenW (lpString=".ldf") returned 4 [0042.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".ldf") returned 0x0 [0042.990] lstrlenW (lpString=".LDF") returned 4 [0042.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch=".LDF") returned 0x0 [0042.990] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.990] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310c08) returned 1 [0042.991] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.991] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0042.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.991] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16299185170) returned 1 [0042.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa86f17b0, dwHighDateTime=0x1d585b4)) [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d40 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d40 | out: hHeap=0x260000) returned 1 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7128 [0042.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0042.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.991] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0042.991] GetLastError () returned 0x0 [0042.991] GetLastError () returned 0x0 [0042.992] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0042.992] GetLastError () returned 0x0 [0042.992] GetLastError () returned 0x0 [0042.992] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.104] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.104] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.122] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.122] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.144] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.144] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.144] CloseHandle (hObject=0x104) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0043.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.[deadmin@cock.li].deadmin")) returned 1 [0043.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0043.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.145] GetLastError () returned 0x0 [0043.145] RtlWakeConditionVariable () returned 0x27e828 [0043.145] GetCurrentThreadId () returned 0x99c [0043.145] GetCurrentThreadId () returned 0x99c [0043.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da218 | out: hHeap=0x260000) returned 1 [0043.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81b0 | out: hHeap=0x260000) returned 1 [0043.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da218 [0043.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.342] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.342] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.342] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.342] WriteFile (in: hFile=0xf0, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.343] CloseHandle (hObject=0xf0) returned 1 [0043.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da218 | out: hHeap=0x260000) returned 1 [0043.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.343] RtlWakeConditionVariable () returned 0x27e828 [0043.343] GetCurrentThreadId () returned 0x99c [0043.343] GetCurrentThreadId () returned 0x99c [0043.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296858 | out: hHeap=0x260000) returned 1 [0043.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8140 | out: hHeap=0x260000) returned 1 [0043.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0043.343] lstrlenW (lpString=".ldf") returned 4 [0043.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".ldf") returned 0x0 [0043.343] lstrlenW (lpString=".vhd") returned 4 [0043.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".vhd") returned 0x0 [0043.344] lstrlenW (lpString=".vhdx") returned 5 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".vhdx") returned 0x0 [0043.344] lstrlenW (lpString=".pst") returned 4 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".pst") returned 0x0 [0043.344] lstrlenW (lpString=".ost") returned 4 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".ost") returned 0x0 [0043.344] lstrlenW (lpString=".bak") returned 4 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".bak") returned 0x0 [0043.344] lstrlenW (lpString=".bac") returned 4 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".bac") returned 0x0 [0043.344] lstrlenW (lpString=".sys") returned 4 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".sys") returned 0x0 [0043.344] lstrlenW (lpString=".v2i") returned 4 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".v2i") returned 0x0 [0043.344] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.432] lstrlenW (lpString=".sql") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".sql") returned 0x0 [0043.433] lstrlenW (lpString=".mdf") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".mdf") returned 0x0 [0043.433] lstrlenW (lpString=".txt") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".txt") returned 0x0 [0043.433] lstrlenW (lpString=".dbf") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".dbf") returned 0x0 [0043.433] lstrlenW (lpString=".ckp") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".ckp") returned 0x0 [0043.433] lstrlenW (lpString=".dacpac") returned 7 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".dacpac") returned 0x0 [0043.433] lstrlenW (lpString=".db3") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".db3") returned 0x0 [0043.433] lstrlenW (lpString=".dtxs") returned 5 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".dtxs") returned 0x0 [0043.433] lstrlenW (lpString=".mdt") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".mdt") returned 0x0 [0043.433] lstrlenW (lpString=".sdf") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".sdf") returned 0x0 [0043.433] lstrlenW (lpString=".MDF") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".MDF") returned 0x0 [0043.433] lstrlenW (lpString=".DBF") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".DBF") returned 0x0 [0043.433] lstrlenW (lpString=".DB") returned 3 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".DB") returned 0x0 [0043.433] lstrlenW (lpString=".db") returned 3 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".db") returned 0x0 [0043.433] lstrlenW (lpString=".ndf") returned 4 [0043.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".ndf") returned 0x0 [0043.433] lstrlenW (lpString=".NDF") returned 4 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".NDF") returned 0x0 [0043.434] lstrlenW (lpString=".Mdf") returned 4 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".Mdf") returned 0x0 [0043.434] lstrlenW (lpString=".dat") returned 4 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".dat") returned 0x0 [0043.434] lstrlenW (lpString=".DAT") returned 4 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".DAT") returned 0x0 [0043.434] lstrlenW (lpString=".ldf") returned 4 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".ldf") returned 0x0 [0043.434] lstrlenW (lpString=".LDF") returned 4 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch=".LDF") returned 0x0 [0043.434] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.434] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.435] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.435] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.435] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16343609872) returned 1 [0043.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8b41f90, dwHighDateTime=0x1d585b4)) [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8028 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8028 | out: hHeap=0x260000) returned 1 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2970a8 [0043.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.435] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.436] GetLastError () returned 0x0 [0043.436] GetLastError () returned 0x0 [0043.436] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.436] GetLastError () returned 0x0 [0043.436] GetLastError () returned 0x0 [0043.436] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x238fdb0*=0x17f80, lpOverlapped=0x0) returned 1 [0043.441] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe8080, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.441] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x17f80, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x17f80, lpOverlapped=0x0) returned 1 [0043.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.441] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.441] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.441] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.442] CloseHandle (hObject=0x100) returned 1 [0043.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.442] GetLastError () returned 0x0 [0043.442] RtlWakeConditionVariable () returned 0x27e828 [0043.442] GetCurrentThreadId () returned 0x99c [0043.442] GetCurrentThreadId () returned 0x99c [0043.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2a78 | out: hHeap=0x260000) returned 1 [0043.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8338 | out: hHeap=0x260000) returned 1 [0043.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2a78 [0043.443] lstrlenW (lpString=".ldf") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".ldf") returned 0x0 [0043.443] lstrlenW (lpString=".vhd") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".vhd") returned 0x0 [0043.443] lstrlenW (lpString=".vhdx") returned 5 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".vhdx") returned 0x0 [0043.443] lstrlenW (lpString=".pst") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".pst") returned 0x0 [0043.443] lstrlenW (lpString=".ost") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".ost") returned 0x0 [0043.443] lstrlenW (lpString=".bak") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".bak") returned 0x0 [0043.443] lstrlenW (lpString=".bac") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".bac") returned 0x0 [0043.443] lstrlenW (lpString=".sys") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".sys") returned 0x0 [0043.443] lstrlenW (lpString=".v2i") returned 4 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".v2i") returned 0x0 [0043.443] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch="s\r\n.v2i") returned 0x0 [0043.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.444] lstrlenW (lpString=".sql") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".sql") returned 0x0 [0043.444] lstrlenW (lpString=".mdf") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".mdf") returned 0x0 [0043.444] lstrlenW (lpString=".txt") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".txt") returned 0x0 [0043.444] lstrlenW (lpString=".dbf") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".dbf") returned 0x0 [0043.444] lstrlenW (lpString=".ckp") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".ckp") returned 0x0 [0043.444] lstrlenW (lpString=".dacpac") returned 7 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".dacpac") returned 0x0 [0043.444] lstrlenW (lpString=".db3") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".db3") returned 0x0 [0043.444] lstrlenW (lpString=".dtxs") returned 5 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".dtxs") returned 0x0 [0043.444] lstrlenW (lpString=".mdt") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".mdt") returned 0x0 [0043.444] lstrlenW (lpString=".sdf") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".sdf") returned 0x0 [0043.444] lstrlenW (lpString=".MDF") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".MDF") returned 0x0 [0043.444] lstrlenW (lpString=".DBF") returned 4 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".DBF") returned 0x0 [0043.444] lstrlenW (lpString=".DB") returned 3 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".DB") returned 0x0 [0043.444] lstrlenW (lpString=".db") returned 3 [0043.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".db") returned 0x0 [0043.445] lstrlenW (lpString=".ndf") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".ndf") returned 0x0 [0043.445] lstrlenW (lpString=".NDF") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".NDF") returned 0x0 [0043.445] lstrlenW (lpString=".Mdf") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".Mdf") returned 0x0 [0043.445] lstrlenW (lpString=".dat") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".dat") returned 0x0 [0043.445] lstrlenW (lpString=".DAT") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".DAT") returned 0x0 [0043.445] lstrlenW (lpString=".ldf") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".ldf") returned 0x0 [0043.445] lstrlenW (lpString=".LDF") returned 4 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch=".LDF") returned 0x0 [0043.445] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.445] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.446] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.446] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.446] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16344730419) returned 1 [0043.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8b680f0, dwHighDateTime=0x1d585b4)) [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8338 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8338 | out: hHeap=0x260000) returned 1 [0043.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.447] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.447] GetLastError () returned 0x0 [0043.447] GetLastError () returned 0x0 [0043.447] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.447] GetLastError () returned 0x0 [0043.447] GetLastError () returned 0x0 [0043.447] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x238fdb0*=0x22d6, lpOverlapped=0x0) returned 1 [0043.449] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdd2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.449] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x22d6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x22d6, lpOverlapped=0x0) returned 1 [0043.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.449] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.449] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.449] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.449] CloseHandle (hObject=0x100) returned 1 [0043.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.[deadmin@cock.li].deadmin")) returned 1 [0043.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.450] GetLastError () returned 0x0 [0043.450] RtlWakeConditionVariable () returned 0x27e828 [0043.450] GetCurrentThreadId () returned 0x99c [0043.450] GetCurrentThreadId () returned 0x99c [0043.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3038 | out: hHeap=0x260000) returned 1 [0043.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8300 | out: hHeap=0x260000) returned 1 [0043.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3038 [0043.450] lstrlenW (lpString=".ldf") returned 4 [0043.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".ldf") returned 0x0 [0043.450] lstrlenW (lpString=".vhd") returned 4 [0043.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".vhd") returned 0x0 [0043.451] lstrlenW (lpString=".vhdx") returned 5 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".vhdx") returned 0x0 [0043.451] lstrlenW (lpString=".pst") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".pst") returned 0x0 [0043.451] lstrlenW (lpString=".ost") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".ost") returned 0x0 [0043.451] lstrlenW (lpString=".bak") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".bak") returned 0x0 [0043.451] lstrlenW (lpString=".bac") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".bac") returned 0x0 [0043.451] lstrlenW (lpString=".sys") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".sys") returned 0x0 [0043.451] lstrlenW (lpString=".v2i") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".v2i") returned 0x0 [0043.451] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch="s\r\n.v2i") returned 0x0 [0043.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.451] lstrlenW (lpString=".sql") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".sql") returned 0x0 [0043.451] lstrlenW (lpString=".mdf") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".mdf") returned 0x0 [0043.451] lstrlenW (lpString=".txt") returned 4 [0043.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".txt") returned 0x0 [0043.451] lstrlenW (lpString=".dbf") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".dbf") returned 0x0 [0043.452] lstrlenW (lpString=".ckp") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".ckp") returned 0x0 [0043.452] lstrlenW (lpString=".dacpac") returned 7 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".dacpac") returned 0x0 [0043.452] lstrlenW (lpString=".db3") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".db3") returned 0x0 [0043.452] lstrlenW (lpString=".dtxs") returned 5 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".dtxs") returned 0x0 [0043.452] lstrlenW (lpString=".mdt") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".mdt") returned 0x0 [0043.452] lstrlenW (lpString=".sdf") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".sdf") returned 0x0 [0043.452] lstrlenW (lpString=".MDF") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".MDF") returned 0x0 [0043.452] lstrlenW (lpString=".DBF") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".DBF") returned 0x0 [0043.452] lstrlenW (lpString=".DB") returned 3 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".DB") returned 0x0 [0043.452] lstrlenW (lpString=".db") returned 3 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".db") returned 0x0 [0043.452] lstrlenW (lpString=".ndf") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".ndf") returned 0x0 [0043.452] lstrlenW (lpString=".NDF") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".NDF") returned 0x0 [0043.452] lstrlenW (lpString=".Mdf") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".Mdf") returned 0x0 [0043.452] lstrlenW (lpString=".dat") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".dat") returned 0x0 [0043.452] lstrlenW (lpString=".DAT") returned 4 [0043.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".DAT") returned 0x0 [0043.453] lstrlenW (lpString=".ldf") returned 4 [0043.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".ldf") returned 0x0 [0043.453] lstrlenW (lpString=".LDF") returned 4 [0043.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch=".LDF") returned 0x0 [0043.453] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.453] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.454] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0043.454] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16345481586) returned 1 [0043.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8b680f0, dwHighDateTime=0x1d585b4)) [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8300 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8300 | out: hHeap=0x260000) returned 1 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.454] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.454] GetLastError () returned 0x0 [0043.454] GetLastError () returned 0x0 [0043.454] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.455] GetLastError () returned 0x0 [0043.455] GetLastError () returned 0x0 [0043.455] ReadFile (in: hFile=0x100, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x238fdb0*=0x734, lpOverlapped=0x0) returned 1 [0043.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.456] WriteFile (in: hFile=0x100, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x734, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x734, lpOverlapped=0x0) returned 1 [0043.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.456] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.456] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.457] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.457] CloseHandle (hObject=0x100) returned 1 [0043.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.[deadmin@cock.li].deadmin")) returned 1 [0043.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.459] GetLastError () returned 0x0 [0043.459] RtlWakeConditionVariable () returned 0x27e828 [0043.459] GetCurrentThreadId () returned 0x99c [0043.459] GetCurrentThreadId () returned 0x99c [0043.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2f80 | out: hHeap=0x260000) returned 1 [0043.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d82c8 | out: hHeap=0x260000) returned 1 [0043.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2f80 [0043.459] lstrlenW (lpString=".ldf") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".ldf") returned 0x0 [0043.459] lstrlenW (lpString=".vhd") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".vhd") returned 0x0 [0043.459] lstrlenW (lpString=".vhdx") returned 5 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".vhdx") returned 0x0 [0043.459] lstrlenW (lpString=".pst") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".pst") returned 0x0 [0043.459] lstrlenW (lpString=".ost") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".ost") returned 0x0 [0043.459] lstrlenW (lpString=".bak") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".bak") returned 0x0 [0043.459] lstrlenW (lpString=".bac") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".bac") returned 0x0 [0043.459] lstrlenW (lpString=".sys") returned 4 [0043.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".sys") returned 0x0 [0043.460] lstrlenW (lpString=".v2i") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".v2i") returned 0x0 [0043.460] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0043.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.460] lstrlenW (lpString=".sql") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".sql") returned 0x0 [0043.460] lstrlenW (lpString=".mdf") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".mdf") returned 0x0 [0043.460] lstrlenW (lpString=".txt") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".txt") returned 0x0 [0043.460] lstrlenW (lpString=".dbf") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".dbf") returned 0x0 [0043.460] lstrlenW (lpString=".ckp") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".ckp") returned 0x0 [0043.460] lstrlenW (lpString=".dacpac") returned 7 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".dacpac") returned 0x0 [0043.460] lstrlenW (lpString=".db3") returned 4 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".db3") returned 0x0 [0043.460] lstrlenW (lpString=".dtxs") returned 5 [0043.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".dtxs") returned 0x0 [0043.460] lstrlenW (lpString=".mdt") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".mdt") returned 0x0 [0043.461] lstrlenW (lpString=".sdf") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".sdf") returned 0x0 [0043.461] lstrlenW (lpString=".MDF") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".MDF") returned 0x0 [0043.461] lstrlenW (lpString=".DBF") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".DBF") returned 0x0 [0043.461] lstrlenW (lpString=".DB") returned 3 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".DB") returned 0x0 [0043.461] lstrlenW (lpString=".db") returned 3 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".db") returned 0x0 [0043.461] lstrlenW (lpString=".ndf") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".ndf") returned 0x0 [0043.461] lstrlenW (lpString=".NDF") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".NDF") returned 0x0 [0043.461] lstrlenW (lpString=".Mdf") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".Mdf") returned 0x0 [0043.461] lstrlenW (lpString=".dat") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".dat") returned 0x0 [0043.461] lstrlenW (lpString=".DAT") returned 4 [0043.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpSrch=".DAT") returned=".DAT" [0043.461] lstrlenW (lpString=".DAT") returned 4 [0043.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.461] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.505] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31ead8 [0043.506] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16350682071) returned 1 [0043.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8bda510, dwHighDateTime=0x1d585b4)) [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d82c8 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d82c8 | out: hHeap=0x260000) returned 1 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.506] GetLastError () returned 0x0 [0043.506] GetLastError () returned 0x0 [0043.507] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.507] GetLastError () returned 0x0 [0043.507] GetLastError () returned 0x0 [0043.507] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x238fdb0*=0x9869, lpOverlapped=0x0) returned 1 [0043.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff6797, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.509] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9869, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x9869, lpOverlapped=0x0) returned 1 [0043.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.509] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.509] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.509] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.509] CloseHandle (hObject=0x100) returned 1 [0043.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.[deadmin@cock.li].deadmin")) returned 1 [0043.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.510] GetLastError () returned 0x0 [0043.511] RtlWakeConditionVariable () returned 0x27e828 [0043.511] GetCurrentThreadId () returned 0x99c [0043.511] GetCurrentThreadId () returned 0x99c [0043.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e918 | out: hHeap=0x260000) returned 1 [0043.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ed8 | out: hHeap=0x260000) returned 1 [0043.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e918 [0043.511] lstrlenW (lpString=".ldf") returned 4 [0043.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".ldf") returned 0x0 [0043.511] lstrlenW (lpString=".vhd") returned 4 [0043.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".vhd") returned 0x0 [0043.511] lstrlenW (lpString=".vhdx") returned 5 [0043.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".vhdx") returned 0x0 [0043.511] lstrlenW (lpString=".pst") returned 4 [0043.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".pst") returned 0x0 [0043.511] lstrlenW (lpString=".ost") returned 4 [0043.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".ost") returned 0x0 [0043.512] lstrlenW (lpString=".bak") returned 4 [0043.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".bak") returned 0x0 [0043.512] lstrlenW (lpString=".bac") returned 4 [0043.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".bac") returned 0x0 [0043.512] lstrlenW (lpString=".sys") returned 4 [0043.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".sys") returned 0x0 [0043.512] lstrlenW (lpString=".v2i") returned 4 [0043.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".v2i") returned 0x0 [0043.512] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch="s\r\n.v2i") returned 0x0 [0043.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.532] lstrlenW (lpString=".sql") returned 4 [0043.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".sql") returned 0x0 [0043.543] lstrlenW (lpString=".mdf") returned 4 [0043.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".mdf") returned 0x0 [0043.548] lstrlenW (lpString=".txt") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".txt") returned 0x0 [0043.551] lstrlenW (lpString=".dbf") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".dbf") returned 0x0 [0043.551] lstrlenW (lpString=".ckp") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".ckp") returned 0x0 [0043.551] lstrlenW (lpString=".dacpac") returned 7 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".dacpac") returned 0x0 [0043.551] lstrlenW (lpString=".db3") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".db3") returned 0x0 [0043.551] lstrlenW (lpString=".dtxs") returned 5 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".dtxs") returned 0x0 [0043.551] lstrlenW (lpString=".mdt") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".mdt") returned 0x0 [0043.551] lstrlenW (lpString=".sdf") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".sdf") returned 0x0 [0043.551] lstrlenW (lpString=".MDF") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".MDF") returned 0x0 [0043.551] lstrlenW (lpString=".DBF") returned 4 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".DBF") returned 0x0 [0043.551] lstrlenW (lpString=".DB") returned 3 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".DB") returned 0x0 [0043.551] lstrlenW (lpString=".db") returned 3 [0043.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".db") returned 0x0 [0043.552] lstrlenW (lpString=".ndf") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".ndf") returned 0x0 [0043.552] lstrlenW (lpString=".NDF") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".NDF") returned 0x0 [0043.552] lstrlenW (lpString=".Mdf") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".Mdf") returned 0x0 [0043.552] lstrlenW (lpString=".dat") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".dat") returned 0x0 [0043.552] lstrlenW (lpString=".DAT") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".DAT") returned 0x0 [0043.552] lstrlenW (lpString=".ldf") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".ldf") returned 0x0 [0043.552] lstrlenW (lpString=".LDF") returned 4 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch=".LDF") returned 0x0 [0043.552] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.552] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.553] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.553] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.553] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16355411860) returned 1 [0043.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8c4c930, dwHighDateTime=0x1d585b4)) [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7e30 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e30 | out: hHeap=0x260000) returned 1 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0043.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0043.554] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.554] GetLastError () returned 0x0 [0043.554] GetLastError () returned 0x0 [0043.554] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.554] GetLastError () returned 0x0 [0043.554] GetLastError () returned 0x0 [0043.554] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.557] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.557] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.558] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.558] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.561] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.561] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.561] CloseHandle (hObject=0x108) returned 1 [0043.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.[deadmin@cock.li].deadmin")) returned 1 [0043.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.588] GetLastError () returned 0x0 [0043.588] RtlWakeConditionVariable () returned 0x27e828 [0043.588] GetCurrentThreadId () returned 0x99c [0043.588] GetCurrentThreadId () returned 0x99c [0043.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2974d0 | out: hHeap=0x260000) returned 1 [0043.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d28 | out: hHeap=0x260000) returned 1 [0043.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2974d0 [0043.589] lstrlenW (lpString=".ldf") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".ldf") returned 0x0 [0043.589] lstrlenW (lpString=".vhd") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".vhd") returned 0x0 [0043.589] lstrlenW (lpString=".vhdx") returned 5 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".vhdx") returned 0x0 [0043.589] lstrlenW (lpString=".pst") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".pst") returned 0x0 [0043.589] lstrlenW (lpString=".ost") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".ost") returned 0x0 [0043.589] lstrlenW (lpString=".bak") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".bak") returned 0x0 [0043.589] lstrlenW (lpString=".bac") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".bac") returned 0x0 [0043.589] lstrlenW (lpString=".sys") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".sys") returned 0x0 [0043.589] lstrlenW (lpString=".v2i") returned 4 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch=".v2i") returned 0x0 [0043.589] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2974d0 | out: hHeap=0x260000) returned 1 [0043.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0043.591] RtlWakeConditionVariable () returned 0x27e828 [0043.591] GetCurrentThreadId () returned 0x99c [0043.591] GetCurrentThreadId () returned 0x99c [0043.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7518 | out: hHeap=0x260000) returned 1 [0043.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cf0 | out: hHeap=0x260000) returned 1 [0043.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7518 [0043.591] lstrlenW (lpString=".ldf") returned 4 [0043.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".ldf") returned 0x0 [0043.591] lstrlenW (lpString=".vhd") returned 4 [0043.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".vhd") returned 0x0 [0043.591] lstrlenW (lpString=".vhdx") returned 5 [0043.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".vhdx") returned 0x0 [0043.591] lstrlenW (lpString=".pst") returned 4 [0043.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".pst") returned 0x0 [0043.591] lstrlenW (lpString=".ost") returned 4 [0043.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".ost") returned 0x0 [0043.592] lstrlenW (lpString=".bak") returned 4 [0043.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".bak") returned 0x0 [0043.592] lstrlenW (lpString=".bac") returned 4 [0043.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".bac") returned 0x0 [0043.592] lstrlenW (lpString=".sys") returned 4 [0043.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".sys") returned 0x0 [0043.592] lstrlenW (lpString=".v2i") returned 4 [0043.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch=".v2i") returned 0x0 [0043.592] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7518 | out: hHeap=0x260000) returned 1 [0043.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.594] RtlWakeConditionVariable () returned 0x27e828 [0043.594] GetCurrentThreadId () returned 0x99c [0043.594] GetCurrentThreadId () returned 0x99c [0043.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7320 | out: hHeap=0x260000) returned 1 [0043.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337cb8 | out: hHeap=0x260000) returned 1 [0043.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7320 [0043.594] lstrlenW (lpString=".ldf") returned 4 [0043.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".ldf") returned 0x0 [0043.594] lstrlenW (lpString=".vhd") returned 4 [0043.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".vhd") returned 0x0 [0043.594] lstrlenW (lpString=".vhdx") returned 5 [0043.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".vhdx") returned 0x0 [0043.594] lstrlenW (lpString=".pst") returned 4 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".pst") returned 0x0 [0043.595] lstrlenW (lpString=".ost") returned 4 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".ost") returned 0x0 [0043.595] lstrlenW (lpString=".bak") returned 4 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".bak") returned 0x0 [0043.595] lstrlenW (lpString=".bac") returned 4 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".bac") returned 0x0 [0043.595] lstrlenW (lpString=".sys") returned 4 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".sys") returned 0x0 [0043.595] lstrlenW (lpString=".v2i") returned 4 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch=".v2i") returned 0x0 [0043.595] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpSrch="s\r\n.v2i") returned 0x0 [0043.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7320 | out: hHeap=0x260000) returned 1 [0043.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.596] RtlWakeConditionVariable () returned 0x27e828 [0043.596] GetCurrentThreadId () returned 0x99c [0043.597] GetCurrentThreadId () returned 0x99c [0043.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7278 | out: hHeap=0x260000) returned 1 [0043.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c80 | out: hHeap=0x260000) returned 1 [0043.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7278 [0043.597] lstrlenW (lpString=".ldf") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".ldf") returned 0x0 [0043.597] lstrlenW (lpString=".vhd") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".vhd") returned 0x0 [0043.597] lstrlenW (lpString=".vhdx") returned 5 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".vhdx") returned 0x0 [0043.597] lstrlenW (lpString=".pst") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".pst") returned 0x0 [0043.597] lstrlenW (lpString=".ost") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".ost") returned 0x0 [0043.597] lstrlenW (lpString=".bak") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".bak") returned 0x0 [0043.597] lstrlenW (lpString=".bac") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".bac") returned 0x0 [0043.597] lstrlenW (lpString=".sys") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".sys") returned 0x0 [0043.597] lstrlenW (lpString=".v2i") returned 4 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch=".v2i") returned 0x0 [0043.597] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpSrch="s\r\n.v2i") returned 0x0 [0043.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7278 | out: hHeap=0x260000) returned 1 [0043.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.599] RtlWakeConditionVariable () returned 0x27e828 [0043.599] GetCurrentThreadId () returned 0x99c [0043.599] GetCurrentThreadId () returned 0x99c [0043.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0043.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c48 | out: hHeap=0x260000) returned 1 [0043.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0043.599] lstrlenW (lpString=".ldf") returned 4 [0043.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".ldf") returned 0x0 [0043.599] lstrlenW (lpString=".vhd") returned 4 [0043.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".vhd") returned 0x0 [0043.599] lstrlenW (lpString=".vhdx") returned 5 [0043.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".vhdx") returned 0x0 [0043.599] lstrlenW (lpString=".pst") returned 4 [0043.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".pst") returned 0x0 [0043.599] lstrlenW (lpString=".ost") returned 4 [0043.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".ost") returned 0x0 [0043.600] lstrlenW (lpString=".bak") returned 4 [0043.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".bak") returned 0x0 [0043.600] lstrlenW (lpString=".bac") returned 4 [0043.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".bac") returned 0x0 [0043.600] lstrlenW (lpString=".sys") returned 4 [0043.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".sys") returned 0x0 [0043.600] lstrlenW (lpString=".v2i") returned 4 [0043.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".v2i") returned 0x0 [0043.600] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch="s\r\n.v2i") returned 0x0 [0043.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.601] lstrlenW (lpString=".sql") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".sql") returned 0x0 [0043.601] lstrlenW (lpString=".mdf") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".mdf") returned 0x0 [0043.601] lstrlenW (lpString=".txt") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".txt") returned 0x0 [0043.601] lstrlenW (lpString=".dbf") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".dbf") returned 0x0 [0043.601] lstrlenW (lpString=".ckp") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".ckp") returned 0x0 [0043.601] lstrlenW (lpString=".dacpac") returned 7 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".dacpac") returned 0x0 [0043.601] lstrlenW (lpString=".db3") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".db3") returned 0x0 [0043.601] lstrlenW (lpString=".dtxs") returned 5 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".dtxs") returned 0x0 [0043.601] lstrlenW (lpString=".mdt") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".mdt") returned 0x0 [0043.601] lstrlenW (lpString=".sdf") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".sdf") returned 0x0 [0043.601] lstrlenW (lpString=".MDF") returned 4 [0043.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".MDF") returned 0x0 [0043.601] lstrlenW (lpString=".DBF") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".DBF") returned 0x0 [0043.602] lstrlenW (lpString=".DB") returned 3 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".DB") returned 0x0 [0043.602] lstrlenW (lpString=".db") returned 3 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".db") returned 0x0 [0043.602] lstrlenW (lpString=".ndf") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".ndf") returned 0x0 [0043.602] lstrlenW (lpString=".NDF") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".NDF") returned 0x0 [0043.602] lstrlenW (lpString=".Mdf") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".Mdf") returned 0x0 [0043.602] lstrlenW (lpString=".dat") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".dat") returned 0x0 [0043.602] lstrlenW (lpString=".DAT") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".DAT") returned 0x0 [0043.602] lstrlenW (lpString=".ldf") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".ldf") returned 0x0 [0043.602] lstrlenW (lpString=".LDF") returned 4 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch=".LDF") returned 0x0 [0043.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.602] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.603] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.603] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16360432469) returned 1 [0043.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8ce4eb0, dwHighDateTime=0x1d585b4)) [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c48 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c48 | out: hHeap=0x260000) returned 1 [0043.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7278 [0043.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7278 | out: hHeap=0x260000) returned 1 [0043.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.604] GetLastError () returned 0x0 [0043.604] GetLastError () returned 0x0 [0043.604] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.604] GetLastError () returned 0x0 [0043.604] GetLastError () returned 0x0 [0043.604] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x238fdb0*=0x285, lpOverlapped=0x0) returned 1 [0043.605] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.605] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x285, lpOverlapped=0x0) returned 1 [0043.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.605] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.605] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.606] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.606] CloseHandle (hObject=0x108) returned 1 [0043.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.[deadmin@cock.li].deadmin")) returned 1 [0043.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.607] GetLastError () returned 0x0 [0043.607] RtlWakeConditionVariable () returned 0x27e828 [0043.607] GetCurrentThreadId () returned 0x99c [0043.607] GetCurrentThreadId () returned 0x99c [0043.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0043.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c10 | out: hHeap=0x260000) returned 1 [0043.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6360 [0043.607] lstrlenW (lpString=".ldf") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".ldf") returned 0x0 [0043.607] lstrlenW (lpString=".vhd") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".vhd") returned 0x0 [0043.607] lstrlenW (lpString=".vhdx") returned 5 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".vhdx") returned 0x0 [0043.607] lstrlenW (lpString=".pst") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".pst") returned 0x0 [0043.607] lstrlenW (lpString=".ost") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".ost") returned 0x0 [0043.607] lstrlenW (lpString=".bak") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".bak") returned 0x0 [0043.607] lstrlenW (lpString=".bac") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".bac") returned 0x0 [0043.607] lstrlenW (lpString=".sys") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".sys") returned 0x0 [0043.607] lstrlenW (lpString=".v2i") returned 4 [0043.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch=".v2i") returned 0x0 [0043.607] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0043.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.608] RtlWakeConditionVariable () returned 0x27e828 [0043.608] GetCurrentThreadId () returned 0x99c [0043.608] GetCurrentThreadId () returned 0x99c [0043.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6c90 | out: hHeap=0x260000) returned 1 [0043.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337bd8 | out: hHeap=0x260000) returned 1 [0043.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6c90 [0043.608] lstrlenW (lpString=".ldf") returned 4 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".ldf") returned 0x0 [0043.608] lstrlenW (lpString=".vhd") returned 4 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".vhd") returned 0x0 [0043.608] lstrlenW (lpString=".vhdx") returned 5 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".vhdx") returned 0x0 [0043.608] lstrlenW (lpString=".pst") returned 4 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".pst") returned 0x0 [0043.608] lstrlenW (lpString=".ost") returned 4 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".ost") returned 0x0 [0043.608] lstrlenW (lpString=".bak") returned 4 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".bak") returned 0x0 [0043.608] lstrlenW (lpString=".bac") returned 4 [0043.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".bac") returned 0x0 [0043.608] lstrlenW (lpString=".sys") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".sys") returned 0x0 [0043.609] lstrlenW (lpString=".v2i") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch=".v2i") returned 0x0 [0043.609] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6c90 | out: hHeap=0x260000) returned 1 [0043.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.609] RtlWakeConditionVariable () returned 0x27e828 [0043.609] GetCurrentThreadId () returned 0x99c [0043.609] GetCurrentThreadId () returned 0x99c [0043.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f71d0 | out: hHeap=0x260000) returned 1 [0043.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ba0 | out: hHeap=0x260000) returned 1 [0043.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f71d0 [0043.609] lstrlenW (lpString=".ldf") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".ldf") returned 0x0 [0043.609] lstrlenW (lpString=".vhd") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".vhd") returned 0x0 [0043.609] lstrlenW (lpString=".vhdx") returned 5 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".vhdx") returned 0x0 [0043.609] lstrlenW (lpString=".pst") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".pst") returned 0x0 [0043.609] lstrlenW (lpString=".ost") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".ost") returned 0x0 [0043.609] lstrlenW (lpString=".bak") returned 4 [0043.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".bak") returned 0x0 [0043.610] lstrlenW (lpString=".bac") returned 4 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".bac") returned 0x0 [0043.610] lstrlenW (lpString=".sys") returned 4 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".sys") returned 0x0 [0043.610] lstrlenW (lpString=".v2i") returned 4 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch=".v2i") returned 0x0 [0043.610] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f71d0 | out: hHeap=0x260000) returned 1 [0043.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.610] RtlWakeConditionVariable () returned 0x27e828 [0043.610] GetCurrentThreadId () returned 0x99c [0043.610] GetCurrentThreadId () returned 0x99c [0043.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7470 | out: hHeap=0x260000) returned 1 [0043.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337af8 | out: hHeap=0x260000) returned 1 [0043.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7470 [0043.610] lstrlenW (lpString=".ldf") returned 4 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".ldf") returned 0x0 [0043.610] lstrlenW (lpString=".vhd") returned 4 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".vhd") returned 0x0 [0043.610] lstrlenW (lpString=".vhdx") returned 5 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".vhdx") returned 0x0 [0043.610] lstrlenW (lpString=".pst") returned 4 [0043.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".pst") returned 0x0 [0043.611] lstrlenW (lpString=".ost") returned 4 [0043.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".ost") returned 0x0 [0043.611] lstrlenW (lpString=".bak") returned 4 [0043.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".bak") returned 0x0 [0043.611] lstrlenW (lpString=".bac") returned 4 [0043.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".bac") returned 0x0 [0043.611] lstrlenW (lpString=".sys") returned 4 [0043.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".sys") returned 0x0 [0043.611] lstrlenW (lpString=".v2i") returned 4 [0043.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch=".v2i") returned 0x0 [0043.611] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7470 | out: hHeap=0x260000) returned 1 [0043.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.612] RtlWakeConditionVariable () returned 0x27e828 [0043.612] GetCurrentThreadId () returned 0x99c [0043.612] GetCurrentThreadId () returned 0x99c [0043.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f73c8 | out: hHeap=0x260000) returned 1 [0043.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948e0 | out: hHeap=0x260000) returned 1 [0043.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f73c8 [0043.612] lstrlenW (lpString=".ldf") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".ldf") returned 0x0 [0043.612] lstrlenW (lpString=".vhd") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".vhd") returned 0x0 [0043.612] lstrlenW (lpString=".vhdx") returned 5 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".vhdx") returned 0x0 [0043.612] lstrlenW (lpString=".pst") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".pst") returned 0x0 [0043.612] lstrlenW (lpString=".ost") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".ost") returned 0x0 [0043.612] lstrlenW (lpString=".bak") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".bak") returned 0x0 [0043.612] lstrlenW (lpString=".bac") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".bac") returned 0x0 [0043.612] lstrlenW (lpString=".sys") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".sys") returned 0x0 [0043.612] lstrlenW (lpString=".v2i") returned 4 [0043.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch=".v2i") returned 0x0 [0043.613] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f73c8 | out: hHeap=0x260000) returned 1 [0043.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.613] RtlWakeConditionVariable () returned 0x27e828 [0043.613] GetCurrentThreadId () returned 0x99c [0043.613] GetCurrentThreadId () returned 0x99c [0043.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297438 | out: hHeap=0x260000) returned 1 [0043.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948a8 | out: hHeap=0x260000) returned 1 [0043.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297438 [0043.613] lstrlenW (lpString=".ldf") returned 4 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".ldf") returned 0x0 [0043.613] lstrlenW (lpString=".vhd") returned 4 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".vhd") returned 0x0 [0043.613] lstrlenW (lpString=".vhdx") returned 5 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".vhdx") returned 0x0 [0043.613] lstrlenW (lpString=".pst") returned 4 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".pst") returned 0x0 [0043.613] lstrlenW (lpString=".ost") returned 4 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".ost") returned 0x0 [0043.613] lstrlenW (lpString=".bak") returned 4 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".bak") returned 0x0 [0043.613] lstrlenW (lpString=".bac") returned 4 [0043.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".bac") returned 0x0 [0043.613] lstrlenW (lpString=".sys") returned 4 [0043.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".sys") returned 0x0 [0043.614] lstrlenW (lpString=".v2i") returned 4 [0043.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch=".v2i") returned 0x0 [0043.614] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297438 | out: hHeap=0x260000) returned 1 [0043.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0043.616] RtlWakeConditionVariable () returned 0x27e828 [0043.616] GetCurrentThreadId () returned 0x99c [0043.616] GetCurrentThreadId () returned 0x99c [0043.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6e88 | out: hHeap=0x260000) returned 1 [0043.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294870 | out: hHeap=0x260000) returned 1 [0043.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6e88 [0043.616] lstrlenW (lpString=".ldf") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".ldf") returned 0x0 [0043.616] lstrlenW (lpString=".vhd") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".vhd") returned 0x0 [0043.616] lstrlenW (lpString=".vhdx") returned 5 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".vhdx") returned 0x0 [0043.616] lstrlenW (lpString=".pst") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".pst") returned 0x0 [0043.616] lstrlenW (lpString=".ost") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".ost") returned 0x0 [0043.616] lstrlenW (lpString=".bak") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".bak") returned 0x0 [0043.616] lstrlenW (lpString=".bac") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".bac") returned 0x0 [0043.616] lstrlenW (lpString=".sys") returned 4 [0043.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".sys") returned 0x0 [0043.616] lstrlenW (lpString=".v2i") returned 4 [0043.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch=".v2i") returned 0x0 [0043.617] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6e88 | out: hHeap=0x260000) returned 1 [0043.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.617] RtlWakeConditionVariable () returned 0x27e828 [0043.617] GetCurrentThreadId () returned 0x99c [0043.617] GetCurrentThreadId () returned 0x99c [0043.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6558 | out: hHeap=0x260000) returned 1 [0043.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294838 | out: hHeap=0x260000) returned 1 [0043.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6558 [0043.618] lstrlenW (lpString=".ldf") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".ldf") returned 0x0 [0043.618] lstrlenW (lpString=".vhd") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".vhd") returned 0x0 [0043.618] lstrlenW (lpString=".vhdx") returned 5 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".vhdx") returned 0x0 [0043.618] lstrlenW (lpString=".pst") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".pst") returned 0x0 [0043.618] lstrlenW (lpString=".ost") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".ost") returned 0x0 [0043.618] lstrlenW (lpString=".bak") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".bak") returned 0x0 [0043.618] lstrlenW (lpString=".bac") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".bac") returned 0x0 [0043.618] lstrlenW (lpString=".sys") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".sys") returned 0x0 [0043.618] lstrlenW (lpString=".v2i") returned 4 [0043.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch=".v2i") returned 0x0 [0043.618] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6558 | out: hHeap=0x260000) returned 1 [0043.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.619] RtlWakeConditionVariable () returned 0x27e828 [0043.619] GetCurrentThreadId () returned 0x99c [0043.619] GetCurrentThreadId () returned 0x99c [0043.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6be8 | out: hHeap=0x260000) returned 1 [0043.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294800 | out: hHeap=0x260000) returned 1 [0043.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6be8 [0043.619] lstrlenW (lpString=".ldf") returned 4 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".ldf") returned 0x0 [0043.619] lstrlenW (lpString=".vhd") returned 4 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".vhd") returned 0x0 [0043.619] lstrlenW (lpString=".vhdx") returned 5 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".vhdx") returned 0x0 [0043.619] lstrlenW (lpString=".pst") returned 4 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".pst") returned 0x0 [0043.619] lstrlenW (lpString=".ost") returned 4 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".ost") returned 0x0 [0043.619] lstrlenW (lpString=".bak") returned 4 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".bak") returned 0x0 [0043.619] lstrlenW (lpString=".bac") returned 4 [0043.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".bac") returned 0x0 [0043.619] lstrlenW (lpString=".sys") returned 4 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".sys") returned 0x0 [0043.620] lstrlenW (lpString=".v2i") returned 4 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch=".v2i") returned 0x0 [0043.620] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", lpSrch="s\r\n.v2i") returned 0x0 [0043.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6be8 | out: hHeap=0x260000) returned 1 [0043.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.620] RtlWakeConditionVariable () returned 0x27e828 [0043.620] GetCurrentThreadId () returned 0x99c [0043.620] GetCurrentThreadId () returned 0x99c [0043.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0043.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2947c8 | out: hHeap=0x260000) returned 1 [0043.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0043.620] lstrlenW (lpString=".ldf") returned 4 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".ldf") returned 0x0 [0043.620] lstrlenW (lpString=".vhd") returned 4 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".vhd") returned 0x0 [0043.620] lstrlenW (lpString=".vhdx") returned 5 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".vhdx") returned 0x0 [0043.620] lstrlenW (lpString=".pst") returned 4 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".pst") returned 0x0 [0043.620] lstrlenW (lpString=".ost") returned 4 [0043.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".ost") returned 0x0 [0043.620] lstrlenW (lpString=".bak") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".bak") returned 0x0 [0043.621] lstrlenW (lpString=".bac") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".bac") returned 0x0 [0043.621] lstrlenW (lpString=".sys") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".sys") returned 0x0 [0043.621] lstrlenW (lpString=".v2i") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch=".v2i") returned 0x0 [0043.621] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", lpSrch="s\r\n.v2i") returned 0x0 [0043.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f62b8 | out: hHeap=0x260000) returned 1 [0043.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.621] RtlWakeConditionVariable () returned 0x27e828 [0043.621] GetCurrentThreadId () returned 0x99c [0043.621] GetCurrentThreadId () returned 0x99c [0043.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6de0 | out: hHeap=0x260000) returned 1 [0043.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946e8 | out: hHeap=0x260000) returned 1 [0043.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6de0 [0043.621] lstrlenW (lpString=".ldf") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".ldf") returned 0x0 [0043.621] lstrlenW (lpString=".vhd") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".vhd") returned 0x0 [0043.621] lstrlenW (lpString=".vhdx") returned 5 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".vhdx") returned 0x0 [0043.621] lstrlenW (lpString=".pst") returned 4 [0043.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".pst") returned 0x0 [0043.621] lstrlenW (lpString=".ost") returned 4 [0043.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".ost") returned 0x0 [0043.622] lstrlenW (lpString=".bak") returned 4 [0043.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".bak") returned 0x0 [0043.622] lstrlenW (lpString=".bac") returned 4 [0043.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".bac") returned 0x0 [0043.622] lstrlenW (lpString=".sys") returned 4 [0043.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".sys") returned 0x0 [0043.622] lstrlenW (lpString=".v2i") returned 4 [0043.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch=".v2i") returned 0x0 [0043.622] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6de0 | out: hHeap=0x260000) returned 1 [0043.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.623] RtlWakeConditionVariable () returned 0x27e828 [0043.623] GetCurrentThreadId () returned 0x99c [0043.623] GetCurrentThreadId () returned 0x99c [0043.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6600 | out: hHeap=0x260000) returned 1 [0043.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946b0 | out: hHeap=0x260000) returned 1 [0043.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6600 [0043.623] lstrlenW (lpString=".ldf") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".ldf") returned 0x0 [0043.623] lstrlenW (lpString=".vhd") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".vhd") returned 0x0 [0043.623] lstrlenW (lpString=".vhdx") returned 5 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".vhdx") returned 0x0 [0043.623] lstrlenW (lpString=".pst") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".pst") returned 0x0 [0043.623] lstrlenW (lpString=".ost") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".ost") returned 0x0 [0043.623] lstrlenW (lpString=".bak") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".bak") returned 0x0 [0043.623] lstrlenW (lpString=".bac") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".bac") returned 0x0 [0043.623] lstrlenW (lpString=".sys") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".sys") returned 0x0 [0043.623] lstrlenW (lpString=".v2i") returned 4 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch=".v2i") returned 0x0 [0043.623] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6600 | out: hHeap=0x260000) returned 1 [0043.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.624] RtlWakeConditionVariable () returned 0x27e828 [0043.624] GetCurrentThreadId () returned 0x99c [0043.624] GetCurrentThreadId () returned 0x99c [0043.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297308 | out: hHeap=0x260000) returned 1 [0043.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294678 | out: hHeap=0x260000) returned 1 [0043.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0043.624] lstrlenW (lpString=".ldf") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".ldf") returned 0x0 [0043.624] lstrlenW (lpString=".vhd") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".vhd") returned 0x0 [0043.624] lstrlenW (lpString=".vhdx") returned 5 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".vhdx") returned 0x0 [0043.624] lstrlenW (lpString=".pst") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".pst") returned 0x0 [0043.624] lstrlenW (lpString=".ost") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".ost") returned 0x0 [0043.624] lstrlenW (lpString=".bak") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".bak") returned 0x0 [0043.624] lstrlenW (lpString=".bac") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".bac") returned 0x0 [0043.624] lstrlenW (lpString=".sys") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".sys") returned 0x0 [0043.624] lstrlenW (lpString=".v2i") returned 4 [0043.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch=".v2i") returned 0x0 [0043.625] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.625] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297308 | out: hHeap=0x260000) returned 1 [0043.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0043.625] RtlWakeConditionVariable () returned 0x27e828 [0043.625] GetCurrentThreadId () returned 0x99c [0043.626] GetCurrentThreadId () returned 0x99c [0043.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294640 | out: hHeap=0x260000) returned 1 [0043.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297270 [0043.626] lstrlenW (lpString=".ldf") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".ldf") returned 0x0 [0043.626] lstrlenW (lpString=".vhd") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".vhd") returned 0x0 [0043.626] lstrlenW (lpString=".vhdx") returned 5 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".vhdx") returned 0x0 [0043.626] lstrlenW (lpString=".pst") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".pst") returned 0x0 [0043.626] lstrlenW (lpString=".ost") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".ost") returned 0x0 [0043.626] lstrlenW (lpString=".bak") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".bak") returned 0x0 [0043.626] lstrlenW (lpString=".bac") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".bac") returned 0x0 [0043.626] lstrlenW (lpString=".sys") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".sys") returned 0x0 [0043.626] lstrlenW (lpString=".v2i") returned 4 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch=".v2i") returned 0x0 [0043.626] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297270 | out: hHeap=0x260000) returned 1 [0043.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0043.627] RtlWakeConditionVariable () returned 0x27e828 [0043.627] GetCurrentThreadId () returned 0x99c [0043.627] GetCurrentThreadId () returned 0x99c [0043.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2e10 [0043.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f33d0 | out: hHeap=0x260000) returned 1 [0043.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294608 | out: hHeap=0x260000) returned 1 [0043.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f33d0 [0043.627] lstrlenW (lpString=".ldf") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".ldf") returned 0x0 [0043.627] lstrlenW (lpString=".vhd") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".vhd") returned 0x0 [0043.627] lstrlenW (lpString=".vhdx") returned 5 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".vhdx") returned 0x0 [0043.627] lstrlenW (lpString=".pst") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".pst") returned 0x0 [0043.627] lstrlenW (lpString=".ost") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".ost") returned 0x0 [0043.627] lstrlenW (lpString=".bak") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".bak") returned 0x0 [0043.627] lstrlenW (lpString=".bac") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".bac") returned 0x0 [0043.627] lstrlenW (lpString=".sys") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".sys") returned 0x0 [0043.627] lstrlenW (lpString=".v2i") returned 4 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch=".v2i") returned 0x0 [0043.627] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f33d0 | out: hHeap=0x260000) returned 1 [0043.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2e10 | out: hHeap=0x260000) returned 1 [0043.628] RtlWakeConditionVariable () returned 0x27e828 [0043.628] GetCurrentThreadId () returned 0x99c [0043.628] GetCurrentThreadId () returned 0x99c [0043.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297140 | out: hHeap=0x260000) returned 1 [0043.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2945d0 | out: hHeap=0x260000) returned 1 [0043.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297140 [0043.628] lstrlenW (lpString=".ldf") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".ldf") returned 0x0 [0043.628] lstrlenW (lpString=".vhd") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".vhd") returned 0x0 [0043.628] lstrlenW (lpString=".vhdx") returned 5 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".vhdx") returned 0x0 [0043.628] lstrlenW (lpString=".pst") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".pst") returned 0x0 [0043.628] lstrlenW (lpString=".ost") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".ost") returned 0x0 [0043.628] lstrlenW (lpString=".bak") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".bak") returned 0x0 [0043.628] lstrlenW (lpString=".bac") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".bac") returned 0x0 [0043.628] lstrlenW (lpString=".sys") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".sys") returned 0x0 [0043.628] lstrlenW (lpString=".v2i") returned 4 [0043.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch=".v2i") returned 0x0 [0043.628] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", lpSrch="s\r\n.v2i") returned 0x0 [0043.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297140 | out: hHeap=0x260000) returned 1 [0043.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297860 | out: hHeap=0x260000) returned 1 [0043.630] RtlWakeConditionVariable () returned 0x27e828 [0043.630] GetCurrentThreadId () returned 0x99c [0043.630] GetCurrentThreadId () returned 0x99c [0043.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6d38 | out: hHeap=0x260000) returned 1 [0043.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294598 | out: hHeap=0x260000) returned 1 [0043.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6d38 [0043.630] lstrlenW (lpString=".ldf") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".ldf") returned 0x0 [0043.630] lstrlenW (lpString=".vhd") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".vhd") returned 0x0 [0043.630] lstrlenW (lpString=".vhdx") returned 5 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".vhdx") returned 0x0 [0043.630] lstrlenW (lpString=".pst") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".pst") returned 0x0 [0043.630] lstrlenW (lpString=".ost") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".ost") returned 0x0 [0043.630] lstrlenW (lpString=".bak") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".bak") returned 0x0 [0043.630] lstrlenW (lpString=".bac") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".bac") returned 0x0 [0043.630] lstrlenW (lpString=".sys") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".sys") returned 0x0 [0043.630] lstrlenW (lpString=".v2i") returned 4 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch=".v2i") returned 0x0 [0043.630] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6d38 | out: hHeap=0x260000) returned 1 [0043.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.631] RtlWakeConditionVariable () returned 0x27e828 [0043.631] GetCurrentThreadId () returned 0x99c [0043.631] GetCurrentThreadId () returned 0x99c [0043.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2e10 [0043.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3318 | out: hHeap=0x260000) returned 1 [0043.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299440 | out: hHeap=0x260000) returned 1 [0043.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3318 [0043.631] lstrlenW (lpString=".ldf") returned 4 [0043.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".ldf") returned 0x0 [0043.631] lstrlenW (lpString=".vhd") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".vhd") returned 0x0 [0043.632] lstrlenW (lpString=".vhdx") returned 5 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".vhdx") returned 0x0 [0043.632] lstrlenW (lpString=".pst") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".pst") returned 0x0 [0043.632] lstrlenW (lpString=".ost") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".ost") returned 0x0 [0043.632] lstrlenW (lpString=".bak") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".bak") returned 0x0 [0043.632] lstrlenW (lpString=".bac") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".bac") returned 0x0 [0043.632] lstrlenW (lpString=".sys") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".sys") returned 0x0 [0043.632] lstrlenW (lpString=".v2i") returned 4 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch=".v2i") returned 0x0 [0043.632] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3318 | out: hHeap=0x260000) returned 1 [0043.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2e10 | out: hHeap=0x260000) returned 1 [0043.632] RtlWakeConditionVariable () returned 0x27e828 [0043.632] GetCurrentThreadId () returned 0x99c [0043.632] GetCurrentThreadId () returned 0x99c [0043.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f66a8 | out: hHeap=0x260000) returned 1 [0043.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299408 | out: hHeap=0x260000) returned 1 [0043.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f66a8 [0043.633] lstrlenW (lpString=".ldf") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".ldf") returned 0x0 [0043.633] lstrlenW (lpString=".vhd") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".vhd") returned 0x0 [0043.633] lstrlenW (lpString=".vhdx") returned 5 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".vhdx") returned 0x0 [0043.633] lstrlenW (lpString=".pst") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".pst") returned 0x0 [0043.633] lstrlenW (lpString=".ost") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".ost") returned 0x0 [0043.633] lstrlenW (lpString=".bak") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".bak") returned 0x0 [0043.633] lstrlenW (lpString=".bac") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".bac") returned 0x0 [0043.633] lstrlenW (lpString=".sys") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".sys") returned 0x0 [0043.633] lstrlenW (lpString=".v2i") returned 4 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch=".v2i") returned 0x0 [0043.633] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.633] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f66a8 | out: hHeap=0x260000) returned 1 [0043.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.633] RtlWakeConditionVariable () returned 0x27e828 [0043.633] GetCurrentThreadId () returned 0x99c [0043.633] GetCurrentThreadId () returned 0x99c [0043.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6210 | out: hHeap=0x260000) returned 1 [0043.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2993d0 | out: hHeap=0x260000) returned 1 [0043.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6210 [0043.634] lstrlenW (lpString=".ldf") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".ldf") returned 0x0 [0043.634] lstrlenW (lpString=".vhd") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".vhd") returned 0x0 [0043.634] lstrlenW (lpString=".vhdx") returned 5 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".vhdx") returned 0x0 [0043.634] lstrlenW (lpString=".pst") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".pst") returned 0x0 [0043.634] lstrlenW (lpString=".ost") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".ost") returned 0x0 [0043.634] lstrlenW (lpString=".bak") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".bak") returned 0x0 [0043.634] lstrlenW (lpString=".bac") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".bac") returned 0x0 [0043.634] lstrlenW (lpString=".sys") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".sys") returned 0x0 [0043.634] lstrlenW (lpString=".v2i") returned 4 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch=".v2i") returned 0x0 [0043.634] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6210 | out: hHeap=0x260000) returned 1 [0043.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.636] RtlWakeConditionVariable () returned 0x27e828 [0043.636] GetCurrentThreadId () returned 0x99c [0043.636] GetCurrentThreadId () returned 0x99c [0043.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6b40 | out: hHeap=0x260000) returned 1 [0043.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299398 | out: hHeap=0x260000) returned 1 [0043.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6b40 [0043.636] lstrlenW (lpString=".ldf") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".ldf") returned 0x0 [0043.636] lstrlenW (lpString=".vhd") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".vhd") returned 0x0 [0043.636] lstrlenW (lpString=".vhdx") returned 5 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".vhdx") returned 0x0 [0043.636] lstrlenW (lpString=".pst") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".pst") returned 0x0 [0043.636] lstrlenW (lpString=".ost") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".ost") returned 0x0 [0043.636] lstrlenW (lpString=".bak") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".bak") returned 0x0 [0043.636] lstrlenW (lpString=".bac") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".bac") returned 0x0 [0043.636] lstrlenW (lpString=".sys") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".sys") returned 0x0 [0043.636] lstrlenW (lpString=".v2i") returned 4 [0043.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch=".v2i") returned 0x0 [0043.637] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6b40 | out: hHeap=0x260000) returned 1 [0043.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.637] RtlWakeConditionVariable () returned 0x27e828 [0043.637] GetCurrentThreadId () returned 0x99c [0043.637] GetCurrentThreadId () returned 0x99c [0043.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6a98 | out: hHeap=0x260000) returned 1 [0043.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299360 | out: hHeap=0x260000) returned 1 [0043.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6a98 [0043.638] lstrlenW (lpString=".ldf") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".ldf") returned 0x0 [0043.638] lstrlenW (lpString=".vhd") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".vhd") returned 0x0 [0043.638] lstrlenW (lpString=".vhdx") returned 5 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".vhdx") returned 0x0 [0043.638] lstrlenW (lpString=".pst") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".pst") returned 0x0 [0043.638] lstrlenW (lpString=".ost") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".ost") returned 0x0 [0043.638] lstrlenW (lpString=".bak") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".bak") returned 0x0 [0043.638] lstrlenW (lpString=".bac") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".bac") returned 0x0 [0043.638] lstrlenW (lpString=".sys") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".sys") returned 0x0 [0043.638] lstrlenW (lpString=".v2i") returned 4 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch=".v2i") returned 0x0 [0043.638] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6a98 | out: hHeap=0x260000) returned 1 [0043.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.638] RtlWakeConditionVariable () returned 0x27e828 [0043.638] GetCurrentThreadId () returned 0x99c [0043.638] GetCurrentThreadId () returned 0x99c [0043.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2e10 [0043.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2798 | out: hHeap=0x260000) returned 1 [0043.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299328 | out: hHeap=0x260000) returned 1 [0043.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2798 [0043.639] lstrlenW (lpString=".ldf") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".ldf") returned 0x0 [0043.639] lstrlenW (lpString=".vhd") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".vhd") returned 0x0 [0043.639] lstrlenW (lpString=".vhdx") returned 5 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".vhdx") returned 0x0 [0043.639] lstrlenW (lpString=".pst") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".pst") returned 0x0 [0043.639] lstrlenW (lpString=".ost") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".ost") returned 0x0 [0043.639] lstrlenW (lpString=".bak") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".bak") returned 0x0 [0043.639] lstrlenW (lpString=".bac") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".bac") returned 0x0 [0043.639] lstrlenW (lpString=".sys") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".sys") returned 0x0 [0043.639] lstrlenW (lpString=".v2i") returned 4 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch=".v2i") returned 0x0 [0043.639] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2798 | out: hHeap=0x260000) returned 1 [0043.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2e10 | out: hHeap=0x260000) returned 1 [0043.639] RtlWakeConditionVariable () returned 0x27e828 [0043.639] GetCurrentThreadId () returned 0x99c [0043.640] GetCurrentThreadId () returned 0x99c [0043.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f69f0 | out: hHeap=0x260000) returned 1 [0043.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992f0 | out: hHeap=0x260000) returned 1 [0043.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f69f0 [0043.640] lstrlenW (lpString=".ldf") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".ldf") returned 0x0 [0043.640] lstrlenW (lpString=".vhd") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".vhd") returned 0x0 [0043.640] lstrlenW (lpString=".vhdx") returned 5 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".vhdx") returned 0x0 [0043.640] lstrlenW (lpString=".pst") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".pst") returned 0x0 [0043.640] lstrlenW (lpString=".ost") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".ost") returned 0x0 [0043.640] lstrlenW (lpString=".bak") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".bak") returned 0x0 [0043.640] lstrlenW (lpString=".bac") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".bac") returned 0x0 [0043.640] lstrlenW (lpString=".sys") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".sys") returned 0x0 [0043.640] lstrlenW (lpString=".v2i") returned 4 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch=".v2i") returned 0x0 [0043.640] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0043.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f69f0 | out: hHeap=0x260000) returned 1 [0043.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.641] RtlWakeConditionVariable () returned 0x27e828 [0043.641] GetCurrentThreadId () returned 0x99c [0043.641] GetCurrentThreadId () returned 0x99c [0043.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296be8 | out: hHeap=0x260000) returned 1 [0043.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992b8 | out: hHeap=0x260000) returned 1 [0043.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296be8 [0043.641] lstrlenW (lpString=".ldf") returned 4 [0043.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".ldf") returned 0x0 [0043.641] lstrlenW (lpString=".vhd") returned 4 [0043.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".vhd") returned 0x0 [0043.641] lstrlenW (lpString=".vhdx") returned 5 [0043.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".vhdx") returned 0x0 [0043.642] lstrlenW (lpString=".pst") returned 4 [0043.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".pst") returned 0x0 [0043.642] lstrlenW (lpString=".ost") returned 4 [0043.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".ost") returned 0x0 [0043.642] lstrlenW (lpString=".bak") returned 4 [0043.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".bak") returned 0x0 [0043.642] lstrlenW (lpString=".bac") returned 4 [0043.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".bac") returned 0x0 [0043.642] lstrlenW (lpString=".sys") returned 4 [0043.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".sys") returned 0x0 [0043.642] lstrlenW (lpString=".v2i") returned 4 [0043.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpSrch=".v2i") returned 0x0 [0043.798] RtlWakeConditionVariable () returned 0x27e828 [0043.799] GetCurrentThreadId () returned 0x99c [0043.799] GetCurrentThreadId () returned 0x99c [0043.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0043.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb20 | out: hHeap=0x260000) returned 1 [0043.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0043.821] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.822] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.822] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x3512e8 [0043.822] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16382344259) returned 1 [0043.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8efa1f0, dwHighDateTime=0x1d585b4)) [0043.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cae8 [0043.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cae8 | out: hHeap=0x260000) returned 1 [0043.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0043.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296be8 [0043.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0043.823] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.823] GetLastError () returned 0x0 [0043.823] GetLastError () returned 0x0 [0043.823] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.823] GetLastError () returned 0x0 [0043.823] GetLastError () returned 0x0 [0043.823] ReadFile (in: hFile=0x104, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x238fdb0*=0x201, lpOverlapped=0x0) returned 1 [0043.824] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffdff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.824] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x201, lpOverlapped=0x0) returned 1 [0043.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.825] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.825] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.825] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.825] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.825] CloseHandle (hObject=0x104) returned 1 [0043.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.[deadmin@cock.li].deadmin")) returned 1 [0043.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.854] GetLastError () returned 0x0 [0043.855] RtlWakeConditionVariable () returned 0x27e828 [0043.855] GetCurrentThreadId () returned 0x99c [0043.855] GetCurrentThreadId () returned 0x99c [0043.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d610 | out: hHeap=0x260000) returned 1 [0043.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1338 | out: hHeap=0x260000) returned 1 [0043.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d610 [0043.855] lstrlenW (lpString=".ldf") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".ldf") returned 0x0 [0043.855] lstrlenW (lpString=".vhd") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".vhd") returned 0x0 [0043.855] lstrlenW (lpString=".vhdx") returned 5 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".vhdx") returned 0x0 [0043.855] lstrlenW (lpString=".pst") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".pst") returned 0x0 [0043.855] lstrlenW (lpString=".ost") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".ost") returned 0x0 [0043.855] lstrlenW (lpString=".bak") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".bak") returned 0x0 [0043.855] lstrlenW (lpString=".bac") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".bac") returned 0x0 [0043.855] lstrlenW (lpString=".sys") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".sys") returned 0x0 [0043.855] lstrlenW (lpString=".v2i") returned 4 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".v2i") returned 0x0 [0043.855] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0043.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.856] lstrlenW (lpString=".sql") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".sql") returned 0x0 [0043.856] lstrlenW (lpString=".mdf") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".mdf") returned 0x0 [0043.856] lstrlenW (lpString=".txt") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".txt") returned 0x0 [0043.856] lstrlenW (lpString=".dbf") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".dbf") returned 0x0 [0043.856] lstrlenW (lpString=".ckp") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".ckp") returned 0x0 [0043.856] lstrlenW (lpString=".dacpac") returned 7 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".dacpac") returned 0x0 [0043.856] lstrlenW (lpString=".db3") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".db3") returned 0x0 [0043.856] lstrlenW (lpString=".dtxs") returned 5 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".dtxs") returned 0x0 [0043.856] lstrlenW (lpString=".mdt") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".mdt") returned 0x0 [0043.856] lstrlenW (lpString=".sdf") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".sdf") returned 0x0 [0043.856] lstrlenW (lpString=".MDF") returned 4 [0043.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".MDF") returned 0x0 [0043.856] lstrlenW (lpString=".DBF") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".DBF") returned 0x0 [0043.857] lstrlenW (lpString=".DB") returned 3 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".DB") returned 0x0 [0043.857] lstrlenW (lpString=".db") returned 3 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".db") returned 0x0 [0043.857] lstrlenW (lpString=".ndf") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".ndf") returned 0x0 [0043.857] lstrlenW (lpString=".NDF") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".NDF") returned 0x0 [0043.857] lstrlenW (lpString=".Mdf") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".Mdf") returned 0x0 [0043.857] lstrlenW (lpString=".dat") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".dat") returned 0x0 [0043.857] lstrlenW (lpString=".DAT") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".DAT") returned 0x0 [0043.857] lstrlenW (lpString=".ldf") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".ldf") returned 0x0 [0043.857] lstrlenW (lpString=".LDF") returned 4 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch=".LDF") returned 0x0 [0043.857] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.857] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.858] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.858] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16385930716) returned 1 [0043.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8f464b0, dwHighDateTime=0x1d585b4)) [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1338 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1338 | out: hHeap=0x260000) returned 1 [0043.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d220 [0043.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d220 | out: hHeap=0x260000) returned 1 [0043.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.859] GetLastError () returned 0x0 [0043.859] GetLastError () returned 0x0 [0043.859] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.859] GetLastError () returned 0x0 [0043.859] GetLastError () returned 0x0 [0043.863] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7642, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.863] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x189be, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x189be, lpOverlapped=0x0) returned 1 [0043.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.863] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.863] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.864] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.864] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.864] CloseHandle (hObject=0x104) returned 1 [0043.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.[deadmin@cock.li].deadmin")) returned 1 [0043.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.864] GetLastError () returned 0x0 [0043.864] RtlWakeConditionVariable () returned 0x27e828 [0043.864] GetCurrentThreadId () returned 0x99c [0043.864] GetCurrentThreadId () returned 0x99c [0043.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d370 | out: hHeap=0x260000) returned 1 [0043.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0043.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0043.865] lstrlenW (lpString=".ldf") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.865] lstrlenW (lpString=".vhd") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0043.865] lstrlenW (lpString=".vhdx") returned 5 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0043.865] lstrlenW (lpString=".pst") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0043.865] lstrlenW (lpString=".ost") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0043.865] lstrlenW (lpString=".bak") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0043.865] lstrlenW (lpString=".bac") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0043.865] lstrlenW (lpString=".sys") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0043.865] lstrlenW (lpString=".v2i") returned 4 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0043.865] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0043.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.865] lstrlenW (lpString=".sql") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0043.866] lstrlenW (lpString=".mdf") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0043.866] lstrlenW (lpString=".txt") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0043.866] lstrlenW (lpString=".dbf") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0043.866] lstrlenW (lpString=".ckp") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0043.866] lstrlenW (lpString=".dacpac") returned 7 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0043.866] lstrlenW (lpString=".db3") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0043.866] lstrlenW (lpString=".dtxs") returned 5 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0043.866] lstrlenW (lpString=".mdt") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0043.866] lstrlenW (lpString=".sdf") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0043.866] lstrlenW (lpString=".MDF") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0043.866] lstrlenW (lpString=".DBF") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0043.866] lstrlenW (lpString=".DB") returned 3 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0043.866] lstrlenW (lpString=".db") returned 3 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0043.866] lstrlenW (lpString=".ndf") returned 4 [0043.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0043.866] lstrlenW (lpString=".NDF") returned 4 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0043.867] lstrlenW (lpString=".Mdf") returned 4 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0043.867] lstrlenW (lpString=".dat") returned 4 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0043.867] lstrlenW (lpString=".DAT") returned 4 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0043.867] lstrlenW (lpString=".ldf") returned 4 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.867] lstrlenW (lpString=".LDF") returned 4 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0043.867] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.867] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.868] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.868] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.868] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16386920828) returned 1 [0043.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8f6c610, dwHighDateTime=0x1d585b4)) [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ff0 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d610 [0043.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d610 | out: hHeap=0x260000) returned 1 [0043.869] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.869] GetLastError () returned 0x0 [0043.869] GetLastError () returned 0x0 [0043.869] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.869] GetLastError () returned 0x0 [0043.869] GetLastError () returned 0x0 [0043.870] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff4e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.871] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0xb20, lpOverlapped=0x0) returned 1 [0043.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.871] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.871] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.871] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.871] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.871] CloseHandle (hObject=0x104) returned 1 [0043.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0043.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.873] GetLastError () returned 0x0 [0043.873] RtlWakeConditionVariable () returned 0x27e828 [0043.873] GetCurrentThreadId () returned 0x99c [0043.873] GetCurrentThreadId () returned 0x99c [0043.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ea68 | out: hHeap=0x260000) returned 1 [0043.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1028 | out: hHeap=0x260000) returned 1 [0043.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ea68 [0043.873] lstrlenW (lpString=".ldf") returned 4 [0043.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.873] lstrlenW (lpString=".vhd") returned 4 [0043.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0043.873] lstrlenW (lpString=".vhdx") returned 5 [0043.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0043.873] lstrlenW (lpString=".pst") returned 4 [0043.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0043.873] lstrlenW (lpString=".ost") returned 4 [0043.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0043.874] lstrlenW (lpString=".bak") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0043.874] lstrlenW (lpString=".bac") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0043.874] lstrlenW (lpString=".sys") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0043.874] lstrlenW (lpString=".v2i") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0043.874] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0043.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.874] lstrlenW (lpString=".sql") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0043.874] lstrlenW (lpString=".mdf") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0043.874] lstrlenW (lpString=".txt") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0043.874] lstrlenW (lpString=".dbf") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0043.874] lstrlenW (lpString=".ckp") returned 4 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0043.874] lstrlenW (lpString=".dacpac") returned 7 [0043.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0043.875] lstrlenW (lpString=".db3") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0043.875] lstrlenW (lpString=".dtxs") returned 5 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0043.875] lstrlenW (lpString=".mdt") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0043.875] lstrlenW (lpString=".sdf") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0043.875] lstrlenW (lpString=".MDF") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0043.875] lstrlenW (lpString=".DBF") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0043.875] lstrlenW (lpString=".DB") returned 3 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0043.875] lstrlenW (lpString=".db") returned 3 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0043.875] lstrlenW (lpString=".ndf") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0043.875] lstrlenW (lpString=".NDF") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0043.875] lstrlenW (lpString=".Mdf") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0043.875] lstrlenW (lpString=".dat") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0043.875] lstrlenW (lpString=".DAT") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0043.875] lstrlenW (lpString=".ldf") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.875] lstrlenW (lpString=".LDF") returned 4 [0043.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0043.876] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.876] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.876] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.876] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.877] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16387768365) returned 1 [0043.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa8f6c610, dwHighDateTime=0x1d585b4)) [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1028 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1028 | out: hHeap=0x260000) returned 1 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d370 [0043.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d370 | out: hHeap=0x260000) returned 1 [0043.877] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.877] GetLastError () returned 0x0 [0043.877] GetLastError () returned 0x0 [0043.877] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.877] GetLastError () returned 0x0 [0043.878] GetLastError () returned 0x0 [0043.879] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff779c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.879] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x8864, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x8864, lpOverlapped=0x0) returned 1 [0043.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.879] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.879] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.880] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.880] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.880] CloseHandle (hObject=0x104) returned 1 [0043.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0043.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0043.880] GetLastError () returned 0x0 [0043.880] RtlWakeConditionVariable () returned 0x27e828 [0043.880] GetCurrentThreadId () returned 0x99c [0043.880] GetCurrentThreadId () returned 0x99c [0043.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da538 [0043.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da600 | out: hHeap=0x260000) returned 1 [0043.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1060 | out: hHeap=0x260000) returned 1 [0043.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0043.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.881] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.881] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.881] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.881] WriteFile (in: hFile=0x104, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.882] CloseHandle (hObject=0x104) returned 1 [0043.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da600 | out: hHeap=0x260000) returned 1 [0043.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0043.882] RtlWakeConditionVariable () returned 0x27e828 [0043.882] GetCurrentThreadId () returned 0x99c [0043.882] GetCurrentThreadId () returned 0x99c [0043.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d808 | out: hHeap=0x260000) returned 1 [0043.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf48 | out: hHeap=0x260000) returned 1 [0043.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0043.883] lstrlenW (lpString=".ldf") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".ldf") returned 0x0 [0043.883] lstrlenW (lpString=".vhd") returned 4 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".vhd") returned 0x0 [0043.883] lstrlenW (lpString=".vhdx") returned 5 [0043.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".vhdx") returned 0x0 [0043.956] lstrlenW (lpString=".pst") returned 4 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".pst") returned 0x0 [0043.968] lstrlenW (lpString=".ost") returned 4 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".ost") returned 0x0 [0043.968] lstrlenW (lpString=".bak") returned 4 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".bak") returned 0x0 [0043.968] lstrlenW (lpString=".bac") returned 4 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".bac") returned 0x0 [0043.968] lstrlenW (lpString=".sys") returned 4 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".sys") returned 0x0 [0043.968] lstrlenW (lpString=".v2i") returned 4 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".v2i") returned 0x0 [0043.968] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0043.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0043.969] lstrlenW (lpString=".sql") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".sql") returned 0x0 [0043.969] lstrlenW (lpString=".mdf") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".mdf") returned 0x0 [0043.969] lstrlenW (lpString=".txt") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".txt") returned 0x0 [0043.969] lstrlenW (lpString=".dbf") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".dbf") returned 0x0 [0043.969] lstrlenW (lpString=".ckp") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".ckp") returned 0x0 [0043.969] lstrlenW (lpString=".dacpac") returned 7 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".dacpac") returned 0x0 [0043.969] lstrlenW (lpString=".db3") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".db3") returned 0x0 [0043.969] lstrlenW (lpString=".dtxs") returned 5 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".dtxs") returned 0x0 [0043.969] lstrlenW (lpString=".mdt") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".mdt") returned 0x0 [0043.969] lstrlenW (lpString=".sdf") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".sdf") returned 0x0 [0043.969] lstrlenW (lpString=".MDF") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".MDF") returned 0x0 [0043.969] lstrlenW (lpString=".DBF") returned 4 [0043.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".DBF") returned 0x0 [0043.970] lstrlenW (lpString=".DB") returned 3 [0043.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".DB") returned 0x0 [0043.970] lstrlenW (lpString=".db") returned 3 [0043.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".db") returned 0x0 [0043.970] lstrlenW (lpString=".ndf") returned 4 [0043.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".ndf") returned 0x0 [0043.970] lstrlenW (lpString=".NDF") returned 4 [0043.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".NDF") returned 0x0 [0043.970] lstrlenW (lpString=".Mdf") returned 4 [0043.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".Mdf") returned 0x0 [0043.980] lstrlenW (lpString=".dat") returned 4 [0043.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".dat") returned 0x0 [0043.987] lstrlenW (lpString=".DAT") returned 4 [0043.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".DAT") returned 0x0 [0043.987] lstrlenW (lpString=".ldf") returned 4 [0043.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".ldf") returned 0x0 [0043.987] lstrlenW (lpString=".LDF") returned 4 [0043.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch=".LDF") returned 0x0 [0043.987] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.988] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0043.988] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.988] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x352500 [0043.989] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16398966796) returned 1 [0043.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9076fb0, dwHighDateTime=0x1d585b4)) [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d060 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0043.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0043.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.989] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0043.989] GetLastError () returned 0x0 [0043.989] GetLastError () returned 0x0 [0043.989] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0043.989] GetLastError () returned 0x0 [0043.989] GetLastError () returned 0x0 [0043.993] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffef249, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.993] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x10db7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x10db7, lpOverlapped=0x0) returned 1 [0043.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0043.996] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.996] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.996] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.996] CloseHandle (hObject=0x10c) returned 1 [0043.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.[deadmin@cock.li].deadmin")) returned 1 [0043.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.997] GetLastError () returned 0x0 [0043.998] RtlWakeConditionVariable () returned 0x27e828 [0043.998] GetCurrentThreadId () returned 0x99c [0043.998] GetCurrentThreadId () returned 0x99c [0043.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3c70 [0043.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3820 | out: hHeap=0x260000) returned 1 [0043.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d028 | out: hHeap=0x260000) returned 1 [0043.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3820 [0043.998] lstrlenW (lpString=".ldf") returned 4 [0043.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.998] lstrlenW (lpString=".vhd") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0043.999] lstrlenW (lpString=".vhdx") returned 5 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0043.999] lstrlenW (lpString=".pst") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0043.999] lstrlenW (lpString=".ost") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0043.999] lstrlenW (lpString=".bak") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0043.999] lstrlenW (lpString=".bac") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0043.999] lstrlenW (lpString=".sys") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0043.999] lstrlenW (lpString=".v2i") returned 4 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0043.999] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0043.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.000] lstrlenW (lpString=".sql") returned 4 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.000] lstrlenW (lpString=".mdf") returned 4 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.000] lstrlenW (lpString=".txt") returned 4 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.000] lstrlenW (lpString=".dbf") returned 4 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.000] lstrlenW (lpString=".ckp") returned 4 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.000] lstrlenW (lpString=".dacpac") returned 7 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.000] lstrlenW (lpString=".db3") returned 4 [0044.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.001] lstrlenW (lpString=".dtxs") returned 5 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.001] lstrlenW (lpString=".mdt") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.001] lstrlenW (lpString=".sdf") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.001] lstrlenW (lpString=".MDF") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.001] lstrlenW (lpString=".DBF") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.001] lstrlenW (lpString=".DB") returned 3 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.001] lstrlenW (lpString=".db") returned 3 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.001] lstrlenW (lpString=".ndf") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.001] lstrlenW (lpString=".NDF") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.001] lstrlenW (lpString=".Mdf") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.001] lstrlenW (lpString=".dat") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.001] lstrlenW (lpString=".DAT") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.001] lstrlenW (lpString=".ldf") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.001] lstrlenW (lpString=".LDF") returned 4 [0044.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.001] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.002] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.002] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.002] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x352500 [0044.003] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16400407278) returned 1 [0044.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa909d110, dwHighDateTime=0x1d585b4)) [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d028 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d028 | out: hHeap=0x260000) returned 1 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0044.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0044.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0044.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0044.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0044.003] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.004] GetLastError () returned 0x0 [0044.004] GetLastError () returned 0x0 [0044.004] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.004] GetLastError () returned 0x0 [0044.004] GetLastError () returned 0x0 [0044.007] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff94f1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.007] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x6b0f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x6b0f, lpOverlapped=0x0) returned 1 [0044.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0044.008] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.008] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.008] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.008] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.008] CloseHandle (hObject=0x10c) returned 1 [0044.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.009] GetLastError () returned 0x0 [0044.010] RtlWakeConditionVariable () returned 0x27e828 [0044.010] GetCurrentThreadId () returned 0x99c [0044.010] GetCurrentThreadId () returned 0x99c [0044.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0044.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cff0 | out: hHeap=0x260000) returned 1 [0044.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.010] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.011] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.011] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.011] WriteFile (in: hFile=0x10c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.012] CloseHandle (hObject=0x10c) returned 1 [0044.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0044.012] RtlWakeConditionVariable () returned 0x27e828 [0044.012] GetCurrentThreadId () returned 0x99c [0044.012] GetCurrentThreadId () returned 0x99c [0044.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3c70 [0044.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f36b0 | out: hHeap=0x260000) returned 1 [0044.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cfb8 | out: hHeap=0x260000) returned 1 [0044.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.012] lstrlenW (lpString=".ldf") returned 4 [0044.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".ldf") returned 0x0 [0044.012] lstrlenW (lpString=".vhd") returned 4 [0044.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".vhd") returned 0x0 [0044.012] lstrlenW (lpString=".vhdx") returned 5 [0044.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".vhdx") returned 0x0 [0044.012] lstrlenW (lpString=".pst") returned 4 [0044.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".pst") returned 0x0 [0044.012] lstrlenW (lpString=".ost") returned 4 [0044.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".ost") returned 0x0 [0044.012] lstrlenW (lpString=".bak") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".bak") returned 0x0 [0044.013] lstrlenW (lpString=".bac") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".bac") returned 0x0 [0044.013] lstrlenW (lpString=".sys") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".sys") returned 0x0 [0044.013] lstrlenW (lpString=".v2i") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".v2i") returned 0x0 [0044.013] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.013] lstrlenW (lpString=".sql") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".sql") returned 0x0 [0044.013] lstrlenW (lpString=".mdf") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".mdf") returned 0x0 [0044.013] lstrlenW (lpString=".txt") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".txt") returned 0x0 [0044.013] lstrlenW (lpString=".dbf") returned 4 [0044.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".dbf") returned 0x0 [0044.014] lstrlenW (lpString=".ckp") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".ckp") returned 0x0 [0044.014] lstrlenW (lpString=".dacpac") returned 7 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".dacpac") returned 0x0 [0044.014] lstrlenW (lpString=".db3") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".db3") returned 0x0 [0044.014] lstrlenW (lpString=".dtxs") returned 5 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".dtxs") returned 0x0 [0044.014] lstrlenW (lpString=".mdt") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".mdt") returned 0x0 [0044.014] lstrlenW (lpString=".sdf") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".sdf") returned 0x0 [0044.014] lstrlenW (lpString=".MDF") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".MDF") returned 0x0 [0044.014] lstrlenW (lpString=".DBF") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".DBF") returned 0x0 [0044.014] lstrlenW (lpString=".DB") returned 3 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".DB") returned 0x0 [0044.014] lstrlenW (lpString=".db") returned 3 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".db") returned 0x0 [0044.014] lstrlenW (lpString=".ndf") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".ndf") returned 0x0 [0044.014] lstrlenW (lpString=".NDF") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".NDF") returned 0x0 [0044.014] lstrlenW (lpString=".Mdf") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".Mdf") returned 0x0 [0044.014] lstrlenW (lpString=".dat") returned 4 [0044.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".dat") returned 0x0 [0044.015] lstrlenW (lpString=".DAT") returned 4 [0044.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".DAT") returned 0x0 [0044.015] lstrlenW (lpString=".ldf") returned 4 [0044.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".ldf") returned 0x0 [0044.015] lstrlenW (lpString=".LDF") returned 4 [0044.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch=".LDF") returned 0x0 [0044.015] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.015] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.016] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.016] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x352500 [0044.016] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16401731709) returned 1 [0044.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa90c3270, dwHighDateTime=0x1d585b4)) [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cfb8 [0044.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cfb8 | out: hHeap=0x260000) returned 1 [0044.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0044.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0044.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0044.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0044.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0044.017] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.017] GetLastError () returned 0x0 [0044.017] GetLastError () returned 0x0 [0044.017] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.017] GetLastError () returned 0x0 [0044.017] GetLastError () returned 0x0 [0044.104] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff1506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.104] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xeafa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0xeafa, lpOverlapped=0x0) returned 1 [0044.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0044.105] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.105] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.105] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.105] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.105] CloseHandle (hObject=0x10c) returned 1 [0044.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.106] GetLastError () returned 0x0 [0044.106] RtlWakeConditionVariable () returned 0x27e828 [0044.106] GetCurrentThreadId () returned 0x99c [0044.106] GetCurrentThreadId () returned 0x99c [0044.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e420 | out: hHeap=0x260000) returned 1 [0044.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d178 | out: hHeap=0x260000) returned 1 [0044.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e420 [0044.107] lstrlenW (lpString=".ldf") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".ldf") returned 0x0 [0044.107] lstrlenW (lpString=".vhd") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".vhd") returned 0x0 [0044.107] lstrlenW (lpString=".vhdx") returned 5 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".vhdx") returned 0x0 [0044.107] lstrlenW (lpString=".pst") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".pst") returned 0x0 [0044.107] lstrlenW (lpString=".ost") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".ost") returned 0x0 [0044.107] lstrlenW (lpString=".bak") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".bak") returned 0x0 [0044.107] lstrlenW (lpString=".bac") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".bac") returned 0x0 [0044.107] lstrlenW (lpString=".sys") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".sys") returned 0x0 [0044.107] lstrlenW (lpString=".v2i") returned 4 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".v2i") returned 0x0 [0044.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.108] lstrlenW (lpString=".sql") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".sql") returned 0x0 [0044.108] lstrlenW (lpString=".mdf") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".mdf") returned 0x0 [0044.108] lstrlenW (lpString=".txt") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".txt") returned 0x0 [0044.108] lstrlenW (lpString=".dbf") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".dbf") returned 0x0 [0044.108] lstrlenW (lpString=".ckp") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".ckp") returned 0x0 [0044.108] lstrlenW (lpString=".dacpac") returned 7 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".dacpac") returned 0x0 [0044.108] lstrlenW (lpString=".db3") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".db3") returned 0x0 [0044.108] lstrlenW (lpString=".dtxs") returned 5 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".dtxs") returned 0x0 [0044.108] lstrlenW (lpString=".mdt") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".mdt") returned 0x0 [0044.108] lstrlenW (lpString=".sdf") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".sdf") returned 0x0 [0044.108] lstrlenW (lpString=".MDF") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".MDF") returned 0x0 [0044.108] lstrlenW (lpString=".DBF") returned 4 [0044.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".DBF") returned 0x0 [0044.109] lstrlenW (lpString=".DB") returned 3 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".DB") returned 0x0 [0044.109] lstrlenW (lpString=".db") returned 3 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".db") returned 0x0 [0044.109] lstrlenW (lpString=".ndf") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".ndf") returned 0x0 [0044.109] lstrlenW (lpString=".NDF") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".NDF") returned 0x0 [0044.109] lstrlenW (lpString=".Mdf") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".Mdf") returned 0x0 [0044.109] lstrlenW (lpString=".dat") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".dat") returned 0x0 [0044.109] lstrlenW (lpString=".DAT") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".DAT") returned 0x0 [0044.109] lstrlenW (lpString=".ldf") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".ldf") returned 0x0 [0044.109] lstrlenW (lpString=".LDF") returned 4 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch=".LDF") returned 0x0 [0044.109] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.109] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.110] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.110] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16411147211) returned 1 [0044.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa91a7ab0, dwHighDateTime=0x1d585b4)) [0044.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d178 [0044.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d178 | out: hHeap=0x260000) returned 1 [0044.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b9d0 [0044.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b9d0 | out: hHeap=0x260000) returned 1 [0044.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.111] GetLastError () returned 0x0 [0044.111] GetLastError () returned 0x0 [0044.111] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.111] GetLastError () returned 0x0 [0044.111] GetLastError () returned 0x0 [0044.114] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff5137, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.115] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xaec9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0xaec9, lpOverlapped=0x0) returned 1 [0044.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.115] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.115] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.115] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.115] CloseHandle (hObject=0x10c) returned 1 [0044.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.116] GetLastError () returned 0x0 [0044.116] RtlWakeConditionVariable () returned 0x27e828 [0044.116] GetCurrentThreadId () returned 0x99c [0044.116] GetCurrentThreadId () returned 0x99c [0044.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dee0 | out: hHeap=0x260000) returned 1 [0044.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d140 | out: hHeap=0x260000) returned 1 [0044.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dee0 [0044.116] lstrlenW (lpString=".ldf") returned 4 [0044.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".ldf") returned 0x0 [0044.116] lstrlenW (lpString=".vhd") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".vhd") returned 0x0 [0044.117] lstrlenW (lpString=".vhdx") returned 5 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".vhdx") returned 0x0 [0044.117] lstrlenW (lpString=".pst") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".pst") returned 0x0 [0044.117] lstrlenW (lpString=".ost") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".ost") returned 0x0 [0044.117] lstrlenW (lpString=".bak") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".bak") returned 0x0 [0044.117] lstrlenW (lpString=".bac") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".bac") returned 0x0 [0044.117] lstrlenW (lpString=".sys") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".sys") returned 0x0 [0044.117] lstrlenW (lpString=".v2i") returned 4 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".v2i") returned 0x0 [0044.117] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.118] lstrlenW (lpString=".sql") returned 4 [0044.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".sql") returned 0x0 [0044.118] lstrlenW (lpString=".mdf") returned 4 [0044.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".mdf") returned 0x0 [0044.118] lstrlenW (lpString=".txt") returned 4 [0044.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".txt") returned 0x0 [0044.118] lstrlenW (lpString=".dbf") returned 4 [0044.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".dbf") returned 0x0 [0044.118] lstrlenW (lpString=".ckp") returned 4 [0044.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".ckp") returned 0x0 [0044.118] lstrlenW (lpString=".dacpac") returned 7 [0044.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".dacpac") returned 0x0 [0044.119] lstrlenW (lpString=".db3") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".db3") returned 0x0 [0044.119] lstrlenW (lpString=".dtxs") returned 5 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".dtxs") returned 0x0 [0044.119] lstrlenW (lpString=".mdt") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".mdt") returned 0x0 [0044.119] lstrlenW (lpString=".sdf") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".sdf") returned 0x0 [0044.119] lstrlenW (lpString=".MDF") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".MDF") returned 0x0 [0044.119] lstrlenW (lpString=".DBF") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".DBF") returned 0x0 [0044.119] lstrlenW (lpString=".DB") returned 3 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".DB") returned 0x0 [0044.119] lstrlenW (lpString=".db") returned 3 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".db") returned 0x0 [0044.119] lstrlenW (lpString=".ndf") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".ndf") returned 0x0 [0044.119] lstrlenW (lpString=".NDF") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".NDF") returned 0x0 [0044.119] lstrlenW (lpString=".Mdf") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".Mdf") returned 0x0 [0044.119] lstrlenW (lpString=".dat") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".dat") returned 0x0 [0044.119] lstrlenW (lpString=".DAT") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".DAT") returned 0x0 [0044.119] lstrlenW (lpString=".ldf") returned 4 [0044.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".ldf") returned 0x0 [0044.119] lstrlenW (lpString=".LDF") returned 4 [0044.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch=".LDF") returned 0x0 [0044.120] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.120] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.120] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.120] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.121] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16412172688) returned 1 [0044.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa91cdc10, dwHighDateTime=0x1d585b4)) [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d140 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d140 | out: hHeap=0x260000) returned 1 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e420 [0044.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e420 | out: hHeap=0x260000) returned 1 [0044.121] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.121] GetLastError () returned 0x0 [0044.121] GetLastError () returned 0x0 [0044.121] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.121] GetLastError () returned 0x0 [0044.122] GetLastError () returned 0x0 [0044.123] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.123] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1d1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x1d1, lpOverlapped=0x0) returned 1 [0044.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.123] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.123] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.123] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.123] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.123] CloseHandle (hObject=0x10c) returned 1 [0044.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.125] GetLastError () returned 0x0 [0044.125] RtlWakeConditionVariable () returned 0x27e828 [0044.125] GetCurrentThreadId () returned 0x99c [0044.125] GetCurrentThreadId () returned 0x99c [0044.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e378 | out: hHeap=0x260000) returned 1 [0044.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d108 | out: hHeap=0x260000) returned 1 [0044.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e378 [0044.125] lstrlenW (lpString=".ldf") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.126] lstrlenW (lpString=".vhd") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.126] lstrlenW (lpString=".vhdx") returned 5 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.126] lstrlenW (lpString=".pst") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.126] lstrlenW (lpString=".ost") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.126] lstrlenW (lpString=".bak") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.126] lstrlenW (lpString=".bac") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.126] lstrlenW (lpString=".sys") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.126] lstrlenW (lpString=".v2i") returned 4 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.126] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.127] lstrlenW (lpString=".sql") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.127] lstrlenW (lpString=".mdf") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.127] lstrlenW (lpString=".txt") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.127] lstrlenW (lpString=".dbf") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.127] lstrlenW (lpString=".ckp") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.127] lstrlenW (lpString=".dacpac") returned 7 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.127] lstrlenW (lpString=".db3") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.127] lstrlenW (lpString=".dtxs") returned 5 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.127] lstrlenW (lpString=".mdt") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.127] lstrlenW (lpString=".sdf") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.127] lstrlenW (lpString=".MDF") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.127] lstrlenW (lpString=".DBF") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.127] lstrlenW (lpString=".DB") returned 3 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.127] lstrlenW (lpString=".db") returned 3 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.127] lstrlenW (lpString=".ndf") returned 4 [0044.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.128] lstrlenW (lpString=".NDF") returned 4 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.128] lstrlenW (lpString=".Mdf") returned 4 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.128] lstrlenW (lpString=".dat") returned 4 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.128] lstrlenW (lpString=".DAT") returned 4 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.128] lstrlenW (lpString=".ldf") returned 4 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.128] lstrlenW (lpString=".LDF") returned 4 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.128] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.128] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.129] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.129] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.129] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16413012059) returned 1 [0044.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa91cdc10, dwHighDateTime=0x1d585b4)) [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d108 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d108 | out: hHeap=0x260000) returned 1 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30dee0 [0044.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dee0 | out: hHeap=0x260000) returned 1 [0044.130] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.130] GetLastError () returned 0x0 [0044.130] GetLastError () returned 0x0 [0044.130] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.130] GetLastError () returned 0x0 [0044.130] GetLastError () returned 0x0 [0044.131] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffc4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.131] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3b1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x3b1, lpOverlapped=0x0) returned 1 [0044.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.132] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.132] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.132] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.132] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.132] CloseHandle (hObject=0x10c) returned 1 [0044.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.133] GetLastError () returned 0x0 [0044.133] RtlWakeConditionVariable () returned 0x27e828 [0044.133] GetCurrentThreadId () returned 0x99c [0044.133] GetCurrentThreadId () returned 0x99c [0044.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e2d0 | out: hHeap=0x260000) returned 1 [0044.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338230 | out: hHeap=0x260000) returned 1 [0044.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e2d0 [0044.133] lstrlenW (lpString=".ldf") returned 4 [0044.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.133] lstrlenW (lpString=".vhd") returned 4 [0044.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.133] lstrlenW (lpString=".vhdx") returned 5 [0044.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.133] lstrlenW (lpString=".pst") returned 4 [0044.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.133] lstrlenW (lpString=".ost") returned 4 [0044.133] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.134] lstrlenW (lpString=".bak") returned 4 [0044.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.134] lstrlenW (lpString=".bac") returned 4 [0044.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.134] lstrlenW (lpString=".sys") returned 4 [0044.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.134] lstrlenW (lpString=".v2i") returned 4 [0044.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.134] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.135] lstrlenW (lpString=".sql") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.135] lstrlenW (lpString=".mdf") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.135] lstrlenW (lpString=".txt") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.135] lstrlenW (lpString=".dbf") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.135] lstrlenW (lpString=".ckp") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.135] lstrlenW (lpString=".dacpac") returned 7 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.135] lstrlenW (lpString=".db3") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.135] lstrlenW (lpString=".dtxs") returned 5 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.135] lstrlenW (lpString=".mdt") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.135] lstrlenW (lpString=".sdf") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.135] lstrlenW (lpString=".MDF") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.135] lstrlenW (lpString=".DBF") returned 4 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.135] lstrlenW (lpString=".DB") returned 3 [0044.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.135] lstrlenW (lpString=".db") returned 3 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.136] lstrlenW (lpString=".ndf") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.136] lstrlenW (lpString=".NDF") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.136] lstrlenW (lpString=".Mdf") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.136] lstrlenW (lpString=".dat") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.136] lstrlenW (lpString=".DAT") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.136] lstrlenW (lpString=".ldf") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.136] lstrlenW (lpString=".LDF") returned 4 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.136] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.136] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0044.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.136] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.137] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.137] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0044.137] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16413819577) returned 1 [0044.137] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa91f3d70, dwHighDateTime=0x1d585b4)) [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338230 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338230 | out: hHeap=0x260000) returned 1 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e378 [0044.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e378 | out: hHeap=0x260000) returned 1 [0044.138] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.138] GetLastError () returned 0x0 [0044.138] GetLastError () returned 0x0 [0044.138] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.138] GetLastError () returned 0x0 [0044.138] GetLastError () returned 0x0 [0044.162] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff80a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.162] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x7f5f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x7f5f, lpOverlapped=0x0) returned 1 [0044.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.162] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.162] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.162] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.162] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.162] CloseHandle (hObject=0x10c) returned 1 [0044.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.163] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.163] GetLastError () returned 0x0 [0044.163] RtlWakeConditionVariable () returned 0x27e828 [0044.163] GetCurrentThreadId () returned 0x99c [0044.163] GetCurrentThreadId () returned 0x99c [0044.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f35f8 | out: hHeap=0x260000) returned 1 [0044.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338188 | out: hHeap=0x260000) returned 1 [0044.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f35f8 [0044.164] lstrlenW (lpString=".ldf") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.164] lstrlenW (lpString=".vhd") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.164] lstrlenW (lpString=".vhdx") returned 5 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.164] lstrlenW (lpString=".pst") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.164] lstrlenW (lpString=".ost") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.164] lstrlenW (lpString=".bak") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.164] lstrlenW (lpString=".bac") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.164] lstrlenW (lpString=".sys") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.164] lstrlenW (lpString=".v2i") returned 4 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.164] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0044.232] lstrlenW (lpString=".sql") returned 4 [0044.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.232] lstrlenW (lpString=".mdf") returned 4 [0044.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.241] lstrlenW (lpString=".txt") returned 4 [0044.248] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.265] lstrlenW (lpString=".dbf") returned 4 [0044.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.265] lstrlenW (lpString=".ckp") returned 4 [0044.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.265] lstrlenW (lpString=".dacpac") returned 7 [0044.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.265] lstrlenW (lpString=".db3") returned 4 [0044.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.265] lstrlenW (lpString=".dtxs") returned 5 [0044.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.265] lstrlenW (lpString=".mdt") returned 4 [0044.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.268] lstrlenW (lpString=".sdf") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.275] lstrlenW (lpString=".MDF") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.275] lstrlenW (lpString=".DBF") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.275] lstrlenW (lpString=".DB") returned 3 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.275] lstrlenW (lpString=".db") returned 3 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.275] lstrlenW (lpString=".ndf") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.275] lstrlenW (lpString=".NDF") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.275] lstrlenW (lpString=".Mdf") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.275] lstrlenW (lpString=".dat") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.275] lstrlenW (lpString=".DAT") returned 4 [0044.275] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.276] lstrlenW (lpString=".ldf") returned 4 [0044.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.276] lstrlenW (lpString=".LDF") returned 4 [0044.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.276] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.276] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.276] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.277] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0044.277] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16427776937) returned 1 [0044.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa934a9d0, dwHighDateTime=0x1d585b4)) [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.277] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.277] GetLastError () returned 0x0 [0044.277] GetLastError () returned 0x0 [0044.277] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.278] GetLastError () returned 0x0 [0044.278] GetLastError () returned 0x0 [0044.279] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff8b1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.279] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x74e5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x238fdb0*=0x74e5, lpOverlapped=0x0) returned 1 [0044.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.279] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.279] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.280] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.280] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.280] CloseHandle (hObject=0x100) returned 1 [0044.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.280] GetLastError () returned 0x0 [0044.280] RtlWakeConditionVariable () returned 0x27e828 [0044.280] GetCurrentThreadId () returned 0x99c [0044.280] GetCurrentThreadId () returned 0x99c [0044.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2348 | out: hHeap=0x260000) returned 1 [0044.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1098 | out: hHeap=0x260000) returned 1 [0044.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2348 [0044.281] lstrlenW (lpString=".ldf") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.281] lstrlenW (lpString=".vhd") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.281] lstrlenW (lpString=".vhdx") returned 5 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.281] lstrlenW (lpString=".pst") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.281] lstrlenW (lpString=".ost") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.281] lstrlenW (lpString=".bak") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.281] lstrlenW (lpString=".bac") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.281] lstrlenW (lpString=".sys") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.281] lstrlenW (lpString=".v2i") returned 4 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.281] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.395] lstrlenW (lpString=".sql") returned 4 [0044.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.395] lstrlenW (lpString=".mdf") returned 4 [0044.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.395] lstrlenW (lpString=".txt") returned 4 [0044.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.395] lstrlenW (lpString=".dbf") returned 4 [0044.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.395] lstrlenW (lpString=".ckp") returned 4 [0044.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.396] lstrlenW (lpString=".dacpac") returned 7 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.396] lstrlenW (lpString=".db3") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.396] lstrlenW (lpString=".dtxs") returned 5 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.396] lstrlenW (lpString=".mdt") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.396] lstrlenW (lpString=".sdf") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.396] lstrlenW (lpString=".MDF") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.396] lstrlenW (lpString=".DBF") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.396] lstrlenW (lpString=".DB") returned 3 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.396] lstrlenW (lpString=".db") returned 3 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.396] lstrlenW (lpString=".ndf") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.396] lstrlenW (lpString=".NDF") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.396] lstrlenW (lpString=".Mdf") returned 4 [0044.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.397] lstrlenW (lpString=".dat") returned 4 [0044.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.397] lstrlenW (lpString=".DAT") returned 4 [0044.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.397] lstrlenW (lpString=".ldf") returned 4 [0044.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.397] lstrlenW (lpString=".LDF") returned 4 [0044.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.397] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3f48 [0044.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.397] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.398] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.398] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fcf8 [0044.398] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16439921759) returned 1 [0044.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa947b4d0, dwHighDateTime=0x1d585b4)) [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d400 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e030 [0044.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e030 | out: hHeap=0x260000) returned 1 [0044.399] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.399] GetLastError () returned 0x0 [0044.399] GetLastError () returned 0x0 [0044.399] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.399] GetLastError () returned 0x0 [0044.399] GetLastError () returned 0x0 [0044.402] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffaf9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.402] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x507, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x507, lpOverlapped=0x0) returned 1 [0044.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.403] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.403] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.403] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.403] CloseHandle (hObject=0xfc) returned 1 [0044.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] RtlWakeConditionVariable () returned 0x27e828 [0044.405] GetCurrentThreadId () returned 0x99c [0044.405] GetCurrentThreadId () returned 0x99c [0044.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eb58 | out: hHeap=0x260000) returned 1 [0044.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0044.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eb58 [0044.405] lstrlenW (lpString=".ldf") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".ldf") returned 0x0 [0044.405] lstrlenW (lpString=".vhd") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".vhd") returned 0x0 [0044.405] lstrlenW (lpString=".vhdx") returned 5 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".vhdx") returned 0x0 [0044.405] lstrlenW (lpString=".pst") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".pst") returned 0x0 [0044.405] lstrlenW (lpString=".ost") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".ost") returned 0x0 [0044.405] lstrlenW (lpString=".bak") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".bak") returned 0x0 [0044.405] lstrlenW (lpString=".bac") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".bac") returned 0x0 [0044.405] lstrlenW (lpString=".sys") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".sys") returned 0x0 [0044.405] lstrlenW (lpString=".v2i") returned 4 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".v2i") returned 0x0 [0044.405] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.406] lstrlenW (lpString=".sql") returned 4 [0044.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".sql") returned 0x0 [0044.406] lstrlenW (lpString=".mdf") returned 4 [0044.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".mdf") returned 0x0 [0044.406] lstrlenW (lpString=".txt") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".txt") returned 0x0 [0044.407] lstrlenW (lpString=".dbf") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".dbf") returned 0x0 [0044.407] lstrlenW (lpString=".ckp") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".ckp") returned 0x0 [0044.407] lstrlenW (lpString=".dacpac") returned 7 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".dacpac") returned 0x0 [0044.407] lstrlenW (lpString=".db3") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".db3") returned 0x0 [0044.407] lstrlenW (lpString=".dtxs") returned 5 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".dtxs") returned 0x0 [0044.407] lstrlenW (lpString=".mdt") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".mdt") returned 0x0 [0044.407] lstrlenW (lpString=".sdf") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".sdf") returned 0x0 [0044.407] lstrlenW (lpString=".MDF") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".MDF") returned 0x0 [0044.407] lstrlenW (lpString=".DBF") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".DBF") returned 0x0 [0044.407] lstrlenW (lpString=".DB") returned 3 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".DB") returned 0x0 [0044.407] lstrlenW (lpString=".db") returned 3 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".db") returned 0x0 [0044.407] lstrlenW (lpString=".ndf") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".ndf") returned 0x0 [0044.407] lstrlenW (lpString=".NDF") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".NDF") returned 0x0 [0044.407] lstrlenW (lpString=".Mdf") returned 4 [0044.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".Mdf") returned 0x0 [0044.407] lstrlenW (lpString=".dat") returned 4 [0044.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".dat") returned 0x0 [0044.408] lstrlenW (lpString=".DAT") returned 4 [0044.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".DAT") returned 0x0 [0044.408] lstrlenW (lpString=".ldf") returned 4 [0044.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".ldf") returned 0x0 [0044.408] lstrlenW (lpString=".LDF") returned 4 [0044.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch=".LDF") returned 0x0 [0044.408] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3f48 [0044.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.408] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.409] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fcf8 [0044.409] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16441019500) returned 1 [0044.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa947b4d0, dwHighDateTime=0x1d585b4)) [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d3c8 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e0d8 [0044.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e0d8 | out: hHeap=0x260000) returned 1 [0044.410] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.410] GetLastError () returned 0x0 [0044.410] GetLastError () returned 0x0 [0044.410] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.410] GetLastError () returned 0x0 [0044.410] GetLastError () returned 0x0 [0044.412] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.412] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x253, lpOverlapped=0x0) returned 1 [0044.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.412] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.413] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.413] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.413] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.413] CloseHandle (hObject=0xfc) returned 1 [0044.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.414] GetLastError () returned 0x0 [0044.414] RtlWakeConditionVariable () returned 0x27e828 [0044.414] GetCurrentThreadId () returned 0x99c [0044.414] GetCurrentThreadId () returned 0x99c [0044.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0044.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ea08 | out: hHeap=0x260000) returned 1 [0044.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d390 | out: hHeap=0x260000) returned 1 [0044.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ea08 [0044.415] lstrlenW (lpString=".ldf") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.415] lstrlenW (lpString=".vhd") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.415] lstrlenW (lpString=".vhdx") returned 5 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.415] lstrlenW (lpString=".pst") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.415] lstrlenW (lpString=".ost") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.415] lstrlenW (lpString=".bak") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.415] lstrlenW (lpString=".bac") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.415] lstrlenW (lpString=".sys") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.415] lstrlenW (lpString=".v2i") returned 4 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.415] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.416] lstrlenW (lpString=".sql") returned 4 [0044.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.416] lstrlenW (lpString=".mdf") returned 4 [0044.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.417] lstrlenW (lpString=".txt") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.417] lstrlenW (lpString=".dbf") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.417] lstrlenW (lpString=".ckp") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.417] lstrlenW (lpString=".dacpac") returned 7 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.417] lstrlenW (lpString=".db3") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.417] lstrlenW (lpString=".dtxs") returned 5 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.417] lstrlenW (lpString=".mdt") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.417] lstrlenW (lpString=".sdf") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.417] lstrlenW (lpString=".MDF") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.417] lstrlenW (lpString=".DBF") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.417] lstrlenW (lpString=".DB") returned 3 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.417] lstrlenW (lpString=".db") returned 3 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.417] lstrlenW (lpString=".ndf") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.417] lstrlenW (lpString=".NDF") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.417] lstrlenW (lpString=".Mdf") returned 4 [0044.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.418] lstrlenW (lpString=".dat") returned 4 [0044.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.418] lstrlenW (lpString=".DAT") returned 4 [0044.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.418] lstrlenW (lpString=".ldf") returned 4 [0044.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.418] lstrlenW (lpString=".LDF") returned 4 [0044.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.418] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3f48 [0044.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.418] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.419] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.419] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fcf8 [0044.419] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16442022169) returned 1 [0044.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa94a1630, dwHighDateTime=0x1d585b4)) [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d390 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d390 | out: hHeap=0x260000) returned 1 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30eb58 [0044.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eb58 | out: hHeap=0x260000) returned 1 [0044.420] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.420] GetLastError () returned 0x0 [0044.420] GetLastError () returned 0x0 [0044.420] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.420] GetLastError () returned 0x0 [0044.420] GetLastError () returned 0x0 [0044.423] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.423] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x543, lpOverlapped=0x0) returned 1 [0044.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.423] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.423] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.423] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.423] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.423] CloseHandle (hObject=0xfc) returned 1 [0044.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.425] GetLastError () returned 0x0 [0044.426] RtlWakeConditionVariable () returned 0x27e828 [0044.426] GetCurrentThreadId () returned 0x99c [0044.426] GetCurrentThreadId () returned 0x99c [0044.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b348 | out: hHeap=0x260000) returned 1 [0044.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d358 | out: hHeap=0x260000) returned 1 [0044.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b348 [0044.426] lstrlenW (lpString=".ldf") returned 4 [0044.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.426] lstrlenW (lpString=".vhd") returned 4 [0044.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.426] lstrlenW (lpString=".vhdx") returned 5 [0044.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.426] lstrlenW (lpString=".pst") returned 4 [0044.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.426] lstrlenW (lpString=".ost") returned 4 [0044.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.426] lstrlenW (lpString=".bak") returned 4 [0044.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.426] lstrlenW (lpString=".bac") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.427] lstrlenW (lpString=".sys") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.427] lstrlenW (lpString=".v2i") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.427] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.427] lstrlenW (lpString=".sql") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.427] lstrlenW (lpString=".mdf") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.427] lstrlenW (lpString=".txt") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.427] lstrlenW (lpString=".dbf") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.427] lstrlenW (lpString=".ckp") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.427] lstrlenW (lpString=".dacpac") returned 7 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.427] lstrlenW (lpString=".db3") returned 4 [0044.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.428] lstrlenW (lpString=".dtxs") returned 5 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.428] lstrlenW (lpString=".mdt") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.428] lstrlenW (lpString=".sdf") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.428] lstrlenW (lpString=".MDF") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.428] lstrlenW (lpString=".DBF") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.428] lstrlenW (lpString=".DB") returned 3 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.428] lstrlenW (lpString=".db") returned 3 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.428] lstrlenW (lpString=".ndf") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.428] lstrlenW (lpString=".NDF") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.428] lstrlenW (lpString=".Mdf") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.428] lstrlenW (lpString=".dat") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.428] lstrlenW (lpString=".DAT") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.428] lstrlenW (lpString=".ldf") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.428] lstrlenW (lpString=".LDF") returned 4 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.428] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3f48 [0044.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.429] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.504] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.504] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.504] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16450491833) returned 1 [0044.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa955fd10, dwHighDateTime=0x1d585b4)) [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d358 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d358 | out: hHeap=0x260000) returned 1 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.504] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.504] GetLastError () returned 0x0 [0044.505] GetLastError () returned 0x0 [0044.505] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.505] GetLastError () returned 0x0 [0044.505] GetLastError () returned 0x0 [0044.506] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff816d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.506] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x7e93, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x7e93, lpOverlapped=0x0) returned 1 [0044.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.506] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.507] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.507] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.507] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.507] CloseHandle (hObject=0xfc) returned 1 [0044.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.508] GetLastError () returned 0x0 [0044.508] RtlWakeConditionVariable () returned 0x27e828 [0044.508] GetCurrentThreadId () returned 0x99c [0044.508] GetCurrentThreadId () returned 0x99c [0044.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0044.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ee8 | out: hHeap=0x260000) returned 1 [0044.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0044.508] lstrlenW (lpString=".ldf") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".ldf") returned 0x0 [0044.508] lstrlenW (lpString=".vhd") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".vhd") returned 0x0 [0044.508] lstrlenW (lpString=".vhdx") returned 5 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".vhdx") returned 0x0 [0044.508] lstrlenW (lpString=".pst") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".pst") returned 0x0 [0044.508] lstrlenW (lpString=".ost") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".ost") returned 0x0 [0044.508] lstrlenW (lpString=".bak") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".bak") returned 0x0 [0044.508] lstrlenW (lpString=".bac") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".bac") returned 0x0 [0044.508] lstrlenW (lpString=".sys") returned 4 [0044.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".sys") returned 0x0 [0044.509] lstrlenW (lpString=".v2i") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".v2i") returned 0x0 [0044.509] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.509] lstrlenW (lpString=".sql") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".sql") returned 0x0 [0044.509] lstrlenW (lpString=".mdf") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".mdf") returned 0x0 [0044.509] lstrlenW (lpString=".txt") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".txt") returned 0x0 [0044.509] lstrlenW (lpString=".dbf") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".dbf") returned 0x0 [0044.509] lstrlenW (lpString=".ckp") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".ckp") returned 0x0 [0044.509] lstrlenW (lpString=".dacpac") returned 7 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".dacpac") returned 0x0 [0044.509] lstrlenW (lpString=".db3") returned 4 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".db3") returned 0x0 [0044.509] lstrlenW (lpString=".dtxs") returned 5 [0044.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".dtxs") returned 0x0 [0044.510] lstrlenW (lpString=".mdt") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".mdt") returned 0x0 [0044.510] lstrlenW (lpString=".sdf") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".sdf") returned 0x0 [0044.510] lstrlenW (lpString=".MDF") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".MDF") returned 0x0 [0044.510] lstrlenW (lpString=".DBF") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".DBF") returned 0x0 [0044.510] lstrlenW (lpString=".DB") returned 3 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".DB") returned 0x0 [0044.510] lstrlenW (lpString=".db") returned 3 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".db") returned 0x0 [0044.510] lstrlenW (lpString=".ndf") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".ndf") returned 0x0 [0044.510] lstrlenW (lpString=".NDF") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".NDF") returned 0x0 [0044.510] lstrlenW (lpString=".Mdf") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".Mdf") returned 0x0 [0044.510] lstrlenW (lpString=".dat") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".dat") returned 0x0 [0044.510] lstrlenW (lpString=".DAT") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".DAT") returned 0x0 [0044.510] lstrlenW (lpString=".ldf") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".ldf") returned 0x0 [0044.510] lstrlenW (lpString=".LDF") returned 4 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch=".LDF") returned 0x0 [0044.510] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.511] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.511] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.511] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.511] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16451252252) returned 1 [0044.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9585e70, dwHighDateTime=0x1d585b4)) [0044.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337ee8 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ee8 | out: hHeap=0x260000) returned 1 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.512] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.512] GetLastError () returned 0x0 [0044.512] GetLastError () returned 0x0 [0044.512] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.512] GetLastError () returned 0x0 [0044.512] GetLastError () returned 0x0 [0044.515] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.515] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0044.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.516] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.516] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.516] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.516] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.516] CloseHandle (hObject=0xfc) returned 1 [0044.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.517] GetLastError () returned 0x0 [0044.517] RtlWakeConditionVariable () returned 0x27e828 [0044.517] GetCurrentThreadId () returned 0x99c [0044.517] GetCurrentThreadId () returned 0x99c [0044.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b120 | out: hHeap=0x260000) returned 1 [0044.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337eb0 | out: hHeap=0x260000) returned 1 [0044.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b120 [0044.517] lstrlenW (lpString=".ldf") returned 4 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".ldf") returned 0x0 [0044.517] lstrlenW (lpString=".vhd") returned 4 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".vhd") returned 0x0 [0044.517] lstrlenW (lpString=".vhdx") returned 5 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".vhdx") returned 0x0 [0044.517] lstrlenW (lpString=".pst") returned 4 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".pst") returned 0x0 [0044.517] lstrlenW (lpString=".ost") returned 4 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".ost") returned 0x0 [0044.517] lstrlenW (lpString=".bak") returned 4 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".bak") returned 0x0 [0044.517] lstrlenW (lpString=".bac") returned 4 [0044.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".bac") returned 0x0 [0044.517] lstrlenW (lpString=".sys") returned 4 [0044.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".sys") returned 0x0 [0044.518] lstrlenW (lpString=".v2i") returned 4 [0044.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".v2i") returned 0x0 [0044.518] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.518] lstrlenW (lpString=".sql") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".sql") returned 0x0 [0044.519] lstrlenW (lpString=".mdf") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".mdf") returned 0x0 [0044.519] lstrlenW (lpString=".txt") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".txt") returned 0x0 [0044.519] lstrlenW (lpString=".dbf") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".dbf") returned 0x0 [0044.519] lstrlenW (lpString=".ckp") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".ckp") returned 0x0 [0044.519] lstrlenW (lpString=".dacpac") returned 7 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".dacpac") returned 0x0 [0044.519] lstrlenW (lpString=".db3") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".db3") returned 0x0 [0044.519] lstrlenW (lpString=".dtxs") returned 5 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".dtxs") returned 0x0 [0044.519] lstrlenW (lpString=".mdt") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".mdt") returned 0x0 [0044.519] lstrlenW (lpString=".sdf") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".sdf") returned 0x0 [0044.519] lstrlenW (lpString=".MDF") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".MDF") returned 0x0 [0044.519] lstrlenW (lpString=".DBF") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".DBF") returned 0x0 [0044.519] lstrlenW (lpString=".DB") returned 3 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".DB") returned 0x0 [0044.519] lstrlenW (lpString=".db") returned 3 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".db") returned 0x0 [0044.519] lstrlenW (lpString=".ndf") returned 4 [0044.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".ndf") returned 0x0 [0044.519] lstrlenW (lpString=".NDF") returned 4 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".NDF") returned 0x0 [0044.520] lstrlenW (lpString=".Mdf") returned 4 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".Mdf") returned 0x0 [0044.520] lstrlenW (lpString=".dat") returned 4 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".dat") returned 0x0 [0044.520] lstrlenW (lpString=".DAT") returned 4 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".DAT") returned 0x0 [0044.520] lstrlenW (lpString=".ldf") returned 4 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".ldf") returned 0x0 [0044.520] lstrlenW (lpString=".LDF") returned 4 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch=".LDF") returned 0x0 [0044.520] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.520] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.521] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.521] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.521] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16452203322) returned 1 [0044.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9585e70, dwHighDateTime=0x1d585b4)) [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337eb0 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337eb0 | out: hHeap=0x260000) returned 1 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.522] GetLastError () returned 0x0 [0044.522] GetLastError () returned 0x0 [0044.522] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.522] GetLastError () returned 0x0 [0044.522] GetLastError () returned 0x0 [0044.523] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.523] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x255, lpOverlapped=0x0) returned 1 [0044.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.523] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.523] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.523] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.523] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.524] CloseHandle (hObject=0xfc) returned 1 [0044.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.526] GetLastError () returned 0x0 [0044.526] RtlWakeConditionVariable () returned 0x27e828 [0044.526] GetCurrentThreadId () returned 0x99c [0044.526] GetCurrentThreadId () returned 0x99c [0044.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0044.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e78 | out: hHeap=0x260000) returned 1 [0044.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0044.526] lstrlenW (lpString=".ldf") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.526] lstrlenW (lpString=".vhd") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.526] lstrlenW (lpString=".vhdx") returned 5 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.526] lstrlenW (lpString=".pst") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.526] lstrlenW (lpString=".ost") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.526] lstrlenW (lpString=".bak") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.526] lstrlenW (lpString=".bac") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.526] lstrlenW (lpString=".sys") returned 4 [0044.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.527] lstrlenW (lpString=".v2i") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.527] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.527] lstrlenW (lpString=".sql") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.527] lstrlenW (lpString=".mdf") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.527] lstrlenW (lpString=".txt") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.527] lstrlenW (lpString=".dbf") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.527] lstrlenW (lpString=".ckp") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.527] lstrlenW (lpString=".dacpac") returned 7 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.527] lstrlenW (lpString=".db3") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.527] lstrlenW (lpString=".dtxs") returned 5 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.527] lstrlenW (lpString=".mdt") returned 4 [0044.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.528] lstrlenW (lpString=".sdf") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.528] lstrlenW (lpString=".MDF") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.528] lstrlenW (lpString=".DBF") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.528] lstrlenW (lpString=".DB") returned 3 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.528] lstrlenW (lpString=".db") returned 3 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.528] lstrlenW (lpString=".ndf") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.528] lstrlenW (lpString=".NDF") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.528] lstrlenW (lpString=".Mdf") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.528] lstrlenW (lpString=".dat") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.528] lstrlenW (lpString=".DAT") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.528] lstrlenW (lpString=".ldf") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.528] lstrlenW (lpString=".LDF") returned 4 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.528] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.528] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.529] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.529] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.529] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16453045653) returned 1 [0044.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa95abfd0, dwHighDateTime=0x1d585b4)) [0044.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e78 [0044.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e78 | out: hHeap=0x260000) returned 1 [0044.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.530] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.530] GetLastError () returned 0x0 [0044.530] GetLastError () returned 0x0 [0044.530] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.530] GetLastError () returned 0x0 [0044.530] GetLastError () returned 0x0 [0044.532] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffec00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.532] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x1400, lpOverlapped=0x0) returned 1 [0044.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.532] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.532] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.532] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.532] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.532] CloseHandle (hObject=0xfc) returned 1 [0044.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.533] GetLastError () returned 0x0 [0044.533] RtlWakeConditionVariable () returned 0x27e828 [0044.533] GetCurrentThreadId () returned 0x99c [0044.533] GetCurrentThreadId () returned 0x99c [0044.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bbe8 | out: hHeap=0x260000) returned 1 [0044.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e40 | out: hHeap=0x260000) returned 1 [0044.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bbe8 [0044.533] lstrlenW (lpString=".ldf") returned 4 [0044.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.533] lstrlenW (lpString=".vhd") returned 4 [0044.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.534] lstrlenW (lpString=".vhdx") returned 5 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.534] lstrlenW (lpString=".pst") returned 4 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.534] lstrlenW (lpString=".ost") returned 4 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.534] lstrlenW (lpString=".bak") returned 4 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.534] lstrlenW (lpString=".bac") returned 4 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.534] lstrlenW (lpString=".sys") returned 4 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.534] lstrlenW (lpString=".v2i") returned 4 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.534] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0044.535] lstrlenW (lpString=".sql") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.535] lstrlenW (lpString=".mdf") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.535] lstrlenW (lpString=".txt") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.535] lstrlenW (lpString=".dbf") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.535] lstrlenW (lpString=".ckp") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.535] lstrlenW (lpString=".dacpac") returned 7 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.535] lstrlenW (lpString=".db3") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.535] lstrlenW (lpString=".dtxs") returned 5 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.535] lstrlenW (lpString=".mdt") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.535] lstrlenW (lpString=".sdf") returned 4 [0044.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.536] lstrlenW (lpString=".MDF") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.536] lstrlenW (lpString=".DBF") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.536] lstrlenW (lpString=".DB") returned 3 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.536] lstrlenW (lpString=".db") returned 3 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.536] lstrlenW (lpString=".ndf") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.536] lstrlenW (lpString=".NDF") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.536] lstrlenW (lpString=".Mdf") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.536] lstrlenW (lpString=".dat") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.536] lstrlenW (lpString=".DAT") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.536] lstrlenW (lpString=".ldf") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.536] lstrlenW (lpString=".LDF") returned 4 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.536] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.536] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.537] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.537] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.537] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16453839585) returned 1 [0044.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa95abfd0, dwHighDateTime=0x1d585b4)) [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e40 [0044.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e40 | out: hHeap=0x260000) returned 1 [0044.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.538] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.538] GetLastError () returned 0x0 [0044.547] GetLastError () returned 0x0 [0044.547] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.547] GetLastError () returned 0x0 [0044.548] GetLastError () returned 0x0 [0044.549] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff12cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.549] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xed34, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xed34, lpOverlapped=0x0) returned 1 [0044.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.550] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.550] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.550] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.550] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.550] CloseHandle (hObject=0xfc) returned 1 [0044.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.551] GetLastError () returned 0x0 [0044.551] RtlWakeConditionVariable () returned 0x27e828 [0044.551] GetCurrentThreadId () returned 0x99c [0044.551] GetCurrentThreadId () returned 0x99c [0044.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296560 | out: hHeap=0x260000) returned 1 [0044.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d98 | out: hHeap=0x260000) returned 1 [0044.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296560 [0044.551] lstrlenW (lpString=".ldf") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".ldf") returned 0x0 [0044.551] lstrlenW (lpString=".vhd") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".vhd") returned 0x0 [0044.551] lstrlenW (lpString=".vhdx") returned 5 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".vhdx") returned 0x0 [0044.551] lstrlenW (lpString=".pst") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".pst") returned 0x0 [0044.551] lstrlenW (lpString=".ost") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".ost") returned 0x0 [0044.551] lstrlenW (lpString=".bak") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".bak") returned 0x0 [0044.551] lstrlenW (lpString=".bac") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".bac") returned 0x0 [0044.551] lstrlenW (lpString=".sys") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".sys") returned 0x0 [0044.551] lstrlenW (lpString=".v2i") returned 4 [0044.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".v2i") returned 0x0 [0044.552] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.577] lstrlenW (lpString=".sql") returned 4 [0044.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".sql") returned 0x0 [0044.577] lstrlenW (lpString=".mdf") returned 4 [0044.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".mdf") returned 0x0 [0044.577] lstrlenW (lpString=".txt") returned 4 [0044.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".txt") returned 0x0 [0044.580] lstrlenW (lpString=".dbf") returned 4 [0044.580] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".dbf") returned 0x0 [0044.580] lstrlenW (lpString=".ckp") returned 4 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".ckp") returned 0x0 [0044.589] lstrlenW (lpString=".dacpac") returned 7 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".dacpac") returned 0x0 [0044.589] lstrlenW (lpString=".db3") returned 4 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".db3") returned 0x0 [0044.589] lstrlenW (lpString=".dtxs") returned 5 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".dtxs") returned 0x0 [0044.589] lstrlenW (lpString=".mdt") returned 4 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".mdt") returned 0x0 [0044.589] lstrlenW (lpString=".sdf") returned 4 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".sdf") returned 0x0 [0044.589] lstrlenW (lpString=".MDF") returned 4 [0044.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".MDF") returned 0x0 [0044.589] lstrlenW (lpString=".DBF") returned 4 [0044.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".DBF") returned 0x0 [0044.600] lstrlenW (lpString=".DB") returned 3 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".DB") returned 0x0 [0044.601] lstrlenW (lpString=".db") returned 3 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".db") returned 0x0 [0044.601] lstrlenW (lpString=".ndf") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".ndf") returned 0x0 [0044.601] lstrlenW (lpString=".NDF") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".NDF") returned 0x0 [0044.601] lstrlenW (lpString=".Mdf") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".Mdf") returned 0x0 [0044.601] lstrlenW (lpString=".dat") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".dat") returned 0x0 [0044.601] lstrlenW (lpString=".DAT") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".DAT") returned 0x0 [0044.601] lstrlenW (lpString=".ldf") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".ldf") returned 0x0 [0044.601] lstrlenW (lpString=".LDF") returned 4 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch=".LDF") returned 0x0 [0044.601] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.601] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.602] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.602] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16460323706) returned 1 [0044.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa966a6b0, dwHighDateTime=0x1d585b4)) [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d630 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d760 [0044.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d760 | out: hHeap=0x260000) returned 1 [0044.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.603] GetLastError () returned 0x0 [0044.603] GetLastError () returned 0x0 [0044.603] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.603] GetLastError () returned 0x0 [0044.603] GetLastError () returned 0x0 [0044.604] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffe53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.604] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1ad, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1ad, lpOverlapped=0x0) returned 1 [0044.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.624] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.624] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.633] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.633] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.633] CloseHandle (hObject=0xf8) returned 1 [0044.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.634] GetLastError () returned 0x0 [0044.634] RtlWakeConditionVariable () returned 0x27e828 [0044.634] GetCurrentThreadId () returned 0x99c [0044.634] GetCurrentThreadId () returned 0x99c [0044.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e678 | out: hHeap=0x260000) returned 1 [0044.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5f8 | out: hHeap=0x260000) returned 1 [0044.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e678 [0044.634] lstrlenW (lpString=".ldf") returned 4 [0044.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.634] lstrlenW (lpString=".vhd") returned 4 [0044.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.634] lstrlenW (lpString=".vhdx") returned 5 [0044.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.634] lstrlenW (lpString=".pst") returned 4 [0044.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.634] lstrlenW (lpString=".ost") returned 4 [0044.634] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.635] lstrlenW (lpString=".bak") returned 4 [0044.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.635] lstrlenW (lpString=".bac") returned 4 [0044.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.635] lstrlenW (lpString=".sys") returned 4 [0044.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.635] lstrlenW (lpString=".v2i") returned 4 [0044.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.635] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.635] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.640] lstrlenW (lpString=".sql") returned 4 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.640] lstrlenW (lpString=".mdf") returned 4 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.640] lstrlenW (lpString=".txt") returned 4 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.640] lstrlenW (lpString=".dbf") returned 4 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.640] lstrlenW (lpString=".ckp") returned 4 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.640] lstrlenW (lpString=".dacpac") returned 7 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.640] lstrlenW (lpString=".db3") returned 4 [0044.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.641] lstrlenW (lpString=".dtxs") returned 5 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.641] lstrlenW (lpString=".mdt") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.641] lstrlenW (lpString=".sdf") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.641] lstrlenW (lpString=".MDF") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.641] lstrlenW (lpString=".DBF") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.641] lstrlenW (lpString=".DB") returned 3 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.641] lstrlenW (lpString=".db") returned 3 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.641] lstrlenW (lpString=".ndf") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.641] lstrlenW (lpString=".NDF") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.641] lstrlenW (lpString=".Mdf") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.641] lstrlenW (lpString=".dat") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.641] lstrlenW (lpString=".DAT") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.641] lstrlenW (lpString=".ldf") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.641] lstrlenW (lpString=".LDF") returned 4 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.641] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.642] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.642] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.642] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.642] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16464359759) returned 1 [0044.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa96b6970, dwHighDateTime=0x1d585b4)) [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5c0 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x260000) returned 1 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6750 [0044.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0044.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.643] GetLastError () returned 0x0 [0044.643] GetLastError () returned 0x0 [0044.643] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.643] GetLastError () returned 0x0 [0044.643] GetLastError () returned 0x0 [0044.647] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffebc5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.647] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x143b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x143b, lpOverlapped=0x0) returned 1 [0044.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.647] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.648] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.648] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.648] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.648] CloseHandle (hObject=0x10c) returned 1 [0044.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.648] GetLastError () returned 0x0 [0044.648] RtlWakeConditionVariable () returned 0x27e828 [0044.648] GetCurrentThreadId () returned 0x99c [0044.649] GetCurrentThreadId () returned 0x99c [0044.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dac40 | out: hHeap=0x260000) returned 1 [0044.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d588 | out: hHeap=0x260000) returned 1 [0044.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dac40 [0044.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.662] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.662] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.662] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.662] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.838] CloseHandle (hObject=0xf8) returned 1 [0044.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dac40 | out: hHeap=0x260000) returned 1 [0044.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.838] RtlWakeConditionVariable () returned 0x27e828 [0044.838] GetCurrentThreadId () returned 0x99c [0044.838] GetCurrentThreadId () returned 0x99c [0044.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0044.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f290 | out: hHeap=0x260000) returned 1 [0044.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0044.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0044.846] lstrlenW (lpString=".ldf") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".ldf") returned 0x0 [0044.846] lstrlenW (lpString=".vhd") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".vhd") returned 0x0 [0044.846] lstrlenW (lpString=".vhdx") returned 5 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".vhdx") returned 0x0 [0044.846] lstrlenW (lpString=".pst") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".pst") returned 0x0 [0044.846] lstrlenW (lpString=".ost") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".ost") returned 0x0 [0044.846] lstrlenW (lpString=".bak") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".bak") returned 0x0 [0044.846] lstrlenW (lpString=".bac") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".bac") returned 0x0 [0044.846] lstrlenW (lpString=".sys") returned 4 [0044.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".sys") returned 0x0 [0044.846] lstrlenW (lpString=".v2i") returned 4 [0044.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".v2i") returned 0x0 [0044.847] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0044.848] lstrlenW (lpString=".sql") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".sql") returned 0x0 [0044.848] lstrlenW (lpString=".mdf") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".mdf") returned 0x0 [0044.848] lstrlenW (lpString=".txt") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".txt") returned 0x0 [0044.848] lstrlenW (lpString=".dbf") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".dbf") returned 0x0 [0044.848] lstrlenW (lpString=".ckp") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".ckp") returned 0x0 [0044.848] lstrlenW (lpString=".dacpac") returned 7 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".dacpac") returned 0x0 [0044.848] lstrlenW (lpString=".db3") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".db3") returned 0x0 [0044.848] lstrlenW (lpString=".dtxs") returned 5 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".dtxs") returned 0x0 [0044.848] lstrlenW (lpString=".mdt") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".mdt") returned 0x0 [0044.848] lstrlenW (lpString=".sdf") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".sdf") returned 0x0 [0044.848] lstrlenW (lpString=".MDF") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".MDF") returned 0x0 [0044.848] lstrlenW (lpString=".DBF") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".DBF") returned 0x0 [0044.848] lstrlenW (lpString=".DB") returned 3 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".DB") returned 0x0 [0044.848] lstrlenW (lpString=".db") returned 3 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".db") returned 0x0 [0044.848] lstrlenW (lpString=".ndf") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".ndf") returned 0x0 [0044.848] lstrlenW (lpString=".NDF") returned 4 [0044.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".NDF") returned 0x0 [0044.849] lstrlenW (lpString=".Mdf") returned 4 [0044.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".Mdf") returned 0x0 [0044.849] lstrlenW (lpString=".dat") returned 4 [0044.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".dat") returned 0x0 [0044.849] lstrlenW (lpString=".DAT") returned 4 [0044.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".DAT") returned 0x0 [0044.849] lstrlenW (lpString=".ldf") returned 4 [0044.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".ldf") returned 0x0 [0044.849] lstrlenW (lpString=".LDF") returned 4 [0044.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch=".LDF") returned 0x0 [0044.849] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.849] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.850] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.850] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x330d00 [0044.850] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16485137419) returned 1 [0044.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa98cbcb0, dwHighDateTime=0x1d585b4)) [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d98 [0044.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d98 | out: hHeap=0x260000) returned 1 [0044.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f290 [0044.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f290 | out: hHeap=0x260000) returned 1 [0044.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.851] GetLastError () returned 0x0 [0044.851] GetLastError () returned 0x0 [0044.851] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.851] GetLastError () returned 0x0 [0044.851] GetLastError () returned 0x0 [0044.853] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffdeb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.853] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x215, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x215, lpOverlapped=0x0) returned 1 [0044.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0044.854] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.854] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.854] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.854] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.854] CloseHandle (hObject=0xf8) returned 1 [0044.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0044.856] GetLastError () returned 0x0 [0044.857] RtlWakeConditionVariable () returned 0x27e828 [0044.857] GetCurrentThreadId () returned 0x99c [0044.857] GetCurrentThreadId () returned 0x99c [0044.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0044.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f3e0 | out: hHeap=0x260000) returned 1 [0044.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d290 | out: hHeap=0x260000) returned 1 [0044.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f3e0 [0044.857] lstrlenW (lpString=".ldf") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.857] lstrlenW (lpString=".vhd") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.857] lstrlenW (lpString=".vhdx") returned 5 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.857] lstrlenW (lpString=".pst") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.857] lstrlenW (lpString=".ost") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.857] lstrlenW (lpString=".bak") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.857] lstrlenW (lpString=".bac") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.857] lstrlenW (lpString=".sys") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.857] lstrlenW (lpString=".v2i") returned 4 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.857] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.882] lstrlenW (lpString=".sql") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.882] lstrlenW (lpString=".mdf") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.882] lstrlenW (lpString=".txt") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.882] lstrlenW (lpString=".dbf") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.882] lstrlenW (lpString=".ckp") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.882] lstrlenW (lpString=".dacpac") returned 7 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.882] lstrlenW (lpString=".db3") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.882] lstrlenW (lpString=".dtxs") returned 5 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.882] lstrlenW (lpString=".mdt") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.882] lstrlenW (lpString=".sdf") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.882] lstrlenW (lpString=".MDF") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.882] lstrlenW (lpString=".DBF") returned 4 [0044.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.882] lstrlenW (lpString=".DB") returned 3 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.883] lstrlenW (lpString=".db") returned 3 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.883] lstrlenW (lpString=".ndf") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.883] lstrlenW (lpString=".NDF") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.883] lstrlenW (lpString=".Mdf") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.883] lstrlenW (lpString=".dat") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.883] lstrlenW (lpString=".DAT") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.883] lstrlenW (lpString=".ldf") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.883] lstrlenW (lpString=".LDF") returned 4 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.883] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0044.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.883] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.884] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.884] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.884] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16488516844) returned 1 [0044.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9917f70, dwHighDateTime=0x1d585b4)) [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ed50 [0044.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ed50 | out: hHeap=0x260000) returned 1 [0044.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.885] GetLastError () returned 0x0 [0044.885] GetLastError () returned 0x0 [0044.885] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.885] GetLastError () returned 0x0 [0044.885] GetLastError () returned 0x0 [0044.895] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff50ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.895] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xaf32, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0xaf32, lpOverlapped=0x0) returned 1 [0044.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0044.895] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.895] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.895] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.896] CloseHandle (hObject=0x10c) returned 1 [0044.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0044.900] GetLastError () returned 0x0 [0044.900] RtlWakeConditionVariable () returned 0x27e828 [0044.900] GetCurrentThreadId () returned 0x99c [0044.900] GetCurrentThreadId () returned 0x99c [0044.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0044.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f098 | out: hHeap=0x260000) returned 1 [0044.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d828 | out: hHeap=0x260000) returned 1 [0044.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f098 [0044.900] lstrlenW (lpString=".ldf") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.901] lstrlenW (lpString=".vhd") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.901] lstrlenW (lpString=".vhdx") returned 5 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.901] lstrlenW (lpString=".pst") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.901] lstrlenW (lpString=".ost") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.901] lstrlenW (lpString=".bak") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.901] lstrlenW (lpString=".bac") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.901] lstrlenW (lpString=".sys") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.901] lstrlenW (lpString=".v2i") returned 4 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.901] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0044.928] lstrlenW (lpString=".sql") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.928] lstrlenW (lpString=".mdf") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.928] lstrlenW (lpString=".txt") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.928] lstrlenW (lpString=".dbf") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.928] lstrlenW (lpString=".ckp") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.928] lstrlenW (lpString=".dacpac") returned 7 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.928] lstrlenW (lpString=".db3") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.928] lstrlenW (lpString=".dtxs") returned 5 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.928] lstrlenW (lpString=".mdt") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.928] lstrlenW (lpString=".sdf") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.928] lstrlenW (lpString=".MDF") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.928] lstrlenW (lpString=".DBF") returned 4 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.928] lstrlenW (lpString=".DB") returned 3 [0044.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.929] lstrlenW (lpString=".db") returned 3 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.929] lstrlenW (lpString=".ndf") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.929] lstrlenW (lpString=".NDF") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.929] lstrlenW (lpString=".Mdf") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.929] lstrlenW (lpString=".dat") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.929] lstrlenW (lpString=".DAT") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.929] lstrlenW (lpString=".ldf") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.929] lstrlenW (lpString=".LDF") returned 4 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.929] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.929] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0044.930] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.930] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.930] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16493114104) returned 1 [0044.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa998a390, dwHighDateTime=0x1d585b4)) [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d710 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d710 | out: hHeap=0x260000) returned 1 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f3e0 [0044.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f3e0 | out: hHeap=0x260000) returned 1 [0044.930] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0044.931] GetLastError () returned 0x0 [0044.931] GetLastError () returned 0x0 [0044.931] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0044.931] GetLastError () returned 0x0 [0044.931] GetLastError () returned 0x0 [0044.932] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa9d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.932] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x563, lpOverlapped=0x0) returned 1 [0044.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0044.933] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.933] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.933] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.933] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.933] CloseHandle (hObject=0x108) returned 1 [0044.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.933] GetLastError () returned 0x0 [0044.934] RtlWakeConditionVariable () returned 0x27e828 [0044.934] GetCurrentThreadId () returned 0x99c [0044.934] GetCurrentThreadId () returned 0x99c [0044.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0044.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13a8 | out: hHeap=0x260000) returned 1 [0044.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0044.934] lstrlenW (lpString=".ldf") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.934] lstrlenW (lpString=".vhd") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.934] lstrlenW (lpString=".vhdx") returned 5 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.934] lstrlenW (lpString=".pst") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.934] lstrlenW (lpString=".ost") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.934] lstrlenW (lpString=".bak") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.934] lstrlenW (lpString=".bac") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.934] lstrlenW (lpString=".sys") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.934] lstrlenW (lpString=".v2i") returned 4 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.934] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.128] lstrlenW (lpString=".sql") returned 4 [0045.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.128] lstrlenW (lpString=".mdf") returned 4 [0045.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.128] lstrlenW (lpString=".txt") returned 4 [0045.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.128] lstrlenW (lpString=".dbf") returned 4 [0045.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.128] lstrlenW (lpString=".ckp") returned 4 [0045.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.128] lstrlenW (lpString=".dacpac") returned 7 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.129] lstrlenW (lpString=".db3") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.129] lstrlenW (lpString=".dtxs") returned 5 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.129] lstrlenW (lpString=".mdt") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.129] lstrlenW (lpString=".sdf") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.129] lstrlenW (lpString=".MDF") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.129] lstrlenW (lpString=".DBF") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.129] lstrlenW (lpString=".DB") returned 3 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.129] lstrlenW (lpString=".db") returned 3 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.129] lstrlenW (lpString=".ndf") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.129] lstrlenW (lpString=".NDF") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.129] lstrlenW (lpString=".Mdf") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.129] lstrlenW (lpString=".dat") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.129] lstrlenW (lpString=".DAT") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.129] lstrlenW (lpString=".ldf") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.129] lstrlenW (lpString=".LDF") returned 4 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.129] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.130] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0045.130] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.130] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.130] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16513437073) returned 1 [0045.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9b79570, dwHighDateTime=0x1d585b4)) [0045.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd60 [0045.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd60 | out: hHeap=0x260000) returned 1 [0045.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f920 [0045.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f920 | out: hHeap=0x260000) returned 1 [0045.134] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.134] GetLastError () returned 0x0 [0045.134] GetLastError () returned 0x0 [0045.134] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.134] GetLastError () returned 0x0 [0045.134] GetLastError () returned 0x0 [0045.136] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd2cb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.136] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x2d35, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x2d35, lpOverlapped=0x0) returned 1 [0045.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.136] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.136] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.136] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.136] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.136] CloseHandle (hObject=0x108) returned 1 [0045.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.137] GetLastError () returned 0x0 [0045.137] RtlWakeConditionVariable () returned 0x27e828 [0045.137] GetCurrentThreadId () returned 0x99c [0045.137] GetCurrentThreadId () returned 0x99c [0045.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ad88 | out: hHeap=0x260000) returned 1 [0045.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd98 | out: hHeap=0x260000) returned 1 [0045.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0045.137] lstrlenW (lpString=".ldf") returned 4 [0045.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.137] lstrlenW (lpString=".vhd") returned 4 [0045.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.137] lstrlenW (lpString=".vhdx") returned 5 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.138] lstrlenW (lpString=".pst") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.138] lstrlenW (lpString=".ost") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.138] lstrlenW (lpString=".bak") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.138] lstrlenW (lpString=".bac") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.138] lstrlenW (lpString=".sys") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.138] lstrlenW (lpString=".v2i") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.138] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.138] lstrlenW (lpString=".sql") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.138] lstrlenW (lpString=".mdf") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.138] lstrlenW (lpString=".txt") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.138] lstrlenW (lpString=".dbf") returned 4 [0045.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.138] lstrlenW (lpString=".ckp") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.139] lstrlenW (lpString=".dacpac") returned 7 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.139] lstrlenW (lpString=".db3") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.139] lstrlenW (lpString=".dtxs") returned 5 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.139] lstrlenW (lpString=".mdt") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.139] lstrlenW (lpString=".sdf") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.139] lstrlenW (lpString=".MDF") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.139] lstrlenW (lpString=".DBF") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.139] lstrlenW (lpString=".DB") returned 3 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.139] lstrlenW (lpString=".db") returned 3 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.139] lstrlenW (lpString=".ndf") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.139] lstrlenW (lpString=".NDF") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.139] lstrlenW (lpString=".Mdf") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.139] lstrlenW (lpString=".dat") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.139] lstrlenW (lpString=".DAT") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.139] lstrlenW (lpString=".ldf") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.139] lstrlenW (lpString=".LDF") returned 4 [0045.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.139] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.140] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0045.140] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.140] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.141] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16514166438) returned 1 [0045.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9b79570, dwHighDateTime=0x1d585b4)) [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd98 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd98 | out: hHeap=0x260000) returned 1 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f920 [0045.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f920 | out: hHeap=0x260000) returned 1 [0045.141] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.141] GetLastError () returned 0x0 [0045.141] GetLastError () returned 0x0 [0045.141] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.141] GetLastError () returned 0x0 [0045.141] GetLastError () returned 0x0 [0045.143] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6dc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.143] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x9240, lpOverlapped=0x0) returned 1 [0045.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.143] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.144] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.144] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.144] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.144] CloseHandle (hObject=0x108) returned 1 [0045.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.144] GetLastError () returned 0x0 [0045.144] RtlWakeConditionVariable () returned 0x27e828 [0045.144] GetCurrentThreadId () returned 0x99c [0045.145] GetCurrentThreadId () returned 0x99c [0045.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ae0 | out: hHeap=0x260000) returned 1 [0045.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efdd0 | out: hHeap=0x260000) returned 1 [0045.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8ae0 [0045.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.145] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.145] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.145] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.145] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.146] CloseHandle (hObject=0x108) returned 1 [0045.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ae0 | out: hHeap=0x260000) returned 1 [0045.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.146] RtlWakeConditionVariable () returned 0x27e828 [0045.146] GetCurrentThreadId () returned 0x99c [0045.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".ldf") returned 0x0 [0045.146] lstrlenW (lpString=".vhd") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".vhd") returned 0x0 [0045.147] lstrlenW (lpString=".vhdx") returned 5 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".vhdx") returned 0x0 [0045.147] lstrlenW (lpString=".pst") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".pst") returned 0x0 [0045.147] lstrlenW (lpString=".ost") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".ost") returned 0x0 [0045.147] lstrlenW (lpString=".bak") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".bak") returned 0x0 [0045.147] lstrlenW (lpString=".bac") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".bac") returned 0x0 [0045.147] lstrlenW (lpString=".sys") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".sys") returned 0x0 [0045.147] lstrlenW (lpString=".v2i") returned 4 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".v2i") returned 0x0 [0045.147] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.147] lstrlenW (lpString=".sql") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".sql") returned 0x0 [0045.148] lstrlenW (lpString=".mdf") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".mdf") returned 0x0 [0045.148] lstrlenW (lpString=".txt") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".txt") returned 0x0 [0045.148] lstrlenW (lpString=".dbf") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".dbf") returned 0x0 [0045.148] lstrlenW (lpString=".ckp") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".ckp") returned 0x0 [0045.148] lstrlenW (lpString=".dacpac") returned 7 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".dacpac") returned 0x0 [0045.148] lstrlenW (lpString=".db3") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".db3") returned 0x0 [0045.148] lstrlenW (lpString=".dtxs") returned 5 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".dtxs") returned 0x0 [0045.148] lstrlenW (lpString=".mdt") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".mdt") returned 0x0 [0045.148] lstrlenW (lpString=".sdf") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".sdf") returned 0x0 [0045.148] lstrlenW (lpString=".MDF") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".MDF") returned 0x0 [0045.148] lstrlenW (lpString=".DBF") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".DBF") returned 0x0 [0045.148] lstrlenW (lpString=".DB") returned 3 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".DB") returned 0x0 [0045.148] lstrlenW (lpString=".db") returned 3 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".db") returned 0x0 [0045.148] lstrlenW (lpString=".ndf") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".ndf") returned 0x0 [0045.148] lstrlenW (lpString=".NDF") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".NDF") returned 0x0 [0045.148] lstrlenW (lpString=".Mdf") returned 4 [0045.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".Mdf") returned 0x0 [0045.148] lstrlenW (lpString=".dat") returned 4 [0045.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".dat") returned 0x0 [0045.149] lstrlenW (lpString=".DAT") returned 4 [0045.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".DAT") returned 0x0 [0045.149] lstrlenW (lpString=".ldf") returned 4 [0045.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".ldf") returned 0x0 [0045.149] lstrlenW (lpString=".LDF") returned 4 [0045.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch=".LDF") returned 0x0 [0045.149] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.149] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0045.150] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.150] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.150] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16515086408) returned 1 [0045.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9b9f6d0, dwHighDateTime=0x1d585b4)) [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe08 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe08 | out: hHeap=0x260000) returned 1 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29da00 [0045.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29da00 | out: hHeap=0x260000) returned 1 [0045.150] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.150] GetLastError () returned 0x0 [0045.150] GetLastError () returned 0x0 [0045.151] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.151] GetLastError () returned 0x0 [0045.151] GetLastError () returned 0x0 [0045.153] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff2f1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.153] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xd0e5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0xd0e5, lpOverlapped=0x0) returned 1 [0045.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.153] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.153] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.153] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.153] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.153] CloseHandle (hObject=0x108) returned 1 [0045.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.154] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.154] GetLastError () returned 0x0 [0045.154] RtlWakeConditionVariable () returned 0x27e828 [0045.154] GetCurrentThreadId () returned 0x99c [0045.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".ldf") returned 0x0 [0045.154] lstrlenW (lpString=".vhd") returned 4 [0045.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".vhd") returned 0x0 [0045.154] lstrlenW (lpString=".vhdx") returned 5 [0045.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".vhdx") returned 0x0 [0045.154] lstrlenW (lpString=".pst") returned 4 [0045.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".pst") returned 0x0 [0045.154] lstrlenW (lpString=".ost") returned 4 [0045.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".ost") returned 0x0 [0045.154] lstrlenW (lpString=".bak") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".bak") returned 0x0 [0045.155] lstrlenW (lpString=".bac") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".bac") returned 0x0 [0045.155] lstrlenW (lpString=".sys") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".sys") returned 0x0 [0045.155] lstrlenW (lpString=".v2i") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".v2i") returned 0x0 [0045.155] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.155] lstrlenW (lpString=".sql") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".sql") returned 0x0 [0045.155] lstrlenW (lpString=".mdf") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".mdf") returned 0x0 [0045.155] lstrlenW (lpString=".txt") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".txt") returned 0x0 [0045.155] lstrlenW (lpString=".dbf") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".dbf") returned 0x0 [0045.155] lstrlenW (lpString=".ckp") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".ckp") returned 0x0 [0045.155] lstrlenW (lpString=".dacpac") returned 7 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".dacpac") returned 0x0 [0045.155] lstrlenW (lpString=".db3") returned 4 [0045.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".db3") returned 0x0 [0045.156] lstrlenW (lpString=".dtxs") returned 5 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".dtxs") returned 0x0 [0045.156] lstrlenW (lpString=".mdt") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".mdt") returned 0x0 [0045.156] lstrlenW (lpString=".sdf") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".sdf") returned 0x0 [0045.156] lstrlenW (lpString=".MDF") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".MDF") returned 0x0 [0045.156] lstrlenW (lpString=".DBF") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".DBF") returned 0x0 [0045.156] lstrlenW (lpString=".DB") returned 3 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".DB") returned 0x0 [0045.156] lstrlenW (lpString=".db") returned 3 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".db") returned 0x0 [0045.156] lstrlenW (lpString=".ndf") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".ndf") returned 0x0 [0045.156] lstrlenW (lpString=".NDF") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".NDF") returned 0x0 [0045.156] lstrlenW (lpString=".Mdf") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".Mdf") returned 0x0 [0045.156] lstrlenW (lpString=".dat") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".dat") returned 0x0 [0045.156] lstrlenW (lpString=".DAT") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".DAT") returned 0x0 [0045.156] lstrlenW (lpString=".ldf") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".ldf") returned 0x0 [0045.156] lstrlenW (lpString=".LDF") returned 4 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch=".LDF") returned 0x0 [0045.156] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.156] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0045.157] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.157] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.157] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16515849874) returned 1 [0045.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9b9f6d0, dwHighDateTime=0x1d585b4)) [0045.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe40 [0045.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe40 | out: hHeap=0x260000) returned 1 [0045.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0045.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0045.158] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.158] GetLastError () returned 0x0 [0045.158] GetLastError () returned 0x0 [0045.158] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.158] GetLastError () returned 0x0 [0045.158] GetLastError () returned 0x0 [0045.159] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffde5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.159] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x21b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x21b, lpOverlapped=0x0) returned 1 [0045.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.160] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.160] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.160] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.160] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.160] CloseHandle (hObject=0x108) returned 1 [0045.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.160] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.211] GetLastError () returned 0x0 [0045.211] RtlWakeConditionVariable () returned 0x27e828 [0045.211] GetCurrentThreadId () returned 0x99c [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.212] lstrlenW (lpString=".vhd") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.212] lstrlenW (lpString=".vhdx") returned 5 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.212] lstrlenW (lpString=".pst") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.212] lstrlenW (lpString=".ost") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.212] lstrlenW (lpString=".bak") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.212] lstrlenW (lpString=".bac") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.212] lstrlenW (lpString=".sys") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.212] lstrlenW (lpString=".v2i") returned 4 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.326] lstrlenW (lpString=".sql") returned 4 [0045.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.326] lstrlenW (lpString=".mdf") returned 4 [0045.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.326] lstrlenW (lpString=".txt") returned 4 [0045.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.327] lstrlenW (lpString=".dbf") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.327] lstrlenW (lpString=".ckp") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.327] lstrlenW (lpString=".dacpac") returned 7 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.327] lstrlenW (lpString=".db3") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.327] lstrlenW (lpString=".dtxs") returned 5 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.327] lstrlenW (lpString=".mdt") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.327] lstrlenW (lpString=".sdf") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.327] lstrlenW (lpString=".MDF") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.327] lstrlenW (lpString=".DBF") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.327] lstrlenW (lpString=".DB") returned 3 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.327] lstrlenW (lpString=".db") returned 3 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.327] lstrlenW (lpString=".ndf") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.327] lstrlenW (lpString=".NDF") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.327] lstrlenW (lpString=".Mdf") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.327] lstrlenW (lpString=".dat") returned 4 [0045.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.327] lstrlenW (lpString=".DAT") returned 4 [0045.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.328] lstrlenW (lpString=".ldf") returned 4 [0045.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.328] lstrlenW (lpString=".LDF") returned 4 [0045.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.328] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.328] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.329] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.329] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.329] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16532987843) returned 1 [0045.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9d425f0, dwHighDateTime=0x1d585b4)) [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29de98 [0045.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x260000) returned 1 [0045.329] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.329] GetLastError () returned 0x0 [0045.330] GetLastError () returned 0x0 [0045.330] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.330] GetLastError () returned 0x0 [0045.330] GetLastError () returned 0x0 [0045.331] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbe9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.331] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4162, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x4162, lpOverlapped=0x0) returned 1 [0045.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.331] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.332] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.332] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.332] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.332] CloseHandle (hObject=0x108) returned 1 [0045.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.332] GetLastError () returned 0x0 [0045.333] RtlWakeConditionVariable () returned 0x27e828 [0045.333] GetCurrentThreadId () returned 0x99c [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".ldf") returned 0x0 [0045.351] lstrlenW (lpString=".vhd") returned 4 [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".vhd") returned 0x0 [0045.351] lstrlenW (lpString=".vhdx") returned 5 [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".vhdx") returned 0x0 [0045.351] lstrlenW (lpString=".pst") returned 4 [0045.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".pst") returned 0x0 [0045.351] lstrlenW (lpString=".ost") returned 4 [0045.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".ost") returned 0x0 [0045.352] lstrlenW (lpString=".bak") returned 4 [0045.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".bak") returned 0x0 [0045.352] lstrlenW (lpString=".bac") returned 4 [0045.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".bac") returned 0x0 [0045.352] lstrlenW (lpString=".sys") returned 4 [0045.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".sys") returned 0x0 [0045.352] lstrlenW (lpString=".v2i") returned 4 [0045.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".v2i") returned 0x0 [0045.352] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.368] lstrlenW (lpString=".sql") returned 4 [0045.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".sql") returned 0x0 [0045.368] lstrlenW (lpString=".mdf") returned 4 [0045.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".mdf") returned 0x0 [0045.368] lstrlenW (lpString=".txt") returned 4 [0045.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".txt") returned 0x0 [0045.368] lstrlenW (lpString=".dbf") returned 4 [0045.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".dbf") returned 0x0 [0045.368] lstrlenW (lpString=".ckp") returned 4 [0045.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".ckp") returned 0x0 [0045.368] lstrlenW (lpString=".dacpac") returned 7 [0045.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".dacpac") returned 0x0 [0045.376] lstrlenW (lpString=".db3") returned 4 [0045.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".db3") returned 0x0 [0045.376] lstrlenW (lpString=".dtxs") returned 5 [0045.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".dtxs") returned 0x0 [0045.379] lstrlenW (lpString=".mdt") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".mdt") returned 0x0 [0045.388] lstrlenW (lpString=".sdf") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".sdf") returned 0x0 [0045.388] lstrlenW (lpString=".MDF") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".MDF") returned 0x0 [0045.388] lstrlenW (lpString=".DBF") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".DBF") returned 0x0 [0045.388] lstrlenW (lpString=".DB") returned 3 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".DB") returned 0x0 [0045.388] lstrlenW (lpString=".db") returned 3 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".db") returned 0x0 [0045.388] lstrlenW (lpString=".ndf") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".ndf") returned 0x0 [0045.388] lstrlenW (lpString=".NDF") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".NDF") returned 0x0 [0045.388] lstrlenW (lpString=".Mdf") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".Mdf") returned 0x0 [0045.388] lstrlenW (lpString=".dat") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".dat") returned 0x0 [0045.388] lstrlenW (lpString=".DAT") returned 4 [0045.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".DAT") returned 0x0 [0045.389] lstrlenW (lpString=".ldf") returned 4 [0045.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".ldf") returned 0x0 [0045.389] lstrlenW (lpString=".LDF") returned 4 [0045.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch=".LDF") returned 0x0 [0045.389] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.389] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.390] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.390] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.390] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16539082215) returned 1 [0045.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9ddab70, dwHighDateTime=0x1d585b4)) [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00a8 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00a8 | out: hHeap=0x260000) returned 1 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6750 [0045.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0045.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.390] GetLastError () returned 0x0 [0045.390] GetLastError () returned 0x0 [0045.390] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.391] GetLastError () returned 0x0 [0045.391] GetLastError () returned 0x0 [0045.392] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffdc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.392] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x239, lpOverlapped=0x0) returned 1 [0045.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.392] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.392] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.392] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.392] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.392] CloseHandle (hObject=0x108) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.393] GetLastError () returned 0x0 [0045.393] RtlWakeConditionVariable () returned 0x27e828 [0045.393] GetCurrentThreadId () returned 0x99c [0045.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".ldf") returned 0x0 [0045.393] lstrlenW (lpString=".vhd") returned 4 [0045.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".vhd") returned 0x0 [0045.393] lstrlenW (lpString=".vhdx") returned 5 [0045.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".vhdx") returned 0x0 [0045.393] lstrlenW (lpString=".pst") returned 4 [0045.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".pst") returned 0x0 [0045.393] lstrlenW (lpString=".ost") returned 4 [0045.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".ost") returned 0x0 [0045.393] lstrlenW (lpString=".bak") returned 4 [0045.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".bak") returned 0x0 [0045.394] lstrlenW (lpString=".bac") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".bac") returned 0x0 [0045.394] lstrlenW (lpString=".sys") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".sys") returned 0x0 [0045.394] lstrlenW (lpString=".v2i") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".v2i") returned 0x0 [0045.394] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.394] lstrlenW (lpString=".sql") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".sql") returned 0x0 [0045.394] lstrlenW (lpString=".mdf") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".mdf") returned 0x0 [0045.394] lstrlenW (lpString=".txt") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".txt") returned 0x0 [0045.394] lstrlenW (lpString=".dbf") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".dbf") returned 0x0 [0045.394] lstrlenW (lpString=".ckp") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".ckp") returned 0x0 [0045.394] lstrlenW (lpString=".dacpac") returned 7 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".dacpac") returned 0x0 [0045.394] lstrlenW (lpString=".db3") returned 4 [0045.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".db3") returned 0x0 [0045.395] lstrlenW (lpString=".dtxs") returned 5 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".dtxs") returned 0x0 [0045.395] lstrlenW (lpString=".mdt") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".mdt") returned 0x0 [0045.395] lstrlenW (lpString=".sdf") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".sdf") returned 0x0 [0045.395] lstrlenW (lpString=".MDF") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".MDF") returned 0x0 [0045.395] lstrlenW (lpString=".DBF") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".DBF") returned 0x0 [0045.395] lstrlenW (lpString=".DB") returned 3 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".DB") returned 0x0 [0045.395] lstrlenW (lpString=".db") returned 3 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".db") returned 0x0 [0045.395] lstrlenW (lpString=".ndf") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".ndf") returned 0x0 [0045.395] lstrlenW (lpString=".NDF") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".NDF") returned 0x0 [0045.395] lstrlenW (lpString=".Mdf") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".Mdf") returned 0x0 [0045.395] lstrlenW (lpString=".dat") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".dat") returned 0x0 [0045.395] lstrlenW (lpString=".DAT") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".DAT") returned 0x0 [0045.395] lstrlenW (lpString=".ldf") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".ldf") returned 0x0 [0045.395] lstrlenW (lpString=".LDF") returned 4 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch=".LDF") returned 0x0 [0045.395] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.395] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.396] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.397] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16539766715) returned 1 [0045.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9e00cd0, dwHighDateTime=0x1d585b4)) [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00e0 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00e0 | out: hHeap=0x260000) returned 1 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f67f8 [0045.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f67f8 | out: hHeap=0x260000) returned 1 [0045.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.397] GetLastError () returned 0x0 [0045.397] GetLastError () returned 0x0 [0045.397] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.397] GetLastError () returned 0x0 [0045.397] GetLastError () returned 0x0 [0045.427] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffefe20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.427] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x101e0, lpOverlapped=0x0) returned 1 [0045.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.430] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.430] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.430] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.430] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.430] CloseHandle (hObject=0x108) returned 1 [0045.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.436] GetLastError () returned 0x0 [0045.436] RtlWakeConditionVariable () returned 0x27e828 [0045.436] GetCurrentThreadId () returned 0x99c [0045.437] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.437] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.437] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.437] WriteFile (in: hFile=0x104, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.438] CloseHandle (hObject=0x104) returned 1 [0045.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8f90 | out: hHeap=0x260000) returned 1 [0045.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e00 | out: hHeap=0x260000) returned 1 [0045.438] RtlWakeConditionVariable () returned 0x27e828 [0045.438] GetCurrentThreadId () returned 0x99c [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.438] lstrlenW (lpString=".vhd") returned 4 [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.438] lstrlenW (lpString=".vhdx") returned 5 [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.438] lstrlenW (lpString=".pst") returned 4 [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.438] lstrlenW (lpString=".ost") returned 4 [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.438] lstrlenW (lpString=".bak") returned 4 [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.438] lstrlenW (lpString=".bac") returned 4 [0045.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.439] lstrlenW (lpString=".sys") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.439] lstrlenW (lpString=".v2i") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.439] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.439] lstrlenW (lpString=".sql") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.439] lstrlenW (lpString=".mdf") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.439] lstrlenW (lpString=".txt") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.439] lstrlenW (lpString=".dbf") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.439] lstrlenW (lpString=".ckp") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.439] lstrlenW (lpString=".dacpac") returned 7 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.439] lstrlenW (lpString=".db3") returned 4 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.439] lstrlenW (lpString=".dtxs") returned 5 [0045.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.439] lstrlenW (lpString=".mdt") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.440] lstrlenW (lpString=".sdf") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.440] lstrlenW (lpString=".MDF") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.440] lstrlenW (lpString=".DBF") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.440] lstrlenW (lpString=".DB") returned 3 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.440] lstrlenW (lpString=".db") returned 3 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.440] lstrlenW (lpString=".ndf") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.440] lstrlenW (lpString=".NDF") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.440] lstrlenW (lpString=".Mdf") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.440] lstrlenW (lpString=".dat") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.440] lstrlenW (lpString=".DAT") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.440] lstrlenW (lpString=".ldf") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.440] lstrlenW (lpString=".LDF") returned 4 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.440] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.440] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0045.441] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.441] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.441] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16544249251) returned 1 [0045.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9e4cf90, dwHighDateTime=0x1d585b4)) [0045.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294758 [0045.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0045.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7908 [0045.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7908 | out: hHeap=0x260000) returned 1 [0045.442] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.442] GetLastError () returned 0x0 [0045.442] GetLastError () returned 0x0 [0045.442] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.442] GetLastError () returned 0x0 [0045.442] GetLastError () returned 0x0 [0045.445] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.445] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x1004, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x1004, lpOverlapped=0x0) returned 1 [0045.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.445] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.445] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.446] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.446] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.446] CloseHandle (hObject=0x104) returned 1 [0045.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.446] GetLastError () returned 0x0 [0045.446] RtlWakeConditionVariable () returned 0x27e828 [0045.446] GetCurrentThreadId () returned 0x99c [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".ldf") returned 0x0 [0045.447] lstrlenW (lpString=".vhd") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".vhd") returned 0x0 [0045.447] lstrlenW (lpString=".vhdx") returned 5 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".vhdx") returned 0x0 [0045.447] lstrlenW (lpString=".pst") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".pst") returned 0x0 [0045.447] lstrlenW (lpString=".ost") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".ost") returned 0x0 [0045.447] lstrlenW (lpString=".bak") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".bak") returned 0x0 [0045.447] lstrlenW (lpString=".bac") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".bac") returned 0x0 [0045.447] lstrlenW (lpString=".sys") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".sys") returned 0x0 [0045.447] lstrlenW (lpString=".v2i") returned 4 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".v2i") returned 0x0 [0045.447] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.448] lstrlenW (lpString=".sql") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".sql") returned 0x0 [0045.448] lstrlenW (lpString=".mdf") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".mdf") returned 0x0 [0045.448] lstrlenW (lpString=".txt") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".txt") returned 0x0 [0045.448] lstrlenW (lpString=".dbf") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".dbf") returned 0x0 [0045.448] lstrlenW (lpString=".ckp") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".ckp") returned 0x0 [0045.448] lstrlenW (lpString=".dacpac") returned 7 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".dacpac") returned 0x0 [0045.448] lstrlenW (lpString=".db3") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".db3") returned 0x0 [0045.448] lstrlenW (lpString=".dtxs") returned 5 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".dtxs") returned 0x0 [0045.448] lstrlenW (lpString=".mdt") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".mdt") returned 0x0 [0045.448] lstrlenW (lpString=".sdf") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".sdf") returned 0x0 [0045.448] lstrlenW (lpString=".MDF") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".MDF") returned 0x0 [0045.448] lstrlenW (lpString=".DBF") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".DBF") returned 0x0 [0045.448] lstrlenW (lpString=".DB") returned 3 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".DB") returned 0x0 [0045.448] lstrlenW (lpString=".db") returned 3 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".db") returned 0x0 [0045.448] lstrlenW (lpString=".ndf") returned 4 [0045.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".ndf") returned 0x0 [0045.449] lstrlenW (lpString=".NDF") returned 4 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".NDF") returned 0x0 [0045.449] lstrlenW (lpString=".Mdf") returned 4 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".Mdf") returned 0x0 [0045.449] lstrlenW (lpString=".dat") returned 4 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".dat") returned 0x0 [0045.449] lstrlenW (lpString=".DAT") returned 4 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".DAT") returned 0x0 [0045.449] lstrlenW (lpString=".ldf") returned 4 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".ldf") returned 0x0 [0045.449] lstrlenW (lpString=".LDF") returned 4 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch=".LDF") returned 0x0 [0045.449] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.449] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0045.450] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.450] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.450] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16545113214) returned 1 [0045.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9e730f0, dwHighDateTime=0x1d585b4)) [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294790 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f7668 [0045.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7668 | out: hHeap=0x260000) returned 1 [0045.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.451] GetLastError () returned 0x0 [0045.451] GetLastError () returned 0x0 [0045.451] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.451] GetLastError () returned 0x0 [0045.451] GetLastError () returned 0x0 [0045.481] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffee1c9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.481] WriteFile (in: hFile=0x104, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x11e37, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x11e37, lpOverlapped=0x0) returned 1 [0045.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.483] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.483] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.483] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.484] CloseHandle (hObject=0x104) returned 1 [0045.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.510] GetLastError () returned 0x0 [0045.510] RtlWakeConditionVariable () returned 0x27e828 [0045.510] GetCurrentThreadId () returned 0x99c [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.510] lstrlenW (lpString=".vhd") returned 4 [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.510] lstrlenW (lpString=".vhdx") returned 5 [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.510] lstrlenW (lpString=".pst") returned 4 [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.510] lstrlenW (lpString=".ost") returned 4 [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.510] lstrlenW (lpString=".bak") returned 4 [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.510] lstrlenW (lpString=".bac") returned 4 [0045.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.510] lstrlenW (lpString=".sys") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.511] lstrlenW (lpString=".v2i") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.511] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.511] lstrlenW (lpString=".sql") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.511] lstrlenW (lpString=".mdf") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.511] lstrlenW (lpString=".txt") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.511] lstrlenW (lpString=".dbf") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.511] lstrlenW (lpString=".ckp") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.511] lstrlenW (lpString=".dacpac") returned 7 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.511] lstrlenW (lpString=".db3") returned 4 [0045.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.511] lstrlenW (lpString=".dtxs") returned 5 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.512] lstrlenW (lpString=".mdt") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.512] lstrlenW (lpString=".sdf") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.512] lstrlenW (lpString=".MDF") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.512] lstrlenW (lpString=".DBF") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.512] lstrlenW (lpString=".DB") returned 3 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.512] lstrlenW (lpString=".db") returned 3 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.512] lstrlenW (lpString=".ndf") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.512] lstrlenW (lpString=".NDF") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.512] lstrlenW (lpString=".Mdf") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.512] lstrlenW (lpString=".dat") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.512] lstrlenW (lpString=".DAT") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.512] lstrlenW (lpString=".ldf") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.512] lstrlenW (lpString=".LDF") returned 4 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.512] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.512] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.512] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.513] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.513] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.513] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16551450557) returned 1 [0045.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9f0b670, dwHighDateTime=0x1d585b4)) [0045.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0268 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0268 | out: hHeap=0x260000) returned 1 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f77b8 [0045.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f77b8 | out: hHeap=0x260000) returned 1 [0045.514] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.514] GetLastError () returned 0x0 [0045.514] GetLastError () returned 0x0 [0045.514] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.514] GetLastError () returned 0x0 [0045.514] GetLastError () returned 0x0 [0045.517] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff1e5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.517] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xe1b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xe1b, lpOverlapped=0x0) returned 1 [0045.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.517] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.517] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.517] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.517] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.518] CloseHandle (hObject=0x108) returned 1 [0045.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.518] GetLastError () returned 0x0 [0045.518] RtlWakeConditionVariable () returned 0x27e828 [0045.518] GetCurrentThreadId () returned 0x99c [0045.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".ldf") returned 0x0 [0045.519] lstrlenW (lpString=".vhd") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".vhd") returned 0x0 [0045.519] lstrlenW (lpString=".vhdx") returned 5 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".vhdx") returned 0x0 [0045.519] lstrlenW (lpString=".pst") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".pst") returned 0x0 [0045.519] lstrlenW (lpString=".ost") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".ost") returned 0x0 [0045.519] lstrlenW (lpString=".bak") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".bak") returned 0x0 [0045.519] lstrlenW (lpString=".bac") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".bac") returned 0x0 [0045.519] lstrlenW (lpString=".sys") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".sys") returned 0x0 [0045.519] lstrlenW (lpString=".v2i") returned 4 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".v2i") returned 0x0 [0045.519] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.520] lstrlenW (lpString=".sql") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".sql") returned 0x0 [0045.520] lstrlenW (lpString=".mdf") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".mdf") returned 0x0 [0045.520] lstrlenW (lpString=".txt") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".txt") returned 0x0 [0045.520] lstrlenW (lpString=".dbf") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".dbf") returned 0x0 [0045.520] lstrlenW (lpString=".ckp") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".ckp") returned 0x0 [0045.520] lstrlenW (lpString=".dacpac") returned 7 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".dacpac") returned 0x0 [0045.520] lstrlenW (lpString=".db3") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".db3") returned 0x0 [0045.520] lstrlenW (lpString=".dtxs") returned 5 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".dtxs") returned 0x0 [0045.520] lstrlenW (lpString=".mdt") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".mdt") returned 0x0 [0045.520] lstrlenW (lpString=".sdf") returned 4 [0045.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".sdf") returned 0x0 [0045.520] lstrlenW (lpString=".MDF") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".MDF") returned 0x0 [0045.521] lstrlenW (lpString=".DBF") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".DBF") returned 0x0 [0045.521] lstrlenW (lpString=".DB") returned 3 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".DB") returned 0x0 [0045.521] lstrlenW (lpString=".db") returned 3 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".db") returned 0x0 [0045.521] lstrlenW (lpString=".ndf") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".ndf") returned 0x0 [0045.521] lstrlenW (lpString=".NDF") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".NDF") returned 0x0 [0045.521] lstrlenW (lpString=".Mdf") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".Mdf") returned 0x0 [0045.521] lstrlenW (lpString=".dat") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".dat") returned 0x0 [0045.521] lstrlenW (lpString=".DAT") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".DAT") returned 0x0 [0045.521] lstrlenW (lpString=".ldf") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".ldf") returned 0x0 [0045.521] lstrlenW (lpString=".LDF") returned 4 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch=".LDF") returned 0x0 [0045.521] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.521] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.522] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.522] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.522] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16552349020) returned 1 [0045.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9f317d0, dwHighDateTime=0x1d585b4)) [0045.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f02a0 [0045.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02a0 | out: hHeap=0x260000) returned 1 [0045.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5d78 [0045.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5d78 | out: hHeap=0x260000) returned 1 [0045.523] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.523] GetLastError () returned 0x0 [0045.523] GetLastError () returned 0x0 [0045.523] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.523] GetLastError () returned 0x0 [0045.523] GetLastError () returned 0x0 [0045.526] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.526] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0045.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.527] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.527] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.527] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.527] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.527] CloseHandle (hObject=0x108) returned 1 [0045.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.529] GetLastError () returned 0x0 [0045.529] RtlWakeConditionVariable () returned 0x27e828 [0045.529] GetCurrentThreadId () returned 0x99c [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".ldf") returned 0x0 [0045.529] lstrlenW (lpString=".vhd") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".vhd") returned 0x0 [0045.529] lstrlenW (lpString=".vhdx") returned 5 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".vhdx") returned 0x0 [0045.529] lstrlenW (lpString=".pst") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".pst") returned 0x0 [0045.529] lstrlenW (lpString=".ost") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".ost") returned 0x0 [0045.529] lstrlenW (lpString=".bak") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".bak") returned 0x0 [0045.529] lstrlenW (lpString=".bac") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".bac") returned 0x0 [0045.529] lstrlenW (lpString=".sys") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".sys") returned 0x0 [0045.529] lstrlenW (lpString=".v2i") returned 4 [0045.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".v2i") returned 0x0 [0045.529] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.530] lstrlenW (lpString=".sql") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".sql") returned 0x0 [0045.530] lstrlenW (lpString=".mdf") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".mdf") returned 0x0 [0045.530] lstrlenW (lpString=".txt") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".txt") returned 0x0 [0045.530] lstrlenW (lpString=".dbf") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".dbf") returned 0x0 [0045.530] lstrlenW (lpString=".ckp") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".ckp") returned 0x0 [0045.530] lstrlenW (lpString=".dacpac") returned 7 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".dacpac") returned 0x0 [0045.530] lstrlenW (lpString=".db3") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".db3") returned 0x0 [0045.530] lstrlenW (lpString=".dtxs") returned 5 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".dtxs") returned 0x0 [0045.530] lstrlenW (lpString=".mdt") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".mdt") returned 0x0 [0045.530] lstrlenW (lpString=".sdf") returned 4 [0045.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".sdf") returned 0x0 [0045.531] lstrlenW (lpString=".MDF") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".MDF") returned 0x0 [0045.531] lstrlenW (lpString=".DBF") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".DBF") returned 0x0 [0045.531] lstrlenW (lpString=".DB") returned 3 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".DB") returned 0x0 [0045.531] lstrlenW (lpString=".db") returned 3 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".db") returned 0x0 [0045.531] lstrlenW (lpString=".ndf") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".ndf") returned 0x0 [0045.531] lstrlenW (lpString=".NDF") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".NDF") returned 0x0 [0045.531] lstrlenW (lpString=".Mdf") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".Mdf") returned 0x0 [0045.531] lstrlenW (lpString=".dat") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".dat") returned 0x0 [0045.531] lstrlenW (lpString=".DAT") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".DAT") returned 0x0 [0045.531] lstrlenW (lpString=".ldf") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".ldf") returned 0x0 [0045.531] lstrlenW (lpString=".LDF") returned 4 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch=".LDF") returned 0x0 [0045.531] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.531] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.532] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.532] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.532] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16553333937) returned 1 [0045.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9f317d0, dwHighDateTime=0x1d585b4)) [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f02d8 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f02d8 | out: hHeap=0x260000) returned 1 [0045.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5cd0 [0045.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5cd0 | out: hHeap=0x260000) returned 1 [0045.533] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.533] GetLastError () returned 0x0 [0045.533] GetLastError () returned 0x0 [0045.533] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.533] GetLastError () returned 0x0 [0045.533] GetLastError () returned 0x0 [0045.534] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffe38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.534] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1c8, lpOverlapped=0x0) returned 1 [0045.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.534] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.534] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.535] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.535] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.535] CloseHandle (hObject=0x108) returned 1 [0045.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.535] GetLastError () returned 0x0 [0045.535] RtlWakeConditionVariable () returned 0x27e828 [0045.536] GetCurrentThreadId () returned 0x99c [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.536] lstrlenW (lpString=".vhd") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.536] lstrlenW (lpString=".vhdx") returned 5 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.536] lstrlenW (lpString=".pst") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.536] lstrlenW (lpString=".ost") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.536] lstrlenW (lpString=".bak") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.536] lstrlenW (lpString=".bac") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.536] lstrlenW (lpString=".sys") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.536] lstrlenW (lpString=".v2i") returned 4 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.536] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.537] lstrlenW (lpString=".sql") returned 4 [0045.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.537] lstrlenW (lpString=".mdf") returned 4 [0045.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.537] lstrlenW (lpString=".txt") returned 4 [0045.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.537] lstrlenW (lpString=".dbf") returned 4 [0045.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.537] lstrlenW (lpString=".ckp") returned 4 [0045.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.537] lstrlenW (lpString=".dacpac") returned 7 [0045.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.537] lstrlenW (lpString=".db3") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.538] lstrlenW (lpString=".dtxs") returned 5 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.538] lstrlenW (lpString=".mdt") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.538] lstrlenW (lpString=".sdf") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.538] lstrlenW (lpString=".MDF") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.538] lstrlenW (lpString=".DBF") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.538] lstrlenW (lpString=".DB") returned 3 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.538] lstrlenW (lpString=".db") returned 3 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.538] lstrlenW (lpString=".ndf") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.538] lstrlenW (lpString=".NDF") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.538] lstrlenW (lpString=".Mdf") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.538] lstrlenW (lpString=".dat") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.538] lstrlenW (lpString=".DAT") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.538] lstrlenW (lpString=".ldf") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.538] lstrlenW (lpString=".LDF") returned 4 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.538] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.539] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.539] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0045.539] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16554054099) returned 1 [0045.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xa9f57930, dwHighDateTime=0x1d585b4)) [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0310 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0310 | out: hHeap=0x260000) returned 1 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0045.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0045.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.540] GetLastError () returned 0x0 [0045.540] GetLastError () returned 0x0 [0045.540] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.540] GetLastError () returned 0x0 [0045.540] GetLastError () returned 0x0 [0045.625] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7a8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.625] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8573, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x8573, lpOverlapped=0x0) returned 1 [0045.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.625] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.625] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.625] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.625] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.625] CloseHandle (hObject=0x108) returned 1 [0045.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.626] GetLastError () returned 0x0 [0045.626] RtlWakeConditionVariable () returned 0x27e828 [0045.626] GetCurrentThreadId () returned 0x99c [0045.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".ldf") returned 0x0 [0045.626] lstrlenW (lpString=".vhd") returned 4 [0045.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".vhd") returned 0x0 [0045.626] lstrlenW (lpString=".vhdx") returned 5 [0045.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".vhdx") returned 0x0 [0045.626] lstrlenW (lpString=".pst") returned 4 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".pst") returned 0x0 [0045.627] lstrlenW (lpString=".ost") returned 4 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".ost") returned 0x0 [0045.627] lstrlenW (lpString=".bak") returned 4 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".bak") returned 0x0 [0045.627] lstrlenW (lpString=".bac") returned 4 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".bac") returned 0x0 [0045.627] lstrlenW (lpString=".sys") returned 4 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".sys") returned 0x0 [0045.627] lstrlenW (lpString=".v2i") returned 4 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".v2i") returned 0x0 [0045.627] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.651] lstrlenW (lpString=".sql") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".sql") returned 0x0 [0045.651] lstrlenW (lpString=".mdf") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".mdf") returned 0x0 [0045.651] lstrlenW (lpString=".txt") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".txt") returned 0x0 [0045.651] lstrlenW (lpString=".dbf") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".dbf") returned 0x0 [0045.651] lstrlenW (lpString=".ckp") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".ckp") returned 0x0 [0045.651] lstrlenW (lpString=".dacpac") returned 7 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".dacpac") returned 0x0 [0045.651] lstrlenW (lpString=".db3") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".db3") returned 0x0 [0045.651] lstrlenW (lpString=".dtxs") returned 5 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".dtxs") returned 0x0 [0045.651] lstrlenW (lpString=".mdt") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".mdt") returned 0x0 [0045.651] lstrlenW (lpString=".sdf") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".sdf") returned 0x0 [0045.651] lstrlenW (lpString=".MDF") returned 4 [0045.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".MDF") returned 0x0 [0045.652] lstrlenW (lpString=".DBF") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".DBF") returned 0x0 [0045.652] lstrlenW (lpString=".DB") returned 3 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".DB") returned 0x0 [0045.652] lstrlenW (lpString=".db") returned 3 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".db") returned 0x0 [0045.652] lstrlenW (lpString=".ndf") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".ndf") returned 0x0 [0045.652] lstrlenW (lpString=".NDF") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".NDF") returned 0x0 [0045.652] lstrlenW (lpString=".Mdf") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".Mdf") returned 0x0 [0045.652] lstrlenW (lpString=".dat") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".dat") returned 0x0 [0045.652] lstrlenW (lpString=".DAT") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".DAT") returned 0x0 [0045.652] lstrlenW (lpString=".ldf") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".ldf") returned 0x0 [0045.652] lstrlenW (lpString=".LDF") returned 4 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch=".LDF") returned 0x0 [0045.652] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.652] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.653] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.653] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.653] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16565422371) returned 1 [0045.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa0622d0, dwHighDateTime=0x1d585b4)) [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b80 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e138 [0045.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e138 | out: hHeap=0x260000) returned 1 [0045.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.654] GetLastError () returned 0x0 [0045.654] GetLastError () returned 0x0 [0045.654] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.654] GetLastError () returned 0x0 [0045.654] GetLastError () returned 0x0 [0045.655] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffe1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.655] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1e4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1e4, lpOverlapped=0x0) returned 1 [0045.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.655] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.655] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.655] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.655] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.656] CloseHandle (hObject=0x108) returned 1 [0045.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.656] GetLastError () returned 0x0 [0045.656] RtlWakeConditionVariable () returned 0x27e828 [0045.656] GetCurrentThreadId () returned 0x99c [0045.735] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.747] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.754] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.754] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.756] CloseHandle (hObject=0xf8) returned 1 [0045.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9440 | out: hHeap=0x260000) returned 1 [0045.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.756] RtlWakeConditionVariable () returned 0x27e828 [0045.756] GetCurrentThreadId () returned 0x99c [0045.756] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.756] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.756] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.756] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.757] CloseHandle (hObject=0xf8) returned 1 [0045.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0045.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.757] RtlWakeConditionVariable () returned 0x27e828 [0045.758] GetCurrentThreadId () returned 0x99c [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.758] lstrlenW (lpString=".vhd") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.758] lstrlenW (lpString=".vhdx") returned 5 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.758] lstrlenW (lpString=".pst") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.758] lstrlenW (lpString=".ost") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.758] lstrlenW (lpString=".bak") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.758] lstrlenW (lpString=".bac") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.758] lstrlenW (lpString=".sys") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.758] lstrlenW (lpString=".v2i") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.758] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.758] lstrlenW (lpString=".sql") returned 4 [0045.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.758] lstrlenW (lpString=".mdf") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.759] lstrlenW (lpString=".txt") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.759] lstrlenW (lpString=".dbf") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.759] lstrlenW (lpString=".ckp") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.759] lstrlenW (lpString=".dacpac") returned 7 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.759] lstrlenW (lpString=".db3") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.759] lstrlenW (lpString=".dtxs") returned 5 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.759] lstrlenW (lpString=".mdt") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.759] lstrlenW (lpString=".sdf") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.759] lstrlenW (lpString=".MDF") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.759] lstrlenW (lpString=".DBF") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.759] lstrlenW (lpString=".DB") returned 3 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.759] lstrlenW (lpString=".db") returned 3 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.759] lstrlenW (lpString=".ndf") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.759] lstrlenW (lpString=".NDF") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.759] lstrlenW (lpString=".Mdf") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.759] lstrlenW (lpString=".dat") returned 4 [0045.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.760] lstrlenW (lpString=".DAT") returned 4 [0045.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.760] lstrlenW (lpString=".ldf") returned 4 [0045.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.760] lstrlenW (lpString=".LDF") returned 4 [0045.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.760] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.760] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.761] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.761] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x334d00 [0045.761] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16576188166) returned 1 [0045.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa16cc70, dwHighDateTime=0x1d585b4)) [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952a0 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0045.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.761] GetLastError () returned 0x0 [0045.762] GetLastError () returned 0x0 [0045.762] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.762] GetLastError () returned 0x0 [0045.762] GetLastError () returned 0x0 [0045.765] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff975, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.765] WriteFile (in: hFile=0xf8, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x68b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x238fdb0*=0x68b, lpOverlapped=0x0) returned 1 [0045.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0045.765] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.765] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.765] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.765] CloseHandle (hObject=0xf8) returned 1 [0045.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.766] GetLastError () returned 0x0 [0045.766] RtlWakeConditionVariable () returned 0x27e828 [0045.766] GetCurrentThreadId () returned 0x99c [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".ldf") returned 0x0 [0045.766] lstrlenW (lpString=".vhd") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".vhd") returned 0x0 [0045.766] lstrlenW (lpString=".vhdx") returned 5 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".vhdx") returned 0x0 [0045.766] lstrlenW (lpString=".pst") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".pst") returned 0x0 [0045.766] lstrlenW (lpString=".ost") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".ost") returned 0x0 [0045.766] lstrlenW (lpString=".bak") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".bak") returned 0x0 [0045.766] lstrlenW (lpString=".bac") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".bac") returned 0x0 [0045.766] lstrlenW (lpString=".sys") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".sys") returned 0x0 [0045.766] lstrlenW (lpString=".v2i") returned 4 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".v2i") returned 0x0 [0045.766] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.768] lstrlenW (lpString=".sql") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".sql") returned 0x0 [0045.768] lstrlenW (lpString=".mdf") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".mdf") returned 0x0 [0045.768] lstrlenW (lpString=".txt") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".txt") returned 0x0 [0045.768] lstrlenW (lpString=".dbf") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".dbf") returned 0x0 [0045.768] lstrlenW (lpString=".ckp") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".ckp") returned 0x0 [0045.768] lstrlenW (lpString=".dacpac") returned 7 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".dacpac") returned 0x0 [0045.768] lstrlenW (lpString=".db3") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".db3") returned 0x0 [0045.768] lstrlenW (lpString=".dtxs") returned 5 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".dtxs") returned 0x0 [0045.768] lstrlenW (lpString=".mdt") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".mdt") returned 0x0 [0045.768] lstrlenW (lpString=".sdf") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".sdf") returned 0x0 [0045.768] lstrlenW (lpString=".MDF") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".MDF") returned 0x0 [0045.768] lstrlenW (lpString=".DBF") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".DBF") returned 0x0 [0045.768] lstrlenW (lpString=".DB") returned 3 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".DB") returned 0x0 [0045.768] lstrlenW (lpString=".db") returned 3 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".db") returned 0x0 [0045.768] lstrlenW (lpString=".ndf") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".ndf") returned 0x0 [0045.768] lstrlenW (lpString=".NDF") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".NDF") returned 0x0 [0045.768] lstrlenW (lpString=".Mdf") returned 4 [0045.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".Mdf") returned 0x0 [0045.769] lstrlenW (lpString=".dat") returned 4 [0045.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".dat") returned 0x0 [0045.769] lstrlenW (lpString=".DAT") returned 4 [0045.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".DAT") returned 0x0 [0045.769] lstrlenW (lpString=".ldf") returned 4 [0045.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".ldf") returned 0x0 [0045.769] lstrlenW (lpString=".LDF") returned 4 [0045.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch=".LDF") returned 0x0 [0045.769] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.769] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.770] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.770] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x334d00 [0045.770] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16577091241) returned 1 [0045.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa16cc70, dwHighDateTime=0x1d585b4)) [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952d8 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952d8 | out: hHeap=0x260000) returned 1 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a0e0 [0045.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a0e0 | out: hHeap=0x260000) returned 1 [0045.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.771] GetLastError () returned 0x0 [0045.771] GetLastError () returned 0x0 [0045.771] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.771] GetLastError () returned 0x0 [0045.771] GetLastError () returned 0x0 [0045.773] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff4013, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.773] WriteFile (in: hFile=0xf8, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0xbfed, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x238fdb0*=0xbfed, lpOverlapped=0x0) returned 1 [0045.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0045.773] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.774] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.774] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.774] CloseHandle (hObject=0xf8) returned 1 [0045.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.825] GetLastError () returned 0x0 [0045.825] RtlWakeConditionVariable () returned 0x27e828 [0045.825] GetCurrentThreadId () returned 0x99c [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.825] lstrlenW (lpString=".vhd") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.825] lstrlenW (lpString=".vhdx") returned 5 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.825] lstrlenW (lpString=".pst") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.825] lstrlenW (lpString=".ost") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.825] lstrlenW (lpString=".bak") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.825] lstrlenW (lpString=".bac") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.825] lstrlenW (lpString=".sys") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.825] lstrlenW (lpString=".v2i") returned 4 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.825] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.826] lstrlenW (lpString=".sql") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.826] lstrlenW (lpString=".mdf") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.826] lstrlenW (lpString=".txt") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.826] lstrlenW (lpString=".dbf") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.826] lstrlenW (lpString=".ckp") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.826] lstrlenW (lpString=".dacpac") returned 7 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.826] lstrlenW (lpString=".db3") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.826] lstrlenW (lpString=".dtxs") returned 5 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.826] lstrlenW (lpString=".mdt") returned 4 [0045.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.826] lstrlenW (lpString=".sdf") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.827] lstrlenW (lpString=".MDF") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.827] lstrlenW (lpString=".DBF") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.827] lstrlenW (lpString=".DB") returned 3 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.827] lstrlenW (lpString=".db") returned 3 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.827] lstrlenW (lpString=".ndf") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.827] lstrlenW (lpString=".NDF") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.827] lstrlenW (lpString=".Mdf") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.827] lstrlenW (lpString=".dat") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.827] lstrlenW (lpString=".DAT") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.827] lstrlenW (lpString=".ldf") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.827] lstrlenW (lpString=".LDF") returned 4 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.827] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.827] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.828] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.828] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.828] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16582941395) returned 1 [0045.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa2051f0, dwHighDateTime=0x1d585b4)) [0045.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295428 [0045.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0045.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6360 [0045.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0045.829] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.829] GetLastError () returned 0x0 [0045.829] GetLastError () returned 0x0 [0045.829] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.829] GetLastError () returned 0x0 [0045.829] GetLastError () returned 0x0 [0045.832] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec81, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.832] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x137f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x137f, lpOverlapped=0x0) returned 1 [0045.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.833] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.833] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.833] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.833] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.833] CloseHandle (hObject=0xf8) returned 1 [0045.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.834] GetLastError () returned 0x0 [0045.834] RtlWakeConditionVariable () returned 0x27e828 [0045.834] GetCurrentThreadId () returned 0x99c [0045.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".ldf") returned 0x0 [0045.834] lstrlenW (lpString=".vhd") returned 4 [0045.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".vhd") returned 0x0 [0045.834] lstrlenW (lpString=".vhdx") returned 5 [0045.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".vhdx") returned 0x0 [0045.835] lstrlenW (lpString=".pst") returned 4 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".pst") returned 0x0 [0045.835] lstrlenW (lpString=".ost") returned 4 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".ost") returned 0x0 [0045.835] lstrlenW (lpString=".bak") returned 4 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".bak") returned 0x0 [0045.835] lstrlenW (lpString=".bac") returned 4 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".bac") returned 0x0 [0045.835] lstrlenW (lpString=".sys") returned 4 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".sys") returned 0x0 [0045.835] lstrlenW (lpString=".v2i") returned 4 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".v2i") returned 0x0 [0045.835] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.836] lstrlenW (lpString=".sql") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".sql") returned 0x0 [0045.836] lstrlenW (lpString=".mdf") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".mdf") returned 0x0 [0045.836] lstrlenW (lpString=".txt") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".txt") returned 0x0 [0045.836] lstrlenW (lpString=".dbf") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".dbf") returned 0x0 [0045.836] lstrlenW (lpString=".ckp") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".ckp") returned 0x0 [0045.836] lstrlenW (lpString=".dacpac") returned 7 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".dacpac") returned 0x0 [0045.836] lstrlenW (lpString=".db3") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".db3") returned 0x0 [0045.836] lstrlenW (lpString=".dtxs") returned 5 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".dtxs") returned 0x0 [0045.836] lstrlenW (lpString=".mdt") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".mdt") returned 0x0 [0045.836] lstrlenW (lpString=".sdf") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".sdf") returned 0x0 [0045.836] lstrlenW (lpString=".MDF") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".MDF") returned 0x0 [0045.836] lstrlenW (lpString=".DBF") returned 4 [0045.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".DBF") returned 0x0 [0045.837] lstrlenW (lpString=".DB") returned 3 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".DB") returned 0x0 [0045.837] lstrlenW (lpString=".db") returned 3 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".db") returned 0x0 [0045.837] lstrlenW (lpString=".ndf") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".ndf") returned 0x0 [0045.837] lstrlenW (lpString=".NDF") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".NDF") returned 0x0 [0045.837] lstrlenW (lpString=".Mdf") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".Mdf") returned 0x0 [0045.837] lstrlenW (lpString=".dat") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".dat") returned 0x0 [0045.837] lstrlenW (lpString=".DAT") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".DAT") returned 0x0 [0045.837] lstrlenW (lpString=".ldf") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".ldf") returned 0x0 [0045.837] lstrlenW (lpString=".LDF") returned 4 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch=".LDF") returned 0x0 [0045.837] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.837] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.838] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.838] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.838] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16583929657) returned 1 [0045.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa22b350, dwHighDateTime=0x1d585b4)) [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295230 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295230 | out: hHeap=0x260000) returned 1 [0045.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6360 [0045.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0045.839] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.839] GetLastError () returned 0x0 [0045.839] GetLastError () returned 0x0 [0045.839] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.839] GetLastError () returned 0x0 [0045.839] GetLastError () returned 0x0 [0045.842] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.842] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0045.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.843] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.843] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.843] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.843] CloseHandle (hObject=0xf8) returned 1 [0045.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.846] GetLastError () returned 0x0 [0045.846] RtlWakeConditionVariable () returned 0x27e828 [0045.846] GetCurrentThreadId () returned 0x99c [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".ldf") returned 0x0 [0045.846] lstrlenW (lpString=".vhd") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".vhd") returned 0x0 [0045.846] lstrlenW (lpString=".vhdx") returned 5 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".vhdx") returned 0x0 [0045.846] lstrlenW (lpString=".pst") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".pst") returned 0x0 [0045.846] lstrlenW (lpString=".ost") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".ost") returned 0x0 [0045.846] lstrlenW (lpString=".bak") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".bak") returned 0x0 [0045.846] lstrlenW (lpString=".bac") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".bac") returned 0x0 [0045.846] lstrlenW (lpString=".sys") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".sys") returned 0x0 [0045.846] lstrlenW (lpString=".v2i") returned 4 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".v2i") returned 0x0 [0045.846] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.847] lstrlenW (lpString=".sql") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".sql") returned 0x0 [0045.847] lstrlenW (lpString=".mdf") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".mdf") returned 0x0 [0045.847] lstrlenW (lpString=".txt") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".txt") returned 0x0 [0045.847] lstrlenW (lpString=".dbf") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".dbf") returned 0x0 [0045.847] lstrlenW (lpString=".ckp") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".ckp") returned 0x0 [0045.847] lstrlenW (lpString=".dacpac") returned 7 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".dacpac") returned 0x0 [0045.847] lstrlenW (lpString=".db3") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".db3") returned 0x0 [0045.847] lstrlenW (lpString=".dtxs") returned 5 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".dtxs") returned 0x0 [0045.847] lstrlenW (lpString=".mdt") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".mdt") returned 0x0 [0045.847] lstrlenW (lpString=".sdf") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".sdf") returned 0x0 [0045.847] lstrlenW (lpString=".MDF") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".MDF") returned 0x0 [0045.847] lstrlenW (lpString=".DBF") returned 4 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".DBF") returned 0x0 [0045.847] lstrlenW (lpString=".DB") returned 3 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".DB") returned 0x0 [0045.847] lstrlenW (lpString=".db") returned 3 [0045.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".db") returned 0x0 [0045.847] lstrlenW (lpString=".ndf") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".ndf") returned 0x0 [0045.848] lstrlenW (lpString=".NDF") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".NDF") returned 0x0 [0045.848] lstrlenW (lpString=".Mdf") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".Mdf") returned 0x0 [0045.848] lstrlenW (lpString=".dat") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".dat") returned 0x0 [0045.848] lstrlenW (lpString=".DAT") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".DAT") returned 0x0 [0045.848] lstrlenW (lpString=".ldf") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".ldf") returned 0x0 [0045.848] lstrlenW (lpString=".LDF") returned 4 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch=".LDF") returned 0x0 [0045.848] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.848] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.849] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.849] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16585023020) returned 1 [0045.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa2514b0, dwHighDateTime=0x1d585b4)) [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951c0 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951c0 | out: hHeap=0x260000) returned 1 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0045.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0045.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.850] GetLastError () returned 0x0 [0045.850] GetLastError () returned 0x0 [0045.850] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.850] GetLastError () returned 0x0 [0045.850] GetLastError () returned 0x0 [0045.851] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffdd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.851] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x22b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x22b, lpOverlapped=0x0) returned 1 [0045.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.851] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.851] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.851] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.851] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.852] CloseHandle (hObject=0xf8) returned 1 [0045.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.852] GetLastError () returned 0x0 [0045.852] RtlWakeConditionVariable () returned 0x27e828 [0045.853] GetCurrentThreadId () returned 0x99c [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.853] lstrlenW (lpString=".vhd") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.853] lstrlenW (lpString=".vhdx") returned 5 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.853] lstrlenW (lpString=".pst") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.853] lstrlenW (lpString=".ost") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.853] lstrlenW (lpString=".bak") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.853] lstrlenW (lpString=".bac") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.853] lstrlenW (lpString=".sys") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.853] lstrlenW (lpString=".v2i") returned 4 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.853] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.854] lstrlenW (lpString=".sql") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.854] lstrlenW (lpString=".mdf") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.854] lstrlenW (lpString=".txt") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.854] lstrlenW (lpString=".dbf") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.854] lstrlenW (lpString=".ckp") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.854] lstrlenW (lpString=".dacpac") returned 7 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.854] lstrlenW (lpString=".db3") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.854] lstrlenW (lpString=".dtxs") returned 5 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.854] lstrlenW (lpString=".mdt") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.854] lstrlenW (lpString=".sdf") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.854] lstrlenW (lpString=".MDF") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.854] lstrlenW (lpString=".DBF") returned 4 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.854] lstrlenW (lpString=".DB") returned 3 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.854] lstrlenW (lpString=".db") returned 3 [0045.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.855] lstrlenW (lpString=".ndf") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.855] lstrlenW (lpString=".NDF") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.855] lstrlenW (lpString=".Mdf") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.855] lstrlenW (lpString=".dat") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.855] lstrlenW (lpString=".DAT") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.855] lstrlenW (lpString=".ldf") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.855] lstrlenW (lpString=".LDF") returned 4 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.855] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.855] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.856] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.856] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.856] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16585713978) returned 1 [0045.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa2514b0, dwHighDateTime=0x1d585b4)) [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951f8 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0045.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0045.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.857] GetLastError () returned 0x0 [0045.857] GetLastError () returned 0x0 [0045.857] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.857] GetLastError () returned 0x0 [0045.857] GetLastError () returned 0x0 [0045.859] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff52f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.859] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xad0e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xad0e, lpOverlapped=0x0) returned 1 [0045.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.859] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.859] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.859] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.859] CloseHandle (hObject=0xf8) returned 1 [0045.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.860] GetLastError () returned 0x0 [0045.860] RtlWakeConditionVariable () returned 0x27e828 [0045.860] GetCurrentThreadId () returned 0x99c [0045.860] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.860] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.860] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.860] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.861] CloseHandle (hObject=0xf8) returned 1 [0045.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0045.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9440 | out: hHeap=0x260000) returned 1 [0045.861] RtlWakeConditionVariable () returned 0x27e828 [0045.862] GetCurrentThreadId () returned 0x99c [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".ldf") returned 0x0 [0045.862] lstrlenW (lpString=".vhd") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".vhd") returned 0x0 [0045.862] lstrlenW (lpString=".vhdx") returned 5 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".vhdx") returned 0x0 [0045.862] lstrlenW (lpString=".pst") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".pst") returned 0x0 [0045.862] lstrlenW (lpString=".ost") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".ost") returned 0x0 [0045.862] lstrlenW (lpString=".bak") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".bak") returned 0x0 [0045.862] lstrlenW (lpString=".bac") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".bac") returned 0x0 [0045.862] lstrlenW (lpString=".sys") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".sys") returned 0x0 [0045.862] lstrlenW (lpString=".v2i") returned 4 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".v2i") returned 0x0 [0045.862] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.863] lstrlenW (lpString=".sql") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".sql") returned 0x0 [0045.863] lstrlenW (lpString=".mdf") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".mdf") returned 0x0 [0045.863] lstrlenW (lpString=".txt") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".txt") returned 0x0 [0045.863] lstrlenW (lpString=".dbf") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".dbf") returned 0x0 [0045.863] lstrlenW (lpString=".ckp") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".ckp") returned 0x0 [0045.863] lstrlenW (lpString=".dacpac") returned 7 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".dacpac") returned 0x0 [0045.863] lstrlenW (lpString=".db3") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".db3") returned 0x0 [0045.863] lstrlenW (lpString=".dtxs") returned 5 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".dtxs") returned 0x0 [0045.863] lstrlenW (lpString=".mdt") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".mdt") returned 0x0 [0045.863] lstrlenW (lpString=".sdf") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".sdf") returned 0x0 [0045.863] lstrlenW (lpString=".MDF") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".MDF") returned 0x0 [0045.863] lstrlenW (lpString=".DBF") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".DBF") returned 0x0 [0045.863] lstrlenW (lpString=".DB") returned 3 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".DB") returned 0x0 [0045.863] lstrlenW (lpString=".db") returned 3 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".db") returned 0x0 [0045.863] lstrlenW (lpString=".ndf") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".ndf") returned 0x0 [0045.863] lstrlenW (lpString=".NDF") returned 4 [0045.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".NDF") returned 0x0 [0045.864] lstrlenW (lpString=".Mdf") returned 4 [0045.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".Mdf") returned 0x0 [0045.864] lstrlenW (lpString=".dat") returned 4 [0045.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".dat") returned 0x0 [0045.864] lstrlenW (lpString=".DAT") returned 4 [0045.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".DAT") returned 0x0 [0045.864] lstrlenW (lpString=".ldf") returned 4 [0045.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".ldf") returned 0x0 [0045.864] lstrlenW (lpString=".LDF") returned 4 [0045.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch=".LDF") returned 0x0 [0045.864] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.864] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.865] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.865] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.865] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16586629427) returned 1 [0045.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa277610, dwHighDateTime=0x1d585b4)) [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2950e0 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950e0 | out: hHeap=0x260000) returned 1 [0045.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0045.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3313a0 [0045.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0045.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.866] GetLastError () returned 0x0 [0045.866] GetLastError () returned 0x0 [0045.866] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.866] GetLastError () returned 0x0 [0045.866] GetLastError () returned 0x0 [0045.868] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe394, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.868] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1c6c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1c6c, lpOverlapped=0x0) returned 1 [0045.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.868] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.868] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.868] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.868] CloseHandle (hObject=0xf8) returned 1 [0045.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.869] GetLastError () returned 0x0 [0045.869] RtlWakeConditionVariable () returned 0x27e828 [0045.869] GetCurrentThreadId () returned 0x99c [0045.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.869] lstrlenW (lpString=".vhd") returned 4 [0045.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.870] lstrlenW (lpString=".vhdx") returned 5 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.870] lstrlenW (lpString=".pst") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.870] lstrlenW (lpString=".ost") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.870] lstrlenW (lpString=".bak") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.870] lstrlenW (lpString=".bac") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.870] lstrlenW (lpString=".sys") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.870] lstrlenW (lpString=".v2i") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.870] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.870] lstrlenW (lpString=".sql") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.870] lstrlenW (lpString=".mdf") returned 4 [0045.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.870] lstrlenW (lpString=".txt") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.871] lstrlenW (lpString=".dbf") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.871] lstrlenW (lpString=".ckp") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.871] lstrlenW (lpString=".dacpac") returned 7 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.871] lstrlenW (lpString=".db3") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.871] lstrlenW (lpString=".dtxs") returned 5 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.871] lstrlenW (lpString=".mdt") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.871] lstrlenW (lpString=".sdf") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.871] lstrlenW (lpString=".MDF") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.871] lstrlenW (lpString=".DBF") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.871] lstrlenW (lpString=".DB") returned 3 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.871] lstrlenW (lpString=".db") returned 3 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.871] lstrlenW (lpString=".ndf") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.871] lstrlenW (lpString=".NDF") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.871] lstrlenW (lpString=".Mdf") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.871] lstrlenW (lpString=".dat") returned 4 [0045.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.871] lstrlenW (lpString=".DAT") returned 4 [0045.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.872] lstrlenW (lpString=".ldf") returned 4 [0045.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.872] lstrlenW (lpString=".LDF") returned 4 [0045.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.872] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.872] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.873] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.873] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.873] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16587385442) returned 1 [0045.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa277610, dwHighDateTime=0x1d585b4)) [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c98 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a188 [0045.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a188 | out: hHeap=0x260000) returned 1 [0045.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.873] GetLastError () returned 0x0 [0045.873] GetLastError () returned 0x0 [0045.874] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.874] GetLastError () returned 0x0 [0045.874] GetLastError () returned 0x0 [0045.876] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff594, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.876] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa6c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xa6c, lpOverlapped=0x0) returned 1 [0045.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.877] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.877] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.877] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.877] CloseHandle (hObject=0xf8) returned 1 [0045.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.878] GetLastError () returned 0x0 [0045.878] RtlWakeConditionVariable () returned 0x27e828 [0045.878] GetCurrentThreadId () returned 0x99c [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.878] lstrlenW (lpString=".vhd") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.878] lstrlenW (lpString=".vhdx") returned 5 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.878] lstrlenW (lpString=".pst") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.878] lstrlenW (lpString=".ost") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.878] lstrlenW (lpString=".bak") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.878] lstrlenW (lpString=".bac") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.878] lstrlenW (lpString=".sys") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.878] lstrlenW (lpString=".v2i") returned 4 [0045.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.879] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.879] lstrlenW (lpString=".sql") returned 4 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.879] lstrlenW (lpString=".mdf") returned 4 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.879] lstrlenW (lpString=".txt") returned 4 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.879] lstrlenW (lpString=".dbf") returned 4 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.879] lstrlenW (lpString=".ckp") returned 4 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.879] lstrlenW (lpString=".dacpac") returned 7 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.879] lstrlenW (lpString=".db3") returned 4 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.879] lstrlenW (lpString=".dtxs") returned 5 [0045.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.879] lstrlenW (lpString=".mdt") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.880] lstrlenW (lpString=".sdf") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.880] lstrlenW (lpString=".MDF") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.880] lstrlenW (lpString=".DBF") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.880] lstrlenW (lpString=".DB") returned 3 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.880] lstrlenW (lpString=".db") returned 3 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.880] lstrlenW (lpString=".ndf") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.880] lstrlenW (lpString=".NDF") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.880] lstrlenW (lpString=".Mdf") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.880] lstrlenW (lpString=".dat") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.880] lstrlenW (lpString=".DAT") returned 4 [0045.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.881] lstrlenW (lpString=".ldf") returned 4 [0045.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.881] lstrlenW (lpString=".LDF") returned 4 [0045.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.881] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.881] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.882] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.882] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.882] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16588294333) returned 1 [0045.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa29d770, dwHighDateTime=0x1d585b4)) [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a380 [0045.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a380 | out: hHeap=0x260000) returned 1 [0045.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.882] GetLastError () returned 0x0 [0045.883] GetLastError () returned 0x0 [0045.883] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.883] GetLastError () returned 0x0 [0045.883] GetLastError () returned 0x0 [0045.885] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5a2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.885] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa5d5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xa5d5, lpOverlapped=0x0) returned 1 [0045.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.885] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.885] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.885] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.886] CloseHandle (hObject=0xf8) returned 1 [0045.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.888] GetLastError () returned 0x0 [0045.888] RtlWakeConditionVariable () returned 0x27e828 [0045.888] GetCurrentThreadId () returned 0x99c [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".ldf") returned 0x0 [0045.888] lstrlenW (lpString=".vhd") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".vhd") returned 0x0 [0045.888] lstrlenW (lpString=".vhdx") returned 5 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".vhdx") returned 0x0 [0045.888] lstrlenW (lpString=".pst") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".pst") returned 0x0 [0045.888] lstrlenW (lpString=".ost") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".ost") returned 0x0 [0045.888] lstrlenW (lpString=".bak") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".bak") returned 0x0 [0045.888] lstrlenW (lpString=".bac") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".bac") returned 0x0 [0045.888] lstrlenW (lpString=".sys") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".sys") returned 0x0 [0045.888] lstrlenW (lpString=".v2i") returned 4 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".v2i") returned 0x0 [0045.888] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.889] lstrlenW (lpString=".sql") returned 4 [0045.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".sql") returned 0x0 [0045.889] lstrlenW (lpString=".mdf") returned 4 [0045.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".mdf") returned 0x0 [0045.889] lstrlenW (lpString=".txt") returned 4 [0045.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".txt") returned 0x0 [0045.889] lstrlenW (lpString=".dbf") returned 4 [0045.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".dbf") returned 0x0 [0045.890] lstrlenW (lpString=".ckp") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".ckp") returned 0x0 [0045.890] lstrlenW (lpString=".dacpac") returned 7 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".dacpac") returned 0x0 [0045.890] lstrlenW (lpString=".db3") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".db3") returned 0x0 [0045.890] lstrlenW (lpString=".dtxs") returned 5 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".dtxs") returned 0x0 [0045.890] lstrlenW (lpString=".mdt") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".mdt") returned 0x0 [0045.890] lstrlenW (lpString=".sdf") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".sdf") returned 0x0 [0045.890] lstrlenW (lpString=".MDF") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".MDF") returned 0x0 [0045.890] lstrlenW (lpString=".DBF") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".DBF") returned 0x0 [0045.890] lstrlenW (lpString=".DB") returned 3 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".DB") returned 0x0 [0045.890] lstrlenW (lpString=".db") returned 3 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".db") returned 0x0 [0045.890] lstrlenW (lpString=".ndf") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".ndf") returned 0x0 [0045.890] lstrlenW (lpString=".NDF") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".NDF") returned 0x0 [0045.890] lstrlenW (lpString=".Mdf") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".Mdf") returned 0x0 [0045.890] lstrlenW (lpString=".dat") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".dat") returned 0x0 [0045.890] lstrlenW (lpString=".DAT") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".DAT") returned 0x0 [0045.890] lstrlenW (lpString=".ldf") returned 4 [0045.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".ldf") returned 0x0 [0045.890] lstrlenW (lpString=".LDF") returned 4 [0045.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch=".LDF") returned 0x0 [0045.891] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.891] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0045.891] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.891] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.892] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16589268378) returned 1 [0045.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa29d770, dwHighDateTime=0x1d585b4)) [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a428 [0045.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a428 | out: hHeap=0x260000) returned 1 [0045.892] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0045.892] GetLastError () returned 0x0 [0045.892] GetLastError () returned 0x0 [0045.892] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0045.892] GetLastError () returned 0x0 [0045.893] GetLastError () returned 0x0 [0045.946] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffefe34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.946] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x101cc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x101cc, lpOverlapped=0x0) returned 1 [0045.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.965] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.965] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.965] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.965] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.965] CloseHandle (hObject=0xf8) returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.[deadmin@cock.li].deadmin")) returned 1 [0046.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.040] GetLastError () returned 0x0 [0046.040] RtlWakeConditionVariable () returned 0x27e828 [0046.040] GetCurrentThreadId () returned 0x99c [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".ldf") returned 0x0 [0046.040] lstrlenW (lpString=".vhd") returned 4 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".vhd") returned 0x0 [0046.040] lstrlenW (lpString=".vhdx") returned 5 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".vhdx") returned 0x0 [0046.040] lstrlenW (lpString=".pst") returned 4 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".pst") returned 0x0 [0046.040] lstrlenW (lpString=".ost") returned 4 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".ost") returned 0x0 [0046.040] lstrlenW (lpString=".bak") returned 4 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".bak") returned 0x0 [0046.040] lstrlenW (lpString=".bac") returned 4 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".bac") returned 0x0 [0046.040] lstrlenW (lpString=".sys") returned 4 [0046.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".sys") returned 0x0 [0046.041] lstrlenW (lpString=".v2i") returned 4 [0046.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".v2i") returned 0x0 [0046.044] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0046.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.048] lstrlenW (lpString=".sql") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".sql") returned 0x0 [0046.048] lstrlenW (lpString=".mdf") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".mdf") returned 0x0 [0046.048] lstrlenW (lpString=".txt") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".txt") returned 0x0 [0046.048] lstrlenW (lpString=".dbf") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".dbf") returned 0x0 [0046.048] lstrlenW (lpString=".ckp") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".ckp") returned 0x0 [0046.048] lstrlenW (lpString=".dacpac") returned 7 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".dacpac") returned 0x0 [0046.048] lstrlenW (lpString=".db3") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".db3") returned 0x0 [0046.048] lstrlenW (lpString=".dtxs") returned 5 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".dtxs") returned 0x0 [0046.048] lstrlenW (lpString=".mdt") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".mdt") returned 0x0 [0046.048] lstrlenW (lpString=".sdf") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".sdf") returned 0x0 [0046.048] lstrlenW (lpString=".MDF") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".MDF") returned 0x0 [0046.048] lstrlenW (lpString=".DBF") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".DBF") returned 0x0 [0046.048] lstrlenW (lpString=".DB") returned 3 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".DB") returned 0x0 [0046.048] lstrlenW (lpString=".db") returned 3 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".db") returned 0x0 [0046.048] lstrlenW (lpString=".ndf") returned 4 [0046.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".ndf") returned 0x0 [0046.048] lstrlenW (lpString=".NDF") returned 4 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".NDF") returned 0x0 [0046.049] lstrlenW (lpString=".Mdf") returned 4 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".Mdf") returned 0x0 [0046.049] lstrlenW (lpString=".dat") returned 4 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".dat") returned 0x0 [0046.049] lstrlenW (lpString=".DAT") returned 4 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".DAT") returned 0x0 [0046.049] lstrlenW (lpString=".ldf") returned 4 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".ldf") returned 0x0 [0046.049] lstrlenW (lpString=".LDF") returned 4 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch=".LDF") returned 0x0 [0046.049] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.049] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.050] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.050] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16605100125) returned 1 [0046.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa41a530, dwHighDateTime=0x1d585b4)) [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5b80 [0046.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5b80 | out: hHeap=0x260000) returned 1 [0046.050] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.050] GetLastError () returned 0x0 [0046.051] GetLastError () returned 0x0 [0046.051] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.051] GetLastError () returned 0x0 [0046.051] GetLastError () returned 0x0 [0046.055] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.055] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.057] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.057] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.058] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.058] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.059] CloseHandle (hObject=0xfc) returned 1 [0046.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.[deadmin@cock.li].deadmin")) returned 1 [0046.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.059] GetLastError () returned 0x0 [0046.059] RtlWakeConditionVariable () returned 0x27e828 [0046.059] GetCurrentThreadId () returned 0x99c [0046.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".ldf") returned 0x0 [0046.059] lstrlenW (lpString=".vhd") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".vhd") returned 0x0 [0046.060] lstrlenW (lpString=".vhdx") returned 5 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".vhdx") returned 0x0 [0046.060] lstrlenW (lpString=".pst") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".pst") returned 0x0 [0046.060] lstrlenW (lpString=".ost") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".ost") returned 0x0 [0046.060] lstrlenW (lpString=".bak") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".bak") returned 0x0 [0046.060] lstrlenW (lpString=".bac") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".bac") returned 0x0 [0046.060] lstrlenW (lpString=".sys") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".sys") returned 0x0 [0046.060] lstrlenW (lpString=".v2i") returned 4 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".v2i") returned 0x0 [0046.060] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch="s\r\n.v2i") returned 0x0 [0046.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.061] lstrlenW (lpString=".sql") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".sql") returned 0x0 [0046.061] lstrlenW (lpString=".mdf") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".mdf") returned 0x0 [0046.061] lstrlenW (lpString=".txt") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".txt") returned 0x0 [0046.061] lstrlenW (lpString=".dbf") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".dbf") returned 0x0 [0046.061] lstrlenW (lpString=".ckp") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".ckp") returned 0x0 [0046.061] lstrlenW (lpString=".dacpac") returned 7 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".dacpac") returned 0x0 [0046.061] lstrlenW (lpString=".db3") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".db3") returned 0x0 [0046.061] lstrlenW (lpString=".dtxs") returned 5 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".dtxs") returned 0x0 [0046.061] lstrlenW (lpString=".mdt") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".mdt") returned 0x0 [0046.061] lstrlenW (lpString=".sdf") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".sdf") returned 0x0 [0046.061] lstrlenW (lpString=".MDF") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".MDF") returned 0x0 [0046.061] lstrlenW (lpString=".DBF") returned 4 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".DBF") returned 0x0 [0046.061] lstrlenW (lpString=".DB") returned 3 [0046.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".DB") returned 0x0 [0046.061] lstrlenW (lpString=".db") returned 3 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".db") returned 0x0 [0046.062] lstrlenW (lpString=".ndf") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".ndf") returned 0x0 [0046.062] lstrlenW (lpString=".NDF") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".NDF") returned 0x0 [0046.062] lstrlenW (lpString=".Mdf") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".Mdf") returned 0x0 [0046.062] lstrlenW (lpString=".dat") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".dat") returned 0x0 [0046.062] lstrlenW (lpString=".DAT") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".DAT") returned 0x0 [0046.062] lstrlenW (lpString=".ldf") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".ldf") returned 0x0 [0046.062] lstrlenW (lpString=".LDF") returned 4 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch=".LDF") returned 0x0 [0046.062] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.062] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.063] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.063] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.063] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16606439464) returned 1 [0046.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa440690, dwHighDateTime=0x1d585b4)) [0046.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0046.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0046.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aa10 [0046.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aa10 | out: hHeap=0x260000) returned 1 [0046.064] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.064] GetLastError () returned 0x0 [0046.064] GetLastError () returned 0x0 [0046.064] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.064] GetLastError () returned 0x0 [0046.064] GetLastError () returned 0x0 [0046.067] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.068] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.069] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.069] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.072] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.072] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.072] CloseHandle (hObject=0xfc) returned 1 [0046.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.[deadmin@cock.li].deadmin")) returned 1 [0046.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.073] GetLastError () returned 0x0 [0046.073] RtlWakeConditionVariable () returned 0x27e828 [0046.073] GetCurrentThreadId () returned 0x99c [0046.073] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.073] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.073] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.073] WriteFile (in: hFile=0xfc, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.074] CloseHandle (hObject=0xfc) returned 1 [0046.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f99b8 | out: hHeap=0x260000) returned 1 [0046.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9440 | out: hHeap=0x260000) returned 1 [0046.074] RtlWakeConditionVariable () returned 0x27e828 [0046.074] GetCurrentThreadId () returned 0x99c [0046.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".ldf") returned 0x0 [0046.074] lstrlenW (lpString=".vhd") returned 4 [0046.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".vhd") returned 0x0 [0046.074] lstrlenW (lpString=".vhdx") returned 5 [0046.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".vhdx") returned 0x0 [0046.074] lstrlenW (lpString=".pst") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".pst") returned 0x0 [0046.075] lstrlenW (lpString=".ost") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".ost") returned 0x0 [0046.075] lstrlenW (lpString=".bak") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".bak") returned 0x0 [0046.075] lstrlenW (lpString=".bac") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".bac") returned 0x0 [0046.075] lstrlenW (lpString=".sys") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".sys") returned 0x0 [0046.075] lstrlenW (lpString=".v2i") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".v2i") returned 0x0 [0046.075] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.075] lstrlenW (lpString=".sql") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".sql") returned 0x0 [0046.075] lstrlenW (lpString=".mdf") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".mdf") returned 0x0 [0046.075] lstrlenW (lpString=".txt") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".txt") returned 0x0 [0046.075] lstrlenW (lpString=".dbf") returned 4 [0046.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".dbf") returned 0x0 [0046.075] lstrlenW (lpString=".ckp") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".ckp") returned 0x0 [0046.076] lstrlenW (lpString=".dacpac") returned 7 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".dacpac") returned 0x0 [0046.076] lstrlenW (lpString=".db3") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".db3") returned 0x0 [0046.076] lstrlenW (lpString=".dtxs") returned 5 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".dtxs") returned 0x0 [0046.076] lstrlenW (lpString=".mdt") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".mdt") returned 0x0 [0046.076] lstrlenW (lpString=".sdf") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".sdf") returned 0x0 [0046.076] lstrlenW (lpString=".MDF") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".MDF") returned 0x0 [0046.076] lstrlenW (lpString=".DBF") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".DBF") returned 0x0 [0046.076] lstrlenW (lpString=".DB") returned 3 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".DB") returned 0x0 [0046.076] lstrlenW (lpString=".db") returned 3 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".db") returned 0x0 [0046.076] lstrlenW (lpString=".ndf") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".ndf") returned 0x0 [0046.076] lstrlenW (lpString=".NDF") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".NDF") returned 0x0 [0046.076] lstrlenW (lpString=".Mdf") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".Mdf") returned 0x0 [0046.076] lstrlenW (lpString=".dat") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".dat") returned 0x0 [0046.076] lstrlenW (lpString=".DAT") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".DAT") returned 0x0 [0046.076] lstrlenW (lpString=".ldf") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".ldf") returned 0x0 [0046.076] lstrlenW (lpString=".LDF") returned 4 [0046.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch=".LDF") returned 0x0 [0046.077] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.077] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.077] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.077] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.078] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16607867663) returned 1 [0046.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa4667f0, dwHighDateTime=0x1d585b4)) [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1918 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1918 | out: hHeap=0x260000) returned 1 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0046.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0046.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.078] GetLastError () returned 0x0 [0046.078] GetLastError () returned 0x0 [0046.078] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.078] GetLastError () returned 0x0 [0046.078] GetLastError () returned 0x0 [0046.081] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.081] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.082] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.082] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.083] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.083] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.083] CloseHandle (hObject=0xfc) returned 1 [0046.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.084] GetLastError () returned 0x0 [0046.084] RtlWakeConditionVariable () returned 0x27e828 [0046.084] GetCurrentThreadId () returned 0x99c [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".ldf") returned 0x0 [0046.084] lstrlenW (lpString=".vhd") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".vhd") returned 0x0 [0046.084] lstrlenW (lpString=".vhdx") returned 5 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".vhdx") returned 0x0 [0046.084] lstrlenW (lpString=".pst") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".pst") returned 0x0 [0046.084] lstrlenW (lpString=".ost") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".ost") returned 0x0 [0046.084] lstrlenW (lpString=".bak") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".bak") returned 0x0 [0046.084] lstrlenW (lpString=".bac") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".bac") returned 0x0 [0046.084] lstrlenW (lpString=".sys") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".sys") returned 0x0 [0046.084] lstrlenW (lpString=".v2i") returned 4 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".v2i") returned 0x0 [0046.084] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0046.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.085] lstrlenW (lpString=".sql") returned 4 [0046.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".sql") returned 0x0 [0046.085] lstrlenW (lpString=".mdf") returned 4 [0046.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".mdf") returned 0x0 [0046.085] lstrlenW (lpString=".txt") returned 4 [0046.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".txt") returned 0x0 [0046.086] lstrlenW (lpString=".dbf") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".dbf") returned 0x0 [0046.086] lstrlenW (lpString=".ckp") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".ckp") returned 0x0 [0046.086] lstrlenW (lpString=".dacpac") returned 7 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".dacpac") returned 0x0 [0046.086] lstrlenW (lpString=".db3") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".db3") returned 0x0 [0046.086] lstrlenW (lpString=".dtxs") returned 5 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".dtxs") returned 0x0 [0046.086] lstrlenW (lpString=".mdt") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".mdt") returned 0x0 [0046.086] lstrlenW (lpString=".sdf") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".sdf") returned 0x0 [0046.086] lstrlenW (lpString=".MDF") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".MDF") returned 0x0 [0046.086] lstrlenW (lpString=".DBF") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".DBF") returned 0x0 [0046.086] lstrlenW (lpString=".DB") returned 3 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".DB") returned 0x0 [0046.086] lstrlenW (lpString=".db") returned 3 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".db") returned 0x0 [0046.086] lstrlenW (lpString=".ndf") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".ndf") returned 0x0 [0046.086] lstrlenW (lpString=".NDF") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".NDF") returned 0x0 [0046.086] lstrlenW (lpString=".Mdf") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".Mdf") returned 0x0 [0046.086] lstrlenW (lpString=".dat") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".dat") returned 0x0 [0046.086] lstrlenW (lpString=".DAT") returned 4 [0046.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".DAT") returned 0x0 [0046.086] lstrlenW (lpString=".ldf") returned 4 [0046.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".ldf") returned 0x0 [0046.087] lstrlenW (lpString=".LDF") returned 4 [0046.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch=".LDF") returned 0x0 [0046.087] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.087] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.088] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.088] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.088] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16608880649) returned 1 [0046.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa48c950, dwHighDateTime=0x1d585b4)) [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0046.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0046.088] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.088] GetLastError () returned 0x0 [0046.088] GetLastError () returned 0x0 [0046.088] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.089] GetLastError () returned 0x0 [0046.089] GetLastError () returned 0x0 [0046.092] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.092] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.093] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.093] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.095] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.095] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.095] CloseHandle (hObject=0xfc) returned 1 [0046.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.[deadmin@cock.li].deadmin")) returned 1 [0046.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.095] GetLastError () returned 0x0 [0046.096] RtlWakeConditionVariable () returned 0x27e828 [0046.096] GetCurrentThreadId () returned 0x99c [0046.097] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.097] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.097] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.097] WriteFile (in: hFile=0xfc, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.098] CloseHandle (hObject=0xfc) returned 1 [0046.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9a80 | out: hHeap=0x260000) returned 1 [0046.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.099] RtlWakeConditionVariable () returned 0x27e828 [0046.099] GetCurrentThreadId () returned 0x99c [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".ldf") returned 0x0 [0046.099] lstrlenW (lpString=".vhd") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".vhd") returned 0x0 [0046.099] lstrlenW (lpString=".vhdx") returned 5 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".vhdx") returned 0x0 [0046.099] lstrlenW (lpString=".pst") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".pst") returned 0x0 [0046.099] lstrlenW (lpString=".ost") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".ost") returned 0x0 [0046.099] lstrlenW (lpString=".bak") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".bak") returned 0x0 [0046.099] lstrlenW (lpString=".bac") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".bac") returned 0x0 [0046.099] lstrlenW (lpString=".sys") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".sys") returned 0x0 [0046.099] lstrlenW (lpString=".v2i") returned 4 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".v2i") returned 0x0 [0046.099] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0046.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.100] lstrlenW (lpString=".sql") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".sql") returned 0x0 [0046.100] lstrlenW (lpString=".mdf") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".mdf") returned 0x0 [0046.100] lstrlenW (lpString=".txt") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".txt") returned 0x0 [0046.100] lstrlenW (lpString=".dbf") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".dbf") returned 0x0 [0046.100] lstrlenW (lpString=".ckp") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".ckp") returned 0x0 [0046.100] lstrlenW (lpString=".dacpac") returned 7 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".dacpac") returned 0x0 [0046.100] lstrlenW (lpString=".db3") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".db3") returned 0x0 [0046.100] lstrlenW (lpString=".dtxs") returned 5 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".dtxs") returned 0x0 [0046.100] lstrlenW (lpString=".mdt") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".mdt") returned 0x0 [0046.100] lstrlenW (lpString=".sdf") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".sdf") returned 0x0 [0046.100] lstrlenW (lpString=".MDF") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".MDF") returned 0x0 [0046.100] lstrlenW (lpString=".DBF") returned 4 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".DBF") returned 0x0 [0046.100] lstrlenW (lpString=".DB") returned 3 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".DB") returned 0x0 [0046.100] lstrlenW (lpString=".db") returned 3 [0046.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".db") returned 0x0 [0046.100] lstrlenW (lpString=".ndf") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".ndf") returned 0x0 [0046.101] lstrlenW (lpString=".NDF") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".NDF") returned 0x0 [0046.101] lstrlenW (lpString=".Mdf") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".Mdf") returned 0x0 [0046.101] lstrlenW (lpString=".dat") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".dat") returned 0x0 [0046.101] lstrlenW (lpString=".DAT") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".DAT") returned 0x0 [0046.101] lstrlenW (lpString=".ldf") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".ldf") returned 0x0 [0046.101] lstrlenW (lpString=".LDF") returned 4 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch=".LDF") returned 0x0 [0046.101] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.101] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.102] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.102] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.102] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16610306136) returned 1 [0046.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa4b2ab0, dwHighDateTime=0x1d585b4)) [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299948 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ab60 [0046.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331c88 [0046.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ab60 | out: hHeap=0x260000) returned 1 [0046.102] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.103] GetLastError () returned 0x0 [0046.103] GetLastError () returned 0x0 [0046.103] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.103] GetLastError () returned 0x0 [0046.103] GetLastError () returned 0x0 [0046.106] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.106] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.106] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.106] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.110] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.110] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.110] CloseHandle (hObject=0xfc) returned 1 [0046.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.[deadmin@cock.li].deadmin")) returned 1 [0046.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.111] GetLastError () returned 0x0 [0046.111] RtlWakeConditionVariable () returned 0x27e828 [0046.111] GetCurrentThreadId () returned 0x99c [0046.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".ldf") returned 0x0 [0046.111] lstrlenW (lpString=".vhd") returned 4 [0046.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".vhd") returned 0x0 [0046.111] lstrlenW (lpString=".vhdx") returned 5 [0046.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".vhdx") returned 0x0 [0046.111] lstrlenW (lpString=".pst") returned 4 [0046.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".pst") returned 0x0 [0046.111] lstrlenW (lpString=".ost") returned 4 [0046.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".ost") returned 0x0 [0046.111] lstrlenW (lpString=".bak") returned 4 [0046.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".bak") returned 0x0 [0046.111] lstrlenW (lpString=".bac") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".bac") returned 0x0 [0046.112] lstrlenW (lpString=".sys") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".sys") returned 0x0 [0046.112] lstrlenW (lpString=".v2i") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".v2i") returned 0x0 [0046.112] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0046.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.112] lstrlenW (lpString=".sql") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".sql") returned 0x0 [0046.112] lstrlenW (lpString=".mdf") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".mdf") returned 0x0 [0046.112] lstrlenW (lpString=".txt") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".txt") returned 0x0 [0046.112] lstrlenW (lpString=".dbf") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".dbf") returned 0x0 [0046.112] lstrlenW (lpString=".ckp") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".ckp") returned 0x0 [0046.112] lstrlenW (lpString=".dacpac") returned 7 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".dacpac") returned 0x0 [0046.112] lstrlenW (lpString=".db3") returned 4 [0046.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".db3") returned 0x0 [0046.112] lstrlenW (lpString=".dtxs") returned 5 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".dtxs") returned 0x0 [0046.113] lstrlenW (lpString=".mdt") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".mdt") returned 0x0 [0046.113] lstrlenW (lpString=".sdf") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".sdf") returned 0x0 [0046.113] lstrlenW (lpString=".MDF") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".MDF") returned 0x0 [0046.113] lstrlenW (lpString=".DBF") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".DBF") returned 0x0 [0046.113] lstrlenW (lpString=".DB") returned 3 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".DB") returned 0x0 [0046.113] lstrlenW (lpString=".db") returned 3 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".db") returned 0x0 [0046.113] lstrlenW (lpString=".ndf") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".ndf") returned 0x0 [0046.113] lstrlenW (lpString=".NDF") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".NDF") returned 0x0 [0046.113] lstrlenW (lpString=".Mdf") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".Mdf") returned 0x0 [0046.113] lstrlenW (lpString=".dat") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".dat") returned 0x0 [0046.113] lstrlenW (lpString=".DAT") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".DAT") returned 0x0 [0046.113] lstrlenW (lpString=".ldf") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".ldf") returned 0x0 [0046.113] lstrlenW (lpString=".LDF") returned 4 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch=".LDF") returned 0x0 [0046.113] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.113] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.114] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.114] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.115] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16611564537) returned 1 [0046.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa4d8c10, dwHighDateTime=0x1d585b4)) [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295380 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295380 | out: hHeap=0x260000) returned 1 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ac08 [0046.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ac08 | out: hHeap=0x260000) returned 1 [0046.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.115] GetLastError () returned 0x0 [0046.115] GetLastError () returned 0x0 [0046.115] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.115] GetLastError () returned 0x0 [0046.116] GetLastError () returned 0x0 [0046.117] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.117] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x600, lpOverlapped=0x0) returned 1 [0046.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.118] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.118] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.118] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.118] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.118] CloseHandle (hObject=0xfc) returned 1 [0046.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.118] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.[deadmin@cock.li].deadmin")) returned 1 [0046.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.119] GetLastError () returned 0x0 [0046.119] RtlWakeConditionVariable () returned 0x27e828 [0046.119] GetCurrentThreadId () returned 0x99c [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".ldf") returned 0x0 [0046.119] lstrlenW (lpString=".vhd") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".vhd") returned 0x0 [0046.119] lstrlenW (lpString=".vhdx") returned 5 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".vhdx") returned 0x0 [0046.119] lstrlenW (lpString=".pst") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".pst") returned 0x0 [0046.119] lstrlenW (lpString=".ost") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".ost") returned 0x0 [0046.119] lstrlenW (lpString=".bak") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".bak") returned 0x0 [0046.119] lstrlenW (lpString=".bac") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".bac") returned 0x0 [0046.119] lstrlenW (lpString=".sys") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".sys") returned 0x0 [0046.119] lstrlenW (lpString=".v2i") returned 4 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".v2i") returned 0x0 [0046.119] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0046.120] lstrlenW (lpString=".sql") returned 4 [0046.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".sql") returned 0x0 [0046.120] lstrlenW (lpString=".mdf") returned 4 [0046.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".mdf") returned 0x0 [0046.120] lstrlenW (lpString=".txt") returned 4 [0046.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".txt") returned 0x0 [0046.120] lstrlenW (lpString=".dbf") returned 4 [0046.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".dbf") returned 0x0 [0046.120] lstrlenW (lpString=".ckp") returned 4 [0046.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".ckp") returned 0x0 [0046.121] lstrlenW (lpString=".dacpac") returned 7 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".dacpac") returned 0x0 [0046.121] lstrlenW (lpString=".db3") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".db3") returned 0x0 [0046.121] lstrlenW (lpString=".dtxs") returned 5 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".dtxs") returned 0x0 [0046.121] lstrlenW (lpString=".mdt") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".mdt") returned 0x0 [0046.121] lstrlenW (lpString=".sdf") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".sdf") returned 0x0 [0046.121] lstrlenW (lpString=".MDF") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".MDF") returned 0x0 [0046.121] lstrlenW (lpString=".DBF") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".DBF") returned 0x0 [0046.121] lstrlenW (lpString=".DB") returned 3 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".DB") returned 0x0 [0046.121] lstrlenW (lpString=".db") returned 3 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".db") returned 0x0 [0046.121] lstrlenW (lpString=".ndf") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".ndf") returned 0x0 [0046.121] lstrlenW (lpString=".NDF") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".NDF") returned 0x0 [0046.121] lstrlenW (lpString=".Mdf") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".Mdf") returned 0x0 [0046.121] lstrlenW (lpString=".dat") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".dat") returned 0x0 [0046.121] lstrlenW (lpString=".DAT") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".DAT") returned 0x0 [0046.121] lstrlenW (lpString=".ldf") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".ldf") returned 0x0 [0046.121] lstrlenW (lpString=".LDF") returned 4 [0046.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch=".LDF") returned 0x0 [0046.122] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0046.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.122] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3351e0) returned 1 [0046.122] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.122] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0046.123] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16612365543) returned 1 [0046.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa4d8c10, dwHighDateTime=0x1d585b4)) [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953b8 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953b8 | out: hHeap=0x260000) returned 1 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ad58 [0046.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ad58 | out: hHeap=0x260000) returned 1 [0046.123] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.123] GetLastError () returned 0x0 [0046.123] GetLastError () returned 0x0 [0046.123] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.123] GetLastError () returned 0x0 [0046.123] GetLastError () returned 0x0 [0046.203] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.204] WriteFile (in: hFile=0xfc, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.204] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.204] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.204] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.204] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.204] CloseHandle (hObject=0xfc) returned 1 [0046.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.205] GetLastError () returned 0x0 [0046.205] RtlWakeConditionVariable () returned 0x27e828 [0046.205] GetCurrentThreadId () returned 0x99c [0046.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".ldf") returned 0x0 [0046.205] lstrlenW (lpString=".vhd") returned 4 [0046.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".vhd") returned 0x0 [0046.205] lstrlenW (lpString=".vhdx") returned 5 [0046.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".vhdx") returned 0x0 [0046.205] lstrlenW (lpString=".pst") returned 4 [0046.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".pst") returned 0x0 [0046.205] lstrlenW (lpString=".ost") returned 4 [0046.205] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".ost") returned 0x0 [0046.206] lstrlenW (lpString=".bak") returned 4 [0046.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".bak") returned 0x0 [0046.206] lstrlenW (lpString=".bac") returned 4 [0046.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".bac") returned 0x0 [0046.206] lstrlenW (lpString=".sys") returned 4 [0046.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".sys") returned 0x0 [0046.206] lstrlenW (lpString=".v2i") returned 4 [0046.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".v2i") returned 0x0 [0046.206] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.206] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.223] lstrlenW (lpString=".sql") returned 4 [0046.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".sql") returned 0x0 [0046.223] lstrlenW (lpString=".mdf") returned 4 [0046.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".mdf") returned 0x0 [0046.223] lstrlenW (lpString=".txt") returned 4 [0046.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".txt") returned 0x0 [0046.223] lstrlenW (lpString=".dbf") returned 4 [0046.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".dbf") returned 0x0 [0046.223] lstrlenW (lpString=".ckp") returned 4 [0046.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".ckp") returned 0x0 [0046.224] lstrlenW (lpString=".dacpac") returned 7 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".dacpac") returned 0x0 [0046.224] lstrlenW (lpString=".db3") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".db3") returned 0x0 [0046.224] lstrlenW (lpString=".dtxs") returned 5 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".dtxs") returned 0x0 [0046.224] lstrlenW (lpString=".mdt") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".mdt") returned 0x0 [0046.224] lstrlenW (lpString=".sdf") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".sdf") returned 0x0 [0046.224] lstrlenW (lpString=".MDF") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".MDF") returned 0x0 [0046.224] lstrlenW (lpString=".DBF") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".DBF") returned 0x0 [0046.224] lstrlenW (lpString=".DB") returned 3 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".DB") returned 0x0 [0046.224] lstrlenW (lpString=".db") returned 3 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".db") returned 0x0 [0046.224] lstrlenW (lpString=".ndf") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".ndf") returned 0x0 [0046.224] lstrlenW (lpString=".NDF") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".NDF") returned 0x0 [0046.224] lstrlenW (lpString=".Mdf") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".Mdf") returned 0x0 [0046.224] lstrlenW (lpString=".dat") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".dat") returned 0x0 [0046.224] lstrlenW (lpString=".DAT") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".DAT") returned 0x0 [0046.224] lstrlenW (lpString=".ldf") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".ldf") returned 0x0 [0046.224] lstrlenW (lpString=".LDF") returned 4 [0046.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch=".LDF") returned 0x0 [0046.224] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.225] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.225] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.225] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0046.226] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16622666733) returned 1 [0046.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa5e35b0, dwHighDateTime=0x1d585b4)) [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299948 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0046.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0046.226] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.226] GetLastError () returned 0x0 [0046.226] GetLastError () returned 0x0 [0046.226] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.226] GetLastError () returned 0x0 [0046.227] GetLastError () returned 0x0 [0046.230] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff1d56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.230] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xe2aa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0xe2aa, lpOverlapped=0x0) returned 1 [0046.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.230] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.230] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.231] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.231] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.231] CloseHandle (hObject=0x100) returned 1 [0046.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.232] GetLastError () returned 0x0 [0046.232] RtlWakeConditionVariable () returned 0x27e828 [0046.232] GetCurrentThreadId () returned 0x99c [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".ldf") returned 0x0 [0046.232] lstrlenW (lpString=".vhd") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".vhd") returned 0x0 [0046.232] lstrlenW (lpString=".vhdx") returned 5 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".vhdx") returned 0x0 [0046.232] lstrlenW (lpString=".pst") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".pst") returned 0x0 [0046.232] lstrlenW (lpString=".ost") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".ost") returned 0x0 [0046.232] lstrlenW (lpString=".bak") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".bak") returned 0x0 [0046.232] lstrlenW (lpString=".bac") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".bac") returned 0x0 [0046.232] lstrlenW (lpString=".sys") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".sys") returned 0x0 [0046.232] lstrlenW (lpString=".v2i") returned 4 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".v2i") returned 0x0 [0046.232] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.233] lstrlenW (lpString=".sql") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".sql") returned 0x0 [0046.233] lstrlenW (lpString=".mdf") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".mdf") returned 0x0 [0046.233] lstrlenW (lpString=".txt") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".txt") returned 0x0 [0046.233] lstrlenW (lpString=".dbf") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".dbf") returned 0x0 [0046.233] lstrlenW (lpString=".ckp") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".ckp") returned 0x0 [0046.233] lstrlenW (lpString=".dacpac") returned 7 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".dacpac") returned 0x0 [0046.233] lstrlenW (lpString=".db3") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".db3") returned 0x0 [0046.233] lstrlenW (lpString=".dtxs") returned 5 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".dtxs") returned 0x0 [0046.233] lstrlenW (lpString=".mdt") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".mdt") returned 0x0 [0046.233] lstrlenW (lpString=".sdf") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".sdf") returned 0x0 [0046.233] lstrlenW (lpString=".MDF") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".MDF") returned 0x0 [0046.233] lstrlenW (lpString=".DBF") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".DBF") returned 0x0 [0046.233] lstrlenW (lpString=".DB") returned 3 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".DB") returned 0x0 [0046.233] lstrlenW (lpString=".db") returned 3 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".db") returned 0x0 [0046.233] lstrlenW (lpString=".ndf") returned 4 [0046.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".ndf") returned 0x0 [0046.233] lstrlenW (lpString=".NDF") returned 4 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".NDF") returned 0x0 [0046.234] lstrlenW (lpString=".Mdf") returned 4 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".Mdf") returned 0x0 [0046.234] lstrlenW (lpString=".dat") returned 4 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".dat") returned 0x0 [0046.234] lstrlenW (lpString=".DAT") returned 4 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".DAT") returned 0x0 [0046.234] lstrlenW (lpString=".ldf") returned 4 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".ldf") returned 0x0 [0046.234] lstrlenW (lpString=".LDF") returned 4 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch=".LDF") returned 0x0 [0046.234] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.234] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.235] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.235] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0046.235] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16623603990) returned 1 [0046.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa5e35b0, dwHighDateTime=0x1d585b4)) [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7470 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b340 [0046.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b340 | out: hHeap=0x260000) returned 1 [0046.235] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.236] GetLastError () returned 0x0 [0046.236] GetLastError () returned 0x0 [0046.236] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.236] GetLastError () returned 0x0 [0046.236] GetLastError () returned 0x0 [0046.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.240] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.240] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.240] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.240] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.240] CloseHandle (hObject=0x100) returned 1 [0046.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.241] GetLastError () returned 0x0 [0046.241] RtlWakeConditionVariable () returned 0x27e828 [0046.241] GetCurrentThreadId () returned 0x99c [0046.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".ldf") returned 0x0 [0046.241] lstrlenW (lpString=".vhd") returned 4 [0046.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".vhd") returned 0x0 [0046.241] lstrlenW (lpString=".vhdx") returned 5 [0046.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".vhdx") returned 0x0 [0046.241] lstrlenW (lpString=".pst") returned 4 [0046.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".pst") returned 0x0 [0046.241] lstrlenW (lpString=".ost") returned 4 [0046.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".ost") returned 0x0 [0046.242] lstrlenW (lpString=".bak") returned 4 [0046.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".bak") returned 0x0 [0046.242] lstrlenW (lpString=".bac") returned 4 [0046.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".bac") returned 0x0 [0046.242] lstrlenW (lpString=".sys") returned 4 [0046.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".sys") returned 0x0 [0046.242] lstrlenW (lpString=".v2i") returned 4 [0046.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".v2i") returned 0x0 [0046.242] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.243] lstrlenW (lpString=".sql") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".sql") returned 0x0 [0046.243] lstrlenW (lpString=".mdf") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".mdf") returned 0x0 [0046.243] lstrlenW (lpString=".txt") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".txt") returned 0x0 [0046.243] lstrlenW (lpString=".dbf") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".dbf") returned 0x0 [0046.243] lstrlenW (lpString=".ckp") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".ckp") returned 0x0 [0046.243] lstrlenW (lpString=".dacpac") returned 7 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".dacpac") returned 0x0 [0046.243] lstrlenW (lpString=".db3") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".db3") returned 0x0 [0046.243] lstrlenW (lpString=".dtxs") returned 5 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".dtxs") returned 0x0 [0046.243] lstrlenW (lpString=".mdt") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".mdt") returned 0x0 [0046.243] lstrlenW (lpString=".sdf") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".sdf") returned 0x0 [0046.243] lstrlenW (lpString=".MDF") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".MDF") returned 0x0 [0046.243] lstrlenW (lpString=".DBF") returned 4 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".DBF") returned 0x0 [0046.243] lstrlenW (lpString=".DB") returned 3 [0046.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".DB") returned 0x0 [0046.244] lstrlenW (lpString=".db") returned 3 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".db") returned 0x0 [0046.244] lstrlenW (lpString=".ndf") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".ndf") returned 0x0 [0046.244] lstrlenW (lpString=".NDF") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".NDF") returned 0x0 [0046.244] lstrlenW (lpString=".Mdf") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".Mdf") returned 0x0 [0046.244] lstrlenW (lpString=".dat") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".dat") returned 0x0 [0046.244] lstrlenW (lpString=".DAT") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".DAT") returned 0x0 [0046.244] lstrlenW (lpString=".ldf") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".ldf") returned 0x0 [0046.244] lstrlenW (lpString=".LDF") returned 4 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch=".LDF") returned 0x0 [0046.244] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.244] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.245] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.245] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0046.245] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16624613565) returned 1 [0046.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa609710, dwHighDateTime=0x1d585b4)) [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d74a8 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d74a8 | out: hHeap=0x260000) returned 1 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b490 [0046.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b490 | out: hHeap=0x260000) returned 1 [0046.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.246] GetLastError () returned 0x0 [0046.246] GetLastError () returned 0x0 [0046.246] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.246] GetLastError () returned 0x0 [0046.246] GetLastError () returned 0x0 [0046.249] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.249] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.250] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.250] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.251] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.251] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.251] CloseHandle (hObject=0x100) returned 1 [0046.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.252] GetLastError () returned 0x0 [0046.252] RtlWakeConditionVariable () returned 0x27e828 [0046.252] GetCurrentThreadId () returned 0x99c [0046.252] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.252] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.252] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.252] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.253] CloseHandle (hObject=0x100) returned 1 [0046.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c10 | out: hHeap=0x260000) returned 1 [0046.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0046.253] RtlWakeConditionVariable () returned 0x27e828 [0046.253] GetCurrentThreadId () returned 0x99c [0046.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".ldf") returned 0x0 [0046.253] lstrlenW (lpString=".vhd") returned 4 [0046.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".vhd") returned 0x0 [0046.253] lstrlenW (lpString=".vhdx") returned 5 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".vhdx") returned 0x0 [0046.254] lstrlenW (lpString=".pst") returned 4 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".pst") returned 0x0 [0046.254] lstrlenW (lpString=".ost") returned 4 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".ost") returned 0x0 [0046.254] lstrlenW (lpString=".bak") returned 4 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".bak") returned 0x0 [0046.254] lstrlenW (lpString=".bac") returned 4 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".bac") returned 0x0 [0046.254] lstrlenW (lpString=".sys") returned 4 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".sys") returned 0x0 [0046.254] lstrlenW (lpString=".v2i") returned 4 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".v2i") returned 0x0 [0046.254] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.255] lstrlenW (lpString=".sql") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".sql") returned 0x0 [0046.255] lstrlenW (lpString=".mdf") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".mdf") returned 0x0 [0046.255] lstrlenW (lpString=".txt") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".txt") returned 0x0 [0046.255] lstrlenW (lpString=".dbf") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".dbf") returned 0x0 [0046.255] lstrlenW (lpString=".ckp") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".ckp") returned 0x0 [0046.255] lstrlenW (lpString=".dacpac") returned 7 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".dacpac") returned 0x0 [0046.255] lstrlenW (lpString=".db3") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".db3") returned 0x0 [0046.255] lstrlenW (lpString=".dtxs") returned 5 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".dtxs") returned 0x0 [0046.255] lstrlenW (lpString=".mdt") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".mdt") returned 0x0 [0046.255] lstrlenW (lpString=".sdf") returned 4 [0046.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".sdf") returned 0x0 [0046.256] lstrlenW (lpString=".MDF") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".MDF") returned 0x0 [0046.256] lstrlenW (lpString=".DBF") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".DBF") returned 0x0 [0046.256] lstrlenW (lpString=".DB") returned 3 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".DB") returned 0x0 [0046.256] lstrlenW (lpString=".db") returned 3 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".db") returned 0x0 [0046.256] lstrlenW (lpString=".ndf") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".ndf") returned 0x0 [0046.256] lstrlenW (lpString=".NDF") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".NDF") returned 0x0 [0046.256] lstrlenW (lpString=".Mdf") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".Mdf") returned 0x0 [0046.256] lstrlenW (lpString=".dat") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".dat") returned 0x0 [0046.256] lstrlenW (lpString=".DAT") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".DAT") returned 0x0 [0046.256] lstrlenW (lpString=".ldf") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".ldf") returned 0x0 [0046.256] lstrlenW (lpString=".LDF") returned 4 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch=".LDF") returned 0x0 [0046.256] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.256] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.257] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.257] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0046.257] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16625832614) returned 1 [0046.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa62f870, dwHighDateTime=0x1d585b4)) [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7518 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7518 | out: hHeap=0x260000) returned 1 [0046.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ab60 [0046.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ab60 | out: hHeap=0x260000) returned 1 [0046.258] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.258] GetLastError () returned 0x0 [0046.258] GetLastError () returned 0x0 [0046.258] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.258] GetLastError () returned 0x0 [0046.258] GetLastError () returned 0x0 [0046.353] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.353] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.355] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.355] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.405] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.405] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.405] CloseHandle (hObject=0x100) returned 1 [0046.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0046.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f91e8 | out: hHeap=0x260000) returned 1 [0046.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.406] GetLastError () returned 0x0 [0046.406] RtlWakeConditionVariable () returned 0x27e828 [0046.406] GetCurrentThreadId () returned 0x99c [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.406] lstrlenW (lpString=".vhd") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".vhd") returned 0x0 [0046.406] lstrlenW (lpString=".vhdx") returned 5 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".vhdx") returned 0x0 [0046.406] lstrlenW (lpString=".pst") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".pst") returned 0x0 [0046.406] lstrlenW (lpString=".ost") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".ost") returned 0x0 [0046.406] lstrlenW (lpString=".bak") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".bak") returned 0x0 [0046.406] lstrlenW (lpString=".bac") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".bac") returned 0x0 [0046.406] lstrlenW (lpString=".sys") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".sys") returned 0x0 [0046.406] lstrlenW (lpString=".v2i") returned 4 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".v2i") returned 0x0 [0046.406] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.407] lstrlenW (lpString=".sql") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".sql") returned 0x0 [0046.407] lstrlenW (lpString=".mdf") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".mdf") returned 0x0 [0046.407] lstrlenW (lpString=".txt") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".txt") returned 0x0 [0046.407] lstrlenW (lpString=".dbf") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".dbf") returned 0x0 [0046.407] lstrlenW (lpString=".ckp") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".ckp") returned 0x0 [0046.407] lstrlenW (lpString=".dacpac") returned 7 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".dacpac") returned 0x0 [0046.407] lstrlenW (lpString=".db3") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".db3") returned 0x0 [0046.407] lstrlenW (lpString=".dtxs") returned 5 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".dtxs") returned 0x0 [0046.407] lstrlenW (lpString=".mdt") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".mdt") returned 0x0 [0046.407] lstrlenW (lpString=".sdf") returned 4 [0046.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".sdf") returned 0x0 [0046.408] lstrlenW (lpString=".MDF") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".MDF") returned 0x0 [0046.408] lstrlenW (lpString=".DBF") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".DBF") returned 0x0 [0046.408] lstrlenW (lpString=".DB") returned 3 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".DB") returned 0x0 [0046.408] lstrlenW (lpString=".db") returned 3 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".db") returned 0x0 [0046.408] lstrlenW (lpString=".ndf") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".ndf") returned 0x0 [0046.408] lstrlenW (lpString=".NDF") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".NDF") returned 0x0 [0046.408] lstrlenW (lpString=".Mdf") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".Mdf") returned 0x0 [0046.408] lstrlenW (lpString=".dat") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".dat") returned 0x0 [0046.408] lstrlenW (lpString=".DAT") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".DAT") returned 0x0 [0046.408] lstrlenW (lpString=".ldf") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.408] lstrlenW (lpString=".LDF") returned 4 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch=".LDF") returned 0x0 [0046.408] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.408] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.409] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.409] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16641030795) returned 1 [0046.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa7864d0, dwHighDateTime=0x1d585b4)) [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7860 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7860 | out: hHeap=0x260000) returned 1 [0046.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.410] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.410] GetLastError () returned 0x0 [0046.410] GetLastError () returned 0x0 [0046.410] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.410] GetLastError () returned 0x0 [0046.410] GetLastError () returned 0x0 [0046.414] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.414] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.416] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.416] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.417] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.417] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.417] CloseHandle (hObject=0x100) returned 1 [0046.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.418] GetLastError () returned 0x0 [0046.418] RtlWakeConditionVariable () returned 0x27e828 [0046.418] GetCurrentThreadId () returned 0x99c [0046.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.418] lstrlenW (lpString=".vhd") returned 4 [0046.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".vhd") returned 0x0 [0046.418] lstrlenW (lpString=".vhdx") returned 5 [0046.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".vhdx") returned 0x0 [0046.418] lstrlenW (lpString=".pst") returned 4 [0046.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".pst") returned 0x0 [0046.418] lstrlenW (lpString=".ost") returned 4 [0046.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".ost") returned 0x0 [0046.419] lstrlenW (lpString=".bak") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".bak") returned 0x0 [0046.419] lstrlenW (lpString=".bac") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".bac") returned 0x0 [0046.419] lstrlenW (lpString=".sys") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".sys") returned 0x0 [0046.419] lstrlenW (lpString=".v2i") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".v2i") returned 0x0 [0046.419] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.419] lstrlenW (lpString=".sql") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".sql") returned 0x0 [0046.419] lstrlenW (lpString=".mdf") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".mdf") returned 0x0 [0046.419] lstrlenW (lpString=".txt") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".txt") returned 0x0 [0046.419] lstrlenW (lpString=".dbf") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".dbf") returned 0x0 [0046.419] lstrlenW (lpString=".ckp") returned 4 [0046.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".ckp") returned 0x0 [0046.420] lstrlenW (lpString=".dacpac") returned 7 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".dacpac") returned 0x0 [0046.420] lstrlenW (lpString=".db3") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".db3") returned 0x0 [0046.420] lstrlenW (lpString=".dtxs") returned 5 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".dtxs") returned 0x0 [0046.420] lstrlenW (lpString=".mdt") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".mdt") returned 0x0 [0046.420] lstrlenW (lpString=".sdf") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".sdf") returned 0x0 [0046.420] lstrlenW (lpString=".MDF") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".MDF") returned 0x0 [0046.420] lstrlenW (lpString=".DBF") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".DBF") returned 0x0 [0046.420] lstrlenW (lpString=".DB") returned 3 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".DB") returned 0x0 [0046.420] lstrlenW (lpString=".db") returned 3 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".db") returned 0x0 [0046.420] lstrlenW (lpString=".ndf") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".ndf") returned 0x0 [0046.420] lstrlenW (lpString=".NDF") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".NDF") returned 0x0 [0046.420] lstrlenW (lpString=".Mdf") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".Mdf") returned 0x0 [0046.420] lstrlenW (lpString=".dat") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".dat") returned 0x0 [0046.420] lstrlenW (lpString=".DAT") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".DAT") returned 0x0 [0046.420] lstrlenW (lpString=".ldf") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.420] lstrlenW (lpString=".LDF") returned 4 [0046.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch=".LDF") returned 0x0 [0046.420] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.421] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.421] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.421] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.421] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16642260732) returned 1 [0046.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa7ac630, dwHighDateTime=0x1d585b4)) [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7898 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7898 | out: hHeap=0x260000) returned 1 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.422] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.422] GetLastError () returned 0x0 [0046.422] GetLastError () returned 0x0 [0046.422] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.422] GetLastError () returned 0x0 [0046.422] GetLastError () returned 0x0 [0046.425] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.425] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.427] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.427] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.428] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.428] CloseHandle (hObject=0x100) returned 1 [0046.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.429] GetLastError () returned 0x0 [0046.429] RtlWakeConditionVariable () returned 0x27e828 [0046.429] GetCurrentThreadId () returned 0x99c [0046.430] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.430] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.430] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.430] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.431] CloseHandle (hObject=0x100) returned 1 [0046.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fcb8 | out: hHeap=0x260000) returned 1 [0046.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.431] RtlWakeConditionVariable () returned 0x27e828 [0046.431] GetCurrentThreadId () returned 0x99c [0046.431] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.431] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.431] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.431] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.432] CloseHandle (hObject=0x100) returned 1 [0046.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9cd8 | out: hHeap=0x260000) returned 1 [0046.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c10 | out: hHeap=0x260000) returned 1 [0046.432] RtlWakeConditionVariable () returned 0x27e828 [0046.432] GetCurrentThreadId () returned 0x99c [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".ldf") returned 0x0 [0046.433] lstrlenW (lpString=".vhd") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".vhd") returned 0x0 [0046.433] lstrlenW (lpString=".vhdx") returned 5 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".vhdx") returned 0x0 [0046.433] lstrlenW (lpString=".pst") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".pst") returned 0x0 [0046.433] lstrlenW (lpString=".ost") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".ost") returned 0x0 [0046.433] lstrlenW (lpString=".bak") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".bak") returned 0x0 [0046.433] lstrlenW (lpString=".bac") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".bac") returned 0x0 [0046.433] lstrlenW (lpString=".sys") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".sys") returned 0x0 [0046.433] lstrlenW (lpString=".v2i") returned 4 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".v2i") returned 0x0 [0046.433] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0046.434] lstrlenW (lpString=".sql") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".sql") returned 0x0 [0046.434] lstrlenW (lpString=".mdf") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".mdf") returned 0x0 [0046.434] lstrlenW (lpString=".txt") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".txt") returned 0x0 [0046.434] lstrlenW (lpString=".dbf") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".dbf") returned 0x0 [0046.434] lstrlenW (lpString=".ckp") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".ckp") returned 0x0 [0046.434] lstrlenW (lpString=".dacpac") returned 7 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".dacpac") returned 0x0 [0046.434] lstrlenW (lpString=".db3") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".db3") returned 0x0 [0046.434] lstrlenW (lpString=".dtxs") returned 5 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".dtxs") returned 0x0 [0046.434] lstrlenW (lpString=".mdt") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".mdt") returned 0x0 [0046.434] lstrlenW (lpString=".sdf") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".sdf") returned 0x0 [0046.434] lstrlenW (lpString=".MDF") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".MDF") returned 0x0 [0046.434] lstrlenW (lpString=".DBF") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".DBF") returned 0x0 [0046.434] lstrlenW (lpString=".DB") returned 3 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".DB") returned 0x0 [0046.434] lstrlenW (lpString=".db") returned 3 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".db") returned 0x0 [0046.434] lstrlenW (lpString=".ndf") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".ndf") returned 0x0 [0046.434] lstrlenW (lpString=".NDF") returned 4 [0046.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".NDF") returned 0x0 [0046.435] lstrlenW (lpString=".Mdf") returned 4 [0046.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".Mdf") returned 0x0 [0046.435] lstrlenW (lpString=".dat") returned 4 [0046.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".dat") returned 0x0 [0046.435] lstrlenW (lpString=".DAT") returned 4 [0046.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".DAT") returned 0x0 [0046.435] lstrlenW (lpString=".ldf") returned 4 [0046.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".ldf") returned 0x0 [0046.435] lstrlenW (lpString=".LDF") returned 4 [0046.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch=".LDF") returned 0x0 [0046.435] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0046.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.435] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.436] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0046.436] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16643694678) returned 1 [0046.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa7d2790, dwHighDateTime=0x1d585b4)) [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8178 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8178 | out: hHeap=0x260000) returned 1 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.436] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.436] GetLastError () returned 0x0 [0046.437] GetLastError () returned 0x0 [0046.437] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.437] GetLastError () returned 0x0 [0046.437] GetLastError () returned 0x0 [0046.438] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd8a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.439] WriteFile (in: hFile=0x100, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x2760, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x238fdb0*=0x2760, lpOverlapped=0x0) returned 1 [0046.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0046.439] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.439] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.439] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.439] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.439] CloseHandle (hObject=0x100) returned 1 [0046.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0046.440] GetLastError () returned 0x0 [0046.440] RtlWakeConditionVariable () returned 0x27e828 [0046.440] GetCurrentThreadId () returned 0x99c [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".ldf") returned 0x0 [0046.440] lstrlenW (lpString=".vhd") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".vhd") returned 0x0 [0046.440] lstrlenW (lpString=".vhdx") returned 5 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".vhdx") returned 0x0 [0046.440] lstrlenW (lpString=".pst") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".pst") returned 0x0 [0046.440] lstrlenW (lpString=".ost") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".ost") returned 0x0 [0046.440] lstrlenW (lpString=".bak") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".bak") returned 0x0 [0046.440] lstrlenW (lpString=".bac") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".bac") returned 0x0 [0046.440] lstrlenW (lpString=".sys") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".sys") returned 0x0 [0046.440] lstrlenW (lpString=".v2i") returned 4 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".v2i") returned 0x0 [0046.440] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.463] lstrlenW (lpString=".sql") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".sql") returned 0x0 [0046.463] lstrlenW (lpString=".mdf") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".mdf") returned 0x0 [0046.463] lstrlenW (lpString=".txt") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".txt") returned 0x0 [0046.463] lstrlenW (lpString=".dbf") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".dbf") returned 0x0 [0046.463] lstrlenW (lpString=".ckp") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".ckp") returned 0x0 [0046.463] lstrlenW (lpString=".dacpac") returned 7 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".dacpac") returned 0x0 [0046.463] lstrlenW (lpString=".db3") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".db3") returned 0x0 [0046.463] lstrlenW (lpString=".dtxs") returned 5 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".dtxs") returned 0x0 [0046.463] lstrlenW (lpString=".mdt") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".mdt") returned 0x0 [0046.463] lstrlenW (lpString=".sdf") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".sdf") returned 0x0 [0046.463] lstrlenW (lpString=".MDF") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".MDF") returned 0x0 [0046.463] lstrlenW (lpString=".DBF") returned 4 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".DBF") returned 0x0 [0046.463] lstrlenW (lpString=".DB") returned 3 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".DB") returned 0x0 [0046.463] lstrlenW (lpString=".db") returned 3 [0046.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".db") returned 0x0 [0046.463] lstrlenW (lpString=".ndf") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".ndf") returned 0x0 [0046.464] lstrlenW (lpString=".NDF") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".NDF") returned 0x0 [0046.464] lstrlenW (lpString=".Mdf") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".Mdf") returned 0x0 [0046.464] lstrlenW (lpString=".dat") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".dat") returned 0x0 [0046.464] lstrlenW (lpString=".DAT") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".DAT") returned 0x0 [0046.464] lstrlenW (lpString=".ldf") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".ldf") returned 0x0 [0046.464] lstrlenW (lpString=".LDF") returned 4 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch=".LDF") returned 0x0 [0046.464] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.464] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.465] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.465] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0046.465] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16646609643) returned 1 [0046.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa81ea50, dwHighDateTime=0x1d585b4)) [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8258 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8258 | out: hHeap=0x260000) returned 1 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0046.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0046.465] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.466] GetLastError () returned 0x0 [0046.466] GetLastError () returned 0x0 [0046.466] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.466] GetLastError () returned 0x0 [0046.466] GetLastError () returned 0x0 [0046.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb8a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.469] WriteFile (in: hFile=0xf0, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x4758, lpOverlapped=0x0) returned 1 [0046.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.469] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.469] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.469] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.469] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.469] CloseHandle (hObject=0xf0) returned 1 [0046.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.480] GetLastError () returned 0x0 [0046.480] RtlWakeConditionVariable () returned 0x27e828 [0046.480] GetCurrentThreadId () returned 0x99c [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".ldf") returned 0x0 [0046.480] lstrlenW (lpString=".vhd") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".vhd") returned 0x0 [0046.480] lstrlenW (lpString=".vhdx") returned 5 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".vhdx") returned 0x0 [0046.480] lstrlenW (lpString=".pst") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".pst") returned 0x0 [0046.480] lstrlenW (lpString=".ost") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".ost") returned 0x0 [0046.480] lstrlenW (lpString=".bak") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".bak") returned 0x0 [0046.480] lstrlenW (lpString=".bac") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".bac") returned 0x0 [0046.480] lstrlenW (lpString=".sys") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".sys") returned 0x0 [0046.480] lstrlenW (lpString=".v2i") returned 4 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".v2i") returned 0x0 [0046.480] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.481] lstrlenW (lpString=".sql") returned 4 [0046.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".sql") returned 0x0 [0046.481] lstrlenW (lpString=".mdf") returned 4 [0046.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".mdf") returned 0x0 [0046.481] lstrlenW (lpString=".txt") returned 4 [0046.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".txt") returned 0x0 [0046.481] lstrlenW (lpString=".dbf") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".dbf") returned 0x0 [0046.482] lstrlenW (lpString=".ckp") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".ckp") returned 0x0 [0046.482] lstrlenW (lpString=".dacpac") returned 7 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".dacpac") returned 0x0 [0046.482] lstrlenW (lpString=".db3") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".db3") returned 0x0 [0046.482] lstrlenW (lpString=".dtxs") returned 5 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".dtxs") returned 0x0 [0046.482] lstrlenW (lpString=".mdt") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".mdt") returned 0x0 [0046.482] lstrlenW (lpString=".sdf") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".sdf") returned 0x0 [0046.482] lstrlenW (lpString=".MDF") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".MDF") returned 0x0 [0046.482] lstrlenW (lpString=".DBF") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".DBF") returned 0x0 [0046.482] lstrlenW (lpString=".DB") returned 3 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".DB") returned 0x0 [0046.482] lstrlenW (lpString=".db") returned 3 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".db") returned 0x0 [0046.482] lstrlenW (lpString=".ndf") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".ndf") returned 0x0 [0046.482] lstrlenW (lpString=".NDF") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".NDF") returned 0x0 [0046.482] lstrlenW (lpString=".Mdf") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".Mdf") returned 0x0 [0046.482] lstrlenW (lpString=".dat") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".dat") returned 0x0 [0046.482] lstrlenW (lpString=".DAT") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".DAT") returned 0x0 [0046.482] lstrlenW (lpString=".ldf") returned 4 [0046.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".ldf") returned 0x0 [0046.483] lstrlenW (lpString=".LDF") returned 4 [0046.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch=".LDF") returned 0x0 [0046.483] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.483] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.483] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0046.484] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16648474128) returned 1 [0046.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa844bb0, dwHighDateTime=0x1d585b4)) [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7940 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7940 | out: hHeap=0x260000) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0046.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0046.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.484] GetLastError () returned 0x0 [0046.484] GetLastError () returned 0x0 [0046.484] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.484] GetLastError () returned 0x0 [0046.485] GetLastError () returned 0x0 [0046.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.487] WriteFile (in: hFile=0xf0, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.489] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.490] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.490] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.490] CloseHandle (hObject=0xf0) returned 1 [0046.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.491] GetLastError () returned 0x0 [0046.491] RtlWakeConditionVariable () returned 0x27e828 [0046.491] GetCurrentThreadId () returned 0x99c [0046.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".ldf") returned 0x0 [0046.491] lstrlenW (lpString=".vhd") returned 4 [0046.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".vhd") returned 0x0 [0046.491] lstrlenW (lpString=".vhdx") returned 5 [0046.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".vhdx") returned 0x0 [0046.491] lstrlenW (lpString=".pst") returned 4 [0046.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".pst") returned 0x0 [0046.491] lstrlenW (lpString=".ost") returned 4 [0046.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".ost") returned 0x0 [0046.492] lstrlenW (lpString=".bak") returned 4 [0046.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".bak") returned 0x0 [0046.492] lstrlenW (lpString=".bac") returned 4 [0046.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".bac") returned 0x0 [0046.492] lstrlenW (lpString=".sys") returned 4 [0046.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".sys") returned 0x0 [0046.492] lstrlenW (lpString=".v2i") returned 4 [0046.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".v2i") returned 0x0 [0046.492] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.493] lstrlenW (lpString=".sql") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".sql") returned 0x0 [0046.493] lstrlenW (lpString=".mdf") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".mdf") returned 0x0 [0046.493] lstrlenW (lpString=".txt") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".txt") returned 0x0 [0046.493] lstrlenW (lpString=".dbf") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".dbf") returned 0x0 [0046.493] lstrlenW (lpString=".ckp") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".ckp") returned 0x0 [0046.493] lstrlenW (lpString=".dacpac") returned 7 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".dacpac") returned 0x0 [0046.493] lstrlenW (lpString=".db3") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".db3") returned 0x0 [0046.493] lstrlenW (lpString=".dtxs") returned 5 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".dtxs") returned 0x0 [0046.493] lstrlenW (lpString=".mdt") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".mdt") returned 0x0 [0046.493] lstrlenW (lpString=".sdf") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".sdf") returned 0x0 [0046.493] lstrlenW (lpString=".MDF") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".MDF") returned 0x0 [0046.493] lstrlenW (lpString=".DBF") returned 4 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".DBF") returned 0x0 [0046.493] lstrlenW (lpString=".DB") returned 3 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".DB") returned 0x0 [0046.493] lstrlenW (lpString=".db") returned 3 [0046.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".db") returned 0x0 [0046.493] lstrlenW (lpString=".ndf") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".ndf") returned 0x0 [0046.494] lstrlenW (lpString=".NDF") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".NDF") returned 0x0 [0046.494] lstrlenW (lpString=".Mdf") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".Mdf") returned 0x0 [0046.494] lstrlenW (lpString=".dat") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".dat") returned 0x0 [0046.494] lstrlenW (lpString=".DAT") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".DAT") returned 0x0 [0046.494] lstrlenW (lpString=".ldf") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".ldf") returned 0x0 [0046.494] lstrlenW (lpString=".LDF") returned 4 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch=".LDF") returned 0x0 [0046.494] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.494] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.495] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.495] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0046.495] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16649615078) returned 1 [0046.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa86ad10, dwHighDateTime=0x1d585b4)) [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7978 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7978 | out: hHeap=0x260000) returned 1 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0046.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0046.495] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.496] GetLastError () returned 0x0 [0046.496] GetLastError () returned 0x0 [0046.496] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.496] GetLastError () returned 0x0 [0046.496] GetLastError () returned 0x0 [0046.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff4498, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.498] WriteFile (in: hFile=0xf0, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xbb68, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0xbb68, lpOverlapped=0x0) returned 1 [0046.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.499] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.499] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.499] CloseHandle (hObject=0xf0) returned 1 [0046.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.502] GetLastError () returned 0x0 [0046.502] RtlWakeConditionVariable () returned 0x27e828 [0046.502] GetCurrentThreadId () returned 0x99c [0046.502] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.502] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.502] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.502] WriteFile (in: hFile=0xf0, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.503] CloseHandle (hObject=0xf0) returned 1 [0046.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee648 | out: hHeap=0x260000) returned 1 [0046.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.504] RtlWakeConditionVariable () returned 0x27e828 [0046.504] GetCurrentThreadId () returned 0x99c [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".ldf") returned 0x0 [0046.504] lstrlenW (lpString=".vhd") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".vhd") returned 0x0 [0046.504] lstrlenW (lpString=".vhdx") returned 5 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".vhdx") returned 0x0 [0046.504] lstrlenW (lpString=".pst") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".pst") returned 0x0 [0046.504] lstrlenW (lpString=".ost") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".ost") returned 0x0 [0046.504] lstrlenW (lpString=".bak") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".bak") returned 0x0 [0046.504] lstrlenW (lpString=".bac") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".bac") returned 0x0 [0046.504] lstrlenW (lpString=".sys") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".sys") returned 0x0 [0046.504] lstrlenW (lpString=".v2i") returned 4 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".v2i") returned 0x0 [0046.504] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0046.505] lstrlenW (lpString=".sql") returned 4 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".sql") returned 0x0 [0046.505] lstrlenW (lpString=".mdf") returned 4 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".mdf") returned 0x0 [0046.505] lstrlenW (lpString=".txt") returned 4 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".txt") returned 0x0 [0046.505] lstrlenW (lpString=".dbf") returned 4 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".dbf") returned 0x0 [0046.505] lstrlenW (lpString=".ckp") returned 4 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".ckp") returned 0x0 [0046.505] lstrlenW (lpString=".dacpac") returned 7 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".dacpac") returned 0x0 [0046.505] lstrlenW (lpString=".db3") returned 4 [0046.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".db3") returned 0x0 [0046.506] lstrlenW (lpString=".dtxs") returned 5 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".dtxs") returned 0x0 [0046.506] lstrlenW (lpString=".mdt") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".mdt") returned 0x0 [0046.506] lstrlenW (lpString=".sdf") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".sdf") returned 0x0 [0046.506] lstrlenW (lpString=".MDF") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".MDF") returned 0x0 [0046.506] lstrlenW (lpString=".DBF") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".DBF") returned 0x0 [0046.506] lstrlenW (lpString=".DB") returned 3 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".DB") returned 0x0 [0046.506] lstrlenW (lpString=".db") returned 3 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".db") returned 0x0 [0046.506] lstrlenW (lpString=".ndf") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".ndf") returned 0x0 [0046.506] lstrlenW (lpString=".NDF") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".NDF") returned 0x0 [0046.506] lstrlenW (lpString=".Mdf") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".Mdf") returned 0x0 [0046.506] lstrlenW (lpString=".dat") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".dat") returned 0x0 [0046.506] lstrlenW (lpString=".DAT") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".DAT") returned 0x0 [0046.506] lstrlenW (lpString=".ldf") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".ldf") returned 0x0 [0046.506] lstrlenW (lpString=".LDF") returned 4 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch=".LDF") returned 0x0 [0046.506] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.506] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310af8) returned 1 [0046.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.507] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0046.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0046.507] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16650852814) returned 1 [0046.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaa890e70, dwHighDateTime=0x1d585b4)) [0046.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d79e8 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d79e8 | out: hHeap=0x260000) returned 1 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0046.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320050 [0046.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0046.508] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0046.508] GetLastError () returned 0x0 [0046.508] GetLastError () returned 0x0 [0046.508] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0046.508] GetLastError () returned 0x0 [0046.508] GetLastError () returned 0x0 [0046.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.552] WriteFile (in: hFile=0xf0, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.554] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.554] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.554] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.554] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.555] CloseHandle (hObject=0xf0) returned 1 [0046.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ca0 [0046.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca0 | out: hHeap=0x260000) returned 1 [0046.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0046.611] GetLastError () returned 0x0 [0046.611] RtlWakeConditionVariable () returned 0x27e828 [0046.611] GetCurrentThreadId () returned 0x99c [0046.669] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.669] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.669] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.669] WriteFile (in: hFile=0xf0, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.670] CloseHandle (hObject=0xf0) returned 1 [0046.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315af8 | out: hHeap=0x260000) returned 1 [0046.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.670] RtlWakeConditionVariable () returned 0x27e828 [0046.671] GetCurrentThreadId () returned 0x99c [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".ldf") returned 0x0 [0046.671] lstrlenW (lpString=".vhd") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".vhd") returned 0x0 [0046.671] lstrlenW (lpString=".vhdx") returned 5 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".vhdx") returned 0x0 [0046.671] lstrlenW (lpString=".pst") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".pst") returned 0x0 [0046.671] lstrlenW (lpString=".ost") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".ost") returned 0x0 [0046.671] lstrlenW (lpString=".bak") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".bak") returned 0x0 [0046.671] lstrlenW (lpString=".bac") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".bac") returned 0x0 [0046.671] lstrlenW (lpString=".sys") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".sys") returned 0x0 [0046.671] lstrlenW (lpString=".v2i") returned 4 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch=".v2i") returned 0x0 [0046.671] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpSrch="s\r\n.v2i") returned 0x0 [0046.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0046.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.672] RtlWakeConditionVariable () returned 0x27e828 [0046.672] GetCurrentThreadId () returned 0x99c [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".ldf") returned 0x0 [0046.672] lstrlenW (lpString=".vhd") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".vhd") returned 0x0 [0046.672] lstrlenW (lpString=".vhdx") returned 5 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".vhdx") returned 0x0 [0046.672] lstrlenW (lpString=".pst") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".pst") returned 0x0 [0046.672] lstrlenW (lpString=".ost") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".ost") returned 0x0 [0046.672] lstrlenW (lpString=".bak") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".bak") returned 0x0 [0046.672] lstrlenW (lpString=".bac") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".bac") returned 0x0 [0046.672] lstrlenW (lpString=".sys") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".sys") returned 0x0 [0046.672] lstrlenW (lpString=".v2i") returned 4 [0046.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch=".v2i") returned 0x0 [0046.673] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0046.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296be8 | out: hHeap=0x260000) returned 1 [0046.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297990 | out: hHeap=0x260000) returned 1 [0046.674] RtlWakeConditionVariable () returned 0x27e828 [0046.674] GetCurrentThreadId () returned 0x99c [0046.692] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.692] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.692] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.692] WriteFile (in: hFile=0x104, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.693] CloseHandle (hObject=0x104) returned 1 [0046.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b880 | out: hHeap=0x260000) returned 1 [0046.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.693] RtlWakeConditionVariable () returned 0x27e828 [0046.693] GetCurrentThreadId () returned 0x99c [0046.776] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.776] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.776] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.776] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.777] CloseHandle (hObject=0xf8) returned 1 [0046.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b688 | out: hHeap=0x260000) returned 1 [0046.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.777] RtlWakeConditionVariable () returned 0x27e828 [0046.777] GetCurrentThreadId () returned 0x99c [0047.079] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.079] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.079] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.079] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.080] CloseHandle (hObject=0xf8) returned 1 [0047.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c8d8 | out: hHeap=0x260000) returned 1 [0047.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3d28 | out: hHeap=0x260000) returned 1 [0047.080] RtlWakeConditionVariable () returned 0x27e828 [0047.080] GetCurrentThreadId () returned 0x99c [0047.115] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.115] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.116] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.116] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.117] CloseHandle (hObject=0xf8) returned 1 [0047.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7320 | out: hHeap=0x260000) returned 1 [0047.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7860 | out: hHeap=0x260000) returned 1 [0047.117] RtlWakeConditionVariable () returned 0x27e828 [0047.117] GetCurrentThreadId () returned 0x99c [0047.213] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.213] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.213] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.214] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.215] CloseHandle (hObject=0xf8) returned 1 [0047.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9120 | out: hHeap=0x260000) returned 1 [0047.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0047.215] RtlWakeConditionVariable () returned 0x27e828 [0047.215] GetCurrentThreadId () returned 0x99c [0047.256] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.256] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.256] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.256] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.258] CloseHandle (hObject=0xf8) returned 1 [0047.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3337e0 | out: hHeap=0x260000) returned 1 [0047.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3332d8 | out: hHeap=0x260000) returned 1 [0047.258] RtlWakeConditionVariable () returned 0x27e828 [0047.258] GetCurrentThreadId () returned 0x99c [0047.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x331b58 | out: hHeap=0x260000) returned 1 [0047.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b68e8 | out: hHeap=0x260000) returned 1 [0047.304] RtlWakeConditionVariable () returned 0x27e828 [0047.304] GetCurrentThreadId () returned 0x99c [0047.304] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.304] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.304] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.304] WriteFile (in: hFile=0xf8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.305] CloseHandle (hObject=0xf8) returned 1 [0047.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x331bf0 | out: hHeap=0x260000) returned 1 [0047.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b68e8 | out: hHeap=0x260000) returned 1 [0047.305] RtlWakeConditionVariable () returned 0x27e828 [0047.305] GetCurrentThreadId () returned 0x99c [0047.306] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3129c8) returned 1 [0047.307] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.307] CryptReleaseContext (hProv=0x3129c8, dwFlags=0x0) returned 1 [0047.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0047.307] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16730838533) returned 1 [0047.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab027490, dwHighDateTime=0x1d585b4)) [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d8d0 [0047.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d8d0 | out: hHeap=0x260000) returned 1 [0047.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a428 [0047.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b68e8 [0047.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a428 | out: hHeap=0x260000) returned 1 [0047.308] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.308] GetLastError () returned 0x0 [0047.308] GetLastError () returned 0x0 [0047.308] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.308] GetLastError () returned 0x0 [0047.308] GetLastError () returned 0x0 [0047.319] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffbca0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.319] WriteFile (in: hFile=0xf8, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x238fdb0*=0x4360, lpOverlapped=0x0) returned 1 [0047.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.319] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.319] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.320] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.320] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.320] CloseHandle (hObject=0xf8) returned 1 [0047.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0047.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0047.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.324] GetLastError () returned 0x0 [0047.325] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.326] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.326] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.326] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16732738854) returned 1 [0047.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab04d5f0, dwHighDateTime=0x1d585b4)) [0047.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337178 [0047.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337178 | out: hHeap=0x260000) returned 1 [0047.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.327] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.327] GetLastError () returned 0x0 [0047.327] GetLastError () returned 0x0 [0047.327] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.327] GetLastError () returned 0x0 [0047.327] GetLastError () returned 0x0 [0047.331] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff7ae4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.331] WriteFile (in: hFile=0x104, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x851c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x238fdb0*=0x851c, lpOverlapped=0x0) returned 1 [0047.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.331] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.331] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.331] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.331] CloseHandle (hObject=0x104) returned 1 [0047.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0047.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0047.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.332] GetLastError () returned 0x0 [0047.333] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.334] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0047.334] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.334] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16733487399) returned 1 [0047.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab073750, dwHighDateTime=0x1d585b4)) [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3371b0 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3371b0 | out: hHeap=0x260000) returned 1 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.334] GetLastError () returned 0x0 [0047.334] GetLastError () returned 0x0 [0047.335] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.335] GetLastError () returned 0x0 [0047.335] GetLastError () returned 0x0 [0047.336] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff826e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.336] WriteFile (in: hFile=0x104, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x7d92, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x238fdb0*=0x7d92, lpOverlapped=0x0) returned 1 [0047.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.337] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.337] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.337] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.337] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.337] CloseHandle (hObject=0x104) returned 1 [0047.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0047.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0047.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.338] GetLastError () returned 0x0 [0047.338] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0047.339] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0047.339] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16734031081) returned 1 [0047.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab073750, dwHighDateTime=0x1d585b4)) [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3371e8 [0047.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0047.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3371e8 | out: hHeap=0x260000) returned 1 [0047.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0047.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.340] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.340] GetLastError () returned 0x0 [0047.340] GetLastError () returned 0x0 [0047.340] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.340] GetLastError () returned 0x0 [0047.340] GetLastError () returned 0x0 [0047.450] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff65a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.450] WriteFile (in: hFile=0x104, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x9a5b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x238fdb0*=0x9a5b, lpOverlapped=0x0) returned 1 [0047.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.452] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.452] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.452] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.452] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.453] CloseHandle (hObject=0x104) returned 1 [0047.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0047.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0047.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0047.456] GetLastError () returned 0x0 [0047.527] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.527] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.528] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.528] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16752879128) returned 1 [0047.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab23c7d0, dwHighDateTime=0x1d585b4)) [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daaa8 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daaa8 | out: hHeap=0x260000) returned 1 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dec0 [0047.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.528] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.528] GetLastError () returned 0x0 [0047.528] GetLastError () returned 0x0 [0047.528] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.529] GetLastError () returned 0x0 [0047.529] GetLastError () returned 0x0 [0047.530] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe05f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.530] WriteFile (in: hFile=0xf8, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x238fdb0*=0x1fa1, lpOverlapped=0x0) returned 1 [0047.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.530] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.530] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.531] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.531] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.531] CloseHandle (hObject=0xf8) returned 1 [0047.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.532] GetLastError () returned 0x0 [0047.532] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.532] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.533] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.533] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16753377024) returned 1 [0047.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab23c7d0, dwHighDateTime=0x1d585b4)) [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7780 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7780 | out: hHeap=0x260000) returned 1 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331e50 [0047.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.533] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.533] GetLastError () returned 0x0 [0047.534] GetLastError () returned 0x0 [0047.534] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.534] GetLastError () returned 0x0 [0047.534] GetLastError () returned 0x0 [0047.535] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffeb3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.535] WriteFile (in: hFile=0xf8, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x14c3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x238fdb0*=0x14c3, lpOverlapped=0x0) returned 1 [0047.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.536] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.536] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.536] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.536] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.536] CloseHandle (hObject=0xf8) returned 1 [0047.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.588] GetLastError () returned 0x0 [0047.589] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.589] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.589] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16759063875) returned 1 [0047.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab2d4d50, dwHighDateTime=0x1d585b4)) [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d75c0 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75c0 | out: hHeap=0x260000) returned 1 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332608 [0047.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.590] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.590] GetLastError () returned 0x0 [0047.590] GetLastError () returned 0x0 [0047.590] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.590] GetLastError () returned 0x0 [0047.590] GetLastError () returned 0x0 [0047.593] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffece2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.593] WriteFile (in: hFile=0xf8, lpBuffer=0x2ba238*, nNumberOfBytesToWrite=0x131e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2ba238*, lpNumberOfBytesWritten=0x238fdb0*=0x131e, lpOverlapped=0x0) returned 1 [0047.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba238 | out: hHeap=0x260000) returned 1 [0047.593] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.593] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.593] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.593] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.593] CloseHandle (hObject=0xf8) returned 1 [0047.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.594] GetLastError () returned 0x0 [0047.595] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.595] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.595] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.595] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16759651668) returned 1 [0047.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab2d4d50, dwHighDateTime=0x1d585b4)) [0047.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7588 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7588 | out: hHeap=0x260000) returned 1 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332ac8 [0047.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.596] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.596] GetLastError () returned 0x0 [0047.596] GetLastError () returned 0x0 [0047.596] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.596] GetLastError () returned 0x0 [0047.596] GetLastError () returned 0x0 [0047.598] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffeb01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.598] WriteFile (in: hFile=0xf8, lpBuffer=0x2ba238*, nNumberOfBytesToWrite=0x14ff, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2ba238*, lpNumberOfBytesWritten=0x238fdb0*=0x14ff, lpOverlapped=0x0) returned 1 [0047.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba238 | out: hHeap=0x260000) returned 1 [0047.598] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.598] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.598] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.598] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.598] CloseHandle (hObject=0xf8) returned 1 [0047.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.599] GetLastError () returned 0x0 [0047.599] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.600] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.600] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.600] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16760142794) returned 1 [0047.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab2faeb0, dwHighDateTime=0x1d585b4)) [0047.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7550 [0047.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7550 | out: hHeap=0x260000) returned 1 [0047.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332b60 [0047.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.601] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.601] GetLastError () returned 0x0 [0047.601] GetLastError () returned 0x0 [0047.601] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.601] GetLastError () returned 0x0 [0047.601] GetLastError () returned 0x0 [0047.603] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdbe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.603] WriteFile (in: hFile=0xf8, lpBuffer=0x2ba238*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2ba238*, lpNumberOfBytesWritten=0x238fdb0*=0x2420, lpOverlapped=0x0) returned 1 [0047.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba238 | out: hHeap=0x260000) returned 1 [0047.603] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.603] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.603] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.604] CloseHandle (hObject=0xf8) returned 1 [0047.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.604] GetLastError () returned 0x0 [0047.604] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.605] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.605] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.605] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16760740934) returned 1 [0047.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab2faeb0, dwHighDateTime=0x1d585b4)) [0047.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7518 [0047.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7518 | out: hHeap=0x260000) returned 1 [0047.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316df8 [0047.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.607] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.607] GetLastError () returned 0x0 [0047.607] GetLastError () returned 0x0 [0047.607] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.607] GetLastError () returned 0x0 [0047.607] GetLastError () returned 0x0 [0047.661] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.661] WriteFile (in: hFile=0xf8, lpBuffer=0x2ba238*, nNumberOfBytesToWrite=0x1398, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2ba238*, lpNumberOfBytesWritten=0x238fdb0*=0x1398, lpOverlapped=0x0) returned 1 [0047.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba238 | out: hHeap=0x260000) returned 1 [0047.663] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.663] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.663] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.663] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.663] CloseHandle (hObject=0xf8) returned 1 [0047.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.673] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.933] GetLastError () returned 0x0 [0047.934] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.934] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.934] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.935] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16793569602) returned 1 [0047.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab61ab90, dwHighDateTime=0x1d585b4)) [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7978 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7978 | out: hHeap=0x260000) returned 1 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31eaf0 [0047.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.935] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.935] GetLastError () returned 0x0 [0047.935] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.935] GetLastError () returned 0x0 [0047.938] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffed38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.938] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x12c8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x12c8, lpOverlapped=0x0) returned 1 [0047.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.939] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.939] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.939] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.939] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.939] CloseHandle (hObject=0xf8) returned 1 [0047.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.944] GetLastError () returned 0x0 [0047.945] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.945] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.946] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16794664725) returned 1 [0047.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab640cf0, dwHighDateTime=0x1d585b4)) [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7940 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7940 | out: hHeap=0x260000) returned 1 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320478 [0047.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.946] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.946] GetLastError () returned 0x0 [0047.946] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.946] GetLastError () returned 0x0 [0047.949] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.949] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1384, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1384, lpOverlapped=0x0) returned 1 [0047.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.949] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.949] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.949] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.949] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.949] CloseHandle (hObject=0xf8) returned 1 [0047.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.950] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.950] GetLastError () returned 0x0 [0047.950] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.951] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.951] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.951] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16795236484) returned 1 [0047.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab640cf0, dwHighDateTime=0x1d585b4)) [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0870 [0047.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0870 | out: hHeap=0x260000) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0047.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.952] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.952] GetLastError () returned 0x0 [0047.952] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.952] GetLastError () returned 0x0 [0047.953] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.954] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x138c, lpOverlapped=0x0) returned 1 [0047.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.954] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.954] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.954] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.954] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.954] CloseHandle (hObject=0xf8) returned 1 [0047.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.955] GetLastError () returned 0x0 [0047.955] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.956] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.956] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.956] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16795729004) returned 1 [0047.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab666e50, dwHighDateTime=0x1d585b4)) [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f08a8 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f08a8 | out: hHeap=0x260000) returned 1 [0047.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3205a8 [0047.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.957] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.957] GetLastError () returned 0x0 [0047.957] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.957] GetLastError () returned 0x0 [0047.958] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe328, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.958] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1cd8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1cd8, lpOverlapped=0x0) returned 1 [0047.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.958] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.959] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.959] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.959] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.959] CloseHandle (hObject=0xf8) returned 1 [0047.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0047.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.960] GetLastError () returned 0x0 [0047.960] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.961] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.961] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.961] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16796232345) returned 1 [0047.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab666e50, dwHighDateTime=0x1d585b4)) [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f08e0 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f08e0 | out: hHeap=0x260000) returned 1 [0047.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320640 [0047.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.962] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.962] GetLastError () returned 0x0 [0047.962] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.962] GetLastError () returned 0x0 [0047.963] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffecfa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.963] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1306, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1306, lpOverlapped=0x0) returned 1 [0047.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.964] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.964] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.964] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.964] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.964] CloseHandle (hObject=0xf8) returned 1 [0047.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.965] GetLastError () returned 0x0 [0047.965] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.966] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.966] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.966] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16796700084) returned 1 [0047.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab666e50, dwHighDateTime=0x1d585b4)) [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0918 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0918 | out: hHeap=0x260000) returned 1 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3206d8 [0047.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.966] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.966] GetLastError () returned 0x0 [0047.967] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.967] GetLastError () returned 0x0 [0047.968] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff96fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.968] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6906, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x6906, lpOverlapped=0x0) returned 1 [0047.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.968] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.968] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.969] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.969] CloseHandle (hObject=0xf8) returned 1 [0047.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.972] GetLastError () returned 0x0 [0047.972] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.973] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.973] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.973] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16797414376) returned 1 [0047.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab68cfb0, dwHighDateTime=0x1d585b4)) [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0950 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0950 | out: hHeap=0x260000) returned 1 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320770 [0047.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.974] GetLastError () returned 0x0 [0047.974] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.974] GetLastError () returned 0x0 [0047.975] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff8eec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.975] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7114, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x7114, lpOverlapped=0x0) returned 1 [0047.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.976] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.976] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.976] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.976] CloseHandle (hObject=0xf8) returned 1 [0047.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.977] GetLastError () returned 0x0 [0047.977] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.978] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.978] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16797889423) returned 1 [0047.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab68cfb0, dwHighDateTime=0x1d585b4)) [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0988 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0988 | out: hHeap=0x260000) returned 1 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320808 [0047.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.978] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.978] GetLastError () returned 0x0 [0047.978] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.978] GetLastError () returned 0x0 [0047.980] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd28c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.980] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2d74, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x2d74, lpOverlapped=0x0) returned 1 [0047.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.980] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.980] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.980] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.980] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.981] CloseHandle (hObject=0xf8) returned 1 [0047.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.981] GetLastError () returned 0x0 [0047.982] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.983] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.983] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.983] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16798400956) returned 1 [0047.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab68cfb0, dwHighDateTime=0x1d585b4)) [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f09c0 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f09c0 | out: hHeap=0x260000) returned 1 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3208a0 [0047.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.983] GetLastError () returned 0x0 [0047.984] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.984] GetLastError () returned 0x0 [0047.985] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffa80c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.985] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x57f4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x57f4, lpOverlapped=0x0) returned 1 [0047.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.985] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.985] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.986] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.986] CloseHandle (hObject=0xf8) returned 1 [0047.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.987] GetLastError () returned 0x0 [0047.987] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.988] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.988] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.988] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16798888494) returned 1 [0047.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab6b3110, dwHighDateTime=0x1d585b4)) [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f09f8 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f09f8 | out: hHeap=0x260000) returned 1 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320938 [0047.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.988] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.988] GetLastError () returned 0x0 [0047.988] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.988] GetLastError () returned 0x0 [0047.990] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc0cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.990] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3f34, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x3f34, lpOverlapped=0x0) returned 1 [0047.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.990] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.991] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.991] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.991] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.991] CloseHandle (hObject=0xf8) returned 1 [0047.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29efe0 [0047.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29efe0 | out: hHeap=0x260000) returned 1 [0047.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.992] GetLastError () returned 0x0 [0047.992] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0047.993] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.993] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0047.993] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16799389905) returned 1 [0047.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab6b3110, dwHighDateTime=0x1d585b4)) [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0a30 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0a30 | out: hHeap=0x260000) returned 1 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354308 [0047.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.993] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0047.993] GetLastError () returned 0x0 [0047.993] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0047.994] GetLastError () returned 0x0 [0047.998] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffbcac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.998] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4354, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x4354, lpOverlapped=0x0) returned 1 [0047.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.998] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.998] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.998] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.998] CloseHandle (hObject=0xf8) returned 1 [0047.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0047.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0047.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0047.999] GetLastError () returned 0x0 [0048.000] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.001] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.001] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.001] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16800186697) returned 1 [0048.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab6b3110, dwHighDateTime=0x1d585b4)) [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0aa0 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0aa0 | out: hHeap=0x260000) returned 1 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320af0 [0048.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.001] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.002] GetLastError () returned 0x0 [0048.002] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.002] GetLastError () returned 0x0 [0048.012] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffbedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.012] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x4124, lpOverlapped=0x0) returned 1 [0048.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.014] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.014] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.014] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.014] CloseHandle (hObject=0xf8) returned 1 [0048.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.015] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.015] GetLastError () returned 0x0 [0048.015] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.016] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.016] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.016] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16801744948) returned 1 [0048.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab6d9270, dwHighDateTime=0x1d585b4)) [0048.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b10 [0048.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b10 | out: hHeap=0x260000) returned 1 [0048.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321638 [0048.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.106] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.106] GetLastError () returned 0x0 [0048.106] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.106] GetLastError () returned 0x0 [0048.109] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffecc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.109] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x133c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x133c, lpOverlapped=0x0) returned 1 [0048.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.109] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.109] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.109] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.109] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.110] CloseHandle (hObject=0xf8) returned 1 [0048.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.111] GetLastError () returned 0x0 [0048.111] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.111] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.112] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.112] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16811279281) returned 1 [0048.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab7e3c10, dwHighDateTime=0x1d585b4)) [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ed8 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ed8 | out: hHeap=0x260000) returned 1 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320d50 [0048.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.112] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.112] GetLastError () returned 0x0 [0048.112] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.112] GetLastError () returned 0x0 [0048.114] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc76a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.114] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x3896, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x3896, lpOverlapped=0x0) returned 1 [0048.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.114] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.114] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.114] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.114] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.115] CloseHandle (hObject=0xf8) returned 1 [0048.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.115] GetLastError () returned 0x0 [0048.116] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.116] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.116] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.116] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16811756554) returned 1 [0048.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab7e3c10, dwHighDateTime=0x1d585b4)) [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8108 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8108 | out: hHeap=0x260000) returned 1 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321768 [0048.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.117] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.117] GetLastError () returned 0x0 [0048.117] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.117] GetLastError () returned 0x0 [0048.119] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.119] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x4780, lpOverlapped=0x0) returned 1 [0048.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.119] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.119] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.119] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.119] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.120] CloseHandle (hObject=0xf8) returned 1 [0048.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.120] GetLastError () returned 0x0 [0048.121] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.121] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.121] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.121] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16812253693) returned 1 [0048.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab7e3c10, dwHighDateTime=0x1d585b4)) [0048.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8060 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321800 [0048.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.122] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.122] GetLastError () returned 0x0 [0048.122] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.122] GetLastError () returned 0x0 [0048.123] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd4ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.124] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2b32, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x2b32, lpOverlapped=0x0) returned 1 [0048.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.124] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.124] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.124] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.124] CloseHandle (hObject=0xf8) returned 1 [0048.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.129] GetLastError () returned 0x0 [0048.129] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.130] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.130] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.130] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16813134042) returned 1 [0048.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab809d70, dwHighDateTime=0x1d585b4)) [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e58 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e58 | out: hHeap=0x260000) returned 1 [0048.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321898 [0048.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.131] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.131] GetLastError () returned 0x0 [0048.131] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.131] GetLastError () returned 0x0 [0048.133] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffcf18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.133] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x30e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x30e8, lpOverlapped=0x0) returned 1 [0048.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.133] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.133] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.133] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.133] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.133] CloseHandle (hObject=0xf8) returned 1 [0048.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.134] GetLastError () returned 0x0 [0048.135] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.136] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.136] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16813676936) returned 1 [0048.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab809d70, dwHighDateTime=0x1d585b4)) [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e90 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e90 | out: hHeap=0x260000) returned 1 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321930 [0048.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.136] GetLastError () returned 0x0 [0048.136] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.136] GetLastError () returned 0x0 [0048.138] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd9a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.138] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x265a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x265a, lpOverlapped=0x0) returned 1 [0048.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.138] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.138] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.138] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.138] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.139] CloseHandle (hObject=0xf8) returned 1 [0048.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.139] GetLastError () returned 0x0 [0048.140] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.140] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.140] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.141] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16814166890) returned 1 [0048.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab809d70, dwHighDateTime=0x1d585b4)) [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0ec8 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0ec8 | out: hHeap=0x260000) returned 1 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3219c8 [0048.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.141] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.141] GetLastError () returned 0x0 [0048.141] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.141] GetLastError () returned 0x0 [0048.184] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe14a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.184] WriteFile (in: hFile=0xf8, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1eb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x1eb6, lpOverlapped=0x0) returned 1 [0048.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0048.185] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.185] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.185] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.185] CloseHandle (hObject=0xf8) returned 1 [0048.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.209] GetLastError () returned 0x0 [0048.209] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.210] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.210] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.210] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16821126896) returned 1 [0048.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab8c8450, dwHighDateTime=0x1d585b4)) [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1130 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1130 | out: hHeap=0x260000) returned 1 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321a60 [0048.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.211] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.211] GetLastError () returned 0x0 [0048.211] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.211] GetLastError () returned 0x0 [0048.246] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc794, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.246] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x386c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x386c, lpOverlapped=0x0) returned 1 [0048.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.247] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.247] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.247] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.247] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.247] CloseHandle (hObject=0x10c) returned 1 [0048.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.248] GetLastError () returned 0x0 [0048.248] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.249] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.249] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.249] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16824983180) returned 1 [0048.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab914710, dwHighDateTime=0x1d585b4)) [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1280 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1280 | out: hHeap=0x260000) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3220e8 [0048.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.249] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.249] GetLastError () returned 0x0 [0048.249] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.249] GetLastError () returned 0x0 [0048.251] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe988, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.251] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1678, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1678, lpOverlapped=0x0) returned 1 [0048.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.251] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.251] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.252] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.252] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.252] CloseHandle (hObject=0x10c) returned 1 [0048.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.253] GetLastError () returned 0x0 [0048.253] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.254] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.254] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16825480207) returned 1 [0048.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab93a870, dwHighDateTime=0x1d585b4)) [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f12b8 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f12b8 | out: hHeap=0x260000) returned 1 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322478 [0048.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.254] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.254] GetLastError () returned 0x0 [0048.254] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.255] GetLastError () returned 0x0 [0048.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff5ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.258] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xa54, lpOverlapped=0x0) returned 1 [0048.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.258] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.258] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.258] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.258] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.258] CloseHandle (hObject=0x10c) returned 1 [0048.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.259] GetLastError () returned 0x0 [0048.259] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.260] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.260] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.260] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16826131271) returned 1 [0048.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab93a870, dwHighDateTime=0x1d585b4)) [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f12f0 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f12f0 | out: hHeap=0x260000) returned 1 [0048.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322510 [0048.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.261] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.261] GetLastError () returned 0x0 [0048.261] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.261] GetLastError () returned 0x0 [0048.263] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffeb68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.263] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1498, lpOverlapped=0x0) returned 1 [0048.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.264] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.264] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.264] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.264] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.264] CloseHandle (hObject=0x10c) returned 1 [0048.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.265] GetLastError () returned 0x0 [0048.266] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.266] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.266] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.267] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16826769304) returned 1 [0048.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab9609d0, dwHighDateTime=0x1d585b4)) [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1328 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1328 | out: hHeap=0x260000) returned 1 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3225a8 [0048.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.267] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.267] GetLastError () returned 0x0 [0048.267] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.275] GetLastError () returned 0x0 [0048.287] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.287] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xbc8, lpOverlapped=0x0) returned 1 [0048.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.287] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.287] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.287] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.287] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.288] CloseHandle (hObject=0x10c) returned 1 [0048.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.288] GetLastError () returned 0x0 [0048.291] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.292] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.292] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.292] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16829341356) returned 1 [0048.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab986b30, dwHighDateTime=0x1d585b4)) [0048.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1408 [0048.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1408 | out: hHeap=0x260000) returned 1 [0048.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322640 [0048.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.293] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.293] GetLastError () returned 0x0 [0048.293] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.293] GetLastError () returned 0x0 [0048.294] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffccd2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.294] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x332e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x332e, lpOverlapped=0x0) returned 1 [0048.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.295] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.295] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.295] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.295] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.295] CloseHandle (hObject=0x100) returned 1 [0048.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.296] GetLastError () returned 0x0 [0048.296] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.297] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.297] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16829816639) returned 1 [0048.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab986b30, dwHighDateTime=0x1d585b4)) [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1440 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1440 | out: hHeap=0x260000) returned 1 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3228a0 [0048.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.298] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.298] GetLastError () returned 0x0 [0048.298] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.298] GetLastError () returned 0x0 [0048.299] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff9656, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.300] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x69aa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x69aa, lpOverlapped=0x0) returned 1 [0048.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.300] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.300] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.300] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.300] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.300] CloseHandle (hObject=0x100) returned 1 [0048.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.301] GetLastError () returned 0x0 [0048.301] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.302] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.302] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.302] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16830329097) returned 1 [0048.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab9acc90, dwHighDateTime=0x1d585b4)) [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1478 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1478 | out: hHeap=0x260000) returned 1 [0048.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322938 [0048.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.303] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.303] GetLastError () returned 0x0 [0048.303] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.303] GetLastError () returned 0x0 [0048.304] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe4ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.304] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1b54, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1b54, lpOverlapped=0x0) returned 1 [0048.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.304] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.305] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.305] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.305] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.305] CloseHandle (hObject=0x100) returned 1 [0048.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.306] GetLastError () returned 0x0 [0048.306] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.307] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.307] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.307] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16830791045) returned 1 [0048.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xab9acc90, dwHighDateTime=0x1d585b4)) [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7f80 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f80 | out: hHeap=0x260000) returned 1 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354308 [0048.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.307] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.307] GetLastError () returned 0x0 [0048.307] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.308] GetLastError () returned 0x0 [0048.405] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffda8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.405] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2576, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x2576, lpOverlapped=0x0) returned 1 [0048.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.405] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.405] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.405] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.405] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.406] CloseHandle (hObject=0x100) returned 1 [0048.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.406] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.409] GetLastError () returned 0x0 [0048.409] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.410] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.410] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.410] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16841124485) returned 1 [0048.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabab7630, dwHighDateTime=0x1d585b4)) [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d87f0 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d87f0 | out: hHeap=0x260000) returned 1 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323210 [0048.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.411] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.411] GetLastError () returned 0x0 [0048.411] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.411] GetLastError () returned 0x0 [0048.412] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.412] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x634, lpOverlapped=0x0) returned 1 [0048.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.413] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.413] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.413] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.413] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.413] CloseHandle (hObject=0x100) returned 1 [0048.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.414] GetLastError () returned 0x0 [0048.414] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.415] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.415] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.416] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16841674216) returned 1 [0048.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabab7630, dwHighDateTime=0x1d585b4)) [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8828 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8828 | out: hHeap=0x260000) returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323340 [0048.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.416] GetLastError () returned 0x0 [0048.416] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.417] GetLastError () returned 0x0 [0048.418] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffb44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.418] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4bc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x4bc, lpOverlapped=0x0) returned 1 [0048.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.419] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.419] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.419] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.420] CloseHandle (hObject=0x100) returned 1 [0048.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.421] GetLastError () returned 0x0 [0048.422] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.423] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.423] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.423] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16842447185) returned 1 [0048.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabadd790, dwHighDateTime=0x1d585b4)) [0048.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8860 [0048.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8860 | out: hHeap=0x260000) returned 1 [0048.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3233d8 [0048.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.424] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.424] GetLastError () returned 0x0 [0048.424] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.424] GetLastError () returned 0x0 [0048.425] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.426] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x804, lpOverlapped=0x0) returned 1 [0048.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.426] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.426] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.426] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.426] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.426] CloseHandle (hObject=0x100) returned 1 [0048.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.427] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.428] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.428] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.428] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.428] GetLastError () returned 0x0 [0048.430] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffea34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.430] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x15cc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x15cc, lpOverlapped=0x0) returned 1 [0048.430] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.430] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.430] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.430] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.430] CloseHandle (hObject=0x100) returned 1 [0048.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.431] GetLastError () returned 0x0 [0048.431] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.432] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.432] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.432] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16843347689) returned 1 [0048.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabadd790, dwHighDateTime=0x1d585b4)) [0048.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d88d0 [0048.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d88d0 | out: hHeap=0x260000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323508 [0048.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.433] GetLastError () returned 0x0 [0048.433] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.433] GetLastError () returned 0x0 [0048.434] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff23c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.434] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xdc4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xdc4, lpOverlapped=0x0) returned 1 [0048.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.435] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.435] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.435] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.435] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.435] CloseHandle (hObject=0x100) returned 1 [0048.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.436] GetLastError () returned 0x0 [0048.436] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.437] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.437] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.437] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16843803211) returned 1 [0048.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabadd790, dwHighDateTime=0x1d585b4)) [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8908 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8908 | out: hHeap=0x260000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3235a0 [0048.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.437] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.438] GetLastError () returned 0x0 [0048.438] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.438] GetLastError () returned 0x0 [0048.522] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.522] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x9b8, lpOverlapped=0x0) returned 1 [0048.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.524] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.524] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.524] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.524] CloseHandle (hObject=0x100) returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.532] GetLastError () returned 0x0 [0048.533] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x335158) returned 1 [0048.534] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.534] CryptReleaseContext (hProv=0x335158, dwFlags=0x0) returned 1 [0048.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.534] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16853501016) returned 1 [0048.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabbe8130, dwHighDateTime=0x1d585b4)) [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8c50 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8c50 | out: hHeap=0x260000) returned 1 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331c88 [0048.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.534] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.535] GetLastError () returned 0x0 [0048.535] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.535] GetLastError () returned 0x0 [0048.537] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff72a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.537] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8d6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x8d6, lpOverlapped=0x0) returned 1 [0048.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.538] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.538] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.538] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.538] CloseHandle (hObject=0x100) returned 1 [0048.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0048.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0048.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.539] GetLastError () returned 0x0 [0048.539] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.540] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.540] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.540] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16854110666) returned 1 [0048.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabbe8130, dwHighDateTime=0x1d585b4)) [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8c88 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8c88 | out: hHeap=0x260000) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323638 [0048.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.541] GetLastError () returned 0x0 [0048.541] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.541] GetLastError () returned 0x0 [0048.542] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe4c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.542] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1b3a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1b3a, lpOverlapped=0x0) returned 1 [0048.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.543] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.543] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.543] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.543] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.543] CloseHandle (hObject=0x100) returned 1 [0048.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0048.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0048.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0048.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.544] GetLastError () returned 0x0 [0048.545] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.545] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.546] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16854666486) returned 1 [0048.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabbe8130, dwHighDateTime=0x1d585b4)) [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8cc0 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8cc0 | out: hHeap=0x260000) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323fb8 [0048.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.546] GetLastError () returned 0x0 [0048.546] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.546] GetLastError () returned 0x0 [0048.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffeb6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.548] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1496, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1496, lpOverlapped=0x0) returned 1 [0048.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.548] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.548] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.548] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.548] CloseHandle (hObject=0x100) returned 1 [0048.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.549] GetLastError () returned 0x0 [0048.551] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0048.552] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.552] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.552] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16855323702) returned 1 [0048.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabc0e290, dwHighDateTime=0x1d585b4)) [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8d30 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8d30 | out: hHeap=0x260000) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332440 [0048.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.553] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.553] GetLastError () returned 0x0 [0048.553] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.553] GetLastError () returned 0x0 [0048.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff3e76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.554] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc18a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xc18a, lpOverlapped=0x0) returned 1 [0048.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.555] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.555] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.555] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.555] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.555] CloseHandle (hObject=0x10c) returned 1 [0048.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.555] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.556] GetLastError () returned 0x0 [0048.557] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0048.558] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.558] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.558] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16855881611) returned 1 [0048.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabc0e290, dwHighDateTime=0x1d585b4)) [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9b78 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9b78 | out: hHeap=0x260000) returned 1 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3240e8 [0048.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.558] GetLastError () returned 0x0 [0048.558] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.558] GetLastError () returned 0x0 [0048.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd7aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.560] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2856, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x2856, lpOverlapped=0x0) returned 1 [0048.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.560] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.560] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.561] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.561] CloseHandle (hObject=0x10c) returned 1 [0048.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.562] GetLastError () returned 0x0 [0048.562] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0048.563] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.563] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.563] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16856460081) returned 1 [0048.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabc343f0, dwHighDateTime=0x1d585b4)) [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8da0 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8da0 | out: hHeap=0x260000) returned 1 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324180 [0048.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.564] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.564] GetLastError () returned 0x0 [0048.564] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.564] GetLastError () returned 0x0 [0048.566] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff866e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.566] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x7992, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x7992, lpOverlapped=0x0) returned 1 [0048.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.566] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.566] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.567] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.567] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.567] CloseHandle (hObject=0x10c) returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.568] GetLastError () returned 0x0 [0048.577] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3128b8) returned 1 [0048.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.599] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.599] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16860025295) returned 1 [0048.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabc806b0, dwHighDateTime=0x1d585b4)) [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8eb8 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8eb8 | out: hHeap=0x260000) returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324510 [0048.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.600] GetLastError () returned 0x0 [0048.600] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.600] GetLastError () returned 0x0 [0048.745] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdfc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.751] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x2040, lpOverlapped=0x0) returned 1 [0048.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.761] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.761] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.762] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.762] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.762] CloseHandle (hObject=0x100) returned 1 [0048.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.763] GetLastError () returned 0x0 [0048.763] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.764] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.764] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.764] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16876486230) returned 1 [0048.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabdfd470, dwHighDateTime=0x1d585b4)) [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9350 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9350 | out: hHeap=0x260000) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325340 [0048.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.764] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.764] GetLastError () returned 0x0 [0048.764] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.764] GetLastError () returned 0x0 [0048.766] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.766] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x8fc, lpOverlapped=0x0) returned 1 [0048.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.766] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.767] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.767] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.767] CloseHandle (hObject=0x100) returned 1 [0048.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.768] GetLastError () returned 0x0 [0048.769] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.769] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.769] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.770] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16877071208) returned 1 [0048.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabe235d0, dwHighDateTime=0x1d585b4)) [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9388 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9388 | out: hHeap=0x260000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325470 [0048.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.770] GetLastError () returned 0x0 [0048.770] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.770] GetLastError () returned 0x0 [0048.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.772] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x820, lpOverlapped=0x0) returned 1 [0048.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.772] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.772] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.773] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.773] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.773] CloseHandle (hObject=0x100) returned 1 [0048.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.774] GetLastError () returned 0x0 [0048.774] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.774] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.774] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.775] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16877575785) returned 1 [0048.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabe235d0, dwHighDateTime=0x1d585b4)) [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d93c0 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d93c0 | out: hHeap=0x260000) returned 1 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325508 [0048.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.775] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.775] GetLastError () returned 0x0 [0048.775] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.775] GetLastError () returned 0x0 [0048.777] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.777] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x820, lpOverlapped=0x0) returned 1 [0048.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.777] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.777] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.777] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.777] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.778] CloseHandle (hObject=0x100) returned 1 [0048.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.778] GetLastError () returned 0x0 [0048.779] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.779] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.779] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.779] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16878059065) returned 1 [0048.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabe235d0, dwHighDateTime=0x1d585b4)) [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d93f8 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d93f8 | out: hHeap=0x260000) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3255a0 [0048.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.780] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.780] GetLastError () returned 0x0 [0048.780] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.780] GetLastError () returned 0x0 [0048.782] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff82c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.782] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x7d4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x7d4, lpOverlapped=0x0) returned 1 [0048.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.782] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.782] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.782] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.782] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.782] CloseHandle (hObject=0x100) returned 1 [0048.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.783] GetLastError () returned 0x0 [0048.784] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.785] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.785] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.785] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16878601615) returned 1 [0048.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabe49730, dwHighDateTime=0x1d585b4)) [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7c18 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c18 | out: hHeap=0x260000) returned 1 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325638 [0048.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.785] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.786] GetLastError () returned 0x0 [0048.786] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.786] GetLastError () returned 0x0 [0048.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.787] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x7e4, lpOverlapped=0x0) returned 1 [0048.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.787] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.788] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.788] CloseHandle (hObject=0x100) returned 1 [0048.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.789] GetLastError () returned 0x0 [0048.789] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.790] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.790] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16879085476) returned 1 [0048.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabe49730, dwHighDateTime=0x1d585b4)) [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7be0 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7be0 | out: hHeap=0x260000) returned 1 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3256d0 [0048.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.790] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.790] GetLastError () returned 0x0 [0048.790] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.790] GetLastError () returned 0x0 [0048.792] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff69c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.792] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x964, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x964, lpOverlapped=0x0) returned 1 [0048.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.792] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.792] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.792] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.792] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.793] CloseHandle (hObject=0x100) returned 1 [0048.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.793] GetLastError () returned 0x0 [0048.794] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0048.794] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.794] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.794] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16879560493) returned 1 [0048.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabe49730, dwHighDateTime=0x1d585b4)) [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ba8 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ba8 | out: hHeap=0x260000) returned 1 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325768 [0048.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.795] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.795] GetLastError () returned 0x0 [0048.795] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.795] GetLastError () returned 0x0 [0048.873] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.873] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x804, lpOverlapped=0x0) returned 1 [0048.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.873] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.873] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.873] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.873] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.873] CloseHandle (hObject=0x100) returned 1 [0048.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.947] GetLastError () returned 0x0 [0048.947] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.948] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.948] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.948] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16894910204) returned 1 [0048.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabfc64f0, dwHighDateTime=0x1d585b4)) [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326d90 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326d90 | out: hHeap=0x260000) returned 1 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325800 [0048.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.949] GetLastError () returned 0x0 [0048.949] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.949] GetLastError () returned 0x0 [0048.952] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff574, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.952] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa8c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xa8c, lpOverlapped=0x0) returned 1 [0048.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.952] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.952] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.952] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.952] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.953] CloseHandle (hObject=0x100) returned 1 [0048.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.953] GetLastError () returned 0x0 [0048.954] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.954] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.954] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0048.955] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16895576620) returned 1 [0048.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabfec650, dwHighDateTime=0x1d585b4)) [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326dc8 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326dc8 | out: hHeap=0x260000) returned 1 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3266d8 [0048.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.955] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.955] GetLastError () returned 0x0 [0048.955] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.956] GetLastError () returned 0x0 [0048.957] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.957] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1b2e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1b2e, lpOverlapped=0x0) returned 1 [0048.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.957] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.957] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.958] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.958] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.958] CloseHandle (hObject=0x100) returned 1 [0048.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0048.959] GetLastError () returned 0x0 [0048.961] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.961] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.961] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.961] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16896257199) returned 1 [0048.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabfec650, dwHighDateTime=0x1d585b4)) [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326e38 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326e38 | out: hHeap=0x260000) returned 1 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3253d8 [0048.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.962] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.962] GetLastError () returned 0x0 [0048.962] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.962] GetLastError () returned 0x0 [0048.964] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.964] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x3670, lpOverlapped=0x0) returned 1 [0048.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.964] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.964] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.964] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.964] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.964] CloseHandle (hObject=0x10c) returned 1 [0048.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.965] GetLastError () returned 0x0 [0048.965] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.966] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.966] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.966] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16896748378) returned 1 [0048.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xabfec650, dwHighDateTime=0x1d585b4)) [0048.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326e70 [0048.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326e70 | out: hHeap=0x260000) returned 1 [0048.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326808 [0048.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.967] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.967] GetLastError () returned 0x0 [0048.967] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.967] GetLastError () returned 0x0 [0048.968] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffcfbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.969] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3044, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x3044, lpOverlapped=0x0) returned 1 [0048.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.969] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.969] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.969] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.969] CloseHandle (hObject=0x10c) returned 1 [0048.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.970] GetLastError () returned 0x0 [0048.971] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.971] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.971] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.972] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16897272214) returned 1 [0048.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac0127b0, dwHighDateTime=0x1d585b4)) [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ea8 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ea8 | out: hHeap=0x260000) returned 1 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326938 [0048.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.972] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.972] GetLastError () returned 0x0 [0048.972] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.972] GetLastError () returned 0x0 [0048.976] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe584, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.976] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1a7c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1a7c, lpOverlapped=0x0) returned 1 [0048.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.976] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.976] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.976] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.976] CloseHandle (hObject=0x10c) returned 1 [0048.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.977] GetLastError () returned 0x0 [0048.977] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0048.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.978] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.978] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16897948406) returned 1 [0048.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac0127b0, dwHighDateTime=0x1d585b4)) [0048.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ee0 [0048.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ee0 | out: hHeap=0x260000) returned 1 [0048.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3209d0 [0048.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0048.979] GetLastError () returned 0x0 [0048.979] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0048.979] GetLastError () returned 0x0 [0049.060] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff718, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.071] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x8e8, lpOverlapped=0x0) returned 1 [0049.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.087] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.087] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.087] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.087] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.087] CloseHandle (hObject=0x10c) returned 1 [0049.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.090] GetLastError () returned 0x0 [0049.091] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.091] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.091] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.092] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16909271371) returned 1 [0049.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac11d150, dwHighDateTime=0x1d585b4)) [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3272d0 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3272d0 | out: hHeap=0x260000) returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eb8c0 [0049.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.092] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.092] GetLastError () returned 0x0 [0049.092] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.092] GetLastError () returned 0x0 [0049.094] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdf18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.094] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x20e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x20e8, lpOverlapped=0x0) returned 1 [0049.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.094] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.094] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.094] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.094] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.095] CloseHandle (hObject=0x10c) returned 1 [0049.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.095] GetLastError () returned 0x0 [0049.096] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.096] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.096] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.097] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16909766806) returned 1 [0049.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac1432b0, dwHighDateTime=0x1d585b4)) [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327308 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327308 | out: hHeap=0x260000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335a38 [0049.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec370 [0049.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335a38 | out: hHeap=0x260000) returned 1 [0049.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.097] GetLastError () returned 0x0 [0049.097] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.097] GetLastError () returned 0x0 [0049.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd5c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.099] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x2a40, lpOverlapped=0x0) returned 1 [0049.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.099] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.099] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.099] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.099] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.099] CloseHandle (hObject=0x10c) returned 1 [0049.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.100] GetLastError () returned 0x0 [0049.100] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.101] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.101] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.101] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16910242037) returned 1 [0049.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac1432b0, dwHighDateTime=0x1d585b4)) [0049.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2945d0 [0049.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2945d0 | out: hHeap=0x260000) returned 1 [0049.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec408 [0049.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.102] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.102] GetLastError () returned 0x0 [0049.102] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.102] GetLastError () returned 0x0 [0049.105] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe13a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.105] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1ec6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1ec6, lpOverlapped=0x0) returned 1 [0049.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.106] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.106] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.106] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.106] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.106] CloseHandle (hObject=0x10c) returned 1 [0049.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.107] GetLastError () returned 0x0 [0049.108] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.108] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.108] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0049.109] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16910974722) returned 1 [0049.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac1432b0, dwHighDateTime=0x1d585b4)) [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3270a0 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3270a0 | out: hHeap=0x260000) returned 1 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3360c8 [0049.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec4a0 [0049.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3360c8 | out: hHeap=0x260000) returned 1 [0049.109] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.109] GetLastError () returned 0x0 [0049.110] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.110] GetLastError () returned 0x0 [0049.111] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.111] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2afa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x2afa, lpOverlapped=0x0) returned 1 [0049.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.111] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.111] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.112] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.112] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.112] CloseHandle (hObject=0x10c) returned 1 [0049.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.113] GetLastError () returned 0x0 [0049.139] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.140] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.140] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.140] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16914134941) returned 1 [0049.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac1b56d0, dwHighDateTime=0x1d585b4)) [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327378 [0049.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327378 | out: hHeap=0x260000) returned 1 [0049.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec2d8 [0049.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.141] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.141] GetLastError () returned 0x0 [0049.141] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.141] GetLastError () returned 0x0 [0049.148] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.148] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x400c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x400c, lpOverlapped=0x0) returned 1 [0049.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.150] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.150] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.150] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.150] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.150] CloseHandle (hObject=0x104) returned 1 [0049.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.386] GetLastError () returned 0x0 [0049.581] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.602] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.602] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16960338236) returned 1 [0049.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac605eb0, dwHighDateTime=0x1d585b4)) [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329bd0 [0049.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329bd0 | out: hHeap=0x260000) returned 1 [0049.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3285a0 [0049.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.603] GetLastError () returned 0x0 [0049.603] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.603] GetLastError () returned 0x0 [0049.605] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff084, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.605] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xf7c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0xf7c, lpOverlapped=0x0) returned 1 [0049.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.606] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.606] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.606] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.606] CloseHandle (hObject=0x108) returned 1 [0049.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.607] GetLastError () returned 0x0 [0049.607] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.608] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.608] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16960958821) returned 1 [0049.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac62c010, dwHighDateTime=0x1d585b4)) [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329c08 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329c08 | out: hHeap=0x260000) returned 1 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3285a0 [0049.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.609] GetLastError () returned 0x0 [0049.609] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.609] GetLastError () returned 0x0 [0049.611] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.611] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x5f8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x5f8, lpOverlapped=0x0) returned 1 [0049.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.611] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.611] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.611] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.611] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.611] CloseHandle (hObject=0x108) returned 1 [0049.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.612] GetLastError () returned 0x0 [0049.613] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.614] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.614] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.614] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16961492702) returned 1 [0049.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac62c010, dwHighDateTime=0x1d585b4)) [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329c40 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329c40 | out: hHeap=0x260000) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3286d0 [0049.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.614] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.614] GetLastError () returned 0x0 [0049.615] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.615] GetLastError () returned 0x0 [0049.616] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff31e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.616] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xce2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0xce2, lpOverlapped=0x0) returned 1 [0049.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.616] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.616] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.617] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.617] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.617] CloseHandle (hObject=0x108) returned 1 [0049.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.618] GetLastError () returned 0x0 [0049.618] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.619] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.619] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16962002217) returned 1 [0049.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac62c010, dwHighDateTime=0x1d585b4)) [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329c78 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329c78 | out: hHeap=0x260000) returned 1 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328768 [0049.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.620] GetLastError () returned 0x0 [0049.620] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.620] GetLastError () returned 0x0 [0049.621] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.621] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x332, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x332, lpOverlapped=0x0) returned 1 [0049.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.621] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.621] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.622] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.622] CloseHandle (hObject=0x108) returned 1 [0049.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.623] GetLastError () returned 0x0 [0049.623] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.624] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.624] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.624] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16962564151) returned 1 [0049.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac652170, dwHighDateTime=0x1d585b4)) [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329cb0 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329cb0 | out: hHeap=0x260000) returned 1 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328800 [0049.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.625] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.625] GetLastError () returned 0x0 [0049.625] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.625] GetLastError () returned 0x0 [0049.627] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc6a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.627] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x3960, lpOverlapped=0x0) returned 1 [0049.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.628] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.628] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.628] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.628] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.628] CloseHandle (hObject=0x108) returned 1 [0049.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.629] GetLastError () returned 0x0 [0049.629] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.630] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.630] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16963121158) returned 1 [0049.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac652170, dwHighDateTime=0x1d585b4)) [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ce8 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ce8 | out: hHeap=0x260000) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328898 [0049.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.631] GetLastError () returned 0x0 [0049.631] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.631] GetLastError () returned 0x0 [0049.632] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffcb1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.632] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x34e2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x34e2, lpOverlapped=0x0) returned 1 [0049.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0049.633] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.633] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.633] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.633] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.633] CloseHandle (hObject=0x108) returned 1 [0049.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.634] GetLastError () returned 0x0 [0049.697] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.777] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.777] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16977835400) returned 1 [0049.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac7a8dd0, dwHighDateTime=0x1d585b4)) [0049.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc00 [0049.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x260000) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329478 [0049.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.778] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.778] GetLastError () returned 0x0 [0049.778] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.778] GetLastError () returned 0x0 [0049.780] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe95a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.780] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x16a6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x16a6, lpOverlapped=0x0) returned 1 [0049.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.780] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.780] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.781] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.781] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.781] CloseHandle (hObject=0x108) returned 1 [0049.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.787] GetLastError () returned 0x0 [0049.788] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.789] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.789] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.789] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16979001362) returned 1 [0049.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac7cef30, dwHighDateTime=0x1d585b4)) [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdf8 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdf8 | out: hHeap=0x260000) returned 1 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3289c8 [0049.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.789] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.790] GetLastError () returned 0x0 [0049.790] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.790] GetLastError () returned 0x0 [0049.791] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.791] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x47c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x47c, lpOverlapped=0x0) returned 1 [0049.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.791] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.791] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.792] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.792] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.792] CloseHandle (hObject=0x108) returned 1 [0049.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.793] GetLastError () returned 0x0 [0049.793] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.794] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.794] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.794] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16979490505) returned 1 [0049.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac7cef30, dwHighDateTime=0x1d585b4)) [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdc0 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdc0 | out: hHeap=0x260000) returned 1 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3295a8 [0049.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.794] GetLastError () returned 0x0 [0049.794] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.795] GetLastError () returned 0x0 [0049.796] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff53c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.796] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0xac4, lpOverlapped=0x0) returned 1 [0049.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.796] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.797] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.797] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.797] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.797] CloseHandle (hObject=0x108) returned 1 [0049.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.798] GetLastError () returned 0x0 [0049.798] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.799] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.799] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.799] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16980015217) returned 1 [0049.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac7f5090, dwHighDateTime=0x1d585b4)) [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329f88 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329f88 | out: hHeap=0x260000) returned 1 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329640 [0049.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.800] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.800] GetLastError () returned 0x0 [0049.800] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.800] GetLastError () returned 0x0 [0049.802] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.802] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x4f4, lpOverlapped=0x0) returned 1 [0049.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.802] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.802] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.802] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.802] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.803] CloseHandle (hObject=0x108) returned 1 [0049.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.803] GetLastError () returned 0x0 [0049.804] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.804] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.804] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16980558082) returned 1 [0049.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac7f5090, dwHighDateTime=0x1d585b4)) [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329fc0 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329fc0 | out: hHeap=0x260000) returned 1 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3296d8 [0049.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.805] GetLastError () returned 0x0 [0049.805] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.805] GetLastError () returned 0x0 [0049.807] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffec78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.807] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1388, lpOverlapped=0x0) returned 1 [0049.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.807] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.807] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.807] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.808] CloseHandle (hObject=0x108) returned 1 [0049.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0049.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0049.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.808] GetLastError () returned 0x0 [0049.809] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.810] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.810] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.810] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16981112378) returned 1 [0049.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac7f5090, dwHighDateTime=0x1d585b4)) [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ff8 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ff8 | out: hHeap=0x260000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329770 [0049.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.811] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.811] GetLastError () returned 0x0 [0049.811] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.811] GetLastError () returned 0x0 [0049.825] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe354, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.825] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1cac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x238fdb0*=0x1cac, lpOverlapped=0x0) returned 1 [0049.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.826] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.826] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.826] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.826] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.826] CloseHandle (hObject=0x108) returned 1 [0049.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.930] GetLastError () returned 0x0 [0049.930] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.931] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.931] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.932] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16993275094) returned 1 [0049.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac925b90, dwHighDateTime=0x1d585b4)) [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a3e8 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a3e8 | out: hHeap=0x260000) returned 1 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b210 [0049.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.932] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.932] GetLastError () returned 0x0 [0049.932] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.933] GetLastError () returned 0x0 [0049.937] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffef358, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.937] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x10ca8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x10ca8, lpOverlapped=0x0) returned 1 [0049.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.938] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.938] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.938] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.938] CloseHandle (hObject=0x108) returned 1 [0049.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.940] GetLastError () returned 0x0 [0049.940] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.941] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.941] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.941] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16994209825) returned 1 [0049.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac94bcf0, dwHighDateTime=0x1d585b4)) [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a420 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a420 | out: hHeap=0x260000) returned 1 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b340 [0049.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.942] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.942] GetLastError () returned 0x0 [0049.942] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.942] GetLastError () returned 0x0 [0049.944] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe3f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.944] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1c0a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1c0a, lpOverlapped=0x0) returned 1 [0049.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.944] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.944] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.944] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.944] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.945] CloseHandle (hObject=0x108) returned 1 [0049.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0049.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.946] GetLastError () returned 0x0 [0049.947] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.948] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.948] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.948] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16994896729) returned 1 [0049.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac94bcf0, dwHighDateTime=0x1d585b4)) [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a458 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a458 | out: hHeap=0x260000) returned 1 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b3d8 [0049.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.949] GetLastError () returned 0x0 [0049.949] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.949] GetLastError () returned 0x0 [0049.952] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffb7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.952] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x486, lpOverlapped=0x0) returned 1 [0049.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.953] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.953] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.953] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.953] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.954] CloseHandle (hObject=0x108) returned 1 [0049.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.954] GetLastError () returned 0x0 [0049.955] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.955] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.955] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.955] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16995662138) returned 1 [0049.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac971e50, dwHighDateTime=0x1d585b4)) [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a490 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a490 | out: hHeap=0x260000) returned 1 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b470 [0049.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.956] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.956] GetLastError () returned 0x0 [0049.956] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.956] GetLastError () returned 0x0 [0049.958] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffce8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.958] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x318, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x318, lpOverlapped=0x0) returned 1 [0049.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.958] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.958] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.958] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.958] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.959] CloseHandle (hObject=0x108) returned 1 [0049.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.960] GetLastError () returned 0x0 [0049.960] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0049.961] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.961] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.961] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=16996181614) returned 1 [0049.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xac971e50, dwHighDateTime=0x1d585b4)) [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a4c8 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a4c8 | out: hHeap=0x260000) returned 1 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b508 [0049.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.961] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0049.961] GetLastError () returned 0x0 [0049.961] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0049.962] GetLastError () returned 0x0 [0050.032] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffbce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.032] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x432, lpOverlapped=0x0) returned 1 [0050.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.034] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.034] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.034] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.034] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.034] CloseHandle (hObject=0x108) returned 1 [0050.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.086] GetLastError () returned 0x0 [0050.086] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.087] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.087] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.087] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17008786381) returned 1 [0050.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacaa2950, dwHighDateTime=0x1d585b4)) [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a880 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a880 | out: hHeap=0x260000) returned 1 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b5a0 [0050.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.087] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.087] GetLastError () returned 0x0 [0050.087] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.088] GetLastError () returned 0x0 [0050.089] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb246, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.089] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4dba, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x4dba, lpOverlapped=0x0) returned 1 [0050.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.090] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.090] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.090] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.090] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.090] CloseHandle (hObject=0x108) returned 1 [0050.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.091] GetLastError () returned 0x0 [0050.091] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.092] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.092] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.092] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17009328283) returned 1 [0050.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacac8ab0, dwHighDateTime=0x1d585b4)) [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a8b8 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a8b8 | out: hHeap=0x260000) returned 1 [0050.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bfb8 [0050.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.093] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.093] GetLastError () returned 0x0 [0050.093] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.093] GetLastError () returned 0x0 [0050.094] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc2c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.094] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x3d40, lpOverlapped=0x0) returned 1 [0050.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.095] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.095] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.095] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.095] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.095] CloseHandle (hObject=0x108) returned 1 [0050.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.096] GetLastError () returned 0x0 [0050.097] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.097] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.097] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.098] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17009867704) returned 1 [0050.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacac8ab0, dwHighDateTime=0x1d585b4)) [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a8f0 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a8f0 | out: hHeap=0x260000) returned 1 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c050 [0050.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.098] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.098] GetLastError () returned 0x0 [0050.098] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.098] GetLastError () returned 0x0 [0050.100] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffacec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.100] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5314, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x5314, lpOverlapped=0x0) returned 1 [0050.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.100] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.100] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.101] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.101] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.101] CloseHandle (hObject=0x108) returned 1 [0050.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.101] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.102] GetLastError () returned 0x0 [0050.102] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.103] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.103] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.103] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17010393735) returned 1 [0050.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacac8ab0, dwHighDateTime=0x1d585b4)) [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a928 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a928 | out: hHeap=0x260000) returned 1 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c0e8 [0050.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.103] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.103] GetLastError () returned 0x0 [0050.104] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.104] GetLastError () returned 0x0 [0050.105] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff48a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.105] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xb758, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xb758, lpOverlapped=0x0) returned 1 [0050.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.106] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.106] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.106] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.106] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.106] CloseHandle (hObject=0x108) returned 1 [0050.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0050.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0050.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.108] GetLastError () returned 0x0 [0050.108] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.109] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.109] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.109] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17011051284) returned 1 [0050.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacaeec10, dwHighDateTime=0x1d585b4)) [0050.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a960 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a960 | out: hHeap=0x260000) returned 1 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c180 [0050.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.110] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.110] GetLastError () returned 0x0 [0050.110] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.110] GetLastError () returned 0x0 [0050.112] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.112] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x3d90, lpOverlapped=0x0) returned 1 [0050.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.112] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.112] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.113] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.113] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.113] CloseHandle (hObject=0x108) returned 1 [0050.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0050.113] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0050.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.114] GetLastError () returned 0x0 [0050.114] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.115] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.115] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.115] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17011642230) returned 1 [0050.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacaeec10, dwHighDateTime=0x1d585b4)) [0050.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0050.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0050.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0050.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a998 [0050.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a998 | out: hHeap=0x260000) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c218 [0050.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.116] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.116] GetLastError () returned 0x0 [0050.116] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.116] GetLastError () returned 0x0 [0050.214] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff91cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.215] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6e34, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x6e34, lpOverlapped=0x0) returned 1 [0050.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.215] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.215] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.216] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.216] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.216] CloseHandle (hObject=0x108) returned 1 [0050.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0050.217] GetLastError () returned 0x0 [0050.398] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.399] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.399] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.400] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17040064025) returned 1 [0050.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacd9c4d0, dwHighDateTime=0x1d585b4)) [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d1f0 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d1f0 | out: hHeap=0x260000) returned 1 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27509e0 [0050.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.400] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.400] GetLastError () returned 0x0 [0050.400] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.400] GetLastError () returned 0x0 [0050.402] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe4ef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.402] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1b11, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1b11, lpOverlapped=0x0) returned 1 [0050.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.402] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.402] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.403] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.403] CloseHandle (hObject=0x100) returned 1 [0050.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.404] GetLastError () returned 0x0 [0050.405] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.405] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.406] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17040750839) returned 1 [0050.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacdc2630, dwHighDateTime=0x1d585b4)) [0050.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d228 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d228 | out: hHeap=0x260000) returned 1 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27509e0 [0050.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.407] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.407] GetLastError () returned 0x0 [0050.407] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.407] GetLastError () returned 0x0 [0050.409] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff2be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.409] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xd42, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xd42, lpOverlapped=0x0) returned 1 [0050.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.409] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.409] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.409] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.409] CloseHandle (hObject=0x100) returned 1 [0050.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.410] GetLastError () returned 0x0 [0050.411] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.412] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17041276397) returned 1 [0050.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacdc2630, dwHighDateTime=0x1d585b4)) [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d260 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d260 | out: hHeap=0x260000) returned 1 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750ba8 [0050.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.412] GetLastError () returned 0x0 [0050.412] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.412] GetLastError () returned 0x0 [0050.414] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffb52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.414] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4ae, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x4ae, lpOverlapped=0x0) returned 1 [0050.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.414] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.415] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.415] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.415] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.415] CloseHandle (hObject=0x100) returned 1 [0050.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.416] GetLastError () returned 0x0 [0050.416] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.417] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.417] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.417] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17041830222) returned 1 [0050.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacdc2630, dwHighDateTime=0x1d585b4)) [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d298 [0050.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d298 | out: hHeap=0x260000) returned 1 [0050.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750c40 [0050.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.418] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.418] GetLastError () returned 0x0 [0050.418] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.418] GetLastError () returned 0x0 [0050.420] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.420] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xf00, lpOverlapped=0x0) returned 1 [0050.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.420] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.420] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.420] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.420] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.421] CloseHandle (hObject=0x100) returned 1 [0050.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.422] GetLastError () returned 0x0 [0050.423] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.424] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.424] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.424] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17042488799) returned 1 [0050.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacde8790, dwHighDateTime=0x1d585b4)) [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d2d0 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d2d0 | out: hHeap=0x260000) returned 1 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750cd8 [0050.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.424] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.424] GetLastError () returned 0x0 [0050.425] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.425] GetLastError () returned 0x0 [0050.426] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffecae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.426] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1352, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1352, lpOverlapped=0x0) returned 1 [0050.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.426] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.427] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.427] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.427] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.427] CloseHandle (hObject=0x100) returned 1 [0050.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.428] GetLastError () returned 0x0 [0050.428] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.429] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.429] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.429] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17043036908) returned 1 [0050.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacde8790, dwHighDateTime=0x1d585b4)) [0050.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d0d0 [0050.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0050.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d0d0 | out: hHeap=0x260000) returned 1 [0050.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0050.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750d70 [0050.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.430] GetLastError () returned 0x0 [0050.430] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.430] GetLastError () returned 0x0 [0050.472] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffefea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.472] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1016, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1016, lpOverlapped=0x0) returned 1 [0050.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.474] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.474] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.474] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.475] CloseHandle (hObject=0x100) returned 1 [0050.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.583] GetLastError () returned 0x0 [0050.583] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.584] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.584] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.584] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17058505207) returned 1 [0050.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacf65550, dwHighDateTime=0x1d585b4)) [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d730 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d730 | out: hHeap=0x260000) returned 1 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750e08 [0050.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.584] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.585] GetLastError () returned 0x0 [0050.585] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.585] GetLastError () returned 0x0 [0050.588] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.588] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0050.588] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.588] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.588] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.588] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.589] CloseHandle (hObject=0x108) returned 1 [0050.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.590] GetLastError () returned 0x0 [0050.590] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.591] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.591] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17059205287) returned 1 [0050.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacf8b6b0, dwHighDateTime=0x1d585b4)) [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d768 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d768 | out: hHeap=0x260000) returned 1 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751c48 [0050.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.591] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.592] GetLastError () returned 0x0 [0050.592] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.592] GetLastError () returned 0x0 [0050.593] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.593] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0050.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0050.594] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.594] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.594] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.594] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.595] CloseHandle (hObject=0x108) returned 1 [0050.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.595] GetLastError () returned 0x0 [0050.596] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.596] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.597] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17059775957) returned 1 [0050.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacf8b6b0, dwHighDateTime=0x1d585b4)) [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d7a0 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d7a0 | out: hHeap=0x260000) returned 1 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751ce0 [0050.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.597] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.597] GetLastError () returned 0x0 [0050.597] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.597] GetLastError () returned 0x0 [0050.599] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.599] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0050.600] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.600] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.600] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.600] CloseHandle (hObject=0x108) returned 1 [0050.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.601] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.602] GetLastError () returned 0x0 [0050.602] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.603] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.603] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17060463721) returned 1 [0050.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacf8b6b0, dwHighDateTime=0x1d585b4)) [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d7d8 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0050.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d7d8 | out: hHeap=0x260000) returned 1 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751d78 [0050.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.604] GetLastError () returned 0x0 [0050.604] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.604] GetLastError () returned 0x0 [0050.606] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.606] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0050.607] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.607] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.607] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.607] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.607] CloseHandle (hObject=0x108) returned 1 [0050.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.608] GetLastError () returned 0x0 [0050.608] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.609] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.609] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.609] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17061031369) returned 1 [0050.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacfb1810, dwHighDateTime=0x1d585b4)) [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d810 [0050.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0050.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d810 | out: hHeap=0x260000) returned 1 [0050.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0050.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751e10 [0050.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.610] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.610] GetLastError () returned 0x0 [0050.610] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.610] GetLastError () returned 0x0 [0050.612] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.612] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0050.612] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.612] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.613] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.613] CloseHandle (hObject=0x108) returned 1 [0050.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.614] GetLastError () returned 0x0 [0050.614] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.615] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.615] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.615] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17061604158) returned 1 [0050.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xacfb1810, dwHighDateTime=0x1d585b4)) [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d848 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d848 | out: hHeap=0x260000) returned 1 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751ea8 [0050.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.615] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.616] GetLastError () returned 0x0 [0050.616] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.616] GetLastError () returned 0x0 [0050.694] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.694] WriteFile (in: hFile=0x108, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0050.694] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.694] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.695] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.695] CloseHandle (hObject=0x108) returned 1 [0050.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.794] GetLastError () returned 0x0 [0050.794] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.795] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.795] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.795] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17079861031) returned 1 [0050.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad17a890, dwHighDateTime=0x1d585b4)) [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dcb0 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dcb0 | out: hHeap=0x260000) returned 1 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752c40 [0050.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.798] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.798] GetLastError () returned 0x0 [0050.798] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.798] GetLastError () returned 0x0 [0050.801] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe8ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.801] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1714, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x1714, lpOverlapped=0x0) returned 1 [0050.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.803] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.804] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.804] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.804] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.804] CloseHandle (hObject=0x108) returned 1 [0050.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.805] GetLastError () returned 0x0 [0050.805] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.806] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.806] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.806] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17080739062) returned 1 [0050.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad17a890, dwHighDateTime=0x1d585b4)) [0050.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dce8 [0050.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dce8 | out: hHeap=0x260000) returned 1 [0050.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752d70 [0050.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.807] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.807] GetLastError () returned 0x0 [0050.807] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.807] GetLastError () returned 0x0 [0050.809] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.809] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x4540, lpOverlapped=0x0) returned 1 [0050.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.809] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.810] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.810] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.810] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.810] CloseHandle (hObject=0x108) returned 1 [0050.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.811] GetLastError () returned 0x0 [0050.811] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.812] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.812] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.812] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17081336781) returned 1 [0050.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad2d14f0, dwHighDateTime=0x1d585b4)) [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dcb0 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dcb0 | out: hHeap=0x260000) returned 1 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27532c8 [0050.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.948] GetLastError () returned 0x0 [0050.949] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.949] GetLastError () returned 0x0 [0050.952] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb4d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.952] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x4b28, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x4b28, lpOverlapped=0x0) returned 1 [0050.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.953] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.953] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.954] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.954] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.954] CloseHandle (hObject=0x108) returned 1 [0050.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.956] GetLastError () returned 0x0 [0050.956] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.957] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.957] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17095839700) returned 1 [0050.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad2f7650, dwHighDateTime=0x1d585b4)) [0050.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dff8 [0050.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dff8 | out: hHeap=0x260000) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752ea0 [0050.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.958] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.958] GetLastError () returned 0x0 [0050.958] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.958] GetLastError () returned 0x0 [0050.960] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd2c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.960] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x2d40, lpOverlapped=0x0) returned 1 [0050.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.961] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.961] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.961] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.961] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.962] CloseHandle (hObject=0x108) returned 1 [0050.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.963] GetLastError () returned 0x0 [0050.963] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.964] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.964] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17096543053) returned 1 [0050.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad2f7650, dwHighDateTime=0x1d585b4)) [0050.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3381c0 [0050.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381c0 | out: hHeap=0x260000) returned 1 [0050.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753658 [0050.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.965] GetLastError () returned 0x0 [0050.965] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.966] GetLastError () returned 0x0 [0050.967] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbd5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.968] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x42a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x42a4, lpOverlapped=0x0) returned 1 [0050.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.968] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.968] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.969] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.969] CloseHandle (hObject=0x108) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.970] GetLastError () returned 0x0 [0050.971] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.972] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.972] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.972] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17097304061) returned 1 [0050.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad31d7b0, dwHighDateTime=0x1d585b4)) [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e030 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e030 | out: hHeap=0x260000) returned 1 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753788 [0050.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.972] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.973] GetLastError () returned 0x0 [0050.973] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.973] GetLastError () returned 0x0 [0050.974] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdd64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.974] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x229c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x229c, lpOverlapped=0x0) returned 1 [0050.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.975] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.975] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.975] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.975] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.975] CloseHandle (hObject=0x108) returned 1 [0050.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.976] GetLastError () returned 0x0 [0050.977] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.978] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.978] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17097934179) returned 1 [0050.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad31d7b0, dwHighDateTime=0x1d585b4)) [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e068 [0050.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e068 | out: hHeap=0x260000) returned 1 [0050.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753820 [0050.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.979] GetLastError () returned 0x0 [0050.979] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.979] GetLastError () returned 0x0 [0050.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffcfa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.981] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x305c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x305c, lpOverlapped=0x0) returned 1 [0050.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.981] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.982] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.982] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.982] CloseHandle (hObject=0x108) returned 1 [0050.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.982] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0050.983] GetLastError () returned 0x0 [0050.983] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0050.984] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.984] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.984] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17098529622) returned 1 [0050.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad343910, dwHighDateTime=0x1d585b4)) [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e0a0 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e0a0 | out: hHeap=0x260000) returned 1 [0050.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27538b8 [0050.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.985] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0050.985] GetLastError () returned 0x0 [0050.985] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0050.985] GetLastError () returned 0x0 [0051.109] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffec9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.109] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1364, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x1364, lpOverlapped=0x0) returned 1 [0051.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.110] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.110] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.110] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.110] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.110] CloseHandle (hObject=0x108) returned 1 [0051.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.111] GetLastError () returned 0x0 [0051.112] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.112] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.112] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.112] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17111361648) returned 1 [0051.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad474410, dwHighDateTime=0x1d585b4)) [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e500 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e500 | out: hHeap=0x260000) returned 1 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a498 [0051.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.113] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.113] GetLastError () returned 0x0 [0051.113] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.113] GetLastError () returned 0x0 [0051.115] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffabd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.115] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x542c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x542c, lpOverlapped=0x0) returned 1 [0051.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.115] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.115] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.115] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.116] CloseHandle (hObject=0x108) returned 1 [0051.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.117] GetLastError () returned 0x0 [0051.117] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.118] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17111940053) returned 1 [0051.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad474410, dwHighDateTime=0x1d585b4)) [0051.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e538 [0051.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e538 | out: hHeap=0x260000) returned 1 [0051.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a5c8 [0051.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.119] GetLastError () returned 0x0 [0051.119] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.119] GetLastError () returned 0x0 [0051.123] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffde18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.123] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x21e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x21e8, lpOverlapped=0x0) returned 1 [0051.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.123] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.123] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.124] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.124] CloseHandle (hObject=0x108) returned 1 [0051.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.125] GetLastError () returned 0x0 [0051.125] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.126] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.126] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17112703947) returned 1 [0051.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad49a570, dwHighDateTime=0x1d585b4)) [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e570 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e570 | out: hHeap=0x260000) returned 1 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a660 [0051.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.127] GetLastError () returned 0x0 [0051.127] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.127] GetLastError () returned 0x0 [0051.128] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd784, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.128] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x287c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x287c, lpOverlapped=0x0) returned 1 [0051.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.128] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.129] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.129] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.129] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.129] CloseHandle (hObject=0x108) returned 1 [0051.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.130] GetLastError () returned 0x0 [0051.130] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.131] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.131] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.131] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17113219724) returned 1 [0051.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad49a570, dwHighDateTime=0x1d585b4)) [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e5a8 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e5a8 | out: hHeap=0x260000) returned 1 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a6f8 [0051.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.132] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.132] GetLastError () returned 0x0 [0051.132] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.132] GetLastError () returned 0x0 [0051.133] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffca10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.133] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x35f0, lpOverlapped=0x0) returned 1 [0051.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.134] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.134] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.134] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.134] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.135] CloseHandle (hObject=0x108) returned 1 [0051.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.136] GetLastError () returned 0x0 [0051.136] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.137] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.137] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.137] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17113858620) returned 1 [0051.138] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad4c06d0, dwHighDateTime=0x1d585b4)) [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e5e0 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e5e0 | out: hHeap=0x260000) returned 1 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a790 [0051.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.138] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.138] GetLastError () returned 0x0 [0051.138] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.138] GetLastError () returned 0x0 [0051.140] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdfd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.140] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x2030, lpOverlapped=0x0) returned 1 [0051.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.140] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.140] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.141] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.141] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.141] CloseHandle (hObject=0x108) returned 1 [0051.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.142] GetLastError () returned 0x0 [0051.142] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.143] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.143] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.143] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17114408121) returned 1 [0051.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad4c06d0, dwHighDateTime=0x1d585b4)) [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e618 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e618 | out: hHeap=0x260000) returned 1 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a828 [0051.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.143] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.144] GetLastError () returned 0x0 [0051.144] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.144] GetLastError () returned 0x0 [0051.145] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd238, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.145] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2dc8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x2dc8, lpOverlapped=0x0) returned 1 [0051.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.145] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.145] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.146] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.146] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.146] CloseHandle (hObject=0x108) returned 1 [0051.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.147] GetLastError () returned 0x0 [0051.147] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.148] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.148] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17114929052) returned 1 [0051.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad4c06d0, dwHighDateTime=0x1d585b4)) [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e650 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e650 | out: hHeap=0x260000) returned 1 [0051.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a8c0 [0051.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.149] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.149] GetLastError () returned 0x0 [0051.149] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.149] GetLastError () returned 0x0 [0051.384] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffedfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.384] WriteFile (in: hFile=0x108, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1204, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x1204, lpOverlapped=0x0) returned 1 [0051.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0051.384] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.384] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.385] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.385] CloseHandle (hObject=0x108) returned 1 [0051.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.534] GetLastError () returned 0x0 [0051.535] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.535] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.535] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.536] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17153680150) returned 1 [0051.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad878930, dwHighDateTime=0x1d585b4)) [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e8f0 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e8f0 | out: hHeap=0x260000) returned 1 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a958 [0051.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.538] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.538] GetLastError () returned 0x0 [0051.538] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.538] GetLastError () returned 0x0 [0051.541] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe0c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.541] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1f3c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1f3c, lpOverlapped=0x0) returned 1 [0051.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.542] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.542] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.543] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.543] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.543] CloseHandle (hObject=0x108) returned 1 [0051.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.549] GetLastError () returned 0x0 [0051.550] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.551] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17155207447) returned 1 [0051.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad89ea90, dwHighDateTime=0x1d585b4)) [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e928 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e928 | out: hHeap=0x260000) returned 1 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0051.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.552] GetLastError () returned 0x0 [0051.552] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.552] GetLastError () returned 0x0 [0051.553] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffeb68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.553] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1498, lpOverlapped=0x0) returned 1 [0051.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.554] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.554] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.554] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.554] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.554] CloseHandle (hObject=0x108) returned 1 [0051.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.555] GetLastError () returned 0x0 [0051.555] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.556] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.556] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.556] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17155757421) returned 1 [0051.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad89ea90, dwHighDateTime=0x1d585b4)) [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e960 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e960 | out: hHeap=0x260000) returned 1 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ba90 [0051.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.557] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.557] GetLastError () returned 0x0 [0051.557] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.557] GetLastError () returned 0x0 [0051.565] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.565] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x16ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x16ec, lpOverlapped=0x0) returned 1 [0051.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.566] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.566] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.566] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.566] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.567] CloseHandle (hObject=0x108) returned 1 [0051.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.568] GetLastError () returned 0x0 [0051.568] RtlWakeConditionVariable () returned 0x27e828 [0051.568] GetCurrentThreadId () returned 0x99c [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".ldf") returned 0x0 [0051.569] lstrlenW (lpString=".vhd") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".vhd") returned 0x0 [0051.569] lstrlenW (lpString=".vhdx") returned 5 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".vhdx") returned 0x0 [0051.569] lstrlenW (lpString=".pst") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".pst") returned 0x0 [0051.569] lstrlenW (lpString=".ost") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".ost") returned 0x0 [0051.569] lstrlenW (lpString=".bak") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".bak") returned 0x0 [0051.569] lstrlenW (lpString=".bac") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".bac") returned 0x0 [0051.569] lstrlenW (lpString=".sys") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".sys") returned 0x0 [0051.569] lstrlenW (lpString=".v2i") returned 4 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".v2i") returned 0x0 [0051.569] lstrlenW (lpString="s\r\n.v2i") returned 7 [0051.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch="s\r\n.v2i") returned 0x0 [0051.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0051.570] lstrlenW (lpString=".sql") returned 4 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".sql") returned 0x0 [0051.570] lstrlenW (lpString=".mdf") returned 4 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".mdf") returned 0x0 [0051.570] lstrlenW (lpString=".txt") returned 4 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".txt") returned 0x0 [0051.570] lstrlenW (lpString=".dbf") returned 4 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".dbf") returned 0x0 [0051.570] lstrlenW (lpString=".ckp") returned 4 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".ckp") returned 0x0 [0051.570] lstrlenW (lpString=".dacpac") returned 7 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".dacpac") returned 0x0 [0051.570] lstrlenW (lpString=".db3") returned 4 [0051.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".db3") returned 0x0 [0051.571] lstrlenW (lpString=".dtxs") returned 5 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".dtxs") returned 0x0 [0051.571] lstrlenW (lpString=".mdt") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".mdt") returned 0x0 [0051.571] lstrlenW (lpString=".sdf") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".sdf") returned 0x0 [0051.571] lstrlenW (lpString=".MDF") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".MDF") returned 0x0 [0051.571] lstrlenW (lpString=".DBF") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".DBF") returned 0x0 [0051.571] lstrlenW (lpString=".DB") returned 3 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".DB") returned 0x0 [0051.571] lstrlenW (lpString=".db") returned 3 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".db") returned 0x0 [0051.571] lstrlenW (lpString=".ndf") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".ndf") returned 0x0 [0051.571] lstrlenW (lpString=".NDF") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".NDF") returned 0x0 [0051.571] lstrlenW (lpString=".Mdf") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".Mdf") returned 0x0 [0051.571] lstrlenW (lpString=".dat") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".dat") returned 0x0 [0051.571] lstrlenW (lpString=".DAT") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".DAT") returned 0x0 [0051.571] lstrlenW (lpString=".ldf") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".ldf") returned 0x0 [0051.571] lstrlenW (lpString=".LDF") returned 4 [0051.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch=".LDF") returned 0x0 [0051.571] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0051.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0051.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0051.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0051.572] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.573] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.573] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.573] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17157426399) returned 1 [0051.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xad8c4bf0, dwHighDateTime=0x1d585b4)) [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e998 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e998 | out: hHeap=0x260000) returned 1 [0051.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.627] GetLastError () returned 0x0 [0051.627] GetLastError () returned 0x0 [0051.627] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.628] GetLastError () returned 0x0 [0051.628] GetLastError () returned 0x0 [0051.630] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd49c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.630] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2b64, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x2b64, lpOverlapped=0x0) returned 1 [0051.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0051.630] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.630] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.630] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.631] CloseHandle (hObject=0x108) returned 1 [0051.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.905] GetLastError () returned 0x0 [0051.905] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.906] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.906] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17190704342) returned 1 [0051.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc0aa30, dwHighDateTime=0x1d585b4)) [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e68 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e68 | out: hHeap=0x260000) returned 1 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0051.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.906] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.907] GetLastError () returned 0x0 [0051.907] GetLastError () returned 0x0 [0051.907] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.907] GetLastError () returned 0x0 [0051.907] GetLastError () returned 0x0 [0051.908] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe0f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.909] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1f0c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1f0c, lpOverlapped=0x0) returned 1 [0051.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.909] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.909] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.909] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.909] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.910] CloseHandle (hObject=0x110) returned 1 [0051.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.911] GetLastError () returned 0x0 [0051.911] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.912] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.912] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.912] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17191298206) returned 1 [0051.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc0aa30, dwHighDateTime=0x1d585b4)) [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0d88 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0d88 | out: hHeap=0x260000) returned 1 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299fe0 [0051.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.912] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.913] GetLastError () returned 0x0 [0051.913] GetLastError () returned 0x0 [0051.913] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.913] GetLastError () returned 0x0 [0051.913] GetLastError () returned 0x0 [0051.914] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe578, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.914] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1a88, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1a88, lpOverlapped=0x0) returned 1 [0051.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.915] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.915] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.915] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.915] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.915] CloseHandle (hObject=0x110) returned 1 [0051.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.916] GetLastError () returned 0x0 [0051.916] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.918] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.918] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.918] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17191932854) returned 1 [0051.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc30b90, dwHighDateTime=0x1d585b4)) [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0dc0 [0051.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0051.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a078 [0051.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.919] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.919] GetLastError () returned 0x0 [0051.919] GetLastError () returned 0x0 [0051.919] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.919] GetLastError () returned 0x0 [0051.919] GetLastError () returned 0x0 [0051.921] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff9770, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.921] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x6890, lpOverlapped=0x0) returned 1 [0051.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.922] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.922] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.922] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.922] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.922] CloseHandle (hObject=0x110) returned 1 [0051.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.923] GetLastError () returned 0x0 [0051.924] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.924] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.924] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.925] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17192569479) returned 1 [0051.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc30b90, dwHighDateTime=0x1d585b4)) [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0df8 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a110 [0051.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.925] GetLastError () returned 0x0 [0051.925] GetLastError () returned 0x0 [0051.925] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.926] GetLastError () returned 0x0 [0051.926] GetLastError () returned 0x0 [0051.927] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.927] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1ba0, lpOverlapped=0x0) returned 1 [0051.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.928] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.928] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.928] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.928] CloseHandle (hObject=0x110) returned 1 [0051.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.929] GetLastError () returned 0x0 [0051.930] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.931] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.931] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.931] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17193205979) returned 1 [0051.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc30b90, dwHighDateTime=0x1d585b4)) [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e30 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e30 | out: hHeap=0x260000) returned 1 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a1a8 [0051.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.931] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.932] GetLastError () returned 0x0 [0051.932] GetLastError () returned 0x0 [0051.932] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.932] GetLastError () returned 0x0 [0051.932] GetLastError () returned 0x0 [0051.933] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffed38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.933] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x12c8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x12c8, lpOverlapped=0x0) returned 1 [0051.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.934] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.934] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.934] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.934] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.934] CloseHandle (hObject=0x110) returned 1 [0051.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.935] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.935] GetLastError () returned 0x0 [0051.936] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.936] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.936] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.936] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17193759172) returned 1 [0051.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc56cf0, dwHighDateTime=0x1d585b4)) [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1338 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1338 | out: hHeap=0x260000) returned 1 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a240 [0051.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.937] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.937] GetLastError () returned 0x0 [0051.937] GetLastError () returned 0x0 [0051.937] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.937] GetLastError () returned 0x0 [0051.938] GetLastError () returned 0x0 [0051.939] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffede4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.939] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x121c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x121c, lpOverlapped=0x0) returned 1 [0051.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.939] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.939] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.940] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.940] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.940] CloseHandle (hObject=0x110) returned 1 [0051.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.940] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0051.941] GetLastError () returned 0x0 [0051.941] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0051.942] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.942] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0051.942] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17194324258) returned 1 [0051.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadc56cf0, dwHighDateTime=0x1d585b4)) [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1370 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1370 | out: hHeap=0x260000) returned 1 [0051.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a2d8 [0051.943] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.943] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0051.943] GetLastError () returned 0x0 [0051.943] GetLastError () returned 0x0 [0051.943] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0051.943] GetLastError () returned 0x0 [0051.943] GetLastError () returned 0x0 [0052.015] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff128, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.015] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xed8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xed8, lpOverlapped=0x0) returned 1 [0052.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.016] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.017] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.017] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.017] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.017] CloseHandle (hObject=0x110) returned 1 [0052.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.100] GetLastError () returned 0x0 [0052.100] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.101] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.101] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.101] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17210207721) returned 1 [0052.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaddd3ab0, dwHighDateTime=0x1d585b4)) [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1060 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1060 | out: hHeap=0x260000) returned 1 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27563f0 [0052.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.102] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.102] GetLastError () returned 0x0 [0052.102] GetLastError () returned 0x0 [0052.102] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.102] GetLastError () returned 0x0 [0052.102] GetLastError () returned 0x0 [0052.104] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff658a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.105] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x9a76, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x9a76, lpOverlapped=0x0) returned 1 [0052.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.108] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.108] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.108] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.109] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.109] CloseHandle (hObject=0x110) returned 1 [0052.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.109] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.110] GetLastError () returned 0x0 [0052.111] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.112] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.112] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.112] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17211290782) returned 1 [0052.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaddf9c10, dwHighDateTime=0x1d585b4)) [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1450 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756520 [0052.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.112] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.113] GetLastError () returned 0x0 [0052.113] GetLastError () returned 0x0 [0052.113] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] GetLastError () returned 0x0 [0052.117] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff4a54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.117] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xb5ac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xb5ac, lpOverlapped=0x0) returned 1 [0052.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.118] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.118] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.119] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.119] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.119] CloseHandle (hObject=0x110) returned 1 [0052.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.119] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.120] GetLastError () returned 0x0 [0052.121] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.122] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.122] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.122] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17212304008) returned 1 [0052.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xade1fd70, dwHighDateTime=0x1d585b4)) [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27565b8 [0052.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.123] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.123] GetLastError () returned 0x0 [0052.123] GetLastError () returned 0x0 [0052.123] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] GetLastError () returned 0x0 [0052.125] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff5566, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.125] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xaa9a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xaa9a, lpOverlapped=0x0) returned 1 [0052.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.126] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.126] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.127] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.127] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.127] CloseHandle (hObject=0x110) returned 1 [0052.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.127] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.128] GetLastError () returned 0x0 [0052.129] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.130] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.130] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.130] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17213093356) returned 1 [0052.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xade1fd70, dwHighDateTime=0x1d585b4)) [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14f8 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a14f8 | out: hHeap=0x260000) returned 1 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756650 [0052.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.130] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.131] GetLastError () returned 0x0 [0052.131] GetLastError () returned 0x0 [0052.131] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.131] GetLastError () returned 0x0 [0052.131] GetLastError () returned 0x0 [0052.274] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffef82c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.274] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x107d4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x107d4, lpOverlapped=0x0) returned 1 [0052.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.275] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.275] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.275] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.275] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.275] CloseHandle (hObject=0x110) returned 1 [0052.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.277] GetLastError () returned 0x0 [0052.277] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.278] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.278] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.278] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17227905143) returned 1 [0052.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadf9cb30, dwHighDateTime=0x1d585b4)) [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d780 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d780 | out: hHeap=0x260000) returned 1 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27566e8 [0052.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.279] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.279] GetLastError () returned 0x0 [0052.279] GetLastError () returned 0x0 [0052.279] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.279] GetLastError () returned 0x0 [0052.279] GetLastError () returned 0x0 [0052.282] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbf94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.282] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x406c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x406c, lpOverlapped=0x0) returned 1 [0052.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0052.282] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.282] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.283] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.283] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.283] CloseHandle (hObject=0x110) returned 1 [0052.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.284] GetLastError () returned 0x0 [0052.284] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.285] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.285] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.285] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17228648168) returned 1 [0052.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadf9cb30, dwHighDateTime=0x1d585b4)) [0052.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d748 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d748 | out: hHeap=0x260000) returned 1 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756fd0 [0052.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.286] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.286] GetLastError () returned 0x0 [0052.286] GetLastError () returned 0x0 [0052.286] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.286] GetLastError () returned 0x0 [0052.287] GetLastError () returned 0x0 [0052.288] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd3b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.288] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2c4c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x2c4c, lpOverlapped=0x0) returned 1 [0052.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0052.289] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.289] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.289] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.289] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.289] CloseHandle (hObject=0x110) returned 1 [0052.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.291] GetLastError () returned 0x0 [0052.291] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.292] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.292] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.292] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17229441632) returned 1 [0052.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadfc2c90, dwHighDateTime=0x1d585b4)) [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d710 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d710 | out: hHeap=0x260000) returned 1 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757068 [0052.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.294] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.294] GetLastError () returned 0x0 [0052.295] GetLastError () returned 0x0 [0052.295] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.295] GetLastError () returned 0x0 [0052.295] GetLastError () returned 0x0 [0052.296] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbfd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.296] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x4030, lpOverlapped=0x0) returned 1 [0052.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0052.297] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.297] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.297] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.297] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.298] CloseHandle (hObject=0x110) returned 1 [0052.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.299] GetLastError () returned 0x0 [0052.299] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.300] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.300] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17230110477) returned 1 [0052.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadfc2c90, dwHighDateTime=0x1d585b4)) [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5f8 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5f8 | out: hHeap=0x260000) returned 1 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757100 [0052.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.301] GetLastError () returned 0x0 [0052.301] GetLastError () returned 0x0 [0052.301] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.301] GetLastError () returned 0x0 [0052.301] GetLastError () returned 0x0 [0052.303] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc14c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.303] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x3eb4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x238fdb0*=0x3eb4, lpOverlapped=0x0) returned 1 [0052.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0052.303] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.303] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.304] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.304] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.304] CloseHandle (hObject=0x110) returned 1 [0052.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.305] GetLastError () returned 0x0 [0052.305] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.306] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.306] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.306] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17230756778) returned 1 [0052.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xadfc2c90, dwHighDateTime=0x1d585b4)) [0052.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5c0 [0052.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x260000) returned 1 [0052.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756b10 [0052.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.318] GetLastError () returned 0x0 [0052.318] GetLastError () returned 0x0 [0052.318] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.319] GetLastError () returned 0x0 [0052.319] GetLastError () returned 0x0 [0052.320] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd580, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.320] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2a80, lpOverlapped=0x0) returned 1 [0052.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.321] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.321] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.321] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.322] CloseHandle (hObject=0x110) returned 1 [0052.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.354] GetLastError () returned 0x0 [0052.355] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.355] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.355] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.356] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17235680004) returned 1 [0052.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae05b210, dwHighDateTime=0x1d585b4)) [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6d8 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6d8 | out: hHeap=0x260000) returned 1 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757230 [0052.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.356] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.357] GetLastError () returned 0x0 [0052.357] GetLastError () returned 0x0 [0052.357] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.357] GetLastError () returned 0x0 [0052.357] GetLastError () returned 0x0 [0052.360] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe77c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.360] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1884, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x1884, lpOverlapped=0x0) returned 1 [0052.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.362] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.362] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.362] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.363] CloseHandle (hObject=0x110) returned 1 [0052.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.364] GetLastError () returned 0x0 [0052.365] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.366] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.366] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17236687043) returned 1 [0052.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae05b210, dwHighDateTime=0x1d585b4)) [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6a0 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6a0 | out: hHeap=0x260000) returned 1 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27575c0 [0052.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.366] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.366] GetLastError () returned 0x0 [0052.367] GetLastError () returned 0x0 [0052.367] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.367] GetLastError () returned 0x0 [0052.367] GetLastError () returned 0x0 [0052.370] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbf08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.370] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x40f8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x40f8, lpOverlapped=0x0) returned 1 [0052.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.370] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.370] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.371] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.371] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.371] CloseHandle (hObject=0x110) returned 1 [0052.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.372] GetLastError () returned 0x0 [0052.372] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.373] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.373] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.373] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17237451935) returned 1 [0052.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae081370, dwHighDateTime=0x1d585b4)) [0052.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d9e8 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9e8 | out: hHeap=0x260000) returned 1 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757658 [0052.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.374] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.374] GetLastError () returned 0x0 [0052.374] GetLastError () returned 0x0 [0052.374] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.374] GetLastError () returned 0x0 [0052.375] GetLastError () returned 0x0 [0052.376] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcf6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.376] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3094, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x3094, lpOverlapped=0x0) returned 1 [0052.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.376] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.377] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.377] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.377] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.377] CloseHandle (hObject=0x110) returned 1 [0052.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.378] GetLastError () returned 0x0 [0052.379] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.379] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.379] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.380] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17238071144) returned 1 [0052.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae081370, dwHighDateTime=0x1d585b4)) [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da20 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da20 | out: hHeap=0x260000) returned 1 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27576f0 [0052.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.380] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.380] GetLastError () returned 0x0 [0052.380] GetLastError () returned 0x0 [0052.381] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.381] GetLastError () returned 0x0 [0052.381] GetLastError () returned 0x0 [0052.382] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe8b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.382] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1748, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x1748, lpOverlapped=0x0) returned 1 [0052.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.383] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.383] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.383] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.383] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.383] CloseHandle (hObject=0x110) returned 1 [0052.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.384] GetLastError () returned 0x0 [0052.385] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.386] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.386] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.386] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17238739982) returned 1 [0052.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae0a74d0, dwHighDateTime=0x1d585b4)) [0052.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da58 [0052.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da58 | out: hHeap=0x260000) returned 1 [0052.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757788 [0052.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.387] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.387] GetLastError () returned 0x0 [0052.387] GetLastError () returned 0x0 [0052.387] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.387] GetLastError () returned 0x0 [0052.387] GetLastError () returned 0x0 [0052.389] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffda7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.389] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2584, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x2584, lpOverlapped=0x0) returned 1 [0052.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.389] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.389] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.390] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.390] CloseHandle (hObject=0x110) returned 1 [0052.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.391] GetLastError () returned 0x0 [0052.391] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.392] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.392] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.392] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17239352325) returned 1 [0052.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae0a74d0, dwHighDateTime=0x1d585b4)) [0052.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da90 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da90 | out: hHeap=0x260000) returned 1 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757820 [0052.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.393] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.393] GetLastError () returned 0x0 [0052.393] GetLastError () returned 0x0 [0052.393] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.393] GetLastError () returned 0x0 [0052.394] GetLastError () returned 0x0 [0052.395] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff9978, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.395] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x6688, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x6688, lpOverlapped=0x0) returned 1 [0052.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.396] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.396] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.396] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.396] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.396] CloseHandle (hObject=0x110) returned 1 [0052.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.397] GetLastError () returned 0x0 [0052.398] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.398] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.398] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.399] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17239969531) returned 1 [0052.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae0a74d0, dwHighDateTime=0x1d585b4)) [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d400 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d400 | out: hHeap=0x260000) returned 1 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27578b8 [0052.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.399] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.399] GetLastError () returned 0x0 [0052.399] GetLastError () returned 0x0 [0052.399] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.400] GetLastError () returned 0x0 [0052.400] GetLastError () returned 0x0 [0052.401] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff87a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.401] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x785c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x785c, lpOverlapped=0x0) returned 1 [0052.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.402] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.402] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.402] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.402] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.402] CloseHandle (hObject=0x110) returned 1 [0052.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.404] GetLastError () returned 0x0 [0052.404] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.405] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.405] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17240598806) returned 1 [0052.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae0cd630, dwHighDateTime=0x1d585b4)) [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d3c8 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d3c8 | out: hHeap=0x260000) returned 1 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757950 [0052.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.405] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.406] GetLastError () returned 0x0 [0052.406] GetLastError () returned 0x0 [0052.406] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.406] GetLastError () returned 0x0 [0052.406] GetLastError () returned 0x0 [0052.408] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff788c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.408] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x8774, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x8774, lpOverlapped=0x0) returned 1 [0052.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.408] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.409] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.409] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.409] CloseHandle (hObject=0x110) returned 1 [0052.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.410] GetLastError () returned 0x0 [0052.411] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.412] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17241264655) returned 1 [0052.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae0cd630, dwHighDateTime=0x1d585b4)) [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d390 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d390 | out: hHeap=0x260000) returned 1 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27579e8 [0052.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.412] GetLastError () returned 0x0 [0052.412] GetLastError () returned 0x0 [0052.412] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.413] GetLastError () returned 0x0 [0052.413] GetLastError () returned 0x0 [0052.414] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffffb0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.414] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x4f4, lpOverlapped=0x0) returned 1 [0052.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0052.414] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.415] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.415] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.415] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.415] CloseHandle (hObject=0x110) returned 1 [0052.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.526] GetLastError () returned 0x0 [0052.535] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.536] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.536] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.536] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17253692980) returned 1 [0052.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae1fe130, dwHighDateTime=0x1d585b4)) [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338000 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338000 | out: hHeap=0x260000) returned 1 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758228 [0052.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.536] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.537] GetLastError () returned 0x0 [0052.537] GetLastError () returned 0x0 [0052.537] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.537] GetLastError () returned 0x0 [0052.537] GetLastError () returned 0x0 [0052.538] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7ed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.539] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x812c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x812c, lpOverlapped=0x0) returned 1 [0052.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.539] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.539] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.539] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.540] CloseHandle (hObject=0x108) returned 1 [0052.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.542] GetLastError () returned 0x0 [0052.542] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.543] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.543] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.543] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17254394110) returned 1 [0052.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae224290, dwHighDateTime=0x1d585b4)) [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337fc8 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337fc8 | out: hHeap=0x260000) returned 1 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758358 [0052.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.543] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.544] GetLastError () returned 0x0 [0052.544] GetLastError () returned 0x0 [0052.544] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.544] GetLastError () returned 0x0 [0052.544] GetLastError () returned 0x0 [0052.545] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff888, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.545] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x778, lpOverlapped=0x0) returned 1 [0052.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.546] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.546] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.546] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.547] CloseHandle (hObject=0x108) returned 1 [0052.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.548] GetLastError () returned 0x0 [0052.548] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.549] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.549] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.549] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17255003347) returned 1 [0052.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae224290, dwHighDateTime=0x1d585b4)) [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f90 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27583f0 [0052.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.550] GetLastError () returned 0x0 [0052.550] GetLastError () returned 0x0 [0052.550] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.550] GetLastError () returned 0x0 [0052.550] GetLastError () returned 0x0 [0052.554] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe158, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.554] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1ea8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1ea8, lpOverlapped=0x0) returned 1 [0052.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.555] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.555] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.555] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.555] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.556] CloseHandle (hObject=0x108) returned 1 [0052.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.557] GetLastError () returned 0x0 [0052.558] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.558] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.559] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.559] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17255980960) returned 1 [0052.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae24a3f0, dwHighDateTime=0x1d585b4)) [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e08 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e08 | out: hHeap=0x260000) returned 1 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758488 [0052.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.559] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.559] GetLastError () returned 0x0 [0052.560] GetLastError () returned 0x0 [0052.560] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.560] GetLastError () returned 0x0 [0052.560] GetLastError () returned 0x0 [0052.561] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe038, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.561] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1fc8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1fc8, lpOverlapped=0x0) returned 1 [0052.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.562] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.562] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.562] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.562] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.563] CloseHandle (hObject=0x108) returned 1 [0052.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.564] GetLastError () returned 0x0 [0052.564] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.565] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.565] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17256599609) returned 1 [0052.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae24a3f0, dwHighDateTime=0x1d585b4)) [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337dd0 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337dd0 | out: hHeap=0x260000) returned 1 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758520 [0052.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.566] GetLastError () returned 0x0 [0052.566] GetLastError () returned 0x0 [0052.566] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.566] GetLastError () returned 0x0 [0052.566] GetLastError () returned 0x0 [0052.567] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdd50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.567] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x22b0, lpOverlapped=0x0) returned 1 [0052.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.568] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.568] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.568] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.568] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.569] CloseHandle (hObject=0x108) returned 1 [0052.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.570] GetLastError () returned 0x0 [0052.570] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.571] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.571] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.571] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17257192502) returned 1 [0052.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae24a3f0, dwHighDateTime=0x1d585b4)) [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337d98 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d98 | out: hHeap=0x260000) returned 1 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27585b8 [0052.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.571] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.572] GetLastError () returned 0x0 [0052.572] GetLastError () returned 0x0 [0052.572] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.572] GetLastError () returned 0x0 [0052.572] GetLastError () returned 0x0 [0052.679] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff188, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.679] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xe78, lpOverlapped=0x0) returned 1 [0052.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.679] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.679] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.680] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.680] CloseHandle (hObject=0x108) returned 1 [0052.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.681] GetLastError () returned 0x0 [0052.682] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.682] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.682] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.683] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17268456134) returned 1 [0052.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae37aef0, dwHighDateTime=0x1d585b4)) [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1758 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758650 [0052.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.684] GetLastError () returned 0x0 [0052.684] GetLastError () returned 0x0 [0052.684] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.684] GetLastError () returned 0x0 [0052.685] GetLastError () returned 0x0 [0052.686] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd37c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.686] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2c84, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x2c84, lpOverlapped=0x0) returned 1 [0052.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.686] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.687] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.687] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.687] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.687] CloseHandle (hObject=0x108) returned 1 [0052.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.688] GetLastError () returned 0x0 [0052.689] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.689] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.689] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.690] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17269070807) returned 1 [0052.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae37aef0, dwHighDateTime=0x1d585b4)) [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1790 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1790 | out: hHeap=0x260000) returned 1 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759068 [0052.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.690] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.690] GetLastError () returned 0x0 [0052.690] GetLastError () returned 0x0 [0052.691] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.691] GetLastError () returned 0x0 [0052.691] GetLastError () returned 0x0 [0052.692] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb724, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.692] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x48dc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x48dc, lpOverlapped=0x0) returned 1 [0052.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.693] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.693] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.693] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.693] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.693] CloseHandle (hObject=0x108) returned 1 [0052.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.694] GetLastError () returned 0x0 [0052.695] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.696] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.696] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.696] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17269737382) returned 1 [0052.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae37aef0, dwHighDateTime=0x1d585b4)) [0052.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a17c8 [0052.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a17c8 | out: hHeap=0x260000) returned 1 [0052.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759100 [0052.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.697] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.697] GetLastError () returned 0x0 [0052.697] GetLastError () returned 0x0 [0052.697] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.697] GetLastError () returned 0x0 [0052.698] GetLastError () returned 0x0 [0052.699] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb9d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.699] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x462e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x462e, lpOverlapped=0x0) returned 1 [0052.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.700] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.700] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.700] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.700] CloseHandle (hObject=0x108) returned 1 [0052.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.701] GetLastError () returned 0x0 [0052.702] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.703] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.703] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.703] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17270419234) returned 1 [0052.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae3a1050, dwHighDateTime=0x1d585b4)) [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5390 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5390 | out: hHeap=0x260000) returned 1 [0052.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759198 [0052.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.704] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.704] GetLastError () returned 0x0 [0052.704] GetLastError () returned 0x0 [0052.704] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.704] GetLastError () returned 0x0 [0052.704] GetLastError () returned 0x0 [0052.706] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8d22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.706] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x72de, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x72de, lpOverlapped=0x0) returned 1 [0052.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.706] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.706] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.707] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.707] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.707] CloseHandle (hObject=0x108) returned 1 [0052.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.708] GetLastError () returned 0x0 [0052.708] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.709] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.709] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.709] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17271044828) returned 1 [0052.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae3a1050, dwHighDateTime=0x1d585b4)) [0052.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5358 [0052.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5358 | out: hHeap=0x260000) returned 1 [0052.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759230 [0052.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.710] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.710] GetLastError () returned 0x0 [0052.710] GetLastError () returned 0x0 [0052.710] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.710] GetLastError () returned 0x0 [0052.711] GetLastError () returned 0x0 [0052.811] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff4a6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.811] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xb594, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0xb594, lpOverlapped=0x0) returned 1 [0052.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.812] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.812] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.812] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.812] CloseHandle (hObject=0x108) returned 1 [0052.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.830] GetLastError () returned 0x0 [0052.831] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.831] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.831] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.832] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17283280024) returned 1 [0052.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae4d1b50, dwHighDateTime=0x1d585b4)) [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5208 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5208 | out: hHeap=0x260000) returned 1 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27592c8 [0052.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.832] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.832] GetLastError () returned 0x0 [0052.833] GetLastError () returned 0x0 [0052.833] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.833] GetLastError () returned 0x0 [0052.833] GetLastError () returned 0x0 [0052.835] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffce68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.835] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3198, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x3198, lpOverlapped=0x0) returned 1 [0052.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.836] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.836] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.837] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.837] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.837] CloseHandle (hObject=0x108) returned 1 [0052.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.838] GetLastError () returned 0x0 [0052.838] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.839] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.839] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.839] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17284054143) returned 1 [0052.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae4f7cb0, dwHighDateTime=0x1d585b4)) [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f51d0 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f51d0 | out: hHeap=0x260000) returned 1 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759658 [0052.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.840] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.840] GetLastError () returned 0x0 [0052.840] GetLastError () returned 0x0 [0052.840] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.840] GetLastError () returned 0x0 [0052.841] GetLastError () returned 0x0 [0052.842] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.842] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x16e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x16e8, lpOverlapped=0x0) returned 1 [0052.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.842] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.843] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.843] CloseHandle (hObject=0x108) returned 1 [0052.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.844] GetLastError () returned 0x0 [0052.844] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.845] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.845] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.845] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17284661817) returned 1 [0052.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae4f7cb0, dwHighDateTime=0x1d585b4)) [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5198 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5198 | out: hHeap=0x260000) returned 1 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27596f0 [0052.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.846] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.846] GetLastError () returned 0x0 [0052.846] GetLastError () returned 0x0 [0052.846] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.847] GetLastError () returned 0x0 [0052.847] GetLastError () returned 0x0 [0052.848] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.848] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2608, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2608, lpOverlapped=0x0) returned 1 [0052.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.849] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.849] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.849] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.849] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.849] CloseHandle (hObject=0x108) returned 1 [0052.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cec0 [0052.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0052.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.850] GetLastError () returned 0x0 [0052.851] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.851] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.851] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.852] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17285271653) returned 1 [0052.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae4f7cb0, dwHighDateTime=0x1d585b4)) [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5160 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5160 | out: hHeap=0x260000) returned 1 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759788 [0052.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.852] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.852] GetLastError () returned 0x0 [0052.852] GetLastError () returned 0x0 [0052.853] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.853] GetLastError () returned 0x0 [0052.853] GetLastError () returned 0x0 [0052.854] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffec14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.854] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x13ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x13ec, lpOverlapped=0x0) returned 1 [0052.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.855] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.855] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.855] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.855] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.856] CloseHandle (hObject=0x108) returned 1 [0052.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cec0 [0052.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0052.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.857] GetLastError () returned 0x0 [0052.857] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.858] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.858] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17285920050) returned 1 [0052.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae51de10, dwHighDateTime=0x1d585b4)) [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5128 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5128 | out: hHeap=0x260000) returned 1 [0052.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759820 [0052.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.859] GetLastError () returned 0x0 [0052.859] GetLastError () returned 0x0 [0052.859] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.859] GetLastError () returned 0x0 [0052.859] GetLastError () returned 0x0 [0052.947] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9e6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.947] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6196, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x6196, lpOverlapped=0x0) returned 1 [0052.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.948] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.948] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.948] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.948] CloseHandle (hObject=0x108) returned 1 [0052.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.949] GetLastError () returned 0x0 [0052.984] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.986] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.986] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0052.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0052.986] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17298748094) returned 1 [0052.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae64e910, dwHighDateTime=0x1d585b4)) [0052.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1060 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1060 | out: hHeap=0x260000) returned 1 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3268a0 [0052.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.987] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0052.987] GetLastError () returned 0x0 [0052.987] GetLastError () returned 0x0 [0052.987] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.987] GetLastError () returned 0x0 [0052.988] GetLastError () returned 0x0 [0052.991] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbf19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.991] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x40e7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x40e7, lpOverlapped=0x0) returned 1 [0052.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.992] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.992] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.992] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.992] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.993] CloseHandle (hObject=0x110) returned 1 [0052.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.994] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0052.995] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.995] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.995] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0052.995] GetLastError () returned 0x0 [0052.997] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa0b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.997] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5f48, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x5f48, lpOverlapped=0x0) returned 1 [0052.997] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.997] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.998] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.998] CloseHandle (hObject=0x110) returned 1 [0052.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0052.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0052.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0052.999] GetLastError () returned 0x0 [0053.000] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.001] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.001] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.001] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17300188009) returned 1 [0053.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae674a70, dwHighDateTime=0x1d585b4)) [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d1e8 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1e8 | out: hHeap=0x260000) returned 1 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a190 [0053.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.001] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.002] GetLastError () returned 0x0 [0053.002] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.002] GetLastError () returned 0x0 [0053.003] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.003] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3b2e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x3b2e, lpOverlapped=0x0) returned 1 [0053.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.004] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.004] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.004] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.004] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.004] CloseHandle (hObject=0x110) returned 1 [0053.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0053.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0053.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.006] GetLastError () returned 0x0 [0053.006] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.007] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.007] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17300786648) returned 1 [0053.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae674a70, dwHighDateTime=0x1d585b4)) [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d1b0 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1b0 | out: hHeap=0x260000) returned 1 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0053.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.007] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.007] GetLastError () returned 0x0 [0053.008] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.008] GetLastError () returned 0x0 [0053.009] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe172, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.009] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1e8e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1e8e, lpOverlapped=0x0) returned 1 [0053.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.010] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.010] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.010] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.011] CloseHandle (hObject=0x110) returned 1 [0053.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0053.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0053.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.012] GetLastError () returned 0x0 [0053.012] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.013] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.013] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.013] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17301421714) returned 1 [0053.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae69abd0, dwHighDateTime=0x1d585b4)) [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d290 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d290 | out: hHeap=0x260000) returned 1 [0053.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a2c0 [0053.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.014] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.014] GetLastError () returned 0x0 [0053.014] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.014] GetLastError () returned 0x0 [0053.015] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc12e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.015] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3ed2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x3ed2, lpOverlapped=0x0) returned 1 [0053.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.016] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.016] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.016] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.016] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.017] CloseHandle (hObject=0x110) returned 1 [0053.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0053.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0053.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.018] GetLastError () returned 0x0 [0053.053] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756858) returned 1 [0053.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.067] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.067] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17306782702) returned 1 [0053.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae733150, dwHighDateTime=0x1d585b4)) [0053.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5438 [0053.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5438 | out: hHeap=0x260000) returned 1 [0053.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a780 [0053.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.082] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.082] GetLastError () returned 0x0 [0053.082] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.082] GetLastError () returned 0x0 [0053.084] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8ba4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.084] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x745c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x745c, lpOverlapped=0x0) returned 1 [0053.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.085] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.085] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.085] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.085] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.086] CloseHandle (hObject=0x108) returned 1 [0053.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.116] GetLastError () returned 0x0 [0053.117] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.118] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17311923628) returned 1 [0053.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae7a5570, dwHighDateTime=0x1d585b4)) [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f53c8 [0053.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f53c8 | out: hHeap=0x260000) returned 1 [0053.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a3f0 [0053.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.119] GetLastError () returned 0x0 [0053.119] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.119] GetLastError () returned 0x0 [0053.153] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff16aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.153] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xe956, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xe956, lpOverlapped=0x0) returned 1 [0053.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.154] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.154] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.155] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.155] CloseHandle (hObject=0x108) returned 1 [0053.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.157] GetLastError () returned 0x0 [0053.157] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.158] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.158] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.158] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17315942643) returned 1 [0053.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae7f1830, dwHighDateTime=0x1d585b4)) [0053.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299600 [0053.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a8b0 [0053.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.159] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.159] GetLastError () returned 0x0 [0053.159] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.159] GetLastError () returned 0x0 [0053.185] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9af4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.185] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x650c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x650c, lpOverlapped=0x0) returned 1 [0053.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.185] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.185] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.186] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.186] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.186] CloseHandle (hObject=0x108) returned 1 [0053.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.209] GetLastError () returned 0x0 [0053.210] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756858) returned 1 [0053.211] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.211] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.211] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17321201097) returned 1 [0053.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae863c50, dwHighDateTime=0x1d585b4)) [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998a0 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998a0 | out: hHeap=0x260000) returned 1 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275aa78 [0053.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.212] GetLastError () returned 0x0 [0053.212] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.212] GetLastError () returned 0x0 [0053.232] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff88c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.232] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x773a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x773a, lpOverlapped=0x0) returned 1 [0053.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.233] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.233] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.233] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.233] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.234] CloseHandle (hObject=0x108) returned 1 [0053.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.235] GetLastError () returned 0x0 [0053.236] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756858) returned 1 [0053.237] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0053.237] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0053.237] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17323791845) returned 1 [0053.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae8aff10, dwHighDateTime=0x1d585b4)) [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996e0 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996e0 | out: hHeap=0x260000) returned 1 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ac40 [0053.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.237] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.238] GetLastError () returned 0x0 [0053.238] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.238] GetLastError () returned 0x0 [0053.245] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffde7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.248] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2182, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2182, lpOverlapped=0x0) returned 1 [0053.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.249] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.249] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.249] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.250] CloseHandle (hObject=0x108) returned 1 [0053.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0053.251] GetLastError () returned 0x0 [0053.332] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.333] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.333] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17335326800) returned 1 [0053.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xae9e0a10, dwHighDateTime=0x1d585b4)) [0053.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2954d0 [0053.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0053.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b360 [0053.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.353] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.379] GetLastError () returned 0x0 [0053.379] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.379] GetLastError () returned 0x0 [0053.428] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.428] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x37e4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x37e4, lpOverlapped=0x0) returned 1 [0053.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.428] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.428] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.428] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.429] CloseHandle (hObject=0xf8) returned 1 [0053.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.441] GetLastError () returned 0x0 [0053.442] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.442] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.442] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.443] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17344377891) returned 1 [0053.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaea9f0f0, dwHighDateTime=0x1d585b4)) [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c098 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c098 | out: hHeap=0x260000) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275aea0 [0053.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.443] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.443] GetLastError () returned 0x0 [0053.443] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.444] GetLastError () returned 0x0 [0053.508] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff554, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.509] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xaac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0xaac, lpOverlapped=0x0) returned 1 [0053.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.509] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.509] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.509] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.509] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.510] CloseHandle (hObject=0xf8) returned 1 [0053.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.511] GetLastError () returned 0x0 [0053.518] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.519] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.519] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17352027241) returned 1 [0053.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaeb5d7d0, dwHighDateTime=0x1d585b4)) [0053.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5518 [0053.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5518 | out: hHeap=0x260000) returned 1 [0053.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275bce0 [0053.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.526] GetLastError () returned 0x0 [0053.526] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.526] GetLastError () returned 0x0 [0053.540] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.540] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x1388, lpOverlapped=0x0) returned 1 [0053.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.541] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.541] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.541] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.541] CloseHandle (hObject=0xf8) returned 1 [0053.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.562] GetLastError () returned 0x0 [0053.562] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.568] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.568] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.569] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17356971904) returned 1 [0053.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaebcfbf0, dwHighDateTime=0x1d585b4)) [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c1e8 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c1e8 | out: hHeap=0x260000) returned 1 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2120 [0053.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.569] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.569] GetLastError () returned 0x0 [0053.569] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.569] GetLastError () returned 0x0 [0053.612] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffcc96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.612] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x336a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x336a, lpOverlapped=0x0) returned 1 [0053.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.613] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.613] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.615] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.616] CloseHandle (hObject=0xf8) returned 1 [0053.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.617] GetLastError () returned 0x0 [0053.621] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.622] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.622] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.622] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17362332975) returned 1 [0053.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaec68170, dwHighDateTime=0x1d585b4)) [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c2c8 [0053.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c2c8 | out: hHeap=0x260000) returned 1 [0053.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f21b8 [0053.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.623] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.623] GetLastError () returned 0x0 [0053.623] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.623] GetLastError () returned 0x0 [0053.625] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8d08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.625] WriteFile (in: hFile=0x110, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x72f8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x72f8, lpOverlapped=0x0) returned 1 [0053.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.625] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.626] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.626] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.626] CloseHandle (hObject=0x110) returned 1 [0053.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0053.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0053.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.627] GetLastError () returned 0x0 [0053.627] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.628] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.628] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.628] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17362955459) returned 1 [0053.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaec68170, dwHighDateTime=0x1d585b4)) [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c300 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c300 | out: hHeap=0x260000) returned 1 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2418 [0053.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.629] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.629] GetLastError () returned 0x0 [0053.629] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.629] GetLastError () returned 0x0 [0053.631] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffacb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.631] WriteFile (in: hFile=0x110, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x5350, lpOverlapped=0x0) returned 1 [0053.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.632] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.632] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.632] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.632] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.632] CloseHandle (hObject=0x110) returned 1 [0053.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0053.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0053.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.634] GetLastError () returned 0x0 [0053.634] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.635] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.635] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.635] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17363596832) returned 1 [0053.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaec8e2d0, dwHighDateTime=0x1d585b4)) [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c338 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c338 | out: hHeap=0x260000) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f24b0 [0053.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.635] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.636] GetLastError () returned 0x0 [0053.636] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.636] GetLastError () returned 0x0 [0053.644] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffb742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.644] WriteFile (in: hFile=0x110, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x48be, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x48be, lpOverlapped=0x0) returned 1 [0053.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.646] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.647] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.647] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.647] CloseHandle (hObject=0x110) returned 1 [0053.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.648] GetLastError () returned 0x0 [0053.648] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.747] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.747] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.747] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17374785396) returned 1 [0053.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaed98c70, dwHighDateTime=0x1d585b4)) [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c568 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c568 | out: hHeap=0x260000) returned 1 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2a08 [0053.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.747] GetLastError () returned 0x0 [0053.748] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.748] GetLastError () returned 0x0 [0053.749] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffed72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.749] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x128e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x128e, lpOverlapped=0x0) returned 1 [0053.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.750] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.750] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.750] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.751] CloseHandle (hObject=0x110) returned 1 [0053.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.755] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.807] GetLastError () returned 0x0 [0053.807] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.808] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.808] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.808] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17380932021) returned 1 [0053.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaee311f0, dwHighDateTime=0x1d585b4)) [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c680 [0053.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c680 | out: hHeap=0x260000) returned 1 [0053.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2710 [0053.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.809] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.809] GetLastError () returned 0x0 [0053.809] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.809] GetLastError () returned 0x0 [0053.811] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc332, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.811] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3cce, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x3cce, lpOverlapped=0x0) returned 1 [0053.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.811] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.811] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.812] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.812] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.812] CloseHandle (hObject=0x10c) returned 1 [0053.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.813] GetLastError () returned 0x0 [0053.813] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.814] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.814] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.814] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17381548104) returned 1 [0053.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaee57350, dwHighDateTime=0x1d585b4)) [0053.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c6b8 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c6b8 | out: hHeap=0x260000) returned 1 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2e30 [0053.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.828] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.828] GetLastError () returned 0x0 [0053.828] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.828] GetLastError () returned 0x0 [0053.830] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff294c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.830] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xd6b4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0xd6b4, lpOverlapped=0x0) returned 1 [0053.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.831] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.831] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.832] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.832] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.832] CloseHandle (hObject=0x10c) returned 1 [0053.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.833] GetLastError () returned 0x0 [0053.834] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.835] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.835] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.835] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17383587050) returned 1 [0053.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaee57350, dwHighDateTime=0x1d585b4)) [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c6f0 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c6f0 | out: hHeap=0x260000) returned 1 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2ec8 [0053.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.835] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.835] GetLastError () returned 0x0 [0053.836] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.836] GetLastError () returned 0x0 [0053.838] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff5ae0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.838] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0xa520, lpOverlapped=0x0) returned 1 [0053.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.838] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.838] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.839] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.839] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.839] CloseHandle (hObject=0x10c) returned 1 [0053.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.840] GetLastError () returned 0x0 [0053.840] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756b88) returned 1 [0053.841] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0053.841] CryptReleaseContext (hProv=0x2756b88, dwFlags=0x0) returned 1 [0053.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0053.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.841] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17384251523) returned 1 [0053.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaee7d4b0, dwHighDateTime=0x1d585b4)) [0053.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5780 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5780 | out: hHeap=0x260000) returned 1 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2f60 [0053.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.842] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.842] GetLastError () returned 0x0 [0053.842] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.842] GetLastError () returned 0x0 [0053.876] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff5c4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.876] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xa3b2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0xa3b2, lpOverlapped=0x0) returned 1 [0053.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.876] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.876] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.877] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.877] CloseHandle (hObject=0x10c) returned 1 [0053.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.895] GetLastError () returned 0x0 [0053.898] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.899] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.899] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17390021167) returned 1 [0053.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaef15a30, dwHighDateTime=0x1d585b4)) [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c760 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c760 | out: hHeap=0x260000) returned 1 [0053.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2ff8 [0053.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.900] GetLastError () returned 0x0 [0053.900] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.900] GetLastError () returned 0x0 [0053.902] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff8eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.902] WriteFile (in: hFile=0x118, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x714e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x714e, lpOverlapped=0x0) returned 1 [0053.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.902] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.902] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.903] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.903] CloseHandle (hObject=0x118) returned 1 [0053.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0053.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0053.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.906] GetLastError () returned 0x0 [0053.907] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.908] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.908] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.908] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17390937205) returned 1 [0053.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaef15a30, dwHighDateTime=0x1d585b4)) [0053.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c798 [0053.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c798 | out: hHeap=0x260000) returned 1 [0053.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3420 [0053.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.909] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.909] GetLastError () returned 0x0 [0053.909] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.909] GetLastError () returned 0x0 [0053.911] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff83b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.911] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7c4e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x7c4e, lpOverlapped=0x0) returned 1 [0053.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.912] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.912] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.912] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.912] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.912] CloseHandle (hObject=0x110) returned 1 [0053.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.913] GetLastError () returned 0x0 [0053.914] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.915] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.915] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.915] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17391634808) returned 1 [0053.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaef3bb90, dwHighDateTime=0x1d585b4)) [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c808 [0053.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c808 | out: hHeap=0x260000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f34b8 [0053.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.916] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.916] GetLastError () returned 0x0 [0053.916] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.916] GetLastError () returned 0x0 [0053.918] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff99d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.918] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x662a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x662a, lpOverlapped=0x0) returned 1 [0053.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.918] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.919] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.919] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.919] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.919] CloseHandle (hObject=0x110) returned 1 [0053.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.920] GetLastError () returned 0x0 [0053.920] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0053.921] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.921] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.921] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17392503472) returned 1 [0053.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaef3bb90, dwHighDateTime=0x1d585b4)) [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c840 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c840 | out: hHeap=0x260000) returned 1 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f35e8 [0053.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.925] GetLastError () returned 0x0 [0053.925] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.925] GetLastError () returned 0x0 [0053.927] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.927] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x4124, lpOverlapped=0x0) returned 1 [0053.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.927] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.927] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.928] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.928] CloseHandle (hObject=0x110) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0053.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0053.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.929] GetLastError () returned 0x0 [0053.929] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756b88) returned 1 [0053.930] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0053.930] CryptReleaseContext (hProv=0x2756b88, dwFlags=0x0) returned 1 [0053.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0053.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0053.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0053.930] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17393138764) returned 1 [0053.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaef61cf0, dwHighDateTime=0x1d585b4)) [0053.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0053.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0053.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0053.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c878 [0053.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c878 | out: hHeap=0x260000) returned 1 [0053.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3680 [0053.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.931] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0053.931] GetLastError () returned 0x0 [0053.931] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0053.931] GetLastError () returned 0x0 [0053.968] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffec3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.968] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x13c4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x13c4, lpOverlapped=0x0) returned 1 [0053.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.968] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.968] WriteFile (in: hFile=0x110, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.969] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.969] CloseHandle (hObject=0x110) returned 1 [0053.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0053.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0053.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0053.995] GetLastError () returned 0x0 [0054.001] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.008] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.008] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17400960132) returned 1 [0054.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf0203d0, dwHighDateTime=0x1d585b4)) [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cb18 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cb18 | out: hHeap=0x260000) returned 1 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3d08 [0054.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.009] GetLastError () returned 0x0 [0054.009] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.009] GetLastError () returned 0x0 [0054.011] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb3f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.011] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4c0a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x4c0a, lpOverlapped=0x0) returned 1 [0054.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.012] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.012] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.012] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.012] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.012] CloseHandle (hObject=0xf8) returned 1 [0054.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.013] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.014] GetLastError () returned 0x0 [0054.014] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.015] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.015] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.015] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17401587729) returned 1 [0054.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf0203d0, dwHighDateTime=0x1d585b4)) [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cb50 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cb50 | out: hHeap=0x260000) returned 1 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3da0 [0054.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.015] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.015] GetLastError () returned 0x0 [0054.016] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.016] GetLastError () returned 0x0 [0054.017] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb0f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.017] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4f08, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x4f08, lpOverlapped=0x0) returned 1 [0054.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.018] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.018] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.018] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.019] CloseHandle (hObject=0xf8) returned 1 [0054.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.020] GetLastError () returned 0x0 [0054.021] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.022] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.022] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.022] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17402291604) returned 1 [0054.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf0203d0, dwHighDateTime=0x1d585b4)) [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cbc0 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cbc0 | out: hHeap=0x260000) returned 1 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3ed0 [0054.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.022] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.022] GetLastError () returned 0x0 [0054.023] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.023] GetLastError () returned 0x0 [0054.024] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc992, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.024] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x366e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x366e, lpOverlapped=0x0) returned 1 [0054.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.025] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.025] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.025] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.025] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.025] CloseHandle (hObject=0xf8) returned 1 [0054.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.027] GetLastError () returned 0x0 [0054.027] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.028] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.028] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.028] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17402883898) returned 1 [0054.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf046530, dwHighDateTime=0x1d585b4)) [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cbf8 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cbf8 | out: hHeap=0x260000) returned 1 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325f20 [0054.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.028] GetLastError () returned 0x0 [0054.028] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.029] GetLastError () returned 0x0 [0054.030] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd8c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.030] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x273e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x273e, lpOverlapped=0x0) returned 1 [0054.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.031] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.031] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.031] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.031] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.031] CloseHandle (hObject=0xf8) returned 1 [0054.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.032] GetLastError () returned 0x0 [0054.033] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.033] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.033] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.034] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17403472230) returned 1 [0054.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf046530, dwHighDateTime=0x1d585b4)) [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cc30 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cc30 | out: hHeap=0x260000) returned 1 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d060 [0054.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.034] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.034] GetLastError () returned 0x0 [0054.034] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.034] GetLastError () returned 0x0 [0054.036] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff0ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.036] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xf36, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xf36, lpOverlapped=0x0) returned 1 [0054.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.036] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.037] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.037] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.037] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.037] CloseHandle (hObject=0xf8) returned 1 [0054.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.038] GetLastError () returned 0x0 [0054.039] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27571e8) returned 1 [0054.039] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0054.039] CryptReleaseContext (hProv=0x27571e8, dwFlags=0x0) returned 1 [0054.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0054.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.040] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17404069410) returned 1 [0054.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf06c690, dwHighDateTime=0x1d585b4)) [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cc68 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cc68 | out: hHeap=0x260000) returned 1 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d0f8 [0054.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.040] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.040] GetLastError () returned 0x0 [0054.040] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.040] GetLastError () returned 0x0 [0054.128] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5af2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.129] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xa50e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xa50e, lpOverlapped=0x0) returned 1 [0054.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.129] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.129] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.130] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.130] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.139] CloseHandle (hObject=0xf8) returned 1 [0054.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.[deadmin@cock.li].deadmin")) returned 1 [0054.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.152] GetLastError () returned 0x0 [0054.152] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.153] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.153] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17415400984) returned 1 [0054.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf177030, dwHighDateTime=0x1d585b4)) [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cf78 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cf78 | out: hHeap=0x260000) returned 1 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d190 [0054.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.153] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.154] GetLastError () returned 0x0 [0054.154] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.154] GetLastError () returned 0x0 [0054.157] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffea0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.157] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x15f2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x15f2, lpOverlapped=0x0) returned 1 [0054.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.157] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.157] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.157] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.158] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.158] CloseHandle (hObject=0xf8) returned 1 [0054.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.161] GetLastError () returned 0x0 [0054.161] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.162] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.162] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17416344831) returned 1 [0054.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf177030, dwHighDateTime=0x1d585b4)) [0054.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cfb0 [0054.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cfb0 | out: hHeap=0x260000) returned 1 [0054.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275da78 [0054.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.163] GetLastError () returned 0x0 [0054.163] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.163] GetLastError () returned 0x0 [0054.165] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff587d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.165] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xa783, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0xa783, lpOverlapped=0x0) returned 1 [0054.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.166] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.166] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.166] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.166] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.167] CloseHandle (hObject=0xf8) returned 1 [0054.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.[deadmin@cock.li].deadmin")) returned 1 [0054.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.168] GetLastError () returned 0x0 [0054.168] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.169] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.169] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17417026586) returned 1 [0054.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf19d190, dwHighDateTime=0x1d585b4)) [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cfe8 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cfe8 | out: hHeap=0x260000) returned 1 [0054.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275db10 [0054.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.170] GetLastError () returned 0x0 [0054.170] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.170] GetLastError () returned 0x0 [0054.172] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffab8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.172] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x5474, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x5474, lpOverlapped=0x0) returned 1 [0054.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.172] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.172] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.173] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.173] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.173] CloseHandle (hObject=0xf8) returned 1 [0054.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.[deadmin@cock.li].deadmin")) returned 1 [0054.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.174] GetLastError () returned 0x0 [0054.174] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.175] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.175] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.175] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17417617923) returned 1 [0054.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf19d190, dwHighDateTime=0x1d585b4)) [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761060 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761060 | out: hHeap=0x260000) returned 1 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dba8 [0054.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.176] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.176] GetLastError () returned 0x0 [0054.176] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.176] GetLastError () returned 0x0 [0054.178] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5b78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.178] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xa488, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0xa488, lpOverlapped=0x0) returned 1 [0054.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.179] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.179] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.179] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.179] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.180] CloseHandle (hObject=0xf8) returned 1 [0054.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.181] GetLastError () returned 0x0 [0054.181] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.182] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.182] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17418463561) returned 1 [0054.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf1c32f0, dwHighDateTime=0x1d585b4)) [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761098 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761098 | out: hHeap=0x260000) returned 1 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dc40 [0054.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.184] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.184] GetLastError () returned 0x0 [0054.184] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.184] GetLastError () returned 0x0 [0054.306] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff9f24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.315] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x60dc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x60dc, lpOverlapped=0x0) returned 1 [0054.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.323] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.323] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.323] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.323] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.324] CloseHandle (hObject=0xf8) returned 1 [0054.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.325] GetLastError () returned 0x0 [0054.325] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.326] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.326] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.326] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17432707854) returned 1 [0054.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf319f50, dwHighDateTime=0x1d585b4)) [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761450 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761450 | out: hHeap=0x260000) returned 1 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dcd8 [0054.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.327] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.327] GetLastError () returned 0x0 [0054.327] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.327] GetLastError () returned 0x0 [0054.330] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff7664, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.330] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x899c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x899c, lpOverlapped=0x0) returned 1 [0054.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.331] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.331] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.331] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.331] CloseHandle (hObject=0xf8) returned 1 [0054.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.332] GetLastError () returned 0x0 [0054.333] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.333] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.334] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17433467624) returned 1 [0054.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf319f50, dwHighDateTime=0x1d585b4)) [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1740 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1740 | out: hHeap=0x260000) returned 1 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296728 [0054.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.334] GetLastError () returned 0x0 [0054.334] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.334] GetLastError () returned 0x0 [0054.336] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb21a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.336] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4de6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x4de6, lpOverlapped=0x0) returned 1 [0054.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.336] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.336] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.337] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.337] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.337] CloseHandle (hObject=0xf8) returned 1 [0054.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.338] GetLastError () returned 0x0 [0054.338] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.339] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.339] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17434051603) returned 1 [0054.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf3400b0, dwHighDateTime=0x1d585b4)) [0054.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1708 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1708 | out: hHeap=0x260000) returned 1 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e6f0 [0054.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.340] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.340] GetLastError () returned 0x0 [0054.340] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.340] GetLastError () returned 0x0 [0054.342] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.342] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x26e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x26e8, lpOverlapped=0x0) returned 1 [0054.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.343] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.343] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.343] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.343] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.344] CloseHandle (hObject=0xf8) returned 1 [0054.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.344] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.345] GetLastError () returned 0x0 [0054.345] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.346] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.346] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17434744307) returned 1 [0054.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf3400b0, dwHighDateTime=0x1d585b4)) [0054.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761488 [0054.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761488 | out: hHeap=0x260000) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e788 [0054.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.347] GetLastError () returned 0x0 [0054.347] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.347] GetLastError () returned 0x0 [0054.350] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffced4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.350] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x312c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x312c, lpOverlapped=0x0) returned 1 [0054.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.351] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.351] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.351] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.351] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.352] CloseHandle (hObject=0xf8) returned 1 [0054.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.527] GetLastError () returned 0x0 [0054.527] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.552] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17455265387) returned 1 [0054.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf52f290, dwHighDateTime=0x1d585b4)) [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27616b8 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27616b8 | out: hHeap=0x260000) returned 1 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ef40 [0054.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.552] GetLastError () returned 0x0 [0054.552] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.553] GetLastError () returned 0x0 [0054.557] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffa660, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.557] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x59a0, lpOverlapped=0x0) returned 1 [0054.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.557] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.557] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.558] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.558] CloseHandle (hObject=0xf8) returned 1 [0054.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.562] GetLastError () returned 0x0 [0054.562] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.563] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.563] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.563] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17456417411) returned 1 [0054.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf5553f0, dwHighDateTime=0x1d585b4)) [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761798 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761798 | out: hHeap=0x260000) returned 1 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ed78 [0054.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.564] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.564] GetLastError () returned 0x0 [0054.564] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.564] GetLastError () returned 0x0 [0054.566] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe904, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.566] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x16fc, lpOverlapped=0x0) returned 1 [0054.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.566] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.566] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.566] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.566] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.567] CloseHandle (hObject=0xf8) returned 1 [0054.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.568] GetLastError () returned 0x0 [0054.568] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.569] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.570] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17457064424) returned 1 [0054.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf57b550, dwHighDateTime=0x1d585b4)) [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27617d0 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27617d0 | out: hHeap=0x260000) returned 1 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f070 [0054.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.570] GetLastError () returned 0x0 [0054.570] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.570] GetLastError () returned 0x0 [0054.574] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffed6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.574] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1294, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1294, lpOverlapped=0x0) returned 1 [0054.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.575] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.575] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.575] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.575] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.576] CloseHandle (hObject=0xf8) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.577] GetLastError () returned 0x0 [0054.577] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.578] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.578] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.578] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17457954538) returned 1 [0054.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf57b550, dwHighDateTime=0x1d585b4)) [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761808 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761808 | out: hHeap=0x260000) returned 1 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0054.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.579] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.579] GetLastError () returned 0x0 [0054.579] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.579] GetLastError () returned 0x0 [0054.581] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffeb9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.581] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1464, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x1464, lpOverlapped=0x0) returned 1 [0054.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.581] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.581] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.582] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.582] CloseHandle (hObject=0xf8) returned 1 [0054.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0054.583] GetLastError () returned 0x0 [0054.583] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.584] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.584] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.584] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17458538092) returned 1 [0054.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf57b550, dwHighDateTime=0x1d585b4)) [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761878 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761878 | out: hHeap=0x260000) returned 1 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e360 [0054.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.622] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.623] GetLastError () returned 0x0 [0054.623] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.623] GetLastError () returned 0x0 [0054.625] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff7bdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.625] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8424, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x8424, lpOverlapped=0x0) returned 1 [0054.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.625] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.626] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.626] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.626] CloseHandle (hObject=0xf8) returned 1 [0054.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.646] GetLastError () returned 0x0 [0054.657] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.670] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.670] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.671] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17467177753) returned 1 [0054.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf65fd90, dwHighDateTime=0x1d585b4)) [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761958 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761958 | out: hHeap=0x260000) returned 1 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f5c8 [0054.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.671] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.671] GetLastError () returned 0x0 [0054.671] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.672] GetLastError () returned 0x0 [0054.674] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe3c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.674] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x1c40, lpOverlapped=0x0) returned 1 [0054.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.675] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.675] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.675] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.675] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.675] CloseHandle (hObject=0xf8) returned 1 [0054.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0054.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0054.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.677] GetLastError () returned 0x0 [0054.677] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.677] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.678] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17467877003) returned 1 [0054.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf65fd90, dwHighDateTime=0x1d585b4)) [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761a00 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761a00 | out: hHeap=0x260000) returned 1 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f498 [0054.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.678] GetLastError () returned 0x0 [0054.678] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.679] GetLastError () returned 0x0 [0054.680] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffeab4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.680] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x154c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x154c, lpOverlapped=0x0) returned 1 [0054.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.680] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.681] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.681] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.681] CloseHandle (hObject=0xf8) returned 1 [0054.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.683] GetLastError () returned 0x0 [0054.683] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.684] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.684] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17468512622) returned 1 [0054.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf685ef0, dwHighDateTime=0x1d585b4)) [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761a38 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761a38 | out: hHeap=0x260000) returned 1 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f6f8 [0054.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.685] GetLastError () returned 0x0 [0054.685] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.685] GetLastError () returned 0x0 [0054.687] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.687] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x13e8, lpOverlapped=0x0) returned 1 [0054.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.687] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.687] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.688] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.688] CloseHandle (hObject=0xf8) returned 1 [0054.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.688] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.689] GetLastError () returned 0x0 [0054.689] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.690] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.690] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.690] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17469115626) returned 1 [0054.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf685ef0, dwHighDateTime=0x1d585b4)) [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761a70 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761a70 | out: hHeap=0x260000) returned 1 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f790 [0054.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.691] GetLastError () returned 0x0 [0054.691] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.691] GetLastError () returned 0x0 [0054.692] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff260, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.693] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xda0, lpOverlapped=0x0) returned 1 [0054.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.693] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.693] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.693] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.693] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.694] CloseHandle (hObject=0xf8) returned 1 [0054.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.695] GetLastError () returned 0x0 [0054.696] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.697] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.697] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17469786569) returned 1 [0054.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf6ac050, dwHighDateTime=0x1d585b4)) [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761ae0 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761ae0 | out: hHeap=0x260000) returned 1 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f828 [0054.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.697] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.697] GetLastError () returned 0x0 [0054.698] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.698] GetLastError () returned 0x0 [0054.699] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe208, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.699] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1df8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x1df8, lpOverlapped=0x0) returned 1 [0054.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.700] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.700] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.700] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.700] CloseHandle (hObject=0xf8) returned 1 [0054.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.701] GetLastError () returned 0x0 [0054.702] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0054.702] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.702] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.703] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17470479418) returned 1 [0054.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf6ac050, dwHighDateTime=0x1d585b4)) [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761b18 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0054.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761b18 | out: hHeap=0x260000) returned 1 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f958 [0054.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.704] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.704] GetLastError () returned 0x0 [0054.704] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.705] GetLastError () returned 0x0 [0054.707] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5bf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.707] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xa410, lpOverlapped=0x0) returned 1 [0054.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.707] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.707] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.708] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.708] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.708] CloseHandle (hObject=0xf8) returned 1 [0054.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0054.709] GetLastError () returned 0x0 [0054.756] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0054.757] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0054.757] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0054.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0054.757] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17475795460) returned 1 [0054.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaf7445d0, dwHighDateTime=0x1d585b4)) [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761b50 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761b50 | out: hHeap=0x260000) returned 1 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f9f0 [0054.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.757] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0054.758] GetLastError () returned 0x0 [0054.758] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0054.758] GetLastError () returned 0x0 [0054.806] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff23c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.806] WriteFile (in: hFile=0xf8, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xdc4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xdc4, lpOverlapped=0x0) returned 1 [0054.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.807] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.807] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.807] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.807] CloseHandle (hObject=0xf8) returned 1 [0054.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.071] GetLastError () returned 0x0 [0055.073] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.074] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.074] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17507502270) returned 1 [0055.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafa3e150, dwHighDateTime=0x1d585b4)) [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f58d0 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f58d0 | out: hHeap=0x260000) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fa88 [0055.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.075] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.075] GetLastError () returned 0x0 [0055.075] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.075] GetLastError () returned 0x0 [0055.079] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc776, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.079] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x388a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x388a, lpOverlapped=0x0) returned 1 [0055.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.081] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.081] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.081] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.081] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.082] CloseHandle (hObject=0xf8) returned 1 [0055.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.084] GetLastError () returned 0x0 [0055.084] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.085] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.085] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17508659879) returned 1 [0055.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafa642b0, dwHighDateTime=0x1d585b4)) [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5898 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5898 | out: hHeap=0x260000) returned 1 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27609f8 [0055.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.086] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.086] GetLastError () returned 0x0 [0055.087] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.087] GetLastError () returned 0x0 [0055.089] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdbc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.089] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2440, lpOverlapped=0x0) returned 1 [0055.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.090] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.090] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.090] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.090] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.091] CloseHandle (hObject=0xf8) returned 1 [0055.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.092] GetLastError () returned 0x0 [0055.092] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.093] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.093] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.094] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17509557084) returned 1 [0055.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafa642b0, dwHighDateTime=0x1d585b4)) [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5860 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5860 | out: hHeap=0x260000) returned 1 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760a90 [0055.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.095] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.095] GetLastError () returned 0x0 [0055.095] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.096] GetLastError () returned 0x0 [0055.098] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff86a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.098] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x795c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x795c, lpOverlapped=0x0) returned 1 [0055.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.098] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.099] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.099] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.099] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.100] CloseHandle (hObject=0xf8) returned 1 [0055.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.101] GetLastError () returned 0x0 [0055.103] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.104] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.104] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.104] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17510503979) returned 1 [0055.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafa8a410, dwHighDateTime=0x1d585b4)) [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5828 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5828 | out: hHeap=0x260000) returned 1 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760b28 [0055.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.105] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.105] GetLastError () returned 0x0 [0055.105] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.105] GetLastError () returned 0x0 [0055.108] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffadc2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.108] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x523e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x523e, lpOverlapped=0x0) returned 1 [0055.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.109] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.109] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.109] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.109] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.110] CloseHandle (hObject=0xf8) returned 1 [0055.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.112] GetLastError () returned 0x0 [0055.112] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.113] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.113] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.113] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17511423313) returned 1 [0055.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafa8a410, dwHighDateTime=0x1d585b4)) [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0118 [0055.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0118 | out: hHeap=0x260000) returned 1 [0055.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760bc0 [0055.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.114] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.114] GetLastError () returned 0x0 [0055.114] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.114] GetLastError () returned 0x0 [0055.281] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd14c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.281] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2eb4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2eb4, lpOverlapped=0x0) returned 1 [0055.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.283] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.283] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.284] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.284] CloseHandle (hObject=0xf8) returned 1 [0055.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.285] GetLastError () returned 0x0 [0055.286] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.286] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.287] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17528775678) returned 1 [0055.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafc53490, dwHighDateTime=0x1d585b4)) [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27621e8 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27621e8 | out: hHeap=0x260000) returned 1 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27645b8 [0055.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.287] GetLastError () returned 0x0 [0055.287] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.288] GetLastError () returned 0x0 [0055.290] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffbd2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.291] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x42d1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x42d1, lpOverlapped=0x0) returned 1 [0055.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.291] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.291] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.291] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.292] CloseHandle (hObject=0xf8) returned 1 [0055.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.293] GetLastError () returned 0x0 [0055.293] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.294] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.294] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.294] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17529525933) returned 1 [0055.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafc53490, dwHighDateTime=0x1d585b4)) [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762220 [0055.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762220 | out: hHeap=0x260000) returned 1 [0055.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27646e8 [0055.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.295] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.295] GetLastError () returned 0x0 [0055.295] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.295] GetLastError () returned 0x0 [0055.297] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc16f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.297] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3e91, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x3e91, lpOverlapped=0x0) returned 1 [0055.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.297] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.297] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.298] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.298] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.298] CloseHandle (hObject=0xf8) returned 1 [0055.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.299] GetLastError () returned 0x0 [0055.299] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.300] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.300] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17530155612) returned 1 [0055.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafc53490, dwHighDateTime=0x1d585b4)) [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762258 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762258 | out: hHeap=0x260000) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764780 [0055.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.301] GetLastError () returned 0x0 [0055.301] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.301] GetLastError () returned 0x0 [0055.303] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffbc3b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.303] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x43c5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x43c5, lpOverlapped=0x0) returned 1 [0055.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.303] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.303] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.304] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.304] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.304] CloseHandle (hObject=0xf8) returned 1 [0055.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.305] GetLastError () returned 0x0 [0055.306] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.307] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.307] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.307] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17530797351) returned 1 [0055.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafc795f0, dwHighDateTime=0x1d585b4)) [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762290 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762290 | out: hHeap=0x260000) returned 1 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764818 [0055.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.307] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.308] GetLastError () returned 0x0 [0055.308] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.308] GetLastError () returned 0x0 [0055.309] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff727a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.309] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8d86, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x8d86, lpOverlapped=0x0) returned 1 [0055.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.310] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.310] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.310] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.310] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.311] CloseHandle (hObject=0xf8) returned 1 [0055.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.312] GetLastError () returned 0x0 [0055.312] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.313] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.313] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.313] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17531407136) returned 1 [0055.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafc795f0, dwHighDateTime=0x1d585b4)) [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27622c8 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27622c8 | out: hHeap=0x260000) returned 1 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27648b0 [0055.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.314] GetLastError () returned 0x0 [0055.314] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.314] GetLastError () returned 0x0 [0055.402] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd2df, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.402] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2d21, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2d21, lpOverlapped=0x0) returned 1 [0055.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.403] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.403] WriteFile (in: hFile=0xf8, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.403] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.404] CloseHandle (hObject=0xf8) returned 1 [0055.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.425] GetLastError () returned 0x0 [0055.425] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d34e8) returned 1 [0055.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.426] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.426] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17542733925) returned 1 [0055.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafd83f90, dwHighDateTime=0x1d585b4)) [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27623a8 [0055.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27623a8 | out: hHeap=0x260000) returned 1 [0055.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764948 [0055.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.427] GetLastError () returned 0x0 [0055.427] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.427] GetLastError () returned 0x0 [0055.432] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff855a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.432] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7aa6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x7aa6, lpOverlapped=0x0) returned 1 [0055.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.433] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.433] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.433] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.433] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.434] CloseHandle (hObject=0x10c) returned 1 [0055.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.435] GetLastError () returned 0x0 [0055.435] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d34e8) returned 1 [0055.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.436] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.436] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17543707809) returned 1 [0055.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafdaa0f0, dwHighDateTime=0x1d585b4)) [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27623e0 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27623e0 | out: hHeap=0x260000) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764ba8 [0055.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.437] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.437] GetLastError () returned 0x0 [0055.437] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.437] GetLastError () returned 0x0 [0055.439] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe49c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.439] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1b64, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1b64, lpOverlapped=0x0) returned 1 [0055.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.439] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.439] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.440] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.440] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.440] CloseHandle (hObject=0x10c) returned 1 [0055.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0055.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0055.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.441] GetLastError () returned 0x0 [0055.442] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d34e8) returned 1 [0055.443] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.443] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.443] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17544422454) returned 1 [0055.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafdd0250, dwHighDateTime=0x1d585b4)) [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762418 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762418 | out: hHeap=0x260000) returned 1 [0055.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764c40 [0055.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.444] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.444] GetLastError () returned 0x0 [0055.444] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.444] GetLastError () returned 0x0 [0055.446] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc9a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.446] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3658, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x3658, lpOverlapped=0x0) returned 1 [0055.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.446] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.446] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.447] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.447] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.447] CloseHandle (hObject=0x10c) returned 1 [0055.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0055.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0055.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.448] GetLastError () returned 0x0 [0055.448] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d34e8) returned 1 [0055.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.449] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.449] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17545030901) returned 1 [0055.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafdd0250, dwHighDateTime=0x1d585b4)) [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762450 [0055.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762450 | out: hHeap=0x260000) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764cd8 [0055.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.450] GetLastError () returned 0x0 [0055.450] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.450] GetLastError () returned 0x0 [0055.452] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb4aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.452] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4b56, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x4b56, lpOverlapped=0x0) returned 1 [0055.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.452] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.452] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.453] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.453] CloseHandle (hObject=0x10c) returned 1 [0055.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0055.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0055.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.456] GetLastError () returned 0x0 [0055.457] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d34e8) returned 1 [0055.457] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.457] CryptReleaseContext (hProv=0x2d34e8, dwFlags=0x0) returned 1 [0055.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.458] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17545872474) returned 1 [0055.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafdd0250, dwHighDateTime=0x1d585b4)) [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762488 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762488 | out: hHeap=0x260000) returned 1 [0055.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764228 [0055.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.541] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.541] GetLastError () returned 0x0 [0055.541] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.541] GetLastError () returned 0x0 [0055.544] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffed5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.544] WriteFile (in: hFile=0x10c, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x12a6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x238fdb0*=0x12a6, lpOverlapped=0x0) returned 1 [0055.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.545] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.545] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.546] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.546] CloseHandle (hObject=0x10c) returned 1 [0055.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.550] GetLastError () returned 0x0 [0055.550] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.551] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17555206350) returned 1 [0055.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafeb4a90, dwHighDateTime=0x1d585b4)) [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27625a0 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27625a0 | out: hHeap=0x260000) returned 1 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764e08 [0055.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.552] GetLastError () returned 0x0 [0055.552] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.552] GetLastError () returned 0x0 [0055.554] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff1bd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.554] WriteFile (in: hFile=0x10c, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0xe42c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x238fdb0*=0xe42c, lpOverlapped=0x0) returned 1 [0055.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.555] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.555] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.555] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.555] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.556] CloseHandle (hObject=0x10c) returned 1 [0055.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.557] GetLastError () returned 0x0 [0055.557] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.558] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.558] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.558] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17555954309) returned 1 [0055.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafedabf0, dwHighDateTime=0x1d585b4)) [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27625d8 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27625d8 | out: hHeap=0x260000) returned 1 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765100 [0055.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.559] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.559] GetLastError () returned 0x0 [0055.559] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.559] GetLastError () returned 0x0 [0055.562] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffef772, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.562] WriteFile (in: hFile=0x10c, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x1088e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x238fdb0*=0x1088e, lpOverlapped=0x0) returned 1 [0055.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.562] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.562] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.563] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.563] CloseHandle (hObject=0x10c) returned 1 [0055.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.564] GetLastError () returned 0x0 [0055.564] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.565] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.565] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17556644646) returned 1 [0055.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xafedabf0, dwHighDateTime=0x1d585b4)) [0055.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762610 [0055.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762610 | out: hHeap=0x260000) returned 1 [0055.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765198 [0055.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.566] GetLastError () returned 0x0 [0055.566] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.566] GetLastError () returned 0x0 [0055.568] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffef814, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.568] WriteFile (in: hFile=0x10c, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x107ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x238fdb0*=0x107ec, lpOverlapped=0x0) returned 1 [0055.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.569] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.569] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.569] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.570] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.570] CloseHandle (hObject=0x10c) returned 1 [0055.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.571] GetLastError () returned 0x0 [0055.571] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.572] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.572] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17557322269) returned 1 [0055.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaff00d50, dwHighDateTime=0x1d585b4)) [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762648 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762648 | out: hHeap=0x260000) returned 1 [0055.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0055.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.573] GetLastError () returned 0x0 [0055.573] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.573] GetLastError () returned 0x0 [0055.575] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffa632, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.575] WriteFile (in: hFile=0x10c, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x59ce, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x238fdb0*=0x59ce, lpOverlapped=0x0) returned 1 [0055.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.575] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.575] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.576] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.576] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.576] CloseHandle (hObject=0x10c) returned 1 [0055.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.577] GetLastError () returned 0x0 [0055.578] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.578] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.578] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0055.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0055.578] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17557957344) returned 1 [0055.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xaff00d50, dwHighDateTime=0x1d585b4)) [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762680 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762680 | out: hHeap=0x260000) returned 1 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0055.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0055.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27652c8 [0055.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.579] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.579] GetLastError () returned 0x0 [0055.579] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.579] GetLastError () returned 0x0 [0055.663] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc2dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.663] WriteFile (in: hFile=0x10c, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x3d24, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x238fdb0*=0x3d24, lpOverlapped=0x0) returned 1 [0055.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.671] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.671] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.680] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.686] CloseHandle (hObject=0x10c) returned 1 [0055.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0055.688] GetLastError () returned 0x0 [0055.816] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.839] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.839] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.839] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17584060798) returned 1 [0055.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb01884b0, dwHighDateTime=0x1d585b4)) [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762b88 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762b88 | out: hHeap=0x260000) returned 1 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27665c8 [0055.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.840] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.840] GetLastError () returned 0x0 [0055.840] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.840] GetLastError () returned 0x0 [0055.842] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffabb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.842] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x544c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x238fdb0*=0x544c, lpOverlapped=0x0) returned 1 [0055.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0055.843] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.843] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.843] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.844] CloseHandle (hObject=0x108) returned 1 [0055.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.867] GetLastError () returned 0x0 [0055.882] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.889] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.889] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.889] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17588998255) returned 1 [0055.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb01fa8d0, dwHighDateTime=0x1d585b4)) [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bcb8 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bcb8 | out: hHeap=0x260000) returned 1 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27668c0 [0055.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.889] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.890] GetLastError () returned 0x0 [0055.890] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.890] GetLastError () returned 0x0 [0055.893] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffcda0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.893] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x3260, lpOverlapped=0x0) returned 1 [0055.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.893] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.893] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.894] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.894] CloseHandle (hObject=0x10c) returned 1 [0055.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cec0 [0055.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0055.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.895] GetLastError () returned 0x0 [0055.896] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.896] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.897] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17589770625) returned 1 [0055.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0220a30, dwHighDateTime=0x1d585b4)) [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bc80 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bc80 | out: hHeap=0x260000) returned 1 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766828 [0055.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.897] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.897] GetLastError () returned 0x0 [0055.897] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.898] GetLastError () returned 0x0 [0055.899] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb528, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.900] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4ad8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x4ad8, lpOverlapped=0x0) returned 1 [0055.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.900] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.901] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.901] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.901] CloseHandle (hObject=0x10c) returned 1 [0055.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d500 [0055.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x260000) returned 1 [0055.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.903] GetLastError () returned 0x0 [0055.903] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.904] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.904] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.904] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17590499857) returned 1 [0055.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0220a30, dwHighDateTime=0x1d585b4)) [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bc48 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bc48 | out: hHeap=0x260000) returned 1 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27669f0 [0055.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.905] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.905] GetLastError () returned 0x0 [0055.905] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.905] GetLastError () returned 0x0 [0055.908] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffad3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.908] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x52c3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x52c3, lpOverlapped=0x0) returned 1 [0055.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.908] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.909] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.909] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.909] CloseHandle (hObject=0x10c) returned 1 [0055.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cec0 [0055.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0055.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0055.910] GetLastError () returned 0x0 [0055.912] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0055.912] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.912] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0055.913] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17591375247) returned 1 [0055.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0246b90, dwHighDateTime=0x1d585b4)) [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bc10 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bc10 | out: hHeap=0x260000) returned 1 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766a88 [0055.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.913] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0055.914] GetLastError () returned 0x0 [0055.914] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0055.914] GetLastError () returned 0x0 [0055.988] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8ba9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.988] WriteFile (in: hFile=0x10c, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x7457, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x238fdb0*=0x7457, lpOverlapped=0x0) returned 1 [0055.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.989] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.989] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.989] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.989] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.990] CloseHandle (hObject=0x10c) returned 1 [0055.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.055] GetLastError () returned 0x0 [0056.056] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.056] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.056] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.057] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17605793913) returned 1 [0056.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb03c3950, dwHighDateTime=0x1d585b4)) [0056.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763090 [0056.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763090 | out: hHeap=0x260000) returned 1 [0056.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767798 [0056.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.082] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.082] GetLastError () returned 0x0 [0056.082] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.082] GetLastError () returned 0x0 [0056.085] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.085] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.120] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.120] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.132] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.132] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.132] CloseHandle (hObject=0x10c) returned 1 [0056.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.134] GetLastError () returned 0x0 [0056.134] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.135] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.135] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17613591344) returned 1 [0056.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb045bed0, dwHighDateTime=0x1d585b4)) [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27631a8 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27631a8 | out: hHeap=0x260000) returned 1 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767700 [0056.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.135] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.136] GetLastError () returned 0x0 [0056.136] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.136] GetLastError () returned 0x0 [0056.140] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.140] WriteFile (in: hFile=0x10c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.142] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.142] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.143] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.143] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.143] CloseHandle (hObject=0x10c) returned 1 [0056.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.144] GetLastError () returned 0x0 [0056.145] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.146] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.146] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.146] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17614758387) returned 1 [0056.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0482030, dwHighDateTime=0x1d585b4)) [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27631e0 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27631e0 | out: hHeap=0x260000) returned 1 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767b28 [0056.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.147] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.147] GetLastError () returned 0x0 [0056.147] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.147] GetLastError () returned 0x0 [0056.150] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe872e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.150] WriteFile (in: hFile=0x10c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x178d2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x178d2, lpOverlapped=0x0) returned 1 [0056.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.151] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.151] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.151] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.151] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.152] CloseHandle (hObject=0x10c) returned 1 [0056.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.153] GetLastError () returned 0x0 [0056.153] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.154] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.154] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.154] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17615546603) returned 1 [0056.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0482030, dwHighDateTime=0x1d585b4)) [0056.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763218 [0056.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763218 | out: hHeap=0x260000) returned 1 [0056.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767bc0 [0056.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.155] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.155] GetLastError () returned 0x0 [0056.155] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.155] GetLastError () returned 0x0 [0056.268] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe88b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.268] WriteFile (in: hFile=0x10c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x17749, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x17749, lpOverlapped=0x0) returned 1 [0056.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.269] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.269] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.269] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.270] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.270] CloseHandle (hObject=0x10c) returned 1 [0056.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.326] GetLastError () returned 0x0 [0056.326] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.327] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.327] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.327] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17632842753) returned 1 [0056.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0624f50, dwHighDateTime=0x1d585b4)) [0056.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763640 [0056.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763640 | out: hHeap=0x260000) returned 1 [0056.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5ad8 [0056.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.328] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.328] GetLastError () returned 0x0 [0056.328] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.328] GetLastError () returned 0x0 [0056.331] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8786, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.331] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x787a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x787a, lpOverlapped=0x0) returned 1 [0056.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.333] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.333] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.333] CloseHandle (hObject=0x10c) returned 1 [0056.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.335] GetLastError () returned 0x0 [0056.335] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.336] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.336] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.336] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17633724856) returned 1 [0056.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb064b0b0, dwHighDateTime=0x1d585b4)) [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763678 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763678 | out: hHeap=0x260000) returned 1 [0056.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5c08 [0056.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.337] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.337] GetLastError () returned 0x0 [0056.337] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.337] GetLastError () returned 0x0 [0056.339] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff56e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.339] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0xa91e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0xa91e, lpOverlapped=0x0) returned 1 [0056.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.340] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.340] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.340] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.340] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.341] CloseHandle (hObject=0x10c) returned 1 [0056.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.342] GetLastError () returned 0x0 [0056.343] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e5a0) returned 1 [0056.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0056.343] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.344] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17634472724) returned 1 [0056.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb064b0b0, dwHighDateTime=0x1d585b4)) [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27636b0 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27636b0 | out: hHeap=0x260000) returned 1 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5ca0 [0056.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.344] GetLastError () returned 0x0 [0056.344] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.345] GetLastError () returned 0x0 [0056.346] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc4bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.346] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x3b43, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x3b43, lpOverlapped=0x0) returned 1 [0056.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.347] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.347] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.347] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.348] CloseHandle (hObject=0x10c) returned 1 [0056.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.349] GetLastError () returned 0x0 [0056.349] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e5a0) returned 1 [0056.350] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0056.350] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.350] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17635128462) returned 1 [0056.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0671210, dwHighDateTime=0x1d585b4)) [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27636e8 [0056.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27636e8 | out: hHeap=0x260000) returned 1 [0056.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5d38 [0056.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.351] GetLastError () returned 0x0 [0056.351] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.351] GetLastError () returned 0x0 [0056.353] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc696, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.353] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x396a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x396a, lpOverlapped=0x0) returned 1 [0056.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.354] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.354] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.354] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.354] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.354] CloseHandle (hObject=0x10c) returned 1 [0056.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.356] GetLastError () returned 0x0 [0056.356] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.357] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.357] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.357] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17635790929) returned 1 [0056.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0671210, dwHighDateTime=0x1d585b4)) [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763720 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763720 | out: hHeap=0x260000) returned 1 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5dd0 [0056.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.358] GetLastError () returned 0x0 [0056.358] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.358] GetLastError () returned 0x0 [0056.424] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff96c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.424] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x693e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x693e, lpOverlapped=0x0) returned 1 [0056.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.425] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.425] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.425] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.425] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.426] CloseHandle (hObject=0x10c) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.426] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.427] GetLastError () returned 0x0 [0056.427] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.428] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.428] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.428] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17642916120) returned 1 [0056.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb072f8f0, dwHighDateTime=0x1d585b4)) [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27638e0 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27638e0 | out: hHeap=0x260000) returned 1 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f5e68 [0056.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.429] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.429] GetLastError () returned 0x0 [0056.429] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.429] GetLastError () returned 0x0 [0056.434] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.434] WriteFile (in: hFile=0x10c, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.436] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.436] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.437] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.437] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.437] CloseHandle (hObject=0x10c) returned 1 [0056.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.[deadmin@cock.li].deadmin")) returned 1 [0056.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.439] GetLastError () returned 0x0 [0056.439] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.440] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.440] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.440] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17644084912) returned 1 [0056.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb072f8f0, dwHighDateTime=0x1d585b4)) [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763918 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763918 | out: hHeap=0x260000) returned 1 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6328 [0056.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.440] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.441] GetLastError () returned 0x0 [0056.441] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.441] GetLastError () returned 0x0 [0056.470] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffea2b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.470] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x15d49, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x15d49, lpOverlapped=0x0) returned 1 [0056.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.471] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.471] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.472] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.472] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.472] CloseHandle (hObject=0x10c) returned 1 [0056.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.[deadmin@cock.li].deadmin")) returned 1 [0056.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.473] GetLastError () returned 0x0 [0056.474] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.474] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.475] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17647651298) returned 1 [0056.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb07a1d10, dwHighDateTime=0x1d585b4)) [0056.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294cd0 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294cd0 | out: hHeap=0x260000) returned 1 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f63c0 [0056.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.476] GetLastError () returned 0x0 [0056.476] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.476] GetLastError () returned 0x0 [0056.478] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd9bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.478] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2645, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2645, lpOverlapped=0x0) returned 1 [0056.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.478] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.478] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.479] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.479] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.479] CloseHandle (hObject=0x10c) returned 1 [0056.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0056.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.480] GetLastError () returned 0x0 [0056.480] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.481] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.481] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0056.481] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17648247698) returned 1 [0056.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb07a1d10, dwHighDateTime=0x1d585b4)) [0056.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0056.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0056.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294ad8 [0056.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ad8 | out: hHeap=0x260000) returned 1 [0056.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6620 [0056.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.482] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.482] GetLastError () returned 0x0 [0056.482] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.482] GetLastError () returned 0x0 [0056.484] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe92d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.484] WriteFile (in: hFile=0x10c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x16d3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x16d3, lpOverlapped=0x0) returned 1 [0056.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.484] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.484] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.485] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.485] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.485] CloseHandle (hObject=0x10c) returned 1 [0056.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0056.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0056.486] GetLastError () returned 0x0 [0056.487] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.533] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.533] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17653406405) returned 1 [0056.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0814130, dwHighDateTime=0x1d585b4)) [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27639f8 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27639f8 | out: hHeap=0x260000) returned 1 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f69b0 [0056.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.534] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.534] GetLastError () returned 0x0 [0056.534] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.534] GetLastError () returned 0x0 [0056.537] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffea0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.537] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x15f6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x15f6, lpOverlapped=0x0) returned 1 [0056.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.538] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.538] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.538] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.539] CloseHandle (hObject=0x10c) returned 1 [0056.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.560] GetLastError () returned 0x0 [0056.561] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.561] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.562] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17656264841) returned 1 [0056.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb08603f0, dwHighDateTime=0x1d585b4)) [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b10 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b10 | out: hHeap=0x260000) returned 1 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6750 [0056.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.562] GetLastError () returned 0x0 [0056.562] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.562] GetLastError () returned 0x0 [0056.566] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffde3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.566] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x21c2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x21c2, lpOverlapped=0x0) returned 1 [0056.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.566] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.566] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.567] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.567] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.567] CloseHandle (hObject=0x10c) returned 1 [0056.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.568] GetLastError () returned 0x0 [0056.569] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.570] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.570] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17657083748) returned 1 [0056.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0886550, dwHighDateTime=0x1d585b4)) [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b48 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0056.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b48 | out: hHeap=0x260000) returned 1 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6e70 [0056.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.570] GetLastError () returned 0x0 [0056.571] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.571] GetLastError () returned 0x0 [0056.572] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffde14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.573] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x21ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x21ec, lpOverlapped=0x0) returned 1 [0056.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.573] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.573] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.573] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.574] CloseHandle (hObject=0x10c) returned 1 [0056.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.575] GetLastError () returned 0x0 [0056.576] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e5a0) returned 1 [0056.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0056.577] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.577] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17657780980) returned 1 [0056.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0886550, dwHighDateTime=0x1d585b4)) [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b80 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b80 | out: hHeap=0x260000) returned 1 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6f08 [0056.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.577] GetLastError () returned 0x0 [0056.578] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.578] GetLastError () returned 0x0 [0056.579] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd52c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.579] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x2ad4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x2ad4, lpOverlapped=0x0) returned 1 [0056.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.580] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.580] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.580] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.580] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.580] CloseHandle (hObject=0x10c) returned 1 [0056.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.582] GetLastError () returned 0x0 [0056.582] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e5a0) returned 1 [0056.583] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.583] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.583] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17658395281) returned 1 [0056.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb08ac6b0, dwHighDateTime=0x1d585b4)) [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763bb8 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763bb8 | out: hHeap=0x260000) returned 1 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6fa0 [0056.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.583] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.584] GetLastError () returned 0x0 [0056.584] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.584] GetLastError () returned 0x0 [0056.585] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe6b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.586] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x194a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x194a, lpOverlapped=0x0) returned 1 [0056.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.586] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.586] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.586] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.586] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.587] CloseHandle (hObject=0x10c) returned 1 [0056.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.588] GetLastError () returned 0x0 [0056.588] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.589] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.589] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17659021616) returned 1 [0056.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb08ac6b0, dwHighDateTime=0x1d585b4)) [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763bf0 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763bf0 | out: hHeap=0x260000) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7038 [0056.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.590] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.590] GetLastError () returned 0x0 [0056.590] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.590] GetLastError () returned 0x0 [0056.603] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc73a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.603] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x38c6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x38c6, lpOverlapped=0x0) returned 1 [0056.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.606] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.606] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.607] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.607] CloseHandle (hObject=0x10c) returned 1 [0056.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.608] GetLastError () returned 0x0 [0056.609] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.610] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.610] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17661168589) returned 1 [0056.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb08d2810, dwHighDateTime=0x1d585b4)) [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c60 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c60 | out: hHeap=0x260000) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f70d0 [0056.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.611] GetLastError () returned 0x0 [0056.611] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.612] GetLastError () returned 0x0 [0056.618] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb96a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.618] WriteFile (in: hFile=0x10c, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x4696, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x4696, lpOverlapped=0x0) returned 1 [0056.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.619] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.619] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.619] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.620] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.620] CloseHandle (hObject=0x10c) returned 1 [0056.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.621] GetLastError () returned 0x0 [0056.626] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.627] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.627] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.627] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17662786303) returned 1 [0056.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb08f8970, dwHighDateTime=0x1d585b4)) [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c98 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c98 | out: hHeap=0x260000) returned 1 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7200 [0056.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.628] GetLastError () returned 0x0 [0056.628] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.628] GetLastError () returned 0x0 [0056.630] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.630] WriteFile (in: hFile=0x108, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x2f38, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x2f38, lpOverlapped=0x0) returned 1 [0056.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.630] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.630] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.631] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.631] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.631] CloseHandle (hObject=0x108) returned 1 [0056.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34e0b8 [0056.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e0b8 | out: hHeap=0x260000) returned 1 [0056.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.633] GetLastError () returned 0x0 [0056.633] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.634] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.634] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17663502470) returned 1 [0056.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb091ead0, dwHighDateTime=0x1d585b4)) [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763cd0 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763cd0 | out: hHeap=0x260000) returned 1 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7298 [0056.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.635] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.635] GetLastError () returned 0x0 [0056.635] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.635] GetLastError () returned 0x0 [0056.636] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffeb44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.636] WriteFile (in: hFile=0x108, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x14bc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x14bc, lpOverlapped=0x0) returned 1 [0056.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.637] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.637] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.638] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.638] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.638] CloseHandle (hObject=0x108) returned 1 [0056.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34e180 [0056.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e180 | out: hHeap=0x260000) returned 1 [0056.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.639] GetLastError () returned 0x0 [0056.639] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.640] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.640] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17664153675) returned 1 [0056.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb091ead0, dwHighDateTime=0x1d585b4)) [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763d08 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763d08 | out: hHeap=0x260000) returned 1 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7330 [0056.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.641] GetLastError () returned 0x0 [0056.641] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.641] GetLastError () returned 0x0 [0056.643] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffea80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.643] WriteFile (in: hFile=0x108, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x1580, lpOverlapped=0x0) returned 1 [0056.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.644] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.644] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.644] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.644] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.645] CloseHandle (hObject=0x108) returned 1 [0056.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34e180 [0056.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e180 | out: hHeap=0x260000) returned 1 [0056.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.646] GetLastError () returned 0x0 [0056.646] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.647] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.647] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17664829085) returned 1 [0056.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0944c30, dwHighDateTime=0x1d585b4)) [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763d40 [0056.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763d40 | out: hHeap=0x260000) returned 1 [0056.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f73c8 [0056.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.648] GetLastError () returned 0x0 [0056.648] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.648] GetLastError () returned 0x0 [0056.744] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd85c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.745] WriteFile (in: hFile=0x108, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x27a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0x27a4, lpOverlapped=0x0) returned 1 [0056.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.746] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.746] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.747] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.747] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.747] CloseHandle (hObject=0x108) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.748] GetLastError () returned 0x0 [0056.749] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.749] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.750] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17675080409) returned 1 [0056.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0a29470, dwHighDateTime=0x1d585b4)) [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763fe0 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763fe0 | out: hHeap=0x260000) returned 1 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4380 [0056.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.750] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.750] GetLastError () returned 0x0 [0056.751] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.751] GetLastError () returned 0x0 [0056.756] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff45c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.756] WriteFile (in: hFile=0x108, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0xba4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x238fdb0*=0xba4, lpOverlapped=0x0) returned 1 [0056.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.756] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.756] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.757] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.757] CloseHandle (hObject=0x108) returned 1 [0056.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.758] GetLastError () returned 0x0 [0056.759] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.760] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.760] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17676139396) returned 1 [0056.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0a4f5d0, dwHighDateTime=0x1d585b4)) [0056.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c2a0 [0056.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c2a0 | out: hHeap=0x260000) returned 1 [0056.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b44b0 [0056.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.761] GetLastError () returned 0x0 [0056.761] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.761] GetLastError () returned 0x0 [0056.764] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffaec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.765] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x514, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x514, lpOverlapped=0x0) returned 1 [0056.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.767] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.767] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.768] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.768] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.768] CloseHandle (hObject=0x108) returned 1 [0056.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341a00 [0056.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341a00 | out: hHeap=0x260000) returned 1 [0056.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.770] GetLastError () returned 0x0 [0056.770] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.771] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.771] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.771] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17677217838) returned 1 [0056.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0a75730, dwHighDateTime=0x1d585b4)) [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c268 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c268 | out: hHeap=0x260000) returned 1 [0056.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4548 [0056.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.772] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.772] GetLastError () returned 0x0 [0056.772] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.772] GetLastError () returned 0x0 [0056.775] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.775] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x608, lpOverlapped=0x0) returned 1 [0056.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.776] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.776] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.776] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.776] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.777] CloseHandle (hObject=0x108) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341a00 [0056.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341a00 | out: hHeap=0x260000) returned 1 [0056.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.778] GetLastError () returned 0x0 [0056.778] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0056.779] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.779] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0056.779] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17678021418) returned 1 [0056.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0a75730, dwHighDateTime=0x1d585b4)) [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c230 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c230 | out: hHeap=0x260000) returned 1 [0056.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b45e0 [0056.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.780] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0056.780] GetLastError () returned 0x0 [0056.780] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0056.780] GetLastError () returned 0x0 [0056.857] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff2a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.864] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0xd58, lpOverlapped=0x0) returned 1 [0056.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.871] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.871] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.886] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.886] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.890] CloseHandle (hObject=0x108) returned 1 [0056.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0056.996] GetLastError () returned 0x0 [0057.002] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.020] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.020] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.020] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17702101196) returned 1 [0057.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0cd6d30, dwHighDateTime=0x1d585b4)) [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1e40 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1e40 | out: hHeap=0x260000) returned 1 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b58e0 [0057.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.021] GetLastError () returned 0x0 [0057.021] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.021] GetLastError () returned 0x0 [0057.023] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd752, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.023] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x28ae, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x28ae, lpOverlapped=0x0) returned 1 [0057.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.023] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.024] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.024] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.024] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.024] CloseHandle (hObject=0x108) returned 1 [0057.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.026] GetLastError () returned 0x0 [0057.026] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.027] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.027] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17702840776) returned 1 [0057.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0cd6d30, dwHighDateTime=0x1d585b4)) [0057.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1d98 [0057.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1d98 | out: hHeap=0x260000) returned 1 [0057.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5718 [0057.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.028] GetLastError () returned 0x0 [0057.028] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.028] GetLastError () returned 0x0 [0057.030] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffeb3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.030] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x14c4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x14c4, lpOverlapped=0x0) returned 1 [0057.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.032] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.032] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.032] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.033] CloseHandle (hObject=0x108) returned 1 [0057.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.034] GetLastError () returned 0x0 [0057.035] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.035] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.036] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17703676453) returned 1 [0057.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0cfce90, dwHighDateTime=0x1d585b4)) [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1d60 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1d60 | out: hHeap=0x260000) returned 1 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5a10 [0057.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.036] GetLastError () returned 0x0 [0057.037] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.037] GetLastError () returned 0x0 [0057.038] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffba0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.038] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x460, lpOverlapped=0x0) returned 1 [0057.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.039] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.039] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.039] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.039] CloseHandle (hObject=0x108) returned 1 [0057.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.041] GetLastError () returned 0x0 [0057.041] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.042] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.042] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17704349408) returned 1 [0057.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0cfce90, dwHighDateTime=0x1d585b4)) [0057.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1d28 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1d28 | out: hHeap=0x260000) returned 1 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5aa8 [0057.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.043] GetLastError () returned 0x0 [0057.043] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.043] GetLastError () returned 0x0 [0057.044] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.045] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x270, lpOverlapped=0x0) returned 1 [0057.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.045] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.045] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.045] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.045] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.046] CloseHandle (hObject=0x108) returned 1 [0057.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.047] GetLastError () returned 0x0 [0057.047] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.048] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.048] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.048] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17704942091) returned 1 [0057.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb0cfce90, dwHighDateTime=0x1d585b4)) [0057.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1cf0 [0057.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1cf0 | out: hHeap=0x260000) returned 1 [0057.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5b40 [0057.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.049] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.049] GetLastError () returned 0x0 [0057.049] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.049] GetLastError () returned 0x0 [0057.100] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffeec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.101] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x1138, lpOverlapped=0x0) returned 1 [0057.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.129] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.133] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.133] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.133] CloseHandle (hObject=0x108) returned 1 [0057.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.411] GetLastError () returned 0x0 [0057.411] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.412] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.412] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.412] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17741353567) returned 1 [0057.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb108ef90, dwHighDateTime=0x1d585b4)) [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f230 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f230 | out: hHeap=0x260000) returned 1 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5bd8 [0057.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.416] GetLastError () returned 0x0 [0057.416] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.416] GetLastError () returned 0x0 [0057.456] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe168, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.456] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1e98, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x1e98, lpOverlapped=0x0) returned 1 [0057.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.457] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.457] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.457] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.458] CloseHandle (hObject=0x108) returned 1 [0057.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.459] GetLastError () returned 0x0 [0057.459] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.460] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.460] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.460] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17746150571) returned 1 [0057.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb11013b0, dwHighDateTime=0x1d585b4)) [0057.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f118 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f118 | out: hHeap=0x260000) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6a18 [0057.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.461] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.461] GetLastError () returned 0x0 [0057.461] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.461] GetLastError () returned 0x0 [0057.476] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd714, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.476] WriteFile (in: hFile=0x108, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x28ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x28ec, lpOverlapped=0x0) returned 1 [0057.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.477] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.477] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.478] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.478] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.478] CloseHandle (hObject=0x108) returned 1 [0057.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.479] GetLastError () returned 0x0 [0057.486] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.487] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.487] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17748834201) returned 1 [0057.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb114d670, dwHighDateTime=0x1d585b4)) [0057.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f070 [0057.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f070 | out: hHeap=0x260000) returned 1 [0057.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6d10 [0057.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.488] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.488] GetLastError () returned 0x0 [0057.488] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.488] GetLastError () returned 0x0 [0057.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffac4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.491] WriteFile (in: hFile=0xf0, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x53c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x53c, lpOverlapped=0x0) returned 1 [0057.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.491] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.492] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.492] CloseHandle (hObject=0xf0) returned 1 [0057.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0057.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0057.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.494] GetLastError () returned 0x0 [0057.494] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.494] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.495] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.495] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17749693134) returned 1 [0057.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb114d670, dwHighDateTime=0x1d585b4)) [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f038 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f038 | out: hHeap=0x260000) returned 1 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6ed8 [0057.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.496] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.497] GetLastError () returned 0x0 [0057.497] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.497] GetLastError () returned 0x0 [0057.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe6b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.498] WriteFile (in: hFile=0xf0, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x1948, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x1948, lpOverlapped=0x0) returned 1 [0057.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.499] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.499] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.500] CloseHandle (hObject=0xf0) returned 1 [0057.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0057.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0057.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.501] GetLastError () returned 0x0 [0057.501] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.502] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.502] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.502] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17750360327) returned 1 [0057.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb11737d0, dwHighDateTime=0x1d585b4)) [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f000 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f000 | out: hHeap=0x260000) returned 1 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6f70 [0057.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.503] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.503] GetLastError () returned 0x0 [0057.503] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.504] GetLastError () returned 0x0 [0057.537] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe3d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.543] WriteFile (in: hFile=0xf0, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x1c2c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x1c2c, lpOverlapped=0x0) returned 1 [0057.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.556] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.567] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.567] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.567] CloseHandle (hObject=0xf0) returned 1 [0057.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.568] GetLastError () returned 0x0 [0057.568] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.569] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.569] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17757048153) returned 1 [0057.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb120bd50, dwHighDateTime=0x1d585b4)) [0057.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32edd0 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32edd0 | out: hHeap=0x260000) returned 1 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7008 [0057.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.570] GetLastError () returned 0x0 [0057.570] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.570] GetLastError () returned 0x0 [0057.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.572] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0xd3c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0xd3c, lpOverlapped=0x0) returned 1 [0057.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.572] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.573] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.573] CloseHandle (hObject=0xf0) returned 1 [0057.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.574] GetLastError () returned 0x0 [0057.575] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.576] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.576] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17757723942) returned 1 [0057.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb120bd50, dwHighDateTime=0x1d585b4)) [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ed98 [0057.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ed98 | out: hHeap=0x260000) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b75f8 [0057.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.577] GetLastError () returned 0x0 [0057.577] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.577] GetLastError () returned 0x0 [0057.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe8b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.579] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x1750, lpOverlapped=0x0) returned 1 [0057.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.579] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.579] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.580] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.580] CloseHandle (hObject=0xf0) returned 1 [0057.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.581] GetLastError () returned 0x0 [0057.582] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.583] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.583] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.583] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17758396400) returned 1 [0057.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1231eb0, dwHighDateTime=0x1d585b4)) [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ed60 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ed60 | out: hHeap=0x260000) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7690 [0057.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.584] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.584] GetLastError () returned 0x0 [0057.584] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.584] GetLastError () returned 0x0 [0057.585] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.585] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x1540, lpOverlapped=0x0) returned 1 [0057.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.586] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.586] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.586] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.586] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.587] CloseHandle (hObject=0xf0) returned 1 [0057.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.588] GetLastError () returned 0x0 [0057.588] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.589] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.589] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17759053651) returned 1 [0057.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1231eb0, dwHighDateTime=0x1d585b4)) [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ed28 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ed28 | out: hHeap=0x260000) returned 1 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7728 [0057.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.590] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.590] GetLastError () returned 0x0 [0057.590] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.590] GetLastError () returned 0x0 [0057.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe60c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.592] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x19f4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x19f4, lpOverlapped=0x0) returned 1 [0057.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.592] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.593] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.593] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.593] CloseHandle (hObject=0xf0) returned 1 [0057.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.594] GetLastError () returned 0x0 [0057.595] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.596] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.596] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17759686942) returned 1 [0057.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1258010, dwHighDateTime=0x1d585b4)) [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ecf0 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ecf0 | out: hHeap=0x260000) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b77c0 [0057.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.596] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.597] GetLastError () returned 0x0 [0057.597] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.597] GetLastError () returned 0x0 [0057.598] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe595, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.598] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1a6b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x1a6b, lpOverlapped=0x0) returned 1 [0057.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.599] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.599] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.599] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.599] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.600] CloseHandle (hObject=0xf0) returned 1 [0057.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.601] GetLastError () returned 0x0 [0057.601] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.602] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.602] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17760331836) returned 1 [0057.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1258010, dwHighDateTime=0x1d585b4)) [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ecb8 [0057.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ecb8 | out: hHeap=0x260000) returned 1 [0057.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7858 [0057.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.603] GetLastError () returned 0x0 [0057.603] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.603] GetLastError () returned 0x0 [0057.682] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe6a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.682] WriteFile (in: hFile=0xf0, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x195b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x195b, lpOverlapped=0x0) returned 1 [0057.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.701] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.756] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.756] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.757] CloseHandle (hObject=0xf0) returned 1 [0057.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0057.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.761] GetLastError () returned 0x0 [0057.761] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.762] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.762] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.762] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17776310756) returned 1 [0057.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb13d4dd0, dwHighDateTime=0x1d585b4)) [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e08 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331600 [0057.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.763] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.763] GetLastError () returned 0x0 [0057.763] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.763] GetLastError () returned 0x0 [0057.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb814, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.766] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x47ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x47ec, lpOverlapped=0x0) returned 1 [0057.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.766] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.767] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.767] CloseHandle (hObject=0xf0) returned 1 [0057.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.769] GetLastError () returned 0x0 [0057.769] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.770] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.770] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.770] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17777090378) returned 1 [0057.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb13faf30, dwHighDateTime=0x1d585b4)) [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e40 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3314d0 [0057.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.771] GetLastError () returned 0x0 [0057.771] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.771] GetLastError () returned 0x0 [0057.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.773] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x8b4, lpOverlapped=0x0) returned 1 [0057.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.773] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.773] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.774] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.774] CloseHandle (hObject=0xf0) returned 1 [0057.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.775] GetLastError () returned 0x0 [0057.776] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.777] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.777] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17777812002) returned 1 [0057.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb13faf30, dwHighDateTime=0x1d585b4)) [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295268 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295268 | out: hHeap=0x260000) returned 1 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331438 [0057.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.778] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.778] GetLastError () returned 0x0 [0057.778] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.778] GetLastError () returned 0x0 [0057.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff50c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.780] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xaf4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0xaf4, lpOverlapped=0x0) returned 1 [0057.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.782] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.783] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.783] CloseHandle (hObject=0xf0) returned 1 [0057.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.784] GetLastError () returned 0x0 [0057.785] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.785] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.785] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.786] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17778677387) returned 1 [0057.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1421090, dwHighDateTime=0x1d585b4)) [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952a0 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3313a0 [0057.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.786] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.786] GetLastError () returned 0x0 [0057.787] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.787] GetLastError () returned 0x0 [0057.790] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa55c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.790] WriteFile (in: hFile=0xf0, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x5aa4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x5aa4, lpOverlapped=0x0) returned 1 [0057.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.792] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.792] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.793] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.793] CloseHandle (hObject=0xf0) returned 1 [0057.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.794] GetLastError () returned 0x0 [0057.794] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.795] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.795] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.795] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17779658477) returned 1 [0057.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1421090, dwHighDateTime=0x1d585b4)) [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952d8 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952d8 | out: hHeap=0x260000) returned 1 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331308 [0057.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.796] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.796] GetLastError () returned 0x0 [0057.796] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.796] GetLastError () returned 0x0 [0057.799] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe308, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.799] WriteFile (in: hFile=0xf0, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1cf8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x1cf8, lpOverlapped=0x0) returned 1 [0057.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.800] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.800] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.801] CloseHandle (hObject=0xf0) returned 1 [0057.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.802] GetLastError () returned 0x0 [0057.802] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.803] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.803] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17780436391) returned 1 [0057.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb14471f0, dwHighDateTime=0x1d585b4)) [0057.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295310 [0057.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0057.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331270 [0057.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.804] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.804] GetLastError () returned 0x0 [0057.804] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.804] GetLastError () returned 0x0 [0057.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.806] WriteFile (in: hFile=0xf0, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x4124, lpOverlapped=0x0) returned 1 [0057.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.807] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.807] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.807] CloseHandle (hObject=0xf0) returned 1 [0057.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.809] GetLastError () returned 0x0 [0057.809] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.810] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.810] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.810] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17781143758) returned 1 [0057.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb14471f0, dwHighDateTime=0x1d585b4)) [0057.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295348 [0057.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295348 | out: hHeap=0x260000) returned 1 [0057.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b78f0 [0057.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.811] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.811] GetLastError () returned 0x0 [0057.811] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.811] GetLastError () returned 0x0 [0057.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffebfd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.813] WriteFile (in: hFile=0xf0, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1402c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x1402c, lpOverlapped=0x0) returned 1 [0057.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.814] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.814] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.814] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.815] CloseHandle (hObject=0xf0) returned 1 [0057.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.816] GetLastError () returned 0x0 [0057.865] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.866] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.866] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.866] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17786697328) returned 1 [0057.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb14df770, dwHighDateTime=0x1d585b4)) [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b48 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7d18 [0057.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.867] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.867] GetLastError () returned 0x0 [0057.867] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.867] GetLastError () returned 0x0 [0057.881] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe11c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.881] WriteFile (in: hFile=0x10c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1ee4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x1ee4, lpOverlapped=0x0) returned 1 [0057.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.883] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.885] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.886] CloseHandle (hObject=0x10c) returned 1 [0057.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.888] GetLastError () returned 0x0 [0057.888] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.889] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.889] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.889] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17789005901) returned 1 [0057.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb15058d0, dwHighDateTime=0x1d585b4)) [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c98 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c98 | out: hHeap=0x260000) returned 1 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7be8 [0057.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.890] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.890] GetLastError () returned 0x0 [0057.890] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.890] GetLastError () returned 0x0 [0057.893] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb316, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.893] WriteFile (in: hFile=0x10c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x4cea, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x4cea, lpOverlapped=0x0) returned 1 [0057.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.895] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.896] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.896] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.896] CloseHandle (hObject=0x10c) returned 1 [0057.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.897] GetLastError () returned 0x0 [0057.898] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.899] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.899] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17790035984) returned 1 [0057.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb152ba30, dwHighDateTime=0x1d585b4)) [0057.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0057.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0057.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b8010 [0057.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.900] GetLastError () returned 0x0 [0057.900] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.900] GetLastError () returned 0x0 [0057.903] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff4ed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.903] WriteFile (in: hFile=0x10c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0xb12c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0xb12c, lpOverlapped=0x0) returned 1 [0057.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.904] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.904] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.905] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.905] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.905] CloseHandle (hObject=0x10c) returned 1 [0057.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0057.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0057.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.907] GetLastError () returned 0x0 [0057.907] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.909] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.909] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.909] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17791020804) returned 1 [0057.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1551b90, dwHighDateTime=0x1d585b4)) [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0057.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b80a8 [0057.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.910] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.910] GetLastError () returned 0x0 [0057.910] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.910] GetLastError () returned 0x0 [0057.912] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9fd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.912] WriteFile (in: hFile=0x10c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x6028, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0x6028, lpOverlapped=0x0) returned 1 [0057.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.912] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.912] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.913] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.913] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.913] CloseHandle (hObject=0x10c) returned 1 [0057.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.990] GetLastError () returned 0x0 [0057.990] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.991] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.991] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.991] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17799198927) returned 1 [0057.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1610270, dwHighDateTime=0x1d585b4)) [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299788 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29cf50 [0057.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.992] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.992] GetLastError () returned 0x0 [0057.992] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.992] GetLastError () returned 0x0 [0057.994] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff67c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.994] WriteFile (in: hFile=0x11c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x984, lpOverlapped=0x0) returned 1 [0057.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.995] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.995] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.995] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.995] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.995] CloseHandle (hObject=0x11c) returned 1 [0057.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0057.997] GetLastError () returned 0x0 [0057.997] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0057.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.998] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0057.998] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17799899172) returned 1 [0057.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1610270, dwHighDateTime=0x1d585b4)) [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997c0 | out: hHeap=0x260000) returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29cfe8 [0057.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0057.999] GetLastError () returned 0x0 [0057.999] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0057.999] GetLastError () returned 0x0 [0058.000] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffa64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.000] WriteFile (in: hFile=0x11c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x59c, lpOverlapped=0x0) returned 1 [0058.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0058.001] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.001] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.001] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.002] CloseHandle (hObject=0x11c) returned 1 [0058.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.003] GetLastError () returned 0x0 [0058.004] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.005] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.005] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17800602028) returned 1 [0058.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb16363d0, dwHighDateTime=0x1d585b4)) [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0310 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0310 | out: hHeap=0x260000) returned 1 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d080 [0058.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.006] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.006] GetLastError () returned 0x0 [0058.006] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.006] GetLastError () returned 0x0 [0058.008] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc064, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.008] WriteFile (in: hFile=0x11c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x3f9c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x3f9c, lpOverlapped=0x0) returned 1 [0058.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0058.009] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.009] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.009] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.010] CloseHandle (hObject=0x11c) returned 1 [0058.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.011] GetLastError () returned 0x0 [0058.011] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.012] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.012] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.012] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17801343973) returned 1 [0058.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb16363d0, dwHighDateTime=0x1d585b4)) [0058.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0348 [0058.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0348 | out: hHeap=0x260000) returned 1 [0058.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d118 [0058.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.013] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.013] GetLastError () returned 0x0 [0058.013] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.013] GetLastError () returned 0x0 [0058.017] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffebe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.018] WriteFile (in: hFile=0x11c, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x238fdb0*=0x1418, lpOverlapped=0x0) returned 1 [0058.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0058.018] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.019] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.019] CloseHandle (hObject=0x11c) returned 1 [0058.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.020] GetLastError () returned 0x0 [0058.020] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.021] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.021] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0058.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0058.021] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17802245334) returned 1 [0058.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb165c530, dwHighDateTime=0x1d585b4)) [0058.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0058.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0058.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0058.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0380 [0058.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0380 | out: hHeap=0x260000) returned 1 [0058.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d1b0 [0058.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.022] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.022] GetLastError () returned 0x0 [0058.022] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.022] GetLastError () returned 0x0 [0058.072] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff226, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.072] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x238fdb0*=0xdda, lpOverlapped=0x0) returned 1 [0058.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.074] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.074] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.074] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.075] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.075] CloseHandle (hObject=0x11c) returned 1 [0058.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0058.119] GetLastError () returned 0x0 [0058.225] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.226] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.226] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.226] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17822710897) returned 1 [0058.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb184b710, dwHighDateTime=0x1d585b4)) [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77b8 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29de28 [0058.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.227] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.227] GetLastError () returned 0x0 [0058.227] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.227] GetLastError () returned 0x0 [0058.229] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffba7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.229] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x4584, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x4584, lpOverlapped=0x0) returned 1 [0058.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.230] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.230] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.231] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.231] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.231] CloseHandle (hObject=0x108) returned 1 [0058.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.232] GetLastError () returned 0x0 [0058.233] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.233] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.233] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.233] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17823459861) returned 1 [0058.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb184b710, dwHighDateTime=0x1d585b4)) [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9c00 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9c00 | out: hHeap=0x260000) returned 1 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29de28 [0058.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.234] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.234] GetLastError () returned 0x0 [0058.234] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.234] GetLastError () returned 0x0 [0058.236] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe99c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.236] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1664, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x1664, lpOverlapped=0x0) returned 1 [0058.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.236] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.236] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.237] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.237] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.237] CloseHandle (hObject=0x108) returned 1 [0058.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.239] GetLastError () returned 0x0 [0058.239] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.240] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.240] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.240] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17824087543) returned 1 [0058.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1871870, dwHighDateTime=0x1d585b4)) [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9c38 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9c38 | out: hHeap=0x260000) returned 1 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0058.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.240] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.241] GetLastError () returned 0x0 [0058.241] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.241] GetLastError () returned 0x0 [0058.407] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbe60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.407] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x41a0, lpOverlapped=0x0) returned 1 [0058.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.408] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.408] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.408] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.408] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.408] CloseHandle (hObject=0x108) returned 1 [0058.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.410] GetLastError () returned 0x0 [0058.410] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.411] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17841202671) returned 1 [0058.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1a14790, dwHighDateTime=0x1d585b4)) [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9d18 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d18 | out: hHeap=0x260000) returned 1 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e088 [0058.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.412] GetLastError () returned 0x0 [0058.412] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.412] GetLastError () returned 0x0 [0058.428] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff604, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.428] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x238fdb0*=0x9fc, lpOverlapped=0x0) returned 1 [0058.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.429] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.429] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.429] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.429] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.430] CloseHandle (hObject=0x108) returned 1 [0058.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.431] GetLastError () returned 0x0 [0058.431] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.432] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.432] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.432] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17843328092) returned 1 [0058.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1a3a8f0, dwHighDateTime=0x1d585b4)) [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9dc0 [0058.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9dc0 | out: hHeap=0x260000) returned 1 [0058.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e2e8 [0058.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.433] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.433] GetLastError () returned 0x0 [0058.433] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.433] GetLastError () returned 0x0 [0058.447] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc808, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.448] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x37f8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x37f8, lpOverlapped=0x0) returned 1 [0058.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.449] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.449] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.449] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.450] CloseHandle (hObject=0x108) returned 1 [0058.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.450] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.468] GetLastError () returned 0x0 [0058.468] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.469] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.469] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.469] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17847020392) returned 1 [0058.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1aacd10, dwHighDateTime=0x1d585b4)) [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ed8 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ed8 | out: hHeap=0x260000) returned 1 [0058.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e4b0 [0058.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.470] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.470] GetLastError () returned 0x0 [0058.470] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.470] GetLastError () returned 0x0 [0058.493] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffede4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.493] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x121c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x121c, lpOverlapped=0x0) returned 1 [0058.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.493] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.494] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.494] CloseHandle (hObject=0x108) returned 1 [0058.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.495] GetLastError () returned 0x0 [0058.496] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.496] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.497] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17849765843) returned 1 [0058.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1ad2e70, dwHighDateTime=0x1d585b4)) [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9f80 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9f80 | out: hHeap=0x260000) returned 1 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e7a8 [0058.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.497] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.497] GetLastError () returned 0x0 [0058.497] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.497] GetLastError () returned 0x0 [0058.501] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff79d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.501] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8628, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x8628, lpOverlapped=0x0) returned 1 [0058.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.506] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.506] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.507] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.507] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.507] CloseHandle (hObject=0x108) returned 1 [0058.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.508] GetLastError () returned 0x0 [0058.513] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.527] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.527] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.527] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17852863029) returned 1 [0058.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1b1f130, dwHighDateTime=0x1d585b4)) [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ff0 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ff0 | out: hHeap=0x260000) returned 1 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29eb38 [0058.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.528] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.528] GetLastError () returned 0x0 [0058.528] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.528] GetLastError () returned 0x0 [0058.538] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.538] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0058.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.539] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.539] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.547] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.547] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.547] CloseHandle (hObject=0xf0) returned 1 [0058.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.549] GetLastError () returned 0x0 [0058.549] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.550] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.550] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.550] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17855090568) returned 1 [0058.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1b6b3f0, dwHighDateTime=0x1d585b4)) [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da0d0 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da0d0 | out: hHeap=0x260000) returned 1 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0058.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.551] GetLastError () returned 0x0 [0058.551] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.551] GetLastError () returned 0x0 [0058.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.576] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.577] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.578] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.578] CloseHandle (hObject=0xf0) returned 1 [0058.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.580] GetLastError () returned 0x0 [0058.580] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.581] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.581] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.581] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17858189855) returned 1 [0058.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1bb76b0, dwHighDateTime=0x1d585b4)) [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da1b0 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da1b0 | out: hHeap=0x260000) returned 1 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ad88 [0058.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.582] GetLastError () returned 0x0 [0058.582] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.582] GetLastError () returned 0x0 [0058.654] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe1ab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.655] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1e55, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1e55, lpOverlapped=0x0) returned 1 [0058.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.655] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.655] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.656] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.656] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.656] CloseHandle (hObject=0xf0) returned 1 [0058.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.684] GetLastError () returned 0x0 [0058.684] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.685] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.685] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.685] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17868611189) returned 1 [0058.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1c9bef0, dwHighDateTime=0x1d585b4)) [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da4c0 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da4c0 | out: hHeap=0x260000) returned 1 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29afe8 [0058.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.686] GetLastError () returned 0x0 [0058.686] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.686] GetLastError () returned 0x0 [0058.689] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.689] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.689] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.690] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.690] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.690] CloseHandle (hObject=0x108) returned 1 [0058.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.691] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.692] GetLastError () returned 0x0 [0058.693] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.693] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.693] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.694] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17869467981) returned 1 [0058.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1cc2050, dwHighDateTime=0x1d585b4)) [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da4f8 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da4f8 | out: hHeap=0x260000) returned 1 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b838 [0058.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.694] GetLastError () returned 0x0 [0058.694] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.695] GetLastError () returned 0x0 [0058.696] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.696] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.697] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.697] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.697] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.697] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.698] CloseHandle (hObject=0x108) returned 1 [0058.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.699] GetLastError () returned 0x0 [0058.706] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.707] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.707] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.707] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17870848153) returned 1 [0058.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1ce81b0, dwHighDateTime=0x1d585b4)) [0058.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da568 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da568 | out: hHeap=0x260000) returned 1 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b7a0 [0058.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.708] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.708] GetLastError () returned 0x0 [0058.708] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.708] GetLastError () returned 0x0 [0058.710] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.710] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.710] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.710] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.711] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.711] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.711] CloseHandle (hObject=0x108) returned 1 [0058.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.713] GetLastError () returned 0x0 [0058.726] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.734] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.734] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.734] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17873558351) returned 1 [0058.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1d34470, dwHighDateTime=0x1d585b4)) [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da610 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da610 | out: hHeap=0x260000) returned 1 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bb30 [0058.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.735] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.735] GetLastError () returned 0x0 [0058.735] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.735] GetLastError () returned 0x0 [0058.738] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.738] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.738] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.738] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.739] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.739] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.739] CloseHandle (hObject=0x108) returned 1 [0058.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.740] GetLastError () returned 0x0 [0058.741] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.741] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.741] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.741] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17874262736) returned 1 [0058.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1d34470, dwHighDateTime=0x1d585b4)) [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da680 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da680 | out: hHeap=0x260000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ba98 [0058.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.742] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.742] GetLastError () returned 0x0 [0058.742] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.742] GetLastError () returned 0x0 [0058.745] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.745] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7c08, lpOverlapped=0x0) returned 1 [0058.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.745] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.746] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.746] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.746] CloseHandle (hObject=0x108) returned 1 [0058.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.748] GetLastError () returned 0x0 [0058.749] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.750] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.750] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17875101472) returned 1 [0058.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1d5a5d0, dwHighDateTime=0x1d585b4)) [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da648 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da648 | out: hHeap=0x260000) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bcf8 [0058.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.751] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.751] GetLastError () returned 0x0 [0058.751] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.751] GetLastError () returned 0x0 [0058.797] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.797] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x48fc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x48fc, lpOverlapped=0x0) returned 1 [0058.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.798] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.798] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.799] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.799] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.799] CloseHandle (hObject=0x108) returned 1 [0058.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.840] GetLastError () returned 0x0 [0058.840] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.855] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.855] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.855] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17885656231) returned 1 [0058.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1e3ee10, dwHighDateTime=0x1d585b4)) [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da8b0 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da8b0 | out: hHeap=0x260000) returned 1 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c380 [0058.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.856] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.856] GetLastError () returned 0x0 [0058.859] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.859] GetLastError () returned 0x0 [0058.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.895] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.899] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.899] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.900] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.900] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.900] CloseHandle (hObject=0x108) returned 1 [0058.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.903] GetLastError () returned 0x0 [0058.904] lstrlenW (lpString=".sql") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".sql") returned 0x0 [0058.904] lstrlenW (lpString=".mdf") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".mdf") returned 0x0 [0058.904] lstrlenW (lpString=".txt") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".txt") returned 0x0 [0058.904] lstrlenW (lpString=".dbf") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".dbf") returned 0x0 [0058.904] lstrlenW (lpString=".ckp") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".ckp") returned 0x0 [0058.904] lstrlenW (lpString=".dacpac") returned 7 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".dacpac") returned 0x0 [0058.904] lstrlenW (lpString=".db3") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".db3") returned 0x0 [0058.904] lstrlenW (lpString=".dtxs") returned 5 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".dtxs") returned 0x0 [0058.904] lstrlenW (lpString=".mdt") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".mdt") returned 0x0 [0058.904] lstrlenW (lpString=".sdf") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".sdf") returned 0x0 [0058.904] lstrlenW (lpString=".MDF") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".MDF") returned 0x0 [0058.904] lstrlenW (lpString=".DBF") returned 4 [0058.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".DBF") returned 0x0 [0058.904] lstrlenW (lpString=".DB") returned 3 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".DB") returned 0x0 [0058.905] lstrlenW (lpString=".db") returned 3 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".db") returned 0x0 [0058.905] lstrlenW (lpString=".ndf") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".ndf") returned 0x0 [0058.905] lstrlenW (lpString=".NDF") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".NDF") returned 0x0 [0058.905] lstrlenW (lpString=".Mdf") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".Mdf") returned 0x0 [0058.905] lstrlenW (lpString=".dat") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".dat") returned 0x0 [0058.905] lstrlenW (lpString=".DAT") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".DAT") returned 0x0 [0058.905] lstrlenW (lpString=".ldf") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".ldf") returned 0x0 [0058.905] lstrlenW (lpString=".LDF") returned 4 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch=".LDF") returned 0x0 [0058.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0058.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0058.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a440 [0058.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0058.905] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.907] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.907] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.907] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17890830292) returned 1 [0058.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1ed7390, dwHighDateTime=0x1d585b4)) [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da990 [0058.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da990 | out: hHeap=0x260000) returned 1 [0058.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c2e8 [0058.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.908] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.908] GetLastError () returned 0x0 [0058.908] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.908] GetLastError () returned 0x0 [0058.916] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9f70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.916] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x6090, lpOverlapped=0x0) returned 1 [0058.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.916] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.916] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.917] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.917] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.917] CloseHandle (hObject=0x108) returned 1 [0058.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0058.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.919] GetLastError () returned 0x0 [0058.919] lstrlenW (lpString=".sql") returned 4 [0058.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".sql") returned 0x0 [0058.919] lstrlenW (lpString=".mdf") returned 4 [0058.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".mdf") returned 0x0 [0058.919] lstrlenW (lpString=".txt") returned 4 [0058.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".txt") returned 0x0 [0058.919] lstrlenW (lpString=".dbf") returned 4 [0058.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".dbf") returned 0x0 [0058.919] lstrlenW (lpString=".ckp") returned 4 [0058.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".ckp") returned 0x0 [0058.920] lstrlenW (lpString=".dacpac") returned 7 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".dacpac") returned 0x0 [0058.920] lstrlenW (lpString=".db3") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".db3") returned 0x0 [0058.920] lstrlenW (lpString=".dtxs") returned 5 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".dtxs") returned 0x0 [0058.920] lstrlenW (lpString=".mdt") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".mdt") returned 0x0 [0058.920] lstrlenW (lpString=".sdf") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".sdf") returned 0x0 [0058.920] lstrlenW (lpString=".MDF") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".MDF") returned 0x0 [0058.920] lstrlenW (lpString=".DBF") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".DBF") returned 0x0 [0058.920] lstrlenW (lpString=".DB") returned 3 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".DB") returned 0x0 [0058.920] lstrlenW (lpString=".db") returned 3 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".db") returned 0x0 [0058.920] lstrlenW (lpString=".ndf") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".ndf") returned 0x0 [0058.920] lstrlenW (lpString=".NDF") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".NDF") returned 0x0 [0058.920] lstrlenW (lpString=".Mdf") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".Mdf") returned 0x0 [0058.920] lstrlenW (lpString=".dat") returned 4 [0058.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".dat") returned 0x0 [0058.920] lstrlenW (lpString=".DAT") returned 4 [0058.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".DAT") returned 0x0 [0058.921] lstrlenW (lpString=".ldf") returned 4 [0058.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".ldf") returned 0x0 [0058.921] lstrlenW (lpString=".LDF") returned 4 [0058.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch=".LDF") returned 0x0 [0058.921] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0058.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0058.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a440 [0058.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0058.921] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.922] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.922] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.922] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17892305546) returned 1 [0058.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1efd4f0, dwHighDateTime=0x1d585b4)) [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da9c8 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9c8 | out: hHeap=0x260000) returned 1 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c548 [0058.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.923] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.923] GetLastError () returned 0x0 [0058.923] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.923] GetLastError () returned 0x0 [0058.924] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8170, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.924] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x7e90, lpOverlapped=0x0) returned 1 [0058.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.928] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.928] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.928] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.929] CloseHandle (hObject=0x108) returned 1 [0058.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0058.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.930] GetLastError () returned 0x0 [0058.930] lstrlenW (lpString=".sql") returned 4 [0058.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".sql") returned 0x0 [0058.930] lstrlenW (lpString=".mdf") returned 4 [0058.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".mdf") returned 0x0 [0058.930] lstrlenW (lpString=".txt") returned 4 [0058.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".txt") returned 0x0 [0058.930] lstrlenW (lpString=".dbf") returned 4 [0058.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".dbf") returned 0x0 [0058.931] lstrlenW (lpString=".ckp") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".ckp") returned 0x0 [0058.931] lstrlenW (lpString=".dacpac") returned 7 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".dacpac") returned 0x0 [0058.931] lstrlenW (lpString=".db3") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".db3") returned 0x0 [0058.931] lstrlenW (lpString=".dtxs") returned 5 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".dtxs") returned 0x0 [0058.931] lstrlenW (lpString=".mdt") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".mdt") returned 0x0 [0058.931] lstrlenW (lpString=".sdf") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".sdf") returned 0x0 [0058.931] lstrlenW (lpString=".MDF") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".MDF") returned 0x0 [0058.931] lstrlenW (lpString=".DBF") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".DBF") returned 0x0 [0058.931] lstrlenW (lpString=".DB") returned 3 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".DB") returned 0x0 [0058.931] lstrlenW (lpString=".db") returned 3 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".db") returned 0x0 [0058.931] lstrlenW (lpString=".ndf") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".ndf") returned 0x0 [0058.931] lstrlenW (lpString=".NDF") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".NDF") returned 0x0 [0058.931] lstrlenW (lpString=".Mdf") returned 4 [0058.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".Mdf") returned 0x0 [0058.931] lstrlenW (lpString=".dat") returned 4 [0058.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".dat") returned 0x0 [0058.932] lstrlenW (lpString=".DAT") returned 4 [0058.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".DAT") returned 0x0 [0058.932] lstrlenW (lpString=".ldf") returned 4 [0058.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".ldf") returned 0x0 [0058.932] lstrlenW (lpString=".LDF") returned 4 [0058.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch=".LDF") returned 0x0 [0058.932] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0058.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0058.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a440 [0058.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0058.932] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.933] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.933] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.933] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17893402907) returned 1 [0058.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1efd4f0, dwHighDateTime=0x1d585b4)) [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daa00 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daa00 | out: hHeap=0x260000) returned 1 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c5e0 [0058.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.934] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.934] GetLastError () returned 0x0 [0058.934] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.934] GetLastError () returned 0x0 [0058.964] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff786b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.965] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x8795, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x8795, lpOverlapped=0x0) returned 1 [0058.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.965] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.965] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.966] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.966] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.966] CloseHandle (hObject=0x108) returned 1 [0058.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0058.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.986] GetLastError () returned 0x0 [0058.986] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.987] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.987] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.987] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17898794748) returned 1 [0058.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1f95a70, dwHighDateTime=0x1d585b4)) [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daa70 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daa70 | out: hHeap=0x260000) returned 1 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c678 [0058.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.987] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.988] GetLastError () returned 0x0 [0058.988] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.988] GetLastError () returned 0x0 [0058.989] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9b39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.990] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x64c7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x64c7, lpOverlapped=0x0) returned 1 [0058.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.990] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.990] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.991] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.991] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.991] CloseHandle (hObject=0x108) returned 1 [0058.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0058.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.[deadmin@cock.li].deadmin")) returned 1 [0058.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0058.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0058.994] GetLastError () returned 0x0 [0058.994] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0058.995] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.995] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.995] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17899602584) returned 1 [0058.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1f95a70, dwHighDateTime=0x1d585b4)) [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7780 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7780 | out: hHeap=0x260000) returned 1 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c7a8 [0058.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.996] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0058.996] GetLastError () returned 0x0 [0058.996] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0058.996] GetLastError () returned 0x0 [0058.998] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe90c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.998] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x16f40, lpOverlapped=0x0) returned 1 [0058.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.999] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.999] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.001] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.002] CloseHandle (hObject=0x108) returned 1 [0059.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4be0 [0059.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4be0 | out: hHeap=0x260000) returned 1 [0059.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.003] GetLastError () returned 0x0 [0059.003] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.004] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.004] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.004] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17900539583) returned 1 [0059.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1fbbbd0, dwHighDateTime=0x1d585b4)) [0059.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daaa8 [0059.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daaa8 | out: hHeap=0x260000) returned 1 [0059.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c840 [0059.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.005] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.005] GetLastError () returned 0x0 [0059.005] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.005] GetLastError () returned 0x0 [0059.007] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff3c7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.007] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xc382, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0xc382, lpOverlapped=0x0) returned 1 [0059.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.008] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.008] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.008] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.008] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.009] CloseHandle (hObject=0x108) returned 1 [0059.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4be0 [0059.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.[deadmin@cock.li].deadmin")) returned 1 [0059.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4be0 | out: hHeap=0x260000) returned 1 [0059.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.010] GetLastError () returned 0x0 [0059.010] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.011] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.011] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.011] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17901224828) returned 1 [0059.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1fbbbd0, dwHighDateTime=0x1d585b4)) [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daae0 [0059.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daae0 | out: hHeap=0x260000) returned 1 [0059.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c8d8 [0059.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.012] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.012] GetLastError () returned 0x0 [0059.012] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.012] GetLastError () returned 0x0 [0059.014] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff83f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.014] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x7c08, lpOverlapped=0x0) returned 1 [0059.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.015] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.015] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.015] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.016] CloseHandle (hObject=0x108) returned 1 [0059.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e4028 [0059.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e4028 | out: hHeap=0x260000) returned 1 [0059.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0059.017] GetLastError () returned 0x0 [0059.018] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.018] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.018] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.019] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17901977425) returned 1 [0059.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb1fe1d30, dwHighDateTime=0x1d585b4)) [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dab18 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab18 | out: hHeap=0x260000) returned 1 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c970 [0059.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.019] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.019] GetLastError () returned 0x0 [0059.020] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.020] GetLastError () returned 0x0 [0059.102] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.102] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0059.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.130] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.130] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.130] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.139] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.140] CloseHandle (hObject=0x108) returned 1 [0059.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.147] GetLastError () returned 0x0 [0059.148] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.148] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.149] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17915597268) returned 1 [0059.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2112830, dwHighDateTime=0x1d585b4)) [0059.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dae60 [0059.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dae60 | out: hHeap=0x260000) returned 1 [0059.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3330a8 [0059.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.163] GetLastError () returned 0x0 [0059.163] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.163] GetLastError () returned 0x0 [0059.283] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8751, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.283] WriteFile (in: hFile=0x108, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x78af, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x78af, lpOverlapped=0x0) returned 1 [0059.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.286] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.286] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.286] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.287] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.287] CloseHandle (hObject=0x108) returned 1 [0059.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.314] GetLastError () returned 0x0 [0059.315] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.315] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.316] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17931904221) returned 1 [0059.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb22b5750, dwHighDateTime=0x1d585b4)) [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db170 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db170 | out: hHeap=0x260000) returned 1 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3331d8 [0059.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.319] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.319] GetLastError () returned 0x0 [0059.319] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.319] GetLastError () returned 0x0 [0059.325] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe8a1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.325] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x175f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x238fdb0*=0x175f, lpOverlapped=0x0) returned 1 [0059.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.326] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.326] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.326] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.327] CloseHandle (hObject=0x104) returned 1 [0059.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.327] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0059.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.328] GetLastError () returned 0x0 [0059.329] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.330] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.330] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17933090196) returned 1 [0059.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb22db8b0, dwHighDateTime=0x1d585b4)) [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7710 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7710 | out: hHeap=0x260000) returned 1 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0059.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.330] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.331] GetLastError () returned 0x0 [0059.331] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.331] GetLastError () returned 0x0 [0059.332] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffec3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.332] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x13c2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x13c2, lpOverlapped=0x0) returned 1 [0059.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.333] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.333] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.333] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.334] CloseHandle (hObject=0x104) returned 1 [0059.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.[deadmin@cock.li].deadmin")) returned 1 [0059.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.335] GetLastError () returned 0x0 [0059.335] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.336] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.336] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.336] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17933714221) returned 1 [0059.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb22db8b0, dwHighDateTime=0x1d585b4)) [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db1e0 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db1e0 | out: hHeap=0x260000) returned 1 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333a28 [0059.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.337] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.337] GetLastError () returned 0x0 [0059.337] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.337] GetLastError () returned 0x0 [0059.338] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.338] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x18f8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x18f8, lpOverlapped=0x0) returned 1 [0059.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.339] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.339] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.339] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.339] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.340] CloseHandle (hObject=0x104) returned 1 [0059.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0059.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.342] GetLastError () returned 0x0 [0059.342] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.343] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.343] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17934435641) returned 1 [0059.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2301a10, dwHighDateTime=0x1d585b4)) [0059.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db218 [0059.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db218 | out: hHeap=0x260000) returned 1 [0059.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333b58 [0059.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.344] GetLastError () returned 0x0 [0059.344] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.344] GetLastError () returned 0x0 [0059.354] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd5f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.354] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2a0a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x2a0a, lpOverlapped=0x0) returned 1 [0059.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.358] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.358] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.359] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.359] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.359] CloseHandle (hObject=0x104) returned 1 [0059.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.360] GetLastError () returned 0x0 [0059.361] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.361] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.362] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.362] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17936285264) returned 1 [0059.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2327b70, dwHighDateTime=0x1d585b4)) [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db288 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db288 | out: hHeap=0x260000) returned 1 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333bf0 [0059.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.362] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.363] GetLastError () returned 0x0 [0059.363] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.363] GetLastError () returned 0x0 [0059.365] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff0a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.365] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xf5c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0xf5c, lpOverlapped=0x0) returned 1 [0059.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.365] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.365] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.366] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.366] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.366] CloseHandle (hObject=0x104) returned 1 [0059.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.368] GetLastError () returned 0x0 [0059.368] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3129c8) returned 1 [0059.369] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0059.369] CryptReleaseContext (hProv=0x3129c8, dwFlags=0x0) returned 1 [0059.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0059.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.369] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17937036202) returned 1 [0059.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2327b70, dwHighDateTime=0x1d585b4)) [0059.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db2c0 [0059.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db2c0 | out: hHeap=0x260000) returned 1 [0059.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333d20 [0059.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.370] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.370] GetLastError () returned 0x0 [0059.370] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.370] GetLastError () returned 0x0 [0059.372] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe254, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.372] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1dac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1dac, lpOverlapped=0x0) returned 1 [0059.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.373] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.373] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.373] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.373] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.374] CloseHandle (hObject=0x104) returned 1 [0059.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.376] GetLastError () returned 0x0 [0059.376] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.377] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.377] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.377] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17937834959) returned 1 [0059.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb234dcd0, dwHighDateTime=0x1d585b4)) [0059.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db2f8 [0059.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db2f8 | out: hHeap=0x260000) returned 1 [0059.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x349c60 [0059.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349c60 | out: hHeap=0x260000) returned 1 [0059.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333db8 [0059.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.378] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.378] GetLastError () returned 0x0 [0059.378] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.378] GetLastError () returned 0x0 [0059.392] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffed98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.392] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1268, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x1268, lpOverlapped=0x0) returned 1 [0059.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.392] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.393] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.393] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.393] CloseHandle (hObject=0x104) returned 1 [0059.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.395] GetLastError () returned 0x0 [0059.395] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.396] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.396] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17939705347) returned 1 [0059.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2373e30, dwHighDateTime=0x1d585b4)) [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db368 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db368 | out: hHeap=0x260000) returned 1 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333e50 [0059.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.397] GetLastError () returned 0x0 [0059.397] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.397] GetLastError () returned 0x0 [0059.398] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff51c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.398] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xae4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0xae4, lpOverlapped=0x0) returned 1 [0059.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.399] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.399] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.399] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.400] CloseHandle (hObject=0x104) returned 1 [0059.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.401] GetLastError () returned 0x0 [0059.401] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.402] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.402] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.402] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17940329120) returned 1 [0059.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2373e30, dwHighDateTime=0x1d585b4)) [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db3a0 [0059.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db3a0 | out: hHeap=0x260000) returned 1 [0059.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331e50 [0059.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.403] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.403] GetLastError () returned 0x0 [0059.403] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.403] GetLastError () returned 0x0 [0059.405] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffac0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.405] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x238fdb0*=0x540, lpOverlapped=0x0) returned 1 [0059.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.408] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.408] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.408] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.408] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.408] CloseHandle (hObject=0x104) returned 1 [0059.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.410] GetLastError () returned 0x0 [0059.410] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.411] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17941228126) returned 1 [0059.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2399f90, dwHighDateTime=0x1d585b4)) [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7668 [0059.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7668 | out: hHeap=0x260000) returned 1 [0059.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0059.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.412] GetLastError () returned 0x0 [0059.412] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.412] GetLastError () returned 0x0 [0059.472] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.472] WriteFile (in: hFile=0x104, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1db8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1db8, lpOverlapped=0x0) returned 1 [0059.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.474] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.474] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.475] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.475] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.475] CloseHandle (hObject=0x104) returned 1 [0059.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.475] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.704] GetLastError () returned 0x0 [0059.836] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.837] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.837] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.837] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17983915074) returned 1 [0059.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb279e4b0, dwHighDateTime=0x1d585b4)) [0059.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8330 [0059.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8330 | out: hHeap=0x260000) returned 1 [0059.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315c28 [0059.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.839] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.839] GetLastError () returned 0x0 [0059.839] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.839] GetLastError () returned 0x0 [0059.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc9be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.841] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3642, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x3642, lpOverlapped=0x0) returned 1 [0059.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.842] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.843] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.843] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.843] CloseHandle (hObject=0xf0) returned 1 [0059.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869b58 [0059.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869b58 | out: hHeap=0x260000) returned 1 [0059.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.844] GetLastError () returned 0x0 [0059.845] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.845] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.845] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.846] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17984681044) returned 1 [0059.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb27c4610, dwHighDateTime=0x1d585b4)) [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8368 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8368 | out: hHeap=0x260000) returned 1 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315b90 [0059.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.846] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.846] GetLastError () returned 0x0 [0059.847] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.847] GetLastError () returned 0x0 [0059.869] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff11b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.870] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xee4a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xee4a, lpOverlapped=0x0) returned 1 [0059.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.870] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.870] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.871] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.871] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.871] CloseHandle (hObject=0xf0) returned 1 [0059.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0059.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0059.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.873] GetLastError () returned 0x0 [0059.898] lstrlenW (lpString=".sql") returned 4 [0059.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".sql") returned 0x0 [0059.898] lstrlenW (lpString=".mdf") returned 4 [0059.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".mdf") returned 0x0 [0059.898] lstrlenW (lpString=".txt") returned 4 [0059.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".txt") returned 0x0 [0059.898] lstrlenW (lpString=".dbf") returned 4 [0059.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".dbf") returned 0x0 [0059.898] lstrlenW (lpString=".ckp") returned 4 [0059.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".ckp") returned 0x0 [0059.898] lstrlenW (lpString=".dacpac") returned 7 [0059.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".dacpac") returned 0x0 [0059.898] lstrlenW (lpString=".db3") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".db3") returned 0x0 [0059.899] lstrlenW (lpString=".dtxs") returned 5 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".dtxs") returned 0x0 [0059.899] lstrlenW (lpString=".mdt") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".mdt") returned 0x0 [0059.899] lstrlenW (lpString=".sdf") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".sdf") returned 0x0 [0059.899] lstrlenW (lpString=".MDF") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".MDF") returned 0x0 [0059.899] lstrlenW (lpString=".DBF") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".DBF") returned 0x0 [0059.899] lstrlenW (lpString=".DB") returned 3 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".DB") returned 0x0 [0059.899] lstrlenW (lpString=".db") returned 3 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".db") returned 0x0 [0059.899] lstrlenW (lpString=".ndf") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".ndf") returned 0x0 [0059.899] lstrlenW (lpString=".NDF") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".NDF") returned 0x0 [0059.899] lstrlenW (lpString=".Mdf") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".Mdf") returned 0x0 [0059.899] lstrlenW (lpString=".dat") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".dat") returned 0x0 [0059.899] lstrlenW (lpString=".DAT") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".DAT") returned 0x0 [0059.899] lstrlenW (lpString=".ldf") returned 4 [0059.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".ldf") returned 0x0 [0059.900] lstrlenW (lpString=".LDF") returned 4 [0059.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch=".LDF") returned 0x0 [0059.900] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0059.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0059.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0059.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0059.900] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.901] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.901] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.901] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17990408771) returned 1 [0059.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2836a30, dwHighDateTime=0x1d585b4)) [0059.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28487d0 [0059.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28487d0 | out: hHeap=0x260000) returned 1 [0059.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315e88 [0059.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.904] GetLastError () returned 0x0 [0059.905] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.905] GetLastError () returned 0x0 [0059.941] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffff6cb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.941] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x934c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x934c, lpOverlapped=0x0) returned 1 [0059.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.942] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.942] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.942] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.942] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.943] CloseHandle (hObject=0x118) returned 1 [0059.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.944] GetLastError () returned 0x0 [0059.945] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0059.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.945] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.946] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=17994676932) returned 1 [0059.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb28a8e50, dwHighDateTime=0x1d585b4)) [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b84f0 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b84f0 | out: hHeap=0x260000) returned 1 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316050 [0059.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.946] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0059.946] GetLastError () returned 0x0 [0059.947] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0059.947] GetLastError () returned 0x0 [0059.981] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd80c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.982] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x27f4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x27f4, lpOverlapped=0x0) returned 1 [0059.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.983] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.983] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.983] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.983] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.984] CloseHandle (hObject=0x118) returned 1 [0059.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.985] GetLastError () returned 0x0 [0060.079] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.080] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.080] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.080] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18008160545) returned 1 [0060.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb29ffab0, dwHighDateTime=0x1d585b4)) [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8838 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8838 | out: hHeap=0x260000) returned 1 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316b00 [0060.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.081] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.081] GetLastError () returned 0x0 [0060.082] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.082] GetLastError () returned 0x0 [0060.094] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff788, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.094] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x878, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x878, lpOverlapped=0x0) returned 1 [0060.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.099] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.099] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.100] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.100] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.100] CloseHandle (hObject=0xfc) returned 1 [0060.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0060.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0060.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.169] GetLastError () returned 0x0 [0060.169] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.170] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.170] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.170] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18017147119) returned 1 [0060.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2ae42f0, dwHighDateTime=0x1d585b4)) [0060.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294eb0 [0060.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0060.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ede8 [0060.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.178] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.178] GetLastError () returned 0x0 [0060.178] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.178] GetLastError () returned 0x0 [0060.180] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe546, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.181] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1aba, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x1aba, lpOverlapped=0x0) returned 1 [0060.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.181] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.181] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.182] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.182] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.182] CloseHandle (hObject=0x110) returned 1 [0060.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc548 [0060.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc548 | out: hHeap=0x260000) returned 1 [0060.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.185] GetLastError () returned 0x0 [0060.185] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.186] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.186] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.186] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18018747302) returned 1 [0060.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2b0a450, dwHighDateTime=0x1d585b4)) [0060.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f90 [0060.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f90 | out: hHeap=0x260000) returned 1 [0060.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ee80 [0060.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.187] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.187] GetLastError () returned 0x0 [0060.187] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.187] GetLastError () returned 0x0 [0060.189] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.189] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1652, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x1652, lpOverlapped=0x0) returned 1 [0060.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.189] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.189] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.190] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.190] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.190] CloseHandle (hObject=0x110) returned 1 [0060.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc548 [0060.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc548 | out: hHeap=0x260000) returned 1 [0060.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.191] GetLastError () returned 0x0 [0060.192] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.192] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.193] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.193] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18019385219) returned 1 [0060.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2b0a450, dwHighDateTime=0x1d585b4)) [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294fc8 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316640 [0060.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.193] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.194] GetLastError () returned 0x0 [0060.194] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.194] GetLastError () returned 0x0 [0060.195] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe940, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.195] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x16c0, lpOverlapped=0x0) returned 1 [0060.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.196] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.196] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.196] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.196] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.196] CloseHandle (hObject=0x110) returned 1 [0060.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27fc548 [0060.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fc548 | out: hHeap=0x260000) returned 1 [0060.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.198] GetLastError () returned 0x0 [0060.198] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.199] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.199] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.199] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18020004565) returned 1 [0060.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2b0a450, dwHighDateTime=0x1d585b4)) [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8918 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8918 | out: hHeap=0x260000) returned 1 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316df8 [0060.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.200] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.200] GetLastError () returned 0x0 [0060.200] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.200] GetLastError () returned 0x0 [0060.209] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffffa30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.209] WriteFile (in: hFile=0x110, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x5d0, lpOverlapped=0x0) returned 1 [0060.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.210] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.210] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.210] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.210] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.211] CloseHandle (hObject=0x110) returned 1 [0060.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.231] GetLastError () returned 0x0 [0060.232] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.260] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.260] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.260] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18026107910) returned 1 [0060.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2ba29d0, dwHighDateTime=0x1d585b4)) [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b89f8 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b89f8 | out: hHeap=0x260000) returned 1 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317188 [0060.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.261] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.261] GetLastError () returned 0x0 [0060.261] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.261] GetLastError () returned 0x0 [0060.264] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc9ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.264] WriteFile (in: hFile=0x110, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3636, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3636, lpOverlapped=0x0) returned 1 [0060.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.264] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.264] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.265] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.265] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.265] CloseHandle (hObject=0x110) returned 1 [0060.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869a90 [0060.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869a90 | out: hHeap=0x260000) returned 1 [0060.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.268] GetLastError () returned 0x0 [0060.268] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.269] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.269] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.269] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18026995762) returned 1 [0060.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2bc8b30, dwHighDateTime=0x1d585b4)) [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8aa0 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8aa0 | out: hHeap=0x260000) returned 1 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x286e5d0 [0060.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317058 [0060.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x286e5d0 | out: hHeap=0x260000) returned 1 [0060.269] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.270] GetLastError () returned 0x0 [0060.270] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.270] GetLastError () returned 0x0 [0060.309] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff9a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.309] WriteFile (in: hFile=0x110, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x660, lpOverlapped=0x0) returned 1 [0060.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.310] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.310] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.311] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.311] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.311] CloseHandle (hObject=0x110) returned 1 [0060.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.312] GetLastError () returned 0x0 [0060.312] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.313] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.313] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.313] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18031458848) returned 1 [0060.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2c3af50, dwHighDateTime=0x1d585b4)) [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8bf0 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8bf0 | out: hHeap=0x260000) returned 1 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3172b8 [0060.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.314] GetLastError () returned 0x0 [0060.314] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.314] GetLastError () returned 0x0 [0060.328] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd752, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.344] WriteFile (in: hFile=0x110, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x28ae, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x28ae, lpOverlapped=0x0) returned 1 [0060.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.345] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.345] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.346] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.346] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.346] CloseHandle (hObject=0x110) returned 1 [0060.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.348] GetLastError () returned 0x0 [0060.348] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.357] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.357] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.357] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18035806574) returned 1 [0060.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2cad370, dwHighDateTime=0x1d585b4)) [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8c98 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8c98 | out: hHeap=0x260000) returned 1 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317648 [0060.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.358] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.358] GetLastError () returned 0x0 [0060.358] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.358] GetLastError () returned 0x0 [0060.426] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe768, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.426] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1898, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1898, lpOverlapped=0x0) returned 1 [0060.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.427] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.427] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.428] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.428] CloseHandle (hObject=0x110) returned 1 [0060.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.429] GetLastError () returned 0x0 [0060.430] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.430] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.430] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.431] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18043175327) returned 1 [0060.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2d458f0, dwHighDateTime=0x1d585b4)) [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8e90 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8e90 | out: hHeap=0x260000) returned 1 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332b60 [0060.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.431] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.431] GetLastError () returned 0x0 [0060.432] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.432] GetLastError () returned 0x0 [0060.433] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe6a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.433] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1960, lpOverlapped=0x0) returned 1 [0060.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.434] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.434] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.434] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.435] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.435] CloseHandle (hObject=0x110) returned 1 [0060.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.436] GetLastError () returned 0x0 [0060.437] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.437] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.437] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.438] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18043866512) returned 1 [0060.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2d6ba50, dwHighDateTime=0x1d585b4)) [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8ec8 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8ec8 | out: hHeap=0x260000) returned 1 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332608 [0060.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.438] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.438] GetLastError () returned 0x0 [0060.438] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.439] GetLastError () returned 0x0 [0060.440] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.440] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1708, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1708, lpOverlapped=0x0) returned 1 [0060.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.440] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.441] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.441] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.441] CloseHandle (hObject=0x110) returned 1 [0060.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.443] GetLastError () returned 0x0 [0060.443] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.444] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.444] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.444] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18044512946) returned 1 [0060.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2d6ba50, dwHighDateTime=0x1d585b4)) [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8f00 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8f00 | out: hHeap=0x260000) returned 1 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c120 [0060.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.445] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.445] GetLastError () returned 0x0 [0060.445] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.445] GetLastError () returned 0x0 [0060.446] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffed9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.446] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1264, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1264, lpOverlapped=0x0) returned 1 [0060.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.447] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.447] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.448] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.448] CloseHandle (hObject=0x110) returned 1 [0060.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.449] GetLastError () returned 0x0 [0060.450] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.451] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.451] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.451] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18045186545) returned 1 [0060.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2d91bb0, dwHighDateTime=0x1d585b4)) [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8f38 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8f38 | out: hHeap=0x260000) returned 1 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0060.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.451] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.452] GetLastError () returned 0x0 [0060.452] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.452] GetLastError () returned 0x0 [0060.486] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe27c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.486] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1d84, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1d84, lpOverlapped=0x0) returned 1 [0060.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.487] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.487] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.487] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.488] CloseHandle (hObject=0x110) returned 1 [0060.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.489] GetLastError () returned 0x0 [0060.492] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.492] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.492] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.493] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18049378850) returned 1 [0060.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2ddde70, dwHighDateTime=0x1d585b4)) [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8fe0 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8fe0 | out: hHeap=0x260000) returned 1 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bf58 [0060.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.493] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.493] GetLastError () returned 0x0 [0060.494] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.494] GetLastError () returned 0x0 [0060.508] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffef8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.508] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1075e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1075e, lpOverlapped=0x0) returned 1 [0060.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.509] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.509] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.510] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.510] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.514] CloseHandle (hObject=0x110) returned 1 [0060.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.518] GetLastError () returned 0x0 [0060.518] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.519] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.519] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18052059200) returned 1 [0060.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2e2a130, dwHighDateTime=0x1d585b4)) [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9018 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9018 | out: hHeap=0x260000) returned 1 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba380 [0060.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.520] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.520] GetLastError () returned 0x0 [0060.520] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.520] GetLastError () returned 0x0 [0060.536] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbc50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.536] WriteFile (in: hFile=0x110, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x43b0, lpOverlapped=0x0) returned 1 [0060.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.537] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.537] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.538] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.538] CloseHandle (hObject=0x110) returned 1 [0060.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.539] GetLastError () returned 0x0 [0060.584] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x283bff8) returned 1 [0060.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.585] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.585] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18058629053) returned 1 [0060.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2ec26b0, dwHighDateTime=0x1d585b4)) [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9210 [0060.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9210 | out: hHeap=0x260000) returned 1 [0060.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba2e8 [0060.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.586] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.586] GetLastError () returned 0x0 [0060.586] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.586] GetLastError () returned 0x0 [0060.600] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffae58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.600] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x51a8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x51a8, lpOverlapped=0x0) returned 1 [0060.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.601] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.601] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.601] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.602] CloseHandle (hObject=0x100) returned 1 [0060.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.640] GetLastError () returned 0x0 [0060.640] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x283bff8) returned 1 [0060.641] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.641] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.641] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18064228754) returned 1 [0060.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2f5ac30, dwHighDateTime=0x1d585b4)) [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9398 [0060.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9398 | out: hHeap=0x260000) returned 1 [0060.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba5e0 [0060.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.642] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.642] GetLastError () returned 0x0 [0060.642] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.642] GetLastError () returned 0x0 [0060.644] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdb38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.644] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x24c8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x24c8, lpOverlapped=0x0) returned 1 [0060.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.644] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.644] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.645] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.645] CloseHandle (hObject=0x100) returned 1 [0060.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.647] GetLastError () returned 0x0 [0060.647] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x283bff8) returned 1 [0060.648] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.648] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.648] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18064917087) returned 1 [0060.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2f5ac30, dwHighDateTime=0x1d585b4)) [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b93d0 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b93d0 | out: hHeap=0x260000) returned 1 [0060.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bad98 [0060.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.649] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.649] GetLastError () returned 0x0 [0060.649] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.649] GetLastError () returned 0x0 [0060.650] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd994, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.650] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x266c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x266c, lpOverlapped=0x0) returned 1 [0060.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.651] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.651] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.651] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.652] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.652] CloseHandle (hObject=0x100) returned 1 [0060.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.654] GetLastError () returned 0x0 [0060.654] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x283bff8) returned 1 [0060.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0060.655] CryptReleaseContext (hProv=0x283bff8, dwFlags=0x0) returned 1 [0060.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0060.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.655] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18065659666) returned 1 [0060.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb2f80d90, dwHighDateTime=0x1d585b4)) [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9408 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9408 | out: hHeap=0x260000) returned 1 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bae30 [0060.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.656] GetLastError () returned 0x0 [0060.656] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.656] GetLastError () returned 0x0 [0060.849] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe022, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.850] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1fde, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x1fde, lpOverlapped=0x0) returned 1 [0060.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.850] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.850] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.851] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.851] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.851] CloseHandle (hObject=0x100) returned 1 [0060.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.853] GetLastError () returned 0x0 [0060.853] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.854] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.854] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.854] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18085513589) returned 1 [0060.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3149e10, dwHighDateTime=0x1d585b4)) [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1950 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f0e0 [0060.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.855] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.855] GetLastError () returned 0x0 [0060.855] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.855] GetLastError () returned 0x0 [0060.856] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffcf1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.857] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x30e4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x30e4, lpOverlapped=0x0) returned 1 [0060.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.857] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.857] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.858] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.858] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.858] CloseHandle (hObject=0x100) returned 1 [0060.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.860] GetLastError () returned 0x0 [0060.861] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.862] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.862] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18086301468) returned 1 [0060.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb316ff70, dwHighDateTime=0x1d585b4)) [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b96a8 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b96a8 | out: hHeap=0x260000) returned 1 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2baec8 [0060.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.863] GetLastError () returned 0x0 [0060.863] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.863] GetLastError () returned 0x0 [0060.866] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe85e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.867] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x17a1c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x17a1c, lpOverlapped=0x0) returned 1 [0060.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.868] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.868] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.869] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.869] CloseHandle (hObject=0x100) returned 1 [0060.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.871] GetLastError () returned 0x0 [0060.872] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.872] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.873] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18087384194) returned 1 [0060.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb31960d0, dwHighDateTime=0x1d585b4)) [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b96e0 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b96e0 | out: hHeap=0x260000) returned 1 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb5e8 [0060.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.873] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.874] GetLastError () returned 0x0 [0060.874] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.874] GetLastError () returned 0x0 [0060.875] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff990, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.875] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x670, lpOverlapped=0x0) returned 1 [0060.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.876] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.876] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.876] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.876] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.877] CloseHandle (hObject=0x100) returned 1 [0060.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0060.878] GetLastError () returned 0x0 [0060.878] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0060.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.879] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.879] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18088237642) returned 1 [0060.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb31960d0, dwHighDateTime=0x1d585b4)) [0060.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0060.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9718 [0060.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9718 | out: hHeap=0x260000) returned 1 [0060.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb680 [0060.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0060.882] GetLastError () returned 0x0 [0060.882] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0060.882] GetLastError () returned 0x0 [0060.884] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffa4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.884] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x5b4, lpOverlapped=0x0) returned 1 [0060.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.884] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.884] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.885] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.885] CloseHandle (hObject=0x100) returned 1 [0060.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.064] GetLastError () returned 0x0 [0061.257] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.281] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.281] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.282] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18128276091) returned 1 [0061.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3574490, dwHighDateTime=0x1d585b4)) [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294720 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc1c8 [0061.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.282] GetLastError () returned 0x0 [0061.283] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.283] GetLastError () returned 0x0 [0061.284] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdd0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.284] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x22f4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x22f4, lpOverlapped=0x0) returned 1 [0061.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.285] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.285] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.285] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.285] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.286] CloseHandle (hObject=0x104) returned 1 [0061.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.289] GetLastError () returned 0x0 [0061.290] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.291] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.291] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18129181785) returned 1 [0061.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3574490, dwHighDateTime=0x1d585b4)) [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9bb0 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9bb0 | out: hHeap=0x260000) returned 1 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bbe38 [0061.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.292] GetLastError () returned 0x0 [0061.292] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.292] GetLastError () returned 0x0 [0061.294] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffaf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.294] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x50c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x50c, lpOverlapped=0x0) returned 1 [0061.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.294] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.294] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.295] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.295] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.295] CloseHandle (hObject=0x104) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.297] GetLastError () returned 0x0 [0061.297] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.298] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.298] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18129926723) returned 1 [0061.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb359a5f0, dwHighDateTime=0x1d585b4)) [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9be8 [0061.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9be8 | out: hHeap=0x260000) returned 1 [0061.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc2f8 [0061.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.299] GetLastError () returned 0x0 [0061.299] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.299] GetLastError () returned 0x0 [0061.301] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff888, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.301] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x778, lpOverlapped=0x0) returned 1 [0061.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.301] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.302] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.302] CloseHandle (hObject=0x104) returned 1 [0061.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.304] GetLastError () returned 0x0 [0061.304] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.305] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.305] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.305] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18130599902) returned 1 [0061.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb359a5f0, dwHighDateTime=0x1d585b4)) [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9c20 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9c20 | out: hHeap=0x260000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc390 [0061.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.306] GetLastError () returned 0x0 [0061.306] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.306] GetLastError () returned 0x0 [0061.311] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdf6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.311] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2094, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x2094, lpOverlapped=0x0) returned 1 [0061.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.311] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.311] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.312] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.312] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.313] CloseHandle (hObject=0x104) returned 1 [0061.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.314] GetLastError () returned 0x0 [0061.314] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.315] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.315] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18131621352) returned 1 [0061.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb35c0750, dwHighDateTime=0x1d585b4)) [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0598 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0598 | out: hHeap=0x260000) returned 1 [0061.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f3d8 [0061.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.316] GetLastError () returned 0x0 [0061.316] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.316] GetLastError () returned 0x0 [0061.542] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd024, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.542] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2fdc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x2fdc, lpOverlapped=0x0) returned 1 [0061.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.545] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.546] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.546] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.546] CloseHandle (hObject=0x104) returned 1 [0061.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.602] GetLastError () returned 0x0 [0061.603] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.603] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.604] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18160472388) returned 1 [0061.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb386e010, dwHighDateTime=0x1d585b4)) [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9e88 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9e88 | out: hHeap=0x260000) returned 1 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc7b8 [0061.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.604] GetLastError () returned 0x0 [0061.605] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.605] GetLastError () returned 0x0 [0061.608] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdbc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.608] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x243c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x243c, lpOverlapped=0x0) returned 1 [0061.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.609] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.609] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.609] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.609] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.610] CloseHandle (hObject=0xfc) returned 1 [0061.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.611] GetLastError () returned 0x0 [0061.612] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.613] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.613] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.613] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18161393491) returned 1 [0061.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3894170, dwHighDateTime=0x1d585b4)) [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9ec0 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9ec0 | out: hHeap=0x260000) returned 1 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc8e8 [0061.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.614] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.614] GetLastError () returned 0x0 [0061.614] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.614] GetLastError () returned 0x0 [0061.616] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe8a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.616] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x175a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x175a, lpOverlapped=0x0) returned 1 [0061.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.617] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.617] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.617] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.617] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.618] CloseHandle (hObject=0xfc) returned 1 [0061.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.619] GetLastError () returned 0x0 [0061.619] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.620] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.620] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.621] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18162169129) returned 1 [0061.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb38ba2d0, dwHighDateTime=0x1d585b4)) [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9f30 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9f30 | out: hHeap=0x260000) returned 1 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc980 [0061.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.621] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.621] GetLastError () returned 0x0 [0061.621] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.622] GetLastError () returned 0x0 [0061.623] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffeddc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.623] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1224, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1224, lpOverlapped=0x0) returned 1 [0061.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.624] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.624] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.624] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.624] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.625] CloseHandle (hObject=0xfc) returned 1 [0061.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.626] GetLastError () returned 0x0 [0061.627] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.627] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0061.627] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0061.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.627] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18162862814) returned 1 [0061.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb38ba2d0, dwHighDateTime=0x1d585b4)) [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9f68 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0061.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9f68 | out: hHeap=0x260000) returned 1 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcab0 [0061.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.628] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.628] GetLastError () returned 0x0 [0061.628] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.629] GetLastError () returned 0x0 [0061.630] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe440, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.630] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x238fdb0*=0x1bc0, lpOverlapped=0x0) returned 1 [0061.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.631] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.631] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.631] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.631] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.632] CloseHandle (hObject=0xfc) returned 1 [0061.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.632] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.633] GetLastError () returned 0x0 [0061.634] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0061.634] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0061.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.635] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18163568369) returned 1 [0061.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb38ba2d0, dwHighDateTime=0x1d585b4)) [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9fa0 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9fa0 | out: hHeap=0x260000) returned 1 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcb48 [0061.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.635] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.635] GetLastError () returned 0x0 [0061.635] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.738] GetLastError () returned 0x0 [0061.740] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.740] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x738, lpOverlapped=0x0) returned 1 [0061.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.741] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.741] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.741] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.741] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.742] CloseHandle (hObject=0xfc) returned 1 [0061.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.755] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.794] GetLastError () returned 0x0 [0061.795] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.796] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.796] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.796] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18179748595) returned 1 [0061.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3a5d1f0, dwHighDateTime=0x1d585b4)) [0061.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d74a8 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d74a8 | out: hHeap=0x260000) returned 1 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcbe0 [0061.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.797] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.797] GetLastError () returned 0x0 [0061.797] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.797] GetLastError () returned 0x0 [0061.799] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd896, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.800] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x276a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x276a, lpOverlapped=0x0) returned 1 [0061.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.800] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.800] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.801] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.801] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.801] CloseHandle (hObject=0x100) returned 1 [0061.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895aa8 [0061.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895aa8 | out: hHeap=0x260000) returned 1 [0061.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.803] GetLastError () returned 0x0 [0061.803] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.804] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.804] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18180504014) returned 1 [0061.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3a5d1f0, dwHighDateTime=0x1d585b4)) [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d74e0 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d74e0 | out: hHeap=0x260000) returned 1 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd300 [0061.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.805] GetLastError () returned 0x0 [0061.805] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.805] GetLastError () returned 0x0 [0061.806] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdd74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.807] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x228c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x228c, lpOverlapped=0x0) returned 1 [0061.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.807] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.807] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.808] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.808] CloseHandle (hObject=0x100) returned 1 [0061.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0061.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0061.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.810] GetLastError () returned 0x0 [0061.810] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.811] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.811] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.811] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18181208534) returned 1 [0061.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3a83350, dwHighDateTime=0x1d585b4)) [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7518 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7518 | out: hHeap=0x260000) returned 1 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd398 [0061.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.812] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.812] GetLastError () returned 0x0 [0061.812] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.812] GetLastError () returned 0x0 [0061.814] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff604, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.814] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x9fc, lpOverlapped=0x0) returned 1 [0061.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.814] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.814] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.815] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.815] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.815] CloseHandle (hObject=0x100) returned 1 [0061.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0061.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0061.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0061.817] GetLastError () returned 0x0 [0061.818] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0061.818] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.818] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0061.819] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18181970624) returned 1 [0061.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3a83350, dwHighDateTime=0x1d585b4)) [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0800 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0800 | out: hHeap=0x260000) returned 1 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f6d0 [0061.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.819] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0061.819] GetLastError () returned 0x0 [0061.820] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0061.820] GetLastError () returned 0x0 [0061.821] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffda44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.821] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x25bc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x25bc, lpOverlapped=0x0) returned 1 [0061.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.822] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.822] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.822] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.822] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.899] CloseHandle (hObject=0x100) returned 1 [0061.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0062.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.316] GetLastError () returned 0x0 [0062.316] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.317] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.317] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.318] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18231865355) returned 1 [0062.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3f45f50, dwHighDateTime=0x1d585b4)) [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3518e8 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3518e8 | out: hHeap=0x260000) returned 1 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3538f0 [0062.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.318] GetLastError () returned 0x0 [0062.319] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.319] GetLastError () returned 0x0 [0062.320] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.320] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3b4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3b4, lpOverlapped=0x0) returned 1 [0062.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.321] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.321] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.321] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.322] CloseHandle (hObject=0x100) returned 1 [0062.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0062.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.323] GetLastError () returned 0x0 [0062.323] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.324] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.324] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18232557199) returned 1 [0062.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3f6c0b0, dwHighDateTime=0x1d585b4)) [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351920 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0062.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351920 | out: hHeap=0x260000) returned 1 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353a20 [0062.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.325] GetLastError () returned 0x0 [0062.325] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.325] GetLastError () returned 0x0 [0062.327] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffb6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.327] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x494, lpOverlapped=0x0) returned 1 [0062.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.328] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.328] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.328] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.328] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.329] CloseHandle (hObject=0x100) returned 1 [0062.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0062.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.330] GetLastError () returned 0x0 [0062.330] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.331] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.331] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.331] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18233230876) returned 1 [0062.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3f6c0b0, dwHighDateTime=0x1d585b4)) [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351958 [0062.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351958 | out: hHeap=0x260000) returned 1 [0062.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353ab8 [0062.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.332] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.332] GetLastError () returned 0x0 [0062.332] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.332] GetLastError () returned 0x0 [0062.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.334] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3b9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3b9, lpOverlapped=0x0) returned 1 [0062.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.334] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.334] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.335] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.335] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.335] CloseHandle (hObject=0x100) returned 1 [0062.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0062.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.337] GetLastError () returned 0x0 [0062.338] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.338] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.338] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.339] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18233976862) returned 1 [0062.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3f92210, dwHighDateTime=0x1d585b4)) [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351990 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351990 | out: hHeap=0x260000) returned 1 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353b50 [0062.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.339] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.339] GetLastError () returned 0x0 [0062.340] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.340] GetLastError () returned 0x0 [0062.341] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffcfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.341] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x304, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x304, lpOverlapped=0x0) returned 1 [0062.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.342] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.342] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.342] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.343] CloseHandle (hObject=0x100) returned 1 [0062.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0062.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.344] GetLastError () returned 0x0 [0062.345] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.346] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.346] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18234684190) returned 1 [0062.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb3f92210, dwHighDateTime=0x1d585b4)) [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3519c8 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3519c8 | out: hHeap=0x260000) returned 1 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353be8 [0062.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.347] GetLastError () returned 0x0 [0062.347] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.347] GetLastError () returned 0x0 [0062.410] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.417] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe44, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xe44, lpOverlapped=0x0) returned 1 [0062.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.447] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.461] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.469] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.476] CloseHandle (hObject=0x100) returned 1 [0062.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.478] GetLastError () returned 0x0 [0062.478] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.479] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.479] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.479] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18248037071) returned 1 [0062.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb40e8e70, dwHighDateTime=0x1d585b4)) [0062.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0a68 [0062.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0a68 | out: hHeap=0x260000) returned 1 [0062.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3326a0 [0062.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.480] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.480] GetLastError () returned 0x0 [0062.480] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.480] GetLastError () returned 0x0 [0062.482] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffbc2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.482] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x43e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x43e, lpOverlapped=0x0) returned 1 [0062.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.482] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.482] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.483] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.483] CloseHandle (hObject=0x100) returned 1 [0062.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.485] GetLastError () returned 0x0 [0062.485] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.486] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.486] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18248715769) returned 1 [0062.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb40e8e70, dwHighDateTime=0x1d585b4)) [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0a30 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0a30 | out: hHeap=0x260000) returned 1 [0062.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3326a0 [0062.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.487] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.487] GetLastError () returned 0x0 [0062.487] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.487] GetLastError () returned 0x0 [0062.489] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffbee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.489] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x412, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x412, lpOverlapped=0x0) returned 1 [0062.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.490] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.490] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.490] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.490] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.491] CloseHandle (hObject=0x100) returned 1 [0062.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.492] GetLastError () returned 0x0 [0062.492] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.493] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.493] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18249440301) returned 1 [0062.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb40e8e70, dwHighDateTime=0x1d585b4)) [0062.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f09f8 [0062.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f09f8 | out: hHeap=0x260000) returned 1 [0062.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3326a0 [0062.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.494] GetLastError () returned 0x0 [0062.494] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.494] GetLastError () returned 0x0 [0062.496] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe481, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.496] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1b7f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x1b7f, lpOverlapped=0x0) returned 1 [0062.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.497] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.497] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.497] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.497] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.498] CloseHandle (hObject=0x100) returned 1 [0062.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.499] GetLastError () returned 0x0 [0062.499] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.500] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.500] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18250142437) returned 1 [0062.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb410efd0, dwHighDateTime=0x1d585b4)) [0062.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f09c0 [0062.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f09c0 | out: hHeap=0x260000) returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3326a0 [0062.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.501] GetLastError () returned 0x0 [0062.501] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.501] GetLastError () returned 0x0 [0062.503] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff953, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.503] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x6ad, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x6ad, lpOverlapped=0x0) returned 1 [0062.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.504] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.504] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.505] CloseHandle (hObject=0x100) returned 1 [0062.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.506] GetLastError () returned 0x0 [0062.506] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.507] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.507] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18250843756) returned 1 [0062.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb410efd0, dwHighDateTime=0x1d585b4)) [0062.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0988 [0062.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0988 | out: hHeap=0x260000) returned 1 [0062.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3326a0 [0062.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.508] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.508] GetLastError () returned 0x0 [0062.508] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.508] GetLastError () returned 0x0 [0062.596] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff961, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.596] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x69f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x69f, lpOverlapped=0x0) returned 1 [0062.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.597] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.597] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.597] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.598] CloseHandle (hObject=0x100) returned 1 [0062.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.602] GetLastError () returned 0x0 [0062.602] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.603] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.603] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18260420324) returned 1 [0062.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4219970, dwHighDateTime=0x1d585b4)) [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351d80 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351d80 | out: hHeap=0x260000) returned 1 [0062.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.604] GetLastError () returned 0x0 [0062.604] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.604] GetLastError () returned 0x0 [0062.606] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff66a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.607] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x996, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x996, lpOverlapped=0x0) returned 1 [0062.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.607] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.607] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.608] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.608] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.608] CloseHandle (hObject=0x100) returned 1 [0062.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0062.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0062.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.610] GetLastError () returned 0x0 [0062.610] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.611] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.611] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.611] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18261231194) returned 1 [0062.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4219970, dwHighDateTime=0x1d585b4)) [0062.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351db8 [0062.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351db8 | out: hHeap=0x260000) returned 1 [0062.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.612] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.612] GetLastError () returned 0x0 [0062.612] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.612] GetLastError () returned 0x0 [0062.614] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff6f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.614] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x90c, lpOverlapped=0x0) returned 1 [0062.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.615] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.616] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.616] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.616] CloseHandle (hObject=0x100) returned 1 [0062.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0062.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0062.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.617] GetLastError () returned 0x0 [0062.618] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.619] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.619] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18262010287) returned 1 [0062.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb423fad0, dwHighDateTime=0x1d585b4)) [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351df0 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351df0 | out: hHeap=0x260000) returned 1 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.620] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.620] GetLastError () returned 0x0 [0062.620] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.620] GetLastError () returned 0x0 [0062.622] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffa7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.622] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x581, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x581, lpOverlapped=0x0) returned 1 [0062.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.623] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.623] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.623] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.624] CloseHandle (hObject=0x100) returned 1 [0062.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0062.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0062.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.625] GetLastError () returned 0x0 [0062.625] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.626] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.626] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.626] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18262748541) returned 1 [0062.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb423fad0, dwHighDateTime=0x1d585b4)) [0062.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351e28 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351e28 | out: hHeap=0x260000) returned 1 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0062.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.627] GetLastError () returned 0x0 [0062.627] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.627] GetLastError () returned 0x0 [0062.629] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffea06, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.629] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x15fa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x15fa, lpOverlapped=0x0) returned 1 [0062.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.630] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.630] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.630] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.630] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.631] CloseHandle (hObject=0x100) returned 1 [0062.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.632] GetLastError () returned 0x0 [0062.633] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.634] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.634] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0062.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0062.634] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18263502504) returned 1 [0062.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb42b1ef0, dwHighDateTime=0x1d585b4)) [0062.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0062.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351c30 [0062.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351c30 | out: hHeap=0x260000) returned 1 [0062.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.668] GetLastError () returned 0x0 [0062.668] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.668] GetLastError () returned 0x0 [0062.671] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc11, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.671] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x3ef, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x3ef, lpOverlapped=0x0) returned 1 [0062.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.672] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.672] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.672] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.672] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.673] CloseHandle (hObject=0x100) returned 1 [0062.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0062.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0062.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0062.699] GetLastError () returned 0x0 [0062.722] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.733] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.733] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.733] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18273412895) returned 1 [0062.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb434a470, dwHighDateTime=0x1d585b4)) [0062.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0062.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0062.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f10f8 [0062.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f10f8 | out: hHeap=0x260000) returned 1 [0062.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0062.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.740] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.740] GetLastError () returned 0x0 [0062.740] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.740] GetLastError () returned 0x0 [0062.742] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffeef68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.743] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x11098, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x11098, lpOverlapped=0x0) returned 1 [0062.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.743] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.743] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.744] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.744] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.744] CloseHandle (hObject=0x118) returned 1 [0062.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0062.767] GetLastError () returned 0x0 [0062.781] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0062.794] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.797] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.797] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18279802071) returned 1 [0062.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb43e29f0, dwHighDateTime=0x1d585b4)) [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0f70 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0f70 | out: hHeap=0x260000) returned 1 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0062.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0062.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.798] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.798] GetLastError () returned 0x0 [0062.798] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.798] GetLastError () returned 0x0 [0062.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffe73ef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.801] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x18c11, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x18c11, lpOverlapped=0x0) returned 1 [0062.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.801] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.802] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.802] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.802] CloseHandle (hObject=0x118) returned 1 [0062.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.806] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.815] GetLastError () returned 0x0 [0062.841] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0062.855] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.858] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0062.866] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18286699328) returned 1 [0062.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb447af70, dwHighDateTime=0x1d585b4)) [0062.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0062.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0e20 [0062.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0e20 | out: hHeap=0x260000) returned 1 [0062.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321800 [0062.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.874] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.879] GetLastError () returned 0x0 [0062.880] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.880] GetLastError () returned 0x0 [0062.883] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.883] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.885] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.885] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.887] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.887] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.887] CloseHandle (hObject=0xfc) returned 1 [0062.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.905] GetLastError () returned 0x0 [0062.916] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0062.924] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.929] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.933] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18293379373) returned 1 [0062.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4539650, dwHighDateTime=0x1d585b4)) [0062.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0c98 [0062.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0c98 | out: hHeap=0x260000) returned 1 [0062.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321470 [0062.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.942] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.943] GetLastError () returned 0x0 [0062.943] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.943] GetLastError () returned 0x0 [0062.947] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.947] WriteFile (in: hFile=0x100, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0062.949] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.949] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.950] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.950] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.950] CloseHandle (hObject=0x100) returned 1 [0062.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0062.952] GetLastError () returned 0x0 [0062.957] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0062.972] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.972] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0062.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.972] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18297311034) returned 1 [0062.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4585910, dwHighDateTime=0x1d585b4)) [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0bf0 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0bf0 | out: hHeap=0x260000) returned 1 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321210 [0062.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0062.973] GetLastError () returned 0x0 [0062.973] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0062.973] GetLastError () returned 0x0 [0063.064] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.066] WriteFile (in: hFile=0x100, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0063.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.076] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.076] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.087] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.088] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.096] CloseHandle (hObject=0x100) returned 1 [0063.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3ee8 [0063.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3ee8 | out: hHeap=0x260000) returned 1 [0063.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0063.302] GetLastError () returned 0x0 [0063.303] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.304] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.304] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.304] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18330560000) returned 1 [0063.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb48a55f0, dwHighDateTime=0x1d585b4)) [0063.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0063.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352100 [0063.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352100 | out: hHeap=0x260000) returned 1 [0063.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b2e0 [0063.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.306] GetLastError () returned 0x0 [0063.306] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.306] GetLastError () returned 0x0 [0063.330] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff2ea6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.330] WriteFile (in: hFile=0x100, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xd15a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0xd15a, lpOverlapped=0x0) returned 1 [0063.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.331] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.332] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.332] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.332] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.333] CloseHandle (hObject=0x100) returned 1 [0063.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3ee8 [0063.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3ee8 | out: hHeap=0x260000) returned 1 [0063.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0063.335] GetLastError () returned 0x0 [0063.336] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.337] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.337] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18333846610) returned 1 [0063.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4917a10, dwHighDateTime=0x1d585b4)) [0063.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352138 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352138 | out: hHeap=0x260000) returned 1 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0063.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321340 [0063.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0063.338] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.338] GetLastError () returned 0x0 [0063.339] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.339] GetLastError () returned 0x0 [0063.343] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.344] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0063.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0063.346] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.346] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.349] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.350] CloseHandle (hObject=0x100) returned 1 [0063.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bb2d0 [0063.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb2d0 | out: hHeap=0x260000) returned 1 [0063.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0063.352] GetLastError () returned 0x0 [0063.363] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.383] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.383] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.384] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18338475018) returned 1 [0063.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4989e30, dwHighDateTime=0x1d585b4)) [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3521a8 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3521a8 | out: hHeap=0x260000) returned 1 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320de8 [0063.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.384] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.385] GetLastError () returned 0x0 [0063.385] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.385] GetLastError () returned 0x0 [0063.457] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffef918, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.469] WriteFile (in: hFile=0x100, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x106e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0x106e8, lpOverlapped=0x0) returned 1 [0063.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.481] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.481] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.483] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.483] CloseHandle (hObject=0x100) returned 1 [0063.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0063.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0063.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.485] GetLastError () returned 0x0 [0063.486] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.487] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.487] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18348910612) returned 1 [0063.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4a6e670, dwHighDateTime=0x1d585b4)) [0063.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3523a0 [0063.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3523a0 | out: hHeap=0x260000) returned 1 [0063.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0063.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be0a8 [0063.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0063.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.489] GetLastError () returned 0x0 [0063.489] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.489] GetLastError () returned 0x0 [0063.493] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.493] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x39f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x39f, lpOverlapped=0x0) returned 1 [0063.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.494] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.494] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.495] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.495] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.495] CloseHandle (hObject=0x100) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.497] GetLastError () returned 0x0 [0063.498] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.499] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.499] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.499] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18350010673) returned 1 [0063.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4a947d0, dwHighDateTime=0x1d585b4)) [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3523d8 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3523d8 | out: hHeap=0x260000) returned 1 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319d98 [0063.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be0a8 [0063.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319d98 | out: hHeap=0x260000) returned 1 [0063.500] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.500] GetLastError () returned 0x0 [0063.500] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.500] GetLastError () returned 0x0 [0063.502] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.502] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0063.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.502] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.502] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.503] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.503] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.503] CloseHandle (hObject=0x100) returned 1 [0063.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.505] GetLastError () returned 0x0 [0063.505] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.506] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.506] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.506] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18350697014) returned 1 [0063.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4a947d0, dwHighDateTime=0x1d585b4)) [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352410 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352410 | out: hHeap=0x260000) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0063.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be0a8 [0063.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0063.507] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.507] GetLastError () returned 0x0 [0063.507] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.507] GetLastError () returned 0x0 [0063.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.509] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x39e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x39e, lpOverlapped=0x0) returned 1 [0063.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.509] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.509] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.510] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.510] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.510] CloseHandle (hObject=0x100) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.512] GetLastError () returned 0x0 [0063.671] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.681] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.681] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.681] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18368411744) returned 1 [0063.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4c839b0, dwHighDateTime=0x1d585b4)) [0063.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0063.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352720 [0063.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352720 | out: hHeap=0x260000) returned 1 [0063.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.745] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.745] GetLastError () returned 0x0 [0063.745] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.745] GetLastError () returned 0x0 [0063.749] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.749] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x3c4, lpOverlapped=0x0) returned 1 [0063.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0063.750] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.750] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.751] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.751] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.752] CloseHandle (hObject=0x120) returned 1 [0063.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0063.753] GetLastError () returned 0x0 [0063.753] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.754] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.755] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18375564604) returned 1 [0063.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4cf5dd0, dwHighDateTime=0x1d585b4)) [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352758 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352758 | out: hHeap=0x260000) returned 1 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0063.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0063.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.755] GetLastError () returned 0x0 [0063.755] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.756] GetLastError () returned 0x0 [0063.764] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.764] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0063.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0063.765] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.765] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.765] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.766] CloseHandle (hObject=0x120) returned 1 [0063.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0063.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0063.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0063.806] GetLastError () returned 0x0 [0063.816] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.842] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.842] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.842] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18384332154) returned 1 [0063.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4dda610, dwHighDateTime=0x1d585b4)) [0063.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352918 [0063.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352918 | out: hHeap=0x260000) returned 1 [0063.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a0e0 [0063.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a0e0 | out: hHeap=0x260000) returned 1 [0063.843] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.843] GetLastError () returned 0x0 [0063.843] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.843] GetLastError () returned 0x0 [0063.845] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.845] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0063.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.846] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.846] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.847] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.847] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.848] CloseHandle (hObject=0x100) returned 1 [0063.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.849] GetLastError () returned 0x0 [0063.849] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.850] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.850] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.850] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18385159986) returned 1 [0063.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4dda610, dwHighDateTime=0x1d585b4)) [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352988 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352988 | out: hHeap=0x260000) returned 1 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.851] GetLastError () returned 0x0 [0063.851] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.852] GetLastError () returned 0x0 [0063.853] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.853] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x3c3, lpOverlapped=0x0) returned 1 [0063.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.854] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.854] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.854] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.855] CloseHandle (hObject=0x100) returned 1 [0063.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.856] GetLastError () returned 0x0 [0063.857] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.858] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.858] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18385928387) returned 1 [0063.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4e00770, dwHighDateTime=0x1d585b4)) [0063.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3529c0 [0063.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3529c0 | out: hHeap=0x260000) returned 1 [0063.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.859] GetLastError () returned 0x0 [0063.859] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.859] GetLastError () returned 0x0 [0063.908] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.909] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x3c2, lpOverlapped=0x0) returned 1 [0063.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.909] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.909] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.910] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.910] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.910] CloseHandle (hObject=0x100) returned 1 [0063.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.987] GetLastError () returned 0x0 [0063.987] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.988] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0063.988] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.988] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18398919995) returned 1 [0063.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4f31270, dwHighDateTime=0x1d585b4)) [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352cd0 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352cd0 | out: hHeap=0x260000) returned 1 [0063.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.989] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.989] GetLastError () returned 0x0 [0063.989] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.989] GetLastError () returned 0x0 [0063.992] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff585b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.992] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xa7a5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0xa7a5, lpOverlapped=0x0) returned 1 [0063.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.993] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.993] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.993] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.993] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.994] CloseHandle (hObject=0xfc) returned 1 [0063.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.[deadmin@cock.li].deadmin")) returned 1 [0063.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.995] GetLastError () returned 0x0 [0063.996] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0063.996] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0063.996] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0063.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.997] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18399764684) returned 1 [0063.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4f573d0, dwHighDateTime=0x1d585b4)) [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352d08 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352d08 | out: hHeap=0x260000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.997] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0063.997] GetLastError () returned 0x0 [0063.997] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0063.998] GetLastError () returned 0x0 [0063.999] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff7fce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.999] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x8032, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0x8032, lpOverlapped=0x0) returned 1 [0064.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.000] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.000] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.000] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.000] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.001] CloseHandle (hObject=0xfc) returned 1 [0064.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0064.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0064.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.002] GetLastError () returned 0x0 [0064.003] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0064.003] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.003] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.004] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18400468501) returned 1 [0064.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4f573d0, dwHighDateTime=0x1d585b4)) [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352d40 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352d40 | out: hHeap=0x260000) returned 1 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.004] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.004] GetLastError () returned 0x0 [0064.004] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.005] GetLastError () returned 0x0 [0064.011] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.011] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.013] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.013] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.015] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.015] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.015] CloseHandle (hObject=0xfc) returned 1 [0064.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0064.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0064.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.017] GetLastError () returned 0x0 [0064.017] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0064.018] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.018] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.018] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18401917225) returned 1 [0064.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb4f7d530, dwHighDateTime=0x1d585b4)) [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352d78 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352d78 | out: hHeap=0x260000) returned 1 [0064.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.019] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.019] GetLastError () returned 0x0 [0064.019] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.019] GetLastError () returned 0x0 [0064.133] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffa86f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.133] WriteFile (in: hFile=0xfc, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x5791, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x238fdb0*=0x5791, lpOverlapped=0x0) returned 1 [0064.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.136] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.136] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.137] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.137] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.137] CloseHandle (hObject=0xfc) returned 1 [0064.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.138] GetLastError () returned 0x0 [0064.139] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.139] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.139] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.140] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18414160201) returned 1 [0064.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb50ae030, dwHighDateTime=0x1d585b4)) [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353088 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353088 | out: hHeap=0x260000) returned 1 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.141] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.141] GetLastError () returned 0x0 [0064.141] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.142] GetLastError () returned 0x0 [0064.146] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.146] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.147] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.147] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.149] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.150] CloseHandle (hObject=0xfc) returned 1 [0064.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.151] GetLastError () returned 0x0 [0064.151] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.152] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.152] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.152] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18415345564) returned 1 [0064.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb50d4190, dwHighDateTime=0x1d585b4)) [0064.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3530c0 [0064.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3530c0 | out: hHeap=0x260000) returned 1 [0064.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.153] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.153] GetLastError () returned 0x0 [0064.153] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.153] GetLastError () returned 0x0 [0064.155] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff7fa7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.155] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8059, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x8059, lpOverlapped=0x0) returned 1 [0064.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.156] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.156] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.157] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.157] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.157] CloseHandle (hObject=0xfc) returned 1 [0064.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.159] GetLastError () returned 0x0 [0064.159] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.160] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.160] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.160] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18416100470) returned 1 [0064.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb50d4190, dwHighDateTime=0x1d585b4)) [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3530f8 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3530f8 | out: hHeap=0x260000) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.161] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.161] GetLastError () returned 0x0 [0064.161] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.161] GetLastError () returned 0x0 [0064.163] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff5747, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.163] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xa8b9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xa8b9, lpOverlapped=0x0) returned 1 [0064.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.163] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.163] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.164] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.164] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.164] CloseHandle (hObject=0xfc) returned 1 [0064.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.166] GetLastError () returned 0x0 [0064.166] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.167] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.167] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.167] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18416859953) returned 1 [0064.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb50fa2f0, dwHighDateTime=0x1d585b4)) [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x353130 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x353130 | out: hHeap=0x260000) returned 1 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0064.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0064.168] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.168] GetLastError () returned 0x0 [0064.168] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.168] GetLastError () returned 0x0 [0064.259] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff6013, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.260] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x9fed, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x9fed, lpOverlapped=0x0) returned 1 [0064.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.260] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.260] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.261] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.261] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.261] CloseHandle (hObject=0xfc) returned 1 [0064.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.344] GetLastError () returned 0x0 [0064.376] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.376] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.377] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18437776751) returned 1 [0064.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb52e94d0, dwHighDateTime=0x1d585b4)) [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x289a0e8 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x289a0e8 | out: hHeap=0x260000) returned 1 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.378] GetLastError () returned 0x0 [0064.378] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.378] GetLastError () returned 0x0 [0064.381] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1f1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.381] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe0f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xe0f, lpOverlapped=0x0) returned 1 [0064.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.382] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.383] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.383] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.383] CloseHandle (hObject=0x100) returned 1 [0064.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.385] GetLastError () returned 0x0 [0064.385] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.386] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0064.386] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.386] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18438725753) returned 1 [0064.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb530f630, dwHighDateTime=0x1d585b4)) [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8978 [0064.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0064.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8978 | out: hHeap=0x260000) returned 1 [0064.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0064.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.387] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.387] GetLastError () returned 0x0 [0064.387] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.387] GetLastError () returned 0x0 [0064.389] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff23a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.389] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xdc6, lpOverlapped=0x0) returned 1 [0064.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.389] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.389] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.390] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.390] CloseHandle (hObject=0x100) returned 1 [0064.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.393] GetLastError () returned 0x0 [0064.393] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0064.394] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.394] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.394] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18439540074) returned 1 [0064.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb530f630, dwHighDateTime=0x1d585b4)) [0064.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8940 [0064.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8940 | out: hHeap=0x260000) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.395] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.395] GetLastError () returned 0x0 [0064.395] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.395] GetLastError () returned 0x0 [0064.397] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff104, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.397] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xefc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xefc, lpOverlapped=0x0) returned 1 [0064.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.398] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.398] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.399] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.399] CloseHandle (hObject=0x100) returned 1 [0064.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.401] GetLastError () returned 0x0 [0064.401] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0064.402] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.402] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.402] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18440327143) returned 1 [0064.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5335790, dwHighDateTime=0x1d585b4)) [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8908 [0064.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8908 | out: hHeap=0x260000) returned 1 [0064.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.403] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.403] GetLastError () returned 0x0 [0064.403] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.403] GetLastError () returned 0x0 [0064.405] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.405] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe48, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xe48, lpOverlapped=0x0) returned 1 [0064.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.405] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.406] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.406] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.407] CloseHandle (hObject=0x100) returned 1 [0064.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.408] GetLastError () returned 0x0 [0064.408] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0064.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.409] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.409] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18441038364) returned 1 [0064.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5335790, dwHighDateTime=0x1d585b4)) [0064.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d88d0 [0064.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d88d0 | out: hHeap=0x260000) returned 1 [0064.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27cdda0 [0064.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cdda0 | out: hHeap=0x260000) returned 1 [0064.410] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.410] GetLastError () returned 0x0 [0064.410] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.410] GetLastError () returned 0x0 [0064.502] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff10b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.502] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xef5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xef5, lpOverlapped=0x0) returned 1 [0064.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.503] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.503] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.503] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.504] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.504] CloseHandle (hObject=0x100) returned 1 [0064.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.505] GetLastError () returned 0x0 [0064.506] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.507] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.507] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18450795215) returned 1 [0064.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5440130, dwHighDateTime=0x1d585b4)) [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8630 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8630 | out: hHeap=0x260000) returned 1 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0064.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.507] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.508] GetLastError () returned 0x0 [0064.508] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.508] GetLastError () returned 0x0 [0064.510] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.510] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe15, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xe15, lpOverlapped=0x0) returned 1 [0064.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.510] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.511] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.511] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.512] CloseHandle (hObject=0x100) returned 1 [0064.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.516] GetLastError () returned 0x0 [0064.517] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.517] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.517] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.518] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18451867299) returned 1 [0064.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5440130, dwHighDateTime=0x1d585b4)) [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d85f8 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d85f8 | out: hHeap=0x260000) returned 1 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.518] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.518] GetLastError () returned 0x0 [0064.519] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.519] GetLastError () returned 0x0 [0064.520] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.520] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xe01, lpOverlapped=0x0) returned 1 [0064.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.523] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.523] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.523] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.523] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.524] CloseHandle (hObject=0x100) returned 1 [0064.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0064.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0064.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.525] GetLastError () returned 0x0 [0064.526] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.526] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.526] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.527] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18452765205) returned 1 [0064.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5466290, dwHighDateTime=0x1d585b4)) [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d85c0 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d85c0 | out: hHeap=0x260000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.527] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.527] GetLastError () returned 0x0 [0064.528] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.528] GetLastError () returned 0x0 [0064.532] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.532] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xe20, lpOverlapped=0x0) returned 1 [0064.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.532] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.532] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.533] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.533] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.533] CloseHandle (hObject=0x100) returned 1 [0064.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0064.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0064.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.535] GetLastError () returned 0x0 [0064.535] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.536] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.536] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.536] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18453712779) returned 1 [0064.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5466290, dwHighDateTime=0x1d585b4)) [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8588 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8588 | out: hHeap=0x260000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.537] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.537] GetLastError () returned 0x0 [0064.537] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.537] GetLastError () returned 0x0 [0064.631] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.632] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xe1d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0xe1d, lpOverlapped=0x0) returned 1 [0064.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.633] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.633] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.634] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.634] CloseHandle (hObject=0x100) returned 1 [0064.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.641] GetLastError () returned 0x0 [0064.642] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.650] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.650] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.650] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18465121682) returned 1 [0064.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5596d90, dwHighDateTime=0x1d585b4)) [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1408 [0064.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1408 | out: hHeap=0x260000) returned 1 [0064.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aea8 [0064.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aea8 | out: hHeap=0x260000) returned 1 [0064.661] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.661] GetLastError () returned 0x0 [0064.661] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.661] GetLastError () returned 0x0 [0064.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff101, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.664] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xeff, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xeff, lpOverlapped=0x0) returned 1 [0064.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.665] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.665] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.666] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.666] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.667] CloseHandle (hObject=0x100) returned 1 [0064.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.668] GetLastError () returned 0x0 [0064.668] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.669] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.669] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18467049214) returned 1 [0064.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb55bcef0, dwHighDateTime=0x1d585b4)) [0064.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1360 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1360 | out: hHeap=0x260000) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0064.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0064.670] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.670] GetLastError () returned 0x0 [0064.670] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.670] GetLastError () returned 0x0 [0064.672] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff1ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.672] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xe14, lpOverlapped=0x0) returned 1 [0064.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.673] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.673] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.674] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.674] CloseHandle (hObject=0x100) returned 1 [0064.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.676] GetLastError () returned 0x0 [0064.676] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.677] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.677] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18467798056) returned 1 [0064.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb55bcef0, dwHighDateTime=0x1d585b4)) [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1328 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1328 | out: hHeap=0x260000) returned 1 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.678] GetLastError () returned 0x0 [0064.678] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.678] GetLastError () returned 0x0 [0064.680] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff207, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.680] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xdf9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xdf9, lpOverlapped=0x0) returned 1 [0064.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.680] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.680] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.681] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.682] CloseHandle (hObject=0x100) returned 1 [0064.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.683] GetLastError () returned 0x0 [0064.683] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.683] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.683] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0064.683] WriteFile (in: hFile=0x100, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0064.685] CloseHandle (hObject=0x100) returned 1 [0064.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0064.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.685] RtlWakeConditionVariable () returned 0x27e828 [0064.685] GetCurrentThreadId () returned 0x99c [0064.685] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2897900) returned 1 [0064.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0064.686] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0064.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.686] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18468720720) returned 1 [0064.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb55e3050, dwHighDateTime=0x1d585b4)) [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1280 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1280 | out: hHeap=0x260000) returned 1 [0064.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323f20 [0064.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.687] GetLastError () returned 0x0 [0064.687] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.687] GetLastError () returned 0x0 [0064.783] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.783] WriteFile (in: hFile=0x100, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.787] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.787] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.788] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.788] CloseHandle (hObject=0x100) returned 1 [0064.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.[deadmin@cock.li].deadmin")) returned 1 [0064.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.790] GetLastError () returned 0x0 [0064.790] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0064.801] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0064.801] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0064.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.801] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18480251654) returned 1 [0064.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb56ed9f0, dwHighDateTime=0x1d585b4)) [0064.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8060 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779160 [0064.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779160 | out: hHeap=0x260000) returned 1 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323cc0 [0064.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.802] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0064.802] GetLastError () returned 0x0 [0064.802] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0064.803] GetLastError () returned 0x0 [0064.816] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffa7a6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.816] WriteFile (in: hFile=0x100, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x585a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x585a, lpOverlapped=0x0) returned 1 [0064.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.817] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.817] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.817] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.817] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.818] CloseHandle (hObject=0x100) returned 1 [0064.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.[deadmin@cock.li].deadmin")) returned 1 [0064.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.828] GetLastError () returned 0x0 [0065.139] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.140] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.140] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.140] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18514112526) returned 1 [0065.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5a33830, dwHighDateTime=0x1d585b4)) [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x289e560 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x289e560 | out: hHeap=0x260000) returned 1 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323340 [0065.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.141] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.141] GetLastError () returned 0x0 [0065.141] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.141] GetLastError () returned 0x0 [0065.303] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff7780, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.303] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x8880, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x8880, lpOverlapped=0x0) returned 1 [0065.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.303] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.304] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.304] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.304] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.304] CloseHandle (hObject=0x120) returned 1 [0065.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.306] GetLastError () returned 0x0 [0065.306] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.307] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.307] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.308] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18530864127) returned 1 [0065.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5bd6750, dwHighDateTime=0x1d585b4)) [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9360 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9360 | out: hHeap=0x260000) returned 1 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323800 [0065.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.308] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.308] GetLastError () returned 0x0 [0065.308] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.309] GetLastError () returned 0x0 [0065.316] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff036, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.316] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xfca, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xfca, lpOverlapped=0x0) returned 1 [0065.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.316] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.316] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.317] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.318] CloseHandle (hObject=0x120) returned 1 [0065.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.320] GetLastError () returned 0x0 [0065.320] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.321] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.321] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.321] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18532257979) returned 1 [0065.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5bfc8b0, dwHighDateTime=0x1d585b4)) [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e93d0 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e93d0 | out: hHeap=0x260000) returned 1 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d4698 [0065.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0065.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d4698 | out: hHeap=0x260000) returned 1 [0065.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3540a8 [0065.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0065.322] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.322] GetLastError () returned 0x0 [0065.322] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.322] GetLastError () returned 0x0 [0065.333] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffedea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.333] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x1216, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x1216, lpOverlapped=0x0) returned 1 [0065.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.334] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.334] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.335] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.335] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.335] CloseHandle (hObject=0x120) returned 1 [0065.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.336] GetLastError () returned 0x0 [0065.337] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.337] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.338] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18533876266) returned 1 [0065.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5c22a10, dwHighDateTime=0x1d585b4)) [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9440 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9440 | out: hHeap=0x260000) returned 1 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354308 [0065.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.338] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.339] GetLastError () returned 0x0 [0065.339] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.339] GetLastError () returned 0x0 [0065.348] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffdae8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.348] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x2518, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x2518, lpOverlapped=0x0) returned 1 [0065.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.348] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.348] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.349] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.349] CloseHandle (hObject=0x120) returned 1 [0065.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.351] GetLastError () returned 0x0 [0065.351] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.352] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.352] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.352] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18535307784) returned 1 [0065.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5c48b70, dwHighDateTime=0x1d585b4)) [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e94b0 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e94b0 | out: hHeap=0x260000) returned 1 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354438 [0065.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.353] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.353] GetLastError () returned 0x0 [0065.353] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.353] GetLastError () returned 0x0 [0065.360] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff0a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.360] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xf5e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xf5e, lpOverlapped=0x0) returned 1 [0065.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.361] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.361] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.361] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.361] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.362] CloseHandle (hObject=0x120) returned 1 [0065.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.363] GetLastError () returned 0x0 [0065.363] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.364] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.364] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.365] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18536576282) returned 1 [0065.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5c6ecd0, dwHighDateTime=0x1d585b4)) [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9520 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9520 | out: hHeap=0x260000) returned 1 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354568 [0065.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.365] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.365] GetLastError () returned 0x0 [0065.366] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.366] GetLastError () returned 0x0 [0065.367] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff700, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.367] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x900, lpOverlapped=0x0) returned 1 [0065.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.368] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.368] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.368] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.368] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.369] CloseHandle (hObject=0x120) returned 1 [0065.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.370] GetLastError () returned 0x0 [0065.370] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.371] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.371] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18537244981) returned 1 [0065.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5c6ecd0, dwHighDateTime=0x1d585b4)) [0065.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9558 [0065.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9558 | out: hHeap=0x260000) returned 1 [0065.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354698 [0065.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.372] GetLastError () returned 0x0 [0065.372] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.372] GetLastError () returned 0x0 [0065.378] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff510, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.378] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xaf0, lpOverlapped=0x0) returned 1 [0065.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.379] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.379] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.380] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.380] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.380] CloseHandle (hObject=0x120) returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.382] GetLastError () returned 0x0 [0065.382] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.383] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.383] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.383] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18538462626) returned 1 [0065.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5c94e30, dwHighDateTime=0x1d585b4)) [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8cf8 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8cf8 | out: hHeap=0x260000) returned 1 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354730 [0065.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.384] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.384] GetLastError () returned 0x0 [0065.384] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.385] GetLastError () returned 0x0 [0065.437] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffdc68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.437] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x2398, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x2398, lpOverlapped=0x0) returned 1 [0065.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.438] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.438] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.438] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.438] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.439] CloseHandle (hObject=0x120) returned 1 [0065.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.468] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.469] GetLastError () returned 0x0 [0065.469] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.480] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.480] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.480] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18548130560) returned 1 [0065.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5d79670, dwHighDateTime=0x1d585b4)) [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9600 [0065.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9600 | out: hHeap=0x260000) returned 1 [0065.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354b58 [0065.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.481] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.481] GetLastError () returned 0x0 [0065.481] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.481] GetLastError () returned 0x0 [0065.546] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffdbdc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.546] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2424, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x2424, lpOverlapped=0x0) returned 1 [0065.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.560] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.560] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.561] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.561] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.561] CloseHandle (hObject=0x120) returned 1 [0065.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.563] GetLastError () returned 0x0 [0065.563] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.564] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.564] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18556510389) returned 1 [0065.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5e37d50, dwHighDateTime=0x1d585b4)) [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e97c0 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e97c0 | out: hHeap=0x260000) returned 1 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354c88 [0065.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.565] GetLastError () returned 0x0 [0065.565] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.565] GetLastError () returned 0x0 [0065.575] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffc7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.575] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3838, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x3838, lpOverlapped=0x0) returned 1 [0065.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.575] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.575] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.576] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.576] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.576] CloseHandle (hObject=0x120) returned 1 [0065.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.578] GetLastError () returned 0x0 [0065.578] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2898428) returned 1 [0065.579] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0065.579] CryptReleaseContext (hProv=0x2898428, dwFlags=0x0) returned 1 [0065.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.579] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18558007232) returned 1 [0065.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5e5deb0, dwHighDateTime=0x1d585b4)) [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9830 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9830 | out: hHeap=0x260000) returned 1 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355148 [0065.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.580] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.580] GetLastError () returned 0x0 [0065.580] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.580] GetLastError () returned 0x0 [0065.588] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff9ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.588] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x632, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x632, lpOverlapped=0x0) returned 1 [0065.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.588] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.588] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.589] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.589] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.590] CloseHandle (hObject=0x120) returned 1 [0065.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.591] GetLastError () returned 0x0 [0065.591] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2898428) returned 1 [0065.592] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0065.592] CryptReleaseContext (hProv=0x2898428, dwFlags=0x0) returned 1 [0065.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0065.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.592] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18559341219) returned 1 [0065.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5e84010, dwHighDateTime=0x1d585b4)) [0065.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e98a0 [0065.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e98a0 | out: hHeap=0x260000) returned 1 [0065.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355278 [0065.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.593] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.593] GetLastError () returned 0x0 [0065.593] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.593] GetLastError () returned 0x0 [0065.596] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff83a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.596] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7c6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x238fdb0*=0x7c6, lpOverlapped=0x0) returned 1 [0065.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0065.597] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.597] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.598] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.598] CloseHandle (hObject=0x120) returned 1 [0065.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.599] GetLastError () returned 0x0 [0065.600] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.601] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.601] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.601] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18560225587) returned 1 [0065.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb5eaa170, dwHighDateTime=0x1d585b4)) [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e98d8 [0065.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e98d8 | out: hHeap=0x260000) returned 1 [0065.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3553a8 [0065.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.602] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.691] GetLastError () returned 0x0 [0065.691] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.691] GetLastError () returned 0x0 [0065.744] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff0a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.744] WriteFile (in: hFile=0x120, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xf5c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0xf5c, lpOverlapped=0x0) returned 1 [0065.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.745] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.745] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.745] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.745] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.746] CloseHandle (hObject=0x120) returned 1 [0065.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.747] GetLastError () returned 0x0 [0065.766] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.767] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.767] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18576808367) returned 1 [0065.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6026f30, dwHighDateTime=0x1d585b4)) [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9c20 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9c20 | out: hHeap=0x260000) returned 1 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355440 [0065.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.768] GetLastError () returned 0x0 [0065.768] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.768] GetLastError () returned 0x0 [0065.785] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffee4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.785] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x11b6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x11b6, lpOverlapped=0x0) returned 1 [0065.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0065.785] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.786] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.786] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.787] CloseHandle (hObject=0x120) returned 1 [0065.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.789] GetLastError () returned 0x0 [0065.789] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.790] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.790] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18579147492) returned 1 [0065.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb60731f0, dwHighDateTime=0x1d585b4)) [0065.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9cc8 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9cc8 | out: hHeap=0x260000) returned 1 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355868 [0065.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.791] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.791] GetLastError () returned 0x0 [0065.791] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.791] GetLastError () returned 0x0 [0065.800] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffb23a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.800] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4dc6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x4dc6, lpOverlapped=0x0) returned 1 [0065.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.800] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.800] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.802] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.802] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.803] CloseHandle (hObject=0x120) returned 1 [0065.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.803] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.[deadmin@cock.li].deadmin")) returned 1 [0065.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.804] GetLastError () returned 0x0 [0065.804] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.805] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.805] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.805] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18580657986) returned 1 [0065.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6099350, dwHighDateTime=0x1d585b4)) [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337ba0 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337ba0 | out: hHeap=0x260000) returned 1 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333db8 [0065.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.806] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.806] GetLastError () returned 0x0 [0065.806] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.806] GetLastError () returned 0x0 [0065.811] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff878a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.811] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7876, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x7876, lpOverlapped=0x0) returned 1 [0065.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.812] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.812] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.812] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.812] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.813] CloseHandle (hObject=0x120) returned 1 [0065.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6928 [0065.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6928 | out: hHeap=0x260000) returned 1 [0065.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.814] GetLastError () returned 0x0 [0065.814] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.815] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.815] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.815] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18581658809) returned 1 [0065.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6099350, dwHighDateTime=0x1d585b4)) [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9d38 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9d38 | out: hHeap=0x260000) returned 1 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324cb8 [0065.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.816] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.816] GetLastError () returned 0x0 [0065.817] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.817] GetLastError () returned 0x0 [0065.869] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffcf1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.869] WriteFile (in: hFile=0x120, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x30e4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x30e4, lpOverlapped=0x0) returned 1 [0065.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.872] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.872] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.872] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.873] CloseHandle (hObject=0x120) returned 1 [0065.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.878] GetLastError () returned 0x0 [0065.878] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.879] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.885] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18588660541) returned 1 [0065.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6157a30, dwHighDateTime=0x1d585b4)) [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9e88 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9e88 | out: hHeap=0x260000) returned 1 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355bf8 [0065.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.886] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.886] GetLastError () returned 0x0 [0065.886] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.887] GetLastError () returned 0x0 [0065.889] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff630, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.889] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x9d0, lpOverlapped=0x0) returned 1 [0065.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.890] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.890] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.890] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.891] CloseHandle (hObject=0xa4) returned 1 [0065.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.892] GetLastError () returned 0x0 [0065.893] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.893] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.893] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.894] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18589480106) returned 1 [0065.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6157a30, dwHighDateTime=0x1d585b4)) [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9ec0 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9ec0 | out: hHeap=0x260000) returned 1 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355dc0 [0065.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.895] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.895] GetLastError () returned 0x0 [0065.895] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.895] GetLastError () returned 0x0 [0065.897] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff4de2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.897] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb21e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xb21e, lpOverlapped=0x0) returned 1 [0065.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.898] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.898] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.898] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.899] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.899] CloseHandle (hObject=0xa4) returned 1 [0065.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.899] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.900] GetLastError () returned 0x0 [0065.901] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0065.903] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.903] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.903] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18590423445) returned 1 [0065.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb617db90, dwHighDateTime=0x1d585b4)) [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9ef8 [0065.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9ef8 | out: hHeap=0x260000) returned 1 [0065.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355e58 [0065.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.904] GetLastError () returned 0x0 [0065.904] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.904] GetLastError () returned 0x0 [0065.915] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff8916, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.915] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x76ea, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x76ea, lpOverlapped=0x0) returned 1 [0065.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.919] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.919] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.920] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.923] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.924] CloseHandle (hObject=0xa4) returned 1 [0065.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.925] GetLastError () returned 0x0 [0065.926] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2898428) returned 1 [0065.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0065.927] CryptReleaseContext (hProv=0x2898428, dwFlags=0x0) returned 1 [0065.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0065.927] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18592793188) returned 1 [0065.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb61c9e50, dwHighDateTime=0x1d585b4)) [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9f68 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9f68 | out: hHeap=0x260000) returned 1 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355ef0 [0065.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.928] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0065.928] GetLastError () returned 0x0 [0065.928] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0065.928] GetLastError () returned 0x0 [0065.993] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffdf32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.994] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x20ce, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x20ce, lpOverlapped=0x0) returned 1 [0065.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.994] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.994] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.995] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.995] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.995] CloseHandle (hObject=0xa4) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0065.997] GetLastError () returned 0x0 [0066.081] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.082] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.082] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.082] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18608356306) returned 1 [0066.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6346c10, dwHighDateTime=0x1d585b4)) [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea240 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea240 | out: hHeap=0x260000) returned 1 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356740 [0066.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.083] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.083] GetLastError () returned 0x0 [0066.083] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.083] GetLastError () returned 0x0 [0066.087] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffea16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.087] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x15ea, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x15ea, lpOverlapped=0x0) returned 1 [0066.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.088] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.088] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.089] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.089] CloseHandle (hObject=0xa4) returned 1 [0066.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.093] GetLastError () returned 0x0 [0066.093] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.094] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.094] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.094] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18609528313) returned 1 [0066.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6346c10, dwHighDateTime=0x1d585b4)) [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337af8 [0066.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337af8 | out: hHeap=0x260000) returned 1 [0066.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324b88 [0066.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.095] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.095] GetLastError () returned 0x0 [0066.095] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.095] GetLastError () returned 0x0 [0066.102] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffe682, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.102] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x197e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x197e, lpOverlapped=0x0) returned 1 [0066.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.103] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.103] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.103] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.103] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.104] CloseHandle (hObject=0xa4) returned 1 [0066.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.125] GetLastError () returned 0x0 [0066.125] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.126] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.126] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18612754897) returned 1 [0066.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6392ed0, dwHighDateTime=0x1d585b4)) [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea2e8 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea2e8 | out: hHeap=0x260000) returned 1 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356870 [0066.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.127] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.127] GetLastError () returned 0x0 [0066.127] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.127] GetLastError () returned 0x0 [0066.138] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffdc4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.138] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x23b6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x23b6, lpOverlapped=0x0) returned 1 [0066.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.138] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.138] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.139] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.139] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.140] CloseHandle (hObject=0xa4) returned 1 [0066.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.141] GetLastError () returned 0x0 [0066.178] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.186] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.186] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.186] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18618723147) returned 1 [0066.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb642b450, dwHighDateTime=0x1d585b4)) [0066.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea438 [0066.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea438 | out: hHeap=0x260000) returned 1 [0066.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356dc8 [0066.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.191] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.191] GetLastError () returned 0x0 [0066.192] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.192] GetLastError () returned 0x0 [0066.207] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffecf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.207] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x1310, lpOverlapped=0x0) returned 1 [0066.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.208] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.208] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.208] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.209] CloseHandle (hObject=0xa4) returned 1 [0066.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.210] GetLastError () returned 0x0 [0066.211] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.211] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.211] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.212] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18621277104) returned 1 [0066.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6477710, dwHighDateTime=0x1d585b4)) [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea550 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea550 | out: hHeap=0x260000) returned 1 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356ad0 [0066.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.212] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.213] GetLastError () returned 0x0 [0066.213] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.213] GetLastError () returned 0x0 [0066.249] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffa5d5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.249] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x5a2b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x5a2b, lpOverlapped=0x0) returned 1 [0066.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.250] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.250] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.250] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.251] CloseHandle (hObject=0xa4) returned 1 [0066.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.[deadmin@cock.li].deadmin")) returned 1 [0066.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.252] GetLastError () returned 0x0 [0066.253] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.254] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.254] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18625493477) returned 1 [0066.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb64e9b30, dwHighDateTime=0x1d585b4)) [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea668 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea668 | out: hHeap=0x260000) returned 1 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0066.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f800 [0066.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0066.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.255] GetLastError () returned 0x0 [0066.255] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.255] GetLastError () returned 0x0 [0066.325] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff9f1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.325] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x60e4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x60e4, lpOverlapped=0x0) returned 1 [0066.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.325] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.326] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.327] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.327] CloseHandle (hObject=0xa4) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.327] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.[deadmin@cock.li].deadmin")) returned 1 [0066.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.328] GetLastError () returned 0x0 [0066.344] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28985c0) returned 1 [0066.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.345] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.345] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18634637972) returned 1 [0066.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb65a8210, dwHighDateTime=0x1d585b4)) [0066.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326dc8 [0066.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326dc8 | out: hHeap=0x260000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b148 [0066.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0066.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b148 | out: hHeap=0x260000) returned 1 [0066.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.346] GetLastError () returned 0x0 [0066.346] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.346] GetLastError () returned 0x0 [0066.380] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff6da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.380] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x926, lpOverlapped=0x0) returned 1 [0066.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.381] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.381] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.382] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.382] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.382] CloseHandle (hObject=0xa4) returned 1 [0066.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.384] GetLastError () returned 0x0 [0066.384] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28985c0) returned 1 [0066.385] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.385] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.385] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18638647879) returned 1 [0066.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb661a630, dwHighDateTime=0x1d585b4)) [0066.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326cb0 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326cb0 | out: hHeap=0x260000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b1f0 [0066.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b1f0 | out: hHeap=0x260000) returned 1 [0066.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.386] GetLastError () returned 0x0 [0066.386] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.386] GetLastError () returned 0x0 [0066.408] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.408] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x980, lpOverlapped=0x0) returned 1 [0066.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.409] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.409] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.410] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.410] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.410] CloseHandle (hObject=0xa4) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.430] GetLastError () returned 0x0 [0066.430] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28985c0) returned 1 [0066.431] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.431] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.431] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18643217718) returned 1 [0066.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb668ca50, dwHighDateTime=0x1d585b4)) [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326b60 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326b60 | out: hHeap=0x260000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b5e0 [0066.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b5e0 | out: hHeap=0x260000) returned 1 [0066.432] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.432] GetLastError () returned 0x0 [0066.432] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.432] GetLastError () returned 0x0 [0066.433] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffa5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.434] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x5a4, lpOverlapped=0x0) returned 1 [0066.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.434] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.434] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.435] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.435] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.435] CloseHandle (hObject=0xa4) returned 1 [0066.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.437] GetLastError () returned 0x0 [0066.438] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28985c0) returned 1 [0066.438] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.438] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.439] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18643979698) returned 1 [0066.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb668ca50, dwHighDateTime=0x1d585b4)) [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326b28 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326b28 | out: hHeap=0x260000) returned 1 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d3558 [0066.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d3558 | out: hHeap=0x260000) returned 1 [0066.439] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.440] GetLastError () returned 0x0 [0066.440] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.440] GetLastError () returned 0x0 [0066.472] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffa4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.472] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x5b4, lpOverlapped=0x0) returned 1 [0066.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.473] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.473] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.473] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.473] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.474] CloseHandle (hObject=0xa4) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x284a0a8 [0066.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284a0a8 | out: hHeap=0x260000) returned 1 [0066.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.475] GetLastError () returned 0x0 [0066.487] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28985c0) returned 1 [0066.541] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.541] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.541] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18654255632) returned 1 [0066.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb67973f0, dwHighDateTime=0x1d585b4)) [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea9e8 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea9e8 | out: hHeap=0x260000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335300 [0066.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335300 | out: hHeap=0x260000) returned 1 [0066.542] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.542] GetLastError () returned 0x0 [0066.542] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.542] GetLastError () returned 0x0 [0066.545] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.545] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x6ec, lpOverlapped=0x0) returned 1 [0066.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.546] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.546] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.547] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.547] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.547] CloseHandle (hObject=0xa4) returned 1 [0066.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.549] GetLastError () returned 0x0 [0066.549] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28985c0) returned 1 [0066.550] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.550] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.550] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18655142865) returned 1 [0066.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb67bd550, dwHighDateTime=0x1d585b4)) [0066.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaa20 [0066.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaa20 | out: hHeap=0x260000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x334fb8 [0066.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x334fb8 | out: hHeap=0x260000) returned 1 [0066.551] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.551] GetLastError () returned 0x0 [0066.551] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.551] GetLastError () returned 0x0 [0066.609] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff3b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.610] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xc4c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0xc4c, lpOverlapped=0x0) returned 1 [0066.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.610] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.610] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.611] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.611] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.611] CloseHandle (hObject=0xa4) returned 1 [0066.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.613] GetLastError () returned 0x0 [0066.613] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.614] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.614] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.614] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18661515160) returned 1 [0066.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6855ad0, dwHighDateTime=0x1d585b4)) [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eab38 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eab38 | out: hHeap=0x260000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3355a0 [0066.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3355a0 | out: hHeap=0x260000) returned 1 [0066.615] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.615] GetLastError () returned 0x0 [0066.615] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.615] GetLastError () returned 0x0 [0066.642] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff95c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.642] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x6a4, lpOverlapped=0x0) returned 1 [0066.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.643] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.643] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.643] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.643] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.644] CloseHandle (hObject=0xa4) returned 1 [0066.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.645] GetLastError () returned 0x0 [0066.646] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.646] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.646] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.647] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18664766379) returned 1 [0066.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb68a1d90, dwHighDateTime=0x1d585b4)) [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327260 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327260 | out: hHeap=0x260000) returned 1 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3358e8 [0066.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3358e8 | out: hHeap=0x260000) returned 1 [0066.647] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.648] GetLastError () returned 0x0 [0066.648] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.648] GetLastError () returned 0x0 [0066.734] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffeeca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.734] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1136, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x1136, lpOverlapped=0x0) returned 1 [0066.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.735] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.735] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.735] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.735] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.736] CloseHandle (hObject=0xa4) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.752] GetLastError () returned 0x0 [0066.752] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.753] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.753] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.753] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18675434123) returned 1 [0066.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb69ac730, dwHighDateTime=0x1d585b4)) [0066.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ff8 [0066.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ff8 | out: hHeap=0x260000) returned 1 [0066.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335b88 [0066.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335b88 | out: hHeap=0x260000) returned 1 [0066.754] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.754] GetLastError () returned 0x0 [0066.754] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.754] GetLastError () returned 0x0 [0066.812] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff984, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.816] WriteFile (in: hFile=0xa4, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x67c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x67c, lpOverlapped=0x0) returned 1 [0066.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.817] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.817] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.818] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.818] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.818] CloseHandle (hObject=0xa4) returned 1 [0066.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4630 [0066.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4630 | out: hHeap=0x260000) returned 1 [0066.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.825] GetLastError () returned 0x0 [0066.825] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.826] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.826] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.826] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18682763910) returned 1 [0066.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6a44cb0, dwHighDateTime=0x1d585b4)) [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326f50 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326f50 | out: hHeap=0x260000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336368 [0066.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336368 | out: hHeap=0x260000) returned 1 [0066.827] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.827] GetLastError () returned 0x0 [0066.827] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.828] GetLastError () returned 0x0 [0066.851] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.851] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x754, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x754, lpOverlapped=0x0) returned 1 [0066.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.852] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.852] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.853] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.853] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.853] CloseHandle (hObject=0xfc) returned 1 [0066.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.853] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.855] GetLastError () returned 0x0 [0066.856] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.856] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.857] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.857] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18685784474) returned 1 [0066.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6a90f70, dwHighDateTime=0x1d585b4)) [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326ea8 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326ea8 | out: hHeap=0x260000) returned 1 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336560 [0066.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336560 | out: hHeap=0x260000) returned 1 [0066.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.858] GetLastError () returned 0x0 [0066.858] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.858] GetLastError () returned 0x0 [0066.925] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.925] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x5fc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x5fc, lpOverlapped=0x0) returned 1 [0066.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.926] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.926] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.927] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.927] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.928] CloseHandle (hObject=0xfc) returned 1 [0066.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0066.930] GetLastError () returned 0x0 [0066.931] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0066.932] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.932] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0066.932] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18693300404) returned 1 [0066.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6b4f650, dwHighDateTime=0x1d585b4)) [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eabe0 [0066.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eabe0 | out: hHeap=0x260000) returned 1 [0066.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336800 [0066.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336800 | out: hHeap=0x260000) returned 1 [0066.941] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0066.942] GetLastError () returned 0x0 [0066.942] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0066.942] GetLastError () returned 0x0 [0067.016] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff7de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.016] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x822, lpOverlapped=0x0) returned 1 [0067.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0067.032] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.032] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.032] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.033] CloseHandle (hObject=0xfc) returned 1 [0067.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.035] GetLastError () returned 0x0 [0067.035] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.036] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.036] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.036] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18703711694) returned 1 [0067.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6c59ff0, dwHighDateTime=0x1d585b4)) [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3276c0 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3276c0 | out: hHeap=0x260000) returned 1 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3369f8 [0067.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3369f8 | out: hHeap=0x260000) returned 1 [0067.037] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.037] GetLastError () returned 0x0 [0067.037] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.037] GetLastError () returned 0x0 [0067.090] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff15e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.090] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xea2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xea2, lpOverlapped=0x0) returned 1 [0067.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.090] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.090] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.091] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.091] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.092] CloseHandle (hObject=0xfc) returned 1 [0067.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.092] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.093] GetLastError () returned 0x0 [0067.093] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.094] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.094] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.095] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18709566359) returned 1 [0067.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6ccc410, dwHighDateTime=0x1d585b4)) [0067.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3275e0 [0067.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3275e0 | out: hHeap=0x260000) returned 1 [0067.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x354560 [0067.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x354560 | out: hHeap=0x260000) returned 1 [0067.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.097] GetLastError () returned 0x0 [0067.097] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.097] GetLastError () returned 0x0 [0067.120] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff75c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.120] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x8a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x8a4, lpOverlapped=0x0) returned 1 [0067.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.121] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.121] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.121] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.121] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.122] CloseHandle (hObject=0xfc) returned 1 [0067.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.123] GetLastError () returned 0x0 [0067.124] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.124] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.124] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.124] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18712562026) returned 1 [0067.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6d186d0, dwHighDateTime=0x1d585b4)) [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327538 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327538 | out: hHeap=0x260000) returned 1 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be448 [0067.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be448 | out: hHeap=0x260000) returned 1 [0067.125] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.125] GetLastError () returned 0x0 [0067.125] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.126] GetLastError () returned 0x0 [0067.153] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.153] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x756, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x756, lpOverlapped=0x0) returned 1 [0067.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.154] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.154] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.155] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.155] CloseHandle (hObject=0xfc) returned 1 [0067.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.156] GetLastError () returned 0x0 [0067.157] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.157] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.157] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.158] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18715881644) returned 1 [0067.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6d64990, dwHighDateTime=0x1d585b4)) [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327458 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327458 | out: hHeap=0x260000) returned 1 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be640 [0067.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be640 | out: hHeap=0x260000) returned 1 [0067.158] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.159] GetLastError () returned 0x0 [0067.159] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.159] GetLastError () returned 0x0 [0067.207] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff754, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.207] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x8ac, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x8ac, lpOverlapped=0x0) returned 1 [0067.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.210] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.210] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.211] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.211] CloseHandle (hObject=0xfc) returned 1 [0067.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.213] GetLastError () returned 0x0 [0067.231] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.231] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.231] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.232] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18723281455) returned 1 [0067.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6e23070, dwHighDateTime=0x1d585b4)) [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3278f0 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3278f0 | out: hHeap=0x260000) returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be988 [0067.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be988 | out: hHeap=0x260000) returned 1 [0067.232] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.233] GetLastError () returned 0x0 [0067.233] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.233] GetLastError () returned 0x0 [0067.234] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffecc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.234] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x134, lpOverlapped=0x0) returned 1 [0067.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.234] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.234] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.235] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.235] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.235] CloseHandle (hObject=0xfc) returned 1 [0067.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.237] GetLastError () returned 0x0 [0067.237] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.238] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.238] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18723933815) returned 1 [0067.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6e491d0, dwHighDateTime=0x1d585b4)) [0067.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3278b8 [0067.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3278b8 | out: hHeap=0x260000) returned 1 [0067.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bed78 [0067.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bed78 | out: hHeap=0x260000) returned 1 [0067.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.239] GetLastError () returned 0x0 [0067.239] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.239] GetLastError () returned 0x0 [0067.240] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffec9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.240] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x137, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0x137, lpOverlapped=0x0) returned 1 [0067.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.241] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.241] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.241] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.242] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.242] CloseHandle (hObject=0xfc) returned 1 [0067.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.244] GetLastError () returned 0x0 [0067.247] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.248] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.248] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0067.248] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18724938864) returned 1 [0067.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb6e491d0, dwHighDateTime=0x1d585b4)) [0067.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0067.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0067.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327880 [0067.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327880 | out: hHeap=0x260000) returned 1 [0067.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2beec8 [0067.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2beec8 | out: hHeap=0x260000) returned 1 [0067.249] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.249] GetLastError () returned 0x0 [0067.249] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.249] GetLastError () returned 0x0 [0067.250] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.250] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xb1, lpOverlapped=0x0) returned 1 [0067.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.251] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.251] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.251] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.251] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.252] CloseHandle (hObject=0xfc) returned 1 [0067.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0067.322] GetLastError () returned 0x0 [0067.625] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.626] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.626] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.626] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18762700304) returned 1 [0067.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7201430, dwHighDateTime=0x1d585b4)) [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9158 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9158 | out: hHeap=0x260000) returned 1 [0067.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0ad8 [0067.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0ad8 | out: hHeap=0x260000) returned 1 [0067.627] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.627] GetLastError () returned 0x0 [0067.627] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.627] GetLastError () returned 0x0 [0067.628] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.628] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xf0, lpOverlapped=0x0) returned 1 [0067.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.629] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.629] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.629] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.633] CloseHandle (hObject=0xa4) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.689] GetLastError () returned 0x0 [0067.690] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0067.691] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.691] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.691] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18769251097) returned 1 [0067.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb72999b0, dwHighDateTime=0x1d585b4)) [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9078 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9078 | out: hHeap=0x260000) returned 1 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0d78 [0067.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0d78 | out: hHeap=0x260000) returned 1 [0067.692] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.693] GetLastError () returned 0x0 [0067.693] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.693] GetLastError () returned 0x0 [0067.694] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.694] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x238fdb0*=0xb3, lpOverlapped=0x0) returned 1 [0067.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.695] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.695] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.696] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.696] CloseHandle (hObject=0xa4) returned 1 [0067.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.696] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.715] GetLastError () returned 0x0 [0067.716] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.717] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.717] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.717] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18771848961) returned 1 [0067.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb72bfb10, dwHighDateTime=0x1d585b4)) [0067.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9040 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9040 | out: hHeap=0x260000) returned 1 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0ec8 [0067.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0ec8 | out: hHeap=0x260000) returned 1 [0067.718] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.718] GetLastError () returned 0x0 [0067.718] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.718] GetLastError () returned 0x0 [0067.719] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.719] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xb4, lpOverlapped=0x0) returned 1 [0067.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.720] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.720] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.721] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.721] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.722] CloseHandle (hObject=0xa4) returned 1 [0067.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.724] GetLastError () returned 0x0 [0067.724] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.725] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.725] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.725] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18772606182) returned 1 [0067.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb72e5c70, dwHighDateTime=0x1d585b4)) [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9008 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9008 | out: hHeap=0x260000) returned 1 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0f70 [0067.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0f70 | out: hHeap=0x260000) returned 1 [0067.726] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.726] GetLastError () returned 0x0 [0067.726] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.726] GetLastError () returned 0x0 [0067.727] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.727] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xb2, lpOverlapped=0x0) returned 1 [0067.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.728] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.728] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.728] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.728] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.729] CloseHandle (hObject=0xa4) returned 1 [0067.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.734] GetLastError () returned 0x0 [0067.736] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.737] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.737] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.737] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18773833259) returned 1 [0067.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb730bdd0, dwHighDateTime=0x1d585b4)) [0067.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8fd0 [0067.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8fd0 | out: hHeap=0x260000) returned 1 [0067.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1018 [0067.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1018 | out: hHeap=0x260000) returned 1 [0067.738] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.738] GetLastError () returned 0x0 [0067.738] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.738] GetLastError () returned 0x0 [0067.739] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffe0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.739] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1f5, lpOverlapped=0x0) returned 1 [0067.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.740] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.740] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.741] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.741] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.741] CloseHandle (hObject=0xa4) returned 1 [0067.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.741] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.745] GetLastError () returned 0x0 [0067.746] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.747] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.747] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18774783401) returned 1 [0067.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb730bdd0, dwHighDateTime=0x1d585b4)) [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8f60 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8f60 | out: hHeap=0x260000) returned 1 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c10c0 [0067.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c10c0 | out: hHeap=0x260000) returned 1 [0067.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.748] GetLastError () returned 0x0 [0067.748] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.748] GetLastError () returned 0x0 [0067.749] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.749] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xfd, lpOverlapped=0x0) returned 1 [0067.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.749] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.749] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.750] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.751] CloseHandle (hObject=0xa4) returned 1 [0067.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.753] GetLastError () returned 0x0 [0067.753] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.754] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.754] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18775496435) returned 1 [0067.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7331f30, dwHighDateTime=0x1d585b4)) [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8f28 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8f28 | out: hHeap=0x260000) returned 1 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1168 [0067.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1168 | out: hHeap=0x260000) returned 1 [0067.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.755] GetLastError () returned 0x0 [0067.755] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.755] GetLastError () returned 0x0 [0067.756] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffe5d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.756] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1a3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1a3, lpOverlapped=0x0) returned 1 [0067.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.756] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.756] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.757] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.758] CloseHandle (hObject=0xa4) returned 1 [0067.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.758] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.759] GetLastError () returned 0x0 [0067.759] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.760] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.760] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18776140987) returned 1 [0067.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7331f30, dwHighDateTime=0x1d585b4)) [0067.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8eb8 [0067.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8eb8 | out: hHeap=0x260000) returned 1 [0067.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1210 [0067.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1210 | out: hHeap=0x260000) returned 1 [0067.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.761] GetLastError () returned 0x0 [0067.761] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.761] GetLastError () returned 0x0 [0067.762] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.762] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xc4, lpOverlapped=0x0) returned 1 [0067.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.763] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.763] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.763] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.764] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.764] CloseHandle (hObject=0xa4) returned 1 [0067.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.767] GetLastError () returned 0x0 [0067.768] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.768] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.769] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.769] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18776985135) returned 1 [0067.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7358090, dwHighDateTime=0x1d585b4)) [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8ef0 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8ef0 | out: hHeap=0x260000) returned 1 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c12b8 [0067.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c12b8 | out: hHeap=0x260000) returned 1 [0067.769] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.770] GetLastError () returned 0x0 [0067.770] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.770] GetLastError () returned 0x0 [0067.772] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffe5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.772] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1a4, lpOverlapped=0x0) returned 1 [0067.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.773] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.773] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.774] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.774] CloseHandle (hObject=0xa4) returned 1 [0067.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.776] GetLastError () returned 0x0 [0067.776] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.777] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.777] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.777] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18777852872) returned 1 [0067.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7358090, dwHighDateTime=0x1d585b4)) [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8e80 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8e80 | out: hHeap=0x260000) returned 1 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1360 [0067.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1360 | out: hHeap=0x260000) returned 1 [0067.778] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.778] GetLastError () returned 0x0 [0067.778] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.778] GetLastError () returned 0x0 [0067.779] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.779] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xc2, lpOverlapped=0x0) returned 1 [0067.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.780] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.780] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.781] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.781] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.781] CloseHandle (hObject=0xa4) returned 1 [0067.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.792] GetLastError () returned 0x0 [0067.793] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.794] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.794] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.794] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18779510584) returned 1 [0067.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb737e1f0, dwHighDateTime=0x1d585b4)) [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8e48 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8e48 | out: hHeap=0x260000) returned 1 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1408 [0067.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1408 | out: hHeap=0x260000) returned 1 [0067.795] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.795] GetLastError () returned 0x0 [0067.795] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.795] GetLastError () returned 0x0 [0067.796] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.796] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1cf, lpOverlapped=0x0) returned 1 [0067.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.797] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.797] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.797] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.798] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.798] CloseHandle (hObject=0xa4) returned 1 [0067.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.800] GetLastError () returned 0x0 [0067.800] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.801] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.801] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.801] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18780219763) returned 1 [0067.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb73a4350, dwHighDateTime=0x1d585b4)) [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8e10 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8e10 | out: hHeap=0x260000) returned 1 [0067.801] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c14b0 [0067.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c14b0 | out: hHeap=0x260000) returned 1 [0067.802] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.802] GetLastError () returned 0x0 [0067.802] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.802] GetLastError () returned 0x0 [0067.803] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffe9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.803] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x164, lpOverlapped=0x0) returned 1 [0067.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.804] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.804] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.804] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.804] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.805] CloseHandle (hObject=0xa4) returned 1 [0067.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.805] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.807] GetLastError () returned 0x0 [0067.807] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2907dd0) returned 1 [0067.808] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.808] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.808] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18780898573) returned 1 [0067.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb73a4350, dwHighDateTime=0x1d585b4)) [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8dd8 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8dd8 | out: hHeap=0x260000) returned 1 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1558 [0067.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1558 | out: hHeap=0x260000) returned 1 [0067.809] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0067.809] GetLastError () returned 0x0 [0067.809] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0067.809] GetLastError () returned 0x0 [0067.810] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.810] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xc6, lpOverlapped=0x0) returned 1 [0067.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.811] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.811] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.811] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.811] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.812] CloseHandle (hObject=0xa4) returned 1 [0067.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.375] GetLastError () returned 0x0 [0068.375] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.376] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.377] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18837773111) returned 1 [0068.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7925630, dwHighDateTime=0x1d585b4)) [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ce8 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ce8 | out: hHeap=0x260000) returned 1 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2cd0 [0068.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2cd0 | out: hHeap=0x260000) returned 1 [0068.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.377] GetLastError () returned 0x0 [0068.378] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.378] GetLastError () returned 0x0 [0068.415] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.416] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x238fdb0*=0x370, lpOverlapped=0x0) returned 1 [0068.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0068.416] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.416] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.417] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.417] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.417] CloseHandle (hObject=0xfc) returned 1 [0068.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.420] GetLastError () returned 0x0 [0068.420] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.422] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.422] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.422] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18842340434) returned 1 [0068.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7997a50, dwHighDateTime=0x1d585b4)) [0068.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329c08 [0068.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329c08 | out: hHeap=0x260000) returned 1 [0068.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2e20 [0068.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2e20 | out: hHeap=0x260000) returned 1 [0068.423] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.423] GetLastError () returned 0x0 [0068.423] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.423] GetLastError () returned 0x0 [0068.424] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.424] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xcc, lpOverlapped=0x0) returned 1 [0068.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.426] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.426] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.427] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.427] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.428] CloseHandle (hObject=0xfc) returned 1 [0068.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.429] GetLastError () returned 0x0 [0068.430] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.431] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.431] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.431] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18843211629) returned 1 [0068.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7997a50, dwHighDateTime=0x1d585b4)) [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329bd0 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329bd0 | out: hHeap=0x260000) returned 1 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c30c0 [0068.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c30c0 | out: hHeap=0x260000) returned 1 [0068.432] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.432] GetLastError () returned 0x0 [0068.432] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.432] GetLastError () returned 0x0 [0068.433] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffee3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.433] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x11d, lpOverlapped=0x0) returned 1 [0068.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.434] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.434] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.434] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.434] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.435] CloseHandle (hObject=0xfc) returned 1 [0068.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.436] GetLastError () returned 0x0 [0068.437] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.438] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.438] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.438] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18843899213) returned 1 [0068.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb79bdbb0, dwHighDateTime=0x1d585b4)) [0068.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329b98 [0068.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329b98 | out: hHeap=0x260000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3168 [0068.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3168 | out: hHeap=0x260000) returned 1 [0068.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.446] GetLastError () returned 0x0 [0068.446] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.446] GetLastError () returned 0x0 [0068.447] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.447] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x24f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x24f, lpOverlapped=0x0) returned 1 [0068.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.448] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.448] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.449] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.449] CloseHandle (hObject=0xfc) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.456] GetLastError () returned 0x0 [0068.457] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.458] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.458] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.458] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18845936293) returned 1 [0068.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb79e3d10, dwHighDateTime=0x1d585b4)) [0068.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329b60 [0068.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329b60 | out: hHeap=0x260000) returned 1 [0068.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0068.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0068.459] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.459] GetLastError () returned 0x0 [0068.459] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.459] GetLastError () returned 0x0 [0068.460] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.460] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x24f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x24f, lpOverlapped=0x0) returned 1 [0068.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.461] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.461] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.462] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.462] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.462] CloseHandle (hObject=0xfc) returned 1 [0068.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0068.462] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0068.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.464] GetLastError () returned 0x0 [0068.464] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.465] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.465] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.465] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18846632854) returned 1 [0068.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb79e3d10, dwHighDateTime=0x1d585b4)) [0068.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329b28 [0068.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329b28 | out: hHeap=0x260000) returned 1 [0068.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c32b8 [0068.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c32b8 | out: hHeap=0x260000) returned 1 [0068.466] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.466] GetLastError () returned 0x0 [0068.466] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.466] GetLastError () returned 0x0 [0068.505] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.505] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3d7, lpOverlapped=0x0) returned 1 [0068.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.506] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.506] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.506] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.507] CloseHandle (hObject=0xfc) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.567] GetLastError () returned 0x0 [0068.567] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.568] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.568] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.568] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18856889250) returned 1 [0068.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7aee6b0, dwHighDateTime=0x1d585b4)) [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c46e8 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c46e8 | out: hHeap=0x260000) returned 1 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867ca0 [0068.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3360 [0068.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867ca0 | out: hHeap=0x260000) returned 1 [0068.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3360 | out: hHeap=0x260000) returned 1 [0068.568] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.569] GetLastError () returned 0x0 [0068.569] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.569] GetLastError () returned 0x0 [0068.570] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.570] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x146, lpOverlapped=0x0) returned 1 [0068.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.570] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.571] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.571] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.571] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.572] CloseHandle (hObject=0xfc) returned 1 [0068.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.573] GetLastError () returned 0x0 [0068.592] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.593] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.593] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.593] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18859445160) returned 1 [0068.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7b3a970, dwHighDateTime=0x1d585b4)) [0068.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4790 [0068.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4790 | out: hHeap=0x260000) returned 1 [0068.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3b40 [0068.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3b40 | out: hHeap=0x260000) returned 1 [0068.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.595] GetLastError () returned 0x0 [0068.595] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.595] GetLastError () returned 0x0 [0068.596] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.596] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x6c, lpOverlapped=0x0) returned 1 [0068.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0068.597] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.597] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.598] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.598] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.599] CloseHandle (hObject=0x104) returned 1 [0068.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.766] GetLastError () returned 0x0 [0068.767] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.767] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.768] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18876878197) returned 1 [0068.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7cdd890, dwHighDateTime=0x1d585b4)) [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4bf0 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4bf0 | out: hHeap=0x260000) returned 1 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6250 [0068.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6250 | out: hHeap=0x260000) returned 1 [0068.768] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.769] GetLastError () returned 0x0 [0068.769] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.769] GetLastError () returned 0x0 [0068.771] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.771] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xfe, lpOverlapped=0x0) returned 1 [0068.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.772] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.772] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.773] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.773] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.773] CloseHandle (hObject=0x104) returned 1 [0068.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.775] GetLastError () returned 0x0 [0068.775] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.776] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.776] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.776] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18877722859) returned 1 [0068.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7cdd890, dwHighDateTime=0x1d585b4)) [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4c28 [0068.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4c28 | out: hHeap=0x260000) returned 1 [0068.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6988 [0068.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6988 | out: hHeap=0x260000) returned 1 [0068.777] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.777] GetLastError () returned 0x0 [0068.777] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.777] GetLastError () returned 0x0 [0068.778] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.778] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xb6, lpOverlapped=0x0) returned 1 [0068.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.779] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.779] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.779] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.779] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.780] CloseHandle (hObject=0x104) returned 1 [0068.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.823] GetLastError () returned 0x0 [0068.823] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.824] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.824] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.824] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18882505105) returned 1 [0068.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7d4fcb0, dwHighDateTime=0x1d585b4)) [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4d40 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4d40 | out: hHeap=0x260000) returned 1 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6a30 [0068.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6a30 | out: hHeap=0x260000) returned 1 [0068.825] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.825] GetLastError () returned 0x0 [0068.825] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.825] GetLastError () returned 0x0 [0068.827] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffeb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.828] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x148, lpOverlapped=0x0) returned 1 [0068.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.828] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.828] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.829] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.829] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.829] CloseHandle (hObject=0x104) returned 1 [0068.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.840] GetLastError () returned 0x0 [0068.841] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.841] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.841] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.842] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18884282448) returned 1 [0068.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7d75e10, dwHighDateTime=0x1d585b4)) [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4d78 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4d78 | out: hHeap=0x260000) returned 1 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6d78 [0068.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6d78 | out: hHeap=0x260000) returned 1 [0068.842] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.843] GetLastError () returned 0x0 [0068.843] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.843] GetLastError () returned 0x0 [0068.844] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.844] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xf0, lpOverlapped=0x0) returned 1 [0068.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.845] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.845] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.846] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.846] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.847] CloseHandle (hObject=0x104) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.848] GetLastError () returned 0x0 [0068.848] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.849] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.849] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18885049838) returned 1 [0068.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7d9bf70, dwHighDateTime=0x1d585b4)) [0068.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4db0 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4db0 | out: hHeap=0x260000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6e20 [0068.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6e20 | out: hHeap=0x260000) returned 1 [0068.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.850] GetLastError () returned 0x0 [0068.850] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.850] GetLastError () returned 0x0 [0068.852] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffed5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.852] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x12b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x12b, lpOverlapped=0x0) returned 1 [0068.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.852] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.853] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.853] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.853] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.854] CloseHandle (hObject=0x104) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.855] GetLastError () returned 0x0 [0068.874] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.875] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.875] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.875] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18887649378) returned 1 [0068.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7de8230, dwHighDateTime=0x1d585b4)) [0068.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4e20 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4e20 | out: hHeap=0x260000) returned 1 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6ec8 [0068.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6ec8 | out: hHeap=0x260000) returned 1 [0068.876] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0068.876] GetLastError () returned 0x0 [0068.876] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0068.876] GetLastError () returned 0x0 [0068.984] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffc460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.984] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3ba0, lpOverlapped=0x0) returned 1 [0068.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.985] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.985] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.988] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.989] CloseHandle (hObject=0xa4) returned 1 [0068.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0068.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.[deadmin@cock.li].deadmin")) returned 1 [0068.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0068.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0068.990] GetLastError () returned 0x0 [0068.991] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0068.991] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0068.991] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0068.991] WriteFile (in: hFile=0xa4, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0068.992] CloseHandle (hObject=0xa4) returned 1 [0068.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e8870 | out: hHeap=0x260000) returned 1 [0068.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0068.993] RtlWakeConditionVariable () returned 0x27e828 [0068.993] GetCurrentThreadId () returned 0x99c [0068.996] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0068.997] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.997] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0068.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0068.997] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18900030369) returned 1 [0068.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7f18d30, dwHighDateTime=0x1d585b4)) [0068.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc00 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x260000) returned 1 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0069.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0069.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0069.000] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.000] GetLastError () returned 0x0 [0069.000] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.000] GetLastError () returned 0x0 [0069.003] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffc2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.003] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3d2, lpOverlapped=0x0) returned 1 [0069.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.004] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.004] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.005] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.005] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.005] CloseHandle (hObject=0xa4) returned 1 [0069.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.007] GetLastError () returned 0x0 [0069.007] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28b8758) returned 1 [0069.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0069.008] CryptReleaseContext (hProv=0x28b8758, dwFlags=0x0) returned 1 [0069.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.008] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18900908822) returned 1 [0069.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7f18d30, dwHighDateTime=0x1d585b4)) [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cbc8 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cbc8 | out: hHeap=0x260000) returned 1 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0069.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3293e0 [0069.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0069.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.009] GetLastError () returned 0x0 [0069.009] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.009] GetLastError () returned 0x0 [0069.010] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff682, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.010] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x97e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x97e, lpOverlapped=0x0) returned 1 [0069.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.011] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.011] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.012] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.012] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.012] CloseHandle (hObject=0xa4) returned 1 [0069.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.014] GetLastError () returned 0x0 [0069.015] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28b8758) returned 1 [0069.015] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0069.016] CryptReleaseContext (hProv=0x28b8758, dwFlags=0x0) returned 1 [0069.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.016] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18901684222) returned 1 [0069.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7f3ee90, dwHighDateTime=0x1d585b4)) [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc38 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc38 | out: hHeap=0x260000) returned 1 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0069.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329348 [0069.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0069.016] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.017] GetLastError () returned 0x0 [0069.017] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.017] GetLastError () returned 0x0 [0069.018] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.018] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x124, lpOverlapped=0x0) returned 1 [0069.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.018] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.018] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.019] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.020] CloseHandle (hObject=0xa4) returned 1 [0069.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.021] GetLastError () returned 0x0 [0069.021] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28b8758) returned 1 [0069.022] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0069.022] CryptReleaseContext (hProv=0x28b8758, dwFlags=0x0) returned 1 [0069.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0069.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.022] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18902360077) returned 1 [0069.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7f3ee90, dwHighDateTime=0x1d585b4)) [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc70 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc70 | out: hHeap=0x260000) returned 1 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0069.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328fb8 [0069.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0069.023] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.023] GetLastError () returned 0x0 [0069.023] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.024] GetLastError () returned 0x0 [0069.024] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffecc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.025] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x134, lpOverlapped=0x0) returned 1 [0069.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.025] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.025] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.026] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.026] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.026] CloseHandle (hObject=0xa4) returned 1 [0069.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b07b8 [0069.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b07b8 | out: hHeap=0x260000) returned 1 [0069.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.028] GetLastError () returned 0x0 [0069.028] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x28b8758) returned 1 [0069.029] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0069.029] CryptReleaseContext (hProv=0x28b8758, dwFlags=0x0) returned 1 [0069.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.029] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18903013361) returned 1 [0069.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb7f3ee90, dwHighDateTime=0x1d585b4)) [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c51a0 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c51a0 | out: hHeap=0x260000) returned 1 [0069.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0069.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328f20 [0069.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0069.030] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.030] GetLastError () returned 0x0 [0069.030] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.173] GetLastError () returned 0x0 [0069.175] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffb69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.175] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x497, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x497, lpOverlapped=0x0) returned 1 [0069.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.175] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.175] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.177] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.177] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.178] CloseHandle (hObject=0xa4) returned 1 [0069.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0069.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0069.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.234] GetLastError () returned 0x0 [0069.234] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.235] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.235] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.235] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18923659780) returned 1 [0069.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb81541d0, dwHighDateTime=0x1d585b4)) [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c56a8 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c56a8 | out: hHeap=0x260000) returned 1 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328e88 [0069.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.236] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.236] GetLastError () returned 0x0 [0069.236] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.237] GetLastError () returned 0x0 [0069.238] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffe59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.238] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1a7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1a7, lpOverlapped=0x0) returned 1 [0069.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.239] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.239] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.240] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.240] CloseHandle (hObject=0x120) returned 1 [0069.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0069.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0069.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.242] GetLastError () returned 0x0 [0069.242] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.243] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.243] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.243] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18924428252) returned 1 [0069.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb81541d0, dwHighDateTime=0x1d585b4)) [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c56e0 [0069.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c56e0 | out: hHeap=0x260000) returned 1 [0069.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327fb0 [0069.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.244] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.244] GetLastError () returned 0x0 [0069.244] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.244] GetLastError () returned 0x0 [0069.246] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.246] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x186, lpOverlapped=0x0) returned 1 [0069.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.247] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.247] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.248] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.248] CloseHandle (hObject=0x120) returned 1 [0069.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0069.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0069.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.250] GetLastError () returned 0x0 [0069.250] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.251] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.251] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.251] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18925222305) returned 1 [0069.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb817a330, dwHighDateTime=0x1d585b4)) [0069.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5718 [0069.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5718 | out: hHeap=0x260000) returned 1 [0069.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327f18 [0069.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.253] GetLastError () returned 0x0 [0069.253] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.254] GetLastError () returned 0x0 [0069.254] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffeeb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.254] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x115, lpOverlapped=0x0) returned 1 [0069.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.255] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.255] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.256] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.256] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.256] CloseHandle (hObject=0x120) returned 1 [0069.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0069.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0069.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.260] GetLastError () returned 0x0 [0069.261] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.262] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.262] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.262] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18926306599) returned 1 [0069.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb817a330, dwHighDateTime=0x1d585b4)) [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5750 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5750 | out: hHeap=0x260000) returned 1 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327e80 [0069.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.263] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.263] GetLastError () returned 0x0 [0069.263] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.263] GetLastError () returned 0x0 [0069.264] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffebd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.264] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x143, lpOverlapped=0x0) returned 1 [0069.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.306] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.306] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.306] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.307] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.307] CloseHandle (hObject=0x120) returned 1 [0069.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.309] GetLastError () returned 0x0 [0069.309] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.310] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.310] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18931114398) returned 1 [0069.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb81ec750, dwHighDateTime=0x1d585b4)) [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a180 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a180 | out: hHeap=0x260000) returned 1 [0069.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ad50 [0069.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.311] GetLastError () returned 0x0 [0069.311] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.311] GetLastError () returned 0x0 [0069.469] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffcd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.469] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x328, lpOverlapped=0x0) returned 1 [0069.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.477] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.477] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.478] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.478] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.479] CloseHandle (hObject=0x120) returned 1 [0069.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.481] GetLastError () returned 0x0 [0069.481] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.482] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.482] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.483] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18948388437) returned 1 [0069.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb83b57d0, dwHighDateTime=0x1d585b4)) [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329f18 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329f18 | out: hHeap=0x260000) returned 1 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0069.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.484] GetLastError () returned 0x0 [0069.484] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.484] GetLastError () returned 0x0 [0069.522] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffc6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.522] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x395, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x395, lpOverlapped=0x0) returned 1 [0069.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.523] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.523] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.524] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.524] CloseHandle (hObject=0x120) returned 1 [0069.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.526] GetLastError () returned 0x0 [0069.526] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.527] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.527] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.527] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18952808115) returned 1 [0069.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8401a90, dwHighDateTime=0x1d585b4)) [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329e70 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329e70 | out: hHeap=0x260000) returned 1 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0069.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.528] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.528] GetLastError () returned 0x0 [0069.528] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.528] GetLastError () returned 0x0 [0069.530] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffe7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.530] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x185, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x185, lpOverlapped=0x0) returned 1 [0069.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.531] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.531] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.532] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.532] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.532] CloseHandle (hObject=0x120) returned 1 [0069.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.534] GetLastError () returned 0x0 [0069.534] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.535] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.535] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.535] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18953622176) returned 1 [0069.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8427bf0, dwHighDateTime=0x1d585b4)) [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329e38 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329e38 | out: hHeap=0x260000) returned 1 [0069.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0069.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.536] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.536] GetLastError () returned 0x0 [0069.536] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.536] GetLastError () returned 0x0 [0069.537] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffe30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.537] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1d0, lpOverlapped=0x0) returned 1 [0069.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.538] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.538] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.538] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.539] CloseHandle (hObject=0x120) returned 1 [0069.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.543] GetLastError () returned 0x0 [0069.543] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.544] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.544] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.545] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18954570706) returned 1 [0069.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8427bf0, dwHighDateTime=0x1d585b4)) [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329e00 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329e00 | out: hHeap=0x260000) returned 1 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ffb8 [0069.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.546] GetLastError () returned 0x0 [0069.546] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.546] GetLastError () returned 0x0 [0069.558] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffe06f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.558] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1f91, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x1f91, lpOverlapped=0x0) returned 1 [0069.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.559] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.560] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.561] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.561] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.562] CloseHandle (hObject=0x120) returned 1 [0069.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.563] GetLastError () returned 0x0 [0069.564] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.565] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.565] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18956596624) returned 1 [0069.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8473eb0, dwHighDateTime=0x1d585b4)) [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329d90 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329d90 | out: hHeap=0x260000) returned 1 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328340 [0069.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.566] GetLastError () returned 0x0 [0069.566] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.566] GetLastError () returned 0x0 [0069.641] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff515, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.641] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xaeb, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0xaeb, lpOverlapped=0x0) returned 1 [0069.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.642] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.642] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.642] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.642] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.643] CloseHandle (hObject=0x120) returned 1 [0069.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2963510 [0069.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2963510 | out: hHeap=0x260000) returned 1 [0069.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.644] GetLastError () returned 0x0 [0069.645] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.645] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.646] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.646] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18964687472) returned 1 [0069.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8532590, dwHighDateTime=0x1d585b4)) [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5948 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5948 | out: hHeap=0x260000) returned 1 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0069.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.646] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.647] GetLastError () returned 0x0 [0069.647] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.647] GetLastError () returned 0x0 [0069.648] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffee4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.648] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x11c, lpOverlapped=0x0) returned 1 [0069.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.648] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.648] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.649] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.650] CloseHandle (hObject=0x120) returned 1 [0069.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2963510 [0069.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2963510 | out: hHeap=0x260000) returned 1 [0069.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.651] GetLastError () returned 0x0 [0069.652] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0069.652] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.652] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.653] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18965368619) returned 1 [0069.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8532590, dwHighDateTime=0x1d585b4)) [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5980 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5980 | out: hHeap=0x260000) returned 1 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed4a8 [0069.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.653] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.653] GetLastError () returned 0x0 [0069.654] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.654] GetLastError () returned 0x0 [0069.890] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffd26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.890] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x2da, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x2da, lpOverlapped=0x0) returned 1 [0069.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.891] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.892] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.892] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.893] CloseHandle (hObject=0x120) returned 1 [0069.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.894] GetLastError () returned 0x0 [0069.898] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0069.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.899] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0069.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.899] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18990010263) returned 1 [0069.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8793b90, dwHighDateTime=0x1d585b4)) [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a570 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a570 | out: hHeap=0x260000) returned 1 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0069.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.900] GetLastError () returned 0x0 [0069.900] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.900] GetLastError () returned 0x0 [0069.904] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffef088, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.904] WriteFile (in: hFile=0x120, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x10f78, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x10f78, lpOverlapped=0x0) returned 1 [0069.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0069.945] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.946] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.946] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.947] CloseHandle (hObject=0x120) returned 1 [0069.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0069.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.[deadmin@cock.li].deadmin")) returned 1 [0069.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0069.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.953] GetLastError () returned 0x0 [0069.954] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0069.955] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.955] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0069.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.955] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18995647146) returned 1 [0069.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb882c110, dwHighDateTime=0x1d585b4)) [0069.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a538 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a538 | out: hHeap=0x260000) returned 1 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b930 [0069.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.956] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.956] GetLastError () returned 0x0 [0069.956] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.956] GetLastError () returned 0x0 [0069.959] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff5c78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.959] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xa388, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xa388, lpOverlapped=0x0) returned 1 [0069.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.960] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.960] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.961] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.961] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.961] CloseHandle (hObject=0x120) returned 1 [0069.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x285dc80 [0069.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.[deadmin@cock.li].deadmin")) returned 1 [0069.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x285dc80 | out: hHeap=0x260000) returned 1 [0069.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.963] GetLastError () returned 0x0 [0069.963] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310b80) returned 1 [0069.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.964] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0069.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.964] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18996542559) returned 1 [0069.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb882c110, dwHighDateTime=0x1d585b4)) [0069.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a500 [0069.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a500 | out: hHeap=0x260000) returned 1 [0069.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0069.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.965] GetLastError () returned 0x0 [0069.965] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.965] GetLastError () returned 0x0 [0069.967] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff962, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.967] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x69e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x69e, lpOverlapped=0x0) returned 1 [0069.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.968] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.968] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.968] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.969] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.969] CloseHandle (hObject=0x120) returned 1 [0069.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0069.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.[deadmin@cock.li].deadmin")) returned 1 [0069.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0069.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.971] GetLastError () returned 0x0 [0069.972] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312830) returned 1 [0069.973] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.973] CryptReleaseContext (hProv=0x312830, dwFlags=0x0) returned 1 [0069.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.973] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18997387609) returned 1 [0069.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8852270, dwHighDateTime=0x1d585b4)) [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a4c8 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a4c8 | out: hHeap=0x260000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0069.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.974] GetLastError () returned 0x0 [0069.974] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.974] GetLastError () returned 0x0 [0069.975] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffef3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.975] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x10d, lpOverlapped=0x0) returned 1 [0069.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.976] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.976] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.976] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.977] CloseHandle (hObject=0x120) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0069.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.[deadmin@cock.li].deadmin")) returned 1 [0069.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0069.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0069.983] GetLastError () returned 0x0 [0069.983] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0069.984] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.984] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0069.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0069.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0069.984] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=18998560852) returned 1 [0069.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb88783d0, dwHighDateTime=0x1d585b4)) [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a490 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a490 | out: hHeap=0x260000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b800 [0069.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.985] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0069.985] GetLastError () returned 0x0 [0069.985] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0069.986] GetLastError () returned 0x0 [0070.098] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff9e80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.098] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x6180, lpOverlapped=0x0) returned 1 [0070.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.102] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.102] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.102] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.102] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.103] CloseHandle (hObject=0x120) returned 1 [0070.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2817ac8 [0070.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817ac8 | out: hHeap=0x260000) returned 1 [0070.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.150] GetLastError () returned 0x0 [0070.150] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.151] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.151] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.151] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19015226826) returned 1 [0070.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb89f5190, dwHighDateTime=0x1d585b4)) [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5e50 [0070.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5e50 | out: hHeap=0x260000) returned 1 [0070.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c79f0 [0070.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0070.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c79f0 | out: hHeap=0x260000) returned 1 [0070.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.152] GetLastError () returned 0x0 [0070.152] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.152] GetLastError () returned 0x0 [0070.165] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc905, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.165] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x36fb, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x238fdb0*=0x36fb, lpOverlapped=0x0) returned 1 [0070.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.166] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.166] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.167] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.168] CloseHandle (hObject=0x108) returned 1 [0070.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.[deadmin@cock.li].deadmin")) returned 1 [0070.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.169] GetLastError () returned 0x0 [0070.170] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.172] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.172] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.172] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19017324171) returned 1 [0070.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8a41450, dwHighDateTime=0x1d585b4)) [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5ec0 [0070.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5ec0 | out: hHeap=0x260000) returned 1 [0070.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7a98 [0070.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32af18 [0070.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7a98 | out: hHeap=0x260000) returned 1 [0070.173] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.173] GetLastError () returned 0x0 [0070.173] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.173] GetLastError () returned 0x0 [0070.183] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe84b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.183] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x17b5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x238fdb0*=0x17b5, lpOverlapped=0x0) returned 1 [0070.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.184] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.184] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.184] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.184] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.185] CloseHandle (hObject=0x108) returned 1 [0070.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2817ac8 [0070.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.[deadmin@cock.li].deadmin")) returned 1 [0070.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817ac8 | out: hHeap=0x260000) returned 1 [0070.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.186] GetLastError () returned 0x0 [0070.187] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.188] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.188] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.188] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19018889684) returned 1 [0070.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8a675b0, dwHighDateTime=0x1d585b4)) [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cc40 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cc40 | out: hHeap=0x260000) returned 1 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0070.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.188] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.189] GetLastError () returned 0x0 [0070.189] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.189] GetLastError () returned 0x0 [0070.190] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.190] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x238fdb0*=0xc4, lpOverlapped=0x0) returned 1 [0070.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.191] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.191] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.191] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.191] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.192] CloseHandle (hObject=0x108) returned 1 [0070.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0070.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc.[deadmin@cock.li].deadmin")) returned 1 [0070.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.193] GetLastError () returned 0x0 [0070.194] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.195] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.195] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.195] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19019589614) returned 1 [0070.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8a675b0, dwHighDateTime=0x1d585b4)) [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cc08 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cc08 | out: hHeap=0x260000) returned 1 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7c90 [0070.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0070.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7c90 | out: hHeap=0x260000) returned 1 [0070.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.196] GetLastError () returned 0x0 [0070.196] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.196] GetLastError () returned 0x0 [0070.197] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffffba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.197] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x238fdb0*=0x46, lpOverlapped=0x0) returned 1 [0070.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.198] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.198] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.198] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.199] CloseHandle (hObject=0x108) returned 1 [0070.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2963a20 [0070.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini.[deadmin@cock.li].deadmin")) returned 1 [0070.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2963a20 | out: hHeap=0x260000) returned 1 [0070.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.203] GetLastError () returned 0x0 [0070.204] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.204] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.205] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.205] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19020585898) returned 1 [0070.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8a8d710, dwHighDateTime=0x1d585b4)) [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cbd0 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cbd0 | out: hHeap=0x260000) returned 1 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7d38 [0070.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0070.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x260000) returned 1 [0070.205] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.206] GetLastError () returned 0x0 [0070.206] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.206] GetLastError () returned 0x0 [0070.207] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffed9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.207] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x1266, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x1266, lpOverlapped=0x0) returned 1 [0070.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.208] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.208] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.209] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.209] CloseHandle (hObject=0x108) returned 1 [0070.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2963a20 [0070.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.[deadmin@cock.li].deadmin")) returned 1 [0070.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2963a20 | out: hHeap=0x260000) returned 1 [0070.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.211] GetLastError () returned 0x0 [0070.211] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.211] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.211] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0070.211] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0070.213] CloseHandle (hObject=0x108) returned 1 [0070.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f490 | out: hHeap=0x260000) returned 1 [0070.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817ac8 | out: hHeap=0x260000) returned 1 [0070.213] RtlWakeConditionVariable () returned 0x27e828 [0070.213] GetCurrentThreadId () returned 0x99c [0070.214] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312720) returned 1 [0070.214] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.215] CryptReleaseContext (hProv=0x312720, dwFlags=0x0) returned 1 [0070.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.215] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19021587222) returned 1 [0070.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8a8d710, dwHighDateTime=0x1d585b4)) [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cb60 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cb60 | out: hHeap=0x260000) returned 1 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0070.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.215] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.216] GetLastError () returned 0x0 [0070.216] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.216] GetLastError () returned 0x0 [0070.218] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff3068, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.218] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xcf98, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0xcf98, lpOverlapped=0x0) returned 1 [0070.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.219] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.219] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.220] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.220] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.220] CloseHandle (hObject=0x108) returned 1 [0070.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.[deadmin@cock.li].deadmin")) returned 1 [0070.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.228] GetLastError () returned 0x0 [0070.229] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312698) returned 1 [0070.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.229] CryptReleaseContext (hProv=0x312698, dwFlags=0x0) returned 1 [0070.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.230] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19023095394) returned 1 [0070.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8ab3870, dwHighDateTime=0x1d585b4)) [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5ef8 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5ef8 | out: hHeap=0x260000) returned 1 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0070.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.231] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.231] GetLastError () returned 0x0 [0070.231] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.231] GetLastError () returned 0x0 [0070.234] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.234] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0070.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.235] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.235] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.235] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.235] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.236] CloseHandle (hObject=0x108) returned 1 [0070.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.[deadmin@cock.li].deadmin")) returned 1 [0070.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.238] GetLastError () returned 0x0 [0070.238] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0070.239] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0070.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.239] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19024059102) returned 1 [0070.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8ad99d0, dwHighDateTime=0x1d585b4)) [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5f30 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5f30 | out: hHeap=0x260000) returned 1 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ece20 [0070.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.240] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.240] GetLastError () returned 0x0 [0070.240] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.241] GetLastError () returned 0x0 [0070.244] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.244] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.245] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.245] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.249] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.249] CloseHandle (hObject=0x108) returned 1 [0070.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.[deadmin@cock.li].deadmin")) returned 1 [0070.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.251] GetLastError () returned 0x0 [0070.251] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.252] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0070.252] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.252] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19025329938) returned 1 [0070.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8affb30, dwHighDateTime=0x1d585b4)) [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5f68 [0070.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5f68 | out: hHeap=0x260000) returned 1 [0070.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eccf0 [0070.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.253] GetLastError () returned 0x0 [0070.253] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.253] GetLastError () returned 0x0 [0070.256] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.256] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.257] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.258] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.264] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.264] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.265] CloseHandle (hObject=0x108) returned 1 [0070.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.[deadmin@cock.li].deadmin")) returned 1 [0070.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.266] GetLastError () returned 0x0 [0070.267] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.268] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.268] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.268] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19026950598) returned 1 [0070.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8b25c90, dwHighDateTime=0x1d585b4)) [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5fa0 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5fa0 | out: hHeap=0x260000) returned 1 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27ecda8 [0070.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x356390 [0070.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ecda8 | out: hHeap=0x260000) returned 1 [0070.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0070.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x356390 | out: hHeap=0x260000) returned 1 [0070.269] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.269] GetLastError () returned 0x0 [0070.269] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.269] GetLastError () returned 0x0 [0070.336] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd678, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.344] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2988, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x2988, lpOverlapped=0x0) returned 1 [0070.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.352] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.352] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.353] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.353] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.353] CloseHandle (hObject=0x108) returned 1 [0070.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.355] GetLastError () returned 0x0 [0070.355] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.358] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.358] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19035889337) returned 1 [0070.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8c0a4d0, dwHighDateTime=0x1d585b4)) [0070.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c6048 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6048 | out: hHeap=0x260000) returned 1 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7d38 [0070.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x260000) returned 1 [0070.360] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.360] GetLastError () returned 0x0 [0070.360] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.360] GetLastError () returned 0x0 [0070.361] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffa078, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.361] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x5f88, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x5f88, lpOverlapped=0x0) returned 1 [0070.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.362] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.362] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.363] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.363] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.364] CloseHandle (hObject=0x108) returned 1 [0070.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.365] GetLastError () returned 0x0 [0070.369] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311488) returned 1 [0070.369] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.370] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0070.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.370] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19037086266) returned 1 [0070.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8c0a4d0, dwHighDateTime=0x1d585b4)) [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c6080 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6080 | out: hHeap=0x260000) returned 1 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.370] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.371] GetLastError () returned 0x0 [0070.371] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.371] GetLastError () returned 0x0 [0070.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbc78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.399] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4388, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x4388, lpOverlapped=0x0) returned 1 [0070.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.400] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.400] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.400] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.400] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.401] CloseHandle (hObject=0x108) returned 1 [0070.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.403] GetLastError () returned 0x0 [0070.407] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312588) returned 1 [0070.408] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.408] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.408] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19040915257) returned 1 [0070.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8c7c8f0, dwHighDateTime=0x1d585b4)) [0070.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c6160 [0070.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6160 | out: hHeap=0x260000) returned 1 [0070.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ecbc0 [0070.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.409] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.409] GetLastError () returned 0x0 [0070.409] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.409] GetLastError () returned 0x0 [0070.434] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.434] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x281, lpOverlapped=0x0) returned 1 [0070.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.435] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.435] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.436] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.436] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.436] CloseHandle (hObject=0x108) returned 1 [0070.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0070.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.438] GetLastError () returned 0x0 [0070.438] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312258) returned 1 [0070.439] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.439] CryptReleaseContext (hProv=0x312258, dwFlags=0x0) returned 1 [0070.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.439] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19044060189) returned 1 [0070.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8cc8bb0, dwHighDateTime=0x1d585b4)) [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32aa40 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32aa40 | out: hHeap=0x260000) returned 1 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27ecda8 [0070.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ecda8 | out: hHeap=0x260000) returned 1 [0070.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.440] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.440] GetLastError () returned 0x0 [0070.440] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.441] GetLastError () returned 0x0 [0070.491] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.491] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.492] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.492] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.494] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.495] CloseHandle (hObject=0x108) returned 1 [0070.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.[deadmin@cock.li].deadmin")) returned 1 [0070.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.526] GetLastError () returned 0x0 [0070.527] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3121d0) returned 1 [0070.528] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.528] CryptReleaseContext (hProv=0x3121d0, dwFlags=0x0) returned 1 [0070.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.528] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19052916506) returned 1 [0070.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8dad3f0, dwHighDateTime=0x1d585b4)) [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a810 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a810 | out: hHeap=0x260000) returned 1 [0070.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec960 [0070.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.529] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.529] GetLastError () returned 0x0 [0070.529] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.529] GetLastError () returned 0x0 [0070.554] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.554] WriteFile (in: hFile=0x104, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0070.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0070.559] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.559] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.560] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.560] CloseHandle (hObject=0x104) returned 1 [0070.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.[deadmin@cock.li].deadmin")) returned 1 [0070.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.563] GetLastError () returned 0x0 [0070.564] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312588) returned 1 [0070.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.564] CryptReleaseContext (hProv=0x312588, dwFlags=0x0) returned 1 [0070.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.565] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19056575442) returned 1 [0070.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8df96b0, dwHighDateTime=0x1d585b4)) [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a730 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a730 | out: hHeap=0x260000) returned 1 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec370 [0070.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.565] GetLastError () returned 0x0 [0070.566] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.566] GetLastError () returned 0x0 [0070.570] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.570] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.571] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.571] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.596] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.597] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.598] CloseHandle (hObject=0x104) returned 1 [0070.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.[deadmin@cock.li].deadmin")) returned 1 [0070.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.600] GetLastError () returned 0x0 [0070.601] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312038) returned 1 [0070.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.602] CryptReleaseContext (hProv=0x312038, dwFlags=0x0) returned 1 [0070.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.602] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19060293570) returned 1 [0070.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8e45970, dwHighDateTime=0x1d585b4)) [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a420 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a420 | out: hHeap=0x260000) returned 1 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eb8c0 [0070.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.603] GetLastError () returned 0x0 [0070.603] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.603] GetLastError () returned 0x0 [0070.625] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.625] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x26d, lpOverlapped=0x0) returned 1 [0070.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.625] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.626] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.626] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.627] CloseHandle (hObject=0x104) returned 1 [0070.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0070.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.628] GetLastError () returned 0x0 [0070.629] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3121d0) returned 1 [0070.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.630] CryptReleaseContext (hProv=0x3121d0, dwFlags=0x0) returned 1 [0070.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.630] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19063161996) returned 1 [0070.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8e91c30, dwHighDateTime=0x1d585b4)) [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cfc0 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cfc0 | out: hHeap=0x260000) returned 1 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750520 [0070.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.631] GetLastError () returned 0x0 [0070.631] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.632] GetLastError () returned 0x0 [0070.662] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.662] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.665] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.665] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.666] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.666] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.667] CloseHandle (hObject=0x104) returned 1 [0070.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2819558 [0070.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2819558 | out: hHeap=0x260000) returned 1 [0070.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.669] GetLastError () returned 0x0 [0070.670] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311ea0) returned 1 [0070.670] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.671] CryptReleaseContext (hProv=0x311ea0, dwFlags=0x0) returned 1 [0070.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.671] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19067184607) returned 1 [0070.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8f04050, dwHighDateTime=0x1d585b4)) [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cf18 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cf18 | out: hHeap=0x260000) returned 1 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7d38 [0070.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x260000) returned 1 [0070.671] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.672] GetLastError () returned 0x0 [0070.672] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.672] GetLastError () returned 0x0 [0070.683] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffce80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.683] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x3180, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x3180, lpOverlapped=0x0) returned 1 [0070.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.684] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.684] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.684] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.684] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.685] CloseHandle (hObject=0x104) returned 1 [0070.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.685] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.687] GetLastError () returned 0x0 [0070.688] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311e18) returned 1 [0070.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.688] CryptReleaseContext (hProv=0x311e18, dwFlags=0x0) returned 1 [0070.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.689] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19068970738) returned 1 [0070.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8f2a1b0, dwHighDateTime=0x1d585b4)) [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cea8 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cea8 | out: hHeap=0x260000) returned 1 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x356eb8 [0070.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x356eb8 | out: hHeap=0x260000) returned 1 [0070.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.689] GetLastError () returned 0x0 [0070.690] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.690] GetLastError () returned 0x0 [0070.732] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.732] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.734] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.734] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.759] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.759] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.759] CloseHandle (hObject=0x104) returned 1 [0070.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.759] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.[deadmin@cock.li].deadmin")) returned 1 [0070.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.761] GetLastError () returned 0x0 [0070.762] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.763] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.763] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.763] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19076407012) returned 1 [0070.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8fe8890, dwHighDateTime=0x1d585b4)) [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a340 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0070.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a340 | out: hHeap=0x260000) returned 1 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0070.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x357008 [0070.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357008 | out: hHeap=0x260000) returned 1 [0070.764] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.764] GetLastError () returned 0x0 [0070.764] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.764] GetLastError () returned 0x0 [0070.768] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffde5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.768] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x21a6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x21a6, lpOverlapped=0x0) returned 1 [0070.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.768] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.769] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.769] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.769] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.770] CloseHandle (hObject=0x104) returned 1 [0070.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860370 [0070.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860370 | out: hHeap=0x260000) returned 1 [0070.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.772] GetLastError () returned 0x0 [0070.772] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311d90) returned 1 [0070.773] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.773] CryptReleaseContext (hProv=0x311d90, dwFlags=0x0) returned 1 [0070.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.773] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19077394482) returned 1 [0070.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb8fe8890, dwHighDateTime=0x1d585b4)) [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a308 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a308 | out: hHeap=0x260000) returned 1 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x357008 [0070.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357008 | out: hHeap=0x260000) returned 1 [0070.774] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.774] GetLastError () returned 0x0 [0070.774] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.774] GetLastError () returned 0x0 [0070.775] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc2a9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.775] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3d57, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x3d57, lpOverlapped=0x0) returned 1 [0070.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.776] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.776] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.777] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.777] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.778] CloseHandle (hObject=0x104) returned 1 [0070.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860370 [0070.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860370 | out: hHeap=0x260000) returned 1 [0070.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.779] GetLastError () returned 0x0 [0070.779] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311d90) returned 1 [0070.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.780] CryptReleaseContext (hProv=0x311d90, dwFlags=0x0) returned 1 [0070.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.780] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19078155670) returned 1 [0070.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb900e9f0, dwHighDateTime=0x1d585b4)) [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a2d0 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a2d0 | out: hHeap=0x260000) returned 1 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x356eb8 [0070.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x356eb8 | out: hHeap=0x260000) returned 1 [0070.781] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.781] GetLastError () returned 0x0 [0070.781] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.782] GetLastError () returned 0x0 [0070.783] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe7bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.783] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1845, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1845, lpOverlapped=0x0) returned 1 [0070.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.784] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.784] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.785] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.785] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.785] CloseHandle (hObject=0x104) returned 1 [0070.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860370 [0070.785] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860370 | out: hHeap=0x260000) returned 1 [0070.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.787] GetLastError () returned 0x0 [0070.855] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.856] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.856] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.856] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19085706000) returned 1 [0070.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb90cd0d0, dwHighDateTime=0x1d585b4)) [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d298 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d298 | out: hHeap=0x260000) returned 1 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.857] GetLastError () returned 0x0 [0070.857] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.857] GetLastError () returned 0x0 [0070.860] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffaebf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.860] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x5141, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x5141, lpOverlapped=0x0) returned 1 [0070.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.861] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.861] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.862] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.862] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.862] CloseHandle (hObject=0xfc) returned 1 [0070.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.864] GetLastError () returned 0x0 [0070.864] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.865] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.865] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.865] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19086630144) returned 1 [0070.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb90cd0d0, dwHighDateTime=0x1d585b4)) [0070.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d260 [0070.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d260 | out: hHeap=0x260000) returned 1 [0070.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.866] GetLastError () returned 0x0 [0070.866] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.866] GetLastError () returned 0x0 [0070.868] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff46a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.869] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb96, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xb96, lpOverlapped=0x0) returned 1 [0070.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.869] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.869] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.870] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.870] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.871] CloseHandle (hObject=0xfc) returned 1 [0070.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x282a9e8 [0070.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css.[deadmin@cock.li].deadmin")) returned 1 [0070.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282a9e8 | out: hHeap=0x260000) returned 1 [0070.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.872] GetLastError () returned 0x0 [0070.873] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311d90) returned 1 [0070.873] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0070.873] CryptReleaseContext (hProv=0x311d90, dwFlags=0x0) returned 1 [0070.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0070.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.874] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19087474134) returned 1 [0070.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb90f3230, dwHighDateTime=0x1d585b4)) [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d490 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d490 | out: hHeap=0x260000) returned 1 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314ba0 [0070.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.875] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.875] GetLastError () returned 0x0 [0070.876] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.876] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0070.876] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.876] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.877] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.878] CloseHandle (hObject=0xfc) returned 1 [0070.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0070.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0070.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.880] GetLastError () returned 0x0 [0070.880] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.881] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.881] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19088250226) returned 1 [0070.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb90f3230, dwHighDateTime=0x1d585b4)) [0070.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d458 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d458 | out: hHeap=0x260000) returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314ba0 [0070.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314ba0 | out: hHeap=0x260000) returned 1 [0070.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.882] GetLastError () returned 0x0 [0070.882] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.882] GetLastError () returned 0x0 [0070.884] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.884] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xff, lpOverlapped=0x0) returned 1 [0070.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.884] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.884] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.885] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.886] CloseHandle (hObject=0xfc) returned 1 [0070.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0070.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0070.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.955] GetLastError () returned 0x0 [0070.958] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0070.959] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.959] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.959] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19096001861) returned 1 [0070.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb91b1910, dwHighDateTime=0x1d585b4)) [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32da08 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32da08 | out: hHeap=0x260000) returned 1 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.960] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0070.960] GetLastError () returned 0x0 [0070.960] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0070.960] GetLastError () returned 0x0 [0070.963] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffebd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.963] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x143, lpOverlapped=0x0) returned 1 [0070.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.964] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.964] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.965] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.965] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.965] CloseHandle (hObject=0xfc) returned 1 [0070.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0070.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0071.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0071.143] GetLastError () returned 0x0 [0071.167] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.168] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.168] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.168] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19116906599) returned 1 [0071.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb93c6c50, dwHighDateTime=0x1d585b4)) [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28593f0 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28593f0 | out: hHeap=0x260000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.169] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.169] GetLastError () returned 0x0 [0071.169] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.169] GetLastError () returned 0x0 [0071.170] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.170] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1f0, lpOverlapped=0x0) returned 1 [0071.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.171] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.171] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.172] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.172] CloseHandle (hObject=0xfc) returned 1 [0071.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0071.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0071.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.174] GetLastError () returned 0x0 [0071.174] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.175] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.175] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.175] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19117617209) returned 1 [0071.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb93c6c50, dwHighDateTime=0x1d585b4)) [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dea8 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dea8 | out: hHeap=0x260000) returned 1 [0071.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.176] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.176] GetLastError () returned 0x0 [0071.176] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.176] GetLastError () returned 0x0 [0071.177] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff4f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.177] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb0e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xb0e, lpOverlapped=0x0) returned 1 [0071.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.178] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.178] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.179] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.179] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.179] CloseHandle (hObject=0xfc) returned 1 [0071.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css.[deadmin@cock.li].deadmin")) returned 1 [0071.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.181] GetLastError () returned 0x0 [0071.181] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.182] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.182] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19118307191) returned 1 [0071.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb93c6c50, dwHighDateTime=0x1d585b4)) [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32de70 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32de70 | out: hHeap=0x260000) returned 1 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.183] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.183] GetLastError () returned 0x0 [0071.183] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.183] GetLastError () returned 0x0 [0071.184] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.184] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x173, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x173, lpOverlapped=0x0) returned 1 [0071.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.185] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.185] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.185] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.186] CloseHandle (hObject=0xfc) returned 1 [0071.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css.[deadmin@cock.li].deadmin")) returned 1 [0071.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.187] GetLastError () returned 0x0 [0071.188] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.188] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.188] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.189] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19118968409) returned 1 [0071.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb93ecdb0, dwHighDateTime=0x1d585b4)) [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32de38 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32de38 | out: hHeap=0x260000) returned 1 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.189] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.189] GetLastError () returned 0x0 [0071.189] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.192] GetLastError () returned 0x0 [0071.250] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.250] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x71e, lpOverlapped=0x0) returned 1 [0071.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.255] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.255] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.255] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.255] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.256] CloseHandle (hObject=0xfc) returned 1 [0071.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0071.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css.[deadmin@cock.li].deadmin")) returned 1 [0071.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0071.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.258] GetLastError () returned 0x0 [0071.258] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.259] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.259] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.259] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19125998545) returned 1 [0071.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9485330, dwHighDateTime=0x1d585b4)) [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dd58 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dd58 | out: hHeap=0x260000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.260] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.260] GetLastError () returned 0x0 [0071.260] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.260] GetLastError () returned 0x0 [0071.286] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff416, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.286] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xbea, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xbea, lpOverlapped=0x0) returned 1 [0071.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.287] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.287] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.287] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.287] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.288] CloseHandle (hObject=0xfc) returned 1 [0071.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css.[deadmin@cock.li].deadmin")) returned 1 [0071.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.387] GetLastError () returned 0x0 [0071.387] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.388] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.388] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.388] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19138898581) returned 1 [0071.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb95dbf90, dwHighDateTime=0x1d585b4)) [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ce0 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ce0 | out: hHeap=0x260000) returned 1 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.389] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.389] GetLastError () returned 0x0 [0071.389] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.389] GetLastError () returned 0x0 [0071.391] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff280, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.391] WriteFile (in: hFile=0xfc, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x238fdb0*=0xd80, lpOverlapped=0x0) returned 1 [0071.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.392] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.392] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.393] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.393] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.393] CloseHandle (hObject=0xfc) returned 1 [0071.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css.[deadmin@cock.li].deadmin")) returned 1 [0071.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.395] GetLastError () returned 0x0 [0071.395] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.396] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.396] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19139715520) returned 1 [0071.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb95dbf90, dwHighDateTime=0x1d585b4)) [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7d18 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7d18 | out: hHeap=0x260000) returned 1 [0071.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed080 [0071.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.397] GetLastError () returned 0x0 [0071.397] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.397] GetLastError () returned 0x0 [0071.435] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff8b1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.435] WriteFile (in: hFile=0xfc, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x74f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x238fdb0*=0x74f, lpOverlapped=0x0) returned 1 [0071.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.436] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.436] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.436] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.437] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.437] CloseHandle (hObject=0xfc) returned 1 [0071.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css.[deadmin@cock.li].deadmin")) returned 1 [0071.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.439] GetLastError () returned 0x0 [0071.439] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.440] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.440] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.440] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19144122486) returned 1 [0071.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb964e3b0, dwHighDateTime=0x1d585b4)) [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8418 [0071.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8418 | out: hHeap=0x260000) returned 1 [0071.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.441] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.441] GetLastError () returned 0x0 [0071.441] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.441] GetLastError () returned 0x0 [0071.444] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.444] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x37a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x37a, lpOverlapped=0x0) returned 1 [0071.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.445] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.445] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.445] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.445] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.446] CloseHandle (hObject=0xfc) returned 1 [0071.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.447] GetLastError () returned 0x0 [0071.448] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.449] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.449] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19144990948) returned 1 [0071.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9674510, dwHighDateTime=0x1d585b4)) [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ff0 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ff0 | out: hHeap=0x260000) returned 1 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.449] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.450] GetLastError () returned 0x0 [0071.450] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.450] GetLastError () returned 0x0 [0071.451] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffcac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.451] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x354, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x354, lpOverlapped=0x0) returned 1 [0071.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.452] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.452] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.453] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.453] CloseHandle (hObject=0xfc) returned 1 [0071.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.455] GetLastError () returned 0x0 [0071.455] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.456] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.456] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.456] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19145715374) returned 1 [0071.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9674510, dwHighDateTime=0x1d585b4)) [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8290 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8290 | out: hHeap=0x260000) returned 1 [0071.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.457] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.457] GetLastError () returned 0x0 [0071.457] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.457] GetLastError () returned 0x0 [0071.458] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.458] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xa0, lpOverlapped=0x0) returned 1 [0071.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.459] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.459] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.459] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.459] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.460] CloseHandle (hObject=0xfc) returned 1 [0071.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.461] GetLastError () returned 0x0 [0071.462] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.462] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.463] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.463] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19146384119) returned 1 [0071.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9674510, dwHighDateTime=0x1d585b4)) [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8300 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8300 | out: hHeap=0x260000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.463] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.464] GetLastError () returned 0x0 [0071.464] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.464] GetLastError () returned 0x0 [0071.465] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffca4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.465] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x35c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x35c, lpOverlapped=0x0) returned 1 [0071.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.466] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.466] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.467] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.467] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.467] CloseHandle (hObject=0xfc) returned 1 [0071.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.469] GetLastError () returned 0x0 [0071.469] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.470] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.470] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.470] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19147151524) returned 1 [0071.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb969a670, dwHighDateTime=0x1d585b4)) [0071.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e7a0 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e7a0 | out: hHeap=0x260000) returned 1 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.471] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.471] GetLastError () returned 0x0 [0071.471] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.471] GetLastError () returned 0x0 [0071.472] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.472] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x16c, lpOverlapped=0x0) returned 1 [0071.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.473] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.473] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.474] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.474] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.475] CloseHandle (hObject=0xfc) returned 1 [0071.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.477] GetLastError () returned 0x0 [0071.477] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.478] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.478] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.478] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19147944036) returned 1 [0071.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb969a670, dwHighDateTime=0x1d585b4)) [0071.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e768 [0071.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e768 | out: hHeap=0x260000) returned 1 [0071.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.479] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.479] GetLastError () returned 0x0 [0071.479] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.479] GetLastError () returned 0x0 [0071.480] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.480] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x16c, lpOverlapped=0x0) returned 1 [0071.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.481] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.481] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.482] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.482] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.482] CloseHandle (hObject=0xfc) returned 1 [0071.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.484] GetLastError () returned 0x0 [0071.485] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.485] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.486] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.486] WriteFile (in: hFile=0x11c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.487] CloseHandle (hObject=0x11c) returned 1 [0071.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e060 | out: hHeap=0x260000) returned 1 [0071.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dda8 | out: hHeap=0x260000) returned 1 [0071.487] RtlWakeConditionVariable () returned 0x27e828 [0071.487] GetCurrentThreadId () returned 0x99c [0071.487] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.488] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.488] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19148952559) returned 1 [0071.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb96c07d0, dwHighDateTime=0x1d585b4)) [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e6f8 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e6f8 | out: hHeap=0x260000) returned 1 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.489] GetLastError () returned 0x0 [0071.489] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.489] GetLastError () returned 0x0 [0071.491] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff241, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.491] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xdbf, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xdbf, lpOverlapped=0x0) returned 1 [0071.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.491] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.492] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.492] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.493] CloseHandle (hObject=0x11c) returned 1 [0071.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css.[deadmin@cock.li].deadmin")) returned 1 [0071.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.494] GetLastError () returned 0x0 [0071.494] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.495] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.495] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.495] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19149655487) returned 1 [0071.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb96e6930, dwHighDateTime=0x1d585b4)) [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e6c0 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e6c0 | out: hHeap=0x260000) returned 1 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.496] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.496] GetLastError () returned 0x0 [0071.496] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.496] GetLastError () returned 0x0 [0071.498] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.498] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x74e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x74e, lpOverlapped=0x0) returned 1 [0071.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.498] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.499] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.499] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.500] CloseHandle (hObject=0x11c) returned 1 [0071.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css.[deadmin@cock.li].deadmin")) returned 1 [0071.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.501] GetLastError () returned 0x0 [0071.502] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.502] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0071.503] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.503] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19150385496) returned 1 [0071.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb96e6930, dwHighDateTime=0x1d585b4)) [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e688 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0071.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e688 | out: hHeap=0x260000) returned 1 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.503] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.504] GetLastError () returned 0x0 [0071.504] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.504] GetLastError () returned 0x0 [0071.507] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe506, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.507] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1afa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x1afa, lpOverlapped=0x0) returned 1 [0071.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.508] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.508] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.508] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.508] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.509] CloseHandle (hObject=0x11c) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.510] GetLastError () returned 0x0 [0071.548] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.548] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.548] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.548] WriteFile (in: hFile=0x104, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.549] CloseHandle (hObject=0x104) returned 1 [0071.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28201a0 | out: hHeap=0x260000) returned 1 [0071.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.550] RtlWakeConditionVariable () returned 0x27e828 [0071.550] GetCurrentThreadId () returned 0x99c [0071.550] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.551] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.551] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19155211217) returned 1 [0071.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9758d50, dwHighDateTime=0x1d585b4)) [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e5a8 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e5a8 | out: hHeap=0x260000) returned 1 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.552] GetLastError () returned 0x0 [0071.552] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.552] GetLastError () returned 0x0 [0071.553] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.553] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xec4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xec4, lpOverlapped=0x0) returned 1 [0071.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.554] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.555] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.555] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.558] CloseHandle (hObject=0x104) returned 1 [0071.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css.[deadmin@cock.li].deadmin")) returned 1 [0071.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.559] GetLastError () returned 0x0 [0071.561] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.561] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.562] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19156274114) returned 1 [0071.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb977eeb0, dwHighDateTime=0x1d585b4)) [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e8b8 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e8b8 | out: hHeap=0x260000) returned 1 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.562] GetLastError () returned 0x0 [0071.563] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.563] GetLastError () returned 0x0 [0071.563] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.564] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xe5, lpOverlapped=0x0) returned 1 [0071.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.564] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.564] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.565] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.566] CloseHandle (hObject=0x104) returned 1 [0071.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c348 [0071.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.[deadmin@cock.li].deadmin")) returned 1 [0071.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c348 | out: hHeap=0x260000) returned 1 [0071.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.567] GetLastError () returned 0x0 [0071.568] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.569] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.569] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19157016574) returned 1 [0071.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb977eeb0, dwHighDateTime=0x1d585b4)) [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e880 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e880 | out: hHeap=0x260000) returned 1 [0071.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.570] GetLastError () returned 0x0 [0071.570] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.570] GetLastError () returned 0x0 [0071.578] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff6cf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.578] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x931, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x931, lpOverlapped=0x0) returned 1 [0071.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.579] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.579] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.580] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.580] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.580] CloseHandle (hObject=0x104) returned 1 [0071.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0071.582] GetLastError () returned 0x0 [0071.582] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0071.583] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.583] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0071.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0071.583] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19158464388) returned 1 [0071.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb97a5010, dwHighDateTime=0x1d585b4)) [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e848 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e848 | out: hHeap=0x260000) returned 1 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.584] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0071.584] GetLastError () returned 0x0 [0071.585] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0071.585] GetLastError () returned 0x0 [0071.586] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff7ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.586] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x832, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x832, lpOverlapped=0x0) returned 1 [0071.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.587] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.587] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.587] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.587] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.588] CloseHandle (hObject=0x104) returned 1 [0071.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0072.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.140] GetLastError () returned 0x0 [0072.140] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0072.141] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.141] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.141] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19214232742) returned 1 [0072.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9d00190, dwHighDateTime=0x1d585b4)) [0072.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e1b8 [0072.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e1b8 | out: hHeap=0x260000) returned 1 [0072.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31bfa8 [0072.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bfa8 | out: hHeap=0x260000) returned 1 [0072.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.142] GetLastError () returned 0x0 [0072.142] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.142] GetLastError () returned 0x0 [0072.153] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff2ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.153] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xd01, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xd01, lpOverlapped=0x0) returned 1 [0072.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.155] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.155] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.156] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.157] CloseHandle (hObject=0x104) returned 1 [0072.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0072.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css.[deadmin@cock.li].deadmin")) returned 1 [0072.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0072.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.158] GetLastError () returned 0x0 [0072.159] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0072.159] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.159] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.160] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19216082731) returned 1 [0072.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9d262f0, dwHighDateTime=0x1d585b4)) [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e180 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e180 | out: hHeap=0x260000) returned 1 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31bfa8 [0072.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bfa8 | out: hHeap=0x260000) returned 1 [0072.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.160] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.161] GetLastError () returned 0x0 [0072.161] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.161] GetLastError () returned 0x0 [0072.164] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff602, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.164] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x9fe, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0x9fe, lpOverlapped=0x0) returned 1 [0072.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.165] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.165] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.165] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.166] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.173] CloseHandle (hObject=0x104) returned 1 [0072.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0072.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css.[deadmin@cock.li].deadmin")) returned 1 [0072.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0072.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.175] GetLastError () returned 0x0 [0072.176] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0072.177] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.177] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.177] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19217811708) returned 1 [0072.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9d4c450, dwHighDateTime=0x1d585b4)) [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e148 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e148 | out: hHeap=0x260000) returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31bfa8 [0072.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bfa8 | out: hHeap=0x260000) returned 1 [0072.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.178] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.178] GetLastError () returned 0x0 [0072.178] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.178] GetLastError () returned 0x0 [0072.179] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.179] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xe9, lpOverlapped=0x0) returned 1 [0072.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.180] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.181] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.181] CloseHandle (hObject=0x104) returned 1 [0072.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c348 [0072.181] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c348 | out: hHeap=0x260000) returned 1 [0072.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.183] GetLastError () returned 0x0 [0072.183] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x312478) returned 1 [0072.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.184] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0072.184] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19218528945) returned 1 [0072.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9d725b0, dwHighDateTime=0x1d585b4)) [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e110 [0072.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e110 | out: hHeap=0x260000) returned 1 [0072.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31bfa8 [0072.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bfa8 | out: hHeap=0x260000) returned 1 [0072.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.185] GetLastError () returned 0x0 [0072.185] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.185] GetLastError () returned 0x0 [0072.190] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff343, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.190] WriteFile (in: hFile=0x104, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xcbd, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x238fdb0*=0xcbd, lpOverlapped=0x0) returned 1 [0072.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0072.191] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.191] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.191] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.191] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.192] CloseHandle (hObject=0x104) returned 1 [0072.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0072.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0072.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0072.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0072.412] GetLastError () returned 0x0 [0072.460] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.461] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.461] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.461] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19246211101) returned 1 [0072.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xb9ff9d10, dwHighDateTime=0x1d585b4)) [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd88 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd88 | out: hHeap=0x260000) returned 1 [0072.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b798 [0072.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.462] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.462] GetLastError () returned 0x0 [0072.462] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.462] GetLastError () returned 0x0 [0072.467] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.467] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.469] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.469] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.494] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.495] CloseHandle (hObject=0x108) returned 1 [0072.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.[deadmin@cock.li].deadmin")) returned 1 [0072.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.497] GetLastError () returned 0x0 [0072.498] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.498] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.498] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.499] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19249980345) returned 1 [0072.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba06c130, dwHighDateTime=0x1d585b4)) [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd18 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd18 | out: hHeap=0x260000) returned 1 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x280e0a0 [0072.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280e0a0 | out: hHeap=0x260000) returned 1 [0072.500] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.500] GetLastError () returned 0x0 [0072.500] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.500] GetLastError () returned 0x0 [0072.502] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.502] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x29a, lpOverlapped=0x0) returned 1 [0072.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.503] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.503] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.503] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.503] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.504] CloseHandle (hObject=0x108) returned 1 [0072.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.506] GetLastError () returned 0x0 [0072.512] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.513] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.513] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.513] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19251388300) returned 1 [0072.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba092290, dwHighDateTime=0x1d585b4)) [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdc0 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdc0 | out: hHeap=0x260000) returned 1 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315038 [0072.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315038 | out: hHeap=0x260000) returned 1 [0072.513] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.514] GetLastError () returned 0x0 [0072.514] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.514] GetLastError () returned 0x0 [0072.515] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.515] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0xd6, lpOverlapped=0x0) returned 1 [0072.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.516] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.516] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.516] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.516] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.517] CloseHandle (hObject=0x108) returned 1 [0072.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0072.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.519] GetLastError () returned 0x0 [0072.519] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.520] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.520] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.520] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19252098115) returned 1 [0072.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba092290, dwHighDateTime=0x1d585b4)) [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdf8 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdf8 | out: hHeap=0x260000) returned 1 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3150e0 [0072.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3150e0 | out: hHeap=0x260000) returned 1 [0072.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.521] GetLastError () returned 0x0 [0072.521] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.521] GetLastError () returned 0x0 [0072.532] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.532] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0072.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.533] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.533] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.534] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.534] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.535] CloseHandle (hObject=0x108) returned 1 [0072.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.536] GetLastError () returned 0x0 [0072.537] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.538] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.538] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19253887531) returned 1 [0072.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba0b83f0, dwHighDateTime=0x1d585b4)) [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32da78 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32da78 | out: hHeap=0x260000) returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315188 [0072.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315188 | out: hHeap=0x260000) returned 1 [0072.538] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.539] GetLastError () returned 0x0 [0072.539] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.539] GetLastError () returned 0x0 [0072.540] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.540] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0072.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.541] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.541] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.542] CloseHandle (hObject=0x108) returned 1 [0072.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.544] GetLastError () returned 0x0 [0072.544] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.545] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.545] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19254605226) returned 1 [0072.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba0de550, dwHighDateTime=0x1d585b4)) [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32da40 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32da40 | out: hHeap=0x260000) returned 1 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b4a0 [0072.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.546] GetLastError () returned 0x0 [0072.546] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.546] GetLastError () returned 0x0 [0072.548] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.548] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x27c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x27c, lpOverlapped=0x0) returned 1 [0072.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.549] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.549] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.549] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.550] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.550] CloseHandle (hObject=0x108) returned 1 [0072.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c6f0 [0072.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c6f0 | out: hHeap=0x260000) returned 1 [0072.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.552] GetLastError () returned 0x0 [0072.552] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.553] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.553] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.553] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19255416636) returned 1 [0072.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba0de550, dwHighDateTime=0x1d585b4)) [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d768 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d768 | out: hHeap=0x260000) returned 1 [0072.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b370 [0072.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.554] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.554] GetLastError () returned 0x0 [0072.554] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.554] GetLastError () returned 0x0 [0072.555] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.555] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0xd0, lpOverlapped=0x0) returned 1 [0072.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.556] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.556] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.557] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.557] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.557] CloseHandle (hObject=0x108) returned 1 [0072.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c6f0 [0072.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0072.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c6f0 | out: hHeap=0x260000) returned 1 [0072.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.559] GetLastError () returned 0x0 [0072.559] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.560] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.560] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.560] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19256142562) returned 1 [0072.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba1046b0, dwHighDateTime=0x1d585b4)) [0072.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d730 [0072.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d730 | out: hHeap=0x260000) returned 1 [0072.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b2d8 [0072.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.561] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.561] GetLastError () returned 0x0 [0072.561] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.561] GetLastError () returned 0x0 [0072.562] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.562] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0072.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.563] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.563] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.564] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.564] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.564] CloseHandle (hObject=0x108) returned 1 [0072.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.566] GetLastError () returned 0x0 [0072.566] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.567] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.567] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.567] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19256840239) returned 1 [0072.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba1046b0, dwHighDateTime=0x1d585b4)) [0072.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d618 [0072.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d618 | out: hHeap=0x260000) returned 1 [0072.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b240 [0072.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.568] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.568] GetLastError () returned 0x0 [0072.568] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.568] GetLastError () returned 0x0 [0072.569] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.569] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0072.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.570] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.570] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.571] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.571] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.571] CloseHandle (hObject=0x108) returned 1 [0072.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.573] GetLastError () returned 0x0 [0072.574] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.575] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.575] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.575] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19257632796) returned 1 [0072.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba12a810, dwHighDateTime=0x1d585b4)) [0072.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d5e0 [0072.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d5e0 | out: hHeap=0x260000) returned 1 [0072.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b1a8 [0072.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.576] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.576] GetLastError () returned 0x0 [0072.576] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.576] GetLastError () returned 0x0 [0072.578] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff895, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.578] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x76b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x76b, lpOverlapped=0x0) returned 1 [0072.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.578] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.578] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.579] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.579] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.580] CloseHandle (hObject=0x108) returned 1 [0072.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c6f0 [0072.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.[deadmin@cock.li].deadmin")) returned 1 [0072.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c6f0 | out: hHeap=0x260000) returned 1 [0072.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.581] GetLastError () returned 0x0 [0072.582] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311268) returned 1 [0072.582] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.582] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0072.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.583] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19258380097) returned 1 [0072.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba12a810, dwHighDateTime=0x1d585b4)) [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d5a8 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d5a8 | out: hHeap=0x260000) returned 1 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b110 [0072.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.583] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.584] GetLastError () returned 0x0 [0072.584] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.584] GetLastError () returned 0x0 [0072.601] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.601] WriteFile (in: hFile=0x108, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x332, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x238fdb0*=0x332, lpOverlapped=0x0) returned 1 [0072.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0072.602] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.602] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.603] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.604] CloseHandle (hObject=0x108) returned 1 [0072.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.[deadmin@cock.li].deadmin")) returned 1 [0072.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.605] GetLastError () returned 0x0 [0072.606] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311bf8) returned 1 [0072.606] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.607] CryptReleaseContext (hProv=0x311bf8, dwFlags=0x0) returned 1 [0072.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.607] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19260786632) returned 1 [0072.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba176ad0, dwHighDateTime=0x1d585b4)) [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2947c8 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2947c8 | out: hHeap=0x260000) returned 1 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a530 [0072.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.607] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.608] GetLastError () returned 0x0 [0072.608] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.608] GetLastError () returned 0x0 [0072.624] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.624] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.628] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.628] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.648] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.648] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.677] CloseHandle (hObject=0x108) returned 1 [0072.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.728] GetLastError () returned 0x0 [0072.737] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310c08) returned 1 [0072.738] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.738] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0072.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.738] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19273942966) returned 1 [0072.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba2a75d0, dwHighDateTime=0x1d585b4)) [0072.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d110 [0072.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d110 | out: hHeap=0x260000) returned 1 [0072.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.739] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.739] GetLastError () returned 0x0 [0072.739] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.739] GetLastError () returned 0x0 [0072.791] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.791] WriteFile (in: hFile=0x11c, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.792] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.822] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.822] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.823] CloseHandle (hObject=0x11c) returned 1 [0072.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.823] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.824] GetLastError () returned 0x0 [0072.825] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311510) returned 1 [0072.826] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.826] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.826] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19282690160) returned 1 [0072.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba38be10, dwHighDateTime=0x1d585b4)) [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e928 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e928 | out: hHeap=0x260000) returned 1 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x280e0a0 [0072.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0072.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280e0a0 | out: hHeap=0x260000) returned 1 [0072.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.827] GetLastError () returned 0x0 [0072.827] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.827] GetLastError () returned 0x0 [0072.828] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.828] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0072.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.828] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.829] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.829] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.829] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.830] CloseHandle (hObject=0x11c) returned 1 [0072.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.831] GetLastError () returned 0x0 [0072.832] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311510) returned 1 [0072.833] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.833] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.833] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19283395624) returned 1 [0072.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba38be10, dwHighDateTime=0x1d585b4)) [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e8f0 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e8f0 | out: hHeap=0x260000) returned 1 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315428 [0072.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315428 | out: hHeap=0x260000) returned 1 [0072.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.834] GetLastError () returned 0x0 [0072.834] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.834] GetLastError () returned 0x0 [0072.865] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.865] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.866] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.866] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.909] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.909] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.910] CloseHandle (hObject=0x11c) returned 1 [0072.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.[deadmin@cock.li].deadmin")) returned 1 [0072.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.912] GetLastError () returned 0x0 [0072.912] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d258) returned 1 [0072.913] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.913] CryptReleaseContext (hProv=0x295d258, dwFlags=0x0) returned 1 [0072.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.913] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19291435080) returned 1 [0072.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba44a4f0, dwHighDateTime=0x1d585b4)) [0072.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337b30 [0072.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b30 | out: hHeap=0x260000) returned 1 [0072.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0072.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.914] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.914] GetLastError () returned 0x0 [0072.914] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.914] GetLastError () returned 0x0 [0072.954] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.954] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.955] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.955] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.957] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.957] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.958] CloseHandle (hObject=0x11c) returned 1 [0072.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.[deadmin@cock.li].deadmin")) returned 1 [0072.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.967] GetLastError () returned 0x0 [0072.968] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0072.968] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.969] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0072.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.969] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19296986058) returned 1 [0072.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba4e2a70, dwHighDateTime=0x1d585b4)) [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1370 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1370 | out: hHeap=0x260000) returned 1 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29aa90 [0072.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.969] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.970] GetLastError () returned 0x0 [0072.970] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.970] GetLastError () returned 0x0 [0072.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd7f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.973] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x281, lpOverlapped=0x0) returned 1 [0072.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.974] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.975] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.975] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.975] CloseHandle (hObject=0xf0) returned 1 [0072.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.977] GetLastError () returned 0x0 [0072.977] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0072.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.978] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0072.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.978] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19297948849) returned 1 [0072.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba508bd0, dwHighDateTime=0x1d585b4)) [0072.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1338 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1338 | out: hHeap=0x260000) returned 1 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a960 [0072.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.979] GetLastError () returned 0x0 [0072.979] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.979] GetLastError () returned 0x0 [0072.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.980] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd1, lpOverlapped=0x0) returned 1 [0072.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.981] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.981] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.982] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.982] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.982] CloseHandle (hObject=0xf0) returned 1 [0072.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0072.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.984] GetLastError () returned 0x0 [0072.985] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0072.985] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.985] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0072.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.986] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19298666267) returned 1 [0072.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba508bd0, dwHighDateTime=0x1d585b4)) [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e30 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0e30 | out: hHeap=0x260000) returned 1 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a8c8 [0072.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.986] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.986] GetLastError () returned 0x0 [0072.986] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.987] GetLastError () returned 0x0 [0072.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.988] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0072.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.988] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.989] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.989] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.990] CloseHandle (hObject=0xf0) returned 1 [0072.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.991] GetLastError () returned 0x0 [0072.992] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0072.992] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.992] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0072.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0072.993] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19299374273) returned 1 [0072.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba52ed30, dwHighDateTime=0x1d585b4)) [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0df8 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0072.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a830 [0072.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0072.993] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0072.993] GetLastError () returned 0x0 [0072.994] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0072.994] GetLastError () returned 0x0 [0072.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.995] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0072.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0072.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.995] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.996] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.997] CloseHandle (hObject=0xf0) returned 1 [0072.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0072.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0072.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0072.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0072.999] GetLastError () returned 0x0 [0072.999] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3117b8) returned 1 [0073.000] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.000] CryptReleaseContext (hProv=0x3117b8, dwFlags=0x0) returned 1 [0073.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.000] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19300154016) returned 1 [0073.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba52ed30, dwHighDateTime=0x1d585b4)) [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0dc0 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a408 [0073.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.001] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.001] GetLastError () returned 0x0 [0073.001] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.001] GetLastError () returned 0x0 [0073.127] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.127] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.128] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.128] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.155] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.155] CloseHandle (hObject=0xf0) returned 1 [0073.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0073.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0073.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.167] GetLastError () returned 0x0 [0073.168] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0073.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.169] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0073.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.169] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19317057819) returned 1 [0073.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba6d1c50, dwHighDateTime=0x1d585b4)) [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299398 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299398 | out: hHeap=0x260000) returned 1 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a110 [0073.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.170] GetLastError () returned 0x0 [0073.170] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.171] GetLastError () returned 0x0 [0073.172] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.172] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x734, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x734, lpOverlapped=0x0) returned 1 [0073.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.173] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.173] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.173] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.173] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.174] CloseHandle (hObject=0x104) returned 1 [0073.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.[deadmin@cock.li].deadmin")) returned 1 [0073.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.176] GetLastError () returned 0x0 [0073.176] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0073.177] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.177] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0073.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.177] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19317804881) returned 1 [0073.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba6d1c50, dwHighDateTime=0x1d585b4)) [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2993d0 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2993d0 | out: hHeap=0x260000) returned 1 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a078 [0073.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.178] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.178] GetLastError () returned 0x0 [0073.178] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.178] GetLastError () returned 0x0 [0073.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff79a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.180] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x866, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x866, lpOverlapped=0x0) returned 1 [0073.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.181] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.181] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.181] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.182] CloseHandle (hObject=0x104) returned 1 [0073.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.[deadmin@cock.li].deadmin")) returned 1 [0073.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.184] GetLastError () returned 0x0 [0073.184] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d1d0) returned 1 [0073.185] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.185] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0073.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.185] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19318658532) returned 1 [0073.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba6f7db0, dwHighDateTime=0x1d585b4)) [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299408 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299408 | out: hHeap=0x260000) returned 1 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299fe0 [0073.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.186] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.186] GetLastError () returned 0x0 [0073.186] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.186] GetLastError () returned 0x0 [0073.194] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff352, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.194] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xcae, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0xcae, lpOverlapped=0x0) returned 1 [0073.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.194] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.194] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.195] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.195] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.196] CloseHandle (hObject=0x104) returned 1 [0073.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cc68 [0073.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.[deadmin@cock.li].deadmin")) returned 1 [0073.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cc68 | out: hHeap=0x260000) returned 1 [0073.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.197] GetLastError () returned 0x0 [0073.198] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d148) returned 1 [0073.199] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.199] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0073.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.199] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19320046291) returned 1 [0073.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba71df10, dwHighDateTime=0x1d585b4)) [0073.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299440 [0073.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299440 | out: hHeap=0x260000) returned 1 [0073.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0073.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.200] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.200] GetLastError () returned 0x0 [0073.200] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.200] GetLastError () returned 0x0 [0073.357] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffb98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.357] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x468, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x468, lpOverlapped=0x0) returned 1 [0073.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.359] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.360] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.360] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.360] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.361] CloseHandle (hObject=0x104) returned 1 [0073.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.[deadmin@cock.li].deadmin")) returned 1 [0073.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.394] GetLastError () returned 0x0 [0073.394] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311378) returned 1 [0073.395] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.395] CryptReleaseContext (hProv=0x311378, dwFlags=0x0) returned 1 [0073.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.395] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19339655330) returned 1 [0073.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba8e6f90, dwHighDateTime=0x1d585b4)) [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe78 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe78 | out: hHeap=0x260000) returned 1 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750060 [0073.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.396] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.396] GetLastError () returned 0x0 [0073.396] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.396] GetLastError () returned 0x0 [0073.399] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.399] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0073.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.400] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.400] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.400] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.401] CloseHandle (hObject=0xf0) returned 1 [0073.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.403] GetLastError () returned 0x0 [0073.403] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311378) returned 1 [0073.404] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.404] CryptReleaseContext (hProv=0x311378, dwFlags=0x0) returned 1 [0073.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.404] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19340514453) returned 1 [0073.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba90d0f0, dwHighDateTime=0x1d585b4)) [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe40 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe40 | out: hHeap=0x260000) returned 1 [0073.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751f40 [0073.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.405] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.405] GetLastError () returned 0x0 [0073.405] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.405] GetLastError () returned 0x0 [0073.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.406] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0073.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.407] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.407] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.407] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.407] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.408] CloseHandle (hObject=0xf0) returned 1 [0073.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.408] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.410] GetLastError () returned 0x0 [0073.411] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3118c8) returned 1 [0073.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.411] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.412] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19341278855) returned 1 [0073.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba90d0f0, dwHighDateTime=0x1d585b4)) [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efe08 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efe08 | out: hHeap=0x260000) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.412] GetLastError () returned 0x0 [0073.413] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.413] GetLastError () returned 0x0 [0073.455] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.455] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.461] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.461] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.480] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.480] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.481] CloseHandle (hObject=0xf0) returned 1 [0073.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.486] GetLastError () returned 0x0 [0073.486] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311378) returned 1 [0073.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.487] CryptReleaseContext (hProv=0x311378, dwFlags=0x0) returned 1 [0073.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.487] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19348834549) returned 1 [0073.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xba9cb7d0, dwHighDateTime=0x1d585b4)) [0073.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0073.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0073.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.488] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.488] GetLastError () returned 0x0 [0073.488] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.488] GetLastError () returned 0x0 [0073.523] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.523] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x277, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x277, lpOverlapped=0x0) returned 1 [0073.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.524] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.524] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.524] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.525] CloseHandle (hObject=0x104) returned 1 [0073.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0073.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.527] GetLastError () returned 0x0 [0073.527] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x310f38) returned 1 [0073.528] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.528] CryptReleaseContext (hProv=0x310f38, dwFlags=0x0) returned 1 [0073.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.528] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19352937657) returned 1 [0073.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbaa3dbf0, dwHighDateTime=0x1d585b4)) [0073.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff58 [0073.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff58 | out: hHeap=0x260000) returned 1 [0073.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.529] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.529] GetLastError () returned 0x0 [0073.529] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.529] GetLastError () returned 0x0 [0073.536] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.536] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.538] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.538] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.629] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.629] CloseHandle (hObject=0x104) returned 1 [0073.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c498 [0073.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c498 | out: hHeap=0x260000) returned 1 [0073.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.631] GetLastError () returned 0x0 [0073.632] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295d148) returned 1 [0073.633] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.633] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0073.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.633] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19363434320) returned 1 [0073.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbab48590, dwHighDateTime=0x1d585b4)) [0073.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d668 [0073.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d668 | out: hHeap=0x260000) returned 1 [0073.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.634] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.634] GetLastError () returned 0x0 [0073.634] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.634] GetLastError () returned 0x0 [0073.637] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe9200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.637] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x16e00, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x16e00, lpOverlapped=0x0) returned 1 [0073.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.642] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.642] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.643] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.643] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.643] CloseHandle (hObject=0x104) returned 1 [0073.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.[deadmin@cock.li].deadmin")) returned 1 [0073.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.645] GetLastError () returned 0x0 [0073.646] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27560e8) returned 1 [0073.646] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.646] CryptReleaseContext (hProv=0x27560e8, dwFlags=0x0) returned 1 [0073.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.647] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19364782570) returned 1 [0073.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbab48590, dwHighDateTime=0x1d585b4)) [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d358 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d358 | out: hHeap=0x260000) returned 1 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.647] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.740] GetLastError () returned 0x0 [0073.740] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.740] GetLastError () returned 0x0 [0073.743] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff690, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.743] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x970, lpOverlapped=0x0) returned 1 [0073.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.744] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.744] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.744] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.745] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.746] CloseHandle (hObject=0x104) returned 1 [0073.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c498 [0073.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.[deadmin@cock.li].deadmin")) returned 1 [0073.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c498 | out: hHeap=0x260000) returned 1 [0073.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.748] GetLastError () returned 0x0 [0073.748] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756170) returned 1 [0073.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.749] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0073.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.749] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19375007926) returned 1 [0073.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbac52f30, dwHighDateTime=0x1d585b4)) [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30da20 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da20 | out: hHeap=0x260000) returned 1 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.750] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.750] GetLastError () returned 0x0 [0073.750] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.750] GetLastError () returned 0x0 [0073.755] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.756] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.759] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.759] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.773] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.773] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.774] CloseHandle (hObject=0x104) returned 1 [0073.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.778] GetLastError () returned 0x0 [0073.779] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3110d0) returned 1 [0073.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.780] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.780] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19378109497) returned 1 [0073.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbac9f1f0, dwHighDateTime=0x1d585b4)) [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d9e8 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9e8 | out: hHeap=0x260000) returned 1 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27586e8 [0073.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.781] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.781] GetLastError () returned 0x0 [0073.781] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.781] GetLastError () returned 0x0 [0073.786] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.786] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x277, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x277, lpOverlapped=0x0) returned 1 [0073.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.787] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.787] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.788] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.788] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.789] CloseHandle (hObject=0x104) returned 1 [0073.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0073.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.791] GetLastError () returned 0x0 [0073.792] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3110d0) returned 1 [0073.793] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.793] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.793] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19379453403) returned 1 [0073.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbacc5350, dwHighDateTime=0x1d585b4)) [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6a0 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6a0 | out: hHeap=0x260000) returned 1 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27582c0 [0073.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.794] GetLastError () returned 0x0 [0073.795] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.795] GetLastError () returned 0x0 [0073.796] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.796] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xcf, lpOverlapped=0x0) returned 1 [0073.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.797] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.797] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.798] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.798] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.799] CloseHandle (hObject=0x104) returned 1 [0073.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.801] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.801] GetLastError () returned 0x0 [0073.802] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3110d0) returned 1 [0073.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.803] CryptReleaseContext (hProv=0x3110d0, dwFlags=0x0) returned 1 [0073.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.803] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19380402666) returned 1 [0073.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbacc5350, dwHighDateTime=0x1d585b4)) [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6d8 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6d8 | out: hHeap=0x260000) returned 1 [0073.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0073.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.888] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0073.888] GetLastError () returned 0x0 [0073.888] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0073.888] GetLastError () returned 0x0 [0073.895] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.895] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0073.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.896] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.896] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.897] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.897] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.897] CloseHandle (hObject=0x104) returned 1 [0073.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0073.899] GetLastError () returned 0x0 [0073.900] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756060) returned 1 [0073.981] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.985] CryptReleaseContext (hProv=0x2756060, dwFlags=0x0) returned 1 [0073.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0073.989] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19399056521) returned 1 [0073.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbae8e3d0, dwHighDateTime=0x1d585b4)) [0073.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0073.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0073.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d518 [0073.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d518 | out: hHeap=0x260000) returned 1 [0073.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3269d0 [0073.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.000] GetLastError () returned 0x0 [0074.000] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.000] GetLastError () returned 0x0 [0074.012] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.012] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2b80, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x2b80, lpOverlapped=0x0) returned 1 [0074.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.013] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.014] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.014] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.015] CloseHandle (hObject=0x104) returned 1 [0074.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.043] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0074.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.056] GetLastError () returned 0x0 [0074.056] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756280) returned 1 [0074.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.057] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0074.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.057] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19405860587) returned 1 [0074.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbaf4cab0, dwHighDateTime=0x1d585b4)) [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d748 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d748 | out: hHeap=0x260000) returned 1 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315770 [0074.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0074.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315770 | out: hHeap=0x260000) returned 1 [0074.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.058] GetLastError () returned 0x0 [0074.059] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.059] GetLastError () returned 0x0 [0074.060] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffd70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.061] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x290, lpOverlapped=0x0) returned 1 [0074.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.061] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.062] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.062] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.062] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.063] CloseHandle (hObject=0x104) returned 1 [0074.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0074.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.065] GetLastError () returned 0x0 [0074.065] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756280) returned 1 [0074.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.066] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0074.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.066] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19406739581) returned 1 [0074.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbaf4cab0, dwHighDateTime=0x1d585b4)) [0074.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d780 [0074.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d780 | out: hHeap=0x260000) returned 1 [0074.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315968 [0074.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0074.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315968 | out: hHeap=0x260000) returned 1 [0074.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.067] GetLastError () returned 0x0 [0074.067] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.067] GetLastError () returned 0x0 [0074.068] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.068] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xd4, lpOverlapped=0x0) returned 1 [0074.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.069] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.069] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.070] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.070] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.071] CloseHandle (hObject=0x104) returned 1 [0074.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0074.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.073] GetLastError () returned 0x0 [0074.073] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756280) returned 1 [0074.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.074] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0074.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.074] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19407529169) returned 1 [0074.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbaf72c10, dwHighDateTime=0x1d585b4)) [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7b8 [0074.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7b8 | out: hHeap=0x260000) returned 1 [0074.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315a10 [0074.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0074.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315a10 | out: hHeap=0x260000) returned 1 [0074.075] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.075] GetLastError () returned 0x0 [0074.075] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.075] GetLastError () returned 0x0 [0074.076] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.076] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0074.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.077] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.078] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.078] CloseHandle (hObject=0x104) returned 1 [0074.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0074.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.080] GetLastError () returned 0x0 [0074.080] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756280) returned 1 [0074.081] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.081] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0074.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.082] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19408264515) returned 1 [0074.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbaf72c10, dwHighDateTime=0x1d585b4)) [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d7f0 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d7f0 | out: hHeap=0x260000) returned 1 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752060 [0074.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0074.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752060 | out: hHeap=0x260000) returned 1 [0074.082] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.082] GetLastError () returned 0x0 [0074.083] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.083] GetLastError () returned 0x0 [0074.083] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.084] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0074.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0074.084] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.084] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.214] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.214] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.214] CloseHandle (hObject=0x104) returned 1 [0074.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0074.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.216] GetLastError () returned 0x0 [0074.217] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756528) returned 1 [0074.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.218] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.218] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19421892147) returned 1 [0074.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb0c9870, dwHighDateTime=0x1d585b4)) [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1290 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1290 | out: hHeap=0x260000) returned 1 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325800 [0074.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.219] GetLastError () returned 0x0 [0074.219] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.219] GetLastError () returned 0x0 [0074.222] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff6a80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.222] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9580, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x9580, lpOverlapped=0x0) returned 1 [0074.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.223] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.223] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.224] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.224] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.224] CloseHandle (hObject=0x104) returned 1 [0074.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0074.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.226] GetLastError () returned 0x0 [0074.227] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756528) returned 1 [0074.227] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.227] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.228] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19422879694) returned 1 [0074.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb0ef9d0, dwHighDateTime=0x1d585b4)) [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1258 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1258 | out: hHeap=0x260000) returned 1 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326478 [0074.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.228] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.229] GetLastError () returned 0x0 [0074.229] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.229] GetLastError () returned 0x0 [0074.231] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.231] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.232] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.234] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.234] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.235] CloseHandle (hObject=0x104) returned 1 [0074.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0074.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.237] GetLastError () returned 0x0 [0074.238] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27561f8) returned 1 [0074.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.238] CryptReleaseContext (hProv=0x27561f8, dwFlags=0x0) returned 1 [0074.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.239] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19423971392) returned 1 [0074.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb0ef9d0, dwHighDateTime=0x1d585b4)) [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1220 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1220 | out: hHeap=0x260000) returned 1 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3265a8 [0074.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.239] GetLastError () returned 0x0 [0074.240] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.240] GetLastError () returned 0x0 [0074.241] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.241] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0074.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.242] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.242] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.243] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.243] CloseHandle (hObject=0x104) returned 1 [0074.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.[deadmin@cock.li].deadmin")) returned 1 [0074.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.245] GetLastError () returned 0x0 [0074.246] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27566c0) returned 1 [0074.247] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.247] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.247] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19424831625) returned 1 [0074.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb115b30, dwHighDateTime=0x1d585b4)) [0074.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11e8 [0074.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a11e8 | out: hHeap=0x260000) returned 1 [0074.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3265a8 [0074.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.248] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.248] GetLastError () returned 0x0 [0074.248] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.248] GetLastError () returned 0x0 [0074.342] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.342] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.344] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.344] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.344] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.345] CloseHandle (hObject=0x104) returned 1 [0074.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.345] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.[deadmin@cock.li].deadmin")) returned 1 [0074.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.347] GetLastError () returned 0x0 [0074.347] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756528) returned 1 [0074.348] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.348] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.348] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19435502275) returned 1 [0074.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb2204d0, dwHighDateTime=0x1d585b4)) [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d258 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d258 | out: hHeap=0x260000) returned 1 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0074.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.355] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.356] GetLastError () returned 0x0 [0074.356] GetLastError () returned 0x0 [0074.356] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.356] GetLastError () returned 0x0 [0074.357] GetLastError () returned 0x0 [0074.357] ReadFile (in: hFile=0x104, lpBuffer=0x29660b8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.361] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.363] ReadFile (in: hFile=0x104, lpBuffer=0x29660b8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.365] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.366] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.367] ReadFile (in: hFile=0x104, lpBuffer=0x29660b8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.367] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.368] ReadFile (in: hFile=0x104, lpBuffer=0x29660b8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesRead=0x238fdb0*=0x4777, lpOverlapped=0x0) returned 1 [0074.368] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb889, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.369] WriteFile (in: hFile=0x104, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4777, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x4777, lpOverlapped=0x0) returned 1 [0074.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.369] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.369] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.370] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.370] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.371] CloseHandle (hObject=0x104) returned 1 [0074.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.[deadmin@cock.li].deadmin")) returned 1 [0074.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.374] GetLastError () returned 0x0 [0074.374] RtlWakeConditionVariable () returned 0x27e828 [0074.374] GetCurrentThreadId () returned 0x99c [0074.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".ldf") returned 0x0 [0074.374] lstrlenW (lpString=".vhd") returned 4 [0074.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".vhd") returned 0x0 [0074.374] lstrlenW (lpString=".vhdx") returned 5 [0074.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".vhdx") returned 0x0 [0074.374] lstrlenW (lpString=".pst") returned 4 [0074.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".pst") returned 0x0 [0074.374] lstrlenW (lpString=".ost") returned 4 [0074.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".ost") returned 0x0 [0074.375] lstrlenW (lpString=".bak") returned 4 [0074.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".bak") returned 0x0 [0074.375] lstrlenW (lpString=".bac") returned 4 [0074.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".bac") returned 0x0 [0074.375] lstrlenW (lpString=".sys") returned 4 [0074.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".sys") returned 0x0 [0074.375] lstrlenW (lpString=".v2i") returned 4 [0074.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".v2i") returned 0x0 [0074.375] lstrlenW (lpString="s\r\n.v2i") returned 7 [0074.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0074.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0074.377] lstrlenW (lpString=".sql") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".sql") returned 0x0 [0074.377] lstrlenW (lpString=".mdf") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".mdf") returned 0x0 [0074.377] lstrlenW (lpString=".txt") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".txt") returned 0x0 [0074.377] lstrlenW (lpString=".dbf") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".dbf") returned 0x0 [0074.377] lstrlenW (lpString=".ckp") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".ckp") returned 0x0 [0074.377] lstrlenW (lpString=".dacpac") returned 7 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".dacpac") returned 0x0 [0074.377] lstrlenW (lpString=".db3") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".db3") returned 0x0 [0074.377] lstrlenW (lpString=".dtxs") returned 5 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".dtxs") returned 0x0 [0074.377] lstrlenW (lpString=".mdt") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".mdt") returned 0x0 [0074.377] lstrlenW (lpString=".sdf") returned 4 [0074.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".sdf") returned 0x0 [0074.377] lstrlenW (lpString=".MDF") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".MDF") returned 0x0 [0074.378] lstrlenW (lpString=".DBF") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".DBF") returned 0x0 [0074.378] lstrlenW (lpString=".DB") returned 3 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".DB") returned 0x0 [0074.378] lstrlenW (lpString=".db") returned 3 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".db") returned 0x0 [0074.378] lstrlenW (lpString=".ndf") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".ndf") returned 0x0 [0074.378] lstrlenW (lpString=".NDF") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".NDF") returned 0x0 [0074.378] lstrlenW (lpString=".Mdf") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".Mdf") returned 0x0 [0074.378] lstrlenW (lpString=".dat") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".dat") returned 0x0 [0074.378] lstrlenW (lpString=".DAT") returned 4 [0074.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", lpSrch=".DAT") returned=".DAT" [0074.378] lstrlenW (lpString=".DAT") returned 4 [0074.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a6b0 [0074.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0074.378] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756528) returned 1 [0074.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.380] CryptReleaseContext (hProv=0x2756528, dwFlags=0x0) returned 1 [0074.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.380] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19438111116) returned 1 [0074.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb246630, dwHighDateTime=0x1d585b4)) [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d290 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d290 | out: hHeap=0x260000) returned 1 [0074.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a2c0 [0074.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.431] GetLastError () returned 0x0 [0074.431] GetLastError () returned 0x0 [0074.431] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.432] GetLastError () returned 0x0 [0074.432] GetLastError () returned 0x0 [0074.435] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.435] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.436] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.438] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.438] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.438] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.441] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.441] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.441] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.444] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.444] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.445] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.445] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.445] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.445] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.447] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.448] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.449] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.449] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.449] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.450] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.450] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.451] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.453] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.453] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.453] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.453] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.454] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.454] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.454] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.466] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.466] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.467] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.467] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.467] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.468] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.468] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.468] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.469] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.474] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.474] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.474] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.475] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.475] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.475] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.476] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.477] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.477] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.477] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.477] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.478] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.478] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.478] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.479] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.479] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.479] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.480] ReadFile (in: hFile=0x104, lpBuffer=0x290c098, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesRead=0x238fdb0*=0x18978, lpOverlapped=0x0) returned 1 [0074.480] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.480] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x18978, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x238fdb0*=0x18978, lpOverlapped=0x0) returned 1 [0074.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0074.480] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.481] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.481] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.481] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.481] CloseHandle (hObject=0x104) returned 1 [0074.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c948 [0074.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.[deadmin@cock.li].deadmin")) returned 1 [0074.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c948 | out: hHeap=0x260000) returned 1 [0074.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.643] GetLastError () returned 0x0 [0074.657] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0074.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.657] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.658] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19465878275) returned 1 [0074.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb4f3ef0, dwHighDateTime=0x1d585b4)) [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5438 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5438 | out: hHeap=0x260000) returned 1 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752258 [0074.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326218 [0074.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752258 | out: hHeap=0x260000) returned 1 [0074.658] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.659] GetLastError () returned 0x0 [0074.659] GetLastError () returned 0x0 [0074.659] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.659] GetLastError () returned 0x0 [0074.659] GetLastError () returned 0x0 [0074.662] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff9200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.662] WriteFile (in: hFile=0x100, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x6e00, lpOverlapped=0x0) returned 1 [0074.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.664] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.664] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.665] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.666] CloseHandle (hObject=0x100) returned 1 [0074.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c948 [0074.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.[deadmin@cock.li].deadmin")) returned 1 [0074.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c948 | out: hHeap=0x260000) returned 1 [0074.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.670] GetLastError () returned 0x0 [0074.671] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0074.672] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.672] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.672] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19467339574) returned 1 [0074.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb51a050, dwHighDateTime=0x1d585b4)) [0074.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5400 [0074.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5400 | out: hHeap=0x260000) returned 1 [0074.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27521b0 [0074.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0074.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27521b0 | out: hHeap=0x260000) returned 1 [0074.673] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.673] GetLastError () returned 0x0 [0074.673] GetLastError () returned 0x0 [0074.673] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.674] GetLastError () returned 0x0 [0074.674] GetLastError () returned 0x0 [0074.677] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.677] WriteFile (in: hFile=0x100, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.678] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.678] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.679] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.680] CloseHandle (hObject=0x100) returned 1 [0074.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css.[deadmin@cock.li].deadmin")) returned 1 [0074.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.682] GetLastError () returned 0x0 [0074.682] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0074.683] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.683] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.683] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19468427099) returned 1 [0074.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb5401b0, dwHighDateTime=0x1d585b4)) [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5470 [0074.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5470 | out: hHeap=0x260000) returned 1 [0074.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0074.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0074.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0074.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.684] GetLastError () returned 0x0 [0074.684] GetLastError () returned 0x0 [0074.684] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.684] GetLastError () returned 0x0 [0074.685] GetLastError () returned 0x0 [0074.687] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.687] WriteFile (in: hFile=0x100, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.689] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.689] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.689] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.689] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.690] CloseHandle (hObject=0x100) returned 1 [0074.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css.[deadmin@cock.li].deadmin")) returned 1 [0074.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.692] GetLastError () returned 0x0 [0074.813] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0074.814] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.814] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.814] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19481544784) returned 1 [0074.814] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb670cb0, dwHighDateTime=0x1d585b4)) [0074.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x288e778 [0074.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x288e778 | out: hHeap=0x260000) returned 1 [0074.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752450 [0074.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752450 | out: hHeap=0x260000) returned 1 [0074.815] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.815] GetLastError () returned 0x0 [0074.815] GetLastError () returned 0x0 [0074.816] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.816] GetLastError () returned 0x0 [0074.816] GetLastError () returned 0x0 [0074.819] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.819] WriteFile (in: hFile=0x11c, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.820] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.821] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.821] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.821] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.822] CloseHandle (hObject=0x11c) returned 1 [0074.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0074.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css.[deadmin@cock.li].deadmin")) returned 1 [0074.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0074.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.824] GetLastError () returned 0x0 [0074.824] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x295f920) returned 1 [0074.825] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0074.825] CryptReleaseContext (hProv=0x295f920, dwFlags=0x0) returned 1 [0074.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.825] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19482601028) returned 1 [0074.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb696e10, dwHighDateTime=0x1d585b4)) [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5198 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5198 | out: hHeap=0x260000) returned 1 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27525a0 [0074.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27525a0 | out: hHeap=0x260000) returned 1 [0074.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.826] GetLastError () returned 0x0 [0074.826] GetLastError () returned 0x0 [0074.826] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.826] GetLastError () returned 0x0 [0074.826] GetLastError () returned 0x0 [0074.829] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.829] WriteFile (in: hFile=0x11c, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.830] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.831] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.831] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.831] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.832] CloseHandle (hObject=0x11c) returned 1 [0074.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0074.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css.[deadmin@cock.li].deadmin")) returned 1 [0074.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0074.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0074.834] GetLastError () returned 0x0 [0074.834] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0074.835] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.835] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0074.835] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19483609071) returned 1 [0074.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb6bcf70, dwHighDateTime=0x1d585b4)) [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f51d0 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f51d0 | out: hHeap=0x260000) returned 1 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752648 [0074.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752648 | out: hHeap=0x260000) returned 1 [0074.836] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0074.836] GetLastError () returned 0x0 [0074.836] GetLastError () returned 0x0 [0074.836] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0074.836] GetLastError () returned 0x0 [0074.836] GetLastError () returned 0x0 [0074.975] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.975] WriteFile (in: hFile=0x11c, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0074.976] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.976] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.001] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.001] CloseHandle (hObject=0x11c) returned 1 [0075.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css.[deadmin@cock.li].deadmin")) returned 1 [0075.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.041] GetLastError () returned 0x0 [0075.047] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.047] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.047] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.048] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19504874167) returned 1 [0075.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb8ac150, dwHighDateTime=0x1d585b4)) [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x288e9a8 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x288e9a8 | out: hHeap=0x260000) returned 1 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27526f0 [0075.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27526f0 | out: hHeap=0x260000) returned 1 [0075.048] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.049] GetLastError () returned 0x0 [0075.049] GetLastError () returned 0x0 [0075.049] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.049] GetLastError () returned 0x0 [0075.049] GetLastError () returned 0x0 [0075.061] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.061] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.062] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.062] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.064] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.064] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.065] CloseHandle (hObject=0x11c) returned 1 [0075.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css.[deadmin@cock.li].deadmin")) returned 1 [0075.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.067] GetLastError () returned 0x0 [0075.067] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.068] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.068] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.069] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19506966128) returned 1 [0075.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb8f8410, dwHighDateTime=0x1d585b4)) [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f10 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f10 | out: hHeap=0x260000) returned 1 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752cd8 [0075.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752cd8 | out: hHeap=0x260000) returned 1 [0075.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.069] GetLastError () returned 0x0 [0075.070] GetLastError () returned 0x0 [0075.070] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.070] GetLastError () returned 0x0 [0075.070] GetLastError () returned 0x0 [0075.073] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.073] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.075] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.075] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.077] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.077] CloseHandle (hObject=0x11c) returned 1 [0075.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css.[deadmin@cock.li].deadmin")) returned 1 [0075.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.079] GetLastError () returned 0x0 [0075.080] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.081] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.081] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.081] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19508196159) returned 1 [0075.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbb8f8410, dwHighDateTime=0x1d585b4)) [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ed8 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ed8 | out: hHeap=0x260000) returned 1 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752e28 [0075.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752e28 | out: hHeap=0x260000) returned 1 [0075.082] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.082] GetLastError () returned 0x0 [0075.082] GetLastError () returned 0x0 [0075.082] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.082] GetLastError () returned 0x0 [0075.082] GetLastError () returned 0x0 [0075.329] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.329] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.330] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.330] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.332] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.332] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.332] CloseHandle (hObject=0x11c) returned 1 [0075.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css.[deadmin@cock.li].deadmin")) returned 1 [0075.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.334] GetLastError () returned 0x0 [0075.335] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.336] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.336] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.336] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19533710378) returned 1 [0075.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbbb7fb70, dwHighDateTime=0x1d585b4)) [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1178 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0075.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752ed0 [0075.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752ed0 | out: hHeap=0x260000) returned 1 [0075.337] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.337] GetLastError () returned 0x0 [0075.337] GetLastError () returned 0x0 [0075.337] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.337] GetLastError () returned 0x0 [0075.337] GetLastError () returned 0x0 [0075.340] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.340] WriteFile (in: hFile=0x11c, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0075.341] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.341] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.342] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.343] CloseHandle (hObject=0x11c) returned 1 [0075.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css.[deadmin@cock.li].deadmin")) returned 1 [0075.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.345] GetLastError () returned 0x0 [0075.346] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.346] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.347] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19534770715) returned 1 [0075.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbbb7fb70, dwHighDateTime=0x1d585b4)) [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1140 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752f78 [0075.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752f78 | out: hHeap=0x260000) returned 1 [0075.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.347] GetLastError () returned 0x0 [0075.348] GetLastError () returned 0x0 [0075.348] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.348] GetLastError () returned 0x0 [0075.348] GetLastError () returned 0x0 [0075.351] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.351] WriteFile (in: hFile=0x11c, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0075.352] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.352] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.354] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.354] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.355] CloseHandle (hObject=0x11c) returned 1 [0075.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css.[deadmin@cock.li].deadmin")) returned 1 [0075.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.357] GetLastError () returned 0x0 [0075.357] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.358] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.358] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19535912269) returned 1 [0075.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbbba5cd0, dwHighDateTime=0x1d585b4)) [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3381f8 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381f8 | out: hHeap=0x260000) returned 1 [0075.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753020 [0075.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753020 | out: hHeap=0x260000) returned 1 [0075.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.359] GetLastError () returned 0x0 [0075.359] GetLastError () returned 0x0 [0075.359] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.359] GetLastError () returned 0x0 [0075.361] GetLastError () returned 0x0 [0075.364] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.364] WriteFile (in: hFile=0x11c, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0075.365] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.365] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.439] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.439] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.440] CloseHandle (hObject=0x11c) returned 1 [0075.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css.[deadmin@cock.li].deadmin")) returned 1 [0075.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.654] GetLastError () returned 0x0 [0075.667] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.677] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.678] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19567881509) returned 1 [0075.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbbec59b0, dwHighDateTime=0x1d585b4)) [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299868 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753800 [0075.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753800 | out: hHeap=0x260000) returned 1 [0075.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.679] GetLastError () returned 0x0 [0075.679] GetLastError () returned 0x0 [0075.679] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.679] GetLastError () returned 0x0 [0075.679] GetLastError () returned 0x0 [0075.683] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.683] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0075.685] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.685] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.687] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.687] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.687] CloseHandle (hObject=0x11c) returned 1 [0075.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0075.688] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css.[deadmin@cock.li].deadmin")) returned 1 [0075.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0075.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.689] GetLastError () returned 0x0 [0075.690] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.690] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.690] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.691] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19569169322) returned 1 [0075.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbbec59b0, dwHighDateTime=0x1d585b4)) [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299830 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753758 [0075.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753758 | out: hHeap=0x260000) returned 1 [0075.692] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.692] GetLastError () returned 0x0 [0075.692] GetLastError () returned 0x0 [0075.692] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.692] GetLastError () returned 0x0 [0075.692] GetLastError () returned 0x0 [0075.695] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.695] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0075.696] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.696] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.698] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.698] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.699] CloseHandle (hObject=0x11c) returned 1 [0075.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css.[deadmin@cock.li].deadmin")) returned 1 [0075.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.896] GetLastError () returned 0x0 [0075.906] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.911] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.911] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19591190972) returned 1 [0075.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc100e50, dwHighDateTime=0x1d585b4)) [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294758 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c82f8 [0075.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c82f8 | out: hHeap=0x260000) returned 1 [0075.912] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.912] GetLastError () returned 0x0 [0075.912] GetLastError () returned 0x0 [0075.912] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.912] GetLastError () returned 0x0 [0075.912] GetLastError () returned 0x0 [0075.915] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.916] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.917] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.918] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.918] CloseHandle (hObject=0x11c) returned 1 [0075.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css.[deadmin@cock.li].deadmin")) returned 1 [0075.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.921] GetLastError () returned 0x0 [0075.921] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.922] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.922] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.922] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19592361853) returned 1 [0075.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc100e50, dwHighDateTime=0x1d585b4)) [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294838 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294838 | out: hHeap=0x260000) returned 1 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c83a0 [0075.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c83a0 | out: hHeap=0x260000) returned 1 [0075.923] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.923] GetLastError () returned 0x0 [0075.924] GetLastError () returned 0x0 [0075.924] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.924] GetLastError () returned 0x0 [0075.924] GetLastError () returned 0x0 [0075.936] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.936] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.937] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.937] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.938] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.938] CloseHandle (hObject=0x11c) returned 1 [0075.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css.[deadmin@cock.li].deadmin")) returned 1 [0075.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.940] GetLastError () returned 0x0 [0075.940] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.941] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.941] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.942] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19594280625) returned 1 [0075.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc14d110, dwHighDateTime=0x1d585b4)) [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948a8 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948a8 | out: hHeap=0x260000) returned 1 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c84f0 [0075.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c84f0 | out: hHeap=0x260000) returned 1 [0075.942] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.943] GetLastError () returned 0x0 [0075.943] GetLastError () returned 0x0 [0075.943] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.943] GetLastError () returned 0x0 [0075.943] GetLastError () returned 0x0 [0075.951] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.951] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0075.953] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.953] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.953] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.953] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.954] CloseHandle (hObject=0x11c) returned 1 [0075.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css.[deadmin@cock.li].deadmin")) returned 1 [0075.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.956] GetLastError () returned 0x0 [0075.956] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.957] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.957] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19595818331) returned 1 [0075.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc173270, dwHighDateTime=0x1d585b4)) [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294918 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294918 | out: hHeap=0x260000) returned 1 [0075.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8640 [0075.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8640 | out: hHeap=0x260000) returned 1 [0075.958] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.958] GetLastError () returned 0x0 [0075.958] GetLastError () returned 0x0 [0075.958] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.958] GetLastError () returned 0x0 [0075.958] GetLastError () returned 0x0 [0075.961] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.961] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.963] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.963] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.963] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.963] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.964] CloseHandle (hObject=0x11c) returned 1 [0075.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css.[deadmin@cock.li].deadmin")) returned 1 [0075.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.966] GetLastError () returned 0x0 [0075.966] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0075.967] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.967] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.967] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19596790144) returned 1 [0075.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc173270, dwHighDateTime=0x1d585b4)) [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294950 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294950 | out: hHeap=0x260000) returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8790 [0075.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8790 | out: hHeap=0x260000) returned 1 [0075.967] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.968] GetLastError () returned 0x0 [0075.968] GetLastError () returned 0x0 [0075.968] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.968] GetLastError () returned 0x0 [0075.968] GetLastError () returned 0x0 [0075.971] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.971] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.972] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.973] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.973] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.974] CloseHandle (hObject=0x11c) returned 1 [0075.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css.[deadmin@cock.li].deadmin")) returned 1 [0075.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0075.975] GetLastError () returned 0x0 [0075.976] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756170) returned 1 [0075.977] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.977] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0075.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0075.977] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19597788656) returned 1 [0075.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc1993d0, dwHighDateTime=0x1d585b4)) [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949f8 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8838 [0075.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8838 | out: hHeap=0x260000) returned 1 [0075.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0075.978] GetLastError () returned 0x0 [0075.978] GetLastError () returned 0x0 [0075.978] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0075.978] GetLastError () returned 0x0 [0075.978] GetLastError () returned 0x0 [0076.014] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.014] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0076.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.018] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.018] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.019] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.019] CloseHandle (hObject=0x11c) returned 1 [0076.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css.[deadmin@cock.li].deadmin")) returned 1 [0076.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.021] GetLastError () returned 0x0 [0076.022] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.023] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.023] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.023] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19602424089) returned 1 [0076.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc20b7f0, dwHighDateTime=0x1d585b4)) [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299910 [0076.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299910 | out: hHeap=0x260000) returned 1 [0076.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c88e0 [0076.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c88e0 | out: hHeap=0x260000) returned 1 [0076.024] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.024] GetLastError () returned 0x0 [0076.024] GetLastError () returned 0x0 [0076.024] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.024] GetLastError () returned 0x0 [0076.024] GetLastError () returned 0x0 [0076.027] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb921, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.027] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x46df, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x46df, lpOverlapped=0x0) returned 1 [0076.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.029] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.029] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.030] CloseHandle (hObject=0x11c) returned 1 [0076.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.031] GetLastError () returned 0x0 [0076.032] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.033] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.033] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.033] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19603425330) returned 1 [0076.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc20b7f0, dwHighDateTime=0x1d585b4)) [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0076.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0076.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8b80 [0076.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8b80 | out: hHeap=0x260000) returned 1 [0076.034] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.034] GetLastError () returned 0x0 [0076.034] GetLastError () returned 0x0 [0076.034] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.035] GetLastError () returned 0x0 [0076.035] GetLastError () returned 0x0 [0076.037] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbcf3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.037] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x430d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x430d, lpOverlapped=0x0) returned 1 [0076.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.038] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.038] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.039] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.040] CloseHandle (hObject=0x11c) returned 1 [0076.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.041] GetLastError () returned 0x0 [0076.042] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756170) returned 1 [0076.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0076.043] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0076.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.043] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19604383778) returned 1 [0076.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc231950, dwHighDateTime=0x1d585b4)) [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998a0 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998a0 | out: hHeap=0x260000) returned 1 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8c28 [0076.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8c28 | out: hHeap=0x260000) returned 1 [0076.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.044] GetLastError () returned 0x0 [0076.044] GetLastError () returned 0x0 [0076.044] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.044] GetLastError () returned 0x0 [0076.044] GetLastError () returned 0x0 [0076.046] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa349, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.046] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5cb7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x5cb7, lpOverlapped=0x0) returned 1 [0076.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.048] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.048] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.049] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.050] CloseHandle (hObject=0x11c) returned 1 [0076.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.147] GetLastError () returned 0x0 [0076.181] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.191] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.191] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.191] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19619233130) returned 1 [0076.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc3ae710, dwHighDateTime=0x1d585b4)) [0076.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf10 [0076.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf10 | out: hHeap=0x260000) returned 1 [0076.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c94b0 [0076.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c94b0 | out: hHeap=0x260000) returned 1 [0076.192] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.192] GetLastError () returned 0x0 [0076.192] GetLastError () returned 0x0 [0076.192] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.192] GetLastError () returned 0x0 [0076.193] GetLastError () returned 0x0 [0076.194] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe029, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.194] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1fd7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1fd7, lpOverlapped=0x0) returned 1 [0076.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.195] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.195] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.196] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.196] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.197] CloseHandle (hObject=0x108) returned 1 [0076.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.199] GetLastError () returned 0x0 [0076.199] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.200] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.200] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.200] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19620129037) returned 1 [0076.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc3ae710, dwHighDateTime=0x1d585b4)) [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cae8 [0076.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cae8 | out: hHeap=0x260000) returned 1 [0076.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9210 [0076.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9210 | out: hHeap=0x260000) returned 1 [0076.201] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.201] GetLastError () returned 0x0 [0076.201] GetLastError () returned 0x0 [0076.201] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.201] GetLastError () returned 0x0 [0076.202] GetLastError () returned 0x0 [0076.204] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff97c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.204] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x684, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x684, lpOverlapped=0x0) returned 1 [0076.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.205] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.205] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.206] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.206] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.206] CloseHandle (hObject=0x108) returned 1 [0076.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.208] GetLastError () returned 0x0 [0076.208] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.209] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.209] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.209] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19621052802) returned 1 [0076.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc3d4870, dwHighDateTime=0x1d585b4)) [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f53c8 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f53c8 | out: hHeap=0x260000) returned 1 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9600 [0076.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9600 | out: hHeap=0x260000) returned 1 [0076.210] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.210] GetLastError () returned 0x0 [0076.210] GetLastError () returned 0x0 [0076.211] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.211] GetLastError () returned 0x0 [0076.211] GetLastError () returned 0x0 [0076.212] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe87a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.213] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1786, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1786, lpOverlapped=0x0) returned 1 [0076.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.213] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.214] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.214] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.215] CloseHandle (hObject=0x108) returned 1 [0076.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.216] GetLastError () returned 0x0 [0076.217] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.218] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.218] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.218] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19621888863) returned 1 [0076.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc3d4870, dwHighDateTime=0x1d585b4)) [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca250 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca250 | out: hHeap=0x260000) returned 1 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c96a8 [0076.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c96a8 | out: hHeap=0x260000) returned 1 [0076.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.219] GetLastError () returned 0x0 [0076.219] GetLastError () returned 0x0 [0076.219] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.219] GetLastError () returned 0x0 [0076.219] GetLastError () returned 0x0 [0076.221] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffee4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.221] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x11b3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x11b3, lpOverlapped=0x0) returned 1 [0076.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.222] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.222] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.222] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.222] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.223] CloseHandle (hObject=0x108) returned 1 [0076.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.225] GetLastError () returned 0x0 [0076.303] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.322] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.322] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.323] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19632368600) returned 1 [0076.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc4df210, dwHighDateTime=0x1d585b4)) [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2954d0 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9d38 [0076.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9d38 | out: hHeap=0x260000) returned 1 [0076.323] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.323] GetLastError () returned 0x0 [0076.324] GetLastError () returned 0x0 [0076.324] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.324] GetLastError () returned 0x0 [0076.324] GetLastError () returned 0x0 [0076.327] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa644, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.327] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x59bc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x59bc, lpOverlapped=0x0) returned 1 [0076.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.328] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.328] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.329] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.330] CloseHandle (hObject=0x11c) returned 1 [0076.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.331] GetLastError () returned 0x0 [0076.332] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.333] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.333] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19633463899) returned 1 [0076.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc505370, dwHighDateTime=0x1d585b4)) [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295508 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295508 | out: hHeap=0x260000) returned 1 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c97f8 [0076.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c97f8 | out: hHeap=0x260000) returned 1 [0076.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.334] GetLastError () returned 0x0 [0076.335] GetLastError () returned 0x0 [0076.335] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.335] GetLastError () returned 0x0 [0076.335] GetLastError () returned 0x0 [0076.345] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff6a23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.345] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x95dd, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x95dd, lpOverlapped=0x0) returned 1 [0076.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.347] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.347] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.348] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.348] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.349] CloseHandle (hObject=0x11c) returned 1 [0076.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.351] GetLastError () returned 0x0 [0076.351] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.352] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.352] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.352] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19635318715) returned 1 [0076.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc52b4d0, dwHighDateTime=0x1d585b4)) [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca480 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca480 | out: hHeap=0x260000) returned 1 [0076.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9e88 [0076.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9e88 | out: hHeap=0x260000) returned 1 [0076.353] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.353] GetLastError () returned 0x0 [0076.353] GetLastError () returned 0x0 [0076.353] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.353] GetLastError () returned 0x0 [0076.353] GetLastError () returned 0x0 [0076.355] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.355] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x2bb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x2bb6, lpOverlapped=0x0) returned 1 [0076.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.356] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.356] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.357] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.357] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.358] CloseHandle (hObject=0x11c) returned 1 [0076.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.359] GetLastError () returned 0x0 [0076.360] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.360] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.360] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.361] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19636175924) returned 1 [0076.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc52b4d0, dwHighDateTime=0x1d585b4)) [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca4b8 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca4b8 | out: hHeap=0x260000) returned 1 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9fd8 [0076.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9fd8 | out: hHeap=0x260000) returned 1 [0076.361] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.361] GetLastError () returned 0x0 [0076.362] GetLastError () returned 0x0 [0076.362] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.362] GetLastError () returned 0x0 [0076.362] GetLastError () returned 0x0 [0076.364] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffdc1f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.364] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x23e1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x23e1, lpOverlapped=0x0) returned 1 [0076.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.365] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.365] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.365] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.365] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.366] CloseHandle (hObject=0x11c) returned 1 [0076.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.368] GetLastError () returned 0x0 [0076.383] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.384] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.384] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.384] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19638665422) returned 1 [0076.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc577790, dwHighDateTime=0x1d585b4)) [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca4f0 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca4f0 | out: hHeap=0x260000) returned 1 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ca080 [0076.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca080 | out: hHeap=0x260000) returned 1 [0076.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.386] GetLastError () returned 0x0 [0076.387] GetLastError () returned 0x0 [0076.387] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.387] GetLastError () returned 0x0 [0076.387] GetLastError () returned 0x0 [0076.391] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7029, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.391] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8fd7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x8fd7, lpOverlapped=0x0) returned 1 [0076.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.392] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.392] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.392] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.392] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.393] CloseHandle (hObject=0x108) returned 1 [0076.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.395] GetLastError () returned 0x0 [0076.395] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.396] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.396] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19639742137) returned 1 [0076.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc59d8f0, dwHighDateTime=0x1d585b4)) [0076.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca528 [0076.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca528 | out: hHeap=0x260000) returned 1 [0076.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0076.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0076.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.397] GetLastError () returned 0x0 [0076.397] GetLastError () returned 0x0 [0076.397] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.398] GetLastError () returned 0x0 [0076.398] GetLastError () returned 0x0 [0076.400] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff2b5d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.400] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd4a3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd4a3, lpOverlapped=0x0) returned 1 [0076.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.401] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.401] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.401] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.401] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.402] CloseHandle (hObject=0x108) returned 1 [0076.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.404] GetLastError () returned 0x0 [0076.404] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.405] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.405] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19640648612) returned 1 [0076.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc59d8f0, dwHighDateTime=0x1d585b4)) [0076.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca598 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca598 | out: hHeap=0x260000) returned 1 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc250 [0076.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc250 | out: hHeap=0x260000) returned 1 [0076.406] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.406] GetLastError () returned 0x0 [0076.407] GetLastError () returned 0x0 [0076.407] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.407] GetLastError () returned 0x0 [0076.407] GetLastError () returned 0x0 [0076.409] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff509b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.410] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xaf65, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xaf65, lpOverlapped=0x0) returned 1 [0076.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.411] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.411] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.412] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.412] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.412] CloseHandle (hObject=0x108) returned 1 [0076.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.414] GetLastError () returned 0x0 [0076.415] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.416] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.416] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.417] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19641780967) returned 1 [0076.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc5c3a50, dwHighDateTime=0x1d585b4)) [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca5d0 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca5d0 | out: hHeap=0x260000) returned 1 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752258 [0076.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752258 | out: hHeap=0x260000) returned 1 [0076.417] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.418] GetLastError () returned 0x0 [0076.418] GetLastError () returned 0x0 [0076.418] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.418] GetLastError () returned 0x0 [0076.418] GetLastError () returned 0x0 [0076.420] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd126, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.420] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2eda, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x2eda, lpOverlapped=0x0) returned 1 [0076.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.421] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.421] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.422] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.422] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.423] CloseHandle (hObject=0x108) returned 1 [0076.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.424] GetLastError () returned 0x0 [0076.425] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.426] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.457] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19645835380) returned 1 [0076.457] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc635e70, dwHighDateTime=0x1d585b4)) [0076.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca6e8 [0076.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca6e8 | out: hHeap=0x260000) returned 1 [0076.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc4f0 [0076.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b490 [0076.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc4f0 | out: hHeap=0x260000) returned 1 [0076.458] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.458] GetLastError () returned 0x0 [0076.458] GetLastError () returned 0x0 [0076.458] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.458] GetLastError () returned 0x0 [0076.459] GetLastError () returned 0x0 [0076.460] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb9b9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.461] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4647, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x4647, lpOverlapped=0x0) returned 1 [0076.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.462] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.462] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.463] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.463] CloseHandle (hObject=0x108) returned 1 [0076.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.465] GetLastError () returned 0x0 [0076.465] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.466] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.466] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19646778731) returned 1 [0076.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc635e70, dwHighDateTime=0x1d585b4)) [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca720 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca720 | out: hHeap=0x260000) returned 1 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc448 [0076.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc448 | out: hHeap=0x260000) returned 1 [0076.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.468] GetLastError () returned 0x0 [0076.468] GetLastError () returned 0x0 [0076.468] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.468] GetLastError () returned 0x0 [0076.468] GetLastError () returned 0x0 [0076.470] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff5a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.470] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa5e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xa5e, lpOverlapped=0x0) returned 1 [0076.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.471] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.471] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.472] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.472] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.472] CloseHandle (hObject=0x108) returned 1 [0076.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.474] GetLastError () returned 0x0 [0076.474] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.475] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.475] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.475] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19647655547) returned 1 [0076.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc65bfd0, dwHighDateTime=0x1d585b4)) [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca758 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca758 | out: hHeap=0x260000) returned 1 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc6e8 [0076.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc6e8 | out: hHeap=0x260000) returned 1 [0076.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.476] GetLastError () returned 0x0 [0076.476] GetLastError () returned 0x0 [0076.477] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.477] GetLastError () returned 0x0 [0076.477] GetLastError () returned 0x0 [0076.479] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc9fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.479] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3606, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3606, lpOverlapped=0x0) returned 1 [0076.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.480] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.480] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.481] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.481] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.481] CloseHandle (hObject=0x108) returned 1 [0076.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.482] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.484] GetLastError () returned 0x0 [0076.485] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0076.486] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.486] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19648695920) returned 1 [0076.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc65bfd0, dwHighDateTime=0x1d585b4)) [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca790 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca790 | out: hHeap=0x260000) returned 1 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc790 [0076.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc790 | out: hHeap=0x260000) returned 1 [0076.487] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.487] GetLastError () returned 0x0 [0076.487] GetLastError () returned 0x0 [0076.487] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.487] GetLastError () returned 0x0 [0076.487] GetLastError () returned 0x0 [0076.489] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffcfda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.489] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3026, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3026, lpOverlapped=0x0) returned 1 [0076.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.491] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.491] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.492] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.493] CloseHandle (hObject=0x108) returned 1 [0076.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.495] GetLastError () returned 0x0 [0076.495] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0076.496] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.496] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19649724348) returned 1 [0076.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc682130, dwHighDateTime=0x1d585b4)) [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca7c8 [0076.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca7c8 | out: hHeap=0x260000) returned 1 [0076.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc838 [0076.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc838 | out: hHeap=0x260000) returned 1 [0076.497] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.497] GetLastError () returned 0x0 [0076.497] GetLastError () returned 0x0 [0076.497] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.497] GetLastError () returned 0x0 [0076.498] GetLastError () returned 0x0 [0076.528] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdfe7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.528] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2019, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x2019, lpOverlapped=0x0) returned 1 [0076.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.529] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.529] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.529] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.529] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.530] CloseHandle (hObject=0x108) returned 1 [0076.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.600] GetLastError () returned 0x0 [0076.600] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.601] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.601] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.602] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19660266245) returned 1 [0076.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc78cad0, dwHighDateTime=0x1d585b4)) [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca988 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca988 | out: hHeap=0x260000) returned 1 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc8e0 [0076.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc8e0 | out: hHeap=0x260000) returned 1 [0076.602] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.602] GetLastError () returned 0x0 [0076.603] GetLastError () returned 0x0 [0076.603] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.603] GetLastError () returned 0x0 [0076.603] GetLastError () returned 0x0 [0076.607] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb59a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.608] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x4a66, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x4a66, lpOverlapped=0x0) returned 1 [0076.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0076.609] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.609] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.610] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.610] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.610] CloseHandle (hObject=0x11c) returned 1 [0076.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.612] GetLastError () returned 0x0 [0076.613] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.613] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.613] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.614] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19661479398) returned 1 [0076.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc7b2c30, dwHighDateTime=0x1d585b4)) [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca9c0 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca9c0 | out: hHeap=0x260000) returned 1 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cce20 [0076.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cce20 | out: hHeap=0x260000) returned 1 [0076.614] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.615] GetLastError () returned 0x0 [0076.615] GetLastError () returned 0x0 [0076.615] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.615] GetLastError () returned 0x0 [0076.615] GetLastError () returned 0x0 [0076.617] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffcd4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.617] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x32b6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x32b6, lpOverlapped=0x0) returned 1 [0076.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0076.618] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.618] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.619] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.619] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.620] CloseHandle (hObject=0x11c) returned 1 [0076.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.622] GetLastError () returned 0x0 [0076.622] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.623] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.623] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.623] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19662446785) returned 1 [0076.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc7b2c30, dwHighDateTime=0x1d585b4)) [0076.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca9f8 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca9f8 | out: hHeap=0x260000) returned 1 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc4f0 [0076.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b360 [0076.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc4f0 | out: hHeap=0x260000) returned 1 [0076.624] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.624] GetLastError () returned 0x0 [0076.625] GetLastError () returned 0x0 [0076.625] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.625] GetLastError () returned 0x0 [0076.625] GetLastError () returned 0x0 [0076.627] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd5ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.627] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x2a01, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x2a01, lpOverlapped=0x0) returned 1 [0076.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0076.667] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.667] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.668] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.668] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.669] CloseHandle (hObject=0x11c) returned 1 [0076.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.718] GetLastError () returned 0x0 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".sql") returned 0x0 [0076.815] lstrlenW (lpString=".mdf") returned 4 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".mdf") returned 0x0 [0076.815] lstrlenW (lpString=".txt") returned 4 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".txt") returned 0x0 [0076.815] lstrlenW (lpString=".dbf") returned 4 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".dbf") returned 0x0 [0076.815] lstrlenW (lpString=".ckp") returned 4 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".ckp") returned 0x0 [0076.815] lstrlenW (lpString=".dacpac") returned 7 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".dacpac") returned 0x0 [0076.815] lstrlenW (lpString=".db3") returned 4 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".db3") returned 0x0 [0076.815] lstrlenW (lpString=".dtxs") returned 5 [0076.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".dtxs") returned 0x0 [0076.816] lstrlenW (lpString=".mdt") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".mdt") returned 0x0 [0076.816] lstrlenW (lpString=".sdf") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".sdf") returned 0x0 [0076.816] lstrlenW (lpString=".MDF") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".MDF") returned 0x0 [0076.816] lstrlenW (lpString=".DBF") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".DBF") returned 0x0 [0076.816] lstrlenW (lpString=".DB") returned 3 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".DB") returned 0x0 [0076.816] lstrlenW (lpString=".db") returned 3 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".db") returned 0x0 [0076.816] lstrlenW (lpString=".ndf") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".ndf") returned 0x0 [0076.816] lstrlenW (lpString=".NDF") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".NDF") returned 0x0 [0076.816] lstrlenW (lpString=".Mdf") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".Mdf") returned 0x0 [0076.816] lstrlenW (lpString=".dat") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".dat") returned 0x0 [0076.816] lstrlenW (lpString=".DAT") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".DAT") returned 0x0 [0076.816] lstrlenW (lpString=".ldf") returned 4 [0076.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".ldf") returned 0x0 [0076.816] lstrlenW (lpString=".LDF") returned 4 [0076.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch=".LDF") returned 0x0 [0076.817] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0076.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.817] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.817] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.818] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.818] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19681881822) returned 1 [0076.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc9a1e10, dwHighDateTime=0x1d585b4)) [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cac60 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cac60 | out: hHeap=0x260000) returned 1 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc598 [0076.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b3f8 [0076.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc598 | out: hHeap=0x260000) returned 1 [0076.818] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.819] GetLastError () returned 0x0 [0076.819] GetLastError () returned 0x0 [0076.819] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.819] GetLastError () returned 0x0 [0076.819] GetLastError () returned 0x0 [0076.821] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdb23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.821] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x24dd, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x24dd, lpOverlapped=0x0) returned 1 [0076.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.822] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.822] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.823] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.823] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.824] CloseHandle (hObject=0x108) returned 1 [0076.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.826] GetLastError () returned 0x0 [0076.826] RtlWakeConditionVariable () returned 0x0 [0076.826] GetCurrentThreadId () returned 0x99c [0076.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".ldf") returned 0x0 [0076.826] lstrlenW (lpString=".vhd") returned 4 [0076.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".vhd") returned 0x0 [0076.826] lstrlenW (lpString=".vhdx") returned 5 [0076.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".vhdx") returned 0x0 [0076.826] lstrlenW (lpString=".pst") returned 4 [0076.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".pst") returned 0x0 [0076.826] lstrlenW (lpString=".ost") returned 4 [0076.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".ost") returned 0x0 [0076.826] lstrlenW (lpString=".bak") returned 4 [0076.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".bak") returned 0x0 [0076.827] lstrlenW (lpString=".bac") returned 4 [0076.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".bac") returned 0x0 [0076.827] lstrlenW (lpString=".sys") returned 4 [0076.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".sys") returned 0x0 [0076.827] lstrlenW (lpString=".v2i") returned 4 [0076.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".v2i") returned 0x0 [0076.827] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch="s\r\n.v2i") returned 0x0 [0076.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0076.828] lstrlenW (lpString=".sql") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".sql") returned 0x0 [0076.828] lstrlenW (lpString=".mdf") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".mdf") returned 0x0 [0076.828] lstrlenW (lpString=".txt") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".txt") returned 0x0 [0076.828] lstrlenW (lpString=".dbf") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".dbf") returned 0x0 [0076.828] lstrlenW (lpString=".ckp") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".ckp") returned 0x0 [0076.828] lstrlenW (lpString=".dacpac") returned 7 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".dacpac") returned 0x0 [0076.828] lstrlenW (lpString=".db3") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".db3") returned 0x0 [0076.828] lstrlenW (lpString=".dtxs") returned 5 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".dtxs") returned 0x0 [0076.828] lstrlenW (lpString=".mdt") returned 4 [0076.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".mdt") returned 0x0 [0076.828] lstrlenW (lpString=".sdf") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".sdf") returned 0x0 [0076.829] lstrlenW (lpString=".MDF") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".MDF") returned 0x0 [0076.829] lstrlenW (lpString=".DBF") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".DBF") returned 0x0 [0076.829] lstrlenW (lpString=".DB") returned 3 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".DB") returned 0x0 [0076.829] lstrlenW (lpString=".db") returned 3 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".db") returned 0x0 [0076.829] lstrlenW (lpString=".ndf") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".ndf") returned 0x0 [0076.829] lstrlenW (lpString=".NDF") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".NDF") returned 0x0 [0076.829] lstrlenW (lpString=".Mdf") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".Mdf") returned 0x0 [0076.829] lstrlenW (lpString=".dat") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".dat") returned 0x0 [0076.829] lstrlenW (lpString=".DAT") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".DAT") returned 0x0 [0076.829] lstrlenW (lpString=".ldf") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".ldf") returned 0x0 [0076.829] lstrlenW (lpString=".LDF") returned 4 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch=".LDF") returned 0x0 [0076.829] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0076.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.830] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.830] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.830] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.831] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19683227529) returned 1 [0076.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbc9c7f70, dwHighDateTime=0x1d585b4)) [0076.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cac98 [0076.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cac98 | out: hHeap=0x260000) returned 1 [0076.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd0c0 [0076.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd0c0 | out: hHeap=0x260000) returned 1 [0076.832] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.832] GetLastError () returned 0x0 [0076.832] GetLastError () returned 0x0 [0076.832] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.832] GetLastError () returned 0x0 [0076.833] GetLastError () returned 0x0 [0076.834] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe762, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.834] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x189e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x189e, lpOverlapped=0x0) returned 1 [0076.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0076.834] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.835] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.835] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.835] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.835] CloseHandle (hObject=0x108) returned 1 [0076.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini.[deadmin@cock.li].deadmin")) returned 1 [0076.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.836] GetLastError () returned 0x0 [0076.836] RtlWakeConditionVariable () returned 0x0 [0076.836] GetCurrentThreadId () returned 0x99c [0076.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".ldf") returned 0x0 [0076.836] lstrlenW (lpString=".vhd") returned 4 [0076.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".vhd") returned 0x0 [0076.836] lstrlenW (lpString=".vhdx") returned 5 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".vhdx") returned 0x0 [0076.837] lstrlenW (lpString=".pst") returned 4 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".pst") returned 0x0 [0076.837] lstrlenW (lpString=".ost") returned 4 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".ost") returned 0x0 [0076.837] lstrlenW (lpString=".bak") returned 4 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".bak") returned 0x0 [0076.837] lstrlenW (lpString=".bac") returned 4 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".bac") returned 0x0 [0076.837] lstrlenW (lpString=".sys") returned 4 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".sys") returned 0x0 [0076.837] lstrlenW (lpString=".v2i") returned 4 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".v2i") returned 0x0 [0076.837] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0076.838] lstrlenW (lpString=".sql") returned 4 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".sql") returned 0x0 [0076.838] lstrlenW (lpString=".mdf") returned 4 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".mdf") returned 0x0 [0076.838] lstrlenW (lpString=".txt") returned 4 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".txt") returned 0x0 [0076.838] lstrlenW (lpString=".dbf") returned 4 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".dbf") returned 0x0 [0076.838] lstrlenW (lpString=".ckp") returned 4 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".ckp") returned 0x0 [0076.838] lstrlenW (lpString=".dacpac") returned 7 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".dacpac") returned 0x0 [0076.838] lstrlenW (lpString=".db3") returned 4 [0076.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".db3") returned 0x0 [0076.838] lstrlenW (lpString=".dtxs") returned 5 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".dtxs") returned 0x0 [0076.839] lstrlenW (lpString=".mdt") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".mdt") returned 0x0 [0076.839] lstrlenW (lpString=".sdf") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".sdf") returned 0x0 [0076.839] lstrlenW (lpString=".MDF") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".MDF") returned 0x0 [0076.839] lstrlenW (lpString=".DBF") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".DBF") returned 0x0 [0076.839] lstrlenW (lpString=".DB") returned 3 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".DB") returned 0x0 [0076.839] lstrlenW (lpString=".db") returned 3 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".db") returned 0x0 [0076.839] lstrlenW (lpString=".ndf") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".ndf") returned 0x0 [0076.839] lstrlenW (lpString=".NDF") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".NDF") returned 0x0 [0076.839] lstrlenW (lpString=".Mdf") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".Mdf") returned 0x0 [0076.839] lstrlenW (lpString=".dat") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".dat") returned 0x0 [0076.839] lstrlenW (lpString=".DAT") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".DAT") returned 0x0 [0076.839] lstrlenW (lpString=".ldf") returned 4 [0076.839] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".ldf") returned 0x0 [0076.839] lstrlenW (lpString=".LDF") returned 4 [0076.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch=".LDF") returned 0x0 [0076.840] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0076.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.840] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0076.840] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.841] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0076.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0076.841] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19684184983) returned 1 [0076.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbca14230, dwHighDateTime=0x1d585b4)) [0076.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cad08 [0076.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cad08 | out: hHeap=0x260000) returned 1 [0076.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd0c0 [0076.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b2c8 [0076.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd0c0 | out: hHeap=0x260000) returned 1 [0076.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0076.871] GetLastError () returned 0x0 [0076.871] GetLastError () returned 0x0 [0076.871] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0076.871] GetLastError () returned 0x0 [0076.872] GetLastError () returned 0x0 [0076.872] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffffd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.873] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x29, lpOverlapped=0x0) returned 1 [0076.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.873] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.873] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.873] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.873] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.873] CloseHandle (hObject=0x108) returned 1 [0076.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.229] GetLastError () returned 0x0 [0077.229] RtlWakeConditionVariable () returned 0x0 [0077.229] GetCurrentThreadId () returned 0x99c [0077.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".ldf") returned 0x0 [0077.229] lstrlenW (lpString=".vhd") returned 4 [0077.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".vhd") returned 0x0 [0077.229] lstrlenW (lpString=".vhdx") returned 5 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".vhdx") returned 0x0 [0077.230] lstrlenW (lpString=".pst") returned 4 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".pst") returned 0x0 [0077.230] lstrlenW (lpString=".ost") returned 4 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".ost") returned 0x0 [0077.230] lstrlenW (lpString=".bak") returned 4 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".bak") returned 0x0 [0077.230] lstrlenW (lpString=".bac") returned 4 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".bac") returned 0x0 [0077.230] lstrlenW (lpString=".sys") returned 4 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".sys") returned 0x0 [0077.230] lstrlenW (lpString=".v2i") returned 4 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".v2i") returned 0x0 [0077.230] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.231] lstrlenW (lpString=".sql") returned 4 [0077.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".sql") returned 0x0 [0077.231] lstrlenW (lpString=".mdf") returned 4 [0077.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".mdf") returned 0x0 [0077.231] lstrlenW (lpString=".txt") returned 4 [0077.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".txt") returned 0x0 [0077.231] lstrlenW (lpString=".dbf") returned 4 [0077.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".dbf") returned 0x0 [0077.231] lstrlenW (lpString=".ckp") returned 4 [0077.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".ckp") returned 0x0 [0077.231] lstrlenW (lpString=".dacpac") returned 7 [0077.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".dacpac") returned 0x0 [0077.232] lstrlenW (lpString=".db3") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".db3") returned 0x0 [0077.232] lstrlenW (lpString=".dtxs") returned 5 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".dtxs") returned 0x0 [0077.232] lstrlenW (lpString=".mdt") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".mdt") returned 0x0 [0077.232] lstrlenW (lpString=".sdf") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".sdf") returned 0x0 [0077.232] lstrlenW (lpString=".MDF") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".MDF") returned 0x0 [0077.232] lstrlenW (lpString=".DBF") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".DBF") returned 0x0 [0077.232] lstrlenW (lpString=".DB") returned 3 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".DB") returned 0x0 [0077.232] lstrlenW (lpString=".db") returned 3 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".db") returned 0x0 [0077.232] lstrlenW (lpString=".ndf") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".ndf") returned 0x0 [0077.232] lstrlenW (lpString=".NDF") returned 4 [0077.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".NDF") returned 0x0 [0077.232] lstrlenW (lpString=".Mdf") returned 4 [0077.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".Mdf") returned 0x0 [0077.233] lstrlenW (lpString=".dat") returned 4 [0077.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".dat") returned 0x0 [0077.233] lstrlenW (lpString=".DAT") returned 4 [0077.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".DAT") returned 0x0 [0077.233] lstrlenW (lpString=".ldf") returned 4 [0077.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".ldf") returned 0x0 [0077.233] lstrlenW (lpString=".LDF") returned 4 [0077.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch=".LDF") returned 0x0 [0077.233] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.233] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.234] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.234] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.234] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19723553856) returned 1 [0077.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcd801d0, dwHighDateTime=0x1d585b4)) [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb088 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb088 | out: hHeap=0x260000) returned 1 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd2b8 [0077.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd2b8 | out: hHeap=0x260000) returned 1 [0077.235] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.235] GetLastError () returned 0x0 [0077.236] GetLastError () returned 0x0 [0077.236] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.236] GetLastError () returned 0x0 [0077.236] GetLastError () returned 0x0 [0077.240] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc09f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.240] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3f61, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x3f61, lpOverlapped=0x0) returned 1 [0077.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.240] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.240] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.241] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.241] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.241] CloseHandle (hObject=0xd8) returned 1 [0077.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.242] GetLastError () returned 0x0 [0077.243] RtlWakeConditionVariable () returned 0x0 [0077.243] GetCurrentThreadId () returned 0x99c [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".ldf") returned 0x0 [0077.243] lstrlenW (lpString=".vhd") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".vhd") returned 0x0 [0077.243] lstrlenW (lpString=".vhdx") returned 5 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".vhdx") returned 0x0 [0077.243] lstrlenW (lpString=".pst") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".pst") returned 0x0 [0077.243] lstrlenW (lpString=".ost") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".ost") returned 0x0 [0077.243] lstrlenW (lpString=".bak") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".bak") returned 0x0 [0077.243] lstrlenW (lpString=".bac") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".bac") returned 0x0 [0077.243] lstrlenW (lpString=".sys") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".sys") returned 0x0 [0077.243] lstrlenW (lpString=".v2i") returned 4 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".v2i") returned 0x0 [0077.243] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.244] lstrlenW (lpString=".sql") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".sql") returned 0x0 [0077.245] lstrlenW (lpString=".mdf") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".mdf") returned 0x0 [0077.245] lstrlenW (lpString=".txt") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".txt") returned 0x0 [0077.245] lstrlenW (lpString=".dbf") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".dbf") returned 0x0 [0077.245] lstrlenW (lpString=".ckp") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".ckp") returned 0x0 [0077.245] lstrlenW (lpString=".dacpac") returned 7 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".dacpac") returned 0x0 [0077.245] lstrlenW (lpString=".db3") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".db3") returned 0x0 [0077.245] lstrlenW (lpString=".dtxs") returned 5 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".dtxs") returned 0x0 [0077.245] lstrlenW (lpString=".mdt") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".mdt") returned 0x0 [0077.245] lstrlenW (lpString=".sdf") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".sdf") returned 0x0 [0077.245] lstrlenW (lpString=".MDF") returned 4 [0077.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".MDF") returned 0x0 [0077.246] lstrlenW (lpString=".DBF") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".DBF") returned 0x0 [0077.246] lstrlenW (lpString=".DB") returned 3 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".DB") returned 0x0 [0077.246] lstrlenW (lpString=".db") returned 3 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".db") returned 0x0 [0077.246] lstrlenW (lpString=".ndf") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".ndf") returned 0x0 [0077.246] lstrlenW (lpString=".NDF") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".NDF") returned 0x0 [0077.246] lstrlenW (lpString=".Mdf") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".Mdf") returned 0x0 [0077.246] lstrlenW (lpString=".dat") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".dat") returned 0x0 [0077.246] lstrlenW (lpString=".DAT") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".DAT") returned 0x0 [0077.246] lstrlenW (lpString=".ldf") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".ldf") returned 0x0 [0077.246] lstrlenW (lpString=".LDF") returned 4 [0077.246] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch=".LDF") returned 0x0 [0077.246] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.247] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.248] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.248] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.248] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19724902540) returned 1 [0077.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcda6330, dwHighDateTime=0x1d585b4)) [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb0c0 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb0c0 | out: hHeap=0x260000) returned 1 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cdde0 [0077.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cdde0 | out: hHeap=0x260000) returned 1 [0077.249] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.249] GetLastError () returned 0x0 [0077.249] GetLastError () returned 0x0 [0077.249] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.249] GetLastError () returned 0x0 [0077.250] GetLastError () returned 0x0 [0077.252] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffcd94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.252] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x326c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x326c, lpOverlapped=0x0) returned 1 [0077.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.252] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.252] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.252] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.252] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.252] CloseHandle (hObject=0xd8) returned 1 [0077.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.254] GetLastError () returned 0x0 [0077.254] RtlWakeConditionVariable () returned 0x0 [0077.254] GetCurrentThreadId () returned 0x99c [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".ldf") returned 0x0 [0077.255] lstrlenW (lpString=".vhd") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".vhd") returned 0x0 [0077.255] lstrlenW (lpString=".vhdx") returned 5 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".vhdx") returned 0x0 [0077.255] lstrlenW (lpString=".pst") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".pst") returned 0x0 [0077.255] lstrlenW (lpString=".ost") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".ost") returned 0x0 [0077.255] lstrlenW (lpString=".bak") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".bak") returned 0x0 [0077.255] lstrlenW (lpString=".bac") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".bac") returned 0x0 [0077.255] lstrlenW (lpString=".sys") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".sys") returned 0x0 [0077.255] lstrlenW (lpString=".v2i") returned 4 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".v2i") returned 0x0 [0077.255] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.255] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.257] lstrlenW (lpString=".sql") returned 4 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".sql") returned 0x0 [0077.257] lstrlenW (lpString=".mdf") returned 4 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".mdf") returned 0x0 [0077.257] lstrlenW (lpString=".txt") returned 4 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".txt") returned 0x0 [0077.257] lstrlenW (lpString=".dbf") returned 4 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".dbf") returned 0x0 [0077.257] lstrlenW (lpString=".ckp") returned 4 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".ckp") returned 0x0 [0077.257] lstrlenW (lpString=".dacpac") returned 7 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".dacpac") returned 0x0 [0077.257] lstrlenW (lpString=".db3") returned 4 [0077.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".db3") returned 0x0 [0077.258] lstrlenW (lpString=".dtxs") returned 5 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".dtxs") returned 0x0 [0077.258] lstrlenW (lpString=".mdt") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".mdt") returned 0x0 [0077.258] lstrlenW (lpString=".sdf") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".sdf") returned 0x0 [0077.258] lstrlenW (lpString=".MDF") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".MDF") returned 0x0 [0077.258] lstrlenW (lpString=".DBF") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".DBF") returned 0x0 [0077.258] lstrlenW (lpString=".DB") returned 3 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".DB") returned 0x0 [0077.258] lstrlenW (lpString=".db") returned 3 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".db") returned 0x0 [0077.258] lstrlenW (lpString=".ndf") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".ndf") returned 0x0 [0077.258] lstrlenW (lpString=".NDF") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".NDF") returned 0x0 [0077.258] lstrlenW (lpString=".Mdf") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".Mdf") returned 0x0 [0077.258] lstrlenW (lpString=".dat") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".dat") returned 0x0 [0077.258] lstrlenW (lpString=".DAT") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".DAT") returned 0x0 [0077.258] lstrlenW (lpString=".ldf") returned 4 [0077.258] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".ldf") returned 0x0 [0077.259] lstrlenW (lpString=".LDF") returned 4 [0077.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch=".LDF") returned 0x0 [0077.259] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.259] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.260] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.260] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.260] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19726087189) returned 1 [0077.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcdcc490, dwHighDateTime=0x1d585b4)) [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb0f8 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb0f8 | out: hHeap=0x260000) returned 1 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cde88 [0077.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cde88 | out: hHeap=0x260000) returned 1 [0077.260] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.261] GetLastError () returned 0x0 [0077.261] GetLastError () returned 0x0 [0077.261] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.261] GetLastError () returned 0x0 [0077.261] GetLastError () returned 0x0 [0077.400] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffdf8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.400] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x2072, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x2072, lpOverlapped=0x0) returned 1 [0077.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.403] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.403] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.403] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.403] CloseHandle (hObject=0xd8) returned 1 [0077.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.406] GetLastError () returned 0x0 [0077.406] RtlWakeConditionVariable () returned 0x0 [0077.406] GetCurrentThreadId () returned 0x99c [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".ldf") returned 0x0 [0077.406] lstrlenW (lpString=".vhd") returned 4 [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".vhd") returned 0x0 [0077.406] lstrlenW (lpString=".vhdx") returned 5 [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".vhdx") returned 0x0 [0077.406] lstrlenW (lpString=".pst") returned 4 [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".pst") returned 0x0 [0077.406] lstrlenW (lpString=".ost") returned 4 [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".ost") returned 0x0 [0077.406] lstrlenW (lpString=".bak") returned 4 [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".bak") returned 0x0 [0077.406] lstrlenW (lpString=".bac") returned 4 [0077.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".bac") returned 0x0 [0077.407] lstrlenW (lpString=".sys") returned 4 [0077.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".sys") returned 0x0 [0077.407] lstrlenW (lpString=".v2i") returned 4 [0077.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".v2i") returned 0x0 [0077.407] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.408] lstrlenW (lpString=".sql") returned 4 [0077.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".sql") returned 0x0 [0077.408] lstrlenW (lpString=".mdf") returned 4 [0077.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".mdf") returned 0x0 [0077.408] lstrlenW (lpString=".txt") returned 4 [0077.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".txt") returned 0x0 [0077.408] lstrlenW (lpString=".dbf") returned 4 [0077.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".dbf") returned 0x0 [0077.408] lstrlenW (lpString=".ckp") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".ckp") returned 0x0 [0077.409] lstrlenW (lpString=".dacpac") returned 7 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".dacpac") returned 0x0 [0077.409] lstrlenW (lpString=".db3") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".db3") returned 0x0 [0077.409] lstrlenW (lpString=".dtxs") returned 5 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".dtxs") returned 0x0 [0077.409] lstrlenW (lpString=".mdt") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".mdt") returned 0x0 [0077.409] lstrlenW (lpString=".sdf") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".sdf") returned 0x0 [0077.409] lstrlenW (lpString=".MDF") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".MDF") returned 0x0 [0077.409] lstrlenW (lpString=".DBF") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".DBF") returned 0x0 [0077.409] lstrlenW (lpString=".DB") returned 3 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".DB") returned 0x0 [0077.409] lstrlenW (lpString=".db") returned 3 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".db") returned 0x0 [0077.409] lstrlenW (lpString=".ndf") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".ndf") returned 0x0 [0077.409] lstrlenW (lpString=".NDF") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".NDF") returned 0x0 [0077.409] lstrlenW (lpString=".Mdf") returned 4 [0077.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".Mdf") returned 0x0 [0077.409] lstrlenW (lpString=".dat") returned 4 [0077.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".dat") returned 0x0 [0077.410] lstrlenW (lpString=".DAT") returned 4 [0077.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".DAT") returned 0x0 [0077.410] lstrlenW (lpString=".ldf") returned 4 [0077.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".ldf") returned 0x0 [0077.410] lstrlenW (lpString=".LDF") returned 4 [0077.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch=".LDF") returned 0x0 [0077.410] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.410] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.411] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.411] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19741209442) returned 1 [0077.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcf49250, dwHighDateTime=0x1d585b4)) [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c418 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c418 | out: hHeap=0x260000) returned 1 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0077.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0077.412] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.412] GetLastError () returned 0x0 [0077.412] GetLastError () returned 0x0 [0077.412] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.412] GetLastError () returned 0x0 [0077.412] GetLastError () returned 0x0 [0077.415] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffeab1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.415] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x154f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x154f, lpOverlapped=0x0) returned 1 [0077.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.416] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.416] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.416] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.416] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.416] CloseHandle (hObject=0xd8) returned 1 [0077.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.418] GetLastError () returned 0x0 [0077.418] RtlWakeConditionVariable () returned 0x0 [0077.418] GetCurrentThreadId () returned 0x99c [0077.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".ldf") returned 0x0 [0077.418] lstrlenW (lpString=".vhd") returned 4 [0077.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".vhd") returned 0x0 [0077.418] lstrlenW (lpString=".vhdx") returned 5 [0077.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".vhdx") returned 0x0 [0077.418] lstrlenW (lpString=".pst") returned 4 [0077.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".pst") returned 0x0 [0077.418] lstrlenW (lpString=".ost") returned 4 [0077.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".ost") returned 0x0 [0077.419] lstrlenW (lpString=".bak") returned 4 [0077.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".bak") returned 0x0 [0077.419] lstrlenW (lpString=".bac") returned 4 [0077.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".bac") returned 0x0 [0077.419] lstrlenW (lpString=".sys") returned 4 [0077.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".sys") returned 0x0 [0077.419] lstrlenW (lpString=".v2i") returned 4 [0077.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".v2i") returned 0x0 [0077.419] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.420] lstrlenW (lpString=".sql") returned 4 [0077.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".sql") returned 0x0 [0077.420] lstrlenW (lpString=".mdf") returned 4 [0077.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".mdf") returned 0x0 [0077.420] lstrlenW (lpString=".txt") returned 4 [0077.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".txt") returned 0x0 [0077.421] lstrlenW (lpString=".dbf") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".dbf") returned 0x0 [0077.421] lstrlenW (lpString=".ckp") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".ckp") returned 0x0 [0077.421] lstrlenW (lpString=".dacpac") returned 7 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".dacpac") returned 0x0 [0077.421] lstrlenW (lpString=".db3") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".db3") returned 0x0 [0077.421] lstrlenW (lpString=".dtxs") returned 5 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".dtxs") returned 0x0 [0077.421] lstrlenW (lpString=".mdt") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".mdt") returned 0x0 [0077.421] lstrlenW (lpString=".sdf") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".sdf") returned 0x0 [0077.421] lstrlenW (lpString=".MDF") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".MDF") returned 0x0 [0077.421] lstrlenW (lpString=".DBF") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".DBF") returned 0x0 [0077.421] lstrlenW (lpString=".DB") returned 3 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".DB") returned 0x0 [0077.421] lstrlenW (lpString=".db") returned 3 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".db") returned 0x0 [0077.421] lstrlenW (lpString=".ndf") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".ndf") returned 0x0 [0077.421] lstrlenW (lpString=".NDF") returned 4 [0077.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".NDF") returned 0x0 [0077.422] lstrlenW (lpString=".Mdf") returned 4 [0077.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".Mdf") returned 0x0 [0077.422] lstrlenW (lpString=".dat") returned 4 [0077.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".dat") returned 0x0 [0077.422] lstrlenW (lpString=".DAT") returned 4 [0077.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".DAT") returned 0x0 [0077.422] lstrlenW (lpString=".ldf") returned 4 [0077.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".ldf") returned 0x0 [0077.422] lstrlenW (lpString=".LDF") returned 4 [0077.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch=".LDF") returned 0x0 [0077.422] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.422] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.423] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.423] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.423] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19742422014) returned 1 [0077.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcf6f3b0, dwHighDateTime=0x1d585b4)) [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c338 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c338 | out: hHeap=0x260000) returned 1 [0077.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce2f8 [0077.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce2f8 | out: hHeap=0x260000) returned 1 [0077.424] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.424] GetLastError () returned 0x0 [0077.424] GetLastError () returned 0x0 [0077.424] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.424] GetLastError () returned 0x0 [0077.424] GetLastError () returned 0x0 [0077.426] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff6fa6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.426] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x905a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x905a, lpOverlapped=0x0) returned 1 [0077.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.427] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.427] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.427] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.427] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.427] CloseHandle (hObject=0xd8) returned 1 [0077.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.429] GetLastError () returned 0x0 [0077.429] RtlWakeConditionVariable () returned 0x0 [0077.429] GetCurrentThreadId () returned 0x99c [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".ldf") returned 0x0 [0077.429] lstrlenW (lpString=".vhd") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".vhd") returned 0x0 [0077.429] lstrlenW (lpString=".vhdx") returned 5 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".vhdx") returned 0x0 [0077.429] lstrlenW (lpString=".pst") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".pst") returned 0x0 [0077.429] lstrlenW (lpString=".ost") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".ost") returned 0x0 [0077.429] lstrlenW (lpString=".bak") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".bak") returned 0x0 [0077.429] lstrlenW (lpString=".bac") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".bac") returned 0x0 [0077.429] lstrlenW (lpString=".sys") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".sys") returned 0x0 [0077.429] lstrlenW (lpString=".v2i") returned 4 [0077.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".v2i") returned 0x0 [0077.430] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.431] lstrlenW (lpString=".sql") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".sql") returned 0x0 [0077.431] lstrlenW (lpString=".mdf") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".mdf") returned 0x0 [0077.431] lstrlenW (lpString=".txt") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".txt") returned 0x0 [0077.431] lstrlenW (lpString=".dbf") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".dbf") returned 0x0 [0077.431] lstrlenW (lpString=".ckp") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".ckp") returned 0x0 [0077.431] lstrlenW (lpString=".dacpac") returned 7 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".dacpac") returned 0x0 [0077.431] lstrlenW (lpString=".db3") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".db3") returned 0x0 [0077.431] lstrlenW (lpString=".dtxs") returned 5 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".dtxs") returned 0x0 [0077.431] lstrlenW (lpString=".mdt") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".mdt") returned 0x0 [0077.431] lstrlenW (lpString=".sdf") returned 4 [0077.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".sdf") returned 0x0 [0077.431] lstrlenW (lpString=".MDF") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".MDF") returned 0x0 [0077.432] lstrlenW (lpString=".DBF") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".DBF") returned 0x0 [0077.432] lstrlenW (lpString=".DB") returned 3 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".DB") returned 0x0 [0077.432] lstrlenW (lpString=".db") returned 3 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".db") returned 0x0 [0077.432] lstrlenW (lpString=".ndf") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".ndf") returned 0x0 [0077.432] lstrlenW (lpString=".NDF") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".NDF") returned 0x0 [0077.432] lstrlenW (lpString=".Mdf") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".Mdf") returned 0x0 [0077.432] lstrlenW (lpString=".dat") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".dat") returned 0x0 [0077.432] lstrlenW (lpString=".DAT") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".DAT") returned 0x0 [0077.432] lstrlenW (lpString=".ldf") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".ldf") returned 0x0 [0077.432] lstrlenW (lpString=".LDF") returned 4 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch=".LDF") returned 0x0 [0077.432] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.432] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.433] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.433] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.433] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.434] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19743465113) returned 1 [0077.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcf6f3b0, dwHighDateTime=0x1d585b4)) [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c300 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c300 | out: hHeap=0x260000) returned 1 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce3a0 [0077.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce3a0 | out: hHeap=0x260000) returned 1 [0077.434] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.434] GetLastError () returned 0x0 [0077.435] GetLastError () returned 0x0 [0077.435] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.435] GetLastError () returned 0x0 [0077.435] GetLastError () returned 0x0 [0077.442] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc492, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.442] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3b6e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3b6e, lpOverlapped=0x0) returned 1 [0077.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.442] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.442] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.442] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.442] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.442] CloseHandle (hObject=0xd8) returned 1 [0077.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.444] GetLastError () returned 0x0 [0077.444] RtlWakeConditionVariable () returned 0x0 [0077.444] GetCurrentThreadId () returned 0x99c [0077.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".ldf") returned 0x0 [0077.444] lstrlenW (lpString=".vhd") returned 4 [0077.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".vhd") returned 0x0 [0077.444] lstrlenW (lpString=".vhdx") returned 5 [0077.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".vhdx") returned 0x0 [0077.444] lstrlenW (lpString=".pst") returned 4 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".pst") returned 0x0 [0077.445] lstrlenW (lpString=".ost") returned 4 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".ost") returned 0x0 [0077.445] lstrlenW (lpString=".bak") returned 4 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".bak") returned 0x0 [0077.445] lstrlenW (lpString=".bac") returned 4 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".bac") returned 0x0 [0077.445] lstrlenW (lpString=".sys") returned 4 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".sys") returned 0x0 [0077.445] lstrlenW (lpString=".v2i") returned 4 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".v2i") returned 0x0 [0077.445] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.446] lstrlenW (lpString=".sql") returned 4 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".sql") returned 0x0 [0077.446] lstrlenW (lpString=".mdf") returned 4 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".mdf") returned 0x0 [0077.446] lstrlenW (lpString=".txt") returned 4 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".txt") returned 0x0 [0077.446] lstrlenW (lpString=".dbf") returned 4 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".dbf") returned 0x0 [0077.446] lstrlenW (lpString=".ckp") returned 4 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".ckp") returned 0x0 [0077.446] lstrlenW (lpString=".dacpac") returned 7 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".dacpac") returned 0x0 [0077.446] lstrlenW (lpString=".db3") returned 4 [0077.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".db3") returned 0x0 [0077.447] lstrlenW (lpString=".dtxs") returned 5 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".dtxs") returned 0x0 [0077.447] lstrlenW (lpString=".mdt") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".mdt") returned 0x0 [0077.447] lstrlenW (lpString=".sdf") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".sdf") returned 0x0 [0077.447] lstrlenW (lpString=".MDF") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".MDF") returned 0x0 [0077.447] lstrlenW (lpString=".DBF") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".DBF") returned 0x0 [0077.447] lstrlenW (lpString=".DB") returned 3 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".DB") returned 0x0 [0077.447] lstrlenW (lpString=".db") returned 3 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".db") returned 0x0 [0077.447] lstrlenW (lpString=".ndf") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".ndf") returned 0x0 [0077.447] lstrlenW (lpString=".NDF") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".NDF") returned 0x0 [0077.447] lstrlenW (lpString=".Mdf") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".Mdf") returned 0x0 [0077.447] lstrlenW (lpString=".dat") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".dat") returned 0x0 [0077.447] lstrlenW (lpString=".DAT") returned 4 [0077.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".DAT") returned 0x0 [0077.447] lstrlenW (lpString=".ldf") returned 4 [0077.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".ldf") returned 0x0 [0077.448] lstrlenW (lpString=".LDF") returned 4 [0077.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch=".LDF") returned 0x0 [0077.448] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.448] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.449] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.449] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19744996315) returned 1 [0077.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcf95510, dwHighDateTime=0x1d585b4)) [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c290 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c290 | out: hHeap=0x260000) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce448 [0077.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce448 | out: hHeap=0x260000) returned 1 [0077.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.450] GetLastError () returned 0x0 [0077.450] GetLastError () returned 0x0 [0077.450] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.450] GetLastError () returned 0x0 [0077.450] GetLastError () returned 0x0 [0077.452] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffa5cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.453] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5a34, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x5a34, lpOverlapped=0x0) returned 1 [0077.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.453] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.453] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.453] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.453] CloseHandle (hObject=0xd8) returned 1 [0077.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.454] GetLastError () returned 0x0 [0077.455] RtlWakeConditionVariable () returned 0x0 [0077.455] GetCurrentThreadId () returned 0x99c [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".ldf") returned 0x0 [0077.455] lstrlenW (lpString=".vhd") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".vhd") returned 0x0 [0077.455] lstrlenW (lpString=".vhdx") returned 5 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".vhdx") returned 0x0 [0077.455] lstrlenW (lpString=".pst") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".pst") returned 0x0 [0077.455] lstrlenW (lpString=".ost") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".ost") returned 0x0 [0077.455] lstrlenW (lpString=".bak") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".bak") returned 0x0 [0077.455] lstrlenW (lpString=".bac") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".bac") returned 0x0 [0077.455] lstrlenW (lpString=".sys") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".sys") returned 0x0 [0077.455] lstrlenW (lpString=".v2i") returned 4 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".v2i") returned 0x0 [0077.455] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.456] lstrlenW (lpString=".sql") returned 4 [0077.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".sql") returned 0x0 [0077.456] lstrlenW (lpString=".mdf") returned 4 [0077.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".mdf") returned 0x0 [0077.456] lstrlenW (lpString=".txt") returned 4 [0077.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".txt") returned 0x0 [0077.456] lstrlenW (lpString=".dbf") returned 4 [0077.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".dbf") returned 0x0 [0077.456] lstrlenW (lpString=".ckp") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".ckp") returned 0x0 [0077.457] lstrlenW (lpString=".dacpac") returned 7 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".dacpac") returned 0x0 [0077.457] lstrlenW (lpString=".db3") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".db3") returned 0x0 [0077.457] lstrlenW (lpString=".dtxs") returned 5 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".dtxs") returned 0x0 [0077.457] lstrlenW (lpString=".mdt") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".mdt") returned 0x0 [0077.457] lstrlenW (lpString=".sdf") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".sdf") returned 0x0 [0077.457] lstrlenW (lpString=".MDF") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".MDF") returned 0x0 [0077.457] lstrlenW (lpString=".DBF") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".DBF") returned 0x0 [0077.457] lstrlenW (lpString=".DB") returned 3 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".DB") returned 0x0 [0077.457] lstrlenW (lpString=".db") returned 3 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".db") returned 0x0 [0077.457] lstrlenW (lpString=".ndf") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".ndf") returned 0x0 [0077.457] lstrlenW (lpString=".NDF") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".NDF") returned 0x0 [0077.457] lstrlenW (lpString=".Mdf") returned 4 [0077.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".Mdf") returned 0x0 [0077.458] lstrlenW (lpString=".dat") returned 4 [0077.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".dat") returned 0x0 [0077.458] lstrlenW (lpString=".DAT") returned 4 [0077.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".DAT") returned 0x0 [0077.458] lstrlenW (lpString=".ldf") returned 4 [0077.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".ldf") returned 0x0 [0077.458] lstrlenW (lpString=".LDF") returned 4 [0077.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch=".LDF") returned 0x0 [0077.458] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.458] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.459] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.459] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19746009439) returned 1 [0077.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcfbb670, dwHighDateTime=0x1d585b4)) [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c258 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c258 | out: hHeap=0x260000) returned 1 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce598 [0077.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce598 | out: hHeap=0x260000) returned 1 [0077.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.460] GetLastError () returned 0x0 [0077.460] GetLastError () returned 0x0 [0077.460] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.460] GetLastError () returned 0x0 [0077.460] GetLastError () returned 0x0 [0077.462] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff5610, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.462] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xa9f0, lpOverlapped=0x0) returned 1 [0077.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.462] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.462] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.463] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.463] CloseHandle (hObject=0xd8) returned 1 [0077.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.464] GetLastError () returned 0x0 [0077.464] RtlWakeConditionVariable () returned 0x0 [0077.464] GetCurrentThreadId () returned 0x99c [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".ldf") returned 0x0 [0077.464] lstrlenW (lpString=".vhd") returned 4 [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".vhd") returned 0x0 [0077.464] lstrlenW (lpString=".vhdx") returned 5 [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".vhdx") returned 0x0 [0077.464] lstrlenW (lpString=".pst") returned 4 [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".pst") returned 0x0 [0077.464] lstrlenW (lpString=".ost") returned 4 [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".ost") returned 0x0 [0077.464] lstrlenW (lpString=".bak") returned 4 [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".bak") returned 0x0 [0077.464] lstrlenW (lpString=".bac") returned 4 [0077.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".bac") returned 0x0 [0077.465] lstrlenW (lpString=".sys") returned 4 [0077.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".sys") returned 0x0 [0077.465] lstrlenW (lpString=".v2i") returned 4 [0077.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".v2i") returned 0x0 [0077.465] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.465] lstrlenW (lpString=".sql") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".sql") returned 0x0 [0077.466] lstrlenW (lpString=".mdf") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".mdf") returned 0x0 [0077.466] lstrlenW (lpString=".txt") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".txt") returned 0x0 [0077.466] lstrlenW (lpString=".dbf") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".dbf") returned 0x0 [0077.466] lstrlenW (lpString=".ckp") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".ckp") returned 0x0 [0077.466] lstrlenW (lpString=".dacpac") returned 7 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".dacpac") returned 0x0 [0077.466] lstrlenW (lpString=".db3") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".db3") returned 0x0 [0077.466] lstrlenW (lpString=".dtxs") returned 5 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".dtxs") returned 0x0 [0077.466] lstrlenW (lpString=".mdt") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".mdt") returned 0x0 [0077.466] lstrlenW (lpString=".sdf") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".sdf") returned 0x0 [0077.466] lstrlenW (lpString=".MDF") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".MDF") returned 0x0 [0077.466] lstrlenW (lpString=".DBF") returned 4 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".DBF") returned 0x0 [0077.466] lstrlenW (lpString=".DB") returned 3 [0077.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".DB") returned 0x0 [0077.467] lstrlenW (lpString=".db") returned 3 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".db") returned 0x0 [0077.467] lstrlenW (lpString=".ndf") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".ndf") returned 0x0 [0077.467] lstrlenW (lpString=".NDF") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".NDF") returned 0x0 [0077.467] lstrlenW (lpString=".Mdf") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".Mdf") returned 0x0 [0077.467] lstrlenW (lpString=".dat") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".dat") returned 0x0 [0077.467] lstrlenW (lpString=".DAT") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".DAT") returned 0x0 [0077.467] lstrlenW (lpString=".ldf") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".ldf") returned 0x0 [0077.467] lstrlenW (lpString=".LDF") returned 4 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch=".LDF") returned 0x0 [0077.467] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.467] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.468] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.468] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.468] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19746939389) returned 1 [0077.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcfbb670, dwHighDateTime=0x1d585b4)) [0077.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c1e8 [0077.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c1e8 | out: hHeap=0x260000) returned 1 [0077.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce640 [0077.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce640 | out: hHeap=0x260000) returned 1 [0077.469] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.469] GetLastError () returned 0x0 [0077.469] GetLastError () returned 0x0 [0077.469] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.469] GetLastError () returned 0x0 [0077.470] GetLastError () returned 0x0 [0077.471] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffb9a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.472] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4660, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x4660, lpOverlapped=0x0) returned 1 [0077.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.472] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.472] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.472] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.472] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.472] CloseHandle (hObject=0xd8) returned 1 [0077.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.473] GetLastError () returned 0x0 [0077.473] RtlWakeConditionVariable () returned 0x0 [0077.473] GetCurrentThreadId () returned 0x99c [0077.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".ldf") returned 0x0 [0077.474] lstrlenW (lpString=".vhd") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".vhd") returned 0x0 [0077.474] lstrlenW (lpString=".vhdx") returned 5 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".vhdx") returned 0x0 [0077.474] lstrlenW (lpString=".pst") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".pst") returned 0x0 [0077.474] lstrlenW (lpString=".ost") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".ost") returned 0x0 [0077.474] lstrlenW (lpString=".bak") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".bak") returned 0x0 [0077.474] lstrlenW (lpString=".bac") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".bac") returned 0x0 [0077.474] lstrlenW (lpString=".sys") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".sys") returned 0x0 [0077.474] lstrlenW (lpString=".v2i") returned 4 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".v2i") returned 0x0 [0077.474] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.476] lstrlenW (lpString=".sql") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".sql") returned 0x0 [0077.476] lstrlenW (lpString=".mdf") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".mdf") returned 0x0 [0077.476] lstrlenW (lpString=".txt") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".txt") returned 0x0 [0077.476] lstrlenW (lpString=".dbf") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".dbf") returned 0x0 [0077.476] lstrlenW (lpString=".ckp") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".ckp") returned 0x0 [0077.476] lstrlenW (lpString=".dacpac") returned 7 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".dacpac") returned 0x0 [0077.476] lstrlenW (lpString=".db3") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".db3") returned 0x0 [0077.476] lstrlenW (lpString=".dtxs") returned 5 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".dtxs") returned 0x0 [0077.476] lstrlenW (lpString=".mdt") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".mdt") returned 0x0 [0077.476] lstrlenW (lpString=".sdf") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".sdf") returned 0x0 [0077.476] lstrlenW (lpString=".MDF") returned 4 [0077.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".MDF") returned 0x0 [0077.477] lstrlenW (lpString=".DBF") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".DBF") returned 0x0 [0077.477] lstrlenW (lpString=".DB") returned 3 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".DB") returned 0x0 [0077.477] lstrlenW (lpString=".db") returned 3 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".db") returned 0x0 [0077.477] lstrlenW (lpString=".ndf") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".ndf") returned 0x0 [0077.477] lstrlenW (lpString=".NDF") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".NDF") returned 0x0 [0077.477] lstrlenW (lpString=".Mdf") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".Mdf") returned 0x0 [0077.477] lstrlenW (lpString=".dat") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".dat") returned 0x0 [0077.477] lstrlenW (lpString=".DAT") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".DAT") returned 0x0 [0077.477] lstrlenW (lpString=".ldf") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".ldf") returned 0x0 [0077.477] lstrlenW (lpString=".LDF") returned 4 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch=".LDF") returned 0x0 [0077.477] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0077.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.477] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.478] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.478] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0077.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0077.478] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19747954753) returned 1 [0077.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbcfe17d0, dwHighDateTime=0x1d585b4)) [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c220 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c220 | out: hHeap=0x260000) returned 1 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce6e8 [0077.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce6e8 | out: hHeap=0x260000) returned 1 [0077.479] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.479] GetLastError () returned 0x0 [0077.479] GetLastError () returned 0x0 [0077.480] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.480] GetLastError () returned 0x0 [0077.480] GetLastError () returned 0x0 [0077.579] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff78a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.579] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x875e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x875e, lpOverlapped=0x0) returned 1 [0077.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.615] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.615] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.615] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.615] CloseHandle (hObject=0xd8) returned 1 [0077.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0077.617] GetLastError () returned 0x0 [0077.617] RtlWakeConditionVariable () returned 0x0 [0077.617] GetCurrentThreadId () returned 0x99c [0077.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".ldf") returned 0x0 [0077.617] lstrlenW (lpString=".vhd") returned 4 [0077.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".vhd") returned 0x0 [0077.617] lstrlenW (lpString=".vhdx") returned 5 [0077.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".vhdx") returned 0x0 [0077.617] lstrlenW (lpString=".pst") returned 4 [0077.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".pst") returned 0x0 [0077.617] lstrlenW (lpString=".ost") returned 4 [0077.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".ost") returned 0x0 [0077.617] lstrlenW (lpString=".bak") returned 4 [0077.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".bak") returned 0x0 [0077.618] lstrlenW (lpString=".bac") returned 4 [0077.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".bac") returned 0x0 [0077.618] lstrlenW (lpString=".sys") returned 4 [0077.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".sys") returned 0x0 [0077.618] lstrlenW (lpString=".v2i") returned 4 [0077.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".v2i") returned 0x0 [0077.618] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.859] lstrlenW (lpString=".sql") returned 4 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".sql") returned 0x0 [0077.859] lstrlenW (lpString=".mdf") returned 4 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".mdf") returned 0x0 [0077.859] lstrlenW (lpString=".txt") returned 4 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".txt") returned 0x0 [0077.859] lstrlenW (lpString=".dbf") returned 4 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".dbf") returned 0x0 [0077.859] lstrlenW (lpString=".ckp") returned 4 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".ckp") returned 0x0 [0077.859] lstrlenW (lpString=".dacpac") returned 7 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".dacpac") returned 0x0 [0077.859] lstrlenW (lpString=".db3") returned 4 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".db3") returned 0x0 [0077.859] lstrlenW (lpString=".dtxs") returned 5 [0077.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".dtxs") returned 0x0 [0077.860] lstrlenW (lpString=".mdt") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".mdt") returned 0x0 [0077.860] lstrlenW (lpString=".sdf") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".sdf") returned 0x0 [0077.860] lstrlenW (lpString=".MDF") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".MDF") returned 0x0 [0077.860] lstrlenW (lpString=".DBF") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".DBF") returned 0x0 [0077.860] lstrlenW (lpString=".DB") returned 3 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".DB") returned 0x0 [0077.860] lstrlenW (lpString=".db") returned 3 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".db") returned 0x0 [0077.860] lstrlenW (lpString=".ndf") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".ndf") returned 0x0 [0077.860] lstrlenW (lpString=".NDF") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".NDF") returned 0x0 [0077.860] lstrlenW (lpString=".Mdf") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".Mdf") returned 0x0 [0077.860] lstrlenW (lpString=".dat") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".dat") returned 0x0 [0077.860] lstrlenW (lpString=".DAT") returned 4 [0077.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".DAT") returned 0x0 [0077.861] lstrlenW (lpString=".ldf") returned 4 [0077.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".ldf") returned 0x0 [0077.861] lstrlenW (lpString=".LDF") returned 4 [0077.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch=".LDF") returned 0x0 [0077.861] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.861] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.862] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.862] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19786299062) returned 1 [0077.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd399a30, dwHighDateTime=0x1d585b4)) [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb788 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb788 | out: hHeap=0x260000) returned 1 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cfb40 [0077.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cfb40 | out: hHeap=0x260000) returned 1 [0077.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.863] GetLastError () returned 0x0 [0077.863] GetLastError () returned 0x0 [0077.863] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.863] GetLastError () returned 0x0 [0077.863] GetLastError () returned 0x0 [0077.866] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe58a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.866] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1a76, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x1a76, lpOverlapped=0x0) returned 1 [0077.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.867] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.867] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.867] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.867] CloseHandle (hObject=0xd8) returned 1 [0077.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.869] GetLastError () returned 0x0 [0077.869] RtlWakeConditionVariable () returned 0x0 [0077.869] GetCurrentThreadId () returned 0x99c [0077.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".ldf") returned 0x0 [0077.869] lstrlenW (lpString=".vhd") returned 4 [0077.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".vhd") returned 0x0 [0077.869] lstrlenW (lpString=".vhdx") returned 5 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".vhdx") returned 0x0 [0077.870] lstrlenW (lpString=".pst") returned 4 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".pst") returned 0x0 [0077.870] lstrlenW (lpString=".ost") returned 4 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".ost") returned 0x0 [0077.870] lstrlenW (lpString=".bak") returned 4 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".bak") returned 0x0 [0077.870] lstrlenW (lpString=".bac") returned 4 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".bac") returned 0x0 [0077.870] lstrlenW (lpString=".sys") returned 4 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".sys") returned 0x0 [0077.870] lstrlenW (lpString=".v2i") returned 4 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".v2i") returned 0x0 [0077.870] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.871] lstrlenW (lpString=".sql") returned 4 [0077.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".sql") returned 0x0 [0077.871] lstrlenW (lpString=".mdf") returned 4 [0077.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".mdf") returned 0x0 [0077.871] lstrlenW (lpString=".txt") returned 4 [0077.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".txt") returned 0x0 [0077.872] lstrlenW (lpString=".dbf") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".dbf") returned 0x0 [0077.872] lstrlenW (lpString=".ckp") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".ckp") returned 0x0 [0077.872] lstrlenW (lpString=".dacpac") returned 7 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".dacpac") returned 0x0 [0077.872] lstrlenW (lpString=".db3") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".db3") returned 0x0 [0077.872] lstrlenW (lpString=".dtxs") returned 5 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".dtxs") returned 0x0 [0077.872] lstrlenW (lpString=".mdt") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".mdt") returned 0x0 [0077.872] lstrlenW (lpString=".sdf") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".sdf") returned 0x0 [0077.872] lstrlenW (lpString=".MDF") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".MDF") returned 0x0 [0077.872] lstrlenW (lpString=".DBF") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".DBF") returned 0x0 [0077.872] lstrlenW (lpString=".DB") returned 3 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".DB") returned 0x0 [0077.872] lstrlenW (lpString=".db") returned 3 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".db") returned 0x0 [0077.872] lstrlenW (lpString=".ndf") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".ndf") returned 0x0 [0077.872] lstrlenW (lpString=".NDF") returned 4 [0077.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".NDF") returned 0x0 [0077.873] lstrlenW (lpString=".Mdf") returned 4 [0077.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".Mdf") returned 0x0 [0077.873] lstrlenW (lpString=".dat") returned 4 [0077.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".dat") returned 0x0 [0077.873] lstrlenW (lpString=".DAT") returned 4 [0077.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".DAT") returned 0x0 [0077.873] lstrlenW (lpString=".ldf") returned 4 [0077.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".ldf") returned 0x0 [0077.873] lstrlenW (lpString=".LDF") returned 4 [0077.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch=".LDF") returned 0x0 [0077.873] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.873] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.874] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.874] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.874] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19787521307) returned 1 [0077.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd399a30, dwHighDateTime=0x1d585b4)) [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb7c0 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb7c0 | out: hHeap=0x260000) returned 1 [0077.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cef70 [0077.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cef70 | out: hHeap=0x260000) returned 1 [0077.875] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.875] GetLastError () returned 0x0 [0077.875] GetLastError () returned 0x0 [0077.875] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.876] GetLastError () returned 0x0 [0077.876] GetLastError () returned 0x0 [0077.878] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffaaa7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.878] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x5559, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x5559, lpOverlapped=0x0) returned 1 [0077.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.878] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.878] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.878] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.878] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.878] CloseHandle (hObject=0xd8) returned 1 [0077.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.880] GetLastError () returned 0x0 [0077.880] RtlWakeConditionVariable () returned 0x0 [0077.880] GetCurrentThreadId () returned 0x99c [0077.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".ldf") returned 0x0 [0077.880] lstrlenW (lpString=".vhd") returned 4 [0077.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".vhd") returned 0x0 [0077.880] lstrlenW (lpString=".vhdx") returned 5 [0077.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".vhdx") returned 0x0 [0077.880] lstrlenW (lpString=".pst") returned 4 [0077.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".pst") returned 0x0 [0077.880] lstrlenW (lpString=".ost") returned 4 [0077.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".ost") returned 0x0 [0077.880] lstrlenW (lpString=".bak") returned 4 [0077.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".bak") returned 0x0 [0077.881] lstrlenW (lpString=".bac") returned 4 [0077.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".bac") returned 0x0 [0077.881] lstrlenW (lpString=".sys") returned 4 [0077.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".sys") returned 0x0 [0077.881] lstrlenW (lpString=".v2i") returned 4 [0077.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".v2i") returned 0x0 [0077.881] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.882] lstrlenW (lpString=".sql") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".sql") returned 0x0 [0077.882] lstrlenW (lpString=".mdf") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".mdf") returned 0x0 [0077.882] lstrlenW (lpString=".txt") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".txt") returned 0x0 [0077.882] lstrlenW (lpString=".dbf") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".dbf") returned 0x0 [0077.882] lstrlenW (lpString=".ckp") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".ckp") returned 0x0 [0077.882] lstrlenW (lpString=".dacpac") returned 7 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".dacpac") returned 0x0 [0077.882] lstrlenW (lpString=".db3") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".db3") returned 0x0 [0077.882] lstrlenW (lpString=".dtxs") returned 5 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".dtxs") returned 0x0 [0077.882] lstrlenW (lpString=".mdt") returned 4 [0077.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".mdt") returned 0x0 [0077.883] lstrlenW (lpString=".sdf") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".sdf") returned 0x0 [0077.883] lstrlenW (lpString=".MDF") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".MDF") returned 0x0 [0077.883] lstrlenW (lpString=".DBF") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".DBF") returned 0x0 [0077.883] lstrlenW (lpString=".DB") returned 3 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".DB") returned 0x0 [0077.883] lstrlenW (lpString=".db") returned 3 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".db") returned 0x0 [0077.883] lstrlenW (lpString=".ndf") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".ndf") returned 0x0 [0077.883] lstrlenW (lpString=".NDF") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".NDF") returned 0x0 [0077.883] lstrlenW (lpString=".Mdf") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".Mdf") returned 0x0 [0077.883] lstrlenW (lpString=".dat") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".dat") returned 0x0 [0077.883] lstrlenW (lpString=".DAT") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".DAT") returned 0x0 [0077.883] lstrlenW (lpString=".ldf") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".ldf") returned 0x0 [0077.883] lstrlenW (lpString=".LDF") returned 4 [0077.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch=".LDF") returned 0x0 [0077.883] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.884] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.884] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.884] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.884] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.885] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19788576001) returned 1 [0077.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd3bfb90, dwHighDateTime=0x1d585b4)) [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb7f8 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb7f8 | out: hHeap=0x260000) returned 1 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cfd38 [0077.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cfd38 | out: hHeap=0x260000) returned 1 [0077.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.885] GetLastError () returned 0x0 [0077.886] GetLastError () returned 0x0 [0077.886] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.886] GetLastError () returned 0x0 [0077.886] GetLastError () returned 0x0 [0077.899] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffa021, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.899] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x5fdf, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x5fdf, lpOverlapped=0x0) returned 1 [0077.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.901] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.902] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.902] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.902] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.902] CloseHandle (hObject=0xd8) returned 1 [0077.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.905] GetLastError () returned 0x0 [0077.905] RtlWakeConditionVariable () returned 0x0 [0077.905] GetCurrentThreadId () returned 0x99c [0077.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".ldf") returned 0x0 [0077.905] lstrlenW (lpString=".vhd") returned 4 [0077.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".vhd") returned 0x0 [0077.905] lstrlenW (lpString=".vhdx") returned 5 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".vhdx") returned 0x0 [0077.906] lstrlenW (lpString=".pst") returned 4 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".pst") returned 0x0 [0077.906] lstrlenW (lpString=".ost") returned 4 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".ost") returned 0x0 [0077.906] lstrlenW (lpString=".bak") returned 4 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".bak") returned 0x0 [0077.906] lstrlenW (lpString=".bac") returned 4 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".bac") returned 0x0 [0077.906] lstrlenW (lpString=".sys") returned 4 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".sys") returned 0x0 [0077.906] lstrlenW (lpString=".v2i") returned 4 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".v2i") returned 0x0 [0077.906] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.908] lstrlenW (lpString=".sql") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".sql") returned 0x0 [0077.908] lstrlenW (lpString=".mdf") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".mdf") returned 0x0 [0077.908] lstrlenW (lpString=".txt") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".txt") returned 0x0 [0077.908] lstrlenW (lpString=".dbf") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".dbf") returned 0x0 [0077.908] lstrlenW (lpString=".ckp") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".ckp") returned 0x0 [0077.908] lstrlenW (lpString=".dacpac") returned 7 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".dacpac") returned 0x0 [0077.908] lstrlenW (lpString=".db3") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".db3") returned 0x0 [0077.908] lstrlenW (lpString=".dtxs") returned 5 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".dtxs") returned 0x0 [0077.908] lstrlenW (lpString=".mdt") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".mdt") returned 0x0 [0077.908] lstrlenW (lpString=".sdf") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".sdf") returned 0x0 [0077.908] lstrlenW (lpString=".MDF") returned 4 [0077.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".MDF") returned 0x0 [0077.908] lstrlenW (lpString=".DBF") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".DBF") returned 0x0 [0077.909] lstrlenW (lpString=".DB") returned 3 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".DB") returned 0x0 [0077.909] lstrlenW (lpString=".db") returned 3 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".db") returned 0x0 [0077.909] lstrlenW (lpString=".ndf") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".ndf") returned 0x0 [0077.909] lstrlenW (lpString=".NDF") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".NDF") returned 0x0 [0077.909] lstrlenW (lpString=".Mdf") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".Mdf") returned 0x0 [0077.909] lstrlenW (lpString=".dat") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".dat") returned 0x0 [0077.909] lstrlenW (lpString=".DAT") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".DAT") returned 0x0 [0077.909] lstrlenW (lpString=".ldf") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".ldf") returned 0x0 [0077.909] lstrlenW (lpString=".LDF") returned 4 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch=".LDF") returned 0x0 [0077.909] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.909] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.910] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.910] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19791159617) returned 1 [0077.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd40be50, dwHighDateTime=0x1d585b4)) [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb868 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb868 | out: hHeap=0x260000) returned 1 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cfde0 [0077.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cfde0 | out: hHeap=0x260000) returned 1 [0077.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.911] GetLastError () returned 0x0 [0077.912] GetLastError () returned 0x0 [0077.912] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.912] GetLastError () returned 0x0 [0077.912] GetLastError () returned 0x0 [0077.915] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd2ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.915] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2d54, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x2d54, lpOverlapped=0x0) returned 1 [0077.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.915] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.915] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.915] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.915] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.915] CloseHandle (hObject=0xd8) returned 1 [0077.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.917] GetLastError () returned 0x0 [0077.917] RtlWakeConditionVariable () returned 0x27e828 [0077.918] GetCurrentThreadId () returned 0x99c [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".ldf") returned 0x0 [0077.918] lstrlenW (lpString=".vhd") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".vhd") returned 0x0 [0077.918] lstrlenW (lpString=".vhdx") returned 5 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".vhdx") returned 0x0 [0077.918] lstrlenW (lpString=".pst") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".pst") returned 0x0 [0077.918] lstrlenW (lpString=".ost") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".ost") returned 0x0 [0077.918] lstrlenW (lpString=".bak") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".bak") returned 0x0 [0077.918] lstrlenW (lpString=".bac") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".bac") returned 0x0 [0077.918] lstrlenW (lpString=".sys") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".sys") returned 0x0 [0077.918] lstrlenW (lpString=".v2i") returned 4 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".v2i") returned 0x0 [0077.918] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.920] lstrlenW (lpString=".sql") returned 4 [0077.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".sql") returned 0x0 [0077.920] lstrlenW (lpString=".mdf") returned 4 [0077.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".mdf") returned 0x0 [0077.920] lstrlenW (lpString=".txt") returned 4 [0077.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".txt") returned 0x0 [0077.920] lstrlenW (lpString=".dbf") returned 4 [0077.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".dbf") returned 0x0 [0077.920] lstrlenW (lpString=".ckp") returned 4 [0077.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".ckp") returned 0x0 [0077.921] lstrlenW (lpString=".dacpac") returned 7 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".dacpac") returned 0x0 [0077.921] lstrlenW (lpString=".db3") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".db3") returned 0x0 [0077.921] lstrlenW (lpString=".dtxs") returned 5 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".dtxs") returned 0x0 [0077.921] lstrlenW (lpString=".mdt") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".mdt") returned 0x0 [0077.921] lstrlenW (lpString=".sdf") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".sdf") returned 0x0 [0077.921] lstrlenW (lpString=".MDF") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".MDF") returned 0x0 [0077.921] lstrlenW (lpString=".DBF") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".DBF") returned 0x0 [0077.921] lstrlenW (lpString=".DB") returned 3 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".DB") returned 0x0 [0077.921] lstrlenW (lpString=".db") returned 3 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".db") returned 0x0 [0077.921] lstrlenW (lpString=".ndf") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".ndf") returned 0x0 [0077.921] lstrlenW (lpString=".NDF") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".NDF") returned 0x0 [0077.921] lstrlenW (lpString=".Mdf") returned 4 [0077.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".Mdf") returned 0x0 [0077.921] lstrlenW (lpString=".dat") returned 4 [0077.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".dat") returned 0x0 [0077.922] lstrlenW (lpString=".DAT") returned 4 [0077.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".DAT") returned 0x0 [0077.922] lstrlenW (lpString=".ldf") returned 4 [0077.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".ldf") returned 0x0 [0077.922] lstrlenW (lpString=".LDF") returned 4 [0077.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch=".LDF") returned 0x0 [0077.922] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.922] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.923] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.923] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.923] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19792426613) returned 1 [0077.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd431fb0, dwHighDateTime=0x1d585b4)) [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb8a0 [0077.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb8a0 | out: hHeap=0x260000) returned 1 [0077.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cff30 [0077.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cff30 | out: hHeap=0x260000) returned 1 [0077.924] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.924] GetLastError () returned 0x0 [0077.924] GetLastError () returned 0x0 [0077.924] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.924] GetLastError () returned 0x0 [0077.925] GetLastError () returned 0x0 [0077.927] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc1c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.927] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3e39, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3e39, lpOverlapped=0x0) returned 1 [0077.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.927] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.927] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.927] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.927] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.928] CloseHandle (hObject=0xd8) returned 1 [0077.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.928] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.929] GetLastError () returned 0x0 [0077.929] RtlWakeConditionVariable () returned 0x27e828 [0077.929] GetCurrentThreadId () returned 0x99c [0077.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".ldf") returned 0x0 [0077.929] lstrlenW (lpString=".vhd") returned 4 [0077.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".vhd") returned 0x0 [0077.929] lstrlenW (lpString=".vhdx") returned 5 [0077.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".vhdx") returned 0x0 [0077.929] lstrlenW (lpString=".pst") returned 4 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".pst") returned 0x0 [0077.930] lstrlenW (lpString=".ost") returned 4 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".ost") returned 0x0 [0077.930] lstrlenW (lpString=".bak") returned 4 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".bak") returned 0x0 [0077.930] lstrlenW (lpString=".bac") returned 4 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".bac") returned 0x0 [0077.930] lstrlenW (lpString=".sys") returned 4 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".sys") returned 0x0 [0077.930] lstrlenW (lpString=".v2i") returned 4 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".v2i") returned 0x0 [0077.930] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.930] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0077.931] lstrlenW (lpString=".sql") returned 4 [0077.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".sql") returned 0x0 [0077.931] lstrlenW (lpString=".mdf") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".mdf") returned 0x0 [0077.932] lstrlenW (lpString=".txt") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".txt") returned 0x0 [0077.932] lstrlenW (lpString=".dbf") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".dbf") returned 0x0 [0077.932] lstrlenW (lpString=".ckp") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".ckp") returned 0x0 [0077.932] lstrlenW (lpString=".dacpac") returned 7 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".dacpac") returned 0x0 [0077.932] lstrlenW (lpString=".db3") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".db3") returned 0x0 [0077.932] lstrlenW (lpString=".dtxs") returned 5 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".dtxs") returned 0x0 [0077.932] lstrlenW (lpString=".mdt") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".mdt") returned 0x0 [0077.932] lstrlenW (lpString=".sdf") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".sdf") returned 0x0 [0077.932] lstrlenW (lpString=".MDF") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".MDF") returned 0x0 [0077.932] lstrlenW (lpString=".DBF") returned 4 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".DBF") returned 0x0 [0077.932] lstrlenW (lpString=".DB") returned 3 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".DB") returned 0x0 [0077.932] lstrlenW (lpString=".db") returned 3 [0077.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".db") returned 0x0 [0077.932] lstrlenW (lpString=".ndf") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".ndf") returned 0x0 [0077.933] lstrlenW (lpString=".NDF") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".NDF") returned 0x0 [0077.933] lstrlenW (lpString=".Mdf") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".Mdf") returned 0x0 [0077.933] lstrlenW (lpString=".dat") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".dat") returned 0x0 [0077.933] lstrlenW (lpString=".DAT") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".DAT") returned 0x0 [0077.933] lstrlenW (lpString=".ldf") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".ldf") returned 0x0 [0077.933] lstrlenW (lpString=".LDF") returned 4 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch=".LDF") returned 0x0 [0077.933] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.933] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0077.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.933] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0077.934] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.934] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0077.934] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19793530882) returned 1 [0077.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd431fb0, dwHighDateTime=0x1d585b4)) [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb8d8 [0077.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb8d8 | out: hHeap=0x260000) returned 1 [0077.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cffd8 [0077.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cffd8 | out: hHeap=0x260000) returned 1 [0077.935] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0077.935] GetLastError () returned 0x0 [0077.935] GetLastError () returned 0x0 [0077.935] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0077.935] GetLastError () returned 0x0 [0077.936] GetLastError () returned 0x0 [0078.027] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffb914, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.027] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x46ec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x46ec, lpOverlapped=0x0) returned 1 [0078.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.031] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.032] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.032] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.032] CloseHandle (hObject=0x11c) returned 1 [0078.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.[deadmin@cock.li].deadmin")) returned 1 [0078.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.033] GetLastError () returned 0x0 [0078.033] RtlWakeConditionVariable () returned 0x0 [0078.033] GetCurrentThreadId () returned 0x99c [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".ldf") returned 0x0 [0078.034] lstrlenW (lpString=".vhd") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".vhd") returned 0x0 [0078.034] lstrlenW (lpString=".vhdx") returned 5 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".vhdx") returned 0x0 [0078.034] lstrlenW (lpString=".pst") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".pst") returned 0x0 [0078.034] lstrlenW (lpString=".ost") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".ost") returned 0x0 [0078.034] lstrlenW (lpString=".bak") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".bak") returned 0x0 [0078.034] lstrlenW (lpString=".bac") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".bac") returned 0x0 [0078.034] lstrlenW (lpString=".sys") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".sys") returned 0x0 [0078.034] lstrlenW (lpString=".v2i") returned 4 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".v2i") returned 0x0 [0078.034] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.096] lstrlenW (lpString=".sql") returned 4 [0078.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".sql") returned 0x0 [0078.096] lstrlenW (lpString=".mdf") returned 4 [0078.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".mdf") returned 0x0 [0078.115] lstrlenW (lpString=".txt") returned 4 [0078.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".txt") returned 0x0 [0078.115] lstrlenW (lpString=".dbf") returned 4 [0078.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".dbf") returned 0x0 [0078.116] lstrlenW (lpString=".ckp") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".ckp") returned 0x0 [0078.116] lstrlenW (lpString=".dacpac") returned 7 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".dacpac") returned 0x0 [0078.116] lstrlenW (lpString=".db3") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".db3") returned 0x0 [0078.116] lstrlenW (lpString=".dtxs") returned 5 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".dtxs") returned 0x0 [0078.116] lstrlenW (lpString=".mdt") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".mdt") returned 0x0 [0078.116] lstrlenW (lpString=".sdf") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".sdf") returned 0x0 [0078.116] lstrlenW (lpString=".MDF") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".MDF") returned 0x0 [0078.116] lstrlenW (lpString=".DBF") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".DBF") returned 0x0 [0078.116] lstrlenW (lpString=".DB") returned 3 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".DB") returned 0x0 [0078.116] lstrlenW (lpString=".db") returned 3 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".db") returned 0x0 [0078.116] lstrlenW (lpString=".ndf") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".ndf") returned 0x0 [0078.116] lstrlenW (lpString=".NDF") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".NDF") returned 0x0 [0078.116] lstrlenW (lpString=".Mdf") returned 4 [0078.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".Mdf") returned 0x0 [0078.117] lstrlenW (lpString=".dat") returned 4 [0078.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".dat") returned 0x0 [0078.117] lstrlenW (lpString=".DAT") returned 4 [0078.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".DAT") returned 0x0 [0078.117] lstrlenW (lpString=".ldf") returned 4 [0078.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".ldf") returned 0x0 [0078.117] lstrlenW (lpString=".LDF") returned 4 [0078.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch=".LDF") returned 0x0 [0078.117] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.117] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0078.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.118] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.118] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19811909179) returned 1 [0078.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd5fb030, dwHighDateTime=0x1d585b4)) [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbb78 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbb78 | out: hHeap=0x260000) returned 1 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd210 [0078.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd210 | out: hHeap=0x260000) returned 1 [0078.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.119] GetLastError () returned 0x0 [0078.119] GetLastError () returned 0x0 [0078.119] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.119] GetLastError () returned 0x0 [0078.119] GetLastError () returned 0x0 [0078.122] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdef4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.122] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x210c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x210c, lpOverlapped=0x0) returned 1 [0078.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.122] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.123] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.123] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.123] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.123] CloseHandle (hObject=0x108) returned 1 [0078.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0078.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0078.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.124] GetLastError () returned 0x0 [0078.125] RtlWakeConditionVariable () returned 0x0 [0078.125] GetCurrentThreadId () returned 0x99c [0078.125] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0078.125] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0078.125] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0078.125] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0078.127] CloseHandle (hObject=0x108) returned 1 [0078.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0078.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.127] RtlWakeConditionVariable () returned 0x27e828 [0078.127] GetCurrentThreadId () returned 0x99c [0078.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".ldf") returned 0x0 [0078.127] lstrlenW (lpString=".vhd") returned 4 [0078.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".vhd") returned 0x0 [0078.128] lstrlenW (lpString=".vhdx") returned 5 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".vhdx") returned 0x0 [0078.128] lstrlenW (lpString=".pst") returned 4 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".pst") returned 0x0 [0078.128] lstrlenW (lpString=".ost") returned 4 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".ost") returned 0x0 [0078.128] lstrlenW (lpString=".bak") returned 4 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".bak") returned 0x0 [0078.128] lstrlenW (lpString=".bac") returned 4 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".bac") returned 0x0 [0078.128] lstrlenW (lpString=".sys") returned 4 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".sys") returned 0x0 [0078.128] lstrlenW (lpString=".v2i") returned 4 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".v2i") returned 0x0 [0078.128] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch="s\r\n.v2i") returned 0x0 [0078.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.129] lstrlenW (lpString=".sql") returned 4 [0078.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".sql") returned 0x0 [0078.129] lstrlenW (lpString=".mdf") returned 4 [0078.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".mdf") returned 0x0 [0078.129] lstrlenW (lpString=".txt") returned 4 [0078.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".txt") returned 0x0 [0078.129] lstrlenW (lpString=".dbf") returned 4 [0078.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".dbf") returned 0x0 [0078.129] lstrlenW (lpString=".ckp") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".ckp") returned 0x0 [0078.130] lstrlenW (lpString=".dacpac") returned 7 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".dacpac") returned 0x0 [0078.130] lstrlenW (lpString=".db3") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".db3") returned 0x0 [0078.130] lstrlenW (lpString=".dtxs") returned 5 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".dtxs") returned 0x0 [0078.130] lstrlenW (lpString=".mdt") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".mdt") returned 0x0 [0078.130] lstrlenW (lpString=".sdf") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".sdf") returned 0x0 [0078.130] lstrlenW (lpString=".MDF") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".MDF") returned 0x0 [0078.130] lstrlenW (lpString=".DBF") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".DBF") returned 0x0 [0078.130] lstrlenW (lpString=".DB") returned 3 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".DB") returned 0x0 [0078.130] lstrlenW (lpString=".db") returned 3 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".db") returned 0x0 [0078.130] lstrlenW (lpString=".ndf") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".ndf") returned 0x0 [0078.130] lstrlenW (lpString=".NDF") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".NDF") returned 0x0 [0078.130] lstrlenW (lpString=".Mdf") returned 4 [0078.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".Mdf") returned 0x0 [0078.131] lstrlenW (lpString=".dat") returned 4 [0078.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".dat") returned 0x0 [0078.131] lstrlenW (lpString=".DAT") returned 4 [0078.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".DAT") returned 0x0 [0078.131] lstrlenW (lpString=".ldf") returned 4 [0078.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".ldf") returned 0x0 [0078.131] lstrlenW (lpString=".LDF") returned 4 [0078.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch=".LDF") returned 0x0 [0078.131] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.131] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0078.132] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.132] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.132] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19813309705) returned 1 [0078.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd621190, dwHighDateTime=0x1d585b4)) [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbbe8 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbbe8 | out: hHeap=0x260000) returned 1 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0838 [0078.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0838 | out: hHeap=0x260000) returned 1 [0078.133] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.133] GetLastError () returned 0x0 [0078.133] GetLastError () returned 0x0 [0078.133] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.133] GetLastError () returned 0x0 [0078.133] GetLastError () returned 0x0 [0078.136] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc656, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.136] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x39aa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x39aa, lpOverlapped=0x0) returned 1 [0078.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.136] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.136] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.136] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.136] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.136] CloseHandle (hObject=0x108) returned 1 [0078.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.[deadmin@cock.li].deadmin")) returned 1 [0078.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.138] GetLastError () returned 0x0 [0078.138] RtlWakeConditionVariable () returned 0x0 [0078.138] GetCurrentThreadId () returned 0x99c [0078.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".ldf") returned 0x0 [0078.138] lstrlenW (lpString=".vhd") returned 4 [0078.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".vhd") returned 0x0 [0078.138] lstrlenW (lpString=".vhdx") returned 5 [0078.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".vhdx") returned 0x0 [0078.138] lstrlenW (lpString=".pst") returned 4 [0078.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".pst") returned 0x0 [0078.138] lstrlenW (lpString=".ost") returned 4 [0078.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".ost") returned 0x0 [0078.139] lstrlenW (lpString=".bak") returned 4 [0078.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".bak") returned 0x0 [0078.139] lstrlenW (lpString=".bac") returned 4 [0078.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".bac") returned 0x0 [0078.139] lstrlenW (lpString=".sys") returned 4 [0078.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".sys") returned 0x0 [0078.139] lstrlenW (lpString=".v2i") returned 4 [0078.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".v2i") returned 0x0 [0078.139] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch="s\r\n.v2i") returned 0x0 [0078.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.140] lstrlenW (lpString=".sql") returned 4 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".sql") returned 0x0 [0078.140] lstrlenW (lpString=".mdf") returned 4 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".mdf") returned 0x0 [0078.140] lstrlenW (lpString=".txt") returned 4 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".txt") returned 0x0 [0078.140] lstrlenW (lpString=".dbf") returned 4 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".dbf") returned 0x0 [0078.140] lstrlenW (lpString=".ckp") returned 4 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".ckp") returned 0x0 [0078.140] lstrlenW (lpString=".dacpac") returned 7 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".dacpac") returned 0x0 [0078.140] lstrlenW (lpString=".db3") returned 4 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".db3") returned 0x0 [0078.140] lstrlenW (lpString=".dtxs") returned 5 [0078.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".dtxs") returned 0x0 [0078.141] lstrlenW (lpString=".mdt") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".mdt") returned 0x0 [0078.141] lstrlenW (lpString=".sdf") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".sdf") returned 0x0 [0078.141] lstrlenW (lpString=".MDF") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".MDF") returned 0x0 [0078.141] lstrlenW (lpString=".DBF") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".DBF") returned 0x0 [0078.141] lstrlenW (lpString=".DB") returned 3 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".DB") returned 0x0 [0078.141] lstrlenW (lpString=".db") returned 3 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".db") returned 0x0 [0078.141] lstrlenW (lpString=".ndf") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".ndf") returned 0x0 [0078.141] lstrlenW (lpString=".NDF") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".NDF") returned 0x0 [0078.141] lstrlenW (lpString=".Mdf") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".Mdf") returned 0x0 [0078.141] lstrlenW (lpString=".dat") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".dat") returned 0x0 [0078.141] lstrlenW (lpString=".DAT") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".DAT") returned 0x0 [0078.141] lstrlenW (lpString=".ldf") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".ldf") returned 0x0 [0078.141] lstrlenW (lpString=".LDF") returned 4 [0078.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch=".LDF") returned 0x0 [0078.142] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.142] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0078.142] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.142] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.143] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19814382753) returned 1 [0078.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd6472f0, dwHighDateTime=0x1d585b4)) [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbc20 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbc20 | out: hHeap=0x260000) returned 1 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d08e0 [0078.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d08e0 | out: hHeap=0x260000) returned 1 [0078.143] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.144] GetLastError () returned 0x0 [0078.144] GetLastError () returned 0x0 [0078.144] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.144] GetLastError () returned 0x0 [0078.144] GetLastError () returned 0x0 [0078.184] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb7d3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.184] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x482d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x482d, lpOverlapped=0x0) returned 1 [0078.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.186] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.186] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.186] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.186] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.186] CloseHandle (hObject=0x108) returned 1 [0078.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0078.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.[deadmin@cock.li].deadmin")) returned 1 [0078.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0078.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.188] GetLastError () returned 0x0 [0078.188] RtlWakeConditionVariable () returned 0x0 [0078.188] GetCurrentThreadId () returned 0x99c [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".ldf") returned 0x0 [0078.189] lstrlenW (lpString=".vhd") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".vhd") returned 0x0 [0078.189] lstrlenW (lpString=".vhdx") returned 5 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".vhdx") returned 0x0 [0078.189] lstrlenW (lpString=".pst") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".pst") returned 0x0 [0078.189] lstrlenW (lpString=".ost") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".ost") returned 0x0 [0078.189] lstrlenW (lpString=".bak") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".bak") returned 0x0 [0078.189] lstrlenW (lpString=".bac") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".bac") returned 0x0 [0078.189] lstrlenW (lpString=".sys") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".sys") returned 0x0 [0078.189] lstrlenW (lpString=".v2i") returned 4 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".v2i") returned 0x0 [0078.189] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0078.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.191] lstrlenW (lpString=".sql") returned 4 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".sql") returned 0x0 [0078.191] lstrlenW (lpString=".mdf") returned 4 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".mdf") returned 0x0 [0078.191] lstrlenW (lpString=".txt") returned 4 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".txt") returned 0x0 [0078.191] lstrlenW (lpString=".dbf") returned 4 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".dbf") returned 0x0 [0078.191] lstrlenW (lpString=".ckp") returned 4 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".ckp") returned 0x0 [0078.191] lstrlenW (lpString=".dacpac") returned 7 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".dacpac") returned 0x0 [0078.191] lstrlenW (lpString=".db3") returned 4 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".db3") returned 0x0 [0078.191] lstrlenW (lpString=".dtxs") returned 5 [0078.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".dtxs") returned 0x0 [0078.192] lstrlenW (lpString=".mdt") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".mdt") returned 0x0 [0078.192] lstrlenW (lpString=".sdf") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".sdf") returned 0x0 [0078.192] lstrlenW (lpString=".MDF") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".MDF") returned 0x0 [0078.192] lstrlenW (lpString=".DBF") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".DBF") returned 0x0 [0078.192] lstrlenW (lpString=".DB") returned 3 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".DB") returned 0x0 [0078.192] lstrlenW (lpString=".db") returned 3 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".db") returned 0x0 [0078.192] lstrlenW (lpString=".ndf") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".ndf") returned 0x0 [0078.192] lstrlenW (lpString=".NDF") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".NDF") returned 0x0 [0078.192] lstrlenW (lpString=".Mdf") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".Mdf") returned 0x0 [0078.192] lstrlenW (lpString=".dat") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".dat") returned 0x0 [0078.192] lstrlenW (lpString=".DAT") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".DAT") returned 0x0 [0078.192] lstrlenW (lpString=".ldf") returned 4 [0078.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".ldf") returned 0x0 [0078.193] lstrlenW (lpString=".LDF") returned 4 [0078.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch=".LDF") returned 0x0 [0078.193] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.193] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756858) returned 1 [0078.194] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.194] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0078.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.194] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19819533691) returned 1 [0078.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd6b9710, dwHighDateTime=0x1d585b4)) [0078.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbd00 [0078.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbd00 | out: hHeap=0x260000) returned 1 [0078.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f27a8 [0078.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.195] GetLastError () returned 0x0 [0078.196] GetLastError () returned 0x0 [0078.196] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.196] GetLastError () returned 0x0 [0078.196] GetLastError () returned 0x0 [0078.203] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.203] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.204] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.205] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.207] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.207] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.207] CloseHandle (hObject=0x108) returned 1 [0078.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.[deadmin@cock.li].deadmin")) returned 1 [0078.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.209] GetLastError () returned 0x0 [0078.209] RtlWakeConditionVariable () returned 0x0 [0078.209] GetCurrentThreadId () returned 0x99c [0078.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.209] lstrlenW (lpString=".vhd") returned 4 [0078.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".vhd") returned 0x0 [0078.209] lstrlenW (lpString=".vhdx") returned 5 [0078.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".vhdx") returned 0x0 [0078.209] lstrlenW (lpString=".pst") returned 4 [0078.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".pst") returned 0x0 [0078.209] lstrlenW (lpString=".ost") returned 4 [0078.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".ost") returned 0x0 [0078.210] lstrlenW (lpString=".bak") returned 4 [0078.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".bak") returned 0x0 [0078.210] lstrlenW (lpString=".bac") returned 4 [0078.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".bac") returned 0x0 [0078.210] lstrlenW (lpString=".sys") returned 4 [0078.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".sys") returned 0x0 [0078.210] lstrlenW (lpString=".v2i") returned 4 [0078.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".v2i") returned 0x0 [0078.210] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0078.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.211] lstrlenW (lpString=".sql") returned 4 [0078.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".sql") returned 0x0 [0078.211] lstrlenW (lpString=".mdf") returned 4 [0078.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".mdf") returned 0x0 [0078.211] lstrlenW (lpString=".txt") returned 4 [0078.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".txt") returned 0x0 [0078.211] lstrlenW (lpString=".dbf") returned 4 [0078.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".dbf") returned 0x0 [0078.211] lstrlenW (lpString=".ckp") returned 4 [0078.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".ckp") returned 0x0 [0078.211] lstrlenW (lpString=".dacpac") returned 7 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".dacpac") returned 0x0 [0078.212] lstrlenW (lpString=".db3") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".db3") returned 0x0 [0078.212] lstrlenW (lpString=".dtxs") returned 5 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".dtxs") returned 0x0 [0078.212] lstrlenW (lpString=".mdt") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".mdt") returned 0x0 [0078.212] lstrlenW (lpString=".sdf") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".sdf") returned 0x0 [0078.212] lstrlenW (lpString=".MDF") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".MDF") returned 0x0 [0078.212] lstrlenW (lpString=".DBF") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".DBF") returned 0x0 [0078.212] lstrlenW (lpString=".DB") returned 3 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".DB") returned 0x0 [0078.212] lstrlenW (lpString=".db") returned 3 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".db") returned 0x0 [0078.212] lstrlenW (lpString=".ndf") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".ndf") returned 0x0 [0078.212] lstrlenW (lpString=".NDF") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".NDF") returned 0x0 [0078.212] lstrlenW (lpString=".Mdf") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".Mdf") returned 0x0 [0078.212] lstrlenW (lpString=".dat") returned 4 [0078.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".dat") returned 0x0 [0078.212] lstrlenW (lpString=".DAT") returned 4 [0078.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".DAT") returned 0x0 [0078.213] lstrlenW (lpString=".ldf") returned 4 [0078.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".ldf") returned 0x0 [0078.213] lstrlenW (lpString=".LDF") returned 4 [0078.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch=".LDF") returned 0x0 [0078.213] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.213] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x311400) returned 1 [0078.214] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.215] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.215] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19821852172) returned 1 [0078.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd6df870, dwHighDateTime=0x1d585b4)) [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbd38 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbd38 | out: hHeap=0x260000) returned 1 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f25e0 [0078.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.219] GetLastError () returned 0x0 [0078.219] GetLastError () returned 0x0 [0078.219] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.219] GetLastError () returned 0x0 [0078.220] GetLastError () returned 0x0 [0078.228] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.269] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x277, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x277, lpOverlapped=0x0) returned 1 [0078.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.269] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.269] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.269] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.269] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.290] CloseHandle (hObject=0x108) returned 1 [0078.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0078.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.375] GetLastError () returned 0x0 [0078.375] RtlWakeConditionVariable () returned 0x0 [0078.375] GetCurrentThreadId () returned 0x99c [0078.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".ldf") returned 0x0 [0078.375] lstrlenW (lpString=".vhd") returned 4 [0078.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".vhd") returned 0x0 [0078.375] lstrlenW (lpString=".vhdx") returned 5 [0078.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".vhdx") returned 0x0 [0078.375] lstrlenW (lpString=".pst") returned 4 [0078.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".pst") returned 0x0 [0078.375] lstrlenW (lpString=".ost") returned 4 [0078.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".ost") returned 0x0 [0078.376] lstrlenW (lpString=".bak") returned 4 [0078.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".bak") returned 0x0 [0078.376] lstrlenW (lpString=".bac") returned 4 [0078.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".bac") returned 0x0 [0078.376] lstrlenW (lpString=".sys") returned 4 [0078.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".sys") returned 0x0 [0078.376] lstrlenW (lpString=".v2i") returned 4 [0078.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".v2i") returned 0x0 [0078.376] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0078.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.377] lstrlenW (lpString=".sql") returned 4 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".sql") returned 0x0 [0078.377] lstrlenW (lpString=".mdf") returned 4 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".mdf") returned 0x0 [0078.377] lstrlenW (lpString=".txt") returned 4 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".txt") returned 0x0 [0078.377] lstrlenW (lpString=".dbf") returned 4 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".dbf") returned 0x0 [0078.377] lstrlenW (lpString=".ckp") returned 4 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".ckp") returned 0x0 [0078.377] lstrlenW (lpString=".dacpac") returned 7 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".dacpac") returned 0x0 [0078.377] lstrlenW (lpString=".db3") returned 4 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".db3") returned 0x0 [0078.377] lstrlenW (lpString=".dtxs") returned 5 [0078.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".dtxs") returned 0x0 [0078.378] lstrlenW (lpString=".mdt") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".mdt") returned 0x0 [0078.378] lstrlenW (lpString=".sdf") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".sdf") returned 0x0 [0078.378] lstrlenW (lpString=".MDF") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".MDF") returned 0x0 [0078.378] lstrlenW (lpString=".DBF") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".DBF") returned 0x0 [0078.378] lstrlenW (lpString=".DB") returned 3 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".DB") returned 0x0 [0078.378] lstrlenW (lpString=".db") returned 3 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".db") returned 0x0 [0078.378] lstrlenW (lpString=".ndf") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".ndf") returned 0x0 [0078.378] lstrlenW (lpString=".NDF") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".NDF") returned 0x0 [0078.378] lstrlenW (lpString=".Mdf") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".Mdf") returned 0x0 [0078.378] lstrlenW (lpString=".dat") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".dat") returned 0x0 [0078.378] lstrlenW (lpString=".DAT") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".DAT") returned 0x0 [0078.378] lstrlenW (lpString=".ldf") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".ldf") returned 0x0 [0078.378] lstrlenW (lpString=".LDF") returned 4 [0078.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch=".LDF") returned 0x0 [0078.379] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.379] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756c10) returned 1 [0078.379] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.379] CryptReleaseContext (hProv=0x2756c10, dwFlags=0x0) returned 1 [0078.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.380] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19838075147) returned 1 [0078.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd882790, dwHighDateTime=0x1d585b4)) [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c8e8 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c8e8 | out: hHeap=0x260000) returned 1 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f27a8 [0078.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.380] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.380] GetLastError () returned 0x0 [0078.381] GetLastError () returned 0x0 [0078.381] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.381] GetLastError () returned 0x0 [0078.381] GetLastError () returned 0x0 [0078.384] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.384] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.385] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.385] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.387] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.387] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.387] CloseHandle (hObject=0x108) returned 1 [0078.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.[deadmin@cock.li].deadmin")) returned 1 [0078.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.391] GetLastError () returned 0x0 [0078.391] RtlWakeConditionVariable () returned 0x0 [0078.391] GetCurrentThreadId () returned 0x99c [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".ldf") returned 0x0 [0078.391] lstrlenW (lpString=".vhd") returned 4 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".vhd") returned 0x0 [0078.391] lstrlenW (lpString=".vhdx") returned 5 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".vhdx") returned 0x0 [0078.391] lstrlenW (lpString=".pst") returned 4 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".pst") returned 0x0 [0078.391] lstrlenW (lpString=".ost") returned 4 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".ost") returned 0x0 [0078.391] lstrlenW (lpString=".bak") returned 4 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".bak") returned 0x0 [0078.391] lstrlenW (lpString=".bac") returned 4 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".bac") returned 0x0 [0078.391] lstrlenW (lpString=".sys") returned 4 [0078.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".sys") returned 0x0 [0078.391] lstrlenW (lpString=".v2i") returned 4 [0078.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".v2i") returned 0x0 [0078.392] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.393] lstrlenW (lpString=".sql") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".sql") returned 0x0 [0078.393] lstrlenW (lpString=".mdf") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".mdf") returned 0x0 [0078.393] lstrlenW (lpString=".txt") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".txt") returned 0x0 [0078.393] lstrlenW (lpString=".dbf") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".dbf") returned 0x0 [0078.393] lstrlenW (lpString=".ckp") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".ckp") returned 0x0 [0078.393] lstrlenW (lpString=".dacpac") returned 7 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".dacpac") returned 0x0 [0078.393] lstrlenW (lpString=".db3") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".db3") returned 0x0 [0078.393] lstrlenW (lpString=".dtxs") returned 5 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".dtxs") returned 0x0 [0078.393] lstrlenW (lpString=".mdt") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".mdt") returned 0x0 [0078.393] lstrlenW (lpString=".sdf") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".sdf") returned 0x0 [0078.393] lstrlenW (lpString=".MDF") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".MDF") returned 0x0 [0078.393] lstrlenW (lpString=".DBF") returned 4 [0078.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".DBF") returned 0x0 [0078.394] lstrlenW (lpString=".DB") returned 3 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".DB") returned 0x0 [0078.394] lstrlenW (lpString=".db") returned 3 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".db") returned 0x0 [0078.394] lstrlenW (lpString=".ndf") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".ndf") returned 0x0 [0078.394] lstrlenW (lpString=".NDF") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".NDF") returned 0x0 [0078.394] lstrlenW (lpString=".Mdf") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".Mdf") returned 0x0 [0078.394] lstrlenW (lpString=".dat") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".dat") returned 0x0 [0078.394] lstrlenW (lpString=".DAT") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".DAT") returned 0x0 [0078.394] lstrlenW (lpString=".ldf") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".ldf") returned 0x0 [0078.394] lstrlenW (lpString=".LDF") returned 4 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch=".LDF") returned 0x0 [0078.394] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.394] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756c98) returned 1 [0078.395] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.395] CryptReleaseContext (hProv=0x2756c98, dwFlags=0x0) returned 1 [0078.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.395] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19839649341) returned 1 [0078.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd8a88f0, dwHighDateTime=0x1d585b4)) [0078.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c8b0 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c8b0 | out: hHeap=0x260000) returned 1 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2840 [0078.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.396] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.396] GetLastError () returned 0x0 [0078.396] GetLastError () returned 0x0 [0078.396] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.397] GetLastError () returned 0x0 [0078.397] GetLastError () returned 0x0 [0078.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffea670, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.399] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x15990, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x15990, lpOverlapped=0x0) returned 1 [0078.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.400] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.400] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.400] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.400] CloseHandle (hObject=0x108) returned 1 [0078.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.401] GetLastError () returned 0x0 [0078.401] RtlWakeConditionVariable () returned 0x0 [0078.401] GetCurrentThreadId () returned 0x99c [0078.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".ldf") returned 0x0 [0078.401] lstrlenW (lpString=".vhd") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".vhd") returned 0x0 [0078.402] lstrlenW (lpString=".vhdx") returned 5 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".vhdx") returned 0x0 [0078.402] lstrlenW (lpString=".pst") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".pst") returned 0x0 [0078.402] lstrlenW (lpString=".ost") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".ost") returned 0x0 [0078.402] lstrlenW (lpString=".bak") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".bak") returned 0x0 [0078.402] lstrlenW (lpString=".bac") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".bac") returned 0x0 [0078.402] lstrlenW (lpString=".sys") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".sys") returned 0x0 [0078.402] lstrlenW (lpString=".v2i") returned 4 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".v2i") returned 0x0 [0078.402] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.403] lstrlenW (lpString=".sql") returned 4 [0078.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".sql") returned 0x0 [0078.403] lstrlenW (lpString=".mdf") returned 4 [0078.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".mdf") returned 0x0 [0078.403] lstrlenW (lpString=".txt") returned 4 [0078.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".txt") returned 0x0 [0078.403] lstrlenW (lpString=".dbf") returned 4 [0078.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".dbf") returned 0x0 [0078.403] lstrlenW (lpString=".ckp") returned 4 [0078.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".ckp") returned 0x0 [0078.403] lstrlenW (lpString=".dacpac") returned 7 [0078.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".dacpac") returned 0x0 [0078.404] lstrlenW (lpString=".db3") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".db3") returned 0x0 [0078.404] lstrlenW (lpString=".dtxs") returned 5 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".dtxs") returned 0x0 [0078.404] lstrlenW (lpString=".mdt") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".mdt") returned 0x0 [0078.404] lstrlenW (lpString=".sdf") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".sdf") returned 0x0 [0078.404] lstrlenW (lpString=".MDF") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".MDF") returned 0x0 [0078.404] lstrlenW (lpString=".DBF") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".DBF") returned 0x0 [0078.404] lstrlenW (lpString=".DB") returned 3 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".DB") returned 0x0 [0078.404] lstrlenW (lpString=".db") returned 3 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".db") returned 0x0 [0078.404] lstrlenW (lpString=".ndf") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".ndf") returned 0x0 [0078.404] lstrlenW (lpString=".NDF") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".NDF") returned 0x0 [0078.404] lstrlenW (lpString=".Mdf") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".Mdf") returned 0x0 [0078.404] lstrlenW (lpString=".dat") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".dat") returned 0x0 [0078.404] lstrlenW (lpString=".DAT") returned 4 [0078.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".DAT") returned 0x0 [0078.405] lstrlenW (lpString=".ldf") returned 4 [0078.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".ldf") returned 0x0 [0078.405] lstrlenW (lpString=".LDF") returned 4 [0078.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch=".LDF") returned 0x0 [0078.405] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.405] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756da8) returned 1 [0078.407] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.407] CryptReleaseContext (hProv=0x2756da8, dwFlags=0x0) returned 1 [0078.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.408] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19840885069) returned 1 [0078.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd8cea50, dwHighDateTime=0x1d585b4)) [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c808 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c808 | out: hHeap=0x260000) returned 1 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f27a8 [0078.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.408] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.409] GetLastError () returned 0x0 [0078.409] GetLastError () returned 0x0 [0078.409] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.409] GetLastError () returned 0x0 [0078.409] GetLastError () returned 0x0 [0078.448] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.448] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.448] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.448] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.449] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.449] CloseHandle (hObject=0x108) returned 1 [0078.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.[deadmin@cock.li].deadmin")) returned 1 [0078.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.450] GetLastError () returned 0x0 [0078.451] RtlWakeConditionVariable () returned 0x0 [0078.451] GetCurrentThreadId () returned 0x99c [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".ldf") returned 0x0 [0078.451] lstrlenW (lpString=".vhd") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".vhd") returned 0x0 [0078.451] lstrlenW (lpString=".vhdx") returned 5 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".vhdx") returned 0x0 [0078.451] lstrlenW (lpString=".pst") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".pst") returned 0x0 [0078.451] lstrlenW (lpString=".ost") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".ost") returned 0x0 [0078.451] lstrlenW (lpString=".bak") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".bak") returned 0x0 [0078.451] lstrlenW (lpString=".bac") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".bac") returned 0x0 [0078.451] lstrlenW (lpString=".sys") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".sys") returned 0x0 [0078.451] lstrlenW (lpString=".v2i") returned 4 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".v2i") returned 0x0 [0078.451] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch="s\r\n.v2i") returned 0x0 [0078.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.452] lstrlenW (lpString=".sql") returned 4 [0078.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".sql") returned 0x0 [0078.452] lstrlenW (lpString=".mdf") returned 4 [0078.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".mdf") returned 0x0 [0078.452] lstrlenW (lpString=".txt") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".txt") returned 0x0 [0078.453] lstrlenW (lpString=".dbf") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".dbf") returned 0x0 [0078.453] lstrlenW (lpString=".ckp") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".ckp") returned 0x0 [0078.453] lstrlenW (lpString=".dacpac") returned 7 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".dacpac") returned 0x0 [0078.453] lstrlenW (lpString=".db3") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".db3") returned 0x0 [0078.453] lstrlenW (lpString=".dtxs") returned 5 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".dtxs") returned 0x0 [0078.453] lstrlenW (lpString=".mdt") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".mdt") returned 0x0 [0078.453] lstrlenW (lpString=".sdf") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".sdf") returned 0x0 [0078.453] lstrlenW (lpString=".MDF") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".MDF") returned 0x0 [0078.453] lstrlenW (lpString=".DBF") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".DBF") returned 0x0 [0078.453] lstrlenW (lpString=".DB") returned 3 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".DB") returned 0x0 [0078.453] lstrlenW (lpString=".db") returned 3 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".db") returned 0x0 [0078.453] lstrlenW (lpString=".ndf") returned 4 [0078.453] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".ndf") returned 0x0 [0078.454] lstrlenW (lpString=".NDF") returned 4 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".NDF") returned 0x0 [0078.454] lstrlenW (lpString=".Mdf") returned 4 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".Mdf") returned 0x0 [0078.454] lstrlenW (lpString=".dat") returned 4 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".dat") returned 0x0 [0078.454] lstrlenW (lpString=".DAT") returned 4 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".DAT") returned 0x0 [0078.454] lstrlenW (lpString=".ldf") returned 4 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".ldf") returned 0x0 [0078.454] lstrlenW (lpString=".LDF") returned 4 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch=".LDF") returned 0x0 [0078.454] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.454] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756c98) returned 1 [0078.455] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.455] CryptReleaseContext (hProv=0x2756c98, dwFlags=0x0) returned 1 [0078.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.455] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19845628334) returned 1 [0078.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbd940e70, dwHighDateTime=0x1d585b4)) [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c760 [0078.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c760 | out: hHeap=0x260000) returned 1 [0078.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0790 [0078.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0790 | out: hHeap=0x260000) returned 1 [0078.456] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.456] GetLastError () returned 0x0 [0078.456] GetLastError () returned 0x0 [0078.456] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.456] GetLastError () returned 0x0 [0078.456] GetLastError () returned 0x0 [0078.552] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff1080, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.552] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xef80, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xef80, lpOverlapped=0x0) returned 1 [0078.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.552] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.552] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.552] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.552] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.552] CloseHandle (hObject=0x108) returned 1 [0078.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.560] GetLastError () returned 0x0 [0078.560] RtlWakeConditionVariable () returned 0x0 [0078.560] GetCurrentThreadId () returned 0x99c [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".ldf") returned 0x0 [0078.560] lstrlenW (lpString=".vhd") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".vhd") returned 0x0 [0078.560] lstrlenW (lpString=".vhdx") returned 5 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".vhdx") returned 0x0 [0078.560] lstrlenW (lpString=".pst") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".pst") returned 0x0 [0078.560] lstrlenW (lpString=".ost") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".ost") returned 0x0 [0078.560] lstrlenW (lpString=".bak") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".bak") returned 0x0 [0078.560] lstrlenW (lpString=".bac") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".bac") returned 0x0 [0078.560] lstrlenW (lpString=".sys") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".sys") returned 0x0 [0078.560] lstrlenW (lpString=".v2i") returned 4 [0078.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".v2i") returned 0x0 [0078.560] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.562] lstrlenW (lpString=".sql") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".sql") returned 0x0 [0078.563] lstrlenW (lpString=".mdf") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".mdf") returned 0x0 [0078.563] lstrlenW (lpString=".txt") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".txt") returned 0x0 [0078.563] lstrlenW (lpString=".dbf") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".dbf") returned 0x0 [0078.563] lstrlenW (lpString=".ckp") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".ckp") returned 0x0 [0078.563] lstrlenW (lpString=".dacpac") returned 7 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".dacpac") returned 0x0 [0078.563] lstrlenW (lpString=".db3") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".db3") returned 0x0 [0078.563] lstrlenW (lpString=".dtxs") returned 5 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".dtxs") returned 0x0 [0078.563] lstrlenW (lpString=".mdt") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".mdt") returned 0x0 [0078.563] lstrlenW (lpString=".sdf") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".sdf") returned 0x0 [0078.563] lstrlenW (lpString=".MDF") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".MDF") returned 0x0 [0078.563] lstrlenW (lpString=".DBF") returned 4 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".DBF") returned 0x0 [0078.563] lstrlenW (lpString=".DB") returned 3 [0078.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".DB") returned 0x0 [0078.564] lstrlenW (lpString=".db") returned 3 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".db") returned 0x0 [0078.564] lstrlenW (lpString=".ndf") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".ndf") returned 0x0 [0078.564] lstrlenW (lpString=".NDF") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".NDF") returned 0x0 [0078.564] lstrlenW (lpString=".Mdf") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".Mdf") returned 0x0 [0078.564] lstrlenW (lpString=".dat") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".dat") returned 0x0 [0078.564] lstrlenW (lpString=".DAT") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".DAT") returned 0x0 [0078.564] lstrlenW (lpString=".ldf") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".ldf") returned 0x0 [0078.564] lstrlenW (lpString=".LDF") returned 4 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch=".LDF") returned 0x0 [0078.564] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.564] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756c98) returned 1 [0078.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.565] CryptReleaseContext (hProv=0x2756c98, dwFlags=0x0) returned 1 [0078.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.565] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19856644713) returned 1 [0078.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbda4b810, dwHighDateTime=0x1d585b4)) [0078.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c6f0 [0078.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c6f0 | out: hHeap=0x260000) returned 1 [0078.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.566] GetLastError () returned 0x0 [0078.566] GetLastError () returned 0x0 [0078.566] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.567] GetLastError () returned 0x0 [0078.567] GetLastError () returned 0x0 [0078.670] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6e70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.670] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x9190, lpOverlapped=0x0) returned 1 [0078.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.671] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.671] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.671] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.671] CloseHandle (hObject=0x108) returned 1 [0078.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0078.674] GetLastError () returned 0x0 [0078.674] RtlWakeConditionVariable () returned 0x0 [0078.674] GetCurrentThreadId () returned 0x99c [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".ldf") returned 0x0 [0078.674] lstrlenW (lpString=".vhd") returned 4 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".vhd") returned 0x0 [0078.674] lstrlenW (lpString=".vhdx") returned 5 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".vhdx") returned 0x0 [0078.674] lstrlenW (lpString=".pst") returned 4 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".pst") returned 0x0 [0078.674] lstrlenW (lpString=".ost") returned 4 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".ost") returned 0x0 [0078.674] lstrlenW (lpString=".bak") returned 4 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".bak") returned 0x0 [0078.674] lstrlenW (lpString=".bac") returned 4 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".bac") returned 0x0 [0078.674] lstrlenW (lpString=".sys") returned 4 [0078.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".sys") returned 0x0 [0078.674] lstrlenW (lpString=".v2i") returned 4 [0078.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".v2i") returned 0x0 [0078.675] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0078.677] lstrlenW (lpString=".sql") returned 4 [0078.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".sql") returned 0x0 [0078.677] lstrlenW (lpString=".mdf") returned 4 [0078.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".mdf") returned 0x0 [0078.677] lstrlenW (lpString=".txt") returned 4 [0078.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".txt") returned 0x0 [0078.677] lstrlenW (lpString=".dbf") returned 4 [0078.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".dbf") returned 0x0 [0078.677] lstrlenW (lpString=".ckp") returned 4 [0078.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".ckp") returned 0x0 [0078.677] lstrlenW (lpString=".dacpac") returned 7 [0078.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".dacpac") returned 0x0 [0078.678] lstrlenW (lpString=".db3") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".db3") returned 0x0 [0078.678] lstrlenW (lpString=".dtxs") returned 5 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".dtxs") returned 0x0 [0078.678] lstrlenW (lpString=".mdt") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".mdt") returned 0x0 [0078.678] lstrlenW (lpString=".sdf") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".sdf") returned 0x0 [0078.678] lstrlenW (lpString=".MDF") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".MDF") returned 0x0 [0078.678] lstrlenW (lpString=".DBF") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".DBF") returned 0x0 [0078.678] lstrlenW (lpString=".DB") returned 3 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".DB") returned 0x0 [0078.678] lstrlenW (lpString=".db") returned 3 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".db") returned 0x0 [0078.678] lstrlenW (lpString=".ndf") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".ndf") returned 0x0 [0078.678] lstrlenW (lpString=".NDF") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".NDF") returned 0x0 [0078.678] lstrlenW (lpString=".Mdf") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".Mdf") returned 0x0 [0078.678] lstrlenW (lpString=".dat") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".dat") returned 0x0 [0078.678] lstrlenW (lpString=".DAT") returned 4 [0078.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".DAT") returned 0x0 [0078.679] lstrlenW (lpString=".ldf") returned 4 [0078.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".ldf") returned 0x0 [0078.679] lstrlenW (lpString=".LDF") returned 4 [0078.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch=".LDF") returned 0x0 [0078.679] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0078.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.679] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0078.680] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.680] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0078.680] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19868100852) returned 1 [0078.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbdb561b0, dwHighDateTime=0x1d585b4)) [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c648 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c648 | out: hHeap=0x260000) returned 1 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0ad8 [0078.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0ad8 | out: hHeap=0x260000) returned 1 [0078.681] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0078.681] GetLastError () returned 0x0 [0078.681] GetLastError () returned 0x0 [0078.681] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0078.681] GetLastError () returned 0x0 [0078.681] GetLastError () returned 0x0 [0078.999] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.999] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.001] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.001] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.362] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.362] CloseHandle (hObject=0x108) returned 1 [0079.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0079.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.365] GetLastError () returned 0x0 [0079.365] RtlWakeConditionVariable () returned 0x0 [0079.365] GetCurrentThreadId () returned 0x99c [0079.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".ldf") returned 0x0 [0079.365] lstrlenW (lpString=".vhd") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".vhd") returned 0x0 [0079.366] lstrlenW (lpString=".vhdx") returned 5 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".vhdx") returned 0x0 [0079.366] lstrlenW (lpString=".pst") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".pst") returned 0x0 [0079.366] lstrlenW (lpString=".ost") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".ost") returned 0x0 [0079.366] lstrlenW (lpString=".bak") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".bak") returned 0x0 [0079.366] lstrlenW (lpString=".bac") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".bac") returned 0x0 [0079.366] lstrlenW (lpString=".sys") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".sys") returned 0x0 [0079.366] lstrlenW (lpString=".v2i") returned 4 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".v2i") returned 0x0 [0079.366] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0079.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.368] lstrlenW (lpString=".sql") returned 4 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".sql") returned 0x0 [0079.368] lstrlenW (lpString=".mdf") returned 4 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".mdf") returned 0x0 [0079.368] lstrlenW (lpString=".txt") returned 4 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".txt") returned 0x0 [0079.368] lstrlenW (lpString=".dbf") returned 4 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".dbf") returned 0x0 [0079.368] lstrlenW (lpString=".ckp") returned 4 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".ckp") returned 0x0 [0079.368] lstrlenW (lpString=".dacpac") returned 7 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".dacpac") returned 0x0 [0079.368] lstrlenW (lpString=".db3") returned 4 [0079.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".db3") returned 0x0 [0079.368] lstrlenW (lpString=".dtxs") returned 5 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".dtxs") returned 0x0 [0079.369] lstrlenW (lpString=".mdt") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".mdt") returned 0x0 [0079.369] lstrlenW (lpString=".sdf") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".sdf") returned 0x0 [0079.369] lstrlenW (lpString=".MDF") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".MDF") returned 0x0 [0079.369] lstrlenW (lpString=".DBF") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".DBF") returned 0x0 [0079.369] lstrlenW (lpString=".DB") returned 3 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".DB") returned 0x0 [0079.369] lstrlenW (lpString=".db") returned 3 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".db") returned 0x0 [0079.369] lstrlenW (lpString=".ndf") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".ndf") returned 0x0 [0079.369] lstrlenW (lpString=".NDF") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".NDF") returned 0x0 [0079.369] lstrlenW (lpString=".Mdf") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".Mdf") returned 0x0 [0079.369] lstrlenW (lpString=".dat") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".dat") returned 0x0 [0079.369] lstrlenW (lpString=".DAT") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".DAT") returned 0x0 [0079.369] lstrlenW (lpString=".ldf") returned 4 [0079.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".ldf") returned 0x0 [0079.370] lstrlenW (lpString=".LDF") returned 4 [0079.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch=".LDF") returned 0x0 [0079.370] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.370] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27569f0) returned 1 [0079.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.371] CryptReleaseContext (hProv=0x27569f0, dwFlags=0x0) returned 1 [0079.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.371] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19937190451) returned 1 [0079.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe1e1e30, dwHighDateTime=0x1d585b4)) [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f57b8 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f57b8 | out: hHeap=0x260000) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dea0 [0079.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.371] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.372] GetLastError () returned 0x0 [0079.372] GetLastError () returned 0x0 [0079.372] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.372] GetLastError () returned 0x0 [0079.372] GetLastError () returned 0x0 [0079.375] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.375] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.376] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.377] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.378] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.378] CloseHandle (hObject=0x108) returned 1 [0079.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0079.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0079.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0079.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.380] GetLastError () returned 0x0 [0079.380] RtlWakeConditionVariable () returned 0x0 [0079.380] GetCurrentThreadId () returned 0x99c [0079.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.381] lstrlenW (lpString=".vhd") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".vhd") returned 0x0 [0079.381] lstrlenW (lpString=".vhdx") returned 5 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".vhdx") returned 0x0 [0079.381] lstrlenW (lpString=".pst") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".pst") returned 0x0 [0079.381] lstrlenW (lpString=".ost") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".ost") returned 0x0 [0079.381] lstrlenW (lpString=".bak") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".bak") returned 0x0 [0079.381] lstrlenW (lpString=".bac") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".bac") returned 0x0 [0079.381] lstrlenW (lpString=".sys") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".sys") returned 0x0 [0079.381] lstrlenW (lpString=".v2i") returned 4 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".v2i") returned 0x0 [0079.381] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0079.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.382] lstrlenW (lpString=".sql") returned 4 [0079.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".sql") returned 0x0 [0079.382] lstrlenW (lpString=".mdf") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".mdf") returned 0x0 [0079.383] lstrlenW (lpString=".txt") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".txt") returned 0x0 [0079.383] lstrlenW (lpString=".dbf") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".dbf") returned 0x0 [0079.383] lstrlenW (lpString=".ckp") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".ckp") returned 0x0 [0079.383] lstrlenW (lpString=".dacpac") returned 7 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".dacpac") returned 0x0 [0079.383] lstrlenW (lpString=".db3") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".db3") returned 0x0 [0079.383] lstrlenW (lpString=".dtxs") returned 5 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".dtxs") returned 0x0 [0079.383] lstrlenW (lpString=".mdt") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".mdt") returned 0x0 [0079.383] lstrlenW (lpString=".sdf") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".sdf") returned 0x0 [0079.383] lstrlenW (lpString=".MDF") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".MDF") returned 0x0 [0079.383] lstrlenW (lpString=".DBF") returned 4 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".DBF") returned 0x0 [0079.383] lstrlenW (lpString=".DB") returned 3 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".DB") returned 0x0 [0079.383] lstrlenW (lpString=".db") returned 3 [0079.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".db") returned 0x0 [0079.384] lstrlenW (lpString=".ndf") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".ndf") returned 0x0 [0079.384] lstrlenW (lpString=".NDF") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".NDF") returned 0x0 [0079.384] lstrlenW (lpString=".Mdf") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".Mdf") returned 0x0 [0079.384] lstrlenW (lpString=".dat") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".dat") returned 0x0 [0079.384] lstrlenW (lpString=".DAT") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".DAT") returned 0x0 [0079.384] lstrlenW (lpString=".ldf") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.384] lstrlenW (lpString=".LDF") returned 4 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch=".LDF") returned 0x0 [0079.384] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.384] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757050) returned 1 [0079.385] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.385] CryptReleaseContext (hProv=0x2757050, dwFlags=0x0) returned 1 [0079.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.385] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19938634875) returned 1 [0079.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe207f90, dwHighDateTime=0x1d585b4)) [0079.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f57f0 [0079.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f57f0 | out: hHeap=0x260000) returned 1 [0079.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dc40 [0079.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.386] GetLastError () returned 0x0 [0079.386] GetLastError () returned 0x0 [0079.386] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.386] GetLastError () returned 0x0 [0079.387] GetLastError () returned 0x0 [0079.390] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.390] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x28b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x28b, lpOverlapped=0x0) returned 1 [0079.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.390] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.390] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.390] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.390] CloseHandle (hObject=0x108) returned 1 [0079.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0079.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.392] GetLastError () returned 0x0 [0079.392] RtlWakeConditionVariable () returned 0x0 [0079.392] GetCurrentThreadId () returned 0x99c [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.392] lstrlenW (lpString=".vhd") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".vhd") returned 0x0 [0079.392] lstrlenW (lpString=".vhdx") returned 5 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".vhdx") returned 0x0 [0079.392] lstrlenW (lpString=".pst") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".pst") returned 0x0 [0079.392] lstrlenW (lpString=".ost") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".ost") returned 0x0 [0079.392] lstrlenW (lpString=".bak") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".bak") returned 0x0 [0079.392] lstrlenW (lpString=".bac") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".bac") returned 0x0 [0079.392] lstrlenW (lpString=".sys") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".sys") returned 0x0 [0079.392] lstrlenW (lpString=".v2i") returned 4 [0079.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".v2i") returned 0x0 [0079.392] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0079.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.394] lstrlenW (lpString=".sql") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".sql") returned 0x0 [0079.394] lstrlenW (lpString=".mdf") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".mdf") returned 0x0 [0079.394] lstrlenW (lpString=".txt") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".txt") returned 0x0 [0079.394] lstrlenW (lpString=".dbf") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".dbf") returned 0x0 [0079.394] lstrlenW (lpString=".ckp") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".ckp") returned 0x0 [0079.394] lstrlenW (lpString=".dacpac") returned 7 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".dacpac") returned 0x0 [0079.394] lstrlenW (lpString=".db3") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".db3") returned 0x0 [0079.394] lstrlenW (lpString=".dtxs") returned 5 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".dtxs") returned 0x0 [0079.394] lstrlenW (lpString=".mdt") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".mdt") returned 0x0 [0079.394] lstrlenW (lpString=".sdf") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".sdf") returned 0x0 [0079.394] lstrlenW (lpString=".MDF") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".MDF") returned 0x0 [0079.394] lstrlenW (lpString=".DBF") returned 4 [0079.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".DBF") returned 0x0 [0079.394] lstrlenW (lpString=".DB") returned 3 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".DB") returned 0x0 [0079.395] lstrlenW (lpString=".db") returned 3 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".db") returned 0x0 [0079.395] lstrlenW (lpString=".ndf") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".ndf") returned 0x0 [0079.395] lstrlenW (lpString=".NDF") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".NDF") returned 0x0 [0079.395] lstrlenW (lpString=".Mdf") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".Mdf") returned 0x0 [0079.395] lstrlenW (lpString=".dat") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".dat") returned 0x0 [0079.395] lstrlenW (lpString=".DAT") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".DAT") returned 0x0 [0079.395] lstrlenW (lpString=".ldf") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.395] lstrlenW (lpString=".LDF") returned 4 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch=".LDF") returned 0x0 [0079.395] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.395] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757050) returned 1 [0079.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.396] CryptReleaseContext (hProv=0x2757050, dwFlags=0x0) returned 1 [0079.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0079.396] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19939743451) returned 1 [0079.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe22e0f0, dwHighDateTime=0x1d585b4)) [0079.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0079.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0079.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0079.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f56a0 [0079.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f56a0 | out: hHeap=0x260000) returned 1 [0079.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275dba8 [0079.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.397] GetLastError () returned 0x0 [0079.397] GetLastError () returned 0x0 [0079.397] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.398] GetLastError () returned 0x0 [0079.398] GetLastError () returned 0x0 [0079.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.399] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd3, lpOverlapped=0x0) returned 1 [0079.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.399] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.399] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.399] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.399] CloseHandle (hObject=0x108) returned 1 [0079.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0079.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0079.401] GetLastError () returned 0x0 [0079.401] RtlWakeConditionVariable () returned 0x0 [0079.401] GetCurrentThreadId () returned 0x99c [0079.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.401] lstrlenW (lpString=".vhd") returned 4 [0079.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.401] lstrlenW (lpString=".vhdx") returned 5 [0079.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.401] lstrlenW (lpString=".pst") returned 4 [0079.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".pst") returned 0x0 [0079.401] lstrlenW (lpString=".ost") returned 4 [0079.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".ost") returned 0x0 [0079.402] lstrlenW (lpString=".bak") returned 4 [0079.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".bak") returned 0x0 [0079.402] lstrlenW (lpString=".bac") returned 4 [0079.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".bac") returned 0x0 [0079.402] lstrlenW (lpString=".sys") returned 4 [0079.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".sys") returned 0x0 [0079.402] lstrlenW (lpString=".v2i") returned 4 [0079.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.402] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.427] lstrlenW (lpString=".sql") returned 4 [0079.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".sql") returned 0x0 [0079.470] lstrlenW (lpString=".mdf") returned 4 [0079.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.476] lstrlenW (lpString=".txt") returned 4 [0079.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".txt") returned 0x0 [0079.476] lstrlenW (lpString=".dbf") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.482] lstrlenW (lpString=".ckp") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.482] lstrlenW (lpString=".dacpac") returned 7 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.482] lstrlenW (lpString=".db3") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".db3") returned 0x0 [0079.482] lstrlenW (lpString=".dtxs") returned 5 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.482] lstrlenW (lpString=".mdt") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.482] lstrlenW (lpString=".sdf") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.483] lstrlenW (lpString=".MDF") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.483] lstrlenW (lpString=".DBF") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.483] lstrlenW (lpString=".DB") returned 3 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".DB") returned 0x0 [0079.483] lstrlenW (lpString=".db") returned 3 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".db") returned 0x0 [0079.483] lstrlenW (lpString=".ndf") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.483] lstrlenW (lpString=".NDF") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.483] lstrlenW (lpString=".Mdf") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.483] lstrlenW (lpString=".dat") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".dat") returned 0x0 [0079.483] lstrlenW (lpString=".DAT") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.483] lstrlenW (lpString=".ldf") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.483] lstrlenW (lpString=".LDF") returned 4 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.483] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.484] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.484] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.484] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.485] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19948568864) returned 1 [0079.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe312930, dwHighDateTime=0x1d585b4)) [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5588 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5588 | out: hHeap=0x260000) returned 1 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d8b0 [0079.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.485] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.485] GetLastError () returned 0x0 [0079.486] GetLastError () returned 0x0 [0079.486] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.486] GetLastError () returned 0x0 [0079.486] GetLastError () returned 0x0 [0079.487] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.487] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0079.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.487] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.487] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.487] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.487] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.488] CloseHandle (hObject=0x108) returned 1 [0079.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.489] GetLastError () returned 0x0 [0079.489] RtlWakeConditionVariable () returned 0x27e828 [0079.490] GetCurrentThreadId () returned 0x99c [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.490] lstrlenW (lpString=".vhd") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".vhd") returned 0x0 [0079.490] lstrlenW (lpString=".vhdx") returned 5 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".vhdx") returned 0x0 [0079.490] lstrlenW (lpString=".pst") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".pst") returned 0x0 [0079.490] lstrlenW (lpString=".ost") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".ost") returned 0x0 [0079.490] lstrlenW (lpString=".bak") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".bak") returned 0x0 [0079.490] lstrlenW (lpString=".bac") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".bac") returned 0x0 [0079.490] lstrlenW (lpString=".sys") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".sys") returned 0x0 [0079.490] lstrlenW (lpString=".v2i") returned 4 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".v2i") returned 0x0 [0079.490] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0079.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.491] lstrlenW (lpString=".sql") returned 4 [0079.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".sql") returned 0x0 [0079.491] lstrlenW (lpString=".mdf") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".mdf") returned 0x0 [0079.492] lstrlenW (lpString=".txt") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".txt") returned 0x0 [0079.492] lstrlenW (lpString=".dbf") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".dbf") returned 0x0 [0079.492] lstrlenW (lpString=".ckp") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".ckp") returned 0x0 [0079.492] lstrlenW (lpString=".dacpac") returned 7 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".dacpac") returned 0x0 [0079.492] lstrlenW (lpString=".db3") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".db3") returned 0x0 [0079.492] lstrlenW (lpString=".dtxs") returned 5 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".dtxs") returned 0x0 [0079.492] lstrlenW (lpString=".mdt") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".mdt") returned 0x0 [0079.492] lstrlenW (lpString=".sdf") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".sdf") returned 0x0 [0079.492] lstrlenW (lpString=".MDF") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".MDF") returned 0x0 [0079.492] lstrlenW (lpString=".DBF") returned 4 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".DBF") returned 0x0 [0079.492] lstrlenW (lpString=".DB") returned 3 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".DB") returned 0x0 [0079.492] lstrlenW (lpString=".db") returned 3 [0079.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".db") returned 0x0 [0079.492] lstrlenW (lpString=".ndf") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".ndf") returned 0x0 [0079.493] lstrlenW (lpString=".NDF") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".NDF") returned 0x0 [0079.493] lstrlenW (lpString=".Mdf") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".Mdf") returned 0x0 [0079.493] lstrlenW (lpString=".dat") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".dat") returned 0x0 [0079.493] lstrlenW (lpString=".DAT") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".DAT") returned 0x0 [0079.493] lstrlenW (lpString=".ldf") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.493] lstrlenW (lpString=".LDF") returned 4 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch=".LDF") returned 0x0 [0079.493] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.493] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.494] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.494] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.494] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19949532273) returned 1 [0079.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe312930, dwHighDateTime=0x1d585b4)) [0079.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f55c0 [0079.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f55c0 | out: hHeap=0x260000) returned 1 [0079.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d948 [0079.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.495] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.495] GetLastError () returned 0x0 [0079.495] GetLastError () returned 0x0 [0079.495] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.495] GetLastError () returned 0x0 [0079.496] GetLastError () returned 0x0 [0079.499] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.499] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x28b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x28b, lpOverlapped=0x0) returned 1 [0079.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.499] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.499] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.499] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.499] CloseHandle (hObject=0x108) returned 1 [0079.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0079.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.502] GetLastError () returned 0x0 [0079.503] RtlWakeConditionVariable () returned 0x0 [0079.503] GetCurrentThreadId () returned 0x99c [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.503] lstrlenW (lpString=".vhd") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".vhd") returned 0x0 [0079.503] lstrlenW (lpString=".vhdx") returned 5 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".vhdx") returned 0x0 [0079.503] lstrlenW (lpString=".pst") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".pst") returned 0x0 [0079.503] lstrlenW (lpString=".ost") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".ost") returned 0x0 [0079.503] lstrlenW (lpString=".bak") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".bak") returned 0x0 [0079.503] lstrlenW (lpString=".bac") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".bac") returned 0x0 [0079.503] lstrlenW (lpString=".sys") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".sys") returned 0x0 [0079.503] lstrlenW (lpString=".v2i") returned 4 [0079.503] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".v2i") returned 0x0 [0079.504] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0079.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.505] lstrlenW (lpString=".sql") returned 4 [0079.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".sql") returned 0x0 [0079.505] lstrlenW (lpString=".mdf") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".mdf") returned 0x0 [0079.506] lstrlenW (lpString=".txt") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".txt") returned 0x0 [0079.506] lstrlenW (lpString=".dbf") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".dbf") returned 0x0 [0079.506] lstrlenW (lpString=".ckp") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".ckp") returned 0x0 [0079.506] lstrlenW (lpString=".dacpac") returned 7 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".dacpac") returned 0x0 [0079.506] lstrlenW (lpString=".db3") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".db3") returned 0x0 [0079.506] lstrlenW (lpString=".dtxs") returned 5 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".dtxs") returned 0x0 [0079.506] lstrlenW (lpString=".mdt") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".mdt") returned 0x0 [0079.506] lstrlenW (lpString=".sdf") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".sdf") returned 0x0 [0079.506] lstrlenW (lpString=".MDF") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".MDF") returned 0x0 [0079.506] lstrlenW (lpString=".DBF") returned 4 [0079.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".DBF") returned 0x0 [0079.507] lstrlenW (lpString=".DB") returned 3 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".DB") returned 0x0 [0079.507] lstrlenW (lpString=".db") returned 3 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".db") returned 0x0 [0079.507] lstrlenW (lpString=".ndf") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".ndf") returned 0x0 [0079.507] lstrlenW (lpString=".NDF") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".NDF") returned 0x0 [0079.507] lstrlenW (lpString=".Mdf") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".Mdf") returned 0x0 [0079.507] lstrlenW (lpString=".dat") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".dat") returned 0x0 [0079.507] lstrlenW (lpString=".DAT") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".DAT") returned 0x0 [0079.507] lstrlenW (lpString=".ldf") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.507] lstrlenW (lpString=".LDF") returned 4 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch=".LDF") returned 0x0 [0079.507] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.508] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.508] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.509] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.509] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19950992038) returned 1 [0079.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe338a90, dwHighDateTime=0x1d585b4)) [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f55f8 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f55f8 | out: hHeap=0x260000) returned 1 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d780 [0079.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.510] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.510] GetLastError () returned 0x0 [0079.510] GetLastError () returned 0x0 [0079.510] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.510] GetLastError () returned 0x0 [0079.510] GetLastError () returned 0x0 [0079.512] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.512] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd3, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd3, lpOverlapped=0x0) returned 1 [0079.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.512] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.512] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.512] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.512] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.513] CloseHandle (hObject=0x108) returned 1 [0079.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.513] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0079.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.515] GetLastError () returned 0x0 [0079.515] RtlWakeConditionVariable () returned 0x0 [0079.515] GetCurrentThreadId () returned 0x99c [0079.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.515] lstrlenW (lpString=".vhd") returned 4 [0079.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.515] lstrlenW (lpString=".vhdx") returned 5 [0079.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.516] lstrlenW (lpString=".pst") returned 4 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".pst") returned 0x0 [0079.516] lstrlenW (lpString=".ost") returned 4 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".ost") returned 0x0 [0079.516] lstrlenW (lpString=".bak") returned 4 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".bak") returned 0x0 [0079.516] lstrlenW (lpString=".bac") returned 4 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".bac") returned 0x0 [0079.516] lstrlenW (lpString=".sys") returned 4 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".sys") returned 0x0 [0079.516] lstrlenW (lpString=".v2i") returned 4 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.516] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.518] lstrlenW (lpString=".sql") returned 4 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".sql") returned 0x0 [0079.518] lstrlenW (lpString=".mdf") returned 4 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.518] lstrlenW (lpString=".txt") returned 4 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".txt") returned 0x0 [0079.518] lstrlenW (lpString=".dbf") returned 4 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.518] lstrlenW (lpString=".ckp") returned 4 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.518] lstrlenW (lpString=".dacpac") returned 7 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.518] lstrlenW (lpString=".db3") returned 4 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".db3") returned 0x0 [0079.518] lstrlenW (lpString=".dtxs") returned 5 [0079.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.518] lstrlenW (lpString=".mdt") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.519] lstrlenW (lpString=".sdf") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.519] lstrlenW (lpString=".MDF") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.519] lstrlenW (lpString=".DBF") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.519] lstrlenW (lpString=".DB") returned 3 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".DB") returned 0x0 [0079.519] lstrlenW (lpString=".db") returned 3 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".db") returned 0x0 [0079.519] lstrlenW (lpString=".ndf") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.519] lstrlenW (lpString=".NDF") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.519] lstrlenW (lpString=".Mdf") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.519] lstrlenW (lpString=".dat") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".dat") returned 0x0 [0079.519] lstrlenW (lpString=".DAT") returned 4 [0079.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.520] lstrlenW (lpString=".ldf") returned 4 [0079.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.520] lstrlenW (lpString=".LDF") returned 4 [0079.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.520] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.520] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.521] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.521] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.521] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19952227241) returned 1 [0079.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe35ebf0, dwHighDateTime=0x1d585b4)) [0079.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5630 [0079.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5630 | out: hHeap=0x260000) returned 1 [0079.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1018 [0079.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d8b0 [0079.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1018 | out: hHeap=0x260000) returned 1 [0079.522] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.522] GetLastError () returned 0x0 [0079.522] GetLastError () returned 0x0 [0079.523] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.523] GetLastError () returned 0x0 [0079.523] GetLastError () returned 0x0 [0079.524] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.524] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x72, lpOverlapped=0x0) returned 1 [0079.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.524] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.525] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.525] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.525] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.525] CloseHandle (hObject=0x108) returned 1 [0079.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.527] GetLastError () returned 0x0 [0079.528] RtlWakeConditionVariable () returned 0x27e828 [0079.528] GetCurrentThreadId () returned 0x99c [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.528] lstrlenW (lpString=".vhd") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.528] lstrlenW (lpString=".vhdx") returned 5 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.528] lstrlenW (lpString=".pst") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".pst") returned 0x0 [0079.528] lstrlenW (lpString=".ost") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".ost") returned 0x0 [0079.528] lstrlenW (lpString=".bak") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".bak") returned 0x0 [0079.528] lstrlenW (lpString=".bac") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".bac") returned 0x0 [0079.528] lstrlenW (lpString=".sys") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".sys") returned 0x0 [0079.528] lstrlenW (lpString=".v2i") returned 4 [0079.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.528] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.530] lstrlenW (lpString=".sql") returned 4 [0079.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".sql") returned 0x0 [0079.530] lstrlenW (lpString=".mdf") returned 4 [0079.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.530] lstrlenW (lpString=".txt") returned 4 [0079.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".txt") returned 0x0 [0079.531] lstrlenW (lpString=".dbf") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.531] lstrlenW (lpString=".ckp") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.531] lstrlenW (lpString=".dacpac") returned 7 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.531] lstrlenW (lpString=".db3") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".db3") returned 0x0 [0079.531] lstrlenW (lpString=".dtxs") returned 5 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.531] lstrlenW (lpString=".mdt") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.531] lstrlenW (lpString=".sdf") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.531] lstrlenW (lpString=".MDF") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.531] lstrlenW (lpString=".DBF") returned 4 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.531] lstrlenW (lpString=".DB") returned 3 [0079.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".DB") returned 0x0 [0079.531] lstrlenW (lpString=".db") returned 3 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".db") returned 0x0 [0079.532] lstrlenW (lpString=".ndf") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.532] lstrlenW (lpString=".NDF") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.532] lstrlenW (lpString=".Mdf") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.532] lstrlenW (lpString=".dat") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".dat") returned 0x0 [0079.532] lstrlenW (lpString=".DAT") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.532] lstrlenW (lpString=".ldf") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.532] lstrlenW (lpString=".LDF") returned 4 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.532] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.532] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.533] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.533] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.534] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19953480989) returned 1 [0079.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe384d50, dwHighDateTime=0x1d585b4)) [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cfe8 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cfe8 | out: hHeap=0x260000) returned 1 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d8b0 [0079.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.534] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.535] GetLastError () returned 0x0 [0079.535] GetLastError () returned 0x0 [0079.535] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.535] GetLastError () returned 0x0 [0079.535] GetLastError () returned 0x0 [0079.536] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.537] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x71, lpOverlapped=0x0) returned 1 [0079.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.537] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.537] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.537] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.537] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.638] CloseHandle (hObject=0x108) returned 1 [0079.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.641] GetLastError () returned 0x0 [0079.641] RtlWakeConditionVariable () returned 0x0 [0079.641] GetCurrentThreadId () returned 0x99c [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".ldf") returned 0x0 [0079.642] lstrlenW (lpString=".vhd") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".vhd") returned 0x0 [0079.642] lstrlenW (lpString=".vhdx") returned 5 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".vhdx") returned 0x0 [0079.642] lstrlenW (lpString=".pst") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".pst") returned 0x0 [0079.642] lstrlenW (lpString=".ost") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".ost") returned 0x0 [0079.642] lstrlenW (lpString=".bak") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".bak") returned 0x0 [0079.642] lstrlenW (lpString=".bac") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".bac") returned 0x0 [0079.642] lstrlenW (lpString=".sys") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".sys") returned 0x0 [0079.642] lstrlenW (lpString=".v2i") returned 4 [0079.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".v2i") returned 0x0 [0079.642] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0079.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.644] lstrlenW (lpString=".sql") returned 4 [0079.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".sql") returned 0x0 [0079.644] lstrlenW (lpString=".mdf") returned 4 [0079.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".mdf") returned 0x0 [0079.644] lstrlenW (lpString=".txt") returned 4 [0079.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".txt") returned 0x0 [0079.644] lstrlenW (lpString=".dbf") returned 4 [0079.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".dbf") returned 0x0 [0079.645] lstrlenW (lpString=".ckp") returned 4 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".ckp") returned 0x0 [0079.645] lstrlenW (lpString=".dacpac") returned 7 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".dacpac") returned 0x0 [0079.645] lstrlenW (lpString=".db3") returned 4 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".db3") returned 0x0 [0079.645] lstrlenW (lpString=".dtxs") returned 5 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".dtxs") returned 0x0 [0079.645] lstrlenW (lpString=".mdt") returned 4 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".mdt") returned 0x0 [0079.645] lstrlenW (lpString=".sdf") returned 4 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".sdf") returned 0x0 [0079.645] lstrlenW (lpString=".MDF") returned 4 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".MDF") returned 0x0 [0079.645] lstrlenW (lpString=".DBF") returned 4 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".DBF") returned 0x0 [0079.645] lstrlenW (lpString=".DB") returned 3 [0079.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".DB") returned 0x0 [0079.645] lstrlenW (lpString=".db") returned 3 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".db") returned 0x0 [0079.646] lstrlenW (lpString=".ndf") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".ndf") returned 0x0 [0079.646] lstrlenW (lpString=".NDF") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".NDF") returned 0x0 [0079.646] lstrlenW (lpString=".Mdf") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".Mdf") returned 0x0 [0079.646] lstrlenW (lpString=".dat") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".dat") returned 0x0 [0079.646] lstrlenW (lpString=".DAT") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".DAT") returned 0x0 [0079.646] lstrlenW (lpString=".ldf") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".ldf") returned 0x0 [0079.646] lstrlenW (lpString=".LDF") returned 4 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch=".LDF") returned 0x0 [0079.646] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.646] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.647] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.648] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19965049921) returned 1 [0079.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe48f6f0, dwHighDateTime=0x1d585b4)) [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ce98 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ce98 | out: hHeap=0x260000) returned 1 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d520 [0079.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.650] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.651] GetLastError () returned 0x0 [0079.651] GetLastError () returned 0x0 [0079.651] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.651] GetLastError () returned 0x0 [0079.651] GetLastError () returned 0x0 [0079.657] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff5aa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.657] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa560, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xa560, lpOverlapped=0x0) returned 1 [0079.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.657] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.657] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.657] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.657] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.657] CloseHandle (hObject=0x108) returned 1 [0079.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.658] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.[deadmin@cock.li].deadmin")) returned 1 [0079.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.661] GetLastError () returned 0x0 [0079.661] RtlWakeConditionVariable () returned 0x0 [0079.661] GetCurrentThreadId () returned 0x99c [0079.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".ldf") returned 0x0 [0079.661] lstrlenW (lpString=".vhd") returned 4 [0079.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".vhd") returned 0x0 [0079.661] lstrlenW (lpString=".vhdx") returned 5 [0079.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".vhdx") returned 0x0 [0079.661] lstrlenW (lpString=".pst") returned 4 [0079.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".pst") returned 0x0 [0079.661] lstrlenW (lpString=".ost") returned 4 [0079.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".ost") returned 0x0 [0079.661] lstrlenW (lpString=".bak") returned 4 [0079.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".bak") returned 0x0 [0079.662] lstrlenW (lpString=".bac") returned 4 [0079.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".bac") returned 0x0 [0079.662] lstrlenW (lpString=".sys") returned 4 [0079.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".sys") returned 0x0 [0079.662] lstrlenW (lpString=".v2i") returned 4 [0079.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".v2i") returned 0x0 [0079.662] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.664] lstrlenW (lpString=".sql") returned 4 [0079.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".sql") returned 0x0 [0079.664] lstrlenW (lpString=".mdf") returned 4 [0079.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".mdf") returned 0x0 [0079.664] lstrlenW (lpString=".txt") returned 4 [0079.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".txt") returned 0x0 [0079.664] lstrlenW (lpString=".dbf") returned 4 [0079.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".dbf") returned 0x0 [0079.664] lstrlenW (lpString=".ckp") returned 4 [0079.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".ckp") returned 0x0 [0079.664] lstrlenW (lpString=".dacpac") returned 7 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".dacpac") returned 0x0 [0079.665] lstrlenW (lpString=".db3") returned 4 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".db3") returned 0x0 [0079.665] lstrlenW (lpString=".dtxs") returned 5 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".dtxs") returned 0x0 [0079.665] lstrlenW (lpString=".mdt") returned 4 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".mdt") returned 0x0 [0079.665] lstrlenW (lpString=".sdf") returned 4 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".sdf") returned 0x0 [0079.665] lstrlenW (lpString=".MDF") returned 4 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".MDF") returned 0x0 [0079.665] lstrlenW (lpString=".DBF") returned 4 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".DBF") returned 0x0 [0079.665] lstrlenW (lpString=".DB") returned 3 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".DB") returned 0x0 [0079.665] lstrlenW (lpString=".db") returned 3 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".db") returned 0x0 [0079.665] lstrlenW (lpString=".ndf") returned 4 [0079.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".ndf") returned 0x0 [0079.665] lstrlenW (lpString=".NDF") returned 4 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".NDF") returned 0x0 [0079.666] lstrlenW (lpString=".Mdf") returned 4 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".Mdf") returned 0x0 [0079.666] lstrlenW (lpString=".dat") returned 4 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".dat") returned 0x0 [0079.666] lstrlenW (lpString=".DAT") returned 4 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".DAT") returned 0x0 [0079.666] lstrlenW (lpString=".ldf") returned 4 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".ldf") returned 0x0 [0079.666] lstrlenW (lpString=".LDF") returned 4 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch=".LDF") returned 0x0 [0079.666] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.666] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757380) returned 1 [0079.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.667] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0079.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.668] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19966873788) returned 1 [0079.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe4b5850, dwHighDateTime=0x1d585b4)) [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ce60 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ce60 | out: hHeap=0x260000) returned 1 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d488 [0079.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.669] GetLastError () returned 0x0 [0079.669] GetLastError () returned 0x0 [0079.669] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.669] GetLastError () returned 0x0 [0079.670] GetLastError () returned 0x0 [0079.673] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.673] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.675] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.675] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.894] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.894] CloseHandle (hObject=0x108) returned 1 [0079.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0079.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.942] GetLastError () returned 0x0 [0079.942] RtlWakeConditionVariable () returned 0x27e828 [0079.942] GetCurrentThreadId () returned 0x99c [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".ldf") returned 0x0 [0079.943] lstrlenW (lpString=".vhd") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".vhd") returned 0x0 [0079.943] lstrlenW (lpString=".vhdx") returned 5 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".vhdx") returned 0x0 [0079.943] lstrlenW (lpString=".pst") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".pst") returned 0x0 [0079.943] lstrlenW (lpString=".ost") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".ost") returned 0x0 [0079.943] lstrlenW (lpString=".bak") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".bak") returned 0x0 [0079.943] lstrlenW (lpString=".bac") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".bac") returned 0x0 [0079.943] lstrlenW (lpString=".sys") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".sys") returned 0x0 [0079.943] lstrlenW (lpString=".v2i") returned 4 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".v2i") returned 0x0 [0079.943] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch="s\r\n.v2i") returned 0x0 [0079.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.945] lstrlenW (lpString=".sql") returned 4 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".sql") returned 0x0 [0079.945] lstrlenW (lpString=".mdf") returned 4 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".mdf") returned 0x0 [0079.945] lstrlenW (lpString=".txt") returned 4 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".txt") returned 0x0 [0079.945] lstrlenW (lpString=".dbf") returned 4 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".dbf") returned 0x0 [0079.945] lstrlenW (lpString=".ckp") returned 4 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".ckp") returned 0x0 [0079.945] lstrlenW (lpString=".dacpac") returned 7 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".dacpac") returned 0x0 [0079.945] lstrlenW (lpString=".db3") returned 4 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".db3") returned 0x0 [0079.945] lstrlenW (lpString=".dtxs") returned 5 [0079.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".dtxs") returned 0x0 [0079.945] lstrlenW (lpString=".mdt") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".mdt") returned 0x0 [0079.946] lstrlenW (lpString=".sdf") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".sdf") returned 0x0 [0079.946] lstrlenW (lpString=".MDF") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".MDF") returned 0x0 [0079.946] lstrlenW (lpString=".DBF") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".DBF") returned 0x0 [0079.946] lstrlenW (lpString=".DB") returned 3 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".DB") returned 0x0 [0079.946] lstrlenW (lpString=".db") returned 3 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".db") returned 0x0 [0079.946] lstrlenW (lpString=".ndf") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".ndf") returned 0x0 [0079.946] lstrlenW (lpString=".NDF") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".NDF") returned 0x0 [0079.946] lstrlenW (lpString=".Mdf") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".Mdf") returned 0x0 [0079.946] lstrlenW (lpString=".dat") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".dat") returned 0x0 [0079.946] lstrlenW (lpString=".DAT") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".DAT") returned 0x0 [0079.946] lstrlenW (lpString=".ldf") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".ldf") returned 0x0 [0079.946] lstrlenW (lpString=".LDF") returned 4 [0079.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch=".LDF") returned 0x0 [0079.947] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.947] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.947] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.947] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.948] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.948] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19994883683) returned 1 [0079.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe763110, dwHighDateTime=0x1d585b4)) [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ccd8 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ccd8 | out: hHeap=0x260000) returned 1 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3268a0 [0079.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.949] GetLastError () returned 0x0 [0079.949] GetLastError () returned 0x0 [0079.949] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.949] GetLastError () returned 0x0 [0079.949] GetLastError () returned 0x0 [0079.957] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd295, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.957] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x2d6b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x2d6b, lpOverlapped=0x0) returned 1 [0079.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0079.957] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.957] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.957] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.957] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.957] CloseHandle (hObject=0x108) returned 1 [0079.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.[deadmin@cock.li].deadmin")) returned 1 [0079.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.959] GetLastError () returned 0x0 [0079.960] RtlWakeConditionVariable () returned 0x0 [0079.960] GetCurrentThreadId () returned 0x99c [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.960] lstrlenW (lpString=".vhd") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0079.960] lstrlenW (lpString=".vhdx") returned 5 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0079.960] lstrlenW (lpString=".pst") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0079.960] lstrlenW (lpString=".ost") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0079.960] lstrlenW (lpString=".bak") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0079.960] lstrlenW (lpString=".bac") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0079.960] lstrlenW (lpString=".sys") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0079.960] lstrlenW (lpString=".v2i") returned 4 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0079.960] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.962] lstrlenW (lpString=".sql") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0079.962] lstrlenW (lpString=".mdf") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0079.962] lstrlenW (lpString=".txt") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0079.962] lstrlenW (lpString=".dbf") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0079.962] lstrlenW (lpString=".ckp") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0079.962] lstrlenW (lpString=".dacpac") returned 7 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0079.962] lstrlenW (lpString=".db3") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0079.962] lstrlenW (lpString=".dtxs") returned 5 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0079.962] lstrlenW (lpString=".mdt") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0079.962] lstrlenW (lpString=".sdf") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0079.962] lstrlenW (lpString=".MDF") returned 4 [0079.962] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0079.962] lstrlenW (lpString=".DBF") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0079.963] lstrlenW (lpString=".DB") returned 3 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0079.963] lstrlenW (lpString=".db") returned 3 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0079.963] lstrlenW (lpString=".ndf") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0079.963] lstrlenW (lpString=".NDF") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0079.963] lstrlenW (lpString=".Mdf") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0079.963] lstrlenW (lpString=".dat") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0079.963] lstrlenW (lpString=".DAT") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0079.963] lstrlenW (lpString=".ldf") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.963] lstrlenW (lpString=".LDF") returned 4 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0079.963] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.963] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.964] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.964] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19996558742) returned 1 [0079.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe789270, dwHighDateTime=0x1d585b4)) [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cbf8 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cbf8 | out: hHeap=0x260000) returned 1 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1210 [0079.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d228 [0079.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1210 | out: hHeap=0x260000) returned 1 [0079.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.965] GetLastError () returned 0x0 [0079.966] GetLastError () returned 0x0 [0079.966] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.966] GetLastError () returned 0x0 [0079.966] GetLastError () returned 0x0 [0079.968] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.968] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x18380, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x18380, lpOverlapped=0x0) returned 1 [0079.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.968] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.969] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.969] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.969] CloseHandle (hObject=0x108) returned 1 [0079.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0079.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.971] GetLastError () returned 0x0 [0079.971] RtlWakeConditionVariable () returned 0x27e828 [0079.971] GetCurrentThreadId () returned 0x99c [0079.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.971] lstrlenW (lpString=".vhd") returned 4 [0079.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".vhd") returned 0x0 [0079.971] lstrlenW (lpString=".vhdx") returned 5 [0079.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0079.971] lstrlenW (lpString=".pst") returned 4 [0079.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".pst") returned 0x0 [0079.972] lstrlenW (lpString=".ost") returned 4 [0079.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".ost") returned 0x0 [0079.972] lstrlenW (lpString=".bak") returned 4 [0079.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".bak") returned 0x0 [0079.972] lstrlenW (lpString=".bac") returned 4 [0079.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".bac") returned 0x0 [0079.972] lstrlenW (lpString=".sys") returned 4 [0079.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".sys") returned 0x0 [0079.972] lstrlenW (lpString=".v2i") returned 4 [0079.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".v2i") returned 0x0 [0079.972] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0079.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0079.977] lstrlenW (lpString=".sql") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".sql") returned 0x0 [0079.977] lstrlenW (lpString=".mdf") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".mdf") returned 0x0 [0079.977] lstrlenW (lpString=".txt") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".txt") returned 0x0 [0079.977] lstrlenW (lpString=".dbf") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".dbf") returned 0x0 [0079.977] lstrlenW (lpString=".ckp") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".ckp") returned 0x0 [0079.977] lstrlenW (lpString=".dacpac") returned 7 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0079.977] lstrlenW (lpString=".db3") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".db3") returned 0x0 [0079.977] lstrlenW (lpString=".dtxs") returned 5 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0079.977] lstrlenW (lpString=".mdt") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".mdt") returned 0x0 [0079.977] lstrlenW (lpString=".sdf") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".sdf") returned 0x0 [0079.977] lstrlenW (lpString=".MDF") returned 4 [0079.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".MDF") returned 0x0 [0079.978] lstrlenW (lpString=".DBF") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".DBF") returned 0x0 [0079.978] lstrlenW (lpString=".DB") returned 3 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".DB") returned 0x0 [0079.978] lstrlenW (lpString=".db") returned 3 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".db") returned 0x0 [0079.978] lstrlenW (lpString=".ndf") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".ndf") returned 0x0 [0079.978] lstrlenW (lpString=".NDF") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".NDF") returned 0x0 [0079.978] lstrlenW (lpString=".Mdf") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0079.978] lstrlenW (lpString=".dat") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".dat") returned 0x0 [0079.978] lstrlenW (lpString=".DAT") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".DAT") returned 0x0 [0079.978] lstrlenW (lpString=".ldf") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".ldf") returned 0x0 [0079.978] lstrlenW (lpString=".LDF") returned 4 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch=".LDF") returned 0x0 [0079.978] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.978] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2756f40) returned 1 [0079.979] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.979] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.980] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=19998068091) returned 1 [0079.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe7af3d0, dwHighDateTime=0x1d585b4)) [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cc68 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cc68 | out: hHeap=0x260000) returned 1 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d12b8 [0079.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d228 [0079.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d12b8 | out: hHeap=0x260000) returned 1 [0079.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0079.980] GetLastError () returned 0x0 [0079.981] GetLastError () returned 0x0 [0079.981] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0079.981] GetLastError () returned 0x0 [0079.981] GetLastError () returned 0x0 [0080.010] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.010] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.011] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.011] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.014] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.014] CloseHandle (hObject=0x108) returned 1 [0080.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0080.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.043] GetLastError () returned 0x0 [0080.043] RtlWakeConditionVariable () returned 0x27e828 [0080.043] GetCurrentThreadId () returned 0x99c [0080.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0080.057] lstrlenW (lpString=".vhd") returned 4 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0080.057] lstrlenW (lpString=".vhdx") returned 5 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0080.057] lstrlenW (lpString=".pst") returned 4 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0080.057] lstrlenW (lpString=".ost") returned 4 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0080.057] lstrlenW (lpString=".bak") returned 4 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0080.057] lstrlenW (lpString=".bac") returned 4 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0080.057] lstrlenW (lpString=".sys") returned 4 [0080.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0080.057] lstrlenW (lpString=".v2i") returned 4 [0080.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0080.058] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.059] lstrlenW (lpString=".sql") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0080.059] lstrlenW (lpString=".mdf") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0080.059] lstrlenW (lpString=".txt") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0080.059] lstrlenW (lpString=".dbf") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0080.059] lstrlenW (lpString=".ckp") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0080.059] lstrlenW (lpString=".dacpac") returned 7 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0080.059] lstrlenW (lpString=".db3") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0080.059] lstrlenW (lpString=".dtxs") returned 5 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0080.059] lstrlenW (lpString=".mdt") returned 4 [0080.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0080.060] lstrlenW (lpString=".sdf") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0080.060] lstrlenW (lpString=".MDF") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0080.060] lstrlenW (lpString=".DBF") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0080.060] lstrlenW (lpString=".DB") returned 3 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0080.060] lstrlenW (lpString=".db") returned 3 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0080.060] lstrlenW (lpString=".ndf") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0080.060] lstrlenW (lpString=".NDF") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0080.060] lstrlenW (lpString=".Mdf") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0080.060] lstrlenW (lpString=".dat") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0080.060] lstrlenW (lpString=".DAT") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0080.060] lstrlenW (lpString=".ldf") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0080.060] lstrlenW (lpString=".LDF") returned 4 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0080.060] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.061] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757628) returned 1 [0080.061] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.061] CryptReleaseContext (hProv=0x2757628, dwFlags=0x0) returned 1 [0080.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.062] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20006274327) returned 1 [0080.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe893c10, dwHighDateTime=0x1d585b4)) [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cb18 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cb18 | out: hHeap=0x260000) returned 1 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1360 [0080.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1360 | out: hHeap=0x260000) returned 1 [0080.062] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.062] GetLastError () returned 0x0 [0080.063] GetLastError () returned 0x0 [0080.063] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.063] GetLastError () returned 0x0 [0080.063] GetLastError () returned 0x0 [0080.066] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffce80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.066] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3180, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x3180, lpOverlapped=0x0) returned 1 [0080.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.066] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.066] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.066] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.066] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.066] CloseHandle (hObject=0x108) returned 1 [0080.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0080.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.068] GetLastError () returned 0x0 [0080.068] RtlWakeConditionVariable () returned 0x0 [0080.068] GetCurrentThreadId () returned 0x99c [0080.068] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.068] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.068] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0080.069] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0080.185] CloseHandle (hObject=0x108) returned 1 [0080.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d14b0 | out: hHeap=0x260000) returned 1 [0080.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.185] RtlWakeConditionVariable () returned 0x0 [0080.185] GetCurrentThreadId () returned 0x99c [0080.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".ldf") returned 0x0 [0080.185] lstrlenW (lpString=".vhd") returned 4 [0080.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".vhd") returned 0x0 [0080.186] lstrlenW (lpString=".vhdx") returned 5 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".vhdx") returned 0x0 [0080.186] lstrlenW (lpString=".pst") returned 4 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".pst") returned 0x0 [0080.186] lstrlenW (lpString=".ost") returned 4 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".ost") returned 0x0 [0080.186] lstrlenW (lpString=".bak") returned 4 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".bak") returned 0x0 [0080.186] lstrlenW (lpString=".bac") returned 4 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".bac") returned 0x0 [0080.186] lstrlenW (lpString=".sys") returned 4 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".sys") returned 0x0 [0080.186] lstrlenW (lpString=".v2i") returned 4 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".v2i") returned 0x0 [0080.186] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch="s\r\n.v2i") returned 0x0 [0080.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.188] lstrlenW (lpString=".sql") returned 4 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".sql") returned 0x0 [0080.188] lstrlenW (lpString=".mdf") returned 4 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".mdf") returned 0x0 [0080.188] lstrlenW (lpString=".txt") returned 4 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".txt") returned 0x0 [0080.188] lstrlenW (lpString=".dbf") returned 4 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".dbf") returned 0x0 [0080.188] lstrlenW (lpString=".ckp") returned 4 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".ckp") returned 0x0 [0080.188] lstrlenW (lpString=".dacpac") returned 7 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".dacpac") returned 0x0 [0080.188] lstrlenW (lpString=".db3") returned 4 [0080.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".db3") returned 0x0 [0080.189] lstrlenW (lpString=".dtxs") returned 5 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".dtxs") returned 0x0 [0080.189] lstrlenW (lpString=".mdt") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".mdt") returned 0x0 [0080.189] lstrlenW (lpString=".sdf") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".sdf") returned 0x0 [0080.189] lstrlenW (lpString=".MDF") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".MDF") returned 0x0 [0080.189] lstrlenW (lpString=".DBF") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".DBF") returned 0x0 [0080.189] lstrlenW (lpString=".DB") returned 3 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".DB") returned 0x0 [0080.189] lstrlenW (lpString=".db") returned 3 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".db") returned 0x0 [0080.189] lstrlenW (lpString=".ndf") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".ndf") returned 0x0 [0080.189] lstrlenW (lpString=".NDF") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".NDF") returned 0x0 [0080.189] lstrlenW (lpString=".Mdf") returned 4 [0080.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".Mdf") returned 0x0 [0080.190] lstrlenW (lpString=".dat") returned 4 [0080.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".dat") returned 0x0 [0080.190] lstrlenW (lpString=".DAT") returned 4 [0080.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".DAT") returned 0x0 [0080.190] lstrlenW (lpString=".ldf") returned 4 [0080.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".ldf") returned 0x0 [0080.190] lstrlenW (lpString=".LDF") returned 4 [0080.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch=".LDF") returned 0x0 [0080.190] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.190] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27577c0) returned 1 [0080.191] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.191] CryptReleaseContext (hProv=0x27577c0, dwFlags=0x0) returned 1 [0080.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.191] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20019262960) returned 1 [0080.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe9c4710, dwHighDateTime=0x1d585b4)) [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761680 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761680 | out: hHeap=0x260000) returned 1 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d3f0 [0080.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.192] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.193] GetLastError () returned 0x0 [0080.193] GetLastError () returned 0x0 [0080.193] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.193] GetLastError () returned 0x0 [0080.193] GetLastError () returned 0x0 [0080.197] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffc55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.198] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3ab, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x3ab, lpOverlapped=0x0) returned 1 [0080.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0080.198] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.198] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.198] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.198] CloseHandle (hObject=0x108) returned 1 [0080.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.[deadmin@cock.li].deadmin")) returned 1 [0080.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.203] GetLastError () returned 0x0 [0080.203] RtlWakeConditionVariable () returned 0x0 [0080.203] GetCurrentThreadId () returned 0x99c [0080.204] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.204] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0080.204] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0080.204] WriteFile (in: hFile=0x108, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0080.207] CloseHandle (hObject=0x108) returned 1 [0080.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348ff0 | out: hHeap=0x260000) returned 1 [0080.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348e80 | out: hHeap=0x260000) returned 1 [0080.207] RtlWakeConditionVariable () returned 0x27e828 [0080.207] GetCurrentThreadId () returned 0x99c [0080.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".ldf") returned 0x0 [0080.207] lstrlenW (lpString=".vhd") returned 4 [0080.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".vhd") returned 0x0 [0080.207] lstrlenW (lpString=".vhdx") returned 5 [0080.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".vhdx") returned 0x0 [0080.207] lstrlenW (lpString=".pst") returned 4 [0080.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".pst") returned 0x0 [0080.207] lstrlenW (lpString=".ost") returned 4 [0080.207] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".ost") returned 0x0 [0080.207] lstrlenW (lpString=".bak") returned 4 [0080.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".bak") returned 0x0 [0080.208] lstrlenW (lpString=".bac") returned 4 [0080.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".bac") returned 0x0 [0080.208] lstrlenW (lpString=".sys") returned 4 [0080.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".sys") returned 0x0 [0080.208] lstrlenW (lpString=".v2i") returned 4 [0080.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".v2i") returned 0x0 [0080.208] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0080.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.209] lstrlenW (lpString=".sql") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".sql") returned 0x0 [0080.210] lstrlenW (lpString=".mdf") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".mdf") returned 0x0 [0080.210] lstrlenW (lpString=".txt") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".txt") returned 0x0 [0080.210] lstrlenW (lpString=".dbf") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".dbf") returned 0x0 [0080.210] lstrlenW (lpString=".ckp") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".ckp") returned 0x0 [0080.210] lstrlenW (lpString=".dacpac") returned 7 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".dacpac") returned 0x0 [0080.210] lstrlenW (lpString=".db3") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".db3") returned 0x0 [0080.210] lstrlenW (lpString=".dtxs") returned 5 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".dtxs") returned 0x0 [0080.210] lstrlenW (lpString=".mdt") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".mdt") returned 0x0 [0080.210] lstrlenW (lpString=".sdf") returned 4 [0080.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".sdf") returned 0x0 [0080.210] lstrlenW (lpString=".MDF") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".MDF") returned 0x0 [0080.211] lstrlenW (lpString=".DBF") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".DBF") returned 0x0 [0080.211] lstrlenW (lpString=".DB") returned 3 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".DB") returned 0x0 [0080.211] lstrlenW (lpString=".db") returned 3 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".db") returned 0x0 [0080.211] lstrlenW (lpString=".ndf") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".ndf") returned 0x0 [0080.211] lstrlenW (lpString=".NDF") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".NDF") returned 0x0 [0080.211] lstrlenW (lpString=".Mdf") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".Mdf") returned 0x0 [0080.211] lstrlenW (lpString=".dat") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".dat") returned 0x0 [0080.211] lstrlenW (lpString=".DAT") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".DAT") returned 0x0 [0080.211] lstrlenW (lpString=".ldf") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".ldf") returned 0x0 [0080.211] lstrlenW (lpString=".LDF") returned 4 [0080.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch=".LDF") returned 0x0 [0080.212] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0080.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.212] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757958) returned 1 [0080.213] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.213] CryptReleaseContext (hProv=0x2757958, dwFlags=0x0) returned 1 [0080.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.213] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20021416793) returned 1 [0080.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbe9ea870, dwHighDateTime=0x1d585b4)) [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27615d8 [0080.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27615d8 | out: hHeap=0x260000) returned 1 [0080.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0080.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.214] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.214] GetLastError () returned 0x0 [0080.214] GetLastError () returned 0x0 [0080.214] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.215] GetLastError () returned 0x0 [0080.215] GetLastError () returned 0x0 [0080.301] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.301] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.306] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.306] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.308] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.308] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.308] CloseHandle (hObject=0x108) returned 1 [0080.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.[deadmin@cock.li].deadmin")) returned 1 [0080.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.310] GetLastError () returned 0x0 [0080.310] RtlWakeConditionVariable () returned 0x0 [0080.310] GetCurrentThreadId () returned 0x99c [0080.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".ldf") returned 0x0 [0080.310] lstrlenW (lpString=".vhd") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".vhd") returned 0x0 [0080.311] lstrlenW (lpString=".vhdx") returned 5 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".vhdx") returned 0x0 [0080.311] lstrlenW (lpString=".pst") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".pst") returned 0x0 [0080.311] lstrlenW (lpString=".ost") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".ost") returned 0x0 [0080.311] lstrlenW (lpString=".bak") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".bak") returned 0x0 [0080.311] lstrlenW (lpString=".bac") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".bac") returned 0x0 [0080.311] lstrlenW (lpString=".sys") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".sys") returned 0x0 [0080.311] lstrlenW (lpString=".v2i") returned 4 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".v2i") returned 0x0 [0080.311] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch="s\r\n.v2i") returned 0x0 [0080.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.345] lstrlenW (lpString=".sql") returned 4 [0080.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".sql") returned 0x0 [0080.345] lstrlenW (lpString=".mdf") returned 4 [0080.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".mdf") returned 0x0 [0080.345] lstrlenW (lpString=".txt") returned 4 [0080.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".txt") returned 0x0 [0080.345] lstrlenW (lpString=".dbf") returned 4 [0080.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".dbf") returned 0x0 [0080.345] lstrlenW (lpString=".ckp") returned 4 [0080.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".ckp") returned 0x0 [0080.356] lstrlenW (lpString=".dacpac") returned 7 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".dacpac") returned 0x0 [0080.356] lstrlenW (lpString=".db3") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".db3") returned 0x0 [0080.356] lstrlenW (lpString=".dtxs") returned 5 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".dtxs") returned 0x0 [0080.356] lstrlenW (lpString=".mdt") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".mdt") returned 0x0 [0080.356] lstrlenW (lpString=".sdf") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".sdf") returned 0x0 [0080.356] lstrlenW (lpString=".MDF") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".MDF") returned 0x0 [0080.356] lstrlenW (lpString=".DBF") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".DBF") returned 0x0 [0080.356] lstrlenW (lpString=".DB") returned 3 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".DB") returned 0x0 [0080.356] lstrlenW (lpString=".db") returned 3 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".db") returned 0x0 [0080.356] lstrlenW (lpString=".ndf") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".ndf") returned 0x0 [0080.356] lstrlenW (lpString=".NDF") returned 4 [0080.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".NDF") returned 0x0 [0080.357] lstrlenW (lpString=".Mdf") returned 4 [0080.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".Mdf") returned 0x0 [0080.357] lstrlenW (lpString=".dat") returned 4 [0080.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".dat") returned 0x0 [0080.357] lstrlenW (lpString=".DAT") returned 4 [0080.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".DAT") returned 0x0 [0080.357] lstrlenW (lpString=".ldf") returned 4 [0080.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".ldf") returned 0x0 [0080.357] lstrlenW (lpString=".LDF") returned 4 [0080.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch=".LDF") returned 0x0 [0080.357] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0080.357] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757b78) returned 1 [0080.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0080.358] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.358] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20035911093) returned 1 [0080.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbeb67630, dwHighDateTime=0x1d585b4)) [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761a00 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761a00 | out: hHeap=0x260000) returned 1 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fc50 [0080.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.359] GetLastError () returned 0x0 [0080.359] GetLastError () returned 0x0 [0080.359] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.359] GetLastError () returned 0x0 [0080.359] GetLastError () returned 0x0 [0080.374] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.374] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.375] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.375] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.376] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.376] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.376] CloseHandle (hObject=0x108) returned 1 [0080.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.[deadmin@cock.li].deadmin")) returned 1 [0080.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.378] GetLastError () returned 0x0 [0080.378] RtlWakeConditionVariable () returned 0x0 [0080.378] GetCurrentThreadId () returned 0x99c [0080.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".ldf") returned 0x0 [0080.378] lstrlenW (lpString=".vhd") returned 4 [0080.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".vhd") returned 0x0 [0080.378] lstrlenW (lpString=".vhdx") returned 5 [0080.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".vhdx") returned 0x0 [0080.378] lstrlenW (lpString=".pst") returned 4 [0080.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".pst") returned 0x0 [0080.378] lstrlenW (lpString=".ost") returned 4 [0080.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".ost") returned 0x0 [0080.379] lstrlenW (lpString=".bak") returned 4 [0080.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".bak") returned 0x0 [0080.379] lstrlenW (lpString=".bac") returned 4 [0080.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".bac") returned 0x0 [0080.379] lstrlenW (lpString=".sys") returned 4 [0080.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".sys") returned 0x0 [0080.379] lstrlenW (lpString=".v2i") returned 4 [0080.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".v2i") returned 0x0 [0080.379] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.380] lstrlenW (lpString=".sql") returned 4 [0080.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".sql") returned 0x0 [0080.380] lstrlenW (lpString=".mdf") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".mdf") returned 0x0 [0080.381] lstrlenW (lpString=".txt") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".txt") returned 0x0 [0080.381] lstrlenW (lpString=".dbf") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".dbf") returned 0x0 [0080.381] lstrlenW (lpString=".ckp") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".ckp") returned 0x0 [0080.381] lstrlenW (lpString=".dacpac") returned 7 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".dacpac") returned 0x0 [0080.381] lstrlenW (lpString=".db3") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".db3") returned 0x0 [0080.381] lstrlenW (lpString=".dtxs") returned 5 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".dtxs") returned 0x0 [0080.381] lstrlenW (lpString=".mdt") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".mdt") returned 0x0 [0080.381] lstrlenW (lpString=".sdf") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".sdf") returned 0x0 [0080.381] lstrlenW (lpString=".MDF") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".MDF") returned 0x0 [0080.381] lstrlenW (lpString=".DBF") returned 4 [0080.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".DBF") returned 0x0 [0080.382] lstrlenW (lpString=".DB") returned 3 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".DB") returned 0x0 [0080.382] lstrlenW (lpString=".db") returned 3 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".db") returned 0x0 [0080.382] lstrlenW (lpString=".ndf") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".ndf") returned 0x0 [0080.382] lstrlenW (lpString=".NDF") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".NDF") returned 0x0 [0080.382] lstrlenW (lpString=".Mdf") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".Mdf") returned 0x0 [0080.382] lstrlenW (lpString=".dat") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".dat") returned 0x0 [0080.382] lstrlenW (lpString=".DAT") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".DAT") returned 0x0 [0080.382] lstrlenW (lpString=".ldf") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".ldf") returned 0x0 [0080.382] lstrlenW (lpString=".LDF") returned 4 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch=".LDF") returned 0x0 [0080.382] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.382] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0080.383] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757b78) returned 1 [0080.383] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0080.383] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.384] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20038479333) returned 1 [0080.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbeb8d790, dwHighDateTime=0x1d585b4)) [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27619c8 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27619c8 | out: hHeap=0x260000) returned 1 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d14b0 [0080.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d14b0 | out: hHeap=0x260000) returned 1 [0080.384] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.385] GetLastError () returned 0x0 [0080.385] GetLastError () returned 0x0 [0080.385] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.385] GetLastError () returned 0x0 [0080.385] GetLastError () returned 0x0 [0080.388] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe8c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.388] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x17380, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x17380, lpOverlapped=0x0) returned 1 [0080.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.388] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.388] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.389] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.389] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.389] CloseHandle (hObject=0x108) returned 1 [0080.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0080.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0080.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.390] GetLastError () returned 0x0 [0080.390] RtlWakeConditionVariable () returned 0x27e828 [0080.390] GetCurrentThreadId () returned 0x99c [0080.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".ldf") returned 0x0 [0080.390] lstrlenW (lpString=".vhd") returned 4 [0080.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".vhd") returned 0x0 [0080.390] lstrlenW (lpString=".vhdx") returned 5 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".vhdx") returned 0x0 [0080.391] lstrlenW (lpString=".pst") returned 4 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".pst") returned 0x0 [0080.391] lstrlenW (lpString=".ost") returned 4 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".ost") returned 0x0 [0080.391] lstrlenW (lpString=".bak") returned 4 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".bak") returned 0x0 [0080.391] lstrlenW (lpString=".bac") returned 4 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".bac") returned 0x0 [0080.391] lstrlenW (lpString=".sys") returned 4 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".sys") returned 0x0 [0080.391] lstrlenW (lpString=".v2i") returned 4 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".v2i") returned 0x0 [0080.391] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch="s\r\n.v2i") returned 0x0 [0080.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.392] lstrlenW (lpString=".sql") returned 4 [0080.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".sql") returned 0x0 [0080.392] lstrlenW (lpString=".mdf") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".mdf") returned 0x0 [0080.393] lstrlenW (lpString=".txt") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".txt") returned 0x0 [0080.393] lstrlenW (lpString=".dbf") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".dbf") returned 0x0 [0080.393] lstrlenW (lpString=".ckp") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".ckp") returned 0x0 [0080.393] lstrlenW (lpString=".dacpac") returned 7 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".dacpac") returned 0x0 [0080.393] lstrlenW (lpString=".db3") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".db3") returned 0x0 [0080.393] lstrlenW (lpString=".dtxs") returned 5 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".dtxs") returned 0x0 [0080.393] lstrlenW (lpString=".mdt") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".mdt") returned 0x0 [0080.393] lstrlenW (lpString=".sdf") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".sdf") returned 0x0 [0080.393] lstrlenW (lpString=".MDF") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".MDF") returned 0x0 [0080.393] lstrlenW (lpString=".DBF") returned 4 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".DBF") returned 0x0 [0080.393] lstrlenW (lpString=".DB") returned 3 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".DB") returned 0x0 [0080.393] lstrlenW (lpString=".db") returned 3 [0080.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".db") returned 0x0 [0080.393] lstrlenW (lpString=".ndf") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".ndf") returned 0x0 [0080.394] lstrlenW (lpString=".NDF") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".NDF") returned 0x0 [0080.394] lstrlenW (lpString=".Mdf") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".Mdf") returned 0x0 [0080.394] lstrlenW (lpString=".dat") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".dat") returned 0x0 [0080.394] lstrlenW (lpString=".DAT") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".DAT") returned 0x0 [0080.394] lstrlenW (lpString=".ldf") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".ldf") returned 0x0 [0080.394] lstrlenW (lpString=".LDF") returned 4 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch=".LDF") returned 0x0 [0080.394] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0080.394] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757b78) returned 1 [0080.395] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0080.395] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0080.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.395] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20039631725) returned 1 [0080.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbebb38f0, dwHighDateTime=0x1d585b4)) [0080.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761990 [0080.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761990 | out: hHeap=0x260000) returned 1 [0080.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f958 [0080.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.396] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.396] GetLastError () returned 0x0 [0080.396] GetLastError () returned 0x0 [0080.396] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.396] GetLastError () returned 0x0 [0080.397] GetLastError () returned 0x0 [0080.458] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcc2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.458] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x33e, lpOverlapped=0x0) returned 1 [0080.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.461] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.461] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.461] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.461] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.461] CloseHandle (hObject=0x108) returned 1 [0080.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.506] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.[deadmin@cock.li].deadmin")) returned 1 [0080.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.522] GetLastError () returned 0x0 [0080.523] RtlWakeConditionVariable () returned 0x0 [0080.526] GetCurrentThreadId () returned 0x99c [0080.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".ldf") returned 0x0 [0080.535] lstrlenW (lpString=".vhd") returned 4 [0080.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".vhd") returned 0x0 [0080.535] lstrlenW (lpString=".vhdx") returned 5 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".vhdx") returned 0x0 [0080.536] lstrlenW (lpString=".pst") returned 4 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".pst") returned 0x0 [0080.536] lstrlenW (lpString=".ost") returned 4 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".ost") returned 0x0 [0080.536] lstrlenW (lpString=".bak") returned 4 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".bak") returned 0x0 [0080.536] lstrlenW (lpString=".bac") returned 4 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".bac") returned 0x0 [0080.536] lstrlenW (lpString=".sys") returned 4 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".sys") returned 0x0 [0080.536] lstrlenW (lpString=".v2i") returned 4 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".v2i") returned 0x0 [0080.536] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch="s\r\n.v2i") returned 0x0 [0080.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.622] lstrlenW (lpString=".sql") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".sql") returned 0x0 [0080.622] lstrlenW (lpString=".mdf") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".mdf") returned 0x0 [0080.622] lstrlenW (lpString=".txt") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".txt") returned 0x0 [0080.622] lstrlenW (lpString=".dbf") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".dbf") returned 0x0 [0080.622] lstrlenW (lpString=".ckp") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".ckp") returned 0x0 [0080.622] lstrlenW (lpString=".dacpac") returned 7 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".dacpac") returned 0x0 [0080.622] lstrlenW (lpString=".db3") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".db3") returned 0x0 [0080.622] lstrlenW (lpString=".dtxs") returned 5 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".dtxs") returned 0x0 [0080.622] lstrlenW (lpString=".mdt") returned 4 [0080.622] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".mdt") returned 0x0 [0080.622] lstrlenW (lpString=".sdf") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".sdf") returned 0x0 [0080.623] lstrlenW (lpString=".MDF") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".MDF") returned 0x0 [0080.623] lstrlenW (lpString=".DBF") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".DBF") returned 0x0 [0080.623] lstrlenW (lpString=".DB") returned 3 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".DB") returned 0x0 [0080.623] lstrlenW (lpString=".db") returned 3 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".db") returned 0x0 [0080.623] lstrlenW (lpString=".ndf") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".ndf") returned 0x0 [0080.623] lstrlenW (lpString=".NDF") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".NDF") returned 0x0 [0080.623] lstrlenW (lpString=".Mdf") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".Mdf") returned 0x0 [0080.623] lstrlenW (lpString=".dat") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".dat") returned 0x0 [0080.623] lstrlenW (lpString=".DAT") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".DAT") returned 0x0 [0080.623] lstrlenW (lpString=".ldf") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".ldf") returned 0x0 [0080.623] lstrlenW (lpString=".LDF") returned 4 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch=".LDF") returned 0x0 [0080.623] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.624] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757c88) returned 1 [0080.624] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.624] CryptReleaseContext (hProv=0x2757c88, dwFlags=0x0) returned 1 [0080.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.625] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20062845357) returned 1 [0080.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbedeed90, dwHighDateTime=0x1d585b4)) [0080.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1778 [0080.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1778 | out: hHeap=0x260000) returned 1 [0080.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f530 [0080.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.628] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.628] GetLastError () returned 0x0 [0080.628] GetLastError () returned 0x0 [0080.628] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.629] GetLastError () returned 0x0 [0080.629] GetLastError () returned 0x0 [0080.632] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.632] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.633] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.633] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.634] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.635] CloseHandle (hObject=0xe4) returned 1 [0080.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0080.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.[deadmin@cock.li].deadmin")) returned 1 [0080.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0080.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.636] GetLastError () returned 0x0 [0080.636] RtlWakeConditionVariable () returned 0x0 [0080.636] GetCurrentThreadId () returned 0x99c [0080.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".ldf") returned 0x0 [0080.637] lstrlenW (lpString=".vhd") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".vhd") returned 0x0 [0080.637] lstrlenW (lpString=".vhdx") returned 5 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".vhdx") returned 0x0 [0080.637] lstrlenW (lpString=".pst") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".pst") returned 0x0 [0080.637] lstrlenW (lpString=".ost") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".ost") returned 0x0 [0080.637] lstrlenW (lpString=".bak") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".bak") returned 0x0 [0080.637] lstrlenW (lpString=".bac") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".bac") returned 0x0 [0080.637] lstrlenW (lpString=".sys") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".sys") returned 0x0 [0080.637] lstrlenW (lpString=".v2i") returned 4 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".v2i") returned 0x0 [0080.637] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.638] lstrlenW (lpString=".sql") returned 4 [0080.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".sql") returned 0x0 [0080.638] lstrlenW (lpString=".mdf") returned 4 [0080.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".mdf") returned 0x0 [0080.638] lstrlenW (lpString=".txt") returned 4 [0080.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".txt") returned 0x0 [0080.638] lstrlenW (lpString=".dbf") returned 4 [0080.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".dbf") returned 0x0 [0080.638] lstrlenW (lpString=".ckp") returned 4 [0080.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".ckp") returned 0x0 [0080.639] lstrlenW (lpString=".dacpac") returned 7 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".dacpac") returned 0x0 [0080.639] lstrlenW (lpString=".db3") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".db3") returned 0x0 [0080.639] lstrlenW (lpString=".dtxs") returned 5 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".dtxs") returned 0x0 [0080.639] lstrlenW (lpString=".mdt") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".mdt") returned 0x0 [0080.639] lstrlenW (lpString=".sdf") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".sdf") returned 0x0 [0080.639] lstrlenW (lpString=".MDF") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".MDF") returned 0x0 [0080.639] lstrlenW (lpString=".DBF") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".DBF") returned 0x0 [0080.639] lstrlenW (lpString=".DB") returned 3 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".DB") returned 0x0 [0080.639] lstrlenW (lpString=".db") returned 3 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".db") returned 0x0 [0080.639] lstrlenW (lpString=".ndf") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".ndf") returned 0x0 [0080.639] lstrlenW (lpString=".NDF") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".NDF") returned 0x0 [0080.639] lstrlenW (lpString=".Mdf") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".Mdf") returned 0x0 [0080.639] lstrlenW (lpString=".dat") returned 4 [0080.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".dat") returned 0x0 [0080.639] lstrlenW (lpString=".DAT") returned 4 [0080.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".DAT") returned 0x0 [0080.640] lstrlenW (lpString=".ldf") returned 4 [0080.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".ldf") returned 0x0 [0080.640] lstrlenW (lpString=".LDF") returned 4 [0080.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch=".LDF") returned 0x0 [0080.640] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.640] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757d98) returned 1 [0080.641] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.641] CryptReleaseContext (hProv=0x2757d98, dwFlags=0x0) returned 1 [0080.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.641] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20064199785) returned 1 [0080.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbee14ef0, dwHighDateTime=0x1d585b4)) [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f17b0 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f17b0 | out: hHeap=0x260000) returned 1 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f530 [0080.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.642] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.642] GetLastError () returned 0x0 [0080.642] GetLastError () returned 0x0 [0080.642] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.642] GetLastError () returned 0x0 [0080.642] GetLastError () returned 0x0 [0080.644] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffef278, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.644] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x10d88, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x10d88, lpOverlapped=0x0) returned 1 [0080.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.645] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.645] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.645] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.645] CloseHandle (hObject=0xe4) returned 1 [0080.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.646] GetLastError () returned 0x0 [0080.646] RtlWakeConditionVariable () returned 0x0 [0080.646] GetCurrentThreadId () returned 0x99c [0080.646] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".ldf") returned 0x0 [0080.647] lstrlenW (lpString=".vhd") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".vhd") returned 0x0 [0080.647] lstrlenW (lpString=".vhdx") returned 5 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".vhdx") returned 0x0 [0080.647] lstrlenW (lpString=".pst") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".pst") returned 0x0 [0080.647] lstrlenW (lpString=".ost") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".ost") returned 0x0 [0080.647] lstrlenW (lpString=".bak") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".bak") returned 0x0 [0080.647] lstrlenW (lpString=".bac") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".bac") returned 0x0 [0080.647] lstrlenW (lpString=".sys") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".sys") returned 0x0 [0080.647] lstrlenW (lpString=".v2i") returned 4 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".v2i") returned 0x0 [0080.647] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.648] lstrlenW (lpString=".sql") returned 4 [0080.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".sql") returned 0x0 [0080.648] lstrlenW (lpString=".mdf") returned 4 [0080.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".mdf") returned 0x0 [0080.648] lstrlenW (lpString=".txt") returned 4 [0080.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".txt") returned 0x0 [0080.648] lstrlenW (lpString=".dbf") returned 4 [0080.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".dbf") returned 0x0 [0080.648] lstrlenW (lpString=".ckp") returned 4 [0080.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".ckp") returned 0x0 [0080.648] lstrlenW (lpString=".dacpac") returned 7 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".dacpac") returned 0x0 [0080.649] lstrlenW (lpString=".db3") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".db3") returned 0x0 [0080.649] lstrlenW (lpString=".dtxs") returned 5 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".dtxs") returned 0x0 [0080.649] lstrlenW (lpString=".mdt") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".mdt") returned 0x0 [0080.649] lstrlenW (lpString=".sdf") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".sdf") returned 0x0 [0080.649] lstrlenW (lpString=".MDF") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".MDF") returned 0x0 [0080.649] lstrlenW (lpString=".DBF") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".DBF") returned 0x0 [0080.649] lstrlenW (lpString=".DB") returned 3 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".DB") returned 0x0 [0080.649] lstrlenW (lpString=".db") returned 3 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".db") returned 0x0 [0080.649] lstrlenW (lpString=".ndf") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".ndf") returned 0x0 [0080.649] lstrlenW (lpString=".NDF") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".NDF") returned 0x0 [0080.649] lstrlenW (lpString=".Mdf") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".Mdf") returned 0x0 [0080.649] lstrlenW (lpString=".dat") returned 4 [0080.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".dat") returned 0x0 [0080.650] lstrlenW (lpString=".DAT") returned 4 [0080.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".DAT") returned 0x0 [0080.650] lstrlenW (lpString=".ldf") returned 4 [0080.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".ldf") returned 0x0 [0080.650] lstrlenW (lpString=".LDF") returned 4 [0080.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch=".LDF") returned 0x0 [0080.650] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.650] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757fb8) returned 1 [0080.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.651] CryptReleaseContext (hProv=0x2757fb8, dwFlags=0x0) returned 1 [0080.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.651] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20065200838) returned 1 [0080.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbee14ef0, dwHighDateTime=0x1d585b4)) [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f17e8 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f17e8 | out: hHeap=0x260000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f530 [0080.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.652] GetLastError () returned 0x0 [0080.652] GetLastError () returned 0x0 [0080.727] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.727] GetLastError () returned 0x0 [0080.728] GetLastError () returned 0x0 [0080.766] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff3c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.766] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xc380, lpOverlapped=0x0) returned 1 [0080.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.767] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.767] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.767] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.767] CloseHandle (hObject=0xe4) returned 1 [0080.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.769] GetLastError () returned 0x0 [0080.769] RtlWakeConditionVariable () returned 0x0 [0080.769] GetCurrentThreadId () returned 0x99c [0080.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".ldf") returned 0x0 [0080.769] lstrlenW (lpString=".vhd") returned 4 [0080.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".vhd") returned 0x0 [0080.769] lstrlenW (lpString=".vhdx") returned 5 [0080.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".vhdx") returned 0x0 [0080.769] lstrlenW (lpString=".pst") returned 4 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".pst") returned 0x0 [0080.770] lstrlenW (lpString=".ost") returned 4 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".ost") returned 0x0 [0080.770] lstrlenW (lpString=".bak") returned 4 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".bak") returned 0x0 [0080.770] lstrlenW (lpString=".bac") returned 4 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".bac") returned 0x0 [0080.770] lstrlenW (lpString=".sys") returned 4 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".sys") returned 0x0 [0080.770] lstrlenW (lpString=".v2i") returned 4 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".v2i") returned 0x0 [0080.770] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.771] lstrlenW (lpString=".sql") returned 4 [0080.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".sql") returned 0x0 [0080.771] lstrlenW (lpString=".mdf") returned 4 [0080.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".mdf") returned 0x0 [0080.771] lstrlenW (lpString=".txt") returned 4 [0080.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".txt") returned 0x0 [0080.771] lstrlenW (lpString=".dbf") returned 4 [0080.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".dbf") returned 0x0 [0080.772] lstrlenW (lpString=".ckp") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".ckp") returned 0x0 [0080.772] lstrlenW (lpString=".dacpac") returned 7 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".dacpac") returned 0x0 [0080.772] lstrlenW (lpString=".db3") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".db3") returned 0x0 [0080.772] lstrlenW (lpString=".dtxs") returned 5 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".dtxs") returned 0x0 [0080.772] lstrlenW (lpString=".mdt") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".mdt") returned 0x0 [0080.772] lstrlenW (lpString=".sdf") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".sdf") returned 0x0 [0080.772] lstrlenW (lpString=".MDF") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".MDF") returned 0x0 [0080.772] lstrlenW (lpString=".DBF") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".DBF") returned 0x0 [0080.772] lstrlenW (lpString=".DB") returned 3 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".DB") returned 0x0 [0080.772] lstrlenW (lpString=".db") returned 3 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".db") returned 0x0 [0080.772] lstrlenW (lpString=".ndf") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".ndf") returned 0x0 [0080.772] lstrlenW (lpString=".NDF") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".NDF") returned 0x0 [0080.772] lstrlenW (lpString=".Mdf") returned 4 [0080.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".Mdf") returned 0x0 [0080.773] lstrlenW (lpString=".dat") returned 4 [0080.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".dat") returned 0x0 [0080.773] lstrlenW (lpString=".DAT") returned 4 [0080.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".DAT") returned 0x0 [0080.773] lstrlenW (lpString=".ldf") returned 4 [0080.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".ldf") returned 0x0 [0080.773] lstrlenW (lpString=".LDF") returned 4 [0080.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch=".LDF") returned 0x0 [0080.773] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.773] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2250) returned 1 [0080.774] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.774] CryptReleaseContext (hProv=0x2d2250, dwFlags=0x0) returned 1 [0080.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.774] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20077515248) returned 1 [0080.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbef459f0, dwHighDateTime=0x1d585b4)) [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13e0 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0080.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.775] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.776] GetLastError () returned 0x0 [0080.776] GetLastError () returned 0x0 [0080.776] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.776] GetLastError () returned 0x0 [0080.776] GetLastError () returned 0x0 [0080.780] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.781] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.782] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.782] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.784] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.784] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.784] CloseHandle (hObject=0xe4) returned 1 [0080.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.786] GetLastError () returned 0x0 [0080.786] RtlWakeConditionVariable () returned 0x0 [0080.786] GetCurrentThreadId () returned 0x99c [0080.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".ldf") returned 0x0 [0080.786] lstrlenW (lpString=".vhd") returned 4 [0080.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".vhd") returned 0x0 [0080.787] lstrlenW (lpString=".vhdx") returned 5 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".vhdx") returned 0x0 [0080.787] lstrlenW (lpString=".pst") returned 4 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".pst") returned 0x0 [0080.787] lstrlenW (lpString=".ost") returned 4 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".ost") returned 0x0 [0080.787] lstrlenW (lpString=".bak") returned 4 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".bak") returned 0x0 [0080.787] lstrlenW (lpString=".bac") returned 4 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".bac") returned 0x0 [0080.787] lstrlenW (lpString=".sys") returned 4 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".sys") returned 0x0 [0080.787] lstrlenW (lpString=".v2i") returned 4 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".v2i") returned 0x0 [0080.787] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0080.789] lstrlenW (lpString=".sql") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".sql") returned 0x0 [0080.789] lstrlenW (lpString=".mdf") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".mdf") returned 0x0 [0080.789] lstrlenW (lpString=".txt") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".txt") returned 0x0 [0080.789] lstrlenW (lpString=".dbf") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".dbf") returned 0x0 [0080.789] lstrlenW (lpString=".ckp") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".ckp") returned 0x0 [0080.789] lstrlenW (lpString=".dacpac") returned 7 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".dacpac") returned 0x0 [0080.789] lstrlenW (lpString=".db3") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".db3") returned 0x0 [0080.789] lstrlenW (lpString=".dtxs") returned 5 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".dtxs") returned 0x0 [0080.789] lstrlenW (lpString=".mdt") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".mdt") returned 0x0 [0080.789] lstrlenW (lpString=".sdf") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".sdf") returned 0x0 [0080.789] lstrlenW (lpString=".MDF") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".MDF") returned 0x0 [0080.789] lstrlenW (lpString=".DBF") returned 4 [0080.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".DBF") returned 0x0 [0080.790] lstrlenW (lpString=".DB") returned 3 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".DB") returned 0x0 [0080.790] lstrlenW (lpString=".db") returned 3 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".db") returned 0x0 [0080.790] lstrlenW (lpString=".ndf") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".ndf") returned 0x0 [0080.790] lstrlenW (lpString=".NDF") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".NDF") returned 0x0 [0080.790] lstrlenW (lpString=".Mdf") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".Mdf") returned 0x0 [0080.790] lstrlenW (lpString=".dat") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".dat") returned 0x0 [0080.790] lstrlenW (lpString=".DAT") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".DAT") returned 0x0 [0080.790] lstrlenW (lpString=".ldf") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".ldf") returned 0x0 [0080.790] lstrlenW (lpString=".LDF") returned 4 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch=".LDF") returned 0x0 [0080.790] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.790] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2470) returned 1 [0080.791] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.791] CryptReleaseContext (hProv=0x2d2470, dwFlags=0x0) returned 1 [0080.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.791] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20079252846) returned 1 [0080.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbef6bb50, dwHighDateTime=0x1d585b4)) [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3382f8 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382f8 | out: hHeap=0x260000) returned 1 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.792] GetLastError () returned 0x0 [0080.792] GetLastError () returned 0x0 [0080.793] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.793] GetLastError () returned 0x0 [0080.793] GetLastError () returned 0x0 [0080.795] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffc880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.795] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3780, lpOverlapped=0x0) returned 1 [0080.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.795] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.795] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.795] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.795] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.795] CloseHandle (hObject=0xe4) returned 1 [0080.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.797] GetLastError () returned 0x0 [0080.797] RtlWakeConditionVariable () returned 0x0 [0080.797] GetCurrentThreadId () returned 0x99c [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".ldf") returned 0x0 [0080.798] lstrlenW (lpString=".vhd") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".vhd") returned 0x0 [0080.798] lstrlenW (lpString=".vhdx") returned 5 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".vhdx") returned 0x0 [0080.798] lstrlenW (lpString=".pst") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".pst") returned 0x0 [0080.798] lstrlenW (lpString=".ost") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".ost") returned 0x0 [0080.798] lstrlenW (lpString=".bak") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".bak") returned 0x0 [0080.798] lstrlenW (lpString=".bac") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".bac") returned 0x0 [0080.798] lstrlenW (lpString=".sys") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".sys") returned 0x0 [0080.798] lstrlenW (lpString=".v2i") returned 4 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".v2i") returned 0x0 [0080.798] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.814] lstrlenW (lpString=".sql") returned 4 [0080.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".sql") returned 0x0 [0080.814] lstrlenW (lpString=".mdf") returned 4 [0080.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".mdf") returned 0x0 [0080.814] lstrlenW (lpString=".txt") returned 4 [0080.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".txt") returned 0x0 [0080.814] lstrlenW (lpString=".dbf") returned 4 [0080.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".dbf") returned 0x0 [0080.814] lstrlenW (lpString=".ckp") returned 4 [0080.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".ckp") returned 0x0 [0080.814] lstrlenW (lpString=".dacpac") returned 7 [0080.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".dacpac") returned 0x0 [0080.814] lstrlenW (lpString=".db3") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".db3") returned 0x0 [0080.815] lstrlenW (lpString=".dtxs") returned 5 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".dtxs") returned 0x0 [0080.815] lstrlenW (lpString=".mdt") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".mdt") returned 0x0 [0080.815] lstrlenW (lpString=".sdf") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".sdf") returned 0x0 [0080.815] lstrlenW (lpString=".MDF") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".MDF") returned 0x0 [0080.815] lstrlenW (lpString=".DBF") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".DBF") returned 0x0 [0080.815] lstrlenW (lpString=".DB") returned 3 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".DB") returned 0x0 [0080.815] lstrlenW (lpString=".db") returned 3 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".db") returned 0x0 [0080.815] lstrlenW (lpString=".ndf") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".ndf") returned 0x0 [0080.815] lstrlenW (lpString=".NDF") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".NDF") returned 0x0 [0080.815] lstrlenW (lpString=".Mdf") returned 4 [0080.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".Mdf") returned 0x0 [0080.816] lstrlenW (lpString=".dat") returned 4 [0080.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".dat") returned 0x0 [0080.816] lstrlenW (lpString=".DAT") returned 4 [0080.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".DAT") returned 0x0 [0080.816] lstrlenW (lpString=".ldf") returned 4 [0080.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".ldf") returned 0x0 [0080.816] lstrlenW (lpString=".LDF") returned 4 [0080.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch=".LDF") returned 0x0 [0080.816] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.816] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2470) returned 1 [0080.817] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.817] CryptReleaseContext (hProv=0x2d2470, dwFlags=0x0) returned 1 [0080.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.817] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20081858533) returned 1 [0080.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbefb7e10, dwHighDateTime=0x1d585b4)) [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338330 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338330 | out: hHeap=0x260000) returned 1 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.818] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.819] GetLastError () returned 0x0 [0080.819] GetLastError () returned 0x0 [0080.819] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.819] GetLastError () returned 0x0 [0080.819] GetLastError () returned 0x0 [0080.825] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.825] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.826] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.826] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.826] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.826] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.827] CloseHandle (hObject=0x11c) returned 1 [0080.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x3490a8 [0080.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3490a8 | out: hHeap=0x260000) returned 1 [0080.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.830] GetLastError () returned 0x0 [0080.830] RtlWakeConditionVariable () returned 0x0 [0080.830] GetCurrentThreadId () returned 0x99c [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".ldf") returned 0x0 [0080.830] lstrlenW (lpString=".vhd") returned 4 [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".vhd") returned 0x0 [0080.830] lstrlenW (lpString=".vhdx") returned 5 [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".vhdx") returned 0x0 [0080.830] lstrlenW (lpString=".pst") returned 4 [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".pst") returned 0x0 [0080.830] lstrlenW (lpString=".ost") returned 4 [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".ost") returned 0x0 [0080.830] lstrlenW (lpString=".bak") returned 4 [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".bak") returned 0x0 [0080.830] lstrlenW (lpString=".bac") returned 4 [0080.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".bac") returned 0x0 [0080.831] lstrlenW (lpString=".sys") returned 4 [0080.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".sys") returned 0x0 [0080.831] lstrlenW (lpString=".v2i") returned 4 [0080.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".v2i") returned 0x0 [0080.831] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch="s\r\n.v2i") returned 0x0 [0080.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.833] lstrlenW (lpString=".sql") returned 4 [0080.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".sql") returned 0x0 [0080.833] lstrlenW (lpString=".mdf") returned 4 [0080.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".mdf") returned 0x0 [0080.833] lstrlenW (lpString=".txt") returned 4 [0080.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".txt") returned 0x0 [0080.833] lstrlenW (lpString=".dbf") returned 4 [0080.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".dbf") returned 0x0 [0080.833] lstrlenW (lpString=".ckp") returned 4 [0080.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".ckp") returned 0x0 [0080.833] lstrlenW (lpString=".dacpac") returned 7 [0080.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".dacpac") returned 0x0 [0080.834] lstrlenW (lpString=".db3") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".db3") returned 0x0 [0080.834] lstrlenW (lpString=".dtxs") returned 5 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".dtxs") returned 0x0 [0080.834] lstrlenW (lpString=".mdt") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".mdt") returned 0x0 [0080.834] lstrlenW (lpString=".sdf") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".sdf") returned 0x0 [0080.834] lstrlenW (lpString=".MDF") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".MDF") returned 0x0 [0080.834] lstrlenW (lpString=".DBF") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".DBF") returned 0x0 [0080.834] lstrlenW (lpString=".DB") returned 3 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".DB") returned 0x0 [0080.834] lstrlenW (lpString=".db") returned 3 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".db") returned 0x0 [0080.834] lstrlenW (lpString=".ndf") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".ndf") returned 0x0 [0080.834] lstrlenW (lpString=".NDF") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".NDF") returned 0x0 [0080.834] lstrlenW (lpString=".Mdf") returned 4 [0080.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".Mdf") returned 0x0 [0080.835] lstrlenW (lpString=".dat") returned 4 [0080.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".dat") returned 0x0 [0080.835] lstrlenW (lpString=".DAT") returned 4 [0080.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".DAT") returned 0x0 [0080.835] lstrlenW (lpString=".ldf") returned 4 [0080.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".ldf") returned 0x0 [0080.835] lstrlenW (lpString=".LDF") returned 4 [0080.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch=".LDF") returned 0x0 [0080.835] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.835] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2580) returned 1 [0080.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.836] CryptReleaseContext (hProv=0x2d2580, dwFlags=0x0) returned 1 [0080.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.836] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20083749246) returned 1 [0080.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbefddf70, dwHighDateTime=0x1d585b4)) [0080.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338368 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338368 | out: hHeap=0x260000) returned 1 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.837] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.837] GetLastError () returned 0x0 [0080.838] GetLastError () returned 0x0 [0080.838] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.838] GetLastError () returned 0x0 [0080.838] GetLastError () returned 0x0 [0080.840] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.840] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.841] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.841] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.841] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.842] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.842] CloseHandle (hObject=0x11c) returned 1 [0080.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x3490a8 [0080.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.[deadmin@cock.li].deadmin")) returned 1 [0080.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3490a8 | out: hHeap=0x260000) returned 1 [0080.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.844] GetLastError () returned 0x0 [0080.844] RtlWakeConditionVariable () returned 0x27e828 [0080.844] GetCurrentThreadId () returned 0x99c [0080.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".ldf") returned 0x0 [0080.844] lstrlenW (lpString=".vhd") returned 4 [0080.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".vhd") returned 0x0 [0080.844] lstrlenW (lpString=".vhdx") returned 5 [0080.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".vhdx") returned 0x0 [0080.844] lstrlenW (lpString=".pst") returned 4 [0080.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".pst") returned 0x0 [0080.845] lstrlenW (lpString=".ost") returned 4 [0080.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".ost") returned 0x0 [0080.845] lstrlenW (lpString=".bak") returned 4 [0080.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".bak") returned 0x0 [0080.845] lstrlenW (lpString=".bac") returned 4 [0080.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".bac") returned 0x0 [0080.845] lstrlenW (lpString=".sys") returned 4 [0080.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".sys") returned 0x0 [0080.845] lstrlenW (lpString=".v2i") returned 4 [0080.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".v2i") returned 0x0 [0080.845] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch="s\r\n.v2i") returned 0x0 [0080.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0080.847] lstrlenW (lpString=".sql") returned 4 [0080.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".sql") returned 0x0 [0080.847] lstrlenW (lpString=".mdf") returned 4 [0080.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".mdf") returned 0x0 [0080.847] lstrlenW (lpString=".txt") returned 4 [0080.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".txt") returned 0x0 [0080.847] lstrlenW (lpString=".dbf") returned 4 [0080.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".dbf") returned 0x0 [0080.847] lstrlenW (lpString=".ckp") returned 4 [0080.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".ckp") returned 0x0 [0080.847] lstrlenW (lpString=".dacpac") returned 7 [0080.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".dacpac") returned 0x0 [0080.847] lstrlenW (lpString=".db3") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".db3") returned 0x0 [0080.848] lstrlenW (lpString=".dtxs") returned 5 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".dtxs") returned 0x0 [0080.848] lstrlenW (lpString=".mdt") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".mdt") returned 0x0 [0080.848] lstrlenW (lpString=".sdf") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".sdf") returned 0x0 [0080.848] lstrlenW (lpString=".MDF") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".MDF") returned 0x0 [0080.848] lstrlenW (lpString=".DBF") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".DBF") returned 0x0 [0080.848] lstrlenW (lpString=".DB") returned 3 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".DB") returned 0x0 [0080.848] lstrlenW (lpString=".db") returned 3 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".db") returned 0x0 [0080.848] lstrlenW (lpString=".ndf") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".ndf") returned 0x0 [0080.848] lstrlenW (lpString=".NDF") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".NDF") returned 0x0 [0080.848] lstrlenW (lpString=".Mdf") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".Mdf") returned 0x0 [0080.848] lstrlenW (lpString=".dat") returned 4 [0080.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".dat") returned 0x0 [0080.848] lstrlenW (lpString=".DAT") returned 4 [0080.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".DAT") returned 0x0 [0080.849] lstrlenW (lpString=".ldf") returned 4 [0080.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".ldf") returned 0x0 [0080.849] lstrlenW (lpString=".LDF") returned 4 [0080.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch=".LDF") returned 0x0 [0080.849] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.849] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2608) returned 1 [0080.850] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.850] CryptReleaseContext (hProv=0x2d2608, dwFlags=0x0) returned 1 [0080.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0080.850] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20085112421) returned 1 [0080.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf0040d0, dwHighDateTime=0x1d585b4)) [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3383a0 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3383a0 | out: hHeap=0x260000) returned 1 [0080.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.851] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0080.851] GetLastError () returned 0x0 [0080.851] GetLastError () returned 0x0 [0080.851] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0080.851] GetLastError () returned 0x0 [0080.851] GetLastError () returned 0x0 [0080.930] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff9a55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.930] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x65ab, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x65ab, lpOverlapped=0x0) returned 1 [0080.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.930] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.930] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.930] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.931] CloseHandle (hObject=0x11c) returned 1 [0080.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.[deadmin@cock.li].deadmin")) returned 1 [0080.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0080.933] GetLastError () returned 0x0 [0080.933] RtlWakeConditionVariable () returned 0x0 [0080.933] GetCurrentThreadId () returned 0x99c [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".ldf") returned 0x0 [0080.934] lstrlenW (lpString=".vhd") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".vhd") returned 0x0 [0080.934] lstrlenW (lpString=".vhdx") returned 5 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".vhdx") returned 0x0 [0080.934] lstrlenW (lpString=".pst") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".pst") returned 0x0 [0080.934] lstrlenW (lpString=".ost") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".ost") returned 0x0 [0080.934] lstrlenW (lpString=".bak") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".bak") returned 0x0 [0080.934] lstrlenW (lpString=".bac") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".bac") returned 0x0 [0080.934] lstrlenW (lpString=".sys") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".sys") returned 0x0 [0080.934] lstrlenW (lpString=".v2i") returned 4 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".v2i") returned 0x0 [0080.934] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0080.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.558] lstrlenW (lpString=".sql") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".sql") returned 0x0 [0081.559] lstrlenW (lpString=".mdf") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".mdf") returned 0x0 [0081.559] lstrlenW (lpString=".txt") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".txt") returned 0x0 [0081.559] lstrlenW (lpString=".dbf") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".dbf") returned 0x0 [0081.559] lstrlenW (lpString=".ckp") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".ckp") returned 0x0 [0081.559] lstrlenW (lpString=".dacpac") returned 7 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".dacpac") returned 0x0 [0081.559] lstrlenW (lpString=".db3") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".db3") returned 0x0 [0081.559] lstrlenW (lpString=".dtxs") returned 5 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".dtxs") returned 0x0 [0081.559] lstrlenW (lpString=".mdt") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".mdt") returned 0x0 [0081.559] lstrlenW (lpString=".sdf") returned 4 [0081.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".sdf") returned 0x0 [0081.559] lstrlenW (lpString=".MDF") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".MDF") returned 0x0 [0081.560] lstrlenW (lpString=".DBF") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".DBF") returned 0x0 [0081.560] lstrlenW (lpString=".DB") returned 3 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".DB") returned 0x0 [0081.560] lstrlenW (lpString=".db") returned 3 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".db") returned 0x0 [0081.560] lstrlenW (lpString=".ndf") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".ndf") returned 0x0 [0081.560] lstrlenW (lpString=".NDF") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".NDF") returned 0x0 [0081.560] lstrlenW (lpString=".Mdf") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".Mdf") returned 0x0 [0081.560] lstrlenW (lpString=".dat") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".dat") returned 0x0 [0081.560] lstrlenW (lpString=".DAT") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".DAT") returned 0x0 [0081.560] lstrlenW (lpString=".ldf") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".ldf") returned 0x0 [0081.560] lstrlenW (lpString=".LDF") returned 4 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch=".LDF") returned 0x0 [0081.560] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.561] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.561] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.562] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20156269159) returned 1 [0081.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf6dc010, dwHighDateTime=0x1d585b4)) [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761fe8 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761fe8 | out: hHeap=0x260000) returned 1 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1b40 [0081.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1b40 | out: hHeap=0x260000) returned 1 [0081.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.562] GetLastError () returned 0x0 [0081.563] GetLastError () returned 0x0 [0081.563] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.563] GetLastError () returned 0x0 [0081.563] GetLastError () returned 0x0 [0081.565] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff73c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.566] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8c3e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x8c3e, lpOverlapped=0x0) returned 1 [0081.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.566] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.566] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.566] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.566] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.566] CloseHandle (hObject=0xe4) returned 1 [0081.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.567] GetLastError () returned 0x0 [0081.568] RtlWakeConditionVariable () returned 0x0 [0081.568] GetCurrentThreadId () returned 0x99c [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".ldf") returned 0x0 [0081.568] lstrlenW (lpString=".vhd") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".vhd") returned 0x0 [0081.568] lstrlenW (lpString=".vhdx") returned 5 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".vhdx") returned 0x0 [0081.568] lstrlenW (lpString=".pst") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".pst") returned 0x0 [0081.568] lstrlenW (lpString=".ost") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".ost") returned 0x0 [0081.568] lstrlenW (lpString=".bak") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".bak") returned 0x0 [0081.568] lstrlenW (lpString=".bac") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".bac") returned 0x0 [0081.568] lstrlenW (lpString=".sys") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".sys") returned 0x0 [0081.568] lstrlenW (lpString=".v2i") returned 4 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".v2i") returned 0x0 [0081.568] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.570] lstrlenW (lpString=".sql") returned 4 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".sql") returned 0x0 [0081.570] lstrlenW (lpString=".mdf") returned 4 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".mdf") returned 0x0 [0081.570] lstrlenW (lpString=".txt") returned 4 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".txt") returned 0x0 [0081.570] lstrlenW (lpString=".dbf") returned 4 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".dbf") returned 0x0 [0081.570] lstrlenW (lpString=".ckp") returned 4 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".ckp") returned 0x0 [0081.570] lstrlenW (lpString=".dacpac") returned 7 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".dacpac") returned 0x0 [0081.570] lstrlenW (lpString=".db3") returned 4 [0081.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".db3") returned 0x0 [0081.570] lstrlenW (lpString=".dtxs") returned 5 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".dtxs") returned 0x0 [0081.571] lstrlenW (lpString=".mdt") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".mdt") returned 0x0 [0081.571] lstrlenW (lpString=".sdf") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".sdf") returned 0x0 [0081.571] lstrlenW (lpString=".MDF") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".MDF") returned 0x0 [0081.571] lstrlenW (lpString=".DBF") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".DBF") returned 0x0 [0081.571] lstrlenW (lpString=".DB") returned 3 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".DB") returned 0x0 [0081.571] lstrlenW (lpString=".db") returned 3 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".db") returned 0x0 [0081.571] lstrlenW (lpString=".ndf") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".ndf") returned 0x0 [0081.571] lstrlenW (lpString=".NDF") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".NDF") returned 0x0 [0081.571] lstrlenW (lpString=".Mdf") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".Mdf") returned 0x0 [0081.571] lstrlenW (lpString=".dat") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".dat") returned 0x0 [0081.571] lstrlenW (lpString=".DAT") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".DAT") returned 0x0 [0081.571] lstrlenW (lpString=".ldf") returned 4 [0081.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".ldf") returned 0x0 [0081.571] lstrlenW (lpString=".LDF") returned 4 [0081.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch=".LDF") returned 0x0 [0081.572] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.572] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.573] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.573] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.573] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20157401174) returned 1 [0081.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf702170, dwHighDateTime=0x1d585b4)) [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761fb0 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761fb0 | out: hHeap=0x260000) returned 1 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1a98 [0081.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1a98 | out: hHeap=0x260000) returned 1 [0081.574] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.574] GetLastError () returned 0x0 [0081.574] GetLastError () returned 0x0 [0081.574] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.574] GetLastError () returned 0x0 [0081.574] GetLastError () returned 0x0 [0081.577] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.577] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.578] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.578] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.580] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.580] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.580] CloseHandle (hObject=0xe4) returned 1 [0081.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.582] GetLastError () returned 0x0 [0081.582] RtlWakeConditionVariable () returned 0x0 [0081.582] GetCurrentThreadId () returned 0x99c [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".ldf") returned 0x0 [0081.582] lstrlenW (lpString=".vhd") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".vhd") returned 0x0 [0081.582] lstrlenW (lpString=".vhdx") returned 5 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".vhdx") returned 0x0 [0081.582] lstrlenW (lpString=".pst") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".pst") returned 0x0 [0081.582] lstrlenW (lpString=".ost") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".ost") returned 0x0 [0081.582] lstrlenW (lpString=".bak") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".bak") returned 0x0 [0081.582] lstrlenW (lpString=".bac") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".bac") returned 0x0 [0081.582] lstrlenW (lpString=".sys") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".sys") returned 0x0 [0081.582] lstrlenW (lpString=".v2i") returned 4 [0081.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".v2i") returned 0x0 [0081.583] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.583] lstrlenW (lpString=".sql") returned 4 [0081.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".sql") returned 0x0 [0081.583] lstrlenW (lpString=".mdf") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".mdf") returned 0x0 [0081.584] lstrlenW (lpString=".txt") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".txt") returned 0x0 [0081.584] lstrlenW (lpString=".dbf") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".dbf") returned 0x0 [0081.584] lstrlenW (lpString=".ckp") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".ckp") returned 0x0 [0081.584] lstrlenW (lpString=".dacpac") returned 7 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".dacpac") returned 0x0 [0081.584] lstrlenW (lpString=".db3") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".db3") returned 0x0 [0081.584] lstrlenW (lpString=".dtxs") returned 5 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".dtxs") returned 0x0 [0081.584] lstrlenW (lpString=".mdt") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".mdt") returned 0x0 [0081.584] lstrlenW (lpString=".sdf") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".sdf") returned 0x0 [0081.584] lstrlenW (lpString=".MDF") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".MDF") returned 0x0 [0081.584] lstrlenW (lpString=".DBF") returned 4 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".DBF") returned 0x0 [0081.584] lstrlenW (lpString=".DB") returned 3 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".DB") returned 0x0 [0081.584] lstrlenW (lpString=".db") returned 3 [0081.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".db") returned 0x0 [0081.585] lstrlenW (lpString=".ndf") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".ndf") returned 0x0 [0081.585] lstrlenW (lpString=".NDF") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".NDF") returned 0x0 [0081.585] lstrlenW (lpString=".Mdf") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".Mdf") returned 0x0 [0081.585] lstrlenW (lpString=".dat") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".dat") returned 0x0 [0081.585] lstrlenW (lpString=".DAT") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".DAT") returned 0x0 [0081.585] lstrlenW (lpString=".ldf") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".ldf") returned 0x0 [0081.585] lstrlenW (lpString=".LDF") returned 4 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch=".LDF") returned 0x0 [0081.585] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.585] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.586] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.586] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20158731027) returned 1 [0081.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf702170, dwHighDateTime=0x1d585b4)) [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761f78 [0081.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761f78 | out: hHeap=0x260000) returned 1 [0081.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1c90 [0081.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1c90 | out: hHeap=0x260000) returned 1 [0081.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.587] GetLastError () returned 0x0 [0081.587] GetLastError () returned 0x0 [0081.587] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.587] GetLastError () returned 0x0 [0081.588] GetLastError () returned 0x0 [0081.590] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.591] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.592] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.592] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.593] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.593] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.593] CloseHandle (hObject=0xe4) returned 1 [0081.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.595] GetLastError () returned 0x0 [0081.595] RtlWakeConditionVariable () returned 0x0 [0081.595] GetCurrentThreadId () returned 0x99c [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".ldf") returned 0x0 [0081.595] lstrlenW (lpString=".vhd") returned 4 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".vhd") returned 0x0 [0081.595] lstrlenW (lpString=".vhdx") returned 5 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".vhdx") returned 0x0 [0081.595] lstrlenW (lpString=".pst") returned 4 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".pst") returned 0x0 [0081.595] lstrlenW (lpString=".ost") returned 4 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".ost") returned 0x0 [0081.595] lstrlenW (lpString=".bak") returned 4 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".bak") returned 0x0 [0081.595] lstrlenW (lpString=".bac") returned 4 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".bac") returned 0x0 [0081.595] lstrlenW (lpString=".sys") returned 4 [0081.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".sys") returned 0x0 [0081.596] lstrlenW (lpString=".v2i") returned 4 [0081.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".v2i") returned 0x0 [0081.596] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.665] lstrlenW (lpString=".sql") returned 4 [0081.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".sql") returned 0x0 [0081.665] lstrlenW (lpString=".mdf") returned 4 [0081.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".mdf") returned 0x0 [0081.665] lstrlenW (lpString=".txt") returned 4 [0081.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".txt") returned 0x0 [0081.665] lstrlenW (lpString=".dbf") returned 4 [0081.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".dbf") returned 0x0 [0081.665] lstrlenW (lpString=".ckp") returned 4 [0081.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".ckp") returned 0x0 [0081.665] lstrlenW (lpString=".dacpac") returned 7 [0081.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".dacpac") returned 0x0 [0081.682] lstrlenW (lpString=".db3") returned 4 [0081.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".db3") returned 0x0 [0081.682] lstrlenW (lpString=".dtxs") returned 5 [0081.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".dtxs") returned 0x0 [0081.683] lstrlenW (lpString=".mdt") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".mdt") returned 0x0 [0081.683] lstrlenW (lpString=".sdf") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".sdf") returned 0x0 [0081.683] lstrlenW (lpString=".MDF") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".MDF") returned 0x0 [0081.683] lstrlenW (lpString=".DBF") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".DBF") returned 0x0 [0081.683] lstrlenW (lpString=".DB") returned 3 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".DB") returned 0x0 [0081.683] lstrlenW (lpString=".db") returned 3 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".db") returned 0x0 [0081.683] lstrlenW (lpString=".ndf") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".ndf") returned 0x0 [0081.683] lstrlenW (lpString=".NDF") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".NDF") returned 0x0 [0081.683] lstrlenW (lpString=".Mdf") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".Mdf") returned 0x0 [0081.683] lstrlenW (lpString=".dat") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".dat") returned 0x0 [0081.683] lstrlenW (lpString=".DAT") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".DAT") returned 0x0 [0081.683] lstrlenW (lpString=".ldf") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".ldf") returned 0x0 [0081.683] lstrlenW (lpString=".LDF") returned 4 [0081.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch=".LDF") returned 0x0 [0081.684] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.684] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.685] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.685] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20168583588) returned 1 [0081.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf80cb10, dwHighDateTime=0x1d585b4)) [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338448 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338448 | out: hHeap=0x260000) returned 1 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1750 [0081.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f238 [0081.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1750 | out: hHeap=0x260000) returned 1 [0081.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.686] GetLastError () returned 0x0 [0081.686] GetLastError () returned 0x0 [0081.686] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.686] GetLastError () returned 0x0 [0081.686] GetLastError () returned 0x0 [0081.689] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.689] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.691] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.691] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.691] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.691] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.691] CloseHandle (hObject=0xe4) returned 1 [0081.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0081.691] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0081.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.692] GetLastError () returned 0x0 [0081.692] RtlWakeConditionVariable () returned 0x0 [0081.692] GetCurrentThreadId () returned 0x99c [0081.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".ldf") returned 0x0 [0081.693] lstrlenW (lpString=".vhd") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".vhd") returned 0x0 [0081.693] lstrlenW (lpString=".vhdx") returned 5 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".vhdx") returned 0x0 [0081.693] lstrlenW (lpString=".pst") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".pst") returned 0x0 [0081.693] lstrlenW (lpString=".ost") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".ost") returned 0x0 [0081.693] lstrlenW (lpString=".bak") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".bak") returned 0x0 [0081.693] lstrlenW (lpString=".bac") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".bac") returned 0x0 [0081.693] lstrlenW (lpString=".sys") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".sys") returned 0x0 [0081.693] lstrlenW (lpString=".v2i") returned 4 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".v2i") returned 0x0 [0081.693] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.694] lstrlenW (lpString=".sql") returned 4 [0081.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".sql") returned 0x0 [0081.694] lstrlenW (lpString=".mdf") returned 4 [0081.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".mdf") returned 0x0 [0081.694] lstrlenW (lpString=".txt") returned 4 [0081.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".txt") returned 0x0 [0081.694] lstrlenW (lpString=".dbf") returned 4 [0081.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".dbf") returned 0x0 [0081.694] lstrlenW (lpString=".ckp") returned 4 [0081.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".ckp") returned 0x0 [0081.694] lstrlenW (lpString=".dacpac") returned 7 [0081.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".dacpac") returned 0x0 [0081.695] lstrlenW (lpString=".db3") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".db3") returned 0x0 [0081.695] lstrlenW (lpString=".dtxs") returned 5 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".dtxs") returned 0x0 [0081.695] lstrlenW (lpString=".mdt") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".mdt") returned 0x0 [0081.695] lstrlenW (lpString=".sdf") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".sdf") returned 0x0 [0081.695] lstrlenW (lpString=".MDF") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".MDF") returned 0x0 [0081.695] lstrlenW (lpString=".DBF") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".DBF") returned 0x0 [0081.695] lstrlenW (lpString=".DB") returned 3 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".DB") returned 0x0 [0081.695] lstrlenW (lpString=".db") returned 3 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".db") returned 0x0 [0081.695] lstrlenW (lpString=".ndf") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".ndf") returned 0x0 [0081.695] lstrlenW (lpString=".NDF") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".NDF") returned 0x0 [0081.695] lstrlenW (lpString=".Mdf") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".Mdf") returned 0x0 [0081.695] lstrlenW (lpString=".dat") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".dat") returned 0x0 [0081.695] lstrlenW (lpString=".DAT") returned 4 [0081.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".DAT") returned 0x0 [0081.696] lstrlenW (lpString=".ldf") returned 4 [0081.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".ldf") returned 0x0 [0081.696] lstrlenW (lpString=".LDF") returned 4 [0081.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch=".LDF") returned 0x0 [0081.696] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.696] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.697] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.697] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20169795013) returned 1 [0081.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf80cb10, dwHighDateTime=0x1d585b4)) [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338480 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338480 | out: hHeap=0x260000) returned 1 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0081.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0081.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0081.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.698] GetLastError () returned 0x0 [0081.698] GetLastError () returned 0x0 [0081.698] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.698] GetLastError () returned 0x0 [0081.698] GetLastError () returned 0x0 [0081.700] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdbb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.700] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x244c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x244c, lpOverlapped=0x0) returned 1 [0081.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.700] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.701] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.701] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.701] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.701] CloseHandle (hObject=0xe4) returned 1 [0081.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.702] GetLastError () returned 0x0 [0081.702] RtlWakeConditionVariable () returned 0x0 [0081.702] GetCurrentThreadId () returned 0x99c [0081.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".ldf") returned 0x0 [0081.702] lstrlenW (lpString=".vhd") returned 4 [0081.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".vhd") returned 0x0 [0081.702] lstrlenW (lpString=".vhdx") returned 5 [0081.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".vhdx") returned 0x0 [0081.702] lstrlenW (lpString=".pst") returned 4 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".pst") returned 0x0 [0081.703] lstrlenW (lpString=".ost") returned 4 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".ost") returned 0x0 [0081.703] lstrlenW (lpString=".bak") returned 4 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".bak") returned 0x0 [0081.703] lstrlenW (lpString=".bac") returned 4 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".bac") returned 0x0 [0081.703] lstrlenW (lpString=".sys") returned 4 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".sys") returned 0x0 [0081.703] lstrlenW (lpString=".v2i") returned 4 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".v2i") returned 0x0 [0081.703] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.704] lstrlenW (lpString=".sql") returned 4 [0081.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".sql") returned 0x0 [0081.704] lstrlenW (lpString=".mdf") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".mdf") returned 0x0 [0081.705] lstrlenW (lpString=".txt") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".txt") returned 0x0 [0081.705] lstrlenW (lpString=".dbf") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".dbf") returned 0x0 [0081.705] lstrlenW (lpString=".ckp") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".ckp") returned 0x0 [0081.705] lstrlenW (lpString=".dacpac") returned 7 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".dacpac") returned 0x0 [0081.705] lstrlenW (lpString=".db3") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".db3") returned 0x0 [0081.705] lstrlenW (lpString=".dtxs") returned 5 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".dtxs") returned 0x0 [0081.705] lstrlenW (lpString=".mdt") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".mdt") returned 0x0 [0081.705] lstrlenW (lpString=".sdf") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".sdf") returned 0x0 [0081.705] lstrlenW (lpString=".MDF") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".MDF") returned 0x0 [0081.705] lstrlenW (lpString=".DBF") returned 4 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".DBF") returned 0x0 [0081.705] lstrlenW (lpString=".DB") returned 3 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".DB") returned 0x0 [0081.705] lstrlenW (lpString=".db") returned 3 [0081.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".db") returned 0x0 [0081.706] lstrlenW (lpString=".ndf") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".ndf") returned 0x0 [0081.706] lstrlenW (lpString=".NDF") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".NDF") returned 0x0 [0081.706] lstrlenW (lpString=".Mdf") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".Mdf") returned 0x0 [0081.706] lstrlenW (lpString=".dat") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".dat") returned 0x0 [0081.706] lstrlenW (lpString=".DAT") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".DAT") returned 0x0 [0081.706] lstrlenW (lpString=".ldf") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".ldf") returned 0x0 [0081.706] lstrlenW (lpString=".LDF") returned 4 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch=".LDF") returned 0x0 [0081.706] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.706] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.707] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.707] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.707] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20170832872) returned 1 [0081.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf832c70, dwHighDateTime=0x1d585b4)) [0081.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3384b8 [0081.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3384b8 | out: hHeap=0x260000) returned 1 [0081.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0081.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760798 [0081.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0081.708] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.708] GetLastError () returned 0x0 [0081.708] GetLastError () returned 0x0 [0081.708] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.708] GetLastError () returned 0x0 [0081.709] GetLastError () returned 0x0 [0081.710] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff8738, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.711] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x78c8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x78c8, lpOverlapped=0x0) returned 1 [0081.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.711] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.711] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.711] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.711] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.711] CloseHandle (hObject=0xe4) returned 1 [0081.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.712] GetLastError () returned 0x0 [0081.712] RtlWakeConditionVariable () returned 0x0 [0081.712] GetCurrentThreadId () returned 0x99c [0081.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".ldf") returned 0x0 [0081.713] lstrlenW (lpString=".vhd") returned 4 [0081.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".vhd") returned 0x0 [0081.713] lstrlenW (lpString=".vhdx") returned 5 [0081.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".vhdx") returned 0x0 [0081.726] lstrlenW (lpString=".pst") returned 4 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".pst") returned 0x0 [0081.726] lstrlenW (lpString=".ost") returned 4 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".ost") returned 0x0 [0081.726] lstrlenW (lpString=".bak") returned 4 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".bak") returned 0x0 [0081.726] lstrlenW (lpString=".bac") returned 4 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".bac") returned 0x0 [0081.726] lstrlenW (lpString=".sys") returned 4 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".sys") returned 0x0 [0081.726] lstrlenW (lpString=".v2i") returned 4 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".v2i") returned 0x0 [0081.726] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.727] lstrlenW (lpString=".sql") returned 4 [0081.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".sql") returned 0x0 [0081.727] lstrlenW (lpString=".mdf") returned 4 [0081.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".mdf") returned 0x0 [0081.728] lstrlenW (lpString=".txt") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".txt") returned 0x0 [0081.728] lstrlenW (lpString=".dbf") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".dbf") returned 0x0 [0081.728] lstrlenW (lpString=".ckp") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".ckp") returned 0x0 [0081.728] lstrlenW (lpString=".dacpac") returned 7 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".dacpac") returned 0x0 [0081.728] lstrlenW (lpString=".db3") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".db3") returned 0x0 [0081.728] lstrlenW (lpString=".dtxs") returned 5 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".dtxs") returned 0x0 [0081.728] lstrlenW (lpString=".mdt") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".mdt") returned 0x0 [0081.728] lstrlenW (lpString=".sdf") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".sdf") returned 0x0 [0081.728] lstrlenW (lpString=".MDF") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".MDF") returned 0x0 [0081.728] lstrlenW (lpString=".DBF") returned 4 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".DBF") returned 0x0 [0081.728] lstrlenW (lpString=".DB") returned 3 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".DB") returned 0x0 [0081.728] lstrlenW (lpString=".db") returned 3 [0081.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".db") returned 0x0 [0081.728] lstrlenW (lpString=".ndf") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".ndf") returned 0x0 [0081.729] lstrlenW (lpString=".NDF") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".NDF") returned 0x0 [0081.729] lstrlenW (lpString=".Mdf") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".Mdf") returned 0x0 [0081.729] lstrlenW (lpString=".dat") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".dat") returned 0x0 [0081.729] lstrlenW (lpString=".DAT") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".DAT") returned 0x0 [0081.729] lstrlenW (lpString=".ldf") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".ldf") returned 0x0 [0081.729] lstrlenW (lpString=".LDF") returned 4 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch=".LDF") returned 0x0 [0081.729] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.729] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.730] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.730] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.730] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20173133004) returned 1 [0081.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf87ef30, dwHighDateTime=0x1d585b4)) [0081.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3384f0 [0081.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3384f0 | out: hHeap=0x260000) returned 1 [0081.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d16a8 [0081.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d16a8 | out: hHeap=0x260000) returned 1 [0081.731] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.731] GetLastError () returned 0x0 [0081.731] GetLastError () returned 0x0 [0081.731] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.731] GetLastError () returned 0x0 [0081.732] GetLastError () returned 0x0 [0081.847] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff1a7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.847] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xe584, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xe584, lpOverlapped=0x0) returned 1 [0081.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.847] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.848] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.848] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.848] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.848] CloseHandle (hObject=0xe4) returned 1 [0081.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.849] GetLastError () returned 0x0 [0081.849] RtlWakeConditionVariable () returned 0x0 [0081.850] GetCurrentThreadId () returned 0x99c [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".ldf") returned 0x0 [0081.850] lstrlenW (lpString=".vhd") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".vhd") returned 0x0 [0081.850] lstrlenW (lpString=".vhdx") returned 5 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".vhdx") returned 0x0 [0081.850] lstrlenW (lpString=".pst") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".pst") returned 0x0 [0081.850] lstrlenW (lpString=".ost") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".ost") returned 0x0 [0081.850] lstrlenW (lpString=".bak") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".bak") returned 0x0 [0081.850] lstrlenW (lpString=".bac") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".bac") returned 0x0 [0081.850] lstrlenW (lpString=".sys") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".sys") returned 0x0 [0081.850] lstrlenW (lpString=".v2i") returned 4 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".v2i") returned 0x0 [0081.850] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.851] lstrlenW (lpString=".sql") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".sql") returned 0x0 [0081.852] lstrlenW (lpString=".mdf") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".mdf") returned 0x0 [0081.852] lstrlenW (lpString=".txt") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".txt") returned 0x0 [0081.852] lstrlenW (lpString=".dbf") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".dbf") returned 0x0 [0081.852] lstrlenW (lpString=".ckp") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".ckp") returned 0x0 [0081.852] lstrlenW (lpString=".dacpac") returned 7 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".dacpac") returned 0x0 [0081.852] lstrlenW (lpString=".db3") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".db3") returned 0x0 [0081.852] lstrlenW (lpString=".dtxs") returned 5 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".dtxs") returned 0x0 [0081.852] lstrlenW (lpString=".mdt") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".mdt") returned 0x0 [0081.852] lstrlenW (lpString=".sdf") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".sdf") returned 0x0 [0081.852] lstrlenW (lpString=".MDF") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".MDF") returned 0x0 [0081.852] lstrlenW (lpString=".DBF") returned 4 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".DBF") returned 0x0 [0081.852] lstrlenW (lpString=".DB") returned 3 [0081.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".DB") returned 0x0 [0081.852] lstrlenW (lpString=".db") returned 3 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".db") returned 0x0 [0081.853] lstrlenW (lpString=".ndf") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".ndf") returned 0x0 [0081.853] lstrlenW (lpString=".NDF") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".NDF") returned 0x0 [0081.853] lstrlenW (lpString=".Mdf") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".Mdf") returned 0x0 [0081.853] lstrlenW (lpString=".dat") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".dat") returned 0x0 [0081.853] lstrlenW (lpString=".DAT") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".DAT") returned 0x0 [0081.853] lstrlenW (lpString=".ldf") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".ldf") returned 0x0 [0081.853] lstrlenW (lpString=".LDF") returned 4 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch=".LDF") returned 0x0 [0081.853] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.853] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.854] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.854] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.854] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20185557772) returned 1 [0081.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf9afa30, dwHighDateTime=0x1d585b4)) [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338720 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338720 | out: hHeap=0x260000) returned 1 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27604a0 [0081.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.855] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.855] GetLastError () returned 0x0 [0081.855] GetLastError () returned 0x0 [0081.856] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.856] GetLastError () returned 0x0 [0081.856] GetLastError () returned 0x0 [0081.858] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff4036, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.858] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbfca, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xbfca, lpOverlapped=0x0) returned 1 [0081.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.858] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.858] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.858] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.859] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.859] CloseHandle (hObject=0xe4) returned 1 [0081.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.860] GetLastError () returned 0x0 [0081.860] RtlWakeConditionVariable () returned 0x0 [0081.860] GetCurrentThreadId () returned 0x99c [0081.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".ldf") returned 0x0 [0081.860] lstrlenW (lpString=".vhd") returned 4 [0081.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".vhd") returned 0x0 [0081.860] lstrlenW (lpString=".vhdx") returned 5 [0081.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".vhdx") returned 0x0 [0081.860] lstrlenW (lpString=".pst") returned 4 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".pst") returned 0x0 [0081.861] lstrlenW (lpString=".ost") returned 4 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".ost") returned 0x0 [0081.861] lstrlenW (lpString=".bak") returned 4 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".bak") returned 0x0 [0081.861] lstrlenW (lpString=".bac") returned 4 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".bac") returned 0x0 [0081.861] lstrlenW (lpString=".sys") returned 4 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".sys") returned 0x0 [0081.861] lstrlenW (lpString=".v2i") returned 4 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".v2i") returned 0x0 [0081.861] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0081.862] lstrlenW (lpString=".sql") returned 4 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".sql") returned 0x0 [0081.862] lstrlenW (lpString=".mdf") returned 4 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".mdf") returned 0x0 [0081.862] lstrlenW (lpString=".txt") returned 4 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".txt") returned 0x0 [0081.862] lstrlenW (lpString=".dbf") returned 4 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".dbf") returned 0x0 [0081.862] lstrlenW (lpString=".ckp") returned 4 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".ckp") returned 0x0 [0081.862] lstrlenW (lpString=".dacpac") returned 7 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".dacpac") returned 0x0 [0081.862] lstrlenW (lpString=".db3") returned 4 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".db3") returned 0x0 [0081.862] lstrlenW (lpString=".dtxs") returned 5 [0081.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".dtxs") returned 0x0 [0081.862] lstrlenW (lpString=".mdt") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".mdt") returned 0x0 [0081.863] lstrlenW (lpString=".sdf") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".sdf") returned 0x0 [0081.863] lstrlenW (lpString=".MDF") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".MDF") returned 0x0 [0081.863] lstrlenW (lpString=".DBF") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".DBF") returned 0x0 [0081.863] lstrlenW (lpString=".DB") returned 3 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".DB") returned 0x0 [0081.863] lstrlenW (lpString=".db") returned 3 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".db") returned 0x0 [0081.863] lstrlenW (lpString=".ndf") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".ndf") returned 0x0 [0081.863] lstrlenW (lpString=".NDF") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".NDF") returned 0x0 [0081.863] lstrlenW (lpString=".Mdf") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".Mdf") returned 0x0 [0081.863] lstrlenW (lpString=".dat") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".dat") returned 0x0 [0081.863] lstrlenW (lpString=".DAT") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".DAT") returned 0x0 [0081.863] lstrlenW (lpString=".ldf") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".ldf") returned 0x0 [0081.863] lstrlenW (lpString=".LDF") returned 4 [0081.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch=".LDF") returned 0x0 [0081.864] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.864] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0081.864] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.864] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.865] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20186614474) returned 1 [0081.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbf9afa30, dwHighDateTime=0x1d585b4)) [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338758 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338758 | out: hHeap=0x260000) returned 1 [0081.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fe18 [0081.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.866] GetLastError () returned 0x0 [0081.866] GetLastError () returned 0x0 [0081.866] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.866] GetLastError () returned 0x0 [0081.866] GetLastError () returned 0x0 [0081.868] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff396a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.869] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc696, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xc696, lpOverlapped=0x0) returned 1 [0081.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.869] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.869] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.869] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.869] CloseHandle (hObject=0xe4) returned 1 [0081.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.871] GetLastError () returned 0x0 [0081.871] RtlWakeConditionVariable () returned 0x0 [0081.871] GetCurrentThreadId () returned 0x99c [0081.871] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.871] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0081.871] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0081.871] WriteFile (in: hFile=0xe4, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0081.873] CloseHandle (hObject=0xe4) returned 1 [0081.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2778120 | out: hHeap=0x260000) returned 1 [0081.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0081.873] RtlWakeConditionVariable () returned 0x27e828 [0081.873] GetCurrentThreadId () returned 0x99c [0081.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".ldf") returned 0x0 [0081.873] lstrlenW (lpString=".vhd") returned 4 [0081.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".vhd") returned 0x0 [0081.873] lstrlenW (lpString=".vhdx") returned 5 [0081.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".vhdx") returned 0x0 [0081.873] lstrlenW (lpString=".pst") returned 4 [0081.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".pst") returned 0x0 [0081.873] lstrlenW (lpString=".ost") returned 4 [0081.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".ost") returned 0x0 [0081.873] lstrlenW (lpString=".bak") returned 4 [0081.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".bak") returned 0x0 [0081.874] lstrlenW (lpString=".bac") returned 4 [0081.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".bac") returned 0x0 [0081.874] lstrlenW (lpString=".sys") returned 4 [0081.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".sys") returned 0x0 [0081.874] lstrlenW (lpString=".v2i") returned 4 [0081.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".v2i") returned 0x0 [0081.874] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0081.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.915] lstrlenW (lpString=".sql") returned 4 [0081.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".sql") returned 0x0 [0081.915] lstrlenW (lpString=".mdf") returned 4 [0081.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".mdf") returned 0x0 [0081.915] lstrlenW (lpString=".txt") returned 4 [0081.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".txt") returned 0x0 [0081.915] lstrlenW (lpString=".dbf") returned 4 [0081.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".dbf") returned 0x0 [0081.915] lstrlenW (lpString=".ckp") returned 4 [0081.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".ckp") returned 0x0 [0081.915] lstrlenW (lpString=".dacpac") returned 7 [0081.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".dacpac") returned 0x0 [0081.919] lstrlenW (lpString=".db3") returned 4 [0081.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".db3") returned 0x0 [0081.919] lstrlenW (lpString=".dtxs") returned 5 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".dtxs") returned 0x0 [0081.931] lstrlenW (lpString=".mdt") returned 4 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".mdt") returned 0x0 [0081.931] lstrlenW (lpString=".sdf") returned 4 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".sdf") returned 0x0 [0081.931] lstrlenW (lpString=".MDF") returned 4 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".MDF") returned 0x0 [0081.931] lstrlenW (lpString=".DBF") returned 4 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".DBF") returned 0x0 [0081.931] lstrlenW (lpString=".DB") returned 3 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".DB") returned 0x0 [0081.931] lstrlenW (lpString=".db") returned 3 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".db") returned 0x0 [0081.931] lstrlenW (lpString=".ndf") returned 4 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".ndf") returned 0x0 [0081.931] lstrlenW (lpString=".NDF") returned 4 [0081.931] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".NDF") returned 0x0 [0081.931] lstrlenW (lpString=".Mdf") returned 4 [0081.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".Mdf") returned 0x0 [0081.932] lstrlenW (lpString=".dat") returned 4 [0081.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".dat") returned 0x0 [0081.932] lstrlenW (lpString=".DAT") returned 4 [0081.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".DAT") returned 0x0 [0081.932] lstrlenW (lpString=".ldf") returned 4 [0081.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".ldf") returned 0x0 [0081.932] lstrlenW (lpString=".LDF") returned 4 [0081.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch=".LDF") returned 0x0 [0081.932] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.932] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2828) returned 1 [0081.933] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.933] CryptReleaseContext (hProv=0x2d2828, dwFlags=0x0) returned 1 [0081.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.933] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20193413772) returned 1 [0081.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfa6e110, dwHighDateTime=0x1d585b4)) [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338870 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338870 | out: hHeap=0x260000) returned 1 [0081.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.934] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.934] GetLastError () returned 0x0 [0081.934] GetLastError () returned 0x0 [0081.934] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.934] GetLastError () returned 0x0 [0081.934] GetLastError () returned 0x0 [0081.938] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.938] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.939] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.939] WriteFile (in: hFile=0xe8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.939] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.940] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.940] CloseHandle (hObject=0xe8) returned 1 [0081.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0081.940] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.[deadmin@cock.li].deadmin")) returned 1 [0081.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0081.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.942] GetLastError () returned 0x0 [0081.942] RtlWakeConditionVariable () returned 0x0 [0081.942] GetCurrentThreadId () returned 0x99c [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".ldf") returned 0x0 [0081.942] lstrlenW (lpString=".vhd") returned 4 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".vhd") returned 0x0 [0081.942] lstrlenW (lpString=".vhdx") returned 5 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".vhdx") returned 0x0 [0081.942] lstrlenW (lpString=".pst") returned 4 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".pst") returned 0x0 [0081.942] lstrlenW (lpString=".ost") returned 4 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".ost") returned 0x0 [0081.942] lstrlenW (lpString=".bak") returned 4 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".bak") returned 0x0 [0081.942] lstrlenW (lpString=".bac") returned 4 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".bac") returned 0x0 [0081.942] lstrlenW (lpString=".sys") returned 4 [0081.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".sys") returned 0x0 [0081.943] lstrlenW (lpString=".v2i") returned 4 [0081.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".v2i") returned 0x0 [0081.943] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch="s\r\n.v2i") returned 0x0 [0081.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.944] lstrlenW (lpString=".sql") returned 4 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".sql") returned 0x0 [0081.944] lstrlenW (lpString=".mdf") returned 4 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".mdf") returned 0x0 [0081.944] lstrlenW (lpString=".txt") returned 4 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".txt") returned 0x0 [0081.944] lstrlenW (lpString=".dbf") returned 4 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".dbf") returned 0x0 [0081.944] lstrlenW (lpString=".ckp") returned 4 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".ckp") returned 0x0 [0081.944] lstrlenW (lpString=".dacpac") returned 7 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".dacpac") returned 0x0 [0081.944] lstrlenW (lpString=".db3") returned 4 [0081.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".db3") returned 0x0 [0081.944] lstrlenW (lpString=".dtxs") returned 5 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".dtxs") returned 0x0 [0081.945] lstrlenW (lpString=".mdt") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".mdt") returned 0x0 [0081.945] lstrlenW (lpString=".sdf") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".sdf") returned 0x0 [0081.945] lstrlenW (lpString=".MDF") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".MDF") returned 0x0 [0081.945] lstrlenW (lpString=".DBF") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".DBF") returned 0x0 [0081.945] lstrlenW (lpString=".DB") returned 3 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".DB") returned 0x0 [0081.945] lstrlenW (lpString=".db") returned 3 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".db") returned 0x0 [0081.945] lstrlenW (lpString=".ndf") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".ndf") returned 0x0 [0081.945] lstrlenW (lpString=".NDF") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".NDF") returned 0x0 [0081.945] lstrlenW (lpString=".Mdf") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".Mdf") returned 0x0 [0081.945] lstrlenW (lpString=".dat") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".dat") returned 0x0 [0081.945] lstrlenW (lpString=".DAT") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".DAT") returned 0x0 [0081.945] lstrlenW (lpString=".ldf") returned 4 [0081.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".ldf") returned 0x0 [0081.945] lstrlenW (lpString=".LDF") returned 4 [0081.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch=".LDF") returned 0x0 [0081.946] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.946] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2718) returned 1 [0081.946] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.947] CryptReleaseContext (hProv=0x2d2718, dwFlags=0x0) returned 1 [0081.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.947] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20194784842) returned 1 [0081.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfa94270, dwHighDateTime=0x1d585b4)) [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3388a8 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3388a8 | out: hHeap=0x260000) returned 1 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.948] GetLastError () returned 0x0 [0081.948] GetLastError () returned 0x0 [0081.948] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.948] GetLastError () returned 0x0 [0081.948] GetLastError () returned 0x0 [0081.950] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffff233e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.951] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xdcc2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xdcc2, lpOverlapped=0x0) returned 1 [0081.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.951] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.951] WriteFile (in: hFile=0xe8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.951] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.951] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.951] CloseHandle (hObject=0xe8) returned 1 [0081.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0081.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.[deadmin@cock.li].deadmin")) returned 1 [0081.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0081.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.953] GetLastError () returned 0x0 [0081.953] RtlWakeConditionVariable () returned 0x0 [0081.953] GetCurrentThreadId () returned 0x99c [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".ldf") returned 0x0 [0081.953] lstrlenW (lpString=".vhd") returned 4 [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".vhd") returned 0x0 [0081.953] lstrlenW (lpString=".vhdx") returned 5 [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".vhdx") returned 0x0 [0081.953] lstrlenW (lpString=".pst") returned 4 [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".pst") returned 0x0 [0081.953] lstrlenW (lpString=".ost") returned 4 [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".ost") returned 0x0 [0081.953] lstrlenW (lpString=".bak") returned 4 [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".bak") returned 0x0 [0081.953] lstrlenW (lpString=".bac") returned 4 [0081.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".bac") returned 0x0 [0081.954] lstrlenW (lpString=".sys") returned 4 [0081.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".sys") returned 0x0 [0081.954] lstrlenW (lpString=".v2i") returned 4 [0081.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".v2i") returned 0x0 [0081.954] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0081.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0081.955] lstrlenW (lpString=".sql") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".sql") returned 0x0 [0081.955] lstrlenW (lpString=".mdf") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".mdf") returned 0x0 [0081.955] lstrlenW (lpString=".txt") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".txt") returned 0x0 [0081.955] lstrlenW (lpString=".dbf") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".dbf") returned 0x0 [0081.955] lstrlenW (lpString=".ckp") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".ckp") returned 0x0 [0081.955] lstrlenW (lpString=".dacpac") returned 7 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".dacpac") returned 0x0 [0081.955] lstrlenW (lpString=".db3") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".db3") returned 0x0 [0081.955] lstrlenW (lpString=".dtxs") returned 5 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".dtxs") returned 0x0 [0081.955] lstrlenW (lpString=".mdt") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".mdt") returned 0x0 [0081.955] lstrlenW (lpString=".sdf") returned 4 [0081.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".sdf") returned 0x0 [0081.955] lstrlenW (lpString=".MDF") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".MDF") returned 0x0 [0081.956] lstrlenW (lpString=".DBF") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".DBF") returned 0x0 [0081.956] lstrlenW (lpString=".DB") returned 3 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".DB") returned 0x0 [0081.956] lstrlenW (lpString=".db") returned 3 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".db") returned 0x0 [0081.956] lstrlenW (lpString=".ndf") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".ndf") returned 0x0 [0081.956] lstrlenW (lpString=".NDF") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".NDF") returned 0x0 [0081.956] lstrlenW (lpString=".Mdf") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".Mdf") returned 0x0 [0081.956] lstrlenW (lpString=".dat") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".dat") returned 0x0 [0081.956] lstrlenW (lpString=".DAT") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".DAT") returned 0x0 [0081.956] lstrlenW (lpString=".ldf") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".ldf") returned 0x0 [0081.956] lstrlenW (lpString=".LDF") returned 4 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch=".LDF") returned 0x0 [0081.956] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0081.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.957] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2938) returned 1 [0081.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.957] CryptReleaseContext (hProv=0x2d2938, dwFlags=0x0) returned 1 [0081.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0081.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0081.957] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20195860072) returned 1 [0081.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfa94270, dwHighDateTime=0x1d585b4)) [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3388e0 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3388e0 | out: hHeap=0x260000) returned 1 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760700 [0081.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.958] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0081.958] GetLastError () returned 0x0 [0081.959] GetLastError () returned 0x0 [0081.959] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0081.959] GetLastError () returned 0x0 [0081.959] GetLastError () returned 0x0 [0081.961] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.961] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0081.963] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.963] WriteFile (in: hFile=0xe8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.964] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.965] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.965] CloseHandle (hObject=0xe8) returned 1 [0081.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0081.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.[deadmin@cock.li].deadmin")) returned 1 [0081.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0081.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0081.966] GetLastError () returned 0x0 [0081.966] RtlWakeConditionVariable () returned 0x0 [0081.966] GetCurrentThreadId () returned 0x99c [0081.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".ldf") returned 0x0 [0081.966] lstrlenW (lpString=".vhd") returned 4 [0081.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".vhd") returned 0x0 [0081.966] lstrlenW (lpString=".vhdx") returned 5 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".vhdx") returned 0x0 [0081.967] lstrlenW (lpString=".pst") returned 4 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".pst") returned 0x0 [0081.967] lstrlenW (lpString=".ost") returned 4 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".ost") returned 0x0 [0081.967] lstrlenW (lpString=".bak") returned 4 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".bak") returned 0x0 [0081.967] lstrlenW (lpString=".bac") returned 4 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".bac") returned 0x0 [0081.967] lstrlenW (lpString=".sys") returned 4 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".sys") returned 0x0 [0081.967] lstrlenW (lpString=".v2i") returned 4 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".v2i") returned 0x0 [0081.967] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0081.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.000] lstrlenW (lpString=".sql") returned 4 [0082.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".sql") returned 0x0 [0082.000] lstrlenW (lpString=".mdf") returned 4 [0082.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".mdf") returned 0x0 [0082.000] lstrlenW (lpString=".txt") returned 4 [0082.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".txt") returned 0x0 [0082.000] lstrlenW (lpString=".dbf") returned 4 [0082.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".dbf") returned 0x0 [0082.000] lstrlenW (lpString=".ckp") returned 4 [0082.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".ckp") returned 0x0 [0082.006] lstrlenW (lpString=".dacpac") returned 7 [0082.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".dacpac") returned 0x0 [0082.006] lstrlenW (lpString=".db3") returned 4 [0082.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".db3") returned 0x0 [0082.006] lstrlenW (lpString=".dtxs") returned 5 [0082.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".dtxs") returned 0x0 [0082.006] lstrlenW (lpString=".mdt") returned 4 [0082.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".mdt") returned 0x0 [0082.006] lstrlenW (lpString=".sdf") returned 4 [0082.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".sdf") returned 0x0 [0082.006] lstrlenW (lpString=".MDF") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".MDF") returned 0x0 [0082.007] lstrlenW (lpString=".DBF") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".DBF") returned 0x0 [0082.007] lstrlenW (lpString=".DB") returned 3 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".DB") returned 0x0 [0082.007] lstrlenW (lpString=".db") returned 3 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".db") returned 0x0 [0082.007] lstrlenW (lpString=".ndf") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".ndf") returned 0x0 [0082.007] lstrlenW (lpString=".NDF") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".NDF") returned 0x0 [0082.007] lstrlenW (lpString=".Mdf") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".Mdf") returned 0x0 [0082.007] lstrlenW (lpString=".dat") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".dat") returned 0x0 [0082.007] lstrlenW (lpString=".DAT") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".DAT") returned 0x0 [0082.007] lstrlenW (lpString=".ldf") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".ldf") returned 0x0 [0082.007] lstrlenW (lpString=".LDF") returned 4 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch=".LDF") returned 0x0 [0082.007] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.008] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d29c0) returned 1 [0082.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.008] CryptReleaseContext (hProv=0x2d29c0, dwFlags=0x0) returned 1 [0082.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.008] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20200961609) returned 1 [0082.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfb06690, dwHighDateTime=0x1d585b4)) [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3389f8 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3389f8 | out: hHeap=0x260000) returned 1 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760078 [0082.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.009] GetLastError () returned 0x0 [0082.010] GetLastError () returned 0x0 [0082.010] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.010] GetLastError () returned 0x0 [0082.010] GetLastError () returned 0x0 [0082.013] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.013] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.015] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.015] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.016] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.016] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.016] CloseHandle (hObject=0xe4) returned 1 [0082.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0082.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0082.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.030] GetLastError () returned 0x0 [0082.030] RtlWakeConditionVariable () returned 0x27e828 [0082.030] GetCurrentThreadId () returned 0x99c [0082.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".ldf") returned 0x0 [0082.030] lstrlenW (lpString=".vhd") returned 4 [0082.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".vhd") returned 0x0 [0082.030] lstrlenW (lpString=".vhdx") returned 5 [0082.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".vhdx") returned 0x0 [0082.030] lstrlenW (lpString=".pst") returned 4 [0082.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".pst") returned 0x0 [0082.030] lstrlenW (lpString=".ost") returned 4 [0082.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".ost") returned 0x0 [0082.030] lstrlenW (lpString=".bak") returned 4 [0082.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".bak") returned 0x0 [0082.031] lstrlenW (lpString=".bac") returned 4 [0082.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".bac") returned 0x0 [0082.031] lstrlenW (lpString=".sys") returned 4 [0082.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".sys") returned 0x0 [0082.031] lstrlenW (lpString=".v2i") returned 4 [0082.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".v2i") returned 0x0 [0082.031] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.032] lstrlenW (lpString=".sql") returned 4 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".sql") returned 0x0 [0082.032] lstrlenW (lpString=".mdf") returned 4 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".mdf") returned 0x0 [0082.032] lstrlenW (lpString=".txt") returned 4 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".txt") returned 0x0 [0082.032] lstrlenW (lpString=".dbf") returned 4 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".dbf") returned 0x0 [0082.032] lstrlenW (lpString=".ckp") returned 4 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".ckp") returned 0x0 [0082.032] lstrlenW (lpString=".dacpac") returned 7 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".dacpac") returned 0x0 [0082.032] lstrlenW (lpString=".db3") returned 4 [0082.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".db3") returned 0x0 [0082.032] lstrlenW (lpString=".dtxs") returned 5 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".dtxs") returned 0x0 [0082.033] lstrlenW (lpString=".mdt") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".mdt") returned 0x0 [0082.033] lstrlenW (lpString=".sdf") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".sdf") returned 0x0 [0082.033] lstrlenW (lpString=".MDF") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".MDF") returned 0x0 [0082.033] lstrlenW (lpString=".DBF") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".DBF") returned 0x0 [0082.033] lstrlenW (lpString=".DB") returned 3 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".DB") returned 0x0 [0082.033] lstrlenW (lpString=".db") returned 3 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".db") returned 0x0 [0082.033] lstrlenW (lpString=".ndf") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".ndf") returned 0x0 [0082.033] lstrlenW (lpString=".NDF") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".NDF") returned 0x0 [0082.033] lstrlenW (lpString=".Mdf") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".Mdf") returned 0x0 [0082.033] lstrlenW (lpString=".dat") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".dat") returned 0x0 [0082.033] lstrlenW (lpString=".DAT") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".DAT") returned 0x0 [0082.033] lstrlenW (lpString=".ldf") returned 4 [0082.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".ldf") returned 0x0 [0082.034] lstrlenW (lpString=".LDF") returned 4 [0082.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch=".LDF") returned 0x0 [0082.034] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.034] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0082.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.035] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.035] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20203587229) returned 1 [0082.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfb52950, dwHighDateTime=0x1d585b4)) [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762300 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762300 | out: hHeap=0x260000) returned 1 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0082.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.036] GetLastError () returned 0x0 [0082.036] GetLastError () returned 0x0 [0082.036] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.036] GetLastError () returned 0x0 [0082.036] GetLastError () returned 0x0 [0082.038] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff6e80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.038] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9180, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x9180, lpOverlapped=0x0) returned 1 [0082.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.038] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.038] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.038] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.038] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.038] CloseHandle (hObject=0xe4) returned 1 [0082.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.040] GetLastError () returned 0x0 [0082.040] RtlWakeConditionVariable () returned 0x0 [0082.040] GetCurrentThreadId () returned 0x99c [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".ldf") returned 0x0 [0082.040] lstrlenW (lpString=".vhd") returned 4 [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".vhd") returned 0x0 [0082.040] lstrlenW (lpString=".vhdx") returned 5 [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".vhdx") returned 0x0 [0082.040] lstrlenW (lpString=".pst") returned 4 [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".pst") returned 0x0 [0082.040] lstrlenW (lpString=".ost") returned 4 [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".ost") returned 0x0 [0082.040] lstrlenW (lpString=".bak") returned 4 [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".bak") returned 0x0 [0082.040] lstrlenW (lpString=".bac") returned 4 [0082.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".bac") returned 0x0 [0082.040] lstrlenW (lpString=".sys") returned 4 [0082.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".sys") returned 0x0 [0082.041] lstrlenW (lpString=".v2i") returned 4 [0082.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".v2i") returned 0x0 [0082.041] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.042] lstrlenW (lpString=".sql") returned 4 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".sql") returned 0x0 [0082.042] lstrlenW (lpString=".mdf") returned 4 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".mdf") returned 0x0 [0082.042] lstrlenW (lpString=".txt") returned 4 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".txt") returned 0x0 [0082.042] lstrlenW (lpString=".dbf") returned 4 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".dbf") returned 0x0 [0082.042] lstrlenW (lpString=".ckp") returned 4 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".ckp") returned 0x0 [0082.042] lstrlenW (lpString=".dacpac") returned 7 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".dacpac") returned 0x0 [0082.042] lstrlenW (lpString=".db3") returned 4 [0082.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".db3") returned 0x0 [0082.042] lstrlenW (lpString=".dtxs") returned 5 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".dtxs") returned 0x0 [0082.043] lstrlenW (lpString=".mdt") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".mdt") returned 0x0 [0082.043] lstrlenW (lpString=".sdf") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".sdf") returned 0x0 [0082.043] lstrlenW (lpString=".MDF") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".MDF") returned 0x0 [0082.043] lstrlenW (lpString=".DBF") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".DBF") returned 0x0 [0082.043] lstrlenW (lpString=".DB") returned 3 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".DB") returned 0x0 [0082.043] lstrlenW (lpString=".db") returned 3 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".db") returned 0x0 [0082.043] lstrlenW (lpString=".ndf") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".ndf") returned 0x0 [0082.043] lstrlenW (lpString=".NDF") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".NDF") returned 0x0 [0082.043] lstrlenW (lpString=".Mdf") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".Mdf") returned 0x0 [0082.043] lstrlenW (lpString=".dat") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".dat") returned 0x0 [0082.043] lstrlenW (lpString=".DAT") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".DAT") returned 0x0 [0082.043] lstrlenW (lpString=".ldf") returned 4 [0082.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".ldf") returned 0x0 [0082.044] lstrlenW (lpString=".LDF") returned 4 [0082.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch=".LDF") returned 0x0 [0082.044] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.044] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2757af0) returned 1 [0082.044] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.045] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.045] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20204585411) returned 1 [0082.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfb78ab0, dwHighDateTime=0x1d585b4)) [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762220 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762220 | out: hHeap=0x260000) returned 1 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27648b0 [0082.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.045] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.046] GetLastError () returned 0x0 [0082.046] GetLastError () returned 0x0 [0082.046] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.046] GetLastError () returned 0x0 [0082.046] GetLastError () returned 0x0 [0082.048] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.048] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x2d90, lpOverlapped=0x0) returned 1 [0082.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.048] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.049] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.049] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.049] CloseHandle (hObject=0xe4) returned 1 [0082.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.051] GetLastError () returned 0x0 [0082.051] RtlWakeConditionVariable () returned 0x27e828 [0082.051] GetCurrentThreadId () returned 0x99c [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".ldf") returned 0x0 [0082.051] lstrlenW (lpString=".vhd") returned 4 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".vhd") returned 0x0 [0082.051] lstrlenW (lpString=".vhdx") returned 5 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".vhdx") returned 0x0 [0082.051] lstrlenW (lpString=".pst") returned 4 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".pst") returned 0x0 [0082.051] lstrlenW (lpString=".ost") returned 4 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".ost") returned 0x0 [0082.051] lstrlenW (lpString=".bak") returned 4 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".bak") returned 0x0 [0082.051] lstrlenW (lpString=".bac") returned 4 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".bac") returned 0x0 [0082.051] lstrlenW (lpString=".sys") returned 4 [0082.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".sys") returned 0x0 [0082.052] lstrlenW (lpString=".v2i") returned 4 [0082.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".v2i") returned 0x0 [0082.052] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.053] lstrlenW (lpString=".sql") returned 4 [0082.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".sql") returned 0x0 [0082.053] lstrlenW (lpString=".mdf") returned 4 [0082.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".mdf") returned 0x0 [0082.053] lstrlenW (lpString=".txt") returned 4 [0082.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".txt") returned 0x0 [0082.053] lstrlenW (lpString=".dbf") returned 4 [0082.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".dbf") returned 0x0 [0082.054] lstrlenW (lpString=".ckp") returned 4 [0082.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".ckp") returned 0x0 [0082.054] lstrlenW (lpString=".dacpac") returned 7 [0082.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".dacpac") returned 0x0 [0082.054] lstrlenW (lpString=".db3") returned 4 [0082.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".db3") returned 0x0 [0082.055] lstrlenW (lpString=".dtxs") returned 5 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".dtxs") returned 0x0 [0082.055] lstrlenW (lpString=".mdt") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".mdt") returned 0x0 [0082.055] lstrlenW (lpString=".sdf") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".sdf") returned 0x0 [0082.055] lstrlenW (lpString=".MDF") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".MDF") returned 0x0 [0082.055] lstrlenW (lpString=".DBF") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".DBF") returned 0x0 [0082.055] lstrlenW (lpString=".DB") returned 3 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".DB") returned 0x0 [0082.055] lstrlenW (lpString=".db") returned 3 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".db") returned 0x0 [0082.055] lstrlenW (lpString=".ndf") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".ndf") returned 0x0 [0082.055] lstrlenW (lpString=".NDF") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".NDF") returned 0x0 [0082.055] lstrlenW (lpString=".Mdf") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".Mdf") returned 0x0 [0082.055] lstrlenW (lpString=".dat") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".dat") returned 0x0 [0082.055] lstrlenW (lpString=".DAT") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".DAT") returned 0x0 [0082.055] lstrlenW (lpString=".ldf") returned 4 [0082.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".ldf") returned 0x0 [0082.056] lstrlenW (lpString=".LDF") returned 4 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch=".LDF") returned 0x0 [0082.056] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.056] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d28b0) returned 1 [0082.150] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.150] CryptReleaseContext (hProv=0x2d28b0, dwFlags=0x0) returned 1 [0082.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.150] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20215131374) returned 1 [0082.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfc83450, dwHighDateTime=0x1d585b4)) [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27622c8 [0082.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27622c8 | out: hHeap=0x260000) returned 1 [0082.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0082.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.151] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.151] GetLastError () returned 0x0 [0082.151] GetLastError () returned 0x0 [0082.151] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.151] GetLastError () returned 0x0 [0082.152] GetLastError () returned 0x0 [0082.155] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffca50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.155] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x35b0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x35b0, lpOverlapped=0x0) returned 1 [0082.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.155] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.155] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.155] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.155] CloseHandle (hObject=0xe4) returned 1 [0082.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.157] GetLastError () returned 0x0 [0082.157] RtlWakeConditionVariable () returned 0x0 [0082.157] GetCurrentThreadId () returned 0x99c [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".ldf") returned 0x0 [0082.157] lstrlenW (lpString=".vhd") returned 4 [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".vhd") returned 0x0 [0082.157] lstrlenW (lpString=".vhdx") returned 5 [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".vhdx") returned 0x0 [0082.157] lstrlenW (lpString=".pst") returned 4 [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".pst") returned 0x0 [0082.157] lstrlenW (lpString=".ost") returned 4 [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".ost") returned 0x0 [0082.157] lstrlenW (lpString=".bak") returned 4 [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".bak") returned 0x0 [0082.157] lstrlenW (lpString=".bac") returned 4 [0082.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".bac") returned 0x0 [0082.158] lstrlenW (lpString=".sys") returned 4 [0082.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".sys") returned 0x0 [0082.158] lstrlenW (lpString=".v2i") returned 4 [0082.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".v2i") returned 0x0 [0082.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.159] lstrlenW (lpString=".sql") returned 4 [0082.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".sql") returned 0x0 [0082.159] lstrlenW (lpString=".mdf") returned 4 [0082.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".mdf") returned 0x0 [0082.159] lstrlenW (lpString=".txt") returned 4 [0082.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".txt") returned 0x0 [0082.160] lstrlenW (lpString=".dbf") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".dbf") returned 0x0 [0082.160] lstrlenW (lpString=".ckp") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".ckp") returned 0x0 [0082.160] lstrlenW (lpString=".dacpac") returned 7 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".dacpac") returned 0x0 [0082.160] lstrlenW (lpString=".db3") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".db3") returned 0x0 [0082.160] lstrlenW (lpString=".dtxs") returned 5 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".dtxs") returned 0x0 [0082.160] lstrlenW (lpString=".mdt") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".mdt") returned 0x0 [0082.160] lstrlenW (lpString=".sdf") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".sdf") returned 0x0 [0082.160] lstrlenW (lpString=".MDF") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".MDF") returned 0x0 [0082.160] lstrlenW (lpString=".DBF") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".DBF") returned 0x0 [0082.160] lstrlenW (lpString=".DB") returned 3 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".DB") returned 0x0 [0082.160] lstrlenW (lpString=".db") returned 3 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".db") returned 0x0 [0082.160] lstrlenW (lpString=".ndf") returned 4 [0082.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".ndf") returned 0x0 [0082.160] lstrlenW (lpString=".NDF") returned 4 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".NDF") returned 0x0 [0082.161] lstrlenW (lpString=".Mdf") returned 4 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".Mdf") returned 0x0 [0082.161] lstrlenW (lpString=".dat") returned 4 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".dat") returned 0x0 [0082.161] lstrlenW (lpString=".DAT") returned 4 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".DAT") returned 0x0 [0082.161] lstrlenW (lpString=".ldf") returned 4 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".ldf") returned 0x0 [0082.161] lstrlenW (lpString=".LDF") returned 4 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch=".LDF") returned 0x0 [0082.161] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.161] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d28b0) returned 1 [0082.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.162] CryptReleaseContext (hProv=0x2d28b0, dwFlags=0x0) returned 1 [0082.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.162] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20216320482) returned 1 [0082.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfc83450, dwHighDateTime=0x1d585b4)) [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762098 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762098 | out: hHeap=0x260000) returned 1 [0082.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28124e0 [0082.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28124e0 | out: hHeap=0x260000) returned 1 [0082.163] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.163] GetLastError () returned 0x0 [0082.163] GetLastError () returned 0x0 [0082.163] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.163] GetLastError () returned 0x0 [0082.163] GetLastError () returned 0x0 [0082.165] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffca70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.165] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x3590, lpOverlapped=0x0) returned 1 [0082.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.166] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.166] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.166] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.166] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.166] CloseHandle (hObject=0xe4) returned 1 [0082.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.167] GetLastError () returned 0x0 [0082.167] RtlWakeConditionVariable () returned 0x0 [0082.167] GetCurrentThreadId () returned 0x99c [0082.168] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.168] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0082.168] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0082.168] WriteFile (in: hFile=0xe4, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0082.169] CloseHandle (hObject=0xe4) returned 1 [0082.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27781d8 | out: hHeap=0x260000) returned 1 [0082.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.169] RtlWakeConditionVariable () returned 0x27e828 [0082.169] GetCurrentThreadId () returned 0x99c [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".ldf") returned 0x0 [0082.170] lstrlenW (lpString=".vhd") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".vhd") returned 0x0 [0082.170] lstrlenW (lpString=".vhdx") returned 5 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".vhdx") returned 0x0 [0082.170] lstrlenW (lpString=".pst") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".pst") returned 0x0 [0082.170] lstrlenW (lpString=".ost") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".ost") returned 0x0 [0082.170] lstrlenW (lpString=".bak") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".bak") returned 0x0 [0082.170] lstrlenW (lpString=".bac") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".bac") returned 0x0 [0082.170] lstrlenW (lpString=".sys") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".sys") returned 0x0 [0082.170] lstrlenW (lpString=".v2i") returned 4 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".v2i") returned 0x0 [0082.170] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.171] lstrlenW (lpString=".sql") returned 4 [0082.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".sql") returned 0x0 [0082.171] lstrlenW (lpString=".mdf") returned 4 [0082.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".mdf") returned 0x0 [0082.171] lstrlenW (lpString=".txt") returned 4 [0082.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".txt") returned 0x0 [0082.171] lstrlenW (lpString=".dbf") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".dbf") returned 0x0 [0082.172] lstrlenW (lpString=".ckp") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".ckp") returned 0x0 [0082.172] lstrlenW (lpString=".dacpac") returned 7 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".dacpac") returned 0x0 [0082.172] lstrlenW (lpString=".db3") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".db3") returned 0x0 [0082.172] lstrlenW (lpString=".dtxs") returned 5 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".dtxs") returned 0x0 [0082.172] lstrlenW (lpString=".mdt") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".mdt") returned 0x0 [0082.172] lstrlenW (lpString=".sdf") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".sdf") returned 0x0 [0082.172] lstrlenW (lpString=".MDF") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".MDF") returned 0x0 [0082.172] lstrlenW (lpString=".DBF") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".DBF") returned 0x0 [0082.172] lstrlenW (lpString=".DB") returned 3 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".DB") returned 0x0 [0082.172] lstrlenW (lpString=".db") returned 3 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".db") returned 0x0 [0082.172] lstrlenW (lpString=".ndf") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".ndf") returned 0x0 [0082.172] lstrlenW (lpString=".NDF") returned 4 [0082.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".NDF") returned 0x0 [0082.172] lstrlenW (lpString=".Mdf") returned 4 [0082.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".Mdf") returned 0x0 [0082.173] lstrlenW (lpString=".dat") returned 4 [0082.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".dat") returned 0x0 [0082.173] lstrlenW (lpString=".DAT") returned 4 [0082.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".DAT") returned 0x0 [0082.173] lstrlenW (lpString=".ldf") returned 4 [0082.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".ldf") returned 0x0 [0082.173] lstrlenW (lpString=".LDF") returned 4 [0082.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch=".LDF") returned 0x0 [0082.173] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.173] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2a48) returned 1 [0082.174] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.174] CryptReleaseContext (hProv=0x2d2a48, dwFlags=0x0) returned 1 [0082.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.174] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20217515271) returned 1 [0082.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfca95b0, dwHighDateTime=0x1d585b4)) [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338a30 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338a30 | out: hHeap=0x260000) returned 1 [0082.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.175] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.175] GetLastError () returned 0x0 [0082.175] GetLastError () returned 0x0 [0082.175] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.175] GetLastError () returned 0x0 [0082.175] GetLastError () returned 0x0 [0082.178] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe9e88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.178] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x16178, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x16178, lpOverlapped=0x0) returned 1 [0082.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.178] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.178] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.179] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.179] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.179] CloseHandle (hObject=0xe4) returned 1 [0082.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.180] GetLastError () returned 0x0 [0082.180] RtlWakeConditionVariable () returned 0x0 [0082.180] GetCurrentThreadId () returned 0x99c [0082.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".ldf") returned 0x0 [0082.180] lstrlenW (lpString=".vhd") returned 4 [0082.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".vhd") returned 0x0 [0082.180] lstrlenW (lpString=".vhdx") returned 5 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".vhdx") returned 0x0 [0082.181] lstrlenW (lpString=".pst") returned 4 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".pst") returned 0x0 [0082.181] lstrlenW (lpString=".ost") returned 4 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".ost") returned 0x0 [0082.181] lstrlenW (lpString=".bak") returned 4 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".bak") returned 0x0 [0082.181] lstrlenW (lpString=".bac") returned 4 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".bac") returned 0x0 [0082.181] lstrlenW (lpString=".sys") returned 4 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".sys") returned 0x0 [0082.181] lstrlenW (lpString=".v2i") returned 4 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".v2i") returned 0x0 [0082.181] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.182] lstrlenW (lpString=".sql") returned 4 [0082.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".sql") returned 0x0 [0082.182] lstrlenW (lpString=".mdf") returned 4 [0082.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".mdf") returned 0x0 [0082.182] lstrlenW (lpString=".txt") returned 4 [0082.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".txt") returned 0x0 [0082.182] lstrlenW (lpString=".dbf") returned 4 [0082.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".dbf") returned 0x0 [0082.182] lstrlenW (lpString=".ckp") returned 4 [0082.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".ckp") returned 0x0 [0082.183] lstrlenW (lpString=".dacpac") returned 7 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".dacpac") returned 0x0 [0082.183] lstrlenW (lpString=".db3") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".db3") returned 0x0 [0082.183] lstrlenW (lpString=".dtxs") returned 5 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".dtxs") returned 0x0 [0082.183] lstrlenW (lpString=".mdt") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".mdt") returned 0x0 [0082.183] lstrlenW (lpString=".sdf") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".sdf") returned 0x0 [0082.183] lstrlenW (lpString=".MDF") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".MDF") returned 0x0 [0082.183] lstrlenW (lpString=".DBF") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".DBF") returned 0x0 [0082.183] lstrlenW (lpString=".DB") returned 3 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".DB") returned 0x0 [0082.183] lstrlenW (lpString=".db") returned 3 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".db") returned 0x0 [0082.183] lstrlenW (lpString=".ndf") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".ndf") returned 0x0 [0082.183] lstrlenW (lpString=".NDF") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".NDF") returned 0x0 [0082.183] lstrlenW (lpString=".Mdf") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".Mdf") returned 0x0 [0082.183] lstrlenW (lpString=".dat") returned 4 [0082.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".dat") returned 0x0 [0082.184] lstrlenW (lpString=".DAT") returned 4 [0082.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".DAT") returned 0x0 [0082.184] lstrlenW (lpString=".ldf") returned 4 [0082.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".ldf") returned 0x0 [0082.184] lstrlenW (lpString=".LDF") returned 4 [0082.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch=".LDF") returned 0x0 [0082.184] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.184] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d28b0) returned 1 [0082.185] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.185] CryptReleaseContext (hProv=0x2d28b0, dwFlags=0x0) returned 1 [0082.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0082.185] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20218604047) returned 1 [0082.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfccf710, dwHighDateTime=0x1d585b4)) [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338a68 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338a68 | out: hHeap=0x260000) returned 1 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0082.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.186] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.186] GetLastError () returned 0x0 [0082.186] GetLastError () returned 0x0 [0082.186] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.186] GetLastError () returned 0x0 [0082.186] GetLastError () returned 0x0 [0082.199] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff8670, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.202] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x7990, lpOverlapped=0x0) returned 1 [0082.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.204] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.204] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.204] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.204] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.204] CloseHandle (hObject=0xe4) returned 1 [0082.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0082.305] GetLastError () returned 0x0 [0082.305] RtlWakeConditionVariable () returned 0x0 [0082.306] GetCurrentThreadId () returned 0x99c [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".ldf") returned 0x0 [0082.306] lstrlenW (lpString=".vhd") returned 4 [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".vhd") returned 0x0 [0082.306] lstrlenW (lpString=".vhdx") returned 5 [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".vhdx") returned 0x0 [0082.306] lstrlenW (lpString=".pst") returned 4 [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".pst") returned 0x0 [0082.306] lstrlenW (lpString=".ost") returned 4 [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".ost") returned 0x0 [0082.306] lstrlenW (lpString=".bak") returned 4 [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".bak") returned 0x0 [0082.306] lstrlenW (lpString=".bac") returned 4 [0082.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".bac") returned 0x0 [0082.306] lstrlenW (lpString=".sys") returned 4 [0082.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".sys") returned 0x0 [0082.307] lstrlenW (lpString=".v2i") returned 4 [0082.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".v2i") returned 0x0 [0082.307] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.316] lstrlenW (lpString=".sql") returned 4 [0082.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".sql") returned 0x0 [0082.316] lstrlenW (lpString=".mdf") returned 4 [0082.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".mdf") returned 0x0 [0082.316] lstrlenW (lpString=".txt") returned 4 [0082.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".txt") returned 0x0 [0082.317] lstrlenW (lpString=".dbf") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".dbf") returned 0x0 [0082.317] lstrlenW (lpString=".ckp") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".ckp") returned 0x0 [0082.317] lstrlenW (lpString=".dacpac") returned 7 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".dacpac") returned 0x0 [0082.317] lstrlenW (lpString=".db3") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".db3") returned 0x0 [0082.317] lstrlenW (lpString=".dtxs") returned 5 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".dtxs") returned 0x0 [0082.317] lstrlenW (lpString=".mdt") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".mdt") returned 0x0 [0082.317] lstrlenW (lpString=".sdf") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".sdf") returned 0x0 [0082.317] lstrlenW (lpString=".MDF") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".MDF") returned 0x0 [0082.317] lstrlenW (lpString=".DBF") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".DBF") returned 0x0 [0082.317] lstrlenW (lpString=".DB") returned 3 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".DB") returned 0x0 [0082.317] lstrlenW (lpString=".db") returned 3 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".db") returned 0x0 [0082.317] lstrlenW (lpString=".ndf") returned 4 [0082.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".ndf") returned 0x0 [0082.317] lstrlenW (lpString=".NDF") returned 4 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".NDF") returned 0x0 [0082.318] lstrlenW (lpString=".Mdf") returned 4 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".Mdf") returned 0x0 [0082.318] lstrlenW (lpString=".dat") returned 4 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".dat") returned 0x0 [0082.318] lstrlenW (lpString=".DAT") returned 4 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".DAT") returned 0x0 [0082.318] lstrlenW (lpString=".ldf") returned 4 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".ldf") returned 0x0 [0082.318] lstrlenW (lpString=".LDF") returned 4 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch=".LDF") returned 0x0 [0082.318] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.318] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2d78) returned 1 [0082.319] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.319] CryptReleaseContext (hProv=0x2d2d78, dwFlags=0x0) returned 1 [0082.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.319] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20232122054) returned 1 [0082.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfe00210, dwHighDateTime=0x1d585b4)) [0082.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338d08 [0082.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338d08 | out: hHeap=0x260000) returned 1 [0082.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.321] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.321] GetLastError () returned 0x0 [0082.321] GetLastError () returned 0x0 [0082.321] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.322] GetLastError () returned 0x0 [0082.322] GetLastError () returned 0x0 [0082.324] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff0688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.324] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf978, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xf978, lpOverlapped=0x0) returned 1 [0082.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.325] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.325] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.325] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.325] CloseHandle (hObject=0xf0) returned 1 [0082.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.325] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.326] GetLastError () returned 0x0 [0082.326] RtlWakeConditionVariable () returned 0x0 [0082.326] GetCurrentThreadId () returned 0x99c [0082.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".ldf") returned 0x0 [0082.327] lstrlenW (lpString=".vhd") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".vhd") returned 0x0 [0082.327] lstrlenW (lpString=".vhdx") returned 5 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".vhdx") returned 0x0 [0082.327] lstrlenW (lpString=".pst") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".pst") returned 0x0 [0082.327] lstrlenW (lpString=".ost") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".ost") returned 0x0 [0082.327] lstrlenW (lpString=".bak") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".bak") returned 0x0 [0082.327] lstrlenW (lpString=".bac") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".bac") returned 0x0 [0082.327] lstrlenW (lpString=".sys") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".sys") returned 0x0 [0082.327] lstrlenW (lpString=".v2i") returned 4 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".v2i") returned 0x0 [0082.327] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.328] lstrlenW (lpString=".sql") returned 4 [0082.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".sql") returned 0x0 [0082.328] lstrlenW (lpString=".mdf") returned 4 [0082.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".mdf") returned 0x0 [0082.328] lstrlenW (lpString=".txt") returned 4 [0082.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".txt") returned 0x0 [0082.328] lstrlenW (lpString=".dbf") returned 4 [0082.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".dbf") returned 0x0 [0082.328] lstrlenW (lpString=".ckp") returned 4 [0082.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".ckp") returned 0x0 [0082.328] lstrlenW (lpString=".dacpac") returned 7 [0082.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".dacpac") returned 0x0 [0082.329] lstrlenW (lpString=".db3") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".db3") returned 0x0 [0082.329] lstrlenW (lpString=".dtxs") returned 5 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".dtxs") returned 0x0 [0082.329] lstrlenW (lpString=".mdt") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".mdt") returned 0x0 [0082.329] lstrlenW (lpString=".sdf") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".sdf") returned 0x0 [0082.329] lstrlenW (lpString=".MDF") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".MDF") returned 0x0 [0082.329] lstrlenW (lpString=".DBF") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".DBF") returned 0x0 [0082.329] lstrlenW (lpString=".DB") returned 3 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".DB") returned 0x0 [0082.329] lstrlenW (lpString=".db") returned 3 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".db") returned 0x0 [0082.329] lstrlenW (lpString=".ndf") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".ndf") returned 0x0 [0082.329] lstrlenW (lpString=".NDF") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".NDF") returned 0x0 [0082.329] lstrlenW (lpString=".Mdf") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".Mdf") returned 0x0 [0082.329] lstrlenW (lpString=".dat") returned 4 [0082.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".dat") returned 0x0 [0082.329] lstrlenW (lpString=".DAT") returned 4 [0082.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".DAT") returned 0x0 [0082.330] lstrlenW (lpString=".ldf") returned 4 [0082.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".ldf") returned 0x0 [0082.330] lstrlenW (lpString=".LDF") returned 4 [0082.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch=".LDF") returned 0x0 [0082.330] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.330] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2e00) returned 1 [0082.331] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.331] CryptReleaseContext (hProv=0x2d2e00, dwFlags=0x0) returned 1 [0082.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.331] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20233198070) returned 1 [0082.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfe26370, dwHighDateTime=0x1d585b4)) [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338d40 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338d40 | out: hHeap=0x260000) returned 1 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.332] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.332] GetLastError () returned 0x0 [0082.332] GetLastError () returned 0x0 [0082.332] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.332] GetLastError () returned 0x0 [0082.332] GetLastError () returned 0x0 [0082.334] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7a98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.335] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x18568, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x18568, lpOverlapped=0x0) returned 1 [0082.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.335] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.335] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.335] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.335] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.335] CloseHandle (hObject=0xf0) returned 1 [0082.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.337] GetLastError () returned 0x0 [0082.337] RtlWakeConditionVariable () returned 0x27e828 [0082.337] GetCurrentThreadId () returned 0x99c [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".ldf") returned 0x0 [0082.337] lstrlenW (lpString=".vhd") returned 4 [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".vhd") returned 0x0 [0082.337] lstrlenW (lpString=".vhdx") returned 5 [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".vhdx") returned 0x0 [0082.337] lstrlenW (lpString=".pst") returned 4 [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".pst") returned 0x0 [0082.337] lstrlenW (lpString=".ost") returned 4 [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".ost") returned 0x0 [0082.337] lstrlenW (lpString=".bak") returned 4 [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".bak") returned 0x0 [0082.337] lstrlenW (lpString=".bac") returned 4 [0082.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".bac") returned 0x0 [0082.337] lstrlenW (lpString=".sys") returned 4 [0082.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".sys") returned 0x0 [0082.338] lstrlenW (lpString=".v2i") returned 4 [0082.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".v2i") returned 0x0 [0082.338] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.339] lstrlenW (lpString=".sql") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".sql") returned 0x0 [0082.339] lstrlenW (lpString=".mdf") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".mdf") returned 0x0 [0082.339] lstrlenW (lpString=".txt") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".txt") returned 0x0 [0082.339] lstrlenW (lpString=".dbf") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".dbf") returned 0x0 [0082.339] lstrlenW (lpString=".ckp") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".ckp") returned 0x0 [0082.339] lstrlenW (lpString=".dacpac") returned 7 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".dacpac") returned 0x0 [0082.339] lstrlenW (lpString=".db3") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".db3") returned 0x0 [0082.339] lstrlenW (lpString=".dtxs") returned 5 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".dtxs") returned 0x0 [0082.339] lstrlenW (lpString=".mdt") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".mdt") returned 0x0 [0082.339] lstrlenW (lpString=".sdf") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".sdf") returned 0x0 [0082.339] lstrlenW (lpString=".MDF") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".MDF") returned 0x0 [0082.339] lstrlenW (lpString=".DBF") returned 4 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".DBF") returned 0x0 [0082.339] lstrlenW (lpString=".DB") returned 3 [0082.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".DB") returned 0x0 [0082.340] lstrlenW (lpString=".db") returned 3 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".db") returned 0x0 [0082.340] lstrlenW (lpString=".ndf") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".ndf") returned 0x0 [0082.340] lstrlenW (lpString=".NDF") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".NDF") returned 0x0 [0082.340] lstrlenW (lpString=".Mdf") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".Mdf") returned 0x0 [0082.340] lstrlenW (lpString=".dat") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".dat") returned 0x0 [0082.340] lstrlenW (lpString=".DAT") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".DAT") returned 0x0 [0082.340] lstrlenW (lpString=".ldf") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".ldf") returned 0x0 [0082.340] lstrlenW (lpString=".LDF") returned 4 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch=".LDF") returned 0x0 [0082.340] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.340] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d2c68) returned 1 [0082.341] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.341] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0082.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.341] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20234242074) returned 1 [0082.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xbfe4c4d0, dwHighDateTime=0x1d585b4)) [0082.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338d78 [0082.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338d78 | out: hHeap=0x260000) returned 1 [0082.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325c28 [0082.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.342] GetLastError () returned 0x0 [0082.342] GetLastError () returned 0x0 [0082.342] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.342] GetLastError () returned 0x0 [0082.343] GetLastError () returned 0x0 [0082.489] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.489] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.492] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.493] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.493] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.493] CloseHandle (hObject=0xf0) returned 1 [0082.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.584] GetLastError () returned 0x0 [0082.584] RtlWakeConditionVariable () returned 0x0 [0082.585] GetCurrentThreadId () returned 0x99c [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".ldf") returned 0x0 [0082.585] lstrlenW (lpString=".vhd") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".vhd") returned 0x0 [0082.585] lstrlenW (lpString=".vhdx") returned 5 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".vhdx") returned 0x0 [0082.585] lstrlenW (lpString=".pst") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".pst") returned 0x0 [0082.585] lstrlenW (lpString=".ost") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".ost") returned 0x0 [0082.585] lstrlenW (lpString=".bak") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".bak") returned 0x0 [0082.585] lstrlenW (lpString=".bac") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".bac") returned 0x0 [0082.585] lstrlenW (lpString=".sys") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".sys") returned 0x0 [0082.585] lstrlenW (lpString=".v2i") returned 4 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".v2i") returned 0x0 [0082.585] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.587] lstrlenW (lpString=".sql") returned 4 [0082.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".sql") returned 0x0 [0082.587] lstrlenW (lpString=".mdf") returned 4 [0082.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".mdf") returned 0x0 [0082.587] lstrlenW (lpString=".txt") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".txt") returned 0x0 [0082.588] lstrlenW (lpString=".dbf") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".dbf") returned 0x0 [0082.588] lstrlenW (lpString=".ckp") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".ckp") returned 0x0 [0082.588] lstrlenW (lpString=".dacpac") returned 7 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".dacpac") returned 0x0 [0082.588] lstrlenW (lpString=".db3") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".db3") returned 0x0 [0082.588] lstrlenW (lpString=".dtxs") returned 5 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".dtxs") returned 0x0 [0082.588] lstrlenW (lpString=".mdt") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".mdt") returned 0x0 [0082.588] lstrlenW (lpString=".sdf") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".sdf") returned 0x0 [0082.588] lstrlenW (lpString=".MDF") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".MDF") returned 0x0 [0082.588] lstrlenW (lpString=".DBF") returned 4 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".DBF") returned 0x0 [0082.588] lstrlenW (lpString=".DB") returned 3 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".DB") returned 0x0 [0082.588] lstrlenW (lpString=".db") returned 3 [0082.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".db") returned 0x0 [0082.589] lstrlenW (lpString=".ndf") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".ndf") returned 0x0 [0082.589] lstrlenW (lpString=".NDF") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".NDF") returned 0x0 [0082.589] lstrlenW (lpString=".Mdf") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".Mdf") returned 0x0 [0082.589] lstrlenW (lpString=".dat") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".dat") returned 0x0 [0082.589] lstrlenW (lpString=".DAT") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".DAT") returned 0x0 [0082.589] lstrlenW (lpString=".ldf") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".ldf") returned 0x0 [0082.589] lstrlenW (lpString=".LDF") returned 4 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch=".LDF") returned 0x0 [0082.589] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.589] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3460) returned 1 [0082.590] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.590] CryptReleaseContext (hProv=0x2d3460, dwFlags=0x0) returned 1 [0082.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.590] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20259138539) returned 1 [0082.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc00adad0, dwHighDateTime=0x1d585b4)) [0082.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27623a8 [0082.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27623a8 | out: hHeap=0x260000) returned 1 [0082.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.591] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.591] GetLastError () returned 0x0 [0082.591] GetLastError () returned 0x0 [0082.591] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.592] GetLastError () returned 0x0 [0082.592] GetLastError () returned 0x0 [0082.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff5278, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.595] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xad88, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xad88, lpOverlapped=0x0) returned 1 [0082.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.595] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.595] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.595] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.596] CloseHandle (hObject=0xf0) returned 1 [0082.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.597] GetLastError () returned 0x0 [0082.597] RtlWakeConditionVariable () returned 0x0 [0082.597] GetCurrentThreadId () returned 0x99c [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".ldf") returned 0x0 [0082.598] lstrlenW (lpString=".vhd") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".vhd") returned 0x0 [0082.598] lstrlenW (lpString=".vhdx") returned 5 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".vhdx") returned 0x0 [0082.598] lstrlenW (lpString=".pst") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".pst") returned 0x0 [0082.598] lstrlenW (lpString=".ost") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".ost") returned 0x0 [0082.598] lstrlenW (lpString=".bak") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".bak") returned 0x0 [0082.598] lstrlenW (lpString=".bac") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".bac") returned 0x0 [0082.598] lstrlenW (lpString=".sys") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".sys") returned 0x0 [0082.598] lstrlenW (lpString=".v2i") returned 4 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".v2i") returned 0x0 [0082.598] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.600] lstrlenW (lpString=".sql") returned 4 [0082.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".sql") returned 0x0 [0082.600] lstrlenW (lpString=".mdf") returned 4 [0082.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".mdf") returned 0x0 [0082.600] lstrlenW (lpString=".txt") returned 4 [0082.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".txt") returned 0x0 [0082.600] lstrlenW (lpString=".dbf") returned 4 [0082.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".dbf") returned 0x0 [0082.600] lstrlenW (lpString=".ckp") returned 4 [0082.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".ckp") returned 0x0 [0082.600] lstrlenW (lpString=".dacpac") returned 7 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".dacpac") returned 0x0 [0082.601] lstrlenW (lpString=".db3") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".db3") returned 0x0 [0082.601] lstrlenW (lpString=".dtxs") returned 5 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".dtxs") returned 0x0 [0082.601] lstrlenW (lpString=".mdt") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".mdt") returned 0x0 [0082.601] lstrlenW (lpString=".sdf") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".sdf") returned 0x0 [0082.601] lstrlenW (lpString=".MDF") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".MDF") returned 0x0 [0082.601] lstrlenW (lpString=".DBF") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".DBF") returned 0x0 [0082.601] lstrlenW (lpString=".DB") returned 3 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".DB") returned 0x0 [0082.601] lstrlenW (lpString=".db") returned 3 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".db") returned 0x0 [0082.601] lstrlenW (lpString=".ndf") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".ndf") returned 0x0 [0082.601] lstrlenW (lpString=".NDF") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".NDF") returned 0x0 [0082.601] lstrlenW (lpString=".Mdf") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".Mdf") returned 0x0 [0082.601] lstrlenW (lpString=".dat") returned 4 [0082.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".dat") returned 0x0 [0082.601] lstrlenW (lpString=".DAT") returned 4 [0082.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".DAT") returned 0x0 [0082.602] lstrlenW (lpString=".ldf") returned 4 [0082.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".ldf") returned 0x0 [0082.602] lstrlenW (lpString=".LDF") returned 4 [0082.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch=".LDF") returned 0x0 [0082.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.602] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3708) returned 1 [0082.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.603] CryptReleaseContext (hProv=0x2d3708, dwFlags=0x0) returned 1 [0082.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.603] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20260404923) returned 1 [0082.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc00d3c30, dwHighDateTime=0x1d585b4)) [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339050 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339050 | out: hHeap=0x260000) returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.604] GetLastError () returned 0x0 [0082.604] GetLastError () returned 0x0 [0082.604] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.604] GetLastError () returned 0x0 [0082.604] GetLastError () returned 0x0 [0082.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.607] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.609] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.609] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.609] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.609] CloseHandle (hObject=0xf0) returned 1 [0082.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.611] GetLastError () returned 0x0 [0082.611] RtlWakeConditionVariable () returned 0x0 [0082.611] GetCurrentThreadId () returned 0x99c [0082.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".ldf") returned 0x0 [0082.611] lstrlenW (lpString=".vhd") returned 4 [0082.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".vhd") returned 0x0 [0082.611] lstrlenW (lpString=".vhdx") returned 5 [0082.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".vhdx") returned 0x0 [0082.611] lstrlenW (lpString=".pst") returned 4 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".pst") returned 0x0 [0082.612] lstrlenW (lpString=".ost") returned 4 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".ost") returned 0x0 [0082.612] lstrlenW (lpString=".bak") returned 4 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".bak") returned 0x0 [0082.612] lstrlenW (lpString=".bac") returned 4 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".bac") returned 0x0 [0082.612] lstrlenW (lpString=".sys") returned 4 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".sys") returned 0x0 [0082.612] lstrlenW (lpString=".v2i") returned 4 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".v2i") returned 0x0 [0082.612] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0082.613] lstrlenW (lpString=".sql") returned 4 [0082.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".sql") returned 0x0 [0082.613] lstrlenW (lpString=".mdf") returned 4 [0082.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".mdf") returned 0x0 [0082.613] lstrlenW (lpString=".txt") returned 4 [0082.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".txt") returned 0x0 [0082.613] lstrlenW (lpString=".dbf") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".dbf") returned 0x0 [0082.614] lstrlenW (lpString=".ckp") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".ckp") returned 0x0 [0082.614] lstrlenW (lpString=".dacpac") returned 7 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".dacpac") returned 0x0 [0082.614] lstrlenW (lpString=".db3") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".db3") returned 0x0 [0082.614] lstrlenW (lpString=".dtxs") returned 5 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".dtxs") returned 0x0 [0082.614] lstrlenW (lpString=".mdt") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".mdt") returned 0x0 [0082.614] lstrlenW (lpString=".sdf") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".sdf") returned 0x0 [0082.614] lstrlenW (lpString=".MDF") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".MDF") returned 0x0 [0082.614] lstrlenW (lpString=".DBF") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".DBF") returned 0x0 [0082.614] lstrlenW (lpString=".DB") returned 3 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".DB") returned 0x0 [0082.614] lstrlenW (lpString=".db") returned 3 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".db") returned 0x0 [0082.614] lstrlenW (lpString=".ndf") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".ndf") returned 0x0 [0082.614] lstrlenW (lpString=".NDF") returned 4 [0082.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".NDF") returned 0x0 [0082.614] lstrlenW (lpString=".Mdf") returned 4 [0082.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".Mdf") returned 0x0 [0082.615] lstrlenW (lpString=".dat") returned 4 [0082.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".dat") returned 0x0 [0082.615] lstrlenW (lpString=".DAT") returned 4 [0082.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".DAT") returned 0x0 [0082.615] lstrlenW (lpString=".ldf") returned 4 [0082.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".ldf") returned 0x0 [0082.615] lstrlenW (lpString=".LDF") returned 4 [0082.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch=".LDF") returned 0x0 [0082.615] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.615] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3790) returned 1 [0082.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.616] CryptReleaseContext (hProv=0x2d3790, dwFlags=0x0) returned 1 [0082.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.616] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20261713195) returned 1 [0082.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc00d3c30, dwHighDateTime=0x1d585b4)) [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339088 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339088 | out: hHeap=0x260000) returned 1 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0082.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.617] GetLastError () returned 0x0 [0082.617] GetLastError () returned 0x0 [0082.617] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.617] GetLastError () returned 0x0 [0082.617] GetLastError () returned 0x0 [0082.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.697] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.700] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.700] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.700] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.700] CloseHandle (hObject=0xf0) returned 1 [0082.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.702] GetLastError () returned 0x0 [0082.702] RtlWakeConditionVariable () returned 0x0 [0082.702] GetCurrentThreadId () returned 0x99c [0082.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".ldf") returned 0x0 [0082.702] lstrlenW (lpString=".vhd") returned 4 [0082.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".vhd") returned 0x0 [0082.702] lstrlenW (lpString=".vhdx") returned 5 [0082.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".vhdx") returned 0x0 [0082.702] lstrlenW (lpString=".pst") returned 4 [0082.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".pst") returned 0x0 [0082.702] lstrlenW (lpString=".ost") returned 4 [0082.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".ost") returned 0x0 [0082.703] lstrlenW (lpString=".bak") returned 4 [0082.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".bak") returned 0x0 [0082.703] lstrlenW (lpString=".bac") returned 4 [0082.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".bac") returned 0x0 [0082.703] lstrlenW (lpString=".sys") returned 4 [0082.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".sys") returned 0x0 [0082.703] lstrlenW (lpString=".v2i") returned 4 [0082.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".v2i") returned 0x0 [0082.703] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch="s\r\n.v2i") returned 0x0 [0082.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.729] lstrlenW (lpString=".sql") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".sql") returned 0x0 [0082.729] lstrlenW (lpString=".mdf") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".mdf") returned 0x0 [0082.729] lstrlenW (lpString=".txt") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".txt") returned 0x0 [0082.729] lstrlenW (lpString=".dbf") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".dbf") returned 0x0 [0082.729] lstrlenW (lpString=".ckp") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".ckp") returned 0x0 [0082.729] lstrlenW (lpString=".dacpac") returned 7 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".dacpac") returned 0x0 [0082.729] lstrlenW (lpString=".db3") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".db3") returned 0x0 [0082.729] lstrlenW (lpString=".dtxs") returned 5 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".dtxs") returned 0x0 [0082.729] lstrlenW (lpString=".mdt") returned 4 [0082.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".mdt") returned 0x0 [0082.729] lstrlenW (lpString=".sdf") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".sdf") returned 0x0 [0082.730] lstrlenW (lpString=".MDF") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".MDF") returned 0x0 [0082.730] lstrlenW (lpString=".DBF") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".DBF") returned 0x0 [0082.730] lstrlenW (lpString=".DB") returned 3 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".DB") returned 0x0 [0082.730] lstrlenW (lpString=".db") returned 3 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".db") returned 0x0 [0082.730] lstrlenW (lpString=".ndf") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".ndf") returned 0x0 [0082.730] lstrlenW (lpString=".NDF") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".NDF") returned 0x0 [0082.730] lstrlenW (lpString=".Mdf") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".Mdf") returned 0x0 [0082.730] lstrlenW (lpString=".dat") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".dat") returned 0x0 [0082.730] lstrlenW (lpString=".DAT") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".DAT") returned 0x0 [0082.730] lstrlenW (lpString=".ldf") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".ldf") returned 0x0 [0082.730] lstrlenW (lpString=".LDF") returned 4 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch=".LDF") returned 0x0 [0082.730] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.731] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3570) returned 1 [0082.731] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.731] CryptReleaseContext (hProv=0x2d3570, dwFlags=0x0) returned 1 [0082.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.732] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20273280822) returned 1 [0082.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0204730, dwHighDateTime=0x1d585b4)) [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3391d8 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3391d8 | out: hHeap=0x260000) returned 1 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764488 [0082.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.732] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.733] GetLastError () returned 0x0 [0082.733] GetLastError () returned 0x0 [0082.733] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.733] GetLastError () returned 0x0 [0082.733] GetLastError () returned 0x0 [0082.747] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff0c80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.747] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf380, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xf380, lpOverlapped=0x0) returned 1 [0082.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.748] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.748] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.748] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.748] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.748] CloseHandle (hObject=0xd8) returned 1 [0082.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.748] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.750] GetLastError () returned 0x0 [0082.750] RtlWakeConditionVariable () returned 0x27e828 [0082.750] GetCurrentThreadId () returned 0x99c [0082.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".ldf") returned 0x0 [0082.750] lstrlenW (lpString=".vhd") returned 4 [0082.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".vhd") returned 0x0 [0082.750] lstrlenW (lpString=".vhdx") returned 5 [0082.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".vhdx") returned 0x0 [0082.751] lstrlenW (lpString=".pst") returned 4 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".pst") returned 0x0 [0082.751] lstrlenW (lpString=".ost") returned 4 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".ost") returned 0x0 [0082.751] lstrlenW (lpString=".bak") returned 4 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".bak") returned 0x0 [0082.751] lstrlenW (lpString=".bac") returned 4 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".bac") returned 0x0 [0082.751] lstrlenW (lpString=".sys") returned 4 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".sys") returned 0x0 [0082.751] lstrlenW (lpString=".v2i") returned 4 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".v2i") returned 0x0 [0082.751] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.752] lstrlenW (lpString=".sql") returned 4 [0082.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".sql") returned 0x0 [0082.752] lstrlenW (lpString=".mdf") returned 4 [0082.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".mdf") returned 0x0 [0082.752] lstrlenW (lpString=".txt") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".txt") returned 0x0 [0082.753] lstrlenW (lpString=".dbf") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".dbf") returned 0x0 [0082.753] lstrlenW (lpString=".ckp") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".ckp") returned 0x0 [0082.753] lstrlenW (lpString=".dacpac") returned 7 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".dacpac") returned 0x0 [0082.753] lstrlenW (lpString=".db3") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".db3") returned 0x0 [0082.753] lstrlenW (lpString=".dtxs") returned 5 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".dtxs") returned 0x0 [0082.753] lstrlenW (lpString=".mdt") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".mdt") returned 0x0 [0082.753] lstrlenW (lpString=".sdf") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".sdf") returned 0x0 [0082.753] lstrlenW (lpString=".MDF") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".MDF") returned 0x0 [0082.753] lstrlenW (lpString=".DBF") returned 4 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".DBF") returned 0x0 [0082.753] lstrlenW (lpString=".DB") returned 3 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".DB") returned 0x0 [0082.753] lstrlenW (lpString=".db") returned 3 [0082.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".db") returned 0x0 [0082.753] lstrlenW (lpString=".ndf") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".ndf") returned 0x0 [0082.754] lstrlenW (lpString=".NDF") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".NDF") returned 0x0 [0082.754] lstrlenW (lpString=".Mdf") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".Mdf") returned 0x0 [0082.754] lstrlenW (lpString=".dat") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".dat") returned 0x0 [0082.754] lstrlenW (lpString=".DAT") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".DAT") returned 0x0 [0082.754] lstrlenW (lpString=".ldf") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".ldf") returned 0x0 [0082.754] lstrlenW (lpString=".LDF") returned 4 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch=".LDF") returned 0x0 [0082.754] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.754] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3570) returned 1 [0082.755] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.755] CryptReleaseContext (hProv=0x2d3570, dwFlags=0x0) returned 1 [0082.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.755] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20275640083) returned 1 [0082.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc022a890, dwHighDateTime=0x1d585b4)) [0082.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339248 [0082.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339248 | out: hHeap=0x260000) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.756] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.756] GetLastError () returned 0x0 [0082.756] GetLastError () returned 0x0 [0082.756] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.757] GetLastError () returned 0x0 [0082.757] GetLastError () returned 0x0 [0082.763] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.763] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.764] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.764] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.764] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.764] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.764] CloseHandle (hObject=0xd8) returned 1 [0082.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0082.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0082.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.767] GetLastError () returned 0x0 [0082.767] RtlWakeConditionVariable () returned 0x0 [0082.767] GetCurrentThreadId () returned 0x99c [0082.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".ldf") returned 0x0 [0082.767] lstrlenW (lpString=".vhd") returned 4 [0082.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".vhd") returned 0x0 [0082.767] lstrlenW (lpString=".vhdx") returned 5 [0082.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".vhdx") returned 0x0 [0082.767] lstrlenW (lpString=".pst") returned 4 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".pst") returned 0x0 [0082.768] lstrlenW (lpString=".ost") returned 4 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".ost") returned 0x0 [0082.768] lstrlenW (lpString=".bak") returned 4 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".bak") returned 0x0 [0082.768] lstrlenW (lpString=".bac") returned 4 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".bac") returned 0x0 [0082.768] lstrlenW (lpString=".sys") returned 4 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".sys") returned 0x0 [0082.768] lstrlenW (lpString=".v2i") returned 4 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".v2i") returned 0x0 [0082.768] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch="s\r\n.v2i") returned 0x0 [0082.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.770] lstrlenW (lpString=".sql") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".sql") returned 0x0 [0082.770] lstrlenW (lpString=".mdf") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".mdf") returned 0x0 [0082.770] lstrlenW (lpString=".txt") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".txt") returned 0x0 [0082.770] lstrlenW (lpString=".dbf") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".dbf") returned 0x0 [0082.770] lstrlenW (lpString=".ckp") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".ckp") returned 0x0 [0082.770] lstrlenW (lpString=".dacpac") returned 7 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".dacpac") returned 0x0 [0082.770] lstrlenW (lpString=".db3") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".db3") returned 0x0 [0082.770] lstrlenW (lpString=".dtxs") returned 5 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".dtxs") returned 0x0 [0082.770] lstrlenW (lpString=".mdt") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".mdt") returned 0x0 [0082.770] lstrlenW (lpString=".sdf") returned 4 [0082.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".sdf") returned 0x0 [0082.770] lstrlenW (lpString=".MDF") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".MDF") returned 0x0 [0082.771] lstrlenW (lpString=".DBF") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".DBF") returned 0x0 [0082.771] lstrlenW (lpString=".DB") returned 3 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".DB") returned 0x0 [0082.771] lstrlenW (lpString=".db") returned 3 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".db") returned 0x0 [0082.771] lstrlenW (lpString=".ndf") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".ndf") returned 0x0 [0082.771] lstrlenW (lpString=".NDF") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".NDF") returned 0x0 [0082.771] lstrlenW (lpString=".Mdf") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".Mdf") returned 0x0 [0082.771] lstrlenW (lpString=".dat") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".dat") returned 0x0 [0082.771] lstrlenW (lpString=".DAT") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".DAT") returned 0x0 [0082.771] lstrlenW (lpString=".ldf") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".ldf") returned 0x0 [0082.771] lstrlenW (lpString=".LDF") returned 4 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch=".LDF") returned 0x0 [0082.771] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.772] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3bd0) returned 1 [0082.772] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.772] CryptReleaseContext (hProv=0x2d3bd0, dwFlags=0x0) returned 1 [0082.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.773] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20277376139) returned 1 [0082.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc02509f0, dwHighDateTime=0x1d585b4)) [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339280 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339280 | out: hHeap=0x260000) returned 1 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.773] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.774] GetLastError () returned 0x0 [0082.829] GetLastError () returned 0x0 [0082.842] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.852] GetLastError () returned 0x0 [0082.852] GetLastError () returned 0x0 [0082.854] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffeb060, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.854] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x14fa0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x14fa0, lpOverlapped=0x0) returned 1 [0082.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.855] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.855] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.855] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.855] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.855] CloseHandle (hObject=0xd8) returned 1 [0082.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.[deadmin@cock.li].deadmin")) returned 1 [0082.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.858] GetLastError () returned 0x0 [0082.858] RtlWakeConditionVariable () returned 0x0 [0082.858] GetCurrentThreadId () returned 0x99c [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".ldf") returned 0x0 [0082.858] lstrlenW (lpString=".vhd") returned 4 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".vhd") returned 0x0 [0082.858] lstrlenW (lpString=".vhdx") returned 5 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".vhdx") returned 0x0 [0082.858] lstrlenW (lpString=".pst") returned 4 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".pst") returned 0x0 [0082.858] lstrlenW (lpString=".ost") returned 4 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".ost") returned 0x0 [0082.858] lstrlenW (lpString=".bak") returned 4 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".bak") returned 0x0 [0082.858] lstrlenW (lpString=".bac") returned 4 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".bac") returned 0x0 [0082.858] lstrlenW (lpString=".sys") returned 4 [0082.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".sys") returned 0x0 [0082.859] lstrlenW (lpString=".v2i") returned 4 [0082.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".v2i") returned 0x0 [0082.859] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.860] lstrlenW (lpString=".sql") returned 4 [0082.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".sql") returned 0x0 [0082.861] lstrlenW (lpString=".mdf") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".mdf") returned 0x0 [0082.861] lstrlenW (lpString=".txt") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".txt") returned 0x0 [0082.861] lstrlenW (lpString=".dbf") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".dbf") returned 0x0 [0082.861] lstrlenW (lpString=".ckp") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".ckp") returned 0x0 [0082.861] lstrlenW (lpString=".dacpac") returned 7 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".dacpac") returned 0x0 [0082.861] lstrlenW (lpString=".db3") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".db3") returned 0x0 [0082.861] lstrlenW (lpString=".dtxs") returned 5 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".dtxs") returned 0x0 [0082.861] lstrlenW (lpString=".mdt") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".mdt") returned 0x0 [0082.861] lstrlenW (lpString=".sdf") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".sdf") returned 0x0 [0082.861] lstrlenW (lpString=".MDF") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".MDF") returned 0x0 [0082.861] lstrlenW (lpString=".DBF") returned 4 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".DBF") returned 0x0 [0082.861] lstrlenW (lpString=".DB") returned 3 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".DB") returned 0x0 [0082.861] lstrlenW (lpString=".db") returned 3 [0082.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".db") returned 0x0 [0082.862] lstrlenW (lpString=".ndf") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".ndf") returned 0x0 [0082.862] lstrlenW (lpString=".NDF") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".NDF") returned 0x0 [0082.862] lstrlenW (lpString=".Mdf") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".Mdf") returned 0x0 [0082.862] lstrlenW (lpString=".dat") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".dat") returned 0x0 [0082.862] lstrlenW (lpString=".DAT") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".DAT") returned 0x0 [0082.862] lstrlenW (lpString=".ldf") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".ldf") returned 0x0 [0082.862] lstrlenW (lpString=".LDF") returned 4 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch=".LDF") returned 0x0 [0082.862] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.862] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3c58) returned 1 [0082.863] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.863] CryptReleaseContext (hProv=0x2d3c58, dwFlags=0x0) returned 1 [0082.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.863] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20286441395) returned 1 [0082.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0335230, dwHighDateTime=0x1d585b4)) [0082.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339440 [0082.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339440 | out: hHeap=0x260000) returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.864] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.864] GetLastError () returned 0x0 [0082.864] GetLastError () returned 0x0 [0082.864] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.865] GetLastError () returned 0x0 [0082.865] GetLastError () returned 0x0 [0082.869] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.869] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.870] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.870] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.872] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.872] CloseHandle (hObject=0xd8) returned 1 [0082.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.872] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.873] GetLastError () returned 0x0 [0082.874] RtlWakeConditionVariable () returned 0x0 [0082.874] GetCurrentThreadId () returned 0x99c [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".ldf") returned 0x0 [0082.874] lstrlenW (lpString=".vhd") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".vhd") returned 0x0 [0082.874] lstrlenW (lpString=".vhdx") returned 5 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".vhdx") returned 0x0 [0082.874] lstrlenW (lpString=".pst") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".pst") returned 0x0 [0082.874] lstrlenW (lpString=".ost") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".ost") returned 0x0 [0082.874] lstrlenW (lpString=".bak") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".bak") returned 0x0 [0082.874] lstrlenW (lpString=".bac") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".bac") returned 0x0 [0082.874] lstrlenW (lpString=".sys") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".sys") returned 0x0 [0082.874] lstrlenW (lpString=".v2i") returned 4 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".v2i") returned 0x0 [0082.874] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.876] lstrlenW (lpString=".sql") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".sql") returned 0x0 [0082.876] lstrlenW (lpString=".mdf") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".mdf") returned 0x0 [0082.876] lstrlenW (lpString=".txt") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".txt") returned 0x0 [0082.876] lstrlenW (lpString=".dbf") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".dbf") returned 0x0 [0082.876] lstrlenW (lpString=".ckp") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".ckp") returned 0x0 [0082.876] lstrlenW (lpString=".dacpac") returned 7 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".dacpac") returned 0x0 [0082.876] lstrlenW (lpString=".db3") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".db3") returned 0x0 [0082.876] lstrlenW (lpString=".dtxs") returned 5 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".dtxs") returned 0x0 [0082.876] lstrlenW (lpString=".mdt") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".mdt") returned 0x0 [0082.876] lstrlenW (lpString=".sdf") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".sdf") returned 0x0 [0082.876] lstrlenW (lpString=".MDF") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".MDF") returned 0x0 [0082.876] lstrlenW (lpString=".DBF") returned 4 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".DBF") returned 0x0 [0082.876] lstrlenW (lpString=".DB") returned 3 [0082.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".DB") returned 0x0 [0082.877] lstrlenW (lpString=".db") returned 3 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".db") returned 0x0 [0082.877] lstrlenW (lpString=".ndf") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".ndf") returned 0x0 [0082.877] lstrlenW (lpString=".NDF") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".NDF") returned 0x0 [0082.877] lstrlenW (lpString=".Mdf") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".Mdf") returned 0x0 [0082.877] lstrlenW (lpString=".dat") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".dat") returned 0x0 [0082.877] lstrlenW (lpString=".DAT") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".DAT") returned 0x0 [0082.877] lstrlenW (lpString=".ldf") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".ldf") returned 0x0 [0082.877] lstrlenW (lpString=".LDF") returned 4 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch=".LDF") returned 0x0 [0082.877] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.877] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d4010) returned 1 [0082.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.878] CryptReleaseContext (hProv=0x2d4010, dwFlags=0x0) returned 1 [0082.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.878] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20287943450) returned 1 [0082.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0419a70, dwHighDateTime=0x1d585b4)) [0082.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339558 [0082.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339558 | out: hHeap=0x260000) returned 1 [0082.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0082.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.980] GetLastError () returned 0x0 [0082.980] GetLastError () returned 0x0 [0082.980] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.981] GetLastError () returned 0x0 [0082.981] GetLastError () returned 0x0 [0082.985] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.985] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.986] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.986] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.988] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.988] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.988] CloseHandle (hObject=0xd8) returned 1 [0082.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.989] GetLastError () returned 0x0 [0082.990] RtlWakeConditionVariable () returned 0x0 [0082.990] GetCurrentThreadId () returned 0x99c [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".ldf") returned 0x0 [0082.990] lstrlenW (lpString=".vhd") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".vhd") returned 0x0 [0082.990] lstrlenW (lpString=".vhdx") returned 5 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".vhdx") returned 0x0 [0082.990] lstrlenW (lpString=".pst") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".pst") returned 0x0 [0082.990] lstrlenW (lpString=".ost") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".ost") returned 0x0 [0082.990] lstrlenW (lpString=".bak") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".bak") returned 0x0 [0082.990] lstrlenW (lpString=".bac") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".bac") returned 0x0 [0082.990] lstrlenW (lpString=".sys") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".sys") returned 0x0 [0082.990] lstrlenW (lpString=".v2i") returned 4 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".v2i") returned 0x0 [0082.990] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0082.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0082.991] lstrlenW (lpString=".sql") returned 4 [0082.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".sql") returned 0x0 [0082.991] lstrlenW (lpString=".mdf") returned 4 [0082.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".mdf") returned 0x0 [0082.992] lstrlenW (lpString=".txt") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".txt") returned 0x0 [0082.992] lstrlenW (lpString=".dbf") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".dbf") returned 0x0 [0082.992] lstrlenW (lpString=".ckp") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".ckp") returned 0x0 [0082.992] lstrlenW (lpString=".dacpac") returned 7 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".dacpac") returned 0x0 [0082.992] lstrlenW (lpString=".db3") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".db3") returned 0x0 [0082.992] lstrlenW (lpString=".dtxs") returned 5 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".dtxs") returned 0x0 [0082.992] lstrlenW (lpString=".mdt") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".mdt") returned 0x0 [0082.992] lstrlenW (lpString=".sdf") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".sdf") returned 0x0 [0082.992] lstrlenW (lpString=".MDF") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".MDF") returned 0x0 [0082.992] lstrlenW (lpString=".DBF") returned 4 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".DBF") returned 0x0 [0082.992] lstrlenW (lpString=".DB") returned 3 [0082.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".DB") returned 0x0 [0082.993] lstrlenW (lpString=".db") returned 3 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".db") returned 0x0 [0082.993] lstrlenW (lpString=".ndf") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".ndf") returned 0x0 [0082.993] lstrlenW (lpString=".NDF") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".NDF") returned 0x0 [0082.993] lstrlenW (lpString=".Mdf") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".Mdf") returned 0x0 [0082.993] lstrlenW (lpString=".dat") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".dat") returned 0x0 [0082.993] lstrlenW (lpString=".DAT") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".DAT") returned 0x0 [0082.993] lstrlenW (lpString=".ldf") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".ldf") returned 0x0 [0082.993] lstrlenW (lpString=".LDF") returned 4 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch=".LDF") returned 0x0 [0082.993] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.993] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3ac0) returned 1 [0082.994] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.994] CryptReleaseContext (hProv=0x2d3ac0, dwFlags=0x0) returned 1 [0082.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.994] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20299542170) returned 1 [0082.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc048be90, dwHighDateTime=0x1d585b4)) [0082.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339590 [0082.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339590 | out: hHeap=0x260000) returned 1 [0082.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764fd0 [0082.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.995] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0082.995] GetLastError () returned 0x0 [0082.995] GetLastError () returned 0x0 [0082.995] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0082.996] GetLastError () returned 0x0 [0082.996] GetLastError () returned 0x0 [0082.997] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.997] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0082.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0082.998] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.998] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.998] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.998] CloseHandle (hObject=0xd8) returned 1 [0082.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.[deadmin@cock.li].deadmin")) returned 1 [0082.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.000] GetLastError () returned 0x0 [0083.000] RtlWakeConditionVariable () returned 0x0 [0083.000] GetCurrentThreadId () returned 0x99c [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".ldf") returned 0x0 [0083.000] lstrlenW (lpString=".vhd") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".vhd") returned 0x0 [0083.000] lstrlenW (lpString=".vhdx") returned 5 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".vhdx") returned 0x0 [0083.000] lstrlenW (lpString=".pst") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".pst") returned 0x0 [0083.000] lstrlenW (lpString=".ost") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".ost") returned 0x0 [0083.000] lstrlenW (lpString=".bak") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".bak") returned 0x0 [0083.000] lstrlenW (lpString=".bac") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".bac") returned 0x0 [0083.000] lstrlenW (lpString=".sys") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".sys") returned 0x0 [0083.000] lstrlenW (lpString=".v2i") returned 4 [0083.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".v2i") returned 0x0 [0083.000] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.001] lstrlenW (lpString=".sql") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".sql") returned 0x0 [0083.002] lstrlenW (lpString=".mdf") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".mdf") returned 0x0 [0083.002] lstrlenW (lpString=".txt") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".txt") returned 0x0 [0083.002] lstrlenW (lpString=".dbf") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".dbf") returned 0x0 [0083.002] lstrlenW (lpString=".ckp") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".ckp") returned 0x0 [0083.002] lstrlenW (lpString=".dacpac") returned 7 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".dacpac") returned 0x0 [0083.002] lstrlenW (lpString=".db3") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".db3") returned 0x0 [0083.002] lstrlenW (lpString=".dtxs") returned 5 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".dtxs") returned 0x0 [0083.002] lstrlenW (lpString=".mdt") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".mdt") returned 0x0 [0083.002] lstrlenW (lpString=".sdf") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".sdf") returned 0x0 [0083.002] lstrlenW (lpString=".MDF") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".MDF") returned 0x0 [0083.002] lstrlenW (lpString=".DBF") returned 4 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".DBF") returned 0x0 [0083.002] lstrlenW (lpString=".DB") returned 3 [0083.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".DB") returned 0x0 [0083.002] lstrlenW (lpString=".db") returned 3 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".db") returned 0x0 [0083.003] lstrlenW (lpString=".ndf") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".ndf") returned 0x0 [0083.003] lstrlenW (lpString=".NDF") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".NDF") returned 0x0 [0083.003] lstrlenW (lpString=".Mdf") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".Mdf") returned 0x0 [0083.003] lstrlenW (lpString=".dat") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".dat") returned 0x0 [0083.003] lstrlenW (lpString=".DAT") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".DAT") returned 0x0 [0083.003] lstrlenW (lpString=".ldf") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".ldf") returned 0x0 [0083.003] lstrlenW (lpString=".LDF") returned 4 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch=".LDF") returned 0x0 [0083.003] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.003] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3ac0) returned 1 [0083.004] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.004] CryptReleaseContext (hProv=0x2d3ac0, dwFlags=0x0) returned 1 [0083.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.004] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20300561411) returned 1 [0083.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc048be90, dwHighDateTime=0x1d585b4)) [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3395c8 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3395c8 | out: hHeap=0x260000) returned 1 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27652c8 [0083.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.005] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.005] GetLastError () returned 0x0 [0083.006] GetLastError () returned 0x0 [0083.006] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.006] GetLastError () returned 0x0 [0083.006] GetLastError () returned 0x0 [0083.007] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffec0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.007] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x140, lpOverlapped=0x0) returned 1 [0083.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.007] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.007] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.007] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.007] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.008] CloseHandle (hObject=0xd8) returned 1 [0083.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.009] GetLastError () returned 0x0 [0083.009] RtlWakeConditionVariable () returned 0x27e828 [0083.009] GetCurrentThreadId () returned 0x99c [0083.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".ldf") returned 0x0 [0083.009] lstrlenW (lpString=".vhd") returned 4 [0083.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".vhd") returned 0x0 [0083.009] lstrlenW (lpString=".vhdx") returned 5 [0083.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".vhdx") returned 0x0 [0083.010] lstrlenW (lpString=".pst") returned 4 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".pst") returned 0x0 [0083.010] lstrlenW (lpString=".ost") returned 4 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".ost") returned 0x0 [0083.010] lstrlenW (lpString=".bak") returned 4 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".bak") returned 0x0 [0083.010] lstrlenW (lpString=".bac") returned 4 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".bac") returned 0x0 [0083.010] lstrlenW (lpString=".sys") returned 4 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".sys") returned 0x0 [0083.010] lstrlenW (lpString=".v2i") returned 4 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".v2i") returned 0x0 [0083.010] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.011] lstrlenW (lpString=".sql") returned 4 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".sql") returned 0x0 [0083.011] lstrlenW (lpString=".mdf") returned 4 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".mdf") returned 0x0 [0083.011] lstrlenW (lpString=".txt") returned 4 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".txt") returned 0x0 [0083.011] lstrlenW (lpString=".dbf") returned 4 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".dbf") returned 0x0 [0083.011] lstrlenW (lpString=".ckp") returned 4 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".ckp") returned 0x0 [0083.011] lstrlenW (lpString=".dacpac") returned 7 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".dacpac") returned 0x0 [0083.011] lstrlenW (lpString=".db3") returned 4 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".db3") returned 0x0 [0083.011] lstrlenW (lpString=".dtxs") returned 5 [0083.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".dtxs") returned 0x0 [0083.012] lstrlenW (lpString=".mdt") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".mdt") returned 0x0 [0083.012] lstrlenW (lpString=".sdf") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".sdf") returned 0x0 [0083.012] lstrlenW (lpString=".MDF") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".MDF") returned 0x0 [0083.012] lstrlenW (lpString=".DBF") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".DBF") returned 0x0 [0083.012] lstrlenW (lpString=".DB") returned 3 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".DB") returned 0x0 [0083.012] lstrlenW (lpString=".db") returned 3 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".db") returned 0x0 [0083.012] lstrlenW (lpString=".ndf") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".ndf") returned 0x0 [0083.012] lstrlenW (lpString=".NDF") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".NDF") returned 0x0 [0083.012] lstrlenW (lpString=".Mdf") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".Mdf") returned 0x0 [0083.012] lstrlenW (lpString=".dat") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".dat") returned 0x0 [0083.012] lstrlenW (lpString=".DAT") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".DAT") returned 0x0 [0083.012] lstrlenW (lpString=".ldf") returned 4 [0083.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".ldf") returned 0x0 [0083.012] lstrlenW (lpString=".LDF") returned 4 [0083.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch=".LDF") returned 0x0 [0083.013] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.013] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3ac0) returned 1 [0083.013] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.014] CryptReleaseContext (hProv=0x2d3ac0, dwFlags=0x0) returned 1 [0083.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.014] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20301482960) returned 1 [0083.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc04b1ff0, dwHighDateTime=0x1d585b4)) [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339600 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339600 | out: hHeap=0x260000) returned 1 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0083.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.014] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.015] GetLastError () returned 0x0 [0083.015] GetLastError () returned 0x0 [0083.015] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.015] GetLastError () returned 0x0 [0083.015] GetLastError () returned 0x0 [0083.083] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.083] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.085] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.086] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.086] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.086] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.086] CloseHandle (hObject=0xd8) returned 1 [0083.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.106] GetLastError () returned 0x0 [0083.106] RtlWakeConditionVariable () returned 0x0 [0083.106] GetCurrentThreadId () returned 0x99c [0083.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".ldf") returned 0x0 [0083.107] lstrlenW (lpString=".vhd") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".vhd") returned 0x0 [0083.107] lstrlenW (lpString=".vhdx") returned 5 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".vhdx") returned 0x0 [0083.107] lstrlenW (lpString=".pst") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".pst") returned 0x0 [0083.107] lstrlenW (lpString=".ost") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".ost") returned 0x0 [0083.107] lstrlenW (lpString=".bak") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".bak") returned 0x0 [0083.107] lstrlenW (lpString=".bac") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".bac") returned 0x0 [0083.107] lstrlenW (lpString=".sys") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".sys") returned 0x0 [0083.107] lstrlenW (lpString=".v2i") returned 4 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".v2i") returned 0x0 [0083.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.109] lstrlenW (lpString=".sql") returned 4 [0083.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".sql") returned 0x0 [0083.109] lstrlenW (lpString=".mdf") returned 4 [0083.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".mdf") returned 0x0 [0083.109] lstrlenW (lpString=".txt") returned 4 [0083.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".txt") returned 0x0 [0083.110] lstrlenW (lpString=".dbf") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".dbf") returned 0x0 [0083.110] lstrlenW (lpString=".ckp") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".ckp") returned 0x0 [0083.110] lstrlenW (lpString=".dacpac") returned 7 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".dacpac") returned 0x0 [0083.110] lstrlenW (lpString=".db3") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".db3") returned 0x0 [0083.110] lstrlenW (lpString=".dtxs") returned 5 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".dtxs") returned 0x0 [0083.110] lstrlenW (lpString=".mdt") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".mdt") returned 0x0 [0083.110] lstrlenW (lpString=".sdf") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".sdf") returned 0x0 [0083.110] lstrlenW (lpString=".MDF") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".MDF") returned 0x0 [0083.110] lstrlenW (lpString=".DBF") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".DBF") returned 0x0 [0083.110] lstrlenW (lpString=".DB") returned 3 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".DB") returned 0x0 [0083.110] lstrlenW (lpString=".db") returned 3 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".db") returned 0x0 [0083.110] lstrlenW (lpString=".ndf") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".ndf") returned 0x0 [0083.110] lstrlenW (lpString=".NDF") returned 4 [0083.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".NDF") returned 0x0 [0083.111] lstrlenW (lpString=".Mdf") returned 4 [0083.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".Mdf") returned 0x0 [0083.111] lstrlenW (lpString=".dat") returned 4 [0083.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".dat") returned 0x0 [0083.111] lstrlenW (lpString=".DAT") returned 4 [0083.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".DAT") returned 0x0 [0083.111] lstrlenW (lpString=".ldf") returned 4 [0083.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".ldf") returned 0x0 [0083.111] lstrlenW (lpString=".LDF") returned 4 [0083.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch=".LDF") returned 0x0 [0083.111] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.111] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.112] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.112] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.112] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20311325902) returned 1 [0083.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0596830, dwHighDateTime=0x1d585b4)) [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339670 [0083.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339670 | out: hHeap=0x260000) returned 1 [0083.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765198 [0083.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.113] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.113] GetLastError () returned 0x0 [0083.113] GetLastError () returned 0x0 [0083.113] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.113] GetLastError () returned 0x0 [0083.114] GetLastError () returned 0x0 [0083.118] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.121] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.121] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.121] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.121] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.121] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.121] CloseHandle (hObject=0xd8) returned 1 [0083.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0083.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0083.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.126] GetLastError () returned 0x0 [0083.126] RtlWakeConditionVariable () returned 0x0 [0083.127] GetCurrentThreadId () returned 0x99c [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".ldf") returned 0x0 [0083.127] lstrlenW (lpString=".vhd") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".vhd") returned 0x0 [0083.127] lstrlenW (lpString=".vhdx") returned 5 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".vhdx") returned 0x0 [0083.127] lstrlenW (lpString=".pst") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".pst") returned 0x0 [0083.127] lstrlenW (lpString=".ost") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".ost") returned 0x0 [0083.127] lstrlenW (lpString=".bak") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".bak") returned 0x0 [0083.127] lstrlenW (lpString=".bac") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".bac") returned 0x0 [0083.127] lstrlenW (lpString=".sys") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".sys") returned 0x0 [0083.127] lstrlenW (lpString=".v2i") returned 4 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".v2i") returned 0x0 [0083.127] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.129] lstrlenW (lpString=".sql") returned 4 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".sql") returned 0x0 [0083.129] lstrlenW (lpString=".mdf") returned 4 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".mdf") returned 0x0 [0083.129] lstrlenW (lpString=".txt") returned 4 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".txt") returned 0x0 [0083.129] lstrlenW (lpString=".dbf") returned 4 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".dbf") returned 0x0 [0083.129] lstrlenW (lpString=".ckp") returned 4 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".ckp") returned 0x0 [0083.129] lstrlenW (lpString=".dacpac") returned 7 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".dacpac") returned 0x0 [0083.129] lstrlenW (lpString=".db3") returned 4 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".db3") returned 0x0 [0083.129] lstrlenW (lpString=".dtxs") returned 5 [0083.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".dtxs") returned 0x0 [0083.130] lstrlenW (lpString=".mdt") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".mdt") returned 0x0 [0083.130] lstrlenW (lpString=".sdf") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".sdf") returned 0x0 [0083.130] lstrlenW (lpString=".MDF") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".MDF") returned 0x0 [0083.130] lstrlenW (lpString=".DBF") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".DBF") returned 0x0 [0083.130] lstrlenW (lpString=".DB") returned 3 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".DB") returned 0x0 [0083.130] lstrlenW (lpString=".db") returned 3 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".db") returned 0x0 [0083.130] lstrlenW (lpString=".ndf") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".ndf") returned 0x0 [0083.130] lstrlenW (lpString=".NDF") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".NDF") returned 0x0 [0083.130] lstrlenW (lpString=".Mdf") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".Mdf") returned 0x0 [0083.130] lstrlenW (lpString=".dat") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".dat") returned 0x0 [0083.130] lstrlenW (lpString=".DAT") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".DAT") returned 0x0 [0083.130] lstrlenW (lpString=".ldf") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".ldf") returned 0x0 [0083.130] lstrlenW (lpString=".LDF") returned 4 [0083.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch=".LDF") returned 0x0 [0083.131] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.131] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.131] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.132] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.132] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20313285359) returned 1 [0083.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc05bc990, dwHighDateTime=0x1d585b4)) [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3396a8 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3396a8 | out: hHeap=0x260000) returned 1 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764e08 [0083.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.133] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.133] GetLastError () returned 0x0 [0083.133] GetLastError () returned 0x0 [0083.133] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.133] GetLastError () returned 0x0 [0083.133] GetLastError () returned 0x0 [0083.135] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffcf1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.135] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x30f, lpOverlapped=0x0) returned 1 [0083.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.135] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.135] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.135] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.136] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.136] CloseHandle (hObject=0xd8) returned 1 [0083.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0083.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0083.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.137] GetLastError () returned 0x0 [0083.137] RtlWakeConditionVariable () returned 0x0 [0083.137] GetCurrentThreadId () returned 0x99c [0083.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".ldf") returned 0x0 [0083.137] lstrlenW (lpString=".vhd") returned 4 [0083.137] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".vhd") returned 0x0 [0083.138] lstrlenW (lpString=".vhdx") returned 5 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".vhdx") returned 0x0 [0083.138] lstrlenW (lpString=".pst") returned 4 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".pst") returned 0x0 [0083.138] lstrlenW (lpString=".ost") returned 4 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".ost") returned 0x0 [0083.138] lstrlenW (lpString=".bak") returned 4 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".bak") returned 0x0 [0083.138] lstrlenW (lpString=".bac") returned 4 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".bac") returned 0x0 [0083.138] lstrlenW (lpString=".sys") returned 4 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".sys") returned 0x0 [0083.138] lstrlenW (lpString=".v2i") returned 4 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".v2i") returned 0x0 [0083.138] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.139] lstrlenW (lpString=".sql") returned 4 [0083.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".sql") returned 0x0 [0083.139] lstrlenW (lpString=".mdf") returned 4 [0083.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".mdf") returned 0x0 [0083.139] lstrlenW (lpString=".txt") returned 4 [0083.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".txt") returned 0x0 [0083.139] lstrlenW (lpString=".dbf") returned 4 [0083.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".dbf") returned 0x0 [0083.139] lstrlenW (lpString=".ckp") returned 4 [0083.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".ckp") returned 0x0 [0083.139] lstrlenW (lpString=".dacpac") returned 7 [0083.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".dacpac") returned 0x0 [0083.139] lstrlenW (lpString=".db3") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".db3") returned 0x0 [0083.140] lstrlenW (lpString=".dtxs") returned 5 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".dtxs") returned 0x0 [0083.140] lstrlenW (lpString=".mdt") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".mdt") returned 0x0 [0083.140] lstrlenW (lpString=".sdf") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".sdf") returned 0x0 [0083.140] lstrlenW (lpString=".MDF") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".MDF") returned 0x0 [0083.140] lstrlenW (lpString=".DBF") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".DBF") returned 0x0 [0083.140] lstrlenW (lpString=".DB") returned 3 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".DB") returned 0x0 [0083.140] lstrlenW (lpString=".db") returned 3 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".db") returned 0x0 [0083.140] lstrlenW (lpString=".ndf") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".ndf") returned 0x0 [0083.140] lstrlenW (lpString=".NDF") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".NDF") returned 0x0 [0083.140] lstrlenW (lpString=".Mdf") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".Mdf") returned 0x0 [0083.140] lstrlenW (lpString=".dat") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".dat") returned 0x0 [0083.140] lstrlenW (lpString=".DAT") returned 4 [0083.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".DAT") returned 0x0 [0083.140] lstrlenW (lpString=".ldf") returned 4 [0083.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".ldf") returned 0x0 [0083.141] lstrlenW (lpString=".LDF") returned 4 [0083.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch=".LDF") returned 0x0 [0083.141] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.141] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.142] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.142] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.142] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20314303559) returned 1 [0083.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc05e2af0, dwHighDateTime=0x1d585b4)) [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3396e0 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3396e0 | out: hHeap=0x260000) returned 1 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764228 [0083.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.143] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.143] GetLastError () returned 0x0 [0083.143] GetLastError () returned 0x0 [0083.143] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.143] GetLastError () returned 0x0 [0083.144] GetLastError () returned 0x0 [0083.344] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.344] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.344] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.344] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.344] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.344] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.344] CloseHandle (hObject=0xd8) returned 1 [0083.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0083.344] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0083.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.346] GetLastError () returned 0x0 [0083.346] RtlWakeConditionVariable () returned 0x0 [0083.347] GetCurrentThreadId () returned 0x99c [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".ldf") returned 0x0 [0083.347] lstrlenW (lpString=".vhd") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".vhd") returned 0x0 [0083.347] lstrlenW (lpString=".vhdx") returned 5 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".vhdx") returned 0x0 [0083.347] lstrlenW (lpString=".pst") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".pst") returned 0x0 [0083.347] lstrlenW (lpString=".ost") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".ost") returned 0x0 [0083.347] lstrlenW (lpString=".bak") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".bak") returned 0x0 [0083.347] lstrlenW (lpString=".bac") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".bac") returned 0x0 [0083.347] lstrlenW (lpString=".sys") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".sys") returned 0x0 [0083.347] lstrlenW (lpString=".v2i") returned 4 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".v2i") returned 0x0 [0083.347] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.347] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.349] lstrlenW (lpString=".sql") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".sql") returned 0x0 [0083.349] lstrlenW (lpString=".mdf") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".mdf") returned 0x0 [0083.349] lstrlenW (lpString=".txt") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".txt") returned 0x0 [0083.349] lstrlenW (lpString=".dbf") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".dbf") returned 0x0 [0083.349] lstrlenW (lpString=".ckp") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".ckp") returned 0x0 [0083.349] lstrlenW (lpString=".dacpac") returned 7 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".dacpac") returned 0x0 [0083.349] lstrlenW (lpString=".db3") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".db3") returned 0x0 [0083.349] lstrlenW (lpString=".dtxs") returned 5 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".dtxs") returned 0x0 [0083.349] lstrlenW (lpString=".mdt") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".mdt") returned 0x0 [0083.349] lstrlenW (lpString=".sdf") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".sdf") returned 0x0 [0083.349] lstrlenW (lpString=".MDF") returned 4 [0083.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".MDF") returned 0x0 [0083.350] lstrlenW (lpString=".DBF") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".DBF") returned 0x0 [0083.350] lstrlenW (lpString=".DB") returned 3 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".DB") returned 0x0 [0083.350] lstrlenW (lpString=".db") returned 3 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".db") returned 0x0 [0083.350] lstrlenW (lpString=".ndf") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".ndf") returned 0x0 [0083.350] lstrlenW (lpString=".NDF") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".NDF") returned 0x0 [0083.350] lstrlenW (lpString=".Mdf") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".Mdf") returned 0x0 [0083.350] lstrlenW (lpString=".dat") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".dat") returned 0x0 [0083.350] lstrlenW (lpString=".DAT") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".DAT") returned 0x0 [0083.350] lstrlenW (lpString=".ldf") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".ldf") returned 0x0 [0083.350] lstrlenW (lpString=".LDF") returned 4 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch=".LDF") returned 0x0 [0083.350] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.350] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.351] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.351] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20335262235) returned 1 [0083.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc07f7e30, dwHighDateTime=0x1d585b4)) [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339910 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339910 | out: hHeap=0x260000) returned 1 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325508 [0083.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.352] GetLastError () returned 0x0 [0083.353] GetLastError () returned 0x0 [0083.353] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.353] GetLastError () returned 0x0 [0083.353] GetLastError () returned 0x0 [0083.354] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.355] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.355] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.355] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.355] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.355] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.355] CloseHandle (hObject=0xd8) returned 1 [0083.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.357] GetLastError () returned 0x0 [0083.357] RtlWakeConditionVariable () returned 0x0 [0083.357] GetCurrentThreadId () returned 0x99c [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".ldf") returned 0x0 [0083.357] lstrlenW (lpString=".vhd") returned 4 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".vhd") returned 0x0 [0083.357] lstrlenW (lpString=".vhdx") returned 5 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".vhdx") returned 0x0 [0083.357] lstrlenW (lpString=".pst") returned 4 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".pst") returned 0x0 [0083.357] lstrlenW (lpString=".ost") returned 4 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".ost") returned 0x0 [0083.357] lstrlenW (lpString=".bak") returned 4 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".bak") returned 0x0 [0083.357] lstrlenW (lpString=".bac") returned 4 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".bac") returned 0x0 [0083.357] lstrlenW (lpString=".sys") returned 4 [0083.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".sys") returned 0x0 [0083.357] lstrlenW (lpString=".v2i") returned 4 [0083.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".v2i") returned 0x0 [0083.358] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.359] lstrlenW (lpString=".sql") returned 4 [0083.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".sql") returned 0x0 [0083.359] lstrlenW (lpString=".mdf") returned 4 [0083.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".mdf") returned 0x0 [0083.359] lstrlenW (lpString=".txt") returned 4 [0083.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".txt") returned 0x0 [0083.360] lstrlenW (lpString=".dbf") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".dbf") returned 0x0 [0083.360] lstrlenW (lpString=".ckp") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".ckp") returned 0x0 [0083.360] lstrlenW (lpString=".dacpac") returned 7 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".dacpac") returned 0x0 [0083.360] lstrlenW (lpString=".db3") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".db3") returned 0x0 [0083.360] lstrlenW (lpString=".dtxs") returned 5 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".dtxs") returned 0x0 [0083.360] lstrlenW (lpString=".mdt") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".mdt") returned 0x0 [0083.360] lstrlenW (lpString=".sdf") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".sdf") returned 0x0 [0083.360] lstrlenW (lpString=".MDF") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".MDF") returned 0x0 [0083.360] lstrlenW (lpString=".DBF") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".DBF") returned 0x0 [0083.360] lstrlenW (lpString=".DB") returned 3 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".DB") returned 0x0 [0083.360] lstrlenW (lpString=".db") returned 3 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".db") returned 0x0 [0083.360] lstrlenW (lpString=".ndf") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".ndf") returned 0x0 [0083.360] lstrlenW (lpString=".NDF") returned 4 [0083.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".NDF") returned 0x0 [0083.361] lstrlenW (lpString=".Mdf") returned 4 [0083.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".Mdf") returned 0x0 [0083.361] lstrlenW (lpString=".dat") returned 4 [0083.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".dat") returned 0x0 [0083.361] lstrlenW (lpString=".DAT") returned 4 [0083.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".DAT") returned 0x0 [0083.361] lstrlenW (lpString=".ldf") returned 4 [0083.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".ldf") returned 0x0 [0083.361] lstrlenW (lpString=".LDF") returned 4 [0083.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch=".LDF") returned 0x0 [0083.361] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.361] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.362] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.362] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.362] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20336339124) returned 1 [0083.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc07f7e30, dwHighDateTime=0x1d585b4)) [0083.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339948 [0083.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339948 | out: hHeap=0x260000) returned 1 [0083.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325340 [0083.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.363] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.363] GetLastError () returned 0x0 [0083.363] GetLastError () returned 0x0 [0083.363] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.364] GetLastError () returned 0x0 [0083.364] GetLastError () returned 0x0 [0083.365] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.365] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x268, lpOverlapped=0x0) returned 1 [0083.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.365] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.365] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.365] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.365] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.365] CloseHandle (hObject=0xd8) returned 1 [0083.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0083.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0083.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.367] GetLastError () returned 0x0 [0083.367] RtlWakeConditionVariable () returned 0x0 [0083.367] GetCurrentThreadId () returned 0x99c [0083.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".ldf") returned 0x0 [0083.367] lstrlenW (lpString=".vhd") returned 4 [0083.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".vhd") returned 0x0 [0083.367] lstrlenW (lpString=".vhdx") returned 5 [0083.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".vhdx") returned 0x0 [0083.367] lstrlenW (lpString=".pst") returned 4 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".pst") returned 0x0 [0083.368] lstrlenW (lpString=".ost") returned 4 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".ost") returned 0x0 [0083.368] lstrlenW (lpString=".bak") returned 4 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".bak") returned 0x0 [0083.368] lstrlenW (lpString=".bac") returned 4 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".bac") returned 0x0 [0083.368] lstrlenW (lpString=".sys") returned 4 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".sys") returned 0x0 [0083.368] lstrlenW (lpString=".v2i") returned 4 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".v2i") returned 0x0 [0083.368] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.369] lstrlenW (lpString=".sql") returned 4 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".sql") returned 0x0 [0083.369] lstrlenW (lpString=".mdf") returned 4 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".mdf") returned 0x0 [0083.369] lstrlenW (lpString=".txt") returned 4 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".txt") returned 0x0 [0083.369] lstrlenW (lpString=".dbf") returned 4 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".dbf") returned 0x0 [0083.369] lstrlenW (lpString=".ckp") returned 4 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".ckp") returned 0x0 [0083.369] lstrlenW (lpString=".dacpac") returned 7 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".dacpac") returned 0x0 [0083.369] lstrlenW (lpString=".db3") returned 4 [0083.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".db3") returned 0x0 [0083.370] lstrlenW (lpString=".dtxs") returned 5 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".dtxs") returned 0x0 [0083.370] lstrlenW (lpString=".mdt") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".mdt") returned 0x0 [0083.370] lstrlenW (lpString=".sdf") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".sdf") returned 0x0 [0083.370] lstrlenW (lpString=".MDF") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".MDF") returned 0x0 [0083.370] lstrlenW (lpString=".DBF") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".DBF") returned 0x0 [0083.370] lstrlenW (lpString=".DB") returned 3 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".DB") returned 0x0 [0083.370] lstrlenW (lpString=".db") returned 3 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".db") returned 0x0 [0083.370] lstrlenW (lpString=".ndf") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".ndf") returned 0x0 [0083.370] lstrlenW (lpString=".NDF") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".NDF") returned 0x0 [0083.370] lstrlenW (lpString=".Mdf") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".Mdf") returned 0x0 [0083.370] lstrlenW (lpString=".dat") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".dat") returned 0x0 [0083.370] lstrlenW (lpString=".DAT") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".DAT") returned 0x0 [0083.370] lstrlenW (lpString=".ldf") returned 4 [0083.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".ldf") returned 0x0 [0083.371] lstrlenW (lpString=".LDF") returned 4 [0083.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch=".LDF") returned 0x0 [0083.371] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.371] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.372] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.372] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20337289179) returned 1 [0083.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc081df90, dwHighDateTime=0x1d585b4)) [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339980 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339980 | out: hHeap=0x260000) returned 1 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3252a8 [0083.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.373] GetLastError () returned 0x0 [0083.373] GetLastError () returned 0x0 [0083.373] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.373] GetLastError () returned 0x0 [0083.373] GetLastError () returned 0x0 [0083.375] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff9d82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.375] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x627e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x627e, lpOverlapped=0x0) returned 1 [0083.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.375] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.375] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.375] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.376] CloseHandle (hObject=0xd8) returned 1 [0083.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0083.377] GetLastError () returned 0x0 [0083.377] RtlWakeConditionVariable () returned 0x0 [0083.377] GetCurrentThreadId () returned 0x99c [0083.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".ldf") returned 0x0 [0083.377] lstrlenW (lpString=".vhd") returned 4 [0083.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".vhd") returned 0x0 [0083.378] lstrlenW (lpString=".vhdx") returned 5 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".vhdx") returned 0x0 [0083.378] lstrlenW (lpString=".pst") returned 4 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".pst") returned 0x0 [0083.378] lstrlenW (lpString=".ost") returned 4 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".ost") returned 0x0 [0083.378] lstrlenW (lpString=".bak") returned 4 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".bak") returned 0x0 [0083.378] lstrlenW (lpString=".bac") returned 4 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".bac") returned 0x0 [0083.378] lstrlenW (lpString=".sys") returned 4 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".sys") returned 0x0 [0083.378] lstrlenW (lpString=".v2i") returned 4 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".v2i") returned 0x0 [0083.378] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0083.379] lstrlenW (lpString=".sql") returned 4 [0083.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".sql") returned 0x0 [0083.379] lstrlenW (lpString=".mdf") returned 4 [0083.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".mdf") returned 0x0 [0083.379] lstrlenW (lpString=".txt") returned 4 [0083.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".txt") returned 0x0 [0083.379] lstrlenW (lpString=".dbf") returned 4 [0083.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".dbf") returned 0x0 [0083.379] lstrlenW (lpString=".ckp") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".ckp") returned 0x0 [0083.380] lstrlenW (lpString=".dacpac") returned 7 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".dacpac") returned 0x0 [0083.380] lstrlenW (lpString=".db3") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".db3") returned 0x0 [0083.380] lstrlenW (lpString=".dtxs") returned 5 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".dtxs") returned 0x0 [0083.380] lstrlenW (lpString=".mdt") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".mdt") returned 0x0 [0083.380] lstrlenW (lpString=".sdf") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".sdf") returned 0x0 [0083.380] lstrlenW (lpString=".MDF") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".MDF") returned 0x0 [0083.380] lstrlenW (lpString=".DBF") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".DBF") returned 0x0 [0083.380] lstrlenW (lpString=".DB") returned 3 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".DB") returned 0x0 [0083.380] lstrlenW (lpString=".db") returned 3 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".db") returned 0x0 [0083.380] lstrlenW (lpString=".ndf") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".ndf") returned 0x0 [0083.380] lstrlenW (lpString=".NDF") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".NDF") returned 0x0 [0083.380] lstrlenW (lpString=".Mdf") returned 4 [0083.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".Mdf") returned 0x0 [0083.381] lstrlenW (lpString=".dat") returned 4 [0083.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".dat") returned 0x0 [0083.381] lstrlenW (lpString=".DAT") returned 4 [0083.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".DAT") returned 0x0 [0083.381] lstrlenW (lpString=".ldf") returned 4 [0083.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".ldf") returned 0x0 [0083.381] lstrlenW (lpString=".LDF") returned 4 [0083.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch=".LDF") returned 0x0 [0083.381] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.381] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.382] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.382] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.382] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20355995991) returned 1 [0083.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc09e7010, dwHighDateTime=0x1d585b4)) [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339b78 [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339b78 | out: hHeap=0x260000) returned 1 [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751e10 [0083.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.560] GetLastError () returned 0x0 [0083.560] GetLastError () returned 0x0 [0083.560] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.560] GetLastError () returned 0x0 [0083.561] GetLastError () returned 0x0 [0083.574] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.574] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0083.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0083.574] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.574] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.575] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.575] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.575] CloseHandle (hObject=0xd8) returned 1 [0083.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0083.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0083.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.636] GetLastError () returned 0x0 [0083.636] RtlWakeConditionVariable () returned 0x27e828 [0083.636] GetCurrentThreadId () returned 0x99c [0083.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".ldf") returned 0x0 [0083.636] lstrlenW (lpString=".vhd") returned 4 [0083.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".vhd") returned 0x0 [0083.636] lstrlenW (lpString=".vhdx") returned 5 [0083.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".vhdx") returned 0x0 [0083.636] lstrlenW (lpString=".pst") returned 4 [0083.636] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".pst") returned 0x0 [0083.636] lstrlenW (lpString=".ost") returned 4 [0083.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".ost") returned 0x0 [0083.637] lstrlenW (lpString=".bak") returned 4 [0083.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".bak") returned 0x0 [0083.637] lstrlenW (lpString=".bac") returned 4 [0083.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".bac") returned 0x0 [0083.637] lstrlenW (lpString=".sys") returned 4 [0083.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".sys") returned 0x0 [0083.637] lstrlenW (lpString=".v2i") returned 4 [0083.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".v2i") returned 0x0 [0083.637] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.638] lstrlenW (lpString=".sql") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".sql") returned 0x0 [0083.638] lstrlenW (lpString=".mdf") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".mdf") returned 0x0 [0083.638] lstrlenW (lpString=".txt") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".txt") returned 0x0 [0083.638] lstrlenW (lpString=".dbf") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".dbf") returned 0x0 [0083.638] lstrlenW (lpString=".ckp") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".ckp") returned 0x0 [0083.638] lstrlenW (lpString=".dacpac") returned 7 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".dacpac") returned 0x0 [0083.638] lstrlenW (lpString=".db3") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".db3") returned 0x0 [0083.638] lstrlenW (lpString=".dtxs") returned 5 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".dtxs") returned 0x0 [0083.638] lstrlenW (lpString=".mdt") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".mdt") returned 0x0 [0083.638] lstrlenW (lpString=".sdf") returned 4 [0083.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".sdf") returned 0x0 [0083.638] lstrlenW (lpString=".MDF") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".MDF") returned 0x0 [0083.639] lstrlenW (lpString=".DBF") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".DBF") returned 0x0 [0083.639] lstrlenW (lpString=".DB") returned 3 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".DB") returned 0x0 [0083.639] lstrlenW (lpString=".db") returned 3 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".db") returned 0x0 [0083.639] lstrlenW (lpString=".ndf") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".ndf") returned 0x0 [0083.639] lstrlenW (lpString=".NDF") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".NDF") returned 0x0 [0083.639] lstrlenW (lpString=".Mdf") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".Mdf") returned 0x0 [0083.639] lstrlenW (lpString=".dat") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".dat") returned 0x0 [0083.639] lstrlenW (lpString=".DAT") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".DAT") returned 0x0 [0083.639] lstrlenW (lpString=".ldf") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".ldf") returned 0x0 [0083.639] lstrlenW (lpString=".LDF") returned 4 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch=".LDF") returned 0x0 [0083.639] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.640] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.640] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.640] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.640] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20364159832) returned 1 [0083.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0aa56f0, dwHighDateTime=0x1d585b4)) [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762760 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762760 | out: hHeap=0x260000) returned 1 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765a80 [0083.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.641] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.641] GetLastError () returned 0x0 [0083.642] GetLastError () returned 0x0 [0083.642] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.642] GetLastError () returned 0x0 [0083.642] GetLastError () returned 0x0 [0083.645] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.645] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x33c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x33c, lpOverlapped=0x0) returned 1 [0083.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0083.645] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.645] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.645] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.645] CloseHandle (hObject=0xe4) returned 1 [0083.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0083.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0083.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0083.647] GetLastError () returned 0x0 [0083.647] RtlWakeConditionVariable () returned 0x0 [0083.647] GetCurrentThreadId () returned 0x99c [0083.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".ldf") returned 0x0 [0083.647] lstrlenW (lpString=".vhd") returned 4 [0083.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".vhd") returned 0x0 [0083.647] lstrlenW (lpString=".vhdx") returned 5 [0083.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".vhdx") returned 0x0 [0083.647] lstrlenW (lpString=".pst") returned 4 [0083.647] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".pst") returned 0x0 [0083.647] lstrlenW (lpString=".ost") returned 4 [0083.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".ost") returned 0x0 [0083.648] lstrlenW (lpString=".bak") returned 4 [0083.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".bak") returned 0x0 [0083.648] lstrlenW (lpString=".bac") returned 4 [0083.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".bac") returned 0x0 [0083.648] lstrlenW (lpString=".sys") returned 4 [0083.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".sys") returned 0x0 [0083.648] lstrlenW (lpString=".v2i") returned 4 [0083.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".v2i") returned 0x0 [0083.648] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.648] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0083.649] lstrlenW (lpString=".sql") returned 4 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".sql") returned 0x0 [0083.649] lstrlenW (lpString=".mdf") returned 4 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".mdf") returned 0x0 [0083.649] lstrlenW (lpString=".txt") returned 4 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".txt") returned 0x0 [0083.649] lstrlenW (lpString=".dbf") returned 4 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".dbf") returned 0x0 [0083.649] lstrlenW (lpString=".ckp") returned 4 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".ckp") returned 0x0 [0083.649] lstrlenW (lpString=".dacpac") returned 7 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".dacpac") returned 0x0 [0083.649] lstrlenW (lpString=".db3") returned 4 [0083.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".db3") returned 0x0 [0083.650] lstrlenW (lpString=".dtxs") returned 5 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".dtxs") returned 0x0 [0083.650] lstrlenW (lpString=".mdt") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".mdt") returned 0x0 [0083.650] lstrlenW (lpString=".sdf") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".sdf") returned 0x0 [0083.650] lstrlenW (lpString=".MDF") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".MDF") returned 0x0 [0083.650] lstrlenW (lpString=".DBF") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".DBF") returned 0x0 [0083.650] lstrlenW (lpString=".DB") returned 3 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".DB") returned 0x0 [0083.650] lstrlenW (lpString=".db") returned 3 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".db") returned 0x0 [0083.650] lstrlenW (lpString=".ndf") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".ndf") returned 0x0 [0083.650] lstrlenW (lpString=".NDF") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".NDF") returned 0x0 [0083.650] lstrlenW (lpString=".Mdf") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".Mdf") returned 0x0 [0083.650] lstrlenW (lpString=".dat") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".dat") returned 0x0 [0083.650] lstrlenW (lpString=".DAT") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".DAT") returned 0x0 [0083.650] lstrlenW (lpString=".ldf") returned 4 [0083.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".ldf") returned 0x0 [0083.651] lstrlenW (lpString=".LDF") returned 4 [0083.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch=".LDF") returned 0x0 [0083.651] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0083.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.651] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0083.652] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.652] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0083.652] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20365287254) returned 1 [0083.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0acb850, dwHighDateTime=0x1d585b4)) [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762728 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762728 | out: hHeap=0x260000) returned 1 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765068 [0083.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0083.653] GetLastError () returned 0x0 [0083.653] GetLastError () returned 0x0 [0083.653] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0083.653] GetLastError () returned 0x0 [0083.653] GetLastError () returned 0x0 [0084.011] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcf7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.011] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x309, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x309, lpOverlapped=0x0) returned 1 [0084.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.014] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.014] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.014] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.014] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.014] CloseHandle (hObject=0xe4) returned 1 [0084.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.016] GetLastError () returned 0x0 [0084.016] RtlWakeConditionVariable () returned 0x27e828 [0084.016] GetCurrentThreadId () returned 0x99c [0084.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".ldf") returned 0x0 [0084.016] lstrlenW (lpString=".vhd") returned 4 [0084.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".vhd") returned 0x0 [0084.016] lstrlenW (lpString=".vhdx") returned 5 [0084.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".vhdx") returned 0x0 [0084.016] lstrlenW (lpString=".pst") returned 4 [0084.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".pst") returned 0x0 [0084.016] lstrlenW (lpString=".ost") returned 4 [0084.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".ost") returned 0x0 [0084.016] lstrlenW (lpString=".bak") returned 4 [0084.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".bak") returned 0x0 [0084.017] lstrlenW (lpString=".bac") returned 4 [0084.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".bac") returned 0x0 [0084.017] lstrlenW (lpString=".sys") returned 4 [0084.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".sys") returned 0x0 [0084.017] lstrlenW (lpString=".v2i") returned 4 [0084.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".v2i") returned 0x0 [0084.017] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.018] lstrlenW (lpString=".sql") returned 4 [0084.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".sql") returned 0x0 [0084.018] lstrlenW (lpString=".mdf") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".mdf") returned 0x0 [0084.019] lstrlenW (lpString=".txt") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".txt") returned 0x0 [0084.019] lstrlenW (lpString=".dbf") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".dbf") returned 0x0 [0084.019] lstrlenW (lpString=".ckp") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".ckp") returned 0x0 [0084.019] lstrlenW (lpString=".dacpac") returned 7 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".dacpac") returned 0x0 [0084.019] lstrlenW (lpString=".db3") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".db3") returned 0x0 [0084.019] lstrlenW (lpString=".dtxs") returned 5 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".dtxs") returned 0x0 [0084.019] lstrlenW (lpString=".mdt") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".mdt") returned 0x0 [0084.019] lstrlenW (lpString=".sdf") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".sdf") returned 0x0 [0084.019] lstrlenW (lpString=".MDF") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".MDF") returned 0x0 [0084.019] lstrlenW (lpString=".DBF") returned 4 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".DBF") returned 0x0 [0084.019] lstrlenW (lpString=".DB") returned 3 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".DB") returned 0x0 [0084.019] lstrlenW (lpString=".db") returned 3 [0084.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".db") returned 0x0 [0084.019] lstrlenW (lpString=".ndf") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".ndf") returned 0x0 [0084.020] lstrlenW (lpString=".NDF") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".NDF") returned 0x0 [0084.020] lstrlenW (lpString=".Mdf") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".Mdf") returned 0x0 [0084.020] lstrlenW (lpString=".dat") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".dat") returned 0x0 [0084.020] lstrlenW (lpString=".DAT") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".DAT") returned 0x0 [0084.020] lstrlenW (lpString=".ldf") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".ldf") returned 0x0 [0084.020] lstrlenW (lpString=".LDF") returned 4 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch=".LDF") returned 0x0 [0084.020] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.020] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.025] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.025] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.025] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20402620979) returned 1 [0084.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0e5d950, dwHighDateTime=0x1d585b4)) [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762610 [0084.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762610 | out: hHeap=0x260000) returned 1 [0084.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765820 [0084.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.026] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.026] GetLastError () returned 0x0 [0084.026] GetLastError () returned 0x0 [0084.026] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.026] GetLastError () returned 0x0 [0084.027] GetLastError () returned 0x0 [0084.161] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.161] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.161] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.161] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.161] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.161] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.161] CloseHandle (hObject=0xe4) returned 1 [0084.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.161] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.164] GetLastError () returned 0x0 [0084.164] RtlWakeConditionVariable () returned 0x0 [0084.164] GetCurrentThreadId () returned 0x99c [0084.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".ldf") returned 0x0 [0084.164] lstrlenW (lpString=".vhd") returned 4 [0084.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".vhd") returned 0x0 [0084.164] lstrlenW (lpString=".vhdx") returned 5 [0084.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".vhdx") returned 0x0 [0084.164] lstrlenW (lpString=".pst") returned 4 [0084.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".pst") returned 0x0 [0084.164] lstrlenW (lpString=".ost") returned 4 [0084.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".ost") returned 0x0 [0084.164] lstrlenW (lpString=".bak") returned 4 [0084.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".bak") returned 0x0 [0084.165] lstrlenW (lpString=".bac") returned 4 [0084.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".bac") returned 0x0 [0084.165] lstrlenW (lpString=".sys") returned 4 [0084.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".sys") returned 0x0 [0084.165] lstrlenW (lpString=".v2i") returned 4 [0084.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".v2i") returned 0x0 [0084.165] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.166] lstrlenW (lpString=".sql") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".sql") returned 0x0 [0084.167] lstrlenW (lpString=".mdf") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".mdf") returned 0x0 [0084.167] lstrlenW (lpString=".txt") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".txt") returned 0x0 [0084.167] lstrlenW (lpString=".dbf") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".dbf") returned 0x0 [0084.167] lstrlenW (lpString=".ckp") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".ckp") returned 0x0 [0084.167] lstrlenW (lpString=".dacpac") returned 7 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".dacpac") returned 0x0 [0084.167] lstrlenW (lpString=".db3") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".db3") returned 0x0 [0084.167] lstrlenW (lpString=".dtxs") returned 5 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".dtxs") returned 0x0 [0084.167] lstrlenW (lpString=".mdt") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".mdt") returned 0x0 [0084.167] lstrlenW (lpString=".sdf") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".sdf") returned 0x0 [0084.167] lstrlenW (lpString=".MDF") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".MDF") returned 0x0 [0084.167] lstrlenW (lpString=".DBF") returned 4 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".DBF") returned 0x0 [0084.167] lstrlenW (lpString=".DB") returned 3 [0084.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".DB") returned 0x0 [0084.168] lstrlenW (lpString=".db") returned 3 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".db") returned 0x0 [0084.168] lstrlenW (lpString=".ndf") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".ndf") returned 0x0 [0084.168] lstrlenW (lpString=".NDF") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".NDF") returned 0x0 [0084.168] lstrlenW (lpString=".Mdf") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".Mdf") returned 0x0 [0084.168] lstrlenW (lpString=".dat") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".dat") returned 0x0 [0084.168] lstrlenW (lpString=".DAT") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".DAT") returned 0x0 [0084.168] lstrlenW (lpString=".ldf") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".ldf") returned 0x0 [0084.168] lstrlenW (lpString=".LDF") returned 4 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch=".LDF") returned 0x0 [0084.168] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.168] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.169] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.169] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20417048058) returned 1 [0084.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc0fb45b0, dwHighDateTime=0x1d585b4)) [0084.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339d00 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339d00 | out: hHeap=0x260000) returned 1 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27519e8 [0084.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.170] GetLastError () returned 0x0 [0084.170] GetLastError () returned 0x0 [0084.171] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.171] GetLastError () returned 0x0 [0084.171] GetLastError () returned 0x0 [0084.189] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcc6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.189] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x33a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x33a, lpOverlapped=0x0) returned 1 [0084.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.189] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.189] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.189] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.189] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.189] CloseHandle (hObject=0xe4) returned 1 [0084.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0084.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0084.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.195] GetLastError () returned 0x0 [0084.195] RtlWakeConditionVariable () returned 0x0 [0084.195] GetCurrentThreadId () returned 0x99c [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".ldf") returned 0x0 [0084.196] lstrlenW (lpString=".vhd") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".vhd") returned 0x0 [0084.196] lstrlenW (lpString=".vhdx") returned 5 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".vhdx") returned 0x0 [0084.196] lstrlenW (lpString=".pst") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".pst") returned 0x0 [0084.196] lstrlenW (lpString=".ost") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".ost") returned 0x0 [0084.196] lstrlenW (lpString=".bak") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".bak") returned 0x0 [0084.196] lstrlenW (lpString=".bac") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".bac") returned 0x0 [0084.196] lstrlenW (lpString=".sys") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".sys") returned 0x0 [0084.196] lstrlenW (lpString=".v2i") returned 4 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".v2i") returned 0x0 [0084.196] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.198] lstrlenW (lpString=".sql") returned 4 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".sql") returned 0x0 [0084.198] lstrlenW (lpString=".mdf") returned 4 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".mdf") returned 0x0 [0084.198] lstrlenW (lpString=".txt") returned 4 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".txt") returned 0x0 [0084.198] lstrlenW (lpString=".dbf") returned 4 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".dbf") returned 0x0 [0084.198] lstrlenW (lpString=".ckp") returned 4 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".ckp") returned 0x0 [0084.198] lstrlenW (lpString=".dacpac") returned 7 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".dacpac") returned 0x0 [0084.198] lstrlenW (lpString=".db3") returned 4 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".db3") returned 0x0 [0084.198] lstrlenW (lpString=".dtxs") returned 5 [0084.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".dtxs") returned 0x0 [0084.198] lstrlenW (lpString=".mdt") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".mdt") returned 0x0 [0084.199] lstrlenW (lpString=".sdf") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".sdf") returned 0x0 [0084.199] lstrlenW (lpString=".MDF") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".MDF") returned 0x0 [0084.199] lstrlenW (lpString=".DBF") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".DBF") returned 0x0 [0084.199] lstrlenW (lpString=".DB") returned 3 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".DB") returned 0x0 [0084.199] lstrlenW (lpString=".db") returned 3 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".db") returned 0x0 [0084.199] lstrlenW (lpString=".ndf") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".ndf") returned 0x0 [0084.199] lstrlenW (lpString=".NDF") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".NDF") returned 0x0 [0084.199] lstrlenW (lpString=".Mdf") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".Mdf") returned 0x0 [0084.199] lstrlenW (lpString=".dat") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".dat") returned 0x0 [0084.199] lstrlenW (lpString=".DAT") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".DAT") returned 0x0 [0084.199] lstrlenW (lpString=".ldf") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".ldf") returned 0x0 [0084.199] lstrlenW (lpString=".LDF") returned 4 [0084.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch=".LDF") returned 0x0 [0084.200] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.200] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.200] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.201] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.201] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20420184592) returned 1 [0084.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1000870, dwHighDateTime=0x1d585b4)) [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339d70 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339d70 | out: hHeap=0x260000) returned 1 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751788 [0084.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.201] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.202] GetLastError () returned 0x0 [0084.202] GetLastError () returned 0x0 [0084.202] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.202] GetLastError () returned 0x0 [0084.202] GetLastError () returned 0x0 [0084.205] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.205] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.205] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.206] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.206] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.206] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.206] CloseHandle (hObject=0xe4) returned 1 [0084.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0084.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0084.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.211] GetLastError () returned 0x0 [0084.211] RtlWakeConditionVariable () returned 0x27e828 [0084.211] GetCurrentThreadId () returned 0x99c [0084.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".ldf") returned 0x0 [0084.211] lstrlenW (lpString=".vhd") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".vhd") returned 0x0 [0084.212] lstrlenW (lpString=".vhdx") returned 5 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".vhdx") returned 0x0 [0084.212] lstrlenW (lpString=".pst") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".pst") returned 0x0 [0084.212] lstrlenW (lpString=".ost") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".ost") returned 0x0 [0084.212] lstrlenW (lpString=".bak") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".bak") returned 0x0 [0084.212] lstrlenW (lpString=".bac") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".bac") returned 0x0 [0084.212] lstrlenW (lpString=".sys") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".sys") returned 0x0 [0084.212] lstrlenW (lpString=".v2i") returned 4 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".v2i") returned 0x0 [0084.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.214] lstrlenW (lpString=".sql") returned 4 [0084.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".sql") returned 0x0 [0084.215] lstrlenW (lpString=".mdf") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".mdf") returned 0x0 [0084.215] lstrlenW (lpString=".txt") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".txt") returned 0x0 [0084.215] lstrlenW (lpString=".dbf") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".dbf") returned 0x0 [0084.215] lstrlenW (lpString=".ckp") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".ckp") returned 0x0 [0084.215] lstrlenW (lpString=".dacpac") returned 7 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".dacpac") returned 0x0 [0084.215] lstrlenW (lpString=".db3") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".db3") returned 0x0 [0084.215] lstrlenW (lpString=".dtxs") returned 5 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".dtxs") returned 0x0 [0084.215] lstrlenW (lpString=".mdt") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".mdt") returned 0x0 [0084.215] lstrlenW (lpString=".sdf") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".sdf") returned 0x0 [0084.215] lstrlenW (lpString=".MDF") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".MDF") returned 0x0 [0084.215] lstrlenW (lpString=".DBF") returned 4 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".DBF") returned 0x0 [0084.215] lstrlenW (lpString=".DB") returned 3 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".DB") returned 0x0 [0084.215] lstrlenW (lpString=".db") returned 3 [0084.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".db") returned 0x0 [0084.216] lstrlenW (lpString=".ndf") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".ndf") returned 0x0 [0084.216] lstrlenW (lpString=".NDF") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".NDF") returned 0x0 [0084.216] lstrlenW (lpString=".Mdf") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".Mdf") returned 0x0 [0084.216] lstrlenW (lpString=".dat") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".dat") returned 0x0 [0084.216] lstrlenW (lpString=".DAT") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".DAT") returned 0x0 [0084.216] lstrlenW (lpString=".ldf") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".ldf") returned 0x0 [0084.216] lstrlenW (lpString=".LDF") returned 4 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch=".LDF") returned 0x0 [0084.216] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.216] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.217] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.217] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20421854157) returned 1 [0084.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc10269d0, dwHighDateTime=0x1d585b4)) [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339da8 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339da8 | out: hHeap=0x260000) returned 1 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751658 [0084.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.218] GetLastError () returned 0x0 [0084.219] GetLastError () returned 0x0 [0084.219] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.219] GetLastError () returned 0x0 [0084.219] GetLastError () returned 0x0 [0084.328] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.328] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.328] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.328] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.329] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.329] CloseHandle (hObject=0xe4) returned 1 [0084.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.331] GetLastError () returned 0x0 [0084.332] RtlWakeConditionVariable () returned 0x0 [0084.332] GetCurrentThreadId () returned 0x99c [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".ldf") returned 0x0 [0084.332] lstrlenW (lpString=".vhd") returned 4 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".vhd") returned 0x0 [0084.332] lstrlenW (lpString=".vhdx") returned 5 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".vhdx") returned 0x0 [0084.332] lstrlenW (lpString=".pst") returned 4 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".pst") returned 0x0 [0084.332] lstrlenW (lpString=".ost") returned 4 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".ost") returned 0x0 [0084.332] lstrlenW (lpString=".bak") returned 4 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".bak") returned 0x0 [0084.332] lstrlenW (lpString=".bac") returned 4 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".bac") returned 0x0 [0084.332] lstrlenW (lpString=".sys") returned 4 [0084.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".sys") returned 0x0 [0084.332] lstrlenW (lpString=".v2i") returned 4 [0084.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".v2i") returned 0x0 [0084.333] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.335] lstrlenW (lpString=".sql") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".sql") returned 0x0 [0084.335] lstrlenW (lpString=".mdf") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".mdf") returned 0x0 [0084.335] lstrlenW (lpString=".txt") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".txt") returned 0x0 [0084.335] lstrlenW (lpString=".dbf") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".dbf") returned 0x0 [0084.335] lstrlenW (lpString=".ckp") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".ckp") returned 0x0 [0084.335] lstrlenW (lpString=".dacpac") returned 7 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".dacpac") returned 0x0 [0084.335] lstrlenW (lpString=".db3") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".db3") returned 0x0 [0084.335] lstrlenW (lpString=".dtxs") returned 5 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".dtxs") returned 0x0 [0084.335] lstrlenW (lpString=".mdt") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".mdt") returned 0x0 [0084.335] lstrlenW (lpString=".sdf") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".sdf") returned 0x0 [0084.335] lstrlenW (lpString=".MDF") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".MDF") returned 0x0 [0084.335] lstrlenW (lpString=".DBF") returned 4 [0084.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".DBF") returned 0x0 [0084.335] lstrlenW (lpString=".DB") returned 3 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".DB") returned 0x0 [0084.336] lstrlenW (lpString=".db") returned 3 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".db") returned 0x0 [0084.336] lstrlenW (lpString=".ndf") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".ndf") returned 0x0 [0084.336] lstrlenW (lpString=".NDF") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".NDF") returned 0x0 [0084.336] lstrlenW (lpString=".Mdf") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".Mdf") returned 0x0 [0084.336] lstrlenW (lpString=".dat") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".dat") returned 0x0 [0084.336] lstrlenW (lpString=".DAT") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".DAT") returned 0x0 [0084.336] lstrlenW (lpString=".ldf") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".ldf") returned 0x0 [0084.336] lstrlenW (lpString=".LDF") returned 4 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch=".LDF") returned 0x0 [0084.336] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0084.336] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3ce0) returned 1 [0084.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0084.337] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0084.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.337] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20434026933) returned 1 [0084.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc11574d0, dwHighDateTime=0x1d585b4)) [0084.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339fa0 [0084.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339fa0 | out: hHeap=0x260000) returned 1 [0084.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27515c0 [0084.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.340] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.340] GetLastError () returned 0x0 [0084.340] GetLastError () returned 0x0 [0084.340] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.341] GetLastError () returned 0x0 [0084.341] GetLastError () returned 0x0 [0084.348] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.348] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.348] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.349] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.349] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.350] CloseHandle (hObject=0xe4) returned 1 [0084.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.352] GetLastError () returned 0x0 [0084.352] RtlWakeConditionVariable () returned 0x0 [0084.352] GetCurrentThreadId () returned 0x99c [0084.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".ldf") returned 0x0 [0084.353] lstrlenW (lpString=".vhd") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".vhd") returned 0x0 [0084.353] lstrlenW (lpString=".vhdx") returned 5 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".vhdx") returned 0x0 [0084.353] lstrlenW (lpString=".pst") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".pst") returned 0x0 [0084.353] lstrlenW (lpString=".ost") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".ost") returned 0x0 [0084.353] lstrlenW (lpString=".bak") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".bak") returned 0x0 [0084.353] lstrlenW (lpString=".bac") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".bac") returned 0x0 [0084.353] lstrlenW (lpString=".sys") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".sys") returned 0x0 [0084.353] lstrlenW (lpString=".v2i") returned 4 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".v2i") returned 0x0 [0084.353] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.354] lstrlenW (lpString=".sql") returned 4 [0084.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".sql") returned 0x0 [0084.355] lstrlenW (lpString=".mdf") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".mdf") returned 0x0 [0084.355] lstrlenW (lpString=".txt") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".txt") returned 0x0 [0084.355] lstrlenW (lpString=".dbf") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".dbf") returned 0x0 [0084.355] lstrlenW (lpString=".ckp") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".ckp") returned 0x0 [0084.355] lstrlenW (lpString=".dacpac") returned 7 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".dacpac") returned 0x0 [0084.355] lstrlenW (lpString=".db3") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".db3") returned 0x0 [0084.355] lstrlenW (lpString=".dtxs") returned 5 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".dtxs") returned 0x0 [0084.355] lstrlenW (lpString=".mdt") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".mdt") returned 0x0 [0084.355] lstrlenW (lpString=".sdf") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".sdf") returned 0x0 [0084.355] lstrlenW (lpString=".MDF") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".MDF") returned 0x0 [0084.355] lstrlenW (lpString=".DBF") returned 4 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".DBF") returned 0x0 [0084.355] lstrlenW (lpString=".DB") returned 3 [0084.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".DB") returned 0x0 [0084.355] lstrlenW (lpString=".db") returned 3 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".db") returned 0x0 [0084.356] lstrlenW (lpString=".ndf") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".ndf") returned 0x0 [0084.356] lstrlenW (lpString=".NDF") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".NDF") returned 0x0 [0084.356] lstrlenW (lpString=".Mdf") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".Mdf") returned 0x0 [0084.356] lstrlenW (lpString=".dat") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".dat") returned 0x0 [0084.356] lstrlenW (lpString=".DAT") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".DAT") returned 0x0 [0084.356] lstrlenW (lpString=".ldf") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".ldf") returned 0x0 [0084.356] lstrlenW (lpString=".LDF") returned 4 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch=".LDF") returned 0x0 [0084.356] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0084.356] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d3ce0) returned 1 [0084.357] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0084.357] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0084.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.357] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20435847481) returned 1 [0084.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc117d630, dwHighDateTime=0x1d585b4)) [0084.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a010 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a010 | out: hHeap=0x260000) returned 1 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751068 [0084.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.358] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.358] GetLastError () returned 0x0 [0084.358] GetLastError () returned 0x0 [0084.359] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.359] GetLastError () returned 0x0 [0084.359] GetLastError () returned 0x0 [0084.368] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.368] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.369] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.369] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.369] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.369] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.369] CloseHandle (hObject=0xe4) returned 1 [0084.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.378] GetLastError () returned 0x0 [0084.378] RtlWakeConditionVariable () returned 0x0 [0084.378] GetCurrentThreadId () returned 0x99c [0084.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".ldf") returned 0x0 [0084.378] lstrlenW (lpString=".vhd") returned 4 [0084.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".vhd") returned 0x0 [0084.378] lstrlenW (lpString=".vhdx") returned 5 [0084.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".vhdx") returned 0x0 [0084.378] lstrlenW (lpString=".pst") returned 4 [0084.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".pst") returned 0x0 [0084.378] lstrlenW (lpString=".ost") returned 4 [0084.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".ost") returned 0x0 [0084.378] lstrlenW (lpString=".bak") returned 4 [0084.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".bak") returned 0x0 [0084.379] lstrlenW (lpString=".bac") returned 4 [0084.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".bac") returned 0x0 [0084.379] lstrlenW (lpString=".sys") returned 4 [0084.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".sys") returned 0x0 [0084.379] lstrlenW (lpString=".v2i") returned 4 [0084.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".v2i") returned 0x0 [0084.379] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.385] lstrlenW (lpString=".sql") returned 4 [0084.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".sql") returned 0x0 [0084.385] lstrlenW (lpString=".mdf") returned 4 [0084.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".mdf") returned 0x0 [0084.385] lstrlenW (lpString=".txt") returned 4 [0084.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".txt") returned 0x0 [0084.385] lstrlenW (lpString=".dbf") returned 4 [0084.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".dbf") returned 0x0 [0084.385] lstrlenW (lpString=".ckp") returned 4 [0084.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".ckp") returned 0x0 [0084.386] lstrlenW (lpString=".dacpac") returned 7 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".dacpac") returned 0x0 [0084.386] lstrlenW (lpString=".db3") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".db3") returned 0x0 [0084.386] lstrlenW (lpString=".dtxs") returned 5 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".dtxs") returned 0x0 [0084.386] lstrlenW (lpString=".mdt") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".mdt") returned 0x0 [0084.386] lstrlenW (lpString=".sdf") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".sdf") returned 0x0 [0084.386] lstrlenW (lpString=".MDF") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".MDF") returned 0x0 [0084.386] lstrlenW (lpString=".DBF") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".DBF") returned 0x0 [0084.386] lstrlenW (lpString=".DB") returned 3 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".DB") returned 0x0 [0084.386] lstrlenW (lpString=".db") returned 3 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".db") returned 0x0 [0084.386] lstrlenW (lpString=".ndf") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".ndf") returned 0x0 [0084.386] lstrlenW (lpString=".NDF") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".NDF") returned 0x0 [0084.386] lstrlenW (lpString=".Mdf") returned 4 [0084.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".Mdf") returned 0x0 [0084.386] lstrlenW (lpString=".dat") returned 4 [0084.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".dat") returned 0x0 [0084.387] lstrlenW (lpString=".DAT") returned 4 [0084.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".DAT") returned 0x0 [0084.387] lstrlenW (lpString=".ldf") returned 4 [0084.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".ldf") returned 0x0 [0084.387] lstrlenW (lpString=".LDF") returned 4 [0084.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch=".LDF") returned 0x0 [0084.387] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.387] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.387] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.388] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.388] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.388] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20438917040) returned 1 [0084.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc11c98f0, dwHighDateTime=0x1d585b4)) [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a048 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a048 | out: hHeap=0x260000) returned 1 [0084.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750f38 [0084.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.389] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.389] GetLastError () returned 0x0 [0084.389] GetLastError () returned 0x0 [0084.389] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.389] GetLastError () returned 0x0 [0084.390] GetLastError () returned 0x0 [0084.391] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.391] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.391] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.391] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.392] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.392] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.392] CloseHandle (hObject=0x11c) returned 1 [0084.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0084.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0084.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.394] GetLastError () returned 0x0 [0084.395] RtlWakeConditionVariable () returned 0x0 [0084.395] GetCurrentThreadId () returned 0x99c [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".ldf") returned 0x0 [0084.395] lstrlenW (lpString=".vhd") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".vhd") returned 0x0 [0084.395] lstrlenW (lpString=".vhdx") returned 5 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".vhdx") returned 0x0 [0084.395] lstrlenW (lpString=".pst") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".pst") returned 0x0 [0084.395] lstrlenW (lpString=".ost") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".ost") returned 0x0 [0084.395] lstrlenW (lpString=".bak") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".bak") returned 0x0 [0084.395] lstrlenW (lpString=".bac") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".bac") returned 0x0 [0084.395] lstrlenW (lpString=".sys") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".sys") returned 0x0 [0084.395] lstrlenW (lpString=".v2i") returned 4 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".v2i") returned 0x0 [0084.395] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.397] lstrlenW (lpString=".sql") returned 4 [0084.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".sql") returned 0x0 [0084.397] lstrlenW (lpString=".mdf") returned 4 [0084.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".mdf") returned 0x0 [0084.397] lstrlenW (lpString=".txt") returned 4 [0084.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".txt") returned 0x0 [0084.397] lstrlenW (lpString=".dbf") returned 4 [0084.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".dbf") returned 0x0 [0084.397] lstrlenW (lpString=".ckp") returned 4 [0084.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".ckp") returned 0x0 [0084.398] lstrlenW (lpString=".dacpac") returned 7 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".dacpac") returned 0x0 [0084.398] lstrlenW (lpString=".db3") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".db3") returned 0x0 [0084.398] lstrlenW (lpString=".dtxs") returned 5 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".dtxs") returned 0x0 [0084.398] lstrlenW (lpString=".mdt") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".mdt") returned 0x0 [0084.398] lstrlenW (lpString=".sdf") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".sdf") returned 0x0 [0084.398] lstrlenW (lpString=".MDF") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".MDF") returned 0x0 [0084.398] lstrlenW (lpString=".DBF") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".DBF") returned 0x0 [0084.398] lstrlenW (lpString=".DB") returned 3 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".DB") returned 0x0 [0084.398] lstrlenW (lpString=".db") returned 3 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".db") returned 0x0 [0084.398] lstrlenW (lpString=".ndf") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".ndf") returned 0x0 [0084.398] lstrlenW (lpString=".NDF") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".NDF") returned 0x0 [0084.398] lstrlenW (lpString=".Mdf") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".Mdf") returned 0x0 [0084.398] lstrlenW (lpString=".dat") returned 4 [0084.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".dat") returned 0x0 [0084.399] lstrlenW (lpString=".DAT") returned 4 [0084.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".DAT") returned 0x0 [0084.399] lstrlenW (lpString=".ldf") returned 4 [0084.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".ldf") returned 0x0 [0084.399] lstrlenW (lpString=".LDF") returned 4 [0084.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch=".LDF") returned 0x0 [0084.399] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.399] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.400] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.400] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.400] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20440112133) returned 1 [0084.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc11efa50, dwHighDateTime=0x1d585b4)) [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a080 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a080 | out: hHeap=0x260000) returned 1 [0084.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750ea0 [0084.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.401] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.401] GetLastError () returned 0x0 [0084.401] GetLastError () returned 0x0 [0084.401] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.401] GetLastError () returned 0x0 [0084.402] GetLastError () returned 0x0 [0084.404] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.405] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.405] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.405] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.405] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.405] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.405] CloseHandle (hObject=0x11c) returned 1 [0084.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0084.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0084.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.407] GetLastError () returned 0x0 [0084.407] RtlWakeConditionVariable () returned 0x27e828 [0084.408] GetCurrentThreadId () returned 0x99c [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".ldf") returned 0x0 [0084.408] lstrlenW (lpString=".vhd") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".vhd") returned 0x0 [0084.408] lstrlenW (lpString=".vhdx") returned 5 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".vhdx") returned 0x0 [0084.408] lstrlenW (lpString=".pst") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".pst") returned 0x0 [0084.408] lstrlenW (lpString=".ost") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".ost") returned 0x0 [0084.408] lstrlenW (lpString=".bak") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".bak") returned 0x0 [0084.408] lstrlenW (lpString=".bac") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".bac") returned 0x0 [0084.408] lstrlenW (lpString=".sys") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".sys") returned 0x0 [0084.408] lstrlenW (lpString=".v2i") returned 4 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".v2i") returned 0x0 [0084.408] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.410] lstrlenW (lpString=".sql") returned 4 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".sql") returned 0x0 [0084.410] lstrlenW (lpString=".mdf") returned 4 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".mdf") returned 0x0 [0084.410] lstrlenW (lpString=".txt") returned 4 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".txt") returned 0x0 [0084.410] lstrlenW (lpString=".dbf") returned 4 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".dbf") returned 0x0 [0084.410] lstrlenW (lpString=".ckp") returned 4 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".ckp") returned 0x0 [0084.410] lstrlenW (lpString=".dacpac") returned 7 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".dacpac") returned 0x0 [0084.410] lstrlenW (lpString=".db3") returned 4 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".db3") returned 0x0 [0084.410] lstrlenW (lpString=".dtxs") returned 5 [0084.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".dtxs") returned 0x0 [0084.411] lstrlenW (lpString=".mdt") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".mdt") returned 0x0 [0084.411] lstrlenW (lpString=".sdf") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".sdf") returned 0x0 [0084.411] lstrlenW (lpString=".MDF") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".MDF") returned 0x0 [0084.411] lstrlenW (lpString=".DBF") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".DBF") returned 0x0 [0084.411] lstrlenW (lpString=".DB") returned 3 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".DB") returned 0x0 [0084.411] lstrlenW (lpString=".db") returned 3 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".db") returned 0x0 [0084.411] lstrlenW (lpString=".ndf") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".ndf") returned 0x0 [0084.411] lstrlenW (lpString=".NDF") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".NDF") returned 0x0 [0084.411] lstrlenW (lpString=".Mdf") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".Mdf") returned 0x0 [0084.411] lstrlenW (lpString=".dat") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".dat") returned 0x0 [0084.411] lstrlenW (lpString=".DAT") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".DAT") returned 0x0 [0084.411] lstrlenW (lpString=".ldf") returned 4 [0084.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".ldf") returned 0x0 [0084.411] lstrlenW (lpString=".LDF") returned 4 [0084.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch=".LDF") returned 0x0 [0084.412] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.412] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.413] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.413] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.413] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20441399649) returned 1 [0084.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1215bb0, dwHighDateTime=0x1d585b4)) [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a0b8 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a0b8 | out: hHeap=0x260000) returned 1 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750b10 [0084.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.414] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.414] GetLastError () returned 0x0 [0084.414] GetLastError () returned 0x0 [0084.414] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.414] GetLastError () returned 0x0 [0084.414] GetLastError () returned 0x0 [0084.416] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.416] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.416] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.416] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.417] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.417] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.417] CloseHandle (hObject=0x11c) returned 1 [0084.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0084.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0084.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.419] GetLastError () returned 0x0 [0084.419] RtlWakeConditionVariable () returned 0x27e828 [0084.419] GetCurrentThreadId () returned 0x99c [0084.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".ldf") returned 0x0 [0084.419] lstrlenW (lpString=".vhd") returned 4 [0084.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".vhd") returned 0x0 [0084.419] lstrlenW (lpString=".vhdx") returned 5 [0084.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".vhdx") returned 0x0 [0084.419] lstrlenW (lpString=".pst") returned 4 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".pst") returned 0x0 [0084.420] lstrlenW (lpString=".ost") returned 4 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".ost") returned 0x0 [0084.420] lstrlenW (lpString=".bak") returned 4 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".bak") returned 0x0 [0084.420] lstrlenW (lpString=".bac") returned 4 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".bac") returned 0x0 [0084.420] lstrlenW (lpString=".sys") returned 4 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".sys") returned 0x0 [0084.420] lstrlenW (lpString=".v2i") returned 4 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".v2i") returned 0x0 [0084.420] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.422] lstrlenW (lpString=".sql") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".sql") returned 0x0 [0084.422] lstrlenW (lpString=".mdf") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".mdf") returned 0x0 [0084.422] lstrlenW (lpString=".txt") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".txt") returned 0x0 [0084.422] lstrlenW (lpString=".dbf") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".dbf") returned 0x0 [0084.422] lstrlenW (lpString=".ckp") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".ckp") returned 0x0 [0084.422] lstrlenW (lpString=".dacpac") returned 7 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".dacpac") returned 0x0 [0084.422] lstrlenW (lpString=".db3") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".db3") returned 0x0 [0084.422] lstrlenW (lpString=".dtxs") returned 5 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".dtxs") returned 0x0 [0084.422] lstrlenW (lpString=".mdt") returned 4 [0084.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".mdt") returned 0x0 [0084.423] lstrlenW (lpString=".sdf") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".sdf") returned 0x0 [0084.423] lstrlenW (lpString=".MDF") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".MDF") returned 0x0 [0084.423] lstrlenW (lpString=".DBF") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".DBF") returned 0x0 [0084.423] lstrlenW (lpString=".DB") returned 3 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".DB") returned 0x0 [0084.423] lstrlenW (lpString=".db") returned 3 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".db") returned 0x0 [0084.423] lstrlenW (lpString=".ndf") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".ndf") returned 0x0 [0084.423] lstrlenW (lpString=".NDF") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".NDF") returned 0x0 [0084.423] lstrlenW (lpString=".Mdf") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".Mdf") returned 0x0 [0084.423] lstrlenW (lpString=".dat") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".dat") returned 0x0 [0084.423] lstrlenW (lpString=".DAT") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".DAT") returned 0x0 [0084.423] lstrlenW (lpString=".ldf") returned 4 [0084.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".ldf") returned 0x0 [0084.423] lstrlenW (lpString=".LDF") returned 4 [0084.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch=".LDF") returned 0x0 [0084.424] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.424] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.425] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.425] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20442606067) returned 1 [0084.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1215bb0, dwHighDateTime=0x1d585b4)) [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a0f0 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a0f0 | out: hHeap=0x260000) returned 1 [0084.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750d70 [0084.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.426] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.426] GetLastError () returned 0x0 [0084.426] GetLastError () returned 0x0 [0084.426] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.426] GetLastError () returned 0x0 [0084.427] GetLastError () returned 0x0 [0084.517] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.517] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.517] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.517] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.517] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.517] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.517] CloseHandle (hObject=0x11c) returned 1 [0084.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.519] GetLastError () returned 0x0 [0084.519] RtlWakeConditionVariable () returned 0x0 [0084.520] GetCurrentThreadId () returned 0x99c [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".ldf") returned 0x0 [0084.520] lstrlenW (lpString=".vhd") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".vhd") returned 0x0 [0084.520] lstrlenW (lpString=".vhdx") returned 5 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".vhdx") returned 0x0 [0084.520] lstrlenW (lpString=".pst") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".pst") returned 0x0 [0084.520] lstrlenW (lpString=".ost") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".ost") returned 0x0 [0084.520] lstrlenW (lpString=".bak") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".bak") returned 0x0 [0084.520] lstrlenW (lpString=".bac") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".bac") returned 0x0 [0084.520] lstrlenW (lpString=".sys") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".sys") returned 0x0 [0084.520] lstrlenW (lpString=".v2i") returned 4 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".v2i") returned 0x0 [0084.520] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.522] lstrlenW (lpString=".sql") returned 4 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".sql") returned 0x0 [0084.522] lstrlenW (lpString=".mdf") returned 4 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".mdf") returned 0x0 [0084.522] lstrlenW (lpString=".txt") returned 4 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".txt") returned 0x0 [0084.522] lstrlenW (lpString=".dbf") returned 4 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".dbf") returned 0x0 [0084.522] lstrlenW (lpString=".ckp") returned 4 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".ckp") returned 0x0 [0084.522] lstrlenW (lpString=".dacpac") returned 7 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".dacpac") returned 0x0 [0084.522] lstrlenW (lpString=".db3") returned 4 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".db3") returned 0x0 [0084.522] lstrlenW (lpString=".dtxs") returned 5 [0084.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".dtxs") returned 0x0 [0084.523] lstrlenW (lpString=".mdt") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".mdt") returned 0x0 [0084.523] lstrlenW (lpString=".sdf") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".sdf") returned 0x0 [0084.523] lstrlenW (lpString=".MDF") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".MDF") returned 0x0 [0084.523] lstrlenW (lpString=".DBF") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".DBF") returned 0x0 [0084.523] lstrlenW (lpString=".DB") returned 3 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".DB") returned 0x0 [0084.523] lstrlenW (lpString=".db") returned 3 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".db") returned 0x0 [0084.523] lstrlenW (lpString=".ndf") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".ndf") returned 0x0 [0084.523] lstrlenW (lpString=".NDF") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".NDF") returned 0x0 [0084.523] lstrlenW (lpString=".Mdf") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".Mdf") returned 0x0 [0084.523] lstrlenW (lpString=".dat") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".dat") returned 0x0 [0084.523] lstrlenW (lpString=".DAT") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".DAT") returned 0x0 [0084.523] lstrlenW (lpString=".ldf") returned 4 [0084.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".ldf") returned 0x0 [0084.523] lstrlenW (lpString=".LDF") returned 4 [0084.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch=".LDF") returned 0x0 [0084.524] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.524] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.524] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.525] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.525] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20452586397) returned 1 [0084.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1320550, dwHighDateTime=0x1d585b4)) [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1890 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1890 | out: hHeap=0x260000) returned 1 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750cd8 [0084.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.525] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.526] GetLastError () returned 0x0 [0084.526] GetLastError () returned 0x0 [0084.526] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.526] GetLastError () returned 0x0 [0084.526] GetLastError () returned 0x0 [0084.529] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.529] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.529] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.529] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.529] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.529] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.530] CloseHandle (hObject=0x11c) returned 1 [0084.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.532] GetLastError () returned 0x0 [0084.532] RtlWakeConditionVariable () returned 0x0 [0084.534] GetCurrentThreadId () returned 0x99c [0084.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".ldf") returned 0x0 [0084.534] lstrlenW (lpString=".vhd") returned 4 [0084.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".vhd") returned 0x0 [0084.534] lstrlenW (lpString=".vhdx") returned 5 [0084.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".vhdx") returned 0x0 [0084.534] lstrlenW (lpString=".pst") returned 4 [0084.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".pst") returned 0x0 [0084.534] lstrlenW (lpString=".ost") returned 4 [0084.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".ost") returned 0x0 [0084.535] lstrlenW (lpString=".bak") returned 4 [0084.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".bak") returned 0x0 [0084.535] lstrlenW (lpString=".bac") returned 4 [0084.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".bac") returned 0x0 [0084.535] lstrlenW (lpString=".sys") returned 4 [0084.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".sys") returned 0x0 [0084.535] lstrlenW (lpString=".v2i") returned 4 [0084.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".v2i") returned 0x0 [0084.535] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.536] lstrlenW (lpString=".sql") returned 4 [0084.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".sql") returned 0x0 [0084.537] lstrlenW (lpString=".mdf") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".mdf") returned 0x0 [0084.537] lstrlenW (lpString=".txt") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".txt") returned 0x0 [0084.537] lstrlenW (lpString=".dbf") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".dbf") returned 0x0 [0084.537] lstrlenW (lpString=".ckp") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".ckp") returned 0x0 [0084.537] lstrlenW (lpString=".dacpac") returned 7 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".dacpac") returned 0x0 [0084.537] lstrlenW (lpString=".db3") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".db3") returned 0x0 [0084.537] lstrlenW (lpString=".dtxs") returned 5 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".dtxs") returned 0x0 [0084.537] lstrlenW (lpString=".mdt") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".mdt") returned 0x0 [0084.537] lstrlenW (lpString=".sdf") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".sdf") returned 0x0 [0084.537] lstrlenW (lpString=".MDF") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".MDF") returned 0x0 [0084.537] lstrlenW (lpString=".DBF") returned 4 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".DBF") returned 0x0 [0084.537] lstrlenW (lpString=".DB") returned 3 [0084.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".DB") returned 0x0 [0084.537] lstrlenW (lpString=".db") returned 3 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".db") returned 0x0 [0084.538] lstrlenW (lpString=".ndf") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".ndf") returned 0x0 [0084.538] lstrlenW (lpString=".NDF") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".NDF") returned 0x0 [0084.538] lstrlenW (lpString=".Mdf") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".Mdf") returned 0x0 [0084.538] lstrlenW (lpString=".dat") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".dat") returned 0x0 [0084.538] lstrlenW (lpString=".DAT") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".DAT") returned 0x0 [0084.538] lstrlenW (lpString=".ldf") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".ldf") returned 0x0 [0084.538] lstrlenW (lpString=".LDF") returned 4 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch=".LDF") returned 0x0 [0084.538] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.538] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.539] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.539] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20454039431) returned 1 [0084.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc13466b0, dwHighDateTime=0x1d585b4)) [0084.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1970 [0084.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1970 | out: hHeap=0x260000) returned 1 [0084.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750650 [0084.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.540] GetLastError () returned 0x0 [0084.540] GetLastError () returned 0x0 [0084.540] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.541] GetLastError () returned 0x0 [0084.541] GetLastError () returned 0x0 [0084.542] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd79, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.542] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x287, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x287, lpOverlapped=0x0) returned 1 [0084.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.542] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.542] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.542] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.542] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.542] CloseHandle (hObject=0x11c) returned 1 [0084.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.544] GetLastError () returned 0x0 [0084.544] RtlWakeConditionVariable () returned 0x27e828 [0084.544] GetCurrentThreadId () returned 0x99c [0084.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".ldf") returned 0x0 [0084.544] lstrlenW (lpString=".vhd") returned 4 [0084.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".vhd") returned 0x0 [0084.544] lstrlenW (lpString=".vhdx") returned 5 [0084.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".vhdx") returned 0x0 [0084.545] lstrlenW (lpString=".pst") returned 4 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".pst") returned 0x0 [0084.545] lstrlenW (lpString=".ost") returned 4 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".ost") returned 0x0 [0084.545] lstrlenW (lpString=".bak") returned 4 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".bak") returned 0x0 [0084.545] lstrlenW (lpString=".bac") returned 4 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".bac") returned 0x0 [0084.545] lstrlenW (lpString=".sys") returned 4 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".sys") returned 0x0 [0084.545] lstrlenW (lpString=".v2i") returned 4 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".v2i") returned 0x0 [0084.545] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.546] lstrlenW (lpString=".sql") returned 4 [0084.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".sql") returned 0x0 [0084.546] lstrlenW (lpString=".mdf") returned 4 [0084.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".mdf") returned 0x0 [0084.546] lstrlenW (lpString=".txt") returned 4 [0084.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".txt") returned 0x0 [0084.546] lstrlenW (lpString=".dbf") returned 4 [0084.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".dbf") returned 0x0 [0084.546] lstrlenW (lpString=".ckp") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".ckp") returned 0x0 [0084.547] lstrlenW (lpString=".dacpac") returned 7 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".dacpac") returned 0x0 [0084.547] lstrlenW (lpString=".db3") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".db3") returned 0x0 [0084.547] lstrlenW (lpString=".dtxs") returned 5 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".dtxs") returned 0x0 [0084.547] lstrlenW (lpString=".mdt") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".mdt") returned 0x0 [0084.547] lstrlenW (lpString=".sdf") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".sdf") returned 0x0 [0084.547] lstrlenW (lpString=".MDF") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".MDF") returned 0x0 [0084.547] lstrlenW (lpString=".DBF") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".DBF") returned 0x0 [0084.547] lstrlenW (lpString=".DB") returned 3 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".DB") returned 0x0 [0084.547] lstrlenW (lpString=".db") returned 3 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".db") returned 0x0 [0084.547] lstrlenW (lpString=".ndf") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".ndf") returned 0x0 [0084.547] lstrlenW (lpString=".NDF") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".NDF") returned 0x0 [0084.547] lstrlenW (lpString=".Mdf") returned 4 [0084.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".Mdf") returned 0x0 [0084.548] lstrlenW (lpString=".dat") returned 4 [0084.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".dat") returned 0x0 [0084.548] lstrlenW (lpString=".DAT") returned 4 [0084.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".DAT") returned 0x0 [0084.548] lstrlenW (lpString=".ldf") returned 4 [0084.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".ldf") returned 0x0 [0084.548] lstrlenW (lpString=".LDF") returned 4 [0084.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch=".LDF") returned 0x0 [0084.548] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.548] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.549] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.549] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.549] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20455011569) returned 1 [0084.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc13466b0, dwHighDateTime=0x1d585b4)) [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f18c8 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f18c8 | out: hHeap=0x260000) returned 1 [0084.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750358 [0084.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.550] GetLastError () returned 0x0 [0084.550] GetLastError () returned 0x0 [0084.550] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.550] GetLastError () returned 0x0 [0084.550] GetLastError () returned 0x0 [0084.552] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.552] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.552] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.552] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.553] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.553] CloseHandle (hObject=0x11c) returned 1 [0084.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.554] GetLastError () returned 0x0 [0084.554] RtlWakeConditionVariable () returned 0x0 [0084.554] GetCurrentThreadId () returned 0x99c [0084.554] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".ldf") returned 0x0 [0084.555] lstrlenW (lpString=".vhd") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".vhd") returned 0x0 [0084.555] lstrlenW (lpString=".vhdx") returned 5 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".vhdx") returned 0x0 [0084.555] lstrlenW (lpString=".pst") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".pst") returned 0x0 [0084.555] lstrlenW (lpString=".ost") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".ost") returned 0x0 [0084.555] lstrlenW (lpString=".bak") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".bak") returned 0x0 [0084.555] lstrlenW (lpString=".bac") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".bac") returned 0x0 [0084.555] lstrlenW (lpString=".sys") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".sys") returned 0x0 [0084.555] lstrlenW (lpString=".v2i") returned 4 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".v2i") returned 0x0 [0084.555] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.556] lstrlenW (lpString=".sql") returned 4 [0084.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".sql") returned 0x0 [0084.556] lstrlenW (lpString=".mdf") returned 4 [0084.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".mdf") returned 0x0 [0084.556] lstrlenW (lpString=".txt") returned 4 [0084.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".txt") returned 0x0 [0084.557] lstrlenW (lpString=".dbf") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".dbf") returned 0x0 [0084.557] lstrlenW (lpString=".ckp") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".ckp") returned 0x0 [0084.557] lstrlenW (lpString=".dacpac") returned 7 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".dacpac") returned 0x0 [0084.557] lstrlenW (lpString=".db3") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".db3") returned 0x0 [0084.557] lstrlenW (lpString=".dtxs") returned 5 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".dtxs") returned 0x0 [0084.557] lstrlenW (lpString=".mdt") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".mdt") returned 0x0 [0084.557] lstrlenW (lpString=".sdf") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".sdf") returned 0x0 [0084.557] lstrlenW (lpString=".MDF") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".MDF") returned 0x0 [0084.557] lstrlenW (lpString=".DBF") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".DBF") returned 0x0 [0084.557] lstrlenW (lpString=".DB") returned 3 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".DB") returned 0x0 [0084.557] lstrlenW (lpString=".db") returned 3 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".db") returned 0x0 [0084.557] lstrlenW (lpString=".ndf") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".ndf") returned 0x0 [0084.557] lstrlenW (lpString=".NDF") returned 4 [0084.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".NDF") returned 0x0 [0084.558] lstrlenW (lpString=".Mdf") returned 4 [0084.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".Mdf") returned 0x0 [0084.558] lstrlenW (lpString=".dat") returned 4 [0084.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".dat") returned 0x0 [0084.558] lstrlenW (lpString=".DAT") returned 4 [0084.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".DAT") returned 0x0 [0084.558] lstrlenW (lpString=".ldf") returned 4 [0084.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".ldf") returned 0x0 [0084.558] lstrlenW (lpString=".LDF") returned 4 [0084.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch=".LDF") returned 0x0 [0084.558] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.558] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.559] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.559] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20456021081) returned 1 [0084.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc136c810, dwHighDateTime=0x1d585b4)) [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1900 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1900 | out: hHeap=0x260000) returned 1 [0084.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27502c0 [0084.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.560] GetLastError () returned 0x0 [0084.560] GetLastError () returned 0x0 [0084.560] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.560] GetLastError () returned 0x0 [0084.561] GetLastError () returned 0x0 [0084.562] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.562] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.562] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.562] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.563] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.563] CloseHandle (hObject=0x11c) returned 1 [0084.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.564] GetLastError () returned 0x0 [0084.564] RtlWakeConditionVariable () returned 0x0 [0084.564] GetCurrentThreadId () returned 0x99c [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".ldf") returned 0x0 [0084.565] lstrlenW (lpString=".vhd") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".vhd") returned 0x0 [0084.565] lstrlenW (lpString=".vhdx") returned 5 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".vhdx") returned 0x0 [0084.565] lstrlenW (lpString=".pst") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".pst") returned 0x0 [0084.565] lstrlenW (lpString=".ost") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".ost") returned 0x0 [0084.565] lstrlenW (lpString=".bak") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".bak") returned 0x0 [0084.565] lstrlenW (lpString=".bac") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".bac") returned 0x0 [0084.565] lstrlenW (lpString=".sys") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".sys") returned 0x0 [0084.565] lstrlenW (lpString=".v2i") returned 4 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".v2i") returned 0x0 [0084.565] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.566] lstrlenW (lpString=".sql") returned 4 [0084.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".sql") returned 0x0 [0084.566] lstrlenW (lpString=".mdf") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".mdf") returned 0x0 [0084.567] lstrlenW (lpString=".txt") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".txt") returned 0x0 [0084.567] lstrlenW (lpString=".dbf") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".dbf") returned 0x0 [0084.567] lstrlenW (lpString=".ckp") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".ckp") returned 0x0 [0084.567] lstrlenW (lpString=".dacpac") returned 7 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".dacpac") returned 0x0 [0084.567] lstrlenW (lpString=".db3") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".db3") returned 0x0 [0084.567] lstrlenW (lpString=".dtxs") returned 5 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".dtxs") returned 0x0 [0084.567] lstrlenW (lpString=".mdt") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".mdt") returned 0x0 [0084.567] lstrlenW (lpString=".sdf") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".sdf") returned 0x0 [0084.567] lstrlenW (lpString=".MDF") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".MDF") returned 0x0 [0084.567] lstrlenW (lpString=".DBF") returned 4 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".DBF") returned 0x0 [0084.567] lstrlenW (lpString=".DB") returned 3 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".DB") returned 0x0 [0084.567] lstrlenW (lpString=".db") returned 3 [0084.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".db") returned 0x0 [0084.567] lstrlenW (lpString=".ndf") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".ndf") returned 0x0 [0084.568] lstrlenW (lpString=".NDF") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".NDF") returned 0x0 [0084.568] lstrlenW (lpString=".Mdf") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".Mdf") returned 0x0 [0084.568] lstrlenW (lpString=".dat") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".dat") returned 0x0 [0084.568] lstrlenW (lpString=".DAT") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".DAT") returned 0x0 [0084.568] lstrlenW (lpString=".ldf") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".ldf") returned 0x0 [0084.568] lstrlenW (lpString=".LDF") returned 4 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch=".LDF") returned 0x0 [0084.568] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.568] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.569] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.569] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20457057853) returned 1 [0084.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1392970, dwHighDateTime=0x1d585b4)) [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1938 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1938 | out: hHeap=0x260000) returned 1 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750228 [0084.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.570] GetLastError () returned 0x0 [0084.571] GetLastError () returned 0x0 [0084.571] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.571] GetLastError () returned 0x0 [0084.571] GetLastError () returned 0x0 [0084.572] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcfd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.572] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x303, lpOverlapped=0x0) returned 1 [0084.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.573] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.573] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.573] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.573] CloseHandle (hObject=0x11c) returned 1 [0084.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.575] GetLastError () returned 0x0 [0084.575] RtlWakeConditionVariable () returned 0x0 [0084.575] GetCurrentThreadId () returned 0x99c [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".ldf") returned 0x0 [0084.575] lstrlenW (lpString=".vhd") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".vhd") returned 0x0 [0084.575] lstrlenW (lpString=".vhdx") returned 5 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".vhdx") returned 0x0 [0084.575] lstrlenW (lpString=".pst") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".pst") returned 0x0 [0084.575] lstrlenW (lpString=".ost") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".ost") returned 0x0 [0084.575] lstrlenW (lpString=".bak") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".bak") returned 0x0 [0084.575] lstrlenW (lpString=".bac") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".bac") returned 0x0 [0084.575] lstrlenW (lpString=".sys") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".sys") returned 0x0 [0084.575] lstrlenW (lpString=".v2i") returned 4 [0084.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".v2i") returned 0x0 [0084.576] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.577] lstrlenW (lpString=".sql") returned 4 [0084.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".sql") returned 0x0 [0084.577] lstrlenW (lpString=".mdf") returned 4 [0084.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".mdf") returned 0x0 [0084.577] lstrlenW (lpString=".txt") returned 4 [0084.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".txt") returned 0x0 [0084.577] lstrlenW (lpString=".dbf") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".dbf") returned 0x0 [0084.578] lstrlenW (lpString=".ckp") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".ckp") returned 0x0 [0084.578] lstrlenW (lpString=".dacpac") returned 7 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".dacpac") returned 0x0 [0084.578] lstrlenW (lpString=".db3") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".db3") returned 0x0 [0084.578] lstrlenW (lpString=".dtxs") returned 5 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".dtxs") returned 0x0 [0084.578] lstrlenW (lpString=".mdt") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".mdt") returned 0x0 [0084.578] lstrlenW (lpString=".sdf") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".sdf") returned 0x0 [0084.578] lstrlenW (lpString=".MDF") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".MDF") returned 0x0 [0084.578] lstrlenW (lpString=".DBF") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".DBF") returned 0x0 [0084.578] lstrlenW (lpString=".DB") returned 3 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".DB") returned 0x0 [0084.578] lstrlenW (lpString=".db") returned 3 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".db") returned 0x0 [0084.578] lstrlenW (lpString=".ndf") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".ndf") returned 0x0 [0084.578] lstrlenW (lpString=".NDF") returned 4 [0084.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".NDF") returned 0x0 [0084.579] lstrlenW (lpString=".Mdf") returned 4 [0084.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".Mdf") returned 0x0 [0084.579] lstrlenW (lpString=".dat") returned 4 [0084.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".dat") returned 0x0 [0084.579] lstrlenW (lpString=".DAT") returned 4 [0084.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".DAT") returned 0x0 [0084.579] lstrlenW (lpString=".ldf") returned 4 [0084.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".ldf") returned 0x0 [0084.579] lstrlenW (lpString=".LDF") returned 4 [0084.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch=".LDF") returned 0x0 [0084.579] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.579] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.580] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.580] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20458117537) returned 1 [0084.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1392970, dwHighDateTime=0x1d585b4)) [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f19a8 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f19a8 | out: hHeap=0x260000) returned 1 [0084.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750190 [0084.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.581] GetLastError () returned 0x0 [0084.581] GetLastError () returned 0x0 [0084.581] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.581] GetLastError () returned 0x0 [0084.581] GetLastError () returned 0x0 [0084.582] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.583] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x298, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x298, lpOverlapped=0x0) returned 1 [0084.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.583] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.583] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.583] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.583] CloseHandle (hObject=0x11c) returned 1 [0084.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.585] GetLastError () returned 0x0 [0084.585] RtlWakeConditionVariable () returned 0x0 [0084.585] GetCurrentThreadId () returned 0x99c [0084.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".ldf") returned 0x0 [0084.585] lstrlenW (lpString=".vhd") returned 4 [0084.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".vhd") returned 0x0 [0084.585] lstrlenW (lpString=".vhdx") returned 5 [0084.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".vhdx") returned 0x0 [0084.585] lstrlenW (lpString=".pst") returned 4 [0084.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".pst") returned 0x0 [0084.585] lstrlenW (lpString=".ost") returned 4 [0084.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".ost") returned 0x0 [0084.585] lstrlenW (lpString=".bak") returned 4 [0084.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".bak") returned 0x0 [0084.586] lstrlenW (lpString=".bac") returned 4 [0084.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".bac") returned 0x0 [0084.586] lstrlenW (lpString=".sys") returned 4 [0084.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".sys") returned 0x0 [0084.586] lstrlenW (lpString=".v2i") returned 4 [0084.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".v2i") returned 0x0 [0084.586] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.587] lstrlenW (lpString=".sql") returned 4 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".sql") returned 0x0 [0084.587] lstrlenW (lpString=".mdf") returned 4 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".mdf") returned 0x0 [0084.587] lstrlenW (lpString=".txt") returned 4 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".txt") returned 0x0 [0084.587] lstrlenW (lpString=".dbf") returned 4 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".dbf") returned 0x0 [0084.587] lstrlenW (lpString=".ckp") returned 4 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".ckp") returned 0x0 [0084.587] lstrlenW (lpString=".dacpac") returned 7 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".dacpac") returned 0x0 [0084.587] lstrlenW (lpString=".db3") returned 4 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".db3") returned 0x0 [0084.587] lstrlenW (lpString=".dtxs") returned 5 [0084.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".dtxs") returned 0x0 [0084.587] lstrlenW (lpString=".mdt") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".mdt") returned 0x0 [0084.588] lstrlenW (lpString=".sdf") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".sdf") returned 0x0 [0084.588] lstrlenW (lpString=".MDF") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".MDF") returned 0x0 [0084.588] lstrlenW (lpString=".DBF") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".DBF") returned 0x0 [0084.588] lstrlenW (lpString=".DB") returned 3 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".DB") returned 0x0 [0084.588] lstrlenW (lpString=".db") returned 3 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".db") returned 0x0 [0084.588] lstrlenW (lpString=".ndf") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".ndf") returned 0x0 [0084.588] lstrlenW (lpString=".NDF") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".NDF") returned 0x0 [0084.588] lstrlenW (lpString=".Mdf") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".Mdf") returned 0x0 [0084.588] lstrlenW (lpString=".dat") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".dat") returned 0x0 [0084.588] lstrlenW (lpString=".DAT") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".DAT") returned 0x0 [0084.588] lstrlenW (lpString=".ldf") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".ldf") returned 0x0 [0084.588] lstrlenW (lpString=".LDF") returned 4 [0084.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch=".LDF") returned 0x0 [0084.588] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.589] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.589] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.590] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20459079157) returned 1 [0084.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc13b8ad0, dwHighDateTime=0x1d585b4)) [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f01f8 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01f8 | out: hHeap=0x260000) returned 1 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0084.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.590] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.591] GetLastError () returned 0x0 [0084.591] GetLastError () returned 0x0 [0084.591] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.591] GetLastError () returned 0x0 [0084.591] GetLastError () returned 0x0 [0084.717] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.717] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.717] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.717] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.717] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.717] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.717] CloseHandle (hObject=0x11c) returned 1 [0084.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.719] GetLastError () returned 0x0 [0084.719] RtlWakeConditionVariable () returned 0x0 [0084.719] GetCurrentThreadId () returned 0x99c [0084.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".ldf") returned 0x0 [0084.719] lstrlenW (lpString=".vhd") returned 4 [0084.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".vhd") returned 0x0 [0084.719] lstrlenW (lpString=".vhdx") returned 5 [0084.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".vhdx") returned 0x0 [0084.719] lstrlenW (lpString=".pst") returned 4 [0084.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".pst") returned 0x0 [0084.719] lstrlenW (lpString=".ost") returned 4 [0084.720] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".ost") returned 0x0 [0084.720] lstrlenW (lpString=".bak") returned 4 [0084.720] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".bak") returned 0x0 [0084.720] lstrlenW (lpString=".bac") returned 4 [0084.720] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".bac") returned 0x0 [0084.720] lstrlenW (lpString=".sys") returned 4 [0084.720] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".sys") returned 0x0 [0084.720] lstrlenW (lpString=".v2i") returned 4 [0084.720] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".v2i") returned 0x0 [0084.720] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.720] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.721] lstrlenW (lpString=".sql") returned 4 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".sql") returned 0x0 [0084.721] lstrlenW (lpString=".mdf") returned 4 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".mdf") returned 0x0 [0084.721] lstrlenW (lpString=".txt") returned 4 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".txt") returned 0x0 [0084.721] lstrlenW (lpString=".dbf") returned 4 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".dbf") returned 0x0 [0084.721] lstrlenW (lpString=".ckp") returned 4 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".ckp") returned 0x0 [0084.721] lstrlenW (lpString=".dacpac") returned 7 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".dacpac") returned 0x0 [0084.721] lstrlenW (lpString=".db3") returned 4 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".db3") returned 0x0 [0084.721] lstrlenW (lpString=".dtxs") returned 5 [0084.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".dtxs") returned 0x0 [0084.721] lstrlenW (lpString=".mdt") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".mdt") returned 0x0 [0084.722] lstrlenW (lpString=".sdf") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".sdf") returned 0x0 [0084.722] lstrlenW (lpString=".MDF") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".MDF") returned 0x0 [0084.722] lstrlenW (lpString=".DBF") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".DBF") returned 0x0 [0084.722] lstrlenW (lpString=".DB") returned 3 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".DB") returned 0x0 [0084.722] lstrlenW (lpString=".db") returned 3 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".db") returned 0x0 [0084.722] lstrlenW (lpString=".ndf") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".ndf") returned 0x0 [0084.722] lstrlenW (lpString=".NDF") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".NDF") returned 0x0 [0084.722] lstrlenW (lpString=".Mdf") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".Mdf") returned 0x0 [0084.722] lstrlenW (lpString=".dat") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".dat") returned 0x0 [0084.722] lstrlenW (lpString=".DAT") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".DAT") returned 0x0 [0084.722] lstrlenW (lpString=".ldf") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".ldf") returned 0x0 [0084.722] lstrlenW (lpString=".LDF") returned 4 [0084.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch=".LDF") returned 0x0 [0084.723] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.723] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.723] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.724] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.724] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20472486746) returned 1 [0084.724] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc150f730, dwHighDateTime=0x1d585b4)) [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c3a0 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c3a0 | out: hHeap=0x260000) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c5a8 [0084.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.724] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.725] GetLastError () returned 0x0 [0084.725] GetLastError () returned 0x0 [0084.725] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] GetLastError () returned 0x0 [0084.727] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.727] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.727] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.727] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.727] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.727] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.727] CloseHandle (hObject=0x11c) returned 1 [0084.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.727] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.728] GetLastError () returned 0x0 [0084.729] RtlWakeConditionVariable () returned 0x0 [0084.729] GetCurrentThreadId () returned 0x99c [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".ldf") returned 0x0 [0084.729] lstrlenW (lpString=".vhd") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".vhd") returned 0x0 [0084.729] lstrlenW (lpString=".vhdx") returned 5 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".vhdx") returned 0x0 [0084.729] lstrlenW (lpString=".pst") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".pst") returned 0x0 [0084.729] lstrlenW (lpString=".ost") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".ost") returned 0x0 [0084.729] lstrlenW (lpString=".bak") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".bak") returned 0x0 [0084.729] lstrlenW (lpString=".bac") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".bac") returned 0x0 [0084.729] lstrlenW (lpString=".sys") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".sys") returned 0x0 [0084.729] lstrlenW (lpString=".v2i") returned 4 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".v2i") returned 0x0 [0084.729] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.731] lstrlenW (lpString=".sql") returned 4 [0084.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".sql") returned 0x0 [0084.731] lstrlenW (lpString=".mdf") returned 4 [0084.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".mdf") returned 0x0 [0084.731] lstrlenW (lpString=".txt") returned 4 [0084.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".txt") returned 0x0 [0084.731] lstrlenW (lpString=".dbf") returned 4 [0084.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".dbf") returned 0x0 [0084.731] lstrlenW (lpString=".ckp") returned 4 [0084.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".ckp") returned 0x0 [0084.731] lstrlenW (lpString=".dacpac") returned 7 [0084.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".dacpac") returned 0x0 [0084.732] lstrlenW (lpString=".db3") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".db3") returned 0x0 [0084.732] lstrlenW (lpString=".dtxs") returned 5 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".dtxs") returned 0x0 [0084.732] lstrlenW (lpString=".mdt") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".mdt") returned 0x0 [0084.732] lstrlenW (lpString=".sdf") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".sdf") returned 0x0 [0084.732] lstrlenW (lpString=".MDF") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".MDF") returned 0x0 [0084.732] lstrlenW (lpString=".DBF") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".DBF") returned 0x0 [0084.732] lstrlenW (lpString=".DB") returned 3 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".DB") returned 0x0 [0084.732] lstrlenW (lpString=".db") returned 3 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".db") returned 0x0 [0084.732] lstrlenW (lpString=".ndf") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".ndf") returned 0x0 [0084.732] lstrlenW (lpString=".NDF") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".NDF") returned 0x0 [0084.732] lstrlenW (lpString=".Mdf") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".Mdf") returned 0x0 [0084.732] lstrlenW (lpString=".dat") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".dat") returned 0x0 [0084.732] lstrlenW (lpString=".DAT") returned 4 [0084.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".DAT") returned 0x0 [0084.733] lstrlenW (lpString=".ldf") returned 4 [0084.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".ldf") returned 0x0 [0084.733] lstrlenW (lpString=".LDF") returned 4 [0084.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch=".LDF") returned 0x0 [0084.733] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.733] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.734] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.734] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.734] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20473496694) returned 1 [0084.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc150f730, dwHighDateTime=0x1d585b4)) [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c3d8 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c3d8 | out: hHeap=0x260000) returned 1 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c180 [0084.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.735] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.735] GetLastError () returned 0x0 [0084.735] GetLastError () returned 0x0 [0084.735] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.735] GetLastError () returned 0x0 [0084.735] GetLastError () returned 0x0 [0084.737] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffce3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.737] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x31d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x31d, lpOverlapped=0x0) returned 1 [0084.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.737] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.737] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.737] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.737] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.737] CloseHandle (hObject=0x11c) returned 1 [0084.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.739] GetLastError () returned 0x0 [0084.739] RtlWakeConditionVariable () returned 0x0 [0084.739] GetCurrentThreadId () returned 0x99c [0084.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".ldf") returned 0x0 [0084.739] lstrlenW (lpString=".vhd") returned 4 [0084.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".vhd") returned 0x0 [0084.740] lstrlenW (lpString=".vhdx") returned 5 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".vhdx") returned 0x0 [0084.740] lstrlenW (lpString=".pst") returned 4 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".pst") returned 0x0 [0084.740] lstrlenW (lpString=".ost") returned 4 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".ost") returned 0x0 [0084.740] lstrlenW (lpString=".bak") returned 4 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".bak") returned 0x0 [0084.740] lstrlenW (lpString=".bac") returned 4 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".bac") returned 0x0 [0084.740] lstrlenW (lpString=".sys") returned 4 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".sys") returned 0x0 [0084.740] lstrlenW (lpString=".v2i") returned 4 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".v2i") returned 0x0 [0084.740] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.741] lstrlenW (lpString=".sql") returned 4 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".sql") returned 0x0 [0084.741] lstrlenW (lpString=".mdf") returned 4 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".mdf") returned 0x0 [0084.741] lstrlenW (lpString=".txt") returned 4 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".txt") returned 0x0 [0084.741] lstrlenW (lpString=".dbf") returned 4 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".dbf") returned 0x0 [0084.741] lstrlenW (lpString=".ckp") returned 4 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".ckp") returned 0x0 [0084.741] lstrlenW (lpString=".dacpac") returned 7 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".dacpac") returned 0x0 [0084.741] lstrlenW (lpString=".db3") returned 4 [0084.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".db3") returned 0x0 [0084.742] lstrlenW (lpString=".dtxs") returned 5 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".dtxs") returned 0x0 [0084.742] lstrlenW (lpString=".mdt") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".mdt") returned 0x0 [0084.742] lstrlenW (lpString=".sdf") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".sdf") returned 0x0 [0084.742] lstrlenW (lpString=".MDF") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".MDF") returned 0x0 [0084.742] lstrlenW (lpString=".DBF") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".DBF") returned 0x0 [0084.742] lstrlenW (lpString=".DB") returned 3 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".DB") returned 0x0 [0084.742] lstrlenW (lpString=".db") returned 3 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".db") returned 0x0 [0084.742] lstrlenW (lpString=".ndf") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".ndf") returned 0x0 [0084.742] lstrlenW (lpString=".NDF") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".NDF") returned 0x0 [0084.742] lstrlenW (lpString=".Mdf") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".Mdf") returned 0x0 [0084.742] lstrlenW (lpString=".dat") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".dat") returned 0x0 [0084.742] lstrlenW (lpString=".DAT") returned 4 [0084.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".DAT") returned 0x0 [0084.742] lstrlenW (lpString=".ldf") returned 4 [0084.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".ldf") returned 0x0 [0084.743] lstrlenW (lpString=".LDF") returned 4 [0084.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch=".LDF") returned 0x0 [0084.743] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.743] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.744] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.744] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.744] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20474490283) returned 1 [0084.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1535890, dwHighDateTime=0x1d585b4)) [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c410 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c410 | out: hHeap=0x260000) returned 1 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c0e8 [0084.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.744] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.745] GetLastError () returned 0x0 [0084.745] GetLastError () returned 0x0 [0084.745] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.745] GetLastError () returned 0x0 [0084.745] GetLastError () returned 0x0 [0084.747] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.747] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.747] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.747] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.747] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.747] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.747] CloseHandle (hObject=0x11c) returned 1 [0084.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.748] GetLastError () returned 0x0 [0084.749] RtlWakeConditionVariable () returned 0x0 [0084.749] GetCurrentThreadId () returned 0x99c [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".ldf") returned 0x0 [0084.749] lstrlenW (lpString=".vhd") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".vhd") returned 0x0 [0084.749] lstrlenW (lpString=".vhdx") returned 5 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".vhdx") returned 0x0 [0084.749] lstrlenW (lpString=".pst") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".pst") returned 0x0 [0084.749] lstrlenW (lpString=".ost") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".ost") returned 0x0 [0084.749] lstrlenW (lpString=".bak") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".bak") returned 0x0 [0084.749] lstrlenW (lpString=".bac") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".bac") returned 0x0 [0084.749] lstrlenW (lpString=".sys") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".sys") returned 0x0 [0084.749] lstrlenW (lpString=".v2i") returned 4 [0084.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".v2i") returned 0x0 [0084.749] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.750] lstrlenW (lpString=".sql") returned 4 [0084.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".sql") returned 0x0 [0084.750] lstrlenW (lpString=".mdf") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".mdf") returned 0x0 [0084.751] lstrlenW (lpString=".txt") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".txt") returned 0x0 [0084.751] lstrlenW (lpString=".dbf") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".dbf") returned 0x0 [0084.751] lstrlenW (lpString=".ckp") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".ckp") returned 0x0 [0084.751] lstrlenW (lpString=".dacpac") returned 7 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".dacpac") returned 0x0 [0084.751] lstrlenW (lpString=".db3") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".db3") returned 0x0 [0084.751] lstrlenW (lpString=".dtxs") returned 5 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".dtxs") returned 0x0 [0084.751] lstrlenW (lpString=".mdt") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".mdt") returned 0x0 [0084.751] lstrlenW (lpString=".sdf") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".sdf") returned 0x0 [0084.751] lstrlenW (lpString=".MDF") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".MDF") returned 0x0 [0084.751] lstrlenW (lpString=".DBF") returned 4 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".DBF") returned 0x0 [0084.751] lstrlenW (lpString=".DB") returned 3 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".DB") returned 0x0 [0084.751] lstrlenW (lpString=".db") returned 3 [0084.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".db") returned 0x0 [0084.752] lstrlenW (lpString=".ndf") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".ndf") returned 0x0 [0084.752] lstrlenW (lpString=".NDF") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".NDF") returned 0x0 [0084.752] lstrlenW (lpString=".Mdf") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".Mdf") returned 0x0 [0084.752] lstrlenW (lpString=".dat") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".dat") returned 0x0 [0084.752] lstrlenW (lpString=".DAT") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".DAT") returned 0x0 [0084.752] lstrlenW (lpString=".ldf") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".ldf") returned 0x0 [0084.752] lstrlenW (lpString=".LDF") returned 4 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch=".LDF") returned 0x0 [0084.752] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.752] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2d30a8) returned 1 [0084.753] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.753] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.753] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20475432992) returned 1 [0084.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1535890, dwHighDateTime=0x1d585b4)) [0084.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c448 [0084.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c448 | out: hHeap=0x260000) returned 1 [0084.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c050 [0084.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.754] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.754] GetLastError () returned 0x0 [0084.754] GetLastError () returned 0x0 [0084.754] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.754] GetLastError () returned 0x0 [0084.755] GetLastError () returned 0x0 [0084.895] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.896] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.896] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.896] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.896] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.896] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.896] CloseHandle (hObject=0x11c) returned 1 [0084.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.899] GetLastError () returned 0x0 [0084.899] RtlWakeConditionVariable () returned 0x0 [0084.899] GetCurrentThreadId () returned 0x99c [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".ldf") returned 0x0 [0084.899] lstrlenW (lpString=".vhd") returned 4 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".vhd") returned 0x0 [0084.899] lstrlenW (lpString=".vhdx") returned 5 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".vhdx") returned 0x0 [0084.899] lstrlenW (lpString=".pst") returned 4 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".pst") returned 0x0 [0084.899] lstrlenW (lpString=".ost") returned 4 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".ost") returned 0x0 [0084.899] lstrlenW (lpString=".bak") returned 4 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".bak") returned 0x0 [0084.899] lstrlenW (lpString=".bac") returned 4 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".bac") returned 0x0 [0084.899] lstrlenW (lpString=".sys") returned 4 [0084.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".sys") returned 0x0 [0084.899] lstrlenW (lpString=".v2i") returned 4 [0084.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".v2i") returned 0x0 [0084.900] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.901] lstrlenW (lpString=".sql") returned 4 [0084.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".sql") returned 0x0 [0084.901] lstrlenW (lpString=".mdf") returned 4 [0084.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".mdf") returned 0x0 [0084.901] lstrlenW (lpString=".txt") returned 4 [0084.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".txt") returned 0x0 [0084.901] lstrlenW (lpString=".dbf") returned 4 [0084.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".dbf") returned 0x0 [0084.901] lstrlenW (lpString=".ckp") returned 4 [0084.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".ckp") returned 0x0 [0084.902] lstrlenW (lpString=".dacpac") returned 7 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".dacpac") returned 0x0 [0084.902] lstrlenW (lpString=".db3") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".db3") returned 0x0 [0084.902] lstrlenW (lpString=".dtxs") returned 5 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".dtxs") returned 0x0 [0084.902] lstrlenW (lpString=".mdt") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".mdt") returned 0x0 [0084.902] lstrlenW (lpString=".sdf") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".sdf") returned 0x0 [0084.902] lstrlenW (lpString=".MDF") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".MDF") returned 0x0 [0084.902] lstrlenW (lpString=".DBF") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".DBF") returned 0x0 [0084.902] lstrlenW (lpString=".DB") returned 3 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".DB") returned 0x0 [0084.902] lstrlenW (lpString=".db") returned 3 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".db") returned 0x0 [0084.902] lstrlenW (lpString=".ndf") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".ndf") returned 0x0 [0084.902] lstrlenW (lpString=".NDF") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".NDF") returned 0x0 [0084.902] lstrlenW (lpString=".Mdf") returned 4 [0084.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".Mdf") returned 0x0 [0084.902] lstrlenW (lpString=".dat") returned 4 [0084.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".dat") returned 0x0 [0084.903] lstrlenW (lpString=".DAT") returned 4 [0084.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".DAT") returned 0x0 [0084.903] lstrlenW (lpString=".ldf") returned 4 [0084.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".ldf") returned 0x0 [0084.903] lstrlenW (lpString=".LDF") returned 4 [0084.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch=".LDF") returned 0x0 [0084.903] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.903] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e408) returned 1 [0084.904] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.904] CryptReleaseContext (hProv=0x33e408, dwFlags=0x0) returned 1 [0084.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.904] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20490510829) returned 1 [0084.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc16b2650, dwHighDateTime=0x1d585b4)) [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c720 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c720 | out: hHeap=0x260000) returned 1 [0084.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0084.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.905] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.905] GetLastError () returned 0x0 [0084.905] GetLastError () returned 0x0 [0084.905] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.905] GetLastError () returned 0x0 [0084.905] GetLastError () returned 0x0 [0084.907] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.907] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x2fe, lpOverlapped=0x0) returned 1 [0084.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.907] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.907] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.908] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.908] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.908] CloseHandle (hObject=0x11c) returned 1 [0084.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0084.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0084.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0084.909] GetLastError () returned 0x0 [0084.909] RtlWakeConditionVariable () returned 0x0 [0084.910] GetCurrentThreadId () returned 0x99c [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".ldf") returned 0x0 [0084.910] lstrlenW (lpString=".vhd") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".vhd") returned 0x0 [0084.910] lstrlenW (lpString=".vhdx") returned 5 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".vhdx") returned 0x0 [0084.910] lstrlenW (lpString=".pst") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".pst") returned 0x0 [0084.910] lstrlenW (lpString=".ost") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".ost") returned 0x0 [0084.910] lstrlenW (lpString=".bak") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".bak") returned 0x0 [0084.910] lstrlenW (lpString=".bac") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".bac") returned 0x0 [0084.910] lstrlenW (lpString=".sys") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".sys") returned 0x0 [0084.910] lstrlenW (lpString=".v2i") returned 4 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".v2i") returned 0x0 [0084.910] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch="s\r\n.v2i") returned 0x0 [0084.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.912] lstrlenW (lpString=".sql") returned 4 [0084.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".sql") returned 0x0 [0084.912] lstrlenW (lpString=".mdf") returned 4 [0084.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".mdf") returned 0x0 [0084.912] lstrlenW (lpString=".txt") returned 4 [0084.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".txt") returned 0x0 [0084.912] lstrlenW (lpString=".dbf") returned 4 [0084.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".dbf") returned 0x0 [0084.912] lstrlenW (lpString=".ckp") returned 4 [0084.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".ckp") returned 0x0 [0084.912] lstrlenW (lpString=".dacpac") returned 7 [0084.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".dacpac") returned 0x0 [0084.913] lstrlenW (lpString=".db3") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".db3") returned 0x0 [0084.913] lstrlenW (lpString=".dtxs") returned 5 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".dtxs") returned 0x0 [0084.913] lstrlenW (lpString=".mdt") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".mdt") returned 0x0 [0084.913] lstrlenW (lpString=".sdf") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".sdf") returned 0x0 [0084.913] lstrlenW (lpString=".MDF") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".MDF") returned 0x0 [0084.913] lstrlenW (lpString=".DBF") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".DBF") returned 0x0 [0084.913] lstrlenW (lpString=".DB") returned 3 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".DB") returned 0x0 [0084.913] lstrlenW (lpString=".db") returned 3 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".db") returned 0x0 [0084.913] lstrlenW (lpString=".ndf") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".ndf") returned 0x0 [0084.913] lstrlenW (lpString=".NDF") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".NDF") returned 0x0 [0084.913] lstrlenW (lpString=".Mdf") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".Mdf") returned 0x0 [0084.913] lstrlenW (lpString=".dat") returned 4 [0084.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".dat") returned 0x0 [0084.913] lstrlenW (lpString=".DAT") returned 4 [0084.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".DAT") returned 0x0 [0084.914] lstrlenW (lpString=".ldf") returned 4 [0084.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".ldf") returned 0x0 [0084.914] lstrlenW (lpString=".LDF") returned 4 [0084.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch=".LDF") returned 0x0 [0084.914] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0084.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.914] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e2f8) returned 1 [0084.915] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.915] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0084.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0084.915] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20491600569) returned 1 [0084.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc16d87b0, dwHighDateTime=0x1d585b4)) [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762b88 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762b88 | out: hHeap=0x260000) returned 1 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0084.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.925] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0084.925] GetLastError () returned 0x0 [0084.925] GetLastError () returned 0x0 [0084.925] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0084.925] GetLastError () returned 0x0 [0084.926] GetLastError () returned 0x0 [0084.984] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.985] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x2de, lpOverlapped=0x0) returned 1 [0084.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.985] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.985] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.985] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.985] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.985] CloseHandle (hObject=0x11c) returned 1 [0084.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0084.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.[deadmin@cock.li].deadmin")) returned 1 [0085.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0085.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.024] GetLastError () returned 0x0 [0085.025] RtlWakeConditionVariable () returned 0x0 [0085.025] GetCurrentThreadId () returned 0x99c [0085.025] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.025] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.025] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.025] WriteFile (in: hFile=0x11c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.027] CloseHandle (hObject=0x11c) returned 1 [0085.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0085.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.027] RtlWakeConditionVariable () returned 0x27e828 [0085.027] GetCurrentThreadId () returned 0x99c [0085.028] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.028] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.028] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.028] WriteFile (in: hFile=0x11c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.029] CloseHandle (hObject=0x11c) returned 1 [0085.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34e668 | out: hHeap=0x260000) returned 1 [0085.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.030] RtlWakeConditionVariable () returned 0x27e828 [0085.030] GetCurrentThreadId () returned 0x99c [0085.030] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.030] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.030] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.030] WriteFile (in: hFile=0x11c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.032] CloseHandle (hObject=0x11c) returned 1 [0085.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0085.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0085.032] RtlWakeConditionVariable () returned 0x27e828 [0085.032] GetCurrentThreadId () returned 0x99c [0085.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".ldf") returned 0x0 [0085.032] lstrlenW (lpString=".vhd") returned 4 [0085.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".vhd") returned 0x0 [0085.032] lstrlenW (lpString=".vhdx") returned 5 [0085.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".vhdx") returned 0x0 [0085.032] lstrlenW (lpString=".pst") returned 4 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".pst") returned 0x0 [0085.033] lstrlenW (lpString=".ost") returned 4 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".ost") returned 0x0 [0085.033] lstrlenW (lpString=".bak") returned 4 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".bak") returned 0x0 [0085.033] lstrlenW (lpString=".bac") returned 4 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".bac") returned 0x0 [0085.033] lstrlenW (lpString=".sys") returned 4 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".sys") returned 0x0 [0085.033] lstrlenW (lpString=".v2i") returned 4 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".v2i") returned 0x0 [0085.033] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.035] lstrlenW (lpString=".sql") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".sql") returned 0x0 [0085.035] lstrlenW (lpString=".mdf") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".mdf") returned 0x0 [0085.035] lstrlenW (lpString=".txt") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".txt") returned 0x0 [0085.035] lstrlenW (lpString=".dbf") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".dbf") returned 0x0 [0085.035] lstrlenW (lpString=".ckp") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".ckp") returned 0x0 [0085.035] lstrlenW (lpString=".dacpac") returned 7 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".dacpac") returned 0x0 [0085.035] lstrlenW (lpString=".db3") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".db3") returned 0x0 [0085.035] lstrlenW (lpString=".dtxs") returned 5 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".dtxs") returned 0x0 [0085.035] lstrlenW (lpString=".mdt") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".mdt") returned 0x0 [0085.035] lstrlenW (lpString=".sdf") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".sdf") returned 0x0 [0085.035] lstrlenW (lpString=".MDF") returned 4 [0085.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".MDF") returned 0x0 [0085.035] lstrlenW (lpString=".DBF") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".DBF") returned 0x0 [0085.036] lstrlenW (lpString=".DB") returned 3 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".DB") returned 0x0 [0085.036] lstrlenW (lpString=".db") returned 3 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".db") returned 0x0 [0085.036] lstrlenW (lpString=".ndf") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".ndf") returned 0x0 [0085.036] lstrlenW (lpString=".NDF") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".NDF") returned 0x0 [0085.036] lstrlenW (lpString=".Mdf") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".Mdf") returned 0x0 [0085.036] lstrlenW (lpString=".dat") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".dat") returned 0x0 [0085.036] lstrlenW (lpString=".DAT") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".DAT") returned 0x0 [0085.036] lstrlenW (lpString=".ldf") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".ldf") returned 0x0 [0085.036] lstrlenW (lpString=".LDF") returned 4 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch=".LDF") returned 0x0 [0085.036] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.036] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.037] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.037] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.037] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20503862291) returned 1 [0085.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc18092b0, dwHighDateTime=0x1d585b4)) [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763090 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763090 | out: hHeap=0x260000) returned 1 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a3a0 [0085.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a3a0 | out: hHeap=0x260000) returned 1 [0085.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.038] GetLastError () returned 0x0 [0085.039] GetLastError () returned 0x0 [0085.039] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.039] GetLastError () returned 0x0 [0085.039] GetLastError () returned 0x0 [0085.041] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff942c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.041] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6bd4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x6bd4, lpOverlapped=0x0) returned 1 [0085.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.041] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.041] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.041] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.042] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.042] CloseHandle (hObject=0x11c) returned 1 [0085.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.042] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.043] GetLastError () returned 0x0 [0085.043] RtlWakeConditionVariable () returned 0x0 [0085.043] GetCurrentThreadId () returned 0x99c [0085.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".ldf") returned 0x0 [0085.044] lstrlenW (lpString=".vhd") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".vhd") returned 0x0 [0085.044] lstrlenW (lpString=".vhdx") returned 5 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".vhdx") returned 0x0 [0085.044] lstrlenW (lpString=".pst") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".pst") returned 0x0 [0085.044] lstrlenW (lpString=".ost") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".ost") returned 0x0 [0085.044] lstrlenW (lpString=".bak") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".bak") returned 0x0 [0085.044] lstrlenW (lpString=".bac") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".bac") returned 0x0 [0085.044] lstrlenW (lpString=".sys") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".sys") returned 0x0 [0085.044] lstrlenW (lpString=".v2i") returned 4 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".v2i") returned 0x0 [0085.044] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.045] lstrlenW (lpString=".sql") returned 4 [0085.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".sql") returned 0x0 [0085.045] lstrlenW (lpString=".mdf") returned 4 [0085.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".mdf") returned 0x0 [0085.045] lstrlenW (lpString=".txt") returned 4 [0085.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".txt") returned 0x0 [0085.045] lstrlenW (lpString=".dbf") returned 4 [0085.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".dbf") returned 0x0 [0085.045] lstrlenW (lpString=".ckp") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".ckp") returned 0x0 [0085.046] lstrlenW (lpString=".dacpac") returned 7 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".dacpac") returned 0x0 [0085.046] lstrlenW (lpString=".db3") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".db3") returned 0x0 [0085.046] lstrlenW (lpString=".dtxs") returned 5 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".dtxs") returned 0x0 [0085.046] lstrlenW (lpString=".mdt") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".mdt") returned 0x0 [0085.046] lstrlenW (lpString=".sdf") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".sdf") returned 0x0 [0085.046] lstrlenW (lpString=".MDF") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".MDF") returned 0x0 [0085.046] lstrlenW (lpString=".DBF") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".DBF") returned 0x0 [0085.046] lstrlenW (lpString=".DB") returned 3 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".DB") returned 0x0 [0085.046] lstrlenW (lpString=".db") returned 3 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".db") returned 0x0 [0085.046] lstrlenW (lpString=".ndf") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".ndf") returned 0x0 [0085.046] lstrlenW (lpString=".NDF") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".NDF") returned 0x0 [0085.046] lstrlenW (lpString=".Mdf") returned 4 [0085.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".Mdf") returned 0x0 [0085.047] lstrlenW (lpString=".dat") returned 4 [0085.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".dat") returned 0x0 [0085.047] lstrlenW (lpString=".DAT") returned 4 [0085.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".DAT") returned 0x0 [0085.047] lstrlenW (lpString=".ldf") returned 4 [0085.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".ldf") returned 0x0 [0085.047] lstrlenW (lpString=".LDF") returned 4 [0085.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch=".LDF") returned 0x0 [0085.047] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.047] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.048] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.048] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.048] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20504915167) returned 1 [0085.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc18092b0, dwHighDateTime=0x1d585b4)) [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763058 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763058 | out: hHeap=0x260000) returned 1 [0085.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0085.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0085.049] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.049] GetLastError () returned 0x0 [0085.049] GetLastError () returned 0x0 [0085.049] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.049] GetLastError () returned 0x0 [0085.049] GetLastError () returned 0x0 [0085.051] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff87a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.052] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x7860, lpOverlapped=0x0) returned 1 [0085.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.052] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.052] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.052] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.052] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.052] CloseHandle (hObject=0x11c) returned 1 [0085.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0085.052] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0085.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.057] GetLastError () returned 0x0 [0085.057] RtlWakeConditionVariable () returned 0x0 [0085.057] GetCurrentThreadId () returned 0x99c [0085.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".ldf") returned 0x0 [0085.057] lstrlenW (lpString=".vhd") returned 4 [0085.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".vhd") returned 0x0 [0085.057] lstrlenW (lpString=".vhdx") returned 5 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".vhdx") returned 0x0 [0085.058] lstrlenW (lpString=".pst") returned 4 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".pst") returned 0x0 [0085.058] lstrlenW (lpString=".ost") returned 4 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".ost") returned 0x0 [0085.058] lstrlenW (lpString=".bak") returned 4 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".bak") returned 0x0 [0085.058] lstrlenW (lpString=".bac") returned 4 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".bac") returned 0x0 [0085.058] lstrlenW (lpString=".sys") returned 4 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".sys") returned 0x0 [0085.058] lstrlenW (lpString=".v2i") returned 4 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".v2i") returned 0x0 [0085.058] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.059] lstrlenW (lpString=".sql") returned 4 [0085.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".sql") returned 0x0 [0085.059] lstrlenW (lpString=".mdf") returned 4 [0085.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".mdf") returned 0x0 [0085.059] lstrlenW (lpString=".txt") returned 4 [0085.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".txt") returned 0x0 [0085.059] lstrlenW (lpString=".dbf") returned 4 [0085.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".dbf") returned 0x0 [0085.059] lstrlenW (lpString=".ckp") returned 4 [0085.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".ckp") returned 0x0 [0085.059] lstrlenW (lpString=".dacpac") returned 7 [0085.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".dacpac") returned 0x0 [0085.060] lstrlenW (lpString=".db3") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".db3") returned 0x0 [0085.060] lstrlenW (lpString=".dtxs") returned 5 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".dtxs") returned 0x0 [0085.060] lstrlenW (lpString=".mdt") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".mdt") returned 0x0 [0085.060] lstrlenW (lpString=".sdf") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".sdf") returned 0x0 [0085.060] lstrlenW (lpString=".MDF") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".MDF") returned 0x0 [0085.060] lstrlenW (lpString=".DBF") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".DBF") returned 0x0 [0085.060] lstrlenW (lpString=".DB") returned 3 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".DB") returned 0x0 [0085.060] lstrlenW (lpString=".db") returned 3 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".db") returned 0x0 [0085.060] lstrlenW (lpString=".ndf") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".ndf") returned 0x0 [0085.060] lstrlenW (lpString=".NDF") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".NDF") returned 0x0 [0085.060] lstrlenW (lpString=".Mdf") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".Mdf") returned 0x0 [0085.060] lstrlenW (lpString=".dat") returned 4 [0085.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".dat") returned 0x0 [0085.060] lstrlenW (lpString=".DAT") returned 4 [0085.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".DAT") returned 0x0 [0085.061] lstrlenW (lpString=".ldf") returned 4 [0085.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".ldf") returned 0x0 [0085.061] lstrlenW (lpString=".LDF") returned 4 [0085.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch=".LDF") returned 0x0 [0085.061] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.061] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.062] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.062] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.062] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20506301769) returned 1 [0085.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc182f410, dwHighDateTime=0x1d585b4)) [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763020 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763020 | out: hHeap=0x260000) returned 1 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.063] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.063] GetLastError () returned 0x0 [0085.063] GetLastError () returned 0x0 [0085.063] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.063] GetLastError () returned 0x0 [0085.063] GetLastError () returned 0x0 [0085.275] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc716, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.275] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x38ea, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x38ea, lpOverlapped=0x0) returned 1 [0085.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.278] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.278] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.278] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.278] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.278] CloseHandle (hObject=0x11c) returned 1 [0085.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.358] GetLastError () returned 0x0 [0085.358] RtlWakeConditionVariable () returned 0x0 [0085.359] GetCurrentThreadId () returned 0x99c [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".ldf") returned 0x0 [0085.359] lstrlenW (lpString=".vhd") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".vhd") returned 0x0 [0085.359] lstrlenW (lpString=".vhdx") returned 5 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".vhdx") returned 0x0 [0085.359] lstrlenW (lpString=".pst") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".pst") returned 0x0 [0085.359] lstrlenW (lpString=".ost") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".ost") returned 0x0 [0085.359] lstrlenW (lpString=".bak") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".bak") returned 0x0 [0085.359] lstrlenW (lpString=".bac") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".bac") returned 0x0 [0085.359] lstrlenW (lpString=".sys") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".sys") returned 0x0 [0085.359] lstrlenW (lpString=".v2i") returned 4 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".v2i") returned 0x0 [0085.359] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0085.434] lstrlenW (lpString=".sql") returned 4 [0085.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".sql") returned 0x0 [0085.434] lstrlenW (lpString=".mdf") returned 4 [0085.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".mdf") returned 0x0 [0085.435] lstrlenW (lpString=".txt") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".txt") returned 0x0 [0085.435] lstrlenW (lpString=".dbf") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".dbf") returned 0x0 [0085.435] lstrlenW (lpString=".ckp") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".ckp") returned 0x0 [0085.435] lstrlenW (lpString=".dacpac") returned 7 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".dacpac") returned 0x0 [0085.435] lstrlenW (lpString=".db3") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".db3") returned 0x0 [0085.435] lstrlenW (lpString=".dtxs") returned 5 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".dtxs") returned 0x0 [0085.435] lstrlenW (lpString=".mdt") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".mdt") returned 0x0 [0085.435] lstrlenW (lpString=".sdf") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".sdf") returned 0x0 [0085.435] lstrlenW (lpString=".MDF") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".MDF") returned 0x0 [0085.435] lstrlenW (lpString=".DBF") returned 4 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".DBF") returned 0x0 [0085.435] lstrlenW (lpString=".DB") returned 3 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".DB") returned 0x0 [0085.435] lstrlenW (lpString=".db") returned 3 [0085.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".db") returned 0x0 [0085.436] lstrlenW (lpString=".ndf") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".ndf") returned 0x0 [0085.436] lstrlenW (lpString=".NDF") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".NDF") returned 0x0 [0085.436] lstrlenW (lpString=".Mdf") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".Mdf") returned 0x0 [0085.436] lstrlenW (lpString=".dat") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".dat") returned 0x0 [0085.436] lstrlenW (lpString=".DAT") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".DAT") returned 0x0 [0085.436] lstrlenW (lpString=".ldf") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".ldf") returned 0x0 [0085.436] lstrlenW (lpString=".LDF") returned 4 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch=".LDF") returned 0x0 [0085.436] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.436] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.437] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.437] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.437] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20543832878) returned 1 [0085.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1bc1510, dwHighDateTime=0x1d585b4)) [0085.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763218 [0085.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763218 | out: hHeap=0x260000) returned 1 [0085.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a598 [0085.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a598 | out: hHeap=0x260000) returned 1 [0085.438] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.438] GetLastError () returned 0x0 [0085.438] GetLastError () returned 0x0 [0085.438] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.438] GetLastError () returned 0x0 [0085.439] GetLastError () returned 0x0 [0085.441] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff158e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.441] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xea72, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xea72, lpOverlapped=0x0) returned 1 [0085.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.441] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.441] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.441] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.441] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.442] CloseHandle (hObject=0xd8) returned 1 [0085.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.443] GetLastError () returned 0x0 [0085.443] RtlWakeConditionVariable () returned 0x0 [0085.443] GetCurrentThreadId () returned 0x99c [0085.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".ldf") returned 0x0 [0085.443] lstrlenW (lpString=".vhd") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".vhd") returned 0x0 [0085.444] lstrlenW (lpString=".vhdx") returned 5 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".vhdx") returned 0x0 [0085.444] lstrlenW (lpString=".pst") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".pst") returned 0x0 [0085.444] lstrlenW (lpString=".ost") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".ost") returned 0x0 [0085.444] lstrlenW (lpString=".bak") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".bak") returned 0x0 [0085.444] lstrlenW (lpString=".bac") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".bac") returned 0x0 [0085.444] lstrlenW (lpString=".sys") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".sys") returned 0x0 [0085.444] lstrlenW (lpString=".v2i") returned 4 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".v2i") returned 0x0 [0085.444] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.486] lstrlenW (lpString=".sql") returned 4 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".sql") returned 0x0 [0085.486] lstrlenW (lpString=".mdf") returned 4 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".mdf") returned 0x0 [0085.486] lstrlenW (lpString=".txt") returned 4 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".txt") returned 0x0 [0085.486] lstrlenW (lpString=".dbf") returned 4 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".dbf") returned 0x0 [0085.486] lstrlenW (lpString=".ckp") returned 4 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".ckp") returned 0x0 [0085.486] lstrlenW (lpString=".dacpac") returned 7 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".dacpac") returned 0x0 [0085.486] lstrlenW (lpString=".db3") returned 4 [0085.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".db3") returned 0x0 [0085.486] lstrlenW (lpString=".dtxs") returned 5 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".dtxs") returned 0x0 [0085.487] lstrlenW (lpString=".mdt") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".mdt") returned 0x0 [0085.487] lstrlenW (lpString=".sdf") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".sdf") returned 0x0 [0085.487] lstrlenW (lpString=".MDF") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".MDF") returned 0x0 [0085.487] lstrlenW (lpString=".DBF") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".DBF") returned 0x0 [0085.487] lstrlenW (lpString=".DB") returned 3 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".DB") returned 0x0 [0085.487] lstrlenW (lpString=".db") returned 3 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".db") returned 0x0 [0085.487] lstrlenW (lpString=".ndf") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".ndf") returned 0x0 [0085.487] lstrlenW (lpString=".NDF") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".NDF") returned 0x0 [0085.487] lstrlenW (lpString=".Mdf") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".Mdf") returned 0x0 [0085.487] lstrlenW (lpString=".dat") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".dat") returned 0x0 [0085.487] lstrlenW (lpString=".DAT") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".DAT") returned 0x0 [0085.487] lstrlenW (lpString=".ldf") returned 4 [0085.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".ldf") returned 0x0 [0085.487] lstrlenW (lpString=".LDF") returned 4 [0085.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch=".LDF") returned 0x0 [0085.488] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.488] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.489] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.489] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20548996871) returned 1 [0085.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1c59a90, dwHighDateTime=0x1d585b4)) [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27639f8 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27639f8 | out: hHeap=0x260000) returned 1 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ab80 [0085.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ab80 | out: hHeap=0x260000) returned 1 [0085.490] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.490] GetLastError () returned 0x0 [0085.490] GetLastError () returned 0x0 [0085.490] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.490] GetLastError () returned 0x0 [0085.490] GetLastError () returned 0x0 [0085.504] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff122a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.504] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xedd6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xedd6, lpOverlapped=0x0) returned 1 [0085.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.505] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.505] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.505] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.505] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.505] CloseHandle (hObject=0x11c) returned 1 [0085.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.507] GetLastError () returned 0x0 [0085.507] RtlWakeConditionVariable () returned 0x27e828 [0085.507] GetCurrentThreadId () returned 0x99c [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".ldf") returned 0x0 [0085.507] lstrlenW (lpString=".vhd") returned 4 [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".vhd") returned 0x0 [0085.507] lstrlenW (lpString=".vhdx") returned 5 [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".vhdx") returned 0x0 [0085.507] lstrlenW (lpString=".pst") returned 4 [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".pst") returned 0x0 [0085.507] lstrlenW (lpString=".ost") returned 4 [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".ost") returned 0x0 [0085.507] lstrlenW (lpString=".bak") returned 4 [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".bak") returned 0x0 [0085.507] lstrlenW (lpString=".bac") returned 4 [0085.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".bac") returned 0x0 [0085.508] lstrlenW (lpString=".sys") returned 4 [0085.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".sys") returned 0x0 [0085.508] lstrlenW (lpString=".v2i") returned 4 [0085.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".v2i") returned 0x0 [0085.508] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.509] lstrlenW (lpString=".sql") returned 4 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".sql") returned 0x0 [0085.509] lstrlenW (lpString=".mdf") returned 4 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".mdf") returned 0x0 [0085.509] lstrlenW (lpString=".txt") returned 4 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".txt") returned 0x0 [0085.509] lstrlenW (lpString=".dbf") returned 4 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".dbf") returned 0x0 [0085.509] lstrlenW (lpString=".ckp") returned 4 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".ckp") returned 0x0 [0085.509] lstrlenW (lpString=".dacpac") returned 7 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".dacpac") returned 0x0 [0085.509] lstrlenW (lpString=".db3") returned 4 [0085.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".db3") returned 0x0 [0085.509] lstrlenW (lpString=".dtxs") returned 5 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".dtxs") returned 0x0 [0085.510] lstrlenW (lpString=".mdt") returned 4 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".mdt") returned 0x0 [0085.510] lstrlenW (lpString=".sdf") returned 4 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".sdf") returned 0x0 [0085.510] lstrlenW (lpString=".MDF") returned 4 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".MDF") returned 0x0 [0085.510] lstrlenW (lpString=".DBF") returned 4 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".DBF") returned 0x0 [0085.510] lstrlenW (lpString=".DB") returned 3 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".DB") returned 0x0 [0085.510] lstrlenW (lpString=".db") returned 3 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".db") returned 0x0 [0085.510] lstrlenW (lpString=".ndf") returned 4 [0085.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".ndf") returned 0x0 [0085.511] lstrlenW (lpString=".NDF") returned 4 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".NDF") returned 0x0 [0085.511] lstrlenW (lpString=".Mdf") returned 4 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".Mdf") returned 0x0 [0085.511] lstrlenW (lpString=".dat") returned 4 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".dat") returned 0x0 [0085.511] lstrlenW (lpString=".DAT") returned 4 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".DAT") returned 0x0 [0085.511] lstrlenW (lpString=".ldf") returned 4 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".ldf") returned 0x0 [0085.511] lstrlenW (lpString=".LDF") returned 4 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch=".LDF") returned 0x0 [0085.511] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.511] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.512] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.512] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.512] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20551326409) returned 1 [0085.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1c7fbf0, dwHighDateTime=0x1d585b4)) [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763988 [0085.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763988 | out: hHeap=0x260000) returned 1 [0085.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0085.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0085.513] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.513] GetLastError () returned 0x0 [0085.513] GetLastError () returned 0x0 [0085.513] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.513] GetLastError () returned 0x0 [0085.514] GetLastError () returned 0x0 [0085.562] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.563] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xf38, lpOverlapped=0x0) returned 1 [0085.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.563] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.563] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.563] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.563] CloseHandle (hObject=0x11c) returned 1 [0085.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.565] GetLastError () returned 0x0 [0085.565] RtlWakeConditionVariable () returned 0x0 [0085.565] GetCurrentThreadId () returned 0x99c [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.566] lstrlenW (lpString=".vhd") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.566] lstrlenW (lpString=".vhdx") returned 5 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.566] lstrlenW (lpString=".pst") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.566] lstrlenW (lpString=".ost") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.566] lstrlenW (lpString=".bak") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.566] lstrlenW (lpString=".bac") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.566] lstrlenW (lpString=".sys") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.566] lstrlenW (lpString=".v2i") returned 4 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.566] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.568] lstrlenW (lpString=".sql") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.568] lstrlenW (lpString=".mdf") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.568] lstrlenW (lpString=".txt") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.568] lstrlenW (lpString=".dbf") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.568] lstrlenW (lpString=".ckp") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.568] lstrlenW (lpString=".dacpac") returned 7 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.568] lstrlenW (lpString=".db3") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.568] lstrlenW (lpString=".dtxs") returned 5 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.568] lstrlenW (lpString=".mdt") returned 4 [0085.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.568] lstrlenW (lpString=".sdf") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.569] lstrlenW (lpString=".MDF") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.569] lstrlenW (lpString=".DBF") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.569] lstrlenW (lpString=".DB") returned 3 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.569] lstrlenW (lpString=".db") returned 3 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".db") returned 0x0 [0085.569] lstrlenW (lpString=".ndf") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.569] lstrlenW (lpString=".NDF") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.569] lstrlenW (lpString=".Mdf") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.569] lstrlenW (lpString=".dat") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.569] lstrlenW (lpString=".DAT") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.569] lstrlenW (lpString=".ldf") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.569] lstrlenW (lpString=".LDF") returned 4 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.569] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.570] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.661] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.661] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20566240598) returned 1 [0085.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1dfc9b0, dwHighDateTime=0x1d585b4)) [0085.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763838 [0085.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763838 | out: hHeap=0x260000) returned 1 [0085.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.662] GetLastError () returned 0x0 [0085.662] GetLastError () returned 0x0 [0085.662] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.663] GetLastError () returned 0x0 [0085.663] GetLastError () returned 0x0 [0085.665] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe939, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.665] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x16c7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x16c7, lpOverlapped=0x0) returned 1 [0085.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.665] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.666] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.666] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.666] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.666] CloseHandle (hObject=0x11c) returned 1 [0085.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d4a8 [0085.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0085.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.668] GetLastError () returned 0x0 [0085.668] RtlWakeConditionVariable () returned 0x0 [0085.668] GetCurrentThreadId () returned 0x99c [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".ldf") returned 0x0 [0085.668] lstrlenW (lpString=".vhd") returned 4 [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".vhd") returned 0x0 [0085.668] lstrlenW (lpString=".vhdx") returned 5 [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.668] lstrlenW (lpString=".pst") returned 4 [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".pst") returned 0x0 [0085.668] lstrlenW (lpString=".ost") returned 4 [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".ost") returned 0x0 [0085.668] lstrlenW (lpString=".bak") returned 4 [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".bak") returned 0x0 [0085.668] lstrlenW (lpString=".bac") returned 4 [0085.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".bac") returned 0x0 [0085.668] lstrlenW (lpString=".sys") returned 4 [0085.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".sys") returned 0x0 [0085.669] lstrlenW (lpString=".v2i") returned 4 [0085.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".v2i") returned 0x0 [0085.669] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.670] lstrlenW (lpString=".sql") returned 4 [0085.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".sql") returned 0x0 [0085.670] lstrlenW (lpString=".mdf") returned 4 [0085.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".mdf") returned 0x0 [0085.670] lstrlenW (lpString=".txt") returned 4 [0085.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".txt") returned 0x0 [0085.670] lstrlenW (lpString=".dbf") returned 4 [0085.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".dbf") returned 0x0 [0085.670] lstrlenW (lpString=".ckp") returned 4 [0085.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".ckp") returned 0x0 [0085.670] lstrlenW (lpString=".dacpac") returned 7 [0085.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.671] lstrlenW (lpString=".db3") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".db3") returned 0x0 [0085.671] lstrlenW (lpString=".dtxs") returned 5 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.671] lstrlenW (lpString=".mdt") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".mdt") returned 0x0 [0085.671] lstrlenW (lpString=".sdf") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".sdf") returned 0x0 [0085.671] lstrlenW (lpString=".MDF") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".MDF") returned 0x0 [0085.671] lstrlenW (lpString=".DBF") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".DBF") returned 0x0 [0085.671] lstrlenW (lpString=".DB") returned 3 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".DB") returned 0x0 [0085.671] lstrlenW (lpString=".db") returned 3 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".db") returned 0x0 [0085.671] lstrlenW (lpString=".ndf") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".ndf") returned 0x0 [0085.671] lstrlenW (lpString=".NDF") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".NDF") returned 0x0 [0085.671] lstrlenW (lpString=".Mdf") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.671] lstrlenW (lpString=".dat") returned 4 [0085.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".dat") returned 0x0 [0085.671] lstrlenW (lpString=".DAT") returned 4 [0085.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".DAT") returned 0x0 [0085.672] lstrlenW (lpString=".ldf") returned 4 [0085.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".ldf") returned 0x0 [0085.672] lstrlenW (lpString=".LDF") returned 4 [0085.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch=".LDF") returned 0x0 [0085.672] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.672] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.673] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.673] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.673] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20567402882) returned 1 [0085.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1dfc9b0, dwHighDateTime=0x1d585b4)) [0085.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763678 [0085.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763678 | out: hHeap=0x260000) returned 1 [0085.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.677] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.678] GetLastError () returned 0x0 [0085.678] GetLastError () returned 0x0 [0085.678] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.678] GetLastError () returned 0x0 [0085.678] GetLastError () returned 0x0 [0085.680] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.680] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x838, lpOverlapped=0x0) returned 1 [0085.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.680] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.680] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.680] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.680] CloseHandle (hObject=0x11c) returned 1 [0085.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.683] GetLastError () returned 0x0 [0085.683] RtlWakeConditionVariable () returned 0x0 [0085.683] GetCurrentThreadId () returned 0x99c [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".ldf") returned 0x0 [0085.683] lstrlenW (lpString=".vhd") returned 4 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".vhd") returned 0x0 [0085.683] lstrlenW (lpString=".vhdx") returned 5 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".vhdx") returned 0x0 [0085.683] lstrlenW (lpString=".pst") returned 4 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".pst") returned 0x0 [0085.683] lstrlenW (lpString=".ost") returned 4 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".ost") returned 0x0 [0085.683] lstrlenW (lpString=".bak") returned 4 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".bak") returned 0x0 [0085.683] lstrlenW (lpString=".bac") returned 4 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".bac") returned 0x0 [0085.683] lstrlenW (lpString=".sys") returned 4 [0085.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".sys") returned 0x0 [0085.684] lstrlenW (lpString=".v2i") returned 4 [0085.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".v2i") returned 0x0 [0085.684] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.685] lstrlenW (lpString=".sql") returned 4 [0085.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".sql") returned 0x0 [0085.685] lstrlenW (lpString=".mdf") returned 4 [0085.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".mdf") returned 0x0 [0085.685] lstrlenW (lpString=".txt") returned 4 [0085.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".txt") returned 0x0 [0085.685] lstrlenW (lpString=".dbf") returned 4 [0085.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".dbf") returned 0x0 [0085.685] lstrlenW (lpString=".ckp") returned 4 [0085.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".ckp") returned 0x0 [0085.685] lstrlenW (lpString=".dacpac") returned 7 [0085.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".dacpac") returned 0x0 [0085.686] lstrlenW (lpString=".db3") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".db3") returned 0x0 [0085.686] lstrlenW (lpString=".dtxs") returned 5 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".dtxs") returned 0x0 [0085.686] lstrlenW (lpString=".mdt") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".mdt") returned 0x0 [0085.686] lstrlenW (lpString=".sdf") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".sdf") returned 0x0 [0085.686] lstrlenW (lpString=".MDF") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".MDF") returned 0x0 [0085.686] lstrlenW (lpString=".DBF") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".DBF") returned 0x0 [0085.686] lstrlenW (lpString=".DB") returned 3 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".DB") returned 0x0 [0085.686] lstrlenW (lpString=".db") returned 3 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".db") returned 0x0 [0085.686] lstrlenW (lpString=".ndf") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".ndf") returned 0x0 [0085.686] lstrlenW (lpString=".NDF") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".NDF") returned 0x0 [0085.686] lstrlenW (lpString=".Mdf") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".Mdf") returned 0x0 [0085.686] lstrlenW (lpString=".dat") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".dat") returned 0x0 [0085.686] lstrlenW (lpString=".DAT") returned 4 [0085.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".DAT") returned 0x0 [0085.687] lstrlenW (lpString=".ldf") returned 4 [0085.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".ldf") returned 0x0 [0085.687] lstrlenW (lpString=".LDF") returned 4 [0085.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch=".LDF") returned 0x0 [0085.687] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0085.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.687] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.688] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0085.688] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20568900550) returned 1 [0085.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1e22b10, dwHighDateTime=0x1d585b4)) [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763608 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763608 | out: hHeap=0x260000) returned 1 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.689] GetLastError () returned 0x0 [0085.689] GetLastError () returned 0x0 [0085.689] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.689] GetLastError () returned 0x0 [0085.689] GetLastError () returned 0x0 [0085.742] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff3113, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.742] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xceed, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xceed, lpOverlapped=0x0) returned 1 [0085.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.745] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.745] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.745] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.745] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.745] CloseHandle (hObject=0x11c) returned 1 [0085.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0085.818] GetLastError () returned 0x0 [0085.819] RtlWakeConditionVariable () returned 0x0 [0085.819] GetCurrentThreadId () returned 0x99c [0085.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".ldf") returned 0x0 [0085.819] lstrlenW (lpString=".vhd") returned 4 [0085.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".vhd") returned 0x0 [0085.819] lstrlenW (lpString=".vhdx") returned 5 [0085.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".vhdx") returned 0x0 [0085.819] lstrlenW (lpString=".pst") returned 4 [0085.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".pst") returned 0x0 [0085.819] lstrlenW (lpString=".ost") returned 4 [0085.819] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".ost") returned 0x0 [0085.819] lstrlenW (lpString=".bak") returned 4 [0085.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".bak") returned 0x0 [0085.820] lstrlenW (lpString=".bac") returned 4 [0085.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".bac") returned 0x0 [0085.820] lstrlenW (lpString=".sys") returned 4 [0085.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".sys") returned 0x0 [0085.820] lstrlenW (lpString=".v2i") returned 4 [0085.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".v2i") returned 0x0 [0085.820] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.834] lstrlenW (lpString=".sql") returned 4 [0085.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".sql") returned 0x0 [0085.834] lstrlenW (lpString=".mdf") returned 4 [0085.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".mdf") returned 0x0 [0085.834] lstrlenW (lpString=".txt") returned 4 [0085.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".txt") returned 0x0 [0085.834] lstrlenW (lpString=".dbf") returned 4 [0085.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".dbf") returned 0x0 [0085.835] lstrlenW (lpString=".ckp") returned 4 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".ckp") returned 0x0 [0085.835] lstrlenW (lpString=".dacpac") returned 7 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".dacpac") returned 0x0 [0085.835] lstrlenW (lpString=".db3") returned 4 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".db3") returned 0x0 [0085.835] lstrlenW (lpString=".dtxs") returned 5 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".dtxs") returned 0x0 [0085.835] lstrlenW (lpString=".mdt") returned 4 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".mdt") returned 0x0 [0085.835] lstrlenW (lpString=".sdf") returned 4 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".sdf") returned 0x0 [0085.835] lstrlenW (lpString=".MDF") returned 4 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".MDF") returned 0x0 [0085.835] lstrlenW (lpString=".DBF") returned 4 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".DBF") returned 0x0 [0085.835] lstrlenW (lpString=".DB") returned 3 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".DB") returned 0x0 [0085.835] lstrlenW (lpString=".db") returned 3 [0085.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".db") returned 0x0 [0085.836] lstrlenW (lpString=".ndf") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".ndf") returned 0x0 [0085.836] lstrlenW (lpString=".NDF") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".NDF") returned 0x0 [0085.836] lstrlenW (lpString=".Mdf") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".Mdf") returned 0x0 [0085.836] lstrlenW (lpString=".dat") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".dat") returned 0x0 [0085.836] lstrlenW (lpString=".DAT") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".DAT") returned 0x0 [0085.836] lstrlenW (lpString=".ldf") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".ldf") returned 0x0 [0085.836] lstrlenW (lpString=".LDF") returned 4 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch=".LDF") returned 0x0 [0085.836] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.836] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.837] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.837] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.838] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20583882375) returned 1 [0085.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1f9f8d0, dwHighDateTime=0x1d585b4)) [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763ec8 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763ec8 | out: hHeap=0x260000) returned 1 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.839] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.839] GetLastError () returned 0x0 [0085.839] GetLastError () returned 0x0 [0085.839] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.839] GetLastError () returned 0x0 [0085.839] GetLastError () returned 0x0 [0085.842] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.842] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2f2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x2f2, lpOverlapped=0x0) returned 1 [0085.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.842] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.842] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.842] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.842] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.842] CloseHandle (hObject=0x11c) returned 1 [0085.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2aed18 [0085.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0085.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.845] GetLastError () returned 0x0 [0085.845] RtlWakeConditionVariable () returned 0x0 [0085.845] GetCurrentThreadId () returned 0x99c [0085.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.846] lstrlenW (lpString=".vhd") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".vhd") returned 0x0 [0085.846] lstrlenW (lpString=".vhdx") returned 5 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".vhdx") returned 0x0 [0085.846] lstrlenW (lpString=".pst") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".pst") returned 0x0 [0085.846] lstrlenW (lpString=".ost") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".ost") returned 0x0 [0085.846] lstrlenW (lpString=".bak") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".bak") returned 0x0 [0085.846] lstrlenW (lpString=".bac") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".bac") returned 0x0 [0085.846] lstrlenW (lpString=".sys") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".sys") returned 0x0 [0085.846] lstrlenW (lpString=".v2i") returned 4 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".v2i") returned 0x0 [0085.846] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.848] lstrlenW (lpString=".sql") returned 4 [0085.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".sql") returned 0x0 [0085.848] lstrlenW (lpString=".mdf") returned 4 [0085.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".mdf") returned 0x0 [0085.848] lstrlenW (lpString=".txt") returned 4 [0085.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".txt") returned 0x0 [0085.849] lstrlenW (lpString=".dbf") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".dbf") returned 0x0 [0085.849] lstrlenW (lpString=".ckp") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".ckp") returned 0x0 [0085.849] lstrlenW (lpString=".dacpac") returned 7 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".dacpac") returned 0x0 [0085.849] lstrlenW (lpString=".db3") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".db3") returned 0x0 [0085.849] lstrlenW (lpString=".dtxs") returned 5 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".dtxs") returned 0x0 [0085.849] lstrlenW (lpString=".mdt") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".mdt") returned 0x0 [0085.849] lstrlenW (lpString=".sdf") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".sdf") returned 0x0 [0085.849] lstrlenW (lpString=".MDF") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".MDF") returned 0x0 [0085.849] lstrlenW (lpString=".DBF") returned 4 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".DBF") returned 0x0 [0085.849] lstrlenW (lpString=".DB") returned 3 [0085.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".DB") returned 0x0 [0085.849] lstrlenW (lpString=".db") returned 3 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".db") returned 0x0 [0085.850] lstrlenW (lpString=".ndf") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".ndf") returned 0x0 [0085.850] lstrlenW (lpString=".NDF") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".NDF") returned 0x0 [0085.850] lstrlenW (lpString=".Mdf") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".Mdf") returned 0x0 [0085.850] lstrlenW (lpString=".dat") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".dat") returned 0x0 [0085.850] lstrlenW (lpString=".DAT") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".DAT") returned 0x0 [0085.850] lstrlenW (lpString=".ldf") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.850] lstrlenW (lpString=".LDF") returned 4 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch=".LDF") returned 0x0 [0085.850] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.850] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.851] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.852] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.852] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20585288985) returned 1 [0085.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc1fc5a30, dwHighDateTime=0x1d585b4)) [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763e90 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763e90 | out: hHeap=0x260000) returned 1 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.853] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.853] GetLastError () returned 0x0 [0085.853] GetLastError () returned 0x0 [0085.853] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.853] GetLastError () returned 0x0 [0085.854] GetLastError () returned 0x0 [0085.857] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.857] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x2cc, lpOverlapped=0x0) returned 1 [0085.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.857] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.858] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.858] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.858] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.858] CloseHandle (hObject=0x11c) returned 1 [0085.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2aed18 [0085.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0085.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.860] GetLastError () returned 0x0 [0085.860] RtlWakeConditionVariable () returned 0x27e828 [0085.860] GetCurrentThreadId () returned 0x99c [0085.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.860] lstrlenW (lpString=".vhd") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".vhd") returned 0x0 [0085.861] lstrlenW (lpString=".vhdx") returned 5 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".vhdx") returned 0x0 [0085.861] lstrlenW (lpString=".pst") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".pst") returned 0x0 [0085.861] lstrlenW (lpString=".ost") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".ost") returned 0x0 [0085.861] lstrlenW (lpString=".bak") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".bak") returned 0x0 [0085.861] lstrlenW (lpString=".bac") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".bac") returned 0x0 [0085.861] lstrlenW (lpString=".sys") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".sys") returned 0x0 [0085.861] lstrlenW (lpString=".v2i") returned 4 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".v2i") returned 0x0 [0085.861] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.893] lstrlenW (lpString=".sql") returned 4 [0085.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".sql") returned 0x0 [0085.893] lstrlenW (lpString=".mdf") returned 4 [0085.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".mdf") returned 0x0 [0085.893] lstrlenW (lpString=".txt") returned 4 [0085.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".txt") returned 0x0 [0085.893] lstrlenW (lpString=".dbf") returned 4 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".dbf") returned 0x0 [0085.894] lstrlenW (lpString=".ckp") returned 4 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".ckp") returned 0x0 [0085.894] lstrlenW (lpString=".dacpac") returned 7 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".dacpac") returned 0x0 [0085.894] lstrlenW (lpString=".db3") returned 4 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".db3") returned 0x0 [0085.894] lstrlenW (lpString=".dtxs") returned 5 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".dtxs") returned 0x0 [0085.894] lstrlenW (lpString=".mdt") returned 4 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".mdt") returned 0x0 [0085.894] lstrlenW (lpString=".sdf") returned 4 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".sdf") returned 0x0 [0085.894] lstrlenW (lpString=".MDF") returned 4 [0085.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".MDF") returned 0x0 [0085.894] lstrlenW (lpString=".DBF") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".DBF") returned 0x0 [0085.895] lstrlenW (lpString=".DB") returned 3 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".DB") returned 0x0 [0085.895] lstrlenW (lpString=".db") returned 3 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".db") returned 0x0 [0085.895] lstrlenW (lpString=".ndf") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".ndf") returned 0x0 [0085.895] lstrlenW (lpString=".NDF") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".NDF") returned 0x0 [0085.895] lstrlenW (lpString=".Mdf") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".Mdf") returned 0x0 [0085.895] lstrlenW (lpString=".dat") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".dat") returned 0x0 [0085.895] lstrlenW (lpString=".DAT") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".DAT") returned 0x0 [0085.895] lstrlenW (lpString=".ldf") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".ldf") returned 0x0 [0085.895] lstrlenW (lpString=".LDF") returned 4 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch=".LDF") returned 0x0 [0085.895] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.896] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.897] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.897] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.897] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20589851445) returned 1 [0085.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2037e50, dwHighDateTime=0x1d585b4)) [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763db0 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763db0 | out: hHeap=0x260000) returned 1 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.898] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.898] GetLastError () returned 0x0 [0085.899] GetLastError () returned 0x0 [0085.899] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.899] GetLastError () returned 0x0 [0085.899] GetLastError () returned 0x0 [0085.901] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcf9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.901] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x307, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x307, lpOverlapped=0x0) returned 1 [0085.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.902] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.902] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.902] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.902] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.902] CloseHandle (hObject=0x11c) returned 1 [0085.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.956] GetLastError () returned 0x0 [0085.957] RtlWakeConditionVariable () returned 0x27e828 [0085.957] GetCurrentThreadId () returned 0x99c [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.957] lstrlenW (lpString=".vhd") returned 4 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.957] lstrlenW (lpString=".vhdx") returned 5 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.957] lstrlenW (lpString=".pst") returned 4 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.957] lstrlenW (lpString=".ost") returned 4 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.957] lstrlenW (lpString=".bak") returned 4 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.957] lstrlenW (lpString=".bac") returned 4 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.957] lstrlenW (lpString=".sys") returned 4 [0085.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.958] lstrlenW (lpString=".v2i") returned 4 [0085.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.958] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.959] lstrlenW (lpString=".sql") returned 4 [0085.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.959] lstrlenW (lpString=".mdf") returned 4 [0085.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.959] lstrlenW (lpString=".txt") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.960] lstrlenW (lpString=".dbf") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.960] lstrlenW (lpString=".ckp") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.960] lstrlenW (lpString=".dacpac") returned 7 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.960] lstrlenW (lpString=".db3") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.960] lstrlenW (lpString=".dtxs") returned 5 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.960] lstrlenW (lpString=".mdt") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.960] lstrlenW (lpString=".sdf") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.960] lstrlenW (lpString=".MDF") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.960] lstrlenW (lpString=".DBF") returned 4 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.960] lstrlenW (lpString=".DB") returned 3 [0085.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.960] lstrlenW (lpString=".db") returned 3 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.961] lstrlenW (lpString=".ndf") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.961] lstrlenW (lpString=".NDF") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.961] lstrlenW (lpString=".Mdf") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.961] lstrlenW (lpString=".dat") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.961] lstrlenW (lpString=".DAT") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.961] lstrlenW (lpString=".ldf") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.961] lstrlenW (lpString=".LDF") returned 4 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.961] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.961] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.962] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.963] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.963] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20596393871) returned 1 [0085.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc20d03d0, dwHighDateTime=0x1d585b4)) [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763d08 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763d08 | out: hHeap=0x260000) returned 1 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.964] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.964] GetLastError () returned 0x0 [0085.964] GetLastError () returned 0x0 [0085.964] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.964] GetLastError () returned 0x0 [0085.965] GetLastError () returned 0x0 [0085.966] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe6c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.966] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1938, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x1938, lpOverlapped=0x0) returned 1 [0085.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.967] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.967] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.967] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.967] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.967] CloseHandle (hObject=0xe4) returned 1 [0085.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.969] GetLastError () returned 0x0 [0085.969] RtlWakeConditionVariable () returned 0x0 [0085.969] GetCurrentThreadId () returned 0x99c [0085.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.969] lstrlenW (lpString=".vhd") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.970] lstrlenW (lpString=".vhdx") returned 5 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.970] lstrlenW (lpString=".pst") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.970] lstrlenW (lpString=".ost") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.970] lstrlenW (lpString=".bak") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.970] lstrlenW (lpString=".bac") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.970] lstrlenW (lpString=".sys") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.970] lstrlenW (lpString=".v2i") returned 4 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.970] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.971] lstrlenW (lpString=".sql") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.972] lstrlenW (lpString=".mdf") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.972] lstrlenW (lpString=".txt") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.972] lstrlenW (lpString=".dbf") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.972] lstrlenW (lpString=".ckp") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.972] lstrlenW (lpString=".dacpac") returned 7 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.972] lstrlenW (lpString=".db3") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.972] lstrlenW (lpString=".dtxs") returned 5 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.972] lstrlenW (lpString=".mdt") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.972] lstrlenW (lpString=".sdf") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.972] lstrlenW (lpString=".MDF") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.972] lstrlenW (lpString=".DBF") returned 4 [0085.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.972] lstrlenW (lpString=".DB") returned 3 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.973] lstrlenW (lpString=".db") returned 3 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".db") returned 0x0 [0085.973] lstrlenW (lpString=".ndf") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.973] lstrlenW (lpString=".NDF") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.973] lstrlenW (lpString=".Mdf") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.973] lstrlenW (lpString=".dat") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.973] lstrlenW (lpString=".DAT") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.973] lstrlenW (lpString=".ldf") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.973] lstrlenW (lpString=".LDF") returned 4 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.973] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0085.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.973] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0085.974] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.974] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0085.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0085.974] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20597550626) returned 1 [0085.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc20f6530, dwHighDateTime=0x1d585b4)) [0085.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763cd0 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763cd0 | out: hHeap=0x260000) returned 1 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.975] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0085.975] GetLastError () returned 0x0 [0085.976] GetLastError () returned 0x0 [0085.976] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0085.976] GetLastError () returned 0x0 [0085.976] GetLastError () returned 0x0 [0086.056] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff073, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.088] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xf8d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xf8d, lpOverlapped=0x0) returned 1 [0086.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.088] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.088] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.088] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.088] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.088] CloseHandle (hObject=0xe4) returned 1 [0086.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.090] GetLastError () returned 0x0 [0086.090] RtlWakeConditionVariable () returned 0x0 [0086.090] GetCurrentThreadId () returned 0x99c [0086.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".ldf") returned 0x0 [0086.090] lstrlenW (lpString=".vhd") returned 4 [0086.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".vhd") returned 0x0 [0086.090] lstrlenW (lpString=".vhdx") returned 5 [0086.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".vhdx") returned 0x0 [0086.090] lstrlenW (lpString=".pst") returned 4 [0086.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".pst") returned 0x0 [0086.090] lstrlenW (lpString=".ost") returned 4 [0086.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".ost") returned 0x0 [0086.091] lstrlenW (lpString=".bak") returned 4 [0086.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".bak") returned 0x0 [0086.091] lstrlenW (lpString=".bac") returned 4 [0086.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".bac") returned 0x0 [0086.091] lstrlenW (lpString=".sys") returned 4 [0086.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".sys") returned 0x0 [0086.091] lstrlenW (lpString=".v2i") returned 4 [0086.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".v2i") returned 0x0 [0086.091] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.092] lstrlenW (lpString=".sql") returned 4 [0086.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".sql") returned 0x0 [0086.092] lstrlenW (lpString=".mdf") returned 4 [0086.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".mdf") returned 0x0 [0086.092] lstrlenW (lpString=".txt") returned 4 [0086.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".txt") returned 0x0 [0086.092] lstrlenW (lpString=".dbf") returned 4 [0086.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".dbf") returned 0x0 [0086.092] lstrlenW (lpString=".ckp") returned 4 [0086.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".ckp") returned 0x0 [0086.092] lstrlenW (lpString=".dacpac") returned 7 [0086.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".dacpac") returned 0x0 [0086.092] lstrlenW (lpString=".db3") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".db3") returned 0x0 [0086.093] lstrlenW (lpString=".dtxs") returned 5 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".dtxs") returned 0x0 [0086.093] lstrlenW (lpString=".mdt") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".mdt") returned 0x0 [0086.093] lstrlenW (lpString=".sdf") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".sdf") returned 0x0 [0086.093] lstrlenW (lpString=".MDF") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".MDF") returned 0x0 [0086.093] lstrlenW (lpString=".DBF") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".DBF") returned 0x0 [0086.093] lstrlenW (lpString=".DB") returned 3 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".DB") returned 0x0 [0086.093] lstrlenW (lpString=".db") returned 3 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".db") returned 0x0 [0086.093] lstrlenW (lpString=".ndf") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".ndf") returned 0x0 [0086.093] lstrlenW (lpString=".NDF") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".NDF") returned 0x0 [0086.093] lstrlenW (lpString=".Mdf") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".Mdf") returned 0x0 [0086.093] lstrlenW (lpString=".dat") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".dat") returned 0x0 [0086.093] lstrlenW (lpString=".DAT") returned 4 [0086.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".DAT") returned 0x0 [0086.094] lstrlenW (lpString=".ldf") returned 4 [0086.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".ldf") returned 0x0 [0086.094] lstrlenW (lpString=".LDF") returned 4 [0086.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch=".LDF") returned 0x0 [0086.094] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.094] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.095] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.095] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.095] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20609596608) returned 1 [0086.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2200ed0, dwHighDateTime=0x1d585b4)) [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763a68 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763a68 | out: hHeap=0x260000) returned 1 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.096] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.096] GetLastError () returned 0x0 [0086.096] GetLastError () returned 0x0 [0086.096] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.096] GetLastError () returned 0x0 [0086.096] GetLastError () returned 0x0 [0086.098] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff269, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.098] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd97, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd97, lpOverlapped=0x0) returned 1 [0086.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.098] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.098] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.098] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.098] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.099] CloseHandle (hObject=0xe4) returned 1 [0086.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.100] GetLastError () returned 0x0 [0086.100] RtlWakeConditionVariable () returned 0x0 [0086.100] GetCurrentThreadId () returned 0x99c [0086.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".ldf") returned 0x0 [0086.100] lstrlenW (lpString=".vhd") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".vhd") returned 0x0 [0086.101] lstrlenW (lpString=".vhdx") returned 5 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".vhdx") returned 0x0 [0086.101] lstrlenW (lpString=".pst") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".pst") returned 0x0 [0086.101] lstrlenW (lpString=".ost") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".ost") returned 0x0 [0086.101] lstrlenW (lpString=".bak") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".bak") returned 0x0 [0086.101] lstrlenW (lpString=".bac") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".bac") returned 0x0 [0086.101] lstrlenW (lpString=".sys") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".sys") returned 0x0 [0086.101] lstrlenW (lpString=".v2i") returned 4 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".v2i") returned 0x0 [0086.101] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.102] lstrlenW (lpString=".sql") returned 4 [0086.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".sql") returned 0x0 [0086.102] lstrlenW (lpString=".mdf") returned 4 [0086.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".mdf") returned 0x0 [0086.102] lstrlenW (lpString=".txt") returned 4 [0086.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".txt") returned 0x0 [0086.102] lstrlenW (lpString=".dbf") returned 4 [0086.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".dbf") returned 0x0 [0086.103] lstrlenW (lpString=".ckp") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".ckp") returned 0x0 [0086.103] lstrlenW (lpString=".dacpac") returned 7 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".dacpac") returned 0x0 [0086.103] lstrlenW (lpString=".db3") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".db3") returned 0x0 [0086.103] lstrlenW (lpString=".dtxs") returned 5 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".dtxs") returned 0x0 [0086.103] lstrlenW (lpString=".mdt") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".mdt") returned 0x0 [0086.103] lstrlenW (lpString=".sdf") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".sdf") returned 0x0 [0086.103] lstrlenW (lpString=".MDF") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".MDF") returned 0x0 [0086.103] lstrlenW (lpString=".DBF") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".DBF") returned 0x0 [0086.103] lstrlenW (lpString=".DB") returned 3 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".DB") returned 0x0 [0086.103] lstrlenW (lpString=".db") returned 3 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".db") returned 0x0 [0086.103] lstrlenW (lpString=".ndf") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".ndf") returned 0x0 [0086.103] lstrlenW (lpString=".NDF") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".NDF") returned 0x0 [0086.103] lstrlenW (lpString=".Mdf") returned 4 [0086.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".Mdf") returned 0x0 [0086.104] lstrlenW (lpString=".dat") returned 4 [0086.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".dat") returned 0x0 [0086.104] lstrlenW (lpString=".DAT") returned 4 [0086.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".DAT") returned 0x0 [0086.104] lstrlenW (lpString=".ldf") returned 4 [0086.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".ldf") returned 0x0 [0086.104] lstrlenW (lpString=".LDF") returned 4 [0086.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch=".LDF") returned 0x0 [0086.104] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.104] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.105] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.105] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.105] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20610610984) returned 1 [0086.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2227030, dwHighDateTime=0x1d585b4)) [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763a30 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763a30 | out: hHeap=0x260000) returned 1 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.106] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.106] GetLastError () returned 0x0 [0086.106] GetLastError () returned 0x0 [0086.106] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.106] GetLastError () returned 0x0 [0086.106] GetLastError () returned 0x0 [0086.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffa5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.108] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x5a4, lpOverlapped=0x0) returned 1 [0086.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.108] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.109] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.109] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.109] CloseHandle (hObject=0xe4) returned 1 [0086.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.109] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.110] GetLastError () returned 0x0 [0086.110] RtlWakeConditionVariable () returned 0x0 [0086.110] GetCurrentThreadId () returned 0x99c [0086.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".ldf") returned 0x0 [0086.110] lstrlenW (lpString=".vhd") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".vhd") returned 0x0 [0086.111] lstrlenW (lpString=".vhdx") returned 5 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".vhdx") returned 0x0 [0086.111] lstrlenW (lpString=".pst") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".pst") returned 0x0 [0086.111] lstrlenW (lpString=".ost") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".ost") returned 0x0 [0086.111] lstrlenW (lpString=".bak") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".bak") returned 0x0 [0086.111] lstrlenW (lpString=".bac") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".bac") returned 0x0 [0086.111] lstrlenW (lpString=".sys") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".sys") returned 0x0 [0086.111] lstrlenW (lpString=".v2i") returned 4 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".v2i") returned 0x0 [0086.111] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0086.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.113] lstrlenW (lpString=".sql") returned 4 [0086.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".sql") returned 0x0 [0086.113] lstrlenW (lpString=".mdf") returned 4 [0086.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".mdf") returned 0x0 [0086.113] lstrlenW (lpString=".txt") returned 4 [0086.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".txt") returned 0x0 [0086.113] lstrlenW (lpString=".dbf") returned 4 [0086.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".dbf") returned 0x0 [0086.113] lstrlenW (lpString=".ckp") returned 4 [0086.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".ckp") returned 0x0 [0086.113] lstrlenW (lpString=".dacpac") returned 7 [0086.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".dacpac") returned 0x0 [0086.114] lstrlenW (lpString=".db3") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".db3") returned 0x0 [0086.114] lstrlenW (lpString=".dtxs") returned 5 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".dtxs") returned 0x0 [0086.114] lstrlenW (lpString=".mdt") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".mdt") returned 0x0 [0086.114] lstrlenW (lpString=".sdf") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".sdf") returned 0x0 [0086.114] lstrlenW (lpString=".MDF") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".MDF") returned 0x0 [0086.114] lstrlenW (lpString=".DBF") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".DBF") returned 0x0 [0086.114] lstrlenW (lpString=".DB") returned 3 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".DB") returned 0x0 [0086.114] lstrlenW (lpString=".db") returned 3 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".db") returned 0x0 [0086.114] lstrlenW (lpString=".ndf") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".ndf") returned 0x0 [0086.114] lstrlenW (lpString=".NDF") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".NDF") returned 0x0 [0086.114] lstrlenW (lpString=".Mdf") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".Mdf") returned 0x0 [0086.114] lstrlenW (lpString=".dat") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".dat") returned 0x0 [0086.114] lstrlenW (lpString=".DAT") returned 4 [0086.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".DAT") returned 0x0 [0086.115] lstrlenW (lpString=".ldf") returned 4 [0086.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".ldf") returned 0x0 [0086.115] lstrlenW (lpString=".LDF") returned 4 [0086.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch=".LDF") returned 0x0 [0086.115] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.115] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.116] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.116] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.116] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20611696078) returned 1 [0086.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc224d190, dwHighDateTime=0x1d585b4)) [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762e98 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762e98 | out: hHeap=0x260000) returned 1 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0086.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0086.117] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.117] GetLastError () returned 0x0 [0086.117] GetLastError () returned 0x0 [0086.117] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.117] GetLastError () returned 0x0 [0086.117] GetLastError () returned 0x0 [0086.119] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff2ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.119] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd14, lpOverlapped=0x0) returned 1 [0086.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.119] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.119] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.119] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.119] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.120] CloseHandle (hObject=0xe4) returned 1 [0086.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0086.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0086.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.121] GetLastError () returned 0x0 [0086.121] RtlWakeConditionVariable () returned 0x0 [0086.121] GetCurrentThreadId () returned 0x99c [0086.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".ldf") returned 0x0 [0086.121] lstrlenW (lpString=".vhd") returned 4 [0086.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".vhd") returned 0x0 [0086.122] lstrlenW (lpString=".vhdx") returned 5 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.122] lstrlenW (lpString=".pst") returned 4 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".pst") returned 0x0 [0086.122] lstrlenW (lpString=".ost") returned 4 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".ost") returned 0x0 [0086.122] lstrlenW (lpString=".bak") returned 4 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".bak") returned 0x0 [0086.122] lstrlenW (lpString=".bac") returned 4 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".bac") returned 0x0 [0086.122] lstrlenW (lpString=".sys") returned 4 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".sys") returned 0x0 [0086.122] lstrlenW (lpString=".v2i") returned 4 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".v2i") returned 0x0 [0086.122] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.219] lstrlenW (lpString=".sql") returned 4 [0086.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".sql") returned 0x0 [0086.229] lstrlenW (lpString=".mdf") returned 4 [0086.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".mdf") returned 0x0 [0086.229] lstrlenW (lpString=".txt") returned 4 [0086.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".txt") returned 0x0 [0086.229] lstrlenW (lpString=".dbf") returned 4 [0086.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".dbf") returned 0x0 [0086.229] lstrlenW (lpString=".ckp") returned 4 [0086.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".ckp") returned 0x0 [0086.233] lstrlenW (lpString=".dacpac") returned 7 [0086.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.233] lstrlenW (lpString=".db3") returned 4 [0086.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".db3") returned 0x0 [0086.234] lstrlenW (lpString=".dtxs") returned 5 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.234] lstrlenW (lpString=".mdt") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".mdt") returned 0x0 [0086.234] lstrlenW (lpString=".sdf") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".sdf") returned 0x0 [0086.234] lstrlenW (lpString=".MDF") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".MDF") returned 0x0 [0086.234] lstrlenW (lpString=".DBF") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".DBF") returned 0x0 [0086.234] lstrlenW (lpString=".DB") returned 3 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".DB") returned 0x0 [0086.234] lstrlenW (lpString=".db") returned 3 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".db") returned 0x0 [0086.234] lstrlenW (lpString=".ndf") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".ndf") returned 0x0 [0086.234] lstrlenW (lpString=".NDF") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".NDF") returned 0x0 [0086.234] lstrlenW (lpString=".Mdf") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.234] lstrlenW (lpString=".dat") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".dat") returned 0x0 [0086.234] lstrlenW (lpString=".DAT") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".DAT") returned 0x0 [0086.234] lstrlenW (lpString=".ldf") returned 4 [0086.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".ldf") returned 0x0 [0086.235] lstrlenW (lpString=".LDF") returned 4 [0086.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch=".LDF") returned 0x0 [0086.235] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.235] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.236] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.236] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.236] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20623739849) returned 1 [0086.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2357b30, dwHighDateTime=0x1d585b4)) [0086.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762920 [0086.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762920 | out: hHeap=0x260000) returned 1 [0086.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b2b8 [0086.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b2b8 | out: hHeap=0x260000) returned 1 [0086.237] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.237] GetLastError () returned 0x0 [0086.237] GetLastError () returned 0x0 [0086.238] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.238] GetLastError () returned 0x0 [0086.238] GetLastError () returned 0x0 [0086.239] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.239] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x838, lpOverlapped=0x0) returned 1 [0086.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.240] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.240] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.240] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.240] CloseHandle (hObject=0xe4) returned 1 [0086.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.284] GetLastError () returned 0x0 [0086.284] RtlWakeConditionVariable () returned 0x27e828 [0086.284] GetCurrentThreadId () returned 0x99c [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".ldf") returned 0x0 [0086.284] lstrlenW (lpString=".vhd") returned 4 [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".vhd") returned 0x0 [0086.284] lstrlenW (lpString=".vhdx") returned 5 [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".vhdx") returned 0x0 [0086.284] lstrlenW (lpString=".pst") returned 4 [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".pst") returned 0x0 [0086.284] lstrlenW (lpString=".ost") returned 4 [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".ost") returned 0x0 [0086.284] lstrlenW (lpString=".bak") returned 4 [0086.284] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".bak") returned 0x0 [0086.284] lstrlenW (lpString=".bac") returned 4 [0086.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".bac") returned 0x0 [0086.285] lstrlenW (lpString=".sys") returned 4 [0086.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".sys") returned 0x0 [0086.285] lstrlenW (lpString=".v2i") returned 4 [0086.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".v2i") returned 0x0 [0086.285] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.286] lstrlenW (lpString=".sql") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".sql") returned 0x0 [0086.286] lstrlenW (lpString=".mdf") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".mdf") returned 0x0 [0086.286] lstrlenW (lpString=".txt") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".txt") returned 0x0 [0086.286] lstrlenW (lpString=".dbf") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".dbf") returned 0x0 [0086.286] lstrlenW (lpString=".ckp") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".ckp") returned 0x0 [0086.286] lstrlenW (lpString=".dacpac") returned 7 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".dacpac") returned 0x0 [0086.286] lstrlenW (lpString=".db3") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".db3") returned 0x0 [0086.286] lstrlenW (lpString=".dtxs") returned 5 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".dtxs") returned 0x0 [0086.286] lstrlenW (lpString=".mdt") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".mdt") returned 0x0 [0086.286] lstrlenW (lpString=".sdf") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".sdf") returned 0x0 [0086.286] lstrlenW (lpString=".MDF") returned 4 [0086.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".MDF") returned 0x0 [0086.286] lstrlenW (lpString=".DBF") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".DBF") returned 0x0 [0086.287] lstrlenW (lpString=".DB") returned 3 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".DB") returned 0x0 [0086.287] lstrlenW (lpString=".db") returned 3 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".db") returned 0x0 [0086.287] lstrlenW (lpString=".ndf") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".ndf") returned 0x0 [0086.287] lstrlenW (lpString=".NDF") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".NDF") returned 0x0 [0086.287] lstrlenW (lpString=".Mdf") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".Mdf") returned 0x0 [0086.287] lstrlenW (lpString=".dat") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".dat") returned 0x0 [0086.287] lstrlenW (lpString=".DAT") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".DAT") returned 0x0 [0086.287] lstrlenW (lpString=".ldf") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".ldf") returned 0x0 [0086.287] lstrlenW (lpString=".LDF") returned 4 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch=".LDF") returned 0x0 [0086.287] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.287] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.288] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.288] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20628950969) returned 1 [0086.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc23f00b0, dwHighDateTime=0x1d585b4)) [0086.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1e78 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1e78 | out: hHeap=0x260000) returned 1 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.289] GetLastError () returned 0x0 [0086.289] GetLastError () returned 0x0 [0086.290] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.290] GetLastError () returned 0x0 [0086.290] GetLastError () returned 0x0 [0086.300] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe4b7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.300] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1b49, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x1b49, lpOverlapped=0x0) returned 1 [0086.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.300] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.300] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.300] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.300] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.300] CloseHandle (hObject=0xe4) returned 1 [0086.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.301] GetLastError () returned 0x0 [0086.302] RtlWakeConditionVariable () returned 0x0 [0086.302] GetCurrentThreadId () returned 0x99c [0086.302] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.302] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.302] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.302] WriteFile (in: hFile=0xe4, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.303] CloseHandle (hObject=0xe4) returned 1 [0086.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e7a0 | out: hHeap=0x260000) returned 1 [0086.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4e8 | out: hHeap=0x260000) returned 1 [0086.304] RtlWakeConditionVariable () returned 0x27e828 [0086.304] GetCurrentThreadId () returned 0x99c [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".ldf") returned 0x0 [0086.304] lstrlenW (lpString=".vhd") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".vhd") returned 0x0 [0086.304] lstrlenW (lpString=".vhdx") returned 5 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".vhdx") returned 0x0 [0086.304] lstrlenW (lpString=".pst") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".pst") returned 0x0 [0086.304] lstrlenW (lpString=".ost") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".ost") returned 0x0 [0086.304] lstrlenW (lpString=".bak") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".bak") returned 0x0 [0086.304] lstrlenW (lpString=".bac") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".bac") returned 0x0 [0086.304] lstrlenW (lpString=".sys") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".sys") returned 0x0 [0086.304] lstrlenW (lpString=".v2i") returned 4 [0086.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".v2i") returned 0x0 [0086.305] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.311] lstrlenW (lpString=".sql") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".sql") returned 0x0 [0086.311] lstrlenW (lpString=".mdf") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".mdf") returned 0x0 [0086.311] lstrlenW (lpString=".txt") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".txt") returned 0x0 [0086.311] lstrlenW (lpString=".dbf") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".dbf") returned 0x0 [0086.311] lstrlenW (lpString=".ckp") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".ckp") returned 0x0 [0086.311] lstrlenW (lpString=".dacpac") returned 7 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".dacpac") returned 0x0 [0086.311] lstrlenW (lpString=".db3") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".db3") returned 0x0 [0086.311] lstrlenW (lpString=".dtxs") returned 5 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".dtxs") returned 0x0 [0086.311] lstrlenW (lpString=".mdt") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".mdt") returned 0x0 [0086.311] lstrlenW (lpString=".sdf") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".sdf") returned 0x0 [0086.311] lstrlenW (lpString=".MDF") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".MDF") returned 0x0 [0086.311] lstrlenW (lpString=".DBF") returned 4 [0086.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".DBF") returned 0x0 [0086.311] lstrlenW (lpString=".DB") returned 3 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".DB") returned 0x0 [0086.312] lstrlenW (lpString=".db") returned 3 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".db") returned 0x0 [0086.312] lstrlenW (lpString=".ndf") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".ndf") returned 0x0 [0086.312] lstrlenW (lpString=".NDF") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".NDF") returned 0x0 [0086.312] lstrlenW (lpString=".Mdf") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".Mdf") returned 0x0 [0086.312] lstrlenW (lpString=".dat") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".dat") returned 0x0 [0086.312] lstrlenW (lpString=".DAT") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".DAT") returned 0x0 [0086.312] lstrlenW (lpString=".ldf") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".ldf") returned 0x0 [0086.312] lstrlenW (lpString=".LDF") returned 4 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch=".LDF") returned 0x0 [0086.312] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.312] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.313] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.313] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.313] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20631445450) returned 1 [0086.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2416210, dwHighDateTime=0x1d585b4)) [0086.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295038 [0086.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0086.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.314] GetLastError () returned 0x0 [0086.314] GetLastError () returned 0x0 [0086.314] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.315] GetLastError () returned 0x0 [0086.315] GetLastError () returned 0x0 [0086.317] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffbb37, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.317] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x44c9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x44c9, lpOverlapped=0x0) returned 1 [0086.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.317] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.318] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.318] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.318] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.318] CloseHandle (hObject=0xd8) returned 1 [0086.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.319] GetLastError () returned 0x0 [0086.319] RtlWakeConditionVariable () returned 0x0 [0086.319] GetCurrentThreadId () returned 0x99c [0086.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".ldf") returned 0x0 [0086.319] lstrlenW (lpString=".vhd") returned 4 [0086.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".vhd") returned 0x0 [0086.320] lstrlenW (lpString=".vhdx") returned 5 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".vhdx") returned 0x0 [0086.320] lstrlenW (lpString=".pst") returned 4 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".pst") returned 0x0 [0086.320] lstrlenW (lpString=".ost") returned 4 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".ost") returned 0x0 [0086.320] lstrlenW (lpString=".bak") returned 4 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".bak") returned 0x0 [0086.320] lstrlenW (lpString=".bac") returned 4 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".bac") returned 0x0 [0086.320] lstrlenW (lpString=".sys") returned 4 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".sys") returned 0x0 [0086.320] lstrlenW (lpString=".v2i") returned 4 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".v2i") returned 0x0 [0086.320] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.321] lstrlenW (lpString=".sql") returned 4 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".sql") returned 0x0 [0086.321] lstrlenW (lpString=".mdf") returned 4 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".mdf") returned 0x0 [0086.321] lstrlenW (lpString=".txt") returned 4 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".txt") returned 0x0 [0086.321] lstrlenW (lpString=".dbf") returned 4 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".dbf") returned 0x0 [0086.321] lstrlenW (lpString=".ckp") returned 4 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".ckp") returned 0x0 [0086.321] lstrlenW (lpString=".dacpac") returned 7 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".dacpac") returned 0x0 [0086.321] lstrlenW (lpString=".db3") returned 4 [0086.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".db3") returned 0x0 [0086.321] lstrlenW (lpString=".dtxs") returned 5 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".dtxs") returned 0x0 [0086.322] lstrlenW (lpString=".mdt") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".mdt") returned 0x0 [0086.322] lstrlenW (lpString=".sdf") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".sdf") returned 0x0 [0086.322] lstrlenW (lpString=".MDF") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".MDF") returned 0x0 [0086.322] lstrlenW (lpString=".DBF") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".DBF") returned 0x0 [0086.322] lstrlenW (lpString=".DB") returned 3 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".DB") returned 0x0 [0086.322] lstrlenW (lpString=".db") returned 3 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".db") returned 0x0 [0086.322] lstrlenW (lpString=".ndf") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".ndf") returned 0x0 [0086.322] lstrlenW (lpString=".NDF") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".NDF") returned 0x0 [0086.322] lstrlenW (lpString=".Mdf") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".Mdf") returned 0x0 [0086.322] lstrlenW (lpString=".dat") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".dat") returned 0x0 [0086.322] lstrlenW (lpString=".DAT") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".DAT") returned 0x0 [0086.322] lstrlenW (lpString=".ldf") returned 4 [0086.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".ldf") returned 0x0 [0086.323] lstrlenW (lpString=".LDF") returned 4 [0086.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch=".LDF") returned 0x0 [0086.323] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.323] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.324] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.324] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20632484779) returned 1 [0086.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc243c370, dwHighDateTime=0x1d585b4)) [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295000 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295000 | out: hHeap=0x260000) returned 1 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.325] GetLastError () returned 0x0 [0086.325] GetLastError () returned 0x0 [0086.325] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.325] GetLastError () returned 0x0 [0086.325] GetLastError () returned 0x0 [0086.327] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffccaa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.327] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3356, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3356, lpOverlapped=0x0) returned 1 [0086.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.327] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.327] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.327] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.327] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.328] CloseHandle (hObject=0xd8) returned 1 [0086.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.329] GetLastError () returned 0x0 [0086.329] RtlWakeConditionVariable () returned 0x27e828 [0086.329] GetCurrentThreadId () returned 0x99c [0086.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".ldf") returned 0x0 [0086.329] lstrlenW (lpString=".vhd") returned 4 [0086.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".vhd") returned 0x0 [0086.329] lstrlenW (lpString=".vhdx") returned 5 [0086.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.329] lstrlenW (lpString=".pst") returned 4 [0086.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".pst") returned 0x0 [0086.329] lstrlenW (lpString=".ost") returned 4 [0086.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".ost") returned 0x0 [0086.330] lstrlenW (lpString=".bak") returned 4 [0086.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".bak") returned 0x0 [0086.330] lstrlenW (lpString=".bac") returned 4 [0086.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".bac") returned 0x0 [0086.330] lstrlenW (lpString=".sys") returned 4 [0086.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".sys") returned 0x0 [0086.330] lstrlenW (lpString=".v2i") returned 4 [0086.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".v2i") returned 0x0 [0086.330] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.354] lstrlenW (lpString=".sql") returned 4 [0086.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".sql") returned 0x0 [0086.358] lstrlenW (lpString=".mdf") returned 4 [0086.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".mdf") returned 0x0 [0086.358] lstrlenW (lpString=".txt") returned 4 [0086.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".txt") returned 0x0 [0086.358] lstrlenW (lpString=".dbf") returned 4 [0086.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".dbf") returned 0x0 [0086.359] lstrlenW (lpString=".ckp") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".ckp") returned 0x0 [0086.359] lstrlenW (lpString=".dacpac") returned 7 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.359] lstrlenW (lpString=".db3") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".db3") returned 0x0 [0086.359] lstrlenW (lpString=".dtxs") returned 5 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.359] lstrlenW (lpString=".mdt") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".mdt") returned 0x0 [0086.359] lstrlenW (lpString=".sdf") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".sdf") returned 0x0 [0086.359] lstrlenW (lpString=".MDF") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".MDF") returned 0x0 [0086.359] lstrlenW (lpString=".DBF") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".DBF") returned 0x0 [0086.359] lstrlenW (lpString=".DB") returned 3 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".DB") returned 0x0 [0086.359] lstrlenW (lpString=".db") returned 3 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".db") returned 0x0 [0086.359] lstrlenW (lpString=".ndf") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".ndf") returned 0x0 [0086.359] lstrlenW (lpString=".NDF") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".NDF") returned 0x0 [0086.359] lstrlenW (lpString=".Mdf") returned 4 [0086.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.360] lstrlenW (lpString=".dat") returned 4 [0086.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".dat") returned 0x0 [0086.360] lstrlenW (lpString=".DAT") returned 4 [0086.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".DAT") returned 0x0 [0086.360] lstrlenW (lpString=".ldf") returned 4 [0086.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".ldf") returned 0x0 [0086.360] lstrlenW (lpString=".LDF") returned 4 [0086.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch=".LDF") returned 0x0 [0086.360] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.360] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.361] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.361] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.361] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20636211052) returned 1 [0086.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2488630, dwHighDateTime=0x1d585b4)) [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295498 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.362] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.362] GetLastError () returned 0x0 [0086.362] GetLastError () returned 0x0 [0086.362] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.362] GetLastError () returned 0x0 [0086.363] GetLastError () returned 0x0 [0086.364] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe390, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.364] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1c70, lpOverlapped=0x0) returned 1 [0086.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.365] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.365] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.365] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.365] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.365] CloseHandle (hObject=0xd8) returned 1 [0086.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.413] GetLastError () returned 0x0 [0086.413] RtlWakeConditionVariable () returned 0x27e828 [0086.413] GetCurrentThreadId () returned 0x99c [0086.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".ldf") returned 0x0 [0086.413] lstrlenW (lpString=".vhd") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".vhd") returned 0x0 [0086.414] lstrlenW (lpString=".vhdx") returned 5 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".vhdx") returned 0x0 [0086.414] lstrlenW (lpString=".pst") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".pst") returned 0x0 [0086.414] lstrlenW (lpString=".ost") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".ost") returned 0x0 [0086.414] lstrlenW (lpString=".bak") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".bak") returned 0x0 [0086.414] lstrlenW (lpString=".bac") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".bac") returned 0x0 [0086.414] lstrlenW (lpString=".sys") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".sys") returned 0x0 [0086.414] lstrlenW (lpString=".v2i") returned 4 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".v2i") returned 0x0 [0086.414] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.415] lstrlenW (lpString=".sql") returned 4 [0086.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".sql") returned 0x0 [0086.415] lstrlenW (lpString=".mdf") returned 4 [0086.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".mdf") returned 0x0 [0086.415] lstrlenW (lpString=".txt") returned 4 [0086.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".txt") returned 0x0 [0086.415] lstrlenW (lpString=".dbf") returned 4 [0086.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".dbf") returned 0x0 [0086.416] lstrlenW (lpString=".ckp") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".ckp") returned 0x0 [0086.416] lstrlenW (lpString=".dacpac") returned 7 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".dacpac") returned 0x0 [0086.416] lstrlenW (lpString=".db3") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".db3") returned 0x0 [0086.416] lstrlenW (lpString=".dtxs") returned 5 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".dtxs") returned 0x0 [0086.416] lstrlenW (lpString=".mdt") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".mdt") returned 0x0 [0086.416] lstrlenW (lpString=".sdf") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".sdf") returned 0x0 [0086.416] lstrlenW (lpString=".MDF") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".MDF") returned 0x0 [0086.416] lstrlenW (lpString=".DBF") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".DBF") returned 0x0 [0086.416] lstrlenW (lpString=".DB") returned 3 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".DB") returned 0x0 [0086.416] lstrlenW (lpString=".db") returned 3 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".db") returned 0x0 [0086.416] lstrlenW (lpString=".ndf") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".ndf") returned 0x0 [0086.416] lstrlenW (lpString=".NDF") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".NDF") returned 0x0 [0086.416] lstrlenW (lpString=".Mdf") returned 4 [0086.416] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".Mdf") returned 0x0 [0086.417] lstrlenW (lpString=".dat") returned 4 [0086.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".dat") returned 0x0 [0086.417] lstrlenW (lpString=".DAT") returned 4 [0086.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".DAT") returned 0x0 [0086.417] lstrlenW (lpString=".ldf") returned 4 [0086.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".ldf") returned 0x0 [0086.417] lstrlenW (lpString=".LDF") returned 4 [0086.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch=".LDF") returned 0x0 [0086.417] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.417] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.418] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.418] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.418] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20641909319) returned 1 [0086.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2520bb0, dwHighDateTime=0x1d585b4)) [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c7c8 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c7c8 | out: hHeap=0x260000) returned 1 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.419] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.419] GetLastError () returned 0x0 [0086.419] GetLastError () returned 0x0 [0086.419] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.419] GetLastError () returned 0x0 [0086.419] GetLastError () returned 0x0 [0086.432] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffec36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.432] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x13ca, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x13ca, lpOverlapped=0x0) returned 1 [0086.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.433] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.433] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.433] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.433] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.433] CloseHandle (hObject=0xe4) returned 1 [0086.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.434] GetLastError () returned 0x0 [0086.434] RtlWakeConditionVariable () returned 0x27e828 [0086.435] GetCurrentThreadId () returned 0x99c [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".ldf") returned 0x0 [0086.435] lstrlenW (lpString=".vhd") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".vhd") returned 0x0 [0086.435] lstrlenW (lpString=".vhdx") returned 5 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".vhdx") returned 0x0 [0086.435] lstrlenW (lpString=".pst") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".pst") returned 0x0 [0086.435] lstrlenW (lpString=".ost") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".ost") returned 0x0 [0086.435] lstrlenW (lpString=".bak") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".bak") returned 0x0 [0086.435] lstrlenW (lpString=".bac") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".bac") returned 0x0 [0086.435] lstrlenW (lpString=".sys") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".sys") returned 0x0 [0086.435] lstrlenW (lpString=".v2i") returned 4 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".v2i") returned 0x0 [0086.435] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.456] lstrlenW (lpString=".sql") returned 4 [0086.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".sql") returned 0x0 [0086.456] lstrlenW (lpString=".mdf") returned 4 [0086.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".mdf") returned 0x0 [0086.456] lstrlenW (lpString=".txt") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".txt") returned 0x0 [0086.457] lstrlenW (lpString=".dbf") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".dbf") returned 0x0 [0086.457] lstrlenW (lpString=".ckp") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".ckp") returned 0x0 [0086.457] lstrlenW (lpString=".dacpac") returned 7 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".dacpac") returned 0x0 [0086.457] lstrlenW (lpString=".db3") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".db3") returned 0x0 [0086.457] lstrlenW (lpString=".dtxs") returned 5 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".dtxs") returned 0x0 [0086.457] lstrlenW (lpString=".mdt") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".mdt") returned 0x0 [0086.457] lstrlenW (lpString=".sdf") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".sdf") returned 0x0 [0086.457] lstrlenW (lpString=".MDF") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".MDF") returned 0x0 [0086.457] lstrlenW (lpString=".DBF") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".DBF") returned 0x0 [0086.457] lstrlenW (lpString=".DB") returned 3 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".DB") returned 0x0 [0086.457] lstrlenW (lpString=".db") returned 3 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".db") returned 0x0 [0086.457] lstrlenW (lpString=".ndf") returned 4 [0086.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".ndf") returned 0x0 [0086.457] lstrlenW (lpString=".NDF") returned 4 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".NDF") returned 0x0 [0086.458] lstrlenW (lpString=".Mdf") returned 4 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".Mdf") returned 0x0 [0086.458] lstrlenW (lpString=".dat") returned 4 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".dat") returned 0x0 [0086.458] lstrlenW (lpString=".DAT") returned 4 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".DAT") returned 0x0 [0086.458] lstrlenW (lpString=".ldf") returned 4 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".ldf") returned 0x0 [0086.458] lstrlenW (lpString=".LDF") returned 4 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch=".LDF") returned 0x0 [0086.458] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.458] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.459] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.459] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20646021546) returned 1 [0086.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2592fd0, dwHighDateTime=0x1d585b4)) [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c8a8 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c8a8 | out: hHeap=0x260000) returned 1 [0086.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.460] GetLastError () returned 0x0 [0086.460] GetLastError () returned 0x0 [0086.460] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.460] GetLastError () returned 0x0 [0086.460] GetLastError () returned 0x0 [0086.462] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffbe22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.462] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x41de, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x41de, lpOverlapped=0x0) returned 1 [0086.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.463] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.463] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.463] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.463] CloseHandle (hObject=0xe4) returned 1 [0086.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.464] GetLastError () returned 0x0 [0086.464] RtlWakeConditionVariable () returned 0x0 [0086.464] GetCurrentThreadId () returned 0x99c [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".ldf") returned 0x0 [0086.465] lstrlenW (lpString=".vhd") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".vhd") returned 0x0 [0086.465] lstrlenW (lpString=".vhdx") returned 5 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.465] lstrlenW (lpString=".pst") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".pst") returned 0x0 [0086.465] lstrlenW (lpString=".ost") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".ost") returned 0x0 [0086.465] lstrlenW (lpString=".bak") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".bak") returned 0x0 [0086.465] lstrlenW (lpString=".bac") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".bac") returned 0x0 [0086.465] lstrlenW (lpString=".sys") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".sys") returned 0x0 [0086.465] lstrlenW (lpString=".v2i") returned 4 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".v2i") returned 0x0 [0086.465] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0086.466] lstrlenW (lpString=".sql") returned 4 [0086.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".sql") returned 0x0 [0086.466] lstrlenW (lpString=".mdf") returned 4 [0086.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".mdf") returned 0x0 [0086.466] lstrlenW (lpString=".txt") returned 4 [0086.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".txt") returned 0x0 [0086.466] lstrlenW (lpString=".dbf") returned 4 [0086.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".dbf") returned 0x0 [0086.467] lstrlenW (lpString=".ckp") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".ckp") returned 0x0 [0086.467] lstrlenW (lpString=".dacpac") returned 7 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.467] lstrlenW (lpString=".db3") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".db3") returned 0x0 [0086.467] lstrlenW (lpString=".dtxs") returned 5 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.467] lstrlenW (lpString=".mdt") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".mdt") returned 0x0 [0086.467] lstrlenW (lpString=".sdf") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".sdf") returned 0x0 [0086.467] lstrlenW (lpString=".MDF") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".MDF") returned 0x0 [0086.467] lstrlenW (lpString=".DBF") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".DBF") returned 0x0 [0086.467] lstrlenW (lpString=".DB") returned 3 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".DB") returned 0x0 [0086.467] lstrlenW (lpString=".db") returned 3 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".db") returned 0x0 [0086.467] lstrlenW (lpString=".ndf") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".ndf") returned 0x0 [0086.467] lstrlenW (lpString=".NDF") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".NDF") returned 0x0 [0086.467] lstrlenW (lpString=".Mdf") returned 4 [0086.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.468] lstrlenW (lpString=".dat") returned 4 [0086.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".dat") returned 0x0 [0086.468] lstrlenW (lpString=".DAT") returned 4 [0086.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".DAT") returned 0x0 [0086.468] lstrlenW (lpString=".ldf") returned 4 [0086.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".ldf") returned 0x0 [0086.468] lstrlenW (lpString=".LDF") returned 4 [0086.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch=".LDF") returned 0x0 [0086.468] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.468] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.469] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.469] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.469] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20647011818) returned 1 [0086.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2592fd0, dwHighDateTime=0x1d585b4)) [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c8e0 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c8e0 | out: hHeap=0x260000) returned 1 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.470] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.470] GetLastError () returned 0x0 [0086.470] GetLastError () returned 0x0 [0086.470] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.470] GetLastError () returned 0x0 [0086.470] GetLastError () returned 0x0 [0086.516] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.516] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x1c6e, lpOverlapped=0x0) returned 1 [0086.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.517] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.517] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.517] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.517] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.517] CloseHandle (hObject=0xe4) returned 1 [0086.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.558] GetLastError () returned 0x0 [0086.559] RtlWakeConditionVariable () returned 0x27e828 [0086.559] GetCurrentThreadId () returned 0x99c [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".ldf") returned 0x0 [0086.559] lstrlenW (lpString=".vhd") returned 4 [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".vhd") returned 0x0 [0086.559] lstrlenW (lpString=".vhdx") returned 5 [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".vhdx") returned 0x0 [0086.559] lstrlenW (lpString=".pst") returned 4 [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".pst") returned 0x0 [0086.559] lstrlenW (lpString=".ost") returned 4 [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".ost") returned 0x0 [0086.559] lstrlenW (lpString=".bak") returned 4 [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".bak") returned 0x0 [0086.559] lstrlenW (lpString=".bac") returned 4 [0086.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".bac") returned 0x0 [0086.559] lstrlenW (lpString=".sys") returned 4 [0086.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".sys") returned 0x0 [0086.560] lstrlenW (lpString=".v2i") returned 4 [0086.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".v2i") returned 0x0 [0086.560] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.561] lstrlenW (lpString=".sql") returned 4 [0086.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".sql") returned 0x0 [0086.561] lstrlenW (lpString=".mdf") returned 4 [0086.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".mdf") returned 0x0 [0086.562] lstrlenW (lpString=".txt") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".txt") returned 0x0 [0086.562] lstrlenW (lpString=".dbf") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".dbf") returned 0x0 [0086.562] lstrlenW (lpString=".ckp") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".ckp") returned 0x0 [0086.562] lstrlenW (lpString=".dacpac") returned 7 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".dacpac") returned 0x0 [0086.562] lstrlenW (lpString=".db3") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".db3") returned 0x0 [0086.562] lstrlenW (lpString=".dtxs") returned 5 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".dtxs") returned 0x0 [0086.562] lstrlenW (lpString=".mdt") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".mdt") returned 0x0 [0086.562] lstrlenW (lpString=".sdf") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".sdf") returned 0x0 [0086.562] lstrlenW (lpString=".MDF") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".MDF") returned 0x0 [0086.562] lstrlenW (lpString=".DBF") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".DBF") returned 0x0 [0086.562] lstrlenW (lpString=".DB") returned 3 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".DB") returned 0x0 [0086.562] lstrlenW (lpString=".db") returned 3 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".db") returned 0x0 [0086.562] lstrlenW (lpString=".ndf") returned 4 [0086.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".ndf") returned 0x0 [0086.563] lstrlenW (lpString=".NDF") returned 4 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".NDF") returned 0x0 [0086.563] lstrlenW (lpString=".Mdf") returned 4 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".Mdf") returned 0x0 [0086.563] lstrlenW (lpString=".dat") returned 4 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".dat") returned 0x0 [0086.563] lstrlenW (lpString=".DAT") returned 4 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".DAT") returned 0x0 [0086.563] lstrlenW (lpString=".ldf") returned 4 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".ldf") returned 0x0 [0086.563] lstrlenW (lpString=".LDF") returned 4 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch=".LDF") returned 0x0 [0086.563] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.563] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.564] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.564] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20656527565) returned 1 [0086.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2677810, dwHighDateTime=0x1d585b4)) [0086.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33caa0 [0086.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33caa0 | out: hHeap=0x260000) returned 1 [0086.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.565] GetLastError () returned 0x0 [0086.565] GetLastError () returned 0x0 [0086.566] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] GetLastError () returned 0x0 [0086.568] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe229, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.568] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1dd7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1dd7, lpOverlapped=0x0) returned 1 [0086.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.569] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.569] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.569] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.569] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.569] CloseHandle (hObject=0xf0) returned 1 [0086.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d2378 [0086.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d2378 | out: hHeap=0x260000) returned 1 [0086.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.572] GetLastError () returned 0x0 [0086.573] RtlWakeConditionVariable () returned 0x0 [0086.573] GetCurrentThreadId () returned 0x99c [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.573] lstrlenW (lpString=".vhd") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.573] lstrlenW (lpString=".vhdx") returned 5 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.573] lstrlenW (lpString=".pst") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.573] lstrlenW (lpString=".ost") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.573] lstrlenW (lpString=".bak") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.573] lstrlenW (lpString=".bac") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.573] lstrlenW (lpString=".sys") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.573] lstrlenW (lpString=".v2i") returned 4 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.573] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.575] lstrlenW (lpString=".sql") returned 4 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.575] lstrlenW (lpString=".mdf") returned 4 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.575] lstrlenW (lpString=".txt") returned 4 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.575] lstrlenW (lpString=".dbf") returned 4 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.575] lstrlenW (lpString=".ckp") returned 4 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.575] lstrlenW (lpString=".dacpac") returned 7 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.575] lstrlenW (lpString=".db3") returned 4 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.575] lstrlenW (lpString=".dtxs") returned 5 [0086.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.575] lstrlenW (lpString=".mdt") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.576] lstrlenW (lpString=".sdf") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.576] lstrlenW (lpString=".MDF") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.576] lstrlenW (lpString=".DBF") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.576] lstrlenW (lpString=".DB") returned 3 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.576] lstrlenW (lpString=".db") returned 3 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".db") returned 0x0 [0086.576] lstrlenW (lpString=".ndf") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.576] lstrlenW (lpString=".NDF") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.576] lstrlenW (lpString=".Mdf") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.576] lstrlenW (lpString=".dat") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.576] lstrlenW (lpString=".DAT") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.576] lstrlenW (lpString=".ldf") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.576] lstrlenW (lpString=".LDF") returned 4 [0086.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.577] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.577] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.578] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.578] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20657883524) returned 1 [0086.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc269d970, dwHighDateTime=0x1d585b4)) [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cad8 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cad8 | out: hHeap=0x260000) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.578] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.579] GetLastError () returned 0x0 [0086.579] GetLastError () returned 0x0 [0086.579] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.579] GetLastError () returned 0x0 [0086.579] GetLastError () returned 0x0 [0086.581] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd868, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.581] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2798, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x2798, lpOverlapped=0x0) returned 1 [0086.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.581] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.581] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.582] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.582] CloseHandle (hObject=0xf0) returned 1 [0086.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0086.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0086.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.584] GetLastError () returned 0x0 [0086.584] RtlWakeConditionVariable () returned 0x0 [0086.584] GetCurrentThreadId () returned 0x99c [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.584] lstrlenW (lpString=".vhd") returned 4 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.584] lstrlenW (lpString=".vhdx") returned 5 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.584] lstrlenW (lpString=".pst") returned 4 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.584] lstrlenW (lpString=".ost") returned 4 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.584] lstrlenW (lpString=".bak") returned 4 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.584] lstrlenW (lpString=".bac") returned 4 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.584] lstrlenW (lpString=".sys") returned 4 [0086.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.585] lstrlenW (lpString=".v2i") returned 4 [0086.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.585] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.586] lstrlenW (lpString=".sql") returned 4 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.586] lstrlenW (lpString=".mdf") returned 4 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.586] lstrlenW (lpString=".txt") returned 4 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.586] lstrlenW (lpString=".dbf") returned 4 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.586] lstrlenW (lpString=".ckp") returned 4 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.586] lstrlenW (lpString=".dacpac") returned 7 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.586] lstrlenW (lpString=".db3") returned 4 [0086.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.586] lstrlenW (lpString=".dtxs") returned 5 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.587] lstrlenW (lpString=".mdt") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.587] lstrlenW (lpString=".sdf") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.587] lstrlenW (lpString=".MDF") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.587] lstrlenW (lpString=".DBF") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.587] lstrlenW (lpString=".DB") returned 3 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.587] lstrlenW (lpString=".db") returned 3 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.587] lstrlenW (lpString=".ndf") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.587] lstrlenW (lpString=".NDF") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.587] lstrlenW (lpString=".Mdf") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.587] lstrlenW (lpString=".dat") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.587] lstrlenW (lpString=".DAT") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.587] lstrlenW (lpString=".ldf") returned 4 [0086.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.587] lstrlenW (lpString=".LDF") returned 4 [0086.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.588] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.588] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.589] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.589] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20658987957) returned 1 [0086.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc26c3ad0, dwHighDateTime=0x1d585b4)) [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cb10 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cb10 | out: hHeap=0x260000) returned 1 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.590] GetLastError () returned 0x0 [0086.590] GetLastError () returned 0x0 [0086.590] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.590] GetLastError () returned 0x0 [0086.590] GetLastError () returned 0x0 [0086.591] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.592] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xc0, lpOverlapped=0x0) returned 1 [0086.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.592] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.592] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.592] CloseHandle (hObject=0xf0) returned 1 [0086.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d2378 [0086.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d2378 | out: hHeap=0x260000) returned 1 [0086.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.594] GetLastError () returned 0x0 [0086.594] RtlWakeConditionVariable () returned 0x0 [0086.594] GetCurrentThreadId () returned 0x99c [0086.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".ldf") returned 0x0 [0086.594] lstrlenW (lpString=".vhd") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".vhd") returned 0x0 [0086.595] lstrlenW (lpString=".vhdx") returned 5 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".vhdx") returned 0x0 [0086.595] lstrlenW (lpString=".pst") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".pst") returned 0x0 [0086.595] lstrlenW (lpString=".ost") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".ost") returned 0x0 [0086.595] lstrlenW (lpString=".bak") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".bak") returned 0x0 [0086.595] lstrlenW (lpString=".bac") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".bac") returned 0x0 [0086.595] lstrlenW (lpString=".sys") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".sys") returned 0x0 [0086.595] lstrlenW (lpString=".v2i") returned 4 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".v2i") returned 0x0 [0086.595] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.597] lstrlenW (lpString=".sql") returned 4 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".sql") returned 0x0 [0086.597] lstrlenW (lpString=".mdf") returned 4 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".mdf") returned 0x0 [0086.597] lstrlenW (lpString=".txt") returned 4 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".txt") returned 0x0 [0086.597] lstrlenW (lpString=".dbf") returned 4 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".dbf") returned 0x0 [0086.597] lstrlenW (lpString=".ckp") returned 4 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".ckp") returned 0x0 [0086.597] lstrlenW (lpString=".dacpac") returned 7 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".dacpac") returned 0x0 [0086.597] lstrlenW (lpString=".db3") returned 4 [0086.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".db3") returned 0x0 [0086.597] lstrlenW (lpString=".dtxs") returned 5 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".dtxs") returned 0x0 [0086.598] lstrlenW (lpString=".mdt") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".mdt") returned 0x0 [0086.598] lstrlenW (lpString=".sdf") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".sdf") returned 0x0 [0086.598] lstrlenW (lpString=".MDF") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".MDF") returned 0x0 [0086.598] lstrlenW (lpString=".DBF") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".DBF") returned 0x0 [0086.598] lstrlenW (lpString=".DB") returned 3 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".DB") returned 0x0 [0086.598] lstrlenW (lpString=".db") returned 3 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".db") returned 0x0 [0086.598] lstrlenW (lpString=".ndf") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".ndf") returned 0x0 [0086.598] lstrlenW (lpString=".NDF") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".NDF") returned 0x0 [0086.598] lstrlenW (lpString=".Mdf") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".Mdf") returned 0x0 [0086.598] lstrlenW (lpString=".dat") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".dat") returned 0x0 [0086.598] lstrlenW (lpString=".DAT") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".DAT") returned 0x0 [0086.598] lstrlenW (lpString=".ldf") returned 4 [0086.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".ldf") returned 0x0 [0086.598] lstrlenW (lpString=".LDF") returned 4 [0086.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch=".LDF") returned 0x0 [0086.599] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.599] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.600] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.600] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.600] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20660087928) returned 1 [0086.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc26e9c30, dwHighDateTime=0x1d585b4)) [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cb48 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cb48 | out: hHeap=0x260000) returned 1 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.601] GetLastError () returned 0x0 [0086.601] GetLastError () returned 0x0 [0086.601] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.601] GetLastError () returned 0x0 [0086.601] GetLastError () returned 0x0 [0086.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe014, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.603] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1fec, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1fec, lpOverlapped=0x0) returned 1 [0086.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.603] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.603] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.603] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.604] CloseHandle (hObject=0xf0) returned 1 [0086.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0086.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0086.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.605] GetLastError () returned 0x0 [0086.605] RtlWakeConditionVariable () returned 0x0 [0086.605] GetCurrentThreadId () returned 0x99c [0086.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.605] lstrlenW (lpString=".vhd") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.606] lstrlenW (lpString=".vhdx") returned 5 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.606] lstrlenW (lpString=".pst") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.606] lstrlenW (lpString=".ost") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.606] lstrlenW (lpString=".bak") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.606] lstrlenW (lpString=".bac") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.606] lstrlenW (lpString=".sys") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.606] lstrlenW (lpString=".v2i") returned 4 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.606] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.607] lstrlenW (lpString=".sql") returned 4 [0086.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.607] lstrlenW (lpString=".mdf") returned 4 [0086.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.607] lstrlenW (lpString=".txt") returned 4 [0086.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.607] lstrlenW (lpString=".dbf") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.608] lstrlenW (lpString=".ckp") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.608] lstrlenW (lpString=".dacpac") returned 7 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.608] lstrlenW (lpString=".db3") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.608] lstrlenW (lpString=".dtxs") returned 5 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.608] lstrlenW (lpString=".mdt") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.608] lstrlenW (lpString=".sdf") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.608] lstrlenW (lpString=".MDF") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.608] lstrlenW (lpString=".DBF") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.608] lstrlenW (lpString=".DB") returned 3 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.608] lstrlenW (lpString=".db") returned 3 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".db") returned 0x0 [0086.608] lstrlenW (lpString=".ndf") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.608] lstrlenW (lpString=".NDF") returned 4 [0086.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.609] lstrlenW (lpString=".Mdf") returned 4 [0086.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.609] lstrlenW (lpString=".dat") returned 4 [0086.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.609] lstrlenW (lpString=".DAT") returned 4 [0086.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.609] lstrlenW (lpString=".ldf") returned 4 [0086.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.609] lstrlenW (lpString=".LDF") returned 4 [0086.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.609] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.609] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.610] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.610] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20661123674) returned 1 [0086.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc26e9c30, dwHighDateTime=0x1d585b4)) [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cb80 [0086.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cb80 | out: hHeap=0x260000) returned 1 [0086.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.611] GetLastError () returned 0x0 [0086.611] GetLastError () returned 0x0 [0086.611] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.612] GetLastError () returned 0x0 [0086.612] GetLastError () returned 0x0 [0086.613] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe002, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.614] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1ffe, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1ffe, lpOverlapped=0x0) returned 1 [0086.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.614] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.614] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.614] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.614] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.614] CloseHandle (hObject=0xf0) returned 1 [0086.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f868 [0086.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f868 | out: hHeap=0x260000) returned 1 [0086.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.616] GetLastError () returned 0x0 [0086.616] RtlWakeConditionVariable () returned 0x0 [0086.616] GetCurrentThreadId () returned 0x99c [0086.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.616] lstrlenW (lpString=".vhd") returned 4 [0086.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.616] lstrlenW (lpString=".vhdx") returned 5 [0086.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.616] lstrlenW (lpString=".pst") returned 4 [0086.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.616] lstrlenW (lpString=".ost") returned 4 [0086.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.617] lstrlenW (lpString=".bak") returned 4 [0086.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.617] lstrlenW (lpString=".bac") returned 4 [0086.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.617] lstrlenW (lpString=".sys") returned 4 [0086.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.617] lstrlenW (lpString=".v2i") returned 4 [0086.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.617] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.618] lstrlenW (lpString=".sql") returned 4 [0086.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.618] lstrlenW (lpString=".mdf") returned 4 [0086.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.618] lstrlenW (lpString=".txt") returned 4 [0086.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.618] lstrlenW (lpString=".dbf") returned 4 [0086.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.618] lstrlenW (lpString=".ckp") returned 4 [0086.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.618] lstrlenW (lpString=".dacpac") returned 7 [0086.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.618] lstrlenW (lpString=".db3") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.619] lstrlenW (lpString=".dtxs") returned 5 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.619] lstrlenW (lpString=".mdt") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.619] lstrlenW (lpString=".sdf") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.619] lstrlenW (lpString=".MDF") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.619] lstrlenW (lpString=".DBF") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.619] lstrlenW (lpString=".DB") returned 3 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.619] lstrlenW (lpString=".db") returned 3 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.619] lstrlenW (lpString=".ndf") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.619] lstrlenW (lpString=".NDF") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.619] lstrlenW (lpString=".Mdf") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.619] lstrlenW (lpString=".dat") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.619] lstrlenW (lpString=".DAT") returned 4 [0086.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.620] lstrlenW (lpString=".ldf") returned 4 [0086.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.620] lstrlenW (lpString=".LDF") returned 4 [0086.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.620] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.620] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.621] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.621] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.621] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20662196501) returned 1 [0086.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc270fd90, dwHighDateTime=0x1d585b4)) [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cbb8 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cbb8 | out: hHeap=0x260000) returned 1 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.622] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.622] GetLastError () returned 0x0 [0086.622] GetLastError () returned 0x0 [0086.622] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.622] GetLastError () returned 0x0 [0086.622] GetLastError () returned 0x0 [0086.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffa5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.624] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x5a4, lpOverlapped=0x0) returned 1 [0086.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.624] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.624] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.624] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.625] CloseHandle (hObject=0xf0) returned 1 [0086.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f868 [0086.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f868 | out: hHeap=0x260000) returned 1 [0086.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.626] GetLastError () returned 0x0 [0086.626] RtlWakeConditionVariable () returned 0x0 [0086.626] GetCurrentThreadId () returned 0x99c [0086.627] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.627] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.635] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.635] WriteFile (in: hFile=0xf0, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.637] CloseHandle (hObject=0xf0) returned 1 [0086.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f9c0 | out: hHeap=0x260000) returned 1 [0086.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ed10 | out: hHeap=0x260000) returned 1 [0086.637] RtlWakeConditionVariable () returned 0x0 [0086.637] GetCurrentThreadId () returned 0x99c [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.638] lstrlenW (lpString=".vhd") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.638] lstrlenW (lpString=".vhdx") returned 5 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.638] lstrlenW (lpString=".pst") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.638] lstrlenW (lpString=".ost") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.638] lstrlenW (lpString=".bak") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.638] lstrlenW (lpString=".bac") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.638] lstrlenW (lpString=".sys") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.638] lstrlenW (lpString=".v2i") returned 4 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.638] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.639] lstrlenW (lpString=".sql") returned 4 [0086.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.639] lstrlenW (lpString=".mdf") returned 4 [0086.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.639] lstrlenW (lpString=".txt") returned 4 [0086.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.639] lstrlenW (lpString=".dbf") returned 4 [0086.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.639] lstrlenW (lpString=".ckp") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.640] lstrlenW (lpString=".dacpac") returned 7 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.640] lstrlenW (lpString=".db3") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.640] lstrlenW (lpString=".dtxs") returned 5 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.640] lstrlenW (lpString=".mdt") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.640] lstrlenW (lpString=".sdf") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.640] lstrlenW (lpString=".MDF") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.640] lstrlenW (lpString=".DBF") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.640] lstrlenW (lpString=".DB") returned 3 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.640] lstrlenW (lpString=".db") returned 3 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".db") returned 0x0 [0086.640] lstrlenW (lpString=".ndf") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.640] lstrlenW (lpString=".NDF") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.640] lstrlenW (lpString=".Mdf") returned 4 [0086.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.640] lstrlenW (lpString=".dat") returned 4 [0086.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.641] lstrlenW (lpString=".DAT") returned 4 [0086.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.641] lstrlenW (lpString=".ldf") returned 4 [0086.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.641] lstrlenW (lpString=".LDF") returned 4 [0086.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.641] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.641] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.642] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.642] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.642] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20664311383) returned 1 [0086.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2735ef0, dwHighDateTime=0x1d585b4)) [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f268 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f268 | out: hHeap=0x260000) returned 1 [0086.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.643] GetLastError () returned 0x0 [0086.643] GetLastError () returned 0x0 [0086.643] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.643] GetLastError () returned 0x0 [0086.644] GetLastError () returned 0x0 [0086.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc6c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.646] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x393c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x393c, lpOverlapped=0x0) returned 1 [0086.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.646] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.646] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.646] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.646] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.647] CloseHandle (hObject=0xf0) returned 1 [0086.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.650] GetLastError () returned 0x0 [0086.650] RtlWakeConditionVariable () returned 0x0 [0086.650] GetCurrentThreadId () returned 0x99c [0086.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.650] lstrlenW (lpString=".vhd") returned 4 [0086.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.650] lstrlenW (lpString=".vhdx") returned 5 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.651] lstrlenW (lpString=".pst") returned 4 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.651] lstrlenW (lpString=".ost") returned 4 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.651] lstrlenW (lpString=".bak") returned 4 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.651] lstrlenW (lpString=".bac") returned 4 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.651] lstrlenW (lpString=".sys") returned 4 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.651] lstrlenW (lpString=".v2i") returned 4 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.651] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.652] lstrlenW (lpString=".sql") returned 4 [0086.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.652] lstrlenW (lpString=".mdf") returned 4 [0086.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.652] lstrlenW (lpString=".txt") returned 4 [0086.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.652] lstrlenW (lpString=".dbf") returned 4 [0086.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.652] lstrlenW (lpString=".ckp") returned 4 [0086.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.652] lstrlenW (lpString=".dacpac") returned 7 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.653] lstrlenW (lpString=".db3") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.653] lstrlenW (lpString=".dtxs") returned 5 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.653] lstrlenW (lpString=".mdt") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.653] lstrlenW (lpString=".sdf") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.653] lstrlenW (lpString=".MDF") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.653] lstrlenW (lpString=".DBF") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.653] lstrlenW (lpString=".DB") returned 3 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.653] lstrlenW (lpString=".db") returned 3 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.653] lstrlenW (lpString=".ndf") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.653] lstrlenW (lpString=".NDF") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.653] lstrlenW (lpString=".Mdf") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.653] lstrlenW (lpString=".dat") returned 4 [0086.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.654] lstrlenW (lpString=".DAT") returned 4 [0086.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.654] lstrlenW (lpString=".ldf") returned 4 [0086.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.654] lstrlenW (lpString=".LDF") returned 4 [0086.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.654] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.654] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.655] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.655] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20665606640) returned 1 [0086.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc275c050, dwHighDateTime=0x1d585b4)) [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f2a0 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2a0 | out: hHeap=0x260000) returned 1 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.656] GetLastError () returned 0x0 [0086.656] GetLastError () returned 0x0 [0086.656] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.656] GetLastError () returned 0x0 [0086.656] GetLastError () returned 0x0 [0086.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe8c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.665] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1738, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x1738, lpOverlapped=0x0) returned 1 [0086.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.666] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.666] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.666] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.666] CloseHandle (hObject=0xf0) returned 1 [0086.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.667] GetLastError () returned 0x0 [0086.668] RtlWakeConditionVariable () returned 0x0 [0086.668] GetCurrentThreadId () returned 0x99c [0086.668] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.668] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0086.668] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0086.668] WriteFile (in: hFile=0xf0, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0086.670] CloseHandle (hObject=0xf0) returned 1 [0086.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3454d8 | out: hHeap=0x260000) returned 1 [0086.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ed10 | out: hHeap=0x260000) returned 1 [0086.670] RtlWakeConditionVariable () returned 0x27e828 [0086.670] GetCurrentThreadId () returned 0x99c [0086.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".ldf") returned 0x0 [0086.670] lstrlenW (lpString=".vhd") returned 4 [0086.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".vhd") returned 0x0 [0086.670] lstrlenW (lpString=".vhdx") returned 5 [0086.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".vhdx") returned 0x0 [0086.670] lstrlenW (lpString=".pst") returned 4 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".pst") returned 0x0 [0086.671] lstrlenW (lpString=".ost") returned 4 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".ost") returned 0x0 [0086.671] lstrlenW (lpString=".bak") returned 4 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".bak") returned 0x0 [0086.671] lstrlenW (lpString=".bac") returned 4 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".bac") returned 0x0 [0086.671] lstrlenW (lpString=".sys") returned 4 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".sys") returned 0x0 [0086.671] lstrlenW (lpString=".v2i") returned 4 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".v2i") returned 0x0 [0086.671] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.672] lstrlenW (lpString=".sql") returned 4 [0086.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".sql") returned 0x0 [0086.672] lstrlenW (lpString=".mdf") returned 4 [0086.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".mdf") returned 0x0 [0086.672] lstrlenW (lpString=".txt") returned 4 [0086.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".txt") returned 0x0 [0086.672] lstrlenW (lpString=".dbf") returned 4 [0086.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".dbf") returned 0x0 [0086.672] lstrlenW (lpString=".ckp") returned 4 [0086.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".ckp") returned 0x0 [0086.672] lstrlenW (lpString=".dacpac") returned 7 [0086.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".dacpac") returned 0x0 [0086.672] lstrlenW (lpString=".db3") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".db3") returned 0x0 [0086.673] lstrlenW (lpString=".dtxs") returned 5 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".dtxs") returned 0x0 [0086.673] lstrlenW (lpString=".mdt") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".mdt") returned 0x0 [0086.673] lstrlenW (lpString=".sdf") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".sdf") returned 0x0 [0086.673] lstrlenW (lpString=".MDF") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".MDF") returned 0x0 [0086.673] lstrlenW (lpString=".DBF") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".DBF") returned 0x0 [0086.673] lstrlenW (lpString=".DB") returned 3 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".DB") returned 0x0 [0086.673] lstrlenW (lpString=".db") returned 3 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".db") returned 0x0 [0086.673] lstrlenW (lpString=".ndf") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".ndf") returned 0x0 [0086.673] lstrlenW (lpString=".NDF") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".NDF") returned 0x0 [0086.673] lstrlenW (lpString=".Mdf") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".Mdf") returned 0x0 [0086.673] lstrlenW (lpString=".dat") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".dat") returned 0x0 [0086.673] lstrlenW (lpString=".DAT") returned 4 [0086.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".DAT") returned 0x0 [0086.673] lstrlenW (lpString=".ldf") returned 4 [0086.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".ldf") returned 0x0 [0086.674] lstrlenW (lpString=".LDF") returned 4 [0086.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch=".LDF") returned 0x0 [0086.674] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.674] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.675] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.675] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.675] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20667617594) returned 1 [0086.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc27a8310, dwHighDateTime=0x1d585b4)) [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ef58 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ef58 | out: hHeap=0x260000) returned 1 [0086.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.676] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.676] GetLastError () returned 0x0 [0086.676] GetLastError () returned 0x0 [0086.676] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.676] GetLastError () returned 0x0 [0086.676] GetLastError () returned 0x0 [0086.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff54ef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.784] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xab11, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xab11, lpOverlapped=0x0) returned 1 [0086.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.815] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.815] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.815] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.815] CloseHandle (hObject=0xf0) returned 1 [0086.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0086.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0086.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.830] GetLastError () returned 0x0 [0086.831] RtlWakeConditionVariable () returned 0x0 [0086.831] GetCurrentThreadId () returned 0x99c [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".ldf") returned 0x0 [0086.831] lstrlenW (lpString=".vhd") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".vhd") returned 0x0 [0086.831] lstrlenW (lpString=".vhdx") returned 5 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".vhdx") returned 0x0 [0086.831] lstrlenW (lpString=".pst") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".pst") returned 0x0 [0086.831] lstrlenW (lpString=".ost") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".ost") returned 0x0 [0086.831] lstrlenW (lpString=".bak") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".bak") returned 0x0 [0086.831] lstrlenW (lpString=".bac") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".bac") returned 0x0 [0086.831] lstrlenW (lpString=".sys") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".sys") returned 0x0 [0086.831] lstrlenW (lpString=".v2i") returned 4 [0086.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".v2i") returned 0x0 [0086.832] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.892] lstrlenW (lpString=".sql") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".sql") returned 0x0 [0086.892] lstrlenW (lpString=".mdf") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".mdf") returned 0x0 [0086.892] lstrlenW (lpString=".txt") returned 4 [0086.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".txt") returned 0x0 [0086.893] lstrlenW (lpString=".dbf") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".dbf") returned 0x0 [0086.893] lstrlenW (lpString=".ckp") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".ckp") returned 0x0 [0086.893] lstrlenW (lpString=".dacpac") returned 7 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".dacpac") returned 0x0 [0086.893] lstrlenW (lpString=".db3") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".db3") returned 0x0 [0086.893] lstrlenW (lpString=".dtxs") returned 5 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".dtxs") returned 0x0 [0086.893] lstrlenW (lpString=".mdt") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".mdt") returned 0x0 [0086.893] lstrlenW (lpString=".sdf") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".sdf") returned 0x0 [0086.893] lstrlenW (lpString=".MDF") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".MDF") returned 0x0 [0086.893] lstrlenW (lpString=".DBF") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".DBF") returned 0x0 [0086.893] lstrlenW (lpString=".DB") returned 3 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".DB") returned 0x0 [0086.893] lstrlenW (lpString=".db") returned 3 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".db") returned 0x0 [0086.893] lstrlenW (lpString=".ndf") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".ndf") returned 0x0 [0086.893] lstrlenW (lpString=".NDF") returned 4 [0086.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".NDF") returned 0x0 [0086.894] lstrlenW (lpString=".Mdf") returned 4 [0086.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".Mdf") returned 0x0 [0086.894] lstrlenW (lpString=".dat") returned 4 [0086.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".dat") returned 0x0 [0086.894] lstrlenW (lpString=".DAT") returned 4 [0086.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".DAT") returned 0x0 [0086.894] lstrlenW (lpString=".ldf") returned 4 [0086.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".ldf") returned 0x0 [0086.894] lstrlenW (lpString=".LDF") returned 4 [0086.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch=".LDF") returned 0x0 [0086.894] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.894] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.895] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.895] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.895] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20689622454) returned 1 [0086.895] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc29bd650, dwHighDateTime=0x1d585b4)) [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cdb0 [0086.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cdb0 | out: hHeap=0x260000) returned 1 [0086.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.896] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.896] GetLastError () returned 0x0 [0086.896] GetLastError () returned 0x0 [0086.896] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.896] GetLastError () returned 0x0 [0086.897] GetLastError () returned 0x0 [0086.898] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffecd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.898] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x132a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x132a, lpOverlapped=0x0) returned 1 [0086.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.899] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.899] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.899] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.899] CloseHandle (hObject=0xd8) returned 1 [0086.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.899] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.901] GetLastError () returned 0x0 [0086.901] RtlWakeConditionVariable () returned 0x0 [0086.901] GetCurrentThreadId () returned 0x99c [0086.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".ldf") returned 0x0 [0086.901] lstrlenW (lpString=".vhd") returned 4 [0086.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".vhd") returned 0x0 [0086.901] lstrlenW (lpString=".vhdx") returned 5 [0086.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".vhdx") returned 0x0 [0086.901] lstrlenW (lpString=".pst") returned 4 [0086.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".pst") returned 0x0 [0086.901] lstrlenW (lpString=".ost") returned 4 [0086.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".ost") returned 0x0 [0086.901] lstrlenW (lpString=".bak") returned 4 [0086.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".bak") returned 0x0 [0086.902] lstrlenW (lpString=".bac") returned 4 [0086.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".bac") returned 0x0 [0086.902] lstrlenW (lpString=".sys") returned 4 [0086.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".sys") returned 0x0 [0086.902] lstrlenW (lpString=".v2i") returned 4 [0086.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".v2i") returned 0x0 [0086.902] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.903] lstrlenW (lpString=".sql") returned 4 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".sql") returned 0x0 [0086.903] lstrlenW (lpString=".mdf") returned 4 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".mdf") returned 0x0 [0086.903] lstrlenW (lpString=".txt") returned 4 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".txt") returned 0x0 [0086.903] lstrlenW (lpString=".dbf") returned 4 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".dbf") returned 0x0 [0086.903] lstrlenW (lpString=".ckp") returned 4 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".ckp") returned 0x0 [0086.903] lstrlenW (lpString=".dacpac") returned 7 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".dacpac") returned 0x0 [0086.903] lstrlenW (lpString=".db3") returned 4 [0086.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".db3") returned 0x0 [0086.903] lstrlenW (lpString=".dtxs") returned 5 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".dtxs") returned 0x0 [0086.904] lstrlenW (lpString=".mdt") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".mdt") returned 0x0 [0086.904] lstrlenW (lpString=".sdf") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".sdf") returned 0x0 [0086.904] lstrlenW (lpString=".MDF") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".MDF") returned 0x0 [0086.904] lstrlenW (lpString=".DBF") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".DBF") returned 0x0 [0086.904] lstrlenW (lpString=".DB") returned 3 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".DB") returned 0x0 [0086.904] lstrlenW (lpString=".db") returned 3 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".db") returned 0x0 [0086.904] lstrlenW (lpString=".ndf") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".ndf") returned 0x0 [0086.904] lstrlenW (lpString=".NDF") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".NDF") returned 0x0 [0086.904] lstrlenW (lpString=".Mdf") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".Mdf") returned 0x0 [0086.904] lstrlenW (lpString=".dat") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".dat") returned 0x0 [0086.904] lstrlenW (lpString=".DAT") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".DAT") returned 0x0 [0086.904] lstrlenW (lpString=".ldf") returned 4 [0086.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".ldf") returned 0x0 [0086.904] lstrlenW (lpString=".LDF") returned 4 [0086.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch=".LDF") returned 0x0 [0086.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.905] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.906] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.906] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20690688272) returned 1 [0086.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc29bd650, dwHighDateTime=0x1d585b4)) [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cde8 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cde8 | out: hHeap=0x260000) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.906] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0086.907] GetLastError () returned 0x0 [0086.907] GetLastError () returned 0x0 [0086.907] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0086.907] GetLastError () returned 0x0 [0086.907] GetLastError () returned 0x0 [0086.910] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc2a9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.910] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3d57, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x3d57, lpOverlapped=0x0) returned 1 [0086.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0086.910] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.910] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.911] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.911] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.911] CloseHandle (hObject=0xd8) returned 1 [0086.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.912] GetLastError () returned 0x0 [0086.912] RtlWakeConditionVariable () returned 0x0 [0086.912] GetCurrentThreadId () returned 0x99c [0086.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".ldf") returned 0x0 [0086.912] lstrlenW (lpString=".vhd") returned 4 [0086.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".vhd") returned 0x0 [0086.912] lstrlenW (lpString=".vhdx") returned 5 [0086.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".vhdx") returned 0x0 [0086.912] lstrlenW (lpString=".pst") returned 4 [0086.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".pst") returned 0x0 [0086.913] lstrlenW (lpString=".ost") returned 4 [0086.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".ost") returned 0x0 [0086.913] lstrlenW (lpString=".bak") returned 4 [0086.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".bak") returned 0x0 [0086.913] lstrlenW (lpString=".bac") returned 4 [0086.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".bac") returned 0x0 [0086.913] lstrlenW (lpString=".sys") returned 4 [0086.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".sys") returned 0x0 [0086.913] lstrlenW (lpString=".v2i") returned 4 [0086.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".v2i") returned 0x0 [0086.913] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.914] lstrlenW (lpString=".sql") returned 4 [0086.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".sql") returned 0x0 [0086.914] lstrlenW (lpString=".mdf") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".mdf") returned 0x0 [0086.915] lstrlenW (lpString=".txt") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".txt") returned 0x0 [0086.915] lstrlenW (lpString=".dbf") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".dbf") returned 0x0 [0086.915] lstrlenW (lpString=".ckp") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".ckp") returned 0x0 [0086.915] lstrlenW (lpString=".dacpac") returned 7 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".dacpac") returned 0x0 [0086.915] lstrlenW (lpString=".db3") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".db3") returned 0x0 [0086.915] lstrlenW (lpString=".dtxs") returned 5 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".dtxs") returned 0x0 [0086.915] lstrlenW (lpString=".mdt") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".mdt") returned 0x0 [0086.915] lstrlenW (lpString=".sdf") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".sdf") returned 0x0 [0086.915] lstrlenW (lpString=".MDF") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".MDF") returned 0x0 [0086.915] lstrlenW (lpString=".DBF") returned 4 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".DBF") returned 0x0 [0086.915] lstrlenW (lpString=".DB") returned 3 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".DB") returned 0x0 [0086.915] lstrlenW (lpString=".db") returned 3 [0086.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".db") returned 0x0 [0086.916] lstrlenW (lpString=".ndf") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".ndf") returned 0x0 [0086.916] lstrlenW (lpString=".NDF") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".NDF") returned 0x0 [0086.916] lstrlenW (lpString=".Mdf") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".Mdf") returned 0x0 [0086.916] lstrlenW (lpString=".dat") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".dat") returned 0x0 [0086.916] lstrlenW (lpString=".DAT") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".DAT") returned 0x0 [0086.916] lstrlenW (lpString=".ldf") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".ldf") returned 0x0 [0086.916] lstrlenW (lpString=".LDF") returned 4 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch=".LDF") returned 0x0 [0086.916] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.916] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0086.917] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.917] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.917] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20691832964) returned 1 [0086.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2aa1e90, dwHighDateTime=0x1d585b4)) [0086.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cf70 [0086.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cf70 | out: hHeap=0x260000) returned 1 [0087.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.000] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.000] GetLastError () returned 0x0 [0087.000] GetLastError () returned 0x0 [0087.000] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.000] GetLastError () returned 0x0 [0087.000] GetLastError () returned 0x0 [0087.002] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe7bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.002] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1845, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x1845, lpOverlapped=0x0) returned 1 [0087.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.003] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.003] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.003] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.003] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.003] CloseHandle (hObject=0xd8) returned 1 [0087.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.010] GetLastError () returned 0x0 [0087.010] RtlWakeConditionVariable () returned 0x0 [0087.010] GetCurrentThreadId () returned 0x99c [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".ldf") returned 0x0 [0087.010] lstrlenW (lpString=".vhd") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".vhd") returned 0x0 [0087.010] lstrlenW (lpString=".vhdx") returned 5 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".vhdx") returned 0x0 [0087.010] lstrlenW (lpString=".pst") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".pst") returned 0x0 [0087.010] lstrlenW (lpString=".ost") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".ost") returned 0x0 [0087.010] lstrlenW (lpString=".bak") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".bak") returned 0x0 [0087.010] lstrlenW (lpString=".bac") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".bac") returned 0x0 [0087.010] lstrlenW (lpString=".sys") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".sys") returned 0x0 [0087.010] lstrlenW (lpString=".v2i") returned 4 [0087.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".v2i") returned 0x0 [0087.010] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.012] lstrlenW (lpString=".sql") returned 4 [0087.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".sql") returned 0x0 [0087.012] lstrlenW (lpString=".mdf") returned 4 [0087.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".mdf") returned 0x0 [0087.012] lstrlenW (lpString=".txt") returned 4 [0087.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".txt") returned 0x0 [0087.013] lstrlenW (lpString=".dbf") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".dbf") returned 0x0 [0087.013] lstrlenW (lpString=".ckp") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".ckp") returned 0x0 [0087.013] lstrlenW (lpString=".dacpac") returned 7 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".dacpac") returned 0x0 [0087.013] lstrlenW (lpString=".db3") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".db3") returned 0x0 [0087.013] lstrlenW (lpString=".dtxs") returned 5 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".dtxs") returned 0x0 [0087.013] lstrlenW (lpString=".mdt") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".mdt") returned 0x0 [0087.013] lstrlenW (lpString=".sdf") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".sdf") returned 0x0 [0087.013] lstrlenW (lpString=".MDF") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".MDF") returned 0x0 [0087.013] lstrlenW (lpString=".DBF") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".DBF") returned 0x0 [0087.013] lstrlenW (lpString=".DB") returned 3 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".DB") returned 0x0 [0087.013] lstrlenW (lpString=".db") returned 3 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".db") returned 0x0 [0087.013] lstrlenW (lpString=".ndf") returned 4 [0087.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".ndf") returned 0x0 [0087.013] lstrlenW (lpString=".NDF") returned 4 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".NDF") returned 0x0 [0087.014] lstrlenW (lpString=".Mdf") returned 4 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".Mdf") returned 0x0 [0087.014] lstrlenW (lpString=".dat") returned 4 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".dat") returned 0x0 [0087.014] lstrlenW (lpString=".DAT") returned 4 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".DAT") returned 0x0 [0087.014] lstrlenW (lpString=".ldf") returned 4 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".ldf") returned 0x0 [0087.014] lstrlenW (lpString=".LDF") returned 4 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch=".LDF") returned 0x0 [0087.014] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.014] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.015] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.015] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.015] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20701620612) returned 1 [0087.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2ac7ff0, dwHighDateTime=0x1d585b4)) [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cfa8 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cfa8 | out: hHeap=0x260000) returned 1 [0087.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.016] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.016] GetLastError () returned 0x0 [0087.016] GetLastError () returned 0x0 [0087.016] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.016] GetLastError () returned 0x0 [0087.016] GetLastError () returned 0x0 [0087.018] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.018] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0087.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.018] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.018] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.018] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.018] CloseHandle (hObject=0xe4) returned 1 [0087.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.020] GetLastError () returned 0x0 [0087.020] RtlWakeConditionVariable () returned 0x27e828 [0087.020] GetCurrentThreadId () returned 0x99c [0087.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".ldf") returned 0x0 [0087.020] lstrlenW (lpString=".vhd") returned 4 [0087.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".vhd") returned 0x0 [0087.020] lstrlenW (lpString=".vhdx") returned 5 [0087.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".vhdx") returned 0x0 [0087.020] lstrlenW (lpString=".pst") returned 4 [0087.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".pst") returned 0x0 [0087.020] lstrlenW (lpString=".ost") returned 4 [0087.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".ost") returned 0x0 [0087.021] lstrlenW (lpString=".bak") returned 4 [0087.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".bak") returned 0x0 [0087.021] lstrlenW (lpString=".bac") returned 4 [0087.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".bac") returned 0x0 [0087.021] lstrlenW (lpString=".sys") returned 4 [0087.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".sys") returned 0x0 [0087.021] lstrlenW (lpString=".v2i") returned 4 [0087.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".v2i") returned 0x0 [0087.021] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.022] lstrlenW (lpString=".sql") returned 4 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".sql") returned 0x0 [0087.022] lstrlenW (lpString=".mdf") returned 4 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".mdf") returned 0x0 [0087.022] lstrlenW (lpString=".txt") returned 4 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".txt") returned 0x0 [0087.022] lstrlenW (lpString=".dbf") returned 4 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".dbf") returned 0x0 [0087.022] lstrlenW (lpString=".ckp") returned 4 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".ckp") returned 0x0 [0087.022] lstrlenW (lpString=".dacpac") returned 7 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".dacpac") returned 0x0 [0087.022] lstrlenW (lpString=".db3") returned 4 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".db3") returned 0x0 [0087.022] lstrlenW (lpString=".dtxs") returned 5 [0087.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".dtxs") returned 0x0 [0087.023] lstrlenW (lpString=".mdt") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".mdt") returned 0x0 [0087.023] lstrlenW (lpString=".sdf") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".sdf") returned 0x0 [0087.023] lstrlenW (lpString=".MDF") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".MDF") returned 0x0 [0087.023] lstrlenW (lpString=".DBF") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".DBF") returned 0x0 [0087.023] lstrlenW (lpString=".DB") returned 3 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".DB") returned 0x0 [0087.023] lstrlenW (lpString=".db") returned 3 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".db") returned 0x0 [0087.023] lstrlenW (lpString=".ndf") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".ndf") returned 0x0 [0087.023] lstrlenW (lpString=".NDF") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".NDF") returned 0x0 [0087.023] lstrlenW (lpString=".Mdf") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".Mdf") returned 0x0 [0087.023] lstrlenW (lpString=".dat") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".dat") returned 0x0 [0087.023] lstrlenW (lpString=".DAT") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".DAT") returned 0x0 [0087.023] lstrlenW (lpString=".ldf") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".ldf") returned 0x0 [0087.023] lstrlenW (lpString=".LDF") returned 4 [0087.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch=".LDF") returned 0x0 [0087.024] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.024] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.024] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.025] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20702577479) returned 1 [0087.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2aee150, dwHighDateTime=0x1d585b4)) [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cfe0 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cfe0 | out: hHeap=0x260000) returned 1 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.025] GetLastError () returned 0x0 [0087.026] GetLastError () returned 0x0 [0087.026] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.026] GetLastError () returned 0x0 [0087.026] GetLastError () returned 0x0 [0087.027] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffffcb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.027] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x35, lpOverlapped=0x0) returned 1 [0087.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.027] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.027] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.028] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.028] CloseHandle (hObject=0xe4) returned 1 [0087.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f868 [0087.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f868 | out: hHeap=0x260000) returned 1 [0087.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.029] GetLastError () returned 0x0 [0087.029] RtlWakeConditionVariable () returned 0x27e828 [0087.029] GetCurrentThreadId () returned 0x99c [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".ldf") returned 0x0 [0087.030] lstrlenW (lpString=".vhd") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".vhd") returned 0x0 [0087.030] lstrlenW (lpString=".vhdx") returned 5 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".vhdx") returned 0x0 [0087.030] lstrlenW (lpString=".pst") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".pst") returned 0x0 [0087.030] lstrlenW (lpString=".ost") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".ost") returned 0x0 [0087.030] lstrlenW (lpString=".bak") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".bak") returned 0x0 [0087.030] lstrlenW (lpString=".bac") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".bac") returned 0x0 [0087.030] lstrlenW (lpString=".sys") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".sys") returned 0x0 [0087.030] lstrlenW (lpString=".v2i") returned 4 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".v2i") returned 0x0 [0087.030] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.032] lstrlenW (lpString=".sql") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".sql") returned 0x0 [0087.032] lstrlenW (lpString=".mdf") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".mdf") returned 0x0 [0087.032] lstrlenW (lpString=".txt") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".txt") returned 0x0 [0087.032] lstrlenW (lpString=".dbf") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".dbf") returned 0x0 [0087.032] lstrlenW (lpString=".ckp") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".ckp") returned 0x0 [0087.032] lstrlenW (lpString=".dacpac") returned 7 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".dacpac") returned 0x0 [0087.032] lstrlenW (lpString=".db3") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".db3") returned 0x0 [0087.032] lstrlenW (lpString=".dtxs") returned 5 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".dtxs") returned 0x0 [0087.032] lstrlenW (lpString=".mdt") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".mdt") returned 0x0 [0087.032] lstrlenW (lpString=".sdf") returned 4 [0087.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".sdf") returned 0x0 [0087.032] lstrlenW (lpString=".MDF") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".MDF") returned 0x0 [0087.033] lstrlenW (lpString=".DBF") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".DBF") returned 0x0 [0087.033] lstrlenW (lpString=".DB") returned 3 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".DB") returned 0x0 [0087.033] lstrlenW (lpString=".db") returned 3 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".db") returned 0x0 [0087.033] lstrlenW (lpString=".ndf") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".ndf") returned 0x0 [0087.033] lstrlenW (lpString=".NDF") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".NDF") returned 0x0 [0087.033] lstrlenW (lpString=".Mdf") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".Mdf") returned 0x0 [0087.033] lstrlenW (lpString=".dat") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".dat") returned 0x0 [0087.033] lstrlenW (lpString=".DAT") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".DAT") returned 0x0 [0087.033] lstrlenW (lpString=".ldf") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".ldf") returned 0x0 [0087.033] lstrlenW (lpString=".LDF") returned 4 [0087.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch=".LDF") returned 0x0 [0087.033] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.034] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.034] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.035] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20703575064) returned 1 [0087.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2b142b0, dwHighDateTime=0x1d585b4)) [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d018 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d018 | out: hHeap=0x260000) returned 1 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.035] GetLastError () returned 0x0 [0087.036] GetLastError () returned 0x0 [0087.036] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.036] GetLastError () returned 0x0 [0087.036] GetLastError () returned 0x0 [0087.037] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.037] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xbb, lpOverlapped=0x0) returned 1 [0087.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.037] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.037] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.037] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.038] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.038] CloseHandle (hObject=0xe4) returned 1 [0087.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f868 [0087.038] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f868 | out: hHeap=0x260000) returned 1 [0087.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.039] GetLastError () returned 0x0 [0087.039] RtlWakeConditionVariable () returned 0x27e828 [0087.039] GetCurrentThreadId () returned 0x99c [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".ldf") returned 0x0 [0087.040] lstrlenW (lpString=".vhd") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".vhd") returned 0x0 [0087.040] lstrlenW (lpString=".vhdx") returned 5 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".vhdx") returned 0x0 [0087.040] lstrlenW (lpString=".pst") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".pst") returned 0x0 [0087.040] lstrlenW (lpString=".ost") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".ost") returned 0x0 [0087.040] lstrlenW (lpString=".bak") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".bak") returned 0x0 [0087.040] lstrlenW (lpString=".bac") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".bac") returned 0x0 [0087.040] lstrlenW (lpString=".sys") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".sys") returned 0x0 [0087.040] lstrlenW (lpString=".v2i") returned 4 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".v2i") returned 0x0 [0087.040] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.042] lstrlenW (lpString=".sql") returned 4 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".sql") returned 0x0 [0087.042] lstrlenW (lpString=".mdf") returned 4 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".mdf") returned 0x0 [0087.042] lstrlenW (lpString=".txt") returned 4 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".txt") returned 0x0 [0087.042] lstrlenW (lpString=".dbf") returned 4 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".dbf") returned 0x0 [0087.042] lstrlenW (lpString=".ckp") returned 4 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".ckp") returned 0x0 [0087.042] lstrlenW (lpString=".dacpac") returned 7 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".dacpac") returned 0x0 [0087.042] lstrlenW (lpString=".db3") returned 4 [0087.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".db3") returned 0x0 [0087.042] lstrlenW (lpString=".dtxs") returned 5 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".dtxs") returned 0x0 [0087.043] lstrlenW (lpString=".mdt") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".mdt") returned 0x0 [0087.043] lstrlenW (lpString=".sdf") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".sdf") returned 0x0 [0087.043] lstrlenW (lpString=".MDF") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".MDF") returned 0x0 [0087.043] lstrlenW (lpString=".DBF") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".DBF") returned 0x0 [0087.043] lstrlenW (lpString=".DB") returned 3 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".DB") returned 0x0 [0087.043] lstrlenW (lpString=".db") returned 3 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".db") returned 0x0 [0087.043] lstrlenW (lpString=".ndf") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".ndf") returned 0x0 [0087.043] lstrlenW (lpString=".NDF") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".NDF") returned 0x0 [0087.043] lstrlenW (lpString=".Mdf") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".Mdf") returned 0x0 [0087.043] lstrlenW (lpString=".dat") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".dat") returned 0x0 [0087.043] lstrlenW (lpString=".DAT") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".DAT") returned 0x0 [0087.043] lstrlenW (lpString=".ldf") returned 4 [0087.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".ldf") returned 0x0 [0087.043] lstrlenW (lpString=".LDF") returned 4 [0087.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch=".LDF") returned 0x0 [0087.044] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.044] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.044] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.044] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.045] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20704582083) returned 1 [0087.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2b142b0, dwHighDateTime=0x1d585b4)) [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d050 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d050 | out: hHeap=0x260000) returned 1 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.045] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.046] GetLastError () returned 0x0 [0087.046] GetLastError () returned 0x0 [0087.046] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.046] GetLastError () returned 0x0 [0087.046] GetLastError () returned 0x0 [0087.048] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.049] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x26e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x26e, lpOverlapped=0x0) returned 1 [0087.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.049] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.049] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.049] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.049] CloseHandle (hObject=0xe4) returned 1 [0087.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f868 [0087.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f868 | out: hHeap=0x260000) returned 1 [0087.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.052] GetLastError () returned 0x0 [0087.052] RtlWakeConditionVariable () returned 0x27e828 [0087.052] GetCurrentThreadId () returned 0x99c [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".ldf") returned 0x0 [0087.052] lstrlenW (lpString=".vhd") returned 4 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".vhd") returned 0x0 [0087.052] lstrlenW (lpString=".vhdx") returned 5 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".vhdx") returned 0x0 [0087.052] lstrlenW (lpString=".pst") returned 4 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".pst") returned 0x0 [0087.052] lstrlenW (lpString=".ost") returned 4 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".ost") returned 0x0 [0087.052] lstrlenW (lpString=".bak") returned 4 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".bak") returned 0x0 [0087.052] lstrlenW (lpString=".bac") returned 4 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".bac") returned 0x0 [0087.052] lstrlenW (lpString=".sys") returned 4 [0087.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".sys") returned 0x0 [0087.053] lstrlenW (lpString=".v2i") returned 4 [0087.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".v2i") returned 0x0 [0087.053] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.054] lstrlenW (lpString=".sql") returned 4 [0087.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".sql") returned 0x0 [0087.054] lstrlenW (lpString=".mdf") returned 4 [0087.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".mdf") returned 0x0 [0087.054] lstrlenW (lpString=".txt") returned 4 [0087.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".txt") returned 0x0 [0087.055] lstrlenW (lpString=".dbf") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".dbf") returned 0x0 [0087.055] lstrlenW (lpString=".ckp") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".ckp") returned 0x0 [0087.055] lstrlenW (lpString=".dacpac") returned 7 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".dacpac") returned 0x0 [0087.055] lstrlenW (lpString=".db3") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".db3") returned 0x0 [0087.055] lstrlenW (lpString=".dtxs") returned 5 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".dtxs") returned 0x0 [0087.055] lstrlenW (lpString=".mdt") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".mdt") returned 0x0 [0087.055] lstrlenW (lpString=".sdf") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".sdf") returned 0x0 [0087.055] lstrlenW (lpString=".MDF") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".MDF") returned 0x0 [0087.055] lstrlenW (lpString=".DBF") returned 4 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".DBF") returned 0x0 [0087.055] lstrlenW (lpString=".DB") returned 3 [0087.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".DB") returned 0x0 [0087.056] lstrlenW (lpString=".db") returned 3 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".db") returned 0x0 [0087.056] lstrlenW (lpString=".ndf") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".ndf") returned 0x0 [0087.056] lstrlenW (lpString=".NDF") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".NDF") returned 0x0 [0087.056] lstrlenW (lpString=".Mdf") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".Mdf") returned 0x0 [0087.056] lstrlenW (lpString=".dat") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".dat") returned 0x0 [0087.056] lstrlenW (lpString=".DAT") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".DAT") returned 0x0 [0087.056] lstrlenW (lpString=".ldf") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".ldf") returned 0x0 [0087.056] lstrlenW (lpString=".LDF") returned 4 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch=".LDF") returned 0x0 [0087.056] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.057] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.058] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.058] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20705891457) returned 1 [0087.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2b3a410, dwHighDateTime=0x1d585b4)) [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d088 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d088 | out: hHeap=0x260000) returned 1 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.059] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.059] GetLastError () returned 0x0 [0087.059] GetLastError () returned 0x0 [0087.059] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.059] GetLastError () returned 0x0 [0087.059] GetLastError () returned 0x0 [0087.061] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff1f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.061] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xe1, lpOverlapped=0x0) returned 1 [0087.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.061] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.061] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.061] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.062] CloseHandle (hObject=0xe4) returned 1 [0087.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d2250 [0087.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d2250 | out: hHeap=0x260000) returned 1 [0087.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.064] GetLastError () returned 0x0 [0087.064] RtlWakeConditionVariable () returned 0x27e828 [0087.064] GetCurrentThreadId () returned 0x99c [0087.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".ldf") returned 0x0 [0087.064] lstrlenW (lpString=".vhd") returned 4 [0087.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".vhd") returned 0x0 [0087.065] lstrlenW (lpString=".vhdx") returned 5 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".vhdx") returned 0x0 [0087.065] lstrlenW (lpString=".pst") returned 4 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".pst") returned 0x0 [0087.065] lstrlenW (lpString=".ost") returned 4 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".ost") returned 0x0 [0087.065] lstrlenW (lpString=".bak") returned 4 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".bak") returned 0x0 [0087.065] lstrlenW (lpString=".bac") returned 4 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".bac") returned 0x0 [0087.065] lstrlenW (lpString=".sys") returned 4 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".sys") returned 0x0 [0087.065] lstrlenW (lpString=".v2i") returned 4 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".v2i") returned 0x0 [0087.065] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.067] lstrlenW (lpString=".sql") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".sql") returned 0x0 [0087.067] lstrlenW (lpString=".mdf") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".mdf") returned 0x0 [0087.067] lstrlenW (lpString=".txt") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".txt") returned 0x0 [0087.067] lstrlenW (lpString=".dbf") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".dbf") returned 0x0 [0087.067] lstrlenW (lpString=".ckp") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".ckp") returned 0x0 [0087.067] lstrlenW (lpString=".dacpac") returned 7 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".dacpac") returned 0x0 [0087.067] lstrlenW (lpString=".db3") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".db3") returned 0x0 [0087.067] lstrlenW (lpString=".dtxs") returned 5 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".dtxs") returned 0x0 [0087.067] lstrlenW (lpString=".mdt") returned 4 [0087.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".mdt") returned 0x0 [0087.067] lstrlenW (lpString=".sdf") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".sdf") returned 0x0 [0087.068] lstrlenW (lpString=".MDF") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".MDF") returned 0x0 [0087.068] lstrlenW (lpString=".DBF") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".DBF") returned 0x0 [0087.068] lstrlenW (lpString=".DB") returned 3 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".DB") returned 0x0 [0087.068] lstrlenW (lpString=".db") returned 3 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".db") returned 0x0 [0087.068] lstrlenW (lpString=".ndf") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".ndf") returned 0x0 [0087.068] lstrlenW (lpString=".NDF") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".NDF") returned 0x0 [0087.068] lstrlenW (lpString=".Mdf") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".Mdf") returned 0x0 [0087.068] lstrlenW (lpString=".dat") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".dat") returned 0x0 [0087.068] lstrlenW (lpString=".DAT") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".DAT") returned 0x0 [0087.068] lstrlenW (lpString=".ldf") returned 4 [0087.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".ldf") returned 0x0 [0087.068] lstrlenW (lpString=".LDF") returned 4 [0087.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch=".LDF") returned 0x0 [0087.069] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.069] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.069] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.070] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.070] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.070] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20707118409) returned 1 [0087.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2b60570, dwHighDateTime=0x1d585b4)) [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d0c0 [0087.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d0c0 | out: hHeap=0x260000) returned 1 [0087.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.071] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.071] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.071] GetLastError () returned 0x0 [0087.071] GetLastError () returned 0x0 [0087.071] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.072] GetLastError () returned 0x0 [0087.072] GetLastError () returned 0x0 [0087.181] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbe5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.182] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x41b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x41b, lpOverlapped=0x0) returned 1 [0087.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.182] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.182] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.182] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.182] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.182] CloseHandle (hObject=0xe4) returned 1 [0087.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.184] GetLastError () returned 0x0 [0087.184] RtlWakeConditionVariable () returned 0x0 [0087.184] GetCurrentThreadId () returned 0x99c [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".ldf") returned 0x0 [0087.185] lstrlenW (lpString=".vhd") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".vhd") returned 0x0 [0087.185] lstrlenW (lpString=".vhdx") returned 5 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".vhdx") returned 0x0 [0087.185] lstrlenW (lpString=".pst") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".pst") returned 0x0 [0087.185] lstrlenW (lpString=".ost") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".ost") returned 0x0 [0087.185] lstrlenW (lpString=".bak") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".bak") returned 0x0 [0087.185] lstrlenW (lpString=".bac") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".bac") returned 0x0 [0087.185] lstrlenW (lpString=".sys") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".sys") returned 0x0 [0087.185] lstrlenW (lpString=".v2i") returned 4 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".v2i") returned 0x0 [0087.185] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.186] lstrlenW (lpString=".sql") returned 4 [0087.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".sql") returned 0x0 [0087.187] lstrlenW (lpString=".mdf") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".mdf") returned 0x0 [0087.187] lstrlenW (lpString=".txt") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".txt") returned 0x0 [0087.187] lstrlenW (lpString=".dbf") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".dbf") returned 0x0 [0087.187] lstrlenW (lpString=".ckp") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".ckp") returned 0x0 [0087.187] lstrlenW (lpString=".dacpac") returned 7 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".dacpac") returned 0x0 [0087.187] lstrlenW (lpString=".db3") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".db3") returned 0x0 [0087.187] lstrlenW (lpString=".dtxs") returned 5 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".dtxs") returned 0x0 [0087.187] lstrlenW (lpString=".mdt") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".mdt") returned 0x0 [0087.187] lstrlenW (lpString=".sdf") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".sdf") returned 0x0 [0087.187] lstrlenW (lpString=".MDF") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".MDF") returned 0x0 [0087.187] lstrlenW (lpString=".DBF") returned 4 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".DBF") returned 0x0 [0087.187] lstrlenW (lpString=".DB") returned 3 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".DB") returned 0x0 [0087.187] lstrlenW (lpString=".db") returned 3 [0087.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".db") returned 0x0 [0087.188] lstrlenW (lpString=".ndf") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".ndf") returned 0x0 [0087.188] lstrlenW (lpString=".NDF") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".NDF") returned 0x0 [0087.188] lstrlenW (lpString=".Mdf") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".Mdf") returned 0x0 [0087.188] lstrlenW (lpString=".dat") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".dat") returned 0x0 [0087.188] lstrlenW (lpString=".DAT") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".DAT") returned 0x0 [0087.188] lstrlenW (lpString=".ldf") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".ldf") returned 0x0 [0087.188] lstrlenW (lpString=".LDF") returned 4 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch=".LDF") returned 0x0 [0087.188] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.188] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.189] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.189] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.189] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20719052448) returned 1 [0087.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2c91070, dwHighDateTime=0x1d585b4)) [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f03b8 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03b8 | out: hHeap=0x260000) returned 1 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.190] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.190] GetLastError () returned 0x0 [0087.190] GetLastError () returned 0x0 [0087.191] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.191] GetLastError () returned 0x0 [0087.191] GetLastError () returned 0x0 [0087.193] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffbec7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.193] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4139, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x4139, lpOverlapped=0x0) returned 1 [0087.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.193] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.193] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.193] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.193] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.193] CloseHandle (hObject=0xe4) returned 1 [0087.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.196] GetLastError () returned 0x0 [0087.196] RtlWakeConditionVariable () returned 0x0 [0087.196] GetCurrentThreadId () returned 0x99c [0087.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".ldf") returned 0x0 [0087.197] lstrlenW (lpString=".vhd") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".vhd") returned 0x0 [0087.197] lstrlenW (lpString=".vhdx") returned 5 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".vhdx") returned 0x0 [0087.197] lstrlenW (lpString=".pst") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".pst") returned 0x0 [0087.197] lstrlenW (lpString=".ost") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".ost") returned 0x0 [0087.197] lstrlenW (lpString=".bak") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".bak") returned 0x0 [0087.197] lstrlenW (lpString=".bac") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".bac") returned 0x0 [0087.197] lstrlenW (lpString=".sys") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".sys") returned 0x0 [0087.197] lstrlenW (lpString=".v2i") returned 4 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".v2i") returned 0x0 [0087.197] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.198] lstrlenW (lpString=".sql") returned 4 [0087.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".sql") returned 0x0 [0087.198] lstrlenW (lpString=".mdf") returned 4 [0087.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".mdf") returned 0x0 [0087.199] lstrlenW (lpString=".txt") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".txt") returned 0x0 [0087.199] lstrlenW (lpString=".dbf") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".dbf") returned 0x0 [0087.199] lstrlenW (lpString=".ckp") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".ckp") returned 0x0 [0087.199] lstrlenW (lpString=".dacpac") returned 7 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".dacpac") returned 0x0 [0087.199] lstrlenW (lpString=".db3") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".db3") returned 0x0 [0087.199] lstrlenW (lpString=".dtxs") returned 5 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".dtxs") returned 0x0 [0087.199] lstrlenW (lpString=".mdt") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".mdt") returned 0x0 [0087.199] lstrlenW (lpString=".sdf") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".sdf") returned 0x0 [0087.199] lstrlenW (lpString=".MDF") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".MDF") returned 0x0 [0087.199] lstrlenW (lpString=".DBF") returned 4 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".DBF") returned 0x0 [0087.199] lstrlenW (lpString=".DB") returned 3 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".DB") returned 0x0 [0087.199] lstrlenW (lpString=".db") returned 3 [0087.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".db") returned 0x0 [0087.199] lstrlenW (lpString=".ndf") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".ndf") returned 0x0 [0087.200] lstrlenW (lpString=".NDF") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".NDF") returned 0x0 [0087.200] lstrlenW (lpString=".Mdf") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".Mdf") returned 0x0 [0087.200] lstrlenW (lpString=".dat") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".dat") returned 0x0 [0087.200] lstrlenW (lpString=".DAT") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".DAT") returned 0x0 [0087.200] lstrlenW (lpString=".ldf") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".ldf") returned 0x0 [0087.200] lstrlenW (lpString=".LDF") returned 4 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch=".LDF") returned 0x0 [0087.200] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.200] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.201] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.201] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.201] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20720233273) returned 1 [0087.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2c91070, dwHighDateTime=0x1d585b4)) [0087.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d0f8 [0087.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d0f8 | out: hHeap=0x260000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.202] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.202] GetLastError () returned 0x0 [0087.202] GetLastError () returned 0x0 [0087.202] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.203] GetLastError () returned 0x0 [0087.203] GetLastError () returned 0x0 [0087.207] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffc1ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.208] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3e01, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3e01, lpOverlapped=0x0) returned 1 [0087.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.208] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.208] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.208] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.208] CloseHandle (hObject=0xe4) returned 1 [0087.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x30ac10 [0087.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ac10 | out: hHeap=0x260000) returned 1 [0087.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.210] GetLastError () returned 0x0 [0087.210] RtlWakeConditionVariable () returned 0x0 [0087.210] GetCurrentThreadId () returned 0x99c [0087.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".ldf") returned 0x0 [0087.210] lstrlenW (lpString=".vhd") returned 4 [0087.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".vhd") returned 0x0 [0087.210] lstrlenW (lpString=".vhdx") returned 5 [0087.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".vhdx") returned 0x0 [0087.210] lstrlenW (lpString=".pst") returned 4 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".pst") returned 0x0 [0087.211] lstrlenW (lpString=".ost") returned 4 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".ost") returned 0x0 [0087.211] lstrlenW (lpString=".bak") returned 4 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".bak") returned 0x0 [0087.211] lstrlenW (lpString=".bac") returned 4 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".bac") returned 0x0 [0087.211] lstrlenW (lpString=".sys") returned 4 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".sys") returned 0x0 [0087.211] lstrlenW (lpString=".v2i") returned 4 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".v2i") returned 0x0 [0087.211] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.212] lstrlenW (lpString=".sql") returned 4 [0087.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".sql") returned 0x0 [0087.212] lstrlenW (lpString=".mdf") returned 4 [0087.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".mdf") returned 0x0 [0087.212] lstrlenW (lpString=".txt") returned 4 [0087.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".txt") returned 0x0 [0087.212] lstrlenW (lpString=".dbf") returned 4 [0087.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".dbf") returned 0x0 [0087.212] lstrlenW (lpString=".ckp") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".ckp") returned 0x0 [0087.213] lstrlenW (lpString=".dacpac") returned 7 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".dacpac") returned 0x0 [0087.213] lstrlenW (lpString=".db3") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".db3") returned 0x0 [0087.213] lstrlenW (lpString=".dtxs") returned 5 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".dtxs") returned 0x0 [0087.213] lstrlenW (lpString=".mdt") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".mdt") returned 0x0 [0087.213] lstrlenW (lpString=".sdf") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".sdf") returned 0x0 [0087.213] lstrlenW (lpString=".MDF") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".MDF") returned 0x0 [0087.213] lstrlenW (lpString=".DBF") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".DBF") returned 0x0 [0087.213] lstrlenW (lpString=".DB") returned 3 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".DB") returned 0x0 [0087.213] lstrlenW (lpString=".db") returned 3 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".db") returned 0x0 [0087.213] lstrlenW (lpString=".ndf") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".ndf") returned 0x0 [0087.213] lstrlenW (lpString=".NDF") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".NDF") returned 0x0 [0087.213] lstrlenW (lpString=".Mdf") returned 4 [0087.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".Mdf") returned 0x0 [0087.213] lstrlenW (lpString=".dat") returned 4 [0087.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".dat") returned 0x0 [0087.214] lstrlenW (lpString=".DAT") returned 4 [0087.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".DAT") returned 0x0 [0087.214] lstrlenW (lpString=".ldf") returned 4 [0087.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".ldf") returned 0x0 [0087.214] lstrlenW (lpString=".LDF") returned 4 [0087.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch=".LDF") returned 0x0 [0087.214] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.214] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.215] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.215] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.215] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20721614267) returned 1 [0087.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2cb71d0, dwHighDateTime=0x1d585b4)) [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d130 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d130 | out: hHeap=0x260000) returned 1 [0087.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.216] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.216] GetLastError () returned 0x0 [0087.216] GetLastError () returned 0x0 [0087.216] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.216] GetLastError () returned 0x0 [0087.216] GetLastError () returned 0x0 [0087.218] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdf18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.218] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x20e8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x20e8, lpOverlapped=0x0) returned 1 [0087.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.218] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.219] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.219] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.219] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.219] CloseHandle (hObject=0xe4) returned 1 [0087.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0087.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0087.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.350] GetLastError () returned 0x0 [0087.350] RtlWakeConditionVariable () returned 0x0 [0087.350] GetCurrentThreadId () returned 0x99c [0087.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.350] lstrlenW (lpString=".vhd") returned 4 [0087.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".vhd") returned 0x0 [0087.350] lstrlenW (lpString=".vhdx") returned 5 [0087.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".vhdx") returned 0x0 [0087.350] lstrlenW (lpString=".pst") returned 4 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".pst") returned 0x0 [0087.351] lstrlenW (lpString=".ost") returned 4 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".ost") returned 0x0 [0087.351] lstrlenW (lpString=".bak") returned 4 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".bak") returned 0x0 [0087.351] lstrlenW (lpString=".bac") returned 4 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".bac") returned 0x0 [0087.351] lstrlenW (lpString=".sys") returned 4 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".sys") returned 0x0 [0087.351] lstrlenW (lpString=".v2i") returned 4 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".v2i") returned 0x0 [0087.351] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.353] lstrlenW (lpString=".sql") returned 4 [0087.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".sql") returned 0x0 [0087.353] lstrlenW (lpString=".mdf") returned 4 [0087.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".mdf") returned 0x0 [0087.353] lstrlenW (lpString=".txt") returned 4 [0087.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".txt") returned 0x0 [0087.353] lstrlenW (lpString=".dbf") returned 4 [0087.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".dbf") returned 0x0 [0087.353] lstrlenW (lpString=".ckp") returned 4 [0087.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".ckp") returned 0x0 [0087.353] lstrlenW (lpString=".dacpac") returned 7 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".dacpac") returned 0x0 [0087.354] lstrlenW (lpString=".db3") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".db3") returned 0x0 [0087.354] lstrlenW (lpString=".dtxs") returned 5 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".dtxs") returned 0x0 [0087.354] lstrlenW (lpString=".mdt") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".mdt") returned 0x0 [0087.354] lstrlenW (lpString=".sdf") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".sdf") returned 0x0 [0087.354] lstrlenW (lpString=".MDF") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".MDF") returned 0x0 [0087.354] lstrlenW (lpString=".DBF") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".DBF") returned 0x0 [0087.354] lstrlenW (lpString=".DB") returned 3 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".DB") returned 0x0 [0087.354] lstrlenW (lpString=".db") returned 3 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".db") returned 0x0 [0087.354] lstrlenW (lpString=".ndf") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".ndf") returned 0x0 [0087.354] lstrlenW (lpString=".NDF") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".NDF") returned 0x0 [0087.354] lstrlenW (lpString=".Mdf") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".Mdf") returned 0x0 [0087.354] lstrlenW (lpString=".dat") returned 4 [0087.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".dat") returned 0x0 [0087.354] lstrlenW (lpString=".DAT") returned 4 [0087.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".DAT") returned 0x0 [0087.355] lstrlenW (lpString=".ldf") returned 4 [0087.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".ldf") returned 0x0 [0087.355] lstrlenW (lpString=".LDF") returned 4 [0087.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch=".LDF") returned 0x0 [0087.355] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.355] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.356] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.356] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.356] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20735700545) returned 1 [0087.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2e0de30, dwHighDateTime=0x1d585b4)) [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d398 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d398 | out: hHeap=0x260000) returned 1 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.357] GetLastError () returned 0x0 [0087.357] GetLastError () returned 0x0 [0087.357] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.357] GetLastError () returned 0x0 [0087.357] GetLastError () returned 0x0 [0087.359] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffc569, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.359] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x3a97, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x3a97, lpOverlapped=0x0) returned 1 [0087.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0087.360] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.360] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.360] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.360] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.360] CloseHandle (hObject=0xe4) returned 1 [0087.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.362] GetLastError () returned 0x0 [0087.363] RtlWakeConditionVariable () returned 0x0 [0087.363] GetCurrentThreadId () returned 0x99c [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".ldf") returned 0x0 [0087.363] lstrlenW (lpString=".vhd") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".vhd") returned 0x0 [0087.363] lstrlenW (lpString=".vhdx") returned 5 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".vhdx") returned 0x0 [0087.363] lstrlenW (lpString=".pst") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".pst") returned 0x0 [0087.363] lstrlenW (lpString=".ost") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".ost") returned 0x0 [0087.363] lstrlenW (lpString=".bak") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".bak") returned 0x0 [0087.363] lstrlenW (lpString=".bac") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".bac") returned 0x0 [0087.363] lstrlenW (lpString=".sys") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".sys") returned 0x0 [0087.363] lstrlenW (lpString=".v2i") returned 4 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".v2i") returned 0x0 [0087.363] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.365] lstrlenW (lpString=".sql") returned 4 [0087.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".sql") returned 0x0 [0087.365] lstrlenW (lpString=".mdf") returned 4 [0087.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".mdf") returned 0x0 [0087.365] lstrlenW (lpString=".txt") returned 4 [0087.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".txt") returned 0x0 [0087.365] lstrlenW (lpString=".dbf") returned 4 [0087.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".dbf") returned 0x0 [0087.365] lstrlenW (lpString=".ckp") returned 4 [0087.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".ckp") returned 0x0 [0087.365] lstrlenW (lpString=".dacpac") returned 7 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".dacpac") returned 0x0 [0087.366] lstrlenW (lpString=".db3") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".db3") returned 0x0 [0087.366] lstrlenW (lpString=".dtxs") returned 5 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".dtxs") returned 0x0 [0087.366] lstrlenW (lpString=".mdt") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".mdt") returned 0x0 [0087.366] lstrlenW (lpString=".sdf") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".sdf") returned 0x0 [0087.366] lstrlenW (lpString=".MDF") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".MDF") returned 0x0 [0087.366] lstrlenW (lpString=".DBF") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".DBF") returned 0x0 [0087.366] lstrlenW (lpString=".DB") returned 3 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".DB") returned 0x0 [0087.366] lstrlenW (lpString=".db") returned 3 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".db") returned 0x0 [0087.366] lstrlenW (lpString=".ndf") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".ndf") returned 0x0 [0087.366] lstrlenW (lpString=".NDF") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".NDF") returned 0x0 [0087.366] lstrlenW (lpString=".Mdf") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".Mdf") returned 0x0 [0087.366] lstrlenW (lpString=".dat") returned 4 [0087.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".dat") returned 0x0 [0087.367] lstrlenW (lpString=".DAT") returned 4 [0087.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".DAT") returned 0x0 [0087.367] lstrlenW (lpString=".ldf") returned 4 [0087.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".ldf") returned 0x0 [0087.367] lstrlenW (lpString=".LDF") returned 4 [0087.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch=".LDF") returned 0x0 [0087.367] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.367] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.368] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.368] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.368] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20736908123) returned 1 [0087.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2e33f90, dwHighDateTime=0x1d585b4)) [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d3d0 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d3d0 | out: hHeap=0x260000) returned 1 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.369] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.369] GetLastError () returned 0x0 [0087.369] GetLastError () returned 0x0 [0087.369] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.369] GetLastError () returned 0x0 [0087.369] GetLastError () returned 0x0 [0087.371] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffbd06, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.371] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x42fa, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x42fa, lpOverlapped=0x0) returned 1 [0087.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0087.372] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.372] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.372] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.372] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.372] CloseHandle (hObject=0xe4) returned 1 [0087.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.374] GetLastError () returned 0x0 [0087.374] RtlWakeConditionVariable () returned 0x0 [0087.374] GetCurrentThreadId () returned 0x99c [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".ldf") returned 0x0 [0087.375] lstrlenW (lpString=".vhd") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".vhd") returned 0x0 [0087.375] lstrlenW (lpString=".vhdx") returned 5 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".vhdx") returned 0x0 [0087.375] lstrlenW (lpString=".pst") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".pst") returned 0x0 [0087.375] lstrlenW (lpString=".ost") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".ost") returned 0x0 [0087.375] lstrlenW (lpString=".bak") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".bak") returned 0x0 [0087.375] lstrlenW (lpString=".bac") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".bac") returned 0x0 [0087.375] lstrlenW (lpString=".sys") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".sys") returned 0x0 [0087.375] lstrlenW (lpString=".v2i") returned 4 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".v2i") returned 0x0 [0087.375] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.375] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.377] lstrlenW (lpString=".sql") returned 4 [0087.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".sql") returned 0x0 [0087.377] lstrlenW (lpString=".mdf") returned 4 [0087.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".mdf") returned 0x0 [0087.377] lstrlenW (lpString=".txt") returned 4 [0087.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".txt") returned 0x0 [0087.377] lstrlenW (lpString=".dbf") returned 4 [0087.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".dbf") returned 0x0 [0087.377] lstrlenW (lpString=".ckp") returned 4 [0087.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".ckp") returned 0x0 [0087.377] lstrlenW (lpString=".dacpac") returned 7 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".dacpac") returned 0x0 [0087.378] lstrlenW (lpString=".db3") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".db3") returned 0x0 [0087.378] lstrlenW (lpString=".dtxs") returned 5 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".dtxs") returned 0x0 [0087.378] lstrlenW (lpString=".mdt") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".mdt") returned 0x0 [0087.378] lstrlenW (lpString=".sdf") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".sdf") returned 0x0 [0087.378] lstrlenW (lpString=".MDF") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".MDF") returned 0x0 [0087.378] lstrlenW (lpString=".DBF") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".DBF") returned 0x0 [0087.378] lstrlenW (lpString=".DB") returned 3 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".DB") returned 0x0 [0087.378] lstrlenW (lpString=".db") returned 3 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".db") returned 0x0 [0087.378] lstrlenW (lpString=".ndf") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".ndf") returned 0x0 [0087.378] lstrlenW (lpString=".NDF") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".NDF") returned 0x0 [0087.378] lstrlenW (lpString=".Mdf") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".Mdf") returned 0x0 [0087.378] lstrlenW (lpString=".dat") returned 4 [0087.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".dat") returned 0x0 [0087.378] lstrlenW (lpString=".DAT") returned 4 [0087.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".DAT") returned 0x0 [0087.379] lstrlenW (lpString=".ldf") returned 4 [0087.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".ldf") returned 0x0 [0087.379] lstrlenW (lpString=".LDF") returned 4 [0087.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch=".LDF") returned 0x0 [0087.379] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.379] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.380] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0087.380] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20738227837) returned 1 [0087.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2e5a0f0, dwHighDateTime=0x1d585b4)) [0087.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d408 [0087.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d408 | out: hHeap=0x260000) returned 1 [0087.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.382] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.382] GetLastError () returned 0x0 [0087.382] GetLastError () returned 0x0 [0087.382] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.383] GetLastError () returned 0x0 [0087.383] GetLastError () returned 0x0 [0087.425] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffbed9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.425] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x4127, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x4127, lpOverlapped=0x0) returned 1 [0087.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0087.428] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.428] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.428] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.428] CloseHandle (hObject=0xe4) returned 1 [0087.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0087.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.431] GetLastError () returned 0x0 [0087.431] RtlWakeConditionVariable () returned 0x0 [0087.431] GetCurrentThreadId () returned 0x99c [0087.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".ldf") returned 0x0 [0087.431] lstrlenW (lpString=".vhd") returned 4 [0087.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".vhd") returned 0x0 [0087.431] lstrlenW (lpString=".vhdx") returned 5 [0087.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".vhdx") returned 0x0 [0087.431] lstrlenW (lpString=".pst") returned 4 [0087.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".pst") returned 0x0 [0087.431] lstrlenW (lpString=".ost") returned 4 [0087.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".ost") returned 0x0 [0087.431] lstrlenW (lpString=".bak") returned 4 [0087.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".bak") returned 0x0 [0087.432] lstrlenW (lpString=".bac") returned 4 [0087.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".bac") returned 0x0 [0087.432] lstrlenW (lpString=".sys") returned 4 [0087.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".sys") returned 0x0 [0087.432] lstrlenW (lpString=".v2i") returned 4 [0087.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".v2i") returned 0x0 [0087.432] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.462] lstrlenW (lpString=".sql") returned 4 [0087.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".sql") returned 0x0 [0087.462] lstrlenW (lpString=".mdf") returned 4 [0087.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".mdf") returned 0x0 [0087.473] lstrlenW (lpString=".txt") returned 4 [0087.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".txt") returned 0x0 [0087.473] lstrlenW (lpString=".dbf") returned 4 [0087.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".dbf") returned 0x0 [0087.473] lstrlenW (lpString=".ckp") returned 4 [0087.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".ckp") returned 0x0 [0087.473] lstrlenW (lpString=".dacpac") returned 7 [0087.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".dacpac") returned 0x0 [0087.473] lstrlenW (lpString=".db3") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".db3") returned 0x0 [0087.474] lstrlenW (lpString=".dtxs") returned 5 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".dtxs") returned 0x0 [0087.474] lstrlenW (lpString=".mdt") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".mdt") returned 0x0 [0087.474] lstrlenW (lpString=".sdf") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".sdf") returned 0x0 [0087.474] lstrlenW (lpString=".MDF") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".MDF") returned 0x0 [0087.474] lstrlenW (lpString=".DBF") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".DBF") returned 0x0 [0087.474] lstrlenW (lpString=".DB") returned 3 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".DB") returned 0x0 [0087.474] lstrlenW (lpString=".db") returned 3 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".db") returned 0x0 [0087.474] lstrlenW (lpString=".ndf") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".ndf") returned 0x0 [0087.474] lstrlenW (lpString=".NDF") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".NDF") returned 0x0 [0087.474] lstrlenW (lpString=".Mdf") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".Mdf") returned 0x0 [0087.474] lstrlenW (lpString=".dat") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".dat") returned 0x0 [0087.474] lstrlenW (lpString=".DAT") returned 4 [0087.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".DAT") returned 0x0 [0087.474] lstrlenW (lpString=".ldf") returned 4 [0087.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".ldf") returned 0x0 [0087.475] lstrlenW (lpString=".LDF") returned 4 [0087.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch=".LDF") returned 0x0 [0087.475] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.475] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.476] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.476] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.476] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20747690877) returned 1 [0087.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2f3e930, dwHighDateTime=0x1d585b4)) [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d558 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d558 | out: hHeap=0x260000) returned 1 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.477] GetLastError () returned 0x0 [0087.477] GetLastError () returned 0x0 [0087.477] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.477] GetLastError () returned 0x0 [0087.477] GetLastError () returned 0x0 [0087.480] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff36a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.480] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc96, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xc96, lpOverlapped=0x0) returned 1 [0087.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.480] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.480] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.480] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.480] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.480] CloseHandle (hObject=0xd8) returned 1 [0087.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.[deadmin@cock.li].deadmin")) returned 1 [0087.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.482] GetLastError () returned 0x0 [0087.483] RtlWakeConditionVariable () returned 0x0 [0087.483] GetCurrentThreadId () returned 0x99c [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0087.483] lstrlenW (lpString=".vhd") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".vhd") returned 0x0 [0087.483] lstrlenW (lpString=".vhdx") returned 5 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".vhdx") returned 0x0 [0087.483] lstrlenW (lpString=".pst") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".pst") returned 0x0 [0087.483] lstrlenW (lpString=".ost") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".ost") returned 0x0 [0087.483] lstrlenW (lpString=".bak") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".bak") returned 0x0 [0087.483] lstrlenW (lpString=".bac") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".bac") returned 0x0 [0087.483] lstrlenW (lpString=".sys") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".sys") returned 0x0 [0087.483] lstrlenW (lpString=".v2i") returned 4 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".v2i") returned 0x0 [0087.483] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.485] lstrlenW (lpString=".sql") returned 4 [0087.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".sql") returned 0x0 [0087.486] lstrlenW (lpString=".mdf") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".mdf") returned 0x0 [0087.486] lstrlenW (lpString=".txt") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".txt") returned 0x0 [0087.486] lstrlenW (lpString=".dbf") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".dbf") returned 0x0 [0087.486] lstrlenW (lpString=".ckp") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".ckp") returned 0x0 [0087.486] lstrlenW (lpString=".dacpac") returned 7 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".dacpac") returned 0x0 [0087.486] lstrlenW (lpString=".db3") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".db3") returned 0x0 [0087.486] lstrlenW (lpString=".dtxs") returned 5 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".dtxs") returned 0x0 [0087.486] lstrlenW (lpString=".mdt") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".mdt") returned 0x0 [0087.486] lstrlenW (lpString=".sdf") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".sdf") returned 0x0 [0087.486] lstrlenW (lpString=".MDF") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".MDF") returned 0x0 [0087.486] lstrlenW (lpString=".DBF") returned 4 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".DBF") returned 0x0 [0087.486] lstrlenW (lpString=".DB") returned 3 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".DB") returned 0x0 [0087.486] lstrlenW (lpString=".db") returned 3 [0087.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".db") returned 0x0 [0087.487] lstrlenW (lpString=".ndf") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".ndf") returned 0x0 [0087.487] lstrlenW (lpString=".NDF") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".NDF") returned 0x0 [0087.487] lstrlenW (lpString=".Mdf") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".Mdf") returned 0x0 [0087.487] lstrlenW (lpString=".dat") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".dat") returned 0x0 [0087.487] lstrlenW (lpString=".DAT") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".DAT") returned 0x0 [0087.487] lstrlenW (lpString=".ldf") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".ldf") returned 0x0 [0087.487] lstrlenW (lpString=".LDF") returned 4 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch=".LDF") returned 0x0 [0087.487] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.487] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.488] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.488] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20748940464) returned 1 [0087.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2f64a90, dwHighDateTime=0x1d585b4)) [0087.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d590 [0087.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d590 | out: hHeap=0x260000) returned 1 [0087.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.489] GetLastError () returned 0x0 [0087.489] GetLastError () returned 0x0 [0087.489] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.490] GetLastError () returned 0x0 [0087.490] GetLastError () returned 0x0 [0087.491] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc5e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.491] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3a2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x3a2, lpOverlapped=0x0) returned 1 [0087.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.492] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.492] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.492] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.492] CloseHandle (hObject=0xd8) returned 1 [0087.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0087.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.494] GetLastError () returned 0x0 [0087.494] RtlWakeConditionVariable () returned 0x0 [0087.494] GetCurrentThreadId () returned 0x99c [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0087.494] lstrlenW (lpString=".vhd") returned 4 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".vhd") returned 0x0 [0087.494] lstrlenW (lpString=".vhdx") returned 5 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".vhdx") returned 0x0 [0087.494] lstrlenW (lpString=".pst") returned 4 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".pst") returned 0x0 [0087.494] lstrlenW (lpString=".ost") returned 4 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".ost") returned 0x0 [0087.494] lstrlenW (lpString=".bak") returned 4 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".bak") returned 0x0 [0087.494] lstrlenW (lpString=".bac") returned 4 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".bac") returned 0x0 [0087.494] lstrlenW (lpString=".sys") returned 4 [0087.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".sys") returned 0x0 [0087.494] lstrlenW (lpString=".v2i") returned 4 [0087.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".v2i") returned 0x0 [0087.495] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.514] lstrlenW (lpString=".sql") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".sql") returned 0x0 [0087.514] lstrlenW (lpString=".mdf") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".mdf") returned 0x0 [0087.514] lstrlenW (lpString=".txt") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".txt") returned 0x0 [0087.514] lstrlenW (lpString=".dbf") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".dbf") returned 0x0 [0087.514] lstrlenW (lpString=".ckp") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".ckp") returned 0x0 [0087.514] lstrlenW (lpString=".dacpac") returned 7 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".dacpac") returned 0x0 [0087.514] lstrlenW (lpString=".db3") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".db3") returned 0x0 [0087.514] lstrlenW (lpString=".dtxs") returned 5 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".dtxs") returned 0x0 [0087.514] lstrlenW (lpString=".mdt") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".mdt") returned 0x0 [0087.514] lstrlenW (lpString=".sdf") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".sdf") returned 0x0 [0087.514] lstrlenW (lpString=".MDF") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".MDF") returned 0x0 [0087.514] lstrlenW (lpString=".DBF") returned 4 [0087.514] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".DBF") returned 0x0 [0087.514] lstrlenW (lpString=".DB") returned 3 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".DB") returned 0x0 [0087.515] lstrlenW (lpString=".db") returned 3 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".db") returned 0x0 [0087.515] lstrlenW (lpString=".ndf") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".ndf") returned 0x0 [0087.515] lstrlenW (lpString=".NDF") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".NDF") returned 0x0 [0087.515] lstrlenW (lpString=".Mdf") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".Mdf") returned 0x0 [0087.515] lstrlenW (lpString=".dat") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".dat") returned 0x0 [0087.515] lstrlenW (lpString=".DAT") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".DAT") returned 0x0 [0087.515] lstrlenW (lpString=".ldf") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0087.515] lstrlenW (lpString=".LDF") returned 4 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch=".LDF") returned 0x0 [0087.515] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.515] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.515] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.516] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.516] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.517] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20751767497) returned 1 [0087.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2fb0d50, dwHighDateTime=0x1d585b4)) [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d5c8 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d5c8 | out: hHeap=0x260000) returned 1 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.517] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.517] GetLastError () returned 0x0 [0087.518] GetLastError () returned 0x0 [0087.518] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.518] GetLastError () returned 0x0 [0087.518] GetLastError () returned 0x0 [0087.520] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.520] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x262, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x262, lpOverlapped=0x0) returned 1 [0087.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.520] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.520] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.520] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.520] CloseHandle (hObject=0xe4) returned 1 [0087.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0087.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0087.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0087.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.532] GetLastError () returned 0x0 [0087.533] RtlWakeConditionVariable () returned 0x0 [0087.533] GetCurrentThreadId () returned 0x99c [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".ldf") returned 0x0 [0087.533] lstrlenW (lpString=".vhd") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".vhd") returned 0x0 [0087.533] lstrlenW (lpString=".vhdx") returned 5 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".vhdx") returned 0x0 [0087.533] lstrlenW (lpString=".pst") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".pst") returned 0x0 [0087.533] lstrlenW (lpString=".ost") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".ost") returned 0x0 [0087.533] lstrlenW (lpString=".bak") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".bak") returned 0x0 [0087.533] lstrlenW (lpString=".bac") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".bac") returned 0x0 [0087.533] lstrlenW (lpString=".sys") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".sys") returned 0x0 [0087.533] lstrlenW (lpString=".v2i") returned 4 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".v2i") returned 0x0 [0087.533] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.536] lstrlenW (lpString=".sql") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".sql") returned 0x0 [0087.536] lstrlenW (lpString=".mdf") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".mdf") returned 0x0 [0087.536] lstrlenW (lpString=".txt") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".txt") returned 0x0 [0087.536] lstrlenW (lpString=".dbf") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".dbf") returned 0x0 [0087.536] lstrlenW (lpString=".ckp") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".ckp") returned 0x0 [0087.536] lstrlenW (lpString=".dacpac") returned 7 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".dacpac") returned 0x0 [0087.536] lstrlenW (lpString=".db3") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".db3") returned 0x0 [0087.536] lstrlenW (lpString=".dtxs") returned 5 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".dtxs") returned 0x0 [0087.536] lstrlenW (lpString=".mdt") returned 4 [0087.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".mdt") returned 0x0 [0087.536] lstrlenW (lpString=".sdf") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".sdf") returned 0x0 [0087.537] lstrlenW (lpString=".MDF") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".MDF") returned 0x0 [0087.537] lstrlenW (lpString=".DBF") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".DBF") returned 0x0 [0087.537] lstrlenW (lpString=".DB") returned 3 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".DB") returned 0x0 [0087.537] lstrlenW (lpString=".db") returned 3 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".db") returned 0x0 [0087.537] lstrlenW (lpString=".ndf") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".ndf") returned 0x0 [0087.537] lstrlenW (lpString=".NDF") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".NDF") returned 0x0 [0087.537] lstrlenW (lpString=".Mdf") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".Mdf") returned 0x0 [0087.537] lstrlenW (lpString=".dat") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".dat") returned 0x0 [0087.537] lstrlenW (lpString=".DAT") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".DAT") returned 0x0 [0087.537] lstrlenW (lpString=".ldf") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".ldf") returned 0x0 [0087.537] lstrlenW (lpString=".LDF") returned 4 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch=".LDF") returned 0x0 [0087.537] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.538] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.538] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.539] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20753972929) returned 1 [0087.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc2fd6eb0, dwHighDateTime=0x1d585b4)) [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7908 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7908 | out: hHeap=0x260000) returned 1 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.539] GetLastError () returned 0x0 [0087.540] GetLastError () returned 0x0 [0087.540] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.540] GetLastError () returned 0x0 [0087.540] GetLastError () returned 0x0 [0087.544] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.544] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0087.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.545] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.545] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.545] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.545] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.545] CloseHandle (hObject=0xe4) returned 1 [0087.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0087.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.547] GetLastError () returned 0x0 [0087.547] RtlWakeConditionVariable () returned 0x0 [0087.547] GetCurrentThreadId () returned 0x99c [0087.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".ldf") returned 0x0 [0087.676] lstrlenW (lpString=".vhd") returned 4 [0087.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".vhd") returned 0x0 [0087.677] lstrlenW (lpString=".vhdx") returned 5 [0087.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".vhdx") returned 0x0 [0087.681] lstrlenW (lpString=".pst") returned 4 [0087.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".pst") returned 0x0 [0087.681] lstrlenW (lpString=".ost") returned 4 [0087.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".ost") returned 0x0 [0087.681] lstrlenW (lpString=".bak") returned 4 [0087.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".bak") returned 0x0 [0087.681] lstrlenW (lpString=".bac") returned 4 [0087.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".bac") returned 0x0 [0087.681] lstrlenW (lpString=".sys") returned 4 [0087.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".sys") returned 0x0 [0087.681] lstrlenW (lpString=".v2i") returned 4 [0087.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".v2i") returned 0x0 [0087.682] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.760] lstrlenW (lpString=".sql") returned 4 [0087.760] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".sql") returned 0x0 [0087.761] lstrlenW (lpString=".mdf") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".mdf") returned 0x0 [0087.761] lstrlenW (lpString=".txt") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".txt") returned 0x0 [0087.761] lstrlenW (lpString=".dbf") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".dbf") returned 0x0 [0087.761] lstrlenW (lpString=".ckp") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".ckp") returned 0x0 [0087.761] lstrlenW (lpString=".dacpac") returned 7 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".dacpac") returned 0x0 [0087.761] lstrlenW (lpString=".db3") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".db3") returned 0x0 [0087.761] lstrlenW (lpString=".dtxs") returned 5 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".dtxs") returned 0x0 [0087.761] lstrlenW (lpString=".mdt") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".mdt") returned 0x0 [0087.761] lstrlenW (lpString=".sdf") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".sdf") returned 0x0 [0087.761] lstrlenW (lpString=".MDF") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".MDF") returned 0x0 [0087.761] lstrlenW (lpString=".DBF") returned 4 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".DBF") returned 0x0 [0087.761] lstrlenW (lpString=".DB") returned 3 [0087.761] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".DB") returned 0x0 [0087.761] lstrlenW (lpString=".db") returned 3 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".db") returned 0x0 [0087.762] lstrlenW (lpString=".ndf") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".ndf") returned 0x0 [0087.762] lstrlenW (lpString=".NDF") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".NDF") returned 0x0 [0087.762] lstrlenW (lpString=".Mdf") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".Mdf") returned 0x0 [0087.762] lstrlenW (lpString=".dat") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".dat") returned 0x0 [0087.762] lstrlenW (lpString=".DAT") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".DAT") returned 0x0 [0087.762] lstrlenW (lpString=".ldf") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".ldf") returned 0x0 [0087.762] lstrlenW (lpString=".LDF") returned 4 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch=".LDF") returned 0x0 [0087.762] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.762] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.763] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.763] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.763] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20776436947) returned 1 [0087.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc31ec1f0, dwHighDateTime=0x1d585b4)) [0087.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d8a0 [0087.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d8a0 | out: hHeap=0x260000) returned 1 [0087.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.764] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.764] GetLastError () returned 0x0 [0087.764] GetLastError () returned 0x0 [0087.764] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.764] GetLastError () returned 0x0 [0087.765] GetLastError () returned 0x0 [0087.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff05f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.766] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xfa1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xfa1, lpOverlapped=0x0) returned 1 [0087.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.766] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.766] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.767] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.767] CloseHandle (hObject=0xf0) returned 1 [0087.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0087.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.[deadmin@cock.li].deadmin")) returned 1 [0087.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0087.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.768] GetLastError () returned 0x0 [0087.768] RtlWakeConditionVariable () returned 0x0 [0087.769] GetCurrentThreadId () returned 0x99c [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0087.769] lstrlenW (lpString=".vhd") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".vhd") returned 0x0 [0087.769] lstrlenW (lpString=".vhdx") returned 5 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".vhdx") returned 0x0 [0087.769] lstrlenW (lpString=".pst") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".pst") returned 0x0 [0087.769] lstrlenW (lpString=".ost") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".ost") returned 0x0 [0087.769] lstrlenW (lpString=".bak") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".bak") returned 0x0 [0087.769] lstrlenW (lpString=".bac") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".bac") returned 0x0 [0087.769] lstrlenW (lpString=".sys") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".sys") returned 0x0 [0087.769] lstrlenW (lpString=".v2i") returned 4 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".v2i") returned 0x0 [0087.769] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch="s\r\n.v2i") returned 0x0 [0087.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.770] lstrlenW (lpString=".sql") returned 4 [0087.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".sql") returned 0x0 [0087.770] lstrlenW (lpString=".mdf") returned 4 [0087.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".mdf") returned 0x0 [0087.771] lstrlenW (lpString=".txt") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".txt") returned 0x0 [0087.771] lstrlenW (lpString=".dbf") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".dbf") returned 0x0 [0087.771] lstrlenW (lpString=".ckp") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".ckp") returned 0x0 [0087.771] lstrlenW (lpString=".dacpac") returned 7 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".dacpac") returned 0x0 [0087.771] lstrlenW (lpString=".db3") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".db3") returned 0x0 [0087.771] lstrlenW (lpString=".dtxs") returned 5 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".dtxs") returned 0x0 [0087.771] lstrlenW (lpString=".mdt") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".mdt") returned 0x0 [0087.771] lstrlenW (lpString=".sdf") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".sdf") returned 0x0 [0087.771] lstrlenW (lpString=".MDF") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".MDF") returned 0x0 [0087.771] lstrlenW (lpString=".DBF") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".DBF") returned 0x0 [0087.771] lstrlenW (lpString=".DB") returned 3 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".DB") returned 0x0 [0087.771] lstrlenW (lpString=".db") returned 3 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".db") returned 0x0 [0087.771] lstrlenW (lpString=".ndf") returned 4 [0087.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".ndf") returned 0x0 [0087.772] lstrlenW (lpString=".NDF") returned 4 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".NDF") returned 0x0 [0087.772] lstrlenW (lpString=".Mdf") returned 4 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".Mdf") returned 0x0 [0087.772] lstrlenW (lpString=".dat") returned 4 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".dat") returned 0x0 [0087.772] lstrlenW (lpString=".DAT") returned 4 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".DAT") returned 0x0 [0087.772] lstrlenW (lpString=".ldf") returned 4 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0087.772] lstrlenW (lpString=".LDF") returned 4 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch=".LDF") returned 0x0 [0087.772] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.772] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.773] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.773] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.773] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20777426261) returned 1 [0087.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3212350, dwHighDateTime=0x1d585b4)) [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d8d8 [0087.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d8d8 | out: hHeap=0x260000) returned 1 [0087.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.774] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.774] GetLastError () returned 0x0 [0087.774] GetLastError () returned 0x0 [0087.774] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.774] GetLastError () returned 0x0 [0087.775] GetLastError () returned 0x0 [0087.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff3ee8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.776] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc118, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xc118, lpOverlapped=0x0) returned 1 [0087.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.777] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.777] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.777] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.777] CloseHandle (hObject=0xf0) returned 1 [0087.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313650 [0087.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js.[deadmin@cock.li].deadmin")) returned 1 [0087.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313650 | out: hHeap=0x260000) returned 1 [0087.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0087.778] GetLastError () returned 0x0 [0087.779] RtlWakeConditionVariable () returned 0x27e828 [0087.779] GetCurrentThreadId () returned 0x99c [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0087.779] lstrlenW (lpString=".vhd") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".vhd") returned 0x0 [0087.779] lstrlenW (lpString=".vhdx") returned 5 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".vhdx") returned 0x0 [0087.779] lstrlenW (lpString=".pst") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".pst") returned 0x0 [0087.779] lstrlenW (lpString=".ost") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".ost") returned 0x0 [0087.779] lstrlenW (lpString=".bak") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".bak") returned 0x0 [0087.779] lstrlenW (lpString=".bac") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".bac") returned 0x0 [0087.779] lstrlenW (lpString=".sys") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".sys") returned 0x0 [0087.779] lstrlenW (lpString=".v2i") returned 4 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".v2i") returned 0x0 [0087.779] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0087.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.957] lstrlenW (lpString=".sql") returned 4 [0087.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".sql") returned 0x0 [0087.957] lstrlenW (lpString=".mdf") returned 4 [0087.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".mdf") returned 0x0 [0087.967] lstrlenW (lpString=".txt") returned 4 [0087.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".txt") returned 0x0 [0087.967] lstrlenW (lpString=".dbf") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".dbf") returned 0x0 [0087.968] lstrlenW (lpString=".ckp") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".ckp") returned 0x0 [0087.968] lstrlenW (lpString=".dacpac") returned 7 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".dacpac") returned 0x0 [0087.968] lstrlenW (lpString=".db3") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".db3") returned 0x0 [0087.968] lstrlenW (lpString=".dtxs") returned 5 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".dtxs") returned 0x0 [0087.968] lstrlenW (lpString=".mdt") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".mdt") returned 0x0 [0087.968] lstrlenW (lpString=".sdf") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".sdf") returned 0x0 [0087.968] lstrlenW (lpString=".MDF") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".MDF") returned 0x0 [0087.968] lstrlenW (lpString=".DBF") returned 4 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".DBF") returned 0x0 [0087.968] lstrlenW (lpString=".DB") returned 3 [0087.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".DB") returned 0x0 [0087.968] lstrlenW (lpString=".db") returned 3 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".db") returned 0x0 [0087.969] lstrlenW (lpString=".ndf") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".ndf") returned 0x0 [0087.969] lstrlenW (lpString=".NDF") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".NDF") returned 0x0 [0087.969] lstrlenW (lpString=".Mdf") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".Mdf") returned 0x0 [0087.969] lstrlenW (lpString=".dat") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".dat") returned 0x0 [0087.969] lstrlenW (lpString=".DAT") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".DAT") returned 0x0 [0087.969] lstrlenW (lpString=".ldf") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0087.969] lstrlenW (lpString=".LDF") returned 4 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch=".LDF") returned 0x0 [0087.969] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.969] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.970] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.970] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20797136359) returned 1 [0087.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3401530, dwHighDateTime=0x1d585b4)) [0087.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b90 [0087.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b90 | out: hHeap=0x260000) returned 1 [0087.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.971] GetLastError () returned 0x0 [0087.971] GetLastError () returned 0x0 [0087.971] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.971] GetLastError () returned 0x0 [0087.972] GetLastError () returned 0x0 [0087.973] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffefc1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.973] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x103f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x103f, lpOverlapped=0x0) returned 1 [0087.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.973] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.973] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.974] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.974] CloseHandle (hObject=0xe4) returned 1 [0087.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0087.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.976] GetLastError () returned 0x0 [0087.976] RtlWakeConditionVariable () returned 0x0 [0087.976] GetCurrentThreadId () returned 0x99c [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".ldf") returned 0x0 [0087.977] lstrlenW (lpString=".vhd") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".vhd") returned 0x0 [0087.977] lstrlenW (lpString=".vhdx") returned 5 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".vhdx") returned 0x0 [0087.977] lstrlenW (lpString=".pst") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".pst") returned 0x0 [0087.977] lstrlenW (lpString=".ost") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".ost") returned 0x0 [0087.977] lstrlenW (lpString=".bak") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".bak") returned 0x0 [0087.977] lstrlenW (lpString=".bac") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".bac") returned 0x0 [0087.977] lstrlenW (lpString=".sys") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".sys") returned 0x0 [0087.977] lstrlenW (lpString=".v2i") returned 4 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".v2i") returned 0x0 [0087.977] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.979] lstrlenW (lpString=".sql") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".sql") returned 0x0 [0087.979] lstrlenW (lpString=".mdf") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".mdf") returned 0x0 [0087.979] lstrlenW (lpString=".txt") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".txt") returned 0x0 [0087.979] lstrlenW (lpString=".dbf") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".dbf") returned 0x0 [0087.979] lstrlenW (lpString=".ckp") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".ckp") returned 0x0 [0087.979] lstrlenW (lpString=".dacpac") returned 7 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".dacpac") returned 0x0 [0087.979] lstrlenW (lpString=".db3") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".db3") returned 0x0 [0087.979] lstrlenW (lpString=".dtxs") returned 5 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".dtxs") returned 0x0 [0087.979] lstrlenW (lpString=".mdt") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".mdt") returned 0x0 [0087.979] lstrlenW (lpString=".sdf") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".sdf") returned 0x0 [0087.979] lstrlenW (lpString=".MDF") returned 4 [0087.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".MDF") returned 0x0 [0087.980] lstrlenW (lpString=".DBF") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".DBF") returned 0x0 [0087.980] lstrlenW (lpString=".DB") returned 3 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".DB") returned 0x0 [0087.980] lstrlenW (lpString=".db") returned 3 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".db") returned 0x0 [0087.980] lstrlenW (lpString=".ndf") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".ndf") returned 0x0 [0087.980] lstrlenW (lpString=".NDF") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".NDF") returned 0x0 [0087.980] lstrlenW (lpString=".Mdf") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".Mdf") returned 0x0 [0087.980] lstrlenW (lpString=".dat") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".dat") returned 0x0 [0087.980] lstrlenW (lpString=".DAT") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".DAT") returned 0x0 [0087.980] lstrlenW (lpString=".ldf") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".ldf") returned 0x0 [0087.980] lstrlenW (lpString=".LDF") returned 4 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch=".LDF") returned 0x0 [0087.980] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.980] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0087.981] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.981] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0087.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0087.981] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20798256666) returned 1 [0087.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3401530, dwHighDateTime=0x1d585b4)) [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b20 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b20 | out: hHeap=0x260000) returned 1 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.982] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0087.982] GetLastError () returned 0x0 [0087.982] GetLastError () returned 0x0 [0087.983] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0087.983] GetLastError () returned 0x0 [0087.983] GetLastError () returned 0x0 [0088.059] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffecd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.069] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x132a, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x132a, lpOverlapped=0x0) returned 1 [0088.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.078] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.078] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.078] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.078] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.078] CloseHandle (hObject=0xe4) returned 1 [0088.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313548 [0088.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313548 | out: hHeap=0x260000) returned 1 [0088.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.080] GetLastError () returned 0x0 [0088.080] RtlWakeConditionVariable () returned 0x0 [0088.080] GetCurrentThreadId () returned 0x99c [0088.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".ldf") returned 0x0 [0088.080] lstrlenW (lpString=".vhd") returned 4 [0088.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".vhd") returned 0x0 [0088.080] lstrlenW (lpString=".vhdx") returned 5 [0088.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".vhdx") returned 0x0 [0088.080] lstrlenW (lpString=".pst") returned 4 [0088.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".pst") returned 0x0 [0088.080] lstrlenW (lpString=".ost") returned 4 [0088.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".ost") returned 0x0 [0088.080] lstrlenW (lpString=".bak") returned 4 [0088.080] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".bak") returned 0x0 [0088.081] lstrlenW (lpString=".bac") returned 4 [0088.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".bac") returned 0x0 [0088.081] lstrlenW (lpString=".sys") returned 4 [0088.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".sys") returned 0x0 [0088.081] lstrlenW (lpString=".v2i") returned 4 [0088.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".v2i") returned 0x0 [0088.081] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.082] lstrlenW (lpString=".sql") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".sql") returned 0x0 [0088.082] lstrlenW (lpString=".mdf") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".mdf") returned 0x0 [0088.082] lstrlenW (lpString=".txt") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".txt") returned 0x0 [0088.082] lstrlenW (lpString=".dbf") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".dbf") returned 0x0 [0088.082] lstrlenW (lpString=".ckp") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".ckp") returned 0x0 [0088.082] lstrlenW (lpString=".dacpac") returned 7 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".dacpac") returned 0x0 [0088.082] lstrlenW (lpString=".db3") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".db3") returned 0x0 [0088.082] lstrlenW (lpString=".dtxs") returned 5 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".dtxs") returned 0x0 [0088.082] lstrlenW (lpString=".mdt") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".mdt") returned 0x0 [0088.082] lstrlenW (lpString=".sdf") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".sdf") returned 0x0 [0088.082] lstrlenW (lpString=".MDF") returned 4 [0088.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".MDF") returned 0x0 [0088.082] lstrlenW (lpString=".DBF") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".DBF") returned 0x0 [0088.083] lstrlenW (lpString=".DB") returned 3 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".DB") returned 0x0 [0088.083] lstrlenW (lpString=".db") returned 3 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".db") returned 0x0 [0088.083] lstrlenW (lpString=".ndf") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".ndf") returned 0x0 [0088.083] lstrlenW (lpString=".NDF") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".NDF") returned 0x0 [0088.083] lstrlenW (lpString=".Mdf") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".Mdf") returned 0x0 [0088.083] lstrlenW (lpString=".dat") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".dat") returned 0x0 [0088.083] lstrlenW (lpString=".DAT") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".DAT") returned 0x0 [0088.083] lstrlenW (lpString=".ldf") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".ldf") returned 0x0 [0088.083] lstrlenW (lpString=".LDF") returned 4 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch=".LDF") returned 0x0 [0088.083] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.083] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.084] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.084] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.084] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20808550834) returned 1 [0088.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc350bed0, dwHighDateTime=0x1d585b4)) [0088.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9960 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9960 | out: hHeap=0x260000) returned 1 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.085] GetLastError () returned 0x0 [0088.085] GetLastError () returned 0x0 [0088.086] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.086] GetLastError () returned 0x0 [0088.086] GetLastError () returned 0x0 [0088.088] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffaebf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.088] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5141, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x5141, lpOverlapped=0x0) returned 1 [0088.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.088] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.088] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.089] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.089] CloseHandle (hObject=0xe4) returned 1 [0088.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0088.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.090] GetLastError () returned 0x0 [0088.090] RtlWakeConditionVariable () returned 0x0 [0088.090] GetCurrentThreadId () returned 0x99c [0088.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".ldf") returned 0x0 [0088.090] lstrlenW (lpString=".vhd") returned 4 [0088.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".vhd") returned 0x0 [0088.090] lstrlenW (lpString=".vhdx") returned 5 [0088.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".vhdx") returned 0x0 [0088.090] lstrlenW (lpString=".pst") returned 4 [0088.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".pst") returned 0x0 [0088.090] lstrlenW (lpString=".ost") returned 4 [0088.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".ost") returned 0x0 [0088.091] lstrlenW (lpString=".bak") returned 4 [0088.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".bak") returned 0x0 [0088.091] lstrlenW (lpString=".bac") returned 4 [0088.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".bac") returned 0x0 [0088.091] lstrlenW (lpString=".sys") returned 4 [0088.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".sys") returned 0x0 [0088.091] lstrlenW (lpString=".v2i") returned 4 [0088.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".v2i") returned 0x0 [0088.091] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.091] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.092] lstrlenW (lpString=".sql") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".sql") returned 0x0 [0088.092] lstrlenW (lpString=".mdf") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".mdf") returned 0x0 [0088.092] lstrlenW (lpString=".txt") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".txt") returned 0x0 [0088.092] lstrlenW (lpString=".dbf") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".dbf") returned 0x0 [0088.092] lstrlenW (lpString=".ckp") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".ckp") returned 0x0 [0088.092] lstrlenW (lpString=".dacpac") returned 7 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".dacpac") returned 0x0 [0088.092] lstrlenW (lpString=".db3") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".db3") returned 0x0 [0088.092] lstrlenW (lpString=".dtxs") returned 5 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".dtxs") returned 0x0 [0088.092] lstrlenW (lpString=".mdt") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".mdt") returned 0x0 [0088.092] lstrlenW (lpString=".sdf") returned 4 [0088.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".sdf") returned 0x0 [0088.092] lstrlenW (lpString=".MDF") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".MDF") returned 0x0 [0088.093] lstrlenW (lpString=".DBF") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".DBF") returned 0x0 [0088.093] lstrlenW (lpString=".DB") returned 3 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".DB") returned 0x0 [0088.093] lstrlenW (lpString=".db") returned 3 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".db") returned 0x0 [0088.093] lstrlenW (lpString=".ndf") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".ndf") returned 0x0 [0088.093] lstrlenW (lpString=".NDF") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".NDF") returned 0x0 [0088.093] lstrlenW (lpString=".Mdf") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".Mdf") returned 0x0 [0088.093] lstrlenW (lpString=".dat") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".dat") returned 0x0 [0088.093] lstrlenW (lpString=".DAT") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".DAT") returned 0x0 [0088.093] lstrlenW (lpString=".ldf") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".ldf") returned 0x0 [0088.093] lstrlenW (lpString=".LDF") returned 4 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch=".LDF") returned 0x0 [0088.093] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.094] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.094] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.094] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.094] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20809559002) returned 1 [0088.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3532030, dwHighDateTime=0x1d585b4)) [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d98f0 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98f0 | out: hHeap=0x260000) returned 1 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.095] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.095] GetLastError () returned 0x0 [0088.095] GetLastError () returned 0x0 [0088.096] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.096] GetLastError () returned 0x0 [0088.096] GetLastError () returned 0x0 [0088.097] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe6c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.097] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x193c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x193c, lpOverlapped=0x0) returned 1 [0088.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.098] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.098] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.098] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.098] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.098] CloseHandle (hObject=0xe4) returned 1 [0088.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0088.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.099] GetLastError () returned 0x0 [0088.099] RtlWakeConditionVariable () returned 0x0 [0088.099] GetCurrentThreadId () returned 0x99c [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".ldf") returned 0x0 [0088.100] lstrlenW (lpString=".vhd") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".vhd") returned 0x0 [0088.100] lstrlenW (lpString=".vhdx") returned 5 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".vhdx") returned 0x0 [0088.100] lstrlenW (lpString=".pst") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".pst") returned 0x0 [0088.100] lstrlenW (lpString=".ost") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".ost") returned 0x0 [0088.100] lstrlenW (lpString=".bak") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".bak") returned 0x0 [0088.100] lstrlenW (lpString=".bac") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".bac") returned 0x0 [0088.100] lstrlenW (lpString=".sys") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".sys") returned 0x0 [0088.100] lstrlenW (lpString=".v2i") returned 4 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".v2i") returned 0x0 [0088.100] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.102] lstrlenW (lpString=".sql") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".sql") returned 0x0 [0088.102] lstrlenW (lpString=".mdf") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".mdf") returned 0x0 [0088.102] lstrlenW (lpString=".txt") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".txt") returned 0x0 [0088.102] lstrlenW (lpString=".dbf") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".dbf") returned 0x0 [0088.102] lstrlenW (lpString=".ckp") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".ckp") returned 0x0 [0088.102] lstrlenW (lpString=".dacpac") returned 7 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".dacpac") returned 0x0 [0088.102] lstrlenW (lpString=".db3") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".db3") returned 0x0 [0088.102] lstrlenW (lpString=".dtxs") returned 5 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".dtxs") returned 0x0 [0088.102] lstrlenW (lpString=".mdt") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".mdt") returned 0x0 [0088.102] lstrlenW (lpString=".sdf") returned 4 [0088.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".sdf") returned 0x0 [0088.102] lstrlenW (lpString=".MDF") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".MDF") returned 0x0 [0088.103] lstrlenW (lpString=".DBF") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".DBF") returned 0x0 [0088.103] lstrlenW (lpString=".DB") returned 3 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".DB") returned 0x0 [0088.103] lstrlenW (lpString=".db") returned 3 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".db") returned 0x0 [0088.103] lstrlenW (lpString=".ndf") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".ndf") returned 0x0 [0088.103] lstrlenW (lpString=".NDF") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".NDF") returned 0x0 [0088.103] lstrlenW (lpString=".Mdf") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".Mdf") returned 0x0 [0088.103] lstrlenW (lpString=".dat") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".dat") returned 0x0 [0088.103] lstrlenW (lpString=".DAT") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".DAT") returned 0x0 [0088.103] lstrlenW (lpString=".ldf") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".ldf") returned 0x0 [0088.103] lstrlenW (lpString=".LDF") returned 4 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch=".LDF") returned 0x0 [0088.103] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.103] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.104] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.104] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.104] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20810555185) returned 1 [0088.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3532030, dwHighDateTime=0x1d585b4)) [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33db40 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33db40 | out: hHeap=0x260000) returned 1 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.105] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.105] GetLastError () returned 0x0 [0088.105] GetLastError () returned 0x0 [0088.106] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.106] GetLastError () returned 0x0 [0088.106] GetLastError () returned 0x0 [0088.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffc39c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.108] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3c64, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x3c64, lpOverlapped=0x0) returned 1 [0088.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.108] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.108] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.108] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.108] CloseHandle (hObject=0xe4) returned 1 [0088.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0088.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0088.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.110] GetLastError () returned 0x0 [0088.110] RtlWakeConditionVariable () returned 0x0 [0088.110] GetCurrentThreadId () returned 0x99c [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".ldf") returned 0x0 [0088.110] lstrlenW (lpString=".vhd") returned 4 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".vhd") returned 0x0 [0088.110] lstrlenW (lpString=".vhdx") returned 5 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".vhdx") returned 0x0 [0088.110] lstrlenW (lpString=".pst") returned 4 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".pst") returned 0x0 [0088.110] lstrlenW (lpString=".ost") returned 4 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".ost") returned 0x0 [0088.110] lstrlenW (lpString=".bak") returned 4 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".bak") returned 0x0 [0088.110] lstrlenW (lpString=".bac") returned 4 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".bac") returned 0x0 [0088.110] lstrlenW (lpString=".sys") returned 4 [0088.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".sys") returned 0x0 [0088.111] lstrlenW (lpString=".v2i") returned 4 [0088.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".v2i") returned 0x0 [0088.111] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.112] lstrlenW (lpString=".sql") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".sql") returned 0x0 [0088.112] lstrlenW (lpString=".mdf") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".mdf") returned 0x0 [0088.112] lstrlenW (lpString=".txt") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".txt") returned 0x0 [0088.112] lstrlenW (lpString=".dbf") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".dbf") returned 0x0 [0088.112] lstrlenW (lpString=".ckp") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".ckp") returned 0x0 [0088.112] lstrlenW (lpString=".dacpac") returned 7 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".dacpac") returned 0x0 [0088.112] lstrlenW (lpString=".db3") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".db3") returned 0x0 [0088.112] lstrlenW (lpString=".dtxs") returned 5 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".dtxs") returned 0x0 [0088.112] lstrlenW (lpString=".mdt") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".mdt") returned 0x0 [0088.112] lstrlenW (lpString=".sdf") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".sdf") returned 0x0 [0088.112] lstrlenW (lpString=".MDF") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".MDF") returned 0x0 [0088.112] lstrlenW (lpString=".DBF") returned 4 [0088.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".DBF") returned 0x0 [0088.112] lstrlenW (lpString=".DB") returned 3 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".DB") returned 0x0 [0088.113] lstrlenW (lpString=".db") returned 3 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".db") returned 0x0 [0088.113] lstrlenW (lpString=".ndf") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".ndf") returned 0x0 [0088.113] lstrlenW (lpString=".NDF") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".NDF") returned 0x0 [0088.113] lstrlenW (lpString=".Mdf") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".Mdf") returned 0x0 [0088.113] lstrlenW (lpString=".dat") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".dat") returned 0x0 [0088.113] lstrlenW (lpString=".DAT") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".DAT") returned 0x0 [0088.113] lstrlenW (lpString=".ldf") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".ldf") returned 0x0 [0088.113] lstrlenW (lpString=".LDF") returned 4 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch=".LDF") returned 0x0 [0088.113] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.113] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.114] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.114] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.114] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20811545479) returned 1 [0088.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3558190, dwHighDateTime=0x1d585b4)) [0088.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33db78 [0088.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33db78 | out: hHeap=0x260000) returned 1 [0088.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.115] GetLastError () returned 0x0 [0088.115] GetLastError () returned 0x0 [0088.115] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.116] GetLastError () returned 0x0 [0088.116] GetLastError () returned 0x0 [0088.117] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffe8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.117] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x171, lpOverlapped=0x0) returned 1 [0088.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.117] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.117] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.117] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.117] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.117] CloseHandle (hObject=0xe4) returned 1 [0088.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0088.118] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0088.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.119] GetLastError () returned 0x0 [0088.119] RtlWakeConditionVariable () returned 0x0 [0088.119] GetCurrentThreadId () returned 0x99c [0088.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".ldf") returned 0x0 [0088.119] lstrlenW (lpString=".vhd") returned 4 [0088.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".vhd") returned 0x0 [0088.119] lstrlenW (lpString=".vhdx") returned 5 [0088.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".vhdx") returned 0x0 [0088.119] lstrlenW (lpString=".pst") returned 4 [0088.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".pst") returned 0x0 [0088.119] lstrlenW (lpString=".ost") returned 4 [0088.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".ost") returned 0x0 [0088.119] lstrlenW (lpString=".bak") returned 4 [0088.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".bak") returned 0x0 [0088.120] lstrlenW (lpString=".bac") returned 4 [0088.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".bac") returned 0x0 [0088.120] lstrlenW (lpString=".sys") returned 4 [0088.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".sys") returned 0x0 [0088.120] lstrlenW (lpString=".v2i") returned 4 [0088.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".v2i") returned 0x0 [0088.120] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.121] lstrlenW (lpString=".sql") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".sql") returned 0x0 [0088.121] lstrlenW (lpString=".mdf") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".mdf") returned 0x0 [0088.121] lstrlenW (lpString=".txt") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".txt") returned 0x0 [0088.121] lstrlenW (lpString=".dbf") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".dbf") returned 0x0 [0088.121] lstrlenW (lpString=".ckp") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".ckp") returned 0x0 [0088.121] lstrlenW (lpString=".dacpac") returned 7 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".dacpac") returned 0x0 [0088.121] lstrlenW (lpString=".db3") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".db3") returned 0x0 [0088.121] lstrlenW (lpString=".dtxs") returned 5 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".dtxs") returned 0x0 [0088.121] lstrlenW (lpString=".mdt") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".mdt") returned 0x0 [0088.121] lstrlenW (lpString=".sdf") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".sdf") returned 0x0 [0088.121] lstrlenW (lpString=".MDF") returned 4 [0088.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".MDF") returned 0x0 [0088.122] lstrlenW (lpString=".DBF") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".DBF") returned 0x0 [0088.122] lstrlenW (lpString=".DB") returned 3 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".DB") returned 0x0 [0088.122] lstrlenW (lpString=".db") returned 3 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".db") returned 0x0 [0088.122] lstrlenW (lpString=".ndf") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".ndf") returned 0x0 [0088.122] lstrlenW (lpString=".NDF") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".NDF") returned 0x0 [0088.122] lstrlenW (lpString=".Mdf") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".Mdf") returned 0x0 [0088.122] lstrlenW (lpString=".dat") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".dat") returned 0x0 [0088.122] lstrlenW (lpString=".DAT") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".DAT") returned 0x0 [0088.122] lstrlenW (lpString=".ldf") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".ldf") returned 0x0 [0088.122] lstrlenW (lpString=".LDF") returned 4 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch=".LDF") returned 0x0 [0088.122] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.122] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.123] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.123] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20812456764) returned 1 [0088.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3558190, dwHighDateTime=0x1d585b4)) [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dbb0 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dbb0 | out: hHeap=0x260000) returned 1 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.124] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.124] GetLastError () returned 0x0 [0088.125] GetLastError () returned 0x0 [0088.125] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.125] GetLastError () returned 0x0 [0088.125] GetLastError () returned 0x0 [0088.126] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffe8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.126] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x176, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x176, lpOverlapped=0x0) returned 1 [0088.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.126] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.126] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.126] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.126] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.127] CloseHandle (hObject=0xe4) returned 1 [0088.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0088.127] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0088.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.128] GetLastError () returned 0x0 [0088.128] RtlWakeConditionVariable () returned 0x27e828 [0088.128] GetCurrentThreadId () returned 0x99c [0088.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".ldf") returned 0x0 [0088.128] lstrlenW (lpString=".vhd") returned 4 [0088.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".vhd") returned 0x0 [0088.128] lstrlenW (lpString=".vhdx") returned 5 [0088.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".vhdx") returned 0x0 [0088.128] lstrlenW (lpString=".pst") returned 4 [0088.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".pst") returned 0x0 [0088.128] lstrlenW (lpString=".ost") returned 4 [0088.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".ost") returned 0x0 [0088.128] lstrlenW (lpString=".bak") returned 4 [0088.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".bak") returned 0x0 [0088.129] lstrlenW (lpString=".bac") returned 4 [0088.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".bac") returned 0x0 [0088.129] lstrlenW (lpString=".sys") returned 4 [0088.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".sys") returned 0x0 [0088.129] lstrlenW (lpString=".v2i") returned 4 [0088.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".v2i") returned 0x0 [0088.129] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.130] lstrlenW (lpString=".sql") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".sql") returned 0x0 [0088.130] lstrlenW (lpString=".mdf") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".mdf") returned 0x0 [0088.130] lstrlenW (lpString=".txt") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".txt") returned 0x0 [0088.130] lstrlenW (lpString=".dbf") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".dbf") returned 0x0 [0088.130] lstrlenW (lpString=".ckp") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".ckp") returned 0x0 [0088.130] lstrlenW (lpString=".dacpac") returned 7 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".dacpac") returned 0x0 [0088.130] lstrlenW (lpString=".db3") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".db3") returned 0x0 [0088.130] lstrlenW (lpString=".dtxs") returned 5 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".dtxs") returned 0x0 [0088.130] lstrlenW (lpString=".mdt") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".mdt") returned 0x0 [0088.130] lstrlenW (lpString=".sdf") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".sdf") returned 0x0 [0088.130] lstrlenW (lpString=".MDF") returned 4 [0088.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".MDF") returned 0x0 [0088.131] lstrlenW (lpString=".DBF") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".DBF") returned 0x0 [0088.131] lstrlenW (lpString=".DB") returned 3 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".DB") returned 0x0 [0088.131] lstrlenW (lpString=".db") returned 3 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".db") returned 0x0 [0088.131] lstrlenW (lpString=".ndf") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".ndf") returned 0x0 [0088.131] lstrlenW (lpString=".NDF") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".NDF") returned 0x0 [0088.131] lstrlenW (lpString=".Mdf") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".Mdf") returned 0x0 [0088.131] lstrlenW (lpString=".dat") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".dat") returned 0x0 [0088.131] lstrlenW (lpString=".DAT") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".DAT") returned 0x0 [0088.131] lstrlenW (lpString=".ldf") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".ldf") returned 0x0 [0088.131] lstrlenW (lpString=".LDF") returned 4 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch=".LDF") returned 0x0 [0088.131] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.131] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.132] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.132] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.132] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20813355636) returned 1 [0088.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc357e2f0, dwHighDateTime=0x1d585b4)) [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dbe8 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dbe8 | out: hHeap=0x260000) returned 1 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.133] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.133] GetLastError () returned 0x0 [0088.133] GetLastError () returned 0x0 [0088.134] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.134] GetLastError () returned 0x0 [0088.134] GetLastError () returned 0x0 [0088.135] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.135] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xb5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xb5, lpOverlapped=0x0) returned 1 [0088.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.135] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.135] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.138] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.138] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.138] CloseHandle (hObject=0xe4) returned 1 [0088.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0088.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0088.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.139] GetLastError () returned 0x0 [0088.139] RtlWakeConditionVariable () returned 0x27e828 [0088.139] GetCurrentThreadId () returned 0x99c [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".ldf") returned 0x0 [0088.140] lstrlenW (lpString=".vhd") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".vhd") returned 0x0 [0088.140] lstrlenW (lpString=".vhdx") returned 5 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".vhdx") returned 0x0 [0088.140] lstrlenW (lpString=".pst") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".pst") returned 0x0 [0088.140] lstrlenW (lpString=".ost") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".ost") returned 0x0 [0088.140] lstrlenW (lpString=".bak") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".bak") returned 0x0 [0088.140] lstrlenW (lpString=".bac") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".bac") returned 0x0 [0088.140] lstrlenW (lpString=".sys") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".sys") returned 0x0 [0088.140] lstrlenW (lpString=".v2i") returned 4 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".v2i") returned 0x0 [0088.140] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.142] lstrlenW (lpString=".sql") returned 4 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".sql") returned 0x0 [0088.142] lstrlenW (lpString=".mdf") returned 4 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".mdf") returned 0x0 [0088.142] lstrlenW (lpString=".txt") returned 4 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".txt") returned 0x0 [0088.142] lstrlenW (lpString=".dbf") returned 4 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".dbf") returned 0x0 [0088.142] lstrlenW (lpString=".ckp") returned 4 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".ckp") returned 0x0 [0088.142] lstrlenW (lpString=".dacpac") returned 7 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".dacpac") returned 0x0 [0088.142] lstrlenW (lpString=".db3") returned 4 [0088.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".db3") returned 0x0 [0088.143] lstrlenW (lpString=".dtxs") returned 5 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".dtxs") returned 0x0 [0088.143] lstrlenW (lpString=".mdt") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".mdt") returned 0x0 [0088.143] lstrlenW (lpString=".sdf") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".sdf") returned 0x0 [0088.143] lstrlenW (lpString=".MDF") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".MDF") returned 0x0 [0088.143] lstrlenW (lpString=".DBF") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".DBF") returned 0x0 [0088.143] lstrlenW (lpString=".DB") returned 3 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".DB") returned 0x0 [0088.143] lstrlenW (lpString=".db") returned 3 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".db") returned 0x0 [0088.143] lstrlenW (lpString=".ndf") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".ndf") returned 0x0 [0088.143] lstrlenW (lpString=".NDF") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".NDF") returned 0x0 [0088.143] lstrlenW (lpString=".Mdf") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".Mdf") returned 0x0 [0088.143] lstrlenW (lpString=".dat") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".dat") returned 0x0 [0088.143] lstrlenW (lpString=".DAT") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".DAT") returned 0x0 [0088.143] lstrlenW (lpString=".ldf") returned 4 [0088.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".ldf") returned 0x0 [0088.144] lstrlenW (lpString=".LDF") returned 4 [0088.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch=".LDF") returned 0x0 [0088.144] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.144] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.144] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.145] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.145] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20814671819) returned 1 [0088.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc35a4450, dwHighDateTime=0x1d585b4)) [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dc20 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dc20 | out: hHeap=0x260000) returned 1 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.146] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.146] GetLastError () returned 0x0 [0088.147] GetLastError () returned 0x0 [0088.147] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.147] GetLastError () returned 0x0 [0088.147] GetLastError () returned 0x0 [0088.148] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.148] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xb7, lpOverlapped=0x0) returned 1 [0088.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.148] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.148] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.148] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.148] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.149] CloseHandle (hObject=0xe4) returned 1 [0088.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0088.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0088.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.150] GetLastError () returned 0x0 [0088.150] RtlWakeConditionVariable () returned 0x0 [0088.150] GetCurrentThreadId () returned 0x99c [0088.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".ldf") returned 0x0 [0088.150] lstrlenW (lpString=".vhd") returned 4 [0088.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".vhd") returned 0x0 [0088.150] lstrlenW (lpString=".vhdx") returned 5 [0088.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".vhdx") returned 0x0 [0088.150] lstrlenW (lpString=".pst") returned 4 [0088.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".pst") returned 0x0 [0088.150] lstrlenW (lpString=".ost") returned 4 [0088.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".ost") returned 0x0 [0088.151] lstrlenW (lpString=".bak") returned 4 [0088.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".bak") returned 0x0 [0088.151] lstrlenW (lpString=".bac") returned 4 [0088.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".bac") returned 0x0 [0088.151] lstrlenW (lpString=".sys") returned 4 [0088.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".sys") returned 0x0 [0088.151] lstrlenW (lpString=".v2i") returned 4 [0088.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".v2i") returned 0x0 [0088.151] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.152] lstrlenW (lpString=".sql") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".sql") returned 0x0 [0088.152] lstrlenW (lpString=".mdf") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".mdf") returned 0x0 [0088.152] lstrlenW (lpString=".txt") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".txt") returned 0x0 [0088.152] lstrlenW (lpString=".dbf") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".dbf") returned 0x0 [0088.152] lstrlenW (lpString=".ckp") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".ckp") returned 0x0 [0088.152] lstrlenW (lpString=".dacpac") returned 7 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".dacpac") returned 0x0 [0088.152] lstrlenW (lpString=".db3") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".db3") returned 0x0 [0088.152] lstrlenW (lpString=".dtxs") returned 5 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".dtxs") returned 0x0 [0088.152] lstrlenW (lpString=".mdt") returned 4 [0088.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".mdt") returned 0x0 [0088.152] lstrlenW (lpString=".sdf") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".sdf") returned 0x0 [0088.153] lstrlenW (lpString=".MDF") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".MDF") returned 0x0 [0088.153] lstrlenW (lpString=".DBF") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".DBF") returned 0x0 [0088.153] lstrlenW (lpString=".DB") returned 3 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".DB") returned 0x0 [0088.153] lstrlenW (lpString=".db") returned 3 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".db") returned 0x0 [0088.153] lstrlenW (lpString=".ndf") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".ndf") returned 0x0 [0088.153] lstrlenW (lpString=".NDF") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".NDF") returned 0x0 [0088.153] lstrlenW (lpString=".Mdf") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".Mdf") returned 0x0 [0088.153] lstrlenW (lpString=".dat") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".dat") returned 0x0 [0088.153] lstrlenW (lpString=".DAT") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".DAT") returned 0x0 [0088.153] lstrlenW (lpString=".ldf") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".ldf") returned 0x0 [0088.153] lstrlenW (lpString=".LDF") returned 4 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch=".LDF") returned 0x0 [0088.153] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.154] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.154] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.154] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.155] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20815567963) returned 1 [0088.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc35a4450, dwHighDateTime=0x1d585b4)) [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dc58 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dc58 | out: hHeap=0x260000) returned 1 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.155] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.155] GetLastError () returned 0x0 [0088.190] GetLastError () returned 0x0 [0088.190] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.190] GetLastError () returned 0x0 [0088.190] GetLastError () returned 0x0 [0088.191] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffe8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.191] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x171, lpOverlapped=0x0) returned 1 [0088.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.191] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.191] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.191] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.191] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.191] CloseHandle (hObject=0xe4) returned 1 [0088.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.312] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.313] GetLastError () returned 0x0 [0088.313] RtlWakeConditionVariable () returned 0x0 [0088.314] GetCurrentThreadId () returned 0x99c [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0088.314] lstrlenW (lpString=".vhd") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".vhd") returned 0x0 [0088.314] lstrlenW (lpString=".vhdx") returned 5 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".vhdx") returned 0x0 [0088.314] lstrlenW (lpString=".pst") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".pst") returned 0x0 [0088.314] lstrlenW (lpString=".ost") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".ost") returned 0x0 [0088.314] lstrlenW (lpString=".bak") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".bak") returned 0x0 [0088.314] lstrlenW (lpString=".bac") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".bac") returned 0x0 [0088.314] lstrlenW (lpString=".sys") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".sys") returned 0x0 [0088.314] lstrlenW (lpString=".v2i") returned 4 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".v2i") returned 0x0 [0088.314] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.315] lstrlenW (lpString=".sql") returned 4 [0088.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".sql") returned 0x0 [0088.315] lstrlenW (lpString=".mdf") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".mdf") returned 0x0 [0088.316] lstrlenW (lpString=".txt") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".txt") returned 0x0 [0088.316] lstrlenW (lpString=".dbf") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".dbf") returned 0x0 [0088.316] lstrlenW (lpString=".ckp") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".ckp") returned 0x0 [0088.316] lstrlenW (lpString=".dacpac") returned 7 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".dacpac") returned 0x0 [0088.316] lstrlenW (lpString=".db3") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".db3") returned 0x0 [0088.316] lstrlenW (lpString=".dtxs") returned 5 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".dtxs") returned 0x0 [0088.316] lstrlenW (lpString=".mdt") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".mdt") returned 0x0 [0088.316] lstrlenW (lpString=".sdf") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".sdf") returned 0x0 [0088.316] lstrlenW (lpString=".MDF") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".MDF") returned 0x0 [0088.316] lstrlenW (lpString=".DBF") returned 4 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".DBF") returned 0x0 [0088.316] lstrlenW (lpString=".DB") returned 3 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".DB") returned 0x0 [0088.316] lstrlenW (lpString=".db") returned 3 [0088.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".db") returned 0x0 [0088.317] lstrlenW (lpString=".ndf") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".ndf") returned 0x0 [0088.317] lstrlenW (lpString=".NDF") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".NDF") returned 0x0 [0088.317] lstrlenW (lpString=".Mdf") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".Mdf") returned 0x0 [0088.317] lstrlenW (lpString=".dat") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".dat") returned 0x0 [0088.317] lstrlenW (lpString=".DAT") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".DAT") returned 0x0 [0088.317] lstrlenW (lpString=".ldf") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0088.317] lstrlenW (lpString=".LDF") returned 4 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch=".LDF") returned 0x0 [0088.317] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.317] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.318] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.318] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.318] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20831936896) returned 1 [0088.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3747370, dwHighDateTime=0x1d585b4)) [0088.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e010 [0088.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e010 | out: hHeap=0x260000) returned 1 [0088.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.319] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.319] GetLastError () returned 0x0 [0088.319] GetLastError () returned 0x0 [0088.319] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.319] GetLastError () returned 0x0 [0088.320] GetLastError () returned 0x0 [0088.321] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff9ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.321] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x612, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x612, lpOverlapped=0x0) returned 1 [0088.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.321] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.321] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.322] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.322] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.322] CloseHandle (hObject=0xe4) returned 1 [0088.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0088.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.323] GetLastError () returned 0x0 [0088.323] RtlWakeConditionVariable () returned 0x0 [0088.323] GetCurrentThreadId () returned 0x99c [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".ldf") returned 0x0 [0088.324] lstrlenW (lpString=".vhd") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".vhd") returned 0x0 [0088.324] lstrlenW (lpString=".vhdx") returned 5 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".vhdx") returned 0x0 [0088.324] lstrlenW (lpString=".pst") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".pst") returned 0x0 [0088.324] lstrlenW (lpString=".ost") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".ost") returned 0x0 [0088.324] lstrlenW (lpString=".bak") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".bak") returned 0x0 [0088.324] lstrlenW (lpString=".bac") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".bac") returned 0x0 [0088.324] lstrlenW (lpString=".sys") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".sys") returned 0x0 [0088.324] lstrlenW (lpString=".v2i") returned 4 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".v2i") returned 0x0 [0088.324] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.326] lstrlenW (lpString=".sql") returned 4 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".sql") returned 0x0 [0088.326] lstrlenW (lpString=".mdf") returned 4 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".mdf") returned 0x0 [0088.326] lstrlenW (lpString=".txt") returned 4 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".txt") returned 0x0 [0088.326] lstrlenW (lpString=".dbf") returned 4 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".dbf") returned 0x0 [0088.326] lstrlenW (lpString=".ckp") returned 4 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".ckp") returned 0x0 [0088.326] lstrlenW (lpString=".dacpac") returned 7 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".dacpac") returned 0x0 [0088.326] lstrlenW (lpString=".db3") returned 4 [0088.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".db3") returned 0x0 [0088.326] lstrlenW (lpString=".dtxs") returned 5 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".dtxs") returned 0x0 [0088.327] lstrlenW (lpString=".mdt") returned 4 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".mdt") returned 0x0 [0088.327] lstrlenW (lpString=".sdf") returned 4 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".sdf") returned 0x0 [0088.327] lstrlenW (lpString=".MDF") returned 4 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".MDF") returned 0x0 [0088.327] lstrlenW (lpString=".DBF") returned 4 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".DBF") returned 0x0 [0088.327] lstrlenW (lpString=".DB") returned 3 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".DB") returned 0x0 [0088.327] lstrlenW (lpString=".db") returned 3 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".db") returned 0x0 [0088.327] lstrlenW (lpString=".ndf") returned 4 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".ndf") returned 0x0 [0088.327] lstrlenW (lpString=".NDF") returned 4 [0088.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".NDF") returned 0x0 [0088.327] lstrlenW (lpString=".Mdf") returned 4 [0088.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".Mdf") returned 0x0 [0088.328] lstrlenW (lpString=".dat") returned 4 [0088.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".dat") returned 0x0 [0088.328] lstrlenW (lpString=".DAT") returned 4 [0088.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".DAT") returned 0x0 [0088.328] lstrlenW (lpString=".ldf") returned 4 [0088.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".ldf") returned 0x0 [0088.328] lstrlenW (lpString=".LDF") returned 4 [0088.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch=".LDF") returned 0x0 [0088.328] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.328] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.329] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.329] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.329] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20833014809) returned 1 [0088.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc376d4d0, dwHighDateTime=0x1d585b4)) [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e048 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e048 | out: hHeap=0x260000) returned 1 [0088.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.330] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.330] GetLastError () returned 0x0 [0088.330] GetLastError () returned 0x0 [0088.330] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.330] GetLastError () returned 0x0 [0088.330] GetLastError () returned 0x0 [0088.332] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc5f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.332] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3a1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x3a1, lpOverlapped=0x0) returned 1 [0088.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.332] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.332] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.332] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.332] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.333] CloseHandle (hObject=0xe4) returned 1 [0088.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css.[deadmin@cock.li].deadmin")) returned 1 [0088.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.334] GetLastError () returned 0x0 [0088.334] RtlWakeConditionVariable () returned 0x0 [0088.334] GetCurrentThreadId () returned 0x99c [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.335] lstrlenW (lpString=".vhd") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0088.335] lstrlenW (lpString=".vhdx") returned 5 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0088.335] lstrlenW (lpString=".pst") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0088.335] lstrlenW (lpString=".ost") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0088.335] lstrlenW (lpString=".bak") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0088.335] lstrlenW (lpString=".bac") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0088.335] lstrlenW (lpString=".sys") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0088.335] lstrlenW (lpString=".v2i") returned 4 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0088.335] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.336] lstrlenW (lpString=".sql") returned 4 [0088.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0088.336] lstrlenW (lpString=".mdf") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0088.337] lstrlenW (lpString=".txt") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0088.337] lstrlenW (lpString=".dbf") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0088.337] lstrlenW (lpString=".ckp") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0088.337] lstrlenW (lpString=".dacpac") returned 7 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0088.337] lstrlenW (lpString=".db3") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0088.337] lstrlenW (lpString=".dtxs") returned 5 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0088.337] lstrlenW (lpString=".mdt") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0088.337] lstrlenW (lpString=".sdf") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0088.337] lstrlenW (lpString=".MDF") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0088.337] lstrlenW (lpString=".DBF") returned 4 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0088.337] lstrlenW (lpString=".DB") returned 3 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0088.337] lstrlenW (lpString=".db") returned 3 [0088.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0088.338] lstrlenW (lpString=".ndf") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0088.338] lstrlenW (lpString=".NDF") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0088.338] lstrlenW (lpString=".Mdf") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0088.338] lstrlenW (lpString=".dat") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0088.338] lstrlenW (lpString=".DAT") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0088.338] lstrlenW (lpString=".ldf") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.338] lstrlenW (lpString=".LDF") returned 4 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0088.338] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.338] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.339] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.339] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20834246780) returned 1 [0088.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc376d4d0, dwHighDateTime=0x1d585b4)) [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e080 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e080 | out: hHeap=0x260000) returned 1 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.342] GetLastError () returned 0x0 [0088.343] GetLastError () returned 0x0 [0088.343] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.343] GetLastError () returned 0x0 [0088.531] GetLastError () returned 0x0 [0088.532] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.532] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x155, lpOverlapped=0x0) returned 1 [0088.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.532] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.532] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.532] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.532] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.532] CloseHandle (hObject=0xe4) returned 1 [0088.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0088.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.534] GetLastError () returned 0x0 [0088.534] RtlWakeConditionVariable () returned 0x0 [0088.534] GetCurrentThreadId () returned 0x99c [0088.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.534] lstrlenW (lpString=".vhd") returned 4 [0088.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0088.534] lstrlenW (lpString=".vhdx") returned 5 [0088.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0088.534] lstrlenW (lpString=".pst") returned 4 [0088.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0088.535] lstrlenW (lpString=".ost") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0088.535] lstrlenW (lpString=".bak") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0088.535] lstrlenW (lpString=".bac") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0088.535] lstrlenW (lpString=".sys") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0088.535] lstrlenW (lpString=".v2i") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0088.535] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0088.822] lstrlenW (lpString=".sql") returned 4 [0088.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0088.834] lstrlenW (lpString=".mdf") returned 4 [0088.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0088.840] lstrlenW (lpString=".txt") returned 4 [0088.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0088.843] lstrlenW (lpString=".dbf") returned 4 [0088.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0088.846] lstrlenW (lpString=".ckp") returned 4 [0088.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0088.852] lstrlenW (lpString=".dacpac") returned 7 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0088.854] lstrlenW (lpString=".db3") returned 4 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0088.854] lstrlenW (lpString=".dtxs") returned 5 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0088.854] lstrlenW (lpString=".mdt") returned 4 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0088.854] lstrlenW (lpString=".sdf") returned 4 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0088.854] lstrlenW (lpString=".MDF") returned 4 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0088.854] lstrlenW (lpString=".DBF") returned 4 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0088.854] lstrlenW (lpString=".DB") returned 3 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0088.854] lstrlenW (lpString=".db") returned 3 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".db") returned 0x0 [0088.854] lstrlenW (lpString=".ndf") returned 4 [0088.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0088.854] lstrlenW (lpString=".NDF") returned 4 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0088.855] lstrlenW (lpString=".Mdf") returned 4 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0088.855] lstrlenW (lpString=".dat") returned 4 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0088.855] lstrlenW (lpString=".DAT") returned 4 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0088.855] lstrlenW (lpString=".ldf") returned 4 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.855] lstrlenW (lpString=".LDF") returned 4 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0088.855] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.855] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.856] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.856] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.856] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20885721867) returned 1 [0088.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3c56230, dwHighDateTime=0x1d585b4)) [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f1c0 [0088.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f1c0 | out: hHeap=0x260000) returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.857] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.857] GetLastError () returned 0x0 [0088.857] GetLastError () returned 0x0 [0088.857] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.858] GetLastError () returned 0x0 [0088.858] GetLastError () returned 0x0 [0088.860] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffe91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.860] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x16f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x16f, lpOverlapped=0x0) returned 1 [0088.938] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.938] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.938] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.938] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.938] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.939] CloseHandle (hObject=0xd8) returned 1 [0088.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0088.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0088.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.941] GetLastError () returned 0x0 [0088.942] RtlWakeConditionVariable () returned 0x0 [0088.942] GetCurrentThreadId () returned 0x99c [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.942] lstrlenW (lpString=".vhd") returned 4 [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0088.942] lstrlenW (lpString=".vhdx") returned 5 [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0088.942] lstrlenW (lpString=".pst") returned 4 [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0088.942] lstrlenW (lpString=".ost") returned 4 [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0088.942] lstrlenW (lpString=".bak") returned 4 [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0088.942] lstrlenW (lpString=".bac") returned 4 [0088.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0088.942] lstrlenW (lpString=".sys") returned 4 [0088.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0088.943] lstrlenW (lpString=".v2i") returned 4 [0088.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0088.943] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0088.944] lstrlenW (lpString=".sql") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0088.945] lstrlenW (lpString=".mdf") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0088.945] lstrlenW (lpString=".txt") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0088.945] lstrlenW (lpString=".dbf") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0088.945] lstrlenW (lpString=".ckp") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0088.945] lstrlenW (lpString=".dacpac") returned 7 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0088.945] lstrlenW (lpString=".db3") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0088.945] lstrlenW (lpString=".dtxs") returned 5 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0088.945] lstrlenW (lpString=".mdt") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0088.945] lstrlenW (lpString=".sdf") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0088.945] lstrlenW (lpString=".MDF") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0088.945] lstrlenW (lpString=".DBF") returned 4 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0088.945] lstrlenW (lpString=".DB") returned 3 [0088.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0088.946] lstrlenW (lpString=".db") returned 3 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0088.946] lstrlenW (lpString=".ndf") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0088.946] lstrlenW (lpString=".NDF") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0088.946] lstrlenW (lpString=".Mdf") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0088.946] lstrlenW (lpString=".dat") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0088.946] lstrlenW (lpString=".DAT") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0088.946] lstrlenW (lpString=".ldf") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.946] lstrlenW (lpString=".LDF") returned 4 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0088.946] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.946] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0088.947] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.947] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.947] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20894843631) returned 1 [0088.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3d3aa70, dwHighDateTime=0x1d585b4)) [0088.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f230 [0088.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f230 | out: hHeap=0x260000) returned 1 [0088.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.948] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0088.948] GetLastError () returned 0x0 [0088.948] GetLastError () returned 0x0 [0088.949] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0088.949] GetLastError () returned 0x0 [0088.949] GetLastError () returned 0x0 [0088.950] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.950] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xde, lpOverlapped=0x0) returned 1 [0088.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.950] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.950] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.950] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.950] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.951] CloseHandle (hObject=0xd8) returned 1 [0088.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0088.951] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0089.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.019] GetLastError () returned 0x0 [0089.020] RtlWakeConditionVariable () returned 0x27e828 [0089.020] GetCurrentThreadId () returned 0x99c [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.020] lstrlenW (lpString=".vhd") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0089.020] lstrlenW (lpString=".vhdx") returned 5 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0089.020] lstrlenW (lpString=".pst") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0089.020] lstrlenW (lpString=".ost") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0089.020] lstrlenW (lpString=".bak") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0089.020] lstrlenW (lpString=".bac") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0089.020] lstrlenW (lpString=".sys") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0089.020] lstrlenW (lpString=".v2i") returned 4 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0089.020] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.173] lstrlenW (lpString=".sql") returned 4 [0089.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0089.173] lstrlenW (lpString=".mdf") returned 4 [0089.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0089.194] lstrlenW (lpString=".txt") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0089.194] lstrlenW (lpString=".dbf") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0089.194] lstrlenW (lpString=".ckp") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0089.194] lstrlenW (lpString=".dacpac") returned 7 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0089.194] lstrlenW (lpString=".db3") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0089.194] lstrlenW (lpString=".dtxs") returned 5 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0089.194] lstrlenW (lpString=".mdt") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0089.194] lstrlenW (lpString=".sdf") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0089.194] lstrlenW (lpString=".MDF") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0089.194] lstrlenW (lpString=".DBF") returned 4 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0089.194] lstrlenW (lpString=".DB") returned 3 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0089.194] lstrlenW (lpString=".db") returned 3 [0089.194] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0089.195] lstrlenW (lpString=".ndf") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0089.195] lstrlenW (lpString=".NDF") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0089.195] lstrlenW (lpString=".Mdf") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0089.195] lstrlenW (lpString=".dat") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0089.195] lstrlenW (lpString=".DAT") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0089.195] lstrlenW (lpString=".ldf") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.195] lstrlenW (lpString=".LDF") returned 4 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0089.195] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.195] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0089.196] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.196] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.196] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20919734815) returned 1 [0089.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc3f9c070, dwHighDateTime=0x1d585b4)) [0089.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1c80 [0089.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1c80 | out: hHeap=0x260000) returned 1 [0089.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.197] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0089.197] GetLastError () returned 0x0 [0089.197] GetLastError () returned 0x0 [0089.197] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0089.197] GetLastError () returned 0x0 [0089.198] GetLastError () returned 0x0 [0089.200] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffef5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.200] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x10b, lpOverlapped=0x0) returned 1 [0089.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0089.200] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.200] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.201] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.201] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.201] CloseHandle (hObject=0xe4) returned 1 [0089.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.237] GetLastError () returned 0x0 [0089.237] RtlWakeConditionVariable () returned 0x0 [0089.237] GetCurrentThreadId () returned 0x99c [0089.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".ldf") returned 0x0 [0089.237] lstrlenW (lpString=".vhd") returned 4 [0089.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".vhd") returned 0x0 [0089.238] lstrlenW (lpString=".vhdx") returned 5 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".vhdx") returned 0x0 [0089.238] lstrlenW (lpString=".pst") returned 4 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".pst") returned 0x0 [0089.238] lstrlenW (lpString=".ost") returned 4 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".ost") returned 0x0 [0089.238] lstrlenW (lpString=".bak") returned 4 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".bak") returned 0x0 [0089.238] lstrlenW (lpString=".bac") returned 4 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".bac") returned 0x0 [0089.238] lstrlenW (lpString=".sys") returned 4 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".sys") returned 0x0 [0089.238] lstrlenW (lpString=".v2i") returned 4 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".v2i") returned 0x0 [0089.238] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.239] lstrlenW (lpString=".sql") returned 4 [0089.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".sql") returned 0x0 [0089.239] lstrlenW (lpString=".mdf") returned 4 [0089.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".mdf") returned 0x0 [0089.239] lstrlenW (lpString=".txt") returned 4 [0089.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".txt") returned 0x0 [0089.239] lstrlenW (lpString=".dbf") returned 4 [0089.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".dbf") returned 0x0 [0089.239] lstrlenW (lpString=".ckp") returned 4 [0089.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".ckp") returned 0x0 [0089.239] lstrlenW (lpString=".dacpac") returned 7 [0089.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".dacpac") returned 0x0 [0089.239] lstrlenW (lpString=".db3") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".db3") returned 0x0 [0089.240] lstrlenW (lpString=".dtxs") returned 5 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".dtxs") returned 0x0 [0089.240] lstrlenW (lpString=".mdt") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".mdt") returned 0x0 [0089.240] lstrlenW (lpString=".sdf") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".sdf") returned 0x0 [0089.240] lstrlenW (lpString=".MDF") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".MDF") returned 0x0 [0089.240] lstrlenW (lpString=".DBF") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".DBF") returned 0x0 [0089.240] lstrlenW (lpString=".DB") returned 3 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".DB") returned 0x0 [0089.240] lstrlenW (lpString=".db") returned 3 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".db") returned 0x0 [0089.240] lstrlenW (lpString=".ndf") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".ndf") returned 0x0 [0089.240] lstrlenW (lpString=".NDF") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".NDF") returned 0x0 [0089.240] lstrlenW (lpString=".Mdf") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".Mdf") returned 0x0 [0089.240] lstrlenW (lpString=".dat") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".dat") returned 0x0 [0089.240] lstrlenW (lpString=".DAT") returned 4 [0089.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".DAT") returned 0x0 [0089.240] lstrlenW (lpString=".ldf") returned 4 [0089.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".ldf") returned 0x0 [0089.241] lstrlenW (lpString=".LDF") returned 4 [0089.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch=".LDF") returned 0x0 [0089.241] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.241] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0089.242] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.242] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0089.242] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20924290784) returned 1 [0089.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc400e490, dwHighDateTime=0x1d585b4)) [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x290f0a8 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290f0a8 | out: hHeap=0x260000) returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.242] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0089.243] GetLastError () returned 0x0 [0089.243] GetLastError () returned 0x0 [0089.243] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0089.243] GetLastError () returned 0x0 [0089.243] GetLastError () returned 0x0 [0089.328] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff2bf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.328] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd41, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xd41, lpOverlapped=0x0) returned 1 [0089.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.328] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.329] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.329] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.329] CloseHandle (hObject=0xe4) returned 1 [0089.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css.[deadmin@cock.li].deadmin")) returned 1 [0089.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0089.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0089.330] GetLastError () returned 0x0 [0089.330] RtlWakeConditionVariable () returned 0x0 [0089.330] GetCurrentThreadId () returned 0x99c [0089.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.331] lstrlenW (lpString=".vhd") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0089.331] lstrlenW (lpString=".vhdx") returned 5 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0089.331] lstrlenW (lpString=".pst") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0089.331] lstrlenW (lpString=".ost") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0089.331] lstrlenW (lpString=".bak") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0089.331] lstrlenW (lpString=".bac") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0089.331] lstrlenW (lpString=".sys") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0089.331] lstrlenW (lpString=".v2i") returned 4 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0089.331] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0089.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.352] lstrlenW (lpString=".sql") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0089.352] lstrlenW (lpString=".mdf") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0089.352] lstrlenW (lpString=".txt") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0089.352] lstrlenW (lpString=".dbf") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0089.352] lstrlenW (lpString=".ckp") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0089.352] lstrlenW (lpString=".dacpac") returned 7 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0089.352] lstrlenW (lpString=".db3") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0089.352] lstrlenW (lpString=".dtxs") returned 5 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0089.352] lstrlenW (lpString=".mdt") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0089.352] lstrlenW (lpString=".sdf") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0089.352] lstrlenW (lpString=".MDF") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0089.352] lstrlenW (lpString=".DBF") returned 4 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0089.352] lstrlenW (lpString=".DB") returned 3 [0089.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0089.353] lstrlenW (lpString=".db") returned 3 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0089.353] lstrlenW (lpString=".ndf") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0089.353] lstrlenW (lpString=".NDF") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0089.353] lstrlenW (lpString=".Mdf") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0089.353] lstrlenW (lpString=".dat") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0089.353] lstrlenW (lpString=".DAT") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0089.353] lstrlenW (lpString=".ldf") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0089.353] lstrlenW (lpString=".LDF") returned 4 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0089.353] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0089.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.353] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0089.354] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.354] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0089.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0089.354] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20935538787) returned 1 [0089.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc418b250, dwHighDateTime=0x1d585b4)) [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bf0 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0089.397] GetLastError () returned 0x0 [0089.397] GetLastError () returned 0x0 [0089.398] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0089.398] GetLastError () returned 0x0 [0089.398] GetLastError () returned 0x0 [0089.400] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.400] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xde, lpOverlapped=0x0) returned 1 [0089.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.400] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.400] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.401] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.401] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.401] CloseHandle (hObject=0x11c) returned 1 [0089.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922920 [0089.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922920 | out: hHeap=0x260000) returned 1 [0089.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0089.403] GetLastError () returned 0x0 [0089.403] RtlWakeConditionVariable () returned 0x0 [0089.403] GetCurrentThreadId () returned 0x99c [0089.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0089.403] lstrlenW (lpString=".vhd") returned 4 [0089.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".vhd") returned 0x0 [0089.403] lstrlenW (lpString=".vhdx") returned 5 [0089.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".vhdx") returned 0x0 [0089.403] lstrlenW (lpString=".pst") returned 4 [0089.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".pst") returned 0x0 [0089.403] lstrlenW (lpString=".ost") returned 4 [0089.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".ost") returned 0x0 [0089.403] lstrlenW (lpString=".bak") returned 4 [0089.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".bak") returned 0x0 [0089.403] lstrlenW (lpString=".bac") returned 4 [0089.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".bac") returned 0x0 [0089.404] lstrlenW (lpString=".sys") returned 4 [0089.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".sys") returned 0x0 [0089.404] lstrlenW (lpString=".v2i") returned 4 [0089.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".v2i") returned 0x0 [0089.404] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.513] lstrlenW (lpString=".sql") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".sql") returned 0x0 [0089.524] lstrlenW (lpString=".mdf") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".mdf") returned 0x0 [0089.524] lstrlenW (lpString=".txt") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".txt") returned 0x0 [0089.524] lstrlenW (lpString=".dbf") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".dbf") returned 0x0 [0089.524] lstrlenW (lpString=".ckp") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".ckp") returned 0x0 [0089.524] lstrlenW (lpString=".dacpac") returned 7 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".dacpac") returned 0x0 [0089.524] lstrlenW (lpString=".db3") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".db3") returned 0x0 [0089.524] lstrlenW (lpString=".dtxs") returned 5 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".dtxs") returned 0x0 [0089.524] lstrlenW (lpString=".mdt") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".mdt") returned 0x0 [0089.524] lstrlenW (lpString=".sdf") returned 4 [0089.524] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".sdf") returned 0x0 [0089.524] lstrlenW (lpString=".MDF") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".MDF") returned 0x0 [0089.525] lstrlenW (lpString=".DBF") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".DBF") returned 0x0 [0089.525] lstrlenW (lpString=".DB") returned 3 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".DB") returned 0x0 [0089.525] lstrlenW (lpString=".db") returned 3 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".db") returned 0x0 [0089.525] lstrlenW (lpString=".ndf") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".ndf") returned 0x0 [0089.525] lstrlenW (lpString=".NDF") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".NDF") returned 0x0 [0089.525] lstrlenW (lpString=".Mdf") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".Mdf") returned 0x0 [0089.525] lstrlenW (lpString=".dat") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".dat") returned 0x0 [0089.525] lstrlenW (lpString=".DAT") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".DAT") returned 0x0 [0089.525] lstrlenW (lpString=".ldf") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".ldf") returned 0x0 [0089.525] lstrlenW (lpString=".LDF") returned 4 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch=".LDF") returned 0x0 [0089.525] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.526] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0089.526] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.526] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0089.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0089.527] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20952765144) returned 1 [0089.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc42bbd50, dwHighDateTime=0x1d585b4)) [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763fe0 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763fe0 | out: hHeap=0x260000) returned 1 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.527] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0089.527] GetLastError () returned 0x0 [0089.528] GetLastError () returned 0x0 [0089.528] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0089.528] GetLastError () returned 0x0 [0089.528] GetLastError () returned 0x0 [0089.530] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.530] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x108, lpOverlapped=0x0) returned 1 [0089.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.530] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.530] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.530] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.531] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.531] CloseHandle (hObject=0x11c) returned 1 [0089.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0089.533] GetLastError () returned 0x0 [0089.533] RtlWakeConditionVariable () returned 0x0 [0089.534] GetCurrentThreadId () returned 0x99c [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0089.534] lstrlenW (lpString=".vhd") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0089.534] lstrlenW (lpString=".vhdx") returned 5 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0089.534] lstrlenW (lpString=".pst") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".pst") returned 0x0 [0089.534] lstrlenW (lpString=".ost") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ost") returned 0x0 [0089.534] lstrlenW (lpString=".bak") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bak") returned 0x0 [0089.534] lstrlenW (lpString=".bac") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".bac") returned 0x0 [0089.534] lstrlenW (lpString=".sys") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sys") returned 0x0 [0089.534] lstrlenW (lpString=".v2i") returned 4 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0089.534] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0089.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0089.536] lstrlenW (lpString=".sql") returned 4 [0089.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sql") returned 0x0 [0089.536] lstrlenW (lpString=".mdf") returned 4 [0089.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0089.536] lstrlenW (lpString=".txt") returned 4 [0089.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".txt") returned 0x0 [0089.536] lstrlenW (lpString=".dbf") returned 4 [0089.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0089.537] lstrlenW (lpString=".ckp") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0089.537] lstrlenW (lpString=".dacpac") returned 7 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0089.537] lstrlenW (lpString=".db3") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db3") returned 0x0 [0089.537] lstrlenW (lpString=".dtxs") returned 5 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0089.537] lstrlenW (lpString=".mdt") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0089.537] lstrlenW (lpString=".sdf") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0089.537] lstrlenW (lpString=".MDF") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0089.537] lstrlenW (lpString=".DBF") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0089.537] lstrlenW (lpString=".DB") returned 3 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DB") returned 0x0 [0089.537] lstrlenW (lpString=".db") returned 3 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".db") returned 0x0 [0089.537] lstrlenW (lpString=".ndf") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0089.537] lstrlenW (lpString=".NDF") returned 4 [0089.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0089.537] lstrlenW (lpString=".Mdf") returned 4 [0089.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0089.538] lstrlenW (lpString=".dat") returned 4 [0089.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".dat") returned 0x0 [0089.538] lstrlenW (lpString=".DAT") returned 4 [0089.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0089.538] lstrlenW (lpString=".ldf") returned 4 [0089.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0089.538] lstrlenW (lpString=".LDF") returned 4 [0089.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0089.538] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.538] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0089.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.539] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0089.539] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20954013548) returned 1 [0089.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc42e1eb0, dwHighDateTime=0x1d585b4)) [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763fa8 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763fa8 | out: hHeap=0x260000) returned 1 [0089.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0089.540] GetLastError () returned 0x0 [0089.540] GetLastError () returned 0x0 [0089.540] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0089.540] GetLastError () returned 0x0 [0089.540] GetLastError () returned 0x0 [0089.621] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff9c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.621] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x638, lpOverlapped=0x0) returned 1 [0089.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.621] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.621] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.621] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.621] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.622] CloseHandle (hObject=0x11c) returned 1 [0089.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0089.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0089.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0089.701] GetLastError () returned 0x0 [0089.701] RtlWakeConditionVariable () returned 0x0 [0089.701] GetCurrentThreadId () returned 0x99c [0089.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".ldf") returned 0x0 [0089.701] lstrlenW (lpString=".vhd") returned 4 [0089.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".vhd") returned 0x0 [0089.701] lstrlenW (lpString=".vhdx") returned 5 [0089.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".vhdx") returned 0x0 [0089.701] lstrlenW (lpString=".pst") returned 4 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".pst") returned 0x0 [0089.702] lstrlenW (lpString=".ost") returned 4 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".ost") returned 0x0 [0089.702] lstrlenW (lpString=".bak") returned 4 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".bak") returned 0x0 [0089.702] lstrlenW (lpString=".bac") returned 4 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".bac") returned 0x0 [0089.702] lstrlenW (lpString=".sys") returned 4 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".sys") returned 0x0 [0089.702] lstrlenW (lpString=".v2i") returned 4 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".v2i") returned 0x0 [0089.702] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.709] lstrlenW (lpString=".sql") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".sql") returned 0x0 [0089.709] lstrlenW (lpString=".mdf") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".mdf") returned 0x0 [0089.709] lstrlenW (lpString=".txt") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".txt") returned 0x0 [0089.709] lstrlenW (lpString=".dbf") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".dbf") returned 0x0 [0089.709] lstrlenW (lpString=".ckp") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".ckp") returned 0x0 [0089.709] lstrlenW (lpString=".dacpac") returned 7 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".dacpac") returned 0x0 [0089.709] lstrlenW (lpString=".db3") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".db3") returned 0x0 [0089.709] lstrlenW (lpString=".dtxs") returned 5 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".dtxs") returned 0x0 [0089.709] lstrlenW (lpString=".mdt") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".mdt") returned 0x0 [0089.709] lstrlenW (lpString=".sdf") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".sdf") returned 0x0 [0089.709] lstrlenW (lpString=".MDF") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".MDF") returned 0x0 [0089.709] lstrlenW (lpString=".DBF") returned 4 [0089.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".DBF") returned 0x0 [0089.709] lstrlenW (lpString=".DB") returned 3 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".DB") returned 0x0 [0089.710] lstrlenW (lpString=".db") returned 3 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".db") returned 0x0 [0089.710] lstrlenW (lpString=".ndf") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".ndf") returned 0x0 [0089.710] lstrlenW (lpString=".NDF") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".NDF") returned 0x0 [0089.710] lstrlenW (lpString=".Mdf") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".Mdf") returned 0x0 [0089.710] lstrlenW (lpString=".dat") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".dat") returned 0x0 [0089.710] lstrlenW (lpString=".DAT") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".DAT") returned 0x0 [0089.710] lstrlenW (lpString=".ldf") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".ldf") returned 0x0 [0089.710] lstrlenW (lpString=".LDF") returned 4 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch=".LDF") returned 0x0 [0089.710] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0089.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.710] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0089.711] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.711] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0089.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0089.711] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=20971249764) returned 1 [0089.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4484dd0, dwHighDateTime=0x1d585b4)) [0089.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18a8 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.712] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0089.712] GetLastError () returned 0x0 [0089.712] GetLastError () returned 0x0 [0089.713] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0089.713] GetLastError () returned 0x0 [0089.713] GetLastError () returned 0x0 [0089.779] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.881] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3ee, lpOverlapped=0x0) returned 1 [0089.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.886] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.895] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.905] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.905] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.905] CloseHandle (hObject=0xe4) returned 1 [0089.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0089.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0090.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.001] GetLastError () returned 0x0 [0090.002] RtlWakeConditionVariable () returned 0x0 [0090.002] GetCurrentThreadId () returned 0x99c [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".ldf") returned 0x0 [0090.002] lstrlenW (lpString=".vhd") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".vhd") returned 0x0 [0090.002] lstrlenW (lpString=".vhdx") returned 5 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".vhdx") returned 0x0 [0090.002] lstrlenW (lpString=".pst") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".pst") returned 0x0 [0090.002] lstrlenW (lpString=".ost") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".ost") returned 0x0 [0090.002] lstrlenW (lpString=".bak") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".bak") returned 0x0 [0090.002] lstrlenW (lpString=".bac") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".bac") returned 0x0 [0090.002] lstrlenW (lpString=".sys") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".sys") returned 0x0 [0090.002] lstrlenW (lpString=".v2i") returned 4 [0090.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".v2i") returned 0x0 [0090.003] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.004] lstrlenW (lpString=".sql") returned 4 [0090.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".sql") returned 0x0 [0090.004] lstrlenW (lpString=".mdf") returned 4 [0090.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".mdf") returned 0x0 [0090.004] lstrlenW (lpString=".txt") returned 4 [0090.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".txt") returned 0x0 [0090.004] lstrlenW (lpString=".dbf") returned 4 [0090.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".dbf") returned 0x0 [0090.004] lstrlenW (lpString=".ckp") returned 4 [0090.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".ckp") returned 0x0 [0090.004] lstrlenW (lpString=".dacpac") returned 7 [0090.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".dacpac") returned 0x0 [0090.005] lstrlenW (lpString=".db3") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".db3") returned 0x0 [0090.005] lstrlenW (lpString=".dtxs") returned 5 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".dtxs") returned 0x0 [0090.005] lstrlenW (lpString=".mdt") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".mdt") returned 0x0 [0090.005] lstrlenW (lpString=".sdf") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".sdf") returned 0x0 [0090.005] lstrlenW (lpString=".MDF") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".MDF") returned 0x0 [0090.005] lstrlenW (lpString=".DBF") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".DBF") returned 0x0 [0090.005] lstrlenW (lpString=".DB") returned 3 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".DB") returned 0x0 [0090.005] lstrlenW (lpString=".db") returned 3 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".db") returned 0x0 [0090.005] lstrlenW (lpString=".ndf") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".ndf") returned 0x0 [0090.005] lstrlenW (lpString=".NDF") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".NDF") returned 0x0 [0090.005] lstrlenW (lpString=".Mdf") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".Mdf") returned 0x0 [0090.005] lstrlenW (lpString=".dat") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".dat") returned 0x0 [0090.005] lstrlenW (lpString=".DAT") returned 4 [0090.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".DAT") returned 0x0 [0090.006] lstrlenW (lpString=".ldf") returned 4 [0090.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".ldf") returned 0x0 [0090.006] lstrlenW (lpString=".LDF") returned 4 [0090.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch=".LDF") returned 0x0 [0090.006] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.006] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.007] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.007] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21000799189) returned 1 [0090.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc47587f0, dwHighDateTime=0x1d585b4)) [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4368 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4368 | out: hHeap=0x260000) returned 1 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.008] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.008] GetLastError () returned 0x0 [0090.008] GetLastError () returned 0x0 [0090.008] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.008] GetLastError () returned 0x0 [0090.008] GetLastError () returned 0x0 [0090.011] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.011] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x26d, lpOverlapped=0x0) returned 1 [0090.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.011] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.011] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.011] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.011] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.011] CloseHandle (hObject=0xd8) returned 1 [0090.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.014] GetLastError () returned 0x0 [0090.014] RtlWakeConditionVariable () returned 0x0 [0090.014] GetCurrentThreadId () returned 0x99c [0090.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0090.014] lstrlenW (lpString=".vhd") returned 4 [0090.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".vhd") returned 0x0 [0090.014] lstrlenW (lpString=".vhdx") returned 5 [0090.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".vhdx") returned 0x0 [0090.014] lstrlenW (lpString=".pst") returned 4 [0090.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".pst") returned 0x0 [0090.014] lstrlenW (lpString=".ost") returned 4 [0090.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".ost") returned 0x0 [0090.014] lstrlenW (lpString=".bak") returned 4 [0090.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".bak") returned 0x0 [0090.014] lstrlenW (lpString=".bac") returned 4 [0090.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".bac") returned 0x0 [0090.015] lstrlenW (lpString=".sys") returned 4 [0090.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".sys") returned 0x0 [0090.015] lstrlenW (lpString=".v2i") returned 4 [0090.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".v2i") returned 0x0 [0090.015] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch="s\r\n.v2i") returned 0x0 [0090.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.016] lstrlenW (lpString=".sql") returned 4 [0090.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".sql") returned 0x0 [0090.016] lstrlenW (lpString=".mdf") returned 4 [0090.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".mdf") returned 0x0 [0090.016] lstrlenW (lpString=".txt") returned 4 [0090.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".txt") returned 0x0 [0090.016] lstrlenW (lpString=".dbf") returned 4 [0090.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".dbf") returned 0x0 [0090.016] lstrlenW (lpString=".ckp") returned 4 [0090.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".ckp") returned 0x0 [0090.016] lstrlenW (lpString=".dacpac") returned 7 [0090.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".dacpac") returned 0x0 [0090.017] lstrlenW (lpString=".db3") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".db3") returned 0x0 [0090.017] lstrlenW (lpString=".dtxs") returned 5 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".dtxs") returned 0x0 [0090.017] lstrlenW (lpString=".mdt") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".mdt") returned 0x0 [0090.017] lstrlenW (lpString=".sdf") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".sdf") returned 0x0 [0090.017] lstrlenW (lpString=".MDF") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".MDF") returned 0x0 [0090.017] lstrlenW (lpString=".DBF") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".DBF") returned 0x0 [0090.017] lstrlenW (lpString=".DB") returned 3 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".DB") returned 0x0 [0090.017] lstrlenW (lpString=".db") returned 3 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".db") returned 0x0 [0090.017] lstrlenW (lpString=".ndf") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".ndf") returned 0x0 [0090.017] lstrlenW (lpString=".NDF") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".NDF") returned 0x0 [0090.017] lstrlenW (lpString=".Mdf") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".Mdf") returned 0x0 [0090.017] lstrlenW (lpString=".dat") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".dat") returned 0x0 [0090.017] lstrlenW (lpString=".DAT") returned 4 [0090.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".DAT") returned 0x0 [0090.018] lstrlenW (lpString=".ldf") returned 4 [0090.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".ldf") returned 0x0 [0090.018] lstrlenW (lpString=".LDF") returned 4 [0090.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch=".LDF") returned 0x0 [0090.018] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.018] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.019] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.019] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.019] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21001996032) returned 1 [0090.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc477e950, dwHighDateTime=0x1d585b4)) [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b43a0 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b43a0 | out: hHeap=0x260000) returned 1 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.020] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.020] GetLastError () returned 0x0 [0090.020] GetLastError () returned 0x0 [0090.020] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.020] GetLastError () returned 0x0 [0090.020] GetLastError () returned 0x0 [0090.106] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffed487, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.106] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x12b79, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x12b79, lpOverlapped=0x0) returned 1 [0090.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.107] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.107] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.107] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.107] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.107] CloseHandle (hObject=0xd8) returned 1 [0090.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js.[deadmin@cock.li].deadmin")) returned 1 [0090.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.108] GetLastError () returned 0x0 [0090.108] RtlWakeConditionVariable () returned 0x0 [0090.109] GetCurrentThreadId () returned 0x99c [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".ldf") returned 0x0 [0090.109] lstrlenW (lpString=".vhd") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".vhd") returned 0x0 [0090.109] lstrlenW (lpString=".vhdx") returned 5 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".vhdx") returned 0x0 [0090.109] lstrlenW (lpString=".pst") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".pst") returned 0x0 [0090.109] lstrlenW (lpString=".ost") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".ost") returned 0x0 [0090.109] lstrlenW (lpString=".bak") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".bak") returned 0x0 [0090.109] lstrlenW (lpString=".bac") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".bac") returned 0x0 [0090.109] lstrlenW (lpString=".sys") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".sys") returned 0x0 [0090.109] lstrlenW (lpString=".v2i") returned 4 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".v2i") returned 0x0 [0090.109] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.110] lstrlenW (lpString=".sql") returned 4 [0090.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".sql") returned 0x0 [0090.110] lstrlenW (lpString=".mdf") returned 4 [0090.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".mdf") returned 0x0 [0090.111] lstrlenW (lpString=".txt") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".txt") returned 0x0 [0090.111] lstrlenW (lpString=".dbf") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".dbf") returned 0x0 [0090.111] lstrlenW (lpString=".ckp") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".ckp") returned 0x0 [0090.111] lstrlenW (lpString=".dacpac") returned 7 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".dacpac") returned 0x0 [0090.111] lstrlenW (lpString=".db3") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".db3") returned 0x0 [0090.111] lstrlenW (lpString=".dtxs") returned 5 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".dtxs") returned 0x0 [0090.111] lstrlenW (lpString=".mdt") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".mdt") returned 0x0 [0090.111] lstrlenW (lpString=".sdf") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".sdf") returned 0x0 [0090.111] lstrlenW (lpString=".MDF") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".MDF") returned 0x0 [0090.111] lstrlenW (lpString=".DBF") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".DBF") returned 0x0 [0090.111] lstrlenW (lpString=".DB") returned 3 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".DB") returned 0x0 [0090.111] lstrlenW (lpString=".db") returned 3 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".db") returned 0x0 [0090.111] lstrlenW (lpString=".ndf") returned 4 [0090.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".ndf") returned 0x0 [0090.111] lstrlenW (lpString=".NDF") returned 4 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".NDF") returned 0x0 [0090.112] lstrlenW (lpString=".Mdf") returned 4 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".Mdf") returned 0x0 [0090.112] lstrlenW (lpString=".dat") returned 4 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".dat") returned 0x0 [0090.112] lstrlenW (lpString=".DAT") returned 4 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".DAT") returned 0x0 [0090.112] lstrlenW (lpString=".ldf") returned 4 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".ldf") returned 0x0 [0090.112] lstrlenW (lpString=".LDF") returned 4 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch=".LDF") returned 0x0 [0090.112] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.112] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.113] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.113] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.113] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21011416380) returned 1 [0090.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4863190, dwHighDateTime=0x1d585b4)) [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4608 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0090.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4608 | out: hHeap=0x260000) returned 1 [0090.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0090.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0090.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0090.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.114] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.114] GetLastError () returned 0x0 [0090.114] GetLastError () returned 0x0 [0090.114] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.114] GetLastError () returned 0x0 [0090.114] GetLastError () returned 0x0 [0090.116] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff9eb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.116] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x614e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x614e, lpOverlapped=0x0) returned 1 [0090.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.117] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.117] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.117] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.117] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.117] CloseHandle (hObject=0xd8) returned 1 [0090.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.119] GetLastError () returned 0x0 [0090.119] RtlWakeConditionVariable () returned 0x0 [0090.119] GetCurrentThreadId () returned 0x99c [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".ldf") returned 0x0 [0090.119] lstrlenW (lpString=".vhd") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".vhd") returned 0x0 [0090.119] lstrlenW (lpString=".vhdx") returned 5 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".vhdx") returned 0x0 [0090.119] lstrlenW (lpString=".pst") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".pst") returned 0x0 [0090.119] lstrlenW (lpString=".ost") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".ost") returned 0x0 [0090.119] lstrlenW (lpString=".bak") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".bak") returned 0x0 [0090.119] lstrlenW (lpString=".bac") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".bac") returned 0x0 [0090.119] lstrlenW (lpString=".sys") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".sys") returned 0x0 [0090.119] lstrlenW (lpString=".v2i") returned 4 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".v2i") returned 0x0 [0090.119] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.120] lstrlenW (lpString=".sql") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".sql") returned 0x0 [0090.121] lstrlenW (lpString=".mdf") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".mdf") returned 0x0 [0090.121] lstrlenW (lpString=".txt") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".txt") returned 0x0 [0090.121] lstrlenW (lpString=".dbf") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".dbf") returned 0x0 [0090.121] lstrlenW (lpString=".ckp") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".ckp") returned 0x0 [0090.121] lstrlenW (lpString=".dacpac") returned 7 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".dacpac") returned 0x0 [0090.121] lstrlenW (lpString=".db3") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".db3") returned 0x0 [0090.121] lstrlenW (lpString=".dtxs") returned 5 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".dtxs") returned 0x0 [0090.121] lstrlenW (lpString=".mdt") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".mdt") returned 0x0 [0090.121] lstrlenW (lpString=".sdf") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".sdf") returned 0x0 [0090.121] lstrlenW (lpString=".MDF") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".MDF") returned 0x0 [0090.121] lstrlenW (lpString=".DBF") returned 4 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".DBF") returned 0x0 [0090.121] lstrlenW (lpString=".DB") returned 3 [0090.121] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".DB") returned 0x0 [0090.122] lstrlenW (lpString=".db") returned 3 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".db") returned 0x0 [0090.122] lstrlenW (lpString=".ndf") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".ndf") returned 0x0 [0090.122] lstrlenW (lpString=".NDF") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".NDF") returned 0x0 [0090.122] lstrlenW (lpString=".Mdf") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".Mdf") returned 0x0 [0090.122] lstrlenW (lpString=".dat") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".dat") returned 0x0 [0090.122] lstrlenW (lpString=".DAT") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".DAT") returned 0x0 [0090.122] lstrlenW (lpString=".ldf") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".ldf") returned 0x0 [0090.122] lstrlenW (lpString=".LDF") returned 4 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch=".LDF") returned 0x0 [0090.122] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.122] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.122] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.123] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.123] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21012437607) returned 1 [0090.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc48892f0, dwHighDateTime=0x1d585b4)) [0090.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4640 [0090.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4640 | out: hHeap=0x260000) returned 1 [0090.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0090.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.124] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.124] GetLastError () returned 0x0 [0090.124] GetLastError () returned 0x0 [0090.124] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.124] GetLastError () returned 0x0 [0090.125] GetLastError () returned 0x0 [0090.152] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.152] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x161d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x161d, lpOverlapped=0x0) returned 1 [0090.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.152] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.152] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.152] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.153] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.153] CloseHandle (hObject=0xd8) returned 1 [0090.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.154] GetLastError () returned 0x0 [0090.154] RtlWakeConditionVariable () returned 0x27e828 [0090.154] GetCurrentThreadId () returned 0x99c [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".ldf") returned 0x0 [0090.155] lstrlenW (lpString=".vhd") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".vhd") returned 0x0 [0090.155] lstrlenW (lpString=".vhdx") returned 5 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".vhdx") returned 0x0 [0090.155] lstrlenW (lpString=".pst") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".pst") returned 0x0 [0090.155] lstrlenW (lpString=".ost") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".ost") returned 0x0 [0090.155] lstrlenW (lpString=".bak") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".bak") returned 0x0 [0090.155] lstrlenW (lpString=".bac") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".bac") returned 0x0 [0090.155] lstrlenW (lpString=".sys") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".sys") returned 0x0 [0090.155] lstrlenW (lpString=".v2i") returned 4 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".v2i") returned 0x0 [0090.155] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.155] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.156] lstrlenW (lpString=".sql") returned 4 [0090.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".sql") returned 0x0 [0090.156] lstrlenW (lpString=".mdf") returned 4 [0090.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".mdf") returned 0x0 [0090.156] lstrlenW (lpString=".txt") returned 4 [0090.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".txt") returned 0x0 [0090.156] lstrlenW (lpString=".dbf") returned 4 [0090.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".dbf") returned 0x0 [0090.157] lstrlenW (lpString=".ckp") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".ckp") returned 0x0 [0090.157] lstrlenW (lpString=".dacpac") returned 7 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".dacpac") returned 0x0 [0090.157] lstrlenW (lpString=".db3") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".db3") returned 0x0 [0090.157] lstrlenW (lpString=".dtxs") returned 5 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".dtxs") returned 0x0 [0090.157] lstrlenW (lpString=".mdt") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".mdt") returned 0x0 [0090.157] lstrlenW (lpString=".sdf") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".sdf") returned 0x0 [0090.157] lstrlenW (lpString=".MDF") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".MDF") returned 0x0 [0090.157] lstrlenW (lpString=".DBF") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".DBF") returned 0x0 [0090.157] lstrlenW (lpString=".DB") returned 3 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".DB") returned 0x0 [0090.157] lstrlenW (lpString=".db") returned 3 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".db") returned 0x0 [0090.157] lstrlenW (lpString=".ndf") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".ndf") returned 0x0 [0090.157] lstrlenW (lpString=".NDF") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".NDF") returned 0x0 [0090.157] lstrlenW (lpString=".Mdf") returned 4 [0090.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".Mdf") returned 0x0 [0090.158] lstrlenW (lpString=".dat") returned 4 [0090.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".dat") returned 0x0 [0090.158] lstrlenW (lpString=".DAT") returned 4 [0090.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".DAT") returned 0x0 [0090.158] lstrlenW (lpString=".ldf") returned 4 [0090.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".ldf") returned 0x0 [0090.158] lstrlenW (lpString=".LDF") returned 4 [0090.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch=".LDF") returned 0x0 [0090.158] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.158] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.159] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.159] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.159] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21016009684) returned 1 [0090.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc48d55b0, dwHighDateTime=0x1d585b4)) [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b46e8 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b46e8 | out: hHeap=0x260000) returned 1 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.160] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.160] GetLastError () returned 0x0 [0090.160] GetLastError () returned 0x0 [0090.160] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.160] GetLastError () returned 0x0 [0090.160] GetLastError () returned 0x0 [0090.183] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe9843, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.183] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x167bd, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x167bd, lpOverlapped=0x0) returned 1 [0090.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.183] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.183] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.183] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.183] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.183] CloseHandle (hObject=0xd8) returned 1 [0090.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.185] GetLastError () returned 0x0 [0090.185] RtlWakeConditionVariable () returned 0x27e828 [0090.185] GetCurrentThreadId () returned 0x99c [0090.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".ldf") returned 0x0 [0090.185] lstrlenW (lpString=".vhd") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".vhd") returned 0x0 [0090.186] lstrlenW (lpString=".vhdx") returned 5 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".vhdx") returned 0x0 [0090.186] lstrlenW (lpString=".pst") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".pst") returned 0x0 [0090.186] lstrlenW (lpString=".ost") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".ost") returned 0x0 [0090.186] lstrlenW (lpString=".bak") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".bak") returned 0x0 [0090.186] lstrlenW (lpString=".bac") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".bac") returned 0x0 [0090.186] lstrlenW (lpString=".sys") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".sys") returned 0x0 [0090.186] lstrlenW (lpString=".v2i") returned 4 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".v2i") returned 0x0 [0090.186] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.187] lstrlenW (lpString=".sql") returned 4 [0090.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".sql") returned 0x0 [0090.187] lstrlenW (lpString=".mdf") returned 4 [0090.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".mdf") returned 0x0 [0090.187] lstrlenW (lpString=".txt") returned 4 [0090.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".txt") returned 0x0 [0090.187] lstrlenW (lpString=".dbf") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".dbf") returned 0x0 [0090.188] lstrlenW (lpString=".ckp") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".ckp") returned 0x0 [0090.188] lstrlenW (lpString=".dacpac") returned 7 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".dacpac") returned 0x0 [0090.188] lstrlenW (lpString=".db3") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".db3") returned 0x0 [0090.188] lstrlenW (lpString=".dtxs") returned 5 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".dtxs") returned 0x0 [0090.188] lstrlenW (lpString=".mdt") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".mdt") returned 0x0 [0090.188] lstrlenW (lpString=".sdf") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".sdf") returned 0x0 [0090.188] lstrlenW (lpString=".MDF") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".MDF") returned 0x0 [0090.188] lstrlenW (lpString=".DBF") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".DBF") returned 0x0 [0090.188] lstrlenW (lpString=".DB") returned 3 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".DB") returned 0x0 [0090.188] lstrlenW (lpString=".db") returned 3 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".db") returned 0x0 [0090.188] lstrlenW (lpString=".ndf") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".ndf") returned 0x0 [0090.188] lstrlenW (lpString=".NDF") returned 4 [0090.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".NDF") returned 0x0 [0090.188] lstrlenW (lpString=".Mdf") returned 4 [0090.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".Mdf") returned 0x0 [0090.189] lstrlenW (lpString=".dat") returned 4 [0090.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".dat") returned 0x0 [0090.189] lstrlenW (lpString=".DAT") returned 4 [0090.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".DAT") returned 0x0 [0090.189] lstrlenW (lpString=".ldf") returned 4 [0090.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".ldf") returned 0x0 [0090.189] lstrlenW (lpString=".LDF") returned 4 [0090.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch=".LDF") returned 0x0 [0090.189] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.189] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.190] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.190] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.190] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21019117811) returned 1 [0090.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4921870, dwHighDateTime=0x1d585b4)) [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4790 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4790 | out: hHeap=0x260000) returned 1 [0090.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.191] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.191] GetLastError () returned 0x0 [0090.191] GetLastError () returned 0x0 [0090.191] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.191] GetLastError () returned 0x0 [0090.191] GetLastError () returned 0x0 [0090.280] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffa970, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.356] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x5690, lpOverlapped=0x0) returned 1 [0090.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.356] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.356] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.357] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.357] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.357] CloseHandle (hObject=0xd8) returned 1 [0090.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.359] GetLastError () returned 0x0 [0090.359] RtlWakeConditionVariable () returned 0x0 [0090.359] GetCurrentThreadId () returned 0x99c [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".ldf") returned 0x0 [0090.359] lstrlenW (lpString=".vhd") returned 4 [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".vhd") returned 0x0 [0090.359] lstrlenW (lpString=".vhdx") returned 5 [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".vhdx") returned 0x0 [0090.359] lstrlenW (lpString=".pst") returned 4 [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".pst") returned 0x0 [0090.359] lstrlenW (lpString=".ost") returned 4 [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".ost") returned 0x0 [0090.359] lstrlenW (lpString=".bak") returned 4 [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".bak") returned 0x0 [0090.359] lstrlenW (lpString=".bac") returned 4 [0090.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".bac") returned 0x0 [0090.359] lstrlenW (lpString=".sys") returned 4 [0090.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".sys") returned 0x0 [0090.360] lstrlenW (lpString=".v2i") returned 4 [0090.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".v2i") returned 0x0 [0090.360] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.361] lstrlenW (lpString=".sql") returned 4 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".sql") returned 0x0 [0090.361] lstrlenW (lpString=".mdf") returned 4 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".mdf") returned 0x0 [0090.361] lstrlenW (lpString=".txt") returned 4 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".txt") returned 0x0 [0090.361] lstrlenW (lpString=".dbf") returned 4 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".dbf") returned 0x0 [0090.361] lstrlenW (lpString=".ckp") returned 4 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".ckp") returned 0x0 [0090.361] lstrlenW (lpString=".dacpac") returned 7 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".dacpac") returned 0x0 [0090.361] lstrlenW (lpString=".db3") returned 4 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".db3") returned 0x0 [0090.361] lstrlenW (lpString=".dtxs") returned 5 [0090.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".dtxs") returned 0x0 [0090.361] lstrlenW (lpString=".mdt") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".mdt") returned 0x0 [0090.362] lstrlenW (lpString=".sdf") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".sdf") returned 0x0 [0090.362] lstrlenW (lpString=".MDF") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".MDF") returned 0x0 [0090.362] lstrlenW (lpString=".DBF") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".DBF") returned 0x0 [0090.362] lstrlenW (lpString=".DB") returned 3 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".DB") returned 0x0 [0090.362] lstrlenW (lpString=".db") returned 3 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".db") returned 0x0 [0090.362] lstrlenW (lpString=".ndf") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".ndf") returned 0x0 [0090.362] lstrlenW (lpString=".NDF") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".NDF") returned 0x0 [0090.362] lstrlenW (lpString=".Mdf") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".Mdf") returned 0x0 [0090.362] lstrlenW (lpString=".dat") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".dat") returned 0x0 [0090.362] lstrlenW (lpString=".DAT") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".DAT") returned 0x0 [0090.362] lstrlenW (lpString=".ldf") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".ldf") returned 0x0 [0090.362] lstrlenW (lpString=".LDF") returned 4 [0090.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch=".LDF") returned 0x0 [0090.362] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.363] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.363] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.363] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.364] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21036475632) returned 1 [0090.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4ac4790, dwHighDateTime=0x1d585b4)) [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4ad8 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4ad8 | out: hHeap=0x260000) returned 1 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.364] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.364] GetLastError () returned 0x0 [0090.365] GetLastError () returned 0x0 [0090.365] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.365] GetLastError () returned 0x0 [0090.365] GetLastError () returned 0x0 [0090.367] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.367] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x271, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x271, lpOverlapped=0x0) returned 1 [0090.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.367] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.367] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.368] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.368] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.368] CloseHandle (hObject=0xd8) returned 1 [0090.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0090.371] GetLastError () returned 0x0 [0090.371] RtlWakeConditionVariable () returned 0x0 [0090.371] GetCurrentThreadId () returned 0x99c [0090.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".ldf") returned 0x0 [0090.371] lstrlenW (lpString=".vhd") returned 4 [0090.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".vhd") returned 0x0 [0090.371] lstrlenW (lpString=".vhdx") returned 5 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".vhdx") returned 0x0 [0090.372] lstrlenW (lpString=".pst") returned 4 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".pst") returned 0x0 [0090.372] lstrlenW (lpString=".ost") returned 4 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".ost") returned 0x0 [0090.372] lstrlenW (lpString=".bak") returned 4 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".bak") returned 0x0 [0090.372] lstrlenW (lpString=".bac") returned 4 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".bac") returned 0x0 [0090.372] lstrlenW (lpString=".sys") returned 4 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".sys") returned 0x0 [0090.372] lstrlenW (lpString=".v2i") returned 4 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".v2i") returned 0x0 [0090.372] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.480] lstrlenW (lpString=".sql") returned 4 [0090.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".sql") returned 0x0 [0090.480] lstrlenW (lpString=".mdf") returned 4 [0090.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".mdf") returned 0x0 [0090.480] lstrlenW (lpString=".txt") returned 4 [0090.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".txt") returned 0x0 [0090.481] lstrlenW (lpString=".dbf") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".dbf") returned 0x0 [0090.481] lstrlenW (lpString=".ckp") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".ckp") returned 0x0 [0090.481] lstrlenW (lpString=".dacpac") returned 7 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".dacpac") returned 0x0 [0090.481] lstrlenW (lpString=".db3") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".db3") returned 0x0 [0090.481] lstrlenW (lpString=".dtxs") returned 5 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".dtxs") returned 0x0 [0090.481] lstrlenW (lpString=".mdt") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".mdt") returned 0x0 [0090.481] lstrlenW (lpString=".sdf") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".sdf") returned 0x0 [0090.481] lstrlenW (lpString=".MDF") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".MDF") returned 0x0 [0090.481] lstrlenW (lpString=".DBF") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".DBF") returned 0x0 [0090.481] lstrlenW (lpString=".DB") returned 3 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".DB") returned 0x0 [0090.481] lstrlenW (lpString=".db") returned 3 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".db") returned 0x0 [0090.481] lstrlenW (lpString=".ndf") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".ndf") returned 0x0 [0090.481] lstrlenW (lpString=".NDF") returned 4 [0090.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".NDF") returned 0x0 [0090.482] lstrlenW (lpString=".Mdf") returned 4 [0090.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".Mdf") returned 0x0 [0090.482] lstrlenW (lpString=".dat") returned 4 [0090.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".dat") returned 0x0 [0090.482] lstrlenW (lpString=".DAT") returned 4 [0090.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".DAT") returned 0x0 [0090.482] lstrlenW (lpString=".ldf") returned 4 [0090.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".ldf") returned 0x0 [0090.482] lstrlenW (lpString=".LDF") returned 4 [0090.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch=".LDF") returned 0x0 [0090.482] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.482] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.483] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.483] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21048417883) returned 1 [0090.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4bf5290, dwHighDateTime=0x1d585b4)) [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4d08 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4d08 | out: hHeap=0x260000) returned 1 [0090.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.484] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.484] GetLastError () returned 0x0 [0090.484] GetLastError () returned 0x0 [0090.484] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.484] GetLastError () returned 0x0 [0090.484] GetLastError () returned 0x0 [0090.486] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.486] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x369, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x369, lpOverlapped=0x0) returned 1 [0090.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.486] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.486] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.486] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.486] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.487] CloseHandle (hObject=0xd8) returned 1 [0090.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.488] GetLastError () returned 0x0 [0090.488] RtlWakeConditionVariable () returned 0x0 [0090.488] GetCurrentThreadId () returned 0x99c [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".ldf") returned 0x0 [0090.489] lstrlenW (lpString=".vhd") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".vhd") returned 0x0 [0090.489] lstrlenW (lpString=".vhdx") returned 5 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".vhdx") returned 0x0 [0090.489] lstrlenW (lpString=".pst") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".pst") returned 0x0 [0090.489] lstrlenW (lpString=".ost") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".ost") returned 0x0 [0090.489] lstrlenW (lpString=".bak") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".bak") returned 0x0 [0090.489] lstrlenW (lpString=".bac") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".bac") returned 0x0 [0090.489] lstrlenW (lpString=".sys") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".sys") returned 0x0 [0090.489] lstrlenW (lpString=".v2i") returned 4 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".v2i") returned 0x0 [0090.489] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.490] lstrlenW (lpString=".sql") returned 4 [0090.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".sql") returned 0x0 [0090.490] lstrlenW (lpString=".mdf") returned 4 [0090.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".mdf") returned 0x0 [0090.491] lstrlenW (lpString=".txt") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".txt") returned 0x0 [0090.491] lstrlenW (lpString=".dbf") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".dbf") returned 0x0 [0090.491] lstrlenW (lpString=".ckp") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".ckp") returned 0x0 [0090.491] lstrlenW (lpString=".dacpac") returned 7 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".dacpac") returned 0x0 [0090.491] lstrlenW (lpString=".db3") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".db3") returned 0x0 [0090.491] lstrlenW (lpString=".dtxs") returned 5 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".dtxs") returned 0x0 [0090.491] lstrlenW (lpString=".mdt") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".mdt") returned 0x0 [0090.491] lstrlenW (lpString=".sdf") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".sdf") returned 0x0 [0090.491] lstrlenW (lpString=".MDF") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".MDF") returned 0x0 [0090.491] lstrlenW (lpString=".DBF") returned 4 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".DBF") returned 0x0 [0090.491] lstrlenW (lpString=".DB") returned 3 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".DB") returned 0x0 [0090.491] lstrlenW (lpString=".db") returned 3 [0090.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".db") returned 0x0 [0090.491] lstrlenW (lpString=".ndf") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".ndf") returned 0x0 [0090.492] lstrlenW (lpString=".NDF") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".NDF") returned 0x0 [0090.492] lstrlenW (lpString=".Mdf") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".Mdf") returned 0x0 [0090.492] lstrlenW (lpString=".dat") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".dat") returned 0x0 [0090.492] lstrlenW (lpString=".DAT") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".DAT") returned 0x0 [0090.492] lstrlenW (lpString=".ldf") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".ldf") returned 0x0 [0090.492] lstrlenW (lpString=".LDF") returned 4 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch=".LDF") returned 0x0 [0090.492] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.492] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.493] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.493] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21049430604) returned 1 [0090.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4bf5290, dwHighDateTime=0x1d585b4)) [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4d40 [0090.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4d40 | out: hHeap=0x260000) returned 1 [0090.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.494] GetLastError () returned 0x0 [0090.494] GetLastError () returned 0x0 [0090.494] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.494] GetLastError () returned 0x0 [0090.495] GetLastError () returned 0x0 [0090.572] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff810, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.572] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x7f0, lpOverlapped=0x0) returned 1 [0090.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.599] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.599] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.600] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.600] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.600] CloseHandle (hObject=0xd8) returned 1 [0090.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0090.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.601] GetLastError () returned 0x0 [0090.602] RtlWakeConditionVariable () returned 0x0 [0090.602] GetCurrentThreadId () returned 0x99c [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.602] lstrlenW (lpString=".vhd") returned 4 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.602] lstrlenW (lpString=".vhdx") returned 5 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.602] lstrlenW (lpString=".pst") returned 4 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.602] lstrlenW (lpString=".ost") returned 4 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.602] lstrlenW (lpString=".bak") returned 4 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.602] lstrlenW (lpString=".bac") returned 4 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.602] lstrlenW (lpString=".sys") returned 4 [0090.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.603] lstrlenW (lpString=".v2i") returned 4 [0090.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.603] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.603] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.671] lstrlenW (lpString=".sql") returned 4 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.671] lstrlenW (lpString=".mdf") returned 4 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.671] lstrlenW (lpString=".txt") returned 4 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.671] lstrlenW (lpString=".dbf") returned 4 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.671] lstrlenW (lpString=".ckp") returned 4 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.671] lstrlenW (lpString=".dacpac") returned 7 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.671] lstrlenW (lpString=".db3") returned 4 [0090.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.671] lstrlenW (lpString=".dtxs") returned 5 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.672] lstrlenW (lpString=".mdt") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.672] lstrlenW (lpString=".sdf") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.672] lstrlenW (lpString=".MDF") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.672] lstrlenW (lpString=".DBF") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.672] lstrlenW (lpString=".DB") returned 3 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.672] lstrlenW (lpString=".db") returned 3 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.672] lstrlenW (lpString=".ndf") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.672] lstrlenW (lpString=".NDF") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.672] lstrlenW (lpString=".Mdf") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.672] lstrlenW (lpString=".dat") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.672] lstrlenW (lpString=".DAT") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.672] lstrlenW (lpString=".ldf") returned 4 [0090.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.672] lstrlenW (lpString=".LDF") returned 4 [0090.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.673] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.673] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.674] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.674] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21067488468) returned 1 [0090.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4dbe310, dwHighDateTime=0x1d585b4)) [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5168 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5168 | out: hHeap=0x260000) returned 1 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.674] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.675] GetLastError () returned 0x0 [0090.675] GetLastError () returned 0x0 [0090.675] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.675] GetLastError () returned 0x0 [0090.675] GetLastError () returned 0x0 [0090.676] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.676] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xde, lpOverlapped=0x0) returned 1 [0090.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.677] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.677] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.677] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.677] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.677] CloseHandle (hObject=0xe4) returned 1 [0090.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0090.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.679] GetLastError () returned 0x0 [0090.679] RtlWakeConditionVariable () returned 0x0 [0090.679] GetCurrentThreadId () returned 0x99c [0090.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0090.679] lstrlenW (lpString=".vhd") returned 4 [0090.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".vhd") returned 0x0 [0090.679] lstrlenW (lpString=".vhdx") returned 5 [0090.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".vhdx") returned 0x0 [0090.679] lstrlenW (lpString=".pst") returned 4 [0090.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".pst") returned 0x0 [0090.679] lstrlenW (lpString=".ost") returned 4 [0090.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".ost") returned 0x0 [0090.679] lstrlenW (lpString=".bak") returned 4 [0090.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".bak") returned 0x0 [0090.680] lstrlenW (lpString=".bac") returned 4 [0090.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".bac") returned 0x0 [0090.680] lstrlenW (lpString=".sys") returned 4 [0090.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".sys") returned 0x0 [0090.680] lstrlenW (lpString=".v2i") returned 4 [0090.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".v2i") returned 0x0 [0090.680] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.702] lstrlenW (lpString=".sql") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".sql") returned 0x0 [0090.702] lstrlenW (lpString=".mdf") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".mdf") returned 0x0 [0090.702] lstrlenW (lpString=".txt") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".txt") returned 0x0 [0090.702] lstrlenW (lpString=".dbf") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".dbf") returned 0x0 [0090.702] lstrlenW (lpString=".ckp") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".ckp") returned 0x0 [0090.702] lstrlenW (lpString=".dacpac") returned 7 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".dacpac") returned 0x0 [0090.702] lstrlenW (lpString=".db3") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".db3") returned 0x0 [0090.702] lstrlenW (lpString=".dtxs") returned 5 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".dtxs") returned 0x0 [0090.702] lstrlenW (lpString=".mdt") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".mdt") returned 0x0 [0090.702] lstrlenW (lpString=".sdf") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".sdf") returned 0x0 [0090.702] lstrlenW (lpString=".MDF") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".MDF") returned 0x0 [0090.702] lstrlenW (lpString=".DBF") returned 4 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".DBF") returned 0x0 [0090.702] lstrlenW (lpString=".DB") returned 3 [0090.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".DB") returned 0x0 [0090.703] lstrlenW (lpString=".db") returned 3 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".db") returned 0x0 [0090.703] lstrlenW (lpString=".ndf") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".ndf") returned 0x0 [0090.703] lstrlenW (lpString=".NDF") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".NDF") returned 0x0 [0090.703] lstrlenW (lpString=".Mdf") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".Mdf") returned 0x0 [0090.703] lstrlenW (lpString=".dat") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".dat") returned 0x0 [0090.703] lstrlenW (lpString=".DAT") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".DAT") returned 0x0 [0090.703] lstrlenW (lpString=".ldf") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0090.703] lstrlenW (lpString=".LDF") returned 4 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch=".LDF") returned 0x0 [0090.703] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.703] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.704] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.704] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.704] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21070542766) returned 1 [0090.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4e0a5d0, dwHighDateTime=0x1d585b4)) [0090.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5210 [0090.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5210 | out: hHeap=0x260000) returned 1 [0090.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.705] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.705] GetLastError () returned 0x0 [0090.705] GetLastError () returned 0x0 [0090.705] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.706] GetLastError () returned 0x0 [0090.706] GetLastError () returned 0x0 [0090.707] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.707] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xb9, lpOverlapped=0x0) returned 1 [0090.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.707] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.707] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.707] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.707] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.707] CloseHandle (hObject=0xd8) returned 1 [0090.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0090.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.710] GetLastError () returned 0x0 [0090.710] RtlWakeConditionVariable () returned 0x0 [0090.710] GetCurrentThreadId () returned 0x99c [0090.710] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.711] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.711] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.711] WriteFile (in: hFile=0xd8, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.713] CloseHandle (hObject=0xd8) returned 1 [0090.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c300 | out: hHeap=0x260000) returned 1 [0090.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.713] RtlWakeConditionVariable () returned 0x27e828 [0090.713] GetCurrentThreadId () returned 0x99c [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".ldf") returned 0x0 [0090.713] lstrlenW (lpString=".vhd") returned 4 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".vhd") returned 0x0 [0090.713] lstrlenW (lpString=".vhdx") returned 5 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".vhdx") returned 0x0 [0090.713] lstrlenW (lpString=".pst") returned 4 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".pst") returned 0x0 [0090.713] lstrlenW (lpString=".ost") returned 4 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".ost") returned 0x0 [0090.713] lstrlenW (lpString=".bak") returned 4 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".bak") returned 0x0 [0090.713] lstrlenW (lpString=".bac") returned 4 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".bac") returned 0x0 [0090.713] lstrlenW (lpString=".sys") returned 4 [0090.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".sys") returned 0x0 [0090.714] lstrlenW (lpString=".v2i") returned 4 [0090.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".v2i") returned 0x0 [0090.714] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.726] lstrlenW (lpString=".sql") returned 4 [0090.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".sql") returned 0x0 [0090.726] lstrlenW (lpString=".mdf") returned 4 [0090.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".mdf") returned 0x0 [0090.726] lstrlenW (lpString=".txt") returned 4 [0090.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".txt") returned 0x0 [0090.726] lstrlenW (lpString=".dbf") returned 4 [0090.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".dbf") returned 0x0 [0090.726] lstrlenW (lpString=".ckp") returned 4 [0090.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".ckp") returned 0x0 [0090.726] lstrlenW (lpString=".dacpac") returned 7 [0090.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".dacpac") returned 0x0 [0090.726] lstrlenW (lpString=".db3") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".db3") returned 0x0 [0090.727] lstrlenW (lpString=".dtxs") returned 5 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".dtxs") returned 0x0 [0090.727] lstrlenW (lpString=".mdt") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".mdt") returned 0x0 [0090.727] lstrlenW (lpString=".sdf") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".sdf") returned 0x0 [0090.727] lstrlenW (lpString=".MDF") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".MDF") returned 0x0 [0090.727] lstrlenW (lpString=".DBF") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".DBF") returned 0x0 [0090.727] lstrlenW (lpString=".DB") returned 3 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".DB") returned 0x0 [0090.727] lstrlenW (lpString=".db") returned 3 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".db") returned 0x0 [0090.727] lstrlenW (lpString=".ndf") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".ndf") returned 0x0 [0090.727] lstrlenW (lpString=".NDF") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".NDF") returned 0x0 [0090.727] lstrlenW (lpString=".Mdf") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".Mdf") returned 0x0 [0090.727] lstrlenW (lpString=".dat") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".dat") returned 0x0 [0090.727] lstrlenW (lpString=".DAT") returned 4 [0090.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".DAT") returned 0x0 [0090.727] lstrlenW (lpString=".ldf") returned 4 [0090.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".ldf") returned 0x0 [0090.728] lstrlenW (lpString=".LDF") returned 4 [0090.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch=".LDF") returned 0x0 [0090.728] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.728] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.729] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.729] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.729] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21072995294) returned 1 [0090.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4e30730, dwHighDateTime=0x1d585b4)) [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5280 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5280 | out: hHeap=0x260000) returned 1 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.730] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.730] GetLastError () returned 0x0 [0090.730] GetLastError () returned 0x0 [0090.730] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.730] GetLastError () returned 0x0 [0090.730] GetLastError () returned 0x0 [0090.734] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffef0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.734] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10f1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x10f1, lpOverlapped=0x0) returned 1 [0090.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.734] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.734] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.734] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.734] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.734] CloseHandle (hObject=0xd8) returned 1 [0090.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css.[deadmin@cock.li].deadmin")) returned 1 [0090.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.736] GetLastError () returned 0x0 [0090.736] RtlWakeConditionVariable () returned 0x27e828 [0090.737] GetCurrentThreadId () returned 0x99c [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.737] lstrlenW (lpString=".vhd") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0090.737] lstrlenW (lpString=".vhdx") returned 5 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0090.737] lstrlenW (lpString=".pst") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0090.737] lstrlenW (lpString=".ost") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0090.737] lstrlenW (lpString=".bak") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0090.737] lstrlenW (lpString=".bac") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0090.737] lstrlenW (lpString=".sys") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0090.737] lstrlenW (lpString=".v2i") returned 4 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0090.737] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.737] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0090.739] lstrlenW (lpString=".sql") returned 4 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0090.739] lstrlenW (lpString=".mdf") returned 4 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0090.739] lstrlenW (lpString=".txt") returned 4 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0090.739] lstrlenW (lpString=".dbf") returned 4 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0090.739] lstrlenW (lpString=".ckp") returned 4 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0090.739] lstrlenW (lpString=".dacpac") returned 7 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0090.739] lstrlenW (lpString=".db3") returned 4 [0090.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0090.740] lstrlenW (lpString=".dtxs") returned 5 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0090.740] lstrlenW (lpString=".mdt") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0090.740] lstrlenW (lpString=".sdf") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0090.740] lstrlenW (lpString=".MDF") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0090.740] lstrlenW (lpString=".DBF") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0090.740] lstrlenW (lpString=".DB") returned 3 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0090.740] lstrlenW (lpString=".db") returned 3 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".db") returned 0x0 [0090.740] lstrlenW (lpString=".ndf") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0090.740] lstrlenW (lpString=".NDF") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0090.740] lstrlenW (lpString=".Mdf") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0090.740] lstrlenW (lpString=".dat") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0090.740] lstrlenW (lpString=".DAT") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0090.740] lstrlenW (lpString=".ldf") returned 4 [0090.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.741] lstrlenW (lpString=".LDF") returned 4 [0090.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0090.741] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.741] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.742] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.742] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21074295139) returned 1 [0090.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4e56890, dwHighDateTime=0x1d585b4)) [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b52b8 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b52b8 | out: hHeap=0x260000) returned 1 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.743] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.743] GetLastError () returned 0x0 [0090.743] GetLastError () returned 0x0 [0090.743] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.743] GetLastError () returned 0x0 [0090.743] GetLastError () returned 0x0 [0090.744] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffe91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.744] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x16f, lpOverlapped=0x0) returned 1 [0090.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.745] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.745] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.745] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.745] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.745] CloseHandle (hObject=0xd8) returned 1 [0090.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0090.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.836] GetLastError () returned 0x0 [0090.836] RtlWakeConditionVariable () returned 0x0 [0090.837] GetCurrentThreadId () returned 0x99c [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.837] lstrlenW (lpString=".vhd") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.837] lstrlenW (lpString=".vhdx") returned 5 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.837] lstrlenW (lpString=".pst") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.837] lstrlenW (lpString=".ost") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.837] lstrlenW (lpString=".bak") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.837] lstrlenW (lpString=".bac") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.837] lstrlenW (lpString=".sys") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.837] lstrlenW (lpString=".v2i") returned 4 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.837] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.837] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.861] lstrlenW (lpString=".sql") returned 4 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.861] lstrlenW (lpString=".mdf") returned 4 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.861] lstrlenW (lpString=".txt") returned 4 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.861] lstrlenW (lpString=".dbf") returned 4 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.861] lstrlenW (lpString=".ckp") returned 4 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.861] lstrlenW (lpString=".dacpac") returned 7 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.861] lstrlenW (lpString=".db3") returned 4 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.861] lstrlenW (lpString=".dtxs") returned 5 [0090.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.861] lstrlenW (lpString=".mdt") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.862] lstrlenW (lpString=".sdf") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.862] lstrlenW (lpString=".MDF") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.862] lstrlenW (lpString=".DBF") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.862] lstrlenW (lpString=".DB") returned 3 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.862] lstrlenW (lpString=".db") returned 3 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.862] lstrlenW (lpString=".ndf") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.862] lstrlenW (lpString=".NDF") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.862] lstrlenW (lpString=".Mdf") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.862] lstrlenW (lpString=".dat") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.862] lstrlenW (lpString=".DAT") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.862] lstrlenW (lpString=".ldf") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.862] lstrlenW (lpString=".LDF") returned 4 [0090.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.862] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.863] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.863] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.863] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.864] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21086479710) returned 1 [0090.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4f87390, dwHighDateTime=0x1d585b4)) [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5520 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5520 | out: hHeap=0x260000) returned 1 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.864] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.864] GetLastError () returned 0x0 [0090.865] GetLastError () returned 0x0 [0090.865] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.865] GetLastError () returned 0x0 [0090.865] GetLastError () returned 0x0 [0090.867] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.867] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x401, lpOverlapped=0x0) returned 1 [0090.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.867] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.867] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.867] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.867] CloseHandle (hObject=0x11c) returned 1 [0090.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0090.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0090.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.869] GetLastError () returned 0x0 [0090.869] RtlWakeConditionVariable () returned 0x0 [0090.869] GetCurrentThreadId () returned 0x99c [0090.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".ldf") returned 0x0 [0090.869] lstrlenW (lpString=".vhd") returned 4 [0090.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".vhd") returned 0x0 [0090.869] lstrlenW (lpString=".vhdx") returned 5 [0090.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".vhdx") returned 0x0 [0090.869] lstrlenW (lpString=".pst") returned 4 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".pst") returned 0x0 [0090.870] lstrlenW (lpString=".ost") returned 4 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".ost") returned 0x0 [0090.870] lstrlenW (lpString=".bak") returned 4 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".bak") returned 0x0 [0090.870] lstrlenW (lpString=".bac") returned 4 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".bac") returned 0x0 [0090.870] lstrlenW (lpString=".sys") returned 4 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".sys") returned 0x0 [0090.870] lstrlenW (lpString=".v2i") returned 4 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".v2i") returned 0x0 [0090.870] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.871] lstrlenW (lpString=".sql") returned 4 [0090.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".sql") returned 0x0 [0090.871] lstrlenW (lpString=".mdf") returned 4 [0090.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".mdf") returned 0x0 [0090.871] lstrlenW (lpString=".txt") returned 4 [0090.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".txt") returned 0x0 [0090.871] lstrlenW (lpString=".dbf") returned 4 [0090.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".dbf") returned 0x0 [0090.871] lstrlenW (lpString=".ckp") returned 4 [0090.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".ckp") returned 0x0 [0090.872] lstrlenW (lpString=".dacpac") returned 7 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".dacpac") returned 0x0 [0090.872] lstrlenW (lpString=".db3") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".db3") returned 0x0 [0090.872] lstrlenW (lpString=".dtxs") returned 5 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".dtxs") returned 0x0 [0090.872] lstrlenW (lpString=".mdt") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".mdt") returned 0x0 [0090.872] lstrlenW (lpString=".sdf") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".sdf") returned 0x0 [0090.872] lstrlenW (lpString=".MDF") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".MDF") returned 0x0 [0090.872] lstrlenW (lpString=".DBF") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".DBF") returned 0x0 [0090.872] lstrlenW (lpString=".DB") returned 3 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".DB") returned 0x0 [0090.872] lstrlenW (lpString=".db") returned 3 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".db") returned 0x0 [0090.872] lstrlenW (lpString=".ndf") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".ndf") returned 0x0 [0090.872] lstrlenW (lpString=".NDF") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".NDF") returned 0x0 [0090.872] lstrlenW (lpString=".Mdf") returned 4 [0090.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".Mdf") returned 0x0 [0090.872] lstrlenW (lpString=".dat") returned 4 [0090.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".dat") returned 0x0 [0090.873] lstrlenW (lpString=".DAT") returned 4 [0090.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".DAT") returned 0x0 [0090.873] lstrlenW (lpString=".ldf") returned 4 [0090.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".ldf") returned 0x0 [0090.873] lstrlenW (lpString=".LDF") returned 4 [0090.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch=".LDF") returned 0x0 [0090.873] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.873] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.874] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.874] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.874] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21087504068) returned 1 [0090.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4fad4f0, dwHighDateTime=0x1d585b4)) [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5558 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5558 | out: hHeap=0x260000) returned 1 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.875] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.875] GetLastError () returned 0x0 [0090.875] GetLastError () returned 0x0 [0090.875] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.875] GetLastError () returned 0x0 [0090.875] GetLastError () returned 0x0 [0090.877] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.877] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x72e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x72e, lpOverlapped=0x0) returned 1 [0090.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.877] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.877] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.877] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.877] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.877] CloseHandle (hObject=0x11c) returned 1 [0090.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35abc0 [0090.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css.[deadmin@cock.li].deadmin")) returned 1 [0090.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35abc0 | out: hHeap=0x260000) returned 1 [0090.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.879] GetLastError () returned 0x0 [0090.879] RtlWakeConditionVariable () returned 0x0 [0090.879] GetCurrentThreadId () returned 0x99c [0090.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.879] lstrlenW (lpString=".vhd") returned 4 [0090.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0090.879] lstrlenW (lpString=".vhdx") returned 5 [0090.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0090.879] lstrlenW (lpString=".pst") returned 4 [0090.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0090.880] lstrlenW (lpString=".ost") returned 4 [0090.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0090.880] lstrlenW (lpString=".bak") returned 4 [0090.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0090.880] lstrlenW (lpString=".bac") returned 4 [0090.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0090.880] lstrlenW (lpString=".sys") returned 4 [0090.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0090.880] lstrlenW (lpString=".v2i") returned 4 [0090.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0090.880] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.881] lstrlenW (lpString=".sql") returned 4 [0090.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0090.881] lstrlenW (lpString=".mdf") returned 4 [0090.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0090.881] lstrlenW (lpString=".txt") returned 4 [0090.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0090.881] lstrlenW (lpString=".dbf") returned 4 [0090.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0090.881] lstrlenW (lpString=".ckp") returned 4 [0090.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0090.882] lstrlenW (lpString=".dacpac") returned 7 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0090.882] lstrlenW (lpString=".db3") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0090.882] lstrlenW (lpString=".dtxs") returned 5 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0090.882] lstrlenW (lpString=".mdt") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0090.882] lstrlenW (lpString=".sdf") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0090.882] lstrlenW (lpString=".MDF") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0090.882] lstrlenW (lpString=".DBF") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0090.882] lstrlenW (lpString=".DB") returned 3 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0090.882] lstrlenW (lpString=".db") returned 3 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".db") returned 0x0 [0090.882] lstrlenW (lpString=".ndf") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0090.882] lstrlenW (lpString=".NDF") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0090.882] lstrlenW (lpString=".Mdf") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0090.882] lstrlenW (lpString=".dat") returned 4 [0090.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0090.883] lstrlenW (lpString=".DAT") returned 4 [0090.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0090.883] lstrlenW (lpString=".ldf") returned 4 [0090.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.883] lstrlenW (lpString=".LDF") returned 4 [0090.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0090.883] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.883] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.883] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.884] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.884] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.884] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21088498789) returned 1 [0090.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4fad4f0, dwHighDateTime=0x1d585b4)) [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5590 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5590 | out: hHeap=0x260000) returned 1 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.885] GetLastError () returned 0x0 [0090.885] GetLastError () returned 0x0 [0090.885] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.885] GetLastError () returned 0x0 [0090.885] GetLastError () returned 0x0 [0090.886] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffe48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.887] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1b8, lpOverlapped=0x0) returned 1 [0090.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.887] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.887] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.887] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.887] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.887] CloseHandle (hObject=0x11c) returned 1 [0090.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0090.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.889] GetLastError () returned 0x0 [0090.889] RtlWakeConditionVariable () returned 0x27e828 [0090.889] GetCurrentThreadId () returned 0x99c [0090.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.889] lstrlenW (lpString=".vhd") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.890] lstrlenW (lpString=".vhdx") returned 5 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.890] lstrlenW (lpString=".pst") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.890] lstrlenW (lpString=".ost") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.890] lstrlenW (lpString=".bak") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.890] lstrlenW (lpString=".bac") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.890] lstrlenW (lpString=".sys") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.890] lstrlenW (lpString=".v2i") returned 4 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.890] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.891] lstrlenW (lpString=".sql") returned 4 [0090.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.892] lstrlenW (lpString=".mdf") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.892] lstrlenW (lpString=".txt") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.892] lstrlenW (lpString=".dbf") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.892] lstrlenW (lpString=".ckp") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.892] lstrlenW (lpString=".dacpac") returned 7 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.892] lstrlenW (lpString=".db3") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.892] lstrlenW (lpString=".dtxs") returned 5 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.892] lstrlenW (lpString=".mdt") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.892] lstrlenW (lpString=".sdf") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.892] lstrlenW (lpString=".MDF") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.892] lstrlenW (lpString=".DBF") returned 4 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.892] lstrlenW (lpString=".DB") returned 3 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.892] lstrlenW (lpString=".db") returned 3 [0090.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.893] lstrlenW (lpString=".ndf") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.893] lstrlenW (lpString=".NDF") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.893] lstrlenW (lpString=".Mdf") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.893] lstrlenW (lpString=".dat") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.893] lstrlenW (lpString=".DAT") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.893] lstrlenW (lpString=".ldf") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.893] lstrlenW (lpString=".LDF") returned 4 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.893] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.893] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.894] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.894] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.894] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21089533539) returned 1 [0090.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4fd3650, dwHighDateTime=0x1d585b4)) [0090.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b55c8 [0090.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b55c8 | out: hHeap=0x260000) returned 1 [0090.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.895] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.895] GetLastError () returned 0x0 [0090.895] GetLastError () returned 0x0 [0090.895] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.895] GetLastError () returned 0x0 [0090.896] GetLastError () returned 0x0 [0090.897] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.897] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x155, lpOverlapped=0x0) returned 1 [0090.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.897] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.897] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.897] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.897] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.898] CloseHandle (hObject=0x11c) returned 1 [0090.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0090.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.901] GetLastError () returned 0x0 [0090.901] RtlWakeConditionVariable () returned 0x0 [0090.901] GetCurrentThreadId () returned 0x99c [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.901] lstrlenW (lpString=".vhd") returned 4 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0090.901] lstrlenW (lpString=".vhdx") returned 5 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0090.901] lstrlenW (lpString=".pst") returned 4 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0090.901] lstrlenW (lpString=".ost") returned 4 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0090.901] lstrlenW (lpString=".bak") returned 4 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0090.901] lstrlenW (lpString=".bac") returned 4 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0090.901] lstrlenW (lpString=".sys") returned 4 [0090.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0090.902] lstrlenW (lpString=".v2i") returned 4 [0090.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0090.902] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.903] lstrlenW (lpString=".sql") returned 4 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0090.903] lstrlenW (lpString=".mdf") returned 4 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0090.903] lstrlenW (lpString=".txt") returned 4 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0090.903] lstrlenW (lpString=".dbf") returned 4 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0090.903] lstrlenW (lpString=".ckp") returned 4 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0090.903] lstrlenW (lpString=".dacpac") returned 7 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0090.903] lstrlenW (lpString=".db3") returned 4 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0090.903] lstrlenW (lpString=".dtxs") returned 5 [0090.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0090.903] lstrlenW (lpString=".mdt") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0090.904] lstrlenW (lpString=".sdf") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0090.904] lstrlenW (lpString=".MDF") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0090.904] lstrlenW (lpString=".DBF") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0090.904] lstrlenW (lpString=".DB") returned 3 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0090.904] lstrlenW (lpString=".db") returned 3 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0090.904] lstrlenW (lpString=".ndf") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0090.904] lstrlenW (lpString=".NDF") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0090.904] lstrlenW (lpString=".Mdf") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0090.904] lstrlenW (lpString=".dat") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0090.904] lstrlenW (lpString=".DAT") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0090.904] lstrlenW (lpString=".ldf") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0090.904] lstrlenW (lpString=".LDF") returned 4 [0090.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0090.904] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.905] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.905] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.905] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.906] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21090675593) returned 1 [0090.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc4ff97b0, dwHighDateTime=0x1d585b4)) [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5600 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5600 | out: hHeap=0x260000) returned 1 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.906] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.906] GetLastError () returned 0x0 [0090.907] GetLastError () returned 0x0 [0090.907] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.907] GetLastError () returned 0x0 [0090.907] GetLastError () returned 0x0 [0090.908] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.908] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xde, lpOverlapped=0x0) returned 1 [0090.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.908] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.908] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.908] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.909] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.909] CloseHandle (hObject=0x11c) returned 1 [0090.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0090.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0090.910] GetLastError () returned 0x0 [0090.910] RtlWakeConditionVariable () returned 0x27e828 [0090.910] GetCurrentThreadId () returned 0x99c [0090.911] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.911] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0090.911] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0090.911] WriteFile (in: hFile=0x11c, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0090.913] CloseHandle (hObject=0x11c) returned 1 [0090.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35adf0 | out: hHeap=0x260000) returned 1 [0090.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35abc0 | out: hHeap=0x260000) returned 1 [0090.913] RtlWakeConditionVariable () returned 0x27e828 [0090.913] GetCurrentThreadId () returned 0x99c [0090.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".ldf") returned 0x0 [0090.913] lstrlenW (lpString=".vhd") returned 4 [0090.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".vhd") returned 0x0 [0090.913] lstrlenW (lpString=".vhdx") returned 5 [0090.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".vhdx") returned 0x0 [0090.913] lstrlenW (lpString=".pst") returned 4 [0090.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".pst") returned 0x0 [0090.913] lstrlenW (lpString=".ost") returned 4 [0090.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".ost") returned 0x0 [0090.913] lstrlenW (lpString=".bak") returned 4 [0090.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".bak") returned 0x0 [0090.914] lstrlenW (lpString=".bac") returned 4 [0090.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".bac") returned 0x0 [0090.914] lstrlenW (lpString=".sys") returned 4 [0090.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".sys") returned 0x0 [0090.914] lstrlenW (lpString=".v2i") returned 4 [0090.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".v2i") returned 0x0 [0090.914] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.915] lstrlenW (lpString=".sql") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".sql") returned 0x0 [0090.915] lstrlenW (lpString=".mdf") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".mdf") returned 0x0 [0090.915] lstrlenW (lpString=".txt") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".txt") returned 0x0 [0090.915] lstrlenW (lpString=".dbf") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".dbf") returned 0x0 [0090.915] lstrlenW (lpString=".ckp") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".ckp") returned 0x0 [0090.915] lstrlenW (lpString=".dacpac") returned 7 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".dacpac") returned 0x0 [0090.915] lstrlenW (lpString=".db3") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".db3") returned 0x0 [0090.915] lstrlenW (lpString=".dtxs") returned 5 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".dtxs") returned 0x0 [0090.915] lstrlenW (lpString=".mdt") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".mdt") returned 0x0 [0090.915] lstrlenW (lpString=".sdf") returned 4 [0090.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".sdf") returned 0x0 [0090.916] lstrlenW (lpString=".MDF") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".MDF") returned 0x0 [0090.916] lstrlenW (lpString=".DBF") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".DBF") returned 0x0 [0090.916] lstrlenW (lpString=".DB") returned 3 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".DB") returned 0x0 [0090.916] lstrlenW (lpString=".db") returned 3 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".db") returned 0x0 [0090.916] lstrlenW (lpString=".ndf") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".ndf") returned 0x0 [0090.916] lstrlenW (lpString=".NDF") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".NDF") returned 0x0 [0090.916] lstrlenW (lpString=".Mdf") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".Mdf") returned 0x0 [0090.916] lstrlenW (lpString=".dat") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".dat") returned 0x0 [0090.916] lstrlenW (lpString=".DAT") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".DAT") returned 0x0 [0090.916] lstrlenW (lpString=".ldf") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".ldf") returned 0x0 [0090.916] lstrlenW (lpString=".LDF") returned 4 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch=".LDF") returned 0x0 [0090.916] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0090.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.917] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0090.918] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.918] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0090.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.918] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21091933218) returned 1 [0090.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc501f910, dwHighDateTime=0x1d585b4)) [0090.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0090.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0090.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0090.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5670 [0090.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5670 | out: hHeap=0x260000) returned 1 [0090.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.919] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0090.919] GetLastError () returned 0x0 [0090.919] GetLastError () returned 0x0 [0090.919] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0090.919] GetLastError () returned 0x0 [0090.920] GetLastError () returned 0x0 [0091.067] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff150, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.067] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xeb0, lpOverlapped=0x0) returned 1 [0091.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.067] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.067] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.067] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.068] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.068] CloseHandle (hObject=0x11c) returned 1 [0091.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css.[deadmin@cock.li].deadmin")) returned 1 [0091.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0091.070] GetLastError () returned 0x0 [0091.070] RtlWakeConditionVariable () returned 0x0 [0091.070] GetCurrentThreadId () returned 0x99c [0091.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".ldf") returned 0x0 [0091.071] lstrlenW (lpString=".vhd") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".vhd") returned 0x0 [0091.071] lstrlenW (lpString=".vhdx") returned 5 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".vhdx") returned 0x0 [0091.071] lstrlenW (lpString=".pst") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".pst") returned 0x0 [0091.071] lstrlenW (lpString=".ost") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".ost") returned 0x0 [0091.071] lstrlenW (lpString=".bak") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".bak") returned 0x0 [0091.071] lstrlenW (lpString=".bac") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".bac") returned 0x0 [0091.071] lstrlenW (lpString=".sys") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".sys") returned 0x0 [0091.071] lstrlenW (lpString=".v2i") returned 4 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".v2i") returned 0x0 [0091.071] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.071] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.339] lstrlenW (lpString=".sql") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".sql") returned 0x0 [0091.339] lstrlenW (lpString=".mdf") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".mdf") returned 0x0 [0091.339] lstrlenW (lpString=".txt") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".txt") returned 0x0 [0091.339] lstrlenW (lpString=".dbf") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".dbf") returned 0x0 [0091.339] lstrlenW (lpString=".ckp") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".ckp") returned 0x0 [0091.339] lstrlenW (lpString=".dacpac") returned 7 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".dacpac") returned 0x0 [0091.339] lstrlenW (lpString=".db3") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".db3") returned 0x0 [0091.339] lstrlenW (lpString=".dtxs") returned 5 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".dtxs") returned 0x0 [0091.339] lstrlenW (lpString=".mdt") returned 4 [0091.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".mdt") returned 0x0 [0091.340] lstrlenW (lpString=".sdf") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".sdf") returned 0x0 [0091.340] lstrlenW (lpString=".MDF") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".MDF") returned 0x0 [0091.340] lstrlenW (lpString=".DBF") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".DBF") returned 0x0 [0091.340] lstrlenW (lpString=".DB") returned 3 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".DB") returned 0x0 [0091.340] lstrlenW (lpString=".db") returned 3 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".db") returned 0x0 [0091.340] lstrlenW (lpString=".ndf") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".ndf") returned 0x0 [0091.340] lstrlenW (lpString=".NDF") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".NDF") returned 0x0 [0091.340] lstrlenW (lpString=".Mdf") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".Mdf") returned 0x0 [0091.340] lstrlenW (lpString=".dat") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".dat") returned 0x0 [0091.340] lstrlenW (lpString=".DAT") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".DAT") returned 0x0 [0091.340] lstrlenW (lpString=".ldf") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".ldf") returned 0x0 [0091.340] lstrlenW (lpString=".LDF") returned 4 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch=".LDF") returned 0x0 [0091.340] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.341] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.341] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.342] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.342] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21134284177) returned 1 [0091.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5423e30, dwHighDateTime=0x1d585b4)) [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5b40 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5b40 | out: hHeap=0x260000) returned 1 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.343] GetLastError () returned 0x0 [0091.343] GetLastError () returned 0x0 [0091.343] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.343] GetLastError () returned 0x0 [0091.343] GetLastError () returned 0x0 [0091.345] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff8fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.345] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x706, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x706, lpOverlapped=0x0) returned 1 [0091.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.345] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.346] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.346] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.346] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.346] CloseHandle (hObject=0xe4) returned 1 [0091.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.346] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css.[deadmin@cock.li].deadmin")) returned 1 [0091.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.348] GetLastError () returned 0x0 [0091.349] RtlWakeConditionVariable () returned 0x0 [0091.349] GetCurrentThreadId () returned 0x99c [0091.651] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.652] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.652] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.652] WriteFile (in: hFile=0xe4, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.654] CloseHandle (hObject=0xe4) returned 1 [0091.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b250 | out: hHeap=0x260000) returned 1 [0091.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.654] RtlWakeConditionVariable () returned 0x0 [0091.654] GetCurrentThreadId () returned 0x99c [0091.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.654] lstrlenW (lpString=".vhd") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0091.655] lstrlenW (lpString=".vhdx") returned 5 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0091.655] lstrlenW (lpString=".pst") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0091.655] lstrlenW (lpString=".ost") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0091.655] lstrlenW (lpString=".bak") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0091.655] lstrlenW (lpString=".bac") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0091.655] lstrlenW (lpString=".sys") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0091.655] lstrlenW (lpString=".v2i") returned 4 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0091.655] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.656] lstrlenW (lpString=".sql") returned 4 [0091.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0091.657] lstrlenW (lpString=".mdf") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0091.657] lstrlenW (lpString=".txt") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0091.657] lstrlenW (lpString=".dbf") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0091.657] lstrlenW (lpString=".ckp") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0091.657] lstrlenW (lpString=".dacpac") returned 7 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0091.657] lstrlenW (lpString=".db3") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0091.657] lstrlenW (lpString=".dtxs") returned 5 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0091.657] lstrlenW (lpString=".mdt") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0091.657] lstrlenW (lpString=".sdf") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0091.657] lstrlenW (lpString=".MDF") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0091.657] lstrlenW (lpString=".DBF") returned 4 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0091.657] lstrlenW (lpString=".DB") returned 3 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0091.657] lstrlenW (lpString=".db") returned 3 [0091.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0091.658] lstrlenW (lpString=".ndf") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0091.658] lstrlenW (lpString=".NDF") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0091.658] lstrlenW (lpString=".Mdf") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0091.658] lstrlenW (lpString=".dat") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0091.658] lstrlenW (lpString=".DAT") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0091.658] lstrlenW (lpString=".ldf") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.658] lstrlenW (lpString=".LDF") returned 4 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0091.658] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.658] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.659] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.659] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.660] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21166119730) returned 1 [0091.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc571d9b0, dwHighDateTime=0x1d585b4)) [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5f30 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5f30 | out: hHeap=0x260000) returned 1 [0091.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.661] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.661] GetLastError () returned 0x0 [0091.661] GetLastError () returned 0x0 [0091.661] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.661] GetLastError () returned 0x0 [0091.662] GetLastError () returned 0x0 [0091.663] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.663] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xde, lpOverlapped=0x0) returned 1 [0091.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.663] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.663] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.663] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.663] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.663] CloseHandle (hObject=0xe4) returned 1 [0091.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.665] GetLastError () returned 0x0 [0091.665] RtlWakeConditionVariable () returned 0x0 [0091.666] GetCurrentThreadId () returned 0x99c [0091.666] lstrcpyW (in: lpString1=0x238edbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.667] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.667] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.667] WriteFile (in: hFile=0xe4, lpBuffer=0x238edbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x238edb8, lpOverlapped=0x0 | out: lpBuffer=0x238edbc*, lpNumberOfBytesWritten=0x238edb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.669] CloseHandle (hObject=0xe4) returned 1 [0091.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.669] RtlWakeConditionVariable () returned 0x0 [0091.669] GetCurrentThreadId () returned 0x99c [0091.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".ldf") returned 0x0 [0091.669] lstrlenW (lpString=".vhd") returned 4 [0091.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".vhd") returned 0x0 [0091.669] lstrlenW (lpString=".vhdx") returned 5 [0091.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".vhdx") returned 0x0 [0091.669] lstrlenW (lpString=".pst") returned 4 [0091.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".pst") returned 0x0 [0091.669] lstrlenW (lpString=".ost") returned 4 [0091.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".ost") returned 0x0 [0091.669] lstrlenW (lpString=".bak") returned 4 [0091.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".bak") returned 0x0 [0091.670] lstrlenW (lpString=".bac") returned 4 [0091.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".bac") returned 0x0 [0091.670] lstrlenW (lpString=".sys") returned 4 [0091.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".sys") returned 0x0 [0091.670] lstrlenW (lpString=".v2i") returned 4 [0091.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".v2i") returned 0x0 [0091.670] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.671] lstrlenW (lpString=".sql") returned 4 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".sql") returned 0x0 [0091.671] lstrlenW (lpString=".mdf") returned 4 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".mdf") returned 0x0 [0091.671] lstrlenW (lpString=".txt") returned 4 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".txt") returned 0x0 [0091.671] lstrlenW (lpString=".dbf") returned 4 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".dbf") returned 0x0 [0091.671] lstrlenW (lpString=".ckp") returned 4 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".ckp") returned 0x0 [0091.671] lstrlenW (lpString=".dacpac") returned 7 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".dacpac") returned 0x0 [0091.671] lstrlenW (lpString=".db3") returned 4 [0091.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".db3") returned 0x0 [0091.671] lstrlenW (lpString=".dtxs") returned 5 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".dtxs") returned 0x0 [0091.672] lstrlenW (lpString=".mdt") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".mdt") returned 0x0 [0091.672] lstrlenW (lpString=".sdf") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".sdf") returned 0x0 [0091.672] lstrlenW (lpString=".MDF") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".MDF") returned 0x0 [0091.672] lstrlenW (lpString=".DBF") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".DBF") returned 0x0 [0091.672] lstrlenW (lpString=".DB") returned 3 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".DB") returned 0x0 [0091.672] lstrlenW (lpString=".db") returned 3 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".db") returned 0x0 [0091.672] lstrlenW (lpString=".ndf") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".ndf") returned 0x0 [0091.672] lstrlenW (lpString=".NDF") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".NDF") returned 0x0 [0091.672] lstrlenW (lpString=".Mdf") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".Mdf") returned 0x0 [0091.672] lstrlenW (lpString=".dat") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".dat") returned 0x0 [0091.672] lstrlenW (lpString=".DAT") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".DAT") returned 0x0 [0091.672] lstrlenW (lpString=".ldf") returned 4 [0091.672] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".ldf") returned 0x0 [0091.673] lstrlenW (lpString=".LDF") returned 4 [0091.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch=".LDF") returned 0x0 [0091.673] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.673] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.674] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.674] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.674] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21167488829) returned 1 [0091.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5743b10, dwHighDateTime=0x1d585b4)) [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5fa0 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5fa0 | out: hHeap=0x260000) returned 1 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.674] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.675] GetLastError () returned 0x0 [0091.675] GetLastError () returned 0x0 [0091.675] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.675] GetLastError () returned 0x0 [0091.675] GetLastError () returned 0x0 [0091.677] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff047, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.677] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xfb9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xfb9, lpOverlapped=0x0) returned 1 [0091.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.677] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.677] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.677] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.677] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.677] CloseHandle (hObject=0xe4) returned 1 [0091.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css.[deadmin@cock.li].deadmin")) returned 1 [0091.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.679] GetLastError () returned 0x0 [0091.679] RtlWakeConditionVariable () returned 0x0 [0091.679] GetCurrentThreadId () returned 0x99c [0091.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".ldf") returned 0x0 [0091.679] lstrlenW (lpString=".vhd") returned 4 [0091.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".vhd") returned 0x0 [0091.679] lstrlenW (lpString=".vhdx") returned 5 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".vhdx") returned 0x0 [0091.680] lstrlenW (lpString=".pst") returned 4 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".pst") returned 0x0 [0091.680] lstrlenW (lpString=".ost") returned 4 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".ost") returned 0x0 [0091.680] lstrlenW (lpString=".bak") returned 4 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".bak") returned 0x0 [0091.680] lstrlenW (lpString=".bac") returned 4 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".bac") returned 0x0 [0091.680] lstrlenW (lpString=".sys") returned 4 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".sys") returned 0x0 [0091.680] lstrlenW (lpString=".v2i") returned 4 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".v2i") returned 0x0 [0091.680] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.681] lstrlenW (lpString=".sql") returned 4 [0091.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".sql") returned 0x0 [0091.681] lstrlenW (lpString=".mdf") returned 4 [0091.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".mdf") returned 0x0 [0091.681] lstrlenW (lpString=".txt") returned 4 [0091.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".txt") returned 0x0 [0091.682] lstrlenW (lpString=".dbf") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".dbf") returned 0x0 [0091.682] lstrlenW (lpString=".ckp") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".ckp") returned 0x0 [0091.682] lstrlenW (lpString=".dacpac") returned 7 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".dacpac") returned 0x0 [0091.682] lstrlenW (lpString=".db3") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".db3") returned 0x0 [0091.682] lstrlenW (lpString=".dtxs") returned 5 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".dtxs") returned 0x0 [0091.682] lstrlenW (lpString=".mdt") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".mdt") returned 0x0 [0091.682] lstrlenW (lpString=".sdf") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".sdf") returned 0x0 [0091.682] lstrlenW (lpString=".MDF") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".MDF") returned 0x0 [0091.682] lstrlenW (lpString=".DBF") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".DBF") returned 0x0 [0091.682] lstrlenW (lpString=".DB") returned 3 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".DB") returned 0x0 [0091.682] lstrlenW (lpString=".db") returned 3 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".db") returned 0x0 [0091.682] lstrlenW (lpString=".ndf") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".ndf") returned 0x0 [0091.682] lstrlenW (lpString=".NDF") returned 4 [0091.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".NDF") returned 0x0 [0091.683] lstrlenW (lpString=".Mdf") returned 4 [0091.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".Mdf") returned 0x0 [0091.683] lstrlenW (lpString=".dat") returned 4 [0091.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".dat") returned 0x0 [0091.683] lstrlenW (lpString=".DAT") returned 4 [0091.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".DAT") returned 0x0 [0091.683] lstrlenW (lpString=".ldf") returned 4 [0091.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".ldf") returned 0x0 [0091.683] lstrlenW (lpString=".LDF") returned 4 [0091.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch=".LDF") returned 0x0 [0091.683] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.683] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.684] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.684] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21168520685) returned 1 [0091.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5769c70, dwHighDateTime=0x1d585b4)) [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5fd8 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5fd8 | out: hHeap=0x260000) returned 1 [0091.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.685] GetLastError () returned 0x0 [0091.685] GetLastError () returned 0x0 [0091.685] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.685] GetLastError () returned 0x0 [0091.685] GetLastError () returned 0x0 [0091.782] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff8c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.782] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x738, lpOverlapped=0x0) returned 1 [0091.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.782] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.782] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.782] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.782] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.782] CloseHandle (hObject=0xe4) returned 1 [0091.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css.[deadmin@cock.li].deadmin")) returned 1 [0091.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.784] GetLastError () returned 0x0 [0091.784] RtlWakeConditionVariable () returned 0x0 [0091.784] GetCurrentThreadId () returned 0x99c [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".ldf") returned 0x0 [0091.785] lstrlenW (lpString=".vhd") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".vhd") returned 0x0 [0091.785] lstrlenW (lpString=".vhdx") returned 5 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".vhdx") returned 0x0 [0091.785] lstrlenW (lpString=".pst") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".pst") returned 0x0 [0091.785] lstrlenW (lpString=".ost") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".ost") returned 0x0 [0091.785] lstrlenW (lpString=".bak") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".bak") returned 0x0 [0091.785] lstrlenW (lpString=".bac") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".bac") returned 0x0 [0091.785] lstrlenW (lpString=".sys") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".sys") returned 0x0 [0091.785] lstrlenW (lpString=".v2i") returned 4 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".v2i") returned 0x0 [0091.785] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0091.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.787] lstrlenW (lpString=".sql") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".sql") returned 0x0 [0091.787] lstrlenW (lpString=".mdf") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".mdf") returned 0x0 [0091.787] lstrlenW (lpString=".txt") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".txt") returned 0x0 [0091.787] lstrlenW (lpString=".dbf") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".dbf") returned 0x0 [0091.787] lstrlenW (lpString=".ckp") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".ckp") returned 0x0 [0091.787] lstrlenW (lpString=".dacpac") returned 7 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".dacpac") returned 0x0 [0091.787] lstrlenW (lpString=".db3") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".db3") returned 0x0 [0091.787] lstrlenW (lpString=".dtxs") returned 5 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".dtxs") returned 0x0 [0091.787] lstrlenW (lpString=".mdt") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".mdt") returned 0x0 [0091.787] lstrlenW (lpString=".sdf") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".sdf") returned 0x0 [0091.787] lstrlenW (lpString=".MDF") returned 4 [0091.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".MDF") returned 0x0 [0091.787] lstrlenW (lpString=".DBF") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".DBF") returned 0x0 [0091.788] lstrlenW (lpString=".DB") returned 3 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".DB") returned 0x0 [0091.788] lstrlenW (lpString=".db") returned 3 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".db") returned 0x0 [0091.788] lstrlenW (lpString=".ndf") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".ndf") returned 0x0 [0091.788] lstrlenW (lpString=".NDF") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".NDF") returned 0x0 [0091.788] lstrlenW (lpString=".Mdf") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".Mdf") returned 0x0 [0091.788] lstrlenW (lpString=".dat") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".dat") returned 0x0 [0091.788] lstrlenW (lpString=".DAT") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".DAT") returned 0x0 [0091.788] lstrlenW (lpString=".ldf") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".ldf") returned 0x0 [0091.788] lstrlenW (lpString=".LDF") returned 4 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch=".LDF") returned 0x0 [0091.788] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.788] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.789] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.789] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.789] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21179289468) returned 1 [0091.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5874610, dwHighDateTime=0x1d585b4)) [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b61d0 [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b61d0 | out: hHeap=0x260000) returned 1 [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.793] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.793] GetLastError () returned 0x0 [0091.793] GetLastError () returned 0x0 [0091.793] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.793] GetLastError () returned 0x0 [0091.793] GetLastError () returned 0x0 [0091.795] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe405, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.795] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1bfb, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1bfb, lpOverlapped=0x0) returned 1 [0091.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.795] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.795] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.795] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.795] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.795] CloseHandle (hObject=0xe4) returned 1 [0091.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0091.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.798] GetLastError () returned 0x0 [0091.798] RtlWakeConditionVariable () returned 0x0 [0091.798] GetCurrentThreadId () returned 0x99c [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".ldf") returned 0x0 [0091.798] lstrlenW (lpString=".vhd") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".vhd") returned 0x0 [0091.798] lstrlenW (lpString=".vhdx") returned 5 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".vhdx") returned 0x0 [0091.798] lstrlenW (lpString=".pst") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".pst") returned 0x0 [0091.798] lstrlenW (lpString=".ost") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".ost") returned 0x0 [0091.798] lstrlenW (lpString=".bak") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".bak") returned 0x0 [0091.798] lstrlenW (lpString=".bac") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".bac") returned 0x0 [0091.798] lstrlenW (lpString=".sys") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".sys") returned 0x0 [0091.798] lstrlenW (lpString=".v2i") returned 4 [0091.798] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".v2i") returned 0x0 [0091.798] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch="s\r\n.v2i") returned 0x0 [0091.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.800] lstrlenW (lpString=".sql") returned 4 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".sql") returned 0x0 [0091.800] lstrlenW (lpString=".mdf") returned 4 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".mdf") returned 0x0 [0091.800] lstrlenW (lpString=".txt") returned 4 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".txt") returned 0x0 [0091.800] lstrlenW (lpString=".dbf") returned 4 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".dbf") returned 0x0 [0091.800] lstrlenW (lpString=".ckp") returned 4 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".ckp") returned 0x0 [0091.800] lstrlenW (lpString=".dacpac") returned 7 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".dacpac") returned 0x0 [0091.800] lstrlenW (lpString=".db3") returned 4 [0091.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".db3") returned 0x0 [0091.800] lstrlenW (lpString=".dtxs") returned 5 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".dtxs") returned 0x0 [0091.801] lstrlenW (lpString=".mdt") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".mdt") returned 0x0 [0091.801] lstrlenW (lpString=".sdf") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".sdf") returned 0x0 [0091.801] lstrlenW (lpString=".MDF") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".MDF") returned 0x0 [0091.801] lstrlenW (lpString=".DBF") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".DBF") returned 0x0 [0091.801] lstrlenW (lpString=".DB") returned 3 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".DB") returned 0x0 [0091.801] lstrlenW (lpString=".db") returned 3 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".db") returned 0x0 [0091.801] lstrlenW (lpString=".ndf") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".ndf") returned 0x0 [0091.801] lstrlenW (lpString=".NDF") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".NDF") returned 0x0 [0091.801] lstrlenW (lpString=".Mdf") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".Mdf") returned 0x0 [0091.801] lstrlenW (lpString=".dat") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".dat") returned 0x0 [0091.801] lstrlenW (lpString=".DAT") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".DAT") returned 0x0 [0091.801] lstrlenW (lpString=".ldf") returned 4 [0091.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".ldf") returned 0x0 [0091.801] lstrlenW (lpString=".LDF") returned 4 [0091.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch=".LDF") returned 0x0 [0091.802] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.802] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.803] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.803] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21180389082) returned 1 [0091.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5874610, dwHighDateTime=0x1d585b4)) [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6208 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6208 | out: hHeap=0x260000) returned 1 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.803] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.804] GetLastError () returned 0x0 [0091.804] GetLastError () returned 0x0 [0091.804] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.804] GetLastError () returned 0x0 [0091.804] GetLastError () returned 0x0 [0091.807] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffda89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.807] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2577, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x2577, lpOverlapped=0x0) returned 1 [0091.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.807] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.807] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.808] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.808] CloseHandle (hObject=0xe4) returned 1 [0091.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0091.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js.[deadmin@cock.li].deadmin")) returned 1 [0091.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0091.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.810] GetLastError () returned 0x0 [0091.810] RtlWakeConditionVariable () returned 0x0 [0091.810] GetCurrentThreadId () returned 0x99c [0091.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".ldf") returned 0x0 [0091.810] lstrlenW (lpString=".vhd") returned 4 [0091.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".vhd") returned 0x0 [0091.810] lstrlenW (lpString=".vhdx") returned 5 [0091.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".vhdx") returned 0x0 [0091.810] lstrlenW (lpString=".pst") returned 4 [0091.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".pst") returned 0x0 [0091.810] lstrlenW (lpString=".ost") returned 4 [0091.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".ost") returned 0x0 [0091.811] lstrlenW (lpString=".bak") returned 4 [0091.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".bak") returned 0x0 [0091.811] lstrlenW (lpString=".bac") returned 4 [0091.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".bac") returned 0x0 [0091.811] lstrlenW (lpString=".sys") returned 4 [0091.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".sys") returned 0x0 [0091.811] lstrlenW (lpString=".v2i") returned 4 [0091.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".v2i") returned 0x0 [0091.811] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.813] lstrlenW (lpString=".sql") returned 4 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".sql") returned 0x0 [0091.813] lstrlenW (lpString=".mdf") returned 4 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".mdf") returned 0x0 [0091.813] lstrlenW (lpString=".txt") returned 4 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".txt") returned 0x0 [0091.813] lstrlenW (lpString=".dbf") returned 4 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".dbf") returned 0x0 [0091.813] lstrlenW (lpString=".ckp") returned 4 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".ckp") returned 0x0 [0091.813] lstrlenW (lpString=".dacpac") returned 7 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".dacpac") returned 0x0 [0091.813] lstrlenW (lpString=".db3") returned 4 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".db3") returned 0x0 [0091.813] lstrlenW (lpString=".dtxs") returned 5 [0091.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".dtxs") returned 0x0 [0091.813] lstrlenW (lpString=".mdt") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".mdt") returned 0x0 [0091.814] lstrlenW (lpString=".sdf") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".sdf") returned 0x0 [0091.814] lstrlenW (lpString=".MDF") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".MDF") returned 0x0 [0091.814] lstrlenW (lpString=".DBF") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".DBF") returned 0x0 [0091.814] lstrlenW (lpString=".DB") returned 3 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".DB") returned 0x0 [0091.814] lstrlenW (lpString=".db") returned 3 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".db") returned 0x0 [0091.814] lstrlenW (lpString=".ndf") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".ndf") returned 0x0 [0091.814] lstrlenW (lpString=".NDF") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".NDF") returned 0x0 [0091.814] lstrlenW (lpString=".Mdf") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".Mdf") returned 0x0 [0091.814] lstrlenW (lpString=".dat") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".dat") returned 0x0 [0091.814] lstrlenW (lpString=".DAT") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".DAT") returned 0x0 [0091.814] lstrlenW (lpString=".ldf") returned 4 [0091.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".ldf") returned 0x0 [0091.814] lstrlenW (lpString=".LDF") returned 4 [0091.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch=".LDF") returned 0x0 [0091.815] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.815] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.816] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.816] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.816] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21181708054) returned 1 [0091.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc589a770, dwHighDateTime=0x1d585b4)) [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6240 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6240 | out: hHeap=0x260000) returned 1 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.817] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.817] GetLastError () returned 0x0 [0091.817] GetLastError () returned 0x0 [0091.817] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.817] GetLastError () returned 0x0 [0091.817] GetLastError () returned 0x0 [0091.818] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.818] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x267, lpOverlapped=0x0) returned 1 [0091.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.819] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.819] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.819] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.819] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.819] CloseHandle (hObject=0xe4) returned 1 [0091.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0091.819] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0091.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.821] GetLastError () returned 0x0 [0091.821] RtlWakeConditionVariable () returned 0x0 [0091.821] GetCurrentThreadId () returned 0x99c [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".ldf") returned 0x0 [0091.821] lstrlenW (lpString=".vhd") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".vhd") returned 0x0 [0091.821] lstrlenW (lpString=".vhdx") returned 5 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".vhdx") returned 0x0 [0091.821] lstrlenW (lpString=".pst") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".pst") returned 0x0 [0091.821] lstrlenW (lpString=".ost") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".ost") returned 0x0 [0091.821] lstrlenW (lpString=".bak") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".bak") returned 0x0 [0091.821] lstrlenW (lpString=".bac") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".bac") returned 0x0 [0091.821] lstrlenW (lpString=".sys") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".sys") returned 0x0 [0091.821] lstrlenW (lpString=".v2i") returned 4 [0091.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".v2i") returned 0x0 [0091.821] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.822] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.823] lstrlenW (lpString=".sql") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".sql") returned 0x0 [0091.823] lstrlenW (lpString=".mdf") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".mdf") returned 0x0 [0091.823] lstrlenW (lpString=".txt") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".txt") returned 0x0 [0091.823] lstrlenW (lpString=".dbf") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".dbf") returned 0x0 [0091.823] lstrlenW (lpString=".ckp") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".ckp") returned 0x0 [0091.823] lstrlenW (lpString=".dacpac") returned 7 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".dacpac") returned 0x0 [0091.823] lstrlenW (lpString=".db3") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".db3") returned 0x0 [0091.823] lstrlenW (lpString=".dtxs") returned 5 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".dtxs") returned 0x0 [0091.823] lstrlenW (lpString=".mdt") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".mdt") returned 0x0 [0091.823] lstrlenW (lpString=".sdf") returned 4 [0091.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".sdf") returned 0x0 [0091.824] lstrlenW (lpString=".MDF") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".MDF") returned 0x0 [0091.824] lstrlenW (lpString=".DBF") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".DBF") returned 0x0 [0091.824] lstrlenW (lpString=".DB") returned 3 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".DB") returned 0x0 [0091.824] lstrlenW (lpString=".db") returned 3 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".db") returned 0x0 [0091.824] lstrlenW (lpString=".ndf") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".ndf") returned 0x0 [0091.824] lstrlenW (lpString=".NDF") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".NDF") returned 0x0 [0091.824] lstrlenW (lpString=".Mdf") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".Mdf") returned 0x0 [0091.824] lstrlenW (lpString=".dat") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".dat") returned 0x0 [0091.824] lstrlenW (lpString=".DAT") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".DAT") returned 0x0 [0091.824] lstrlenW (lpString=".ldf") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".ldf") returned 0x0 [0091.824] lstrlenW (lpString=".LDF") returned 4 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch=".LDF") returned 0x0 [0091.824] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.825] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.825] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.825] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.825] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21182663740) returned 1 [0091.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc58c08d0, dwHighDateTime=0x1d585b4)) [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6278 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6278 | out: hHeap=0x260000) returned 1 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.826] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.826] GetLastError () returned 0x0 [0091.827] GetLastError () returned 0x0 [0091.827] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.827] GetLastError () returned 0x0 [0091.827] GetLastError () returned 0x0 [0091.829] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff5ad1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.829] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa52f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xa52f, lpOverlapped=0x0) returned 1 [0091.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.829] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.829] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.829] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.829] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.829] CloseHandle (hObject=0xe4) returned 1 [0091.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.831] GetLastError () returned 0x0 [0091.831] RtlWakeConditionVariable () returned 0x0 [0091.831] GetCurrentThreadId () returned 0x99c [0091.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".ldf") returned 0x0 [0091.831] lstrlenW (lpString=".vhd") returned 4 [0091.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".vhd") returned 0x0 [0091.831] lstrlenW (lpString=".vhdx") returned 5 [0091.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".vhdx") returned 0x0 [0091.831] lstrlenW (lpString=".pst") returned 4 [0091.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".pst") returned 0x0 [0091.831] lstrlenW (lpString=".ost") returned 4 [0091.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".ost") returned 0x0 [0091.832] lstrlenW (lpString=".bak") returned 4 [0091.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".bak") returned 0x0 [0091.832] lstrlenW (lpString=".bac") returned 4 [0091.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".bac") returned 0x0 [0091.832] lstrlenW (lpString=".sys") returned 4 [0091.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".sys") returned 0x0 [0091.832] lstrlenW (lpString=".v2i") returned 4 [0091.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".v2i") returned 0x0 [0091.832] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0091.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.833] lstrlenW (lpString=".sql") returned 4 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".sql") returned 0x0 [0091.833] lstrlenW (lpString=".mdf") returned 4 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".mdf") returned 0x0 [0091.833] lstrlenW (lpString=".txt") returned 4 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".txt") returned 0x0 [0091.833] lstrlenW (lpString=".dbf") returned 4 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".dbf") returned 0x0 [0091.833] lstrlenW (lpString=".ckp") returned 4 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".ckp") returned 0x0 [0091.833] lstrlenW (lpString=".dacpac") returned 7 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".dacpac") returned 0x0 [0091.833] lstrlenW (lpString=".db3") returned 4 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".db3") returned 0x0 [0091.833] lstrlenW (lpString=".dtxs") returned 5 [0091.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".dtxs") returned 0x0 [0091.833] lstrlenW (lpString=".mdt") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".mdt") returned 0x0 [0091.834] lstrlenW (lpString=".sdf") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".sdf") returned 0x0 [0091.834] lstrlenW (lpString=".MDF") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".MDF") returned 0x0 [0091.834] lstrlenW (lpString=".DBF") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".DBF") returned 0x0 [0091.834] lstrlenW (lpString=".DB") returned 3 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".DB") returned 0x0 [0091.834] lstrlenW (lpString=".db") returned 3 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".db") returned 0x0 [0091.834] lstrlenW (lpString=".ndf") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".ndf") returned 0x0 [0091.834] lstrlenW (lpString=".NDF") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".NDF") returned 0x0 [0091.834] lstrlenW (lpString=".Mdf") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".Mdf") returned 0x0 [0091.834] lstrlenW (lpString=".dat") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".dat") returned 0x0 [0091.834] lstrlenW (lpString=".DAT") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".DAT") returned 0x0 [0091.834] lstrlenW (lpString=".ldf") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".ldf") returned 0x0 [0091.834] lstrlenW (lpString=".LDF") returned 4 [0091.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch=".LDF") returned 0x0 [0091.834] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.835] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.835] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.835] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.836] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21183673971) returned 1 [0091.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc58c08d0, dwHighDateTime=0x1d585b4)) [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b62b0 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b62b0 | out: hHeap=0x260000) returned 1 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.836] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.836] GetLastError () returned 0x0 [0091.837] GetLastError () returned 0x0 [0091.837] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.837] GetLastError () returned 0x0 [0091.837] GetLastError () returned 0x0 [0091.839] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffde1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.839] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x21e5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x21e5, lpOverlapped=0x0) returned 1 [0091.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.840] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.840] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.840] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.840] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.840] CloseHandle (hObject=0xe4) returned 1 [0091.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0091.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.841] GetLastError () returned 0x0 [0091.841] RtlWakeConditionVariable () returned 0x0 [0091.841] GetCurrentThreadId () returned 0x99c [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".ldf") returned 0x0 [0091.842] lstrlenW (lpString=".vhd") returned 4 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".vhd") returned 0x0 [0091.842] lstrlenW (lpString=".vhdx") returned 5 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".vhdx") returned 0x0 [0091.842] lstrlenW (lpString=".pst") returned 4 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".pst") returned 0x0 [0091.842] lstrlenW (lpString=".ost") returned 4 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".ost") returned 0x0 [0091.842] lstrlenW (lpString=".bak") returned 4 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".bak") returned 0x0 [0091.842] lstrlenW (lpString=".bac") returned 4 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".bac") returned 0x0 [0091.842] lstrlenW (lpString=".sys") returned 4 [0091.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".sys") returned 0x0 [0091.842] lstrlenW (lpString=".v2i") returned 4 [0091.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".v2i") returned 0x0 [0091.843] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.844] lstrlenW (lpString=".sql") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".sql") returned 0x0 [0091.844] lstrlenW (lpString=".mdf") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".mdf") returned 0x0 [0091.844] lstrlenW (lpString=".txt") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".txt") returned 0x0 [0091.844] lstrlenW (lpString=".dbf") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".dbf") returned 0x0 [0091.844] lstrlenW (lpString=".ckp") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".ckp") returned 0x0 [0091.844] lstrlenW (lpString=".dacpac") returned 7 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".dacpac") returned 0x0 [0091.844] lstrlenW (lpString=".db3") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".db3") returned 0x0 [0091.844] lstrlenW (lpString=".dtxs") returned 5 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".dtxs") returned 0x0 [0091.844] lstrlenW (lpString=".mdt") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".mdt") returned 0x0 [0091.844] lstrlenW (lpString=".sdf") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".sdf") returned 0x0 [0091.844] lstrlenW (lpString=".MDF") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".MDF") returned 0x0 [0091.844] lstrlenW (lpString=".DBF") returned 4 [0091.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".DBF") returned 0x0 [0091.844] lstrlenW (lpString=".DB") returned 3 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".DB") returned 0x0 [0091.845] lstrlenW (lpString=".db") returned 3 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".db") returned 0x0 [0091.845] lstrlenW (lpString=".ndf") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".ndf") returned 0x0 [0091.845] lstrlenW (lpString=".NDF") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".NDF") returned 0x0 [0091.845] lstrlenW (lpString=".Mdf") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".Mdf") returned 0x0 [0091.845] lstrlenW (lpString=".dat") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".dat") returned 0x0 [0091.845] lstrlenW (lpString=".DAT") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".DAT") returned 0x0 [0091.845] lstrlenW (lpString=".ldf") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".ldf") returned 0x0 [0091.845] lstrlenW (lpString=".LDF") returned 4 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch=".LDF") returned 0x0 [0091.845] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0091.845] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.846] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0091.846] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.846] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0091.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.846] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21184742819) returned 1 [0091.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc58e6a30, dwHighDateTime=0x1d585b4)) [0091.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b62e8 [0091.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b62e8 | out: hHeap=0x260000) returned 1 [0091.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.847] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.847] GetLastError () returned 0x0 [0091.847] GetLastError () returned 0x0 [0091.847] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.848] GetLastError () returned 0x0 [0091.848] GetLastError () returned 0x0 [0091.849] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.849] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x350, lpOverlapped=0x0) returned 1 [0091.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.849] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.850] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.850] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.850] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.850] CloseHandle (hObject=0xe4) returned 1 [0091.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.851] GetLastError () returned 0x0 [0091.851] RtlWakeConditionVariable () returned 0x0 [0091.851] GetCurrentThreadId () returned 0x99c [0091.851] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".ldf") returned 0x0 [0091.851] lstrlenW (lpString=".vhd") returned 4 [0091.851] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".vhd") returned 0x0 [0091.852] lstrlenW (lpString=".vhdx") returned 5 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".vhdx") returned 0x0 [0091.852] lstrlenW (lpString=".pst") returned 4 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".pst") returned 0x0 [0091.852] lstrlenW (lpString=".ost") returned 4 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".ost") returned 0x0 [0091.852] lstrlenW (lpString=".bak") returned 4 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".bak") returned 0x0 [0091.852] lstrlenW (lpString=".bac") returned 4 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".bac") returned 0x0 [0091.852] lstrlenW (lpString=".sys") returned 4 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".sys") returned 0x0 [0091.852] lstrlenW (lpString=".v2i") returned 4 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".v2i") returned 0x0 [0091.852] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.973] lstrlenW (lpString=".sql") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".sql") returned 0x0 [0091.973] lstrlenW (lpString=".mdf") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".mdf") returned 0x0 [0091.973] lstrlenW (lpString=".txt") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".txt") returned 0x0 [0091.973] lstrlenW (lpString=".dbf") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".dbf") returned 0x0 [0091.973] lstrlenW (lpString=".ckp") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".ckp") returned 0x0 [0091.973] lstrlenW (lpString=".dacpac") returned 7 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".dacpac") returned 0x0 [0091.973] lstrlenW (lpString=".db3") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".db3") returned 0x0 [0091.973] lstrlenW (lpString=".dtxs") returned 5 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".dtxs") returned 0x0 [0091.973] lstrlenW (lpString=".mdt") returned 4 [0091.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".mdt") returned 0x0 [0091.974] lstrlenW (lpString=".sdf") returned 4 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".sdf") returned 0x0 [0091.974] lstrlenW (lpString=".MDF") returned 4 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".MDF") returned 0x0 [0091.974] lstrlenW (lpString=".DBF") returned 4 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".DBF") returned 0x0 [0091.974] lstrlenW (lpString=".DB") returned 3 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".DB") returned 0x0 [0091.974] lstrlenW (lpString=".db") returned 3 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".db") returned 0x0 [0091.974] lstrlenW (lpString=".ndf") returned 4 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".ndf") returned 0x0 [0091.974] lstrlenW (lpString=".NDF") returned 4 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".NDF") returned 0x0 [0091.974] lstrlenW (lpString=".Mdf") returned 4 [0091.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".Mdf") returned 0x0 [0091.975] lstrlenW (lpString=".dat") returned 4 [0091.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".dat") returned 0x0 [0091.975] lstrlenW (lpString=".DAT") returned 4 [0091.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".DAT") returned 0x0 [0091.975] lstrlenW (lpString=".ldf") returned 4 [0091.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".ldf") returned 0x0 [0091.975] lstrlenW (lpString=".LDF") returned 4 [0091.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch=".LDF") returned 0x0 [0091.975] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.975] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.976] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0091.977] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21197772588) returned 1 [0091.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5a17530, dwHighDateTime=0x1d585b4)) [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6518 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6518 | out: hHeap=0x260000) returned 1 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.978] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.978] GetLastError () returned 0x0 [0091.978] GetLastError () returned 0x0 [0091.979] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.979] GetLastError () returned 0x0 [0091.979] GetLastError () returned 0x0 [0091.980] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.980] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x34f, lpOverlapped=0x0) returned 1 [0091.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0091.981] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.981] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.981] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.981] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.981] CloseHandle (hObject=0xe4) returned 1 [0091.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0091.983] GetLastError () returned 0x0 [0091.983] RtlWakeConditionVariable () returned 0x0 [0091.984] GetCurrentThreadId () returned 0x99c [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".ldf") returned 0x0 [0091.984] lstrlenW (lpString=".vhd") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".vhd") returned 0x0 [0091.984] lstrlenW (lpString=".vhdx") returned 5 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".vhdx") returned 0x0 [0091.984] lstrlenW (lpString=".pst") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".pst") returned 0x0 [0091.984] lstrlenW (lpString=".ost") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".ost") returned 0x0 [0091.984] lstrlenW (lpString=".bak") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".bak") returned 0x0 [0091.984] lstrlenW (lpString=".bac") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".bac") returned 0x0 [0091.984] lstrlenW (lpString=".sys") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".sys") returned 0x0 [0091.984] lstrlenW (lpString=".v2i") returned 4 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".v2i") returned 0x0 [0091.984] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.986] lstrlenW (lpString=".sql") returned 4 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".sql") returned 0x0 [0091.986] lstrlenW (lpString=".mdf") returned 4 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".mdf") returned 0x0 [0091.986] lstrlenW (lpString=".txt") returned 4 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".txt") returned 0x0 [0091.986] lstrlenW (lpString=".dbf") returned 4 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".dbf") returned 0x0 [0091.986] lstrlenW (lpString=".ckp") returned 4 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".ckp") returned 0x0 [0091.986] lstrlenW (lpString=".dacpac") returned 7 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".dacpac") returned 0x0 [0091.986] lstrlenW (lpString=".db3") returned 4 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".db3") returned 0x0 [0091.986] lstrlenW (lpString=".dtxs") returned 5 [0091.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".dtxs") returned 0x0 [0091.987] lstrlenW (lpString=".mdt") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".mdt") returned 0x0 [0091.987] lstrlenW (lpString=".sdf") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".sdf") returned 0x0 [0091.987] lstrlenW (lpString=".MDF") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".MDF") returned 0x0 [0091.987] lstrlenW (lpString=".DBF") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".DBF") returned 0x0 [0091.987] lstrlenW (lpString=".DB") returned 3 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".DB") returned 0x0 [0091.987] lstrlenW (lpString=".db") returned 3 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".db") returned 0x0 [0091.987] lstrlenW (lpString=".ndf") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".ndf") returned 0x0 [0091.987] lstrlenW (lpString=".NDF") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".NDF") returned 0x0 [0091.987] lstrlenW (lpString=".Mdf") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".Mdf") returned 0x0 [0091.987] lstrlenW (lpString=".dat") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".dat") returned 0x0 [0091.987] lstrlenW (lpString=".DAT") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".DAT") returned 0x0 [0091.987] lstrlenW (lpString=".ldf") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".ldf") returned 0x0 [0091.987] lstrlenW (lpString=".LDF") returned 4 [0091.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch=".LDF") returned 0x0 [0091.988] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.988] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.988] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.988] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0091.989] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21198977520) returned 1 [0091.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5a3d690, dwHighDateTime=0x1d585b4)) [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6550 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6550 | out: hHeap=0x260000) returned 1 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.989] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0091.989] GetLastError () returned 0x0 [0091.990] GetLastError () returned 0x0 [0091.990] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0091.990] GetLastError () returned 0x0 [0091.990] GetLastError () returned 0x0 [0091.992] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.992] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x352, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x352, lpOverlapped=0x0) returned 1 [0091.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0091.992] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.992] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.992] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.992] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.992] CloseHandle (hObject=0xe4) returned 1 [0091.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0091.994] GetLastError () returned 0x0 [0091.994] RtlWakeConditionVariable () returned 0x0 [0091.994] GetCurrentThreadId () returned 0x99c [0091.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".ldf") returned 0x0 [0091.994] lstrlenW (lpString=".vhd") returned 4 [0091.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".vhd") returned 0x0 [0091.994] lstrlenW (lpString=".vhdx") returned 5 [0091.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".vhdx") returned 0x0 [0091.994] lstrlenW (lpString=".pst") returned 4 [0091.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".pst") returned 0x0 [0091.994] lstrlenW (lpString=".ost") returned 4 [0091.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".ost") returned 0x0 [0091.995] lstrlenW (lpString=".bak") returned 4 [0091.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".bak") returned 0x0 [0091.995] lstrlenW (lpString=".bac") returned 4 [0091.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".bac") returned 0x0 [0091.995] lstrlenW (lpString=".sys") returned 4 [0091.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".sys") returned 0x0 [0091.995] lstrlenW (lpString=".v2i") returned 4 [0091.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".v2i") returned 0x0 [0091.995] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.996] lstrlenW (lpString=".sql") returned 4 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".sql") returned 0x0 [0091.996] lstrlenW (lpString=".mdf") returned 4 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".mdf") returned 0x0 [0091.996] lstrlenW (lpString=".txt") returned 4 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".txt") returned 0x0 [0091.996] lstrlenW (lpString=".dbf") returned 4 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".dbf") returned 0x0 [0091.996] lstrlenW (lpString=".ckp") returned 4 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".ckp") returned 0x0 [0091.996] lstrlenW (lpString=".dacpac") returned 7 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".dacpac") returned 0x0 [0091.996] lstrlenW (lpString=".db3") returned 4 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".db3") returned 0x0 [0091.996] lstrlenW (lpString=".dtxs") returned 5 [0091.996] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".dtxs") returned 0x0 [0091.997] lstrlenW (lpString=".mdt") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".mdt") returned 0x0 [0091.997] lstrlenW (lpString=".sdf") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".sdf") returned 0x0 [0091.997] lstrlenW (lpString=".MDF") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".MDF") returned 0x0 [0091.997] lstrlenW (lpString=".DBF") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".DBF") returned 0x0 [0091.997] lstrlenW (lpString=".DB") returned 3 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".DB") returned 0x0 [0091.997] lstrlenW (lpString=".db") returned 3 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".db") returned 0x0 [0091.997] lstrlenW (lpString=".ndf") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".ndf") returned 0x0 [0091.997] lstrlenW (lpString=".NDF") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".NDF") returned 0x0 [0091.997] lstrlenW (lpString=".Mdf") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".Mdf") returned 0x0 [0091.997] lstrlenW (lpString=".dat") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".dat") returned 0x0 [0091.997] lstrlenW (lpString=".DAT") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".DAT") returned 0x0 [0091.997] lstrlenW (lpString=".ldf") returned 4 [0091.997] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".ldf") returned 0x0 [0091.997] lstrlenW (lpString=".LDF") returned 4 [0091.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch=".LDF") returned 0x0 [0091.998] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.998] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0091.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.999] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0091.999] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21199984685) returned 1 [0091.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5a637f0, dwHighDateTime=0x1d585b4)) [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6588 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6588 | out: hHeap=0x260000) returned 1 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.000] GetLastError () returned 0x0 [0092.000] GetLastError () returned 0x0 [0092.000] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.000] GetLastError () returned 0x0 [0092.000] GetLastError () returned 0x0 [0092.002] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffc8d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.002] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x373, lpOverlapped=0x0) returned 1 [0092.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.002] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.002] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.002] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.002] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.002] CloseHandle (hObject=0xe4) returned 1 [0092.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0092.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0092.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.004] GetLastError () returned 0x0 [0092.004] RtlWakeConditionVariable () returned 0x0 [0092.004] GetCurrentThreadId () returned 0x99c [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".ldf") returned 0x0 [0092.004] lstrlenW (lpString=".vhd") returned 4 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".vhd") returned 0x0 [0092.004] lstrlenW (lpString=".vhdx") returned 5 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".vhdx") returned 0x0 [0092.004] lstrlenW (lpString=".pst") returned 4 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".pst") returned 0x0 [0092.004] lstrlenW (lpString=".ost") returned 4 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".ost") returned 0x0 [0092.004] lstrlenW (lpString=".bak") returned 4 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".bak") returned 0x0 [0092.004] lstrlenW (lpString=".bac") returned 4 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".bac") returned 0x0 [0092.004] lstrlenW (lpString=".sys") returned 4 [0092.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".sys") returned 0x0 [0092.005] lstrlenW (lpString=".v2i") returned 4 [0092.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".v2i") returned 0x0 [0092.005] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.006] lstrlenW (lpString=".sql") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".sql") returned 0x0 [0092.006] lstrlenW (lpString=".mdf") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".mdf") returned 0x0 [0092.006] lstrlenW (lpString=".txt") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".txt") returned 0x0 [0092.006] lstrlenW (lpString=".dbf") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".dbf") returned 0x0 [0092.006] lstrlenW (lpString=".ckp") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".ckp") returned 0x0 [0092.006] lstrlenW (lpString=".dacpac") returned 7 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".dacpac") returned 0x0 [0092.006] lstrlenW (lpString=".db3") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".db3") returned 0x0 [0092.006] lstrlenW (lpString=".dtxs") returned 5 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".dtxs") returned 0x0 [0092.006] lstrlenW (lpString=".mdt") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".mdt") returned 0x0 [0092.006] lstrlenW (lpString=".sdf") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".sdf") returned 0x0 [0092.006] lstrlenW (lpString=".MDF") returned 4 [0092.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".MDF") returned 0x0 [0092.006] lstrlenW (lpString=".DBF") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".DBF") returned 0x0 [0092.007] lstrlenW (lpString=".DB") returned 3 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".DB") returned 0x0 [0092.007] lstrlenW (lpString=".db") returned 3 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".db") returned 0x0 [0092.007] lstrlenW (lpString=".ndf") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".ndf") returned 0x0 [0092.007] lstrlenW (lpString=".NDF") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".NDF") returned 0x0 [0092.007] lstrlenW (lpString=".Mdf") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".Mdf") returned 0x0 [0092.007] lstrlenW (lpString=".dat") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".dat") returned 0x0 [0092.007] lstrlenW (lpString=".DAT") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".DAT") returned 0x0 [0092.007] lstrlenW (lpString=".ldf") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".ldf") returned 0x0 [0092.007] lstrlenW (lpString=".LDF") returned 4 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch=".LDF") returned 0x0 [0092.007] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.007] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.008] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.008] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21200947471) returned 1 [0092.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5a637f0, dwHighDateTime=0x1d585b4)) [0092.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b65c0 [0092.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b65c0 | out: hHeap=0x260000) returned 1 [0092.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b408 [0092.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b408 | out: hHeap=0x260000) returned 1 [0092.123] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.124] GetLastError () returned 0x0 [0092.124] GetLastError () returned 0x0 [0092.124] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.124] GetLastError () returned 0x0 [0092.124] GetLastError () returned 0x0 [0092.125] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.125] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xa0, lpOverlapped=0x0) returned 1 [0092.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.125] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.125] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.126] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.126] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.126] CloseHandle (hObject=0xe4) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.253] GetLastError () returned 0x0 [0092.253] RtlWakeConditionVariable () returned 0x0 [0092.253] GetCurrentThreadId () returned 0x99c [0092.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0092.253] lstrlenW (lpString=".vhd") returned 4 [0092.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".vhd") returned 0x0 [0092.253] lstrlenW (lpString=".vhdx") returned 5 [0092.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".vhdx") returned 0x0 [0092.253] lstrlenW (lpString=".pst") returned 4 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".pst") returned 0x0 [0092.254] lstrlenW (lpString=".ost") returned 4 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".ost") returned 0x0 [0092.254] lstrlenW (lpString=".bak") returned 4 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".bak") returned 0x0 [0092.254] lstrlenW (lpString=".bac") returned 4 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".bac") returned 0x0 [0092.254] lstrlenW (lpString=".sys") returned 4 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".sys") returned 0x0 [0092.254] lstrlenW (lpString=".v2i") returned 4 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".v2i") returned 0x0 [0092.254] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.254] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.255] lstrlenW (lpString=".sql") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".sql") returned 0x0 [0092.256] lstrlenW (lpString=".mdf") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".mdf") returned 0x0 [0092.256] lstrlenW (lpString=".txt") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".txt") returned 0x0 [0092.256] lstrlenW (lpString=".dbf") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".dbf") returned 0x0 [0092.256] lstrlenW (lpString=".ckp") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".ckp") returned 0x0 [0092.256] lstrlenW (lpString=".dacpac") returned 7 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".dacpac") returned 0x0 [0092.256] lstrlenW (lpString=".db3") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".db3") returned 0x0 [0092.256] lstrlenW (lpString=".dtxs") returned 5 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".dtxs") returned 0x0 [0092.256] lstrlenW (lpString=".mdt") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".mdt") returned 0x0 [0092.256] lstrlenW (lpString=".sdf") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".sdf") returned 0x0 [0092.256] lstrlenW (lpString=".MDF") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".MDF") returned 0x0 [0092.256] lstrlenW (lpString=".DBF") returned 4 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".DBF") returned 0x0 [0092.256] lstrlenW (lpString=".DB") returned 3 [0092.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".DB") returned 0x0 [0092.256] lstrlenW (lpString=".db") returned 3 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".db") returned 0x0 [0092.257] lstrlenW (lpString=".ndf") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".ndf") returned 0x0 [0092.257] lstrlenW (lpString=".NDF") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".NDF") returned 0x0 [0092.257] lstrlenW (lpString=".Mdf") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".Mdf") returned 0x0 [0092.257] lstrlenW (lpString=".dat") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".dat") returned 0x0 [0092.257] lstrlenW (lpString=".DAT") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".DAT") returned 0x0 [0092.257] lstrlenW (lpString=".ldf") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".ldf") returned 0x0 [0092.257] lstrlenW (lpString=".LDF") returned 4 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch=".LDF") returned 0x0 [0092.257] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.257] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.258] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.258] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.258] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21225937234) returned 1 [0092.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5cc4df0, dwHighDateTime=0x1d585b4)) [0092.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6b38 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6b38 | out: hHeap=0x260000) returned 1 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.259] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.259] GetLastError () returned 0x0 [0092.260] GetLastError () returned 0x0 [0092.260] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.260] GetLastError () returned 0x0 [0092.260] GetLastError () returned 0x0 [0092.263] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffa41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.263] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x5bf, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x5bf, lpOverlapped=0x0) returned 1 [0092.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.263] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.264] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.264] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.264] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.264] CloseHandle (hObject=0xe4) returned 1 [0092.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0092.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.266] GetLastError () returned 0x0 [0092.266] RtlWakeConditionVariable () returned 0x0 [0092.266] GetCurrentThreadId () returned 0x99c [0092.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".ldf") returned 0x0 [0092.266] lstrlenW (lpString=".vhd") returned 4 [0092.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".vhd") returned 0x0 [0092.266] lstrlenW (lpString=".vhdx") returned 5 [0092.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".vhdx") returned 0x0 [0092.266] lstrlenW (lpString=".pst") returned 4 [0092.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".pst") returned 0x0 [0092.266] lstrlenW (lpString=".ost") returned 4 [0092.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".ost") returned 0x0 [0092.266] lstrlenW (lpString=".bak") returned 4 [0092.266] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".bak") returned 0x0 [0092.266] lstrlenW (lpString=".bac") returned 4 [0092.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".bac") returned 0x0 [0092.267] lstrlenW (lpString=".sys") returned 4 [0092.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".sys") returned 0x0 [0092.267] lstrlenW (lpString=".v2i") returned 4 [0092.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".v2i") returned 0x0 [0092.267] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.267] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.268] lstrlenW (lpString=".sql") returned 4 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".sql") returned 0x0 [0092.268] lstrlenW (lpString=".mdf") returned 4 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".mdf") returned 0x0 [0092.268] lstrlenW (lpString=".txt") returned 4 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".txt") returned 0x0 [0092.268] lstrlenW (lpString=".dbf") returned 4 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".dbf") returned 0x0 [0092.268] lstrlenW (lpString=".ckp") returned 4 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".ckp") returned 0x0 [0092.268] lstrlenW (lpString=".dacpac") returned 7 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".dacpac") returned 0x0 [0092.268] lstrlenW (lpString=".db3") returned 4 [0092.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".db3") returned 0x0 [0092.268] lstrlenW (lpString=".dtxs") returned 5 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".dtxs") returned 0x0 [0092.269] lstrlenW (lpString=".mdt") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".mdt") returned 0x0 [0092.269] lstrlenW (lpString=".sdf") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".sdf") returned 0x0 [0092.269] lstrlenW (lpString=".MDF") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".MDF") returned 0x0 [0092.269] lstrlenW (lpString=".DBF") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".DBF") returned 0x0 [0092.269] lstrlenW (lpString=".DB") returned 3 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".DB") returned 0x0 [0092.269] lstrlenW (lpString=".db") returned 3 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".db") returned 0x0 [0092.269] lstrlenW (lpString=".ndf") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".ndf") returned 0x0 [0092.269] lstrlenW (lpString=".NDF") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".NDF") returned 0x0 [0092.269] lstrlenW (lpString=".Mdf") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".Mdf") returned 0x0 [0092.269] lstrlenW (lpString=".dat") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".dat") returned 0x0 [0092.269] lstrlenW (lpString=".DAT") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".DAT") returned 0x0 [0092.269] lstrlenW (lpString=".ldf") returned 4 [0092.269] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".ldf") returned 0x0 [0092.269] lstrlenW (lpString=".LDF") returned 4 [0092.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch=".LDF") returned 0x0 [0092.270] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.270] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.270] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.271] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.271] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21227182102) returned 1 [0092.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5ceaf50, dwHighDateTime=0x1d585b4)) [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6b70 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6b70 | out: hHeap=0x260000) returned 1 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.271] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.272] GetLastError () returned 0x0 [0092.272] GetLastError () returned 0x0 [0092.272] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.272] GetLastError () returned 0x0 [0092.272] GetLastError () returned 0x0 [0092.274] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffa37, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.274] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x5c9, lpOverlapped=0x0) returned 1 [0092.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.274] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.274] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.274] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.274] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.274] CloseHandle (hObject=0xe4) returned 1 [0092.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.[deadmin@cock.li].deadmin")) returned 1 [0092.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.276] GetLastError () returned 0x0 [0092.276] RtlWakeConditionVariable () returned 0x0 [0092.276] GetCurrentThreadId () returned 0x99c [0092.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.276] lstrlenW (lpString=".vhd") returned 4 [0092.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".vhd") returned 0x0 [0092.276] lstrlenW (lpString=".vhdx") returned 5 [0092.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".vhdx") returned 0x0 [0092.276] lstrlenW (lpString=".pst") returned 4 [0092.276] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".pst") returned 0x0 [0092.277] lstrlenW (lpString=".ost") returned 4 [0092.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".ost") returned 0x0 [0092.277] lstrlenW (lpString=".bak") returned 4 [0092.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".bak") returned 0x0 [0092.277] lstrlenW (lpString=".bac") returned 4 [0092.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".bac") returned 0x0 [0092.277] lstrlenW (lpString=".sys") returned 4 [0092.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".sys") returned 0x0 [0092.277] lstrlenW (lpString=".v2i") returned 4 [0092.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".v2i") returned 0x0 [0092.277] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.277] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.278] lstrlenW (lpString=".sql") returned 4 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".sql") returned 0x0 [0092.278] lstrlenW (lpString=".mdf") returned 4 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".mdf") returned 0x0 [0092.278] lstrlenW (lpString=".txt") returned 4 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".txt") returned 0x0 [0092.278] lstrlenW (lpString=".dbf") returned 4 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".dbf") returned 0x0 [0092.278] lstrlenW (lpString=".ckp") returned 4 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".ckp") returned 0x0 [0092.278] lstrlenW (lpString=".dacpac") returned 7 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".dacpac") returned 0x0 [0092.278] lstrlenW (lpString=".db3") returned 4 [0092.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".db3") returned 0x0 [0092.278] lstrlenW (lpString=".dtxs") returned 5 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".dtxs") returned 0x0 [0092.279] lstrlenW (lpString=".mdt") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".mdt") returned 0x0 [0092.279] lstrlenW (lpString=".sdf") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".sdf") returned 0x0 [0092.279] lstrlenW (lpString=".MDF") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".MDF") returned 0x0 [0092.279] lstrlenW (lpString=".DBF") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".DBF") returned 0x0 [0092.279] lstrlenW (lpString=".DB") returned 3 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".DB") returned 0x0 [0092.279] lstrlenW (lpString=".db") returned 3 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".db") returned 0x0 [0092.279] lstrlenW (lpString=".ndf") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".ndf") returned 0x0 [0092.279] lstrlenW (lpString=".NDF") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".NDF") returned 0x0 [0092.279] lstrlenW (lpString=".Mdf") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".Mdf") returned 0x0 [0092.279] lstrlenW (lpString=".dat") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".dat") returned 0x0 [0092.279] lstrlenW (lpString=".DAT") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".DAT") returned 0x0 [0092.279] lstrlenW (lpString=".ldf") returned 4 [0092.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.280] lstrlenW (lpString=".LDF") returned 4 [0092.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch=".LDF") returned 0x0 [0092.280] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.280] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.280] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.281] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.281] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21228183051) returned 1 [0092.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5d110b0, dwHighDateTime=0x1d585b4)) [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6ba8 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6ba8 | out: hHeap=0x260000) returned 1 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.281] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.282] GetLastError () returned 0x0 [0092.282] GetLastError () returned 0x0 [0092.282] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.282] GetLastError () returned 0x0 [0092.282] GetLastError () returned 0x0 [0092.399] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffeb67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.399] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1499, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x1499, lpOverlapped=0x0) returned 1 [0092.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.399] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.399] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.400] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.400] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.400] CloseHandle (hObject=0xe4) returned 1 [0092.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.401] GetLastError () returned 0x0 [0092.401] RtlWakeConditionVariable () returned 0x0 [0092.402] GetCurrentThreadId () returned 0x99c [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".ldf") returned 0x0 [0092.402] lstrlenW (lpString=".vhd") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".vhd") returned 0x0 [0092.402] lstrlenW (lpString=".vhdx") returned 5 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".vhdx") returned 0x0 [0092.402] lstrlenW (lpString=".pst") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".pst") returned 0x0 [0092.402] lstrlenW (lpString=".ost") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".ost") returned 0x0 [0092.402] lstrlenW (lpString=".bak") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".bak") returned 0x0 [0092.402] lstrlenW (lpString=".bac") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".bac") returned 0x0 [0092.402] lstrlenW (lpString=".sys") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".sys") returned 0x0 [0092.402] lstrlenW (lpString=".v2i") returned 4 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".v2i") returned 0x0 [0092.402] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.403] lstrlenW (lpString=".sql") returned 4 [0092.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".sql") returned 0x0 [0092.404] lstrlenW (lpString=".mdf") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".mdf") returned 0x0 [0092.404] lstrlenW (lpString=".txt") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".txt") returned 0x0 [0092.404] lstrlenW (lpString=".dbf") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".dbf") returned 0x0 [0092.404] lstrlenW (lpString=".ckp") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".ckp") returned 0x0 [0092.404] lstrlenW (lpString=".dacpac") returned 7 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".dacpac") returned 0x0 [0092.404] lstrlenW (lpString=".db3") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".db3") returned 0x0 [0092.404] lstrlenW (lpString=".dtxs") returned 5 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".dtxs") returned 0x0 [0092.404] lstrlenW (lpString=".mdt") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".mdt") returned 0x0 [0092.404] lstrlenW (lpString=".sdf") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".sdf") returned 0x0 [0092.404] lstrlenW (lpString=".MDF") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".MDF") returned 0x0 [0092.404] lstrlenW (lpString=".DBF") returned 4 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".DBF") returned 0x0 [0092.404] lstrlenW (lpString=".DB") returned 3 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".DB") returned 0x0 [0092.404] lstrlenW (lpString=".db") returned 3 [0092.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".db") returned 0x0 [0092.404] lstrlenW (lpString=".ndf") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".ndf") returned 0x0 [0092.405] lstrlenW (lpString=".NDF") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".NDF") returned 0x0 [0092.405] lstrlenW (lpString=".Mdf") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".Mdf") returned 0x0 [0092.405] lstrlenW (lpString=".dat") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".dat") returned 0x0 [0092.405] lstrlenW (lpString=".DAT") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".DAT") returned 0x0 [0092.405] lstrlenW (lpString=".ldf") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".ldf") returned 0x0 [0092.405] lstrlenW (lpString=".LDF") returned 4 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch=".LDF") returned 0x0 [0092.405] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.405] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.406] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.406] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.406] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21240731176) returned 1 [0092.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5e41bb0, dwHighDateTime=0x1d585b4)) [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6e48 [0092.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6e48 | out: hHeap=0x260000) returned 1 [0092.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.407] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.407] GetLastError () returned 0x0 [0092.407] GetLastError () returned 0x0 [0092.407] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.407] GetLastError () returned 0x0 [0092.408] GetLastError () returned 0x0 [0092.409] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffca1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.409] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x35f, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x35f, lpOverlapped=0x0) returned 1 [0092.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.409] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.409] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.410] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.410] CloseHandle (hObject=0xe4) returned 1 [0092.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.411] GetLastError () returned 0x0 [0092.411] RtlWakeConditionVariable () returned 0x0 [0092.411] GetCurrentThreadId () returned 0x99c [0092.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".ldf") returned 0x0 [0092.411] lstrlenW (lpString=".vhd") returned 4 [0092.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".vhd") returned 0x0 [0092.412] lstrlenW (lpString=".vhdx") returned 5 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".vhdx") returned 0x0 [0092.412] lstrlenW (lpString=".pst") returned 4 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".pst") returned 0x0 [0092.412] lstrlenW (lpString=".ost") returned 4 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".ost") returned 0x0 [0092.412] lstrlenW (lpString=".bak") returned 4 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".bak") returned 0x0 [0092.412] lstrlenW (lpString=".bac") returned 4 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".bac") returned 0x0 [0092.412] lstrlenW (lpString=".sys") returned 4 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".sys") returned 0x0 [0092.412] lstrlenW (lpString=".v2i") returned 4 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".v2i") returned 0x0 [0092.412] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.413] lstrlenW (lpString=".sql") returned 4 [0092.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".sql") returned 0x0 [0092.413] lstrlenW (lpString=".mdf") returned 4 [0092.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".mdf") returned 0x0 [0092.413] lstrlenW (lpString=".txt") returned 4 [0092.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".txt") returned 0x0 [0092.413] lstrlenW (lpString=".dbf") returned 4 [0092.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".dbf") returned 0x0 [0092.414] lstrlenW (lpString=".ckp") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".ckp") returned 0x0 [0092.414] lstrlenW (lpString=".dacpac") returned 7 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".dacpac") returned 0x0 [0092.414] lstrlenW (lpString=".db3") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".db3") returned 0x0 [0092.414] lstrlenW (lpString=".dtxs") returned 5 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".dtxs") returned 0x0 [0092.414] lstrlenW (lpString=".mdt") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".mdt") returned 0x0 [0092.414] lstrlenW (lpString=".sdf") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".sdf") returned 0x0 [0092.414] lstrlenW (lpString=".MDF") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".MDF") returned 0x0 [0092.414] lstrlenW (lpString=".DBF") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".DBF") returned 0x0 [0092.414] lstrlenW (lpString=".DB") returned 3 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".DB") returned 0x0 [0092.414] lstrlenW (lpString=".db") returned 3 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".db") returned 0x0 [0092.414] lstrlenW (lpString=".ndf") returned 4 [0092.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".ndf") returned 0x0 [0092.414] lstrlenW (lpString=".NDF") returned 4 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".NDF") returned 0x0 [0092.415] lstrlenW (lpString=".Mdf") returned 4 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".Mdf") returned 0x0 [0092.415] lstrlenW (lpString=".dat") returned 4 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".dat") returned 0x0 [0092.415] lstrlenW (lpString=".DAT") returned 4 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".DAT") returned 0x0 [0092.415] lstrlenW (lpString=".ldf") returned 4 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".ldf") returned 0x0 [0092.415] lstrlenW (lpString=".LDF") returned 4 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch=".LDF") returned 0x0 [0092.415] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.415] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.416] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.416] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.416] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21241723607) returned 1 [0092.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5e67d10, dwHighDateTime=0x1d585b4)) [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6e80 [0092.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6e80 | out: hHeap=0x260000) returned 1 [0092.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.417] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.417] GetLastError () returned 0x0 [0092.417] GetLastError () returned 0x0 [0092.417] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.417] GetLastError () returned 0x0 [0092.418] GetLastError () returned 0x0 [0092.418] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.419] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xf1, lpOverlapped=0x0) returned 1 [0092.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.419] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.419] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.419] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.419] CloseHandle (hObject=0xe4) returned 1 [0092.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.421] GetLastError () returned 0x0 [0092.421] RtlWakeConditionVariable () returned 0x27e828 [0092.421] GetCurrentThreadId () returned 0x99c [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".ldf") returned 0x0 [0092.421] lstrlenW (lpString=".vhd") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".vhd") returned 0x0 [0092.421] lstrlenW (lpString=".vhdx") returned 5 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".vhdx") returned 0x0 [0092.421] lstrlenW (lpString=".pst") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".pst") returned 0x0 [0092.421] lstrlenW (lpString=".ost") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".ost") returned 0x0 [0092.421] lstrlenW (lpString=".bak") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".bak") returned 0x0 [0092.421] lstrlenW (lpString=".bac") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".bac") returned 0x0 [0092.421] lstrlenW (lpString=".sys") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".sys") returned 0x0 [0092.421] lstrlenW (lpString=".v2i") returned 4 [0092.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".v2i") returned 0x0 [0092.422] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.423] lstrlenW (lpString=".sql") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".sql") returned 0x0 [0092.423] lstrlenW (lpString=".mdf") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".mdf") returned 0x0 [0092.423] lstrlenW (lpString=".txt") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".txt") returned 0x0 [0092.423] lstrlenW (lpString=".dbf") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".dbf") returned 0x0 [0092.423] lstrlenW (lpString=".ckp") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".ckp") returned 0x0 [0092.423] lstrlenW (lpString=".dacpac") returned 7 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".dacpac") returned 0x0 [0092.423] lstrlenW (lpString=".db3") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".db3") returned 0x0 [0092.423] lstrlenW (lpString=".dtxs") returned 5 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".dtxs") returned 0x0 [0092.423] lstrlenW (lpString=".mdt") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".mdt") returned 0x0 [0092.423] lstrlenW (lpString=".sdf") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".sdf") returned 0x0 [0092.423] lstrlenW (lpString=".MDF") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".MDF") returned 0x0 [0092.423] lstrlenW (lpString=".DBF") returned 4 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".DBF") returned 0x0 [0092.423] lstrlenW (lpString=".DB") returned 3 [0092.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".DB") returned 0x0 [0092.424] lstrlenW (lpString=".db") returned 3 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".db") returned 0x0 [0092.424] lstrlenW (lpString=".ndf") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".ndf") returned 0x0 [0092.424] lstrlenW (lpString=".NDF") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".NDF") returned 0x0 [0092.424] lstrlenW (lpString=".Mdf") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".Mdf") returned 0x0 [0092.424] lstrlenW (lpString=".dat") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".dat") returned 0x0 [0092.424] lstrlenW (lpString=".DAT") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".DAT") returned 0x0 [0092.424] lstrlenW (lpString=".ldf") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".ldf") returned 0x0 [0092.424] lstrlenW (lpString=".LDF") returned 4 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch=".LDF") returned 0x0 [0092.424] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.424] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.425] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.425] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21242637714) returned 1 [0092.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5e67d10, dwHighDateTime=0x1d585b4)) [0092.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6eb8 [0092.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6eb8 | out: hHeap=0x260000) returned 1 [0092.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.426] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.426] GetLastError () returned 0x0 [0092.426] GetLastError () returned 0x0 [0092.426] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.426] GetLastError () returned 0x0 [0092.427] GetLastError () returned 0x0 [0092.428] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffca3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.428] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x35d, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x35d, lpOverlapped=0x0) returned 1 [0092.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.428] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.429] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.429] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.429] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.429] CloseHandle (hObject=0xe4) returned 1 [0092.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.433] GetLastError () returned 0x0 [0092.433] RtlWakeConditionVariable () returned 0x0 [0092.433] GetCurrentThreadId () returned 0x99c [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".ldf") returned 0x0 [0092.433] lstrlenW (lpString=".vhd") returned 4 [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".vhd") returned 0x0 [0092.433] lstrlenW (lpString=".vhdx") returned 5 [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".vhdx") returned 0x0 [0092.433] lstrlenW (lpString=".pst") returned 4 [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".pst") returned 0x0 [0092.433] lstrlenW (lpString=".ost") returned 4 [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".ost") returned 0x0 [0092.433] lstrlenW (lpString=".bak") returned 4 [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".bak") returned 0x0 [0092.433] lstrlenW (lpString=".bac") returned 4 [0092.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".bac") returned 0x0 [0092.433] lstrlenW (lpString=".sys") returned 4 [0092.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".sys") returned 0x0 [0092.434] lstrlenW (lpString=".v2i") returned 4 [0092.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".v2i") returned 0x0 [0092.434] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.435] lstrlenW (lpString=".sql") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".sql") returned 0x0 [0092.435] lstrlenW (lpString=".mdf") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".mdf") returned 0x0 [0092.435] lstrlenW (lpString=".txt") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".txt") returned 0x0 [0092.435] lstrlenW (lpString=".dbf") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".dbf") returned 0x0 [0092.435] lstrlenW (lpString=".ckp") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".ckp") returned 0x0 [0092.435] lstrlenW (lpString=".dacpac") returned 7 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".dacpac") returned 0x0 [0092.435] lstrlenW (lpString=".db3") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".db3") returned 0x0 [0092.435] lstrlenW (lpString=".dtxs") returned 5 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".dtxs") returned 0x0 [0092.435] lstrlenW (lpString=".mdt") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".mdt") returned 0x0 [0092.435] lstrlenW (lpString=".sdf") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".sdf") returned 0x0 [0092.435] lstrlenW (lpString=".MDF") returned 4 [0092.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".MDF") returned 0x0 [0092.435] lstrlenW (lpString=".DBF") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".DBF") returned 0x0 [0092.436] lstrlenW (lpString=".DB") returned 3 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".DB") returned 0x0 [0092.436] lstrlenW (lpString=".db") returned 3 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".db") returned 0x0 [0092.436] lstrlenW (lpString=".ndf") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".ndf") returned 0x0 [0092.436] lstrlenW (lpString=".NDF") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".NDF") returned 0x0 [0092.436] lstrlenW (lpString=".Mdf") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".Mdf") returned 0x0 [0092.436] lstrlenW (lpString=".dat") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".dat") returned 0x0 [0092.436] lstrlenW (lpString=".DAT") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".DAT") returned 0x0 [0092.436] lstrlenW (lpString=".ldf") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".ldf") returned 0x0 [0092.436] lstrlenW (lpString=".LDF") returned 4 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch=".LDF") returned 0x0 [0092.436] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.436] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.437] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.437] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.437] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21243847863) returned 1 [0092.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5e8de70, dwHighDateTime=0x1d585b4)) [0092.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6ef0 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6ef0 | out: hHeap=0x260000) returned 1 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.438] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.438] GetLastError () returned 0x0 [0092.438] GetLastError () returned 0x0 [0092.438] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.439] GetLastError () returned 0x0 [0092.439] GetLastError () returned 0x0 [0092.554] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.554] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x352, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x352, lpOverlapped=0x0) returned 1 [0092.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.554] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.554] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.554] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.554] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.554] CloseHandle (hObject=0xe4) returned 1 [0092.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.555] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.556] GetLastError () returned 0x0 [0092.556] RtlWakeConditionVariable () returned 0x0 [0092.557] GetCurrentThreadId () returned 0x99c [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".ldf") returned 0x0 [0092.557] lstrlenW (lpString=".vhd") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".vhd") returned 0x0 [0092.557] lstrlenW (lpString=".vhdx") returned 5 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.557] lstrlenW (lpString=".pst") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".pst") returned 0x0 [0092.557] lstrlenW (lpString=".ost") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".ost") returned 0x0 [0092.557] lstrlenW (lpString=".bak") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".bak") returned 0x0 [0092.557] lstrlenW (lpString=".bac") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".bac") returned 0x0 [0092.557] lstrlenW (lpString=".sys") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".sys") returned 0x0 [0092.557] lstrlenW (lpString=".v2i") returned 4 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".v2i") returned 0x0 [0092.557] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.559] lstrlenW (lpString=".sql") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".sql") returned 0x0 [0092.559] lstrlenW (lpString=".mdf") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".mdf") returned 0x0 [0092.559] lstrlenW (lpString=".txt") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".txt") returned 0x0 [0092.559] lstrlenW (lpString=".dbf") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".dbf") returned 0x0 [0092.559] lstrlenW (lpString=".ckp") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".ckp") returned 0x0 [0092.559] lstrlenW (lpString=".dacpac") returned 7 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.559] lstrlenW (lpString=".db3") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".db3") returned 0x0 [0092.559] lstrlenW (lpString=".dtxs") returned 5 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.559] lstrlenW (lpString=".mdt") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".mdt") returned 0x0 [0092.559] lstrlenW (lpString=".sdf") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".sdf") returned 0x0 [0092.559] lstrlenW (lpString=".MDF") returned 4 [0092.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".MDF") returned 0x0 [0092.559] lstrlenW (lpString=".DBF") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".DBF") returned 0x0 [0092.560] lstrlenW (lpString=".DB") returned 3 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".DB") returned 0x0 [0092.560] lstrlenW (lpString=".db") returned 3 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".db") returned 0x0 [0092.560] lstrlenW (lpString=".ndf") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".ndf") returned 0x0 [0092.560] lstrlenW (lpString=".NDF") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".NDF") returned 0x0 [0092.560] lstrlenW (lpString=".Mdf") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.560] lstrlenW (lpString=".dat") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".dat") returned 0x0 [0092.560] lstrlenW (lpString=".DAT") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".DAT") returned 0x0 [0092.560] lstrlenW (lpString=".ldf") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".ldf") returned 0x0 [0092.560] lstrlenW (lpString=".LDF") returned 4 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch=".LDF") returned 0x0 [0092.560] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.560] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.561] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.561] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21256244004) returned 1 [0092.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5fbe970, dwHighDateTime=0x1d585b4)) [0092.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7190 [0092.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7190 | out: hHeap=0x260000) returned 1 [0092.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.562] GetLastError () returned 0x0 [0092.562] GetLastError () returned 0x0 [0092.562] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.562] GetLastError () returned 0x0 [0092.563] GetLastError () returned 0x0 [0092.564] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff948, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.564] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x6b8, lpOverlapped=0x0) returned 1 [0092.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.564] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.564] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.565] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.565] CloseHandle (hObject=0xe4) returned 1 [0092.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.567] GetLastError () returned 0x0 [0092.567] RtlWakeConditionVariable () returned 0x0 [0092.567] GetCurrentThreadId () returned 0x99c [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.567] lstrlenW (lpString=".vhd") returned 4 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".vhd") returned 0x0 [0092.567] lstrlenW (lpString=".vhdx") returned 5 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".vhdx") returned 0x0 [0092.567] lstrlenW (lpString=".pst") returned 4 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".pst") returned 0x0 [0092.567] lstrlenW (lpString=".ost") returned 4 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".ost") returned 0x0 [0092.567] lstrlenW (lpString=".bak") returned 4 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".bak") returned 0x0 [0092.567] lstrlenW (lpString=".bac") returned 4 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".bac") returned 0x0 [0092.567] lstrlenW (lpString=".sys") returned 4 [0092.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".sys") returned 0x0 [0092.567] lstrlenW (lpString=".v2i") returned 4 [0092.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".v2i") returned 0x0 [0092.568] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.570] lstrlenW (lpString=".sql") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".sql") returned 0x0 [0092.570] lstrlenW (lpString=".mdf") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".mdf") returned 0x0 [0092.570] lstrlenW (lpString=".txt") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".txt") returned 0x0 [0092.570] lstrlenW (lpString=".dbf") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".dbf") returned 0x0 [0092.570] lstrlenW (lpString=".ckp") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".ckp") returned 0x0 [0092.570] lstrlenW (lpString=".dacpac") returned 7 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".dacpac") returned 0x0 [0092.570] lstrlenW (lpString=".db3") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".db3") returned 0x0 [0092.570] lstrlenW (lpString=".dtxs") returned 5 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".dtxs") returned 0x0 [0092.570] lstrlenW (lpString=".mdt") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".mdt") returned 0x0 [0092.570] lstrlenW (lpString=".sdf") returned 4 [0092.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".sdf") returned 0x0 [0092.571] lstrlenW (lpString=".MDF") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".MDF") returned 0x0 [0092.571] lstrlenW (lpString=".DBF") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".DBF") returned 0x0 [0092.571] lstrlenW (lpString=".DB") returned 3 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".DB") returned 0x0 [0092.571] lstrlenW (lpString=".db") returned 3 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".db") returned 0x0 [0092.571] lstrlenW (lpString=".ndf") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".ndf") returned 0x0 [0092.571] lstrlenW (lpString=".NDF") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".NDF") returned 0x0 [0092.571] lstrlenW (lpString=".Mdf") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".Mdf") returned 0x0 [0092.571] lstrlenW (lpString=".dat") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".dat") returned 0x0 [0092.571] lstrlenW (lpString=".DAT") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".DAT") returned 0x0 [0092.571] lstrlenW (lpString=".ldf") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.571] lstrlenW (lpString=".LDF") returned 4 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch=".LDF") returned 0x0 [0092.571] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.571] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.573] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.573] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21257381051) returned 1 [0092.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5fe4ad0, dwHighDateTime=0x1d585b4)) [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b71c8 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b71c8 | out: hHeap=0x260000) returned 1 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.574] GetLastError () returned 0x0 [0092.574] GetLastError () returned 0x0 [0092.574] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.574] GetLastError () returned 0x0 [0092.574] GetLastError () returned 0x0 [0092.576] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe617, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.576] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19e9, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19e9, lpOverlapped=0x0) returned 1 [0092.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.576] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.576] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.576] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.576] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.576] CloseHandle (hObject=0xe4) returned 1 [0092.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.578] GetLastError () returned 0x0 [0092.579] RtlWakeConditionVariable () returned 0x0 [0092.579] GetCurrentThreadId () returned 0x99c [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.579] lstrlenW (lpString=".vhd") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".vhd") returned 0x0 [0092.579] lstrlenW (lpString=".vhdx") returned 5 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.579] lstrlenW (lpString=".pst") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".pst") returned 0x0 [0092.579] lstrlenW (lpString=".ost") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".ost") returned 0x0 [0092.579] lstrlenW (lpString=".bak") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".bak") returned 0x0 [0092.579] lstrlenW (lpString=".bac") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".bac") returned 0x0 [0092.579] lstrlenW (lpString=".sys") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".sys") returned 0x0 [0092.579] lstrlenW (lpString=".v2i") returned 4 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".v2i") returned 0x0 [0092.579] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.581] lstrlenW (lpString=".sql") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".sql") returned 0x0 [0092.581] lstrlenW (lpString=".mdf") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".mdf") returned 0x0 [0092.581] lstrlenW (lpString=".txt") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".txt") returned 0x0 [0092.581] lstrlenW (lpString=".dbf") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".dbf") returned 0x0 [0092.581] lstrlenW (lpString=".ckp") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".ckp") returned 0x0 [0092.581] lstrlenW (lpString=".dacpac") returned 7 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.581] lstrlenW (lpString=".db3") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".db3") returned 0x0 [0092.581] lstrlenW (lpString=".dtxs") returned 5 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.581] lstrlenW (lpString=".mdt") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".mdt") returned 0x0 [0092.581] lstrlenW (lpString=".sdf") returned 4 [0092.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".sdf") returned 0x0 [0092.582] lstrlenW (lpString=".MDF") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".MDF") returned 0x0 [0092.582] lstrlenW (lpString=".DBF") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".DBF") returned 0x0 [0092.582] lstrlenW (lpString=".DB") returned 3 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".DB") returned 0x0 [0092.582] lstrlenW (lpString=".db") returned 3 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".db") returned 0x0 [0092.582] lstrlenW (lpString=".ndf") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".ndf") returned 0x0 [0092.582] lstrlenW (lpString=".NDF") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".NDF") returned 0x0 [0092.582] lstrlenW (lpString=".Mdf") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.582] lstrlenW (lpString=".dat") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".dat") returned 0x0 [0092.582] lstrlenW (lpString=".DAT") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".DAT") returned 0x0 [0092.582] lstrlenW (lpString=".ldf") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".ldf") returned 0x0 [0092.582] lstrlenW (lpString=".LDF") returned 4 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch=".LDF") returned 0x0 [0092.582] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.583] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.583] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.583] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.584] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21258464837) returned 1 [0092.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc5fe4ad0, dwHighDateTime=0x1d585b4)) [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7200 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7200 | out: hHeap=0x260000) returned 1 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.584] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.584] GetLastError () returned 0x0 [0092.585] GetLastError () returned 0x0 [0092.585] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.585] GetLastError () returned 0x0 [0092.585] GetLastError () returned 0x0 [0092.587] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff5f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.587] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xa10, lpOverlapped=0x0) returned 1 [0092.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.587] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.587] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.587] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.587] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.587] CloseHandle (hObject=0xe4) returned 1 [0092.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0092.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0092.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.589] GetLastError () returned 0x0 [0092.589] RtlWakeConditionVariable () returned 0x0 [0092.590] GetCurrentThreadId () returned 0x99c [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".ldf") returned 0x0 [0092.590] lstrlenW (lpString=".vhd") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".vhd") returned 0x0 [0092.590] lstrlenW (lpString=".vhdx") returned 5 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".vhdx") returned 0x0 [0092.590] lstrlenW (lpString=".pst") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".pst") returned 0x0 [0092.590] lstrlenW (lpString=".ost") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".ost") returned 0x0 [0092.590] lstrlenW (lpString=".bak") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".bak") returned 0x0 [0092.590] lstrlenW (lpString=".bac") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".bac") returned 0x0 [0092.590] lstrlenW (lpString=".sys") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".sys") returned 0x0 [0092.590] lstrlenW (lpString=".v2i") returned 4 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".v2i") returned 0x0 [0092.590] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.592] lstrlenW (lpString=".sql") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".sql") returned 0x0 [0092.592] lstrlenW (lpString=".mdf") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".mdf") returned 0x0 [0092.592] lstrlenW (lpString=".txt") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".txt") returned 0x0 [0092.592] lstrlenW (lpString=".dbf") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".dbf") returned 0x0 [0092.592] lstrlenW (lpString=".ckp") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".ckp") returned 0x0 [0092.592] lstrlenW (lpString=".dacpac") returned 7 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".dacpac") returned 0x0 [0092.592] lstrlenW (lpString=".db3") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".db3") returned 0x0 [0092.592] lstrlenW (lpString=".dtxs") returned 5 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".dtxs") returned 0x0 [0092.592] lstrlenW (lpString=".mdt") returned 4 [0092.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".mdt") returned 0x0 [0092.592] lstrlenW (lpString=".sdf") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".sdf") returned 0x0 [0092.593] lstrlenW (lpString=".MDF") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".MDF") returned 0x0 [0092.593] lstrlenW (lpString=".DBF") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".DBF") returned 0x0 [0092.593] lstrlenW (lpString=".DB") returned 3 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".DB") returned 0x0 [0092.593] lstrlenW (lpString=".db") returned 3 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".db") returned 0x0 [0092.593] lstrlenW (lpString=".ndf") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".ndf") returned 0x0 [0092.593] lstrlenW (lpString=".NDF") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".NDF") returned 0x0 [0092.593] lstrlenW (lpString=".Mdf") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".Mdf") returned 0x0 [0092.593] lstrlenW (lpString=".dat") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".dat") returned 0x0 [0092.593] lstrlenW (lpString=".DAT") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".DAT") returned 0x0 [0092.593] lstrlenW (lpString=".ldf") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".ldf") returned 0x0 [0092.593] lstrlenW (lpString=".LDF") returned 4 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch=".LDF") returned 0x0 [0092.593] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.593] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.594] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.594] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.594] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.595] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21259569869) returned 1 [0092.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc600ac30, dwHighDateTime=0x1d585b4)) [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7238 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7238 | out: hHeap=0x260000) returned 1 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.595] GetLastError () returned 0x0 [0092.596] GetLastError () returned 0x0 [0092.596] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.596] GetLastError () returned 0x0 [0092.596] GetLastError () returned 0x0 [0092.718] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdff2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.718] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x200e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x200e, lpOverlapped=0x0) returned 1 [0092.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.719] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.719] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.719] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.719] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.719] CloseHandle (hObject=0xe4) returned 1 [0092.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0092.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0092.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.721] GetLastError () returned 0x0 [0092.721] RtlWakeConditionVariable () returned 0x0 [0092.721] GetCurrentThreadId () returned 0x99c [0092.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".ldf") returned 0x0 [0092.721] lstrlenW (lpString=".vhd") returned 4 [0092.721] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".vhd") returned 0x0 [0092.722] lstrlenW (lpString=".vhdx") returned 5 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.722] lstrlenW (lpString=".pst") returned 4 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".pst") returned 0x0 [0092.722] lstrlenW (lpString=".ost") returned 4 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".ost") returned 0x0 [0092.722] lstrlenW (lpString=".bak") returned 4 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".bak") returned 0x0 [0092.722] lstrlenW (lpString=".bac") returned 4 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".bac") returned 0x0 [0092.722] lstrlenW (lpString=".sys") returned 4 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".sys") returned 0x0 [0092.722] lstrlenW (lpString=".v2i") returned 4 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".v2i") returned 0x0 [0092.722] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.723] lstrlenW (lpString=".sql") returned 4 [0092.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".sql") returned 0x0 [0092.723] lstrlenW (lpString=".mdf") returned 4 [0092.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".mdf") returned 0x0 [0092.723] lstrlenW (lpString=".txt") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".txt") returned 0x0 [0092.724] lstrlenW (lpString=".dbf") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".dbf") returned 0x0 [0092.724] lstrlenW (lpString=".ckp") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".ckp") returned 0x0 [0092.724] lstrlenW (lpString=".dacpac") returned 7 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.724] lstrlenW (lpString=".db3") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".db3") returned 0x0 [0092.724] lstrlenW (lpString=".dtxs") returned 5 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.724] lstrlenW (lpString=".mdt") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".mdt") returned 0x0 [0092.724] lstrlenW (lpString=".sdf") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".sdf") returned 0x0 [0092.724] lstrlenW (lpString=".MDF") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".MDF") returned 0x0 [0092.724] lstrlenW (lpString=".DBF") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".DBF") returned 0x0 [0092.724] lstrlenW (lpString=".DB") returned 3 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".DB") returned 0x0 [0092.724] lstrlenW (lpString=".db") returned 3 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".db") returned 0x0 [0092.724] lstrlenW (lpString=".ndf") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".ndf") returned 0x0 [0092.724] lstrlenW (lpString=".NDF") returned 4 [0092.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".NDF") returned 0x0 [0092.725] lstrlenW (lpString=".Mdf") returned 4 [0092.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.725] lstrlenW (lpString=".dat") returned 4 [0092.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".dat") returned 0x0 [0092.725] lstrlenW (lpString=".DAT") returned 4 [0092.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".DAT") returned 0x0 [0092.725] lstrlenW (lpString=".ldf") returned 4 [0092.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".ldf") returned 0x0 [0092.725] lstrlenW (lpString=".LDF") returned 4 [0092.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch=".LDF") returned 0x0 [0092.725] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.725] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.726] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.726] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.726] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21272721048) returned 1 [0092.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc613b730, dwHighDateTime=0x1d585b4)) [0092.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7580 [0092.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7580 | out: hHeap=0x260000) returned 1 [0092.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.727] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.727] GetLastError () returned 0x0 [0092.727] GetLastError () returned 0x0 [0092.727] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.728] GetLastError () returned 0x0 [0092.728] GetLastError () returned 0x0 [0092.730] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffebf88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.730] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x14078, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x14078, lpOverlapped=0x0) returned 1 [0092.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.730] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.730] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.730] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.730] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.730] CloseHandle (hObject=0xe4) returned 1 [0092.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0092.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0092.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.732] GetLastError () returned 0x0 [0092.732] RtlWakeConditionVariable () returned 0x0 [0092.732] GetCurrentThreadId () returned 0x99c [0092.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".ldf") returned 0x0 [0092.732] lstrlenW (lpString=".vhd") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".vhd") returned 0x0 [0092.733] lstrlenW (lpString=".vhdx") returned 5 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".vhdx") returned 0x0 [0092.733] lstrlenW (lpString=".pst") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".pst") returned 0x0 [0092.733] lstrlenW (lpString=".ost") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".ost") returned 0x0 [0092.733] lstrlenW (lpString=".bak") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".bak") returned 0x0 [0092.733] lstrlenW (lpString=".bac") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".bac") returned 0x0 [0092.733] lstrlenW (lpString=".sys") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".sys") returned 0x0 [0092.733] lstrlenW (lpString=".v2i") returned 4 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".v2i") returned 0x0 [0092.733] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch="s\r\n.v2i") returned 0x0 [0092.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.734] lstrlenW (lpString=".sql") returned 4 [0092.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".sql") returned 0x0 [0092.734] lstrlenW (lpString=".mdf") returned 4 [0092.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".mdf") returned 0x0 [0092.734] lstrlenW (lpString=".txt") returned 4 [0092.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".txt") returned 0x0 [0092.734] lstrlenW (lpString=".dbf") returned 4 [0092.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".dbf") returned 0x0 [0092.734] lstrlenW (lpString=".ckp") returned 4 [0092.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".ckp") returned 0x0 [0092.735] lstrlenW (lpString=".dacpac") returned 7 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".dacpac") returned 0x0 [0092.735] lstrlenW (lpString=".db3") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".db3") returned 0x0 [0092.735] lstrlenW (lpString=".dtxs") returned 5 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".dtxs") returned 0x0 [0092.735] lstrlenW (lpString=".mdt") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".mdt") returned 0x0 [0092.735] lstrlenW (lpString=".sdf") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".sdf") returned 0x0 [0092.735] lstrlenW (lpString=".MDF") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".MDF") returned 0x0 [0092.735] lstrlenW (lpString=".DBF") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".DBF") returned 0x0 [0092.735] lstrlenW (lpString=".DB") returned 3 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".DB") returned 0x0 [0092.735] lstrlenW (lpString=".db") returned 3 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".db") returned 0x0 [0092.735] lstrlenW (lpString=".ndf") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".ndf") returned 0x0 [0092.735] lstrlenW (lpString=".NDF") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".NDF") returned 0x0 [0092.735] lstrlenW (lpString=".Mdf") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".Mdf") returned 0x0 [0092.735] lstrlenW (lpString=".dat") returned 4 [0092.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".dat") returned 0x0 [0092.736] lstrlenW (lpString=".DAT") returned 4 [0092.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".DAT") returned 0x0 [0092.736] lstrlenW (lpString=".ldf") returned 4 [0092.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".ldf") returned 0x0 [0092.736] lstrlenW (lpString=".LDF") returned 4 [0092.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch=".LDF") returned 0x0 [0092.736] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.736] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.737] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.737] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.737] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21273799892) returned 1 [0092.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6161890, dwHighDateTime=0x1d585b4)) [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b75b8 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b75b8 | out: hHeap=0x260000) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.738] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.738] GetLastError () returned 0x0 [0092.738] GetLastError () returned 0x0 [0092.738] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.738] GetLastError () returned 0x0 [0092.738] GetLastError () returned 0x0 [0092.739] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffede, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.739] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x122, lpOverlapped=0x0) returned 1 [0092.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.739] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.740] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.740] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.740] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.740] CloseHandle (hObject=0xe4) returned 1 [0092.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.741] GetLastError () returned 0x0 [0092.741] RtlWakeConditionVariable () returned 0x27e828 [0092.741] GetCurrentThreadId () returned 0x99c [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".ldf") returned 0x0 [0092.742] lstrlenW (lpString=".vhd") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".vhd") returned 0x0 [0092.742] lstrlenW (lpString=".vhdx") returned 5 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".vhdx") returned 0x0 [0092.742] lstrlenW (lpString=".pst") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".pst") returned 0x0 [0092.742] lstrlenW (lpString=".ost") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".ost") returned 0x0 [0092.742] lstrlenW (lpString=".bak") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".bak") returned 0x0 [0092.742] lstrlenW (lpString=".bac") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".bac") returned 0x0 [0092.742] lstrlenW (lpString=".sys") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".sys") returned 0x0 [0092.742] lstrlenW (lpString=".v2i") returned 4 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".v2i") returned 0x0 [0092.742] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0092.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.743] lstrlenW (lpString=".sql") returned 4 [0092.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".sql") returned 0x0 [0092.743] lstrlenW (lpString=".mdf") returned 4 [0092.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".mdf") returned 0x0 [0092.744] lstrlenW (lpString=".txt") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".txt") returned 0x0 [0092.744] lstrlenW (lpString=".dbf") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".dbf") returned 0x0 [0092.744] lstrlenW (lpString=".ckp") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".ckp") returned 0x0 [0092.744] lstrlenW (lpString=".dacpac") returned 7 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".dacpac") returned 0x0 [0092.744] lstrlenW (lpString=".db3") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".db3") returned 0x0 [0092.744] lstrlenW (lpString=".dtxs") returned 5 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".dtxs") returned 0x0 [0092.744] lstrlenW (lpString=".mdt") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".mdt") returned 0x0 [0092.744] lstrlenW (lpString=".sdf") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".sdf") returned 0x0 [0092.744] lstrlenW (lpString=".MDF") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".MDF") returned 0x0 [0092.744] lstrlenW (lpString=".DBF") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".DBF") returned 0x0 [0092.744] lstrlenW (lpString=".DB") returned 3 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".DB") returned 0x0 [0092.744] lstrlenW (lpString=".db") returned 3 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".db") returned 0x0 [0092.744] lstrlenW (lpString=".ndf") returned 4 [0092.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".ndf") returned 0x0 [0092.744] lstrlenW (lpString=".NDF") returned 4 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".NDF") returned 0x0 [0092.745] lstrlenW (lpString=".Mdf") returned 4 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".Mdf") returned 0x0 [0092.745] lstrlenW (lpString=".dat") returned 4 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".dat") returned 0x0 [0092.745] lstrlenW (lpString=".DAT") returned 4 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".DAT") returned 0x0 [0092.745] lstrlenW (lpString=".ldf") returned 4 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".ldf") returned 0x0 [0092.745] lstrlenW (lpString=".LDF") returned 4 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch=".LDF") returned 0x0 [0092.745] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.745] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.746] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.746] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21274720779) returned 1 [0092.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc61879f0, dwHighDateTime=0x1d585b4)) [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b75f0 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b75f0 | out: hHeap=0x260000) returned 1 [0092.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.747] GetLastError () returned 0x0 [0092.747] GetLastError () returned 0x0 [0092.747] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] GetLastError () returned 0x0 [0092.749] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff64a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.749] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x9b6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x9b6, lpOverlapped=0x0) returned 1 [0092.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.749] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.749] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.749] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.749] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.750] CloseHandle (hObject=0xe4) returned 1 [0092.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.751] GetLastError () returned 0x0 [0092.751] RtlWakeConditionVariable () returned 0x0 [0092.751] GetCurrentThreadId () returned 0x99c [0092.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".ldf") returned 0x0 [0092.751] lstrlenW (lpString=".vhd") returned 4 [0092.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".vhd") returned 0x0 [0092.751] lstrlenW (lpString=".vhdx") returned 5 [0092.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".vhdx") returned 0x0 [0092.751] lstrlenW (lpString=".pst") returned 4 [0092.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".pst") returned 0x0 [0092.751] lstrlenW (lpString=".ost") returned 4 [0092.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".ost") returned 0x0 [0092.752] lstrlenW (lpString=".bak") returned 4 [0092.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".bak") returned 0x0 [0092.752] lstrlenW (lpString=".bac") returned 4 [0092.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".bac") returned 0x0 [0092.752] lstrlenW (lpString=".sys") returned 4 [0092.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".sys") returned 0x0 [0092.752] lstrlenW (lpString=".v2i") returned 4 [0092.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".v2i") returned 0x0 [0092.752] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0092.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.753] lstrlenW (lpString=".sql") returned 4 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".sql") returned 0x0 [0092.753] lstrlenW (lpString=".mdf") returned 4 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".mdf") returned 0x0 [0092.753] lstrlenW (lpString=".txt") returned 4 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".txt") returned 0x0 [0092.753] lstrlenW (lpString=".dbf") returned 4 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".dbf") returned 0x0 [0092.753] lstrlenW (lpString=".ckp") returned 4 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".ckp") returned 0x0 [0092.753] lstrlenW (lpString=".dacpac") returned 7 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".dacpac") returned 0x0 [0092.753] lstrlenW (lpString=".db3") returned 4 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".db3") returned 0x0 [0092.753] lstrlenW (lpString=".dtxs") returned 5 [0092.753] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".dtxs") returned 0x0 [0092.754] lstrlenW (lpString=".mdt") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".mdt") returned 0x0 [0092.754] lstrlenW (lpString=".sdf") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".sdf") returned 0x0 [0092.754] lstrlenW (lpString=".MDF") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".MDF") returned 0x0 [0092.754] lstrlenW (lpString=".DBF") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".DBF") returned 0x0 [0092.754] lstrlenW (lpString=".DB") returned 3 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".DB") returned 0x0 [0092.754] lstrlenW (lpString=".db") returned 3 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".db") returned 0x0 [0092.754] lstrlenW (lpString=".ndf") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".ndf") returned 0x0 [0092.754] lstrlenW (lpString=".NDF") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".NDF") returned 0x0 [0092.754] lstrlenW (lpString=".Mdf") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".Mdf") returned 0x0 [0092.754] lstrlenW (lpString=".dat") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".dat") returned 0x0 [0092.754] lstrlenW (lpString=".DAT") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".DAT") returned 0x0 [0092.754] lstrlenW (lpString=".ldf") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".ldf") returned 0x0 [0092.754] lstrlenW (lpString=".LDF") returned 4 [0092.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch=".LDF") returned 0x0 [0092.755] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.755] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.755] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.755] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.756] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21275675727) returned 1 [0092.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc61879f0, dwHighDateTime=0x1d585b4)) [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7628 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7628 | out: hHeap=0x260000) returned 1 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.756] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.756] GetLastError () returned 0x0 [0092.757] GetLastError () returned 0x0 [0092.757] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] GetLastError () returned 0x0 [0092.873] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff611, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.873] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x9ef, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x9ef, lpOverlapped=0x0) returned 1 [0092.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.873] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.873] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.873] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.873] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.874] CloseHandle (hObject=0xe4) returned 1 [0092.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] RtlWakeConditionVariable () returned 0x27e828 [0092.876] GetCurrentThreadId () returned 0x99c [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".ldf") returned 0x0 [0092.876] lstrlenW (lpString=".vhd") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".vhd") returned 0x0 [0092.876] lstrlenW (lpString=".vhdx") returned 5 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".vhdx") returned 0x0 [0092.876] lstrlenW (lpString=".pst") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".pst") returned 0x0 [0092.876] lstrlenW (lpString=".ost") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".ost") returned 0x0 [0092.876] lstrlenW (lpString=".bak") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".bak") returned 0x0 [0092.876] lstrlenW (lpString=".bac") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".bac") returned 0x0 [0092.876] lstrlenW (lpString=".sys") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".sys") returned 0x0 [0092.876] lstrlenW (lpString=".v2i") returned 4 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".v2i") returned 0x0 [0092.876] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.878] lstrlenW (lpString=".sql") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".sql") returned 0x0 [0092.878] lstrlenW (lpString=".mdf") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".mdf") returned 0x0 [0092.878] lstrlenW (lpString=".txt") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".txt") returned 0x0 [0092.878] lstrlenW (lpString=".dbf") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".dbf") returned 0x0 [0092.878] lstrlenW (lpString=".ckp") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".ckp") returned 0x0 [0092.878] lstrlenW (lpString=".dacpac") returned 7 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".dacpac") returned 0x0 [0092.878] lstrlenW (lpString=".db3") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".db3") returned 0x0 [0092.878] lstrlenW (lpString=".dtxs") returned 5 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".dtxs") returned 0x0 [0092.878] lstrlenW (lpString=".mdt") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".mdt") returned 0x0 [0092.878] lstrlenW (lpString=".sdf") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".sdf") returned 0x0 [0092.878] lstrlenW (lpString=".MDF") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".MDF") returned 0x0 [0092.878] lstrlenW (lpString=".DBF") returned 4 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".DBF") returned 0x0 [0092.878] lstrlenW (lpString=".DB") returned 3 [0092.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".DB") returned 0x0 [0092.878] lstrlenW (lpString=".db") returned 3 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".db") returned 0x0 [0092.879] lstrlenW (lpString=".ndf") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".ndf") returned 0x0 [0092.879] lstrlenW (lpString=".NDF") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".NDF") returned 0x0 [0092.879] lstrlenW (lpString=".Mdf") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".Mdf") returned 0x0 [0092.879] lstrlenW (lpString=".dat") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".dat") returned 0x0 [0092.879] lstrlenW (lpString=".DAT") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".DAT") returned 0x0 [0092.879] lstrlenW (lpString=".ldf") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".ldf") returned 0x0 [0092.879] lstrlenW (lpString=".LDF") returned 4 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch=".LDF") returned 0x0 [0092.879] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.879] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.880] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.880] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.880] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21288138629) returned 1 [0092.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc62b84f0, dwHighDateTime=0x1d585b4)) [0092.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7900 [0092.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7900 | out: hHeap=0x260000) returned 1 [0092.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b408 [0092.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b408 | out: hHeap=0x260000) returned 1 [0092.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.881] GetLastError () returned 0x0 [0092.881] GetLastError () returned 0x0 [0092.881] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.881] GetLastError () returned 0x0 [0092.882] GetLastError () returned 0x0 [0092.883] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff5d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.884] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa2e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xa2e, lpOverlapped=0x0) returned 1 [0092.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.884] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.884] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.884] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.884] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.884] CloseHandle (hObject=0xe4) returned 1 [0092.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0092.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.886] GetLastError () returned 0x0 [0092.886] RtlWakeConditionVariable () returned 0x0 [0092.886] GetCurrentThreadId () returned 0x99c [0092.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".ldf") returned 0x0 [0092.886] lstrlenW (lpString=".vhd") returned 4 [0092.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".vhd") returned 0x0 [0092.886] lstrlenW (lpString=".vhdx") returned 5 [0092.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".vhdx") returned 0x0 [0092.886] lstrlenW (lpString=".pst") returned 4 [0092.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".pst") returned 0x0 [0092.886] lstrlenW (lpString=".ost") returned 4 [0092.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".ost") returned 0x0 [0092.886] lstrlenW (lpString=".bak") returned 4 [0092.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".bak") returned 0x0 [0092.887] lstrlenW (lpString=".bac") returned 4 [0092.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".bac") returned 0x0 [0092.887] lstrlenW (lpString=".sys") returned 4 [0092.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".sys") returned 0x0 [0092.887] lstrlenW (lpString=".v2i") returned 4 [0092.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".v2i") returned 0x0 [0092.887] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch="s\r\n.v2i") returned 0x0 [0092.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.888] lstrlenW (lpString=".sql") returned 4 [0092.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".sql") returned 0x0 [0092.888] lstrlenW (lpString=".mdf") returned 4 [0092.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".mdf") returned 0x0 [0092.888] lstrlenW (lpString=".txt") returned 4 [0092.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".txt") returned 0x0 [0092.888] lstrlenW (lpString=".dbf") returned 4 [0092.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".dbf") returned 0x0 [0092.888] lstrlenW (lpString=".ckp") returned 4 [0092.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".ckp") returned 0x0 [0092.888] lstrlenW (lpString=".dacpac") returned 7 [0092.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".dacpac") returned 0x0 [0092.888] lstrlenW (lpString=".db3") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".db3") returned 0x0 [0092.889] lstrlenW (lpString=".dtxs") returned 5 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".dtxs") returned 0x0 [0092.889] lstrlenW (lpString=".mdt") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".mdt") returned 0x0 [0092.889] lstrlenW (lpString=".sdf") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".sdf") returned 0x0 [0092.889] lstrlenW (lpString=".MDF") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".MDF") returned 0x0 [0092.889] lstrlenW (lpString=".DBF") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".DBF") returned 0x0 [0092.889] lstrlenW (lpString=".DB") returned 3 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".DB") returned 0x0 [0092.889] lstrlenW (lpString=".db") returned 3 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".db") returned 0x0 [0092.889] lstrlenW (lpString=".ndf") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".ndf") returned 0x0 [0092.889] lstrlenW (lpString=".NDF") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".NDF") returned 0x0 [0092.889] lstrlenW (lpString=".Mdf") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".Mdf") returned 0x0 [0092.889] lstrlenW (lpString=".dat") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".dat") returned 0x0 [0092.889] lstrlenW (lpString=".DAT") returned 4 [0092.889] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".DAT") returned 0x0 [0092.889] lstrlenW (lpString=".ldf") returned 4 [0092.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".ldf") returned 0x0 [0092.890] lstrlenW (lpString=".LDF") returned 4 [0092.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch=".LDF") returned 0x0 [0092.890] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.890] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.891] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.891] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.891] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21289191636) returned 1 [0092.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc62de650, dwHighDateTime=0x1d585b4)) [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7938 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7938 | out: hHeap=0x260000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b558 [0092.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b558 | out: hHeap=0x260000) returned 1 [0092.891] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.892] GetLastError () returned 0x0 [0092.892] GetLastError () returned 0x0 [0092.892] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.892] GetLastError () returned 0x0 [0092.892] GetLastError () returned 0x0 [0092.894] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff15a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.894] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xea6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xea6, lpOverlapped=0x0) returned 1 [0092.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.894] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.894] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.894] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.894] CloseHandle (hObject=0xe4) returned 1 [0092.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2754fc8 [0092.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2754fc8 | out: hHeap=0x260000) returned 1 [0092.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0092.896] GetLastError () returned 0x0 [0092.896] RtlWakeConditionVariable () returned 0x0 [0092.896] GetCurrentThreadId () returned 0x99c [0092.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".ldf") returned 0x0 [0092.896] lstrlenW (lpString=".vhd") returned 4 [0092.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".vhd") returned 0x0 [0092.896] lstrlenW (lpString=".vhdx") returned 5 [0092.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".vhdx") returned 0x0 [0092.896] lstrlenW (lpString=".pst") returned 4 [0092.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".pst") returned 0x0 [0092.896] lstrlenW (lpString=".ost") returned 4 [0092.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".ost") returned 0x0 [0092.897] lstrlenW (lpString=".bak") returned 4 [0092.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".bak") returned 0x0 [0092.897] lstrlenW (lpString=".bac") returned 4 [0092.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".bac") returned 0x0 [0092.897] lstrlenW (lpString=".sys") returned 4 [0092.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".sys") returned 0x0 [0092.897] lstrlenW (lpString=".v2i") returned 4 [0092.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".v2i") returned 0x0 [0092.897] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch="s\r\n.v2i") returned 0x0 [0092.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.900] lstrlenW (lpString=".sql") returned 4 [0092.900] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".sql") returned 0x0 [0092.900] lstrlenW (lpString=".mdf") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".mdf") returned 0x0 [0092.901] lstrlenW (lpString=".txt") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".txt") returned 0x0 [0092.901] lstrlenW (lpString=".dbf") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".dbf") returned 0x0 [0092.901] lstrlenW (lpString=".ckp") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".ckp") returned 0x0 [0092.901] lstrlenW (lpString=".dacpac") returned 7 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".dacpac") returned 0x0 [0092.901] lstrlenW (lpString=".db3") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".db3") returned 0x0 [0092.901] lstrlenW (lpString=".dtxs") returned 5 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".dtxs") returned 0x0 [0092.901] lstrlenW (lpString=".mdt") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".mdt") returned 0x0 [0092.901] lstrlenW (lpString=".sdf") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".sdf") returned 0x0 [0092.901] lstrlenW (lpString=".MDF") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".MDF") returned 0x0 [0092.901] lstrlenW (lpString=".DBF") returned 4 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".DBF") returned 0x0 [0092.901] lstrlenW (lpString=".DB") returned 3 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".DB") returned 0x0 [0092.901] lstrlenW (lpString=".db") returned 3 [0092.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".db") returned 0x0 [0092.902] lstrlenW (lpString=".ndf") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".ndf") returned 0x0 [0092.902] lstrlenW (lpString=".NDF") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".NDF") returned 0x0 [0092.902] lstrlenW (lpString=".Mdf") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".Mdf") returned 0x0 [0092.902] lstrlenW (lpString=".dat") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".dat") returned 0x0 [0092.902] lstrlenW (lpString=".DAT") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".DAT") returned 0x0 [0092.902] lstrlenW (lpString=".ldf") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".ldf") returned 0x0 [0092.902] lstrlenW (lpString=".LDF") returned 4 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch=".LDF") returned 0x0 [0092.902] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0092.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.902] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0092.903] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.903] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0092.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0092.903] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21290436550) returned 1 [0092.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc63047b0, dwHighDateTime=0x1d585b4)) [0092.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0092.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0092.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0092.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7970 [0092.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7970 | out: hHeap=0x260000) returned 1 [0092.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b558 [0092.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b558 | out: hHeap=0x260000) returned 1 [0092.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0092.904] GetLastError () returned 0x0 [0092.904] GetLastError () returned 0x0 [0092.904] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0092.905] GetLastError () returned 0x0 [0092.905] GetLastError () returned 0x0 [0093.009] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff94a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.009] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6b6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x6b6, lpOverlapped=0x0) returned 1 [0093.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.010] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.010] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.010] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.010] CloseHandle (hObject=0xe4) returned 1 [0093.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0093.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0093.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.012] GetLastError () returned 0x0 [0093.012] RtlWakeConditionVariable () returned 0x0 [0093.012] GetCurrentThreadId () returned 0x99c [0093.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".ldf") returned 0x0 [0093.012] lstrlenW (lpString=".vhd") returned 4 [0093.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".vhd") returned 0x0 [0093.012] lstrlenW (lpString=".vhdx") returned 5 [0093.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".vhdx") returned 0x0 [0093.012] lstrlenW (lpString=".pst") returned 4 [0093.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".pst") returned 0x0 [0093.012] lstrlenW (lpString=".ost") returned 4 [0093.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".ost") returned 0x0 [0093.012] lstrlenW (lpString=".bak") returned 4 [0093.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".bak") returned 0x0 [0093.012] lstrlenW (lpString=".bac") returned 4 [0093.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".bac") returned 0x0 [0093.013] lstrlenW (lpString=".sys") returned 4 [0093.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".sys") returned 0x0 [0093.013] lstrlenW (lpString=".v2i") returned 4 [0093.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".v2i") returned 0x0 [0093.013] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.014] lstrlenW (lpString=".sql") returned 4 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".sql") returned 0x0 [0093.014] lstrlenW (lpString=".mdf") returned 4 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".mdf") returned 0x0 [0093.014] lstrlenW (lpString=".txt") returned 4 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".txt") returned 0x0 [0093.014] lstrlenW (lpString=".dbf") returned 4 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".dbf") returned 0x0 [0093.014] lstrlenW (lpString=".ckp") returned 4 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".ckp") returned 0x0 [0093.014] lstrlenW (lpString=".dacpac") returned 7 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".dacpac") returned 0x0 [0093.014] lstrlenW (lpString=".db3") returned 4 [0093.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".db3") returned 0x0 [0093.015] lstrlenW (lpString=".dtxs") returned 5 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".dtxs") returned 0x0 [0093.015] lstrlenW (lpString=".mdt") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".mdt") returned 0x0 [0093.015] lstrlenW (lpString=".sdf") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".sdf") returned 0x0 [0093.015] lstrlenW (lpString=".MDF") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".MDF") returned 0x0 [0093.015] lstrlenW (lpString=".DBF") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".DBF") returned 0x0 [0093.015] lstrlenW (lpString=".DB") returned 3 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".DB") returned 0x0 [0093.015] lstrlenW (lpString=".db") returned 3 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".db") returned 0x0 [0093.015] lstrlenW (lpString=".ndf") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".ndf") returned 0x0 [0093.015] lstrlenW (lpString=".NDF") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".NDF") returned 0x0 [0093.015] lstrlenW (lpString=".Mdf") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".Mdf") returned 0x0 [0093.015] lstrlenW (lpString=".dat") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".dat") returned 0x0 [0093.015] lstrlenW (lpString=".DAT") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".DAT") returned 0x0 [0093.015] lstrlenW (lpString=".ldf") returned 4 [0093.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".ldf") returned 0x0 [0093.016] lstrlenW (lpString=".LDF") returned 4 [0093.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch=".LDF") returned 0x0 [0093.016] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.016] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0093.017] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.017] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.017] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21301788959) returned 1 [0093.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc640f150, dwHighDateTime=0x1d585b4)) [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7b68 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7b68 | out: hHeap=0x260000) returned 1 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0093.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0093.017] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.018] GetLastError () returned 0x0 [0093.018] GetLastError () returned 0x0 [0093.018] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.018] GetLastError () returned 0x0 [0093.018] GetLastError () returned 0x0 [0093.058] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.077] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.077] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.077] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.077] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.077] CloseHandle (hObject=0xe4) returned 1 [0093.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755620 [0093.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755620 | out: hHeap=0x260000) returned 1 [0093.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.080] GetLastError () returned 0x0 [0093.081] RtlWakeConditionVariable () returned 0x0 [0093.081] GetCurrentThreadId () returned 0x99c [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".ldf") returned 0x0 [0093.081] lstrlenW (lpString=".vhd") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".vhd") returned 0x0 [0093.081] lstrlenW (lpString=".vhdx") returned 5 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".vhdx") returned 0x0 [0093.081] lstrlenW (lpString=".pst") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".pst") returned 0x0 [0093.081] lstrlenW (lpString=".ost") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".ost") returned 0x0 [0093.081] lstrlenW (lpString=".bak") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".bak") returned 0x0 [0093.081] lstrlenW (lpString=".bac") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".bac") returned 0x0 [0093.081] lstrlenW (lpString=".sys") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".sys") returned 0x0 [0093.081] lstrlenW (lpString=".v2i") returned 4 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".v2i") returned 0x0 [0093.081] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.081] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.084] lstrlenW (lpString=".sql") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".sql") returned 0x0 [0093.084] lstrlenW (lpString=".mdf") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".mdf") returned 0x0 [0093.084] lstrlenW (lpString=".txt") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".txt") returned 0x0 [0093.084] lstrlenW (lpString=".dbf") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".dbf") returned 0x0 [0093.084] lstrlenW (lpString=".ckp") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".ckp") returned 0x0 [0093.084] lstrlenW (lpString=".dacpac") returned 7 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".dacpac") returned 0x0 [0093.084] lstrlenW (lpString=".db3") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".db3") returned 0x0 [0093.084] lstrlenW (lpString=".dtxs") returned 5 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".dtxs") returned 0x0 [0093.084] lstrlenW (lpString=".mdt") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".mdt") returned 0x0 [0093.084] lstrlenW (lpString=".sdf") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".sdf") returned 0x0 [0093.084] lstrlenW (lpString=".MDF") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".MDF") returned 0x0 [0093.084] lstrlenW (lpString=".DBF") returned 4 [0093.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".DBF") returned 0x0 [0093.084] lstrlenW (lpString=".DB") returned 3 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".DB") returned 0x0 [0093.085] lstrlenW (lpString=".db") returned 3 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".db") returned 0x0 [0093.085] lstrlenW (lpString=".ndf") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".ndf") returned 0x0 [0093.085] lstrlenW (lpString=".NDF") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".NDF") returned 0x0 [0093.085] lstrlenW (lpString=".Mdf") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".Mdf") returned 0x0 [0093.085] lstrlenW (lpString=".dat") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".dat") returned 0x0 [0093.085] lstrlenW (lpString=".DAT") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".DAT") returned 0x0 [0093.085] lstrlenW (lpString=".ldf") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".ldf") returned 0x0 [0093.085] lstrlenW (lpString=".LDF") returned 4 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch=".LDF") returned 0x0 [0093.085] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.085] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0093.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.086] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.086] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21308753702) returned 1 [0093.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc64cd830, dwHighDateTime=0x1d585b4)) [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7ba0 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7ba0 | out: hHeap=0x260000) returned 1 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0093.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0093.087] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.087] GetLastError () returned 0x0 [0093.088] GetLastError () returned 0x0 [0093.088] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.088] GetLastError () returned 0x0 [0093.088] GetLastError () returned 0x0 [0093.090] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff60a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.090] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x9f6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x9f6, lpOverlapped=0x0) returned 1 [0093.090] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.090] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.090] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.090] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.090] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.090] CloseHandle (hObject=0xe4) returned 1 [0093.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755620 [0093.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755620 | out: hHeap=0x260000) returned 1 [0093.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.093] GetLastError () returned 0x0 [0093.093] RtlWakeConditionVariable () returned 0x0 [0093.093] GetCurrentThreadId () returned 0x99c [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".ldf") returned 0x0 [0093.093] lstrlenW (lpString=".vhd") returned 4 [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".vhd") returned 0x0 [0093.093] lstrlenW (lpString=".vhdx") returned 5 [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".vhdx") returned 0x0 [0093.093] lstrlenW (lpString=".pst") returned 4 [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".pst") returned 0x0 [0093.093] lstrlenW (lpString=".ost") returned 4 [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".ost") returned 0x0 [0093.093] lstrlenW (lpString=".bak") returned 4 [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".bak") returned 0x0 [0093.093] lstrlenW (lpString=".bac") returned 4 [0093.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".bac") returned 0x0 [0093.094] lstrlenW (lpString=".sys") returned 4 [0093.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".sys") returned 0x0 [0093.094] lstrlenW (lpString=".v2i") returned 4 [0093.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".v2i") returned 0x0 [0093.094] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0093.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.095] lstrlenW (lpString=".sql") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".sql") returned 0x0 [0093.096] lstrlenW (lpString=".mdf") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".mdf") returned 0x0 [0093.096] lstrlenW (lpString=".txt") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".txt") returned 0x0 [0093.096] lstrlenW (lpString=".dbf") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".dbf") returned 0x0 [0093.096] lstrlenW (lpString=".ckp") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".ckp") returned 0x0 [0093.096] lstrlenW (lpString=".dacpac") returned 7 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".dacpac") returned 0x0 [0093.096] lstrlenW (lpString=".db3") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".db3") returned 0x0 [0093.096] lstrlenW (lpString=".dtxs") returned 5 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".dtxs") returned 0x0 [0093.096] lstrlenW (lpString=".mdt") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".mdt") returned 0x0 [0093.096] lstrlenW (lpString=".sdf") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".sdf") returned 0x0 [0093.096] lstrlenW (lpString=".MDF") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".MDF") returned 0x0 [0093.096] lstrlenW (lpString=".DBF") returned 4 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".DBF") returned 0x0 [0093.096] lstrlenW (lpString=".DB") returned 3 [0093.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".DB") returned 0x0 [0093.096] lstrlenW (lpString=".db") returned 3 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".db") returned 0x0 [0093.097] lstrlenW (lpString=".ndf") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".ndf") returned 0x0 [0093.097] lstrlenW (lpString=".NDF") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".NDF") returned 0x0 [0093.097] lstrlenW (lpString=".Mdf") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".Mdf") returned 0x0 [0093.097] lstrlenW (lpString=".dat") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".dat") returned 0x0 [0093.097] lstrlenW (lpString=".DAT") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".DAT") returned 0x0 [0093.097] lstrlenW (lpString=".ldf") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".ldf") returned 0x0 [0093.097] lstrlenW (lpString=".LDF") returned 4 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch=".LDF") returned 0x0 [0093.097] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.097] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0093.098] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.098] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.098] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21309938831) returned 1 [0093.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc64cd830, dwHighDateTime=0x1d585b4)) [0093.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7bd8 [0093.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7bd8 | out: hHeap=0x260000) returned 1 [0093.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b948 [0093.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b948 | out: hHeap=0x260000) returned 1 [0093.099] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.099] GetLastError () returned 0x0 [0093.099] GetLastError () returned 0x0 [0093.099] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.100] GetLastError () returned 0x0 [0093.100] GetLastError () returned 0x0 [0093.284] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.284] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xd6e, lpOverlapped=0x0) returned 1 [0093.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.284] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.284] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.284] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.284] CloseHandle (hObject=0xe4) returned 1 [0093.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0093.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0093.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.325] GetLastError () returned 0x0 [0093.325] RtlWakeConditionVariable () returned 0x0 [0093.325] GetCurrentThreadId () returned 0x99c [0093.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".ldf") returned 0x0 [0093.325] lstrlenW (lpString=".vhd") returned 4 [0093.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".vhd") returned 0x0 [0093.325] lstrlenW (lpString=".vhdx") returned 5 [0093.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".vhdx") returned 0x0 [0093.325] lstrlenW (lpString=".pst") returned 4 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".pst") returned 0x0 [0093.326] lstrlenW (lpString=".ost") returned 4 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".ost") returned 0x0 [0093.326] lstrlenW (lpString=".bak") returned 4 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".bak") returned 0x0 [0093.326] lstrlenW (lpString=".bac") returned 4 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".bac") returned 0x0 [0093.326] lstrlenW (lpString=".sys") returned 4 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".sys") returned 0x0 [0093.326] lstrlenW (lpString=".v2i") returned 4 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".v2i") returned 0x0 [0093.326] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.326] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.327] lstrlenW (lpString=".sql") returned 4 [0093.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".sql") returned 0x0 [0093.327] lstrlenW (lpString=".mdf") returned 4 [0093.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".mdf") returned 0x0 [0093.327] lstrlenW (lpString=".txt") returned 4 [0093.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".txt") returned 0x0 [0093.327] lstrlenW (lpString=".dbf") returned 4 [0093.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".dbf") returned 0x0 [0093.327] lstrlenW (lpString=".ckp") returned 4 [0093.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".ckp") returned 0x0 [0093.327] lstrlenW (lpString=".dacpac") returned 7 [0093.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".dacpac") returned 0x0 [0093.328] lstrlenW (lpString=".db3") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".db3") returned 0x0 [0093.328] lstrlenW (lpString=".dtxs") returned 5 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".dtxs") returned 0x0 [0093.328] lstrlenW (lpString=".mdt") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".mdt") returned 0x0 [0093.328] lstrlenW (lpString=".sdf") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".sdf") returned 0x0 [0093.328] lstrlenW (lpString=".MDF") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".MDF") returned 0x0 [0093.328] lstrlenW (lpString=".DBF") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".DBF") returned 0x0 [0093.328] lstrlenW (lpString=".DB") returned 3 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".DB") returned 0x0 [0093.328] lstrlenW (lpString=".db") returned 3 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".db") returned 0x0 [0093.328] lstrlenW (lpString=".ndf") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".ndf") returned 0x0 [0093.328] lstrlenW (lpString=".NDF") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".NDF") returned 0x0 [0093.328] lstrlenW (lpString=".Mdf") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".Mdf") returned 0x0 [0093.328] lstrlenW (lpString=".dat") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".dat") returned 0x0 [0093.328] lstrlenW (lpString=".DAT") returned 4 [0093.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".DAT") returned 0x0 [0093.329] lstrlenW (lpString=".ldf") returned 4 [0093.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".ldf") returned 0x0 [0093.329] lstrlenW (lpString=".LDF") returned 4 [0093.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch=".LDF") returned 0x0 [0093.329] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.329] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0093.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.330] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.330] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21333096317) returned 1 [0093.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6708cd0, dwHighDateTime=0x1d585b4)) [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7d98 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7d98 | out: hHeap=0x260000) returned 1 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0093.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0093.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.331] GetLastError () returned 0x0 [0093.331] GetLastError () returned 0x0 [0093.331] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.331] GetLastError () returned 0x0 [0093.331] GetLastError () returned 0x0 [0093.334] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.334] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.334] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.334] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.337] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.337] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.337] CloseHandle (hObject=0xe4) returned 1 [0093.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755708 [0093.337] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755708 | out: hHeap=0x260000) returned 1 [0093.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.338] GetLastError () returned 0x0 [0093.339] RtlWakeConditionVariable () returned 0x0 [0093.339] GetCurrentThreadId () returned 0x99c [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".ldf") returned 0x0 [0093.339] lstrlenW (lpString=".vhd") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".vhd") returned 0x0 [0093.339] lstrlenW (lpString=".vhdx") returned 5 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".vhdx") returned 0x0 [0093.339] lstrlenW (lpString=".pst") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".pst") returned 0x0 [0093.339] lstrlenW (lpString=".ost") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".ost") returned 0x0 [0093.339] lstrlenW (lpString=".bak") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".bak") returned 0x0 [0093.339] lstrlenW (lpString=".bac") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".bac") returned 0x0 [0093.339] lstrlenW (lpString=".sys") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".sys") returned 0x0 [0093.339] lstrlenW (lpString=".v2i") returned 4 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".v2i") returned 0x0 [0093.339] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.340] lstrlenW (lpString=".sql") returned 4 [0093.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".sql") returned 0x0 [0093.341] lstrlenW (lpString=".mdf") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".mdf") returned 0x0 [0093.341] lstrlenW (lpString=".txt") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".txt") returned 0x0 [0093.341] lstrlenW (lpString=".dbf") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".dbf") returned 0x0 [0093.341] lstrlenW (lpString=".ckp") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".ckp") returned 0x0 [0093.341] lstrlenW (lpString=".dacpac") returned 7 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".dacpac") returned 0x0 [0093.341] lstrlenW (lpString=".db3") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".db3") returned 0x0 [0093.341] lstrlenW (lpString=".dtxs") returned 5 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".dtxs") returned 0x0 [0093.341] lstrlenW (lpString=".mdt") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".mdt") returned 0x0 [0093.341] lstrlenW (lpString=".sdf") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".sdf") returned 0x0 [0093.341] lstrlenW (lpString=".MDF") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".MDF") returned 0x0 [0093.341] lstrlenW (lpString=".DBF") returned 4 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".DBF") returned 0x0 [0093.341] lstrlenW (lpString=".DB") returned 3 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".DB") returned 0x0 [0093.341] lstrlenW (lpString=".db") returned 3 [0093.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".db") returned 0x0 [0093.342] lstrlenW (lpString=".ndf") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".ndf") returned 0x0 [0093.342] lstrlenW (lpString=".NDF") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".NDF") returned 0x0 [0093.342] lstrlenW (lpString=".Mdf") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".Mdf") returned 0x0 [0093.342] lstrlenW (lpString=".dat") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".dat") returned 0x0 [0093.342] lstrlenW (lpString=".DAT") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".DAT") returned 0x0 [0093.342] lstrlenW (lpString=".ldf") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".ldf") returned 0x0 [0093.342] lstrlenW (lpString=".LDF") returned 4 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch=".LDF") returned 0x0 [0093.342] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.342] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.342] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0093.343] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.343] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.343] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21334431641) returned 1 [0093.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc672ee30, dwHighDateTime=0x1d585b4)) [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7dd0 [0093.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7dd0 | out: hHeap=0x260000) returned 1 [0093.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0093.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0093.344] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.344] GetLastError () returned 0x0 [0093.344] GetLastError () returned 0x0 [0093.344] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.344] GetLastError () returned 0x0 [0093.345] GetLastError () returned 0x0 [0093.346] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff60a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.346] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x9f6, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x9f6, lpOverlapped=0x0) returned 1 [0093.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.347] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.347] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.347] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.347] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.347] CloseHandle (hObject=0xe4) returned 1 [0093.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755708 [0093.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755708 | out: hHeap=0x260000) returned 1 [0093.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.348] GetLastError () returned 0x0 [0093.348] RtlWakeConditionVariable () returned 0x0 [0093.349] GetCurrentThreadId () returned 0x99c [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".ldf") returned 0x0 [0093.349] lstrlenW (lpString=".vhd") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".vhd") returned 0x0 [0093.349] lstrlenW (lpString=".vhdx") returned 5 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".vhdx") returned 0x0 [0093.349] lstrlenW (lpString=".pst") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".pst") returned 0x0 [0093.349] lstrlenW (lpString=".ost") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".ost") returned 0x0 [0093.349] lstrlenW (lpString=".bak") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".bak") returned 0x0 [0093.349] lstrlenW (lpString=".bac") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".bac") returned 0x0 [0093.349] lstrlenW (lpString=".sys") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".sys") returned 0x0 [0093.349] lstrlenW (lpString=".v2i") returned 4 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".v2i") returned 0x0 [0093.349] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.350] lstrlenW (lpString=".sql") returned 4 [0093.350] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".sql") returned 0x0 [0093.350] lstrlenW (lpString=".mdf") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".mdf") returned 0x0 [0093.351] lstrlenW (lpString=".txt") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".txt") returned 0x0 [0093.351] lstrlenW (lpString=".dbf") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".dbf") returned 0x0 [0093.351] lstrlenW (lpString=".ckp") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".ckp") returned 0x0 [0093.351] lstrlenW (lpString=".dacpac") returned 7 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".dacpac") returned 0x0 [0093.351] lstrlenW (lpString=".db3") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".db3") returned 0x0 [0093.351] lstrlenW (lpString=".dtxs") returned 5 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".dtxs") returned 0x0 [0093.351] lstrlenW (lpString=".mdt") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".mdt") returned 0x0 [0093.351] lstrlenW (lpString=".sdf") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".sdf") returned 0x0 [0093.351] lstrlenW (lpString=".MDF") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".MDF") returned 0x0 [0093.351] lstrlenW (lpString=".DBF") returned 4 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".DBF") returned 0x0 [0093.351] lstrlenW (lpString=".DB") returned 3 [0093.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".DB") returned 0x0 [0093.351] lstrlenW (lpString=".db") returned 3 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".db") returned 0x0 [0093.352] lstrlenW (lpString=".ndf") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".ndf") returned 0x0 [0093.352] lstrlenW (lpString=".NDF") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".NDF") returned 0x0 [0093.352] lstrlenW (lpString=".Mdf") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".Mdf") returned 0x0 [0093.352] lstrlenW (lpString=".dat") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".dat") returned 0x0 [0093.352] lstrlenW (lpString=".DAT") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".DAT") returned 0x0 [0093.352] lstrlenW (lpString=".ldf") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".ldf") returned 0x0 [0093.352] lstrlenW (lpString=".LDF") returned 4 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch=".LDF") returned 0x0 [0093.352] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.352] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e380) returned 1 [0093.353] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.353] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.353] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21335488666) returned 1 [0093.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6754f90, dwHighDateTime=0x1d585b4)) [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7e08 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7e08 | out: hHeap=0x260000) returned 1 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0093.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0093.354] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.355] GetLastError () returned 0x0 [0093.355] GetLastError () returned 0x0 [0093.355] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.355] GetLastError () returned 0x0 [0093.355] GetLastError () returned 0x0 [0093.420] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.420] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.421] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.421] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.422] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.422] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.422] CloseHandle (hObject=0xe4) returned 1 [0093.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0093.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0093.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.424] GetLastError () returned 0x0 [0093.424] RtlWakeConditionVariable () returned 0x0 [0093.424] GetCurrentThreadId () returned 0x99c [0093.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".ldf") returned 0x0 [0093.424] lstrlenW (lpString=".vhd") returned 4 [0093.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".vhd") returned 0x0 [0093.425] lstrlenW (lpString=".vhdx") returned 5 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".vhdx") returned 0x0 [0093.425] lstrlenW (lpString=".pst") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".pst") returned 0x0 [0093.425] lstrlenW (lpString=".ost") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".ost") returned 0x0 [0093.425] lstrlenW (lpString=".bak") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".bak") returned 0x0 [0093.425] lstrlenW (lpString=".bac") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".bac") returned 0x0 [0093.425] lstrlenW (lpString=".sys") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".sys") returned 0x0 [0093.425] lstrlenW (lpString=".v2i") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".v2i") returned 0x0 [0093.425] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch="s\r\n.v2i") returned 0x0 [0093.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.508] lstrlenW (lpString=".sql") returned 4 [0093.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".sql") returned 0x0 [0093.508] lstrlenW (lpString=".mdf") returned 4 [0093.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".mdf") returned 0x0 [0093.508] lstrlenW (lpString=".txt") returned 4 [0093.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".txt") returned 0x0 [0093.509] lstrlenW (lpString=".dbf") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".dbf") returned 0x0 [0093.509] lstrlenW (lpString=".ckp") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".ckp") returned 0x0 [0093.509] lstrlenW (lpString=".dacpac") returned 7 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".dacpac") returned 0x0 [0093.509] lstrlenW (lpString=".db3") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".db3") returned 0x0 [0093.509] lstrlenW (lpString=".dtxs") returned 5 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".dtxs") returned 0x0 [0093.509] lstrlenW (lpString=".mdt") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".mdt") returned 0x0 [0093.509] lstrlenW (lpString=".sdf") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".sdf") returned 0x0 [0093.509] lstrlenW (lpString=".MDF") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".MDF") returned 0x0 [0093.509] lstrlenW (lpString=".DBF") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".DBF") returned 0x0 [0093.509] lstrlenW (lpString=".DB") returned 3 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".DB") returned 0x0 [0093.509] lstrlenW (lpString=".db") returned 3 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".db") returned 0x0 [0093.509] lstrlenW (lpString=".ndf") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".ndf") returned 0x0 [0093.509] lstrlenW (lpString=".NDF") returned 4 [0093.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".NDF") returned 0x0 [0093.510] lstrlenW (lpString=".Mdf") returned 4 [0093.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".Mdf") returned 0x0 [0093.510] lstrlenW (lpString=".dat") returned 4 [0093.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".dat") returned 0x0 [0093.510] lstrlenW (lpString=".DAT") returned 4 [0093.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".DAT") returned 0x0 [0093.510] lstrlenW (lpString=".ldf") returned 4 [0093.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".ldf") returned 0x0 [0093.510] lstrlenW (lpString=".LDF") returned 4 [0093.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch=".LDF") returned 0x0 [0093.510] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.510] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e490) returned 1 [0093.511] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.511] CryptReleaseContext (hProv=0x33e490, dwFlags=0x0) returned 1 [0093.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.511] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21351219594) returned 1 [0093.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc68d1d50, dwHighDateTime=0x1d585b4)) [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b81c0 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b81c0 | out: hHeap=0x260000) returned 1 [0093.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bbe8 [0093.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bbe8 | out: hHeap=0x260000) returned 1 [0093.512] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.512] GetLastError () returned 0x0 [0093.512] GetLastError () returned 0x0 [0093.512] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.512] GetLastError () returned 0x0 [0093.512] GetLastError () returned 0x0 [0093.515] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffa2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.515] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x5d5, lpOverlapped=0x0) returned 1 [0093.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.515] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.515] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.515] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.516] CloseHandle (hObject=0xd8) returned 1 [0093.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27dc090 [0093.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd.[deadmin@cock.li].deadmin")) returned 1 [0093.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc090 | out: hHeap=0x260000) returned 1 [0093.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.517] GetLastError () returned 0x0 [0093.517] RtlWakeConditionVariable () returned 0x0 [0093.517] GetCurrentThreadId () returned 0x99c [0093.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".ldf") returned 0x0 [0093.517] lstrlenW (lpString=".vhd") returned 4 [0093.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".vhd") returned 0x0 [0093.517] lstrlenW (lpString=".vhdx") returned 5 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".vhdx") returned 0x0 [0093.518] lstrlenW (lpString=".pst") returned 4 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".pst") returned 0x0 [0093.518] lstrlenW (lpString=".ost") returned 4 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".ost") returned 0x0 [0093.518] lstrlenW (lpString=".bak") returned 4 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".bak") returned 0x0 [0093.518] lstrlenW (lpString=".bac") returned 4 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".bac") returned 0x0 [0093.518] lstrlenW (lpString=".sys") returned 4 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".sys") returned 0x0 [0093.518] lstrlenW (lpString=".v2i") returned 4 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch=".v2i") returned 0x0 [0093.518] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e628 | out: hHeap=0x260000) returned 1 [0093.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e490 | out: hHeap=0x260000) returned 1 [0093.518] RtlWakeConditionVariable () returned 0x27e828 [0093.519] GetCurrentThreadId () returned 0x99c [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".ldf") returned 0x0 [0093.519] lstrlenW (lpString=".vhd") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".vhd") returned 0x0 [0093.519] lstrlenW (lpString=".vhdx") returned 5 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".vhdx") returned 0x0 [0093.519] lstrlenW (lpString=".pst") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".pst") returned 0x0 [0093.519] lstrlenW (lpString=".ost") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".ost") returned 0x0 [0093.519] lstrlenW (lpString=".bak") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".bak") returned 0x0 [0093.519] lstrlenW (lpString=".bac") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".bac") returned 0x0 [0093.519] lstrlenW (lpString=".sys") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".sys") returned 0x0 [0093.519] lstrlenW (lpString=".v2i") returned 4 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".v2i") returned 0x0 [0093.519] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0093.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.520] lstrlenW (lpString=".sql") returned 4 [0093.520] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".sql") returned 0x0 [0093.521] lstrlenW (lpString=".mdf") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".mdf") returned 0x0 [0093.521] lstrlenW (lpString=".txt") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".txt") returned 0x0 [0093.521] lstrlenW (lpString=".dbf") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".dbf") returned 0x0 [0093.521] lstrlenW (lpString=".ckp") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".ckp") returned 0x0 [0093.521] lstrlenW (lpString=".dacpac") returned 7 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".dacpac") returned 0x0 [0093.521] lstrlenW (lpString=".db3") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".db3") returned 0x0 [0093.521] lstrlenW (lpString=".dtxs") returned 5 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".dtxs") returned 0x0 [0093.521] lstrlenW (lpString=".mdt") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".mdt") returned 0x0 [0093.521] lstrlenW (lpString=".sdf") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".sdf") returned 0x0 [0093.521] lstrlenW (lpString=".MDF") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".MDF") returned 0x0 [0093.521] lstrlenW (lpString=".DBF") returned 4 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".DBF") returned 0x0 [0093.521] lstrlenW (lpString=".DB") returned 3 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".DB") returned 0x0 [0093.521] lstrlenW (lpString=".db") returned 3 [0093.521] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".db") returned 0x0 [0093.522] lstrlenW (lpString=".ndf") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".ndf") returned 0x0 [0093.522] lstrlenW (lpString=".NDF") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".NDF") returned 0x0 [0093.522] lstrlenW (lpString=".Mdf") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".Mdf") returned 0x0 [0093.522] lstrlenW (lpString=".dat") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".dat") returned 0x0 [0093.522] lstrlenW (lpString=".DAT") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".DAT") returned 0x0 [0093.522] lstrlenW (lpString=".ldf") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".ldf") returned 0x0 [0093.522] lstrlenW (lpString=".LDF") returned 4 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch=".LDF") returned 0x0 [0093.522] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.522] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.522] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e628) returned 1 [0093.523] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.523] CryptReleaseContext (hProv=0x33e628, dwFlags=0x0) returned 1 [0093.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.523] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21352435624) returned 1 [0093.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc68f7eb0, dwHighDateTime=0x1d585b4)) [0093.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df088 [0093.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df088 | out: hHeap=0x260000) returned 1 [0093.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.524] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.524] GetLastError () returned 0x0 [0093.524] GetLastError () returned 0x0 [0093.524] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.524] GetLastError () returned 0x0 [0093.525] GetLastError () returned 0x0 [0093.527] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.528] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.529] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.529] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.530] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.530] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.530] CloseHandle (hObject=0xd8) returned 1 [0093.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.[deadmin@cock.li].deadmin")) returned 1 [0093.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.532] GetLastError () returned 0x0 [0093.532] RtlWakeConditionVariable () returned 0x0 [0093.532] GetCurrentThreadId () returned 0x99c [0093.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".ldf") returned 0x0 [0093.532] lstrlenW (lpString=".vhd") returned 4 [0093.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".vhd") returned 0x0 [0093.532] lstrlenW (lpString=".vhdx") returned 5 [0093.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".vhdx") returned 0x0 [0093.532] lstrlenW (lpString=".pst") returned 4 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".pst") returned 0x0 [0093.533] lstrlenW (lpString=".ost") returned 4 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".ost") returned 0x0 [0093.533] lstrlenW (lpString=".bak") returned 4 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".bak") returned 0x0 [0093.533] lstrlenW (lpString=".bac") returned 4 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".bac") returned 0x0 [0093.533] lstrlenW (lpString=".sys") returned 4 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".sys") returned 0x0 [0093.533] lstrlenW (lpString=".v2i") returned 4 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".v2i") returned 0x0 [0093.533] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.534] lstrlenW (lpString=".sql") returned 4 [0093.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".sql") returned 0x0 [0093.534] lstrlenW (lpString=".mdf") returned 4 [0093.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".mdf") returned 0x0 [0093.534] lstrlenW (lpString=".txt") returned 4 [0093.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".txt") returned 0x0 [0093.534] lstrlenW (lpString=".dbf") returned 4 [0093.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".dbf") returned 0x0 [0093.534] lstrlenW (lpString=".ckp") returned 4 [0093.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".ckp") returned 0x0 [0093.534] lstrlenW (lpString=".dacpac") returned 7 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".dacpac") returned 0x0 [0093.535] lstrlenW (lpString=".db3") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".db3") returned 0x0 [0093.535] lstrlenW (lpString=".dtxs") returned 5 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".dtxs") returned 0x0 [0093.535] lstrlenW (lpString=".mdt") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".mdt") returned 0x0 [0093.535] lstrlenW (lpString=".sdf") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".sdf") returned 0x0 [0093.535] lstrlenW (lpString=".MDF") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".MDF") returned 0x0 [0093.535] lstrlenW (lpString=".DBF") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".DBF") returned 0x0 [0093.535] lstrlenW (lpString=".DB") returned 3 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".DB") returned 0x0 [0093.535] lstrlenW (lpString=".db") returned 3 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".db") returned 0x0 [0093.535] lstrlenW (lpString=".ndf") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".ndf") returned 0x0 [0093.535] lstrlenW (lpString=".NDF") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".NDF") returned 0x0 [0093.535] lstrlenW (lpString=".Mdf") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".Mdf") returned 0x0 [0093.535] lstrlenW (lpString=".dat") returned 4 [0093.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".dat") returned 0x0 [0093.535] lstrlenW (lpString=".DAT") returned 4 [0093.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".DAT") returned 0x0 [0093.536] lstrlenW (lpString=".ldf") returned 4 [0093.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".ldf") returned 0x0 [0093.536] lstrlenW (lpString=".LDF") returned 4 [0093.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch=".LDF") returned 0x0 [0093.536] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.536] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e490) returned 1 [0093.537] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.537] CryptReleaseContext (hProv=0x33e490, dwFlags=0x0) returned 1 [0093.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.537] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21353792044) returned 1 [0093.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc68f7eb0, dwHighDateTime=0x1d585b4)) [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df0c0 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df0c0 | out: hHeap=0x260000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.537] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.604] GetLastError () returned 0x0 [0093.604] GetLastError () returned 0x0 [0093.604] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.604] GetLastError () returned 0x0 [0093.605] GetLastError () returned 0x0 [0093.651] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.652] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.653] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.653] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.660] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.660] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.660] CloseHandle (hObject=0xd8) returned 1 [0093.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.661] GetLastError () returned 0x0 [0093.662] RtlWakeConditionVariable () returned 0x0 [0093.662] GetCurrentThreadId () returned 0x99c [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".ldf") returned 0x0 [0093.662] lstrlenW (lpString=".vhd") returned 4 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".vhd") returned 0x0 [0093.662] lstrlenW (lpString=".vhdx") returned 5 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".vhdx") returned 0x0 [0093.662] lstrlenW (lpString=".pst") returned 4 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".pst") returned 0x0 [0093.662] lstrlenW (lpString=".ost") returned 4 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".ost") returned 0x0 [0093.662] lstrlenW (lpString=".bak") returned 4 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".bak") returned 0x0 [0093.662] lstrlenW (lpString=".bac") returned 4 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".bac") returned 0x0 [0093.662] lstrlenW (lpString=".sys") returned 4 [0093.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".sys") returned 0x0 [0093.662] lstrlenW (lpString=".v2i") returned 4 [0093.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".v2i") returned 0x0 [0093.664] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.669] lstrlenW (lpString=".sql") returned 4 [0093.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".sql") returned 0x0 [0093.669] lstrlenW (lpString=".mdf") returned 4 [0093.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".mdf") returned 0x0 [0093.669] lstrlenW (lpString=".txt") returned 4 [0093.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".txt") returned 0x0 [0093.669] lstrlenW (lpString=".dbf") returned 4 [0093.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".dbf") returned 0x0 [0093.669] lstrlenW (lpString=".ckp") returned 4 [0093.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".ckp") returned 0x0 [0093.669] lstrlenW (lpString=".dacpac") returned 7 [0093.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".dacpac") returned 0x0 [0093.669] lstrlenW (lpString=".db3") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".db3") returned 0x0 [0093.670] lstrlenW (lpString=".dtxs") returned 5 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".dtxs") returned 0x0 [0093.670] lstrlenW (lpString=".mdt") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".mdt") returned 0x0 [0093.670] lstrlenW (lpString=".sdf") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".sdf") returned 0x0 [0093.670] lstrlenW (lpString=".MDF") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".MDF") returned 0x0 [0093.670] lstrlenW (lpString=".DBF") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".DBF") returned 0x0 [0093.670] lstrlenW (lpString=".DB") returned 3 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".DB") returned 0x0 [0093.670] lstrlenW (lpString=".db") returned 3 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".db") returned 0x0 [0093.670] lstrlenW (lpString=".ndf") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".ndf") returned 0x0 [0093.670] lstrlenW (lpString=".NDF") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".NDF") returned 0x0 [0093.670] lstrlenW (lpString=".Mdf") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".Mdf") returned 0x0 [0093.670] lstrlenW (lpString=".dat") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".dat") returned 0x0 [0093.670] lstrlenW (lpString=".DAT") returned 4 [0093.670] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".DAT") returned 0x0 [0093.671] lstrlenW (lpString=".ldf") returned 4 [0093.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".ldf") returned 0x0 [0093.671] lstrlenW (lpString=".LDF") returned 4 [0093.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch=".LDF") returned 0x0 [0093.671] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.671] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.671] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e5a0) returned 1 [0093.672] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.672] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0093.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.672] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21367291636) returned 1 [0093.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6a4eb10, dwHighDateTime=0x1d585b4)) [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df280 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df280 | out: hHeap=0x260000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.672] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.673] GetLastError () returned 0x0 [0093.673] GetLastError () returned 0x0 [0093.673] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.673] GetLastError () returned 0x0 [0093.673] GetLastError () returned 0x0 [0093.683] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffc070, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.683] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x3f90, lpOverlapped=0x0) returned 1 [0093.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.684] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.684] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.684] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.684] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.684] CloseHandle (hObject=0xe4) returned 1 [0093.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4250 [0093.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4250 | out: hHeap=0x260000) returned 1 [0093.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.686] GetLastError () returned 0x0 [0093.686] RtlWakeConditionVariable () returned 0x27e828 [0093.686] GetCurrentThreadId () returned 0x99c [0093.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.686] lstrlenW (lpString=".vhd") returned 4 [0093.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".vhd") returned 0x0 [0093.686] lstrlenW (lpString=".vhdx") returned 5 [0093.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".vhdx") returned 0x0 [0093.686] lstrlenW (lpString=".pst") returned 4 [0093.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".pst") returned 0x0 [0093.686] lstrlenW (lpString=".ost") returned 4 [0093.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".ost") returned 0x0 [0093.686] lstrlenW (lpString=".bak") returned 4 [0093.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".bak") returned 0x0 [0093.686] lstrlenW (lpString=".bac") returned 4 [0093.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".bac") returned 0x0 [0093.687] lstrlenW (lpString=".sys") returned 4 [0093.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".sys") returned 0x0 [0093.687] lstrlenW (lpString=".v2i") returned 4 [0093.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".v2i") returned 0x0 [0093.687] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch="s\r\n.v2i") returned 0x0 [0093.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.689] lstrlenW (lpString=".sql") returned 4 [0093.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".sql") returned 0x0 [0093.689] lstrlenW (lpString=".mdf") returned 4 [0093.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".mdf") returned 0x0 [0093.689] lstrlenW (lpString=".txt") returned 4 [0093.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".txt") returned 0x0 [0093.689] lstrlenW (lpString=".dbf") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".dbf") returned 0x0 [0093.690] lstrlenW (lpString=".ckp") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".ckp") returned 0x0 [0093.690] lstrlenW (lpString=".dacpac") returned 7 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".dacpac") returned 0x0 [0093.690] lstrlenW (lpString=".db3") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".db3") returned 0x0 [0093.690] lstrlenW (lpString=".dtxs") returned 5 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".dtxs") returned 0x0 [0093.690] lstrlenW (lpString=".mdt") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".mdt") returned 0x0 [0093.690] lstrlenW (lpString=".sdf") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".sdf") returned 0x0 [0093.690] lstrlenW (lpString=".MDF") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".MDF") returned 0x0 [0093.690] lstrlenW (lpString=".DBF") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".DBF") returned 0x0 [0093.690] lstrlenW (lpString=".DB") returned 3 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".DB") returned 0x0 [0093.690] lstrlenW (lpString=".db") returned 3 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".db") returned 0x0 [0093.690] lstrlenW (lpString=".ndf") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".ndf") returned 0x0 [0093.690] lstrlenW (lpString=".NDF") returned 4 [0093.690] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".NDF") returned 0x0 [0093.690] lstrlenW (lpString=".Mdf") returned 4 [0093.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".Mdf") returned 0x0 [0093.691] lstrlenW (lpString=".dat") returned 4 [0093.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".dat") returned 0x0 [0093.691] lstrlenW (lpString=".DAT") returned 4 [0093.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".DAT") returned 0x0 [0093.691] lstrlenW (lpString=".ldf") returned 4 [0093.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.691] lstrlenW (lpString=".LDF") returned 4 [0093.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch=".LDF") returned 0x0 [0093.691] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.691] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.691] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e958) returned 1 [0093.692] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.692] CryptReleaseContext (hProv=0x33e958, dwFlags=0x0) returned 1 [0093.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0093.692] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21369315687) returned 1 [0093.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6a74c70, dwHighDateTime=0x1d585b4)) [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df2f0 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df2f0 | out: hHeap=0x260000) returned 1 [0093.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.693] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.693] GetLastError () returned 0x0 [0093.693] GetLastError () returned 0x0 [0093.693] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.693] GetLastError () returned 0x0 [0093.693] GetLastError () returned 0x0 [0093.696] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff5890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.696] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa770, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xa770, lpOverlapped=0x0) returned 1 [0093.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.696] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.697] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.697] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.697] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.697] CloseHandle (hObject=0xe4) returned 1 [0093.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x150) returned 0x2b2d80 [0093.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0093.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.701] GetLastError () returned 0x0 [0093.701] RtlWakeConditionVariable () returned 0x27e828 [0093.701] GetCurrentThreadId () returned 0x99c [0093.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.701] lstrlenW (lpString=".vhd") returned 4 [0093.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".vhd") returned 0x0 [0093.701] lstrlenW (lpString=".vhdx") returned 5 [0093.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".vhdx") returned 0x0 [0093.701] lstrlenW (lpString=".pst") returned 4 [0093.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".pst") returned 0x0 [0093.701] lstrlenW (lpString=".ost") returned 4 [0093.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ost") returned 0x0 [0093.701] lstrlenW (lpString=".bak") returned 4 [0093.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".bak") returned 0x0 [0093.702] lstrlenW (lpString=".bac") returned 4 [0093.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".bac") returned 0x0 [0093.702] lstrlenW (lpString=".sys") returned 4 [0093.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".sys") returned 0x0 [0093.702] lstrlenW (lpString=".v2i") returned 4 [0093.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".v2i") returned 0x0 [0093.702] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.815] lstrlenW (lpString=".sql") returned 4 [0093.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".sql") returned 0x0 [0093.815] lstrlenW (lpString=".mdf") returned 4 [0093.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".mdf") returned 0x0 [0093.815] lstrlenW (lpString=".txt") returned 4 [0093.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".txt") returned 0x0 [0093.830] lstrlenW (lpString=".dbf") returned 4 [0093.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dbf") returned 0x0 [0093.830] lstrlenW (lpString=".ckp") returned 4 [0093.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ckp") returned 0x0 [0093.830] lstrlenW (lpString=".dacpac") returned 7 [0093.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dacpac") returned 0x0 [0093.831] lstrlenW (lpString=".db3") returned 4 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".db3") returned 0x0 [0093.831] lstrlenW (lpString=".dtxs") returned 5 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dtxs") returned 0x0 [0093.831] lstrlenW (lpString=".mdt") returned 4 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".mdt") returned 0x0 [0093.831] lstrlenW (lpString=".sdf") returned 4 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".sdf") returned 0x0 [0093.831] lstrlenW (lpString=".MDF") returned 4 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".MDF") returned 0x0 [0093.831] lstrlenW (lpString=".DBF") returned 4 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".DBF") returned 0x0 [0093.831] lstrlenW (lpString=".DB") returned 3 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".DB") returned 0x0 [0093.831] lstrlenW (lpString=".db") returned 3 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".db") returned 0x0 [0093.831] lstrlenW (lpString=".ndf") returned 4 [0093.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ndf") returned 0x0 [0093.831] lstrlenW (lpString=".NDF") returned 4 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".NDF") returned 0x0 [0093.832] lstrlenW (lpString=".Mdf") returned 4 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".Mdf") returned 0x0 [0093.832] lstrlenW (lpString=".dat") returned 4 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dat") returned 0x0 [0093.832] lstrlenW (lpString=".DAT") returned 4 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".DAT") returned 0x0 [0093.832] lstrlenW (lpString=".ldf") returned 4 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.832] lstrlenW (lpString=".LDF") returned 4 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch=".LDF") returned 0x0 [0093.832] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.832] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e8d0) returned 1 [0093.833] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.833] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0093.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.833] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21383420665) returned 1 [0093.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6bcb8d0, dwHighDateTime=0x1d585b4)) [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df590 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df590 | out: hHeap=0x260000) returned 1 [0093.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.834] GetLastError () returned 0x0 [0093.834] GetLastError () returned 0x0 [0093.834] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.834] GetLastError () returned 0x0 [0093.834] GetLastError () returned 0x0 [0093.839] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.839] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.840] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.840] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.840] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.840] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.840] CloseHandle (hObject=0xe4) returned 1 [0093.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x150) returned 0x2b2d80 [0093.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0093.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.843] GetLastError () returned 0x0 [0093.843] RtlWakeConditionVariable () returned 0x0 [0093.843] GetCurrentThreadId () returned 0x99c [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".ldf") returned 0x0 [0093.843] lstrlenW (lpString=".vhd") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".vhd") returned 0x0 [0093.843] lstrlenW (lpString=".vhdx") returned 5 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".vhdx") returned 0x0 [0093.843] lstrlenW (lpString=".pst") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".pst") returned 0x0 [0093.843] lstrlenW (lpString=".ost") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".ost") returned 0x0 [0093.843] lstrlenW (lpString=".bak") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".bak") returned 0x0 [0093.843] lstrlenW (lpString=".bac") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".bac") returned 0x0 [0093.843] lstrlenW (lpString=".sys") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".sys") returned 0x0 [0093.843] lstrlenW (lpString=".v2i") returned 4 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".v2i") returned 0x0 [0093.843] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch="s\r\n.v2i") returned 0x0 [0093.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.845] lstrlenW (lpString=".sql") returned 4 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".sql") returned 0x0 [0093.845] lstrlenW (lpString=".mdf") returned 4 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".mdf") returned 0x0 [0093.845] lstrlenW (lpString=".txt") returned 4 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".txt") returned 0x0 [0093.845] lstrlenW (lpString=".dbf") returned 4 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".dbf") returned 0x0 [0093.845] lstrlenW (lpString=".ckp") returned 4 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".ckp") returned 0x0 [0093.845] lstrlenW (lpString=".dacpac") returned 7 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".dacpac") returned 0x0 [0093.845] lstrlenW (lpString=".db3") returned 4 [0093.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".db3") returned 0x0 [0093.846] lstrlenW (lpString=".dtxs") returned 5 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".dtxs") returned 0x0 [0093.846] lstrlenW (lpString=".mdt") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".mdt") returned 0x0 [0093.846] lstrlenW (lpString=".sdf") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".sdf") returned 0x0 [0093.846] lstrlenW (lpString=".MDF") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".MDF") returned 0x0 [0093.846] lstrlenW (lpString=".DBF") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".DBF") returned 0x0 [0093.846] lstrlenW (lpString=".DB") returned 3 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".DB") returned 0x0 [0093.846] lstrlenW (lpString=".db") returned 3 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".db") returned 0x0 [0093.846] lstrlenW (lpString=".ndf") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".ndf") returned 0x0 [0093.846] lstrlenW (lpString=".NDF") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".NDF") returned 0x0 [0093.846] lstrlenW (lpString=".Mdf") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".Mdf") returned 0x0 [0093.846] lstrlenW (lpString=".dat") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".dat") returned 0x0 [0093.846] lstrlenW (lpString=".DAT") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".DAT") returned 0x0 [0093.846] lstrlenW (lpString=".ldf") returned 4 [0093.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".ldf") returned 0x0 [0093.847] lstrlenW (lpString=".LDF") returned 4 [0093.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch=".LDF") returned 0x0 [0093.847] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.847] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e8d0) returned 1 [0093.848] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.848] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0093.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.848] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21384892296) returned 1 [0093.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6bf1a30, dwHighDateTime=0x1d585b4)) [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df5c8 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df5c8 | out: hHeap=0x260000) returned 1 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33c080 [0093.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c080 | out: hHeap=0x260000) returned 1 [0093.848] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.849] GetLastError () returned 0x0 [0093.849] GetLastError () returned 0x0 [0093.849] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.849] GetLastError () returned 0x0 [0093.849] GetLastError () returned 0x0 [0093.854] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.854] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.855] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.855] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.856] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.856] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.856] CloseHandle (hObject=0xe4) returned 1 [0093.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27dc3f0 [0093.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.[deadmin@cock.li].deadmin")) returned 1 [0093.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc3f0 | out: hHeap=0x260000) returned 1 [0093.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.858] GetLastError () returned 0x0 [0093.858] RtlWakeConditionVariable () returned 0x0 [0093.858] GetCurrentThreadId () returned 0x99c [0093.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".ldf") returned 0x0 [0093.858] lstrlenW (lpString=".vhd") returned 4 [0093.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".vhd") returned 0x0 [0093.859] lstrlenW (lpString=".vhdx") returned 5 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".vhdx") returned 0x0 [0093.859] lstrlenW (lpString=".pst") returned 4 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".pst") returned 0x0 [0093.859] lstrlenW (lpString=".ost") returned 4 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".ost") returned 0x0 [0093.859] lstrlenW (lpString=".bak") returned 4 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".bak") returned 0x0 [0093.859] lstrlenW (lpString=".bac") returned 4 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".bac") returned 0x0 [0093.859] lstrlenW (lpString=".sys") returned 4 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".sys") returned 0x0 [0093.859] lstrlenW (lpString=".v2i") returned 4 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".v2i") returned 0x0 [0093.859] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch="s\r\n.v2i") returned 0x0 [0093.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.860] lstrlenW (lpString=".sql") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".sql") returned 0x0 [0093.861] lstrlenW (lpString=".mdf") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".mdf") returned 0x0 [0093.861] lstrlenW (lpString=".txt") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".txt") returned 0x0 [0093.861] lstrlenW (lpString=".dbf") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".dbf") returned 0x0 [0093.861] lstrlenW (lpString=".ckp") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".ckp") returned 0x0 [0093.861] lstrlenW (lpString=".dacpac") returned 7 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".dacpac") returned 0x0 [0093.861] lstrlenW (lpString=".db3") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".db3") returned 0x0 [0093.861] lstrlenW (lpString=".dtxs") returned 5 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".dtxs") returned 0x0 [0093.861] lstrlenW (lpString=".mdt") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".mdt") returned 0x0 [0093.861] lstrlenW (lpString=".sdf") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".sdf") returned 0x0 [0093.861] lstrlenW (lpString=".MDF") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".MDF") returned 0x0 [0093.861] lstrlenW (lpString=".DBF") returned 4 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".DBF") returned 0x0 [0093.861] lstrlenW (lpString=".DB") returned 3 [0093.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".DB") returned 0x0 [0093.862] lstrlenW (lpString=".db") returned 3 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".db") returned 0x0 [0093.862] lstrlenW (lpString=".ndf") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".ndf") returned 0x0 [0093.862] lstrlenW (lpString=".NDF") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".NDF") returned 0x0 [0093.862] lstrlenW (lpString=".Mdf") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".Mdf") returned 0x0 [0093.862] lstrlenW (lpString=".dat") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".dat") returned 0x0 [0093.862] lstrlenW (lpString=".DAT") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".DAT") returned 0x0 [0093.862] lstrlenW (lpString=".ldf") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".ldf") returned 0x0 [0093.862] lstrlenW (lpString=".LDF") returned 4 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch=".LDF") returned 0x0 [0093.862] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.862] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e8d0) returned 1 [0093.863] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.863] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0093.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.863] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21386445173) returned 1 [0093.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6c17b90, dwHighDateTime=0x1d585b4)) [0093.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df600 [0093.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df600 | out: hHeap=0x260000) returned 1 [0093.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.864] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.864] GetLastError () returned 0x0 [0093.864] GetLastError () returned 0x0 [0093.864] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.865] GetLastError () returned 0x0 [0093.865] GetLastError () returned 0x0 [0093.949] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.950] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.951] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.951] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.952] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.952] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.952] CloseHandle (hObject=0xe4) returned 1 [0093.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0093.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.[deadmin@cock.li].deadmin")) returned 1 [0093.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.955] GetLastError () returned 0x0 [0093.955] RtlWakeConditionVariable () returned 0x0 [0093.955] GetCurrentThreadId () returned 0x99c [0093.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".ldf") returned 0x0 [0093.955] lstrlenW (lpString=".vhd") returned 4 [0093.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".vhd") returned 0x0 [0093.955] lstrlenW (lpString=".vhdx") returned 5 [0093.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".vhdx") returned 0x0 [0093.955] lstrlenW (lpString=".pst") returned 4 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".pst") returned 0x0 [0093.956] lstrlenW (lpString=".ost") returned 4 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".ost") returned 0x0 [0093.956] lstrlenW (lpString=".bak") returned 4 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".bak") returned 0x0 [0093.956] lstrlenW (lpString=".bac") returned 4 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".bac") returned 0x0 [0093.956] lstrlenW (lpString=".sys") returned 4 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".sys") returned 0x0 [0093.956] lstrlenW (lpString=".v2i") returned 4 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".v2i") returned 0x0 [0093.956] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.958] lstrlenW (lpString=".sql") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".sql") returned 0x0 [0093.958] lstrlenW (lpString=".mdf") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".mdf") returned 0x0 [0093.958] lstrlenW (lpString=".txt") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".txt") returned 0x0 [0093.958] lstrlenW (lpString=".dbf") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".dbf") returned 0x0 [0093.958] lstrlenW (lpString=".ckp") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".ckp") returned 0x0 [0093.958] lstrlenW (lpString=".dacpac") returned 7 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".dacpac") returned 0x0 [0093.958] lstrlenW (lpString=".db3") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".db3") returned 0x0 [0093.958] lstrlenW (lpString=".dtxs") returned 5 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".dtxs") returned 0x0 [0093.958] lstrlenW (lpString=".mdt") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".mdt") returned 0x0 [0093.958] lstrlenW (lpString=".sdf") returned 4 [0093.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".sdf") returned 0x0 [0093.959] lstrlenW (lpString=".MDF") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".MDF") returned 0x0 [0093.959] lstrlenW (lpString=".DBF") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".DBF") returned 0x0 [0093.959] lstrlenW (lpString=".DB") returned 3 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".DB") returned 0x0 [0093.959] lstrlenW (lpString=".db") returned 3 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".db") returned 0x0 [0093.959] lstrlenW (lpString=".ndf") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".ndf") returned 0x0 [0093.959] lstrlenW (lpString=".NDF") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".NDF") returned 0x0 [0093.959] lstrlenW (lpString=".Mdf") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".Mdf") returned 0x0 [0093.959] lstrlenW (lpString=".dat") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".dat") returned 0x0 [0093.959] lstrlenW (lpString=".DAT") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".DAT") returned 0x0 [0093.959] lstrlenW (lpString=".ldf") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".ldf") returned 0x0 [0093.959] lstrlenW (lpString=".LDF") returned 4 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch=".LDF") returned 0x0 [0093.959] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.960] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33ec88) returned 1 [0093.960] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.960] CryptReleaseContext (hProv=0x33ec88, dwFlags=0x0) returned 1 [0093.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.960] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.961] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21396173295) returned 1 [0093.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6d22530, dwHighDateTime=0x1d585b4)) [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df750 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df750 | out: hHeap=0x260000) returned 1 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.961] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.961] GetLastError () returned 0x0 [0093.962] GetLastError () returned 0x0 [0093.962] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.962] GetLastError () returned 0x0 [0093.962] GetLastError () returned 0x0 [0093.965] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.965] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.967] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.967] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.967] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.967] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.967] CloseHandle (hObject=0xe4) returned 1 [0093.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.969] GetLastError () returned 0x0 [0093.969] RtlWakeConditionVariable () returned 0x0 [0093.969] GetCurrentThreadId () returned 0x99c [0093.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".ldf") returned 0x0 [0093.969] lstrlenW (lpString=".vhd") returned 4 [0093.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".vhd") returned 0x0 [0093.969] lstrlenW (lpString=".vhdx") returned 5 [0093.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".vhdx") returned 0x0 [0093.969] lstrlenW (lpString=".pst") returned 4 [0093.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".pst") returned 0x0 [0093.969] lstrlenW (lpString=".ost") returned 4 [0093.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".ost") returned 0x0 [0093.970] lstrlenW (lpString=".bak") returned 4 [0093.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".bak") returned 0x0 [0093.970] lstrlenW (lpString=".bac") returned 4 [0093.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".bac") returned 0x0 [0093.970] lstrlenW (lpString=".sys") returned 4 [0093.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".sys") returned 0x0 [0093.970] lstrlenW (lpString=".v2i") returned 4 [0093.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".v2i") returned 0x0 [0093.970] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch="s\r\n.v2i") returned 0x0 [0093.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.971] lstrlenW (lpString=".sql") returned 4 [0093.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".sql") returned 0x0 [0093.971] lstrlenW (lpString=".mdf") returned 4 [0093.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".mdf") returned 0x0 [0093.971] lstrlenW (lpString=".txt") returned 4 [0093.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".txt") returned 0x0 [0093.971] lstrlenW (lpString=".dbf") returned 4 [0093.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".dbf") returned 0x0 [0093.971] lstrlenW (lpString=".ckp") returned 4 [0093.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".ckp") returned 0x0 [0093.971] lstrlenW (lpString=".dacpac") returned 7 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".dacpac") returned 0x0 [0093.972] lstrlenW (lpString=".db3") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".db3") returned 0x0 [0093.972] lstrlenW (lpString=".dtxs") returned 5 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".dtxs") returned 0x0 [0093.972] lstrlenW (lpString=".mdt") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".mdt") returned 0x0 [0093.972] lstrlenW (lpString=".sdf") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".sdf") returned 0x0 [0093.972] lstrlenW (lpString=".MDF") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".MDF") returned 0x0 [0093.972] lstrlenW (lpString=".DBF") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".DBF") returned 0x0 [0093.972] lstrlenW (lpString=".DB") returned 3 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".DB") returned 0x0 [0093.972] lstrlenW (lpString=".db") returned 3 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".db") returned 0x0 [0093.972] lstrlenW (lpString=".ndf") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".ndf") returned 0x0 [0093.972] lstrlenW (lpString=".NDF") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".NDF") returned 0x0 [0093.972] lstrlenW (lpString=".Mdf") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".Mdf") returned 0x0 [0093.972] lstrlenW (lpString=".dat") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".dat") returned 0x0 [0093.972] lstrlenW (lpString=".DAT") returned 4 [0093.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".DAT") returned 0x0 [0093.973] lstrlenW (lpString=".ldf") returned 4 [0093.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".ldf") returned 0x0 [0093.973] lstrlenW (lpString=".LDF") returned 4 [0093.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch=".LDF") returned 0x0 [0093.973] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.973] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33eea8) returned 1 [0093.974] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.974] CryptReleaseContext (hProv=0x33eea8, dwFlags=0x0) returned 1 [0093.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.974] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21397495146) returned 1 [0093.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6d22530, dwHighDateTime=0x1d585b4)) [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df788 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df788 | out: hHeap=0x260000) returned 1 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.975] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.975] GetLastError () returned 0x0 [0093.975] GetLastError () returned 0x0 [0093.975] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0093.975] GetLastError () returned 0x0 [0093.975] GetLastError () returned 0x0 [0093.978] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.978] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.979] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.980] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.981] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.981] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.981] CloseHandle (hObject=0xe4) returned 1 [0093.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.[deadmin@cock.li].deadmin")) returned 1 [0093.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.983] GetLastError () returned 0x0 [0093.983] RtlWakeConditionVariable () returned 0x0 [0093.983] GetCurrentThreadId () returned 0x99c [0093.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".ldf") returned 0x0 [0093.983] lstrlenW (lpString=".vhd") returned 4 [0093.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".vhd") returned 0x0 [0093.984] lstrlenW (lpString=".vhdx") returned 5 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".vhdx") returned 0x0 [0093.984] lstrlenW (lpString=".pst") returned 4 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".pst") returned 0x0 [0093.984] lstrlenW (lpString=".ost") returned 4 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".ost") returned 0x0 [0093.984] lstrlenW (lpString=".bak") returned 4 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".bak") returned 0x0 [0093.984] lstrlenW (lpString=".bac") returned 4 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".bac") returned 0x0 [0093.984] lstrlenW (lpString=".sys") returned 4 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".sys") returned 0x0 [0093.984] lstrlenW (lpString=".v2i") returned 4 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".v2i") returned 0x0 [0093.984] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch="s\r\n.v2i") returned 0x0 [0093.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0093.986] lstrlenW (lpString=".sql") returned 4 [0093.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".sql") returned 0x0 [0093.986] lstrlenW (lpString=".mdf") returned 4 [0093.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".mdf") returned 0x0 [0093.986] lstrlenW (lpString=".txt") returned 4 [0093.986] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".txt") returned 0x0 [0093.987] lstrlenW (lpString=".dbf") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".dbf") returned 0x0 [0093.987] lstrlenW (lpString=".ckp") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".ckp") returned 0x0 [0093.987] lstrlenW (lpString=".dacpac") returned 7 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".dacpac") returned 0x0 [0093.987] lstrlenW (lpString=".db3") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".db3") returned 0x0 [0093.987] lstrlenW (lpString=".dtxs") returned 5 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".dtxs") returned 0x0 [0093.987] lstrlenW (lpString=".mdt") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".mdt") returned 0x0 [0093.987] lstrlenW (lpString=".sdf") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".sdf") returned 0x0 [0093.987] lstrlenW (lpString=".MDF") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".MDF") returned 0x0 [0093.987] lstrlenW (lpString=".DBF") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".DBF") returned 0x0 [0093.987] lstrlenW (lpString=".DB") returned 3 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".DB") returned 0x0 [0093.987] lstrlenW (lpString=".db") returned 3 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".db") returned 0x0 [0093.987] lstrlenW (lpString=".ndf") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".ndf") returned 0x0 [0093.987] lstrlenW (lpString=".NDF") returned 4 [0093.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".NDF") returned 0x0 [0093.987] lstrlenW (lpString=".Mdf") returned 4 [0093.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".Mdf") returned 0x0 [0093.988] lstrlenW (lpString=".dat") returned 4 [0093.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".dat") returned 0x0 [0093.988] lstrlenW (lpString=".DAT") returned 4 [0093.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".DAT") returned 0x0 [0093.988] lstrlenW (lpString=".ldf") returned 4 [0093.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".ldf") returned 0x0 [0093.988] lstrlenW (lpString=".LDF") returned 4 [0093.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch=".LDF") returned 0x0 [0093.988] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.988] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33ef30) returned 1 [0093.989] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.989] CryptReleaseContext (hProv=0x33ef30, dwFlags=0x0) returned 1 [0093.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0093.989] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21399009575) returned 1 [0093.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6d48690, dwHighDateTime=0x1d585b4)) [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df7c0 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df7c0 | out: hHeap=0x260000) returned 1 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.990] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0093.990] GetLastError () returned 0x0 [0094.077] GetLastError () returned 0x0 [0094.077] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.088] GetLastError () returned 0x0 [0094.088] GetLastError () returned 0x0 [0094.102] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.102] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.103] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.103] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.103] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.103] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.103] CloseHandle (hObject=0xd8) returned 1 [0094.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.[deadmin@cock.li].deadmin")) returned 1 [0094.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.105] GetLastError () returned 0x0 [0094.105] RtlWakeConditionVariable () returned 0x0 [0094.105] GetCurrentThreadId () returned 0x99c [0094.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".ldf") returned 0x0 [0094.105] lstrlenW (lpString=".vhd") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".vhd") returned 0x0 [0094.106] lstrlenW (lpString=".vhdx") returned 5 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".vhdx") returned 0x0 [0094.106] lstrlenW (lpString=".pst") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".pst") returned 0x0 [0094.106] lstrlenW (lpString=".ost") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".ost") returned 0x0 [0094.106] lstrlenW (lpString=".bak") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".bak") returned 0x0 [0094.106] lstrlenW (lpString=".bac") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".bac") returned 0x0 [0094.106] lstrlenW (lpString=".sys") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".sys") returned 0x0 [0094.106] lstrlenW (lpString=".v2i") returned 4 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".v2i") returned 0x0 [0094.106] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch="s\r\n.v2i") returned 0x0 [0094.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.107] lstrlenW (lpString=".sql") returned 4 [0094.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".sql") returned 0x0 [0094.107] lstrlenW (lpString=".mdf") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".mdf") returned 0x0 [0094.108] lstrlenW (lpString=".txt") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".txt") returned 0x0 [0094.108] lstrlenW (lpString=".dbf") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".dbf") returned 0x0 [0094.108] lstrlenW (lpString=".ckp") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".ckp") returned 0x0 [0094.108] lstrlenW (lpString=".dacpac") returned 7 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".dacpac") returned 0x0 [0094.108] lstrlenW (lpString=".db3") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".db3") returned 0x0 [0094.108] lstrlenW (lpString=".dtxs") returned 5 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".dtxs") returned 0x0 [0094.108] lstrlenW (lpString=".mdt") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".mdt") returned 0x0 [0094.108] lstrlenW (lpString=".sdf") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".sdf") returned 0x0 [0094.108] lstrlenW (lpString=".MDF") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".MDF") returned 0x0 [0094.108] lstrlenW (lpString=".DBF") returned 4 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".DBF") returned 0x0 [0094.108] lstrlenW (lpString=".DB") returned 3 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".DB") returned 0x0 [0094.108] lstrlenW (lpString=".db") returned 3 [0094.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".db") returned 0x0 [0094.108] lstrlenW (lpString=".ndf") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".ndf") returned 0x0 [0094.109] lstrlenW (lpString=".NDF") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".NDF") returned 0x0 [0094.109] lstrlenW (lpString=".Mdf") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".Mdf") returned 0x0 [0094.109] lstrlenW (lpString=".dat") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".dat") returned 0x0 [0094.109] lstrlenW (lpString=".DAT") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".DAT") returned 0x0 [0094.109] lstrlenW (lpString=".ldf") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".ldf") returned 0x0 [0094.109] lstrlenW (lpString=".LDF") returned 4 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch=".LDF") returned 0x0 [0094.109] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.109] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33ed10) returned 1 [0094.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.110] CryptReleaseContext (hProv=0x33ed10, dwFlags=0x0) returned 1 [0094.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.110] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21411145909) returned 1 [0094.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6e79190, dwHighDateTime=0x1d585b4)) [0094.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df9f0 [0094.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df9f0 | out: hHeap=0x260000) returned 1 [0094.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812588 [0094.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812588 | out: hHeap=0x260000) returned 1 [0094.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.111] GetLastError () returned 0x0 [0094.111] GetLastError () returned 0x0 [0094.111] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] GetLastError () returned 0x0 [0094.114] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff1f39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.114] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe0c7, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xe0c7, lpOverlapped=0x0) returned 1 [0094.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.114] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.114] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.114] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.114] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.114] CloseHandle (hObject=0xd8) returned 1 [0094.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0094.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam.[deadmin@cock.li].deadmin")) returned 1 [0094.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0094.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.116] GetLastError () returned 0x0 [0094.116] RtlWakeConditionVariable () returned 0x0 [0094.116] GetCurrentThreadId () returned 0x99c [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".ldf") returned 0x0 [0094.117] lstrlenW (lpString=".vhd") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".vhd") returned 0x0 [0094.117] lstrlenW (lpString=".vhdx") returned 5 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".vhdx") returned 0x0 [0094.117] lstrlenW (lpString=".pst") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".pst") returned 0x0 [0094.117] lstrlenW (lpString=".ost") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".ost") returned 0x0 [0094.117] lstrlenW (lpString=".bak") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".bak") returned 0x0 [0094.117] lstrlenW (lpString=".bac") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".bac") returned 0x0 [0094.117] lstrlenW (lpString=".sys") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".sys") returned 0x0 [0094.117] lstrlenW (lpString=".v2i") returned 4 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".v2i") returned 0x0 [0094.117] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch="s\r\n.v2i") returned 0x0 [0094.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.118] lstrlenW (lpString=".sql") returned 4 [0094.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".sql") returned 0x0 [0094.118] lstrlenW (lpString=".mdf") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".mdf") returned 0x0 [0094.119] lstrlenW (lpString=".txt") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".txt") returned 0x0 [0094.119] lstrlenW (lpString=".dbf") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".dbf") returned 0x0 [0094.119] lstrlenW (lpString=".ckp") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".ckp") returned 0x0 [0094.119] lstrlenW (lpString=".dacpac") returned 7 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".dacpac") returned 0x0 [0094.119] lstrlenW (lpString=".db3") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".db3") returned 0x0 [0094.119] lstrlenW (lpString=".dtxs") returned 5 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".dtxs") returned 0x0 [0094.119] lstrlenW (lpString=".mdt") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".mdt") returned 0x0 [0094.119] lstrlenW (lpString=".sdf") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".sdf") returned 0x0 [0094.119] lstrlenW (lpString=".MDF") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".MDF") returned 0x0 [0094.119] lstrlenW (lpString=".DBF") returned 4 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".DBF") returned 0x0 [0094.119] lstrlenW (lpString=".DB") returned 3 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".DB") returned 0x0 [0094.119] lstrlenW (lpString=".db") returned 3 [0094.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".db") returned 0x0 [0094.119] lstrlenW (lpString=".ndf") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".ndf") returned 0x0 [0094.120] lstrlenW (lpString=".NDF") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".NDF") returned 0x0 [0094.120] lstrlenW (lpString=".Mdf") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".Mdf") returned 0x0 [0094.120] lstrlenW (lpString=".dat") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".dat") returned 0x0 [0094.120] lstrlenW (lpString=".DAT") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".DAT") returned 0x0 [0094.120] lstrlenW (lpString=".ldf") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".ldf") returned 0x0 [0094.120] lstrlenW (lpString=".LDF") returned 4 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch=".LDF") returned 0x0 [0094.120] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.120] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33ed10) returned 1 [0094.121] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.121] CryptReleaseContext (hProv=0x33ed10, dwFlags=0x0) returned 1 [0094.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.121] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21412231728) returned 1 [0094.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6e9f2f0, dwHighDateTime=0x1d585b4)) [0094.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfa28 [0094.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfa28 | out: hHeap=0x260000) returned 1 [0094.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317ba0 [0094.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317ba0 | out: hHeap=0x260000) returned 1 [0094.122] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.122] GetLastError () returned 0x0 [0094.122] GetLastError () returned 0x0 [0094.122] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.122] GetLastError () returned 0x0 [0094.123] GetLastError () returned 0x0 [0094.124] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff949e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.124] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6b62, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x6b62, lpOverlapped=0x0) returned 1 [0094.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.125] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.125] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.125] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.125] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.125] CloseHandle (hObject=0xd8) returned 1 [0094.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0094.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam.[deadmin@cock.li].deadmin")) returned 1 [0094.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0094.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.127] GetLastError () returned 0x0 [0094.127] RtlWakeConditionVariable () returned 0x0 [0094.127] GetCurrentThreadId () returned 0x99c [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".ldf") returned 0x0 [0094.127] lstrlenW (lpString=".vhd") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".vhd") returned 0x0 [0094.127] lstrlenW (lpString=".vhdx") returned 5 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".vhdx") returned 0x0 [0094.127] lstrlenW (lpString=".pst") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".pst") returned 0x0 [0094.127] lstrlenW (lpString=".ost") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".ost") returned 0x0 [0094.127] lstrlenW (lpString=".bak") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".bak") returned 0x0 [0094.127] lstrlenW (lpString=".bac") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".bac") returned 0x0 [0094.127] lstrlenW (lpString=".sys") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".sys") returned 0x0 [0094.127] lstrlenW (lpString=".v2i") returned 4 [0094.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".v2i") returned 0x0 [0094.127] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch="s\r\n.v2i") returned 0x0 [0094.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0094.129] lstrlenW (lpString=".sql") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".sql") returned 0x0 [0094.129] lstrlenW (lpString=".mdf") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".mdf") returned 0x0 [0094.129] lstrlenW (lpString=".txt") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".txt") returned 0x0 [0094.129] lstrlenW (lpString=".dbf") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".dbf") returned 0x0 [0094.129] lstrlenW (lpString=".ckp") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".ckp") returned 0x0 [0094.129] lstrlenW (lpString=".dacpac") returned 7 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".dacpac") returned 0x0 [0094.129] lstrlenW (lpString=".db3") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".db3") returned 0x0 [0094.129] lstrlenW (lpString=".dtxs") returned 5 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".dtxs") returned 0x0 [0094.129] lstrlenW (lpString=".mdt") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".mdt") returned 0x0 [0094.129] lstrlenW (lpString=".sdf") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".sdf") returned 0x0 [0094.129] lstrlenW (lpString=".MDF") returned 4 [0094.129] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".MDF") returned 0x0 [0094.130] lstrlenW (lpString=".DBF") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".DBF") returned 0x0 [0094.130] lstrlenW (lpString=".DB") returned 3 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".DB") returned 0x0 [0094.130] lstrlenW (lpString=".db") returned 3 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".db") returned 0x0 [0094.130] lstrlenW (lpString=".ndf") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".ndf") returned 0x0 [0094.130] lstrlenW (lpString=".NDF") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".NDF") returned 0x0 [0094.130] lstrlenW (lpString=".Mdf") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".Mdf") returned 0x0 [0094.130] lstrlenW (lpString=".dat") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".dat") returned 0x0 [0094.130] lstrlenW (lpString=".DAT") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".DAT") returned 0x0 [0094.130] lstrlenW (lpString=".ldf") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".ldf") returned 0x0 [0094.130] lstrlenW (lpString=".LDF") returned 4 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch=".LDF") returned 0x0 [0094.130] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0094.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.131] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33ed10) returned 1 [0094.132] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.132] CryptReleaseContext (hProv=0x33ed10, dwFlags=0x0) returned 1 [0094.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0094.132] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21413307435) returned 1 [0094.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc6ec5450, dwHighDateTime=0x1d585b4)) [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfa60 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfa60 | out: hHeap=0x260000) returned 1 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.133] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.133] GetLastError () returned 0x0 [0094.133] GetLastError () returned 0x0 [0094.133] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.133] GetLastError () returned 0x0 [0094.133] GetLastError () returned 0x0 [0094.195] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff30d5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.195] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcf2b, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0xcf2b, lpOverlapped=0x0) returned 1 [0094.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.196] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.196] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.196] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.196] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.196] CloseHandle (hObject=0xd8) returned 1 [0094.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0094.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam.[deadmin@cock.li].deadmin")) returned 1 [0094.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0094.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0094.246] GetLastError () returned 0x0 [0094.246] RtlWakeConditionVariable () returned 0x0 [0094.246] GetCurrentThreadId () returned 0x99c [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".ldf") returned 0x0 [0094.247] lstrlenW (lpString=".vhd") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".vhd") returned 0x0 [0094.247] lstrlenW (lpString=".vhdx") returned 5 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".vhdx") returned 0x0 [0094.247] lstrlenW (lpString=".pst") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".pst") returned 0x0 [0094.247] lstrlenW (lpString=".ost") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".ost") returned 0x0 [0094.247] lstrlenW (lpString=".bak") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".bak") returned 0x0 [0094.247] lstrlenW (lpString=".bac") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".bac") returned 0x0 [0094.247] lstrlenW (lpString=".sys") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".sys") returned 0x0 [0094.247] lstrlenW (lpString=".v2i") returned 4 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".v2i") returned 0x0 [0094.247] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0094.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.299] lstrlenW (lpString=".sql") returned 4 [0094.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".sql") returned 0x0 [0094.303] lstrlenW (lpString=".mdf") returned 4 [0094.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".mdf") returned 0x0 [0094.303] lstrlenW (lpString=".txt") returned 4 [0094.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".txt") returned 0x0 [0094.303] lstrlenW (lpString=".dbf") returned 4 [0094.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".dbf") returned 0x0 [0094.303] lstrlenW (lpString=".ckp") returned 4 [0094.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".ckp") returned 0x0 [0094.303] lstrlenW (lpString=".dacpac") returned 7 [0094.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".dacpac") returned 0x0 [0094.304] lstrlenW (lpString=".db3") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".db3") returned 0x0 [0094.304] lstrlenW (lpString=".dtxs") returned 5 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".dtxs") returned 0x0 [0094.304] lstrlenW (lpString=".mdt") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".mdt") returned 0x0 [0094.304] lstrlenW (lpString=".sdf") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".sdf") returned 0x0 [0094.304] lstrlenW (lpString=".MDF") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".MDF") returned 0x0 [0094.304] lstrlenW (lpString=".DBF") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".DBF") returned 0x0 [0094.304] lstrlenW (lpString=".DB") returned 3 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".DB") returned 0x0 [0094.304] lstrlenW (lpString=".db") returned 3 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".db") returned 0x0 [0094.304] lstrlenW (lpString=".ndf") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".ndf") returned 0x0 [0094.304] lstrlenW (lpString=".NDF") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".NDF") returned 0x0 [0094.304] lstrlenW (lpString=".Mdf") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".Mdf") returned 0x0 [0094.304] lstrlenW (lpString=".dat") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".dat") returned 0x0 [0094.304] lstrlenW (lpString=".DAT") returned 4 [0094.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpSrch=".DAT") returned=".DAT" [0094.304] lstrlenW (lpString=".DAT") returned 4 [0094.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.305] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33e8d0) returned 1 [0094.305] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.305] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0094.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.306] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21430672322) returned 1 [0094.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7068370, dwHighDateTime=0x1d585b4)) [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfde0 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfde0 | out: hHeap=0x260000) returned 1 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.306] GetLastError () returned 0x0 [0094.307] GetLastError () returned 0x0 [0094.307] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.307] GetLastError () returned 0x0 [0094.307] GetLastError () returned 0x0 [0094.523] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.523] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x10000, lpOverlapped=0x0) returned 1 [0094.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.524] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.524] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.524] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.524] CloseHandle (hObject=0xe4) returned 1 [0094.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat.[deadmin@cock.li].deadmin")) returned 1 [0094.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.527] GetLastError () returned 0x0 [0094.527] RtlWakeConditionVariable () returned 0x0 [0094.527] GetCurrentThreadId () returned 0x99c [0094.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".ldf") returned 0x0 [0094.527] lstrlenW (lpString=".vhd") returned 4 [0094.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".vhd") returned 0x0 [0094.527] lstrlenW (lpString=".vhdx") returned 5 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".vhdx") returned 0x0 [0094.528] lstrlenW (lpString=".pst") returned 4 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".pst") returned 0x0 [0094.528] lstrlenW (lpString=".ost") returned 4 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".ost") returned 0x0 [0094.528] lstrlenW (lpString=".bak") returned 4 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".bak") returned 0x0 [0094.528] lstrlenW (lpString=".bac") returned 4 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".bac") returned 0x0 [0094.528] lstrlenW (lpString=".sys") returned 4 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".sys") returned 0x0 [0094.528] lstrlenW (lpString=".v2i") returned 4 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".v2i") returned 0x0 [0094.528] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.530] lstrlenW (lpString=".sql") returned 4 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".sql") returned 0x0 [0094.530] lstrlenW (lpString=".mdf") returned 4 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".mdf") returned 0x0 [0094.530] lstrlenW (lpString=".txt") returned 4 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".txt") returned 0x0 [0094.530] lstrlenW (lpString=".dbf") returned 4 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".dbf") returned 0x0 [0094.530] lstrlenW (lpString=".ckp") returned 4 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".ckp") returned 0x0 [0094.530] lstrlenW (lpString=".dacpac") returned 7 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".dacpac") returned 0x0 [0094.530] lstrlenW (lpString=".db3") returned 4 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".db3") returned 0x0 [0094.530] lstrlenW (lpString=".dtxs") returned 5 [0094.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".dtxs") returned 0x0 [0094.530] lstrlenW (lpString=".mdt") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".mdt") returned 0x0 [0094.531] lstrlenW (lpString=".sdf") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".sdf") returned 0x0 [0094.531] lstrlenW (lpString=".MDF") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".MDF") returned 0x0 [0094.531] lstrlenW (lpString=".DBF") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".DBF") returned 0x0 [0094.531] lstrlenW (lpString=".DB") returned 3 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".DB") returned 0x0 [0094.531] lstrlenW (lpString=".db") returned 3 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".db") returned 0x0 [0094.531] lstrlenW (lpString=".ndf") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".ndf") returned 0x0 [0094.531] lstrlenW (lpString=".NDF") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".NDF") returned 0x0 [0094.531] lstrlenW (lpString=".Mdf") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".Mdf") returned 0x0 [0094.531] lstrlenW (lpString=".dat") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".dat") returned 0x0 [0094.531] lstrlenW (lpString=".DAT") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".DAT") returned 0x0 [0094.531] lstrlenW (lpString=".ldf") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".ldf") returned 0x0 [0094.531] lstrlenW (lpString=".LDF") returned 4 [0094.531] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch=".LDF") returned 0x0 [0094.531] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.532] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.532] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33f590) returned 1 [0094.532] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.532] CryptReleaseContext (hProv=0x33f590, dwFlags=0x0) returned 1 [0094.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.533] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21453379422) returned 1 [0094.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc727d6b0, dwHighDateTime=0x1d585b4)) [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfef8 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfef8 | out: hHeap=0x260000) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dc60 [0094.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.533] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.534] GetLastError () returned 0x0 [0094.534] GetLastError () returned 0x0 [0094.534] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.534] GetLastError () returned 0x0 [0094.534] GetLastError () returned 0x0 [0094.538] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff6e42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.539] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x91be, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x91be, lpOverlapped=0x0) returned 1 [0094.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.539] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.539] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.539] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.539] CloseHandle (hObject=0xe4) returned 1 [0094.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.542] GetLastError () returned 0x0 [0094.542] RtlWakeConditionVariable () returned 0x0 [0094.542] GetCurrentThreadId () returned 0x99c [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".ldf") returned 0x0 [0094.542] lstrlenW (lpString=".vhd") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".vhd") returned 0x0 [0094.542] lstrlenW (lpString=".vhdx") returned 5 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".vhdx") returned 0x0 [0094.542] lstrlenW (lpString=".pst") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".pst") returned 0x0 [0094.542] lstrlenW (lpString=".ost") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".ost") returned 0x0 [0094.542] lstrlenW (lpString=".bak") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".bak") returned 0x0 [0094.542] lstrlenW (lpString=".bac") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".bac") returned 0x0 [0094.542] lstrlenW (lpString=".sys") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".sys") returned 0x0 [0094.542] lstrlenW (lpString=".v2i") returned 4 [0094.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".v2i") returned 0x0 [0094.542] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.544] lstrlenW (lpString=".sql") returned 4 [0094.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".sql") returned 0x0 [0094.544] lstrlenW (lpString=".mdf") returned 4 [0094.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".mdf") returned 0x0 [0094.544] lstrlenW (lpString=".txt") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".txt") returned 0x0 [0094.545] lstrlenW (lpString=".dbf") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".dbf") returned 0x0 [0094.545] lstrlenW (lpString=".ckp") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".ckp") returned 0x0 [0094.545] lstrlenW (lpString=".dacpac") returned 7 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".dacpac") returned 0x0 [0094.545] lstrlenW (lpString=".db3") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".db3") returned 0x0 [0094.545] lstrlenW (lpString=".dtxs") returned 5 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".dtxs") returned 0x0 [0094.545] lstrlenW (lpString=".mdt") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".mdt") returned 0x0 [0094.545] lstrlenW (lpString=".sdf") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".sdf") returned 0x0 [0094.545] lstrlenW (lpString=".MDF") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".MDF") returned 0x0 [0094.545] lstrlenW (lpString=".DBF") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".DBF") returned 0x0 [0094.545] lstrlenW (lpString=".DB") returned 3 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".DB") returned 0x0 [0094.545] lstrlenW (lpString=".db") returned 3 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".db") returned 0x0 [0094.545] lstrlenW (lpString=".ndf") returned 4 [0094.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".ndf") returned 0x0 [0094.545] lstrlenW (lpString=".NDF") returned 4 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".NDF") returned 0x0 [0094.546] lstrlenW (lpString=".Mdf") returned 4 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".Mdf") returned 0x0 [0094.546] lstrlenW (lpString=".dat") returned 4 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".dat") returned 0x0 [0094.546] lstrlenW (lpString=".DAT") returned 4 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".DAT") returned 0x0 [0094.546] lstrlenW (lpString=".ldf") returned 4 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".ldf") returned 0x0 [0094.546] lstrlenW (lpString=".LDF") returned 4 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch=".LDF") returned 0x0 [0094.546] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.546] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33f9d0) returned 1 [0094.547] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.547] CryptReleaseContext (hProv=0x33f9d0, dwFlags=0x0) returned 1 [0094.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.547] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21454824511) returned 1 [0094.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc72a3810, dwHighDateTime=0x1d585b4)) [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dff30 [0094.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dff30 | out: hHeap=0x260000) returned 1 [0094.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dc60 [0094.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.548] GetLastError () returned 0x0 [0094.548] GetLastError () returned 0x0 [0094.548] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.548] GetLastError () returned 0x0 [0094.549] GetLastError () returned 0x0 [0094.549] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.550] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x268, lpOverlapped=0x0) returned 1 [0094.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.550] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.550] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.550] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.550] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.550] CloseHandle (hObject=0xe4) returned 1 [0094.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.552] GetLastError () returned 0x0 [0094.552] RtlWakeConditionVariable () returned 0x27e828 [0094.552] GetCurrentThreadId () returned 0x99c [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".ldf") returned 0x0 [0094.553] lstrlenW (lpString=".vhd") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".vhd") returned 0x0 [0094.553] lstrlenW (lpString=".vhdx") returned 5 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".vhdx") returned 0x0 [0094.553] lstrlenW (lpString=".pst") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".pst") returned 0x0 [0094.553] lstrlenW (lpString=".ost") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".ost") returned 0x0 [0094.553] lstrlenW (lpString=".bak") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".bak") returned 0x0 [0094.553] lstrlenW (lpString=".bac") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".bac") returned 0x0 [0094.553] lstrlenW (lpString=".sys") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".sys") returned 0x0 [0094.553] lstrlenW (lpString=".v2i") returned 4 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".v2i") returned 0x0 [0094.553] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.555] lstrlenW (lpString=".sql") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".sql") returned 0x0 [0094.555] lstrlenW (lpString=".mdf") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".mdf") returned 0x0 [0094.555] lstrlenW (lpString=".txt") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".txt") returned 0x0 [0094.555] lstrlenW (lpString=".dbf") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".dbf") returned 0x0 [0094.555] lstrlenW (lpString=".ckp") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".ckp") returned 0x0 [0094.555] lstrlenW (lpString=".dacpac") returned 7 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".dacpac") returned 0x0 [0094.555] lstrlenW (lpString=".db3") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".db3") returned 0x0 [0094.555] lstrlenW (lpString=".dtxs") returned 5 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".dtxs") returned 0x0 [0094.555] lstrlenW (lpString=".mdt") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".mdt") returned 0x0 [0094.555] lstrlenW (lpString=".sdf") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".sdf") returned 0x0 [0094.555] lstrlenW (lpString=".MDF") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".MDF") returned 0x0 [0094.555] lstrlenW (lpString=".DBF") returned 4 [0094.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".DBF") returned 0x0 [0094.556] lstrlenW (lpString=".DB") returned 3 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".DB") returned 0x0 [0094.556] lstrlenW (lpString=".db") returned 3 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".db") returned 0x0 [0094.556] lstrlenW (lpString=".ndf") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".ndf") returned 0x0 [0094.556] lstrlenW (lpString=".NDF") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".NDF") returned 0x0 [0094.556] lstrlenW (lpString=".Mdf") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".Mdf") returned 0x0 [0094.556] lstrlenW (lpString=".dat") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".dat") returned 0x0 [0094.556] lstrlenW (lpString=".DAT") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".DAT") returned 0x0 [0094.556] lstrlenW (lpString=".ldf") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".ldf") returned 0x0 [0094.556] lstrlenW (lpString=".LDF") returned 4 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch=".LDF") returned 0x0 [0094.556] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.556] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fa58) returned 1 [0094.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.557] CryptReleaseContext (hProv=0x33fa58, dwFlags=0x0) returned 1 [0094.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.557] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21455848411) returned 1 [0094.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc72c9970, dwHighDateTime=0x1d585b4)) [0094.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dff68 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dff68 | out: hHeap=0x260000) returned 1 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dc60 [0094.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.558] GetLastError () returned 0x0 [0094.558] GetLastError () returned 0x0 [0094.558] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.559] GetLastError () returned 0x0 [0094.559] GetLastError () returned 0x0 [0094.571] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffea44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.571] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x15bc, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x15bc, lpOverlapped=0x0) returned 1 [0094.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.571] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.571] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.571] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.571] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.571] CloseHandle (hObject=0xe4) returned 1 [0094.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.573] GetLastError () returned 0x0 [0094.573] RtlWakeConditionVariable () returned 0x0 [0094.573] GetCurrentThreadId () returned 0x99c [0094.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".ldf") returned 0x0 [0094.573] lstrlenW (lpString=".vhd") returned 4 [0094.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".vhd") returned 0x0 [0094.573] lstrlenW (lpString=".vhdx") returned 5 [0094.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".vhdx") returned 0x0 [0094.573] lstrlenW (lpString=".pst") returned 4 [0094.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".pst") returned 0x0 [0094.573] lstrlenW (lpString=".ost") returned 4 [0094.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".ost") returned 0x0 [0094.598] lstrlenW (lpString=".bak") returned 4 [0094.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".bak") returned 0x0 [0094.598] lstrlenW (lpString=".bac") returned 4 [0094.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".bac") returned 0x0 [0094.598] lstrlenW (lpString=".sys") returned 4 [0094.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".sys") returned 0x0 [0094.598] lstrlenW (lpString=".v2i") returned 4 [0094.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".v2i") returned 0x0 [0094.598] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.692] lstrlenW (lpString=".sql") returned 4 [0094.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".sql") returned 0x0 [0094.692] lstrlenW (lpString=".mdf") returned 4 [0094.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".mdf") returned 0x0 [0094.692] lstrlenW (lpString=".txt") returned 4 [0094.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".txt") returned 0x0 [0094.692] lstrlenW (lpString=".dbf") returned 4 [0094.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".dbf") returned 0x0 [0094.693] lstrlenW (lpString=".ckp") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".ckp") returned 0x0 [0094.693] lstrlenW (lpString=".dacpac") returned 7 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".dacpac") returned 0x0 [0094.693] lstrlenW (lpString=".db3") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".db3") returned 0x0 [0094.693] lstrlenW (lpString=".dtxs") returned 5 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".dtxs") returned 0x0 [0094.693] lstrlenW (lpString=".mdt") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".mdt") returned 0x0 [0094.693] lstrlenW (lpString=".sdf") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".sdf") returned 0x0 [0094.693] lstrlenW (lpString=".MDF") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".MDF") returned 0x0 [0094.693] lstrlenW (lpString=".DBF") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".DBF") returned 0x0 [0094.693] lstrlenW (lpString=".DB") returned 3 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".DB") returned 0x0 [0094.693] lstrlenW (lpString=".db") returned 3 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".db") returned 0x0 [0094.693] lstrlenW (lpString=".ndf") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".ndf") returned 0x0 [0094.693] lstrlenW (lpString=".NDF") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".NDF") returned 0x0 [0094.693] lstrlenW (lpString=".Mdf") returned 4 [0094.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".Mdf") returned 0x0 [0094.694] lstrlenW (lpString=".dat") returned 4 [0094.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".dat") returned 0x0 [0094.694] lstrlenW (lpString=".DAT") returned 4 [0094.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".DAT") returned 0x0 [0094.694] lstrlenW (lpString=".ldf") returned 4 [0094.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".ldf") returned 0x0 [0094.694] lstrlenW (lpString=".LDF") returned 4 [0094.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch=".LDF") returned 0x0 [0094.694] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.694] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33f150) returned 1 [0094.695] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.695] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.695] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21469602975) returned 1 [0094.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc74205d0, dwHighDateTime=0x1d585b4)) [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0240 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0240 | out: hHeap=0x260000) returned 1 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317f90 [0094.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317f90 | out: hHeap=0x260000) returned 1 [0094.696] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.696] GetLastError () returned 0x0 [0094.696] GetLastError () returned 0x0 [0094.696] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.696] GetLastError () returned 0x0 [0094.696] GetLastError () returned 0x0 [0094.698] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffa3e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.698] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5c20, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x5c20, lpOverlapped=0x0) returned 1 [0094.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.699] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.699] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.699] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.699] CloseHandle (hObject=0xe4) returned 1 [0094.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342f18 [0094.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342f18 | out: hHeap=0x260000) returned 1 [0094.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.702] GetLastError () returned 0x0 [0094.702] RtlWakeConditionVariable () returned 0x0 [0094.702] GetCurrentThreadId () returned 0x99c [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".ldf") returned 0x0 [0094.702] lstrlenW (lpString=".vhd") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".vhd") returned 0x0 [0094.702] lstrlenW (lpString=".vhdx") returned 5 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".vhdx") returned 0x0 [0094.702] lstrlenW (lpString=".pst") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".pst") returned 0x0 [0094.702] lstrlenW (lpString=".ost") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".ost") returned 0x0 [0094.702] lstrlenW (lpString=".bak") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".bak") returned 0x0 [0094.702] lstrlenW (lpString=".bac") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".bac") returned 0x0 [0094.702] lstrlenW (lpString=".sys") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".sys") returned 0x0 [0094.702] lstrlenW (lpString=".v2i") returned 4 [0094.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".v2i") returned 0x0 [0094.703] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.704] lstrlenW (lpString=".sql") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".sql") returned 0x0 [0094.705] lstrlenW (lpString=".mdf") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".mdf") returned 0x0 [0094.705] lstrlenW (lpString=".txt") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".txt") returned 0x0 [0094.705] lstrlenW (lpString=".dbf") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".dbf") returned 0x0 [0094.705] lstrlenW (lpString=".ckp") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".ckp") returned 0x0 [0094.705] lstrlenW (lpString=".dacpac") returned 7 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".dacpac") returned 0x0 [0094.705] lstrlenW (lpString=".db3") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".db3") returned 0x0 [0094.705] lstrlenW (lpString=".dtxs") returned 5 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".dtxs") returned 0x0 [0094.705] lstrlenW (lpString=".mdt") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".mdt") returned 0x0 [0094.705] lstrlenW (lpString=".sdf") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".sdf") returned 0x0 [0094.705] lstrlenW (lpString=".MDF") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".MDF") returned 0x0 [0094.705] lstrlenW (lpString=".DBF") returned 4 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".DBF") returned 0x0 [0094.705] lstrlenW (lpString=".DB") returned 3 [0094.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".DB") returned 0x0 [0094.706] lstrlenW (lpString=".db") returned 3 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".db") returned 0x0 [0094.706] lstrlenW (lpString=".ndf") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".ndf") returned 0x0 [0094.706] lstrlenW (lpString=".NDF") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".NDF") returned 0x0 [0094.706] lstrlenW (lpString=".Mdf") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".Mdf") returned 0x0 [0094.706] lstrlenW (lpString=".dat") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".dat") returned 0x0 [0094.706] lstrlenW (lpString=".DAT") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".DAT") returned 0x0 [0094.706] lstrlenW (lpString=".ldf") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".ldf") returned 0x0 [0094.706] lstrlenW (lpString=".LDF") returned 4 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch=".LDF") returned 0x0 [0094.706] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.706] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33f150) returned 1 [0094.707] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.707] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0094.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.707] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21470839908) returned 1 [0094.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc74205d0, dwHighDateTime=0x1d585b4)) [0094.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0278 [0094.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0278 | out: hHeap=0x260000) returned 1 [0094.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317f90 [0094.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29db30 [0094.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317f90 | out: hHeap=0x260000) returned 1 [0094.717] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.717] GetLastError () returned 0x0 [0094.717] GetLastError () returned 0x0 [0094.717] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.717] GetLastError () returned 0x0 [0094.717] GetLastError () returned 0x0 [0094.737] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.738] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.738] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.738] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.753] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.753] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.753] CloseHandle (hObject=0xe4) returned 1 [0094.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.755] GetLastError () returned 0x0 [0094.755] RtlWakeConditionVariable () returned 0x0 [0094.755] GetCurrentThreadId () returned 0x99c [0094.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".ldf") returned 0x0 [0094.755] lstrlenW (lpString=".vhd") returned 4 [0094.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".vhd") returned 0x0 [0094.755] lstrlenW (lpString=".vhdx") returned 5 [0094.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".vhdx") returned 0x0 [0094.755] lstrlenW (lpString=".pst") returned 4 [0094.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".pst") returned 0x0 [0094.755] lstrlenW (lpString=".ost") returned 4 [0094.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".ost") returned 0x0 [0094.755] lstrlenW (lpString=".bak") returned 4 [0094.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".bak") returned 0x0 [0094.756] lstrlenW (lpString=".bac") returned 4 [0094.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".bac") returned 0x0 [0094.756] lstrlenW (lpString=".sys") returned 4 [0094.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".sys") returned 0x0 [0094.756] lstrlenW (lpString=".v2i") returned 4 [0094.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".v2i") returned 0x0 [0094.756] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.758] lstrlenW (lpString=".sql") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".sql") returned 0x0 [0094.758] lstrlenW (lpString=".mdf") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".mdf") returned 0x0 [0094.758] lstrlenW (lpString=".txt") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".txt") returned 0x0 [0094.758] lstrlenW (lpString=".dbf") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".dbf") returned 0x0 [0094.758] lstrlenW (lpString=".ckp") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".ckp") returned 0x0 [0094.758] lstrlenW (lpString=".dacpac") returned 7 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".dacpac") returned 0x0 [0094.758] lstrlenW (lpString=".db3") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".db3") returned 0x0 [0094.758] lstrlenW (lpString=".dtxs") returned 5 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".dtxs") returned 0x0 [0094.758] lstrlenW (lpString=".mdt") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".mdt") returned 0x0 [0094.758] lstrlenW (lpString=".sdf") returned 4 [0094.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".sdf") returned 0x0 [0094.758] lstrlenW (lpString=".MDF") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".MDF") returned 0x0 [0094.759] lstrlenW (lpString=".DBF") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".DBF") returned 0x0 [0094.759] lstrlenW (lpString=".DB") returned 3 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".DB") returned 0x0 [0094.759] lstrlenW (lpString=".db") returned 3 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".db") returned 0x0 [0094.759] lstrlenW (lpString=".ndf") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".ndf") returned 0x0 [0094.759] lstrlenW (lpString=".NDF") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".NDF") returned 0x0 [0094.759] lstrlenW (lpString=".Mdf") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".Mdf") returned 0x0 [0094.759] lstrlenW (lpString=".dat") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".dat") returned 0x0 [0094.759] lstrlenW (lpString=".DAT") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".DAT") returned 0x0 [0094.759] lstrlenW (lpString=".ldf") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".ldf") returned 0x0 [0094.759] lstrlenW (lpString=".LDF") returned 4 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch=".LDF") returned 0x0 [0094.759] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.759] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fd00) returned 1 [0094.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.760] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.760] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21476152337) returned 1 [0094.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc74b8b50, dwHighDateTime=0x1d585b4)) [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0320 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0320 | out: hHeap=0x260000) returned 1 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.761] GetLastError () returned 0x0 [0094.761] GetLastError () returned 0x0 [0094.762] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.762] GetLastError () returned 0x0 [0094.762] GetLastError () returned 0x0 [0094.763] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffff4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.763] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0xb2, lpOverlapped=0x0) returned 1 [0094.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.763] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.763] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.763] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.763] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.763] CloseHandle (hObject=0xe4) returned 1 [0094.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.765] GetLastError () returned 0x0 [0094.765] RtlWakeConditionVariable () returned 0x0 [0094.765] GetCurrentThreadId () returned 0x99c [0094.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".ldf") returned 0x0 [0094.765] lstrlenW (lpString=".vhd") returned 4 [0094.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".vhd") returned 0x0 [0094.765] lstrlenW (lpString=".vhdx") returned 5 [0094.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".vhdx") returned 0x0 [0094.765] lstrlenW (lpString=".pst") returned 4 [0094.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".pst") returned 0x0 [0094.766] lstrlenW (lpString=".ost") returned 4 [0094.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".ost") returned 0x0 [0094.766] lstrlenW (lpString=".bak") returned 4 [0094.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".bak") returned 0x0 [0094.766] lstrlenW (lpString=".bac") returned 4 [0094.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".bac") returned 0x0 [0094.766] lstrlenW (lpString=".sys") returned 4 [0094.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".sys") returned 0x0 [0094.766] lstrlenW (lpString=".v2i") returned 4 [0094.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".v2i") returned 0x0 [0094.766] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.767] lstrlenW (lpString=".sql") returned 4 [0094.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".sql") returned 0x0 [0094.767] lstrlenW (lpString=".mdf") returned 4 [0094.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".mdf") returned 0x0 [0094.767] lstrlenW (lpString=".txt") returned 4 [0094.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".txt") returned 0x0 [0094.767] lstrlenW (lpString=".dbf") returned 4 [0094.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".dbf") returned 0x0 [0094.767] lstrlenW (lpString=".ckp") returned 4 [0094.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".ckp") returned 0x0 [0094.767] lstrlenW (lpString=".dacpac") returned 7 [0094.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".dacpac") returned 0x0 [0094.767] lstrlenW (lpString=".db3") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".db3") returned 0x0 [0094.768] lstrlenW (lpString=".dtxs") returned 5 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".dtxs") returned 0x0 [0094.768] lstrlenW (lpString=".mdt") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".mdt") returned 0x0 [0094.768] lstrlenW (lpString=".sdf") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".sdf") returned 0x0 [0094.768] lstrlenW (lpString=".MDF") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".MDF") returned 0x0 [0094.768] lstrlenW (lpString=".DBF") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".DBF") returned 0x0 [0094.768] lstrlenW (lpString=".DB") returned 3 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".DB") returned 0x0 [0094.768] lstrlenW (lpString=".db") returned 3 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".db") returned 0x0 [0094.768] lstrlenW (lpString=".ndf") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".ndf") returned 0x0 [0094.768] lstrlenW (lpString=".NDF") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".NDF") returned 0x0 [0094.768] lstrlenW (lpString=".Mdf") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".Mdf") returned 0x0 [0094.768] lstrlenW (lpString=".dat") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".dat") returned 0x0 [0094.768] lstrlenW (lpString=".DAT") returned 4 [0094.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".DAT") returned 0x0 [0094.768] lstrlenW (lpString=".ldf") returned 4 [0094.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".ldf") returned 0x0 [0094.769] lstrlenW (lpString=".LDF") returned 4 [0094.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch=".LDF") returned 0x0 [0094.769] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.769] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fd00) returned 1 [0094.770] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.770] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.770] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21477088962) returned 1 [0094.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc74b8b50, dwHighDateTime=0x1d585b4)) [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0358 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0358 | out: hHeap=0x260000) returned 1 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.771] GetLastError () returned 0x0 [0094.771] GetLastError () returned 0x0 [0094.771] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.771] GetLastError () returned 0x0 [0094.771] GetLastError () returned 0x0 [0094.775] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.775] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.775] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.775] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.789] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.789] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.789] CloseHandle (hObject=0xe4) returned 1 [0094.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0094.790] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0094.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.791] GetLastError () returned 0x0 [0094.791] RtlWakeConditionVariable () returned 0x0 [0094.791] GetCurrentThreadId () returned 0x99c [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".ldf") returned 0x0 [0094.791] lstrlenW (lpString=".vhd") returned 4 [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".vhd") returned 0x0 [0094.791] lstrlenW (lpString=".vhdx") returned 5 [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".vhdx") returned 0x0 [0094.791] lstrlenW (lpString=".pst") returned 4 [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".pst") returned 0x0 [0094.791] lstrlenW (lpString=".ost") returned 4 [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".ost") returned 0x0 [0094.791] lstrlenW (lpString=".bak") returned 4 [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".bak") returned 0x0 [0094.791] lstrlenW (lpString=".bac") returned 4 [0094.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".bac") returned 0x0 [0094.792] lstrlenW (lpString=".sys") returned 4 [0094.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".sys") returned 0x0 [0094.792] lstrlenW (lpString=".v2i") returned 4 [0094.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".v2i") returned 0x0 [0094.792] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.793] lstrlenW (lpString=".sql") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".sql") returned 0x0 [0094.793] lstrlenW (lpString=".mdf") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".mdf") returned 0x0 [0094.793] lstrlenW (lpString=".txt") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".txt") returned 0x0 [0094.793] lstrlenW (lpString=".dbf") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".dbf") returned 0x0 [0094.793] lstrlenW (lpString=".ckp") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".ckp") returned 0x0 [0094.793] lstrlenW (lpString=".dacpac") returned 7 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".dacpac") returned 0x0 [0094.793] lstrlenW (lpString=".db3") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".db3") returned 0x0 [0094.793] lstrlenW (lpString=".dtxs") returned 5 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".dtxs") returned 0x0 [0094.793] lstrlenW (lpString=".mdt") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".mdt") returned 0x0 [0094.793] lstrlenW (lpString=".sdf") returned 4 [0094.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".sdf") returned 0x0 [0094.793] lstrlenW (lpString=".MDF") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".MDF") returned 0x0 [0094.794] lstrlenW (lpString=".DBF") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".DBF") returned 0x0 [0094.794] lstrlenW (lpString=".DB") returned 3 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".DB") returned 0x0 [0094.794] lstrlenW (lpString=".db") returned 3 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".db") returned 0x0 [0094.794] lstrlenW (lpString=".ndf") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".ndf") returned 0x0 [0094.794] lstrlenW (lpString=".NDF") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".NDF") returned 0x0 [0094.794] lstrlenW (lpString=".Mdf") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".Mdf") returned 0x0 [0094.794] lstrlenW (lpString=".dat") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".dat") returned 0x0 [0094.794] lstrlenW (lpString=".DAT") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".DAT") returned 0x0 [0094.794] lstrlenW (lpString=".ldf") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".ldf") returned 0x0 [0094.794] lstrlenW (lpString=".LDF") returned 4 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch=".LDF") returned 0x0 [0094.794] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.794] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.794] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fd00) returned 1 [0094.795] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.795] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.795] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21479653638) returned 1 [0094.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7504e10, dwHighDateTime=0x1d585b4)) [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0400 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0400 | out: hHeap=0x260000) returned 1 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.796] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.796] GetLastError () returned 0x0 [0094.796] GetLastError () returned 0x0 [0094.796] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.797] GetLastError () returned 0x0 [0094.797] GetLastError () returned 0x0 [0094.812] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff5880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.812] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa780, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0xa780, lpOverlapped=0x0) returned 1 [0094.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.812] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.812] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.812] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.812] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.812] CloseHandle (hObject=0xe4) returned 1 [0094.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0094.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0094.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.814] GetLastError () returned 0x0 [0094.814] RtlWakeConditionVariable () returned 0x0 [0094.814] GetCurrentThreadId () returned 0x99c [0094.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".ldf") returned 0x0 [0094.814] lstrlenW (lpString=".vhd") returned 4 [0094.814] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".vhd") returned 0x0 [0094.815] lstrlenW (lpString=".vhdx") returned 5 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".vhdx") returned 0x0 [0094.815] lstrlenW (lpString=".pst") returned 4 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".pst") returned 0x0 [0094.815] lstrlenW (lpString=".ost") returned 4 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".ost") returned 0x0 [0094.815] lstrlenW (lpString=".bak") returned 4 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".bak") returned 0x0 [0094.815] lstrlenW (lpString=".bac") returned 4 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".bac") returned 0x0 [0094.815] lstrlenW (lpString=".sys") returned 4 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".sys") returned 0x0 [0094.815] lstrlenW (lpString=".v2i") returned 4 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".v2i") returned 0x0 [0094.815] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.816] lstrlenW (lpString=".sql") returned 4 [0094.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".sql") returned 0x0 [0094.816] lstrlenW (lpString=".mdf") returned 4 [0094.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".mdf") returned 0x0 [0094.816] lstrlenW (lpString=".txt") returned 4 [0094.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".txt") returned 0x0 [0094.817] lstrlenW (lpString=".dbf") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".dbf") returned 0x0 [0094.817] lstrlenW (lpString=".ckp") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".ckp") returned 0x0 [0094.817] lstrlenW (lpString=".dacpac") returned 7 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".dacpac") returned 0x0 [0094.817] lstrlenW (lpString=".db3") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".db3") returned 0x0 [0094.817] lstrlenW (lpString=".dtxs") returned 5 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".dtxs") returned 0x0 [0094.817] lstrlenW (lpString=".mdt") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".mdt") returned 0x0 [0094.817] lstrlenW (lpString=".sdf") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".sdf") returned 0x0 [0094.817] lstrlenW (lpString=".MDF") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".MDF") returned 0x0 [0094.817] lstrlenW (lpString=".DBF") returned 4 [0094.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".DBF") returned 0x0 [0094.817] lstrlenW (lpString=".DB") returned 3 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".DB") returned 0x0 [0094.818] lstrlenW (lpString=".db") returned 3 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".db") returned 0x0 [0094.818] lstrlenW (lpString=".ndf") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".ndf") returned 0x0 [0094.818] lstrlenW (lpString=".NDF") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".NDF") returned 0x0 [0094.818] lstrlenW (lpString=".Mdf") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".Mdf") returned 0x0 [0094.818] lstrlenW (lpString=".dat") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".dat") returned 0x0 [0094.818] lstrlenW (lpString=".DAT") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".DAT") returned 0x0 [0094.818] lstrlenW (lpString=".ldf") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".ldf") returned 0x0 [0094.818] lstrlenW (lpString=".LDF") returned 4 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch=".LDF") returned 0x0 [0094.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.818] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fd00) returned 1 [0094.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.819] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.819] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21482039311) returned 1 [0094.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc75510d0, dwHighDateTime=0x1d585b4)) [0094.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0470 [0094.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0470 | out: hHeap=0x260000) returned 1 [0094.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.820] GetLastError () returned 0x0 [0094.820] GetLastError () returned 0x0 [0094.820] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.820] GetLastError () returned 0x0 [0094.821] GetLastError () returned 0x0 [0094.892] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.892] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.893] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.893] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.894] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.894] CloseHandle (hObject=0xe4) returned 1 [0094.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.925] GetLastError () returned 0x0 [0094.925] RtlWakeConditionVariable () returned 0x27e828 [0094.925] GetCurrentThreadId () returned 0x99c [0094.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".ldf") returned 0x0 [0094.925] lstrlenW (lpString=".vhd") returned 4 [0094.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".vhd") returned 0x0 [0094.925] lstrlenW (lpString=".vhdx") returned 5 [0094.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".vhdx") returned 0x0 [0094.925] lstrlenW (lpString=".pst") returned 4 [0094.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".pst") returned 0x0 [0094.925] lstrlenW (lpString=".ost") returned 4 [0094.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".ost") returned 0x0 [0094.925] lstrlenW (lpString=".bak") returned 4 [0094.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".bak") returned 0x0 [0094.926] lstrlenW (lpString=".bac") returned 4 [0094.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".bac") returned 0x0 [0094.926] lstrlenW (lpString=".sys") returned 4 [0094.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".sys") returned 0x0 [0094.926] lstrlenW (lpString=".v2i") returned 4 [0094.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".v2i") returned 0x0 [0094.926] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch="s\r\n.v2i") returned 0x0 [0094.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.927] lstrlenW (lpString=".sql") returned 4 [0094.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".sql") returned 0x0 [0094.927] lstrlenW (lpString=".mdf") returned 4 [0094.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".mdf") returned 0x0 [0094.927] lstrlenW (lpString=".txt") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".txt") returned 0x0 [0094.928] lstrlenW (lpString=".dbf") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".dbf") returned 0x0 [0094.928] lstrlenW (lpString=".ckp") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".ckp") returned 0x0 [0094.928] lstrlenW (lpString=".dacpac") returned 7 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".dacpac") returned 0x0 [0094.928] lstrlenW (lpString=".db3") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".db3") returned 0x0 [0094.928] lstrlenW (lpString=".dtxs") returned 5 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".dtxs") returned 0x0 [0094.928] lstrlenW (lpString=".mdt") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".mdt") returned 0x0 [0094.928] lstrlenW (lpString=".sdf") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".sdf") returned 0x0 [0094.928] lstrlenW (lpString=".MDF") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".MDF") returned 0x0 [0094.928] lstrlenW (lpString=".DBF") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".DBF") returned 0x0 [0094.928] lstrlenW (lpString=".DB") returned 3 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".DB") returned 0x0 [0094.928] lstrlenW (lpString=".db") returned 3 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".db") returned 0x0 [0094.928] lstrlenW (lpString=".ndf") returned 4 [0094.928] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".ndf") returned 0x0 [0094.929] lstrlenW (lpString=".NDF") returned 4 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".NDF") returned 0x0 [0094.929] lstrlenW (lpString=".Mdf") returned 4 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".Mdf") returned 0x0 [0094.929] lstrlenW (lpString=".dat") returned 4 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".dat") returned 0x0 [0094.929] lstrlenW (lpString=".DAT") returned 4 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".DAT") returned 0x0 [0094.929] lstrlenW (lpString=".ldf") returned 4 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".ldf") returned 0x0 [0094.929] lstrlenW (lpString=".LDF") returned 4 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch=".LDF") returned 0x0 [0094.929] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.929] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0094.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.929] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fd00) returned 1 [0094.930] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.930] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0094.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0094.930] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21493125464) returned 1 [0094.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc765ba70, dwHighDateTime=0x1d585b4)) [0094.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0094.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0094.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0094.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e05c0 [0094.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e05c0 | out: hHeap=0x260000) returned 1 [0094.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.940] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0094.940] GetLastError () returned 0x0 [0094.940] GetLastError () returned 0x0 [0094.940] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0094.941] GetLastError () returned 0x0 [0094.941] GetLastError () returned 0x0 [0094.944] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.944] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.944] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.944] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.945] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.945] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.945] CloseHandle (hObject=0x11c) returned 1 [0094.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0094.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0094.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0094.969] GetLastError () returned 0x0 [0094.969] RtlWakeConditionVariable () returned 0x0 [0094.969] GetCurrentThreadId () returned 0x99c [0094.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".ldf") returned 0x0 [0094.969] lstrlenW (lpString=".vhd") returned 4 [0094.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".vhd") returned 0x0 [0094.969] lstrlenW (lpString=".vhdx") returned 5 [0094.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".vhdx") returned 0x0 [0094.969] lstrlenW (lpString=".pst") returned 4 [0094.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".pst") returned 0x0 [0094.969] lstrlenW (lpString=".ost") returned 4 [0094.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".ost") returned 0x0 [0094.969] lstrlenW (lpString=".bak") returned 4 [0094.969] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".bak") returned 0x0 [0094.970] lstrlenW (lpString=".bac") returned 4 [0094.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".bac") returned 0x0 [0094.970] lstrlenW (lpString=".sys") returned 4 [0094.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".sys") returned 0x0 [0094.970] lstrlenW (lpString=".v2i") returned 4 [0094.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".v2i") returned 0x0 [0094.970] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.102] lstrlenW (lpString=".sql") returned 4 [0095.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".sql") returned 0x0 [0095.102] lstrlenW (lpString=".mdf") returned 4 [0095.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".mdf") returned 0x0 [0095.103] lstrlenW (lpString=".txt") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".txt") returned 0x0 [0095.103] lstrlenW (lpString=".dbf") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".dbf") returned 0x0 [0095.103] lstrlenW (lpString=".ckp") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".ckp") returned 0x0 [0095.103] lstrlenW (lpString=".dacpac") returned 7 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".dacpac") returned 0x0 [0095.103] lstrlenW (lpString=".db3") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".db3") returned 0x0 [0095.103] lstrlenW (lpString=".dtxs") returned 5 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".dtxs") returned 0x0 [0095.103] lstrlenW (lpString=".mdt") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".mdt") returned 0x0 [0095.103] lstrlenW (lpString=".sdf") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".sdf") returned 0x0 [0095.103] lstrlenW (lpString=".MDF") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".MDF") returned 0x0 [0095.103] lstrlenW (lpString=".DBF") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".DBF") returned 0x0 [0095.103] lstrlenW (lpString=".DB") returned 3 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".DB") returned 0x0 [0095.103] lstrlenW (lpString=".db") returned 3 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".db") returned 0x0 [0095.103] lstrlenW (lpString=".ndf") returned 4 [0095.103] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".ndf") returned 0x0 [0095.103] lstrlenW (lpString=".NDF") returned 4 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".NDF") returned 0x0 [0095.104] lstrlenW (lpString=".Mdf") returned 4 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".Mdf") returned 0x0 [0095.104] lstrlenW (lpString=".dat") returned 4 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".dat") returned 0x0 [0095.104] lstrlenW (lpString=".DAT") returned 4 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".DAT") returned 0x0 [0095.104] lstrlenW (lpString=".ldf") returned 4 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".ldf") returned 0x0 [0095.104] lstrlenW (lpString=".LDF") returned 4 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch=".LDF") returned 0x0 [0095.104] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.104] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x3401c8) returned 1 [0095.105] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.105] CryptReleaseContext (hProv=0x3401c8, dwFlags=0x0) returned 1 [0095.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.105] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21510621356) returned 1 [0095.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc77fe990, dwHighDateTime=0x1d585b4)) [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e07f0 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e07f0 | out: hHeap=0x260000) returned 1 [0095.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0095.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.106] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.106] GetLastError () returned 0x0 [0095.106] GetLastError () returned 0x0 [0095.106] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.106] GetLastError () returned 0x0 [0095.106] GetLastError () returned 0x0 [0095.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.136] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.137] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.137] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.143] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.143] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.143] CloseHandle (hObject=0xf0) returned 1 [0095.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.145] GetLastError () returned 0x0 [0095.145] RtlWakeConditionVariable () returned 0x0 [0095.146] GetCurrentThreadId () returned 0x99c [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".ldf") returned 0x0 [0095.146] lstrlenW (lpString=".vhd") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".vhd") returned 0x0 [0095.146] lstrlenW (lpString=".vhdx") returned 5 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".vhdx") returned 0x0 [0095.146] lstrlenW (lpString=".pst") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".pst") returned 0x0 [0095.146] lstrlenW (lpString=".ost") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".ost") returned 0x0 [0095.146] lstrlenW (lpString=".bak") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".bak") returned 0x0 [0095.146] lstrlenW (lpString=".bac") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".bac") returned 0x0 [0095.146] lstrlenW (lpString=".sys") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".sys") returned 0x0 [0095.146] lstrlenW (lpString=".v2i") returned 4 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".v2i") returned 0x0 [0095.146] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch="s\r\n.v2i") returned 0x0 [0095.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.148] lstrlenW (lpString=".sql") returned 4 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".sql") returned 0x0 [0095.148] lstrlenW (lpString=".mdf") returned 4 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".mdf") returned 0x0 [0095.148] lstrlenW (lpString=".txt") returned 4 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".txt") returned 0x0 [0095.148] lstrlenW (lpString=".dbf") returned 4 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".dbf") returned 0x0 [0095.148] lstrlenW (lpString=".ckp") returned 4 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".ckp") returned 0x0 [0095.148] lstrlenW (lpString=".dacpac") returned 7 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".dacpac") returned 0x0 [0095.148] lstrlenW (lpString=".db3") returned 4 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".db3") returned 0x0 [0095.148] lstrlenW (lpString=".dtxs") returned 5 [0095.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".dtxs") returned 0x0 [0095.148] lstrlenW (lpString=".mdt") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".mdt") returned 0x0 [0095.149] lstrlenW (lpString=".sdf") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".sdf") returned 0x0 [0095.149] lstrlenW (lpString=".MDF") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".MDF") returned 0x0 [0095.149] lstrlenW (lpString=".DBF") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".DBF") returned 0x0 [0095.149] lstrlenW (lpString=".DB") returned 3 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".DB") returned 0x0 [0095.149] lstrlenW (lpString=".db") returned 3 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".db") returned 0x0 [0095.149] lstrlenW (lpString=".ndf") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".ndf") returned 0x0 [0095.149] lstrlenW (lpString=".NDF") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".NDF") returned 0x0 [0095.149] lstrlenW (lpString=".Mdf") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".Mdf") returned 0x0 [0095.149] lstrlenW (lpString=".dat") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".dat") returned 0x0 [0095.149] lstrlenW (lpString=".DAT") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".DAT") returned 0x0 [0095.149] lstrlenW (lpString=".ldf") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".ldf") returned 0x0 [0095.149] lstrlenW (lpString=".LDF") returned 4 [0095.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch=".LDF") returned 0x0 [0095.149] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.150] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x33fd00) returned 1 [0095.150] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.150] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0095.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.151] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21515174523) returned 1 [0095.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7870db0, dwHighDateTime=0x1d585b4)) [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0860 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0860 | out: hHeap=0x260000) returned 1 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0095.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.151] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.151] GetLastError () returned 0x0 [0095.152] GetLastError () returned 0x0 [0095.152] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.152] GetLastError () returned 0x0 [0095.152] GetLastError () returned 0x0 [0095.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffa9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.167] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x566, lpOverlapped=0x0) returned 1 [0095.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.167] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.167] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.167] CloseHandle (hObject=0xf0) returned 1 [0095.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.[deadmin@cock.li].deadmin")) returned 1 [0095.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.169] GetLastError () returned 0x0 [0095.169] RtlWakeConditionVariable () returned 0x0 [0095.169] GetCurrentThreadId () returned 0x99c [0095.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".ldf") returned 0x0 [0095.169] lstrlenW (lpString=".vhd") returned 4 [0095.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".vhd") returned 0x0 [0095.169] lstrlenW (lpString=".vhdx") returned 5 [0095.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".vhdx") returned 0x0 [0095.169] lstrlenW (lpString=".pst") returned 4 [0095.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".pst") returned 0x0 [0095.169] lstrlenW (lpString=".ost") returned 4 [0095.169] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".ost") returned 0x0 [0095.169] lstrlenW (lpString=".bak") returned 4 [0095.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".bak") returned 0x0 [0095.170] lstrlenW (lpString=".bac") returned 4 [0095.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".bac") returned 0x0 [0095.170] lstrlenW (lpString=".sys") returned 4 [0095.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".sys") returned 0x0 [0095.170] lstrlenW (lpString=".v2i") returned 4 [0095.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".v2i") returned 0x0 [0095.170] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch="s\r\n.v2i") returned 0x0 [0095.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.191] lstrlenW (lpString=".sql") returned 4 [0095.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".sql") returned 0x0 [0095.192] lstrlenW (lpString=".mdf") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".mdf") returned 0x0 [0095.192] lstrlenW (lpString=".txt") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".txt") returned 0x0 [0095.192] lstrlenW (lpString=".dbf") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".dbf") returned 0x0 [0095.192] lstrlenW (lpString=".ckp") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".ckp") returned 0x0 [0095.192] lstrlenW (lpString=".dacpac") returned 7 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".dacpac") returned 0x0 [0095.192] lstrlenW (lpString=".db3") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".db3") returned 0x0 [0095.192] lstrlenW (lpString=".dtxs") returned 5 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".dtxs") returned 0x0 [0095.192] lstrlenW (lpString=".mdt") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".mdt") returned 0x0 [0095.192] lstrlenW (lpString=".sdf") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".sdf") returned 0x0 [0095.192] lstrlenW (lpString=".MDF") returned 4 [0095.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".MDF") returned 0x0 [0095.193] lstrlenW (lpString=".DBF") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".DBF") returned 0x0 [0095.193] lstrlenW (lpString=".DB") returned 3 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".DB") returned 0x0 [0095.193] lstrlenW (lpString=".db") returned 3 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".db") returned 0x0 [0095.193] lstrlenW (lpString=".ndf") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".ndf") returned 0x0 [0095.193] lstrlenW (lpString=".NDF") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".NDF") returned 0x0 [0095.193] lstrlenW (lpString=".Mdf") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".Mdf") returned 0x0 [0095.193] lstrlenW (lpString=".dat") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".dat") returned 0x0 [0095.193] lstrlenW (lpString=".DAT") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".DAT") returned 0x0 [0095.193] lstrlenW (lpString=".ldf") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".ldf") returned 0x0 [0095.193] lstrlenW (lpString=".LDF") returned 4 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch=".LDF") returned 0x0 [0095.193] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.193] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.193] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5220) returned 1 [0095.194] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.194] CryptReleaseContext (hProv=0x27e5220, dwFlags=0x0) returned 1 [0095.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.194] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21519551965) returned 1 [0095.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc78e31d0, dwHighDateTime=0x1d585b4)) [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0940 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0940 | out: hHeap=0x260000) returned 1 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.195] GetLastError () returned 0x0 [0095.195] GetLastError () returned 0x0 [0095.195] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.196] GetLastError () returned 0x0 [0095.196] GetLastError () returned 0x0 [0095.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff5b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.197] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xa4c, lpOverlapped=0x0) returned 1 [0095.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.197] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.198] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.198] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.198] CloseHandle (hObject=0xf0) returned 1 [0095.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.[deadmin@cock.li].deadmin")) returned 1 [0095.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.200] GetLastError () returned 0x0 [0095.200] RtlWakeConditionVariable () returned 0x0 [0095.200] GetCurrentThreadId () returned 0x99c [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".ldf") returned 0x0 [0095.200] lstrlenW (lpString=".vhd") returned 4 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".vhd") returned 0x0 [0095.200] lstrlenW (lpString=".vhdx") returned 5 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".vhdx") returned 0x0 [0095.200] lstrlenW (lpString=".pst") returned 4 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".pst") returned 0x0 [0095.200] lstrlenW (lpString=".ost") returned 4 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".ost") returned 0x0 [0095.200] lstrlenW (lpString=".bak") returned 4 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".bak") returned 0x0 [0095.200] lstrlenW (lpString=".bac") returned 4 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".bac") returned 0x0 [0095.200] lstrlenW (lpString=".sys") returned 4 [0095.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".sys") returned 0x0 [0095.200] lstrlenW (lpString=".v2i") returned 4 [0095.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".v2i") returned 0x0 [0095.201] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch="s\r\n.v2i") returned 0x0 [0095.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.202] lstrlenW (lpString=".sql") returned 4 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".sql") returned 0x0 [0095.202] lstrlenW (lpString=".mdf") returned 4 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".mdf") returned 0x0 [0095.202] lstrlenW (lpString=".txt") returned 4 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".txt") returned 0x0 [0095.202] lstrlenW (lpString=".dbf") returned 4 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".dbf") returned 0x0 [0095.202] lstrlenW (lpString=".ckp") returned 4 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".ckp") returned 0x0 [0095.202] lstrlenW (lpString=".dacpac") returned 7 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".dacpac") returned 0x0 [0095.202] lstrlenW (lpString=".db3") returned 4 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".db3") returned 0x0 [0095.202] lstrlenW (lpString=".dtxs") returned 5 [0095.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".dtxs") returned 0x0 [0095.203] lstrlenW (lpString=".mdt") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".mdt") returned 0x0 [0095.203] lstrlenW (lpString=".sdf") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".sdf") returned 0x0 [0095.203] lstrlenW (lpString=".MDF") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".MDF") returned 0x0 [0095.203] lstrlenW (lpString=".DBF") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".DBF") returned 0x0 [0095.203] lstrlenW (lpString=".DB") returned 3 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".DB") returned 0x0 [0095.203] lstrlenW (lpString=".db") returned 3 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".db") returned 0x0 [0095.203] lstrlenW (lpString=".ndf") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".ndf") returned 0x0 [0095.203] lstrlenW (lpString=".NDF") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".NDF") returned 0x0 [0095.203] lstrlenW (lpString=".Mdf") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".Mdf") returned 0x0 [0095.203] lstrlenW (lpString=".dat") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".dat") returned 0x0 [0095.203] lstrlenW (lpString=".DAT") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".DAT") returned 0x0 [0095.203] lstrlenW (lpString=".ldf") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".ldf") returned 0x0 [0095.203] lstrlenW (lpString=".LDF") returned 4 [0095.203] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch=".LDF") returned 0x0 [0095.203] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.204] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.204] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5198) returned 1 [0095.204] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.204] CryptReleaseContext (hProv=0x27e5198, dwFlags=0x0) returned 1 [0095.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.205] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21520574076) returned 1 [0095.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc78e31d0, dwHighDateTime=0x1d585b4)) [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0978 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0978 | out: hHeap=0x260000) returned 1 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.205] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.205] GetLastError () returned 0x0 [0095.206] GetLastError () returned 0x0 [0095.207] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.207] GetLastError () returned 0x0 [0095.207] GetLastError () returned 0x0 [0095.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.226] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xa00, lpOverlapped=0x0) returned 1 [0095.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.226] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.226] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.226] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.227] CloseHandle (hObject=0xf0) returned 1 [0095.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.[deadmin@cock.li].deadmin")) returned 1 [0095.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.256] GetLastError () returned 0x0 [0095.256] RtlWakeConditionVariable () returned 0x27e828 [0095.256] GetCurrentThreadId () returned 0x99c [0095.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".ldf") returned 0x0 [0095.256] lstrlenW (lpString=".vhd") returned 4 [0095.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".vhd") returned 0x0 [0095.256] lstrlenW (lpString=".vhdx") returned 5 [0095.256] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".vhdx") returned 0x0 [0095.257] lstrlenW (lpString=".pst") returned 4 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".pst") returned 0x0 [0095.257] lstrlenW (lpString=".ost") returned 4 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".ost") returned 0x0 [0095.257] lstrlenW (lpString=".bak") returned 4 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".bak") returned 0x0 [0095.257] lstrlenW (lpString=".bac") returned 4 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".bac") returned 0x0 [0095.257] lstrlenW (lpString=".sys") returned 4 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".sys") returned 0x0 [0095.257] lstrlenW (lpString=".v2i") returned 4 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".v2i") returned 0x0 [0095.257] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.259] lstrlenW (lpString=".sql") returned 4 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".sql") returned 0x0 [0095.259] lstrlenW (lpString=".mdf") returned 4 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".mdf") returned 0x0 [0095.259] lstrlenW (lpString=".txt") returned 4 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".txt") returned 0x0 [0095.259] lstrlenW (lpString=".dbf") returned 4 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".dbf") returned 0x0 [0095.259] lstrlenW (lpString=".ckp") returned 4 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".ckp") returned 0x0 [0095.259] lstrlenW (lpString=".dacpac") returned 7 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".dacpac") returned 0x0 [0095.259] lstrlenW (lpString=".db3") returned 4 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".db3") returned 0x0 [0095.259] lstrlenW (lpString=".dtxs") returned 5 [0095.259] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".dtxs") returned 0x0 [0095.260] lstrlenW (lpString=".mdt") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".mdt") returned 0x0 [0095.260] lstrlenW (lpString=".sdf") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".sdf") returned 0x0 [0095.260] lstrlenW (lpString=".MDF") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".MDF") returned 0x0 [0095.260] lstrlenW (lpString=".DBF") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".DBF") returned 0x0 [0095.260] lstrlenW (lpString=".DB") returned 3 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".DB") returned 0x0 [0095.260] lstrlenW (lpString=".db") returned 3 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".db") returned 0x0 [0095.260] lstrlenW (lpString=".ndf") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".ndf") returned 0x0 [0095.260] lstrlenW (lpString=".NDF") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".NDF") returned 0x0 [0095.260] lstrlenW (lpString=".Mdf") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".Mdf") returned 0x0 [0095.260] lstrlenW (lpString=".dat") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".dat") returned 0x0 [0095.260] lstrlenW (lpString=".DAT") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".DAT") returned 0x0 [0095.260] lstrlenW (lpString=".ldf") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".ldf") returned 0x0 [0095.260] lstrlenW (lpString=".LDF") returned 4 [0095.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch=".LDF") returned 0x0 [0095.260] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.261] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5330) returned 1 [0095.261] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.261] CryptReleaseContext (hProv=0x27e5330, dwFlags=0x0) returned 1 [0095.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.262] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21526278349) returned 1 [0095.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc797b750, dwHighDateTime=0x1d585b4)) [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0a58 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0a58 | out: hHeap=0x260000) returned 1 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.262] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.262] GetLastError () returned 0x0 [0095.263] GetLastError () returned 0x0 [0095.263] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.263] GetLastError () returned 0x0 [0095.263] GetLastError () returned 0x0 [0095.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.333] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.333] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.333] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.335] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.335] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.335] CloseHandle (hObject=0xf0) returned 1 [0095.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.337] GetLastError () returned 0x0 [0095.337] RtlWakeConditionVariable () returned 0x0 [0095.337] GetCurrentThreadId () returned 0x99c [0095.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".ldf") returned 0x0 [0095.337] lstrlenW (lpString=".vhd") returned 4 [0095.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".vhd") returned 0x0 [0095.337] lstrlenW (lpString=".vhdx") returned 5 [0095.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".vhdx") returned 0x0 [0095.337] lstrlenW (lpString=".pst") returned 4 [0095.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".pst") returned 0x0 [0095.337] lstrlenW (lpString=".ost") returned 4 [0095.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".ost") returned 0x0 [0095.337] lstrlenW (lpString=".bak") returned 4 [0095.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".bak") returned 0x0 [0095.338] lstrlenW (lpString=".bac") returned 4 [0095.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".bac") returned 0x0 [0095.338] lstrlenW (lpString=".sys") returned 4 [0095.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".sys") returned 0x0 [0095.338] lstrlenW (lpString=".v2i") returned 4 [0095.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".v2i") returned 0x0 [0095.338] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.339] lstrlenW (lpString=".sql") returned 4 [0095.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".sql") returned 0x0 [0095.339] lstrlenW (lpString=".mdf") returned 4 [0095.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".mdf") returned 0x0 [0095.339] lstrlenW (lpString=".txt") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".txt") returned 0x0 [0095.340] lstrlenW (lpString=".dbf") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".dbf") returned 0x0 [0095.340] lstrlenW (lpString=".ckp") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".ckp") returned 0x0 [0095.340] lstrlenW (lpString=".dacpac") returned 7 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".dacpac") returned 0x0 [0095.340] lstrlenW (lpString=".db3") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".db3") returned 0x0 [0095.340] lstrlenW (lpString=".dtxs") returned 5 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".dtxs") returned 0x0 [0095.340] lstrlenW (lpString=".mdt") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".mdt") returned 0x0 [0095.340] lstrlenW (lpString=".sdf") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".sdf") returned 0x0 [0095.340] lstrlenW (lpString=".MDF") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".MDF") returned 0x0 [0095.340] lstrlenW (lpString=".DBF") returned 4 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".DBF") returned 0x0 [0095.340] lstrlenW (lpString=".DB") returned 3 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".DB") returned 0x0 [0095.340] lstrlenW (lpString=".db") returned 3 [0095.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".db") returned 0x0 [0095.340] lstrlenW (lpString=".ndf") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".ndf") returned 0x0 [0095.341] lstrlenW (lpString=".NDF") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".NDF") returned 0x0 [0095.341] lstrlenW (lpString=".Mdf") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".Mdf") returned 0x0 [0095.341] lstrlenW (lpString=".dat") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".dat") returned 0x0 [0095.341] lstrlenW (lpString=".DAT") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".DAT") returned 0x0 [0095.341] lstrlenW (lpString=".ldf") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".ldf") returned 0x0 [0095.341] lstrlenW (lpString=".LDF") returned 4 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch=".LDF") returned 0x0 [0095.341] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.341] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5550) returned 1 [0095.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.342] CryptReleaseContext (hProv=0x27e5550, dwFlags=0x0) returned 1 [0095.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.342] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21534331109) returned 1 [0095.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7a39e30, dwHighDateTime=0x1d585b4)) [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0b38 [0095.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0b38 | out: hHeap=0x260000) returned 1 [0095.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.343] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.343] GetLastError () returned 0x0 [0095.343] GetLastError () returned 0x0 [0095.343] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.343] GetLastError () returned 0x0 [0095.344] GetLastError () returned 0x0 [0095.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.353] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.354] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.386] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.386] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.386] CloseHandle (hObject=0xf0) returned 1 [0095.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.406] GetLastError () returned 0x0 [0095.406] RtlWakeConditionVariable () returned 0x27e828 [0095.406] GetCurrentThreadId () returned 0x99c [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".ldf") returned 0x0 [0095.406] lstrlenW (lpString=".vhd") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".vhd") returned 0x0 [0095.406] lstrlenW (lpString=".vhdx") returned 5 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".vhdx") returned 0x0 [0095.406] lstrlenW (lpString=".pst") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".pst") returned 0x0 [0095.406] lstrlenW (lpString=".ost") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".ost") returned 0x0 [0095.406] lstrlenW (lpString=".bak") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".bak") returned 0x0 [0095.406] lstrlenW (lpString=".bac") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".bac") returned 0x0 [0095.406] lstrlenW (lpString=".sys") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".sys") returned 0x0 [0095.406] lstrlenW (lpString=".v2i") returned 4 [0095.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".v2i") returned 0x0 [0095.406] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch="s\r\n.v2i") returned 0x0 [0095.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0095.409] lstrlenW (lpString=".sql") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".sql") returned 0x0 [0095.409] lstrlenW (lpString=".mdf") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".mdf") returned 0x0 [0095.409] lstrlenW (lpString=".txt") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".txt") returned 0x0 [0095.409] lstrlenW (lpString=".dbf") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".dbf") returned 0x0 [0095.409] lstrlenW (lpString=".ckp") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".ckp") returned 0x0 [0095.409] lstrlenW (lpString=".dacpac") returned 7 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".dacpac") returned 0x0 [0095.409] lstrlenW (lpString=".db3") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".db3") returned 0x0 [0095.409] lstrlenW (lpString=".dtxs") returned 5 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".dtxs") returned 0x0 [0095.409] lstrlenW (lpString=".mdt") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".mdt") returned 0x0 [0095.409] lstrlenW (lpString=".sdf") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".sdf") returned 0x0 [0095.409] lstrlenW (lpString=".MDF") returned 4 [0095.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".MDF") returned 0x0 [0095.410] lstrlenW (lpString=".DBF") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".DBF") returned 0x0 [0095.411] lstrlenW (lpString=".DB") returned 3 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".DB") returned 0x0 [0095.411] lstrlenW (lpString=".db") returned 3 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".db") returned 0x0 [0095.411] lstrlenW (lpString=".ndf") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".ndf") returned 0x0 [0095.411] lstrlenW (lpString=".NDF") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".NDF") returned 0x0 [0095.411] lstrlenW (lpString=".Mdf") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".Mdf") returned 0x0 [0095.411] lstrlenW (lpString=".dat") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".dat") returned 0x0 [0095.411] lstrlenW (lpString=".DAT") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".DAT") returned 0x0 [0095.411] lstrlenW (lpString=".ldf") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".ldf") returned 0x0 [0095.411] lstrlenW (lpString=".LDF") returned 4 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch=".LDF") returned 0x0 [0095.411] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0095.412] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5770) returned 1 [0095.412] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0095.412] CryptReleaseContext (hProv=0x27e5770, dwFlags=0x0) returned 1 [0095.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0095.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.413] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21541365692) returned 1 [0095.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7af8510, dwHighDateTime=0x1d585b4)) [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0c18 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c18 | out: hHeap=0x260000) returned 1 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.413] GetLastError () returned 0x0 [0095.414] GetLastError () returned 0x0 [0095.414] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.414] GetLastError () returned 0x0 [0095.414] GetLastError () returned 0x0 [0095.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.420] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.421] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.428] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.428] CloseHandle (hObject=0xf0) returned 1 [0095.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0095.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.[deadmin@cock.li].deadmin")) returned 1 [0095.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0095.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.431] GetLastError () returned 0x0 [0095.431] RtlWakeConditionVariable () returned 0x0 [0095.431] GetCurrentThreadId () returned 0x99c [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".ldf") returned 0x0 [0095.432] lstrlenW (lpString=".vhd") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".vhd") returned 0x0 [0095.432] lstrlenW (lpString=".vhdx") returned 5 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".vhdx") returned 0x0 [0095.432] lstrlenW (lpString=".pst") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".pst") returned 0x0 [0095.432] lstrlenW (lpString=".ost") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".ost") returned 0x0 [0095.432] lstrlenW (lpString=".bak") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".bak") returned 0x0 [0095.432] lstrlenW (lpString=".bac") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".bac") returned 0x0 [0095.432] lstrlenW (lpString=".sys") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".sys") returned 0x0 [0095.432] lstrlenW (lpString=".v2i") returned 4 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".v2i") returned 0x0 [0095.432] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch="s\r\n.v2i") returned 0x0 [0095.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.468] lstrlenW (lpString=".sql") returned 4 [0095.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".sql") returned 0x0 [0095.468] lstrlenW (lpString=".mdf") returned 4 [0095.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".mdf") returned 0x0 [0095.468] lstrlenW (lpString=".txt") returned 4 [0095.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".txt") returned 0x0 [0095.468] lstrlenW (lpString=".dbf") returned 4 [0095.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".dbf") returned 0x0 [0095.468] lstrlenW (lpString=".ckp") returned 4 [0095.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".ckp") returned 0x0 [0095.469] lstrlenW (lpString=".dacpac") returned 7 [0095.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".dacpac") returned 0x0 [0095.469] lstrlenW (lpString=".db3") returned 4 [0095.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".db3") returned 0x0 [0095.469] lstrlenW (lpString=".dtxs") returned 5 [0095.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".dtxs") returned 0x0 [0095.469] lstrlenW (lpString=".mdt") returned 4 [0095.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".mdt") returned 0x0 [0095.480] lstrlenW (lpString=".sdf") returned 4 [0095.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".sdf") returned 0x0 [0095.480] lstrlenW (lpString=".MDF") returned 4 [0095.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".MDF") returned 0x0 [0095.480] lstrlenW (lpString=".DBF") returned 4 [0095.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".DBF") returned 0x0 [0095.480] lstrlenW (lpString=".DB") returned 3 [0095.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".DB") returned 0x0 [0095.480] lstrlenW (lpString=".db") returned 3 [0095.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".db") returned 0x0 [0095.481] lstrlenW (lpString=".ndf") returned 4 [0095.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".ndf") returned 0x0 [0095.481] lstrlenW (lpString=".NDF") returned 4 [0095.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".NDF") returned 0x0 [0095.481] lstrlenW (lpString=".Mdf") returned 4 [0095.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".Mdf") returned 0x0 [0095.481] lstrlenW (lpString=".dat") returned 4 [0095.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".dat") returned 0x0 [0095.481] lstrlenW (lpString=".DAT") returned 4 [0095.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".DAT") returned 0x0 [0095.481] lstrlenW (lpString=".ldf") returned 4 [0095.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".ldf") returned 0x0 [0095.486] lstrlenW (lpString=".LDF") returned 4 [0095.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch=".LDF") returned 0x0 [0095.487] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.487] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5aa0) returned 1 [0095.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.488] CryptReleaseContext (hProv=0x27e5aa0, dwFlags=0x0) returned 1 [0095.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.488] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21548888270) returned 1 [0095.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7bdcd50, dwHighDateTime=0x1d585b4)) [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0d68 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0d68 | out: hHeap=0x260000) returned 1 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.514] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.514] GetLastError () returned 0x0 [0095.514] GetLastError () returned 0x0 [0095.515] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.515] GetLastError () returned 0x0 [0095.515] GetLastError () returned 0x0 [0095.536] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.536] WriteFile (in: hFile=0x104, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.537] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.537] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.549] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.549] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.549] CloseHandle (hObject=0x104) returned 1 [0095.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.[deadmin@cock.li].deadmin")) returned 1 [0095.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.552] GetLastError () returned 0x0 [0095.552] RtlWakeConditionVariable () returned 0x27e828 [0095.552] GetCurrentThreadId () returned 0x99c [0095.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".ldf") returned 0x0 [0095.552] lstrlenW (lpString=".vhd") returned 4 [0095.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".vhd") returned 0x0 [0095.552] lstrlenW (lpString=".vhdx") returned 5 [0095.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".vhdx") returned 0x0 [0095.552] lstrlenW (lpString=".pst") returned 4 [0095.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".pst") returned 0x0 [0095.552] lstrlenW (lpString=".ost") returned 4 [0095.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".ost") returned 0x0 [0095.553] lstrlenW (lpString=".bak") returned 4 [0095.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".bak") returned 0x0 [0095.553] lstrlenW (lpString=".bac") returned 4 [0095.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".bac") returned 0x0 [0095.553] lstrlenW (lpString=".sys") returned 4 [0095.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".sys") returned 0x0 [0095.553] lstrlenW (lpString=".v2i") returned 4 [0095.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".v2i") returned 0x0 [0095.553] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.555] lstrlenW (lpString=".sql") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".sql") returned 0x0 [0095.555] lstrlenW (lpString=".mdf") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".mdf") returned 0x0 [0095.555] lstrlenW (lpString=".txt") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".txt") returned 0x0 [0095.555] lstrlenW (lpString=".dbf") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".dbf") returned 0x0 [0095.555] lstrlenW (lpString=".ckp") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".ckp") returned 0x0 [0095.555] lstrlenW (lpString=".dacpac") returned 7 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".dacpac") returned 0x0 [0095.555] lstrlenW (lpString=".db3") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".db3") returned 0x0 [0095.555] lstrlenW (lpString=".dtxs") returned 5 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".dtxs") returned 0x0 [0095.555] lstrlenW (lpString=".mdt") returned 4 [0095.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".mdt") returned 0x0 [0095.556] lstrlenW (lpString=".sdf") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".sdf") returned 0x0 [0095.556] lstrlenW (lpString=".MDF") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".MDF") returned 0x0 [0095.556] lstrlenW (lpString=".DBF") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".DBF") returned 0x0 [0095.556] lstrlenW (lpString=".DB") returned 3 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".DB") returned 0x0 [0095.556] lstrlenW (lpString=".db") returned 3 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".db") returned 0x0 [0095.556] lstrlenW (lpString=".ndf") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".ndf") returned 0x0 [0095.556] lstrlenW (lpString=".NDF") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".NDF") returned 0x0 [0095.556] lstrlenW (lpString=".Mdf") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".Mdf") returned 0x0 [0095.556] lstrlenW (lpString=".dat") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".dat") returned 0x0 [0095.556] lstrlenW (lpString=".DAT") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".DAT") returned 0x0 [0095.556] lstrlenW (lpString=".ldf") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".ldf") returned 0x0 [0095.556] lstrlenW (lpString=".LDF") returned 4 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch=".LDF") returned 0x0 [0095.556] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.557] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5088) returned 1 [0095.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.557] CryptReleaseContext (hProv=0x27e5088, dwFlags=0x0) returned 1 [0095.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.558] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21555873613) returned 1 [0095.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7c4f170, dwHighDateTime=0x1d585b4)) [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0e10 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0e10 | out: hHeap=0x260000) returned 1 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d8d0 [0095.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.558] GetLastError () returned 0x0 [0095.559] GetLastError () returned 0x0 [0095.559] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.559] GetLastError () returned 0x0 [0095.559] GetLastError () returned 0x0 [0095.591] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffba70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.592] WriteFile (in: hFile=0x104, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x4590, lpOverlapped=0x0) returned 1 [0095.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.592] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.592] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.592] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.592] CloseHandle (hObject=0x104) returned 1 [0095.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27dc4c8 [0095.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc4c8 | out: hHeap=0x260000) returned 1 [0095.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.595] GetLastError () returned 0x0 [0095.595] RtlWakeConditionVariable () returned 0x0 [0095.595] GetCurrentThreadId () returned 0x99c [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".ldf") returned 0x0 [0095.596] lstrlenW (lpString=".vhd") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".vhd") returned 0x0 [0095.596] lstrlenW (lpString=".vhdx") returned 5 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".vhdx") returned 0x0 [0095.596] lstrlenW (lpString=".pst") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".pst") returned 0x0 [0095.596] lstrlenW (lpString=".ost") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".ost") returned 0x0 [0095.596] lstrlenW (lpString=".bak") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".bak") returned 0x0 [0095.596] lstrlenW (lpString=".bac") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".bac") returned 0x0 [0095.596] lstrlenW (lpString=".sys") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".sys") returned 0x0 [0095.596] lstrlenW (lpString=".v2i") returned 4 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".v2i") returned 0x0 [0095.596] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.599] lstrlenW (lpString=".sql") returned 4 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".sql") returned 0x0 [0095.599] lstrlenW (lpString=".mdf") returned 4 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".mdf") returned 0x0 [0095.599] lstrlenW (lpString=".txt") returned 4 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".txt") returned 0x0 [0095.599] lstrlenW (lpString=".dbf") returned 4 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".dbf") returned 0x0 [0095.599] lstrlenW (lpString=".ckp") returned 4 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".ckp") returned 0x0 [0095.599] lstrlenW (lpString=".dacpac") returned 7 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".dacpac") returned 0x0 [0095.599] lstrlenW (lpString=".db3") returned 4 [0095.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".db3") returned 0x0 [0095.600] lstrlenW (lpString=".dtxs") returned 5 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".dtxs") returned 0x0 [0095.600] lstrlenW (lpString=".mdt") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".mdt") returned 0x0 [0095.600] lstrlenW (lpString=".sdf") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".sdf") returned 0x0 [0095.600] lstrlenW (lpString=".MDF") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".MDF") returned 0x0 [0095.600] lstrlenW (lpString=".DBF") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".DBF") returned 0x0 [0095.600] lstrlenW (lpString=".DB") returned 3 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".DB") returned 0x0 [0095.600] lstrlenW (lpString=".db") returned 3 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".db") returned 0x0 [0095.600] lstrlenW (lpString=".ndf") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".ndf") returned 0x0 [0095.600] lstrlenW (lpString=".NDF") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".NDF") returned 0x0 [0095.600] lstrlenW (lpString=".Mdf") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".Mdf") returned 0x0 [0095.600] lstrlenW (lpString=".dat") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".dat") returned 0x0 [0095.600] lstrlenW (lpString=".DAT") returned 4 [0095.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".DAT") returned 0x0 [0095.600] lstrlenW (lpString=".ldf") returned 4 [0095.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".ldf") returned 0x0 [0095.601] lstrlenW (lpString=".LDF") returned 4 [0095.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch=".LDF") returned 0x0 [0095.601] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.601] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.601] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5a18) returned 1 [0095.602] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.602] CryptReleaseContext (hProv=0x27e5a18, dwFlags=0x0) returned 1 [0095.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.602] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21560294120) returned 1 [0095.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7cc1590, dwHighDateTime=0x1d585b4)) [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0e48 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0e48 | out: hHeap=0x260000) returned 1 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.603] GetLastError () returned 0x0 [0095.603] GetLastError () returned 0x0 [0095.603] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.603] GetLastError () returned 0x0 [0095.603] GetLastError () returned 0x0 [0095.622] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.622] WriteFile (in: hFile=0x104, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.623] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.623] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.647] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.647] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.648] CloseHandle (hObject=0x104) returned 1 [0095.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.774] GetLastError () returned 0x0 [0095.774] RtlWakeConditionVariable () returned 0x0 [0095.774] GetCurrentThreadId () returned 0x99c [0095.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".ldf") returned 0x0 [0095.774] lstrlenW (lpString=".vhd") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".vhd") returned 0x0 [0095.775] lstrlenW (lpString=".vhdx") returned 5 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".vhdx") returned 0x0 [0095.775] lstrlenW (lpString=".pst") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".pst") returned 0x0 [0095.775] lstrlenW (lpString=".ost") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".ost") returned 0x0 [0095.775] lstrlenW (lpString=".bak") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".bak") returned 0x0 [0095.775] lstrlenW (lpString=".bac") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".bac") returned 0x0 [0095.775] lstrlenW (lpString=".sys") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".sys") returned 0x0 [0095.775] lstrlenW (lpString=".v2i") returned 4 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".v2i") returned 0x0 [0095.775] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0095.777] lstrlenW (lpString=".sql") returned 4 [0095.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".sql") returned 0x0 [0095.777] lstrlenW (lpString=".mdf") returned 4 [0095.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".mdf") returned 0x0 [0095.777] lstrlenW (lpString=".txt") returned 4 [0095.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".txt") returned 0x0 [0095.777] lstrlenW (lpString=".dbf") returned 4 [0095.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".dbf") returned 0x0 [0095.777] lstrlenW (lpString=".ckp") returned 4 [0095.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".ckp") returned 0x0 [0095.778] lstrlenW (lpString=".dacpac") returned 7 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".dacpac") returned 0x0 [0095.778] lstrlenW (lpString=".db3") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".db3") returned 0x0 [0095.778] lstrlenW (lpString=".dtxs") returned 5 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".dtxs") returned 0x0 [0095.778] lstrlenW (lpString=".mdt") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".mdt") returned 0x0 [0095.778] lstrlenW (lpString=".sdf") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".sdf") returned 0x0 [0095.778] lstrlenW (lpString=".MDF") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".MDF") returned 0x0 [0095.778] lstrlenW (lpString=".DBF") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".DBF") returned 0x0 [0095.778] lstrlenW (lpString=".DB") returned 3 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".DB") returned 0x0 [0095.778] lstrlenW (lpString=".db") returned 3 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".db") returned 0x0 [0095.778] lstrlenW (lpString=".ndf") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".ndf") returned 0x0 [0095.778] lstrlenW (lpString=".NDF") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".NDF") returned 0x0 [0095.778] lstrlenW (lpString=".Mdf") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".Mdf") returned 0x0 [0095.778] lstrlenW (lpString=".dat") returned 4 [0095.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".dat") returned 0x0 [0095.778] lstrlenW (lpString=".DAT") returned 4 [0095.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".DAT") returned 0x0 [0095.779] lstrlenW (lpString=".ldf") returned 4 [0095.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".ldf") returned 0x0 [0095.779] lstrlenW (lpString=".LDF") returned 4 [0095.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch=".LDF") returned 0x0 [0095.779] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.779] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5dd0) returned 1 [0095.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.780] CryptReleaseContext (hProv=0x27e5dd0, dwFlags=0x0) returned 1 [0095.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.780] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21578103015) returned 1 [0095.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7e644b0, dwHighDateTime=0x1d585b4)) [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1008 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1008 | out: hHeap=0x260000) returned 1 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.781] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.781] GetLastError () returned 0x0 [0095.781] GetLastError () returned 0x0 [0095.781] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.781] GetLastError () returned 0x0 [0095.781] GetLastError () returned 0x0 [0095.788] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.788] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.788] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.788] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.819] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.827] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.827] CloseHandle (hObject=0x108) returned 1 [0095.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.830] GetLastError () returned 0x0 [0095.830] RtlWakeConditionVariable () returned 0x0 [0095.830] GetCurrentThreadId () returned 0x99c [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".ldf") returned 0x0 [0095.831] lstrlenW (lpString=".vhd") returned 4 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".vhd") returned 0x0 [0095.831] lstrlenW (lpString=".vhdx") returned 5 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".vhdx") returned 0x0 [0095.831] lstrlenW (lpString=".pst") returned 4 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".pst") returned 0x0 [0095.831] lstrlenW (lpString=".ost") returned 4 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".ost") returned 0x0 [0095.831] lstrlenW (lpString=".bak") returned 4 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".bak") returned 0x0 [0095.831] lstrlenW (lpString=".bac") returned 4 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".bac") returned 0x0 [0095.831] lstrlenW (lpString=".sys") returned 4 [0095.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".sys") returned 0x0 [0095.831] lstrlenW (lpString=".v2i") returned 4 [0095.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".v2i") returned 0x0 [0095.832] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0095.834] lstrlenW (lpString=".sql") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".sql") returned 0x0 [0095.834] lstrlenW (lpString=".mdf") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".mdf") returned 0x0 [0095.834] lstrlenW (lpString=".txt") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".txt") returned 0x0 [0095.834] lstrlenW (lpString=".dbf") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".dbf") returned 0x0 [0095.834] lstrlenW (lpString=".ckp") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".ckp") returned 0x0 [0095.834] lstrlenW (lpString=".dacpac") returned 7 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".dacpac") returned 0x0 [0095.834] lstrlenW (lpString=".db3") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".db3") returned 0x0 [0095.834] lstrlenW (lpString=".dtxs") returned 5 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".dtxs") returned 0x0 [0095.834] lstrlenW (lpString=".mdt") returned 4 [0095.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".mdt") returned 0x0 [0095.835] lstrlenW (lpString=".sdf") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".sdf") returned 0x0 [0095.835] lstrlenW (lpString=".MDF") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".MDF") returned 0x0 [0095.835] lstrlenW (lpString=".DBF") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".DBF") returned 0x0 [0095.835] lstrlenW (lpString=".DB") returned 3 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".DB") returned 0x0 [0095.835] lstrlenW (lpString=".db") returned 3 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".db") returned 0x0 [0095.835] lstrlenW (lpString=".ndf") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".ndf") returned 0x0 [0095.835] lstrlenW (lpString=".NDF") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".NDF") returned 0x0 [0095.835] lstrlenW (lpString=".Mdf") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".Mdf") returned 0x0 [0095.835] lstrlenW (lpString=".dat") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".dat") returned 0x0 [0095.835] lstrlenW (lpString=".DAT") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".DAT") returned 0x0 [0095.835] lstrlenW (lpString=".ldf") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".ldf") returned 0x0 [0095.835] lstrlenW (lpString=".LDF") returned 4 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch=".LDF") returned 0x0 [0095.835] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.836] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6210) returned 1 [0095.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.836] CryptReleaseContext (hProv=0x27e6210, dwFlags=0x0) returned 1 [0095.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.837] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21583775648) returned 1 [0095.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7efca30, dwHighDateTime=0x1d585b4)) [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1040 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1040 | out: hHeap=0x260000) returned 1 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.837] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.837] GetLastError () returned 0x0 [0095.838] GetLastError () returned 0x0 [0095.838] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.838] GetLastError () returned 0x0 [0095.838] GetLastError () returned 0x0 [0095.855] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffeeaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.855] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x11560, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x11560, lpOverlapped=0x0) returned 1 [0095.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.855] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.856] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.856] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.856] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.856] CloseHandle (hObject=0x108) returned 1 [0095.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.858] GetLastError () returned 0x0 [0095.859] RtlWakeConditionVariable () returned 0x27e828 [0095.859] GetCurrentThreadId () returned 0x99c [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".ldf") returned 0x0 [0095.859] lstrlenW (lpString=".vhd") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".vhd") returned 0x0 [0095.859] lstrlenW (lpString=".vhdx") returned 5 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".vhdx") returned 0x0 [0095.859] lstrlenW (lpString=".pst") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".pst") returned 0x0 [0095.859] lstrlenW (lpString=".ost") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".ost") returned 0x0 [0095.859] lstrlenW (lpString=".bak") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".bak") returned 0x0 [0095.859] lstrlenW (lpString=".bac") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".bac") returned 0x0 [0095.859] lstrlenW (lpString=".sys") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".sys") returned 0x0 [0095.859] lstrlenW (lpString=".v2i") returned 4 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".v2i") returned 0x0 [0095.859] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch="s\r\n.v2i") returned 0x0 [0095.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0095.862] lstrlenW (lpString=".sql") returned 4 [0095.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".sql") returned 0x0 [0095.862] lstrlenW (lpString=".mdf") returned 4 [0095.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".mdf") returned 0x0 [0095.862] lstrlenW (lpString=".txt") returned 4 [0095.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".txt") returned 0x0 [0095.862] lstrlenW (lpString=".dbf") returned 4 [0095.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".dbf") returned 0x0 [0095.862] lstrlenW (lpString=".ckp") returned 4 [0095.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".ckp") returned 0x0 [0095.863] lstrlenW (lpString=".dacpac") returned 7 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".dacpac") returned 0x0 [0095.863] lstrlenW (lpString=".db3") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".db3") returned 0x0 [0095.863] lstrlenW (lpString=".dtxs") returned 5 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".dtxs") returned 0x0 [0095.863] lstrlenW (lpString=".mdt") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".mdt") returned 0x0 [0095.863] lstrlenW (lpString=".sdf") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".sdf") returned 0x0 [0095.863] lstrlenW (lpString=".MDF") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".MDF") returned 0x0 [0095.863] lstrlenW (lpString=".DBF") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".DBF") returned 0x0 [0095.863] lstrlenW (lpString=".DB") returned 3 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".DB") returned 0x0 [0095.863] lstrlenW (lpString=".db") returned 3 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".db") returned 0x0 [0095.863] lstrlenW (lpString=".ndf") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".ndf") returned 0x0 [0095.863] lstrlenW (lpString=".NDF") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".NDF") returned 0x0 [0095.863] lstrlenW (lpString=".Mdf") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".Mdf") returned 0x0 [0095.863] lstrlenW (lpString=".dat") returned 4 [0095.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".dat") returned 0x0 [0095.864] lstrlenW (lpString=".DAT") returned 4 [0095.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".DAT") returned 0x0 [0095.864] lstrlenW (lpString=".ldf") returned 4 [0095.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".ldf") returned 0x0 [0095.864] lstrlenW (lpString=".LDF") returned 4 [0095.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch=".LDF") returned 0x0 [0095.864] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.864] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6298) returned 1 [0095.865] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.865] CryptReleaseContext (hProv=0x27e6298, dwFlags=0x0) returned 1 [0095.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.865] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21586602031) returned 1 [0095.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc7f48cf0, dwHighDateTime=0x1d585b4)) [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e10b0 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e10b0 | out: hHeap=0x260000) returned 1 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.866] GetLastError () returned 0x0 [0095.866] GetLastError () returned 0x0 [0095.866] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.866] GetLastError () returned 0x0 [0095.866] GetLastError () returned 0x0 [0095.886] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.886] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.886] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.886] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.989] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.989] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.989] CloseHandle (hObject=0x108) returned 1 [0095.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.[deadmin@cock.li].deadmin")) returned 1 [0095.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0095.991] GetLastError () returned 0x0 [0095.991] RtlWakeConditionVariable () returned 0x0 [0095.991] GetCurrentThreadId () returned 0x99c [0095.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".ldf") returned 0x0 [0095.991] lstrlenW (lpString=".vhd") returned 4 [0095.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".vhd") returned 0x0 [0095.991] lstrlenW (lpString=".vhdx") returned 5 [0095.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".vhdx") returned 0x0 [0095.991] lstrlenW (lpString=".pst") returned 4 [0095.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".pst") returned 0x0 [0095.991] lstrlenW (lpString=".ost") returned 4 [0095.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".ost") returned 0x0 [0095.992] lstrlenW (lpString=".bak") returned 4 [0095.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".bak") returned 0x0 [0095.992] lstrlenW (lpString=".bac") returned 4 [0095.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".bac") returned 0x0 [0095.992] lstrlenW (lpString=".sys") returned 4 [0095.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".sys") returned 0x0 [0095.992] lstrlenW (lpString=".v2i") returned 4 [0095.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".v2i") returned 0x0 [0095.992] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.992] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0095.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0095.993] lstrlenW (lpString=".sql") returned 4 [0095.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".sql") returned 0x0 [0095.993] lstrlenW (lpString=".mdf") returned 4 [0095.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".mdf") returned 0x0 [0095.993] lstrlenW (lpString=".txt") returned 4 [0095.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".txt") returned 0x0 [0095.994] lstrlenW (lpString=".dbf") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".dbf") returned 0x0 [0095.994] lstrlenW (lpString=".ckp") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".ckp") returned 0x0 [0095.994] lstrlenW (lpString=".dacpac") returned 7 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".dacpac") returned 0x0 [0095.994] lstrlenW (lpString=".db3") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".db3") returned 0x0 [0095.994] lstrlenW (lpString=".dtxs") returned 5 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".dtxs") returned 0x0 [0095.994] lstrlenW (lpString=".mdt") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".mdt") returned 0x0 [0095.994] lstrlenW (lpString=".sdf") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".sdf") returned 0x0 [0095.994] lstrlenW (lpString=".MDF") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".MDF") returned 0x0 [0095.994] lstrlenW (lpString=".DBF") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".DBF") returned 0x0 [0095.994] lstrlenW (lpString=".DB") returned 3 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".DB") returned 0x0 [0095.994] lstrlenW (lpString=".db") returned 3 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".db") returned 0x0 [0095.994] lstrlenW (lpString=".ndf") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".ndf") returned 0x0 [0095.994] lstrlenW (lpString=".NDF") returned 4 [0095.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".NDF") returned 0x0 [0095.995] lstrlenW (lpString=".Mdf") returned 4 [0095.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".Mdf") returned 0x0 [0095.995] lstrlenW (lpString=".dat") returned 4 [0095.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".dat") returned 0x0 [0095.995] lstrlenW (lpString=".DAT") returned 4 [0095.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".DAT") returned 0x0 [0095.995] lstrlenW (lpString=".ldf") returned 4 [0095.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".ldf") returned 0x0 [0095.995] lstrlenW (lpString=".LDF") returned 4 [0095.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch=".LDF") returned 0x0 [0095.995] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.995] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0095.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.995] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e63a8) returned 1 [0095.996] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.996] CryptReleaseContext (hProv=0x27e63a8, dwFlags=0x0) returned 1 [0095.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0095.996] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21599718857) returned 1 [0095.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc80797f0, dwHighDateTime=0x1d585b4)) [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1200 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1200 | out: hHeap=0x260000) returned 1 [0095.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.997] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0095.997] GetLastError () returned 0x0 [0095.997] GetLastError () returned 0x0 [0095.997] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0095.997] GetLastError () returned 0x0 [0095.997] GetLastError () returned 0x0 [0096.001] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.001] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.001] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.001] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.033] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.033] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.033] CloseHandle (hObject=0x108) returned 1 [0096.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.[deadmin@cock.li].deadmin")) returned 1 [0096.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.037] GetLastError () returned 0x0 [0096.037] RtlWakeConditionVariable () returned 0x0 [0096.037] GetCurrentThreadId () returned 0x99c [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".ldf") returned 0x0 [0096.037] lstrlenW (lpString=".vhd") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".vhd") returned 0x0 [0096.037] lstrlenW (lpString=".vhdx") returned 5 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".vhdx") returned 0x0 [0096.037] lstrlenW (lpString=".pst") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".pst") returned 0x0 [0096.037] lstrlenW (lpString=".ost") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".ost") returned 0x0 [0096.037] lstrlenW (lpString=".bak") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".bak") returned 0x0 [0096.037] lstrlenW (lpString=".bac") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".bac") returned 0x0 [0096.037] lstrlenW (lpString=".sys") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".sys") returned 0x0 [0096.037] lstrlenW (lpString=".v2i") returned 4 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".v2i") returned 0x0 [0096.037] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0096.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.039] lstrlenW (lpString=".sql") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".sql") returned 0x0 [0096.039] lstrlenW (lpString=".mdf") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".mdf") returned 0x0 [0096.039] lstrlenW (lpString=".txt") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".txt") returned 0x0 [0096.039] lstrlenW (lpString=".dbf") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".dbf") returned 0x0 [0096.039] lstrlenW (lpString=".ckp") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".ckp") returned 0x0 [0096.039] lstrlenW (lpString=".dacpac") returned 7 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".dacpac") returned 0x0 [0096.039] lstrlenW (lpString=".db3") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".db3") returned 0x0 [0096.039] lstrlenW (lpString=".dtxs") returned 5 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".dtxs") returned 0x0 [0096.039] lstrlenW (lpString=".mdt") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".mdt") returned 0x0 [0096.039] lstrlenW (lpString=".sdf") returned 4 [0096.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".sdf") returned 0x0 [0096.040] lstrlenW (lpString=".MDF") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".MDF") returned 0x0 [0096.040] lstrlenW (lpString=".DBF") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".DBF") returned 0x0 [0096.040] lstrlenW (lpString=".DB") returned 3 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".DB") returned 0x0 [0096.040] lstrlenW (lpString=".db") returned 3 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".db") returned 0x0 [0096.040] lstrlenW (lpString=".ndf") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".ndf") returned 0x0 [0096.040] lstrlenW (lpString=".NDF") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".NDF") returned 0x0 [0096.040] lstrlenW (lpString=".Mdf") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".Mdf") returned 0x0 [0096.040] lstrlenW (lpString=".dat") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".dat") returned 0x0 [0096.040] lstrlenW (lpString=".DAT") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".DAT") returned 0x0 [0096.040] lstrlenW (lpString=".ldf") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".ldf") returned 0x0 [0096.040] lstrlenW (lpString=".LDF") returned 4 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch=".LDF") returned 0x0 [0096.040] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.041] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6650) returned 1 [0096.041] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.041] CryptReleaseContext (hProv=0x27e6650, dwFlags=0x0) returned 1 [0096.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.042] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21604265414) returned 1 [0096.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc80ebc10, dwHighDateTime=0x1d585b4)) [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1270 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1270 | out: hHeap=0x260000) returned 1 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.042] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.042] GetLastError () returned 0x0 [0096.043] GetLastError () returned 0x0 [0096.043] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.043] GetLastError () returned 0x0 [0096.043] GetLastError () returned 0x0 [0096.046] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.046] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.047] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.047] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.073] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.073] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.073] CloseHandle (hObject=0x108) returned 1 [0096.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.[deadmin@cock.li].deadmin")) returned 1 [0096.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.075] GetLastError () returned 0x0 [0096.075] RtlWakeConditionVariable () returned 0x0 [0096.075] GetCurrentThreadId () returned 0x99c [0096.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".ldf") returned 0x0 [0096.075] lstrlenW (lpString=".vhd") returned 4 [0096.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".vhd") returned 0x0 [0096.075] lstrlenW (lpString=".vhdx") returned 5 [0096.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".vhdx") returned 0x0 [0096.075] lstrlenW (lpString=".pst") returned 4 [0096.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".pst") returned 0x0 [0096.075] lstrlenW (lpString=".ost") returned 4 [0096.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".ost") returned 0x0 [0096.075] lstrlenW (lpString=".bak") returned 4 [0096.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".bak") returned 0x0 [0096.076] lstrlenW (lpString=".bac") returned 4 [0096.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".bac") returned 0x0 [0096.076] lstrlenW (lpString=".sys") returned 4 [0096.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".sys") returned 0x0 [0096.076] lstrlenW (lpString=".v2i") returned 4 [0096.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".v2i") returned 0x0 [0096.076] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch="s\r\n.v2i") returned 0x0 [0096.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.078] lstrlenW (lpString=".sql") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".sql") returned 0x0 [0096.078] lstrlenW (lpString=".mdf") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".mdf") returned 0x0 [0096.078] lstrlenW (lpString=".txt") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".txt") returned 0x0 [0096.078] lstrlenW (lpString=".dbf") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".dbf") returned 0x0 [0096.078] lstrlenW (lpString=".ckp") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".ckp") returned 0x0 [0096.078] lstrlenW (lpString=".dacpac") returned 7 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".dacpac") returned 0x0 [0096.078] lstrlenW (lpString=".db3") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".db3") returned 0x0 [0096.078] lstrlenW (lpString=".dtxs") returned 5 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".dtxs") returned 0x0 [0096.078] lstrlenW (lpString=".mdt") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".mdt") returned 0x0 [0096.078] lstrlenW (lpString=".sdf") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".sdf") returned 0x0 [0096.078] lstrlenW (lpString=".MDF") returned 4 [0096.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".MDF") returned 0x0 [0096.078] lstrlenW (lpString=".DBF") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".DBF") returned 0x0 [0096.079] lstrlenW (lpString=".DB") returned 3 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".DB") returned 0x0 [0096.079] lstrlenW (lpString=".db") returned 3 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".db") returned 0x0 [0096.079] lstrlenW (lpString=".ndf") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".ndf") returned 0x0 [0096.079] lstrlenW (lpString=".NDF") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".NDF") returned 0x0 [0096.079] lstrlenW (lpString=".Mdf") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".Mdf") returned 0x0 [0096.079] lstrlenW (lpString=".dat") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".dat") returned 0x0 [0096.079] lstrlenW (lpString=".DAT") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".DAT") returned 0x0 [0096.079] lstrlenW (lpString=".ldf") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".ldf") returned 0x0 [0096.079] lstrlenW (lpString=".LDF") returned 4 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch=".LDF") returned 0x0 [0096.079] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.079] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.079] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6760) returned 1 [0096.080] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.080] CryptReleaseContext (hProv=0x27e6760, dwFlags=0x0) returned 1 [0096.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.080] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21608152465) returned 1 [0096.080] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc815e030, dwHighDateTime=0x1d585b4)) [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1318 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1318 | out: hHeap=0x260000) returned 1 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.081] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.081] GetLastError () returned 0x0 [0096.081] GetLastError () returned 0x0 [0096.082] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.082] GetLastError () returned 0x0 [0096.082] GetLastError () returned 0x0 [0096.092] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.092] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0096.092] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.092] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.109] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.109] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.109] CloseHandle (hObject=0x108) returned 1 [0096.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.[deadmin@cock.li].deadmin")) returned 1 [0096.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.111] GetLastError () returned 0x0 [0096.111] RtlWakeConditionVariable () returned 0x0 [0096.111] GetCurrentThreadId () returned 0x99c [0096.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".ldf") returned 0x0 [0096.111] lstrlenW (lpString=".vhd") returned 4 [0096.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".vhd") returned 0x0 [0096.111] lstrlenW (lpString=".vhdx") returned 5 [0096.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".vhdx") returned 0x0 [0096.111] lstrlenW (lpString=".pst") returned 4 [0096.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".pst") returned 0x0 [0096.111] lstrlenW (lpString=".ost") returned 4 [0096.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".ost") returned 0x0 [0096.112] lstrlenW (lpString=".bak") returned 4 [0096.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".bak") returned 0x0 [0096.112] lstrlenW (lpString=".bac") returned 4 [0096.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".bac") returned 0x0 [0096.112] lstrlenW (lpString=".sys") returned 4 [0096.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".sys") returned 0x0 [0096.112] lstrlenW (lpString=".v2i") returned 4 [0096.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".v2i") returned 0x0 [0096.112] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0096.113] lstrlenW (lpString=".sql") returned 4 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".sql") returned 0x0 [0096.113] lstrlenW (lpString=".mdf") returned 4 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".mdf") returned 0x0 [0096.113] lstrlenW (lpString=".txt") returned 4 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".txt") returned 0x0 [0096.113] lstrlenW (lpString=".dbf") returned 4 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".dbf") returned 0x0 [0096.113] lstrlenW (lpString=".ckp") returned 4 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".ckp") returned 0x0 [0096.113] lstrlenW (lpString=".dacpac") returned 7 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".dacpac") returned 0x0 [0096.113] lstrlenW (lpString=".db3") returned 4 [0096.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".db3") returned 0x0 [0096.114] lstrlenW (lpString=".dtxs") returned 5 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".dtxs") returned 0x0 [0096.114] lstrlenW (lpString=".mdt") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".mdt") returned 0x0 [0096.114] lstrlenW (lpString=".sdf") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".sdf") returned 0x0 [0096.114] lstrlenW (lpString=".MDF") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".MDF") returned 0x0 [0096.114] lstrlenW (lpString=".DBF") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".DBF") returned 0x0 [0096.114] lstrlenW (lpString=".DB") returned 3 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".DB") returned 0x0 [0096.114] lstrlenW (lpString=".db") returned 3 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".db") returned 0x0 [0096.114] lstrlenW (lpString=".ndf") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".ndf") returned 0x0 [0096.114] lstrlenW (lpString=".NDF") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".NDF") returned 0x0 [0096.114] lstrlenW (lpString=".Mdf") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".Mdf") returned 0x0 [0096.114] lstrlenW (lpString=".dat") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".dat") returned 0x0 [0096.114] lstrlenW (lpString=".DAT") returned 4 [0096.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".DAT") returned 0x0 [0096.114] lstrlenW (lpString=".ldf") returned 4 [0096.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".ldf") returned 0x0 [0096.115] lstrlenW (lpString=".LDF") returned 4 [0096.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch=".LDF") returned 0x0 [0096.115] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.115] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5088) returned 1 [0096.116] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.116] CryptReleaseContext (hProv=0x27e5088, dwFlags=0x0) returned 1 [0096.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.116] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21611688118) returned 1 [0096.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc81aa2f0, dwHighDateTime=0x1d585b4)) [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e13c0 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e13c0 | out: hHeap=0x260000) returned 1 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0096.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0096.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.116] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.117] GetLastError () returned 0x0 [0096.117] GetLastError () returned 0x0 [0096.117] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.117] GetLastError () returned 0x0 [0096.117] GetLastError () returned 0x0 [0096.126] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.126] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.127] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.127] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.127] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.127] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.127] CloseHandle (hObject=0x108) returned 1 [0096.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.127] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.129] GetLastError () returned 0x0 [0096.129] RtlWakeConditionVariable () returned 0x0 [0096.148] GetCurrentThreadId () returned 0x99c [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".ldf") returned 0x0 [0096.149] lstrlenW (lpString=".vhd") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".vhd") returned 0x0 [0096.149] lstrlenW (lpString=".vhdx") returned 5 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".vhdx") returned 0x0 [0096.149] lstrlenW (lpString=".pst") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".pst") returned 0x0 [0096.149] lstrlenW (lpString=".ost") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".ost") returned 0x0 [0096.149] lstrlenW (lpString=".bak") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".bak") returned 0x0 [0096.149] lstrlenW (lpString=".bac") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".bac") returned 0x0 [0096.149] lstrlenW (lpString=".sys") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".sys") returned 0x0 [0096.149] lstrlenW (lpString=".v2i") returned 4 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".v2i") returned 0x0 [0096.149] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.150] lstrlenW (lpString=".sql") returned 4 [0096.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".sql") returned 0x0 [0096.151] lstrlenW (lpString=".mdf") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".mdf") returned 0x0 [0096.151] lstrlenW (lpString=".txt") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".txt") returned 0x0 [0096.151] lstrlenW (lpString=".dbf") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".dbf") returned 0x0 [0096.151] lstrlenW (lpString=".ckp") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".ckp") returned 0x0 [0096.151] lstrlenW (lpString=".dacpac") returned 7 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".dacpac") returned 0x0 [0096.151] lstrlenW (lpString=".db3") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".db3") returned 0x0 [0096.151] lstrlenW (lpString=".dtxs") returned 5 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".dtxs") returned 0x0 [0096.151] lstrlenW (lpString=".mdt") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".mdt") returned 0x0 [0096.151] lstrlenW (lpString=".sdf") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".sdf") returned 0x0 [0096.151] lstrlenW (lpString=".MDF") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".MDF") returned 0x0 [0096.151] lstrlenW (lpString=".DBF") returned 4 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".DBF") returned 0x0 [0096.151] lstrlenW (lpString=".DB") returned 3 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".DB") returned 0x0 [0096.151] lstrlenW (lpString=".db") returned 3 [0096.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".db") returned 0x0 [0096.151] lstrlenW (lpString=".ndf") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".ndf") returned 0x0 [0096.152] lstrlenW (lpString=".NDF") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".NDF") returned 0x0 [0096.152] lstrlenW (lpString=".Mdf") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".Mdf") returned 0x0 [0096.152] lstrlenW (lpString=".dat") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".dat") returned 0x0 [0096.152] lstrlenW (lpString=".DAT") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".DAT") returned 0x0 [0096.152] lstrlenW (lpString=".ldf") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".ldf") returned 0x0 [0096.152] lstrlenW (lpString=".LDF") returned 4 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch=".LDF") returned 0x0 [0096.152] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.152] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e5088) returned 1 [0096.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.153] CryptReleaseContext (hProv=0x27e5088, dwFlags=0x0) returned 1 [0096.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.153] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21615421468) returned 1 [0096.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc81f65b0, dwHighDateTime=0x1d585b4)) [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1468 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1468 | out: hHeap=0x260000) returned 1 [0096.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f6b8 [0096.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f6b8 | out: hHeap=0x260000) returned 1 [0096.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0096.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.154] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.154] GetLastError () returned 0x0 [0096.154] GetLastError () returned 0x0 [0096.154] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.154] GetLastError () returned 0x0 [0096.154] GetLastError () returned 0x0 [0096.178] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.178] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0096.182] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.182] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.184] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.184] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.184] CloseHandle (hObject=0xe4) returned 1 [0096.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.186] GetLastError () returned 0x0 [0096.186] RtlWakeConditionVariable () returned 0x0 [0096.186] GetCurrentThreadId () returned 0x99c [0096.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".ldf") returned 0x0 [0096.186] lstrlenW (lpString=".vhd") returned 4 [0096.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".vhd") returned 0x0 [0096.186] lstrlenW (lpString=".vhdx") returned 5 [0096.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".vhdx") returned 0x0 [0096.186] lstrlenW (lpString=".pst") returned 4 [0096.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".pst") returned 0x0 [0096.186] lstrlenW (lpString=".ost") returned 4 [0096.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".ost") returned 0x0 [0096.186] lstrlenW (lpString=".bak") returned 4 [0096.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".bak") returned 0x0 [0096.186] lstrlenW (lpString=".bac") returned 4 [0096.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".bac") returned 0x0 [0096.187] lstrlenW (lpString=".sys") returned 4 [0096.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".sys") returned 0x0 [0096.187] lstrlenW (lpString=".v2i") returned 4 [0096.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".v2i") returned 0x0 [0096.187] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.188] lstrlenW (lpString=".sql") returned 4 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".sql") returned 0x0 [0096.188] lstrlenW (lpString=".mdf") returned 4 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".mdf") returned 0x0 [0096.188] lstrlenW (lpString=".txt") returned 4 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".txt") returned 0x0 [0096.188] lstrlenW (lpString=".dbf") returned 4 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".dbf") returned 0x0 [0096.188] lstrlenW (lpString=".ckp") returned 4 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".ckp") returned 0x0 [0096.188] lstrlenW (lpString=".dacpac") returned 7 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".dacpac") returned 0x0 [0096.188] lstrlenW (lpString=".db3") returned 4 [0096.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".db3") returned 0x0 [0096.189] lstrlenW (lpString=".dtxs") returned 5 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".dtxs") returned 0x0 [0096.189] lstrlenW (lpString=".mdt") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".mdt") returned 0x0 [0096.189] lstrlenW (lpString=".sdf") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".sdf") returned 0x0 [0096.189] lstrlenW (lpString=".MDF") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".MDF") returned 0x0 [0096.189] lstrlenW (lpString=".DBF") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".DBF") returned 0x0 [0096.189] lstrlenW (lpString=".DB") returned 3 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".DB") returned 0x0 [0096.189] lstrlenW (lpString=".db") returned 3 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".db") returned 0x0 [0096.189] lstrlenW (lpString=".ndf") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".ndf") returned 0x0 [0096.189] lstrlenW (lpString=".NDF") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".NDF") returned 0x0 [0096.189] lstrlenW (lpString=".Mdf") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".Mdf") returned 0x0 [0096.189] lstrlenW (lpString=".dat") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".dat") returned 0x0 [0096.189] lstrlenW (lpString=".DAT") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".DAT") returned 0x0 [0096.189] lstrlenW (lpString=".ldf") returned 4 [0096.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".ldf") returned 0x0 [0096.190] lstrlenW (lpString=".LDF") returned 4 [0096.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch=".LDF") returned 0x0 [0096.190] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.190] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6980) returned 1 [0096.191] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.191] CryptReleaseContext (hProv=0x27e6980, dwFlags=0x0) returned 1 [0096.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.191] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21619205910) returned 1 [0096.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc82689d0, dwHighDateTime=0x1d585b4)) [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1510 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1510 | out: hHeap=0x260000) returned 1 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d838 [0096.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.192] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.192] GetLastError () returned 0x0 [0096.192] GetLastError () returned 0x0 [0096.192] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.192] GetLastError () returned 0x0 [0096.192] GetLastError () returned 0x0 [0096.243] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.243] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0096.248] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.248] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.284] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.284] CloseHandle (hObject=0xe4) returned 1 [0096.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.285] GetLastError () returned 0x0 [0096.286] RtlWakeConditionVariable () returned 0x0 [0096.286] GetCurrentThreadId () returned 0x99c [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".ldf") returned 0x0 [0096.286] lstrlenW (lpString=".vhd") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".vhd") returned 0x0 [0096.286] lstrlenW (lpString=".vhdx") returned 5 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".vhdx") returned 0x0 [0096.286] lstrlenW (lpString=".pst") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".pst") returned 0x0 [0096.286] lstrlenW (lpString=".ost") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".ost") returned 0x0 [0096.286] lstrlenW (lpString=".bak") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".bak") returned 0x0 [0096.286] lstrlenW (lpString=".bac") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".bac") returned 0x0 [0096.286] lstrlenW (lpString=".sys") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".sys") returned 0x0 [0096.286] lstrlenW (lpString=".v2i") returned 4 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".v2i") returned 0x0 [0096.286] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0096.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.288] lstrlenW (lpString=".sql") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".sql") returned 0x0 [0096.288] lstrlenW (lpString=".mdf") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".mdf") returned 0x0 [0096.288] lstrlenW (lpString=".txt") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".txt") returned 0x0 [0096.288] lstrlenW (lpString=".dbf") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".dbf") returned 0x0 [0096.288] lstrlenW (lpString=".ckp") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".ckp") returned 0x0 [0096.288] lstrlenW (lpString=".dacpac") returned 7 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".dacpac") returned 0x0 [0096.288] lstrlenW (lpString=".db3") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".db3") returned 0x0 [0096.288] lstrlenW (lpString=".dtxs") returned 5 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".dtxs") returned 0x0 [0096.288] lstrlenW (lpString=".mdt") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".mdt") returned 0x0 [0096.288] lstrlenW (lpString=".sdf") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".sdf") returned 0x0 [0096.288] lstrlenW (lpString=".MDF") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".MDF") returned 0x0 [0096.288] lstrlenW (lpString=".DBF") returned 4 [0096.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".DBF") returned 0x0 [0096.288] lstrlenW (lpString=".DB") returned 3 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".DB") returned 0x0 [0096.289] lstrlenW (lpString=".db") returned 3 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".db") returned 0x0 [0096.289] lstrlenW (lpString=".ndf") returned 4 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".ndf") returned 0x0 [0096.289] lstrlenW (lpString=".NDF") returned 4 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".NDF") returned 0x0 [0096.289] lstrlenW (lpString=".Mdf") returned 4 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".Mdf") returned 0x0 [0096.289] lstrlenW (lpString=".dat") returned 4 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".dat") returned 0x0 [0096.289] lstrlenW (lpString=".DAT") returned 4 [0096.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", lpSrch=".DAT") returned=".DAT" [0096.289] lstrlenW (lpString=".DAT") returned 4 [0096.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.289] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e67e8) returned 1 [0096.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.290] CryptReleaseContext (hProv=0x27e67e8, dwFlags=0x0) returned 1 [0096.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.290] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21629124351) returned 1 [0096.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc834d210, dwHighDateTime=0x1d585b4)) [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e16d0 [0096.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e16d0 | out: hHeap=0x260000) returned 1 [0096.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.291] GetLastError () returned 0x0 [0096.291] GetLastError () returned 0x0 [0096.291] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.291] GetLastError () returned 0x0 [0096.291] GetLastError () returned 0x0 [0096.293] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff5ff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.293] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa00c, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0xa00c, lpOverlapped=0x0) returned 1 [0096.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.294] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.294] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.294] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.294] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.294] CloseHandle (hObject=0xe4) returned 1 [0096.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.[deadmin@cock.li].deadmin")) returned 1 [0096.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.296] GetLastError () returned 0x0 [0096.296] RtlWakeConditionVariable () returned 0x0 [0096.296] GetCurrentThreadId () returned 0x99c [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".ldf") returned 0x0 [0096.296] lstrlenW (lpString=".vhd") returned 4 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".vhd") returned 0x0 [0096.296] lstrlenW (lpString=".vhdx") returned 5 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".vhdx") returned 0x0 [0096.296] lstrlenW (lpString=".pst") returned 4 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".pst") returned 0x0 [0096.296] lstrlenW (lpString=".ost") returned 4 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".ost") returned 0x0 [0096.296] lstrlenW (lpString=".bak") returned 4 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".bak") returned 0x0 [0096.296] lstrlenW (lpString=".bac") returned 4 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".bac") returned 0x0 [0096.296] lstrlenW (lpString=".sys") returned 4 [0096.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".sys") returned 0x0 [0096.297] lstrlenW (lpString=".v2i") returned 4 [0096.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".v2i") returned 0x0 [0096.297] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch="s\r\n.v2i") returned 0x0 [0096.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.298] lstrlenW (lpString=".sql") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".sql") returned 0x0 [0096.298] lstrlenW (lpString=".mdf") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".mdf") returned 0x0 [0096.298] lstrlenW (lpString=".txt") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".txt") returned 0x0 [0096.298] lstrlenW (lpString=".dbf") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".dbf") returned 0x0 [0096.298] lstrlenW (lpString=".ckp") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".ckp") returned 0x0 [0096.298] lstrlenW (lpString=".dacpac") returned 7 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".dacpac") returned 0x0 [0096.298] lstrlenW (lpString=".db3") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".db3") returned 0x0 [0096.298] lstrlenW (lpString=".dtxs") returned 5 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".dtxs") returned 0x0 [0096.298] lstrlenW (lpString=".mdt") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".mdt") returned 0x0 [0096.298] lstrlenW (lpString=".sdf") returned 4 [0096.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".sdf") returned 0x0 [0096.298] lstrlenW (lpString=".MDF") returned 4 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".MDF") returned 0x0 [0096.299] lstrlenW (lpString=".DBF") returned 4 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".DBF") returned 0x0 [0096.299] lstrlenW (lpString=".DB") returned 3 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".DB") returned 0x0 [0096.299] lstrlenW (lpString=".db") returned 3 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".db") returned 0x0 [0096.299] lstrlenW (lpString=".ndf") returned 4 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".ndf") returned 0x0 [0096.299] lstrlenW (lpString=".NDF") returned 4 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".NDF") returned 0x0 [0096.299] lstrlenW (lpString=".Mdf") returned 4 [0096.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".Mdf") returned 0x0 [0096.300] lstrlenW (lpString=".dat") returned 4 [0096.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".dat") returned 0x0 [0096.300] lstrlenW (lpString=".DAT") returned 4 [0096.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".DAT") returned 0x0 [0096.300] lstrlenW (lpString=".ldf") returned 4 [0096.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".ldf") returned 0x0 [0096.300] lstrlenW (lpString=".LDF") returned 4 [0096.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch=".LDF") returned 0x0 [0096.300] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.300] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6cb0) returned 1 [0096.301] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.301] CryptReleaseContext (hProv=0x27e6cb0, dwFlags=0x0) returned 1 [0096.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.301] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21630225880) returned 1 [0096.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc8373370, dwHighDateTime=0x1d585b4)) [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1708 [0096.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1708 | out: hHeap=0x260000) returned 1 [0096.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.302] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.302] GetLastError () returned 0x0 [0096.302] GetLastError () returned 0x0 [0096.302] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.302] GetLastError () returned 0x0 [0096.302] GetLastError () returned 0x0 [0096.304] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe367, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.304] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1c99, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x1c99, lpOverlapped=0x0) returned 1 [0096.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.304] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.304] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.305] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.305] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.305] CloseHandle (hObject=0xe4) returned 1 [0096.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.[deadmin@cock.li].deadmin")) returned 1 [0096.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.306] GetLastError () returned 0x0 [0096.306] RtlWakeConditionVariable () returned 0x0 [0096.306] GetCurrentThreadId () returned 0x99c [0096.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".ldf") returned 0x0 [0096.306] lstrlenW (lpString=".vhd") returned 4 [0096.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".vhd") returned 0x0 [0096.307] lstrlenW (lpString=".vhdx") returned 5 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".vhdx") returned 0x0 [0096.307] lstrlenW (lpString=".pst") returned 4 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".pst") returned 0x0 [0096.307] lstrlenW (lpString=".ost") returned 4 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".ost") returned 0x0 [0096.307] lstrlenW (lpString=".bak") returned 4 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".bak") returned 0x0 [0096.307] lstrlenW (lpString=".bac") returned 4 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".bac") returned 0x0 [0096.307] lstrlenW (lpString=".sys") returned 4 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".sys") returned 0x0 [0096.307] lstrlenW (lpString=".v2i") returned 4 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".v2i") returned 0x0 [0096.307] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.309] lstrlenW (lpString=".sql") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".sql") returned 0x0 [0096.309] lstrlenW (lpString=".mdf") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".mdf") returned 0x0 [0096.309] lstrlenW (lpString=".txt") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".txt") returned 0x0 [0096.309] lstrlenW (lpString=".dbf") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".dbf") returned 0x0 [0096.309] lstrlenW (lpString=".ckp") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".ckp") returned 0x0 [0096.309] lstrlenW (lpString=".dacpac") returned 7 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".dacpac") returned 0x0 [0096.309] lstrlenW (lpString=".db3") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".db3") returned 0x0 [0096.309] lstrlenW (lpString=".dtxs") returned 5 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".dtxs") returned 0x0 [0096.309] lstrlenW (lpString=".mdt") returned 4 [0096.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".mdt") returned 0x0 [0096.309] lstrlenW (lpString=".sdf") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".sdf") returned 0x0 [0096.310] lstrlenW (lpString=".MDF") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".MDF") returned 0x0 [0096.310] lstrlenW (lpString=".DBF") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".DBF") returned 0x0 [0096.310] lstrlenW (lpString=".DB") returned 3 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".DB") returned 0x0 [0096.310] lstrlenW (lpString=".db") returned 3 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".db") returned 0x0 [0096.310] lstrlenW (lpString=".ndf") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".ndf") returned 0x0 [0096.310] lstrlenW (lpString=".NDF") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".NDF") returned 0x0 [0096.310] lstrlenW (lpString=".Mdf") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".Mdf") returned 0x0 [0096.310] lstrlenW (lpString=".dat") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".dat") returned 0x0 [0096.310] lstrlenW (lpString=".DAT") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".DAT") returned 0x0 [0096.310] lstrlenW (lpString=".ldf") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".ldf") returned 0x0 [0096.310] lstrlenW (lpString=".LDF") returned 4 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch=".LDF") returned 0x0 [0096.310] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.311] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6d38) returned 1 [0096.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.311] CryptReleaseContext (hProv=0x27e6d38, dwFlags=0x0) returned 1 [0096.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.312] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21631265301) returned 1 [0096.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc8373370, dwHighDateTime=0x1d585b4)) [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1740 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1740 | out: hHeap=0x260000) returned 1 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.312] GetLastError () returned 0x0 [0096.313] GetLastError () returned 0x0 [0096.313] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.313] GetLastError () returned 0x0 [0096.313] GetLastError () returned 0x0 [0096.318] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.318] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.318] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.319] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.321] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.321] CloseHandle (hObject=0xe4) returned 1 [0096.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.323] GetLastError () returned 0x0 [0096.323] RtlWakeConditionVariable () returned 0x0 [0096.323] GetCurrentThreadId () returned 0x99c [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".ldf") returned 0x0 [0096.323] lstrlenW (lpString=".vhd") returned 4 [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".vhd") returned 0x0 [0096.323] lstrlenW (lpString=".vhdx") returned 5 [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".vhdx") returned 0x0 [0096.323] lstrlenW (lpString=".pst") returned 4 [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".pst") returned 0x0 [0096.323] lstrlenW (lpString=".ost") returned 4 [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".ost") returned 0x0 [0096.323] lstrlenW (lpString=".bak") returned 4 [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".bak") returned 0x0 [0096.323] lstrlenW (lpString=".bac") returned 4 [0096.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".bac") returned 0x0 [0096.323] lstrlenW (lpString=".sys") returned 4 [0096.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".sys") returned 0x0 [0096.324] lstrlenW (lpString=".v2i") returned 4 [0096.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".v2i") returned 0x0 [0096.324] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.328] lstrlenW (lpString=".sql") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".sql") returned 0x0 [0096.328] lstrlenW (lpString=".mdf") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".mdf") returned 0x0 [0096.328] lstrlenW (lpString=".txt") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".txt") returned 0x0 [0096.328] lstrlenW (lpString=".dbf") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".dbf") returned 0x0 [0096.328] lstrlenW (lpString=".ckp") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".ckp") returned 0x0 [0096.328] lstrlenW (lpString=".dacpac") returned 7 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".dacpac") returned 0x0 [0096.328] lstrlenW (lpString=".db3") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".db3") returned 0x0 [0096.328] lstrlenW (lpString=".dtxs") returned 5 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".dtxs") returned 0x0 [0096.328] lstrlenW (lpString=".mdt") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".mdt") returned 0x0 [0096.328] lstrlenW (lpString=".sdf") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".sdf") returned 0x0 [0096.328] lstrlenW (lpString=".MDF") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".MDF") returned 0x0 [0096.328] lstrlenW (lpString=".DBF") returned 4 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".DBF") returned 0x0 [0096.328] lstrlenW (lpString=".DB") returned 3 [0096.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".DB") returned 0x0 [0096.329] lstrlenW (lpString=".db") returned 3 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".db") returned 0x0 [0096.329] lstrlenW (lpString=".ndf") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".ndf") returned 0x0 [0096.329] lstrlenW (lpString=".NDF") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".NDF") returned 0x0 [0096.329] lstrlenW (lpString=".Mdf") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".Mdf") returned 0x0 [0096.329] lstrlenW (lpString=".dat") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".dat") returned 0x0 [0096.329] lstrlenW (lpString=".DAT") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".DAT") returned 0x0 [0096.329] lstrlenW (lpString=".ldf") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".ldf") returned 0x0 [0096.329] lstrlenW (lpString=".LDF") returned 4 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch=".LDF") returned 0x0 [0096.329] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.329] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6dc0) returned 1 [0096.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.330] CryptReleaseContext (hProv=0x27e6dc0, dwFlags=0x0) returned 1 [0096.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.330] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21633141472) returned 1 [0096.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc83bf630, dwHighDateTime=0x1d585b4)) [0096.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1778 [0096.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1778 | out: hHeap=0x260000) returned 1 [0096.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.331] GetLastError () returned 0x0 [0096.331] GetLastError () returned 0x0 [0096.331] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.332] GetLastError () returned 0x0 [0096.332] GetLastError () returned 0x0 [0096.334] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffedc20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.334] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x123e0, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x123e0, lpOverlapped=0x0) returned 1 [0096.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.334] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.334] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.334] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.334] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.334] CloseHandle (hObject=0xe4) returned 1 [0096.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.336] GetLastError () returned 0x0 [0096.336] RtlWakeConditionVariable () returned 0x0 [0096.336] GetCurrentThreadId () returned 0x99c [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".ldf") returned 0x0 [0096.337] lstrlenW (lpString=".vhd") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".vhd") returned 0x0 [0096.337] lstrlenW (lpString=".vhdx") returned 5 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".vhdx") returned 0x0 [0096.337] lstrlenW (lpString=".pst") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".pst") returned 0x0 [0096.337] lstrlenW (lpString=".ost") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".ost") returned 0x0 [0096.337] lstrlenW (lpString=".bak") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".bak") returned 0x0 [0096.337] lstrlenW (lpString=".bac") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".bac") returned 0x0 [0096.337] lstrlenW (lpString=".sys") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".sys") returned 0x0 [0096.337] lstrlenW (lpString=".v2i") returned 4 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".v2i") returned 0x0 [0096.337] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.339] lstrlenW (lpString=".sql") returned 4 [0096.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".sql") returned 0x0 [0096.339] lstrlenW (lpString=".mdf") returned 4 [0096.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".mdf") returned 0x0 [0096.339] lstrlenW (lpString=".txt") returned 4 [0096.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".txt") returned 0x0 [0096.339] lstrlenW (lpString=".dbf") returned 4 [0096.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".dbf") returned 0x0 [0096.339] lstrlenW (lpString=".ckp") returned 4 [0096.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".ckp") returned 0x0 [0096.339] lstrlenW (lpString=".dacpac") returned 7 [0096.339] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".dacpac") returned 0x0 [0096.340] lstrlenW (lpString=".db3") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".db3") returned 0x0 [0096.340] lstrlenW (lpString=".dtxs") returned 5 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".dtxs") returned 0x0 [0096.340] lstrlenW (lpString=".mdt") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".mdt") returned 0x0 [0096.340] lstrlenW (lpString=".sdf") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".sdf") returned 0x0 [0096.340] lstrlenW (lpString=".MDF") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".MDF") returned 0x0 [0096.340] lstrlenW (lpString=".DBF") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".DBF") returned 0x0 [0096.340] lstrlenW (lpString=".DB") returned 3 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".DB") returned 0x0 [0096.340] lstrlenW (lpString=".db") returned 3 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".db") returned 0x0 [0096.340] lstrlenW (lpString=".ndf") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".ndf") returned 0x0 [0096.340] lstrlenW (lpString=".NDF") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".NDF") returned 0x0 [0096.340] lstrlenW (lpString=".Mdf") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".Mdf") returned 0x0 [0096.340] lstrlenW (lpString=".dat") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".dat") returned 0x0 [0096.340] lstrlenW (lpString=".DAT") returned 4 [0096.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".DAT") returned 0x0 [0096.340] lstrlenW (lpString=".ldf") returned 4 [0096.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".ldf") returned 0x0 [0096.341] lstrlenW (lpString=".LDF") returned 4 [0096.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch=".LDF") returned 0x0 [0096.341] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.341] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6e48) returned 1 [0096.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.342] CryptReleaseContext (hProv=0x27e6e48, dwFlags=0x0) returned 1 [0096.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.342] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21634293437) returned 1 [0096.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc83bf630, dwHighDateTime=0x1d585b4)) [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e17b0 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e17b0 | out: hHeap=0x260000) returned 1 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.343] GetLastError () returned 0x0 [0096.343] GetLastError () returned 0x0 [0096.343] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.343] GetLastError () returned 0x0 [0096.343] GetLastError () returned 0x0 [0096.346] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.346] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.347] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.348] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.349] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.349] CloseHandle (hObject=0xe4) returned 1 [0096.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.351] GetLastError () returned 0x0 [0096.351] RtlWakeConditionVariable () returned 0x0 [0096.351] GetCurrentThreadId () returned 0x99c [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".ldf") returned 0x0 [0096.351] lstrlenW (lpString=".vhd") returned 4 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".vhd") returned 0x0 [0096.351] lstrlenW (lpString=".vhdx") returned 5 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".vhdx") returned 0x0 [0096.351] lstrlenW (lpString=".pst") returned 4 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".pst") returned 0x0 [0096.351] lstrlenW (lpString=".ost") returned 4 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".ost") returned 0x0 [0096.351] lstrlenW (lpString=".bak") returned 4 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".bak") returned 0x0 [0096.351] lstrlenW (lpString=".bac") returned 4 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".bac") returned 0x0 [0096.351] lstrlenW (lpString=".sys") returned 4 [0096.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".sys") returned 0x0 [0096.351] lstrlenW (lpString=".v2i") returned 4 [0096.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".v2i") returned 0x0 [0096.352] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.353] lstrlenW (lpString=".sql") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".sql") returned 0x0 [0096.353] lstrlenW (lpString=".mdf") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".mdf") returned 0x0 [0096.353] lstrlenW (lpString=".txt") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".txt") returned 0x0 [0096.353] lstrlenW (lpString=".dbf") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".dbf") returned 0x0 [0096.353] lstrlenW (lpString=".ckp") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".ckp") returned 0x0 [0096.353] lstrlenW (lpString=".dacpac") returned 7 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".dacpac") returned 0x0 [0096.353] lstrlenW (lpString=".db3") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".db3") returned 0x0 [0096.353] lstrlenW (lpString=".dtxs") returned 5 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".dtxs") returned 0x0 [0096.353] lstrlenW (lpString=".mdt") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".mdt") returned 0x0 [0096.353] lstrlenW (lpString=".sdf") returned 4 [0096.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".sdf") returned 0x0 [0096.354] lstrlenW (lpString=".MDF") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".MDF") returned 0x0 [0096.354] lstrlenW (lpString=".DBF") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".DBF") returned 0x0 [0096.354] lstrlenW (lpString=".DB") returned 3 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".DB") returned 0x0 [0096.354] lstrlenW (lpString=".db") returned 3 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".db") returned 0x0 [0096.354] lstrlenW (lpString=".ndf") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".ndf") returned 0x0 [0096.354] lstrlenW (lpString=".NDF") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".NDF") returned 0x0 [0096.354] lstrlenW (lpString=".Mdf") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".Mdf") returned 0x0 [0096.354] lstrlenW (lpString=".dat") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".dat") returned 0x0 [0096.354] lstrlenW (lpString=".DAT") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".DAT") returned 0x0 [0096.354] lstrlenW (lpString=".ldf") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".ldf") returned 0x0 [0096.354] lstrlenW (lpString=".LDF") returned 4 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch=".LDF") returned 0x0 [0096.354] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.355] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6ed0) returned 1 [0096.355] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.355] CryptReleaseContext (hProv=0x27e6ed0, dwFlags=0x0) returned 1 [0096.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.355] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21635661497) returned 1 [0096.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc83e5790, dwHighDateTime=0x1d585b4)) [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e17e8 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e17e8 | out: hHeap=0x260000) returned 1 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.356] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.356] GetLastError () returned 0x0 [0096.357] GetLastError () returned 0x0 [0096.357] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.357] GetLastError () returned 0x0 [0096.357] GetLastError () returned 0x0 [0096.369] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.369] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0096.373] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.373] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.445] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.445] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.445] CloseHandle (hObject=0xe4) returned 1 [0096.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4758 [0096.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4758 | out: hHeap=0x260000) returned 1 [0096.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.471] GetLastError () returned 0x0 [0096.471] RtlWakeConditionVariable () returned 0x0 [0096.471] GetCurrentThreadId () returned 0x99c [0096.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".ldf") returned 0x0 [0096.472] lstrlenW (lpString=".vhd") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".vhd") returned 0x0 [0096.472] lstrlenW (lpString=".vhdx") returned 5 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".vhdx") returned 0x0 [0096.472] lstrlenW (lpString=".pst") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".pst") returned 0x0 [0096.472] lstrlenW (lpString=".ost") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".ost") returned 0x0 [0096.472] lstrlenW (lpString=".bak") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".bak") returned 0x0 [0096.472] lstrlenW (lpString=".bac") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".bac") returned 0x0 [0096.472] lstrlenW (lpString=".sys") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".sys") returned 0x0 [0096.472] lstrlenW (lpString=".v2i") returned 4 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".v2i") returned 0x0 [0096.472] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch="s\r\n.v2i") returned 0x0 [0096.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.473] lstrlenW (lpString=".sql") returned 4 [0096.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".sql") returned 0x0 [0096.473] lstrlenW (lpString=".mdf") returned 4 [0096.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".mdf") returned 0x0 [0096.474] lstrlenW (lpString=".txt") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".txt") returned 0x0 [0096.474] lstrlenW (lpString=".dbf") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".dbf") returned 0x0 [0096.474] lstrlenW (lpString=".ckp") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".ckp") returned 0x0 [0096.474] lstrlenW (lpString=".dacpac") returned 7 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".dacpac") returned 0x0 [0096.474] lstrlenW (lpString=".db3") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".db3") returned 0x0 [0096.474] lstrlenW (lpString=".dtxs") returned 5 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".dtxs") returned 0x0 [0096.474] lstrlenW (lpString=".mdt") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".mdt") returned 0x0 [0096.474] lstrlenW (lpString=".sdf") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".sdf") returned 0x0 [0096.474] lstrlenW (lpString=".MDF") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".MDF") returned 0x0 [0096.474] lstrlenW (lpString=".DBF") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".DBF") returned 0x0 [0096.474] lstrlenW (lpString=".DB") returned 3 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".DB") returned 0x0 [0096.474] lstrlenW (lpString=".db") returned 3 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".db") returned 0x0 [0096.474] lstrlenW (lpString=".ndf") returned 4 [0096.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".ndf") returned 0x0 [0096.475] lstrlenW (lpString=".NDF") returned 4 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".NDF") returned 0x0 [0096.475] lstrlenW (lpString=".Mdf") returned 4 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".Mdf") returned 0x0 [0096.475] lstrlenW (lpString=".dat") returned 4 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".dat") returned 0x0 [0096.475] lstrlenW (lpString=".DAT") returned 4 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".DAT") returned 0x0 [0096.475] lstrlenW (lpString=".ldf") returned 4 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".ldf") returned 0x0 [0096.475] lstrlenW (lpString=".LDF") returned 4 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch=".LDF") returned 0x0 [0096.475] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.475] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6f58) returned 1 [0096.476] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.476] CryptReleaseContext (hProv=0x27e6f58, dwFlags=0x0) returned 1 [0096.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.476] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21647723560) returned 1 [0096.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc8516290, dwHighDateTime=0x1d585b4)) [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e19a8 [0096.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e19a8 | out: hHeap=0x260000) returned 1 [0096.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.477] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.477] GetLastError () returned 0x0 [0096.477] GetLastError () returned 0x0 [0096.477] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.477] GetLastError () returned 0x0 [0096.478] GetLastError () returned 0x0 [0096.480] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffeca6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.480] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13594, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x13594, lpOverlapped=0x0) returned 1 [0096.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.480] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.480] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.480] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.481] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.481] CloseHandle (hObject=0xe4) returned 1 [0096.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.[deadmin@cock.li].deadmin")) returned 1 [0096.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.482] GetLastError () returned 0x0 [0096.482] RtlWakeConditionVariable () returned 0x0 [0096.482] GetCurrentThreadId () returned 0x99c [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".ldf") returned 0x0 [0096.483] lstrlenW (lpString=".vhd") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".vhd") returned 0x0 [0096.483] lstrlenW (lpString=".vhdx") returned 5 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".vhdx") returned 0x0 [0096.483] lstrlenW (lpString=".pst") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".pst") returned 0x0 [0096.483] lstrlenW (lpString=".ost") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".ost") returned 0x0 [0096.483] lstrlenW (lpString=".bak") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".bak") returned 0x0 [0096.483] lstrlenW (lpString=".bac") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".bac") returned 0x0 [0096.483] lstrlenW (lpString=".sys") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".sys") returned 0x0 [0096.483] lstrlenW (lpString=".v2i") returned 4 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".v2i") returned 0x0 [0096.483] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.484] lstrlenW (lpString=".sql") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".sql") returned 0x0 [0096.485] lstrlenW (lpString=".mdf") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".mdf") returned 0x0 [0096.485] lstrlenW (lpString=".txt") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".txt") returned 0x0 [0096.485] lstrlenW (lpString=".dbf") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".dbf") returned 0x0 [0096.485] lstrlenW (lpString=".ckp") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".ckp") returned 0x0 [0096.485] lstrlenW (lpString=".dacpac") returned 7 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".dacpac") returned 0x0 [0096.485] lstrlenW (lpString=".db3") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".db3") returned 0x0 [0096.485] lstrlenW (lpString=".dtxs") returned 5 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".dtxs") returned 0x0 [0096.485] lstrlenW (lpString=".mdt") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".mdt") returned 0x0 [0096.485] lstrlenW (lpString=".sdf") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".sdf") returned 0x0 [0096.485] lstrlenW (lpString=".MDF") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".MDF") returned 0x0 [0096.485] lstrlenW (lpString=".DBF") returned 4 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".DBF") returned 0x0 [0096.485] lstrlenW (lpString=".DB") returned 3 [0096.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".DB") returned 0x0 [0096.485] lstrlenW (lpString=".db") returned 3 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".db") returned 0x0 [0096.486] lstrlenW (lpString=".ndf") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".ndf") returned 0x0 [0096.486] lstrlenW (lpString=".NDF") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".NDF") returned 0x0 [0096.486] lstrlenW (lpString=".Mdf") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".Mdf") returned 0x0 [0096.486] lstrlenW (lpString=".dat") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".dat") returned 0x0 [0096.486] lstrlenW (lpString=".DAT") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".DAT") returned 0x0 [0096.486] lstrlenW (lpString=".ldf") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".ldf") returned 0x0 [0096.486] lstrlenW (lpString=".LDF") returned 4 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch=".LDF") returned 0x0 [0096.486] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.486] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2768280) returned 1 [0096.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.487] CryptReleaseContext (hProv=0x2768280, dwFlags=0x0) returned 1 [0096.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.487] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21648837437) returned 1 [0096.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc853c3f0, dwHighDateTime=0x1d585b4)) [0096.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0096.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e19e0 [0096.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e19e0 | out: hHeap=0x260000) returned 1 [0096.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.488] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.488] GetLastError () returned 0x0 [0096.488] GetLastError () returned 0x0 [0096.488] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.488] GetLastError () returned 0x0 [0096.489] GetLastError () returned 0x0 [0096.491] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.492] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.493] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.493] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.494] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.494] CloseHandle (hObject=0xe4) returned 1 [0096.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.496] GetLastError () returned 0x0 [0096.496] RtlWakeConditionVariable () returned 0x0 [0096.496] GetCurrentThreadId () returned 0x99c [0096.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".ldf") returned 0x0 [0096.496] lstrlenW (lpString=".vhd") returned 4 [0096.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".vhd") returned 0x0 [0096.496] lstrlenW (lpString=".vhdx") returned 5 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".vhdx") returned 0x0 [0096.497] lstrlenW (lpString=".pst") returned 4 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".pst") returned 0x0 [0096.497] lstrlenW (lpString=".ost") returned 4 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".ost") returned 0x0 [0096.497] lstrlenW (lpString=".bak") returned 4 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".bak") returned 0x0 [0096.497] lstrlenW (lpString=".bac") returned 4 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".bac") returned 0x0 [0096.497] lstrlenW (lpString=".sys") returned 4 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".sys") returned 0x0 [0096.497] lstrlenW (lpString=".v2i") returned 4 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".v2i") returned 0x0 [0096.497] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.499] lstrlenW (lpString=".sql") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".sql") returned 0x0 [0096.499] lstrlenW (lpString=".mdf") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".mdf") returned 0x0 [0096.499] lstrlenW (lpString=".txt") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".txt") returned 0x0 [0096.499] lstrlenW (lpString=".dbf") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".dbf") returned 0x0 [0096.499] lstrlenW (lpString=".ckp") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".ckp") returned 0x0 [0096.499] lstrlenW (lpString=".dacpac") returned 7 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".dacpac") returned 0x0 [0096.499] lstrlenW (lpString=".db3") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".db3") returned 0x0 [0096.499] lstrlenW (lpString=".dtxs") returned 5 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".dtxs") returned 0x0 [0096.499] lstrlenW (lpString=".mdt") returned 4 [0096.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".mdt") returned 0x0 [0096.499] lstrlenW (lpString=".sdf") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".sdf") returned 0x0 [0096.500] lstrlenW (lpString=".MDF") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".MDF") returned 0x0 [0096.500] lstrlenW (lpString=".DBF") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".DBF") returned 0x0 [0096.500] lstrlenW (lpString=".DB") returned 3 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".DB") returned 0x0 [0096.500] lstrlenW (lpString=".db") returned 3 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".db") returned 0x0 [0096.500] lstrlenW (lpString=".ndf") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".ndf") returned 0x0 [0096.500] lstrlenW (lpString=".NDF") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".NDF") returned 0x0 [0096.500] lstrlenW (lpString=".Mdf") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".Mdf") returned 0x0 [0096.500] lstrlenW (lpString=".dat") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".dat") returned 0x0 [0096.500] lstrlenW (lpString=".DAT") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".DAT") returned 0x0 [0096.500] lstrlenW (lpString=".ldf") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".ldf") returned 0x0 [0096.500] lstrlenW (lpString=".LDF") returned 4 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch=".LDF") returned 0x0 [0096.500] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.501] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2768170) returned 1 [0096.521] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.521] CryptReleaseContext (hProv=0x2768170, dwFlags=0x0) returned 1 [0096.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.521] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21652187886) returned 1 [0096.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc85886b0, dwHighDateTime=0x1d585b4)) [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1970 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1970 | out: hHeap=0x260000) returned 1 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.522] GetLastError () returned 0x0 [0096.522] GetLastError () returned 0x0 [0096.522] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.522] GetLastError () returned 0x0 [0096.523] GetLastError () returned 0x0 [0096.526] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.526] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.527] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.527] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.530] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.530] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.531] CloseHandle (hObject=0xe4) returned 1 [0096.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0096.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0096.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.533] GetLastError () returned 0x0 [0096.533] RtlWakeConditionVariable () returned 0x0 [0096.533] GetCurrentThreadId () returned 0x99c [0096.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".ldf") returned 0x0 [0096.533] lstrlenW (lpString=".vhd") returned 4 [0096.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".vhd") returned 0x0 [0096.533] lstrlenW (lpString=".vhdx") returned 5 [0096.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".vhdx") returned 0x0 [0096.533] lstrlenW (lpString=".pst") returned 4 [0096.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".pst") returned 0x0 [0096.533] lstrlenW (lpString=".ost") returned 4 [0096.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".ost") returned 0x0 [0096.533] lstrlenW (lpString=".bak") returned 4 [0096.533] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".bak") returned 0x0 [0096.534] lstrlenW (lpString=".bac") returned 4 [0096.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".bac") returned 0x0 [0096.534] lstrlenW (lpString=".sys") returned 4 [0096.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".sys") returned 0x0 [0096.534] lstrlenW (lpString=".v2i") returned 4 [0096.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".v2i") returned 0x0 [0096.534] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.534] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.535] lstrlenW (lpString=".sql") returned 4 [0096.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".sql") returned 0x0 [0096.535] lstrlenW (lpString=".mdf") returned 4 [0096.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".mdf") returned 0x0 [0096.535] lstrlenW (lpString=".txt") returned 4 [0096.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".txt") returned 0x0 [0096.535] lstrlenW (lpString=".dbf") returned 4 [0096.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".dbf") returned 0x0 [0096.535] lstrlenW (lpString=".ckp") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".ckp") returned 0x0 [0096.536] lstrlenW (lpString=".dacpac") returned 7 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".dacpac") returned 0x0 [0096.536] lstrlenW (lpString=".db3") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".db3") returned 0x0 [0096.536] lstrlenW (lpString=".dtxs") returned 5 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".dtxs") returned 0x0 [0096.536] lstrlenW (lpString=".mdt") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".mdt") returned 0x0 [0096.536] lstrlenW (lpString=".sdf") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".sdf") returned 0x0 [0096.536] lstrlenW (lpString=".MDF") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".MDF") returned 0x0 [0096.536] lstrlenW (lpString=".DBF") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".DBF") returned 0x0 [0096.536] lstrlenW (lpString=".DB") returned 3 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".DB") returned 0x0 [0096.536] lstrlenW (lpString=".db") returned 3 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".db") returned 0x0 [0096.536] lstrlenW (lpString=".ndf") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".ndf") returned 0x0 [0096.536] lstrlenW (lpString=".NDF") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".NDF") returned 0x0 [0096.536] lstrlenW (lpString=".Mdf") returned 4 [0096.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".Mdf") returned 0x0 [0096.536] lstrlenW (lpString=".dat") returned 4 [0096.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".dat") returned 0x0 [0096.537] lstrlenW (lpString=".DAT") returned 4 [0096.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".DAT") returned 0x0 [0096.537] lstrlenW (lpString=".ldf") returned 4 [0096.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".ldf") returned 0x0 [0096.537] lstrlenW (lpString=".LDF") returned 4 [0096.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch=".LDF") returned 0x0 [0096.537] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.537] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2768418) returned 1 [0096.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.538] CryptReleaseContext (hProv=0x2768418, dwFlags=0x0) returned 1 [0096.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.538] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21653907933) returned 1 [0096.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc85ae810, dwHighDateTime=0x1d585b4)) [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1a88 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1a88 | out: hHeap=0x260000) returned 1 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.539] GetLastError () returned 0x0 [0096.539] GetLastError () returned 0x0 [0096.539] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.539] GetLastError () returned 0x0 [0096.539] GetLastError () returned 0x0 [0096.546] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.546] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.547] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.547] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.549] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.549] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.549] CloseHandle (hObject=0xe4) returned 1 [0096.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0096.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0096.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.551] GetLastError () returned 0x0 [0096.552] RtlWakeConditionVariable () returned 0x0 [0096.552] GetCurrentThreadId () returned 0x99c [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".ldf") returned 0x0 [0096.552] lstrlenW (lpString=".vhd") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".vhd") returned 0x0 [0096.552] lstrlenW (lpString=".vhdx") returned 5 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".vhdx") returned 0x0 [0096.552] lstrlenW (lpString=".pst") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".pst") returned 0x0 [0096.552] lstrlenW (lpString=".ost") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".ost") returned 0x0 [0096.552] lstrlenW (lpString=".bak") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".bak") returned 0x0 [0096.552] lstrlenW (lpString=".bac") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".bac") returned 0x0 [0096.552] lstrlenW (lpString=".sys") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".sys") returned 0x0 [0096.552] lstrlenW (lpString=".v2i") returned 4 [0096.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".v2i") returned 0x0 [0096.552] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.553] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.555] lstrlenW (lpString=".sql") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".sql") returned 0x0 [0096.555] lstrlenW (lpString=".mdf") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".mdf") returned 0x0 [0096.555] lstrlenW (lpString=".txt") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".txt") returned 0x0 [0096.555] lstrlenW (lpString=".dbf") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".dbf") returned 0x0 [0096.555] lstrlenW (lpString=".ckp") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".ckp") returned 0x0 [0096.555] lstrlenW (lpString=".dacpac") returned 7 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".dacpac") returned 0x0 [0096.555] lstrlenW (lpString=".db3") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".db3") returned 0x0 [0096.555] lstrlenW (lpString=".dtxs") returned 5 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".dtxs") returned 0x0 [0096.555] lstrlenW (lpString=".mdt") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".mdt") returned 0x0 [0096.555] lstrlenW (lpString=".sdf") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".sdf") returned 0x0 [0096.555] lstrlenW (lpString=".MDF") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".MDF") returned 0x0 [0096.555] lstrlenW (lpString=".DBF") returned 4 [0096.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".DBF") returned 0x0 [0096.555] lstrlenW (lpString=".DB") returned 3 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".DB") returned 0x0 [0096.556] lstrlenW (lpString=".db") returned 3 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".db") returned 0x0 [0096.556] lstrlenW (lpString=".ndf") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".ndf") returned 0x0 [0096.556] lstrlenW (lpString=".NDF") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".NDF") returned 0x0 [0096.556] lstrlenW (lpString=".Mdf") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".Mdf") returned 0x0 [0096.556] lstrlenW (lpString=".dat") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".dat") returned 0x0 [0096.556] lstrlenW (lpString=".DAT") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".DAT") returned 0x0 [0096.556] lstrlenW (lpString=".ldf") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".ldf") returned 0x0 [0096.556] lstrlenW (lpString=".LDF") returned 4 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch=".LDF") returned 0x0 [0096.556] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.556] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27684a0) returned 1 [0096.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.557] CryptReleaseContext (hProv=0x27684a0, dwFlags=0x0) returned 1 [0096.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.557] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21655848357) returned 1 [0096.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc85d4970, dwHighDateTime=0x1d585b4)) [0096.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1ac0 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1ac0 | out: hHeap=0x260000) returned 1 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.558] GetLastError () returned 0x0 [0096.558] GetLastError () returned 0x0 [0096.558] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.559] GetLastError () returned 0x0 [0096.559] GetLastError () returned 0x0 [0096.562] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.562] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.563] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.563] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.565] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.565] CloseHandle (hObject=0xe4) returned 1 [0096.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0096.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0096.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.567] GetLastError () returned 0x0 [0096.567] RtlWakeConditionVariable () returned 0x0 [0096.567] GetCurrentThreadId () returned 0x99c [0096.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".ldf") returned 0x0 [0096.567] lstrlenW (lpString=".vhd") returned 4 [0096.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".vhd") returned 0x0 [0096.567] lstrlenW (lpString=".vhdx") returned 5 [0096.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".vhdx") returned 0x0 [0096.568] lstrlenW (lpString=".pst") returned 4 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".pst") returned 0x0 [0096.568] lstrlenW (lpString=".ost") returned 4 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".ost") returned 0x0 [0096.568] lstrlenW (lpString=".bak") returned 4 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".bak") returned 0x0 [0096.568] lstrlenW (lpString=".bac") returned 4 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".bac") returned 0x0 [0096.568] lstrlenW (lpString=".sys") returned 4 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".sys") returned 0x0 [0096.568] lstrlenW (lpString=".v2i") returned 4 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".v2i") returned 0x0 [0096.568] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.569] lstrlenW (lpString=".sql") returned 4 [0096.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".sql") returned 0x0 [0096.569] lstrlenW (lpString=".mdf") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".mdf") returned 0x0 [0096.570] lstrlenW (lpString=".txt") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".txt") returned 0x0 [0096.570] lstrlenW (lpString=".dbf") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".dbf") returned 0x0 [0096.570] lstrlenW (lpString=".ckp") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".ckp") returned 0x0 [0096.570] lstrlenW (lpString=".dacpac") returned 7 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".dacpac") returned 0x0 [0096.570] lstrlenW (lpString=".db3") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".db3") returned 0x0 [0096.570] lstrlenW (lpString=".dtxs") returned 5 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".dtxs") returned 0x0 [0096.570] lstrlenW (lpString=".mdt") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".mdt") returned 0x0 [0096.570] lstrlenW (lpString=".sdf") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".sdf") returned 0x0 [0096.570] lstrlenW (lpString=".MDF") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".MDF") returned 0x0 [0096.570] lstrlenW (lpString=".DBF") returned 4 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".DBF") returned 0x0 [0096.570] lstrlenW (lpString=".DB") returned 3 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".DB") returned 0x0 [0096.570] lstrlenW (lpString=".db") returned 3 [0096.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".db") returned 0x0 [0096.570] lstrlenW (lpString=".ndf") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".ndf") returned 0x0 [0096.571] lstrlenW (lpString=".NDF") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".NDF") returned 0x0 [0096.571] lstrlenW (lpString=".Mdf") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".Mdf") returned 0x0 [0096.571] lstrlenW (lpString=".dat") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".dat") returned 0x0 [0096.571] lstrlenW (lpString=".DAT") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".DAT") returned 0x0 [0096.571] lstrlenW (lpString=".ldf") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".ldf") returned 0x0 [0096.571] lstrlenW (lpString=".LDF") returned 4 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch=".LDF") returned 0x0 [0096.571] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.571] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27e6a08) returned 1 [0096.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.572] CryptReleaseContext (hProv=0x27e6a08, dwFlags=0x0) returned 1 [0096.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.572] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21657327550) returned 1 [0096.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc85faad0, dwHighDateTime=0x1d585b4)) [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1af8 [0096.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1af8 | out: hHeap=0x260000) returned 1 [0096.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d540 [0096.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.573] GetLastError () returned 0x0 [0096.573] GetLastError () returned 0x0 [0096.573] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.573] GetLastError () returned 0x0 [0096.574] GetLastError () returned 0x0 [0096.576] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.576] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.578] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.578] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.581] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.581] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.581] CloseHandle (hObject=0xe4) returned 1 [0096.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27dc4c8 [0096.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc4c8 | out: hHeap=0x260000) returned 1 [0096.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.583] GetLastError () returned 0x0 [0096.583] RtlWakeConditionVariable () returned 0x0 [0096.583] GetCurrentThreadId () returned 0x99c [0096.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".ldf") returned 0x0 [0096.584] lstrlenW (lpString=".vhd") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".vhd") returned 0x0 [0096.584] lstrlenW (lpString=".vhdx") returned 5 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".vhdx") returned 0x0 [0096.584] lstrlenW (lpString=".pst") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".pst") returned 0x0 [0096.584] lstrlenW (lpString=".ost") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".ost") returned 0x0 [0096.584] lstrlenW (lpString=".bak") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".bak") returned 0x0 [0096.584] lstrlenW (lpString=".bac") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".bac") returned 0x0 [0096.584] lstrlenW (lpString=".sys") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".sys") returned 0x0 [0096.584] lstrlenW (lpString=".v2i") returned 4 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".v2i") returned 0x0 [0096.584] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.585] lstrlenW (lpString=".sql") returned 4 [0096.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".sql") returned 0x0 [0096.586] lstrlenW (lpString=".mdf") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".mdf") returned 0x0 [0096.586] lstrlenW (lpString=".txt") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".txt") returned 0x0 [0096.586] lstrlenW (lpString=".dbf") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".dbf") returned 0x0 [0096.586] lstrlenW (lpString=".ckp") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".ckp") returned 0x0 [0096.586] lstrlenW (lpString=".dacpac") returned 7 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".dacpac") returned 0x0 [0096.586] lstrlenW (lpString=".db3") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".db3") returned 0x0 [0096.586] lstrlenW (lpString=".dtxs") returned 5 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".dtxs") returned 0x0 [0096.586] lstrlenW (lpString=".mdt") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".mdt") returned 0x0 [0096.586] lstrlenW (lpString=".sdf") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".sdf") returned 0x0 [0096.586] lstrlenW (lpString=".MDF") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".MDF") returned 0x0 [0096.586] lstrlenW (lpString=".DBF") returned 4 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".DBF") returned 0x0 [0096.586] lstrlenW (lpString=".DB") returned 3 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".DB") returned 0x0 [0096.586] lstrlenW (lpString=".db") returned 3 [0096.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".db") returned 0x0 [0096.586] lstrlenW (lpString=".ndf") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".ndf") returned 0x0 [0096.587] lstrlenW (lpString=".NDF") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".NDF") returned 0x0 [0096.587] lstrlenW (lpString=".Mdf") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".Mdf") returned 0x0 [0096.587] lstrlenW (lpString=".dat") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".dat") returned 0x0 [0096.587] lstrlenW (lpString=".DAT") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".DAT") returned 0x0 [0096.587] lstrlenW (lpString=".ldf") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".ldf") returned 0x0 [0096.587] lstrlenW (lpString=".LDF") returned 4 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch=".LDF") returned 0x0 [0096.587] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.587] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x2768528) returned 1 [0096.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.588] CryptReleaseContext (hProv=0x2768528, dwFlags=0x0) returned 1 [0096.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.588] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21658932140) returned 1 [0096.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc8620c30, dwHighDateTime=0x1d585b4)) [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1b30 [0096.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1b30 | out: hHeap=0x260000) returned 1 [0096.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.589] GetLastError () returned 0x0 [0096.589] GetLastError () returned 0x0 [0096.589] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.589] GetLastError () returned 0x0 [0096.590] GetLastError () returned 0x0 [0096.593] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.593] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x238fdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.594] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.594] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x238fdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.596] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x238fdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x238fdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.596] CloseHandle (hObject=0xe4) returned 1 [0096.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0096.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0096.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0096.597] GetLastError () returned 0x0 [0096.598] RtlWakeConditionVariable () returned 0x0 [0096.598] GetCurrentThreadId () returned 0x99c [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".ldf") returned 0x0 [0096.598] lstrlenW (lpString=".vhd") returned 4 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".vhd") returned 0x0 [0096.598] lstrlenW (lpString=".vhdx") returned 5 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".vhdx") returned 0x0 [0096.598] lstrlenW (lpString=".pst") returned 4 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".pst") returned 0x0 [0096.598] lstrlenW (lpString=".ost") returned 4 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".ost") returned 0x0 [0096.598] lstrlenW (lpString=".bak") returned 4 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".bak") returned 0x0 [0096.598] lstrlenW (lpString=".bac") returned 4 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".bac") returned 0x0 [0096.598] lstrlenW (lpString=".sys") returned 4 [0096.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".sys") returned 0x0 [0096.599] lstrlenW (lpString=".v2i") returned 4 [0096.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".v2i") returned 0x0 [0096.599] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch="s\r\n.v2i") returned 0x0 [0096.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.600] lstrlenW (lpString=".sql") returned 4 [0096.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".sql") returned 0x0 [0096.600] lstrlenW (lpString=".mdf") returned 4 [0096.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".mdf") returned 0x0 [0096.600] lstrlenW (lpString=".txt") returned 4 [0096.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".txt") returned 0x0 [0096.600] lstrlenW (lpString=".dbf") returned 4 [0096.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".dbf") returned 0x0 [0096.600] lstrlenW (lpString=".ckp") returned 4 [0096.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".ckp") returned 0x0 [0096.600] lstrlenW (lpString=".dacpac") returned 7 [0096.600] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".dacpac") returned 0x0 [0096.600] lstrlenW (lpString=".db3") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".db3") returned 0x0 [0096.601] lstrlenW (lpString=".dtxs") returned 5 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".dtxs") returned 0x0 [0096.601] lstrlenW (lpString=".mdt") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".mdt") returned 0x0 [0096.601] lstrlenW (lpString=".sdf") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".sdf") returned 0x0 [0096.601] lstrlenW (lpString=".MDF") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".MDF") returned 0x0 [0096.601] lstrlenW (lpString=".DBF") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".DBF") returned 0x0 [0096.601] lstrlenW (lpString=".DB") returned 3 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".DB") returned 0x0 [0096.601] lstrlenW (lpString=".db") returned 3 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".db") returned 0x0 [0096.601] lstrlenW (lpString=".ndf") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".ndf") returned 0x0 [0096.601] lstrlenW (lpString=".NDF") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".NDF") returned 0x0 [0096.601] lstrlenW (lpString=".Mdf") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".Mdf") returned 0x0 [0096.601] lstrlenW (lpString=".dat") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".dat") returned 0x0 [0096.601] lstrlenW (lpString=".DAT") returned 4 [0096.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".DAT") returned 0x0 [0096.601] lstrlenW (lpString=".ldf") returned 4 [0096.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".ldf") returned 0x0 [0096.602] lstrlenW (lpString=".LDF") returned 4 [0096.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch=".LDF") returned 0x0 [0096.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0096.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0096.602] CryptAcquireContextA (in: phProv=0x238fb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x238fb80*=0x27685b0) returned 1 [0096.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0096.603] CryptReleaseContext (hProv=0x27685b0, dwFlags=0x0) returned 1 [0096.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0096.603] QueryPerformanceCounter (in: lpPerformanceCount=0x238fb10 | out: lpPerformanceCount=0x238fb10*=21660392888) returned 1 [0096.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x238fb50 | out: lpSystemTimeAsFileTime=0x238fb50*(dwLowDateTime=0xc8646d90, dwHighDateTime=0x1d585b4)) [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1b68 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1b68 | out: hHeap=0x260000) returned 1 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x238f9f0) [0096.604] GetLastError () returned 0x0 [0096.604] GetLastError () returned 0x0 [0096.604] RtlUnwind (TargetFrame=0x238fae8, TargetIp=0x42ae4e, ExceptionRecord=0x238f4b4, ReturnValue=0x0) [0096.604] GetLastError () returned 0x0 [0096.604] GetLastError () returned 0x0 Thread: id = 8 os_tid = 0x9ac [0029.737] GetLastError () returned 0x57 [0029.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x364) returned 0x280de0 [0029.738] SetLastError (dwErrCode=0x57) [0029.738] GetCurrentThreadId () returned 0x9ac [0029.738] GetCurrentThreadId () returned 0x9ac [0029.738] RtlWakeConditionVariable () returned 0x1 [0029.745] GetCurrentThreadId () returned 0x9ac [0029.745] GetCurrentThreadId () returned 0x9ac [0029.745] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.774] GetCurrentThreadId () returned 0x9ac [0029.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3d98 [0029.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0029.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a15d0 | out: hHeap=0x260000) returned 1 [0029.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0029.774] lstrlenW (lpString=".ldf") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".ldf") returned 0x0 [0029.774] lstrlenW (lpString=".vhd") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".vhd") returned 0x0 [0029.774] lstrlenW (lpString=".vhdx") returned 5 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".vhdx") returned 0x0 [0029.774] lstrlenW (lpString=".pst") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".pst") returned 0x0 [0029.774] lstrlenW (lpString=".ost") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".ost") returned 0x0 [0029.774] lstrlenW (lpString=".bak") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".bak") returned 0x0 [0029.774] lstrlenW (lpString=".bac") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".bac") returned 0x0 [0029.774] lstrlenW (lpString=".sys") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".sys") returned 0x0 [0029.774] lstrlenW (lpString=".v2i") returned 4 [0029.774] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch=".v2i") returned 0x0 [0029.775] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.775] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\..", lpSrch="s\r\n.v2i") returned 0x0 [0029.775] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.." (normalized: "c:\\$recycle.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0029.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3d98 | out: hHeap=0x260000) returned 1 [0029.775] RtlWakeConditionVariable () returned 0x27e828 [0029.775] GetCurrentThreadId () returned 0x9ac [0029.775] GetCurrentThreadId () returned 0x9ac [0029.775] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.824] GetCurrentThreadId () returned 0x9ac [0029.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efe8 [0029.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0029.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0029.825] lstrlenW (lpString=".ldf") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".ldf") returned 0x0 [0029.825] lstrlenW (lpString=".vhd") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".vhd") returned 0x0 [0029.825] lstrlenW (lpString=".vhdx") returned 5 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".vhdx") returned 0x0 [0029.825] lstrlenW (lpString=".pst") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".pst") returned 0x0 [0029.825] lstrlenW (lpString=".ost") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".ost") returned 0x0 [0029.825] lstrlenW (lpString=".bak") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".bak") returned 0x0 [0029.825] lstrlenW (lpString=".bac") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".bac") returned 0x0 [0029.825] lstrlenW (lpString=".sys") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".sys") returned 0x0 [0029.825] lstrlenW (lpString=".v2i") returned 4 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch=".v2i") returned 0x0 [0029.825] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.825] StrStrW (lpFirst="\\\\?\\C:\\Boot\\.", lpSrch="s\r\n.v2i") returned 0x0 [0029.825] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\." (normalized: "c:\\boot\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0029.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efe8 | out: hHeap=0x260000) returned 1 [0029.825] RtlWakeConditionVariable () returned 0x27e828 [0029.826] GetCurrentThreadId () returned 0x9ac [0029.826] GetCurrentThreadId () returned 0x9ac [0029.826] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.833] GetCurrentThreadId () returned 0x9ac [0029.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0029.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0029.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0029.833] lstrlenW (lpString=".ldf") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".ldf") returned 0x0 [0029.833] lstrlenW (lpString=".vhd") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".vhd") returned 0x0 [0029.833] lstrlenW (lpString=".vhdx") returned 5 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".vhdx") returned 0x0 [0029.833] lstrlenW (lpString=".pst") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".pst") returned 0x0 [0029.833] lstrlenW (lpString=".ost") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".ost") returned 0x0 [0029.833] lstrlenW (lpString=".bak") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".bak") returned 0x0 [0029.833] lstrlenW (lpString=".bac") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".bac") returned 0x0 [0029.833] lstrlenW (lpString=".sys") returned 4 [0029.833] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".sys") returned 0x0 [0029.833] lstrlenW (lpString=".v2i") returned 4 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".v2i") returned 0x0 [0029.834] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch="s\r\n.v2i") returned 0x0 [0029.834] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.834] lstrlenW (lpString=".sql") returned 4 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".sql") returned 0x0 [0029.834] lstrlenW (lpString=".mdf") returned 4 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".mdf") returned 0x0 [0029.834] lstrlenW (lpString=".txt") returned 4 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".txt") returned 0x0 [0029.834] lstrlenW (lpString=".dbf") returned 4 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".dbf") returned 0x0 [0029.834] lstrlenW (lpString=".ckp") returned 4 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".ckp") returned 0x0 [0029.834] lstrlenW (lpString=".dacpac") returned 7 [0029.834] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".dacpac") returned 0x0 [0029.834] lstrlenW (lpString=".db3") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".db3") returned 0x0 [0029.835] lstrlenW (lpString=".dtxs") returned 5 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".dtxs") returned 0x0 [0029.835] lstrlenW (lpString=".mdt") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".mdt") returned 0x0 [0029.835] lstrlenW (lpString=".sdf") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".sdf") returned 0x0 [0029.835] lstrlenW (lpString=".MDF") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".MDF") returned 0x0 [0029.835] lstrlenW (lpString=".DBF") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".DBF") returned 0x0 [0029.835] lstrlenW (lpString=".DB") returned 3 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".DB") returned 0x0 [0029.835] lstrlenW (lpString=".db") returned 3 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".db") returned 0x0 [0029.835] lstrlenW (lpString=".ndf") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".ndf") returned 0x0 [0029.835] lstrlenW (lpString=".NDF") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".NDF") returned 0x0 [0029.835] lstrlenW (lpString=".Mdf") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".Mdf") returned 0x0 [0029.835] lstrlenW (lpString=".dat") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".dat") returned 0x0 [0029.835] lstrlenW (lpString=".DAT") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".DAT") returned 0x0 [0029.835] lstrlenW (lpString=".ldf") returned 4 [0029.835] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".ldf") returned 0x0 [0029.835] lstrlenW (lpString=".LDF") returned 4 [0029.836] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch=".LDF") returned 0x0 [0029.836] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0029.836] StrStrW (lpFirst="\\\\?\\C:\\Boot\\BCD.LOG1", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0029.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0029.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0029.836] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e0c0) returned 1 [0029.837] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0029.837] CryptReleaseContext (hProv=0x27e0c0, dwFlags=0x0) returned 1 [0029.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x292580 [0029.837] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=14983821312) returned 1 [0029.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa25591b0, dwHighDateTime=0x1d585b4)) [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e0c0 [0029.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b2d90 [0029.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27e0c0 [0029.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b2d90 [0029.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.838] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0029.838] GetLastError () returned 0x0 [0029.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x27a170 [0029.838] SetLastError (dwErrCode=0x0) [0029.838] GetLastError () returned 0x0 [0029.838] SetLastError (dwErrCode=0x0) [0029.838] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.839] SetLastError (dwErrCode=0x0) [0029.839] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] GetLastError () returned 0x0 [0029.840] SetLastError (dwErrCode=0x0) [0029.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0029.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2b4238 [0029.840] ReadFile (in: hFile=0xec, lpBuffer=0x2b4238, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesRead=0x24cfdb0*=0x0, lpOverlapped=0x0) returned 1 [0029.840] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.840] WriteFile (in: hFile=0xec, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x0, lpOverlapped=0x0) returned 1 [0029.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.841] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.841] WriteFile (in: hFile=0xec, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0029.842] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0029.842] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0029.842] CloseHandle (hObject=0xec) returned 1 [0029.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0c0 [0029.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG1.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\boot\\bcd.log1.[deadmin@cock.li].deadmin")) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0029.844] GetLastError () returned 0x0 [0029.844] SetLastError (dwErrCode=0x0) [0029.844] GetLastError () returned 0x0 [0029.844] SetLastError (dwErrCode=0x0) [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792e8 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2792c8 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a28 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x292580 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0029.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0029.844] RtlWakeConditionVariable () returned 0x27e828 [0029.844] GetCurrentThreadId () returned 0x9ac [0029.845] GetCurrentThreadId () returned 0x9ac [0029.845] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.877] GetCurrentThreadId () returned 0x9ac [0029.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.877] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\cs-cz\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.877] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.877] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.877] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.877] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.879] CloseHandle (hObject=0xec) returned 1 [0029.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.879] RtlWakeConditionVariable () returned 0x27e828 [0029.879] GetCurrentThreadId () returned 0x9ac [0029.879] GetCurrentThreadId () returned 0x9ac [0029.879] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.893] GetCurrentThreadId () returned 0x9ac [0029.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0029.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.893] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\de-de\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0029.893] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.893] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0029.893] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0029.893] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0029.895] CloseHandle (hObject=0xec) returned 1 [0029.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0029.895] RtlWakeConditionVariable () returned 0x27e828 [0029.895] GetCurrentThreadId () returned 0x9ac [0029.895] GetCurrentThreadId () returned 0x9ac [0029.895] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.906] GetCurrentThreadId () returned 0x9ac [0029.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.906] lstrlenW (lpString=".ldf") returned 4 [0029.906] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".ldf") returned 0x0 [0029.906] lstrlenW (lpString=".vhd") returned 4 [0029.906] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".vhd") returned 0x0 [0029.906] lstrlenW (lpString=".vhdx") returned 5 [0029.906] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.906] lstrlenW (lpString=".pst") returned 4 [0029.906] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".pst") returned 0x0 [0029.906] lstrlenW (lpString=".ost") returned 4 [0029.907] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".ost") returned 0x0 [0029.907] lstrlenW (lpString=".bak") returned 4 [0029.907] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".bak") returned 0x0 [0029.907] lstrlenW (lpString=".bac") returned 4 [0029.907] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".bac") returned 0x0 [0029.907] lstrlenW (lpString=".sys") returned 4 [0029.907] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".sys") returned 0x0 [0029.907] lstrlenW (lpString=".v2i") returned 4 [0029.907] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch=".v2i") returned 0x0 [0029.907] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.907] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.907] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.907] RtlWakeConditionVariable () returned 0x27e828 [0029.907] GetCurrentThreadId () returned 0x9ac [0029.907] GetCurrentThreadId () returned 0x9ac [0029.907] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0029.990] GetCurrentThreadId () returned 0x9ac [0029.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0029.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.991] lstrlenW (lpString=".ldf") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0029.991] lstrlenW (lpString=".vhd") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0029.991] lstrlenW (lpString=".vhdx") returned 5 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0029.991] lstrlenW (lpString=".pst") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0029.991] lstrlenW (lpString=".ost") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0029.991] lstrlenW (lpString=".bak") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0029.991] lstrlenW (lpString=".bac") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0029.991] lstrlenW (lpString=".sys") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0029.991] lstrlenW (lpString=".v2i") returned 4 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0029.991] lstrlenW (lpString="s\r\n.v2i") returned 7 [0029.991] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0029.991] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0029.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0029.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0029.992] RtlWakeConditionVariable () returned 0x27e828 [0029.992] GetCurrentThreadId () returned 0x9ac [0029.992] GetCurrentThreadId () returned 0x9ac [0029.992] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.004] GetCurrentThreadId () returned 0x9ac [0030.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.004] lstrlenW (lpString=".ldf") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".ldf") returned 0x0 [0030.004] lstrlenW (lpString=".vhd") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".vhd") returned 0x0 [0030.004] lstrlenW (lpString=".vhdx") returned 5 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".vhdx") returned 0x0 [0030.004] lstrlenW (lpString=".pst") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".pst") returned 0x0 [0030.004] lstrlenW (lpString=".ost") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".ost") returned 0x0 [0030.004] lstrlenW (lpString=".bak") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".bak") returned 0x0 [0030.004] lstrlenW (lpString=".bac") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".bac") returned 0x0 [0030.004] lstrlenW (lpString=".sys") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".sys") returned 0x0 [0030.004] lstrlenW (lpString=".v2i") returned 4 [0030.004] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch=".v2i") returned 0x0 [0030.005] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.005] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf", lpSrch="s\r\n.v2i") returned 0x0 [0030.005] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0030.005] RtlWakeConditionVariable () returned 0x27e828 [0030.005] GetCurrentThreadId () returned 0x9ac [0030.005] GetCurrentThreadId () returned 0x9ac [0030.005] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.065] GetCurrentThreadId () returned 0x9ac [0030.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.066] lstrlenW (lpString=".ldf") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.066] lstrlenW (lpString=".vhd") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.066] lstrlenW (lpString=".vhdx") returned 5 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.066] lstrlenW (lpString=".pst") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.066] lstrlenW (lpString=".ost") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.066] lstrlenW (lpString=".bak") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.066] lstrlenW (lpString=".bac") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.066] lstrlenW (lpString=".sys") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.066] lstrlenW (lpString=".v2i") returned 4 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.066] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.066] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.066] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.066] RtlWakeConditionVariable () returned 0x27e828 [0030.066] GetCurrentThreadId () returned 0x9ac [0030.066] GetCurrentThreadId () returned 0x9ac [0030.066] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.078] GetCurrentThreadId () returned 0x9ac [0030.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.078] lstrlenW (lpString=".ldf") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.078] lstrlenW (lpString=".vhd") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.078] lstrlenW (lpString=".vhdx") returned 5 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.078] lstrlenW (lpString=".pst") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.078] lstrlenW (lpString=".ost") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.078] lstrlenW (lpString=".bak") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.078] lstrlenW (lpString=".bac") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.078] lstrlenW (lpString=".sys") returned 4 [0030.078] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.079] lstrlenW (lpString=".v2i") returned 4 [0030.079] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.079] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.079] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.079] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.079] RtlWakeConditionVariable () returned 0x27e828 [0030.079] GetCurrentThreadId () returned 0x9ac [0030.079] GetCurrentThreadId () returned 0x9ac [0030.079] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.099] GetCurrentThreadId () returned 0x9ac [0030.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d120 [0030.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.099] lstrlenW (lpString=".ldf") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".ldf") returned 0x0 [0030.099] lstrlenW (lpString=".vhd") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".vhd") returned 0x0 [0030.099] lstrlenW (lpString=".vhdx") returned 5 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".vhdx") returned 0x0 [0030.099] lstrlenW (lpString=".pst") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".pst") returned 0x0 [0030.099] lstrlenW (lpString=".ost") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".ost") returned 0x0 [0030.099] lstrlenW (lpString=".bak") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".bak") returned 0x0 [0030.099] lstrlenW (lpString=".bac") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".bac") returned 0x0 [0030.099] lstrlenW (lpString=".sys") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".sys") returned 0x0 [0030.099] lstrlenW (lpString=".v2i") returned 4 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch=".v2i") returned 0x0 [0030.099] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.099] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0030.099] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0c8 | out: hHeap=0x260000) returned 1 [0030.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d120 | out: hHeap=0x260000) returned 1 [0030.100] RtlWakeConditionVariable () returned 0x27e828 [0030.100] GetCurrentThreadId () returned 0x9ac [0030.100] GetCurrentThreadId () returned 0x9ac [0030.100] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.107] GetCurrentThreadId () returned 0x9ac [0030.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.107] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\nb-no\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.107] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.107] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.108] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.108] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.109] CloseHandle (hObject=0xec) returned 1 [0030.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.109] RtlWakeConditionVariable () returned 0x27e828 [0030.109] GetCurrentThreadId () returned 0x9ac [0030.109] GetCurrentThreadId () returned 0x9ac [0030.109] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.120] GetCurrentThreadId () returned 0x9ac [0030.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.120] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\pl-pl\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.120] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.120] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.120] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.120] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.121] CloseHandle (hObject=0xec) returned 1 [0030.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.121] RtlWakeConditionVariable () returned 0x27e828 [0030.121] GetCurrentThreadId () returned 0x9ac [0030.121] GetCurrentThreadId () returned 0x9ac [0030.121] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.130] GetCurrentThreadId () returned 0x9ac [0030.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.130] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\pt-pt\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.130] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.130] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.130] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.130] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.131] CloseHandle (hObject=0xec) returned 1 [0030.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.131] RtlWakeConditionVariable () returned 0x27e828 [0030.131] GetCurrentThreadId () returned 0x9ac [0030.131] GetCurrentThreadId () returned 0x9ac [0030.131] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.141] GetCurrentThreadId () returned 0x9ac [0030.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.142] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\sv-se\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.142] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.142] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.142] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.142] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.143] CloseHandle (hObject=0xec) returned 1 [0030.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.143] RtlWakeConditionVariable () returned 0x27e828 [0030.143] GetCurrentThreadId () returned 0x9ac [0030.143] GetCurrentThreadId () returned 0x9ac [0030.143] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.153] GetCurrentThreadId () returned 0x9ac [0030.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.153] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\zh-cn\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.153] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.153] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.153] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.153] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.154] CloseHandle (hObject=0xec) returned 1 [0030.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.154] RtlWakeConditionVariable () returned 0x27e828 [0030.154] GetCurrentThreadId () returned 0x9ac [0030.154] GetCurrentThreadId () returned 0x9ac [0030.154] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.162] GetCurrentThreadId () returned 0x9ac [0030.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d0d8 [0030.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.162] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\boot\\zh-tw\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0030.163] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.163] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.163] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.163] WriteFile (in: hFile=0xec, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.164] CloseHandle (hObject=0xec) returned 1 [0030.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0d8 | out: hHeap=0x260000) returned 1 [0030.164] RtlWakeConditionVariable () returned 0x27e828 [0030.164] GetCurrentThreadId () returned 0x9ac [0030.164] GetCurrentThreadId () returned 0x9ac [0030.164] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.172] GetCurrentThreadId () returned 0x9ac [0030.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.172] lstrlenW (lpString=".ldf") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".ldf") returned 0x0 [0030.172] lstrlenW (lpString=".vhd") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".vhd") returned 0x0 [0030.172] lstrlenW (lpString=".vhdx") returned 5 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".vhdx") returned 0x0 [0030.172] lstrlenW (lpString=".pst") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".pst") returned 0x0 [0030.172] lstrlenW (lpString=".ost") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".ost") returned 0x0 [0030.172] lstrlenW (lpString=".bak") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".bak") returned 0x0 [0030.172] lstrlenW (lpString=".bac") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".bac") returned 0x0 [0030.172] lstrlenW (lpString=".sys") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".sys") returned 0x0 [0030.172] lstrlenW (lpString=".v2i") returned 4 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch=".v2i") returned 0x0 [0030.172] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.172] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi\\.", lpSrch="s\r\n.v2i") returned 0x0 [0030.172] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\." (normalized: "c:\\config.msi\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.172] RtlWakeConditionVariable () returned 0x27e828 [0030.172] GetCurrentThreadId () returned 0x9ac [0030.172] GetCurrentThreadId () returned 0x9ac [0030.172] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.180] GetCurrentThreadId () returned 0x9ac [0030.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1678 | out: hHeap=0x260000) returned 1 [0030.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.180] lstrlenW (lpString=".ldf") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".ldf") returned 0x0 [0030.180] lstrlenW (lpString=".vhd") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".vhd") returned 0x0 [0030.180] lstrlenW (lpString=".vhdx") returned 5 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".vhdx") returned 0x0 [0030.180] lstrlenW (lpString=".pst") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".pst") returned 0x0 [0030.180] lstrlenW (lpString=".ost") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".ost") returned 0x0 [0030.180] lstrlenW (lpString=".bak") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".bak") returned 0x0 [0030.180] lstrlenW (lpString=".bac") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".bac") returned 0x0 [0030.180] lstrlenW (lpString=".sys") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".sys") returned 0x0 [0030.180] lstrlenW (lpString=".v2i") returned 4 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch=".v2i") returned 0x0 [0030.180] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\.", lpSrch="s\r\n.v2i") returned 0x0 [0030.180] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\." (normalized: "c:\\msocache\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1608 | out: hHeap=0x260000) returned 1 [0030.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1598 | out: hHeap=0x260000) returned 1 [0030.180] RtlWakeConditionVariable () returned 0x27e828 [0030.180] GetCurrentThreadId () returned 0x9ac [0030.180] GetCurrentThreadId () returned 0x9ac [0030.180] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.195] GetCurrentThreadId () returned 0x9ac [0030.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b2d90 [0030.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.195] lstrlenW (lpString=".ldf") returned 4 [0030.195] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0030.196] lstrlenW (lpString=".vhd") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0030.196] lstrlenW (lpString=".vhdx") returned 5 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0030.196] lstrlenW (lpString=".pst") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0030.196] lstrlenW (lpString=".ost") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0030.196] lstrlenW (lpString=".bak") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0030.196] lstrlenW (lpString=".bac") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0030.196] lstrlenW (lpString=".sys") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0030.196] lstrlenW (lpString=".v2i") returned 4 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0030.196] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.196] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0030.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0030.196] RtlWakeConditionVariable () returned 0x27e828 [0030.196] GetCurrentThreadId () returned 0x9ac [0030.196] GetCurrentThreadId () returned 0x9ac [0030.196] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.283] GetCurrentThreadId () returned 0x9ac [0030.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3ca0 [0030.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3bf8 [0030.283] lstrlenW (lpString=".ldf") returned 4 [0030.283] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".ldf") returned 0x0 [0030.283] lstrlenW (lpString=".vhd") returned 4 [0030.283] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".vhd") returned 0x0 [0030.283] lstrlenW (lpString=".vhdx") returned 5 [0030.283] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".vhdx") returned 0x0 [0030.283] lstrlenW (lpString=".pst") returned 4 [0030.283] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".pst") returned 0x0 [0030.283] lstrlenW (lpString=".ost") returned 4 [0030.283] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".ost") returned 0x0 [0030.283] lstrlenW (lpString=".bak") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".bak") returned 0x0 [0030.284] lstrlenW (lpString=".bac") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".bac") returned 0x0 [0030.284] lstrlenW (lpString=".sys") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".sys") returned 0x0 [0030.284] lstrlenW (lpString=".v2i") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".v2i") returned 0x0 [0030.284] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0030.284] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.284] lstrlenW (lpString=".sql") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".sql") returned 0x0 [0030.284] lstrlenW (lpString=".mdf") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".mdf") returned 0x0 [0030.284] lstrlenW (lpString=".txt") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".txt") returned 0x0 [0030.284] lstrlenW (lpString=".dbf") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".dbf") returned 0x0 [0030.284] lstrlenW (lpString=".ckp") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".ckp") returned 0x0 [0030.284] lstrlenW (lpString=".dacpac") returned 7 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".dacpac") returned 0x0 [0030.284] lstrlenW (lpString=".db3") returned 4 [0030.284] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".db3") returned 0x0 [0030.285] lstrlenW (lpString=".dtxs") returned 5 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".dtxs") returned 0x0 [0030.285] lstrlenW (lpString=".mdt") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".mdt") returned 0x0 [0030.285] lstrlenW (lpString=".sdf") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".sdf") returned 0x0 [0030.285] lstrlenW (lpString=".MDF") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".MDF") returned 0x0 [0030.285] lstrlenW (lpString=".DBF") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".DBF") returned 0x0 [0030.285] lstrlenW (lpString=".DB") returned 3 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".DB") returned 0x0 [0030.285] lstrlenW (lpString=".db") returned 3 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".db") returned 0x0 [0030.285] lstrlenW (lpString=".ndf") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".ndf") returned 0x0 [0030.285] lstrlenW (lpString=".NDF") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".NDF") returned 0x0 [0030.285] lstrlenW (lpString=".Mdf") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".Mdf") returned 0x0 [0030.285] lstrlenW (lpString=".dat") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".dat") returned 0x0 [0030.285] lstrlenW (lpString=".DAT") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".DAT") returned 0x0 [0030.285] lstrlenW (lpString=".ldf") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".ldf") returned 0x0 [0030.285] lstrlenW (lpString=".LDF") returned 4 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch=".LDF") returned 0x0 [0030.285] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.285] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0030.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.285] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d118) returned 1 [0030.286] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.286] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0030.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0030.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x293798 [0030.286] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15028757543) returned 1 [0030.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa29a9990, dwHighDateTime=0x1d585b4)) [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d118 [0030.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3f48 [0030.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3fc0 [0030.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f48 | out: hHeap=0x260000) returned 1 [0030.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0030.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fc0 | out: hHeap=0x260000) returned 1 [0030.287] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0030.287] GetLastError () returned 0x0 [0030.287] SetLastError (dwErrCode=0x0) [0030.287] GetLastError () returned 0x0 [0030.287] SetLastError (dwErrCode=0x0) [0030.287] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0030.287] GetLastError () returned 0x0 [0030.287] SetLastError (dwErrCode=0x0) [0030.287] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.288] SetLastError (dwErrCode=0x0) [0030.288] GetLastError () returned 0x0 [0030.289] SetLastError (dwErrCode=0x0) [0030.289] GetLastError () returned 0x0 [0030.289] SetLastError (dwErrCode=0x0) [0030.289] GetLastError () returned 0x0 [0030.289] SetLastError (dwErrCode=0x0) [0030.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.289] ReadFile (in: hFile=0xfc, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x24cfdb0*=0x61d, lpOverlapped=0x0) returned 1 [0030.290] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.291] WriteFile (in: hFile=0xfc, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x24cfdb0*=0x61d, lpOverlapped=0x0) returned 1 [0030.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.291] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.291] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.291] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.291] CloseHandle (hObject=0xfc) returned 1 [0030.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3f48 [0030.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3f48 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0030.296] GetLastError () returned 0x0 [0030.296] SetLastError (dwErrCode=0x0) [0030.296] GetLastError () returned 0x0 [0030.296] SetLastError (dwErrCode=0x0) [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293798 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ca0 | out: hHeap=0x260000) returned 1 [0030.296] RtlWakeConditionVariable () returned 0x27e828 [0030.296] GetCurrentThreadId () returned 0x9ac [0030.296] GetCurrentThreadId () returned 0x9ac [0030.296] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.310] GetCurrentThreadId () returned 0x9ac [0030.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3e10 [0030.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3bf8 [0030.310] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0030.310] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.310] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0030.310] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0030.310] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0030.311] CloseHandle (hObject=0xf0) returned 1 [0030.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bf8 | out: hHeap=0x260000) returned 1 [0030.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.311] RtlWakeConditionVariable () returned 0x27e828 [0030.312] GetCurrentThreadId () returned 0x9ac [0030.312] GetCurrentThreadId () returned 0x9ac [0030.312] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.719] GetCurrentThreadId () returned 0x9ac [0030.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3e10 [0030.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.719] lstrlenW (lpString=".ldf") returned 4 [0030.719] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0030.719] lstrlenW (lpString=".vhd") returned 4 [0030.719] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0030.719] lstrlenW (lpString=".vhdx") returned 5 [0030.719] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0030.719] lstrlenW (lpString=".pst") returned 4 [0030.719] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0030.719] lstrlenW (lpString=".ost") returned 4 [0030.719] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0030.719] lstrlenW (lpString=".bak") returned 4 [0030.719] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0030.719] lstrlenW (lpString=".bac") returned 4 [0030.720] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0030.720] lstrlenW (lpString=".sys") returned 4 [0030.720] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0030.720] lstrlenW (lpString=".v2i") returned 4 [0030.720] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0030.720] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.720] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0030.720] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0030.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d108 | out: hHeap=0x260000) returned 1 [0030.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0030.720] RtlWakeConditionVariable () returned 0x27e828 [0030.720] GetCurrentThreadId () returned 0x9ac [0030.720] GetCurrentThreadId () returned 0x9ac [0030.720] SleepConditionVariableSRW (in: ConditionVariable=0x27e800, SRWLock=0x27e884, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x27e800, SRWLock=0x27e884) returned 1 [0030.802] GetCurrentThreadId () returned 0x9ac [0030.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3970 [0030.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0030.802] lstrlenW (lpString=".ldf") returned 4 [0030.802] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".ldf") returned 0x0 [0030.802] lstrlenW (lpString=".vhd") returned 4 [0030.802] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".vhd") returned 0x0 [0030.802] lstrlenW (lpString=".vhdx") returned 5 [0030.802] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".vhdx") returned 0x0 [0030.802] lstrlenW (lpString=".pst") returned 4 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".pst") returned 0x0 [0030.803] lstrlenW (lpString=".ost") returned 4 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".ost") returned 0x0 [0030.803] lstrlenW (lpString=".bak") returned 4 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".bak") returned 0x0 [0030.803] lstrlenW (lpString=".bac") returned 4 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".bac") returned 0x0 [0030.803] lstrlenW (lpString=".sys") returned 4 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".sys") returned 0x0 [0030.803] lstrlenW (lpString=".v2i") returned 4 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".v2i") returned 0x0 [0030.803] lstrlenW (lpString="s\r\n.v2i") returned 7 [0030.803] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0030.803] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.804] lstrlenW (lpString=".sql") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".sql") returned 0x0 [0030.804] lstrlenW (lpString=".mdf") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".mdf") returned 0x0 [0030.804] lstrlenW (lpString=".txt") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".txt") returned 0x0 [0030.804] lstrlenW (lpString=".dbf") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".dbf") returned 0x0 [0030.804] lstrlenW (lpString=".ckp") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".ckp") returned 0x0 [0030.804] lstrlenW (lpString=".dacpac") returned 7 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".dacpac") returned 0x0 [0030.804] lstrlenW (lpString=".db3") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".db3") returned 0x0 [0030.804] lstrlenW (lpString=".dtxs") returned 5 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".dtxs") returned 0x0 [0030.804] lstrlenW (lpString=".mdt") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".mdt") returned 0x0 [0030.804] lstrlenW (lpString=".sdf") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".sdf") returned 0x0 [0030.804] lstrlenW (lpString=".MDF") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".MDF") returned 0x0 [0030.804] lstrlenW (lpString=".DBF") returned 4 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".DBF") returned 0x0 [0030.804] lstrlenW (lpString=".DB") returned 3 [0030.804] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".DB") returned 0x0 [0030.805] lstrlenW (lpString=".db") returned 3 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".db") returned 0x0 [0030.805] lstrlenW (lpString=".ndf") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".ndf") returned 0x0 [0030.805] lstrlenW (lpString=".NDF") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".NDF") returned 0x0 [0030.805] lstrlenW (lpString=".Mdf") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".Mdf") returned 0x0 [0030.805] lstrlenW (lpString=".dat") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".dat") returned 0x0 [0030.805] lstrlenW (lpString=".DAT") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".DAT") returned 0x0 [0030.805] lstrlenW (lpString=".ldf") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".ldf") returned 0x0 [0030.805] lstrlenW (lpString=".LDF") returned 4 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch=".LDF") returned 0x0 [0030.805] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0030.805] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0030.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3a18 [0030.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.805] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d118) returned 1 [0030.806] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0030.806] CryptReleaseContext (hProv=0x27d118, dwFlags=0x0) returned 1 [0030.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x293798 [0030.806] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15080717001) returned 1 [0030.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa2c310f0, dwHighDateTime=0x1d585b4)) [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d118 [0030.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b3b50 [0030.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2b3bc8 [0030.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0030.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0030.806] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3bc8 | out: hHeap=0x260000) returned 1 [0030.806] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.807] SetLastError (dwErrCode=0x0) [0030.807] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] GetLastError () returned 0x0 [0030.808] SetLastError (dwErrCode=0x0) [0030.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0030.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d7470 [0030.809] ReadFile (in: hFile=0xfc, lpBuffer=0x2d7470, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.815] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.815] WriteFile (in: hFile=0xfc, lpBuffer=0x2d7470*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d7470*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0030.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0030.815] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.815] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0030.817] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0030.817] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0030.817] CloseHandle (hObject=0xfc) returned 1 [0032.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0032.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.[deadmin@cock.li].deadmin")) returned 1 [0032.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0032.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0032.135] GetLastError () returned 0x0 [0032.136] SetLastError (dwErrCode=0x0) [0032.136] GetLastError () returned 0x0 [0032.136] SetLastError (dwErrCode=0x0) [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293798 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3a18 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3970 | out: hHeap=0x260000) returned 1 [0032.136] RtlWakeConditionVariable () returned 0x27e828 [0032.136] GetCurrentThreadId () returned 0x9ac [0032.136] GetCurrentThreadId () returned 0x9ac [0032.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5830 | out: hHeap=0x260000) returned 1 [0032.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0032.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29aef8 [0032.137] lstrlenW (lpString=".ldf") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".ldf") returned 0x0 [0032.137] lstrlenW (lpString=".vhd") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".vhd") returned 0x0 [0032.137] lstrlenW (lpString=".vhdx") returned 5 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".vhdx") returned 0x0 [0032.137] lstrlenW (lpString=".pst") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".pst") returned 0x0 [0032.137] lstrlenW (lpString=".ost") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".ost") returned 0x0 [0032.137] lstrlenW (lpString=".bak") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".bak") returned 0x0 [0032.137] lstrlenW (lpString=".bac") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".bac") returned 0x0 [0032.137] lstrlenW (lpString=".sys") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".sys") returned 0x0 [0032.137] lstrlenW (lpString=".v2i") returned 4 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".v2i") returned 0x0 [0032.137] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.137] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0032.137] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0032.270] lstrlenW (lpString=".sql") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".sql") returned 0x0 [0032.270] lstrlenW (lpString=".mdf") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".mdf") returned 0x0 [0032.270] lstrlenW (lpString=".txt") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".txt") returned 0x0 [0032.270] lstrlenW (lpString=".dbf") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".dbf") returned 0x0 [0032.270] lstrlenW (lpString=".ckp") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".ckp") returned 0x0 [0032.270] lstrlenW (lpString=".dacpac") returned 7 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".dacpac") returned 0x0 [0032.270] lstrlenW (lpString=".db3") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".db3") returned 0x0 [0032.270] lstrlenW (lpString=".dtxs") returned 5 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".dtxs") returned 0x0 [0032.270] lstrlenW (lpString=".mdt") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".mdt") returned 0x0 [0032.270] lstrlenW (lpString=".sdf") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".sdf") returned 0x0 [0032.270] lstrlenW (lpString=".MDF") returned 4 [0032.270] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".MDF") returned 0x0 [0032.270] lstrlenW (lpString=".DBF") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".DBF") returned 0x0 [0032.271] lstrlenW (lpString=".DB") returned 3 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".DB") returned 0x0 [0032.271] lstrlenW (lpString=".db") returned 3 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".db") returned 0x0 [0032.271] lstrlenW (lpString=".ndf") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".ndf") returned 0x0 [0032.271] lstrlenW (lpString=".NDF") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".NDF") returned 0x0 [0032.271] lstrlenW (lpString=".Mdf") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".Mdf") returned 0x0 [0032.271] lstrlenW (lpString=".dat") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".dat") returned 0x0 [0032.271] lstrlenW (lpString=".DAT") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".DAT") returned 0x0 [0032.271] lstrlenW (lpString=".ldf") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".ldf") returned 0x0 [0032.271] lstrlenW (lpString=".LDF") returned 4 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch=".LDF") returned 0x0 [0032.271] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d53c0 [0032.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.271] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d54f8) returned 1 [0032.272] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.272] CryptReleaseContext (hProv=0x2d54f8, dwFlags=0x0) returned 1 [0032.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d7470 [0032.272] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15227331794) returned 1 [0032.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa36e73f0, dwHighDateTime=0x1d585b4)) [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1530 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27e130 [0032.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0032.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e130 | out: hHeap=0x260000) returned 1 [0032.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d0d0 [0032.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.273] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0032.273] GetLastError () returned 0x0 [0032.273] SetLastError (dwErrCode=0x0) [0032.273] GetLastError () returned 0x0 [0032.273] SetLastError (dwErrCode=0x0) [0032.273] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0032.273] GetLastError () returned 0x0 [0032.273] SetLastError (dwErrCode=0x0) [0032.273] GetLastError () returned 0x0 [0032.273] SetLastError (dwErrCode=0x0) [0032.273] GetLastError () returned 0x0 [0032.273] SetLastError (dwErrCode=0x0) [0032.273] GetLastError () returned 0x0 [0032.273] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.274] GetLastError () returned 0x0 [0032.274] SetLastError (dwErrCode=0x0) [0032.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2965f8 | out: hHeap=0x260000) returned 1 [0032.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x2d8688 [0032.275] ReadFile (in: hFile=0xf0, lpBuffer=0x2d8688, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d8688*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.277] WriteFile (in: hFile=0xf0, lpBuffer=0x2d8688*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2d8688*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8688 | out: hHeap=0x260000) returned 1 [0032.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.278] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.279] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.279] CloseHandle (hObject=0xf0) returned 1 [0032.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d5a48 [0032.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.[deadmin@cock.li].deadmin")) returned 1 [0032.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5a48 | out: hHeap=0x260000) returned 1 [0032.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0032.483] GetLastError () returned 0x0 [0032.483] SetLastError (dwErrCode=0x0) [0032.483] GetLastError () returned 0x0 [0032.483] SetLastError (dwErrCode=0x0) [0032.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0032.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29aef8 | out: hHeap=0x260000) returned 1 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0032.484] RtlWakeConditionVariable () returned 0x27e828 [0032.484] GetCurrentThreadId () returned 0x9ac [0032.484] GetCurrentThreadId () returned 0x9ac [0032.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5b30 | out: hHeap=0x260000) returned 1 [0032.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0032.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0032.484] lstrlenW (lpString=".ldf") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".ldf") returned 0x0 [0032.484] lstrlenW (lpString=".vhd") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".vhd") returned 0x0 [0032.484] lstrlenW (lpString=".vhdx") returned 5 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".vhdx") returned 0x0 [0032.484] lstrlenW (lpString=".pst") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".pst") returned 0x0 [0032.484] lstrlenW (lpString=".ost") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".ost") returned 0x0 [0032.484] lstrlenW (lpString=".bak") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".bak") returned 0x0 [0032.484] lstrlenW (lpString=".bac") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".bac") returned 0x0 [0032.484] lstrlenW (lpString=".sys") returned 4 [0032.484] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".sys") returned 0x0 [0032.484] lstrlenW (lpString=".v2i") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".v2i") returned 0x0 [0032.485] lstrlenW (lpString="s\r\n.v2i") returned 7 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0032.485] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0032.485] lstrlenW (lpString=".sql") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".sql") returned 0x0 [0032.485] lstrlenW (lpString=".mdf") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".mdf") returned 0x0 [0032.485] lstrlenW (lpString=".txt") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".txt") returned 0x0 [0032.485] lstrlenW (lpString=".dbf") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".dbf") returned 0x0 [0032.485] lstrlenW (lpString=".ckp") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".ckp") returned 0x0 [0032.485] lstrlenW (lpString=".dacpac") returned 7 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".dacpac") returned 0x0 [0032.485] lstrlenW (lpString=".db3") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".db3") returned 0x0 [0032.485] lstrlenW (lpString=".dtxs") returned 5 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".dtxs") returned 0x0 [0032.485] lstrlenW (lpString=".mdt") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".mdt") returned 0x0 [0032.485] lstrlenW (lpString=".sdf") returned 4 [0032.485] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".sdf") returned 0x0 [0032.486] lstrlenW (lpString=".MDF") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".MDF") returned 0x0 [0032.486] lstrlenW (lpString=".DBF") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".DBF") returned 0x0 [0032.486] lstrlenW (lpString=".DB") returned 3 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".DB") returned 0x0 [0032.486] lstrlenW (lpString=".db") returned 3 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".db") returned 0x0 [0032.486] lstrlenW (lpString=".ndf") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".ndf") returned 0x0 [0032.486] lstrlenW (lpString=".NDF") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".NDF") returned 0x0 [0032.486] lstrlenW (lpString=".Mdf") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".Mdf") returned 0x0 [0032.486] lstrlenW (lpString=".dat") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".dat") returned 0x0 [0032.486] lstrlenW (lpString=".DAT") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".DAT") returned 0x0 [0032.486] lstrlenW (lpString=".ldf") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".ldf") returned 0x0 [0032.486] lstrlenW (lpString=".LDF") returned 4 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch=".LDF") returned 0x0 [0032.486] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0032.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0032.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0032.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0032.486] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5a48) returned 1 [0032.487] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0032.487] CryptReleaseContext (hProv=0x2d5a48, dwFlags=0x0) returned 1 [0032.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0032.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0032.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d7458 [0032.487] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15248843132) returned 1 [0032.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa38fc730, dwHighDateTime=0x1d585b4)) [0032.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0032.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0032.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0032.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0032.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2b2ec8 [0032.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0032.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x27d138 [0032.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2ec8 | out: hHeap=0x260000) returned 1 [0032.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dbf8 [0032.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0032.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dbf8 | out: hHeap=0x260000) returned 1 [0032.488] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0032.488] GetLastError () returned 0x0 [0032.488] SetLastError (dwErrCode=0x0) [0032.488] GetLastError () returned 0x0 [0032.488] SetLastError (dwErrCode=0x0) [0032.488] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0032.488] GetLastError () returned 0x0 [0032.488] SetLastError (dwErrCode=0x0) [0032.488] GetLastError () returned 0x0 [0032.488] SetLastError (dwErrCode=0x0) [0032.488] GetLastError () returned 0x0 [0032.488] SetLastError (dwErrCode=0x0) [0032.488] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.489] GetLastError () returned 0x0 [0032.489] SetLastError (dwErrCode=0x0) [0032.490] GetLastError () returned 0x0 [0032.490] SetLastError (dwErrCode=0x0) [0032.490] GetLastError () returned 0x0 [0032.490] SetLastError (dwErrCode=0x0) [0032.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x3028b0 [0032.490] ReadFile (in: hFile=0xf0, lpBuffer=0x3028b0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3028b0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.497] WriteFile (in: hFile=0xf0, lpBuffer=0x3028b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3028b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0032.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3028b0 | out: hHeap=0x260000) returned 1 [0032.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.498] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0032.499] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0032.499] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0032.499] CloseHandle (hObject=0xf0) returned 1 [0034.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0034.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.[deadmin@cock.li].deadmin")) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0034.208] GetLastError () returned 0x0 [0034.208] SetLastError (dwErrCode=0x0) [0034.208] GetLastError () returned 0x0 [0034.208] SetLastError (dwErrCode=0x0) [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7458 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0034.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0034.208] RtlWakeConditionVariable () returned 0x27e828 [0034.209] GetCurrentThreadId () returned 0x9ac [0034.209] GetCurrentThreadId () returned 0x9ac [0034.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0034.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298d80 | out: hHeap=0x260000) returned 1 [0034.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b48 | out: hHeap=0x260000) returned 1 [0034.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ee60 [0034.209] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.538] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0034.538] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0034.538] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0034.538] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0034.586] CloseHandle (hObject=0xf0) returned 1 [0034.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee60 | out: hHeap=0x260000) returned 1 [0034.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0034.586] RtlWakeConditionVariable () returned 0x27e828 [0034.586] GetCurrentThreadId () returned 0x9ac [0034.587] GetCurrentThreadId () returned 0x9ac [0034.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0034.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298ca8 | out: hHeap=0x260000) returned 1 [0034.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0034.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0034.587] lstrlenW (lpString=".ldf") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".ldf") returned 0x0 [0034.587] lstrlenW (lpString=".vhd") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".vhd") returned 0x0 [0034.587] lstrlenW (lpString=".vhdx") returned 5 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".vhdx") returned 0x0 [0034.587] lstrlenW (lpString=".pst") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".pst") returned 0x0 [0034.587] lstrlenW (lpString=".ost") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".ost") returned 0x0 [0034.587] lstrlenW (lpString=".bak") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".bak") returned 0x0 [0034.587] lstrlenW (lpString=".bac") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".bac") returned 0x0 [0034.587] lstrlenW (lpString=".sys") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".sys") returned 0x0 [0034.587] lstrlenW (lpString=".v2i") returned 4 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".v2i") returned 0x0 [0034.587] lstrlenW (lpString="s\r\n.v2i") returned 7 [0034.587] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch="s\r\n.v2i") returned 0x0 [0034.587] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.588] lstrlenW (lpString=".sql") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".sql") returned 0x0 [0034.588] lstrlenW (lpString=".mdf") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".mdf") returned 0x0 [0034.588] lstrlenW (lpString=".txt") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".txt") returned 0x0 [0034.588] lstrlenW (lpString=".dbf") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".dbf") returned 0x0 [0034.588] lstrlenW (lpString=".ckp") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".ckp") returned 0x0 [0034.588] lstrlenW (lpString=".dacpac") returned 7 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".dacpac") returned 0x0 [0034.588] lstrlenW (lpString=".db3") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".db3") returned 0x0 [0034.588] lstrlenW (lpString=".dtxs") returned 5 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".dtxs") returned 0x0 [0034.588] lstrlenW (lpString=".mdt") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".mdt") returned 0x0 [0034.588] lstrlenW (lpString=".sdf") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".sdf") returned 0x0 [0034.588] lstrlenW (lpString=".MDF") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".MDF") returned 0x0 [0034.588] lstrlenW (lpString=".DBF") returned 4 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".DBF") returned 0x0 [0034.588] lstrlenW (lpString=".DB") returned 3 [0034.588] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".DB") returned 0x0 [0034.588] lstrlenW (lpString=".db") returned 3 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".db") returned 0x0 [0034.589] lstrlenW (lpString=".ndf") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".ndf") returned 0x0 [0034.589] lstrlenW (lpString=".NDF") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".NDF") returned 0x0 [0034.589] lstrlenW (lpString=".Mdf") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".Mdf") returned 0x0 [0034.589] lstrlenW (lpString=".dat") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".dat") returned 0x0 [0034.589] lstrlenW (lpString=".DAT") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".DAT") returned 0x0 [0034.589] lstrlenW (lpString=".ldf") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".ldf") returned 0x0 [0034.589] lstrlenW (lpString=".LDF") returned 4 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch=".LDF") returned 0x0 [0034.589] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0034.589] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0034.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0034.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0034.589] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d53c0) returned 1 [0034.590] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0034.590] CryptReleaseContext (hProv=0x2d53c0, dwFlags=0x0) returned 1 [0034.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2ecac0 [0034.590] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15459129516) returned 1 [0034.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa4b95310, dwHighDateTime=0x1d585b4)) [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b80 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d53c0 [0034.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0034.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0034.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0034.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0034.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0034.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0034.591] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0034.591] GetLastError () returned 0x0 [0034.591] SetLastError (dwErrCode=0x0) [0034.591] GetLastError () returned 0x0 [0034.591] SetLastError (dwErrCode=0x0) [0034.591] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0034.591] GetLastError () returned 0x0 [0034.591] SetLastError (dwErrCode=0x0) [0034.591] GetLastError () returned 0x0 [0034.591] SetLastError (dwErrCode=0x0) [0034.591] GetLastError () returned 0x0 [0034.591] SetLastError (dwErrCode=0x0) [0034.591] GetLastError () returned 0x0 [0034.591] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.592] SetLastError (dwErrCode=0x0) [0034.592] GetLastError () returned 0x0 [0034.593] SetLastError (dwErrCode=0x0) [0034.593] GetLastError () returned 0x0 [0034.593] SetLastError (dwErrCode=0x0) [0034.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0034.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x308ad0 [0034.593] ReadFile (in: hFile=0xf0, lpBuffer=0x308ad0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x308ad0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0034.596] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.597] WriteFile (in: hFile=0xf0, lpBuffer=0x308ad0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x308ad0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0034.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x308ad0 | out: hHeap=0x260000) returned 1 [0034.597] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.597] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0034.598] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0034.598] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0034.599] CloseHandle (hObject=0xf0) returned 1 [0036.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.[deadmin@cock.li].deadmin")) returned 1 [0036.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0036.664] GetLastError () returned 0x0 [0036.664] SetLastError (dwErrCode=0x0) [0036.664] GetLastError () returned 0x0 [0036.664] SetLastError (dwErrCode=0x0) [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ecac0 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c768 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0036.664] RtlWakeConditionVariable () returned 0x27e828 [0036.664] GetCurrentThreadId () returned 0x9ac [0036.664] GetCurrentThreadId () returned 0x9ac [0036.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0036.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1060 | out: hHeap=0x260000) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0036.664] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.665] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0036.665] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0036.665] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0036.665] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0036.666] CloseHandle (hObject=0xf0) returned 1 [0036.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da600 | out: hHeap=0x260000) returned 1 [0036.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0036.666] RtlWakeConditionVariable () returned 0x27e828 [0036.666] GetCurrentThreadId () returned 0x9ac [0036.666] GetCurrentThreadId () returned 0x9ac [0036.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296268 | out: hHeap=0x260000) returned 1 [0036.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1098 | out: hHeap=0x260000) returned 1 [0036.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0036.666] lstrlenW (lpString=".ldf") returned 4 [0036.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0036.666] lstrlenW (lpString=".vhd") returned 4 [0036.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0036.666] lstrlenW (lpString=".vhdx") returned 5 [0036.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0036.666] lstrlenW (lpString=".pst") returned 4 [0036.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0036.666] lstrlenW (lpString=".ost") returned 4 [0036.666] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0036.667] lstrlenW (lpString=".bak") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0036.667] lstrlenW (lpString=".bac") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0036.667] lstrlenW (lpString=".sys") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0036.667] lstrlenW (lpString=".v2i") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0036.667] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0036.667] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296268 | out: hHeap=0x260000) returned 1 [0036.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.667] RtlWakeConditionVariable () returned 0x27e828 [0036.667] GetCurrentThreadId () returned 0x9ac [0036.667] GetCurrentThreadId () returned 0x9ac [0036.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296300 | out: hHeap=0x260000) returned 1 [0036.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a10d0 | out: hHeap=0x260000) returned 1 [0036.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296300 [0036.667] lstrlenW (lpString=".ldf") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0036.667] lstrlenW (lpString=".vhd") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0036.667] lstrlenW (lpString=".vhdx") returned 5 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0036.667] lstrlenW (lpString=".pst") returned 4 [0036.667] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0036.667] lstrlenW (lpString=".ost") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0036.668] lstrlenW (lpString=".bak") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0036.668] lstrlenW (lpString=".bac") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0036.668] lstrlenW (lpString=".sys") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0036.668] lstrlenW (lpString=".v2i") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0036.668] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0036.668] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296300 | out: hHeap=0x260000) returned 1 [0036.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.668] RtlWakeConditionVariable () returned 0x27e828 [0036.668] GetCurrentThreadId () returned 0x9ac [0036.668] GetCurrentThreadId () returned 0x9ac [0036.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0036.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b348 | out: hHeap=0x260000) returned 1 [0036.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1108 | out: hHeap=0x260000) returned 1 [0036.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b348 [0036.668] lstrlenW (lpString=".ldf") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".ldf") returned 0x0 [0036.668] lstrlenW (lpString=".vhd") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".vhd") returned 0x0 [0036.668] lstrlenW (lpString=".vhdx") returned 5 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".vhdx") returned 0x0 [0036.668] lstrlenW (lpString=".pst") returned 4 [0036.668] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".pst") returned 0x0 [0036.668] lstrlenW (lpString=".ost") returned 4 [0036.669] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".ost") returned 0x0 [0036.669] lstrlenW (lpString=".bak") returned 4 [0036.669] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".bak") returned 0x0 [0036.669] lstrlenW (lpString=".bac") returned 4 [0036.669] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".bac") returned 0x0 [0036.669] lstrlenW (lpString=".sys") returned 4 [0036.669] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".sys") returned 0x0 [0036.669] lstrlenW (lpString=".v2i") returned 4 [0036.669] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".v2i") returned 0x0 [0036.669] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.669] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0036.669] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.670] lstrlenW (lpString=".sql") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".sql") returned 0x0 [0036.670] lstrlenW (lpString=".mdf") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".mdf") returned 0x0 [0036.670] lstrlenW (lpString=".txt") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".txt") returned 0x0 [0036.670] lstrlenW (lpString=".dbf") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".dbf") returned 0x0 [0036.670] lstrlenW (lpString=".ckp") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".ckp") returned 0x0 [0036.670] lstrlenW (lpString=".dacpac") returned 7 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".dacpac") returned 0x0 [0036.670] lstrlenW (lpString=".db3") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".db3") returned 0x0 [0036.670] lstrlenW (lpString=".dtxs") returned 5 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".dtxs") returned 0x0 [0036.670] lstrlenW (lpString=".mdt") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".mdt") returned 0x0 [0036.670] lstrlenW (lpString=".sdf") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".sdf") returned 0x0 [0036.670] lstrlenW (lpString=".MDF") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".MDF") returned 0x0 [0036.670] lstrlenW (lpString=".DBF") returned 4 [0036.670] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".DBF") returned 0x0 [0036.671] lstrlenW (lpString=".DB") returned 3 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".DB") returned 0x0 [0036.671] lstrlenW (lpString=".db") returned 3 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".db") returned 0x0 [0036.671] lstrlenW (lpString=".ndf") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".ndf") returned 0x0 [0036.671] lstrlenW (lpString=".NDF") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".NDF") returned 0x0 [0036.671] lstrlenW (lpString=".Mdf") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".Mdf") returned 0x0 [0036.671] lstrlenW (lpString=".dat") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".dat") returned 0x0 [0036.671] lstrlenW (lpString=".DAT") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".DAT") returned 0x0 [0036.671] lstrlenW (lpString=".ldf") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".ldf") returned 0x0 [0036.671] lstrlenW (lpString=".LDF") returned 4 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch=".LDF") returned 0x0 [0036.671] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.671] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0036.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.671] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5250) returned 1 [0036.672] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.672] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0036.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2ec8b0 [0036.672] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15667327478) returned 1 [0036.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa5ea0310, dwHighDateTime=0x1d585b4)) [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1108 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1108 | out: hHeap=0x260000) returned 1 [0036.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d568 [0036.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0036.673] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0036.673] GetLastError () returned 0x0 [0036.673] SetLastError (dwErrCode=0x0) [0036.673] GetLastError () returned 0x0 [0036.673] SetLastError (dwErrCode=0x0) [0036.673] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0036.673] GetLastError () returned 0x0 [0036.673] SetLastError (dwErrCode=0x0) [0036.673] GetLastError () returned 0x0 [0036.673] SetLastError (dwErrCode=0x0) [0036.673] GetLastError () returned 0x0 [0036.673] SetLastError (dwErrCode=0x0) [0036.673] GetLastError () returned 0x0 [0036.673] SetLastError (dwErrCode=0x0) [0036.673] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.674] GetLastError () returned 0x0 [0036.674] SetLastError (dwErrCode=0x0) [0036.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0036.675] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.678] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.678] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.678] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.680] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.680] CloseHandle (hObject=0xf0) returned 1 [0036.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.[deadmin@cock.li].deadmin")) returned 1 [0036.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0036.680] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ec8b0 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b348 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0036.681] RtlWakeConditionVariable () returned 0x27e828 [0036.681] GetCurrentThreadId () returned 0x9ac [0036.681] GetCurrentThreadId () returned 0x9ac [0036.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b400 | out: hHeap=0x260000) returned 1 [0036.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0036.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b400 [0036.681] lstrlenW (lpString=".ldf") returned 4 [0036.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".ldf") returned 0x0 [0036.681] lstrlenW (lpString=".vhd") returned 4 [0036.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".vhd") returned 0x0 [0036.681] lstrlenW (lpString=".vhdx") returned 5 [0036.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".vhdx") returned 0x0 [0036.681] lstrlenW (lpString=".pst") returned 4 [0036.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".pst") returned 0x0 [0036.681] lstrlenW (lpString=".ost") returned 4 [0036.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".ost") returned 0x0 [0036.681] lstrlenW (lpString=".bak") returned 4 [0036.681] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".bak") returned 0x0 [0036.681] lstrlenW (lpString=".bac") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".bac") returned 0x0 [0036.682] lstrlenW (lpString=".sys") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".sys") returned 0x0 [0036.682] lstrlenW (lpString=".v2i") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".v2i") returned 0x0 [0036.682] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0036.682] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.682] lstrlenW (lpString=".sql") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".sql") returned 0x0 [0036.682] lstrlenW (lpString=".mdf") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".mdf") returned 0x0 [0036.682] lstrlenW (lpString=".txt") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".txt") returned 0x0 [0036.682] lstrlenW (lpString=".dbf") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".dbf") returned 0x0 [0036.682] lstrlenW (lpString=".ckp") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".ckp") returned 0x0 [0036.682] lstrlenW (lpString=".dacpac") returned 7 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".dacpac") returned 0x0 [0036.682] lstrlenW (lpString=".db3") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".db3") returned 0x0 [0036.682] lstrlenW (lpString=".dtxs") returned 5 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".dtxs") returned 0x0 [0036.682] lstrlenW (lpString=".mdt") returned 4 [0036.682] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".mdt") returned 0x0 [0036.682] lstrlenW (lpString=".sdf") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".sdf") returned 0x0 [0036.683] lstrlenW (lpString=".MDF") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".MDF") returned 0x0 [0036.683] lstrlenW (lpString=".DBF") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".DBF") returned 0x0 [0036.683] lstrlenW (lpString=".DB") returned 3 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".DB") returned 0x0 [0036.683] lstrlenW (lpString=".db") returned 3 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".db") returned 0x0 [0036.683] lstrlenW (lpString=".ndf") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".ndf") returned 0x0 [0036.683] lstrlenW (lpString=".NDF") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".NDF") returned 0x0 [0036.683] lstrlenW (lpString=".Mdf") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".Mdf") returned 0x0 [0036.683] lstrlenW (lpString=".dat") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".dat") returned 0x0 [0036.683] lstrlenW (lpString=".DAT") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".DAT") returned 0x0 [0036.683] lstrlenW (lpString=".ldf") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".ldf") returned 0x0 [0036.683] lstrlenW (lpString=".LDF") returned 4 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch=".LDF") returned 0x0 [0036.683] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.683] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0036.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.683] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5250) returned 1 [0036.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.684] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0036.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2ec8b0 [0036.684] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15668538292) returned 1 [0036.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa5ec6470, dwHighDateTime=0x1d585b4)) [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1140 [0036.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0036.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d568 [0036.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0036.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0036.687] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x646, lpOverlapped=0x0) returned 1 [0036.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.688] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x646, lpOverlapped=0x0) returned 1 [0036.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.688] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.688] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0036.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0036.688] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0036.688] CloseHandle (hObject=0xf0) returned 1 [0036.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0036.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.[deadmin@cock.li].deadmin")) returned 1 [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ec8b0 | out: hHeap=0x260000) returned 1 [0036.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0036.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b400 | out: hHeap=0x260000) returned 1 [0036.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0036.690] RtlWakeConditionVariable () returned 0x27e828 [0036.690] GetCurrentThreadId () returned 0x9ac [0036.690] GetCurrentThreadId () returned 0x9ac [0036.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0036.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d6b8 | out: hHeap=0x260000) returned 1 [0036.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0036.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d6b8 [0036.690] lstrlenW (lpString=".ldf") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".ldf") returned 0x0 [0036.690] lstrlenW (lpString=".vhd") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".vhd") returned 0x0 [0036.690] lstrlenW (lpString=".vhdx") returned 5 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".vhdx") returned 0x0 [0036.690] lstrlenW (lpString=".pst") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".pst") returned 0x0 [0036.690] lstrlenW (lpString=".ost") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".ost") returned 0x0 [0036.690] lstrlenW (lpString=".bak") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".bak") returned 0x0 [0036.690] lstrlenW (lpString=".bac") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".bac") returned 0x0 [0036.690] lstrlenW (lpString=".sys") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".sys") returned 0x0 [0036.690] lstrlenW (lpString=".v2i") returned 4 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".v2i") returned 0x0 [0036.690] lstrlenW (lpString="s\r\n.v2i") returned 7 [0036.690] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0036.690] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.691] lstrlenW (lpString=".sql") returned 4 [0036.691] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".sql") returned 0x0 [0036.691] lstrlenW (lpString=".mdf") returned 4 [0036.691] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".mdf") returned 0x0 [0036.691] lstrlenW (lpString=".txt") returned 4 [0036.691] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".txt") returned 0x0 [0036.691] lstrlenW (lpString=".dbf") returned 4 [0036.691] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".dbf") returned 0x0 [0036.692] lstrlenW (lpString=".ckp") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".ckp") returned 0x0 [0036.692] lstrlenW (lpString=".dacpac") returned 7 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".dacpac") returned 0x0 [0036.692] lstrlenW (lpString=".db3") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".db3") returned 0x0 [0036.692] lstrlenW (lpString=".dtxs") returned 5 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".dtxs") returned 0x0 [0036.692] lstrlenW (lpString=".mdt") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".mdt") returned 0x0 [0036.692] lstrlenW (lpString=".sdf") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".sdf") returned 0x0 [0036.692] lstrlenW (lpString=".MDF") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".MDF") returned 0x0 [0036.692] lstrlenW (lpString=".DBF") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".DBF") returned 0x0 [0036.692] lstrlenW (lpString=".DB") returned 3 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".DB") returned 0x0 [0036.692] lstrlenW (lpString=".db") returned 3 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".db") returned 0x0 [0036.692] lstrlenW (lpString=".ndf") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".ndf") returned 0x0 [0036.692] lstrlenW (lpString=".NDF") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".NDF") returned 0x0 [0036.692] lstrlenW (lpString=".Mdf") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".Mdf") returned 0x0 [0036.692] lstrlenW (lpString=".dat") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".dat") returned 0x0 [0036.692] lstrlenW (lpString=".DAT") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".DAT") returned 0x0 [0036.692] lstrlenW (lpString=".ldf") returned 4 [0036.692] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".ldf") returned 0x0 [0036.692] lstrlenW (lpString=".LDF") returned 4 [0036.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch=".LDF") returned 0x0 [0036.693] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0036.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0036.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0036.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0036.693] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5250) returned 1 [0036.694] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0036.694] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0036.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2ec8b0 [0036.694] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15669484623) returned 1 [0036.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa5eec5d0, dwHighDateTime=0x1d585b4)) [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1178 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x299108 [0036.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0036.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299108 | out: hHeap=0x260000) returned 1 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d418 [0036.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0036.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0036.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0036.694] GetLastError () returned 0x0 [0036.694] SetLastError (dwErrCode=0x0) [0036.694] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.695] GetLastError () returned 0x0 [0036.695] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] GetLastError () returned 0x0 [0036.696] SetLastError (dwErrCode=0x0) [0036.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0036.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0036.696] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.848] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0036.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0036.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.850] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0038.853] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0038.853] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0038.854] CloseHandle (hObject=0xf0) returned 1 [0038.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0038.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.[deadmin@cock.li].deadmin")) returned 1 [0038.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0038.858] GetLastError () returned 0x0 [0038.858] SetLastError (dwErrCode=0x0) [0038.858] GetLastError () returned 0x0 [0038.858] SetLastError (dwErrCode=0x0) [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ec8b0 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d6b8 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0038.858] RtlWakeConditionVariable () returned 0x27e828 [0038.858] GetCurrentThreadId () returned 0x9ac [0038.858] GetCurrentThreadId () returned 0x9ac [0038.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40c8 | out: hHeap=0x260000) returned 1 [0038.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1370 | out: hHeap=0x260000) returned 1 [0038.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0038.858] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.948] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0038.948] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0038.948] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0038.948] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0038.949] CloseHandle (hObject=0x104) returned 1 [0038.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da9e8 | out: hHeap=0x260000) returned 1 [0038.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0038.949] RtlWakeConditionVariable () returned 0x27e828 [0038.949] GetCurrentThreadId () returned 0x9ac [0038.949] GetCurrentThreadId () returned 0x9ac [0038.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2964c8 | out: hHeap=0x260000) returned 1 [0038.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13a8 | out: hHeap=0x260000) returned 1 [0038.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2964c8 [0038.949] lstrlenW (lpString=".ldf") returned 4 [0038.949] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0038.949] lstrlenW (lpString=".vhd") returned 4 [0038.949] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0038.950] lstrlenW (lpString=".vhdx") returned 5 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0038.950] lstrlenW (lpString=".pst") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0038.950] lstrlenW (lpString=".ost") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0038.950] lstrlenW (lpString=".bak") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0038.950] lstrlenW (lpString=".bac") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0038.950] lstrlenW (lpString=".sys") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0038.950] lstrlenW (lpString=".v2i") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0038.950] lstrlenW (lpString="s\r\n.v2i") returned 7 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0038.950] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0038.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2964c8 | out: hHeap=0x260000) returned 1 [0038.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0038.950] RtlWakeConditionVariable () returned 0x27e828 [0038.950] GetCurrentThreadId () returned 0x9ac [0038.950] GetCurrentThreadId () returned 0x9ac [0038.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296560 | out: hHeap=0x260000) returned 1 [0038.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0038.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296560 [0038.950] lstrlenW (lpString=".ldf") returned 4 [0038.950] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0038.951] lstrlenW (lpString=".vhd") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0038.951] lstrlenW (lpString=".vhdx") returned 5 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0038.951] lstrlenW (lpString=".pst") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0038.951] lstrlenW (lpString=".ost") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0038.951] lstrlenW (lpString=".bak") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0038.951] lstrlenW (lpString=".bac") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0038.951] lstrlenW (lpString=".sys") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0038.951] lstrlenW (lpString=".v2i") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0038.951] lstrlenW (lpString="s\r\n.v2i") returned 7 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0038.951] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0038.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296560 | out: hHeap=0x260000) returned 1 [0038.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0038.951] RtlWakeConditionVariable () returned 0x27e828 [0038.951] GetCurrentThreadId () returned 0x9ac [0038.951] GetCurrentThreadId () returned 0x9ac [0038.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0038.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d958 | out: hHeap=0x260000) returned 1 [0038.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0038.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d958 [0038.951] lstrlenW (lpString=".ldf") returned 4 [0038.951] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".ldf") returned 0x0 [0038.952] lstrlenW (lpString=".vhd") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".vhd") returned 0x0 [0038.952] lstrlenW (lpString=".vhdx") returned 5 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".vhdx") returned 0x0 [0038.952] lstrlenW (lpString=".pst") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".pst") returned 0x0 [0038.952] lstrlenW (lpString=".ost") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".ost") returned 0x0 [0038.952] lstrlenW (lpString=".bak") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".bak") returned 0x0 [0038.952] lstrlenW (lpString=".bac") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".bac") returned 0x0 [0038.952] lstrlenW (lpString=".sys") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".sys") returned 0x0 [0038.952] lstrlenW (lpString=".v2i") returned 4 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".v2i") returned 0x0 [0038.952] lstrlenW (lpString="s\r\n.v2i") returned 7 [0038.952] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0038.952] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.954] lstrlenW (lpString=".sql") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".sql") returned 0x0 [0038.954] lstrlenW (lpString=".mdf") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".mdf") returned 0x0 [0038.954] lstrlenW (lpString=".txt") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".txt") returned 0x0 [0038.954] lstrlenW (lpString=".dbf") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".dbf") returned 0x0 [0038.954] lstrlenW (lpString=".ckp") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".ckp") returned 0x0 [0038.954] lstrlenW (lpString=".dacpac") returned 7 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".dacpac") returned 0x0 [0038.954] lstrlenW (lpString=".db3") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".db3") returned 0x0 [0038.954] lstrlenW (lpString=".dtxs") returned 5 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".dtxs") returned 0x0 [0038.954] lstrlenW (lpString=".mdt") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".mdt") returned 0x0 [0038.954] lstrlenW (lpString=".sdf") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".sdf") returned 0x0 [0038.954] lstrlenW (lpString=".MDF") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".MDF") returned 0x0 [0038.954] lstrlenW (lpString=".DBF") returned 4 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".DBF") returned 0x0 [0038.954] lstrlenW (lpString=".DB") returned 3 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".DB") returned 0x0 [0038.954] lstrlenW (lpString=".db") returned 3 [0038.954] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".db") returned 0x0 [0038.954] lstrlenW (lpString=".ndf") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".ndf") returned 0x0 [0038.955] lstrlenW (lpString=".NDF") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".NDF") returned 0x0 [0038.955] lstrlenW (lpString=".Mdf") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".Mdf") returned 0x0 [0038.955] lstrlenW (lpString=".dat") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".dat") returned 0x0 [0038.955] lstrlenW (lpString=".DAT") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".DAT") returned 0x0 [0038.955] lstrlenW (lpString=".ldf") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".ldf") returned 0x0 [0038.955] lstrlenW (lpString=".LDF") returned 4 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch=".LDF") returned 0x0 [0038.955] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0038.955] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0038.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0038.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0038.955] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5250) returned 1 [0038.956] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0038.956] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0038.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0038.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0038.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0038.956] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15895763865) returned 1 [0038.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa62ca990, dwHighDateTime=0x1d585b4)) [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1418 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5250 [0038.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0038.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e570 [0038.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0038.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e570 | out: hHeap=0x260000) returned 1 [0038.957] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0038.957] GetLastError () returned 0x0 [0038.957] SetLastError (dwErrCode=0x0) [0038.957] GetLastError () returned 0x0 [0038.957] SetLastError (dwErrCode=0x0) [0038.957] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.958] GetLastError () returned 0x0 [0038.958] SetLastError (dwErrCode=0x0) [0038.959] GetLastError () returned 0x0 [0038.959] SetLastError (dwErrCode=0x0) [0038.959] GetLastError () returned 0x0 [0038.959] SetLastError (dwErrCode=0x0) [0038.959] GetLastError () returned 0x0 [0038.959] SetLastError (dwErrCode=0x0) [0038.959] GetLastError () returned 0x0 [0038.959] SetLastError (dwErrCode=0x0) [0038.959] GetLastError () returned 0x0 [0038.959] SetLastError (dwErrCode=0x0) [0038.959] GetLastError () returned 0x0 [0038.959] SetLastError (dwErrCode=0x0) [0038.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0038.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0038.959] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0038.963] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0038.963] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0038.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0038.964] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.964] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0038.965] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0038.965] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0038.966] CloseHandle (hObject=0x104) returned 1 [0038.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0038.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.[deadmin@cock.li].deadmin")) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0038.967] GetLastError () returned 0x0 [0038.967] SetLastError (dwErrCode=0x0) [0038.967] GetLastError () returned 0x0 [0038.967] SetLastError (dwErrCode=0x0) [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4108 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d958 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0038.967] RtlWakeConditionVariable () returned 0x27e828 [0038.967] GetCurrentThreadId () returned 0x9ac [0038.967] GetCurrentThreadId () returned 0x9ac [0038.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b628 | out: hHeap=0x260000) returned 1 [0038.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0038.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0038.967] lstrlenW (lpString=".ldf") returned 4 [0038.967] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".ldf") returned 0x0 [0038.967] lstrlenW (lpString=".vhd") returned 4 [0038.967] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".vhd") returned 0x0 [0038.967] lstrlenW (lpString=".vhdx") returned 5 [0038.967] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".vhdx") returned 0x0 [0038.967] lstrlenW (lpString=".pst") returned 4 [0038.967] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".pst") returned 0x0 [0038.967] lstrlenW (lpString=".ost") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".ost") returned 0x0 [0038.968] lstrlenW (lpString=".bak") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".bak") returned 0x0 [0038.968] lstrlenW (lpString=".bac") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".bac") returned 0x0 [0038.968] lstrlenW (lpString=".sys") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".sys") returned 0x0 [0038.968] lstrlenW (lpString=".v2i") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".v2i") returned 0x0 [0038.968] lstrlenW (lpString="s\r\n.v2i") returned 7 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0038.968] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.968] lstrlenW (lpString=".sql") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".sql") returned 0x0 [0038.968] lstrlenW (lpString=".mdf") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".mdf") returned 0x0 [0038.968] lstrlenW (lpString=".txt") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".txt") returned 0x0 [0038.968] lstrlenW (lpString=".dbf") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".dbf") returned 0x0 [0038.968] lstrlenW (lpString=".ckp") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".ckp") returned 0x0 [0038.968] lstrlenW (lpString=".dacpac") returned 7 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".dacpac") returned 0x0 [0038.968] lstrlenW (lpString=".db3") returned 4 [0038.968] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".db3") returned 0x0 [0038.969] lstrlenW (lpString=".dtxs") returned 5 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".dtxs") returned 0x0 [0038.969] lstrlenW (lpString=".mdt") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".mdt") returned 0x0 [0038.969] lstrlenW (lpString=".sdf") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".sdf") returned 0x0 [0038.969] lstrlenW (lpString=".MDF") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".MDF") returned 0x0 [0038.969] lstrlenW (lpString=".DBF") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".DBF") returned 0x0 [0038.969] lstrlenW (lpString=".DB") returned 3 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".DB") returned 0x0 [0038.969] lstrlenW (lpString=".db") returned 3 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".db") returned 0x0 [0038.969] lstrlenW (lpString=".ndf") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".ndf") returned 0x0 [0038.969] lstrlenW (lpString=".NDF") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".NDF") returned 0x0 [0038.969] lstrlenW (lpString=".Mdf") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".Mdf") returned 0x0 [0038.969] lstrlenW (lpString=".dat") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".dat") returned 0x0 [0038.969] lstrlenW (lpString=".DAT") returned 4 [0038.969] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".DAT") returned 0x0 [0038.969] lstrlenW (lpString=".ldf") returned 4 [0038.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".ldf") returned 0x0 [0038.970] lstrlenW (lpString=".LDF") returned 4 [0038.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch=".LDF") returned 0x0 [0038.970] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0038.970] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0038.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0038.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0038.970] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5250) returned 1 [0038.970] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0038.971] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0038.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0038.971] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15897177751) returned 1 [0038.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa62f0af0, dwHighDateTime=0x1d585b4)) [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1450 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5250 [0038.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0038.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d568 [0038.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0038.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0038.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0038.971] GetLastError () returned 0x0 [0038.971] SetLastError (dwErrCode=0x0) [0038.971] GetLastError () returned 0x0 [0038.971] SetLastError (dwErrCode=0x0) [0038.971] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.972] SetLastError (dwErrCode=0x0) [0038.972] GetLastError () returned 0x0 [0038.973] SetLastError (dwErrCode=0x0) [0038.973] GetLastError () returned 0x0 [0038.973] SetLastError (dwErrCode=0x0) [0038.973] GetLastError () returned 0x0 [0038.973] SetLastError (dwErrCode=0x0) [0038.973] GetLastError () returned 0x0 [0038.973] SetLastError (dwErrCode=0x0) [0038.973] GetLastError () returned 0x0 [0038.973] SetLastError (dwErrCode=0x0) [0038.973] GetLastError () returned 0x0 [0038.973] SetLastError (dwErrCode=0x0) [0038.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2fa468 | out: hHeap=0x260000) returned 1 [0038.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x19000) returned 0x31ead8 [0038.973] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0038.976] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0038.976] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0038.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0038.976] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.976] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0038.978] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0038.978] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0038.978] CloseHandle (hObject=0x104) returned 1 [0038.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0038.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.[deadmin@cock.li].deadmin")) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0038.979] GetLastError () returned 0x0 [0038.979] SetLastError (dwErrCode=0x0) [0038.979] GetLastError () returned 0x0 [0038.979] SetLastError (dwErrCode=0x0) [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279368 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279348 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280a48 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4108 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b628 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c768 | out: hHeap=0x260000) returned 1 [0038.979] RtlWakeConditionVariable () returned 0x27e828 [0038.979] GetCurrentThreadId () returned 0x9ac [0038.979] GetCurrentThreadId () returned 0x9ac [0038.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b6e0 | out: hHeap=0x260000) returned 1 [0038.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0038.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b6e0 [0038.979] lstrlenW (lpString=".ldf") returned 4 [0038.979] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".ldf") returned 0x0 [0038.979] lstrlenW (lpString=".vhd") returned 4 [0038.979] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".vhd") returned 0x0 [0038.979] lstrlenW (lpString=".vhdx") returned 5 [0038.979] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".vhdx") returned 0x0 [0038.980] lstrlenW (lpString=".pst") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".pst") returned 0x0 [0038.980] lstrlenW (lpString=".ost") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".ost") returned 0x0 [0038.980] lstrlenW (lpString=".bak") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".bak") returned 0x0 [0038.980] lstrlenW (lpString=".bac") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".bac") returned 0x0 [0038.980] lstrlenW (lpString=".sys") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".sys") returned 0x0 [0038.980] lstrlenW (lpString=".v2i") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".v2i") returned 0x0 [0038.980] lstrlenW (lpString="s\r\n.v2i") returned 7 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0038.980] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.980] lstrlenW (lpString=".sql") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".sql") returned 0x0 [0038.980] lstrlenW (lpString=".mdf") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".mdf") returned 0x0 [0038.980] lstrlenW (lpString=".txt") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".txt") returned 0x0 [0038.980] lstrlenW (lpString=".dbf") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".dbf") returned 0x0 [0038.980] lstrlenW (lpString=".ckp") returned 4 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".ckp") returned 0x0 [0038.980] lstrlenW (lpString=".dacpac") returned 7 [0038.980] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".dacpac") returned 0x0 [0038.981] lstrlenW (lpString=".db3") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".db3") returned 0x0 [0038.981] lstrlenW (lpString=".dtxs") returned 5 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".dtxs") returned 0x0 [0038.981] lstrlenW (lpString=".mdt") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".mdt") returned 0x0 [0038.981] lstrlenW (lpString=".sdf") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".sdf") returned 0x0 [0038.981] lstrlenW (lpString=".MDF") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".MDF") returned 0x0 [0038.981] lstrlenW (lpString=".DBF") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".DBF") returned 0x0 [0038.981] lstrlenW (lpString=".DB") returned 3 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".DB") returned 0x0 [0038.981] lstrlenW (lpString=".db") returned 3 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".db") returned 0x0 [0038.981] lstrlenW (lpString=".ndf") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".ndf") returned 0x0 [0038.981] lstrlenW (lpString=".NDF") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".NDF") returned 0x0 [0038.981] lstrlenW (lpString=".Mdf") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".Mdf") returned 0x0 [0038.981] lstrlenW (lpString=".dat") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".dat") returned 0x0 [0038.981] lstrlenW (lpString=".DAT") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".DAT") returned 0x0 [0038.981] lstrlenW (lpString=".ldf") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".ldf") returned 0x0 [0038.981] lstrlenW (lpString=".LDF") returned 4 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch=".LDF") returned 0x0 [0038.981] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0038.981] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0038.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0038.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0038.982] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d5250) returned 1 [0038.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0038.982] CryptReleaseContext (hProv=0x2d5250, dwFlags=0x0) returned 1 [0038.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0038.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0038.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0038.982] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15898358881) returned 1 [0038.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa62f0af0, dwHighDateTime=0x1d585b4)) [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5250 [0038.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0038.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5250 | out: hHeap=0x260000) returned 1 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e420 [0038.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0038.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2fa468 [0038.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e420 | out: hHeap=0x260000) returned 1 [0038.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0038.983] GetLastError () returned 0x0 [0038.983] SetLastError (dwErrCode=0x0) [0038.983] GetLastError () returned 0x0 [0038.983] SetLastError (dwErrCode=0x0) [0038.983] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0038.983] GetLastError () returned 0x0 [0038.983] SetLastError (dwErrCode=0x0) [0038.983] GetLastError () returned 0x0 [0038.983] SetLastError (dwErrCode=0x0) [0038.984] GetLastError () returned 0x0 [0038.984] SetLastError (dwErrCode=0x0) [0038.984] GetLastError () returned 0x0 [0038.984] SetLastError (dwErrCode=0x0) [0038.984] GetLastError () returned 0x0 [0038.984] SetLastError (dwErrCode=0x0) [0038.984] GetLastError () returned 0x0 [0038.984] ReadFile (in: hFile=0x104, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x391, lpOverlapped=0x0) returned 1 [0039.267] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffc6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.267] WriteFile (in: hFile=0x104, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x391, lpOverlapped=0x0) returned 1 [0039.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.269] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.270] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.270] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.270] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.270] CloseHandle (hObject=0x104) returned 1 [0039.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0039.270] GetLastError () returned 0x0 [0039.271] RtlWakeConditionVariable () returned 0x27e828 [0039.271] GetCurrentThreadId () returned 0x9ac [0039.271] GetCurrentThreadId () returned 0x9ac [0039.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d8b0 [0039.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x260000) returned 1 [0039.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1758 | out: hHeap=0x260000) returned 1 [0039.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29de98 [0039.271] lstrlenW (lpString=".ldf") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".ldf") returned 0x0 [0039.271] lstrlenW (lpString=".vhd") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".vhd") returned 0x0 [0039.271] lstrlenW (lpString=".vhdx") returned 5 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".vhdx") returned 0x0 [0039.271] lstrlenW (lpString=".pst") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".pst") returned 0x0 [0039.271] lstrlenW (lpString=".ost") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".ost") returned 0x0 [0039.271] lstrlenW (lpString=".bak") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".bak") returned 0x0 [0039.271] lstrlenW (lpString=".bac") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".bac") returned 0x0 [0039.271] lstrlenW (lpString=".sys") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".sys") returned 0x0 [0039.271] lstrlenW (lpString=".v2i") returned 4 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".v2i") returned 0x0 [0039.271] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.271] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch="s\r\n.v2i") returned 0x0 [0039.271] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.416] lstrlenW (lpString=".sql") returned 4 [0039.416] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".sql") returned 0x0 [0039.416] lstrlenW (lpString=".mdf") returned 4 [0039.434] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".mdf") returned 0x0 [0039.434] lstrlenW (lpString=".txt") returned 4 [0039.434] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".txt") returned 0x0 [0039.434] lstrlenW (lpString=".dbf") returned 4 [0039.444] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".dbf") returned 0x0 [0039.444] lstrlenW (lpString=".ckp") returned 4 [0039.447] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".ckp") returned 0x0 [0039.448] lstrlenW (lpString=".dacpac") returned 7 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".dacpac") returned 0x0 [0039.448] lstrlenW (lpString=".db3") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".db3") returned 0x0 [0039.448] lstrlenW (lpString=".dtxs") returned 5 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".dtxs") returned 0x0 [0039.448] lstrlenW (lpString=".mdt") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".mdt") returned 0x0 [0039.448] lstrlenW (lpString=".sdf") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".sdf") returned 0x0 [0039.448] lstrlenW (lpString=".MDF") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".MDF") returned 0x0 [0039.448] lstrlenW (lpString=".DBF") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".DBF") returned 0x0 [0039.448] lstrlenW (lpString=".DB") returned 3 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".DB") returned 0x0 [0039.448] lstrlenW (lpString=".db") returned 3 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".db") returned 0x0 [0039.448] lstrlenW (lpString=".ndf") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".ndf") returned 0x0 [0039.448] lstrlenW (lpString=".NDF") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".NDF") returned 0x0 [0039.448] lstrlenW (lpString=".Mdf") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".Mdf") returned 0x0 [0039.448] lstrlenW (lpString=".dat") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".dat") returned 0x0 [0039.448] lstrlenW (lpString=".DAT") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".DAT") returned 0x0 [0039.448] lstrlenW (lpString=".ldf") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".ldf") returned 0x0 [0039.448] lstrlenW (lpString=".LDF") returned 4 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch=".LDF") returned 0x0 [0039.448] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.448] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.449] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.449] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.449] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15945063705) returned 1 [0039.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa652bf90, dwHighDateTime=0x1d585b4)) [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299210 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299210 | out: hHeap=0x260000) returned 1 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dfe8 [0039.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dfe8 | out: hHeap=0x260000) returned 1 [0039.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.450] GetLastError () returned 0x0 [0039.450] GetLastError () returned 0x0 [0039.450] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.450] GetLastError () returned 0x0 [0039.450] GetLastError () returned 0x0 [0039.450] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.453] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.453] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.454] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.454] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.455] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.455] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.455] CloseHandle (hObject=0xfc) returned 1 [0039.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.[deadmin@cock.li].deadmin")) returned 1 [0039.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.456] GetLastError () returned 0x0 [0039.456] RtlWakeConditionVariable () returned 0x27e828 [0039.456] GetCurrentThreadId () returned 0x9ac [0039.456] GetCurrentThreadId () returned 0x9ac [0039.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0039.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299248 | out: hHeap=0x260000) returned 1 [0039.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0039.456] lstrlenW (lpString=".ldf") returned 4 [0039.456] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".ldf") returned 0x0 [0039.456] lstrlenW (lpString=".vhd") returned 4 [0039.456] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".vhd") returned 0x0 [0039.456] lstrlenW (lpString=".vhdx") returned 5 [0039.456] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".vhdx") returned 0x0 [0039.456] lstrlenW (lpString=".pst") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".pst") returned 0x0 [0039.457] lstrlenW (lpString=".ost") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".ost") returned 0x0 [0039.457] lstrlenW (lpString=".bak") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".bak") returned 0x0 [0039.457] lstrlenW (lpString=".bac") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".bac") returned 0x0 [0039.457] lstrlenW (lpString=".sys") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".sys") returned 0x0 [0039.457] lstrlenW (lpString=".v2i") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".v2i") returned 0x0 [0039.457] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.457] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.457] lstrlenW (lpString=".sql") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".sql") returned 0x0 [0039.457] lstrlenW (lpString=".mdf") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".mdf") returned 0x0 [0039.457] lstrlenW (lpString=".txt") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".txt") returned 0x0 [0039.457] lstrlenW (lpString=".dbf") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".dbf") returned 0x0 [0039.457] lstrlenW (lpString=".ckp") returned 4 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".ckp") returned 0x0 [0039.457] lstrlenW (lpString=".dacpac") returned 7 [0039.457] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".dacpac") returned 0x0 [0039.458] lstrlenW (lpString=".db3") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".db3") returned 0x0 [0039.458] lstrlenW (lpString=".dtxs") returned 5 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".dtxs") returned 0x0 [0039.458] lstrlenW (lpString=".mdt") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".mdt") returned 0x0 [0039.458] lstrlenW (lpString=".sdf") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".sdf") returned 0x0 [0039.458] lstrlenW (lpString=".MDF") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".MDF") returned 0x0 [0039.458] lstrlenW (lpString=".DBF") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".DBF") returned 0x0 [0039.458] lstrlenW (lpString=".DB") returned 3 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".DB") returned 0x0 [0039.458] lstrlenW (lpString=".db") returned 3 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".db") returned 0x0 [0039.458] lstrlenW (lpString=".ndf") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".ndf") returned 0x0 [0039.458] lstrlenW (lpString=".NDF") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".NDF") returned 0x0 [0039.458] lstrlenW (lpString=".Mdf") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".Mdf") returned 0x0 [0039.458] lstrlenW (lpString=".dat") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".dat") returned 0x0 [0039.458] lstrlenW (lpString=".DAT") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".DAT") returned 0x0 [0039.458] lstrlenW (lpString=".ldf") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".ldf") returned 0x0 [0039.458] lstrlenW (lpString=".LDF") returned 4 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch=".LDF") returned 0x0 [0039.458] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.458] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.459] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.459] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.459] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15946054768) returned 1 [0039.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa65520f0, dwHighDateTime=0x1d585b4)) [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299248 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299248 | out: hHeap=0x260000) returned 1 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d8b0 [0039.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0039.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.460] GetLastError () returned 0x0 [0039.460] GetLastError () returned 0x0 [0039.460] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.460] GetLastError () returned 0x0 [0039.460] GetLastError () returned 0x0 [0039.460] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.463] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.463] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.463] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.464] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.465] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.465] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.465] CloseHandle (hObject=0xfc) returned 1 [0039.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.[deadmin@cock.li].deadmin")) returned 1 [0039.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.469] GetLastError () returned 0x0 [0039.469] RtlWakeConditionVariable () returned 0x27e828 [0039.469] GetCurrentThreadId () returned 0x9ac [0039.469] GetCurrentThreadId () returned 0x9ac [0039.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b798 | out: hHeap=0x260000) returned 1 [0039.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299280 | out: hHeap=0x260000) returned 1 [0039.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b798 [0039.469] lstrlenW (lpString=".ldf") returned 4 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".ldf") returned 0x0 [0039.469] lstrlenW (lpString=".vhd") returned 4 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".vhd") returned 0x0 [0039.469] lstrlenW (lpString=".vhdx") returned 5 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".vhdx") returned 0x0 [0039.469] lstrlenW (lpString=".pst") returned 4 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".pst") returned 0x0 [0039.469] lstrlenW (lpString=".ost") returned 4 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".ost") returned 0x0 [0039.469] lstrlenW (lpString=".bak") returned 4 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".bak") returned 0x0 [0039.469] lstrlenW (lpString=".bac") returned 4 [0039.469] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".bac") returned 0x0 [0039.470] lstrlenW (lpString=".sys") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".sys") returned 0x0 [0039.470] lstrlenW (lpString=".v2i") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".v2i") returned 0x0 [0039.470] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.470] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.470] lstrlenW (lpString=".sql") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".sql") returned 0x0 [0039.470] lstrlenW (lpString=".mdf") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".mdf") returned 0x0 [0039.470] lstrlenW (lpString=".txt") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".txt") returned 0x0 [0039.470] lstrlenW (lpString=".dbf") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".dbf") returned 0x0 [0039.470] lstrlenW (lpString=".ckp") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".ckp") returned 0x0 [0039.470] lstrlenW (lpString=".dacpac") returned 7 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".dacpac") returned 0x0 [0039.470] lstrlenW (lpString=".db3") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".db3") returned 0x0 [0039.470] lstrlenW (lpString=".dtxs") returned 5 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".dtxs") returned 0x0 [0039.470] lstrlenW (lpString=".mdt") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".mdt") returned 0x0 [0039.470] lstrlenW (lpString=".sdf") returned 4 [0039.470] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".sdf") returned 0x0 [0039.470] lstrlenW (lpString=".MDF") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".MDF") returned 0x0 [0039.471] lstrlenW (lpString=".DBF") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".DBF") returned 0x0 [0039.471] lstrlenW (lpString=".DB") returned 3 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".DB") returned 0x0 [0039.471] lstrlenW (lpString=".db") returned 3 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".db") returned 0x0 [0039.471] lstrlenW (lpString=".ndf") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".ndf") returned 0x0 [0039.471] lstrlenW (lpString=".NDF") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".NDF") returned 0x0 [0039.471] lstrlenW (lpString=".Mdf") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".Mdf") returned 0x0 [0039.471] lstrlenW (lpString=".dat") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".dat") returned 0x0 [0039.471] lstrlenW (lpString=".DAT") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".DAT") returned 0x0 [0039.471] lstrlenW (lpString=".ldf") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".ldf") returned 0x0 [0039.471] lstrlenW (lpString=".LDF") returned 4 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch=".LDF") returned 0x0 [0039.471] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.471] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.471] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.472] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.472] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.472] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15947332702) returned 1 [0039.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6578250, dwHighDateTime=0x1d585b4)) [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299280 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299280 | out: hHeap=0x260000) returned 1 [0039.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d8b0 [0039.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0039.473] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.473] GetLastError () returned 0x0 [0039.473] GetLastError () returned 0x0 [0039.473] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.473] GetLastError () returned 0x0 [0039.473] GetLastError () returned 0x0 [0039.473] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x15b5, lpOverlapped=0x0) returned 1 [0039.475] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffea4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.475] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x15b5, lpOverlapped=0x0) returned 1 [0039.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.475] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.475] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.475] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.475] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.475] CloseHandle (hObject=0xfc) returned 1 [0039.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.475] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.476] GetLastError () returned 0x0 [0039.476] RtlWakeConditionVariable () returned 0x27e828 [0039.476] GetCurrentThreadId () returned 0x9ac [0039.476] GetCurrentThreadId () returned 0x9ac [0039.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b850 | out: hHeap=0x260000) returned 1 [0039.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992b8 | out: hHeap=0x260000) returned 1 [0039.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b850 [0039.476] lstrlenW (lpString=".ldf") returned 4 [0039.476] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".ldf") returned 0x0 [0039.476] lstrlenW (lpString=".vhd") returned 4 [0039.476] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".vhd") returned 0x0 [0039.476] lstrlenW (lpString=".vhdx") returned 5 [0039.476] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".vhdx") returned 0x0 [0039.476] lstrlenW (lpString=".pst") returned 4 [0039.476] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".pst") returned 0x0 [0039.476] lstrlenW (lpString=".ost") returned 4 [0039.476] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".ost") returned 0x0 [0039.476] lstrlenW (lpString=".bak") returned 4 [0039.476] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".bak") returned 0x0 [0039.477] lstrlenW (lpString=".bac") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".bac") returned 0x0 [0039.477] lstrlenW (lpString=".sys") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".sys") returned 0x0 [0039.477] lstrlenW (lpString=".v2i") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".v2i") returned 0x0 [0039.477] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.477] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.477] lstrlenW (lpString=".sql") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".sql") returned 0x0 [0039.477] lstrlenW (lpString=".mdf") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".mdf") returned 0x0 [0039.477] lstrlenW (lpString=".txt") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".txt") returned 0x0 [0039.477] lstrlenW (lpString=".dbf") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".dbf") returned 0x0 [0039.477] lstrlenW (lpString=".ckp") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".ckp") returned 0x0 [0039.477] lstrlenW (lpString=".dacpac") returned 7 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".dacpac") returned 0x0 [0039.477] lstrlenW (lpString=".db3") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".db3") returned 0x0 [0039.477] lstrlenW (lpString=".dtxs") returned 5 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".dtxs") returned 0x0 [0039.477] lstrlenW (lpString=".mdt") returned 4 [0039.477] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".mdt") returned 0x0 [0039.478] lstrlenW (lpString=".sdf") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".sdf") returned 0x0 [0039.478] lstrlenW (lpString=".MDF") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".MDF") returned 0x0 [0039.478] lstrlenW (lpString=".DBF") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".DBF") returned 0x0 [0039.478] lstrlenW (lpString=".DB") returned 3 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".DB") returned 0x0 [0039.478] lstrlenW (lpString=".db") returned 3 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".db") returned 0x0 [0039.478] lstrlenW (lpString=".ndf") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".ndf") returned 0x0 [0039.478] lstrlenW (lpString=".NDF") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".NDF") returned 0x0 [0039.478] lstrlenW (lpString=".Mdf") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".Mdf") returned 0x0 [0039.478] lstrlenW (lpString=".dat") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".dat") returned 0x0 [0039.478] lstrlenW (lpString=".DAT") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".DAT") returned 0x0 [0039.478] lstrlenW (lpString=".ldf") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".ldf") returned 0x0 [0039.478] lstrlenW (lpString=".LDF") returned 4 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch=".LDF") returned 0x0 [0039.478] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.478] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.478] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.479] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.479] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.479] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15948039438) returned 1 [0039.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6578250, dwHighDateTime=0x1d585b4)) [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992b8 [0039.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992b8 | out: hHeap=0x260000) returned 1 [0039.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d8b0 [0039.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0039.480] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.480] GetLastError () returned 0x0 [0039.480] GetLastError () returned 0x0 [0039.480] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.480] GetLastError () returned 0x0 [0039.480] GetLastError () returned 0x0 [0039.480] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.483] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.483] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.483] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.483] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.485] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.485] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.485] CloseHandle (hObject=0xfc) returned 1 [0039.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.[deadmin@cock.li].deadmin")) returned 1 [0039.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.486] GetLastError () returned 0x0 [0039.486] RtlWakeConditionVariable () returned 0x27e828 [0039.486] GetCurrentThreadId () returned 0x9ac [0039.486] GetCurrentThreadId () returned 0x9ac [0039.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b908 | out: hHeap=0x260000) returned 1 [0039.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992f0 | out: hHeap=0x260000) returned 1 [0039.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b908 [0039.486] lstrlenW (lpString=".ldf") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".ldf") returned 0x0 [0039.486] lstrlenW (lpString=".vhd") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".vhd") returned 0x0 [0039.486] lstrlenW (lpString=".vhdx") returned 5 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".vhdx") returned 0x0 [0039.486] lstrlenW (lpString=".pst") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".pst") returned 0x0 [0039.486] lstrlenW (lpString=".ost") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".ost") returned 0x0 [0039.486] lstrlenW (lpString=".bak") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".bak") returned 0x0 [0039.486] lstrlenW (lpString=".bac") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".bac") returned 0x0 [0039.486] lstrlenW (lpString=".sys") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".sys") returned 0x0 [0039.486] lstrlenW (lpString=".v2i") returned 4 [0039.486] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".v2i") returned 0x0 [0039.487] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.487] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.487] lstrlenW (lpString=".sql") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".sql") returned 0x0 [0039.487] lstrlenW (lpString=".mdf") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".mdf") returned 0x0 [0039.487] lstrlenW (lpString=".txt") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".txt") returned 0x0 [0039.487] lstrlenW (lpString=".dbf") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".dbf") returned 0x0 [0039.487] lstrlenW (lpString=".ckp") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".ckp") returned 0x0 [0039.487] lstrlenW (lpString=".dacpac") returned 7 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".dacpac") returned 0x0 [0039.487] lstrlenW (lpString=".db3") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".db3") returned 0x0 [0039.487] lstrlenW (lpString=".dtxs") returned 5 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".dtxs") returned 0x0 [0039.487] lstrlenW (lpString=".mdt") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".mdt") returned 0x0 [0039.487] lstrlenW (lpString=".sdf") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".sdf") returned 0x0 [0039.487] lstrlenW (lpString=".MDF") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".MDF") returned 0x0 [0039.487] lstrlenW (lpString=".DBF") returned 4 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".DBF") returned 0x0 [0039.487] lstrlenW (lpString=".DB") returned 3 [0039.487] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".DB") returned 0x0 [0039.488] lstrlenW (lpString=".db") returned 3 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".db") returned 0x0 [0039.488] lstrlenW (lpString=".ndf") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".ndf") returned 0x0 [0039.488] lstrlenW (lpString=".NDF") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".NDF") returned 0x0 [0039.488] lstrlenW (lpString=".Mdf") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".Mdf") returned 0x0 [0039.488] lstrlenW (lpString=".dat") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".dat") returned 0x0 [0039.488] lstrlenW (lpString=".DAT") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".DAT") returned 0x0 [0039.488] lstrlenW (lpString=".ldf") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".ldf") returned 0x0 [0039.488] lstrlenW (lpString=".LDF") returned 4 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch=".LDF") returned 0x0 [0039.488] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.488] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3b90 [0039.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.488] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.489] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.489] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15949013629) returned 1 [0039.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa659e3b0, dwHighDateTime=0x1d585b4)) [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992f0 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2992f0 | out: hHeap=0x260000) returned 1 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d8b0 [0039.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0039.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.490] GetLastError () returned 0x0 [0039.490] GetLastError () returned 0x0 [0039.490] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.490] GetLastError () returned 0x0 [0039.490] GetLastError () returned 0x0 [0039.490] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x333, lpOverlapped=0x0) returned 1 [0039.621] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffccd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.621] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x333, lpOverlapped=0x0) returned 1 [0039.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0039.623] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.623] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.623] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.623] CloseHandle (hObject=0xfc) returned 1 [0039.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.624] GetLastError () returned 0x0 [0039.624] RtlWakeConditionVariable () returned 0x27e828 [0039.624] GetCurrentThreadId () returned 0x9ac [0039.624] GetCurrentThreadId () returned 0x9ac [0039.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db0f0 [0039.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3ed8 | out: hHeap=0x260000) returned 1 [0039.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1918 | out: hHeap=0x260000) returned 1 [0039.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db1b8 [0039.624] lstrlenW (lpString=".ldf") returned 4 [0039.624] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".ldf") returned 0x0 [0039.624] lstrlenW (lpString=".vhd") returned 4 [0039.624] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".vhd") returned 0x0 [0039.624] lstrlenW (lpString=".vhdx") returned 5 [0039.624] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".vhdx") returned 0x0 [0039.624] lstrlenW (lpString=".pst") returned 4 [0039.624] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".pst") returned 0x0 [0039.624] lstrlenW (lpString=".ost") returned 4 [0039.624] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".ost") returned 0x0 [0039.624] lstrlenW (lpString=".bak") returned 4 [0039.624] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".bak") returned 0x0 [0039.625] lstrlenW (lpString=".bac") returned 4 [0039.625] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".bac") returned 0x0 [0039.625] lstrlenW (lpString=".sys") returned 4 [0039.625] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".sys") returned 0x0 [0039.625] lstrlenW (lpString=".v2i") returned 4 [0039.625] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".v2i") returned 0x0 [0039.625] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.625] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch="s\r\n.v2i") returned 0x0 [0039.625] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.693] lstrlenW (lpString=".sql") returned 4 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".sql") returned 0x0 [0039.693] lstrlenW (lpString=".mdf") returned 4 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".mdf") returned 0x0 [0039.693] lstrlenW (lpString=".txt") returned 4 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".txt") returned 0x0 [0039.693] lstrlenW (lpString=".dbf") returned 4 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".dbf") returned 0x0 [0039.693] lstrlenW (lpString=".ckp") returned 4 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".ckp") returned 0x0 [0039.693] lstrlenW (lpString=".dacpac") returned 7 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".dacpac") returned 0x0 [0039.693] lstrlenW (lpString=".db3") returned 4 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".db3") returned 0x0 [0039.693] lstrlenW (lpString=".dtxs") returned 5 [0039.693] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".dtxs") returned 0x0 [0039.694] lstrlenW (lpString=".mdt") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".mdt") returned 0x0 [0039.694] lstrlenW (lpString=".sdf") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".sdf") returned 0x0 [0039.694] lstrlenW (lpString=".MDF") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".MDF") returned 0x0 [0039.694] lstrlenW (lpString=".DBF") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".DBF") returned 0x0 [0039.694] lstrlenW (lpString=".DB") returned 3 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".DB") returned 0x0 [0039.694] lstrlenW (lpString=".db") returned 3 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".db") returned 0x0 [0039.694] lstrlenW (lpString=".ndf") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".ndf") returned 0x0 [0039.694] lstrlenW (lpString=".NDF") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".NDF") returned 0x0 [0039.694] lstrlenW (lpString=".Mdf") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".Mdf") returned 0x0 [0039.694] lstrlenW (lpString=".dat") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".dat") returned 0x0 [0039.694] lstrlenW (lpString=".DAT") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".DAT") returned 0x0 [0039.694] lstrlenW (lpString=".ldf") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".ldf") returned 0x0 [0039.694] lstrlenW (lpString=".LDF") returned 4 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch=".LDF") returned 0x0 [0039.694] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.694] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.694] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.695] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.695] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.696] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15969664533) returned 1 [0039.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa678d590, dwHighDateTime=0x1d585b4)) [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994e8 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0039.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.696] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.696] GetLastError () returned 0x0 [0039.696] GetLastError () returned 0x0 [0039.696] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.696] GetLastError () returned 0x0 [0039.696] GetLastError () returned 0x0 [0039.697] ReadFile (in: hFile=0x104, lpBuffer=0x2760050, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.701] WriteFile (in: hFile=0x104, lpBuffer=0x2760050*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2760050 | out: hHeap=0x260000) returned 1 [0039.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.701] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.703] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.703] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.703] CloseHandle (hObject=0x104) returned 1 [0039.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3e10 [0039.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.[deadmin@cock.li].deadmin")) returned 1 [0039.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0039.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.704] GetLastError () returned 0x0 [0039.704] RtlWakeConditionVariable () returned 0x27e828 [0039.704] GetCurrentThreadId () returned 0x9ac [0039.704] GetCurrentThreadId () returned 0x9ac [0039.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db0f0 [0039.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5ea8 | out: hHeap=0x260000) returned 1 [0039.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0039.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db1b8 [0039.704] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.705] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.705] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0039.705] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0039.705] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0039.706] CloseHandle (hObject=0x104) returned 1 [0039.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db1b8 | out: hHeap=0x260000) returned 1 [0039.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db0f0 | out: hHeap=0x260000) returned 1 [0039.706] RtlWakeConditionVariable () returned 0x27e828 [0039.706] GetCurrentThreadId () returned 0x9ac [0039.706] GetCurrentThreadId () returned 0x9ac [0039.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295da8 | out: hHeap=0x260000) returned 1 [0039.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299558 | out: hHeap=0x260000) returned 1 [0039.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295da8 [0039.706] lstrlenW (lpString=".ldf") returned 4 [0039.706] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".ldf") returned 0x0 [0039.706] lstrlenW (lpString=".vhd") returned 4 [0039.706] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".vhd") returned 0x0 [0039.706] lstrlenW (lpString=".vhdx") returned 5 [0039.706] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".vhdx") returned 0x0 [0039.706] lstrlenW (lpString=".pst") returned 4 [0039.706] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".pst") returned 0x0 [0039.706] lstrlenW (lpString=".ost") returned 4 [0039.706] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".ost") returned 0x0 [0039.706] lstrlenW (lpString=".bak") returned 4 [0039.706] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".bak") returned 0x0 [0039.706] lstrlenW (lpString=".bac") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".bac") returned 0x0 [0039.707] lstrlenW (lpString=".sys") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".sys") returned 0x0 [0039.707] lstrlenW (lpString=".v2i") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch=".v2i") returned 0x0 [0039.707] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.", lpSrch="s\r\n.v2i") returned 0x0 [0039.707] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295da8 | out: hHeap=0x260000) returned 1 [0039.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.707] RtlWakeConditionVariable () returned 0x27e828 [0039.707] GetCurrentThreadId () returned 0x9ac [0039.707] GetCurrentThreadId () returned 0x9ac [0039.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296690 | out: hHeap=0x260000) returned 1 [0039.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299590 | out: hHeap=0x260000) returned 1 [0039.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296690 [0039.707] lstrlenW (lpString=".ldf") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".ldf") returned 0x0 [0039.707] lstrlenW (lpString=".vhd") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".vhd") returned 0x0 [0039.707] lstrlenW (lpString=".vhdx") returned 5 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".vhdx") returned 0x0 [0039.707] lstrlenW (lpString=".pst") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".pst") returned 0x0 [0039.707] lstrlenW (lpString=".ost") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".ost") returned 0x0 [0039.707] lstrlenW (lpString=".bak") returned 4 [0039.707] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".bak") returned 0x0 [0039.707] lstrlenW (lpString=".bac") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".bac") returned 0x0 [0039.708] lstrlenW (lpString=".sys") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".sys") returned 0x0 [0039.708] lstrlenW (lpString=".v2i") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch=".v2i") returned 0x0 [0039.708] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..", lpSrch="s\r\n.v2i") returned 0x0 [0039.708] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296690 | out: hHeap=0x260000) returned 1 [0039.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0039.708] RtlWakeConditionVariable () returned 0x27e828 [0039.708] GetCurrentThreadId () returned 0x9ac [0039.708] GetCurrentThreadId () returned 0x9ac [0039.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bf80 | out: hHeap=0x260000) returned 1 [0039.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0039.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0039.708] lstrlenW (lpString=".ldf") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ldf") returned 0x0 [0039.708] lstrlenW (lpString=".vhd") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".vhd") returned 0x0 [0039.708] lstrlenW (lpString=".vhdx") returned 5 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".vhdx") returned 0x0 [0039.708] lstrlenW (lpString=".pst") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".pst") returned 0x0 [0039.708] lstrlenW (lpString=".ost") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ost") returned 0x0 [0039.708] lstrlenW (lpString=".bak") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".bak") returned 0x0 [0039.708] lstrlenW (lpString=".bac") returned 4 [0039.708] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".bac") returned 0x0 [0039.709] lstrlenW (lpString=".sys") returned 4 [0039.709] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sys") returned 0x0 [0039.709] lstrlenW (lpString=".v2i") returned 4 [0039.709] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".v2i") returned 0x0 [0039.709] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.709] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch="s\r\n.v2i") returned 0x0 [0039.709] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.710] lstrlenW (lpString=".sql") returned 4 [0039.710] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sql") returned 0x0 [0039.710] lstrlenW (lpString=".mdf") returned 4 [0039.710] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".mdf") returned 0x0 [0039.710] lstrlenW (lpString=".txt") returned 4 [0039.710] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".txt") returned 0x0 [0039.710] lstrlenW (lpString=".dbf") returned 4 [0039.710] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dbf") returned 0x0 [0039.711] lstrlenW (lpString=".ckp") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ckp") returned 0x0 [0039.711] lstrlenW (lpString=".dacpac") returned 7 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dacpac") returned 0x0 [0039.711] lstrlenW (lpString=".db3") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".db3") returned 0x0 [0039.711] lstrlenW (lpString=".dtxs") returned 5 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dtxs") returned 0x0 [0039.711] lstrlenW (lpString=".mdt") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".mdt") returned 0x0 [0039.711] lstrlenW (lpString=".sdf") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".sdf") returned 0x0 [0039.711] lstrlenW (lpString=".MDF") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".MDF") returned 0x0 [0039.711] lstrlenW (lpString=".DBF") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DBF") returned 0x0 [0039.711] lstrlenW (lpString=".DB") returned 3 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DB") returned 0x0 [0039.711] lstrlenW (lpString=".db") returned 3 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".db") returned 0x0 [0039.711] lstrlenW (lpString=".ndf") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ndf") returned 0x0 [0039.711] lstrlenW (lpString=".NDF") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".NDF") returned 0x0 [0039.711] lstrlenW (lpString=".Mdf") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".Mdf") returned 0x0 [0039.711] lstrlenW (lpString=".dat") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".dat") returned 0x0 [0039.711] lstrlenW (lpString=".DAT") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".DAT") returned 0x0 [0039.711] lstrlenW (lpString=".ldf") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".ldf") returned 0x0 [0039.711] lstrlenW (lpString=".LDF") returned 4 [0039.711] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch=".LDF") returned 0x0 [0039.712] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.712] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.712] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27d0b0) returned 1 [0039.712] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.712] CryptReleaseContext (hProv=0x27d0b0, dwFlags=0x0) returned 1 [0039.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.713] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15971367851) returned 1 [0039.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa67b36f0, dwHighDateTime=0x1d585b4)) [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27d0b0 [0039.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0039.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.713] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.713] GetLastError () returned 0x0 [0039.713] GetLastError () returned 0x0 [0039.713] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.713] GetLastError () returned 0x0 [0039.713] GetLastError () returned 0x0 [0039.714] ReadFile (in: hFile=0x104, lpBuffer=0x2760050, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.716] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.716] WriteFile (in: hFile=0x104, lpBuffer=0x2760050*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0039.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2760050 | out: hHeap=0x260000) returned 1 [0039.717] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.717] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.725] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.725] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.726] CloseHandle (hObject=0x104) returned 1 [0039.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.[deadmin@cock.li].deadmin")) returned 1 [0039.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.726] GetLastError () returned 0x0 [0039.727] RtlWakeConditionVariable () returned 0x27e828 [0039.727] GetCurrentThreadId () returned 0x9ac [0039.727] GetCurrentThreadId () returned 0x9ac [0039.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0039.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c038 | out: hHeap=0x260000) returned 1 [0039.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0039.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c038 [0039.727] lstrlenW (lpString=".ldf") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ldf") returned 0x0 [0039.727] lstrlenW (lpString=".vhd") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".vhd") returned 0x0 [0039.727] lstrlenW (lpString=".vhdx") returned 5 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".vhdx") returned 0x0 [0039.727] lstrlenW (lpString=".pst") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".pst") returned 0x0 [0039.727] lstrlenW (lpString=".ost") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ost") returned 0x0 [0039.727] lstrlenW (lpString=".bak") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".bak") returned 0x0 [0039.727] lstrlenW (lpString=".bac") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".bac") returned 0x0 [0039.727] lstrlenW (lpString=".sys") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sys") returned 0x0 [0039.727] lstrlenW (lpString=".v2i") returned 4 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".v2i") returned 0x0 [0039.727] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.727] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch="s\r\n.v2i") returned 0x0 [0039.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.728] lstrlenW (lpString=".sql") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sql") returned 0x0 [0039.728] lstrlenW (lpString=".mdf") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".mdf") returned 0x0 [0039.728] lstrlenW (lpString=".txt") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".txt") returned 0x0 [0039.728] lstrlenW (lpString=".dbf") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dbf") returned 0x0 [0039.728] lstrlenW (lpString=".ckp") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ckp") returned 0x0 [0039.728] lstrlenW (lpString=".dacpac") returned 7 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dacpac") returned 0x0 [0039.728] lstrlenW (lpString=".db3") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".db3") returned 0x0 [0039.728] lstrlenW (lpString=".dtxs") returned 5 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dtxs") returned 0x0 [0039.728] lstrlenW (lpString=".mdt") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".mdt") returned 0x0 [0039.728] lstrlenW (lpString=".sdf") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sdf") returned 0x0 [0039.728] lstrlenW (lpString=".MDF") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".MDF") returned 0x0 [0039.728] lstrlenW (lpString=".DBF") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DBF") returned 0x0 [0039.728] lstrlenW (lpString=".DB") returned 3 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DB") returned 0x0 [0039.728] lstrlenW (lpString=".db") returned 3 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".db") returned 0x0 [0039.728] lstrlenW (lpString=".ndf") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ndf") returned 0x0 [0039.728] lstrlenW (lpString=".NDF") returned 4 [0039.728] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".NDF") returned 0x0 [0039.729] lstrlenW (lpString=".Mdf") returned 4 [0039.729] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".Mdf") returned 0x0 [0039.729] lstrlenW (lpString=".dat") returned 4 [0039.729] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dat") returned 0x0 [0039.729] lstrlenW (lpString=".DAT") returned 4 [0039.729] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DAT") returned 0x0 [0039.729] lstrlenW (lpString=".ldf") returned 4 [0039.729] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ldf") returned 0x0 [0039.729] lstrlenW (lpString=".LDF") returned 4 [0039.729] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".LDF") returned 0x0 [0039.729] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0039.729] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0039.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5250 [0039.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0039.729] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d7370) returned 1 [0039.730] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0039.730] CryptReleaseContext (hProv=0x2d7370, dwFlags=0x0) returned 1 [0039.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0039.730] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=15973096821) returned 1 [0039.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa67d9850, dwHighDateTime=0x1d585b4)) [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299600 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d7370 [0039.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0039.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7370 | out: hHeap=0x260000) returned 1 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0039.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0039.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0039.730] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0039.730] GetLastError () returned 0x0 [0039.731] GetLastError () returned 0x0 [0039.731] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0039.731] GetLastError () returned 0x0 [0039.731] GetLastError () returned 0x0 [0039.731] ReadFile (in: hFile=0x104, lpBuffer=0x2760050, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesRead=0x24cfdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0039.824] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.824] WriteFile (in: hFile=0x104, lpBuffer=0x2760050*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2760050*, lpNumberOfBytesWritten=0x24cfdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0039.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2760050 | out: hHeap=0x260000) returned 1 [0039.826] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.826] WriteFile (in: hFile=0x104, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0039.826] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0039.826] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0039.826] CloseHandle (hObject=0x104) returned 1 [0039.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.[deadmin@cock.li].deadmin")) returned 1 [0039.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0039.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0039.957] GetLastError () returned 0x0 [0039.957] RtlWakeConditionVariable () returned 0x27e828 [0039.957] GetCurrentThreadId () returned 0x9ac [0039.957] GetCurrentThreadId () returned 0x9ac [0039.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0039.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e870 | out: hHeap=0x260000) returned 1 [0039.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299910 | out: hHeap=0x260000) returned 1 [0039.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e870 [0039.957] lstrlenW (lpString=".ldf") returned 4 [0039.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ldf") returned 0x0 [0039.957] lstrlenW (lpString=".vhd") returned 4 [0039.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".vhd") returned 0x0 [0039.957] lstrlenW (lpString=".vhdx") returned 5 [0039.957] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".vhdx") returned 0x0 [0039.958] lstrlenW (lpString=".pst") returned 4 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".pst") returned 0x0 [0039.958] lstrlenW (lpString=".ost") returned 4 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ost") returned 0x0 [0039.958] lstrlenW (lpString=".bak") returned 4 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".bak") returned 0x0 [0039.958] lstrlenW (lpString=".bac") returned 4 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".bac") returned 0x0 [0039.958] lstrlenW (lpString=".sys") returned 4 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sys") returned 0x0 [0039.958] lstrlenW (lpString=".v2i") returned 4 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".v2i") returned 0x0 [0039.958] lstrlenW (lpString="s\r\n.v2i") returned 7 [0039.958] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch="s\r\n.v2i") returned 0x0 [0039.958] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.164] lstrlenW (lpString=".sql") returned 4 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sql") returned 0x0 [0040.164] lstrlenW (lpString=".mdf") returned 4 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".mdf") returned 0x0 [0040.164] lstrlenW (lpString=".txt") returned 4 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".txt") returned 0x0 [0040.164] lstrlenW (lpString=".dbf") returned 4 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dbf") returned 0x0 [0040.164] lstrlenW (lpString=".ckp") returned 4 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ckp") returned 0x0 [0040.164] lstrlenW (lpString=".dacpac") returned 7 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dacpac") returned 0x0 [0040.164] lstrlenW (lpString=".db3") returned 4 [0040.164] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".db3") returned 0x0 [0040.165] lstrlenW (lpString=".dtxs") returned 5 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dtxs") returned 0x0 [0040.165] lstrlenW (lpString=".mdt") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".mdt") returned 0x0 [0040.165] lstrlenW (lpString=".sdf") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sdf") returned 0x0 [0040.165] lstrlenW (lpString=".MDF") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".MDF") returned 0x0 [0040.165] lstrlenW (lpString=".DBF") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DBF") returned 0x0 [0040.165] lstrlenW (lpString=".DB") returned 3 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DB") returned 0x0 [0040.165] lstrlenW (lpString=".db") returned 3 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".db") returned 0x0 [0040.165] lstrlenW (lpString=".ndf") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ndf") returned 0x0 [0040.165] lstrlenW (lpString=".NDF") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".NDF") returned 0x0 [0040.165] lstrlenW (lpString=".Mdf") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".Mdf") returned 0x0 [0040.165] lstrlenW (lpString=".dat") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dat") returned 0x0 [0040.165] lstrlenW (lpString=".DAT") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DAT") returned 0x0 [0040.165] lstrlenW (lpString=".ldf") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ldf") returned 0x0 [0040.165] lstrlenW (lpString=".LDF") returned 4 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".LDF") returned 0x0 [0040.165] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.165] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0040.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.165] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.166] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.166] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0040.166] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16016752106) returned 1 [0040.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6c03ed0, dwHighDateTime=0x1d585b4)) [0040.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946e8 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946e8 | out: hHeap=0x260000) returned 1 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0040.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0040.167] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.167] GetLastError () returned 0x0 [0040.167] GetLastError () returned 0x0 [0040.167] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.167] GetLastError () returned 0x0 [0040.167] GetLastError () returned 0x0 [0040.168] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.171] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.171] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.172] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.172] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.172] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.172] CloseHandle (hObject=0x108) returned 1 [0040.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.173] GetLastError () returned 0x0 [0040.173] RtlWakeConditionVariable () returned 0x27e828 [0040.173] GetCurrentThreadId () returned 0x9ac [0040.173] GetCurrentThreadId () returned 0x9ac [0040.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0040.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c5f8 | out: hHeap=0x260000) returned 1 [0040.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2947c8 | out: hHeap=0x260000) returned 1 [0040.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c5f8 [0040.173] lstrlenW (lpString=".ldf") returned 4 [0040.173] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ldf") returned 0x0 [0040.173] lstrlenW (lpString=".vhd") returned 4 [0040.173] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".vhd") returned 0x0 [0040.173] lstrlenW (lpString=".vhdx") returned 5 [0040.173] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".vhdx") returned 0x0 [0040.173] lstrlenW (lpString=".pst") returned 4 [0040.173] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".pst") returned 0x0 [0040.174] lstrlenW (lpString=".ost") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ost") returned 0x0 [0040.174] lstrlenW (lpString=".bak") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".bak") returned 0x0 [0040.174] lstrlenW (lpString=".bac") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".bac") returned 0x0 [0040.174] lstrlenW (lpString=".sys") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sys") returned 0x0 [0040.174] lstrlenW (lpString=".v2i") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".v2i") returned 0x0 [0040.174] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.174] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.174] lstrlenW (lpString=".sql") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sql") returned 0x0 [0040.174] lstrlenW (lpString=".mdf") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".mdf") returned 0x0 [0040.174] lstrlenW (lpString=".txt") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".txt") returned 0x0 [0040.174] lstrlenW (lpString=".dbf") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dbf") returned 0x0 [0040.174] lstrlenW (lpString=".ckp") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ckp") returned 0x0 [0040.174] lstrlenW (lpString=".dacpac") returned 7 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dacpac") returned 0x0 [0040.174] lstrlenW (lpString=".db3") returned 4 [0040.174] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".db3") returned 0x0 [0040.175] lstrlenW (lpString=".dtxs") returned 5 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dtxs") returned 0x0 [0040.175] lstrlenW (lpString=".mdt") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".mdt") returned 0x0 [0040.175] lstrlenW (lpString=".sdf") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".sdf") returned 0x0 [0040.175] lstrlenW (lpString=".MDF") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".MDF") returned 0x0 [0040.175] lstrlenW (lpString=".DBF") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DBF") returned 0x0 [0040.175] lstrlenW (lpString=".DB") returned 3 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DB") returned 0x0 [0040.175] lstrlenW (lpString=".db") returned 3 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".db") returned 0x0 [0040.175] lstrlenW (lpString=".ndf") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ndf") returned 0x0 [0040.175] lstrlenW (lpString=".NDF") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".NDF") returned 0x0 [0040.175] lstrlenW (lpString=".Mdf") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".Mdf") returned 0x0 [0040.175] lstrlenW (lpString=".dat") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".dat") returned 0x0 [0040.175] lstrlenW (lpString=".DAT") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".DAT") returned 0x0 [0040.175] lstrlenW (lpString=".ldf") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".ldf") returned 0x0 [0040.175] lstrlenW (lpString=".LDF") returned 4 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch=".LDF") returned 0x0 [0040.175] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.175] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0040.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.175] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.176] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.176] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0040.176] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16017747663) returned 1 [0040.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6c2a030, dwHighDateTime=0x1d585b4)) [0040.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2947c8 [0040.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2947c8 | out: hHeap=0x260000) returned 1 [0040.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0040.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0040.177] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.177] GetLastError () returned 0x0 [0040.177] GetLastError () returned 0x0 [0040.177] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.177] GetLastError () returned 0x0 [0040.177] GetLastError () returned 0x0 [0040.177] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0040.179] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.179] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0040.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.179] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.179] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.179] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.179] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.179] CloseHandle (hObject=0x108) returned 1 [0040.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.[deadmin@cock.li].deadmin")) returned 1 [0040.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.180] GetLastError () returned 0x0 [0040.180] RtlWakeConditionVariable () returned 0x27e828 [0040.180] GetCurrentThreadId () returned 0x9ac [0040.180] GetCurrentThreadId () returned 0x9ac [0040.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0040.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0040.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294800 | out: hHeap=0x260000) returned 1 [0040.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0040.180] lstrlenW (lpString=".ldf") returned 4 [0040.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ldf") returned 0x0 [0040.180] lstrlenW (lpString=".vhd") returned 4 [0040.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".vhd") returned 0x0 [0040.180] lstrlenW (lpString=".vhdx") returned 5 [0040.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".vhdx") returned 0x0 [0040.180] lstrlenW (lpString=".pst") returned 4 [0040.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".pst") returned 0x0 [0040.180] lstrlenW (lpString=".ost") returned 4 [0040.180] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ost") returned 0x0 [0040.181] lstrlenW (lpString=".bak") returned 4 [0040.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".bak") returned 0x0 [0040.181] lstrlenW (lpString=".bac") returned 4 [0040.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".bac") returned 0x0 [0040.181] lstrlenW (lpString=".sys") returned 4 [0040.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sys") returned 0x0 [0040.181] lstrlenW (lpString=".v2i") returned 4 [0040.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".v2i") returned 0x0 [0040.181] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.181] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch="s\r\n.v2i") returned 0x0 [0040.181] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.182] lstrlenW (lpString=".sql") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sql") returned 0x0 [0040.182] lstrlenW (lpString=".mdf") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".mdf") returned 0x0 [0040.182] lstrlenW (lpString=".txt") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".txt") returned 0x0 [0040.182] lstrlenW (lpString=".dbf") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dbf") returned 0x0 [0040.182] lstrlenW (lpString=".ckp") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ckp") returned 0x0 [0040.182] lstrlenW (lpString=".dacpac") returned 7 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dacpac") returned 0x0 [0040.182] lstrlenW (lpString=".db3") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".db3") returned 0x0 [0040.182] lstrlenW (lpString=".dtxs") returned 5 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dtxs") returned 0x0 [0040.182] lstrlenW (lpString=".mdt") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".mdt") returned 0x0 [0040.182] lstrlenW (lpString=".sdf") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".sdf") returned 0x0 [0040.182] lstrlenW (lpString=".MDF") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".MDF") returned 0x0 [0040.182] lstrlenW (lpString=".DBF") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DBF") returned 0x0 [0040.182] lstrlenW (lpString=".DB") returned 3 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DB") returned 0x0 [0040.182] lstrlenW (lpString=".db") returned 3 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".db") returned 0x0 [0040.182] lstrlenW (lpString=".ndf") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ndf") returned 0x0 [0040.182] lstrlenW (lpString=".NDF") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".NDF") returned 0x0 [0040.182] lstrlenW (lpString=".Mdf") returned 4 [0040.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".Mdf") returned 0x0 [0040.183] lstrlenW (lpString=".dat") returned 4 [0040.183] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".dat") returned 0x0 [0040.183] lstrlenW (lpString=".DAT") returned 4 [0040.183] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".DAT") returned 0x0 [0040.183] lstrlenW (lpString=".ldf") returned 4 [0040.183] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".ldf") returned 0x0 [0040.183] lstrlenW (lpString=".LDF") returned 4 [0040.183] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch=".LDF") returned 0x0 [0040.183] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.183] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0040.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.183] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.184] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0040.184] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16018531411) returned 1 [0040.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6c2a030, dwHighDateTime=0x1d585b4)) [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294800 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294800 | out: hHeap=0x260000) returned 1 [0040.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e870 [0040.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e870 | out: hHeap=0x260000) returned 1 [0040.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.185] GetLastError () returned 0x0 [0040.185] GetLastError () returned 0x0 [0040.185] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.185] GetLastError () returned 0x0 [0040.185] GetLastError () returned 0x0 [0040.185] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.188] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.188] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.188] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.189] CloseHandle (hObject=0x108) returned 1 [0040.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.[deadmin@cock.li].deadmin")) returned 1 [0040.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.189] GetLastError () returned 0x0 [0040.189] RtlWakeConditionVariable () returned 0x27e828 [0040.189] GetCurrentThreadId () returned 0x9ac [0040.190] GetCurrentThreadId () returned 0x9ac [0040.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0040.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0040.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294838 | out: hHeap=0x260000) returned 1 [0040.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0040.190] lstrlenW (lpString=".ldf") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ldf") returned 0x0 [0040.190] lstrlenW (lpString=".vhd") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".vhd") returned 0x0 [0040.190] lstrlenW (lpString=".vhdx") returned 5 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".vhdx") returned 0x0 [0040.190] lstrlenW (lpString=".pst") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".pst") returned 0x0 [0040.190] lstrlenW (lpString=".ost") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ost") returned 0x0 [0040.190] lstrlenW (lpString=".bak") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".bak") returned 0x0 [0040.190] lstrlenW (lpString=".bac") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".bac") returned 0x0 [0040.190] lstrlenW (lpString=".sys") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sys") returned 0x0 [0040.190] lstrlenW (lpString=".v2i") returned 4 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".v2i") returned 0x0 [0040.190] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.190] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch="s\r\n.v2i") returned 0x0 [0040.190] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.190] lstrlenW (lpString=".sql") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sql") returned 0x0 [0040.191] lstrlenW (lpString=".mdf") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".mdf") returned 0x0 [0040.191] lstrlenW (lpString=".txt") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".txt") returned 0x0 [0040.191] lstrlenW (lpString=".dbf") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dbf") returned 0x0 [0040.191] lstrlenW (lpString=".ckp") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ckp") returned 0x0 [0040.191] lstrlenW (lpString=".dacpac") returned 7 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dacpac") returned 0x0 [0040.191] lstrlenW (lpString=".db3") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".db3") returned 0x0 [0040.191] lstrlenW (lpString=".dtxs") returned 5 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dtxs") returned 0x0 [0040.191] lstrlenW (lpString=".mdt") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".mdt") returned 0x0 [0040.191] lstrlenW (lpString=".sdf") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".sdf") returned 0x0 [0040.191] lstrlenW (lpString=".MDF") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".MDF") returned 0x0 [0040.191] lstrlenW (lpString=".DBF") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DBF") returned 0x0 [0040.191] lstrlenW (lpString=".DB") returned 3 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DB") returned 0x0 [0040.191] lstrlenW (lpString=".db") returned 3 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".db") returned 0x0 [0040.191] lstrlenW (lpString=".ndf") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ndf") returned 0x0 [0040.191] lstrlenW (lpString=".NDF") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".NDF") returned 0x0 [0040.191] lstrlenW (lpString=".Mdf") returned 4 [0040.191] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".Mdf") returned 0x0 [0040.191] lstrlenW (lpString=".dat") returned 4 [0040.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".dat") returned 0x0 [0040.192] lstrlenW (lpString=".DAT") returned 4 [0040.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".DAT") returned 0x0 [0040.192] lstrlenW (lpString=".ldf") returned 4 [0040.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".ldf") returned 0x0 [0040.192] lstrlenW (lpString=".LDF") returned 4 [0040.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch=".LDF") returned 0x0 [0040.192] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.192] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0040.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.192] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.193] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.193] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0040.193] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16019382426) returned 1 [0040.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6c50190, dwHighDateTime=0x1d585b4)) [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294838 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294838 | out: hHeap=0x260000) returned 1 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29cf80 [0040.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0040.193] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.193] GetLastError () returned 0x0 [0040.193] GetLastError () returned 0x0 [0040.193] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.194] GetLastError () returned 0x0 [0040.194] GetLastError () returned 0x0 [0040.194] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.197] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.197] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0040.197] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.197] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.292] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.292] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.292] CloseHandle (hObject=0x108) returned 1 [0040.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.293] GetLastError () returned 0x0 [0040.293] RtlWakeConditionVariable () returned 0x27e828 [0040.293] GetCurrentThreadId () returned 0x9ac [0040.293] GetCurrentThreadId () returned 0x9ac [0040.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0040.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5ec8 | out: hHeap=0x260000) returned 1 [0040.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0040.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5ec8 [0040.293] lstrlenW (lpString=".ldf") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".ldf") returned 0x0 [0040.294] lstrlenW (lpString=".vhd") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".vhd") returned 0x0 [0040.294] lstrlenW (lpString=".vhdx") returned 5 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".vhdx") returned 0x0 [0040.294] lstrlenW (lpString=".pst") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".pst") returned 0x0 [0040.294] lstrlenW (lpString=".ost") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".ost") returned 0x0 [0040.294] lstrlenW (lpString=".bak") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".bak") returned 0x0 [0040.294] lstrlenW (lpString=".bac") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".bac") returned 0x0 [0040.294] lstrlenW (lpString=".sys") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".sys") returned 0x0 [0040.294] lstrlenW (lpString=".v2i") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".v2i") returned 0x0 [0040.294] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.294] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.294] lstrlenW (lpString=".sql") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".sql") returned 0x0 [0040.294] lstrlenW (lpString=".mdf") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".mdf") returned 0x0 [0040.294] lstrlenW (lpString=".txt") returned 4 [0040.294] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".txt") returned 0x0 [0040.294] lstrlenW (lpString=".dbf") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".dbf") returned 0x0 [0040.295] lstrlenW (lpString=".ckp") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".ckp") returned 0x0 [0040.295] lstrlenW (lpString=".dacpac") returned 7 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".dacpac") returned 0x0 [0040.295] lstrlenW (lpString=".db3") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".db3") returned 0x0 [0040.295] lstrlenW (lpString=".dtxs") returned 5 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".dtxs") returned 0x0 [0040.295] lstrlenW (lpString=".mdt") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".mdt") returned 0x0 [0040.295] lstrlenW (lpString=".sdf") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".sdf") returned 0x0 [0040.295] lstrlenW (lpString=".MDF") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".MDF") returned 0x0 [0040.295] lstrlenW (lpString=".DBF") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".DBF") returned 0x0 [0040.295] lstrlenW (lpString=".DB") returned 3 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".DB") returned 0x0 [0040.295] lstrlenW (lpString=".db") returned 3 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".db") returned 0x0 [0040.295] lstrlenW (lpString=".ndf") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".ndf") returned 0x0 [0040.295] lstrlenW (lpString=".NDF") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".NDF") returned 0x0 [0040.295] lstrlenW (lpString=".Mdf") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".Mdf") returned 0x0 [0040.295] lstrlenW (lpString=".dat") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".dat") returned 0x0 [0040.295] lstrlenW (lpString=".DAT") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".DAT") returned 0x0 [0040.295] lstrlenW (lpString=".ldf") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".ldf") returned 0x0 [0040.295] lstrlenW (lpString=".LDF") returned 4 [0040.295] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch=".LDF") returned 0x0 [0040.296] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.296] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0040.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.296] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.296] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.296] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x314ae0 [0040.297] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16029765804) returned 1 [0040.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6d5ab30, dwHighDateTime=0x1d585b4)) [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949f8 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949f8 | out: hHeap=0x260000) returned 1 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5d78 [0040.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5d78 | out: hHeap=0x260000) returned 1 [0040.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.297] GetLastError () returned 0x0 [0040.297] GetLastError () returned 0x0 [0040.297] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.297] GetLastError () returned 0x0 [0040.297] GetLastError () returned 0x0 [0040.297] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x2213, lpOverlapped=0x0) returned 1 [0040.300] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdded, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.300] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2213, lpOverlapped=0x0) returned 1 [0040.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0040.300] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.300] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.300] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.300] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.300] CloseHandle (hObject=0x108) returned 1 [0040.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.[deadmin@cock.li].deadmin")) returned 1 [0040.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0040.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.301] GetLastError () returned 0x0 [0040.301] RtlWakeConditionVariable () returned 0x27e828 [0040.301] GetCurrentThreadId () returned 0x9ac [0040.301] GetCurrentThreadId () returned 0x9ac [0040.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d68 | out: hHeap=0x260000) returned 1 [0040.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a30 | out: hHeap=0x260000) returned 1 [0040.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9d68 [0040.301] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.304] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.304] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.304] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.304] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.305] CloseHandle (hObject=0x108) returned 1 [0040.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d68 | out: hHeap=0x260000) returned 1 [0040.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.305] RtlWakeConditionVariable () returned 0x27e828 [0040.305] GetCurrentThreadId () returned 0x9ac [0040.305] GetCurrentThreadId () returned 0x9ac [0040.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0040.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297be0 | out: hHeap=0x260000) returned 1 [0040.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a68 | out: hHeap=0x260000) returned 1 [0040.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297be0 [0040.305] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\all users\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.306] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.306] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.306] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.306] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.307] CloseHandle (hObject=0x108) returned 1 [0040.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297be0 | out: hHeap=0x260000) returned 1 [0040.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.308] RtlWakeConditionVariable () returned 0x27e828 [0040.308] GetCurrentThreadId () returned 0x9ac [0040.308] GetCurrentThreadId () returned 0x9ac [0040.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0040.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d138 | out: hHeap=0x260000) returned 1 [0040.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0040.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5ff0 [0040.308] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\msocache\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.308] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.308] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.308] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.308] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.309] CloseHandle (hObject=0x108) returned 1 [0040.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5ff0 | out: hHeap=0x260000) returned 1 [0040.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0040.309] RtlWakeConditionVariable () returned 0x27e828 [0040.309] GetCurrentThreadId () returned 0x9ac [0040.309] GetCurrentThreadId () returned 0x9ac [0040.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294aa0 [0040.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b48 | out: hHeap=0x260000) returned 1 [0040.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0040.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b10 [0040.309] lstrlenW (lpString=".ldf") returned 4 [0040.309] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".ldf") returned 0x0 [0040.310] lstrlenW (lpString=".vhd") returned 4 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".vhd") returned 0x0 [0040.310] lstrlenW (lpString=".vhdx") returned 5 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".vhdx") returned 0x0 [0040.310] lstrlenW (lpString=".pst") returned 4 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".pst") returned 0x0 [0040.310] lstrlenW (lpString=".ost") returned 4 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".ost") returned 0x0 [0040.310] lstrlenW (lpString=".bak") returned 4 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".bak") returned 0x0 [0040.310] lstrlenW (lpString=".bac") returned 4 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".bac") returned 0x0 [0040.310] lstrlenW (lpString=".sys") returned 4 [0040.310] StrStrW (lpFirst="\\\\?\\C:\\pagefile.sys", lpSrch=".sys") returned=".sys" [0040.310] lstrlenW (lpString=".sys") returned 4 [0040.310] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0040.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0040.310] RtlWakeConditionVariable () returned 0x27e828 [0040.310] GetCurrentThreadId () returned 0x9ac [0040.310] GetCurrentThreadId () returned 0x9ac [0040.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0040.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ad8 | out: hHeap=0x260000) returned 1 [0040.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297cd0 [0040.311] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\perflogs\\admin\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.315] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.315] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.315] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.315] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.316] CloseHandle (hObject=0x108) returned 1 [0040.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.316] RtlWakeConditionVariable () returned 0x27e828 [0040.316] GetCurrentThreadId () returned 0x9ac [0040.316] GetCurrentThreadId () returned 0x9ac [0040.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0040.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0040.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0040.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5ff0 [0040.316] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\perflogs\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.316] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.316] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.316] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.316] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.317] CloseHandle (hObject=0x108) returned 1 [0040.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5ff0 | out: hHeap=0x260000) returned 1 [0040.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0040.317] RtlWakeConditionVariable () returned 0x27e828 [0040.317] GetCurrentThreadId () returned 0x9ac [0040.318] GetCurrentThreadId () returned 0x9ac [0040.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b80 [0040.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c28 | out: hHeap=0x260000) returned 1 [0040.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0040.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bf0 [0040.318] lstrlenW (lpString=".ldf") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".ldf") returned 0x0 [0040.318] lstrlenW (lpString=".vhd") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".vhd") returned 0x0 [0040.318] lstrlenW (lpString=".vhdx") returned 5 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".vhdx") returned 0x0 [0040.318] lstrlenW (lpString=".pst") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".pst") returned 0x0 [0040.318] lstrlenW (lpString=".ost") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".ost") returned 0x0 [0040.318] lstrlenW (lpString=".bak") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".bak") returned 0x0 [0040.318] lstrlenW (lpString=".bac") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".bac") returned 0x0 [0040.318] lstrlenW (lpString=".sys") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".sys") returned 0x0 [0040.318] lstrlenW (lpString=".v2i") returned 4 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch=".v2i") returned 0x0 [0040.318] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\.", lpSrch="s\r\n.v2i") returned 0x0 [0040.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\." (normalized: "c:\\program files\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0040.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0040.318] RtlWakeConditionVariable () returned 0x27e828 [0040.318] GetCurrentThreadId () returned 0x9ac [0040.318] GetCurrentThreadId () returned 0x9ac [0040.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b80 [0040.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c98 | out: hHeap=0x260000) returned 1 [0040.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0040.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c60 [0040.319] lstrlenW (lpString=".ldf") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".ldf") returned 0x0 [0040.319] lstrlenW (lpString=".vhd") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".vhd") returned 0x0 [0040.319] lstrlenW (lpString=".vhdx") returned 5 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".vhdx") returned 0x0 [0040.319] lstrlenW (lpString=".pst") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".pst") returned 0x0 [0040.319] lstrlenW (lpString=".ost") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".ost") returned 0x0 [0040.319] lstrlenW (lpString=".bak") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".bak") returned 0x0 [0040.319] lstrlenW (lpString=".bac") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".bac") returned 0x0 [0040.319] lstrlenW (lpString=".sys") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".sys") returned 0x0 [0040.319] lstrlenW (lpString=".v2i") returned 4 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch=".v2i") returned 0x0 [0040.319] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\..", lpSrch="s\r\n.v2i") returned 0x0 [0040.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0040.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0040.319] RtlWakeConditionVariable () returned 0x27e828 [0040.319] GetCurrentThreadId () returned 0x9ac [0040.319] GetCurrentThreadId () returned 0x9ac [0040.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0040.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0040.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0040.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297d48 [0040.320] lstrlenW (lpString=".ldf") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".ldf") returned 0x0 [0040.320] lstrlenW (lpString=".vhd") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".vhd") returned 0x0 [0040.320] lstrlenW (lpString=".vhdx") returned 5 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".vhdx") returned 0x0 [0040.320] lstrlenW (lpString=".pst") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".pst") returned 0x0 [0040.320] lstrlenW (lpString=".ost") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".ost") returned 0x0 [0040.320] lstrlenW (lpString=".bak") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".bak") returned 0x0 [0040.320] lstrlenW (lpString=".bac") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".bac") returned 0x0 [0040.320] lstrlenW (lpString=".sys") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".sys") returned 0x0 [0040.320] lstrlenW (lpString=".v2i") returned 4 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".v2i") returned 0x0 [0040.320] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0040.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.321] lstrlenW (lpString=".sql") returned 4 [0040.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".sql") returned 0x0 [0040.321] lstrlenW (lpString=".mdf") returned 4 [0040.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".mdf") returned 0x0 [0040.321] lstrlenW (lpString=".txt") returned 4 [0040.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".txt") returned 0x0 [0040.321] lstrlenW (lpString=".dbf") returned 4 [0040.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".dbf") returned 0x0 [0040.321] lstrlenW (lpString=".ckp") returned 4 [0040.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".ckp") returned 0x0 [0040.321] lstrlenW (lpString=".dacpac") returned 7 [0040.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".dacpac") returned 0x0 [0040.322] lstrlenW (lpString=".db3") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".db3") returned 0x0 [0040.322] lstrlenW (lpString=".dtxs") returned 5 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".dtxs") returned 0x0 [0040.322] lstrlenW (lpString=".mdt") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".mdt") returned 0x0 [0040.322] lstrlenW (lpString=".sdf") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".sdf") returned 0x0 [0040.322] lstrlenW (lpString=".MDF") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".MDF") returned 0x0 [0040.322] lstrlenW (lpString=".DBF") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".DBF") returned 0x0 [0040.322] lstrlenW (lpString=".DB") returned 3 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".DB") returned 0x0 [0040.322] lstrlenW (lpString=".db") returned 3 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".db") returned 0x0 [0040.322] lstrlenW (lpString=".ndf") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".ndf") returned 0x0 [0040.322] lstrlenW (lpString=".NDF") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".NDF") returned 0x0 [0040.322] lstrlenW (lpString=".Mdf") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".Mdf") returned 0x0 [0040.322] lstrlenW (lpString=".dat") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".dat") returned 0x0 [0040.322] lstrlenW (lpString=".DAT") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".DAT") returned 0x0 [0040.322] lstrlenW (lpString=".ldf") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".ldf") returned 0x0 [0040.322] lstrlenW (lpString=".LDF") returned 4 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch=".LDF") returned 0x0 [0040.322] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3838 [0040.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.323] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.323] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.323] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16032459669) returned 1 [0040.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6d80c90, dwHighDateTime=0x1d585b4)) [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297cd0 [0040.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e5d0 [0040.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297cd0 | out: hHeap=0x260000) returned 1 [0040.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0040.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e5d0 | out: hHeap=0x260000) returned 1 [0040.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.324] GetLastError () returned 0x0 [0040.324] GetLastError () returned 0x0 [0040.324] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.324] GetLastError () returned 0x0 [0040.324] GetLastError () returned 0x0 [0040.324] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x18340, lpOverlapped=0x0) returned 1 [0040.341] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7cc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.341] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x18340, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x18340, lpOverlapped=0x0) returned 1 [0040.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0040.343] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.343] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.343] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.343] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.344] CloseHandle (hObject=0x108) returned 1 [0040.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.448] GetLastError () returned 0x0 [0040.448] RtlWakeConditionVariable () returned 0x27e828 [0040.448] GetCurrentThreadId () returned 0x9ac [0040.448] GetCurrentThreadId () returned 0x9ac [0040.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c8d8 | out: hHeap=0x260000) returned 1 [0040.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f58 | out: hHeap=0x260000) returned 1 [0040.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c8d8 [0040.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.540] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.540] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.540] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.540] WriteFile (in: hFile=0xfc, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.541] CloseHandle (hObject=0xfc) returned 1 [0040.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c8d8 | out: hHeap=0x260000) returned 1 [0040.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.541] RtlWakeConditionVariable () returned 0x27e828 [0040.541] GetCurrentThreadId () returned 0x9ac [0040.541] GetCurrentThreadId () returned 0x9ac [0040.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296e48 | out: hHeap=0x260000) returned 1 [0040.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0040.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296e48 [0040.541] lstrlenW (lpString=".ldf") returned 4 [0040.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".ldf") returned 0x0 [0040.541] lstrlenW (lpString=".vhd") returned 4 [0040.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".vhd") returned 0x0 [0040.541] lstrlenW (lpString=".vhdx") returned 5 [0040.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".vhdx") returned 0x0 [0040.541] lstrlenW (lpString=".pst") returned 4 [0040.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".pst") returned 0x0 [0040.541] lstrlenW (lpString=".ost") returned 4 [0040.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".ost") returned 0x0 [0040.542] lstrlenW (lpString=".bak") returned 4 [0040.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".bak") returned 0x0 [0040.542] lstrlenW (lpString=".bac") returned 4 [0040.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".bac") returned 0x0 [0040.542] lstrlenW (lpString=".sys") returned 4 [0040.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".sys") returned 0x0 [0040.542] lstrlenW (lpString=".v2i") returned 4 [0040.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".v2i") returned 0x0 [0040.542] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0040.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.545] lstrlenW (lpString=".sql") returned 4 [0040.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".sql") returned 0x0 [0040.546] lstrlenW (lpString=".mdf") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".mdf") returned 0x0 [0040.546] lstrlenW (lpString=".txt") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".txt") returned 0x0 [0040.546] lstrlenW (lpString=".dbf") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".dbf") returned 0x0 [0040.546] lstrlenW (lpString=".ckp") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".ckp") returned 0x0 [0040.546] lstrlenW (lpString=".dacpac") returned 7 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".dacpac") returned 0x0 [0040.546] lstrlenW (lpString=".db3") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".db3") returned 0x0 [0040.546] lstrlenW (lpString=".dtxs") returned 5 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".dtxs") returned 0x0 [0040.546] lstrlenW (lpString=".mdt") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".mdt") returned 0x0 [0040.546] lstrlenW (lpString=".sdf") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".sdf") returned 0x0 [0040.546] lstrlenW (lpString=".MDF") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".MDF") returned 0x0 [0040.546] lstrlenW (lpString=".DBF") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".DBF") returned 0x0 [0040.546] lstrlenW (lpString=".DB") returned 3 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".DB") returned 0x0 [0040.546] lstrlenW (lpString=".db") returned 3 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".db") returned 0x0 [0040.546] lstrlenW (lpString=".ndf") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".ndf") returned 0x0 [0040.546] lstrlenW (lpString=".NDF") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".NDF") returned 0x0 [0040.546] lstrlenW (lpString=".Mdf") returned 4 [0040.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".Mdf") returned 0x0 [0040.546] lstrlenW (lpString=".dat") returned 4 [0040.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".dat") returned 0x0 [0040.547] lstrlenW (lpString=".DAT") returned 4 [0040.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".DAT") returned 0x0 [0040.547] lstrlenW (lpString=".ldf") returned 4 [0040.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".ldf") returned 0x0 [0040.547] lstrlenW (lpString=".LDF") returned 4 [0040.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch=".LDF") returned 0x0 [0040.547] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x295790 [0040.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.547] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.548] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.548] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.548] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16054908123) returned 1 [0040.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa6fbc130, dwHighDateTime=0x1d585b4)) [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295038 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295038 | out: hHeap=0x260000) returned 1 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0040.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.549] GetLastError () returned 0x0 [0040.549] GetLastError () returned 0x0 [0040.549] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.549] GetLastError () returned 0x0 [0040.549] GetLastError () returned 0x0 [0040.549] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.553] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.553] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.553] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.553] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.567] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.567] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.567] CloseHandle (hObject=0xfc) returned 1 [0040.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.[deadmin@cock.li].deadmin")) returned 1 [0040.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.568] GetLastError () returned 0x0 [0040.568] RtlWakeConditionVariable () returned 0x27e828 [0040.568] GetCurrentThreadId () returned 0x9ac [0040.568] GetCurrentThreadId () returned 0x9ac [0040.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296f78 | out: hHeap=0x260000) returned 1 [0040.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0040.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296f78 [0040.568] lstrlenW (lpString=".ldf") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.568] lstrlenW (lpString=".vhd") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".vhd") returned 0x0 [0040.568] lstrlenW (lpString=".vhdx") returned 5 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".vhdx") returned 0x0 [0040.568] lstrlenW (lpString=".pst") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".pst") returned 0x0 [0040.568] lstrlenW (lpString=".ost") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".ost") returned 0x0 [0040.568] lstrlenW (lpString=".bak") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".bak") returned 0x0 [0040.568] lstrlenW (lpString=".bac") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".bac") returned 0x0 [0040.568] lstrlenW (lpString=".sys") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".sys") returned 0x0 [0040.568] lstrlenW (lpString=".v2i") returned 4 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".v2i") returned 0x0 [0040.568] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.612] lstrlenW (lpString=".sql") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".sql") returned 0x0 [0040.612] lstrlenW (lpString=".mdf") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".mdf") returned 0x0 [0040.612] lstrlenW (lpString=".txt") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".txt") returned 0x0 [0040.612] lstrlenW (lpString=".dbf") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".dbf") returned 0x0 [0040.612] lstrlenW (lpString=".ckp") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".ckp") returned 0x0 [0040.612] lstrlenW (lpString=".dacpac") returned 7 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".dacpac") returned 0x0 [0040.612] lstrlenW (lpString=".db3") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".db3") returned 0x0 [0040.612] lstrlenW (lpString=".dtxs") returned 5 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".dtxs") returned 0x0 [0040.612] lstrlenW (lpString=".mdt") returned 4 [0040.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".mdt") returned 0x0 [0040.613] lstrlenW (lpString=".sdf") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".sdf") returned 0x0 [0040.613] lstrlenW (lpString=".MDF") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".MDF") returned 0x0 [0040.613] lstrlenW (lpString=".DBF") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".DBF") returned 0x0 [0040.613] lstrlenW (lpString=".DB") returned 3 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".DB") returned 0x0 [0040.613] lstrlenW (lpString=".db") returned 3 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".db") returned 0x0 [0040.613] lstrlenW (lpString=".ndf") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".ndf") returned 0x0 [0040.613] lstrlenW (lpString=".NDF") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".NDF") returned 0x0 [0040.613] lstrlenW (lpString=".Mdf") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".Mdf") returned 0x0 [0040.613] lstrlenW (lpString=".dat") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".dat") returned 0x0 [0040.613] lstrlenW (lpString=".DAT") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".DAT") returned 0x0 [0040.613] lstrlenW (lpString=".ldf") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".ldf") returned 0x0 [0040.613] lstrlenW (lpString=".LDF") returned 4 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch=".LDF") returned 0x0 [0040.613] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5320 [0040.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.613] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.614] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.614] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x315ae0 [0040.614] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16061562093) returned 1 [0040.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa70546b0, dwHighDateTime=0x1d585b4)) [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295070 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295070 | out: hHeap=0x260000) returned 1 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296e48 [0040.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.615] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.615] GetLastError () returned 0x0 [0040.615] GetLastError () returned 0x0 [0040.615] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.615] GetLastError () returned 0x0 [0040.615] GetLastError () returned 0x0 [0040.616] ReadFile (in: hFile=0x108, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.619] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.619] WriteFile (in: hFile=0x108, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.620] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.620] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.621] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.621] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.622] CloseHandle (hObject=0x108) returned 1 [0040.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0040.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.622] GetLastError () returned 0x0 [0040.623] RtlWakeConditionVariable () returned 0x27e828 [0040.623] GetCurrentThreadId () returned 0x9ac [0040.623] GetCurrentThreadId () returned 0x9ac [0040.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0040.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2971d8 | out: hHeap=0x260000) returned 1 [0040.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0040.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0040.623] lstrlenW (lpString=".ldf") returned 4 [0040.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".ldf") returned 0x0 [0040.623] lstrlenW (lpString=".vhd") returned 4 [0040.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".vhd") returned 0x0 [0040.623] lstrlenW (lpString=".vhdx") returned 5 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".vhdx") returned 0x0 [0040.624] lstrlenW (lpString=".pst") returned 4 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".pst") returned 0x0 [0040.624] lstrlenW (lpString=".ost") returned 4 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".ost") returned 0x0 [0040.624] lstrlenW (lpString=".bak") returned 4 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".bak") returned 0x0 [0040.624] lstrlenW (lpString=".bac") returned 4 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".bac") returned 0x0 [0040.624] lstrlenW (lpString=".sys") returned 4 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".sys") returned 0x0 [0040.624] lstrlenW (lpString=".v2i") returned 4 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".v2i") returned 0x0 [0040.624] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch="s\r\n.v2i") returned 0x0 [0040.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.759] lstrlenW (lpString=".sql") returned 4 [0040.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".sql") returned 0x0 [0040.771] lstrlenW (lpString=".mdf") returned 4 [0040.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".mdf") returned 0x0 [0040.771] lstrlenW (lpString=".txt") returned 4 [0040.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".txt") returned 0x0 [0040.778] lstrlenW (lpString=".dbf") returned 4 [0040.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".dbf") returned 0x0 [0040.779] lstrlenW (lpString=".ckp") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".ckp") returned 0x0 [0040.779] lstrlenW (lpString=".dacpac") returned 7 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".dacpac") returned 0x0 [0040.779] lstrlenW (lpString=".db3") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".db3") returned 0x0 [0040.779] lstrlenW (lpString=".dtxs") returned 5 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".dtxs") returned 0x0 [0040.779] lstrlenW (lpString=".mdt") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".mdt") returned 0x0 [0040.779] lstrlenW (lpString=".sdf") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".sdf") returned 0x0 [0040.779] lstrlenW (lpString=".MDF") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".MDF") returned 0x0 [0040.779] lstrlenW (lpString=".DBF") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".DBF") returned 0x0 [0040.779] lstrlenW (lpString=".DB") returned 3 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".DB") returned 0x0 [0040.779] lstrlenW (lpString=".db") returned 3 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".db") returned 0x0 [0040.779] lstrlenW (lpString=".ndf") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".ndf") returned 0x0 [0040.779] lstrlenW (lpString=".NDF") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".NDF") returned 0x0 [0040.779] lstrlenW (lpString=".Mdf") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".Mdf") returned 0x0 [0040.779] lstrlenW (lpString=".dat") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".dat") returned 0x0 [0040.779] lstrlenW (lpString=".DAT") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".DAT") returned 0x0 [0040.779] lstrlenW (lpString=".ldf") returned 4 [0040.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".ldf") returned 0x0 [0040.780] lstrlenW (lpString=".LDF") returned 4 [0040.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch=".LDF") returned 0x0 [0040.780] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0040.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0040.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f16f0 [0040.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0040.780] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0040.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0040.780] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0040.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0040.781] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16078175590) returned 1 [0040.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa71f75d0, dwHighDateTime=0x1d585b4)) [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295428 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0040.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0040.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e288 [0040.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0040.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0040.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.781] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0040.781] GetLastError () returned 0x0 [0040.781] GetLastError () returned 0x0 [0040.781] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0040.781] GetLastError () returned 0x0 [0040.782] GetLastError () returned 0x0 [0040.782] ReadFile (in: hFile=0xfc, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.784] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.784] WriteFile (in: hFile=0xfc, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0040.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0040.785] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.785] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0040.785] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0040.785] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0040.785] CloseHandle (hObject=0xfc) returned 1 [0040.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0040.785] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.[deadmin@cock.li].deadmin")) returned 1 [0040.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0040.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0040.786] GetLastError () returned 0x0 [0040.786] RtlWakeConditionVariable () returned 0x27e828 [0040.787] GetCurrentThreadId () returned 0x9ac [0040.787] GetCurrentThreadId () returned 0x9ac [0040.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0040.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0040.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0040.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.818] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.818] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.818] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.818] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.819] CloseHandle (hObject=0x10c) returned 1 [0040.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c488 | out: hHeap=0x260000) returned 1 [0040.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.819] RtlWakeConditionVariable () returned 0x27e828 [0040.819] GetCurrentThreadId () returned 0x9ac [0040.819] GetCurrentThreadId () returned 0x9ac [0040.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6168 | out: hHeap=0x260000) returned 1 [0040.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295540 | out: hHeap=0x260000) returned 1 [0040.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6168 [0040.820] lstrlenW (lpString=".ldf") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.820] lstrlenW (lpString=".vhd") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.820] lstrlenW (lpString=".vhdx") returned 5 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.820] lstrlenW (lpString=".pst") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.820] lstrlenW (lpString=".ost") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.820] lstrlenW (lpString=".bak") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.820] lstrlenW (lpString=".bac") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.820] lstrlenW (lpString=".sys") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.820] lstrlenW (lpString=".v2i") returned 4 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.820] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.820] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6168 | out: hHeap=0x260000) returned 1 [0040.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0040.820] RtlWakeConditionVariable () returned 0x27e828 [0040.820] GetCurrentThreadId () returned 0x9ac [0040.820] GetCurrentThreadId () returned 0x9ac [0040.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cbb8 | out: hHeap=0x260000) returned 1 [0040.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7470 | out: hHeap=0x260000) returned 1 [0040.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29cbb8 [0040.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.849] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.849] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.849] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.849] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.850] CloseHandle (hObject=0x10c) returned 1 [0040.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cbb8 | out: hHeap=0x260000) returned 1 [0040.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.851] RtlWakeConditionVariable () returned 0x27e828 [0040.851] GetCurrentThreadId () returned 0x9ac [0040.851] GetCurrentThreadId () returned 0x9ac [0040.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0040.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75c0 | out: hHeap=0x260000) returned 1 [0040.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0040.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.854] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.854] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.854] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.854] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.855] CloseHandle (hObject=0x10c) returned 1 [0040.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0040.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.855] RtlWakeConditionVariable () returned 0x27e828 [0040.856] GetCurrentThreadId () returned 0x9ac [0040.856] GetCurrentThreadId () returned 0x9ac [0040.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2120 | out: hHeap=0x260000) returned 1 [0040.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7630 | out: hHeap=0x260000) returned 1 [0040.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2120 [0040.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.858] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.858] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0040.858] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0040.858] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0040.859] CloseHandle (hObject=0x10c) returned 1 [0040.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2120 | out: hHeap=0x260000) returned 1 [0040.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.859] RtlWakeConditionVariable () returned 0x27e828 [0040.860] GetCurrentThreadId () returned 0x9ac [0040.860] GetCurrentThreadId () returned 0x9ac [0040.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0040.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76a0 | out: hHeap=0x260000) returned 1 [0040.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6750 [0040.860] lstrlenW (lpString=".ldf") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".ldf") returned 0x0 [0040.860] lstrlenW (lpString=".vhd") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".vhd") returned 0x0 [0040.860] lstrlenW (lpString=".vhdx") returned 5 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".vhdx") returned 0x0 [0040.860] lstrlenW (lpString=".pst") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".pst") returned 0x0 [0040.860] lstrlenW (lpString=".ost") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".ost") returned 0x0 [0040.860] lstrlenW (lpString=".bak") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".bak") returned 0x0 [0040.860] lstrlenW (lpString=".bac") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".bac") returned 0x0 [0040.860] lstrlenW (lpString=".sys") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".sys") returned 0x0 [0040.860] lstrlenW (lpString=".v2i") returned 4 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch=".v2i") returned 0x0 [0040.860] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6750 | out: hHeap=0x260000) returned 1 [0040.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.861] RtlWakeConditionVariable () returned 0x27e828 [0040.861] GetCurrentThreadId () returned 0x9ac [0040.861] GetCurrentThreadId () returned 0x9ac [0040.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f67f8 | out: hHeap=0x260000) returned 1 [0040.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76d8 | out: hHeap=0x260000) returned 1 [0040.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f67f8 [0040.861] lstrlenW (lpString=".ldf") returned 4 [0040.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".ldf") returned 0x0 [0040.861] lstrlenW (lpString=".vhd") returned 4 [0040.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".vhd") returned 0x0 [0040.861] lstrlenW (lpString=".vhdx") returned 5 [0040.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".vhdx") returned 0x0 [0040.861] lstrlenW (lpString=".pst") returned 4 [0040.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".pst") returned 0x0 [0040.861] lstrlenW (lpString=".ost") returned 4 [0040.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".ost") returned 0x0 [0040.862] lstrlenW (lpString=".bak") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".bak") returned 0x0 [0040.862] lstrlenW (lpString=".bac") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".bac") returned 0x0 [0040.862] lstrlenW (lpString=".sys") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".sys") returned 0x0 [0040.862] lstrlenW (lpString=".v2i") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch=".v2i") returned 0x0 [0040.862] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f67f8 | out: hHeap=0x260000) returned 1 [0040.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.862] RtlWakeConditionVariable () returned 0x27e828 [0040.862] GetCurrentThreadId () returned 0x9ac [0040.862] GetCurrentThreadId () returned 0x9ac [0040.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f68a0 | out: hHeap=0x260000) returned 1 [0040.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7710 | out: hHeap=0x260000) returned 1 [0040.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f68a0 [0040.862] lstrlenW (lpString=".ldf") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".ldf") returned 0x0 [0040.862] lstrlenW (lpString=".vhd") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".vhd") returned 0x0 [0040.862] lstrlenW (lpString=".vhdx") returned 5 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".vhdx") returned 0x0 [0040.862] lstrlenW (lpString=".pst") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".pst") returned 0x0 [0040.862] lstrlenW (lpString=".ost") returned 4 [0040.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".ost") returned 0x0 [0040.862] lstrlenW (lpString=".bak") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".bak") returned 0x0 [0040.863] lstrlenW (lpString=".bac") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".bac") returned 0x0 [0040.863] lstrlenW (lpString=".sys") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".sys") returned 0x0 [0040.863] lstrlenW (lpString=".v2i") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch=".v2i") returned 0x0 [0040.863] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f68a0 | out: hHeap=0x260000) returned 1 [0040.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.863] RtlWakeConditionVariable () returned 0x27e828 [0040.863] GetCurrentThreadId () returned 0x9ac [0040.863] GetCurrentThreadId () returned 0x9ac [0040.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6948 | out: hHeap=0x260000) returned 1 [0040.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7748 | out: hHeap=0x260000) returned 1 [0040.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6948 [0040.863] lstrlenW (lpString=".ldf") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".ldf") returned 0x0 [0040.863] lstrlenW (lpString=".vhd") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".vhd") returned 0x0 [0040.863] lstrlenW (lpString=".vhdx") returned 5 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".vhdx") returned 0x0 [0040.863] lstrlenW (lpString=".pst") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".pst") returned 0x0 [0040.863] lstrlenW (lpString=".ost") returned 4 [0040.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".ost") returned 0x0 [0040.863] lstrlenW (lpString=".bak") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".bak") returned 0x0 [0040.864] lstrlenW (lpString=".bac") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".bac") returned 0x0 [0040.864] lstrlenW (lpString=".sys") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".sys") returned 0x0 [0040.864] lstrlenW (lpString=".v2i") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch=".v2i") returned 0x0 [0040.864] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6948 | out: hHeap=0x260000) returned 1 [0040.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.864] RtlWakeConditionVariable () returned 0x27e828 [0040.864] GetCurrentThreadId () returned 0x9ac [0040.864] GetCurrentThreadId () returned 0x9ac [0040.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297ac0 | out: hHeap=0x260000) returned 1 [0040.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7780 | out: hHeap=0x260000) returned 1 [0040.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0040.864] lstrlenW (lpString=".ldf") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".ldf") returned 0x0 [0040.864] lstrlenW (lpString=".vhd") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".vhd") returned 0x0 [0040.864] lstrlenW (lpString=".vhdx") returned 5 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".vhdx") returned 0x0 [0040.864] lstrlenW (lpString=".pst") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".pst") returned 0x0 [0040.864] lstrlenW (lpString=".ost") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".ost") returned 0x0 [0040.864] lstrlenW (lpString=".bak") returned 4 [0040.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".bak") returned 0x0 [0040.864] lstrlenW (lpString=".bac") returned 4 [0040.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".bac") returned 0x0 [0040.865] lstrlenW (lpString=".sys") returned 4 [0040.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".sys") returned 0x0 [0040.865] lstrlenW (lpString=".v2i") returned 4 [0040.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch=".v2i") returned 0x0 [0040.865] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297ac0 | out: hHeap=0x260000) returned 1 [0040.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296b50 | out: hHeap=0x260000) returned 1 [0040.865] RtlWakeConditionVariable () returned 0x27e828 [0040.865] GetCurrentThreadId () returned 0x9ac [0040.865] GetCurrentThreadId () returned 0x9ac [0040.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ef8 | out: hHeap=0x260000) returned 1 [0040.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0040.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ef8 [0040.866] lstrlenW (lpString=".ldf") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".ldf") returned 0x0 [0040.866] lstrlenW (lpString=".vhd") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".vhd") returned 0x0 [0040.866] lstrlenW (lpString=".vhdx") returned 5 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".vhdx") returned 0x0 [0040.866] lstrlenW (lpString=".pst") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".pst") returned 0x0 [0040.866] lstrlenW (lpString=".ost") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".ost") returned 0x0 [0040.866] lstrlenW (lpString=".bak") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".bak") returned 0x0 [0040.866] lstrlenW (lpString=".bac") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".bac") returned 0x0 [0040.866] lstrlenW (lpString=".sys") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".sys") returned 0x0 [0040.866] lstrlenW (lpString=".v2i") returned 4 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch=".v2i") returned 0x0 [0040.866] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ef8 | out: hHeap=0x260000) returned 1 [0040.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.867] RtlWakeConditionVariable () returned 0x27e828 [0040.867] GetCurrentThreadId () returned 0x9ac [0040.867] GetCurrentThreadId () returned 0x9ac [0040.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f69f0 | out: hHeap=0x260000) returned 1 [0040.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77f0 | out: hHeap=0x260000) returned 1 [0040.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f69f0 [0040.867] lstrlenW (lpString=".ldf") returned 4 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".ldf") returned 0x0 [0040.867] lstrlenW (lpString=".vhd") returned 4 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".vhd") returned 0x0 [0040.867] lstrlenW (lpString=".vhdx") returned 5 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.867] lstrlenW (lpString=".pst") returned 4 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".pst") returned 0x0 [0040.867] lstrlenW (lpString=".ost") returned 4 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".ost") returned 0x0 [0040.867] lstrlenW (lpString=".bak") returned 4 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".bak") returned 0x0 [0040.867] lstrlenW (lpString=".bac") returned 4 [0040.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".bac") returned 0x0 [0040.868] lstrlenW (lpString=".sys") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".sys") returned 0x0 [0040.868] lstrlenW (lpString=".v2i") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch=".v2i") returned 0x0 [0040.868] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f69f0 | out: hHeap=0x260000) returned 1 [0040.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.868] RtlWakeConditionVariable () returned 0x27e828 [0040.868] GetCurrentThreadId () returned 0x9ac [0040.868] GetCurrentThreadId () returned 0x9ac [0040.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6a98 | out: hHeap=0x260000) returned 1 [0040.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7828 | out: hHeap=0x260000) returned 1 [0040.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6a98 [0040.868] lstrlenW (lpString=".ldf") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".ldf") returned 0x0 [0040.868] lstrlenW (lpString=".vhd") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".vhd") returned 0x0 [0040.868] lstrlenW (lpString=".vhdx") returned 5 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".vhdx") returned 0x0 [0040.868] lstrlenW (lpString=".pst") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".pst") returned 0x0 [0040.868] lstrlenW (lpString=".ost") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".ost") returned 0x0 [0040.868] lstrlenW (lpString=".bak") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".bak") returned 0x0 [0040.868] lstrlenW (lpString=".bac") returned 4 [0040.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".bac") returned 0x0 [0040.869] lstrlenW (lpString=".sys") returned 4 [0040.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".sys") returned 0x0 [0040.869] lstrlenW (lpString=".v2i") returned 4 [0040.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch=".v2i") returned 0x0 [0040.869] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6a98 | out: hHeap=0x260000) returned 1 [0040.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.869] RtlWakeConditionVariable () returned 0x27e828 [0040.869] GetCurrentThreadId () returned 0x9ac [0040.869] GetCurrentThreadId () returned 0x9ac [0040.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9fc0 | out: hHeap=0x260000) returned 1 [0040.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7860 | out: hHeap=0x260000) returned 1 [0040.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9fc0 [0040.870] lstrlenW (lpString=".ldf") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".ldf") returned 0x0 [0040.870] lstrlenW (lpString=".vhd") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".vhd") returned 0x0 [0040.870] lstrlenW (lpString=".vhdx") returned 5 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".vhdx") returned 0x0 [0040.870] lstrlenW (lpString=".pst") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".pst") returned 0x0 [0040.870] lstrlenW (lpString=".ost") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".ost") returned 0x0 [0040.870] lstrlenW (lpString=".bak") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".bak") returned 0x0 [0040.870] lstrlenW (lpString=".bac") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".bac") returned 0x0 [0040.870] lstrlenW (lpString=".sys") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".sys") returned 0x0 [0040.870] lstrlenW (lpString=".v2i") returned 4 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch=".v2i") returned 0x0 [0040.870] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9fc0 | out: hHeap=0x260000) returned 1 [0040.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.871] RtlWakeConditionVariable () returned 0x27e828 [0040.871] GetCurrentThreadId () returned 0x9ac [0040.871] GetCurrentThreadId () returned 0x9ac [0040.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f21d8 | out: hHeap=0x260000) returned 1 [0040.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7898 | out: hHeap=0x260000) returned 1 [0040.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f21d8 [0040.871] lstrlenW (lpString=".ldf") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".ldf") returned 0x0 [0040.871] lstrlenW (lpString=".vhd") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".vhd") returned 0x0 [0040.871] lstrlenW (lpString=".vhdx") returned 5 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.871] lstrlenW (lpString=".pst") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".pst") returned 0x0 [0040.871] lstrlenW (lpString=".ost") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".ost") returned 0x0 [0040.871] lstrlenW (lpString=".bak") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".bak") returned 0x0 [0040.871] lstrlenW (lpString=".bac") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".bac") returned 0x0 [0040.871] lstrlenW (lpString=".sys") returned 4 [0040.871] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".sys") returned 0x0 [0040.872] lstrlenW (lpString=".v2i") returned 4 [0040.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch=".v2i") returned 0x0 [0040.872] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f21d8 | out: hHeap=0x260000) returned 1 [0040.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.872] RtlWakeConditionVariable () returned 0x27e828 [0040.872] GetCurrentThreadId () returned 0x9ac [0040.872] GetCurrentThreadId () returned 0x9ac [0040.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0040.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d78d0 | out: hHeap=0x260000) returned 1 [0040.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.872] lstrlenW (lpString=".ldf") returned 4 [0040.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".ldf") returned 0x0 [0040.872] lstrlenW (lpString=".vhd") returned 4 [0040.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".vhd") returned 0x0 [0040.872] lstrlenW (lpString=".vhdx") returned 5 [0040.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.872] lstrlenW (lpString=".pst") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".pst") returned 0x0 [0040.873] lstrlenW (lpString=".ost") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".ost") returned 0x0 [0040.873] lstrlenW (lpString=".bak") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".bak") returned 0x0 [0040.873] lstrlenW (lpString=".bac") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".bac") returned 0x0 [0040.873] lstrlenW (lpString=".sys") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".sys") returned 0x0 [0040.873] lstrlenW (lpString=".v2i") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch=".v2i") returned 0x0 [0040.873] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ba78 | out: hHeap=0x260000) returned 1 [0040.873] RtlWakeConditionVariable () returned 0x27e828 [0040.873] GetCurrentThreadId () returned 0x9ac [0040.873] GetCurrentThreadId () returned 0x9ac [0040.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0040.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ae0 | out: hHeap=0x260000) returned 1 [0040.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7908 | out: hHeap=0x260000) returned 1 [0040.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f8ae0 [0040.873] lstrlenW (lpString=".ldf") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".ldf") returned 0x0 [0040.873] lstrlenW (lpString=".vhd") returned 4 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".vhd") returned 0x0 [0040.873] lstrlenW (lpString=".vhdx") returned 5 [0040.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".vhdx") returned 0x0 [0040.874] lstrlenW (lpString=".pst") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".pst") returned 0x0 [0040.874] lstrlenW (lpString=".ost") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".ost") returned 0x0 [0040.874] lstrlenW (lpString=".bak") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".bak") returned 0x0 [0040.874] lstrlenW (lpString=".bac") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".bac") returned 0x0 [0040.874] lstrlenW (lpString=".sys") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".sys") returned 0x0 [0040.874] lstrlenW (lpString=".v2i") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch=".v2i") returned 0x0 [0040.874] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpSrch="s\r\n.v2i") returned 0x0 [0040.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8ae0 | out: hHeap=0x260000) returned 1 [0040.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296b50 | out: hHeap=0x260000) returned 1 [0040.874] RtlWakeConditionVariable () returned 0x27e828 [0040.874] GetCurrentThreadId () returned 0x9ac [0040.874] GetCurrentThreadId () returned 0x9ac [0040.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6b40 | out: hHeap=0x260000) returned 1 [0040.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7940 | out: hHeap=0x260000) returned 1 [0040.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6b40 [0040.874] lstrlenW (lpString=".ldf") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".ldf") returned 0x0 [0040.874] lstrlenW (lpString=".vhd") returned 4 [0040.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".vhd") returned 0x0 [0040.874] lstrlenW (lpString=".vhdx") returned 5 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.875] lstrlenW (lpString=".pst") returned 4 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".pst") returned 0x0 [0040.875] lstrlenW (lpString=".ost") returned 4 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".ost") returned 0x0 [0040.875] lstrlenW (lpString=".bak") returned 4 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".bak") returned 0x0 [0040.875] lstrlenW (lpString=".bac") returned 4 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".bac") returned 0x0 [0040.875] lstrlenW (lpString=".sys") returned 4 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".sys") returned 0x0 [0040.875] lstrlenW (lpString=".v2i") returned 4 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch=".v2i") returned 0x0 [0040.875] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6b40 | out: hHeap=0x260000) returned 1 [0040.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.876] RtlWakeConditionVariable () returned 0x27e828 [0040.876] GetCurrentThreadId () returned 0x9ac [0040.876] GetCurrentThreadId () returned 0x9ac [0040.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6be8 | out: hHeap=0x260000) returned 1 [0040.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7978 | out: hHeap=0x260000) returned 1 [0040.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6be8 [0040.876] lstrlenW (lpString=".ldf") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".ldf") returned 0x0 [0040.876] lstrlenW (lpString=".vhd") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".vhd") returned 0x0 [0040.876] lstrlenW (lpString=".vhdx") returned 5 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".vhdx") returned 0x0 [0040.876] lstrlenW (lpString=".pst") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".pst") returned 0x0 [0040.876] lstrlenW (lpString=".ost") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".ost") returned 0x0 [0040.876] lstrlenW (lpString=".bak") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".bak") returned 0x0 [0040.876] lstrlenW (lpString=".bac") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".bac") returned 0x0 [0040.876] lstrlenW (lpString=".sys") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".sys") returned 0x0 [0040.876] lstrlenW (lpString=".v2i") returned 4 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch=".v2i") returned 0x0 [0040.876] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6be8 | out: hHeap=0x260000) returned 1 [0040.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.877] RtlWakeConditionVariable () returned 0x27e828 [0040.877] GetCurrentThreadId () returned 0x9ac [0040.877] GetCurrentThreadId () returned 0x9ac [0040.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6c90 | out: hHeap=0x260000) returned 1 [0040.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d79b0 | out: hHeap=0x260000) returned 1 [0040.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6c90 [0040.877] lstrlenW (lpString=".ldf") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".ldf") returned 0x0 [0040.877] lstrlenW (lpString=".vhd") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".vhd") returned 0x0 [0040.877] lstrlenW (lpString=".vhdx") returned 5 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.877] lstrlenW (lpString=".pst") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".pst") returned 0x0 [0040.877] lstrlenW (lpString=".ost") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".ost") returned 0x0 [0040.877] lstrlenW (lpString=".bak") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".bak") returned 0x0 [0040.877] lstrlenW (lpString=".bac") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".bac") returned 0x0 [0040.877] lstrlenW (lpString=".sys") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".sys") returned 0x0 [0040.877] lstrlenW (lpString=".v2i") returned 4 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch=".v2i") returned 0x0 [0040.877] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6c90 | out: hHeap=0x260000) returned 1 [0040.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.905] RtlWakeConditionVariable () returned 0x27e828 [0040.905] GetCurrentThreadId () returned 0x9ac [0040.905] GetCurrentThreadId () returned 0x9ac [0040.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f64b0 [0040.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0040.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0040.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6360 [0040.905] lstrlenW (lpString=".ldf") returned 4 [0040.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0040.905] lstrlenW (lpString=".vhd") returned 4 [0040.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0040.905] lstrlenW (lpString=".vhdx") returned 5 [0040.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0040.905] lstrlenW (lpString=".pst") returned 4 [0040.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0040.905] lstrlenW (lpString=".ost") returned 4 [0040.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0040.906] lstrlenW (lpString=".bak") returned 4 [0040.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0040.906] lstrlenW (lpString=".bac") returned 4 [0040.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0040.906] lstrlenW (lpString=".sys") returned 4 [0040.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0040.906] lstrlenW (lpString=".v2i") returned 4 [0040.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0040.906] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0040.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0040.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0040.937] RtlWakeConditionVariable () returned 0x27e828 [0040.937] GetCurrentThreadId () returned 0x9ac [0040.937] GetCurrentThreadId () returned 0x9ac [0040.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0040.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f48 | out: hHeap=0x260000) returned 1 [0040.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0040.937] lstrlenW (lpString=".ldf") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".ldf") returned 0x0 [0040.937] lstrlenW (lpString=".vhd") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".vhd") returned 0x0 [0040.937] lstrlenW (lpString=".vhdx") returned 5 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".vhdx") returned 0x0 [0040.937] lstrlenW (lpString=".pst") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".pst") returned 0x0 [0040.937] lstrlenW (lpString=".ost") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".ost") returned 0x0 [0040.937] lstrlenW (lpString=".bak") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".bak") returned 0x0 [0040.937] lstrlenW (lpString=".bac") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".bac") returned 0x0 [0040.937] lstrlenW (lpString=".sys") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".sys") returned 0x0 [0040.937] lstrlenW (lpString=".v2i") returned 4 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch=".v2i") returned 0x0 [0040.937] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0040.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.939] RtlWakeConditionVariable () returned 0x27e828 [0040.939] GetCurrentThreadId () returned 0x9ac [0040.939] GetCurrentThreadId () returned 0x9ac [0040.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da218 | out: hHeap=0x260000) returned 1 [0040.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7f80 | out: hHeap=0x260000) returned 1 [0040.939] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da218 [0040.939] lstrlenW (lpString=".ldf") returned 4 [0040.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".ldf") returned 0x0 [0040.939] lstrlenW (lpString=".vhd") returned 4 [0040.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".vhd") returned 0x0 [0040.939] lstrlenW (lpString=".vhdx") returned 5 [0040.939] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".vhdx") returned 0x0 [0040.939] lstrlenW (lpString=".pst") returned 4 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".pst") returned 0x0 [0040.940] lstrlenW (lpString=".ost") returned 4 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".ost") returned 0x0 [0040.940] lstrlenW (lpString=".bak") returned 4 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".bak") returned 0x0 [0040.940] lstrlenW (lpString=".bac") returned 4 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".bac") returned 0x0 [0040.940] lstrlenW (lpString=".sys") returned 4 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".sys") returned 0x0 [0040.940] lstrlenW (lpString=".v2i") returned 4 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch=".v2i") returned 0x0 [0040.940] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da218 | out: hHeap=0x260000) returned 1 [0040.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0040.985] RtlWakeConditionVariable () returned 0x27e828 [0040.985] GetCurrentThreadId () returned 0x9ac [0040.985] GetCurrentThreadId () returned 0x9ac [0040.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0040.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bbe8 | out: hHeap=0x260000) returned 1 [0040.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8258 | out: hHeap=0x260000) returned 1 [0040.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bbe8 [0040.985] lstrlenW (lpString=".ldf") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".ldf") returned 0x0 [0040.985] lstrlenW (lpString=".vhd") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".vhd") returned 0x0 [0040.985] lstrlenW (lpString=".vhdx") returned 5 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".vhdx") returned 0x0 [0040.985] lstrlenW (lpString=".pst") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".pst") returned 0x0 [0040.985] lstrlenW (lpString=".ost") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".ost") returned 0x0 [0040.985] lstrlenW (lpString=".bak") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".bak") returned 0x0 [0040.985] lstrlenW (lpString=".bac") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".bac") returned 0x0 [0040.985] lstrlenW (lpString=".sys") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".sys") returned 0x0 [0040.985] lstrlenW (lpString=".v2i") returned 4 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch=".v2i") returned 0x0 [0040.985] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bbe8 | out: hHeap=0x260000) returned 1 [0040.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0040.997] RtlWakeConditionVariable () returned 0x27e828 [0040.997] GetCurrentThreadId () returned 0x9ac [0040.997] GetCurrentThreadId () returned 0x9ac [0040.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0040.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da790 | out: hHeap=0x260000) returned 1 [0040.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8338 | out: hHeap=0x260000) returned 1 [0040.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da790 [0040.998] lstrlenW (lpString=".ldf") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".ldf") returned 0x0 [0040.998] lstrlenW (lpString=".vhd") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".vhd") returned 0x0 [0040.998] lstrlenW (lpString=".vhdx") returned 5 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".vhdx") returned 0x0 [0040.998] lstrlenW (lpString=".pst") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".pst") returned 0x0 [0040.998] lstrlenW (lpString=".ost") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".ost") returned 0x0 [0040.998] lstrlenW (lpString=".bak") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".bak") returned 0x0 [0040.998] lstrlenW (lpString=".bac") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".bac") returned 0x0 [0040.998] lstrlenW (lpString=".sys") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".sys") returned 0x0 [0040.998] lstrlenW (lpString=".v2i") returned 4 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch=".v2i") returned 0x0 [0040.998] lstrlenW (lpString="s\r\n.v2i") returned 7 [0040.998] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", lpSrch="s\r\n.v2i") returned 0x0 [0040.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da790 | out: hHeap=0x260000) returned 1 [0041.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.017] RtlWakeConditionVariable () returned 0x27e828 [0041.017] GetCurrentThreadId () returned 0x9ac [0041.017] GetCurrentThreadId () returned 0x9ac [0041.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f30f0 | out: hHeap=0x260000) returned 1 [0041.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b68 | out: hHeap=0x260000) returned 1 [0041.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f30f0 [0041.017] lstrlenW (lpString=".ldf") returned 4 [0041.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".ldf") returned 0x0 [0041.017] lstrlenW (lpString=".vhd") returned 4 [0041.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".vhd") returned 0x0 [0041.017] lstrlenW (lpString=".vhdx") returned 5 [0041.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".vhdx") returned 0x0 [0041.017] lstrlenW (lpString=".pst") returned 4 [0041.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".pst") returned 0x0 [0041.017] lstrlenW (lpString=".ost") returned 4 [0041.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".ost") returned 0x0 [0041.017] lstrlenW (lpString=".bak") returned 4 [0041.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".bak") returned 0x0 [0041.018] lstrlenW (lpString=".bac") returned 4 [0041.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".bac") returned 0x0 [0041.018] lstrlenW (lpString=".sys") returned 4 [0041.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".sys") returned 0x0 [0041.018] lstrlenW (lpString=".v2i") returned 4 [0041.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch=".v2i") returned 0x0 [0041.018] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f30f0 | out: hHeap=0x260000) returned 1 [0041.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2b30 | out: hHeap=0x260000) returned 1 [0041.031] RtlWakeConditionVariable () returned 0x27e828 [0041.031] GetCurrentThreadId () returned 0x9ac [0041.031] GetCurrentThreadId () returned 0x9ac [0041.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0041.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0d88 | out: hHeap=0x260000) returned 1 [0041.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da538 [0041.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.040] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.040] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.040] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.040] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.041] CloseHandle (hObject=0x100) returned 1 [0041.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da538 | out: hHeap=0x260000) returned 1 [0041.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0041.041] RtlWakeConditionVariable () returned 0x27e828 [0041.041] GetCurrentThreadId () returned 0x9ac [0041.041] GetCurrentThreadId () returned 0x9ac [0041.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7710 | out: hHeap=0x260000) returned 1 [0041.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c80 | out: hHeap=0x260000) returned 1 [0041.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0041.042] lstrlenW (lpString=".ldf") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.042] lstrlenW (lpString=".vhd") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.042] lstrlenW (lpString=".vhdx") returned 5 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.042] lstrlenW (lpString=".pst") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.042] lstrlenW (lpString=".ost") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.042] lstrlenW (lpString=".bak") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.042] lstrlenW (lpString=".bac") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.042] lstrlenW (lpString=".sys") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.042] lstrlenW (lpString=".v2i") returned 4 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.042] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7710 | out: hHeap=0x260000) returned 1 [0041.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.104] RtlWakeConditionVariable () returned 0x27e828 [0041.104] GetCurrentThreadId () returned 0x9ac [0041.104] GetCurrentThreadId () returned 0x9ac [0041.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7908 | out: hHeap=0x260000) returned 1 [0041.105] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd28 | out: hHeap=0x260000) returned 1 [0041.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7908 [0041.106] lstrlenW (lpString=".ldf") returned 4 [0041.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".ldf") returned 0x0 [0041.107] lstrlenW (lpString=".vhd") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".vhd") returned 0x0 [0041.107] lstrlenW (lpString=".vhdx") returned 5 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".vhdx") returned 0x0 [0041.107] lstrlenW (lpString=".pst") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".pst") returned 0x0 [0041.107] lstrlenW (lpString=".ost") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".ost") returned 0x0 [0041.107] lstrlenW (lpString=".bak") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".bak") returned 0x0 [0041.107] lstrlenW (lpString=".bac") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".bac") returned 0x0 [0041.107] lstrlenW (lpString=".sys") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".sys") returned 0x0 [0041.107] lstrlenW (lpString=".v2i") returned 4 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch=".v2i") returned 0x0 [0041.107] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", lpSrch="s\r\n.v2i") returned 0x0 [0041.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7908 | out: hHeap=0x260000) returned 1 [0041.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.107] RtlWakeConditionVariable () returned 0x27e828 [0041.107] GetCurrentThreadId () returned 0x9ac [0041.107] GetCurrentThreadId () returned 0x9ac [0041.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9920 | out: hHeap=0x260000) returned 1 [0041.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd98 | out: hHeap=0x260000) returned 1 [0041.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9920 [0041.107] lstrlenW (lpString=".ldf") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".ldf") returned 0x0 [0041.108] lstrlenW (lpString=".vhd") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".vhd") returned 0x0 [0041.108] lstrlenW (lpString=".vhdx") returned 5 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".vhdx") returned 0x0 [0041.108] lstrlenW (lpString=".pst") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".pst") returned 0x0 [0041.108] lstrlenW (lpString=".ost") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".ost") returned 0x0 [0041.108] lstrlenW (lpString=".bak") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".bak") returned 0x0 [0041.108] lstrlenW (lpString=".bac") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".bac") returned 0x0 [0041.108] lstrlenW (lpString=".sys") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".sys") returned 0x0 [0041.108] lstrlenW (lpString=".v2i") returned 4 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch=".v2i") returned 0x0 [0041.108] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9920 | out: hHeap=0x260000) returned 1 [0041.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.108] RtlWakeConditionVariable () returned 0x27e828 [0041.108] GetCurrentThreadId () returned 0x9ac [0041.108] GetCurrentThreadId () returned 0x9ac [0041.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f99b8 | out: hHeap=0x260000) returned 1 [0041.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efdd0 | out: hHeap=0x260000) returned 1 [0041.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f99b8 [0041.108] lstrlenW (lpString=".ldf") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".ldf") returned 0x0 [0041.109] lstrlenW (lpString=".vhd") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".vhd") returned 0x0 [0041.109] lstrlenW (lpString=".vhdx") returned 5 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".vhdx") returned 0x0 [0041.109] lstrlenW (lpString=".pst") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".pst") returned 0x0 [0041.109] lstrlenW (lpString=".ost") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".ost") returned 0x0 [0041.109] lstrlenW (lpString=".bak") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".bak") returned 0x0 [0041.109] lstrlenW (lpString=".bac") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".bac") returned 0x0 [0041.109] lstrlenW (lpString=".sys") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".sys") returned 0x0 [0041.109] lstrlenW (lpString=".v2i") returned 4 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch=".v2i") returned 0x0 [0041.109] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f99b8 | out: hHeap=0x260000) returned 1 [0041.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.119] RtlWakeConditionVariable () returned 0x27e828 [0041.119] GetCurrentThreadId () returned 0x9ac [0041.119] GetCurrentThreadId () returned 0x9ac [0041.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9cb0 | out: hHeap=0x260000) returned 1 [0041.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efee8 | out: hHeap=0x260000) returned 1 [0041.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f9cb0 [0041.119] lstrlenW (lpString=".ldf") returned 4 [0041.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".ldf") returned 0x0 [0041.119] lstrlenW (lpString=".vhd") returned 4 [0041.119] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".vhd") returned 0x0 [0041.119] lstrlenW (lpString=".vhdx") returned 5 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".vhdx") returned 0x0 [0041.120] lstrlenW (lpString=".pst") returned 4 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".pst") returned 0x0 [0041.120] lstrlenW (lpString=".ost") returned 4 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".ost") returned 0x0 [0041.120] lstrlenW (lpString=".bak") returned 4 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".bak") returned 0x0 [0041.120] lstrlenW (lpString=".bac") returned 4 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".bac") returned 0x0 [0041.120] lstrlenW (lpString=".sys") returned 4 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".sys") returned 0x0 [0041.120] lstrlenW (lpString=".v2i") returned 4 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch=".v2i") returned 0x0 [0041.120] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.120] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", lpSrch="s\r\n.v2i") returned 0x0 [0041.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9cb0 | out: hHeap=0x260000) returned 1 [0041.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2960a0 | out: hHeap=0x260000) returned 1 [0041.131] RtlWakeConditionVariable () returned 0x27e828 [0041.131] GetCurrentThreadId () returned 0x9ac [0041.131] GetCurrentThreadId () returned 0x9ac [0041.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f79b0 | out: hHeap=0x260000) returned 1 [0041.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2effc8 | out: hHeap=0x260000) returned 1 [0041.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f79b0 [0041.131] lstrlenW (lpString=".ldf") returned 4 [0041.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.131] lstrlenW (lpString=".vhd") returned 4 [0041.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.131] lstrlenW (lpString=".vhdx") returned 5 [0041.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.131] lstrlenW (lpString=".pst") returned 4 [0041.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.131] lstrlenW (lpString=".ost") returned 4 [0041.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.131] lstrlenW (lpString=".bak") returned 4 [0041.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.132] lstrlenW (lpString=".bac") returned 4 [0041.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.132] lstrlenW (lpString=".sys") returned 4 [0041.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.132] lstrlenW (lpString=".v2i") returned 4 [0041.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.132] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f79b0 | out: hHeap=0x260000) returned 1 [0041.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.132] RtlWakeConditionVariable () returned 0x27e828 [0041.132] GetCurrentThreadId () returned 0x9ac [0041.132] GetCurrentThreadId () returned 0x9ac [0041.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3540 | out: hHeap=0x260000) returned 1 [0041.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0000 | out: hHeap=0x260000) returned 1 [0041.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3540 [0041.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.133] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.133] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.133] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.133] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.134] CloseHandle (hObject=0x100) returned 1 [0041.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3540 | out: hHeap=0x260000) returned 1 [0041.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0041.134] RtlWakeConditionVariable () returned 0x27e828 [0041.134] GetCurrentThreadId () returned 0x9ac [0041.134] GetCurrentThreadId () returned 0x9ac [0041.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0038 | out: hHeap=0x260000) returned 1 [0041.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30daf0 [0041.134] lstrlenW (lpString=".ldf") returned 4 [0041.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.134] lstrlenW (lpString=".vhd") returned 4 [0041.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.134] lstrlenW (lpString=".vhdx") returned 5 [0041.134] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.135] lstrlenW (lpString=".pst") returned 4 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.135] lstrlenW (lpString=".ost") returned 4 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.135] lstrlenW (lpString=".bak") returned 4 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.135] lstrlenW (lpString=".bac") returned 4 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.135] lstrlenW (lpString=".sys") returned 4 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.135] lstrlenW (lpString=".v2i") returned 4 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.135] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.135] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0041.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e288 | out: hHeap=0x260000) returned 1 [0041.135] RtlWakeConditionVariable () returned 0x27e828 [0041.135] GetCurrentThreadId () returned 0x9ac [0041.135] GetCurrentThreadId () returned 0x9ac [0041.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f35f8 | out: hHeap=0x260000) returned 1 [0041.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0070 | out: hHeap=0x260000) returned 1 [0041.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f35f8 [0041.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.145] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.145] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.145] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.145] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.146] CloseHandle (hObject=0x100) returned 1 [0041.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f35f8 | out: hHeap=0x260000) returned 1 [0041.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2290 | out: hHeap=0x260000) returned 1 [0041.146] RtlWakeConditionVariable () returned 0x27e828 [0041.146] GetCurrentThreadId () returned 0x9ac [0041.146] GetCurrentThreadId () returned 0x9ac [0041.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dc40 | out: hHeap=0x260000) returned 1 [0041.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0188 | out: hHeap=0x260000) returned 1 [0041.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30dc40 [0041.146] lstrlenW (lpString=".ldf") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.147] lstrlenW (lpString=".vhd") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.147] lstrlenW (lpString=".vhdx") returned 5 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.147] lstrlenW (lpString=".pst") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.147] lstrlenW (lpString=".ost") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.147] lstrlenW (lpString=".bak") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.147] lstrlenW (lpString=".bac") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.147] lstrlenW (lpString=".sys") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.147] lstrlenW (lpString=".v2i") returned 4 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.147] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dc40 | out: hHeap=0x260000) returned 1 [0041.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.222] RtlWakeConditionVariable () returned 0x27e828 [0041.222] GetCurrentThreadId () returned 0x9ac [0041.222] GetCurrentThreadId () returned 0x9ac [0041.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b570 | out: hHeap=0x260000) returned 1 [0041.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1338 | out: hHeap=0x260000) returned 1 [0041.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b570 [0041.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.229] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.229] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.229] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.229] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.230] CloseHandle (hObject=0x100) returned 1 [0041.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b570 | out: hHeap=0x260000) returned 1 [0041.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.230] RtlWakeConditionVariable () returned 0x27e828 [0041.230] GetCurrentThreadId () returned 0x9ac [0041.230] GetCurrentThreadId () returned 0x9ac [0041.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0041.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1300 | out: hHeap=0x260000) returned 1 [0041.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0041.230] lstrlenW (lpString=".ldf") returned 4 [0041.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".ldf") returned 0x0 [0041.230] lstrlenW (lpString=".vhd") returned 4 [0041.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".vhd") returned 0x0 [0041.230] lstrlenW (lpString=".vhdx") returned 5 [0041.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".vhdx") returned 0x0 [0041.230] lstrlenW (lpString=".pst") returned 4 [0041.230] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".pst") returned 0x0 [0041.231] lstrlenW (lpString=".ost") returned 4 [0041.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".ost") returned 0x0 [0041.231] lstrlenW (lpString=".bak") returned 4 [0041.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".bak") returned 0x0 [0041.231] lstrlenW (lpString=".bac") returned 4 [0041.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".bac") returned 0x0 [0041.231] lstrlenW (lpString=".sys") returned 4 [0041.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".sys") returned 0x0 [0041.231] lstrlenW (lpString=".v2i") returned 4 [0041.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch=".v2i") returned 0x0 [0041.231] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0041.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0041.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.231] RtlWakeConditionVariable () returned 0x27e828 [0041.231] GetCurrentThreadId () returned 0x9ac [0041.231] GetCurrentThreadId () returned 0x9ac [0041.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b4b8 | out: hHeap=0x260000) returned 1 [0041.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdc0 | out: hHeap=0x260000) returned 1 [0041.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0041.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.232] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.232] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.232] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.232] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.233] CloseHandle (hObject=0x100) returned 1 [0041.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b4b8 | out: hHeap=0x260000) returned 1 [0041.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.233] RtlWakeConditionVariable () returned 0x27e828 [0041.233] GetCurrentThreadId () returned 0x9ac [0041.233] GetCurrentThreadId () returned 0x9ac [0041.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3de0 | out: hHeap=0x260000) returned 1 [0041.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cdf8 | out: hHeap=0x260000) returned 1 [0041.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3de0 [0041.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.234] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.234] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0041.234] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0041.234] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0041.235] CloseHandle (hObject=0x100) returned 1 [0041.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3de0 | out: hHeap=0x260000) returned 1 [0041.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3488 | out: hHeap=0x260000) returned 1 [0041.235] RtlWakeConditionVariable () returned 0x27e828 [0041.235] GetCurrentThreadId () returned 0x9ac [0041.235] GetCurrentThreadId () returned 0x9ac [0041.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29da00 | out: hHeap=0x260000) returned 1 [0041.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0041.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29da00 [0041.235] lstrlenW (lpString=".ldf") returned 4 [0041.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".ldf") returned 0x0 [0041.235] lstrlenW (lpString=".vhd") returned 4 [0041.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".vhd") returned 0x0 [0041.235] lstrlenW (lpString=".vhdx") returned 5 [0041.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".vhdx") returned 0x0 [0041.235] lstrlenW (lpString=".pst") returned 4 [0041.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".pst") returned 0x0 [0041.235] lstrlenW (lpString=".ost") returned 4 [0041.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".ost") returned 0x0 [0041.235] lstrlenW (lpString=".bak") returned 4 [0041.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".bak") returned 0x0 [0041.236] lstrlenW (lpString=".bac") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".bac") returned 0x0 [0041.236] lstrlenW (lpString=".sys") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".sys") returned 0x0 [0041.236] lstrlenW (lpString=".v2i") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".v2i") returned 0x0 [0041.236] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.236] lstrlenW (lpString=".sql") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".sql") returned 0x0 [0041.236] lstrlenW (lpString=".mdf") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".mdf") returned 0x0 [0041.236] lstrlenW (lpString=".txt") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".txt") returned 0x0 [0041.236] lstrlenW (lpString=".dbf") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".dbf") returned 0x0 [0041.236] lstrlenW (lpString=".ckp") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".ckp") returned 0x0 [0041.236] lstrlenW (lpString=".dacpac") returned 7 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".dacpac") returned 0x0 [0041.236] lstrlenW (lpString=".db3") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".db3") returned 0x0 [0041.236] lstrlenW (lpString=".dtxs") returned 5 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".dtxs") returned 0x0 [0041.236] lstrlenW (lpString=".mdt") returned 4 [0041.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".mdt") returned 0x0 [0041.236] lstrlenW (lpString=".sdf") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".sdf") returned 0x0 [0041.237] lstrlenW (lpString=".MDF") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".MDF") returned 0x0 [0041.237] lstrlenW (lpString=".DBF") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".DBF") returned 0x0 [0041.237] lstrlenW (lpString=".DB") returned 3 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".DB") returned 0x0 [0041.237] lstrlenW (lpString=".db") returned 3 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".db") returned 0x0 [0041.237] lstrlenW (lpString=".ndf") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".ndf") returned 0x0 [0041.237] lstrlenW (lpString=".NDF") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".NDF") returned 0x0 [0041.237] lstrlenW (lpString=".Mdf") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".Mdf") returned 0x0 [0041.237] lstrlenW (lpString=".dat") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".dat") returned 0x0 [0041.237] lstrlenW (lpString=".DAT") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".DAT") returned 0x0 [0041.237] lstrlenW (lpString=".ldf") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".ldf") returned 0x0 [0041.237] lstrlenW (lpString=".LDF") returned 4 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch=".LDF") returned 0x0 [0041.237] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.237] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.238] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.238] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16123942028) returned 1 [0041.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7647db0, dwHighDateTime=0x1d585b4)) [0041.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0041.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0041.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e9c0 [0041.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e9c0 | out: hHeap=0x260000) returned 1 [0041.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.239] GetLastError () returned 0x0 [0041.239] GetLastError () returned 0x0 [0041.239] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.239] GetLastError () returned 0x0 [0041.239] GetLastError () returned 0x0 [0041.240] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.244] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.244] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.244] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.246] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.246] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.246] CloseHandle (hObject=0x100) returned 1 [0041.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.292] GetLastError () returned 0x0 [0041.293] RtlWakeConditionVariable () returned 0x27e828 [0041.293] GetCurrentThreadId () returned 0x9ac [0041.293] GetCurrentThreadId () returned 0x9ac [0041.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e420 | out: hHeap=0x260000) returned 1 [0041.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf80 | out: hHeap=0x260000) returned 1 [0041.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e420 [0041.293] lstrlenW (lpString=".ldf") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".ldf") returned 0x0 [0041.293] lstrlenW (lpString=".vhd") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".vhd") returned 0x0 [0041.293] lstrlenW (lpString=".vhdx") returned 5 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".vhdx") returned 0x0 [0041.293] lstrlenW (lpString=".pst") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".pst") returned 0x0 [0041.293] lstrlenW (lpString=".ost") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".ost") returned 0x0 [0041.293] lstrlenW (lpString=".bak") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".bak") returned 0x0 [0041.293] lstrlenW (lpString=".bac") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".bac") returned 0x0 [0041.293] lstrlenW (lpString=".sys") returned 4 [0041.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".sys") returned 0x0 [0041.293] lstrlenW (lpString=".v2i") returned 4 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".v2i") returned 0x0 [0041.294] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.294] lstrlenW (lpString=".sql") returned 4 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".sql") returned 0x0 [0041.294] lstrlenW (lpString=".mdf") returned 4 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".mdf") returned 0x0 [0041.294] lstrlenW (lpString=".txt") returned 4 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".txt") returned 0x0 [0041.294] lstrlenW (lpString=".dbf") returned 4 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".dbf") returned 0x0 [0041.294] lstrlenW (lpString=".ckp") returned 4 [0041.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".ckp") returned 0x0 [0041.295] lstrlenW (lpString=".dacpac") returned 7 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".dacpac") returned 0x0 [0041.295] lstrlenW (lpString=".db3") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".db3") returned 0x0 [0041.295] lstrlenW (lpString=".dtxs") returned 5 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".dtxs") returned 0x0 [0041.295] lstrlenW (lpString=".mdt") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".mdt") returned 0x0 [0041.295] lstrlenW (lpString=".sdf") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".sdf") returned 0x0 [0041.295] lstrlenW (lpString=".MDF") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".MDF") returned 0x0 [0041.295] lstrlenW (lpString=".DBF") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".DBF") returned 0x0 [0041.295] lstrlenW (lpString=".DB") returned 3 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".DB") returned 0x0 [0041.295] lstrlenW (lpString=".db") returned 3 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".db") returned 0x0 [0041.295] lstrlenW (lpString=".ndf") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".ndf") returned 0x0 [0041.295] lstrlenW (lpString=".NDF") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".NDF") returned 0x0 [0041.295] lstrlenW (lpString=".Mdf") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".Mdf") returned 0x0 [0041.295] lstrlenW (lpString=".dat") returned 4 [0041.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".dat") returned 0x0 [0041.295] lstrlenW (lpString=".DAT") returned 4 [0041.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".DAT") returned 0x0 [0041.296] lstrlenW (lpString=".ldf") returned 4 [0041.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".ldf") returned 0x0 [0041.296] lstrlenW (lpString=".LDF") returned 4 [0041.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch=".LDF") returned 0x0 [0041.296] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.296] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.297] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.297] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16129805568) returned 1 [0041.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa76e0330, dwHighDateTime=0x1d585b4)) [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf80 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf80 | out: hHeap=0x260000) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.297] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.298] GetLastError () returned 0x0 [0041.298] GetLastError () returned 0x0 [0041.298] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.298] GetLastError () returned 0x0 [0041.298] GetLastError () returned 0x0 [0041.298] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.303] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.303] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.304] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.304] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.315] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.315] CloseHandle (hObject=0x100) returned 1 [0041.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.316] GetLastError () returned 0x0 [0041.316] RtlWakeConditionVariable () returned 0x27e828 [0041.316] GetCurrentThreadId () returned 0x9ac [0041.316] GetCurrentThreadId () returned 0x9ac [0041.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e618 | out: hHeap=0x260000) returned 1 [0041.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cff0 | out: hHeap=0x260000) returned 1 [0041.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e618 [0041.316] lstrlenW (lpString=".ldf") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".ldf") returned 0x0 [0041.317] lstrlenW (lpString=".vhd") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".vhd") returned 0x0 [0041.317] lstrlenW (lpString=".vhdx") returned 5 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".vhdx") returned 0x0 [0041.317] lstrlenW (lpString=".pst") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".pst") returned 0x0 [0041.317] lstrlenW (lpString=".ost") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".ost") returned 0x0 [0041.317] lstrlenW (lpString=".bak") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".bak") returned 0x0 [0041.317] lstrlenW (lpString=".bac") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".bac") returned 0x0 [0041.317] lstrlenW (lpString=".sys") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".sys") returned 0x0 [0041.317] lstrlenW (lpString=".v2i") returned 4 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".v2i") returned 0x0 [0041.317] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.318] lstrlenW (lpString=".sql") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".sql") returned 0x0 [0041.318] lstrlenW (lpString=".mdf") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".mdf") returned 0x0 [0041.318] lstrlenW (lpString=".txt") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".txt") returned 0x0 [0041.318] lstrlenW (lpString=".dbf") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".dbf") returned 0x0 [0041.318] lstrlenW (lpString=".ckp") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".ckp") returned 0x0 [0041.318] lstrlenW (lpString=".dacpac") returned 7 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".dacpac") returned 0x0 [0041.318] lstrlenW (lpString=".db3") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".db3") returned 0x0 [0041.318] lstrlenW (lpString=".dtxs") returned 5 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".dtxs") returned 0x0 [0041.318] lstrlenW (lpString=".mdt") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".mdt") returned 0x0 [0041.318] lstrlenW (lpString=".sdf") returned 4 [0041.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".sdf") returned 0x0 [0041.319] lstrlenW (lpString=".MDF") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".MDF") returned 0x0 [0041.319] lstrlenW (lpString=".DBF") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".DBF") returned 0x0 [0041.319] lstrlenW (lpString=".DB") returned 3 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".DB") returned 0x0 [0041.319] lstrlenW (lpString=".db") returned 3 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".db") returned 0x0 [0041.319] lstrlenW (lpString=".ndf") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".ndf") returned 0x0 [0041.319] lstrlenW (lpString=".NDF") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".NDF") returned 0x0 [0041.319] lstrlenW (lpString=".Mdf") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".Mdf") returned 0x0 [0041.319] lstrlenW (lpString=".dat") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".dat") returned 0x0 [0041.319] lstrlenW (lpString=".DAT") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".DAT") returned 0x0 [0041.319] lstrlenW (lpString=".ldf") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".ldf") returned 0x0 [0041.319] lstrlenW (lpString=".LDF") returned 4 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch=".LDF") returned 0x0 [0041.319] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.320] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.320] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.320] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.321] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16132179599) returned 1 [0041.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7706490, dwHighDateTime=0x1d585b4)) [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cff0 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cff0 | out: hHeap=0x260000) returned 1 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e420 [0041.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e420 | out: hHeap=0x260000) returned 1 [0041.321] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.321] GetLastError () returned 0x0 [0041.322] GetLastError () returned 0x0 [0041.322] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.322] GetLastError () returned 0x0 [0041.322] GetLastError () returned 0x0 [0041.322] ReadFile (in: hFile=0x100, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.330] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.330] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.331] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.331] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.331] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.331] CloseHandle (hObject=0x100) returned 1 [0041.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.332] GetLastError () returned 0x0 [0041.332] RtlWakeConditionVariable () returned 0x27e828 [0041.332] GetCurrentThreadId () returned 0x9ac [0041.332] GetCurrentThreadId () returned 0x9ac [0041.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e6c0 | out: hHeap=0x260000) returned 1 [0041.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d028 | out: hHeap=0x260000) returned 1 [0041.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.333] lstrlenW (lpString=".ldf") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".ldf") returned 0x0 [0041.333] lstrlenW (lpString=".vhd") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".vhd") returned 0x0 [0041.333] lstrlenW (lpString=".vhdx") returned 5 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".vhdx") returned 0x0 [0041.333] lstrlenW (lpString=".pst") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".pst") returned 0x0 [0041.333] lstrlenW (lpString=".ost") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".ost") returned 0x0 [0041.333] lstrlenW (lpString=".bak") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".bak") returned 0x0 [0041.333] lstrlenW (lpString=".bac") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".bac") returned 0x0 [0041.333] lstrlenW (lpString=".sys") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".sys") returned 0x0 [0041.333] lstrlenW (lpString=".v2i") returned 4 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".v2i") returned 0x0 [0041.333] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0041.334] lstrlenW (lpString=".sql") returned 4 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".sql") returned 0x0 [0041.334] lstrlenW (lpString=".mdf") returned 4 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".mdf") returned 0x0 [0041.334] lstrlenW (lpString=".txt") returned 4 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".txt") returned 0x0 [0041.334] lstrlenW (lpString=".dbf") returned 4 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".dbf") returned 0x0 [0041.334] lstrlenW (lpString=".ckp") returned 4 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".ckp") returned 0x0 [0041.334] lstrlenW (lpString=".dacpac") returned 7 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".dacpac") returned 0x0 [0041.334] lstrlenW (lpString=".db3") returned 4 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".db3") returned 0x0 [0041.334] lstrlenW (lpString=".dtxs") returned 5 [0041.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".dtxs") returned 0x0 [0041.335] lstrlenW (lpString=".mdt") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".mdt") returned 0x0 [0041.335] lstrlenW (lpString=".sdf") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".sdf") returned 0x0 [0041.335] lstrlenW (lpString=".MDF") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".MDF") returned 0x0 [0041.335] lstrlenW (lpString=".DBF") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".DBF") returned 0x0 [0041.335] lstrlenW (lpString=".DB") returned 3 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".DB") returned 0x0 [0041.335] lstrlenW (lpString=".db") returned 3 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".db") returned 0x0 [0041.335] lstrlenW (lpString=".ndf") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".ndf") returned 0x0 [0041.335] lstrlenW (lpString=".NDF") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".NDF") returned 0x0 [0041.335] lstrlenW (lpString=".Mdf") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".Mdf") returned 0x0 [0041.335] lstrlenW (lpString=".dat") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".dat") returned 0x0 [0041.335] lstrlenW (lpString=".DAT") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".DAT") returned 0x0 [0041.335] lstrlenW (lpString=".ldf") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".ldf") returned 0x0 [0041.335] lstrlenW (lpString=".LDF") returned 4 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch=".LDF") returned 0x0 [0041.335] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0041.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.336] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.337] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0041.337] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16133784210) returned 1 [0041.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa772c5f0, dwHighDateTime=0x1d585b4)) [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d028 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d028 | out: hHeap=0x260000) returned 1 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e618 [0041.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0041.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e618 | out: hHeap=0x260000) returned 1 [0041.337] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.337] GetLastError () returned 0x0 [0041.338] GetLastError () returned 0x0 [0041.338] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.338] GetLastError () returned 0x0 [0041.338] GetLastError () returned 0x0 [0041.338] ReadFile (in: hFile=0x100, lpBuffer=0x277a058, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.373] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.373] WriteFile (in: hFile=0x100, lpBuffer=0x277a058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277a058*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277a058 | out: hHeap=0x260000) returned 1 [0041.374] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.374] WriteFile (in: hFile=0x100, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.381] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.381] CloseHandle (hObject=0x100) returned 1 [0041.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0041.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.542] GetLastError () returned 0x0 [0041.542] RtlWakeConditionVariable () returned 0x27e828 [0041.542] GetCurrentThreadId () returned 0x9ac [0041.542] GetCurrentThreadId () returned 0x9ac [0041.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eab0 | out: hHeap=0x260000) returned 1 [0041.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1418 | out: hHeap=0x260000) returned 1 [0041.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eab0 [0041.542] lstrlenW (lpString=".ldf") returned 4 [0041.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".ldf") returned 0x0 [0041.542] lstrlenW (lpString=".vhd") returned 4 [0041.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".vhd") returned 0x0 [0041.542] lstrlenW (lpString=".vhdx") returned 5 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".vhdx") returned 0x0 [0041.543] lstrlenW (lpString=".pst") returned 4 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".pst") returned 0x0 [0041.543] lstrlenW (lpString=".ost") returned 4 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".ost") returned 0x0 [0041.543] lstrlenW (lpString=".bak") returned 4 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".bak") returned 0x0 [0041.543] lstrlenW (lpString=".bac") returned 4 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".bac") returned 0x0 [0041.543] lstrlenW (lpString=".sys") returned 4 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".sys") returned 0x0 [0041.543] lstrlenW (lpString=".v2i") returned 4 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".v2i") returned 0x0 [0041.543] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.703] lstrlenW (lpString=".sql") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".sql") returned 0x0 [0041.703] lstrlenW (lpString=".mdf") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".mdf") returned 0x0 [0041.703] lstrlenW (lpString=".txt") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".txt") returned 0x0 [0041.703] lstrlenW (lpString=".dbf") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".dbf") returned 0x0 [0041.703] lstrlenW (lpString=".ckp") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".ckp") returned 0x0 [0041.703] lstrlenW (lpString=".dacpac") returned 7 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".dacpac") returned 0x0 [0041.703] lstrlenW (lpString=".db3") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".db3") returned 0x0 [0041.703] lstrlenW (lpString=".dtxs") returned 5 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".dtxs") returned 0x0 [0041.703] lstrlenW (lpString=".mdt") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".mdt") returned 0x0 [0041.703] lstrlenW (lpString=".sdf") returned 4 [0041.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".sdf") returned 0x0 [0041.703] lstrlenW (lpString=".MDF") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".MDF") returned 0x0 [0041.704] lstrlenW (lpString=".DBF") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".DBF") returned 0x0 [0041.704] lstrlenW (lpString=".DB") returned 3 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".DB") returned 0x0 [0041.704] lstrlenW (lpString=".db") returned 3 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".db") returned 0x0 [0041.704] lstrlenW (lpString=".ndf") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".ndf") returned 0x0 [0041.704] lstrlenW (lpString=".NDF") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".NDF") returned 0x0 [0041.704] lstrlenW (lpString=".Mdf") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".Mdf") returned 0x0 [0041.704] lstrlenW (lpString=".dat") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".dat") returned 0x0 [0041.704] lstrlenW (lpString=".DAT") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".DAT") returned 0x0 [0041.704] lstrlenW (lpString=".ldf") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".ldf") returned 0x0 [0041.704] lstrlenW (lpString=".LDF") returned 4 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch=".LDF") returned 0x0 [0041.704] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.704] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.705] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.705] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.706] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16170700835) returned 1 [0041.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7abe6f0, dwHighDateTime=0x1d585b4)) [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337f90 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337f90 | out: hHeap=0x260000) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0041.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0041.706] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.707] GetLastError () returned 0x0 [0041.707] GetLastError () returned 0x0 [0041.707] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.707] GetLastError () returned 0x0 [0041.707] GetLastError () returned 0x0 [0041.707] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x3db8, lpOverlapped=0x0) returned 1 [0041.710] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.710] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3db8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3db8, lpOverlapped=0x0) returned 1 [0041.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.714] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.714] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.714] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.714] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.714] CloseHandle (hObject=0xfc) returned 1 [0041.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0041.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.725] GetLastError () returned 0x0 [0041.725] RtlWakeConditionVariable () returned 0x27e828 [0041.725] GetCurrentThreadId () returned 0x9ac [0041.725] GetCurrentThreadId () returned 0x9ac [0041.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0041.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d438 | out: hHeap=0x260000) returned 1 [0041.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312af8 [0041.725] lstrlenW (lpString=".ldf") returned 4 [0041.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".ldf") returned 0x0 [0041.725] lstrlenW (lpString=".vhd") returned 4 [0041.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".vhd") returned 0x0 [0041.725] lstrlenW (lpString=".vhdx") returned 5 [0041.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".vhdx") returned 0x0 [0041.725] lstrlenW (lpString=".pst") returned 4 [0041.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".pst") returned 0x0 [0041.725] lstrlenW (lpString=".ost") returned 4 [0041.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".ost") returned 0x0 [0041.725] lstrlenW (lpString=".bak") returned 4 [0041.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".bak") returned 0x0 [0041.726] lstrlenW (lpString=".bac") returned 4 [0041.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".bac") returned 0x0 [0041.726] lstrlenW (lpString=".sys") returned 4 [0041.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".sys") returned 0x0 [0041.726] lstrlenW (lpString=".v2i") returned 4 [0041.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".v2i") returned 0x0 [0041.726] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.726] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.727] lstrlenW (lpString=".sql") returned 4 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".sql") returned 0x0 [0041.727] lstrlenW (lpString=".mdf") returned 4 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".mdf") returned 0x0 [0041.727] lstrlenW (lpString=".txt") returned 4 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".txt") returned 0x0 [0041.727] lstrlenW (lpString=".dbf") returned 4 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".dbf") returned 0x0 [0041.727] lstrlenW (lpString=".ckp") returned 4 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".ckp") returned 0x0 [0041.727] lstrlenW (lpString=".dacpac") returned 7 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".dacpac") returned 0x0 [0041.727] lstrlenW (lpString=".db3") returned 4 [0041.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".db3") returned 0x0 [0041.728] lstrlenW (lpString=".dtxs") returned 5 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".dtxs") returned 0x0 [0041.728] lstrlenW (lpString=".mdt") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".mdt") returned 0x0 [0041.728] lstrlenW (lpString=".sdf") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".sdf") returned 0x0 [0041.728] lstrlenW (lpString=".MDF") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".MDF") returned 0x0 [0041.728] lstrlenW (lpString=".DBF") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".DBF") returned 0x0 [0041.728] lstrlenW (lpString=".DB") returned 3 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".DB") returned 0x0 [0041.728] lstrlenW (lpString=".db") returned 3 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".db") returned 0x0 [0041.728] lstrlenW (lpString=".ndf") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".ndf") returned 0x0 [0041.728] lstrlenW (lpString=".NDF") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".NDF") returned 0x0 [0041.728] lstrlenW (lpString=".Mdf") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".Mdf") returned 0x0 [0041.728] lstrlenW (lpString=".dat") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".dat") returned 0x0 [0041.728] lstrlenW (lpString=".DAT") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".DAT") returned 0x0 [0041.728] lstrlenW (lpString=".ldf") returned 4 [0041.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".ldf") returned 0x0 [0041.728] lstrlenW (lpString=".LDF") returned 4 [0041.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch=".LDF") returned 0x0 [0041.729] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.729] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.730] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.730] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.730] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16173108019) returned 1 [0041.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7b0a9b0, dwHighDateTime=0x1d585b4)) [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d438 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d438 | out: hHeap=0x260000) returned 1 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313510 [0041.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.731] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.731] GetLastError () returned 0x0 [0041.731] GetLastError () returned 0x0 [0041.731] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.731] GetLastError () returned 0x0 [0041.731] GetLastError () returned 0x0 [0041.731] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.735] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.735] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0041.735] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.735] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.737] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.737] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.737] CloseHandle (hObject=0xfc) returned 1 [0041.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f448 [0041.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f448 | out: hHeap=0x260000) returned 1 [0041.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.739] GetLastError () returned 0x0 [0041.739] RtlWakeConditionVariable () returned 0x27e828 [0041.739] GetCurrentThreadId () returned 0x9ac [0041.739] GetCurrentThreadId () returned 0x9ac [0041.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312b90 | out: hHeap=0x260000) returned 1 [0041.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d470 | out: hHeap=0x260000) returned 1 [0041.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312b90 [0041.739] lstrlenW (lpString=".ldf") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".ldf") returned 0x0 [0041.739] lstrlenW (lpString=".vhd") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".vhd") returned 0x0 [0041.739] lstrlenW (lpString=".vhdx") returned 5 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".vhdx") returned 0x0 [0041.739] lstrlenW (lpString=".pst") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".pst") returned 0x0 [0041.739] lstrlenW (lpString=".ost") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".ost") returned 0x0 [0041.739] lstrlenW (lpString=".bak") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".bak") returned 0x0 [0041.739] lstrlenW (lpString=".bac") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".bac") returned 0x0 [0041.739] lstrlenW (lpString=".sys") returned 4 [0041.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".sys") returned 0x0 [0041.740] lstrlenW (lpString=".v2i") returned 4 [0041.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".v2i") returned 0x0 [0041.740] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.844] lstrlenW (lpString=".sql") returned 4 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".sql") returned 0x0 [0041.844] lstrlenW (lpString=".mdf") returned 4 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".mdf") returned 0x0 [0041.844] lstrlenW (lpString=".txt") returned 4 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".txt") returned 0x0 [0041.844] lstrlenW (lpString=".dbf") returned 4 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".dbf") returned 0x0 [0041.844] lstrlenW (lpString=".ckp") returned 4 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".ckp") returned 0x0 [0041.844] lstrlenW (lpString=".dacpac") returned 7 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".dacpac") returned 0x0 [0041.844] lstrlenW (lpString=".db3") returned 4 [0041.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".db3") returned 0x0 [0041.844] lstrlenW (lpString=".dtxs") returned 5 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".dtxs") returned 0x0 [0041.845] lstrlenW (lpString=".mdt") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".mdt") returned 0x0 [0041.845] lstrlenW (lpString=".sdf") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".sdf") returned 0x0 [0041.845] lstrlenW (lpString=".MDF") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".MDF") returned 0x0 [0041.845] lstrlenW (lpString=".DBF") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".DBF") returned 0x0 [0041.845] lstrlenW (lpString=".DB") returned 3 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".DB") returned 0x0 [0041.845] lstrlenW (lpString=".db") returned 3 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".db") returned 0x0 [0041.845] lstrlenW (lpString=".ndf") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".ndf") returned 0x0 [0041.845] lstrlenW (lpString=".NDF") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".NDF") returned 0x0 [0041.845] lstrlenW (lpString=".Mdf") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".Mdf") returned 0x0 [0041.845] lstrlenW (lpString=".dat") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".dat") returned 0x0 [0041.845] lstrlenW (lpString=".DAT") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".DAT") returned 0x0 [0041.845] lstrlenW (lpString=".ldf") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".ldf") returned 0x0 [0041.845] lstrlenW (lpString=".LDF") returned 4 [0041.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch=".LDF") returned 0x0 [0041.846] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.846] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.847] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.847] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.847] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16184797948) returned 1 [0041.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7c15350, dwHighDateTime=0x1d585b4)) [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5f8 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5f8 | out: hHeap=0x260000) returned 1 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312af8 [0041.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.847] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.848] GetLastError () returned 0x0 [0041.848] GetLastError () returned 0x0 [0041.848] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] GetLastError () returned 0x0 [0041.848] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.853] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.853] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.854] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.854] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.855] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.855] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.855] CloseHandle (hObject=0xfc) returned 1 [0041.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.857] GetLastError () returned 0x0 [0041.857] RtlWakeConditionVariable () returned 0x27e828 [0041.857] GetCurrentThreadId () returned 0x9ac [0041.857] GetCurrentThreadId () returned 0x9ac [0041.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312fb8 | out: hHeap=0x260000) returned 1 [0041.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0041.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312fb8 [0041.857] lstrlenW (lpString=".ldf") returned 4 [0041.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".ldf") returned 0x0 [0041.857] lstrlenW (lpString=".vhd") returned 4 [0041.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".vhd") returned 0x0 [0041.857] lstrlenW (lpString=".vhdx") returned 5 [0041.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".vhdx") returned 0x0 [0041.857] lstrlenW (lpString=".pst") returned 4 [0041.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".pst") returned 0x0 [0041.858] lstrlenW (lpString=".ost") returned 4 [0041.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".ost") returned 0x0 [0041.858] lstrlenW (lpString=".bak") returned 4 [0041.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".bak") returned 0x0 [0041.858] lstrlenW (lpString=".bac") returned 4 [0041.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".bac") returned 0x0 [0041.858] lstrlenW (lpString=".sys") returned 4 [0041.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".sys") returned 0x0 [0041.858] lstrlenW (lpString=".v2i") returned 4 [0041.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".v2i") returned 0x0 [0041.858] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0041.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.859] lstrlenW (lpString=".sql") returned 4 [0041.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".sql") returned 0x0 [0041.859] lstrlenW (lpString=".mdf") returned 4 [0041.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".mdf") returned 0x0 [0041.859] lstrlenW (lpString=".txt") returned 4 [0041.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".txt") returned 0x0 [0041.859] lstrlenW (lpString=".dbf") returned 4 [0041.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".dbf") returned 0x0 [0041.859] lstrlenW (lpString=".ckp") returned 4 [0041.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".ckp") returned 0x0 [0041.859] lstrlenW (lpString=".dacpac") returned 7 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".dacpac") returned 0x0 [0041.860] lstrlenW (lpString=".db3") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".db3") returned 0x0 [0041.860] lstrlenW (lpString=".dtxs") returned 5 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".dtxs") returned 0x0 [0041.860] lstrlenW (lpString=".mdt") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".mdt") returned 0x0 [0041.860] lstrlenW (lpString=".sdf") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".sdf") returned 0x0 [0041.860] lstrlenW (lpString=".MDF") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".MDF") returned 0x0 [0041.860] lstrlenW (lpString=".DBF") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".DBF") returned 0x0 [0041.860] lstrlenW (lpString=".DB") returned 3 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".DB") returned 0x0 [0041.860] lstrlenW (lpString=".db") returned 3 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".db") returned 0x0 [0041.860] lstrlenW (lpString=".ndf") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".ndf") returned 0x0 [0041.860] lstrlenW (lpString=".NDF") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".NDF") returned 0x0 [0041.860] lstrlenW (lpString=".Mdf") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".Mdf") returned 0x0 [0041.860] lstrlenW (lpString=".dat") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".dat") returned 0x0 [0041.860] lstrlenW (lpString=".DAT") returned 4 [0041.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".DAT") returned 0x0 [0041.861] lstrlenW (lpString=".ldf") returned 4 [0041.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".ldf") returned 0x0 [0041.861] lstrlenW (lpString=".LDF") returned 4 [0041.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch=".LDF") returned 0x0 [0041.861] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.861] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.862] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.862] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16186312793) returned 1 [0041.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7c3b4b0, dwHighDateTime=0x1d585b4)) [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d630 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312b90 [0041.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.863] GetLastError () returned 0x0 [0041.863] GetLastError () returned 0x0 [0041.863] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.863] GetLastError () returned 0x0 [0041.863] GetLastError () returned 0x0 [0041.863] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.867] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.867] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.867] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.868] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.872] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.872] CloseHandle (hObject=0xfc) returned 1 [0041.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.[deadmin@cock.li].deadmin")) returned 1 [0041.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0041.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0041.874] GetLastError () returned 0x0 [0041.874] RtlWakeConditionVariable () returned 0x27e828 [0041.874] GetCurrentThreadId () returned 0x9ac [0041.874] GetCurrentThreadId () returned 0x9ac [0041.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0041.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313050 | out: hHeap=0x260000) returned 1 [0041.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d668 | out: hHeap=0x260000) returned 1 [0041.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313050 [0041.874] lstrlenW (lpString=".ldf") returned 4 [0041.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".ldf") returned 0x0 [0041.874] lstrlenW (lpString=".vhd") returned 4 [0041.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".vhd") returned 0x0 [0041.875] lstrlenW (lpString=".vhdx") returned 5 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".vhdx") returned 0x0 [0041.875] lstrlenW (lpString=".pst") returned 4 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".pst") returned 0x0 [0041.875] lstrlenW (lpString=".ost") returned 4 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".ost") returned 0x0 [0041.875] lstrlenW (lpString=".bak") returned 4 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".bak") returned 0x0 [0041.875] lstrlenW (lpString=".bac") returned 4 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".bac") returned 0x0 [0041.875] lstrlenW (lpString=".sys") returned 4 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".sys") returned 0x0 [0041.875] lstrlenW (lpString=".v2i") returned 4 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".v2i") returned 0x0 [0041.875] lstrlenW (lpString="s\r\n.v2i") returned 7 [0041.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0041.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0041.879] lstrlenW (lpString=".sql") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".sql") returned 0x0 [0041.879] lstrlenW (lpString=".mdf") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".mdf") returned 0x0 [0041.879] lstrlenW (lpString=".txt") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".txt") returned 0x0 [0041.879] lstrlenW (lpString=".dbf") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".dbf") returned 0x0 [0041.879] lstrlenW (lpString=".ckp") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".ckp") returned 0x0 [0041.879] lstrlenW (lpString=".dacpac") returned 7 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".dacpac") returned 0x0 [0041.879] lstrlenW (lpString=".db3") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".db3") returned 0x0 [0041.879] lstrlenW (lpString=".dtxs") returned 5 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".dtxs") returned 0x0 [0041.879] lstrlenW (lpString=".mdt") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".mdt") returned 0x0 [0041.879] lstrlenW (lpString=".sdf") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".sdf") returned 0x0 [0041.879] lstrlenW (lpString=".MDF") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".MDF") returned 0x0 [0041.879] lstrlenW (lpString=".DBF") returned 4 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".DBF") returned 0x0 [0041.879] lstrlenW (lpString=".DB") returned 3 [0041.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".DB") returned 0x0 [0041.880] lstrlenW (lpString=".db") returned 3 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".db") returned 0x0 [0041.880] lstrlenW (lpString=".ndf") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".ndf") returned 0x0 [0041.880] lstrlenW (lpString=".NDF") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".NDF") returned 0x0 [0041.880] lstrlenW (lpString=".Mdf") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".Mdf") returned 0x0 [0041.880] lstrlenW (lpString=".dat") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".dat") returned 0x0 [0041.880] lstrlenW (lpString=".DAT") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".DAT") returned 0x0 [0041.880] lstrlenW (lpString=".ldf") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".ldf") returned 0x0 [0041.880] lstrlenW (lpString=".LDF") returned 4 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch=".LDF") returned 0x0 [0041.880] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0041.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0041.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d58d8 [0041.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0041.880] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0041.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0041.881] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0041.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0041.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0041.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x31acf8 [0041.881] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16188260627) returned 1 [0041.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7c61610, dwHighDateTime=0x1d585b4)) [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d668 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0041.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d668 | out: hHeap=0x260000) returned 1 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0041.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0041.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0041.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x312fb8 [0041.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0041.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0041.882] GetLastError () returned 0x0 [0041.882] GetLastError () returned 0x0 [0041.882] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0041.883] GetLastError () returned 0x0 [0041.883] GetLastError () returned 0x0 [0041.883] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.931] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.931] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0041.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0041.932] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.932] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0041.932] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0041.932] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0041.932] CloseHandle (hObject=0xfc) returned 1 [0041.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0041.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0042.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.035] GetLastError () returned 0x0 [0042.035] RtlWakeConditionVariable () returned 0x27e828 [0042.035] GetCurrentThreadId () returned 0x9ac [0042.035] GetCurrentThreadId () returned 0x9ac [0042.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3133e0 | out: hHeap=0x260000) returned 1 [0042.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d8d0 | out: hHeap=0x260000) returned 1 [0042.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3133e0 [0042.035] lstrlenW (lpString=".ldf") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".ldf") returned 0x0 [0042.036] lstrlenW (lpString=".vhd") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".vhd") returned 0x0 [0042.036] lstrlenW (lpString=".vhdx") returned 5 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".vhdx") returned 0x0 [0042.036] lstrlenW (lpString=".pst") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".pst") returned 0x0 [0042.036] lstrlenW (lpString=".ost") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".ost") returned 0x0 [0042.036] lstrlenW (lpString=".bak") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".bak") returned 0x0 [0042.036] lstrlenW (lpString=".bac") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".bac") returned 0x0 [0042.036] lstrlenW (lpString=".sys") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".sys") returned 0x0 [0042.036] lstrlenW (lpString=".v2i") returned 4 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".v2i") returned 0x0 [0042.036] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.037] lstrlenW (lpString=".sql") returned 4 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".sql") returned 0x0 [0042.037] lstrlenW (lpString=".mdf") returned 4 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".mdf") returned 0x0 [0042.037] lstrlenW (lpString=".txt") returned 4 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".txt") returned 0x0 [0042.037] lstrlenW (lpString=".dbf") returned 4 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".dbf") returned 0x0 [0042.037] lstrlenW (lpString=".ckp") returned 4 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".ckp") returned 0x0 [0042.037] lstrlenW (lpString=".dacpac") returned 7 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".dacpac") returned 0x0 [0042.037] lstrlenW (lpString=".db3") returned 4 [0042.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".db3") returned 0x0 [0042.038] lstrlenW (lpString=".dtxs") returned 5 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".dtxs") returned 0x0 [0042.038] lstrlenW (lpString=".mdt") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".mdt") returned 0x0 [0042.038] lstrlenW (lpString=".sdf") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".sdf") returned 0x0 [0042.038] lstrlenW (lpString=".MDF") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".MDF") returned 0x0 [0042.038] lstrlenW (lpString=".DBF") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".DBF") returned 0x0 [0042.038] lstrlenW (lpString=".DB") returned 3 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".DB") returned 0x0 [0042.038] lstrlenW (lpString=".db") returned 3 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".db") returned 0x0 [0042.038] lstrlenW (lpString=".ndf") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".ndf") returned 0x0 [0042.038] lstrlenW (lpString=".NDF") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".NDF") returned 0x0 [0042.038] lstrlenW (lpString=".Mdf") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".Mdf") returned 0x0 [0042.038] lstrlenW (lpString=".dat") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".dat") returned 0x0 [0042.038] lstrlenW (lpString=".DAT") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".DAT") returned 0x0 [0042.038] lstrlenW (lpString=".ldf") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".ldf") returned 0x0 [0042.038] lstrlenW (lpString=".LDF") returned 4 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch=".LDF") returned 0x0 [0042.038] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0042.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.039] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0042.039] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.039] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.039] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16204058039) returned 1 [0042.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7dde3d0, dwHighDateTime=0x1d585b4)) [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d8d0 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d8d0 | out: hHeap=0x260000) returned 1 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313050 [0042.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.040] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.040] GetLastError () returned 0x0 [0042.040] GetLastError () returned 0x0 [0042.040] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.040] GetLastError () returned 0x0 [0042.040] GetLastError () returned 0x0 [0042.041] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x6190, lpOverlapped=0x0) returned 1 [0042.043] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9e70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.043] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6190, lpOverlapped=0x0) returned 1 [0042.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.043] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.043] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.044] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.044] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.044] CloseHandle (hObject=0x10c) returned 1 [0042.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0042.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0042.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.045] GetLastError () returned 0x0 [0042.045] RtlWakeConditionVariable () returned 0x27e828 [0042.045] GetCurrentThreadId () returned 0x9ac [0042.045] GetCurrentThreadId () returned 0x9ac [0042.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f1e8 | out: hHeap=0x260000) returned 1 [0042.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d908 | out: hHeap=0x260000) returned 1 [0042.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f1e8 [0042.045] lstrlenW (lpString=".ldf") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".ldf") returned 0x0 [0042.045] lstrlenW (lpString=".vhd") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".vhd") returned 0x0 [0042.045] lstrlenW (lpString=".vhdx") returned 5 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".vhdx") returned 0x0 [0042.045] lstrlenW (lpString=".pst") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".pst") returned 0x0 [0042.045] lstrlenW (lpString=".ost") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".ost") returned 0x0 [0042.045] lstrlenW (lpString=".bak") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".bak") returned 0x0 [0042.045] lstrlenW (lpString=".bac") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".bac") returned 0x0 [0042.045] lstrlenW (lpString=".sys") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".sys") returned 0x0 [0042.045] lstrlenW (lpString=".v2i") returned 4 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".v2i") returned 0x0 [0042.045] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch="s\r\n.v2i") returned 0x0 [0042.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.046] lstrlenW (lpString=".sql") returned 4 [0042.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".sql") returned 0x0 [0042.046] lstrlenW (lpString=".mdf") returned 4 [0042.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".mdf") returned 0x0 [0042.047] lstrlenW (lpString=".txt") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".txt") returned 0x0 [0042.047] lstrlenW (lpString=".dbf") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".dbf") returned 0x0 [0042.047] lstrlenW (lpString=".ckp") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".ckp") returned 0x0 [0042.047] lstrlenW (lpString=".dacpac") returned 7 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".dacpac") returned 0x0 [0042.047] lstrlenW (lpString=".db3") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".db3") returned 0x0 [0042.047] lstrlenW (lpString=".dtxs") returned 5 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".dtxs") returned 0x0 [0042.047] lstrlenW (lpString=".mdt") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".mdt") returned 0x0 [0042.047] lstrlenW (lpString=".sdf") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".sdf") returned 0x0 [0042.047] lstrlenW (lpString=".MDF") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".MDF") returned 0x0 [0042.047] lstrlenW (lpString=".DBF") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".DBF") returned 0x0 [0042.047] lstrlenW (lpString=".DB") returned 3 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".DB") returned 0x0 [0042.047] lstrlenW (lpString=".db") returned 3 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".db") returned 0x0 [0042.047] lstrlenW (lpString=".ndf") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".ndf") returned 0x0 [0042.047] lstrlenW (lpString=".NDF") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".NDF") returned 0x0 [0042.047] lstrlenW (lpString=".Mdf") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".Mdf") returned 0x0 [0042.047] lstrlenW (lpString=".dat") returned 4 [0042.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".dat") returned 0x0 [0042.048] lstrlenW (lpString=".DAT") returned 4 [0042.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".DAT") returned 0x0 [0042.048] lstrlenW (lpString=".ldf") returned 4 [0042.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".ldf") returned 0x0 [0042.048] lstrlenW (lpString=".LDF") returned 4 [0042.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch=".LDF") returned 0x0 [0042.048] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0042.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.048] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0042.049] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.049] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.049] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16204989656) returned 1 [0042.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7e04530, dwHighDateTime=0x1d585b4)) [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d908 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d908 | out: hHeap=0x260000) returned 1 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dd48 [0042.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dd48 | out: hHeap=0x260000) returned 1 [0042.049] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.049] GetLastError () returned 0x0 [0042.050] GetLastError () returned 0x0 [0042.050] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.050] GetLastError () returned 0x0 [0042.050] GetLastError () returned 0x0 [0042.050] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.053] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.053] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.053] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.054] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.054] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.054] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.054] CloseHandle (hObject=0x10c) returned 1 [0042.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0042.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.[deadmin@cock.li].deadmin")) returned 1 [0042.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0042.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.055] GetLastError () returned 0x0 [0042.055] RtlWakeConditionVariable () returned 0x27e828 [0042.055] GetCurrentThreadId () returned 0x9ac [0042.055] GetCurrentThreadId () returned 0x9ac [0042.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313478 | out: hHeap=0x260000) returned 1 [0042.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d940 | out: hHeap=0x260000) returned 1 [0042.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x313478 [0042.056] lstrlenW (lpString=".ldf") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".ldf") returned 0x0 [0042.056] lstrlenW (lpString=".vhd") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".vhd") returned 0x0 [0042.056] lstrlenW (lpString=".vhdx") returned 5 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".vhdx") returned 0x0 [0042.056] lstrlenW (lpString=".pst") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".pst") returned 0x0 [0042.056] lstrlenW (lpString=".ost") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".ost") returned 0x0 [0042.056] lstrlenW (lpString=".bak") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".bak") returned 0x0 [0042.056] lstrlenW (lpString=".bac") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".bac") returned 0x0 [0042.056] lstrlenW (lpString=".sys") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".sys") returned 0x0 [0042.056] lstrlenW (lpString=".v2i") returned 4 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".v2i") returned 0x0 [0042.056] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.057] lstrlenW (lpString=".sql") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".sql") returned 0x0 [0042.057] lstrlenW (lpString=".mdf") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".mdf") returned 0x0 [0042.057] lstrlenW (lpString=".txt") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".txt") returned 0x0 [0042.057] lstrlenW (lpString=".dbf") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".dbf") returned 0x0 [0042.057] lstrlenW (lpString=".ckp") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".ckp") returned 0x0 [0042.057] lstrlenW (lpString=".dacpac") returned 7 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".dacpac") returned 0x0 [0042.057] lstrlenW (lpString=".db3") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".db3") returned 0x0 [0042.057] lstrlenW (lpString=".dtxs") returned 5 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".dtxs") returned 0x0 [0042.057] lstrlenW (lpString=".mdt") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".mdt") returned 0x0 [0042.057] lstrlenW (lpString=".sdf") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".sdf") returned 0x0 [0042.057] lstrlenW (lpString=".MDF") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".MDF") returned 0x0 [0042.057] lstrlenW (lpString=".DBF") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".DBF") returned 0x0 [0042.057] lstrlenW (lpString=".DB") returned 3 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".DB") returned 0x0 [0042.057] lstrlenW (lpString=".db") returned 3 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".db") returned 0x0 [0042.057] lstrlenW (lpString=".ndf") returned 4 [0042.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".ndf") returned 0x0 [0042.058] lstrlenW (lpString=".NDF") returned 4 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".NDF") returned 0x0 [0042.058] lstrlenW (lpString=".Mdf") returned 4 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".Mdf") returned 0x0 [0042.058] lstrlenW (lpString=".dat") returned 4 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".dat") returned 0x0 [0042.058] lstrlenW (lpString=".DAT") returned 4 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".DAT") returned 0x0 [0042.058] lstrlenW (lpString=".ldf") returned 4 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".ldf") returned 0x0 [0042.058] lstrlenW (lpString=".LDF") returned 4 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch=".LDF") returned 0x0 [0042.058] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0042.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.058] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0042.059] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.059] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.059] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16206033537) returned 1 [0042.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7e2a690, dwHighDateTime=0x1d585b4)) [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d940 [0042.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d940 | out: hHeap=0x260000) returned 1 [0042.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3133e0 [0042.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.060] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.060] GetLastError () returned 0x0 [0042.060] GetLastError () returned 0x0 [0042.060] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.060] GetLastError () returned 0x0 [0042.060] GetLastError () returned 0x0 [0042.060] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x7568, lpOverlapped=0x0) returned 1 [0042.062] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8a98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.062] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x7568, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x7568, lpOverlapped=0x0) returned 1 [0042.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.062] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.062] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.062] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.062] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.062] CloseHandle (hObject=0x10c) returned 1 [0042.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f6d0 [0042.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f6d0 | out: hHeap=0x260000) returned 1 [0042.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.063] GetLastError () returned 0x0 [0042.063] RtlWakeConditionVariable () returned 0x27e828 [0042.063] GetCurrentThreadId () returned 0x9ac [0042.063] GetCurrentThreadId () returned 0x9ac [0042.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0042.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edec0 | out: hHeap=0x260000) returned 1 [0042.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0042.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edec0 [0042.063] lstrlenW (lpString=".ldf") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".ldf") returned 0x0 [0042.064] lstrlenW (lpString=".vhd") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".vhd") returned 0x0 [0042.064] lstrlenW (lpString=".vhdx") returned 5 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.064] lstrlenW (lpString=".pst") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".pst") returned 0x0 [0042.064] lstrlenW (lpString=".ost") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".ost") returned 0x0 [0042.064] lstrlenW (lpString=".bak") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".bak") returned 0x0 [0042.064] lstrlenW (lpString=".bac") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".bac") returned 0x0 [0042.064] lstrlenW (lpString=".sys") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".sys") returned 0x0 [0042.064] lstrlenW (lpString=".v2i") returned 4 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".v2i") returned 0x0 [0042.064] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0042.065] lstrlenW (lpString=".sql") returned 4 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".sql") returned 0x0 [0042.065] lstrlenW (lpString=".mdf") returned 4 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".mdf") returned 0x0 [0042.065] lstrlenW (lpString=".txt") returned 4 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".txt") returned 0x0 [0042.065] lstrlenW (lpString=".dbf") returned 4 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".dbf") returned 0x0 [0042.065] lstrlenW (lpString=".ckp") returned 4 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".ckp") returned 0x0 [0042.065] lstrlenW (lpString=".dacpac") returned 7 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.065] lstrlenW (lpString=".db3") returned 4 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".db3") returned 0x0 [0042.065] lstrlenW (lpString=".dtxs") returned 5 [0042.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.065] lstrlenW (lpString=".mdt") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".mdt") returned 0x0 [0042.066] lstrlenW (lpString=".sdf") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".sdf") returned 0x0 [0042.066] lstrlenW (lpString=".MDF") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".MDF") returned 0x0 [0042.066] lstrlenW (lpString=".DBF") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".DBF") returned 0x0 [0042.066] lstrlenW (lpString=".DB") returned 3 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".DB") returned 0x0 [0042.066] lstrlenW (lpString=".db") returned 3 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".db") returned 0x0 [0042.066] lstrlenW (lpString=".ndf") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".ndf") returned 0x0 [0042.066] lstrlenW (lpString=".NDF") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".NDF") returned 0x0 [0042.066] lstrlenW (lpString=".Mdf") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.066] lstrlenW (lpString=".dat") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".dat") returned 0x0 [0042.066] lstrlenW (lpString=".DAT") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".DAT") returned 0x0 [0042.066] lstrlenW (lpString=".ldf") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".ldf") returned 0x0 [0042.066] lstrlenW (lpString=".LDF") returned 4 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch=".LDF") returned 0x0 [0042.066] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2d5348 [0042.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.066] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0042.067] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.067] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0042.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.067] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16206844932) returned 1 [0042.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa7e2a690, dwHighDateTime=0x1d585b4)) [0042.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0042.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0042.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0042.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299600 [0042.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299600 | out: hHeap=0x260000) returned 1 [0042.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ef48 [0042.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ef48 | out: hHeap=0x260000) returned 1 [0042.068] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.068] GetLastError () returned 0x0 [0042.068] GetLastError () returned 0x0 [0042.068] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.068] GetLastError () returned 0x0 [0042.068] GetLastError () returned 0x0 [0042.068] ReadFile (in: hFile=0x10c, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x545, lpOverlapped=0x0) returned 1 [0042.180] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffabb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.180] WriteFile (in: hFile=0x10c, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x545, lpOverlapped=0x0) returned 1 [0042.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.181] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.181] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.182] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.182] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.182] CloseHandle (hObject=0x10c) returned 1 [0042.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x298fd0 [0042.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0042.183] GetLastError () returned 0x0 [0042.183] RtlWakeConditionVariable () returned 0x27e828 [0042.183] GetCurrentThreadId () returned 0x9ac [0042.183] GetCurrentThreadId () returned 0x9ac [0042.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0042.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee7d0 | out: hHeap=0x260000) returned 1 [0042.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0042.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee7d0 [0042.183] lstrlenW (lpString=".ldf") returned 4 [0042.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".ldf") returned 0x0 [0042.183] lstrlenW (lpString=".vhd") returned 4 [0042.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".vhd") returned 0x0 [0042.183] lstrlenW (lpString=".vhdx") returned 5 [0042.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.183] lstrlenW (lpString=".pst") returned 4 [0042.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".pst") returned 0x0 [0042.183] lstrlenW (lpString=".ost") returned 4 [0042.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".ost") returned 0x0 [0042.184] lstrlenW (lpString=".bak") returned 4 [0042.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".bak") returned 0x0 [0042.184] lstrlenW (lpString=".bac") returned 4 [0042.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".bac") returned 0x0 [0042.184] lstrlenW (lpString=".sys") returned 4 [0042.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".sys") returned 0x0 [0042.184] lstrlenW (lpString=".v2i") returned 4 [0042.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".v2i") returned 0x0 [0042.184] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.249] lstrlenW (lpString=".sql") returned 4 [0042.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".sql") returned 0x0 [0042.257] lstrlenW (lpString=".mdf") returned 4 [0042.257] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".mdf") returned 0x0 [0042.260] lstrlenW (lpString=".txt") returned 4 [0042.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".txt") returned 0x0 [0042.270] lstrlenW (lpString=".dbf") returned 4 [0042.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".dbf") returned 0x0 [0042.270] lstrlenW (lpString=".ckp") returned 4 [0042.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".ckp") returned 0x0 [0042.270] lstrlenW (lpString=".dacpac") returned 7 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.271] lstrlenW (lpString=".db3") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".db3") returned 0x0 [0042.271] lstrlenW (lpString=".dtxs") returned 5 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.271] lstrlenW (lpString=".mdt") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".mdt") returned 0x0 [0042.271] lstrlenW (lpString=".sdf") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".sdf") returned 0x0 [0042.271] lstrlenW (lpString=".MDF") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".MDF") returned 0x0 [0042.271] lstrlenW (lpString=".DBF") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".DBF") returned 0x0 [0042.271] lstrlenW (lpString=".DB") returned 3 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".DB") returned 0x0 [0042.271] lstrlenW (lpString=".db") returned 3 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".db") returned 0x0 [0042.271] lstrlenW (lpString=".ndf") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".ndf") returned 0x0 [0042.271] lstrlenW (lpString=".NDF") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".NDF") returned 0x0 [0042.271] lstrlenW (lpString=".Mdf") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.271] lstrlenW (lpString=".dat") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".dat") returned 0x0 [0042.271] lstrlenW (lpString=".DAT") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".DAT") returned 0x0 [0042.271] lstrlenW (lpString=".ldf") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".ldf") returned 0x0 [0042.271] lstrlenW (lpString=".LDF") returned 4 [0042.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch=".LDF") returned 0x0 [0042.271] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.272] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0042.272] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.272] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0042.273] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16227369543) returned 1 [0042.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8019870, dwHighDateTime=0x1d585b4)) [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.273] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.273] GetLastError () returned 0x0 [0042.273] GetLastError () returned 0x0 [0042.273] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.273] GetLastError () returned 0x0 [0042.274] GetLastError () returned 0x0 [0042.274] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x15b5, lpOverlapped=0x0) returned 1 [0042.277] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffea4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.277] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x15b5, lpOverlapped=0x0) returned 1 [0042.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.277] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.277] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.277] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.277] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.277] CloseHandle (hObject=0x108) returned 1 [0042.277] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2f5320 [0042.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0042.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.278] GetLastError () returned 0x0 [0042.278] RtlWakeConditionVariable () returned 0x27e828 [0042.278] GetCurrentThreadId () returned 0x9ac [0042.278] GetCurrentThreadId () returned 0x9ac [0042.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0042.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eee28 | out: hHeap=0x260000) returned 1 [0042.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eee28 [0042.278] lstrlenW (lpString=".ldf") returned 4 [0042.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.278] lstrlenW (lpString=".vhd") returned 4 [0042.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.278] lstrlenW (lpString=".vhdx") returned 5 [0042.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.278] lstrlenW (lpString=".pst") returned 4 [0042.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.278] lstrlenW (lpString=".ost") returned 4 [0042.278] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.278] lstrlenW (lpString=".bak") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.279] lstrlenW (lpString=".bac") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.279] lstrlenW (lpString=".sys") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.279] lstrlenW (lpString=".v2i") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.279] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.279] lstrlenW (lpString=".sql") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.279] lstrlenW (lpString=".mdf") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.279] lstrlenW (lpString=".txt") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.279] lstrlenW (lpString=".dbf") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.279] lstrlenW (lpString=".ckp") returned 4 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.279] lstrlenW (lpString=".dacpac") returned 7 [0042.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.279] lstrlenW (lpString=".db3") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.280] lstrlenW (lpString=".dtxs") returned 5 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.280] lstrlenW (lpString=".mdt") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.280] lstrlenW (lpString=".sdf") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.280] lstrlenW (lpString=".MDF") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.280] lstrlenW (lpString=".DBF") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.280] lstrlenW (lpString=".DB") returned 3 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.280] lstrlenW (lpString=".db") returned 3 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.280] lstrlenW (lpString=".ndf") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.280] lstrlenW (lpString=".NDF") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.280] lstrlenW (lpString=".Mdf") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.280] lstrlenW (lpString=".dat") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.280] lstrlenW (lpString=".DAT") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.280] lstrlenW (lpString=".ldf") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.280] lstrlenW (lpString=".LDF") returned 4 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.280] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3fe0 [0042.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.281] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2b3f18) returned 1 [0042.281] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.281] CryptReleaseContext (hProv=0x2b3f18, dwFlags=0x0) returned 1 [0042.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0042.281] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16228259646) returned 1 [0042.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa803f9d0, dwHighDateTime=0x1d585b4)) [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299638 | out: hHeap=0x260000) returned 1 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.282] GetLastError () returned 0x0 [0042.282] GetLastError () returned 0x0 [0042.282] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.282] GetLastError () returned 0x0 [0042.282] GetLastError () returned 0x0 [0042.282] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x2488, lpOverlapped=0x0) returned 1 [0042.284] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdb78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.284] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2488, lpOverlapped=0x0) returned 1 [0042.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.284] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.284] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.284] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.284] CloseHandle (hObject=0x108) returned 1 [0042.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2f5320 [0042.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0042.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.285] GetLastError () returned 0x0 [0042.285] RtlWakeConditionVariable () returned 0x27e828 [0042.285] GetCurrentThreadId () returned 0x9ac [0042.285] GetCurrentThreadId () returned 0x9ac [0042.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0042.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.286] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.286] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.286] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.286] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.287] CloseHandle (hObject=0x108) returned 1 [0042.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.287] RtlWakeConditionVariable () returned 0x27e828 [0042.287] GetCurrentThreadId () returned 0x9ac [0042.287] GetCurrentThreadId () returned 0x9ac [0042.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0042.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ed9e0 | out: hHeap=0x260000) returned 1 [0042.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0042.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2ed9b0 [0042.287] lstrlenW (lpString=".ldf") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".ldf") returned 0x0 [0042.287] lstrlenW (lpString=".vhd") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".vhd") returned 0x0 [0042.287] lstrlenW (lpString=".vhdx") returned 5 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".vhdx") returned 0x0 [0042.287] lstrlenW (lpString=".pst") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".pst") returned 0x0 [0042.287] lstrlenW (lpString=".ost") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".ost") returned 0x0 [0042.287] lstrlenW (lpString=".bak") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".bak") returned 0x0 [0042.287] lstrlenW (lpString=".bac") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".bac") returned 0x0 [0042.287] lstrlenW (lpString=".sys") returned 4 [0042.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".sys") returned 0x0 [0042.288] lstrlenW (lpString=".v2i") returned 4 [0042.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".v2i") returned 0x0 [0042.288] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.289] lstrlenW (lpString=".sql") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".sql") returned 0x0 [0042.289] lstrlenW (lpString=".mdf") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".mdf") returned 0x0 [0042.289] lstrlenW (lpString=".txt") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".txt") returned 0x0 [0042.289] lstrlenW (lpString=".dbf") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".dbf") returned 0x0 [0042.289] lstrlenW (lpString=".ckp") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".ckp") returned 0x0 [0042.289] lstrlenW (lpString=".dacpac") returned 7 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".dacpac") returned 0x0 [0042.289] lstrlenW (lpString=".db3") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".db3") returned 0x0 [0042.289] lstrlenW (lpString=".dtxs") returned 5 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".dtxs") returned 0x0 [0042.289] lstrlenW (lpString=".mdt") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".mdt") returned 0x0 [0042.289] lstrlenW (lpString=".sdf") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".sdf") returned 0x0 [0042.289] lstrlenW (lpString=".MDF") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".MDF") returned 0x0 [0042.289] lstrlenW (lpString=".DBF") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".DBF") returned 0x0 [0042.289] lstrlenW (lpString=".DB") returned 3 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".DB") returned 0x0 [0042.289] lstrlenW (lpString=".db") returned 3 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".db") returned 0x0 [0042.289] lstrlenW (lpString=".ndf") returned 4 [0042.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".ndf") returned 0x0 [0042.289] lstrlenW (lpString=".NDF") returned 4 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".NDF") returned 0x0 [0042.290] lstrlenW (lpString=".Mdf") returned 4 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".Mdf") returned 0x0 [0042.290] lstrlenW (lpString=".dat") returned 4 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".dat") returned 0x0 [0042.290] lstrlenW (lpString=".DAT") returned 4 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".DAT") returned 0x0 [0042.290] lstrlenW (lpString=".ldf") returned 4 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".ldf") returned 0x0 [0042.290] lstrlenW (lpString=".LDF") returned 4 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch=".LDF") returned 0x0 [0042.290] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.290] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e0f0) returned 1 [0042.291] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.291] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0042.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0042.291] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16229200210) returned 1 [0042.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa803f9d0, dwHighDateTime=0x1d585b4)) [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294790 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0042.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.291] GetLastError () returned 0x0 [0042.292] GetLastError () returned 0x0 [0042.292] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.292] GetLastError () returned 0x0 [0042.292] GetLastError () returned 0x0 [0042.292] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x567, lpOverlapped=0x0) returned 1 [0042.293] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.293] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x567, lpOverlapped=0x0) returned 1 [0042.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.294] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.294] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.294] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.294] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.294] CloseHandle (hObject=0x108) returned 1 [0042.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2b3fe0 [0042.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3fe0 | out: hHeap=0x260000) returned 1 [0042.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.295] GetLastError () returned 0x0 [0042.295] RtlWakeConditionVariable () returned 0x27e828 [0042.295] GetCurrentThreadId () returned 0x9ac [0042.295] GetCurrentThreadId () returned 0x9ac [0042.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0042.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eef10 | out: hHeap=0x260000) returned 1 [0042.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0042.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eef10 [0042.295] lstrlenW (lpString=".ldf") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.295] lstrlenW (lpString=".vhd") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.295] lstrlenW (lpString=".vhdx") returned 5 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.295] lstrlenW (lpString=".pst") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.295] lstrlenW (lpString=".ost") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.295] lstrlenW (lpString=".bak") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.295] lstrlenW (lpString=".bac") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.295] lstrlenW (lpString=".sys") returned 4 [0042.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.295] lstrlenW (lpString=".v2i") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.296] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.296] lstrlenW (lpString=".sql") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.296] lstrlenW (lpString=".mdf") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.296] lstrlenW (lpString=".txt") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.296] lstrlenW (lpString=".dbf") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.296] lstrlenW (lpString=".ckp") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.296] lstrlenW (lpString=".dacpac") returned 7 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.296] lstrlenW (lpString=".db3") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.296] lstrlenW (lpString=".dtxs") returned 5 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.296] lstrlenW (lpString=".mdt") returned 4 [0042.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.296] lstrlenW (lpString=".sdf") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.297] lstrlenW (lpString=".MDF") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.297] lstrlenW (lpString=".DBF") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.297] lstrlenW (lpString=".DB") returned 3 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.297] lstrlenW (lpString=".db") returned 3 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.297] lstrlenW (lpString=".ndf") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.297] lstrlenW (lpString=".NDF") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.297] lstrlenW (lpString=".Mdf") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.297] lstrlenW (lpString=".dat") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.297] lstrlenW (lpString=".DAT") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.297] lstrlenW (lpString=".ldf") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.297] lstrlenW (lpString=".LDF") returned 4 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.297] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.297] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e0f0) returned 1 [0042.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.298] CryptReleaseContext (hProv=0x27e0f0, dwFlags=0x0) returned 1 [0042.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2793060 [0042.298] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16229938053) returned 1 [0042.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8065b30, dwHighDateTime=0x1d585b4)) [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294758 [0042.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0042.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.299] GetLastError () returned 0x0 [0042.299] GetLastError () returned 0x0 [0042.299] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.299] GetLastError () returned 0x0 [0042.299] GetLastError () returned 0x0 [0042.299] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x93a, lpOverlapped=0x0) returned 1 [0042.350] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff6c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.350] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x93a, lpOverlapped=0x0) returned 1 [0042.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0042.350] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.350] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.350] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.350] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.350] CloseHandle (hObject=0x108) returned 1 [0042.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b2d90 [0042.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0042.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.351] GetLastError () returned 0x0 [0042.352] RtlWakeConditionVariable () returned 0x27e828 [0042.352] GetCurrentThreadId () returned 0x9ac [0042.352] GetCurrentThreadId () returned 0x9ac [0042.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f010 | out: hHeap=0x260000) returned 1 [0042.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c98 | out: hHeap=0x260000) returned 1 [0042.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0042.352] lstrlenW (lpString=".ldf") returned 4 [0042.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".ldf") returned 0x0 [0042.352] lstrlenW (lpString=".vhd") returned 4 [0042.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".vhd") returned 0x0 [0042.352] lstrlenW (lpString=".vhdx") returned 5 [0042.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".vhdx") returned 0x0 [0042.353] lstrlenW (lpString=".pst") returned 4 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".pst") returned 0x0 [0042.353] lstrlenW (lpString=".ost") returned 4 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".ost") returned 0x0 [0042.353] lstrlenW (lpString=".bak") returned 4 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".bak") returned 0x0 [0042.353] lstrlenW (lpString=".bac") returned 4 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".bac") returned 0x0 [0042.353] lstrlenW (lpString=".sys") returned 4 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".sys") returned 0x0 [0042.353] lstrlenW (lpString=".v2i") returned 4 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".v2i") returned 0x0 [0042.353] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch="s\r\n.v2i") returned 0x0 [0042.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.358] lstrlenW (lpString=".sql") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".sql") returned 0x0 [0042.359] lstrlenW (lpString=".mdf") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".mdf") returned 0x0 [0042.359] lstrlenW (lpString=".txt") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".txt") returned 0x0 [0042.359] lstrlenW (lpString=".dbf") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".dbf") returned 0x0 [0042.359] lstrlenW (lpString=".ckp") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".ckp") returned 0x0 [0042.359] lstrlenW (lpString=".dacpac") returned 7 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".dacpac") returned 0x0 [0042.359] lstrlenW (lpString=".db3") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".db3") returned 0x0 [0042.359] lstrlenW (lpString=".dtxs") returned 5 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".dtxs") returned 0x0 [0042.359] lstrlenW (lpString=".mdt") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".mdt") returned 0x0 [0042.359] lstrlenW (lpString=".sdf") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".sdf") returned 0x0 [0042.359] lstrlenW (lpString=".MDF") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".MDF") returned 0x0 [0042.359] lstrlenW (lpString=".DBF") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".DBF") returned 0x0 [0042.359] lstrlenW (lpString=".DB") returned 3 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".DB") returned 0x0 [0042.359] lstrlenW (lpString=".db") returned 3 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".db") returned 0x0 [0042.359] lstrlenW (lpString=".ndf") returned 4 [0042.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".ndf") returned 0x0 [0042.360] lstrlenW (lpString=".NDF") returned 4 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".NDF") returned 0x0 [0042.360] lstrlenW (lpString=".Mdf") returned 4 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".Mdf") returned 0x0 [0042.360] lstrlenW (lpString=".dat") returned 4 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".dat") returned 0x0 [0042.360] lstrlenW (lpString=".DAT") returned 4 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".DAT") returned 0x0 [0042.360] lstrlenW (lpString=".ldf") returned 4 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".ldf") returned 0x0 [0042.360] lstrlenW (lpString=".LDF") returned 4 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch=".LDF") returned 0x0 [0042.360] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.360] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.361] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.361] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.361] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16236209784) returned 1 [0042.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa80fe0b0, dwHighDateTime=0x1d585b4)) [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294988 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294988 | out: hHeap=0x260000) returned 1 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.361] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.362] GetLastError () returned 0x0 [0042.362] GetLastError () returned 0x0 [0042.362] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.362] GetLastError () returned 0x0 [0042.362] GetLastError () returned 0x0 [0042.362] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0xb9a0, lpOverlapped=0x0) returned 1 [0042.365] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff4660, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.365] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xb9a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9a0, lpOverlapped=0x0) returned 1 [0042.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.366] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.366] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.367] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.367] CloseHandle (hObject=0x100) returned 1 [0042.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.367] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.367] GetLastError () returned 0x0 [0042.367] RtlWakeConditionVariable () returned 0x27e828 [0042.367] GetCurrentThreadId () returned 0x9ac [0042.368] GetCurrentThreadId () returned 0x9ac [0042.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9568 | out: hHeap=0x260000) returned 1 [0042.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0042.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0042.368] lstrlenW (lpString=".ldf") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".ldf") returned 0x0 [0042.368] lstrlenW (lpString=".vhd") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".vhd") returned 0x0 [0042.368] lstrlenW (lpString=".vhdx") returned 5 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.368] lstrlenW (lpString=".pst") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".pst") returned 0x0 [0042.368] lstrlenW (lpString=".ost") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".ost") returned 0x0 [0042.368] lstrlenW (lpString=".bak") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".bak") returned 0x0 [0042.368] lstrlenW (lpString=".bac") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".bac") returned 0x0 [0042.368] lstrlenW (lpString=".sys") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".sys") returned 0x0 [0042.368] lstrlenW (lpString=".v2i") returned 4 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".v2i") returned 0x0 [0042.368] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.369] lstrlenW (lpString=".sql") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".sql") returned 0x0 [0042.369] lstrlenW (lpString=".mdf") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".mdf") returned 0x0 [0042.369] lstrlenW (lpString=".txt") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".txt") returned 0x0 [0042.369] lstrlenW (lpString=".dbf") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".dbf") returned 0x0 [0042.369] lstrlenW (lpString=".ckp") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".ckp") returned 0x0 [0042.369] lstrlenW (lpString=".dacpac") returned 7 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.369] lstrlenW (lpString=".db3") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".db3") returned 0x0 [0042.369] lstrlenW (lpString=".dtxs") returned 5 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.369] lstrlenW (lpString=".mdt") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".mdt") returned 0x0 [0042.369] lstrlenW (lpString=".sdf") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".sdf") returned 0x0 [0042.369] lstrlenW (lpString=".MDF") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".MDF") returned 0x0 [0042.369] lstrlenW (lpString=".DBF") returned 4 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".DBF") returned 0x0 [0042.369] lstrlenW (lpString=".DB") returned 3 [0042.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".DB") returned 0x0 [0042.370] lstrlenW (lpString=".db") returned 3 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".db") returned 0x0 [0042.370] lstrlenW (lpString=".ndf") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".ndf") returned 0x0 [0042.370] lstrlenW (lpString=".NDF") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".NDF") returned 0x0 [0042.370] lstrlenW (lpString=".Mdf") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.370] lstrlenW (lpString=".dat") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".dat") returned 0x0 [0042.370] lstrlenW (lpString=".DAT") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".DAT") returned 0x0 [0042.370] lstrlenW (lpString=".ldf") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".ldf") returned 0x0 [0042.370] lstrlenW (lpString=".LDF") returned 4 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch=".LDF") returned 0x0 [0042.370] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.371] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.371] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.372] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16237265305) returned 1 [0042.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8124210, dwHighDateTime=0x1d585b4)) [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d08 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.372] GetLastError () returned 0x0 [0042.372] GetLastError () returned 0x0 [0042.372] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.373] GetLastError () returned 0x0 [0042.373] GetLastError () returned 0x0 [0042.373] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0xc72, lpOverlapped=0x0) returned 1 [0042.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff38e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.375] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0xc72, lpOverlapped=0x0) returned 1 [0042.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.375] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.375] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.376] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.376] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.376] CloseHandle (hObject=0x100) returned 1 [0042.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x298fd0 [0042.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.376] GetLastError () returned 0x0 [0042.377] RtlWakeConditionVariable () returned 0x27e828 [0042.377] GetCurrentThreadId () returned 0x9ac [0042.377] GetCurrentThreadId () returned 0x9ac [0042.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0042.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef1c8 | out: hHeap=0x260000) returned 1 [0042.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0042.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef1c8 [0042.377] lstrlenW (lpString=".ldf") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.377] lstrlenW (lpString=".vhd") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.377] lstrlenW (lpString=".vhdx") returned 5 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.377] lstrlenW (lpString=".pst") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.377] lstrlenW (lpString=".ost") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.377] lstrlenW (lpString=".bak") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.377] lstrlenW (lpString=".bac") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.377] lstrlenW (lpString=".sys") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.377] lstrlenW (lpString=".v2i") returned 4 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.377] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.378] lstrlenW (lpString=".sql") returned 4 [0042.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.378] lstrlenW (lpString=".mdf") returned 4 [0042.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.378] lstrlenW (lpString=".txt") returned 4 [0042.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.379] lstrlenW (lpString=".dbf") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.379] lstrlenW (lpString=".ckp") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.379] lstrlenW (lpString=".dacpac") returned 7 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.379] lstrlenW (lpString=".db3") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.379] lstrlenW (lpString=".dtxs") returned 5 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.379] lstrlenW (lpString=".mdt") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.379] lstrlenW (lpString=".sdf") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.379] lstrlenW (lpString=".MDF") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.379] lstrlenW (lpString=".DBF") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.379] lstrlenW (lpString=".DB") returned 3 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.379] lstrlenW (lpString=".db") returned 3 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.379] lstrlenW (lpString=".ndf") returned 4 [0042.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.379] lstrlenW (lpString=".NDF") returned 4 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.380] lstrlenW (lpString=".Mdf") returned 4 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.380] lstrlenW (lpString=".dat") returned 4 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.380] lstrlenW (lpString=".DAT") returned 4 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.380] lstrlenW (lpString=".ldf") returned 4 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.380] lstrlenW (lpString=".LDF") returned 4 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.380] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.380] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.381] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.381] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.381] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16238202319) returned 1 [0042.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8124210, dwHighDateTime=0x1d585b4)) [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bf0 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bf0 | out: hHeap=0x260000) returned 1 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.382] GetLastError () returned 0x0 [0042.382] GetLastError () returned 0x0 [0042.382] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.382] GetLastError () returned 0x0 [0042.382] GetLastError () returned 0x0 [0042.382] ReadFile (in: hFile=0x100, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x106f, lpOverlapped=0x0) returned 1 [0042.383] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffef91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.384] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x106f, lpOverlapped=0x0) returned 1 [0042.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.384] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.384] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.384] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.384] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.384] CloseHandle (hObject=0x100) returned 1 [0042.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.385] GetLastError () returned 0x0 [0042.385] RtlWakeConditionVariable () returned 0x27e828 [0042.385] GetCurrentThreadId () returned 0x9ac [0042.385] GetCurrentThreadId () returned 0x9ac [0042.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299988 | out: hHeap=0x260000) returned 1 [0042.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c28 | out: hHeap=0x260000) returned 1 [0042.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0042.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.387] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.387] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.387] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.387] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.388] CloseHandle (hObject=0x100) returned 1 [0042.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0042.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.388] RtlWakeConditionVariable () returned 0x27e828 [0042.388] GetCurrentThreadId () returned 0x9ac [0042.388] GetCurrentThreadId () returned 0x9ac [0042.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f92b0 [0042.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca0 | out: hHeap=0x260000) returned 1 [0042.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ad8 | out: hHeap=0x260000) returned 1 [0042.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ca0 [0042.388] lstrlenW (lpString=".ldf") returned 4 [0042.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".ldf") returned 0x0 [0042.388] lstrlenW (lpString=".vhd") returned 4 [0042.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".vhd") returned 0x0 [0042.389] lstrlenW (lpString=".vhdx") returned 5 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".vhdx") returned 0x0 [0042.389] lstrlenW (lpString=".pst") returned 4 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".pst") returned 0x0 [0042.389] lstrlenW (lpString=".ost") returned 4 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".ost") returned 0x0 [0042.389] lstrlenW (lpString=".bak") returned 4 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".bak") returned 0x0 [0042.389] lstrlenW (lpString=".bac") returned 4 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".bac") returned 0x0 [0042.389] lstrlenW (lpString=".sys") returned 4 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".sys") returned 0x0 [0042.389] lstrlenW (lpString=".v2i") returned 4 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".v2i") returned 0x0 [0042.389] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch="s\r\n.v2i") returned 0x0 [0042.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.417] lstrlenW (lpString=".sql") returned 4 [0042.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".sql") returned 0x0 [0042.424] lstrlenW (lpString=".mdf") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".mdf") returned 0x0 [0042.428] lstrlenW (lpString=".txt") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".txt") returned 0x0 [0042.428] lstrlenW (lpString=".dbf") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".dbf") returned 0x0 [0042.428] lstrlenW (lpString=".ckp") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".ckp") returned 0x0 [0042.428] lstrlenW (lpString=".dacpac") returned 7 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".dacpac") returned 0x0 [0042.428] lstrlenW (lpString=".db3") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".db3") returned 0x0 [0042.428] lstrlenW (lpString=".dtxs") returned 5 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".dtxs") returned 0x0 [0042.428] lstrlenW (lpString=".mdt") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".mdt") returned 0x0 [0042.428] lstrlenW (lpString=".sdf") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".sdf") returned 0x0 [0042.428] lstrlenW (lpString=".MDF") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".MDF") returned 0x0 [0042.428] lstrlenW (lpString=".DBF") returned 4 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".DBF") returned 0x0 [0042.428] lstrlenW (lpString=".DB") returned 3 [0042.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".DB") returned 0x0 [0042.429] lstrlenW (lpString=".db") returned 3 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".db") returned 0x0 [0042.429] lstrlenW (lpString=".ndf") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".ndf") returned 0x0 [0042.429] lstrlenW (lpString=".NDF") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".NDF") returned 0x0 [0042.429] lstrlenW (lpString=".Mdf") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".Mdf") returned 0x0 [0042.429] lstrlenW (lpString=".dat") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".dat") returned 0x0 [0042.429] lstrlenW (lpString=".DAT") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".DAT") returned 0x0 [0042.429] lstrlenW (lpString=".ldf") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".ldf") returned 0x0 [0042.429] lstrlenW (lpString=".LDF") returned 4 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch=".LDF") returned 0x0 [0042.429] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.429] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.430] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.430] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.430] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16243117181) returned 1 [0042.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8196630, dwHighDateTime=0x1d585b4)) [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294f20 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.431] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.431] GetLastError () returned 0x0 [0042.431] GetLastError () returned 0x0 [0042.431] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.431] GetLastError () returned 0x0 [0042.431] GetLastError () returned 0x0 [0042.431] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.434] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.434] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.434] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.434] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.436] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.436] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.436] CloseHandle (hObject=0x108) returned 1 [0042.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.437] GetLastError () returned 0x0 [0042.437] RtlWakeConditionVariable () returned 0x27e828 [0042.437] GetCurrentThreadId () returned 0x9ac [0042.437] GetCurrentThreadId () returned 0x9ac [0042.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0042.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295688 | out: hHeap=0x260000) returned 1 [0042.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ee8 | out: hHeap=0x260000) returned 1 [0042.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0042.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.511] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.511] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.511] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.511] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.512] CloseHandle (hObject=0x100) returned 1 [0042.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0042.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0042.512] RtlWakeConditionVariable () returned 0x27e828 [0042.512] GetCurrentThreadId () returned 0x9ac [0042.513] GetCurrentThreadId () returned 0x9ac [0042.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3e10 [0042.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2959a0 | out: hHeap=0x260000) returned 1 [0042.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0042.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x298fd0 [0042.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.554] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.554] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.554] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.554] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.555] CloseHandle (hObject=0x108) returned 1 [0042.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.555] RtlWakeConditionVariable () returned 0x27e828 [0042.555] GetCurrentThreadId () returned 0x9ac [0042.555] GetCurrentThreadId () returned 0x9ac [0042.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef738 [0042.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef908 | out: hHeap=0x260000) returned 1 [0042.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295348 | out: hHeap=0x260000) returned 1 [0042.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef908 [0042.555] lstrlenW (lpString=".ldf") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".ldf") returned 0x0 [0042.556] lstrlenW (lpString=".vhd") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".vhd") returned 0x0 [0042.556] lstrlenW (lpString=".vhdx") returned 5 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".vhdx") returned 0x0 [0042.556] lstrlenW (lpString=".pst") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".pst") returned 0x0 [0042.556] lstrlenW (lpString=".ost") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".ost") returned 0x0 [0042.556] lstrlenW (lpString=".bak") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".bak") returned 0x0 [0042.556] lstrlenW (lpString=".bac") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".bac") returned 0x0 [0042.556] lstrlenW (lpString=".sys") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".sys") returned 0x0 [0042.556] lstrlenW (lpString=".v2i") returned 4 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".v2i") returned 0x0 [0042.556] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.557] lstrlenW (lpString=".sql") returned 4 [0042.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".sql") returned 0x0 [0042.557] lstrlenW (lpString=".mdf") returned 4 [0042.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".mdf") returned 0x0 [0042.557] lstrlenW (lpString=".txt") returned 4 [0042.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".txt") returned 0x0 [0042.557] lstrlenW (lpString=".dbf") returned 4 [0042.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".dbf") returned 0x0 [0042.557] lstrlenW (lpString=".ckp") returned 4 [0042.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".ckp") returned 0x0 [0042.557] lstrlenW (lpString=".dacpac") returned 7 [0042.557] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".dacpac") returned 0x0 [0042.558] lstrlenW (lpString=".db3") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".db3") returned 0x0 [0042.558] lstrlenW (lpString=".dtxs") returned 5 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".dtxs") returned 0x0 [0042.558] lstrlenW (lpString=".mdt") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".mdt") returned 0x0 [0042.558] lstrlenW (lpString=".sdf") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".sdf") returned 0x0 [0042.558] lstrlenW (lpString=".MDF") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".MDF") returned 0x0 [0042.558] lstrlenW (lpString=".DBF") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".DBF") returned 0x0 [0042.558] lstrlenW (lpString=".DB") returned 3 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".DB") returned 0x0 [0042.558] lstrlenW (lpString=".db") returned 3 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".db") returned 0x0 [0042.558] lstrlenW (lpString=".ndf") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".ndf") returned 0x0 [0042.558] lstrlenW (lpString=".NDF") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".NDF") returned 0x0 [0042.558] lstrlenW (lpString=".Mdf") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".Mdf") returned 0x0 [0042.558] lstrlenW (lpString=".dat") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".dat") returned 0x0 [0042.558] lstrlenW (lpString=".DAT") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".DAT") returned 0x0 [0042.558] lstrlenW (lpString=".ldf") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".ldf") returned 0x0 [0042.558] lstrlenW (lpString=".LDF") returned 4 [0042.558] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch=".LDF") returned 0x0 [0042.558] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.559] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.559] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.559] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.560] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16256066627) returned 1 [0042.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa82ed290, dwHighDateTime=0x1d585b4)) [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295348 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295348 | out: hHeap=0x260000) returned 1 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.560] GetLastError () returned 0x0 [0042.560] GetLastError () returned 0x0 [0042.560] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.560] GetLastError () returned 0x0 [0042.561] GetLastError () returned 0x0 [0042.561] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x41d4, lpOverlapped=0x0) returned 1 [0042.562] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.562] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x41d4, lpOverlapped=0x0) returned 1 [0042.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.562] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.562] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.562] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.562] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.563] CloseHandle (hObject=0x108) returned 1 [0042.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.563] GetLastError () returned 0x0 [0042.563] RtlWakeConditionVariable () returned 0x27e828 [0042.563] GetCurrentThreadId () returned 0x9ac [0042.563] GetCurrentThreadId () returned 0x9ac [0042.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f7a8 [0042.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fbe0 | out: hHeap=0x260000) returned 1 [0042.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0042.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fbe0 [0042.564] lstrlenW (lpString=".ldf") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.564] lstrlenW (lpString=".vhd") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.564] lstrlenW (lpString=".vhdx") returned 5 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.564] lstrlenW (lpString=".pst") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.564] lstrlenW (lpString=".ost") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.564] lstrlenW (lpString=".bak") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.564] lstrlenW (lpString=".bac") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.564] lstrlenW (lpString=".sys") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.564] lstrlenW (lpString=".v2i") returned 4 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.564] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.564] lstrlenW (lpString=".sql") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.565] lstrlenW (lpString=".mdf") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.565] lstrlenW (lpString=".txt") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.565] lstrlenW (lpString=".dbf") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.565] lstrlenW (lpString=".ckp") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.565] lstrlenW (lpString=".dacpac") returned 7 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.565] lstrlenW (lpString=".db3") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.565] lstrlenW (lpString=".dtxs") returned 5 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.565] lstrlenW (lpString=".mdt") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.565] lstrlenW (lpString=".sdf") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.565] lstrlenW (lpString=".MDF") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.565] lstrlenW (lpString=".DBF") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.565] lstrlenW (lpString=".DB") returned 3 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.565] lstrlenW (lpString=".db") returned 3 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.565] lstrlenW (lpString=".ndf") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.565] lstrlenW (lpString=".NDF") returned 4 [0042.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.565] lstrlenW (lpString=".Mdf") returned 4 [0042.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.566] lstrlenW (lpString=".dat") returned 4 [0042.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.566] lstrlenW (lpString=".DAT") returned 4 [0042.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.566] lstrlenW (lpString=".ldf") returned 4 [0042.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.566] lstrlenW (lpString=".LDF") returned 4 [0042.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.566] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.566] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.567] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.567] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.567] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16256797074) returned 1 [0042.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa82ed290, dwHighDateTime=0x1d585b4)) [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295310 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295310 | out: hHeap=0x260000) returned 1 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.567] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.567] GetLastError () returned 0x0 [0042.568] GetLastError () returned 0x0 [0042.568] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.568] GetLastError () returned 0x0 [0042.568] GetLastError () returned 0x0 [0042.568] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x7976, lpOverlapped=0x0) returned 1 [0042.569] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff868a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.569] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x7976, lpOverlapped=0x0) returned 1 [0042.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.570] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.570] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.570] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.570] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.570] CloseHandle (hObject=0x108) returned 1 [0042.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.571] GetLastError () returned 0x0 [0042.571] RtlWakeConditionVariable () returned 0x27e828 [0042.571] GetCurrentThreadId () returned 0x9ac [0042.571] GetCurrentThreadId () returned 0x9ac [0042.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5668 | out: hHeap=0x260000) returned 1 [0042.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952d8 | out: hHeap=0x260000) returned 1 [0042.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0042.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.572] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.573] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.573] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.573] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.573] CloseHandle (hObject=0x108) returned 1 [0042.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d90 | out: hHeap=0x260000) returned 1 [0042.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d0b0 | out: hHeap=0x260000) returned 1 [0042.574] RtlWakeConditionVariable () returned 0x27e828 [0042.574] GetCurrentThreadId () returned 0x9ac [0042.574] GetCurrentThreadId () returned 0x9ac [0042.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d0b0 [0042.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5760 | out: hHeap=0x260000) returned 1 [0042.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0042.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b2d90 [0042.574] lstrlenW (lpString=".ldf") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".ldf") returned 0x0 [0042.574] lstrlenW (lpString=".vhd") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".vhd") returned 0x0 [0042.574] lstrlenW (lpString=".vhdx") returned 5 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".vhdx") returned 0x0 [0042.574] lstrlenW (lpString=".pst") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".pst") returned 0x0 [0042.574] lstrlenW (lpString=".ost") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".ost") returned 0x0 [0042.574] lstrlenW (lpString=".bak") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".bak") returned 0x0 [0042.574] lstrlenW (lpString=".bac") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".bac") returned 0x0 [0042.574] lstrlenW (lpString=".sys") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".sys") returned 0x0 [0042.574] lstrlenW (lpString=".v2i") returned 4 [0042.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".v2i") returned 0x0 [0042.574] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.575] lstrlenW (lpString=".sql") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".sql") returned 0x0 [0042.575] lstrlenW (lpString=".mdf") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".mdf") returned 0x0 [0042.575] lstrlenW (lpString=".txt") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".txt") returned 0x0 [0042.575] lstrlenW (lpString=".dbf") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".dbf") returned 0x0 [0042.575] lstrlenW (lpString=".ckp") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".ckp") returned 0x0 [0042.575] lstrlenW (lpString=".dacpac") returned 7 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".dacpac") returned 0x0 [0042.575] lstrlenW (lpString=".db3") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".db3") returned 0x0 [0042.575] lstrlenW (lpString=".dtxs") returned 5 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".dtxs") returned 0x0 [0042.575] lstrlenW (lpString=".mdt") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".mdt") returned 0x0 [0042.575] lstrlenW (lpString=".sdf") returned 4 [0042.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".sdf") returned 0x0 [0042.576] lstrlenW (lpString=".MDF") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".MDF") returned 0x0 [0042.576] lstrlenW (lpString=".DBF") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".DBF") returned 0x0 [0042.576] lstrlenW (lpString=".DB") returned 3 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".DB") returned 0x0 [0042.576] lstrlenW (lpString=".db") returned 3 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".db") returned 0x0 [0042.576] lstrlenW (lpString=".ndf") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".ndf") returned 0x0 [0042.576] lstrlenW (lpString=".NDF") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".NDF") returned 0x0 [0042.576] lstrlenW (lpString=".Mdf") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".Mdf") returned 0x0 [0042.576] lstrlenW (lpString=".dat") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".dat") returned 0x0 [0042.576] lstrlenW (lpString=".DAT") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".DAT") returned 0x0 [0042.576] lstrlenW (lpString=".ldf") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".ldf") returned 0x0 [0042.576] lstrlenW (lpString=".LDF") returned 4 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch=".LDF") returned 0x0 [0042.576] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.576] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.577] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.577] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16257846244) returned 1 [0042.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa83133f0, dwHighDateTime=0x1d585b4)) [0042.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2952a0 [0042.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2952a0 | out: hHeap=0x260000) returned 1 [0042.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.578] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.578] GetLastError () returned 0x0 [0042.578] GetLastError () returned 0x0 [0042.578] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.578] GetLastError () returned 0x0 [0042.578] GetLastError () returned 0x0 [0042.578] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0042.580] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.580] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0042.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.580] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.580] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.580] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.580] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.580] CloseHandle (hObject=0x108) returned 1 [0042.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x298fd0 [0042.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0042.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.581] GetLastError () returned 0x0 [0042.581] RtlWakeConditionVariable () returned 0x27e828 [0042.581] GetCurrentThreadId () returned 0x9ac [0042.581] GetCurrentThreadId () returned 0x9ac [0042.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef738 [0042.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef9f0 | out: hHeap=0x260000) returned 1 [0042.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295268 | out: hHeap=0x260000) returned 1 [0042.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ef9f0 [0042.581] lstrlenW (lpString=".ldf") returned 4 [0042.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.581] lstrlenW (lpString=".vhd") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".vhd") returned 0x0 [0042.582] lstrlenW (lpString=".vhdx") returned 5 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".vhdx") returned 0x0 [0042.582] lstrlenW (lpString=".pst") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".pst") returned 0x0 [0042.582] lstrlenW (lpString=".ost") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".ost") returned 0x0 [0042.582] lstrlenW (lpString=".bak") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".bak") returned 0x0 [0042.582] lstrlenW (lpString=".bac") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".bac") returned 0x0 [0042.582] lstrlenW (lpString=".sys") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".sys") returned 0x0 [0042.582] lstrlenW (lpString=".v2i") returned 4 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".v2i") returned 0x0 [0042.582] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch="s\r\n.v2i") returned 0x0 [0042.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.583] lstrlenW (lpString=".sql") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".sql") returned 0x0 [0042.583] lstrlenW (lpString=".mdf") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".mdf") returned 0x0 [0042.583] lstrlenW (lpString=".txt") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".txt") returned 0x0 [0042.583] lstrlenW (lpString=".dbf") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".dbf") returned 0x0 [0042.583] lstrlenW (lpString=".ckp") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".ckp") returned 0x0 [0042.583] lstrlenW (lpString=".dacpac") returned 7 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".dacpac") returned 0x0 [0042.583] lstrlenW (lpString=".db3") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".db3") returned 0x0 [0042.583] lstrlenW (lpString=".dtxs") returned 5 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".dtxs") returned 0x0 [0042.583] lstrlenW (lpString=".mdt") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".mdt") returned 0x0 [0042.583] lstrlenW (lpString=".sdf") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".sdf") returned 0x0 [0042.583] lstrlenW (lpString=".MDF") returned 4 [0042.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".MDF") returned 0x0 [0042.584] lstrlenW (lpString=".DBF") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".DBF") returned 0x0 [0042.584] lstrlenW (lpString=".DB") returned 3 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".DB") returned 0x0 [0042.584] lstrlenW (lpString=".db") returned 3 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".db") returned 0x0 [0042.584] lstrlenW (lpString=".ndf") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".ndf") returned 0x0 [0042.584] lstrlenW (lpString=".NDF") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".NDF") returned 0x0 [0042.584] lstrlenW (lpString=".Mdf") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".Mdf") returned 0x0 [0042.584] lstrlenW (lpString=".dat") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".dat") returned 0x0 [0042.584] lstrlenW (lpString=".DAT") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".DAT") returned 0x0 [0042.584] lstrlenW (lpString=".ldf") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".ldf") returned 0x0 [0042.584] lstrlenW (lpString=".LDF") returned 4 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch=".LDF") returned 0x0 [0042.584] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0042.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.584] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0042.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.585] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0042.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0042.585] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16258631513) returned 1 [0042.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa83133f0, dwHighDateTime=0x1d585b4)) [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295268 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295268 | out: hHeap=0x260000) returned 1 [0042.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0042.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.586] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.586] GetLastError () returned 0x0 [0042.586] GetLastError () returned 0x0 [0042.586] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.586] GetLastError () returned 0x0 [0042.586] GetLastError () returned 0x0 [0042.586] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x648, lpOverlapped=0x0) returned 1 [0042.637] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff9b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.637] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x648, lpOverlapped=0x0) returned 1 [0042.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.638] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.638] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.638] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.638] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.638] CloseHandle (hObject=0x108) returned 1 [0042.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x2b3e10 [0042.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.[deadmin@cock.li].deadmin")) returned 1 [0042.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3e10 | out: hHeap=0x260000) returned 1 [0042.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0042.639] GetLastError () returned 0x0 [0042.639] RtlWakeConditionVariable () returned 0x27e828 [0042.639] GetCurrentThreadId () returned 0x9ac [0042.639] GetCurrentThreadId () returned 0x9ac [0042.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0042.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ed8a8 | out: hHeap=0x260000) returned 1 [0042.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0042.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312c00 [0042.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.694] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.694] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.694] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.694] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.695] CloseHandle (hObject=0x108) returned 1 [0042.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312c00 | out: hHeap=0x260000) returned 1 [0042.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0042.695] RtlWakeConditionVariable () returned 0x27e828 [0042.695] GetCurrentThreadId () returned 0x9ac [0042.696] GetCurrentThreadId () returned 0x9ac [0042.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2eddd8 [0042.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315cc8 | out: hHeap=0x260000) returned 1 [0042.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c60 | out: hHeap=0x260000) returned 1 [0042.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315cc8 [0042.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.696] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.696] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0042.696] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0042.696] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0042.697] CloseHandle (hObject=0x108) returned 1 [0042.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315cc8 | out: hHeap=0x260000) returned 1 [0042.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eddd8 | out: hHeap=0x260000) returned 1 [0042.697] RtlWakeConditionVariable () returned 0x27e828 [0042.697] GetCurrentThreadId () returned 0x9ac [0042.697] GetCurrentThreadId () returned 0x9ac [0042.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297990 | out: hHeap=0x260000) returned 1 [0042.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0042.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0042.698] lstrlenW (lpString=".ldf") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".ldf") returned 0x0 [0042.698] lstrlenW (lpString=".vhd") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".vhd") returned 0x0 [0042.698] lstrlenW (lpString=".vhdx") returned 5 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".vhdx") returned 0x0 [0042.698] lstrlenW (lpString=".pst") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".pst") returned 0x0 [0042.698] lstrlenW (lpString=".ost") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".ost") returned 0x0 [0042.698] lstrlenW (lpString=".bak") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".bak") returned 0x0 [0042.698] lstrlenW (lpString=".bac") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".bac") returned 0x0 [0042.698] lstrlenW (lpString=".sys") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".sys") returned 0x0 [0042.698] lstrlenW (lpString=".v2i") returned 4 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".v2i") returned 0x0 [0042.698] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.699] lstrlenW (lpString=".sql") returned 4 [0042.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".sql") returned 0x0 [0042.699] lstrlenW (lpString=".mdf") returned 4 [0042.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".mdf") returned 0x0 [0042.699] lstrlenW (lpString=".txt") returned 4 [0042.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".txt") returned 0x0 [0042.699] lstrlenW (lpString=".dbf") returned 4 [0042.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".dbf") returned 0x0 [0042.699] lstrlenW (lpString=".ckp") returned 4 [0042.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".ckp") returned 0x0 [0042.699] lstrlenW (lpString=".dacpac") returned 7 [0042.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".dacpac") returned 0x0 [0042.699] lstrlenW (lpString=".db3") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".db3") returned 0x0 [0042.700] lstrlenW (lpString=".dtxs") returned 5 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".dtxs") returned 0x0 [0042.700] lstrlenW (lpString=".mdt") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".mdt") returned 0x0 [0042.700] lstrlenW (lpString=".sdf") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".sdf") returned 0x0 [0042.700] lstrlenW (lpString=".MDF") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".MDF") returned 0x0 [0042.700] lstrlenW (lpString=".DBF") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".DBF") returned 0x0 [0042.700] lstrlenW (lpString=".DB") returned 3 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".DB") returned 0x0 [0042.700] lstrlenW (lpString=".db") returned 3 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".db") returned 0x0 [0042.700] lstrlenW (lpString=".ndf") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".ndf") returned 0x0 [0042.700] lstrlenW (lpString=".NDF") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".NDF") returned 0x0 [0042.700] lstrlenW (lpString=".Mdf") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".Mdf") returned 0x0 [0042.700] lstrlenW (lpString=".dat") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".dat") returned 0x0 [0042.700] lstrlenW (lpString=".DAT") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".DAT") returned 0x0 [0042.700] lstrlenW (lpString=".ldf") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".ldf") returned 0x0 [0042.700] lstrlenW (lpString=".LDF") returned 4 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch=".LDF") returned 0x0 [0042.700] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.701] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0042.701] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.701] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0042.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.701] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16270263102) returned 1 [0042.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8443ef0, dwHighDateTime=0x1d585b4)) [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bf0 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0042.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.702] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.702] GetLastError () returned 0x0 [0042.702] GetLastError () returned 0x0 [0042.702] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.702] GetLastError () returned 0x0 [0042.702] GetLastError () returned 0x0 [0042.703] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x2560, lpOverlapped=0x0) returned 1 [0042.704] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.704] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x2560, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2560, lpOverlapped=0x0) returned 1 [0042.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.704] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.704] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.704] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.705] CloseHandle (hObject=0x108) returned 1 [0042.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.705] GetLastError () returned 0x0 [0042.705] RtlWakeConditionVariable () returned 0x27e828 [0042.705] GetCurrentThreadId () returned 0x9ac [0042.705] GetCurrentThreadId () returned 0x9ac [0042.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7128 | out: hHeap=0x260000) returned 1 [0042.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0042.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7128 [0042.706] lstrlenW (lpString=".ldf") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".ldf") returned 0x0 [0042.706] lstrlenW (lpString=".vhd") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".vhd") returned 0x0 [0042.706] lstrlenW (lpString=".vhdx") returned 5 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".vhdx") returned 0x0 [0042.706] lstrlenW (lpString=".pst") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".pst") returned 0x0 [0042.706] lstrlenW (lpString=".ost") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".ost") returned 0x0 [0042.706] lstrlenW (lpString=".bak") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".bak") returned 0x0 [0042.706] lstrlenW (lpString=".bac") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".bac") returned 0x0 [0042.706] lstrlenW (lpString=".sys") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".sys") returned 0x0 [0042.706] lstrlenW (lpString=".v2i") returned 4 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".v2i") returned 0x0 [0042.706] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.707] lstrlenW (lpString=".sql") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".sql") returned 0x0 [0042.707] lstrlenW (lpString=".mdf") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".mdf") returned 0x0 [0042.707] lstrlenW (lpString=".txt") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".txt") returned 0x0 [0042.707] lstrlenW (lpString=".dbf") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".dbf") returned 0x0 [0042.707] lstrlenW (lpString=".ckp") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".ckp") returned 0x0 [0042.707] lstrlenW (lpString=".dacpac") returned 7 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".dacpac") returned 0x0 [0042.707] lstrlenW (lpString=".db3") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".db3") returned 0x0 [0042.707] lstrlenW (lpString=".dtxs") returned 5 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".dtxs") returned 0x0 [0042.707] lstrlenW (lpString=".mdt") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".mdt") returned 0x0 [0042.707] lstrlenW (lpString=".sdf") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".sdf") returned 0x0 [0042.707] lstrlenW (lpString=".MDF") returned 4 [0042.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".MDF") returned 0x0 [0042.707] lstrlenW (lpString=".DBF") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".DBF") returned 0x0 [0042.708] lstrlenW (lpString=".DB") returned 3 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".DB") returned 0x0 [0042.708] lstrlenW (lpString=".db") returned 3 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".db") returned 0x0 [0042.708] lstrlenW (lpString=".ndf") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".ndf") returned 0x0 [0042.708] lstrlenW (lpString=".NDF") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".NDF") returned 0x0 [0042.708] lstrlenW (lpString=".Mdf") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".Mdf") returned 0x0 [0042.708] lstrlenW (lpString=".dat") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".dat") returned 0x0 [0042.708] lstrlenW (lpString=".DAT") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".DAT") returned 0x0 [0042.708] lstrlenW (lpString=".ldf") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".ldf") returned 0x0 [0042.708] lstrlenW (lpString=".LDF") returned 4 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch=".LDF") returned 0x0 [0042.708] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.708] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0042.709] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.709] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0042.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.709] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16271032714) returned 1 [0042.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8443ef0, dwHighDateTime=0x1d585b4)) [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c28 [0042.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0042.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0042.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0042.710] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.710] GetLastError () returned 0x0 [0042.710] GetLastError () returned 0x0 [0042.710] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.710] GetLastError () returned 0x0 [0042.710] GetLastError () returned 0x0 [0042.710] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x4d88, lpOverlapped=0x0) returned 1 [0042.712] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb278, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.712] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x4d88, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x4d88, lpOverlapped=0x0) returned 1 [0042.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.712] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.712] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.712] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.712] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.712] CloseHandle (hObject=0x108) returned 1 [0042.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.713] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.762] GetLastError () returned 0x0 [0042.762] RtlWakeConditionVariable () returned 0x27e828 [0042.762] GetCurrentThreadId () returned 0x9ac [0042.762] GetCurrentThreadId () returned 0x9ac [0042.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296b50 | out: hHeap=0x260000) returned 1 [0042.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0042.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0042.762] lstrlenW (lpString=".ldf") returned 4 [0042.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".ldf") returned 0x0 [0042.762] lstrlenW (lpString=".vhd") returned 4 [0042.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".vhd") returned 0x0 [0042.762] lstrlenW (lpString=".vhdx") returned 5 [0042.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".vhdx") returned 0x0 [0042.762] lstrlenW (lpString=".pst") returned 4 [0042.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".pst") returned 0x0 [0042.762] lstrlenW (lpString=".ost") returned 4 [0042.762] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".ost") returned 0x0 [0042.763] lstrlenW (lpString=".bak") returned 4 [0042.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".bak") returned 0x0 [0042.763] lstrlenW (lpString=".bac") returned 4 [0042.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".bac") returned 0x0 [0042.763] lstrlenW (lpString=".sys") returned 4 [0042.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".sys") returned 0x0 [0042.763] lstrlenW (lpString=".v2i") returned 4 [0042.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".v2i") returned 0x0 [0042.763] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.763] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.764] lstrlenW (lpString=".sql") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".sql") returned 0x0 [0042.764] lstrlenW (lpString=".mdf") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".mdf") returned 0x0 [0042.764] lstrlenW (lpString=".txt") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".txt") returned 0x0 [0042.764] lstrlenW (lpString=".dbf") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".dbf") returned 0x0 [0042.764] lstrlenW (lpString=".ckp") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".ckp") returned 0x0 [0042.764] lstrlenW (lpString=".dacpac") returned 7 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".dacpac") returned 0x0 [0042.764] lstrlenW (lpString=".db3") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".db3") returned 0x0 [0042.764] lstrlenW (lpString=".dtxs") returned 5 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".dtxs") returned 0x0 [0042.764] lstrlenW (lpString=".mdt") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".mdt") returned 0x0 [0042.764] lstrlenW (lpString=".sdf") returned 4 [0042.764] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".sdf") returned 0x0 [0042.765] lstrlenW (lpString=".MDF") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".MDF") returned 0x0 [0042.765] lstrlenW (lpString=".DBF") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".DBF") returned 0x0 [0042.765] lstrlenW (lpString=".DB") returned 3 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".DB") returned 0x0 [0042.765] lstrlenW (lpString=".db") returned 3 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".db") returned 0x0 [0042.765] lstrlenW (lpString=".ndf") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".ndf") returned 0x0 [0042.765] lstrlenW (lpString=".NDF") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".NDF") returned 0x0 [0042.765] lstrlenW (lpString=".Mdf") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".Mdf") returned 0x0 [0042.765] lstrlenW (lpString=".dat") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".dat") returned 0x0 [0042.765] lstrlenW (lpString=".DAT") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".DAT") returned 0x0 [0042.765] lstrlenW (lpString=".ldf") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".ldf") returned 0x0 [0042.765] lstrlenW (lpString=".LDF") returned 4 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch=".LDF") returned 0x0 [0042.765] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.765] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0042.766] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.766] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0042.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.766] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16276741981) returned 1 [0042.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa84dc470, dwHighDateTime=0x1d585b4)) [0042.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b80 [0042.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b80 | out: hHeap=0x260000) returned 1 [0042.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0042.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0042.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0042.767] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.767] GetLastError () returned 0x0 [0042.767] GetLastError () returned 0x0 [0042.767] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.767] GetLastError () returned 0x0 [0042.767] GetLastError () returned 0x0 [0042.767] ReadFile (in: hFile=0x108, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x47a0, lpOverlapped=0x0) returned 1 [0042.769] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb860, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.769] WriteFile (in: hFile=0x108, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x47a0, lpOverlapped=0x0) returned 1 [0042.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0042.769] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.769] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0042.770] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0042.770] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0042.770] CloseHandle (hObject=0x108) returned 1 [0042.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.[deadmin@cock.li].deadmin")) returned 1 [0042.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0042.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0042.771] GetLastError () returned 0x0 [0042.771] RtlWakeConditionVariable () returned 0x27e828 [0042.771] GetCurrentThreadId () returned 0x9ac [0042.771] GetCurrentThreadId () returned 0x9ac [0042.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f7080 | out: hHeap=0x260000) returned 1 [0042.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0042.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7080 [0042.771] lstrlenW (lpString=".ldf") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".ldf") returned 0x0 [0042.771] lstrlenW (lpString=".vhd") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".vhd") returned 0x0 [0042.771] lstrlenW (lpString=".vhdx") returned 5 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".vhdx") returned 0x0 [0042.771] lstrlenW (lpString=".pst") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".pst") returned 0x0 [0042.771] lstrlenW (lpString=".ost") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".ost") returned 0x0 [0042.771] lstrlenW (lpString=".bak") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".bak") returned 0x0 [0042.771] lstrlenW (lpString=".bac") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".bac") returned 0x0 [0042.771] lstrlenW (lpString=".sys") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".sys") returned 0x0 [0042.771] lstrlenW (lpString=".v2i") returned 4 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".v2i") returned 0x0 [0042.771] lstrlenW (lpString="s\r\n.v2i") returned 7 [0042.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0042.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.772] lstrlenW (lpString=".sql") returned 4 [0042.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".sql") returned 0x0 [0042.773] lstrlenW (lpString=".mdf") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".mdf") returned 0x0 [0042.773] lstrlenW (lpString=".txt") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".txt") returned 0x0 [0042.773] lstrlenW (lpString=".dbf") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".dbf") returned 0x0 [0042.773] lstrlenW (lpString=".ckp") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".ckp") returned 0x0 [0042.773] lstrlenW (lpString=".dacpac") returned 7 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".dacpac") returned 0x0 [0042.773] lstrlenW (lpString=".db3") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".db3") returned 0x0 [0042.773] lstrlenW (lpString=".dtxs") returned 5 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".dtxs") returned 0x0 [0042.773] lstrlenW (lpString=".mdt") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".mdt") returned 0x0 [0042.773] lstrlenW (lpString=".sdf") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".sdf") returned 0x0 [0042.773] lstrlenW (lpString=".MDF") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".MDF") returned 0x0 [0042.773] lstrlenW (lpString=".DBF") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".DBF") returned 0x0 [0042.773] lstrlenW (lpString=".DB") returned 3 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".DB") returned 0x0 [0042.773] lstrlenW (lpString=".db") returned 3 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".db") returned 0x0 [0042.773] lstrlenW (lpString=".ndf") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".ndf") returned 0x0 [0042.773] lstrlenW (lpString=".NDF") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".NDF") returned 0x0 [0042.773] lstrlenW (lpString=".Mdf") returned 4 [0042.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".Mdf") returned 0x0 [0042.774] lstrlenW (lpString=".dat") returned 4 [0042.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".dat") returned 0x0 [0042.774] lstrlenW (lpString=".DAT") returned 4 [0042.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".DAT") returned 0x0 [0042.774] lstrlenW (lpString=".ldf") returned 4 [0042.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".ldf") returned 0x0 [0042.774] lstrlenW (lpString=".LDF") returned 4 [0042.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch=".LDF") returned 0x0 [0042.774] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0042.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0042.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0042.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0042.774] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0042.775] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0042.775] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0042.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0042.775] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16277594658) returned 1 [0042.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa84dc470, dwHighDateTime=0x1d585b4)) [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bb8 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0042.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bb8 | out: hHeap=0x260000) returned 1 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0042.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0042.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0042.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0042.825] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0042.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0042.825] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0042.825] GetLastError () returned 0x0 [0042.826] GetLastError () returned 0x0 [0042.826] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0042.826] GetLastError () returned 0x0 [0042.826] GetLastError () returned 0x0 [0042.826] ReadFile (in: hFile=0x108, lpBuffer=0x2750048, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.971] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0042.971] WriteFile (in: hFile=0x108, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0042.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0042.972] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.972] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.002] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.002] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.003] CloseHandle (hObject=0x108) returned 1 [0043.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.003] GetLastError () returned 0x0 [0043.004] RtlWakeConditionVariable () returned 0x27e828 [0043.004] GetCurrentThreadId () returned 0x9ac [0043.004] GetCurrentThreadId () returned 0x9ac [0043.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0043.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9980 | out: hHeap=0x260000) returned 1 [0043.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a68 | out: hHeap=0x260000) returned 1 [0043.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9980 [0043.004] lstrlenW (lpString=".ldf") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".ldf") returned 0x0 [0043.004] lstrlenW (lpString=".vhd") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".vhd") returned 0x0 [0043.004] lstrlenW (lpString=".vhdx") returned 5 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".vhdx") returned 0x0 [0043.004] lstrlenW (lpString=".pst") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".pst") returned 0x0 [0043.004] lstrlenW (lpString=".ost") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".ost") returned 0x0 [0043.004] lstrlenW (lpString=".bak") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".bak") returned 0x0 [0043.004] lstrlenW (lpString=".bac") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".bac") returned 0x0 [0043.004] lstrlenW (lpString=".sys") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".sys") returned 0x0 [0043.004] lstrlenW (lpString=".v2i") returned 4 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".v2i") returned 0x0 [0043.004] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch="s\r\n.v2i") returned 0x0 [0043.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.005] lstrlenW (lpString=".sql") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".sql") returned 0x0 [0043.005] lstrlenW (lpString=".mdf") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".mdf") returned 0x0 [0043.005] lstrlenW (lpString=".txt") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".txt") returned 0x0 [0043.005] lstrlenW (lpString=".dbf") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".dbf") returned 0x0 [0043.005] lstrlenW (lpString=".ckp") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".ckp") returned 0x0 [0043.005] lstrlenW (lpString=".dacpac") returned 7 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".dacpac") returned 0x0 [0043.005] lstrlenW (lpString=".db3") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".db3") returned 0x0 [0043.005] lstrlenW (lpString=".dtxs") returned 5 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".dtxs") returned 0x0 [0043.005] lstrlenW (lpString=".mdt") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".mdt") returned 0x0 [0043.005] lstrlenW (lpString=".sdf") returned 4 [0043.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".sdf") returned 0x0 [0043.006] lstrlenW (lpString=".MDF") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".MDF") returned 0x0 [0043.006] lstrlenW (lpString=".DBF") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".DBF") returned 0x0 [0043.006] lstrlenW (lpString=".DB") returned 3 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".DB") returned 0x0 [0043.006] lstrlenW (lpString=".db") returned 3 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".db") returned 0x0 [0043.006] lstrlenW (lpString=".ndf") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".ndf") returned 0x0 [0043.006] lstrlenW (lpString=".NDF") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".NDF") returned 0x0 [0043.006] lstrlenW (lpString=".Mdf") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".Mdf") returned 0x0 [0043.006] lstrlenW (lpString=".dat") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".dat") returned 0x0 [0043.006] lstrlenW (lpString=".DAT") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".DAT") returned 0x0 [0043.006] lstrlenW (lpString=".ldf") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".ldf") returned 0x0 [0043.006] lstrlenW (lpString=".LDF") returned 4 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch=".LDF") returned 0x0 [0043.006] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.006] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310c08) returned 1 [0043.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.007] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.007] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16300846944) returned 1 [0043.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8717910, dwHighDateTime=0x1d585b4)) [0043.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294a68 [0043.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a68 | out: hHeap=0x260000) returned 1 [0043.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.008] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.008] GetLastError () returned 0x0 [0043.008] GetLastError () returned 0x0 [0043.008] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.008] GetLastError () returned 0x0 [0043.008] GetLastError () returned 0x0 [0043.009] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0xba5e, lpOverlapped=0x0) returned 1 [0043.011] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff45a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.011] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xba5e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xba5e, lpOverlapped=0x0) returned 1 [0043.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.012] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.012] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.012] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.012] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.012] CloseHandle (hObject=0x108) returned 1 [0043.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0043.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.[deadmin@cock.li].deadmin")) returned 1 [0043.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0043.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.013] GetLastError () returned 0x0 [0043.013] RtlWakeConditionVariable () returned 0x27e828 [0043.013] GetCurrentThreadId () returned 0x9ac [0043.013] GetCurrentThreadId () returned 0x9ac [0043.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315db0 | out: hHeap=0x260000) returned 1 [0043.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a30 | out: hHeap=0x260000) returned 1 [0043.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315db0 [0043.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.014] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.014] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.014] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.014] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.015] CloseHandle (hObject=0x108) returned 1 [0043.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315db0 | out: hHeap=0x260000) returned 1 [0043.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.015] RtlWakeConditionVariable () returned 0x27e828 [0043.015] GetCurrentThreadId () returned 0x9ac [0043.015] GetCurrentThreadId () returned 0x9ac [0043.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297730 | out: hHeap=0x260000) returned 1 [0043.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d08 | out: hHeap=0x260000) returned 1 [0043.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0043.016] lstrlenW (lpString=".ldf") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".ldf") returned 0x0 [0043.016] lstrlenW (lpString=".vhd") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".vhd") returned 0x0 [0043.016] lstrlenW (lpString=".vhdx") returned 5 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".vhdx") returned 0x0 [0043.016] lstrlenW (lpString=".pst") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".pst") returned 0x0 [0043.016] lstrlenW (lpString=".ost") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".ost") returned 0x0 [0043.016] lstrlenW (lpString=".bak") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".bak") returned 0x0 [0043.016] lstrlenW (lpString=".bac") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".bac") returned 0x0 [0043.016] lstrlenW (lpString=".sys") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".sys") returned 0x0 [0043.016] lstrlenW (lpString=".v2i") returned 4 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".v2i") returned 0x0 [0043.016] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.017] lstrlenW (lpString=".sql") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".sql") returned 0x0 [0043.017] lstrlenW (lpString=".mdf") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".mdf") returned 0x0 [0043.017] lstrlenW (lpString=".txt") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".txt") returned 0x0 [0043.017] lstrlenW (lpString=".dbf") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".dbf") returned 0x0 [0043.017] lstrlenW (lpString=".ckp") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".ckp") returned 0x0 [0043.017] lstrlenW (lpString=".dacpac") returned 7 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".dacpac") returned 0x0 [0043.017] lstrlenW (lpString=".db3") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".db3") returned 0x0 [0043.017] lstrlenW (lpString=".dtxs") returned 5 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".dtxs") returned 0x0 [0043.017] lstrlenW (lpString=".mdt") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".mdt") returned 0x0 [0043.017] lstrlenW (lpString=".sdf") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".sdf") returned 0x0 [0043.017] lstrlenW (lpString=".MDF") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".MDF") returned 0x0 [0043.017] lstrlenW (lpString=".DBF") returned 4 [0043.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".DBF") returned 0x0 [0043.017] lstrlenW (lpString=".DB") returned 3 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".DB") returned 0x0 [0043.018] lstrlenW (lpString=".db") returned 3 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".db") returned 0x0 [0043.018] lstrlenW (lpString=".ndf") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".ndf") returned 0x0 [0043.018] lstrlenW (lpString=".NDF") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".NDF") returned 0x0 [0043.018] lstrlenW (lpString=".Mdf") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".Mdf") returned 0x0 [0043.018] lstrlenW (lpString=".dat") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".dat") returned 0x0 [0043.018] lstrlenW (lpString=".DAT") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".DAT") returned 0x0 [0043.018] lstrlenW (lpString=".ldf") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".ldf") returned 0x0 [0043.018] lstrlenW (lpString=".LDF") returned 4 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch=".LDF") returned 0x0 [0043.018] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.018] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310c08) returned 1 [0043.019] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.019] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.019] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16302027461) returned 1 [0043.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa873da70, dwHighDateTime=0x1d585b4)) [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d08 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d08 | out: hHeap=0x260000) returned 1 [0043.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2978f8 [0043.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.020] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.020] GetLastError () returned 0x0 [0043.020] GetLastError () returned 0x0 [0043.020] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.020] GetLastError () returned 0x0 [0043.020] GetLastError () returned 0x0 [0043.020] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.023] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.023] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.024] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.024] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.026] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.026] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.026] CloseHandle (hObject=0x108) returned 1 [0043.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0043.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0043.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.027] GetLastError () returned 0x0 [0043.027] RtlWakeConditionVariable () returned 0x27e828 [0043.027] GetCurrentThreadId () returned 0x9ac [0043.027] GetCurrentThreadId () returned 0x9ac [0043.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2973a0 | out: hHeap=0x260000) returned 1 [0043.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0043.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2973a0 [0043.027] lstrlenW (lpString=".ldf") returned 4 [0043.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".ldf") returned 0x0 [0043.027] lstrlenW (lpString=".vhd") returned 4 [0043.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".vhd") returned 0x0 [0043.027] lstrlenW (lpString=".vhdx") returned 5 [0043.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".vhdx") returned 0x0 [0043.027] lstrlenW (lpString=".pst") returned 4 [0043.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".pst") returned 0x0 [0043.027] lstrlenW (lpString=".ost") returned 4 [0043.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".ost") returned 0x0 [0043.027] lstrlenW (lpString=".bak") returned 4 [0043.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".bak") returned 0x0 [0043.028] lstrlenW (lpString=".bac") returned 4 [0043.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".bac") returned 0x0 [0043.028] lstrlenW (lpString=".sys") returned 4 [0043.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".sys") returned 0x0 [0043.028] lstrlenW (lpString=".v2i") returned 4 [0043.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".v2i") returned 0x0 [0043.028] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch="s\r\n.v2i") returned 0x0 [0043.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.029] lstrlenW (lpString=".sql") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".sql") returned 0x0 [0043.029] lstrlenW (lpString=".mdf") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".mdf") returned 0x0 [0043.029] lstrlenW (lpString=".txt") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".txt") returned 0x0 [0043.029] lstrlenW (lpString=".dbf") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".dbf") returned 0x0 [0043.029] lstrlenW (lpString=".ckp") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".ckp") returned 0x0 [0043.029] lstrlenW (lpString=".dacpac") returned 7 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".dacpac") returned 0x0 [0043.029] lstrlenW (lpString=".db3") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".db3") returned 0x0 [0043.029] lstrlenW (lpString=".dtxs") returned 5 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".dtxs") returned 0x0 [0043.029] lstrlenW (lpString=".mdt") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".mdt") returned 0x0 [0043.029] lstrlenW (lpString=".sdf") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".sdf") returned 0x0 [0043.029] lstrlenW (lpString=".MDF") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".MDF") returned 0x0 [0043.029] lstrlenW (lpString=".DBF") returned 4 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".DBF") returned 0x0 [0043.029] lstrlenW (lpString=".DB") returned 3 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".DB") returned 0x0 [0043.029] lstrlenW (lpString=".db") returned 3 [0043.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".db") returned 0x0 [0043.030] lstrlenW (lpString=".ndf") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".ndf") returned 0x0 [0043.030] lstrlenW (lpString=".NDF") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".NDF") returned 0x0 [0043.030] lstrlenW (lpString=".Mdf") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".Mdf") returned 0x0 [0043.030] lstrlenW (lpString=".dat") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".dat") returned 0x0 [0043.030] lstrlenW (lpString=".DAT") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".DAT") returned 0x0 [0043.030] lstrlenW (lpString=".ldf") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".ldf") returned 0x0 [0043.030] lstrlenW (lpString=".LDF") returned 4 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch=".LDF") returned 0x0 [0043.030] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0043.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.030] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310c08) returned 1 [0043.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.031] CryptReleaseContext (hProv=0x310c08, dwFlags=0x0) returned 1 [0043.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.031] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16303214105) returned 1 [0043.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8763bd0, dwHighDateTime=0x1d585b4)) [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e7c8 [0043.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0043.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0043.032] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.032] GetLastError () returned 0x0 [0043.032] GetLastError () returned 0x0 [0043.032] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.032] GetLastError () returned 0x0 [0043.032] GetLastError () returned 0x0 [0043.032] ReadFile (in: hFile=0x108, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.082] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.083] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.083] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.083] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.141] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.141] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.141] CloseHandle (hObject=0x108) returned 1 [0043.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0043.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.[deadmin@cock.li].deadmin")) returned 1 [0043.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0043.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0043.142] GetLastError () returned 0x0 [0043.142] RtlWakeConditionVariable () returned 0x27e828 [0043.142] GetCurrentThreadId () returned 0x9ac [0043.142] GetCurrentThreadId () returned 0x9ac [0043.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cbb8 | out: hHeap=0x260000) returned 1 [0043.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81e8 | out: hHeap=0x260000) returned 1 [0043.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29cbb8 [0043.142] lstrlenW (lpString=".ldf") returned 4 [0043.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0043.142] lstrlenW (lpString=".vhd") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".vhd") returned 0x0 [0043.143] lstrlenW (lpString=".vhdx") returned 5 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".vhdx") returned 0x0 [0043.143] lstrlenW (lpString=".pst") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".pst") returned 0x0 [0043.143] lstrlenW (lpString=".ost") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".ost") returned 0x0 [0043.143] lstrlenW (lpString=".bak") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".bak") returned 0x0 [0043.143] lstrlenW (lpString=".bac") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".bac") returned 0x0 [0043.143] lstrlenW (lpString=".sys") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".sys") returned 0x0 [0043.143] lstrlenW (lpString=".v2i") returned 4 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".v2i") returned 0x0 [0043.143] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.345] lstrlenW (lpString=".sql") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".sql") returned 0x0 [0043.345] lstrlenW (lpString=".mdf") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".mdf") returned 0x0 [0043.345] lstrlenW (lpString=".txt") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".txt") returned 0x0 [0043.345] lstrlenW (lpString=".dbf") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".dbf") returned 0x0 [0043.345] lstrlenW (lpString=".ckp") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".ckp") returned 0x0 [0043.345] lstrlenW (lpString=".dacpac") returned 7 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".dacpac") returned 0x0 [0043.345] lstrlenW (lpString=".db3") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".db3") returned 0x0 [0043.345] lstrlenW (lpString=".dtxs") returned 5 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".dtxs") returned 0x0 [0043.345] lstrlenW (lpString=".mdt") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".mdt") returned 0x0 [0043.345] lstrlenW (lpString=".sdf") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".sdf") returned 0x0 [0043.345] lstrlenW (lpString=".MDF") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".MDF") returned 0x0 [0043.345] lstrlenW (lpString=".DBF") returned 4 [0043.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".DBF") returned 0x0 [0043.346] lstrlenW (lpString=".DB") returned 3 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".DB") returned 0x0 [0043.346] lstrlenW (lpString=".db") returned 3 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".db") returned 0x0 [0043.346] lstrlenW (lpString=".ndf") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".ndf") returned 0x0 [0043.346] lstrlenW (lpString=".NDF") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".NDF") returned 0x0 [0043.346] lstrlenW (lpString=".Mdf") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".Mdf") returned 0x0 [0043.346] lstrlenW (lpString=".dat") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".dat") returned 0x0 [0043.346] lstrlenW (lpString=".DAT") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".DAT") returned 0x0 [0043.346] lstrlenW (lpString=".ldf") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".ldf") returned 0x0 [0043.346] lstrlenW (lpString=".LDF") returned 4 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch=".LDF") returned 0x0 [0043.346] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0043.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.346] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.348] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.348] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2d8458 [0043.348] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16334936485) returned 1 [0043.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8a5d750, dwHighDateTime=0x1d585b4)) [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8140 [0043.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8140 | out: hHeap=0x260000) returned 1 [0043.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b688 [0043.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b688 | out: hHeap=0x260000) returned 1 [0043.349] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.350] GetLastError () returned 0x0 [0043.350] GetLastError () returned 0x0 [0043.350] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.350] GetLastError () returned 0x0 [0043.350] GetLastError () returned 0x0 [0043.351] ReadFile (in: hFile=0xf0, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x3580, lpOverlapped=0x0) returned 1 [0043.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffca80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.354] WriteFile (in: hFile=0xf0, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3580, lpOverlapped=0x0) returned 1 [0043.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.354] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.354] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.354] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.354] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.354] CloseHandle (hObject=0xf0) returned 1 [0043.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.354] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0043.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315be0 | out: hHeap=0x260000) returned 1 [0043.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0043.356] GetLastError () returned 0x0 [0043.356] RtlWakeConditionVariable () returned 0x27e828 [0043.356] GetCurrentThreadId () returned 0x9ac [0043.356] GetCurrentThreadId () returned 0x9ac [0043.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b688 [0043.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cf80 | out: hHeap=0x260000) returned 1 [0043.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8108 | out: hHeap=0x260000) returned 1 [0043.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0043.357] lstrlenW (lpString=".ldf") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".ldf") returned 0x0 [0043.357] lstrlenW (lpString=".vhd") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".vhd") returned 0x0 [0043.357] lstrlenW (lpString=".vhdx") returned 5 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".vhdx") returned 0x0 [0043.357] lstrlenW (lpString=".pst") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".pst") returned 0x0 [0043.357] lstrlenW (lpString=".ost") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".ost") returned 0x0 [0043.357] lstrlenW (lpString=".bak") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".bak") returned 0x0 [0043.357] lstrlenW (lpString=".bac") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".bac") returned 0x0 [0043.357] lstrlenW (lpString=".sys") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".sys") returned 0x0 [0043.357] lstrlenW (lpString=".v2i") returned 4 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".v2i") returned 0x0 [0043.357] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.390] lstrlenW (lpString=".sql") returned 4 [0043.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".sql") returned 0x0 [0043.390] lstrlenW (lpString=".mdf") returned 4 [0043.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".mdf") returned 0x0 [0043.390] lstrlenW (lpString=".txt") returned 4 [0043.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".txt") returned 0x0 [0043.390] lstrlenW (lpString=".dbf") returned 4 [0043.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".dbf") returned 0x0 [0043.390] lstrlenW (lpString=".ckp") returned 4 [0043.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".ckp") returned 0x0 [0043.390] lstrlenW (lpString=".dacpac") returned 7 [0043.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".dacpac") returned 0x0 [0043.391] lstrlenW (lpString=".db3") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".db3") returned 0x0 [0043.391] lstrlenW (lpString=".dtxs") returned 5 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".dtxs") returned 0x0 [0043.391] lstrlenW (lpString=".mdt") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".mdt") returned 0x0 [0043.391] lstrlenW (lpString=".sdf") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".sdf") returned 0x0 [0043.391] lstrlenW (lpString=".MDF") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".MDF") returned 0x0 [0043.391] lstrlenW (lpString=".DBF") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".DBF") returned 0x0 [0043.391] lstrlenW (lpString=".DB") returned 3 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".DB") returned 0x0 [0043.391] lstrlenW (lpString=".db") returned 3 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".db") returned 0x0 [0043.391] lstrlenW (lpString=".ndf") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".ndf") returned 0x0 [0043.391] lstrlenW (lpString=".NDF") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".NDF") returned 0x0 [0043.391] lstrlenW (lpString=".Mdf") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".Mdf") returned 0x0 [0043.391] lstrlenW (lpString=".dat") returned 4 [0043.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".dat") returned 0x0 [0043.391] lstrlenW (lpString=".DAT") returned 4 [0043.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".DAT") returned 0x0 [0043.392] lstrlenW (lpString=".ldf") returned 4 [0043.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".ldf") returned 0x0 [0043.392] lstrlenW (lpString=".LDF") returned 4 [0043.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch=".LDF") returned 0x0 [0043.392] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.392] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.393] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.393] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.393] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16339417208) returned 1 [0043.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8acfb70, dwHighDateTime=0x1d585b4)) [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8098 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8098 | out: hHeap=0x260000) returned 1 [0043.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0043.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0043.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.394] GetLastError () returned 0x0 [0043.394] GetLastError () returned 0x0 [0043.394] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.394] GetLastError () returned 0x0 [0043.394] GetLastError () returned 0x0 [0043.395] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.400] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.400] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.401] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.401] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.401] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.401] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.401] CloseHandle (hObject=0xfc) returned 1 [0043.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.402] GetLastError () returned 0x0 [0043.403] RtlWakeConditionVariable () returned 0x27e828 [0043.403] GetCurrentThreadId () returned 0x9ac [0043.403] GetCurrentThreadId () returned 0x9ac [0043.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x296f78 | out: hHeap=0x260000) returned 1 [0043.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0043.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296f78 [0043.403] lstrlenW (lpString=".ldf") returned 4 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".ldf") returned 0x0 [0043.403] lstrlenW (lpString=".vhd") returned 4 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".vhd") returned 0x0 [0043.403] lstrlenW (lpString=".vhdx") returned 5 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".vhdx") returned 0x0 [0043.403] lstrlenW (lpString=".pst") returned 4 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".pst") returned 0x0 [0043.403] lstrlenW (lpString=".ost") returned 4 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".ost") returned 0x0 [0043.403] lstrlenW (lpString=".bak") returned 4 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".bak") returned 0x0 [0043.403] lstrlenW (lpString=".bac") returned 4 [0043.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".bac") returned 0x0 [0043.403] lstrlenW (lpString=".sys") returned 4 [0043.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".sys") returned 0x0 [0043.404] lstrlenW (lpString=".v2i") returned 4 [0043.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".v2i") returned 0x0 [0043.404] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0043.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.406] lstrlenW (lpString=".sql") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".sql") returned 0x0 [0043.406] lstrlenW (lpString=".mdf") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".mdf") returned 0x0 [0043.406] lstrlenW (lpString=".txt") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".txt") returned 0x0 [0043.406] lstrlenW (lpString=".dbf") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".dbf") returned 0x0 [0043.406] lstrlenW (lpString=".ckp") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".ckp") returned 0x0 [0043.406] lstrlenW (lpString=".dacpac") returned 7 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".dacpac") returned 0x0 [0043.406] lstrlenW (lpString=".db3") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".db3") returned 0x0 [0043.406] lstrlenW (lpString=".dtxs") returned 5 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".dtxs") returned 0x0 [0043.406] lstrlenW (lpString=".mdt") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".mdt") returned 0x0 [0043.406] lstrlenW (lpString=".sdf") returned 4 [0043.406] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".sdf") returned 0x0 [0043.406] lstrlenW (lpString=".MDF") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".MDF") returned 0x0 [0043.407] lstrlenW (lpString=".DBF") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".DBF") returned 0x0 [0043.407] lstrlenW (lpString=".DB") returned 3 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".DB") returned 0x0 [0043.407] lstrlenW (lpString=".db") returned 3 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".db") returned 0x0 [0043.407] lstrlenW (lpString=".ndf") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".ndf") returned 0x0 [0043.407] lstrlenW (lpString=".NDF") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".NDF") returned 0x0 [0043.407] lstrlenW (lpString=".Mdf") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".Mdf") returned 0x0 [0043.407] lstrlenW (lpString=".dat") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".dat") returned 0x0 [0043.407] lstrlenW (lpString=".DAT") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".DAT") returned 0x0 [0043.407] lstrlenW (lpString=".ldf") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".ldf") returned 0x0 [0043.407] lstrlenW (lpString=".LDF") returned 4 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch=".LDF") returned 0x0 [0043.407] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.408] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.409] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.409] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.409] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16340996548) returned 1 [0043.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8af5cd0, dwHighDateTime=0x1d585b4)) [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8060 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8060 | out: hHeap=0x260000) returned 1 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b688 [0043.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297730 [0043.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b688 | out: hHeap=0x260000) returned 1 [0043.409] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.410] GetLastError () returned 0x0 [0043.410] GetLastError () returned 0x0 [0043.410] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.410] GetLastError () returned 0x0 [0043.410] GetLastError () returned 0x0 [0043.410] ReadFile (in: hFile=0xfc, lpBuffer=0x3382e0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.500] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.500] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.501] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.501] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.501] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.501] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.501] CloseHandle (hObject=0xfc) returned 1 [0043.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.[deadmin@cock.li].deadmin")) returned 1 [0043.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.573] GetLastError () returned 0x0 [0043.573] RtlWakeConditionVariable () returned 0x27e828 [0043.573] GetCurrentThreadId () returned 0x9ac [0043.573] GetCurrentThreadId () returned 0x9ac [0043.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0043.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e870 | out: hHeap=0x260000) returned 1 [0043.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b68 | out: hHeap=0x260000) returned 1 [0043.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e870 [0043.573] lstrlenW (lpString=".ldf") returned 4 [0043.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".ldf") returned 0x0 [0043.574] lstrlenW (lpString=".vhd") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".vhd") returned 0x0 [0043.574] lstrlenW (lpString=".vhdx") returned 5 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".vhdx") returned 0x0 [0043.574] lstrlenW (lpString=".pst") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".pst") returned 0x0 [0043.574] lstrlenW (lpString=".ost") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".ost") returned 0x0 [0043.574] lstrlenW (lpString=".bak") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".bak") returned 0x0 [0043.574] lstrlenW (lpString=".bac") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".bac") returned 0x0 [0043.574] lstrlenW (lpString=".sys") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".sys") returned 0x0 [0043.574] lstrlenW (lpString=".v2i") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".v2i") returned 0x0 [0043.574] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0043.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.574] lstrlenW (lpString=".sql") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".sql") returned 0x0 [0043.574] lstrlenW (lpString=".mdf") returned 4 [0043.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".mdf") returned 0x0 [0043.575] lstrlenW (lpString=".txt") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".txt") returned 0x0 [0043.575] lstrlenW (lpString=".dbf") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".dbf") returned 0x0 [0043.575] lstrlenW (lpString=".ckp") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".ckp") returned 0x0 [0043.575] lstrlenW (lpString=".dacpac") returned 7 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".dacpac") returned 0x0 [0043.575] lstrlenW (lpString=".db3") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".db3") returned 0x0 [0043.575] lstrlenW (lpString=".dtxs") returned 5 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".dtxs") returned 0x0 [0043.575] lstrlenW (lpString=".mdt") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".mdt") returned 0x0 [0043.575] lstrlenW (lpString=".sdf") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".sdf") returned 0x0 [0043.575] lstrlenW (lpString=".MDF") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".MDF") returned 0x0 [0043.575] lstrlenW (lpString=".DBF") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".DBF") returned 0x0 [0043.575] lstrlenW (lpString=".DB") returned 3 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".DB") returned 0x0 [0043.575] lstrlenW (lpString=".db") returned 3 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".db") returned 0x0 [0043.575] lstrlenW (lpString=".ndf") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".ndf") returned 0x0 [0043.575] lstrlenW (lpString=".NDF") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".NDF") returned 0x0 [0043.575] lstrlenW (lpString=".Mdf") returned 4 [0043.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".Mdf") returned 0x0 [0043.576] lstrlenW (lpString=".dat") returned 4 [0043.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".dat") returned 0x0 [0043.576] lstrlenW (lpString=".DAT") returned 4 [0043.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".DAT") returned 0x0 [0043.576] lstrlenW (lpString=".ldf") returned 4 [0043.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".ldf") returned 0x0 [0043.576] lstrlenW (lpString=".LDF") returned 4 [0043.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch=".LDF") returned 0x0 [0043.576] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.576] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.577] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.577] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16357793343) returned 1 [0043.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8c98bf0, dwHighDateTime=0x1d585b4)) [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337b68 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b68 | out: hHeap=0x260000) returned 1 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ce30 [0043.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0043.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.577] GetLastError () returned 0x0 [0043.578] GetLastError () returned 0x0 [0043.578] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.578] GetLastError () returned 0x0 [0043.578] GetLastError () returned 0x0 [0043.578] ReadFile (in: hFile=0xfc, lpBuffer=0x31ead8, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.582] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.582] WriteFile (in: hFile=0xfc, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0043.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0043.582] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.582] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.582] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.582] CloseHandle (hObject=0xfc) returned 1 [0043.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0043.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.[deadmin@cock.li].deadmin")) returned 1 [0043.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0043.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.583] GetLastError () returned 0x0 [0043.583] RtlWakeConditionVariable () returned 0x27e828 [0043.583] GetCurrentThreadId () returned 0x9ac [0043.583] GetCurrentThreadId () returned 0x9ac [0043.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da790 | out: hHeap=0x260000) returned 1 [0043.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b30 | out: hHeap=0x260000) returned 1 [0043.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da790 [0043.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0043.584] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.584] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.584] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.584] WriteFile (in: hFile=0xfc, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.585] CloseHandle (hObject=0xfc) returned 1 [0043.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da790 | out: hHeap=0x260000) returned 1 [0043.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.585] RtlWakeConditionVariable () returned 0x27e828 [0043.585] GetCurrentThreadId () returned 0x9ac [0043.586] GetCurrentThreadId () returned 0x9ac [0043.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297568 | out: hHeap=0x260000) returned 1 [0043.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d60 | out: hHeap=0x260000) returned 1 [0043.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297568 [0043.586] lstrlenW (lpString=".ldf") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".ldf") returned 0x0 [0043.586] lstrlenW (lpString=".vhd") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".vhd") returned 0x0 [0043.586] lstrlenW (lpString=".vhdx") returned 5 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".vhdx") returned 0x0 [0043.586] lstrlenW (lpString=".pst") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".pst") returned 0x0 [0043.586] lstrlenW (lpString=".ost") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".ost") returned 0x0 [0043.586] lstrlenW (lpString=".bak") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".bak") returned 0x0 [0043.586] lstrlenW (lpString=".bac") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".bac") returned 0x0 [0043.586] lstrlenW (lpString=".sys") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".sys") returned 0x0 [0043.586] lstrlenW (lpString=".v2i") returned 4 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch=".v2i") returned 0x0 [0043.586] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpSrch="s\r\n.v2i") returned 0x0 [0043.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297568 | out: hHeap=0x260000) returned 1 [0043.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2971d8 | out: hHeap=0x260000) returned 1 [0043.694] RtlWakeConditionVariable () returned 0x27e828 [0043.694] GetCurrentThreadId () returned 0x9ac [0043.694] GetCurrentThreadId () returned 0x9ac [0043.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5e20 [0043.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5ec8 | out: hHeap=0x260000) returned 1 [0043.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30da58 | out: hHeap=0x260000) returned 1 [0043.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5ec8 [0043.694] lstrlenW (lpString=".ldf") returned 4 [0043.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".ldf") returned 0x0 [0043.694] lstrlenW (lpString=".vhd") returned 4 [0043.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".vhd") returned 0x0 [0043.694] lstrlenW (lpString=".vhdx") returned 5 [0043.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".vhdx") returned 0x0 [0043.694] lstrlenW (lpString=".pst") returned 4 [0043.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".pst") returned 0x0 [0043.694] lstrlenW (lpString=".ost") returned 4 [0043.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".ost") returned 0x0 [0043.695] lstrlenW (lpString=".bak") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".bak") returned 0x0 [0043.695] lstrlenW (lpString=".bac") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".bac") returned 0x0 [0043.695] lstrlenW (lpString=".sys") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".sys") returned 0x0 [0043.695] lstrlenW (lpString=".v2i") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".v2i") returned 0x0 [0043.695] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch="s\r\n.v2i") returned 0x0 [0043.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.695] lstrlenW (lpString=".sql") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".sql") returned 0x0 [0043.695] lstrlenW (lpString=".mdf") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".mdf") returned 0x0 [0043.695] lstrlenW (lpString=".txt") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".txt") returned 0x0 [0043.695] lstrlenW (lpString=".dbf") returned 4 [0043.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".dbf") returned 0x0 [0043.696] lstrlenW (lpString=".ckp") returned 4 [0043.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".ckp") returned 0x0 [0043.696] lstrlenW (lpString=".dacpac") returned 7 [0043.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".dacpac") returned 0x0 [0043.696] lstrlenW (lpString=".db3") returned 4 [0043.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".db3") returned 0x0 [0043.696] lstrlenW (lpString=".dtxs") returned 5 [0043.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".dtxs") returned 0x0 [0043.702] lstrlenW (lpString=".mdt") returned 4 [0043.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".mdt") returned 0x0 [0043.702] lstrlenW (lpString=".sdf") returned 4 [0043.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".sdf") returned 0x0 [0043.710] lstrlenW (lpString=".MDF") returned 4 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".MDF") returned 0x0 [0043.710] lstrlenW (lpString=".DBF") returned 4 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".DBF") returned 0x0 [0043.710] lstrlenW (lpString=".DB") returned 3 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".DB") returned 0x0 [0043.710] lstrlenW (lpString=".db") returned 3 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".db") returned 0x0 [0043.710] lstrlenW (lpString=".ndf") returned 4 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".ndf") returned 0x0 [0043.710] lstrlenW (lpString=".NDF") returned 4 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".NDF") returned 0x0 [0043.710] lstrlenW (lpString=".Mdf") returned 4 [0043.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".Mdf") returned 0x0 [0043.710] lstrlenW (lpString=".dat") returned 4 [0043.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".dat") returned 0x0 [0043.711] lstrlenW (lpString=".DAT") returned 4 [0043.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".DAT") returned 0x0 [0043.732] lstrlenW (lpString=".ldf") returned 4 [0043.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".ldf") returned 0x0 [0043.733] lstrlenW (lpString=".LDF") returned 4 [0043.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch=".LDF") returned 0x0 [0043.733] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.733] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.768] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.773] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.773] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16377425062) returned 1 [0043.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8e61c70, dwHighDateTime=0x1d585b4)) [0043.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0dc0 [0043.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0dc0 | out: hHeap=0x260000) returned 1 [0043.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29db50 [0043.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29db50 | out: hHeap=0x260000) returned 1 [0043.774] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.774] GetLastError () returned 0x0 [0043.774] GetLastError () returned 0x0 [0043.774] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.774] GetLastError () returned 0x0 [0043.775] GetLastError () returned 0x0 [0043.778] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7098, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.778] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8f68, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x8f68, lpOverlapped=0x0) returned 1 [0043.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.778] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.778] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.778] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.778] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.778] CloseHandle (hObject=0x108) returned 1 [0043.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0043.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.[deadmin@cock.li].deadmin")) returned 1 [0043.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0043.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.779] GetLastError () returned 0x0 [0043.779] RtlWakeConditionVariable () returned 0x27e828 [0043.779] GetCurrentThreadId () returned 0x9ac [0043.779] GetCurrentThreadId () returned 0x9ac [0043.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0043.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f26e0 | out: hHeap=0x260000) returned 1 [0043.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0043.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f26e0 [0043.779] lstrlenW (lpString=".ldf") returned 4 [0043.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.779] lstrlenW (lpString=".vhd") returned 4 [0043.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0043.779] lstrlenW (lpString=".vhdx") returned 5 [0043.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0043.780] lstrlenW (lpString=".pst") returned 4 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0043.780] lstrlenW (lpString=".ost") returned 4 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0043.780] lstrlenW (lpString=".bak") returned 4 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0043.780] lstrlenW (lpString=".bac") returned 4 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0043.780] lstrlenW (lpString=".sys") returned 4 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0043.780] lstrlenW (lpString=".v2i") returned 4 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0043.780] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0043.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.781] lstrlenW (lpString=".sql") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0043.781] lstrlenW (lpString=".mdf") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0043.781] lstrlenW (lpString=".txt") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0043.781] lstrlenW (lpString=".dbf") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0043.781] lstrlenW (lpString=".ckp") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0043.781] lstrlenW (lpString=".dacpac") returned 7 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0043.781] lstrlenW (lpString=".db3") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0043.781] lstrlenW (lpString=".dtxs") returned 5 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0043.781] lstrlenW (lpString=".mdt") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0043.781] lstrlenW (lpString=".sdf") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0043.781] lstrlenW (lpString=".MDF") returned 4 [0043.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0043.782] lstrlenW (lpString=".DBF") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0043.782] lstrlenW (lpString=".DB") returned 3 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0043.782] lstrlenW (lpString=".db") returned 3 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0043.782] lstrlenW (lpString=".ndf") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0043.782] lstrlenW (lpString=".NDF") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0043.782] lstrlenW (lpString=".Mdf") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0043.782] lstrlenW (lpString=".dat") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0043.782] lstrlenW (lpString=".DAT") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0043.782] lstrlenW (lpString=".ldf") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.782] lstrlenW (lpString=".LDF") returned 4 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0043.782] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.782] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.783] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.783] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0043.783] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16378428176) returned 1 [0043.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa8e87dd0, dwHighDateTime=0x1d585b4)) [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0df8 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0043.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0df8 | out: hHeap=0x260000) returned 1 [0043.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0043.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0043.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f5e20 [0043.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0043.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0043.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5e20 | out: hHeap=0x260000) returned 1 [0043.784] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.784] GetLastError () returned 0x0 [0043.784] GetLastError () returned 0x0 [0043.784] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.784] GetLastError () returned 0x0 [0043.784] GetLastError () returned 0x0 [0043.833] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff9d6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.833] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6292, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x6292, lpOverlapped=0x0) returned 1 [0043.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0043.833] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.833] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.833] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.833] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.833] CloseHandle (hObject=0x108) returned 1 [0043.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0043.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.834] GetLastError () returned 0x0 [0043.834] RtlWakeConditionVariable () returned 0x27e828 [0043.834] GetCurrentThreadId () returned 0x9ac [0043.834] GetCurrentThreadId () returned 0x9ac [0043.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da920 | out: hHeap=0x260000) returned 1 [0043.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338268 | out: hHeap=0x260000) returned 1 [0043.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da920 [0043.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.948] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.948] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.948] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.948] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.949] CloseHandle (hObject=0x100) returned 1 [0043.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da920 | out: hHeap=0x260000) returned 1 [0043.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.949] RtlWakeConditionVariable () returned 0x27e828 [0043.949] GetCurrentThreadId () returned 0x9ac [0043.949] GetCurrentThreadId () returned 0x9ac [0043.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0043.949] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3de0 | out: hHeap=0x260000) returned 1 [0043.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd88 | out: hHeap=0x260000) returned 1 [0043.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3de0 [0043.950] lstrlenW (lpString=".ldf") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.950] lstrlenW (lpString=".vhd") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0043.950] lstrlenW (lpString=".vhdx") returned 5 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0043.950] lstrlenW (lpString=".pst") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0043.950] lstrlenW (lpString=".ost") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0043.950] lstrlenW (lpString=".bak") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0043.950] lstrlenW (lpString=".bac") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0043.950] lstrlenW (lpString=".sys") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0043.950] lstrlenW (lpString=".v2i") returned 4 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0043.950] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.950] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0043.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.951] lstrlenW (lpString=".sql") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0043.951] lstrlenW (lpString=".mdf") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0043.951] lstrlenW (lpString=".txt") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0043.951] lstrlenW (lpString=".dbf") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0043.951] lstrlenW (lpString=".ckp") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0043.951] lstrlenW (lpString=".dacpac") returned 7 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0043.951] lstrlenW (lpString=".db3") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0043.951] lstrlenW (lpString=".dtxs") returned 5 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0043.951] lstrlenW (lpString=".mdt") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0043.951] lstrlenW (lpString=".sdf") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0043.951] lstrlenW (lpString=".MDF") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0043.951] lstrlenW (lpString=".DBF") returned 4 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0043.951] lstrlenW (lpString=".DB") returned 3 [0043.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0043.952] lstrlenW (lpString=".db") returned 3 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0043.952] lstrlenW (lpString=".ndf") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0043.952] lstrlenW (lpString=".NDF") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0043.952] lstrlenW (lpString=".Mdf") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0043.952] lstrlenW (lpString=".dat") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0043.952] lstrlenW (lpString=".DAT") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0043.952] lstrlenW (lpString=".ldf") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0043.952] lstrlenW (lpString=".LDF") returned 4 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0043.952] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.952] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.953] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.953] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x3382e0 [0043.953] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16395431402) returned 1 [0043.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa902acf0, dwHighDateTime=0x1d585b4)) [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cd88 [0043.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd88 | out: hHeap=0x260000) returned 1 [0043.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0043.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0043.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.954] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.954] GetLastError () returned 0x0 [0043.954] GetLastError () returned 0x0 [0043.954] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.954] GetLastError () returned 0x0 [0043.954] GetLastError () returned 0x0 [0043.957] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff7f0f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.957] WriteFile (in: hFile=0x100, lpBuffer=0x3394f8*, nNumberOfBytesToWrite=0x80f1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3394f8*, lpNumberOfBytesWritten=0x24cfdb0*=0x80f1, lpOverlapped=0x0) returned 1 [0043.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3394f8 | out: hHeap=0x260000) returned 1 [0043.957] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.957] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.958] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.958] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.958] CloseHandle (hObject=0x100) returned 1 [0043.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0043.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.958] GetLastError () returned 0x0 [0043.958] RtlWakeConditionVariable () returned 0x27e828 [0043.959] GetCurrentThreadId () returned 0x9ac [0043.959] GetCurrentThreadId () returned 0x9ac [0043.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da3a8 | out: hHeap=0x260000) returned 1 [0043.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cd50 | out: hHeap=0x260000) returned 1 [0043.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da3a8 [0043.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.961] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.961] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0043.961] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0043.961] WriteFile (in: hFile=0x100, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0043.962] CloseHandle (hObject=0x100) returned 1 [0043.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da3a8 | out: hHeap=0x260000) returned 1 [0043.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da150 | out: hHeap=0x260000) returned 1 [0043.962] RtlWakeConditionVariable () returned 0x27e828 [0043.962] GetCurrentThreadId () returned 0x9ac [0043.963] GetCurrentThreadId () returned 0x9ac [0043.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0043.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3f50 | out: hHeap=0x260000) returned 1 [0043.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d0d0 | out: hHeap=0x260000) returned 1 [0043.963] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3f50 [0043.963] lstrlenW (lpString=".ldf") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".ldf") returned 0x0 [0043.963] lstrlenW (lpString=".vhd") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".vhd") returned 0x0 [0043.963] lstrlenW (lpString=".vhdx") returned 5 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".vhdx") returned 0x0 [0043.963] lstrlenW (lpString=".pst") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".pst") returned 0x0 [0043.963] lstrlenW (lpString=".ost") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".ost") returned 0x0 [0043.963] lstrlenW (lpString=".bak") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".bak") returned 0x0 [0043.963] lstrlenW (lpString=".bac") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".bac") returned 0x0 [0043.963] lstrlenW (lpString=".sys") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".sys") returned 0x0 [0043.963] lstrlenW (lpString=".v2i") returned 4 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".v2i") returned 0x0 [0043.963] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.963] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0043.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.964] lstrlenW (lpString=".sql") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".sql") returned 0x0 [0043.964] lstrlenW (lpString=".mdf") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".mdf") returned 0x0 [0043.964] lstrlenW (lpString=".txt") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".txt") returned 0x0 [0043.964] lstrlenW (lpString=".dbf") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".dbf") returned 0x0 [0043.964] lstrlenW (lpString=".ckp") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".ckp") returned 0x0 [0043.964] lstrlenW (lpString=".dacpac") returned 7 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".dacpac") returned 0x0 [0043.964] lstrlenW (lpString=".db3") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".db3") returned 0x0 [0043.964] lstrlenW (lpString=".dtxs") returned 5 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".dtxs") returned 0x0 [0043.964] lstrlenW (lpString=".mdt") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".mdt") returned 0x0 [0043.964] lstrlenW (lpString=".sdf") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".sdf") returned 0x0 [0043.964] lstrlenW (lpString=".MDF") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".MDF") returned 0x0 [0043.964] lstrlenW (lpString=".DBF") returned 4 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".DBF") returned 0x0 [0043.964] lstrlenW (lpString=".DB") returned 3 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".DB") returned 0x0 [0043.964] lstrlenW (lpString=".db") returned 3 [0043.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".db") returned 0x0 [0043.964] lstrlenW (lpString=".ndf") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".ndf") returned 0x0 [0043.965] lstrlenW (lpString=".NDF") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".NDF") returned 0x0 [0043.965] lstrlenW (lpString=".Mdf") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".Mdf") returned 0x0 [0043.965] lstrlenW (lpString=".dat") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".dat") returned 0x0 [0043.965] lstrlenW (lpString=".DAT") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".DAT") returned 0x0 [0043.965] lstrlenW (lpString=".ldf") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".ldf") returned 0x0 [0043.965] lstrlenW (lpString=".LDF") returned 4 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch=".LDF") returned 0x0 [0043.965] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.965] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.966] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.966] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x3382e0 [0043.966] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16396707487) returned 1 [0043.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9050e50, dwHighDateTime=0x1d585b4)) [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d0d0 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d0d0 | out: hHeap=0x260000) returned 1 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0043.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0043.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.966] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.967] GetLastError () returned 0x0 [0043.967] GetLastError () returned 0x0 [0043.967] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.967] GetLastError () returned 0x0 [0043.967] GetLastError () returned 0x0 [0043.971] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff257a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.971] WriteFile (in: hFile=0x100, lpBuffer=0x3394f8*, nNumberOfBytesToWrite=0xda86, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3394f8*, lpNumberOfBytesWritten=0x24cfdb0*=0xda86, lpOverlapped=0x0) returned 1 [0043.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3394f8 | out: hHeap=0x260000) returned 1 [0043.971] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.971] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.971] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.971] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.971] CloseHandle (hObject=0x100) returned 1 [0043.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.[deadmin@cock.li].deadmin")) returned 1 [0043.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.972] GetLastError () returned 0x0 [0043.972] RtlWakeConditionVariable () returned 0x27e828 [0043.972] GetCurrentThreadId () returned 0x9ac [0043.972] GetCurrentThreadId () returned 0x9ac [0043.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0043.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3c70 | out: hHeap=0x260000) returned 1 [0043.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d098 | out: hHeap=0x260000) returned 1 [0043.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3c70 [0043.972] lstrlenW (lpString=".ldf") returned 4 [0043.972] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".ldf") returned 0x0 [0043.972] lstrlenW (lpString=".vhd") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".vhd") returned 0x0 [0043.973] lstrlenW (lpString=".vhdx") returned 5 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".vhdx") returned 0x0 [0043.973] lstrlenW (lpString=".pst") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".pst") returned 0x0 [0043.973] lstrlenW (lpString=".ost") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".ost") returned 0x0 [0043.973] lstrlenW (lpString=".bak") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".bak") returned 0x0 [0043.973] lstrlenW (lpString=".bac") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".bac") returned 0x0 [0043.973] lstrlenW (lpString=".sys") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".sys") returned 0x0 [0043.973] lstrlenW (lpString=".v2i") returned 4 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".v2i") returned 0x0 [0043.973] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch="s\r\n.v2i") returned 0x0 [0043.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.974] lstrlenW (lpString=".sql") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".sql") returned 0x0 [0043.974] lstrlenW (lpString=".mdf") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".mdf") returned 0x0 [0043.974] lstrlenW (lpString=".txt") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".txt") returned 0x0 [0043.974] lstrlenW (lpString=".dbf") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".dbf") returned 0x0 [0043.974] lstrlenW (lpString=".ckp") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".ckp") returned 0x0 [0043.974] lstrlenW (lpString=".dacpac") returned 7 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".dacpac") returned 0x0 [0043.974] lstrlenW (lpString=".db3") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".db3") returned 0x0 [0043.974] lstrlenW (lpString=".dtxs") returned 5 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".dtxs") returned 0x0 [0043.974] lstrlenW (lpString=".mdt") returned 4 [0043.974] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".mdt") returned 0x0 [0043.975] lstrlenW (lpString=".sdf") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".sdf") returned 0x0 [0043.975] lstrlenW (lpString=".MDF") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".MDF") returned 0x0 [0043.975] lstrlenW (lpString=".DBF") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".DBF") returned 0x0 [0043.975] lstrlenW (lpString=".DB") returned 3 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".DB") returned 0x0 [0043.975] lstrlenW (lpString=".db") returned 3 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".db") returned 0x0 [0043.975] lstrlenW (lpString=".ndf") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".ndf") returned 0x0 [0043.975] lstrlenW (lpString=".NDF") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".NDF") returned 0x0 [0043.975] lstrlenW (lpString=".Mdf") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".Mdf") returned 0x0 [0043.975] lstrlenW (lpString=".dat") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".dat") returned 0x0 [0043.975] lstrlenW (lpString=".DAT") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".DAT") returned 0x0 [0043.975] lstrlenW (lpString=".ldf") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".ldf") returned 0x0 [0043.975] lstrlenW (lpString=".LDF") returned 4 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch=".LDF") returned 0x0 [0043.975] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.975] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.975] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.975] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.976] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x3382e0 [0043.976] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16397759682) returned 1 [0043.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9076fb0, dwHighDateTime=0x1d585b4)) [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d098 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d098 | out: hHeap=0x260000) returned 1 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0043.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0043.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.977] GetLastError () returned 0x0 [0043.977] GetLastError () returned 0x0 [0043.977] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.977] GetLastError () returned 0x0 [0043.977] GetLastError () returned 0x0 [0043.979] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffddb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.979] WriteFile (in: hFile=0x100, lpBuffer=0x3394f8*, nNumberOfBytesToWrite=0x225, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3394f8*, lpNumberOfBytesWritten=0x24cfdb0*=0x225, lpOverlapped=0x0) returned 1 [0043.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3394f8 | out: hHeap=0x260000) returned 1 [0043.979] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.979] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0043.979] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0043.979] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0043.979] CloseHandle (hObject=0x100) returned 1 [0043.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0043.979] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.[deadmin@cock.li].deadmin")) returned 1 [0043.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0043.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0043.981] GetLastError () returned 0x0 [0043.981] RtlWakeConditionVariable () returned 0x27e828 [0043.981] GetCurrentThreadId () returned 0x9ac [0043.981] GetCurrentThreadId () returned 0x9ac [0043.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3b00 [0043.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3bb8 | out: hHeap=0x260000) returned 1 [0043.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0043.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0043.982] lstrlenW (lpString=".ldf") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.982] lstrlenW (lpString=".vhd") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0043.982] lstrlenW (lpString=".vhdx") returned 5 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0043.982] lstrlenW (lpString=".pst") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0043.982] lstrlenW (lpString=".ost") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0043.982] lstrlenW (lpString=".bak") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0043.982] lstrlenW (lpString=".bac") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0043.982] lstrlenW (lpString=".sys") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0043.982] lstrlenW (lpString=".v2i") returned 4 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0043.982] lstrlenW (lpString="s\r\n.v2i") returned 7 [0043.982] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0043.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0043.982] lstrlenW (lpString=".sql") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0043.983] lstrlenW (lpString=".mdf") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0043.983] lstrlenW (lpString=".txt") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0043.983] lstrlenW (lpString=".dbf") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0043.983] lstrlenW (lpString=".ckp") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0043.983] lstrlenW (lpString=".dacpac") returned 7 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0043.983] lstrlenW (lpString=".db3") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0043.983] lstrlenW (lpString=".dtxs") returned 5 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0043.983] lstrlenW (lpString=".mdt") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0043.983] lstrlenW (lpString=".sdf") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0043.983] lstrlenW (lpString=".MDF") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0043.983] lstrlenW (lpString=".DBF") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0043.983] lstrlenW (lpString=".DB") returned 3 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0043.983] lstrlenW (lpString=".db") returned 3 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0043.983] lstrlenW (lpString=".ndf") returned 4 [0043.983] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0043.983] lstrlenW (lpString=".NDF") returned 4 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0043.984] lstrlenW (lpString=".Mdf") returned 4 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0043.984] lstrlenW (lpString=".dat") returned 4 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0043.984] lstrlenW (lpString=".DAT") returned 4 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0043.984] lstrlenW (lpString=".ldf") returned 4 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0043.984] lstrlenW (lpString=".LDF") returned 4 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0043.984] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0043.984] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0043.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0043.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0043.984] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0043.985] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0043.985] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0043.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x3382e0 [0043.985] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16398609538) returned 1 [0043.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9076fb0, dwHighDateTime=0x1d585b4)) [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d060 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0043.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d060 | out: hHeap=0x260000) returned 1 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297e38 [0043.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29eb10 [0043.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0043.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29eb10 | out: hHeap=0x260000) returned 1 [0043.986] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0043.986] GetLastError () returned 0x0 [0043.986] GetLastError () returned 0x0 [0043.986] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0043.986] GetLastError () returned 0x0 [0043.986] GetLastError () returned 0x0 [0044.102] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff87b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.102] WriteFile (in: hFile=0x100, lpBuffer=0x3394f8*, nNumberOfBytesToWrite=0x785, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3394f8*, lpNumberOfBytesWritten=0x24cfdb0*=0x785, lpOverlapped=0x0) returned 1 [0044.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3394f8 | out: hHeap=0x260000) returned 1 [0044.102] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.102] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.102] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.102] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.102] CloseHandle (hObject=0x100) returned 1 [0044.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.103] GetLastError () returned 0x0 [0044.103] RtlWakeConditionVariable () returned 0x27e828 [0044.103] GetCurrentThreadId () returned 0x9ac [0044.103] GetCurrentThreadId () returned 0x9ac [0044.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da2e0 | out: hHeap=0x260000) returned 1 [0044.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb90 | out: hHeap=0x260000) returned 1 [0044.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da2e0 [0044.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.144] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.144] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.144] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.144] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.145] CloseHandle (hObject=0x104) returned 1 [0044.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da2e0 | out: hHeap=0x260000) returned 1 [0044.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.145] RtlWakeConditionVariable () returned 0x27e828 [0044.145] GetCurrentThreadId () returned 0x9ac [0044.145] GetCurrentThreadId () returned 0x9ac [0044.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3260 | out: hHeap=0x260000) returned 1 [0044.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d1b0 | out: hHeap=0x260000) returned 1 [0044.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3260 [0044.145] lstrlenW (lpString=".ldf") returned 4 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".ldf") returned 0x0 [0044.145] lstrlenW (lpString=".vhd") returned 4 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".vhd") returned 0x0 [0044.145] lstrlenW (lpString=".vhdx") returned 5 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".vhdx") returned 0x0 [0044.145] lstrlenW (lpString=".pst") returned 4 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".pst") returned 0x0 [0044.145] lstrlenW (lpString=".ost") returned 4 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".ost") returned 0x0 [0044.145] lstrlenW (lpString=".bak") returned 4 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".bak") returned 0x0 [0044.145] lstrlenW (lpString=".bac") returned 4 [0044.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".bac") returned 0x0 [0044.145] lstrlenW (lpString=".sys") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".sys") returned 0x0 [0044.146] lstrlenW (lpString=".v2i") returned 4 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".v2i") returned 0x0 [0044.146] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0044.282] lstrlenW (lpString=".sql") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".sql") returned 0x0 [0044.282] lstrlenW (lpString=".mdf") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".mdf") returned 0x0 [0044.282] lstrlenW (lpString=".txt") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".txt") returned 0x0 [0044.282] lstrlenW (lpString=".dbf") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".dbf") returned 0x0 [0044.282] lstrlenW (lpString=".ckp") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".ckp") returned 0x0 [0044.282] lstrlenW (lpString=".dacpac") returned 7 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".dacpac") returned 0x0 [0044.282] lstrlenW (lpString=".db3") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".db3") returned 0x0 [0044.282] lstrlenW (lpString=".dtxs") returned 5 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".dtxs") returned 0x0 [0044.282] lstrlenW (lpString=".mdt") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".mdt") returned 0x0 [0044.282] lstrlenW (lpString=".sdf") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".sdf") returned 0x0 [0044.282] lstrlenW (lpString=".MDF") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".MDF") returned 0x0 [0044.282] lstrlenW (lpString=".DBF") returned 4 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".DBF") returned 0x0 [0044.282] lstrlenW (lpString=".DB") returned 3 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".DB") returned 0x0 [0044.282] lstrlenW (lpString=".db") returned 3 [0044.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".db") returned 0x0 [0044.283] lstrlenW (lpString=".ndf") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".ndf") returned 0x0 [0044.283] lstrlenW (lpString=".NDF") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".NDF") returned 0x0 [0044.283] lstrlenW (lpString=".Mdf") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".Mdf") returned 0x0 [0044.283] lstrlenW (lpString=".dat") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".dat") returned 0x0 [0044.283] lstrlenW (lpString=".DAT") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".DAT") returned 0x0 [0044.283] lstrlenW (lpString=".ldf") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".ldf") returned 0x0 [0044.283] lstrlenW (lpString=".LDF") returned 4 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch=".LDF") returned 0x0 [0044.283] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0044.283] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.284] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0044.284] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0044.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f4108 [0044.284] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16428616165) returned 1 [0044.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa934a9d0, dwHighDateTime=0x1d585b4)) [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1098 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0044.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1098 | out: hHeap=0x260000) returned 1 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30daf0 [0044.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0044.286] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.286] GetLastError () returned 0x0 [0044.286] GetLastError () returned 0x0 [0044.286] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.286] GetLastError () returned 0x0 [0044.286] GetLastError () returned 0x0 [0044.287] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffe0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.287] WriteFile (in: hFile=0x100, lpBuffer=0x31ead8*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x31ead8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f5, lpOverlapped=0x0) returned 1 [0044.287] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ead8 | out: hHeap=0x260000) returned 1 [0044.287] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.287] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.288] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.288] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.288] CloseHandle (hObject=0x100) returned 1 [0044.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.288] GetLastError () returned 0x0 [0044.288] RtlWakeConditionVariable () returned 0x27e828 [0044.288] GetCurrentThreadId () returned 0x9ac [0044.289] GetCurrentThreadId () returned 0x9ac [0044.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f24b8 | out: hHeap=0x260000) returned 1 [0044.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a10d0 | out: hHeap=0x260000) returned 1 [0044.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f24b8 [0044.289] lstrlenW (lpString=".ldf") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.289] lstrlenW (lpString=".vhd") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.289] lstrlenW (lpString=".vhdx") returned 5 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.289] lstrlenW (lpString=".pst") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.289] lstrlenW (lpString=".ost") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.289] lstrlenW (lpString=".bak") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.289] lstrlenW (lpString=".bac") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.289] lstrlenW (lpString=".sys") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.289] lstrlenW (lpString=".v2i") returned 4 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.289] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.311] lstrlenW (lpString=".sql") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.311] lstrlenW (lpString=".mdf") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.311] lstrlenW (lpString=".txt") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.311] lstrlenW (lpString=".dbf") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.311] lstrlenW (lpString=".ckp") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.311] lstrlenW (lpString=".dacpac") returned 7 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.311] lstrlenW (lpString=".db3") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.311] lstrlenW (lpString=".dtxs") returned 5 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.311] lstrlenW (lpString=".mdt") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.311] lstrlenW (lpString=".sdf") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.311] lstrlenW (lpString=".MDF") returned 4 [0044.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.311] lstrlenW (lpString=".DBF") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.312] lstrlenW (lpString=".DB") returned 3 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.312] lstrlenW (lpString=".db") returned 3 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.312] lstrlenW (lpString=".ndf") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.312] lstrlenW (lpString=".NDF") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.312] lstrlenW (lpString=".Mdf") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.312] lstrlenW (lpString=".dat") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.312] lstrlenW (lpString=".DAT") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.312] lstrlenW (lpString=".ldf") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.312] lstrlenW (lpString=".LDF") returned 4 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.312] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.312] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.313] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.313] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.313] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16431448043) returned 1 [0044.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9396c90, dwHighDateTime=0x1d585b4)) [0044.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ff0 [0044.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ff0 | out: hHeap=0x260000) returned 1 [0044.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.314] GetLastError () returned 0x0 [0044.314] GetLastError () returned 0x0 [0044.314] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.314] GetLastError () returned 0x0 [0044.314] GetLastError () returned 0x0 [0044.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff904d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.317] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x6fb3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x6fb3, lpOverlapped=0x0) returned 1 [0044.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.317] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.317] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.317] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.318] CloseHandle (hObject=0x10c) returned 1 [0044.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.318] GetLastError () returned 0x0 [0044.318] RtlWakeConditionVariable () returned 0x27e828 [0044.318] GetCurrentThreadId () returned 0x9ac [0044.318] GetCurrentThreadId () returned 0x9ac [0044.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f3e98 | out: hHeap=0x260000) returned 1 [0044.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0044.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3e98 [0044.319] lstrlenW (lpString=".ldf") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".ldf") returned 0x0 [0044.319] lstrlenW (lpString=".vhd") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".vhd") returned 0x0 [0044.319] lstrlenW (lpString=".vhdx") returned 5 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".vhdx") returned 0x0 [0044.319] lstrlenW (lpString=".pst") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".pst") returned 0x0 [0044.319] lstrlenW (lpString=".ost") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".ost") returned 0x0 [0044.319] lstrlenW (lpString=".bak") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".bak") returned 0x0 [0044.319] lstrlenW (lpString=".bac") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".bac") returned 0x0 [0044.319] lstrlenW (lpString=".sys") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".sys") returned 0x0 [0044.319] lstrlenW (lpString=".v2i") returned 4 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".v2i") returned 0x0 [0044.319] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.320] lstrlenW (lpString=".sql") returned 4 [0044.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".sql") returned 0x0 [0044.320] lstrlenW (lpString=".mdf") returned 4 [0044.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".mdf") returned 0x0 [0044.320] lstrlenW (lpString=".txt") returned 4 [0044.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".txt") returned 0x0 [0044.320] lstrlenW (lpString=".dbf") returned 4 [0044.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".dbf") returned 0x0 [0044.320] lstrlenW (lpString=".ckp") returned 4 [0044.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".ckp") returned 0x0 [0044.320] lstrlenW (lpString=".dacpac") returned 7 [0044.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".dacpac") returned 0x0 [0044.321] lstrlenW (lpString=".db3") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".db3") returned 0x0 [0044.321] lstrlenW (lpString=".dtxs") returned 5 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".dtxs") returned 0x0 [0044.321] lstrlenW (lpString=".mdt") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".mdt") returned 0x0 [0044.321] lstrlenW (lpString=".sdf") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".sdf") returned 0x0 [0044.321] lstrlenW (lpString=".MDF") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".MDF") returned 0x0 [0044.321] lstrlenW (lpString=".DBF") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".DBF") returned 0x0 [0044.321] lstrlenW (lpString=".DB") returned 3 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".DB") returned 0x0 [0044.321] lstrlenW (lpString=".db") returned 3 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".db") returned 0x0 [0044.321] lstrlenW (lpString=".ndf") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".ndf") returned 0x0 [0044.321] lstrlenW (lpString=".NDF") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".NDF") returned 0x0 [0044.321] lstrlenW (lpString=".Mdf") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".Mdf") returned 0x0 [0044.321] lstrlenW (lpString=".dat") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".dat") returned 0x0 [0044.321] lstrlenW (lpString=".DAT") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".DAT") returned 0x0 [0044.321] lstrlenW (lpString=".ldf") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".ldf") returned 0x0 [0044.321] lstrlenW (lpString=".LDF") returned 4 [0044.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch=".LDF") returned 0x0 [0044.321] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.322] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.322] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.322] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.322] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16432362026) returned 1 [0044.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa93bcdf0, dwHighDateTime=0x1d585b4)) [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1140 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.323] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.323] GetLastError () returned 0x0 [0044.323] GetLastError () returned 0x0 [0044.323] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.323] GetLastError () returned 0x0 [0044.323] GetLastError () returned 0x0 [0044.325] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffee924, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.325] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x116dc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x116dc, lpOverlapped=0x0) returned 1 [0044.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.326] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.326] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.326] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.326] CloseHandle (hObject=0x10c) returned 1 [0044.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.327] GetLastError () returned 0x0 [0044.327] RtlWakeConditionVariable () returned 0x27e828 [0044.327] GetCurrentThreadId () returned 0x9ac [0044.327] GetCurrentThreadId () returned 0x9ac [0044.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b4b8 | out: hHeap=0x260000) returned 1 [0044.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0044.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0044.327] lstrlenW (lpString=".ldf") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".ldf") returned 0x0 [0044.327] lstrlenW (lpString=".vhd") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".vhd") returned 0x0 [0044.327] lstrlenW (lpString=".vhdx") returned 5 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".vhdx") returned 0x0 [0044.327] lstrlenW (lpString=".pst") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".pst") returned 0x0 [0044.327] lstrlenW (lpString=".ost") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".ost") returned 0x0 [0044.327] lstrlenW (lpString=".bak") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".bak") returned 0x0 [0044.327] lstrlenW (lpString=".bac") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".bac") returned 0x0 [0044.327] lstrlenW (lpString=".sys") returned 4 [0044.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".sys") returned 0x0 [0044.328] lstrlenW (lpString=".v2i") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".v2i") returned 0x0 [0044.328] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.328] lstrlenW (lpString=".sql") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".sql") returned 0x0 [0044.328] lstrlenW (lpString=".mdf") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".mdf") returned 0x0 [0044.328] lstrlenW (lpString=".txt") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".txt") returned 0x0 [0044.328] lstrlenW (lpString=".dbf") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".dbf") returned 0x0 [0044.328] lstrlenW (lpString=".ckp") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".ckp") returned 0x0 [0044.328] lstrlenW (lpString=".dacpac") returned 7 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".dacpac") returned 0x0 [0044.328] lstrlenW (lpString=".db3") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".db3") returned 0x0 [0044.328] lstrlenW (lpString=".dtxs") returned 5 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".dtxs") returned 0x0 [0044.328] lstrlenW (lpString=".mdt") returned 4 [0044.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".mdt") returned 0x0 [0044.328] lstrlenW (lpString=".sdf") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".sdf") returned 0x0 [0044.329] lstrlenW (lpString=".MDF") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".MDF") returned 0x0 [0044.329] lstrlenW (lpString=".DBF") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".DBF") returned 0x0 [0044.329] lstrlenW (lpString=".DB") returned 3 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".DB") returned 0x0 [0044.329] lstrlenW (lpString=".db") returned 3 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".db") returned 0x0 [0044.329] lstrlenW (lpString=".ndf") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".ndf") returned 0x0 [0044.329] lstrlenW (lpString=".NDF") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".NDF") returned 0x0 [0044.329] lstrlenW (lpString=".Mdf") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".Mdf") returned 0x0 [0044.329] lstrlenW (lpString=".dat") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".dat") returned 0x0 [0044.329] lstrlenW (lpString=".DAT") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".DAT") returned 0x0 [0044.329] lstrlenW (lpString=".ldf") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".ldf") returned 0x0 [0044.329] lstrlenW (lpString=".LDF") returned 4 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch=".LDF") returned 0x0 [0044.329] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.329] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.330] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.330] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16433138917) returned 1 [0044.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa93bcdf0, dwHighDateTime=0x1d585b4)) [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1178 [0044.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0044.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.331] GetLastError () returned 0x0 [0044.331] GetLastError () returned 0x0 [0044.331] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.331] GetLastError () returned 0x0 [0044.331] GetLastError () returned 0x0 [0044.332] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffdc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.332] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x239, lpOverlapped=0x0) returned 1 [0044.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.333] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.333] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.333] CloseHandle (hObject=0x10c) returned 1 [0044.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.335] GetLastError () returned 0x0 [0044.335] RtlWakeConditionVariable () returned 0x27e828 [0044.335] GetCurrentThreadId () returned 0x9ac [0044.335] GetCurrentThreadId () returned 0x9ac [0044.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b570 | out: hHeap=0x260000) returned 1 [0044.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ed8 | out: hHeap=0x260000) returned 1 [0044.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b570 [0044.335] lstrlenW (lpString=".ldf") returned 4 [0044.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.335] lstrlenW (lpString=".vhd") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.336] lstrlenW (lpString=".vhdx") returned 5 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.336] lstrlenW (lpString=".pst") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.336] lstrlenW (lpString=".ost") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.336] lstrlenW (lpString=".bak") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.336] lstrlenW (lpString=".bac") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.336] lstrlenW (lpString=".sys") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.336] lstrlenW (lpString=".v2i") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.336] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.336] lstrlenW (lpString=".sql") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.336] lstrlenW (lpString=".mdf") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.336] lstrlenW (lpString=".txt") returned 4 [0044.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.337] lstrlenW (lpString=".dbf") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.337] lstrlenW (lpString=".ckp") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.337] lstrlenW (lpString=".dacpac") returned 7 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.337] lstrlenW (lpString=".db3") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.337] lstrlenW (lpString=".dtxs") returned 5 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.337] lstrlenW (lpString=".mdt") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.337] lstrlenW (lpString=".sdf") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.337] lstrlenW (lpString=".MDF") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.337] lstrlenW (lpString=".DBF") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.337] lstrlenW (lpString=".DB") returned 3 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.337] lstrlenW (lpString=".db") returned 3 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.337] lstrlenW (lpString=".ndf") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.337] lstrlenW (lpString=".NDF") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.337] lstrlenW (lpString=".Mdf") returned 4 [0044.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.337] lstrlenW (lpString=".dat") returned 4 [0044.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.338] lstrlenW (lpString=".DAT") returned 4 [0044.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.338] lstrlenW (lpString=".ldf") returned 4 [0044.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.338] lstrlenW (lpString=".LDF") returned 4 [0044.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.338] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.338] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.339] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.339] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16433987632) returned 1 [0044.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa93e2f50, dwHighDateTime=0x1d585b4)) [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ed8 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ed8 | out: hHeap=0x260000) returned 1 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.339] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.339] GetLastError () returned 0x0 [0044.339] GetLastError () returned 0x0 [0044.340] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.340] GetLastError () returned 0x0 [0044.340] GetLastError () returned 0x0 [0044.341] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff08b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.341] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xf75, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0xf75, lpOverlapped=0x0) returned 1 [0044.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.341] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.341] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.342] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.342] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.342] CloseHandle (hObject=0x10c) returned 1 [0044.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.342] GetLastError () returned 0x0 [0044.342] RtlWakeConditionVariable () returned 0x27e828 [0044.343] GetCurrentThreadId () returned 0x9ac [0044.343] GetCurrentThreadId () returned 0x9ac [0044.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f36b0 [0044.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bb30 | out: hHeap=0x260000) returned 1 [0044.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f10 | out: hHeap=0x260000) returned 1 [0044.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0044.343] lstrlenW (lpString=".ldf") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.343] lstrlenW (lpString=".vhd") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.343] lstrlenW (lpString=".vhdx") returned 5 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.343] lstrlenW (lpString=".pst") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.343] lstrlenW (lpString=".ost") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.343] lstrlenW (lpString=".bak") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.343] lstrlenW (lpString=".bac") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.343] lstrlenW (lpString=".sys") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.343] lstrlenW (lpString=".v2i") returned 4 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.343] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.344] lstrlenW (lpString=".sql") returned 4 [0044.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.344] lstrlenW (lpString=".mdf") returned 4 [0044.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.344] lstrlenW (lpString=".txt") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.345] lstrlenW (lpString=".dbf") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.345] lstrlenW (lpString=".ckp") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.345] lstrlenW (lpString=".dacpac") returned 7 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.345] lstrlenW (lpString=".db3") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.345] lstrlenW (lpString=".dtxs") returned 5 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.345] lstrlenW (lpString=".mdt") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.345] lstrlenW (lpString=".sdf") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.345] lstrlenW (lpString=".MDF") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.345] lstrlenW (lpString=".DBF") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.345] lstrlenW (lpString=".DB") returned 3 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.345] lstrlenW (lpString=".db") returned 3 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.345] lstrlenW (lpString=".ndf") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.345] lstrlenW (lpString=".NDF") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.345] lstrlenW (lpString=".Mdf") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.345] lstrlenW (lpString=".dat") returned 4 [0044.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.346] lstrlenW (lpString=".DAT") returned 4 [0044.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.346] lstrlenW (lpString=".ldf") returned 4 [0044.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.346] lstrlenW (lpString=".LDF") returned 4 [0044.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.346] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.346] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.347] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.347] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.347] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16434784549) returned 1 [0044.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa93e2f50, dwHighDateTime=0x1d585b4)) [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f10 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f10 | out: hHeap=0x260000) returned 1 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e4c8 [0044.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e4c8 | out: hHeap=0x260000) returned 1 [0044.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.347] GetLastError () returned 0x0 [0044.347] GetLastError () returned 0x0 [0044.348] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.348] GetLastError () returned 0x0 [0044.348] GetLastError () returned 0x0 [0044.351] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff7e03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.351] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x81fd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x81fd, lpOverlapped=0x0) returned 1 [0044.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.351] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.351] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.351] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.352] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.352] CloseHandle (hObject=0x10c) returned 1 [0044.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.352] GetLastError () returned 0x0 [0044.352] RtlWakeConditionVariable () returned 0x27e828 [0044.352] GetCurrentThreadId () returned 0x9ac [0044.352] GetCurrentThreadId () returned 0x9ac [0044.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db280 [0044.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db410 | out: hHeap=0x260000) returned 1 [0044.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f48 | out: hHeap=0x260000) returned 1 [0044.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db410 [0044.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.353] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.353] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.353] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.353] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.354] CloseHandle (hObject=0x10c) returned 1 [0044.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db410 | out: hHeap=0x260000) returned 1 [0044.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db280 | out: hHeap=0x260000) returned 1 [0044.354] RtlWakeConditionVariable () returned 0x27e828 [0044.354] GetCurrentThreadId () returned 0x9ac [0044.354] GetCurrentThreadId () returned 0x9ac [0044.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e618 | out: hHeap=0x260000) returned 1 [0044.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f80 | out: hHeap=0x260000) returned 1 [0044.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e618 [0044.354] lstrlenW (lpString=".ldf") returned 4 [0044.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".ldf") returned 0x0 [0044.354] lstrlenW (lpString=".vhd") returned 4 [0044.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".vhd") returned 0x0 [0044.354] lstrlenW (lpString=".vhdx") returned 5 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".vhdx") returned 0x0 [0044.355] lstrlenW (lpString=".pst") returned 4 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".pst") returned 0x0 [0044.355] lstrlenW (lpString=".ost") returned 4 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".ost") returned 0x0 [0044.355] lstrlenW (lpString=".bak") returned 4 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".bak") returned 0x0 [0044.355] lstrlenW (lpString=".bac") returned 4 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".bac") returned 0x0 [0044.355] lstrlenW (lpString=".sys") returned 4 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".sys") returned 0x0 [0044.355] lstrlenW (lpString=".v2i") returned 4 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".v2i") returned 0x0 [0044.355] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.356] lstrlenW (lpString=".sql") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".sql") returned 0x0 [0044.356] lstrlenW (lpString=".mdf") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".mdf") returned 0x0 [0044.356] lstrlenW (lpString=".txt") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".txt") returned 0x0 [0044.356] lstrlenW (lpString=".dbf") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".dbf") returned 0x0 [0044.356] lstrlenW (lpString=".ckp") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".ckp") returned 0x0 [0044.356] lstrlenW (lpString=".dacpac") returned 7 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".dacpac") returned 0x0 [0044.356] lstrlenW (lpString=".db3") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".db3") returned 0x0 [0044.356] lstrlenW (lpString=".dtxs") returned 5 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".dtxs") returned 0x0 [0044.356] lstrlenW (lpString=".mdt") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".mdt") returned 0x0 [0044.356] lstrlenW (lpString=".sdf") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".sdf") returned 0x0 [0044.356] lstrlenW (lpString=".MDF") returned 4 [0044.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".MDF") returned 0x0 [0044.356] lstrlenW (lpString=".DBF") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".DBF") returned 0x0 [0044.357] lstrlenW (lpString=".DB") returned 3 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".DB") returned 0x0 [0044.357] lstrlenW (lpString=".db") returned 3 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".db") returned 0x0 [0044.357] lstrlenW (lpString=".ndf") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".ndf") returned 0x0 [0044.357] lstrlenW (lpString=".NDF") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".NDF") returned 0x0 [0044.357] lstrlenW (lpString=".Mdf") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".Mdf") returned 0x0 [0044.357] lstrlenW (lpString=".dat") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".dat") returned 0x0 [0044.357] lstrlenW (lpString=".DAT") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".DAT") returned 0x0 [0044.357] lstrlenW (lpString=".ldf") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".ldf") returned 0x0 [0044.357] lstrlenW (lpString=".LDF") returned 4 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch=".LDF") returned 0x0 [0044.357] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.357] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.358] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.358] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16435935271) returned 1 [0044.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa94090b0, dwHighDateTime=0x1d585b4)) [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f80 [0044.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f80 | out: hHeap=0x260000) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.359] GetLastError () returned 0x0 [0044.359] GetLastError () returned 0x0 [0044.359] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.359] GetLastError () returned 0x0 [0044.359] GetLastError () returned 0x0 [0044.361] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff4f32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.361] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xb0ce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0xb0ce, lpOverlapped=0x0) returned 1 [0044.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.361] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.361] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.361] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.361] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.361] CloseHandle (hObject=0x10c) returned 1 [0044.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.362] GetLastError () returned 0x0 [0044.362] RtlWakeConditionVariable () returned 0x27e828 [0044.362] GetCurrentThreadId () returned 0x9ac [0044.362] GetCurrentThreadId () returned 0x9ac [0044.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e180 | out: hHeap=0x260000) returned 1 [0044.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0fb8 | out: hHeap=0x260000) returned 1 [0044.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e180 [0044.363] lstrlenW (lpString=".ldf") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".ldf") returned 0x0 [0044.363] lstrlenW (lpString=".vhd") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".vhd") returned 0x0 [0044.363] lstrlenW (lpString=".vhdx") returned 5 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".vhdx") returned 0x0 [0044.363] lstrlenW (lpString=".pst") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".pst") returned 0x0 [0044.363] lstrlenW (lpString=".ost") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".ost") returned 0x0 [0044.363] lstrlenW (lpString=".bak") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".bak") returned 0x0 [0044.363] lstrlenW (lpString=".bac") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".bac") returned 0x0 [0044.363] lstrlenW (lpString=".sys") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".sys") returned 0x0 [0044.363] lstrlenW (lpString=".v2i") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".v2i") returned 0x0 [0044.363] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.363] lstrlenW (lpString=".sql") returned 4 [0044.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".sql") returned 0x0 [0044.364] lstrlenW (lpString=".mdf") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".mdf") returned 0x0 [0044.364] lstrlenW (lpString=".txt") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".txt") returned 0x0 [0044.364] lstrlenW (lpString=".dbf") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".dbf") returned 0x0 [0044.364] lstrlenW (lpString=".ckp") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".ckp") returned 0x0 [0044.364] lstrlenW (lpString=".dacpac") returned 7 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".dacpac") returned 0x0 [0044.364] lstrlenW (lpString=".db3") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".db3") returned 0x0 [0044.364] lstrlenW (lpString=".dtxs") returned 5 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".dtxs") returned 0x0 [0044.364] lstrlenW (lpString=".mdt") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".mdt") returned 0x0 [0044.364] lstrlenW (lpString=".sdf") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".sdf") returned 0x0 [0044.364] lstrlenW (lpString=".MDF") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".MDF") returned 0x0 [0044.364] lstrlenW (lpString=".DBF") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".DBF") returned 0x0 [0044.364] lstrlenW (lpString=".DB") returned 3 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".DB") returned 0x0 [0044.364] lstrlenW (lpString=".db") returned 3 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".db") returned 0x0 [0044.364] lstrlenW (lpString=".ndf") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".ndf") returned 0x0 [0044.364] lstrlenW (lpString=".NDF") returned 4 [0044.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".NDF") returned 0x0 [0044.365] lstrlenW (lpString=".Mdf") returned 4 [0044.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".Mdf") returned 0x0 [0044.365] lstrlenW (lpString=".dat") returned 4 [0044.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".dat") returned 0x0 [0044.365] lstrlenW (lpString=".DAT") returned 4 [0044.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".DAT") returned 0x0 [0044.365] lstrlenW (lpString=".ldf") returned 4 [0044.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".ldf") returned 0x0 [0044.365] lstrlenW (lpString=".LDF") returned 4 [0044.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch=".LDF") returned 0x0 [0044.365] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.365] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.366] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.366] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0044.366] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16436702902) returned 1 [0044.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa94090b0, dwHighDateTime=0x1d585b4)) [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0fb8 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0fb8 | out: hHeap=0x260000) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e618 [0044.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e618 | out: hHeap=0x260000) returned 1 [0044.439] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.440] GetLastError () returned 0x0 [0044.449] GetLastError () returned 0x0 [0044.449] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.464] GetLastError () returned 0x0 [0044.464] GetLastError () returned 0x0 [0044.466] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe09, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.466] WriteFile (in: hFile=0x10c, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x1f7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f7, lpOverlapped=0x0) returned 1 [0044.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0044.466] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.466] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.467] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.467] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.467] CloseHandle (hObject=0x10c) returned 1 [0044.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0044.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0044.467] GetLastError () returned 0x0 [0044.467] RtlWakeConditionVariable () returned 0x27e828 [0044.467] GetCurrentThreadId () returned 0x9ac [0044.468] GetCurrentThreadId () returned 0x9ac [0044.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dadd0 | out: hHeap=0x260000) returned 1 [0044.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337fc8 | out: hHeap=0x260000) returned 1 [0044.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dadd0 [0044.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0044.554] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.554] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.554] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.554] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.555] CloseHandle (hObject=0x104) returned 1 [0044.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dadd0 | out: hHeap=0x260000) returned 1 [0044.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0044.555] RtlWakeConditionVariable () returned 0x27e828 [0044.555] GetCurrentThreadId () returned 0x9ac [0044.555] GetCurrentThreadId () returned 0x9ac [0044.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d958 | out: hHeap=0x260000) returned 1 [0044.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0044.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d958 [0044.555] lstrlenW (lpString=".ldf") returned 4 [0044.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.556] lstrlenW (lpString=".vhd") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.556] lstrlenW (lpString=".vhdx") returned 5 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.556] lstrlenW (lpString=".pst") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.556] lstrlenW (lpString=".ost") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.556] lstrlenW (lpString=".bak") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.556] lstrlenW (lpString=".bac") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.556] lstrlenW (lpString=".sys") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.556] lstrlenW (lpString=".v2i") returned 4 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.556] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.556] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.616] lstrlenW (lpString=".sql") returned 4 [0044.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.616] lstrlenW (lpString=".mdf") returned 4 [0044.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.617] lstrlenW (lpString=".txt") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.617] lstrlenW (lpString=".dbf") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.617] lstrlenW (lpString=".ckp") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.617] lstrlenW (lpString=".dacpac") returned 7 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.617] lstrlenW (lpString=".db3") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.617] lstrlenW (lpString=".dtxs") returned 5 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.617] lstrlenW (lpString=".mdt") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.617] lstrlenW (lpString=".sdf") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.617] lstrlenW (lpString=".MDF") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.617] lstrlenW (lpString=".DBF") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.617] lstrlenW (lpString=".DB") returned 3 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.617] lstrlenW (lpString=".db") returned 3 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.617] lstrlenW (lpString=".ndf") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.617] lstrlenW (lpString=".NDF") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.617] lstrlenW (lpString=".Mdf") returned 4 [0044.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.618] lstrlenW (lpString=".dat") returned 4 [0044.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.618] lstrlenW (lpString=".DAT") returned 4 [0044.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.618] lstrlenW (lpString=".ldf") returned 4 [0044.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.618] lstrlenW (lpString=".LDF") returned 4 [0044.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.618] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3e10 [0044.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.618] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.619] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x331d08 [0044.619] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16461999367) returned 1 [0044.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9690810, dwHighDateTime=0x1d585b4)) [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0fb8 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0fb8 | out: hHeap=0x260000) returned 1 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29daa8 [0044.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29daa8 | out: hHeap=0x260000) returned 1 [0044.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.620] GetLastError () returned 0x0 [0044.620] GetLastError () returned 0x0 [0044.620] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.620] GetLastError () returned 0x0 [0044.620] GetLastError () returned 0x0 [0044.623] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff608, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.623] WriteFile (in: hFile=0x10c, lpBuffer=0x277c058*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x277c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x9f8, lpOverlapped=0x0) returned 1 [0044.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c058 | out: hHeap=0x260000) returned 1 [0044.635] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.635] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.635] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.635] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.635] CloseHandle (hObject=0x10c) returned 1 [0044.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.636] GetLastError () returned 0x0 [0044.638] RtlWakeConditionVariable () returned 0x27e828 [0044.638] GetCurrentThreadId () returned 0x9ac [0044.638] GetCurrentThreadId () returned 0x9ac [0044.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e720 | out: hHeap=0x260000) returned 1 [0044.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5c0 | out: hHeap=0x260000) returned 1 [0044.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e720 [0044.638] lstrlenW (lpString=".ldf") returned 4 [0044.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.638] lstrlenW (lpString=".vhd") returned 4 [0044.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.638] lstrlenW (lpString=".vhdx") returned 5 [0044.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.638] lstrlenW (lpString=".pst") returned 4 [0044.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.638] lstrlenW (lpString=".ost") returned 4 [0044.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.638] lstrlenW (lpString=".bak") returned 4 [0044.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.639] lstrlenW (lpString=".bac") returned 4 [0044.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.639] lstrlenW (lpString=".sys") returned 4 [0044.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.639] lstrlenW (lpString=".v2i") returned 4 [0044.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.639] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.650] lstrlenW (lpString=".sql") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.650] lstrlenW (lpString=".mdf") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.650] lstrlenW (lpString=".txt") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.650] lstrlenW (lpString=".dbf") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.650] lstrlenW (lpString=".ckp") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.650] lstrlenW (lpString=".dacpac") returned 7 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.650] lstrlenW (lpString=".db3") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.650] lstrlenW (lpString=".dtxs") returned 5 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.650] lstrlenW (lpString=".mdt") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.650] lstrlenW (lpString=".sdf") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.650] lstrlenW (lpString=".MDF") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.650] lstrlenW (lpString=".DBF") returned 4 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.650] lstrlenW (lpString=".DB") returned 3 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.650] lstrlenW (lpString=".db") returned 3 [0044.650] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.651] lstrlenW (lpString=".ndf") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.651] lstrlenW (lpString=".NDF") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.651] lstrlenW (lpString=".Mdf") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.651] lstrlenW (lpString=".dat") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.651] lstrlenW (lpString=".DAT") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.651] lstrlenW (lpString=".ldf") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.651] lstrlenW (lpString=".LDF") returned 4 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.651] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.651] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.652] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.652] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.652] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16465311085) returned 1 [0044.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa96dcad0, dwHighDateTime=0x1d585b4)) [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d588 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d588 | out: hHeap=0x260000) returned 1 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d958 [0044.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d958 | out: hHeap=0x260000) returned 1 [0044.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.653] GetLastError () returned 0x0 [0044.653] GetLastError () returned 0x0 [0044.653] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.653] GetLastError () returned 0x0 [0044.653] GetLastError () returned 0x0 [0044.654] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff7ce9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.654] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x8317, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x8317, lpOverlapped=0x0) returned 1 [0044.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.655] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.655] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.655] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.655] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.655] CloseHandle (hObject=0x10c) returned 1 [0044.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.656] GetLastError () returned 0x0 [0044.656] RtlWakeConditionVariable () returned 0x27e828 [0044.656] GetCurrentThreadId () returned 0x9ac [0044.656] GetCurrentThreadId () returned 0x9ac [0044.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e480 | out: hHeap=0x260000) returned 1 [0044.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x260000) returned 1 [0044.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e480 [0044.656] lstrlenW (lpString=".ldf") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".ldf") returned 0x0 [0044.656] lstrlenW (lpString=".vhd") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".vhd") returned 0x0 [0044.656] lstrlenW (lpString=".vhdx") returned 5 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".vhdx") returned 0x0 [0044.656] lstrlenW (lpString=".pst") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".pst") returned 0x0 [0044.656] lstrlenW (lpString=".ost") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".ost") returned 0x0 [0044.656] lstrlenW (lpString=".bak") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".bak") returned 0x0 [0044.656] lstrlenW (lpString=".bac") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".bac") returned 0x0 [0044.656] lstrlenW (lpString=".sys") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".sys") returned 0x0 [0044.656] lstrlenW (lpString=".v2i") returned 4 [0044.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".v2i") returned 0x0 [0044.657] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.657] lstrlenW (lpString=".sql") returned 4 [0044.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".sql") returned 0x0 [0044.657] lstrlenW (lpString=".mdf") returned 4 [0044.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".mdf") returned 0x0 [0044.657] lstrlenW (lpString=".txt") returned 4 [0044.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".txt") returned 0x0 [0044.658] lstrlenW (lpString=".dbf") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".dbf") returned 0x0 [0044.658] lstrlenW (lpString=".ckp") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".ckp") returned 0x0 [0044.658] lstrlenW (lpString=".dacpac") returned 7 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".dacpac") returned 0x0 [0044.658] lstrlenW (lpString=".db3") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".db3") returned 0x0 [0044.658] lstrlenW (lpString=".dtxs") returned 5 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".dtxs") returned 0x0 [0044.658] lstrlenW (lpString=".mdt") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".mdt") returned 0x0 [0044.658] lstrlenW (lpString=".sdf") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".sdf") returned 0x0 [0044.658] lstrlenW (lpString=".MDF") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".MDF") returned 0x0 [0044.658] lstrlenW (lpString=".DBF") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".DBF") returned 0x0 [0044.658] lstrlenW (lpString=".DB") returned 3 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".DB") returned 0x0 [0044.658] lstrlenW (lpString=".db") returned 3 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".db") returned 0x0 [0044.658] lstrlenW (lpString=".ndf") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".ndf") returned 0x0 [0044.658] lstrlenW (lpString=".NDF") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".NDF") returned 0x0 [0044.658] lstrlenW (lpString=".Mdf") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".Mdf") returned 0x0 [0044.658] lstrlenW (lpString=".dat") returned 4 [0044.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".dat") returned 0x0 [0044.658] lstrlenW (lpString=".DAT") returned 4 [0044.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".DAT") returned 0x0 [0044.659] lstrlenW (lpString=".ldf") returned 4 [0044.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".ldf") returned 0x0 [0044.659] lstrlenW (lpString=".LDF") returned 4 [0044.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch=".LDF") returned 0x0 [0044.659] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.659] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.660] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.660] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.660] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16466081396) returned 1 [0044.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa96dcad0, dwHighDateTime=0x1d585b4)) [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d550 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x260000) returned 1 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e720 [0044.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e720 | out: hHeap=0x260000) returned 1 [0044.660] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.660] GetLastError () returned 0x0 [0044.660] GetLastError () returned 0x0 [0044.660] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.661] GetLastError () returned 0x0 [0044.661] GetLastError () returned 0x0 [0044.663] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffefea3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.663] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x1015d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1015d, lpOverlapped=0x0) returned 1 [0044.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.664] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.664] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.664] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.664] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.664] CloseHandle (hObject=0x10c) returned 1 [0044.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.665] GetLastError () returned 0x0 [0044.665] RtlWakeConditionVariable () returned 0x27e828 [0044.665] GetCurrentThreadId () returned 0x9ac [0044.665] GetCurrentThreadId () returned 0x9ac [0044.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0044.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d518 | out: hHeap=0x260000) returned 1 [0044.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0044.665] lstrlenW (lpString=".ldf") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".ldf") returned 0x0 [0044.665] lstrlenW (lpString=".vhd") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".vhd") returned 0x0 [0044.665] lstrlenW (lpString=".vhdx") returned 5 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".vhdx") returned 0x0 [0044.665] lstrlenW (lpString=".pst") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".pst") returned 0x0 [0044.665] lstrlenW (lpString=".ost") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".ost") returned 0x0 [0044.665] lstrlenW (lpString=".bak") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".bak") returned 0x0 [0044.665] lstrlenW (lpString=".bac") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".bac") returned 0x0 [0044.665] lstrlenW (lpString=".sys") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".sys") returned 0x0 [0044.665] lstrlenW (lpString=".v2i") returned 4 [0044.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".v2i") returned 0x0 [0044.666] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.666] lstrlenW (lpString=".sql") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".sql") returned 0x0 [0044.666] lstrlenW (lpString=".mdf") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".mdf") returned 0x0 [0044.666] lstrlenW (lpString=".txt") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".txt") returned 0x0 [0044.666] lstrlenW (lpString=".dbf") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".dbf") returned 0x0 [0044.666] lstrlenW (lpString=".ckp") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".ckp") returned 0x0 [0044.666] lstrlenW (lpString=".dacpac") returned 7 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".dacpac") returned 0x0 [0044.666] lstrlenW (lpString=".db3") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".db3") returned 0x0 [0044.666] lstrlenW (lpString=".dtxs") returned 5 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".dtxs") returned 0x0 [0044.666] lstrlenW (lpString=".mdt") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".mdt") returned 0x0 [0044.666] lstrlenW (lpString=".sdf") returned 4 [0044.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".sdf") returned 0x0 [0044.666] lstrlenW (lpString=".MDF") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".MDF") returned 0x0 [0044.667] lstrlenW (lpString=".DBF") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".DBF") returned 0x0 [0044.667] lstrlenW (lpString=".DB") returned 3 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".DB") returned 0x0 [0044.667] lstrlenW (lpString=".db") returned 3 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".db") returned 0x0 [0044.667] lstrlenW (lpString=".ndf") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".ndf") returned 0x0 [0044.667] lstrlenW (lpString=".NDF") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".NDF") returned 0x0 [0044.667] lstrlenW (lpString=".Mdf") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".Mdf") returned 0x0 [0044.667] lstrlenW (lpString=".dat") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".dat") returned 0x0 [0044.667] lstrlenW (lpString=".DAT") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".DAT") returned 0x0 [0044.667] lstrlenW (lpString=".ldf") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".ldf") returned 0x0 [0044.667] lstrlenW (lpString=".LDF") returned 4 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch=".LDF") returned 0x0 [0044.667] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.667] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.668] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.668] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.668] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16466938552) returned 1 [0044.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9702c30, dwHighDateTime=0x1d585b4)) [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d518 [0044.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d518 | out: hHeap=0x260000) returned 1 [0044.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e480 [0044.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e480 | out: hHeap=0x260000) returned 1 [0044.669] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.669] GetLastError () returned 0x0 [0044.669] GetLastError () returned 0x0 [0044.669] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.669] GetLastError () returned 0x0 [0044.669] GetLastError () returned 0x0 [0044.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.670] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0044.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.670] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.670] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.671] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.671] CloseHandle (hObject=0x10c) returned 1 [0044.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.673] GetLastError () returned 0x0 [0044.673] RtlWakeConditionVariable () returned 0x27e828 [0044.673] GetCurrentThreadId () returned 0x9ac [0044.673] GetCurrentThreadId () returned 0x9ac [0044.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0044.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x260000) returned 1 [0044.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0044.673] lstrlenW (lpString=".ldf") returned 4 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.673] lstrlenW (lpString=".vhd") returned 4 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.673] lstrlenW (lpString=".vhdx") returned 5 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.673] lstrlenW (lpString=".pst") returned 4 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.673] lstrlenW (lpString=".ost") returned 4 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.673] lstrlenW (lpString=".bak") returned 4 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.673] lstrlenW (lpString=".bac") returned 4 [0044.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.674] lstrlenW (lpString=".sys") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.674] lstrlenW (lpString=".v2i") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.674] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.674] lstrlenW (lpString=".sql") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.674] lstrlenW (lpString=".mdf") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.674] lstrlenW (lpString=".txt") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.674] lstrlenW (lpString=".dbf") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.674] lstrlenW (lpString=".ckp") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.674] lstrlenW (lpString=".dacpac") returned 7 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.674] lstrlenW (lpString=".db3") returned 4 [0044.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.675] lstrlenW (lpString=".dtxs") returned 5 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.675] lstrlenW (lpString=".mdt") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.675] lstrlenW (lpString=".sdf") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.675] lstrlenW (lpString=".MDF") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.675] lstrlenW (lpString=".DBF") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.675] lstrlenW (lpString=".DB") returned 3 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.675] lstrlenW (lpString=".db") returned 3 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.675] lstrlenW (lpString=".ndf") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.675] lstrlenW (lpString=".NDF") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.675] lstrlenW (lpString=".Mdf") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.675] lstrlenW (lpString=".dat") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.675] lstrlenW (lpString=".DAT") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.675] lstrlenW (lpString=".ldf") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.675] lstrlenW (lpString=".LDF") returned 4 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.675] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.676] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.676] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.676] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16467875192) returned 1 [0044.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9702c30, dwHighDateTime=0x1d585b4)) [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4e0 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x260000) returned 1 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d0d0 [0044.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0044.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.678] GetLastError () returned 0x0 [0044.679] GetLastError () returned 0x0 [0044.679] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.679] GetLastError () returned 0x0 [0044.679] GetLastError () returned 0x0 [0044.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff654, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.680] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x9ac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x9ac, lpOverlapped=0x0) returned 1 [0044.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.680] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.680] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.681] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.681] CloseHandle (hObject=0x10c) returned 1 [0044.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.682] GetLastError () returned 0x0 [0044.682] RtlWakeConditionVariable () returned 0x27e828 [0044.682] GetCurrentThreadId () returned 0x9ac [0044.682] GetCurrentThreadId () returned 0x9ac [0044.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e528 | out: hHeap=0x260000) returned 1 [0044.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4a8 | out: hHeap=0x260000) returned 1 [0044.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e528 [0044.682] lstrlenW (lpString=".ldf") returned 4 [0044.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.682] lstrlenW (lpString=".vhd") returned 4 [0044.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.683] lstrlenW (lpString=".vhdx") returned 5 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.683] lstrlenW (lpString=".pst") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.683] lstrlenW (lpString=".ost") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.683] lstrlenW (lpString=".bak") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.683] lstrlenW (lpString=".bac") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.683] lstrlenW (lpString=".sys") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.683] lstrlenW (lpString=".v2i") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.683] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.683] lstrlenW (lpString=".sql") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.683] lstrlenW (lpString=".mdf") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.683] lstrlenW (lpString=".txt") returned 4 [0044.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.684] lstrlenW (lpString=".dbf") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.684] lstrlenW (lpString=".ckp") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.684] lstrlenW (lpString=".dacpac") returned 7 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.684] lstrlenW (lpString=".db3") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.684] lstrlenW (lpString=".dtxs") returned 5 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.684] lstrlenW (lpString=".mdt") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.684] lstrlenW (lpString=".sdf") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.684] lstrlenW (lpString=".MDF") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.684] lstrlenW (lpString=".DBF") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.684] lstrlenW (lpString=".DB") returned 3 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.684] lstrlenW (lpString=".db") returned 3 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.684] lstrlenW (lpString=".ndf") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.684] lstrlenW (lpString=".NDF") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.684] lstrlenW (lpString=".Mdf") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.684] lstrlenW (lpString=".dat") returned 4 [0044.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.684] lstrlenW (lpString=".DAT") returned 4 [0044.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.685] lstrlenW (lpString=".ldf") returned 4 [0044.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.685] lstrlenW (lpString=".LDF") returned 4 [0044.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.685] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.685] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.686] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.686] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16468681264) returned 1 [0044.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9728d90, dwHighDateTime=0x1d585b4)) [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4a8 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4a8 | out: hHeap=0x260000) returned 1 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dca0 [0044.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0044.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.686] GetLastError () returned 0x0 [0044.687] GetLastError () returned 0x0 [0044.687] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.687] GetLastError () returned 0x0 [0044.687] GetLastError () returned 0x0 [0044.689] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb3e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.689] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x4c1d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x4c1d, lpOverlapped=0x0) returned 1 [0044.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.689] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.689] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.690] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.690] CloseHandle (hObject=0x10c) returned 1 [0044.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.691] GetLastError () returned 0x0 [0044.691] RtlWakeConditionVariable () returned 0x27e828 [0044.691] GetCurrentThreadId () returned 0x9ac [0044.691] GetCurrentThreadId () returned 0x9ac [0044.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db028 | out: hHeap=0x260000) returned 1 [0044.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1720 | out: hHeap=0x260000) returned 1 [0044.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db028 [0044.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.691] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.691] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.692] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.692] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.692] CloseHandle (hObject=0x10c) returned 1 [0044.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db028 | out: hHeap=0x260000) returned 1 [0044.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf60 | out: hHeap=0x260000) returned 1 [0044.693] RtlWakeConditionVariable () returned 0x27e828 [0044.693] GetCurrentThreadId () returned 0x9ac [0044.693] GetCurrentThreadId () returned 0x9ac [0044.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eab0 | out: hHeap=0x260000) returned 1 [0044.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6d8 | out: hHeap=0x260000) returned 1 [0044.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eab0 [0044.693] lstrlenW (lpString=".ldf") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".ldf") returned 0x0 [0044.693] lstrlenW (lpString=".vhd") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".vhd") returned 0x0 [0044.693] lstrlenW (lpString=".vhdx") returned 5 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".vhdx") returned 0x0 [0044.693] lstrlenW (lpString=".pst") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".pst") returned 0x0 [0044.693] lstrlenW (lpString=".ost") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".ost") returned 0x0 [0044.693] lstrlenW (lpString=".bak") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".bak") returned 0x0 [0044.693] lstrlenW (lpString=".bac") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".bac") returned 0x0 [0044.693] lstrlenW (lpString=".sys") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".sys") returned 0x0 [0044.693] lstrlenW (lpString=".v2i") returned 4 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".v2i") returned 0x0 [0044.693] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.694] lstrlenW (lpString=".sql") returned 4 [0044.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".sql") returned 0x0 [0044.695] lstrlenW (lpString=".mdf") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".mdf") returned 0x0 [0044.695] lstrlenW (lpString=".txt") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".txt") returned 0x0 [0044.695] lstrlenW (lpString=".dbf") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".dbf") returned 0x0 [0044.695] lstrlenW (lpString=".ckp") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".ckp") returned 0x0 [0044.695] lstrlenW (lpString=".dacpac") returned 7 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".dacpac") returned 0x0 [0044.695] lstrlenW (lpString=".db3") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".db3") returned 0x0 [0044.695] lstrlenW (lpString=".dtxs") returned 5 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".dtxs") returned 0x0 [0044.695] lstrlenW (lpString=".mdt") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".mdt") returned 0x0 [0044.695] lstrlenW (lpString=".sdf") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".sdf") returned 0x0 [0044.695] lstrlenW (lpString=".MDF") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".MDF") returned 0x0 [0044.695] lstrlenW (lpString=".DBF") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".DBF") returned 0x0 [0044.695] lstrlenW (lpString=".DB") returned 3 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".DB") returned 0x0 [0044.695] lstrlenW (lpString=".db") returned 3 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".db") returned 0x0 [0044.695] lstrlenW (lpString=".ndf") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".ndf") returned 0x0 [0044.695] lstrlenW (lpString=".NDF") returned 4 [0044.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".NDF") returned 0x0 [0044.695] lstrlenW (lpString=".Mdf") returned 4 [0044.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".Mdf") returned 0x0 [0044.696] lstrlenW (lpString=".dat") returned 4 [0044.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".dat") returned 0x0 [0044.696] lstrlenW (lpString=".DAT") returned 4 [0044.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".DAT") returned 0x0 [0044.696] lstrlenW (lpString=".ldf") returned 4 [0044.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".ldf") returned 0x0 [0044.696] lstrlenW (lpString=".LDF") returned 4 [0044.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch=".LDF") returned 0x0 [0044.696] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.696] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.697] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.697] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16469823289) returned 1 [0044.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa974eef0, dwHighDateTime=0x1d585b4)) [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6d8 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6d8 | out: hHeap=0x260000) returned 1 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30dce8 [0044.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dce8 | out: hHeap=0x260000) returned 1 [0044.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.698] GetLastError () returned 0x0 [0044.698] GetLastError () returned 0x0 [0044.698] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.698] GetLastError () returned 0x0 [0044.698] GetLastError () returned 0x0 [0044.700] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff45ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.700] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xba32, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0xba32, lpOverlapped=0x0) returned 1 [0044.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.700] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.700] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.700] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.700] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.700] CloseHandle (hObject=0x10c) returned 1 [0044.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.701] GetLastError () returned 0x0 [0044.701] RtlWakeConditionVariable () returned 0x27e828 [0044.701] GetCurrentThreadId () returned 0x9ac [0044.701] GetCurrentThreadId () returned 0x9ac [0044.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0044.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6a0 | out: hHeap=0x260000) returned 1 [0044.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0044.701] lstrlenW (lpString=".ldf") returned 4 [0044.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".ldf") returned 0x0 [0044.701] lstrlenW (lpString=".vhd") returned 4 [0044.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".vhd") returned 0x0 [0044.701] lstrlenW (lpString=".vhdx") returned 5 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".vhdx") returned 0x0 [0044.702] lstrlenW (lpString=".pst") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".pst") returned 0x0 [0044.702] lstrlenW (lpString=".ost") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".ost") returned 0x0 [0044.702] lstrlenW (lpString=".bak") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".bak") returned 0x0 [0044.702] lstrlenW (lpString=".bac") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".bac") returned 0x0 [0044.702] lstrlenW (lpString=".sys") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".sys") returned 0x0 [0044.702] lstrlenW (lpString=".v2i") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".v2i") returned 0x0 [0044.702] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.702] lstrlenW (lpString=".sql") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".sql") returned 0x0 [0044.702] lstrlenW (lpString=".mdf") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".mdf") returned 0x0 [0044.702] lstrlenW (lpString=".txt") returned 4 [0044.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".txt") returned 0x0 [0044.703] lstrlenW (lpString=".dbf") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".dbf") returned 0x0 [0044.703] lstrlenW (lpString=".ckp") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".ckp") returned 0x0 [0044.703] lstrlenW (lpString=".dacpac") returned 7 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".dacpac") returned 0x0 [0044.703] lstrlenW (lpString=".db3") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".db3") returned 0x0 [0044.703] lstrlenW (lpString=".dtxs") returned 5 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".dtxs") returned 0x0 [0044.703] lstrlenW (lpString=".mdt") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".mdt") returned 0x0 [0044.703] lstrlenW (lpString=".sdf") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".sdf") returned 0x0 [0044.703] lstrlenW (lpString=".MDF") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".MDF") returned 0x0 [0044.703] lstrlenW (lpString=".DBF") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".DBF") returned 0x0 [0044.703] lstrlenW (lpString=".DB") returned 3 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".DB") returned 0x0 [0044.703] lstrlenW (lpString=".db") returned 3 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".db") returned 0x0 [0044.703] lstrlenW (lpString=".ndf") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".ndf") returned 0x0 [0044.703] lstrlenW (lpString=".NDF") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".NDF") returned 0x0 [0044.703] lstrlenW (lpString=".Mdf") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".Mdf") returned 0x0 [0044.703] lstrlenW (lpString=".dat") returned 4 [0044.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".dat") returned 0x0 [0044.704] lstrlenW (lpString=".DAT") returned 4 [0044.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".DAT") returned 0x0 [0044.704] lstrlenW (lpString=".ldf") returned 4 [0044.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".ldf") returned 0x0 [0044.704] lstrlenW (lpString=".LDF") returned 4 [0044.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch=".LDF") returned 0x0 [0044.704] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.704] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.705] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.705] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.705] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16470587321) returned 1 [0044.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa974eef0, dwHighDateTime=0x1d585b4)) [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d6a0 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d6a0 | out: hHeap=0x260000) returned 1 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30eab0 [0044.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eab0 | out: hHeap=0x260000) returned 1 [0044.705] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.705] GetLastError () returned 0x0 [0044.706] GetLastError () returned 0x0 [0044.706] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.706] GetLastError () returned 0x0 [0044.706] GetLastError () returned 0x0 [0044.707] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffe0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.707] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f3, lpOverlapped=0x0) returned 1 [0044.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.707] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.707] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.707] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.707] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.707] CloseHandle (hObject=0x10c) returned 1 [0044.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.[deadmin@cock.li].deadmin")) returned 1 [0044.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.709] GetLastError () returned 0x0 [0044.709] RtlWakeConditionVariable () returned 0x27e828 [0044.709] GetCurrentThreadId () returned 0x9ac [0044.709] GetCurrentThreadId () returned 0x9ac [0044.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eca8 | out: hHeap=0x260000) returned 1 [0044.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0044.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0044.815] lstrlenW (lpString=".ldf") returned 4 [0044.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.815] lstrlenW (lpString=".vhd") returned 4 [0044.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.815] lstrlenW (lpString=".vhdx") returned 5 [0044.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.815] lstrlenW (lpString=".pst") returned 4 [0044.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.816] lstrlenW (lpString=".ost") returned 4 [0044.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.816] lstrlenW (lpString=".bak") returned 4 [0044.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.816] lstrlenW (lpString=".bac") returned 4 [0044.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.816] lstrlenW (lpString=".sys") returned 4 [0044.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.816] lstrlenW (lpString=".v2i") returned 4 [0044.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.816] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.817] lstrlenW (lpString=".sql") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.817] lstrlenW (lpString=".mdf") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.817] lstrlenW (lpString=".txt") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.817] lstrlenW (lpString=".dbf") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.817] lstrlenW (lpString=".ckp") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.817] lstrlenW (lpString=".dacpac") returned 7 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.817] lstrlenW (lpString=".db3") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.817] lstrlenW (lpString=".dtxs") returned 5 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.817] lstrlenW (lpString=".mdt") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.817] lstrlenW (lpString=".sdf") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.817] lstrlenW (lpString=".MDF") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.817] lstrlenW (lpString=".DBF") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.817] lstrlenW (lpString=".DB") returned 3 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.817] lstrlenW (lpString=".db") returned 3 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.817] lstrlenW (lpString=".ndf") returned 4 [0044.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.818] lstrlenW (lpString=".NDF") returned 4 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.818] lstrlenW (lpString=".Mdf") returned 4 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.818] lstrlenW (lpString=".dat") returned 4 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.818] lstrlenW (lpString=".DAT") returned 4 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.818] lstrlenW (lpString=".ldf") returned 4 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.818] lstrlenW (lpString=".LDF") returned 4 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.818] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.819] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.819] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16482010674) returned 1 [0044.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa987f9f0, dwHighDateTime=0x1d585b4)) [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30df88 [0044.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df88 | out: hHeap=0x260000) returned 1 [0044.819] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.820] GetLastError () returned 0x0 [0044.820] GetLastError () returned 0x0 [0044.820] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.820] GetLastError () returned 0x0 [0044.820] GetLastError () returned 0x0 [0044.822] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffb30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.822] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x4d0, lpOverlapped=0x0) returned 1 [0044.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.822] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.822] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.822] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.822] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.822] CloseHandle (hObject=0x10c) returned 1 [0044.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.823] GetLastError () returned 0x0 [0044.823] RtlWakeConditionVariable () returned 0x27e828 [0044.823] GetCurrentThreadId () returned 0x9ac [0044.823] GetCurrentThreadId () returned 0x9ac [0044.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b068 | out: hHeap=0x260000) returned 1 [0044.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295540 | out: hHeap=0x260000) returned 1 [0044.823] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b068 [0044.823] lstrlenW (lpString=".ldf") returned 4 [0044.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.823] lstrlenW (lpString=".vhd") returned 4 [0044.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0044.823] lstrlenW (lpString=".vhdx") returned 5 [0044.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0044.823] lstrlenW (lpString=".pst") returned 4 [0044.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0044.823] lstrlenW (lpString=".ost") returned 4 [0044.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0044.823] lstrlenW (lpString=".bak") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0044.824] lstrlenW (lpString=".bac") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0044.824] lstrlenW (lpString=".sys") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0044.824] lstrlenW (lpString=".v2i") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0044.824] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0044.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.824] lstrlenW (lpString=".sql") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0044.824] lstrlenW (lpString=".mdf") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0044.824] lstrlenW (lpString=".txt") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0044.824] lstrlenW (lpString=".dbf") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0044.824] lstrlenW (lpString=".ckp") returned 4 [0044.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0044.824] lstrlenW (lpString=".dacpac") returned 7 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0044.825] lstrlenW (lpString=".db3") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0044.825] lstrlenW (lpString=".dtxs") returned 5 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0044.825] lstrlenW (lpString=".mdt") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0044.825] lstrlenW (lpString=".sdf") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0044.825] lstrlenW (lpString=".MDF") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0044.825] lstrlenW (lpString=".DBF") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0044.825] lstrlenW (lpString=".DB") returned 3 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0044.825] lstrlenW (lpString=".db") returned 3 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0044.825] lstrlenW (lpString=".ndf") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0044.825] lstrlenW (lpString=".NDF") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0044.825] lstrlenW (lpString=".Mdf") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0044.825] lstrlenW (lpString=".dat") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0044.825] lstrlenW (lpString=".DAT") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0044.825] lstrlenW (lpString=".ldf") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0044.825] lstrlenW (lpString=".LDF") returned 4 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0044.825] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.825] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.826] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.826] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.826] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.826] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16482759496) returned 1 [0044.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa987f9f0, dwHighDateTime=0x1d585b4)) [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295540 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295540 | out: hHeap=0x260000) returned 1 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30e960 [0044.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e960 | out: hHeap=0x260000) returned 1 [0044.827] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.827] GetLastError () returned 0x0 [0044.827] GetLastError () returned 0x0 [0044.827] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.827] GetLastError () returned 0x0 [0044.827] GetLastError () returned 0x0 [0044.829] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb813, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.829] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x47ed, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x47ed, lpOverlapped=0x0) returned 1 [0044.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.829] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.829] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.829] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.829] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.830] CloseHandle (hObject=0x10c) returned 1 [0044.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0044.830] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0044.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0044.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.830] GetLastError () returned 0x0 [0044.830] RtlWakeConditionVariable () returned 0x27e828 [0044.830] GetCurrentThreadId () returned 0x9ac [0044.830] GetCurrentThreadId () returned 0x9ac [0044.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db4d8 | out: hHeap=0x260000) returned 1 [0044.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295508 | out: hHeap=0x260000) returned 1 [0044.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db4d8 [0044.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.831] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.831] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0044.831] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0044.831] WriteFile (in: hFile=0x10c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0044.832] CloseHandle (hObject=0x10c) returned 1 [0044.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db4d8 | out: hHeap=0x260000) returned 1 [0044.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf60 | out: hHeap=0x260000) returned 1 [0044.832] RtlWakeConditionVariable () returned 0x27e828 [0044.832] GetCurrentThreadId () returned 0x9ac [0044.832] GetCurrentThreadId () returned 0x9ac [0044.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ed50 | out: hHeap=0x260000) returned 1 [0044.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0044.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0044.832] lstrlenW (lpString=".ldf") returned 4 [0044.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".ldf") returned 0x0 [0044.833] lstrlenW (lpString=".vhd") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".vhd") returned 0x0 [0044.833] lstrlenW (lpString=".vhdx") returned 5 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".vhdx") returned 0x0 [0044.833] lstrlenW (lpString=".pst") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".pst") returned 0x0 [0044.833] lstrlenW (lpString=".ost") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".ost") returned 0x0 [0044.833] lstrlenW (lpString=".bak") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".bak") returned 0x0 [0044.833] lstrlenW (lpString=".bac") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".bac") returned 0x0 [0044.833] lstrlenW (lpString=".sys") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".sys") returned 0x0 [0044.833] lstrlenW (lpString=".v2i") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".v2i") returned 0x0 [0044.833] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0044.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.833] lstrlenW (lpString=".sql") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".sql") returned 0x0 [0044.833] lstrlenW (lpString=".mdf") returned 4 [0044.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".mdf") returned 0x0 [0044.833] lstrlenW (lpString=".txt") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".txt") returned 0x0 [0044.834] lstrlenW (lpString=".dbf") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".dbf") returned 0x0 [0044.834] lstrlenW (lpString=".ckp") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".ckp") returned 0x0 [0044.834] lstrlenW (lpString=".dacpac") returned 7 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".dacpac") returned 0x0 [0044.834] lstrlenW (lpString=".db3") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".db3") returned 0x0 [0044.834] lstrlenW (lpString=".dtxs") returned 5 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".dtxs") returned 0x0 [0044.834] lstrlenW (lpString=".mdt") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".mdt") returned 0x0 [0044.834] lstrlenW (lpString=".sdf") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".sdf") returned 0x0 [0044.834] lstrlenW (lpString=".MDF") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".MDF") returned 0x0 [0044.834] lstrlenW (lpString=".DBF") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".DBF") returned 0x0 [0044.834] lstrlenW (lpString=".DB") returned 3 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".DB") returned 0x0 [0044.834] lstrlenW (lpString=".db") returned 3 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".db") returned 0x0 [0044.834] lstrlenW (lpString=".ndf") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".ndf") returned 0x0 [0044.834] lstrlenW (lpString=".NDF") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".NDF") returned 0x0 [0044.834] lstrlenW (lpString=".Mdf") returned 4 [0044.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".Mdf") returned 0x0 [0044.835] lstrlenW (lpString=".dat") returned 4 [0044.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".dat") returned 0x0 [0044.835] lstrlenW (lpString=".DAT") returned 4 [0044.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".DAT") returned 0x0 [0044.835] lstrlenW (lpString=".ldf") returned 4 [0044.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".ldf") returned 0x0 [0044.835] lstrlenW (lpString=".LDF") returned 4 [0044.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch=".LDF") returned 0x0 [0044.835] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.835] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.836] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.836] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16483684756) returned 1 [0044.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa98a5b50, dwHighDateTime=0x1d585b4)) [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2954d0 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30eca8 [0044.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30eca8 | out: hHeap=0x260000) returned 1 [0044.836] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.836] GetLastError () returned 0x0 [0044.836] GetLastError () returned 0x0 [0044.836] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.837] GetLastError () returned 0x0 [0044.837] GetLastError () returned 0x0 [0044.839] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff18bd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.839] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0xe743, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0xe743, lpOverlapped=0x0) returned 1 [0044.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.839] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.839] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.839] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.839] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.840] CloseHandle (hObject=0x10c) returned 1 [0044.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0044.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.[deadmin@cock.li].deadmin")) returned 1 [0044.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fd90 | out: hHeap=0x260000) returned 1 [0044.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.840] GetLastError () returned 0x0 [0044.840] RtlWakeConditionVariable () returned 0x27e828 [0044.840] GetCurrentThreadId () returned 0x9ac [0044.840] GetCurrentThreadId () returned 0x9ac [0044.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.840] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f338 | out: hHeap=0x260000) returned 1 [0044.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d98 | out: hHeap=0x260000) returned 1 [0044.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f338 [0044.841] lstrlenW (lpString=".ldf") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.841] lstrlenW (lpString=".vhd") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0044.841] lstrlenW (lpString=".vhdx") returned 5 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0044.841] lstrlenW (lpString=".pst") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0044.841] lstrlenW (lpString=".ost") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0044.841] lstrlenW (lpString=".bak") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0044.841] lstrlenW (lpString=".bac") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0044.841] lstrlenW (lpString=".sys") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0044.841] lstrlenW (lpString=".v2i") returned 4 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0044.841] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.841] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0044.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0044.842] lstrlenW (lpString=".sql") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0044.842] lstrlenW (lpString=".mdf") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0044.842] lstrlenW (lpString=".txt") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0044.842] lstrlenW (lpString=".dbf") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0044.842] lstrlenW (lpString=".ckp") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0044.842] lstrlenW (lpString=".dacpac") returned 7 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0044.842] lstrlenW (lpString=".db3") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0044.842] lstrlenW (lpString=".dtxs") returned 5 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0044.842] lstrlenW (lpString=".mdt") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0044.842] lstrlenW (lpString=".sdf") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0044.842] lstrlenW (lpString=".MDF") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0044.842] lstrlenW (lpString=".DBF") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0044.842] lstrlenW (lpString=".DB") returned 3 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0044.842] lstrlenW (lpString=".db") returned 3 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0044.842] lstrlenW (lpString=".ndf") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0044.842] lstrlenW (lpString=".NDF") returned 4 [0044.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0044.843] lstrlenW (lpString=".Mdf") returned 4 [0044.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0044.843] lstrlenW (lpString=".dat") returned 4 [0044.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0044.843] lstrlenW (lpString=".DAT") returned 4 [0044.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0044.843] lstrlenW (lpString=".ldf") returned 4 [0044.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0044.843] lstrlenW (lpString=".LDF") returned 4 [0044.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0044.843] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0044.843] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0044.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0044.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0044.843] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0044.844] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0044.844] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0044.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0044.844] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16484494557) returned 1 [0044.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa98a5b50, dwHighDateTime=0x1d585b4)) [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d98 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0044.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d98 | out: hHeap=0x260000) returned 1 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0044.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30ed50 [0044.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0044.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ed50 | out: hHeap=0x260000) returned 1 [0044.844] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0044.844] GetLastError () returned 0x0 [0044.845] GetLastError () returned 0x0 [0044.845] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0044.845] GetLastError () returned 0x0 [0044.845] GetLastError () returned 0x0 [0044.867] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff985, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.867] WriteFile (in: hFile=0x10c, lpBuffer=0x2b4238*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4238*, lpNumberOfBytesWritten=0x24cfdb0*=0x67b, lpOverlapped=0x0) returned 1 [0044.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0044.868] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.868] WriteFile (in: hFile=0x10c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0044.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0044.868] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0044.868] CloseHandle (hObject=0x10c) returned 1 [0044.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0044.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0044.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0044.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0044.922] GetLastError () returned 0x0 [0044.922] RtlWakeConditionVariable () returned 0x27e828 [0044.922] GetCurrentThreadId () returned 0x9ac [0044.922] GetCurrentThreadId () returned 0x9ac [0044.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f728 | out: hHeap=0x260000) returned 1 [0044.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d748 | out: hHeap=0x260000) returned 1 [0044.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f728 [0044.922] lstrlenW (lpString=".ldf") returned 4 [0044.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".ldf") returned 0x0 [0044.922] lstrlenW (lpString=".vhd") returned 4 [0044.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".vhd") returned 0x0 [0044.922] lstrlenW (lpString=".vhdx") returned 5 [0044.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".vhdx") returned 0x0 [0044.923] lstrlenW (lpString=".pst") returned 4 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".pst") returned 0x0 [0044.923] lstrlenW (lpString=".ost") returned 4 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".ost") returned 0x0 [0044.923] lstrlenW (lpString=".bak") returned 4 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".bak") returned 0x0 [0044.923] lstrlenW (lpString=".bac") returned 4 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".bac") returned 0x0 [0044.923] lstrlenW (lpString=".sys") returned 4 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".sys") returned 0x0 [0044.923] lstrlenW (lpString=".v2i") returned 4 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".v2i") returned 0x0 [0044.923] lstrlenW (lpString="s\r\n.v2i") returned 7 [0044.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch="s\r\n.v2i") returned 0x0 [0044.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.094] lstrlenW (lpString=".sql") returned 4 [0045.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".sql") returned 0x0 [0045.094] lstrlenW (lpString=".mdf") returned 4 [0045.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".mdf") returned 0x0 [0045.095] lstrlenW (lpString=".txt") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".txt") returned 0x0 [0045.095] lstrlenW (lpString=".dbf") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".dbf") returned 0x0 [0045.095] lstrlenW (lpString=".ckp") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".ckp") returned 0x0 [0045.095] lstrlenW (lpString=".dacpac") returned 7 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".dacpac") returned 0x0 [0045.095] lstrlenW (lpString=".db3") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".db3") returned 0x0 [0045.095] lstrlenW (lpString=".dtxs") returned 5 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".dtxs") returned 0x0 [0045.095] lstrlenW (lpString=".mdt") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".mdt") returned 0x0 [0045.095] lstrlenW (lpString=".sdf") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".sdf") returned 0x0 [0045.095] lstrlenW (lpString=".MDF") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".MDF") returned 0x0 [0045.095] lstrlenW (lpString=".DBF") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".DBF") returned 0x0 [0045.095] lstrlenW (lpString=".DB") returned 3 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".DB") returned 0x0 [0045.095] lstrlenW (lpString=".db") returned 3 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".db") returned 0x0 [0045.095] lstrlenW (lpString=".ndf") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".ndf") returned 0x0 [0045.095] lstrlenW (lpString=".NDF") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".NDF") returned 0x0 [0045.095] lstrlenW (lpString=".Mdf") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".Mdf") returned 0x0 [0045.095] lstrlenW (lpString=".dat") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".dat") returned 0x0 [0045.095] lstrlenW (lpString=".DAT") returned 4 [0045.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".DAT") returned 0x0 [0045.096] lstrlenW (lpString=".ldf") returned 4 [0045.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".ldf") returned 0x0 [0045.096] lstrlenW (lpString=".LDF") returned 4 [0045.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch=".LDF") returned 0x0 [0045.096] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.096] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0045.097] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.097] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.097] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16509793407) returned 1 [0045.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9b07150, dwHighDateTime=0x1d585b4)) [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a16e8 | out: hHeap=0x260000) returned 1 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f338 [0045.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f338 | out: hHeap=0x260000) returned 1 [0045.097] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.097] GetLastError () returned 0x0 [0045.098] GetLastError () returned 0x0 [0045.098] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.098] GetLastError () returned 0x0 [0045.098] GetLastError () returned 0x0 [0045.099] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffdb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.099] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x249, lpOverlapped=0x0) returned 1 [0045.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.099] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.099] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.099] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.099] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.099] CloseHandle (hObject=0xfc) returned 1 [0045.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.100] GetLastError () returned 0x0 [0045.100] RtlWakeConditionVariable () returned 0x27e828 [0045.100] GetCurrentThreadId () returned 0x9ac [0045.100] GetCurrentThreadId () returned 0x9ac [0045.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db730 | out: hHeap=0x260000) returned 1 [0045.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13e0 | out: hHeap=0x260000) returned 1 [0045.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db730 [0045.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.102] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.102] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.102] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.103] WriteFile (in: hFile=0xfc, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.103] CloseHandle (hObject=0xfc) returned 1 [0045.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db730 | out: hHeap=0x260000) returned 1 [0045.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.104] RtlWakeConditionVariable () returned 0x27e828 [0045.104] GetCurrentThreadId () returned 0x9ac [0045.104] GetCurrentThreadId () returned 0x9ac [0045.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f878 | out: hHeap=0x260000) returned 1 [0045.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efcf0 | out: hHeap=0x260000) returned 1 [0045.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f878 [0045.104] lstrlenW (lpString=".ldf") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".ldf") returned 0x0 [0045.104] lstrlenW (lpString=".vhd") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".vhd") returned 0x0 [0045.104] lstrlenW (lpString=".vhdx") returned 5 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".vhdx") returned 0x0 [0045.104] lstrlenW (lpString=".pst") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".pst") returned 0x0 [0045.104] lstrlenW (lpString=".ost") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".ost") returned 0x0 [0045.104] lstrlenW (lpString=".bak") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".bak") returned 0x0 [0045.104] lstrlenW (lpString=".bac") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".bac") returned 0x0 [0045.104] lstrlenW (lpString=".sys") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".sys") returned 0x0 [0045.104] lstrlenW (lpString=".v2i") returned 4 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".v2i") returned 0x0 [0045.104] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.105] lstrlenW (lpString=".sql") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".sql") returned 0x0 [0045.105] lstrlenW (lpString=".mdf") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".mdf") returned 0x0 [0045.105] lstrlenW (lpString=".txt") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".txt") returned 0x0 [0045.105] lstrlenW (lpString=".dbf") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".dbf") returned 0x0 [0045.105] lstrlenW (lpString=".ckp") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".ckp") returned 0x0 [0045.105] lstrlenW (lpString=".dacpac") returned 7 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".dacpac") returned 0x0 [0045.105] lstrlenW (lpString=".db3") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".db3") returned 0x0 [0045.105] lstrlenW (lpString=".dtxs") returned 5 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".dtxs") returned 0x0 [0045.105] lstrlenW (lpString=".mdt") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".mdt") returned 0x0 [0045.105] lstrlenW (lpString=".sdf") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".sdf") returned 0x0 [0045.105] lstrlenW (lpString=".MDF") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".MDF") returned 0x0 [0045.105] lstrlenW (lpString=".DBF") returned 4 [0045.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".DBF") returned 0x0 [0045.106] lstrlenW (lpString=".DB") returned 3 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".DB") returned 0x0 [0045.106] lstrlenW (lpString=".db") returned 3 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".db") returned 0x0 [0045.106] lstrlenW (lpString=".ndf") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".ndf") returned 0x0 [0045.106] lstrlenW (lpString=".NDF") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".NDF") returned 0x0 [0045.106] lstrlenW (lpString=".Mdf") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".Mdf") returned 0x0 [0045.106] lstrlenW (lpString=".dat") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".dat") returned 0x0 [0045.106] lstrlenW (lpString=".DAT") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".DAT") returned 0x0 [0045.106] lstrlenW (lpString=".ldf") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".ldf") returned 0x0 [0045.106] lstrlenW (lpString=".LDF") returned 4 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch=".LDF") returned 0x0 [0045.106] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.106] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.106] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0045.107] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.107] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.107] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16510822146) returned 1 [0045.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9b2d2b0, dwHighDateTime=0x1d585b4)) [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efcf0 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efcf0 | out: hHeap=0x260000) returned 1 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f728 [0045.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f728 | out: hHeap=0x260000) returned 1 [0045.108] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.108] GetLastError () returned 0x0 [0045.108] GetLastError () returned 0x0 [0045.108] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.108] GetLastError () returned 0x0 [0045.108] GetLastError () returned 0x0 [0045.110] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe992b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.110] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x166d5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x166d5, lpOverlapped=0x0) returned 1 [0045.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.111] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.111] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.111] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.111] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.111] CloseHandle (hObject=0xfc) returned 1 [0045.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.112] GetLastError () returned 0x0 [0045.112] RtlWakeConditionVariable () returned 0x27e828 [0045.112] GetCurrentThreadId () returned 0x9ac [0045.112] GetCurrentThreadId () returned 0x9ac [0045.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f920 | out: hHeap=0x260000) returned 1 [0045.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd28 | out: hHeap=0x260000) returned 1 [0045.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f920 [0045.112] lstrlenW (lpString=".ldf") returned 4 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".ldf") returned 0x0 [0045.112] lstrlenW (lpString=".vhd") returned 4 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".vhd") returned 0x0 [0045.112] lstrlenW (lpString=".vhdx") returned 5 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".vhdx") returned 0x0 [0045.112] lstrlenW (lpString=".pst") returned 4 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".pst") returned 0x0 [0045.112] lstrlenW (lpString=".ost") returned 4 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".ost") returned 0x0 [0045.112] lstrlenW (lpString=".bak") returned 4 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".bak") returned 0x0 [0045.112] lstrlenW (lpString=".bac") returned 4 [0045.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".bac") returned 0x0 [0045.113] lstrlenW (lpString=".sys") returned 4 [0045.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".sys") returned 0x0 [0045.113] lstrlenW (lpString=".v2i") returned 4 [0045.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".v2i") returned 0x0 [0045.113] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.113] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.113] lstrlenW (lpString=".sql") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".sql") returned 0x0 [0045.114] lstrlenW (lpString=".mdf") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".mdf") returned 0x0 [0045.114] lstrlenW (lpString=".txt") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".txt") returned 0x0 [0045.114] lstrlenW (lpString=".dbf") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".dbf") returned 0x0 [0045.114] lstrlenW (lpString=".ckp") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".ckp") returned 0x0 [0045.114] lstrlenW (lpString=".dacpac") returned 7 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".dacpac") returned 0x0 [0045.114] lstrlenW (lpString=".db3") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".db3") returned 0x0 [0045.114] lstrlenW (lpString=".dtxs") returned 5 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".dtxs") returned 0x0 [0045.114] lstrlenW (lpString=".mdt") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".mdt") returned 0x0 [0045.114] lstrlenW (lpString=".sdf") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".sdf") returned 0x0 [0045.114] lstrlenW (lpString=".MDF") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".MDF") returned 0x0 [0045.114] lstrlenW (lpString=".DBF") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".DBF") returned 0x0 [0045.114] lstrlenW (lpString=".DB") returned 3 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".DB") returned 0x0 [0045.114] lstrlenW (lpString=".db") returned 3 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".db") returned 0x0 [0045.114] lstrlenW (lpString=".ndf") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".ndf") returned 0x0 [0045.114] lstrlenW (lpString=".NDF") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".NDF") returned 0x0 [0045.114] lstrlenW (lpString=".Mdf") returned 4 [0045.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".Mdf") returned 0x0 [0045.115] lstrlenW (lpString=".dat") returned 4 [0045.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".dat") returned 0x0 [0045.115] lstrlenW (lpString=".DAT") returned 4 [0045.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".DAT") returned 0x0 [0045.115] lstrlenW (lpString=".ldf") returned 4 [0045.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".ldf") returned 0x0 [0045.115] lstrlenW (lpString=".LDF") returned 4 [0045.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch=".LDF") returned 0x0 [0045.115] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.115] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0045.116] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.116] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.116] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16511707523) returned 1 [0045.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9b53410, dwHighDateTime=0x1d585b4)) [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd28 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd28 | out: hHeap=0x260000) returned 1 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f878 [0045.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f878 | out: hHeap=0x260000) returned 1 [0045.116] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.117] GetLastError () returned 0x0 [0045.117] GetLastError () returned 0x0 [0045.117] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.117] GetLastError () returned 0x0 [0045.117] GetLastError () returned 0x0 [0045.118] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.118] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1f4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f4, lpOverlapped=0x0) returned 1 [0045.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.118] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.118] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.118] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.118] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.118] CloseHandle (hObject=0xfc) returned 1 [0045.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.118] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.123] GetLastError () returned 0x0 [0045.123] RtlWakeConditionVariable () returned 0x27e828 [0045.123] GetCurrentThreadId () returned 0x9ac [0045.123] GetCurrentThreadId () returned 0x9ac [0045.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f9c8 | out: hHeap=0x260000) returned 1 [0045.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd60 | out: hHeap=0x260000) returned 1 [0045.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f9c8 [0045.123] lstrlenW (lpString=".ldf") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.123] lstrlenW (lpString=".vhd") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.123] lstrlenW (lpString=".vhdx") returned 5 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.123] lstrlenW (lpString=".pst") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.123] lstrlenW (lpString=".ost") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.123] lstrlenW (lpString=".bak") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.123] lstrlenW (lpString=".bac") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.123] lstrlenW (lpString=".sys") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.123] lstrlenW (lpString=".v2i") returned 4 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.123] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.123] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.124] lstrlenW (lpString=".sql") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.124] lstrlenW (lpString=".mdf") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.124] lstrlenW (lpString=".txt") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.124] lstrlenW (lpString=".dbf") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.124] lstrlenW (lpString=".ckp") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.124] lstrlenW (lpString=".dacpac") returned 7 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.124] lstrlenW (lpString=".db3") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.124] lstrlenW (lpString=".dtxs") returned 5 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.124] lstrlenW (lpString=".mdt") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.124] lstrlenW (lpString=".sdf") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.124] lstrlenW (lpString=".MDF") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.124] lstrlenW (lpString=".DBF") returned 4 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.124] lstrlenW (lpString=".DB") returned 3 [0045.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.125] lstrlenW (lpString=".db") returned 3 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.125] lstrlenW (lpString=".ndf") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.125] lstrlenW (lpString=".NDF") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.125] lstrlenW (lpString=".Mdf") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.125] lstrlenW (lpString=".dat") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.125] lstrlenW (lpString=".DAT") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.125] lstrlenW (lpString=".ldf") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.125] lstrlenW (lpString=".LDF") returned 4 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.125] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.125] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0045.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.126] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0045.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.126] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16512712694) returned 1 [0045.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9b53410, dwHighDateTime=0x1d585b4)) [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd60 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd60 | out: hHeap=0x260000) returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f920 [0045.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f920 | out: hHeap=0x260000) returned 1 [0045.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.127] GetLastError () returned 0x0 [0045.127] GetLastError () returned 0x0 [0045.127] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.127] GetLastError () returned 0x0 [0045.127] GetLastError () returned 0x0 [0045.208] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff5f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.208] WriteFile (in: hFile=0xfc, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa0e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xa0e, lpOverlapped=0x0) returned 1 [0045.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.208] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.209] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.209] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.209] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.209] CloseHandle (hObject=0xfc) returned 1 [0045.209] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315e98 [0045.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315e98 | out: hHeap=0x260000) returned 1 [0045.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0045.210] GetLastError () returned 0x0 [0045.210] RtlWakeConditionVariable () returned 0x27e828 [0045.210] GetCurrentThreadId () returned 0x9ac [0045.210] GetCurrentThreadId () returned 0x9ac [0045.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e330 | out: hHeap=0x260000) returned 1 [0045.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff20 | out: hHeap=0x260000) returned 1 [0045.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0045.210] lstrlenW (lpString=".ldf") returned 4 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".ldf") returned 0x0 [0045.210] lstrlenW (lpString=".vhd") returned 4 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".vhd") returned 0x0 [0045.210] lstrlenW (lpString=".vhdx") returned 5 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".vhdx") returned 0x0 [0045.210] lstrlenW (lpString=".pst") returned 4 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".pst") returned 0x0 [0045.210] lstrlenW (lpString=".ost") returned 4 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".ost") returned 0x0 [0045.210] lstrlenW (lpString=".bak") returned 4 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".bak") returned 0x0 [0045.210] lstrlenW (lpString=".bac") returned 4 [0045.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".bac") returned 0x0 [0045.210] lstrlenW (lpString=".sys") returned 4 [0045.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".sys") returned 0x0 [0045.211] lstrlenW (lpString=".v2i") returned 4 [0045.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".v2i") returned 0x0 [0045.211] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.216] lstrlenW (lpString=".sql") returned 4 [0045.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".sql") returned 0x0 [0045.216] lstrlenW (lpString=".mdf") returned 4 [0045.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".mdf") returned 0x0 [0045.217] lstrlenW (lpString=".txt") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".txt") returned 0x0 [0045.217] lstrlenW (lpString=".dbf") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".dbf") returned 0x0 [0045.217] lstrlenW (lpString=".ckp") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".ckp") returned 0x0 [0045.217] lstrlenW (lpString=".dacpac") returned 7 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".dacpac") returned 0x0 [0045.217] lstrlenW (lpString=".db3") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".db3") returned 0x0 [0045.217] lstrlenW (lpString=".dtxs") returned 5 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".dtxs") returned 0x0 [0045.217] lstrlenW (lpString=".mdt") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".mdt") returned 0x0 [0045.217] lstrlenW (lpString=".sdf") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".sdf") returned 0x0 [0045.217] lstrlenW (lpString=".MDF") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".MDF") returned 0x0 [0045.217] lstrlenW (lpString=".DBF") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".DBF") returned 0x0 [0045.217] lstrlenW (lpString=".DB") returned 3 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".DB") returned 0x0 [0045.217] lstrlenW (lpString=".db") returned 3 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".db") returned 0x0 [0045.217] lstrlenW (lpString=".ndf") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".ndf") returned 0x0 [0045.217] lstrlenW (lpString=".NDF") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".NDF") returned 0x0 [0045.217] lstrlenW (lpString=".Mdf") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".Mdf") returned 0x0 [0045.217] lstrlenW (lpString=".dat") returned 4 [0045.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".dat") returned 0x0 [0045.218] lstrlenW (lpString=".DAT") returned 4 [0045.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".DAT") returned 0x0 [0045.218] lstrlenW (lpString=".ldf") returned 4 [0045.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".ldf") returned 0x0 [0045.218] lstrlenW (lpString=".LDF") returned 4 [0045.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch=".LDF") returned 0x0 [0045.218] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.218] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.219] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.219] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.219] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16521985610) returned 1 [0045.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9c37c50, dwHighDateTime=0x1d585b4)) [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff58 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff58 | out: hHeap=0x260000) returned 1 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e090 [0045.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e090 | out: hHeap=0x260000) returned 1 [0045.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.219] GetLastError () returned 0x0 [0045.219] GetLastError () returned 0x0 [0045.220] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.220] GetLastError () returned 0x0 [0045.220] GetLastError () returned 0x0 [0045.221] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffdb5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.221] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x24b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x24b, lpOverlapped=0x0) returned 1 [0045.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.221] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.221] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.221] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.221] CloseHandle (hObject=0x108) returned 1 [0045.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.222] GetLastError () returned 0x0 [0045.222] RtlWakeConditionVariable () returned 0x27e828 [0045.222] GetCurrentThreadId () returned 0x9ac [0045.222] GetCurrentThreadId () returned 0x9ac [0045.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8c70 | out: hHeap=0x260000) returned 1 [0045.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff90 | out: hHeap=0x260000) returned 1 [0045.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8c70 [0045.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.224] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.224] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.224] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.224] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.225] CloseHandle (hObject=0x108) returned 1 [0045.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8c70 | out: hHeap=0x260000) returned 1 [0045.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.225] RtlWakeConditionVariable () returned 0x27e828 [0045.225] GetCurrentThreadId () returned 0x9ac [0045.225] GetCurrentThreadId () returned 0x9ac [0045.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f1e8 | out: hHeap=0x260000) returned 1 [0045.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0045.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f1e8 [0045.225] lstrlenW (lpString=".ldf") returned 4 [0045.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.225] lstrlenW (lpString=".vhd") returned 4 [0045.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.225] lstrlenW (lpString=".vhdx") returned 5 [0045.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.225] lstrlenW (lpString=".pst") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.226] lstrlenW (lpString=".ost") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.226] lstrlenW (lpString=".bak") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.226] lstrlenW (lpString=".bac") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.226] lstrlenW (lpString=".sys") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.226] lstrlenW (lpString=".v2i") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.226] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.226] lstrlenW (lpString=".sql") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.226] lstrlenW (lpString=".mdf") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.226] lstrlenW (lpString=".txt") returned 4 [0045.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.226] lstrlenW (lpString=".dbf") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.227] lstrlenW (lpString=".ckp") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.227] lstrlenW (lpString=".dacpac") returned 7 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.227] lstrlenW (lpString=".db3") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.227] lstrlenW (lpString=".dtxs") returned 5 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.227] lstrlenW (lpString=".mdt") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.227] lstrlenW (lpString=".sdf") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.227] lstrlenW (lpString=".MDF") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.227] lstrlenW (lpString=".DBF") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.227] lstrlenW (lpString=".DB") returned 3 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.227] lstrlenW (lpString=".db") returned 3 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.227] lstrlenW (lpString=".ndf") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.227] lstrlenW (lpString=".NDF") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.227] lstrlenW (lpString=".Mdf") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.227] lstrlenW (lpString=".dat") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.227] lstrlenW (lpString=".DAT") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.227] lstrlenW (lpString=".ldf") returned 4 [0045.227] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.228] lstrlenW (lpString=".LDF") returned 4 [0045.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.228] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.228] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.228] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.229] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.229] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16522978496) returned 1 [0045.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9c5ddb0, dwHighDateTime=0x1d585b4)) [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x30f530 [0045.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30f530 | out: hHeap=0x260000) returned 1 [0045.229] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.229] GetLastError () returned 0x0 [0045.229] GetLastError () returned 0x0 [0045.229] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.230] GetLastError () returned 0x0 [0045.230] GetLastError () returned 0x0 [0045.231] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.231] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x59f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x59f, lpOverlapped=0x0) returned 1 [0045.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.231] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.231] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.232] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.232] CloseHandle (hObject=0x108) returned 1 [0045.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.232] GetLastError () returned 0x0 [0045.232] RtlWakeConditionVariable () returned 0x27e828 [0045.232] GetCurrentThreadId () returned 0x9ac [0045.232] GetCurrentThreadId () returned 0x9ac [0045.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dd48 | out: hHeap=0x260000) returned 1 [0045.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2effc8 | out: hHeap=0x260000) returned 1 [0045.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dd48 [0045.233] lstrlenW (lpString=".ldf") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".ldf") returned 0x0 [0045.233] lstrlenW (lpString=".vhd") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".vhd") returned 0x0 [0045.233] lstrlenW (lpString=".vhdx") returned 5 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".vhdx") returned 0x0 [0045.233] lstrlenW (lpString=".pst") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".pst") returned 0x0 [0045.233] lstrlenW (lpString=".ost") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".ost") returned 0x0 [0045.233] lstrlenW (lpString=".bak") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".bak") returned 0x0 [0045.233] lstrlenW (lpString=".bac") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".bac") returned 0x0 [0045.233] lstrlenW (lpString=".sys") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".sys") returned 0x0 [0045.233] lstrlenW (lpString=".v2i") returned 4 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".v2i") returned 0x0 [0045.233] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.234] lstrlenW (lpString=".sql") returned 4 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".sql") returned 0x0 [0045.234] lstrlenW (lpString=".mdf") returned 4 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".mdf") returned 0x0 [0045.234] lstrlenW (lpString=".txt") returned 4 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".txt") returned 0x0 [0045.234] lstrlenW (lpString=".dbf") returned 4 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".dbf") returned 0x0 [0045.234] lstrlenW (lpString=".ckp") returned 4 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".ckp") returned 0x0 [0045.234] lstrlenW (lpString=".dacpac") returned 7 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".dacpac") returned 0x0 [0045.234] lstrlenW (lpString=".db3") returned 4 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".db3") returned 0x0 [0045.234] lstrlenW (lpString=".dtxs") returned 5 [0045.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".dtxs") returned 0x0 [0045.234] lstrlenW (lpString=".mdt") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".mdt") returned 0x0 [0045.235] lstrlenW (lpString=".sdf") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".sdf") returned 0x0 [0045.235] lstrlenW (lpString=".MDF") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".MDF") returned 0x0 [0045.235] lstrlenW (lpString=".DBF") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".DBF") returned 0x0 [0045.235] lstrlenW (lpString=".DB") returned 3 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".DB") returned 0x0 [0045.235] lstrlenW (lpString=".db") returned 3 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".db") returned 0x0 [0045.235] lstrlenW (lpString=".ndf") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".ndf") returned 0x0 [0045.235] lstrlenW (lpString=".NDF") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".NDF") returned 0x0 [0045.235] lstrlenW (lpString=".Mdf") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".Mdf") returned 0x0 [0045.235] lstrlenW (lpString=".dat") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".dat") returned 0x0 [0045.235] lstrlenW (lpString=".DAT") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".DAT") returned 0x0 [0045.235] lstrlenW (lpString=".ldf") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".ldf") returned 0x0 [0045.235] lstrlenW (lpString=".LDF") returned 4 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch=".LDF") returned 0x0 [0045.235] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.235] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.236] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.236] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.236] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16523744099) returned 1 [0045.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9c5ddb0, dwHighDateTime=0x1d585b4)) [0045.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2effc8 [0045.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2effc8 | out: hHeap=0x260000) returned 1 [0045.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e330 [0045.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e330 | out: hHeap=0x260000) returned 1 [0045.237] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.237] GetLastError () returned 0x0 [0045.237] GetLastError () returned 0x0 [0045.237] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.237] GetLastError () returned 0x0 [0045.237] GetLastError () returned 0x0 [0045.239] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff4459, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.239] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xbba7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xbba7, lpOverlapped=0x0) returned 1 [0045.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.240] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.240] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.240] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.240] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.240] CloseHandle (hObject=0x108) returned 1 [0045.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.242] GetLastError () returned 0x0 [0045.242] RtlWakeConditionVariable () returned 0x27e828 [0045.242] GetCurrentThreadId () returned 0x9ac [0045.242] GetCurrentThreadId () returned 0x9ac [0045.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d2c8 | out: hHeap=0x260000) returned 1 [0045.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0000 | out: hHeap=0x260000) returned 1 [0045.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d2c8 [0045.242] lstrlenW (lpString=".ldf") returned 4 [0045.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".ldf") returned 0x0 [0045.242] lstrlenW (lpString=".vhd") returned 4 [0045.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".vhd") returned 0x0 [0045.242] lstrlenW (lpString=".vhdx") returned 5 [0045.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".vhdx") returned 0x0 [0045.242] lstrlenW (lpString=".pst") returned 4 [0045.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".pst") returned 0x0 [0045.243] lstrlenW (lpString=".ost") returned 4 [0045.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".ost") returned 0x0 [0045.243] lstrlenW (lpString=".bak") returned 4 [0045.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".bak") returned 0x0 [0045.243] lstrlenW (lpString=".bac") returned 4 [0045.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".bac") returned 0x0 [0045.243] lstrlenW (lpString=".sys") returned 4 [0045.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".sys") returned 0x0 [0045.243] lstrlenW (lpString=".v2i") returned 4 [0045.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".v2i") returned 0x0 [0045.243] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.244] lstrlenW (lpString=".sql") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".sql") returned 0x0 [0045.244] lstrlenW (lpString=".mdf") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".mdf") returned 0x0 [0045.244] lstrlenW (lpString=".txt") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".txt") returned 0x0 [0045.244] lstrlenW (lpString=".dbf") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".dbf") returned 0x0 [0045.244] lstrlenW (lpString=".ckp") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".ckp") returned 0x0 [0045.244] lstrlenW (lpString=".dacpac") returned 7 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".dacpac") returned 0x0 [0045.244] lstrlenW (lpString=".db3") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".db3") returned 0x0 [0045.244] lstrlenW (lpString=".dtxs") returned 5 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".dtxs") returned 0x0 [0045.244] lstrlenW (lpString=".mdt") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".mdt") returned 0x0 [0045.244] lstrlenW (lpString=".sdf") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".sdf") returned 0x0 [0045.244] lstrlenW (lpString=".MDF") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".MDF") returned 0x0 [0045.244] lstrlenW (lpString=".DBF") returned 4 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".DBF") returned 0x0 [0045.244] lstrlenW (lpString=".DB") returned 3 [0045.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".DB") returned 0x0 [0045.244] lstrlenW (lpString=".db") returned 3 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".db") returned 0x0 [0045.245] lstrlenW (lpString=".ndf") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".ndf") returned 0x0 [0045.245] lstrlenW (lpString=".NDF") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".NDF") returned 0x0 [0045.245] lstrlenW (lpString=".Mdf") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".Mdf") returned 0x0 [0045.245] lstrlenW (lpString=".dat") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".dat") returned 0x0 [0045.245] lstrlenW (lpString=".DAT") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".DAT") returned 0x0 [0045.245] lstrlenW (lpString=".ldf") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".ldf") returned 0x0 [0045.245] lstrlenW (lpString=".LDF") returned 4 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch=".LDF") returned 0x0 [0045.245] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.245] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.245] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.246] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.246] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16524715738) returned 1 [0045.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9c83f10, dwHighDateTime=0x1d585b4)) [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0000 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0000 | out: hHeap=0x260000) returned 1 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dd48 [0045.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dd48 | out: hHeap=0x260000) returned 1 [0045.246] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.247] GetLastError () returned 0x0 [0045.247] GetLastError () returned 0x0 [0045.247] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.247] GetLastError () returned 0x0 [0045.247] GetLastError () returned 0x0 [0045.248] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffda8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.248] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x258, lpOverlapped=0x0) returned 1 [0045.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.248] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.248] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.248] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.248] CloseHandle (hObject=0x108) returned 1 [0045.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.249] GetLastError () returned 0x0 [0045.249] RtlWakeConditionVariable () returned 0x27e828 [0045.249] GetCurrentThreadId () returned 0x9ac [0045.249] GetCurrentThreadId () returned 0x9ac [0045.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e1e0 | out: hHeap=0x260000) returned 1 [0045.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0038 | out: hHeap=0x260000) returned 1 [0045.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e1e0 [0045.249] lstrlenW (lpString=".ldf") returned 4 [0045.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.249] lstrlenW (lpString=".vhd") returned 4 [0045.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.250] lstrlenW (lpString=".vhdx") returned 5 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.250] lstrlenW (lpString=".pst") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.250] lstrlenW (lpString=".ost") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.250] lstrlenW (lpString=".bak") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.250] lstrlenW (lpString=".bac") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.250] lstrlenW (lpString=".sys") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.250] lstrlenW (lpString=".v2i") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.250] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.250] lstrlenW (lpString=".sql") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.250] lstrlenW (lpString=".mdf") returned 4 [0045.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.250] lstrlenW (lpString=".txt") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.251] lstrlenW (lpString=".dbf") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.251] lstrlenW (lpString=".ckp") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.251] lstrlenW (lpString=".dacpac") returned 7 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.251] lstrlenW (lpString=".db3") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.251] lstrlenW (lpString=".dtxs") returned 5 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.251] lstrlenW (lpString=".mdt") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.251] lstrlenW (lpString=".sdf") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.251] lstrlenW (lpString=".MDF") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.251] lstrlenW (lpString=".DBF") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.251] lstrlenW (lpString=".DB") returned 3 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.251] lstrlenW (lpString=".db") returned 3 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.251] lstrlenW (lpString=".ndf") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.251] lstrlenW (lpString=".NDF") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.251] lstrlenW (lpString=".Mdf") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.251] lstrlenW (lpString=".dat") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.251] lstrlenW (lpString=".DAT") returned 4 [0045.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.252] lstrlenW (lpString=".ldf") returned 4 [0045.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.252] lstrlenW (lpString=".LDF") returned 4 [0045.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.252] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.252] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.252] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.252] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.253] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16525375307) returned 1 [0045.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9c83f10, dwHighDateTime=0x1d585b4)) [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0038 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0038 | out: hHeap=0x260000) returned 1 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d2c8 [0045.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d2c8 | out: hHeap=0x260000) returned 1 [0045.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.253] GetLastError () returned 0x0 [0045.253] GetLastError () returned 0x0 [0045.253] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.253] GetLastError () returned 0x0 [0045.254] GetLastError () returned 0x0 [0045.255] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6f08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.255] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x90f8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x90f8, lpOverlapped=0x0) returned 1 [0045.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.257] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.257] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.257] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.257] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.257] CloseHandle (hObject=0x108) returned 1 [0045.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.258] GetLastError () returned 0x0 [0045.258] RtlWakeConditionVariable () returned 0x27e828 [0045.258] GetCurrentThreadId () returned 0x9ac [0045.258] GetCurrentThreadId () returned 0x9ac [0045.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8d38 | out: hHeap=0x260000) returned 1 [0045.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0070 | out: hHeap=0x260000) returned 1 [0045.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8d38 [0045.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.258] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.258] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.258] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.258] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.259] CloseHandle (hObject=0x108) returned 1 [0045.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8d38 | out: hHeap=0x260000) returned 1 [0045.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.259] RtlWakeConditionVariable () returned 0x27e828 [0045.259] GetCurrentThreadId () returned 0x9ac [0045.259] GetCurrentThreadId () returned 0x9ac [0045.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e138 | out: hHeap=0x260000) returned 1 [0045.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0045.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e138 [0045.260] lstrlenW (lpString=".ldf") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.260] lstrlenW (lpString=".vhd") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.260] lstrlenW (lpString=".vhdx") returned 5 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.260] lstrlenW (lpString=".pst") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.260] lstrlenW (lpString=".ost") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.260] lstrlenW (lpString=".bak") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.260] lstrlenW (lpString=".bac") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.260] lstrlenW (lpString=".sys") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.260] lstrlenW (lpString=".v2i") returned 4 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.260] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.264] lstrlenW (lpString=".sql") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.264] lstrlenW (lpString=".mdf") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.264] lstrlenW (lpString=".txt") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.264] lstrlenW (lpString=".dbf") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.264] lstrlenW (lpString=".ckp") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.264] lstrlenW (lpString=".dacpac") returned 7 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.264] lstrlenW (lpString=".db3") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.264] lstrlenW (lpString=".dtxs") returned 5 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.264] lstrlenW (lpString=".mdt") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.264] lstrlenW (lpString=".sdf") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.264] lstrlenW (lpString=".MDF") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.264] lstrlenW (lpString=".DBF") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.264] lstrlenW (lpString=".DB") returned 3 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.264] lstrlenW (lpString=".db") returned 3 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.264] lstrlenW (lpString=".ndf") returned 4 [0045.264] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.264] lstrlenW (lpString=".NDF") returned 4 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.265] lstrlenW (lpString=".Mdf") returned 4 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.265] lstrlenW (lpString=".dat") returned 4 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.265] lstrlenW (lpString=".DAT") returned 4 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.265] lstrlenW (lpString=".ldf") returned 4 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.265] lstrlenW (lpString=".LDF") returned 4 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.265] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.265] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.266] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.266] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.266] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16526703198) returned 1 [0045.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9caa070, dwHighDateTime=0x1d585b4)) [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299830 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299830 | out: hHeap=0x260000) returned 1 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e1e0 [0045.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e1e0 | out: hHeap=0x260000) returned 1 [0045.266] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.267] GetLastError () returned 0x0 [0045.267] GetLastError () returned 0x0 [0045.267] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.267] GetLastError () returned 0x0 [0045.267] GetLastError () returned 0x0 [0045.268] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff97e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.268] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x682, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x682, lpOverlapped=0x0) returned 1 [0045.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.268] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.268] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.269] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.269] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.269] CloseHandle (hObject=0x108) returned 1 [0045.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.269] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.269] GetLastError () returned 0x0 [0045.269] RtlWakeConditionVariable () returned 0x27e828 [0045.269] GetCurrentThreadId () returned 0x9ac [0045.269] GetCurrentThreadId () returned 0x9ac [0045.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ddf0 | out: hHeap=0x260000) returned 1 [0045.270] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0045.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ddf0 [0045.270] lstrlenW (lpString=".ldf") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".ldf") returned 0x0 [0045.270] lstrlenW (lpString=".vhd") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".vhd") returned 0x0 [0045.270] lstrlenW (lpString=".vhdx") returned 5 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".vhdx") returned 0x0 [0045.270] lstrlenW (lpString=".pst") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".pst") returned 0x0 [0045.270] lstrlenW (lpString=".ost") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".ost") returned 0x0 [0045.270] lstrlenW (lpString=".bak") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".bak") returned 0x0 [0045.270] lstrlenW (lpString=".bac") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".bac") returned 0x0 [0045.270] lstrlenW (lpString=".sys") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".sys") returned 0x0 [0045.270] lstrlenW (lpString=".v2i") returned 4 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".v2i") returned 0x0 [0045.270] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.270] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.271] lstrlenW (lpString=".sql") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".sql") returned 0x0 [0045.271] lstrlenW (lpString=".mdf") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".mdf") returned 0x0 [0045.271] lstrlenW (lpString=".txt") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".txt") returned 0x0 [0045.271] lstrlenW (lpString=".dbf") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".dbf") returned 0x0 [0045.271] lstrlenW (lpString=".ckp") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".ckp") returned 0x0 [0045.271] lstrlenW (lpString=".dacpac") returned 7 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".dacpac") returned 0x0 [0045.271] lstrlenW (lpString=".db3") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".db3") returned 0x0 [0045.271] lstrlenW (lpString=".dtxs") returned 5 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".dtxs") returned 0x0 [0045.271] lstrlenW (lpString=".mdt") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".mdt") returned 0x0 [0045.271] lstrlenW (lpString=".sdf") returned 4 [0045.271] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".sdf") returned 0x0 [0045.272] lstrlenW (lpString=".MDF") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".MDF") returned 0x0 [0045.272] lstrlenW (lpString=".DBF") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".DBF") returned 0x0 [0045.272] lstrlenW (lpString=".DB") returned 3 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".DB") returned 0x0 [0045.272] lstrlenW (lpString=".db") returned 3 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".db") returned 0x0 [0045.272] lstrlenW (lpString=".ndf") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".ndf") returned 0x0 [0045.272] lstrlenW (lpString=".NDF") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".NDF") returned 0x0 [0045.272] lstrlenW (lpString=".Mdf") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".Mdf") returned 0x0 [0045.272] lstrlenW (lpString=".dat") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".dat") returned 0x0 [0045.272] lstrlenW (lpString=".DAT") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".DAT") returned 0x0 [0045.272] lstrlenW (lpString=".ldf") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".ldf") returned 0x0 [0045.272] lstrlenW (lpString=".LDF") returned 4 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch=".LDF") returned 0x0 [0045.272] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.272] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.273] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.273] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.273] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16527432926) returned 1 [0045.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9cd01d0, dwHighDateTime=0x1d585b4)) [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299868 [0045.273] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.273] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299868 | out: hHeap=0x260000) returned 1 [0045.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29e138 [0045.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.274] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e138 | out: hHeap=0x260000) returned 1 [0045.274] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.274] GetLastError () returned 0x0 [0045.274] GetLastError () returned 0x0 [0045.274] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.274] GetLastError () returned 0x0 [0045.274] GetLastError () returned 0x0 [0045.276] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff48a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.276] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb75e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb75e, lpOverlapped=0x0) returned 1 [0045.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.276] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.276] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.276] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.276] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.276] CloseHandle (hObject=0x108) returned 1 [0045.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.278] GetLastError () returned 0x0 [0045.278] RtlWakeConditionVariable () returned 0x27e828 [0045.278] GetCurrentThreadId () returned 0x9ac [0045.278] GetCurrentThreadId () returned 0x9ac [0045.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0045.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998a0 | out: hHeap=0x260000) returned 1 [0045.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d8b0 [0045.279] lstrlenW (lpString=".ldf") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".ldf") returned 0x0 [0045.279] lstrlenW (lpString=".vhd") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".vhd") returned 0x0 [0045.279] lstrlenW (lpString=".vhdx") returned 5 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".vhdx") returned 0x0 [0045.279] lstrlenW (lpString=".pst") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".pst") returned 0x0 [0045.279] lstrlenW (lpString=".ost") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".ost") returned 0x0 [0045.279] lstrlenW (lpString=".bak") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".bak") returned 0x0 [0045.279] lstrlenW (lpString=".bac") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".bac") returned 0x0 [0045.279] lstrlenW (lpString=".sys") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".sys") returned 0x0 [0045.279] lstrlenW (lpString=".v2i") returned 4 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".v2i") returned 0x0 [0045.279] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.279] lstrlenW (lpString=".sql") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".sql") returned 0x0 [0045.280] lstrlenW (lpString=".mdf") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".mdf") returned 0x0 [0045.280] lstrlenW (lpString=".txt") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".txt") returned 0x0 [0045.280] lstrlenW (lpString=".dbf") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".dbf") returned 0x0 [0045.280] lstrlenW (lpString=".ckp") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".ckp") returned 0x0 [0045.280] lstrlenW (lpString=".dacpac") returned 7 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".dacpac") returned 0x0 [0045.280] lstrlenW (lpString=".db3") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".db3") returned 0x0 [0045.280] lstrlenW (lpString=".dtxs") returned 5 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".dtxs") returned 0x0 [0045.280] lstrlenW (lpString=".mdt") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".mdt") returned 0x0 [0045.280] lstrlenW (lpString=".sdf") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".sdf") returned 0x0 [0045.280] lstrlenW (lpString=".MDF") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".MDF") returned 0x0 [0045.280] lstrlenW (lpString=".DBF") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".DBF") returned 0x0 [0045.280] lstrlenW (lpString=".DB") returned 3 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".DB") returned 0x0 [0045.280] lstrlenW (lpString=".db") returned 3 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".db") returned 0x0 [0045.280] lstrlenW (lpString=".ndf") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".ndf") returned 0x0 [0045.280] lstrlenW (lpString=".NDF") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".NDF") returned 0x0 [0045.280] lstrlenW (lpString=".Mdf") returned 4 [0045.280] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".Mdf") returned 0x0 [0045.280] lstrlenW (lpString=".dat") returned 4 [0045.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".dat") returned 0x0 [0045.281] lstrlenW (lpString=".DAT") returned 4 [0045.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".DAT") returned 0x0 [0045.281] lstrlenW (lpString=".ldf") returned 4 [0045.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".ldf") returned 0x0 [0045.281] lstrlenW (lpString=".LDF") returned 4 [0045.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch=".LDF") returned 0x0 [0045.281] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.281] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.281] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.282] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.282] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.282] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16528291250) returned 1 [0045.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9cd01d0, dwHighDateTime=0x1d585b4)) [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998a0 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998a0 | out: hHeap=0x260000) returned 1 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29ddf0 [0045.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ddf0 | out: hHeap=0x260000) returned 1 [0045.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.282] GetLastError () returned 0x0 [0045.283] GetLastError () returned 0x0 [0045.283] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.283] GetLastError () returned 0x0 [0045.283] GetLastError () returned 0x0 [0045.284] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffdb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.284] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x24a, lpOverlapped=0x0) returned 1 [0045.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.284] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.284] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.284] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.284] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.284] CloseHandle (hObject=0x108) returned 1 [0045.284] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.285] GetLastError () returned 0x0 [0045.285] RtlWakeConditionVariable () returned 0x27e828 [0045.285] GetCurrentThreadId () returned 0x9ac [0045.285] GetCurrentThreadId () returned 0x9ac [0045.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x260000) returned 1 [0045.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0045.285] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29de98 [0045.285] lstrlenW (lpString=".ldf") returned 4 [0045.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.285] lstrlenW (lpString=".vhd") returned 4 [0045.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.285] lstrlenW (lpString=".vhdx") returned 5 [0045.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.285] lstrlenW (lpString=".pst") returned 4 [0045.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.285] lstrlenW (lpString=".ost") returned 4 [0045.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.286] lstrlenW (lpString=".bak") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.286] lstrlenW (lpString=".bac") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.286] lstrlenW (lpString=".sys") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.286] lstrlenW (lpString=".v2i") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.286] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.286] lstrlenW (lpString=".sql") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.286] lstrlenW (lpString=".mdf") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.286] lstrlenW (lpString=".txt") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.286] lstrlenW (lpString=".dbf") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.286] lstrlenW (lpString=".ckp") returned 4 [0045.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.286] lstrlenW (lpString=".dacpac") returned 7 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.287] lstrlenW (lpString=".db3") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.287] lstrlenW (lpString=".dtxs") returned 5 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.287] lstrlenW (lpString=".mdt") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.287] lstrlenW (lpString=".sdf") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.287] lstrlenW (lpString=".MDF") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.287] lstrlenW (lpString=".DBF") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.287] lstrlenW (lpString=".DB") returned 3 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.287] lstrlenW (lpString=".db") returned 3 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.287] lstrlenW (lpString=".ndf") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.287] lstrlenW (lpString=".NDF") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.287] lstrlenW (lpString=".Mdf") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.287] lstrlenW (lpString=".dat") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.287] lstrlenW (lpString=".DAT") returned 4 [0045.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.288] lstrlenW (lpString=".ldf") returned 4 [0045.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.288] lstrlenW (lpString=".LDF") returned 4 [0045.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.288] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.288] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.288] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.289] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16528975072) returned 1 [0045.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9cf6330, dwHighDateTime=0x1d585b4)) [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d8b0 [0045.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d8b0 | out: hHeap=0x260000) returned 1 [0045.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.289] GetLastError () returned 0x0 [0045.289] GetLastError () returned 0x0 [0045.289] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.289] GetLastError () returned 0x0 [0045.290] GetLastError () returned 0x0 [0045.291] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb395, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.291] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4c6b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x4c6b, lpOverlapped=0x0) returned 1 [0045.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.291] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.291] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.291] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.292] CloseHandle (hObject=0x108) returned 1 [0045.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.292] GetLastError () returned 0x0 [0045.292] RtlWakeConditionVariable () returned 0x27e828 [0045.292] GetCurrentThreadId () returned 0x9ac [0045.292] GetCurrentThreadId () returned 0x9ac [0045.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a48 | out: hHeap=0x260000) returned 1 [0045.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299910 | out: hHeap=0x260000) returned 1 [0045.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9a48 [0045.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.293] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.293] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.293] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.293] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.294] CloseHandle (hObject=0x108) returned 1 [0045.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a48 | out: hHeap=0x260000) returned 1 [0045.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.294] RtlWakeConditionVariable () returned 0x27e828 [0045.294] GetCurrentThreadId () returned 0x9ac [0045.294] GetCurrentThreadId () returned 0x9ac [0045.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dfe8 | out: hHeap=0x260000) returned 1 [0045.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996e0 | out: hHeap=0x260000) returned 1 [0045.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dfe8 [0045.294] lstrlenW (lpString=".ldf") returned 4 [0045.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.294] lstrlenW (lpString=".vhd") returned 4 [0045.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".vhd") returned 0x0 [0045.294] lstrlenW (lpString=".vhdx") returned 5 [0045.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".vhdx") returned 0x0 [0045.294] lstrlenW (lpString=".pst") returned 4 [0045.294] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".pst") returned 0x0 [0045.295] lstrlenW (lpString=".ost") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".ost") returned 0x0 [0045.295] lstrlenW (lpString=".bak") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".bak") returned 0x0 [0045.295] lstrlenW (lpString=".bac") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".bac") returned 0x0 [0045.295] lstrlenW (lpString=".sys") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".sys") returned 0x0 [0045.295] lstrlenW (lpString=".v2i") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".v2i") returned 0x0 [0045.295] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0045.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.295] lstrlenW (lpString=".sql") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".sql") returned 0x0 [0045.295] lstrlenW (lpString=".mdf") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".mdf") returned 0x0 [0045.295] lstrlenW (lpString=".txt") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".txt") returned 0x0 [0045.295] lstrlenW (lpString=".dbf") returned 4 [0045.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".dbf") returned 0x0 [0045.295] lstrlenW (lpString=".ckp") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".ckp") returned 0x0 [0045.296] lstrlenW (lpString=".dacpac") returned 7 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".dacpac") returned 0x0 [0045.296] lstrlenW (lpString=".db3") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".db3") returned 0x0 [0045.296] lstrlenW (lpString=".dtxs") returned 5 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".dtxs") returned 0x0 [0045.296] lstrlenW (lpString=".mdt") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".mdt") returned 0x0 [0045.296] lstrlenW (lpString=".sdf") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".sdf") returned 0x0 [0045.296] lstrlenW (lpString=".MDF") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".MDF") returned 0x0 [0045.296] lstrlenW (lpString=".DBF") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".DBF") returned 0x0 [0045.296] lstrlenW (lpString=".DB") returned 3 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".DB") returned 0x0 [0045.296] lstrlenW (lpString=".db") returned 3 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".db") returned 0x0 [0045.296] lstrlenW (lpString=".ndf") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".ndf") returned 0x0 [0045.296] lstrlenW (lpString=".NDF") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".NDF") returned 0x0 [0045.296] lstrlenW (lpString=".Mdf") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".Mdf") returned 0x0 [0045.296] lstrlenW (lpString=".dat") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".dat") returned 0x0 [0045.296] lstrlenW (lpString=".DAT") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".DAT") returned 0x0 [0045.296] lstrlenW (lpString=".ldf") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".ldf") returned 0x0 [0045.296] lstrlenW (lpString=".LDF") returned 4 [0045.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch=".LDF") returned 0x0 [0045.297] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.297] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.297] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.298] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16529866145) returned 1 [0045.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9cf6330, dwHighDateTime=0x1d585b4)) [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996e0 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996e0 | out: hHeap=0x260000) returned 1 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29de98 [0045.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29de98 | out: hHeap=0x260000) returned 1 [0045.298] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.298] GetLastError () returned 0x0 [0045.298] GetLastError () returned 0x0 [0045.298] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.298] GetLastError () returned 0x0 [0045.298] GetLastError () returned 0x0 [0045.300] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa71, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.300] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x58f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x58f, lpOverlapped=0x0) returned 1 [0045.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.300] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.300] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.300] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.300] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.300] CloseHandle (hObject=0x108) returned 1 [0045.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.[deadmin@cock.li].deadmin")) returned 1 [0045.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.301] GetLastError () returned 0x0 [0045.301] RtlWakeConditionVariable () returned 0x27e828 [0045.301] GetCurrentThreadId () returned 0x9ac [0045.301] GetCurrentThreadId () returned 0x9ac [0045.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0045.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29df40 | out: hHeap=0x260000) returned 1 [0045.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299718 | out: hHeap=0x260000) returned 1 [0045.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29df40 [0045.301] lstrlenW (lpString=".ldf") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".ldf") returned 0x0 [0045.302] lstrlenW (lpString=".vhd") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".vhd") returned 0x0 [0045.302] lstrlenW (lpString=".vhdx") returned 5 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".vhdx") returned 0x0 [0045.302] lstrlenW (lpString=".pst") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".pst") returned 0x0 [0045.302] lstrlenW (lpString=".ost") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".ost") returned 0x0 [0045.302] lstrlenW (lpString=".bak") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".bak") returned 0x0 [0045.302] lstrlenW (lpString=".bac") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".bac") returned 0x0 [0045.302] lstrlenW (lpString=".sys") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".sys") returned 0x0 [0045.302] lstrlenW (lpString=".v2i") returned 4 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".v2i") returned 0x0 [0045.302] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.303] lstrlenW (lpString=".sql") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".sql") returned 0x0 [0045.303] lstrlenW (lpString=".mdf") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".mdf") returned 0x0 [0045.303] lstrlenW (lpString=".txt") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".txt") returned 0x0 [0045.303] lstrlenW (lpString=".dbf") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".dbf") returned 0x0 [0045.303] lstrlenW (lpString=".ckp") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".ckp") returned 0x0 [0045.303] lstrlenW (lpString=".dacpac") returned 7 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".dacpac") returned 0x0 [0045.303] lstrlenW (lpString=".db3") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".db3") returned 0x0 [0045.303] lstrlenW (lpString=".dtxs") returned 5 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".dtxs") returned 0x0 [0045.303] lstrlenW (lpString=".mdt") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".mdt") returned 0x0 [0045.303] lstrlenW (lpString=".sdf") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".sdf") returned 0x0 [0045.303] lstrlenW (lpString=".MDF") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".MDF") returned 0x0 [0045.303] lstrlenW (lpString=".DBF") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".DBF") returned 0x0 [0045.303] lstrlenW (lpString=".DB") returned 3 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".DB") returned 0x0 [0045.303] lstrlenW (lpString=".db") returned 3 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".db") returned 0x0 [0045.303] lstrlenW (lpString=".ndf") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".ndf") returned 0x0 [0045.303] lstrlenW (lpString=".NDF") returned 4 [0045.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".NDF") returned 0x0 [0045.304] lstrlenW (lpString=".Mdf") returned 4 [0045.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".Mdf") returned 0x0 [0045.304] lstrlenW (lpString=".dat") returned 4 [0045.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".dat") returned 0x0 [0045.304] lstrlenW (lpString=".DAT") returned 4 [0045.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".DAT") returned 0x0 [0045.304] lstrlenW (lpString=".ldf") returned 4 [0045.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".ldf") returned 0x0 [0045.304] lstrlenW (lpString=".LDF") returned 4 [0045.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch=".LDF") returned 0x0 [0045.304] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.304] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.305] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.305] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.305] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16530594928) returned 1 [0045.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9d1c490, dwHighDateTime=0x1d585b4)) [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299718 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299718 | out: hHeap=0x260000) returned 1 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29dfe8 [0045.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dfe8 | out: hHeap=0x260000) returned 1 [0045.305] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.305] GetLastError () returned 0x0 [0045.306] GetLastError () returned 0x0 [0045.306] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.306] GetLastError () returned 0x0 [0045.306] GetLastError () returned 0x0 [0045.307] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff4cf2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.307] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb30e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb30e, lpOverlapped=0x0) returned 1 [0045.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.308] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.308] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.308] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.308] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.308] CloseHandle (hObject=0x108) returned 1 [0045.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.310] GetLastError () returned 0x0 [0045.310] RtlWakeConditionVariable () returned 0x27e828 [0045.310] GetCurrentThreadId () returned 0x9ac [0045.310] GetCurrentThreadId () returned 0x9ac [0045.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0045.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cc70 | out: hHeap=0x260000) returned 1 [0045.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0045.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29cc70 [0045.310] lstrlenW (lpString=".ldf") returned 4 [0045.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.310] lstrlenW (lpString=".vhd") returned 4 [0045.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.310] lstrlenW (lpString=".vhdx") returned 5 [0045.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.311] lstrlenW (lpString=".pst") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.311] lstrlenW (lpString=".ost") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.311] lstrlenW (lpString=".bak") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.311] lstrlenW (lpString=".bac") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.311] lstrlenW (lpString=".sys") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.311] lstrlenW (lpString=".v2i") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.311] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0045.311] lstrlenW (lpString=".sql") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.311] lstrlenW (lpString=".mdf") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.311] lstrlenW (lpString=".txt") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.311] lstrlenW (lpString=".dbf") returned 4 [0045.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.311] lstrlenW (lpString=".ckp") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.312] lstrlenW (lpString=".dacpac") returned 7 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.312] lstrlenW (lpString=".db3") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.312] lstrlenW (lpString=".dtxs") returned 5 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.312] lstrlenW (lpString=".mdt") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.312] lstrlenW (lpString=".sdf") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.312] lstrlenW (lpString=".MDF") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.312] lstrlenW (lpString=".DBF") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.312] lstrlenW (lpString=".DB") returned 3 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.312] lstrlenW (lpString=".db") returned 3 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.312] lstrlenW (lpString=".ndf") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.312] lstrlenW (lpString=".NDF") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.312] lstrlenW (lpString=".Mdf") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.312] lstrlenW (lpString=".dat") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.312] lstrlenW (lpString=".DAT") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.312] lstrlenW (lpString=".ldf") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.312] lstrlenW (lpString=".LDF") returned 4 [0045.312] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.313] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.313] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x298fd0 [0045.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.313] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.313] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.313] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32eae0 [0045.314] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16531464093) returned 1 [0045.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xa9d1c490, dwHighDateTime=0x1d585b4)) [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994b0 | out: hHeap=0x260000) returned 1 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x29d4c0 [0045.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d4c0 | out: hHeap=0x260000) returned 1 [0045.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.314] GetLastError () returned 0x0 [0045.314] GetLastError () returned 0x0 [0045.314] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.314] GetLastError () returned 0x0 [0045.314] GetLastError () returned 0x0 [0045.316] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc287, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.316] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3d79, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3d79, lpOverlapped=0x0) returned 1 [0045.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0045.317] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.317] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.317] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.317] CloseHandle (hObject=0x108) returned 1 [0045.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0045.318] GetLastError () returned 0x0 [0045.318] RtlWakeConditionVariable () returned 0x27e828 [0045.318] GetCurrentThreadId () returned 0x9ac [0045.318] GetCurrentThreadId () returned 0x9ac [0045.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e00 | out: hHeap=0x260000) returned 1 [0045.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0045.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0045.475] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.475] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.475] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.475] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.476] CloseHandle (hObject=0xf8) returned 1 [0045.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f8e00 | out: hHeap=0x260000) returned 1 [0045.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.476] RtlWakeConditionVariable () returned 0x27e828 [0045.476] GetCurrentThreadId () returned 0x9ac [0045.476] GetCurrentThreadId () returned 0x9ac [0045.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6360 [0045.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f75c0 | out: hHeap=0x260000) returned 1 [0045.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01c0 | out: hHeap=0x260000) returned 1 [0045.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0045.477] lstrlenW (lpString=".ldf") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".ldf") returned 0x0 [0045.477] lstrlenW (lpString=".vhd") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".vhd") returned 0x0 [0045.477] lstrlenW (lpString=".vhdx") returned 5 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".vhdx") returned 0x0 [0045.477] lstrlenW (lpString=".pst") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".pst") returned 0x0 [0045.477] lstrlenW (lpString=".ost") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".ost") returned 0x0 [0045.477] lstrlenW (lpString=".bak") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".bak") returned 0x0 [0045.477] lstrlenW (lpString=".bac") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".bac") returned 0x0 [0045.477] lstrlenW (lpString=".sys") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".sys") returned 0x0 [0045.477] lstrlenW (lpString=".v2i") returned 4 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".v2i") returned 0x0 [0045.477] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.477] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.617] lstrlenW (lpString=".sql") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".sql") returned 0x0 [0045.617] lstrlenW (lpString=".mdf") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".mdf") returned 0x0 [0045.617] lstrlenW (lpString=".txt") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".txt") returned 0x0 [0045.617] lstrlenW (lpString=".dbf") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".dbf") returned 0x0 [0045.617] lstrlenW (lpString=".ckp") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".ckp") returned 0x0 [0045.617] lstrlenW (lpString=".dacpac") returned 7 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".dacpac") returned 0x0 [0045.617] lstrlenW (lpString=".db3") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".db3") returned 0x0 [0045.617] lstrlenW (lpString=".dtxs") returned 5 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".dtxs") returned 0x0 [0045.617] lstrlenW (lpString=".mdt") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".mdt") returned 0x0 [0045.617] lstrlenW (lpString=".sdf") returned 4 [0045.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".sdf") returned 0x0 [0045.617] lstrlenW (lpString=".MDF") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".MDF") returned 0x0 [0045.618] lstrlenW (lpString=".DBF") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".DBF") returned 0x0 [0045.618] lstrlenW (lpString=".DB") returned 3 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".DB") returned 0x0 [0045.618] lstrlenW (lpString=".db") returned 3 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".db") returned 0x0 [0045.618] lstrlenW (lpString=".ndf") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".ndf") returned 0x0 [0045.618] lstrlenW (lpString=".NDF") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".NDF") returned 0x0 [0045.618] lstrlenW (lpString=".Mdf") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".Mdf") returned 0x0 [0045.618] lstrlenW (lpString=".dat") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".dat") returned 0x0 [0045.618] lstrlenW (lpString=".DAT") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".DAT") returned 0x0 [0045.618] lstrlenW (lpString=".ldf") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".ldf") returned 0x0 [0045.618] lstrlenW (lpString=".LDF") returned 4 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch=".LDF") returned 0x0 [0045.618] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0045.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0045.618] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312940) returned 1 [0045.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0045.619] CryptReleaseContext (hProv=0x312940, dwFlags=0x0) returned 1 [0045.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.619] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16562029638) returned 1 [0045.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa016010, dwHighDateTime=0x1d585b4)) [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294ee8 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294ee8 | out: hHeap=0x260000) returned 1 [0045.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f64b0 [0045.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f64b0 | out: hHeap=0x260000) returned 1 [0045.620] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.620] GetLastError () returned 0x0 [0045.620] GetLastError () returned 0x0 [0045.620] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.620] GetLastError () returned 0x0 [0045.620] GetLastError () returned 0x0 [0045.622] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffd9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.622] WriteFile (in: hFile=0xfc, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x265, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x265, lpOverlapped=0x0) returned 1 [0045.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.622] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.622] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.622] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.622] CloseHandle (hObject=0xfc) returned 1 [0045.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.623] GetLastError () returned 0x0 [0045.623] RtlWakeConditionVariable () returned 0x27e828 [0045.623] GetCurrentThreadId () returned 0x9ac [0045.623] GetCurrentThreadId () returned 0x9ac [0045.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6360 [0045.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0045.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f20 | out: hHeap=0x260000) returned 1 [0045.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319c48 [0045.623] lstrlenW (lpString=".ldf") returned 4 [0045.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".ldf") returned 0x0 [0045.623] lstrlenW (lpString=".vhd") returned 4 [0045.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".vhd") returned 0x0 [0045.623] lstrlenW (lpString=".vhdx") returned 5 [0045.623] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".vhdx") returned 0x0 [0045.624] lstrlenW (lpString=".pst") returned 4 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".pst") returned 0x0 [0045.624] lstrlenW (lpString=".ost") returned 4 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".ost") returned 0x0 [0045.624] lstrlenW (lpString=".bak") returned 4 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".bak") returned 0x0 [0045.624] lstrlenW (lpString=".bac") returned 4 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".bac") returned 0x0 [0045.624] lstrlenW (lpString=".sys") returned 4 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".sys") returned 0x0 [0045.624] lstrlenW (lpString=".v2i") returned 4 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".v2i") returned 0x0 [0045.624] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch="s\r\n.v2i") returned 0x0 [0045.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.730] lstrlenW (lpString=".sql") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".sql") returned 0x0 [0045.730] lstrlenW (lpString=".mdf") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".mdf") returned 0x0 [0045.730] lstrlenW (lpString=".txt") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".txt") returned 0x0 [0045.730] lstrlenW (lpString=".dbf") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".dbf") returned 0x0 [0045.730] lstrlenW (lpString=".ckp") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".ckp") returned 0x0 [0045.730] lstrlenW (lpString=".dacpac") returned 7 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".dacpac") returned 0x0 [0045.730] lstrlenW (lpString=".db3") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".db3") returned 0x0 [0045.730] lstrlenW (lpString=".dtxs") returned 5 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".dtxs") returned 0x0 [0045.730] lstrlenW (lpString=".mdt") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".mdt") returned 0x0 [0045.730] lstrlenW (lpString=".sdf") returned 4 [0045.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".sdf") returned 0x0 [0045.730] lstrlenW (lpString=".MDF") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".MDF") returned 0x0 [0045.731] lstrlenW (lpString=".DBF") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".DBF") returned 0x0 [0045.731] lstrlenW (lpString=".DB") returned 3 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".DB") returned 0x0 [0045.731] lstrlenW (lpString=".db") returned 3 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".db") returned 0x0 [0045.731] lstrlenW (lpString=".ndf") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".ndf") returned 0x0 [0045.731] lstrlenW (lpString=".NDF") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".NDF") returned 0x0 [0045.731] lstrlenW (lpString=".Mdf") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".Mdf") returned 0x0 [0045.731] lstrlenW (lpString=".dat") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".dat") returned 0x0 [0045.731] lstrlenW (lpString=".DAT") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".DAT") returned 0x0 [0045.731] lstrlenW (lpString=".ldf") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".ldf") returned 0x0 [0045.731] lstrlenW (lpString=".LDF") returned 4 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch=".LDF") returned 0x0 [0045.731] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.731] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.732] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.732] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.733] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16573368062) returned 1 [0045.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa1209b0, dwHighDateTime=0x1d585b4)) [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ec48 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ec48 | out: hHeap=0x260000) returned 1 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0045.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0045.733] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.733] GetLastError () returned 0x0 [0045.733] GetLastError () returned 0x0 [0045.733] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.734] GetLastError () returned 0x0 [0045.734] GetLastError () returned 0x0 [0045.736] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff2a61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.736] WriteFile (in: hFile=0xfc, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0xd59f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0xd59f, lpOverlapped=0x0) returned 1 [0045.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.737] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.737] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.737] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.737] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.737] CloseHandle (hObject=0xfc) returned 1 [0045.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.[deadmin@cock.li].deadmin")) returned 1 [0045.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0045.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.738] GetLastError () returned 0x0 [0045.738] RtlWakeConditionVariable () returned 0x27e828 [0045.738] GetCurrentThreadId () returned 0x9ac [0045.738] GetCurrentThreadId () returned 0x9ac [0045.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c990 | out: hHeap=0x260000) returned 1 [0045.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0045.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c990 [0045.738] lstrlenW (lpString=".ldf") returned 4 [0045.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".ldf") returned 0x0 [0045.738] lstrlenW (lpString=".vhd") returned 4 [0045.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".vhd") returned 0x0 [0045.738] lstrlenW (lpString=".vhdx") returned 5 [0045.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".vhdx") returned 0x0 [0045.738] lstrlenW (lpString=".pst") returned 4 [0045.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".pst") returned 0x0 [0045.738] lstrlenW (lpString=".ost") returned 4 [0045.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".ost") returned 0x0 [0045.739] lstrlenW (lpString=".bak") returned 4 [0045.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".bak") returned 0x0 [0045.739] lstrlenW (lpString=".bac") returned 4 [0045.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".bac") returned 0x0 [0045.739] lstrlenW (lpString=".sys") returned 4 [0045.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".sys") returned 0x0 [0045.739] lstrlenW (lpString=".v2i") returned 4 [0045.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".v2i") returned 0x0 [0045.739] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch="s\r\n.v2i") returned 0x0 [0045.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.741] lstrlenW (lpString=".sql") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".sql") returned 0x0 [0045.741] lstrlenW (lpString=".mdf") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".mdf") returned 0x0 [0045.741] lstrlenW (lpString=".txt") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".txt") returned 0x0 [0045.741] lstrlenW (lpString=".dbf") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".dbf") returned 0x0 [0045.741] lstrlenW (lpString=".ckp") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".ckp") returned 0x0 [0045.741] lstrlenW (lpString=".dacpac") returned 7 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".dacpac") returned 0x0 [0045.741] lstrlenW (lpString=".db3") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".db3") returned 0x0 [0045.741] lstrlenW (lpString=".dtxs") returned 5 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".dtxs") returned 0x0 [0045.741] lstrlenW (lpString=".mdt") returned 4 [0045.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".mdt") returned 0x0 [0045.742] lstrlenW (lpString=".sdf") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".sdf") returned 0x0 [0045.742] lstrlenW (lpString=".MDF") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".MDF") returned 0x0 [0045.742] lstrlenW (lpString=".DBF") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".DBF") returned 0x0 [0045.742] lstrlenW (lpString=".DB") returned 3 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".DB") returned 0x0 [0045.742] lstrlenW (lpString=".db") returned 3 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".db") returned 0x0 [0045.742] lstrlenW (lpString=".ndf") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".ndf") returned 0x0 [0045.742] lstrlenW (lpString=".NDF") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".NDF") returned 0x0 [0045.742] lstrlenW (lpString=".Mdf") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".Mdf") returned 0x0 [0045.742] lstrlenW (lpString=".dat") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".dat") returned 0x0 [0045.742] lstrlenW (lpString=".DAT") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".DAT") returned 0x0 [0045.742] lstrlenW (lpString=".ldf") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".ldf") returned 0x0 [0045.742] lstrlenW (lpString=".LDF") returned 4 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch=".LDF") returned 0x0 [0045.742] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.742] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.743] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.743] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.743] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16574450802) returned 1 [0045.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa146b10, dwHighDateTime=0x1d585b4)) [0045.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e08 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e08 | out: hHeap=0x260000) returned 1 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6360 [0045.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0045.744] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.744] GetLastError () returned 0x0 [0045.744] GetLastError () returned 0x0 [0045.744] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.744] GetLastError () returned 0x0 [0045.744] GetLastError () returned 0x0 [0045.745] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffd8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.745] WriteFile (in: hFile=0xfc, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x271, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x271, lpOverlapped=0x0) returned 1 [0045.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.746] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.746] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.746] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.746] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.746] CloseHandle (hObject=0xfc) returned 1 [0045.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.[deadmin@cock.li].deadmin")) returned 1 [0045.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0045.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.748] GetLastError () returned 0x0 [0045.748] RtlWakeConditionVariable () returned 0x27e828 [0045.748] GetCurrentThreadId () returned 0x9ac [0045.749] GetCurrentThreadId () returned 0x9ac [0045.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0045.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0045.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0045.749] lstrlenW (lpString=".ldf") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.749] lstrlenW (lpString=".vhd") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".vhd") returned 0x0 [0045.749] lstrlenW (lpString=".vhdx") returned 5 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".vhdx") returned 0x0 [0045.749] lstrlenW (lpString=".pst") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".pst") returned 0x0 [0045.749] lstrlenW (lpString=".ost") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".ost") returned 0x0 [0045.749] lstrlenW (lpString=".bak") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".bak") returned 0x0 [0045.749] lstrlenW (lpString=".bac") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".bac") returned 0x0 [0045.749] lstrlenW (lpString=".sys") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".sys") returned 0x0 [0045.749] lstrlenW (lpString=".v2i") returned 4 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".v2i") returned 0x0 [0045.749] lstrlenW (lpString="s\r\n.v2i") returned 7 [0045.749] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch="s\r\n.v2i") returned 0x0 [0045.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0045.750] lstrlenW (lpString=".sql") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".sql") returned 0x0 [0045.750] lstrlenW (lpString=".mdf") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".mdf") returned 0x0 [0045.750] lstrlenW (lpString=".txt") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".txt") returned 0x0 [0045.750] lstrlenW (lpString=".dbf") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".dbf") returned 0x0 [0045.750] lstrlenW (lpString=".ckp") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".ckp") returned 0x0 [0045.750] lstrlenW (lpString=".dacpac") returned 7 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".dacpac") returned 0x0 [0045.750] lstrlenW (lpString=".db3") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".db3") returned 0x0 [0045.750] lstrlenW (lpString=".dtxs") returned 5 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".dtxs") returned 0x0 [0045.750] lstrlenW (lpString=".mdt") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".mdt") returned 0x0 [0045.750] lstrlenW (lpString=".sdf") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".sdf") returned 0x0 [0045.750] lstrlenW (lpString=".MDF") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".MDF") returned 0x0 [0045.750] lstrlenW (lpString=".DBF") returned 4 [0045.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".DBF") returned 0x0 [0045.751] lstrlenW (lpString=".DB") returned 3 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".DB") returned 0x0 [0045.751] lstrlenW (lpString=".db") returned 3 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".db") returned 0x0 [0045.751] lstrlenW (lpString=".ndf") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".ndf") returned 0x0 [0045.751] lstrlenW (lpString=".NDF") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".NDF") returned 0x0 [0045.751] lstrlenW (lpString=".Mdf") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".Mdf") returned 0x0 [0045.751] lstrlenW (lpString=".dat") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".dat") returned 0x0 [0045.751] lstrlenW (lpString=".DAT") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".DAT") returned 0x0 [0045.751] lstrlenW (lpString=".ldf") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".ldf") returned 0x0 [0045.751] lstrlenW (lpString=".LDF") returned 4 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch=".LDF") returned 0x0 [0045.751] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0045.751] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0045.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x27d070 [0045.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0045.751] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0045.752] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0045.752] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0045.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x2f04d8 [0045.752] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16575320141) returned 1 [0045.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa146b10, dwHighDateTime=0x1d585b4)) [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e40 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0045.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e40 | out: hHeap=0x260000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0045.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2f6360 [0045.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0045.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f6360 | out: hHeap=0x260000) returned 1 [0045.753] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0045.753] GetLastError () returned 0x0 [0045.753] GetLastError () returned 0x0 [0045.753] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0045.753] GetLastError () returned 0x0 [0045.753] GetLastError () returned 0x0 [0045.796] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff7d39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.796] WriteFile (in: hFile=0xfc, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x82c7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x82c7, lpOverlapped=0x0) returned 1 [0045.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0045.799] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.799] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0045.799] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0045.799] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0045.799] CloseHandle (hObject=0xfc) returned 1 [0045.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x316238 [0045.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.[deadmin@cock.li].deadmin")) returned 1 [0045.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x316238 | out: hHeap=0x260000) returned 1 [0045.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0045.800] GetLastError () returned 0x0 [0045.800] RtlWakeConditionVariable () returned 0x27e828 [0045.800] GetCurrentThreadId () returned 0x9ac [0045.800] GetCurrentThreadId () returned 0x9ac [0045.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca0 | out: hHeap=0x260000) returned 1 [0045.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0045.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ca0 [0045.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0045.914] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.914] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0045.914] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0045.914] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0045.915] CloseHandle (hObject=0x104) returned 1 [0045.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca0 | out: hHeap=0x260000) returned 1 [0045.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0045.915] RtlWakeConditionVariable () returned 0x27e828 [0045.915] GetCurrentThreadId () returned 0x9ac [0045.915] GetCurrentThreadId () returned 0x9ac [0045.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f92b0 | out: hHeap=0x260000) returned 1 [0045.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1aa0 | out: hHeap=0x260000) returned 1 [0045.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f92b0 [0045.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.052] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.052] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.052] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.052] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.080] CloseHandle (hObject=0xf8) returned 1 [0046.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f92b0 | out: hHeap=0x260000) returned 1 [0046.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.080] RtlWakeConditionVariable () returned 0x27e828 [0046.080] GetCurrentThreadId () returned 0x9ac [0046.080] GetCurrentThreadId () returned 0x9ac [0046.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ac08 | out: hHeap=0x260000) returned 1 [0046.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0046.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a038 [0046.090] lstrlenW (lpString=".ldf") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".ldf") returned 0x0 [0046.090] lstrlenW (lpString=".vhd") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".vhd") returned 0x0 [0046.090] lstrlenW (lpString=".vhdx") returned 5 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".vhdx") returned 0x0 [0046.090] lstrlenW (lpString=".pst") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".pst") returned 0x0 [0046.090] lstrlenW (lpString=".ost") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".ost") returned 0x0 [0046.090] lstrlenW (lpString=".bak") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".bak") returned 0x0 [0046.090] lstrlenW (lpString=".bac") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".bac") returned 0x0 [0046.090] lstrlenW (lpString=".sys") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".sys") returned 0x0 [0046.090] lstrlenW (lpString=".v2i") returned 4 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".v2i") returned 0x0 [0046.090] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch="s\r\n.v2i") returned 0x0 [0046.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.096] lstrlenW (lpString=".sql") returned 4 [0046.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".sql") returned 0x0 [0046.104] lstrlenW (lpString=".mdf") returned 4 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".mdf") returned 0x0 [0046.104] lstrlenW (lpString=".txt") returned 4 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".txt") returned 0x0 [0046.104] lstrlenW (lpString=".dbf") returned 4 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".dbf") returned 0x0 [0046.104] lstrlenW (lpString=".ckp") returned 4 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".ckp") returned 0x0 [0046.104] lstrlenW (lpString=".dacpac") returned 7 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".dacpac") returned 0x0 [0046.104] lstrlenW (lpString=".db3") returned 4 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".db3") returned 0x0 [0046.104] lstrlenW (lpString=".dtxs") returned 5 [0046.104] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".dtxs") returned 0x0 [0046.104] lstrlenW (lpString=".mdt") returned 4 [0046.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".mdt") returned 0x0 [0046.110] lstrlenW (lpString=".sdf") returned 4 [0046.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".sdf") returned 0x0 [0046.110] lstrlenW (lpString=".MDF") returned 4 [0046.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".MDF") returned 0x0 [0046.116] lstrlenW (lpString=".DBF") returned 4 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".DBF") returned 0x0 [0046.117] lstrlenW (lpString=".DB") returned 3 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".DB") returned 0x0 [0046.117] lstrlenW (lpString=".db") returned 3 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".db") returned 0x0 [0046.117] lstrlenW (lpString=".ndf") returned 4 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".ndf") returned 0x0 [0046.117] lstrlenW (lpString=".NDF") returned 4 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".NDF") returned 0x0 [0046.117] lstrlenW (lpString=".Mdf") returned 4 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".Mdf") returned 0x0 [0046.117] lstrlenW (lpString=".dat") returned 4 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".dat") returned 0x0 [0046.117] lstrlenW (lpString=".DAT") returned 4 [0046.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".DAT") returned 0x0 [0046.124] lstrlenW (lpString=".ldf") returned 4 [0046.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".ldf") returned 0x0 [0046.125] lstrlenW (lpString=".LDF") returned 4 [0046.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch=".LDF") returned 0x0 [0046.125] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.125] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3351e0) returned 1 [0046.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.126] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.126] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16612694711) returned 1 [0046.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa4d8c10, dwHighDateTime=0x1d585b4)) [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953b8 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953b8 | out: hHeap=0x260000) returned 1 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ad58 [0046.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ad58 | out: hHeap=0x260000) returned 1 [0046.126] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.126] GetLastError () returned 0x0 [0046.127] GetLastError () returned 0x0 [0046.127] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.127] GetLastError () returned 0x0 [0046.127] GetLastError () returned 0x0 [0046.132] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.132] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.133] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.133] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.135] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.135] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.135] CloseHandle (hObject=0xf8) returned 1 [0046.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.[deadmin@cock.li].deadmin")) returned 1 [0046.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.138] GetLastError () returned 0x0 [0046.138] RtlWakeConditionVariable () returned 0x27e828 [0046.138] GetCurrentThreadId () returned 0x9ac [0046.138] GetCurrentThreadId () returned 0x9ac [0046.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aea8 | out: hHeap=0x260000) returned 1 [0046.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0046.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aea8 [0046.138] lstrlenW (lpString=".ldf") returned 4 [0046.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".ldf") returned 0x0 [0046.138] lstrlenW (lpString=".vhd") returned 4 [0046.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".vhd") returned 0x0 [0046.138] lstrlenW (lpString=".vhdx") returned 5 [0046.138] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".vhdx") returned 0x0 [0046.138] lstrlenW (lpString=".pst") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".pst") returned 0x0 [0046.139] lstrlenW (lpString=".ost") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".ost") returned 0x0 [0046.139] lstrlenW (lpString=".bak") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".bak") returned 0x0 [0046.139] lstrlenW (lpString=".bac") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".bac") returned 0x0 [0046.139] lstrlenW (lpString=".sys") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".sys") returned 0x0 [0046.139] lstrlenW (lpString=".v2i") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".v2i") returned 0x0 [0046.139] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.139] lstrlenW (lpString=".sql") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".sql") returned 0x0 [0046.139] lstrlenW (lpString=".mdf") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".mdf") returned 0x0 [0046.139] lstrlenW (lpString=".txt") returned 4 [0046.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".txt") returned 0x0 [0046.139] lstrlenW (lpString=".dbf") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".dbf") returned 0x0 [0046.140] lstrlenW (lpString=".ckp") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".ckp") returned 0x0 [0046.140] lstrlenW (lpString=".dacpac") returned 7 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".dacpac") returned 0x0 [0046.140] lstrlenW (lpString=".db3") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".db3") returned 0x0 [0046.140] lstrlenW (lpString=".dtxs") returned 5 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".dtxs") returned 0x0 [0046.140] lstrlenW (lpString=".mdt") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".mdt") returned 0x0 [0046.140] lstrlenW (lpString=".sdf") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".sdf") returned 0x0 [0046.140] lstrlenW (lpString=".MDF") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".MDF") returned 0x0 [0046.140] lstrlenW (lpString=".DBF") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".DBF") returned 0x0 [0046.140] lstrlenW (lpString=".DB") returned 3 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".DB") returned 0x0 [0046.140] lstrlenW (lpString=".db") returned 3 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".db") returned 0x0 [0046.140] lstrlenW (lpString=".ndf") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".ndf") returned 0x0 [0046.140] lstrlenW (lpString=".NDF") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".NDF") returned 0x0 [0046.140] lstrlenW (lpString=".Mdf") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".Mdf") returned 0x0 [0046.140] lstrlenW (lpString=".dat") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".dat") returned 0x0 [0046.140] lstrlenW (lpString=".DAT") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".DAT") returned 0x0 [0046.140] lstrlenW (lpString=".ldf") returned 4 [0046.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".ldf") returned 0x0 [0046.141] lstrlenW (lpString=".LDF") returned 4 [0046.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch=".LDF") returned 0x0 [0046.141] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.141] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3351e0) returned 1 [0046.141] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.141] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.142] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16614273170) returned 1 [0046.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa4fed70, dwHighDateTime=0x1d585b4)) [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2953f0 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2953f0 | out: hHeap=0x260000) returned 1 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a038 [0046.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a038 | out: hHeap=0x260000) returned 1 [0046.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.142] GetLastError () returned 0x0 [0046.142] GetLastError () returned 0x0 [0046.142] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.142] GetLastError () returned 0x0 [0046.143] GetLastError () returned 0x0 [0046.146] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.146] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.147] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.147] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.149] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.149] CloseHandle (hObject=0xf8) returned 1 [0046.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.149] GetLastError () returned 0x0 [0046.150] RtlWakeConditionVariable () returned 0x27e828 [0046.150] GetCurrentThreadId () returned 0x9ac [0046.150] GetCurrentThreadId () returned 0x9ac [0046.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31af50 | out: hHeap=0x260000) returned 1 [0046.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0046.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31af50 [0046.150] lstrlenW (lpString=".ldf") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".ldf") returned 0x0 [0046.150] lstrlenW (lpString=".vhd") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".vhd") returned 0x0 [0046.150] lstrlenW (lpString=".vhdx") returned 5 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".vhdx") returned 0x0 [0046.150] lstrlenW (lpString=".pst") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".pst") returned 0x0 [0046.150] lstrlenW (lpString=".ost") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".ost") returned 0x0 [0046.150] lstrlenW (lpString=".bak") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".bak") returned 0x0 [0046.150] lstrlenW (lpString=".bac") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".bac") returned 0x0 [0046.150] lstrlenW (lpString=".sys") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".sys") returned 0x0 [0046.150] lstrlenW (lpString=".v2i") returned 4 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".v2i") returned 0x0 [0046.150] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.151] lstrlenW (lpString=".sql") returned 4 [0046.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".sql") returned 0x0 [0046.151] lstrlenW (lpString=".mdf") returned 4 [0046.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".mdf") returned 0x0 [0046.151] lstrlenW (lpString=".txt") returned 4 [0046.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".txt") returned 0x0 [0046.151] lstrlenW (lpString=".dbf") returned 4 [0046.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".dbf") returned 0x0 [0046.152] lstrlenW (lpString=".ckp") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".ckp") returned 0x0 [0046.152] lstrlenW (lpString=".dacpac") returned 7 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".dacpac") returned 0x0 [0046.152] lstrlenW (lpString=".db3") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".db3") returned 0x0 [0046.152] lstrlenW (lpString=".dtxs") returned 5 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".dtxs") returned 0x0 [0046.152] lstrlenW (lpString=".mdt") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".mdt") returned 0x0 [0046.152] lstrlenW (lpString=".sdf") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".sdf") returned 0x0 [0046.152] lstrlenW (lpString=".MDF") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".MDF") returned 0x0 [0046.152] lstrlenW (lpString=".DBF") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".DBF") returned 0x0 [0046.152] lstrlenW (lpString=".DB") returned 3 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".DB") returned 0x0 [0046.152] lstrlenW (lpString=".db") returned 3 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".db") returned 0x0 [0046.152] lstrlenW (lpString=".ndf") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".ndf") returned 0x0 [0046.152] lstrlenW (lpString=".NDF") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".NDF") returned 0x0 [0046.152] lstrlenW (lpString=".Mdf") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".Mdf") returned 0x0 [0046.152] lstrlenW (lpString=".dat") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".dat") returned 0x0 [0046.152] lstrlenW (lpString=".DAT") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".DAT") returned 0x0 [0046.152] lstrlenW (lpString=".ldf") returned 4 [0046.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".ldf") returned 0x0 [0046.152] lstrlenW (lpString=".LDF") returned 4 [0046.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch=".LDF") returned 0x0 [0046.153] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.153] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3351e0) returned 1 [0046.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.153] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.154] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16615471327) returned 1 [0046.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa524ed0, dwHighDateTime=0x1d585b4)) [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295118 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295118 | out: hHeap=0x260000) returned 1 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aea8 [0046.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aea8 | out: hHeap=0x260000) returned 1 [0046.154] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.154] GetLastError () returned 0x0 [0046.154] GetLastError () returned 0x0 [0046.154] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.154] GetLastError () returned 0x0 [0046.155] GetLastError () returned 0x0 [0046.157] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffeec70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.157] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x11390, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x11390, lpOverlapped=0x0) returned 1 [0046.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.157] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.157] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.157] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.157] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.157] CloseHandle (hObject=0xf8) returned 1 [0046.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.158] GetLastError () returned 0x0 [0046.158] RtlWakeConditionVariable () returned 0x27e828 [0046.158] GetCurrentThreadId () returned 0x9ac [0046.158] GetCurrentThreadId () returned 0x9ac [0046.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aff8 | out: hHeap=0x260000) returned 1 [0046.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0046.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aff8 [0046.159] lstrlenW (lpString=".ldf") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".ldf") returned 0x0 [0046.159] lstrlenW (lpString=".vhd") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".vhd") returned 0x0 [0046.159] lstrlenW (lpString=".vhdx") returned 5 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".vhdx") returned 0x0 [0046.159] lstrlenW (lpString=".pst") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".pst") returned 0x0 [0046.159] lstrlenW (lpString=".ost") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".ost") returned 0x0 [0046.159] lstrlenW (lpString=".bak") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".bak") returned 0x0 [0046.159] lstrlenW (lpString=".bac") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".bac") returned 0x0 [0046.159] lstrlenW (lpString=".sys") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".sys") returned 0x0 [0046.159] lstrlenW (lpString=".v2i") returned 4 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".v2i") returned 0x0 [0046.159] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.160] lstrlenW (lpString=".sql") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".sql") returned 0x0 [0046.160] lstrlenW (lpString=".mdf") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".mdf") returned 0x0 [0046.160] lstrlenW (lpString=".txt") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".txt") returned 0x0 [0046.160] lstrlenW (lpString=".dbf") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".dbf") returned 0x0 [0046.160] lstrlenW (lpString=".ckp") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".ckp") returned 0x0 [0046.160] lstrlenW (lpString=".dacpac") returned 7 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".dacpac") returned 0x0 [0046.160] lstrlenW (lpString=".db3") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".db3") returned 0x0 [0046.160] lstrlenW (lpString=".dtxs") returned 5 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".dtxs") returned 0x0 [0046.160] lstrlenW (lpString=".mdt") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".mdt") returned 0x0 [0046.160] lstrlenW (lpString=".sdf") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".sdf") returned 0x0 [0046.160] lstrlenW (lpString=".MDF") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".MDF") returned 0x0 [0046.160] lstrlenW (lpString=".DBF") returned 4 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".DBF") returned 0x0 [0046.160] lstrlenW (lpString=".DB") returned 3 [0046.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".DB") returned 0x0 [0046.160] lstrlenW (lpString=".db") returned 3 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".db") returned 0x0 [0046.161] lstrlenW (lpString=".ndf") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".ndf") returned 0x0 [0046.161] lstrlenW (lpString=".NDF") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".NDF") returned 0x0 [0046.161] lstrlenW (lpString=".Mdf") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".Mdf") returned 0x0 [0046.161] lstrlenW (lpString=".dat") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".dat") returned 0x0 [0046.161] lstrlenW (lpString=".DAT") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".DAT") returned 0x0 [0046.161] lstrlenW (lpString=".ldf") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".ldf") returned 0x0 [0046.161] lstrlenW (lpString=".LDF") returned 4 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch=".LDF") returned 0x0 [0046.161] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.161] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3351e0) returned 1 [0046.162] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.162] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.162] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16616310866) returned 1 [0046.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa54b030, dwHighDateTime=0x1d585b4)) [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294eb0 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294eb0 | out: hHeap=0x260000) returned 1 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31af50 [0046.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31af50 | out: hHeap=0x260000) returned 1 [0046.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.163] GetLastError () returned 0x0 [0046.163] GetLastError () returned 0x0 [0046.163] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.163] GetLastError () returned 0x0 [0046.163] GetLastError () returned 0x0 [0046.165] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.165] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.167] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.167] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.167] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.167] CloseHandle (hObject=0xf8) returned 1 [0046.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.168] GetLastError () returned 0x0 [0046.168] RtlWakeConditionVariable () returned 0x27e828 [0046.168] GetCurrentThreadId () returned 0x9ac [0046.168] GetCurrentThreadId () returned 0x9ac [0046.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29be10 | out: hHeap=0x260000) returned 1 [0046.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294f90 | out: hHeap=0x260000) returned 1 [0046.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29be10 [0046.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.168] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.169] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.169] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.169] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.170] CloseHandle (hObject=0xf8) returned 1 [0046.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29be10 | out: hHeap=0x260000) returned 1 [0046.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0046.170] RtlWakeConditionVariable () returned 0x27e828 [0046.170] GetCurrentThreadId () returned 0x9ac [0046.170] GetCurrentThreadId () returned 0x9ac [0046.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0046.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9b48 | out: hHeap=0x260000) returned 1 [0046.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294fc8 | out: hHeap=0x260000) returned 1 [0046.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9b48 [0046.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.170] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.170] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.170] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.171] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.172] CloseHandle (hObject=0xf8) returned 1 [0046.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9b48 | out: hHeap=0x260000) returned 1 [0046.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daab0 | out: hHeap=0x260000) returned 1 [0046.172] RtlWakeConditionVariable () returned 0x27e828 [0046.172] GetCurrentThreadId () returned 0x9ac [0046.172] GetCurrentThreadId () returned 0x9ac [0046.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b908 | out: hHeap=0x260000) returned 1 [0046.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b10 | out: hHeap=0x260000) returned 1 [0046.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b908 [0046.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.172] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.173] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.173] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.173] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.173] CloseHandle (hObject=0xf8) returned 1 [0046.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b908 | out: hHeap=0x260000) returned 1 [0046.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0046.174] RtlWakeConditionVariable () returned 0x27e828 [0046.174] GetCurrentThreadId () returned 0x9ac [0046.174] GetCurrentThreadId () returned 0x9ac [0046.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0046.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b0a0 [0046.174] lstrlenW (lpString=".ldf") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".ldf") returned 0x0 [0046.174] lstrlenW (lpString=".vhd") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".vhd") returned 0x0 [0046.174] lstrlenW (lpString=".vhdx") returned 5 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".vhdx") returned 0x0 [0046.174] lstrlenW (lpString=".pst") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".pst") returned 0x0 [0046.174] lstrlenW (lpString=".ost") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".ost") returned 0x0 [0046.174] lstrlenW (lpString=".bak") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".bak") returned 0x0 [0046.174] lstrlenW (lpString=".bac") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".bac") returned 0x0 [0046.174] lstrlenW (lpString=".sys") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".sys") returned 0x0 [0046.174] lstrlenW (lpString=".v2i") returned 4 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".v2i") returned 0x0 [0046.174] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.175] lstrlenW (lpString=".sql") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".sql") returned 0x0 [0046.176] lstrlenW (lpString=".mdf") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".mdf") returned 0x0 [0046.176] lstrlenW (lpString=".txt") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".txt") returned 0x0 [0046.176] lstrlenW (lpString=".dbf") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".dbf") returned 0x0 [0046.176] lstrlenW (lpString=".ckp") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".ckp") returned 0x0 [0046.176] lstrlenW (lpString=".dacpac") returned 7 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".dacpac") returned 0x0 [0046.176] lstrlenW (lpString=".db3") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".db3") returned 0x0 [0046.176] lstrlenW (lpString=".dtxs") returned 5 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".dtxs") returned 0x0 [0046.176] lstrlenW (lpString=".mdt") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".mdt") returned 0x0 [0046.176] lstrlenW (lpString=".sdf") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".sdf") returned 0x0 [0046.176] lstrlenW (lpString=".MDF") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".MDF") returned 0x0 [0046.176] lstrlenW (lpString=".DBF") returned 4 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".DBF") returned 0x0 [0046.176] lstrlenW (lpString=".DB") returned 3 [0046.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".DB") returned 0x0 [0046.177] lstrlenW (lpString=".db") returned 3 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".db") returned 0x0 [0046.177] lstrlenW (lpString=".ndf") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".ndf") returned 0x0 [0046.177] lstrlenW (lpString=".NDF") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".NDF") returned 0x0 [0046.177] lstrlenW (lpString=".Mdf") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".Mdf") returned 0x0 [0046.177] lstrlenW (lpString=".dat") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".dat") returned 0x0 [0046.177] lstrlenW (lpString=".DAT") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".DAT") returned 0x0 [0046.177] lstrlenW (lpString=".ldf") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".ldf") returned 0x0 [0046.177] lstrlenW (lpString=".LDF") returned 4 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch=".LDF") returned 0x0 [0046.177] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.177] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3351e0) returned 1 [0046.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.178] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.178] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16617917961) returned 1 [0046.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa571190, dwHighDateTime=0x1d585b4)) [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294aa0 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294aa0 | out: hHeap=0x260000) returned 1 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aff8 [0046.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aff8 | out: hHeap=0x260000) returned 1 [0046.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.179] GetLastError () returned 0x0 [0046.179] GetLastError () returned 0x0 [0046.179] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.179] GetLastError () returned 0x0 [0046.179] GetLastError () returned 0x0 [0046.183] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.183] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.184] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.184] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.185] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.185] CloseHandle (hObject=0xf8) returned 1 [0046.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.186] GetLastError () returned 0x0 [0046.186] RtlWakeConditionVariable () returned 0x27e828 [0046.186] GetCurrentThreadId () returned 0x9ac [0046.186] GetCurrentThreadId () returned 0x9ac [0046.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b148 | out: hHeap=0x260000) returned 1 [0046.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0046.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b148 [0046.186] lstrlenW (lpString=".ldf") returned 4 [0046.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".ldf") returned 0x0 [0046.186] lstrlenW (lpString=".vhd") returned 4 [0046.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".vhd") returned 0x0 [0046.186] lstrlenW (lpString=".vhdx") returned 5 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".vhdx") returned 0x0 [0046.187] lstrlenW (lpString=".pst") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".pst") returned 0x0 [0046.187] lstrlenW (lpString=".ost") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".ost") returned 0x0 [0046.187] lstrlenW (lpString=".bak") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".bak") returned 0x0 [0046.187] lstrlenW (lpString=".bac") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".bac") returned 0x0 [0046.187] lstrlenW (lpString=".sys") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".sys") returned 0x0 [0046.187] lstrlenW (lpString=".v2i") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".v2i") returned 0x0 [0046.187] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0046.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.187] lstrlenW (lpString=".sql") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".sql") returned 0x0 [0046.187] lstrlenW (lpString=".mdf") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".mdf") returned 0x0 [0046.187] lstrlenW (lpString=".txt") returned 4 [0046.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".txt") returned 0x0 [0046.188] lstrlenW (lpString=".dbf") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".dbf") returned 0x0 [0046.188] lstrlenW (lpString=".ckp") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".ckp") returned 0x0 [0046.188] lstrlenW (lpString=".dacpac") returned 7 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".dacpac") returned 0x0 [0046.188] lstrlenW (lpString=".db3") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".db3") returned 0x0 [0046.188] lstrlenW (lpString=".dtxs") returned 5 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".dtxs") returned 0x0 [0046.188] lstrlenW (lpString=".mdt") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".mdt") returned 0x0 [0046.188] lstrlenW (lpString=".sdf") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".sdf") returned 0x0 [0046.188] lstrlenW (lpString=".MDF") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".MDF") returned 0x0 [0046.188] lstrlenW (lpString=".DBF") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".DBF") returned 0x0 [0046.188] lstrlenW (lpString=".DB") returned 3 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".DB") returned 0x0 [0046.188] lstrlenW (lpString=".db") returned 3 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".db") returned 0x0 [0046.188] lstrlenW (lpString=".ndf") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".ndf") returned 0x0 [0046.188] lstrlenW (lpString=".NDF") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".NDF") returned 0x0 [0046.188] lstrlenW (lpString=".Mdf") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".Mdf") returned 0x0 [0046.188] lstrlenW (lpString=".dat") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".dat") returned 0x0 [0046.188] lstrlenW (lpString=".DAT") returned 4 [0046.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".DAT") returned 0x0 [0046.188] lstrlenW (lpString=".ldf") returned 4 [0046.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".ldf") returned 0x0 [0046.189] lstrlenW (lpString=".LDF") returned 4 [0046.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch=".LDF") returned 0x0 [0046.189] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b2d90 [0046.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.189] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3351e0) returned 1 [0046.189] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.189] CryptReleaseContext (hProv=0x3351e0, dwFlags=0x0) returned 1 [0046.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.190] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16619075701) returned 1 [0046.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa571190, dwHighDateTime=0x1d585b4)) [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949c0 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.190] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.190] GetLastError () returned 0x0 [0046.190] GetLastError () returned 0x0 [0046.190] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.190] GetLastError () returned 0x0 [0046.191] GetLastError () returned 0x0 [0046.193] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.193] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0046.194] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.194] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.194] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.194] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.194] CloseHandle (hObject=0xf8) returned 1 [0046.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.[deadmin@cock.li].deadmin")) returned 1 [0046.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.195] GetLastError () returned 0x0 [0046.195] RtlWakeConditionVariable () returned 0x27e828 [0046.195] GetCurrentThreadId () returned 0x9ac [0046.195] GetCurrentThreadId () returned 0x9ac [0046.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31aab8 [0046.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b1f0 | out: hHeap=0x260000) returned 1 [0046.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0046.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b1f0 [0046.195] lstrlenW (lpString=".ldf") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".ldf") returned 0x0 [0046.195] lstrlenW (lpString=".vhd") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".vhd") returned 0x0 [0046.195] lstrlenW (lpString=".vhdx") returned 5 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".vhdx") returned 0x0 [0046.195] lstrlenW (lpString=".pst") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".pst") returned 0x0 [0046.195] lstrlenW (lpString=".ost") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".ost") returned 0x0 [0046.195] lstrlenW (lpString=".bak") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".bak") returned 0x0 [0046.195] lstrlenW (lpString=".bac") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".bac") returned 0x0 [0046.195] lstrlenW (lpString=".sys") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".sys") returned 0x0 [0046.195] lstrlenW (lpString=".v2i") returned 4 [0046.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".v2i") returned 0x0 [0046.196] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0046.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.265] lstrlenW (lpString=".sql") returned 4 [0046.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".sql") returned 0x0 [0046.265] lstrlenW (lpString=".mdf") returned 4 [0046.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".mdf") returned 0x0 [0046.265] lstrlenW (lpString=".txt") returned 4 [0046.265] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".txt") returned 0x0 [0046.265] lstrlenW (lpString=".dbf") returned 4 [0046.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".dbf") returned 0x0 [0046.268] lstrlenW (lpString=".ckp") returned 4 [0046.268] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".ckp") returned 0x0 [0046.268] lstrlenW (lpString=".dacpac") returned 7 [0046.274] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".dacpac") returned 0x0 [0046.279] lstrlenW (lpString=".db3") returned 4 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".db3") returned 0x0 [0046.279] lstrlenW (lpString=".dtxs") returned 5 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".dtxs") returned 0x0 [0046.279] lstrlenW (lpString=".mdt") returned 4 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".mdt") returned 0x0 [0046.279] lstrlenW (lpString=".sdf") returned 4 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".sdf") returned 0x0 [0046.279] lstrlenW (lpString=".MDF") returned 4 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".MDF") returned 0x0 [0046.279] lstrlenW (lpString=".DBF") returned 4 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".DBF") returned 0x0 [0046.279] lstrlenW (lpString=".DB") returned 3 [0046.279] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".DB") returned 0x0 [0046.279] lstrlenW (lpString=".db") returned 3 [0046.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".db") returned 0x0 [0046.282] lstrlenW (lpString=".ndf") returned 4 [0046.282] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".ndf") returned 0x0 [0046.289] lstrlenW (lpString=".NDF") returned 4 [0046.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".NDF") returned 0x0 [0046.289] lstrlenW (lpString=".Mdf") returned 4 [0046.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".Mdf") returned 0x0 [0046.289] lstrlenW (lpString=".dat") returned 4 [0046.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".dat") returned 0x0 [0046.289] lstrlenW (lpString=".DAT") returned 4 [0046.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".DAT") returned 0x0 [0046.290] lstrlenW (lpString=".ldf") returned 4 [0046.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".ldf") returned 0x0 [0046.290] lstrlenW (lpString=".LDF") returned 4 [0046.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch=".LDF") returned 0x0 [0046.290] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.290] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.291] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.291] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.291] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16629201692) returned 1 [0046.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa67bb30, dwHighDateTime=0x1d585b4)) [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d75f8 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d75f8 | out: hHeap=0x260000) returned 1 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0046.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0046.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.291] GetLastError () returned 0x0 [0046.292] GetLastError () returned 0x0 [0046.292] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.292] GetLastError () returned 0x0 [0046.292] GetLastError () returned 0x0 [0046.296] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.296] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.297] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.297] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.297] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.297] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.297] CloseHandle (hObject=0xf8) returned 1 [0046.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.[deadmin@cock.li].deadmin")) returned 1 [0046.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.298] GetLastError () returned 0x0 [0046.298] RtlWakeConditionVariable () returned 0x27e828 [0046.298] GetCurrentThreadId () returned 0x9ac [0046.298] GetCurrentThreadId () returned 0x9ac [0046.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0046.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7630 | out: hHeap=0x260000) returned 1 [0046.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0046.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.298] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.298] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.298] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.298] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.299] CloseHandle (hObject=0xf8) returned 1 [0046.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0046.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0046.299] RtlWakeConditionVariable () returned 0x27e828 [0046.299] GetCurrentThreadId () returned 0x9ac [0046.299] GetCurrentThreadId () returned 0x9ac [0046.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310b80 | out: hHeap=0x260000) returned 1 [0046.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7668 | out: hHeap=0x260000) returned 1 [0046.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310b80 [0046.300] lstrlenW (lpString=".ldf") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".ldf") returned 0x0 [0046.300] lstrlenW (lpString=".vhd") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".vhd") returned 0x0 [0046.300] lstrlenW (lpString=".vhdx") returned 5 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".vhdx") returned 0x0 [0046.300] lstrlenW (lpString=".pst") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".pst") returned 0x0 [0046.300] lstrlenW (lpString=".ost") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".ost") returned 0x0 [0046.300] lstrlenW (lpString=".bak") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".bak") returned 0x0 [0046.300] lstrlenW (lpString=".bac") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".bac") returned 0x0 [0046.300] lstrlenW (lpString=".sys") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".sys") returned 0x0 [0046.300] lstrlenW (lpString=".v2i") returned 4 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch=".v2i") returned 0x0 [0046.300] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310b80 | out: hHeap=0x260000) returned 1 [0046.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310af8 | out: hHeap=0x260000) returned 1 [0046.303] RtlWakeConditionVariable () returned 0x27e828 [0046.303] GetCurrentThreadId () returned 0x9ac [0046.303] GetCurrentThreadId () returned 0x9ac [0046.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29aef8 | out: hHeap=0x260000) returned 1 [0046.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76a0 | out: hHeap=0x260000) returned 1 [0046.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29aef8 [0046.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.303] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.303] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.304] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.304] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.304] CloseHandle (hObject=0xf8) returned 1 [0046.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29aef8 | out: hHeap=0x260000) returned 1 [0046.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c6b0 | out: hHeap=0x260000) returned 1 [0046.305] RtlWakeConditionVariable () returned 0x27e828 [0046.305] GetCurrentThreadId () returned 0x9ac [0046.305] GetCurrentThreadId () returned 0x9ac [0046.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c768 | out: hHeap=0x260000) returned 1 [0046.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76d8 | out: hHeap=0x260000) returned 1 [0046.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0046.305] lstrlenW (lpString=".ldf") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".ldf") returned 0x0 [0046.305] lstrlenW (lpString=".vhd") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".vhd") returned 0x0 [0046.305] lstrlenW (lpString=".vhdx") returned 5 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".vhdx") returned 0x0 [0046.305] lstrlenW (lpString=".pst") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".pst") returned 0x0 [0046.305] lstrlenW (lpString=".ost") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".ost") returned 0x0 [0046.305] lstrlenW (lpString=".bak") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".bak") returned 0x0 [0046.305] lstrlenW (lpString=".bac") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".bac") returned 0x0 [0046.305] lstrlenW (lpString=".sys") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".sys") returned 0x0 [0046.305] lstrlenW (lpString=".v2i") returned 4 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".v2i") returned 0x0 [0046.305] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.306] lstrlenW (lpString=".sql") returned 4 [0046.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".sql") returned 0x0 [0046.306] lstrlenW (lpString=".mdf") returned 4 [0046.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".mdf") returned 0x0 [0046.307] lstrlenW (lpString=".txt") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".txt") returned 0x0 [0046.307] lstrlenW (lpString=".dbf") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".dbf") returned 0x0 [0046.307] lstrlenW (lpString=".ckp") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".ckp") returned 0x0 [0046.307] lstrlenW (lpString=".dacpac") returned 7 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".dacpac") returned 0x0 [0046.307] lstrlenW (lpString=".db3") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".db3") returned 0x0 [0046.307] lstrlenW (lpString=".dtxs") returned 5 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".dtxs") returned 0x0 [0046.307] lstrlenW (lpString=".mdt") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".mdt") returned 0x0 [0046.307] lstrlenW (lpString=".sdf") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".sdf") returned 0x0 [0046.307] lstrlenW (lpString=".MDF") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".MDF") returned 0x0 [0046.307] lstrlenW (lpString=".DBF") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".DBF") returned 0x0 [0046.307] lstrlenW (lpString=".DB") returned 3 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".DB") returned 0x0 [0046.307] lstrlenW (lpString=".db") returned 3 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".db") returned 0x0 [0046.307] lstrlenW (lpString=".ndf") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".ndf") returned 0x0 [0046.307] lstrlenW (lpString=".NDF") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".NDF") returned 0x0 [0046.307] lstrlenW (lpString=".Mdf") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".Mdf") returned 0x0 [0046.307] lstrlenW (lpString=".dat") returned 4 [0046.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".dat") returned 0x0 [0046.307] lstrlenW (lpString=".DAT") returned 4 [0046.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".DAT") returned 0x0 [0046.308] lstrlenW (lpString=".ldf") returned 4 [0046.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".ldf") returned 0x0 [0046.308] lstrlenW (lpString=".LDF") returned 4 [0046.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch=".LDF") returned 0x0 [0046.308] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.308] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.308] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.309] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.309] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16630976910) returned 1 [0046.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa6a1c90, dwHighDateTime=0x1d585b4)) [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d76d8 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76d8 | out: hHeap=0x260000) returned 1 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0046.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0046.309] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.309] GetLastError () returned 0x0 [0046.309] GetLastError () returned 0x0 [0046.309] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.309] GetLastError () returned 0x0 [0046.310] GetLastError () returned 0x0 [0046.313] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.313] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.314] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.314] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.315] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.315] CloseHandle (hObject=0xf8) returned 1 [0046.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.316] GetLastError () returned 0x0 [0046.316] RtlWakeConditionVariable () returned 0x27e828 [0046.316] GetCurrentThreadId () returned 0x9ac [0046.316] GetCurrentThreadId () returned 0x9ac [0046.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b6e0 | out: hHeap=0x260000) returned 1 [0046.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7710 | out: hHeap=0x260000) returned 1 [0046.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b6e0 [0046.316] lstrlenW (lpString=".ldf") returned 4 [0046.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".ldf") returned 0x0 [0046.316] lstrlenW (lpString=".vhd") returned 4 [0046.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".vhd") returned 0x0 [0046.316] lstrlenW (lpString=".vhdx") returned 5 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".vhdx") returned 0x0 [0046.317] lstrlenW (lpString=".pst") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".pst") returned 0x0 [0046.317] lstrlenW (lpString=".ost") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".ost") returned 0x0 [0046.317] lstrlenW (lpString=".bak") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".bak") returned 0x0 [0046.317] lstrlenW (lpString=".bac") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".bac") returned 0x0 [0046.317] lstrlenW (lpString=".sys") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".sys") returned 0x0 [0046.317] lstrlenW (lpString=".v2i") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".v2i") returned 0x0 [0046.317] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.317] lstrlenW (lpString=".sql") returned 4 [0046.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".sql") returned 0x0 [0046.317] lstrlenW (lpString=".mdf") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".mdf") returned 0x0 [0046.318] lstrlenW (lpString=".txt") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".txt") returned 0x0 [0046.318] lstrlenW (lpString=".dbf") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".dbf") returned 0x0 [0046.318] lstrlenW (lpString=".ckp") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".ckp") returned 0x0 [0046.318] lstrlenW (lpString=".dacpac") returned 7 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".dacpac") returned 0x0 [0046.318] lstrlenW (lpString=".db3") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".db3") returned 0x0 [0046.318] lstrlenW (lpString=".dtxs") returned 5 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".dtxs") returned 0x0 [0046.318] lstrlenW (lpString=".mdt") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".mdt") returned 0x0 [0046.318] lstrlenW (lpString=".sdf") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".sdf") returned 0x0 [0046.318] lstrlenW (lpString=".MDF") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".MDF") returned 0x0 [0046.318] lstrlenW (lpString=".DBF") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".DBF") returned 0x0 [0046.318] lstrlenW (lpString=".DB") returned 3 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".DB") returned 0x0 [0046.318] lstrlenW (lpString=".db") returned 3 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".db") returned 0x0 [0046.318] lstrlenW (lpString=".ndf") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".ndf") returned 0x0 [0046.318] lstrlenW (lpString=".NDF") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".NDF") returned 0x0 [0046.318] lstrlenW (lpString=".Mdf") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".Mdf") returned 0x0 [0046.318] lstrlenW (lpString=".dat") returned 4 [0046.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".dat") returned 0x0 [0046.318] lstrlenW (lpString=".DAT") returned 4 [0046.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".DAT") returned 0x0 [0046.319] lstrlenW (lpString=".ldf") returned 4 [0046.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".ldf") returned 0x0 [0046.319] lstrlenW (lpString=".LDF") returned 4 [0046.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch=".LDF") returned 0x0 [0046.319] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.319] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.320] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.320] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.320] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16632079529) returned 1 [0046.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa6c7df0, dwHighDateTime=0x1d585b4)) [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7710 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7710 | out: hHeap=0x260000) returned 1 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0046.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0046.320] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.320] GetLastError () returned 0x0 [0046.320] GetLastError () returned 0x0 [0046.320] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.321] GetLastError () returned 0x0 [0046.321] GetLastError () returned 0x0 [0046.323] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.323] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.325] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.325] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.326] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.326] CloseHandle (hObject=0xf8) returned 1 [0046.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.327] GetLastError () returned 0x0 [0046.327] RtlWakeConditionVariable () returned 0x27e828 [0046.327] GetCurrentThreadId () returned 0x9ac [0046.327] GetCurrentThreadId () returned 0x9ac [0046.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edcf0 | out: hHeap=0x260000) returned 1 [0046.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7748 | out: hHeap=0x260000) returned 1 [0046.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edcf0 [0046.327] lstrlenW (lpString=".ldf") returned 4 [0046.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".ldf") returned 0x0 [0046.327] lstrlenW (lpString=".vhd") returned 4 [0046.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".vhd") returned 0x0 [0046.328] lstrlenW (lpString=".vhdx") returned 5 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".vhdx") returned 0x0 [0046.328] lstrlenW (lpString=".pst") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".pst") returned 0x0 [0046.328] lstrlenW (lpString=".ost") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".ost") returned 0x0 [0046.328] lstrlenW (lpString=".bak") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".bak") returned 0x0 [0046.328] lstrlenW (lpString=".bac") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".bac") returned 0x0 [0046.328] lstrlenW (lpString=".sys") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".sys") returned 0x0 [0046.328] lstrlenW (lpString=".v2i") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".v2i") returned 0x0 [0046.328] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.328] lstrlenW (lpString=".sql") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".sql") returned 0x0 [0046.328] lstrlenW (lpString=".mdf") returned 4 [0046.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".mdf") returned 0x0 [0046.329] lstrlenW (lpString=".txt") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".txt") returned 0x0 [0046.329] lstrlenW (lpString=".dbf") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".dbf") returned 0x0 [0046.329] lstrlenW (lpString=".ckp") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".ckp") returned 0x0 [0046.329] lstrlenW (lpString=".dacpac") returned 7 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".dacpac") returned 0x0 [0046.329] lstrlenW (lpString=".db3") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".db3") returned 0x0 [0046.329] lstrlenW (lpString=".dtxs") returned 5 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".dtxs") returned 0x0 [0046.329] lstrlenW (lpString=".mdt") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".mdt") returned 0x0 [0046.329] lstrlenW (lpString=".sdf") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".sdf") returned 0x0 [0046.329] lstrlenW (lpString=".MDF") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".MDF") returned 0x0 [0046.329] lstrlenW (lpString=".DBF") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".DBF") returned 0x0 [0046.329] lstrlenW (lpString=".DB") returned 3 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".DB") returned 0x0 [0046.329] lstrlenW (lpString=".db") returned 3 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".db") returned 0x0 [0046.329] lstrlenW (lpString=".ndf") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".ndf") returned 0x0 [0046.329] lstrlenW (lpString=".NDF") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".NDF") returned 0x0 [0046.329] lstrlenW (lpString=".Mdf") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".Mdf") returned 0x0 [0046.329] lstrlenW (lpString=".dat") returned 4 [0046.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".dat") returned 0x0 [0046.329] lstrlenW (lpString=".DAT") returned 4 [0046.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".DAT") returned 0x0 [0046.330] lstrlenW (lpString=".ldf") returned 4 [0046.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".ldf") returned 0x0 [0046.330] lstrlenW (lpString=".LDF") returned 4 [0046.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch=".LDF") returned 0x0 [0046.330] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0046.330] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0046.331] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x32fae0 [0046.331] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16633179068) returned 1 [0046.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa6c7df0, dwHighDateTime=0x1d585b4)) [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7748 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7748 | out: hHeap=0x260000) returned 1 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31aab8 [0046.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.331] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31aab8 | out: hHeap=0x260000) returned 1 [0046.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.331] GetLastError () returned 0x0 [0046.331] GetLastError () returned 0x0 [0046.331] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.332] GetLastError () returned 0x0 [0046.332] GetLastError () returned 0x0 [0046.364] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.364] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.365] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.365] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.368] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.368] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.368] CloseHandle (hObject=0xf8) returned 1 [0046.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.369] GetLastError () returned 0x0 [0046.369] RtlWakeConditionVariable () returned 0x27e828 [0046.369] GetCurrentThreadId () returned 0x9ac [0046.369] GetCurrentThreadId () returned 0x9ac [0046.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ede60 | out: hHeap=0x260000) returned 1 [0046.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0046.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ede60 [0046.369] lstrlenW (lpString=".ldf") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".ldf") returned 0x0 [0046.369] lstrlenW (lpString=".vhd") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".vhd") returned 0x0 [0046.369] lstrlenW (lpString=".vhdx") returned 5 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".vhdx") returned 0x0 [0046.369] lstrlenW (lpString=".pst") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".pst") returned 0x0 [0046.369] lstrlenW (lpString=".ost") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".ost") returned 0x0 [0046.369] lstrlenW (lpString=".bak") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".bak") returned 0x0 [0046.369] lstrlenW (lpString=".bac") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".bac") returned 0x0 [0046.369] lstrlenW (lpString=".sys") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".sys") returned 0x0 [0046.369] lstrlenW (lpString=".v2i") returned 4 [0046.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".v2i") returned 0x0 [0046.370] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.370] lstrlenW (lpString=".sql") returned 4 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".sql") returned 0x0 [0046.370] lstrlenW (lpString=".mdf") returned 4 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".mdf") returned 0x0 [0046.370] lstrlenW (lpString=".txt") returned 4 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".txt") returned 0x0 [0046.370] lstrlenW (lpString=".dbf") returned 4 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".dbf") returned 0x0 [0046.370] lstrlenW (lpString=".ckp") returned 4 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".ckp") returned 0x0 [0046.370] lstrlenW (lpString=".dacpac") returned 7 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".dacpac") returned 0x0 [0046.370] lstrlenW (lpString=".db3") returned 4 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".db3") returned 0x0 [0046.370] lstrlenW (lpString=".dtxs") returned 5 [0046.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".dtxs") returned 0x0 [0046.370] lstrlenW (lpString=".mdt") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".mdt") returned 0x0 [0046.371] lstrlenW (lpString=".sdf") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".sdf") returned 0x0 [0046.371] lstrlenW (lpString=".MDF") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".MDF") returned 0x0 [0046.371] lstrlenW (lpString=".DBF") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".DBF") returned 0x0 [0046.371] lstrlenW (lpString=".DB") returned 3 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".DB") returned 0x0 [0046.371] lstrlenW (lpString=".db") returned 3 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".db") returned 0x0 [0046.371] lstrlenW (lpString=".ndf") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".ndf") returned 0x0 [0046.371] lstrlenW (lpString=".NDF") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".NDF") returned 0x0 [0046.371] lstrlenW (lpString=".Mdf") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".Mdf") returned 0x0 [0046.371] lstrlenW (lpString=".dat") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".dat") returned 0x0 [0046.371] lstrlenW (lpString=".DAT") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".DAT") returned 0x0 [0046.371] lstrlenW (lpString=".ldf") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".ldf") returned 0x0 [0046.371] lstrlenW (lpString=".LDF") returned 4 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch=".LDF") returned 0x0 [0046.371] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.371] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.372] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.372] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16637341550) returned 1 [0046.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa73a210, dwHighDateTime=0x1d585b4)) [0046.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77b8 [0046.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0046.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.373] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.373] GetLastError () returned 0x0 [0046.373] GetLastError () returned 0x0 [0046.373] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.373] GetLastError () returned 0x0 [0046.373] GetLastError () returned 0x0 [0046.375] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd4ff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.375] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x2b01, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x2b01, lpOverlapped=0x0) returned 1 [0046.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.375] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.375] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.375] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.375] CloseHandle (hObject=0xf8) returned 1 [0046.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.376] GetLastError () returned 0x0 [0046.376] RtlWakeConditionVariable () returned 0x27e828 [0046.376] GetCurrentThreadId () returned 0x9ac [0046.376] GetCurrentThreadId () returned 0x9ac [0046.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b0a0 [0046.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b5e0 | out: hHeap=0x260000) returned 1 [0046.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77f0 | out: hHeap=0x260000) returned 1 [0046.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b5e0 [0046.376] lstrlenW (lpString=".ldf") returned 4 [0046.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".ldf") returned 0x0 [0046.376] lstrlenW (lpString=".vhd") returned 4 [0046.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".vhd") returned 0x0 [0046.376] lstrlenW (lpString=".vhdx") returned 5 [0046.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".vhdx") returned 0x0 [0046.376] lstrlenW (lpString=".pst") returned 4 [0046.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".pst") returned 0x0 [0046.376] lstrlenW (lpString=".ost") returned 4 [0046.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".ost") returned 0x0 [0046.376] lstrlenW (lpString=".bak") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".bak") returned 0x0 [0046.377] lstrlenW (lpString=".bac") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".bac") returned 0x0 [0046.377] lstrlenW (lpString=".sys") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".sys") returned 0x0 [0046.377] lstrlenW (lpString=".v2i") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".v2i") returned 0x0 [0046.377] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch="s\r\n.v2i") returned 0x0 [0046.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.377] lstrlenW (lpString=".sql") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".sql") returned 0x0 [0046.377] lstrlenW (lpString=".mdf") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".mdf") returned 0x0 [0046.377] lstrlenW (lpString=".txt") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".txt") returned 0x0 [0046.377] lstrlenW (lpString=".dbf") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".dbf") returned 0x0 [0046.377] lstrlenW (lpString=".ckp") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".ckp") returned 0x0 [0046.377] lstrlenW (lpString=".dacpac") returned 7 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".dacpac") returned 0x0 [0046.377] lstrlenW (lpString=".db3") returned 4 [0046.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".db3") returned 0x0 [0046.378] lstrlenW (lpString=".dtxs") returned 5 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".dtxs") returned 0x0 [0046.378] lstrlenW (lpString=".mdt") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".mdt") returned 0x0 [0046.378] lstrlenW (lpString=".sdf") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".sdf") returned 0x0 [0046.378] lstrlenW (lpString=".MDF") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".MDF") returned 0x0 [0046.378] lstrlenW (lpString=".DBF") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".DBF") returned 0x0 [0046.378] lstrlenW (lpString=".DB") returned 3 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".DB") returned 0x0 [0046.378] lstrlenW (lpString=".db") returned 3 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".db") returned 0x0 [0046.378] lstrlenW (lpString=".ndf") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".ndf") returned 0x0 [0046.378] lstrlenW (lpString=".NDF") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".NDF") returned 0x0 [0046.378] lstrlenW (lpString=".Mdf") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".Mdf") returned 0x0 [0046.378] lstrlenW (lpString=".dat") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".dat") returned 0x0 [0046.378] lstrlenW (lpString=".DAT") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".DAT") returned 0x0 [0046.378] lstrlenW (lpString=".ldf") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".ldf") returned 0x0 [0046.378] lstrlenW (lpString=".LDF") returned 4 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch=".LDF") returned 0x0 [0046.378] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.378] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.379] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.379] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.380] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16638072417) returned 1 [0046.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa760370, dwHighDateTime=0x1d585b4)) [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77f0 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77f0 | out: hHeap=0x260000) returned 1 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b298 [0046.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b298 | out: hHeap=0x260000) returned 1 [0046.380] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.380] GetLastError () returned 0x0 [0046.380] GetLastError () returned 0x0 [0046.380] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.380] GetLastError () returned 0x0 [0046.381] GetLastError () returned 0x0 [0046.381] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.381] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x146, lpOverlapped=0x0) returned 1 [0046.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.382] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.382] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.382] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.382] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.382] CloseHandle (hObject=0xf8) returned 1 [0046.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.[deadmin@cock.li].deadmin")) returned 1 [0046.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.383] GetLastError () returned 0x0 [0046.383] RtlWakeConditionVariable () returned 0x27e828 [0046.383] GetCurrentThreadId () returned 0x9ac [0046.383] GetCurrentThreadId () returned 0x9ac [0046.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0046.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edf18 [0046.383] lstrlenW (lpString=".ldf") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.383] lstrlenW (lpString=".vhd") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".vhd") returned 0x0 [0046.383] lstrlenW (lpString=".vhdx") returned 5 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".vhdx") returned 0x0 [0046.383] lstrlenW (lpString=".pst") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".pst") returned 0x0 [0046.383] lstrlenW (lpString=".ost") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".ost") returned 0x0 [0046.383] lstrlenW (lpString=".bak") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".bak") returned 0x0 [0046.383] lstrlenW (lpString=".bac") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".bac") returned 0x0 [0046.383] lstrlenW (lpString=".sys") returned 4 [0046.383] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".sys") returned 0x0 [0046.383] lstrlenW (lpString=".v2i") returned 4 [0046.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".v2i") returned 0x0 [0046.384] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.384] lstrlenW (lpString=".sql") returned 4 [0046.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".sql") returned 0x0 [0046.384] lstrlenW (lpString=".mdf") returned 4 [0046.384] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".mdf") returned 0x0 [0046.384] lstrlenW (lpString=".txt") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".txt") returned 0x0 [0046.385] lstrlenW (lpString=".dbf") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".dbf") returned 0x0 [0046.385] lstrlenW (lpString=".ckp") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".ckp") returned 0x0 [0046.385] lstrlenW (lpString=".dacpac") returned 7 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".dacpac") returned 0x0 [0046.385] lstrlenW (lpString=".db3") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".db3") returned 0x0 [0046.385] lstrlenW (lpString=".dtxs") returned 5 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".dtxs") returned 0x0 [0046.385] lstrlenW (lpString=".mdt") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".mdt") returned 0x0 [0046.385] lstrlenW (lpString=".sdf") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".sdf") returned 0x0 [0046.385] lstrlenW (lpString=".MDF") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".MDF") returned 0x0 [0046.385] lstrlenW (lpString=".DBF") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".DBF") returned 0x0 [0046.385] lstrlenW (lpString=".DB") returned 3 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".DB") returned 0x0 [0046.385] lstrlenW (lpString=".db") returned 3 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".db") returned 0x0 [0046.385] lstrlenW (lpString=".ndf") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".ndf") returned 0x0 [0046.385] lstrlenW (lpString=".NDF") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".NDF") returned 0x0 [0046.385] lstrlenW (lpString=".Mdf") returned 4 [0046.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".Mdf") returned 0x0 [0046.385] lstrlenW (lpString=".dat") returned 4 [0046.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".dat") returned 0x0 [0046.386] lstrlenW (lpString=".DAT") returned 4 [0046.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".DAT") returned 0x0 [0046.386] lstrlenW (lpString=".ldf") returned 4 [0046.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.386] lstrlenW (lpString=".LDF") returned 4 [0046.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch=".LDF") returned 0x0 [0046.386] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.386] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.386] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.387] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.387] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.387] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16638841500) returned 1 [0046.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa760370, dwHighDateTime=0x1d585b4)) [0046.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1950 [0046.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0046.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.388] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.388] GetLastError () returned 0x0 [0046.388] GetLastError () returned 0x0 [0046.388] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.388] GetLastError () returned 0x0 [0046.388] GetLastError () returned 0x0 [0046.391] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.391] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.394] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.394] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.394] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.394] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.394] CloseHandle (hObject=0xf8) returned 1 [0046.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.395] GetLastError () returned 0x0 [0046.395] RtlWakeConditionVariable () returned 0x27e828 [0046.395] GetCurrentThreadId () returned 0x9ac [0046.395] GetCurrentThreadId () returned 0x9ac [0046.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edfd0 | out: hHeap=0x260000) returned 1 [0046.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7828 | out: hHeap=0x260000) returned 1 [0046.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edfd0 [0046.396] lstrlenW (lpString=".ldf") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.396] lstrlenW (lpString=".vhd") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".vhd") returned 0x0 [0046.396] lstrlenW (lpString=".vhdx") returned 5 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".vhdx") returned 0x0 [0046.396] lstrlenW (lpString=".pst") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".pst") returned 0x0 [0046.396] lstrlenW (lpString=".ost") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".ost") returned 0x0 [0046.396] lstrlenW (lpString=".bak") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".bak") returned 0x0 [0046.396] lstrlenW (lpString=".bac") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".bac") returned 0x0 [0046.396] lstrlenW (lpString=".sys") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".sys") returned 0x0 [0046.396] lstrlenW (lpString=".v2i") returned 4 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".v2i") returned 0x0 [0046.396] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.396] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch="s\r\n.v2i") returned 0x0 [0046.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.397] lstrlenW (lpString=".sql") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".sql") returned 0x0 [0046.397] lstrlenW (lpString=".mdf") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".mdf") returned 0x0 [0046.397] lstrlenW (lpString=".txt") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".txt") returned 0x0 [0046.397] lstrlenW (lpString=".dbf") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".dbf") returned 0x0 [0046.397] lstrlenW (lpString=".ckp") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".ckp") returned 0x0 [0046.397] lstrlenW (lpString=".dacpac") returned 7 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".dacpac") returned 0x0 [0046.397] lstrlenW (lpString=".db3") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".db3") returned 0x0 [0046.397] lstrlenW (lpString=".dtxs") returned 5 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".dtxs") returned 0x0 [0046.397] lstrlenW (lpString=".mdt") returned 4 [0046.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".mdt") returned 0x0 [0046.398] lstrlenW (lpString=".sdf") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".sdf") returned 0x0 [0046.398] lstrlenW (lpString=".MDF") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".MDF") returned 0x0 [0046.398] lstrlenW (lpString=".DBF") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".DBF") returned 0x0 [0046.398] lstrlenW (lpString=".DB") returned 3 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".DB") returned 0x0 [0046.398] lstrlenW (lpString=".db") returned 3 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".db") returned 0x0 [0046.398] lstrlenW (lpString=".ndf") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".ndf") returned 0x0 [0046.398] lstrlenW (lpString=".NDF") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".NDF") returned 0x0 [0046.398] lstrlenW (lpString=".Mdf") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".Mdf") returned 0x0 [0046.398] lstrlenW (lpString=".dat") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".dat") returned 0x0 [0046.398] lstrlenW (lpString=".DAT") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".DAT") returned 0x0 [0046.398] lstrlenW (lpString=".ldf") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".ldf") returned 0x0 [0046.398] lstrlenW (lpString=".LDF") returned 4 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch=".LDF") returned 0x0 [0046.398] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0046.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0046.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2f5910 [0046.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0046.398] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0046.399] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0046.399] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0046.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0046.399] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16640038437) returned 1 [0046.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaa7864d0, dwHighDateTime=0x1d585b4)) [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7828 [0046.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0046.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7828 | out: hHeap=0x260000) returned 1 [0046.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x297c58 [0046.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0046.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b0a0 [0046.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0046.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.400] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0046.400] GetLastError () returned 0x0 [0046.400] GetLastError () returned 0x0 [0046.400] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0046.400] GetLastError () returned 0x0 [0046.400] GetLastError () returned 0x0 [0046.441] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.442] WriteFile (in: hFile=0xf8, lpBuffer=0x2750048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2750048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0046.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2750048 | out: hHeap=0x260000) returned 1 [0046.444] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.444] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0046.444] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0046.444] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0046.444] CloseHandle (hObject=0xf8) returned 1 [0046.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0046.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.[deadmin@cock.li].deadmin")) returned 1 [0046.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315f80 | out: hHeap=0x260000) returned 1 [0046.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0046.445] GetLastError () returned 0x0 [0046.445] RtlWakeConditionVariable () returned 0x27e828 [0046.445] GetCurrentThreadId () returned 0x9ac [0046.445] GetCurrentThreadId () returned 0x9ac [0046.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9c10 [0046.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b10 | out: hHeap=0x260000) returned 1 [0046.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81e8 | out: hHeap=0x260000) returned 1 [0046.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9b10 [0046.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0046.515] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.515] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.515] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.515] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.535] CloseHandle (hObject=0xf8) returned 1 [0046.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b10 | out: hHeap=0x260000) returned 1 [0046.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9c10 | out: hHeap=0x260000) returned 1 [0046.535] RtlWakeConditionVariable () returned 0x27e828 [0046.536] GetCurrentThreadId () returned 0x9ac [0046.536] GetCurrentThreadId () returned 0x9ac [0046.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edf18 [0046.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee700 | out: hHeap=0x260000) returned 1 [0046.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a90 | out: hHeap=0x260000) returned 1 [0046.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee700 [0046.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.633] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.633] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.633] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.633] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.634] CloseHandle (hObject=0x104) returned 1 [0046.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee700 | out: hHeap=0x260000) returned 1 [0046.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.635] RtlWakeConditionVariable () returned 0x27e828 [0046.635] GetCurrentThreadId () returned 0x9ac [0046.635] GetCurrentThreadId () returned 0x9ac [0046.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fe68 | out: hHeap=0x260000) returned 1 [0046.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7fb8 | out: hHeap=0x260000) returned 1 [0046.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fe68 [0046.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.635] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.635] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.635] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.635] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.636] CloseHandle (hObject=0x104) returned 1 [0046.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29fe68 | out: hHeap=0x260000) returned 1 [0046.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.637] RtlWakeConditionVariable () returned 0x27e828 [0046.637] GetCurrentThreadId () returned 0x9ac [0046.637] GetCurrentThreadId () returned 0x9ac [0046.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ff40 | out: hHeap=0x260000) returned 1 [0046.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7df8 | out: hHeap=0x260000) returned 1 [0046.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ff40 [0046.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.637] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.637] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.637] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.637] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.638] CloseHandle (hObject=0x104) returned 1 [0046.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ff40 | out: hHeap=0x260000) returned 1 [0046.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.638] RtlWakeConditionVariable () returned 0x27e828 [0046.638] GetCurrentThreadId () returned 0x9ac [0046.638] GetCurrentThreadId () returned 0x9ac [0046.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b0a0 [0046.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0046.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e30 | out: hHeap=0x260000) returned 1 [0046.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0046.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.639] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.639] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.639] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.639] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.640] CloseHandle (hObject=0x104) returned 1 [0046.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0046.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.640] RtlWakeConditionVariable () returned 0x27e828 [0046.640] GetCurrentThreadId () returned 0x9ac [0046.640] GetCurrentThreadId () returned 0x9ac [0046.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0046.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7e68 | out: hHeap=0x260000) returned 1 [0046.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297d48 [0046.641] lstrlenW (lpString=".ldf") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".ldf") returned 0x0 [0046.641] lstrlenW (lpString=".vhd") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".vhd") returned 0x0 [0046.641] lstrlenW (lpString=".vhdx") returned 5 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".vhdx") returned 0x0 [0046.641] lstrlenW (lpString=".pst") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".pst") returned 0x0 [0046.641] lstrlenW (lpString=".ost") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".ost") returned 0x0 [0046.641] lstrlenW (lpString=".bak") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".bak") returned 0x0 [0046.641] lstrlenW (lpString=".bac") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".bac") returned 0x0 [0046.641] lstrlenW (lpString=".sys") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".sys") returned 0x0 [0046.641] lstrlenW (lpString=".v2i") returned 4 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch=".v2i") returned 0x0 [0046.641] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0046.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297d48 | out: hHeap=0x260000) returned 1 [0046.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297c58 | out: hHeap=0x260000) returned 1 [0046.641] RtlWakeConditionVariable () returned 0x27e828 [0046.641] GetCurrentThreadId () returned 0x9ac [0046.641] GetCurrentThreadId () returned 0x9ac [0046.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297600 | out: hHeap=0x260000) returned 1 [0046.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ea0 | out: hHeap=0x260000) returned 1 [0046.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297600 [0046.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\services\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0046.642] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.642] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.642] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.642] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.643] CloseHandle (hObject=0x104) returned 1 [0046.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297600 | out: hHeap=0x260000) returned 1 [0046.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297990 | out: hHeap=0x260000) returned 1 [0046.643] RtlWakeConditionVariable () returned 0x27e828 [0046.643] GetCurrentThreadId () returned 0x9ac [0046.643] GetCurrentThreadId () returned 0x9ac [0046.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315cc8 [0046.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315db0 | out: hHeap=0x260000) returned 1 [0046.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9b0 | out: hHeap=0x260000) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315db0 [0046.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315db0 | out: hHeap=0x260000) returned 1 [0046.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315cc8 | out: hHeap=0x260000) returned 1 [0046.644] RtlWakeConditionVariable () returned 0x27e828 [0046.644] GetCurrentThreadId () returned 0x9ac [0046.644] GetCurrentThreadId () returned 0x9ac [0046.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9fc0 [0046.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0046.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d978 | out: hHeap=0x260000) returned 1 [0046.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9da0 [0046.644] lstrlenW (lpString=".ldf") returned 4 [0046.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".ldf") returned 0x0 [0046.644] lstrlenW (lpString=".vhd") returned 4 [0046.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".vhd") returned 0x0 [0046.644] lstrlenW (lpString=".vhdx") returned 5 [0046.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".vhdx") returned 0x0 [0046.644] lstrlenW (lpString=".pst") returned 4 [0046.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".pst") returned 0x0 [0046.644] lstrlenW (lpString=".ost") returned 4 [0046.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".ost") returned 0x0 [0046.644] lstrlenW (lpString=".bak") returned 4 [0046.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".bak") returned 0x0 [0046.645] lstrlenW (lpString=".bac") returned 4 [0046.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".bac") returned 0x0 [0046.645] lstrlenW (lpString=".sys") returned 4 [0046.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".sys") returned 0x0 [0046.645] lstrlenW (lpString=".v2i") returned 4 [0046.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch=".v2i") returned 0x0 [0046.645] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9da0 | out: hHeap=0x260000) returned 1 [0046.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9fc0 | out: hHeap=0x260000) returned 1 [0046.657] RtlWakeConditionVariable () returned 0x27e828 [0046.657] GetCurrentThreadId () returned 0x9ac [0046.657] GetCurrentThreadId () returned 0x9ac [0046.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2edf18 [0046.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2be8 | out: hHeap=0x260000) returned 1 [0046.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ac8 | out: hHeap=0x260000) returned 1 [0046.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2be8 [0046.657] lstrlenW (lpString=".ldf") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".ldf") returned 0x0 [0046.657] lstrlenW (lpString=".vhd") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".vhd") returned 0x0 [0046.657] lstrlenW (lpString=".vhdx") returned 5 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".vhdx") returned 0x0 [0046.657] lstrlenW (lpString=".pst") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".pst") returned 0x0 [0046.657] lstrlenW (lpString=".ost") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".ost") returned 0x0 [0046.657] lstrlenW (lpString=".bak") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".bak") returned 0x0 [0046.657] lstrlenW (lpString=".bac") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".bac") returned 0x0 [0046.657] lstrlenW (lpString=".sys") returned 4 [0046.657] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".sys") returned 0x0 [0046.657] lstrlenW (lpString=".v2i") returned 4 [0046.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch=".v2i") returned 0x0 [0046.658] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", lpSrch="s\r\n.v2i") returned 0x0 [0046.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2be8 | out: hHeap=0x260000) returned 1 [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.658] RtlWakeConditionVariable () returned 0x27e828 [0046.658] GetCurrentThreadId () returned 0x9ac [0046.658] GetCurrentThreadId () returned 0x9ac [0046.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b00 | out: hHeap=0x260000) returned 1 [0046.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0046.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\!_HOW_RECOVERY_FILES_!.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\!_how_recovery_files_!.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0046.658] RtlWakeConditionVariable () returned 0x27e828 [0046.658] GetCurrentThreadId () returned 0x9ac [0046.658] GetCurrentThreadId () returned 0x9ac [0046.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b0a0 [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e918 | out: hHeap=0x260000) returned 1 [0046.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b38 | out: hHeap=0x260000) returned 1 [0046.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e918 [0046.658] lstrlenW (lpString=".ldf") returned 4 [0046.658] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".ldf") returned 0x0 [0046.659] lstrlenW (lpString=".vhd") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".vhd") returned 0x0 [0046.659] lstrlenW (lpString=".vhdx") returned 5 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".vhdx") returned 0x0 [0046.659] lstrlenW (lpString=".pst") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".pst") returned 0x0 [0046.659] lstrlenW (lpString=".ost") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".ost") returned 0x0 [0046.659] lstrlenW (lpString=".bak") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".bak") returned 0x0 [0046.659] lstrlenW (lpString=".bac") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".bac") returned 0x0 [0046.659] lstrlenW (lpString=".sys") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".sys") returned 0x0 [0046.659] lstrlenW (lpString=".v2i") returned 4 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch=".v2i") returned 0x0 [0046.659] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.659] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e918 | out: hHeap=0x260000) returned 1 [0046.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.659] RtlWakeConditionVariable () returned 0x27e828 [0046.659] GetCurrentThreadId () returned 0x9ac [0046.659] GetCurrentThreadId () returned 0x9ac [0046.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b0a0 [0046.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0046.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b70 | out: hHeap=0x260000) returned 1 [0046.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0046.659] lstrlenW (lpString=".ldf") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".ldf") returned 0x0 [0046.660] lstrlenW (lpString=".vhd") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".vhd") returned 0x0 [0046.660] lstrlenW (lpString=".vhdx") returned 5 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".vhdx") returned 0x0 [0046.660] lstrlenW (lpString=".pst") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".pst") returned 0x0 [0046.660] lstrlenW (lpString=".ost") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".ost") returned 0x0 [0046.660] lstrlenW (lpString=".bak") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".bak") returned 0x0 [0046.660] lstrlenW (lpString=".bac") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".bac") returned 0x0 [0046.660] lstrlenW (lpString=".sys") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".sys") returned 0x0 [0046.660] lstrlenW (lpString=".v2i") returned 4 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch=".v2i") returned 0x0 [0046.660] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e7c8 | out: hHeap=0x260000) returned 1 [0046.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.660] RtlWakeConditionVariable () returned 0x27e828 [0046.660] GetCurrentThreadId () returned 0x9ac [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".ldf") returned 0x0 [0046.661] lstrlenW (lpString=".vhd") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".vhd") returned 0x0 [0046.661] lstrlenW (lpString=".vhdx") returned 5 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".vhdx") returned 0x0 [0046.661] lstrlenW (lpString=".pst") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".pst") returned 0x0 [0046.661] lstrlenW (lpString=".ost") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".ost") returned 0x0 [0046.661] lstrlenW (lpString=".bak") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".bak") returned 0x0 [0046.661] lstrlenW (lpString=".bac") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".bac") returned 0x0 [0046.661] lstrlenW (lpString=".sys") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".sys") returned 0x0 [0046.661] lstrlenW (lpString=".v2i") returned 4 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch=".v2i") returned 0x0 [0046.661] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29e870 | out: hHeap=0x260000) returned 1 [0046.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.661] RtlWakeConditionVariable () returned 0x27e828 [0046.661] GetCurrentThreadId () returned 0x9ac [0046.662] RtlWakeConditionVariable () returned 0x27e828 [0046.662] GetCurrentThreadId () returned 0x9ac [0046.662] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.662] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.662] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.662] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.663] CloseHandle (hObject=0xf0) returned 1 [0046.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2570 | out: hHeap=0x260000) returned 1 [0046.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edf18 | out: hHeap=0x260000) returned 1 [0046.663] RtlWakeConditionVariable () returned 0x27e828 [0046.663] GetCurrentThreadId () returned 0x9ac [0046.664] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.664] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.664] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.664] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.665] CloseHandle (hObject=0xf0) returned 1 [0046.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ce30 | out: hHeap=0x260000) returned 1 [0046.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b0a0 | out: hHeap=0x260000) returned 1 [0046.665] RtlWakeConditionVariable () returned 0x27e828 [0046.665] GetCurrentThreadId () returned 0x9ac [0046.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".ldf") returned 0x0 [0046.665] lstrlenW (lpString=".vhd") returned 4 [0046.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".vhd") returned 0x0 [0046.665] lstrlenW (lpString=".vhdx") returned 5 [0046.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".vhdx") returned 0x0 [0046.666] lstrlenW (lpString=".pst") returned 4 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".pst") returned 0x0 [0046.666] lstrlenW (lpString=".ost") returned 4 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".ost") returned 0x0 [0046.666] lstrlenW (lpString=".bak") returned 4 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".bak") returned 0x0 [0046.666] lstrlenW (lpString=".bac") returned 4 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".bac") returned 0x0 [0046.666] lstrlenW (lpString=".sys") returned 4 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".sys") returned 0x0 [0046.666] lstrlenW (lpString=".v2i") returned 4 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch=".v2i") returned 0x0 [0046.666] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpSrch="s\r\n.v2i") returned 0x0 [0046.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310c08 | out: hHeap=0x260000) returned 1 [0046.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310af8 | out: hHeap=0x260000) returned 1 [0046.684] RtlWakeConditionVariable () returned 0x27e828 [0046.684] GetCurrentThreadId () returned 0x9ac [0046.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".ldf") returned 0x0 [0046.684] lstrlenW (lpString=".vhd") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".vhd") returned 0x0 [0046.685] lstrlenW (lpString=".vhdx") returned 5 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".vhdx") returned 0x0 [0046.685] lstrlenW (lpString=".pst") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".pst") returned 0x0 [0046.685] lstrlenW (lpString=".ost") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".ost") returned 0x0 [0046.685] lstrlenW (lpString=".bak") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".bak") returned 0x0 [0046.685] lstrlenW (lpString=".bac") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".bac") returned 0x0 [0046.685] lstrlenW (lpString=".sys") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".sys") returned 0x0 [0046.685] lstrlenW (lpString=".v2i") returned 4 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch=".v2i") returned 0x0 [0046.685] lstrlenW (lpString="s\r\n.v2i") returned 7 [0046.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", lpSrch="s\r\n.v2i") returned 0x0 [0046.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310d18 | out: hHeap=0x260000) returned 1 [0046.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x310af8 | out: hHeap=0x260000) returned 1 [0046.694] RtlWakeConditionVariable () returned 0x27e828 [0046.694] GetCurrentThreadId () returned 0x9ac [0046.704] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.704] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.704] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.704] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.705] CloseHandle (hObject=0x104) returned 1 [0046.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297140 | out: hHeap=0x260000) returned 1 [0046.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297990 | out: hHeap=0x260000) returned 1 [0046.705] RtlWakeConditionVariable () returned 0x27e828 [0046.705] GetCurrentThreadId () returned 0x9ac [0046.748] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.759] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.759] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.759] WriteFile (in: hFile=0x104, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.766] CloseHandle (hObject=0x104) returned 1 [0046.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d418 | out: hHeap=0x260000) returned 1 [0046.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0046.766] RtlWakeConditionVariable () returned 0x27e828 [0046.766] GetCurrentThreadId () returned 0x9ac [0046.778] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.778] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.778] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.778] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.780] CloseHandle (hObject=0xf8) returned 1 [0046.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e2d0 | out: hHeap=0x260000) returned 1 [0046.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0046.780] RtlWakeConditionVariable () returned 0x27e828 [0046.780] GetCurrentThreadId () returned 0x9ac [0046.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297fa0 | out: hHeap=0x260000) returned 1 [0046.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297e38 | out: hHeap=0x260000) returned 1 [0046.781] RtlWakeConditionVariable () returned 0x27e828 [0046.781] GetCurrentThreadId () returned 0x9ac [0046.783] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.784] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0046.784] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0046.784] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0046.785] CloseHandle (hObject=0xf8) returned 1 [0046.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312698 | out: hHeap=0x260000) returned 1 [0046.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312610 | out: hHeap=0x260000) returned 1 [0046.785] RtlWakeConditionVariable () returned 0x27e828 [0046.785] GetCurrentThreadId () returned 0x9ac [0047.072] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.072] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.072] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.072] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.074] CloseHandle (hObject=0xf8) returned 1 [0047.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2a78 | out: hHeap=0x260000) returned 1 [0047.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f2798 | out: hHeap=0x260000) returned 1 [0047.074] RtlWakeConditionVariable () returned 0x27e828 [0047.074] GetCurrentThreadId () returned 0x9ac [0047.095] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.096] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.096] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.096] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.097] CloseHandle (hObject=0xf8) returned 1 [0047.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ef110 | out: hHeap=0x260000) returned 1 [0047.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee9e0 | out: hHeap=0x260000) returned 1 [0047.097] RtlWakeConditionVariable () returned 0x27e828 [0047.097] GetCurrentThreadId () returned 0x9ac [0047.202] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.202] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.202] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.202] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.204] CloseHandle (hObject=0xf8) returned 1 [0047.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efbd8 | out: hHeap=0x260000) returned 1 [0047.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29b068 | out: hHeap=0x260000) returned 1 [0047.204] RtlWakeConditionVariable () returned 0x27e828 [0047.205] GetCurrentThreadId () returned 0x9ac [0047.267] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.267] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.267] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.267] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.268] CloseHandle (hObject=0xf8) returned 1 [0047.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x333950 | out: hHeap=0x260000) returned 1 [0047.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3332d8 | out: hHeap=0x260000) returned 1 [0047.268] RtlWakeConditionVariable () returned 0x27e828 [0047.268] GetCurrentThreadId () returned 0x9ac [0047.286] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.286] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.286] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.286] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.289] CloseHandle (hObject=0xf8) returned 1 [0047.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bec8 | out: hHeap=0x260000) returned 1 [0047.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3332d8 | out: hHeap=0x260000) returned 1 [0047.289] RtlWakeConditionVariable () returned 0x27e828 [0047.289] GetCurrentThreadId () returned 0x9ac [0047.289] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.289] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.289] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.289] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.291] CloseHandle (hObject=0xf8) returned 1 [0047.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0047.291] RtlWakeConditionVariable () returned 0x27e828 [0047.291] GetCurrentThreadId () returned 0x9ac [0047.291] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.291] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.291] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.291] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.292] CloseHandle (hObject=0xf8) returned 1 [0047.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x331860 | out: hHeap=0x260000) returned 1 [0047.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b68e8 | out: hHeap=0x260000) returned 1 [0047.292] RtlWakeConditionVariable () returned 0x27e828 [0047.292] GetCurrentThreadId () returned 0x9ac [0047.293] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.293] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.293] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.293] WriteFile (in: hFile=0xf8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.294] CloseHandle (hObject=0xf8) returned 1 [0047.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3129c8 | out: hHeap=0x260000) returned 1 [0047.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x311488 | out: hHeap=0x260000) returned 1 [0047.294] RtlWakeConditionVariable () returned 0x27e828 [0047.294] GetCurrentThreadId () returned 0x9ac [0047.314] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3129c8) returned 1 [0047.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.315] CryptReleaseContext (hProv=0x3129c8, dwFlags=0x0) returned 1 [0047.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0047.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.315] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16731657136) returned 1 [0047.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab04d5f0, dwHighDateTime=0x1d585b4)) [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d940 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d940 | out: hHeap=0x260000) returned 1 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.316] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.316] GetLastError () returned 0x0 [0047.316] GetLastError () returned 0x0 [0047.316] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.316] GetLastError () returned 0x0 [0047.316] GetLastError () returned 0x0 [0047.320] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffe34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.320] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1cc, lpOverlapped=0x0) returned 1 [0047.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.322] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.322] WriteFile (in: hFile=0x104, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.322] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.322] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.322] CloseHandle (hObject=0x104) returned 1 [0047.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c1a8 [0047.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.[deadmin@cock.li].deadmin")) returned 1 [0047.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c1a8 | out: hHeap=0x260000) returned 1 [0047.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0047.323] GetLastError () returned 0x0 [0047.346] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.346] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.347] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16734773319) returned 1 [0047.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab0998b0, dwHighDateTime=0x1d585b4)) [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3371e8 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3371e8 | out: hHeap=0x260000) returned 1 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b928 [0047.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b928 | out: hHeap=0x260000) returned 1 [0047.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.347] GetLastError () returned 0x0 [0047.347] GetLastError () returned 0x0 [0047.347] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.347] GetLastError () returned 0x0 [0047.348] GetLastError () returned 0x0 [0047.357] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8ed2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.357] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x712e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x712e, lpOverlapped=0x0) returned 1 [0047.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.359] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.359] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.359] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.359] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.359] CloseHandle (hObject=0xf0) returned 1 [0047.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0047.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.[deadmin@cock.li].deadmin")) returned 1 [0047.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0047.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.390] GetLastError () returned 0x0 [0047.395] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.396] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.396] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16739724214) returned 1 [0047.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab10bcd0, dwHighDateTime=0x1d585b4)) [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337338 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337338 | out: hHeap=0x260000) returned 1 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a428 [0047.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a428 | out: hHeap=0x260000) returned 1 [0047.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.397] GetLastError () returned 0x0 [0047.397] GetLastError () returned 0x0 [0047.397] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.397] GetLastError () returned 0x0 [0047.397] GetLastError () returned 0x0 [0047.405] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.405] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0047.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.406] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.408] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.408] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.408] CloseHandle (hObject=0xf0) returned 1 [0047.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0047.408] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.[deadmin@cock.li].deadmin")) returned 1 [0047.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0047.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.409] GetLastError () returned 0x0 [0047.409] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.410] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.410] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.410] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16741348806) returned 1 [0047.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab131e30, dwHighDateTime=0x1d585b4)) [0047.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3373a8 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3373a8 | out: hHeap=0x260000) returned 1 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0047.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.413] GetLastError () returned 0x0 [0047.413] GetLastError () returned 0x0 [0047.413] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.413] GetLastError () returned 0x0 [0047.413] GetLastError () returned 0x0 [0047.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc5e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.415] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3a18, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x3a18, lpOverlapped=0x0) returned 1 [0047.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.415] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.415] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.415] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.415] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.415] CloseHandle (hObject=0xf0) returned 1 [0047.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x298fd0 [0047.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.[deadmin@cock.li].deadmin")) returned 1 [0047.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298fd0 | out: hHeap=0x260000) returned 1 [0047.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.416] GetLastError () returned 0x0 [0047.417] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.417] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.417] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.417] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.418] CloseHandle (hObject=0xf0) returned 1 [0047.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0378 | out: hHeap=0x260000) returned 1 [0047.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0047.418] RtlWakeConditionVariable () returned 0x27e828 [0047.418] GetCurrentThreadId () returned 0x9ac [0047.418] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.418] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.418] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.418] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.419] CloseHandle (hObject=0xf0) returned 1 [0047.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0450 | out: hHeap=0x260000) returned 1 [0047.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f958 | out: hHeap=0x260000) returned 1 [0047.419] RtlWakeConditionVariable () returned 0x27e828 [0047.419] GetCurrentThreadId () returned 0x9ac [0047.420] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.420] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.420] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.420] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.421] CloseHandle (hObject=0xf0) returned 1 [0047.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x333ce8 | out: hHeap=0x260000) returned 1 [0047.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x333b78 | out: hHeap=0x260000) returned 1 [0047.421] RtlWakeConditionVariable () returned 0x27e828 [0047.421] GetCurrentThreadId () returned 0x9ac [0047.421] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.421] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.421] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.421] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.422] CloseHandle (hObject=0xf0) returned 1 [0047.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x333da0 | out: hHeap=0x260000) returned 1 [0047.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x333b78 | out: hHeap=0x260000) returned 1 [0047.422] RtlWakeConditionVariable () returned 0x27e828 [0047.422] GetCurrentThreadId () returned 0x9ac [0047.422] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.423] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0047.423] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0047.423] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0047.424] CloseHandle (hObject=0xf0) returned 1 [0047.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ad58 | out: hHeap=0x260000) returned 1 [0047.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.424] RtlWakeConditionVariable () returned 0x27e828 [0047.424] GetCurrentThreadId () returned 0x9ac [0047.424] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.425] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.425] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16742627770) returned 1 [0047.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab157f90, dwHighDateTime=0x1d585b4)) [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8220 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8220 | out: hHeap=0x260000) returned 1 [0047.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0047.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.426] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.426] GetLastError () returned 0x0 [0047.426] GetLastError () returned 0x0 [0047.426] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.426] GetLastError () returned 0x0 [0047.426] GetLastError () returned 0x0 [0047.428] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdcc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.428] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2340, lpOverlapped=0x0) returned 1 [0047.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.428] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.428] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.428] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.428] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.429] CloseHandle (hObject=0xf0) returned 1 [0047.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.429] GetLastError () returned 0x0 [0047.430] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.430] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.430] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.431] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16743167285) returned 1 [0047.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab157f90, dwHighDateTime=0x1d585b4)) [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d81e8 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81e8 | out: hHeap=0x260000) returned 1 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0047.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.431] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.431] GetLastError () returned 0x0 [0047.431] GetLastError () returned 0x0 [0047.431] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.431] GetLastError () returned 0x0 [0047.431] GetLastError () returned 0x0 [0047.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe3d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.433] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c30, lpOverlapped=0x0) returned 1 [0047.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.433] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.433] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.433] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.433] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.433] CloseHandle (hObject=0xf0) returned 1 [0047.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.434] GetLastError () returned 0x0 [0047.435] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.436] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.436] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.436] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16743688000) returned 1 [0047.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab157f90, dwHighDateTime=0x1d585b4)) [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d81b0 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81b0 | out: hHeap=0x260000) returned 1 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331ac0 [0047.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.436] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.436] GetLastError () returned 0x0 [0047.436] GetLastError () returned 0x0 [0047.437] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.437] GetLastError () returned 0x0 [0047.437] GetLastError () returned 0x0 [0047.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc5e7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.438] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3a19, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x3a19, lpOverlapped=0x0) returned 1 [0047.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.438] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.438] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.439] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.439] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.439] CloseHandle (hObject=0xf0) returned 1 [0047.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.439] GetLastError () returned 0x0 [0047.440] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.440] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.440] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.440] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16744162630) returned 1 [0047.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab17e0f0, dwHighDateTime=0x1d585b4)) [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8178 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8178 | out: hHeap=0x260000) returned 1 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.441] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331c88 [0047.441] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.441] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.441] GetLastError () returned 0x0 [0047.441] GetLastError () returned 0x0 [0047.441] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.441] GetLastError () returned 0x0 [0047.441] GetLastError () returned 0x0 [0047.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe5e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.443] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1a1c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1a1c, lpOverlapped=0x0) returned 1 [0047.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.443] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.443] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.443] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.443] CloseHandle (hObject=0xf0) returned 1 [0047.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.444] GetLastError () returned 0x0 [0047.445] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.446] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.446] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.446] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16744694395) returned 1 [0047.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab17e0f0, dwHighDateTime=0x1d585b4)) [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299948 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299948 | out: hHeap=0x260000) returned 1 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31ae00 [0047.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331d20 [0047.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31ae00 | out: hHeap=0x260000) returned 1 [0047.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.446] GetLastError () returned 0x0 [0047.447] GetLastError () returned 0x0 [0047.447] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.447] GetLastError () returned 0x0 [0047.447] GetLastError () returned 0x0 [0047.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff34d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.448] WriteFile (in: hFile=0xf0, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xcb3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xcb3, lpOverlapped=0x0) returned 1 [0047.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.448] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.449] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.449] CloseHandle (hObject=0xf0) returned 1 [0047.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.468] GetLastError () returned 0x0 [0047.468] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.469] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.469] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.469] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16747027539) returned 1 [0047.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab1a4250, dwHighDateTime=0x1d585b4)) [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299788 [0047.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299788 | out: hHeap=0x260000) returned 1 [0047.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331db8 [0047.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.470] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.470] GetLastError () returned 0x0 [0047.470] GetLastError () returned 0x0 [0047.470] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.470] GetLastError () returned 0x0 [0047.470] GetLastError () returned 0x0 [0047.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd18d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.474] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x2e73, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x2e73, lpOverlapped=0x0) returned 1 [0047.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.476] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.476] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.476] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.477] CloseHandle (hObject=0xf0) returned 1 [0047.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.477] GetLastError () returned 0x0 [0047.478] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.478] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.478] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.479] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16747970984) returned 1 [0047.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab1ca3b0, dwHighDateTime=0x1d585b4)) [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2996a8 | out: hHeap=0x260000) returned 1 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331f80 [0047.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.479] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.479] GetLastError () returned 0x0 [0047.479] GetLastError () returned 0x0 [0047.479] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.479] GetLastError () returned 0x0 [0047.480] GetLastError () returned 0x0 [0047.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffdfb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.482] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x205, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x205, lpOverlapped=0x0) returned 1 [0047.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.482] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.482] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.482] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.482] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.483] CloseHandle (hObject=0xf0) returned 1 [0047.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.483] GetLastError () returned 0x0 [0047.484] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.484] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.484] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.484] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16748556321) returned 1 [0047.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab1ca3b0, dwHighDateTime=0x1d585b4)) [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332018 [0047.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.485] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.485] GetLastError () returned 0x0 [0047.485] GetLastError () returned 0x0 [0047.485] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.485] GetLastError () returned 0x0 [0047.485] GetLastError () returned 0x0 [0047.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.486] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x1f6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f6, lpOverlapped=0x0) returned 1 [0047.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.487] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.487] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.487] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.487] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.487] CloseHandle (hObject=0xf0) returned 1 [0047.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.488] GetLastError () returned 0x0 [0047.489] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.489] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.489] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16749052438) returned 1 [0047.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab1f0510, dwHighDateTime=0x1d585b4)) [0047.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331f80 [0047.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.490] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.490] GetLastError () returned 0x0 [0047.490] GetLastError () returned 0x0 [0047.490] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.490] GetLastError () returned 0x0 [0047.490] GetLastError () returned 0x0 [0047.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffce62, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.492] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x319e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x319e, lpOverlapped=0x0) returned 1 [0047.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.492] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.492] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.492] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.492] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.492] CloseHandle (hObject=0xf0) returned 1 [0047.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.493] GetLastError () returned 0x0 [0047.493] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.494] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.494] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.494] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16749523830) returned 1 [0047.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab1f0510, dwHighDateTime=0x1d585b4)) [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7908 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7908 | out: hHeap=0x260000) returned 1 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332148 [0047.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.495] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.495] GetLastError () returned 0x0 [0047.495] GetLastError () returned 0x0 [0047.495] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.495] GetLastError () returned 0x0 [0047.495] GetLastError () returned 0x0 [0047.496] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff264, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.496] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0xd9c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0xd9c, lpOverlapped=0x0) returned 1 [0047.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.497] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.497] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.497] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.497] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.497] CloseHandle (hObject=0xf0) returned 1 [0047.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.498] GetLastError () returned 0x0 [0047.498] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.499] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.499] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.499] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16749993520) returned 1 [0047.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab1f0510, dwHighDateTime=0x1d585b4)) [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d78d0 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d78d0 | out: hHeap=0x260000) returned 1 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3321e0 [0047.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.499] GetLastError () returned 0x0 [0047.500] GetLastError () returned 0x0 [0047.500] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.500] GetLastError () returned 0x0 [0047.500] GetLastError () returned 0x0 [0047.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff3bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.501] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0xc44, lpOverlapped=0x0) returned 1 [0047.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.501] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.502] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.502] CloseHandle (hObject=0xf0) returned 1 [0047.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.503] GetLastError () returned 0x0 [0047.503] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.503] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.503] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.504] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16750475820) returned 1 [0047.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab216670, dwHighDateTime=0x1d585b4)) [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7898 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7898 | out: hHeap=0x260000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332278 [0047.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.504] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.504] GetLastError () returned 0x0 [0047.504] GetLastError () returned 0x0 [0047.504] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.504] GetLastError () returned 0x0 [0047.505] GetLastError () returned 0x0 [0047.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcf3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.506] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x30c2, lpOverlapped=0x0) returned 1 [0047.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.506] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.506] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.506] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.507] CloseHandle (hObject=0xf0) returned 1 [0047.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.507] GetLastError () returned 0x0 [0047.508] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.508] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.508] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.508] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16750949077) returned 1 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab216670, dwHighDateTime=0x1d585b4)) [0047.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7860 [0047.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7860 | out: hHeap=0x260000) returned 1 [0047.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332310 [0047.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.509] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.509] GetLastError () returned 0x0 [0047.509] GetLastError () returned 0x0 [0047.509] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.509] GetLastError () returned 0x0 [0047.509] GetLastError () returned 0x0 [0047.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeb7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.511] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x1485, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1485, lpOverlapped=0x0) returned 1 [0047.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.511] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.511] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.511] CloseHandle (hObject=0xf0) returned 1 [0047.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.512] GetLastError () returned 0x0 [0047.513] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.514] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.514] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.514] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16751481623) returned 1 [0047.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab216670, dwHighDateTime=0x1d585b4)) [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7828 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7828 | out: hHeap=0x260000) returned 1 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3323a8 [0047.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.514] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.514] GetLastError () returned 0x0 [0047.514] GetLastError () returned 0x0 [0047.514] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.515] GetLastError () returned 0x0 [0047.515] GetLastError () returned 0x0 [0047.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff5dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.516] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0xa24, lpOverlapped=0x0) returned 1 [0047.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.516] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.517] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.517] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.517] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.517] CloseHandle (hObject=0xf0) returned 1 [0047.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.518] GetLastError () returned 0x0 [0047.518] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.519] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.519] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16752047161) returned 1 [0047.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab23c7d0, dwHighDateTime=0x1d585b4)) [0047.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77f0 [0047.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77f0 | out: hHeap=0x260000) returned 1 [0047.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332440 [0047.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.520] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.520] GetLastError () returned 0x0 [0047.520] GetLastError () returned 0x0 [0047.520] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.520] GetLastError () returned 0x0 [0047.520] GetLastError () returned 0x0 [0047.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd691, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.524] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x296f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x296f, lpOverlapped=0x0) returned 1 [0047.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.524] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.524] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.524] CloseHandle (hObject=0xf0) returned 1 [0047.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.538] GetLastError () returned 0x0 [0047.538] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.539] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.539] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16753985022) returned 1 [0047.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab262930, dwHighDateTime=0x1d585b4)) [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7710 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7710 | out: hHeap=0x260000) returned 1 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3324d8 [0047.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.539] GetLastError () returned 0x0 [0047.539] GetLastError () returned 0x0 [0047.539] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.540] GetLastError () returned 0x0 [0047.540] GetLastError () returned 0x0 [0047.542] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeca5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.542] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x135b, lpOverlapped=0x0) returned 1 [0047.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.543] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.543] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.543] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.543] CloseHandle (hObject=0xf0) returned 1 [0047.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.544] GetLastError () returned 0x0 [0047.544] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.545] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.545] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16754624370) returned 1 [0047.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab262930, dwHighDateTime=0x1d585b4)) [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7748 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7748 | out: hHeap=0x260000) returned 1 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334018 [0047.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.546] GetLastError () returned 0x0 [0047.546] GetLastError () returned 0x0 [0047.546] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.546] GetLastError () returned 0x0 [0047.546] GetLastError () returned 0x0 [0047.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffec5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.547] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x13a6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x13a6, lpOverlapped=0x0) returned 1 [0047.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.548] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.548] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.548] CloseHandle (hObject=0xf0) returned 1 [0047.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.549] GetLastError () returned 0x0 [0047.549] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.550] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.550] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.550] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16755116928) returned 1 [0047.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab288a90, dwHighDateTime=0x1d585b4)) [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d76d8 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76d8 | out: hHeap=0x260000) returned 1 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332738 [0047.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.551] GetLastError () returned 0x0 [0047.551] GetLastError () returned 0x0 [0047.551] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.551] GetLastError () returned 0x0 [0047.551] GetLastError () returned 0x0 [0047.552] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffb86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.552] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x47a, lpOverlapped=0x0) returned 1 [0047.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.553] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.553] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.553] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.553] CloseHandle (hObject=0xf0) returned 1 [0047.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.554] GetLastError () returned 0x0 [0047.554] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.555] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.555] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.555] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16755579734) returned 1 [0047.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab288a90, dwHighDateTime=0x1d585b4)) [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d76a0 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76a0 | out: hHeap=0x260000) returned 1 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3327d0 [0047.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.555] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.555] GetLastError () returned 0x0 [0047.555] GetLastError () returned 0x0 [0047.555] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.556] GetLastError () returned 0x0 [0047.556] GetLastError () returned 0x0 [0047.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe261, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.557] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x1d9f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d9f, lpOverlapped=0x0) returned 1 [0047.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.557] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.558] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.558] CloseHandle (hObject=0xf0) returned 1 [0047.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.558] GetLastError () returned 0x0 [0047.559] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.560] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.560] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.560] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16756116880) returned 1 [0047.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab288a90, dwHighDateTime=0x1d585b4)) [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7668 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7668 | out: hHeap=0x260000) returned 1 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332868 [0047.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.561] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.561] GetLastError () returned 0x0 [0047.561] GetLastError () returned 0x0 [0047.561] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.561] GetLastError () returned 0x0 [0047.561] GetLastError () returned 0x0 [0047.562] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe4b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.562] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x1b48, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b48, lpOverlapped=0x0) returned 1 [0047.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.563] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.563] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.563] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.563] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.563] CloseHandle (hObject=0xf0) returned 1 [0047.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.564] GetLastError () returned 0x0 [0047.564] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.565] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.565] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16756594335) returned 1 [0047.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab2aebf0, dwHighDateTime=0x1d585b4)) [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7630 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7630 | out: hHeap=0x260000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332900 [0047.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.565] GetLastError () returned 0x0 [0047.566] GetLastError () returned 0x0 [0047.566] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.566] GetLastError () returned 0x0 [0047.566] GetLastError () returned 0x0 [0047.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcc3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.567] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x33c6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x33c6, lpOverlapped=0x0) returned 1 [0047.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.567] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.568] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.568] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.568] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.568] CloseHandle (hObject=0xf0) returned 1 [0047.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.569] GetLastError () returned 0x0 [0047.569] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.570] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.570] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.570] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16757131333) returned 1 [0047.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab2aebf0, dwHighDateTime=0x1d585b4)) [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d76a0 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d76a0 | out: hHeap=0x260000) returned 1 [0047.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332998 [0047.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.571] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.571] GetLastError () returned 0x0 [0047.571] GetLastError () returned 0x0 [0047.571] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.571] GetLastError () returned 0x0 [0047.571] GetLastError () returned 0x0 [0047.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffde7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.583] WriteFile (in: hFile=0xf0, lpBuffer=0x2b8238*, nNumberOfBytesToWrite=0x2186, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b8238*, lpNumberOfBytesWritten=0x24cfdb0*=0x2186, lpOverlapped=0x0) returned 1 [0047.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8238 | out: hHeap=0x260000) returned 1 [0047.584] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.584] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.585] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.585] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.585] CloseHandle (hObject=0xf0) returned 1 [0047.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.[deadmin@cock.li].deadmin")) returned 1 [0047.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0047.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.675] GetLastError () returned 0x0 [0047.675] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.676] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.676] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16767698092) returned 1 [0047.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab3b9590, dwHighDateTime=0x1d585b4)) [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295380 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295380 | out: hHeap=0x260000) returned 1 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31ef18 [0047.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.676] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.676] GetLastError () returned 0x0 [0047.677] GetLastError () returned 0x0 [0047.677] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.677] GetLastError () returned 0x0 [0047.677] GetLastError () returned 0x0 [0047.678] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.679] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ba0, lpOverlapped=0x0) returned 1 [0047.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.679] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.679] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.679] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.679] CloseHandle (hObject=0x104) returned 1 [0047.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0047.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.682] GetLastError () returned 0x0 [0047.682] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.683] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.683] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.683] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16768447346) returned 1 [0047.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab3b9590, dwHighDateTime=0x1d585b4)) [0047.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1950 [0047.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1950 | out: hHeap=0x260000) returned 1 [0047.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f048 [0047.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.684] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.684] GetLastError () returned 0x0 [0047.684] GetLastError () returned 0x0 [0047.684] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.684] GetLastError () returned 0x0 [0047.684] GetLastError () returned 0x0 [0047.686] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff2f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.686] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xd10, lpOverlapped=0x0) returned 1 [0047.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.686] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.686] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.686] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.686] CloseHandle (hObject=0x104) returned 1 [0047.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0047.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.687] GetLastError () returned 0x0 [0047.687] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.688] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.688] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16768939598) returned 1 [0047.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab3b9590, dwHighDateTime=0x1d585b4)) [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1918 [0047.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1918 | out: hHeap=0x260000) returned 1 [0047.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f0e0 [0047.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.689] GetLastError () returned 0x0 [0047.689] GetLastError () returned 0x0 [0047.689] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.689] GetLastError () returned 0x0 [0047.689] GetLastError () returned 0x0 [0047.691] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff9c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.691] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x63c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x63c, lpOverlapped=0x0) returned 1 [0047.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.691] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.691] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.691] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.691] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.691] CloseHandle (hObject=0x104) returned 1 [0047.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.691] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0047.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.692] GetLastError () returned 0x0 [0047.693] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.693] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.693] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.693] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16769454663) returned 1 [0047.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab3df6f0, dwHighDateTime=0x1d585b4)) [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c60 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c60 | out: hHeap=0x260000) returned 1 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f178 [0047.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.694] GetLastError () returned 0x0 [0047.694] GetLastError () returned 0x0 [0047.694] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.694] GetLastError () returned 0x0 [0047.694] GetLastError () returned 0x0 [0047.696] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe0e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.696] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f20, lpOverlapped=0x0) returned 1 [0047.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.696] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.696] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.696] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.696] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.697] CloseHandle (hObject=0x104) returned 1 [0047.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0047.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.697] GetLastError () returned 0x0 [0047.698] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.698] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.698] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.698] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16769950540) returned 1 [0047.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab3df6f0, dwHighDateTime=0x1d585b4)) [0047.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bf0 [0047.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1bf0 | out: hHeap=0x260000) returned 1 [0047.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f210 [0047.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.699] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.699] GetLastError () returned 0x0 [0047.699] GetLastError () returned 0x0 [0047.699] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.699] GetLastError () returned 0x0 [0047.699] GetLastError () returned 0x0 [0047.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff8d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.701] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x728, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x728, lpOverlapped=0x0) returned 1 [0047.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.701] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.701] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.701] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.701] CloseHandle (hObject=0x104) returned 1 [0047.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0047.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0047.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.702] GetLastError () returned 0x0 [0047.703] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.703] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.703] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.704] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16770474382) returned 1 [0047.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab3df6f0, dwHighDateTime=0x1d585b4)) [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c28 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1c28 | out: hHeap=0x260000) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f2a8 [0047.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.704] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.704] GetLastError () returned 0x0 [0047.704] GetLastError () returned 0x0 [0047.704] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.704] GetLastError () returned 0x0 [0047.705] GetLastError () returned 0x0 [0047.784] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff9924, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.784] WriteFile (in: hFile=0x104, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x66dc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x66dc, lpOverlapped=0x0) returned 1 [0047.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0047.786] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.787] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.787] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.787] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.787] CloseHandle (hObject=0x104) returned 1 [0047.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.788] GetLastError () returned 0x0 [0047.851] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.860] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.860] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.860] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16786156459) returned 1 [0047.860] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab55c4b0, dwHighDateTime=0x1d585b4)) [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f06e8 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f06e8 | out: hHeap=0x260000) returned 1 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fb90 [0047.862] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.862] GetLastError () returned 0x0 [0047.868] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe28c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.868] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1d74, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d74, lpOverlapped=0x0) returned 1 [0047.868] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.868] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.868] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.868] CloseHandle (hObject=0x104) returned 1 [0047.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.869] GetLastError () returned 0x0 [0047.870] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.870] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.870] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.871] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16787164779) returned 1 [0047.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab582610, dwHighDateTime=0x1d585b4)) [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0720 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0720 | out: hHeap=0x260000) returned 1 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f768 [0047.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.871] GetLastError () returned 0x0 [0047.871] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.871] GetLastError () returned 0x0 [0047.873] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffedfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.873] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1204, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1204, lpOverlapped=0x0) returned 1 [0047.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.873] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.873] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.873] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.873] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.873] CloseHandle (hObject=0x104) returned 1 [0047.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.874] GetLastError () returned 0x0 [0047.874] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.875] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.875] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.875] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16787644643) returned 1 [0047.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab582610, dwHighDateTime=0x1d585b4)) [0047.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0758 [0047.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0758 | out: hHeap=0x260000) returned 1 [0047.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fcc0 [0047.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.876] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.876] GetLastError () returned 0x0 [0047.876] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.876] GetLastError () returned 0x0 [0047.878] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.878] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xc48, lpOverlapped=0x0) returned 1 [0047.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.878] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.878] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.878] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.878] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.878] CloseHandle (hObject=0x104) returned 1 [0047.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.879] GetLastError () returned 0x0 [0047.880] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.881] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.881] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16788181779) returned 1 [0047.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab5a8770, dwHighDateTime=0x1d585b4)) [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0790 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0790 | out: hHeap=0x260000) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fd58 [0047.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.881] GetLastError () returned 0x0 [0047.881] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.881] GetLastError () returned 0x0 [0047.883] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe20c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.883] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1df4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1df4, lpOverlapped=0x0) returned 1 [0047.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.883] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.883] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.883] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.883] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.883] CloseHandle (hObject=0x104) returned 1 [0047.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.884] GetLastError () returned 0x0 [0047.885] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.885] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.885] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.885] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16788656461) returned 1 [0047.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab5a8770, dwHighDateTime=0x1d585b4)) [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f07c8 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f07c8 | out: hHeap=0x260000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fdf0 [0047.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.886] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.886] GetLastError () returned 0x0 [0047.886] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.886] GetLastError () returned 0x0 [0047.888] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffded4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.888] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x212c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x212c, lpOverlapped=0x0) returned 1 [0047.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.888] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.888] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.888] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.888] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.888] CloseHandle (hObject=0x104) returned 1 [0047.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0047.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0047.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0047.889] GetLastError () returned 0x0 [0047.889] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0047.890] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0047.890] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0047.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0047.890] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16789125156) returned 1 [0047.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab5a8770, dwHighDateTime=0x1d585b4)) [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0800 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0047.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0800 | out: hHeap=0x260000) returned 1 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0047.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0047.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0047.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0047.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fe88 [0047.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0047.891] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0047.891] GetLastError () returned 0x0 [0047.891] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0047.891] GetLastError () returned 0x0 [0047.896] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe184, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.896] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1e7c, lpOverlapped=0x0) returned 1 [0047.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0047.897] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.897] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0047.897] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0047.897] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0047.897] CloseHandle (hObject=0x104) returned 1 [0047.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0047.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.039] GetLastError () returned 0x0 [0048.039] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.039] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.040] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.040] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16804079405) returned 1 [0048.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab725530, dwHighDateTime=0x1d585b4)) [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0bf0 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0bf0 | out: hHeap=0x260000) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320e80 [0048.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.040] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.040] GetLastError () returned 0x0 [0048.040] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.040] GetLastError () returned 0x0 [0048.043] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff4484, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.044] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xbb7c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xbb7c, lpOverlapped=0x0) returned 1 [0048.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.044] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.044] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.044] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.044] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.044] CloseHandle (hObject=0x104) returned 1 [0048.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.045] GetLastError () returned 0x0 [0048.045] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.046] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.046] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.046] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16804740820) returned 1 [0048.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab725530, dwHighDateTime=0x1d585b4)) [0048.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0c28 [0048.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0c28 | out: hHeap=0x260000) returned 1 [0048.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320fb0 [0048.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.047] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.047] GetLastError () returned 0x0 [0048.047] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.047] GetLastError () returned 0x0 [0048.049] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff62f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.049] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9d0e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x9d0e, lpOverlapped=0x0) returned 1 [0048.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.049] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.049] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.050] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.050] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.050] CloseHandle (hObject=0x104) returned 1 [0048.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.050] GetLastError () returned 0x0 [0048.051] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.051] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.051] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.052] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16805268522) returned 1 [0048.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab74b690, dwHighDateTime=0x1d585b4)) [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0c60 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0c60 | out: hHeap=0x260000) returned 1 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321048 [0048.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.052] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.052] GetLastError () returned 0x0 [0048.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.052] GetLastError () returned 0x0 [0048.055] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff4556, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.055] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xbaaa, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xbaaa, lpOverlapped=0x0) returned 1 [0048.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.055] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.055] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.055] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.055] CloseHandle (hObject=0x104) returned 1 [0048.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.056] GetLastError () returned 0x0 [0048.056] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.057] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.057] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16805843479) returned 1 [0048.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab74b690, dwHighDateTime=0x1d585b4)) [0048.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0c98 [0048.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0c98 | out: hHeap=0x260000) returned 1 [0048.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3210e0 [0048.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.058] GetLastError () returned 0x0 [0048.058] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.058] GetLastError () returned 0x0 [0048.059] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc734, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.059] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x38cc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x38cc, lpOverlapped=0x0) returned 1 [0048.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.060] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.060] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.060] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.060] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.060] CloseHandle (hObject=0x104) returned 1 [0048.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.061] GetLastError () returned 0x0 [0048.063] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.064] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.064] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16806514726) returned 1 [0048.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab7717f0, dwHighDateTime=0x1d585b4)) [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0cd0 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0cd0 | out: hHeap=0x260000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321178 [0048.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.065] GetLastError () returned 0x0 [0048.065] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.065] GetLastError () returned 0x0 [0048.066] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffafb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.066] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x504a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x504a, lpOverlapped=0x0) returned 1 [0048.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.067] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.067] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.067] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.067] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.067] CloseHandle (hObject=0x104) returned 1 [0048.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ed88 [0048.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ed88 | out: hHeap=0x260000) returned 1 [0048.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.068] GetLastError () returned 0x0 [0048.068] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.069] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.069] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.069] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16807015832) returned 1 [0048.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab7717f0, dwHighDateTime=0x1d585b4)) [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0d08 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0d08 | out: hHeap=0x260000) returned 1 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319ba0 [0048.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321210 [0048.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319ba0 | out: hHeap=0x260000) returned 1 [0048.070] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.070] GetLastError () returned 0x0 [0048.070] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.070] GetLastError () returned 0x0 [0048.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe0e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.180] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1f1e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f1e, lpOverlapped=0x0) returned 1 [0048.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0048.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.180] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.180] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.180] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.180] CloseHandle (hObject=0x104) returned 1 [0048.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.181] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.181] GetLastError () returned 0x0 [0048.195] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.196] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.196] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.196] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16819700409) returned 1 [0048.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab8a22f0, dwHighDateTime=0x1d585b4)) [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1088 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1088 | out: hHeap=0x260000) returned 1 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3212a8 [0048.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.196] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.197] GetLastError () returned 0x0 [0048.197] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.197] GetLastError () returned 0x0 [0048.199] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe07a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.199] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1f86, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f86, lpOverlapped=0x0) returned 1 [0048.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.200] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.200] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.200] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.200] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.200] CloseHandle (hObject=0xf8) returned 1 [0048.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.201] GetLastError () returned 0x0 [0048.201] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.202] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.202] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16820332682) returned 1 [0048.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab8a22f0, dwHighDateTime=0x1d585b4)) [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f10c0 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f10c0 | out: hHeap=0x260000) returned 1 [0048.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321f20 [0048.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.203] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.203] GetLastError () returned 0x0 [0048.203] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.203] GetLastError () returned 0x0 [0048.204] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdba8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.204] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2458, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2458, lpOverlapped=0x0) returned 1 [0048.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.205] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.205] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.205] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.205] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.205] CloseHandle (hObject=0xf8) returned 1 [0048.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0048.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0048.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.206] GetLastError () returned 0x0 [0048.206] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.207] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.207] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.207] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16820814861) returned 1 [0048.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab8c8450, dwHighDateTime=0x1d585b4)) [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f10f8 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f10f8 | out: hHeap=0x260000) returned 1 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321fb8 [0048.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.208] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.208] GetLastError () returned 0x0 [0048.208] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.208] GetLastError () returned 0x0 [0048.230] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff048, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.230] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xfb8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xfb8, lpOverlapped=0x0) returned 1 [0048.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.231] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.231] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.231] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.231] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.231] CloseHandle (hObject=0xf8) returned 1 [0048.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.232] GetLastError () returned 0x0 [0048.233] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.234] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.234] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.234] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16823502643) returned 1 [0048.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab8ee5b0, dwHighDateTime=0x1d585b4)) [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f11d8 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f11d8 | out: hHeap=0x260000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322050 [0048.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.234] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.235] GetLastError () returned 0x0 [0048.235] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.235] GetLastError () returned 0x0 [0048.236] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff938, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.236] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x6c8, lpOverlapped=0x0) returned 1 [0048.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.236] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.237] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.237] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.237] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.237] CloseHandle (hObject=0xf8) returned 1 [0048.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.238] GetLastError () returned 0x0 [0048.238] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.239] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.239] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16824004544) returned 1 [0048.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab914710, dwHighDateTime=0x1d585b4)) [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1210 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1210 | out: hHeap=0x260000) returned 1 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3222b0 [0048.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.240] GetLastError () returned 0x0 [0048.240] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.240] GetLastError () returned 0x0 [0048.241] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffcf3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.241] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x30c2, lpOverlapped=0x0) returned 1 [0048.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.241] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.242] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.242] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.242] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.242] CloseHandle (hObject=0xf8) returned 1 [0048.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.242] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.243] GetLastError () returned 0x0 [0048.244] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.244] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.244] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.244] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16824561810) returned 1 [0048.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab914710, dwHighDateTime=0x1d585b4)) [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1248 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1248 | out: hHeap=0x260000) returned 1 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322348 [0048.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.245] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.245] GetLastError () returned 0x0 [0048.245] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.245] GetLastError () returned 0x0 [0048.268] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff604, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.268] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9fc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x9fc, lpOverlapped=0x0) returned 1 [0048.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.269] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.270] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.270] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.270] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.270] CloseHandle (hObject=0xf8) returned 1 [0048.270] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.271] GetLastError () returned 0x0 [0048.271] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.272] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.272] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.272] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16827292461) returned 1 [0048.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xab9609d0, dwHighDateTime=0x1d585b4)) [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1360 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1360 | out: hHeap=0x260000) returned 1 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3223e0 [0048.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.272] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.272] GetLastError () returned 0x0 [0048.272] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.273] GetLastError () returned 0x0 [0048.369] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.369] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xec4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xec4, lpOverlapped=0x0) returned 1 [0048.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.369] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.369] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.370] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.370] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.370] CloseHandle (hObject=0xf8) returned 1 [0048.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.371] GetLastError () returned 0x0 [0048.371] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.372] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.372] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16837283947) returned 1 [0048.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba45210, dwHighDateTime=0x1d585b4)) [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8668 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8668 | out: hHeap=0x260000) returned 1 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322de8 [0048.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.372] GetLastError () returned 0x0 [0048.372] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.372] GetLastError () returned 0x0 [0048.374] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffbec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.374] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x414, lpOverlapped=0x0) returned 1 [0048.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.374] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.374] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.374] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.374] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.374] CloseHandle (hObject=0xf8) returned 1 [0048.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.375] GetLastError () returned 0x0 [0048.375] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.376] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.376] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.376] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16837760205) returned 1 [0048.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba6b370, dwHighDateTime=0x1d585b4)) [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d86a0 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d86a0 | out: hHeap=0x260000) returned 1 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322f18 [0048.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.377] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.377] GetLastError () returned 0x0 [0048.377] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.377] GetLastError () returned 0x0 [0048.379] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff78a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.379] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x876, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x876, lpOverlapped=0x0) returned 1 [0048.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.379] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.379] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.379] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.379] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.379] CloseHandle (hObject=0xf8) returned 1 [0048.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.380] GetLastError () returned 0x0 [0048.381] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.382] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.382] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.382] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16838306324) returned 1 [0048.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba6b370, dwHighDateTime=0x1d585b4)) [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d86d8 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d86d8 | out: hHeap=0x260000) returned 1 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322fb0 [0048.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.383] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.383] GetLastError () returned 0x0 [0048.383] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.383] GetLastError () returned 0x0 [0048.384] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff950, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.384] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x6b0, lpOverlapped=0x0) returned 1 [0048.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.385] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.385] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.385] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.385] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.385] CloseHandle (hObject=0xf8) returned 1 [0048.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.386] GetLastError () returned 0x0 [0048.386] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.387] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.387] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.387] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16838818532) returned 1 [0048.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba6b370, dwHighDateTime=0x1d585b4)) [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8710 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8710 | out: hHeap=0x260000) returned 1 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323048 [0048.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.388] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.388] GetLastError () returned 0x0 [0048.388] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.388] GetLastError () returned 0x0 [0048.390] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffdf52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.390] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x20ae, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x20ae, lpOverlapped=0x0) returned 1 [0048.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.390] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.390] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.390] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.390] CloseHandle (hObject=0xf8) returned 1 [0048.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.391] GetLastError () returned 0x0 [0048.392] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.392] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.392] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.392] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16839354868) returned 1 [0048.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba914d0, dwHighDateTime=0x1d585b4)) [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8748 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8748 | out: hHeap=0x260000) returned 1 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3230e0 [0048.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.393] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.393] GetLastError () returned 0x0 [0048.393] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.393] GetLastError () returned 0x0 [0048.395] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffec90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.395] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1370, lpOverlapped=0x0) returned 1 [0048.395] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.395] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.395] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.395] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.395] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.395] CloseHandle (hObject=0xf8) returned 1 [0048.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.396] GetLastError () returned 0x0 [0048.397] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.398] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.398] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.398] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16839885996) returned 1 [0048.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba914d0, dwHighDateTime=0x1d585b4)) [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8780 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8780 | out: hHeap=0x260000) returned 1 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323178 [0048.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.398] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.398] GetLastError () returned 0x0 [0048.398] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.398] GetLastError () returned 0x0 [0048.400] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffce0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.400] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x31f4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x31f4, lpOverlapped=0x0) returned 1 [0048.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.400] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.400] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.401] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.401] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.401] CloseHandle (hObject=0xf8) returned 1 [0048.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.402] GetLastError () returned 0x0 [0048.402] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0048.403] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.403] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0048.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0048.403] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16840383724) returned 1 [0048.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaba914d0, dwHighDateTime=0x1d585b4)) [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d87b8 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d87b8 | out: hHeap=0x260000) returned 1 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323210 [0048.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.403] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.403] GetLastError () returned 0x0 [0048.403] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.403] GetLastError () returned 0x0 [0048.513] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff3e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.513] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xc20, lpOverlapped=0x0) returned 1 [0048.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.514] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.514] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.514] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.514] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.514] CloseHandle (hObject=0xf8) returned 1 [0048.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0048.515] GetLastError () returned 0x0 [0048.568] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0048.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.569] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.569] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16857028189) returned 1 [0048.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabc343f0, dwHighDateTime=0x1d585b4)) [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8dd8 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8dd8 | out: hHeap=0x260000) returned 1 [0048.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324218 [0048.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.570] GetLastError () returned 0x0 [0048.570] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.570] GetLastError () returned 0x0 [0048.572] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff68a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.572] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x976, lpOverlapped=0x0) returned 1 [0048.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.572] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.572] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.572] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.572] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.573] CloseHandle (hObject=0x10c) returned 1 [0048.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.573] GetLastError () returned 0x0 [0048.574] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0048.574] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.574] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.575] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16857570924) returned 1 [0048.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabc343f0, dwHighDateTime=0x1d585b4)) [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8e10 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8e10 | out: hHeap=0x260000) returned 1 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323e88 [0048.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.575] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.575] GetLastError () returned 0x0 [0048.575] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.575] GetLastError () returned 0x0 [0048.577] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff8c44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.577] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x73bc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x73bc, lpOverlapped=0x0) returned 1 [0048.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.577] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.577] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.578] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.578] CloseHandle (hObject=0x10c) returned 1 [0048.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.579] GetLastError () returned 0x0 [0048.580] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0048.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.580] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.580] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16858315022) returned 1 [0048.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabc5a550, dwHighDateTime=0x1d585b4)) [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8e48 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0048.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8e48 | out: hHeap=0x260000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324348 [0048.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.583] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.583] GetLastError () returned 0x0 [0048.583] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.583] GetLastError () returned 0x0 [0048.584] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff57e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.584] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xa82, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xa82, lpOverlapped=0x0) returned 1 [0048.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.584] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.585] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.585] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.585] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.585] CloseHandle (hObject=0x10c) returned 1 [0048.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.586] GetLastError () returned 0x0 [0048.586] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0048.587] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.587] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.587] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16858785044) returned 1 [0048.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabc5a550, dwHighDateTime=0x1d585b4)) [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8e80 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0048.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8e80 | out: hHeap=0x260000) returned 1 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3243e0 [0048.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.587] GetLastError () returned 0x0 [0048.587] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.587] GetLastError () returned 0x0 [0048.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff4f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.589] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb10, lpOverlapped=0x0) returned 1 [0048.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.589] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.589] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.589] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.589] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.589] CloseHandle (hObject=0x10c) returned 1 [0048.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.590] GetLastError () returned 0x0 [0048.590] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0048.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.591] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.591] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16859247580) returned 1 [0048.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabc5a550, dwHighDateTime=0x1d585b4)) [0048.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8eb8 [0048.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0048.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8eb8 | out: hHeap=0x260000) returned 1 [0048.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0048.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324478 [0048.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.592] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.592] GetLastError () returned 0x0 [0048.592] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.592] GetLastError () returned 0x0 [0048.594] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff6baa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.594] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9456, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x9456, lpOverlapped=0x0) returned 1 [0048.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.594] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.594] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.594] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.594] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.595] CloseHandle (hObject=0x10c) returned 1 [0048.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.595] GetLastError () returned 0x0 [0048.596] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3128b8) returned 1 [0048.596] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0048.596] CryptReleaseContext (hProv=0x3128b8, dwFlags=0x0) returned 1 [0048.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.597] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16859776332) returned 1 [0048.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabc806b0, dwHighDateTime=0x1d585b4)) [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8ef0 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8ef0 | out: hHeap=0x260000) returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324510 [0048.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.597] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.597] GetLastError () returned 0x0 [0048.597] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.597] GetLastError () returned 0x0 [0048.718] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff63a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.718] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x9c5e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x9c5e, lpOverlapped=0x0) returned 1 [0048.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.718] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.718] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.718] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.718] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.719] CloseHandle (hObject=0x10c) returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.727] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.727] GetLastError () returned 0x0 [0048.727] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.728] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.728] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.728] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16872948478) returned 1 [0048.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdb11b0, dwHighDateTime=0x1d585b4)) [0048.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.728] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338268 [0048.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338268 | out: hHeap=0x260000) returned 1 [0048.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324f18 [0048.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.729] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.729] GetLastError () returned 0x0 [0048.729] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.729] GetLastError () returned 0x0 [0048.731] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff524, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.731] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xadc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xadc, lpOverlapped=0x0) returned 1 [0048.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.731] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.731] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.731] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.731] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.732] CloseHandle (hObject=0x10c) returned 1 [0048.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.732] GetLastError () returned 0x0 [0048.733] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.733] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.733] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.734] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16873469207) returned 1 [0048.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdb11b0, dwHighDateTime=0x1d585b4)) [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9200 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9200 | out: hHeap=0x260000) returned 1 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325048 [0048.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.734] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.734] GetLastError () returned 0x0 [0048.734] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.734] GetLastError () returned 0x0 [0048.736] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff514, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.736] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xaec, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xaec, lpOverlapped=0x0) returned 1 [0048.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.736] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.736] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.736] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.736] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.737] CloseHandle (hObject=0x10c) returned 1 [0048.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.738] GetLastError () returned 0x0 [0048.738] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.738] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.738] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.739] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16873976565) returned 1 [0048.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdd7310, dwHighDateTime=0x1d585b4)) [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9238 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9238 | out: hHeap=0x260000) returned 1 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3250e0 [0048.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.739] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.739] GetLastError () returned 0x0 [0048.739] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.739] GetLastError () returned 0x0 [0048.741] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff470, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.741] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb90, lpOverlapped=0x0) returned 1 [0048.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.741] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.741] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.741] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.742] CloseHandle (hObject=0x10c) returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.742] GetLastError () returned 0x0 [0048.743] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.743] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.743] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.743] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16874461075) returned 1 [0048.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdd7310, dwHighDateTime=0x1d585b4)) [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9270 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9270 | out: hHeap=0x260000) returned 1 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325178 [0048.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.744] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.744] GetLastError () returned 0x0 [0048.744] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.744] GetLastError () returned 0x0 [0048.746] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff470, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.746] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb90, lpOverlapped=0x0) returned 1 [0048.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.746] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.746] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.746] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.747] CloseHandle (hObject=0x10c) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.747] GetLastError () returned 0x0 [0048.748] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.749] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.749] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16875027684) returned 1 [0048.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdd7310, dwHighDateTime=0x1d585b4)) [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d92a8 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d92a8 | out: hHeap=0x260000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325210 [0048.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.750] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.750] GetLastError () returned 0x0 [0048.750] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.750] GetLastError () returned 0x0 [0048.752] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff1fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.752] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xe04, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xe04, lpOverlapped=0x0) returned 1 [0048.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.752] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.752] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.752] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.752] CloseHandle (hObject=0x10c) returned 1 [0048.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.753] GetLastError () returned 0x0 [0048.753] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.754] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.754] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16875549913) returned 1 [0048.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdfd470, dwHighDateTime=0x1d585b4)) [0048.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d92e0 [0048.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d92e0 | out: hHeap=0x260000) returned 1 [0048.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3252a8 [0048.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.755] GetLastError () returned 0x0 [0048.755] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.755] GetLastError () returned 0x0 [0048.757] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff74c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.757] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x8b4, lpOverlapped=0x0) returned 1 [0048.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.757] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.757] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.757] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.757] CloseHandle (hObject=0x10c) returned 1 [0048.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.758] GetLastError () returned 0x0 [0048.758] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310b80) returned 1 [0048.759] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0048.759] CryptReleaseContext (hProv=0x310b80, dwFlags=0x0) returned 1 [0048.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0048.759] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16876033345) returned 1 [0048.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xabdfd470, dwHighDateTime=0x1d585b4)) [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9318 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0048.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9318 | out: hHeap=0x260000) returned 1 [0048.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0048.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0048.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0048.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0048.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325340 [0048.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0048.760] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0048.760] GetLastError () returned 0x0 [0048.760] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0048.760] GetLastError () returned 0x0 [0048.867] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff704, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.867] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x8fc, lpOverlapped=0x0) returned 1 [0048.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0048.869] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.869] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0048.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0048.872] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0048.872] CloseHandle (hObject=0x10c) returned 1 [0048.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0048.872] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0048.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0048.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0048.960] GetLastError () returned 0x0 [0049.050] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.057] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.058] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16905872176) returned 1 [0049.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac0d0e90, dwHighDateTime=0x1d585b4)) [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327180 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327180 | out: hHeap=0x260000) returned 1 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebf48 [0049.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.058] GetLastError () returned 0x0 [0049.058] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.058] GetLastError () returned 0x0 [0049.061] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe4e6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.061] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1b1a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b1a, lpOverlapped=0x0) returned 1 [0049.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.061] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.061] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.061] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.062] CloseHandle (hObject=0x104) returned 1 [0049.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.063] GetLastError () returned 0x0 [0049.063] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.064] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.064] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16906537162) returned 1 [0049.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac0f6ff0, dwHighDateTime=0x1d585b4)) [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3271b8 [0049.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3271b8 | out: hHeap=0x260000) returned 1 [0049.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebf48 [0049.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.065] GetLastError () returned 0x0 [0049.065] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.065] GetLastError () returned 0x0 [0049.067] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb8ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.067] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x4712, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x4712, lpOverlapped=0x0) returned 1 [0049.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.067] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.067] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.067] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.067] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.067] CloseHandle (hObject=0x104) returned 1 [0049.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.068] GetLastError () returned 0x0 [0049.068] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.069] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.069] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.069] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16907056351) returned 1 [0049.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac0f6ff0, dwHighDateTime=0x1d585b4)) [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3271f0 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3271f0 | out: hHeap=0x260000) returned 1 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec078 [0049.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.070] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.070] GetLastError () returned 0x0 [0049.070] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.070] GetLastError () returned 0x0 [0049.072] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff4922, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.072] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xb6de, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb6de, lpOverlapped=0x0) returned 1 [0049.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.072] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.072] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.073] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.073] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.073] CloseHandle (hObject=0x104) returned 1 [0049.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.074] GetLastError () returned 0x0 [0049.074] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.074] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.075] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16907573061) returned 1 [0049.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac0f6ff0, dwHighDateTime=0x1d585b4)) [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327228 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327228 | out: hHeap=0x260000) returned 1 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec110 [0049.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.075] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.075] GetLastError () returned 0x0 [0049.075] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.075] GetLastError () returned 0x0 [0049.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe84c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.077] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x17b4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x17b4, lpOverlapped=0x0) returned 1 [0049.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.077] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.077] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.078] CloseHandle (hObject=0x104) returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.079] GetLastError () returned 0x0 [0049.079] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.080] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.080] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.080] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16908100819) returned 1 [0049.080] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac11d150, dwHighDateTime=0x1d585b4)) [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327260 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327260 | out: hHeap=0x260000) returned 1 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec1a8 [0049.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.080] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.080] GetLastError () returned 0x0 [0049.081] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.081] GetLastError () returned 0x0 [0049.082] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff016, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.082] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xfea, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0xfea, lpOverlapped=0x0) returned 1 [0049.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.082] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.082] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.082] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.083] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.083] CloseHandle (hObject=0x104) returned 1 [0049.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.084] GetLastError () returned 0x0 [0049.084] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.085] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.085] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0049.085] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16908585717) returned 1 [0049.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac11d150, dwHighDateTime=0x1d585b4)) [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327298 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327298 | out: hHeap=0x260000) returned 1 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec240 [0049.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.085] GetLastError () returned 0x0 [0049.085] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.086] GetLastError () returned 0x0 [0049.137] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffde98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.137] WriteFile (in: hFile=0x104, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2168, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x2168, lpOverlapped=0x0) returned 1 [0049.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.138] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.138] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.138] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.138] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.138] CloseHandle (hObject=0x104) returned 1 [0049.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.139] GetLastError () returned 0x0 [0049.153] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.153] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.153] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.153] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16915455280) returned 1 [0049.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac1b56d0, dwHighDateTime=0x1d585b4)) [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327420 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327420 | out: hHeap=0x260000) returned 1 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec538 [0049.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.154] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.154] GetLastError () returned 0x0 [0049.154] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.154] GetLastError () returned 0x0 [0049.157] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffec16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.157] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x13ea, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13ea, lpOverlapped=0x0) returned 1 [0049.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.159] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.159] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.159] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.159] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.159] CloseHandle (hObject=0x108) returned 1 [0049.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.160] GetLastError () returned 0x0 [0049.160] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.161] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.161] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16916212902) returned 1 [0049.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac1db830, dwHighDateTime=0x1d585b4)) [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327458 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327458 | out: hHeap=0x260000) returned 1 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec798 [0049.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.162] GetLastError () returned 0x0 [0049.162] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.162] GetLastError () returned 0x0 [0049.164] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdd22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.164] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x22de, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x22de, lpOverlapped=0x0) returned 1 [0049.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.165] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.165] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.165] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.165] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.165] CloseHandle (hObject=0x108) returned 1 [0049.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.166] GetLastError () returned 0x0 [0049.166] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.167] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.167] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.167] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16916808866) returned 1 [0049.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac1db830, dwHighDateTime=0x1d585b4)) [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327490 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327490 | out: hHeap=0x260000) returned 1 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec830 [0049.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.167] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.168] GetLastError () returned 0x0 [0049.168] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.168] GetLastError () returned 0x0 [0049.171] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffbc02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.171] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x43fe, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x43fe, lpOverlapped=0x0) returned 1 [0049.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.171] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.171] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.172] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.172] CloseHandle (hObject=0x108) returned 1 [0049.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0049.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0049.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.173] GetLastError () returned 0x0 [0049.173] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.174] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.174] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.174] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16917502444) returned 1 [0049.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac201990, dwHighDateTime=0x1d585b4)) [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3274c8 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3274c8 | out: hHeap=0x260000) returned 1 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec8c8 [0049.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.174] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.175] GetLastError () returned 0x0 [0049.175] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.175] GetLastError () returned 0x0 [0049.176] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffa40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.176] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5c0, lpOverlapped=0x0) returned 1 [0049.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.176] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.176] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.176] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.177] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.177] CloseHandle (hObject=0x108) returned 1 [0049.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0049.177] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0049.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.177] GetLastError () returned 0x0 [0049.178] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.179] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.179] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.179] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16918013006) returned 1 [0049.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac201990, dwHighDateTime=0x1d585b4)) [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327500 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327500 | out: hHeap=0x260000) returned 1 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec960 [0049.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.180] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.180] GetLastError () returned 0x0 [0049.180] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.180] GetLastError () returned 0x0 [0049.181] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffeb74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.181] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x148c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x148c, lpOverlapped=0x0) returned 1 [0049.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.181] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.181] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.182] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.182] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.182] CloseHandle (hObject=0x108) returned 1 [0049.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f0a8 [0049.182] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f0a8 | out: hHeap=0x260000) returned 1 [0049.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.183] GetLastError () returned 0x0 [0049.183] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.184] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.184] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16918482466) returned 1 [0049.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac201990, dwHighDateTime=0x1d585b4)) [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327538 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327538 | out: hHeap=0x260000) returned 1 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336aa0 [0049.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec9f8 [0049.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336aa0 | out: hHeap=0x260000) returned 1 [0049.184] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.184] GetLastError () returned 0x0 [0049.184] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.184] GetLastError () returned 0x0 [0049.386] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffc80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.387] WriteFile (in: hFile=0x108, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x380, lpOverlapped=0x0) returned 1 [0049.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.387] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.387] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.387] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.387] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.388] CloseHandle (hObject=0x108) returned 1 [0049.388] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.388] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0049.470] GetLastError () returned 0x0 [0049.547] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.577] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.577] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16957808511) returned 1 [0049.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac5dfd50, dwHighDateTime=0x1d585b4)) [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329af0 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329af0 | out: hHeap=0x260000) returned 1 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328340 [0049.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.578] GetLastError () returned 0x0 [0049.578] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.578] GetLastError () returned 0x0 [0049.581] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffedcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.581] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1234, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1234, lpOverlapped=0x0) returned 1 [0049.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.582] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.582] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.582] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.582] CloseHandle (hObject=0x10c) returned 1 [0049.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.583] GetLastError () returned 0x0 [0049.583] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.584] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.584] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.584] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16958535242) returned 1 [0049.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac5dfd50, dwHighDateTime=0x1d585b4)) [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329b28 [0049.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329b28 | out: hHeap=0x260000) returned 1 [0049.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327af0 [0049.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.585] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.585] GetLastError () returned 0x0 [0049.585] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.585] GetLastError () returned 0x0 [0049.586] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff32a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.586] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xcd6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xcd6, lpOverlapped=0x0) returned 1 [0049.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.587] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.587] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.587] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.587] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.587] CloseHandle (hObject=0x10c) returned 1 [0049.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.588] GetLastError () returned 0x0 [0049.588] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.589] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.589] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.589] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16959023517) returned 1 [0049.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac5dfd50, dwHighDateTime=0x1d585b4)) [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329b60 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329b60 | out: hHeap=0x260000) returned 1 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328470 [0049.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.590] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.590] GetLastError () returned 0x0 [0049.590] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.590] GetLastError () returned 0x0 [0049.591] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff858, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.591] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x7a8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x7a8, lpOverlapped=0x0) returned 1 [0049.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.592] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.592] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.592] CloseHandle (hObject=0x10c) returned 1 [0049.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.593] GetLastError () returned 0x0 [0049.594] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.594] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.594] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.595] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16959573052) returned 1 [0049.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac605eb0, dwHighDateTime=0x1d585b4)) [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329b98 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329b98 | out: hHeap=0x260000) returned 1 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328508 [0049.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.595] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.595] GetLastError () returned 0x0 [0049.595] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.595] GetLastError () returned 0x0 [0049.597] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff1b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.597] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xe4e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xe4e, lpOverlapped=0x0) returned 1 [0049.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.597] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.597] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.597] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.598] CloseHandle (hObject=0x10c) returned 1 [0049.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.598] GetLastError () returned 0x0 [0049.599] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.599] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.600] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16960070390) returned 1 [0049.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac605eb0, dwHighDateTime=0x1d585b4)) [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329bd0 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0049.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329bd0 | out: hHeap=0x260000) returned 1 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3285a0 [0049.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.600] GetLastError () returned 0x0 [0049.600] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.600] GetLastError () returned 0x0 [0049.638] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff438, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.638] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xbc8, lpOverlapped=0x0) returned 1 [0049.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.639] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.639] WriteFile (in: hFile=0x10c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.639] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.639] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.640] CloseHandle (hObject=0x10c) returned 1 [0049.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.644] GetLastError () returned 0x0 [0049.644] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311268) returned 1 [0049.645] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.645] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0049.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.645] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16964617796) returned 1 [0049.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6782d0, dwHighDateTime=0x1d585b4)) [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329d58 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329d58 | out: hHeap=0x260000) returned 1 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328638 [0049.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.646] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.646] GetLastError () returned 0x0 [0049.646] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.646] GetLastError () returned 0x0 [0049.648] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff17a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.648] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xe86, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xe86, lpOverlapped=0x0) returned 1 [0049.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.649] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.649] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.649] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.649] CloseHandle (hObject=0xf8) returned 1 [0049.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0049.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.650] GetLastError () returned 0x0 [0049.650] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311268) returned 1 [0049.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.651] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0049.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.651] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16965228121) returned 1 [0049.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6782d0, dwHighDateTime=0x1d585b4)) [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329d90 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329d90 | out: hHeap=0x260000) returned 1 [0049.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328a60 [0049.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.652] GetLastError () returned 0x0 [0049.652] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.652] GetLastError () returned 0x0 [0049.653] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffa44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.653] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5bc, lpOverlapped=0x0) returned 1 [0049.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.654] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.654] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.654] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.654] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.654] CloseHandle (hObject=0xf8) returned 1 [0049.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0049.654] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0049.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.655] GetLastError () returned 0x0 [0049.655] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311268) returned 1 [0049.656] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.656] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0049.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.656] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16965733858) returned 1 [0049.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac69e430, dwHighDateTime=0x1d585b4)) [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329dc8 [0049.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329dc8 | out: hHeap=0x260000) returned 1 [0049.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328af8 [0049.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.657] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.657] GetLastError () returned 0x0 [0049.657] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.657] GetLastError () returned 0x0 [0049.658] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffffa88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.658] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x578, lpOverlapped=0x0) returned 1 [0049.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.659] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.659] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.659] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.659] CloseHandle (hObject=0xf8) returned 1 [0049.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0049.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0049.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.660] GetLastError () returned 0x0 [0049.661] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311268) returned 1 [0049.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.661] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0049.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.662] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16966265928) returned 1 [0049.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac69e430, dwHighDateTime=0x1d585b4)) [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329e00 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329e00 | out: hHeap=0x260000) returned 1 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328b90 [0049.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.662] GetLastError () returned 0x0 [0049.662] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.662] GetLastError () returned 0x0 [0049.664] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffcea8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.664] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3158, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3158, lpOverlapped=0x0) returned 1 [0049.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.664] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.664] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.664] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.664] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.664] CloseHandle (hObject=0xf8) returned 1 [0049.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0049.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0049.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.665] GetLastError () returned 0x0 [0049.666] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311268) returned 1 [0049.666] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.666] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0049.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.666] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16966750259) returned 1 [0049.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac69e430, dwHighDateTime=0x1d585b4)) [0049.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329e38 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329e38 | out: hHeap=0x260000) returned 1 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328c28 [0049.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.667] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.667] GetLastError () returned 0x0 [0049.667] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.667] GetLastError () returned 0x0 [0049.668] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffd66c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.669] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2994, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2994, lpOverlapped=0x0) returned 1 [0049.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.669] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.669] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.669] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.669] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.669] CloseHandle (hObject=0xf8) returned 1 [0049.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0049.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0049.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.670] GetLastError () returned 0x0 [0049.671] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311268) returned 1 [0049.671] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.671] CryptReleaseContext (hProv=0x311268, dwFlags=0x0) returned 1 [0049.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.671] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16967254012) returned 1 [0049.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6c4590, dwHighDateTime=0x1d585b4)) [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329e70 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329e70 | out: hHeap=0x260000) returned 1 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328cc0 [0049.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.672] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.672] GetLastError () returned 0x0 [0049.672] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.672] GetLastError () returned 0x0 [0049.673] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff7bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.674] WriteFile (in: hFile=0xf8, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x844, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x844, lpOverlapped=0x0) returned 1 [0049.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.674] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.674] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.674] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.674] CloseHandle (hObject=0xf8) returned 1 [0049.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0049.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0049.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.675] GetLastError () returned 0x0 [0049.678] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.679] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.679] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.679] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16968008639) returned 1 [0049.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6c4590, dwHighDateTime=0x1d585b4)) [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ea8 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ea8 | out: hHeap=0x260000) returned 1 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0049.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.679] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.680] GetLastError () returned 0x0 [0049.680] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.680] GetLastError () returned 0x0 [0049.681] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff9e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.681] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x620, lpOverlapped=0x0) returned 1 [0049.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.681] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.681] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.682] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.682] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.682] CloseHandle (hObject=0x100) returned 1 [0049.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.683] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.684] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.684] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.684] GetLastError () returned 0x0 [0049.685] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffd31e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.685] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2ce2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2ce2, lpOverlapped=0x0) returned 1 [0049.686] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.686] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.686] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.686] CloseHandle (hObject=0x100) returned 1 [0049.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.687] GetLastError () returned 0x0 [0049.687] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.688] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.688] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16968976043) returned 1 [0049.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6ea6f0, dwHighDateTime=0x1d585b4)) [0049.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329f18 [0049.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329f18 | out: hHeap=0x260000) returned 1 [0049.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328e88 [0049.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.691] GetLastError () returned 0x0 [0049.691] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.691] GetLastError () returned 0x0 [0049.692] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdbac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.692] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2454, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2454, lpOverlapped=0x0) returned 1 [0049.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.693] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.693] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.693] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.693] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.693] CloseHandle (hObject=0x100) returned 1 [0049.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.694] GetLastError () returned 0x0 [0049.694] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.695] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.695] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.695] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16969645261) returned 1 [0049.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6ea6f0, dwHighDateTime=0x1d585b4)) [0049.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329f50 [0049.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329f50 | out: hHeap=0x260000) returned 1 [0049.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.696] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328f20 [0049.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.696] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.696] GetLastError () returned 0x0 [0049.696] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.696] GetLastError () returned 0x0 [0049.697] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff040, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.698] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0xfc0, lpOverlapped=0x0) returned 1 [0049.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.698] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.698] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.698] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.698] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.698] CloseHandle (hObject=0x100) returned 1 [0049.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.699] GetLastError () returned 0x0 [0049.699] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.700] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.700] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.700] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16970146912) returned 1 [0049.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac6ea6f0, dwHighDateTime=0x1d585b4)) [0049.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc70 [0049.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc70 | out: hHeap=0x260000) returned 1 [0049.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328fb8 [0049.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.701] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.701] GetLastError () returned 0x0 [0049.701] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.701] GetLastError () returned 0x0 [0049.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffef0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.703] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x10f4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x10f4, lpOverlapped=0x0) returned 1 [0049.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.703] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.703] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.703] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.703] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.704] CloseHandle (hObject=0x100) returned 1 [0049.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.704] GetLastError () returned 0x0 [0049.705] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.705] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.705] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.705] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16970656519) returned 1 [0049.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac710850, dwHighDateTime=0x1d585b4)) [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc38 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc38 | out: hHeap=0x260000) returned 1 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329348 [0049.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.706] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.706] GetLastError () returned 0x0 [0049.706] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.706] GetLastError () returned 0x0 [0049.708] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe454, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.708] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1bac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1bac, lpOverlapped=0x0) returned 1 [0049.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.708] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.708] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.708] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.708] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.708] CloseHandle (hObject=0x100) returned 1 [0049.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.709] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.709] GetLastError () returned 0x0 [0049.709] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.710] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0049.710] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0049.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0049.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0049.710] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16971144794) returned 1 [0049.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac710850, dwHighDateTime=0x1d585b4)) [0049.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0049.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0049.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0049.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cc00 [0049.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cc00 | out: hHeap=0x260000) returned 1 [0049.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3293e0 [0049.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.711] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.711] GetLastError () returned 0x0 [0049.711] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.711] GetLastError () returned 0x0 [0049.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe446, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.713] WriteFile (in: hFile=0x100, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x1bba, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1bba, lpOverlapped=0x0) returned 1 [0049.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0049.713] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.713] WriteFile (in: hFile=0x100, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.713] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.713] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.714] CloseHandle (hObject=0x100) returned 1 [0049.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0049.717] GetLastError () returned 0x0 [0049.853] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.854] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.854] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.854] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16985494534) returned 1 [0049.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac8674b0, dwHighDateTime=0x1d585b4)) [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a110 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a110 | out: hHeap=0x260000) returned 1 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32aaf0 [0049.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.854] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.854] GetLastError () returned 0x0 [0049.855] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.855] GetLastError () returned 0x0 [0049.858] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff4e0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.858] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xb20, lpOverlapped=0x0) returned 1 [0049.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.858] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.858] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.858] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.858] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.859] CloseHandle (hObject=0x100) returned 1 [0049.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.859] GetLastError () returned 0x0 [0049.860] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.860] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.860] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.861] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16986174390) returned 1 [0049.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac88d610, dwHighDateTime=0x1d585b4)) [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a148 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a148 | out: hHeap=0x260000) returned 1 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32aaf0 [0049.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.861] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.861] GetLastError () returned 0x0 [0049.861] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.861] GetLastError () returned 0x0 [0049.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff5c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.863] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xa38, lpOverlapped=0x0) returned 1 [0049.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.863] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.863] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.863] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.863] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.864] CloseHandle (hObject=0x100) returned 1 [0049.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.864] GetLastError () returned 0x0 [0049.865] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.866] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.866] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.866] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16986727922) returned 1 [0049.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac88d610, dwHighDateTime=0x1d585b4)) [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a180 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a180 | out: hHeap=0x260000) returned 1 [0049.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ac20 [0049.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.867] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.867] GetLastError () returned 0x0 [0049.867] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.867] GetLastError () returned 0x0 [0049.868] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffff97ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.868] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x6852, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x6852, lpOverlapped=0x0) returned 1 [0049.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.869] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.869] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.869] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.869] CloseHandle (hObject=0x100) returned 1 [0049.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.870] GetLastError () returned 0x0 [0049.870] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.871] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.871] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.871] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16987244241) returned 1 [0049.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac88d610, dwHighDateTime=0x1d585b4)) [0049.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a1b8 [0049.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a1b8 | out: hHeap=0x260000) returned 1 [0049.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32acb8 [0049.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.872] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.872] GetLastError () returned 0x0 [0049.872] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.872] GetLastError () returned 0x0 [0049.874] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff570, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.874] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xa90, lpOverlapped=0x0) returned 1 [0049.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.874] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.874] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.875] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.875] CloseHandle (hObject=0x100) returned 1 [0049.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.876] GetLastError () returned 0x0 [0049.876] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.877] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.877] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.877] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16987793843) returned 1 [0049.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac8b3770, dwHighDateTime=0x1d585b4)) [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a1f0 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a1f0 | out: hHeap=0x260000) returned 1 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ad50 [0049.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.877] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.877] GetLastError () returned 0x0 [0049.878] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.878] GetLastError () returned 0x0 [0049.879] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffad4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.879] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x52c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x52c, lpOverlapped=0x0) returned 1 [0049.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.879] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.879] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.880] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.880] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.880] CloseHandle (hObject=0x100) returned 1 [0049.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.881] GetLastError () returned 0x0 [0049.881] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.882] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.882] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.882] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16988291838) returned 1 [0049.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac8b3770, dwHighDateTime=0x1d585b4)) [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a228 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a228 | out: hHeap=0x260000) returned 1 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0049.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0049.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ade8 [0049.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.882] GetLastError () returned 0x0 [0049.883] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.883] GetLastError () returned 0x0 [0049.884] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe104, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.884] WriteFile (in: hFile=0x100, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1efc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1efc, lpOverlapped=0x0) returned 1 [0049.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0049.884] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.884] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.885] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.885] CloseHandle (hObject=0x100) returned 1 [0049.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0049.885] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0049.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0049.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0049.886] GetLastError () returned 0x0 [0049.994] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0049.995] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0049.995] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0049.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0049.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0049.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0049.995] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=16999646619) returned 1 [0049.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac9be110, dwHighDateTime=0x1d585b4)) [0049.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0049.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0049.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0049.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cca8 [0049.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0049.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cca8 | out: hHeap=0x260000) returned 1 [0049.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0049.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0049.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0049.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0049.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329050 [0049.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0049.996] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0049.996] GetLastError () returned 0x0 [0049.996] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0049.996] GetLastError () returned 0x0 [0049.998] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffea50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0049.998] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x15b0, lpOverlapped=0x0) returned 1 [0049.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0049.999] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.999] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0049.999] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0049.999] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0049.999] CloseHandle (hObject=0x10c) returned 1 [0049.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0049.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.000] GetLastError () returned 0x0 [0050.001] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.002] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.002] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.002] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17000300343) returned 1 [0050.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac9e4270, dwHighDateTime=0x1d585b4)) [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a5a8 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a5a8 | out: hHeap=0x260000) returned 1 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0050.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0050.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32af18 [0050.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.002] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.003] GetLastError () returned 0x0 [0050.003] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.003] GetLastError () returned 0x0 [0050.004] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffce34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.004] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x31cc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x31cc, lpOverlapped=0x0) returned 1 [0050.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.005] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.005] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.005] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.005] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.005] CloseHandle (hObject=0x10c) returned 1 [0050.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.006] GetLastError () returned 0x0 [0050.006] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.007] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.007] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.007] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17000824869) returned 1 [0050.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac9e4270, dwHighDateTime=0x1d585b4)) [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a5e0 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a5e0 | out: hHeap=0x260000) returned 1 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0050.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0050.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b800 [0050.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.008] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.008] GetLastError () returned 0x0 [0050.008] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.008] GetLastError () returned 0x0 [0050.009] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe4f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.009] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x1b08, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b08, lpOverlapped=0x0) returned 1 [0050.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.010] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.010] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.010] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.010] CloseHandle (hObject=0x10c) returned 1 [0050.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.011] GetLastError () returned 0x0 [0050.011] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.012] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.012] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.012] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17001323425) returned 1 [0050.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xac9e4270, dwHighDateTime=0x1d585b4)) [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a618 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a618 | out: hHeap=0x260000) returned 1 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0050.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0050.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b898 [0050.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.013] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.013] GetLastError () returned 0x0 [0050.013] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.013] GetLastError () returned 0x0 [0050.017] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffffb18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.017] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x4e8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x4e8, lpOverlapped=0x0) returned 1 [0050.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.017] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.017] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.018] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.018] CloseHandle (hObject=0x10c) returned 1 [0050.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.019] GetLastError () returned 0x0 [0050.019] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.020] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.020] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.020] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17002101160) returned 1 [0050.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca0a3d0, dwHighDateTime=0x1d585b4)) [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a650 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a650 | out: hHeap=0x260000) returned 1 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0050.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0050.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b930 [0050.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.020] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.021] GetLastError () returned 0x0 [0050.021] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.021] GetLastError () returned 0x0 [0050.022] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffff480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.022] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb80, lpOverlapped=0x0) returned 1 [0050.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.022] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.022] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.023] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.023] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.023] CloseHandle (hObject=0x10c) returned 1 [0050.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f238 [0050.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f238 | out: hHeap=0x260000) returned 1 [0050.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.026] GetLastError () returned 0x0 [0050.026] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.027] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.027] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17002829479) returned 1 [0050.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca0a3d0, dwHighDateTime=0x1d585b4)) [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a688 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a688 | out: hHeap=0x260000) returned 1 [0050.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0050.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0050.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b9c8 [0050.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.028] GetLastError () returned 0x0 [0050.028] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.028] GetLastError () returned 0x0 [0050.037] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffde88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.037] WriteFile (in: hFile=0x10c, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2178, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x2178, lpOverlapped=0x0) returned 1 [0050.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0050.037] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.037] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.037] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.037] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.038] CloseHandle (hObject=0x10c) returned 1 [0050.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0050.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.040] GetLastError () returned 0x0 [0050.041] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.042] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.042] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17004296499) returned 1 [0050.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca30530, dwHighDateTime=0x1d585b4)) [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a6f8 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a6f8 | out: hHeap=0x260000) returned 1 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ba60 [0050.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.042] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.043] GetLastError () returned 0x0 [0050.043] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.043] GetLastError () returned 0x0 [0050.045] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd9fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.045] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2606, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2606, lpOverlapped=0x0) returned 1 [0050.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.048] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.048] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.048] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.048] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.048] CloseHandle (hObject=0x10c) returned 1 [0050.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.049] GetLastError () returned 0x0 [0050.049] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.050] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.050] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17005136928) returned 1 [0050.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca56690, dwHighDateTime=0x1d585b4)) [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a730 [0050.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a730 | out: hHeap=0x260000) returned 1 [0050.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bb90 [0050.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.051] GetLastError () returned 0x0 [0050.051] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.051] GetLastError () returned 0x0 [0050.055] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffda84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.055] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x257c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x257c, lpOverlapped=0x0) returned 1 [0050.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.055] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.055] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.055] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.056] CloseHandle (hObject=0x10c) returned 1 [0050.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.056] GetLastError () returned 0x0 [0050.057] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.057] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.058] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17005868398) returned 1 [0050.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca56690, dwHighDateTime=0x1d585b4)) [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a768 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a768 | out: hHeap=0x260000) returned 1 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bc28 [0050.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.058] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.058] GetLastError () returned 0x0 [0050.058] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.058] GetLastError () returned 0x0 [0050.060] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffbd88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.060] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4278, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x4278, lpOverlapped=0x0) returned 1 [0050.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.060] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.061] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.061] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.061] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.061] CloseHandle (hObject=0x10c) returned 1 [0050.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.062] GetLastError () returned 0x0 [0050.062] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.063] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.063] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.063] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17006412821) returned 1 [0050.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca7c7f0, dwHighDateTime=0x1d585b4)) [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a7a0 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a7a0 | out: hHeap=0x260000) returned 1 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bcc0 [0050.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.064] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.064] GetLastError () returned 0x0 [0050.064] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.064] GetLastError () returned 0x0 [0050.065] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffaaea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.065] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x5516, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5516, lpOverlapped=0x0) returned 1 [0050.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.066] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.066] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.066] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.066] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.066] CloseHandle (hObject=0x10c) returned 1 [0050.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.067] GetLastError () returned 0x0 [0050.068] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.068] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.068] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.069] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17006976827) returned 1 [0050.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca7c7f0, dwHighDateTime=0x1d585b4)) [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a7d8 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a7d8 | out: hHeap=0x260000) returned 1 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bd58 [0050.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.069] GetLastError () returned 0x0 [0050.069] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.069] GetLastError () returned 0x0 [0050.071] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff75ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.071] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x8a12, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x8a12, lpOverlapped=0x0) returned 1 [0050.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.071] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.072] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.072] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.072] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.072] CloseHandle (hObject=0x10c) returned 1 [0050.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f170 [0050.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f170 | out: hHeap=0x260000) returned 1 [0050.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.073] GetLastError () returned 0x0 [0050.073] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.074] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.074] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.074] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17007512202) returned 1 [0050.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaca7c7f0, dwHighDateTime=0x1d585b4)) [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a810 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a810 | out: hHeap=0x260000) returned 1 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32bdf0 [0050.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.075] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.075] GetLastError () returned 0x0 [0050.075] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.075] GetLastError () returned 0x0 [0050.179] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff7d66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.179] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x829a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x829a, lpOverlapped=0x0) returned 1 [0050.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.179] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.179] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.179] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.179] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.180] CloseHandle (hObject=0x10c) returned 1 [0050.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.180] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.181] GetLastError () returned 0x0 [0050.181] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.182] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.182] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17018290599) returned 1 [0050.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacb87190, dwHighDateTime=0x1d585b4)) [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cbd0 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cbd0 | out: hHeap=0x260000) returned 1 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32be88 [0050.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.182] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.182] GetLastError () returned 0x0 [0050.183] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.183] GetLastError () returned 0x0 [0050.184] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb8ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.184] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x4752, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x4752, lpOverlapped=0x0) returned 1 [0050.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.184] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.185] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.185] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.185] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.185] CloseHandle (hObject=0x10c) returned 1 [0050.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.186] GetLastError () returned 0x0 [0050.187] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.187] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.187] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.188] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17018867901) returned 1 [0050.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacbad2f0, dwHighDateTime=0x1d585b4)) [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cc08 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cc08 | out: hHeap=0x260000) returned 1 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c938 [0050.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.188] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.188] GetLastError () returned 0x0 [0050.188] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.188] GetLastError () returned 0x0 [0050.190] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xfffee202, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.190] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x11dfe, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x11dfe, lpOverlapped=0x0) returned 1 [0050.191] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.191] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.191] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.191] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.191] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.192] CloseHandle (hObject=0x10c) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.192] GetLastError () returned 0x0 [0050.193] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.193] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.193] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.194] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17019472820) returned 1 [0050.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacbad2f0, dwHighDateTime=0x1d585b4)) [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cff0 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cff0 | out: hHeap=0x260000) returned 1 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3292b0 [0050.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.194] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.194] GetLastError () returned 0x0 [0050.194] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.194] GetLastError () returned 0x0 [0050.196] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffaa66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.196] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x559a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x559a, lpOverlapped=0x0) returned 1 [0050.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.196] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.196] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.197] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.197] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.197] CloseHandle (hObject=0x10c) returned 1 [0050.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.198] GetLastError () returned 0x0 [0050.198] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.199] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.199] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.199] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17019997132) returned 1 [0050.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacbad2f0, dwHighDateTime=0x1d585b4)) [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cfb8 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cfb8 | out: hHeap=0x260000) returned 1 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x329218 [0050.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.199] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.200] GetLastError () returned 0x0 [0050.200] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.200] GetLastError () returned 0x0 [0050.201] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9a1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.201] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x65e6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x65e6, lpOverlapped=0x0) returned 1 [0050.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.202] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.202] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.202] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.202] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.202] CloseHandle (hObject=0x10c) returned 1 [0050.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.203] GetLastError () returned 0x0 [0050.204] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.204] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.204] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.204] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17020554434) returned 1 [0050.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacbd3450, dwHighDateTime=0x1d585b4)) [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cf80 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cf80 | out: hHeap=0x260000) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327c20 [0050.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.205] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.205] GetLastError () returned 0x0 [0050.205] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.205] GetLastError () returned 0x0 [0050.207] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd252, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.207] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x2dae, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2dae, lpOverlapped=0x0) returned 1 [0050.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.207] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.207] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.207] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.207] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.208] CloseHandle (hObject=0x10c) returned 1 [0050.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.208] GetLastError () returned 0x0 [0050.212] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.212] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.212] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.212] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17021361816) returned 1 [0050.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacbd3450, dwHighDateTime=0x1d585b4)) [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cc40 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cc40 | out: hHeap=0x260000) returned 1 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296be8 [0050.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.213] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.213] GetLastError () returned 0x0 [0050.213] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.213] GetLastError () returned 0x0 [0050.225] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc9ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.225] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3632, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3632, lpOverlapped=0x0) returned 1 [0050.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.227] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.227] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.228] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.228] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.228] CloseHandle (hObject=0x10c) returned 1 [0050.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.233] GetLastError () returned 0x0 [0050.233] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.234] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.234] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.234] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17023483492) returned 1 [0050.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacc1f710, dwHighDateTime=0x1d585b4)) [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ccb0 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ccb0 | out: hHeap=0x260000) returned 1 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0050.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.234] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.234] GetLastError () returned 0x0 [0050.235] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.235] GetLastError () returned 0x0 [0050.237] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffdd86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.237] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x227a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x227a, lpOverlapped=0x0) returned 1 [0050.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.238] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.238] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.238] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.238] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.238] CloseHandle (hObject=0x10c) returned 1 [0050.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.239] GetLastError () returned 0x0 [0050.240] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.240] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.240] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.241] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17024176565) returned 1 [0050.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacc1f710, dwHighDateTime=0x1d585b4)) [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cce8 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cce8 | out: hHeap=0x260000) returned 1 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0050.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.241] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.241] GetLastError () returned 0x0 [0050.241] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.242] GetLastError () returned 0x0 [0050.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc97e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.243] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x3682, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3682, lpOverlapped=0x0) returned 1 [0050.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.243] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.243] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.244] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.244] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.244] CloseHandle (hObject=0x10c) returned 1 [0050.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.245] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.246] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.246] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.246] GetLastError () returned 0x0 [0050.248] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffda39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.248] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x25c7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x25c7, lpOverlapped=0x0) returned 1 [0050.248] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.248] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.248] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.248] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.249] CloseHandle (hObject=0x10c) returned 1 [0050.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.249] GetLastError () returned 0x0 [0050.250] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.250] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.250] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.251] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17025167616) returned 1 [0050.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacc45870, dwHighDateTime=0x1d585b4)) [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cd58 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cd58 | out: hHeap=0x260000) returned 1 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296f78 [0050.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.251] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.251] GetLastError () returned 0x0 [0050.251] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.251] GetLastError () returned 0x0 [0050.253] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff99d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.253] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x6630, lpOverlapped=0x0) returned 1 [0050.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.254] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.254] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.254] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.254] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.254] CloseHandle (hObject=0x10c) returned 1 [0050.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ee50 [0050.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ee50 | out: hHeap=0x260000) returned 1 [0050.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.255] GetLastError () returned 0x0 [0050.255] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.256] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.256] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.256] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.256] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17025732552) returned 1 [0050.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacc45870, dwHighDateTime=0x1d585b4)) [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cd90 [0050.256] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cd90 | out: hHeap=0x260000) returned 1 [0050.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296a20 [0050.257] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.257] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.257] GetLastError () returned 0x0 [0050.257] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.257] GetLastError () returned 0x0 [0050.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffff9466, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.259] WriteFile (in: hFile=0x10c, lpBuffer=0x3382e0*, nNumberOfBytesToWrite=0x6b9a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x3382e0*, lpNumberOfBytesWritten=0x24cfdb0*=0x6b9a, lpOverlapped=0x0) returned 1 [0050.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3382e0 | out: hHeap=0x260000) returned 1 [0050.259] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.259] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.259] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.260] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.260] CloseHandle (hObject=0x10c) returned 1 [0050.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.267] GetLastError () returned 0x0 [0050.299] lstrlenW (lpString=".sql") returned 4 [0050.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".sql") returned 0x0 [0050.306] lstrlenW (lpString=".mdf") returned 4 [0050.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".mdf") returned 0x0 [0050.306] lstrlenW (lpString=".txt") returned 4 [0050.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".txt") returned 0x0 [0050.306] lstrlenW (lpString=".dbf") returned 4 [0050.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".dbf") returned 0x0 [0050.306] lstrlenW (lpString=".ckp") returned 4 [0050.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".ckp") returned 0x0 [0050.306] lstrlenW (lpString=".dacpac") returned 7 [0050.306] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".dacpac") returned 0x0 [0050.306] lstrlenW (lpString=".db3") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".db3") returned 0x0 [0050.307] lstrlenW (lpString=".dtxs") returned 5 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".dtxs") returned 0x0 [0050.307] lstrlenW (lpString=".mdt") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".mdt") returned 0x0 [0050.307] lstrlenW (lpString=".sdf") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".sdf") returned 0x0 [0050.307] lstrlenW (lpString=".MDF") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".MDF") returned 0x0 [0050.307] lstrlenW (lpString=".DBF") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".DBF") returned 0x0 [0050.307] lstrlenW (lpString=".DB") returned 3 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".DB") returned 0x0 [0050.307] lstrlenW (lpString=".db") returned 3 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".db") returned 0x0 [0050.307] lstrlenW (lpString=".ndf") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".ndf") returned 0x0 [0050.307] lstrlenW (lpString=".NDF") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".NDF") returned 0x0 [0050.307] lstrlenW (lpString=".Mdf") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".Mdf") returned 0x0 [0050.307] lstrlenW (lpString=".dat") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".dat") returned 0x0 [0050.307] lstrlenW (lpString=".DAT") returned 4 [0050.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".DAT") returned 0x0 [0050.307] lstrlenW (lpString=".ldf") returned 4 [0050.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".ldf") returned 0x0 [0050.308] lstrlenW (lpString=".LDF") returned 4 [0050.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch=".LDF") returned 0x0 [0050.308] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0050.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0050.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2b3c38 [0050.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0050.308] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.309] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.309] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.309] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17031007249) returned 1 [0050.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaccb7c90, dwHighDateTime=0x1d585b4)) [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cf50 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cf50 | out: hHeap=0x260000) returned 1 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750358 [0050.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.310] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.310] GetLastError () returned 0x0 [0050.310] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.310] GetLastError () returned 0x0 [0050.314] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffe40e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.314] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1bf2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1bf2, lpOverlapped=0x0) returned 1 [0050.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.314] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.314] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.315] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.315] CloseHandle (hObject=0x10c) returned 1 [0050.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.316] GetLastError () returned 0x0 [0050.316] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.317] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.317] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.317] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17031862682) returned 1 [0050.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaccdddf0, dwHighDateTime=0x1d585b4)) [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cf88 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cf88 | out: hHeap=0x260000) returned 1 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750060 [0050.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.318] GetLastError () returned 0x0 [0050.318] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.318] GetLastError () returned 0x0 [0050.320] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffb12d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.320] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4ed3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ed3, lpOverlapped=0x0) returned 1 [0050.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.321] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.321] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.321] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.321] CloseHandle (hObject=0x10c) returned 1 [0050.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.[deadmin@cock.li].deadmin")) returned 1 [0050.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.323] GetLastError () returned 0x0 [0050.323] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.324] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.324] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17032509547) returned 1 [0050.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaccdddf0, dwHighDateTime=0x1d585b4)) [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cfc0 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cfc0 | out: hHeap=0x260000) returned 1 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750488 [0050.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.325] GetLastError () returned 0x0 [0050.325] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.325] GetLastError () returned 0x0 [0050.327] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd830, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.327] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x27d0, lpOverlapped=0x0) returned 1 [0050.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.327] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.327] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.328] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.328] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.328] CloseHandle (hObject=0x10c) returned 1 [0050.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.329] GetLastError () returned 0x0 [0050.329] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.330] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.330] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17033112420) returned 1 [0050.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd03f50, dwHighDateTime=0x1d585b4)) [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cff8 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0050.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cff8 | out: hHeap=0x260000) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750520 [0050.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.331] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.331] GetLastError () returned 0x0 [0050.331] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.331] GetLastError () returned 0x0 [0050.332] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffa11c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.332] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5ee4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x5ee4, lpOverlapped=0x0) returned 1 [0050.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.333] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.333] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.333] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.334] CloseHandle (hObject=0x10c) returned 1 [0050.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.335] GetLastError () returned 0x0 [0050.335] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.336] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0050.336] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0050.336] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17033686260) returned 1 [0050.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd03f50, dwHighDateTime=0x1d585b4)) [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d030 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0050.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d030 | out: hHeap=0x260000) returned 1 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27505b8 [0050.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.336] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.336] GetLastError () returned 0x0 [0050.336] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.337] GetLastError () returned 0x0 [0050.338] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffddce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.338] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2232, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2232, lpOverlapped=0x0) returned 1 [0050.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.338] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.338] WriteFile (in: hFile=0x10c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.339] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.339] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.339] CloseHandle (hObject=0x10c) returned 1 [0050.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29ef18 [0050.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef18 | out: hHeap=0x260000) returned 1 [0050.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0050.340] GetLastError () returned 0x0 [0050.355] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.356] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.356] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.356] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17035733874) returned 1 [0050.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd2a0b0, dwHighDateTime=0x1d585b4)) [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cff0 [0050.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cff0 | out: hHeap=0x260000) returned 1 [0050.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750650 [0050.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.357] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.357] GetLastError () returned 0x0 [0050.357] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.357] GetLastError () returned 0x0 [0050.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff1c6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.361] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xe392, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xe392, lpOverlapped=0x0) returned 1 [0050.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.361] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.361] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.362] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.362] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.362] CloseHandle (hObject=0x104) returned 1 [0050.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.363] GetLastError () returned 0x0 [0050.363] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.364] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.364] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.364] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17036489899) returned 1 [0050.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd50210, dwHighDateTime=0x1d585b4)) [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d0a0 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d0a0 | out: hHeap=0x260000) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27506e8 [0050.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.364] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.364] GetLastError () returned 0x0 [0050.364] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.365] GetLastError () returned 0x0 [0050.366] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff6eec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.366] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9114, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x9114, lpOverlapped=0x0) returned 1 [0050.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.367] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.367] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.367] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.367] CloseHandle (hObject=0x104) returned 1 [0050.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.368] GetLastError () returned 0x0 [0050.369] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.369] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.369] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.370] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17037066282) returned 1 [0050.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd50210, dwHighDateTime=0x1d585b4)) [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d0d8 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d0d8 | out: hHeap=0x260000) returned 1 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750780 [0050.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.370] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.370] GetLastError () returned 0x0 [0050.370] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.370] GetLastError () returned 0x0 [0050.372] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe7ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.372] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1846, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1846, lpOverlapped=0x0) returned 1 [0050.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.372] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.372] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.372] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.372] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.373] CloseHandle (hObject=0x104) returned 1 [0050.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.374] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.374] GetLastError () returned 0x0 [0050.374] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.375] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.375] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.375] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17037630053) returned 1 [0050.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd76370, dwHighDateTime=0x1d585b4)) [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d110 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d110 | out: hHeap=0x260000) returned 1 [0050.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750818 [0050.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.376] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.376] GetLastError () returned 0x0 [0050.376] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.376] GetLastError () returned 0x0 [0050.377] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd9f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.377] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2610, lpOverlapped=0x0) returned 1 [0050.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.378] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.378] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.378] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.378] CloseHandle (hObject=0x104) returned 1 [0050.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.379] GetLastError () returned 0x0 [0050.380] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.380] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.381] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17038166349) returned 1 [0050.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd76370, dwHighDateTime=0x1d585b4)) [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d148 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d148 | out: hHeap=0x260000) returned 1 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27508b0 [0050.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.381] GetLastError () returned 0x0 [0050.381] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.381] GetLastError () returned 0x0 [0050.383] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.383] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x9b8, lpOverlapped=0x0) returned 1 [0050.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.383] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.383] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.383] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.383] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.384] CloseHandle (hObject=0x104) returned 1 [0050.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.385] GetLastError () returned 0x0 [0050.385] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.386] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.386] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0050.386] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17038704344) returned 1 [0050.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacd76370, dwHighDateTime=0x1d585b4)) [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d180 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d180 | out: hHeap=0x260000) returned 1 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750948 [0050.386] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.386] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.387] GetLastError () returned 0x0 [0050.387] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.387] GetLastError () returned 0x0 [0050.388] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeaf6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.388] WriteFile (in: hFile=0x104, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x150a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x150a, lpOverlapped=0x0) returned 1 [0050.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.389] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.389] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.389] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.389] CloseHandle (hObject=0x104) returned 1 [0050.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.390] GetLastError () returned 0x0 [0050.593] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.617] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.618] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.618] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17061879680) returned 1 [0050.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacfb1810, dwHighDateTime=0x1d585b4)) [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d810 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d810 | out: hHeap=0x260000) returned 1 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751ea8 [0050.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.618] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.618] GetLastError () returned 0x0 [0050.618] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.618] GetLastError () returned 0x0 [0050.621] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff1ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.621] WriteFile (in: hFile=0x110, lpBuffer=0x27fd088*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fd088*, lpNumberOfBytesWritten=0x24cfdb0*=0xe16, lpOverlapped=0x0) returned 1 [0050.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fd088 | out: hHeap=0x260000) returned 1 [0050.622] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.622] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.622] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.622] CloseHandle (hObject=0x110) returned 1 [0050.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.623] GetLastError () returned 0x0 [0050.624] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.625] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.625] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.625] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17062581794) returned 1 [0050.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacfd7970, dwHighDateTime=0x1d585b4)) [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d880 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d880 | out: hHeap=0x260000) returned 1 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec1a8 [0050.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.625] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.625] GetLastError () returned 0x0 [0050.625] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.626] GetLastError () returned 0x0 [0050.627] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.627] WriteFile (in: hFile=0x110, lpBuffer=0x27fd088*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fd088*, lpNumberOfBytesWritten=0x24cfdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0050.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fd088 | out: hHeap=0x260000) returned 1 [0050.627] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.628] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.628] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.628] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.628] CloseHandle (hObject=0x110) returned 1 [0050.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.629] GetLastError () returned 0x0 [0050.629] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.630] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.630] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17063123785) returned 1 [0050.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacfd7970, dwHighDateTime=0x1d585b4)) [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d8b8 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d8b8 | out: hHeap=0x260000) returned 1 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752060 [0050.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.631] GetLastError () returned 0x0 [0050.631] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.631] GetLastError () returned 0x0 [0050.633] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.633] WriteFile (in: hFile=0x110, lpBuffer=0x27fd088*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fd088*, lpNumberOfBytesWritten=0x24cfdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fd088 | out: hHeap=0x260000) returned 1 [0050.633] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.633] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.634] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.634] CloseHandle (hObject=0x110) returned 1 [0050.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.635] GetLastError () returned 0x0 [0050.635] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.636] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.636] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.636] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17063721946) returned 1 [0050.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacfd7970, dwHighDateTime=0x1d585b4)) [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d8f0 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d8f0 | out: hHeap=0x260000) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27520f8 [0050.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.637] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.637] GetLastError () returned 0x0 [0050.637] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.637] GetLastError () returned 0x0 [0050.639] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.639] WriteFile (in: hFile=0x110, lpBuffer=0x27fd088*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fd088*, lpNumberOfBytesWritten=0x24cfdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0050.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fd088 | out: hHeap=0x260000) returned 1 [0050.639] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.640] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.640] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.640] CloseHandle (hObject=0x110) returned 1 [0050.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.641] GetLastError () returned 0x0 [0050.642] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.643] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.643] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17064385487) returned 1 [0050.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacffdad0, dwHighDateTime=0x1d585b4)) [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d928 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d928 | out: hHeap=0x260000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752190 [0050.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.643] GetLastError () returned 0x0 [0050.643] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.644] GetLastError () returned 0x0 [0050.645] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8098, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.645] WriteFile (in: hFile=0x110, lpBuffer=0x27fd088*, nNumberOfBytesToWrite=0x7f68, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fd088*, lpNumberOfBytesWritten=0x24cfdb0*=0x7f68, lpOverlapped=0x0) returned 1 [0050.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fd088 | out: hHeap=0x260000) returned 1 [0050.646] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.646] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.646] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.646] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.646] CloseHandle (hObject=0x110) returned 1 [0050.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.[deadmin@cock.li].deadmin")) returned 1 [0050.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.647] GetLastError () returned 0x0 [0050.648] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.649] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.649] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.649] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17065023015) returned 1 [0050.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xacffdad0, dwHighDateTime=0x1d585b4)) [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30ce68 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30ce68 | out: hHeap=0x260000) returned 1 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752228 [0050.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.650] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.650] GetLastError () returned 0x0 [0050.650] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.650] GetLastError () returned 0x0 [0050.696] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc118, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.696] WriteFile (in: hFile=0x110, lpBuffer=0x27fd088*, nNumberOfBytesToWrite=0x3ee8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fd088*, lpNumberOfBytesWritten=0x24cfdb0*=0x3ee8, lpOverlapped=0x0) returned 1 [0050.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fd088 | out: hHeap=0x260000) returned 1 [0050.698] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.698] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.699] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.699] CloseHandle (hObject=0x110) returned 1 [0050.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.761] GetLastError () returned 0x0 [0050.762] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.762] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.762] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.763] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17076383886) returned 1 [0050.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad12e5d0, dwHighDateTime=0x1d585b4)) [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32db98 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32db98 | out: hHeap=0x260000) returned 1 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.763] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27522c0 [0050.763] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.763] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.763] GetLastError () returned 0x0 [0050.763] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.764] GetLastError () returned 0x0 [0050.767] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbcec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.767] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4314, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x4314, lpOverlapped=0x0) returned 1 [0050.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.767] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.767] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.768] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.768] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.768] CloseHandle (hObject=0x110) returned 1 [0050.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.769] GetLastError () returned 0x0 [0050.770] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.770] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.770] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.771] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17077175970) returned 1 [0050.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad12e5d0, dwHighDateTime=0x1d585b4)) [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dbd0 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dbd0 | out: hHeap=0x260000) returned 1 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752a78 [0050.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.771] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.771] GetLastError () returned 0x0 [0050.771] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.772] GetLastError () returned 0x0 [0050.773] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd2f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.773] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2d0c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2d0c, lpOverlapped=0x0) returned 1 [0050.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.773] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.774] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.774] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.774] CloseHandle (hObject=0x110) returned 1 [0050.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.775] GetLastError () returned 0x0 [0050.775] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.776] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.776] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.776] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17077747103) returned 1 [0050.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad12e5d0, dwHighDateTime=0x1d585b4)) [0050.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dc08 [0050.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dc08 | out: hHeap=0x260000) returned 1 [0050.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752b10 [0050.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.777] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.777] GetLastError () returned 0x0 [0050.777] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.777] GetLastError () returned 0x0 [0050.779] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd424, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.779] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2bdc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2bdc, lpOverlapped=0x0) returned 1 [0050.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.779] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.779] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.780] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.780] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.780] CloseHandle (hObject=0x110) returned 1 [0050.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.781] GetLastError () returned 0x0 [0050.781] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.782] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.782] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17078347671) returned 1 [0050.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad154730, dwHighDateTime=0x1d585b4)) [0050.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dc40 [0050.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dc40 | out: hHeap=0x260000) returned 1 [0050.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752ba8 [0050.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.783] GetLastError () returned 0x0 [0050.783] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.783] GetLastError () returned 0x0 [0050.785] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffb480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.785] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x4b80, lpOverlapped=0x0) returned 1 [0050.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.785] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.785] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.786] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.786] CloseHandle (hObject=0x110) returned 1 [0050.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f878 [0050.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f878 | out: hHeap=0x260000) returned 1 [0050.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.790] GetLastError () returned 0x0 [0050.791] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.791] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.791] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.792] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17079267947) returned 1 [0050.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad154730, dwHighDateTime=0x1d585b4)) [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dc78 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dc78 | out: hHeap=0x260000) returned 1 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752c40 [0050.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.792] GetLastError () returned 0x0 [0050.792] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.792] GetLastError () returned 0x0 [0050.803] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffedec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.803] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1214, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1214, lpOverlapped=0x0) returned 1 [0050.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.835] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.835] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.835] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.835] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.836] CloseHandle (hObject=0x110) returned 1 [0050.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.880] GetLastError () returned 0x0 [0050.881] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.882] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.882] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.882] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17088290138) returned 1 [0050.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad238f70, dwHighDateTime=0x1d585b4)) [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32de70 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32de70 | out: hHeap=0x260000) returned 1 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2752cd8 [0050.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.883] GetLastError () returned 0x0 [0050.883] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.883] GetLastError () returned 0x0 [0050.890] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffea80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.890] WriteFile (in: hFile=0x110, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1580, lpOverlapped=0x0) returned 1 [0050.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0050.890] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.890] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.891] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.891] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.891] CloseHandle (hObject=0x110) returned 1 [0050.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.892] GetLastError () returned 0x0 [0050.893] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.894] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.894] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.894] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17089516069) returned 1 [0050.894] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad25f0d0, dwHighDateTime=0x1d585b4)) [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dee0 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dee0 | out: hHeap=0x260000) returned 1 [0050.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753230 [0050.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.895] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.895] GetLastError () returned 0x0 [0050.895] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.895] GetLastError () returned 0x0 [0050.897] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffef20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.897] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x10e0, lpOverlapped=0x0) returned 1 [0050.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.897] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.898] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.898] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.898] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.898] CloseHandle (hObject=0x110) returned 1 [0050.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.899] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.900] GetLastError () returned 0x0 [0050.901] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.902] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.902] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.902] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17090291070) returned 1 [0050.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad25f0d0, dwHighDateTime=0x1d585b4)) [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32df18 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32df18 | out: hHeap=0x260000) returned 1 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753360 [0050.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.902] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.903] GetLastError () returned 0x0 [0050.903] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.903] GetLastError () returned 0x0 [0050.905] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff81c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.905] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x7e4, lpOverlapped=0x0) returned 1 [0050.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.905] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.905] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.906] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.906] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.906] CloseHandle (hObject=0x110) returned 1 [0050.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.907] GetLastError () returned 0x0 [0050.908] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.909] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.909] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.909] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17091015410) returned 1 [0050.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad285230, dwHighDateTime=0x1d585b4)) [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32df50 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32df50 | out: hHeap=0x260000) returned 1 [0050.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27533f8 [0050.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.910] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.910] GetLastError () returned 0x0 [0050.910] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.910] GetLastError () returned 0x0 [0050.912] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.912] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1f38, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f38, lpOverlapped=0x0) returned 1 [0050.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0050.912] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.913] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0050.913] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0050.913] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0050.913] CloseHandle (hObject=0x110) returned 1 [0050.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0050.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.[deadmin@cock.li].deadmin")) returned 1 [0050.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0050.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0050.915] GetLastError () returned 0x0 [0050.915] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0050.916] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0050.916] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0050.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0050.916] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17091721763) returned 1 [0050.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad285230, dwHighDateTime=0x1d585b4)) [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32df88 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0050.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32df88 | out: hHeap=0x260000) returned 1 [0050.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0050.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0050.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0050.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0050.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753490 [0050.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0050.917] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0050.917] GetLastError () returned 0x0 [0050.917] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0050.917] GetLastError () returned 0x0 [0051.026] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd6f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.027] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x290c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x290c, lpOverlapped=0x0) returned 1 [0051.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.027] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.027] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.027] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.028] CloseHandle (hObject=0x110) returned 1 [0051.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.029] GetLastError () returned 0x0 [0051.029] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.030] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.030] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.030] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17103099042) returned 1 [0051.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad3b5d30, dwHighDateTime=0x1d585b4)) [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e228 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e228 | out: hHeap=0x260000) returned 1 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753528 [0051.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.030] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.031] GetLastError () returned 0x0 [0051.031] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.031] GetLastError () returned 0x0 [0051.032] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd4fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.032] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2b04, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2b04, lpOverlapped=0x0) returned 1 [0051.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.033] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.033] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.033] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.033] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.033] CloseHandle (hObject=0x110) returned 1 [0051.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.034] GetLastError () returned 0x0 [0051.035] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.036] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.036] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.036] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17103711914) returned 1 [0051.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad3b5d30, dwHighDateTime=0x1d585b4)) [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e260 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e260 | out: hHeap=0x260000) returned 1 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753d78 [0051.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.037] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.037] GetLastError () returned 0x0 [0051.037] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.037] GetLastError () returned 0x0 [0051.038] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff300, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.038] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xd00, lpOverlapped=0x0) returned 1 [0051.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.038] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.039] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.039] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.039] CloseHandle (hObject=0x110) returned 1 [0051.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.040] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.041] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.041] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.041] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.041] GetLastError () returned 0x0 [0051.042] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffb024, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.043] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4fdc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x4fdc, lpOverlapped=0x0) returned 1 [0051.043] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.043] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.043] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.043] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.044] CloseHandle (hObject=0x110) returned 1 [0051.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.045] GetLastError () returned 0x0 [0051.045] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.046] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.046] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.046] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17104716408) returned 1 [0051.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad3dbe90, dwHighDateTime=0x1d585b4)) [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e2d0 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e2d0 | out: hHeap=0x260000) returned 1 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2753ea8 [0051.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.047] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.047] GetLastError () returned 0x0 [0051.047] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.047] GetLastError () returned 0x0 [0051.048] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdb48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.048] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x24b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x24b8, lpOverlapped=0x0) returned 1 [0051.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.049] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.049] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.049] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.049] CloseHandle (hObject=0x110) returned 1 [0051.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.050] GetLastError () returned 0x0 [0051.051] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.051] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.051] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.052] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17105267259) returned 1 [0051.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad3dbe90, dwHighDateTime=0x1d585b4)) [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e308 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e308 | out: hHeap=0x260000) returned 1 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec1a8 [0051.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.052] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.052] GetLastError () returned 0x0 [0051.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.052] GetLastError () returned 0x0 [0051.058] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe79c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.058] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1864, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1864, lpOverlapped=0x0) returned 1 [0051.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.058] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.058] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.059] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.059] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.059] CloseHandle (hObject=0x110) returned 1 [0051.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.060] GetLastError () returned 0x0 [0051.060] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.061] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.061] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.061] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17106217195) returned 1 [0051.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad401ff0, dwHighDateTime=0x1d585b4)) [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e340 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e340 | out: hHeap=0x260000) returned 1 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a070 [0051.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.062] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.062] GetLastError () returned 0x0 [0051.062] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.062] GetLastError () returned 0x0 [0051.300] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffb6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.300] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x4928, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x4928, lpOverlapped=0x0) returned 1 [0051.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.313] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.313] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.313] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.313] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.314] CloseHandle (hObject=0x110) returned 1 [0051.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.315] GetLastError () returned 0x0 [0051.315] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.316] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.316] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.316] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17131894043) returned 1 [0051.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad6635f0, dwHighDateTime=0x1d585b4)) [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8300 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8300 | out: hHeap=0x260000) returned 1 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0051.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.319] GetLastError () returned 0x0 [0051.319] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.319] GetLastError () returned 0x0 [0051.321] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff2fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.321] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xd04, lpOverlapped=0x0) returned 1 [0051.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.322] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.322] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.322] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.322] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.322] CloseHandle (hObject=0x110) returned 1 [0051.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.323] GetLastError () returned 0x0 [0051.323] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.324] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.324] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17132557665) returned 1 [0051.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad689750, dwHighDateTime=0x1d585b4)) [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8290 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8290 | out: hHeap=0x260000) returned 1 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0051.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.325] GetLastError () returned 0x0 [0051.325] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.325] GetLastError () returned 0x0 [0051.327] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffca28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.327] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x35d8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x35d8, lpOverlapped=0x0) returned 1 [0051.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.327] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.327] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.327] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.327] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.328] CloseHandle (hObject=0x110) returned 1 [0051.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.329] GetLastError () returned 0x0 [0051.329] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.330] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.330] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.330] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17133092075) returned 1 [0051.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad689750, dwHighDateTime=0x1d585b4)) [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ff0 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ff0 | out: hHeap=0x260000) returned 1 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ae18 [0051.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.330] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.331] GetLastError () returned 0x0 [0051.331] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.331] GetLastError () returned 0x0 [0051.332] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff434, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.332] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xbcc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xbcc, lpOverlapped=0x0) returned 1 [0051.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.332] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.332] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.333] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.333] CloseHandle (hObject=0x110) returned 1 [0051.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.334] GetLastError () returned 0x0 [0051.334] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.335] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.335] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.335] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17133622064) returned 1 [0051.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad689750, dwHighDateTime=0x1d585b4)) [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8418 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8418 | out: hHeap=0x260000) returned 1 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277aeb0 [0051.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.336] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.336] GetLastError () returned 0x0 [0051.336] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.336] GetLastError () returned 0x0 [0051.337] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe230, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.337] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1dd0, lpOverlapped=0x0) returned 1 [0051.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.338] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.338] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.338] CloseHandle (hObject=0x110) returned 1 [0051.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.339] GetLastError () returned 0x0 [0051.340] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.341] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.341] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.341] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17134200140) returned 1 [0051.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad6af8b0, dwHighDateTime=0x1d585b4)) [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d83e0 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d83e0 | out: hHeap=0x260000) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277af48 [0051.341] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.341] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.342] GetLastError () returned 0x0 [0051.342] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.342] GetLastError () returned 0x0 [0051.343] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdca8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.343] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2358, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2358, lpOverlapped=0x0) returned 1 [0051.343] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.343] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.344] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.344] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.344] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.344] CloseHandle (hObject=0x110) returned 1 [0051.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0051.344] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0051.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.345] GetLastError () returned 0x0 [0051.345] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.346] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.346] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.346] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17134731863) returned 1 [0051.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad6af8b0, dwHighDateTime=0x1d585b4)) [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d83a8 [0051.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d83a8 | out: hHeap=0x260000) returned 1 [0051.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277afe0 [0051.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.347] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.347] GetLastError () returned 0x0 [0051.347] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.347] GetLastError () returned 0x0 [0051.389] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc8cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.389] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x3734, lpOverlapped=0x0) returned 1 [0051.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.389] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.390] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.390] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.390] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.390] CloseHandle (hObject=0x110) returned 1 [0051.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.415] GetLastError () returned 0x0 [0051.415] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.429] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.429] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.429] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17143025827) returned 1 [0051.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad76df90, dwHighDateTime=0x1d585b4)) [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ca8 [0051.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ca8 | out: hHeap=0x260000) returned 1 [0051.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b078 [0051.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.430] GetLastError () returned 0x0 [0051.430] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.430] GetLastError () returned 0x0 [0051.433] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcb70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.434] WriteFile (in: hFile=0x110, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x3490, lpOverlapped=0x0) returned 1 [0051.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.437] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.437] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.438] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.438] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.439] CloseHandle (hObject=0x110) returned 1 [0051.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.440] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.440] GetLastError () returned 0x0 [0051.440] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.441] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.441] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.442] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17144279413) returned 1 [0051.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad7940f0, dwHighDateTime=0x1d585b4)) [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7c70 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c70 | out: hHeap=0x260000) returned 1 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b4a0 [0051.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.442] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.443] GetLastError () returned 0x0 [0051.443] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.443] GetLastError () returned 0x0 [0051.450] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa7fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.450] WriteFile (in: hFile=0x110, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x5804, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x5804, lpOverlapped=0x0) returned 1 [0051.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.450] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.451] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.451] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.451] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.451] CloseHandle (hObject=0x110) returned 1 [0051.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a08e0 [0051.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a08e0 | out: hHeap=0x260000) returned 1 [0051.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.453] GetLastError () returned 0x0 [0051.453] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.454] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.454] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17145533259) returned 1 [0051.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad7ba250, dwHighDateTime=0x1d585b4)) [0051.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e768 [0051.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e768 | out: hHeap=0x260000) returned 1 [0051.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b538 [0051.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.455] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.455] GetLastError () returned 0x0 [0051.455] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.455] GetLastError () returned 0x0 [0051.460] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa8e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.460] WriteFile (in: hFile=0x110, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x571c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x571c, lpOverlapped=0x0) returned 1 [0051.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.461] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.461] WriteFile (in: hFile=0x110, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.461] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.461] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.462] CloseHandle (hObject=0x110) returned 1 [0051.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.465] GetLastError () returned 0x0 [0051.466] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.467] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.467] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.467] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17146790706) returned 1 [0051.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad7e03b0, dwHighDateTime=0x1d585b4)) [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e7d8 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e7d8 | out: hHeap=0x260000) returned 1 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b5d0 [0051.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.468] GetLastError () returned 0x0 [0051.468] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.468] GetLastError () returned 0x0 [0051.470] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc11c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.470] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x3ee4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x3ee4, lpOverlapped=0x0) returned 1 [0051.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.470] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.470] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.471] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.471] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.471] CloseHandle (hObject=0x118) returned 1 [0051.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.472] GetLastError () returned 0x0 [0051.473] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.474] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.474] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17147504095) returned 1 [0051.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad7e03b0, dwHighDateTime=0x1d585b4)) [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e810 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e810 | out: hHeap=0x260000) returned 1 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b700 [0051.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.475] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.475] GetLastError () returned 0x0 [0051.475] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.475] GetLastError () returned 0x0 [0051.477] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffee48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.477] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x11b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x11b8, lpOverlapped=0x0) returned 1 [0051.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.477] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.478] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.478] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.478] CloseHandle (hObject=0x118) returned 1 [0051.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.479] GetLastError () returned 0x0 [0051.480] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.481] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.481] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.481] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17148234781) returned 1 [0051.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad806510, dwHighDateTime=0x1d585b4)) [0051.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e848 [0051.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e848 | out: hHeap=0x260000) returned 1 [0051.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b798 [0051.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.482] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.482] GetLastError () returned 0x0 [0051.482] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.482] GetLastError () returned 0x0 [0051.484] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffd910, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.484] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x26f0, lpOverlapped=0x0) returned 1 [0051.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.484] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.485] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.485] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.485] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.485] CloseHandle (hObject=0x118) returned 1 [0051.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.487] GetLastError () returned 0x0 [0051.487] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.488] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0051.488] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17148919276) returned 1 [0051.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad806510, dwHighDateTime=0x1d585b4)) [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e880 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.488] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e880 | out: hHeap=0x260000) returned 1 [0051.488] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b830 [0051.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.489] GetLastError () returned 0x0 [0051.489] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.489] GetLastError () returned 0x0 [0051.490] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffb10c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.491] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x4ef4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ef4, lpOverlapped=0x0) returned 1 [0051.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.491] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.491] WriteFile (in: hFile=0x118, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.491] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.491] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.492] CloseHandle (hObject=0x118) returned 1 [0051.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0051.495] GetLastError () returned 0x0 [0051.504] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.505] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.505] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.505] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17150658632) returned 1 [0051.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad82c670, dwHighDateTime=0x1d585b4)) [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dff8 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dff8 | out: hHeap=0x260000) returned 1 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b8c8 [0051.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.506] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.506] GetLastError () returned 0x0 [0051.506] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.506] GetLastError () returned 0x0 [0051.508] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffde98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.508] WriteFile (in: hFile=0x118, lpBuffer=0x280d090*, nNumberOfBytesToWrite=0x2168, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280d090*, lpNumberOfBytesWritten=0x24cfdb0*=0x2168, lpOverlapped=0x0) returned 1 [0051.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280d090 | out: hHeap=0x260000) returned 1 [0051.604] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.605] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.605] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.605] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.606] CloseHandle (hObject=0x118) returned 1 [0051.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0818 [0051.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0818 | out: hHeap=0x260000) returned 1 [0051.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.607] GetLastError () returned 0x0 [0051.607] RtlWakeConditionVariable () returned 0x27e828 [0051.607] GetCurrentThreadId () returned 0x9ac [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".ldf") returned 0x0 [0051.607] lstrlenW (lpString=".vhd") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".vhd") returned 0x0 [0051.607] lstrlenW (lpString=".vhdx") returned 5 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".vhdx") returned 0x0 [0051.607] lstrlenW (lpString=".pst") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".pst") returned 0x0 [0051.607] lstrlenW (lpString=".ost") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".ost") returned 0x0 [0051.607] lstrlenW (lpString=".bak") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".bak") returned 0x0 [0051.607] lstrlenW (lpString=".bac") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".bac") returned 0x0 [0051.607] lstrlenW (lpString=".sys") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".sys") returned 0x0 [0051.607] lstrlenW (lpString=".v2i") returned 4 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".v2i") returned 0x0 [0051.607] lstrlenW (lpString="s\r\n.v2i") returned 7 [0051.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch="s\r\n.v2i") returned 0x0 [0051.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0051.673] lstrlenW (lpString=".sql") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".sql") returned 0x0 [0051.673] lstrlenW (lpString=".mdf") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".mdf") returned 0x0 [0051.673] lstrlenW (lpString=".txt") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".txt") returned 0x0 [0051.673] lstrlenW (lpString=".dbf") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".dbf") returned 0x0 [0051.673] lstrlenW (lpString=".ckp") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".ckp") returned 0x0 [0051.673] lstrlenW (lpString=".dacpac") returned 7 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".dacpac") returned 0x0 [0051.673] lstrlenW (lpString=".db3") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".db3") returned 0x0 [0051.673] lstrlenW (lpString=".dtxs") returned 5 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".dtxs") returned 0x0 [0051.673] lstrlenW (lpString=".mdt") returned 4 [0051.673] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".mdt") returned 0x0 [0051.674] lstrlenW (lpString=".sdf") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".sdf") returned 0x0 [0051.674] lstrlenW (lpString=".MDF") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".MDF") returned 0x0 [0051.674] lstrlenW (lpString=".DBF") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".DBF") returned 0x0 [0051.674] lstrlenW (lpString=".DB") returned 3 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".DB") returned 0x0 [0051.674] lstrlenW (lpString=".db") returned 3 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".db") returned 0x0 [0051.674] lstrlenW (lpString=".ndf") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".ndf") returned 0x0 [0051.674] lstrlenW (lpString=".NDF") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".NDF") returned 0x0 [0051.674] lstrlenW (lpString=".Mdf") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".Mdf") returned 0x0 [0051.674] lstrlenW (lpString=".dat") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".dat") returned 0x0 [0051.674] lstrlenW (lpString=".DAT") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".DAT") returned 0x0 [0051.674] lstrlenW (lpString=".ldf") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".ldf") returned 0x0 [0051.674] lstrlenW (lpString=".LDF") returned 4 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch=".LDF") returned 0x0 [0051.674] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0051.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0051.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a308 [0051.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0051.674] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.676] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.676] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17167700677) returned 1 [0051.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad9cf590, dwHighDateTime=0x1d585b4)) [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c8250 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8250 | out: hHeap=0x260000) returned 1 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.676] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.677] GetLastError () returned 0x0 [0051.677] GetLastError () returned 0x0 [0051.677] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.677] GetLastError () returned 0x0 [0051.677] GetLastError () returned 0x0 [0051.678] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffefd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.679] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1028, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1028, lpOverlapped=0x0) returned 1 [0051.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.679] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.679] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.679] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.679] CloseHandle (hObject=0x108) returned 1 [0051.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.680] GetLastError () returned 0x0 [0051.681] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.682] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.682] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.682] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17168286534) returned 1 [0051.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad9cf590, dwHighDateTime=0x1d585b4)) [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b48 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b48 | out: hHeap=0x260000) returned 1 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277beb8 [0051.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.682] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.682] GetLastError () returned 0x0 [0051.683] GetLastError () returned 0x0 [0051.683] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.683] GetLastError () returned 0x0 [0051.683] GetLastError () returned 0x0 [0051.684] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc1f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.684] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x3e10, lpOverlapped=0x0) returned 1 [0051.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.685] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.685] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.686] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.686] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.686] CloseHandle (hObject=0x108) returned 1 [0051.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.687] GetLastError () returned 0x0 [0051.687] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.688] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.688] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17168937715) returned 1 [0051.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad9f56f0, dwHighDateTime=0x1d585b4)) [0051.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294a68 [0051.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294a68 | out: hHeap=0x260000) returned 1 [0051.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297568 [0051.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.689] GetLastError () returned 0x0 [0051.689] GetLastError () returned 0x0 [0051.689] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.689] GetLastError () returned 0x0 [0051.689] GetLastError () returned 0x0 [0051.691] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd59c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.691] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2a64, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x2a64, lpOverlapped=0x0) returned 1 [0051.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.691] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.691] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.692] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.692] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.692] CloseHandle (hObject=0x108) returned 1 [0051.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.693] GetLastError () returned 0x0 [0051.693] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.694] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.694] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.694] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17169508722) returned 1 [0051.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xad9f56f0, dwHighDateTime=0x1d585b4)) [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994e8 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2994e8 | out: hHeap=0x260000) returned 1 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296e48 [0051.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.695] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.695] GetLastError () returned 0x0 [0051.695] GetLastError () returned 0x0 [0051.695] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.695] GetLastError () returned 0x0 [0051.695] GetLastError () returned 0x0 [0051.697] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd3e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.697] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2c18, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x2c18, lpOverlapped=0x0) returned 1 [0051.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.697] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.697] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.698] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.698] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.698] CloseHandle (hObject=0x108) returned 1 [0051.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.699] GetLastError () returned 0x0 [0051.700] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.701] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.701] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.701] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17170184489) returned 1 [0051.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xada1b850, dwHighDateTime=0x1d585b4)) [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299520 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0051.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.701] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.701] GetLastError () returned 0x0 [0051.702] GetLastError () returned 0x0 [0051.702] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.702] GetLastError () returned 0x0 [0051.702] GetLastError () returned 0x0 [0051.703] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe67c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.703] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1984, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1984, lpOverlapped=0x0) returned 1 [0051.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.704] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.704] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.704] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.704] CloseHandle (hObject=0x108) returned 1 [0051.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.705] GetLastError () returned 0x0 [0051.706] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.706] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.706] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.706] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17170894664) returned 1 [0051.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xada1b850, dwHighDateTime=0x1d585b4)) [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299558 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299558 | out: hHeap=0x260000) returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0051.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.708] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.709] GetLastError () returned 0x0 [0051.709] GetLastError () returned 0x0 [0051.709] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.709] GetLastError () returned 0x0 [0051.709] GetLastError () returned 0x0 [0051.741] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffef6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.741] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1094, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1094, lpOverlapped=0x0) returned 1 [0051.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0051.741] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.741] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.741] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.742] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.742] CloseHandle (hObject=0x108) returned 1 [0051.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.863] GetLastError () returned 0x0 [0051.863] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.864] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.864] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.864] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17186545997) returned 1 [0051.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadb98610, dwHighDateTime=0x1d585b4)) [0051.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948a8 [0051.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2948a8 | out: hHeap=0x260000) returned 1 [0051.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327b88 [0051.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.865] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.865] GetLastError () returned 0x0 [0051.865] GetLastError () returned 0x0 [0051.865] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.865] GetLastError () returned 0x0 [0051.865] GetLastError () returned 0x0 [0051.868] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffef98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.869] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1068, lpOverlapped=0x0) returned 1 [0051.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.869] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.869] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.869] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.869] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.870] CloseHandle (hObject=0x10c) returned 1 [0051.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.871] GetLastError () returned 0x0 [0051.871] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.872] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.872] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.872] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17187308672) returned 1 [0051.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadbbe770, dwHighDateTime=0x1d585b4)) [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294870 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294870 | out: hHeap=0x260000) returned 1 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751f40 [0051.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.872] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.873] GetLastError () returned 0x0 [0051.873] GetLastError () returned 0x0 [0051.873] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.873] GetLastError () returned 0x0 [0051.873] GetLastError () returned 0x0 [0051.874] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd5ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.874] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2a54, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2a54, lpOverlapped=0x0) returned 1 [0051.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.875] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.875] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.875] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.875] CloseHandle (hObject=0x10c) returned 1 [0051.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.877] GetLastError () returned 0x0 [0051.877] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.878] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.878] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17187896646) returned 1 [0051.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadbbe770, dwHighDateTime=0x1d585b4)) [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294838 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294838 | out: hHeap=0x260000) returned 1 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299d80 [0051.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.878] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.879] GetLastError () returned 0x0 [0051.879] GetLastError () returned 0x0 [0051.879] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.879] GetLastError () returned 0x0 [0051.879] GetLastError () returned 0x0 [0051.880] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd374, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.880] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2c8c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2c8c, lpOverlapped=0x0) returned 1 [0051.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.881] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.881] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.881] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.881] CloseHandle (hObject=0x10c) returned 1 [0051.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.882] GetLastError () returned 0x0 [0051.883] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.884] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.884] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.884] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17188529869) returned 1 [0051.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadbbe770, dwHighDateTime=0x1d585b4)) [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1530 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0051.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299e18 [0051.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.885] GetLastError () returned 0x0 [0051.885] GetLastError () returned 0x0 [0051.885] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.885] GetLastError () returned 0x0 [0051.885] GetLastError () returned 0x0 [0051.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffd054, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.887] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2fac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2fac, lpOverlapped=0x0) returned 1 [0051.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.887] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.887] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.888] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.888] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.888] CloseHandle (hObject=0x10c) returned 1 [0051.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.[deadmin@cock.li].deadmin")) returned 1 [0051.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0051.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0051.889] GetLastError () returned 0x0 [0051.890] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0051.890] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0051.890] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0051.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0051.891] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17189174466) returned 1 [0051.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadbe48d0, dwHighDateTime=0x1d585b4)) [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13a8 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0051.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13a8 | out: hHeap=0x260000) returned 1 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0051.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0051.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0051.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0051.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0051.891] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0051.891] GetLastError () returned 0x0 [0051.891] GetLastError () returned 0x0 [0051.891] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0051.892] GetLastError () returned 0x0 [0051.892] GetLastError () returned 0x0 [0051.893] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0xffffc948, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.893] WriteFile (in: hFile=0x10c, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x36b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x36b8, lpOverlapped=0x0) returned 1 [0051.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0051.902] SetFilePointerEx (in: hFile=0x10c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.902] WriteFile (in: hFile=0x10c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0051.902] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0051.902] WriteFile (in: hFile=0x10c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0051.903] CloseHandle (hObject=0x10c) returned 1 [0051.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0051.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.014] GetLastError () returned 0x0 [0052.020] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.021] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.021] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.021] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17202258583) returned 1 [0052.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadd153d0, dwHighDateTime=0x1d585b4)) [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd98 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd98 | out: hHeap=0x260000) returned 1 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299f48 [0052.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.022] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.022] GetLastError () returned 0x0 [0052.022] GetLastError () returned 0x0 [0052.022] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.022] GetLastError () returned 0x0 [0052.023] GetLastError () returned 0x0 [0052.024] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff62d9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.024] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x9d27, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x9d27, lpOverlapped=0x0) returned 1 [0052.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.025] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.025] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.025] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.025] CloseHandle (hObject=0x108) returned 1 [0052.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.026] GetLastError () returned 0x0 [0052.027] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.027] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.028] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17202875340) returned 1 [0052.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadd3b530, dwHighDateTime=0x1d585b4)) [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1140 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1140 | out: hHeap=0x260000) returned 1 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ab28 [0052.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.028] GetLastError () returned 0x0 [0052.028] GetLastError () returned 0x0 [0052.029] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.029] GetLastError () returned 0x0 [0052.029] GetLastError () returned 0x0 [0052.030] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff7c87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.030] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x8379, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x8379, lpOverlapped=0x0) returned 1 [0052.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.031] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.031] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.031] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.031] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.031] CloseHandle (hObject=0x108) returned 1 [0052.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0052.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0052.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.032] GetLastError () returned 0x0 [0052.034] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.035] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.035] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17203620184) returned 1 [0052.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadd3b530, dwHighDateTime=0x1d585b4)) [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1178 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1178 | out: hHeap=0x260000) returned 1 [0052.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29abc0 [0052.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.036] GetLastError () returned 0x0 [0052.036] GetLastError () returned 0x0 [0052.036] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.036] GetLastError () returned 0x0 [0052.036] GetLastError () returned 0x0 [0052.038] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff0f3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.038] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xf0c1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xf0c1, lpOverlapped=0x0) returned 1 [0052.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.039] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.039] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.039] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.039] CloseHandle (hObject=0x108) returned 1 [0052.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.040] GetLastError () returned 0x0 [0052.041] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.041] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.041] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.041] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17204259443) returned 1 [0052.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadd61690, dwHighDateTime=0x1d585b4)) [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ed8 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0ed8 | out: hHeap=0x260000) returned 1 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750a78 [0052.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.042] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.042] GetLastError () returned 0x0 [0052.043] GetLastError () returned 0x0 [0052.043] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.043] GetLastError () returned 0x0 [0052.043] GetLastError () returned 0x0 [0052.045] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff3faa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.045] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc056, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xc056, lpOverlapped=0x0) returned 1 [0052.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.045] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.045] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.045] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.045] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.046] CloseHandle (hObject=0x108) returned 1 [0052.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.047] GetLastError () returned 0x0 [0052.047] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.048] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.048] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.048] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17204899816) returned 1 [0052.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadd61690, dwHighDateTime=0x1d585b4)) [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f10 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f10 | out: hHeap=0x260000) returned 1 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756060 [0052.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.048] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.049] GetLastError () returned 0x0 [0052.049] GetLastError () returned 0x0 [0052.049] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.049] GetLastError () returned 0x0 [0052.049] GetLastError () returned 0x0 [0052.051] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffad7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.051] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5285, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x5285, lpOverlapped=0x0) returned 1 [0052.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.052] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.052] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.052] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.052] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.053] CloseHandle (hObject=0x108) returned 1 [0052.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0052.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0052.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.055] GetLastError () returned 0x0 [0052.056] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.057] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.057] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.057] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17205797979) returned 1 [0052.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadd61690, dwHighDateTime=0x1d585b4)) [0052.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f48 [0052.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0f48 | out: hHeap=0x260000) returned 1 [0052.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756a78 [0052.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.203] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.203] GetLastError () returned 0x0 [0052.203] GetLastError () returned 0x0 [0052.203] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.203] GetLastError () returned 0x0 [0052.203] GetLastError () returned 0x0 [0052.207] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffba35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.207] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x45cb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x45cb, lpOverlapped=0x0) returned 1 [0052.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.207] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.207] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.208] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.208] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.208] CloseHandle (hObject=0x108) returned 1 [0052.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.209] GetLastError () returned 0x0 [0052.210] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.211] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.211] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.211] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17221193133) returned 1 [0052.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadede450, dwHighDateTime=0x1d585b4)) [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a12c8 | out: hHeap=0x260000) returned 1 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756190 [0052.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.211] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.212] GetLastError () returned 0x0 [0052.212] GetLastError () returned 0x0 [0052.212] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.212] GetLastError () returned 0x0 [0052.212] GetLastError () returned 0x0 [0052.214] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb7bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.214] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4844, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x4844, lpOverlapped=0x0) returned 1 [0052.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.214] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.215] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.215] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.215] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.215] CloseHandle (hObject=0x108) returned 1 [0052.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.217] GetLastError () returned 0x0 [0052.218] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.219] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.219] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.219] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17221999209) returned 1 [0052.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadf045b0, dwHighDateTime=0x1d585b4)) [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff58 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff58 | out: hHeap=0x260000) returned 1 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0052.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.220] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.220] GetLastError () returned 0x0 [0052.220] GetLastError () returned 0x0 [0052.220] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.220] GetLastError () returned 0x0 [0052.220] GetLastError () returned 0x0 [0052.222] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.222] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x3928, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x3928, lpOverlapped=0x0) returned 1 [0052.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.223] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.223] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.223] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.223] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.224] CloseHandle (hObject=0x108) returned 1 [0052.224] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.225] GetLastError () returned 0x0 [0052.225] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.226] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.226] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.226] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17222986472) returned 1 [0052.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadf2a710, dwHighDateTime=0x1d585b4)) [0052.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2eff90 [0052.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2eff90 | out: hHeap=0x260000) returned 1 [0052.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296008 [0052.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.230] GetLastError () returned 0x0 [0052.230] GetLastError () returned 0x0 [0052.230] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.230] GetLastError () returned 0x0 [0052.230] GetLastError () returned 0x0 [0052.232] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe5a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.232] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1a60, lpOverlapped=0x0) returned 1 [0052.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.233] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.233] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.233] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.233] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.234] CloseHandle (hObject=0x108) returned 1 [0052.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.235] GetLastError () returned 0x0 [0052.235] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.236] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.236] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.236] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17223745531) returned 1 [0052.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xadf2a710, dwHighDateTime=0x1d585b4)) [0052.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1098 [0052.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1098 | out: hHeap=0x260000) returned 1 [0052.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756ba8 [0052.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.237] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.237] GetLastError () returned 0x0 [0052.237] GetLastError () returned 0x0 [0052.237] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.237] GetLastError () returned 0x0 [0052.238] GetLastError () returned 0x0 [0052.313] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd678, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.313] WriteFile (in: hFile=0x108, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2988, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x2988, lpOverlapped=0x0) returned 1 [0052.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0052.314] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.314] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.314] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.314] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.315] CloseHandle (hObject=0x108) returned 1 [0052.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.458] GetLastError () returned 0x0 [0052.458] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.459] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.459] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17246042480) returned 1 [0052.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae13fa50, dwHighDateTime=0x1d585b4)) [0052.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d630 [0052.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0052.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2756c40 [0052.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.460] GetLastError () returned 0x0 [0052.460] GetLastError () returned 0x0 [0052.460] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.460] GetLastError () returned 0x0 [0052.460] GetLastError () returned 0x0 [0052.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffee1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.464] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x11e4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x11e4, lpOverlapped=0x0) returned 1 [0052.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.464] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.464] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.464] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.464] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.465] CloseHandle (hObject=0x108) returned 1 [0052.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.466] GetLastError () returned 0x0 [0052.466] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.467] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.467] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.467] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17246839875) returned 1 [0052.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae165bb0, dwHighDateTime=0x1d585b4)) [0052.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294758 [0052.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294758 | out: hHeap=0x260000) returned 1 [0052.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0052.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.468] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.468] GetLastError () returned 0x0 [0052.468] GetLastError () returned 0x0 [0052.468] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.468] GetLastError () returned 0x0 [0052.468] GetLastError () returned 0x0 [0052.470] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe494, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.470] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1b6c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b6c, lpOverlapped=0x0) returned 1 [0052.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.470] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.470] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.471] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.471] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.471] CloseHandle (hObject=0x108) returned 1 [0052.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.472] GetLastError () returned 0x0 [0052.473] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.473] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.474] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.474] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17247482680) returned 1 [0052.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae165bb0, dwHighDateTime=0x1d585b4)) [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294790 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294790 | out: hHeap=0x260000) returned 1 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295f70 [0052.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.474] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.474] GetLastError () returned 0x0 [0052.475] GetLastError () returned 0x0 [0052.475] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.475] GetLastError () returned 0x0 [0052.475] GetLastError () returned 0x0 [0052.476] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.476] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1ec4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ec4, lpOverlapped=0x0) returned 1 [0052.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.477] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.477] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.477] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.477] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.477] CloseHandle (hObject=0x108) returned 1 [0052.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.479] GetLastError () returned 0x0 [0052.479] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.480] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.480] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.480] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17248116937) returned 1 [0052.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae18bd10, dwHighDateTime=0x1d585b4)) [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d860 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d860 | out: hHeap=0x260000) returned 1 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.480] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2757ea8 [0052.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.481] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.481] GetLastError () returned 0x0 [0052.481] GetLastError () returned 0x0 [0052.481] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.481] GetLastError () returned 0x0 [0052.481] GetLastError () returned 0x0 [0052.483] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc5d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.483] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x3a28, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x3a28, lpOverlapped=0x0) returned 1 [0052.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.483] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.483] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.483] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.483] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.484] CloseHandle (hObject=0x108) returned 1 [0052.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2a0750 [0052.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a0750 | out: hHeap=0x260000) returned 1 [0052.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.485] GetLastError () returned 0x0 [0052.485] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.486] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.486] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17248949068) returned 1 [0052.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae18bd10, dwHighDateTime=0x1d585b4)) [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338150 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338150 | out: hHeap=0x260000) returned 1 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29aa90 [0052.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.489] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.489] GetLastError () returned 0x0 [0052.489] GetLastError () returned 0x0 [0052.489] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.489] GetLastError () returned 0x0 [0052.490] GetLastError () returned 0x0 [0052.529] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffdc90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.529] WriteFile (in: hFile=0x108, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x2370, lpOverlapped=0x0) returned 1 [0052.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.530] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.530] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.530] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.530] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.531] CloseHandle (hObject=0x108) returned 1 [0052.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.605] GetLastError () returned 0x0 [0052.605] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.606] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.606] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.606] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17260686497) returned 1 [0052.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae2bc810, dwHighDateTime=0x1d585b4)) [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e40 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e40 | out: hHeap=0x260000) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.606] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27588b0 [0052.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.606] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.606] GetLastError () returned 0x0 [0052.607] GetLastError () returned 0x0 [0052.607] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.607] GetLastError () returned 0x0 [0052.607] GetLastError () returned 0x0 [0052.608] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc3a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.608] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x3c58, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c58, lpOverlapped=0x0) returned 1 [0052.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.609] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.609] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.609] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.609] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.610] CloseHandle (hObject=0x110) returned 1 [0052.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.611] GetLastError () returned 0x0 [0052.611] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.612] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.612] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.612] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17261306247) returned 1 [0052.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae2bc810, dwHighDateTime=0x1d585b4)) [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338188 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338188 | out: hHeap=0x260000) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27589e0 [0052.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.613] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.613] GetLastError () returned 0x0 [0052.613] GetLastError () returned 0x0 [0052.613] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.613] GetLastError () returned 0x0 [0052.613] GetLastError () returned 0x0 [0052.614] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbdc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.615] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4238, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x4238, lpOverlapped=0x0) returned 1 [0052.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.615] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.615] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.615] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.616] CloseHandle (hObject=0x110) returned 1 [0052.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.617] GetLastError () returned 0x0 [0052.617] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.618] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.618] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.618] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17261954077) returned 1 [0052.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae2bc810, dwHighDateTime=0x1d585b4)) [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338230 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338230 | out: hHeap=0x260000) returned 1 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758a78 [0052.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.619] GetLastError () returned 0x0 [0052.619] GetLastError () returned 0x0 [0052.619] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.619] GetLastError () returned 0x0 [0052.620] GetLastError () returned 0x0 [0052.621] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbb9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.621] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4464, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x4464, lpOverlapped=0x0) returned 1 [0052.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.622] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.622] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.622] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.622] CloseHandle (hObject=0x110) returned 1 [0052.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.623] GetLastError () returned 0x0 [0052.624] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.625] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.625] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.625] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17262628200) returned 1 [0052.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae2e2970, dwHighDateTime=0x1d585b4)) [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3381f8 [0052.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381f8 | out: hHeap=0x260000) returned 1 [0052.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758b10 [0052.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.626] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.626] GetLastError () returned 0x0 [0052.626] GetLastError () returned 0x0 [0052.626] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.626] GetLastError () returned 0x0 [0052.626] GetLastError () returned 0x0 [0052.628] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff7a30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.628] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x85d0, lpOverlapped=0x0) returned 1 [0052.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.629] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.629] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.629] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.630] CloseHandle (hObject=0x110) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.631] GetLastError () returned 0x0 [0052.631] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.632] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.632] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.632] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17263310819) returned 1 [0052.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae2e2970, dwHighDateTime=0x1d585b4)) [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a30 | out: hHeap=0x260000) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758ba8 [0052.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.633] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.633] GetLastError () returned 0x0 [0052.633] GetLastError () returned 0x0 [0052.633] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.633] GetLastError () returned 0x0 [0052.633] GetLastError () returned 0x0 [0052.635] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffce30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.635] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x31d0, lpOverlapped=0x0) returned 1 [0052.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.635] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.635] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.636] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.636] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.636] CloseHandle (hObject=0x110) returned 1 [0052.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0052.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0052.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.637] GetLastError () returned 0x0 [0052.637] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.638] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.638] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.638] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.638] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17263957163) returned 1 [0052.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae308ad0, dwHighDateTime=0x1d585b4)) [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1870 | out: hHeap=0x260000) returned 1 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758c40 [0052.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.639] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.639] GetLastError () returned 0x0 [0052.639] GetLastError () returned 0x0 [0052.639] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.639] GetLastError () returned 0x0 [0052.640] GetLastError () returned 0x0 [0052.804] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe2f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.804] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1d08, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d08, lpOverlapped=0x0) returned 1 [0052.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0052.806] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.806] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.806] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.806] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.807] CloseHandle (hObject=0x110) returned 1 [0052.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.[deadmin@cock.li].deadmin")) returned 1 [0052.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.896] GetLastError () returned 0x0 [0052.897] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.897] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.898] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.898] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17289882716) returned 1 [0052.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae56a0d0, dwHighDateTime=0x1d585b4)) [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1cd0 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x260000) returned 1 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758cd8 [0052.898] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.898] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.898] GetLastError () returned 0x0 [0052.899] GetLastError () returned 0x0 [0052.899] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.899] GetLastError () returned 0x0 [0052.899] GetLastError () returned 0x0 [0052.902] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8dec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.902] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x7214, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x7214, lpOverlapped=0x0) returned 1 [0052.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.903] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.903] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.903] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.903] CloseHandle (hObject=0x110) returned 1 [0052.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.905] GetLastError () returned 0x0 [0052.905] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.906] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.906] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17290697923) returned 1 [0052.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae590230, dwHighDateTime=0x1d585b4)) [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1838 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759c48 [0052.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.906] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.907] GetLastError () returned 0x0 [0052.907] GetLastError () returned 0x0 [0052.907] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.907] GetLastError () returned 0x0 [0052.907] GetLastError () returned 0x0 [0052.909] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff985d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.909] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x67a3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x67a3, lpOverlapped=0x0) returned 1 [0052.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.909] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.909] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.909] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.909] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.910] CloseHandle (hObject=0x110) returned 1 [0052.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.911] GetLastError () returned 0x0 [0052.911] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.912] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.912] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.912] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17291319065) returned 1 [0052.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae590230, dwHighDateTime=0x1d585b4)) [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1800 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759ce0 [0052.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.913] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.913] GetLastError () returned 0x0 [0052.913] GetLastError () returned 0x0 [0052.913] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.913] GetLastError () returned 0x0 [0052.913] GetLastError () returned 0x0 [0052.915] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa21e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.915] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5de2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x5de2, lpOverlapped=0x0) returned 1 [0052.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.916] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.916] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.916] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.917] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.917] CloseHandle (hObject=0x110) returned 1 [0052.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.918] GetLastError () returned 0x0 [0052.918] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.919] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.919] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.919] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17292027377) returned 1 [0052.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae5b6390, dwHighDateTime=0x1d585b4)) [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d220 [0052.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d220 | out: hHeap=0x260000) returned 1 [0052.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759d78 [0052.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.920] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.920] GetLastError () returned 0x0 [0052.920] GetLastError () returned 0x0 [0052.920] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.920] GetLastError () returned 0x0 [0052.920] GetLastError () returned 0x0 [0052.922] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffa4d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.922] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x5b2a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x5b2a, lpOverlapped=0x0) returned 1 [0052.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.922] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.923] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.923] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.923] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.923] CloseHandle (hObject=0x110) returned 1 [0052.923] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0052.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.[deadmin@cock.li].deadmin")) returned 1 [0052.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0052.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0052.924] GetLastError () returned 0x0 [0052.925] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0052.925] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0052.925] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0052.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0052.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0052.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0052.925] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17292663036) returned 1 [0052.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae5b6390, dwHighDateTime=0x1d585b4)) [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb58 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0052.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb58 | out: hHeap=0x260000) returned 1 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0052.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0052.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0052.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2759e10 [0052.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0052.926] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0052.926] GetLastError () returned 0x0 [0052.926] GetLastError () returned 0x0 [0052.926] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0052.927] GetLastError () returned 0x0 [0052.927] GetLastError () returned 0x0 [0052.960] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff82da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.960] WriteFile (in: hFile=0x110, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x7d26, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x7d26, lpOverlapped=0x0) returned 1 [0052.960] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0052.963] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.963] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0052.963] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0052.963] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0052.963] CloseHandle (hObject=0x110) returned 1 [0053.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.[deadmin@cock.li].deadmin")) returned 1 [0053.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.230] GetLastError () returned 0x0 [0053.230] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756858) returned 1 [0053.255] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.255] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.255] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17325600225) returned 1 [0053.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae8d6070, dwHighDateTime=0x1d585b4)) [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299750 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299750 | out: hHeap=0x260000) returned 1 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275acd8 [0053.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.256] GetLastError () returned 0x0 [0053.256] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.256] GetLastError () returned 0x0 [0053.264] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe18c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.265] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1e74, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1e74, lpOverlapped=0x0) returned 1 [0053.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.265] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.265] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.266] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.266] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.266] CloseHandle (hObject=0x110) returned 1 [0053.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.289] GetLastError () returned 0x0 [0053.290] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.291] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.291] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17329181936) returned 1 [0053.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae948490, dwHighDateTime=0x1d585b4)) [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00e0 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00e0 | out: hHeap=0x260000) returned 1 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ad70 [0053.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.291] GetLastError () returned 0x0 [0053.291] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.292] GetLastError () returned 0x0 [0053.302] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffb8dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.302] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x4724, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x4724, lpOverlapped=0x0) returned 1 [0053.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.303] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.303] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.303] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.303] CloseHandle (hObject=0x110) returned 1 [0053.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.304] GetLastError () returned 0x0 [0053.305] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.306] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.306] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.306] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17330703025) returned 1 [0053.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae96e5f0, dwHighDateTime=0x1d585b4)) [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd28 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd28 | out: hHeap=0x260000) returned 1 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b100 [0053.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.307] GetLastError () returned 0x0 [0053.307] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.307] GetLastError () returned 0x0 [0053.320] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffeb00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.320] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x1500, lpOverlapped=0x0) returned 1 [0053.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.321] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.321] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.322] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.322] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.322] CloseHandle (hObject=0x110) returned 1 [0053.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.323] GetLastError () returned 0x0 [0053.324] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.324] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.325] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17332578263) returned 1 [0053.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae994750, dwHighDateTime=0x1d585b4)) [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295540 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295540 | out: hHeap=0x260000) returned 1 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b230 [0053.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.325] GetLastError () returned 0x0 [0053.326] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.326] GetLastError () returned 0x0 [0053.338] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe2b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.338] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1d4c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d4c, lpOverlapped=0x0) returned 1 [0053.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.342] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.342] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.343] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.343] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.343] CloseHandle (hObject=0x110) returned 1 [0053.343] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.344] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.344] GetLastError () returned 0x0 [0053.345] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.345] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.346] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17334670543) returned 1 [0053.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xae9ba8b0, dwHighDateTime=0x1d585b4)) [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295508 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295508 | out: hHeap=0x260000) returned 1 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b3f8 [0053.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.346] GetLastError () returned 0x0 [0053.346] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.347] GetLastError () returned 0x0 [0053.359] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcfc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.363] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3040, lpOverlapped=0x0) returned 1 [0053.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.379] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.379] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.380] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.380] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.380] CloseHandle (hObject=0x110) returned 1 [0053.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.382] GetLastError () returned 0x0 [0053.383] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.384] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.384] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.384] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17338491264) returned 1 [0053.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaea2ccd0, dwHighDateTime=0x1d585b4)) [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b490 [0053.384] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.384] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.385] GetLastError () returned 0x0 [0053.385] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.385] GetLastError () returned 0x0 [0053.445] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc01e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.445] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3fe2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3fe2, lpOverlapped=0x0) returned 1 [0053.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.445] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.445] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.446] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.446] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.446] CloseHandle (hObject=0x110) returned 1 [0053.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.448] GetLastError () returned 0x0 [0053.451] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.452] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.452] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.452] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17345313330) returned 1 [0053.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeac5250, dwHighDateTime=0x1d585b4)) [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c0d0 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c0d0 | out: hHeap=0x260000) returned 1 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b5c0 [0053.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.453] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.453] GetLastError () returned 0x0 [0053.453] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.453] GetLastError () returned 0x0 [0053.455] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdc6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.455] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2394, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x2394, lpOverlapped=0x0) returned 1 [0053.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.456] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.456] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.456] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.456] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.457] CloseHandle (hObject=0x110) returned 1 [0053.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.458] GetLastError () returned 0x0 [0053.458] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.459] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.459] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17346012730) returned 1 [0053.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeac5250, dwHighDateTime=0x1d585b4)) [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c108 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c108 | out: hHeap=0x260000) returned 1 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b950 [0053.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.460] GetLastError () returned 0x0 [0053.460] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.460] GetLastError () returned 0x0 [0053.511] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd5bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.511] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x2a44, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x2a44, lpOverlapped=0x0) returned 1 [0053.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.512] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.512] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.512] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.512] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.513] CloseHandle (hObject=0x110) returned 1 [0053.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.513] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.514] GetLastError () returned 0x0 [0053.514] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.515] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.515] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17351647569) returned 1 [0053.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeb5d7d0, dwHighDateTime=0x1d585b4)) [0053.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5550 [0053.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5550 | out: hHeap=0x260000) returned 1 [0053.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b9e8 [0053.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.516] GetLastError () returned 0x0 [0053.516] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.516] GetLastError () returned 0x0 [0053.520] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd624, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.520] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x29dc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x29dc, lpOverlapped=0x0) returned 1 [0053.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.520] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.520] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.521] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.521] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.521] CloseHandle (hObject=0x110) returned 1 [0053.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.522] GetLastError () returned 0x0 [0053.522] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.523] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.523] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.523] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17352423048) returned 1 [0053.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeb5d7d0, dwHighDateTime=0x1d585b4)) [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5518 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5518 | out: hHeap=0x260000) returned 1 [0053.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275bce0 [0053.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.524] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.524] GetLastError () returned 0x0 [0053.524] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.524] GetLastError () returned 0x0 [0053.545] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.545] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3004, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3004, lpOverlapped=0x0) returned 1 [0053.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.548] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.548] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.548] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.549] CloseHandle (hObject=0x110) returned 1 [0053.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.550] GetLastError () returned 0x0 [0053.550] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.551] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17355214252) returned 1 [0053.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeba9a90, dwHighDateTime=0x1d585b4)) [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c178 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c178 | out: hHeap=0x260000) returned 1 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275bd78 [0053.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.552] GetLastError () returned 0x0 [0053.552] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.552] GetLastError () returned 0x0 [0053.556] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc162, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.556] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3e9e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3e9e, lpOverlapped=0x0) returned 1 [0053.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.556] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.556] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.557] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.557] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.557] CloseHandle (hObject=0x110) returned 1 [0053.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.558] GetLastError () returned 0x0 [0053.559] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.560] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.560] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.560] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17356084524) returned 1 [0053.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaebcfbf0, dwHighDateTime=0x1d585b4)) [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c1b0 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c1b0 | out: hHeap=0x260000) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325f20 [0053.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.560] GetLastError () returned 0x0 [0053.561] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.561] GetLastError () returned 0x0 [0053.563] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8c5e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.563] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x73a2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x73a2, lpOverlapped=0x0) returned 1 [0053.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.564] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.564] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.564] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.564] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.564] CloseHandle (hObject=0x110) returned 1 [0053.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.565] GetLastError () returned 0x0 [0053.566] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756858) returned 1 [0053.566] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.566] CryptReleaseContext (hProv=0x2756858, dwFlags=0x0) returned 1 [0053.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.567] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17356770380) returned 1 [0053.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaebcfbf0, dwHighDateTime=0x1d585b4)) [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c220 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c220 | out: hHeap=0x260000) returned 1 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2120 [0053.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.567] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.567] GetLastError () returned 0x0 [0053.567] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.567] GetLastError () returned 0x0 [0053.594] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe35c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.594] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1ca4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ca4, lpOverlapped=0x0) returned 1 [0053.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0053.595] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.595] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.595] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.596] CloseHandle (hObject=0x110) returned 1 [0053.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.597] GetLastError () returned 0x0 [0053.597] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.603] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0053.603] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17360412425) returned 1 [0053.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaec42010, dwHighDateTime=0x1d585b4)) [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c290 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c290 | out: hHeap=0x260000) returned 1 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2250 [0053.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.610] GetLastError () returned 0x0 [0053.610] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.610] GetLastError () returned 0x0 [0053.620] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdf86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.620] WriteFile (in: hFile=0x110, lpBuffer=0x27ce068*, nNumberOfBytesToWrite=0x207a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ce068*, lpNumberOfBytesWritten=0x24cfdb0*=0x207a, lpOverlapped=0x0) returned 1 [0053.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce068 | out: hHeap=0x260000) returned 1 [0053.620] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.620] WriteFile (in: hFile=0x110, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.620] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.621] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.621] CloseHandle (hObject=0x110) returned 1 [0053.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0053.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0053.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0053.637] GetLastError () returned 0x0 [0053.643] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.648] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.649] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.649] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17364982722) returned 1 [0053.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaecb4430, dwHighDateTime=0x1d585b4)) [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c3a8 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c3a8 | out: hHeap=0x260000) returned 1 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2548 [0053.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.649] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.649] GetLastError () returned 0x0 [0053.650] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.650] GetLastError () returned 0x0 [0053.652] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff1a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.652] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0xe60, lpOverlapped=0x0) returned 1 [0053.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.653] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.653] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.653] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.653] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.654] CloseHandle (hObject=0xf8) returned 1 [0053.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.654] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.655] GetLastError () returned 0x0 [0053.656] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.657] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.657] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17365786515) returned 1 [0053.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaecb4430, dwHighDateTime=0x1d585b4)) [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c418 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c418 | out: hHeap=0x260000) returned 1 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f25e0 [0053.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.657] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.657] GetLastError () returned 0x0 [0053.658] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.658] GetLastError () returned 0x0 [0053.678] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffeb32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.679] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x14ce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x14ce, lpOverlapped=0x0) returned 1 [0053.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.679] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.679] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.679] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.679] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.680] CloseHandle (hObject=0xf8) returned 1 [0053.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.681] GetLastError () returned 0x0 [0053.681] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.682] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.682] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.682] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17368343997) returned 1 [0053.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaed006f0, dwHighDateTime=0x1d585b4)) [0053.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c4f8 [0053.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c4f8 | out: hHeap=0x260000) returned 1 [0053.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f27a8 [0053.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.683] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.683] GetLastError () returned 0x0 [0053.683] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.683] GetLastError () returned 0x0 [0053.687] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe9b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.687] WriteFile (in: hFile=0xf8, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x164c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x164c, lpOverlapped=0x0) returned 1 [0053.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0053.688] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.688] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.688] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.689] CloseHandle (hObject=0xf8) returned 1 [0053.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cec0 [0053.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x260000) returned 1 [0053.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.690] GetLastError () returned 0x0 [0053.690] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.691] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0053.691] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.691] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17369187677) returned 1 [0053.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaed006f0, dwHighDateTime=0x1d585b4)) [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c530 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0053.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c530 | out: hHeap=0x260000) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2a08 [0053.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.691] GetLastError () returned 0x0 [0053.692] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.692] GetLastError () returned 0x0 [0053.696] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff62da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.696] WriteFile (in: hFile=0xf8, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x9d26, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x9d26, lpOverlapped=0x0) returned 1 [0053.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0053.697] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.697] WriteFile (in: hFile=0xf8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.697] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.697] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.698] CloseHandle (hObject=0xf8) returned 1 [0053.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0053.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0053.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.959] GetLastError () returned 0x0 [0053.971] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.972] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.972] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.972] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17397347648) returned 1 [0053.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaefadfb0, dwHighDateTime=0x1d585b4)) [0053.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f56a0 [0053.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f56a0 | out: hHeap=0x260000) returned 1 [0053.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2aa0 [0053.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.973] GetLastError () returned 0x0 [0053.973] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.973] GetLastError () returned 0x0 [0053.975] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.975] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x2004, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x2004, lpOverlapped=0x0) returned 1 [0053.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.975] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.976] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.976] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.976] CloseHandle (hObject=0x110) returned 1 [0053.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0053.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0053.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.977] GetLastError () returned 0x0 [0053.978] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.979] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.979] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.979] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17398014598) returned 1 [0053.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaefd4110, dwHighDateTime=0x1d585b4)) [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ca00 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ca00 | out: hHeap=0x260000) returned 1 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3aa8 [0053.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.980] GetLastError () returned 0x0 [0053.980] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.980] GetLastError () returned 0x0 [0053.981] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe3f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.982] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1c0c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c0c, lpOverlapped=0x0) returned 1 [0053.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.982] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.982] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.982] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.982] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.983] CloseHandle (hObject=0x110) returned 1 [0053.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0053.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0053.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.984] GetLastError () returned 0x0 [0053.984] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.985] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.985] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.985] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17398597865) returned 1 [0053.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaefd4110, dwHighDateTime=0x1d585b4)) [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ca38 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ca38 | out: hHeap=0x260000) returned 1 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3b40 [0053.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.985] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.986] GetLastError () returned 0x0 [0053.986] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.986] GetLastError () returned 0x0 [0053.990] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffeb40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.990] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x14c0, lpOverlapped=0x0) returned 1 [0053.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.990] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.990] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.991] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.991] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.991] CloseHandle (hObject=0x110) returned 1 [0053.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d2a8 [0053.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d2a8 | out: hHeap=0x260000) returned 1 [0053.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.992] GetLastError () returned 0x0 [0053.992] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.993] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.993] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.993] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17399444032) returned 1 [0053.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeffa270, dwHighDateTime=0x1d585b4)) [0053.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ca70 [0053.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0053.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ca70 | out: hHeap=0x260000) returned 1 [0053.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0053.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0053.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0053.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0053.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3bd8 [0053.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0053.994] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0053.994] GetLastError () returned 0x0 [0053.994] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0053.994] GetLastError () returned 0x0 [0053.996] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe084, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.996] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1f7c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f7c, lpOverlapped=0x0) returned 1 [0053.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0053.996] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.996] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0053.997] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0053.997] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0053.997] CloseHandle (hObject=0x110) returned 1 [0053.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0053.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.[deadmin@cock.li].deadmin")) returned 1 [0053.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0053.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0053.998] GetLastError () returned 0x0 [0053.998] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0053.999] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0053.999] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0053.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0053.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0053.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0053.999] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17400036526) returned 1 [0053.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeffa270, dwHighDateTime=0x1d585b4)) [0053.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0053.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0053.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0053.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275caa8 [0054.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275caa8 | out: hHeap=0x260000) returned 1 [0054.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3c70 [0054.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.000] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.000] GetLastError () returned 0x0 [0054.000] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.000] GetLastError () returned 0x0 [0054.002] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff85ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.002] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x7a46, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x7a46, lpOverlapped=0x0) returned 1 [0054.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.003] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.003] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.003] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.003] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.003] CloseHandle (hObject=0x110) returned 1 [0054.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.004] GetLastError () returned 0x0 [0054.004] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.005] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.005] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17400642837) returned 1 [0054.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaeffa270, dwHighDateTime=0x1d585b4)) [0054.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cb18 [0054.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cb18 | out: hHeap=0x260000) returned 1 [0054.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3d08 [0054.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.006] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.006] GetLastError () returned 0x0 [0054.006] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.006] GetLastError () returned 0x0 [0054.086] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff5f50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.092] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xa0b0, lpOverlapped=0x0) returned 1 [0054.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.104] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.104] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.115] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.115] CloseHandle (hObject=0x110) returned 1 [0054.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.116] GetLastError () returned 0x0 [0054.116] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.117] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.117] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.117] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17411964123) returned 1 [0054.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf12ad70, dwHighDateTime=0x1d585b4)) [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ce60 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ce60 | out: hHeap=0x260000) returned 1 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d650 [0054.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.119] GetLastError () returned 0x0 [0054.119] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.119] GetLastError () returned 0x0 [0054.123] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd294, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.123] WriteFile (in: hFile=0x110, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2d6c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x2d6c, lpOverlapped=0x0) returned 1 [0054.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.124] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.124] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.124] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.124] CloseHandle (hObject=0x110) returned 1 [0054.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.125] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.125] GetLastError () returned 0x0 [0054.126] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.126] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.126] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.126] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17412762073) returned 1 [0054.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf12ad70, dwHighDateTime=0x1d585b4)) [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ce98 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ce98 | out: hHeap=0x260000) returned 1 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d780 [0054.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.127] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.127] GetLastError () returned 0x0 [0054.127] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.127] GetLastError () returned 0x0 [0054.131] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffe0b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.131] WriteFile (in: hFile=0x110, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f50, lpOverlapped=0x0) returned 1 [0054.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0054.133] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.133] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.133] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.133] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.134] CloseHandle (hObject=0x110) returned 1 [0054.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.135] GetLastError () returned 0x0 [0054.135] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.136] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.136] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17413680184) returned 1 [0054.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf150ed0, dwHighDateTime=0x1d585b4)) [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275ced0 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275ced0 | out: hHeap=0x260000) returned 1 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d818 [0054.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.136] GetLastError () returned 0x0 [0054.136] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.137] GetLastError () returned 0x0 [0054.140] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff7e32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.140] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x81ce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x81ce, lpOverlapped=0x0) returned 1 [0054.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.140] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.140] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.141] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.141] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.141] CloseHandle (hObject=0x110) returned 1 [0054.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0054.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0054.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.142] GetLastError () returned 0x0 [0054.142] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.143] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.143] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.143] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17414449870) returned 1 [0054.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf150ed0, dwHighDateTime=0x1d585b4)) [0054.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cf08 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cf08 | out: hHeap=0x260000) returned 1 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d8b0 [0054.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.144] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.144] GetLastError () returned 0x0 [0054.144] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.144] GetLastError () returned 0x0 [0054.146] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdbb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.146] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x244a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x244a, lpOverlapped=0x0) returned 1 [0054.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.146] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.146] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.147] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.147] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.147] CloseHandle (hObject=0x110) returned 1 [0054.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.148] GetLastError () returned 0x0 [0054.148] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.149] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.149] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.149] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17415050094) returned 1 [0054.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf177030, dwHighDateTime=0x1d585b4)) [0054.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cf40 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cf40 | out: hHeap=0x260000) returned 1 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d948 [0054.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.150] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.150] GetLastError () returned 0x0 [0054.150] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.150] GetLastError () returned 0x0 [0054.258] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffba5e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.258] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x45a2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x45a2, lpOverlapped=0x0) returned 1 [0054.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.272] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.272] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.279] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.280] CloseHandle (hObject=0x110) returned 1 [0054.280] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.289] GetLastError () returned 0x0 [0054.289] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.290] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.290] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17429136997) returned 1 [0054.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf2cdc90, dwHighDateTime=0x1d585b4)) [0054.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761338 [0054.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761338 | out: hHeap=0x260000) returned 1 [0054.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d9e0 [0054.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.291] GetLastError () returned 0x0 [0054.291] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.291] GetLastError () returned 0x0 [0054.294] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffef9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.294] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1066, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1066, lpOverlapped=0x0) returned 1 [0054.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.295] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.295] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.295] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.295] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.295] CloseHandle (hObject=0x110) returned 1 [0054.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.296] GetLastError () returned 0x0 [0054.297] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.297] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.298] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17429873509) returned 1 [0054.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf2cdc90, dwHighDateTime=0x1d585b4)) [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761370 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761370 | out: hHeap=0x260000) returned 1 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e3f8 [0054.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.298] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.298] GetLastError () returned 0x0 [0054.298] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.298] GetLastError () returned 0x0 [0054.300] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffccd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.300] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x332a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x332a, lpOverlapped=0x0) returned 1 [0054.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.301] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.301] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.301] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.301] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.301] CloseHandle (hObject=0x110) returned 1 [0054.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.302] GetLastError () returned 0x0 [0054.303] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.303] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.303] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.304] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17430478000) returned 1 [0054.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf2f3df0, dwHighDateTime=0x1d585b4)) [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27613a8 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27613a8 | out: hHeap=0x260000) returned 1 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e490 [0054.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.304] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.304] GetLastError () returned 0x0 [0054.304] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.305] GetLastError () returned 0x0 [0054.306] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff943e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.306] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6bc2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x6bc2, lpOverlapped=0x0) returned 1 [0054.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.307] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.307] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.307] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.307] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.308] CloseHandle (hObject=0x110) returned 1 [0054.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.309] GetLastError () returned 0x0 [0054.309] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.310] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.310] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17431128760) returned 1 [0054.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf2f3df0, dwHighDateTime=0x1d585b4)) [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27613e0 [0054.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27613e0 | out: hHeap=0x260000) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e528 [0054.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.311] GetLastError () returned 0x0 [0054.311] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.311] GetLastError () returned 0x0 [0054.315] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff5f7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.316] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xa086, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xa086, lpOverlapped=0x0) returned 1 [0054.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.316] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.316] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.316] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.317] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.317] CloseHandle (hObject=0x110) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.318] GetLastError () returned 0x0 [0054.318] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.319] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.319] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.319] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17432050275) returned 1 [0054.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf319f50, dwHighDateTime=0x1d585b4)) [0054.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761418 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761418 | out: hHeap=0x260000) returned 1 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e5c0 [0054.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.320] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.320] GetLastError () returned 0x0 [0054.320] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.320] GetLastError () returned 0x0 [0054.402] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc7f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.402] WriteFile (in: hFile=0x110, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x380a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x380a, lpOverlapped=0x0) returned 1 [0054.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0054.403] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.403] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.403] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.403] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.404] CloseHandle (hObject=0x110) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.482] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.496] GetLastError () returned 0x0 [0054.503] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.518] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.518] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.518] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17451893432) returned 1 [0054.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf4e2fd0, dwHighDateTime=0x1d585b4)) [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27615d8 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27615d8 | out: hHeap=0x260000) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ebb0 [0054.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.518] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.519] GetLastError () returned 0x0 [0054.519] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.519] GetLastError () returned 0x0 [0054.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff3460, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.522] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0xcba0, lpOverlapped=0x0) returned 1 [0054.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.522] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.523] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.523] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.523] CloseHandle (hObject=0xf0) returned 1 [0054.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.524] GetLastError () returned 0x0 [0054.524] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.525] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.525] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17452631809) returned 1 [0054.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf509130, dwHighDateTime=0x1d585b4)) [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761648 [0054.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761648 | out: hHeap=0x260000) returned 1 [0054.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.526] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275eb18 [0054.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.526] GetLastError () returned 0x0 [0054.526] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.526] GetLastError () returned 0x0 [0054.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffae42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.528] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x51be, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x51be, lpOverlapped=0x0) returned 1 [0054.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.528] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.528] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.529] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.529] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.529] CloseHandle (hObject=0xf0) returned 1 [0054.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.530] GetLastError () returned 0x0 [0054.530] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.531] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.531] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.531] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17453239348) returned 1 [0054.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf509130, dwHighDateTime=0x1d585b4)) [0054.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27616b8 [0054.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27616b8 | out: hHeap=0x260000) returned 1 [0054.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ece0 [0054.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.532] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.532] GetLastError () returned 0x0 [0054.532] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.532] GetLastError () returned 0x0 [0054.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeccc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.534] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1334, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x1334, lpOverlapped=0x0) returned 1 [0054.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.534] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.534] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.535] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.535] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.535] CloseHandle (hObject=0xf0) returned 1 [0054.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.536] GetLastError () returned 0x0 [0054.536] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.537] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.537] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.537] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17453820097) returned 1 [0054.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf509130, dwHighDateTime=0x1d585b4)) [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27616f0 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27616f0 | out: hHeap=0x260000) returned 1 [0054.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ee10 [0054.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.538] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.538] GetLastError () returned 0x0 [0054.538] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.538] GetLastError () returned 0x0 [0054.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe2c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.540] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1d3c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d3c, lpOverlapped=0x0) returned 1 [0054.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.540] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.540] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.540] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.540] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.541] CloseHandle (hObject=0xf0) returned 1 [0054.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.542] GetLastError () returned 0x0 [0054.542] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.543] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0054.543] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0054.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.543] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17454438680) returned 1 [0054.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf52f290, dwHighDateTime=0x1d585b4)) [0054.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761728 [0054.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0054.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761728 | out: hHeap=0x260000) returned 1 [0054.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0054.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275eea8 [0054.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.544] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.544] GetLastError () returned 0x0 [0054.544] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.544] GetLastError () returned 0x0 [0054.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffec48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.546] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x13b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x13b8, lpOverlapped=0x0) returned 1 [0054.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.546] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.547] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.547] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.547] CloseHandle (hObject=0xf0) returned 1 [0054.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.548] GetLastError () returned 0x0 [0054.548] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757738) returned 1 [0054.549] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0054.549] CryptReleaseContext (hProv=0x2757738, dwFlags=0x0) returned 1 [0054.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.549] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17455027691) returned 1 [0054.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf52f290, dwHighDateTime=0x1d585b4)) [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761760 [0054.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761760 | out: hHeap=0x260000) returned 1 [0054.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ef40 [0054.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.550] GetLastError () returned 0x0 [0054.550] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.550] GetLastError () returned 0x0 [0054.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffed7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.620] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x1284, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x1284, lpOverlapped=0x0) returned 1 [0054.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0054.621] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.621] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.621] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.621] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.622] CloseHandle (hObject=0xf0) returned 1 [0054.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.673] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.692] GetLastError () returned 0x0 [0054.699] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.759] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.759] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.760] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17476068516) returned 1 [0054.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf7445d0, dwHighDateTime=0x1d585b4)) [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761b18 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761b18 | out: hHeap=0x260000) returned 1 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f9f0 [0054.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.760] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.760] GetLastError () returned 0x0 [0054.760] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.760] GetLastError () returned 0x0 [0054.764] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff328, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.764] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xcd8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xcd8, lpOverlapped=0x0) returned 1 [0054.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.765] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.765] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.765] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.766] CloseHandle (hObject=0x118) returned 1 [0054.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.766] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.767] GetLastError () returned 0x0 [0054.767] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.768] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.768] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.768] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17476982826) returned 1 [0054.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf7445d0, dwHighDateTime=0x1d585b4)) [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1820 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1820 | out: hHeap=0x260000) returned 1 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f8c0 [0054.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.769] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.769] GetLastError () returned 0x0 [0054.770] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.770] GetLastError () returned 0x0 [0054.771] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffeb8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.771] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x1476, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x1476, lpOverlapped=0x0) returned 1 [0054.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.772] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.772] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.772] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.772] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.773] CloseHandle (hObject=0x118) returned 1 [0054.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.774] GetLastError () returned 0x0 [0054.774] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.775] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.775] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.775] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17477637338) returned 1 [0054.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf76a730, dwHighDateTime=0x1d585b4)) [0054.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f17e8 [0054.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f17e8 | out: hHeap=0x260000) returned 1 [0054.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0054.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.776] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.776] GetLastError () returned 0x0 [0054.776] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.776] GetLastError () returned 0x0 [0054.778] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff6d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.778] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x92e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x92e, lpOverlapped=0x0) returned 1 [0054.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.778] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.778] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.779] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.779] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.779] CloseHandle (hObject=0x118) returned 1 [0054.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.780] GetLastError () returned 0x0 [0054.781] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.781] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.781] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.781] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17478263588) returned 1 [0054.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf76a730, dwHighDateTime=0x1d585b4)) [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f17b0 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f17b0 | out: hHeap=0x260000) returned 1 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fbb8 [0054.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.782] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.782] GetLastError () returned 0x0 [0054.782] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.782] GetLastError () returned 0x0 [0054.784] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff5b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.784] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0xa4e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0xa4e, lpOverlapped=0x0) returned 1 [0054.784] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.784] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.784] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.785] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.785] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.785] CloseHandle (hObject=0x118) returned 1 [0054.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0054.785] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0054.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.786] GetLastError () returned 0x0 [0054.786] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.787] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.787] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.788] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17478870966) returned 1 [0054.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf790890, dwHighDateTime=0x1d585b4)) [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1778 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1778 | out: hHeap=0x260000) returned 1 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f370 [0054.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f370 | out: hHeap=0x260000) returned 1 [0054.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fc50 [0054.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.788] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.788] GetLastError () returned 0x0 [0054.788] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.788] GetLastError () returned 0x0 [0054.808] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff6da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.808] WriteFile (in: hFile=0x118, lpBuffer=0x279c058*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x279c058*, lpNumberOfBytesWritten=0x24cfdb0*=0x926, lpOverlapped=0x0) returned 1 [0054.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x279c058 | out: hHeap=0x260000) returned 1 [0054.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.813] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.814] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.814] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.814] CloseHandle (hObject=0x118) returned 1 [0054.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.882] GetLastError () returned 0x0 [0054.901] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.902] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.902] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.902] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17490346225) returned 1 [0054.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf89b230, dwHighDateTime=0x1d585b4)) [0054.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761c30 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761c30 | out: hHeap=0x260000) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fce8 [0054.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.903] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.903] GetLastError () returned 0x0 [0054.903] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.903] GetLastError () returned 0x0 [0054.905] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffbcd0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.905] WriteFile (in: hFile=0x110, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x4330, lpOverlapped=0x0) returned 1 [0054.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0054.906] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.906] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.907] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.907] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.907] CloseHandle (hObject=0x110) returned 1 [0054.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0054.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0054.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.909] GetLastError () returned 0x0 [0054.909] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.910] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.910] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17491117543) returned 1 [0054.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf89b230, dwHighDateTime=0x1d585b4)) [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761df0 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761df0 | out: hHeap=0x260000) returned 1 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760370 [0054.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.911] GetLastError () returned 0x0 [0054.911] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.911] GetLastError () returned 0x0 [0054.916] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffee212, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.916] WriteFile (in: hFile=0x110, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x11dee, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x11dee, lpOverlapped=0x0) returned 1 [0054.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0054.917] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.917] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.918] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.918] CloseHandle (hObject=0x110) returned 1 [0054.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.919] GetLastError () returned 0x0 [0054.919] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.920] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.920] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.920] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17492137112) returned 1 [0054.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf8c1390, dwHighDateTime=0x1d585b4)) [0054.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e60 [0054.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e60 | out: hHeap=0x260000) returned 1 [0054.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760408 [0054.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.921] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.921] GetLastError () returned 0x0 [0054.921] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.921] GetLastError () returned 0x0 [0054.923] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff4a4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.923] WriteFile (in: hFile=0x110, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0xb5b4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0xb5b4, lpOverlapped=0x0) returned 1 [0054.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0054.924] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.924] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.924] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.924] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.924] CloseHandle (hObject=0x110) returned 1 [0054.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.925] GetLastError () returned 0x0 [0054.926] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.927] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.927] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17492824181) returned 1 [0054.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf8c1390, dwHighDateTime=0x1d585b4)) [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e98 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e98 | out: hHeap=0x260000) returned 1 [0054.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1be8 [0054.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0054.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1be8 | out: hHeap=0x260000) returned 1 [0054.928] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.928] GetLastError () returned 0x0 [0054.928] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.928] GetLastError () returned 0x0 [0054.930] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffce24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.930] WriteFile (in: hFile=0x110, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x31dc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x31dc, lpOverlapped=0x0) returned 1 [0054.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0054.930] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.930] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.931] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.931] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.931] CloseHandle (hObject=0x110) returned 1 [0054.933] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0054.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.[deadmin@cock.li].deadmin")) returned 1 [0054.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0054.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0054.935] GetLastError () returned 0x0 [0054.935] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0054.935] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0054.935] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0054.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0054.936] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17493676627) returned 1 [0054.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaf8e74f0, dwHighDateTime=0x1d585b4)) [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761ed0 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0054.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761ed0 | out: hHeap=0x260000) returned 1 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0054.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0054.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0054.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27605d0 [0054.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0054.936] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0054.936] GetLastError () returned 0x0 [0054.936] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0054.937] GetLastError () returned 0x0 [0054.984] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffc7ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.984] WriteFile (in: hFile=0x110, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x3854, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3854, lpOverlapped=0x0) returned 1 [0054.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0054.986] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.986] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0054.986] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0054.986] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0054.987] CloseHandle (hObject=0x110) returned 1 [0055.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.199] GetLastError () returned 0x0 [0055.199] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.200] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.200] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.200] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17520103924) returned 1 [0055.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xafb6ec50, dwHighDateTime=0x1d585b4)) [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0150 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0150 | out: hHeap=0x260000) returned 1 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760668 [0055.200] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.201] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.201] GetLastError () returned 0x0 [0055.201] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.201] GetLastError () returned 0x0 [0055.203] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffcab0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.203] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3550, lpOverlapped=0x0) returned 1 [0055.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0055.204] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.204] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.205] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.205] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.205] CloseHandle (hObject=0x110) returned 1 [0055.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.206] GetLastError () returned 0x0 [0055.207] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.207] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.208] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.208] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17520880175) returned 1 [0055.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xafb6ec50, dwHighDateTime=0x1d585b4)) [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0188 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0188 | out: hHeap=0x260000) returned 1 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760cf0 [0055.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.208] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.208] GetLastError () returned 0x0 [0055.209] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.209] GetLastError () returned 0x0 [0055.210] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffdc0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.210] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x23f4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x23f4, lpOverlapped=0x0) returned 1 [0055.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0055.211] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.211] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.211] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.211] CloseHandle (hObject=0x110) returned 1 [0055.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.212] GetLastError () returned 0x0 [0055.213] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.213] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0055.213] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.214] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17521478560) returned 1 [0055.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xafb94db0, dwHighDateTime=0x1d585b4)) [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762060 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0055.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762060 | out: hHeap=0x260000) returned 1 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760d88 [0055.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.214] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.214] GetLastError () returned 0x0 [0055.214] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.215] GetLastError () returned 0x0 [0055.216] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffddf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.216] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x2210, lpOverlapped=0x0) returned 1 [0055.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0055.216] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.217] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.217] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.217] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.217] CloseHandle (hObject=0x110) returned 1 [0055.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.217] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.218] GetLastError () returned 0x0 [0055.219] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d2c68) returned 1 [0055.220] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27efc0 | out: pbBuffer=0x27efc0) returned 1 [0055.220] CryptReleaseContext (hProv=0x2d2c68, dwFlags=0x0) returned 1 [0055.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27efc0 | out: hHeap=0x260000) returned 1 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.220] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17522115914) returned 1 [0055.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xafb94db0, dwHighDateTime=0x1d585b4)) [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762098 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762098 | out: hHeap=0x260000) returned 1 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760e20 [0055.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.221] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.221] GetLastError () returned 0x0 [0055.221] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.221] GetLastError () returned 0x0 [0055.225] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffde60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.225] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x21a0, lpOverlapped=0x0) returned 1 [0055.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0055.226] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.226] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.226] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.226] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.226] CloseHandle (hObject=0x110) returned 1 [0055.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.228] GetLastError () returned 0x0 [0055.228] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.229] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0055.229] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17522985528) returned 1 [0055.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xafbbaf10, dwHighDateTime=0x1d585b4)) [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f01c0 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f01c0 | out: hHeap=0x260000) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325d58 [0055.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.229] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.229] GetLastError () returned 0x0 [0055.230] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.230] GetLastError () returned 0x0 [0055.395] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffff8768, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.395] WriteFile (in: hFile=0x110, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x7898, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x7898, lpOverlapped=0x0) returned 1 [0055.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0055.397] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.398] WriteFile (in: hFile=0x110, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.398] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.398] WriteFile (in: hFile=0x110, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.399] CloseHandle (hObject=0x110) returned 1 [0055.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.399] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0055.475] GetLastError () returned 0x0 [0055.634] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.653] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.653] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.653] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17565458352) returned 1 [0055.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaffbf430, dwHighDateTime=0x1d585b4)) [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1970 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1970 | out: hHeap=0x260000) returned 1 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765820 [0055.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.654] GetLastError () returned 0x0 [0055.654] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.654] GetLastError () returned 0x0 [0055.657] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffde4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.657] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x21b2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x21b2, lpOverlapped=0x0) returned 1 [0055.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.658] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.658] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.658] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.658] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.659] CloseHandle (hObject=0x104) returned 1 [0055.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.660] GetLastError () returned 0x0 [0055.660] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.661] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.661] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.661] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17566216388) returned 1 [0055.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaffe5590, dwHighDateTime=0x1d585b4)) [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1890 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1890 | out: hHeap=0x260000) returned 1 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.661] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765068 [0055.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.662] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.662] GetLastError () returned 0x0 [0055.662] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.662] GetLastError () returned 0x0 [0055.664] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb5f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.664] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x4a0e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x4a0e, lpOverlapped=0x0) returned 1 [0055.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.664] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.664] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.665] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.665] CloseHandle (hObject=0x104) returned 1 [0055.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.666] GetLastError () returned 0x0 [0055.668] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.669] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.669] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17566984404) returned 1 [0055.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xaffe5590, dwHighDateTime=0x1d585b4)) [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1858 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1858 | out: hHeap=0x260000) returned 1 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765950 [0055.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.669] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.669] GetLastError () returned 0x0 [0055.670] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.670] GetLastError () returned 0x0 [0055.671] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd308, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.672] WriteFile (in: hFile=0x104, lpBuffer=0x27b5060*, nNumberOfBytesToWrite=0x2cf8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27b5060*, lpNumberOfBytesWritten=0x24cfdb0*=0x2cf8, lpOverlapped=0x0) returned 1 [0055.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b5060 | out: hHeap=0x260000) returned 1 [0055.674] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.674] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.674] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.674] CloseHandle (hObject=0x104) returned 1 [0055.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.675] GetLastError () returned 0x0 [0055.676] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.677] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.677] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17567834388) returned 1 [0055.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb000b6f0, dwHighDateTime=0x1d585b4)) [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762798 [0055.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762798 | out: hHeap=0x260000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27659e8 [0055.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.678] GetLastError () returned 0x0 [0055.678] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.678] GetLastError () returned 0x0 [0055.681] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb072, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.681] WriteFile (in: hFile=0x104, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x4f8e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x4f8e, lpOverlapped=0x0) returned 1 [0055.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.682] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.682] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.682] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.682] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.682] CloseHandle (hObject=0x104) returned 1 [0055.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0055.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.[deadmin@cock.li].deadmin")) returned 1 [0055.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0055.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.684] GetLastError () returned 0x0 [0055.684] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.685] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.685] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17568580853) returned 1 [0055.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb000b6f0, dwHighDateTime=0x1d585b4)) [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27627d0 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27627d0 | out: hHeap=0x260000) returned 1 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765a80 [0055.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.685] GetLastError () returned 0x0 [0055.685] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.686] GetLastError () returned 0x0 [0055.694] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd63c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.694] WriteFile (in: hFile=0x104, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x29c4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x29c4, lpOverlapped=0x0) returned 1 [0055.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.695] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.695] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.695] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.695] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.695] CloseHandle (hObject=0x104) returned 1 [0055.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.702] GetLastError () returned 0x0 [0055.702] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.703] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.703] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.703] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17570435594) returned 1 [0055.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0031850, dwHighDateTime=0x1d585b4)) [0055.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762840 [0055.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762840 | out: hHeap=0x260000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765b18 [0055.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.704] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.704] GetLastError () returned 0x0 [0055.704] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.704] GetLastError () returned 0x0 [0055.712] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff6575, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.713] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x9a8b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x9a8b, lpOverlapped=0x0) returned 1 [0055.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.713] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.713] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.713] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.714] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.714] CloseHandle (hObject=0xf8) returned 1 [0055.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d370 [0055.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d370 | out: hHeap=0x260000) returned 1 [0055.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.715] GetLastError () returned 0x0 [0055.715] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.716] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.716] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.716] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17571726814) returned 1 [0055.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb00579b0, dwHighDateTime=0x1d585b4)) [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762878 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762878 | out: hHeap=0x260000) returned 1 [0055.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765c48 [0055.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.717] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.717] GetLastError () returned 0x0 [0055.717] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.717] GetLastError () returned 0x0 [0055.720] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff7e10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.720] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x81f0, lpOverlapped=0x0) returned 1 [0055.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.720] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.720] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.721] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.721] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.721] CloseHandle (hObject=0xf8) returned 1 [0055.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.723] GetLastError () returned 0x0 [0055.724] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.725] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.725] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.725] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17572608242) returned 1 [0055.725] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb007db10, dwHighDateTime=0x1d585b4)) [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27628b0 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27628b0 | out: hHeap=0x260000) returned 1 [0055.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.725] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765ce0 [0055.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.726] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.726] GetLastError () returned 0x0 [0055.726] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.726] GetLastError () returned 0x0 [0055.728] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5545, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.728] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xaabb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xaabb, lpOverlapped=0x0) returned 1 [0055.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.729] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.729] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.730] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.730] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.730] CloseHandle (hObject=0xf8) returned 1 [0055.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.730] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.732] GetLastError () returned 0x0 [0055.732] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.733] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.733] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.733] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17573415198) returned 1 [0055.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb007db10, dwHighDateTime=0x1d585b4)) [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27628e8 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27628e8 | out: hHeap=0x260000) returned 1 [0055.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f4d8 [0055.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f4d8 | out: hHeap=0x260000) returned 1 [0055.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765d78 [0055.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.734] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.734] GetLastError () returned 0x0 [0055.734] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.734] GetLastError () returned 0x0 [0055.736] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffb526, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.736] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4ada, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ada, lpOverlapped=0x0) returned 1 [0055.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0055.737] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.737] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.737] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.738] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.738] CloseHandle (hObject=0xf8) returned 1 [0055.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c560 [0055.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c560 | out: hHeap=0x260000) returned 1 [0055.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.928] GetLastError () returned 0x0 [0055.935] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.950] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.950] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.950] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17595111808) returned 1 [0055.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0292e50, dwHighDateTime=0x1d585b4)) [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31baf8 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31baf8 | out: hHeap=0x260000) returned 1 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.950] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.951] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766e18 [0055.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.951] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.951] GetLastError () returned 0x0 [0055.951] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.951] GetLastError () returned 0x0 [0055.954] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffa5aa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.954] WriteFile (in: hFile=0xf8, lpBuffer=0x281b088*, nNumberOfBytesToWrite=0x5a56, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281b088*, lpNumberOfBytesWritten=0x24cfdb0*=0x5a56, lpOverlapped=0x0) returned 1 [0055.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281b088 | out: hHeap=0x260000) returned 1 [0055.954] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.954] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.955] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.955] CloseHandle (hObject=0xf8) returned 1 [0055.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.956] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.956] GetLastError () returned 0x0 [0055.957] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.957] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.958] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17595866294) returned 1 [0055.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb02b8fb0, dwHighDateTime=0x1d585b4)) [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762d48 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762d48 | out: hHeap=0x260000) returned 1 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766d80 [0055.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.958] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.958] GetLastError () returned 0x0 [0055.958] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.958] GetLastError () returned 0x0 [0055.960] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff978d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.960] WriteFile (in: hFile=0xf8, lpBuffer=0x281b088*, nNumberOfBytesToWrite=0x6873, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281b088*, lpNumberOfBytesWritten=0x24cfdb0*=0x6873, lpOverlapped=0x0) returned 1 [0055.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281b088 | out: hHeap=0x260000) returned 1 [0055.961] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.961] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.961] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.961] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.961] CloseHandle (hObject=0xf8) returned 1 [0055.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.963] GetLastError () returned 0x0 [0055.963] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.964] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.964] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17596487343) returned 1 [0055.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb02b8fb0, dwHighDateTime=0x1d585b4)) [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762d80 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762d80 | out: hHeap=0x260000) returned 1 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766f48 [0055.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.964] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.964] GetLastError () returned 0x0 [0055.965] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.965] GetLastError () returned 0x0 [0055.968] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffff5b69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.968] WriteFile (in: hFile=0xf8, lpBuffer=0x281b088*, nNumberOfBytesToWrite=0xa497, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281b088*, lpNumberOfBytesWritten=0x24cfdb0*=0xa497, lpOverlapped=0x0) returned 1 [0055.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281b088 | out: hHeap=0x260000) returned 1 [0055.968] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.968] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.969] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.969] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.969] CloseHandle (hObject=0xf8) returned 1 [0055.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.970] GetLastError () returned 0x0 [0055.970] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.971] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.971] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.971] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17597243616) returned 1 [0055.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb02b8fb0, dwHighDateTime=0x1d585b4)) [0055.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762db8 [0055.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762db8 | out: hHeap=0x260000) returned 1 [0055.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0055.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2766fe0 [0055.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0055.972] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.972] GetLastError () returned 0x0 [0055.972] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.972] GetLastError () returned 0x0 [0055.974] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffe185, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.974] WriteFile (in: hFile=0xf8, lpBuffer=0x281b088*, nNumberOfBytesToWrite=0x1e7b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281b088*, lpNumberOfBytesWritten=0x24cfdb0*=0x1e7b, lpOverlapped=0x0) returned 1 [0055.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281b088 | out: hHeap=0x260000) returned 1 [0055.976] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.976] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.976] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.977] CloseHandle (hObject=0xf8) returned 1 [0055.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0055.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.[deadmin@cock.li].deadmin")) returned 1 [0055.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0055.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0055.978] GetLastError () returned 0x0 [0055.979] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0055.979] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0055.979] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0055.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0055.980] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17598076162) returned 1 [0055.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb02df110, dwHighDateTime=0x1d585b4)) [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762df0 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0055.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762df0 | out: hHeap=0x260000) returned 1 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0055.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a448 [0055.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0055.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767078 [0055.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a448 | out: hHeap=0x260000) returned 1 [0055.980] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0055.980] GetLastError () returned 0x0 [0055.980] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0055.981] GetLastError () returned 0x0 [0055.992] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xffffc9eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.992] WriteFile (in: hFile=0xf8, lpBuffer=0x27fb078*, nNumberOfBytesToWrite=0x3615, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fb078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3615, lpOverlapped=0x0) returned 1 [0055.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fb078 | out: hHeap=0x260000) returned 1 [0055.995] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.995] WriteFile (in: hFile=0xf8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0055.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0055.996] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0055.996] CloseHandle (hObject=0xf8) returned 1 [0056.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.002] GetLastError () returned 0x0 [0056.002] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.003] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.003] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.003] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17600431884) returned 1 [0056.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0305270, dwHighDateTime=0x1d585b4)) [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762e60 [0056.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762e60 | out: hHeap=0x260000) returned 1 [0056.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767110 [0056.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.004] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.004] GetLastError () returned 0x0 [0056.004] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.004] GetLastError () returned 0x0 [0056.007] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc209, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.007] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x3df7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3df7, lpOverlapped=0x0) returned 1 [0056.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.010] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.010] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.010] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.011] CloseHandle (hObject=0x108) returned 1 [0056.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d500 [0056.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x260000) returned 1 [0056.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.012] GetLastError () returned 0x0 [0056.012] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.013] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.013] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.013] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17601397780) returned 1 [0056.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb032b3d0, dwHighDateTime=0x1d585b4)) [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762e98 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762e98 | out: hHeap=0x260000) returned 1 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767240 [0056.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.013] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.014] GetLastError () returned 0x0 [0056.014] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.014] GetLastError () returned 0x0 [0056.017] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc281, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.017] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x3d7f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3d7f, lpOverlapped=0x0) returned 1 [0056.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.018] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.018] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.018] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.018] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.018] CloseHandle (hObject=0x108) returned 1 [0056.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d500 [0056.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x260000) returned 1 [0056.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.020] GetLastError () returned 0x0 [0056.020] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.021] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.021] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.021] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17602198320) returned 1 [0056.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0351530, dwHighDateTime=0x1d585b4)) [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762ed0 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762ed0 | out: hHeap=0x260000) returned 1 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27672d8 [0056.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.022] GetLastError () returned 0x0 [0056.022] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.022] GetLastError () returned 0x0 [0056.024] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb13a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.024] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x4ec6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ec6, lpOverlapped=0x0) returned 1 [0056.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.024] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.024] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.025] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.025] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.025] CloseHandle (hObject=0x108) returned 1 [0056.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.026] GetLastError () returned 0x0 [0056.027] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.027] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.028] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17602864052) returned 1 [0056.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0351530, dwHighDateTime=0x1d585b4)) [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762f40 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762f40 | out: hHeap=0x260000) returned 1 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767370 [0056.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.028] GetLastError () returned 0x0 [0056.028] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.028] GetLastError () returned 0x0 [0056.031] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffef424, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.031] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x10bdc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x10bdc, lpOverlapped=0x0) returned 1 [0056.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.031] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.031] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.032] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.032] CloseHandle (hObject=0x108) returned 1 [0056.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.033] GetLastError () returned 0x0 [0056.033] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.034] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.034] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17603543252) returned 1 [0056.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0351530, dwHighDateTime=0x1d585b4)) [0056.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762f78 [0056.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762f78 | out: hHeap=0x260000) returned 1 [0056.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27674a0 [0056.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.035] GetLastError () returned 0x0 [0056.035] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.035] GetLastError () returned 0x0 [0056.038] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.038] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.039] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.039] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.039] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.040] CloseHandle (hObject=0x108) returned 1 [0056.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.041] GetLastError () returned 0x0 [0056.041] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e5a0) returned 1 [0056.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0056.042] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0056.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.042] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17604318085) returned 1 [0056.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0377690, dwHighDateTime=0x1d585b4)) [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762fb0 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762fb0 | out: hHeap=0x260000) returned 1 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767538 [0056.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.043] GetLastError () returned 0x0 [0056.043] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.043] GetLastError () returned 0x0 [0056.087] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe98d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.087] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1672c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x1672c, lpOverlapped=0x0) returned 1 [0056.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.158] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.158] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.158] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.158] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.158] CloseHandle (hObject=0x108) returned 1 [0056.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.160] GetLastError () returned 0x0 [0056.160] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.161] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.161] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17616250331) returned 1 [0056.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb04a8190, dwHighDateTime=0x1d585b4)) [0056.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295460 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27675d0 [0056.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.162] GetLastError () returned 0x0 [0056.162] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.162] GetLastError () returned 0x0 [0056.174] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffea581, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.174] WriteFile (in: hFile=0x108, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x15a7f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x15a7f, lpOverlapped=0x0) returned 1 [0056.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.177] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.177] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.177] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.177] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.177] CloseHandle (hObject=0x108) returned 1 [0056.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.179] GetLastError () returned 0x0 [0056.179] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.180] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.180] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.180] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17618107913) returned 1 [0056.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb04ce2f0, dwHighDateTime=0x1d585b4)) [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763250 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763250 | out: hHeap=0x260000) returned 1 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2767cf0 [0056.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.181] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.181] GetLastError () returned 0x0 [0056.181] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.181] GetLastError () returned 0x0 [0056.191] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.191] WriteFile (in: hFile=0x108, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.192] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.192] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.193] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.193] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.193] CloseHandle (hObject=0x108) returned 1 [0056.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.194] GetLastError () returned 0x0 [0056.204] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.220] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.220] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.220] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17622151667) returned 1 [0056.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb051a5b0, dwHighDateTime=0x1d585b4)) [0056.220] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27632f8 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27632f8 | out: hHeap=0x260000) returned 1 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x330ee0 [0056.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.221] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.221] GetLastError () returned 0x0 [0056.221] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.222] GetLastError () returned 0x0 [0056.225] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffeb076, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.225] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x14f8a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x14f8a, lpOverlapped=0x0) returned 1 [0056.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.225] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.226] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.226] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.226] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.227] CloseHandle (hObject=0x108) returned 1 [0056.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.228] GetLastError () returned 0x0 [0056.228] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.229] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.229] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.229] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17623024551) returned 1 [0056.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0540710, dwHighDateTime=0x1d585b4)) [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27633a0 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27633a0 | out: hHeap=0x260000) returned 1 [0056.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x330ee0 [0056.230] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.230] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.230] GetLastError () returned 0x0 [0056.230] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.230] GetLastError () returned 0x0 [0056.275] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe8212, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.275] WriteFile (in: hFile=0x108, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x17dee, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x17dee, lpOverlapped=0x0) returned 1 [0056.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0056.278] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.278] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.279] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.279] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.279] CloseHandle (hObject=0x108) returned 1 [0056.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.284] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.284] GetLastError () returned 0x0 [0056.284] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.285] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.285] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.285] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.286] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17628672984) returned 1 [0056.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb05d8c90, dwHighDateTime=0x1d585b4)) [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27634f0 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27634f0 | out: hHeap=0x260000) returned 1 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0056.286] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.286] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.286] GetLastError () returned 0x0 [0056.287] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.287] GetLastError () returned 0x0 [0056.290] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffea46c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.290] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x15b94, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x24cfdb0*=0x15b94, lpOverlapped=0x0) returned 1 [0056.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.290] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.290] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.291] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.291] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.291] CloseHandle (hObject=0x104) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d758 [0056.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d758 | out: hHeap=0x260000) returned 1 [0056.292] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.293] GetLastError () returned 0x0 [0056.293] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.294] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.294] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.294] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17629514429) returned 1 [0056.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb05d8c90, dwHighDateTime=0x1d585b4)) [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763528 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763528 | out: hHeap=0x260000) returned 1 [0056.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0056.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.295] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.295] GetLastError () returned 0x0 [0056.295] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.295] GetLastError () returned 0x0 [0056.298] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.299] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.300] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.300] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.300] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.300] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.301] CloseHandle (hObject=0x104) returned 1 [0056.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d820 [0056.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d820 | out: hHeap=0x260000) returned 1 [0056.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.302] GetLastError () returned 0x0 [0056.303] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.304] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.304] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.304] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17630525688) returned 1 [0056.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb05fedf0, dwHighDateTime=0x1d585b4)) [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763560 [0056.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763560 | out: hHeap=0x260000) returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295da8 [0056.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.305] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.305] GetLastError () returned 0x0 [0056.305] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.305] GetLastError () returned 0x0 [0056.308] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe8487, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.308] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x17b79, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x24cfdb0*=0x17b79, lpOverlapped=0x0) returned 1 [0056.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.309] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.309] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.310] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.310] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.310] CloseHandle (hObject=0x104) returned 1 [0056.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d820 [0056.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d820 | out: hHeap=0x260000) returned 1 [0056.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.312] GetLastError () returned 0x0 [0056.312] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.313] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.313] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.313] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17631456541) returned 1 [0056.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb05fedf0, dwHighDateTime=0x1d585b4)) [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763598 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763598 | out: hHeap=0x260000) returned 1 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.314] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760c58 [0056.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.314] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.314] GetLastError () returned 0x0 [0056.314] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.314] GetLastError () returned 0x0 [0056.382] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffebfcd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.382] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x14033, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x24cfdb0*=0x14033, lpOverlapped=0x0) returned 1 [0056.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.415] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.415] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.418] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.418] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.418] CloseHandle (hObject=0x104) returned 1 [0056.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.419] GetLastError () returned 0x0 [0056.419] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.420] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.420] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.420] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17642158916) returned 1 [0056.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0709790, dwHighDateTime=0x1d585b4)) [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27638a8 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27638a8 | out: hHeap=0x260000) returned 1 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6160 [0056.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.421] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.421] GetLastError () returned 0x0 [0056.421] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.421] GetLastError () returned 0x0 [0056.443] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffcae4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.443] WriteFile (in: hFile=0x104, lpBuffer=0x27ac060*, nNumberOfBytesToWrite=0x351c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27ac060*, lpNumberOfBytesWritten=0x24cfdb0*=0x351c, lpOverlapped=0x0) returned 1 [0056.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac060 | out: hHeap=0x260000) returned 1 [0056.444] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.445] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.445] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.445] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.445] CloseHandle (hObject=0x104) returned 1 [0056.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d5c8 [0056.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.[deadmin@cock.li].deadmin")) returned 1 [0056.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d5c8 | out: hHeap=0x260000) returned 1 [0056.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.447] GetLastError () returned 0x0 [0056.447] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.448] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.448] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.448] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17644887530) returned 1 [0056.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0755a50, dwHighDateTime=0x1d585b4)) [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c60 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c60 | out: hHeap=0x260000) returned 1 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6290 [0056.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.448] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.449] GetLastError () returned 0x0 [0056.449] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.449] GetLastError () returned 0x0 [0056.452] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.453] WriteFile (in: hFile=0x104, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.455] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.455] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.456] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.456] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.456] CloseHandle (hObject=0x104) returned 1 [0056.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.[deadmin@cock.li].deadmin")) returned 1 [0056.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.457] GetLastError () returned 0x0 [0056.457] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.458] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.458] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.458] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17645961392) returned 1 [0056.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb077bbb0, dwHighDateTime=0x1d585b4)) [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b80 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b80 | out: hHeap=0x260000) returned 1 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6458 [0056.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.459] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.459] GetLastError () returned 0x0 [0056.459] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.459] GetLastError () returned 0x0 [0056.463] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.463] WriteFile (in: hFile=0x104, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0056.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.464] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.464] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.464] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.464] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.465] CloseHandle (hObject=0x104) returned 1 [0056.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cdf8 [0056.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.[deadmin@cock.li].deadmin")) returned 1 [0056.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cdf8 | out: hHeap=0x260000) returned 1 [0056.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.466] GetLastError () returned 0x0 [0056.466] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.467] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.467] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.467] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17646823011) returned 1 [0056.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb077bbb0, dwHighDateTime=0x1d585b4)) [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0056.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294bb8 | out: hHeap=0x260000) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f64f0 [0056.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.468] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.468] GetLastError () returned 0x0 [0056.468] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.468] GetLastError () returned 0x0 [0056.530] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe88be, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.531] WriteFile (in: hFile=0x104, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x17742, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x17742, lpOverlapped=0x0) returned 1 [0056.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0056.532] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.532] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.532] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.532] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.533] CloseHandle (hObject=0x104) returned 1 [0056.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.[deadmin@cock.li].deadmin")) returned 1 [0056.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.598] GetLastError () returned 0x0 [0056.598] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.599] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.599] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17660034363) returned 1 [0056.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb08d2810, dwHighDateTime=0x1d585b4)) [0056.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763c28 [0056.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763c28 | out: hHeap=0x260000) returned 1 [0056.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f6588 [0056.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.604] GetLastError () returned 0x0 [0056.604] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.604] GetLastError () returned 0x0 [0056.622] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe8c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.622] WriteFile (in: hFile=0x104, lpBuffer=0x27c5068*, nNumberOfBytesToWrite=0x173e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27c5068*, lpNumberOfBytesWritten=0x24cfdb0*=0x173e, lpOverlapped=0x0) returned 1 [0056.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c5068 | out: hHeap=0x260000) returned 1 [0056.622] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.622] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.623] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.623] CloseHandle (hObject=0x104) returned 1 [0056.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.654] GetLastError () returned 0x0 [0056.664] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.677] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.677] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.677] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17667800187) returned 1 [0056.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0990ef0, dwHighDateTime=0x1d585b4)) [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763e20 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763e20 | out: hHeap=0x260000) returned 1 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f76c0 [0056.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.678] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.678] GetLastError () returned 0x0 [0056.678] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.678] GetLastError () returned 0x0 [0056.681] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3f0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.681] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xc10, lpOverlapped=0x0) returned 1 [0056.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.682] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.682] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.682] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.682] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.683] CloseHandle (hObject=0x104) returned 1 [0056.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.684] GetLastError () returned 0x0 [0056.685] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.686] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.686] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17668684978) returned 1 [0056.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0990ef0, dwHighDateTime=0x1d585b4)) [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763e90 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763e90 | out: hHeap=0x260000) returned 1 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7590 [0056.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.687] GetLastError () returned 0x0 [0056.687] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.687] GetLastError () returned 0x0 [0056.688] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffa780, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.689] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x5880, lpOverlapped=0x0) returned 1 [0056.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.689] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.689] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.690] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.690] CloseHandle (hObject=0x104) returned 1 [0056.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.691] GetLastError () returned 0x0 [0056.692] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.692] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.692] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.693] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17669374058) returned 1 [0056.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb09b7050, dwHighDateTime=0x1d585b4)) [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eb30 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eb30 | out: hHeap=0x260000) returned 1 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f77f0 [0056.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.693] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.693] GetLastError () returned 0x0 [0056.693] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.694] GetLastError () returned 0x0 [0056.696] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb884, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.696] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x477c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x477c, lpOverlapped=0x0) returned 1 [0056.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.696] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.696] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.699] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.699] CloseHandle (hObject=0x104) returned 1 [0056.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.701] GetLastError () returned 0x0 [0056.701] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.702] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.702] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.702] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17670303031) returned 1 [0056.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb09b7050, dwHighDateTime=0x1d585b4)) [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eaf8 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eaf8 | out: hHeap=0x260000) returned 1 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f7888 [0056.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.703] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.703] GetLastError () returned 0x0 [0056.703] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.703] GetLastError () returned 0x0 [0056.786] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffffad0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.796] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x530, lpOverlapped=0x0) returned 1 [0056.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.807] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.807] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.814] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.814] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.814] CloseHandle (hObject=0x104) returned 1 [0056.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.816] GetLastError () returned 0x0 [0056.816] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.817] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.817] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.817] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17681793888) returned 1 [0056.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0ae7b50, dwHighDateTime=0x1d585b4)) [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c0e0 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c0e0 | out: hHeap=0x260000) returned 1 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b48d8 [0056.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.831] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.831] GetLastError () returned 0x0 [0056.831] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.831] GetLastError () returned 0x0 [0056.833] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff490, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.833] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0xb70, lpOverlapped=0x0) returned 1 [0056.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.834] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.834] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.835] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.835] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.835] CloseHandle (hObject=0x104) returned 1 [0056.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.836] GetLastError () returned 0x0 [0056.837] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.837] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.837] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.838] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17683873325) returned 1 [0056.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0b0dcb0, dwHighDateTime=0x1d585b4)) [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c0a8 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c0a8 | out: hHeap=0x260000) returned 1 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4a08 [0056.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.838] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.838] GetLastError () returned 0x0 [0056.839] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.839] GetLastError () returned 0x0 [0056.840] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe960, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.840] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x16a0, lpOverlapped=0x0) returned 1 [0056.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.841] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.841] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.841] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.842] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.842] CloseHandle (hObject=0x104) returned 1 [0056.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0056.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0056.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.843] GetLastError () returned 0x0 [0056.844] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.844] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.844] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.845] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17684572544) returned 1 [0056.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0b0dcb0, dwHighDateTime=0x1d585b4)) [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31c070 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31c070 | out: hHeap=0x260000) returned 1 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4aa0 [0056.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.845] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.845] GetLastError () returned 0x0 [0056.846] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.846] GetLastError () returned 0x0 [0056.894] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe928, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.894] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x16d8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x16d8, lpOverlapped=0x0) returned 1 [0056.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0056.894] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.894] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.895] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.895] CloseHandle (hObject=0x104) returned 1 [0056.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0056.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0056.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.935] GetLastError () returned 0x0 [0056.936] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.936] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.936] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.937] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17693775379) returned 1 [0056.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0bf24f0, dwHighDateTime=0x1d585b4)) [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31be08 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31be08 | out: hHeap=0x260000) returned 1 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b4b38 [0056.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.937] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.937] GetLastError () returned 0x0 [0056.938] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.938] GetLastError () returned 0x0 [0056.941] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb8ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.941] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4732, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x4732, lpOverlapped=0x0) returned 1 [0056.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.942] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.942] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.942] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.942] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.942] CloseHandle (hObject=0x104) returned 1 [0056.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0056.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0056.944] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.944] GetLastError () returned 0x0 [0056.944] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.945] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.945] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17694592521) returned 1 [0056.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0c18650, dwHighDateTime=0x1d585b4)) [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bdd0 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bdd0 | out: hHeap=0x260000) returned 1 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b51c0 [0056.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.945] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.946] GetLastError () returned 0x0 [0056.946] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.946] GetLastError () returned 0x0 [0056.947] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff940a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.948] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x6bf6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x6bf6, lpOverlapped=0x0) returned 1 [0056.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.948] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.948] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.949] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.949] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.949] CloseHandle (hObject=0x104) returned 1 [0056.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0056.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0056.950] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.950] GetLastError () returned 0x0 [0056.951] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.952] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.952] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.952] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17695298244) returned 1 [0056.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0c18650, dwHighDateTime=0x1d585b4)) [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bd98 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bd98 | out: hHeap=0x260000) returned 1 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.952] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5258 [0056.952] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.953] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.953] GetLastError () returned 0x0 [0056.953] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.953] GetLastError () returned 0x0 [0056.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff292, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.955] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xd6e, lpOverlapped=0x0) returned 1 [0056.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.955] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.955] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.956] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.956] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.956] CloseHandle (hObject=0x104) returned 1 [0056.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0056.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0056.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.957] GetLastError () returned 0x0 [0056.957] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.958] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.958] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.958] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17695948339) returned 1 [0056.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0c3e7b0, dwHighDateTime=0x1d585b4)) [0056.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x31bd60 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bd60 | out: hHeap=0x260000) returned 1 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b52f0 [0056.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.959] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.959] GetLastError () returned 0x0 [0056.959] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.959] GetLastError () returned 0x0 [0056.961] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe48c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.961] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1b74, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b74, lpOverlapped=0x0) returned 1 [0056.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0056.961] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.961] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0056.962] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0056.962] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0056.962] CloseHandle (hObject=0x104) returned 1 [0056.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0056.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0056.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0056.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0056.963] GetLastError () returned 0x0 [0056.963] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0056.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0056.964] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0056.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0056.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0056.964] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17696585910) returned 1 [0056.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb0c3e7b0, dwHighDateTime=0x1d585b4)) [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c758 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0056.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c758 | out: hHeap=0x260000) returned 1 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0056.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0056.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0056.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b5388 [0056.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0056.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0056.966] GetLastError () returned 0x0 [0056.966] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0056.966] GetLastError () returned 0x0 [0057.084] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.090] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0057.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.097] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.097] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.301] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.301] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.302] CloseHandle (hObject=0x104) returned 1 [0057.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.357] GetLastError () returned 0x0 [0057.362] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.391] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.391] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.392] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.399] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17739990726) returned 1 [0057.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1068e30, dwHighDateTime=0x1d585b4)) [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f2a0 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2a0 | out: hHeap=0x260000) returned 1 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6850 [0057.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.399] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.400] GetLastError () returned 0x0 [0057.400] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.400] GetLastError () returned 0x0 [0057.403] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff38c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.403] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xc74, lpOverlapped=0x0) returned 1 [0057.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.404] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.404] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.404] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.404] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.405] CloseHandle (hObject=0xf8) returned 1 [0057.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.406] GetLastError () returned 0x0 [0057.406] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.407] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.407] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0057.407] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17740824884) returned 1 [0057.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1068e30, dwHighDateTime=0x1d585b4)) [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f268 [0057.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.407] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f268 | out: hHeap=0x260000) returned 1 [0057.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.408] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6688 [0057.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.408] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.408] GetLastError () returned 0x0 [0057.408] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.408] GetLastError () returned 0x0 [0057.410] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0xfffff19c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.410] WriteFile (in: hFile=0xf8, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xe64, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xe64, lpOverlapped=0x0) returned 1 [0057.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.418] SetFilePointerEx (in: hFile=0xf8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.418] WriteFile (in: hFile=0xf8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.418] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.418] WriteFile (in: hFile=0xf8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.419] CloseHandle (hObject=0xf8) returned 1 [0057.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0057.420] GetLastError () returned 0x0 [0057.428] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.429] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.429] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.429] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17743018051) returned 1 [0057.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb10b50f0, dwHighDateTime=0x1d585b4)) [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f1c0 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f1c0 | out: hHeap=0x260000) returned 1 [0057.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b68e8 [0057.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.430] GetLastError () returned 0x0 [0057.430] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.430] GetLastError () returned 0x0 [0057.441] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff2dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.441] WriteFile (in: hFile=0x104, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0xd24, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0xd24, lpOverlapped=0x0) returned 1 [0057.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.442] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.442] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.443] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.443] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.443] CloseHandle (hObject=0x104) returned 1 [0057.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.444] GetLastError () returned 0x0 [0057.445] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.446] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.446] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17744684381) returned 1 [0057.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb10db250, dwHighDateTime=0x1d585b4)) [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f188 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f188 | out: hHeap=0x260000) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6ab0 [0057.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.447] GetLastError () returned 0x0 [0057.447] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.447] GetLastError () returned 0x0 [0057.448] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffaf80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.448] WriteFile (in: hFile=0x104, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x5080, lpOverlapped=0x0) returned 1 [0057.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.449] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.449] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.449] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.450] CloseHandle (hObject=0x104) returned 1 [0057.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.450] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.451] GetLastError () returned 0x0 [0057.451] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.452] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.452] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.452] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17745332522) returned 1 [0057.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb10db250, dwHighDateTime=0x1d585b4)) [0057.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f150 [0057.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f150 | out: hHeap=0x260000) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6be0 [0057.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.453] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.453] GetLastError () returned 0x0 [0057.453] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.453] GetLastError () returned 0x0 [0057.530] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe038, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.530] WriteFile (in: hFile=0x104, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x1fc8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x1fc8, lpOverlapped=0x0) returned 1 [0057.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0057.531] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.531] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.531] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.531] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.532] CloseHandle (hObject=0x104) returned 1 [0057.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.533] GetLastError () returned 0x0 [0057.534] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.534] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.534] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.534] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17753562649) returned 1 [0057.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb11bfa90, dwHighDateTime=0x1d585b4)) [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eee8 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eee8 | out: hHeap=0x260000) returned 1 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b6c78 [0057.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.535] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.535] GetLastError () returned 0x0 [0057.535] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.536] GetLastError () returned 0x0 [0057.537] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff774, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.537] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x88c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x88c, lpOverlapped=0x0) returned 1 [0057.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.538] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.538] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.538] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.538] CloseHandle (hObject=0x104) returned 1 [0057.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.540] GetLastError () returned 0x0 [0057.540] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.541] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.541] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.541] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17754196614) returned 1 [0057.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb11bfa90, dwHighDateTime=0x1d585b4)) [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eeb0 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eeb0 | out: hHeap=0x260000) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7300 [0057.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.542] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.542] GetLastError () returned 0x0 [0057.542] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.542] GetLastError () returned 0x0 [0057.543] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff5cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.543] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xa34, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0xa34, lpOverlapped=0x0) returned 1 [0057.544] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.544] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.544] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.544] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.545] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.545] CloseHandle (hObject=0x104) returned 1 [0057.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.546] GetLastError () returned 0x0 [0057.547] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.548] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.548] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.548] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17754899528) returned 1 [0057.548] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb11bfa90, dwHighDateTime=0x1d585b4)) [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ee78 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ee78 | out: hHeap=0x260000) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7398 [0057.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.549] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.549] GetLastError () returned 0x0 [0057.549] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.549] GetLastError () returned 0x0 [0057.551] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff760, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.551] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x8a0, lpOverlapped=0x0) returned 1 [0057.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.551] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.551] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.552] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.552] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.552] CloseHandle (hObject=0x104) returned 1 [0057.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.553] GetLastError () returned 0x0 [0057.553] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.554] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.554] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.554] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17755548827) returned 1 [0057.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb11e5bf0, dwHighDateTime=0x1d585b4)) [0057.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ee40 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ee40 | out: hHeap=0x260000) returned 1 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7430 [0057.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.555] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.555] GetLastError () returned 0x0 [0057.555] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.555] GetLastError () returned 0x0 [0057.557] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.557] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xc28, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0xc28, lpOverlapped=0x0) returned 1 [0057.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.557] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.557] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.560] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.560] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.561] CloseHandle (hObject=0x104) returned 1 [0057.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.562] GetLastError () returned 0x0 [0057.563] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.564] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.564] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17756491233) returned 1 [0057.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb11e5bf0, dwHighDateTime=0x1d585b4)) [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ee08 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ee08 | out: hHeap=0x260000) returned 1 [0057.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b74c8 [0057.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.565] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.565] GetLastError () returned 0x0 [0057.565] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.565] GetLastError () returned 0x0 [0057.674] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff290, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.674] WriteFile (in: hFile=0x104, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0xd70, lpOverlapped=0x0) returned 1 [0057.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0057.676] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.676] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.676] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.676] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.677] CloseHandle (hObject=0x104) returned 1 [0057.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.678] GetLastError () returned 0x0 [0057.678] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.679] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.679] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.679] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17768025502) returned 1 [0057.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb13166f0, dwHighDateTime=0x1d585b4)) [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2951f8 [0057.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2951f8 | out: hHeap=0x260000) returned 1 [0057.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331860 [0057.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.680] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.680] GetLastError () returned 0x0 [0057.680] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.680] GetLastError () returned 0x0 [0057.683] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.683] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x411a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x411a, lpOverlapped=0x0) returned 1 [0057.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.684] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.684] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.684] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.684] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.685] CloseHandle (hObject=0x104) returned 1 [0057.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.685] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.686] GetLastError () returned 0x0 [0057.687] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.687] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.687] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.688] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17769109692) returned 1 [0057.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb133c850, dwHighDateTime=0x1d585b4)) [0057.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2950a8 [0057.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950a8 | out: hHeap=0x260000) returned 1 [0057.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331730 [0057.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.691] GetLastError () returned 0x0 [0057.691] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.691] GetLastError () returned 0x0 [0057.693] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffc2a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.693] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x3d5c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x3d5c, lpOverlapped=0x0) returned 1 [0057.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0057.694] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.694] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.694] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.695] CloseHandle (hObject=0x104) returned 1 [0057.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.696] GetLastError () returned 0x0 [0057.696] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.697] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.697] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17769861435) returned 1 [0057.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb133c850, dwHighDateTime=0x1d585b4)) [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2950e0 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2950e0 | out: hHeap=0x260000) returned 1 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331698 [0057.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.698] GetLastError () returned 0x0 [0057.698] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.698] GetLastError () returned 0x0 [0057.701] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffbfc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.701] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x4040, lpOverlapped=0x0) returned 1 [0057.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.702] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.702] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.702] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.702] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.703] CloseHandle (hObject=0x104) returned 1 [0057.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.704] GetLastError () returned 0x0 [0057.704] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.752] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.752] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.752] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17775354053) returned 1 [0057.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb13d4dd0, dwHighDateTime=0x1d585b4)) [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294e78 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294e78 | out: hHeap=0x260000) returned 1 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331600 [0057.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.753] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.753] GetLastError () returned 0x0 [0057.753] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.754] GetLastError () returned 0x0 [0057.829] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffb2e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.829] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x4d18, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x4d18, lpOverlapped=0x0) returned 1 [0057.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.831] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.831] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.831] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.831] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.832] CloseHandle (hObject=0x104) returned 1 [0057.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.834] GetLastError () returned 0x0 [0057.834] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.835] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.835] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.835] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17783612777) returned 1 [0057.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb14934b0, dwHighDateTime=0x1d585b4)) [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7b50 [0057.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.836] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.836] GetLastError () returned 0x0 [0057.836] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.836] GetLastError () returned 0x0 [0057.838] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff7258, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.838] WriteFile (in: hFile=0x104, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x8da8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x8da8, lpOverlapped=0x0) returned 1 [0057.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.841] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.841] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.841] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.841] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.841] CloseHandle (hObject=0x104) returned 1 [0057.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0057.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0057.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.843] GetLastError () returned 0x0 [0057.843] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.844] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.844] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.844] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17784518740) returned 1 [0057.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb14934b0, dwHighDateTime=0x1d585b4)) [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0057.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7c80 [0057.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.845] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.845] GetLastError () returned 0x0 [0057.845] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.845] GetLastError () returned 0x0 [0057.848] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffebf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.848] WriteFile (in: hFile=0x104, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x140c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x140c, lpOverlapped=0x0) returned 1 [0057.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.849] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.849] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.849] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.849] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.850] CloseHandle (hObject=0x104) returned 1 [0057.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0057.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0057.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.851] GetLastError () returned 0x0 [0057.851] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.852] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.852] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.852] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17785350173) returned 1 [0057.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb14b9610, dwHighDateTime=0x1d585b4)) [0057.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b10 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b7d18 [0057.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.853] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.853] GetLastError () returned 0x0 [0057.853] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.853] GetLastError () returned 0x0 [0057.870] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd950, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.870] WriteFile (in: hFile=0x104, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x26b0, lpOverlapped=0x0) returned 1 [0057.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0057.870] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.870] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.871] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.871] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.871] CloseHandle (hObject=0x104) returned 1 [0057.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0057.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0057.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.872] GetLastError () returned 0x0 [0057.915] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.916] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.916] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.916] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17791741231) returned 1 [0057.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1551b90, dwHighDateTime=0x1d585b4)) [0057.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d0f8 [0057.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d0f8 | out: hHeap=0x260000) returned 1 [0057.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b80a8 [0057.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.917] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.917] GetLastError () returned 0x0 [0057.917] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.917] GetLastError () returned 0x0 [0057.921] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe6d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.921] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1928, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1928, lpOverlapped=0x0) returned 1 [0057.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.921] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.922] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.922] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.922] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.922] CloseHandle (hObject=0x104) returned 1 [0057.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0057.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0057.924] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.924] GetLastError () returned 0x0 [0057.924] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.925] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.925] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.925] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17792597129) returned 1 [0057.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1577cf0, dwHighDateTime=0x1d585b4)) [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18a8 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18a8 | out: hHeap=0x260000) returned 1 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0057.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.926] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.926] GetLastError () returned 0x0 [0057.926] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.926] GetLastError () returned 0x0 [0057.927] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffef76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.927] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x108a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x108a, lpOverlapped=0x0) returned 1 [0057.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0057.928] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.928] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0057.928] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0057.928] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0057.929] CloseHandle (hObject=0x104) returned 1 [0057.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341ac8 [0057.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0057.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341ac8 | out: hHeap=0x260000) returned 1 [0057.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0057.930] GetLastError () returned 0x0 [0057.930] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0057.931] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0057.931] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0057.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0057.931] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17793231779) returned 1 [0057.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1577cf0, dwHighDateTime=0x1d585b4)) [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f03f0 [0057.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0057.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f03f0 | out: hHeap=0x260000) returned 1 [0057.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0057.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0057.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0057.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0057.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0057.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0057.932] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0057.932] GetLastError () returned 0x0 [0057.932] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0057.932] GetLastError () returned 0x0 [0058.024] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffeed2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.024] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x112e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x112e, lpOverlapped=0x0) returned 1 [0058.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.025] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.025] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.025] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.025] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.026] CloseHandle (hObject=0x104) returned 1 [0058.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.027] GetLastError () returned 0x0 [0058.027] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.028] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.028] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.028] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17802906108) returned 1 [0058.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb165c530, dwHighDateTime=0x1d585b4)) [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d940 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d940 | out: hHeap=0x260000) returned 1 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d1b0 [0058.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.029] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.029] GetLastError () returned 0x0 [0058.029] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.029] GetLastError () returned 0x0 [0058.030] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffdc2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.031] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x23d4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x23d4, lpOverlapped=0x0) returned 1 [0058.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.031] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.032] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.032] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.032] CloseHandle (hObject=0x104) returned 1 [0058.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.033] GetLastError () returned 0x0 [0058.034] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.035] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.035] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17803614269) returned 1 [0058.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1682690, dwHighDateTime=0x1d585b4)) [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d908 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d908 | out: hHeap=0x260000) returned 1 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d2e0 [0058.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.036] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.036] GetLastError () returned 0x0 [0058.036] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.036] GetLastError () returned 0x0 [0058.038] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe03c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.038] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x1fc4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x1fc4, lpOverlapped=0x0) returned 1 [0058.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.038] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.039] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.039] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.040] CloseHandle (hObject=0x104) returned 1 [0058.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.041] GetLastError () returned 0x0 [0058.041] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.042] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.042] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17804303285) returned 1 [0058.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1682690, dwHighDateTime=0x1d585b4)) [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d8d0 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d8d0 | out: hHeap=0x260000) returned 1 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d378 [0058.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.043] GetLastError () returned 0x0 [0058.043] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.043] GetLastError () returned 0x0 [0058.045] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff8a1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.045] WriteFile (in: hFile=0x104, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x75e2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x75e2, lpOverlapped=0x0) returned 1 [0058.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.047] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.048] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.048] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.048] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.049] CloseHandle (hObject=0x104) returned 1 [0058.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.050] GetLastError () returned 0x0 [0058.050] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.051] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.051] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.051] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17805223571) returned 1 [0058.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb16a87f0, dwHighDateTime=0x1d585b4)) [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294c98 [0058.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294c98 | out: hHeap=0x260000) returned 1 [0058.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d410 [0058.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.052] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.052] GetLastError () returned 0x0 [0058.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.052] GetLastError () returned 0x0 [0058.057] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff7db2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.057] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x824e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x824e, lpOverlapped=0x0) returned 1 [0058.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0058.057] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.057] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.058] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.058] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.058] CloseHandle (hObject=0x104) returned 1 [0058.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.060] GetLastError () returned 0x0 [0058.060] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.061] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.061] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.061] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17806199502) returned 1 [0058.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb16a87f0, dwHighDateTime=0x1d585b4)) [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d81e8 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d81e8 | out: hHeap=0x260000) returned 1 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d4a8 [0058.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.062] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.062] GetLastError () returned 0x0 [0058.062] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.062] GetLastError () returned 0x0 [0058.075] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff9d4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.076] WriteFile (in: hFile=0x104, lpBuffer=0x2836088*, nNumberOfBytesToWrite=0x62b2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2836088*, lpNumberOfBytesWritten=0x24cfdb0*=0x62b2, lpOverlapped=0x0) returned 1 [0058.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2836088 | out: hHeap=0x260000) returned 1 [0058.077] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.077] WriteFile (in: hFile=0x104, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.077] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.078] CloseHandle (hObject=0x104) returned 1 [0058.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.083] GetLastError () returned 0x0 [0058.083] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.084] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.084] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.085] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17808565120) returned 1 [0058.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb16f4ab0, dwHighDateTime=0x1d585b4)) [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77f0 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77f0 | out: hHeap=0x260000) returned 1 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331db8 [0058.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.085] GetLastError () returned 0x0 [0058.085] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.086] GetLastError () returned 0x0 [0058.088] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff90da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.088] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x6f26, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x6f26, lpOverlapped=0x0) returned 1 [0058.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.090] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.090] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.091] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.091] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.091] CloseHandle (hObject=0x11c) returned 1 [0058.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.093] GetLastError () returned 0x0 [0058.093] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.094] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.094] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.094] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17809539607) returned 1 [0058.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb171ac10, dwHighDateTime=0x1d585b4)) [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7828 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7828 | out: hHeap=0x260000) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3323a8 [0058.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.095] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.095] GetLastError () returned 0x0 [0058.095] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.095] GetLastError () returned 0x0 [0058.098] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff463c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.099] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0xb9c4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9c4, lpOverlapped=0x0) returned 1 [0058.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.099] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.100] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.100] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.100] CloseHandle (hObject=0x11c) returned 1 [0058.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0058.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0058.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.101] GetLastError () returned 0x0 [0058.102] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.102] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.102] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.103] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17810367696) returned 1 [0058.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb171ac10, dwHighDateTime=0x1d585b4)) [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7860 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7860 | out: hHeap=0x260000) returned 1 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332310 [0058.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.103] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.103] GetLastError () returned 0x0 [0058.103] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.103] GetLastError () returned 0x0 [0058.105] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff96d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.106] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x6928, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x6928, lpOverlapped=0x0) returned 1 [0058.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.106] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.107] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.107] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.107] CloseHandle (hObject=0x11c) returned 1 [0058.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341d20 [0058.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341d20 | out: hHeap=0x260000) returned 1 [0058.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.108] GetLastError () returned 0x0 [0058.108] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.109] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.109] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.109] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17811047747) returned 1 [0058.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb171ac10, dwHighDateTime=0x1d585b4)) [0058.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7898 [0058.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7898 | out: hHeap=0x260000) returned 1 [0058.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332278 [0058.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.110] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.110] GetLastError () returned 0x0 [0058.111] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.111] GetLastError () returned 0x0 [0058.112] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8c00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.112] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x7400, lpOverlapped=0x0) returned 1 [0058.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.113] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.113] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.113] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.113] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.114] CloseHandle (hObject=0x11c) returned 1 [0058.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341c58 [0058.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341c58 | out: hHeap=0x260000) returned 1 [0058.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.115] GetLastError () returned 0x0 [0058.115] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.116] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.116] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.116] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17811736318) returned 1 [0058.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1740d70, dwHighDateTime=0x1d585b4)) [0058.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d78d0 [0058.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d78d0 | out: hHeap=0x260000) returned 1 [0058.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3321e0 [0058.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.117] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.117] GetLastError () returned 0x0 [0058.117] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.117] GetLastError () returned 0x0 [0058.123] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbf70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.123] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x4090, lpOverlapped=0x0) returned 1 [0058.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.124] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.124] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.124] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.125] CloseHandle (hObject=0x11c) returned 1 [0058.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.127] GetLastError () returned 0x0 [0058.127] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.128] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.128] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.128] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17812950115) returned 1 [0058.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1766ed0, dwHighDateTime=0x1d585b4)) [0058.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d98f0 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98f0 | out: hHeap=0x260000) returned 1 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d248 [0058.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.129] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.129] GetLastError () returned 0x0 [0058.129] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.129] GetLastError () returned 0x0 [0058.131] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8920, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.131] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x76e0, lpOverlapped=0x0) returned 1 [0058.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.132] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.132] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.132] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.132] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.133] CloseHandle (hObject=0x11c) returned 1 [0058.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.134] GetLastError () returned 0x0 [0058.134] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.135] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.135] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17813607580) returned 1 [0058.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1766ed0, dwHighDateTime=0x1d585b4)) [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9928 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0058.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9928 | out: hHeap=0x260000) returned 1 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d670 [0058.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.136] GetLastError () returned 0x0 [0058.136] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.136] GetLastError () returned 0x0 [0058.138] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa7b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.138] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x5850, lpOverlapped=0x0) returned 1 [0058.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.138] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.138] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.139] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.139] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.139] CloseHandle (hObject=0x11c) returned 1 [0058.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.140] GetLastError () returned 0x0 [0058.141] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.141] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.141] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.142] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17814270557) returned 1 [0058.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb178d030, dwHighDateTime=0x1d585b4)) [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9960 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9960 | out: hHeap=0x260000) returned 1 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0058.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.142] GetLastError () returned 0x0 [0058.142] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.143] GetLastError () returned 0x0 [0058.144] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffacd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.144] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x5328, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x5328, lpOverlapped=0x0) returned 1 [0058.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.145] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.145] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.145] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.145] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.146] CloseHandle (hObject=0x11c) returned 1 [0058.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.147] GetLastError () returned 0x0 [0058.147] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e5a0) returned 1 [0058.148] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.148] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0058.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.148] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17814915890) returned 1 [0058.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb178d030, dwHighDateTime=0x1d585b4)) [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9998 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9998 | out: hHeap=0x260000) returned 1 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0058.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.149] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.149] GetLastError () returned 0x0 [0058.149] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.149] GetLastError () returned 0x0 [0058.151] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff740, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.151] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x8c0, lpOverlapped=0x0) returned 1 [0058.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.151] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.151] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.152] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.152] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.152] CloseHandle (hObject=0x11c) returned 1 [0058.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.153] GetLastError () returned 0x0 [0058.154] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e5a0) returned 1 [0058.154] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.154] CryptReleaseContext (hProv=0x33e5a0, dwFlags=0x0) returned 1 [0058.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.154] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17815559409) returned 1 [0058.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb178d030, dwHighDateTime=0x1d585b4)) [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d99d0 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d99d0 | out: hHeap=0x260000) returned 1 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d838 [0058.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.155] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.155] GetLastError () returned 0x0 [0058.155] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.155] GetLastError () returned 0x0 [0058.157] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc608, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.157] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x39f8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x39f8, lpOverlapped=0x0) returned 1 [0058.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.158] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.158] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.158] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.158] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.159] CloseHandle (hObject=0x11c) returned 1 [0058.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x341b90 [0058.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x341b90 | out: hHeap=0x260000) returned 1 [0058.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.160] GetLastError () returned 0x0 [0058.160] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.161] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.161] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17816200307) returned 1 [0058.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb17b3190, dwHighDateTime=0x1d585b4)) [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a08 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a08 | out: hHeap=0x260000) returned 1 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d8d0 [0058.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.162] GetLastError () returned 0x0 [0058.162] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.162] GetLastError () returned 0x0 [0058.242] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe2d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.242] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x1d2a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d2a, lpOverlapped=0x0) returned 1 [0058.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.243] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.243] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.243] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.244] CloseHandle (hObject=0x11c) returned 1 [0058.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.245] GetLastError () returned 0x0 [0058.245] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.246] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.246] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.246] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17824723309) returned 1 [0058.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1871870, dwHighDateTime=0x1d585b4)) [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9c70 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9c70 | out: hHeap=0x260000) returned 1 [0058.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d968 [0058.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.247] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.247] GetLastError () returned 0x0 [0058.247] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.247] GetLastError () returned 0x0 [0058.248] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc668, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.249] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0x3998, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3998, lpOverlapped=0x0) returned 1 [0058.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.249] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.249] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.249] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.250] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.250] CloseHandle (hObject=0x11c) returned 1 [0058.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.251] GetLastError () returned 0x0 [0058.252] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.253] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0b0 | out: pbBuffer=0x27f0b0) returned 1 [0058.253] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0b0 | out: hHeap=0x260000) returned 1 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.253] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17825420157) returned 1 [0058.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb18979d0, dwHighDateTime=0x1d585b4)) [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ca8 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0058.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca8 | out: hHeap=0x260000) returned 1 [0058.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0058.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e120 [0058.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.254] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.254] GetLastError () returned 0x0 [0058.254] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.254] GetLastError () returned 0x0 [0058.422] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff13c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.422] WriteFile (in: hFile=0x11c, lpBuffer=0x27bc068*, nNumberOfBytesToWrite=0xec4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bc068*, lpNumberOfBytesWritten=0x24cfdb0*=0xec4, lpOverlapped=0x0) returned 1 [0058.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bc068 | out: hHeap=0x260000) returned 1 [0058.422] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.422] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.423] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.423] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.423] CloseHandle (hObject=0x11c) returned 1 [0058.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.424] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.425] GetLastError () returned 0x0 [0058.425] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.426] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.426] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17842714593) returned 1 [0058.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1a3a8f0, dwHighDateTime=0x1d585b4)) [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9d88 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9d88 | out: hHeap=0x260000) returned 1 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e1b8 [0058.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.427] GetLastError () returned 0x0 [0058.427] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.427] GetLastError () returned 0x0 [0058.444] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffefe0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.444] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1020, lpOverlapped=0x0) returned 1 [0058.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.444] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.445] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.445] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.445] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.445] CloseHandle (hObject=0x11c) returned 1 [0058.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.447] GetLastError () returned 0x0 [0058.455] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.455] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.455] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.456] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17845666585) returned 1 [0058.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1a86bb0, dwHighDateTime=0x1d585b4)) [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9e30 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9e30 | out: hHeap=0x260000) returned 1 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e418 [0058.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.456] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.456] GetLastError () returned 0x0 [0058.456] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.457] GetLastError () returned 0x0 [0058.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.460] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x608, lpOverlapped=0x0) returned 1 [0058.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.460] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.461] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.461] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.461] CloseHandle (hObject=0xf0) returned 1 [0058.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.463] GetLastError () returned 0x0 [0058.479] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.488] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.489] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0058.489] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17849012447) returned 1 [0058.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1ad2e70, dwHighDateTime=0x1d585b4)) [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9f48 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9f48 | out: hHeap=0x260000) returned 1 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.489] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e840 [0058.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.490] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.490] GetLastError () returned 0x0 [0058.490] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.490] GetLastError () returned 0x0 [0058.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.500] WriteFile (in: hFile=0xf0, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x634, lpOverlapped=0x0) returned 1 [0058.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0058.501] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.502] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.502] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.502] CloseHandle (hObject=0xf0) returned 1 [0058.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0058.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0058.504] GetLastError () returned 0x0 [0058.509] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.510] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.510] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.510] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17851110078) returned 1 [0058.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1af8fd0, dwHighDateTime=0x1d585b4)) [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ff0 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ff0 | out: hHeap=0x260000) returned 1 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29e970 [0058.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.511] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.511] GetLastError () returned 0x0 [0058.511] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.511] GetLastError () returned 0x0 [0058.514] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8170, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.514] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x7e90, lpOverlapped=0x0) returned 1 [0058.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.515] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.515] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.516] CloseHandle (hObject=0x108) returned 1 [0058.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.517] GetLastError () returned 0x0 [0058.517] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.518] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.518] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.518] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17851946270) returned 1 [0058.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1b1f130, dwHighDateTime=0x1d585b4)) [0058.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da028 [0058.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0058.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da028 | out: hHeap=0x260000) returned 1 [0058.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0058.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ea08 [0058.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.519] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.519] GetLastError () returned 0x0 [0058.519] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.519] GetLastError () returned 0x0 [0058.521] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff5dfe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.521] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xa202, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0xa202, lpOverlapped=0x0) returned 1 [0058.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.522] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.522] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.522] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.523] CloseHandle (hObject=0x108) returned 1 [0058.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.524] GetLastError () returned 0x0 [0058.524] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x283ac50) returned 1 [0058.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0058.525] CryptReleaseContext (hProv=0x283ac50, dwFlags=0x0) returned 1 [0058.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.525] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17852600298) returned 1 [0058.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1b1f130, dwHighDateTime=0x1d585b4)) [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da060 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da060 | out: hHeap=0x260000) returned 1 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29eb38 [0058.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.526] GetLastError () returned 0x0 [0058.526] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.526] GetLastError () returned 0x0 [0058.596] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe742, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.596] WriteFile (in: hFile=0x108, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x18be, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x18be, lpOverlapped=0x0) returned 1 [0058.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0058.597] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.597] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.597] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.597] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.598] CloseHandle (hObject=0x108) returned 1 [0058.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.599] GetLastError () returned 0x0 [0058.599] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.600] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.600] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.600] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17860288191) returned 1 [0058.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1bdd810, dwHighDateTime=0x1d585b4)) [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da258 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da258 | out: hHeap=0x260000) returned 1 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b080 [0058.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.603] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.603] GetLastError () returned 0x0 [0058.603] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.603] GetLastError () returned 0x0 [0058.605] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.605] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.606] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.606] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.607] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.607] CloseHandle (hObject=0x108) returned 1 [0058.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.608] GetLastError () returned 0x0 [0058.609] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.610] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.610] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17861114018) returned 1 [0058.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1c03970, dwHighDateTime=0x1d585b4)) [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da290 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da290 | out: hHeap=0x260000) returned 1 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b1b0 [0058.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.611] GetLastError () returned 0x0 [0058.611] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.611] GetLastError () returned 0x0 [0058.619] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.619] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x7db8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x7db8, lpOverlapped=0x0) returned 1 [0058.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.619] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.620] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.620] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.620] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.620] CloseHandle (hObject=0x108) returned 1 [0058.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.622] GetLastError () returned 0x0 [0058.622] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.623] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.623] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.623] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17862420029) returned 1 [0058.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1c03970, dwHighDateTime=0x1d585b4)) [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da300 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da300 | out: hHeap=0x260000) returned 1 [0058.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b248 [0058.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.624] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.624] GetLastError () returned 0x0 [0058.624] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.624] GetLastError () returned 0x0 [0058.632] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff6542, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.633] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x9abe, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x9abe, lpOverlapped=0x0) returned 1 [0058.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.633] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.633] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.634] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.634] CloseHandle (hObject=0x108) returned 1 [0058.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.635] GetLastError () returned 0x0 [0058.635] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.636] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.636] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.636] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17863757565) returned 1 [0058.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1c29ad0, dwHighDateTime=0x1d585b4)) [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da370 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da370 | out: hHeap=0x260000) returned 1 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b378 [0058.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.637] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.637] GetLastError () returned 0x0 [0058.637] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.637] GetLastError () returned 0x0 [0058.645] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff8320, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.645] WriteFile (in: hFile=0x108, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x7ce0, lpOverlapped=0x0) returned 1 [0058.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0058.646] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.646] WriteFile (in: hFile=0x108, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.646] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.646] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.647] CloseHandle (hObject=0x108) returned 1 [0058.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0058.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.648] GetLastError () returned 0x0 [0058.770] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.779] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.779] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.780] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17878079071) returned 1 [0058.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1d80730, dwHighDateTime=0x1d585b4)) [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da760 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da760 | out: hHeap=0x260000) returned 1 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29bec0 [0058.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.780] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.780] GetLastError () returned 0x0 [0058.780] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.781] GetLastError () returned 0x0 [0058.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff9504, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.806] WriteFile (in: hFile=0xf0, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x6afc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x6afc, lpOverlapped=0x0) returned 1 [0058.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0058.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.807] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.808] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.808] CloseHandle (hObject=0xf0) returned 1 [0058.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0058.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.810] GetLastError () returned 0x0 [0058.810] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.811] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0058.811] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.811] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17881218128) returned 1 [0058.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1dcc9f0, dwHighDateTime=0x1d585b4)) [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da840 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da840 | out: hHeap=0x260000) returned 1 [0058.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29b5d8 [0058.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.812] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.812] GetLastError () returned 0x0 [0058.812] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.812] GetLastError () returned 0x0 [0058.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8098, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.815] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7f68, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x7f68, lpOverlapped=0x0) returned 1 [0058.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.816] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.816] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.816] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.817] CloseHandle (hObject=0xf0) returned 1 [0058.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27e3d08 [0058.817] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0058.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e3d08 | out: hHeap=0x260000) returned 1 [0058.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0058.818] GetLastError () returned 0x0 [0058.818] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0058.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0058.819] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0058.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0058.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0058.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0058.819] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17882049262) returned 1 [0058.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1e18cb0, dwHighDateTime=0x1d585b4)) [0058.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0058.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0058.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0058.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2da878 [0058.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0058.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2da878 | out: hHeap=0x260000) returned 1 [0058.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0058.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0058.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0058.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0058.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c1b8 [0058.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0058.834] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0058.834] GetLastError () returned 0x0 [0058.834] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0058.834] GetLastError () returned 0x0 [0058.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffaf5b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.912] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x50a5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x50a5, lpOverlapped=0x0) returned 1 [0058.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0058.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.913] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0058.914] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0058.914] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0058.914] CloseHandle (hObject=0xf0) returned 1 [0058.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0058.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.[deadmin@cock.li].deadmin")) returned 1 [0059.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.026] GetLastError () returned 0x0 [0059.026] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.029] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.029] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.029] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17903004671) returned 1 [0059.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb1fe1d30, dwHighDateTime=0x1d585b4)) [0059.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dab88 [0059.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dab88 | out: hHeap=0x260000) returned 1 [0059.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29caa0 [0059.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.038] GetLastError () returned 0x0 [0059.038] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.038] GetLastError () returned 0x0 [0059.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.049] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0059.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.052] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.052] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.055] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.056] CloseHandle (hObject=0xf0) returned 1 [0059.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.057] GetLastError () returned 0x0 [0059.057] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.058] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.058] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.058] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.058] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17905950705) returned 1 [0059.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb202dff0, dwHighDateTime=0x1d585b4)) [0059.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dac30 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dac30 | out: hHeap=0x260000) returned 1 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ebd0 [0059.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.059] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.059] GetLastError () returned 0x0 [0059.059] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.059] GetLastError () returned 0x0 [0059.071] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.071] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0059.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.072] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.072] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.077] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.077] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.078] CloseHandle (hObject=0xf0) returned 1 [0059.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.109] GetLastError () returned 0x0 [0059.109] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.110] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.110] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.110] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17911147359) returned 1 [0059.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb20c6570, dwHighDateTime=0x1d585b4)) [0059.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dad10 [0059.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad10 | out: hHeap=0x260000) returned 1 [0059.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332db0 [0059.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.111] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.111] GetLastError () returned 0x0 [0059.111] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.111] GetLastError () returned 0x0 [0059.114] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffcf0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.114] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x30f2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x30f2, lpOverlapped=0x0) returned 1 [0059.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.115] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.115] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.115] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.115] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.116] CloseHandle (hObject=0x11c) returned 1 [0059.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.[deadmin@cock.li].deadmin")) returned 1 [0059.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.117] GetLastError () returned 0x0 [0059.118] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.119] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17911978608) returned 1 [0059.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb20c6570, dwHighDateTime=0x1d585b4)) [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dad48 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dad48 | out: hHeap=0x260000) returned 1 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332ee0 [0059.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.119] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.119] GetLastError () returned 0x0 [0059.120] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.120] GetLastError () returned 0x0 [0059.131] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffc3bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.131] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x3c45, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c45, lpOverlapped=0x0) returned 1 [0059.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.133] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.133] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.133] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.133] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.134] CloseHandle (hObject=0x11c) returned 1 [0059.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.135] GetLastError () returned 0x0 [0059.135] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.136] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.136] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.136] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17913718381) returned 1 [0059.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb20ec6d0, dwHighDateTime=0x1d585b4)) [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dadb8 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dadb8 | out: hHeap=0x260000) returned 1 [0059.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.137] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332f78 [0059.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.137] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.137] GetLastError () returned 0x0 [0059.137] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.137] GetLastError () returned 0x0 [0059.156] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffefea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.156] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1016, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1016, lpOverlapped=0x0) returned 1 [0059.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.157] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.157] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.157] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.157] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.157] CloseHandle (hObject=0x11c) returned 1 [0059.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.[deadmin@cock.li].deadmin")) returned 1 [0059.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.159] GetLastError () returned 0x0 [0059.159] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.160] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.160] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.160] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17916155979) returned 1 [0059.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2138990, dwHighDateTime=0x1d585b4)) [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dae98 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dae98 | out: hHeap=0x260000) returned 1 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x349990 [0059.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349990 | out: hHeap=0x260000) returned 1 [0059.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3330a8 [0059.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.161] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.161] GetLastError () returned 0x0 [0059.161] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.161] GetLastError () returned 0x0 [0059.165] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff5cbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.165] WriteFile (in: hFile=0x11c, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xa343, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0xa343, lpOverlapped=0x0) returned 1 [0059.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.165] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.165] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.166] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.166] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.166] CloseHandle (hObject=0x11c) returned 1 [0059.166] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.169] GetLastError () returned 0x0 [0059.169] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.170] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.170] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.170] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17917149847) returned 1 [0059.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2138990, dwHighDateTime=0x1d585b4)) [0059.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daed0 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daed0 | out: hHeap=0x260000) returned 1 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333308 [0059.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.171] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.171] GetLastError () returned 0x0 [0059.171] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.172] GetLastError () returned 0x0 [0059.174] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff5bbb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.174] WriteFile (in: hFile=0x11c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0xa445, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0xa445, lpOverlapped=0x0) returned 1 [0059.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0059.175] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.175] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.175] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.175] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.176] CloseHandle (hObject=0x11c) returned 1 [0059.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.177] GetLastError () returned 0x0 [0059.178] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.179] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.179] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.179] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17918001475) returned 1 [0059.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb215eaf0, dwHighDateTime=0x1d585b4)) [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daf08 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf08 | out: hHeap=0x260000) returned 1 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3333a0 [0059.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.180] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.180] GetLastError () returned 0x0 [0059.180] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.180] GetLastError () returned 0x0 [0059.191] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd45e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.191] WriteFile (in: hFile=0x11c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x2ba2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x2ba2, lpOverlapped=0x0) returned 1 [0059.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0059.192] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.192] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.192] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.193] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.193] CloseHandle (hObject=0x11c) returned 1 [0059.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.194] GetLastError () returned 0x0 [0059.195] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.195] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.195] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.195] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17919661234) returned 1 [0059.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2184c50, dwHighDateTime=0x1d585b4)) [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2daf78 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2daf78 | out: hHeap=0x260000) returned 1 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.196] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333438 [0059.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.196] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.196] GetLastError () returned 0x0 [0059.196] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.196] GetLastError () returned 0x0 [0059.202] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff4252, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.202] WriteFile (in: hFile=0x11c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0xbdae, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0xbdae, lpOverlapped=0x0) returned 1 [0059.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0059.202] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.203] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.203] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.203] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.203] CloseHandle (hObject=0x11c) returned 1 [0059.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.[deadmin@cock.li].deadmin")) returned 1 [0059.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.205] GetLastError () returned 0x0 [0059.205] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x283aef8) returned 1 [0059.206] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.206] CryptReleaseContext (hProv=0x283aef8, dwFlags=0x0) returned 1 [0059.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.206] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17920716147) returned 1 [0059.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb21aadb0, dwHighDateTime=0x1d585b4)) [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2dafe8 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2dafe8 | out: hHeap=0x260000) returned 1 [0059.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333568 [0059.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.207] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.207] GetLastError () returned 0x0 [0059.207] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.207] GetLastError () returned 0x0 [0059.248] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8554, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.248] WriteFile (in: hFile=0x11c, lpBuffer=0x281d080*, nNumberOfBytesToWrite=0x7aac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x281d080*, lpNumberOfBytesWritten=0x24cfdb0*=0x7aac, lpOverlapped=0x0) returned 1 [0059.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281d080 | out: hHeap=0x260000) returned 1 [0059.248] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.249] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.250] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.250] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.255] CloseHandle (hObject=0x11c) returned 1 [0059.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d438 [0059.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d438 | out: hHeap=0x260000) returned 1 [0059.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.280] GetLastError () returned 0x0 [0059.310] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.311] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.311] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17931189915) returned 1 [0059.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb228f5f0, dwHighDateTime=0x1d585b4)) [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db138 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db138 | out: hHeap=0x260000) returned 1 [0059.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333860 [0059.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.312] GetLastError () returned 0x0 [0059.312] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.312] GetLastError () returned 0x0 [0059.321] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff88a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.321] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0x776, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0x776, lpOverlapped=0x0) returned 1 [0059.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.322] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.322] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.323] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.323] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.323] CloseHandle (hObject=0x11c) returned 1 [0059.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.324] GetLastError () returned 0x0 [0059.364] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.371] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.371] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17937262579) returned 1 [0059.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2327b70, dwHighDateTime=0x1d585b4)) [0059.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db288 [0059.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db288 | out: hHeap=0x260000) returned 1 [0059.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x333db8 [0059.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.379] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.379] GetLastError () returned 0x0 [0059.380] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.380] GetLastError () returned 0x0 [0059.391] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffd876, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.391] WriteFile (in: hFile=0x11c, lpBuffer=0x2804078*, nNumberOfBytesToWrite=0x278a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2804078*, lpNumberOfBytesWritten=0x24cfdb0*=0x278a, lpOverlapped=0x0) returned 1 [0059.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2804078 | out: hHeap=0x260000) returned 1 [0059.404] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.404] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.414] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.414] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.415] CloseHandle (hObject=0x11c) returned 1 [0059.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0059.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.416] GetLastError () returned 0x0 [0059.416] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.417] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.417] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.417] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17941845739) returned 1 [0059.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2399f90, dwHighDateTime=0x1d585b4)) [0059.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7630 [0059.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7630 | out: hHeap=0x260000) returned 1 [0059.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x331990 [0059.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.418] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.418] GetLastError () returned 0x0 [0059.418] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.418] GetLastError () returned 0x0 [0059.478] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff324, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.478] WriteFile (in: hFile=0x11c, lpBuffer=0x27eb070*, nNumberOfBytesToWrite=0xcdc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27eb070*, lpNumberOfBytesWritten=0x24cfdb0*=0xcdc, lpOverlapped=0x0) returned 1 [0059.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb070 | out: hHeap=0x260000) returned 1 [0059.479] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.479] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.479] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.480] CloseHandle (hObject=0x11c) returned 1 [0059.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.505] GetLastError () returned 0x0 [0059.506] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.507] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.507] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17950822463) returned 1 [0059.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb247e7d0, dwHighDateTime=0x1d585b4)) [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db480 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db480 | out: hHeap=0x260000) returned 1 [0059.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334148 [0059.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.508] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.508] GetLastError () returned 0x0 [0059.558] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.558] GetLastError () returned 0x0 [0059.581] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb8ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.581] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x4754, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x4754, lpOverlapped=0x0) returned 1 [0059.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.582] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.582] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.582] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.582] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.583] CloseHandle (hObject=0xf0) returned 1 [0059.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.595] GetLastError () returned 0x0 [0059.596] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.597] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.597] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.597] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17959798581) returned 1 [0059.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2563010, dwHighDateTime=0x1d585b4)) [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db560 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db560 | out: hHeap=0x260000) returned 1 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334278 [0059.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.599] GetLastError () returned 0x0 [0059.599] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.599] GetLastError () returned 0x0 [0059.601] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffddbe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.601] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2242, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x2242, lpOverlapped=0x0) returned 1 [0059.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.602] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.602] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.602] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.602] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.603] CloseHandle (hObject=0xf0) returned 1 [0059.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.606] GetLastError () returned 0x0 [0059.607] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.608] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0059.608] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.608] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17960931162) returned 1 [0059.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2589170, dwHighDateTime=0x1d585b4)) [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db598 [0059.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db598 | out: hHeap=0x260000) returned 1 [0059.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3344d8 [0059.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.609] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.609] GetLastError () returned 0x0 [0059.609] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.609] GetLastError () returned 0x0 [0059.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff70f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.612] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x8f0e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x8f0e, lpOverlapped=0x0) returned 1 [0059.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.613] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.613] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.613] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.613] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.614] CloseHandle (hObject=0xf0) returned 1 [0059.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.615] GetLastError () returned 0x0 [0059.615] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.616] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.616] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17961731484) returned 1 [0059.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2589170, dwHighDateTime=0x1d585b4)) [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db5d0 [0059.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db5d0 | out: hHeap=0x260000) returned 1 [0059.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334570 [0059.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.617] GetLastError () returned 0x0 [0059.617] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.617] GetLastError () returned 0x0 [0059.619] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd7c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.619] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x283c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x283c, lpOverlapped=0x0) returned 1 [0059.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.620] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.620] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.621] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.621] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.621] CloseHandle (hObject=0xf0) returned 1 [0059.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.623] GetLastError () returned 0x0 [0059.623] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.624] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.624] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.624] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17962507466) returned 1 [0059.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb25af2d0, dwHighDateTime=0x1d585b4)) [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db608 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db608 | out: hHeap=0x260000) returned 1 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334608 [0059.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.625] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.625] GetLastError () returned 0x0 [0059.625] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.625] GetLastError () returned 0x0 [0059.626] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffaeb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.626] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x514c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x514c, lpOverlapped=0x0) returned 1 [0059.627] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.627] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.627] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.627] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.628] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.628] CloseHandle (hObject=0xf0) returned 1 [0059.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.629] GetLastError () returned 0x0 [0059.629] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.630] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.630] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.630] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17963153223) returned 1 [0059.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb25af2d0, dwHighDateTime=0x1d585b4)) [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db640 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db640 | out: hHeap=0x260000) returned 1 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3346a0 [0059.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.631] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.631] GetLastError () returned 0x0 [0059.631] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.631] GetLastError () returned 0x0 [0059.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdf70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.633] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x2090, lpOverlapped=0x0) returned 1 [0059.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.633] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.634] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.634] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.634] CloseHandle (hObject=0xf0) returned 1 [0059.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.635] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.636] GetLastError () returned 0x0 [0059.636] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.637] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.637] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.637] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17963788219) returned 1 [0059.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb25af2d0, dwHighDateTime=0x1d585b4)) [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db678 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0059.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db678 | out: hHeap=0x260000) returned 1 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x349d50 [0059.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349d50 | out: hHeap=0x260000) returned 1 [0059.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334738 [0059.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.637] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.638] GetLastError () returned 0x0 [0059.638] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.638] GetLastError () returned 0x0 [0059.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd7f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.666] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x280c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x280c, lpOverlapped=0x0) returned 1 [0059.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0059.667] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.667] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.668] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.668] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.668] CloseHandle (hObject=0xf0) returned 1 [0059.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.669] GetLastError () returned 0x0 [0059.684] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.692] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.692] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0059.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0059.692] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17969309228) returned 1 [0059.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2647850, dwHighDateTime=0x1d585b4)) [0059.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0059.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0059.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0059.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2db7c8 [0059.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db7c8 | out: hHeap=0x260000) returned 1 [0059.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x334b60 [0059.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.694] GetLastError () returned 0x0 [0059.694] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.694] GetLastError () returned 0x0 [0059.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd6da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.781] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x2926, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x2926, lpOverlapped=0x0) returned 1 [0059.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.784] WriteFile (in: hFile=0xf0, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.784] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.784] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.785] CloseHandle (hObject=0xf0) returned 1 [0059.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0059.811] GetLastError () returned 0x0 [0059.848] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.848] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.849] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.849] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17984985202) returned 1 [0059.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb27c4610, dwHighDateTime=0x1d585b4)) [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8368 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8368 | out: hHeap=0x260000) returned 1 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315b90 [0059.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.849] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.850] GetLastError () returned 0x0 [0059.850] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.850] GetLastError () returned 0x0 [0059.858] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff85fc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.858] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x7a04, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x7a04, lpOverlapped=0x0) returned 1 [0059.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.859] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.859] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.860] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.860] CloseHandle (hObject=0x108) returned 1 [0059.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.860] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.861] GetLastError () returned 0x0 [0059.862] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.862] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.862] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.862] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17986360185) returned 1 [0059.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb27ea770, dwHighDateTime=0x1d585b4)) [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b83d8 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b83d8 | out: hHeap=0x260000) returned 1 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315df0 [0059.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.863] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.863] GetLastError () returned 0x0 [0059.863] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.863] GetLastError () returned 0x0 [0059.865] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff4420, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.865] WriteFile (in: hFile=0x108, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0xbbe0, lpOverlapped=0x0) returned 1 [0059.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0059.866] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.866] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.867] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.867] CloseHandle (hObject=0x108) returned 1 [0059.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869900 [0059.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869900 | out: hHeap=0x260000) returned 1 [0059.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.927] GetLastError () returned 0x0 [0059.927] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.928] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.928] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.928] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17992918564) returned 1 [0059.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2882cf0, dwHighDateTime=0x1d585b4)) [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8480 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8480 | out: hHeap=0x260000) returned 1 [0059.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315fb8 [0059.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.929] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.929] GetLastError () returned 0x0 [0059.929] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.929] GetLastError () returned 0x0 [0059.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffae16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.958] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x51ea, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x51ea, lpOverlapped=0x0) returned 1 [0059.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0059.958] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.958] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.959] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.959] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.959] CloseHandle (hObject=0xf0) returned 1 [0059.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.961] GetLastError () returned 0x0 [0059.961] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.962] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.962] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.962] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17996302623) returned 1 [0059.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb28cefb0, dwHighDateTime=0x1d585b4)) [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8598 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8598 | out: hHeap=0x260000) returned 1 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316180 [0059.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.963] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.963] GetLastError () returned 0x0 [0059.963] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.963] GetLastError () returned 0x0 [0059.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8fb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.965] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x704e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x704e, lpOverlapped=0x0) returned 1 [0059.966] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0059.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.966] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.967] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.967] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.967] CloseHandle (hObject=0xf0) returned 1 [0059.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.968] GetLastError () returned 0x0 [0059.969] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.969] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.969] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.970] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17997167026) returned 1 [0059.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb28f5110, dwHighDateTime=0x1d585b4)) [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b85d0 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b85d0 | out: hHeap=0x260000) returned 1 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316478 [0059.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.971] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.971] GetLastError () returned 0x0 [0059.971] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.972] GetLastError () returned 0x0 [0059.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffebc4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.973] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x143c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x143c, lpOverlapped=0x0) returned 1 [0059.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0059.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.974] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.974] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.974] CloseHandle (hObject=0xf0) returned 1 [0059.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0059.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0059.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0059.977] GetLastError () returned 0x0 [0059.978] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0059.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0059.978] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0059.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0059.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0059.979] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=17997973162) returned 1 [0059.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb28f5110, dwHighDateTime=0x1d585b4)) [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8608 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0059.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8608 | out: hHeap=0x260000) returned 1 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0059.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0059.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0059.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316510 [0059.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0059.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0059.979] GetLastError () returned 0x0 [0059.980] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0059.980] GetLastError () returned 0x0 [0059.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeabc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.986] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1544, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x1544, lpOverlapped=0x0) returned 1 [0059.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0059.988] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.988] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0059.989] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0059.989] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0059.989] CloseHandle (hObject=0xf0) returned 1 [0059.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0059.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.034] GetLastError () returned 0x0 [0060.034] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.035] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.035] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.035] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18003680573) returned 1 [0060.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb298d690, dwHighDateTime=0x1d585b4)) [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8758 [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8758 | out: hHeap=0x260000) returned 1 [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3165a8 [0060.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.038] GetLastError () returned 0x0 [0060.039] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.039] GetLastError () returned 0x0 [0060.053] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa4f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.053] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x5b08, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x5b08, lpOverlapped=0x0) returned 1 [0060.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.054] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.054] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.055] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.056] CloseHandle (hObject=0xf0) returned 1 [0060.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.057] GetLastError () returned 0x0 [0060.075] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.076] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.077] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.077] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18007787897) returned 1 [0060.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb29ffab0, dwHighDateTime=0x1d585b4)) [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8838 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8838 | out: hHeap=0x260000) returned 1 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x316b00 [0060.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.078] GetLastError () returned 0x0 [0060.078] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.078] GetLastError () returned 0x0 [0060.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe1a8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.088] WriteFile (in: hFile=0xf0, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1e58, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1e58, lpOverlapped=0x0) returned 1 [0060.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0060.088] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.089] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.089] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.089] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.090] CloseHandle (hObject=0xf0) returned 1 [0060.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.277] GetLastError () returned 0x0 [0060.296] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.297] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.297] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.297] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18029843034) returned 1 [0060.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2c14df0, dwHighDateTime=0x1d585b4)) [0060.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8b80 [0060.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8b80 | out: hHeap=0x260000) returned 1 [0060.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x317480 [0060.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.298] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.298] GetLastError () returned 0x0 [0060.298] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.298] GetLastError () returned 0x0 [0060.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe7b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.301] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x184c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x184c, lpOverlapped=0x0) returned 1 [0060.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.301] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.301] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.302] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.303] CloseHandle (hObject=0xf0) returned 1 [0060.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.306] GetLastError () returned 0x0 [0060.306] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.307] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.307] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.307] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18030814474) returned 1 [0060.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2c14df0, dwHighDateTime=0x1d585b4)) [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8bb8 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8bb8 | out: hHeap=0x260000) returned 1 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3173e8 [0060.308] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.308] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.308] GetLastError () returned 0x0 [0060.308] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.308] GetLastError () returned 0x0 [0060.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbe3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.366] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x41c2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x41c2, lpOverlapped=0x0) returned 1 [0060.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.368] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.368] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.369] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.369] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.369] CloseHandle (hObject=0xf0) returned 1 [0060.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.371] GetLastError () returned 0x0 [0060.371] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.372] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.372] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18037362112) returned 1 [0060.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2cd34d0, dwHighDateTime=0x1d585b4)) [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8d40 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8d40 | out: hHeap=0x260000) returned 1 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3175b0 [0060.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.373] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.373] GetLastError () returned 0x0 [0060.373] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.373] GetLastError () returned 0x0 [0060.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe4f4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.376] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1b0c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b0c, lpOverlapped=0x0) returned 1 [0060.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.377] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.377] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.377] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.378] CloseHandle (hObject=0xf0) returned 1 [0060.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.379] GetLastError () returned 0x0 [0060.379] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.380] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.380] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18038142071) returned 1 [0060.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2cd34d0, dwHighDateTime=0x1d585b4)) [0060.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8d78 [0060.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8d78 | out: hHeap=0x260000) returned 1 [0060.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3327d0 [0060.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.381] GetLastError () returned 0x0 [0060.381] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.381] GetLastError () returned 0x0 [0060.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe408, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.383] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1bf8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1bf8, lpOverlapped=0x0) returned 1 [0060.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.383] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.383] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.384] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.384] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.384] CloseHandle (hObject=0xf0) returned 1 [0060.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.386] GetLastError () returned 0x0 [0060.386] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.387] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.387] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.387] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18038786675) returned 1 [0060.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2cd34d0, dwHighDateTime=0x1d585b4)) [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8db0 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8db0 | out: hHeap=0x260000) returned 1 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.387] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332570 [0060.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.387] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.388] GetLastError () returned 0x0 [0060.462] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.462] GetLastError () returned 0x0 [0060.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffed90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.465] WriteFile (in: hFile=0xf0, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x1270, lpOverlapped=0x0) returned 1 [0060.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0060.465] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.465] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.466] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.466] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.466] CloseHandle (hObject=0xf0) returned 1 [0060.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.468] GetLastError () returned 0x0 [0060.468] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.469] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.469] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.469] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18047024485) returned 1 [0060.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2db7d10, dwHighDateTime=0x1d585b4)) [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8f70 [0060.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8f70 | out: hHeap=0x260000) returned 1 [0060.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29c120 [0060.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.470] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.470] GetLastError () returned 0x0 [0060.470] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.470] GetLastError () returned 0x0 [0060.529] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff51e6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.530] WriteFile (in: hFile=0xf0, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xae1a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xae1a, lpOverlapped=0x0) returned 1 [0060.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0060.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.530] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.531] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.531] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.531] CloseHandle (hObject=0xf0) returned 1 [0060.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.531] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.533] GetLastError () returned 0x0 [0060.533] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.533] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.534] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.534] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18053484052) returned 1 [0060.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2e50290, dwHighDateTime=0x1d585b4)) [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9088 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9088 | out: hHeap=0x260000) returned 1 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba250 [0060.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.534] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.535] GetLastError () returned 0x0 [0060.535] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.535] GetLastError () returned 0x0 [0060.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8a36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.546] WriteFile (in: hFile=0xf0, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x75ca, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x75ca, lpOverlapped=0x0) returned 1 [0060.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0060.547] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.547] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.548] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.548] CloseHandle (hObject=0xf0) returned 1 [0060.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28334f8 [0060.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28334f8 | out: hHeap=0x260000) returned 1 [0060.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.550] GetLastError () returned 0x0 [0060.550] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.551] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.551] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18055238527) returned 1 [0060.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2e763f0, dwHighDateTime=0x1d585b4)) [0060.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b90f8 [0060.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b90f8 | out: hHeap=0x260000) returned 1 [0060.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba548 [0060.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.552] GetLastError () returned 0x0 [0060.552] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.552] GetLastError () returned 0x0 [0060.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffab50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.557] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x54b0, lpOverlapped=0x0) returned 1 [0060.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.558] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.558] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.559] CloseHandle (hObject=0xf0) returned 1 [0060.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28335c0 [0060.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28335c0 | out: hHeap=0x260000) returned 1 [0060.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.560] GetLastError () returned 0x0 [0060.561] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.562] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.562] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.562] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18056302111) returned 1 [0060.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2e9c550, dwHighDateTime=0x1d585b4)) [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9130 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9130 | out: hHeap=0x260000) returned 1 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba678 [0060.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.563] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.563] GetLastError () returned 0x0 [0060.563] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.563] GetLastError () returned 0x0 [0060.564] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb860, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.564] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x47a0, lpOverlapped=0x0) returned 1 [0060.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.565] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.565] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.565] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.566] CloseHandle (hObject=0xf0) returned 1 [0060.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2833688 [0060.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2833688 | out: hHeap=0x260000) returned 1 [0060.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.567] GetLastError () returned 0x0 [0060.567] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.568] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.568] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.568] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0060.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0060.568] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18056944515) returned 1 [0060.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2e9c550, dwHighDateTime=0x1d585b4)) [0060.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0060.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279308 [0060.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9168 [0060.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9168 | out: hHeap=0x260000) returned 1 [0060.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba710 [0060.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.569] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.569] GetLastError () returned 0x0 [0060.569] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.569] GetLastError () returned 0x0 [0060.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff575a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.571] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xa8a6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0xa8a6, lpOverlapped=0x0) returned 1 [0060.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.572] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.572] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.572] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.572] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.573] CloseHandle (hObject=0xf0) returned 1 [0060.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2833688 [0060.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2833688 | out: hHeap=0x260000) returned 1 [0060.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.574] GetLastError () returned 0x0 [0060.574] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.689] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.689] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.691] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18069174857) returned 1 [0060.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2fcd050, dwHighDateTime=0x1d585b4)) [0060.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b91a0 [0060.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b91a0 | out: hHeap=0x260000) returned 1 [0060.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bae30 [0060.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.694] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.694] GetLastError () returned 0x0 [0060.694] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.695] GetLastError () returned 0x0 [0060.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffda9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.697] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2566, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x2566, lpOverlapped=0x0) returned 1 [0060.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.699] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.699] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.699] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.700] CloseHandle (hObject=0xf0) returned 1 [0060.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.700] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.701] GetLastError () returned 0x0 [0060.701] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.702] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.702] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.702] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18070349463) returned 1 [0060.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2ff31b0, dwHighDateTime=0x1d585b4)) [0060.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9440 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9440 | out: hHeap=0x260000) returned 1 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ba840 [0060.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.703] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.703] GetLastError () returned 0x0 [0060.703] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.703] GetLastError () returned 0x0 [0060.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd3d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.705] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2c2c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x2c2c, lpOverlapped=0x0) returned 1 [0060.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.705] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.706] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.706] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.706] CloseHandle (hObject=0xf0) returned 1 [0060.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.708] GetLastError () returned 0x0 [0060.708] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.709] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.709] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.709] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.709] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18071050063) returned 1 [0060.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb2ff31b0, dwHighDateTime=0x1d585b4)) [0060.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9478 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9478 | out: hHeap=0x260000) returned 1 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2baf60 [0060.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.710] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.710] GetLastError () returned 0x0 [0060.710] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.710] GetLastError () returned 0x0 [0060.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcf36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.712] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x30ca, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x30ca, lpOverlapped=0x0) returned 1 [0060.712] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.713] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.713] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.713] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.713] CloseHandle (hObject=0xf0) returned 1 [0060.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.715] GetLastError () returned 0x0 [0060.715] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.727] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.727] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.727] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18072804575) returned 1 [0060.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3019310, dwHighDateTime=0x1d585b4)) [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b94b0 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b94b0 | out: hHeap=0x260000) returned 1 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2baff8 [0060.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.728] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.728] GetLastError () returned 0x0 [0060.728] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.728] GetLastError () returned 0x0 [0060.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb3b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.730] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4c4c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x4c4c, lpOverlapped=0x0) returned 1 [0060.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.730] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.730] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.731] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.731] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.731] CloseHandle (hObject=0xf0) returned 1 [0060.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.733] GetLastError () returned 0x0 [0060.733] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.734] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.734] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.734] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18073510036) returned 1 [0060.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb303f470, dwHighDateTime=0x1d585b4)) [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b94e8 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b94e8 | out: hHeap=0x260000) returned 1 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb090 [0060.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.735] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.735] GetLastError () returned 0x0 [0060.735] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.735] GetLastError () returned 0x0 [0060.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc7d6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.736] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x382a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x382a, lpOverlapped=0x0) returned 1 [0060.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0060.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.737] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.737] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.738] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.738] CloseHandle (hObject=0xf0) returned 1 [0060.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0060.738] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0060.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.739] GetLastError () returned 0x0 [0060.740] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.740] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.741] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.741] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18074184001) returned 1 [0060.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb303f470, dwHighDateTime=0x1d585b4)) [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9520 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9520 | out: hHeap=0x260000) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb128 [0060.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.741] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.971] GetLastError () returned 0x0 [0060.975] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.975] GetLastError () returned 0x0 [0060.982] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe4b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.982] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1b4a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b4a, lpOverlapped=0x0) returned 1 [0060.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.987] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.987] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.987] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.987] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.988] CloseHandle (hObject=0xf0) returned 1 [0060.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0060.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0060.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.989] GetLastError () returned 0x0 [0060.990] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.990] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.990] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.990] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.991] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18099171313) returned 1 [0060.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb32a0a70, dwHighDateTime=0x1d585b4)) [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9750 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9750 | out: hHeap=0x260000) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb1c0 [0060.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.991] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.991] GetLastError () returned 0x0 [0060.992] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.992] GetLastError () returned 0x0 [0060.993] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffafc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0060.993] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x504, lpOverlapped=0x0) returned 1 [0060.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0060.994] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.994] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0060.995] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0060.995] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0060.995] CloseHandle (hObject=0xf0) returned 1 [0060.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0060.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0060.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0060.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0060.997] GetLastError () returned 0x0 [0060.997] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0060.998] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0060.998] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0060.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0060.998] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18099904546) returned 1 [0060.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb32c6bd0, dwHighDateTime=0x1d585b4)) [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9788 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0060.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9788 | out: hHeap=0x260000) returned 1 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0060.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0060.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0060.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb7b0 [0060.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0060.999] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0060.999] GetLastError () returned 0x0 [0060.999] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0060.999] GetLastError () returned 0x0 [0061.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe5ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.000] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1a54, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1a54, lpOverlapped=0x0) returned 1 [0061.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.001] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.001] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.001] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.002] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.002] CloseHandle (hObject=0xf0) returned 1 [0061.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.003] GetLastError () returned 0x0 [0061.004] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.004] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.004] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.005] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18100568772) returned 1 [0061.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb32c6bd0, dwHighDateTime=0x1d585b4)) [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b97c0 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b97c0 | out: hHeap=0x260000) returned 1 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb848 [0061.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.005] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.005] GetLastError () returned 0x0 [0061.005] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.006] GetLastError () returned 0x0 [0061.007] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffa8c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.007] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x574, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x574, lpOverlapped=0x0) returned 1 [0061.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.008] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.008] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.009] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.009] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.009] CloseHandle (hObject=0xf0) returned 1 [0061.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.010] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.010] GetLastError () returned 0x0 [0061.014] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.015] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.015] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.015] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18101626399) returned 1 [0061.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb32ecd30, dwHighDateTime=0x1d585b4)) [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b97f8 [0061.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b97f8 | out: hHeap=0x260000) returned 1 [0061.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb8e0 [0061.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.016] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.016] GetLastError () returned 0x0 [0061.016] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.016] GetLastError () returned 0x0 [0061.018] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffe636, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.018] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19ca, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19ca, lpOverlapped=0x0) returned 1 [0061.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.019] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.019] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.019] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.019] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.020] CloseHandle (hObject=0xf0) returned 1 [0061.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0061.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0061.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.021] GetLastError () returned 0x0 [0061.021] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.022] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.022] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.022] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18102327343) returned 1 [0061.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb32ecd30, dwHighDateTime=0x1d585b4)) [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9830 [0061.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9830 | out: hHeap=0x260000) returned 1 [0061.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bb978 [0061.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.023] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.023] GetLastError () returned 0x0 [0061.023] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.023] GetLastError () returned 0x0 [0061.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa014, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.182] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5fec, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x5fec, lpOverlapped=0x0) returned 1 [0061.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.183] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.183] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.184] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.184] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.185] CloseHandle (hObject=0xf0) returned 1 [0061.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.246] GetLastError () returned 0x0 [0061.247] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.247] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.247] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.248] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18124878451) returned 1 [0061.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb35281d0, dwHighDateTime=0x1d585b4)) [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9b08 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9b08 | out: hHeap=0x260000) returned 1 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x332ac8 [0061.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.248] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.248] GetLastError () returned 0x0 [0061.249] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.249] GetLastError () returned 0x0 [0061.250] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffdecb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.250] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2135, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x2135, lpOverlapped=0x0) returned 1 [0061.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.251] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.251] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.251] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.251] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.252] CloseHandle (hObject=0x100) returned 1 [0061.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.[deadmin@cock.li].deadmin")) returned 1 [0061.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.253] GetLastError () returned 0x0 [0061.254] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.254] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.255] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18125576874) returned 1 [0061.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb35281d0, dwHighDateTime=0x1d585b4)) [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949c0 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2949c0 | out: hHeap=0x260000) returned 1 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f048 [0061.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.255] GetLastError () returned 0x0 [0061.256] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.256] GetLastError () returned 0x0 [0061.257] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffffb10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.257] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x4f0, lpOverlapped=0x0) returned 1 [0061.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.258] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.258] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.258] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.258] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.259] CloseHandle (hObject=0x100) returned 1 [0061.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.260] GetLastError () returned 0x0 [0061.260] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.261] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0061.261] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0061.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.261] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18126248983) returned 1 [0061.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb354e330, dwHighDateTime=0x1d585b4)) [0061.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294720 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0061.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294720 | out: hHeap=0x260000) returned 1 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f470 [0061.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.262] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.262] GetLastError () returned 0x0 [0061.262] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.262] GetLastError () returned 0x0 [0061.264] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe7bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.264] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1844, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1844, lpOverlapped=0x0) returned 1 [0061.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.265] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.265] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.265] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.265] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.266] CloseHandle (hObject=0x100) returned 1 [0061.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.266] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.267] GetLastError () returned 0x0 [0061.268] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897658) returned 1 [0061.268] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0061.268] CryptReleaseContext (hProv=0x2897658, dwFlags=0x0) returned 1 [0061.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.269] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18126975296) returned 1 [0061.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb354e330, dwHighDateTime=0x1d585b4)) [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9b40 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9b40 | out: hHeap=0x260000) returned 1 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.269] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bba10 [0061.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.269] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.269] GetLastError () returned 0x0 [0061.270] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.270] GetLastError () returned 0x0 [0061.274] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff7e4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.274] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x81c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x81c, lpOverlapped=0x0) returned 1 [0061.275] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.275] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.275] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.275] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.275] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.276] CloseHandle (hObject=0x100) returned 1 [0061.276] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.277] GetLastError () returned 0x0 [0061.278] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897658) returned 1 [0061.279] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0061.279] CryptReleaseContext (hProv=0x2897658, dwFlags=0x0) returned 1 [0061.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.279] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18127997909) returned 1 [0061.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3574490, dwHighDateTime=0x1d585b4)) [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9b78 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9b78 | out: hHeap=0x260000) returned 1 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bc1c8 [0061.280] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.280] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.280] GetLastError () returned 0x0 [0061.280] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.280] GetLastError () returned 0x0 [0061.503] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffebee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.503] WriteFile (in: hFile=0x100, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1412, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1412, lpOverlapped=0x0) returned 1 [0061.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.539] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.539] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.540] CloseHandle (hObject=0x100) returned 1 [0061.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.615] GetLastError () returned 0x0 [0061.623] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.636] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.636] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.636] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.636] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18163757709) returned 1 [0061.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb38e0430, dwHighDateTime=0x1d585b4)) [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9f68 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9f68 | out: hHeap=0x260000) returned 1 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcab0 [0061.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.637] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.637] GetLastError () returned 0x0 [0061.637] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.637] GetLastError () returned 0x0 [0061.639] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffe3ee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.639] WriteFile (in: hFile=0x100, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1c12, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c12, lpOverlapped=0x0) returned 1 [0061.640] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.640] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.640] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.640] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.641] CloseHandle (hObject=0x100) returned 1 [0061.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.642] GetLastError () returned 0x0 [0061.643] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.644] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.644] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18164485313) returned 1 [0061.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb38e0430, dwHighDateTime=0x1d585b4)) [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b9fd8 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b9fd8 | out: hHeap=0x260000) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bca18 [0061.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.644] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.645] GetLastError () returned 0x0 [0061.645] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.645] GetLastError () returned 0x0 [0061.646] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff398, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.647] WriteFile (in: hFile=0x100, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xc68, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0xc68, lpOverlapped=0x0) returned 1 [0061.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.647] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.647] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.648] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.648] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.648] CloseHandle (hObject=0x100) returned 1 [0061.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.649] GetLastError () returned 0x0 [0061.650] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.651] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.651] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.651] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18165187932) returned 1 [0061.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb38e0430, dwHighDateTime=0x1d585b4)) [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba010 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba010 | out: hHeap=0x260000) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcc78 [0061.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.652] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.652] GetLastError () returned 0x0 [0061.652] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.652] GetLastError () returned 0x0 [0061.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff074, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.654] WriteFile (in: hFile=0x100, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xf8c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0xf8c, lpOverlapped=0x0) returned 1 [0061.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.654] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.655] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.655] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.655] CloseHandle (hObject=0x100) returned 1 [0061.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.657] GetLastError () returned 0x0 [0061.657] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.658] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.658] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.658] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18165910221) returned 1 [0061.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3906590, dwHighDateTime=0x1d585b4)) [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba048 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba048 | out: hHeap=0x260000) returned 1 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcd10 [0061.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.659] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.659] GetLastError () returned 0x0 [0061.659] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.659] GetLastError () returned 0x0 [0061.660] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff08c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.661] WriteFile (in: hFile=0x100, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0xf74, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0xf74, lpOverlapped=0x0) returned 1 [0061.661] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.661] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.662] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.662] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.662] CloseHandle (hObject=0x100) returned 1 [0061.662] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2869770 [0061.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2869770 | out: hHeap=0x260000) returned 1 [0061.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.663] GetLastError () returned 0x0 [0061.664] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.665] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.665] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.665] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18166588955) returned 1 [0061.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3906590, dwHighDateTime=0x1d585b4)) [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ba080 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ba080 | out: hHeap=0x260000) returned 1 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bcda8 [0061.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.666] GetLastError () returned 0x0 [0061.666] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.666] GetLastError () returned 0x0 [0061.742] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xffffea44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.742] WriteFile (in: hFile=0x100, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x15bc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x15bc, lpOverlapped=0x0) returned 1 [0061.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0061.743] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.743] WriteFile (in: hFile=0x100, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.743] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.743] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.744] CloseHandle (hObject=0x100) returned 1 [0061.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28959e0 [0061.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28959e0 | out: hHeap=0x260000) returned 1 [0061.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.821] GetLastError () returned 0x0 [0061.823] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.824] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.824] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.824] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18182539942) returned 1 [0061.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3aa94b0, dwHighDateTime=0x1d585b4)) [0061.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f07c8 [0061.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.838] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f07c8 | out: hHeap=0x260000) returned 1 [0061.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f6d0 [0061.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.839] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.840] GetLastError () returned 0x0 [0061.840] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.840] GetLastError () returned 0x0 [0061.842] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffedcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.842] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1234, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1234, lpOverlapped=0x0) returned 1 [0061.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.844] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.845] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.845] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.846] CloseHandle (hObject=0x118) returned 1 [0061.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28959e0 [0061.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0061.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28959e0 | out: hHeap=0x260000) returned 1 [0061.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0061.848] GetLastError () returned 0x0 [0061.848] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0061.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0061.849] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0061.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0061.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0061.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0061.849] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18185063691) returned 1 [0061.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3acf610, dwHighDateTime=0x1d585b4)) [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0790 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0061.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0790 | out: hHeap=0x260000) returned 1 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0061.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0061.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0061.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fd58 [0061.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0061.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0061.851] GetLastError () returned 0x0 [0061.851] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0061.851] GetLastError () returned 0x0 [0061.929] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdca4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.929] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x235c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x235c, lpOverlapped=0x0) returned 1 [0061.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0061.929] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.929] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0061.930] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0061.930] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0061.930] CloseHandle (hObject=0x118) returned 1 [0062.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28960e8 [0062.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0062.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28960e8 | out: hHeap=0x260000) returned 1 [0062.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.014] GetLastError () returned 0x0 [0062.016] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.017] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.017] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.017] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18201829922) returned 1 [0062.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3c72530, dwHighDateTime=0x1d585b4)) [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8258 [0062.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8258 | out: hHeap=0x260000) returned 1 [0062.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd690 [0062.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.018] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.018] GetLastError () returned 0x0 [0062.018] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.018] GetLastError () returned 0x0 [0062.019] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.019] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x182, lpOverlapped=0x0) returned 1 [0062.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.020] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.020] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.020] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.020] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.021] CloseHandle (hObject=0xfc) returned 1 [0062.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28960e8 [0062.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28960e8 | out: hHeap=0x260000) returned 1 [0062.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.022] GetLastError () returned 0x0 [0062.022] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.023] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.023] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.023] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18202453519) returned 1 [0062.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3c72530, dwHighDateTime=0x1d585b4)) [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295380 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295380 | out: hHeap=0x260000) returned 1 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd7c0 [0062.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.024] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.024] GetLastError () returned 0x0 [0062.024] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.024] GetLastError () returned 0x0 [0062.025] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffea8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.025] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x158, lpOverlapped=0x0) returned 1 [0062.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.026] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.026] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.027] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.027] CloseHandle (hObject=0xfc) returned 1 [0062.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28960e8 [0062.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28960e8 | out: hHeap=0x260000) returned 1 [0062.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.028] GetLastError () returned 0x0 [0062.114] lstrlenW (lpString=".sql") returned 4 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".sql") returned 0x0 [0062.115] lstrlenW (lpString=".mdf") returned 4 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".mdf") returned 0x0 [0062.115] lstrlenW (lpString=".txt") returned 4 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".txt") returned 0x0 [0062.115] lstrlenW (lpString=".dbf") returned 4 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".dbf") returned 0x0 [0062.115] lstrlenW (lpString=".ckp") returned 4 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".ckp") returned 0x0 [0062.115] lstrlenW (lpString=".dacpac") returned 7 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".dacpac") returned 0x0 [0062.115] lstrlenW (lpString=".db3") returned 4 [0062.115] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".db3") returned 0x0 [0062.115] lstrlenW (lpString=".dtxs") returned 5 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".dtxs") returned 0x0 [0062.116] lstrlenW (lpString=".mdt") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".mdt") returned 0x0 [0062.116] lstrlenW (lpString=".sdf") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".sdf") returned 0x0 [0062.116] lstrlenW (lpString=".MDF") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".MDF") returned 0x0 [0062.116] lstrlenW (lpString=".DBF") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".DBF") returned 0x0 [0062.116] lstrlenW (lpString=".DB") returned 3 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".DB") returned 0x0 [0062.116] lstrlenW (lpString=".db") returned 3 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".db") returned 0x0 [0062.116] lstrlenW (lpString=".ndf") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".ndf") returned 0x0 [0062.116] lstrlenW (lpString=".NDF") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".NDF") returned 0x0 [0062.116] lstrlenW (lpString=".Mdf") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".Mdf") returned 0x0 [0062.116] lstrlenW (lpString=".dat") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".dat") returned 0x0 [0062.116] lstrlenW (lpString=".DAT") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".DAT") returned 0x0 [0062.116] lstrlenW (lpString=".ldf") returned 4 [0062.116] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".ldf") returned 0x0 [0062.116] lstrlenW (lpString=".LDF") returned 4 [0062.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch=".LDF") returned 0x0 [0062.117] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0062.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0062.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x34a440 [0062.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0062.117] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.118] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.118] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.118] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.118] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.118] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18212089100) returned 1 [0062.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3d7ced0, dwHighDateTime=0x1d585b4)) [0062.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2899978 [0062.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2899978 | out: hHeap=0x260000) returned 1 [0062.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.121] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd858 [0062.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.121] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.121] GetLastError () returned 0x0 [0062.121] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.121] GetLastError () returned 0x0 [0062.122] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.123] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1af, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1af, lpOverlapped=0x0) returned 1 [0062.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.124] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.124] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.125] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.125] CloseHandle (hObject=0x118) returned 1 [0062.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28960e8 [0062.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28960e8 | out: hHeap=0x260000) returned 1 [0062.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.127] GetLastError () returned 0x0 [0062.127] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.128] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.128] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.128] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18212890266) returned 1 [0062.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3d7ced0, dwHighDateTime=0x1d585b4)) [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351338 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351338 | out: hHeap=0x260000) returned 1 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd8f0 [0062.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.128] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.129] GetLastError () returned 0x0 [0062.129] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.129] GetLastError () returned 0x0 [0062.130] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.130] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d3, lpOverlapped=0x0) returned 1 [0062.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.130] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.130] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.131] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.131] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.131] CloseHandle (hObject=0x118) returned 1 [0062.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28960e8 [0062.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28960e8 | out: hHeap=0x260000) returned 1 [0062.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.133] GetLastError () returned 0x0 [0062.134] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.135] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.135] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.135] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18213600243) returned 1 [0062.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3da3030, dwHighDateTime=0x1d585b4)) [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351370 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351370 | out: hHeap=0x260000) returned 1 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bd988 [0062.136] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.136] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.136] GetLastError () returned 0x0 [0062.136] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.136] GetLastError () returned 0x0 [0062.137] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.137] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0062.137] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.137] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.137] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.138] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.138] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.138] CloseHandle (hObject=0x118) returned 1 [0062.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896020 [0062.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896020 | out: hHeap=0x260000) returned 1 [0062.140] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.140] GetLastError () returned 0x0 [0062.140] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.141] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.141] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.141] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18214225146) returned 1 [0062.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3da3030, dwHighDateTime=0x1d585b4)) [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3513a8 [0062.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3513a8 | out: hHeap=0x260000) returned 1 [0062.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bda20 [0062.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.142] GetLastError () returned 0x0 [0062.142] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.142] GetLastError () returned 0x0 [0062.143] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.143] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0062.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.144] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.144] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.144] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.144] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.145] CloseHandle (hObject=0x118) returned 1 [0062.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896020 [0062.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896020 | out: hHeap=0x260000) returned 1 [0062.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.146] GetLastError () returned 0x0 [0062.147] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.147] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.147] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.148] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18214875856) returned 1 [0062.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3da3030, dwHighDateTime=0x1d585b4)) [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3513e0 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3513e0 | out: hHeap=0x260000) returned 1 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdab8 [0062.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.148] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.148] GetLastError () returned 0x0 [0062.149] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.149] GetLastError () returned 0x0 [0062.171] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff009, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.171] WriteFile (in: hFile=0x118, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xff7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0xff7, lpOverlapped=0x0) returned 1 [0062.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.174] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.174] WriteFile (in: hFile=0x118, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.174] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.174] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.175] CloseHandle (hObject=0x118) returned 1 [0062.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.296] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.304] GetLastError () returned 0x0 [0062.304] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.305] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.305] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.305] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18230609640) returned 1 [0062.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3f1fdf0, dwHighDateTime=0x1d585b4)) [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351878 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351878 | out: hHeap=0x260000) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3537c0 [0062.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.306] GetLastError () returned 0x0 [0062.306] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.306] GetLastError () returned 0x0 [0062.309] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffc79, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.309] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x387, lpOverlapped=0x0) returned 1 [0062.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0062.310] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.310] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.311] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.311] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.311] CloseHandle (hObject=0xfc) returned 1 [0062.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895e90 [0062.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895e90 | out: hHeap=0x260000) returned 1 [0062.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.313] GetLastError () returned 0x0 [0062.320] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.349] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.349] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.349] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18235005618) returned 1 [0062.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3f92210, dwHighDateTime=0x1d585b4)) [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351920 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351920 | out: hHeap=0x260000) returned 1 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353be8 [0062.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.350] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.350] GetLastError () returned 0x0 [0062.350] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.350] GetLastError () returned 0x0 [0062.353] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffd29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.353] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x2d7, lpOverlapped=0x0) returned 1 [0062.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.354] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.354] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.354] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.354] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.355] CloseHandle (hObject=0xfc) returned 1 [0062.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0062.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.356] GetLastError () returned 0x0 [0062.356] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.357] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.357] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.357] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18235836253) returned 1 [0062.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3fb8370, dwHighDateTime=0x1d585b4)) [0062.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351a00 [0062.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351a00 | out: hHeap=0x260000) returned 1 [0062.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353988 [0062.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.358] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.358] GetLastError () returned 0x0 [0062.358] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.358] GetLastError () returned 0x0 [0062.360] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffbba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.360] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x446, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x446, lpOverlapped=0x0) returned 1 [0062.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.361] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.361] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.361] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.361] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.362] CloseHandle (hObject=0xfc) returned 1 [0062.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895918 [0062.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895918 | out: hHeap=0x260000) returned 1 [0062.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.363] GetLastError () returned 0x0 [0062.363] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.364] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.364] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.364] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18236533590) returned 1 [0062.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb3fb8370, dwHighDateTime=0x1d585b4)) [0062.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.364] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x351a38 [0062.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0062.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x351a38 | out: hHeap=0x260000) returned 1 [0062.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0062.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x353d18 [0062.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.365] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.365] GetLastError () returned 0x0 [0062.365] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.365] GetLastError () returned 0x0 [0062.481] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffa02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.488] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x5fe, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x5fe, lpOverlapped=0x0) returned 1 [0062.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.496] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.496] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.511] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.511] CloseHandle (hObject=0xfc) returned 1 [0062.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.513] GetLastError () returned 0x0 [0062.513] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.514] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.514] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.514] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18251489573) returned 1 [0062.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4135130, dwHighDateTime=0x1d585b4)) [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0950 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0950 | out: hHeap=0x260000) returned 1 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x315cc0 [0062.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.514] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.515] GetLastError () returned 0x0 [0062.515] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.515] GetLastError () returned 0x0 [0062.516] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffedb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.517] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x124a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x124a, lpOverlapped=0x0) returned 1 [0062.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.517] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.517] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.518] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.518] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.518] CloseHandle (hObject=0xfc) returned 1 [0062.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.519] GetLastError () returned 0x0 [0062.520] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.521] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.521] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.521] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18252191050) returned 1 [0062.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4135130, dwHighDateTime=0x1d585b4)) [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0918 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0918 | out: hHeap=0x260000) returned 1 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.522] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.522] GetLastError () returned 0x0 [0062.522] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.522] GetLastError () returned 0x0 [0062.524] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdfe9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.524] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2017, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x2017, lpOverlapped=0x0) returned 1 [0062.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.524] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.524] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.525] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.525] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.525] CloseHandle (hObject=0xfc) returned 1 [0062.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.527] GetLastError () returned 0x0 [0062.527] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.528] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.528] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.528] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18252912944) returned 1 [0062.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb415b290, dwHighDateTime=0x1d585b4)) [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f08e0 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f08e0 | out: hHeap=0x260000) returned 1 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.529] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.529] GetLastError () returned 0x0 [0062.529] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.529] GetLastError () returned 0x0 [0062.531] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdf12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.531] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x20ee, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x20ee, lpOverlapped=0x0) returned 1 [0062.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.531] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.532] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.532] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.532] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.532] CloseHandle (hObject=0xfc) returned 1 [0062.533] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.534] GetLastError () returned 0x0 [0062.534] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.535] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.535] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.535] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18253635431) returned 1 [0062.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb415b290, dwHighDateTime=0x1d585b4)) [0062.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f08a8 [0062.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f08a8 | out: hHeap=0x260000) returned 1 [0062.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.536] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.536] GetLastError () returned 0x0 [0062.536] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.536] GetLastError () returned 0x0 [0062.538] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdfda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.538] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2026, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x2026, lpOverlapped=0x0) returned 1 [0062.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.539] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.539] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.539] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.539] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.540] CloseHandle (hObject=0xfc) returned 1 [0062.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.541] GetLastError () returned 0x0 [0062.541] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.542] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.542] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.542] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18254322011) returned 1 [0062.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb41813f0, dwHighDateTime=0x1d585b4)) [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0870 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0870 | out: hHeap=0x260000) returned 1 [0062.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319af8 [0062.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2bdb50 [0062.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319af8 | out: hHeap=0x260000) returned 1 [0062.543] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.543] GetLastError () returned 0x0 [0062.543] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.543] GetLastError () returned 0x0 [0062.657] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffdced, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.657] WriteFile (in: hFile=0xfc, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x2313, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x2313, lpOverlapped=0x0) returned 1 [0062.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0062.657] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.658] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.658] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.658] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.659] CloseHandle (hObject=0xfc) returned 1 [0062.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0062.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.[deadmin@cock.li].deadmin")) returned 1 [0062.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0062.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.747] GetLastError () returned 0x0 [0062.753] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.754] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.754] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18275522109) returned 1 [0062.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb43705d0, dwHighDateTime=0x1d585b4)) [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0b10 [0062.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0b10 | out: hHeap=0x260000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0062.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321e88 [0062.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.755] GetLastError () returned 0x0 [0062.755] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.755] GetLastError () returned 0x0 [0062.759] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe89c5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.759] WriteFile (in: hFile=0xfc, lpBuffer=0x27bb060*, nNumberOfBytesToWrite=0x1763b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27bb060*, lpNumberOfBytesWritten=0x24cfdb0*=0x1763b, lpOverlapped=0x0) returned 1 [0062.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb060 | out: hHeap=0x260000) returned 1 [0062.760] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.760] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.760] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.760] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.761] CloseHandle (hObject=0xfc) returned 1 [0062.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2896ca0 [0062.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2896ca0 | out: hHeap=0x260000) returned 1 [0062.762] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.762] GetLastError () returned 0x0 [0062.763] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.764] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.764] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0062.764] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18276491392) returned 1 [0062.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4396730, dwHighDateTime=0x1d585b4)) [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1050 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1050 | out: hHeap=0x260000) returned 1 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0062.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3212a8 [0062.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.764] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.765] GetLastError () returned 0x0 [0062.765] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.765] GetLastError () returned 0x0 [0062.771] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.772] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.773] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.773] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.775] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.775] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.776] CloseHandle (hObject=0xfc) returned 1 [0062.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.776] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.777] GetLastError () returned 0x0 [0062.778] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.779] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0062.779] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.779] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18278029671) returned 1 [0062.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb43bc890, dwHighDateTime=0x1d585b4)) [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0fe0 [0062.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0062.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0fe0 | out: hHeap=0x260000) returned 1 [0062.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0062.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0062.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321df0 [0062.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.780] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.780] GetLastError () returned 0x0 [0062.780] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.780] GetLastError () returned 0x0 [0062.782] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffefa0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.782] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x105f4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x105f4, lpOverlapped=0x0) returned 1 [0062.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.783] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.783] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.783] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.784] CloseHandle (hObject=0xfc) returned 1 [0062.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0062.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0062.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.785] GetLastError () returned 0x0 [0062.786] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0062.787] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0062.787] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0062.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0062.787] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18278812243) returned 1 [0062.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb43bc890, dwHighDateTime=0x1d585b4)) [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0fa8 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0062.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0fa8 | out: hHeap=0x260000) returned 1 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0062.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0062.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319c48 [0062.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0062.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0062.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319c48 | out: hHeap=0x260000) returned 1 [0062.788] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0062.788] GetLastError () returned 0x0 [0062.788] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0062.788] GetLastError () returned 0x0 [0062.791] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.791] WriteFile (in: hFile=0xfc, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0062.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0062.792] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.793] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0062.794] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0062.794] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0062.795] CloseHandle (hObject=0xfc) returned 1 [0062.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0062.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.[deadmin@cock.li].deadmin")) returned 1 [0062.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0062.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0062.796] GetLastError () returned 0x0 [0063.323] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.324] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.324] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.324] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18332531133) returned 1 [0063.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb48f18b0, dwHighDateTime=0x1d585b4)) [0063.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352100 [0063.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352100 | out: hHeap=0x260000) returned 1 [0063.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0063.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.325] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.325] GetLastError () returned 0x0 [0063.325] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.326] GetLastError () returned 0x0 [0063.353] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffedbf3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.353] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1240d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x1240d, lpOverlapped=0x0) returned 1 [0063.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.355] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.355] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.355] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.356] CloseHandle (hObject=0xf0) returned 1 [0063.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3ee8 [0063.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3ee8 | out: hHeap=0x260000) returned 1 [0063.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.358] GetLastError () returned 0x0 [0063.359] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.360] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.360] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.360] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.360] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18336131467) returned 1 [0063.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb493db70, dwHighDateTime=0x1d585b4)) [0063.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3521a8 [0063.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3521a8 | out: hHeap=0x260000) returned 1 [0063.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321b90 [0063.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.361] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.361] GetLastError () returned 0x0 [0063.361] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.361] GetLastError () returned 0x0 [0063.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffedb60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.365] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x124a0, lpOverlapped=0x0) returned 1 [0063.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.366] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.366] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.367] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.367] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.368] CloseHandle (hObject=0xf0) returned 1 [0063.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3ee8 [0063.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3ee8 | out: hHeap=0x260000) returned 1 [0063.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.370] GetLastError () returned 0x0 [0063.371] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897988) returned 1 [0063.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.372] CryptReleaseContext (hProv=0x2897988, dwFlags=0x0) returned 1 [0063.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0063.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0063.372] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18337336060) returned 1 [0063.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4963cd0, dwHighDateTime=0x1d585b4)) [0063.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0063.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0063.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3521e0 [0063.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3521e0 | out: hHeap=0x260000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320e80 [0063.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.373] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.373] GetLastError () returned 0x0 [0063.373] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.374] GetLastError () returned 0x0 [0063.377] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffef27d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.377] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x10d83, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x10d83, lpOverlapped=0x0) returned 1 [0063.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.378] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.379] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.379] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.380] CloseHandle (hObject=0xf0) returned 1 [0063.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bb2d0 [0063.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bb2d0 | out: hHeap=0x260000) returned 1 [0063.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0063.381] GetLastError () returned 0x0 [0063.382] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.442] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.442] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.442] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18344326346) returned 1 [0063.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb49fc250, dwHighDateTime=0x1d585b4)) [0063.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352218 [0063.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352218 | out: hHeap=0x260000) returned 1 [0063.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321cc0 [0063.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.443] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.443] GetLastError () returned 0x0 [0063.443] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.444] GetLastError () returned 0x0 [0063.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffea28b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.447] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x15d75, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x15d75, lpOverlapped=0x0) returned 1 [0063.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.448] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.448] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.449] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.449] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.450] CloseHandle (hObject=0xf0) returned 1 [0063.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0063.450] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.[deadmin@cock.li].deadmin")) returned 1 [0063.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0063.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.452] GetLastError () returned 0x0 [0063.453] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.454] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.454] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.455] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18345579017) returned 1 [0063.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4a223b0, dwHighDateTime=0x1d585b4)) [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3522f8 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3522f8 | out: hHeap=0x260000) returned 1 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be0a8 [0063.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.455] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.456] GetLastError () returned 0x0 [0063.456] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.456] GetLastError () returned 0x0 [0063.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.458] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c5, lpOverlapped=0x0) returned 1 [0063.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.460] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.460] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.462] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.462] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.463] CloseHandle (hObject=0xf0) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.464] GetLastError () returned 0x0 [0063.465] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.466] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.467] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18346781220) returned 1 [0063.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4a48510, dwHighDateTime=0x1d585b4)) [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352330 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352330 | out: hHeap=0x260000) returned 1 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be0a8 [0063.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.468] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.468] GetLastError () returned 0x0 [0063.468] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.468] GetLastError () returned 0x0 [0063.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.470] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.471] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.472] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.472] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.473] CloseHandle (hObject=0xf0) returned 1 [0063.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.474] GetLastError () returned 0x0 [0063.475] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.476] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.476] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.476] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18347714900) returned 1 [0063.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4a48510, dwHighDateTime=0x1d585b4)) [0063.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3524b8 [0063.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3524b8 | out: hHeap=0x260000) returned 1 [0063.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.522] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.522] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.522] GetLastError () returned 0x0 [0063.523] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.523] GetLastError () returned 0x0 [0063.524] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.525] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c1, lpOverlapped=0x0) returned 1 [0063.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.526] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.526] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.527] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.527] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.527] CloseHandle (hObject=0xf0) returned 1 [0063.528] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30daf0 [0063.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30daf0 | out: hHeap=0x260000) returned 1 [0063.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.561] GetLastError () returned 0x0 [0063.568] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.569] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.569] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18357010830) returned 1 [0063.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4b2cd50, dwHighDateTime=0x1d585b4)) [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3525d0 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3525d0 | out: hHeap=0x260000) returned 1 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.570] GetLastError () returned 0x0 [0063.570] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.570] GetLastError () returned 0x0 [0063.573] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.573] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c4, lpOverlapped=0x0) returned 1 [0063.574] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.574] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.574] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.574] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.574] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.575] CloseHandle (hObject=0xf0) returned 1 [0063.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.575] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.576] GetLastError () returned 0x0 [0063.576] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.577] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.577] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.577] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18357842213) returned 1 [0063.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4b52eb0, dwHighDateTime=0x1d585b4)) [0063.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352608 [0063.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352608 | out: hHeap=0x260000) returned 1 [0063.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.578] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.578] GetLastError () returned 0x0 [0063.578] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.578] GetLastError () returned 0x0 [0063.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.580] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c2, lpOverlapped=0x0) returned 1 [0063.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.580] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.581] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.581] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.581] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.582] CloseHandle (hObject=0xf0) returned 1 [0063.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.583] GetLastError () returned 0x0 [0063.584] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.584] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.584] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.585] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18358568629) returned 1 [0063.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4b52eb0, dwHighDateTime=0x1d585b4)) [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352640 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352640 | out: hHeap=0x260000) returned 1 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.585] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.585] GetLastError () returned 0x0 [0063.586] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.586] GetLastError () returned 0x0 [0063.587] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.587] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3a0, lpOverlapped=0x0) returned 1 [0063.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.588] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.588] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.588] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.589] CloseHandle (hObject=0xf0) returned 1 [0063.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.590] GetLastError () returned 0x0 [0063.590] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.591] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.591] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18359239899) returned 1 [0063.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4b79010, dwHighDateTime=0x1d585b4)) [0063.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352678 [0063.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352678 | out: hHeap=0x260000) returned 1 [0063.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8270 [0063.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8270 | out: hHeap=0x260000) returned 1 [0063.592] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.592] GetLastError () returned 0x0 [0063.592] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.592] GetLastError () returned 0x0 [0063.594] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.594] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3bf, lpOverlapped=0x0) returned 1 [0063.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.594] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.594] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.595] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.595] CloseHandle (hObject=0xf0) returned 1 [0063.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.597] GetLastError () returned 0x0 [0063.597] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.598] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.598] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18359928145) returned 1 [0063.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4b79010, dwHighDateTime=0x1d585b4)) [0063.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3526b0 [0063.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3526b0 | out: hHeap=0x260000) returned 1 [0063.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.599] GetLastError () returned 0x0 [0063.599] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.599] GetLastError () returned 0x0 [0063.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.761] WriteFile (in: hFile=0xf0, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c4, lpOverlapped=0x0) returned 1 [0063.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0063.761] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.761] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.762] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.762] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.762] CloseHandle (hObject=0xf0) returned 1 [0063.762] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.763] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.810] GetLastError () returned 0x0 [0063.810] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.811] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0063.811] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.811] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0063.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.811] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18381411371) returned 1 [0063.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4d8e350, dwHighDateTime=0x1d585b4)) [0063.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3528e0 [0063.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3528e0 | out: hHeap=0x260000) returned 1 [0063.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x319cf0 [0063.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x319cf0 | out: hHeap=0x260000) returned 1 [0063.814] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.814] GetLastError () returned 0x0 [0063.814] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.814] GetLastError () returned 0x0 [0063.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.816] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c6, lpOverlapped=0x0) returned 1 [0063.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.817] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.818] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.818] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.818] CloseHandle (hObject=0xf0) returned 1 [0063.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.819] GetLastError () returned 0x0 [0063.820] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.821] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.821] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.821] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18382206321) returned 1 [0063.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4db44b0, dwHighDateTime=0x1d585b4)) [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352918 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0063.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352918 | out: hHeap=0x260000) returned 1 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0063.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a0e0 [0063.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a0e0 | out: hHeap=0x260000) returned 1 [0063.822] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.822] GetLastError () returned 0x0 [0063.822] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.822] GetLastError () returned 0x0 [0063.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.824] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x3c2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c2, lpOverlapped=0x0) returned 1 [0063.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.824] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.824] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.825] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.825] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.825] CloseHandle (hObject=0xf0) returned 1 [0063.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.827] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0063.827] GetLastError () returned 0x0 [0063.827] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.828] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0063.828] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0063.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.828] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18382910761) returned 1 [0063.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4e72b90, dwHighDateTime=0x1d585b4)) [0063.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0063.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352528 [0063.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352528 | out: hHeap=0x260000) returned 1 [0063.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a2d8 [0063.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a2d8 | out: hHeap=0x260000) returned 1 [0063.902] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.902] GetLastError () returned 0x0 [0063.902] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.902] GetLastError () returned 0x0 [0063.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc3b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.906] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c5, lpOverlapped=0x0) returned 1 [0063.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0063.907] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.907] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.908] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.908] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.908] CloseHandle (hObject=0xf0) returned 1 [0063.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845920 [0063.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.[deadmin@cock.li].deadmin")) returned 1 [0063.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845920 | out: hHeap=0x260000) returned 1 [0063.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0063.955] GetLastError () returned 0x0 [0063.960] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.961] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0063.961] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.961] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0063.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.962] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18396272172) returned 1 [0063.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4f0b110, dwHighDateTime=0x1d585b4)) [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352bf0 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352bf0 | out: hHeap=0x260000) returned 1 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.962] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.962] GetLastError () returned 0x0 [0063.963] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.963] GetLastError () returned 0x0 [0063.964] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff407f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.965] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0xbf81, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0xbf81, lpOverlapped=0x0) returned 1 [0063.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.965] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.966] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.966] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.966] CloseHandle (hObject=0xf0) returned 1 [0063.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0063.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.[deadmin@cock.li].deadmin")) returned 1 [0063.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0063.968] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.968] GetLastError () returned 0x0 [0063.968] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.969] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0063.969] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.969] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18397010445) returned 1 [0063.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4f0b110, dwHighDateTime=0x1d585b4)) [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352c28 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352c28 | out: hHeap=0x260000) returned 1 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.970] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.970] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.970] GetLastError () returned 0x0 [0063.970] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.970] GetLastError () returned 0x0 [0063.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa7e6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.972] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x581a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x581a, lpOverlapped=0x0) returned 1 [0063.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.973] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.973] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.973] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.974] CloseHandle (hObject=0xf0) returned 1 [0063.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0063.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.[deadmin@cock.li].deadmin")) returned 1 [0063.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0063.975] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.975] GetLastError () returned 0x0 [0063.975] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.976] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0063.976] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0063.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.976] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18397736347) returned 1 [0063.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4f31270, dwHighDateTime=0x1d585b4)) [0063.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352c60 [0063.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352c60 | out: hHeap=0x260000) returned 1 [0063.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.977] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.977] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.977] GetLastError () returned 0x0 [0063.977] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.977] GetLastError () returned 0x0 [0063.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff9693, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.979] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x696d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x696d, lpOverlapped=0x0) returned 1 [0063.980] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0063.980] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.980] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0063.980] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0063.980] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0063.981] CloseHandle (hObject=0xf0) returned 1 [0063.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0063.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.[deadmin@cock.li].deadmin")) returned 1 [0063.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0063.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0063.982] GetLastError () returned 0x0 [0063.983] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2897900) returned 1 [0063.983] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0063.983] CryptReleaseContext (hProv=0x2897900, dwFlags=0x0) returned 1 [0063.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0063.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0063.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0063.984] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18398468585) returned 1 [0063.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb4f31270, dwHighDateTime=0x1d585b4)) [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x352c98 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0063.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x352c98 | out: hHeap=0x260000) returned 1 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0063.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27f8120 [0063.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0063.984] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0063.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f8120 | out: hHeap=0x260000) returned 1 [0063.984] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0063.984] GetLastError () returned 0x0 [0063.984] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0063.985] GetLastError () returned 0x0 [0064.091] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.098] WriteFile (in: hFile=0xf0, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.110] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.126] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.254] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.257] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.257] CloseHandle (hObject=0xf0) returned 1 [0064.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.259] GetLastError () returned 0x0 [0064.350] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.351] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.351] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0064.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0064.351] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18435255443) returned 1 [0064.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb52c3370, dwHighDateTime=0x1d585b4)) [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2899f98 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2899f98 | out: hHeap=0x260000) returned 1 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a620 [0064.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.352] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a620 | out: hHeap=0x260000) returned 1 [0064.352] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.352] GetLastError () returned 0x0 [0064.352] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.353] GetLastError () returned 0x0 [0064.354] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffb365, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.354] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4c9b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x4c9b, lpOverlapped=0x0) returned 1 [0064.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.355] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.355] WriteFile (in: hFile=0xa4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.356] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.356] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.356] CloseHandle (hObject=0xa4) returned 1 [0064.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.[deadmin@cock.li].deadmin")) returned 1 [0064.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0064.358] GetLastError () returned 0x0 [0064.380] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.411] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.411] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.412] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18441301069) returned 1 [0064.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5335790, dwHighDateTime=0x1d585b4)) [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8978 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8978 | out: hHeap=0x260000) returned 1 [0064.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27cdda0 [0064.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cdda0 | out: hHeap=0x260000) returned 1 [0064.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.413] GetLastError () returned 0x0 [0064.413] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.413] GetLastError () returned 0x0 [0064.416] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.416] WriteFile (in: hFile=0x120, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe0e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0xe0e, lpOverlapped=0x0) returned 1 [0064.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.417] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.417] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.417] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.417] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.418] CloseHandle (hObject=0x120) returned 1 [0064.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.419] GetLastError () returned 0x0 [0064.419] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.420] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.420] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.420] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18442136119) returned 1 [0064.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb535b8f0, dwHighDateTime=0x1d585b4)) [0064.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8898 [0064.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8898 | out: hHeap=0x260000) returned 1 [0064.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27cde48 [0064.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.421] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.421] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cde48 | out: hHeap=0x260000) returned 1 [0064.421] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.421] GetLastError () returned 0x0 [0064.421] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.421] GetLastError () returned 0x0 [0064.423] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.423] WriteFile (in: hFile=0x120, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0xe16, lpOverlapped=0x0) returned 1 [0064.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.423] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.423] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.424] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.424] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.424] CloseHandle (hObject=0x120) returned 1 [0064.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.426] GetLastError () returned 0x0 [0064.426] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.427] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.427] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.427] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18442804595) returned 1 [0064.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb535b8f0, dwHighDateTime=0x1d585b4)) [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8860 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8860 | out: hHeap=0x260000) returned 1 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27cde48 [0064.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cde48 | out: hHeap=0x260000) returned 1 [0064.428] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.428] GetLastError () returned 0x0 [0064.428] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.428] GetLastError () returned 0x0 [0064.546] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1d1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.547] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xe2f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xe2f, lpOverlapped=0x0) returned 1 [0064.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.547] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.547] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.548] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.548] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.548] CloseHandle (hObject=0x120) returned 1 [0064.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.580] GetLastError () returned 0x0 [0064.580] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.581] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.581] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.581] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18458195510) returned 1 [0064.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb54d86b0, dwHighDateTime=0x1d585b4)) [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d84e0 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d84e0 | out: hHeap=0x260000) returned 1 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27ce628 [0064.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce628 | out: hHeap=0x260000) returned 1 [0064.582] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.582] GetLastError () returned 0x0 [0064.582] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.582] GetLastError () returned 0x0 [0064.584] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.584] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xe2c, lpOverlapped=0x0) returned 1 [0064.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.585] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.585] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.585] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.585] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.586] CloseHandle (hObject=0x120) returned 1 [0064.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.587] GetLastError () returned 0x0 [0064.588] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.588] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.589] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18458964096) returned 1 [0064.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb54fe810, dwHighDateTime=0x1d585b4)) [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d84a8 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d84a8 | out: hHeap=0x260000) returned 1 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27ce580 [0064.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce580 | out: hHeap=0x260000) returned 1 [0064.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.589] GetLastError () returned 0x0 [0064.589] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.590] GetLastError () returned 0x0 [0064.591] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1f1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.591] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe0f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xe0f, lpOverlapped=0x0) returned 1 [0064.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.592] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.592] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.592] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.593] CloseHandle (hObject=0x120) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.594] GetLastError () returned 0x0 [0064.596] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.597] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.597] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.597] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18459794517) returned 1 [0064.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb54fe810, dwHighDateTime=0x1d585b4)) [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8470 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8470 | out: hHeap=0x260000) returned 1 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27ce580 [0064.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce580 | out: hHeap=0x260000) returned 1 [0064.598] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.598] GetLastError () returned 0x0 [0064.598] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.598] GetLastError () returned 0x0 [0064.600] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff181, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.600] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe7f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xe7f, lpOverlapped=0x0) returned 1 [0064.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0064.600] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.600] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.601] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.601] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.602] CloseHandle (hObject=0x120) returned 1 [0064.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.603] GetLastError () returned 0x0 [0064.603] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.604] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.604] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.604] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18460535454) returned 1 [0064.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5524970, dwHighDateTime=0x1d585b4)) [0064.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7a90 [0064.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7a90 | out: hHeap=0x260000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27ce580 [0064.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2be140 [0064.605] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ce580 | out: hHeap=0x260000) returned 1 [0064.605] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.605] GetLastError () returned 0x0 [0064.605] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.605] GetLastError () returned 0x0 [0064.607] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff1e8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.607] WriteFile (in: hFile=0x120, lpBuffer=0x28a1068*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a1068*, lpNumberOfBytesWritten=0x24cfdb0*=0xe18, lpOverlapped=0x0) returned 1 [0064.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a1068 | out: hHeap=0x260000) returned 1 [0064.607] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.608] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.608] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.608] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.609] CloseHandle (hObject=0x120) returned 1 [0064.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0064.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0064.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.610] GetLastError () returned 0x0 [0064.671] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.688] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.688] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18468956995) returned 1 [0064.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb55e3050, dwHighDateTime=0x1d585b4)) [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1360 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1360 | out: hHeap=0x260000) returned 1 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323f20 [0064.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.690] GetLastError () returned 0x0 [0064.690] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.690] GetLastError () returned 0x0 [0064.692] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff117, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.692] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xee9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xee9, lpOverlapped=0x0) returned 1 [0064.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.693] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.693] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.694] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.694] CloseHandle (hObject=0x120) returned 1 [0064.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845af0 [0064.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.[deadmin@cock.li].deadmin")) returned 1 [0064.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845af0 | out: hHeap=0x260000) returned 1 [0064.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.696] GetLastError () returned 0x0 [0064.696] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.697] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.697] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.697] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18469807767) returned 1 [0064.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb56091b0, dwHighDateTime=0x1d585b4)) [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1248 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1248 | out: hHeap=0x260000) returned 1 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3242b0 [0064.698] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.698] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.698] GetLastError () returned 0x0 [0064.698] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.698] GetLastError () returned 0x0 [0064.700] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff0390, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.700] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xfc70, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xfc70, lpOverlapped=0x0) returned 1 [0064.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.701] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.701] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.701] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.701] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.702] CloseHandle (hObject=0x120) returned 1 [0064.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.[deadmin@cock.li].deadmin")) returned 1 [0064.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.703] GetLastError () returned 0x0 [0064.703] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.704] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.704] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.704] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18470533257) returned 1 [0064.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb56091b0, dwHighDateTime=0x1d585b4)) [0064.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1210 [0064.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1210 | out: hHeap=0x260000) returned 1 [0064.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323c28 [0064.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.705] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.705] GetLastError () returned 0x0 [0064.705] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.705] GetLastError () returned 0x0 [0064.707] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffeda00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.708] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x12600, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x12600, lpOverlapped=0x0) returned 1 [0064.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.708] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.708] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.756] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.756] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.757] CloseHandle (hObject=0x120) returned 1 [0064.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.758] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.[deadmin@cock.li].deadmin")) returned 1 [0064.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.759] GetLastError () returned 0x0 [0064.760] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.760] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0064.761] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18476182245) returned 1 [0064.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb56a1730, dwHighDateTime=0x1d585b4)) [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f11d8 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f11d8 | out: hHeap=0x260000) returned 1 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31a818 [0064.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0064.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31a818 | out: hHeap=0x260000) returned 1 [0064.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.762] GetLastError () returned 0x0 [0064.762] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.762] GetLastError () returned 0x0 [0064.765] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.765] WriteFile (in: hFile=0x120, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0064.766] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.766] WriteFile (in: hFile=0x120, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.767] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.767] CloseHandle (hObject=0x120) returned 1 [0064.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0064.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.[deadmin@cock.li].deadmin")) returned 1 [0064.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0064.769] GetLastError () returned 0x0 [0064.769] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.769] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0064.769] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0064.769] WriteFile (in: hFile=0x120, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0064.770] CloseHandle (hObject=0x120) returned 1 [0064.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e8648 | out: hHeap=0x260000) returned 1 [0064.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0064.771] RtlWakeConditionVariable () returned 0x27e828 [0064.771] GetCurrentThreadId () returned 0x9ac [0064.771] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.848] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.848] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0064.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0064.848] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18484935724) returned 1 [0064.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb575fe10, dwHighDateTime=0x1d585b4)) [0064.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0064.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0064.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0064.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ed8 [0064.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ed8 | out: hHeap=0x260000) returned 1 [0064.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323930 [0064.849] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.849] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.849] GetLastError () returned 0x0 [0064.849] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.849] GetLastError () returned 0x0 [0064.856] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.856] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0064.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.857] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.859] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.859] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.859] CloseHandle (hObject=0x120) returned 1 [0064.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0064.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.[deadmin@cock.li].deadmin")) returned 1 [0064.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0064.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0064.865] GetLastError () returned 0x0 [0064.868] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.869] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.869] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.869] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18487007862) returned 1 [0064.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb57ac0d0, dwHighDateTime=0x1d585b4)) [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d80d0 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d80d0 | out: hHeap=0x260000) returned 1 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3239c8 [0064.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.870] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.870] GetLastError () returned 0x0 [0064.870] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.870] GetLastError () returned 0x0 [0064.872] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff7cf6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.872] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x830a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x830a, lpOverlapped=0x0) returned 1 [0064.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.873] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.873] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.873] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.873] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.874] CloseHandle (hObject=0x120) returned 1 [0064.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bcd60 [0064.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bcd60 | out: hHeap=0x260000) returned 1 [0064.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.875] GetLastError () returned 0x0 [0064.875] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.876] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0064.876] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0064.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.876] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18487760892) returned 1 [0064.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb57ac0d0, dwHighDateTime=0x1d585b4)) [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d9b0 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d9b0 | out: hHeap=0x260000) returned 1 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323768 [0064.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.877] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.877] GetLastError () returned 0x0 [0064.877] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.878] GetLastError () returned 0x0 [0064.894] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffa126, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.894] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x5eda, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x5eda, lpOverlapped=0x0) returned 1 [0064.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.895] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.895] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.895] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.895] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.896] CloseHandle (hObject=0x120) returned 1 [0064.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.897] GetLastError () returned 0x0 [0064.898] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.899] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0064.899] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.899] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18489995566) returned 1 [0064.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb57f8390, dwHighDateTime=0x1d585b4)) [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e90c0 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e90c0 | out: hHeap=0x260000) returned 1 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322c20 [0064.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.900] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.900] GetLastError () returned 0x0 [0064.900] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.900] GetLastError () returned 0x0 [0064.902] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffdf98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.902] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x2068, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x2068, lpOverlapped=0x0) returned 1 [0064.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.903] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.903] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.903] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.904] CloseHandle (hObject=0x120) returned 1 [0064.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0064.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.[deadmin@cock.li].deadmin")) returned 1 [0064.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0064.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0064.905] GetLastError () returned 0x0 [0064.905] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0064.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0064.906] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0064.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0064.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0064.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0064.906] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18490751575) returned 1 [0064.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb57f8390, dwHighDateTime=0x1d585b4)) [0064.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e90f8 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0064.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e90f8 | out: hHeap=0x260000) returned 1 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0064.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0064.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0064.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323470 [0064.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0064.907] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0064.907] GetLastError () returned 0x0 [0064.907] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0064.907] GetLastError () returned 0x0 [0064.931] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffe26c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.931] WriteFile (in: hFile=0x120, lpBuffer=0x2850048*, nNumberOfBytesToWrite=0x1d94, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2850048*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d94, lpOverlapped=0x0) returned 1 [0064.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2850048 | out: hHeap=0x260000) returned 1 [0064.934] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.934] WriteFile (in: hFile=0x120, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0064.935] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0064.935] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0064.935] CloseHandle (hObject=0x120) returned 1 [0065.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27bcd60 [0065.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27bcd60 | out: hHeap=0x260000) returned 1 [0065.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0065.112] GetLastError () returned 0x0 [0065.118] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.119] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.119] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0065.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0065.119] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18512037071) returned 1 [0065.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5a0d6d0, dwHighDateTime=0x1d585b4)) [0065.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0065.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0065.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0065.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9280 [0065.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0065.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9280 | out: hHeap=0x260000) returned 1 [0065.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0065.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3233d8 [0065.120] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.120] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.120] GetLastError () returned 0x0 [0065.120] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.121] GetLastError () returned 0x0 [0065.288] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe4c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.288] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1b3a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b3a, lpOverlapped=0x0) returned 1 [0065.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.290] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.290] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.293] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.293] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.294] CloseHandle (hObject=0xfc) returned 1 [0065.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.295] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0065.295] GetLastError () returned 0x0 [0065.388] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.389] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.389] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.389] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18539011477) returned 1 [0065.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5c94e30, dwHighDateTime=0x1d585b4)) [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8cf8 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8cf8 | out: hHeap=0x260000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.389] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354730 [0065.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.390] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.390] GetLastError () returned 0x0 [0065.390] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.390] GetLastError () returned 0x0 [0065.403] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd8a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.404] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x275c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x275c, lpOverlapped=0x0) returned 1 [0065.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.404] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.404] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.405] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.405] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.405] CloseHandle (hObject=0xa4) returned 1 [0065.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.414] GetLastError () returned 0x0 [0065.414] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.415] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.415] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.415] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18541602352) returned 1 [0065.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5ce10f0, dwHighDateTime=0x1d585b4)) [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8c88 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8c88 | out: hHeap=0x260000) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.415] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3547c8 [0065.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.416] GetLastError () returned 0x0 [0065.416] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.416] GetLastError () returned 0x0 [0065.428] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffe80e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.428] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x17f2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x17f2, lpOverlapped=0x0) returned 1 [0065.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.429] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.429] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.429] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.429] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.430] CloseHandle (hObject=0xa4) returned 1 [0065.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.456] GetLastError () returned 0x0 [0065.457] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.457] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.457] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.458] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18545895212) returned 1 [0065.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5d53510, dwHighDateTime=0x1d585b4)) [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9590 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9590 | out: hHeap=0x260000) returned 1 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354990 [0065.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.459] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.459] GetLastError () returned 0x0 [0065.459] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.459] GetLastError () returned 0x0 [0065.472] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffdb72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.472] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x248e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x248e, lpOverlapped=0x0) returned 1 [0065.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.473] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.473] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.474] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.474] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.474] CloseHandle (hObject=0xa4) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.476] GetLastError () returned 0x0 [0065.476] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0065.477] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0065.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.477] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18547861139) returned 1 [0065.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5d79670, dwHighDateTime=0x1d585b4)) [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9638 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9638 | out: hHeap=0x260000) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354b58 [0065.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.478] GetLastError () returned 0x0 [0065.478] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.479] GetLastError () returned 0x0 [0065.489] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff9746, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.489] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x68ba, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x68ba, lpOverlapped=0x0) returned 1 [0065.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.490] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.490] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.491] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.491] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.491] CloseHandle (hObject=0xa4) returned 1 [0065.492] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.[deadmin@cock.li].deadmin")) returned 1 [0065.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.506] GetLastError () returned 0x0 [0065.506] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.507] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.507] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18550891448) returned 1 [0065.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5dc5930, dwHighDateTime=0x1d585b4)) [0065.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9670 [0065.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9670 | out: hHeap=0x260000) returned 1 [0065.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354d20 [0065.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.516] GetLastError () returned 0x0 [0065.516] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.516] GetLastError () returned 0x0 [0065.519] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffe2c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.519] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x1d3a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x1d3a, lpOverlapped=0x0) returned 1 [0065.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.519] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.519] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.520] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.520] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.521] CloseHandle (hObject=0xa4) returned 1 [0065.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2895c38 [0065.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2895c38 | out: hHeap=0x260000) returned 1 [0065.524] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.524] GetLastError () returned 0x0 [0065.524] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.525] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.525] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.525] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18552597605) returned 1 [0065.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5deba90, dwHighDateTime=0x1d585b4)) [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e96a8 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e96a8 | out: hHeap=0x260000) returned 1 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.525] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354db8 [0065.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.526] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.526] GetLastError () returned 0x0 [0065.526] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.526] GetLastError () returned 0x0 [0065.530] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffcec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.530] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x3138, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x3138, lpOverlapped=0x0) returned 1 [0065.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.530] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.531] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.531] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.531] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.532] CloseHandle (hObject=0xa4) returned 1 [0065.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.533] GetLastError () returned 0x0 [0065.534] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.534] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.534] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.535] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18553580988) returned 1 [0065.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5deba90, dwHighDateTime=0x1d585b4)) [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9718 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9718 | out: hHeap=0x260000) returned 1 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354e50 [0065.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.535] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.536] GetLastError () returned 0x0 [0065.536] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.536] GetLastError () returned 0x0 [0065.537] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffa288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.537] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x5d78, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x5d78, lpOverlapped=0x0) returned 1 [0065.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.538] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.538] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.538] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.538] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.539] CloseHandle (hObject=0xa4) returned 1 [0065.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.540] GetLastError () returned 0x0 [0065.541] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.541] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.542] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.542] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18554285363) returned 1 [0065.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5e11bf0, dwHighDateTime=0x1d585b4)) [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9750 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9750 | out: hHeap=0x260000) returned 1 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x354f80 [0065.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.542] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.543] GetLastError () returned 0x0 [0065.543] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.543] GetLastError () returned 0x0 [0065.547] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd23c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.547] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x2dc4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x2dc4, lpOverlapped=0x0) returned 1 [0065.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.548] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.548] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.554] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.554] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.554] CloseHandle (hObject=0xa4) returned 1 [0065.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.554] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.556] GetLastError () returned 0x0 [0065.556] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.557] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.557] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.557] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18555796443) returned 1 [0065.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5e37d50, dwHighDateTime=0x1d585b4)) [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9788 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9788 | out: hHeap=0x260000) returned 1 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355018 [0065.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.558] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.558] GetLastError () returned 0x0 [0065.558] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.558] GetLastError () returned 0x0 [0065.642] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffe516, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.642] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x1aea, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x1aea, lpOverlapped=0x0) returned 1 [0065.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.643] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.643] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.644] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.644] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.644] CloseHandle (hObject=0xa4) returned 1 [0065.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.646] GetLastError () returned 0x0 [0065.647] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.647] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.647] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.647] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18564888114) returned 1 [0065.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5f1c590, dwHighDateTime=0x1d585b4)) [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e99b8 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e99b8 | out: hHeap=0x260000) returned 1 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x322cb8 [0065.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.648] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.649] GetLastError () returned 0x0 [0065.649] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.649] GetLastError () returned 0x0 [0065.650] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff7f08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.651] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x80f8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x80f8, lpOverlapped=0x0) returned 1 [0065.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.655] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.655] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.656] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.656] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.657] CloseHandle (hObject=0xa4) returned 1 [0065.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.658] GetLastError () returned 0x0 [0065.659] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.659] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.660] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.660] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18566085938) returned 1 [0065.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5f1c590, dwHighDateTime=0x1d585b4)) [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e99f0 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e99f0 | out: hHeap=0x260000) returned 1 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324050 [0065.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.660] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.661] GetLastError () returned 0x0 [0065.661] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.661] GetLastError () returned 0x0 [0065.663] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff99ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.663] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x6632, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x6632, lpOverlapped=0x0) returned 1 [0065.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.664] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.664] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.665] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.665] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.665] CloseHandle (hObject=0xa4) returned 1 [0065.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.666] GetLastError () returned 0x0 [0065.667] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.668] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.668] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18566885558) returned 1 [0065.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5f426f0, dwHighDateTime=0x1d585b4)) [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9a28 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9a28 | out: hHeap=0x260000) returned 1 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323fb8 [0065.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.669] GetLastError () returned 0x0 [0065.669] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.669] GetLastError () returned 0x0 [0065.670] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffff5782, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.670] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xa87e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xa87e, lpOverlapped=0x0) returned 1 [0065.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.671] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.671] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.672] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.672] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.672] CloseHandle (hObject=0xa4) returned 1 [0065.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.672] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.674] GetLastError () returned 0x0 [0065.674] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.675] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.675] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.675] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18567645622) returned 1 [0065.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5f426f0, dwHighDateTime=0x1d585b4)) [0065.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9a60 [0065.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9a60 | out: hHeap=0x260000) returned 1 [0065.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323638 [0065.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.676] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.676] GetLastError () returned 0x0 [0065.676] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.677] GetLastError () returned 0x0 [0065.679] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd812, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.679] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x27ee, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x27ee, lpOverlapped=0x0) returned 1 [0065.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.680] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.680] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.680] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.681] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.681] CloseHandle (hObject=0xa4) returned 1 [0065.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.683] GetLastError () returned 0x0 [0065.683] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.684] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.684] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.684] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18568522178) returned 1 [0065.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb5f68850, dwHighDateTime=0x1d585b4)) [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9a98 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9a98 | out: hHeap=0x260000) returned 1 [0065.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323df0 [0065.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.685] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.685] GetLastError () returned 0x0 [0065.685] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.685] GetLastError () returned 0x0 [0065.742] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffff2b1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.742] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xd4f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xd4f, lpOverlapped=0x0) returned 1 [0065.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.743] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.743] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.774] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.775] CloseHandle (hObject=0xa4) returned 1 [0065.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.[deadmin@cock.li].deadmin")) returned 1 [0065.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0065.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.777] GetLastError () returned 0x0 [0065.777] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.778] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.778] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.778] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18577922644) returned 1 [0065.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb604d090, dwHighDateTime=0x1d585b4)) [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9c90 [0065.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9c90 | out: hHeap=0x260000) returned 1 [0065.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355900 [0065.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.779] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.779] GetLastError () returned 0x0 [0065.779] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.779] GetLastError () returned 0x0 [0065.799] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffb006, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.799] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x4ffa, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ffa, lpOverlapped=0x0) returned 1 [0065.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0065.808] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.808] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.809] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.809] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.809] CloseHandle (hObject=0xa4) returned 1 [0065.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.819] GetLastError () returned 0x0 [0065.857] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.858] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.858] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18585903065) returned 1 [0065.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb610b770, dwHighDateTime=0x1d585b4)) [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9e18 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9e18 | out: hHeap=0x260000) returned 1 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355bf8 [0065.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.859] GetLastError () returned 0x0 [0065.859] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.859] GetLastError () returned 0x0 [0065.867] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffdbb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.867] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2448, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x2448, lpOverlapped=0x0) returned 1 [0065.868] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0065.868] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.868] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.873] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.873] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.874] CloseHandle (hObject=0xa4) returned 1 [0065.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.907] GetLastError () returned 0x0 [0065.908] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0065.908] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0065.908] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0065.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0065.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.909] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18590969875) returned 1 [0065.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb617db90, dwHighDateTime=0x1d585b4)) [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9f30 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9f30 | out: hHeap=0x260000) returned 1 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355e58 [0065.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.909] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.909] GetLastError () returned 0x0 [0065.910] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.910] GetLastError () returned 0x0 [0065.929] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffff8eb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.929] WriteFile (in: hFile=0x120, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x7148, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x7148, lpOverlapped=0x0) returned 1 [0065.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.930] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.930] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.931] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.931] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.931] CloseHandle (hObject=0x120) returned 1 [0065.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0065.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.[deadmin@cock.li].deadmin")) returned 1 [0065.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0065.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0065.932] GetLastError () returned 0x0 [0065.933] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2898428) returned 1 [0065.933] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0065.933] CryptReleaseContext (hProv=0x2898428, dwFlags=0x0) returned 1 [0065.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0065.934] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18593479678) returned 1 [0065.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb61c9e50, dwHighDateTime=0x1d585b4)) [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e9fa0 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0065.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e9fa0 | out: hHeap=0x260000) returned 1 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0065.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0065.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0065.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x355f88 [0065.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0065.934] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0065.935] GetLastError () returned 0x0 [0065.935] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0065.935] GetLastError () returned 0x0 [0065.997] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffff668, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.997] WriteFile (in: hFile=0x120, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x998, lpOverlapped=0x0) returned 1 [0065.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0065.998] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.998] WriteFile (in: hFile=0x120, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0065.999] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0065.999] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0065.999] CloseHandle (hObject=0x120) returned 1 [0065.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0065.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.098] GetLastError () returned 0x0 [0066.113] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.113] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.114] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.114] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18611485865) returned 1 [0066.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6392ed0, dwHighDateTime=0x1d585b4)) [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28ed120 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28ed120 | out: hHeap=0x260000) returned 1 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3560b8 [0066.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.114] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.115] GetLastError () returned 0x0 [0066.115] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.115] GetLastError () returned 0x0 [0066.118] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe65a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.118] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19a6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x19a6, lpOverlapped=0x0) returned 1 [0066.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.119] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.119] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.120] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.120] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.120] CloseHandle (hObject=0x104) returned 1 [0066.120] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6860 [0066.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6860 | out: hHeap=0x260000) returned 1 [0066.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.122] GetLastError () returned 0x0 [0066.122] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.123] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.123] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.123] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18612407706) returned 1 [0066.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6392ed0, dwHighDateTime=0x1d585b4)) [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea2b0 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea2b0 | out: hHeap=0x260000) returned 1 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.123] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356870 [0066.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.124] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.124] GetLastError () returned 0x0 [0066.124] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.124] GetLastError () returned 0x0 [0066.154] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffe9c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.154] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x163c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x163c, lpOverlapped=0x0) returned 1 [0066.155] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.155] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.155] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.156] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.157] CloseHandle (hObject=0x104) returned 1 [0066.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.159] GetLastError () returned 0x0 [0066.159] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.160] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.160] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.160] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18616138147) returned 1 [0066.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb64052f0, dwHighDateTime=0x1d585b4)) [0066.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea3c8 [0066.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea3c8 | out: hHeap=0x260000) returned 1 [0066.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356908 [0066.161] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.161] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.161] GetLastError () returned 0x0 [0066.162] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.162] GetLastError () returned 0x0 [0066.179] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffcb9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.179] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x3465, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x3465, lpOverlapped=0x0) returned 1 [0066.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.180] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.180] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.181] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.181] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.181] CloseHandle (hObject=0x104) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.181] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.[deadmin@cock.li].deadmin")) returned 1 [0066.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.182] GetLastError () returned 0x0 [0066.183] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2898428) returned 1 [0066.183] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0066.183] CryptReleaseContext (hProv=0x2898428, dwFlags=0x0) returned 1 [0066.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.184] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18618481643) returned 1 [0066.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb642b450, dwHighDateTime=0x1d585b4)) [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea470 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea470 | out: hHeap=0x260000) returned 1 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356c00 [0066.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.184] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.185] GetLastError () returned 0x0 [0066.185] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.185] GetLastError () returned 0x0 [0066.187] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffd028, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.187] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x2fd8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x2fd8, lpOverlapped=0x0) returned 1 [0066.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.188] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.188] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.188] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.189] CloseHandle (hObject=0x104) returned 1 [0066.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.190] GetLastError () returned 0x0 [0066.191] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.217] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.217] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18621799098) returned 1 [0066.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6477710, dwHighDateTime=0x1d585b4)) [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea4a8 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea4a8 | out: hHeap=0x260000) returned 1 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0066.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356ad0 [0066.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0066.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.218] GetLastError () returned 0x0 [0066.218] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.218] GetLastError () returned 0x0 [0066.220] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffddb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.220] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x224e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x224e, lpOverlapped=0x0) returned 1 [0066.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.221] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.221] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.222] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.222] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.222] CloseHandle (hObject=0x104) returned 1 [0066.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.224] GetLastError () returned 0x0 [0066.224] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.225] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.225] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.225] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18622615241) returned 1 [0066.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb649d870, dwHighDateTime=0x1d585b4)) [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea588 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea588 | out: hHeap=0x260000) returned 1 [0066.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0066.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x356e60 [0066.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0066.226] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.226] GetLastError () returned 0x0 [0066.226] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.226] GetLastError () returned 0x0 [0066.234] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffda3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.235] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x25c1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x25c1, lpOverlapped=0x0) returned 1 [0066.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.235] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.235] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.236] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.236] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.236] CloseHandle (hObject=0x104) returned 1 [0066.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.[deadmin@cock.li].deadmin")) returned 1 [0066.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.238] GetLastError () returned 0x0 [0066.239] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.239] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.239] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.240] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18624074901) returned 1 [0066.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb64c39d0, dwHighDateTime=0x1d585b4)) [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea5f8 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea5f8 | out: hHeap=0x260000) returned 1 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d0df8 [0066.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3570c0 [0066.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d0df8 | out: hHeap=0x260000) returned 1 [0066.240] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.240] GetLastError () returned 0x0 [0066.241] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.241] GetLastError () returned 0x0 [0066.274] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffa510, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.275] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x5af0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x5af0, lpOverlapped=0x0) returned 1 [0066.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.276] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.277] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.277] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.277] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.278] CloseHandle (hObject=0x104) returned 1 [0066.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.279] GetLastError () returned 0x0 [0066.280] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.281] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.281] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.281] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18628249628) returned 1 [0066.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb650fc90, dwHighDateTime=0x1d585b4)) [0066.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea6a0 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea6a0 | out: hHeap=0x260000) returned 1 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31f800 [0066.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.282] GetLastError () returned 0x0 [0066.282] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.282] GetLastError () returned 0x0 [0066.298] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffffae98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.298] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x5168, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x5168, lpOverlapped=0x0) returned 1 [0066.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.298] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.299] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.299] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.299] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.300] CloseHandle (hObject=0x104) returned 1 [0066.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.301] GetLastError () returned 0x0 [0066.302] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.302] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.302] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.303] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18630382789) returned 1 [0066.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb655bf50, dwHighDateTime=0x1d585b4)) [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea748 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea748 | out: hHeap=0x260000) returned 1 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0066.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x31fc28 [0066.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0066.303] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.304] GetLastError () returned 0x0 [0066.304] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.304] GetLastError () returned 0x0 [0066.349] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xffff3166, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.349] WriteFile (in: hFile=0x104, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xce9a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0xce9a, lpOverlapped=0x0) returned 1 [0066.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0066.351] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.351] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.352] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.352] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.352] CloseHandle (hObject=0x104) returned 1 [0066.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0066.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0066.354] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.354] GetLastError () returned 0x0 [0066.354] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.355] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.355] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.355] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18635637531) returned 1 [0066.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb65ce370, dwHighDateTime=0x1d585b4)) [0066.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326d90 [0066.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326d90 | out: hHeap=0x260000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x28d3558 [0066.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323f20 [0066.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28d3558 | out: hHeap=0x260000) returned 1 [0066.356] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.356] GetLastError () returned 0x0 [0066.356] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.356] GetLastError () returned 0x0 [0066.388] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff3a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.388] WriteFile (in: hFile=0x104, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xc5e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xc5e, lpOverlapped=0x0) returned 1 [0066.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.388] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.388] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.389] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.389] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.389] CloseHandle (hObject=0x104) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.391] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.391] GetLastError () returned 0x0 [0066.392] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.392] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.392] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.393] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18639379391) returned 1 [0066.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb661a630, dwHighDateTime=0x1d585b4)) [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326c78 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326c78 | out: hHeap=0x260000) returned 1 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b340 [0066.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b340 | out: hHeap=0x260000) returned 1 [0066.393] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.394] GetLastError () returned 0x0 [0066.394] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.394] GetLastError () returned 0x0 [0066.396] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff66c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.396] WriteFile (in: hFile=0x104, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x994, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x994, lpOverlapped=0x0) returned 1 [0066.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.396] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.396] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.397] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.397] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.397] CloseHandle (hObject=0x104) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.399] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.399] GetLastError () returned 0x0 [0066.399] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.400] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.400] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.400] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18640268911) returned 1 [0066.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6640790, dwHighDateTime=0x1d585b4)) [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326c40 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326c40 | out: hHeap=0x260000) returned 1 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b688 [0066.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b688 | out: hHeap=0x260000) returned 1 [0066.403] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.403] GetLastError () returned 0x0 [0066.403] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.403] GetLastError () returned 0x0 [0066.411] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffff362, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.411] WriteFile (in: hFile=0x104, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xc9e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xc9e, lpOverlapped=0x0) returned 1 [0066.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0066.412] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.412] WriteFile (in: hFile=0x104, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.412] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.412] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.413] CloseHandle (hObject=0x104) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x284a0a8 [0066.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284a0a8 | out: hHeap=0x260000) returned 1 [0066.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.425] GetLastError () returned 0x0 [0066.426] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.426] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.426] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.427] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18642773167) returned 1 [0066.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb668ca50, dwHighDateTime=0x1d585b4)) [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326b98 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326b98 | out: hHeap=0x260000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b730 [0066.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b730 | out: hHeap=0x260000) returned 1 [0066.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.427] GetLastError () returned 0x0 [0066.428] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.428] GetLastError () returned 0x0 [0066.489] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff222, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.489] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xdde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xdde, lpOverlapped=0x0) returned 1 [0066.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.490] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.490] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.491] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.491] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.491] CloseHandle (hObject=0x118) returned 1 [0066.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x284a0a8 [0066.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284a0a8 | out: hHeap=0x260000) returned 1 [0066.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.493] GetLastError () returned 0x0 [0066.493] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.494] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.494] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.494] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18649492312) returned 1 [0066.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6724fd0, dwHighDateTime=0x1d585b4)) [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea898 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea898 | out: hHeap=0x260000) returned 1 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x334dc0 [0066.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x334dc0 | out: hHeap=0x260000) returned 1 [0066.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.495] GetLastError () returned 0x0 [0066.495] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.495] GetLastError () returned 0x0 [0066.525] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff7de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.525] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x822, lpOverlapped=0x0) returned 1 [0066.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.526] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.526] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.527] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.527] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.527] CloseHandle (hObject=0x118) returned 1 [0066.527] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.528] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.529] GetLastError () returned 0x0 [0066.529] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.530] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0066.530] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.530] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18653217747) returned 1 [0066.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6771290, dwHighDateTime=0x1d585b4)) [0066.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27ea9b0 [0066.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5fd8 [0066.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ea9b0 | out: hHeap=0x260000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5fd8 | out: hHeap=0x260000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335108 [0066.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335108 | out: hHeap=0x260000) returned 1 [0066.532] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.532] GetLastError () returned 0x0 [0066.532] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.532] GetLastError () returned 0x0 [0066.560] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffe4d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.560] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x1b28, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b28, lpOverlapped=0x0) returned 1 [0066.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.561] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.561] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.562] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.562] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.562] CloseHandle (hObject=0x118) returned 1 [0066.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.564] GetLastError () returned 0x0 [0066.564] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x28985c0) returned 1 [0066.564] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.565] CryptReleaseContext (hProv=0x28985c0, dwFlags=0x0) returned 1 [0066.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.565] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18656585634) returned 1 [0066.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb67bd550, dwHighDateTime=0x1d585b4)) [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaa90 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaa90 | out: hHeap=0x260000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335450 [0066.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335450 | out: hHeap=0x260000) returned 1 [0066.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.566] GetLastError () returned 0x0 [0066.566] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.566] GetLastError () returned 0x0 [0066.616] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffc2a4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.616] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3d5c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x3d5c, lpOverlapped=0x0) returned 1 [0066.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.617] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.617] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.617] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.617] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.618] CloseHandle (hObject=0x118) returned 1 [0066.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.619] GetLastError () returned 0x0 [0066.620] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.620] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.620] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.621] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18662331259) returned 1 [0066.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6855ad0, dwHighDateTime=0x1d585b4)) [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3272d0 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3272d0 | out: hHeap=0x260000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3356f0 [0066.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3356f0 | out: hHeap=0x260000) returned 1 [0066.623] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.623] GetLastError () returned 0x0 [0066.623] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.623] GetLastError () returned 0x0 [0066.649] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xfffff8da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.649] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x726, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x726, lpOverlapped=0x0) returned 1 [0066.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.650] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.650] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.650] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.650] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.651] CloseHandle (hObject=0x118) returned 1 [0066.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.652] GetLastError () returned 0x0 [0066.652] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.653] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.653] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.653] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18665451672) returned 1 [0066.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb68a1d90, dwHighDateTime=0x1d585b4)) [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327228 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2d5f88 [0066.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327228 | out: hHeap=0x260000) returned 1 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5f88 | out: hHeap=0x260000) returned 1 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335990 [0066.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335990 | out: hHeap=0x260000) returned 1 [0066.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.654] GetLastError () returned 0x0 [0066.654] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.654] GetLastError () returned 0x0 [0066.737] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xffffdec4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.737] WriteFile (in: hFile=0x118, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x213c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x213c, lpOverlapped=0x0) returned 1 [0066.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.740] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.740] WriteFile (in: hFile=0x118, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.740] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.740] WriteFile (in: hFile=0x118, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.741] CloseHandle (hObject=0x118) returned 1 [0066.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f42d0 [0066.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f42d0 | out: hHeap=0x260000) returned 1 [0066.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.747] GetLastError () returned 0x0 [0066.747] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.748] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.748] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.748] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18674896153) returned 1 [0066.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb69865d0, dwHighDateTime=0x1d585b4)) [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327030 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327030 | out: hHeap=0x260000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x335c30 [0066.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x335c30 | out: hHeap=0x260000) returned 1 [0066.749] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.749] GetLastError () returned 0x0 [0066.749] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.749] GetLastError () returned 0x0 [0066.809] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.809] WriteFile (in: hFile=0x11c, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x724, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x724, lpOverlapped=0x0) returned 1 [0066.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0066.810] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.810] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.810] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.810] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.811] CloseHandle (hObject=0x11c) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27f3e10 [0066.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f3e10 | out: hHeap=0x260000) returned 1 [0066.841] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.841] GetLastError () returned 0x0 [0066.841] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.842] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.842] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.842] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18684349862) returned 1 [0066.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6a6ae10, dwHighDateTime=0x1d585b4)) [0066.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x326f18 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x326f18 | out: hHeap=0x260000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3362c0 [0066.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3362c0 | out: hHeap=0x260000) returned 1 [0066.843] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.843] GetLastError () returned 0x0 [0066.843] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.843] GetLastError () returned 0x0 [0066.902] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.902] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x73c, lpOverlapped=0x0) returned 1 [0066.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0066.903] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.903] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0066.904] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0066.904] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0066.905] CloseHandle (hObject=0x11c) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0066.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0066.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0066.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0066.911] GetLastError () returned 0x0 [0066.912] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0066.913] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0066.913] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0066.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0066.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0066.913] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18691428577) returned 1 [0066.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6b294f0, dwHighDateTime=0x1d585b4)) [0066.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0066.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0066.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0066.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaba8 [0066.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0066.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaba8 | out: hHeap=0x260000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0066.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x336608 [0066.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0066.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x336608 | out: hHeap=0x260000) returned 1 [0066.914] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0066.914] GetLastError () returned 0x0 [0066.914] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0066.915] GetLastError () returned 0x0 [0067.012] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff6c3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.014] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x93c4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x93c4, lpOverlapped=0x0) returned 1 [0067.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.027] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.027] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.028] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.028] CloseHandle (hObject=0x11c) returned 1 [0067.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.041] GetLastError () returned 0x0 [0067.041] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.042] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.042] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18704323581) returned 1 [0067.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6c59ff0, dwHighDateTime=0x1d585b4)) [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327650 [0067.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327650 | out: hHeap=0x260000) returned 1 [0067.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x354560 [0067.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x354560 | out: hHeap=0x260000) returned 1 [0067.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.043] GetLastError () returned 0x0 [0067.043] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.043] GetLastError () returned 0x0 [0067.098] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff298, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.098] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xd68, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xd68, lpOverlapped=0x0) returned 1 [0067.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.099] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.099] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.099] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.099] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.100] CloseHandle (hObject=0x11c) returned 1 [0067.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.101] GetLastError () returned 0x0 [0067.102] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.103] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.103] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.103] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18710424107) returned 1 [0067.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6cf2570, dwHighDateTime=0x1d585b4)) [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3275a8 [0067.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3275a8 | out: hHeap=0x260000) returned 1 [0067.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be2f8 [0067.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be2f8 | out: hHeap=0x260000) returned 1 [0067.104] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.104] GetLastError () returned 0x0 [0067.104] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.104] GetLastError () returned 0x0 [0067.127] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffebd2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.127] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x142e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x142e, lpOverlapped=0x0) returned 1 [0067.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.128] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.128] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.128] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.128] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.129] CloseHandle (hObject=0x11c) returned 1 [0067.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.130] GetLastError () returned 0x0 [0067.131] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.131] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.131] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.131] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.131] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18713262557) returned 1 [0067.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6d3e830, dwHighDateTime=0x1d585b4)) [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327500 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327500 | out: hHeap=0x260000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be4f0 [0067.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.132] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be4f0 | out: hHeap=0x260000) returned 1 [0067.132] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.132] GetLastError () returned 0x0 [0067.132] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.133] GetLastError () returned 0x0 [0067.147] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff954, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.147] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x6ac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x6ac, lpOverlapped=0x0) returned 1 [0067.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.147] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.147] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.148] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.148] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.148] CloseHandle (hObject=0x11c) returned 1 [0067.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.150] GetLastError () returned 0x0 [0067.150] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.151] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.151] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.151] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18715234744) returned 1 [0067.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6d64990, dwHighDateTime=0x1d585b4)) [0067.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327490 [0067.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327490 | out: hHeap=0x260000) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be6e8 [0067.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be6e8 | out: hHeap=0x260000) returned 1 [0067.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.152] GetLastError () returned 0x0 [0067.152] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.152] GetLastError () returned 0x0 [0067.171] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff7de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.171] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x822, lpOverlapped=0x0) returned 1 [0067.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.172] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.172] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.172] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.172] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.176] CloseHandle (hObject=0x11c) returned 1 [0067.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf.[deadmin@cock.li].deadmin")) returned 1 [0067.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.177] GetLastError () returned 0x0 [0067.178] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.179] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.179] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.179] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18717991513) returned 1 [0067.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6db0c50, dwHighDateTime=0x1d585b4)) [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327a08 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327a08 | out: hHeap=0x260000) returned 1 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2be838 [0067.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2be838 | out: hHeap=0x260000) returned 1 [0067.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.180] GetLastError () returned 0x0 [0067.180] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.180] GetLastError () returned 0x0 [0067.181] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.181] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xf0, lpOverlapped=0x0) returned 1 [0067.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.181] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.181] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.182] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.182] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.183] CloseHandle (hObject=0x11c) returned 1 [0067.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.184] GetLastError () returned 0x0 [0067.184] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.185] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.185] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.185] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18718644041) returned 1 [0067.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6db0c50, dwHighDateTime=0x1d585b4)) [0067.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3279d0 [0067.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3279d0 | out: hHeap=0x260000) returned 1 [0067.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bead8 [0067.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bead8 | out: hHeap=0x260000) returned 1 [0067.186] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.186] GetLastError () returned 0x0 [0067.186] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.186] GetLastError () returned 0x0 [0067.187] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.187] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xea, lpOverlapped=0x0) returned 1 [0067.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.188] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.188] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.188] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.189] CloseHandle (hObject=0x11c) returned 1 [0067.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.192] GetLastError () returned 0x0 [0067.193] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.194] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.194] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.194] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18719507048) returned 1 [0067.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6dd6db0, dwHighDateTime=0x1d585b4)) [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327998 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327998 | out: hHeap=0x260000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2beb80 [0067.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2beb80 | out: hHeap=0x260000) returned 1 [0067.195] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.195] GetLastError () returned 0x0 [0067.195] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.195] GetLastError () returned 0x0 [0067.196] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.196] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x297, lpOverlapped=0x0) returned 1 [0067.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.197] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.197] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.197] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.197] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.198] CloseHandle (hObject=0x11c) returned 1 [0067.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.201] GetLastError () returned 0x0 [0067.201] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.202] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.202] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.202] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.202] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18720329387) returned 1 [0067.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6dd6db0, dwHighDateTime=0x1d585b4)) [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327960 [0067.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327960 | out: hHeap=0x260000) returned 1 [0067.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bec28 [0067.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bec28 | out: hHeap=0x260000) returned 1 [0067.203] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.203] GetLastError () returned 0x0 [0067.203] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.203] GetLastError () returned 0x0 [0067.204] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.204] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0067.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0067.205] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.205] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.205] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.206] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.206] CloseHandle (hObject=0x11c) returned 1 [0067.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.260] GetLastError () returned 0x0 [0067.261] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.262] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.262] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.262] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18726327281) returned 1 [0067.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6e6f330, dwHighDateTime=0x1d585b4)) [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x327810 [0067.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x327810 | out: hHeap=0x260000) returned 1 [0067.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2becd0 [0067.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.263] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.263] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2becd0 | out: hHeap=0x260000) returned 1 [0067.263] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.263] GetLastError () returned 0x0 [0067.263] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.263] GetLastError () returned 0x0 [0067.266] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffb99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.266] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x467, lpOverlapped=0x0) returned 1 [0067.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.267] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.267] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.268] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.268] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.268] CloseHandle (hObject=0x11c) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.269] GetLastError () returned 0x0 [0067.270] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.271] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.271] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.271] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18727231927) returned 1 [0067.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6e95490, dwHighDateTime=0x1d585b4)) [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3277d8 [0067.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3277d8 | out: hHeap=0x260000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf0c0 [0067.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.272] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf0c0 | out: hHeap=0x260000) returned 1 [0067.272] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.272] GetLastError () returned 0x0 [0067.272] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.272] GetLastError () returned 0x0 [0067.273] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffec5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.273] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x13b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x13b, lpOverlapped=0x0) returned 1 [0067.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.274] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.274] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.274] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.274] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.275] CloseHandle (hObject=0x11c) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f4480 [0067.275] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f4480 | out: hHeap=0x260000) returned 1 [0067.277] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.277] GetLastError () returned 0x0 [0067.278] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.278] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.278] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.279] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18727979663) returned 1 [0067.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb6e95490, dwHighDateTime=0x1d585b4)) [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3277a0 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3277a0 | out: hHeap=0x260000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf168 [0067.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf168 | out: hHeap=0x260000) returned 1 [0067.279] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.280] GetLastError () returned 0x0 [0067.280] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.280] GetLastError () returned 0x0 [0067.281] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffefb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.281] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x105, lpOverlapped=0x0) returned 1 [0067.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.281] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.281] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.282] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.282] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.283] CloseHandle (hObject=0x11c) returned 1 [0067.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.443] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.444] GetLastError () returned 0x0 [0067.444] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.445] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.445] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18744640146) returned 1 [0067.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb70383b0, dwHighDateTime=0x1d585b4)) [0067.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaf28 [0067.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaf28 | out: hHeap=0x260000) returned 1 [0067.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bf210 [0067.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bf210 | out: hHeap=0x260000) returned 1 [0067.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.446] GetLastError () returned 0x0 [0067.446] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.446] GetLastError () returned 0x0 [0067.447] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffef5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.447] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x10b, lpOverlapped=0x0) returned 1 [0067.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.448] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.448] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.448] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.449] CloseHandle (hObject=0xfc) returned 1 [0067.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.450] GetLastError () returned 0x0 [0067.451] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.451] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.452] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.452] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18745283334) returned 1 [0067.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb70383b0, dwHighDateTime=0x1d585b4)) [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaf60 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaf60 | out: hHeap=0x260000) returned 1 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bfd38 [0067.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bfd38 | out: hHeap=0x260000) returned 1 [0067.452] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.453] GetLastError () returned 0x0 [0067.453] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.453] GetLastError () returned 0x0 [0067.454] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.454] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0067.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.454] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.454] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.455] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.455] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.456] CloseHandle (hObject=0xfc) returned 1 [0067.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.458] GetLastError () returned 0x0 [0067.458] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.459] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.459] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18746009416) returned 1 [0067.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb705e510, dwHighDateTime=0x1d585b4)) [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eaf98 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eaf98 | out: hHeap=0x260000) returned 1 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bfde0 [0067.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bfde0 | out: hHeap=0x260000) returned 1 [0067.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.460] GetLastError () returned 0x0 [0067.460] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.460] GetLastError () returned 0x0 [0067.461] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.461] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xce, lpOverlapped=0x0) returned 1 [0067.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.462] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.462] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.462] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.462] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.463] CloseHandle (hObject=0xfc) returned 1 [0067.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.464] GetLastError () returned 0x0 [0067.464] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.465] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.465] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.465] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18746653543) returned 1 [0067.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb705e510, dwHighDateTime=0x1d585b4)) [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eafd0 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eafd0 | out: hHeap=0x260000) returned 1 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bfe88 [0067.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bfe88 | out: hHeap=0x260000) returned 1 [0067.466] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.466] GetLastError () returned 0x0 [0067.466] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.466] GetLastError () returned 0x0 [0067.467] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.467] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0067.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.468] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.468] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.469] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.469] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.469] CloseHandle (hObject=0xfc) returned 1 [0067.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.471] GetLastError () returned 0x0 [0067.472] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x29061a8) returned 1 [0067.473] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.473] CryptReleaseContext (hProv=0x29061a8, dwFlags=0x0) returned 1 [0067.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.473] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18747416347) returned 1 [0067.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7084670, dwHighDateTime=0x1d585b4)) [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337b68 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337b68 | out: hHeap=0x260000) returned 1 [0067.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bff30 [0067.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bff30 | out: hHeap=0x260000) returned 1 [0067.474] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.474] GetLastError () returned 0x0 [0067.474] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.474] GetLastError () returned 0x0 [0067.476] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.476] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xaf, lpOverlapped=0x0) returned 1 [0067.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.477] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.477] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.478] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.478] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.478] CloseHandle (hObject=0xfc) returned 1 [0067.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.480] GetLastError () returned 0x0 [0067.480] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x29061a8) returned 1 [0067.481] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.481] CryptReleaseContext (hProv=0x29061a8, dwFlags=0x0) returned 1 [0067.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.481] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18748240848) returned 1 [0067.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7084670, dwHighDateTime=0x1d585b4)) [0067.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c10 [0067.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c10 | out: hHeap=0x260000) returned 1 [0067.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2bffd8 [0067.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2bffd8 | out: hHeap=0x260000) returned 1 [0067.482] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.482] GetLastError () returned 0x0 [0067.482] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.482] GetLastError () returned 0x0 [0067.485] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.485] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0067.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.487] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.487] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.488] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.488] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.489] CloseHandle (hObject=0xfc) returned 1 [0067.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.491] GetLastError () returned 0x0 [0067.492] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.493] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.493] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.493] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18749441169) returned 1 [0067.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb70aa7d0, dwHighDateTime=0x1d585b4)) [0067.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.493] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337c48 [0067.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337c48 | out: hHeap=0x260000) returned 1 [0067.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0080 [0067.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3337c8 [0067.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0080 | out: hHeap=0x260000) returned 1 [0067.494] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.494] GetLastError () returned 0x0 [0067.494] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.494] GetLastError () returned 0x0 [0067.495] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.495] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xad, lpOverlapped=0x0) returned 1 [0067.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.496] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.496] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.497] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.497] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.497] CloseHandle (hObject=0xfc) returned 1 [0067.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.499] GetLastError () returned 0x0 [0067.499] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.500] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.500] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18750148131) returned 1 [0067.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb70aa7d0, dwHighDateTime=0x1d585b4)) [0067.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338268 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338268 | out: hHeap=0x260000) returned 1 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x354560 [0067.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3337c8 [0067.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x354560 | out: hHeap=0x260000) returned 1 [0067.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.501] GetLastError () returned 0x0 [0067.501] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.502] GetLastError () returned 0x0 [0067.502] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.503] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xad, lpOverlapped=0x0) returned 1 [0067.503] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.503] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.503] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.504] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.504] CloseHandle (hObject=0xfc) returned 1 [0067.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.506] GetLastError () returned 0x0 [0067.506] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2907220) returned 1 [0067.507] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.507] CryptReleaseContext (hProv=0x2907220, dwFlags=0x0) returned 1 [0067.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.507] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18750856543) returned 1 [0067.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb70d0930, dwHighDateTime=0x1d585b4)) [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27eb008 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eb008 | out: hHeap=0x260000) returned 1 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0250 [0067.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.508] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0250 | out: hHeap=0x260000) returned 1 [0067.508] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.508] GetLastError () returned 0x0 [0067.508] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.508] GetLastError () returned 0x0 [0067.509] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.510] WriteFile (in: hFile=0xfc, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0067.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.510] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.510] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.511] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.511] CloseHandle (hObject=0xfc) returned 1 [0067.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.513] GetLastError () returned 0x0 [0067.539] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.540] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.540] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.540] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18754091271) returned 1 [0067.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb711cbf0, dwHighDateTime=0x1d585b4)) [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d93c0 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d93c0 | out: hHeap=0x260000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c02f8 [0067.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c02f8 | out: hHeap=0x260000) returned 1 [0067.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.541] GetLastError () returned 0x0 [0067.541] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.541] GetLastError () returned 0x0 [0067.542] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.542] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb1, lpOverlapped=0x0) returned 1 [0067.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.542] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.542] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.543] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.543] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.543] CloseHandle (hObject=0xa4) returned 1 [0067.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.545] GetLastError () returned 0x0 [0067.546] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.547] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.547] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.547] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18754827336) returned 1 [0067.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb711cbf0, dwHighDateTime=0x1d585b4)) [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9388 [0067.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9388 | out: hHeap=0x260000) returned 1 [0067.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c03a0 [0067.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c03a0 | out: hHeap=0x260000) returned 1 [0067.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.548] GetLastError () returned 0x0 [0067.548] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.548] GetLastError () returned 0x0 [0067.549] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffd65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.550] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x29b, lpOverlapped=0x0) returned 1 [0067.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.550] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.550] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.551] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.551] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.551] CloseHandle (hObject=0xa4) returned 1 [0067.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.553] GetLastError () returned 0x0 [0067.553] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.554] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.554] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.554] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.554] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18755548245) returned 1 [0067.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7142d50, dwHighDateTime=0x1d585b4)) [0067.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9350 [0067.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9350 | out: hHeap=0x260000) returned 1 [0067.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c04f0 [0067.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.555] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c04f0 | out: hHeap=0x260000) returned 1 [0067.555] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.555] GetLastError () returned 0x0 [0067.555] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.555] GetLastError () returned 0x0 [0067.556] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.556] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xbc, lpOverlapped=0x0) returned 1 [0067.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.557] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.557] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.558] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.558] CloseHandle (hObject=0xa4) returned 1 [0067.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.560] GetLastError () returned 0x0 [0067.560] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.561] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.561] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.561] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.561] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18756243160) returned 1 [0067.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7142d50, dwHighDateTime=0x1d585b4)) [0067.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9318 [0067.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9318 | out: hHeap=0x260000) returned 1 [0067.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0598 [0067.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0598 | out: hHeap=0x260000) returned 1 [0067.562] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.562] GetLastError () returned 0x0 [0067.562] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.562] GetLastError () returned 0x0 [0067.563] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.563] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb0, lpOverlapped=0x0) returned 1 [0067.564] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.564] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.564] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.565] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.565] CloseHandle (hObject=0xa4) returned 1 [0067.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.569] GetLastError () returned 0x0 [0067.569] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.570] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.570] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.570] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18757147323) returned 1 [0067.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7168eb0, dwHighDateTime=0x1d585b4)) [0067.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d92e0 [0067.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d92e0 | out: hHeap=0x260000) returned 1 [0067.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0640 [0067.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0640 | out: hHeap=0x260000) returned 1 [0067.571] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.571] GetLastError () returned 0x0 [0067.571] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.571] GetLastError () returned 0x0 [0067.572] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffffbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.572] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x44, lpOverlapped=0x0) returned 1 [0067.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.573] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.573] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.574] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.574] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.574] CloseHandle (hObject=0xa4) returned 1 [0067.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.584] GetLastError () returned 0x0 [0067.584] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.585] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.585] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.585] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18758640509) returned 1 [0067.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb718f010, dwHighDateTime=0x1d585b4)) [0067.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9270 [0067.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9270 | out: hHeap=0x260000) returned 1 [0067.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c06e8 [0067.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c06e8 | out: hHeap=0x260000) returned 1 [0067.586] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.586] GetLastError () returned 0x0 [0067.586] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.586] GetLastError () returned 0x0 [0067.587] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.587] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb3, lpOverlapped=0x0) returned 1 [0067.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.588] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.588] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.588] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.588] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.589] CloseHandle (hObject=0xa4) returned 1 [0067.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.591] GetLastError () returned 0x0 [0067.592] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.592] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.592] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.593] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18759378264) returned 1 [0067.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb718f010, dwHighDateTime=0x1d585b4)) [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9238 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9238 | out: hHeap=0x260000) returned 1 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0838 [0067.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0838 | out: hHeap=0x260000) returned 1 [0067.593] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.594] GetLastError () returned 0x0 [0067.594] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.594] GetLastError () returned 0x0 [0067.598] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffeef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.598] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x111, lpOverlapped=0x0) returned 1 [0067.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.599] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.599] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.599] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.600] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.600] CloseHandle (hObject=0xa4) returned 1 [0067.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.602] GetLastError () returned 0x0 [0067.602] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.603] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.603] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18760402245) returned 1 [0067.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb71b5170, dwHighDateTime=0x1d585b4)) [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9200 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9200 | out: hHeap=0x260000) returned 1 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c08e0 [0067.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c08e0 | out: hHeap=0x260000) returned 1 [0067.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.604] GetLastError () returned 0x0 [0067.604] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.604] GetLastError () returned 0x0 [0067.605] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffba5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.605] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x45b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x45b, lpOverlapped=0x0) returned 1 [0067.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.606] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.606] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.607] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.607] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.607] CloseHandle (hObject=0xa4) returned 1 [0067.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.609] GetLastError () returned 0x0 [0067.609] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.610] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.610] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.610] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18761136788) returned 1 [0067.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb71b5170, dwHighDateTime=0x1d585b4)) [0067.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d91c8 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d91c8 | out: hHeap=0x260000) returned 1 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0988 [0067.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0988 | out: hHeap=0x260000) returned 1 [0067.611] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.611] GetLastError () returned 0x0 [0067.611] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.611] GetLastError () returned 0x0 [0067.612] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff05, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.613] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xfb, lpOverlapped=0x0) returned 1 [0067.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.614] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.615] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.615] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.616] CloseHandle (hObject=0xa4) returned 1 [0067.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.617] GetLastError () returned 0x0 [0067.617] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.618] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.618] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0067.618] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0067.618] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18761960198) returned 1 [0067.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb71db2d0, dwHighDateTime=0x1d585b4)) [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9190 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9190 | out: hHeap=0x260000) returned 1 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0a30 [0067.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0a30 | out: hHeap=0x260000) returned 1 [0067.619] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.619] GetLastError () returned 0x0 [0067.619] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.620] GetLastError () returned 0x0 [0067.620] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.621] WriteFile (in: hFile=0xa4, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xf0, lpOverlapped=0x0) returned 1 [0067.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.621] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.621] WriteFile (in: hFile=0xa4, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.622] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.622] CloseHandle (hObject=0xa4) returned 1 [0067.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b06e0 [0067.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b06e0 | out: hHeap=0x260000) returned 1 [0067.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0067.624] GetLastError () returned 0x0 [0067.641] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.641] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.641] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.642] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18764297290) returned 1 [0067.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7227590, dwHighDateTime=0x1d585b4)) [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9158 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9158 | out: hHeap=0x260000) returned 1 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0ad8 [0067.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0ad8 | out: hHeap=0x260000) returned 1 [0067.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.643] GetLastError () returned 0x0 [0067.643] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.643] GetLastError () returned 0x0 [0067.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.644] WriteFile (in: hFile=0xf0, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0x103, lpOverlapped=0x0) returned 1 [0067.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.644] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.644] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.645] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.646] CloseHandle (hObject=0xf0) returned 1 [0067.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.647] GetLastError () returned 0x0 [0067.647] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.648] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.648] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.648] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.648] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18764943898) returned 1 [0067.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7227590, dwHighDateTime=0x1d585b4)) [0067.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8f98 [0067.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8f98 | out: hHeap=0x260000) returned 1 [0067.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0b80 [0067.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0b80 | out: hHeap=0x260000) returned 1 [0067.649] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.649] GetLastError () returned 0x0 [0067.649] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.649] GetLastError () returned 0x0 [0067.650] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff25, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.650] WriteFile (in: hFile=0xf0, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xdb, lpOverlapped=0x0) returned 1 [0067.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.651] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.651] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.652] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.652] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.652] CloseHandle (hObject=0xf0) returned 1 [0067.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.654] GetLastError () returned 0x0 [0067.655] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.655] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.656] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18765676643) returned 1 [0067.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7227590, dwHighDateTime=0x1d585b4)) [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9120 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9120 | out: hHeap=0x260000) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0c28 [0067.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0c28 | out: hHeap=0x260000) returned 1 [0067.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.657] GetLastError () returned 0x0 [0067.657] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.657] GetLastError () returned 0x0 [0067.658] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.658] WriteFile (in: hFile=0xf0, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xc0, lpOverlapped=0x0) returned 1 [0067.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.659] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.659] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.660] CloseHandle (hObject=0xf0) returned 1 [0067.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.662] GetLastError () returned 0x0 [0067.662] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.663] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.663] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.663] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18766447060) returned 1 [0067.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb724d6f0, dwHighDateTime=0x1d585b4)) [0067.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d90e8 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d90e8 | out: hHeap=0x260000) returned 1 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2b28d8 [0067.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0cd0 [0067.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b28d8 | out: hHeap=0x260000) returned 1 [0067.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0cd0 | out: hHeap=0x260000) returned 1 [0067.664] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.664] GetLastError () returned 0x0 [0067.664] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.664] GetLastError () returned 0x0 [0067.665] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.666] WriteFile (in: hFile=0xf0, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xbf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xbf, lpOverlapped=0x0) returned 1 [0067.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.666] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.666] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.667] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.667] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.668] CloseHandle (hObject=0xf0) returned 1 [0067.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.670] GetLastError () returned 0x0 [0067.670] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.671] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.671] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.671] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18768139133) returned 1 [0067.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb72999b0, dwHighDateTime=0x1d585b4)) [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9078 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9078 | out: hHeap=0x260000) returned 1 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0d78 [0067.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0d78 | out: hHeap=0x260000) returned 1 [0067.700] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.700] GetLastError () returned 0x0 [0067.700] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.700] GetLastError () returned 0x0 [0067.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.701] WriteFile (in: hFile=0xf0, lpBuffer=0x28a9068*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x28a9068*, lpNumberOfBytesWritten=0x24cfdb0*=0xb8, lpOverlapped=0x0) returned 1 [0067.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28a9068 | out: hHeap=0x260000) returned 1 [0067.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.702] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.702] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.702] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.703] CloseHandle (hObject=0xf0) returned 1 [0067.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.814] GetLastError () returned 0x0 [0067.814] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2907dd0) returned 1 [0067.815] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.815] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.815] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18781660594) returned 1 [0067.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb73ca4b0, dwHighDateTime=0x1d585b4)) [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d8da0 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d8da0 | out: hHeap=0x260000) returned 1 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c0e20 [0067.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c0e20 | out: hHeap=0x260000) returned 1 [0067.816] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.816] GetLastError () returned 0x0 [0067.817] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.817] GetLastError () returned 0x0 [0067.817] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.818] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x7c, lpOverlapped=0x0) returned 1 [0067.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.818] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.818] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.819] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.819] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.819] CloseHandle (hObject=0xf0) returned 1 [0067.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.820] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.822] GetLastError () returned 0x0 [0067.857] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2907dd0) returned 1 [0067.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.858] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.858] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18785945582) returned 1 [0067.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7416770, dwHighDateTime=0x1d585b4)) [0067.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ac8 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ac8 | out: hHeap=0x260000) returned 1 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c16a8 [0067.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c16a8 | out: hHeap=0x260000) returned 1 [0067.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.859] GetLastError () returned 0x0 [0067.860] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.860] GetLastError () returned 0x0 [0067.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.861] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xb6, lpOverlapped=0x0) returned 1 [0067.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.863] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.865] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.865] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.865] CloseHandle (hObject=0xf0) returned 1 [0067.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.865] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.867] GetLastError () returned 0x0 [0067.868] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2907dd0) returned 1 [0067.869] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.869] CryptReleaseContext (hProv=0x2907dd0, dwFlags=0x0) returned 1 [0067.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.869] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18786990439) returned 1 [0067.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb743c8d0, dwHighDateTime=0x1d585b4)) [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7b00 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b00 | out: hHeap=0x260000) returned 1 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1750 [0067.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1750 | out: hHeap=0x260000) returned 1 [0067.870] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.870] GetLastError () returned 0x0 [0067.870] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.870] GetLastError () returned 0x0 [0067.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffffc0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.871] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x40, lpOverlapped=0x0) returned 1 [0067.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.871] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.872] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.872] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.873] CloseHandle (hObject=0xf0) returned 1 [0067.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0067.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0067.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.878] GetLastError () returned 0x0 [0067.879] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.880] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.880] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.880] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18788123093) returned 1 [0067.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7462a30, dwHighDateTime=0x1d585b4)) [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7b38 [0067.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7b38 | out: hHeap=0x260000) returned 1 [0067.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c17f8 [0067.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c17f8 | out: hHeap=0x260000) returned 1 [0067.881] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.881] GetLastError () returned 0x0 [0067.881] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.881] GetLastError () returned 0x0 [0067.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffbf0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.901] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x40f6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x40f6, lpOverlapped=0x0) returned 1 [0067.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.902] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.903] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.903] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.906] CloseHandle (hObject=0xf0) returned 1 [0067.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.913] GetLastError () returned 0x0 [0067.915] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.916] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0067.916] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0067.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.916] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18791740379) returned 1 [0067.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb74aecf0, dwHighDateTime=0x1d585b4)) [0067.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ba8 [0067.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ba8 | out: hHeap=0x260000) returned 1 [0067.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c18a0 [0067.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c18a0 | out: hHeap=0x260000) returned 1 [0067.920] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.920] GetLastError () returned 0x0 [0067.920] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.920] GetLastError () returned 0x0 [0067.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff9d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.921] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x63, lpOverlapped=0x0) returned 1 [0067.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.923] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.924] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.924] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.924] CloseHandle (hObject=0xf0) returned 1 [0067.924] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.927] GetLastError () returned 0x0 [0067.927] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.928] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.928] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.928] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18792911239) returned 1 [0067.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb74d4e50, dwHighDateTime=0x1d585b4)) [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7be0 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7be0 | out: hHeap=0x260000) returned 1 [0067.928] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c19f0 [0067.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c19f0 | out: hHeap=0x260000) returned 1 [0067.929] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.929] GetLastError () returned 0x0 [0067.929] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.929] GetLastError () returned 0x0 [0067.930] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffffb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.930] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x4a, lpOverlapped=0x0) returned 1 [0067.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.931] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.931] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.931] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.931] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.932] CloseHandle (hObject=0xf0) returned 1 [0067.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.932] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.934] GetLastError () returned 0x0 [0067.935] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.935] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.936] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.936] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18793686006) returned 1 [0067.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb74d4e50, dwHighDateTime=0x1d585b4)) [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7c18 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c18 | out: hHeap=0x260000) returned 1 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1a98 [0067.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1a98 | out: hHeap=0x260000) returned 1 [0067.936] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.937] GetLastError () returned 0x0 [0067.938] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.938] GetLastError () returned 0x0 [0067.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.942] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x61, lpOverlapped=0x0) returned 1 [0067.946] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.947] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.947] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.948] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.948] CloseHandle (hObject=0xf0) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.948] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.963] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.963] GetLastError () returned 0x0 [0067.963] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.964] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.964] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.964] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18796539005) returned 1 [0067.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7521110, dwHighDateTime=0x1d585b4)) [0067.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.964] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294608 [0067.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294608 | out: hHeap=0x260000) returned 1 [0067.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1b40 [0067.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.965] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1b40 | out: hHeap=0x260000) returned 1 [0067.965] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.965] GetLastError () returned 0x0 [0067.965] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.965] GetLastError () returned 0x0 [0067.966] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.966] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x7a, lpOverlapped=0x0) returned 1 [0067.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.967] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.967] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.968] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.968] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.969] CloseHandle (hObject=0xf0) returned 1 [0067.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.977] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.977] GetLastError () returned 0x0 [0067.978] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.978] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.979] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18797979322) returned 1 [0067.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7547270, dwHighDateTime=0x1d585b4)) [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294640 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294640 | out: hHeap=0x260000) returned 1 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1be8 [0067.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1be8 | out: hHeap=0x260000) returned 1 [0067.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.980] GetLastError () returned 0x0 [0067.980] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.980] GetLastError () returned 0x0 [0067.983] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.983] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xda, lpOverlapped=0x0) returned 1 [0067.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.984] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.985] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.985] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0067.986] CloseHandle (hObject=0xf0) returned 1 [0067.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0067.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.[deadmin@cock.li].deadmin")) returned 1 [0067.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0067.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0067.987] GetLastError () returned 0x0 [0067.987] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0067.988] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0067.988] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0067.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0067.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0067.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0067.988] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18798952573) returned 1 [0067.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb756d3d0, dwHighDateTime=0x1d585b4)) [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294678 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0067.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294678 | out: hHeap=0x260000) returned 1 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0067.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1c90 [0067.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0067.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0067.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1c90 | out: hHeap=0x260000) returned 1 [0067.989] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0067.989] GetLastError () returned 0x0 [0067.989] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0067.989] GetLastError () returned 0x0 [0067.990] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.990] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xda, lpOverlapped=0x0) returned 1 [0067.991] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0067.991] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.991] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0067.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0067.996] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.003] CloseHandle (hObject=0xf0) returned 1 [0068.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.007] GetLastError () returned 0x0 [0068.007] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.008] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.008] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18800962565) returned 1 [0068.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7593530, dwHighDateTime=0x1d585b4)) [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946b0 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2946b0 | out: hHeap=0x260000) returned 1 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1d38 [0068.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1d38 | out: hHeap=0x260000) returned 1 [0068.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.009] GetLastError () returned 0x0 [0068.009] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.010] GetLastError () returned 0x0 [0068.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.011] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xc7, lpOverlapped=0x0) returned 1 [0068.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.011] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.012] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.012] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.012] CloseHandle (hObject=0xf0) returned 1 [0068.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.013] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.014] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.015] GetLastError () returned 0x0 [0068.015] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.016] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.016] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.016] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18801697228) returned 1 [0068.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7593530, dwHighDateTime=0x1d585b4)) [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2945d0 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2945d0 | out: hHeap=0x260000) returned 1 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1948 [0068.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1948 | out: hHeap=0x260000) returned 1 [0068.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.022] GetLastError () returned 0x0 [0068.022] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.022] GetLastError () returned 0x0 [0068.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.023] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xaa, lpOverlapped=0x0) returned 1 [0068.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.023] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.024] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.024] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.025] CloseHandle (hObject=0xf0) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.385] GetLastError () returned 0x0 [0068.395] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.396] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.396] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18839694898) returned 1 [0068.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb794b790, dwHighDateTime=0x1d585b4)) [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28ae7b0 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28ae7b0 | out: hHeap=0x260000) returned 1 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2cd0 [0068.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2cd0 | out: hHeap=0x260000) returned 1 [0068.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.397] GetLastError () returned 0x0 [0068.397] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.397] GetLastError () returned 0x0 [0068.398] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.398] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x65, lpOverlapped=0x0) returned 1 [0068.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.398] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.399] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.399] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.399] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.400] CloseHandle (hObject=0xa4) returned 1 [0068.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.402] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.402] GetLastError () returned 0x0 [0068.402] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.403] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.403] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.403] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18840395991) returned 1 [0068.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb794b790, dwHighDateTime=0x1d585b4)) [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329c78 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329c78 | out: hHeap=0x260000) returned 1 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2ec8 [0068.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2ec8 | out: hHeap=0x260000) returned 1 [0068.404] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.404] GetLastError () returned 0x0 [0068.404] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.404] GetLastError () returned 0x0 [0068.405] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffffb1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.405] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x4f, lpOverlapped=0x0) returned 1 [0068.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.405] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.406] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.406] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.406] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.407] CloseHandle (hObject=0xa4) returned 1 [0068.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.409] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.409] GetLastError () returned 0x0 [0068.409] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.410] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.410] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.410] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18841110178) returned 1 [0068.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb79718f0, dwHighDateTime=0x1d585b4)) [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329c40 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329c40 | out: hHeap=0x260000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c2f70 [0068.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c2f70 | out: hHeap=0x260000) returned 1 [0068.411] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.411] GetLastError () returned 0x0 [0068.411] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.411] GetLastError () returned 0x0 [0068.412] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.412] WriteFile (in: hFile=0xa4, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x8c, lpOverlapped=0x0) returned 1 [0068.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.413] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.413] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.414] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.414] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.414] CloseHandle (hObject=0xa4) returned 1 [0068.414] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.472] GetLastError () returned 0x0 [0068.482] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.483] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.483] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.483] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18848397858) returned 1 [0068.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7a09e70, dwHighDateTime=0x1d585b4)) [0068.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329af0 [0068.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329af0 | out: hHeap=0x260000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3018 [0068.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3018 | out: hHeap=0x260000) returned 1 [0068.485] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.486] GetLastError () returned 0x0 [0068.486] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.486] GetLastError () returned 0x0 [0068.491] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffc2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.493] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x3d4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x3d4, lpOverlapped=0x0) returned 1 [0068.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0068.494] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.494] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.495] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.495] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.496] CloseHandle (hObject=0xa4) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.497] GetLastError () returned 0x0 [0068.498] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.498] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.498] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.499] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18849978325) returned 1 [0068.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7a2ffd0, dwHighDateTime=0x1d585b4)) [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4528 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4528 | out: hHeap=0x260000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867b38 [0068.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3408 [0068.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867b38 | out: hHeap=0x260000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.499] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3408 | out: hHeap=0x260000) returned 1 [0068.499] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.500] GetLastError () returned 0x0 [0068.500] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.500] GetLastError () returned 0x0 [0068.501] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xfffffeff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.501] WriteFile (in: hFile=0xa4, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x101, lpOverlapped=0x0) returned 1 [0068.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0068.502] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.502] WriteFile (in: hFile=0xa4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.502] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.502] WriteFile (in: hFile=0xa4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.503] CloseHandle (hObject=0xa4) returned 1 [0068.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.504] GetLastError () returned 0x0 [0068.511] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.512] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.512] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.512] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18851291916) returned 1 [0068.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7a56130, dwHighDateTime=0x1d585b4)) [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28ae9e0 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28ae9e0 | out: hHeap=0x260000) returned 1 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c34b0 [0068.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c34b0 | out: hHeap=0x260000) returned 1 [0068.512] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.513] GetLastError () returned 0x0 [0068.513] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.513] GetLastError () returned 0x0 [0068.514] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffffbb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.514] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x45, lpOverlapped=0x0) returned 1 [0068.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.515] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.515] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.515] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.516] CloseHandle (hObject=0xfc) returned 1 [0068.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.518] GetLastError () returned 0x0 [0068.518] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.519] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.519] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18852025936) returned 1 [0068.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7a7c290, dwHighDateTime=0x1d585b4)) [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4598 [0068.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4598 | out: hHeap=0x260000) returned 1 [0068.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3558 [0068.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3558 | out: hHeap=0x260000) returned 1 [0068.520] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.520] GetLastError () returned 0x0 [0068.520] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.520] GetLastError () returned 0x0 [0068.521] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffeed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.521] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x113, lpOverlapped=0x0) returned 1 [0068.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.522] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.522] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.522] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.523] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.523] CloseHandle (hObject=0xfc) returned 1 [0068.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.527] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.527] GetLastError () returned 0x0 [0068.528] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.529] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.529] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.529] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18853010894) returned 1 [0068.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7a7c290, dwHighDateTime=0x1d585b4)) [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c45d0 [0068.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.529] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c45d0 | out: hHeap=0x260000) returned 1 [0068.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3600 [0068.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3600 | out: hHeap=0x260000) returned 1 [0068.530] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.530] GetLastError () returned 0x0 [0068.530] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.530] GetLastError () returned 0x0 [0068.532] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.532] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xae, lpOverlapped=0x0) returned 1 [0068.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.533] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.533] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.534] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.534] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.535] CloseHandle (hObject=0xfc) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.537] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.537] GetLastError () returned 0x0 [0068.537] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.538] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.538] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18853957307) returned 1 [0068.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7aa23f0, dwHighDateTime=0x1d585b4)) [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4608 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4608 | out: hHeap=0x260000) returned 1 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c36a8 [0068.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c36a8 | out: hHeap=0x260000) returned 1 [0068.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.540] GetLastError () returned 0x0 [0068.540] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.540] GetLastError () returned 0x0 [0068.541] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffecf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.541] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x131, lpOverlapped=0x0) returned 1 [0068.542] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.542] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.543] WriteFile (in: hFile=0xfc, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.543] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.543] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.544] CloseHandle (hObject=0xfc) returned 1 [0068.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0608 [0068.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0608 | out: hHeap=0x260000) returned 1 [0068.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.545] GetLastError () returned 0x0 [0068.561] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.562] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.562] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.562] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18856362928) returned 1 [0068.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7aee6b0, dwHighDateTime=0x1d585b4)) [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c46b0 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c46b0 | out: hHeap=0x260000) returned 1 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x2867ca0 [0068.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c38a0 [0068.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2867ca0 | out: hHeap=0x260000) returned 1 [0068.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c38a0 | out: hHeap=0x260000) returned 1 [0068.563] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.563] GetLastError () returned 0x0 [0068.563] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.564] GetLastError () returned 0x0 [0068.600] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffba0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.600] WriteFile (in: hFile=0x11c, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0x460, lpOverlapped=0x0) returned 1 [0068.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0068.601] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.601] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.601] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.601] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.602] CloseHandle (hObject=0x11c) returned 1 [0068.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.641] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.642] GetLastError () returned 0x0 [0068.642] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.643] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0068.643] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.643] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18864389799) returned 1 [0068.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7bacd90, dwHighDateTime=0x1d585b4)) [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c48e0 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c48e0 | out: hHeap=0x260000) returned 1 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c37f8 [0068.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.643] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c37f8 | out: hHeap=0x260000) returned 1 [0068.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.644] GetLastError () returned 0x0 [0068.644] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.644] GetLastError () returned 0x0 [0068.645] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.645] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xb4, lpOverlapped=0x0) returned 1 [0068.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.646] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.646] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.646] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.646] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.647] CloseHandle (hObject=0x11c) returned 1 [0068.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.649] GetLastError () returned 0x0 [0068.650] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.650] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0068.650] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0068.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.650] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18865161073) returned 1 [0068.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7bacd90, dwHighDateTime=0x1d585b4)) [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4918 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4918 | out: hHeap=0x260000) returned 1 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3fd8 [0068.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3fd8 | out: hHeap=0x260000) returned 1 [0068.651] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.651] GetLastError () returned 0x0 [0068.651] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.652] GetLastError () returned 0x0 [0068.652] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.653] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xaf, lpOverlapped=0x0) returned 1 [0068.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.653] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.653] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.654] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.654] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.654] CloseHandle (hObject=0x11c) returned 1 [0068.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.658] GetLastError () returned 0x0 [0068.658] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.659] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0068.659] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.659] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18865993577) returned 1 [0068.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7bd2ef0, dwHighDateTime=0x1d585b4)) [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4950 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4950 | out: hHeap=0x260000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c4080 [0068.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4080 | out: hHeap=0x260000) returned 1 [0068.660] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.660] GetLastError () returned 0x0 [0068.660] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.660] GetLastError () returned 0x0 [0068.661] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.661] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x146, lpOverlapped=0x0) returned 1 [0068.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.662] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.662] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.662] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.662] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.663] CloseHandle (hObject=0x11c) returned 1 [0068.663] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.664] GetLastError () returned 0x0 [0068.665] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.665] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0068.665] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0068.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0068.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0068.666] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18866666312) returned 1 [0068.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7bd2ef0, dwHighDateTime=0x1d585b4)) [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4988 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4988 | out: hHeap=0x260000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1e88 [0068.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x321c28 [0068.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1e88 | out: hHeap=0x260000) returned 1 [0068.666] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.666] GetLastError () returned 0x0 [0068.666] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.667] GetLastError () returned 0x0 [0068.668] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffefe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.668] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x102, lpOverlapped=0x0) returned 1 [0068.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.668] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.668] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.669] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.669] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.669] CloseHandle (hObject=0x11c) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0068.671] GetLastError () returned 0x0 [0068.684] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.685] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.685] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.685] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18868591436) returned 1 [0068.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7bf9050, dwHighDateTime=0x1d585b4)) [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c49c0 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c49c0 | out: hHeap=0x260000) returned 1 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c1e88 [0068.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c1e88 | out: hHeap=0x260000) returned 1 [0068.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.686] GetLastError () returned 0x0 [0068.686] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.686] GetLastError () returned 0x0 [0068.687] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.687] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xe9, lpOverlapped=0x0) returned 1 [0068.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.688] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.688] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.689] CloseHandle (hObject=0x120) returned 1 [0068.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.693] GetLastError () returned 0x0 [0068.693] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.694] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.694] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.694] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18869514703) returned 1 [0068.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c1f1b0, dwHighDateTime=0x1d585b4)) [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c49f8 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c49f8 | out: hHeap=0x260000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c62f8 [0068.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c62f8 | out: hHeap=0x260000) returned 1 [0068.695] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.695] GetLastError () returned 0x0 [0068.695] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.695] GetLastError () returned 0x0 [0068.696] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffee1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.696] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x11f, lpOverlapped=0x0) returned 1 [0068.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.697] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.697] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.697] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.697] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.698] CloseHandle (hObject=0x120) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.699] GetLastError () returned 0x0 [0068.700] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.700] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.700] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.701] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18870169584) returned 1 [0068.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c1f1b0, dwHighDateTime=0x1d585b4)) [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4a30 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4a30 | out: hHeap=0x260000) returned 1 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c63a0 [0068.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c63a0 | out: hHeap=0x260000) returned 1 [0068.701] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.701] GetLastError () returned 0x0 [0068.702] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.702] GetLastError () returned 0x0 [0068.703] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffeff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.703] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x101, lpOverlapped=0x0) returned 1 [0068.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.703] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.703] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.704] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.705] CloseHandle (hObject=0x120) returned 1 [0068.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.706] GetLastError () returned 0x0 [0068.707] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.708] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.708] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.708] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18870895665) returned 1 [0068.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c45310, dwHighDateTime=0x1d585b4)) [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4a68 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4a68 | out: hHeap=0x260000) returned 1 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6448 [0068.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6448 | out: hHeap=0x260000) returned 1 [0068.709] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.709] GetLastError () returned 0x0 [0068.709] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.709] GetLastError () returned 0x0 [0068.710] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.710] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xe9, lpOverlapped=0x0) returned 1 [0068.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.710] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.711] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.711] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.711] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.712] CloseHandle (hObject=0x120) returned 1 [0068.712] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.713] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.713] GetLastError () returned 0x0 [0068.713] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.714] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.714] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.714] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18871553913) returned 1 [0068.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c45310, dwHighDateTime=0x1d585b4)) [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4aa0 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4aa0 | out: hHeap=0x260000) returned 1 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c64f0 [0068.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c64f0 | out: hHeap=0x260000) returned 1 [0068.715] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.715] GetLastError () returned 0x0 [0068.715] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.715] GetLastError () returned 0x0 [0068.716] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.716] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0068.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.717] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.717] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.718] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.718] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.726] CloseHandle (hObject=0x120) returned 1 [0068.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.728] GetLastError () returned 0x0 [0068.728] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.729] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.729] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.729] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18873011139) returned 1 [0068.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c6b470, dwHighDateTime=0x1d585b4)) [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4ad8 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4ad8 | out: hHeap=0x260000) returned 1 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.729] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6598 [0068.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6598 | out: hHeap=0x260000) returned 1 [0068.730] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.730] GetLastError () returned 0x0 [0068.730] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.730] GetLastError () returned 0x0 [0068.731] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.731] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xb1, lpOverlapped=0x0) returned 1 [0068.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.732] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.732] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.732] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.732] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.733] CloseHandle (hObject=0x120) returned 1 [0068.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.735] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.735] GetLastError () returned 0x0 [0068.736] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.737] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.737] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.737] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18874024828) returned 1 [0068.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c915d0, dwHighDateTime=0x1d585b4)) [0068.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4b10 [0068.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4b10 | out: hHeap=0x260000) returned 1 [0068.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6640 [0068.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.740] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6640 | out: hHeap=0x260000) returned 1 [0068.740] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.740] GetLastError () returned 0x0 [0068.740] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.740] GetLastError () returned 0x0 [0068.741] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.741] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xad, lpOverlapped=0x0) returned 1 [0068.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.742] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.742] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.742] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.742] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.743] CloseHandle (hObject=0x120) returned 1 [0068.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.745] GetLastError () returned 0x0 [0068.745] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.746] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.746] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18874723982) returned 1 [0068.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7c915d0, dwHighDateTime=0x1d585b4)) [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4b48 [0068.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4b48 | out: hHeap=0x260000) returned 1 [0068.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c66e8 [0068.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c66e8 | out: hHeap=0x260000) returned 1 [0068.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.747] GetLastError () returned 0x0 [0068.747] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.747] GetLastError () returned 0x0 [0068.748] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xfffffeb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.748] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x14e, lpOverlapped=0x0) returned 1 [0068.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.749] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.749] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.750] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.750] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.750] CloseHandle (hObject=0x120) returned 1 [0068.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.752] GetLastError () returned 0x0 [0068.752] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.753] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.753] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.753] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18875438449) returned 1 [0068.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7cb7730, dwHighDateTime=0x1d585b4)) [0068.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4b80 [0068.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4b80 | out: hHeap=0x260000) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6790 [0068.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6790 | out: hHeap=0x260000) returned 1 [0068.754] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.754] GetLastError () returned 0x0 [0068.754] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.754] GetLastError () returned 0x0 [0068.755] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xffffff15, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.755] WriteFile (in: hFile=0x120, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xeb, lpOverlapped=0x0) returned 1 [0068.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.756] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.756] WriteFile (in: hFile=0x120, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.757] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.757] WriteFile (in: hFile=0x120, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.757] CloseHandle (hObject=0x120) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.759] GetLastError () returned 0x0 [0068.782] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.782] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.783] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18878380207) returned 1 [0068.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7d039f0, dwHighDateTime=0x1d585b4)) [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4c28 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4c28 | out: hHeap=0x260000) returned 1 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6988 [0068.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6988 | out: hHeap=0x260000) returned 1 [0068.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.784] GetLastError () returned 0x0 [0068.784] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.784] GetLastError () returned 0x0 [0068.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff09, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.785] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xf7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xf7, lpOverlapped=0x0) returned 1 [0068.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.785] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.786] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.786] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.787] CloseHandle (hObject=0xf0) returned 1 [0068.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.788] GetLastError () returned 0x0 [0068.789] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.790] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.790] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.790] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18879154912) returned 1 [0068.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7d039f0, dwHighDateTime=0x1d585b4)) [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4c60 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4c60 | out: hHeap=0x260000) returned 1 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c68e0 [0068.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c68e0 | out: hHeap=0x260000) returned 1 [0068.791] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.791] GetLastError () returned 0x0 [0068.791] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.791] GetLastError () returned 0x0 [0068.792] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.793] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xaf, lpOverlapped=0x0) returned 1 [0068.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.793] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.794] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.794] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.794] CloseHandle (hObject=0xf0) returned 1 [0068.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.797] GetLastError () returned 0x0 [0068.797] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.798] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.798] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.798] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18879886906) returned 1 [0068.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7d29b50, dwHighDateTime=0x1d585b4)) [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4c98 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4c98 | out: hHeap=0x260000) returned 1 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6ad8 [0068.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6ad8 | out: hHeap=0x260000) returned 1 [0068.798] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.799] GetLastError () returned 0x0 [0068.799] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.799] GetLastError () returned 0x0 [0068.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.800] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xff, lpOverlapped=0x0) returned 1 [0068.800] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.800] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.801] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.801] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.802] CloseHandle (hObject=0xf0) returned 1 [0068.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.803] GetLastError () returned 0x0 [0068.803] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.804] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.804] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.804] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18880533095) returned 1 [0068.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7d29b50, dwHighDateTime=0x1d585b4)) [0068.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4cd0 [0068.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4cd0 | out: hHeap=0x260000) returned 1 [0068.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6b80 [0068.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6b80 | out: hHeap=0x260000) returned 1 [0068.805] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.805] GetLastError () returned 0x0 [0068.805] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.805] GetLastError () returned 0x0 [0068.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.806] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xb0, lpOverlapped=0x0) returned 1 [0068.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.807] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.807] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.808] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.808] CloseHandle (hObject=0xf0) returned 1 [0068.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.810] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.810] GetLastError () returned 0x0 [0068.811] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.811] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.811] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.812] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18881296474) returned 1 [0068.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7d4fcb0, dwHighDateTime=0x1d585b4)) [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4d08 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4d08 | out: hHeap=0x260000) returned 1 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6c28 [0068.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.812] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x323b90 [0068.813] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6c28 | out: hHeap=0x260000) returned 1 [0068.813] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.813] GetLastError () returned 0x0 [0068.813] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.813] GetLastError () returned 0x0 [0068.814] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.814] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xb0, lpOverlapped=0x0) returned 1 [0068.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0068.815] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.815] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.815] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.815] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.816] CloseHandle (hObject=0xf0) returned 1 [0068.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif.[deadmin@cock.li].deadmin")) returned 1 [0068.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0068.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0068.880] GetLastError () returned 0x0 [0068.880] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0068.881] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0068.881] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0068.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0068.881] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18888199301) returned 1 [0068.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7de8230, dwHighDateTime=0x1d585b4)) [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c4e58 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0068.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c4e58 | out: hHeap=0x260000) returned 1 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0068.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c6cd0 [0068.881] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0068.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ebfe0 [0068.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6cd0 | out: hHeap=0x260000) returned 1 [0068.882] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0068.882] GetLastError () returned 0x0 [0068.882] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0068.882] GetLastError () returned 0x0 [0068.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.884] WriteFile (in: hFile=0xf0, lpBuffer=0x2817088*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x2817088*, lpNumberOfBytesWritten=0x24cfdb0*=0xb1, lpOverlapped=0x0) returned 1 [0068.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2817088 | out: hHeap=0x260000) returned 1 [0068.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.885] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0068.885] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0068.885] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0068.886] CloseHandle (hObject=0xf0) returned 1 [0068.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0068.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.072] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.072] GetLastError () returned 0x0 [0069.073] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.073] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.073] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.074] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18907474426) returned 1 [0069.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7fb12b0, dwHighDateTime=0x1d585b4)) [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c52b8 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c52b8 | out: hHeap=0x260000) returned 1 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31b148 [0069.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0069.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31b148 | out: hHeap=0x260000) returned 1 [0069.074] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.075] GetLastError () returned 0x0 [0069.075] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.075] GetLastError () returned 0x0 [0069.093] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffa55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.094] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x5ab, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5ab, lpOverlapped=0x0) returned 1 [0069.094] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0069.094] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.094] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.095] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.095] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.095] CloseHandle (hObject=0xf0) returned 1 [0069.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.097] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.097] GetLastError () returned 0x0 [0069.097] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.098] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.098] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.098] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18909937925) returned 1 [0069.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb7ffd570, dwHighDateTime=0x1d585b4)) [0069.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5360 [0069.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5360 | out: hHeap=0x260000) returned 1 [0069.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328b90 [0069.099] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.099] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.099] GetLastError () returned 0x0 [0069.099] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.099] GetLastError () returned 0x0 [0069.100] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffee4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.100] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x11c, lpOverlapped=0x0) returned 1 [0069.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0069.101] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.101] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.102] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.102] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.102] CloseHandle (hObject=0xf0) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.104] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.105] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.105] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.105] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.105] GetLastError () returned 0x0 [0069.107] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.108] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2fe, lpOverlapped=0x0) returned 1 [0069.108] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.108] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.109] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.109] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.110] CloseHandle (hObject=0xf0) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.111] GetLastError () returned 0x0 [0069.111] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.114] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.114] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.114] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18911543286) returned 1 [0069.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb80236d0, dwHighDateTime=0x1d585b4)) [0069.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c53d0 [0069.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c53d0 | out: hHeap=0x260000) returned 1 [0069.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328930 [0069.115] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.115] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.115] GetLastError () returned 0x0 [0069.115] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.115] GetLastError () returned 0x0 [0069.146] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff569, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.146] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0xa97, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xa97, lpOverlapped=0x0) returned 1 [0069.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0069.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.147] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.148] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.148] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.148] CloseHandle (hObject=0xf0) returned 1 [0069.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.150] GetLastError () returned 0x0 [0069.150] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.151] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.151] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.151] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18915199284) returned 1 [0069.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb806f990, dwHighDateTime=0x1d585b4)) [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c54e8 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c54e8 | out: hHeap=0x260000) returned 1 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328898 [0069.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.152] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.152] GetLastError () returned 0x0 [0069.152] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.152] GetLastError () returned 0x0 [0069.153] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.153] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13c, lpOverlapped=0x0) returned 1 [0069.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0069.154] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.154] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.154] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.154] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.155] CloseHandle (hObject=0xf0) returned 1 [0069.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.156] GetLastError () returned 0x0 [0069.157] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.157] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.157] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.157] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18915862756) returned 1 [0069.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8095af0, dwHighDateTime=0x1d585b4)) [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5520 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5520 | out: hHeap=0x260000) returned 1 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328508 [0069.158] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.158] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.158] GetLastError () returned 0x0 [0069.158] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.159] GetLastError () returned 0x0 [0069.159] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffee9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.160] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x117, lpOverlapped=0x0) returned 1 [0069.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0069.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.160] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.161] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.161] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.161] CloseHandle (hObject=0xf0) returned 1 [0069.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.161] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.163] GetLastError () returned 0x0 [0069.163] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.164] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.164] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.164] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18916518034) returned 1 [0069.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8095af0, dwHighDateTime=0x1d585b4)) [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5558 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5558 | out: hHeap=0x260000) returned 1 [0069.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328470 [0069.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.165] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.165] GetLastError () returned 0x0 [0069.165] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.165] GetLastError () returned 0x0 [0069.166] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe83, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.166] WriteFile (in: hFile=0xf0, lpBuffer=0x291c0a0*, nNumberOfBytesToWrite=0x17d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x291c0a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x17d, lpOverlapped=0x0) returned 1 [0069.167] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291c0a0 | out: hHeap=0x260000) returned 1 [0069.167] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.167] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.167] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.167] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.168] CloseHandle (hObject=0xf0) returned 1 [0069.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.193] GetLastError () returned 0x0 [0069.194] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.194] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.195] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.195] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18919744070) returned 1 [0069.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb80e1db0, dwHighDateTime=0x1d585b4)) [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5590 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5590 | out: hHeap=0x260000) returned 1 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x327af0 [0069.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.197] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.197] GetLastError () returned 0x0 [0069.198] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.198] GetLastError () returned 0x0 [0069.200] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffebc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.200] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x144, lpOverlapped=0x0) returned 1 [0069.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.201] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.201] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.202] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.202] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.203] CloseHandle (hObject=0xf0) returned 1 [0069.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.204] GetLastError () returned 0x0 [0069.204] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.206] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.207] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.207] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18920783945) returned 1 [0069.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8107f10, dwHighDateTime=0x1d585b4)) [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c55c8 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c55c8 | out: hHeap=0x260000) returned 1 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328340 [0069.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.207] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.208] GetLastError () returned 0x0 [0069.208] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.208] GetLastError () returned 0x0 [0069.209] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.209] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x2d7, lpOverlapped=0x0) returned 1 [0069.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.210] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.210] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.211] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.211] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.211] CloseHandle (hObject=0xf0) returned 1 [0069.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.213] GetLastError () returned 0x0 [0069.213] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.214] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.214] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.214] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18921503967) returned 1 [0069.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8107f10, dwHighDateTime=0x1d585b4)) [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5600 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5600 | out: hHeap=0x260000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.214] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3282a8 [0069.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.215] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.215] GetLastError () returned 0x0 [0069.215] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.215] GetLastError () returned 0x0 [0069.216] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.216] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x2ae, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x2ae, lpOverlapped=0x0) returned 1 [0069.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.217] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.217] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.218] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.218] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.219] CloseHandle (hObject=0xf0) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.221] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.221] GetLastError () returned 0x0 [0069.221] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.222] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.222] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.222] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18922305939) returned 1 [0069.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb812e070, dwHighDateTime=0x1d585b4)) [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5638 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5638 | out: hHeap=0x260000) returned 1 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328210 [0069.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.223] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.223] GetLastError () returned 0x0 [0069.223] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.223] GetLastError () returned 0x0 [0069.224] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffde0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.224] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x220, lpOverlapped=0x0) returned 1 [0069.225] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.225] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.225] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.225] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.226] CloseHandle (hObject=0xf0) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.227] GetLastError () returned 0x0 [0069.228] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.228] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.228] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.229] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18922970446) returned 1 [0069.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb812e070, dwHighDateTime=0x1d585b4)) [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5670 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5670 | out: hHeap=0x260000) returned 1 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328178 [0069.229] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.229] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.229] GetLastError () returned 0x0 [0069.230] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.230] GetLastError () returned 0x0 [0069.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.231] WriteFile (in: hFile=0xf0, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x16e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x16e, lpOverlapped=0x0) returned 1 [0069.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.231] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.231] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.232] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.232] CloseHandle (hObject=0xf0) returned 1 [0069.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.301] GetLastError () returned 0x0 [0069.301] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.302] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.302] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.302] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18930325639) returned 1 [0069.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb81ec750, dwHighDateTime=0x1d585b4)) [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a1b8 [0069.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a1b8 | out: hHeap=0x260000) returned 1 [0069.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ad50 [0069.303] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.303] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.303] GetLastError () returned 0x0 [0069.303] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.303] GetLastError () returned 0x0 [0069.509] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff9ea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.509] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x616, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x616, lpOverlapped=0x0) returned 1 [0069.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.510] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.511] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.511] CloseHandle (hObject=0xf0) returned 1 [0069.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.512] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.513] GetLastError () returned 0x0 [0069.514] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.515] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.515] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.515] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18951645288) returned 1 [0069.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8401a90, dwHighDateTime=0x1d585b4)) [0069.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x329ea8 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x329ea8 | out: hHeap=0x260000) returned 1 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0069.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320510 [0069.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0069.516] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.516] GetLastError () returned 0x0 [0069.517] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.517] GetLastError () returned 0x0 [0069.624] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff907, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.624] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x6f9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6f9, lpOverlapped=0x0) returned 1 [0069.625] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.625] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.625] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.626] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.626] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.626] CloseHandle (hObject=0xf0) returned 1 [0069.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.628] GetLastError () returned 0x0 [0069.628] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.629] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.629] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.629] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18963040109) returned 1 [0069.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb850c430, dwHighDateTime=0x1d585b4)) [0069.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5910 [0069.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5910 | out: hHeap=0x260000) returned 1 [0069.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed670 [0069.630] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.630] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.630] GetLastError () returned 0x0 [0069.630] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.630] GetLastError () returned 0x0 [0069.659] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.659] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x770, lpOverlapped=0x0) returned 1 [0069.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.662] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.662] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.663] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.663] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.664] CloseHandle (hObject=0xf0) returned 1 [0069.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.668] GetLastError () returned 0x0 [0069.668] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.669] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.669] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.669] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18966996588) returned 1 [0069.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb85586f0, dwHighDateTime=0x1d585b4)) [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c59f0 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c59f0 | out: hHeap=0x260000) returned 1 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed540 [0069.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.670] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.670] GetLastError () returned 0x0 [0069.670] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.670] GetLastError () returned 0x0 [0069.671] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffdb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.671] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x24e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x24e, lpOverlapped=0x0) returned 1 [0069.672] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.672] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.672] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.672] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.672] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.673] CloseHandle (hObject=0xf0) returned 1 [0069.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.673] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.675] GetLastError () returned 0x0 [0069.675] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.676] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.676] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.676] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18967698320) returned 1 [0069.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb857e850, dwHighDateTime=0x1d585b4)) [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5a28 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5a28 | out: hHeap=0x260000) returned 1 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ed2e0 [0069.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.677] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.677] GetLastError () returned 0x0 [0069.677] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.677] GetLastError () returned 0x0 [0069.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8c3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.704] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x73d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x73d, lpOverlapped=0x0) returned 1 [0069.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0069.705] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.705] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0069.705] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0069.705] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0069.706] CloseHandle (hObject=0xf0) returned 1 [0069.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0069.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.[deadmin@cock.li].deadmin")) returned 1 [0069.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0069.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0069.816] GetLastError () returned 0x0 [0069.816] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311488) returned 1 [0069.829] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0069.829] CryptReleaseContext (hProv=0x311488, dwFlags=0x0) returned 1 [0069.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0069.830] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=18983074527) returned 1 [0069.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb86fb610, dwHighDateTime=0x1d585b4)) [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5be8 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0069.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5be8 | out: hHeap=0x260000) returned 1 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0069.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c3210 [0069.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0069.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32ac20 [0069.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c3210 | out: hHeap=0x260000) returned 1 [0069.830] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0069.830] GetLastError () returned 0x0 [0069.831] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0069.831] GetLastError () returned 0x0 [0069.917] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.917] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0069.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0069.951] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.951] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.062] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.062] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.062] CloseHandle (hObject=0x108) returned 1 [0070.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.[deadmin@cock.li].deadmin")) returned 1 [0070.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.064] GetLastError () returned 0x0 [0070.064] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312940) returned 1 [0070.065] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.065] CryptReleaseContext (hProv=0x312940, dwFlags=0x0) returned 1 [0070.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.065] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19006659293) returned 1 [0070.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8936ab0, dwHighDateTime=0x1d585b4)) [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5cc8 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5cc8 | out: hHeap=0x260000) returned 1 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328cc0 [0070.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.066] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.066] GetLastError () returned 0x0 [0070.066] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.067] GetLastError () returned 0x0 [0070.071] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.071] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0070.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.071] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.071] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.072] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.072] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.073] CloseHandle (hObject=0x108) returned 1 [0070.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.[deadmin@cock.li].deadmin")) returned 1 [0070.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.074] GetLastError () returned 0x0 [0070.076] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3111e0) returned 1 [0070.076] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.076] CryptReleaseContext (hProv=0x3111e0, dwFlags=0x0) returned 1 [0070.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.077] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19007780029) returned 1 [0070.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb895cc10, dwHighDateTime=0x1d585b4)) [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5d00 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5d00 | out: hHeap=0x260000) returned 1 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32b800 [0070.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.077] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.078] GetLastError () returned 0x0 [0070.078] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.078] GetLastError () returned 0x0 [0070.079] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff7a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.079] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x860, lpOverlapped=0x0) returned 1 [0070.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.080] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.080] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.080] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.080] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.081] CloseHandle (hObject=0x108) returned 1 [0070.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.[deadmin@cock.li].deadmin")) returned 1 [0070.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.083] GetLastError () returned 0x0 [0070.083] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3111e0) returned 1 [0070.084] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.084] CryptReleaseContext (hProv=0x3111e0, dwFlags=0x0) returned 1 [0070.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0070.084] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19008511239) returned 1 [0070.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb895cc10, dwHighDateTime=0x1d585b4)) [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5d38 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5d38 | out: hHeap=0x260000) returned 1 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c478 [0070.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.085] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.085] GetLastError () returned 0x0 [0070.085] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.085] GetLastError () returned 0x0 [0070.091] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd070, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.091] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x2f90, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2f90, lpOverlapped=0x0) returned 1 [0070.092] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.092] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.092] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.093] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.093] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.093] CloseHandle (hObject=0x108) returned 1 [0070.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.095] GetLastError () returned 0x0 [0070.280] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312500) returned 1 [0070.281] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.281] CryptReleaseContext (hProv=0x312500, dwFlags=0x0) returned 1 [0070.281] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.281] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19028235249) returned 1 [0070.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8b4bdf0, dwHighDateTime=0x1d585b4)) [0070.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.281] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28571d0 [0070.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28571d0 | out: hHeap=0x260000) returned 1 [0070.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x31acb0 [0070.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0070.282] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31acb0 | out: hHeap=0x260000) returned 1 [0070.282] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.282] GetLastError () returned 0x0 [0070.282] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.282] GetLastError () returned 0x0 [0070.291] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff7670, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.295] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x8990, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x8990, lpOverlapped=0x0) returned 1 [0070.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.301] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.301] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.302] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.302] CloseHandle (hObject=0xfc) returned 1 [0070.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.314] GetLastError () returned 0x0 [0070.314] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3111e0) returned 1 [0070.315] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.315] CryptReleaseContext (hProv=0x3111e0, dwFlags=0x0) returned 1 [0070.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.323] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19032441987) returned 1 [0070.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8b980b0, dwHighDateTime=0x1d585b4)) [0070.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cce8 [0070.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cce8 | out: hHeap=0x260000) returned 1 [0070.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.325] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0070.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.326] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.326] GetLastError () returned 0x0 [0070.326] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.326] GetLastError () returned 0x0 [0070.328] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc0a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.328] WriteFile (in: hFile=0xfc, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x3f60, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3f60, lpOverlapped=0x0) returned 1 [0070.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.329] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.329] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.329] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.329] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.330] CloseHandle (hObject=0xfc) returned 1 [0070.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.332] GetLastError () returned 0x0 [0070.332] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.333] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.333] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.333] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19033415941) returned 1 [0070.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8bbe210, dwHighDateTime=0x1d585b4)) [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ccb0 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ccb0 | out: hHeap=0x260000) returned 1 [0070.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.334] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.334] GetLastError () returned 0x0 [0070.334] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.334] GetLastError () returned 0x0 [0070.336] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffb282, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.336] WriteFile (in: hFile=0xfc, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x4d7e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x4d7e, lpOverlapped=0x0) returned 1 [0070.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.337] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.337] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.338] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.338] CloseHandle (hObject=0xfc) returned 1 [0070.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.[deadmin@cock.li].deadmin")) returned 1 [0070.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.340] GetLastError () returned 0x0 [0070.341] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.341] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.341] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.342] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19034278027) returned 1 [0070.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8be4370, dwHighDateTime=0x1d585b4)) [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c5fd8 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5fd8 | out: hHeap=0x260000) returned 1 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2971d8 [0070.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.343] GetLastError () returned 0x0 [0070.343] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.343] GetLastError () returned 0x0 [0070.345] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffff3670, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.345] WriteFile (in: hFile=0xfc, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xc990, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xc990, lpOverlapped=0x0) returned 1 [0070.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.346] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.346] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.346] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.347] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.347] CloseHandle (hObject=0xfc) returned 1 [0070.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.349] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.349] GetLastError () returned 0x0 [0070.349] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312368) returned 1 [0070.350] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0070.350] CryptReleaseContext (hProv=0x312368, dwFlags=0x0) returned 1 [0070.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.350] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19035120737) returned 1 [0070.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8be4370, dwHighDateTime=0x1d585b4)) [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2c6010 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c6010 | out: hHeap=0x260000) returned 1 [0070.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7de0 [0070.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7de0 | out: hHeap=0x260000) returned 1 [0070.351] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.351] GetLastError () returned 0x0 [0070.351] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.351] GetLastError () returned 0x0 [0070.482] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffb280, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.482] WriteFile (in: hFile=0xfc, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x4d80, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x4d80, lpOverlapped=0x0) returned 1 [0070.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.483] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.483] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.484] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.484] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.484] CloseHandle (hObject=0xfc) returned 1 [0070.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x28e6798 [0070.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.[deadmin@cock.li].deadmin")) returned 1 [0070.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28e6798 | out: hHeap=0x260000) returned 1 [0070.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.512] GetLastError () returned 0x0 [0070.513] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3122e0) returned 1 [0070.514] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.514] CryptReleaseContext (hProv=0x3122e0, dwFlags=0x0) returned 1 [0070.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.514] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19051523862) returned 1 [0070.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8d87290, dwHighDateTime=0x1d585b4)) [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a848 [0070.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a848 | out: hHeap=0x260000) returned 1 [0070.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.515] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec960 [0070.515] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.515] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.515] GetLastError () returned 0x0 [0070.515] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.515] GetLastError () returned 0x0 [0070.531] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffff814, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.531] WriteFile (in: hFile=0xfc, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x7ec, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x7ec, lpOverlapped=0x0) returned 1 [0070.532] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0070.532] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.532] WriteFile (in: hFile=0xfc, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.533] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.533] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.533] CloseHandle (hObject=0xfc) returned 1 [0070.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.[deadmin@cock.li].deadmin")) returned 1 [0070.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.535] GetLastError () returned 0x0 [0070.575] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312148) returned 1 [0070.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.576] CryptReleaseContext (hProv=0x312148, dwFlags=0x0) returned 1 [0070.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.576] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19057731423) returned 1 [0070.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8e1f810, dwHighDateTime=0x1d585b4)) [0070.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2858270 [0070.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2858270 | out: hHeap=0x260000) returned 1 [0070.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec370 [0070.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.577] GetLastError () returned 0x0 [0070.577] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.577] GetLastError () returned 0x0 [0070.580] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.580] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0070.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.582] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.582] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.583] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.583] CloseHandle (hObject=0x100) returned 1 [0070.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.[deadmin@cock.li].deadmin")) returned 1 [0070.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.585] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.585] GetLastError () returned 0x0 [0070.585] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312038) returned 1 [0070.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.586] CryptReleaseContext (hProv=0x312038, dwFlags=0x0) returned 1 [0070.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.586] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19058752226) returned 1 [0070.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8e1f810, dwHighDateTime=0x1d585b4)) [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a6f8 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a6f8 | out: hHeap=0x260000) returned 1 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7fd8 [0070.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2ec370 [0070.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x260000) returned 1 [0070.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.587] GetLastError () returned 0x0 [0070.587] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.587] GetLastError () returned 0x0 [0070.594] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.595] WriteFile (in: hFile=0x100, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0070.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0070.604] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.604] WriteFile (in: hFile=0x100, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.645] WriteFile (in: hFile=0x100, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.646] CloseHandle (hObject=0x100) returned 1 [0070.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0070.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.[deadmin@cock.li].deadmin")) returned 1 [0070.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0070.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.647] GetLastError () returned 0x0 [0070.656] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.657] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.658] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19065870320) returned 1 [0070.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8eddef0, dwHighDateTime=0x1d585b4)) [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x28583c0 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28583c0 | out: hHeap=0x260000) returned 1 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7d38 [0070.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2eb8c0 [0070.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x260000) returned 1 [0070.659] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.659] GetLastError () returned 0x0 [0070.659] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.659] GetLastError () returned 0x0 [0070.673] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.673] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x18780, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x18780, lpOverlapped=0x0) returned 1 [0070.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.675] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.675] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.675] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.675] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.676] CloseHandle (hObject=0x108) returned 1 [0070.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2b0890 [0070.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0070.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b0890 | out: hHeap=0x260000) returned 1 [0070.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.677] GetLastError () returned 0x0 [0070.678] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311ea0) returned 1 [0070.679] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.679] CryptReleaseContext (hProv=0x311ea0, dwFlags=0x0) returned 1 [0070.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0070.679] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19068006814) returned 1 [0070.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb8f04050, dwHighDateTime=0x1d585b4)) [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32cee0 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32cee0 | out: hHeap=0x260000) returned 1 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x356eb8 [0070.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296988 [0070.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x356eb8 | out: hHeap=0x260000) returned 1 [0070.680] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.680] GetLastError () returned 0x0 [0070.680] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.680] GetLastError () returned 0x0 [0070.695] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff447, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.695] WriteFile (in: hFile=0x108, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xbb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xbb9, lpOverlapped=0x0) returned 1 [0070.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.696] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.696] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.697] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.697] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.697] CloseHandle (hObject=0x108) returned 1 [0070.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.698] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.[deadmin@cock.li].deadmin")) returned 1 [0070.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0070.699] GetLastError () returned 0x0 [0070.744] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.767] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.767] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.788] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19078868873) returned 1 [0070.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb900e9f0, dwHighDateTime=0x1d585b4)) [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32a298 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32a298 | out: hHeap=0x260000) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x357008 [0070.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357008 | out: hHeap=0x260000) returned 1 [0070.788] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.788] GetLastError () returned 0x0 [0070.789] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.789] GetLastError () returned 0x0 [0070.798] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffe9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.798] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x161d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x161d, lpOverlapped=0x0) returned 1 [0070.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.799] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.799] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.800] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.800] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.800] CloseHandle (hObject=0xfc) returned 1 [0070.800] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.802] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.802] GetLastError () returned 0x0 [0070.802] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.803] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.803] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19080429137) returned 1 [0070.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9034b50, dwHighDateTime=0x1d585b4)) [0070.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cfb8 [0070.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cfb8 | out: hHeap=0x260000) returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.804] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.804] GetLastError () returned 0x0 [0070.804] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.804] GetLastError () returned 0x0 [0070.814] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xffffc39c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.814] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x3c64, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c64, lpOverlapped=0x0) returned 1 [0070.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.815] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.815] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.815] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.815] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.816] CloseHandle (hObject=0xfc) returned 1 [0070.816] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2845a08 [0070.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.818] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.818] GetLastError () returned 0x0 [0070.818] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.819] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.819] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19082025343) returned 1 [0070.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb905acb0, dwHighDateTime=0x1d585b4)) [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d308 [0070.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d308 | out: hHeap=0x260000) returned 1 [0070.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c7f30 [0070.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c7f30 | out: hHeap=0x260000) returned 1 [0070.820] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.820] GetLastError () returned 0x0 [0070.820] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.820] GetLastError () returned 0x0 [0070.849] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.849] WriteFile (in: hFile=0xfc, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0070.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.852] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.852] WriteFile (in: hFile=0xfc, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.853] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.853] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.854] CloseHandle (hObject=0xfc) returned 1 [0070.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0070.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0070.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.906] GetLastError () returned 0x0 [0070.908] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.908] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.908] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0070.908] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0070.910] CloseHandle (hObject=0x11c) returned 1 [0070.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282a8f0 | out: hHeap=0x260000) returned 1 [0070.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.910] RtlWakeConditionVariable () returned 0x27e828 [0070.910] GetCurrentThreadId () returned 0x9ac [0070.910] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.911] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.911] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.911] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19091225804) returned 1 [0070.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb913f4f0, dwHighDateTime=0x1d585b4)) [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d378 [0070.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d378 | out: hHeap=0x260000) returned 1 [0070.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.912] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.912] GetLastError () returned 0x0 [0070.912] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.912] GetLastError () returned 0x0 [0070.914] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff350, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.914] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xcb0, lpOverlapped=0x0) returned 1 [0070.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.915] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.915] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.916] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.916] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.917] CloseHandle (hObject=0x11c) returned 1 [0070.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0070.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css.[deadmin@cock.li].deadmin")) returned 1 [0070.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.919] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.919] GetLastError () returned 0x0 [0070.919] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311d90) returned 1 [0070.920] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0070.920] CryptReleaseContext (hProv=0x311d90, dwFlags=0x0) returned 1 [0070.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0070.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.920] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19092115190) returned 1 [0070.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9165650, dwHighDateTime=0x1d585b4)) [0070.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d228 [0070.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d228 | out: hHeap=0x260000) returned 1 [0070.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0070.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0070.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.922] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.922] GetLastError () returned 0x0 [0070.922] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.922] GetLastError () returned 0x0 [0070.925] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8e1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.925] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x71f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x71f, lpOverlapped=0x0) returned 1 [0070.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.925] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.926] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.926] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.926] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.927] CloseHandle (hObject=0x11c) returned 1 [0070.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0070.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css.[deadmin@cock.li].deadmin")) returned 1 [0070.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0070.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.928] GetLastError () returned 0x0 [0070.929] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.929] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.929] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.929] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.930] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19093077733) returned 1 [0070.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9165650, dwHighDateTime=0x1d585b4)) [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d6f8 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d6f8 | out: hHeap=0x260000) returned 1 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31bd50 [0070.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bd50 | out: hHeap=0x260000) returned 1 [0070.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.930] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.931] GetLastError () returned 0x0 [0070.931] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.931] GetLastError () returned 0x0 [0070.932] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.932] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0070.932] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.932] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.932] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.933] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.933] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.934] CloseHandle (hObject=0x11c) returned 1 [0070.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0070.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0070.935] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.936] GetLastError () returned 0x0 [0070.936] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0070.937] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0070.937] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0070.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a38 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0070.937] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19093791481) returned 1 [0070.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb918b7b0, dwHighDateTime=0x1d585b4)) [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793e8 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277c70 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d6c0 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0070.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d6c0 | out: hHeap=0x260000) returned 1 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31bd50 [0070.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0070.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31bd50 | out: hHeap=0x260000) returned 1 [0070.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0070.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0070.937] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0070.938] GetLastError () returned 0x0 [0070.938] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0070.938] GetLastError () returned 0x0 [0070.939] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.939] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0070.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0070.940] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.940] WriteFile (in: hFile=0x11c, lpBuffer=0x280a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a38*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0070.940] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0070.940] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0070.941] CloseHandle (hObject=0x11c) returned 1 [0070.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c138 [0070.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0070.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c138 | out: hHeap=0x260000) returned 1 [0070.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277c70 | out: hHeap=0x260000) returned 1 [0070.942] GetLastError () returned 0x0 [0070.981] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.981] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0070.981] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0070.981] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0070.984] CloseHandle (hObject=0x11c) returned 1 [0070.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30dbd8 | out: hHeap=0x260000) returned 1 [0070.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2845a08 | out: hHeap=0x260000) returned 1 [0070.984] RtlWakeConditionVariable () returned 0x27e828 [0070.984] GetCurrentThreadId () returned 0x9ac [0071.002] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.003] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.004] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.004] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19100493604) returned 1 [0071.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9223d30, dwHighDateTime=0x1d585b4)) [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2858e08 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2858e08 | out: hHeap=0x260000) returned 1 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.005] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.005] GetLastError () returned 0x0 [0071.005] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.005] GetLastError () returned 0x0 [0071.008] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.008] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0071.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.009] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.010] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.011] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.012] CloseHandle (hObject=0x11c) returned 1 [0071.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312e10 [0071.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312e10 | out: hHeap=0x260000) returned 1 [0071.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.015] GetLastError () returned 0x0 [0071.016] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.016] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.016] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.016] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.018] CloseHandle (hObject=0x11c) returned 1 [0071.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28201a0 | out: hHeap=0x260000) returned 1 [0071.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.018] RtlWakeConditionVariable () returned 0x27e828 [0071.018] GetCurrentThreadId () returned 0x9ac [0071.019] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.020] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.020] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.020] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19102093317) returned 1 [0071.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9249e90, dwHighDateTime=0x1d585b4)) [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d8f0 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d8f0 | out: hHeap=0x260000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.021] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.021] GetLastError () returned 0x0 [0071.021] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.021] GetLastError () returned 0x0 [0071.042] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff3c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.042] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0xc3c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0xc3c, lpOverlapped=0x0) returned 1 [0071.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.045] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.045] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.046] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.046] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.047] CloseHandle (hObject=0x11c) returned 1 [0071.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x31caf0 [0071.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css.[deadmin@cock.li].deadmin")) returned 1 [0071.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.049] GetLastError () returned 0x0 [0071.049] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.051] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.051] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19105195501) returned 1 [0071.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9296150, dwHighDateTime=0x1d585b4)) [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d8b8 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d8b8 | out: hHeap=0x260000) returned 1 [0071.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.052] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.052] GetLastError () returned 0x0 [0071.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.052] GetLastError () returned 0x0 [0071.056] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffe91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.056] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x16f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x16f, lpOverlapped=0x0) returned 1 [0071.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.057] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.057] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.058] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.058] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.076] CloseHandle (hObject=0x11c) returned 1 [0071.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.078] GetLastError () returned 0x0 [0071.078] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.079] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.079] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.079] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19108021127) returned 1 [0071.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb92e2410, dwHighDateTime=0x1d585b4)) [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d880 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d880 | out: hHeap=0x260000) returned 1 [0071.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.080] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.080] GetLastError () returned 0x0 [0071.080] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.080] GetLastError () returned 0x0 [0071.081] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.081] WriteFile (in: hFile=0x11c, lpBuffer=0x27fe080*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x27fe080*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0071.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27fe080 | out: hHeap=0x260000) returned 1 [0071.082] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.082] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.082] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.082] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.083] CloseHandle (hObject=0x11c) returned 1 [0071.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.128] GetLastError () returned 0x0 [0071.128] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.129] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.129] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.129] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19113047229) returned 1 [0071.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9354830, dwHighDateTime=0x1d585b4)) [0071.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32df88 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32df88 | out: hHeap=0x260000) returned 1 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x31beb8 [0071.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31beb8 | out: hHeap=0x260000) returned 1 [0071.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.130] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.130] GetLastError () returned 0x0 [0071.130] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.130] GetLastError () returned 0x0 [0071.133] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.133] WriteFile (in: hFile=0x11c, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x94, lpOverlapped=0x0) returned 1 [0071.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0071.134] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.134] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.134] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.134] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.135] CloseHandle (hObject=0x11c) returned 1 [0071.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.215] GetLastError () returned 0x0 [0071.215] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.216] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.216] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.216] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.216] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19121728313) returned 1 [0071.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9439070, dwHighDateTime=0x1d585b4)) [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ddc8 [0071.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ddc8 | out: hHeap=0x260000) returned 1 [0071.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.219] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.219] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.219] GetLastError () returned 0x0 [0071.221] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.221] GetLastError () returned 0x0 [0071.225] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.225] WriteFile (in: hFile=0x11c, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0071.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.227] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.227] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.228] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.228] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.228] CloseHandle (hObject=0x11c) returned 1 [0071.229] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c240 [0071.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c240 | out: hHeap=0x260000) returned 1 [0071.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.237] GetLastError () returned 0x0 [0071.237] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.237] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.237] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.237] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.269] CloseHandle (hObject=0x11c) returned 1 [0071.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28201a0 | out: hHeap=0x260000) returned 1 [0071.269] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0071.269] RtlWakeConditionVariable () returned 0x27e828 [0071.269] GetCurrentThreadId () returned 0x9ac [0071.270] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.271] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.271] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.271] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19127188918) returned 1 [0071.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb94ab490, dwHighDateTime=0x1d585b4)) [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32dd20 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32dd20 | out: hHeap=0x260000) returned 1 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.271] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.271] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.271] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.272] GetLastError () returned 0x0 [0071.272] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.272] GetLastError () returned 0x0 [0071.301] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff8ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.301] WriteFile (in: hFile=0x11c, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x752, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x752, lpOverlapped=0x0) returned 1 [0071.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.302] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.302] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.303] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.303] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.304] CloseHandle (hObject=0x11c) returned 1 [0071.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820298 [0071.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css.[deadmin@cock.li].deadmin")) returned 1 [0071.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820298 | out: hHeap=0x260000) returned 1 [0071.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.385] GetLastError () returned 0x0 [0071.590] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.590] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.590] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.590] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0071.591] CloseHandle (hObject=0xf0) returned 1 [0071.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30df78 | out: hHeap=0x260000) returned 1 [0071.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0071.591] RtlWakeConditionVariable () returned 0x27e828 [0071.591] GetCurrentThreadId () returned 0x9ac [0071.868] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.885] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.885] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.886] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19188677229) returned 1 [0071.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9a9eb90, dwHighDateTime=0x1d585b4)) [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e340 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e340 | out: hHeap=0x260000) returned 1 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.886] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.886] GetLastError () returned 0x0 [0071.887] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.887] GetLastError () returned 0x0 [0071.888] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff9cc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.888] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x634, lpOverlapped=0x0) returned 1 [0071.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.889] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.889] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.890] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.890] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.890] CloseHandle (hObject=0x108) returned 1 [0071.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c450 [0071.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c450 | out: hHeap=0x260000) returned 1 [0071.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.892] GetLastError () returned 0x0 [0071.892] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.893] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.893] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.893] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19189430866) returned 1 [0071.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9a9eb90, dwHighDateTime=0x1d585b4)) [0071.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e298 [0071.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e298 | out: hHeap=0x260000) returned 1 [0071.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.894] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.894] GetLastError () returned 0x0 [0071.894] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.894] GetLastError () returned 0x0 [0071.895] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffe54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.895] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x1ac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ac, lpOverlapped=0x0) returned 1 [0071.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.896] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.896] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.897] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.897] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.897] CloseHandle (hObject=0x108) returned 1 [0071.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c450 [0071.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c450 | out: hHeap=0x260000) returned 1 [0071.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.899] GetLastError () returned 0x0 [0071.899] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.900] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.900] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.900] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19190119081) returned 1 [0071.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9a9eb90, dwHighDateTime=0x1d585b4)) [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e260 [0071.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e260 | out: hHeap=0x260000) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.901] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.901] GetLastError () returned 0x0 [0071.901] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.901] GetLastError () returned 0x0 [0071.902] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.902] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0071.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.903] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.904] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.904] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.905] CloseHandle (hObject=0x108) returned 1 [0071.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c450 [0071.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c450 | out: hHeap=0x260000) returned 1 [0071.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.908] GetLastError () returned 0x0 [0071.909] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0071.909] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0071.909] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0071.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0071.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0071.910] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19191073033) returned 1 [0071.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xb9ac4cf0, dwHighDateTime=0x1d585b4)) [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32e228 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0071.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32e228 | out: hHeap=0x260000) returned 1 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0071.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0071.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0071.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0071.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0071.910] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0071.910] GetLastError () returned 0x0 [0071.911] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0071.911] GetLastError () returned 0x0 [0071.911] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.912] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0071.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0071.912] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.912] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0071.913] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0071.913] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0071.914] CloseHandle (hObject=0x108) returned 1 [0071.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c450 [0071.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0071.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c450 | out: hHeap=0x260000) returned 1 [0071.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0071.915] GetLastError () returned 0x0 [0071.916] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.916] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0071.916] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0071.916] WriteFile (in: hFile=0x108, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0072.196] CloseHandle (hObject=0x108) returned 1 [0072.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28201a0 | out: hHeap=0x260000) returned 1 [0072.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x31caf0 | out: hHeap=0x260000) returned 1 [0072.196] RtlWakeConditionVariable () returned 0x27e828 [0072.196] GetCurrentThreadId () returned 0x9ac [0072.409] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.409] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0072.409] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0072.409] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0072.411] CloseHandle (hObject=0x11c) returned 1 [0072.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e148 | out: hHeap=0x260000) returned 1 [0072.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0072.411] RtlWakeConditionVariable () returned 0x27e828 [0072.411] GetCurrentThreadId () returned 0x9ac [0072.596] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311bf8) returned 1 [0072.597] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.597] CryptReleaseContext (hProv=0x311bf8, dwFlags=0x0) returned 1 [0072.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.597] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19259789974) returned 1 [0072.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba150970, dwHighDateTime=0x1d585b4)) [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x285a650 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x285a650 | out: hHeap=0x260000) returned 1 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b700 [0072.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.597] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.598] GetLastError () returned 0x0 [0072.598] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.598] GetLastError () returned 0x0 [0072.618] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.618] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0072.619] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.619] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.645] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.645] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.645] CloseHandle (hObject=0xec) returned 1 [0072.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.662] GetLastError () returned 0x0 [0072.663] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311510) returned 1 [0072.664] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.664] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.664] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19266552048) returned 1 [0072.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba1e8ef0, dwHighDateTime=0x1d585b4)) [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d4c8 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d4c8 | out: hHeap=0x260000) returned 1 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277bc58 [0072.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.665] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.665] GetLastError () returned 0x0 [0072.666] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.666] GetLastError () returned 0x0 [0072.686] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.686] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0072.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.687] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.687] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.688] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.688] CloseHandle (hObject=0xec) returned 1 [0072.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.688] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.[deadmin@cock.li].deadmin")) returned 1 [0072.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.690] GetLastError () returned 0x0 [0072.691] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311c80) returned 1 [0072.692] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.692] CryptReleaseContext (hProv=0x311c80, dwFlags=0x0) returned 1 [0072.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.692] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19269293958) returned 1 [0072.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba2351b0, dwHighDateTime=0x1d585b4)) [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d1b8 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d1b8 | out: hHeap=0x260000) returned 1 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b408 [0072.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.693] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.693] GetLastError () returned 0x0 [0072.693] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.693] GetLastError () returned 0x0 [0072.705] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.705] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.706] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.706] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.731] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.731] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.732] CloseHandle (hObject=0xec) returned 1 [0072.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.745] GetLastError () returned 0x0 [0072.745] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311d08) returned 1 [0072.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.746] CryptReleaseContext (hProv=0x311d08, dwFlags=0x0) returned 1 [0072.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.746] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19274723487) returned 1 [0072.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba2cd730, dwHighDateTime=0x1d585b4)) [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32d0d8 [0072.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32d0d8 | out: hHeap=0x260000) returned 1 [0072.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ace8 [0072.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.747] GetLastError () returned 0x0 [0072.747] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.747] GetLastError () returned 0x0 [0072.756] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.756] WriteFile (in: hFile=0xec, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.758] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0072.759] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.759] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.765] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.766] CloseHandle (hObject=0xec) returned 1 [0072.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.766] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.768] GetLastError () returned 0x0 [0072.768] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311a60) returned 1 [0072.769] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.769] CryptReleaseContext (hProv=0x311a60, dwFlags=0x0) returned 1 [0072.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.769] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.769] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19277063311) returned 1 [0072.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba2f3890, dwHighDateTime=0x1d585b4)) [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ea40 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ea40 | out: hHeap=0x260000) returned 1 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.770] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.770] GetLastError () returned 0x0 [0072.770] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.771] GetLastError () returned 0x0 [0072.772] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffce88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.772] WriteFile (in: hFile=0xec, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x3178, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3178, lpOverlapped=0x0) returned 1 [0072.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0072.773] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.773] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.774] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.774] CloseHandle (hObject=0xec) returned 1 [0072.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.[deadmin@cock.li].deadmin")) returned 1 [0072.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.778] GetLastError () returned 0x0 [0072.779] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x312478) returned 1 [0072.780] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.780] CryptReleaseContext (hProv=0x312478, dwFlags=0x0) returned 1 [0072.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.780] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19278103098) returned 1 [0072.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba3199f0, dwHighDateTime=0x1d585b4)) [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ea08 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0072.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ea08 | out: hHeap=0x260000) returned 1 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0072.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.780] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0072.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.781] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.781] GetLastError () returned 0x0 [0072.781] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.781] GetLastError () returned 0x0 [0072.795] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.795] WriteFile (in: hFile=0xec, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0072.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0072.798] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.798] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.854] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.854] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.855] CloseHandle (hObject=0xec) returned 1 [0072.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0072.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.857] GetLastError () returned 0x0 [0072.857] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311510) returned 1 [0072.858] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.858] CryptReleaseContext (hProv=0x311510, dwFlags=0x0) returned 1 [0072.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.858] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19285922066) returned 1 [0072.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba3d80d0, dwHighDateTime=0x1d585b4)) [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3381c0 [0072.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3381c0 | out: hHeap=0x260000) returned 1 [0072.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315428 [0072.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a958 [0072.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315428 | out: hHeap=0x260000) returned 1 [0072.859] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.859] GetLastError () returned 0x0 [0072.859] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.859] GetLastError () returned 0x0 [0072.898] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffffd84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.898] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x27c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x27c, lpOverlapped=0x0) returned 1 [0072.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.899] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.899] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.900] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.900] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.900] CloseHandle (hObject=0xec) returned 1 [0072.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.902] GetLastError () returned 0x0 [0072.902] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x295d1d0) returned 1 [0072.903] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.903] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0072.903] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.903] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19290444396) returned 1 [0072.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba44a4f0, dwHighDateTime=0x1d585b4)) [0072.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337d60 [0072.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337d60 | out: hHeap=0x260000) returned 1 [0072.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x328d58 [0072.904] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.904] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.904] GetLastError () returned 0x0 [0072.904] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.904] GetLastError () returned 0x0 [0072.916] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffff6c7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.916] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x9382, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x9382, lpOverlapped=0x0) returned 1 [0072.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.917] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.917] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.918] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.919] CloseHandle (hObject=0xec) returned 1 [0072.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0072.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.[deadmin@cock.li].deadmin")) returned 1 [0072.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0072.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.920] GetLastError () returned 0x0 [0072.921] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x295d148) returned 1 [0072.922] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.922] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0072.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.922] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19292296914) returned 1 [0072.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba470650, dwHighDateTime=0x1d585b4)) [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7c70 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0072.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7c70 | out: hHeap=0x260000) returned 1 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0072.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0072.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0072.922] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b8c8 [0072.923] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0072.923] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0072.923] GetLastError () returned 0x0 [0072.923] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0072.923] GetLastError () returned 0x0 [0072.925] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffffd93, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.925] WriteFile (in: hFile=0xec, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x26d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x26d, lpOverlapped=0x0) returned 1 [0072.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0072.925] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.925] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0072.926] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0072.926] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0072.927] CloseHandle (hObject=0xec) returned 1 [0072.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0072.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0072.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0072.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0072.928] GetLastError () returned 0x0 [0072.929] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x295d148) returned 1 [0072.929] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0072.929] CryptReleaseContext (hProv=0x295d148, dwFlags=0x0) returned 1 [0072.930] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0072.930] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19293079830) returned 1 [0072.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba470650, dwHighDateTime=0x1d585b4)) [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7ca8 [0072.930] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7ca8 | out: hHeap=0x260000) returned 1 [0073.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.015] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a408 [0073.015] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.015] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.015] GetLastError () returned 0x0 [0073.015] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.015] GetLastError () returned 0x0 [0073.017] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.017] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xcd, lpOverlapped=0x0) returned 1 [0073.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.028] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.028] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.038] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.038] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.039] CloseHandle (hObject=0xec) returned 1 [0073.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.041] GetLastError () returned 0x0 [0073.041] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3118c8) returned 1 [0073.042] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.042] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.042] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19304320873) returned 1 [0073.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba5a1150, dwHighDateTime=0x1d585b4)) [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13a8 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a13a8 | out: hHeap=0x260000) returned 1 [0073.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a9f8 [0073.043] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.043] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.043] GetLastError () returned 0x0 [0073.043] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.043] GetLastError () returned 0x0 [0073.045] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.045] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0xcd, lpOverlapped=0x0) returned 1 [0073.046] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.046] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.046] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.047] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.047] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.047] CloseHandle (hObject=0xec) returned 1 [0073.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0073.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.049] GetLastError () returned 0x0 [0073.050] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3118c8) returned 1 [0073.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.050] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.051] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19305173594) returned 1 [0073.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba5a1150, dwHighDateTime=0x1d585b4)) [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1530 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1530 | out: hHeap=0x260000) returned 1 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a5d0 [0073.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.051] GetLastError () returned 0x0 [0073.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.052] GetLastError () returned 0x0 [0073.053] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.053] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x72, lpOverlapped=0x0) returned 1 [0073.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.054] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.054] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.055] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.055] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.056] CloseHandle (hObject=0xec) returned 1 [0073.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.057] GetLastError () returned 0x0 [0073.058] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3118c8) returned 1 [0073.059] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.059] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.059] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19306003514) returned 1 [0073.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba5c72b0, dwHighDateTime=0x1d585b4)) [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991a0 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991a0 | out: hHeap=0x260000) returned 1 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29a538 [0073.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.060] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.060] GetLastError () returned 0x0 [0073.060] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.060] GetLastError () returned 0x0 [0073.061] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.061] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x71, lpOverlapped=0x0) returned 1 [0073.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.062] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.062] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.062] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.062] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.063] CloseHandle (hObject=0xec) returned 1 [0073.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0073.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.065] GetLastError () returned 0x0 [0073.065] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3117b8) returned 1 [0073.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.066] CryptReleaseContext (hProv=0x3117b8, dwFlags=0x0) returned 1 [0073.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.066] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19306709059) returned 1 [0073.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba5c72b0, dwHighDateTime=0x1d585b4)) [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991d8 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2991d8 | out: hHeap=0x260000) returned 1 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.066] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b9f8 [0073.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.067] GetLastError () returned 0x0 [0073.067] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.067] GetLastError () returned 0x0 [0073.188] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.188] WriteFile (in: hFile=0xec, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.189] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.189] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.191] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.191] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.192] CloseHandle (hObject=0xec) returned 1 [0073.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.[deadmin@cock.li].deadmin")) returned 1 [0073.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.203] GetLastError () returned 0x0 [0073.204] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3118c8) returned 1 [0073.205] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.205] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.205] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19320600967) returned 1 [0073.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba71df10, dwHighDateTime=0x1d585b4)) [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299590 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299590 | out: hHeap=0x260000) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.205] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.205] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299fe0 [0073.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.206] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.206] GetLastError () returned 0x0 [0073.206] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.206] GetLastError () returned 0x0 [0073.209] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0xfffffbd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.209] WriteFile (in: hFile=0xec, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x42c, lpOverlapped=0x0) returned 1 [0073.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.209] SetFilePointerEx (in: hFile=0xec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.210] WriteFile (in: hFile=0xec, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.210] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.210] WriteFile (in: hFile=0xec, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.211] CloseHandle (hObject=0xec) returned 1 [0073.215] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.[deadmin@cock.li].deadmin")) returned 1 [0073.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.276] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.276] GetLastError () returned 0x0 [0073.277] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3118c8) returned 1 [0073.278] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27ef70 | out: pbBuffer=0x27ef70) returned 1 [0073.278] CryptReleaseContext (hProv=0x3118c8, dwFlags=0x0) returned 1 [0073.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.278] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19327906872) returned 1 [0073.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba7dc5f0, dwHighDateTime=0x1d585b4)) [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299558 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299558 | out: hHeap=0x260000) returned 1 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.278] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.278] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.279] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0073.279] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.279] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.279] GetLastError () returned 0x0 [0073.279] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.279] GetLastError () returned 0x0 [0073.281] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.281] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.283] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.283] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.283] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.287] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.287] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.287] CloseHandle (hObject=0x108) returned 1 [0073.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cd30 [0073.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cd30 | out: hHeap=0x260000) returned 1 [0073.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.289] GetLastError () returned 0x0 [0073.290] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311378) returned 1 [0073.290] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.290] CryptReleaseContext (hProv=0x311378, dwFlags=0x0) returned 1 [0073.290] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.291] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19329175465) returned 1 [0073.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xba802750, dwHighDateTime=0x1d585b4)) [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299520 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299520 | out: hHeap=0x260000) returned 1 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x299eb0 [0073.291] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.291] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.291] GetLastError () returned 0x0 [0073.292] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.292] GetLastError () returned 0x0 [0073.310] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.310] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0073.312] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.312] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.543] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.543] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.544] CloseHandle (hObject=0x108) returned 1 [0073.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2822ce0 [0073.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2822ce0 | out: hHeap=0x260000) returned 1 [0073.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.546] GetLastError () returned 0x0 [0073.546] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0073.547] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.547] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.547] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19354806990) returned 1 [0073.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaa63d50, dwHighDateTime=0x1d585b4)) [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd98 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd98 | out: hHeap=0x260000) returned 1 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758ea0 [0073.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.548] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.548] GetLastError () returned 0x0 [0073.548] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.548] GetLastError () returned 0x0 [0073.551] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.551] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3b80, lpOverlapped=0x0) returned 1 [0073.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.552] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.552] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.553] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.553] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.554] CloseHandle (hObject=0x108) returned 1 [0073.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0073.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.558] GetLastError () returned 0x0 [0073.558] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0073.559] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.559] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.559] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19356048668) returned 1 [0073.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaa89eb0, dwHighDateTime=0x1d585b4)) [0073.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0070 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0070 | out: hHeap=0x260000) returned 1 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x28162f8 [0073.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28162f8 | out: hHeap=0x260000) returned 1 [0073.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758b10 [0073.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.560] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.560] GetLastError () returned 0x0 [0073.560] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.560] GetLastError () returned 0x0 [0073.562] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.562] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.563] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.563] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.563] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.565] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.565] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.565] CloseHandle (hObject=0x108) returned 1 [0073.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0073.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.567] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.567] GetLastError () returned 0x0 [0073.568] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310af8) returned 1 [0073.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.569] CryptReleaseContext (hProv=0x310af8, dwFlags=0x0) returned 1 [0073.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.569] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19357032009) returned 1 [0073.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaa89eb0, dwHighDateTime=0x1d585b4)) [0073.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0038 [0073.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0038 | out: hHeap=0x260000) returned 1 [0073.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x314af8 [0073.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0073.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x314af8 | out: hHeap=0x260000) returned 1 [0073.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.570] GetLastError () returned 0x0 [0073.570] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.571] GetLastError () returned 0x0 [0073.573] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff9b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.573] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x648, lpOverlapped=0x0) returned 1 [0073.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.577] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.578] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.578] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.579] CloseHandle (hObject=0x108) returned 1 [0073.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2822ce0 [0073.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.[deadmin@cock.li].deadmin")) returned 1 [0073.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2822ce0 | out: hHeap=0x260000) returned 1 [0073.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.581] GetLastError () returned 0x0 [0073.582] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0073.582] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.582] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.583] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19358365901) returned 1 [0073.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaab0010, dwHighDateTime=0x1d585b4)) [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0000 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0000 | out: hHeap=0x260000) returned 1 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2758a78 [0073.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.583] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.583] GetLastError () returned 0x0 [0073.583] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.584] GetLastError () returned 0x0 [0073.593] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff2060, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.593] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xdfa0, lpOverlapped=0x0) returned 1 [0073.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.594] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.594] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.595] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.595] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.595] CloseHandle (hObject=0x108) returned 1 [0073.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c498 [0073.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.[deadmin@cock.li].deadmin")) returned 1 [0073.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c498 | out: hHeap=0x260000) returned 1 [0073.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.597] GetLastError () returned 0x0 [0073.598] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x310e28) returned 1 [0073.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.598] CryptReleaseContext (hProv=0x310e28, dwFlags=0x0) returned 1 [0073.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.599] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19359974906) returned 1 [0073.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaad6170, dwHighDateTime=0x1d585b4)) [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2effc8 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2effc8 | out: hHeap=0x260000) returned 1 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3154d0 [0073.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3154d0 | out: hHeap=0x260000) returned 1 [0073.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.599] GetLastError () returned 0x0 [0073.600] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.600] GetLastError () returned 0x0 [0073.610] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffbb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.610] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x44a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x44a, lpOverlapped=0x0) returned 1 [0073.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.615] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.615] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.615] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.615] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.616] CloseHandle (hObject=0x108) returned 1 [0073.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.[deadmin@cock.li].deadmin")) returned 1 [0073.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.618] GetLastError () returned 0x0 [0073.618] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x295d1d0) returned 1 [0073.619] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.619] CryptReleaseContext (hProv=0x295d1d0, dwFlags=0x0) returned 1 [0073.619] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.619] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19362030835) returned 1 [0073.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbab22430, dwHighDateTime=0x1d585b4)) [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d630 [0073.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d630 | out: hHeap=0x260000) returned 1 [0073.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0073.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.620] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.620] GetLastError () returned 0x0 [0073.620] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.620] GetLastError () returned 0x0 [0073.657] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb870, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.657] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x4790, lpOverlapped=0x0) returned 1 [0073.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.659] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.659] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.659] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.660] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.660] CloseHandle (hObject=0x108) returned 1 [0073.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0073.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0073.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.662] GetLastError () returned 0x0 [0073.662] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0073.663] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.663] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.664] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19366477601) returned 1 [0073.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbab94850, dwHighDateTime=0x1d585b4)) [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d470 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d470 | out: hHeap=0x260000) returned 1 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27589e0 [0073.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.664] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.665] GetLastError () returned 0x0 [0073.665] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.665] GetLastError () returned 0x0 [0073.672] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.672] WriteFile (in: hFile=0x108, lpBuffer=0x29250a0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29250a0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29250a0 | out: hHeap=0x260000) returned 1 [0073.673] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.673] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.681] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.681] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.682] CloseHandle (hObject=0x108) returned 1 [0073.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0073.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.[deadmin@cock.li].deadmin")) returned 1 [0073.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0073.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.685] GetLastError () returned 0x0 [0073.685] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0073.686] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.686] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0073.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.686] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19368761765) returned 1 [0073.687] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbabba9b0, dwHighDateTime=0x1d585b4)) [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d320 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d320 | out: hHeap=0x260000) returned 1 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x3152d8 [0073.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27588b0 [0073.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3152d8 | out: hHeap=0x260000) returned 1 [0073.687] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.687] GetLastError () returned 0x0 [0073.687] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.688] GetLastError () returned 0x0 [0073.764] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.764] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0073.766] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.766] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.867] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.867] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.868] CloseHandle (hObject=0x108) returned 1 [0073.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0073.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.869] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.869] GetLastError () returned 0x0 [0073.870] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756170) returned 1 [0073.871] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.871] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0073.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.871] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19387230355) returned 1 [0073.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbad83a30, dwHighDateTime=0x1d585b4)) [0073.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d178 [0073.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d178 | out: hHeap=0x260000) returned 1 [0073.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x28162f8 [0073.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28162f8 | out: hHeap=0x260000) returned 1 [0073.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324e80 [0073.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.872] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.872] GetLastError () returned 0x0 [0073.872] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.872] GetLastError () returned 0x0 [0073.879] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff579, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.879] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa87, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xa87, lpOverlapped=0x0) returned 1 [0073.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.880] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.880] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.881] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.881] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.882] CloseHandle (hObject=0x108) returned 1 [0073.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.[deadmin@cock.li].deadmin")) returned 1 [0073.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.884] GetLastError () returned 0x0 [0073.884] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756060) returned 1 [0073.885] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.885] CryptReleaseContext (hProv=0x2756060, dwFlags=0x0) returned 1 [0073.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.885] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19388622800) returned 1 [0073.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbada9b90, dwHighDateTime=0x1d585b4)) [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb90 [0073.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb90 | out: hHeap=0x260000) returned 1 [0073.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x28162f8 [0073.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28162f8 | out: hHeap=0x260000) returned 1 [0073.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0073.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.886] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.886] GetLastError () returned 0x0 [0073.886] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.886] GetLastError () returned 0x0 [0073.889] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.892] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0073.893] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.893] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.893] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.929] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.929] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.932] CloseHandle (hObject=0x108) returned 1 [0073.932] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.932] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.[deadmin@cock.li].deadmin")) returned 1 [0073.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.939] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.939] GetLastError () returned 0x0 [0073.939] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756170) returned 1 [0073.941] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0073.942] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0073.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.942] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19394286876) returned 1 [0073.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbae1bfb0, dwHighDateTime=0x1d585b4)) [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d220 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d220 | out: hHeap=0x260000) returned 1 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324e80 [0073.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.942] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.943] GetLastError () returned 0x0 [0073.943] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.943] GetLastError () returned 0x0 [0073.946] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.946] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0073.947] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.947] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.947] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.952] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.954] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.961] CloseHandle (hObject=0x108) returned 1 [0073.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.[deadmin@cock.li].deadmin")) returned 1 [0073.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.970] GetLastError () returned 0x0 [0073.972] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756390) returned 1 [0073.978] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f128 | out: pbBuffer=0x27f128) returned 1 [0073.978] CryptReleaseContext (hProv=0x2756390, dwFlags=0x0) returned 1 [0073.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f128 | out: hHeap=0x260000) returned 1 [0073.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0073.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.978] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19397936808) returned 1 [0073.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbae8e3d0, dwHighDateTime=0x1d585b4)) [0073.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0073.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.978] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d4e0 [0073.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d4e0 | out: hHeap=0x260000) returned 1 [0073.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.979] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0073.979] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.979] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.979] GetLastError () returned 0x0 [0073.979] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.979] GetLastError () returned 0x0 [0073.981] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.981] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0073.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.982] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.983] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.983] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.983] CloseHandle (hObject=0x108) returned 1 [0073.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c7b8 [0073.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.[deadmin@cock.li].deadmin")) returned 1 [0073.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c7b8 | out: hHeap=0x260000) returned 1 [0073.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.985] GetLastError () returned 0x0 [0073.986] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756060) returned 1 [0073.987] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.987] CryptReleaseContext (hProv=0x2756060, dwFlags=0x0) returned 1 [0073.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.987] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19398834184) returned 1 [0073.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbae8e3d0, dwHighDateTime=0x1d585b4)) [0073.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d518 [0073.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0073.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d518 | out: hHeap=0x260000) returned 1 [0073.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0073.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0073.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0073.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0073.988] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.988] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.988] GetLastError () returned 0x0 [0073.988] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.988] GetLastError () returned 0x0 [0073.991] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffeb680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.991] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x14980, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x14980, lpOverlapped=0x0) returned 1 [0073.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0073.992] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.992] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0073.992] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0073.992] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0073.993] CloseHandle (hObject=0x108) returned 1 [0073.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x357300 [0073.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.[deadmin@cock.li].deadmin")) returned 1 [0073.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x357300 | out: hHeap=0x260000) returned 1 [0073.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0073.995] GetLastError () returned 0x0 [0073.996] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756170) returned 1 [0073.997] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0073.997] CryptReleaseContext (hProv=0x2756170, dwFlags=0x0) returned 1 [0073.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0073.997] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19399812353) returned 1 [0073.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaeb4530, dwHighDateTime=0x1d585b4)) [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d550 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0073.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d550 | out: hHeap=0x260000) returned 1 [0073.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x28162f8 [0073.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0073.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0073.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28162f8 | out: hHeap=0x260000) returned 1 [0073.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3269d0 [0073.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0073.998] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0073.998] GetLastError () returned 0x0 [0073.998] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0073.998] GetLastError () returned 0x0 [0074.008] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.008] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x780, lpOverlapped=0x0) returned 1 [0074.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.009] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.009] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.010] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.010] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.011] CloseHandle (hObject=0x108) returned 1 [0074.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.[deadmin@cock.li].deadmin")) returned 1 [0074.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0074.035] GetLastError () returned 0x0 [0074.038] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756280) returned 1 [0074.040] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.040] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0074.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.040] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19404162918) returned 1 [0074.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaf26950, dwHighDateTime=0x1d585b4)) [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d5f8 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d5f8 | out: hHeap=0x260000) returned 1 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326938 [0074.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.041] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.041] GetLastError () returned 0x0 [0074.042] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.042] GetLastError () returned 0x0 [0074.043] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.043] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2980, lpOverlapped=0x0) returned 1 [0074.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.045] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.045] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.046] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.046] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.047] CloseHandle (hObject=0x108) returned 1 [0074.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.[deadmin@cock.li].deadmin")) returned 1 [0074.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0074.048] GetLastError () returned 0x0 [0074.049] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756280) returned 1 [0074.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.050] CryptReleaseContext (hProv=0x2756280, dwFlags=0x0) returned 1 [0074.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.050] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19405132145) returned 1 [0074.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbaf26950, dwHighDateTime=0x1d585b4)) [0074.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0074.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30d710 [0074.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30d710 | out: hHeap=0x260000) returned 1 [0074.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326808 [0074.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.051] GetLastError () returned 0x0 [0074.051] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.051] GetLastError () returned 0x0 [0074.191] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.196] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.210] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.212] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.314] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.314] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.315] CloseHandle (hObject=0x108) returned 1 [0074.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0074.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0074.317] GetLastError () returned 0x0 [0074.317] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27566c0) returned 1 [0074.318] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.318] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.318] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19431932834) returned 1 [0074.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb1ae0b0, dwHighDateTime=0x1d585b4)) [0074.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0074.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0074.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1488 | out: hHeap=0x260000) returned 1 [0074.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3253d8 [0074.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.319] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.319] GetLastError () returned 0x0 [0074.320] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.320] GetLastError () returned 0x0 [0074.323] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffb200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.323] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x4e00, lpOverlapped=0x0) returned 1 [0074.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0074.324] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.324] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.325] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.325] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.325] CloseHandle (hObject=0x108) returned 1 [0074.325] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.[deadmin@cock.li].deadmin")) returned 1 [0074.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0074.327] GetLastError () returned 0x0 [0074.328] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27566c0) returned 1 [0074.328] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.328] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.329] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19432970185) returned 1 [0074.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb1d4210, dwHighDateTime=0x1d585b4)) [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1450 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1450 | out: hHeap=0x260000) returned 1 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326180 [0074.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.329] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.329] GetLastError () returned 0x0 [0074.330] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.330] GetLastError () returned 0x0 [0074.331] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.331] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x3000, lpOverlapped=0x0) returned 1 [0074.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0074.332] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.332] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.333] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.334] CloseHandle (hObject=0x108) returned 1 [0074.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.[deadmin@cock.li].deadmin")) returned 1 [0074.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0074.335] GetLastError () returned 0x0 [0074.336] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27566c0) returned 1 [0074.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.337] CryptReleaseContext (hProv=0x27566c0, dwFlags=0x0) returned 1 [0074.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.337] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19433806396) returned 1 [0074.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb1fa370, dwHighDateTime=0x1d585b4)) [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cb20 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0074.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30cb20 | out: hHeap=0x260000) returned 1 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0074.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x315620 [0074.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277ad80 [0074.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x315620 | out: hHeap=0x260000) returned 1 [0074.338] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.338] GetLastError () returned 0x0 [0074.338] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.338] GetLastError () returned 0x0 [0074.427] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffde00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.427] WriteFile (in: hFile=0x108, lpBuffer=0x290c098*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x290c098*, lpNumberOfBytesWritten=0x24cfdb0*=0x2200, lpOverlapped=0x0) returned 1 [0074.428] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290c098 | out: hHeap=0x260000) returned 1 [0074.428] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.429] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.429] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.429] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.430] CloseHandle (hObject=0x108) returned 1 [0074.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0074.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.[deadmin@cock.li].deadmin")) returned 1 [0074.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0074.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277eb0 | out: hHeap=0x260000) returned 1 [0074.686] GetLastError () returned 0x0 [0074.817] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0074.828] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.828] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.852] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19485270023) returned 1 [0074.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb6e30d0, dwHighDateTime=0x1d585b4)) [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f51d0 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f51d0 | out: hHeap=0x260000) returned 1 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752648 [0074.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752648 | out: hHeap=0x260000) returned 1 [0074.852] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.853] GetLastError () returned 0x0 [0074.853] GetLastError () returned 0x0 [0074.853] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.853] GetLastError () returned 0x0 [0074.853] GetLastError () returned 0x0 [0074.857] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.858] WriteFile (in: hFile=0xfc, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.860] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.860] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.861] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.861] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.862] CloseHandle (hObject=0xfc) returned 1 [0074.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0074.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css.[deadmin@cock.li].deadmin")) returned 1 [0074.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0074.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0074.863] GetLastError () returned 0x0 [0074.864] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0074.865] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.865] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.866] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19486677169) returned 1 [0074.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb709230, dwHighDateTime=0x1d585b4)) [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5208 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5208 | out: hHeap=0x260000) returned 1 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27524f8 [0074.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27524f8 | out: hHeap=0x260000) returned 1 [0074.866] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.867] GetLastError () returned 0x0 [0074.867] GetLastError () returned 0x0 [0074.867] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.867] GetLastError () returned 0x0 [0074.867] GetLastError () returned 0x0 [0074.870] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.870] WriteFile (in: hFile=0xfc, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.871] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.871] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.872] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.872] CloseHandle (hObject=0xfc) returned 1 [0074.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0074.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css.[deadmin@cock.li].deadmin")) returned 1 [0074.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0074.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0074.874] GetLastError () returned 0x0 [0074.874] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0074.875] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.875] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.875] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19487653759) returned 1 [0074.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb709230, dwHighDateTime=0x1d585b4)) [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5240 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5240 | out: hHeap=0x260000) returned 1 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752798 [0074.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752798 | out: hHeap=0x260000) returned 1 [0074.876] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.876] GetLastError () returned 0x0 [0074.876] GetLastError () returned 0x0 [0074.877] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.877] GetLastError () returned 0x0 [0074.877] GetLastError () returned 0x0 [0074.881] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.881] WriteFile (in: hFile=0xfc, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.882] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.882] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.882] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.882] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.883] CloseHandle (hObject=0xfc) returned 1 [0074.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0074.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css.[deadmin@cock.li].deadmin")) returned 1 [0074.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0074.885] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0074.885] GetLastError () returned 0x0 [0074.885] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0074.886] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0074.886] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0074.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0074.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0074.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0074.886] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19488739378) returned 1 [0074.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb72f390, dwHighDateTime=0x1d585b4)) [0074.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0074.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0074.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0074.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5278 [0074.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0074.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5278 | out: hHeap=0x260000) returned 1 [0074.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0074.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0074.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752840 [0074.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0074.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0074.887] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752840 | out: hHeap=0x260000) returned 1 [0074.887] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0074.887] GetLastError () returned 0x0 [0074.887] GetLastError () returned 0x0 [0074.887] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0074.888] GetLastError () returned 0x0 [0074.888] GetLastError () returned 0x0 [0074.969] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.969] WriteFile (in: hFile=0xfc, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0074.971] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0074.971] SetFilePointerEx (in: hFile=0xfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.971] WriteFile (in: hFile=0xfc, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0074.995] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0074.995] WriteFile (in: hFile=0xfc, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0074.996] CloseHandle (hObject=0xfc) returned 1 [0074.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0074.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css.[deadmin@cock.li].deadmin")) returned 1 [0074.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0074.999] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0074.999] GetLastError () returned 0x0 [0075.007] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.008] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.008] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.008] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19500898125) returned 1 [0075.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb85fe90, dwHighDateTime=0x1d585b4)) [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x288e900 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x288e900 | out: hHeap=0x260000) returned 1 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27528e8 [0075.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27528e8 | out: hHeap=0x260000) returned 1 [0075.009] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.009] GetLastError () returned 0x0 [0075.009] GetLastError () returned 0x0 [0075.009] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.009] GetLastError () returned 0x0 [0075.009] GetLastError () returned 0x0 [0075.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.012] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0075.013] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.013] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.015] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.015] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.016] CloseHandle (hObject=0xf0) returned 1 [0075.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css.[deadmin@cock.li].deadmin")) returned 1 [0075.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0075.018] GetLastError () returned 0x0 [0075.018] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.019] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.019] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.019] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.019] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19502025424) returned 1 [0075.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb85fe90, dwHighDateTime=0x1d585b4)) [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5320 [0075.019] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5320 | out: hHeap=0x260000) returned 1 [0075.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752a38 [0075.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.020] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752a38 | out: hHeap=0x260000) returned 1 [0075.020] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.020] GetLastError () returned 0x0 [0075.020] GetLastError () returned 0x0 [0075.020] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.020] GetLastError () returned 0x0 [0075.021] GetLastError () returned 0x0 [0075.024] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.024] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0075.025] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.025] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.027] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.028] CloseHandle (hObject=0xf0) returned 1 [0075.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css.[deadmin@cock.li].deadmin")) returned 1 [0075.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0075.030] GetLastError () returned 0x0 [0075.030] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0075.031] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.031] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19503224525) returned 1 [0075.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbb885ff0, dwHighDateTime=0x1d585b4)) [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5358 [0075.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5358 | out: hHeap=0x260000) returned 1 [0075.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752ae0 [0075.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x326640 [0075.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752ae0 | out: hHeap=0x260000) returned 1 [0075.032] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.032] GetLastError () returned 0x0 [0075.032] GetLastError () returned 0x0 [0075.032] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.032] GetLastError () returned 0x0 [0075.033] GetLastError () returned 0x0 [0075.319] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.319] WriteFile (in: hFile=0xf0, lpBuffer=0x293e0a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293e0a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293e0a8 | out: hHeap=0x260000) returned 1 [0075.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.321] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.402] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.402] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.402] CloseHandle (hObject=0xf0) returned 1 [0075.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css.[deadmin@cock.li].deadmin")) returned 1 [0075.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0075.404] GetLastError () returned 0x0 [0075.404] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0075.405] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0075.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.405] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19540653620) returned 1 [0075.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbbc180f0, dwHighDateTime=0x1d585b4)) [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e40 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e40 | out: hHeap=0x260000) returned 1 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2752b88 [0075.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2752b88 | out: hHeap=0x260000) returned 1 [0075.406] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.406] GetLastError () returned 0x0 [0075.407] GetLastError () returned 0x0 [0075.407] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.407] GetLastError () returned 0x0 [0075.407] GetLastError () returned 0x0 [0075.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.409] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.410] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.410] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.412] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.412] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.413] CloseHandle (hObject=0xf0) returned 1 [0075.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css.[deadmin@cock.li].deadmin")) returned 1 [0075.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0075.414] GetLastError () returned 0x0 [0075.415] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.415] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0075.415] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.416] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19541678601) returned 1 [0075.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbbc3e250, dwHighDateTime=0x1d585b4)) [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337e78 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337e78 | out: hHeap=0x260000) returned 1 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27532c0 [0075.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27532c0 | out: hHeap=0x260000) returned 1 [0075.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.417] GetLastError () returned 0x0 [0075.417] GetLastError () returned 0x0 [0075.417] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.417] GetLastError () returned 0x0 [0075.417] GetLastError () returned 0x0 [0075.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.419] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.420] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.422] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.422] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.423] CloseHandle (hObject=0xf0) returned 1 [0075.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css.[deadmin@cock.li].deadmin")) returned 1 [0075.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0075.424] GetLastError () returned 0x0 [0075.425] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0075.426] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0075.426] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19542685374) returned 1 [0075.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbbc3e250, dwHighDateTime=0x1d585b4)) [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2780f0 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x337eb0 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x337eb0 | out: hHeap=0x260000) returned 1 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753368 [0075.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753368 | out: hHeap=0x260000) returned 1 [0075.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.427] GetLastError () returned 0x0 [0075.427] GetLastError () returned 0x0 [0075.427] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.427] GetLastError () returned 0x0 [0075.427] GetLastError () returned 0x0 [0075.430] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.430] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.431] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.432] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.432] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.433] CloseHandle (hObject=0xf0) returned 1 [0075.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0075.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css.[deadmin@cock.li].deadmin")) returned 1 [0075.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0075.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2780f0 | out: hHeap=0x260000) returned 1 [0075.434] GetLastError () returned 0x0 [0075.772] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.773] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.773] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0075.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0075.784] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19578546852) returned 1 [0075.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbbfaa1f0, dwHighDateTime=0x1d585b4)) [0075.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0075.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0075.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0075.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0075.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2995c8 | out: hHeap=0x260000) returned 1 [0075.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753aa0 [0075.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753aa0 | out: hHeap=0x260000) returned 1 [0075.795] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.795] GetLastError () returned 0x0 [0075.801] GetLastError () returned 0x0 [0075.801] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.801] GetLastError () returned 0x0 [0075.801] GetLastError () returned 0x0 [0075.804] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.805] WriteFile (in: hFile=0xe8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.805] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0075.806] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.806] WriteFile (in: hFile=0xe8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.806] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.806] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.807] CloseHandle (hObject=0xe8) returned 1 [0075.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css.[deadmin@cock.li].deadmin")) returned 1 [0075.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0075.828] GetLastError () returned 0x0 [0075.829] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.853] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.853] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0075.853] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19585394279) returned 1 [0075.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc0688d0, dwHighDateTime=0x1d585b4)) [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338038 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338038 | out: hHeap=0x260000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753c98 [0075.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753c98 | out: hHeap=0x260000) returned 1 [0075.854] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.854] GetLastError () returned 0x0 [0075.854] GetLastError () returned 0x0 [0075.854] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.854] GetLastError () returned 0x0 [0075.854] GetLastError () returned 0x0 [0075.859] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.860] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0075.862] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.862] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.863] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.863] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.863] CloseHandle (hObject=0xd8) returned 1 [0075.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css.[deadmin@cock.li].deadmin")) returned 1 [0075.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0075.865] GetLastError () returned 0x0 [0075.865] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.866] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.866] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0075.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0075.866] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19586742005) returned 1 [0075.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc08ea30, dwHighDateTime=0x1d585b4)) [0075.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0075.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0075.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0075.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3380a8 [0075.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380a8 | out: hHeap=0x260000) returned 1 [0075.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753d40 [0075.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753d40 | out: hHeap=0x260000) returned 1 [0075.867] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.867] GetLastError () returned 0x0 [0075.867] GetLastError () returned 0x0 [0075.867] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.868] GetLastError () returned 0x0 [0075.868] GetLastError () returned 0x0 [0075.870] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.870] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0075.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0075.871] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.872] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0075.872] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0075.872] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0075.873] CloseHandle (hObject=0xd8) returned 1 [0075.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0075.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css.[deadmin@cock.li].deadmin")) returned 1 [0075.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0075.874] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0075.874] GetLastError () returned 0x0 [0075.875] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0075.876] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0075.876] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0075.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0075.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0075.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0075.876] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19587759474) returned 1 [0075.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc08ea30, dwHighDateTime=0x1d585b4)) [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3380e0 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0075.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3380e0 | out: hHeap=0x260000) returned 1 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0075.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2753e90 [0075.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0075.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277a108 [0075.877] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2753e90 | out: hHeap=0x260000) returned 1 [0075.877] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0075.877] GetLastError () returned 0x0 [0075.878] GetLastError () returned 0x0 [0075.878] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0075.878] GetLastError () returned 0x0 [0075.878] GetLastError () returned 0x0 [0076.004] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.004] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0076.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.006] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.006] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.006] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.006] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.007] CloseHandle (hObject=0xd8) returned 1 [0076.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2f9d70 [0076.007] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css.[deadmin@cock.li].deadmin")) returned 1 [0076.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f9d70 | out: hHeap=0x260000) returned 1 [0076.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0076.009] GetLastError () returned 0x0 [0076.036] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.045] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.046] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.051] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19605175108) returned 1 [0076.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc257ab0, dwHighDateTime=0x1d585b4)) [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2998d8 | out: hHeap=0x260000) returned 1 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8c28 [0076.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8c28 | out: hHeap=0x260000) returned 1 [0076.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.051] GetLastError () returned 0x0 [0076.052] GetLastError () returned 0x0 [0076.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.052] GetLastError () returned 0x0 [0076.052] GetLastError () returned 0x0 [0076.055] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc44b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.055] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3bb5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3bb5, lpOverlapped=0x0) returned 1 [0076.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.056] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.056] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.056] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.056] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.057] CloseHandle (hObject=0x108) returned 1 [0076.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.057] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.059] GetLastError () returned 0x0 [0076.059] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.060] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.060] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.060] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19606102422) returned 1 [0076.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc257ab0, dwHighDateTime=0x1d585b4)) [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294b48 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294b48 | out: hHeap=0x260000) returned 1 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8a30 [0076.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8a30 | out: hHeap=0x260000) returned 1 [0076.061] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.061] GetLastError () returned 0x0 [0076.061] GetLastError () returned 0x0 [0076.061] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.061] GetLastError () returned 0x0 [0076.061] GetLastError () returned 0x0 [0076.063] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffe348, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.063] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1cb8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1cb8, lpOverlapped=0x0) returned 1 [0076.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.064] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.064] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.065] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.065] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.065] CloseHandle (hObject=0x108) returned 1 [0076.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.067] GetLastError () returned 0x0 [0076.067] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.068] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.068] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.068] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.068] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19606963220) returned 1 [0076.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc27dc10, dwHighDateTime=0x1d585b4)) [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1800 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1800 | out: hHeap=0x260000) returned 1 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8d78 [0076.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8d78 | out: hHeap=0x260000) returned 1 [0076.069] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.070] GetLastError () returned 0x0 [0076.070] GetLastError () returned 0x0 [0076.070] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.070] GetLastError () returned 0x0 [0076.070] GetLastError () returned 0x0 [0076.072] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc661, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.072] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x399f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x399f, lpOverlapped=0x0) returned 1 [0076.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.073] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.073] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.074] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.074] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.075] CloseHandle (hObject=0x108) returned 1 [0076.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.076] GetLastError () returned 0x0 [0076.077] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.078] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.078] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.078] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19607937508) returned 1 [0076.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc27dc10, dwHighDateTime=0x1d585b4)) [0076.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1838 [0076.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1838 | out: hHeap=0x260000) returned 1 [0076.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c8e20 [0076.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a228 [0076.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c8e20 | out: hHeap=0x260000) returned 1 [0076.079] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.079] GetLastError () returned 0x0 [0076.079] GetLastError () returned 0x0 [0076.079] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.079] GetLastError () returned 0x0 [0076.080] GetLastError () returned 0x0 [0076.148] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd449, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.148] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2bb7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2bb7, lpOverlapped=0x0) returned 1 [0076.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.148] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.148] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.149] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.150] CloseHandle (hObject=0x108) returned 1 [0076.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.159] GetLastError () returned 0x0 [0076.274] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.300] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.300] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.300] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19630126629) returned 1 [0076.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc4b90b0, dwHighDateTime=0x1d585b4)) [0076.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.300] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca3d8 [0076.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca3d8 | out: hHeap=0x260000) returned 1 [0076.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9be8 [0076.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.301] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9be8 | out: hHeap=0x260000) returned 1 [0076.301] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.301] GetLastError () returned 0x0 [0076.301] GetLastError () returned 0x0 [0076.301] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.302] GetLastError () returned 0x0 [0076.302] GetLastError () returned 0x0 [0076.303] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffcec5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.304] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x313b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x313b, lpOverlapped=0x0) returned 1 [0076.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.305] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.305] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.306] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.306] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.307] CloseHandle (hObject=0xe4) returned 1 [0076.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.309] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.310] GetLastError () returned 0x0 [0076.310] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.311] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.311] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.311] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19631208627) returned 1 [0076.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc4b90b0, dwHighDateTime=0x1d585b4)) [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294dd0 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294dd0 | out: hHeap=0x260000) returned 1 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c92b8 [0076.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c92b8 | out: hHeap=0x260000) returned 1 [0076.312] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.312] GetLastError () returned 0x0 [0076.312] GetLastError () returned 0x0 [0076.312] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.312] GetLastError () returned 0x0 [0076.312] GetLastError () returned 0x0 [0076.314] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd2ed, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.314] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2d13, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2d13, lpOverlapped=0x0) returned 1 [0076.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.315] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.315] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.316] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.316] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.316] CloseHandle (hObject=0xe4) returned 1 [0076.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.316] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.318] GetLastError () returned 0x0 [0076.318] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.319] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.319] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.319] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19632038230) returned 1 [0076.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc4df210, dwHighDateTime=0x1d585b4)) [0076.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2954d0 [0076.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2954d0 | out: hHeap=0x260000) returned 1 [0076.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9d38 [0076.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.320] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.320] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9d38 | out: hHeap=0x260000) returned 1 [0076.320] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.320] GetLastError () returned 0x0 [0076.320] GetLastError () returned 0x0 [0076.320] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.320] GetLastError () returned 0x0 [0076.321] GetLastError () returned 0x0 [0076.336] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffee87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.336] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1179, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1179, lpOverlapped=0x0) returned 1 [0076.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.337] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.337] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.338] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.339] CloseHandle (hObject=0xe4) returned 1 [0076.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.341] GetLastError () returned 0x0 [0076.341] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.342] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x2777d0 | out: pbBuffer=0x2777d0) returned 1 [0076.342] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2777d0 | out: hHeap=0x260000) returned 1 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0076.342] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19634292110) returned 1 [0076.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc505370, dwHighDateTime=0x1d585b4)) [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295540 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295540 | out: hHeap=0x260000) returned 1 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2c9de0 [0076.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.342] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ab10 [0076.342] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c9de0 | out: hHeap=0x260000) returned 1 [0076.342] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.343] GetLastError () returned 0x0 [0076.343] GetLastError () returned 0x0 [0076.343] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.343] GetLastError () returned 0x0 [0076.343] GetLastError () returned 0x0 [0076.378] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffee14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.378] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x11ec, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x11ec, lpOverlapped=0x0) returned 1 [0076.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.380] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.380] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.381] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.382] CloseHandle (hObject=0xe4) returned 1 [0076.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0076.456] GetLastError () returned 0x0 [0076.478] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.500] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.500] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.500] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19650098305) returned 1 [0076.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc682130, dwHighDateTime=0x1d585b4)) [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca7c8 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca7c8 | out: hHeap=0x260000) returned 1 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc838 [0076.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc838 | out: hHeap=0x260000) returned 1 [0076.501] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.501] GetLastError () returned 0x0 [0076.501] GetLastError () returned 0x0 [0076.501] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.501] GetLastError () returned 0x0 [0076.501] GetLastError () returned 0x0 [0076.505] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff2d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.505] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd2c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xd2c, lpOverlapped=0x0) returned 1 [0076.506] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.506] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.506] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.506] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.507] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.507] CloseHandle (hObject=0x11c) returned 1 [0076.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.509] GetLastError () returned 0x0 [0076.509] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.510] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.510] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.510] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19651116678) returned 1 [0076.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc6a8290, dwHighDateTime=0x1d585b4)) [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca800 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca800 | out: hHeap=0x260000) returned 1 [0076.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc640 [0076.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc640 | out: hHeap=0x260000) returned 1 [0076.511] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.511] GetLastError () returned 0x0 [0076.511] GetLastError () returned 0x0 [0076.511] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.511] GetLastError () returned 0x0 [0076.511] GetLastError () returned 0x0 [0076.513] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe117, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.513] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1ee9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ee9, lpOverlapped=0x0) returned 1 [0076.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.514] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.514] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.515] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.515] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.516] CloseHandle (hObject=0x11c) returned 1 [0076.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.516] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.517] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.517] GetLastError () returned 0x0 [0076.517] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.518] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.518] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.518] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.519] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19651973621) returned 1 [0076.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc6ce3f0, dwHighDateTime=0x1d585b4)) [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca838 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca838 | out: hHeap=0x260000) returned 1 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cc988 [0076.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc988 | out: hHeap=0x260000) returned 1 [0076.519] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.519] GetLastError () returned 0x0 [0076.520] GetLastError () returned 0x0 [0076.520] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.520] GetLastError () returned 0x0 [0076.520] GetLastError () returned 0x0 [0076.522] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffecb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.522] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1349, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1349, lpOverlapped=0x0) returned 1 [0076.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.523] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.523] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.523] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.523] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.524] CloseHandle (hObject=0x11c) returned 1 [0076.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.526] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.526] GetLastError () returned 0x0 [0076.585] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.586] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.586] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19658732655) returned 1 [0076.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc766970, dwHighDateTime=0x1d585b4)) [0076.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2ca950 [0076.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ca950 | out: hHeap=0x260000) returned 1 [0076.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cccd0 [0076.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cccd0 | out: hHeap=0x260000) returned 1 [0076.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.587] GetLastError () returned 0x0 [0076.587] GetLastError () returned 0x0 [0076.587] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.587] GetLastError () returned 0x0 [0076.588] GetLastError () returned 0x0 [0076.589] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffec89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.589] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1377, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1377, lpOverlapped=0x0) returned 1 [0076.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.628] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.628] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.629] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.629] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.630] CloseHandle (hObject=0xd8) returned 1 [0076.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.632] GetLastError () returned 0x0 [0076.632] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.633] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.633] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.633] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.633] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19663441636) returned 1 [0076.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc7d8d90, dwHighDateTime=0x1d585b4)) [0076.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caa30 [0076.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caa30 | out: hHeap=0x260000) returned 1 [0076.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b490 [0076.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.634] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.634] GetLastError () returned 0x0 [0076.635] GetLastError () returned 0x0 [0076.635] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.635] GetLastError () returned 0x0 [0076.635] GetLastError () returned 0x0 [0076.637] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff8933, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.637] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x76cd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x76cd, lpOverlapped=0x0) returned 1 [0076.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.639] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.639] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.640] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.640] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.641] CloseHandle (hObject=0xd8) returned 1 [0076.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.642] GetLastError () returned 0x0 [0076.643] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.644] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.644] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.644] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19664521073) returned 1 [0076.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc7feef0, dwHighDateTime=0x1d585b4)) [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caa68 [0076.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caa68 | out: hHeap=0x260000) returned 1 [0076.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ccad8 [0076.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b360 [0076.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ccad8 | out: hHeap=0x260000) returned 1 [0076.645] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.645] GetLastError () returned 0x0 [0076.645] GetLastError () returned 0x0 [0076.645] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.645] GetLastError () returned 0x0 [0076.646] GetLastError () returned 0x0 [0076.647] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffefff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.648] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1001, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1001, lpOverlapped=0x0) returned 1 [0076.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.649] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.649] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.650] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.650] CloseHandle (hObject=0xd8) returned 1 [0076.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.652] GetLastError () returned 0x0 [0076.652] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.653] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.653] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.653] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.654] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19665480208) returned 1 [0076.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc7feef0, dwHighDateTime=0x1d585b4)) [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caaa0 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caaa0 | out: hHeap=0x260000) returned 1 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ccf70 [0076.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b360 [0076.654] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ccf70 | out: hHeap=0x260000) returned 1 [0076.654] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.655] GetLastError () returned 0x0 [0076.655] GetLastError () returned 0x0 [0076.655] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.655] GetLastError () returned 0x0 [0076.655] GetLastError () returned 0x0 [0076.669] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff17e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.669] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xe82, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xe82, lpOverlapped=0x0) returned 1 [0076.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0076.672] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.672] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.673] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.673] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.674] CloseHandle (hObject=0xd8) returned 1 [0076.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.679] GetLastError () returned 0x0 [0076.680] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.681] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.681] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.681] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19668215148) returned 1 [0076.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc84b1b0, dwHighDateTime=0x1d585b4)) [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c0d0 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c0d0 | out: hHeap=0x260000) returned 1 [0076.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd018 [0076.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b360 [0076.682] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd018 | out: hHeap=0x260000) returned 1 [0076.682] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.682] GetLastError () returned 0x0 [0076.682] GetLastError () returned 0x0 [0076.682] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.682] GetLastError () returned 0x0 [0076.682] GetLastError () returned 0x0 [0076.686] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe95f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.686] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16a1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x16a1, lpOverlapped=0x0) returned 1 [0076.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.687] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.687] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.688] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.688] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.688] CloseHandle (hObject=0xd8) returned 1 [0076.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.691] GetLastError () returned 0x0 [0076.691] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.692] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.692] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.692] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19669318017) returned 1 [0076.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc871310, dwHighDateTime=0x1d585b4)) [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c098 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c098 | out: hHeap=0x260000) returned 1 [0076.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b230 [0076.693] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.693] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.693] GetLastError () returned 0x0 [0076.693] GetLastError () returned 0x0 [0076.693] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.693] GetLastError () returned 0x0 [0076.693] GetLastError () returned 0x0 [0076.695] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffb378, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.695] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4c88, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x4c88, lpOverlapped=0x0) returned 1 [0076.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.697] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.697] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.698] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.698] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.698] CloseHandle (hObject=0xd8) returned 1 [0076.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.700] GetLastError () returned 0x0 [0076.701] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.702] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.702] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.702] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19670303574) returned 1 [0076.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc871310, dwHighDateTime=0x1d585b4)) [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c060 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c060 | out: hHeap=0x260000) returned 1 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b5c0 [0076.703] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.703] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.703] GetLastError () returned 0x0 [0076.703] GetLastError () returned 0x0 [0076.703] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.703] GetLastError () returned 0x0 [0076.703] GetLastError () returned 0x0 [0076.720] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff318e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.721] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xce72, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xce72, lpOverlapped=0x0) returned 1 [0076.723] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.723] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.723] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.724] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.724] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.725] CloseHandle (hObject=0xd8) returned 1 [0076.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.729] GetLastError () returned 0x0 [0076.730] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.731] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.731] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.731] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19673198657) returned 1 [0076.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc8bd5d0, dwHighDateTime=0x1d585b4)) [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cab10 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cab10 | out: hHeap=0x260000) returned 1 [0076.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.731] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275aea0 [0076.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.732] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.732] GetLastError () returned 0x0 [0076.732] GetLastError () returned 0x0 [0076.732] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.732] GetLastError () returned 0x0 [0076.733] GetLastError () returned 0x0 [0076.736] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff91b6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.736] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6e4a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6e4a, lpOverlapped=0x0) returned 1 [0076.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.737] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.737] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.738] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.738] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.739] CloseHandle (hObject=0xd8) returned 1 [0076.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.741] GetLastError () returned 0x0 [0076.741] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.742] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0076.742] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.743] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19674378127) returned 1 [0076.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc8e3730, dwHighDateTime=0x1d585b4)) [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cab48 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cab48 | out: hHeap=0x260000) returned 1 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b658 [0076.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.744] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.744] GetLastError () returned 0x0 [0076.744] GetLastError () returned 0x0 [0076.744] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.744] GetLastError () returned 0x0 [0076.744] GetLastError () returned 0x0 [0076.746] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff9fac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.747] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6054, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6054, lpOverlapped=0x0) returned 1 [0076.748] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.748] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.748] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.749] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.749] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.750] CloseHandle (hObject=0xd8) returned 1 [0076.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0076.750] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0076.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.752] GetLastError () returned 0x0 [0076.753] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.754] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0076.754] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.754] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19675507606) returned 1 [0076.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbc909890, dwHighDateTime=0x1d585b4)) [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cab80 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0076.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cab80 | out: hHeap=0x260000) returned 1 [0076.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0076.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x27523a8 [0076.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0076.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27523a8 | out: hHeap=0x260000) returned 1 [0076.755] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.755] GetLastError () returned 0x0 [0076.755] GetLastError () returned 0x0 [0076.755] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.755] GetLastError () returned 0x0 [0076.756] GetLastError () returned 0x0 [0076.854] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff8f44, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.855] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x70bc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x70bc, lpOverlapped=0x0) returned 1 [0076.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.856] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.856] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.858] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.858] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.858] CloseHandle (hObject=0xd8) returned 1 [0076.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0076.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0076.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0076.860] GetLastError () returned 0x0 [0076.860] RtlWakeConditionVariable () returned 0x0 [0076.861] GetCurrentThreadId () returned 0x9ac [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".ldf") returned 0x0 [0076.861] lstrlenW (lpString=".vhd") returned 4 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".vhd") returned 0x0 [0076.861] lstrlenW (lpString=".vhdx") returned 5 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".vhdx") returned 0x0 [0076.861] lstrlenW (lpString=".pst") returned 4 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".pst") returned 0x0 [0076.861] lstrlenW (lpString=".ost") returned 4 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".ost") returned 0x0 [0076.861] lstrlenW (lpString=".bak") returned 4 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".bak") returned 0x0 [0076.861] lstrlenW (lpString=".bac") returned 4 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".bac") returned 0x0 [0076.861] lstrlenW (lpString=".sys") returned 4 [0076.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".sys") returned 0x0 [0076.861] lstrlenW (lpString=".v2i") returned 4 [0076.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".v2i") returned 0x0 [0076.862] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0076.875] lstrlenW (lpString=".sql") returned 4 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".sql") returned 0x0 [0076.875] lstrlenW (lpString=".mdf") returned 4 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".mdf") returned 0x0 [0076.875] lstrlenW (lpString=".txt") returned 4 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".txt") returned 0x0 [0076.875] lstrlenW (lpString=".dbf") returned 4 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".dbf") returned 0x0 [0076.875] lstrlenW (lpString=".ckp") returned 4 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".ckp") returned 0x0 [0076.875] lstrlenW (lpString=".dacpac") returned 7 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".dacpac") returned 0x0 [0076.875] lstrlenW (lpString=".db3") returned 4 [0076.875] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".db3") returned 0x0 [0076.876] lstrlenW (lpString=".dtxs") returned 5 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".dtxs") returned 0x0 [0076.876] lstrlenW (lpString=".mdt") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".mdt") returned 0x0 [0076.876] lstrlenW (lpString=".sdf") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".sdf") returned 0x0 [0076.876] lstrlenW (lpString=".MDF") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".MDF") returned 0x0 [0076.876] lstrlenW (lpString=".DBF") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".DBF") returned 0x0 [0076.876] lstrlenW (lpString=".DB") returned 3 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".DB") returned 0x0 [0076.876] lstrlenW (lpString=".db") returned 3 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".db") returned 0x0 [0076.876] lstrlenW (lpString=".ndf") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".ndf") returned 0x0 [0076.876] lstrlenW (lpString=".NDF") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".NDF") returned 0x0 [0076.876] lstrlenW (lpString=".Mdf") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".Mdf") returned 0x0 [0076.876] lstrlenW (lpString=".dat") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".dat") returned 0x0 [0076.876] lstrlenW (lpString=".DAT") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".DAT") returned 0x0 [0076.876] lstrlenW (lpString=".ldf") returned 4 [0076.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".ldf") returned 0x0 [0076.877] lstrlenW (lpString=".LDF") returned 4 [0076.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch=".LDF") returned 0x0 [0076.877] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0076.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.877] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.878] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.878] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19687915813) returned 1 [0076.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbca3a390, dwHighDateTime=0x1d585b4)) [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cad08 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cad08 | out: hHeap=0x260000) returned 1 [0076.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd0c0 [0076.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd0c0 | out: hHeap=0x260000) returned 1 [0076.879] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.879] GetLastError () returned 0x0 [0076.879] GetLastError () returned 0x0 [0076.879] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.879] GetLastError () returned 0x0 [0076.879] GetLastError () returned 0x0 [0076.882] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffec53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.882] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13ad, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x13ad, lpOverlapped=0x0) returned 1 [0076.882] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.882] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.882] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.882] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.882] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.883] CloseHandle (hObject=0xe4) returned 1 [0076.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.884] GetLastError () returned 0x0 [0076.885] RtlWakeConditionVariable () returned 0x0 [0076.885] GetCurrentThreadId () returned 0x9ac [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".ldf") returned 0x0 [0076.885] lstrlenW (lpString=".vhd") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".vhd") returned 0x0 [0076.885] lstrlenW (lpString=".vhdx") returned 5 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".vhdx") returned 0x0 [0076.885] lstrlenW (lpString=".pst") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".pst") returned 0x0 [0076.885] lstrlenW (lpString=".ost") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".ost") returned 0x0 [0076.885] lstrlenW (lpString=".bak") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".bak") returned 0x0 [0076.885] lstrlenW (lpString=".bac") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".bac") returned 0x0 [0076.885] lstrlenW (lpString=".sys") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".sys") returned 0x0 [0076.885] lstrlenW (lpString=".v2i") returned 4 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".v2i") returned 0x0 [0076.885] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.885] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0076.887] lstrlenW (lpString=".sql") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".sql") returned 0x0 [0076.887] lstrlenW (lpString=".mdf") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".mdf") returned 0x0 [0076.887] lstrlenW (lpString=".txt") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".txt") returned 0x0 [0076.887] lstrlenW (lpString=".dbf") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".dbf") returned 0x0 [0076.887] lstrlenW (lpString=".ckp") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".ckp") returned 0x0 [0076.887] lstrlenW (lpString=".dacpac") returned 7 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".dacpac") returned 0x0 [0076.887] lstrlenW (lpString=".db3") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".db3") returned 0x0 [0076.887] lstrlenW (lpString=".dtxs") returned 5 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".dtxs") returned 0x0 [0076.887] lstrlenW (lpString=".mdt") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".mdt") returned 0x0 [0076.887] lstrlenW (lpString=".sdf") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".sdf") returned 0x0 [0076.887] lstrlenW (lpString=".MDF") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".MDF") returned 0x0 [0076.887] lstrlenW (lpString=".DBF") returned 4 [0076.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".DBF") returned 0x0 [0076.887] lstrlenW (lpString=".DB") returned 3 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".DB") returned 0x0 [0076.888] lstrlenW (lpString=".db") returned 3 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".db") returned 0x0 [0076.888] lstrlenW (lpString=".ndf") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".ndf") returned 0x0 [0076.888] lstrlenW (lpString=".NDF") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".NDF") returned 0x0 [0076.888] lstrlenW (lpString=".Mdf") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".Mdf") returned 0x0 [0076.888] lstrlenW (lpString=".dat") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".dat") returned 0x0 [0076.888] lstrlenW (lpString=".DAT") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".DAT") returned 0x0 [0076.888] lstrlenW (lpString=".ldf") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".ldf") returned 0x0 [0076.888] lstrlenW (lpString=".LDF") returned 4 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch=".LDF") returned 0x0 [0076.888] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.888] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0076.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.888] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.889] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.889] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.889] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19689047941) returned 1 [0076.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbca3a390, dwHighDateTime=0x1d585b4)) [0076.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cad40 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cad40 | out: hHeap=0x260000) returned 1 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd360 [0076.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.890] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd360 | out: hHeap=0x260000) returned 1 [0076.890] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.890] GetLastError () returned 0x0 [0076.890] GetLastError () returned 0x0 [0076.890] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.891] GetLastError () returned 0x0 [0076.891] GetLastError () returned 0x0 [0076.893] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe8fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.893] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1706, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1706, lpOverlapped=0x0) returned 1 [0076.894] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.894] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.894] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.894] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.894] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.894] CloseHandle (hObject=0xe4) returned 1 [0076.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0076.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.[deadmin@cock.li].deadmin")) returned 1 [0076.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0076.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0076.895] GetLastError () returned 0x0 [0076.895] RtlWakeConditionVariable () returned 0x27e828 [0076.895] GetCurrentThreadId () returned 0x9ac [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".ldf") returned 0x0 [0076.896] lstrlenW (lpString=".vhd") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".vhd") returned 0x0 [0076.896] lstrlenW (lpString=".vhdx") returned 5 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".vhdx") returned 0x0 [0076.896] lstrlenW (lpString=".pst") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".pst") returned 0x0 [0076.896] lstrlenW (lpString=".ost") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".ost") returned 0x0 [0076.896] lstrlenW (lpString=".bak") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".bak") returned 0x0 [0076.896] lstrlenW (lpString=".bac") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".bac") returned 0x0 [0076.896] lstrlenW (lpString=".sys") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".sys") returned 0x0 [0076.896] lstrlenW (lpString=".v2i") returned 4 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".v2i") returned 0x0 [0076.896] lstrlenW (lpString="s\r\n.v2i") returned 7 [0076.896] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0076.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0076.897] lstrlenW (lpString=".sql") returned 4 [0076.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".sql") returned 0x0 [0076.897] lstrlenW (lpString=".mdf") returned 4 [0076.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".mdf") returned 0x0 [0076.897] lstrlenW (lpString=".txt") returned 4 [0076.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".txt") returned 0x0 [0076.897] lstrlenW (lpString=".dbf") returned 4 [0076.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".dbf") returned 0x0 [0076.898] lstrlenW (lpString=".ckp") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".ckp") returned 0x0 [0076.898] lstrlenW (lpString=".dacpac") returned 7 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".dacpac") returned 0x0 [0076.898] lstrlenW (lpString=".db3") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".db3") returned 0x0 [0076.898] lstrlenW (lpString=".dtxs") returned 5 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".dtxs") returned 0x0 [0076.898] lstrlenW (lpString=".mdt") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".mdt") returned 0x0 [0076.898] lstrlenW (lpString=".sdf") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".sdf") returned 0x0 [0076.898] lstrlenW (lpString=".MDF") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".MDF") returned 0x0 [0076.898] lstrlenW (lpString=".DBF") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".DBF") returned 0x0 [0076.898] lstrlenW (lpString=".DB") returned 3 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".DB") returned 0x0 [0076.898] lstrlenW (lpString=".db") returned 3 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".db") returned 0x0 [0076.898] lstrlenW (lpString=".ndf") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".ndf") returned 0x0 [0076.898] lstrlenW (lpString=".NDF") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".NDF") returned 0x0 [0076.898] lstrlenW (lpString=".Mdf") returned 4 [0076.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".Mdf") returned 0x0 [0076.899] lstrlenW (lpString=".dat") returned 4 [0076.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".dat") returned 0x0 [0076.899] lstrlenW (lpString=".DAT") returned 4 [0076.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".DAT") returned 0x0 [0076.899] lstrlenW (lpString=".ldf") returned 4 [0076.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".ldf") returned 0x0 [0076.899] lstrlenW (lpString=".LDF") returned 4 [0076.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch=".LDF") returned 0x0 [0076.899] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0076.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0076.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0076.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0076.899] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0076.900] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0076.900] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0076.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0076.900] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19690117231) returned 1 [0076.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbca604f0, dwHighDateTime=0x1d585b4)) [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cad78 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0076.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cad78 | out: hHeap=0x260000) returned 1 [0076.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0076.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0076.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd408 [0076.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0076.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275a358 [0076.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd408 | out: hHeap=0x260000) returned 1 [0076.901] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0076.901] GetLastError () returned 0x0 [0076.901] GetLastError () returned 0x0 [0076.901] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0076.901] GetLastError () returned 0x0 [0076.901] GetLastError () returned 0x0 [0076.940] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff9b67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.940] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6499, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6499, lpOverlapped=0x0) returned 1 [0076.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0076.940] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.940] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0076.940] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0076.940] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0076.940] CloseHandle (hObject=0xe4) returned 1 [0077.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0077.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0077.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.072] GetLastError () returned 0x0 [0077.072] RtlWakeConditionVariable () returned 0x0 [0077.072] GetCurrentThreadId () returned 0x9ac [0077.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".ldf") returned 0x0 [0077.072] lstrlenW (lpString=".vhd") returned 4 [0077.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".vhd") returned 0x0 [0077.072] lstrlenW (lpString=".vhdx") returned 5 [0077.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".vhdx") returned 0x0 [0077.072] lstrlenW (lpString=".pst") returned 4 [0077.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".pst") returned 0x0 [0077.072] lstrlenW (lpString=".ost") returned 4 [0077.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".ost") returned 0x0 [0077.072] lstrlenW (lpString=".bak") returned 4 [0077.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".bak") returned 0x0 [0077.073] lstrlenW (lpString=".bac") returned 4 [0077.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".bac") returned 0x0 [0077.073] lstrlenW (lpString=".sys") returned 4 [0077.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".sys") returned 0x0 [0077.073] lstrlenW (lpString=".v2i") returned 4 [0077.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".v2i") returned 0x0 [0077.073] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.073] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.074] lstrlenW (lpString=".sql") returned 4 [0077.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".sql") returned 0x0 [0077.074] lstrlenW (lpString=".mdf") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".mdf") returned 0x0 [0077.075] lstrlenW (lpString=".txt") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".txt") returned 0x0 [0077.075] lstrlenW (lpString=".dbf") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".dbf") returned 0x0 [0077.075] lstrlenW (lpString=".ckp") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".ckp") returned 0x0 [0077.075] lstrlenW (lpString=".dacpac") returned 7 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".dacpac") returned 0x0 [0077.075] lstrlenW (lpString=".db3") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".db3") returned 0x0 [0077.075] lstrlenW (lpString=".dtxs") returned 5 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".dtxs") returned 0x0 [0077.075] lstrlenW (lpString=".mdt") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".mdt") returned 0x0 [0077.075] lstrlenW (lpString=".sdf") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".sdf") returned 0x0 [0077.075] lstrlenW (lpString=".MDF") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".MDF") returned 0x0 [0077.075] lstrlenW (lpString=".DBF") returned 4 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".DBF") returned 0x0 [0077.075] lstrlenW (lpString=".DB") returned 3 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".DB") returned 0x0 [0077.075] lstrlenW (lpString=".db") returned 3 [0077.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".db") returned 0x0 [0077.076] lstrlenW (lpString=".ndf") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".ndf") returned 0x0 [0077.076] lstrlenW (lpString=".NDF") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".NDF") returned 0x0 [0077.076] lstrlenW (lpString=".Mdf") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".Mdf") returned 0x0 [0077.076] lstrlenW (lpString=".dat") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".dat") returned 0x0 [0077.076] lstrlenW (lpString=".DAT") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".DAT") returned 0x0 [0077.076] lstrlenW (lpString=".ldf") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".ldf") returned 0x0 [0077.076] lstrlenW (lpString=".LDF") returned 4 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch=".LDF") returned 0x0 [0077.076] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.076] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.077] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.077] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.077] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19707837843) returned 1 [0077.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbcc03410, dwHighDateTime=0x1d585b4)) [0077.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caf00 [0077.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caf00 | out: hHeap=0x260000) returned 1 [0077.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd4b0 [0077.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0077.078] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd4b0 | out: hHeap=0x260000) returned 1 [0077.078] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.078] GetLastError () returned 0x0 [0077.078] GetLastError () returned 0x0 [0077.078] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.078] GetLastError () returned 0x0 [0077.079] GetLastError () returned 0x0 [0077.080] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff3ef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.080] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc11, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xc11, lpOverlapped=0x0) returned 1 [0077.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.080] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.081] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.081] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.081] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.081] CloseHandle (hObject=0xe4) returned 1 [0077.081] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0077.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0077.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.084] GetLastError () returned 0x0 [0077.084] RtlWakeConditionVariable () returned 0x0 [0077.084] GetCurrentThreadId () returned 0x9ac [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".ldf") returned 0x0 [0077.084] lstrlenW (lpString=".vhd") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".vhd") returned 0x0 [0077.084] lstrlenW (lpString=".vhdx") returned 5 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".vhdx") returned 0x0 [0077.084] lstrlenW (lpString=".pst") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".pst") returned 0x0 [0077.084] lstrlenW (lpString=".ost") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".ost") returned 0x0 [0077.084] lstrlenW (lpString=".bak") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".bak") returned 0x0 [0077.084] lstrlenW (lpString=".bac") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".bac") returned 0x0 [0077.084] lstrlenW (lpString=".sys") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".sys") returned 0x0 [0077.084] lstrlenW (lpString=".v2i") returned 4 [0077.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".v2i") returned 0x0 [0077.084] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.086] lstrlenW (lpString=".sql") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".sql") returned 0x0 [0077.086] lstrlenW (lpString=".mdf") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".mdf") returned 0x0 [0077.086] lstrlenW (lpString=".txt") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".txt") returned 0x0 [0077.086] lstrlenW (lpString=".dbf") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".dbf") returned 0x0 [0077.086] lstrlenW (lpString=".ckp") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".ckp") returned 0x0 [0077.086] lstrlenW (lpString=".dacpac") returned 7 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".dacpac") returned 0x0 [0077.086] lstrlenW (lpString=".db3") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".db3") returned 0x0 [0077.086] lstrlenW (lpString=".dtxs") returned 5 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".dtxs") returned 0x0 [0077.086] lstrlenW (lpString=".mdt") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".mdt") returned 0x0 [0077.086] lstrlenW (lpString=".sdf") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".sdf") returned 0x0 [0077.086] lstrlenW (lpString=".MDF") returned 4 [0077.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".MDF") returned 0x0 [0077.087] lstrlenW (lpString=".DBF") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".DBF") returned 0x0 [0077.087] lstrlenW (lpString=".DB") returned 3 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".DB") returned 0x0 [0077.087] lstrlenW (lpString=".db") returned 3 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".db") returned 0x0 [0077.087] lstrlenW (lpString=".ndf") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".ndf") returned 0x0 [0077.087] lstrlenW (lpString=".NDF") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".NDF") returned 0x0 [0077.087] lstrlenW (lpString=".Mdf") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".Mdf") returned 0x0 [0077.087] lstrlenW (lpString=".dat") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".dat") returned 0x0 [0077.087] lstrlenW (lpString=".DAT") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".DAT") returned 0x0 [0077.087] lstrlenW (lpString=".ldf") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".ldf") returned 0x0 [0077.087] lstrlenW (lpString=".LDF") returned 4 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch=".LDF") returned 0x0 [0077.087] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.087] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.088] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.088] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.088] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19708961854) returned 1 [0077.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbcc29570, dwHighDateTime=0x1d585b4)) [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caf38 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caf38 | out: hHeap=0x260000) returned 1 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd948 [0077.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0077.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd948 | out: hHeap=0x260000) returned 1 [0077.089] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.089] GetLastError () returned 0x0 [0077.090] GetLastError () returned 0x0 [0077.090] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.090] GetLastError () returned 0x0 [0077.090] GetLastError () returned 0x0 [0077.092] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff10b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.093] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xef5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xef5, lpOverlapped=0x0) returned 1 [0077.093] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.093] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.093] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.093] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.093] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.093] CloseHandle (hObject=0xe4) returned 1 [0077.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0077.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0077.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.095] GetLastError () returned 0x0 [0077.095] RtlWakeConditionVariable () returned 0x0 [0077.095] GetCurrentThreadId () returned 0x9ac [0077.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".ldf") returned 0x0 [0077.095] lstrlenW (lpString=".vhd") returned 4 [0077.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".vhd") returned 0x0 [0077.095] lstrlenW (lpString=".vhdx") returned 5 [0077.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".vhdx") returned 0x0 [0077.095] lstrlenW (lpString=".pst") returned 4 [0077.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".pst") returned 0x0 [0077.095] lstrlenW (lpString=".ost") returned 4 [0077.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".ost") returned 0x0 [0077.095] lstrlenW (lpString=".bak") returned 4 [0077.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".bak") returned 0x0 [0077.096] lstrlenW (lpString=".bac") returned 4 [0077.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".bac") returned 0x0 [0077.096] lstrlenW (lpString=".sys") returned 4 [0077.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".sys") returned 0x0 [0077.096] lstrlenW (lpString=".v2i") returned 4 [0077.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".v2i") returned 0x0 [0077.096] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.098] lstrlenW (lpString=".sql") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".sql") returned 0x0 [0077.098] lstrlenW (lpString=".mdf") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".mdf") returned 0x0 [0077.098] lstrlenW (lpString=".txt") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".txt") returned 0x0 [0077.098] lstrlenW (lpString=".dbf") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".dbf") returned 0x0 [0077.098] lstrlenW (lpString=".ckp") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".ckp") returned 0x0 [0077.098] lstrlenW (lpString=".dacpac") returned 7 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".dacpac") returned 0x0 [0077.098] lstrlenW (lpString=".db3") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".db3") returned 0x0 [0077.098] lstrlenW (lpString=".dtxs") returned 5 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".dtxs") returned 0x0 [0077.098] lstrlenW (lpString=".mdt") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".mdt") returned 0x0 [0077.098] lstrlenW (lpString=".sdf") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".sdf") returned 0x0 [0077.098] lstrlenW (lpString=".MDF") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".MDF") returned 0x0 [0077.098] lstrlenW (lpString=".DBF") returned 4 [0077.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".DBF") returned 0x0 [0077.099] lstrlenW (lpString=".DB") returned 3 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".DB") returned 0x0 [0077.099] lstrlenW (lpString=".db") returned 3 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".db") returned 0x0 [0077.099] lstrlenW (lpString=".ndf") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".ndf") returned 0x0 [0077.099] lstrlenW (lpString=".NDF") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".NDF") returned 0x0 [0077.099] lstrlenW (lpString=".Mdf") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".Mdf") returned 0x0 [0077.099] lstrlenW (lpString=".dat") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".dat") returned 0x0 [0077.099] lstrlenW (lpString=".DAT") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".DAT") returned 0x0 [0077.099] lstrlenW (lpString=".ldf") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".ldf") returned 0x0 [0077.099] lstrlenW (lpString=".LDF") returned 4 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch=".LDF") returned 0x0 [0077.099] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0077.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.099] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.100] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.100] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0077.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0077.100] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19710151940) returned 1 [0077.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbcc4f6d0, dwHighDateTime=0x1d585b4)) [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2caf70 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2caf70 | out: hHeap=0x260000) returned 1 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd9f0 [0077.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275af38 [0077.101] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd9f0 | out: hHeap=0x260000) returned 1 [0077.101] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.101] GetLastError () returned 0x0 [0077.101] GetLastError () returned 0x0 [0077.102] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.102] GetLastError () returned 0x0 [0077.102] GetLastError () returned 0x0 [0077.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe48b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.108] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1b75, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b75, lpOverlapped=0x0) returned 1 [0077.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0077.108] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.108] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.108] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.108] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.108] CloseHandle (hObject=0xe4) returned 1 [0077.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0077.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0077.110] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0077.110] GetLastError () returned 0x0 [0077.110] RtlWakeConditionVariable () returned 0x0 [0077.110] GetCurrentThreadId () returned 0x9ac [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".ldf") returned 0x0 [0077.110] lstrlenW (lpString=".vhd") returned 4 [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".vhd") returned 0x0 [0077.110] lstrlenW (lpString=".vhdx") returned 5 [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".vhdx") returned 0x0 [0077.110] lstrlenW (lpString=".pst") returned 4 [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".pst") returned 0x0 [0077.110] lstrlenW (lpString=".ost") returned 4 [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".ost") returned 0x0 [0077.110] lstrlenW (lpString=".bak") returned 4 [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".bak") returned 0x0 [0077.110] lstrlenW (lpString=".bac") returned 4 [0077.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".bac") returned 0x0 [0077.111] lstrlenW (lpString=".sys") returned 4 [0077.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".sys") returned 0x0 [0077.111] lstrlenW (lpString=".v2i") returned 4 [0077.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".v2i") returned 0x0 [0077.111] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.497] lstrlenW (lpString=".sql") returned 4 [0077.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".sql") returned 0x0 [0077.497] lstrlenW (lpString=".mdf") returned 4 [0077.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".mdf") returned 0x0 [0077.497] lstrlenW (lpString=".txt") returned 4 [0077.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".txt") returned 0x0 [0077.508] lstrlenW (lpString=".dbf") returned 4 [0077.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".dbf") returned 0x0 [0077.508] lstrlenW (lpString=".ckp") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".ckp") returned 0x0 [0077.517] lstrlenW (lpString=".dacpac") returned 7 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".dacpac") returned 0x0 [0077.517] lstrlenW (lpString=".db3") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".db3") returned 0x0 [0077.517] lstrlenW (lpString=".dtxs") returned 5 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".dtxs") returned 0x0 [0077.517] lstrlenW (lpString=".mdt") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".mdt") returned 0x0 [0077.517] lstrlenW (lpString=".sdf") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".sdf") returned 0x0 [0077.517] lstrlenW (lpString=".MDF") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".MDF") returned 0x0 [0077.517] lstrlenW (lpString=".DBF") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".DBF") returned 0x0 [0077.517] lstrlenW (lpString=".DB") returned 3 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".DB") returned 0x0 [0077.517] lstrlenW (lpString=".db") returned 3 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".db") returned 0x0 [0077.517] lstrlenW (lpString=".ndf") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".ndf") returned 0x0 [0077.517] lstrlenW (lpString=".NDF") returned 4 [0077.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".NDF") returned 0x0 [0077.517] lstrlenW (lpString=".Mdf") returned 4 [0077.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".Mdf") returned 0x0 [0077.518] lstrlenW (lpString=".dat") returned 4 [0077.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".dat") returned 0x0 [0077.518] lstrlenW (lpString=".DAT") returned 4 [0077.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".DAT") returned 0x0 [0077.518] lstrlenW (lpString=".ldf") returned 4 [0077.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".ldf") returned 0x0 [0077.518] lstrlenW (lpString=".LDF") returned 4 [0077.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch=".LDF") returned 0x0 [0077.518] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.518] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.519] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.519] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.519] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19752011128) returned 1 [0077.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd053bf0, dwHighDateTime=0x1d585b4)) [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c140 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c140 | out: hHeap=0x260000) returned 1 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.519] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce8e0 [0077.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.520] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce8e0 | out: hHeap=0x260000) returned 1 [0077.520] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.520] GetLastError () returned 0x0 [0077.520] GetLastError () returned 0x0 [0077.520] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.520] GetLastError () returned 0x0 [0077.520] GetLastError () returned 0x0 [0077.523] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff37b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.523] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xc85, lpOverlapped=0x0) returned 1 [0077.523] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.523] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.523] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.524] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.524] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.524] CloseHandle (hObject=0x108) returned 1 [0077.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.525] GetLastError () returned 0x0 [0077.525] RtlWakeConditionVariable () returned 0x0 [0077.525] GetCurrentThreadId () returned 0x9ac [0077.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".ldf") returned 0x0 [0077.525] lstrlenW (lpString=".vhd") returned 4 [0077.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".vhd") returned 0x0 [0077.525] lstrlenW (lpString=".vhdx") returned 5 [0077.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".vhdx") returned 0x0 [0077.525] lstrlenW (lpString=".pst") returned 4 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".pst") returned 0x0 [0077.526] lstrlenW (lpString=".ost") returned 4 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".ost") returned 0x0 [0077.526] lstrlenW (lpString=".bak") returned 4 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".bak") returned 0x0 [0077.526] lstrlenW (lpString=".bac") returned 4 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".bac") returned 0x0 [0077.526] lstrlenW (lpString=".sys") returned 4 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".sys") returned 0x0 [0077.526] lstrlenW (lpString=".v2i") returned 4 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".v2i") returned 0x0 [0077.526] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.527] lstrlenW (lpString=".sql") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".sql") returned 0x0 [0077.528] lstrlenW (lpString=".mdf") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".mdf") returned 0x0 [0077.528] lstrlenW (lpString=".txt") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".txt") returned 0x0 [0077.528] lstrlenW (lpString=".dbf") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".dbf") returned 0x0 [0077.528] lstrlenW (lpString=".ckp") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".ckp") returned 0x0 [0077.528] lstrlenW (lpString=".dacpac") returned 7 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".dacpac") returned 0x0 [0077.528] lstrlenW (lpString=".db3") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".db3") returned 0x0 [0077.528] lstrlenW (lpString=".dtxs") returned 5 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".dtxs") returned 0x0 [0077.528] lstrlenW (lpString=".mdt") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".mdt") returned 0x0 [0077.528] lstrlenW (lpString=".sdf") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".sdf") returned 0x0 [0077.528] lstrlenW (lpString=".MDF") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".MDF") returned 0x0 [0077.528] lstrlenW (lpString=".DBF") returned 4 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".DBF") returned 0x0 [0077.528] lstrlenW (lpString=".DB") returned 3 [0077.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".DB") returned 0x0 [0077.529] lstrlenW (lpString=".db") returned 3 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".db") returned 0x0 [0077.529] lstrlenW (lpString=".ndf") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".ndf") returned 0x0 [0077.529] lstrlenW (lpString=".NDF") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".NDF") returned 0x0 [0077.529] lstrlenW (lpString=".Mdf") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".Mdf") returned 0x0 [0077.529] lstrlenW (lpString=".dat") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".dat") returned 0x0 [0077.529] lstrlenW (lpString=".DAT") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".DAT") returned 0x0 [0077.529] lstrlenW (lpString=".ldf") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".ldf") returned 0x0 [0077.529] lstrlenW (lpString=".LDF") returned 4 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch=".LDF") returned 0x0 [0077.529] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.529] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.530] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.530] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.530] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19753140070) returned 1 [0077.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd053bf0, dwHighDateTime=0x1d585b4)) [0077.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb168 [0077.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb168 | out: hHeap=0x260000) returned 1 [0077.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ce8e0 [0077.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ce8e0 | out: hHeap=0x260000) returned 1 [0077.531] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.531] GetLastError () returned 0x0 [0077.531] GetLastError () returned 0x0 [0077.531] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.531] GetLastError () returned 0x0 [0077.532] GetLastError () returned 0x0 [0077.533] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc5e2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.533] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3a1e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3a1e, lpOverlapped=0x0) returned 1 [0077.534] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.534] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.534] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.534] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.534] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.534] CloseHandle (hObject=0x108) returned 1 [0077.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.535] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.535] GetLastError () returned 0x0 [0077.535] RtlWakeConditionVariable () returned 0x0 [0077.535] GetCurrentThreadId () returned 0x9ac [0077.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".ldf") returned 0x0 [0077.535] lstrlenW (lpString=".vhd") returned 4 [0077.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".vhd") returned 0x0 [0077.535] lstrlenW (lpString=".vhdx") returned 5 [0077.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".vhdx") returned 0x0 [0077.536] lstrlenW (lpString=".pst") returned 4 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".pst") returned 0x0 [0077.536] lstrlenW (lpString=".ost") returned 4 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".ost") returned 0x0 [0077.536] lstrlenW (lpString=".bak") returned 4 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".bak") returned 0x0 [0077.536] lstrlenW (lpString=".bac") returned 4 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".bac") returned 0x0 [0077.536] lstrlenW (lpString=".sys") returned 4 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".sys") returned 0x0 [0077.536] lstrlenW (lpString=".v2i") returned 4 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".v2i") returned 0x0 [0077.536] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.537] lstrlenW (lpString=".sql") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".sql") returned 0x0 [0077.537] lstrlenW (lpString=".mdf") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".mdf") returned 0x0 [0077.537] lstrlenW (lpString=".txt") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".txt") returned 0x0 [0077.537] lstrlenW (lpString=".dbf") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".dbf") returned 0x0 [0077.537] lstrlenW (lpString=".ckp") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".ckp") returned 0x0 [0077.537] lstrlenW (lpString=".dacpac") returned 7 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".dacpac") returned 0x0 [0077.537] lstrlenW (lpString=".db3") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".db3") returned 0x0 [0077.537] lstrlenW (lpString=".dtxs") returned 5 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".dtxs") returned 0x0 [0077.537] lstrlenW (lpString=".mdt") returned 4 [0077.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".mdt") returned 0x0 [0077.538] lstrlenW (lpString=".sdf") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".sdf") returned 0x0 [0077.538] lstrlenW (lpString=".MDF") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".MDF") returned 0x0 [0077.538] lstrlenW (lpString=".DBF") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".DBF") returned 0x0 [0077.538] lstrlenW (lpString=".DB") returned 3 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".DB") returned 0x0 [0077.538] lstrlenW (lpString=".db") returned 3 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".db") returned 0x0 [0077.538] lstrlenW (lpString=".ndf") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".ndf") returned 0x0 [0077.538] lstrlenW (lpString=".NDF") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".NDF") returned 0x0 [0077.538] lstrlenW (lpString=".Mdf") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".Mdf") returned 0x0 [0077.538] lstrlenW (lpString=".dat") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".dat") returned 0x0 [0077.538] lstrlenW (lpString=".DAT") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".DAT") returned 0x0 [0077.538] lstrlenW (lpString=".ldf") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".ldf") returned 0x0 [0077.538] lstrlenW (lpString=".LDF") returned 4 [0077.538] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch=".LDF") returned 0x0 [0077.538] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.539] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.539] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.539] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.539] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.540] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19754071437) returned 1 [0077.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd079d50, dwHighDateTime=0x1d585b4)) [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb1a0 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb1a0 | out: hHeap=0x260000) returned 1 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cea30 [0077.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cea30 | out: hHeap=0x260000) returned 1 [0077.540] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.540] GetLastError () returned 0x0 [0077.541] GetLastError () returned 0x0 [0077.541] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.541] GetLastError () returned 0x0 [0077.541] GetLastError () returned 0x0 [0077.543] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffa71e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.543] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x58e2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x58e2, lpOverlapped=0x0) returned 1 [0077.543] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.543] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.544] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.544] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.544] CloseHandle (hObject=0x108) returned 1 [0077.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.545] GetLastError () returned 0x0 [0077.545] RtlWakeConditionVariable () returned 0x0 [0077.545] GetCurrentThreadId () returned 0x9ac [0077.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".ldf") returned 0x0 [0077.545] lstrlenW (lpString=".vhd") returned 4 [0077.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".vhd") returned 0x0 [0077.545] lstrlenW (lpString=".vhdx") returned 5 [0077.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".vhdx") returned 0x0 [0077.545] lstrlenW (lpString=".pst") returned 4 [0077.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".pst") returned 0x0 [0077.545] lstrlenW (lpString=".ost") returned 4 [0077.545] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".ost") returned 0x0 [0077.546] lstrlenW (lpString=".bak") returned 4 [0077.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".bak") returned 0x0 [0077.546] lstrlenW (lpString=".bac") returned 4 [0077.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".bac") returned 0x0 [0077.546] lstrlenW (lpString=".sys") returned 4 [0077.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".sys") returned 0x0 [0077.546] lstrlenW (lpString=".v2i") returned 4 [0077.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".v2i") returned 0x0 [0077.546] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.546] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0077.547] lstrlenW (lpString=".sql") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".sql") returned 0x0 [0077.547] lstrlenW (lpString=".mdf") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".mdf") returned 0x0 [0077.547] lstrlenW (lpString=".txt") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".txt") returned 0x0 [0077.547] lstrlenW (lpString=".dbf") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".dbf") returned 0x0 [0077.547] lstrlenW (lpString=".ckp") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".ckp") returned 0x0 [0077.547] lstrlenW (lpString=".dacpac") returned 7 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".dacpac") returned 0x0 [0077.547] lstrlenW (lpString=".db3") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".db3") returned 0x0 [0077.547] lstrlenW (lpString=".dtxs") returned 5 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".dtxs") returned 0x0 [0077.547] lstrlenW (lpString=".mdt") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".mdt") returned 0x0 [0077.547] lstrlenW (lpString=".sdf") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".sdf") returned 0x0 [0077.547] lstrlenW (lpString=".MDF") returned 4 [0077.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".MDF") returned 0x0 [0077.547] lstrlenW (lpString=".DBF") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".DBF") returned 0x0 [0077.548] lstrlenW (lpString=".DB") returned 3 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".DB") returned 0x0 [0077.548] lstrlenW (lpString=".db") returned 3 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".db") returned 0x0 [0077.548] lstrlenW (lpString=".ndf") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".ndf") returned 0x0 [0077.548] lstrlenW (lpString=".NDF") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".NDF") returned 0x0 [0077.548] lstrlenW (lpString=".Mdf") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".Mdf") returned 0x0 [0077.548] lstrlenW (lpString=".dat") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".dat") returned 0x0 [0077.548] lstrlenW (lpString=".DAT") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".DAT") returned 0x0 [0077.548] lstrlenW (lpString=".ldf") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".ldf") returned 0x0 [0077.548] lstrlenW (lpString=".LDF") returned 4 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch=".LDF") returned 0x0 [0077.548] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.549] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.549] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.549] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.549] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19755059323) returned 1 [0077.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd09feb0, dwHighDateTime=0x1d585b4)) [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb1d8 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb1d8 | out: hHeap=0x260000) returned 1 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cead8 [0077.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.550] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cead8 | out: hHeap=0x260000) returned 1 [0077.550] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.550] GetLastError () returned 0x0 [0077.550] GetLastError () returned 0x0 [0077.551] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.551] GetLastError () returned 0x0 [0077.551] GetLastError () returned 0x0 [0077.622] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffeed5d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.622] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x112a3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x112a3, lpOverlapped=0x0) returned 1 [0077.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0077.623] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x108, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.623] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.623] CloseHandle (hObject=0x108) returned 1 [0077.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.704] GetLastError () returned 0x0 [0077.704] RtlWakeConditionVariable () returned 0x0 [0077.704] GetCurrentThreadId () returned 0x9ac [0077.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".ldf") returned 0x0 [0077.704] lstrlenW (lpString=".vhd") returned 4 [0077.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".vhd") returned 0x0 [0077.704] lstrlenW (lpString=".vhdx") returned 5 [0077.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".vhdx") returned 0x0 [0077.704] lstrlenW (lpString=".pst") returned 4 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".pst") returned 0x0 [0077.705] lstrlenW (lpString=".ost") returned 4 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".ost") returned 0x0 [0077.705] lstrlenW (lpString=".bak") returned 4 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".bak") returned 0x0 [0077.705] lstrlenW (lpString=".bac") returned 4 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".bac") returned 0x0 [0077.705] lstrlenW (lpString=".sys") returned 4 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".sys") returned 0x0 [0077.705] lstrlenW (lpString=".v2i") returned 4 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".v2i") returned 0x0 [0077.705] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.708] lstrlenW (lpString=".sql") returned 4 [0077.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".sql") returned 0x0 [0077.708] lstrlenW (lpString=".mdf") returned 4 [0077.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".mdf") returned 0x0 [0077.708] lstrlenW (lpString=".txt") returned 4 [0077.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".txt") returned 0x0 [0077.708] lstrlenW (lpString=".dbf") returned 4 [0077.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".dbf") returned 0x0 [0077.708] lstrlenW (lpString=".ckp") returned 4 [0077.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".ckp") returned 0x0 [0077.708] lstrlenW (lpString=".dacpac") returned 7 [0077.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".dacpac") returned 0x0 [0077.709] lstrlenW (lpString=".db3") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".db3") returned 0x0 [0077.709] lstrlenW (lpString=".dtxs") returned 5 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".dtxs") returned 0x0 [0077.709] lstrlenW (lpString=".mdt") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".mdt") returned 0x0 [0077.709] lstrlenW (lpString=".sdf") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".sdf") returned 0x0 [0077.709] lstrlenW (lpString=".MDF") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".MDF") returned 0x0 [0077.709] lstrlenW (lpString=".DBF") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".DBF") returned 0x0 [0077.709] lstrlenW (lpString=".DB") returned 3 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".DB") returned 0x0 [0077.709] lstrlenW (lpString=".db") returned 3 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".db") returned 0x0 [0077.709] lstrlenW (lpString=".ndf") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".ndf") returned 0x0 [0077.709] lstrlenW (lpString=".NDF") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".NDF") returned 0x0 [0077.709] lstrlenW (lpString=".Mdf") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".Mdf") returned 0x0 [0077.709] lstrlenW (lpString=".dat") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".dat") returned 0x0 [0077.709] lstrlenW (lpString=".DAT") returned 4 [0077.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".DAT") returned 0x0 [0077.710] lstrlenW (lpString=".ldf") returned 4 [0077.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".ldf") returned 0x0 [0077.710] lstrlenW (lpString=".LDF") returned 4 [0077.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch=".LDF") returned 0x0 [0077.710] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.710] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.711] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.711] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.711] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19771196646) returned 1 [0077.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd21cc70, dwHighDateTime=0x1d585b4)) [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb520 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb520 | out: hHeap=0x260000) returned 1 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2ceb80 [0077.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ceb80 | out: hHeap=0x260000) returned 1 [0077.712] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.712] GetLastError () returned 0x0 [0077.712] GetLastError () returned 0x0 [0077.712] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.712] GetLastError () returned 0x0 [0077.712] GetLastError () returned 0x0 [0077.714] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe329, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.714] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1cd7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1cd7, lpOverlapped=0x0) returned 1 [0077.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.714] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.714] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.714] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.714] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.714] CloseHandle (hObject=0xe4) returned 1 [0077.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.715] GetLastError () returned 0x0 [0077.716] RtlWakeConditionVariable () returned 0x0 [0077.716] GetCurrentThreadId () returned 0x9ac [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".ldf") returned 0x0 [0077.716] lstrlenW (lpString=".vhd") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".vhd") returned 0x0 [0077.716] lstrlenW (lpString=".vhdx") returned 5 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".vhdx") returned 0x0 [0077.716] lstrlenW (lpString=".pst") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".pst") returned 0x0 [0077.716] lstrlenW (lpString=".ost") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".ost") returned 0x0 [0077.716] lstrlenW (lpString=".bak") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".bak") returned 0x0 [0077.716] lstrlenW (lpString=".bac") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".bac") returned 0x0 [0077.716] lstrlenW (lpString=".sys") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".sys") returned 0x0 [0077.716] lstrlenW (lpString=".v2i") returned 4 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".v2i") returned 0x0 [0077.716] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.717] lstrlenW (lpString=".sql") returned 4 [0077.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".sql") returned 0x0 [0077.717] lstrlenW (lpString=".mdf") returned 4 [0077.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".mdf") returned 0x0 [0077.717] lstrlenW (lpString=".txt") returned 4 [0077.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".txt") returned 0x0 [0077.717] lstrlenW (lpString=".dbf") returned 4 [0077.717] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".dbf") returned 0x0 [0077.718] lstrlenW (lpString=".ckp") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".ckp") returned 0x0 [0077.718] lstrlenW (lpString=".dacpac") returned 7 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".dacpac") returned 0x0 [0077.718] lstrlenW (lpString=".db3") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".db3") returned 0x0 [0077.718] lstrlenW (lpString=".dtxs") returned 5 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".dtxs") returned 0x0 [0077.718] lstrlenW (lpString=".mdt") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".mdt") returned 0x0 [0077.718] lstrlenW (lpString=".sdf") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".sdf") returned 0x0 [0077.718] lstrlenW (lpString=".MDF") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".MDF") returned 0x0 [0077.718] lstrlenW (lpString=".DBF") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".DBF") returned 0x0 [0077.718] lstrlenW (lpString=".DB") returned 3 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".DB") returned 0x0 [0077.718] lstrlenW (lpString=".db") returned 3 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".db") returned 0x0 [0077.718] lstrlenW (lpString=".ndf") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".ndf") returned 0x0 [0077.718] lstrlenW (lpString=".NDF") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".NDF") returned 0x0 [0077.718] lstrlenW (lpString=".Mdf") returned 4 [0077.718] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".Mdf") returned 0x0 [0077.719] lstrlenW (lpString=".dat") returned 4 [0077.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".dat") returned 0x0 [0077.719] lstrlenW (lpString=".DAT") returned 4 [0077.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".DAT") returned 0x0 [0077.719] lstrlenW (lpString=".ldf") returned 4 [0077.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".ldf") returned 0x0 [0077.719] lstrlenW (lpString=".LDF") returned 4 [0077.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch=".LDF") returned 0x0 [0077.719] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.719] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.719] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.739] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.739] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.739] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19773996200) returned 1 [0077.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd268f30, dwHighDateTime=0x1d585b4)) [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb558 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb558 | out: hHeap=0x260000) returned 1 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf558 [0077.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.739] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf558 | out: hHeap=0x260000) returned 1 [0077.740] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.740] GetLastError () returned 0x0 [0077.740] GetLastError () returned 0x0 [0077.740] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.740] GetLastError () returned 0x0 [0077.740] GetLastError () returned 0x0 [0077.742] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe467, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.742] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1b99, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b99, lpOverlapped=0x0) returned 1 [0077.742] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.742] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.742] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.742] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.742] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.742] CloseHandle (hObject=0xe4) returned 1 [0077.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.744] GetLastError () returned 0x0 [0077.744] RtlWakeConditionVariable () returned 0x0 [0077.744] GetCurrentThreadId () returned 0x9ac [0077.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".ldf") returned 0x0 [0077.744] lstrlenW (lpString=".vhd") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".vhd") returned 0x0 [0077.745] lstrlenW (lpString=".vhdx") returned 5 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".vhdx") returned 0x0 [0077.745] lstrlenW (lpString=".pst") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".pst") returned 0x0 [0077.745] lstrlenW (lpString=".ost") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".ost") returned 0x0 [0077.745] lstrlenW (lpString=".bak") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".bak") returned 0x0 [0077.745] lstrlenW (lpString=".bac") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".bac") returned 0x0 [0077.745] lstrlenW (lpString=".sys") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".sys") returned 0x0 [0077.745] lstrlenW (lpString=".v2i") returned 4 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".v2i") returned 0x0 [0077.745] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.746] lstrlenW (lpString=".sql") returned 4 [0077.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".sql") returned 0x0 [0077.746] lstrlenW (lpString=".mdf") returned 4 [0077.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".mdf") returned 0x0 [0077.746] lstrlenW (lpString=".txt") returned 4 [0077.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".txt") returned 0x0 [0077.746] lstrlenW (lpString=".dbf") returned 4 [0077.746] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".dbf") returned 0x0 [0077.747] lstrlenW (lpString=".ckp") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".ckp") returned 0x0 [0077.747] lstrlenW (lpString=".dacpac") returned 7 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".dacpac") returned 0x0 [0077.747] lstrlenW (lpString=".db3") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".db3") returned 0x0 [0077.747] lstrlenW (lpString=".dtxs") returned 5 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".dtxs") returned 0x0 [0077.747] lstrlenW (lpString=".mdt") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".mdt") returned 0x0 [0077.747] lstrlenW (lpString=".sdf") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".sdf") returned 0x0 [0077.747] lstrlenW (lpString=".MDF") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".MDF") returned 0x0 [0077.747] lstrlenW (lpString=".DBF") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".DBF") returned 0x0 [0077.747] lstrlenW (lpString=".DB") returned 3 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".DB") returned 0x0 [0077.747] lstrlenW (lpString=".db") returned 3 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".db") returned 0x0 [0077.747] lstrlenW (lpString=".ndf") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".ndf") returned 0x0 [0077.747] lstrlenW (lpString=".NDF") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".NDF") returned 0x0 [0077.747] lstrlenW (lpString=".Mdf") returned 4 [0077.747] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".Mdf") returned 0x0 [0077.748] lstrlenW (lpString=".dat") returned 4 [0077.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".dat") returned 0x0 [0077.748] lstrlenW (lpString=".DAT") returned 4 [0077.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".DAT") returned 0x0 [0077.748] lstrlenW (lpString=".ldf") returned 4 [0077.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".ldf") returned 0x0 [0077.748] lstrlenW (lpString=".LDF") returned 4 [0077.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch=".LDF") returned 0x0 [0077.748] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.748] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.748] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.749] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.749] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.749] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19775010015) returned 1 [0077.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd268f30, dwHighDateTime=0x1d585b4)) [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb590 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb590 | out: hHeap=0x260000) returned 1 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.749] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf600 [0077.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf600 | out: hHeap=0x260000) returned 1 [0077.750] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.750] GetLastError () returned 0x0 [0077.750] GetLastError () returned 0x0 [0077.750] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.750] GetLastError () returned 0x0 [0077.750] GetLastError () returned 0x0 [0077.752] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffd03e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.752] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2fc2, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2fc2, lpOverlapped=0x0) returned 1 [0077.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.753] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.753] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.753] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.753] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.753] CloseHandle (hObject=0xe4) returned 1 [0077.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.755] GetLastError () returned 0x0 [0077.755] RtlWakeConditionVariable () returned 0x0 [0077.755] GetCurrentThreadId () returned 0x9ac [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".ldf") returned 0x0 [0077.755] lstrlenW (lpString=".vhd") returned 4 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".vhd") returned 0x0 [0077.755] lstrlenW (lpString=".vhdx") returned 5 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".vhdx") returned 0x0 [0077.755] lstrlenW (lpString=".pst") returned 4 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".pst") returned 0x0 [0077.755] lstrlenW (lpString=".ost") returned 4 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".ost") returned 0x0 [0077.755] lstrlenW (lpString=".bak") returned 4 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".bak") returned 0x0 [0077.755] lstrlenW (lpString=".bac") returned 4 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".bac") returned 0x0 [0077.755] lstrlenW (lpString=".sys") returned 4 [0077.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".sys") returned 0x0 [0077.755] lstrlenW (lpString=".v2i") returned 4 [0077.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".v2i") returned 0x0 [0077.756] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.758] lstrlenW (lpString=".sql") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".sql") returned 0x0 [0077.758] lstrlenW (lpString=".mdf") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".mdf") returned 0x0 [0077.758] lstrlenW (lpString=".txt") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".txt") returned 0x0 [0077.758] lstrlenW (lpString=".dbf") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".dbf") returned 0x0 [0077.758] lstrlenW (lpString=".ckp") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".ckp") returned 0x0 [0077.758] lstrlenW (lpString=".dacpac") returned 7 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".dacpac") returned 0x0 [0077.758] lstrlenW (lpString=".db3") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".db3") returned 0x0 [0077.758] lstrlenW (lpString=".dtxs") returned 5 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".dtxs") returned 0x0 [0077.758] lstrlenW (lpString=".mdt") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".mdt") returned 0x0 [0077.758] lstrlenW (lpString=".sdf") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".sdf") returned 0x0 [0077.758] lstrlenW (lpString=".MDF") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".MDF") returned 0x0 [0077.758] lstrlenW (lpString=".DBF") returned 4 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".DBF") returned 0x0 [0077.758] lstrlenW (lpString=".DB") returned 3 [0077.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".DB") returned 0x0 [0077.759] lstrlenW (lpString=".db") returned 3 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".db") returned 0x0 [0077.759] lstrlenW (lpString=".ndf") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".ndf") returned 0x0 [0077.759] lstrlenW (lpString=".NDF") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".NDF") returned 0x0 [0077.759] lstrlenW (lpString=".Mdf") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".Mdf") returned 0x0 [0077.759] lstrlenW (lpString=".dat") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".dat") returned 0x0 [0077.759] lstrlenW (lpString=".DAT") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".DAT") returned 0x0 [0077.759] lstrlenW (lpString=".ldf") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".ldf") returned 0x0 [0077.759] lstrlenW (lpString=".LDF") returned 4 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch=".LDF") returned 0x0 [0077.759] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.759] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.760] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.760] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.760] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19776142823) returned 1 [0077.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd28f090, dwHighDateTime=0x1d585b4)) [0077.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb5c8 [0077.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb5c8 | out: hHeap=0x260000) returned 1 [0077.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf6a8 [0077.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.761] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf6a8 | out: hHeap=0x260000) returned 1 [0077.761] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.761] GetLastError () returned 0x0 [0077.761] GetLastError () returned 0x0 [0077.762] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.762] GetLastError () returned 0x0 [0077.762] GetLastError () returned 0x0 [0077.764] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff7125, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.765] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8edb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x8edb, lpOverlapped=0x0) returned 1 [0077.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.765] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.765] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.765] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.765] CloseHandle (hObject=0xe4) returned 1 [0077.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.767] GetLastError () returned 0x0 [0077.767] RtlWakeConditionVariable () returned 0x0 [0077.767] GetCurrentThreadId () returned 0x9ac [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".ldf") returned 0x0 [0077.767] lstrlenW (lpString=".vhd") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".vhd") returned 0x0 [0077.767] lstrlenW (lpString=".vhdx") returned 5 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".vhdx") returned 0x0 [0077.767] lstrlenW (lpString=".pst") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".pst") returned 0x0 [0077.767] lstrlenW (lpString=".ost") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".ost") returned 0x0 [0077.767] lstrlenW (lpString=".bak") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".bak") returned 0x0 [0077.767] lstrlenW (lpString=".bac") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".bac") returned 0x0 [0077.767] lstrlenW (lpString=".sys") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".sys") returned 0x0 [0077.767] lstrlenW (lpString=".v2i") returned 4 [0077.767] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".v2i") returned 0x0 [0077.768] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.768] lstrlenW (lpString=".sql") returned 4 [0077.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".sql") returned 0x0 [0077.769] lstrlenW (lpString=".mdf") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".mdf") returned 0x0 [0077.769] lstrlenW (lpString=".txt") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".txt") returned 0x0 [0077.769] lstrlenW (lpString=".dbf") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".dbf") returned 0x0 [0077.769] lstrlenW (lpString=".ckp") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".ckp") returned 0x0 [0077.769] lstrlenW (lpString=".dacpac") returned 7 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".dacpac") returned 0x0 [0077.769] lstrlenW (lpString=".db3") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".db3") returned 0x0 [0077.769] lstrlenW (lpString=".dtxs") returned 5 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".dtxs") returned 0x0 [0077.769] lstrlenW (lpString=".mdt") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".mdt") returned 0x0 [0077.769] lstrlenW (lpString=".sdf") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".sdf") returned 0x0 [0077.769] lstrlenW (lpString=".MDF") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".MDF") returned 0x0 [0077.769] lstrlenW (lpString=".DBF") returned 4 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".DBF") returned 0x0 [0077.769] lstrlenW (lpString=".DB") returned 3 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".DB") returned 0x0 [0077.769] lstrlenW (lpString=".db") returned 3 [0077.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".db") returned 0x0 [0077.770] lstrlenW (lpString=".ndf") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".ndf") returned 0x0 [0077.770] lstrlenW (lpString=".NDF") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".NDF") returned 0x0 [0077.770] lstrlenW (lpString=".Mdf") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".Mdf") returned 0x0 [0077.770] lstrlenW (lpString=".dat") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".dat") returned 0x0 [0077.770] lstrlenW (lpString=".DAT") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".DAT") returned 0x0 [0077.770] lstrlenW (lpString=".ldf") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".ldf") returned 0x0 [0077.770] lstrlenW (lpString=".LDF") returned 4 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch=".LDF") returned 0x0 [0077.770] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.770] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.771] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.771] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.771] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19777237687) returned 1 [0077.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd2b51f0, dwHighDateTime=0x1d585b4)) [0077.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb600 [0077.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb600 | out: hHeap=0x260000) returned 1 [0077.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf750 [0077.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf750 | out: hHeap=0x260000) returned 1 [0077.772] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.772] GetLastError () returned 0x0 [0077.772] GetLastError () returned 0x0 [0077.772] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.772] GetLastError () returned 0x0 [0077.773] GetLastError () returned 0x0 [0077.774] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffef59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.774] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10a7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x10a7, lpOverlapped=0x0) returned 1 [0077.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.775] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.775] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.775] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.775] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.775] CloseHandle (hObject=0xe4) returned 1 [0077.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.777] GetLastError () returned 0x0 [0077.777] RtlWakeConditionVariable () returned 0x0 [0077.777] GetCurrentThreadId () returned 0x9ac [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".ldf") returned 0x0 [0077.777] lstrlenW (lpString=".vhd") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".vhd") returned 0x0 [0077.777] lstrlenW (lpString=".vhdx") returned 5 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".vhdx") returned 0x0 [0077.777] lstrlenW (lpString=".pst") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".pst") returned 0x0 [0077.777] lstrlenW (lpString=".ost") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".ost") returned 0x0 [0077.777] lstrlenW (lpString=".bak") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".bak") returned 0x0 [0077.777] lstrlenW (lpString=".bac") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".bac") returned 0x0 [0077.777] lstrlenW (lpString=".sys") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".sys") returned 0x0 [0077.777] lstrlenW (lpString=".v2i") returned 4 [0077.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".v2i") returned 0x0 [0077.777] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.779] lstrlenW (lpString=".sql") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".sql") returned 0x0 [0077.779] lstrlenW (lpString=".mdf") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".mdf") returned 0x0 [0077.779] lstrlenW (lpString=".txt") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".txt") returned 0x0 [0077.779] lstrlenW (lpString=".dbf") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".dbf") returned 0x0 [0077.779] lstrlenW (lpString=".ckp") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".ckp") returned 0x0 [0077.779] lstrlenW (lpString=".dacpac") returned 7 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".dacpac") returned 0x0 [0077.779] lstrlenW (lpString=".db3") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".db3") returned 0x0 [0077.779] lstrlenW (lpString=".dtxs") returned 5 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".dtxs") returned 0x0 [0077.779] lstrlenW (lpString=".mdt") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".mdt") returned 0x0 [0077.779] lstrlenW (lpString=".sdf") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".sdf") returned 0x0 [0077.779] lstrlenW (lpString=".MDF") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".MDF") returned 0x0 [0077.779] lstrlenW (lpString=".DBF") returned 4 [0077.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".DBF") returned 0x0 [0077.779] lstrlenW (lpString=".DB") returned 3 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".DB") returned 0x0 [0077.780] lstrlenW (lpString=".db") returned 3 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".db") returned 0x0 [0077.780] lstrlenW (lpString=".ndf") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".ndf") returned 0x0 [0077.780] lstrlenW (lpString=".NDF") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".NDF") returned 0x0 [0077.780] lstrlenW (lpString=".Mdf") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".Mdf") returned 0x0 [0077.780] lstrlenW (lpString=".dat") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".dat") returned 0x0 [0077.780] lstrlenW (lpString=".DAT") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".DAT") returned 0x0 [0077.780] lstrlenW (lpString=".ldf") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".ldf") returned 0x0 [0077.780] lstrlenW (lpString=".LDF") returned 4 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch=".LDF") returned 0x0 [0077.780] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.780] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.781] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.781] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.781] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.781] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19778246472) returned 1 [0077.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd2b51f0, dwHighDateTime=0x1d585b4)) [0077.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb638 [0077.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb638 | out: hHeap=0x260000) returned 1 [0077.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf7f8 [0077.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf7f8 | out: hHeap=0x260000) returned 1 [0077.782] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.782] GetLastError () returned 0x0 [0077.783] GetLastError () returned 0x0 [0077.783] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.783] GetLastError () returned 0x0 [0077.783] GetLastError () returned 0x0 [0077.784] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffee81, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.785] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x117f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x117f, lpOverlapped=0x0) returned 1 [0077.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.785] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.785] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.785] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.785] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.785] CloseHandle (hObject=0xe4) returned 1 [0077.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0077.785] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0077.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.786] GetLastError () returned 0x0 [0077.787] RtlWakeConditionVariable () returned 0x0 [0077.787] GetCurrentThreadId () returned 0x9ac [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".ldf") returned 0x0 [0077.787] lstrlenW (lpString=".vhd") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".vhd") returned 0x0 [0077.787] lstrlenW (lpString=".vhdx") returned 5 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".vhdx") returned 0x0 [0077.787] lstrlenW (lpString=".pst") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".pst") returned 0x0 [0077.787] lstrlenW (lpString=".ost") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".ost") returned 0x0 [0077.787] lstrlenW (lpString=".bak") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".bak") returned 0x0 [0077.787] lstrlenW (lpString=".bac") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".bac") returned 0x0 [0077.787] lstrlenW (lpString=".sys") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".sys") returned 0x0 [0077.787] lstrlenW (lpString=".v2i") returned 4 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".v2i") returned 0x0 [0077.787] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.787] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0077.788] lstrlenW (lpString=".sql") returned 4 [0077.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".sql") returned 0x0 [0077.788] lstrlenW (lpString=".mdf") returned 4 [0077.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".mdf") returned 0x0 [0077.788] lstrlenW (lpString=".txt") returned 4 [0077.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".txt") returned 0x0 [0077.789] lstrlenW (lpString=".dbf") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".dbf") returned 0x0 [0077.789] lstrlenW (lpString=".ckp") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".ckp") returned 0x0 [0077.789] lstrlenW (lpString=".dacpac") returned 7 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".dacpac") returned 0x0 [0077.789] lstrlenW (lpString=".db3") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".db3") returned 0x0 [0077.789] lstrlenW (lpString=".dtxs") returned 5 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".dtxs") returned 0x0 [0077.789] lstrlenW (lpString=".mdt") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".mdt") returned 0x0 [0077.789] lstrlenW (lpString=".sdf") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".sdf") returned 0x0 [0077.789] lstrlenW (lpString=".MDF") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".MDF") returned 0x0 [0077.789] lstrlenW (lpString=".DBF") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".DBF") returned 0x0 [0077.789] lstrlenW (lpString=".DB") returned 3 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".DB") returned 0x0 [0077.789] lstrlenW (lpString=".db") returned 3 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".db") returned 0x0 [0077.789] lstrlenW (lpString=".ndf") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".ndf") returned 0x0 [0077.789] lstrlenW (lpString=".NDF") returned 4 [0077.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".NDF") returned 0x0 [0077.790] lstrlenW (lpString=".Mdf") returned 4 [0077.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".Mdf") returned 0x0 [0077.790] lstrlenW (lpString=".dat") returned 4 [0077.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".dat") returned 0x0 [0077.790] lstrlenW (lpString=".DAT") returned 4 [0077.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".DAT") returned 0x0 [0077.790] lstrlenW (lpString=".ldf") returned 4 [0077.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".ldf") returned 0x0 [0077.790] lstrlenW (lpString=".LDF") returned 4 [0077.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch=".LDF") returned 0x0 [0077.790] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0077.790] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0077.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0077.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0077.790] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0077.791] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0077.791] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0077.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0077.791] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19779219410) returned 1 [0077.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd2db350, dwHighDateTime=0x1d585b4)) [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb670 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0077.791] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb670 | out: hHeap=0x260000) returned 1 [0077.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0077.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0077.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf8a0 [0077.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0077.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0077.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf8a0 | out: hHeap=0x260000) returned 1 [0077.792] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0077.792] GetLastError () returned 0x0 [0077.792] GetLastError () returned 0x0 [0077.792] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0077.792] GetLastError () returned 0x0 [0077.792] GetLastError () returned 0x0 [0077.877] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffdc6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.887] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2395, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2395, lpOverlapped=0x0) returned 1 [0077.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0077.888] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.888] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0077.888] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0077.888] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0077.888] CloseHandle (hObject=0xe4) returned 1 [0077.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0077.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.[deadmin@cock.li].deadmin")) returned 1 [0077.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0077.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0077.889] GetLastError () returned 0x0 [0077.889] RtlWakeConditionVariable () returned 0x0 [0077.890] GetCurrentThreadId () returned 0x9ac [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".ldf") returned 0x0 [0077.890] lstrlenW (lpString=".vhd") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".vhd") returned 0x0 [0077.890] lstrlenW (lpString=".vhdx") returned 5 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".vhdx") returned 0x0 [0077.890] lstrlenW (lpString=".pst") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".pst") returned 0x0 [0077.890] lstrlenW (lpString=".ost") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".ost") returned 0x0 [0077.890] lstrlenW (lpString=".bak") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".bak") returned 0x0 [0077.890] lstrlenW (lpString=".bac") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".bac") returned 0x0 [0077.890] lstrlenW (lpString=".sys") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".sys") returned 0x0 [0077.890] lstrlenW (lpString=".v2i") returned 4 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".v2i") returned 0x0 [0077.890] lstrlenW (lpString="s\r\n.v2i") returned 7 [0077.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0077.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0077.985] lstrlenW (lpString=".sql") returned 4 [0077.985] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".sql") returned 0x0 [0077.994] lstrlenW (lpString=".mdf") returned 4 [0077.994] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".mdf") returned 0x0 [0077.994] lstrlenW (lpString=".txt") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".txt") returned 0x0 [0078.000] lstrlenW (lpString=".dbf") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".dbf") returned 0x0 [0078.000] lstrlenW (lpString=".ckp") returned 4 [0078.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".ckp") returned 0x0 [0078.000] lstrlenW (lpString=".dacpac") returned 7 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".dacpac") returned 0x0 [0078.001] lstrlenW (lpString=".db3") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".db3") returned 0x0 [0078.001] lstrlenW (lpString=".dtxs") returned 5 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".dtxs") returned 0x0 [0078.001] lstrlenW (lpString=".mdt") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".mdt") returned 0x0 [0078.001] lstrlenW (lpString=".sdf") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".sdf") returned 0x0 [0078.001] lstrlenW (lpString=".MDF") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".MDF") returned 0x0 [0078.001] lstrlenW (lpString=".DBF") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".DBF") returned 0x0 [0078.001] lstrlenW (lpString=".DB") returned 3 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".DB") returned 0x0 [0078.001] lstrlenW (lpString=".db") returned 3 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".db") returned 0x0 [0078.001] lstrlenW (lpString=".ndf") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".ndf") returned 0x0 [0078.001] lstrlenW (lpString=".NDF") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".NDF") returned 0x0 [0078.001] lstrlenW (lpString=".Mdf") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".Mdf") returned 0x0 [0078.001] lstrlenW (lpString=".dat") returned 4 [0078.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".dat") returned 0x0 [0078.001] lstrlenW (lpString=".DAT") returned 4 [0078.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".DAT") returned 0x0 [0078.002] lstrlenW (lpString=".ldf") returned 4 [0078.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".ldf") returned 0x0 [0078.002] lstrlenW (lpString=".LDF") returned 4 [0078.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch=".LDF") returned 0x0 [0078.002] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.002] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.003] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.003] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.003] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19800398732) returned 1 [0078.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd4f0690, dwHighDateTime=0x1d585b4)) [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c4c0 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c4c0 | out: hHeap=0x260000) returned 1 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cf9f0 [0078.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0078.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cf9f0 | out: hHeap=0x260000) returned 1 [0078.004] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.004] GetLastError () returned 0x0 [0078.004] GetLastError () returned 0x0 [0078.004] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.004] GetLastError () returned 0x0 [0078.004] GetLastError () returned 0x0 [0078.006] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffefc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.006] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1038, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1038, lpOverlapped=0x0) returned 1 [0078.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.006] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.006] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.006] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.006] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.006] CloseHandle (hObject=0xd8) returned 1 [0078.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.007] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.[deadmin@cock.li].deadmin")) returned 1 [0078.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.008] GetLastError () returned 0x0 [0078.008] RtlWakeConditionVariable () returned 0x0 [0078.008] GetCurrentThreadId () returned 0x9ac [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".ldf") returned 0x0 [0078.008] lstrlenW (lpString=".vhd") returned 4 [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".vhd") returned 0x0 [0078.008] lstrlenW (lpString=".vhdx") returned 5 [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".vhdx") returned 0x0 [0078.008] lstrlenW (lpString=".pst") returned 4 [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".pst") returned 0x0 [0078.008] lstrlenW (lpString=".ost") returned 4 [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".ost") returned 0x0 [0078.008] lstrlenW (lpString=".bak") returned 4 [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".bak") returned 0x0 [0078.008] lstrlenW (lpString=".bac") returned 4 [0078.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".bac") returned 0x0 [0078.009] lstrlenW (lpString=".sys") returned 4 [0078.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".sys") returned 0x0 [0078.009] lstrlenW (lpString=".v2i") returned 4 [0078.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".v2i") returned 0x0 [0078.009] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.010] lstrlenW (lpString=".sql") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".sql") returned 0x0 [0078.010] lstrlenW (lpString=".mdf") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".mdf") returned 0x0 [0078.010] lstrlenW (lpString=".txt") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".txt") returned 0x0 [0078.010] lstrlenW (lpString=".dbf") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".dbf") returned 0x0 [0078.010] lstrlenW (lpString=".ckp") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".ckp") returned 0x0 [0078.010] lstrlenW (lpString=".dacpac") returned 7 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".dacpac") returned 0x0 [0078.010] lstrlenW (lpString=".db3") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".db3") returned 0x0 [0078.010] lstrlenW (lpString=".dtxs") returned 5 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".dtxs") returned 0x0 [0078.010] lstrlenW (lpString=".mdt") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".mdt") returned 0x0 [0078.010] lstrlenW (lpString=".sdf") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".sdf") returned 0x0 [0078.010] lstrlenW (lpString=".MDF") returned 4 [0078.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".MDF") returned 0x0 [0078.010] lstrlenW (lpString=".DBF") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".DBF") returned 0x0 [0078.011] lstrlenW (lpString=".DB") returned 3 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".DB") returned 0x0 [0078.011] lstrlenW (lpString=".db") returned 3 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".db") returned 0x0 [0078.011] lstrlenW (lpString=".ndf") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".ndf") returned 0x0 [0078.011] lstrlenW (lpString=".NDF") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".NDF") returned 0x0 [0078.011] lstrlenW (lpString=".Mdf") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".Mdf") returned 0x0 [0078.011] lstrlenW (lpString=".dat") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".dat") returned 0x0 [0078.011] lstrlenW (lpString=".DAT") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".DAT") returned 0x0 [0078.011] lstrlenW (lpString=".ldf") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".ldf") returned 0x0 [0078.011] lstrlenW (lpString=".LDF") returned 4 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch=".LDF") returned 0x0 [0078.011] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.011] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.012] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.012] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.012] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19801350181) returned 1 [0078.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd4f0690, dwHighDateTime=0x1d585b4)) [0078.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb980 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb980 | out: hHeap=0x260000) returned 1 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d02f8 [0078.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0078.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d02f8 | out: hHeap=0x260000) returned 1 [0078.013] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.013] GetLastError () returned 0x0 [0078.013] GetLastError () returned 0x0 [0078.014] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.014] GetLastError () returned 0x0 [0078.014] GetLastError () returned 0x0 [0078.015] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffddd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.016] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x222a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x222a, lpOverlapped=0x0) returned 1 [0078.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.016] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.016] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.016] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.016] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.016] CloseHandle (hObject=0xd8) returned 1 [0078.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.017] GetLastError () returned 0x0 [0078.017] RtlWakeConditionVariable () returned 0x0 [0078.018] GetCurrentThreadId () returned 0x9ac [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".ldf") returned 0x0 [0078.018] lstrlenW (lpString=".vhd") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".vhd") returned 0x0 [0078.018] lstrlenW (lpString=".vhdx") returned 5 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".vhdx") returned 0x0 [0078.018] lstrlenW (lpString=".pst") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".pst") returned 0x0 [0078.018] lstrlenW (lpString=".ost") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".ost") returned 0x0 [0078.018] lstrlenW (lpString=".bak") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".bak") returned 0x0 [0078.018] lstrlenW (lpString=".bac") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".bac") returned 0x0 [0078.018] lstrlenW (lpString=".sys") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".sys") returned 0x0 [0078.018] lstrlenW (lpString=".v2i") returned 4 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".v2i") returned 0x0 [0078.018] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.022] lstrlenW (lpString=".sql") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".sql") returned 0x0 [0078.022] lstrlenW (lpString=".mdf") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".mdf") returned 0x0 [0078.022] lstrlenW (lpString=".txt") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".txt") returned 0x0 [0078.022] lstrlenW (lpString=".dbf") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".dbf") returned 0x0 [0078.022] lstrlenW (lpString=".ckp") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".ckp") returned 0x0 [0078.022] lstrlenW (lpString=".dacpac") returned 7 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".dacpac") returned 0x0 [0078.022] lstrlenW (lpString=".db3") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".db3") returned 0x0 [0078.022] lstrlenW (lpString=".dtxs") returned 5 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".dtxs") returned 0x0 [0078.022] lstrlenW (lpString=".mdt") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".mdt") returned 0x0 [0078.022] lstrlenW (lpString=".sdf") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".sdf") returned 0x0 [0078.022] lstrlenW (lpString=".MDF") returned 4 [0078.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".MDF") returned 0x0 [0078.022] lstrlenW (lpString=".DBF") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".DBF") returned 0x0 [0078.023] lstrlenW (lpString=".DB") returned 3 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".DB") returned 0x0 [0078.023] lstrlenW (lpString=".db") returned 3 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".db") returned 0x0 [0078.023] lstrlenW (lpString=".ndf") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".ndf") returned 0x0 [0078.023] lstrlenW (lpString=".NDF") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".NDF") returned 0x0 [0078.023] lstrlenW (lpString=".Mdf") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".Mdf") returned 0x0 [0078.023] lstrlenW (lpString=".dat") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".dat") returned 0x0 [0078.023] lstrlenW (lpString=".DAT") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".DAT") returned 0x0 [0078.023] lstrlenW (lpString=".ldf") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".ldf") returned 0x0 [0078.023] lstrlenW (lpString=".LDF") returned 4 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch=".LDF") returned 0x0 [0078.023] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0078.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.023] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.024] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.024] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0078.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0078.024] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19802550407) returned 1 [0078.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd5167f0, dwHighDateTime=0x1d585b4)) [0078.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cb9b8 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cb9b8 | out: hHeap=0x260000) returned 1 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.025] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2678 [0078.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.025] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.025] GetLastError () returned 0x0 [0078.025] GetLastError () returned 0x0 [0078.025] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.026] GetLastError () returned 0x0 [0078.026] GetLastError () returned 0x0 [0078.027] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffdde5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.028] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x221b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x221b, lpOverlapped=0x0) returned 1 [0078.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.028] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.028] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.028] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.028] CloseHandle (hObject=0xd8) returned 1 [0078.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0078.029] GetLastError () returned 0x0 [0078.029] RtlWakeConditionVariable () returned 0x0 [0078.029] GetCurrentThreadId () returned 0x9ac [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".ldf") returned 0x0 [0078.030] lstrlenW (lpString=".vhd") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".vhd") returned 0x0 [0078.030] lstrlenW (lpString=".vhdx") returned 5 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".vhdx") returned 0x0 [0078.030] lstrlenW (lpString=".pst") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".pst") returned 0x0 [0078.030] lstrlenW (lpString=".ost") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".ost") returned 0x0 [0078.030] lstrlenW (lpString=".bak") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".bak") returned 0x0 [0078.030] lstrlenW (lpString=".bac") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".bac") returned 0x0 [0078.030] lstrlenW (lpString=".sys") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".sys") returned 0x0 [0078.030] lstrlenW (lpString=".v2i") returned 4 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".v2i") returned 0x0 [0078.030] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.031] lstrlenW (lpString=".sql") returned 4 [0078.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".sql") returned 0x0 [0078.046] lstrlenW (lpString=".mdf") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".mdf") returned 0x0 [0078.046] lstrlenW (lpString=".txt") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".txt") returned 0x0 [0078.046] lstrlenW (lpString=".dbf") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".dbf") returned 0x0 [0078.046] lstrlenW (lpString=".ckp") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".ckp") returned 0x0 [0078.046] lstrlenW (lpString=".dacpac") returned 7 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".dacpac") returned 0x0 [0078.046] lstrlenW (lpString=".db3") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".db3") returned 0x0 [0078.046] lstrlenW (lpString=".dtxs") returned 5 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".dtxs") returned 0x0 [0078.046] lstrlenW (lpString=".mdt") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".mdt") returned 0x0 [0078.046] lstrlenW (lpString=".sdf") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".sdf") returned 0x0 [0078.046] lstrlenW (lpString=".MDF") returned 4 [0078.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".MDF") returned 0x0 [0078.047] lstrlenW (lpString=".DBF") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".DBF") returned 0x0 [0078.047] lstrlenW (lpString=".DB") returned 3 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".DB") returned 0x0 [0078.047] lstrlenW (lpString=".db") returned 3 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".db") returned 0x0 [0078.047] lstrlenW (lpString=".ndf") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".ndf") returned 0x0 [0078.047] lstrlenW (lpString=".NDF") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".NDF") returned 0x0 [0078.047] lstrlenW (lpString=".Mdf") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".Mdf") returned 0x0 [0078.047] lstrlenW (lpString=".dat") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".dat") returned 0x0 [0078.047] lstrlenW (lpString=".DAT") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".DAT") returned 0x0 [0078.047] lstrlenW (lpString=".ldf") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".ldf") returned 0x0 [0078.047] lstrlenW (lpString=".LDF") returned 4 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch=".LDF") returned 0x0 [0078.047] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.048] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.048] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.048] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.048] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19804960422) returned 1 [0078.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd562ab0, dwHighDateTime=0x1d585b4)) [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cba60 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cba60 | out: hHeap=0x260000) returned 1 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d02f8 [0078.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d02f8 | out: hHeap=0x260000) returned 1 [0078.049] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.049] GetLastError () returned 0x0 [0078.050] GetLastError () returned 0x0 [0078.050] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.050] GetLastError () returned 0x0 [0078.050] GetLastError () returned 0x0 [0078.059] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffde98, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.059] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2168, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2168, lpOverlapped=0x0) returned 1 [0078.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.060] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.060] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.060] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.060] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.060] CloseHandle (hObject=0xd8) returned 1 [0078.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.062] GetLastError () returned 0x0 [0078.062] RtlWakeConditionVariable () returned 0x0 [0078.062] GetCurrentThreadId () returned 0x9ac [0078.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".ldf") returned 0x0 [0078.063] lstrlenW (lpString=".vhd") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".vhd") returned 0x0 [0078.063] lstrlenW (lpString=".vhdx") returned 5 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".vhdx") returned 0x0 [0078.063] lstrlenW (lpString=".pst") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".pst") returned 0x0 [0078.063] lstrlenW (lpString=".ost") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".ost") returned 0x0 [0078.063] lstrlenW (lpString=".bak") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".bak") returned 0x0 [0078.063] lstrlenW (lpString=".bac") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".bac") returned 0x0 [0078.063] lstrlenW (lpString=".sys") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".sys") returned 0x0 [0078.063] lstrlenW (lpString=".v2i") returned 4 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".v2i") returned 0x0 [0078.063] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.085] lstrlenW (lpString=".sql") returned 4 [0078.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".sql") returned 0x0 [0078.085] lstrlenW (lpString=".mdf") returned 4 [0078.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".mdf") returned 0x0 [0078.086] lstrlenW (lpString=".txt") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".txt") returned 0x0 [0078.086] lstrlenW (lpString=".dbf") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".dbf") returned 0x0 [0078.086] lstrlenW (lpString=".ckp") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".ckp") returned 0x0 [0078.086] lstrlenW (lpString=".dacpac") returned 7 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".dacpac") returned 0x0 [0078.086] lstrlenW (lpString=".db3") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".db3") returned 0x0 [0078.086] lstrlenW (lpString=".dtxs") returned 5 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".dtxs") returned 0x0 [0078.086] lstrlenW (lpString=".mdt") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".mdt") returned 0x0 [0078.086] lstrlenW (lpString=".sdf") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".sdf") returned 0x0 [0078.086] lstrlenW (lpString=".MDF") returned 4 [0078.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".MDF") returned 0x0 [0078.087] lstrlenW (lpString=".DBF") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".DBF") returned 0x0 [0078.087] lstrlenW (lpString=".DB") returned 3 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".DB") returned 0x0 [0078.087] lstrlenW (lpString=".db") returned 3 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".db") returned 0x0 [0078.087] lstrlenW (lpString=".ndf") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".ndf") returned 0x0 [0078.087] lstrlenW (lpString=".NDF") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".NDF") returned 0x0 [0078.087] lstrlenW (lpString=".Mdf") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".Mdf") returned 0x0 [0078.087] lstrlenW (lpString=".dat") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".dat") returned 0x0 [0078.087] lstrlenW (lpString=".DAT") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".DAT") returned 0x0 [0078.087] lstrlenW (lpString=".ldf") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".ldf") returned 0x0 [0078.087] lstrlenW (lpString=".LDF") returned 4 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch=".LDF") returned 0x0 [0078.087] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.087] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.088] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.088] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.088] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19808956236) returned 1 [0078.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd5aed70, dwHighDateTime=0x1d585b4)) [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbb08 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbb08 | out: hHeap=0x260000) returned 1 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d04f0 [0078.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d04f0 | out: hHeap=0x260000) returned 1 [0078.089] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.089] GetLastError () returned 0x0 [0078.089] GetLastError () returned 0x0 [0078.090] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.090] GetLastError () returned 0x0 [0078.090] GetLastError () returned 0x0 [0078.093] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.093] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.095] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.095] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.096] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.096] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.096] CloseHandle (hObject=0xd8) returned 1 [0078.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0078.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0078.098] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.098] GetLastError () returned 0x0 [0078.098] RtlWakeConditionVariable () returned 0x0 [0078.098] GetCurrentThreadId () returned 0x9ac [0078.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".ldf") returned 0x0 [0078.098] lstrlenW (lpString=".vhd") returned 4 [0078.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".vhd") returned 0x0 [0078.098] lstrlenW (lpString=".vhdx") returned 5 [0078.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".vhdx") returned 0x0 [0078.098] lstrlenW (lpString=".pst") returned 4 [0078.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".pst") returned 0x0 [0078.098] lstrlenW (lpString=".ost") returned 4 [0078.098] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".ost") returned 0x0 [0078.099] lstrlenW (lpString=".bak") returned 4 [0078.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".bak") returned 0x0 [0078.099] lstrlenW (lpString=".bac") returned 4 [0078.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".bac") returned 0x0 [0078.099] lstrlenW (lpString=".sys") returned 4 [0078.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".sys") returned 0x0 [0078.099] lstrlenW (lpString=".v2i") returned 4 [0078.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".v2i") returned 0x0 [0078.099] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.099] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.100] lstrlenW (lpString=".sql") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".sql") returned 0x0 [0078.100] lstrlenW (lpString=".mdf") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".mdf") returned 0x0 [0078.100] lstrlenW (lpString=".txt") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".txt") returned 0x0 [0078.100] lstrlenW (lpString=".dbf") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".dbf") returned 0x0 [0078.100] lstrlenW (lpString=".ckp") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".ckp") returned 0x0 [0078.100] lstrlenW (lpString=".dacpac") returned 7 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".dacpac") returned 0x0 [0078.100] lstrlenW (lpString=".db3") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".db3") returned 0x0 [0078.100] lstrlenW (lpString=".dtxs") returned 5 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".dtxs") returned 0x0 [0078.100] lstrlenW (lpString=".mdt") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".mdt") returned 0x0 [0078.100] lstrlenW (lpString=".sdf") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".sdf") returned 0x0 [0078.100] lstrlenW (lpString=".MDF") returned 4 [0078.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".MDF") returned 0x0 [0078.101] lstrlenW (lpString=".DBF") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".DBF") returned 0x0 [0078.101] lstrlenW (lpString=".DB") returned 3 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".DB") returned 0x0 [0078.101] lstrlenW (lpString=".db") returned 3 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".db") returned 0x0 [0078.101] lstrlenW (lpString=".ndf") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".ndf") returned 0x0 [0078.101] lstrlenW (lpString=".NDF") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".NDF") returned 0x0 [0078.101] lstrlenW (lpString=".Mdf") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".Mdf") returned 0x0 [0078.101] lstrlenW (lpString=".dat") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".dat") returned 0x0 [0078.101] lstrlenW (lpString=".DAT") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".DAT") returned 0x0 [0078.101] lstrlenW (lpString=".ldf") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".ldf") returned 0x0 [0078.101] lstrlenW (lpString=".LDF") returned 4 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch=".LDF") returned 0x0 [0078.101] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.102] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.102] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.102] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.102] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19810360594) returned 1 [0078.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd5d4ed0, dwHighDateTime=0x1d585b4)) [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbb40 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbb40 | out: hHeap=0x260000) returned 1 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d06e8 [0078.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.103] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d06e8 | out: hHeap=0x260000) returned 1 [0078.103] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.103] GetLastError () returned 0x0 [0078.104] GetLastError () returned 0x0 [0078.104] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.104] GetLastError () returned 0x0 [0078.104] GetLastError () returned 0x0 [0078.105] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffa2c2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.106] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5d3e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5d3e, lpOverlapped=0x0) returned 1 [0078.106] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.106] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.106] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.106] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.106] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.106] CloseHandle (hObject=0xd8) returned 1 [0078.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0078.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0078.108] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.108] GetLastError () returned 0x0 [0078.108] RtlWakeConditionVariable () returned 0x0 [0078.108] GetCurrentThreadId () returned 0x9ac [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".ldf") returned 0x0 [0078.108] lstrlenW (lpString=".vhd") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".vhd") returned 0x0 [0078.108] lstrlenW (lpString=".vhdx") returned 5 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".vhdx") returned 0x0 [0078.108] lstrlenW (lpString=".pst") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".pst") returned 0x0 [0078.108] lstrlenW (lpString=".ost") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".ost") returned 0x0 [0078.108] lstrlenW (lpString=".bak") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".bak") returned 0x0 [0078.108] lstrlenW (lpString=".bac") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".bac") returned 0x0 [0078.108] lstrlenW (lpString=".sys") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".sys") returned 0x0 [0078.108] lstrlenW (lpString=".v2i") returned 4 [0078.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".v2i") returned 0x0 [0078.109] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.109] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch="s\r\n.v2i") returned 0x0 [0078.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.110] lstrlenW (lpString=".sql") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".sql") returned 0x0 [0078.110] lstrlenW (lpString=".mdf") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".mdf") returned 0x0 [0078.110] lstrlenW (lpString=".txt") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".txt") returned 0x0 [0078.110] lstrlenW (lpString=".dbf") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".dbf") returned 0x0 [0078.110] lstrlenW (lpString=".ckp") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".ckp") returned 0x0 [0078.110] lstrlenW (lpString=".dacpac") returned 7 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".dacpac") returned 0x0 [0078.110] lstrlenW (lpString=".db3") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".db3") returned 0x0 [0078.110] lstrlenW (lpString=".dtxs") returned 5 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".dtxs") returned 0x0 [0078.110] lstrlenW (lpString=".mdt") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".mdt") returned 0x0 [0078.110] lstrlenW (lpString=".sdf") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".sdf") returned 0x0 [0078.110] lstrlenW (lpString=".MDF") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".MDF") returned 0x0 [0078.110] lstrlenW (lpString=".DBF") returned 4 [0078.110] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".DBF") returned 0x0 [0078.110] lstrlenW (lpString=".DB") returned 3 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".DB") returned 0x0 [0078.111] lstrlenW (lpString=".db") returned 3 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".db") returned 0x0 [0078.111] lstrlenW (lpString=".ndf") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".ndf") returned 0x0 [0078.111] lstrlenW (lpString=".NDF") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".NDF") returned 0x0 [0078.111] lstrlenW (lpString=".Mdf") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".Mdf") returned 0x0 [0078.111] lstrlenW (lpString=".dat") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".dat") returned 0x0 [0078.111] lstrlenW (lpString=".DAT") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".DAT") returned 0x0 [0078.111] lstrlenW (lpString=".ldf") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".ldf") returned 0x0 [0078.111] lstrlenW (lpString=".LDF") returned 4 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch=".LDF") returned 0x0 [0078.111] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.111] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.111] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x311400) returned 1 [0078.112] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.112] CryptReleaseContext (hProv=0x311400, dwFlags=0x0) returned 1 [0078.112] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.112] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19811342768) returned 1 [0078.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd5fb030, dwHighDateTime=0x1d585b4)) [0078.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbb78 [0078.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbb78 | out: hHeap=0x260000) returned 1 [0078.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2cd210 [0078.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.113] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cd210 | out: hHeap=0x260000) returned 1 [0078.113] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.113] GetLastError () returned 0x0 [0078.113] GetLastError () returned 0x0 [0078.113] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.114] GetLastError () returned 0x0 [0078.114] GetLastError () returned 0x0 [0078.183] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffde10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.183] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x21f0, lpOverlapped=0x0) returned 1 [0078.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.183] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.183] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.183] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.183] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.183] CloseHandle (hObject=0xd8) returned 1 [0078.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0078.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx.[deadmin@cock.li].deadmin")) returned 1 [0078.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0078.297] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.297] GetLastError () returned 0x0 [0078.297] RtlWakeConditionVariable () returned 0x0 [0078.297] GetCurrentThreadId () returned 0x9ac [0078.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".ldf") returned 0x0 [0078.297] lstrlenW (lpString=".vhd") returned 4 [0078.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".vhd") returned 0x0 [0078.297] lstrlenW (lpString=".vhdx") returned 5 [0078.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".vhdx") returned 0x0 [0078.297] lstrlenW (lpString=".pst") returned 4 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".pst") returned 0x0 [0078.298] lstrlenW (lpString=".ost") returned 4 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".ost") returned 0x0 [0078.298] lstrlenW (lpString=".bak") returned 4 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".bak") returned 0x0 [0078.298] lstrlenW (lpString=".bac") returned 4 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".bac") returned 0x0 [0078.298] lstrlenW (lpString=".sys") returned 4 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".sys") returned 0x0 [0078.298] lstrlenW (lpString=".v2i") returned 4 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".v2i") returned 0x0 [0078.298] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.298] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.299] lstrlenW (lpString=".sql") returned 4 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".sql") returned 0x0 [0078.299] lstrlenW (lpString=".mdf") returned 4 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".mdf") returned 0x0 [0078.299] lstrlenW (lpString=".txt") returned 4 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".txt") returned 0x0 [0078.299] lstrlenW (lpString=".dbf") returned 4 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".dbf") returned 0x0 [0078.299] lstrlenW (lpString=".ckp") returned 4 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".ckp") returned 0x0 [0078.299] lstrlenW (lpString=".dacpac") returned 7 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".dacpac") returned 0x0 [0078.299] lstrlenW (lpString=".db3") returned 4 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".db3") returned 0x0 [0078.299] lstrlenW (lpString=".dtxs") returned 5 [0078.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".dtxs") returned 0x0 [0078.300] lstrlenW (lpString=".mdt") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".mdt") returned 0x0 [0078.300] lstrlenW (lpString=".sdf") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".sdf") returned 0x0 [0078.300] lstrlenW (lpString=".MDF") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".MDF") returned 0x0 [0078.300] lstrlenW (lpString=".DBF") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".DBF") returned 0x0 [0078.300] lstrlenW (lpString=".DB") returned 3 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".DB") returned 0x0 [0078.300] lstrlenW (lpString=".db") returned 3 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".db") returned 0x0 [0078.300] lstrlenW (lpString=".ndf") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".ndf") returned 0x0 [0078.300] lstrlenW (lpString=".NDF") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".NDF") returned 0x0 [0078.300] lstrlenW (lpString=".Mdf") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".Mdf") returned 0x0 [0078.300] lstrlenW (lpString=".dat") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".dat") returned 0x0 [0078.300] lstrlenW (lpString=".DAT") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".DAT") returned 0x0 [0078.300] lstrlenW (lpString=".ldf") returned 4 [0078.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".ldf") returned 0x0 [0078.300] lstrlenW (lpString=".LDF") returned 4 [0078.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch=".LDF") returned 0x0 [0078.301] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.301] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756968) returned 1 [0078.301] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.301] CryptReleaseContext (hProv=0x2756968, dwFlags=0x0) returned 1 [0078.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.302] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19830282507) returned 1 [0078.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd7c40b0, dwHighDateTime=0x1d585b4)) [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbef8 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbef8 | out: hHeap=0x260000) returned 1 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.302] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.303] GetLastError () returned 0x0 [0078.303] GetLastError () returned 0x0 [0078.303] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.303] GetLastError () returned 0x0 [0078.303] GetLastError () returned 0x0 [0078.305] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffdc80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.305] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2380, lpOverlapped=0x0) returned 1 [0078.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.305] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.305] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.305] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.305] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.305] CloseHandle (hObject=0xd8) returned 1 [0078.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0078.306] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0078.307] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.307] GetLastError () returned 0x0 [0078.307] RtlWakeConditionVariable () returned 0x0 [0078.307] GetCurrentThreadId () returned 0x9ac [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".ldf") returned 0x0 [0078.307] lstrlenW (lpString=".vhd") returned 4 [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".vhd") returned 0x0 [0078.307] lstrlenW (lpString=".vhdx") returned 5 [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".vhdx") returned 0x0 [0078.307] lstrlenW (lpString=".pst") returned 4 [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".pst") returned 0x0 [0078.307] lstrlenW (lpString=".ost") returned 4 [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".ost") returned 0x0 [0078.307] lstrlenW (lpString=".bak") returned 4 [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".bak") returned 0x0 [0078.307] lstrlenW (lpString=".bac") returned 4 [0078.307] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".bac") returned 0x0 [0078.308] lstrlenW (lpString=".sys") returned 4 [0078.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".sys") returned 0x0 [0078.308] lstrlenW (lpString=".v2i") returned 4 [0078.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".v2i") returned 0x0 [0078.308] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.309] lstrlenW (lpString=".sql") returned 4 [0078.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".sql") returned 0x0 [0078.309] lstrlenW (lpString=".mdf") returned 4 [0078.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".mdf") returned 0x0 [0078.309] lstrlenW (lpString=".txt") returned 4 [0078.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".txt") returned 0x0 [0078.310] lstrlenW (lpString=".dbf") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".dbf") returned 0x0 [0078.310] lstrlenW (lpString=".ckp") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".ckp") returned 0x0 [0078.310] lstrlenW (lpString=".dacpac") returned 7 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".dacpac") returned 0x0 [0078.310] lstrlenW (lpString=".db3") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".db3") returned 0x0 [0078.310] lstrlenW (lpString=".dtxs") returned 5 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".dtxs") returned 0x0 [0078.310] lstrlenW (lpString=".mdt") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".mdt") returned 0x0 [0078.310] lstrlenW (lpString=".sdf") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".sdf") returned 0x0 [0078.310] lstrlenW (lpString=".MDF") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".MDF") returned 0x0 [0078.310] lstrlenW (lpString=".DBF") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".DBF") returned 0x0 [0078.310] lstrlenW (lpString=".DB") returned 3 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".DB") returned 0x0 [0078.310] lstrlenW (lpString=".db") returned 3 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".db") returned 0x0 [0078.310] lstrlenW (lpString=".ndf") returned 4 [0078.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".ndf") returned 0x0 [0078.310] lstrlenW (lpString=".NDF") returned 4 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".NDF") returned 0x0 [0078.311] lstrlenW (lpString=".Mdf") returned 4 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".Mdf") returned 0x0 [0078.311] lstrlenW (lpString=".dat") returned 4 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".dat") returned 0x0 [0078.311] lstrlenW (lpString=".DAT") returned 4 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".DAT") returned 0x0 [0078.311] lstrlenW (lpString=".ldf") returned 4 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".ldf") returned 0x0 [0078.311] lstrlenW (lpString=".LDF") returned 4 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch=".LDF") returned 0x0 [0078.311] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.311] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27569f0) returned 1 [0078.312] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.312] CryptReleaseContext (hProv=0x27569f0, dwFlags=0x0) returned 1 [0078.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.312] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19831341641) returned 1 [0078.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd7ea210, dwHighDateTime=0x1d585b4)) [0078.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbf30 [0078.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbf30 | out: hHeap=0x260000) returned 1 [0078.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f24b0 [0078.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.313] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.313] GetLastError () returned 0x0 [0078.313] GetLastError () returned 0x0 [0078.313] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.314] GetLastError () returned 0x0 [0078.314] GetLastError () returned 0x0 [0078.316] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff6890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.316] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x9770, lpOverlapped=0x0) returned 1 [0078.316] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.316] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.316] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.317] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.317] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.317] CloseHandle (hObject=0xd8) returned 1 [0078.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0078.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0078.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.318] GetLastError () returned 0x0 [0078.318] RtlWakeConditionVariable () returned 0x0 [0078.318] GetCurrentThreadId () returned 0x9ac [0078.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".ldf") returned 0x0 [0078.318] lstrlenW (lpString=".vhd") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".vhd") returned 0x0 [0078.319] lstrlenW (lpString=".vhdx") returned 5 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".vhdx") returned 0x0 [0078.319] lstrlenW (lpString=".pst") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".pst") returned 0x0 [0078.319] lstrlenW (lpString=".ost") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".ost") returned 0x0 [0078.319] lstrlenW (lpString=".bak") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".bak") returned 0x0 [0078.319] lstrlenW (lpString=".bac") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".bac") returned 0x0 [0078.319] lstrlenW (lpString=".sys") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".sys") returned 0x0 [0078.319] lstrlenW (lpString=".v2i") returned 4 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".v2i") returned 0x0 [0078.319] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.319] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0078.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.321] lstrlenW (lpString=".sql") returned 4 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".sql") returned 0x0 [0078.321] lstrlenW (lpString=".mdf") returned 4 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".mdf") returned 0x0 [0078.321] lstrlenW (lpString=".txt") returned 4 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".txt") returned 0x0 [0078.321] lstrlenW (lpString=".dbf") returned 4 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".dbf") returned 0x0 [0078.321] lstrlenW (lpString=".ckp") returned 4 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".ckp") returned 0x0 [0078.321] lstrlenW (lpString=".dacpac") returned 7 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".dacpac") returned 0x0 [0078.321] lstrlenW (lpString=".db3") returned 4 [0078.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".db3") returned 0x0 [0078.321] lstrlenW (lpString=".dtxs") returned 5 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".dtxs") returned 0x0 [0078.322] lstrlenW (lpString=".mdt") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".mdt") returned 0x0 [0078.322] lstrlenW (lpString=".sdf") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".sdf") returned 0x0 [0078.322] lstrlenW (lpString=".MDF") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".MDF") returned 0x0 [0078.322] lstrlenW (lpString=".DBF") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".DBF") returned 0x0 [0078.322] lstrlenW (lpString=".DB") returned 3 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".DB") returned 0x0 [0078.322] lstrlenW (lpString=".db") returned 3 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".db") returned 0x0 [0078.322] lstrlenW (lpString=".ndf") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".ndf") returned 0x0 [0078.322] lstrlenW (lpString=".NDF") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".NDF") returned 0x0 [0078.322] lstrlenW (lpString=".Mdf") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".Mdf") returned 0x0 [0078.322] lstrlenW (lpString=".dat") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".dat") returned 0x0 [0078.322] lstrlenW (lpString=".DAT") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".DAT") returned 0x0 [0078.322] lstrlenW (lpString=".ldf") returned 4 [0078.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".ldf") returned 0x0 [0078.322] lstrlenW (lpString=".LDF") returned 4 [0078.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch=".LDF") returned 0x0 [0078.323] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.323] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.323] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27569f0) returned 1 [0078.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.324] CryptReleaseContext (hProv=0x27569f0, dwFlags=0x0) returned 1 [0078.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.324] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19832484032) returned 1 [0078.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd7ea210, dwHighDateTime=0x1d585b4)) [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cbf68 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cbf68 | out: hHeap=0x260000) returned 1 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0988 [0078.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0988 | out: hHeap=0x260000) returned 1 [0078.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.325] GetLastError () returned 0x0 [0078.325] GetLastError () returned 0x0 [0078.325] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.325] GetLastError () returned 0x0 [0078.325] GetLastError () returned 0x0 [0078.328] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.328] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.329] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.329] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.331] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.331] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.331] CloseHandle (hObject=0xd8) returned 1 [0078.331] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dfe0 [0078.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.[deadmin@cock.li].deadmin")) returned 1 [0078.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dfe0 | out: hHeap=0x260000) returned 1 [0078.332] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.332] GetLastError () returned 0x0 [0078.333] RtlWakeConditionVariable () returned 0x0 [0078.333] GetCurrentThreadId () returned 0x9ac [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".ldf") returned 0x0 [0078.333] lstrlenW (lpString=".vhd") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".vhd") returned 0x0 [0078.333] lstrlenW (lpString=".vhdx") returned 5 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".vhdx") returned 0x0 [0078.333] lstrlenW (lpString=".pst") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".pst") returned 0x0 [0078.333] lstrlenW (lpString=".ost") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".ost") returned 0x0 [0078.333] lstrlenW (lpString=".bak") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".bak") returned 0x0 [0078.333] lstrlenW (lpString=".bac") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".bac") returned 0x0 [0078.333] lstrlenW (lpString=".sys") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".sys") returned 0x0 [0078.333] lstrlenW (lpString=".v2i") returned 4 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".v2i") returned 0x0 [0078.333] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch="s\r\n.v2i") returned 0x0 [0078.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.334] lstrlenW (lpString=".sql") returned 4 [0078.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".sql") returned 0x0 [0078.334] lstrlenW (lpString=".mdf") returned 4 [0078.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".mdf") returned 0x0 [0078.335] lstrlenW (lpString=".txt") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".txt") returned 0x0 [0078.335] lstrlenW (lpString=".dbf") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".dbf") returned 0x0 [0078.335] lstrlenW (lpString=".ckp") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".ckp") returned 0x0 [0078.335] lstrlenW (lpString=".dacpac") returned 7 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".dacpac") returned 0x0 [0078.335] lstrlenW (lpString=".db3") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".db3") returned 0x0 [0078.335] lstrlenW (lpString=".dtxs") returned 5 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".dtxs") returned 0x0 [0078.335] lstrlenW (lpString=".mdt") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".mdt") returned 0x0 [0078.335] lstrlenW (lpString=".sdf") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".sdf") returned 0x0 [0078.335] lstrlenW (lpString=".MDF") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".MDF") returned 0x0 [0078.335] lstrlenW (lpString=".DBF") returned 4 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".DBF") returned 0x0 [0078.335] lstrlenW (lpString=".DB") returned 3 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".DB") returned 0x0 [0078.335] lstrlenW (lpString=".db") returned 3 [0078.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".db") returned 0x0 [0078.335] lstrlenW (lpString=".ndf") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".ndf") returned 0x0 [0078.336] lstrlenW (lpString=".NDF") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".NDF") returned 0x0 [0078.336] lstrlenW (lpString=".Mdf") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".Mdf") returned 0x0 [0078.336] lstrlenW (lpString=".dat") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".dat") returned 0x0 [0078.336] lstrlenW (lpString=".DAT") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".DAT") returned 0x0 [0078.336] lstrlenW (lpString=".ldf") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".ldf") returned 0x0 [0078.336] lstrlenW (lpString=".LDF") returned 4 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch=".LDF") returned 0x0 [0078.336] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.336] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756b00) returned 1 [0078.337] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.337] CryptReleaseContext (hProv=0x2756b00, dwFlags=0x0) returned 1 [0078.337] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.337] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19833828013) returned 1 [0078.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd810370, dwHighDateTime=0x1d585b4)) [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c9c8 [0078.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c9c8 | out: hHeap=0x260000) returned 1 [0078.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0598 [0078.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275b528 [0078.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0598 | out: hHeap=0x260000) returned 1 [0078.338] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.338] GetLastError () returned 0x0 [0078.338] GetLastError () returned 0x0 [0078.338] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.338] GetLastError () returned 0x0 [0078.338] GetLastError () returned 0x0 [0078.431] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff9bc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.431] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x644, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x644, lpOverlapped=0x0) returned 1 [0078.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0078.442] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.442] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.442] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.442] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.442] CloseHandle (hObject=0xd8) returned 1 [0078.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.[deadmin@cock.li].deadmin")) returned 1 [0078.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.444] GetLastError () returned 0x0 [0078.444] RtlWakeConditionVariable () returned 0x0 [0078.444] GetCurrentThreadId () returned 0x9ac [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".ldf") returned 0x0 [0078.445] lstrlenW (lpString=".vhd") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".vhd") returned 0x0 [0078.445] lstrlenW (lpString=".vhdx") returned 5 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".vhdx") returned 0x0 [0078.445] lstrlenW (lpString=".pst") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".pst") returned 0x0 [0078.445] lstrlenW (lpString=".ost") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".ost") returned 0x0 [0078.445] lstrlenW (lpString=".bak") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".bak") returned 0x0 [0078.445] lstrlenW (lpString=".bac") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".bac") returned 0x0 [0078.445] lstrlenW (lpString=".sys") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".sys") returned 0x0 [0078.445] lstrlenW (lpString=".v2i") returned 4 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".v2i") returned 0x0 [0078.445] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.459] lstrlenW (lpString=".sql") returned 4 [0078.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".sql") returned 0x0 [0078.460] lstrlenW (lpString=".mdf") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".mdf") returned 0x0 [0078.460] lstrlenW (lpString=".txt") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".txt") returned 0x0 [0078.460] lstrlenW (lpString=".dbf") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".dbf") returned 0x0 [0078.460] lstrlenW (lpString=".ckp") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".ckp") returned 0x0 [0078.460] lstrlenW (lpString=".dacpac") returned 7 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".dacpac") returned 0x0 [0078.460] lstrlenW (lpString=".db3") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".db3") returned 0x0 [0078.460] lstrlenW (lpString=".dtxs") returned 5 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".dtxs") returned 0x0 [0078.460] lstrlenW (lpString=".mdt") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".mdt") returned 0x0 [0078.460] lstrlenW (lpString=".sdf") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".sdf") returned 0x0 [0078.460] lstrlenW (lpString=".MDF") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".MDF") returned 0x0 [0078.460] lstrlenW (lpString=".DBF") returned 4 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".DBF") returned 0x0 [0078.460] lstrlenW (lpString=".DB") returned 3 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".DB") returned 0x0 [0078.460] lstrlenW (lpString=".db") returned 3 [0078.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".db") returned 0x0 [0078.461] lstrlenW (lpString=".ndf") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".ndf") returned 0x0 [0078.461] lstrlenW (lpString=".NDF") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".NDF") returned 0x0 [0078.461] lstrlenW (lpString=".Mdf") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".Mdf") returned 0x0 [0078.461] lstrlenW (lpString=".dat") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".dat") returned 0x0 [0078.461] lstrlenW (lpString=".DAT") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".DAT") returned 0x0 [0078.461] lstrlenW (lpString=".ldf") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".ldf") returned 0x0 [0078.461] lstrlenW (lpString=".LDF") returned 4 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch=".LDF") returned 0x0 [0078.461] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.461] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756c98) returned 1 [0078.462] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.462] CryptReleaseContext (hProv=0x2756c98, dwFlags=0x0) returned 1 [0078.462] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.462] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19846332942) returned 1 [0078.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbd940e70, dwHighDateTime=0x1d585b4)) [0078.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c760 [0078.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c760 | out: hHeap=0x260000) returned 1 [0078.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0790 [0078.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0078.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0790 | out: hHeap=0x260000) returned 1 [0078.463] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.463] GetLastError () returned 0x0 [0078.463] GetLastError () returned 0x0 [0078.463] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.463] GetLastError () returned 0x0 [0078.464] GetLastError () returned 0x0 [0078.467] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.467] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0078.467] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.467] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.586] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.587] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.587] CloseHandle (hObject=0xd8) returned 1 [0078.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.588] GetLastError () returned 0x0 [0078.588] RtlWakeConditionVariable () returned 0x0 [0078.588] GetCurrentThreadId () returned 0x9ac [0078.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".ldf") returned 0x0 [0078.588] lstrlenW (lpString=".vhd") returned 4 [0078.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".vhd") returned 0x0 [0078.588] lstrlenW (lpString=".vhdx") returned 5 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".vhdx") returned 0x0 [0078.589] lstrlenW (lpString=".pst") returned 4 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".pst") returned 0x0 [0078.589] lstrlenW (lpString=".ost") returned 4 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".ost") returned 0x0 [0078.589] lstrlenW (lpString=".bak") returned 4 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".bak") returned 0x0 [0078.589] lstrlenW (lpString=".bac") returned 4 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".bac") returned 0x0 [0078.589] lstrlenW (lpString=".sys") returned 4 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".sys") returned 0x0 [0078.589] lstrlenW (lpString=".v2i") returned 4 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".v2i") returned 0x0 [0078.589] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0078.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.590] lstrlenW (lpString=".sql") returned 4 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".sql") returned 0x0 [0078.590] lstrlenW (lpString=".mdf") returned 4 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".mdf") returned 0x0 [0078.590] lstrlenW (lpString=".txt") returned 4 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".txt") returned 0x0 [0078.590] lstrlenW (lpString=".dbf") returned 4 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".dbf") returned 0x0 [0078.590] lstrlenW (lpString=".ckp") returned 4 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".ckp") returned 0x0 [0078.590] lstrlenW (lpString=".dacpac") returned 7 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".dacpac") returned 0x0 [0078.590] lstrlenW (lpString=".db3") returned 4 [0078.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".db3") returned 0x0 [0078.591] lstrlenW (lpString=".dtxs") returned 5 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".dtxs") returned 0x0 [0078.591] lstrlenW (lpString=".mdt") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".mdt") returned 0x0 [0078.591] lstrlenW (lpString=".sdf") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".sdf") returned 0x0 [0078.591] lstrlenW (lpString=".MDF") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".MDF") returned 0x0 [0078.591] lstrlenW (lpString=".DBF") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".DBF") returned 0x0 [0078.591] lstrlenW (lpString=".DB") returned 3 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".DB") returned 0x0 [0078.591] lstrlenW (lpString=".db") returned 3 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".db") returned 0x0 [0078.591] lstrlenW (lpString=".ndf") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".ndf") returned 0x0 [0078.591] lstrlenW (lpString=".NDF") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".NDF") returned 0x0 [0078.591] lstrlenW (lpString=".Mdf") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".Mdf") returned 0x0 [0078.591] lstrlenW (lpString=".dat") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".dat") returned 0x0 [0078.591] lstrlenW (lpString=".DAT") returned 4 [0078.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".DAT") returned 0x0 [0078.591] lstrlenW (lpString=".ldf") returned 4 [0078.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".ldf") returned 0x0 [0078.592] lstrlenW (lpString=".LDF") returned 4 [0078.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch=".LDF") returned 0x0 [0078.592] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.592] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27569f0) returned 1 [0078.593] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.593] CryptReleaseContext (hProv=0x27569f0, dwFlags=0x0) returned 1 [0078.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.593] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19859486020) returned 1 [0078.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbda97ad0, dwHighDateTime=0x1d585b4)) [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c680 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c680 | out: hHeap=0x260000) returned 1 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0ad8 [0078.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f2840 [0078.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0ad8 | out: hHeap=0x260000) returned 1 [0078.594] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.595] GetLastError () returned 0x0 [0078.595] GetLastError () returned 0x0 [0078.595] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.595] GetLastError () returned 0x0 [0078.595] GetLastError () returned 0x0 [0078.688] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff5680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.688] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xa980, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xa980, lpOverlapped=0x0) returned 1 [0078.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.688] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.689] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.689] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.689] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.689] CloseHandle (hObject=0xd8) returned 1 [0078.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0078.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.[deadmin@cock.li].deadmin")) returned 1 [0078.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0078.697] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.697] GetLastError () returned 0x0 [0078.697] RtlWakeConditionVariable () returned 0x0 [0078.697] GetCurrentThreadId () returned 0x9ac [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".ldf") returned 0x0 [0078.697] lstrlenW (lpString=".vhd") returned 4 [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".vhd") returned 0x0 [0078.697] lstrlenW (lpString=".vhdx") returned 5 [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".vhdx") returned 0x0 [0078.697] lstrlenW (lpString=".pst") returned 4 [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".pst") returned 0x0 [0078.697] lstrlenW (lpString=".ost") returned 4 [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".ost") returned 0x0 [0078.697] lstrlenW (lpString=".bak") returned 4 [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".bak") returned 0x0 [0078.697] lstrlenW (lpString=".bac") returned 4 [0078.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".bac") returned 0x0 [0078.697] lstrlenW (lpString=".sys") returned 4 [0078.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".sys") returned 0x0 [0078.698] lstrlenW (lpString=".v2i") returned 4 [0078.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".v2i") returned 0x0 [0078.698] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch="s\r\n.v2i") returned 0x0 [0078.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.699] lstrlenW (lpString=".sql") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".sql") returned 0x0 [0078.699] lstrlenW (lpString=".mdf") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".mdf") returned 0x0 [0078.699] lstrlenW (lpString=".txt") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".txt") returned 0x0 [0078.699] lstrlenW (lpString=".dbf") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".dbf") returned 0x0 [0078.699] lstrlenW (lpString=".ckp") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".ckp") returned 0x0 [0078.699] lstrlenW (lpString=".dacpac") returned 7 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".dacpac") returned 0x0 [0078.699] lstrlenW (lpString=".db3") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".db3") returned 0x0 [0078.699] lstrlenW (lpString=".dtxs") returned 5 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".dtxs") returned 0x0 [0078.699] lstrlenW (lpString=".mdt") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".mdt") returned 0x0 [0078.699] lstrlenW (lpString=".sdf") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".sdf") returned 0x0 [0078.699] lstrlenW (lpString=".MDF") returned 4 [0078.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".MDF") returned 0x0 [0078.699] lstrlenW (lpString=".DBF") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".DBF") returned 0x0 [0078.700] lstrlenW (lpString=".DB") returned 3 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".DB") returned 0x0 [0078.700] lstrlenW (lpString=".db") returned 3 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".db") returned 0x0 [0078.700] lstrlenW (lpString=".ndf") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".ndf") returned 0x0 [0078.700] lstrlenW (lpString=".NDF") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".NDF") returned 0x0 [0078.700] lstrlenW (lpString=".Mdf") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".Mdf") returned 0x0 [0078.700] lstrlenW (lpString=".dat") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".dat") returned 0x0 [0078.700] lstrlenW (lpString=".DAT") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".DAT") returned 0x0 [0078.700] lstrlenW (lpString=".ldf") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".ldf") returned 0x0 [0078.700] lstrlenW (lpString=".LDF") returned 4 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch=".LDF") returned 0x0 [0078.700] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.700] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756fc8) returned 1 [0078.701] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.701] CryptReleaseContext (hProv=0x2756fc8, dwFlags=0x0) returned 1 [0078.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.701] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19870251068) returned 1 [0078.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbdb7c310, dwHighDateTime=0x1d585b4)) [0078.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c5d8 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c5d8 | out: hHeap=0x260000) returned 1 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.702] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.702] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.702] GetLastError () returned 0x0 [0078.702] GetLastError () returned 0x0 [0078.703] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.703] GetLastError () returned 0x0 [0078.703] GetLastError () returned 0x0 [0078.704] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff286, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.704] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd7a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd7a, lpOverlapped=0x0) returned 1 [0078.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.704] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.705] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.705] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.705] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.705] CloseHandle (hObject=0xd8) returned 1 [0078.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0078.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.[deadmin@cock.li].deadmin")) returned 1 [0078.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0078.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.706] GetLastError () returned 0x0 [0078.706] RtlWakeConditionVariable () returned 0x27e828 [0078.706] GetCurrentThreadId () returned 0x9ac [0078.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".ldf") returned 0x0 [0078.707] lstrlenW (lpString=".vhd") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".vhd") returned 0x0 [0078.707] lstrlenW (lpString=".vhdx") returned 5 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".vhdx") returned 0x0 [0078.707] lstrlenW (lpString=".pst") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".pst") returned 0x0 [0078.707] lstrlenW (lpString=".ost") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".ost") returned 0x0 [0078.707] lstrlenW (lpString=".bak") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".bak") returned 0x0 [0078.707] lstrlenW (lpString=".bac") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".bac") returned 0x0 [0078.707] lstrlenW (lpString=".sys") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".sys") returned 0x0 [0078.707] lstrlenW (lpString=".v2i") returned 4 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".v2i") returned 0x0 [0078.707] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0078.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.708] lstrlenW (lpString=".sql") returned 4 [0078.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".sql") returned 0x0 [0078.708] lstrlenW (lpString=".mdf") returned 4 [0078.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".mdf") returned 0x0 [0078.708] lstrlenW (lpString=".txt") returned 4 [0078.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".txt") returned 0x0 [0078.708] lstrlenW (lpString=".dbf") returned 4 [0078.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".dbf") returned 0x0 [0078.708] lstrlenW (lpString=".ckp") returned 4 [0078.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".ckp") returned 0x0 [0078.708] lstrlenW (lpString=".dacpac") returned 7 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".dacpac") returned 0x0 [0078.709] lstrlenW (lpString=".db3") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".db3") returned 0x0 [0078.709] lstrlenW (lpString=".dtxs") returned 5 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".dtxs") returned 0x0 [0078.709] lstrlenW (lpString=".mdt") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".mdt") returned 0x0 [0078.709] lstrlenW (lpString=".sdf") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".sdf") returned 0x0 [0078.709] lstrlenW (lpString=".MDF") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".MDF") returned 0x0 [0078.709] lstrlenW (lpString=".DBF") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".DBF") returned 0x0 [0078.709] lstrlenW (lpString=".DB") returned 3 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".DB") returned 0x0 [0078.709] lstrlenW (lpString=".db") returned 3 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".db") returned 0x0 [0078.709] lstrlenW (lpString=".ndf") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".ndf") returned 0x0 [0078.709] lstrlenW (lpString=".NDF") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".NDF") returned 0x0 [0078.709] lstrlenW (lpString=".Mdf") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".Mdf") returned 0x0 [0078.709] lstrlenW (lpString=".dat") returned 4 [0078.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".dat") returned 0x0 [0078.709] lstrlenW (lpString=".DAT") returned 4 [0078.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".DAT") returned 0x0 [0078.710] lstrlenW (lpString=".ldf") returned 4 [0078.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".ldf") returned 0x0 [0078.710] lstrlenW (lpString=".LDF") returned 4 [0078.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch=".LDF") returned 0x0 [0078.710] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.710] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0078.711] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.711] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0078.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.711] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19871196896) returned 1 [0078.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbdba2470, dwHighDateTime=0x1d585b4)) [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275c5a0 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275c5a0 | out: hHeap=0x260000) returned 1 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3550 [0078.711] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.712] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.712] GetLastError () returned 0x0 [0078.712] GetLastError () returned 0x0 [0078.712] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.712] GetLastError () returned 0x0 [0078.712] GetLastError () returned 0x0 [0078.764] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.764] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0078.765] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.765] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0078.767] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0078.767] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0078.767] CloseHandle (hObject=0xd8) returned 1 [0078.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0078.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0078.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0078.769] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0078.769] GetLastError () returned 0x0 [0078.769] RtlWakeConditionVariable () returned 0x27e828 [0078.769] GetCurrentThreadId () returned 0x9ac [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".ldf") returned 0x0 [0078.769] lstrlenW (lpString=".vhd") returned 4 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".vhd") returned 0x0 [0078.769] lstrlenW (lpString=".vhdx") returned 5 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".vhdx") returned 0x0 [0078.769] lstrlenW (lpString=".pst") returned 4 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".pst") returned 0x0 [0078.769] lstrlenW (lpString=".ost") returned 4 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".ost") returned 0x0 [0078.769] lstrlenW (lpString=".bak") returned 4 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".bak") returned 0x0 [0078.769] lstrlenW (lpString=".bac") returned 4 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".bac") returned 0x0 [0078.769] lstrlenW (lpString=".sys") returned 4 [0078.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".sys") returned 0x0 [0078.770] lstrlenW (lpString=".v2i") returned 4 [0078.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".v2i") returned 0x0 [0078.770] lstrlenW (lpString="s\r\n.v2i") returned 7 [0078.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0078.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0078.771] lstrlenW (lpString=".sql") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".sql") returned 0x0 [0078.771] lstrlenW (lpString=".mdf") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".mdf") returned 0x0 [0078.771] lstrlenW (lpString=".txt") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".txt") returned 0x0 [0078.771] lstrlenW (lpString=".dbf") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".dbf") returned 0x0 [0078.771] lstrlenW (lpString=".ckp") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".ckp") returned 0x0 [0078.771] lstrlenW (lpString=".dacpac") returned 7 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".dacpac") returned 0x0 [0078.771] lstrlenW (lpString=".db3") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".db3") returned 0x0 [0078.771] lstrlenW (lpString=".dtxs") returned 5 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".dtxs") returned 0x0 [0078.771] lstrlenW (lpString=".mdt") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".mdt") returned 0x0 [0078.771] lstrlenW (lpString=".sdf") returned 4 [0078.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".sdf") returned 0x0 [0078.771] lstrlenW (lpString=".MDF") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".MDF") returned 0x0 [0078.772] lstrlenW (lpString=".DBF") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".DBF") returned 0x0 [0078.772] lstrlenW (lpString=".DB") returned 3 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".DB") returned 0x0 [0078.772] lstrlenW (lpString=".db") returned 3 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".db") returned 0x0 [0078.772] lstrlenW (lpString=".ndf") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".ndf") returned 0x0 [0078.772] lstrlenW (lpString=".NDF") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".NDF") returned 0x0 [0078.772] lstrlenW (lpString=".Mdf") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".Mdf") returned 0x0 [0078.772] lstrlenW (lpString=".dat") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".dat") returned 0x0 [0078.772] lstrlenW (lpString=".DAT") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".DAT") returned 0x0 [0078.772] lstrlenW (lpString=".ldf") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".ldf") returned 0x0 [0078.772] lstrlenW (lpString=".LDF") returned 4 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch=".LDF") returned 0x0 [0078.772] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0078.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0078.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0078.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0078.772] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27570d8) returned 1 [0078.773] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0078.773] CryptReleaseContext (hProv=0x27570d8, dwFlags=0x0) returned 1 [0078.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0078.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0078.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0078.773] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19877462885) returned 1 [0078.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbdc3a9f0, dwHighDateTime=0x1d585b4)) [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2cc080 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0078.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2cc080 | out: hHeap=0x260000) returned 1 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0078.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d03a0 [0078.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0078.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f3978 [0078.774] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d03a0 | out: hHeap=0x260000) returned 1 [0078.774] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0078.774] GetLastError () returned 0x0 [0078.775] GetLastError () returned 0x0 [0078.775] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0078.775] GetLastError () returned 0x0 [0078.775] GetLastError () returned 0x0 [0078.778] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.778] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0078.779] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0078.779] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.779] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.374] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.374] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.374] CloseHandle (hObject=0xd8) returned 1 [0079.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0079.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.[deadmin@cock.li].deadmin")) returned 1 [0079.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0079.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.404] GetLastError () returned 0x0 [0079.404] RtlWakeConditionVariable () returned 0x0 [0079.404] GetCurrentThreadId () returned 0x9ac [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.405] lstrlenW (lpString=".vhd") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.405] lstrlenW (lpString=".vhdx") returned 5 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.405] lstrlenW (lpString=".pst") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".pst") returned 0x0 [0079.405] lstrlenW (lpString=".ost") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".ost") returned 0x0 [0079.405] lstrlenW (lpString=".bak") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".bak") returned 0x0 [0079.405] lstrlenW (lpString=".bac") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".bac") returned 0x0 [0079.405] lstrlenW (lpString=".sys") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".sys") returned 0x0 [0079.405] lstrlenW (lpString=".v2i") returned 4 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.405] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.405] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.407] lstrlenW (lpString=".sql") returned 4 [0079.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".sql") returned 0x0 [0079.407] lstrlenW (lpString=".mdf") returned 4 [0079.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.407] lstrlenW (lpString=".txt") returned 4 [0079.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".txt") returned 0x0 [0079.407] lstrlenW (lpString=".dbf") returned 4 [0079.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.407] lstrlenW (lpString=".ckp") returned 4 [0079.407] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.408] lstrlenW (lpString=".dacpac") returned 7 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.408] lstrlenW (lpString=".db3") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".db3") returned 0x0 [0079.408] lstrlenW (lpString=".dtxs") returned 5 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.408] lstrlenW (lpString=".mdt") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.408] lstrlenW (lpString=".sdf") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.408] lstrlenW (lpString=".MDF") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.408] lstrlenW (lpString=".DBF") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.408] lstrlenW (lpString=".DB") returned 3 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".DB") returned 0x0 [0079.408] lstrlenW (lpString=".db") returned 3 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".db") returned 0x0 [0079.408] lstrlenW (lpString=".ndf") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.408] lstrlenW (lpString=".NDF") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.408] lstrlenW (lpString=".Mdf") returned 4 [0079.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.408] lstrlenW (lpString=".dat") returned 4 [0079.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".dat") returned 0x0 [0079.409] lstrlenW (lpString=".DAT") returned 4 [0079.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.409] lstrlenW (lpString=".ldf") returned 4 [0079.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.409] lstrlenW (lpString=".LDF") returned 4 [0079.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.409] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.409] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.410] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.410] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.410] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19941109060) returned 1 [0079.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe254250, dwHighDateTime=0x1d585b4)) [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5710 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5710 | out: hHeap=0x260000) returned 1 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0ec8 [0079.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275de08 [0079.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0ec8 | out: hHeap=0x260000) returned 1 [0079.411] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.411] GetLastError () returned 0x0 [0079.411] GetLastError () returned 0x0 [0079.411] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.411] GetLastError () returned 0x0 [0079.411] GetLastError () returned 0x0 [0079.412] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.412] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x71, lpOverlapped=0x0) returned 1 [0079.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.413] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.413] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.413] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.413] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.413] CloseHandle (hObject=0xd8) returned 1 [0079.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0079.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0079.414] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.414] GetLastError () returned 0x0 [0079.415] RtlWakeConditionVariable () returned 0x27e828 [0079.415] GetCurrentThreadId () returned 0x9ac [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".ldf") returned 0x0 [0079.415] lstrlenW (lpString=".vhd") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".vhd") returned 0x0 [0079.415] lstrlenW (lpString=".vhdx") returned 5 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".vhdx") returned 0x0 [0079.415] lstrlenW (lpString=".pst") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".pst") returned 0x0 [0079.415] lstrlenW (lpString=".ost") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".ost") returned 0x0 [0079.415] lstrlenW (lpString=".bak") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".bak") returned 0x0 [0079.415] lstrlenW (lpString=".bac") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".bac") returned 0x0 [0079.415] lstrlenW (lpString=".sys") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".sys") returned 0x0 [0079.415] lstrlenW (lpString=".v2i") returned 4 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".v2i") returned 0x0 [0079.415] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0079.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.417] lstrlenW (lpString=".sql") returned 4 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".sql") returned 0x0 [0079.417] lstrlenW (lpString=".mdf") returned 4 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".mdf") returned 0x0 [0079.417] lstrlenW (lpString=".txt") returned 4 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".txt") returned 0x0 [0079.417] lstrlenW (lpString=".dbf") returned 4 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".dbf") returned 0x0 [0079.417] lstrlenW (lpString=".ckp") returned 4 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".ckp") returned 0x0 [0079.417] lstrlenW (lpString=".dacpac") returned 7 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".dacpac") returned 0x0 [0079.417] lstrlenW (lpString=".db3") returned 4 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".db3") returned 0x0 [0079.417] lstrlenW (lpString=".dtxs") returned 5 [0079.417] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".dtxs") returned 0x0 [0079.417] lstrlenW (lpString=".mdt") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".mdt") returned 0x0 [0079.418] lstrlenW (lpString=".sdf") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".sdf") returned 0x0 [0079.418] lstrlenW (lpString=".MDF") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".MDF") returned 0x0 [0079.418] lstrlenW (lpString=".DBF") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".DBF") returned 0x0 [0079.418] lstrlenW (lpString=".DB") returned 3 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".DB") returned 0x0 [0079.418] lstrlenW (lpString=".db") returned 3 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".db") returned 0x0 [0079.418] lstrlenW (lpString=".ndf") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".ndf") returned 0x0 [0079.418] lstrlenW (lpString=".NDF") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".NDF") returned 0x0 [0079.418] lstrlenW (lpString=".Mdf") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".Mdf") returned 0x0 [0079.418] lstrlenW (lpString=".dat") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".dat") returned 0x0 [0079.418] lstrlenW (lpString=".DAT") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".DAT") returned 0x0 [0079.418] lstrlenW (lpString=".ldf") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".ldf") returned 0x0 [0079.418] lstrlenW (lpString=".LDF") returned 4 [0079.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch=".LDF") returned 0x0 [0079.419] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.419] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757160) returned 1 [0079.419] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.419] CryptReleaseContext (hProv=0x2757160, dwFlags=0x0) returned 1 [0079.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.420] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19942083831) returned 1 [0079.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe27a3b0, dwHighDateTime=0x1d585b4)) [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5748 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5748 | out: hHeap=0x260000) returned 1 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.420] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275de08 [0079.420] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.420] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.421] GetLastError () returned 0x0 [0079.421] GetLastError () returned 0x0 [0079.421] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.421] GetLastError () returned 0x0 [0079.421] GetLastError () returned 0x0 [0079.424] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.424] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.426] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.426] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.427] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.427] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.427] CloseHandle (hObject=0xd8) returned 1 [0079.427] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.[deadmin@cock.li].deadmin")) returned 1 [0079.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.429] GetLastError () returned 0x0 [0079.429] RtlWakeConditionVariable () returned 0x27e828 [0079.429] GetCurrentThreadId () returned 0x9ac [0079.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.429] lstrlenW (lpString=".vhd") returned 4 [0079.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".vhd") returned 0x0 [0079.429] lstrlenW (lpString=".vhdx") returned 5 [0079.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".vhdx") returned 0x0 [0079.429] lstrlenW (lpString=".pst") returned 4 [0079.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".pst") returned 0x0 [0079.429] lstrlenW (lpString=".ost") returned 4 [0079.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".ost") returned 0x0 [0079.429] lstrlenW (lpString=".bak") returned 4 [0079.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".bak") returned 0x0 [0079.430] lstrlenW (lpString=".bac") returned 4 [0079.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".bac") returned 0x0 [0079.430] lstrlenW (lpString=".sys") returned 4 [0079.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".sys") returned 0x0 [0079.430] lstrlenW (lpString=".v2i") returned 4 [0079.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".v2i") returned 0x0 [0079.430] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.430] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0079.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.431] lstrlenW (lpString=".sql") returned 4 [0079.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".sql") returned 0x0 [0079.431] lstrlenW (lpString=".mdf") returned 4 [0079.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".mdf") returned 0x0 [0079.431] lstrlenW (lpString=".txt") returned 4 [0079.431] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".txt") returned 0x0 [0079.432] lstrlenW (lpString=".dbf") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".dbf") returned 0x0 [0079.432] lstrlenW (lpString=".ckp") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".ckp") returned 0x0 [0079.432] lstrlenW (lpString=".dacpac") returned 7 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".dacpac") returned 0x0 [0079.432] lstrlenW (lpString=".db3") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".db3") returned 0x0 [0079.432] lstrlenW (lpString=".dtxs") returned 5 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".dtxs") returned 0x0 [0079.432] lstrlenW (lpString=".mdt") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".mdt") returned 0x0 [0079.432] lstrlenW (lpString=".sdf") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".sdf") returned 0x0 [0079.432] lstrlenW (lpString=".MDF") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".MDF") returned 0x0 [0079.432] lstrlenW (lpString=".DBF") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".DBF") returned 0x0 [0079.432] lstrlenW (lpString=".DB") returned 3 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".DB") returned 0x0 [0079.432] lstrlenW (lpString=".db") returned 3 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".db") returned 0x0 [0079.432] lstrlenW (lpString=".ndf") returned 4 [0079.432] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".ndf") returned 0x0 [0079.432] lstrlenW (lpString=".NDF") returned 4 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".NDF") returned 0x0 [0079.433] lstrlenW (lpString=".Mdf") returned 4 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".Mdf") returned 0x0 [0079.433] lstrlenW (lpString=".dat") returned 4 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".dat") returned 0x0 [0079.433] lstrlenW (lpString=".DAT") returned 4 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".DAT") returned 0x0 [0079.433] lstrlenW (lpString=".ldf") returned 4 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.433] lstrlenW (lpString=".LDF") returned 4 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch=".LDF") returned 0x0 [0079.433] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.433] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.433] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.434] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.434] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.434] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.434] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19943525511) returned 1 [0079.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe27a3b0, dwHighDateTime=0x1d585b4)) [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5780 [0079.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5780 | out: hHeap=0x260000) returned 1 [0079.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275db10 [0079.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.435] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.435] GetLastError () returned 0x0 [0079.435] GetLastError () returned 0x0 [0079.435] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.436] GetLastError () returned 0x0 [0079.436] GetLastError () returned 0x0 [0079.437] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.437] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x277, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x277, lpOverlapped=0x0) returned 1 [0079.437] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.437] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.437] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.438] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.438] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.438] CloseHandle (hObject=0xd8) returned 1 [0079.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0079.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.439] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.439] GetLastError () returned 0x0 [0079.439] RtlWakeConditionVariable () returned 0x27e828 [0079.439] GetCurrentThreadId () returned 0x9ac [0079.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.439] lstrlenW (lpString=".vhd") returned 4 [0079.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".vhd") returned 0x0 [0079.439] lstrlenW (lpString=".vhdx") returned 5 [0079.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".vhdx") returned 0x0 [0079.439] lstrlenW (lpString=".pst") returned 4 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".pst") returned 0x0 [0079.440] lstrlenW (lpString=".ost") returned 4 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".ost") returned 0x0 [0079.440] lstrlenW (lpString=".bak") returned 4 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".bak") returned 0x0 [0079.440] lstrlenW (lpString=".bac") returned 4 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".bac") returned 0x0 [0079.440] lstrlenW (lpString=".sys") returned 4 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".sys") returned 0x0 [0079.440] lstrlenW (lpString=".v2i") returned 4 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".v2i") returned 0x0 [0079.440] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch="s\r\n.v2i") returned 0x0 [0079.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.441] lstrlenW (lpString=".sql") returned 4 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".sql") returned 0x0 [0079.441] lstrlenW (lpString=".mdf") returned 4 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".mdf") returned 0x0 [0079.441] lstrlenW (lpString=".txt") returned 4 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".txt") returned 0x0 [0079.441] lstrlenW (lpString=".dbf") returned 4 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".dbf") returned 0x0 [0079.441] lstrlenW (lpString=".ckp") returned 4 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".ckp") returned 0x0 [0079.441] lstrlenW (lpString=".dacpac") returned 7 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".dacpac") returned 0x0 [0079.441] lstrlenW (lpString=".db3") returned 4 [0079.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".db3") returned 0x0 [0079.442] lstrlenW (lpString=".dtxs") returned 5 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".dtxs") returned 0x0 [0079.442] lstrlenW (lpString=".mdt") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".mdt") returned 0x0 [0079.442] lstrlenW (lpString=".sdf") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".sdf") returned 0x0 [0079.442] lstrlenW (lpString=".MDF") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".MDF") returned 0x0 [0079.442] lstrlenW (lpString=".DBF") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".DBF") returned 0x0 [0079.442] lstrlenW (lpString=".DB") returned 3 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".DB") returned 0x0 [0079.442] lstrlenW (lpString=".db") returned 3 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".db") returned 0x0 [0079.442] lstrlenW (lpString=".ndf") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".ndf") returned 0x0 [0079.442] lstrlenW (lpString=".NDF") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".NDF") returned 0x0 [0079.442] lstrlenW (lpString=".Mdf") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".Mdf") returned 0x0 [0079.442] lstrlenW (lpString=".dat") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".dat") returned 0x0 [0079.442] lstrlenW (lpString=".DAT") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".DAT") returned 0x0 [0079.442] lstrlenW (lpString=".ldf") returned 4 [0079.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".ldf") returned 0x0 [0079.443] lstrlenW (lpString=".LDF") returned 4 [0079.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch=".LDF") returned 0x0 [0079.443] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.443] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.444] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.444] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.444] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19944487882) returned 1 [0079.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe2a0510, dwHighDateTime=0x1d585b4)) [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f54a8 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f54a8 | out: hHeap=0x260000) returned 1 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275da78 [0079.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.444] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.445] GetLastError () returned 0x0 [0079.445] GetLastError () returned 0x0 [0079.445] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.445] GetLastError () returned 0x0 [0079.445] GetLastError () returned 0x0 [0079.446] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.446] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xcf, lpOverlapped=0x0) returned 1 [0079.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.447] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.447] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.447] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.447] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.447] CloseHandle (hObject=0xd8) returned 1 [0079.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.447] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.[deadmin@cock.li].deadmin")) returned 1 [0079.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.448] GetLastError () returned 0x0 [0079.449] RtlWakeConditionVariable () returned 0x27e828 [0079.449] GetCurrentThreadId () returned 0x9ac [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.449] lstrlenW (lpString=".vhd") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.449] lstrlenW (lpString=".vhdx") returned 5 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.449] lstrlenW (lpString=".pst") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".pst") returned 0x0 [0079.449] lstrlenW (lpString=".ost") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".ost") returned 0x0 [0079.449] lstrlenW (lpString=".bak") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".bak") returned 0x0 [0079.449] lstrlenW (lpString=".bac") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".bac") returned 0x0 [0079.449] lstrlenW (lpString=".sys") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".sys") returned 0x0 [0079.449] lstrlenW (lpString=".v2i") returned 4 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.449] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.450] lstrlenW (lpString=".sql") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".sql") returned 0x0 [0079.451] lstrlenW (lpString=".mdf") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.451] lstrlenW (lpString=".txt") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".txt") returned 0x0 [0079.451] lstrlenW (lpString=".dbf") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.451] lstrlenW (lpString=".ckp") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.451] lstrlenW (lpString=".dacpac") returned 7 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.451] lstrlenW (lpString=".db3") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".db3") returned 0x0 [0079.451] lstrlenW (lpString=".dtxs") returned 5 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.451] lstrlenW (lpString=".mdt") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.451] lstrlenW (lpString=".sdf") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.451] lstrlenW (lpString=".MDF") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.451] lstrlenW (lpString=".DBF") returned 4 [0079.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.451] lstrlenW (lpString=".DB") returned 3 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".DB") returned 0x0 [0079.452] lstrlenW (lpString=".db") returned 3 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".db") returned 0x0 [0079.452] lstrlenW (lpString=".ndf") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.452] lstrlenW (lpString=".NDF") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.452] lstrlenW (lpString=".Mdf") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.452] lstrlenW (lpString=".dat") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".dat") returned 0x0 [0079.452] lstrlenW (lpString=".DAT") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.452] lstrlenW (lpString=".ldf") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.452] lstrlenW (lpString=".LDF") returned 4 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.452] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.452] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.452] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.453] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.453] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.453] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19945546090) returned 1 [0079.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe2c6670, dwHighDateTime=0x1d585b4)) [0079.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f54e0 [0079.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f54e0 | out: hHeap=0x260000) returned 1 [0079.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d190 [0079.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.455] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.455] GetLastError () returned 0x0 [0079.455] GetLastError () returned 0x0 [0079.455] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.456] GetLastError () returned 0x0 [0079.456] GetLastError () returned 0x0 [0079.457] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.457] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x72, lpOverlapped=0x0) returned 1 [0079.457] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.457] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.457] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.457] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.457] CloseHandle (hObject=0xd8) returned 1 [0079.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.459] GetLastError () returned 0x0 [0079.459] RtlWakeConditionVariable () returned 0x27e828 [0079.459] GetCurrentThreadId () returned 0x9ac [0079.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.459] lstrlenW (lpString=".vhd") returned 4 [0079.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".vhd") returned 0x0 [0079.459] lstrlenW (lpString=".vhdx") returned 5 [0079.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".vhdx") returned 0x0 [0079.459] lstrlenW (lpString=".pst") returned 4 [0079.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".pst") returned 0x0 [0079.459] lstrlenW (lpString=".ost") returned 4 [0079.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".ost") returned 0x0 [0079.460] lstrlenW (lpString=".bak") returned 4 [0079.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".bak") returned 0x0 [0079.460] lstrlenW (lpString=".bac") returned 4 [0079.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".bac") returned 0x0 [0079.460] lstrlenW (lpString=".sys") returned 4 [0079.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".sys") returned 0x0 [0079.460] lstrlenW (lpString=".v2i") returned 4 [0079.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".v2i") returned 0x0 [0079.460] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch="s\r\n.v2i") returned 0x0 [0079.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.461] lstrlenW (lpString=".sql") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".sql") returned 0x0 [0079.461] lstrlenW (lpString=".mdf") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".mdf") returned 0x0 [0079.461] lstrlenW (lpString=".txt") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".txt") returned 0x0 [0079.461] lstrlenW (lpString=".dbf") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".dbf") returned 0x0 [0079.461] lstrlenW (lpString=".ckp") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".ckp") returned 0x0 [0079.461] lstrlenW (lpString=".dacpac") returned 7 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".dacpac") returned 0x0 [0079.461] lstrlenW (lpString=".db3") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".db3") returned 0x0 [0079.461] lstrlenW (lpString=".dtxs") returned 5 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".dtxs") returned 0x0 [0079.461] lstrlenW (lpString=".mdt") returned 4 [0079.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".mdt") returned 0x0 [0079.462] lstrlenW (lpString=".sdf") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".sdf") returned 0x0 [0079.462] lstrlenW (lpString=".MDF") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".MDF") returned 0x0 [0079.462] lstrlenW (lpString=".DBF") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".DBF") returned 0x0 [0079.462] lstrlenW (lpString=".DB") returned 3 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".DB") returned 0x0 [0079.462] lstrlenW (lpString=".db") returned 3 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".db") returned 0x0 [0079.462] lstrlenW (lpString=".ndf") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".ndf") returned 0x0 [0079.462] lstrlenW (lpString=".NDF") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".NDF") returned 0x0 [0079.462] lstrlenW (lpString=".Mdf") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".Mdf") returned 0x0 [0079.462] lstrlenW (lpString=".dat") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".dat") returned 0x0 [0079.462] lstrlenW (lpString=".DAT") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".DAT") returned 0x0 [0079.462] lstrlenW (lpString=".ldf") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".ldf") returned 0x0 [0079.462] lstrlenW (lpString=".LDF") returned 4 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch=".LDF") returned 0x0 [0079.462] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.463] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.463] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.463] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.464] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19946473307) returned 1 [0079.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe2c6670, dwHighDateTime=0x1d585b4)) [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5518 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5518 | out: hHeap=0x260000) returned 1 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d948 [0079.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.464] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.464] GetLastError () returned 0x0 [0079.465] GetLastError () returned 0x0 [0079.465] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.465] GetLastError () returned 0x0 [0079.465] GetLastError () returned 0x0 [0079.466] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffff8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.466] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x71, lpOverlapped=0x0) returned 1 [0079.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.466] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.466] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.467] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.467] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.467] CloseHandle (hObject=0xd8) returned 1 [0079.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.[deadmin@cock.li].deadmin")) returned 1 [0079.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.468] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.468] GetLastError () returned 0x0 [0079.469] RtlWakeConditionVariable () returned 0x27e828 [0079.469] GetCurrentThreadId () returned 0x9ac [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".ldf") returned 0x0 [0079.469] lstrlenW (lpString=".vhd") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".vhd") returned 0x0 [0079.469] lstrlenW (lpString=".vhdx") returned 5 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".vhdx") returned 0x0 [0079.469] lstrlenW (lpString=".pst") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".pst") returned 0x0 [0079.469] lstrlenW (lpString=".ost") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".ost") returned 0x0 [0079.469] lstrlenW (lpString=".bak") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".bak") returned 0x0 [0079.469] lstrlenW (lpString=".bac") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".bac") returned 0x0 [0079.469] lstrlenW (lpString=".sys") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".sys") returned 0x0 [0079.469] lstrlenW (lpString=".v2i") returned 4 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".v2i") returned 0x0 [0079.469] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch="s\r\n.v2i") returned 0x0 [0079.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.471] lstrlenW (lpString=".sql") returned 4 [0079.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".sql") returned 0x0 [0079.471] lstrlenW (lpString=".mdf") returned 4 [0079.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".mdf") returned 0x0 [0079.471] lstrlenW (lpString=".txt") returned 4 [0079.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".txt") returned 0x0 [0079.471] lstrlenW (lpString=".dbf") returned 4 [0079.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".dbf") returned 0x0 [0079.471] lstrlenW (lpString=".ckp") returned 4 [0079.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".ckp") returned 0x0 [0079.471] lstrlenW (lpString=".dacpac") returned 7 [0079.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".dacpac") returned 0x0 [0079.471] lstrlenW (lpString=".db3") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".db3") returned 0x0 [0079.472] lstrlenW (lpString=".dtxs") returned 5 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".dtxs") returned 0x0 [0079.472] lstrlenW (lpString=".mdt") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".mdt") returned 0x0 [0079.472] lstrlenW (lpString=".sdf") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".sdf") returned 0x0 [0079.472] lstrlenW (lpString=".MDF") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".MDF") returned 0x0 [0079.472] lstrlenW (lpString=".DBF") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".DBF") returned 0x0 [0079.472] lstrlenW (lpString=".DB") returned 3 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".DB") returned 0x0 [0079.472] lstrlenW (lpString=".db") returned 3 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".db") returned 0x0 [0079.472] lstrlenW (lpString=".ndf") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".ndf") returned 0x0 [0079.472] lstrlenW (lpString=".NDF") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".NDF") returned 0x0 [0079.472] lstrlenW (lpString=".Mdf") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".Mdf") returned 0x0 [0079.472] lstrlenW (lpString=".dat") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".dat") returned 0x0 [0079.472] lstrlenW (lpString=".DAT") returned 4 [0079.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".DAT") returned 0x0 [0079.472] lstrlenW (lpString=".ldf") returned 4 [0079.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".ldf") returned 0x0 [0079.473] lstrlenW (lpString=".LDF") returned 4 [0079.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch=".LDF") returned 0x0 [0079.473] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0079.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.473] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757270) returned 1 [0079.474] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.474] CryptReleaseContext (hProv=0x2757270, dwFlags=0x0) returned 1 [0079.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0079.474] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19947490310) returned 1 [0079.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe2ec7d0, dwHighDateTime=0x1d585b4)) [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f5550 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f5550 | out: hHeap=0x260000) returned 1 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0f70 [0079.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275de08 [0079.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0f70 | out: hHeap=0x260000) returned 1 [0079.474] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.475] GetLastError () returned 0x0 [0079.475] GetLastError () returned 0x0 [0079.475] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.475] GetLastError () returned 0x0 [0079.475] GetLastError () returned 0x0 [0079.477] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff9f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.477] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x608, lpOverlapped=0x0) returned 1 [0079.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.477] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.477] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.477] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.477] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.477] CloseHandle (hObject=0xd8) returned 1 [0079.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.[deadmin@cock.li].deadmin")) returned 1 [0079.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0079.479] GetLastError () returned 0x0 [0079.479] RtlWakeConditionVariable () returned 0x27e828 [0079.479] GetCurrentThreadId () returned 0x9ac [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".ldf") returned 0x0 [0079.479] lstrlenW (lpString=".vhd") returned 4 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".vhd") returned 0x0 [0079.479] lstrlenW (lpString=".vhdx") returned 5 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".vhdx") returned 0x0 [0079.479] lstrlenW (lpString=".pst") returned 4 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".pst") returned 0x0 [0079.479] lstrlenW (lpString=".ost") returned 4 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".ost") returned 0x0 [0079.479] lstrlenW (lpString=".bak") returned 4 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".bak") returned 0x0 [0079.479] lstrlenW (lpString=".bac") returned 4 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".bac") returned 0x0 [0079.479] lstrlenW (lpString=".sys") returned 4 [0079.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".sys") returned 0x0 [0079.480] lstrlenW (lpString=".v2i") returned 4 [0079.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".v2i") returned 0x0 [0079.480] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0079.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.481] lstrlenW (lpString=".sql") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".sql") returned 0x0 [0079.481] lstrlenW (lpString=".mdf") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".mdf") returned 0x0 [0079.481] lstrlenW (lpString=".txt") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".txt") returned 0x0 [0079.481] lstrlenW (lpString=".dbf") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".dbf") returned 0x0 [0079.481] lstrlenW (lpString=".ckp") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".ckp") returned 0x0 [0079.481] lstrlenW (lpString=".dacpac") returned 7 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".dacpac") returned 0x0 [0079.481] lstrlenW (lpString=".db3") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".db3") returned 0x0 [0079.481] lstrlenW (lpString=".dtxs") returned 5 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".dtxs") returned 0x0 [0079.481] lstrlenW (lpString=".mdt") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".mdt") returned 0x0 [0079.481] lstrlenW (lpString=".sdf") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".sdf") returned 0x0 [0079.481] lstrlenW (lpString=".MDF") returned 4 [0079.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".MDF") returned 0x0 [0079.482] lstrlenW (lpString=".DBF") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".DBF") returned 0x0 [0079.482] lstrlenW (lpString=".DB") returned 3 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".DB") returned 0x0 [0079.482] lstrlenW (lpString=".db") returned 3 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".db") returned 0x0 [0079.482] lstrlenW (lpString=".ndf") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".ndf") returned 0x0 [0079.482] lstrlenW (lpString=".NDF") returned 4 [0079.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".NDF") returned 0x0 [0079.482] lstrlenW (lpString=".Mdf") returned 4 [0079.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".Mdf") returned 0x0 [0079.551] lstrlenW (lpString=".dat") returned 4 [0079.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".dat") returned 0x0 [0079.551] lstrlenW (lpString=".DAT") returned 4 [0079.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".DAT") returned 0x0 [0079.551] lstrlenW (lpString=".ldf") returned 4 [0079.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".ldf") returned 0x0 [0079.551] lstrlenW (lpString=".LDF") returned 4 [0079.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch=".LDF") returned 0x0 [0079.551] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.551] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.552] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.552] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.553] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19955365888) returned 1 [0079.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe3aaeb0, dwHighDateTime=0x1d585b4)) [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cfe8 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cfe8 | out: hHeap=0x260000) returned 1 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d8b0 [0079.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.553] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.554] GetLastError () returned 0x0 [0079.554] GetLastError () returned 0x0 [0079.554] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.554] GetLastError () returned 0x0 [0079.554] GetLastError () returned 0x0 [0079.558] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.558] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.562] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.562] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.562] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.567] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.567] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.567] CloseHandle (hObject=0xd8) returned 1 [0079.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.[deadmin@cock.li].deadmin")) returned 1 [0079.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.570] GetLastError () returned 0x0 [0079.570] RtlWakeConditionVariable () returned 0x0 [0079.570] GetCurrentThreadId () returned 0x9ac [0079.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".ldf") returned 0x0 [0079.570] lstrlenW (lpString=".vhd") returned 4 [0079.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".vhd") returned 0x0 [0079.570] lstrlenW (lpString=".vhdx") returned 5 [0079.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".vhdx") returned 0x0 [0079.570] lstrlenW (lpString=".pst") returned 4 [0079.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".pst") returned 0x0 [0079.570] lstrlenW (lpString=".ost") returned 4 [0079.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".ost") returned 0x0 [0079.570] lstrlenW (lpString=".bak") returned 4 [0079.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".bak") returned 0x0 [0079.571] lstrlenW (lpString=".bac") returned 4 [0079.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".bac") returned 0x0 [0079.571] lstrlenW (lpString=".sys") returned 4 [0079.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".sys") returned 0x0 [0079.571] lstrlenW (lpString=".v2i") returned 4 [0079.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".v2i") returned 0x0 [0079.571] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch="s\r\n.v2i") returned 0x0 [0079.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.573] lstrlenW (lpString=".sql") returned 4 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".sql") returned 0x0 [0079.573] lstrlenW (lpString=".mdf") returned 4 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".mdf") returned 0x0 [0079.573] lstrlenW (lpString=".txt") returned 4 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".txt") returned 0x0 [0079.573] lstrlenW (lpString=".dbf") returned 4 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".dbf") returned 0x0 [0079.573] lstrlenW (lpString=".ckp") returned 4 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".ckp") returned 0x0 [0079.573] lstrlenW (lpString=".dacpac") returned 7 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".dacpac") returned 0x0 [0079.573] lstrlenW (lpString=".db3") returned 4 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".db3") returned 0x0 [0079.573] lstrlenW (lpString=".dtxs") returned 5 [0079.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".dtxs") returned 0x0 [0079.573] lstrlenW (lpString=".mdt") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".mdt") returned 0x0 [0079.574] lstrlenW (lpString=".sdf") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".sdf") returned 0x0 [0079.574] lstrlenW (lpString=".MDF") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".MDF") returned 0x0 [0079.574] lstrlenW (lpString=".DBF") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".DBF") returned 0x0 [0079.574] lstrlenW (lpString=".DB") returned 3 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".DB") returned 0x0 [0079.574] lstrlenW (lpString=".db") returned 3 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".db") returned 0x0 [0079.574] lstrlenW (lpString=".ndf") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".ndf") returned 0x0 [0079.574] lstrlenW (lpString=".NDF") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".NDF") returned 0x0 [0079.574] lstrlenW (lpString=".Mdf") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".Mdf") returned 0x0 [0079.574] lstrlenW (lpString=".dat") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".dat") returned 0x0 [0079.574] lstrlenW (lpString=".DAT") returned 4 [0079.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".DAT") returned 0x0 [0079.575] lstrlenW (lpString=".ldf") returned 4 [0079.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".ldf") returned 0x0 [0079.575] lstrlenW (lpString=".LDF") returned 4 [0079.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch=".LDF") returned 0x0 [0079.575] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.575] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27572f8) returned 1 [0079.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.576] CryptReleaseContext (hProv=0x27572f8, dwFlags=0x0) returned 1 [0079.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.576] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19957733440) returned 1 [0079.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe3f7170, dwHighDateTime=0x1d585b4)) [0079.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cfb0 [0079.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cfb0 | out: hHeap=0x260000) returned 1 [0079.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275de08 [0079.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.577] GetLastError () returned 0x0 [0079.577] GetLastError () returned 0x0 [0079.578] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.578] GetLastError () returned 0x0 [0079.578] GetLastError () returned 0x0 [0079.581] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.581] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0079.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0079.586] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.586] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.588] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.588] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.588] CloseHandle (hObject=0xd8) returned 1 [0079.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.[deadmin@cock.li].deadmin")) returned 1 [0079.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.590] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.590] GetLastError () returned 0x0 [0079.591] RtlWakeConditionVariable () returned 0x27e828 [0079.591] GetCurrentThreadId () returned 0x9ac [0079.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.591] lstrlenW (lpString=".vhd") returned 4 [0079.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".vhd") returned 0x0 [0079.591] lstrlenW (lpString=".vhdx") returned 5 [0079.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".vhdx") returned 0x0 [0079.591] lstrlenW (lpString=".pst") returned 4 [0079.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".pst") returned 0x0 [0079.591] lstrlenW (lpString=".ost") returned 4 [0079.591] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".ost") returned 0x0 [0079.591] lstrlenW (lpString=".bak") returned 4 [0079.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".bak") returned 0x0 [0079.592] lstrlenW (lpString=".bac") returned 4 [0079.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".bac") returned 0x0 [0079.592] lstrlenW (lpString=".sys") returned 4 [0079.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".sys") returned 0x0 [0079.592] lstrlenW (lpString=".v2i") returned 4 [0079.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".v2i") returned 0x0 [0079.592] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.592] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch="s\r\n.v2i") returned 0x0 [0079.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0079.594] lstrlenW (lpString=".sql") returned 4 [0079.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".sql") returned 0x0 [0079.594] lstrlenW (lpString=".mdf") returned 4 [0079.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".mdf") returned 0x0 [0079.594] lstrlenW (lpString=".txt") returned 4 [0079.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".txt") returned 0x0 [0079.594] lstrlenW (lpString=".dbf") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".dbf") returned 0x0 [0079.595] lstrlenW (lpString=".ckp") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".ckp") returned 0x0 [0079.595] lstrlenW (lpString=".dacpac") returned 7 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".dacpac") returned 0x0 [0079.595] lstrlenW (lpString=".db3") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".db3") returned 0x0 [0079.595] lstrlenW (lpString=".dtxs") returned 5 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".dtxs") returned 0x0 [0079.595] lstrlenW (lpString=".mdt") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".mdt") returned 0x0 [0079.595] lstrlenW (lpString=".sdf") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".sdf") returned 0x0 [0079.595] lstrlenW (lpString=".MDF") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".MDF") returned 0x0 [0079.595] lstrlenW (lpString=".DBF") returned 4 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".DBF") returned 0x0 [0079.595] lstrlenW (lpString=".DB") returned 3 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".DB") returned 0x0 [0079.595] lstrlenW (lpString=".db") returned 3 [0079.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".db") returned 0x0 [0079.595] lstrlenW (lpString=".ndf") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".ndf") returned 0x0 [0079.596] lstrlenW (lpString=".NDF") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".NDF") returned 0x0 [0079.596] lstrlenW (lpString=".Mdf") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".Mdf") returned 0x0 [0079.596] lstrlenW (lpString=".dat") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".dat") returned 0x0 [0079.596] lstrlenW (lpString=".DAT") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".DAT") returned 0x0 [0079.596] lstrlenW (lpString=".ldf") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".ldf") returned 0x0 [0079.596] lstrlenW (lpString=".LDF") returned 4 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch=".LDF") returned 0x0 [0079.596] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.596] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2756f40) returned 1 [0079.597] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.597] CryptReleaseContext (hProv=0x2756f40, dwFlags=0x0) returned 1 [0079.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.598] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19959865769) returned 1 [0079.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe41d2d0, dwHighDateTime=0x1d585b4)) [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cf78 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cf78 | out: hHeap=0x260000) returned 1 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1168 [0079.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d818 [0079.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1168 | out: hHeap=0x260000) returned 1 [0079.598] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.599] GetLastError () returned 0x0 [0079.599] GetLastError () returned 0x0 [0079.599] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.599] GetLastError () returned 0x0 [0079.599] GetLastError () returned 0x0 [0079.690] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.690] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x277, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x277, lpOverlapped=0x0) returned 1 [0079.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.706] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.706] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.711] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.711] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.711] CloseHandle (hObject=0xd8) returned 1 [0079.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0079.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.[deadmin@cock.li].deadmin")) returned 1 [0079.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0079.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.714] GetLastError () returned 0x0 [0079.714] RtlWakeConditionVariable () returned 0x0 [0079.714] GetCurrentThreadId () returned 0x9ac [0079.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".ldf") returned 0x0 [0079.714] lstrlenW (lpString=".vhd") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".vhd") returned 0x0 [0079.715] lstrlenW (lpString=".vhdx") returned 5 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".vhdx") returned 0x0 [0079.715] lstrlenW (lpString=".pst") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".pst") returned 0x0 [0079.715] lstrlenW (lpString=".ost") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".ost") returned 0x0 [0079.715] lstrlenW (lpString=".bak") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".bak") returned 0x0 [0079.715] lstrlenW (lpString=".bac") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".bac") returned 0x0 [0079.715] lstrlenW (lpString=".sys") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".sys") returned 0x0 [0079.715] lstrlenW (lpString=".v2i") returned 4 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".v2i") returned 0x0 [0079.715] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch="s\r\n.v2i") returned 0x0 [0079.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.897] lstrlenW (lpString=".sql") returned 4 [0079.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".sql") returned 0x0 [0079.897] lstrlenW (lpString=".mdf") returned 4 [0079.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".mdf") returned 0x0 [0079.897] lstrlenW (lpString=".txt") returned 4 [0079.897] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".txt") returned 0x0 [0079.898] lstrlenW (lpString=".dbf") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".dbf") returned 0x0 [0079.898] lstrlenW (lpString=".ckp") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".ckp") returned 0x0 [0079.898] lstrlenW (lpString=".dacpac") returned 7 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".dacpac") returned 0x0 [0079.898] lstrlenW (lpString=".db3") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".db3") returned 0x0 [0079.898] lstrlenW (lpString=".dtxs") returned 5 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".dtxs") returned 0x0 [0079.898] lstrlenW (lpString=".mdt") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".mdt") returned 0x0 [0079.898] lstrlenW (lpString=".sdf") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".sdf") returned 0x0 [0079.898] lstrlenW (lpString=".MDF") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".MDF") returned 0x0 [0079.898] lstrlenW (lpString=".DBF") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".DBF") returned 0x0 [0079.898] lstrlenW (lpString=".DB") returned 3 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".DB") returned 0x0 [0079.898] lstrlenW (lpString=".db") returned 3 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".db") returned 0x0 [0079.898] lstrlenW (lpString=".ndf") returned 4 [0079.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".ndf") returned 0x0 [0079.898] lstrlenW (lpString=".NDF") returned 4 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".NDF") returned 0x0 [0079.899] lstrlenW (lpString=".Mdf") returned 4 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".Mdf") returned 0x0 [0079.899] lstrlenW (lpString=".dat") returned 4 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".dat") returned 0x0 [0079.899] lstrlenW (lpString=".DAT") returned 4 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".DAT") returned 0x0 [0079.899] lstrlenW (lpString=".ldf") returned 4 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".ldf") returned 0x0 [0079.899] lstrlenW (lpString=".LDF") returned 4 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch=".LDF") returned 0x0 [0079.899] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.899] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.899] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27572f8) returned 1 [0079.900] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.900] CryptReleaseContext (hProv=0x27572f8, dwFlags=0x0) returned 1 [0079.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.900] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19990124582) returned 1 [0079.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe6f0cf0, dwHighDateTime=0x1d585b4)) [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cdb8 [0079.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cdb8 | out: hHeap=0x260000) returned 1 [0079.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275de08 [0079.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.901] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.901] GetLastError () returned 0x0 [0079.901] GetLastError () returned 0x0 [0079.901] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.901] GetLastError () returned 0x0 [0079.902] GetLastError () returned 0x0 [0079.905] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffbe78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.905] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4188, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x4188, lpOverlapped=0x0) returned 1 [0079.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.905] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.905] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.906] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.906] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.906] CloseHandle (hObject=0x11c) returned 1 [0079.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0079.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.[deadmin@cock.li].deadmin")) returned 1 [0079.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0079.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.908] GetLastError () returned 0x0 [0079.909] RtlWakeConditionVariable () returned 0x0 [0079.909] GetCurrentThreadId () returned 0x9ac [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".ldf") returned 0x0 [0079.909] lstrlenW (lpString=".vhd") returned 4 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".vhd") returned 0x0 [0079.909] lstrlenW (lpString=".vhdx") returned 5 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".vhdx") returned 0x0 [0079.909] lstrlenW (lpString=".pst") returned 4 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".pst") returned 0x0 [0079.909] lstrlenW (lpString=".ost") returned 4 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".ost") returned 0x0 [0079.909] lstrlenW (lpString=".bak") returned 4 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".bak") returned 0x0 [0079.909] lstrlenW (lpString=".bac") returned 4 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".bac") returned 0x0 [0079.909] lstrlenW (lpString=".sys") returned 4 [0079.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".sys") returned 0x0 [0079.909] lstrlenW (lpString=".v2i") returned 4 [0079.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".v2i") returned 0x0 [0079.910] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0079.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.911] lstrlenW (lpString=".sql") returned 4 [0079.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".sql") returned 0x0 [0079.911] lstrlenW (lpString=".mdf") returned 4 [0079.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".mdf") returned 0x0 [0079.911] lstrlenW (lpString=".txt") returned 4 [0079.911] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".txt") returned 0x0 [0079.911] lstrlenW (lpString=".dbf") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".dbf") returned 0x0 [0079.912] lstrlenW (lpString=".ckp") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".ckp") returned 0x0 [0079.912] lstrlenW (lpString=".dacpac") returned 7 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".dacpac") returned 0x0 [0079.912] lstrlenW (lpString=".db3") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".db3") returned 0x0 [0079.912] lstrlenW (lpString=".dtxs") returned 5 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".dtxs") returned 0x0 [0079.912] lstrlenW (lpString=".mdt") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".mdt") returned 0x0 [0079.912] lstrlenW (lpString=".sdf") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".sdf") returned 0x0 [0079.912] lstrlenW (lpString=".MDF") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".MDF") returned 0x0 [0079.912] lstrlenW (lpString=".DBF") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".DBF") returned 0x0 [0079.912] lstrlenW (lpString=".DB") returned 3 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".DB") returned 0x0 [0079.912] lstrlenW (lpString=".db") returned 3 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".db") returned 0x0 [0079.912] lstrlenW (lpString=".ndf") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".ndf") returned 0x0 [0079.912] lstrlenW (lpString=".NDF") returned 4 [0079.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".NDF") returned 0x0 [0079.912] lstrlenW (lpString=".Mdf") returned 4 [0079.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".Mdf") returned 0x0 [0079.913] lstrlenW (lpString=".dat") returned 4 [0079.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".dat") returned 0x0 [0079.913] lstrlenW (lpString=".DAT") returned 4 [0079.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".DAT") returned 0x0 [0079.913] lstrlenW (lpString=".ldf") returned 4 [0079.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".ldf") returned 0x0 [0079.913] lstrlenW (lpString=".LDF") returned 4 [0079.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch=".LDF") returned 0x0 [0079.913] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.913] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757380) returned 1 [0079.914] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.914] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0079.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.914] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19991519503) returned 1 [0079.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe716e50, dwHighDateTime=0x1d585b4)) [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cd80 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd80 | out: hHeap=0x260000) returned 1 [0079.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d2c0 [0079.915] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.915] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.915] GetLastError () returned 0x0 [0079.915] GetLastError () returned 0x0 [0079.915] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.915] GetLastError () returned 0x0 [0079.915] GetLastError () returned 0x0 [0079.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffcb28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.917] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x34d8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x34d8, lpOverlapped=0x0) returned 1 [0079.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0079.917] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.917] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0079.918] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0079.918] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0079.918] CloseHandle (hObject=0x11c) returned 1 [0079.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c628 [0079.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.[deadmin@cock.li].deadmin")) returned 1 [0079.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c628 | out: hHeap=0x260000) returned 1 [0079.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0079.920] GetLastError () returned 0x0 [0079.920] RtlWakeConditionVariable () returned 0x27e828 [0079.920] GetCurrentThreadId () returned 0x9ac [0079.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".ldf") returned 0x0 [0079.920] lstrlenW (lpString=".vhd") returned 4 [0079.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".vhd") returned 0x0 [0079.921] lstrlenW (lpString=".vhdx") returned 5 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".vhdx") returned 0x0 [0079.921] lstrlenW (lpString=".pst") returned 4 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".pst") returned 0x0 [0079.921] lstrlenW (lpString=".ost") returned 4 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".ost") returned 0x0 [0079.921] lstrlenW (lpString=".bak") returned 4 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".bak") returned 0x0 [0079.921] lstrlenW (lpString=".bac") returned 4 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".bac") returned 0x0 [0079.921] lstrlenW (lpString=".sys") returned 4 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".sys") returned 0x0 [0079.921] lstrlenW (lpString=".v2i") returned 4 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".v2i") returned 0x0 [0079.921] lstrlenW (lpString="s\r\n.v2i") returned 7 [0079.921] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch="s\r\n.v2i") returned 0x0 [0079.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0079.923] lstrlenW (lpString=".sql") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".sql") returned 0x0 [0079.924] lstrlenW (lpString=".mdf") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".mdf") returned 0x0 [0079.924] lstrlenW (lpString=".txt") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".txt") returned 0x0 [0079.924] lstrlenW (lpString=".dbf") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".dbf") returned 0x0 [0079.924] lstrlenW (lpString=".ckp") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".ckp") returned 0x0 [0079.924] lstrlenW (lpString=".dacpac") returned 7 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".dacpac") returned 0x0 [0079.924] lstrlenW (lpString=".db3") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".db3") returned 0x0 [0079.924] lstrlenW (lpString=".dtxs") returned 5 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".dtxs") returned 0x0 [0079.924] lstrlenW (lpString=".mdt") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".mdt") returned 0x0 [0079.924] lstrlenW (lpString=".sdf") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".sdf") returned 0x0 [0079.924] lstrlenW (lpString=".MDF") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".MDF") returned 0x0 [0079.924] lstrlenW (lpString=".DBF") returned 4 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".DBF") returned 0x0 [0079.924] lstrlenW (lpString=".DB") returned 3 [0079.924] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".DB") returned 0x0 [0079.924] lstrlenW (lpString=".db") returned 3 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".db") returned 0x0 [0079.925] lstrlenW (lpString=".ndf") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".ndf") returned 0x0 [0079.925] lstrlenW (lpString=".NDF") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".NDF") returned 0x0 [0079.925] lstrlenW (lpString=".Mdf") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".Mdf") returned 0x0 [0079.925] lstrlenW (lpString=".dat") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".dat") returned 0x0 [0079.925] lstrlenW (lpString=".DAT") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".DAT") returned 0x0 [0079.925] lstrlenW (lpString=".ldf") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".ldf") returned 0x0 [0079.925] lstrlenW (lpString=".LDF") returned 4 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch=".LDF") returned 0x0 [0079.925] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0079.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0079.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0079.925] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0079.925] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757490) returned 1 [0079.926] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0079.926] CryptReleaseContext (hProv=0x2757490, dwFlags=0x0) returned 1 [0079.926] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0079.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0079.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0079.926] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=19992742321) returned 1 [0079.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe73cfb0, dwHighDateTime=0x1d585b4)) [0079.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0079.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0079.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0079.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cd48 [0079.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0079.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cd48 | out: hHeap=0x260000) returned 1 [0079.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0079.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0079.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0079.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0079.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275d5b8 [0079.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0079.927] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0079.927] GetLastError () returned 0x0 [0079.927] GetLastError () returned 0x0 [0079.927] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0079.928] GetLastError () returned 0x0 [0079.928] GetLastError () returned 0x0 [0080.003] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff3270, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.003] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xcd90, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xcd90, lpOverlapped=0x0) returned 1 [0080.004] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.004] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.004] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.004] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.004] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.004] CloseHandle (hObject=0x11c) returned 1 [0080.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.[deadmin@cock.li].deadmin")) returned 1 [0080.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.006] GetLastError () returned 0x0 [0080.006] RtlWakeConditionVariable () returned 0x0 [0080.006] GetCurrentThreadId () returned 0x9ac [0080.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".ldf") returned 0x0 [0080.006] lstrlenW (lpString=".vhd") returned 4 [0080.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".vhd") returned 0x0 [0080.006] lstrlenW (lpString=".vhdx") returned 5 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".vhdx") returned 0x0 [0080.007] lstrlenW (lpString=".pst") returned 4 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".pst") returned 0x0 [0080.007] lstrlenW (lpString=".ost") returned 4 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".ost") returned 0x0 [0080.007] lstrlenW (lpString=".bak") returned 4 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".bak") returned 0x0 [0080.007] lstrlenW (lpString=".bac") returned 4 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".bac") returned 0x0 [0080.007] lstrlenW (lpString=".sys") returned 4 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".sys") returned 0x0 [0080.007] lstrlenW (lpString=".v2i") returned 4 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".v2i") returned 0x0 [0080.007] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0080.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.025] lstrlenW (lpString=".sql") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".sql") returned 0x0 [0080.025] lstrlenW (lpString=".mdf") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".mdf") returned 0x0 [0080.025] lstrlenW (lpString=".txt") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".txt") returned 0x0 [0080.025] lstrlenW (lpString=".dbf") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".dbf") returned 0x0 [0080.025] lstrlenW (lpString=".ckp") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".ckp") returned 0x0 [0080.025] lstrlenW (lpString=".dacpac") returned 7 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".dacpac") returned 0x0 [0080.025] lstrlenW (lpString=".db3") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".db3") returned 0x0 [0080.025] lstrlenW (lpString=".dtxs") returned 5 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".dtxs") returned 0x0 [0080.025] lstrlenW (lpString=".mdt") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".mdt") returned 0x0 [0080.025] lstrlenW (lpString=".sdf") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".sdf") returned 0x0 [0080.025] lstrlenW (lpString=".MDF") returned 4 [0080.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".MDF") returned 0x0 [0080.026] lstrlenW (lpString=".DBF") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".DBF") returned 0x0 [0080.026] lstrlenW (lpString=".DB") returned 3 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".DB") returned 0x0 [0080.026] lstrlenW (lpString=".db") returned 3 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".db") returned 0x0 [0080.026] lstrlenW (lpString=".ndf") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".ndf") returned 0x0 [0080.026] lstrlenW (lpString=".NDF") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".NDF") returned 0x0 [0080.026] lstrlenW (lpString=".Mdf") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".Mdf") returned 0x0 [0080.026] lstrlenW (lpString=".dat") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".dat") returned 0x0 [0080.026] lstrlenW (lpString=".DAT") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".DAT") returned 0x0 [0080.026] lstrlenW (lpString=".ldf") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".ldf") returned 0x0 [0080.026] lstrlenW (lpString=".LDF") returned 4 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch=".LDF") returned 0x0 [0080.026] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.026] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757518) returned 1 [0080.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.027] CryptReleaseContext (hProv=0x2757518, dwFlags=0x0) returned 1 [0080.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.027] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20002859908) returned 1 [0080.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe8217f0, dwHighDateTime=0x1d585b4)) [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cbc0 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cbc0 | out: hHeap=0x260000) returned 1 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d12b8 [0080.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d12b8 | out: hHeap=0x260000) returned 1 [0080.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.029] GetLastError () returned 0x0 [0080.029] GetLastError () returned 0x0 [0080.029] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.029] GetLastError () returned 0x0 [0080.029] GetLastError () returned 0x0 [0080.033] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.033] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2c00, lpOverlapped=0x0) returned 1 [0080.033] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.033] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.033] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.033] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.033] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.033] CloseHandle (hObject=0xd8) returned 1 [0080.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.[deadmin@cock.li].deadmin")) returned 1 [0080.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.035] GetLastError () returned 0x0 [0080.035] RtlWakeConditionVariable () returned 0x0 [0080.035] GetCurrentThreadId () returned 0x9ac [0080.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".ldf") returned 0x0 [0080.035] lstrlenW (lpString=".vhd") returned 4 [0080.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".vhd") returned 0x0 [0080.035] lstrlenW (lpString=".vhdx") returned 5 [0080.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".vhdx") returned 0x0 [0080.035] lstrlenW (lpString=".pst") returned 4 [0080.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".pst") returned 0x0 [0080.035] lstrlenW (lpString=".ost") returned 4 [0080.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".ost") returned 0x0 [0080.035] lstrlenW (lpString=".bak") returned 4 [0080.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".bak") returned 0x0 [0080.036] lstrlenW (lpString=".bac") returned 4 [0080.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".bac") returned 0x0 [0080.036] lstrlenW (lpString=".sys") returned 4 [0080.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".sys") returned 0x0 [0080.036] lstrlenW (lpString=".v2i") returned 4 [0080.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".v2i") returned 0x0 [0080.036] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.037] lstrlenW (lpString=".sql") returned 4 [0080.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".sql") returned 0x0 [0080.037] lstrlenW (lpString=".mdf") returned 4 [0080.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".mdf") returned 0x0 [0080.037] lstrlenW (lpString=".txt") returned 4 [0080.037] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".txt") returned 0x0 [0080.037] lstrlenW (lpString=".dbf") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".dbf") returned 0x0 [0080.038] lstrlenW (lpString=".ckp") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".ckp") returned 0x0 [0080.038] lstrlenW (lpString=".dacpac") returned 7 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".dacpac") returned 0x0 [0080.038] lstrlenW (lpString=".db3") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".db3") returned 0x0 [0080.038] lstrlenW (lpString=".dtxs") returned 5 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".dtxs") returned 0x0 [0080.038] lstrlenW (lpString=".mdt") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".mdt") returned 0x0 [0080.038] lstrlenW (lpString=".sdf") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".sdf") returned 0x0 [0080.038] lstrlenW (lpString=".MDF") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".MDF") returned 0x0 [0080.038] lstrlenW (lpString=".DBF") returned 4 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".DBF") returned 0x0 [0080.038] lstrlenW (lpString=".DB") returned 3 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".DB") returned 0x0 [0080.038] lstrlenW (lpString=".db") returned 3 [0080.038] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".db") returned 0x0 [0080.039] lstrlenW (lpString=".ndf") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".ndf") returned 0x0 [0080.039] lstrlenW (lpString=".NDF") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".NDF") returned 0x0 [0080.039] lstrlenW (lpString=".Mdf") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".Mdf") returned 0x0 [0080.039] lstrlenW (lpString=".dat") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".dat") returned 0x0 [0080.039] lstrlenW (lpString=".DAT") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".DAT") returned 0x0 [0080.039] lstrlenW (lpString=".ldf") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".ldf") returned 0x0 [0080.039] lstrlenW (lpString=".LDF") returned 4 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch=".LDF") returned 0x0 [0080.039] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.039] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757380) returned 1 [0080.040] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.040] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0080.040] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.040] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20004163014) returned 1 [0080.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe847950, dwHighDateTime=0x1d585b4)) [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cb88 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cb88 | out: hHeap=0x260000) returned 1 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d12b8 [0080.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325a60 [0080.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d12b8 | out: hHeap=0x260000) returned 1 [0080.041] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.041] GetLastError () returned 0x0 [0080.042] GetLastError () returned 0x0 [0080.042] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.042] GetLastError () returned 0x0 [0080.042] GetLastError () returned 0x0 [0080.044] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.044] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.045] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.045] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.045] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.046] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.046] CloseHandle (hObject=0xd8) returned 1 [0080.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.047] GetLastError () returned 0x0 [0080.047] RtlWakeConditionVariable () returned 0x27e828 [0080.047] GetCurrentThreadId () returned 0x9ac [0080.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".ldf") returned 0x0 [0080.047] lstrlenW (lpString=".vhd") returned 4 [0080.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".vhd") returned 0x0 [0080.047] lstrlenW (lpString=".vhdx") returned 5 [0080.047] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".vhdx") returned 0x0 [0080.047] lstrlenW (lpString=".pst") returned 4 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".pst") returned 0x0 [0080.048] lstrlenW (lpString=".ost") returned 4 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".ost") returned 0x0 [0080.048] lstrlenW (lpString=".bak") returned 4 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".bak") returned 0x0 [0080.048] lstrlenW (lpString=".bac") returned 4 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".bac") returned 0x0 [0080.048] lstrlenW (lpString=".sys") returned 4 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".sys") returned 0x0 [0080.048] lstrlenW (lpString=".v2i") returned 4 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".v2i") returned 0x0 [0080.048] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch="s\r\n.v2i") returned 0x0 [0080.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.050] lstrlenW (lpString=".sql") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".sql") returned 0x0 [0080.050] lstrlenW (lpString=".mdf") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".mdf") returned 0x0 [0080.050] lstrlenW (lpString=".txt") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".txt") returned 0x0 [0080.050] lstrlenW (lpString=".dbf") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".dbf") returned 0x0 [0080.050] lstrlenW (lpString=".ckp") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".ckp") returned 0x0 [0080.050] lstrlenW (lpString=".dacpac") returned 7 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".dacpac") returned 0x0 [0080.050] lstrlenW (lpString=".db3") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".db3") returned 0x0 [0080.050] lstrlenW (lpString=".dtxs") returned 5 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".dtxs") returned 0x0 [0080.050] lstrlenW (lpString=".mdt") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".mdt") returned 0x0 [0080.050] lstrlenW (lpString=".sdf") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".sdf") returned 0x0 [0080.050] lstrlenW (lpString=".MDF") returned 4 [0080.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".MDF") returned 0x0 [0080.050] lstrlenW (lpString=".DBF") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".DBF") returned 0x0 [0080.051] lstrlenW (lpString=".DB") returned 3 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".DB") returned 0x0 [0080.051] lstrlenW (lpString=".db") returned 3 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".db") returned 0x0 [0080.051] lstrlenW (lpString=".ndf") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".ndf") returned 0x0 [0080.051] lstrlenW (lpString=".NDF") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".NDF") returned 0x0 [0080.051] lstrlenW (lpString=".Mdf") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".Mdf") returned 0x0 [0080.051] lstrlenW (lpString=".dat") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".dat") returned 0x0 [0080.051] lstrlenW (lpString=".DAT") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".DAT") returned 0x0 [0080.051] lstrlenW (lpString=".ldf") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".ldf") returned 0x0 [0080.051] lstrlenW (lpString=".LDF") returned 4 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch=".LDF") returned 0x0 [0080.051] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.051] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757628) returned 1 [0080.052] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.052] CryptReleaseContext (hProv=0x2757628, dwFlags=0x0) returned 1 [0080.052] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.052] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20005357855) returned 1 [0080.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe86dab0, dwHighDateTime=0x1d585b4)) [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x275cb18 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x275cb18 | out: hHeap=0x260000) returned 1 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1360 [0080.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.053] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1360 | out: hHeap=0x260000) returned 1 [0080.054] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.055] GetLastError () returned 0x0 [0080.055] GetLastError () returned 0x0 [0080.055] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.055] GetLastError () returned 0x0 [0080.056] GetLastError () returned 0x0 [0080.083] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.083] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.085] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.085] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.086] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.086] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.086] CloseHandle (hObject=0xd8) returned 1 [0080.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.[deadmin@cock.li].deadmin")) returned 1 [0080.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.089] GetLastError () returned 0x0 [0080.089] RtlWakeConditionVariable () returned 0x0 [0080.089] GetCurrentThreadId () returned 0x9ac [0080.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".ldf") returned 0x0 [0080.089] lstrlenW (lpString=".vhd") returned 4 [0080.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".vhd") returned 0x0 [0080.089] lstrlenW (lpString=".vhdx") returned 5 [0080.089] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".vhdx") returned 0x0 [0080.090] lstrlenW (lpString=".pst") returned 4 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".pst") returned 0x0 [0080.090] lstrlenW (lpString=".ost") returned 4 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".ost") returned 0x0 [0080.090] lstrlenW (lpString=".bak") returned 4 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".bak") returned 0x0 [0080.090] lstrlenW (lpString=".bac") returned 4 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".bac") returned 0x0 [0080.090] lstrlenW (lpString=".sys") returned 4 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".sys") returned 0x0 [0080.090] lstrlenW (lpString=".v2i") returned 4 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".v2i") returned 0x0 [0080.090] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.090] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch="s\r\n.v2i") returned 0x0 [0080.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.092] lstrlenW (lpString=".sql") returned 4 [0080.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".sql") returned 0x0 [0080.092] lstrlenW (lpString=".mdf") returned 4 [0080.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".mdf") returned 0x0 [0080.092] lstrlenW (lpString=".txt") returned 4 [0080.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".txt") returned 0x0 [0080.092] lstrlenW (lpString=".dbf") returned 4 [0080.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".dbf") returned 0x0 [0080.092] lstrlenW (lpString=".ckp") returned 4 [0080.092] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".ckp") returned 0x0 [0080.092] lstrlenW (lpString=".dacpac") returned 7 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".dacpac") returned 0x0 [0080.093] lstrlenW (lpString=".db3") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".db3") returned 0x0 [0080.093] lstrlenW (lpString=".dtxs") returned 5 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".dtxs") returned 0x0 [0080.093] lstrlenW (lpString=".mdt") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".mdt") returned 0x0 [0080.093] lstrlenW (lpString=".sdf") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".sdf") returned 0x0 [0080.093] lstrlenW (lpString=".MDF") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".MDF") returned 0x0 [0080.093] lstrlenW (lpString=".DBF") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".DBF") returned 0x0 [0080.093] lstrlenW (lpString=".DB") returned 3 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".DB") returned 0x0 [0080.093] lstrlenW (lpString=".db") returned 3 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".db") returned 0x0 [0080.093] lstrlenW (lpString=".ndf") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".ndf") returned 0x0 [0080.093] lstrlenW (lpString=".NDF") returned 4 [0080.093] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".NDF") returned 0x0 [0080.094] lstrlenW (lpString=".Mdf") returned 4 [0080.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".Mdf") returned 0x0 [0080.094] lstrlenW (lpString=".dat") returned 4 [0080.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".dat") returned 0x0 [0080.094] lstrlenW (lpString=".DAT") returned 4 [0080.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".DAT") returned 0x0 [0080.094] lstrlenW (lpString=".ldf") returned 4 [0080.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".ldf") returned 0x0 [0080.094] lstrlenW (lpString=".LDF") returned 4 [0080.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch=".LDF") returned 0x0 [0080.094] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.094] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.094] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27576b0) returned 1 [0080.095] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.095] CryptReleaseContext (hProv=0x27576b0, dwFlags=0x0) returned 1 [0080.095] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.095] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20009630393) returned 1 [0080.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe8dfed0, dwHighDateTime=0x1d585b4)) [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761878 [0080.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761878 | out: hHeap=0x260000) returned 1 [0080.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1360 [0080.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.096] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1360 | out: hHeap=0x260000) returned 1 [0080.096] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.096] GetLastError () returned 0x0 [0080.096] GetLastError () returned 0x0 [0080.096] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.096] GetLastError () returned 0x0 [0080.097] GetLastError () returned 0x0 [0080.113] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff3a84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.113] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xc57c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xc57c, lpOverlapped=0x0) returned 1 [0080.114] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.114] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.114] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.114] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.114] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.114] CloseHandle (hObject=0xd8) returned 1 [0080.115] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.[deadmin@cock.li].deadmin")) returned 1 [0080.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.117] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.117] GetLastError () returned 0x0 [0080.117] RtlWakeConditionVariable () returned 0x27e828 [0080.117] GetCurrentThreadId () returned 0x9ac [0080.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".ldf") returned 0x0 [0080.117] lstrlenW (lpString=".vhd") returned 4 [0080.117] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".vhd") returned 0x0 [0080.117] lstrlenW (lpString=".vhdx") returned 5 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".vhdx") returned 0x0 [0080.118] lstrlenW (lpString=".pst") returned 4 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".pst") returned 0x0 [0080.118] lstrlenW (lpString=".ost") returned 4 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".ost") returned 0x0 [0080.118] lstrlenW (lpString=".bak") returned 4 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".bak") returned 0x0 [0080.118] lstrlenW (lpString=".bac") returned 4 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".bac") returned 0x0 [0080.118] lstrlenW (lpString=".sys") returned 4 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".sys") returned 0x0 [0080.118] lstrlenW (lpString=".v2i") returned 4 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".v2i") returned 0x0 [0080.118] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.118] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.124] lstrlenW (lpString=".sql") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".sql") returned 0x0 [0080.124] lstrlenW (lpString=".mdf") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".mdf") returned 0x0 [0080.124] lstrlenW (lpString=".txt") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".txt") returned 0x0 [0080.124] lstrlenW (lpString=".dbf") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".dbf") returned 0x0 [0080.124] lstrlenW (lpString=".ckp") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".ckp") returned 0x0 [0080.124] lstrlenW (lpString=".dacpac") returned 7 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".dacpac") returned 0x0 [0080.124] lstrlenW (lpString=".db3") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".db3") returned 0x0 [0080.124] lstrlenW (lpString=".dtxs") returned 5 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".dtxs") returned 0x0 [0080.124] lstrlenW (lpString=".mdt") returned 4 [0080.124] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".mdt") returned 0x0 [0080.124] lstrlenW (lpString=".sdf") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".sdf") returned 0x0 [0080.125] lstrlenW (lpString=".MDF") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".MDF") returned 0x0 [0080.125] lstrlenW (lpString=".DBF") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".DBF") returned 0x0 [0080.125] lstrlenW (lpString=".DB") returned 3 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".DB") returned 0x0 [0080.125] lstrlenW (lpString=".db") returned 3 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".db") returned 0x0 [0080.125] lstrlenW (lpString=".ndf") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".ndf") returned 0x0 [0080.125] lstrlenW (lpString=".NDF") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".NDF") returned 0x0 [0080.125] lstrlenW (lpString=".Mdf") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".Mdf") returned 0x0 [0080.125] lstrlenW (lpString=".dat") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".dat") returned 0x0 [0080.125] lstrlenW (lpString=".DAT") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".DAT") returned 0x0 [0080.125] lstrlenW (lpString=".ldf") returned 4 [0080.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".ldf") returned 0x0 [0080.126] lstrlenW (lpString=".LDF") returned 4 [0080.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch=".LDF") returned 0x0 [0080.126] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.126] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.126] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.126] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27577c0) returned 1 [0080.127] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.127] CryptReleaseContext (hProv=0x27577c0, dwFlags=0x0) returned 1 [0080.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.127] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20012796366) returned 1 [0080.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbe92c190, dwHighDateTime=0x1d585b4)) [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27616b8 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27616b8 | out: hHeap=0x260000) returned 1 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1408 [0080.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2f38e0 [0080.128] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1408 | out: hHeap=0x260000) returned 1 [0080.128] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.128] GetLastError () returned 0x0 [0080.128] GetLastError () returned 0x0 [0080.128] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.128] GetLastError () returned 0x0 [0080.128] GetLastError () returned 0x0 [0080.131] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.133] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.133] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.133] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.135] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.135] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.135] CloseHandle (hObject=0xd8) returned 1 [0080.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.220] GetLastError () returned 0x0 [0080.220] RtlWakeConditionVariable () returned 0x0 [0080.220] GetCurrentThreadId () returned 0x9ac [0080.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".ldf") returned 0x0 [0080.220] lstrlenW (lpString=".vhd") returned 4 [0080.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".vhd") returned 0x0 [0080.220] lstrlenW (lpString=".vhdx") returned 5 [0080.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".vhdx") returned 0x0 [0080.220] lstrlenW (lpString=".pst") returned 4 [0080.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".pst") returned 0x0 [0080.220] lstrlenW (lpString=".ost") returned 4 [0080.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".ost") returned 0x0 [0080.221] lstrlenW (lpString=".bak") returned 4 [0080.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".bak") returned 0x0 [0080.221] lstrlenW (lpString=".bac") returned 4 [0080.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".bac") returned 0x0 [0080.221] lstrlenW (lpString=".sys") returned 4 [0080.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".sys") returned 0x0 [0080.221] lstrlenW (lpString=".v2i") returned 4 [0080.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".v2i") returned 0x0 [0080.221] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.223] lstrlenW (lpString=".sql") returned 4 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".sql") returned 0x0 [0080.223] lstrlenW (lpString=".mdf") returned 4 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".mdf") returned 0x0 [0080.223] lstrlenW (lpString=".txt") returned 4 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".txt") returned 0x0 [0080.223] lstrlenW (lpString=".dbf") returned 4 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".dbf") returned 0x0 [0080.223] lstrlenW (lpString=".ckp") returned 4 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".ckp") returned 0x0 [0080.223] lstrlenW (lpString=".dacpac") returned 7 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".dacpac") returned 0x0 [0080.223] lstrlenW (lpString=".db3") returned 4 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".db3") returned 0x0 [0080.223] lstrlenW (lpString=".dtxs") returned 5 [0080.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".dtxs") returned 0x0 [0080.224] lstrlenW (lpString=".mdt") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".mdt") returned 0x0 [0080.224] lstrlenW (lpString=".sdf") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".sdf") returned 0x0 [0080.224] lstrlenW (lpString=".MDF") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".MDF") returned 0x0 [0080.224] lstrlenW (lpString=".DBF") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".DBF") returned 0x0 [0080.224] lstrlenW (lpString=".DB") returned 3 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".DB") returned 0x0 [0080.224] lstrlenW (lpString=".db") returned 3 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".db") returned 0x0 [0080.224] lstrlenW (lpString=".ndf") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".ndf") returned 0x0 [0080.224] lstrlenW (lpString=".NDF") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".NDF") returned 0x0 [0080.224] lstrlenW (lpString=".Mdf") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".Mdf") returned 0x0 [0080.224] lstrlenW (lpString=".dat") returned 4 [0080.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".dat") returned 0x0 [0080.224] lstrlenW (lpString=".DAT") returned 4 [0080.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".DAT") returned 0x0 [0080.225] lstrlenW (lpString=".ldf") returned 4 [0080.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".ldf") returned 0x0 [0080.225] lstrlenW (lpString=".LDF") returned 4 [0080.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch=".LDF") returned 0x0 [0080.225] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.225] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.225] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27578d0) returned 1 [0080.226] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.226] CryptReleaseContext (hProv=0x27578d0, dwFlags=0x0) returned 1 [0080.226] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.226] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20022742339) returned 1 [0080.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbea109d0, dwHighDateTime=0x1d585b4)) [0080.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761610 [0080.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761610 | out: hHeap=0x260000) returned 1 [0080.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0080.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.227] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.227] GetLastError () returned 0x0 [0080.228] GetLastError () returned 0x0 [0080.228] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.228] GetLastError () returned 0x0 [0080.228] GetLastError () returned 0x0 [0080.231] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.231] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0080.233] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.233] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.236] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.236] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.236] CloseHandle (hObject=0xd8) returned 1 [0080.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0080.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0080.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.238] GetLastError () returned 0x0 [0080.238] RtlWakeConditionVariable () returned 0x0 [0080.238] GetCurrentThreadId () returned 0x9ac [0080.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".ldf") returned 0x0 [0080.238] lstrlenW (lpString=".vhd") returned 4 [0080.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".vhd") returned 0x0 [0080.238] lstrlenW (lpString=".vhdx") returned 5 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".vhdx") returned 0x0 [0080.239] lstrlenW (lpString=".pst") returned 4 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".pst") returned 0x0 [0080.239] lstrlenW (lpString=".ost") returned 4 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".ost") returned 0x0 [0080.239] lstrlenW (lpString=".bak") returned 4 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".bak") returned 0x0 [0080.239] lstrlenW (lpString=".bac") returned 4 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".bac") returned 0x0 [0080.239] lstrlenW (lpString=".sys") returned 4 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".sys") returned 0x0 [0080.239] lstrlenW (lpString=".v2i") returned 4 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".v2i") returned 0x0 [0080.239] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch="s\r\n.v2i") returned 0x0 [0080.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.242] lstrlenW (lpString=".sql") returned 4 [0080.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".sql") returned 0x0 [0080.242] lstrlenW (lpString=".mdf") returned 4 [0080.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".mdf") returned 0x0 [0080.242] lstrlenW (lpString=".txt") returned 4 [0080.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".txt") returned 0x0 [0080.243] lstrlenW (lpString=".dbf") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".dbf") returned 0x0 [0080.243] lstrlenW (lpString=".ckp") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".ckp") returned 0x0 [0080.243] lstrlenW (lpString=".dacpac") returned 7 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".dacpac") returned 0x0 [0080.243] lstrlenW (lpString=".db3") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".db3") returned 0x0 [0080.243] lstrlenW (lpString=".dtxs") returned 5 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".dtxs") returned 0x0 [0080.243] lstrlenW (lpString=".mdt") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".mdt") returned 0x0 [0080.243] lstrlenW (lpString=".sdf") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".sdf") returned 0x0 [0080.243] lstrlenW (lpString=".MDF") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".MDF") returned 0x0 [0080.243] lstrlenW (lpString=".DBF") returned 4 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".DBF") returned 0x0 [0080.243] lstrlenW (lpString=".DB") returned 3 [0080.243] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".DB") returned 0x0 [0080.243] lstrlenW (lpString=".db") returned 3 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".db") returned 0x0 [0080.244] lstrlenW (lpString=".ndf") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".ndf") returned 0x0 [0080.244] lstrlenW (lpString=".NDF") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".NDF") returned 0x0 [0080.244] lstrlenW (lpString=".Mdf") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".Mdf") returned 0x0 [0080.244] lstrlenW (lpString=".dat") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".dat") returned 0x0 [0080.244] lstrlenW (lpString=".DAT") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".DAT") returned 0x0 [0080.244] lstrlenW (lpString=".ldf") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".ldf") returned 0x0 [0080.244] lstrlenW (lpString=".LDF") returned 4 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch=".LDF") returned 0x0 [0080.244] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.244] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0080.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.244] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757380) returned 1 [0080.245] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.246] CryptReleaseContext (hProv=0x2757380, dwFlags=0x0) returned 1 [0080.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0080.246] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20024689437) returned 1 [0080.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbea36b30, dwHighDateTime=0x1d585b4)) [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761b88 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761b88 | out: hHeap=0x260000) returned 1 [0080.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f070 [0080.247] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.247] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.247] GetLastError () returned 0x0 [0080.247] GetLastError () returned 0x0 [0080.247] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.247] GetLastError () returned 0x0 [0080.248] GetLastError () returned 0x0 [0080.251] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.251] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.252] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0080.252] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.252] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.254] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.254] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.254] CloseHandle (hObject=0xd8) returned 1 [0080.257] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.[deadmin@cock.li].deadmin")) returned 1 [0080.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0080.259] GetLastError () returned 0x0 [0080.259] RtlWakeConditionVariable () returned 0x0 [0080.259] GetCurrentThreadId () returned 0x9ac [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".ldf") returned 0x0 [0080.260] lstrlenW (lpString=".vhd") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".vhd") returned 0x0 [0080.260] lstrlenW (lpString=".vhdx") returned 5 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".vhdx") returned 0x0 [0080.260] lstrlenW (lpString=".pst") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".pst") returned 0x0 [0080.260] lstrlenW (lpString=".ost") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".ost") returned 0x0 [0080.260] lstrlenW (lpString=".bak") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".bak") returned 0x0 [0080.260] lstrlenW (lpString=".bac") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".bac") returned 0x0 [0080.260] lstrlenW (lpString=".sys") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".sys") returned 0x0 [0080.260] lstrlenW (lpString=".v2i") returned 4 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".v2i") returned 0x0 [0080.260] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.260] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch="s\r\n.v2i") returned 0x0 [0080.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.262] lstrlenW (lpString=".sql") returned 4 [0080.262] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".sql") returned 0x0 [0080.262] lstrlenW (lpString=".mdf") returned 4 [0080.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".mdf") returned 0x0 [0080.315] lstrlenW (lpString=".txt") returned 4 [0080.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".txt") returned 0x0 [0080.315] lstrlenW (lpString=".dbf") returned 4 [0080.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".dbf") returned 0x0 [0080.315] lstrlenW (lpString=".ckp") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".ckp") returned 0x0 [0080.316] lstrlenW (lpString=".dacpac") returned 7 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".dacpac") returned 0x0 [0080.316] lstrlenW (lpString=".db3") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".db3") returned 0x0 [0080.316] lstrlenW (lpString=".dtxs") returned 5 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".dtxs") returned 0x0 [0080.316] lstrlenW (lpString=".mdt") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".mdt") returned 0x0 [0080.316] lstrlenW (lpString=".sdf") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".sdf") returned 0x0 [0080.316] lstrlenW (lpString=".MDF") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".MDF") returned 0x0 [0080.316] lstrlenW (lpString=".DBF") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".DBF") returned 0x0 [0080.316] lstrlenW (lpString=".DB") returned 3 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".DB") returned 0x0 [0080.316] lstrlenW (lpString=".db") returned 3 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".db") returned 0x0 [0080.316] lstrlenW (lpString=".ndf") returned 4 [0080.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".ndf") returned 0x0 [0080.317] lstrlenW (lpString=".NDF") returned 4 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".NDF") returned 0x0 [0080.317] lstrlenW (lpString=".Mdf") returned 4 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".Mdf") returned 0x0 [0080.317] lstrlenW (lpString=".dat") returned 4 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".dat") returned 0x0 [0080.317] lstrlenW (lpString=".DAT") returned 4 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".DAT") returned 0x0 [0080.317] lstrlenW (lpString=".ldf") returned 4 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".ldf") returned 0x0 [0080.317] lstrlenW (lpString=".LDF") returned 4 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch=".LDF") returned 0x0 [0080.317] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.317] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27576b0) returned 1 [0080.318] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.318] CryptReleaseContext (hProv=0x27576b0, dwFlags=0x0) returned 1 [0080.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.318] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20031947906) returned 1 [0080.318] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbeaf5210, dwHighDateTime=0x1d585b4)) [0080.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761bc0 [0080.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761bc0 | out: hHeap=0x260000) returned 1 [0080.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.319] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f108 [0080.319] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.319] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.319] GetLastError () returned 0x0 [0080.319] GetLastError () returned 0x0 [0080.319] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.320] GetLastError () returned 0x0 [0080.320] GetLastError () returned 0x0 [0080.361] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.361] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.366] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.366] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.369] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.369] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.369] CloseHandle (hObject=0xd8) returned 1 [0080.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.[deadmin@cock.li].deadmin")) returned 1 [0080.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.371] GetLastError () returned 0x0 [0080.371] RtlWakeConditionVariable () returned 0x27e828 [0080.371] GetCurrentThreadId () returned 0x9ac [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".ldf") returned 0x0 [0080.372] lstrlenW (lpString=".vhd") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".vhd") returned 0x0 [0080.372] lstrlenW (lpString=".vhdx") returned 5 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".vhdx") returned 0x0 [0080.372] lstrlenW (lpString=".pst") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".pst") returned 0x0 [0080.372] lstrlenW (lpString=".ost") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".ost") returned 0x0 [0080.372] lstrlenW (lpString=".bak") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".bak") returned 0x0 [0080.372] lstrlenW (lpString=".bac") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".bac") returned 0x0 [0080.372] lstrlenW (lpString=".sys") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".sys") returned 0x0 [0080.372] lstrlenW (lpString=".v2i") returned 4 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".v2i") returned 0x0 [0080.372] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch="s\r\n.v2i") returned 0x0 [0080.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.398] lstrlenW (lpString=".sql") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".sql") returned 0x0 [0080.398] lstrlenW (lpString=".mdf") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".mdf") returned 0x0 [0080.398] lstrlenW (lpString=".txt") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".txt") returned 0x0 [0080.398] lstrlenW (lpString=".dbf") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".dbf") returned 0x0 [0080.398] lstrlenW (lpString=".ckp") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".ckp") returned 0x0 [0080.398] lstrlenW (lpString=".dacpac") returned 7 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".dacpac") returned 0x0 [0080.398] lstrlenW (lpString=".db3") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".db3") returned 0x0 [0080.398] lstrlenW (lpString=".dtxs") returned 5 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".dtxs") returned 0x0 [0080.398] lstrlenW (lpString=".mdt") returned 4 [0080.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".mdt") returned 0x0 [0080.399] lstrlenW (lpString=".sdf") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".sdf") returned 0x0 [0080.399] lstrlenW (lpString=".MDF") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".MDF") returned 0x0 [0080.399] lstrlenW (lpString=".DBF") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".DBF") returned 0x0 [0080.399] lstrlenW (lpString=".DB") returned 3 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".DB") returned 0x0 [0080.399] lstrlenW (lpString=".db") returned 3 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".db") returned 0x0 [0080.399] lstrlenW (lpString=".ndf") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".ndf") returned 0x0 [0080.399] lstrlenW (lpString=".NDF") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".NDF") returned 0x0 [0080.399] lstrlenW (lpString=".Mdf") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".Mdf") returned 0x0 [0080.399] lstrlenW (lpString=".dat") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".dat") returned 0x0 [0080.399] lstrlenW (lpString=".DAT") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".DAT") returned 0x0 [0080.399] lstrlenW (lpString=".ldf") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".ldf") returned 0x0 [0080.399] lstrlenW (lpString=".LDF") returned 4 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch=".LDF") returned 0x0 [0080.399] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0080.400] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757b78) returned 1 [0080.400] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0080.400] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0080.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.401] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20040168584) returned 1 [0080.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbebb38f0, dwHighDateTime=0x1d585b4)) [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761990 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761990 | out: hHeap=0x260000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f958 [0080.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.401] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.401] GetLastError () returned 0x0 [0080.402] GetLastError () returned 0x0 [0080.402] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.402] GetLastError () returned 0x0 [0080.402] GetLastError () returned 0x0 [0080.405] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.405] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.406] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.406] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.406] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.406] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.407] CloseHandle (hObject=0xd8) returned 1 [0080.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.408] GetLastError () returned 0x0 [0080.408] RtlWakeConditionVariable () returned 0x0 [0080.408] GetCurrentThreadId () returned 0x9ac [0080.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".ldf") returned 0x0 [0080.408] lstrlenW (lpString=".vhd") returned 4 [0080.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".vhd") returned 0x0 [0080.408] lstrlenW (lpString=".vhdx") returned 5 [0080.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".vhdx") returned 0x0 [0080.408] lstrlenW (lpString=".pst") returned 4 [0080.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".pst") returned 0x0 [0080.408] lstrlenW (lpString=".ost") returned 4 [0080.408] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".ost") returned 0x0 [0080.409] lstrlenW (lpString=".bak") returned 4 [0080.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".bak") returned 0x0 [0080.409] lstrlenW (lpString=".bac") returned 4 [0080.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".bac") returned 0x0 [0080.409] lstrlenW (lpString=".sys") returned 4 [0080.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".sys") returned 0x0 [0080.409] lstrlenW (lpString=".v2i") returned 4 [0080.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".v2i") returned 0x0 [0080.409] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.409] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0080.410] lstrlenW (lpString=".sql") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".sql") returned 0x0 [0080.410] lstrlenW (lpString=".mdf") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".mdf") returned 0x0 [0080.410] lstrlenW (lpString=".txt") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".txt") returned 0x0 [0080.410] lstrlenW (lpString=".dbf") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".dbf") returned 0x0 [0080.410] lstrlenW (lpString=".ckp") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".ckp") returned 0x0 [0080.410] lstrlenW (lpString=".dacpac") returned 7 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".dacpac") returned 0x0 [0080.410] lstrlenW (lpString=".db3") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".db3") returned 0x0 [0080.410] lstrlenW (lpString=".dtxs") returned 5 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".dtxs") returned 0x0 [0080.410] lstrlenW (lpString=".mdt") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".mdt") returned 0x0 [0080.410] lstrlenW (lpString=".sdf") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".sdf") returned 0x0 [0080.410] lstrlenW (lpString=".MDF") returned 4 [0080.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".MDF") returned 0x0 [0080.411] lstrlenW (lpString=".DBF") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".DBF") returned 0x0 [0080.411] lstrlenW (lpString=".DB") returned 3 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".DB") returned 0x0 [0080.411] lstrlenW (lpString=".db") returned 3 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".db") returned 0x0 [0080.411] lstrlenW (lpString=".ndf") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".ndf") returned 0x0 [0080.411] lstrlenW (lpString=".NDF") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".NDF") returned 0x0 [0080.411] lstrlenW (lpString=".Mdf") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".Mdf") returned 0x0 [0080.411] lstrlenW (lpString=".dat") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".dat") returned 0x0 [0080.411] lstrlenW (lpString=".DAT") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".DAT") returned 0x0 [0080.411] lstrlenW (lpString=".ldf") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".ldf") returned 0x0 [0080.411] lstrlenW (lpString=".LDF") returned 4 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch=".LDF") returned 0x0 [0080.411] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0080.411] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757b78) returned 1 [0080.412] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0080.412] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.412] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0080.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.412] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20041357309) returned 1 [0080.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbebd9a50, dwHighDateTime=0x1d585b4)) [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761920 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761920 | out: hHeap=0x260000) returned 1 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275ec48 [0080.413] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.413] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.413] GetLastError () returned 0x0 [0080.413] GetLastError () returned 0x0 [0080.414] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.414] GetLastError () returned 0x0 [0080.414] GetLastError () returned 0x0 [0080.415] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.415] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c00, lpOverlapped=0x0) returned 1 [0080.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.416] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.416] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.416] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.416] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.416] CloseHandle (hObject=0xd8) returned 1 [0080.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.417] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.417] GetLastError () returned 0x0 [0080.417] RtlWakeConditionVariable () returned 0x0 [0080.417] GetCurrentThreadId () returned 0x9ac [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".ldf") returned 0x0 [0080.418] lstrlenW (lpString=".vhd") returned 4 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".vhd") returned 0x0 [0080.418] lstrlenW (lpString=".vhdx") returned 5 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".vhdx") returned 0x0 [0080.418] lstrlenW (lpString=".pst") returned 4 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".pst") returned 0x0 [0080.418] lstrlenW (lpString=".ost") returned 4 [0080.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".ost") returned 0x0 [0080.418] lstrlenW (lpString=".bak") returned 4 [0080.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".bak") returned 0x0 [0080.461] lstrlenW (lpString=".bac") returned 4 [0080.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".bac") returned 0x0 [0080.462] lstrlenW (lpString=".sys") returned 4 [0080.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".sys") returned 0x0 [0080.462] lstrlenW (lpString=".v2i") returned 4 [0080.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".v2i") returned 0x0 [0080.462] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch="s\r\n.v2i") returned 0x0 [0080.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.463] lstrlenW (lpString=".sql") returned 4 [0080.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".sql") returned 0x0 [0080.463] lstrlenW (lpString=".mdf") returned 4 [0080.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".mdf") returned 0x0 [0080.463] lstrlenW (lpString=".txt") returned 4 [0080.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".txt") returned 0x0 [0080.463] lstrlenW (lpString=".dbf") returned 4 [0080.463] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".dbf") returned 0x0 [0080.463] lstrlenW (lpString=".ckp") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".ckp") returned 0x0 [0080.464] lstrlenW (lpString=".dacpac") returned 7 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".dacpac") returned 0x0 [0080.464] lstrlenW (lpString=".db3") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".db3") returned 0x0 [0080.464] lstrlenW (lpString=".dtxs") returned 5 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".dtxs") returned 0x0 [0080.464] lstrlenW (lpString=".mdt") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".mdt") returned 0x0 [0080.464] lstrlenW (lpString=".sdf") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".sdf") returned 0x0 [0080.464] lstrlenW (lpString=".MDF") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".MDF") returned 0x0 [0080.464] lstrlenW (lpString=".DBF") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".DBF") returned 0x0 [0080.464] lstrlenW (lpString=".DB") returned 3 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".DB") returned 0x0 [0080.464] lstrlenW (lpString=".db") returned 3 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".db") returned 0x0 [0080.464] lstrlenW (lpString=".ndf") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".ndf") returned 0x0 [0080.464] lstrlenW (lpString=".NDF") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".NDF") returned 0x0 [0080.464] lstrlenW (lpString=".Mdf") returned 4 [0080.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".Mdf") returned 0x0 [0080.464] lstrlenW (lpString=".dat") returned 4 [0080.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".dat") returned 0x0 [0080.465] lstrlenW (lpString=".DAT") returned 4 [0080.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".DAT") returned 0x0 [0080.465] lstrlenW (lpString=".ldf") returned 4 [0080.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".ldf") returned 0x0 [0080.465] lstrlenW (lpString=".LDF") returned 4 [0080.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch=".LDF") returned 0x0 [0080.465] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.465] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757b78) returned 1 [0080.466] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.466] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.466] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20046728838) returned 1 [0080.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbec71fd0, dwHighDateTime=0x1d585b4)) [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761568 [0080.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761568 | out: hHeap=0x260000) returned 1 [0080.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275e5c0 [0080.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.467] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.467] GetLastError () returned 0x0 [0080.467] GetLastError () returned 0x0 [0080.467] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.467] GetLastError () returned 0x0 [0080.467] GetLastError () returned 0x0 [0080.468] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.469] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb3, lpOverlapped=0x0) returned 1 [0080.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.469] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.469] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.469] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.469] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.469] CloseHandle (hObject=0x108) returned 1 [0080.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0080.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.[deadmin@cock.li].deadmin")) returned 1 [0080.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0080.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.471] GetLastError () returned 0x0 [0080.471] RtlWakeConditionVariable () returned 0x0 [0080.471] GetCurrentThreadId () returned 0x9ac [0080.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".ldf") returned 0x0 [0080.471] lstrlenW (lpString=".vhd") returned 4 [0080.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".vhd") returned 0x0 [0080.471] lstrlenW (lpString=".vhdx") returned 5 [0080.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".vhdx") returned 0x0 [0080.471] lstrlenW (lpString=".pst") returned 4 [0080.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".pst") returned 0x0 [0080.471] lstrlenW (lpString=".ost") returned 4 [0080.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".ost") returned 0x0 [0080.472] lstrlenW (lpString=".bak") returned 4 [0080.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".bak") returned 0x0 [0080.472] lstrlenW (lpString=".bac") returned 4 [0080.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".bac") returned 0x0 [0080.472] lstrlenW (lpString=".sys") returned 4 [0080.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".sys") returned 0x0 [0080.472] lstrlenW (lpString=".v2i") returned 4 [0080.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".v2i") returned 0x0 [0080.472] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch="s\r\n.v2i") returned 0x0 [0080.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.473] lstrlenW (lpString=".sql") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".sql") returned 0x0 [0080.473] lstrlenW (lpString=".mdf") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".mdf") returned 0x0 [0080.473] lstrlenW (lpString=".txt") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".txt") returned 0x0 [0080.473] lstrlenW (lpString=".dbf") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".dbf") returned 0x0 [0080.473] lstrlenW (lpString=".ckp") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".ckp") returned 0x0 [0080.473] lstrlenW (lpString=".dacpac") returned 7 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".dacpac") returned 0x0 [0080.473] lstrlenW (lpString=".db3") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".db3") returned 0x0 [0080.473] lstrlenW (lpString=".dtxs") returned 5 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".dtxs") returned 0x0 [0080.473] lstrlenW (lpString=".mdt") returned 4 [0080.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".mdt") returned 0x0 [0080.473] lstrlenW (lpString=".sdf") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".sdf") returned 0x0 [0080.474] lstrlenW (lpString=".MDF") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".MDF") returned 0x0 [0080.474] lstrlenW (lpString=".DBF") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".DBF") returned 0x0 [0080.474] lstrlenW (lpString=".DB") returned 3 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".DB") returned 0x0 [0080.474] lstrlenW (lpString=".db") returned 3 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".db") returned 0x0 [0080.474] lstrlenW (lpString=".ndf") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".ndf") returned 0x0 [0080.474] lstrlenW (lpString=".NDF") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".NDF") returned 0x0 [0080.474] lstrlenW (lpString=".Mdf") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".Mdf") returned 0x0 [0080.474] lstrlenW (lpString=".dat") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".dat") returned 0x0 [0080.474] lstrlenW (lpString=".DAT") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".DAT") returned 0x0 [0080.474] lstrlenW (lpString=".ldf") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".ldf") returned 0x0 [0080.474] lstrlenW (lpString=".LDF") returned 4 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch=".LDF") returned 0x0 [0080.474] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.474] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.475] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757b78) returned 1 [0080.475] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.475] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.475] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.476] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20047667160) returned 1 [0080.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbec71fd0, dwHighDateTime=0x1d585b4)) [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761530 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761530 | out: hHeap=0x260000) returned 1 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f790 [0080.476] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.476] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.476] GetLastError () returned 0x0 [0080.477] GetLastError () returned 0x0 [0080.477] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.477] GetLastError () returned 0x0 [0080.477] GetLastError () returned 0x0 [0080.478] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffcae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.478] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x352, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x352, lpOverlapped=0x0) returned 1 [0080.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.479] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.479] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.479] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.479] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.479] CloseHandle (hObject=0x108) returned 1 [0080.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0080.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.[deadmin@cock.li].deadmin")) returned 1 [0080.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0080.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.480] GetLastError () returned 0x0 [0080.480] RtlWakeConditionVariable () returned 0x27e828 [0080.480] GetCurrentThreadId () returned 0x9ac [0080.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".ldf") returned 0x0 [0080.480] lstrlenW (lpString=".vhd") returned 4 [0080.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".vhd") returned 0x0 [0080.481] lstrlenW (lpString=".vhdx") returned 5 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".vhdx") returned 0x0 [0080.481] lstrlenW (lpString=".pst") returned 4 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".pst") returned 0x0 [0080.481] lstrlenW (lpString=".ost") returned 4 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".ost") returned 0x0 [0080.481] lstrlenW (lpString=".bak") returned 4 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".bak") returned 0x0 [0080.481] lstrlenW (lpString=".bac") returned 4 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".bac") returned 0x0 [0080.481] lstrlenW (lpString=".sys") returned 4 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".sys") returned 0x0 [0080.481] lstrlenW (lpString=".v2i") returned 4 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".v2i") returned 0x0 [0080.481] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.483] lstrlenW (lpString=".sql") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".sql") returned 0x0 [0080.483] lstrlenW (lpString=".mdf") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".mdf") returned 0x0 [0080.483] lstrlenW (lpString=".txt") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".txt") returned 0x0 [0080.483] lstrlenW (lpString=".dbf") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".dbf") returned 0x0 [0080.483] lstrlenW (lpString=".ckp") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".ckp") returned 0x0 [0080.483] lstrlenW (lpString=".dacpac") returned 7 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".dacpac") returned 0x0 [0080.483] lstrlenW (lpString=".db3") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".db3") returned 0x0 [0080.483] lstrlenW (lpString=".dtxs") returned 5 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".dtxs") returned 0x0 [0080.483] lstrlenW (lpString=".mdt") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".mdt") returned 0x0 [0080.483] lstrlenW (lpString=".sdf") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".sdf") returned 0x0 [0080.483] lstrlenW (lpString=".MDF") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".MDF") returned 0x0 [0080.483] lstrlenW (lpString=".DBF") returned 4 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".DBF") returned 0x0 [0080.483] lstrlenW (lpString=".DB") returned 3 [0080.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".DB") returned 0x0 [0080.484] lstrlenW (lpString=".db") returned 3 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".db") returned 0x0 [0080.484] lstrlenW (lpString=".ndf") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".ndf") returned 0x0 [0080.484] lstrlenW (lpString=".NDF") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".NDF") returned 0x0 [0080.484] lstrlenW (lpString=".Mdf") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".Mdf") returned 0x0 [0080.484] lstrlenW (lpString=".dat") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".dat") returned 0x0 [0080.484] lstrlenW (lpString=".DAT") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".DAT") returned 0x0 [0080.484] lstrlenW (lpString=".ldf") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".ldf") returned 0x0 [0080.484] lstrlenW (lpString=".LDF") returned 4 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch=".LDF") returned 0x0 [0080.484] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.484] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.484] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757b78) returned 1 [0080.485] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.485] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.485] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.485] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20048639917) returned 1 [0080.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbec98130, dwHighDateTime=0x1d585b4)) [0080.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27614f8 [0080.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27614f8 | out: hHeap=0x260000) returned 1 [0080.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f498 [0080.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.486] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.486] GetLastError () returned 0x0 [0080.486] GetLastError () returned 0x0 [0080.486] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.486] GetLastError () returned 0x0 [0080.487] GetLastError () returned 0x0 [0080.489] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffec488, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.489] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13b78, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x13b78, lpOverlapped=0x0) returned 1 [0080.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.490] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.490] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.490] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.490] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.490] CloseHandle (hObject=0x108) returned 1 [0080.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34cf88 [0080.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34cf88 | out: hHeap=0x260000) returned 1 [0080.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.491] GetLastError () returned 0x0 [0080.491] RtlWakeConditionVariable () returned 0x27e828 [0080.491] GetCurrentThreadId () returned 0x9ac [0080.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".ldf") returned 0x0 [0080.491] lstrlenW (lpString=".vhd") returned 4 [0080.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".vhd") returned 0x0 [0080.491] lstrlenW (lpString=".vhdx") returned 5 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".vhdx") returned 0x0 [0080.492] lstrlenW (lpString=".pst") returned 4 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".pst") returned 0x0 [0080.492] lstrlenW (lpString=".ost") returned 4 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".ost") returned 0x0 [0080.492] lstrlenW (lpString=".bak") returned 4 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".bak") returned 0x0 [0080.492] lstrlenW (lpString=".bac") returned 4 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".bac") returned 0x0 [0080.492] lstrlenW (lpString=".sys") returned 4 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".sys") returned 0x0 [0080.492] lstrlenW (lpString=".v2i") returned 4 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".v2i") returned 0x0 [0080.492] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch="s\r\n.v2i") returned 0x0 [0080.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0080.493] lstrlenW (lpString=".sql") returned 4 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".sql") returned 0x0 [0080.493] lstrlenW (lpString=".mdf") returned 4 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".mdf") returned 0x0 [0080.493] lstrlenW (lpString=".txt") returned 4 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".txt") returned 0x0 [0080.493] lstrlenW (lpString=".dbf") returned 4 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".dbf") returned 0x0 [0080.493] lstrlenW (lpString=".ckp") returned 4 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".ckp") returned 0x0 [0080.493] lstrlenW (lpString=".dacpac") returned 7 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".dacpac") returned 0x0 [0080.493] lstrlenW (lpString=".db3") returned 4 [0080.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".db3") returned 0x0 [0080.494] lstrlenW (lpString=".dtxs") returned 5 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".dtxs") returned 0x0 [0080.494] lstrlenW (lpString=".mdt") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".mdt") returned 0x0 [0080.494] lstrlenW (lpString=".sdf") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".sdf") returned 0x0 [0080.494] lstrlenW (lpString=".MDF") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".MDF") returned 0x0 [0080.494] lstrlenW (lpString=".DBF") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".DBF") returned 0x0 [0080.494] lstrlenW (lpString=".DB") returned 3 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".DB") returned 0x0 [0080.494] lstrlenW (lpString=".db") returned 3 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".db") returned 0x0 [0080.494] lstrlenW (lpString=".ndf") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".ndf") returned 0x0 [0080.494] lstrlenW (lpString=".NDF") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".NDF") returned 0x0 [0080.494] lstrlenW (lpString=".Mdf") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".Mdf") returned 0x0 [0080.494] lstrlenW (lpString=".dat") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".dat") returned 0x0 [0080.494] lstrlenW (lpString=".DAT") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".DAT") returned 0x0 [0080.494] lstrlenW (lpString=".ldf") returned 4 [0080.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".ldf") returned 0x0 [0080.495] lstrlenW (lpString=".LDF") returned 4 [0080.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch=".LDF") returned 0x0 [0080.495] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0080.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.495] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757b78) returned 1 [0080.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.496] CryptReleaseContext (hProv=0x2757b78, dwFlags=0x0) returned 1 [0080.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0080.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0080.496] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20049805421) returned 1 [0080.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbed306b0, dwHighDateTime=0x1d585b4)) [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd60 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd60 | out: hHeap=0x260000) returned 1 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e658 [0080.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e658 | out: hHeap=0x260000) returned 1 [0080.547] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275fb20 [0080.547] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.547] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.547] GetLastError () returned 0x0 [0080.547] GetLastError () returned 0x0 [0080.548] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.548] GetLastError () returned 0x0 [0080.548] GetLastError () returned 0x0 [0080.549] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffffd8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.549] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x272, lpOverlapped=0x0) returned 1 [0080.549] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.549] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.549] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.549] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.549] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.549] CloseHandle (hObject=0x108) returned 1 [0080.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.[deadmin@cock.li].deadmin")) returned 1 [0080.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.559] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0080.559] GetLastError () returned 0x0 [0080.560] RtlWakeConditionVariable () returned 0x0 [0080.560] GetCurrentThreadId () returned 0x9ac [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".ldf") returned 0x0 [0080.560] lstrlenW (lpString=".vhd") returned 4 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".vhd") returned 0x0 [0080.560] lstrlenW (lpString=".vhdx") returned 5 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".vhdx") returned 0x0 [0080.560] lstrlenW (lpString=".pst") returned 4 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".pst") returned 0x0 [0080.560] lstrlenW (lpString=".ost") returned 4 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".ost") returned 0x0 [0080.560] lstrlenW (lpString=".bak") returned 4 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".bak") returned 0x0 [0080.560] lstrlenW (lpString=".bac") returned 4 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".bac") returned 0x0 [0080.560] lstrlenW (lpString=".sys") returned 4 [0080.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".sys") returned 0x0 [0080.560] lstrlenW (lpString=".v2i") returned 4 [0080.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".v2i") returned 0x0 [0080.561] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.570] lstrlenW (lpString=".sql") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".sql") returned 0x0 [0080.570] lstrlenW (lpString=".mdf") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".mdf") returned 0x0 [0080.570] lstrlenW (lpString=".txt") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".txt") returned 0x0 [0080.570] lstrlenW (lpString=".dbf") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".dbf") returned 0x0 [0080.570] lstrlenW (lpString=".ckp") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".ckp") returned 0x0 [0080.570] lstrlenW (lpString=".dacpac") returned 7 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".dacpac") returned 0x0 [0080.570] lstrlenW (lpString=".db3") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".db3") returned 0x0 [0080.570] lstrlenW (lpString=".dtxs") returned 5 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".dtxs") returned 0x0 [0080.570] lstrlenW (lpString=".mdt") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".mdt") returned 0x0 [0080.570] lstrlenW (lpString=".sdf") returned 4 [0080.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".sdf") returned 0x0 [0080.571] lstrlenW (lpString=".MDF") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".MDF") returned 0x0 [0080.571] lstrlenW (lpString=".DBF") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".DBF") returned 0x0 [0080.571] lstrlenW (lpString=".DB") returned 3 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".DB") returned 0x0 [0080.571] lstrlenW (lpString=".db") returned 3 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".db") returned 0x0 [0080.571] lstrlenW (lpString=".ndf") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".ndf") returned 0x0 [0080.571] lstrlenW (lpString=".NDF") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".NDF") returned 0x0 [0080.571] lstrlenW (lpString=".Mdf") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".Mdf") returned 0x0 [0080.571] lstrlenW (lpString=".dat") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".dat") returned 0x0 [0080.571] lstrlenW (lpString=".DAT") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".DAT") returned 0x0 [0080.571] lstrlenW (lpString=".ldf") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".ldf") returned 0x0 [0080.571] lstrlenW (lpString=".LDF") returned 4 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch=".LDF") returned 0x0 [0080.571] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.572] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757c88) returned 1 [0080.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.572] CryptReleaseContext (hProv=0x2757c88, dwFlags=0x0) returned 1 [0080.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.572] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20057363557) returned 1 [0080.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbed56810, dwHighDateTime=0x1d585b4)) [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2efd28 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2efd28 | out: hHeap=0x260000) returned 1 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x291e5e0 [0080.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291e5e0 | out: hHeap=0x260000) returned 1 [0080.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0080.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.573] GetLastError () returned 0x0 [0080.574] GetLastError () returned 0x0 [0080.574] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.574] GetLastError () returned 0x0 [0080.574] GetLastError () returned 0x0 [0080.580] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.580] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.582] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.582] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.582] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.593] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.593] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.593] CloseHandle (hObject=0xe8) returned 1 [0080.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0080.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0080.595] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.595] GetLastError () returned 0x0 [0080.595] RtlWakeConditionVariable () returned 0x27e828 [0080.595] GetCurrentThreadId () returned 0x9ac [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".ldf") returned 0x0 [0080.595] lstrlenW (lpString=".vhd") returned 4 [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".vhd") returned 0x0 [0080.595] lstrlenW (lpString=".vhdx") returned 5 [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".vhdx") returned 0x0 [0080.595] lstrlenW (lpString=".pst") returned 4 [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".pst") returned 0x0 [0080.595] lstrlenW (lpString=".ost") returned 4 [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".ost") returned 0x0 [0080.595] lstrlenW (lpString=".bak") returned 4 [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".bak") returned 0x0 [0080.595] lstrlenW (lpString=".bac") returned 4 [0080.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".bac") returned 0x0 [0080.596] lstrlenW (lpString=".sys") returned 4 [0080.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".sys") returned 0x0 [0080.596] lstrlenW (lpString=".v2i") returned 4 [0080.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".v2i") returned 0x0 [0080.596] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.597] lstrlenW (lpString=".sql") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".sql") returned 0x0 [0080.597] lstrlenW (lpString=".mdf") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".mdf") returned 0x0 [0080.597] lstrlenW (lpString=".txt") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".txt") returned 0x0 [0080.597] lstrlenW (lpString=".dbf") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".dbf") returned 0x0 [0080.597] lstrlenW (lpString=".ckp") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".ckp") returned 0x0 [0080.597] lstrlenW (lpString=".dacpac") returned 7 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".dacpac") returned 0x0 [0080.597] lstrlenW (lpString=".db3") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".db3") returned 0x0 [0080.597] lstrlenW (lpString=".dtxs") returned 5 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".dtxs") returned 0x0 [0080.597] lstrlenW (lpString=".mdt") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".mdt") returned 0x0 [0080.597] lstrlenW (lpString=".sdf") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".sdf") returned 0x0 [0080.597] lstrlenW (lpString=".MDF") returned 4 [0080.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".MDF") returned 0x0 [0080.597] lstrlenW (lpString=".DBF") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".DBF") returned 0x0 [0080.598] lstrlenW (lpString=".DB") returned 3 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".DB") returned 0x0 [0080.598] lstrlenW (lpString=".db") returned 3 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".db") returned 0x0 [0080.598] lstrlenW (lpString=".ndf") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".ndf") returned 0x0 [0080.598] lstrlenW (lpString=".NDF") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".NDF") returned 0x0 [0080.598] lstrlenW (lpString=".Mdf") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".Mdf") returned 0x0 [0080.598] lstrlenW (lpString=".dat") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".dat") returned 0x0 [0080.598] lstrlenW (lpString=".DAT") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".DAT") returned 0x0 [0080.598] lstrlenW (lpString=".ldf") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".ldf") returned 0x0 [0080.598] lstrlenW (lpString=".LDF") returned 4 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch=".LDF") returned 0x0 [0080.598] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.598] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27576b0) returned 1 [0080.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.599] CryptReleaseContext (hProv=0x27576b0, dwFlags=0x0) returned 1 [0080.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.599] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20060053938) returned 1 [0080.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbeda2ad0, dwHighDateTime=0x1d585b4)) [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00e0 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00e0 | out: hHeap=0x260000) returned 1 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.600] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f530 [0080.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.600] GetLastError () returned 0x0 [0080.600] GetLastError () returned 0x0 [0080.601] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.601] GetLastError () returned 0x0 [0080.601] GetLastError () returned 0x0 [0080.606] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.606] WriteFile (in: hFile=0xe8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0080.607] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.607] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.607] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.607] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.607] CloseHandle (hObject=0xe8) returned 1 [0080.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.609] GetLastError () returned 0x0 [0080.609] RtlWakeConditionVariable () returned 0x0 [0080.609] GetCurrentThreadId () returned 0x9ac [0080.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".ldf") returned 0x0 [0080.609] lstrlenW (lpString=".vhd") returned 4 [0080.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".vhd") returned 0x0 [0080.609] lstrlenW (lpString=".vhdx") returned 5 [0080.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".vhdx") returned 0x0 [0080.609] lstrlenW (lpString=".pst") returned 4 [0080.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".pst") returned 0x0 [0080.609] lstrlenW (lpString=".ost") returned 4 [0080.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".ost") returned 0x0 [0080.610] lstrlenW (lpString=".bak") returned 4 [0080.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".bak") returned 0x0 [0080.610] lstrlenW (lpString=".bac") returned 4 [0080.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".bac") returned 0x0 [0080.610] lstrlenW (lpString=".sys") returned 4 [0080.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".sys") returned 0x0 [0080.610] lstrlenW (lpString=".v2i") returned 4 [0080.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".v2i") returned 0x0 [0080.610] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0080.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0080.611] lstrlenW (lpString=".sql") returned 4 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".sql") returned 0x0 [0080.611] lstrlenW (lpString=".mdf") returned 4 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".mdf") returned 0x0 [0080.611] lstrlenW (lpString=".txt") returned 4 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".txt") returned 0x0 [0080.611] lstrlenW (lpString=".dbf") returned 4 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".dbf") returned 0x0 [0080.611] lstrlenW (lpString=".ckp") returned 4 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".ckp") returned 0x0 [0080.611] lstrlenW (lpString=".dacpac") returned 7 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".dacpac") returned 0x0 [0080.611] lstrlenW (lpString=".db3") returned 4 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".db3") returned 0x0 [0080.611] lstrlenW (lpString=".dtxs") returned 5 [0080.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".dtxs") returned 0x0 [0080.612] lstrlenW (lpString=".mdt") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".mdt") returned 0x0 [0080.612] lstrlenW (lpString=".sdf") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".sdf") returned 0x0 [0080.612] lstrlenW (lpString=".MDF") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".MDF") returned 0x0 [0080.612] lstrlenW (lpString=".DBF") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".DBF") returned 0x0 [0080.612] lstrlenW (lpString=".DB") returned 3 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".DB") returned 0x0 [0080.612] lstrlenW (lpString=".db") returned 3 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".db") returned 0x0 [0080.612] lstrlenW (lpString=".ndf") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".ndf") returned 0x0 [0080.612] lstrlenW (lpString=".NDF") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".NDF") returned 0x0 [0080.612] lstrlenW (lpString=".Mdf") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".Mdf") returned 0x0 [0080.612] lstrlenW (lpString=".dat") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".dat") returned 0x0 [0080.612] lstrlenW (lpString=".DAT") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".DAT") returned 0x0 [0080.612] lstrlenW (lpString=".ldf") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".ldf") returned 0x0 [0080.612] lstrlenW (lpString=".LDF") returned 4 [0080.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch=".LDF") returned 0x0 [0080.613] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0080.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0080.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0080.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0080.613] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27576b0) returned 1 [0080.613] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0080.613] CryptReleaseContext (hProv=0x27576b0, dwFlags=0x0) returned 1 [0080.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0080.614] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20061480602) returned 1 [0080.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbedc8c30, dwHighDateTime=0x1d585b4)) [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f00a8 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0080.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f00a8 | out: hHeap=0x260000) returned 1 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0080.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d0b80 [0080.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0080.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f400 [0080.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d0b80 | out: hHeap=0x260000) returned 1 [0080.614] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0080.615] GetLastError () returned 0x0 [0080.615] GetLastError () returned 0x0 [0080.615] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0080.615] GetLastError () returned 0x0 [0080.615] GetLastError () returned 0x0 [0080.713] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.713] WriteFile (in: hFile=0xe8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0080.714] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0080.714] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.722] WriteFile (in: hFile=0xe8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0080.804] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0080.804] WriteFile (in: hFile=0xe8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0080.804] CloseHandle (hObject=0xe8) returned 1 [0080.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0080.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.[deadmin@cock.li].deadmin")) returned 1 [0080.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0080.925] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0080.925] GetLastError () returned 0x0 [0080.925] RtlWakeConditionVariable () returned 0x0 [0080.926] GetCurrentThreadId () returned 0x9ac [0080.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".ldf") returned 0x0 [0080.926] lstrlenW (lpString=".vhd") returned 4 [0080.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".vhd") returned 0x0 [0080.926] lstrlenW (lpString=".vhdx") returned 5 [0080.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".vhdx") returned 0x0 [0080.926] lstrlenW (lpString=".pst") returned 4 [0080.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".pst") returned 0x0 [0080.926] lstrlenW (lpString=".ost") returned 4 [0080.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".ost") returned 0x0 [0080.926] lstrlenW (lpString=".bak") returned 4 [0080.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".bak") returned 0x0 [0080.926] lstrlenW (lpString=".bac") returned 4 [0080.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".bac") returned 0x0 [0080.927] lstrlenW (lpString=".sys") returned 4 [0080.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".sys") returned 0x0 [0080.927] lstrlenW (lpString=".v2i") returned 4 [0080.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".v2i") returned 0x0 [0080.927] lstrlenW (lpString="s\r\n.v2i") returned 7 [0080.927] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0080.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0081.575] lstrlenW (lpString=".sql") returned 4 [0081.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".sql") returned 0x0 [0081.575] lstrlenW (lpString=".mdf") returned 4 [0081.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".mdf") returned 0x0 [0081.575] lstrlenW (lpString=".txt") returned 4 [0081.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".txt") returned 0x0 [0081.576] lstrlenW (lpString=".dbf") returned 4 [0081.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".dbf") returned 0x0 [0081.576] lstrlenW (lpString=".ckp") returned 4 [0081.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".ckp") returned 0x0 [0081.576] lstrlenW (lpString=".dacpac") returned 7 [0081.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".dacpac") returned 0x0 [0081.579] lstrlenW (lpString=".db3") returned 4 [0081.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".db3") returned 0x0 [0081.579] lstrlenW (lpString=".dtxs") returned 5 [0081.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".dtxs") returned 0x0 [0081.589] lstrlenW (lpString=".mdt") returned 4 [0081.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".mdt") returned 0x0 [0081.589] lstrlenW (lpString=".sdf") returned 4 [0081.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".sdf") returned 0x0 [0081.589] lstrlenW (lpString=".MDF") returned 4 [0081.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".MDF") returned 0x0 [0081.589] lstrlenW (lpString=".DBF") returned 4 [0081.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".DBF") returned 0x0 [0081.589] lstrlenW (lpString=".DB") returned 3 [0081.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".DB") returned 0x0 [0081.596] lstrlenW (lpString=".db") returned 3 [0081.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".db") returned 0x0 [0081.596] lstrlenW (lpString=".ndf") returned 4 [0081.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".ndf") returned 0x0 [0081.597] lstrlenW (lpString=".NDF") returned 4 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".NDF") returned 0x0 [0081.597] lstrlenW (lpString=".Mdf") returned 4 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".Mdf") returned 0x0 [0081.597] lstrlenW (lpString=".dat") returned 4 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".dat") returned 0x0 [0081.597] lstrlenW (lpString=".DAT") returned 4 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".DAT") returned 0x0 [0081.597] lstrlenW (lpString=".ldf") returned 4 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".ldf") returned 0x0 [0081.597] lstrlenW (lpString=".LDF") returned 4 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch=".LDF") returned 0x0 [0081.597] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0081.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.597] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.598] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0081.598] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20159923732) returned 1 [0081.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf7282d0, dwHighDateTime=0x1d585b4)) [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761f40 [0081.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761f40 | out: hHeap=0x260000) returned 1 [0081.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1c90 [0081.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1c90 | out: hHeap=0x260000) returned 1 [0081.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.599] GetLastError () returned 0x0 [0081.599] GetLastError () returned 0x0 [0081.599] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.599] GetLastError () returned 0x0 [0081.599] GetLastError () returned 0x0 [0081.601] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff75ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.601] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8a54, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x8a54, lpOverlapped=0x0) returned 1 [0081.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.602] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.602] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.602] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.602] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.602] CloseHandle (hObject=0x11c) returned 1 [0081.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0081.603] GetLastError () returned 0x0 [0081.603] RtlWakeConditionVariable () returned 0x0 [0081.603] GetCurrentThreadId () returned 0x9ac [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".ldf") returned 0x0 [0081.604] lstrlenW (lpString=".vhd") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".vhd") returned 0x0 [0081.604] lstrlenW (lpString=".vhdx") returned 5 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".vhdx") returned 0x0 [0081.604] lstrlenW (lpString=".pst") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".pst") returned 0x0 [0081.604] lstrlenW (lpString=".ost") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".ost") returned 0x0 [0081.604] lstrlenW (lpString=".bak") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".bak") returned 0x0 [0081.604] lstrlenW (lpString=".bac") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".bac") returned 0x0 [0081.604] lstrlenW (lpString=".sys") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".sys") returned 0x0 [0081.604] lstrlenW (lpString=".v2i") returned 4 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".v2i") returned 0x0 [0081.604] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.613] lstrlenW (lpString=".sql") returned 4 [0081.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".sql") returned 0x0 [0081.613] lstrlenW (lpString=".mdf") returned 4 [0081.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".mdf") returned 0x0 [0081.613] lstrlenW (lpString=".txt") returned 4 [0081.613] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".txt") returned 0x0 [0081.614] lstrlenW (lpString=".dbf") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".dbf") returned 0x0 [0081.614] lstrlenW (lpString=".ckp") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".ckp") returned 0x0 [0081.614] lstrlenW (lpString=".dacpac") returned 7 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".dacpac") returned 0x0 [0081.614] lstrlenW (lpString=".db3") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".db3") returned 0x0 [0081.614] lstrlenW (lpString=".dtxs") returned 5 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".dtxs") returned 0x0 [0081.614] lstrlenW (lpString=".mdt") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".mdt") returned 0x0 [0081.614] lstrlenW (lpString=".sdf") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".sdf") returned 0x0 [0081.614] lstrlenW (lpString=".MDF") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".MDF") returned 0x0 [0081.614] lstrlenW (lpString=".DBF") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".DBF") returned 0x0 [0081.614] lstrlenW (lpString=".DB") returned 3 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".DB") returned 0x0 [0081.614] lstrlenW (lpString=".db") returned 3 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".db") returned 0x0 [0081.614] lstrlenW (lpString=".ndf") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".ndf") returned 0x0 [0081.614] lstrlenW (lpString=".NDF") returned 4 [0081.614] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".NDF") returned 0x0 [0081.615] lstrlenW (lpString=".Mdf") returned 4 [0081.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".Mdf") returned 0x0 [0081.615] lstrlenW (lpString=".dat") returned 4 [0081.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".dat") returned 0x0 [0081.615] lstrlenW (lpString=".DAT") returned 4 [0081.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".DAT") returned 0x0 [0081.615] lstrlenW (lpString=".ldf") returned 4 [0081.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".ldf") returned 0x0 [0081.615] lstrlenW (lpString=".LDF") returned 4 [0081.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch=".LDF") returned 0x0 [0081.615] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.615] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.615] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.616] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.616] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.616] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20161719394) returned 1 [0081.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf74e430, dwHighDateTime=0x1d585b4)) [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e98 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e98 | out: hHeap=0x260000) returned 1 [0081.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d19f0 [0081.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.617] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d19f0 | out: hHeap=0x260000) returned 1 [0081.617] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.617] GetLastError () returned 0x0 [0081.617] GetLastError () returned 0x0 [0081.617] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.617] GetLastError () returned 0x0 [0081.617] GetLastError () returned 0x0 [0081.620] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.621] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.622] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.622] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.622] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.622] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.622] CloseHandle (hObject=0x108) returned 1 [0081.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2860628 [0081.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2860628 | out: hHeap=0x260000) returned 1 [0081.623] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.623] GetLastError () returned 0x0 [0081.624] RtlWakeConditionVariable () returned 0x0 [0081.624] GetCurrentThreadId () returned 0x9ac [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".ldf") returned 0x0 [0081.624] lstrlenW (lpString=".vhd") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".vhd") returned 0x0 [0081.624] lstrlenW (lpString=".vhdx") returned 5 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".vhdx") returned 0x0 [0081.624] lstrlenW (lpString=".pst") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".pst") returned 0x0 [0081.624] lstrlenW (lpString=".ost") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".ost") returned 0x0 [0081.624] lstrlenW (lpString=".bak") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".bak") returned 0x0 [0081.624] lstrlenW (lpString=".bac") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".bac") returned 0x0 [0081.624] lstrlenW (lpString=".sys") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".sys") returned 0x0 [0081.624] lstrlenW (lpString=".v2i") returned 4 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".v2i") returned 0x0 [0081.624] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.624] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.626] lstrlenW (lpString=".sql") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".sql") returned 0x0 [0081.626] lstrlenW (lpString=".mdf") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".mdf") returned 0x0 [0081.626] lstrlenW (lpString=".txt") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".txt") returned 0x0 [0081.626] lstrlenW (lpString=".dbf") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".dbf") returned 0x0 [0081.626] lstrlenW (lpString=".ckp") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".ckp") returned 0x0 [0081.626] lstrlenW (lpString=".dacpac") returned 7 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".dacpac") returned 0x0 [0081.626] lstrlenW (lpString=".db3") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".db3") returned 0x0 [0081.626] lstrlenW (lpString=".dtxs") returned 5 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".dtxs") returned 0x0 [0081.626] lstrlenW (lpString=".mdt") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".mdt") returned 0x0 [0081.626] lstrlenW (lpString=".sdf") returned 4 [0081.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".sdf") returned 0x0 [0081.627] lstrlenW (lpString=".MDF") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".MDF") returned 0x0 [0081.627] lstrlenW (lpString=".DBF") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".DBF") returned 0x0 [0081.627] lstrlenW (lpString=".DB") returned 3 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".DB") returned 0x0 [0081.627] lstrlenW (lpString=".db") returned 3 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".db") returned 0x0 [0081.627] lstrlenW (lpString=".ndf") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".ndf") returned 0x0 [0081.627] lstrlenW (lpString=".NDF") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".NDF") returned 0x0 [0081.627] lstrlenW (lpString=".Mdf") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".Mdf") returned 0x0 [0081.627] lstrlenW (lpString=".dat") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".dat") returned 0x0 [0081.627] lstrlenW (lpString=".DAT") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".DAT") returned 0x0 [0081.627] lstrlenW (lpString=".ldf") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".ldf") returned 0x0 [0081.627] lstrlenW (lpString=".LDF") returned 4 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch=".LDF") returned 0x0 [0081.627] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.628] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.628] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.628] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.629] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20162965013) returned 1 [0081.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf774590, dwHighDateTime=0x1d585b4)) [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e60 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e60 | out: hHeap=0x260000) returned 1 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1e88 [0081.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1e88 | out: hHeap=0x260000) returned 1 [0081.629] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.629] GetLastError () returned 0x0 [0081.630] GetLastError () returned 0x0 [0081.630] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.630] GetLastError () returned 0x0 [0081.630] GetLastError () returned 0x0 [0081.633] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.633] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.634] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.634] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.635] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.635] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.636] CloseHandle (hObject=0x108) returned 1 [0081.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.637] GetLastError () returned 0x0 [0081.637] RtlWakeConditionVariable () returned 0x0 [0081.637] GetCurrentThreadId () returned 0x9ac [0081.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".ldf") returned 0x0 [0081.637] lstrlenW (lpString=".vhd") returned 4 [0081.637] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".vhd") returned 0x0 [0081.637] lstrlenW (lpString=".vhdx") returned 5 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".vhdx") returned 0x0 [0081.638] lstrlenW (lpString=".pst") returned 4 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".pst") returned 0x0 [0081.638] lstrlenW (lpString=".ost") returned 4 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".ost") returned 0x0 [0081.638] lstrlenW (lpString=".bak") returned 4 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".bak") returned 0x0 [0081.638] lstrlenW (lpString=".bac") returned 4 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".bac") returned 0x0 [0081.638] lstrlenW (lpString=".sys") returned 4 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".sys") returned 0x0 [0081.638] lstrlenW (lpString=".v2i") returned 4 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".v2i") returned 0x0 [0081.638] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.638] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch="s\r\n.v2i") returned 0x0 [0081.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.639] lstrlenW (lpString=".sql") returned 4 [0081.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".sql") returned 0x0 [0081.639] lstrlenW (lpString=".mdf") returned 4 [0081.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".mdf") returned 0x0 [0081.639] lstrlenW (lpString=".txt") returned 4 [0081.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".txt") returned 0x0 [0081.639] lstrlenW (lpString=".dbf") returned 4 [0081.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".dbf") returned 0x0 [0081.639] lstrlenW (lpString=".ckp") returned 4 [0081.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".ckp") returned 0x0 [0081.639] lstrlenW (lpString=".dacpac") returned 7 [0081.639] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".dacpac") returned 0x0 [0081.639] lstrlenW (lpString=".db3") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".db3") returned 0x0 [0081.640] lstrlenW (lpString=".dtxs") returned 5 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".dtxs") returned 0x0 [0081.640] lstrlenW (lpString=".mdt") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".mdt") returned 0x0 [0081.640] lstrlenW (lpString=".sdf") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".sdf") returned 0x0 [0081.640] lstrlenW (lpString=".MDF") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".MDF") returned 0x0 [0081.640] lstrlenW (lpString=".DBF") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".DBF") returned 0x0 [0081.640] lstrlenW (lpString=".DB") returned 3 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".DB") returned 0x0 [0081.640] lstrlenW (lpString=".db") returned 3 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".db") returned 0x0 [0081.640] lstrlenW (lpString=".ndf") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".ndf") returned 0x0 [0081.640] lstrlenW (lpString=".NDF") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".NDF") returned 0x0 [0081.640] lstrlenW (lpString=".Mdf") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".Mdf") returned 0x0 [0081.640] lstrlenW (lpString=".dat") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".dat") returned 0x0 [0081.640] lstrlenW (lpString=".DAT") returned 4 [0081.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".DAT") returned 0x0 [0081.641] lstrlenW (lpString=".ldf") returned 4 [0081.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".ldf") returned 0x0 [0081.641] lstrlenW (lpString=".LDF") returned 4 [0081.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch=".LDF") returned 0x0 [0081.641] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.641] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.642] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.642] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.642] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20164295653) returned 1 [0081.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf79a6f0, dwHighDateTime=0x1d585b4)) [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2761e28 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2761e28 | out: hHeap=0x260000) returned 1 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2d1fd8 [0081.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x275f1a0 [0081.642] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d1fd8 | out: hHeap=0x260000) returned 1 [0081.643] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.643] GetLastError () returned 0x0 [0081.643] GetLastError () returned 0x0 [0081.643] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.643] GetLastError () returned 0x0 [0081.643] GetLastError () returned 0x0 [0081.764] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.764] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0081.765] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.765] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.765] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.765] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.766] CloseHandle (hObject=0x108) returned 1 [0081.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0081.766] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl.[deadmin@cock.li].deadmin")) returned 1 [0081.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0081.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.767] GetLastError () returned 0x0 [0081.767] RtlWakeConditionVariable () returned 0x0 [0081.767] GetCurrentThreadId () returned 0x9ac [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".ldf") returned 0x0 [0081.768] lstrlenW (lpString=".vhd") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".vhd") returned 0x0 [0081.768] lstrlenW (lpString=".vhdx") returned 5 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".vhdx") returned 0x0 [0081.768] lstrlenW (lpString=".pst") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".pst") returned 0x0 [0081.768] lstrlenW (lpString=".ost") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".ost") returned 0x0 [0081.768] lstrlenW (lpString=".bak") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".bak") returned 0x0 [0081.768] lstrlenW (lpString=".bac") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".bac") returned 0x0 [0081.768] lstrlenW (lpString=".sys") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".sys") returned 0x0 [0081.768] lstrlenW (lpString=".v2i") returned 4 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".v2i") returned 0x0 [0081.768] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.768] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.769] lstrlenW (lpString=".sql") returned 4 [0081.769] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".sql") returned 0x0 [0081.769] lstrlenW (lpString=".mdf") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".mdf") returned 0x0 [0081.770] lstrlenW (lpString=".txt") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".txt") returned 0x0 [0081.770] lstrlenW (lpString=".dbf") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".dbf") returned 0x0 [0081.770] lstrlenW (lpString=".ckp") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".ckp") returned 0x0 [0081.770] lstrlenW (lpString=".dacpac") returned 7 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".dacpac") returned 0x0 [0081.770] lstrlenW (lpString=".db3") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".db3") returned 0x0 [0081.770] lstrlenW (lpString=".dtxs") returned 5 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".dtxs") returned 0x0 [0081.770] lstrlenW (lpString=".mdt") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".mdt") returned 0x0 [0081.770] lstrlenW (lpString=".sdf") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".sdf") returned 0x0 [0081.770] lstrlenW (lpString=".MDF") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".MDF") returned 0x0 [0081.770] lstrlenW (lpString=".DBF") returned 4 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".DBF") returned 0x0 [0081.770] lstrlenW (lpString=".DB") returned 3 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".DB") returned 0x0 [0081.770] lstrlenW (lpString=".db") returned 3 [0081.770] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".db") returned 0x0 [0081.770] lstrlenW (lpString=".ndf") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".ndf") returned 0x0 [0081.771] lstrlenW (lpString=".NDF") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".NDF") returned 0x0 [0081.771] lstrlenW (lpString=".Mdf") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".Mdf") returned 0x0 [0081.771] lstrlenW (lpString=".dat") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".dat") returned 0x0 [0081.771] lstrlenW (lpString=".DAT") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".DAT") returned 0x0 [0081.771] lstrlenW (lpString=".ldf") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".ldf") returned 0x0 [0081.771] lstrlenW (lpString=".LDF") returned 4 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch=".LDF") returned 0x0 [0081.771] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.771] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.772] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.772] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.772] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.772] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20177330250) returned 1 [0081.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf8cb1f0, dwHighDateTime=0x1d585b4)) [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338598 [0081.772] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338598 | out: hHeap=0x260000) returned 1 [0081.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760798 [0081.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.773] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.773] GetLastError () returned 0x0 [0081.773] GetLastError () returned 0x0 [0081.773] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.773] GetLastError () returned 0x0 [0081.774] GetLastError () returned 0x0 [0081.775] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff94ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.776] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6b14, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6b14, lpOverlapped=0x0) returned 1 [0081.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.776] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.776] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.776] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.776] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.776] CloseHandle (hObject=0x108) returned 1 [0081.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.776] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.778] GetLastError () returned 0x0 [0081.778] RtlWakeConditionVariable () returned 0x0 [0081.778] GetCurrentThreadId () returned 0x9ac [0081.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".ldf") returned 0x0 [0081.778] lstrlenW (lpString=".vhd") returned 4 [0081.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".vhd") returned 0x0 [0081.778] lstrlenW (lpString=".vhdx") returned 5 [0081.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".vhdx") returned 0x0 [0081.778] lstrlenW (lpString=".pst") returned 4 [0081.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".pst") returned 0x0 [0081.778] lstrlenW (lpString=".ost") returned 4 [0081.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".ost") returned 0x0 [0081.778] lstrlenW (lpString=".bak") returned 4 [0081.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".bak") returned 0x0 [0081.779] lstrlenW (lpString=".bac") returned 4 [0081.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".bac") returned 0x0 [0081.779] lstrlenW (lpString=".sys") returned 4 [0081.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".sys") returned 0x0 [0081.779] lstrlenW (lpString=".v2i") returned 4 [0081.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".v2i") returned 0x0 [0081.779] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.780] lstrlenW (lpString=".sql") returned 4 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".sql") returned 0x0 [0081.780] lstrlenW (lpString=".mdf") returned 4 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".mdf") returned 0x0 [0081.780] lstrlenW (lpString=".txt") returned 4 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".txt") returned 0x0 [0081.780] lstrlenW (lpString=".dbf") returned 4 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".dbf") returned 0x0 [0081.780] lstrlenW (lpString=".ckp") returned 4 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".ckp") returned 0x0 [0081.780] lstrlenW (lpString=".dacpac") returned 7 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".dacpac") returned 0x0 [0081.780] lstrlenW (lpString=".db3") returned 4 [0081.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".db3") returned 0x0 [0081.780] lstrlenW (lpString=".dtxs") returned 5 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".dtxs") returned 0x0 [0081.781] lstrlenW (lpString=".mdt") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".mdt") returned 0x0 [0081.781] lstrlenW (lpString=".sdf") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".sdf") returned 0x0 [0081.781] lstrlenW (lpString=".MDF") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".MDF") returned 0x0 [0081.781] lstrlenW (lpString=".DBF") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".DBF") returned 0x0 [0081.781] lstrlenW (lpString=".DB") returned 3 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".DB") returned 0x0 [0081.781] lstrlenW (lpString=".db") returned 3 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".db") returned 0x0 [0081.781] lstrlenW (lpString=".ndf") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".ndf") returned 0x0 [0081.781] lstrlenW (lpString=".NDF") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".NDF") returned 0x0 [0081.781] lstrlenW (lpString=".Mdf") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".Mdf") returned 0x0 [0081.781] lstrlenW (lpString=".dat") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".dat") returned 0x0 [0081.781] lstrlenW (lpString=".DAT") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".DAT") returned 0x0 [0081.781] lstrlenW (lpString=".ldf") returned 4 [0081.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".ldf") returned 0x0 [0081.781] lstrlenW (lpString=".LDF") returned 4 [0081.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch=".LDF") returned 0x0 [0081.782] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.782] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.782] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.783] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.783] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20178385337) returned 1 [0081.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf8f1350, dwHighDateTime=0x1d585b4)) [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3385d0 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3385d0 | out: hHeap=0x260000) returned 1 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760408 [0081.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.784] GetLastError () returned 0x0 [0081.784] GetLastError () returned 0x0 [0081.784] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.784] GetLastError () returned 0x0 [0081.784] GetLastError () returned 0x0 [0081.786] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff47ac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.786] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb854, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb854, lpOverlapped=0x0) returned 1 [0081.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.786] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.786] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.787] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.787] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.787] CloseHandle (hObject=0x108) returned 1 [0081.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.788] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.788] GetLastError () returned 0x0 [0081.788] RtlWakeConditionVariable () returned 0x0 [0081.788] GetCurrentThreadId () returned 0x9ac [0081.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".ldf") returned 0x0 [0081.788] lstrlenW (lpString=".vhd") returned 4 [0081.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".vhd") returned 0x0 [0081.788] lstrlenW (lpString=".vhdx") returned 5 [0081.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".vhdx") returned 0x0 [0081.789] lstrlenW (lpString=".pst") returned 4 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".pst") returned 0x0 [0081.789] lstrlenW (lpString=".ost") returned 4 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".ost") returned 0x0 [0081.789] lstrlenW (lpString=".bak") returned 4 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".bak") returned 0x0 [0081.789] lstrlenW (lpString=".bac") returned 4 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".bac") returned 0x0 [0081.789] lstrlenW (lpString=".sys") returned 4 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".sys") returned 0x0 [0081.789] lstrlenW (lpString=".v2i") returned 4 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".v2i") returned 0x0 [0081.789] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.789] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.791] lstrlenW (lpString=".sql") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".sql") returned 0x0 [0081.791] lstrlenW (lpString=".mdf") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".mdf") returned 0x0 [0081.791] lstrlenW (lpString=".txt") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".txt") returned 0x0 [0081.791] lstrlenW (lpString=".dbf") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".dbf") returned 0x0 [0081.791] lstrlenW (lpString=".ckp") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".ckp") returned 0x0 [0081.791] lstrlenW (lpString=".dacpac") returned 7 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".dacpac") returned 0x0 [0081.791] lstrlenW (lpString=".db3") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".db3") returned 0x0 [0081.791] lstrlenW (lpString=".dtxs") returned 5 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".dtxs") returned 0x0 [0081.791] lstrlenW (lpString=".mdt") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".mdt") returned 0x0 [0081.791] lstrlenW (lpString=".sdf") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".sdf") returned 0x0 [0081.791] lstrlenW (lpString=".MDF") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".MDF") returned 0x0 [0081.791] lstrlenW (lpString=".DBF") returned 4 [0081.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".DBF") returned 0x0 [0081.792] lstrlenW (lpString=".DB") returned 3 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".DB") returned 0x0 [0081.792] lstrlenW (lpString=".db") returned 3 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".db") returned 0x0 [0081.792] lstrlenW (lpString=".ndf") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".ndf") returned 0x0 [0081.792] lstrlenW (lpString=".NDF") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".NDF") returned 0x0 [0081.792] lstrlenW (lpString=".Mdf") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".Mdf") returned 0x0 [0081.792] lstrlenW (lpString=".dat") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".dat") returned 0x0 [0081.792] lstrlenW (lpString=".DAT") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".DAT") returned 0x0 [0081.792] lstrlenW (lpString=".ldf") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".ldf") returned 0x0 [0081.792] lstrlenW (lpString=".LDF") returned 4 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch=".LDF") returned 0x0 [0081.792] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.792] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.793] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.793] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.793] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20179450171) returned 1 [0081.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf9174b0, dwHighDateTime=0x1d585b4)) [0081.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338608 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338608 | out: hHeap=0x260000) returned 1 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27601a8 [0081.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.794] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.794] GetLastError () returned 0x0 [0081.794] GetLastError () returned 0x0 [0081.795] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.795] GetLastError () returned 0x0 [0081.795] GetLastError () returned 0x0 [0081.797] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffff1ed2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.797] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe12e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xe12e, lpOverlapped=0x0) returned 1 [0081.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.797] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.797] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.798] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.798] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.798] CloseHandle (hObject=0x108) returned 1 [0081.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.[deadmin@cock.li].deadmin")) returned 1 [0081.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0081.799] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0081.799] GetLastError () returned 0x0 [0081.799] RtlWakeConditionVariable () returned 0x0 [0081.799] GetCurrentThreadId () returned 0x9ac [0081.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".ldf") returned 0x0 [0081.799] lstrlenW (lpString=".vhd") returned 4 [0081.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".vhd") returned 0x0 [0081.799] lstrlenW (lpString=".vhdx") returned 5 [0081.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".vhdx") returned 0x0 [0081.799] lstrlenW (lpString=".pst") returned 4 [0081.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".pst") returned 0x0 [0081.799] lstrlenW (lpString=".ost") returned 4 [0081.799] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".ost") returned 0x0 [0081.800] lstrlenW (lpString=".bak") returned 4 [0081.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".bak") returned 0x0 [0081.800] lstrlenW (lpString=".bac") returned 4 [0081.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".bac") returned 0x0 [0081.800] lstrlenW (lpString=".sys") returned 4 [0081.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".sys") returned 0x0 [0081.800] lstrlenW (lpString=".v2i") returned 4 [0081.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".v2i") returned 0x0 [0081.800] lstrlenW (lpString="s\r\n.v2i") returned 7 [0081.800] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch="s\r\n.v2i") returned 0x0 [0081.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0081.801] lstrlenW (lpString=".sql") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".sql") returned 0x0 [0081.801] lstrlenW (lpString=".mdf") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".mdf") returned 0x0 [0081.801] lstrlenW (lpString=".txt") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".txt") returned 0x0 [0081.801] lstrlenW (lpString=".dbf") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".dbf") returned 0x0 [0081.801] lstrlenW (lpString=".ckp") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".ckp") returned 0x0 [0081.801] lstrlenW (lpString=".dacpac") returned 7 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".dacpac") returned 0x0 [0081.801] lstrlenW (lpString=".db3") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".db3") returned 0x0 [0081.801] lstrlenW (lpString=".dtxs") returned 5 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".dtxs") returned 0x0 [0081.801] lstrlenW (lpString=".mdt") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".mdt") returned 0x0 [0081.801] lstrlenW (lpString=".sdf") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".sdf") returned 0x0 [0081.801] lstrlenW (lpString=".MDF") returned 4 [0081.801] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".MDF") returned 0x0 [0081.802] lstrlenW (lpString=".DBF") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".DBF") returned 0x0 [0081.802] lstrlenW (lpString=".DB") returned 3 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".DB") returned 0x0 [0081.802] lstrlenW (lpString=".db") returned 3 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".db") returned 0x0 [0081.802] lstrlenW (lpString=".ndf") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".ndf") returned 0x0 [0081.802] lstrlenW (lpString=".NDF") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".NDF") returned 0x0 [0081.802] lstrlenW (lpString=".Mdf") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".Mdf") returned 0x0 [0081.802] lstrlenW (lpString=".dat") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".dat") returned 0x0 [0081.802] lstrlenW (lpString=".DAT") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".DAT") returned 0x0 [0081.802] lstrlenW (lpString=".ldf") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".ldf") returned 0x0 [0081.802] lstrlenW (lpString=".LDF") returned 4 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch=".LDF") returned 0x0 [0081.802] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0081.802] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0081.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0081.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0081.802] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0081.803] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0081.803] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0081.803] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0081.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0081.803] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0081.803] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20180458236) returned 1 [0081.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbf9174b0, dwHighDateTime=0x1d585b4)) [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338640 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0081.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338640 | out: hHeap=0x260000) returned 1 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0081.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0081.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0081.804] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760370 [0081.804] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0081.804] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0081.804] GetLastError () returned 0x0 [0081.804] GetLastError () returned 0x0 [0081.805] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0081.805] GetLastError () returned 0x0 [0081.805] GetLastError () returned 0x0 [0081.887] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffc6fe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.888] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3902, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3902, lpOverlapped=0x0) returned 1 [0081.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0081.888] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.888] WriteFile (in: hFile=0x108, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.888] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0081.888] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0081.888] CloseHandle (hObject=0x108) returned 1 [0081.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0081.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.[deadmin@cock.li].deadmin")) returned 1 [0082.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.016] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.016] GetLastError () returned 0x0 [0082.016] RtlWakeConditionVariable () returned 0x0 [0082.017] GetCurrentThreadId () returned 0x9ac [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".ldf") returned 0x0 [0082.017] lstrlenW (lpString=".vhd") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".vhd") returned 0x0 [0082.017] lstrlenW (lpString=".vhdx") returned 5 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".vhdx") returned 0x0 [0082.017] lstrlenW (lpString=".pst") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".pst") returned 0x0 [0082.017] lstrlenW (lpString=".ost") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".ost") returned 0x0 [0082.017] lstrlenW (lpString=".bak") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".bak") returned 0x0 [0082.017] lstrlenW (lpString=".bac") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".bac") returned 0x0 [0082.017] lstrlenW (lpString=".sys") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".sys") returned 0x0 [0082.017] lstrlenW (lpString=".v2i") returned 4 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".v2i") returned 0x0 [0082.017] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.017] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch="s\r\n.v2i") returned 0x0 [0082.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0082.019] lstrlenW (lpString=".sql") returned 4 [0082.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".sql") returned 0x0 [0082.019] lstrlenW (lpString=".mdf") returned 4 [0082.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".mdf") returned 0x0 [0082.019] lstrlenW (lpString=".txt") returned 4 [0082.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".txt") returned 0x0 [0082.019] lstrlenW (lpString=".dbf") returned 4 [0082.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".dbf") returned 0x0 [0082.019] lstrlenW (lpString=".ckp") returned 4 [0082.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".ckp") returned 0x0 [0082.019] lstrlenW (lpString=".dacpac") returned 7 [0082.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".dacpac") returned 0x0 [0082.020] lstrlenW (lpString=".db3") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".db3") returned 0x0 [0082.020] lstrlenW (lpString=".dtxs") returned 5 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".dtxs") returned 0x0 [0082.020] lstrlenW (lpString=".mdt") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".mdt") returned 0x0 [0082.020] lstrlenW (lpString=".sdf") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".sdf") returned 0x0 [0082.020] lstrlenW (lpString=".MDF") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".MDF") returned 0x0 [0082.020] lstrlenW (lpString=".DBF") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".DBF") returned 0x0 [0082.020] lstrlenW (lpString=".DB") returned 3 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".DB") returned 0x0 [0082.020] lstrlenW (lpString=".db") returned 3 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".db") returned 0x0 [0082.020] lstrlenW (lpString=".ndf") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".ndf") returned 0x0 [0082.020] lstrlenW (lpString=".NDF") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".NDF") returned 0x0 [0082.020] lstrlenW (lpString=".Mdf") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".Mdf") returned 0x0 [0082.020] lstrlenW (lpString=".dat") returned 4 [0082.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".dat") returned 0x0 [0082.020] lstrlenW (lpString=".DAT") returned 4 [0082.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".DAT") returned 0x0 [0082.021] lstrlenW (lpString=".ldf") returned 4 [0082.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".ldf") returned 0x0 [0082.021] lstrlenW (lpString=".LDF") returned 4 [0082.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch=".LDF") returned 0x0 [0082.021] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0082.021] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d29c0) returned 1 [0082.022] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0082.022] CryptReleaseContext (hProv=0x2d29c0, dwFlags=0x0) returned 1 [0082.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0082.022] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20202297775) returned 1 [0082.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbfb2c7f0, dwHighDateTime=0x1d585b4)) [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762370 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762370 | out: hHeap=0x260000) returned 1 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.022] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.023] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.023] GetLastError () returned 0x0 [0082.023] GetLastError () returned 0x0 [0082.023] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.023] GetLastError () returned 0x0 [0082.023] GetLastError () returned 0x0 [0082.025] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffcc78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.025] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3388, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3388, lpOverlapped=0x0) returned 1 [0082.025] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.025] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.025] WriteFile (in: hFile=0xe4, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.026] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.026] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.026] CloseHandle (hObject=0xe4) returned 1 [0082.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.[deadmin@cock.li].deadmin")) returned 1 [0082.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0082.027] GetLastError () returned 0x0 [0082.027] RtlWakeConditionVariable () returned 0x0 [0082.027] GetCurrentThreadId () returned 0x9ac [0082.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".ldf") returned 0x0 [0082.027] lstrlenW (lpString=".vhd") returned 4 [0082.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".vhd") returned 0x0 [0082.027] lstrlenW (lpString=".vhdx") returned 5 [0082.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".vhdx") returned 0x0 [0082.027] lstrlenW (lpString=".pst") returned 4 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".pst") returned 0x0 [0082.028] lstrlenW (lpString=".ost") returned 4 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".ost") returned 0x0 [0082.028] lstrlenW (lpString=".bak") returned 4 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".bak") returned 0x0 [0082.028] lstrlenW (lpString=".bac") returned 4 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".bac") returned 0x0 [0082.028] lstrlenW (lpString=".sys") returned 4 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".sys") returned 0x0 [0082.028] lstrlenW (lpString=".v2i") returned 4 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".v2i") returned 0x0 [0082.028] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0082.056] lstrlenW (lpString=".sql") returned 4 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".sql") returned 0x0 [0082.056] lstrlenW (lpString=".mdf") returned 4 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".mdf") returned 0x0 [0082.056] lstrlenW (lpString=".txt") returned 4 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".txt") returned 0x0 [0082.056] lstrlenW (lpString=".dbf") returned 4 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".dbf") returned 0x0 [0082.056] lstrlenW (lpString=".ckp") returned 4 [0082.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".ckp") returned 0x0 [0082.057] lstrlenW (lpString=".dacpac") returned 7 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".dacpac") returned 0x0 [0082.057] lstrlenW (lpString=".db3") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".db3") returned 0x0 [0082.057] lstrlenW (lpString=".dtxs") returned 5 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".dtxs") returned 0x0 [0082.057] lstrlenW (lpString=".mdt") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".mdt") returned 0x0 [0082.057] lstrlenW (lpString=".sdf") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".sdf") returned 0x0 [0082.057] lstrlenW (lpString=".MDF") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".MDF") returned 0x0 [0082.057] lstrlenW (lpString=".DBF") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".DBF") returned 0x0 [0082.057] lstrlenW (lpString=".DB") returned 3 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".DB") returned 0x0 [0082.057] lstrlenW (lpString=".db") returned 3 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".db") returned 0x0 [0082.057] lstrlenW (lpString=".ndf") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".ndf") returned 0x0 [0082.057] lstrlenW (lpString=".NDF") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".NDF") returned 0x0 [0082.057] lstrlenW (lpString=".Mdf") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".Mdf") returned 0x0 [0082.057] lstrlenW (lpString=".dat") returned 4 [0082.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".dat") returned 0x0 [0082.058] lstrlenW (lpString=".DAT") returned 4 [0082.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".DAT") returned 0x0 [0082.058] lstrlenW (lpString=".ldf") returned 4 [0082.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".ldf") returned 0x0 [0082.058] lstrlenW (lpString=".LDF") returned 4 [0082.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch=".LDF") returned 0x0 [0082.058] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.058] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0082.059] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.059] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.059] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20206115980) returned 1 [0082.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbfb9ec10, dwHighDateTime=0x1d585b4)) [0082.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762220 [0082.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762220 | out: hHeap=0x260000) returned 1 [0082.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27649e0 [0082.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.061] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.061] GetLastError () returned 0x0 [0082.061] GetLastError () returned 0x0 [0082.061] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.061] GetLastError () returned 0x0 [0082.061] GetLastError () returned 0x0 [0082.063] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd860, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.063] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x27a0, lpOverlapped=0x0) returned 1 [0082.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.063] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.064] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.064] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.064] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.064] CloseHandle (hObject=0x108) returned 1 [0082.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.065] GetLastError () returned 0x0 [0082.065] RtlWakeConditionVariable () returned 0x0 [0082.065] GetCurrentThreadId () returned 0x9ac [0082.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".ldf") returned 0x0 [0082.065] lstrlenW (lpString=".vhd") returned 4 [0082.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".vhd") returned 0x0 [0082.065] lstrlenW (lpString=".vhdx") returned 5 [0082.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".vhdx") returned 0x0 [0082.065] lstrlenW (lpString=".pst") returned 4 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".pst") returned 0x0 [0082.066] lstrlenW (lpString=".ost") returned 4 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".ost") returned 0x0 [0082.066] lstrlenW (lpString=".bak") returned 4 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".bak") returned 0x0 [0082.066] lstrlenW (lpString=".bac") returned 4 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".bac") returned 0x0 [0082.066] lstrlenW (lpString=".sys") returned 4 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".sys") returned 0x0 [0082.066] lstrlenW (lpString=".v2i") returned 4 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".v2i") returned 0x0 [0082.066] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0082.067] lstrlenW (lpString=".sql") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".sql") returned 0x0 [0082.067] lstrlenW (lpString=".mdf") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".mdf") returned 0x0 [0082.067] lstrlenW (lpString=".txt") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".txt") returned 0x0 [0082.067] lstrlenW (lpString=".dbf") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".dbf") returned 0x0 [0082.067] lstrlenW (lpString=".ckp") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".ckp") returned 0x0 [0082.067] lstrlenW (lpString=".dacpac") returned 7 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".dacpac") returned 0x0 [0082.067] lstrlenW (lpString=".db3") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".db3") returned 0x0 [0082.067] lstrlenW (lpString=".dtxs") returned 5 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".dtxs") returned 0x0 [0082.067] lstrlenW (lpString=".mdt") returned 4 [0082.067] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".mdt") returned 0x0 [0082.067] lstrlenW (lpString=".sdf") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".sdf") returned 0x0 [0082.068] lstrlenW (lpString=".MDF") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".MDF") returned 0x0 [0082.068] lstrlenW (lpString=".DBF") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".DBF") returned 0x0 [0082.068] lstrlenW (lpString=".DB") returned 3 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".DB") returned 0x0 [0082.068] lstrlenW (lpString=".db") returned 3 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".db") returned 0x0 [0082.068] lstrlenW (lpString=".ndf") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".ndf") returned 0x0 [0082.068] lstrlenW (lpString=".NDF") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".NDF") returned 0x0 [0082.068] lstrlenW (lpString=".Mdf") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".Mdf") returned 0x0 [0082.068] lstrlenW (lpString=".dat") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".dat") returned 0x0 [0082.068] lstrlenW (lpString=".DAT") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".DAT") returned 0x0 [0082.068] lstrlenW (lpString=".ldf") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".ldf") returned 0x0 [0082.068] lstrlenW (lpString=".LDF") returned 4 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch=".LDF") returned 0x0 [0082.068] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.068] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.069] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0082.069] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.069] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.070] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20207065459) returned 1 [0082.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbfb9ec10, dwHighDateTime=0x1d585b4)) [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762290 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762290 | out: hHeap=0x260000) returned 1 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764650 [0082.070] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.070] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.070] GetLastError () returned 0x0 [0082.071] GetLastError () returned 0x0 [0082.071] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.071] GetLastError () returned 0x0 [0082.071] GetLastError () returned 0x0 [0082.073] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd248, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.073] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2db8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2db8, lpOverlapped=0x0) returned 1 [0082.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.073] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.073] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.073] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.073] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.073] CloseHandle (hObject=0x108) returned 1 [0082.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.074] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.075] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.075] GetLastError () returned 0x0 [0082.075] RtlWakeConditionVariable () returned 0x0 [0082.075] GetCurrentThreadId () returned 0x9ac [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".ldf") returned 0x0 [0082.075] lstrlenW (lpString=".vhd") returned 4 [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".vhd") returned 0x0 [0082.075] lstrlenW (lpString=".vhdx") returned 5 [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".vhdx") returned 0x0 [0082.075] lstrlenW (lpString=".pst") returned 4 [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".pst") returned 0x0 [0082.075] lstrlenW (lpString=".ost") returned 4 [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".ost") returned 0x0 [0082.075] lstrlenW (lpString=".bak") returned 4 [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".bak") returned 0x0 [0082.075] lstrlenW (lpString=".bac") returned 4 [0082.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".bac") returned 0x0 [0082.075] lstrlenW (lpString=".sys") returned 4 [0082.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".sys") returned 0x0 [0082.076] lstrlenW (lpString=".v2i") returned 4 [0082.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".v2i") returned 0x0 [0082.076] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.076] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0082.077] lstrlenW (lpString=".sql") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".sql") returned 0x0 [0082.077] lstrlenW (lpString=".mdf") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".mdf") returned 0x0 [0082.077] lstrlenW (lpString=".txt") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".txt") returned 0x0 [0082.077] lstrlenW (lpString=".dbf") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".dbf") returned 0x0 [0082.077] lstrlenW (lpString=".ckp") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".ckp") returned 0x0 [0082.077] lstrlenW (lpString=".dacpac") returned 7 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".dacpac") returned 0x0 [0082.077] lstrlenW (lpString=".db3") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".db3") returned 0x0 [0082.077] lstrlenW (lpString=".dtxs") returned 5 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".dtxs") returned 0x0 [0082.077] lstrlenW (lpString=".mdt") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".mdt") returned 0x0 [0082.077] lstrlenW (lpString=".sdf") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".sdf") returned 0x0 [0082.077] lstrlenW (lpString=".MDF") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".MDF") returned 0x0 [0082.077] lstrlenW (lpString=".DBF") returned 4 [0082.077] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".DBF") returned 0x0 [0082.077] lstrlenW (lpString=".DB") returned 3 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".DB") returned 0x0 [0082.078] lstrlenW (lpString=".db") returned 3 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".db") returned 0x0 [0082.078] lstrlenW (lpString=".ndf") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".ndf") returned 0x0 [0082.078] lstrlenW (lpString=".NDF") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".NDF") returned 0x0 [0082.078] lstrlenW (lpString=".Mdf") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".Mdf") returned 0x0 [0082.078] lstrlenW (lpString=".dat") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".dat") returned 0x0 [0082.078] lstrlenW (lpString=".DAT") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".DAT") returned 0x0 [0082.078] lstrlenW (lpString=".ldf") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".ldf") returned 0x0 [0082.078] lstrlenW (lpString=".LDF") returned 4 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch=".LDF") returned 0x0 [0082.078] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.078] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.078] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0082.079] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.079] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0082.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.079] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20208044654) returned 1 [0082.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbfbc4d70, dwHighDateTime=0x1d585b4)) [0082.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762258 [0082.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762258 | out: hHeap=0x260000) returned 1 [0082.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27646e8 [0082.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.080] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.080] GetLastError () returned 0x0 [0082.080] GetLastError () returned 0x0 [0082.080] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.081] GetLastError () returned 0x0 [0082.081] GetLastError () returned 0x0 [0082.154] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xffffd850, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.177] WriteFile (in: hFile=0x108, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x27b0, lpOverlapped=0x0) returned 1 [0082.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.188] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.188] WriteFile (in: hFile=0x108, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.188] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.188] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.188] CloseHandle (hObject=0x108) returned 1 [0082.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281de30 [0082.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281de30 | out: hHeap=0x260000) returned 1 [0082.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.189] GetLastError () returned 0x0 [0082.190] RtlWakeConditionVariable () returned 0x0 [0082.190] GetCurrentThreadId () returned 0x9ac [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".ldf") returned 0x0 [0082.190] lstrlenW (lpString=".vhd") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".vhd") returned 0x0 [0082.190] lstrlenW (lpString=".vhdx") returned 5 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".vhdx") returned 0x0 [0082.190] lstrlenW (lpString=".pst") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".pst") returned 0x0 [0082.190] lstrlenW (lpString=".ost") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".ost") returned 0x0 [0082.190] lstrlenW (lpString=".bak") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".bak") returned 0x0 [0082.190] lstrlenW (lpString=".bac") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".bac") returned 0x0 [0082.190] lstrlenW (lpString=".sys") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".sys") returned 0x0 [0082.190] lstrlenW (lpString=".v2i") returned 4 [0082.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".v2i") returned 0x0 [0082.191] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch="s\r\n.v2i") returned 0x0 [0082.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.394] lstrlenW (lpString=".sql") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".sql") returned 0x0 [0082.394] lstrlenW (lpString=".mdf") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".mdf") returned 0x0 [0082.394] lstrlenW (lpString=".txt") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".txt") returned 0x0 [0082.394] lstrlenW (lpString=".dbf") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".dbf") returned 0x0 [0082.394] lstrlenW (lpString=".ckp") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".ckp") returned 0x0 [0082.394] lstrlenW (lpString=".dacpac") returned 7 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".dacpac") returned 0x0 [0082.394] lstrlenW (lpString=".db3") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".db3") returned 0x0 [0082.394] lstrlenW (lpString=".dtxs") returned 5 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".dtxs") returned 0x0 [0082.394] lstrlenW (lpString=".mdt") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".mdt") returned 0x0 [0082.394] lstrlenW (lpString=".sdf") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".sdf") returned 0x0 [0082.394] lstrlenW (lpString=".MDF") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".MDF") returned 0x0 [0082.394] lstrlenW (lpString=".DBF") returned 4 [0082.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".DBF") returned 0x0 [0082.394] lstrlenW (lpString=".DB") returned 3 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".DB") returned 0x0 [0082.395] lstrlenW (lpString=".db") returned 3 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".db") returned 0x0 [0082.395] lstrlenW (lpString=".ndf") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".ndf") returned 0x0 [0082.395] lstrlenW (lpString=".NDF") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".NDF") returned 0x0 [0082.395] lstrlenW (lpString=".Mdf") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".Mdf") returned 0x0 [0082.395] lstrlenW (lpString=".dat") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".dat") returned 0x0 [0082.395] lstrlenW (lpString=".DAT") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".DAT") returned 0x0 [0082.395] lstrlenW (lpString=".ldf") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".ldf") returned 0x0 [0082.395] lstrlenW (lpString=".LDF") returned 4 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch=".LDF") returned 0x0 [0082.395] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.395] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.395] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d2f10) returned 1 [0082.396] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.396] CryptReleaseContext (hProv=0x2d2f10, dwFlags=0x0) returned 1 [0082.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.396] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20239747029) returned 1 [0082.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbfebe8f0, dwHighDateTime=0x1d585b4)) [0082.396] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338e90 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338e90 | out: hHeap=0x260000) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x324de8 [0082.397] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.397] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.397] GetLastError () returned 0x0 [0082.397] GetLastError () returned 0x0 [0082.398] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.398] GetLastError () returned 0x0 [0082.398] GetLastError () returned 0x0 [0082.415] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff8660, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.415] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x79a0, lpOverlapped=0x0) returned 1 [0082.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.416] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.416] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.416] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.416] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.416] CloseHandle (hObject=0x11c) returned 1 [0082.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0082.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.[deadmin@cock.li].deadmin")) returned 1 [0082.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0082.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.418] GetLastError () returned 0x0 [0082.418] RtlWakeConditionVariable () returned 0x27e828 [0082.418] GetCurrentThreadId () returned 0x9ac [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".ldf") returned 0x0 [0082.418] lstrlenW (lpString=".vhd") returned 4 [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".vhd") returned 0x0 [0082.418] lstrlenW (lpString=".vhdx") returned 5 [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".vhdx") returned 0x0 [0082.418] lstrlenW (lpString=".pst") returned 4 [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".pst") returned 0x0 [0082.418] lstrlenW (lpString=".ost") returned 4 [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".ost") returned 0x0 [0082.418] lstrlenW (lpString=".bak") returned 4 [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".bak") returned 0x0 [0082.418] lstrlenW (lpString=".bac") returned 4 [0082.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".bac") returned 0x0 [0082.419] lstrlenW (lpString=".sys") returned 4 [0082.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".sys") returned 0x0 [0082.419] lstrlenW (lpString=".v2i") returned 4 [0082.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".v2i") returned 0x0 [0082.419] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.419] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.420] lstrlenW (lpString=".sql") returned 4 [0082.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".sql") returned 0x0 [0082.420] lstrlenW (lpString=".mdf") returned 4 [0082.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".mdf") returned 0x0 [0082.420] lstrlenW (lpString=".txt") returned 4 [0082.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".txt") returned 0x0 [0082.420] lstrlenW (lpString=".dbf") returned 4 [0082.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".dbf") returned 0x0 [0082.420] lstrlenW (lpString=".ckp") returned 4 [0082.420] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".ckp") returned 0x0 [0082.420] lstrlenW (lpString=".dacpac") returned 7 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".dacpac") returned 0x0 [0082.421] lstrlenW (lpString=".db3") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".db3") returned 0x0 [0082.421] lstrlenW (lpString=".dtxs") returned 5 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".dtxs") returned 0x0 [0082.421] lstrlenW (lpString=".mdt") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".mdt") returned 0x0 [0082.421] lstrlenW (lpString=".sdf") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".sdf") returned 0x0 [0082.421] lstrlenW (lpString=".MDF") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".MDF") returned 0x0 [0082.421] lstrlenW (lpString=".DBF") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".DBF") returned 0x0 [0082.421] lstrlenW (lpString=".DB") returned 3 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".DB") returned 0x0 [0082.421] lstrlenW (lpString=".db") returned 3 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".db") returned 0x0 [0082.421] lstrlenW (lpString=".ndf") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".ndf") returned 0x0 [0082.421] lstrlenW (lpString=".NDF") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".NDF") returned 0x0 [0082.421] lstrlenW (lpString=".Mdf") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".Mdf") returned 0x0 [0082.421] lstrlenW (lpString=".dat") returned 4 [0082.421] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".dat") returned 0x0 [0082.421] lstrlenW (lpString=".DAT") returned 4 [0082.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".DAT") returned 0x0 [0082.422] lstrlenW (lpString=".ldf") returned 4 [0082.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".ldf") returned 0x0 [0082.422] lstrlenW (lpString=".LDF") returned 4 [0082.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch=".LDF") returned 0x0 [0082.422] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.422] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.422] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.422] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d2f10) returned 1 [0082.423] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.423] CryptReleaseContext (hProv=0x2d2f10, dwFlags=0x0) returned 1 [0082.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.423] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20242402479) returned 1 [0082.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xbff0abb0, dwHighDateTime=0x1d585b4)) [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x338f00 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x338f00 | out: hHeap=0x260000) returned 1 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.423] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.423] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.424] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.424] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.424] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.424] GetLastError () returned 0x0 [0082.424] GetLastError () returned 0x0 [0082.424] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.424] GetLastError () returned 0x0 [0082.424] GetLastError () returned 0x0 [0082.440] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.441] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.442] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.442] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.442] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.456] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.456] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.456] CloseHandle (hObject=0x11c) returned 1 [0082.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.546] GetLastError () returned 0x0 [0082.546] RtlWakeConditionVariable () returned 0x27e828 [0082.546] GetCurrentThreadId () returned 0x9ac [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".ldf") returned 0x0 [0082.547] lstrlenW (lpString=".vhd") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".vhd") returned 0x0 [0082.547] lstrlenW (lpString=".vhdx") returned 5 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".vhdx") returned 0x0 [0082.547] lstrlenW (lpString=".pst") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".pst") returned 0x0 [0082.547] lstrlenW (lpString=".ost") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".ost") returned 0x0 [0082.547] lstrlenW (lpString=".bak") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".bak") returned 0x0 [0082.547] lstrlenW (lpString=".bac") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".bac") returned 0x0 [0082.547] lstrlenW (lpString=".sys") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".sys") returned 0x0 [0082.547] lstrlenW (lpString=".v2i") returned 4 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".v2i") returned 0x0 [0082.547] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.547] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0082.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.548] lstrlenW (lpString=".sql") returned 4 [0082.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".sql") returned 0x0 [0082.548] lstrlenW (lpString=".mdf") returned 4 [0082.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".mdf") returned 0x0 [0082.549] lstrlenW (lpString=".txt") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".txt") returned 0x0 [0082.549] lstrlenW (lpString=".dbf") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".dbf") returned 0x0 [0082.549] lstrlenW (lpString=".ckp") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".ckp") returned 0x0 [0082.549] lstrlenW (lpString=".dacpac") returned 7 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".dacpac") returned 0x0 [0082.549] lstrlenW (lpString=".db3") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".db3") returned 0x0 [0082.549] lstrlenW (lpString=".dtxs") returned 5 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".dtxs") returned 0x0 [0082.549] lstrlenW (lpString=".mdt") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".mdt") returned 0x0 [0082.549] lstrlenW (lpString=".sdf") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".sdf") returned 0x0 [0082.549] lstrlenW (lpString=".MDF") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".MDF") returned 0x0 [0082.549] lstrlenW (lpString=".DBF") returned 4 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".DBF") returned 0x0 [0082.549] lstrlenW (lpString=".DB") returned 3 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".DB") returned 0x0 [0082.549] lstrlenW (lpString=".db") returned 3 [0082.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".db") returned 0x0 [0082.549] lstrlenW (lpString=".ndf") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".ndf") returned 0x0 [0082.550] lstrlenW (lpString=".NDF") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".NDF") returned 0x0 [0082.550] lstrlenW (lpString=".Mdf") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".Mdf") returned 0x0 [0082.550] lstrlenW (lpString=".dat") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".dat") returned 0x0 [0082.550] lstrlenW (lpString=".DAT") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".DAT") returned 0x0 [0082.550] lstrlenW (lpString=".ldf") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".ldf") returned 0x0 [0082.550] lstrlenW (lpString=".LDF") returned 4 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch=".LDF") returned 0x0 [0082.550] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.550] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d31b8) returned 1 [0082.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.551] CryptReleaseContext (hProv=0x2d31b8, dwFlags=0x0) returned 1 [0082.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.551] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20255229034) returned 1 [0082.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc003b6b0, dwHighDateTime=0x1d585b4)) [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762450 [0082.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762450 | out: hHeap=0x260000) returned 1 [0082.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.552] GetLastError () returned 0x0 [0082.552] GetLastError () returned 0x0 [0082.552] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.552] GetLastError () returned 0x0 [0082.553] GetLastError () returned 0x0 [0082.567] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.568] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.569] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.569] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.569] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.569] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.569] CloseHandle (hObject=0x11c) returned 1 [0082.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.571] GetLastError () returned 0x0 [0082.572] RtlWakeConditionVariable () returned 0x27e828 [0082.572] GetCurrentThreadId () returned 0x9ac [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".ldf") returned 0x0 [0082.572] lstrlenW (lpString=".vhd") returned 4 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".vhd") returned 0x0 [0082.572] lstrlenW (lpString=".vhdx") returned 5 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".vhdx") returned 0x0 [0082.572] lstrlenW (lpString=".pst") returned 4 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".pst") returned 0x0 [0082.572] lstrlenW (lpString=".ost") returned 4 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".ost") returned 0x0 [0082.572] lstrlenW (lpString=".bak") returned 4 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".bak") returned 0x0 [0082.572] lstrlenW (lpString=".bac") returned 4 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".bac") returned 0x0 [0082.572] lstrlenW (lpString=".sys") returned 4 [0082.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".sys") returned 0x0 [0082.573] lstrlenW (lpString=".v2i") returned 4 [0082.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".v2i") returned 0x0 [0082.573] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0082.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.575] lstrlenW (lpString=".sql") returned 4 [0082.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".sql") returned 0x0 [0082.575] lstrlenW (lpString=".mdf") returned 4 [0082.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".mdf") returned 0x0 [0082.575] lstrlenW (lpString=".txt") returned 4 [0082.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".txt") returned 0x0 [0082.575] lstrlenW (lpString=".dbf") returned 4 [0082.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".dbf") returned 0x0 [0082.575] lstrlenW (lpString=".ckp") returned 4 [0082.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".ckp") returned 0x0 [0082.575] lstrlenW (lpString=".dacpac") returned 7 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".dacpac") returned 0x0 [0082.576] lstrlenW (lpString=".db3") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".db3") returned 0x0 [0082.576] lstrlenW (lpString=".dtxs") returned 5 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".dtxs") returned 0x0 [0082.576] lstrlenW (lpString=".mdt") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".mdt") returned 0x0 [0082.576] lstrlenW (lpString=".sdf") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".sdf") returned 0x0 [0082.576] lstrlenW (lpString=".MDF") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".MDF") returned 0x0 [0082.576] lstrlenW (lpString=".DBF") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".DBF") returned 0x0 [0082.576] lstrlenW (lpString=".DB") returned 3 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".DB") returned 0x0 [0082.576] lstrlenW (lpString=".db") returned 3 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".db") returned 0x0 [0082.576] lstrlenW (lpString=".ndf") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".ndf") returned 0x0 [0082.576] lstrlenW (lpString=".NDF") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".NDF") returned 0x0 [0082.576] lstrlenW (lpString=".Mdf") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".Mdf") returned 0x0 [0082.576] lstrlenW (lpString=".dat") returned 4 [0082.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".dat") returned 0x0 [0082.576] lstrlenW (lpString=".DAT") returned 4 [0082.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".DAT") returned 0x0 [0082.577] lstrlenW (lpString=".ldf") returned 4 [0082.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".ldf") returned 0x0 [0082.577] lstrlenW (lpString=".LDF") returned 4 [0082.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch=".LDF") returned 0x0 [0082.577] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.577] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.577] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3570) returned 1 [0082.578] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.578] CryptReleaseContext (hProv=0x2d3570, dwFlags=0x0) returned 1 [0082.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.578] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20257903519) returned 1 [0082.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0087970, dwHighDateTime=0x1d585b4)) [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27623e0 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27623e0 | out: hHeap=0x260000) returned 1 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.578] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0082.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.579] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.579] GetLastError () returned 0x0 [0082.579] GetLastError () returned 0x0 [0082.579] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.579] GetLastError () returned 0x0 [0082.579] GetLastError () returned 0x0 [0082.658] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.658] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.659] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.659] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.660] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.660] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.660] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.660] CloseHandle (hObject=0x11c) returned 1 [0082.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.[deadmin@cock.li].deadmin")) returned 1 [0082.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.662] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.662] GetLastError () returned 0x0 [0082.662] RtlWakeConditionVariable () returned 0x0 [0082.662] GetCurrentThreadId () returned 0x9ac [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".ldf") returned 0x0 [0082.663] lstrlenW (lpString=".vhd") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".vhd") returned 0x0 [0082.663] lstrlenW (lpString=".vhdx") returned 5 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".vhdx") returned 0x0 [0082.663] lstrlenW (lpString=".pst") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".pst") returned 0x0 [0082.663] lstrlenW (lpString=".ost") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".ost") returned 0x0 [0082.663] lstrlenW (lpString=".bak") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".bak") returned 0x0 [0082.663] lstrlenW (lpString=".bac") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".bac") returned 0x0 [0082.663] lstrlenW (lpString=".sys") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".sys") returned 0x0 [0082.663] lstrlenW (lpString=".v2i") returned 4 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".v2i") returned 0x0 [0082.663] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0082.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.665] lstrlenW (lpString=".sql") returned 4 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".sql") returned 0x0 [0082.665] lstrlenW (lpString=".mdf") returned 4 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".mdf") returned 0x0 [0082.665] lstrlenW (lpString=".txt") returned 4 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".txt") returned 0x0 [0082.665] lstrlenW (lpString=".dbf") returned 4 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".dbf") returned 0x0 [0082.665] lstrlenW (lpString=".ckp") returned 4 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".ckp") returned 0x0 [0082.665] lstrlenW (lpString=".dacpac") returned 7 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".dacpac") returned 0x0 [0082.665] lstrlenW (lpString=".db3") returned 4 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".db3") returned 0x0 [0082.665] lstrlenW (lpString=".dtxs") returned 5 [0082.665] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".dtxs") returned 0x0 [0082.665] lstrlenW (lpString=".mdt") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".mdt") returned 0x0 [0082.666] lstrlenW (lpString=".sdf") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".sdf") returned 0x0 [0082.666] lstrlenW (lpString=".MDF") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".MDF") returned 0x0 [0082.666] lstrlenW (lpString=".DBF") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".DBF") returned 0x0 [0082.666] lstrlenW (lpString=".DB") returned 3 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".DB") returned 0x0 [0082.666] lstrlenW (lpString=".db") returned 3 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".db") returned 0x0 [0082.666] lstrlenW (lpString=".ndf") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".ndf") returned 0x0 [0082.666] lstrlenW (lpString=".NDF") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".NDF") returned 0x0 [0082.666] lstrlenW (lpString=".Mdf") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".Mdf") returned 0x0 [0082.666] lstrlenW (lpString=".dat") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".dat") returned 0x0 [0082.666] lstrlenW (lpString=".DAT") returned 4 [0082.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", lpSrch=".DAT") returned=".DAT" [0082.666] lstrlenW (lpString=".DAT") returned 4 [0082.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.666] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3680) returned 1 [0082.667] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.667] CryptReleaseContext (hProv=0x2d3680, dwFlags=0x0) returned 1 [0082.667] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.667] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.668] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20266864207) returned 1 [0082.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc016c1b0, dwHighDateTime=0x1d585b4)) [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339130 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339130 | out: hHeap=0x260000) returned 1 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.668] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.668] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.668] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.668] GetLastError () returned 0x0 [0082.669] GetLastError () returned 0x0 [0082.669] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.669] GetLastError () returned 0x0 [0082.669] GetLastError () returned 0x0 [0082.672] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.672] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.673] ReadFile (in: hFile=0x11c, lpBuffer=0x293c0b0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesRead=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.675] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.675] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.676] ReadFile (in: hFile=0x11c, lpBuffer=0x293c0b0, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesRead=0x24cfdb0*=0x14c86, lpOverlapped=0x0) returned 1 [0082.676] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffeb37a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.676] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x14c86, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x14c86, lpOverlapped=0x0) returned 1 [0082.677] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.677] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.677] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.677] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.677] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.677] CloseHandle (hObject=0x11c) returned 1 [0082.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.[deadmin@cock.li].deadmin")) returned 1 [0082.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.679] GetLastError () returned 0x0 [0082.680] RtlWakeConditionVariable () returned 0x0 [0082.680] GetCurrentThreadId () returned 0x9ac [0082.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".ldf") returned 0x0 [0082.680] lstrlenW (lpString=".vhd") returned 4 [0082.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".vhd") returned 0x0 [0082.680] lstrlenW (lpString=".vhdx") returned 5 [0082.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".vhdx") returned 0x0 [0082.680] lstrlenW (lpString=".pst") returned 4 [0082.680] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".pst") returned 0x0 [0082.681] lstrlenW (lpString=".ost") returned 4 [0082.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".ost") returned 0x0 [0082.681] lstrlenW (lpString=".bak") returned 4 [0082.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".bak") returned 0x0 [0082.681] lstrlenW (lpString=".bac") returned 4 [0082.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".bac") returned 0x0 [0082.681] lstrlenW (lpString=".sys") returned 4 [0082.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".sys") returned 0x0 [0082.681] lstrlenW (lpString=".v2i") returned 4 [0082.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".v2i") returned 0x0 [0082.681] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.681] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0082.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.683] lstrlenW (lpString=".sql") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".sql") returned 0x0 [0082.683] lstrlenW (lpString=".mdf") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".mdf") returned 0x0 [0082.683] lstrlenW (lpString=".txt") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".txt") returned 0x0 [0082.683] lstrlenW (lpString=".dbf") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".dbf") returned 0x0 [0082.683] lstrlenW (lpString=".ckp") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".ckp") returned 0x0 [0082.683] lstrlenW (lpString=".dacpac") returned 7 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".dacpac") returned 0x0 [0082.683] lstrlenW (lpString=".db3") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".db3") returned 0x0 [0082.683] lstrlenW (lpString=".dtxs") returned 5 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".dtxs") returned 0x0 [0082.683] lstrlenW (lpString=".mdt") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".mdt") returned 0x0 [0082.683] lstrlenW (lpString=".sdf") returned 4 [0082.683] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".sdf") returned 0x0 [0082.683] lstrlenW (lpString=".MDF") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".MDF") returned 0x0 [0082.684] lstrlenW (lpString=".DBF") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".DBF") returned 0x0 [0082.684] lstrlenW (lpString=".DB") returned 3 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".DB") returned 0x0 [0082.684] lstrlenW (lpString=".db") returned 3 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".db") returned 0x0 [0082.684] lstrlenW (lpString=".ndf") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".ndf") returned 0x0 [0082.684] lstrlenW (lpString=".NDF") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".NDF") returned 0x0 [0082.684] lstrlenW (lpString=".Mdf") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".Mdf") returned 0x0 [0082.684] lstrlenW (lpString=".dat") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".dat") returned 0x0 [0082.684] lstrlenW (lpString=".DAT") returned 4 [0082.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", lpSrch=".DAT") returned=".DAT" [0082.684] lstrlenW (lpString=".DAT") returned 4 [0082.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0082.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.684] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d39b0) returned 1 [0082.685] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.685] CryptReleaseContext (hProv=0x2d39b0, dwFlags=0x0) returned 1 [0082.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0082.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0082.685] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20268645798) returned 1 [0082.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0192310, dwHighDateTime=0x1d585b4)) [0082.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0082.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0082.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0082.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339168 [0082.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339168 | out: hHeap=0x260000) returned 1 [0082.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320180 [0082.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.686] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.686] GetLastError () returned 0x0 [0082.686] GetLastError () returned 0x0 [0082.687] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.687] GetLastError () returned 0x0 [0082.687] GetLastError () returned 0x0 [0082.689] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff7a88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.689] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x8578, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x8578, lpOverlapped=0x0) returned 1 [0082.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0082.689] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.690] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.690] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.690] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.690] CloseHandle (hObject=0x11c) returned 1 [0082.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0082.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.[deadmin@cock.li].deadmin")) returned 1 [0082.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0082.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0082.692] GetLastError () returned 0x0 [0082.692] RtlWakeConditionVariable () returned 0x0 [0082.692] GetCurrentThreadId () returned 0x9ac [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".ldf") returned 0x0 [0082.692] lstrlenW (lpString=".vhd") returned 4 [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".vhd") returned 0x0 [0082.692] lstrlenW (lpString=".vhdx") returned 5 [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".vhdx") returned 0x0 [0082.692] lstrlenW (lpString=".pst") returned 4 [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".pst") returned 0x0 [0082.692] lstrlenW (lpString=".ost") returned 4 [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".ost") returned 0x0 [0082.692] lstrlenW (lpString=".bak") returned 4 [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".bak") returned 0x0 [0082.692] lstrlenW (lpString=".bac") returned 4 [0082.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".bac") returned 0x0 [0082.693] lstrlenW (lpString=".sys") returned 4 [0082.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".sys") returned 0x0 [0082.693] lstrlenW (lpString=".v2i") returned 4 [0082.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".v2i") returned 0x0 [0082.693] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch="s\r\n.v2i") returned 0x0 [0082.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.694] lstrlenW (lpString=".sql") returned 4 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".sql") returned 0x0 [0082.694] lstrlenW (lpString=".mdf") returned 4 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".mdf") returned 0x0 [0082.694] lstrlenW (lpString=".txt") returned 4 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".txt") returned 0x0 [0082.694] lstrlenW (lpString=".dbf") returned 4 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".dbf") returned 0x0 [0082.694] lstrlenW (lpString=".ckp") returned 4 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".ckp") returned 0x0 [0082.694] lstrlenW (lpString=".dacpac") returned 7 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".dacpac") returned 0x0 [0082.694] lstrlenW (lpString=".db3") returned 4 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".db3") returned 0x0 [0082.694] lstrlenW (lpString=".dtxs") returned 5 [0082.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".dtxs") returned 0x0 [0082.695] lstrlenW (lpString=".mdt") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".mdt") returned 0x0 [0082.695] lstrlenW (lpString=".sdf") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".sdf") returned 0x0 [0082.695] lstrlenW (lpString=".MDF") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".MDF") returned 0x0 [0082.695] lstrlenW (lpString=".DBF") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".DBF") returned 0x0 [0082.695] lstrlenW (lpString=".DB") returned 3 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".DB") returned 0x0 [0082.695] lstrlenW (lpString=".db") returned 3 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".db") returned 0x0 [0082.695] lstrlenW (lpString=".ndf") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".ndf") returned 0x0 [0082.695] lstrlenW (lpString=".NDF") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".NDF") returned 0x0 [0082.695] lstrlenW (lpString=".Mdf") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".Mdf") returned 0x0 [0082.695] lstrlenW (lpString=".dat") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".dat") returned 0x0 [0082.695] lstrlenW (lpString=".DAT") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".DAT") returned 0x0 [0082.695] lstrlenW (lpString=".ldf") returned 4 [0082.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".ldf") returned 0x0 [0082.695] lstrlenW (lpString=".LDF") returned 4 [0082.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch=".LDF") returned 0x0 [0082.696] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.705] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3570) returned 1 [0082.706] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.706] CryptReleaseContext (hProv=0x2d3570, dwFlags=0x0) returned 1 [0082.706] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.706] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20270739795) returned 1 [0082.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc01b8470, dwHighDateTime=0x1d585b4)) [0082.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3391d8 [0082.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3391d8 | out: hHeap=0x260000) returned 1 [0082.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.707] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764358 [0082.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.707] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.707] GetLastError () returned 0x0 [0082.707] GetLastError () returned 0x0 [0082.707] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.708] GetLastError () returned 0x0 [0082.708] GetLastError () returned 0x0 [0082.724] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.724] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.726] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.726] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.735] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.735] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.735] CloseHandle (hObject=0x11c) returned 1 [0082.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349160 [0082.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.[deadmin@cock.li].deadmin")) returned 1 [0082.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349160 | out: hHeap=0x260000) returned 1 [0082.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.737] GetLastError () returned 0x0 [0082.737] RtlWakeConditionVariable () returned 0x0 [0082.737] GetCurrentThreadId () returned 0x9ac [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".ldf") returned 0x0 [0082.738] lstrlenW (lpString=".vhd") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".vhd") returned 0x0 [0082.738] lstrlenW (lpString=".vhdx") returned 5 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".vhdx") returned 0x0 [0082.738] lstrlenW (lpString=".pst") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".pst") returned 0x0 [0082.738] lstrlenW (lpString=".ost") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".ost") returned 0x0 [0082.738] lstrlenW (lpString=".bak") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".bak") returned 0x0 [0082.738] lstrlenW (lpString=".bac") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".bac") returned 0x0 [0082.738] lstrlenW (lpString=".sys") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".sys") returned 0x0 [0082.738] lstrlenW (lpString=".v2i") returned 4 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".v2i") returned 0x0 [0082.738] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch="s\r\n.v2i") returned 0x0 [0082.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.740] lstrlenW (lpString=".sql") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".sql") returned 0x0 [0082.740] lstrlenW (lpString=".mdf") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".mdf") returned 0x0 [0082.740] lstrlenW (lpString=".txt") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".txt") returned 0x0 [0082.740] lstrlenW (lpString=".dbf") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".dbf") returned 0x0 [0082.740] lstrlenW (lpString=".ckp") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".ckp") returned 0x0 [0082.740] lstrlenW (lpString=".dacpac") returned 7 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".dacpac") returned 0x0 [0082.740] lstrlenW (lpString=".db3") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".db3") returned 0x0 [0082.740] lstrlenW (lpString=".dtxs") returned 5 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".dtxs") returned 0x0 [0082.740] lstrlenW (lpString=".mdt") returned 4 [0082.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".mdt") returned 0x0 [0082.741] lstrlenW (lpString=".sdf") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".sdf") returned 0x0 [0082.741] lstrlenW (lpString=".MDF") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".MDF") returned 0x0 [0082.741] lstrlenW (lpString=".DBF") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".DBF") returned 0x0 [0082.741] lstrlenW (lpString=".DB") returned 3 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".DB") returned 0x0 [0082.741] lstrlenW (lpString=".db") returned 3 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".db") returned 0x0 [0082.741] lstrlenW (lpString=".ndf") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".ndf") returned 0x0 [0082.741] lstrlenW (lpString=".NDF") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".NDF") returned 0x0 [0082.741] lstrlenW (lpString=".Mdf") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".Mdf") returned 0x0 [0082.741] lstrlenW (lpString=".dat") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".dat") returned 0x0 [0082.741] lstrlenW (lpString=".DAT") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".DAT") returned 0x0 [0082.741] lstrlenW (lpString=".ldf") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".ldf") returned 0x0 [0082.741] lstrlenW (lpString=".LDF") returned 4 [0082.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch=".LDF") returned 0x0 [0082.741] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.742] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3ac0) returned 1 [0082.743] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.743] CryptReleaseContext (hProv=0x2d3ac0, dwFlags=0x0) returned 1 [0082.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.743] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20274423458) returned 1 [0082.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc022a890, dwHighDateTime=0x1d585b4)) [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339210 [0082.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339210 | out: hHeap=0x260000) returned 1 [0082.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764488 [0082.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.744] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.744] GetLastError () returned 0x0 [0082.744] GetLastError () returned 0x0 [0082.744] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.744] GetLastError () returned 0x0 [0082.745] GetLastError () returned 0x0 [0082.759] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.759] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.761] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0082.761] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.761] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.774] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.774] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.774] CloseHandle (hObject=0x11c) returned 1 [0082.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34c3d0 [0082.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.[deadmin@cock.li].deadmin")) returned 1 [0082.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34c3d0 | out: hHeap=0x260000) returned 1 [0082.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0082.777] GetLastError () returned 0x0 [0082.777] RtlWakeConditionVariable () returned 0x27e828 [0082.777] GetCurrentThreadId () returned 0x9ac [0082.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".ldf") returned 0x0 [0082.777] lstrlenW (lpString=".vhd") returned 4 [0082.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".vhd") returned 0x0 [0082.777] lstrlenW (lpString=".vhdx") returned 5 [0082.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".vhdx") returned 0x0 [0082.777] lstrlenW (lpString=".pst") returned 4 [0082.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".pst") returned 0x0 [0082.777] lstrlenW (lpString=".ost") returned 4 [0082.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".ost") returned 0x0 [0082.777] lstrlenW (lpString=".bak") returned 4 [0082.777] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".bak") returned 0x0 [0082.777] lstrlenW (lpString=".bac") returned 4 [0082.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".bac") returned 0x0 [0082.778] lstrlenW (lpString=".sys") returned 4 [0082.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".sys") returned 0x0 [0082.778] lstrlenW (lpString=".v2i") returned 4 [0082.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".v2i") returned 0x0 [0082.778] lstrlenW (lpString="s\r\n.v2i") returned 7 [0082.778] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0082.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0082.779] lstrlenW (lpString=".sql") returned 4 [0082.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".sql") returned 0x0 [0082.779] lstrlenW (lpString=".mdf") returned 4 [0082.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".mdf") returned 0x0 [0082.779] lstrlenW (lpString=".txt") returned 4 [0082.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".txt") returned 0x0 [0082.780] lstrlenW (lpString=".dbf") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".dbf") returned 0x0 [0082.780] lstrlenW (lpString=".ckp") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".ckp") returned 0x0 [0082.780] lstrlenW (lpString=".dacpac") returned 7 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".dacpac") returned 0x0 [0082.780] lstrlenW (lpString=".db3") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".db3") returned 0x0 [0082.780] lstrlenW (lpString=".dtxs") returned 5 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".dtxs") returned 0x0 [0082.780] lstrlenW (lpString=".mdt") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".mdt") returned 0x0 [0082.780] lstrlenW (lpString=".sdf") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".sdf") returned 0x0 [0082.780] lstrlenW (lpString=".MDF") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".MDF") returned 0x0 [0082.780] lstrlenW (lpString=".DBF") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".DBF") returned 0x0 [0082.780] lstrlenW (lpString=".DB") returned 3 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".DB") returned 0x0 [0082.780] lstrlenW (lpString=".db") returned 3 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".db") returned 0x0 [0082.780] lstrlenW (lpString=".ndf") returned 4 [0082.780] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".ndf") returned 0x0 [0082.780] lstrlenW (lpString=".NDF") returned 4 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".NDF") returned 0x0 [0082.781] lstrlenW (lpString=".Mdf") returned 4 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".Mdf") returned 0x0 [0082.781] lstrlenW (lpString=".dat") returned 4 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".dat") returned 0x0 [0082.781] lstrlenW (lpString=".DAT") returned 4 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".DAT") returned 0x0 [0082.781] lstrlenW (lpString=".ldf") returned 4 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".ldf") returned 0x0 [0082.781] lstrlenW (lpString=".LDF") returned 4 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch=".LDF") returned 0x0 [0082.781] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0082.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0082.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0082.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0082.781] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3b48) returned 1 [0082.782] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0082.782] CryptReleaseContext (hProv=0x2d3b48, dwFlags=0x0) returned 1 [0082.782] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0082.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0082.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0082.782] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20278334279) returned 1 [0082.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0276b50, dwHighDateTime=0x1d585b4)) [0082.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0082.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0082.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0082.782] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3392b8 [0082.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0082.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3392b8 | out: hHeap=0x260000) returned 1 [0082.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0082.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0082.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0082.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0082.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x320348 [0082.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0082.783] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0082.783] GetLastError () returned 0x0 [0082.783] GetLastError () returned 0x0 [0082.783] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0082.784] GetLastError () returned 0x0 [0082.784] GetLastError () returned 0x0 [0082.866] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.866] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0082.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0082.897] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.897] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0082.983] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0082.983] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0082.984] CloseHandle (hObject=0x11c) returned 1 [0083.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0083.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.[deadmin@cock.li].deadmin")) returned 1 [0083.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0083.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.018] GetLastError () returned 0x0 [0083.018] RtlWakeConditionVariable () returned 0x0 [0083.018] GetCurrentThreadId () returned 0x9ac [0083.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".ldf") returned 0x0 [0083.018] lstrlenW (lpString=".vhd") returned 4 [0083.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".vhd") returned 0x0 [0083.018] lstrlenW (lpString=".vhdx") returned 5 [0083.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".vhdx") returned 0x0 [0083.018] lstrlenW (lpString=".pst") returned 4 [0083.018] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".pst") returned 0x0 [0083.018] lstrlenW (lpString=".ost") returned 4 [0083.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".ost") returned 0x0 [0083.019] lstrlenW (lpString=".bak") returned 4 [0083.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".bak") returned 0x0 [0083.019] lstrlenW (lpString=".bac") returned 4 [0083.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".bac") returned 0x0 [0083.019] lstrlenW (lpString=".sys") returned 4 [0083.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".sys") returned 0x0 [0083.019] lstrlenW (lpString=".v2i") returned 4 [0083.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".v2i") returned 0x0 [0083.019] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.314] lstrlenW (lpString=".sql") returned 4 [0083.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".sql") returned 0x0 [0083.314] lstrlenW (lpString=".mdf") returned 4 [0083.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".mdf") returned 0x0 [0083.314] lstrlenW (lpString=".txt") returned 4 [0083.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".txt") returned 0x0 [0083.314] lstrlenW (lpString=".dbf") returned 4 [0083.314] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".dbf") returned 0x0 [0083.314] lstrlenW (lpString=".ckp") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".ckp") returned 0x0 [0083.315] lstrlenW (lpString=".dacpac") returned 7 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".dacpac") returned 0x0 [0083.315] lstrlenW (lpString=".db3") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".db3") returned 0x0 [0083.315] lstrlenW (lpString=".dtxs") returned 5 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".dtxs") returned 0x0 [0083.315] lstrlenW (lpString=".mdt") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".mdt") returned 0x0 [0083.315] lstrlenW (lpString=".sdf") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".sdf") returned 0x0 [0083.315] lstrlenW (lpString=".MDF") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".MDF") returned 0x0 [0083.315] lstrlenW (lpString=".DBF") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".DBF") returned 0x0 [0083.315] lstrlenW (lpString=".DB") returned 3 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".DB") returned 0x0 [0083.315] lstrlenW (lpString=".db") returned 3 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".db") returned 0x0 [0083.315] lstrlenW (lpString=".ndf") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".ndf") returned 0x0 [0083.315] lstrlenW (lpString=".NDF") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".NDF") returned 0x0 [0083.315] lstrlenW (lpString=".Mdf") returned 4 [0083.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".Mdf") returned 0x0 [0083.316] lstrlenW (lpString=".dat") returned 4 [0083.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".dat") returned 0x0 [0083.316] lstrlenW (lpString=".DAT") returned 4 [0083.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".DAT") returned 0x0 [0083.316] lstrlenW (lpString=".ldf") returned 4 [0083.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".ldf") returned 0x0 [0083.316] lstrlenW (lpString=".LDF") returned 4 [0083.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch=".LDF") returned 0x0 [0083.316] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.316] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.316] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.316] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.317] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.317] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.317] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20331820958) returned 1 [0083.317] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0785a10, dwHighDateTime=0x1d585b4)) [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339868 [0083.317] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339868 | out: hHeap=0x260000) returned 1 [0083.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.318] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27652c8 [0083.318] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.318] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.318] GetLastError () returned 0x0 [0083.318] GetLastError () returned 0x0 [0083.318] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.319] GetLastError () returned 0x0 [0083.319] GetLastError () returned 0x0 [0083.321] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.321] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x152, lpOverlapped=0x0) returned 1 [0083.321] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0083.321] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.321] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.321] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.321] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.321] CloseHandle (hObject=0x11c) returned 1 [0083.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.324] GetLastError () returned 0x0 [0083.324] RtlWakeConditionVariable () returned 0x0 [0083.324] GetCurrentThreadId () returned 0x9ac [0083.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".ldf") returned 0x0 [0083.324] lstrlenW (lpString=".vhd") returned 4 [0083.324] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".vhd") returned 0x0 [0083.325] lstrlenW (lpString=".vhdx") returned 5 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".vhdx") returned 0x0 [0083.325] lstrlenW (lpString=".pst") returned 4 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".pst") returned 0x0 [0083.325] lstrlenW (lpString=".ost") returned 4 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".ost") returned 0x0 [0083.325] lstrlenW (lpString=".bak") returned 4 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".bak") returned 0x0 [0083.325] lstrlenW (lpString=".bac") returned 4 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".bac") returned 0x0 [0083.325] lstrlenW (lpString=".sys") returned 4 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".sys") returned 0x0 [0083.325] lstrlenW (lpString=".v2i") returned 4 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".v2i") returned 0x0 [0083.325] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.325] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.326] lstrlenW (lpString=".sql") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".sql") returned 0x0 [0083.327] lstrlenW (lpString=".mdf") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".mdf") returned 0x0 [0083.327] lstrlenW (lpString=".txt") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".txt") returned 0x0 [0083.327] lstrlenW (lpString=".dbf") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".dbf") returned 0x0 [0083.327] lstrlenW (lpString=".ckp") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".ckp") returned 0x0 [0083.327] lstrlenW (lpString=".dacpac") returned 7 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".dacpac") returned 0x0 [0083.327] lstrlenW (lpString=".db3") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".db3") returned 0x0 [0083.327] lstrlenW (lpString=".dtxs") returned 5 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".dtxs") returned 0x0 [0083.327] lstrlenW (lpString=".mdt") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".mdt") returned 0x0 [0083.327] lstrlenW (lpString=".sdf") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".sdf") returned 0x0 [0083.327] lstrlenW (lpString=".MDF") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".MDF") returned 0x0 [0083.327] lstrlenW (lpString=".DBF") returned 4 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".DBF") returned 0x0 [0083.327] lstrlenW (lpString=".DB") returned 3 [0083.327] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".DB") returned 0x0 [0083.328] lstrlenW (lpString=".db") returned 3 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".db") returned 0x0 [0083.328] lstrlenW (lpString=".ndf") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".ndf") returned 0x0 [0083.328] lstrlenW (lpString=".NDF") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".NDF") returned 0x0 [0083.328] lstrlenW (lpString=".Mdf") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".Mdf") returned 0x0 [0083.328] lstrlenW (lpString=".dat") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".dat") returned 0x0 [0083.328] lstrlenW (lpString=".DAT") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".DAT") returned 0x0 [0083.328] lstrlenW (lpString=".ldf") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".ldf") returned 0x0 [0083.328] lstrlenW (lpString=".LDF") returned 4 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch=".LDF") returned 0x0 [0083.328] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.328] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.328] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.329] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.329] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.329] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.329] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20333045090) returned 1 [0083.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc07abb70, dwHighDateTime=0x1d585b4)) [0083.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.329] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3398a0 [0083.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3398a0 | out: hHeap=0x260000) returned 1 [0083.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.330] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325638 [0083.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.330] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.330] GetLastError () returned 0x0 [0083.330] GetLastError () returned 0x0 [0083.330] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.331] GetLastError () returned 0x0 [0083.331] GetLastError () returned 0x0 [0083.332] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.332] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x346, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x346, lpOverlapped=0x0) returned 1 [0083.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0083.333] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.333] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.333] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.333] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.333] CloseHandle (hObject=0x11c) returned 1 [0083.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.334] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.335] GetLastError () returned 0x0 [0083.335] RtlWakeConditionVariable () returned 0x0 [0083.335] GetCurrentThreadId () returned 0x9ac [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".ldf") returned 0x0 [0083.335] lstrlenW (lpString=".vhd") returned 4 [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".vhd") returned 0x0 [0083.335] lstrlenW (lpString=".vhdx") returned 5 [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".vhdx") returned 0x0 [0083.335] lstrlenW (lpString=".pst") returned 4 [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".pst") returned 0x0 [0083.335] lstrlenW (lpString=".ost") returned 4 [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".ost") returned 0x0 [0083.335] lstrlenW (lpString=".bak") returned 4 [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".bak") returned 0x0 [0083.335] lstrlenW (lpString=".bac") returned 4 [0083.335] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".bac") returned 0x0 [0083.335] lstrlenW (lpString=".sys") returned 4 [0083.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".sys") returned 0x0 [0083.336] lstrlenW (lpString=".v2i") returned 4 [0083.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".v2i") returned 0x0 [0083.336] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.336] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.337] lstrlenW (lpString=".sql") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".sql") returned 0x0 [0083.337] lstrlenW (lpString=".mdf") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".mdf") returned 0x0 [0083.337] lstrlenW (lpString=".txt") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".txt") returned 0x0 [0083.337] lstrlenW (lpString=".dbf") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".dbf") returned 0x0 [0083.337] lstrlenW (lpString=".ckp") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".ckp") returned 0x0 [0083.337] lstrlenW (lpString=".dacpac") returned 7 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".dacpac") returned 0x0 [0083.337] lstrlenW (lpString=".db3") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".db3") returned 0x0 [0083.337] lstrlenW (lpString=".dtxs") returned 5 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".dtxs") returned 0x0 [0083.337] lstrlenW (lpString=".mdt") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".mdt") returned 0x0 [0083.337] lstrlenW (lpString=".sdf") returned 4 [0083.337] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".sdf") returned 0x0 [0083.337] lstrlenW (lpString=".MDF") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".MDF") returned 0x0 [0083.338] lstrlenW (lpString=".DBF") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".DBF") returned 0x0 [0083.338] lstrlenW (lpString=".DB") returned 3 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".DB") returned 0x0 [0083.338] lstrlenW (lpString=".db") returned 3 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".db") returned 0x0 [0083.338] lstrlenW (lpString=".ndf") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".ndf") returned 0x0 [0083.338] lstrlenW (lpString=".NDF") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".NDF") returned 0x0 [0083.338] lstrlenW (lpString=".Mdf") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".Mdf") returned 0x0 [0083.338] lstrlenW (lpString=".dat") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".dat") returned 0x0 [0083.338] lstrlenW (lpString=".DAT") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".DAT") returned 0x0 [0083.338] lstrlenW (lpString=".ldf") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".ldf") returned 0x0 [0083.338] lstrlenW (lpString=".LDF") returned 4 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch=".LDF") returned 0x0 [0083.338] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.338] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.339] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.339] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.339] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.339] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.339] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20334061827) returned 1 [0083.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc07d1cd0, dwHighDateTime=0x1d585b4)) [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x3398d8 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3398d8 | out: hHeap=0x260000) returned 1 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.340] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x325508 [0083.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.340] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.340] GetLastError () returned 0x0 [0083.341] GetLastError () returned 0x0 [0083.341] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.341] GetLastError () returned 0x0 [0083.341] GetLastError () returned 0x0 [0083.557] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.557] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.557] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0083.557] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.557] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.557] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.557] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.557] CloseHandle (hObject=0x11c) returned 1 [0083.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.596] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.596] GetLastError () returned 0x0 [0083.596] RtlWakeConditionVariable () returned 0x0 [0083.596] GetCurrentThreadId () returned 0x9ac [0083.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".ldf") returned 0x0 [0083.596] lstrlenW (lpString=".vhd") returned 4 [0083.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".vhd") returned 0x0 [0083.596] lstrlenW (lpString=".vhdx") returned 5 [0083.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".vhdx") returned 0x0 [0083.596] lstrlenW (lpString=".pst") returned 4 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".pst") returned 0x0 [0083.597] lstrlenW (lpString=".ost") returned 4 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".ost") returned 0x0 [0083.597] lstrlenW (lpString=".bak") returned 4 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".bak") returned 0x0 [0083.597] lstrlenW (lpString=".bac") returned 4 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".bac") returned 0x0 [0083.597] lstrlenW (lpString=".sys") returned 4 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".sys") returned 0x0 [0083.597] lstrlenW (lpString=".v2i") returned 4 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".v2i") returned 0x0 [0083.597] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.599] lstrlenW (lpString=".sql") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".sql") returned 0x0 [0083.599] lstrlenW (lpString=".mdf") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".mdf") returned 0x0 [0083.599] lstrlenW (lpString=".txt") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".txt") returned 0x0 [0083.599] lstrlenW (lpString=".dbf") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".dbf") returned 0x0 [0083.599] lstrlenW (lpString=".ckp") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".ckp") returned 0x0 [0083.599] lstrlenW (lpString=".dacpac") returned 7 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".dacpac") returned 0x0 [0083.599] lstrlenW (lpString=".db3") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".db3") returned 0x0 [0083.599] lstrlenW (lpString=".dtxs") returned 5 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".dtxs") returned 0x0 [0083.599] lstrlenW (lpString=".mdt") returned 4 [0083.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".mdt") returned 0x0 [0083.601] lstrlenW (lpString=".sdf") returned 4 [0083.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".sdf") returned 0x0 [0083.601] lstrlenW (lpString=".MDF") returned 4 [0083.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".MDF") returned 0x0 [0083.601] lstrlenW (lpString=".DBF") returned 4 [0083.601] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".DBF") returned 0x0 [0083.602] lstrlenW (lpString=".DB") returned 3 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".DB") returned 0x0 [0083.602] lstrlenW (lpString=".db") returned 3 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".db") returned 0x0 [0083.602] lstrlenW (lpString=".ndf") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".ndf") returned 0x0 [0083.602] lstrlenW (lpString=".NDF") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".NDF") returned 0x0 [0083.602] lstrlenW (lpString=".Mdf") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".Mdf") returned 0x0 [0083.602] lstrlenW (lpString=".dat") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".dat") returned 0x0 [0083.602] lstrlenW (lpString=".DAT") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".DAT") returned 0x0 [0083.602] lstrlenW (lpString=".ldf") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".ldf") returned 0x0 [0083.602] lstrlenW (lpString=".LDF") returned 4 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch=".LDF") returned 0x0 [0083.602] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.602] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.602] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.603] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.603] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.603] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20360455034) returned 1 [0083.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0a59430, dwHighDateTime=0x1d585b4)) [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339bb0 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339bb0 | out: hHeap=0x260000) returned 1 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.604] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751d78 [0083.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.604] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.604] GetLastError () returned 0x0 [0083.605] GetLastError () returned 0x0 [0083.605] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.605] GetLastError () returned 0x0 [0083.605] GetLastError () returned 0x0 [0083.606] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.606] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x267, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x267, lpOverlapped=0x0) returned 1 [0083.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.606] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.606] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.606] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.606] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.606] CloseHandle (hObject=0x11c) returned 1 [0083.607] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.608] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.608] GetLastError () returned 0x0 [0083.608] RtlWakeConditionVariable () returned 0x27e828 [0083.608] GetCurrentThreadId () returned 0x9ac [0083.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".ldf") returned 0x0 [0083.609] lstrlenW (lpString=".vhd") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".vhd") returned 0x0 [0083.609] lstrlenW (lpString=".vhdx") returned 5 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".vhdx") returned 0x0 [0083.609] lstrlenW (lpString=".pst") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".pst") returned 0x0 [0083.609] lstrlenW (lpString=".ost") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".ost") returned 0x0 [0083.609] lstrlenW (lpString=".bak") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".bak") returned 0x0 [0083.609] lstrlenW (lpString=".bac") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".bac") returned 0x0 [0083.609] lstrlenW (lpString=".sys") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".sys") returned 0x0 [0083.609] lstrlenW (lpString=".v2i") returned 4 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".v2i") returned 0x0 [0083.609] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0083.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.610] lstrlenW (lpString=".sql") returned 4 [0083.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".sql") returned 0x0 [0083.610] lstrlenW (lpString=".mdf") returned 4 [0083.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".mdf") returned 0x0 [0083.610] lstrlenW (lpString=".txt") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".txt") returned 0x0 [0083.611] lstrlenW (lpString=".dbf") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".dbf") returned 0x0 [0083.611] lstrlenW (lpString=".ckp") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".ckp") returned 0x0 [0083.611] lstrlenW (lpString=".dacpac") returned 7 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".dacpac") returned 0x0 [0083.611] lstrlenW (lpString=".db3") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".db3") returned 0x0 [0083.611] lstrlenW (lpString=".dtxs") returned 5 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".dtxs") returned 0x0 [0083.611] lstrlenW (lpString=".mdt") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".mdt") returned 0x0 [0083.611] lstrlenW (lpString=".sdf") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".sdf") returned 0x0 [0083.611] lstrlenW (lpString=".MDF") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".MDF") returned 0x0 [0083.611] lstrlenW (lpString=".DBF") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".DBF") returned 0x0 [0083.611] lstrlenW (lpString=".DB") returned 3 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".DB") returned 0x0 [0083.611] lstrlenW (lpString=".db") returned 3 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".db") returned 0x0 [0083.611] lstrlenW (lpString=".ndf") returned 4 [0083.611] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".ndf") returned 0x0 [0083.612] lstrlenW (lpString=".NDF") returned 4 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".NDF") returned 0x0 [0083.612] lstrlenW (lpString=".Mdf") returned 4 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".Mdf") returned 0x0 [0083.612] lstrlenW (lpString=".dat") returned 4 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".dat") returned 0x0 [0083.612] lstrlenW (lpString=".DAT") returned 4 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".DAT") returned 0x0 [0083.612] lstrlenW (lpString=".ldf") returned 4 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".ldf") returned 0x0 [0083.612] lstrlenW (lpString=".LDF") returned 4 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch=".LDF") returned 0x0 [0083.612] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.612] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.612] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.613] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.613] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.613] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20361425814) returned 1 [0083.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0a59430, dwHighDateTime=0x1d585b4)) [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762808 [0083.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762808 | out: hHeap=0x260000) returned 1 [0083.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2764948 [0083.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.614] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.614] GetLastError () returned 0x0 [0083.614] GetLastError () returned 0x0 [0083.614] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.614] GetLastError () returned 0x0 [0083.615] GetLastError () returned 0x0 [0083.615] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffda5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.615] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x25b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x25b, lpOverlapped=0x0) returned 1 [0083.616] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.616] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.616] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.616] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.616] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.616] CloseHandle (hObject=0x11c) returned 1 [0083.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d118 [0083.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.[deadmin@cock.li].deadmin")) returned 1 [0083.617] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d118 | out: hHeap=0x260000) returned 1 [0083.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.618] GetLastError () returned 0x0 [0083.618] RtlWakeConditionVariable () returned 0x27e828 [0083.618] GetCurrentThreadId () returned 0x9ac [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".ldf") returned 0x0 [0083.618] lstrlenW (lpString=".vhd") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".vhd") returned 0x0 [0083.618] lstrlenW (lpString=".vhdx") returned 5 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".vhdx") returned 0x0 [0083.618] lstrlenW (lpString=".pst") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".pst") returned 0x0 [0083.618] lstrlenW (lpString=".ost") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".ost") returned 0x0 [0083.618] lstrlenW (lpString=".bak") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".bak") returned 0x0 [0083.618] lstrlenW (lpString=".bac") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".bac") returned 0x0 [0083.618] lstrlenW (lpString=".sys") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".sys") returned 0x0 [0083.618] lstrlenW (lpString=".v2i") returned 4 [0083.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".v2i") returned 0x0 [0083.619] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.619] lstrlenW (lpString=".sql") returned 4 [0083.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".sql") returned 0x0 [0083.620] lstrlenW (lpString=".mdf") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".mdf") returned 0x0 [0083.620] lstrlenW (lpString=".txt") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".txt") returned 0x0 [0083.620] lstrlenW (lpString=".dbf") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".dbf") returned 0x0 [0083.620] lstrlenW (lpString=".ckp") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".ckp") returned 0x0 [0083.620] lstrlenW (lpString=".dacpac") returned 7 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".dacpac") returned 0x0 [0083.620] lstrlenW (lpString=".db3") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".db3") returned 0x0 [0083.620] lstrlenW (lpString=".dtxs") returned 5 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".dtxs") returned 0x0 [0083.620] lstrlenW (lpString=".mdt") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".mdt") returned 0x0 [0083.620] lstrlenW (lpString=".sdf") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".sdf") returned 0x0 [0083.620] lstrlenW (lpString=".MDF") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".MDF") returned 0x0 [0083.620] lstrlenW (lpString=".DBF") returned 4 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".DBF") returned 0x0 [0083.620] lstrlenW (lpString=".DB") returned 3 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".DB") returned 0x0 [0083.620] lstrlenW (lpString=".db") returned 3 [0083.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".db") returned 0x0 [0083.621] lstrlenW (lpString=".ndf") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".ndf") returned 0x0 [0083.621] lstrlenW (lpString=".NDF") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".NDF") returned 0x0 [0083.621] lstrlenW (lpString=".Mdf") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".Mdf") returned 0x0 [0083.621] lstrlenW (lpString=".dat") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".dat") returned 0x0 [0083.621] lstrlenW (lpString=".DAT") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".DAT") returned 0x0 [0083.621] lstrlenW (lpString=".ldf") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".ldf") returned 0x0 [0083.621] lstrlenW (lpString=".LDF") returned 4 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch=".LDF") returned 0x0 [0083.621] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.621] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.621] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.622] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.622] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.622] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.622] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.622] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20362456346) returned 1 [0083.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0a7f590, dwHighDateTime=0x1d585b4)) [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27627d0 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27627d0 | out: hHeap=0x260000) returned 1 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765a80 [0083.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.624] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.624] GetLastError () returned 0x0 [0083.624] GetLastError () returned 0x0 [0083.625] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.625] GetLastError () returned 0x0 [0083.625] GetLastError () returned 0x0 [0083.663] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.664] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.664] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.664] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.664] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.664] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.664] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.664] CloseHandle (hObject=0x11c) returned 1 [0083.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0083.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0083.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.666] GetLastError () returned 0x0 [0083.666] RtlWakeConditionVariable () returned 0x0 [0083.666] GetCurrentThreadId () returned 0x9ac [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".ldf") returned 0x0 [0083.666] lstrlenW (lpString=".vhd") returned 4 [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".vhd") returned 0x0 [0083.666] lstrlenW (lpString=".vhdx") returned 5 [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".vhdx") returned 0x0 [0083.666] lstrlenW (lpString=".pst") returned 4 [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".pst") returned 0x0 [0083.666] lstrlenW (lpString=".ost") returned 4 [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".ost") returned 0x0 [0083.666] lstrlenW (lpString=".bak") returned 4 [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".bak") returned 0x0 [0083.666] lstrlenW (lpString=".bac") returned 4 [0083.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".bac") returned 0x0 [0083.667] lstrlenW (lpString=".sys") returned 4 [0083.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".sys") returned 0x0 [0083.667] lstrlenW (lpString=".v2i") returned 4 [0083.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".v2i") returned 0x0 [0083.667] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.667] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.668] lstrlenW (lpString=".sql") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".sql") returned 0x0 [0083.668] lstrlenW (lpString=".mdf") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".mdf") returned 0x0 [0083.668] lstrlenW (lpString=".txt") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".txt") returned 0x0 [0083.668] lstrlenW (lpString=".dbf") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".dbf") returned 0x0 [0083.668] lstrlenW (lpString=".ckp") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".ckp") returned 0x0 [0083.668] lstrlenW (lpString=".dacpac") returned 7 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".dacpac") returned 0x0 [0083.668] lstrlenW (lpString=".db3") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".db3") returned 0x0 [0083.668] lstrlenW (lpString=".dtxs") returned 5 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".dtxs") returned 0x0 [0083.668] lstrlenW (lpString=".mdt") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".mdt") returned 0x0 [0083.668] lstrlenW (lpString=".sdf") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".sdf") returned 0x0 [0083.668] lstrlenW (lpString=".MDF") returned 4 [0083.668] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".MDF") returned 0x0 [0083.669] lstrlenW (lpString=".DBF") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".DBF") returned 0x0 [0083.669] lstrlenW (lpString=".DB") returned 3 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".DB") returned 0x0 [0083.669] lstrlenW (lpString=".db") returned 3 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".db") returned 0x0 [0083.669] lstrlenW (lpString=".ndf") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".ndf") returned 0x0 [0083.669] lstrlenW (lpString=".NDF") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".NDF") returned 0x0 [0083.669] lstrlenW (lpString=".Mdf") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".Mdf") returned 0x0 [0083.669] lstrlenW (lpString=".dat") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".dat") returned 0x0 [0083.669] lstrlenW (lpString=".DAT") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".DAT") returned 0x0 [0083.669] lstrlenW (lpString=".ldf") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".ldf") returned 0x0 [0083.669] lstrlenW (lpString=".LDF") returned 4 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch=".LDF") returned 0x0 [0083.669] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.669] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.670] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.670] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.670] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.670] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.670] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.670] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20367161928) returned 1 [0083.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0af19b0, dwHighDateTime=0x1d585b4)) [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27626b8 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27626b8 | out: hHeap=0x260000) returned 1 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.671] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27659e8 [0083.671] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.671] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.671] GetLastError () returned 0x0 [0083.672] GetLastError () returned 0x0 [0083.672] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.672] GetLastError () returned 0x0 [0083.672] GetLastError () returned 0x0 [0083.673] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.673] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0083.674] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0083.674] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.674] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0083.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0083.674] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0083.674] CloseHandle (hObject=0x11c) returned 1 [0083.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0083.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.[deadmin@cock.li].deadmin")) returned 1 [0083.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0083.675] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0083.675] GetLastError () returned 0x0 [0083.675] RtlWakeConditionVariable () returned 0x0 [0083.676] GetCurrentThreadId () returned 0x9ac [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".ldf") returned 0x0 [0083.676] lstrlenW (lpString=".vhd") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".vhd") returned 0x0 [0083.676] lstrlenW (lpString=".vhdx") returned 5 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".vhdx") returned 0x0 [0083.676] lstrlenW (lpString=".pst") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".pst") returned 0x0 [0083.676] lstrlenW (lpString=".ost") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".ost") returned 0x0 [0083.676] lstrlenW (lpString=".bak") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".bak") returned 0x0 [0083.676] lstrlenW (lpString=".bac") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".bac") returned 0x0 [0083.676] lstrlenW (lpString=".sys") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".sys") returned 0x0 [0083.676] lstrlenW (lpString=".v2i") returned 4 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".v2i") returned 0x0 [0083.676] lstrlenW (lpString="s\r\n.v2i") returned 7 [0083.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0083.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0083.677] lstrlenW (lpString=".sql") returned 4 [0083.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".sql") returned 0x0 [0083.677] lstrlenW (lpString=".mdf") returned 4 [0083.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".mdf") returned 0x0 [0083.677] lstrlenW (lpString=".txt") returned 4 [0083.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".txt") returned 0x0 [0083.677] lstrlenW (lpString=".dbf") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".dbf") returned 0x0 [0083.678] lstrlenW (lpString=".ckp") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".ckp") returned 0x0 [0083.678] lstrlenW (lpString=".dacpac") returned 7 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".dacpac") returned 0x0 [0083.678] lstrlenW (lpString=".db3") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".db3") returned 0x0 [0083.678] lstrlenW (lpString=".dtxs") returned 5 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".dtxs") returned 0x0 [0083.678] lstrlenW (lpString=".mdt") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".mdt") returned 0x0 [0083.678] lstrlenW (lpString=".sdf") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".sdf") returned 0x0 [0083.678] lstrlenW (lpString=".MDF") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".MDF") returned 0x0 [0083.678] lstrlenW (lpString=".DBF") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".DBF") returned 0x0 [0083.678] lstrlenW (lpString=".DB") returned 3 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".DB") returned 0x0 [0083.678] lstrlenW (lpString=".db") returned 3 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".db") returned 0x0 [0083.678] lstrlenW (lpString=".ndf") returned 4 [0083.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".ndf") returned 0x0 [0083.679] lstrlenW (lpString=".NDF") returned 4 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".NDF") returned 0x0 [0083.679] lstrlenW (lpString=".Mdf") returned 4 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".Mdf") returned 0x0 [0083.679] lstrlenW (lpString=".dat") returned 4 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".dat") returned 0x0 [0083.679] lstrlenW (lpString=".DAT") returned 4 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".DAT") returned 0x0 [0083.679] lstrlenW (lpString=".ldf") returned 4 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".ldf") returned 0x0 [0083.679] lstrlenW (lpString=".LDF") returned 4 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch=".LDF") returned 0x0 [0083.679] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0083.679] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0083.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0083.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0083.679] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0083.680] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0083.680] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0083.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0083.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0083.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0083.680] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20368133453) returned 1 [0083.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0b17b10, dwHighDateTime=0x1d585b4)) [0083.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0083.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0083.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0083.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762680 [0083.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0083.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762680 | out: hHeap=0x260000) returned 1 [0083.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0083.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0083.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0083.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0083.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27656f0 [0083.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0083.681] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0083.681] GetLastError () returned 0x0 [0083.681] GetLastError () returned 0x0 [0083.681] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0083.681] GetLastError () returned 0x0 [0083.682] GetLastError () returned 0x0 [0084.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.028] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.028] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.028] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.028] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.028] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.028] CloseHandle (hObject=0x11c) returned 1 [0084.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.030] GetLastError () returned 0x0 [0084.030] RtlWakeConditionVariable () returned 0x0 [0084.030] GetCurrentThreadId () returned 0x9ac [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".ldf") returned 0x0 [0084.030] lstrlenW (lpString=".vhd") returned 4 [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".vhd") returned 0x0 [0084.030] lstrlenW (lpString=".vhdx") returned 5 [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".vhdx") returned 0x0 [0084.030] lstrlenW (lpString=".pst") returned 4 [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".pst") returned 0x0 [0084.030] lstrlenW (lpString=".ost") returned 4 [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".ost") returned 0x0 [0084.030] lstrlenW (lpString=".bak") returned 4 [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".bak") returned 0x0 [0084.030] lstrlenW (lpString=".bac") returned 4 [0084.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".bac") returned 0x0 [0084.030] lstrlenW (lpString=".sys") returned 4 [0084.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".sys") returned 0x0 [0084.031] lstrlenW (lpString=".v2i") returned 4 [0084.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".v2i") returned 0x0 [0084.031] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.032] lstrlenW (lpString=".sql") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".sql") returned 0x0 [0084.032] lstrlenW (lpString=".mdf") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".mdf") returned 0x0 [0084.032] lstrlenW (lpString=".txt") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".txt") returned 0x0 [0084.032] lstrlenW (lpString=".dbf") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".dbf") returned 0x0 [0084.032] lstrlenW (lpString=".ckp") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".ckp") returned 0x0 [0084.032] lstrlenW (lpString=".dacpac") returned 7 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".dacpac") returned 0x0 [0084.032] lstrlenW (lpString=".db3") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".db3") returned 0x0 [0084.032] lstrlenW (lpString=".dtxs") returned 5 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".dtxs") returned 0x0 [0084.032] lstrlenW (lpString=".mdt") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".mdt") returned 0x0 [0084.032] lstrlenW (lpString=".sdf") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".sdf") returned 0x0 [0084.032] lstrlenW (lpString=".MDF") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".MDF") returned 0x0 [0084.032] lstrlenW (lpString=".DBF") returned 4 [0084.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".DBF") returned 0x0 [0084.032] lstrlenW (lpString=".DB") returned 3 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".DB") returned 0x0 [0084.033] lstrlenW (lpString=".db") returned 3 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".db") returned 0x0 [0084.033] lstrlenW (lpString=".ndf") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".ndf") returned 0x0 [0084.033] lstrlenW (lpString=".NDF") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".NDF") returned 0x0 [0084.033] lstrlenW (lpString=".Mdf") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".Mdf") returned 0x0 [0084.033] lstrlenW (lpString=".dat") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".dat") returned 0x0 [0084.033] lstrlenW (lpString=".DAT") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".DAT") returned 0x0 [0084.033] lstrlenW (lpString=".ldf") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".ldf") returned 0x0 [0084.033] lstrlenW (lpString=".LDF") returned 4 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch=".LDF") returned 0x0 [0084.033] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.033] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.034] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.034] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20403552015) returned 1 [0084.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0e5d950, dwHighDateTime=0x1d585b4)) [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27625a0 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27625a0 | out: hHeap=0x260000) returned 1 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750a78 [0084.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.035] GetLastError () returned 0x0 [0084.035] GetLastError () returned 0x0 [0084.036] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.036] GetLastError () returned 0x0 [0084.036] GetLastError () returned 0x0 [0084.046] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffcd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.046] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x328, lpOverlapped=0x0) returned 1 [0084.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.047] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.047] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.047] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.047] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.047] CloseHandle (hObject=0x11c) returned 1 [0084.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.048] GetLastError () returned 0x0 [0084.049] RtlWakeConditionVariable () returned 0x0 [0084.049] GetCurrentThreadId () returned 0x9ac [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".ldf") returned 0x0 [0084.049] lstrlenW (lpString=".vhd") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".vhd") returned 0x0 [0084.049] lstrlenW (lpString=".vhdx") returned 5 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".vhdx") returned 0x0 [0084.049] lstrlenW (lpString=".pst") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".pst") returned 0x0 [0084.049] lstrlenW (lpString=".ost") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".ost") returned 0x0 [0084.049] lstrlenW (lpString=".bak") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".bak") returned 0x0 [0084.049] lstrlenW (lpString=".bac") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".bac") returned 0x0 [0084.049] lstrlenW (lpString=".sys") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".sys") returned 0x0 [0084.049] lstrlenW (lpString=".v2i") returned 4 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".v2i") returned 0x0 [0084.049] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.050] lstrlenW (lpString=".sql") returned 4 [0084.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".sql") returned 0x0 [0084.050] lstrlenW (lpString=".mdf") returned 4 [0084.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".mdf") returned 0x0 [0084.050] lstrlenW (lpString=".txt") returned 4 [0084.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".txt") returned 0x0 [0084.050] lstrlenW (lpString=".dbf") returned 4 [0084.050] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".dbf") returned 0x0 [0084.051] lstrlenW (lpString=".ckp") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".ckp") returned 0x0 [0084.051] lstrlenW (lpString=".dacpac") returned 7 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".dacpac") returned 0x0 [0084.051] lstrlenW (lpString=".db3") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".db3") returned 0x0 [0084.051] lstrlenW (lpString=".dtxs") returned 5 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".dtxs") returned 0x0 [0084.051] lstrlenW (lpString=".mdt") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".mdt") returned 0x0 [0084.051] lstrlenW (lpString=".sdf") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".sdf") returned 0x0 [0084.051] lstrlenW (lpString=".MDF") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".MDF") returned 0x0 [0084.051] lstrlenW (lpString=".DBF") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".DBF") returned 0x0 [0084.051] lstrlenW (lpString=".DB") returned 3 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".DB") returned 0x0 [0084.051] lstrlenW (lpString=".db") returned 3 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".db") returned 0x0 [0084.051] lstrlenW (lpString=".ndf") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".ndf") returned 0x0 [0084.051] lstrlenW (lpString=".NDF") returned 4 [0084.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".NDF") returned 0x0 [0084.051] lstrlenW (lpString=".Mdf") returned 4 [0084.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".Mdf") returned 0x0 [0084.052] lstrlenW (lpString=".dat") returned 4 [0084.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".dat") returned 0x0 [0084.052] lstrlenW (lpString=".DAT") returned 4 [0084.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".DAT") returned 0x0 [0084.052] lstrlenW (lpString=".ldf") returned 4 [0084.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".ldf") returned 0x0 [0084.052] lstrlenW (lpString=".LDF") returned 4 [0084.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch=".LDF") returned 0x0 [0084.052] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.052] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.053] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.063] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.063] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.063] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20406434975) returned 1 [0084.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc0ea9c10, dwHighDateTime=0x1d585b4)) [0084.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339c58 [0084.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339c58 | out: hHeap=0x260000) returned 1 [0084.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.073] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.073] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27519e8 [0084.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.088] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.088] GetLastError () returned 0x0 [0084.088] GetLastError () returned 0x0 [0084.088] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.088] GetLastError () returned 0x0 [0084.088] GetLastError () returned 0x0 [0084.185] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.186] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.186] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.186] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.187] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.187] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.187] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.187] CloseHandle (hObject=0x11c) returned 1 [0084.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d1e0 [0084.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d1e0 | out: hHeap=0x260000) returned 1 [0084.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.233] GetLastError () returned 0x0 [0084.233] RtlWakeConditionVariable () returned 0x27e828 [0084.233] GetCurrentThreadId () returned 0x9ac [0084.233] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".ldf") returned 0x0 [0084.234] lstrlenW (lpString=".vhd") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".vhd") returned 0x0 [0084.234] lstrlenW (lpString=".vhdx") returned 5 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".vhdx") returned 0x0 [0084.234] lstrlenW (lpString=".pst") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".pst") returned 0x0 [0084.234] lstrlenW (lpString=".ost") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".ost") returned 0x0 [0084.234] lstrlenW (lpString=".bak") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".bak") returned 0x0 [0084.234] lstrlenW (lpString=".bac") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".bac") returned 0x0 [0084.234] lstrlenW (lpString=".sys") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".sys") returned 0x0 [0084.234] lstrlenW (lpString=".v2i") returned 4 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".v2i") returned 0x0 [0084.234] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.234] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.236] lstrlenW (lpString=".sql") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".sql") returned 0x0 [0084.236] lstrlenW (lpString=".mdf") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".mdf") returned 0x0 [0084.236] lstrlenW (lpString=".txt") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".txt") returned 0x0 [0084.236] lstrlenW (lpString=".dbf") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".dbf") returned 0x0 [0084.236] lstrlenW (lpString=".ckp") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".ckp") returned 0x0 [0084.236] lstrlenW (lpString=".dacpac") returned 7 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".dacpac") returned 0x0 [0084.236] lstrlenW (lpString=".db3") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".db3") returned 0x0 [0084.236] lstrlenW (lpString=".dtxs") returned 5 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".dtxs") returned 0x0 [0084.236] lstrlenW (lpString=".mdt") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".mdt") returned 0x0 [0084.236] lstrlenW (lpString=".sdf") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".sdf") returned 0x0 [0084.236] lstrlenW (lpString=".MDF") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".MDF") returned 0x0 [0084.236] lstrlenW (lpString=".DBF") returned 4 [0084.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".DBF") returned 0x0 [0084.237] lstrlenW (lpString=".DB") returned 3 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".DB") returned 0x0 [0084.237] lstrlenW (lpString=".db") returned 3 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".db") returned 0x0 [0084.237] lstrlenW (lpString=".ndf") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".ndf") returned 0x0 [0084.237] lstrlenW (lpString=".NDF") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".NDF") returned 0x0 [0084.237] lstrlenW (lpString=".Mdf") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".Mdf") returned 0x0 [0084.237] lstrlenW (lpString=".dat") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".dat") returned 0x0 [0084.237] lstrlenW (lpString=".DAT") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".DAT") returned 0x0 [0084.237] lstrlenW (lpString=".ldf") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".ldf") returned 0x0 [0084.237] lstrlenW (lpString=".LDF") returned 4 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch=".LDF") returned 0x0 [0084.237] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.237] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.238] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.238] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.238] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20423954188) returned 1 [0084.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc104cb30, dwHighDateTime=0x1d585b4)) [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339e18 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339e18 | out: hHeap=0x260000) returned 1 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751a80 [0084.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.239] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.239] GetLastError () returned 0x0 [0084.239] GetLastError () returned 0x0 [0084.240] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.240] GetLastError () returned 0x0 [0084.240] GetLastError () returned 0x0 [0084.257] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.258] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.258] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.258] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.258] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.258] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.258] CloseHandle (hObject=0x11c) returned 1 [0084.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.288] GetLastError () returned 0x0 [0084.288] RtlWakeConditionVariable () returned 0x27e828 [0084.288] GetCurrentThreadId () returned 0x9ac [0084.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".ldf") returned 0x0 [0084.289] lstrlenW (lpString=".vhd") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".vhd") returned 0x0 [0084.289] lstrlenW (lpString=".vhdx") returned 5 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".vhdx") returned 0x0 [0084.289] lstrlenW (lpString=".pst") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".pst") returned 0x0 [0084.289] lstrlenW (lpString=".ost") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".ost") returned 0x0 [0084.289] lstrlenW (lpString=".bak") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".bak") returned 0x0 [0084.289] lstrlenW (lpString=".bac") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".bac") returned 0x0 [0084.289] lstrlenW (lpString=".sys") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".sys") returned 0x0 [0084.289] lstrlenW (lpString=".v2i") returned 4 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".v2i") returned 0x0 [0084.289] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.289] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.290] lstrlenW (lpString=".sql") returned 4 [0084.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".sql") returned 0x0 [0084.290] lstrlenW (lpString=".mdf") returned 4 [0084.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".mdf") returned 0x0 [0084.290] lstrlenW (lpString=".txt") returned 4 [0084.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".txt") returned 0x0 [0084.290] lstrlenW (lpString=".dbf") returned 4 [0084.290] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".dbf") returned 0x0 [0084.290] lstrlenW (lpString=".ckp") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".ckp") returned 0x0 [0084.291] lstrlenW (lpString=".dacpac") returned 7 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".dacpac") returned 0x0 [0084.291] lstrlenW (lpString=".db3") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".db3") returned 0x0 [0084.291] lstrlenW (lpString=".dtxs") returned 5 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".dtxs") returned 0x0 [0084.291] lstrlenW (lpString=".mdt") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".mdt") returned 0x0 [0084.291] lstrlenW (lpString=".sdf") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".sdf") returned 0x0 [0084.291] lstrlenW (lpString=".MDF") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".MDF") returned 0x0 [0084.291] lstrlenW (lpString=".DBF") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".DBF") returned 0x0 [0084.291] lstrlenW (lpString=".DB") returned 3 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".DB") returned 0x0 [0084.291] lstrlenW (lpString=".db") returned 3 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".db") returned 0x0 [0084.291] lstrlenW (lpString=".ndf") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".ndf") returned 0x0 [0084.291] lstrlenW (lpString=".NDF") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".NDF") returned 0x0 [0084.291] lstrlenW (lpString=".Mdf") returned 4 [0084.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".Mdf") returned 0x0 [0084.291] lstrlenW (lpString=".dat") returned 4 [0084.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".dat") returned 0x0 [0084.292] lstrlenW (lpString=".DAT") returned 4 [0084.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".DAT") returned 0x0 [0084.292] lstrlenW (lpString=".ldf") returned 4 [0084.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".ldf") returned 0x0 [0084.292] lstrlenW (lpString=".LDF") returned 4 [0084.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch=".LDF") returned 0x0 [0084.292] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.292] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0084.292] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3ce0) returned 1 [0084.293] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0084.293] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.293] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20429410891) returned 1 [0084.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc10e50b0, dwHighDateTime=0x1d585b4)) [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339f30 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339f30 | out: hHeap=0x260000) returned 1 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751490 [0084.294] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.294] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.294] GetLastError () returned 0x0 [0084.294] GetLastError () returned 0x0 [0084.294] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.294] GetLastError () returned 0x0 [0084.294] GetLastError () returned 0x0 [0084.297] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.297] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.298] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.298] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.298] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.298] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.298] CloseHandle (hObject=0x11c) returned 1 [0084.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.300] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.300] GetLastError () returned 0x0 [0084.300] RtlWakeConditionVariable () returned 0x0 [0084.300] GetCurrentThreadId () returned 0x9ac [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".ldf") returned 0x0 [0084.300] lstrlenW (lpString=".vhd") returned 4 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".vhd") returned 0x0 [0084.300] lstrlenW (lpString=".vhdx") returned 5 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".vhdx") returned 0x0 [0084.300] lstrlenW (lpString=".pst") returned 4 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".pst") returned 0x0 [0084.300] lstrlenW (lpString=".ost") returned 4 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".ost") returned 0x0 [0084.300] lstrlenW (lpString=".bak") returned 4 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".bak") returned 0x0 [0084.300] lstrlenW (lpString=".bac") returned 4 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".bac") returned 0x0 [0084.300] lstrlenW (lpString=".sys") returned 4 [0084.300] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".sys") returned 0x0 [0084.301] lstrlenW (lpString=".v2i") returned 4 [0084.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".v2i") returned 0x0 [0084.301] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0084.303] lstrlenW (lpString=".sql") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".sql") returned 0x0 [0084.303] lstrlenW (lpString=".mdf") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".mdf") returned 0x0 [0084.303] lstrlenW (lpString=".txt") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".txt") returned 0x0 [0084.303] lstrlenW (lpString=".dbf") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".dbf") returned 0x0 [0084.303] lstrlenW (lpString=".ckp") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".ckp") returned 0x0 [0084.303] lstrlenW (lpString=".dacpac") returned 7 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".dacpac") returned 0x0 [0084.303] lstrlenW (lpString=".db3") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".db3") returned 0x0 [0084.303] lstrlenW (lpString=".dtxs") returned 5 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".dtxs") returned 0x0 [0084.303] lstrlenW (lpString=".mdt") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".mdt") returned 0x0 [0084.303] lstrlenW (lpString=".sdf") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".sdf") returned 0x0 [0084.303] lstrlenW (lpString=".MDF") returned 4 [0084.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".MDF") returned 0x0 [0084.304] lstrlenW (lpString=".DBF") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".DBF") returned 0x0 [0084.304] lstrlenW (lpString=".DB") returned 3 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".DB") returned 0x0 [0084.304] lstrlenW (lpString=".db") returned 3 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".db") returned 0x0 [0084.304] lstrlenW (lpString=".ndf") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".ndf") returned 0x0 [0084.304] lstrlenW (lpString=".NDF") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".NDF") returned 0x0 [0084.304] lstrlenW (lpString=".Mdf") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".Mdf") returned 0x0 [0084.304] lstrlenW (lpString=".dat") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".dat") returned 0x0 [0084.304] lstrlenW (lpString=".DAT") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".DAT") returned 0x0 [0084.304] lstrlenW (lpString=".ldf") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".ldf") returned 0x0 [0084.304] lstrlenW (lpString=".LDF") returned 4 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch=".LDF") returned 0x0 [0084.304] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.304] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0084.304] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3ce0) returned 1 [0084.305] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0084.305] CryptReleaseContext (hProv=0x2d3ce0, dwFlags=0x0) returned 1 [0084.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0084.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.306] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20430665224) returned 1 [0084.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc110b210, dwHighDateTime=0x1d585b4)) [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x339f68 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x339f68 | out: hHeap=0x260000) returned 1 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751198 [0084.306] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.306] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.307] GetLastError () returned 0x0 [0084.307] GetLastError () returned 0x0 [0084.307] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.307] GetLastError () returned 0x0 [0084.307] GetLastError () returned 0x0 [0084.382] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.382] WriteFile (in: hFile=0x11c, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.382] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.382] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.382] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.383] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.383] CloseHandle (hObject=0x11c) returned 1 [0084.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.484] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.485] GetLastError () returned 0x0 [0084.485] RtlWakeConditionVariable () returned 0x0 [0084.485] GetCurrentThreadId () returned 0x9ac [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".ldf") returned 0x0 [0084.485] lstrlenW (lpString=".vhd") returned 4 [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".vhd") returned 0x0 [0084.485] lstrlenW (lpString=".vhdx") returned 5 [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".vhdx") returned 0x0 [0084.485] lstrlenW (lpString=".pst") returned 4 [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".pst") returned 0x0 [0084.485] lstrlenW (lpString=".ost") returned 4 [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".ost") returned 0x0 [0084.485] lstrlenW (lpString=".bak") returned 4 [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".bak") returned 0x0 [0084.485] lstrlenW (lpString=".bac") returned 4 [0084.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".bac") returned 0x0 [0084.485] lstrlenW (lpString=".sys") returned 4 [0084.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".sys") returned 0x0 [0084.486] lstrlenW (lpString=".v2i") returned 4 [0084.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".v2i") returned 0x0 [0084.486] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.486] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.487] lstrlenW (lpString=".sql") returned 4 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".sql") returned 0x0 [0084.487] lstrlenW (lpString=".mdf") returned 4 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".mdf") returned 0x0 [0084.487] lstrlenW (lpString=".txt") returned 4 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".txt") returned 0x0 [0084.487] lstrlenW (lpString=".dbf") returned 4 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".dbf") returned 0x0 [0084.487] lstrlenW (lpString=".ckp") returned 4 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".ckp") returned 0x0 [0084.487] lstrlenW (lpString=".dacpac") returned 7 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".dacpac") returned 0x0 [0084.487] lstrlenW (lpString=".db3") returned 4 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".db3") returned 0x0 [0084.487] lstrlenW (lpString=".dtxs") returned 5 [0084.487] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".dtxs") returned 0x0 [0084.488] lstrlenW (lpString=".mdt") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".mdt") returned 0x0 [0084.488] lstrlenW (lpString=".sdf") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".sdf") returned 0x0 [0084.488] lstrlenW (lpString=".MDF") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".MDF") returned 0x0 [0084.488] lstrlenW (lpString=".DBF") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".DBF") returned 0x0 [0084.488] lstrlenW (lpString=".DB") returned 3 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".DB") returned 0x0 [0084.488] lstrlenW (lpString=".db") returned 3 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".db") returned 0x0 [0084.488] lstrlenW (lpString=".ndf") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".ndf") returned 0x0 [0084.488] lstrlenW (lpString=".NDF") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".NDF") returned 0x0 [0084.488] lstrlenW (lpString=".Mdf") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".Mdf") returned 0x0 [0084.488] lstrlenW (lpString=".dat") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".dat") returned 0x0 [0084.488] lstrlenW (lpString=".DAT") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".DAT") returned 0x0 [0084.488] lstrlenW (lpString=".ldf") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".ldf") returned 0x0 [0084.488] lstrlenW (lpString=".LDF") returned 4 [0084.488] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch=".LDF") returned 0x0 [0084.489] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.489] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.489] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.489] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.489] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.490] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20449103491) returned 1 [0084.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc12d4290, dwHighDateTime=0x1d585b4)) [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33a240 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a240 | out: hHeap=0x260000) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2751100 [0084.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.491] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.491] GetLastError () returned 0x0 [0084.491] GetLastError () returned 0x0 [0084.491] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.491] GetLastError () returned 0x0 [0084.491] GetLastError () returned 0x0 [0084.493] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcb8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.493] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x348, lpOverlapped=0x0) returned 1 [0084.493] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.493] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.493] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.493] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.494] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.494] CloseHandle (hObject=0xe4) returned 1 [0084.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.495] GetLastError () returned 0x0 [0084.496] RtlWakeConditionVariable () returned 0x0 [0084.496] GetCurrentThreadId () returned 0x9ac [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".ldf") returned 0x0 [0084.496] lstrlenW (lpString=".vhd") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".vhd") returned 0x0 [0084.496] lstrlenW (lpString=".vhdx") returned 5 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".vhdx") returned 0x0 [0084.496] lstrlenW (lpString=".pst") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".pst") returned 0x0 [0084.496] lstrlenW (lpString=".ost") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".ost") returned 0x0 [0084.496] lstrlenW (lpString=".bak") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".bak") returned 0x0 [0084.496] lstrlenW (lpString=".bac") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".bac") returned 0x0 [0084.496] lstrlenW (lpString=".sys") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".sys") returned 0x0 [0084.496] lstrlenW (lpString=".v2i") returned 4 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".v2i") returned 0x0 [0084.496] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.498] lstrlenW (lpString=".sql") returned 4 [0084.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".sql") returned 0x0 [0084.498] lstrlenW (lpString=".mdf") returned 4 [0084.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".mdf") returned 0x0 [0084.499] lstrlenW (lpString=".txt") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".txt") returned 0x0 [0084.499] lstrlenW (lpString=".dbf") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".dbf") returned 0x0 [0084.499] lstrlenW (lpString=".ckp") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".ckp") returned 0x0 [0084.499] lstrlenW (lpString=".dacpac") returned 7 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".dacpac") returned 0x0 [0084.499] lstrlenW (lpString=".db3") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".db3") returned 0x0 [0084.499] lstrlenW (lpString=".dtxs") returned 5 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".dtxs") returned 0x0 [0084.499] lstrlenW (lpString=".mdt") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".mdt") returned 0x0 [0084.499] lstrlenW (lpString=".sdf") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".sdf") returned 0x0 [0084.499] lstrlenW (lpString=".MDF") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".MDF") returned 0x0 [0084.499] lstrlenW (lpString=".DBF") returned 4 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".DBF") returned 0x0 [0084.499] lstrlenW (lpString=".DB") returned 3 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".DB") returned 0x0 [0084.499] lstrlenW (lpString=".db") returned 3 [0084.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".db") returned 0x0 [0084.499] lstrlenW (lpString=".ndf") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".ndf") returned 0x0 [0084.500] lstrlenW (lpString=".NDF") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".NDF") returned 0x0 [0084.500] lstrlenW (lpString=".Mdf") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".Mdf") returned 0x0 [0084.500] lstrlenW (lpString=".dat") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".dat") returned 0x0 [0084.500] lstrlenW (lpString=".DAT") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".DAT") returned 0x0 [0084.500] lstrlenW (lpString=".ldf") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".ldf") returned 0x0 [0084.500] lstrlenW (lpString=".LDF") returned 4 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch=".LDF") returned 0x0 [0084.500] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.500] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.501] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.501] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.501] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20450236257) returned 1 [0084.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc12d4290, dwHighDateTime=0x1d585b4)) [0084.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x290f0a8 [0084.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x290f0a8 | out: hHeap=0x260000) returned 1 [0084.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750818 [0084.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.502] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.502] GetLastError () returned 0x0 [0084.502] GetLastError () returned 0x0 [0084.503] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.503] GetLastError () returned 0x0 [0084.503] GetLastError () returned 0x0 [0084.504] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffd68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.504] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x298, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x298, lpOverlapped=0x0) returned 1 [0084.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.504] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.504] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.504] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.504] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.505] CloseHandle (hObject=0xe4) returned 1 [0084.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.507] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.507] GetLastError () returned 0x0 [0084.507] RtlWakeConditionVariable () returned 0x0 [0084.507] GetCurrentThreadId () returned 0x9ac [0084.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".ldf") returned 0x0 [0084.507] lstrlenW (lpString=".vhd") returned 4 [0084.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".vhd") returned 0x0 [0084.507] lstrlenW (lpString=".vhdx") returned 5 [0084.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".vhdx") returned 0x0 [0084.507] lstrlenW (lpString=".pst") returned 4 [0084.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".pst") returned 0x0 [0084.508] lstrlenW (lpString=".ost") returned 4 [0084.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".ost") returned 0x0 [0084.508] lstrlenW (lpString=".bak") returned 4 [0084.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".bak") returned 0x0 [0084.508] lstrlenW (lpString=".bac") returned 4 [0084.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".bac") returned 0x0 [0084.508] lstrlenW (lpString=".sys") returned 4 [0084.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".sys") returned 0x0 [0084.508] lstrlenW (lpString=".v2i") returned 4 [0084.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".v2i") returned 0x0 [0084.508] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.509] lstrlenW (lpString=".sql") returned 4 [0084.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".sql") returned 0x0 [0084.509] lstrlenW (lpString=".mdf") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".mdf") returned 0x0 [0084.510] lstrlenW (lpString=".txt") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".txt") returned 0x0 [0084.510] lstrlenW (lpString=".dbf") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".dbf") returned 0x0 [0084.510] lstrlenW (lpString=".ckp") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".ckp") returned 0x0 [0084.510] lstrlenW (lpString=".dacpac") returned 7 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".dacpac") returned 0x0 [0084.510] lstrlenW (lpString=".db3") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".db3") returned 0x0 [0084.510] lstrlenW (lpString=".dtxs") returned 5 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".dtxs") returned 0x0 [0084.510] lstrlenW (lpString=".mdt") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".mdt") returned 0x0 [0084.510] lstrlenW (lpString=".sdf") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".sdf") returned 0x0 [0084.510] lstrlenW (lpString=".MDF") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".MDF") returned 0x0 [0084.510] lstrlenW (lpString=".DBF") returned 4 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".DBF") returned 0x0 [0084.510] lstrlenW (lpString=".DB") returned 3 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".DB") returned 0x0 [0084.510] lstrlenW (lpString=".db") returned 3 [0084.510] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".db") returned 0x0 [0084.510] lstrlenW (lpString=".ndf") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".ndf") returned 0x0 [0084.511] lstrlenW (lpString=".NDF") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".NDF") returned 0x0 [0084.511] lstrlenW (lpString=".Mdf") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".Mdf") returned 0x0 [0084.511] lstrlenW (lpString=".dat") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".dat") returned 0x0 [0084.511] lstrlenW (lpString=".DAT") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".DAT") returned 0x0 [0084.511] lstrlenW (lpString=".ldf") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".ldf") returned 0x0 [0084.511] lstrlenW (lpString=".LDF") returned 4 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch=".LDF") returned 0x0 [0084.511] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.511] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.511] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.512] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.512] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.512] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.512] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20451337421) returned 1 [0084.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc12fa3f0, dwHighDateTime=0x1d585b4)) [0084.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.512] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f1858 [0084.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f1858 | out: hHeap=0x260000) returned 1 [0084.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.513] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2750780 [0084.513] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.513] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.513] GetLastError () returned 0x0 [0084.513] GetLastError () returned 0x0 [0084.513] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.514] GetLastError () returned 0x0 [0084.514] GetLastError () returned 0x0 [0084.640] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.651] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0084.671] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.671] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.671] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.671] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.672] CloseHandle (hObject=0xe4) returned 1 [0084.672] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.672] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.673] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.673] GetLastError () returned 0x0 [0084.674] RtlWakeConditionVariable () returned 0x0 [0084.674] GetCurrentThreadId () returned 0x9ac [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".ldf") returned 0x0 [0084.674] lstrlenW (lpString=".vhd") returned 4 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".vhd") returned 0x0 [0084.674] lstrlenW (lpString=".vhdx") returned 5 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".vhdx") returned 0x0 [0084.674] lstrlenW (lpString=".pst") returned 4 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".pst") returned 0x0 [0084.674] lstrlenW (lpString=".ost") returned 4 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".ost") returned 0x0 [0084.674] lstrlenW (lpString=".bak") returned 4 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".bak") returned 0x0 [0084.674] lstrlenW (lpString=".bac") returned 4 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".bac") returned 0x0 [0084.674] lstrlenW (lpString=".sys") returned 4 [0084.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".sys") returned 0x0 [0084.675] lstrlenW (lpString=".v2i") returned 4 [0084.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".v2i") returned 0x0 [0084.675] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.676] lstrlenW (lpString=".sql") returned 4 [0084.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".sql") returned 0x0 [0084.676] lstrlenW (lpString=".mdf") returned 4 [0084.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".mdf") returned 0x0 [0084.676] lstrlenW (lpString=".txt") returned 4 [0084.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".txt") returned 0x0 [0084.676] lstrlenW (lpString=".dbf") returned 4 [0084.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".dbf") returned 0x0 [0084.676] lstrlenW (lpString=".ckp") returned 4 [0084.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".ckp") returned 0x0 [0084.676] lstrlenW (lpString=".dacpac") returned 7 [0084.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".dacpac") returned 0x0 [0084.677] lstrlenW (lpString=".db3") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".db3") returned 0x0 [0084.677] lstrlenW (lpString=".dtxs") returned 5 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".dtxs") returned 0x0 [0084.677] lstrlenW (lpString=".mdt") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".mdt") returned 0x0 [0084.677] lstrlenW (lpString=".sdf") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".sdf") returned 0x0 [0084.677] lstrlenW (lpString=".MDF") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".MDF") returned 0x0 [0084.677] lstrlenW (lpString=".DBF") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".DBF") returned 0x0 [0084.677] lstrlenW (lpString=".DB") returned 3 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".DB") returned 0x0 [0084.677] lstrlenW (lpString=".db") returned 3 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".db") returned 0x0 [0084.677] lstrlenW (lpString=".ndf") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".ndf") returned 0x0 [0084.677] lstrlenW (lpString=".NDF") returned 4 [0084.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".NDF") returned 0x0 [0084.677] lstrlenW (lpString=".Mdf") returned 4 [0084.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".Mdf") returned 0x0 [0084.678] lstrlenW (lpString=".dat") returned 4 [0084.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".dat") returned 0x0 [0084.678] lstrlenW (lpString=".DAT") returned 4 [0084.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".DAT") returned 0x0 [0084.678] lstrlenW (lpString=".ldf") returned 4 [0084.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".ldf") returned 0x0 [0084.678] lstrlenW (lpString=".LDF") returned 4 [0084.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch=".LDF") returned 0x0 [0084.678] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.678] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.679] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.679] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.679] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20468018009) returned 1 [0084.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc149d310, dwHighDateTime=0x1d585b4)) [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f58d0 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f58d0 | out: hHeap=0x260000) returned 1 [0084.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c770 [0084.680] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.680] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.680] GetLastError () returned 0x0 [0084.680] GetLastError () returned 0x0 [0084.680] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.680] GetLastError () returned 0x0 [0084.681] GetLastError () returned 0x0 [0084.682] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.682] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.683] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.683] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.683] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.683] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.683] CloseHandle (hObject=0xe4) returned 1 [0084.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.685] GetLastError () returned 0x0 [0084.685] RtlWakeConditionVariable () returned 0x0 [0084.685] GetCurrentThreadId () returned 0x9ac [0084.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".ldf") returned 0x0 [0084.685] lstrlenW (lpString=".vhd") returned 4 [0084.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".vhd") returned 0x0 [0084.685] lstrlenW (lpString=".vhdx") returned 5 [0084.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".vhdx") returned 0x0 [0084.685] lstrlenW (lpString=".pst") returned 4 [0084.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".pst") returned 0x0 [0084.685] lstrlenW (lpString=".ost") returned 4 [0084.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".ost") returned 0x0 [0084.685] lstrlenW (lpString=".bak") returned 4 [0084.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".bak") returned 0x0 [0084.686] lstrlenW (lpString=".bac") returned 4 [0084.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".bac") returned 0x0 [0084.686] lstrlenW (lpString=".sys") returned 4 [0084.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".sys") returned 0x0 [0084.686] lstrlenW (lpString=".v2i") returned 4 [0084.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".v2i") returned 0x0 [0084.686] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch="s\r\n.v2i") returned 0x0 [0084.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.688] lstrlenW (lpString=".sql") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".sql") returned 0x0 [0084.688] lstrlenW (lpString=".mdf") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".mdf") returned 0x0 [0084.688] lstrlenW (lpString=".txt") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".txt") returned 0x0 [0084.688] lstrlenW (lpString=".dbf") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".dbf") returned 0x0 [0084.688] lstrlenW (lpString=".ckp") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".ckp") returned 0x0 [0084.688] lstrlenW (lpString=".dacpac") returned 7 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".dacpac") returned 0x0 [0084.688] lstrlenW (lpString=".db3") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".db3") returned 0x0 [0084.688] lstrlenW (lpString=".dtxs") returned 5 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".dtxs") returned 0x0 [0084.688] lstrlenW (lpString=".mdt") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".mdt") returned 0x0 [0084.688] lstrlenW (lpString=".sdf") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".sdf") returned 0x0 [0084.688] lstrlenW (lpString=".MDF") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".MDF") returned 0x0 [0084.688] lstrlenW (lpString=".DBF") returned 4 [0084.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".DBF") returned 0x0 [0084.689] lstrlenW (lpString=".DB") returned 3 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".DB") returned 0x0 [0084.689] lstrlenW (lpString=".db") returned 3 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".db") returned 0x0 [0084.689] lstrlenW (lpString=".ndf") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".ndf") returned 0x0 [0084.689] lstrlenW (lpString=".NDF") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".NDF") returned 0x0 [0084.689] lstrlenW (lpString=".Mdf") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".Mdf") returned 0x0 [0084.689] lstrlenW (lpString=".dat") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".dat") returned 0x0 [0084.689] lstrlenW (lpString=".DAT") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".DAT") returned 0x0 [0084.689] lstrlenW (lpString=".ldf") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".ldf") returned 0x0 [0084.689] lstrlenW (lpString=".LDF") returned 4 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch=".LDF") returned 0x0 [0084.689] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.689] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.689] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.690] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.690] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.690] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.690] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20469152770) returned 1 [0084.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc149d310, dwHighDateTime=0x1d585b4)) [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c2f8 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c2f8 | out: hHeap=0x260000) returned 1 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c640 [0084.691] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.691] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.691] GetLastError () returned 0x0 [0084.691] GetLastError () returned 0x0 [0084.692] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.692] GetLastError () returned 0x0 [0084.692] GetLastError () returned 0x0 [0084.694] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.694] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x327, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x327, lpOverlapped=0x0) returned 1 [0084.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.694] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.694] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.694] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.694] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.694] CloseHandle (hObject=0xe4) returned 1 [0084.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.694] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.[deadmin@cock.li].deadmin")) returned 1 [0084.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.696] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.696] GetLastError () returned 0x0 [0084.696] RtlWakeConditionVariable () returned 0x0 [0084.696] GetCurrentThreadId () returned 0x9ac [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".ldf") returned 0x0 [0084.696] lstrlenW (lpString=".vhd") returned 4 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".vhd") returned 0x0 [0084.696] lstrlenW (lpString=".vhdx") returned 5 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".vhdx") returned 0x0 [0084.696] lstrlenW (lpString=".pst") returned 4 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".pst") returned 0x0 [0084.696] lstrlenW (lpString=".ost") returned 4 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".ost") returned 0x0 [0084.696] lstrlenW (lpString=".bak") returned 4 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".bak") returned 0x0 [0084.696] lstrlenW (lpString=".bac") returned 4 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".bac") returned 0x0 [0084.696] lstrlenW (lpString=".sys") returned 4 [0084.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".sys") returned 0x0 [0084.697] lstrlenW (lpString=".v2i") returned 4 [0084.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".v2i") returned 0x0 [0084.697] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.698] lstrlenW (lpString=".sql") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".sql") returned 0x0 [0084.698] lstrlenW (lpString=".mdf") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".mdf") returned 0x0 [0084.698] lstrlenW (lpString=".txt") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".txt") returned 0x0 [0084.698] lstrlenW (lpString=".dbf") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".dbf") returned 0x0 [0084.698] lstrlenW (lpString=".ckp") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".ckp") returned 0x0 [0084.698] lstrlenW (lpString=".dacpac") returned 7 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".dacpac") returned 0x0 [0084.698] lstrlenW (lpString=".db3") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".db3") returned 0x0 [0084.698] lstrlenW (lpString=".dtxs") returned 5 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".dtxs") returned 0x0 [0084.698] lstrlenW (lpString=".mdt") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".mdt") returned 0x0 [0084.698] lstrlenW (lpString=".sdf") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".sdf") returned 0x0 [0084.698] lstrlenW (lpString=".MDF") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".MDF") returned 0x0 [0084.698] lstrlenW (lpString=".DBF") returned 4 [0084.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".DBF") returned 0x0 [0084.699] lstrlenW (lpString=".DB") returned 3 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".DB") returned 0x0 [0084.699] lstrlenW (lpString=".db") returned 3 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".db") returned 0x0 [0084.699] lstrlenW (lpString=".ndf") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".ndf") returned 0x0 [0084.699] lstrlenW (lpString=".NDF") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".NDF") returned 0x0 [0084.699] lstrlenW (lpString=".Mdf") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".Mdf") returned 0x0 [0084.699] lstrlenW (lpString=".dat") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".dat") returned 0x0 [0084.699] lstrlenW (lpString=".DAT") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".DAT") returned 0x0 [0084.699] lstrlenW (lpString=".ldf") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".ldf") returned 0x0 [0084.699] lstrlenW (lpString=".LDF") returned 4 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch=".LDF") returned 0x0 [0084.699] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.699] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.700] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.700] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.700] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20470151953) returned 1 [0084.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc14c3470, dwHighDateTime=0x1d585b4)) [0084.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c330 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0084.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c330 | out: hHeap=0x260000) returned 1 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32baf8 [0084.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.701] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.701] GetLastError () returned 0x0 [0084.701] GetLastError () returned 0x0 [0084.702] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.702] GetLastError () returned 0x0 [0084.702] GetLastError () returned 0x0 [0084.703] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.703] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x436, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x436, lpOverlapped=0x0) returned 1 [0084.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.704] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.704] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.704] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.704] CloseHandle (hObject=0xe4) returned 1 [0084.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.705] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.705] GetLastError () returned 0x0 [0084.705] RtlWakeConditionVariable () returned 0x0 [0084.705] GetCurrentThreadId () returned 0x9ac [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".ldf") returned 0x0 [0084.706] lstrlenW (lpString=".vhd") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".vhd") returned 0x0 [0084.706] lstrlenW (lpString=".vhdx") returned 5 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".vhdx") returned 0x0 [0084.706] lstrlenW (lpString=".pst") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".pst") returned 0x0 [0084.706] lstrlenW (lpString=".ost") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".ost") returned 0x0 [0084.706] lstrlenW (lpString=".bak") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".bak") returned 0x0 [0084.706] lstrlenW (lpString=".bac") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".bac") returned 0x0 [0084.706] lstrlenW (lpString=".sys") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".sys") returned 0x0 [0084.706] lstrlenW (lpString=".v2i") returned 4 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".v2i") returned 0x0 [0084.706] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0084.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.707] lstrlenW (lpString=".sql") returned 4 [0084.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".sql") returned 0x0 [0084.707] lstrlenW (lpString=".mdf") returned 4 [0084.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".mdf") returned 0x0 [0084.707] lstrlenW (lpString=".txt") returned 4 [0084.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".txt") returned 0x0 [0084.707] lstrlenW (lpString=".dbf") returned 4 [0084.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".dbf") returned 0x0 [0084.707] lstrlenW (lpString=".ckp") returned 4 [0084.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".ckp") returned 0x0 [0084.708] lstrlenW (lpString=".dacpac") returned 7 [0084.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".dacpac") returned 0x0 [0084.708] lstrlenW (lpString=".db3") returned 4 [0084.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".db3") returned 0x0 [0084.708] lstrlenW (lpString=".dtxs") returned 5 [0084.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".dtxs") returned 0x0 [0084.708] lstrlenW (lpString=".mdt") returned 4 [0084.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".mdt") returned 0x0 [0084.708] lstrlenW (lpString=".sdf") returned 4 [0084.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".sdf") returned 0x0 [0084.708] lstrlenW (lpString=".MDF") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".MDF") returned 0x0 [0084.765] lstrlenW (lpString=".DBF") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".DBF") returned 0x0 [0084.765] lstrlenW (lpString=".DB") returned 3 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".DB") returned 0x0 [0084.765] lstrlenW (lpString=".db") returned 3 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".db") returned 0x0 [0084.765] lstrlenW (lpString=".ndf") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".ndf") returned 0x0 [0084.765] lstrlenW (lpString=".NDF") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".NDF") returned 0x0 [0084.765] lstrlenW (lpString=".Mdf") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".Mdf") returned 0x0 [0084.765] lstrlenW (lpString=".dat") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".dat") returned 0x0 [0084.765] lstrlenW (lpString=".DAT") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".DAT") returned 0x0 [0084.765] lstrlenW (lpString=".ldf") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".ldf") returned 0x0 [0084.765] lstrlenW (lpString=".LDF") returned 4 [0084.765] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch=".LDF") returned 0x0 [0084.766] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.766] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.766] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d30a8) returned 1 [0084.766] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.766] CryptReleaseContext (hProv=0x2d30a8, dwFlags=0x0) returned 1 [0084.766] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.767] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20476776646) returned 1 [0084.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc155b9f0, dwHighDateTime=0x1d585b4)) [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c480 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c480 | out: hHeap=0x260000) returned 1 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.767] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c6d8 [0084.767] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.767] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.767] GetLastError () returned 0x0 [0084.768] GetLastError () returned 0x0 [0084.768] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.768] GetLastError () returned 0x0 [0084.768] GetLastError () returned 0x0 [0084.807] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff44a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.807] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xbb6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xbb6, lpOverlapped=0x0) returned 1 [0084.807] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.807] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.808] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.808] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.808] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.808] CloseHandle (hObject=0xe4) returned 1 [0084.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0084.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.[deadmin@cock.li].deadmin")) returned 1 [0084.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0084.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.809] GetLastError () returned 0x0 [0084.809] RtlWakeConditionVariable () returned 0x27e828 [0084.809] GetCurrentThreadId () returned 0x9ac [0084.809] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".ldf") returned 0x0 [0084.810] lstrlenW (lpString=".vhd") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".vhd") returned 0x0 [0084.810] lstrlenW (lpString=".vhdx") returned 5 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".vhdx") returned 0x0 [0084.810] lstrlenW (lpString=".pst") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".pst") returned 0x0 [0084.810] lstrlenW (lpString=".ost") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".ost") returned 0x0 [0084.810] lstrlenW (lpString=".bak") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".bak") returned 0x0 [0084.810] lstrlenW (lpString=".bac") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".bac") returned 0x0 [0084.810] lstrlenW (lpString=".sys") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".sys") returned 0x0 [0084.810] lstrlenW (lpString=".v2i") returned 4 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".v2i") returned 0x0 [0084.810] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.810] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0084.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0084.811] lstrlenW (lpString=".sql") returned 4 [0084.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".sql") returned 0x0 [0084.811] lstrlenW (lpString=".mdf") returned 4 [0084.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".mdf") returned 0x0 [0084.811] lstrlenW (lpString=".txt") returned 4 [0084.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".txt") returned 0x0 [0084.811] lstrlenW (lpString=".dbf") returned 4 [0084.811] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".dbf") returned 0x0 [0084.811] lstrlenW (lpString=".ckp") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".ckp") returned 0x0 [0084.812] lstrlenW (lpString=".dacpac") returned 7 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".dacpac") returned 0x0 [0084.812] lstrlenW (lpString=".db3") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".db3") returned 0x0 [0084.812] lstrlenW (lpString=".dtxs") returned 5 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".dtxs") returned 0x0 [0084.812] lstrlenW (lpString=".mdt") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".mdt") returned 0x0 [0084.812] lstrlenW (lpString=".sdf") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".sdf") returned 0x0 [0084.812] lstrlenW (lpString=".MDF") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".MDF") returned 0x0 [0084.812] lstrlenW (lpString=".DBF") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".DBF") returned 0x0 [0084.812] lstrlenW (lpString=".DB") returned 3 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".DB") returned 0x0 [0084.812] lstrlenW (lpString=".db") returned 3 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".db") returned 0x0 [0084.812] lstrlenW (lpString=".ndf") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".ndf") returned 0x0 [0084.812] lstrlenW (lpString=".NDF") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".NDF") returned 0x0 [0084.812] lstrlenW (lpString=".Mdf") returned 4 [0084.812] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".Mdf") returned 0x0 [0084.813] lstrlenW (lpString=".dat") returned 4 [0084.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".dat") returned 0x0 [0084.813] lstrlenW (lpString=".DAT") returned 4 [0084.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".DAT") returned 0x0 [0084.813] lstrlenW (lpString=".ldf") returned 4 [0084.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".ldf") returned 0x0 [0084.813] lstrlenW (lpString=".LDF") returned 4 [0084.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch=".LDF") returned 0x0 [0084.813] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.813] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0084.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.813] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2d3ac0) returned 1 [0084.814] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.814] CryptReleaseContext (hProv=0x2d3ac0, dwFlags=0x0) returned 1 [0084.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0084.814] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20481511025) returned 1 [0084.814] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc15cde10, dwHighDateTime=0x1d585b4)) [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c5d0 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c5d0 | out: hHeap=0x260000) returned 1 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f3e8 [0084.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.814] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f3e8 | out: hHeap=0x260000) returned 1 [0084.815] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.815] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.815] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.815] GetLastError () returned 0x0 [0084.815] GetLastError () returned 0x0 [0084.815] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.815] GetLastError () returned 0x0 [0084.815] GetLastError () returned 0x0 [0084.825] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.825] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0084.825] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.825] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.831] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.831] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.831] CloseHandle (hObject=0xe4) returned 1 [0084.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x349218 [0084.842] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.[deadmin@cock.li].deadmin")) returned 1 [0084.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x349218 | out: hHeap=0x260000) returned 1 [0084.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0084.853] GetLastError () returned 0x0 [0084.853] RtlWakeConditionVariable () returned 0x27e828 [0084.853] GetCurrentThreadId () returned 0x9ac [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".ldf") returned 0x0 [0084.854] lstrlenW (lpString=".vhd") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".vhd") returned 0x0 [0084.854] lstrlenW (lpString=".vhdx") returned 5 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".vhdx") returned 0x0 [0084.854] lstrlenW (lpString=".pst") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".pst") returned 0x0 [0084.854] lstrlenW (lpString=".ost") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".ost") returned 0x0 [0084.854] lstrlenW (lpString=".bak") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".bak") returned 0x0 [0084.854] lstrlenW (lpString=".bac") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".bac") returned 0x0 [0084.854] lstrlenW (lpString=".sys") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".sys") returned 0x0 [0084.854] lstrlenW (lpString=".v2i") returned 4 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".v2i") returned 0x0 [0084.854] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch="s\r\n.v2i") returned 0x0 [0084.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.861] lstrlenW (lpString=".sql") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".sql") returned 0x0 [0084.861] lstrlenW (lpString=".mdf") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".mdf") returned 0x0 [0084.861] lstrlenW (lpString=".txt") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".txt") returned 0x0 [0084.861] lstrlenW (lpString=".dbf") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".dbf") returned 0x0 [0084.861] lstrlenW (lpString=".ckp") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".ckp") returned 0x0 [0084.861] lstrlenW (lpString=".dacpac") returned 7 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".dacpac") returned 0x0 [0084.861] lstrlenW (lpString=".db3") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".db3") returned 0x0 [0084.861] lstrlenW (lpString=".dtxs") returned 5 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".dtxs") returned 0x0 [0084.861] lstrlenW (lpString=".mdt") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".mdt") returned 0x0 [0084.861] lstrlenW (lpString=".sdf") returned 4 [0084.861] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".sdf") returned 0x0 [0084.862] lstrlenW (lpString=".MDF") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".MDF") returned 0x0 [0084.862] lstrlenW (lpString=".DBF") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".DBF") returned 0x0 [0084.862] lstrlenW (lpString=".DB") returned 3 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".DB") returned 0x0 [0084.862] lstrlenW (lpString=".db") returned 3 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".db") returned 0x0 [0084.862] lstrlenW (lpString=".ndf") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".ndf") returned 0x0 [0084.862] lstrlenW (lpString=".NDF") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".NDF") returned 0x0 [0084.862] lstrlenW (lpString=".Mdf") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".Mdf") returned 0x0 [0084.862] lstrlenW (lpString=".dat") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".dat") returned 0x0 [0084.862] lstrlenW (lpString=".DAT") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".DAT") returned 0x0 [0084.862] lstrlenW (lpString=".ldf") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".ldf") returned 0x0 [0084.862] lstrlenW (lpString=".LDF") returned 4 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch=".LDF") returned 0x0 [0084.862] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.863] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x2757af0) returned 1 [0084.863] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.863] CryptReleaseContext (hProv=0x2757af0, dwFlags=0x0) returned 1 [0084.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.864] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20486464914) returned 1 [0084.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1640230, dwHighDateTime=0x1d585b4)) [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c6b0 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c6b0 | out: hHeap=0x260000) returned 1 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.864] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.865] GetLastError () returned 0x0 [0084.865] GetLastError () returned 0x0 [0084.865] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.865] GetLastError () returned 0x0 [0084.865] GetLastError () returned 0x0 [0084.868] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.868] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0084.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0084.870] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.870] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.871] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.871] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.871] CloseHandle (hObject=0xd8) returned 1 [0084.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x348c58 [0084.872] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.[deadmin@cock.li].deadmin")) returned 1 [0084.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x348c58 | out: hHeap=0x260000) returned 1 [0084.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.873] GetLastError () returned 0x0 [0084.873] RtlWakeConditionVariable () returned 0x0 [0084.873] GetCurrentThreadId () returned 0x9ac [0084.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".ldf") returned 0x0 [0084.873] lstrlenW (lpString=".vhd") returned 4 [0084.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".vhd") returned 0x0 [0084.873] lstrlenW (lpString=".vhdx") returned 5 [0084.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".vhdx") returned 0x0 [0084.873] lstrlenW (lpString=".pst") returned 4 [0084.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".pst") returned 0x0 [0084.873] lstrlenW (lpString=".ost") returned 4 [0084.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".ost") returned 0x0 [0084.874] lstrlenW (lpString=".bak") returned 4 [0084.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".bak") returned 0x0 [0084.874] lstrlenW (lpString=".bac") returned 4 [0084.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".bac") returned 0x0 [0084.874] lstrlenW (lpString=".sys") returned 4 [0084.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".sys") returned 0x0 [0084.874] lstrlenW (lpString=".v2i") returned 4 [0084.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".v2i") returned 0x0 [0084.874] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch="s\r\n.v2i") returned 0x0 [0084.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.876] lstrlenW (lpString=".sql") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".sql") returned 0x0 [0084.876] lstrlenW (lpString=".mdf") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".mdf") returned 0x0 [0084.876] lstrlenW (lpString=".txt") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".txt") returned 0x0 [0084.876] lstrlenW (lpString=".dbf") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".dbf") returned 0x0 [0084.876] lstrlenW (lpString=".ckp") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".ckp") returned 0x0 [0084.876] lstrlenW (lpString=".dacpac") returned 7 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".dacpac") returned 0x0 [0084.876] lstrlenW (lpString=".db3") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".db3") returned 0x0 [0084.876] lstrlenW (lpString=".dtxs") returned 5 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".dtxs") returned 0x0 [0084.876] lstrlenW (lpString=".mdt") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".mdt") returned 0x0 [0084.876] lstrlenW (lpString=".sdf") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".sdf") returned 0x0 [0084.876] lstrlenW (lpString=".MDF") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".MDF") returned 0x0 [0084.876] lstrlenW (lpString=".DBF") returned 4 [0084.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".DBF") returned 0x0 [0084.877] lstrlenW (lpString=".DB") returned 3 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".DB") returned 0x0 [0084.877] lstrlenW (lpString=".db") returned 3 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".db") returned 0x0 [0084.877] lstrlenW (lpString=".ndf") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".ndf") returned 0x0 [0084.877] lstrlenW (lpString=".NDF") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".NDF") returned 0x0 [0084.877] lstrlenW (lpString=".Mdf") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".Mdf") returned 0x0 [0084.877] lstrlenW (lpString=".dat") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".dat") returned 0x0 [0084.877] lstrlenW (lpString=".DAT") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".DAT") returned 0x0 [0084.877] lstrlenW (lpString=".ldf") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".ldf") returned 0x0 [0084.877] lstrlenW (lpString=".LDF") returned 4 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch=".LDF") returned 0x0 [0084.877] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.877] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e2f8) returned 1 [0084.878] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.878] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.878] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20487949509) returned 1 [0084.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1666390, dwHighDateTime=0x1d585b4)) [0084.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c6e8 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c6e8 | out: hHeap=0x260000) returned 1 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x32c218 [0084.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.879] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.879] GetLastError () returned 0x0 [0084.879] GetLastError () returned 0x0 [0084.880] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.931] GetLastError () returned 0x0 [0084.931] GetLastError () returned 0x0 [0084.933] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc40, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.933] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c0, lpOverlapped=0x0) returned 1 [0084.933] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.933] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.933] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.933] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.933] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.933] CloseHandle (hObject=0xd8) returned 1 [0084.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x34d050 [0084.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.[deadmin@cock.li].deadmin")) returned 1 [0084.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0084.936] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.936] GetLastError () returned 0x0 [0084.936] RtlWakeConditionVariable () returned 0x0 [0084.936] GetCurrentThreadId () returned 0x9ac [0084.937] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.937] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.937] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0084.937] WriteFile (in: hFile=0xd8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0084.939] CloseHandle (hObject=0xd8) returned 1 [0084.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0084.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0084.940] RtlWakeConditionVariable () returned 0x27e828 [0084.940] GetCurrentThreadId () returned 0x9ac [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".ldf") returned 0x0 [0084.940] lstrlenW (lpString=".vhd") returned 4 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".vhd") returned 0x0 [0084.940] lstrlenW (lpString=".vhdx") returned 5 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".vhdx") returned 0x0 [0084.940] lstrlenW (lpString=".pst") returned 4 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".pst") returned 0x0 [0084.940] lstrlenW (lpString=".ost") returned 4 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".ost") returned 0x0 [0084.940] lstrlenW (lpString=".bak") returned 4 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".bak") returned 0x0 [0084.940] lstrlenW (lpString=".bac") returned 4 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".bac") returned 0x0 [0084.940] lstrlenW (lpString=".sys") returned 4 [0084.940] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".sys") returned 0x0 [0084.940] lstrlenW (lpString=".v2i") returned 4 [0084.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".v2i") returned 0x0 [0084.941] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.941] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch="s\r\n.v2i") returned 0x0 [0084.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.942] lstrlenW (lpString=".sql") returned 4 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".sql") returned 0x0 [0084.942] lstrlenW (lpString=".mdf") returned 4 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".mdf") returned 0x0 [0084.942] lstrlenW (lpString=".txt") returned 4 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".txt") returned 0x0 [0084.942] lstrlenW (lpString=".dbf") returned 4 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".dbf") returned 0x0 [0084.942] lstrlenW (lpString=".ckp") returned 4 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".ckp") returned 0x0 [0084.942] lstrlenW (lpString=".dacpac") returned 7 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".dacpac") returned 0x0 [0084.942] lstrlenW (lpString=".db3") returned 4 [0084.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".db3") returned 0x0 [0084.942] lstrlenW (lpString=".dtxs") returned 5 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".dtxs") returned 0x0 [0084.943] lstrlenW (lpString=".mdt") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".mdt") returned 0x0 [0084.943] lstrlenW (lpString=".sdf") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".sdf") returned 0x0 [0084.943] lstrlenW (lpString=".MDF") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".MDF") returned 0x0 [0084.943] lstrlenW (lpString=".DBF") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".DBF") returned 0x0 [0084.943] lstrlenW (lpString=".DB") returned 3 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".DB") returned 0x0 [0084.943] lstrlenW (lpString=".db") returned 3 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".db") returned 0x0 [0084.943] lstrlenW (lpString=".ndf") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".ndf") returned 0x0 [0084.943] lstrlenW (lpString=".NDF") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".NDF") returned 0x0 [0084.943] lstrlenW (lpString=".Mdf") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".Mdf") returned 0x0 [0084.943] lstrlenW (lpString=".dat") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".dat") returned 0x0 [0084.943] lstrlenW (lpString=".DAT") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".DAT") returned 0x0 [0084.943] lstrlenW (lpString=".ldf") returned 4 [0084.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".ldf") returned 0x0 [0084.944] lstrlenW (lpString=".LDF") returned 4 [0084.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch=".LDF") returned 0x0 [0084.944] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.944] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.944] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e2f8) returned 1 [0084.945] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.945] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.945] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20494593648) returned 1 [0084.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1724a70, dwHighDateTime=0x1d585b4)) [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762d48 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762d48 | out: hHeap=0x260000) returned 1 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.945] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.946] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.946] GetLastError () returned 0x0 [0084.946] GetLastError () returned 0x0 [0084.946] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.946] GetLastError () returned 0x0 [0084.946] GetLastError () returned 0x0 [0084.948] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffd70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.948] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x290, lpOverlapped=0x0) returned 1 [0084.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.948] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.948] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.948] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.949] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.949] CloseHandle (hObject=0xd8) returned 1 [0084.949] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0084.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.[deadmin@cock.li].deadmin")) returned 1 [0084.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0084.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.951] GetLastError () returned 0x0 [0084.951] RtlWakeConditionVariable () returned 0x0 [0084.951] GetCurrentThreadId () returned 0x9ac [0084.951] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.951] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0084.951] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0084.951] WriteFile (in: hFile=0xd8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0084.953] CloseHandle (hObject=0xd8) returned 1 [0084.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2aed18 | out: hHeap=0x260000) returned 1 [0084.953] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0084.953] RtlWakeConditionVariable () returned 0x27e828 [0084.953] GetCurrentThreadId () returned 0x9ac [0084.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".ldf") returned 0x0 [0084.954] lstrlenW (lpString=".vhd") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".vhd") returned 0x0 [0084.954] lstrlenW (lpString=".vhdx") returned 5 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".vhdx") returned 0x0 [0084.954] lstrlenW (lpString=".pst") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".pst") returned 0x0 [0084.954] lstrlenW (lpString=".ost") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".ost") returned 0x0 [0084.954] lstrlenW (lpString=".bak") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".bak") returned 0x0 [0084.954] lstrlenW (lpString=".bac") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".bac") returned 0x0 [0084.954] lstrlenW (lpString=".sys") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".sys") returned 0x0 [0084.954] lstrlenW (lpString=".v2i") returned 4 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".v2i") returned 0x0 [0084.954] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.954] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch="s\r\n.v2i") returned 0x0 [0084.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.955] lstrlenW (lpString=".sql") returned 4 [0084.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".sql") returned 0x0 [0084.955] lstrlenW (lpString=".mdf") returned 4 [0084.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".mdf") returned 0x0 [0084.955] lstrlenW (lpString=".txt") returned 4 [0084.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".txt") returned 0x0 [0084.956] lstrlenW (lpString=".dbf") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".dbf") returned 0x0 [0084.956] lstrlenW (lpString=".ckp") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".ckp") returned 0x0 [0084.956] lstrlenW (lpString=".dacpac") returned 7 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".dacpac") returned 0x0 [0084.956] lstrlenW (lpString=".db3") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".db3") returned 0x0 [0084.956] lstrlenW (lpString=".dtxs") returned 5 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".dtxs") returned 0x0 [0084.956] lstrlenW (lpString=".mdt") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".mdt") returned 0x0 [0084.956] lstrlenW (lpString=".sdf") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".sdf") returned 0x0 [0084.956] lstrlenW (lpString=".MDF") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".MDF") returned 0x0 [0084.956] lstrlenW (lpString=".DBF") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".DBF") returned 0x0 [0084.956] lstrlenW (lpString=".DB") returned 3 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".DB") returned 0x0 [0084.956] lstrlenW (lpString=".db") returned 3 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".db") returned 0x0 [0084.956] lstrlenW (lpString=".ndf") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".ndf") returned 0x0 [0084.956] lstrlenW (lpString=".NDF") returned 4 [0084.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".NDF") returned 0x0 [0084.957] lstrlenW (lpString=".Mdf") returned 4 [0084.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".Mdf") returned 0x0 [0084.957] lstrlenW (lpString=".dat") returned 4 [0084.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".dat") returned 0x0 [0084.957] lstrlenW (lpString=".DAT") returned 4 [0084.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".DAT") returned 0x0 [0084.957] lstrlenW (lpString=".ldf") returned 4 [0084.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".ldf") returned 0x0 [0084.957] lstrlenW (lpString=".LDF") returned 4 [0084.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch=".LDF") returned 0x0 [0084.957] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.957] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e2f8) returned 1 [0084.958] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.958] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.958] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20495944805) returned 1 [0084.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc174abd0, dwHighDateTime=0x1d585b4)) [0084.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762d80 [0084.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762d80 | out: hHeap=0x260000) returned 1 [0084.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.959] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.959] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.959] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.959] GetLastError () returned 0x0 [0084.959] GetLastError () returned 0x0 [0084.959] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.960] GetLastError () returned 0x0 [0084.960] GetLastError () returned 0x0 [0084.961] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.961] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3b0, lpOverlapped=0x0) returned 1 [0084.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0084.962] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.962] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0084.962] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0084.962] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0084.962] CloseHandle (hObject=0xd8) returned 1 [0084.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x282c348 [0084.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.[deadmin@cock.li].deadmin")) returned 1 [0084.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x282c348 | out: hHeap=0x260000) returned 1 [0084.964] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0084.964] GetLastError () returned 0x0 [0084.964] RtlWakeConditionVariable () returned 0x0 [0084.964] GetCurrentThreadId () returned 0x9ac [0084.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".ldf") returned 0x0 [0084.964] lstrlenW (lpString=".vhd") returned 4 [0084.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".vhd") returned 0x0 [0084.964] lstrlenW (lpString=".vhdx") returned 5 [0084.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".vhdx") returned 0x0 [0084.964] lstrlenW (lpString=".pst") returned 4 [0084.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".pst") returned 0x0 [0084.964] lstrlenW (lpString=".ost") returned 4 [0084.964] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".ost") returned 0x0 [0084.965] lstrlenW (lpString=".bak") returned 4 [0084.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".bak") returned 0x0 [0084.965] lstrlenW (lpString=".bac") returned 4 [0084.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".bac") returned 0x0 [0084.965] lstrlenW (lpString=".sys") returned 4 [0084.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".sys") returned 0x0 [0084.965] lstrlenW (lpString=".v2i") returned 4 [0084.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".v2i") returned 0x0 [0084.965] lstrlenW (lpString="s\r\n.v2i") returned 7 [0084.965] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch="s\r\n.v2i") returned 0x0 [0084.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0084.966] lstrlenW (lpString=".sql") returned 4 [0084.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".sql") returned 0x0 [0084.966] lstrlenW (lpString=".mdf") returned 4 [0084.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".mdf") returned 0x0 [0084.966] lstrlenW (lpString=".txt") returned 4 [0084.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".txt") returned 0x0 [0084.966] lstrlenW (lpString=".dbf") returned 4 [0084.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".dbf") returned 0x0 [0084.966] lstrlenW (lpString=".ckp") returned 4 [0084.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".ckp") returned 0x0 [0084.966] lstrlenW (lpString=".dacpac") returned 7 [0084.966] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".dacpac") returned 0x0 [0084.966] lstrlenW (lpString=".db3") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".db3") returned 0x0 [0084.967] lstrlenW (lpString=".dtxs") returned 5 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".dtxs") returned 0x0 [0084.967] lstrlenW (lpString=".mdt") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".mdt") returned 0x0 [0084.967] lstrlenW (lpString=".sdf") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".sdf") returned 0x0 [0084.967] lstrlenW (lpString=".MDF") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".MDF") returned 0x0 [0084.967] lstrlenW (lpString=".DBF") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".DBF") returned 0x0 [0084.967] lstrlenW (lpString=".DB") returned 3 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".DB") returned 0x0 [0084.967] lstrlenW (lpString=".db") returned 3 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".db") returned 0x0 [0084.967] lstrlenW (lpString=".ndf") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".ndf") returned 0x0 [0084.967] lstrlenW (lpString=".NDF") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".NDF") returned 0x0 [0084.967] lstrlenW (lpString=".Mdf") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".Mdf") returned 0x0 [0084.967] lstrlenW (lpString=".dat") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".dat") returned 0x0 [0084.967] lstrlenW (lpString=".DAT") returned 4 [0084.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".DAT") returned 0x0 [0084.968] lstrlenW (lpString=".ldf") returned 4 [0084.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".ldf") returned 0x0 [0084.968] lstrlenW (lpString=".LDF") returned 4 [0084.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch=".LDF") returned 0x0 [0084.968] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0084.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0084.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0084.968] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0084.968] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e2f8) returned 1 [0084.969] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0084.969] CryptReleaseContext (hProv=0x33e2f8, dwFlags=0x0) returned 1 [0084.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0084.969] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20496997098) returned 1 [0084.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc174abd0, dwHighDateTime=0x1d585b4)) [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762cd8 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0084.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762cd8 | out: hHeap=0x260000) returned 1 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0084.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0084.969] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0084.969] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0084.970] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0084.970] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0084.970] GetLastError () returned 0x0 [0084.970] GetLastError () returned 0x0 [0084.970] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0084.970] GetLastError () returned 0x0 [0084.970] GetLastError () returned 0x0 [0084.998] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.020] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3de, lpOverlapped=0x0) returned 1 [0085.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0085.021] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.021] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.021] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.021] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.021] CloseHandle (hObject=0xd8) returned 1 [0085.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0085.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer.[deadmin@cock.li].deadmin")) returned 1 [0085.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0085.274] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0085.274] GetLastError () returned 0x0 [0085.274] RtlWakeConditionVariable () returned 0x0 [0085.274] GetCurrentThreadId () returned 0x9ac [0085.360] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.360] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0085.360] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0085.360] WriteFile (in: hFile=0xd8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0085.362] CloseHandle (hObject=0xd8) returned 1 [0085.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d500 | out: hHeap=0x260000) returned 1 [0085.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0085.362] RtlWakeConditionVariable () returned 0x0 [0085.362] GetCurrentThreadId () returned 0x9ac [0085.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".ldf") returned 0x0 [0085.363] lstrlenW (lpString=".vhd") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".vhd") returned 0x0 [0085.363] lstrlenW (lpString=".vhdx") returned 5 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".vhdx") returned 0x0 [0085.363] lstrlenW (lpString=".pst") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".pst") returned 0x0 [0085.363] lstrlenW (lpString=".ost") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".ost") returned 0x0 [0085.363] lstrlenW (lpString=".bak") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".bak") returned 0x0 [0085.363] lstrlenW (lpString=".bac") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".bac") returned 0x0 [0085.363] lstrlenW (lpString=".sys") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".sys") returned 0x0 [0085.363] lstrlenW (lpString=".v2i") returned 4 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".v2i") returned 0x0 [0085.363] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.423] lstrlenW (lpString=".sql") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".sql") returned 0x0 [0085.423] lstrlenW (lpString=".mdf") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".mdf") returned 0x0 [0085.423] lstrlenW (lpString=".txt") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".txt") returned 0x0 [0085.423] lstrlenW (lpString=".dbf") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".dbf") returned 0x0 [0085.423] lstrlenW (lpString=".ckp") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".ckp") returned 0x0 [0085.423] lstrlenW (lpString=".dacpac") returned 7 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".dacpac") returned 0x0 [0085.423] lstrlenW (lpString=".db3") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".db3") returned 0x0 [0085.423] lstrlenW (lpString=".dtxs") returned 5 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".dtxs") returned 0x0 [0085.423] lstrlenW (lpString=".mdt") returned 4 [0085.423] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".mdt") returned 0x0 [0085.423] lstrlenW (lpString=".sdf") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".sdf") returned 0x0 [0085.424] lstrlenW (lpString=".MDF") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".MDF") returned 0x0 [0085.424] lstrlenW (lpString=".DBF") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".DBF") returned 0x0 [0085.424] lstrlenW (lpString=".DB") returned 3 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".DB") returned 0x0 [0085.424] lstrlenW (lpString=".db") returned 3 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".db") returned 0x0 [0085.424] lstrlenW (lpString=".ndf") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".ndf") returned 0x0 [0085.424] lstrlenW (lpString=".NDF") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".NDF") returned 0x0 [0085.424] lstrlenW (lpString=".Mdf") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".Mdf") returned 0x0 [0085.424] lstrlenW (lpString=".dat") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".dat") returned 0x0 [0085.424] lstrlenW (lpString=".DAT") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".DAT") returned 0x0 [0085.424] lstrlenW (lpString=".ldf") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".ldf") returned 0x0 [0085.424] lstrlenW (lpString=".LDF") returned 4 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch=".LDF") returned 0x0 [0085.424] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.424] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0085.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.425] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0085.425] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.425] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0085.426] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20542695598) returned 1 [0085.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1bc1510, dwHighDateTime=0x1d585b4)) [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763250 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763250 | out: hHeap=0x260000) returned 1 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33aa30 [0085.426] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.426] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.427] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33aa30 | out: hHeap=0x260000) returned 1 [0085.427] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0085.427] GetLastError () returned 0x0 [0085.427] GetLastError () returned 0x0 [0085.427] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0085.427] GetLastError () returned 0x0 [0085.427] GetLastError () returned 0x0 [0085.430] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffff5176, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.430] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xae8a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xae8a, lpOverlapped=0x0) returned 1 [0085.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.430] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.431] WriteFile (in: hFile=0x11c, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.431] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.431] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.431] CloseHandle (hObject=0x11c) returned 1 [0085.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0085.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0085.432] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0085.432] GetLastError () returned 0x0 [0085.432] RtlWakeConditionVariable () returned 0x0 [0085.433] GetCurrentThreadId () returned 0x9ac [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".ldf") returned 0x0 [0085.433] lstrlenW (lpString=".vhd") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".vhd") returned 0x0 [0085.433] lstrlenW (lpString=".vhdx") returned 5 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".vhdx") returned 0x0 [0085.433] lstrlenW (lpString=".pst") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".pst") returned 0x0 [0085.433] lstrlenW (lpString=".ost") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".ost") returned 0x0 [0085.433] lstrlenW (lpString=".bak") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".bak") returned 0x0 [0085.433] lstrlenW (lpString=".bac") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".bac") returned 0x0 [0085.433] lstrlenW (lpString=".sys") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".sys") returned 0x0 [0085.433] lstrlenW (lpString=".v2i") returned 4 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".v2i") returned 0x0 [0085.433] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0085.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0085.464] lstrlenW (lpString=".sql") returned 4 [0085.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".sql") returned 0x0 [0085.464] lstrlenW (lpString=".mdf") returned 4 [0085.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".mdf") returned 0x0 [0085.464] lstrlenW (lpString=".txt") returned 4 [0085.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".txt") returned 0x0 [0085.464] lstrlenW (lpString=".dbf") returned 4 [0085.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".dbf") returned 0x0 [0085.464] lstrlenW (lpString=".ckp") returned 4 [0085.464] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".ckp") returned 0x0 [0085.464] lstrlenW (lpString=".dacpac") returned 7 [0085.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".dacpac") returned 0x0 [0085.480] lstrlenW (lpString=".db3") returned 4 [0085.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".db3") returned 0x0 [0085.480] lstrlenW (lpString=".dtxs") returned 5 [0085.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".dtxs") returned 0x0 [0085.480] lstrlenW (lpString=".mdt") returned 4 [0085.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".mdt") returned 0x0 [0085.480] lstrlenW (lpString=".sdf") returned 4 [0085.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".sdf") returned 0x0 [0085.480] lstrlenW (lpString=".MDF") returned 4 [0085.480] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".MDF") returned 0x0 [0085.481] lstrlenW (lpString=".DBF") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".DBF") returned 0x0 [0085.481] lstrlenW (lpString=".DB") returned 3 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".DB") returned 0x0 [0085.481] lstrlenW (lpString=".db") returned 3 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".db") returned 0x0 [0085.481] lstrlenW (lpString=".ndf") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".ndf") returned 0x0 [0085.481] lstrlenW (lpString=".NDF") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".NDF") returned 0x0 [0085.481] lstrlenW (lpString=".Mdf") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".Mdf") returned 0x0 [0085.481] lstrlenW (lpString=".dat") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".dat") returned 0x0 [0085.481] lstrlenW (lpString=".DAT") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".DAT") returned 0x0 [0085.481] lstrlenW (lpString=".ldf") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".ldf") returned 0x0 [0085.481] lstrlenW (lpString=".LDF") returned 4 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch=".LDF") returned 0x0 [0085.481] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.482] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0085.482] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.482] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.483] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20548367995) returned 1 [0085.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1c33930, dwHighDateTime=0x1d585b4)) [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27639f8 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27639f8 | out: hHeap=0x260000) returned 1 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a640 [0085.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.483] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.483] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a640 | out: hHeap=0x260000) returned 1 [0085.483] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0085.483] GetLastError () returned 0x0 [0085.484] GetLastError () returned 0x0 [0085.484] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0085.484] GetLastError () returned 0x0 [0085.484] GetLastError () returned 0x0 [0085.493] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff0ab8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.494] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xf548, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xf548, lpOverlapped=0x0) returned 1 [0085.494] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.494] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.494] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.494] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.494] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.494] CloseHandle (hObject=0xd8) returned 1 [0085.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.[deadmin@cock.li].deadmin")) returned 1 [0085.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0085.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.496] GetLastError () returned 0x0 [0085.497] RtlWakeConditionVariable () returned 0x0 [0085.497] GetCurrentThreadId () returned 0x9ac [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.497] lstrlenW (lpString=".vhd") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0085.497] lstrlenW (lpString=".vhdx") returned 5 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0085.497] lstrlenW (lpString=".pst") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0085.497] lstrlenW (lpString=".ost") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0085.497] lstrlenW (lpString=".bak") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0085.497] lstrlenW (lpString=".bac") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0085.497] lstrlenW (lpString=".sys") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0085.497] lstrlenW (lpString=".v2i") returned 4 [0085.497] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0085.497] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0085.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0085.499] lstrlenW (lpString=".sql") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0085.499] lstrlenW (lpString=".mdf") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0085.499] lstrlenW (lpString=".txt") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0085.499] lstrlenW (lpString=".dbf") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0085.499] lstrlenW (lpString=".ckp") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0085.499] lstrlenW (lpString=".dacpac") returned 7 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0085.499] lstrlenW (lpString=".db3") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0085.499] lstrlenW (lpString=".dtxs") returned 5 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0085.499] lstrlenW (lpString=".mdt") returned 4 [0085.499] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0085.500] lstrlenW (lpString=".sdf") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0085.500] lstrlenW (lpString=".MDF") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0085.500] lstrlenW (lpString=".DBF") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0085.500] lstrlenW (lpString=".DB") returned 3 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0085.500] lstrlenW (lpString=".db") returned 3 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0085.500] lstrlenW (lpString=".ndf") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0085.500] lstrlenW (lpString=".NDF") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0085.500] lstrlenW (lpString=".Mdf") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0085.500] lstrlenW (lpString=".dat") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0085.500] lstrlenW (lpString=".DAT") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0085.500] lstrlenW (lpString=".ldf") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0085.500] lstrlenW (lpString=".LDF") returned 4 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0085.500] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.500] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0085.501] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0085.501] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0085.501] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.501] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.502] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20550275394) returned 1 [0085.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1c59a90, dwHighDateTime=0x1d585b4)) [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27639c0 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27639c0 | out: hHeap=0x260000) returned 1 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a988 [0085.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a988 | out: hHeap=0x260000) returned 1 [0085.502] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0085.502] GetLastError () returned 0x0 [0085.503] GetLastError () returned 0x0 [0085.503] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0085.503] GetLastError () returned 0x0 [0085.503] GetLastError () returned 0x0 [0085.580] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffac8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.581] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x538, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x538, lpOverlapped=0x0) returned 1 [0085.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.581] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.581] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.581] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.581] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.581] CloseHandle (hObject=0xd8) returned 1 [0085.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0085.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.583] GetLastError () returned 0x0 [0085.583] RtlWakeConditionVariable () returned 0x27e828 [0085.583] GetCurrentThreadId () returned 0x9ac [0085.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.583] lstrlenW (lpString=".vhd") returned 4 [0085.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0085.583] lstrlenW (lpString=".vhdx") returned 5 [0085.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0085.583] lstrlenW (lpString=".pst") returned 4 [0085.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0085.583] lstrlenW (lpString=".ost") returned 4 [0085.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0085.584] lstrlenW (lpString=".bak") returned 4 [0085.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0085.584] lstrlenW (lpString=".bac") returned 4 [0085.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0085.584] lstrlenW (lpString=".sys") returned 4 [0085.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0085.584] lstrlenW (lpString=".v2i") returned 4 [0085.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0085.584] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0085.585] lstrlenW (lpString=".sql") returned 4 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0085.585] lstrlenW (lpString=".mdf") returned 4 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0085.585] lstrlenW (lpString=".txt") returned 4 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0085.585] lstrlenW (lpString=".dbf") returned 4 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0085.585] lstrlenW (lpString=".ckp") returned 4 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0085.585] lstrlenW (lpString=".dacpac") returned 7 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0085.585] lstrlenW (lpString=".db3") returned 4 [0085.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0085.586] lstrlenW (lpString=".dtxs") returned 5 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0085.586] lstrlenW (lpString=".mdt") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0085.586] lstrlenW (lpString=".sdf") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0085.586] lstrlenW (lpString=".MDF") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0085.586] lstrlenW (lpString=".DBF") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0085.586] lstrlenW (lpString=".DB") returned 3 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0085.586] lstrlenW (lpString=".db") returned 3 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".db") returned 0x0 [0085.586] lstrlenW (lpString=".ndf") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0085.586] lstrlenW (lpString=".NDF") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0085.586] lstrlenW (lpString=".Mdf") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0085.586] lstrlenW (lpString=".dat") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0085.586] lstrlenW (lpString=".DAT") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0085.586] lstrlenW (lpString=".ldf") returned 4 [0085.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0085.587] lstrlenW (lpString=".LDF") returned 4 [0085.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0085.587] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.587] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0085.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.588] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.588] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20558892533) returned 1 [0085.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1d3e2d0, dwHighDateTime=0x1d585b4)) [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27637c8 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27637c8 | out: hHeap=0x260000) returned 1 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0085.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0085.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0085.589] GetLastError () returned 0x0 [0085.589] GetLastError () returned 0x0 [0085.589] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0085.589] GetLastError () returned 0x0 [0085.589] GetLastError () returned 0x0 [0085.601] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd151, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.601] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2eaf, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2eaf, lpOverlapped=0x0) returned 1 [0085.602] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0085.602] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.602] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.602] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.602] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.602] CloseHandle (hObject=0xd8) returned 1 [0085.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0085.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0085.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.604] GetLastError () returned 0x0 [0085.604] RtlWakeConditionVariable () returned 0x27e828 [0085.604] GetCurrentThreadId () returned 0x9ac [0085.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".ldf") returned 0x0 [0085.604] lstrlenW (lpString=".vhd") returned 4 [0085.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".vhd") returned 0x0 [0085.604] lstrlenW (lpString=".vhdx") returned 5 [0085.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".vhdx") returned 0x0 [0085.604] lstrlenW (lpString=".pst") returned 4 [0085.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".pst") returned 0x0 [0085.604] lstrlenW (lpString=".ost") returned 4 [0085.604] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".ost") returned 0x0 [0085.605] lstrlenW (lpString=".bak") returned 4 [0085.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".bak") returned 0x0 [0085.605] lstrlenW (lpString=".bac") returned 4 [0085.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".bac") returned 0x0 [0085.605] lstrlenW (lpString=".sys") returned 4 [0085.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".sys") returned 0x0 [0085.605] lstrlenW (lpString=".v2i") returned 4 [0085.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".v2i") returned 0x0 [0085.605] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0085.631] lstrlenW (lpString=".sql") returned 4 [0085.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".sql") returned 0x0 [0085.631] lstrlenW (lpString=".mdf") returned 4 [0085.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".mdf") returned 0x0 [0085.631] lstrlenW (lpString=".txt") returned 4 [0085.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".txt") returned 0x0 [0085.642] lstrlenW (lpString=".dbf") returned 4 [0085.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".dbf") returned 0x0 [0085.642] lstrlenW (lpString=".ckp") returned 4 [0085.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".ckp") returned 0x0 [0085.644] lstrlenW (lpString=".dacpac") returned 7 [0085.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".dacpac") returned 0x0 [0085.644] lstrlenW (lpString=".db3") returned 4 [0085.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".db3") returned 0x0 [0085.644] lstrlenW (lpString=".dtxs") returned 5 [0085.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".dtxs") returned 0x0 [0085.644] lstrlenW (lpString=".mdt") returned 4 [0085.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".mdt") returned 0x0 [0085.644] lstrlenW (lpString=".sdf") returned 4 [0085.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".sdf") returned 0x0 [0085.645] lstrlenW (lpString=".MDF") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".MDF") returned 0x0 [0085.645] lstrlenW (lpString=".DBF") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".DBF") returned 0x0 [0085.645] lstrlenW (lpString=".DB") returned 3 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".DB") returned 0x0 [0085.645] lstrlenW (lpString=".db") returned 3 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".db") returned 0x0 [0085.645] lstrlenW (lpString=".ndf") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".ndf") returned 0x0 [0085.645] lstrlenW (lpString=".NDF") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".NDF") returned 0x0 [0085.645] lstrlenW (lpString=".Mdf") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".Mdf") returned 0x0 [0085.645] lstrlenW (lpString=".dat") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".dat") returned 0x0 [0085.645] lstrlenW (lpString=".DAT") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".DAT") returned 0x0 [0085.645] lstrlenW (lpString=".ldf") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".ldf") returned 0x0 [0085.645] lstrlenW (lpString=".LDF") returned 4 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch=".LDF") returned 0x0 [0085.645] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.645] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.646] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0085.646] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.646] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.646] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.647] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20564773547) returned 1 [0085.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1dd6850, dwHighDateTime=0x1d585b4)) [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27636e8 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27636e8 | out: hHeap=0x260000) returned 1 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.647] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.647] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0085.647] GetLastError () returned 0x0 [0085.648] GetLastError () returned 0x0 [0085.648] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0085.648] GetLastError () returned 0x0 [0085.648] GetLastError () returned 0x0 [0085.650] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd5f1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.650] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2a0f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2a0f, lpOverlapped=0x0) returned 1 [0085.650] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.650] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.650] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.650] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.650] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.650] CloseHandle (hObject=0xd8) returned 1 [0085.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d4a8 [0085.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0085.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0085.652] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0085.652] GetLastError () returned 0x0 [0085.652] RtlWakeConditionVariable () returned 0x0 [0085.653] GetCurrentThreadId () returned 0x9ac [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".ldf") returned 0x0 [0085.653] lstrlenW (lpString=".vhd") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".vhd") returned 0x0 [0085.653] lstrlenW (lpString=".vhdx") returned 5 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".vhdx") returned 0x0 [0085.653] lstrlenW (lpString=".pst") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".pst") returned 0x0 [0085.653] lstrlenW (lpString=".ost") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".ost") returned 0x0 [0085.653] lstrlenW (lpString=".bak") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".bak") returned 0x0 [0085.653] lstrlenW (lpString=".bac") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".bac") returned 0x0 [0085.653] lstrlenW (lpString=".sys") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".sys") returned 0x0 [0085.653] lstrlenW (lpString=".v2i") returned 4 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".v2i") returned 0x0 [0085.653] lstrlenW (lpString="s\r\n.v2i") returned 7 [0085.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0085.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0085.655] lstrlenW (lpString=".sql") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".sql") returned 0x0 [0085.655] lstrlenW (lpString=".mdf") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".mdf") returned 0x0 [0085.655] lstrlenW (lpString=".txt") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".txt") returned 0x0 [0085.655] lstrlenW (lpString=".dbf") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".dbf") returned 0x0 [0085.655] lstrlenW (lpString=".ckp") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".ckp") returned 0x0 [0085.655] lstrlenW (lpString=".dacpac") returned 7 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".dacpac") returned 0x0 [0085.655] lstrlenW (lpString=".db3") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".db3") returned 0x0 [0085.655] lstrlenW (lpString=".dtxs") returned 5 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".dtxs") returned 0x0 [0085.655] lstrlenW (lpString=".mdt") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".mdt") returned 0x0 [0085.655] lstrlenW (lpString=".sdf") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".sdf") returned 0x0 [0085.655] lstrlenW (lpString=".MDF") returned 4 [0085.655] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".MDF") returned 0x0 [0085.655] lstrlenW (lpString=".DBF") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".DBF") returned 0x0 [0085.656] lstrlenW (lpString=".DB") returned 3 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".DB") returned 0x0 [0085.656] lstrlenW (lpString=".db") returned 3 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".db") returned 0x0 [0085.656] lstrlenW (lpString=".ndf") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".ndf") returned 0x0 [0085.656] lstrlenW (lpString=".NDF") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".NDF") returned 0x0 [0085.656] lstrlenW (lpString=".Mdf") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".Mdf") returned 0x0 [0085.656] lstrlenW (lpString=".dat") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".dat") returned 0x0 [0085.656] lstrlenW (lpString=".DAT") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".DAT") returned 0x0 [0085.656] lstrlenW (lpString=".ldf") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".ldf") returned 0x0 [0085.656] lstrlenW (lpString=".LDF") returned 4 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch=".LDF") returned 0x0 [0085.656] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0085.656] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0085.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0085.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0085.656] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0085.657] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0085.657] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0085.657] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0085.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0085.657] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0085.657] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20565861854) returned 1 [0085.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc1dd6850, dwHighDateTime=0x1d585b4)) [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27636b0 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0085.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27636b0 | out: hHeap=0x260000) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0085.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ae20 [0085.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0085.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0085.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ae20 | out: hHeap=0x260000) returned 1 [0085.658] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0085.658] GetLastError () returned 0x0 [0085.659] GetLastError () returned 0x0 [0085.659] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0085.659] GetLastError () returned 0x0 [0085.659] GetLastError () returned 0x0 [0085.741] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff41b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.741] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbe5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xbe5, lpOverlapped=0x0) returned 1 [0085.741] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0085.741] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.741] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0085.741] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0085.741] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0085.741] CloseHandle (hObject=0xd8) returned 1 [0085.741] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0085.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.018] GetLastError () returned 0x0 [0086.018] RtlWakeConditionVariable () returned 0x0 [0086.019] GetCurrentThreadId () returned 0x9ac [0086.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".ldf") returned 0x0 [0086.019] lstrlenW (lpString=".vhd") returned 4 [0086.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".vhd") returned 0x0 [0086.019] lstrlenW (lpString=".vhdx") returned 5 [0086.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.019] lstrlenW (lpString=".pst") returned 4 [0086.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".pst") returned 0x0 [0086.019] lstrlenW (lpString=".ost") returned 4 [0086.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".ost") returned 0x0 [0086.019] lstrlenW (lpString=".bak") returned 4 [0086.019] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".bak") returned 0x0 [0086.019] lstrlenW (lpString=".bac") returned 4 [0086.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".bac") returned 0x0 [0086.020] lstrlenW (lpString=".sys") returned 4 [0086.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".sys") returned 0x0 [0086.020] lstrlenW (lpString=".v2i") returned 4 [0086.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".v2i") returned 0x0 [0086.020] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.021] lstrlenW (lpString=".sql") returned 4 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".sql") returned 0x0 [0086.021] lstrlenW (lpString=".mdf") returned 4 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".mdf") returned 0x0 [0086.021] lstrlenW (lpString=".txt") returned 4 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".txt") returned 0x0 [0086.021] lstrlenW (lpString=".dbf") returned 4 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".dbf") returned 0x0 [0086.021] lstrlenW (lpString=".ckp") returned 4 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".ckp") returned 0x0 [0086.021] lstrlenW (lpString=".dacpac") returned 7 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.021] lstrlenW (lpString=".db3") returned 4 [0086.021] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".db3") returned 0x0 [0086.021] lstrlenW (lpString=".dtxs") returned 5 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.022] lstrlenW (lpString=".mdt") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".mdt") returned 0x0 [0086.022] lstrlenW (lpString=".sdf") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".sdf") returned 0x0 [0086.022] lstrlenW (lpString=".MDF") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".MDF") returned 0x0 [0086.022] lstrlenW (lpString=".DBF") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".DBF") returned 0x0 [0086.022] lstrlenW (lpString=".DB") returned 3 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".DB") returned 0x0 [0086.022] lstrlenW (lpString=".db") returned 3 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".db") returned 0x0 [0086.022] lstrlenW (lpString=".ndf") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".ndf") returned 0x0 [0086.022] lstrlenW (lpString=".NDF") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".NDF") returned 0x0 [0086.022] lstrlenW (lpString=".Mdf") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.022] lstrlenW (lpString=".dat") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".dat") returned 0x0 [0086.022] lstrlenW (lpString=".DAT") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".DAT") returned 0x0 [0086.022] lstrlenW (lpString=".ldf") returned 4 [0086.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".ldf") returned 0x0 [0086.022] lstrlenW (lpString=".LDF") returned 4 [0086.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch=".LDF") returned 0x0 [0086.023] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.023] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.023] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.023] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.024] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.024] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20602485912) returned 1 [0086.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2168950, dwHighDateTime=0x1d585b4)) [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763bb8 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763bb8 | out: hHeap=0x260000) returned 1 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.024] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.024] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.025] GetLastError () returned 0x0 [0086.025] GetLastError () returned 0x0 [0086.025] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.025] GetLastError () returned 0x0 [0086.025] GetLastError () returned 0x0 [0086.028] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.028] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x838, lpOverlapped=0x0) returned 1 [0086.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.029] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.029] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.029] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.029] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.029] CloseHandle (hObject=0xd8) returned 1 [0086.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.031] GetLastError () returned 0x0 [0086.031] RtlWakeConditionVariable () returned 0x0 [0086.031] GetCurrentThreadId () returned 0x9ac [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".ldf") returned 0x0 [0086.031] lstrlenW (lpString=".vhd") returned 4 [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".vhd") returned 0x0 [0086.031] lstrlenW (lpString=".vhdx") returned 5 [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".vhdx") returned 0x0 [0086.031] lstrlenW (lpString=".pst") returned 4 [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".pst") returned 0x0 [0086.031] lstrlenW (lpString=".ost") returned 4 [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".ost") returned 0x0 [0086.031] lstrlenW (lpString=".bak") returned 4 [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".bak") returned 0x0 [0086.031] lstrlenW (lpString=".bac") returned 4 [0086.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".bac") returned 0x0 [0086.031] lstrlenW (lpString=".sys") returned 4 [0086.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".sys") returned 0x0 [0086.032] lstrlenW (lpString=".v2i") returned 4 [0086.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".v2i") returned 0x0 [0086.032] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.034] lstrlenW (lpString=".sql") returned 4 [0086.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".sql") returned 0x0 [0086.034] lstrlenW (lpString=".mdf") returned 4 [0086.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".mdf") returned 0x0 [0086.034] lstrlenW (lpString=".txt") returned 4 [0086.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".txt") returned 0x0 [0086.034] lstrlenW (lpString=".dbf") returned 4 [0086.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".dbf") returned 0x0 [0086.034] lstrlenW (lpString=".ckp") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".ckp") returned 0x0 [0086.035] lstrlenW (lpString=".dacpac") returned 7 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".dacpac") returned 0x0 [0086.035] lstrlenW (lpString=".db3") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".db3") returned 0x0 [0086.035] lstrlenW (lpString=".dtxs") returned 5 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".dtxs") returned 0x0 [0086.035] lstrlenW (lpString=".mdt") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".mdt") returned 0x0 [0086.035] lstrlenW (lpString=".sdf") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".sdf") returned 0x0 [0086.035] lstrlenW (lpString=".MDF") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".MDF") returned 0x0 [0086.035] lstrlenW (lpString=".DBF") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".DBF") returned 0x0 [0086.035] lstrlenW (lpString=".DB") returned 3 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".DB") returned 0x0 [0086.035] lstrlenW (lpString=".db") returned 3 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".db") returned 0x0 [0086.035] lstrlenW (lpString=".ndf") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".ndf") returned 0x0 [0086.035] lstrlenW (lpString=".NDF") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".NDF") returned 0x0 [0086.035] lstrlenW (lpString=".Mdf") returned 4 [0086.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".Mdf") returned 0x0 [0086.035] lstrlenW (lpString=".dat") returned 4 [0086.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".dat") returned 0x0 [0086.036] lstrlenW (lpString=".DAT") returned 4 [0086.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".DAT") returned 0x0 [0086.036] lstrlenW (lpString=".ldf") returned 4 [0086.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".ldf") returned 0x0 [0086.036] lstrlenW (lpString=".LDF") returned 4 [0086.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch=".LDF") returned 0x0 [0086.036] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.036] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.037] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.037] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.037] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20603806511) returned 1 [0086.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc218eab0, dwHighDateTime=0x1d585b4)) [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b48 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b48 | out: hHeap=0x260000) returned 1 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.038] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.038] GetLastError () returned 0x0 [0086.038] GetLastError () returned 0x0 [0086.038] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.038] GetLastError () returned 0x0 [0086.038] GetLastError () returned 0x0 [0086.040] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffff9b06, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.040] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x64fa, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x64fa, lpOverlapped=0x0) returned 1 [0086.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.041] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.041] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.041] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.041] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.041] CloseHandle (hObject=0xd8) returned 1 [0086.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.042] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.042] GetLastError () returned 0x0 [0086.043] RtlWakeConditionVariable () returned 0x0 [0086.043] GetCurrentThreadId () returned 0x9ac [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.043] lstrlenW (lpString=".vhd") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0086.043] lstrlenW (lpString=".vhdx") returned 5 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.043] lstrlenW (lpString=".pst") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".pst") returned 0x0 [0086.043] lstrlenW (lpString=".ost") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".ost") returned 0x0 [0086.043] lstrlenW (lpString=".bak") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".bak") returned 0x0 [0086.043] lstrlenW (lpString=".bac") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".bac") returned 0x0 [0086.043] lstrlenW (lpString=".sys") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".sys") returned 0x0 [0086.043] lstrlenW (lpString=".v2i") returned 4 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0086.043] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.044] lstrlenW (lpString=".sql") returned 4 [0086.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".sql") returned 0x0 [0086.044] lstrlenW (lpString=".mdf") returned 4 [0086.044] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0086.044] lstrlenW (lpString=".txt") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".txt") returned 0x0 [0086.045] lstrlenW (lpString=".dbf") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0086.045] lstrlenW (lpString=".ckp") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0086.045] lstrlenW (lpString=".dacpac") returned 7 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.045] lstrlenW (lpString=".db3") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".db3") returned 0x0 [0086.045] lstrlenW (lpString=".dtxs") returned 5 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.045] lstrlenW (lpString=".mdt") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0086.045] lstrlenW (lpString=".sdf") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0086.045] lstrlenW (lpString=".MDF") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0086.045] lstrlenW (lpString=".DBF") returned 4 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0086.045] lstrlenW (lpString=".DB") returned 3 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".DB") returned 0x0 [0086.045] lstrlenW (lpString=".db") returned 3 [0086.045] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".db") returned 0x0 [0086.045] lstrlenW (lpString=".ndf") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0086.046] lstrlenW (lpString=".NDF") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0086.046] lstrlenW (lpString=".Mdf") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.046] lstrlenW (lpString=".dat") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".dat") returned 0x0 [0086.046] lstrlenW (lpString=".DAT") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0086.046] lstrlenW (lpString=".ldf") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0086.046] lstrlenW (lpString=".LDF") returned 4 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0086.046] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.046] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.047] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.047] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.047] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.047] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20604840939) returned 1 [0086.047] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc218eab0, dwHighDateTime=0x1d585b4)) [0086.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.047] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763b80 [0086.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763b80 | out: hHeap=0x260000) returned 1 [0086.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b168 [0086.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.048] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.048] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b168 | out: hHeap=0x260000) returned 1 [0086.048] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.048] GetLastError () returned 0x0 [0086.048] GetLastError () returned 0x0 [0086.048] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.049] GetLastError () returned 0x0 [0086.049] GetLastError () returned 0x0 [0086.124] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff0c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.124] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xf38, lpOverlapped=0x0) returned 1 [0086.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.124] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.124] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.124] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.125] CloseHandle (hObject=0xd8) returned 1 [0086.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2820770 [0086.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2820770 | out: hHeap=0x260000) returned 1 [0086.160] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.160] GetLastError () returned 0x0 [0086.160] RtlWakeConditionVariable () returned 0x0 [0086.160] GetCurrentThreadId () returned 0x9ac [0086.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.160] lstrlenW (lpString=".vhd") returned 4 [0086.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".vhd") returned 0x0 [0086.160] lstrlenW (lpString=".vhdx") returned 5 [0086.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.161] lstrlenW (lpString=".pst") returned 4 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".pst") returned 0x0 [0086.161] lstrlenW (lpString=".ost") returned 4 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".ost") returned 0x0 [0086.161] lstrlenW (lpString=".bak") returned 4 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".bak") returned 0x0 [0086.161] lstrlenW (lpString=".bac") returned 4 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".bac") returned 0x0 [0086.161] lstrlenW (lpString=".sys") returned 4 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".sys") returned 0x0 [0086.161] lstrlenW (lpString=".v2i") returned 4 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".v2i") returned 0x0 [0086.161] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.162] lstrlenW (lpString=".sql") returned 4 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".sql") returned 0x0 [0086.162] lstrlenW (lpString=".mdf") returned 4 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".mdf") returned 0x0 [0086.162] lstrlenW (lpString=".txt") returned 4 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".txt") returned 0x0 [0086.162] lstrlenW (lpString=".dbf") returned 4 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".dbf") returned 0x0 [0086.162] lstrlenW (lpString=".ckp") returned 4 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".ckp") returned 0x0 [0086.162] lstrlenW (lpString=".dacpac") returned 7 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.162] lstrlenW (lpString=".db3") returned 4 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".db3") returned 0x0 [0086.162] lstrlenW (lpString=".dtxs") returned 5 [0086.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.162] lstrlenW (lpString=".mdt") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".mdt") returned 0x0 [0086.163] lstrlenW (lpString=".sdf") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".sdf") returned 0x0 [0086.163] lstrlenW (lpString=".MDF") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".MDF") returned 0x0 [0086.163] lstrlenW (lpString=".DBF") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".DBF") returned 0x0 [0086.163] lstrlenW (lpString=".DB") returned 3 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".DB") returned 0x0 [0086.163] lstrlenW (lpString=".db") returned 3 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".db") returned 0x0 [0086.163] lstrlenW (lpString=".ndf") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".ndf") returned 0x0 [0086.163] lstrlenW (lpString=".NDF") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".NDF") returned 0x0 [0086.163] lstrlenW (lpString=".Mdf") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.163] lstrlenW (lpString=".dat") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".dat") returned 0x0 [0086.163] lstrlenW (lpString=".DAT") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".DAT") returned 0x0 [0086.163] lstrlenW (lpString=".ldf") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".ldf") returned 0x0 [0086.163] lstrlenW (lpString=".LDF") returned 4 [0086.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch=".LDF") returned 0x0 [0086.163] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.164] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.164] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.164] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.165] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20616576536) returned 1 [0086.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc22bf5b0, dwHighDateTime=0x1d585b4)) [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762aa8 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762aa8 | out: hHeap=0x260000) returned 1 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a988 [0086.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a988 | out: hHeap=0x260000) returned 1 [0086.165] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.166] GetLastError () returned 0x0 [0086.166] GetLastError () returned 0x0 [0086.166] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.166] GetLastError () returned 0x0 [0086.166] GetLastError () returned 0x0 [0086.168] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.168] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x838, lpOverlapped=0x0) returned 1 [0086.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.168] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.168] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.168] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.168] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.168] CloseHandle (hObject=0xd8) returned 1 [0086.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d4a8 [0086.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0086.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.169] GetLastError () returned 0x0 [0086.170] RtlWakeConditionVariable () returned 0x0 [0086.170] GetCurrentThreadId () returned 0x9ac [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".ldf") returned 0x0 [0086.170] lstrlenW (lpString=".vhd") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".vhd") returned 0x0 [0086.170] lstrlenW (lpString=".vhdx") returned 5 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".vhdx") returned 0x0 [0086.170] lstrlenW (lpString=".pst") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".pst") returned 0x0 [0086.170] lstrlenW (lpString=".ost") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".ost") returned 0x0 [0086.170] lstrlenW (lpString=".bak") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".bak") returned 0x0 [0086.170] lstrlenW (lpString=".bac") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".bac") returned 0x0 [0086.170] lstrlenW (lpString=".sys") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".sys") returned 0x0 [0086.170] lstrlenW (lpString=".v2i") returned 4 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".v2i") returned 0x0 [0086.170] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.171] lstrlenW (lpString=".sql") returned 4 [0086.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".sql") returned 0x0 [0086.171] lstrlenW (lpString=".mdf") returned 4 [0086.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".mdf") returned 0x0 [0086.171] lstrlenW (lpString=".txt") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".txt") returned 0x0 [0086.172] lstrlenW (lpString=".dbf") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".dbf") returned 0x0 [0086.172] lstrlenW (lpString=".ckp") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".ckp") returned 0x0 [0086.172] lstrlenW (lpString=".dacpac") returned 7 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".dacpac") returned 0x0 [0086.172] lstrlenW (lpString=".db3") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".db3") returned 0x0 [0086.172] lstrlenW (lpString=".dtxs") returned 5 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".dtxs") returned 0x0 [0086.172] lstrlenW (lpString=".mdt") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".mdt") returned 0x0 [0086.172] lstrlenW (lpString=".sdf") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".sdf") returned 0x0 [0086.172] lstrlenW (lpString=".MDF") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".MDF") returned 0x0 [0086.172] lstrlenW (lpString=".DBF") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".DBF") returned 0x0 [0086.172] lstrlenW (lpString=".DB") returned 3 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".DB") returned 0x0 [0086.172] lstrlenW (lpString=".db") returned 3 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".db") returned 0x0 [0086.172] lstrlenW (lpString=".ndf") returned 4 [0086.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".ndf") returned 0x0 [0086.172] lstrlenW (lpString=".NDF") returned 4 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".NDF") returned 0x0 [0086.173] lstrlenW (lpString=".Mdf") returned 4 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".Mdf") returned 0x0 [0086.173] lstrlenW (lpString=".dat") returned 4 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".dat") returned 0x0 [0086.173] lstrlenW (lpString=".DAT") returned 4 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".DAT") returned 0x0 [0086.173] lstrlenW (lpString=".ldf") returned 4 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".ldf") returned 0x0 [0086.173] lstrlenW (lpString=".LDF") returned 4 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch=".LDF") returned 0x0 [0086.173] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.173] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.173] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.174] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.174] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.174] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20617521966) returned 1 [0086.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc22bf5b0, dwHighDateTime=0x1d585b4)) [0086.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762a70 [0086.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762a70 | out: hHeap=0x260000) returned 1 [0086.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33af70 [0086.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33af70 | out: hHeap=0x260000) returned 1 [0086.175] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.175] GetLastError () returned 0x0 [0086.175] GetLastError () returned 0x0 [0086.175] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.176] GetLastError () returned 0x0 [0086.176] GetLastError () returned 0x0 [0086.177] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.178] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x450, lpOverlapped=0x0) returned 1 [0086.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.178] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.178] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.178] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.178] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.178] CloseHandle (hObject=0xd8) returned 1 [0086.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d4a8 [0086.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d4a8 | out: hHeap=0x260000) returned 1 [0086.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.179] GetLastError () returned 0x0 [0086.179] RtlWakeConditionVariable () returned 0x0 [0086.179] GetCurrentThreadId () returned 0x9ac [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.180] lstrlenW (lpString=".vhd") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".vhd") returned 0x0 [0086.180] lstrlenW (lpString=".vhdx") returned 5 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0086.180] lstrlenW (lpString=".pst") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".pst") returned 0x0 [0086.180] lstrlenW (lpString=".ost") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".ost") returned 0x0 [0086.180] lstrlenW (lpString=".bak") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".bak") returned 0x0 [0086.180] lstrlenW (lpString=".bac") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".bac") returned 0x0 [0086.180] lstrlenW (lpString=".sys") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".sys") returned 0x0 [0086.180] lstrlenW (lpString=".v2i") returned 4 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".v2i") returned 0x0 [0086.180] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.181] lstrlenW (lpString=".sql") returned 4 [0086.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".sql") returned 0x0 [0086.181] lstrlenW (lpString=".mdf") returned 4 [0086.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".mdf") returned 0x0 [0086.181] lstrlenW (lpString=".txt") returned 4 [0086.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".txt") returned 0x0 [0086.181] lstrlenW (lpString=".dbf") returned 4 [0086.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".dbf") returned 0x0 [0086.181] lstrlenW (lpString=".ckp") returned 4 [0086.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".ckp") returned 0x0 [0086.182] lstrlenW (lpString=".dacpac") returned 7 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0086.182] lstrlenW (lpString=".db3") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".db3") returned 0x0 [0086.182] lstrlenW (lpString=".dtxs") returned 5 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0086.182] lstrlenW (lpString=".mdt") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".mdt") returned 0x0 [0086.182] lstrlenW (lpString=".sdf") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".sdf") returned 0x0 [0086.182] lstrlenW (lpString=".MDF") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".MDF") returned 0x0 [0086.182] lstrlenW (lpString=".DBF") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".DBF") returned 0x0 [0086.182] lstrlenW (lpString=".DB") returned 3 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".DB") returned 0x0 [0086.182] lstrlenW (lpString=".db") returned 3 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".db") returned 0x0 [0086.182] lstrlenW (lpString=".ndf") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".ndf") returned 0x0 [0086.182] lstrlenW (lpString=".NDF") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".NDF") returned 0x0 [0086.182] lstrlenW (lpString=".Mdf") returned 4 [0086.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0086.182] lstrlenW (lpString=".dat") returned 4 [0086.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".dat") returned 0x0 [0086.183] lstrlenW (lpString=".DAT") returned 4 [0086.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".DAT") returned 0x0 [0086.183] lstrlenW (lpString=".ldf") returned 4 [0086.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".ldf") returned 0x0 [0086.183] lstrlenW (lpString=".LDF") returned 4 [0086.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch=".LDF") returned 0x0 [0086.183] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.183] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.184] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.184] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20618505238) returned 1 [0086.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc22e5710, dwHighDateTime=0x1d585b4)) [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2762a38 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2762a38 | out: hHeap=0x260000) returned 1 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a988 [0086.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a988 | out: hHeap=0x260000) returned 1 [0086.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.185] GetLastError () returned 0x0 [0086.185] GetLastError () returned 0x0 [0086.185] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.185] GetLastError () returned 0x0 [0086.185] GetLastError () returned 0x0 [0086.192] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffabcf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.192] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5431, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x5431, lpOverlapped=0x0) returned 1 [0086.192] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.192] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.192] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.192] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.192] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.193] CloseHandle (hObject=0xd8) returned 1 [0086.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x291d3c0 [0086.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291d3c0 | out: hHeap=0x260000) returned 1 [0086.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.196] GetLastError () returned 0x0 [0086.196] RtlWakeConditionVariable () returned 0x0 [0086.196] GetCurrentThreadId () returned 0x9ac [0086.196] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".ldf") returned 0x0 [0086.196] lstrlenW (lpString=".vhd") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".vhd") returned 0x0 [0086.197] lstrlenW (lpString=".vhdx") returned 5 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".vhdx") returned 0x0 [0086.197] lstrlenW (lpString=".pst") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".pst") returned 0x0 [0086.197] lstrlenW (lpString=".ost") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".ost") returned 0x0 [0086.197] lstrlenW (lpString=".bak") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".bak") returned 0x0 [0086.197] lstrlenW (lpString=".bac") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".bac") returned 0x0 [0086.197] lstrlenW (lpString=".sys") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".sys") returned 0x0 [0086.197] lstrlenW (lpString=".v2i") returned 4 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".v2i") returned 0x0 [0086.197] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.198] lstrlenW (lpString=".sql") returned 4 [0086.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".sql") returned 0x0 [0086.198] lstrlenW (lpString=".mdf") returned 4 [0086.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".mdf") returned 0x0 [0086.198] lstrlenW (lpString=".txt") returned 4 [0086.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".txt") returned 0x0 [0086.198] lstrlenW (lpString=".dbf") returned 4 [0086.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".dbf") returned 0x0 [0086.198] lstrlenW (lpString=".ckp") returned 4 [0086.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".ckp") returned 0x0 [0086.198] lstrlenW (lpString=".dacpac") returned 7 [0086.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".dacpac") returned 0x0 [0086.198] lstrlenW (lpString=".db3") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".db3") returned 0x0 [0086.199] lstrlenW (lpString=".dtxs") returned 5 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".dtxs") returned 0x0 [0086.199] lstrlenW (lpString=".mdt") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".mdt") returned 0x0 [0086.199] lstrlenW (lpString=".sdf") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".sdf") returned 0x0 [0086.199] lstrlenW (lpString=".MDF") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".MDF") returned 0x0 [0086.199] lstrlenW (lpString=".DBF") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".DBF") returned 0x0 [0086.199] lstrlenW (lpString=".DB") returned 3 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".DB") returned 0x0 [0086.199] lstrlenW (lpString=".db") returned 3 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".db") returned 0x0 [0086.199] lstrlenW (lpString=".ndf") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".ndf") returned 0x0 [0086.199] lstrlenW (lpString=".NDF") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".NDF") returned 0x0 [0086.199] lstrlenW (lpString=".Mdf") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".Mdf") returned 0x0 [0086.199] lstrlenW (lpString=".dat") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".dat") returned 0x0 [0086.199] lstrlenW (lpString=".DAT") returned 4 [0086.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".DAT") returned 0x0 [0086.199] lstrlenW (lpString=".ldf") returned 4 [0086.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".ldf") returned 0x0 [0086.200] lstrlenW (lpString=".LDF") returned 4 [0086.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch=".LDF") returned 0x0 [0086.200] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0086.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0086.200] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.201] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0086.201] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277f988 [0086.201] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20620190331) returned 1 [0086.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc230b870, dwHighDateTime=0x1d585b4)) [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27629c8 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0086.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27629c8 | out: hHeap=0x260000) returned 1 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33a4f0 [0086.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.201] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33a4f0 | out: hHeap=0x260000) returned 1 [0086.201] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.202] GetLastError () returned 0x0 [0086.202] GetLastError () returned 0x0 [0086.202] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.202] GetLastError () returned 0x0 [0086.202] GetLastError () returned 0x0 [0086.246] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe66b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.246] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1995, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1995, lpOverlapped=0x0) returned 1 [0086.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.246] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.246] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.246] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.246] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.247] CloseHandle (hObject=0xd8) returned 1 [0086.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x30e970 [0086.346] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x30e970 | out: hHeap=0x260000) returned 1 [0086.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0086.348] GetLastError () returned 0x0 [0086.348] RtlWakeConditionVariable () returned 0x0 [0086.348] GetCurrentThreadId () returned 0x9ac [0086.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".ldf") returned 0x0 [0086.348] lstrlenW (lpString=".vhd") returned 4 [0086.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".vhd") returned 0x0 [0086.348] lstrlenW (lpString=".vhdx") returned 5 [0086.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.348] lstrlenW (lpString=".pst") returned 4 [0086.348] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".pst") returned 0x0 [0086.348] lstrlenW (lpString=".ost") returned 4 [0086.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".ost") returned 0x0 [0086.349] lstrlenW (lpString=".bak") returned 4 [0086.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".bak") returned 0x0 [0086.349] lstrlenW (lpString=".bac") returned 4 [0086.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".bac") returned 0x0 [0086.349] lstrlenW (lpString=".sys") returned 4 [0086.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".sys") returned 0x0 [0086.349] lstrlenW (lpString=".v2i") returned 4 [0086.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".v2i") returned 0x0 [0086.349] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.349] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.368] lstrlenW (lpString=".sql") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".sql") returned 0x0 [0086.368] lstrlenW (lpString=".mdf") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".mdf") returned 0x0 [0086.368] lstrlenW (lpString=".txt") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".txt") returned 0x0 [0086.368] lstrlenW (lpString=".dbf") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".dbf") returned 0x0 [0086.368] lstrlenW (lpString=".ckp") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".ckp") returned 0x0 [0086.368] lstrlenW (lpString=".dacpac") returned 7 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.368] lstrlenW (lpString=".db3") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".db3") returned 0x0 [0086.368] lstrlenW (lpString=".dtxs") returned 5 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.368] lstrlenW (lpString=".mdt") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".mdt") returned 0x0 [0086.368] lstrlenW (lpString=".sdf") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".sdf") returned 0x0 [0086.368] lstrlenW (lpString=".MDF") returned 4 [0086.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".MDF") returned 0x0 [0086.368] lstrlenW (lpString=".DBF") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".DBF") returned 0x0 [0086.369] lstrlenW (lpString=".DB") returned 3 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".DB") returned 0x0 [0086.369] lstrlenW (lpString=".db") returned 3 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".db") returned 0x0 [0086.369] lstrlenW (lpString=".ndf") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".ndf") returned 0x0 [0086.369] lstrlenW (lpString=".NDF") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".NDF") returned 0x0 [0086.369] lstrlenW (lpString=".Mdf") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.369] lstrlenW (lpString=".dat") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".dat") returned 0x0 [0086.369] lstrlenW (lpString=".DAT") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".DAT") returned 0x0 [0086.369] lstrlenW (lpString=".ldf") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".ldf") returned 0x0 [0086.369] lstrlenW (lpString=".LDF") returned 4 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch=".LDF") returned 0x0 [0086.369] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.369] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.370] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.370] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.370] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20637153100) returned 1 [0086.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc24ae790, dwHighDateTime=0x1d585b4)) [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295498 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295498 | out: hHeap=0x260000) returned 1 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.371] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.371] GetLastError () returned 0x0 [0086.371] GetLastError () returned 0x0 [0086.372] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.372] GetLastError () returned 0x0 [0086.372] GetLastError () returned 0x0 [0086.375] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe390, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.375] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c70, lpOverlapped=0x0) returned 1 [0086.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.375] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.375] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.375] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.375] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.375] CloseHandle (hObject=0xd8) returned 1 [0086.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d2378 [0086.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d2378 | out: hHeap=0x260000) returned 1 [0086.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.377] GetLastError () returned 0x0 [0086.377] RtlWakeConditionVariable () returned 0x0 [0086.377] GetCurrentThreadId () returned 0x9ac [0086.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".ldf") returned 0x0 [0086.378] lstrlenW (lpString=".vhd") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".vhd") returned 0x0 [0086.378] lstrlenW (lpString=".vhdx") returned 5 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.378] lstrlenW (lpString=".pst") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".pst") returned 0x0 [0086.378] lstrlenW (lpString=".ost") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".ost") returned 0x0 [0086.378] lstrlenW (lpString=".bak") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".bak") returned 0x0 [0086.378] lstrlenW (lpString=".bac") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".bac") returned 0x0 [0086.378] lstrlenW (lpString=".sys") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".sys") returned 0x0 [0086.378] lstrlenW (lpString=".v2i") returned 4 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".v2i") returned 0x0 [0086.378] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.379] lstrlenW (lpString=".sql") returned 4 [0086.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".sql") returned 0x0 [0086.379] lstrlenW (lpString=".mdf") returned 4 [0086.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".mdf") returned 0x0 [0086.379] lstrlenW (lpString=".txt") returned 4 [0086.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".txt") returned 0x0 [0086.379] lstrlenW (lpString=".dbf") returned 4 [0086.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".dbf") returned 0x0 [0086.379] lstrlenW (lpString=".ckp") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".ckp") returned 0x0 [0086.380] lstrlenW (lpString=".dacpac") returned 7 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.380] lstrlenW (lpString=".db3") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".db3") returned 0x0 [0086.380] lstrlenW (lpString=".dtxs") returned 5 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.380] lstrlenW (lpString=".mdt") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".mdt") returned 0x0 [0086.380] lstrlenW (lpString=".sdf") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".sdf") returned 0x0 [0086.380] lstrlenW (lpString=".MDF") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".MDF") returned 0x0 [0086.380] lstrlenW (lpString=".DBF") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".DBF") returned 0x0 [0086.380] lstrlenW (lpString=".DB") returned 3 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".DB") returned 0x0 [0086.380] lstrlenW (lpString=".db") returned 3 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".db") returned 0x0 [0086.380] lstrlenW (lpString=".ndf") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".ndf") returned 0x0 [0086.380] lstrlenW (lpString=".NDF") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".NDF") returned 0x0 [0086.380] lstrlenW (lpString=".Mdf") returned 4 [0086.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.380] lstrlenW (lpString=".dat") returned 4 [0086.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".dat") returned 0x0 [0086.381] lstrlenW (lpString=".DAT") returned 4 [0086.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".DAT") returned 0x0 [0086.381] lstrlenW (lpString=".ldf") returned 4 [0086.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".ldf") returned 0x0 [0086.381] lstrlenW (lpString=".LDF") returned 4 [0086.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch=".LDF") returned 0x0 [0086.381] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.381] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.382] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.382] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.382] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20638312720) returned 1 [0086.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc24d48f0, dwHighDateTime=0x1d585b4)) [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295460 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295460 | out: hHeap=0x260000) returned 1 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.383] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.383] GetLastError () returned 0x0 [0086.383] GetLastError () returned 0x0 [0086.383] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.383] GetLastError () returned 0x0 [0086.383] GetLastError () returned 0x0 [0086.385] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.385] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c6e, lpOverlapped=0x0) returned 1 [0086.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.385] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.386] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.386] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.386] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.386] CloseHandle (hObject=0xd8) returned 1 [0086.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2d2378 [0086.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d2378 | out: hHeap=0x260000) returned 1 [0086.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.388] GetLastError () returned 0x0 [0086.388] RtlWakeConditionVariable () returned 0x27e828 [0086.388] GetCurrentThreadId () returned 0x9ac [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".ldf") returned 0x0 [0086.388] lstrlenW (lpString=".vhd") returned 4 [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".vhd") returned 0x0 [0086.388] lstrlenW (lpString=".vhdx") returned 5 [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".vhdx") returned 0x0 [0086.388] lstrlenW (lpString=".pst") returned 4 [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".pst") returned 0x0 [0086.388] lstrlenW (lpString=".ost") returned 4 [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".ost") returned 0x0 [0086.388] lstrlenW (lpString=".bak") returned 4 [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".bak") returned 0x0 [0086.388] lstrlenW (lpString=".bac") returned 4 [0086.388] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".bac") returned 0x0 [0086.388] lstrlenW (lpString=".sys") returned 4 [0086.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".sys") returned 0x0 [0086.389] lstrlenW (lpString=".v2i") returned 4 [0086.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".v2i") returned 0x0 [0086.389] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.390] lstrlenW (lpString=".sql") returned 4 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".sql") returned 0x0 [0086.390] lstrlenW (lpString=".mdf") returned 4 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".mdf") returned 0x0 [0086.390] lstrlenW (lpString=".txt") returned 4 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".txt") returned 0x0 [0086.390] lstrlenW (lpString=".dbf") returned 4 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".dbf") returned 0x0 [0086.390] lstrlenW (lpString=".ckp") returned 4 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".ckp") returned 0x0 [0086.390] lstrlenW (lpString=".dacpac") returned 7 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".dacpac") returned 0x0 [0086.390] lstrlenW (lpString=".db3") returned 4 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".db3") returned 0x0 [0086.390] lstrlenW (lpString=".dtxs") returned 5 [0086.390] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".dtxs") returned 0x0 [0086.391] lstrlenW (lpString=".mdt") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".mdt") returned 0x0 [0086.391] lstrlenW (lpString=".sdf") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".sdf") returned 0x0 [0086.391] lstrlenW (lpString=".MDF") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".MDF") returned 0x0 [0086.391] lstrlenW (lpString=".DBF") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".DBF") returned 0x0 [0086.391] lstrlenW (lpString=".DB") returned 3 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".DB") returned 0x0 [0086.391] lstrlenW (lpString=".db") returned 3 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".db") returned 0x0 [0086.391] lstrlenW (lpString=".ndf") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".ndf") returned 0x0 [0086.391] lstrlenW (lpString=".NDF") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".NDF") returned 0x0 [0086.391] lstrlenW (lpString=".Mdf") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".Mdf") returned 0x0 [0086.391] lstrlenW (lpString=".dat") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".dat") returned 0x0 [0086.391] lstrlenW (lpString=".DAT") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".DAT") returned 0x0 [0086.391] lstrlenW (lpString=".ldf") returned 4 [0086.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".ldf") returned 0x0 [0086.391] lstrlenW (lpString=".LDF") returned 4 [0086.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch=".LDF") returned 0x0 [0086.392] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.392] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.392] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.393] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.393] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20639386566) returned 1 [0086.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc24faa50, dwHighDateTime=0x1d585b4)) [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c758 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c758 | out: hHeap=0x260000) returned 1 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.394] GetLastError () returned 0x0 [0086.394] GetLastError () returned 0x0 [0086.394] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.394] GetLastError () returned 0x0 [0086.394] GetLastError () returned 0x0 [0086.396] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffb922, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.396] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x46de, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x46de, lpOverlapped=0x0) returned 1 [0086.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.396] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.396] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.397] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.397] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.397] CloseHandle (hObject=0xd8) returned 1 [0086.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.398] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.398] GetLastError () returned 0x0 [0086.398] RtlWakeConditionVariable () returned 0x27e828 [0086.398] GetCurrentThreadId () returned 0x9ac [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".ldf") returned 0x0 [0086.399] lstrlenW (lpString=".vhd") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".vhd") returned 0x0 [0086.399] lstrlenW (lpString=".vhdx") returned 5 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.399] lstrlenW (lpString=".pst") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".pst") returned 0x0 [0086.399] lstrlenW (lpString=".ost") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".ost") returned 0x0 [0086.399] lstrlenW (lpString=".bak") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".bak") returned 0x0 [0086.399] lstrlenW (lpString=".bac") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".bac") returned 0x0 [0086.399] lstrlenW (lpString=".sys") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".sys") returned 0x0 [0086.399] lstrlenW (lpString=".v2i") returned 4 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".v2i") returned 0x0 [0086.399] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.400] lstrlenW (lpString=".sql") returned 4 [0086.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".sql") returned 0x0 [0086.400] lstrlenW (lpString=".mdf") returned 4 [0086.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".mdf") returned 0x0 [0086.400] lstrlenW (lpString=".txt") returned 4 [0086.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".txt") returned 0x0 [0086.400] lstrlenW (lpString=".dbf") returned 4 [0086.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".dbf") returned 0x0 [0086.400] lstrlenW (lpString=".ckp") returned 4 [0086.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".ckp") returned 0x0 [0086.400] lstrlenW (lpString=".dacpac") returned 7 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.401] lstrlenW (lpString=".db3") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".db3") returned 0x0 [0086.401] lstrlenW (lpString=".dtxs") returned 5 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.401] lstrlenW (lpString=".mdt") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".mdt") returned 0x0 [0086.401] lstrlenW (lpString=".sdf") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".sdf") returned 0x0 [0086.401] lstrlenW (lpString=".MDF") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".MDF") returned 0x0 [0086.401] lstrlenW (lpString=".DBF") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".DBF") returned 0x0 [0086.401] lstrlenW (lpString=".DB") returned 3 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".DB") returned 0x0 [0086.401] lstrlenW (lpString=".db") returned 3 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".db") returned 0x0 [0086.401] lstrlenW (lpString=".ndf") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".ndf") returned 0x0 [0086.401] lstrlenW (lpString=".NDF") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".NDF") returned 0x0 [0086.401] lstrlenW (lpString=".Mdf") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.401] lstrlenW (lpString=".dat") returned 4 [0086.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".dat") returned 0x0 [0086.401] lstrlenW (lpString=".DAT") returned 4 [0086.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".DAT") returned 0x0 [0086.402] lstrlenW (lpString=".ldf") returned 4 [0086.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".ldf") returned 0x0 [0086.402] lstrlenW (lpString=".LDF") returned 4 [0086.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch=".LDF") returned 0x0 [0086.402] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0086.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.402] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.403] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.403] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0086.403] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20640399988) returned 1 [0086.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc24faa50, dwHighDateTime=0x1d585b4)) [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33c790 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33c790 | out: hHeap=0x260000) returned 1 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.403] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.404] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.404] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.404] GetLastError () returned 0x0 [0086.404] GetLastError () returned 0x0 [0086.404] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.404] GetLastError () returned 0x0 [0086.404] GetLastError () returned 0x0 [0086.481] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffe392, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.500] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1c6e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1c6e, lpOverlapped=0x0) returned 1 [0086.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.511] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.511] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.511] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.511] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.511] CloseHandle (hObject=0xd8) returned 1 [0086.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0086.631] GetLastError () returned 0x0 [0086.631] RtlWakeConditionVariable () returned 0x0 [0086.631] GetCurrentThreadId () returned 0x9ac [0086.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".ldf") returned 0x0 [0086.631] lstrlenW (lpString=".vhd") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".vhd") returned 0x0 [0086.632] lstrlenW (lpString=".vhdx") returned 5 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".vhdx") returned 0x0 [0086.632] lstrlenW (lpString=".pst") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".pst") returned 0x0 [0086.632] lstrlenW (lpString=".ost") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".ost") returned 0x0 [0086.632] lstrlenW (lpString=".bak") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".bak") returned 0x0 [0086.632] lstrlenW (lpString=".bac") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".bac") returned 0x0 [0086.632] lstrlenW (lpString=".sys") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".sys") returned 0x0 [0086.632] lstrlenW (lpString=".v2i") returned 4 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".v2i") returned 0x0 [0086.632] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0086.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.704] lstrlenW (lpString=".sql") returned 4 [0086.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".sql") returned 0x0 [0086.704] lstrlenW (lpString=".mdf") returned 4 [0086.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".mdf") returned 0x0 [0086.704] lstrlenW (lpString=".txt") returned 4 [0086.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".txt") returned 0x0 [0086.704] lstrlenW (lpString=".dbf") returned 4 [0086.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".dbf") returned 0x0 [0086.704] lstrlenW (lpString=".ckp") returned 4 [0086.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".ckp") returned 0x0 [0086.705] lstrlenW (lpString=".dacpac") returned 7 [0086.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".dacpac") returned 0x0 [0086.705] lstrlenW (lpString=".db3") returned 4 [0086.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".db3") returned 0x0 [0086.713] lstrlenW (lpString=".dtxs") returned 5 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".dtxs") returned 0x0 [0086.713] lstrlenW (lpString=".mdt") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".mdt") returned 0x0 [0086.713] lstrlenW (lpString=".sdf") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".sdf") returned 0x0 [0086.713] lstrlenW (lpString=".MDF") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".MDF") returned 0x0 [0086.713] lstrlenW (lpString=".DBF") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".DBF") returned 0x0 [0086.713] lstrlenW (lpString=".DB") returned 3 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".DB") returned 0x0 [0086.713] lstrlenW (lpString=".db") returned 3 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".db") returned 0x0 [0086.713] lstrlenW (lpString=".ndf") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".ndf") returned 0x0 [0086.713] lstrlenW (lpString=".NDF") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".NDF") returned 0x0 [0086.713] lstrlenW (lpString=".Mdf") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".Mdf") returned 0x0 [0086.713] lstrlenW (lpString=".dat") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".dat") returned 0x0 [0086.713] lstrlenW (lpString=".DAT") returned 4 [0086.713] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".DAT") returned 0x0 [0086.713] lstrlenW (lpString=".ldf") returned 4 [0086.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".ldf") returned 0x0 [0086.714] lstrlenW (lpString=".LDF") returned 4 [0086.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch=".LDF") returned 0x0 [0086.714] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.714] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.714] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.715] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.715] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.715] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20671593298) returned 1 [0086.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc27f45d0, dwHighDateTime=0x1d585b4)) [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295428 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295428 | out: hHeap=0x260000) returned 1 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.715] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.716] GetLastError () returned 0x0 [0086.716] GetLastError () returned 0x0 [0086.716] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.716] GetLastError () returned 0x0 [0086.716] GetLastError () returned 0x0 [0086.719] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff7c8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.719] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x838, lpOverlapped=0x0) returned 1 [0086.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.719] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.720] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.720] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.720] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.720] CloseHandle (hObject=0xd8) returned 1 [0086.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.720] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0086.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.722] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.722] GetLastError () returned 0x0 [0086.722] RtlWakeConditionVariable () returned 0x0 [0086.722] GetCurrentThreadId () returned 0x9ac [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".ldf") returned 0x0 [0086.722] lstrlenW (lpString=".vhd") returned 4 [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".vhd") returned 0x0 [0086.722] lstrlenW (lpString=".vhdx") returned 5 [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".vhdx") returned 0x0 [0086.722] lstrlenW (lpString=".pst") returned 4 [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".pst") returned 0x0 [0086.722] lstrlenW (lpString=".ost") returned 4 [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".ost") returned 0x0 [0086.722] lstrlenW (lpString=".bak") returned 4 [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".bak") returned 0x0 [0086.722] lstrlenW (lpString=".bac") returned 4 [0086.722] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".bac") returned 0x0 [0086.722] lstrlenW (lpString=".sys") returned 4 [0086.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".sys") returned 0x0 [0086.723] lstrlenW (lpString=".v2i") returned 4 [0086.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".v2i") returned 0x0 [0086.723] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.723] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.724] lstrlenW (lpString=".sql") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".sql") returned 0x0 [0086.724] lstrlenW (lpString=".mdf") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".mdf") returned 0x0 [0086.724] lstrlenW (lpString=".txt") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".txt") returned 0x0 [0086.724] lstrlenW (lpString=".dbf") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".dbf") returned 0x0 [0086.724] lstrlenW (lpString=".ckp") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".ckp") returned 0x0 [0086.724] lstrlenW (lpString=".dacpac") returned 7 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".dacpac") returned 0x0 [0086.724] lstrlenW (lpString=".db3") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".db3") returned 0x0 [0086.724] lstrlenW (lpString=".dtxs") returned 5 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".dtxs") returned 0x0 [0086.724] lstrlenW (lpString=".mdt") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".mdt") returned 0x0 [0086.724] lstrlenW (lpString=".sdf") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".sdf") returned 0x0 [0086.724] lstrlenW (lpString=".MDF") returned 4 [0086.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".MDF") returned 0x0 [0086.725] lstrlenW (lpString=".DBF") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".DBF") returned 0x0 [0086.725] lstrlenW (lpString=".DB") returned 3 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".DB") returned 0x0 [0086.725] lstrlenW (lpString=".db") returned 3 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".db") returned 0x0 [0086.725] lstrlenW (lpString=".ndf") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".ndf") returned 0x0 [0086.725] lstrlenW (lpString=".NDF") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".NDF") returned 0x0 [0086.725] lstrlenW (lpString=".Mdf") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".Mdf") returned 0x0 [0086.725] lstrlenW (lpString=".dat") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".dat") returned 0x0 [0086.725] lstrlenW (lpString=".DAT") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".DAT") returned 0x0 [0086.725] lstrlenW (lpString=".ldf") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".ldf") returned 0x0 [0086.725] lstrlenW (lpString=".LDF") returned 4 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch=".LDF") returned 0x0 [0086.725] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.725] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.725] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.725] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.726] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.726] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.726] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.726] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.726] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20672757871) returned 1 [0086.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc281a730, dwHighDateTime=0x1d585b4)) [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295150 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295150 | out: hHeap=0x260000) returned 1 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.727] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.727] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.727] GetLastError () returned 0x0 [0086.728] GetLastError () returned 0x0 [0086.728] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.728] GetLastError () returned 0x0 [0086.728] GetLastError () returned 0x0 [0086.729] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff643, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.729] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x9bd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x9bd, lpOverlapped=0x0) returned 1 [0086.730] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.730] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.730] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.730] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.730] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.730] CloseHandle (hObject=0xd8) returned 1 [0086.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.730] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.732] GetLastError () returned 0x0 [0086.732] RtlWakeConditionVariable () returned 0x0 [0086.732] GetCurrentThreadId () returned 0x9ac [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".ldf") returned 0x0 [0086.732] lstrlenW (lpString=".vhd") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".vhd") returned 0x0 [0086.732] lstrlenW (lpString=".vhdx") returned 5 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".vhdx") returned 0x0 [0086.732] lstrlenW (lpString=".pst") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".pst") returned 0x0 [0086.732] lstrlenW (lpString=".ost") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".ost") returned 0x0 [0086.732] lstrlenW (lpString=".bak") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".bak") returned 0x0 [0086.732] lstrlenW (lpString=".bac") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".bac") returned 0x0 [0086.732] lstrlenW (lpString=".sys") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".sys") returned 0x0 [0086.732] lstrlenW (lpString=".v2i") returned 4 [0086.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".v2i") returned 0x0 [0086.733] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.733] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0086.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0086.734] lstrlenW (lpString=".sql") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".sql") returned 0x0 [0086.734] lstrlenW (lpString=".mdf") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".mdf") returned 0x0 [0086.734] lstrlenW (lpString=".txt") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".txt") returned 0x0 [0086.734] lstrlenW (lpString=".dbf") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".dbf") returned 0x0 [0086.734] lstrlenW (lpString=".ckp") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".ckp") returned 0x0 [0086.734] lstrlenW (lpString=".dacpac") returned 7 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".dacpac") returned 0x0 [0086.734] lstrlenW (lpString=".db3") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".db3") returned 0x0 [0086.734] lstrlenW (lpString=".dtxs") returned 5 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".dtxs") returned 0x0 [0086.734] lstrlenW (lpString=".mdt") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".mdt") returned 0x0 [0086.734] lstrlenW (lpString=".sdf") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".sdf") returned 0x0 [0086.734] lstrlenW (lpString=".MDF") returned 4 [0086.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".MDF") returned 0x0 [0086.734] lstrlenW (lpString=".DBF") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".DBF") returned 0x0 [0086.735] lstrlenW (lpString=".DB") returned 3 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".DB") returned 0x0 [0086.735] lstrlenW (lpString=".db") returned 3 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".db") returned 0x0 [0086.735] lstrlenW (lpString=".ndf") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".ndf") returned 0x0 [0086.735] lstrlenW (lpString=".NDF") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".NDF") returned 0x0 [0086.735] lstrlenW (lpString=".Mdf") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".Mdf") returned 0x0 [0086.735] lstrlenW (lpString=".dat") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".dat") returned 0x0 [0086.735] lstrlenW (lpString=".DAT") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".DAT") returned 0x0 [0086.735] lstrlenW (lpString=".ldf") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".ldf") returned 0x0 [0086.735] lstrlenW (lpString=".LDF") returned 4 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch=".LDF") returned 0x0 [0086.735] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0086.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.735] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.736] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.736] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0086.737] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20673771484) returned 1 [0086.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2840890, dwHighDateTime=0x1d585b4)) [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295188 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295188 | out: hHeap=0x260000) returned 1 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.737] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.737] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.737] GetLastError () returned 0x0 [0086.738] GetLastError () returned 0x0 [0086.738] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.738] GetLastError () returned 0x0 [0086.738] GetLastError () returned 0x0 [0086.820] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffdb13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.820] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x24ed, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x24ed, lpOverlapped=0x0) returned 1 [0086.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0086.820] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.820] WriteFile (in: hFile=0xd8, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.821] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.821] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.821] CloseHandle (hObject=0xd8) returned 1 [0086.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0086.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.822] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0086.822] GetLastError () returned 0x0 [0086.823] RtlWakeConditionVariable () returned 0x0 [0086.823] GetCurrentThreadId () returned 0x9ac [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".ldf") returned 0x0 [0086.823] lstrlenW (lpString=".vhd") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".vhd") returned 0x0 [0086.823] lstrlenW (lpString=".vhdx") returned 5 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".vhdx") returned 0x0 [0086.823] lstrlenW (lpString=".pst") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".pst") returned 0x0 [0086.823] lstrlenW (lpString=".ost") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".ost") returned 0x0 [0086.823] lstrlenW (lpString=".bak") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".bak") returned 0x0 [0086.823] lstrlenW (lpString=".bac") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".bac") returned 0x0 [0086.823] lstrlenW (lpString=".sys") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".sys") returned 0x0 [0086.823] lstrlenW (lpString=".v2i") returned 4 [0086.823] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".v2i") returned 0x0 [0086.824] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.824] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.834] lstrlenW (lpString=".sql") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".sql") returned 0x0 [0086.834] lstrlenW (lpString=".mdf") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".mdf") returned 0x0 [0086.834] lstrlenW (lpString=".txt") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".txt") returned 0x0 [0086.834] lstrlenW (lpString=".dbf") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".dbf") returned 0x0 [0086.834] lstrlenW (lpString=".ckp") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".ckp") returned 0x0 [0086.834] lstrlenW (lpString=".dacpac") returned 7 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".dacpac") returned 0x0 [0086.834] lstrlenW (lpString=".db3") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".db3") returned 0x0 [0086.834] lstrlenW (lpString=".dtxs") returned 5 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".dtxs") returned 0x0 [0086.834] lstrlenW (lpString=".mdt") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".mdt") returned 0x0 [0086.834] lstrlenW (lpString=".sdf") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".sdf") returned 0x0 [0086.834] lstrlenW (lpString=".MDF") returned 4 [0086.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".MDF") returned 0x0 [0086.835] lstrlenW (lpString=".DBF") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".DBF") returned 0x0 [0086.835] lstrlenW (lpString=".DB") returned 3 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".DB") returned 0x0 [0086.835] lstrlenW (lpString=".db") returned 3 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".db") returned 0x0 [0086.835] lstrlenW (lpString=".ndf") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".ndf") returned 0x0 [0086.835] lstrlenW (lpString=".NDF") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".NDF") returned 0x0 [0086.835] lstrlenW (lpString=".Mdf") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".Mdf") returned 0x0 [0086.835] lstrlenW (lpString=".dat") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".dat") returned 0x0 [0086.835] lstrlenW (lpString=".DAT") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".DAT") returned 0x0 [0086.835] lstrlenW (lpString=".ldf") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".ldf") returned 0x0 [0086.835] lstrlenW (lpString=".LDF") returned 4 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch=".LDF") returned 0x0 [0086.835] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.835] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.836] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.836] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20683753445) returned 1 [0086.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc29250d0, dwHighDateTime=0x1d585b4)) [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b10 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1b10 | out: hHeap=0x260000) returned 1 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.837] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.837] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.837] GetLastError () returned 0x0 [0086.837] GetLastError () returned 0x0 [0086.838] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.838] GetLastError () returned 0x0 [0086.838] GetLastError () returned 0x0 [0086.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff822d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.842] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x7dd3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x7dd3, lpOverlapped=0x0) returned 1 [0086.842] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.842] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.842] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.842] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.842] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.842] CloseHandle (hObject=0xf0) returned 1 [0086.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312f18 [0086.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312f18 | out: hHeap=0x260000) returned 1 [0086.844] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.844] GetLastError () returned 0x0 [0086.844] RtlWakeConditionVariable () returned 0x0 [0086.844] GetCurrentThreadId () returned 0x9ac [0086.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".ldf") returned 0x0 [0086.844] lstrlenW (lpString=".vhd") returned 4 [0086.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".vhd") returned 0x0 [0086.844] lstrlenW (lpString=".vhdx") returned 5 [0086.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".vhdx") returned 0x0 [0086.844] lstrlenW (lpString=".pst") returned 4 [0086.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".pst") returned 0x0 [0086.844] lstrlenW (lpString=".ost") returned 4 [0086.844] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".ost") returned 0x0 [0086.844] lstrlenW (lpString=".bak") returned 4 [0086.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".bak") returned 0x0 [0086.845] lstrlenW (lpString=".bac") returned 4 [0086.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".bac") returned 0x0 [0086.845] lstrlenW (lpString=".sys") returned 4 [0086.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".sys") returned 0x0 [0086.845] lstrlenW (lpString=".v2i") returned 4 [0086.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".v2i") returned 0x0 [0086.845] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.847] lstrlenW (lpString=".sql") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".sql") returned 0x0 [0086.847] lstrlenW (lpString=".mdf") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".mdf") returned 0x0 [0086.847] lstrlenW (lpString=".txt") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".txt") returned 0x0 [0086.847] lstrlenW (lpString=".dbf") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".dbf") returned 0x0 [0086.847] lstrlenW (lpString=".ckp") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".ckp") returned 0x0 [0086.847] lstrlenW (lpString=".dacpac") returned 7 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".dacpac") returned 0x0 [0086.847] lstrlenW (lpString=".db3") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".db3") returned 0x0 [0086.847] lstrlenW (lpString=".dtxs") returned 5 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".dtxs") returned 0x0 [0086.847] lstrlenW (lpString=".mdt") returned 4 [0086.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".mdt") returned 0x0 [0086.848] lstrlenW (lpString=".sdf") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".sdf") returned 0x0 [0086.848] lstrlenW (lpString=".MDF") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".MDF") returned 0x0 [0086.848] lstrlenW (lpString=".DBF") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".DBF") returned 0x0 [0086.848] lstrlenW (lpString=".DB") returned 3 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".DB") returned 0x0 [0086.848] lstrlenW (lpString=".db") returned 3 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".db") returned 0x0 [0086.848] lstrlenW (lpString=".ndf") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".ndf") returned 0x0 [0086.848] lstrlenW (lpString=".NDF") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".NDF") returned 0x0 [0086.848] lstrlenW (lpString=".Mdf") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".Mdf") returned 0x0 [0086.848] lstrlenW (lpString=".dat") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".dat") returned 0x0 [0086.848] lstrlenW (lpString=".DAT") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".DAT") returned 0x0 [0086.848] lstrlenW (lpString=".ldf") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".ldf") returned 0x0 [0086.848] lstrlenW (lpString=".LDF") returned 4 [0086.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch=".LDF") returned 0x0 [0086.848] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.849] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.849] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.849] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.850] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20685078694) returned 1 [0086.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc294b230, dwHighDateTime=0x1d585b4)) [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a18e0 | out: hHeap=0x260000) returned 1 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.850] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.851] GetLastError () returned 0x0 [0086.851] GetLastError () returned 0x0 [0086.851] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.851] GetLastError () returned 0x0 [0086.851] GetLastError () returned 0x0 [0086.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff4648, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.853] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb9b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9b8, lpOverlapped=0x0) returned 1 [0086.853] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.853] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.854] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.854] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.854] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.854] CloseHandle (hObject=0xf0) returned 1 [0086.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.856] GetLastError () returned 0x0 [0086.856] RtlWakeConditionVariable () returned 0x27e828 [0086.856] GetCurrentThreadId () returned 0x9ac [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".ldf") returned 0x0 [0086.856] lstrlenW (lpString=".vhd") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".vhd") returned 0x0 [0086.856] lstrlenW (lpString=".vhdx") returned 5 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".vhdx") returned 0x0 [0086.856] lstrlenW (lpString=".pst") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".pst") returned 0x0 [0086.856] lstrlenW (lpString=".ost") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".ost") returned 0x0 [0086.856] lstrlenW (lpString=".bak") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".bak") returned 0x0 [0086.856] lstrlenW (lpString=".bac") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".bac") returned 0x0 [0086.856] lstrlenW (lpString=".sys") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".sys") returned 0x0 [0086.856] lstrlenW (lpString=".v2i") returned 4 [0086.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".v2i") returned 0x0 [0086.856] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.858] lstrlenW (lpString=".sql") returned 4 [0086.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".sql") returned 0x0 [0086.858] lstrlenW (lpString=".mdf") returned 4 [0086.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".mdf") returned 0x0 [0086.858] lstrlenW (lpString=".txt") returned 4 [0086.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".txt") returned 0x0 [0086.859] lstrlenW (lpString=".dbf") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".dbf") returned 0x0 [0086.859] lstrlenW (lpString=".ckp") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".ckp") returned 0x0 [0086.859] lstrlenW (lpString=".dacpac") returned 7 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".dacpac") returned 0x0 [0086.859] lstrlenW (lpString=".db3") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".db3") returned 0x0 [0086.859] lstrlenW (lpString=".dtxs") returned 5 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".dtxs") returned 0x0 [0086.859] lstrlenW (lpString=".mdt") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".mdt") returned 0x0 [0086.859] lstrlenW (lpString=".sdf") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".sdf") returned 0x0 [0086.859] lstrlenW (lpString=".MDF") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".MDF") returned 0x0 [0086.859] lstrlenW (lpString=".DBF") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".DBF") returned 0x0 [0086.859] lstrlenW (lpString=".DB") returned 3 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".DB") returned 0x0 [0086.859] lstrlenW (lpString=".db") returned 3 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".db") returned 0x0 [0086.859] lstrlenW (lpString=".ndf") returned 4 [0086.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".ndf") returned 0x0 [0086.859] lstrlenW (lpString=".NDF") returned 4 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".NDF") returned 0x0 [0086.860] lstrlenW (lpString=".Mdf") returned 4 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".Mdf") returned 0x0 [0086.860] lstrlenW (lpString=".dat") returned 4 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".dat") returned 0x0 [0086.860] lstrlenW (lpString=".DAT") returned 4 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".DAT") returned 0x0 [0086.860] lstrlenW (lpString=".ldf") returned 4 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".ldf") returned 0x0 [0086.860] lstrlenW (lpString=".LDF") returned 4 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch=".LDF") returned 0x0 [0086.860] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0086.860] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.861] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0086.861] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0086.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.861] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20686239884) returned 1 [0086.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2971390, dwHighDateTime=0x1d585b4)) [0086.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0086.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1a68 | out: hHeap=0x260000) returned 1 [0086.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.862] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.862] GetLastError () returned 0x0 [0086.862] GetLastError () returned 0x0 [0086.862] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.863] GetLastError () returned 0x0 [0086.863] GetLastError () returned 0x0 [0086.945] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb145, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.945] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4ebb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ebb, lpOverlapped=0x0) returned 1 [0086.955] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.955] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.955] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.955] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.955] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.955] CloseHandle (hObject=0xf0) returned 1 [0086.955] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0086.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0086.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.957] GetLastError () returned 0x0 [0086.957] RtlWakeConditionVariable () returned 0x0 [0086.957] GetCurrentThreadId () returned 0x9ac [0086.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".ldf") returned 0x0 [0086.957] lstrlenW (lpString=".vhd") returned 4 [0086.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".vhd") returned 0x0 [0086.957] lstrlenW (lpString=".vhdx") returned 5 [0086.957] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".vhdx") returned 0x0 [0086.958] lstrlenW (lpString=".pst") returned 4 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".pst") returned 0x0 [0086.958] lstrlenW (lpString=".ost") returned 4 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".ost") returned 0x0 [0086.958] lstrlenW (lpString=".bak") returned 4 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".bak") returned 0x0 [0086.958] lstrlenW (lpString=".bac") returned 4 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".bac") returned 0x0 [0086.958] lstrlenW (lpString=".sys") returned 4 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".sys") returned 0x0 [0086.958] lstrlenW (lpString=".v2i") returned 4 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".v2i") returned 0x0 [0086.958] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.958] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.959] lstrlenW (lpString=".sql") returned 4 [0086.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".sql") returned 0x0 [0086.959] lstrlenW (lpString=".mdf") returned 4 [0086.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".mdf") returned 0x0 [0086.959] lstrlenW (lpString=".txt") returned 4 [0086.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".txt") returned 0x0 [0086.959] lstrlenW (lpString=".dbf") returned 4 [0086.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".dbf") returned 0x0 [0086.959] lstrlenW (lpString=".ckp") returned 4 [0086.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".ckp") returned 0x0 [0086.959] lstrlenW (lpString=".dacpac") returned 7 [0086.959] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".dacpac") returned 0x0 [0086.959] lstrlenW (lpString=".db3") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".db3") returned 0x0 [0086.960] lstrlenW (lpString=".dtxs") returned 5 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".dtxs") returned 0x0 [0086.960] lstrlenW (lpString=".mdt") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".mdt") returned 0x0 [0086.960] lstrlenW (lpString=".sdf") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".sdf") returned 0x0 [0086.960] lstrlenW (lpString=".MDF") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".MDF") returned 0x0 [0086.960] lstrlenW (lpString=".DBF") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".DBF") returned 0x0 [0086.960] lstrlenW (lpString=".DB") returned 3 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".DB") returned 0x0 [0086.960] lstrlenW (lpString=".db") returned 3 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".db") returned 0x0 [0086.960] lstrlenW (lpString=".ndf") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".ndf") returned 0x0 [0086.960] lstrlenW (lpString=".NDF") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".NDF") returned 0x0 [0086.960] lstrlenW (lpString=".Mdf") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".Mdf") returned 0x0 [0086.960] lstrlenW (lpString=".dat") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".dat") returned 0x0 [0086.960] lstrlenW (lpString=".DAT") returned 4 [0086.960] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".DAT") returned 0x0 [0086.960] lstrlenW (lpString=".ldf") returned 4 [0086.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".ldf") returned 0x0 [0086.961] lstrlenW (lpString=".LDF") returned 4 [0086.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch=".LDF") returned 0x0 [0086.961] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.961] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.961] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0086.961] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.962] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0086.962] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.962] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20696292627) returned 1 [0086.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2a55bd0, dwHighDateTime=0x1d585b4)) [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cec8 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cec8 | out: hHeap=0x260000) returned 1 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.962] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.962] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.962] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.963] GetLastError () returned 0x0 [0086.963] GetLastError () returned 0x0 [0086.963] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.963] GetLastError () returned 0x0 [0086.963] GetLastError () returned 0x0 [0086.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffc39c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.965] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x3c64, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3c64, lpOverlapped=0x0) returned 1 [0086.965] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.965] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.965] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.966] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.966] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.966] CloseHandle (hObject=0xf0) returned 1 [0086.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.967] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.967] GetLastError () returned 0x0 [0086.967] RtlWakeConditionVariable () returned 0x0 [0086.967] GetCurrentThreadId () returned 0x9ac [0086.967] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".ldf") returned 0x0 [0086.968] lstrlenW (lpString=".vhd") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".vhd") returned 0x0 [0086.968] lstrlenW (lpString=".vhdx") returned 5 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".vhdx") returned 0x0 [0086.968] lstrlenW (lpString=".pst") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".pst") returned 0x0 [0086.968] lstrlenW (lpString=".ost") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".ost") returned 0x0 [0086.968] lstrlenW (lpString=".bak") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".bak") returned 0x0 [0086.968] lstrlenW (lpString=".bac") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".bac") returned 0x0 [0086.968] lstrlenW (lpString=".sys") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".sys") returned 0x0 [0086.968] lstrlenW (lpString=".v2i") returned 4 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".v2i") returned 0x0 [0086.968] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.968] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.970] lstrlenW (lpString=".sql") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".sql") returned 0x0 [0086.970] lstrlenW (lpString=".mdf") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".mdf") returned 0x0 [0086.970] lstrlenW (lpString=".txt") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".txt") returned 0x0 [0086.970] lstrlenW (lpString=".dbf") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".dbf") returned 0x0 [0086.970] lstrlenW (lpString=".ckp") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".ckp") returned 0x0 [0086.970] lstrlenW (lpString=".dacpac") returned 7 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".dacpac") returned 0x0 [0086.970] lstrlenW (lpString=".db3") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".db3") returned 0x0 [0086.970] lstrlenW (lpString=".dtxs") returned 5 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".dtxs") returned 0x0 [0086.970] lstrlenW (lpString=".mdt") returned 4 [0086.970] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".mdt") returned 0x0 [0086.971] lstrlenW (lpString=".sdf") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".sdf") returned 0x0 [0086.971] lstrlenW (lpString=".MDF") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".MDF") returned 0x0 [0086.971] lstrlenW (lpString=".DBF") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".DBF") returned 0x0 [0086.971] lstrlenW (lpString=".DB") returned 3 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".DB") returned 0x0 [0086.971] lstrlenW (lpString=".db") returned 3 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".db") returned 0x0 [0086.971] lstrlenW (lpString=".ndf") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".ndf") returned 0x0 [0086.971] lstrlenW (lpString=".NDF") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".NDF") returned 0x0 [0086.971] lstrlenW (lpString=".Mdf") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".Mdf") returned 0x0 [0086.971] lstrlenW (lpString=".dat") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".dat") returned 0x0 [0086.971] lstrlenW (lpString=".DAT") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".DAT") returned 0x0 [0086.971] lstrlenW (lpString=".ldf") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".ldf") returned 0x0 [0086.971] lstrlenW (lpString=".LDF") returned 4 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch=".LDF") returned 0x0 [0086.971] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.971] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0086.972] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.972] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0086.972] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0086.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.973] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20697369699) returned 1 [0086.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2a7bd30, dwHighDateTime=0x1d585b4)) [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cf00 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cf00 | out: hHeap=0x260000) returned 1 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.973] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.973] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.973] GetLastError () returned 0x0 [0086.974] GetLastError () returned 0x0 [0086.974] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.974] GetLastError () returned 0x0 [0086.974] GetLastError () returned 0x0 [0086.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.976] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x276, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x276, lpOverlapped=0x0) returned 1 [0086.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.976] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.976] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.976] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.976] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.976] CloseHandle (hObject=0xf0) returned 1 [0086.976] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0086.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0086.978] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.978] GetLastError () returned 0x0 [0086.978] RtlWakeConditionVariable () returned 0x0 [0086.978] GetCurrentThreadId () returned 0x9ac [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".ldf") returned 0x0 [0086.978] lstrlenW (lpString=".vhd") returned 4 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".vhd") returned 0x0 [0086.978] lstrlenW (lpString=".vhdx") returned 5 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".vhdx") returned 0x0 [0086.978] lstrlenW (lpString=".pst") returned 4 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".pst") returned 0x0 [0086.978] lstrlenW (lpString=".ost") returned 4 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".ost") returned 0x0 [0086.978] lstrlenW (lpString=".bak") returned 4 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".bak") returned 0x0 [0086.978] lstrlenW (lpString=".bac") returned 4 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".bac") returned 0x0 [0086.978] lstrlenW (lpString=".sys") returned 4 [0086.978] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".sys") returned 0x0 [0086.978] lstrlenW (lpString=".v2i") returned 4 [0086.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".v2i") returned 0x0 [0086.979] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.979] lstrlenW (lpString=".sql") returned 4 [0086.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".sql") returned 0x0 [0086.980] lstrlenW (lpString=".mdf") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".mdf") returned 0x0 [0086.980] lstrlenW (lpString=".txt") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".txt") returned 0x0 [0086.980] lstrlenW (lpString=".dbf") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".dbf") returned 0x0 [0086.980] lstrlenW (lpString=".ckp") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".ckp") returned 0x0 [0086.980] lstrlenW (lpString=".dacpac") returned 7 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".dacpac") returned 0x0 [0086.980] lstrlenW (lpString=".db3") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".db3") returned 0x0 [0086.980] lstrlenW (lpString=".dtxs") returned 5 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".dtxs") returned 0x0 [0086.980] lstrlenW (lpString=".mdt") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".mdt") returned 0x0 [0086.980] lstrlenW (lpString=".sdf") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".sdf") returned 0x0 [0086.980] lstrlenW (lpString=".MDF") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".MDF") returned 0x0 [0086.980] lstrlenW (lpString=".DBF") returned 4 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".DBF") returned 0x0 [0086.980] lstrlenW (lpString=".DB") returned 3 [0086.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".DB") returned 0x0 [0086.980] lstrlenW (lpString=".db") returned 3 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".db") returned 0x0 [0086.981] lstrlenW (lpString=".ndf") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".ndf") returned 0x0 [0086.981] lstrlenW (lpString=".NDF") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".NDF") returned 0x0 [0086.981] lstrlenW (lpString=".Mdf") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".Mdf") returned 0x0 [0086.981] lstrlenW (lpString=".dat") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".dat") returned 0x0 [0086.981] lstrlenW (lpString=".DAT") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".DAT") returned 0x0 [0086.981] lstrlenW (lpString=".ldf") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".ldf") returned 0x0 [0086.981] lstrlenW (lpString=".LDF") returned 4 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch=".LDF") returned 0x0 [0086.981] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0086.981] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0086.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0086.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0086.981] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0086.982] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0086.982] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0086.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0086.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0086.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0086.982] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20698336367) returned 1 [0086.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2a7bd30, dwHighDateTime=0x1d585b4)) [0086.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0086.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0086.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0086.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33cf38 [0086.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0086.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33cf38 | out: hHeap=0x260000) returned 1 [0086.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0086.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0086.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0086.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0086.983] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0086.983] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0086.983] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0086.983] GetLastError () returned 0x0 [0086.983] GetLastError () returned 0x0 [0086.983] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0086.983] GetLastError () returned 0x0 [0086.984] GetLastError () returned 0x0 [0086.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.985] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xe6, lpOverlapped=0x0) returned 1 [0086.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0086.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.985] WriteFile (in: hFile=0xf0, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0086.985] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0086.985] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0086.985] CloseHandle (hObject=0xf0) returned 1 [0086.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0086.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.[deadmin@cock.li].deadmin")) returned 1 [0086.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0086.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0086.987] GetLastError () returned 0x0 [0086.987] RtlWakeConditionVariable () returned 0x27e828 [0086.987] GetCurrentThreadId () returned 0x9ac [0086.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".ldf") returned 0x0 [0086.987] lstrlenW (lpString=".vhd") returned 4 [0086.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".vhd") returned 0x0 [0086.987] lstrlenW (lpString=".vhdx") returned 5 [0086.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".vhdx") returned 0x0 [0086.987] lstrlenW (lpString=".pst") returned 4 [0086.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".pst") returned 0x0 [0086.987] lstrlenW (lpString=".ost") returned 4 [0086.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".ost") returned 0x0 [0086.987] lstrlenW (lpString=".bak") returned 4 [0086.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".bak") returned 0x0 [0086.988] lstrlenW (lpString=".bac") returned 4 [0086.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".bac") returned 0x0 [0086.988] lstrlenW (lpString=".sys") returned 4 [0086.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".sys") returned 0x0 [0086.988] lstrlenW (lpString=".v2i") returned 4 [0086.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".v2i") returned 0x0 [0086.988] lstrlenW (lpString="s\r\n.v2i") returned 7 [0086.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch="s\r\n.v2i") returned 0x0 [0086.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.139] lstrlenW (lpString=".sql") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".sql") returned 0x0 [0087.139] lstrlenW (lpString=".mdf") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".mdf") returned 0x0 [0087.139] lstrlenW (lpString=".txt") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".txt") returned 0x0 [0087.139] lstrlenW (lpString=".dbf") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".dbf") returned 0x0 [0087.139] lstrlenW (lpString=".ckp") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".ckp") returned 0x0 [0087.139] lstrlenW (lpString=".dacpac") returned 7 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".dacpac") returned 0x0 [0087.139] lstrlenW (lpString=".db3") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".db3") returned 0x0 [0087.139] lstrlenW (lpString=".dtxs") returned 5 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".dtxs") returned 0x0 [0087.139] lstrlenW (lpString=".mdt") returned 4 [0087.139] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".mdt") returned 0x0 [0087.140] lstrlenW (lpString=".sdf") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".sdf") returned 0x0 [0087.140] lstrlenW (lpString=".MDF") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".MDF") returned 0x0 [0087.140] lstrlenW (lpString=".DBF") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".DBF") returned 0x0 [0087.140] lstrlenW (lpString=".DB") returned 3 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".DB") returned 0x0 [0087.140] lstrlenW (lpString=".db") returned 3 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".db") returned 0x0 [0087.140] lstrlenW (lpString=".ndf") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".ndf") returned 0x0 [0087.140] lstrlenW (lpString=".NDF") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".NDF") returned 0x0 [0087.140] lstrlenW (lpString=".Mdf") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".Mdf") returned 0x0 [0087.140] lstrlenW (lpString=".dat") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".dat") returned 0x0 [0087.140] lstrlenW (lpString=".DAT") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".DAT") returned 0x0 [0087.140] lstrlenW (lpString=".ldf") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".ldf") returned 0x0 [0087.140] lstrlenW (lpString=".LDF") returned 4 [0087.140] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch=".LDF") returned 0x0 [0087.140] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.141] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.141] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.141] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.142] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20714292315) returned 1 [0087.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2c1ec50, dwHighDateTime=0x1d585b4)) [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0498 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0498 | out: hHeap=0x260000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.142] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.143] GetLastError () returned 0x0 [0087.143] GetLastError () returned 0x0 [0087.143] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.143] GetLastError () returned 0x0 [0087.143] GetLastError () returned 0x0 [0087.146] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffbe5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.146] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x41b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x41b, lpOverlapped=0x0) returned 1 [0087.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0087.146] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.146] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.146] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.146] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.146] CloseHandle (hObject=0xd8) returned 1 [0087.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.148] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.148] GetLastError () returned 0x0 [0087.148] RtlWakeConditionVariable () returned 0x0 [0087.148] GetCurrentThreadId () returned 0x9ac [0087.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".ldf") returned 0x0 [0087.148] lstrlenW (lpString=".vhd") returned 4 [0087.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".vhd") returned 0x0 [0087.148] lstrlenW (lpString=".vhdx") returned 5 [0087.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".vhdx") returned 0x0 [0087.148] lstrlenW (lpString=".pst") returned 4 [0087.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".pst") returned 0x0 [0087.148] lstrlenW (lpString=".ost") returned 4 [0087.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".ost") returned 0x0 [0087.149] lstrlenW (lpString=".bak") returned 4 [0087.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".bak") returned 0x0 [0087.149] lstrlenW (lpString=".bac") returned 4 [0087.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".bac") returned 0x0 [0087.149] lstrlenW (lpString=".sys") returned 4 [0087.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".sys") returned 0x0 [0087.149] lstrlenW (lpString=".v2i") returned 4 [0087.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".v2i") returned 0x0 [0087.149] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.150] lstrlenW (lpString=".sql") returned 4 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".sql") returned 0x0 [0087.150] lstrlenW (lpString=".mdf") returned 4 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".mdf") returned 0x0 [0087.150] lstrlenW (lpString=".txt") returned 4 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".txt") returned 0x0 [0087.150] lstrlenW (lpString=".dbf") returned 4 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".dbf") returned 0x0 [0087.150] lstrlenW (lpString=".ckp") returned 4 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".ckp") returned 0x0 [0087.150] lstrlenW (lpString=".dacpac") returned 7 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".dacpac") returned 0x0 [0087.150] lstrlenW (lpString=".db3") returned 4 [0087.150] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".db3") returned 0x0 [0087.150] lstrlenW (lpString=".dtxs") returned 5 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".dtxs") returned 0x0 [0087.151] lstrlenW (lpString=".mdt") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".mdt") returned 0x0 [0087.151] lstrlenW (lpString=".sdf") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".sdf") returned 0x0 [0087.151] lstrlenW (lpString=".MDF") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".MDF") returned 0x0 [0087.151] lstrlenW (lpString=".DBF") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".DBF") returned 0x0 [0087.151] lstrlenW (lpString=".DB") returned 3 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".DB") returned 0x0 [0087.151] lstrlenW (lpString=".db") returned 3 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".db") returned 0x0 [0087.151] lstrlenW (lpString=".ndf") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".ndf") returned 0x0 [0087.151] lstrlenW (lpString=".NDF") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".NDF") returned 0x0 [0087.151] lstrlenW (lpString=".Mdf") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".Mdf") returned 0x0 [0087.151] lstrlenW (lpString=".dat") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".dat") returned 0x0 [0087.151] lstrlenW (lpString=".DAT") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".DAT") returned 0x0 [0087.151] lstrlenW (lpString=".ldf") returned 4 [0087.151] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".ldf") returned 0x0 [0087.151] lstrlenW (lpString=".LDF") returned 4 [0087.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch=".LDF") returned 0x0 [0087.152] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.152] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.152] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.152] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.153] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.153] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20715385997) returned 1 [0087.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2c1ec50, dwHighDateTime=0x1d585b4)) [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0460 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0460 | out: hHeap=0x260000) returned 1 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.153] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.153] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.154] GetLastError () returned 0x0 [0087.154] GetLastError () returned 0x0 [0087.154] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.154] GetLastError () returned 0x0 [0087.154] GetLastError () returned 0x0 [0087.156] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc943, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.156] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x36bd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x36bd, lpOverlapped=0x0) returned 1 [0087.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0087.156] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.156] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.156] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.157] CloseHandle (hObject=0xd8) returned 1 [0087.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.159] GetLastError () returned 0x0 [0087.159] RtlWakeConditionVariable () returned 0x0 [0087.159] GetCurrentThreadId () returned 0x9ac [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".ldf") returned 0x0 [0087.159] lstrlenW (lpString=".vhd") returned 4 [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".vhd") returned 0x0 [0087.159] lstrlenW (lpString=".vhdx") returned 5 [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".vhdx") returned 0x0 [0087.159] lstrlenW (lpString=".pst") returned 4 [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".pst") returned 0x0 [0087.159] lstrlenW (lpString=".ost") returned 4 [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".ost") returned 0x0 [0087.159] lstrlenW (lpString=".bak") returned 4 [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".bak") returned 0x0 [0087.159] lstrlenW (lpString=".bac") returned 4 [0087.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".bac") returned 0x0 [0087.160] lstrlenW (lpString=".sys") returned 4 [0087.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".sys") returned 0x0 [0087.160] lstrlenW (lpString=".v2i") returned 4 [0087.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".v2i") returned 0x0 [0087.160] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.161] lstrlenW (lpString=".sql") returned 4 [0087.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".sql") returned 0x0 [0087.161] lstrlenW (lpString=".mdf") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".mdf") returned 0x0 [0087.162] lstrlenW (lpString=".txt") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".txt") returned 0x0 [0087.162] lstrlenW (lpString=".dbf") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".dbf") returned 0x0 [0087.162] lstrlenW (lpString=".ckp") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".ckp") returned 0x0 [0087.162] lstrlenW (lpString=".dacpac") returned 7 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".dacpac") returned 0x0 [0087.162] lstrlenW (lpString=".db3") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".db3") returned 0x0 [0087.162] lstrlenW (lpString=".dtxs") returned 5 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".dtxs") returned 0x0 [0087.162] lstrlenW (lpString=".mdt") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".mdt") returned 0x0 [0087.162] lstrlenW (lpString=".sdf") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".sdf") returned 0x0 [0087.162] lstrlenW (lpString=".MDF") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".MDF") returned 0x0 [0087.162] lstrlenW (lpString=".DBF") returned 4 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".DBF") returned 0x0 [0087.162] lstrlenW (lpString=".DB") returned 3 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".DB") returned 0x0 [0087.162] lstrlenW (lpString=".db") returned 3 [0087.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".db") returned 0x0 [0087.162] lstrlenW (lpString=".ndf") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".ndf") returned 0x0 [0087.163] lstrlenW (lpString=".NDF") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".NDF") returned 0x0 [0087.163] lstrlenW (lpString=".Mdf") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".Mdf") returned 0x0 [0087.163] lstrlenW (lpString=".dat") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".dat") returned 0x0 [0087.163] lstrlenW (lpString=".DAT") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".DAT") returned 0x0 [0087.163] lstrlenW (lpString=".ldf") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".ldf") returned 0x0 [0087.163] lstrlenW (lpString=".LDF") returned 4 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch=".LDF") returned 0x0 [0087.163] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.163] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.163] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.164] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.164] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.164] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20716537061) returned 1 [0087.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2c44db0, dwHighDateTime=0x1d585b4)) [0087.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0428 [0087.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0428 | out: hHeap=0x260000) returned 1 [0087.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.165] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.165] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.165] GetLastError () returned 0x0 [0087.165] GetLastError () returned 0x0 [0087.166] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.166] GetLastError () returned 0x0 [0087.166] GetLastError () returned 0x0 [0087.167] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc2de, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.168] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x3d22, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3d22, lpOverlapped=0x0) returned 1 [0087.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0087.168] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.168] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.168] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.168] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.168] CloseHandle (hObject=0xd8) returned 1 [0087.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.171] GetLastError () returned 0x0 [0087.171] RtlWakeConditionVariable () returned 0x0 [0087.171] GetCurrentThreadId () returned 0x9ac [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".ldf") returned 0x0 [0087.171] lstrlenW (lpString=".vhd") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".vhd") returned 0x0 [0087.171] lstrlenW (lpString=".vhdx") returned 5 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".vhdx") returned 0x0 [0087.171] lstrlenW (lpString=".pst") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".pst") returned 0x0 [0087.171] lstrlenW (lpString=".ost") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".ost") returned 0x0 [0087.171] lstrlenW (lpString=".bak") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".bak") returned 0x0 [0087.171] lstrlenW (lpString=".bac") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".bac") returned 0x0 [0087.171] lstrlenW (lpString=".sys") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".sys") returned 0x0 [0087.171] lstrlenW (lpString=".v2i") returned 4 [0087.171] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".v2i") returned 0x0 [0087.172] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.172] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.261] lstrlenW (lpString=".sql") returned 4 [0087.261] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".sql") returned 0x0 [0087.261] lstrlenW (lpString=".mdf") returned 4 [0087.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".mdf") returned 0x0 [0087.272] lstrlenW (lpString=".txt") returned 4 [0087.272] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".txt") returned 0x0 [0087.272] lstrlenW (lpString=".dbf") returned 4 [0087.295] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".dbf") returned 0x0 [0087.296] lstrlenW (lpString=".ckp") returned 4 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".ckp") returned 0x0 [0087.296] lstrlenW (lpString=".dacpac") returned 7 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".dacpac") returned 0x0 [0087.296] lstrlenW (lpString=".db3") returned 4 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".db3") returned 0x0 [0087.296] lstrlenW (lpString=".dtxs") returned 5 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".dtxs") returned 0x0 [0087.296] lstrlenW (lpString=".mdt") returned 4 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".mdt") returned 0x0 [0087.296] lstrlenW (lpString=".sdf") returned 4 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".sdf") returned 0x0 [0087.296] lstrlenW (lpString=".MDF") returned 4 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".MDF") returned 0x0 [0087.296] lstrlenW (lpString=".DBF") returned 4 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".DBF") returned 0x0 [0087.296] lstrlenW (lpString=".DB") returned 3 [0087.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".DB") returned 0x0 [0087.296] lstrlenW (lpString=".db") returned 3 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".db") returned 0x0 [0087.297] lstrlenW (lpString=".ndf") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".ndf") returned 0x0 [0087.297] lstrlenW (lpString=".NDF") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".NDF") returned 0x0 [0087.297] lstrlenW (lpString=".Mdf") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".Mdf") returned 0x0 [0087.297] lstrlenW (lpString=".dat") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".dat") returned 0x0 [0087.297] lstrlenW (lpString=".DAT") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".DAT") returned 0x0 [0087.297] lstrlenW (lpString=".ldf") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".ldf") returned 0x0 [0087.297] lstrlenW (lpString=".LDF") returned 4 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch=".LDF") returned 0x0 [0087.297] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.297] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.298] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.298] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.298] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.298] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.298] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20729959339) returned 1 [0087.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2d9ba10, dwHighDateTime=0x1d585b4)) [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d2b8 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d2b8 | out: hHeap=0x260000) returned 1 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.299] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.299] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.299] GetLastError () returned 0x0 [0087.300] GetLastError () returned 0x0 [0087.300] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.300] GetLastError () returned 0x0 [0087.300] GetLastError () returned 0x0 [0087.301] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffbd51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.301] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x42af, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x42af, lpOverlapped=0x0) returned 1 [0087.302] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.302] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.302] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.302] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.302] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.302] CloseHandle (hObject=0xd8) returned 1 [0087.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.304] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.304] GetLastError () returned 0x0 [0087.305] RtlWakeConditionVariable () returned 0x0 [0087.305] GetCurrentThreadId () returned 0x9ac [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".ldf") returned 0x0 [0087.305] lstrlenW (lpString=".vhd") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".vhd") returned 0x0 [0087.305] lstrlenW (lpString=".vhdx") returned 5 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".vhdx") returned 0x0 [0087.305] lstrlenW (lpString=".pst") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".pst") returned 0x0 [0087.305] lstrlenW (lpString=".ost") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".ost") returned 0x0 [0087.305] lstrlenW (lpString=".bak") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".bak") returned 0x0 [0087.305] lstrlenW (lpString=".bac") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".bac") returned 0x0 [0087.305] lstrlenW (lpString=".sys") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".sys") returned 0x0 [0087.305] lstrlenW (lpString=".v2i") returned 4 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".v2i") returned 0x0 [0087.305] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.308] lstrlenW (lpString=".sql") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".sql") returned 0x0 [0087.308] lstrlenW (lpString=".mdf") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".mdf") returned 0x0 [0087.308] lstrlenW (lpString=".txt") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".txt") returned 0x0 [0087.308] lstrlenW (lpString=".dbf") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".dbf") returned 0x0 [0087.308] lstrlenW (lpString=".ckp") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".ckp") returned 0x0 [0087.308] lstrlenW (lpString=".dacpac") returned 7 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".dacpac") returned 0x0 [0087.308] lstrlenW (lpString=".db3") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".db3") returned 0x0 [0087.308] lstrlenW (lpString=".dtxs") returned 5 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".dtxs") returned 0x0 [0087.308] lstrlenW (lpString=".mdt") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".mdt") returned 0x0 [0087.308] lstrlenW (lpString=".sdf") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".sdf") returned 0x0 [0087.308] lstrlenW (lpString=".MDF") returned 4 [0087.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".MDF") returned 0x0 [0087.309] lstrlenW (lpString=".DBF") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".DBF") returned 0x0 [0087.309] lstrlenW (lpString=".DB") returned 3 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".DB") returned 0x0 [0087.309] lstrlenW (lpString=".db") returned 3 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".db") returned 0x0 [0087.309] lstrlenW (lpString=".ndf") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".ndf") returned 0x0 [0087.309] lstrlenW (lpString=".NDF") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".NDF") returned 0x0 [0087.309] lstrlenW (lpString=".Mdf") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".Mdf") returned 0x0 [0087.309] lstrlenW (lpString=".dat") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".dat") returned 0x0 [0087.309] lstrlenW (lpString=".DAT") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".DAT") returned 0x0 [0087.309] lstrlenW (lpString=".ldf") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".ldf") returned 0x0 [0087.309] lstrlenW (lpString=".LDF") returned 4 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch=".LDF") returned 0x0 [0087.309] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.309] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.310] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.310] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.310] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.310] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20731158342) returned 1 [0087.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2d9ba10, dwHighDateTime=0x1d585b4)) [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d2f0 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d2f0 | out: hHeap=0x260000) returned 1 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.311] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.311] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.311] GetLastError () returned 0x0 [0087.312] GetLastError () returned 0x0 [0087.312] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.312] GetLastError () returned 0x0 [0087.312] GetLastError () returned 0x0 [0087.314] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc527, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.314] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3ad9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3ad9, lpOverlapped=0x0) returned 1 [0087.314] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.314] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.314] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.315] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.315] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.315] CloseHandle (hObject=0xd8) returned 1 [0087.315] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922440 [0087.315] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922440 | out: hHeap=0x260000) returned 1 [0087.317] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.317] GetLastError () returned 0x0 [0087.317] RtlWakeConditionVariable () returned 0x0 [0087.317] GetCurrentThreadId () returned 0x9ac [0087.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".ldf") returned 0x0 [0087.317] lstrlenW (lpString=".vhd") returned 4 [0087.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".vhd") returned 0x0 [0087.317] lstrlenW (lpString=".vhdx") returned 5 [0087.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".vhdx") returned 0x0 [0087.317] lstrlenW (lpString=".pst") returned 4 [0087.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".pst") returned 0x0 [0087.317] lstrlenW (lpString=".ost") returned 4 [0087.317] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".ost") returned 0x0 [0087.318] lstrlenW (lpString=".bak") returned 4 [0087.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".bak") returned 0x0 [0087.318] lstrlenW (lpString=".bac") returned 4 [0087.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".bac") returned 0x0 [0087.318] lstrlenW (lpString=".sys") returned 4 [0087.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".sys") returned 0x0 [0087.318] lstrlenW (lpString=".v2i") returned 4 [0087.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".v2i") returned 0x0 [0087.318] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.318] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.320] lstrlenW (lpString=".sql") returned 4 [0087.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".sql") returned 0x0 [0087.320] lstrlenW (lpString=".mdf") returned 4 [0087.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".mdf") returned 0x0 [0087.320] lstrlenW (lpString=".txt") returned 4 [0087.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".txt") returned 0x0 [0087.320] lstrlenW (lpString=".dbf") returned 4 [0087.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".dbf") returned 0x0 [0087.320] lstrlenW (lpString=".ckp") returned 4 [0087.320] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".ckp") returned 0x0 [0087.320] lstrlenW (lpString=".dacpac") returned 7 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".dacpac") returned 0x0 [0087.321] lstrlenW (lpString=".db3") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".db3") returned 0x0 [0087.321] lstrlenW (lpString=".dtxs") returned 5 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".dtxs") returned 0x0 [0087.321] lstrlenW (lpString=".mdt") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".mdt") returned 0x0 [0087.321] lstrlenW (lpString=".sdf") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".sdf") returned 0x0 [0087.321] lstrlenW (lpString=".MDF") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".MDF") returned 0x0 [0087.321] lstrlenW (lpString=".DBF") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".DBF") returned 0x0 [0087.321] lstrlenW (lpString=".DB") returned 3 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".DB") returned 0x0 [0087.321] lstrlenW (lpString=".db") returned 3 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".db") returned 0x0 [0087.321] lstrlenW (lpString=".ndf") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".ndf") returned 0x0 [0087.321] lstrlenW (lpString=".NDF") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".NDF") returned 0x0 [0087.321] lstrlenW (lpString=".Mdf") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".Mdf") returned 0x0 [0087.321] lstrlenW (lpString=".dat") returned 4 [0087.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".dat") returned 0x0 [0087.321] lstrlenW (lpString=".DAT") returned 4 [0087.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".DAT") returned 0x0 [0087.322] lstrlenW (lpString=".ldf") returned 4 [0087.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".ldf") returned 0x0 [0087.322] lstrlenW (lpString=".LDF") returned 4 [0087.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch=".LDF") returned 0x0 [0087.322] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.322] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.322] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.323] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.323] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.323] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20732417292) returned 1 [0087.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2dc1b70, dwHighDateTime=0x1d585b4)) [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d328 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d328 | out: hHeap=0x260000) returned 1 [0087.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.324] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.324] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.324] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.324] GetLastError () returned 0x0 [0087.324] GetLastError () returned 0x0 [0087.324] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.324] GetLastError () returned 0x0 [0087.324] GetLastError () returned 0x0 [0087.327] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc859, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.327] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x37a7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x37a7, lpOverlapped=0x0) returned 1 [0087.327] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.327] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.327] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.327] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.327] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.327] CloseHandle (hObject=0xd8) returned 1 [0087.327] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.327] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.330] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.330] GetLastError () returned 0x0 [0087.330] RtlWakeConditionVariable () returned 0x0 [0087.330] GetCurrentThreadId () returned 0x9ac [0087.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".ldf") returned 0x0 [0087.330] lstrlenW (lpString=".vhd") returned 4 [0087.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".vhd") returned 0x0 [0087.330] lstrlenW (lpString=".vhdx") returned 5 [0087.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".vhdx") returned 0x0 [0087.330] lstrlenW (lpString=".pst") returned 4 [0087.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".pst") returned 0x0 [0087.330] lstrlenW (lpString=".ost") returned 4 [0087.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".ost") returned 0x0 [0087.330] lstrlenW (lpString=".bak") returned 4 [0087.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".bak") returned 0x0 [0087.330] lstrlenW (lpString=".bac") returned 4 [0087.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".bac") returned 0x0 [0087.331] lstrlenW (lpString=".sys") returned 4 [0087.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".sys") returned 0x0 [0087.331] lstrlenW (lpString=".v2i") returned 4 [0087.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".v2i") returned 0x0 [0087.331] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch="s\r\n.v2i") returned 0x0 [0087.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.332] lstrlenW (lpString=".sql") returned 4 [0087.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".sql") returned 0x0 [0087.332] lstrlenW (lpString=".mdf") returned 4 [0087.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".mdf") returned 0x0 [0087.332] lstrlenW (lpString=".txt") returned 4 [0087.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".txt") returned 0x0 [0087.333] lstrlenW (lpString=".dbf") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".dbf") returned 0x0 [0087.333] lstrlenW (lpString=".ckp") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".ckp") returned 0x0 [0087.333] lstrlenW (lpString=".dacpac") returned 7 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".dacpac") returned 0x0 [0087.333] lstrlenW (lpString=".db3") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".db3") returned 0x0 [0087.333] lstrlenW (lpString=".dtxs") returned 5 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".dtxs") returned 0x0 [0087.333] lstrlenW (lpString=".mdt") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".mdt") returned 0x0 [0087.333] lstrlenW (lpString=".sdf") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".sdf") returned 0x0 [0087.333] lstrlenW (lpString=".MDF") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".MDF") returned 0x0 [0087.333] lstrlenW (lpString=".DBF") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".DBF") returned 0x0 [0087.333] lstrlenW (lpString=".DB") returned 3 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".DB") returned 0x0 [0087.333] lstrlenW (lpString=".db") returned 3 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".db") returned 0x0 [0087.333] lstrlenW (lpString=".ndf") returned 4 [0087.333] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".ndf") returned 0x0 [0087.333] lstrlenW (lpString=".NDF") returned 4 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".NDF") returned 0x0 [0087.334] lstrlenW (lpString=".Mdf") returned 4 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".Mdf") returned 0x0 [0087.334] lstrlenW (lpString=".dat") returned 4 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".dat") returned 0x0 [0087.334] lstrlenW (lpString=".DAT") returned 4 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".DAT") returned 0x0 [0087.334] lstrlenW (lpString=".ldf") returned 4 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".ldf") returned 0x0 [0087.334] lstrlenW (lpString=".LDF") returned 4 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch=".LDF") returned 0x0 [0087.334] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.334] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.334] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.334] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.335] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.335] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.335] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.335] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20733626938) returned 1 [0087.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2de7cd0, dwHighDateTime=0x1d585b4)) [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d360 [0087.335] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d360 | out: hHeap=0x260000) returned 1 [0087.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.336] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.336] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.336] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.336] GetLastError () returned 0x0 [0087.336] GetLastError () returned 0x0 [0087.336] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.336] GetLastError () returned 0x0 [0087.337] GetLastError () returned 0x0 [0087.408] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffc67d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.408] WriteFile (in: hFile=0xd8, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x3983, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x3983, lpOverlapped=0x0) returned 1 [0087.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0087.408] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.408] WriteFile (in: hFile=0xd8, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.408] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.408] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.408] CloseHandle (hObject=0xd8) returned 1 [0087.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.410] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.410] GetLastError () returned 0x0 [0087.410] RtlWakeConditionVariable () returned 0x0 [0087.410] GetCurrentThreadId () returned 0x9ac [0087.410] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".ldf") returned 0x0 [0087.411] lstrlenW (lpString=".vhd") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".vhd") returned 0x0 [0087.411] lstrlenW (lpString=".vhdx") returned 5 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".vhdx") returned 0x0 [0087.411] lstrlenW (lpString=".pst") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".pst") returned 0x0 [0087.411] lstrlenW (lpString=".ost") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".ost") returned 0x0 [0087.411] lstrlenW (lpString=".bak") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".bak") returned 0x0 [0087.411] lstrlenW (lpString=".bac") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".bac") returned 0x0 [0087.411] lstrlenW (lpString=".sys") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".sys") returned 0x0 [0087.411] lstrlenW (lpString=".v2i") returned 4 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".v2i") returned 0x0 [0087.411] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch="s\r\n.v2i") returned 0x0 [0087.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.442] lstrlenW (lpString=".sql") returned 4 [0087.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".sql") returned 0x0 [0087.442] lstrlenW (lpString=".mdf") returned 4 [0087.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".mdf") returned 0x0 [0087.442] lstrlenW (lpString=".txt") returned 4 [0087.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".txt") returned 0x0 [0087.442] lstrlenW (lpString=".dbf") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".dbf") returned 0x0 [0087.443] lstrlenW (lpString=".ckp") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".ckp") returned 0x0 [0087.443] lstrlenW (lpString=".dacpac") returned 7 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".dacpac") returned 0x0 [0087.443] lstrlenW (lpString=".db3") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".db3") returned 0x0 [0087.443] lstrlenW (lpString=".dtxs") returned 5 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".dtxs") returned 0x0 [0087.443] lstrlenW (lpString=".mdt") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".mdt") returned 0x0 [0087.443] lstrlenW (lpString=".sdf") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".sdf") returned 0x0 [0087.443] lstrlenW (lpString=".MDF") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".MDF") returned 0x0 [0087.443] lstrlenW (lpString=".DBF") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".DBF") returned 0x0 [0087.443] lstrlenW (lpString=".DB") returned 3 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".DB") returned 0x0 [0087.443] lstrlenW (lpString=".db") returned 3 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".db") returned 0x0 [0087.443] lstrlenW (lpString=".ndf") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".ndf") returned 0x0 [0087.443] lstrlenW (lpString=".NDF") returned 4 [0087.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".NDF") returned 0x0 [0087.443] lstrlenW (lpString=".Mdf") returned 4 [0087.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".Mdf") returned 0x0 [0087.444] lstrlenW (lpString=".dat") returned 4 [0087.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".dat") returned 0x0 [0087.444] lstrlenW (lpString=".DAT") returned 4 [0087.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".DAT") returned 0x0 [0087.444] lstrlenW (lpString=".ldf") returned 4 [0087.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".ldf") returned 0x0 [0087.444] lstrlenW (lpString=".LDF") returned 4 [0087.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch=".LDF") returned 0x0 [0087.444] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.444] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.445] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.445] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.445] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20744619636) returned 1 [0087.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2ef2670, dwHighDateTime=0x1d585b4)) [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d4e8 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d4e8 | out: hHeap=0x260000) returned 1 [0087.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.446] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.446] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.446] GetLastError () returned 0x0 [0087.446] GetLastError () returned 0x0 [0087.446] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.446] GetLastError () returned 0x0 [0087.447] GetLastError () returned 0x0 [0087.451] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff7fb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.451] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x805, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x805, lpOverlapped=0x0) returned 1 [0087.451] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.451] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.452] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.452] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.452] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.452] CloseHandle (hObject=0xe4) returned 1 [0087.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.[deadmin@cock.li].deadmin")) returned 1 [0087.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.454] GetLastError () returned 0x0 [0087.454] RtlWakeConditionVariable () returned 0x0 [0087.454] GetCurrentThreadId () returned 0x9ac [0087.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".ldf") returned 0x0 [0087.454] lstrlenW (lpString=".vhd") returned 4 [0087.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".vhd") returned 0x0 [0087.454] lstrlenW (lpString=".vhdx") returned 5 [0087.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".vhdx") returned 0x0 [0087.454] lstrlenW (lpString=".pst") returned 4 [0087.454] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".pst") returned 0x0 [0087.454] lstrlenW (lpString=".ost") returned 4 [0087.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".ost") returned 0x0 [0087.455] lstrlenW (lpString=".bak") returned 4 [0087.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".bak") returned 0x0 [0087.455] lstrlenW (lpString=".bac") returned 4 [0087.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".bac") returned 0x0 [0087.455] lstrlenW (lpString=".sys") returned 4 [0087.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".sys") returned 0x0 [0087.455] lstrlenW (lpString=".v2i") returned 4 [0087.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".v2i") returned 0x0 [0087.455] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch="s\r\n.v2i") returned 0x0 [0087.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.457] lstrlenW (lpString=".sql") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".sql") returned 0x0 [0087.457] lstrlenW (lpString=".mdf") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".mdf") returned 0x0 [0087.457] lstrlenW (lpString=".txt") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".txt") returned 0x0 [0087.457] lstrlenW (lpString=".dbf") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".dbf") returned 0x0 [0087.457] lstrlenW (lpString=".ckp") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".ckp") returned 0x0 [0087.457] lstrlenW (lpString=".dacpac") returned 7 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".dacpac") returned 0x0 [0087.457] lstrlenW (lpString=".db3") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".db3") returned 0x0 [0087.457] lstrlenW (lpString=".dtxs") returned 5 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".dtxs") returned 0x0 [0087.457] lstrlenW (lpString=".mdt") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".mdt") returned 0x0 [0087.457] lstrlenW (lpString=".sdf") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".sdf") returned 0x0 [0087.457] lstrlenW (lpString=".MDF") returned 4 [0087.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".MDF") returned 0x0 [0087.457] lstrlenW (lpString=".DBF") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".DBF") returned 0x0 [0087.458] lstrlenW (lpString=".DB") returned 3 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".DB") returned 0x0 [0087.458] lstrlenW (lpString=".db") returned 3 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".db") returned 0x0 [0087.458] lstrlenW (lpString=".ndf") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".ndf") returned 0x0 [0087.458] lstrlenW (lpString=".NDF") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".NDF") returned 0x0 [0087.458] lstrlenW (lpString=".Mdf") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".Mdf") returned 0x0 [0087.458] lstrlenW (lpString=".dat") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".dat") returned 0x0 [0087.458] lstrlenW (lpString=".DAT") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".DAT") returned 0x0 [0087.458] lstrlenW (lpString=".ldf") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".ldf") returned 0x0 [0087.458] lstrlenW (lpString=".LDF") returned 4 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch=".LDF") returned 0x0 [0087.458] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.458] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.458] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.459] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.459] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.459] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.459] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20746057880) returned 1 [0087.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2f187d0, dwHighDateTime=0x1d585b4)) [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d520 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d520 | out: hHeap=0x260000) returned 1 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.460] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.460] GetLastError () returned 0x0 [0087.461] GetLastError () returned 0x0 [0087.461] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.461] GetLastError () returned 0x0 [0087.461] GetLastError () returned 0x0 [0087.463] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffea04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.463] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x15fc, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x15fc, lpOverlapped=0x0) returned 1 [0087.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.463] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.463] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.463] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.463] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.463] CloseHandle (hObject=0xe4) returned 1 [0087.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js.[deadmin@cock.li].deadmin")) returned 1 [0087.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.465] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.465] GetLastError () returned 0x0 [0087.465] RtlWakeConditionVariable () returned 0x0 [0087.465] GetCurrentThreadId () returned 0x9ac [0087.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".ldf") returned 0x0 [0087.465] lstrlenW (lpString=".vhd") returned 4 [0087.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".vhd") returned 0x0 [0087.465] lstrlenW (lpString=".vhdx") returned 5 [0087.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".vhdx") returned 0x0 [0087.465] lstrlenW (lpString=".pst") returned 4 [0087.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".pst") returned 0x0 [0087.465] lstrlenW (lpString=".ost") returned 4 [0087.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".ost") returned 0x0 [0087.465] lstrlenW (lpString=".bak") returned 4 [0087.465] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".bak") returned 0x0 [0087.465] lstrlenW (lpString=".bac") returned 4 [0087.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".bac") returned 0x0 [0087.466] lstrlenW (lpString=".sys") returned 4 [0087.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".sys") returned 0x0 [0087.466] lstrlenW (lpString=".v2i") returned 4 [0087.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".v2i") returned 0x0 [0087.466] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch="s\r\n.v2i") returned 0x0 [0087.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0087.467] lstrlenW (lpString=".sql") returned 4 [0087.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".sql") returned 0x0 [0087.468] lstrlenW (lpString=".mdf") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".mdf") returned 0x0 [0087.468] lstrlenW (lpString=".txt") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".txt") returned 0x0 [0087.468] lstrlenW (lpString=".dbf") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".dbf") returned 0x0 [0087.468] lstrlenW (lpString=".ckp") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".ckp") returned 0x0 [0087.468] lstrlenW (lpString=".dacpac") returned 7 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".dacpac") returned 0x0 [0087.468] lstrlenW (lpString=".db3") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".db3") returned 0x0 [0087.468] lstrlenW (lpString=".dtxs") returned 5 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".dtxs") returned 0x0 [0087.468] lstrlenW (lpString=".mdt") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".mdt") returned 0x0 [0087.468] lstrlenW (lpString=".sdf") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".sdf") returned 0x0 [0087.468] lstrlenW (lpString=".MDF") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".MDF") returned 0x0 [0087.468] lstrlenW (lpString=".DBF") returned 4 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".DBF") returned 0x0 [0087.468] lstrlenW (lpString=".DB") returned 3 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".DB") returned 0x0 [0087.468] lstrlenW (lpString=".db") returned 3 [0087.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".db") returned 0x0 [0087.469] lstrlenW (lpString=".ndf") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".ndf") returned 0x0 [0087.469] lstrlenW (lpString=".NDF") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".NDF") returned 0x0 [0087.469] lstrlenW (lpString=".Mdf") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".Mdf") returned 0x0 [0087.469] lstrlenW (lpString=".dat") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".dat") returned 0x0 [0087.469] lstrlenW (lpString=".DAT") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".DAT") returned 0x0 [0087.469] lstrlenW (lpString=".ldf") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".ldf") returned 0x0 [0087.469] lstrlenW (lpString=".LDF") returned 4 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch=".LDF") returned 0x0 [0087.469] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.469] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.470] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.470] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.470] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20747153467) returned 1 [0087.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2f3e930, dwHighDateTime=0x1d585b4)) [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d558 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d558 | out: hHeap=0x260000) returned 1 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.471] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.471] GetLastError () returned 0x0 [0087.471] GetLastError () returned 0x0 [0087.472] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.472] GetLastError () returned 0x0 [0087.472] GetLastError () returned 0x0 [0087.504] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.504] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x40c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x40c, lpOverlapped=0x0) returned 1 [0087.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.505] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.505] WriteFile (in: hFile=0xe4, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.505] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.505] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.505] CloseHandle (hObject=0xe4) returned 1 [0087.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.519] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css.[deadmin@cock.li].deadmin")) returned 1 [0087.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.548] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.548] GetLastError () returned 0x0 [0087.548] RtlWakeConditionVariable () returned 0x0 [0087.548] GetCurrentThreadId () returned 0x9ac [0087.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".ldf") returned 0x0 [0087.548] lstrlenW (lpString=".vhd") returned 4 [0087.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".vhd") returned 0x0 [0087.548] lstrlenW (lpString=".vhdx") returned 5 [0087.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".vhdx") returned 0x0 [0087.548] lstrlenW (lpString=".pst") returned 4 [0087.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".pst") returned 0x0 [0087.548] lstrlenW (lpString=".ost") returned 4 [0087.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".ost") returned 0x0 [0087.548] lstrlenW (lpString=".bak") returned 4 [0087.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".bak") returned 0x0 [0087.548] lstrlenW (lpString=".bac") returned 4 [0087.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".bac") returned 0x0 [0087.549] lstrlenW (lpString=".sys") returned 4 [0087.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".sys") returned 0x0 [0087.549] lstrlenW (lpString=".v2i") returned 4 [0087.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".v2i") returned 0x0 [0087.549] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.550] lstrlenW (lpString=".sql") returned 4 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".sql") returned 0x0 [0087.550] lstrlenW (lpString=".mdf") returned 4 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".mdf") returned 0x0 [0087.550] lstrlenW (lpString=".txt") returned 4 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".txt") returned 0x0 [0087.550] lstrlenW (lpString=".dbf") returned 4 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".dbf") returned 0x0 [0087.550] lstrlenW (lpString=".ckp") returned 4 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".ckp") returned 0x0 [0087.550] lstrlenW (lpString=".dacpac") returned 7 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".dacpac") returned 0x0 [0087.550] lstrlenW (lpString=".db3") returned 4 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".db3") returned 0x0 [0087.550] lstrlenW (lpString=".dtxs") returned 5 [0087.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".dtxs") returned 0x0 [0087.551] lstrlenW (lpString=".mdt") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".mdt") returned 0x0 [0087.551] lstrlenW (lpString=".sdf") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".sdf") returned 0x0 [0087.551] lstrlenW (lpString=".MDF") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".MDF") returned 0x0 [0087.551] lstrlenW (lpString=".DBF") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".DBF") returned 0x0 [0087.551] lstrlenW (lpString=".DB") returned 3 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".DB") returned 0x0 [0087.551] lstrlenW (lpString=".db") returned 3 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".db") returned 0x0 [0087.551] lstrlenW (lpString=".ndf") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".ndf") returned 0x0 [0087.551] lstrlenW (lpString=".NDF") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".NDF") returned 0x0 [0087.551] lstrlenW (lpString=".Mdf") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".Mdf") returned 0x0 [0087.551] lstrlenW (lpString=".dat") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".dat") returned 0x0 [0087.551] lstrlenW (lpString=".DAT") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".DAT") returned 0x0 [0087.551] lstrlenW (lpString=".ldf") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".ldf") returned 0x0 [0087.551] lstrlenW (lpString=".LDF") returned 4 [0087.551] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch=".LDF") returned 0x0 [0087.552] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.552] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.552] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.552] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.552] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.553] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20755381852) returned 1 [0087.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc2ffd010, dwHighDateTime=0x1d585b4)) [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d78d0 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d78d0 | out: hHeap=0x260000) returned 1 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.553] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.553] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.554] GetLastError () returned 0x0 [0087.554] GetLastError () returned 0x0 [0087.554] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.554] GetLastError () returned 0x0 [0087.554] GetLastError () returned 0x0 [0087.557] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.557] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0087.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.558] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.558] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.558] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.558] CloseHandle (hObject=0xd8) returned 1 [0087.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0087.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.560] GetLastError () returned 0x0 [0087.560] RtlWakeConditionVariable () returned 0x0 [0087.560] GetCurrentThreadId () returned 0x9ac [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".ldf") returned 0x0 [0087.560] lstrlenW (lpString=".vhd") returned 4 [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".vhd") returned 0x0 [0087.560] lstrlenW (lpString=".vhdx") returned 5 [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".vhdx") returned 0x0 [0087.560] lstrlenW (lpString=".pst") returned 4 [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".pst") returned 0x0 [0087.560] lstrlenW (lpString=".ost") returned 4 [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".ost") returned 0x0 [0087.560] lstrlenW (lpString=".bak") returned 4 [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".bak") returned 0x0 [0087.560] lstrlenW (lpString=".bac") returned 4 [0087.560] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".bac") returned 0x0 [0087.560] lstrlenW (lpString=".sys") returned 4 [0087.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".sys") returned 0x0 [0087.561] lstrlenW (lpString=".v2i") returned 4 [0087.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".v2i") returned 0x0 [0087.561] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.562] lstrlenW (lpString=".sql") returned 4 [0087.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".sql") returned 0x0 [0087.562] lstrlenW (lpString=".mdf") returned 4 [0087.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".mdf") returned 0x0 [0087.562] lstrlenW (lpString=".txt") returned 4 [0087.562] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".txt") returned 0x0 [0087.563] lstrlenW (lpString=".dbf") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".dbf") returned 0x0 [0087.563] lstrlenW (lpString=".ckp") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".ckp") returned 0x0 [0087.563] lstrlenW (lpString=".dacpac") returned 7 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".dacpac") returned 0x0 [0087.563] lstrlenW (lpString=".db3") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".db3") returned 0x0 [0087.563] lstrlenW (lpString=".dtxs") returned 5 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".dtxs") returned 0x0 [0087.563] lstrlenW (lpString=".mdt") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".mdt") returned 0x0 [0087.563] lstrlenW (lpString=".sdf") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".sdf") returned 0x0 [0087.563] lstrlenW (lpString=".MDF") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".MDF") returned 0x0 [0087.563] lstrlenW (lpString=".DBF") returned 4 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".DBF") returned 0x0 [0087.563] lstrlenW (lpString=".DB") returned 3 [0087.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".DB") returned 0x0 [0087.563] lstrlenW (lpString=".db") returned 3 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".db") returned 0x0 [0087.564] lstrlenW (lpString=".ndf") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".ndf") returned 0x0 [0087.564] lstrlenW (lpString=".NDF") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".NDF") returned 0x0 [0087.564] lstrlenW (lpString=".Mdf") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".Mdf") returned 0x0 [0087.564] lstrlenW (lpString=".dat") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".dat") returned 0x0 [0087.564] lstrlenW (lpString=".DAT") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".DAT") returned 0x0 [0087.564] lstrlenW (lpString=".ldf") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".ldf") returned 0x0 [0087.564] lstrlenW (lpString=".LDF") returned 4 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch=".LDF") returned 0x0 [0087.564] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.564] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.565] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.565] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20756648601) returned 1 [0087.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3023170, dwHighDateTime=0x1d585b4)) [0087.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7898 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7898 | out: hHeap=0x260000) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.566] GetLastError () returned 0x0 [0087.566] GetLastError () returned 0x0 [0087.567] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.567] GetLastError () returned 0x0 [0087.567] GetLastError () returned 0x0 [0087.569] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.569] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0087.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.570] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.570] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.570] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.570] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.570] CloseHandle (hObject=0xd8) returned 1 [0087.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x150) returned 0x2b2d80 [0087.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.571] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b2d80 | out: hHeap=0x260000) returned 1 [0087.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.572] GetLastError () returned 0x0 [0087.572] RtlWakeConditionVariable () returned 0x0 [0087.572] GetCurrentThreadId () returned 0x9ac [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".ldf") returned 0x0 [0087.572] lstrlenW (lpString=".vhd") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".vhd") returned 0x0 [0087.572] lstrlenW (lpString=".vhdx") returned 5 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".vhdx") returned 0x0 [0087.572] lstrlenW (lpString=".pst") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".pst") returned 0x0 [0087.572] lstrlenW (lpString=".ost") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".ost") returned 0x0 [0087.572] lstrlenW (lpString=".bak") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".bak") returned 0x0 [0087.572] lstrlenW (lpString=".bac") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".bac") returned 0x0 [0087.572] lstrlenW (lpString=".sys") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".sys") returned 0x0 [0087.572] lstrlenW (lpString=".v2i") returned 4 [0087.572] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".v2i") returned 0x0 [0087.573] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.573] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.573] lstrlenW (lpString=".sql") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".sql") returned 0x0 [0087.574] lstrlenW (lpString=".mdf") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".mdf") returned 0x0 [0087.574] lstrlenW (lpString=".txt") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".txt") returned 0x0 [0087.574] lstrlenW (lpString=".dbf") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".dbf") returned 0x0 [0087.574] lstrlenW (lpString=".ckp") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".ckp") returned 0x0 [0087.574] lstrlenW (lpString=".dacpac") returned 7 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".dacpac") returned 0x0 [0087.574] lstrlenW (lpString=".db3") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".db3") returned 0x0 [0087.574] lstrlenW (lpString=".dtxs") returned 5 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".dtxs") returned 0x0 [0087.574] lstrlenW (lpString=".mdt") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".mdt") returned 0x0 [0087.574] lstrlenW (lpString=".sdf") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".sdf") returned 0x0 [0087.574] lstrlenW (lpString=".MDF") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".MDF") returned 0x0 [0087.574] lstrlenW (lpString=".DBF") returned 4 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".DBF") returned 0x0 [0087.574] lstrlenW (lpString=".DB") returned 3 [0087.574] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".DB") returned 0x0 [0087.574] lstrlenW (lpString=".db") returned 3 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".db") returned 0x0 [0087.575] lstrlenW (lpString=".ndf") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".ndf") returned 0x0 [0087.575] lstrlenW (lpString=".NDF") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".NDF") returned 0x0 [0087.575] lstrlenW (lpString=".Mdf") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".Mdf") returned 0x0 [0087.575] lstrlenW (lpString=".dat") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".dat") returned 0x0 [0087.575] lstrlenW (lpString=".DAT") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".DAT") returned 0x0 [0087.575] lstrlenW (lpString=".ldf") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".ldf") returned 0x0 [0087.575] lstrlenW (lpString=".LDF") returned 4 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch=".LDF") returned 0x0 [0087.575] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.575] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.576] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.576] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.576] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.576] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20757740119) returned 1 [0087.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3023170, dwHighDateTime=0x1d585b4)) [0087.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.576] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7860 [0087.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7860 | out: hHeap=0x260000) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.577] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.577] GetLastError () returned 0x0 [0087.577] GetLastError () returned 0x0 [0087.577] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.578] GetLastError () returned 0x0 [0087.578] GetLastError () returned 0x0 [0087.580] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.580] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0087.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.581] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.581] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.581] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.581] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.582] CloseHandle (hObject=0xd8) returned 1 [0087.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0087.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.583] GetLastError () returned 0x0 [0087.583] RtlWakeConditionVariable () returned 0x0 [0087.583] GetCurrentThreadId () returned 0x9ac [0087.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".ldf") returned 0x0 [0087.583] lstrlenW (lpString=".vhd") returned 4 [0087.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".vhd") returned 0x0 [0087.583] lstrlenW (lpString=".vhdx") returned 5 [0087.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".vhdx") returned 0x0 [0087.583] lstrlenW (lpString=".pst") returned 4 [0087.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".pst") returned 0x0 [0087.583] lstrlenW (lpString=".ost") returned 4 [0087.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".ost") returned 0x0 [0087.584] lstrlenW (lpString=".bak") returned 4 [0087.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".bak") returned 0x0 [0087.584] lstrlenW (lpString=".bac") returned 4 [0087.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".bac") returned 0x0 [0087.584] lstrlenW (lpString=".sys") returned 4 [0087.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".sys") returned 0x0 [0087.584] lstrlenW (lpString=".v2i") returned 4 [0087.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".v2i") returned 0x0 [0087.584] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch="s\r\n.v2i") returned 0x0 [0087.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.585] lstrlenW (lpString=".sql") returned 4 [0087.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".sql") returned 0x0 [0087.585] lstrlenW (lpString=".mdf") returned 4 [0087.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".mdf") returned 0x0 [0087.586] lstrlenW (lpString=".txt") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".txt") returned 0x0 [0087.586] lstrlenW (lpString=".dbf") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".dbf") returned 0x0 [0087.586] lstrlenW (lpString=".ckp") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".ckp") returned 0x0 [0087.586] lstrlenW (lpString=".dacpac") returned 7 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".dacpac") returned 0x0 [0087.586] lstrlenW (lpString=".db3") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".db3") returned 0x0 [0087.586] lstrlenW (lpString=".dtxs") returned 5 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".dtxs") returned 0x0 [0087.586] lstrlenW (lpString=".mdt") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".mdt") returned 0x0 [0087.586] lstrlenW (lpString=".sdf") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".sdf") returned 0x0 [0087.586] lstrlenW (lpString=".MDF") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".MDF") returned 0x0 [0087.586] lstrlenW (lpString=".DBF") returned 4 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".DBF") returned 0x0 [0087.586] lstrlenW (lpString=".DB") returned 3 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".DB") returned 0x0 [0087.586] lstrlenW (lpString=".db") returned 3 [0087.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".db") returned 0x0 [0087.586] lstrlenW (lpString=".ndf") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".ndf") returned 0x0 [0087.587] lstrlenW (lpString=".NDF") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".NDF") returned 0x0 [0087.587] lstrlenW (lpString=".Mdf") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".Mdf") returned 0x0 [0087.587] lstrlenW (lpString=".dat") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".dat") returned 0x0 [0087.587] lstrlenW (lpString=".DAT") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".DAT") returned 0x0 [0087.587] lstrlenW (lpString=".ldf") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".ldf") returned 0x0 [0087.587] lstrlenW (lpString=".LDF") returned 4 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch=".LDF") returned 0x0 [0087.587] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.587] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.588] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.588] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20758926082) returned 1 [0087.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc30492d0, dwHighDateTime=0x1d585b4)) [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d7828 [0087.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d7828 | out: hHeap=0x260000) returned 1 [0087.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.589] GetLastError () returned 0x0 [0087.589] GetLastError () returned 0x0 [0087.589] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.589] GetLastError () returned 0x0 [0087.590] GetLastError () returned 0x0 [0087.591] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe8293, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.591] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x17d6d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x17d6d, lpOverlapped=0x0) returned 1 [0087.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.592] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.592] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.592] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.592] CloseHandle (hObject=0xd8) returned 1 [0087.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.594] GetLastError () returned 0x0 [0087.594] RtlWakeConditionVariable () returned 0x0 [0087.594] GetCurrentThreadId () returned 0x9ac [0087.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".ldf") returned 0x0 [0087.594] lstrlenW (lpString=".vhd") returned 4 [0087.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".vhd") returned 0x0 [0087.594] lstrlenW (lpString=".vhdx") returned 5 [0087.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".vhdx") returned 0x0 [0087.594] lstrlenW (lpString=".pst") returned 4 [0087.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".pst") returned 0x0 [0087.594] lstrlenW (lpString=".ost") returned 4 [0087.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".ost") returned 0x0 [0087.595] lstrlenW (lpString=".bak") returned 4 [0087.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".bak") returned 0x0 [0087.595] lstrlenW (lpString=".bac") returned 4 [0087.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".bac") returned 0x0 [0087.595] lstrlenW (lpString=".sys") returned 4 [0087.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".sys") returned 0x0 [0087.595] lstrlenW (lpString=".v2i") returned 4 [0087.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".v2i") returned 0x0 [0087.595] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.596] lstrlenW (lpString=".sql") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".sql") returned 0x0 [0087.596] lstrlenW (lpString=".mdf") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".mdf") returned 0x0 [0087.596] lstrlenW (lpString=".txt") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".txt") returned 0x0 [0087.596] lstrlenW (lpString=".dbf") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".dbf") returned 0x0 [0087.596] lstrlenW (lpString=".ckp") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".ckp") returned 0x0 [0087.596] lstrlenW (lpString=".dacpac") returned 7 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".dacpac") returned 0x0 [0087.596] lstrlenW (lpString=".db3") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".db3") returned 0x0 [0087.596] lstrlenW (lpString=".dtxs") returned 5 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".dtxs") returned 0x0 [0087.596] lstrlenW (lpString=".mdt") returned 4 [0087.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".mdt") returned 0x0 [0087.597] lstrlenW (lpString=".sdf") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".sdf") returned 0x0 [0087.597] lstrlenW (lpString=".MDF") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".MDF") returned 0x0 [0087.597] lstrlenW (lpString=".DBF") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".DBF") returned 0x0 [0087.597] lstrlenW (lpString=".DB") returned 3 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".DB") returned 0x0 [0087.597] lstrlenW (lpString=".db") returned 3 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".db") returned 0x0 [0087.597] lstrlenW (lpString=".ndf") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".ndf") returned 0x0 [0087.597] lstrlenW (lpString=".NDF") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".NDF") returned 0x0 [0087.597] lstrlenW (lpString=".Mdf") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".Mdf") returned 0x0 [0087.597] lstrlenW (lpString=".dat") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".dat") returned 0x0 [0087.597] lstrlenW (lpString=".DAT") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".DAT") returned 0x0 [0087.597] lstrlenW (lpString=".ldf") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".ldf") returned 0x0 [0087.597] lstrlenW (lpString=".LDF") returned 4 [0087.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch=".LDF") returned 0x0 [0087.597] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.598] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.598] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.599] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20759973791) returned 1 [0087.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc306f430, dwHighDateTime=0x1d585b4)) [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77f0 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77f0 | out: hHeap=0x260000) returned 1 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.599] GetLastError () returned 0x0 [0087.600] GetLastError () returned 0x0 [0087.600] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.600] GetLastError () returned 0x0 [0087.600] GetLastError () returned 0x0 [0087.602] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe94cd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.602] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16b33, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x16b33, lpOverlapped=0x0) returned 1 [0087.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.603] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.603] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.603] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.603] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.603] CloseHandle (hObject=0xd8) returned 1 [0087.603] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0087.604] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.604] GetLastError () returned 0x0 [0087.605] RtlWakeConditionVariable () returned 0x0 [0087.605] GetCurrentThreadId () returned 0x9ac [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".ldf") returned 0x0 [0087.605] lstrlenW (lpString=".vhd") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".vhd") returned 0x0 [0087.605] lstrlenW (lpString=".vhdx") returned 5 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".vhdx") returned 0x0 [0087.605] lstrlenW (lpString=".pst") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".pst") returned 0x0 [0087.605] lstrlenW (lpString=".ost") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".ost") returned 0x0 [0087.605] lstrlenW (lpString=".bak") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".bak") returned 0x0 [0087.605] lstrlenW (lpString=".bac") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".bac") returned 0x0 [0087.605] lstrlenW (lpString=".sys") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".sys") returned 0x0 [0087.605] lstrlenW (lpString=".v2i") returned 4 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".v2i") returned 0x0 [0087.605] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.605] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.606] lstrlenW (lpString=".sql") returned 4 [0087.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".sql") returned 0x0 [0087.606] lstrlenW (lpString=".mdf") returned 4 [0087.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".mdf") returned 0x0 [0087.606] lstrlenW (lpString=".txt") returned 4 [0087.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".txt") returned 0x0 [0087.607] lstrlenW (lpString=".dbf") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".dbf") returned 0x0 [0087.607] lstrlenW (lpString=".ckp") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".ckp") returned 0x0 [0087.607] lstrlenW (lpString=".dacpac") returned 7 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".dacpac") returned 0x0 [0087.607] lstrlenW (lpString=".db3") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".db3") returned 0x0 [0087.607] lstrlenW (lpString=".dtxs") returned 5 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".dtxs") returned 0x0 [0087.607] lstrlenW (lpString=".mdt") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".mdt") returned 0x0 [0087.607] lstrlenW (lpString=".sdf") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".sdf") returned 0x0 [0087.607] lstrlenW (lpString=".MDF") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".MDF") returned 0x0 [0087.607] lstrlenW (lpString=".DBF") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".DBF") returned 0x0 [0087.607] lstrlenW (lpString=".DB") returned 3 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".DB") returned 0x0 [0087.607] lstrlenW (lpString=".db") returned 3 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".db") returned 0x0 [0087.607] lstrlenW (lpString=".ndf") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".ndf") returned 0x0 [0087.607] lstrlenW (lpString=".NDF") returned 4 [0087.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".NDF") returned 0x0 [0087.608] lstrlenW (lpString=".Mdf") returned 4 [0087.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".Mdf") returned 0x0 [0087.608] lstrlenW (lpString=".dat") returned 4 [0087.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".dat") returned 0x0 [0087.608] lstrlenW (lpString=".DAT") returned 4 [0087.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".DAT") returned 0x0 [0087.608] lstrlenW (lpString=".ldf") returned 4 [0087.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".ldf") returned 0x0 [0087.608] lstrlenW (lpString=".LDF") returned 4 [0087.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch=".LDF") returned 0x0 [0087.608] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.608] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.608] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.609] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.609] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.609] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20761017370) returned 1 [0087.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc306f430, dwHighDateTime=0x1d585b4)) [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d600 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.609] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d600 | out: hHeap=0x260000) returned 1 [0087.609] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.610] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.610] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.610] GetLastError () returned 0x0 [0087.610] GetLastError () returned 0x0 [0087.611] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.611] GetLastError () returned 0x0 [0087.611] GetLastError () returned 0x0 [0087.613] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7153, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.613] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x18ead, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x18ead, lpOverlapped=0x0) returned 1 [0087.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.614] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.614] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.614] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.614] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.614] CloseHandle (hObject=0xd8) returned 1 [0087.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0087.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0087.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.615] GetLastError () returned 0x0 [0087.616] RtlWakeConditionVariable () returned 0x0 [0087.616] GetCurrentThreadId () returned 0x9ac [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".ldf") returned 0x0 [0087.616] lstrlenW (lpString=".vhd") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".vhd") returned 0x0 [0087.616] lstrlenW (lpString=".vhdx") returned 5 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".vhdx") returned 0x0 [0087.616] lstrlenW (lpString=".pst") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".pst") returned 0x0 [0087.616] lstrlenW (lpString=".ost") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".ost") returned 0x0 [0087.616] lstrlenW (lpString=".bak") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".bak") returned 0x0 [0087.616] lstrlenW (lpString=".bac") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".bac") returned 0x0 [0087.616] lstrlenW (lpString=".sys") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".sys") returned 0x0 [0087.616] lstrlenW (lpString=".v2i") returned 4 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".v2i") returned 0x0 [0087.616] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.616] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch="s\r\n.v2i") returned 0x0 [0087.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0087.617] lstrlenW (lpString=".sql") returned 4 [0087.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".sql") returned 0x0 [0087.617] lstrlenW (lpString=".mdf") returned 4 [0087.617] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".mdf") returned 0x0 [0087.618] lstrlenW (lpString=".txt") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".txt") returned 0x0 [0087.618] lstrlenW (lpString=".dbf") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".dbf") returned 0x0 [0087.618] lstrlenW (lpString=".ckp") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".ckp") returned 0x0 [0087.618] lstrlenW (lpString=".dacpac") returned 7 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".dacpac") returned 0x0 [0087.618] lstrlenW (lpString=".db3") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".db3") returned 0x0 [0087.618] lstrlenW (lpString=".dtxs") returned 5 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".dtxs") returned 0x0 [0087.618] lstrlenW (lpString=".mdt") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".mdt") returned 0x0 [0087.618] lstrlenW (lpString=".sdf") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".sdf") returned 0x0 [0087.618] lstrlenW (lpString=".MDF") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".MDF") returned 0x0 [0087.618] lstrlenW (lpString=".DBF") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".DBF") returned 0x0 [0087.618] lstrlenW (lpString=".DB") returned 3 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".DB") returned 0x0 [0087.618] lstrlenW (lpString=".db") returned 3 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".db") returned 0x0 [0087.618] lstrlenW (lpString=".ndf") returned 4 [0087.618] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".ndf") returned 0x0 [0087.619] lstrlenW (lpString=".NDF") returned 4 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".NDF") returned 0x0 [0087.619] lstrlenW (lpString=".Mdf") returned 4 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".Mdf") returned 0x0 [0087.619] lstrlenW (lpString=".dat") returned 4 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".dat") returned 0x0 [0087.619] lstrlenW (lpString=".DAT") returned 4 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".DAT") returned 0x0 [0087.619] lstrlenW (lpString=".ldf") returned 4 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".ldf") returned 0x0 [0087.619] lstrlenW (lpString=".LDF") returned 4 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch=".LDF") returned 0x0 [0087.619] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0087.619] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.619] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.620] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.620] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.620] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0087.620] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20762127708) returned 1 [0087.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3095590, dwHighDateTime=0x1d585b4)) [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d638 [0087.620] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d638 | out: hHeap=0x260000) returned 1 [0087.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.621] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.621] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.621] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.621] GetLastError () returned 0x0 [0087.621] GetLastError () returned 0x0 [0087.621] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.621] GetLastError () returned 0x0 [0087.622] GetLastError () returned 0x0 [0087.683] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.683] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0087.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.684] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.684] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.684] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.684] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.684] CloseHandle (hObject=0xd8) returned 1 [0087.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0087.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.[deadmin@cock.li].deadmin")) returned 1 [0087.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0087.686] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0087.686] GetLastError () returned 0x0 [0087.686] RtlWakeConditionVariable () returned 0x0 [0087.686] GetCurrentThreadId () returned 0x9ac [0087.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".ldf") returned 0x0 [0087.686] lstrlenW (lpString=".vhd") returned 4 [0087.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".vhd") returned 0x0 [0087.686] lstrlenW (lpString=".vhdx") returned 5 [0087.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".vhdx") returned 0x0 [0087.686] lstrlenW (lpString=".pst") returned 4 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".pst") returned 0x0 [0087.687] lstrlenW (lpString=".ost") returned 4 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".ost") returned 0x0 [0087.687] lstrlenW (lpString=".bak") returned 4 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".bak") returned 0x0 [0087.687] lstrlenW (lpString=".bac") returned 4 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".bac") returned 0x0 [0087.687] lstrlenW (lpString=".sys") returned 4 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".sys") returned 0x0 [0087.687] lstrlenW (lpString=".v2i") returned 4 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".v2i") returned 0x0 [0087.687] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch="s\r\n.v2i") returned 0x0 [0087.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.805] lstrlenW (lpString=".sql") returned 4 [0087.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".sql") returned 0x0 [0087.805] lstrlenW (lpString=".mdf") returned 4 [0087.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".mdf") returned 0x0 [0087.805] lstrlenW (lpString=".txt") returned 4 [0087.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".txt") returned 0x0 [0087.805] lstrlenW (lpString=".dbf") returned 4 [0087.805] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".dbf") returned 0x0 [0087.805] lstrlenW (lpString=".ckp") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".ckp") returned 0x0 [0087.806] lstrlenW (lpString=".dacpac") returned 7 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".dacpac") returned 0x0 [0087.806] lstrlenW (lpString=".db3") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".db3") returned 0x0 [0087.806] lstrlenW (lpString=".dtxs") returned 5 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".dtxs") returned 0x0 [0087.806] lstrlenW (lpString=".mdt") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".mdt") returned 0x0 [0087.806] lstrlenW (lpString=".sdf") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".sdf") returned 0x0 [0087.806] lstrlenW (lpString=".MDF") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".MDF") returned 0x0 [0087.806] lstrlenW (lpString=".DBF") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".DBF") returned 0x0 [0087.806] lstrlenW (lpString=".DB") returned 3 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".DB") returned 0x0 [0087.806] lstrlenW (lpString=".db") returned 3 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".db") returned 0x0 [0087.806] lstrlenW (lpString=".ndf") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".ndf") returned 0x0 [0087.806] lstrlenW (lpString=".NDF") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".NDF") returned 0x0 [0087.806] lstrlenW (lpString=".Mdf") returned 4 [0087.806] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".Mdf") returned 0x0 [0087.806] lstrlenW (lpString=".dat") returned 4 [0087.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".dat") returned 0x0 [0087.807] lstrlenW (lpString=".DAT") returned 4 [0087.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".DAT") returned 0x0 [0087.807] lstrlenW (lpString=".ldf") returned 4 [0087.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".ldf") returned 0x0 [0087.807] lstrlenW (lpString=".LDF") returned 4 [0087.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch=".LDF") returned 0x0 [0087.807] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.807] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0087.807] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.808] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0087.808] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.808] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20780907504) returned 1 [0087.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc325e610, dwHighDateTime=0x1d585b4)) [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d980 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d980 | out: hHeap=0x260000) returned 1 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.808] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.808] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.809] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.809] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.809] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.809] GetLastError () returned 0x0 [0087.809] GetLastError () returned 0x0 [0087.809] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.809] GetLastError () returned 0x0 [0087.809] GetLastError () returned 0x0 [0087.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe982f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.812] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x167d1, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x167d1, lpOverlapped=0x0) returned 1 [0087.812] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.812] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.812] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.813] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.813] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.813] CloseHandle (hObject=0xf0) returned 1 [0087.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.[deadmin@cock.li].deadmin")) returned 1 [0087.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.814] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.814] GetLastError () returned 0x0 [0087.814] RtlWakeConditionVariable () returned 0x0 [0087.815] GetCurrentThreadId () returned 0x9ac [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".ldf") returned 0x0 [0087.815] lstrlenW (lpString=".vhd") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".vhd") returned 0x0 [0087.815] lstrlenW (lpString=".vhdx") returned 5 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".vhdx") returned 0x0 [0087.815] lstrlenW (lpString=".pst") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".pst") returned 0x0 [0087.815] lstrlenW (lpString=".ost") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".ost") returned 0x0 [0087.815] lstrlenW (lpString=".bak") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".bak") returned 0x0 [0087.815] lstrlenW (lpString=".bac") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".bac") returned 0x0 [0087.815] lstrlenW (lpString=".sys") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".sys") returned 0x0 [0087.815] lstrlenW (lpString=".v2i") returned 4 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".v2i") returned 0x0 [0087.815] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.815] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0087.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.816] lstrlenW (lpString=".sql") returned 4 [0087.816] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".sql") returned 0x0 [0087.816] lstrlenW (lpString=".mdf") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".mdf") returned 0x0 [0087.817] lstrlenW (lpString=".txt") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".txt") returned 0x0 [0087.817] lstrlenW (lpString=".dbf") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".dbf") returned 0x0 [0087.817] lstrlenW (lpString=".ckp") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".ckp") returned 0x0 [0087.817] lstrlenW (lpString=".dacpac") returned 7 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".dacpac") returned 0x0 [0087.817] lstrlenW (lpString=".db3") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".db3") returned 0x0 [0087.817] lstrlenW (lpString=".dtxs") returned 5 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".dtxs") returned 0x0 [0087.817] lstrlenW (lpString=".mdt") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".mdt") returned 0x0 [0087.817] lstrlenW (lpString=".sdf") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".sdf") returned 0x0 [0087.817] lstrlenW (lpString=".MDF") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".MDF") returned 0x0 [0087.817] lstrlenW (lpString=".DBF") returned 4 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".DBF") returned 0x0 [0087.817] lstrlenW (lpString=".DB") returned 3 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".DB") returned 0x0 [0087.817] lstrlenW (lpString=".db") returned 3 [0087.817] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".db") returned 0x0 [0087.818] lstrlenW (lpString=".ndf") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".ndf") returned 0x0 [0087.818] lstrlenW (lpString=".NDF") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".NDF") returned 0x0 [0087.818] lstrlenW (lpString=".Mdf") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".Mdf") returned 0x0 [0087.818] lstrlenW (lpString=".dat") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".dat") returned 0x0 [0087.818] lstrlenW (lpString=".DAT") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".DAT") returned 0x0 [0087.818] lstrlenW (lpString=".ldf") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".ldf") returned 0x0 [0087.818] lstrlenW (lpString=".LDF") returned 4 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch=".LDF") returned 0x0 [0087.818] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.818] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0087.818] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.819] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0087.819] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.819] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0087.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.819] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20782166086) returned 1 [0087.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3284770, dwHighDateTime=0x1d585b4)) [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d9b8 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d9b8 | out: hHeap=0x260000) returned 1 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.821] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.821] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.821] GetLastError () returned 0x0 [0087.822] GetLastError () returned 0x0 [0087.822] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.822] GetLastError () returned 0x0 [0087.822] GetLastError () returned 0x0 [0087.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.823] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13e, lpOverlapped=0x0) returned 1 [0087.823] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.823] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.824] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.824] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.824] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.824] CloseHandle (hObject=0xf0) returned 1 [0087.824] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0087.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.[deadmin@cock.li].deadmin")) returned 1 [0087.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0087.825] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.826] GetLastError () returned 0x0 [0087.826] RtlWakeConditionVariable () returned 0x27e828 [0087.826] GetCurrentThreadId () returned 0x9ac [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".ldf") returned 0x0 [0087.826] lstrlenW (lpString=".vhd") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".vhd") returned 0x0 [0087.826] lstrlenW (lpString=".vhdx") returned 5 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".vhdx") returned 0x0 [0087.826] lstrlenW (lpString=".pst") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".pst") returned 0x0 [0087.826] lstrlenW (lpString=".ost") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".ost") returned 0x0 [0087.826] lstrlenW (lpString=".bak") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".bak") returned 0x0 [0087.826] lstrlenW (lpString=".bac") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".bac") returned 0x0 [0087.826] lstrlenW (lpString=".sys") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".sys") returned 0x0 [0087.826] lstrlenW (lpString=".v2i") returned 4 [0087.826] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".v2i") returned 0x0 [0087.827] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.827] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch="s\r\n.v2i") returned 0x0 [0087.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.827] lstrlenW (lpString=".sql") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".sql") returned 0x0 [0087.828] lstrlenW (lpString=".mdf") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".mdf") returned 0x0 [0087.828] lstrlenW (lpString=".txt") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".txt") returned 0x0 [0087.828] lstrlenW (lpString=".dbf") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".dbf") returned 0x0 [0087.828] lstrlenW (lpString=".ckp") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".ckp") returned 0x0 [0087.828] lstrlenW (lpString=".dacpac") returned 7 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".dacpac") returned 0x0 [0087.828] lstrlenW (lpString=".db3") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".db3") returned 0x0 [0087.828] lstrlenW (lpString=".dtxs") returned 5 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".dtxs") returned 0x0 [0087.828] lstrlenW (lpString=".mdt") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".mdt") returned 0x0 [0087.828] lstrlenW (lpString=".sdf") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".sdf") returned 0x0 [0087.828] lstrlenW (lpString=".MDF") returned 4 [0087.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".MDF") returned 0x0 [0087.829] lstrlenW (lpString=".DBF") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".DBF") returned 0x0 [0087.829] lstrlenW (lpString=".DB") returned 3 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".DB") returned 0x0 [0087.829] lstrlenW (lpString=".db") returned 3 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".db") returned 0x0 [0087.829] lstrlenW (lpString=".ndf") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".ndf") returned 0x0 [0087.829] lstrlenW (lpString=".NDF") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".NDF") returned 0x0 [0087.829] lstrlenW (lpString=".Mdf") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".Mdf") returned 0x0 [0087.829] lstrlenW (lpString=".dat") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".dat") returned 0x0 [0087.829] lstrlenW (lpString=".DAT") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".DAT") returned 0x0 [0087.829] lstrlenW (lpString=".ldf") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".ldf") returned 0x0 [0087.829] lstrlenW (lpString=".LDF") returned 4 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch=".LDF") returned 0x0 [0087.829] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f100 [0087.829] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.830] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f100 | out: pbBuffer=0x27f100) returned 1 [0087.830] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f100 | out: hHeap=0x260000) returned 1 [0087.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.830] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20783155255) returned 1 [0087.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc32aa8d0, dwHighDateTime=0x1d585b4)) [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33d9f0 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33d9f0 | out: hHeap=0x260000) returned 1 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.831] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.831] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.831] GetLastError () returned 0x0 [0087.831] GetLastError () returned 0x0 [0087.832] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.832] GetLastError () returned 0x0 [0087.832] GetLastError () returned 0x0 [0087.855] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffafa5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.855] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x505b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x505b, lpOverlapped=0x0) returned 1 [0087.855] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0087.856] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.856] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.856] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.856] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.856] CloseHandle (hObject=0xf0) returned 1 [0087.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edde8 [0087.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js.[deadmin@cock.li].deadmin")) returned 1 [0087.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edde8 | out: hHeap=0x260000) returned 1 [0087.866] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.866] GetLastError () returned 0x0 [0087.866] RtlWakeConditionVariable () returned 0x0 [0087.866] GetCurrentThreadId () returned 0x9ac [0087.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".ldf") returned 0x0 [0087.866] lstrlenW (lpString=".vhd") returned 4 [0087.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".vhd") returned 0x0 [0087.866] lstrlenW (lpString=".vhdx") returned 5 [0087.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".vhdx") returned 0x0 [0087.866] lstrlenW (lpString=".pst") returned 4 [0087.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".pst") returned 0x0 [0087.866] lstrlenW (lpString=".ost") returned 4 [0087.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".ost") returned 0x0 [0087.867] lstrlenW (lpString=".bak") returned 4 [0087.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".bak") returned 0x0 [0087.867] lstrlenW (lpString=".bac") returned 4 [0087.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".bac") returned 0x0 [0087.867] lstrlenW (lpString=".sys") returned 4 [0087.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".sys") returned 0x0 [0087.867] lstrlenW (lpString=".v2i") returned 4 [0087.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".v2i") returned 0x0 [0087.867] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.869] lstrlenW (lpString=".sql") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".sql") returned 0x0 [0087.869] lstrlenW (lpString=".mdf") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".mdf") returned 0x0 [0087.869] lstrlenW (lpString=".txt") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".txt") returned 0x0 [0087.869] lstrlenW (lpString=".dbf") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".dbf") returned 0x0 [0087.869] lstrlenW (lpString=".ckp") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".ckp") returned 0x0 [0087.869] lstrlenW (lpString=".dacpac") returned 7 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".dacpac") returned 0x0 [0087.869] lstrlenW (lpString=".db3") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".db3") returned 0x0 [0087.869] lstrlenW (lpString=".dtxs") returned 5 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".dtxs") returned 0x0 [0087.869] lstrlenW (lpString=".mdt") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".mdt") returned 0x0 [0087.869] lstrlenW (lpString=".sdf") returned 4 [0087.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".sdf") returned 0x0 [0087.870] lstrlenW (lpString=".MDF") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".MDF") returned 0x0 [0087.870] lstrlenW (lpString=".DBF") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".DBF") returned 0x0 [0087.870] lstrlenW (lpString=".DB") returned 3 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".DB") returned 0x0 [0087.870] lstrlenW (lpString=".db") returned 3 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".db") returned 0x0 [0087.870] lstrlenW (lpString=".ndf") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".ndf") returned 0x0 [0087.870] lstrlenW (lpString=".NDF") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".NDF") returned 0x0 [0087.870] lstrlenW (lpString=".Mdf") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".Mdf") returned 0x0 [0087.870] lstrlenW (lpString=".dat") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".dat") returned 0x0 [0087.870] lstrlenW (lpString=".DAT") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".DAT") returned 0x0 [0087.870] lstrlenW (lpString=".ldf") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".ldf") returned 0x0 [0087.870] lstrlenW (lpString=".LDF") returned 4 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch=".LDF") returned 0x0 [0087.870] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.870] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.871] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.871] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.871] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.872] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20787267754) returned 1 [0087.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc32f6b90, dwHighDateTime=0x1d585b4)) [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33da98 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33da98 | out: hHeap=0x260000) returned 1 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.872] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.872] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.872] GetLastError () returned 0x0 [0087.873] GetLastError () returned 0x0 [0087.873] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.873] GetLastError () returned 0x0 [0087.873] GetLastError () returned 0x0 [0087.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.875] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd78, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd78, lpOverlapped=0x0) returned 1 [0087.875] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.875] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.875] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.875] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.876] CloseHandle (hObject=0xf0) returned 1 [0087.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.878] GetLastError () returned 0x0 [0087.878] RtlWakeConditionVariable () returned 0x0 [0087.878] GetCurrentThreadId () returned 0x9ac [0087.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".ldf") returned 0x0 [0087.878] lstrlenW (lpString=".vhd") returned 4 [0087.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".vhd") returned 0x0 [0087.878] lstrlenW (lpString=".vhdx") returned 5 [0087.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".vhdx") returned 0x0 [0087.878] lstrlenW (lpString=".pst") returned 4 [0087.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".pst") returned 0x0 [0087.878] lstrlenW (lpString=".ost") returned 4 [0087.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".ost") returned 0x0 [0087.879] lstrlenW (lpString=".bak") returned 4 [0087.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".bak") returned 0x0 [0087.879] lstrlenW (lpString=".bac") returned 4 [0087.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".bac") returned 0x0 [0087.879] lstrlenW (lpString=".sys") returned 4 [0087.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".sys") returned 0x0 [0087.879] lstrlenW (lpString=".v2i") returned 4 [0087.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".v2i") returned 0x0 [0087.879] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.879] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch="s\r\n.v2i") returned 0x0 [0087.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.880] lstrlenW (lpString=".sql") returned 4 [0087.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".sql") returned 0x0 [0087.880] lstrlenW (lpString=".mdf") returned 4 [0087.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".mdf") returned 0x0 [0087.880] lstrlenW (lpString=".txt") returned 4 [0087.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".txt") returned 0x0 [0087.880] lstrlenW (lpString=".dbf") returned 4 [0087.880] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".dbf") returned 0x0 [0087.881] lstrlenW (lpString=".ckp") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".ckp") returned 0x0 [0087.881] lstrlenW (lpString=".dacpac") returned 7 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".dacpac") returned 0x0 [0087.881] lstrlenW (lpString=".db3") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".db3") returned 0x0 [0087.881] lstrlenW (lpString=".dtxs") returned 5 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".dtxs") returned 0x0 [0087.881] lstrlenW (lpString=".mdt") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".mdt") returned 0x0 [0087.881] lstrlenW (lpString=".sdf") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".sdf") returned 0x0 [0087.881] lstrlenW (lpString=".MDF") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".MDF") returned 0x0 [0087.881] lstrlenW (lpString=".DBF") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".DBF") returned 0x0 [0087.881] lstrlenW (lpString=".DB") returned 3 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".DB") returned 0x0 [0087.881] lstrlenW (lpString=".db") returned 3 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".db") returned 0x0 [0087.881] lstrlenW (lpString=".ndf") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".ndf") returned 0x0 [0087.881] lstrlenW (lpString=".NDF") returned 4 [0087.881] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".NDF") returned 0x0 [0087.881] lstrlenW (lpString=".Mdf") returned 4 [0087.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".Mdf") returned 0x0 [0087.882] lstrlenW (lpString=".dat") returned 4 [0087.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".dat") returned 0x0 [0087.882] lstrlenW (lpString=".DAT") returned 4 [0087.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".DAT") returned 0x0 [0087.882] lstrlenW (lpString=".ldf") returned 4 [0087.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".ldf") returned 0x0 [0087.882] lstrlenW (lpString=".LDF") returned 4 [0087.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch=".LDF") returned 0x0 [0087.882] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.882] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.882] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.882] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.883] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.883] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.883] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20788416902) returned 1 [0087.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc331ccf0, dwHighDateTime=0x1d585b4)) [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dad0 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dad0 | out: hHeap=0x260000) returned 1 [0087.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.884] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.884] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.884] GetLastError () returned 0x0 [0087.884] GetLastError () returned 0x0 [0087.884] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.884] GetLastError () returned 0x0 [0087.884] GetLastError () returned 0x0 [0087.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.886] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xce, lpOverlapped=0x0) returned 1 [0087.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.886] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.886] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.886] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.886] CloseHandle (hObject=0xf0) returned 1 [0087.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js.[deadmin@cock.li].deadmin")) returned 1 [0087.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.888] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.888] GetLastError () returned 0x0 [0087.888] RtlWakeConditionVariable () returned 0x27e828 [0087.888] GetCurrentThreadId () returned 0x9ac [0087.889] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0087.889] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0087.889] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0087.889] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0087.891] CloseHandle (hObject=0xf0) returned 1 [0087.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2ee890 | out: hHeap=0x260000) returned 1 [0087.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2edde8 | out: hHeap=0x260000) returned 1 [0087.891] RtlWakeConditionVariable () returned 0x27e828 [0087.891] GetCurrentThreadId () returned 0x9ac [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".ldf") returned 0x0 [0087.892] lstrlenW (lpString=".vhd") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".vhd") returned 0x0 [0087.892] lstrlenW (lpString=".vhdx") returned 5 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".vhdx") returned 0x0 [0087.892] lstrlenW (lpString=".pst") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".pst") returned 0x0 [0087.892] lstrlenW (lpString=".ost") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".ost") returned 0x0 [0087.892] lstrlenW (lpString=".bak") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".bak") returned 0x0 [0087.892] lstrlenW (lpString=".bac") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".bac") returned 0x0 [0087.892] lstrlenW (lpString=".sys") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".sys") returned 0x0 [0087.892] lstrlenW (lpString=".v2i") returned 4 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".v2i") returned 0x0 [0087.892] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0087.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.893] lstrlenW (lpString=".sql") returned 4 [0087.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".sql") returned 0x0 [0087.894] lstrlenW (lpString=".mdf") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".mdf") returned 0x0 [0087.894] lstrlenW (lpString=".txt") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".txt") returned 0x0 [0087.894] lstrlenW (lpString=".dbf") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".dbf") returned 0x0 [0087.894] lstrlenW (lpString=".ckp") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".ckp") returned 0x0 [0087.894] lstrlenW (lpString=".dacpac") returned 7 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".dacpac") returned 0x0 [0087.894] lstrlenW (lpString=".db3") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".db3") returned 0x0 [0087.894] lstrlenW (lpString=".dtxs") returned 5 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".dtxs") returned 0x0 [0087.894] lstrlenW (lpString=".mdt") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".mdt") returned 0x0 [0087.894] lstrlenW (lpString=".sdf") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".sdf") returned 0x0 [0087.894] lstrlenW (lpString=".MDF") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".MDF") returned 0x0 [0087.894] lstrlenW (lpString=".DBF") returned 4 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".DBF") returned 0x0 [0087.894] lstrlenW (lpString=".DB") returned 3 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".DB") returned 0x0 [0087.894] lstrlenW (lpString=".db") returned 3 [0087.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".db") returned 0x0 [0087.895] lstrlenW (lpString=".ndf") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".ndf") returned 0x0 [0087.895] lstrlenW (lpString=".NDF") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".NDF") returned 0x0 [0087.895] lstrlenW (lpString=".Mdf") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".Mdf") returned 0x0 [0087.895] lstrlenW (lpString=".dat") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".dat") returned 0x0 [0087.895] lstrlenW (lpString=".DAT") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".DAT") returned 0x0 [0087.895] lstrlenW (lpString=".ldf") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".ldf") returned 0x0 [0087.895] lstrlenW (lpString=".LDF") returned 4 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch=".LDF") returned 0x0 [0087.895] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.895] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.896] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.896] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20789738039) returned 1 [0087.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3342e50, dwHighDateTime=0x1d585b4)) [0087.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ca8 [0087.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ca8 | out: hHeap=0x260000) returned 1 [0087.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.897] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.897] GetLastError () returned 0x0 [0087.897] GetLastError () returned 0x0 [0087.897] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.898] GetLastError () returned 0x0 [0087.898] GetLastError () returned 0x0 [0087.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.899] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x244, lpOverlapped=0x0) returned 1 [0087.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.899] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.899] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.899] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.899] CloseHandle (hObject=0xf0) returned 1 [0087.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313548 [0087.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.[deadmin@cock.li].deadmin")) returned 1 [0087.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313548 | out: hHeap=0x260000) returned 1 [0087.901] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.901] GetLastError () returned 0x0 [0087.901] RtlWakeConditionVariable () returned 0x0 [0087.901] GetCurrentThreadId () returned 0x9ac [0087.901] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".ldf") returned 0x0 [0087.901] lstrlenW (lpString=".vhd") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".vhd") returned 0x0 [0087.902] lstrlenW (lpString=".vhdx") returned 5 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".vhdx") returned 0x0 [0087.902] lstrlenW (lpString=".pst") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".pst") returned 0x0 [0087.902] lstrlenW (lpString=".ost") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".ost") returned 0x0 [0087.902] lstrlenW (lpString=".bak") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".bak") returned 0x0 [0087.902] lstrlenW (lpString=".bac") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".bac") returned 0x0 [0087.902] lstrlenW (lpString=".sys") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".sys") returned 0x0 [0087.902] lstrlenW (lpString=".v2i") returned 4 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".v2i") returned 0x0 [0087.902] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0087.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.903] lstrlenW (lpString=".sql") returned 4 [0087.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".sql") returned 0x0 [0087.903] lstrlenW (lpString=".mdf") returned 4 [0087.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".mdf") returned 0x0 [0087.903] lstrlenW (lpString=".txt") returned 4 [0087.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".txt") returned 0x0 [0087.903] lstrlenW (lpString=".dbf") returned 4 [0087.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".dbf") returned 0x0 [0087.904] lstrlenW (lpString=".ckp") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".ckp") returned 0x0 [0087.904] lstrlenW (lpString=".dacpac") returned 7 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".dacpac") returned 0x0 [0087.904] lstrlenW (lpString=".db3") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".db3") returned 0x0 [0087.904] lstrlenW (lpString=".dtxs") returned 5 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".dtxs") returned 0x0 [0087.904] lstrlenW (lpString=".mdt") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".mdt") returned 0x0 [0087.904] lstrlenW (lpString=".sdf") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".sdf") returned 0x0 [0087.904] lstrlenW (lpString=".MDF") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".MDF") returned 0x0 [0087.904] lstrlenW (lpString=".DBF") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".DBF") returned 0x0 [0087.904] lstrlenW (lpString=".DB") returned 3 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".DB") returned 0x0 [0087.904] lstrlenW (lpString=".db") returned 3 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".db") returned 0x0 [0087.904] lstrlenW (lpString=".ndf") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".ndf") returned 0x0 [0087.904] lstrlenW (lpString=".NDF") returned 4 [0087.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".NDF") returned 0x0 [0087.904] lstrlenW (lpString=".Mdf") returned 4 [0087.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".Mdf") returned 0x0 [0087.905] lstrlenW (lpString=".dat") returned 4 [0087.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".dat") returned 0x0 [0087.905] lstrlenW (lpString=".DAT") returned 4 [0087.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".DAT") returned 0x0 [0087.905] lstrlenW (lpString=".ldf") returned 4 [0087.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".ldf") returned 0x0 [0087.905] lstrlenW (lpString=".LDF") returned 4 [0087.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch=".LDF") returned 0x0 [0087.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.905] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.906] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.906] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20790748012) returned 1 [0087.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3368fb0, dwHighDateTime=0x1d585b4)) [0087.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9c70 [0087.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9c70 | out: hHeap=0x260000) returned 1 [0087.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.907] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.907] GetLastError () returned 0x0 [0087.907] GetLastError () returned 0x0 [0087.907] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.908] GetLastError () returned 0x0 [0087.908] GetLastError () returned 0x0 [0087.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff418, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.909] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xbe8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xbe8, lpOverlapped=0x0) returned 1 [0087.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.910] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.910] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.910] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.910] CloseHandle (hObject=0xf0) returned 1 [0087.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.[deadmin@cock.li].deadmin")) returned 1 [0087.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.912] GetLastError () returned 0x0 [0087.912] RtlWakeConditionVariable () returned 0x0 [0087.912] GetCurrentThreadId () returned 0x9ac [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".ldf") returned 0x0 [0087.912] lstrlenW (lpString=".vhd") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".vhd") returned 0x0 [0087.912] lstrlenW (lpString=".vhdx") returned 5 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".vhdx") returned 0x0 [0087.912] lstrlenW (lpString=".pst") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".pst") returned 0x0 [0087.912] lstrlenW (lpString=".ost") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".ost") returned 0x0 [0087.912] lstrlenW (lpString=".bak") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".bak") returned 0x0 [0087.912] lstrlenW (lpString=".bac") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".bac") returned 0x0 [0087.912] lstrlenW (lpString=".sys") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".sys") returned 0x0 [0087.912] lstrlenW (lpString=".v2i") returned 4 [0087.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".v2i") returned 0x0 [0087.913] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0087.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.914] lstrlenW (lpString=".sql") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".sql") returned 0x0 [0087.914] lstrlenW (lpString=".mdf") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".mdf") returned 0x0 [0087.914] lstrlenW (lpString=".txt") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".txt") returned 0x0 [0087.914] lstrlenW (lpString=".dbf") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".dbf") returned 0x0 [0087.914] lstrlenW (lpString=".ckp") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".ckp") returned 0x0 [0087.914] lstrlenW (lpString=".dacpac") returned 7 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".dacpac") returned 0x0 [0087.914] lstrlenW (lpString=".db3") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".db3") returned 0x0 [0087.914] lstrlenW (lpString=".dtxs") returned 5 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".dtxs") returned 0x0 [0087.914] lstrlenW (lpString=".mdt") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".mdt") returned 0x0 [0087.914] lstrlenW (lpString=".sdf") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".sdf") returned 0x0 [0087.914] lstrlenW (lpString=".MDF") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".MDF") returned 0x0 [0087.914] lstrlenW (lpString=".DBF") returned 4 [0087.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".DBF") returned 0x0 [0087.915] lstrlenW (lpString=".DB") returned 3 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".DB") returned 0x0 [0087.915] lstrlenW (lpString=".db") returned 3 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".db") returned 0x0 [0087.915] lstrlenW (lpString=".ndf") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".ndf") returned 0x0 [0087.915] lstrlenW (lpString=".NDF") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".NDF") returned 0x0 [0087.915] lstrlenW (lpString=".Mdf") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".Mdf") returned 0x0 [0087.915] lstrlenW (lpString=".dat") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".dat") returned 0x0 [0087.915] lstrlenW (lpString=".DAT") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".DAT") returned 0x0 [0087.915] lstrlenW (lpString=".ldf") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".ldf") returned 0x0 [0087.915] lstrlenW (lpString=".LDF") returned 4 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch=".LDF") returned 0x0 [0087.915] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.915] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.915] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.916] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.916] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.916] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20791749741) returned 1 [0087.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3368fb0, dwHighDateTime=0x1d585b4)) [0087.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9c38 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9c38 | out: hHeap=0x260000) returned 1 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.917] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.917] GetLastError () returned 0x0 [0087.917] GetLastError () returned 0x0 [0087.918] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.918] GetLastError () returned 0x0 [0087.918] GetLastError () returned 0x0 [0087.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff6dc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.928] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x924, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x924, lpOverlapped=0x0) returned 1 [0087.928] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0087.928] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.929] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0087.929] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0087.929] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0087.929] CloseHandle (hObject=0xf0) returned 1 [0087.929] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0087.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0087.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0087.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0087.931] GetLastError () returned 0x0 [0087.932] RtlWakeConditionVariable () returned 0x0 [0087.932] GetCurrentThreadId () returned 0x9ac [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".ldf") returned 0x0 [0087.932] lstrlenW (lpString=".vhd") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".vhd") returned 0x0 [0087.932] lstrlenW (lpString=".vhdx") returned 5 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".vhdx") returned 0x0 [0087.932] lstrlenW (lpString=".pst") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".pst") returned 0x0 [0087.932] lstrlenW (lpString=".ost") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".ost") returned 0x0 [0087.932] lstrlenW (lpString=".bak") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".bak") returned 0x0 [0087.932] lstrlenW (lpString=".bac") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".bac") returned 0x0 [0087.932] lstrlenW (lpString=".sys") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".sys") returned 0x0 [0087.932] lstrlenW (lpString=".v2i") returned 4 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".v2i") returned 0x0 [0087.932] lstrlenW (lpString="s\r\n.v2i") returned 7 [0087.932] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch="s\r\n.v2i") returned 0x0 [0087.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0087.934] lstrlenW (lpString=".sql") returned 4 [0087.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".sql") returned 0x0 [0087.934] lstrlenW (lpString=".mdf") returned 4 [0087.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".mdf") returned 0x0 [0087.934] lstrlenW (lpString=".txt") returned 4 [0087.934] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".txt") returned 0x0 [0087.934] lstrlenW (lpString=".dbf") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".dbf") returned 0x0 [0087.935] lstrlenW (lpString=".ckp") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".ckp") returned 0x0 [0087.935] lstrlenW (lpString=".dacpac") returned 7 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".dacpac") returned 0x0 [0087.935] lstrlenW (lpString=".db3") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".db3") returned 0x0 [0087.935] lstrlenW (lpString=".dtxs") returned 5 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".dtxs") returned 0x0 [0087.935] lstrlenW (lpString=".mdt") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".mdt") returned 0x0 [0087.935] lstrlenW (lpString=".sdf") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".sdf") returned 0x0 [0087.935] lstrlenW (lpString=".MDF") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".MDF") returned 0x0 [0087.935] lstrlenW (lpString=".DBF") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".DBF") returned 0x0 [0087.935] lstrlenW (lpString=".DB") returned 3 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".DB") returned 0x0 [0087.935] lstrlenW (lpString=".db") returned 3 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".db") returned 0x0 [0087.935] lstrlenW (lpString=".ndf") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".ndf") returned 0x0 [0087.935] lstrlenW (lpString=".NDF") returned 4 [0087.935] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".NDF") returned 0x0 [0087.936] lstrlenW (lpString=".Mdf") returned 4 [0087.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".Mdf") returned 0x0 [0087.936] lstrlenW (lpString=".dat") returned 4 [0087.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".dat") returned 0x0 [0087.936] lstrlenW (lpString=".DAT") returned 4 [0087.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".DAT") returned 0x0 [0087.936] lstrlenW (lpString=".ldf") returned 4 [0087.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".ldf") returned 0x0 [0087.936] lstrlenW (lpString=".LDF") returned 4 [0087.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch=".LDF") returned 0x0 [0087.936] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0087.936] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0087.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0087.936] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0087.936] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0087.937] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0087.937] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0087.937] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0087.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0087.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0087.937] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20793821114) returned 1 [0087.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3427690, dwHighDateTime=0x1d585b4)) [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9b20 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0087.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9b20 | out: hHeap=0x260000) returned 1 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0087.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0087.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0087.997] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0087.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0087.997] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0087.998] GetLastError () returned 0x0 [0087.998] GetLastError () returned 0x0 [0087.998] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0087.998] GetLastError () returned 0x0 [0087.998] GetLastError () returned 0x0 [0088.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff518, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.000] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xae8, lpOverlapped=0x0) returned 1 [0088.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.000] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.000] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.000] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.000] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.000] CloseHandle (hObject=0xf0) returned 1 [0088.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313548 [0088.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313548 | out: hHeap=0x260000) returned 1 [0088.002] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.002] GetLastError () returned 0x0 [0088.002] RtlWakeConditionVariable () returned 0x0 [0088.002] GetCurrentThreadId () returned 0x9ac [0088.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".ldf") returned 0x0 [0088.002] lstrlenW (lpString=".vhd") returned 4 [0088.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".vhd") returned 0x0 [0088.002] lstrlenW (lpString=".vhdx") returned 5 [0088.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".vhdx") returned 0x0 [0088.002] lstrlenW (lpString=".pst") returned 4 [0088.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".pst") returned 0x0 [0088.002] lstrlenW (lpString=".ost") returned 4 [0088.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".ost") returned 0x0 [0088.003] lstrlenW (lpString=".bak") returned 4 [0088.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".bak") returned 0x0 [0088.003] lstrlenW (lpString=".bac") returned 4 [0088.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".bac") returned 0x0 [0088.003] lstrlenW (lpString=".sys") returned 4 [0088.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".sys") returned 0x0 [0088.003] lstrlenW (lpString=".v2i") returned 4 [0088.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".v2i") returned 0x0 [0088.003] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.004] lstrlenW (lpString=".sql") returned 4 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".sql") returned 0x0 [0088.004] lstrlenW (lpString=".mdf") returned 4 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".mdf") returned 0x0 [0088.004] lstrlenW (lpString=".txt") returned 4 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".txt") returned 0x0 [0088.004] lstrlenW (lpString=".dbf") returned 4 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".dbf") returned 0x0 [0088.004] lstrlenW (lpString=".ckp") returned 4 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".ckp") returned 0x0 [0088.004] lstrlenW (lpString=".dacpac") returned 7 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".dacpac") returned 0x0 [0088.004] lstrlenW (lpString=".db3") returned 4 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".db3") returned 0x0 [0088.004] lstrlenW (lpString=".dtxs") returned 5 [0088.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".dtxs") returned 0x0 [0088.004] lstrlenW (lpString=".mdt") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".mdt") returned 0x0 [0088.005] lstrlenW (lpString=".sdf") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".sdf") returned 0x0 [0088.005] lstrlenW (lpString=".MDF") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".MDF") returned 0x0 [0088.005] lstrlenW (lpString=".DBF") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".DBF") returned 0x0 [0088.005] lstrlenW (lpString=".DB") returned 3 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".DB") returned 0x0 [0088.005] lstrlenW (lpString=".db") returned 3 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".db") returned 0x0 [0088.005] lstrlenW (lpString=".ndf") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".ndf") returned 0x0 [0088.005] lstrlenW (lpString=".NDF") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".NDF") returned 0x0 [0088.005] lstrlenW (lpString=".Mdf") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".Mdf") returned 0x0 [0088.005] lstrlenW (lpString=".dat") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".dat") returned 0x0 [0088.005] lstrlenW (lpString=".DAT") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".DAT") returned 0x0 [0088.005] lstrlenW (lpString=".ldf") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".ldf") returned 0x0 [0088.005] lstrlenW (lpString=".LDF") returned 4 [0088.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch=".LDF") returned 0x0 [0088.006] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.006] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.006] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.006] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.006] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.007] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20800775883) returned 1 [0088.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc344d7f0, dwHighDateTime=0x1d585b4)) [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ae8 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ae8 | out: hHeap=0x260000) returned 1 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.007] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.007] GetLastError () returned 0x0 [0088.008] GetLastError () returned 0x0 [0088.008] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.008] GetLastError () returned 0x0 [0088.008] GetLastError () returned 0x0 [0088.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe9843, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.010] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x167bd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x167bd, lpOverlapped=0x0) returned 1 [0088.011] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.011] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.011] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.011] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.011] CloseHandle (hObject=0xf0) returned 1 [0088.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0088.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.013] GetLastError () returned 0x0 [0088.013] RtlWakeConditionVariable () returned 0x0 [0088.013] GetCurrentThreadId () returned 0x9ac [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".ldf") returned 0x0 [0088.013] lstrlenW (lpString=".vhd") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".vhd") returned 0x0 [0088.013] lstrlenW (lpString=".vhdx") returned 5 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".vhdx") returned 0x0 [0088.013] lstrlenW (lpString=".pst") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".pst") returned 0x0 [0088.013] lstrlenW (lpString=".ost") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".ost") returned 0x0 [0088.013] lstrlenW (lpString=".bak") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".bak") returned 0x0 [0088.013] lstrlenW (lpString=".bac") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".bac") returned 0x0 [0088.013] lstrlenW (lpString=".sys") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".sys") returned 0x0 [0088.013] lstrlenW (lpString=".v2i") returned 4 [0088.013] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".v2i") returned 0x0 [0088.013] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.014] lstrlenW (lpString=".sql") returned 4 [0088.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".sql") returned 0x0 [0088.014] lstrlenW (lpString=".mdf") returned 4 [0088.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".mdf") returned 0x0 [0088.015] lstrlenW (lpString=".txt") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".txt") returned 0x0 [0088.015] lstrlenW (lpString=".dbf") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".dbf") returned 0x0 [0088.015] lstrlenW (lpString=".ckp") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".ckp") returned 0x0 [0088.015] lstrlenW (lpString=".dacpac") returned 7 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".dacpac") returned 0x0 [0088.015] lstrlenW (lpString=".db3") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".db3") returned 0x0 [0088.015] lstrlenW (lpString=".dtxs") returned 5 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".dtxs") returned 0x0 [0088.015] lstrlenW (lpString=".mdt") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".mdt") returned 0x0 [0088.015] lstrlenW (lpString=".sdf") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".sdf") returned 0x0 [0088.015] lstrlenW (lpString=".MDF") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".MDF") returned 0x0 [0088.015] lstrlenW (lpString=".DBF") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".DBF") returned 0x0 [0088.015] lstrlenW (lpString=".DB") returned 3 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".DB") returned 0x0 [0088.015] lstrlenW (lpString=".db") returned 3 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".db") returned 0x0 [0088.015] lstrlenW (lpString=".ndf") returned 4 [0088.015] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".ndf") returned 0x0 [0088.016] lstrlenW (lpString=".NDF") returned 4 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".NDF") returned 0x0 [0088.016] lstrlenW (lpString=".Mdf") returned 4 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".Mdf") returned 0x0 [0088.016] lstrlenW (lpString=".dat") returned 4 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".dat") returned 0x0 [0088.016] lstrlenW (lpString=".DAT") returned 4 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".DAT") returned 0x0 [0088.016] lstrlenW (lpString=".ldf") returned 4 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".ldf") returned 0x0 [0088.016] lstrlenW (lpString=".LDF") returned 4 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch=".LDF") returned 0x0 [0088.016] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.016] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.016] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.016] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.017] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.017] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.017] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20801843851) returned 1 [0088.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3473950, dwHighDateTime=0x1d585b4)) [0088.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9ab0 [0088.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9ab0 | out: hHeap=0x260000) returned 1 [0088.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.018] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.018] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.018] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.018] GetLastError () returned 0x0 [0088.018] GetLastError () returned 0x0 [0088.018] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.019] GetLastError () returned 0x0 [0088.019] GetLastError () returned 0x0 [0088.020] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb145, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.021] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x4ebb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x4ebb, lpOverlapped=0x0) returned 1 [0088.021] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0088.021] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.021] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.021] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.021] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.021] CloseHandle (hObject=0xf0) returned 1 [0088.021] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.023] GetLastError () returned 0x0 [0088.023] RtlWakeConditionVariable () returned 0x0 [0088.023] GetCurrentThreadId () returned 0x9ac [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".ldf") returned 0x0 [0088.023] lstrlenW (lpString=".vhd") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".vhd") returned 0x0 [0088.023] lstrlenW (lpString=".vhdx") returned 5 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".vhdx") returned 0x0 [0088.023] lstrlenW (lpString=".pst") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".pst") returned 0x0 [0088.023] lstrlenW (lpString=".ost") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".ost") returned 0x0 [0088.023] lstrlenW (lpString=".bak") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".bak") returned 0x0 [0088.023] lstrlenW (lpString=".bac") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".bac") returned 0x0 [0088.023] lstrlenW (lpString=".sys") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".sys") returned 0x0 [0088.023] lstrlenW (lpString=".v2i") returned 4 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".v2i") returned 0x0 [0088.023] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.024] lstrlenW (lpString=".sql") returned 4 [0088.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".sql") returned 0x0 [0088.024] lstrlenW (lpString=".mdf") returned 4 [0088.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".mdf") returned 0x0 [0088.025] lstrlenW (lpString=".txt") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".txt") returned 0x0 [0088.025] lstrlenW (lpString=".dbf") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".dbf") returned 0x0 [0088.025] lstrlenW (lpString=".ckp") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".ckp") returned 0x0 [0088.025] lstrlenW (lpString=".dacpac") returned 7 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".dacpac") returned 0x0 [0088.025] lstrlenW (lpString=".db3") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".db3") returned 0x0 [0088.025] lstrlenW (lpString=".dtxs") returned 5 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".dtxs") returned 0x0 [0088.025] lstrlenW (lpString=".mdt") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".mdt") returned 0x0 [0088.025] lstrlenW (lpString=".sdf") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".sdf") returned 0x0 [0088.025] lstrlenW (lpString=".MDF") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".MDF") returned 0x0 [0088.025] lstrlenW (lpString=".DBF") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".DBF") returned 0x0 [0088.025] lstrlenW (lpString=".DB") returned 3 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".DB") returned 0x0 [0088.025] lstrlenW (lpString=".db") returned 3 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".db") returned 0x0 [0088.025] lstrlenW (lpString=".ndf") returned 4 [0088.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".ndf") returned 0x0 [0088.026] lstrlenW (lpString=".NDF") returned 4 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".NDF") returned 0x0 [0088.026] lstrlenW (lpString=".Mdf") returned 4 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".Mdf") returned 0x0 [0088.026] lstrlenW (lpString=".dat") returned 4 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".dat") returned 0x0 [0088.026] lstrlenW (lpString=".DAT") returned 4 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".DAT") returned 0x0 [0088.026] lstrlenW (lpString=".ldf") returned 4 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".ldf") returned 0x0 [0088.026] lstrlenW (lpString=".LDF") returned 4 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch=".LDF") returned 0x0 [0088.026] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.026] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.027] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.027] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20802823868) returned 1 [0088.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3473950, dwHighDateTime=0x1d585b4)) [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a78 [0088.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a78 | out: hHeap=0x260000) returned 1 [0088.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.028] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.028] GetLastError () returned 0x0 [0088.028] GetLastError () returned 0x0 [0088.028] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.028] GetLastError () returned 0x0 [0088.028] GetLastError () returned 0x0 [0088.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbf1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.030] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x40f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x40f, lpOverlapped=0x0) returned 1 [0088.030] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.030] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.031] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.031] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.031] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.031] CloseHandle (hObject=0xf0) returned 1 [0088.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.032] GetLastError () returned 0x0 [0088.032] RtlWakeConditionVariable () returned 0x0 [0088.032] GetCurrentThreadId () returned 0x9ac [0088.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".ldf") returned 0x0 [0088.032] lstrlenW (lpString=".vhd") returned 4 [0088.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".vhd") returned 0x0 [0088.032] lstrlenW (lpString=".vhdx") returned 5 [0088.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".vhdx") returned 0x0 [0088.033] lstrlenW (lpString=".pst") returned 4 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".pst") returned 0x0 [0088.033] lstrlenW (lpString=".ost") returned 4 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".ost") returned 0x0 [0088.033] lstrlenW (lpString=".bak") returned 4 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".bak") returned 0x0 [0088.033] lstrlenW (lpString=".bac") returned 4 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".bac") returned 0x0 [0088.033] lstrlenW (lpString=".sys") returned 4 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".sys") returned 0x0 [0088.033] lstrlenW (lpString=".v2i") returned 4 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".v2i") returned 0x0 [0088.033] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch="s\r\n.v2i") returned 0x0 [0088.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.034] lstrlenW (lpString=".sql") returned 4 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".sql") returned 0x0 [0088.034] lstrlenW (lpString=".mdf") returned 4 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".mdf") returned 0x0 [0088.034] lstrlenW (lpString=".txt") returned 4 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".txt") returned 0x0 [0088.034] lstrlenW (lpString=".dbf") returned 4 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".dbf") returned 0x0 [0088.034] lstrlenW (lpString=".ckp") returned 4 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".ckp") returned 0x0 [0088.034] lstrlenW (lpString=".dacpac") returned 7 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".dacpac") returned 0x0 [0088.034] lstrlenW (lpString=".db3") returned 4 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".db3") returned 0x0 [0088.034] lstrlenW (lpString=".dtxs") returned 5 [0088.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".dtxs") returned 0x0 [0088.035] lstrlenW (lpString=".mdt") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".mdt") returned 0x0 [0088.035] lstrlenW (lpString=".sdf") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".sdf") returned 0x0 [0088.035] lstrlenW (lpString=".MDF") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".MDF") returned 0x0 [0088.035] lstrlenW (lpString=".DBF") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".DBF") returned 0x0 [0088.035] lstrlenW (lpString=".DB") returned 3 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".DB") returned 0x0 [0088.035] lstrlenW (lpString=".db") returned 3 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".db") returned 0x0 [0088.035] lstrlenW (lpString=".ndf") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".ndf") returned 0x0 [0088.035] lstrlenW (lpString=".NDF") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".NDF") returned 0x0 [0088.035] lstrlenW (lpString=".Mdf") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".Mdf") returned 0x0 [0088.035] lstrlenW (lpString=".dat") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".dat") returned 0x0 [0088.035] lstrlenW (lpString=".DAT") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".DAT") returned 0x0 [0088.035] lstrlenW (lpString=".ldf") returned 4 [0088.035] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".ldf") returned 0x0 [0088.035] lstrlenW (lpString=".LDF") returned 4 [0088.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch=".LDF") returned 0x0 [0088.036] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.036] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.036] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.036] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.036] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.037] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20803780889) returned 1 [0088.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3499ab0, dwHighDateTime=0x1d585b4)) [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d9a40 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d9a40 | out: hHeap=0x260000) returned 1 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765230 [0088.037] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.037] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.038] GetLastError () returned 0x0 [0088.038] GetLastError () returned 0x0 [0088.038] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.038] GetLastError () returned 0x0 [0088.038] GetLastError () returned 0x0 [0088.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa970, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.172] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x5690, lpOverlapped=0x0) returned 1 [0088.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.174] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.175] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.175] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.175] CloseHandle (hObject=0xf0) returned 1 [0088.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a300 [0088.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a300 | out: hHeap=0x260000) returned 1 [0088.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.176] GetLastError () returned 0x0 [0088.176] RtlWakeConditionVariable () returned 0x0 [0088.176] GetCurrentThreadId () returned 0x9ac [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".ldf") returned 0x0 [0088.177] lstrlenW (lpString=".vhd") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".vhd") returned 0x0 [0088.177] lstrlenW (lpString=".vhdx") returned 5 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".vhdx") returned 0x0 [0088.177] lstrlenW (lpString=".pst") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".pst") returned 0x0 [0088.177] lstrlenW (lpString=".ost") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".ost") returned 0x0 [0088.177] lstrlenW (lpString=".bak") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".bak") returned 0x0 [0088.177] lstrlenW (lpString=".bac") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".bac") returned 0x0 [0088.177] lstrlenW (lpString=".sys") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".sys") returned 0x0 [0088.177] lstrlenW (lpString=".v2i") returned 4 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".v2i") returned 0x0 [0088.177] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.178] lstrlenW (lpString=".sql") returned 4 [0088.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".sql") returned 0x0 [0088.178] lstrlenW (lpString=".mdf") returned 4 [0088.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".mdf") returned 0x0 [0088.178] lstrlenW (lpString=".txt") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".txt") returned 0x0 [0088.179] lstrlenW (lpString=".dbf") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".dbf") returned 0x0 [0088.179] lstrlenW (lpString=".ckp") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".ckp") returned 0x0 [0088.179] lstrlenW (lpString=".dacpac") returned 7 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".dacpac") returned 0x0 [0088.179] lstrlenW (lpString=".db3") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".db3") returned 0x0 [0088.179] lstrlenW (lpString=".dtxs") returned 5 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".dtxs") returned 0x0 [0088.179] lstrlenW (lpString=".mdt") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".mdt") returned 0x0 [0088.179] lstrlenW (lpString=".sdf") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".sdf") returned 0x0 [0088.179] lstrlenW (lpString=".MDF") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".MDF") returned 0x0 [0088.179] lstrlenW (lpString=".DBF") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".DBF") returned 0x0 [0088.179] lstrlenW (lpString=".DB") returned 3 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".DB") returned 0x0 [0088.179] lstrlenW (lpString=".db") returned 3 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".db") returned 0x0 [0088.179] lstrlenW (lpString=".ndf") returned 4 [0088.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".ndf") returned 0x0 [0088.179] lstrlenW (lpString=".NDF") returned 4 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".NDF") returned 0x0 [0088.180] lstrlenW (lpString=".Mdf") returned 4 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".Mdf") returned 0x0 [0088.180] lstrlenW (lpString=".dat") returned 4 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".dat") returned 0x0 [0088.180] lstrlenW (lpString=".DAT") returned 4 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".DAT") returned 0x0 [0088.180] lstrlenW (lpString=".ldf") returned 4 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".ldf") returned 0x0 [0088.180] lstrlenW (lpString=".LDF") returned 4 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch=".LDF") returned 0x0 [0088.180] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.180] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.181] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.181] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.181] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20818226200) returned 1 [0088.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc35f0710, dwHighDateTime=0x1d585b4)) [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dd00 [0088.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dd00 | out: hHeap=0x260000) returned 1 [0088.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2765528 [0088.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.182] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.182] GetLastError () returned 0x0 [0088.182] GetLastError () returned 0x0 [0088.182] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.182] GetLastError () returned 0x0 [0088.183] GetLastError () returned 0x0 [0088.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd8f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.185] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x271, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x271, lpOverlapped=0x0) returned 1 [0088.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.185] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.185] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.186] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.186] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.186] CloseHandle (hObject=0xf0) returned 1 [0088.186] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0088.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0088.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.197] GetLastError () returned 0x0 [0088.197] RtlWakeConditionVariable () returned 0x0 [0088.197] GetCurrentThreadId () returned 0x9ac [0088.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".ldf") returned 0x0 [0088.197] lstrlenW (lpString=".vhd") returned 4 [0088.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".vhd") returned 0x0 [0088.197] lstrlenW (lpString=".vhdx") returned 5 [0088.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".vhdx") returned 0x0 [0088.197] lstrlenW (lpString=".pst") returned 4 [0088.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".pst") returned 0x0 [0088.197] lstrlenW (lpString=".ost") returned 4 [0088.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".ost") returned 0x0 [0088.197] lstrlenW (lpString=".bak") returned 4 [0088.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".bak") returned 0x0 [0088.198] lstrlenW (lpString=".bac") returned 4 [0088.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".bac") returned 0x0 [0088.198] lstrlenW (lpString=".sys") returned 4 [0088.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".sys") returned 0x0 [0088.198] lstrlenW (lpString=".v2i") returned 4 [0088.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".v2i") returned 0x0 [0088.198] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.200] lstrlenW (lpString=".sql") returned 4 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".sql") returned 0x0 [0088.200] lstrlenW (lpString=".mdf") returned 4 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".mdf") returned 0x0 [0088.200] lstrlenW (lpString=".txt") returned 4 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".txt") returned 0x0 [0088.200] lstrlenW (lpString=".dbf") returned 4 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".dbf") returned 0x0 [0088.200] lstrlenW (lpString=".ckp") returned 4 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".ckp") returned 0x0 [0088.200] lstrlenW (lpString=".dacpac") returned 7 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".dacpac") returned 0x0 [0088.200] lstrlenW (lpString=".db3") returned 4 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".db3") returned 0x0 [0088.200] lstrlenW (lpString=".dtxs") returned 5 [0088.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".dtxs") returned 0x0 [0088.200] lstrlenW (lpString=".mdt") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".mdt") returned 0x0 [0088.201] lstrlenW (lpString=".sdf") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".sdf") returned 0x0 [0088.201] lstrlenW (lpString=".MDF") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".MDF") returned 0x0 [0088.201] lstrlenW (lpString=".DBF") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".DBF") returned 0x0 [0088.201] lstrlenW (lpString=".DB") returned 3 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".DB") returned 0x0 [0088.201] lstrlenW (lpString=".db") returned 3 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".db") returned 0x0 [0088.201] lstrlenW (lpString=".ndf") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".ndf") returned 0x0 [0088.201] lstrlenW (lpString=".NDF") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".NDF") returned 0x0 [0088.201] lstrlenW (lpString=".Mdf") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".Mdf") returned 0x0 [0088.201] lstrlenW (lpString=".dat") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".dat") returned 0x0 [0088.201] lstrlenW (lpString=".DAT") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".DAT") returned 0x0 [0088.201] lstrlenW (lpString=".ldf") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".ldf") returned 0x0 [0088.201] lstrlenW (lpString=".LDF") returned 4 [0088.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch=".LDF") returned 0x0 [0088.202] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.202] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.203] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.203] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.203] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20820396800) returned 1 [0088.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc363c9d0, dwHighDateTime=0x1d585b4)) [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dd38 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dd38 | out: hHeap=0x260000) returned 1 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.204] GetLastError () returned 0x0 [0088.204] GetLastError () returned 0x0 [0088.204] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.204] GetLastError () returned 0x0 [0088.204] GetLastError () returned 0x0 [0088.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.206] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x369, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x369, lpOverlapped=0x0) returned 1 [0088.206] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.206] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.206] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.206] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.206] CloseHandle (hObject=0xf0) returned 1 [0088.206] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0088.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0088.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.208] GetLastError () returned 0x0 [0088.208] RtlWakeConditionVariable () returned 0x27e828 [0088.208] GetCurrentThreadId () returned 0x9ac [0088.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".ldf") returned 0x0 [0088.208] lstrlenW (lpString=".vhd") returned 4 [0088.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".vhd") returned 0x0 [0088.208] lstrlenW (lpString=".vhdx") returned 5 [0088.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".vhdx") returned 0x0 [0088.208] lstrlenW (lpString=".pst") returned 4 [0088.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".pst") returned 0x0 [0088.208] lstrlenW (lpString=".ost") returned 4 [0088.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".ost") returned 0x0 [0088.208] lstrlenW (lpString=".bak") returned 4 [0088.208] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".bak") returned 0x0 [0088.209] lstrlenW (lpString=".bac") returned 4 [0088.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".bac") returned 0x0 [0088.209] lstrlenW (lpString=".sys") returned 4 [0088.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".sys") returned 0x0 [0088.209] lstrlenW (lpString=".v2i") returned 4 [0088.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".v2i") returned 0x0 [0088.209] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0088.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.210] lstrlenW (lpString=".sql") returned 4 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".sql") returned 0x0 [0088.210] lstrlenW (lpString=".mdf") returned 4 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".mdf") returned 0x0 [0088.210] lstrlenW (lpString=".txt") returned 4 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".txt") returned 0x0 [0088.210] lstrlenW (lpString=".dbf") returned 4 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".dbf") returned 0x0 [0088.210] lstrlenW (lpString=".ckp") returned 4 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".ckp") returned 0x0 [0088.210] lstrlenW (lpString=".dacpac") returned 7 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".dacpac") returned 0x0 [0088.210] lstrlenW (lpString=".db3") returned 4 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".db3") returned 0x0 [0088.210] lstrlenW (lpString=".dtxs") returned 5 [0088.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".dtxs") returned 0x0 [0088.211] lstrlenW (lpString=".mdt") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".mdt") returned 0x0 [0088.211] lstrlenW (lpString=".sdf") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".sdf") returned 0x0 [0088.211] lstrlenW (lpString=".MDF") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".MDF") returned 0x0 [0088.211] lstrlenW (lpString=".DBF") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".DBF") returned 0x0 [0088.211] lstrlenW (lpString=".DB") returned 3 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".DB") returned 0x0 [0088.211] lstrlenW (lpString=".db") returned 3 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".db") returned 0x0 [0088.211] lstrlenW (lpString=".ndf") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".ndf") returned 0x0 [0088.211] lstrlenW (lpString=".NDF") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".NDF") returned 0x0 [0088.211] lstrlenW (lpString=".Mdf") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".Mdf") returned 0x0 [0088.211] lstrlenW (lpString=".dat") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".dat") returned 0x0 [0088.211] lstrlenW (lpString=".DAT") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".DAT") returned 0x0 [0088.211] lstrlenW (lpString=".ldf") returned 4 [0088.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".ldf") returned 0x0 [0088.211] lstrlenW (lpString=".LDF") returned 4 [0088.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch=".LDF") returned 0x0 [0088.212] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.212] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.212] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.213] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.213] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20821383125) returned 1 [0088.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc363c9d0, dwHighDateTime=0x1d585b4)) [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dd70 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dd70 | out: hHeap=0x260000) returned 1 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.213] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.213] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.214] GetLastError () returned 0x0 [0088.214] GetLastError () returned 0x0 [0088.214] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.214] GetLastError () returned 0x0 [0088.214] GetLastError () returned 0x0 [0088.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.215] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x13e, lpOverlapped=0x0) returned 1 [0088.215] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.215] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.215] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.216] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.216] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.216] CloseHandle (hObject=0xf0) returned 1 [0088.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0088.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.[deadmin@cock.li].deadmin")) returned 1 [0088.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0088.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.217] GetLastError () returned 0x0 [0088.217] RtlWakeConditionVariable () returned 0x27e828 [0088.217] GetCurrentThreadId () returned 0x9ac [0088.217] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".ldf") returned 0x0 [0088.217] lstrlenW (lpString=".vhd") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".vhd") returned 0x0 [0088.218] lstrlenW (lpString=".vhdx") returned 5 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".vhdx") returned 0x0 [0088.218] lstrlenW (lpString=".pst") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".pst") returned 0x0 [0088.218] lstrlenW (lpString=".ost") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".ost") returned 0x0 [0088.218] lstrlenW (lpString=".bak") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".bak") returned 0x0 [0088.218] lstrlenW (lpString=".bac") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".bac") returned 0x0 [0088.218] lstrlenW (lpString=".sys") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".sys") returned 0x0 [0088.218] lstrlenW (lpString=".v2i") returned 4 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".v2i") returned 0x0 [0088.218] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.218] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch="s\r\n.v2i") returned 0x0 [0088.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.219] lstrlenW (lpString=".sql") returned 4 [0088.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".sql") returned 0x0 [0088.219] lstrlenW (lpString=".mdf") returned 4 [0088.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".mdf") returned 0x0 [0088.219] lstrlenW (lpString=".txt") returned 4 [0088.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".txt") returned 0x0 [0088.219] lstrlenW (lpString=".dbf") returned 4 [0088.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".dbf") returned 0x0 [0088.219] lstrlenW (lpString=".ckp") returned 4 [0088.219] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".ckp") returned 0x0 [0088.220] lstrlenW (lpString=".dacpac") returned 7 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".dacpac") returned 0x0 [0088.220] lstrlenW (lpString=".db3") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".db3") returned 0x0 [0088.220] lstrlenW (lpString=".dtxs") returned 5 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".dtxs") returned 0x0 [0088.220] lstrlenW (lpString=".mdt") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".mdt") returned 0x0 [0088.220] lstrlenW (lpString=".sdf") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".sdf") returned 0x0 [0088.220] lstrlenW (lpString=".MDF") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".MDF") returned 0x0 [0088.220] lstrlenW (lpString=".DBF") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".DBF") returned 0x0 [0088.220] lstrlenW (lpString=".DB") returned 3 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".DB") returned 0x0 [0088.220] lstrlenW (lpString=".db") returned 3 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".db") returned 0x0 [0088.220] lstrlenW (lpString=".ndf") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".ndf") returned 0x0 [0088.220] lstrlenW (lpString=".NDF") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".NDF") returned 0x0 [0088.220] lstrlenW (lpString=".Mdf") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".Mdf") returned 0x0 [0088.220] lstrlenW (lpString=".dat") returned 4 [0088.220] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".dat") returned 0x0 [0088.221] lstrlenW (lpString=".DAT") returned 4 [0088.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".DAT") returned 0x0 [0088.221] lstrlenW (lpString=".ldf") returned 4 [0088.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".ldf") returned 0x0 [0088.221] lstrlenW (lpString=".LDF") returned 4 [0088.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch=".LDF") returned 0x0 [0088.221] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.221] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.222] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.222] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.222] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20822304668) returned 1 [0088.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3662b30, dwHighDateTime=0x1d585b4)) [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dda8 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dda8 | out: hHeap=0x260000) returned 1 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.223] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.223] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.223] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.223] GetLastError () returned 0x0 [0088.223] GetLastError () returned 0x0 [0088.223] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.223] GetLastError () returned 0x0 [0088.223] GetLastError () returned 0x0 [0088.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffec773, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.226] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1388d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1388d, lpOverlapped=0x0) returned 1 [0088.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.227] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.227] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.227] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.227] CloseHandle (hObject=0xf0) returned 1 [0088.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x312af8 [0088.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js.[deadmin@cock.li].deadmin")) returned 1 [0088.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x312af8 | out: hHeap=0x260000) returned 1 [0088.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.228] GetLastError () returned 0x0 [0088.228] RtlWakeConditionVariable () returned 0x27e828 [0088.228] GetCurrentThreadId () returned 0x9ac [0088.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0088.229] lstrlenW (lpString=".vhd") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".vhd") returned 0x0 [0088.229] lstrlenW (lpString=".vhdx") returned 5 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".vhdx") returned 0x0 [0088.229] lstrlenW (lpString=".pst") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".pst") returned 0x0 [0088.229] lstrlenW (lpString=".ost") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".ost") returned 0x0 [0088.229] lstrlenW (lpString=".bak") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".bak") returned 0x0 [0088.229] lstrlenW (lpString=".bac") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".bac") returned 0x0 [0088.229] lstrlenW (lpString=".sys") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".sys") returned 0x0 [0088.229] lstrlenW (lpString=".v2i") returned 4 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".v2i") returned 0x0 [0088.229] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.229] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.231] lstrlenW (lpString=".sql") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".sql") returned 0x0 [0088.231] lstrlenW (lpString=".mdf") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".mdf") returned 0x0 [0088.231] lstrlenW (lpString=".txt") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".txt") returned 0x0 [0088.231] lstrlenW (lpString=".dbf") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".dbf") returned 0x0 [0088.231] lstrlenW (lpString=".ckp") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".ckp") returned 0x0 [0088.231] lstrlenW (lpString=".dacpac") returned 7 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".dacpac") returned 0x0 [0088.231] lstrlenW (lpString=".db3") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".db3") returned 0x0 [0088.231] lstrlenW (lpString=".dtxs") returned 5 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".dtxs") returned 0x0 [0088.231] lstrlenW (lpString=".mdt") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".mdt") returned 0x0 [0088.231] lstrlenW (lpString=".sdf") returned 4 [0088.231] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".sdf") returned 0x0 [0088.231] lstrlenW (lpString=".MDF") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".MDF") returned 0x0 [0088.232] lstrlenW (lpString=".DBF") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".DBF") returned 0x0 [0088.232] lstrlenW (lpString=".DB") returned 3 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".DB") returned 0x0 [0088.232] lstrlenW (lpString=".db") returned 3 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".db") returned 0x0 [0088.232] lstrlenW (lpString=".ndf") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".ndf") returned 0x0 [0088.232] lstrlenW (lpString=".NDF") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".NDF") returned 0x0 [0088.232] lstrlenW (lpString=".Mdf") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".Mdf") returned 0x0 [0088.232] lstrlenW (lpString=".dat") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".dat") returned 0x0 [0088.232] lstrlenW (lpString=".DAT") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".DAT") returned 0x0 [0088.232] lstrlenW (lpString=".ldf") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".ldf") returned 0x0 [0088.232] lstrlenW (lpString=".LDF") returned 4 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch=".LDF") returned 0x0 [0088.232] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.232] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.233] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.233] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.233] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.233] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20823462950) returned 1 [0088.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3688c90, dwHighDateTime=0x1d585b4)) [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33dde0 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33dde0 | out: hHeap=0x260000) returned 1 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.234] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.234] GetLastError () returned 0x0 [0088.235] GetLastError () returned 0x0 [0088.235] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.235] GetLastError () returned 0x0 [0088.235] GetLastError () returned 0x0 [0088.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffba3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.237] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x45d, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x45d, lpOverlapped=0x0) returned 1 [0088.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.237] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.237] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.237] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.237] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.237] CloseHandle (hObject=0xf0) returned 1 [0088.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f750 [0088.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.[deadmin@cock.li].deadmin")) returned 1 [0088.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.239] GetLastError () returned 0x0 [0088.239] RtlWakeConditionVariable () returned 0x27e828 [0088.239] GetCurrentThreadId () returned 0x9ac [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0088.239] lstrlenW (lpString=".vhd") returned 4 [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".vhd") returned 0x0 [0088.239] lstrlenW (lpString=".vhdx") returned 5 [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".vhdx") returned 0x0 [0088.239] lstrlenW (lpString=".pst") returned 4 [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".pst") returned 0x0 [0088.239] lstrlenW (lpString=".ost") returned 4 [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".ost") returned 0x0 [0088.239] lstrlenW (lpString=".bak") returned 4 [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".bak") returned 0x0 [0088.239] lstrlenW (lpString=".bac") returned 4 [0088.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".bac") returned 0x0 [0088.239] lstrlenW (lpString=".sys") returned 4 [0088.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".sys") returned 0x0 [0088.240] lstrlenW (lpString=".v2i") returned 4 [0088.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".v2i") returned 0x0 [0088.240] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.240] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.241] lstrlenW (lpString=".sql") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".sql") returned 0x0 [0088.241] lstrlenW (lpString=".mdf") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".mdf") returned 0x0 [0088.241] lstrlenW (lpString=".txt") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".txt") returned 0x0 [0088.241] lstrlenW (lpString=".dbf") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".dbf") returned 0x0 [0088.241] lstrlenW (lpString=".ckp") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".ckp") returned 0x0 [0088.241] lstrlenW (lpString=".dacpac") returned 7 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".dacpac") returned 0x0 [0088.241] lstrlenW (lpString=".db3") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".db3") returned 0x0 [0088.241] lstrlenW (lpString=".dtxs") returned 5 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".dtxs") returned 0x0 [0088.241] lstrlenW (lpString=".mdt") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".mdt") returned 0x0 [0088.241] lstrlenW (lpString=".sdf") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".sdf") returned 0x0 [0088.241] lstrlenW (lpString=".MDF") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".MDF") returned 0x0 [0088.241] lstrlenW (lpString=".DBF") returned 4 [0088.241] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".DBF") returned 0x0 [0088.242] lstrlenW (lpString=".DB") returned 3 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".DB") returned 0x0 [0088.242] lstrlenW (lpString=".db") returned 3 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".db") returned 0x0 [0088.242] lstrlenW (lpString=".ndf") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".ndf") returned 0x0 [0088.242] lstrlenW (lpString=".NDF") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".NDF") returned 0x0 [0088.242] lstrlenW (lpString=".Mdf") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".Mdf") returned 0x0 [0088.242] lstrlenW (lpString=".dat") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".dat") returned 0x0 [0088.242] lstrlenW (lpString=".DAT") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".DAT") returned 0x0 [0088.242] lstrlenW (lpString=".ldf") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0088.242] lstrlenW (lpString=".LDF") returned 4 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch=".LDF") returned 0x0 [0088.242] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.242] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.242] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.243] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.243] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0088.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0088.243] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20824451895) returned 1 [0088.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3688c90, dwHighDateTime=0x1d585b4)) [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33de18 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33de18 | out: hHeap=0x260000) returned 1 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.244] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.244] GetLastError () returned 0x0 [0088.244] GetLastError () returned 0x0 [0088.245] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.245] GetLastError () returned 0x0 [0088.245] GetLastError () returned 0x0 [0088.246] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff7b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.246] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x850, lpOverlapped=0x0) returned 1 [0088.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.247] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.247] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.247] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.247] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.247] CloseHandle (hObject=0xf0) returned 1 [0088.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.[deadmin@cock.li].deadmin")) returned 1 [0088.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0088.248] GetLastError () returned 0x0 [0088.248] RtlWakeConditionVariable () returned 0x27e828 [0088.248] GetCurrentThreadId () returned 0x9ac [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".ldf") returned 0x0 [0088.249] lstrlenW (lpString=".vhd") returned 4 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".vhd") returned 0x0 [0088.249] lstrlenW (lpString=".vhdx") returned 5 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".vhdx") returned 0x0 [0088.249] lstrlenW (lpString=".pst") returned 4 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".pst") returned 0x0 [0088.249] lstrlenW (lpString=".ost") returned 4 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".ost") returned 0x0 [0088.249] lstrlenW (lpString=".bak") returned 4 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".bak") returned 0x0 [0088.249] lstrlenW (lpString=".bac") returned 4 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".bac") returned 0x0 [0088.249] lstrlenW (lpString=".sys") returned 4 [0088.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".sys") returned 0x0 [0088.343] lstrlenW (lpString=".v2i") returned 4 [0088.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".v2i") returned 0x0 [0088.343] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch="s\r\n.v2i") returned 0x0 [0088.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.345] lstrlenW (lpString=".sql") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".sql") returned 0x0 [0088.345] lstrlenW (lpString=".mdf") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".mdf") returned 0x0 [0088.345] lstrlenW (lpString=".txt") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".txt") returned 0x0 [0088.345] lstrlenW (lpString=".dbf") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".dbf") returned 0x0 [0088.345] lstrlenW (lpString=".ckp") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".ckp") returned 0x0 [0088.345] lstrlenW (lpString=".dacpac") returned 7 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".dacpac") returned 0x0 [0088.345] lstrlenW (lpString=".db3") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".db3") returned 0x0 [0088.345] lstrlenW (lpString=".dtxs") returned 5 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".dtxs") returned 0x0 [0088.345] lstrlenW (lpString=".mdt") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".mdt") returned 0x0 [0088.345] lstrlenW (lpString=".sdf") returned 4 [0088.345] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".sdf") returned 0x0 [0088.346] lstrlenW (lpString=".MDF") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".MDF") returned 0x0 [0088.346] lstrlenW (lpString=".DBF") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".DBF") returned 0x0 [0088.346] lstrlenW (lpString=".DB") returned 3 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".DB") returned 0x0 [0088.346] lstrlenW (lpString=".db") returned 3 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".db") returned 0x0 [0088.346] lstrlenW (lpString=".ndf") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".ndf") returned 0x0 [0088.346] lstrlenW (lpString=".NDF") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".NDF") returned 0x0 [0088.346] lstrlenW (lpString=".Mdf") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".Mdf") returned 0x0 [0088.346] lstrlenW (lpString=".dat") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".dat") returned 0x0 [0088.346] lstrlenW (lpString=".DAT") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".DAT") returned 0x0 [0088.346] lstrlenW (lpString=".ldf") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".ldf") returned 0x0 [0088.346] lstrlenW (lpString=".LDF") returned 4 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch=".LDF") returned 0x0 [0088.346] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.346] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.347] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.347] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.347] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.347] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.347] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.348] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20834870706) returned 1 [0088.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3793630, dwHighDateTime=0x1d585b4)) [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e080 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e080 | out: hHeap=0x260000) returned 1 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.348] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.348] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.348] GetLastError () returned 0x0 [0088.349] GetLastError () returned 0x0 [0088.349] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.349] GetLastError () returned 0x0 [0088.349] GetLastError () returned 0x0 [0088.350] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffd13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.351] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2ed, lpOverlapped=0x0) returned 1 [0088.351] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.351] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.351] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.351] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.351] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.351] CloseHandle (hObject=0x11c) returned 1 [0088.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291fa98 [0088.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.[deadmin@cock.li].deadmin")) returned 1 [0088.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.353] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.353] GetLastError () returned 0x0 [0088.353] RtlWakeConditionVariable () returned 0x0 [0088.353] GetCurrentThreadId () returned 0x9ac [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.353] lstrlenW (lpString=".vhd") returned 4 [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0088.353] lstrlenW (lpString=".vhdx") returned 5 [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0088.353] lstrlenW (lpString=".pst") returned 4 [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0088.353] lstrlenW (lpString=".ost") returned 4 [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0088.353] lstrlenW (lpString=".bak") returned 4 [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0088.353] lstrlenW (lpString=".bac") returned 4 [0088.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0088.353] lstrlenW (lpString=".sys") returned 4 [0088.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0088.354] lstrlenW (lpString=".v2i") returned 4 [0088.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0088.354] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.355] lstrlenW (lpString=".sql") returned 4 [0088.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0088.355] lstrlenW (lpString=".mdf") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0088.356] lstrlenW (lpString=".txt") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0088.356] lstrlenW (lpString=".dbf") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0088.356] lstrlenW (lpString=".ckp") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0088.356] lstrlenW (lpString=".dacpac") returned 7 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0088.356] lstrlenW (lpString=".db3") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0088.356] lstrlenW (lpString=".dtxs") returned 5 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0088.356] lstrlenW (lpString=".mdt") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0088.356] lstrlenW (lpString=".sdf") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0088.356] lstrlenW (lpString=".MDF") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0088.356] lstrlenW (lpString=".DBF") returned 4 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0088.356] lstrlenW (lpString=".DB") returned 3 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0088.356] lstrlenW (lpString=".db") returned 3 [0088.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0088.356] lstrlenW (lpString=".ndf") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0088.357] lstrlenW (lpString=".NDF") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0088.357] lstrlenW (lpString=".Mdf") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0088.357] lstrlenW (lpString=".dat") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0088.357] lstrlenW (lpString=".DAT") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0088.357] lstrlenW (lpString=".ldf") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.357] lstrlenW (lpString=".LDF") returned 4 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0088.357] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.357] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.358] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.358] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.358] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20835932278) returned 1 [0088.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3793630, dwHighDateTime=0x1d585b4)) [0088.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e0b8 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e0b8 | out: hHeap=0x260000) returned 1 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.359] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.359] GetLastError () returned 0x0 [0088.359] GetLastError () returned 0x0 [0088.360] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.360] GetLastError () returned 0x0 [0088.360] GetLastError () returned 0x0 [0088.361] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.361] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0088.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.361] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.361] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.361] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.361] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.362] CloseHandle (hObject=0x11c) returned 1 [0088.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0088.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.363] GetLastError () returned 0x0 [0088.363] RtlWakeConditionVariable () returned 0x0 [0088.363] GetCurrentThreadId () returned 0x9ac [0088.365] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.365] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.365] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0088.365] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0088.367] CloseHandle (hObject=0x11c) returned 1 [0088.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.367] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.367] RtlWakeConditionVariable () returned 0x0 [0088.367] GetCurrentThreadId () returned 0x9ac [0088.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".ldf") returned 0x0 [0088.368] lstrlenW (lpString=".vhd") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".vhd") returned 0x0 [0088.368] lstrlenW (lpString=".vhdx") returned 5 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".vhdx") returned 0x0 [0088.368] lstrlenW (lpString=".pst") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".pst") returned 0x0 [0088.368] lstrlenW (lpString=".ost") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".ost") returned 0x0 [0088.368] lstrlenW (lpString=".bak") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".bak") returned 0x0 [0088.368] lstrlenW (lpString=".bac") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".bac") returned 0x0 [0088.368] lstrlenW (lpString=".sys") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".sys") returned 0x0 [0088.368] lstrlenW (lpString=".v2i") returned 4 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".v2i") returned 0x0 [0088.368] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.369] lstrlenW (lpString=".sql") returned 4 [0088.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".sql") returned 0x0 [0088.369] lstrlenW (lpString=".mdf") returned 4 [0088.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".mdf") returned 0x0 [0088.369] lstrlenW (lpString=".txt") returned 4 [0088.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".txt") returned 0x0 [0088.369] lstrlenW (lpString=".dbf") returned 4 [0088.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".dbf") returned 0x0 [0088.370] lstrlenW (lpString=".ckp") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".ckp") returned 0x0 [0088.370] lstrlenW (lpString=".dacpac") returned 7 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".dacpac") returned 0x0 [0088.370] lstrlenW (lpString=".db3") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".db3") returned 0x0 [0088.370] lstrlenW (lpString=".dtxs") returned 5 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".dtxs") returned 0x0 [0088.370] lstrlenW (lpString=".mdt") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".mdt") returned 0x0 [0088.370] lstrlenW (lpString=".sdf") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".sdf") returned 0x0 [0088.370] lstrlenW (lpString=".MDF") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".MDF") returned 0x0 [0088.370] lstrlenW (lpString=".DBF") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".DBF") returned 0x0 [0088.370] lstrlenW (lpString=".DB") returned 3 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".DB") returned 0x0 [0088.370] lstrlenW (lpString=".db") returned 3 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".db") returned 0x0 [0088.370] lstrlenW (lpString=".ndf") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".ndf") returned 0x0 [0088.370] lstrlenW (lpString=".NDF") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".NDF") returned 0x0 [0088.370] lstrlenW (lpString=".Mdf") returned 4 [0088.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".Mdf") returned 0x0 [0088.371] lstrlenW (lpString=".dat") returned 4 [0088.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".dat") returned 0x0 [0088.371] lstrlenW (lpString=".DAT") returned 4 [0088.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".DAT") returned 0x0 [0088.371] lstrlenW (lpString=".ldf") returned 4 [0088.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".ldf") returned 0x0 [0088.371] lstrlenW (lpString=".LDF") returned 4 [0088.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch=".LDF") returned 0x0 [0088.371] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.371] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.372] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.372] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.372] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20837318720) returned 1 [0088.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc37b9790, dwHighDateTime=0x1d585b4)) [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e128 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e128 | out: hHeap=0x260000) returned 1 [0088.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.373] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.373] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.373] GetLastError () returned 0x0 [0088.373] GetLastError () returned 0x0 [0088.373] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.373] GetLastError () returned 0x0 [0088.373] GetLastError () returned 0x0 [0088.375] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff5ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.375] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xa32, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xa32, lpOverlapped=0x0) returned 1 [0088.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.376] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.376] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.376] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.376] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.376] CloseHandle (hObject=0x11c) returned 1 [0088.376] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css.[deadmin@cock.li].deadmin")) returned 1 [0088.377] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.378] GetLastError () returned 0x0 [0088.378] RtlWakeConditionVariable () returned 0x0 [0088.378] GetCurrentThreadId () returned 0x9ac [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0088.378] lstrlenW (lpString=".vhd") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".vhd") returned 0x0 [0088.378] lstrlenW (lpString=".vhdx") returned 5 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".vhdx") returned 0x0 [0088.378] lstrlenW (lpString=".pst") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".pst") returned 0x0 [0088.378] lstrlenW (lpString=".ost") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ost") returned 0x0 [0088.378] lstrlenW (lpString=".bak") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".bak") returned 0x0 [0088.378] lstrlenW (lpString=".bac") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".bac") returned 0x0 [0088.378] lstrlenW (lpString=".sys") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".sys") returned 0x0 [0088.378] lstrlenW (lpString=".v2i") returned 4 [0088.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".v2i") returned 0x0 [0088.378] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.380] lstrlenW (lpString=".sql") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".sql") returned 0x0 [0088.380] lstrlenW (lpString=".mdf") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".mdf") returned 0x0 [0088.380] lstrlenW (lpString=".txt") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".txt") returned 0x0 [0088.380] lstrlenW (lpString=".dbf") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dbf") returned 0x0 [0088.380] lstrlenW (lpString=".ckp") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ckp") returned 0x0 [0088.380] lstrlenW (lpString=".dacpac") returned 7 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dacpac") returned 0x0 [0088.380] lstrlenW (lpString=".db3") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".db3") returned 0x0 [0088.380] lstrlenW (lpString=".dtxs") returned 5 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dtxs") returned 0x0 [0088.380] lstrlenW (lpString=".mdt") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".mdt") returned 0x0 [0088.380] lstrlenW (lpString=".sdf") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".sdf") returned 0x0 [0088.380] lstrlenW (lpString=".MDF") returned 4 [0088.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".MDF") returned 0x0 [0088.381] lstrlenW (lpString=".DBF") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".DBF") returned 0x0 [0088.381] lstrlenW (lpString=".DB") returned 3 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".DB") returned 0x0 [0088.381] lstrlenW (lpString=".db") returned 3 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".db") returned 0x0 [0088.381] lstrlenW (lpString=".ndf") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ndf") returned 0x0 [0088.381] lstrlenW (lpString=".NDF") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".NDF") returned 0x0 [0088.381] lstrlenW (lpString=".Mdf") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".Mdf") returned 0x0 [0088.381] lstrlenW (lpString=".dat") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dat") returned 0x0 [0088.381] lstrlenW (lpString=".DAT") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".DAT") returned 0x0 [0088.381] lstrlenW (lpString=".ldf") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0088.381] lstrlenW (lpString=".LDF") returned 4 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".LDF") returned 0x0 [0088.381] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.381] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.382] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.382] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.382] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20838360890) returned 1 [0088.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc37df8f0, dwHighDateTime=0x1d585b4)) [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e160 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e160 | out: hHeap=0x260000) returned 1 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.383] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.383] GetLastError () returned 0x0 [0088.384] GetLastError () returned 0x0 [0088.384] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.384] GetLastError () returned 0x0 [0088.384] GetLastError () returned 0x0 [0088.385] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.385] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0088.385] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.385] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.385] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.386] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.386] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.386] CloseHandle (hObject=0x11c) returned 1 [0088.386] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0088.388] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.388] GetLastError () returned 0x0 [0088.388] RtlWakeConditionVariable () returned 0x0 [0088.388] GetCurrentThreadId () returned 0x9ac [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.389] lstrlenW (lpString=".vhd") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0088.389] lstrlenW (lpString=".vhdx") returned 5 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0088.389] lstrlenW (lpString=".pst") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0088.389] lstrlenW (lpString=".ost") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0088.389] lstrlenW (lpString=".bak") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0088.389] lstrlenW (lpString=".bac") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0088.389] lstrlenW (lpString=".sys") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0088.389] lstrlenW (lpString=".v2i") returned 4 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0088.389] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.389] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.391] lstrlenW (lpString=".sql") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0088.391] lstrlenW (lpString=".mdf") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0088.391] lstrlenW (lpString=".txt") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0088.391] lstrlenW (lpString=".dbf") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0088.391] lstrlenW (lpString=".ckp") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0088.391] lstrlenW (lpString=".dacpac") returned 7 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0088.391] lstrlenW (lpString=".db3") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0088.391] lstrlenW (lpString=".dtxs") returned 5 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0088.391] lstrlenW (lpString=".mdt") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0088.391] lstrlenW (lpString=".sdf") returned 4 [0088.391] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0088.391] lstrlenW (lpString=".MDF") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0088.392] lstrlenW (lpString=".DBF") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0088.392] lstrlenW (lpString=".DB") returned 3 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0088.392] lstrlenW (lpString=".db") returned 3 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".db") returned 0x0 [0088.392] lstrlenW (lpString=".ndf") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0088.392] lstrlenW (lpString=".NDF") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0088.392] lstrlenW (lpString=".Mdf") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0088.392] lstrlenW (lpString=".dat") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0088.392] lstrlenW (lpString=".DAT") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0088.392] lstrlenW (lpString=".ldf") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.392] lstrlenW (lpString=".LDF") returned 4 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0088.392] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.392] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.393] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.393] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.393] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.393] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.394] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20839465970) returned 1 [0088.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3805a50, dwHighDateTime=0x1d585b4)) [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e198 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e198 | out: hHeap=0x260000) returned 1 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.394] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.394] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.394] GetLastError () returned 0x0 [0088.395] GetLastError () returned 0x0 [0088.395] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.395] GetLastError () returned 0x0 [0088.395] GetLastError () returned 0x0 [0088.396] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.396] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xff, lpOverlapped=0x0) returned 1 [0088.396] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.396] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.396] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.396] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.396] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.397] CloseHandle (hObject=0x11c) returned 1 [0088.397] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0088.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.400] GetLastError () returned 0x0 [0088.400] RtlWakeConditionVariable () returned 0x0 [0088.400] GetCurrentThreadId () returned 0x9ac [0088.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.400] lstrlenW (lpString=".vhd") returned 4 [0088.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0088.400] lstrlenW (lpString=".vhdx") returned 5 [0088.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0088.400] lstrlenW (lpString=".pst") returned 4 [0088.400] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0088.401] lstrlenW (lpString=".ost") returned 4 [0088.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0088.401] lstrlenW (lpString=".bak") returned 4 [0088.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0088.401] lstrlenW (lpString=".bac") returned 4 [0088.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0088.401] lstrlenW (lpString=".sys") returned 4 [0088.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0088.401] lstrlenW (lpString=".v2i") returned 4 [0088.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0088.401] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.401] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.402] lstrlenW (lpString=".sql") returned 4 [0088.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0088.402] lstrlenW (lpString=".mdf") returned 4 [0088.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0088.402] lstrlenW (lpString=".txt") returned 4 [0088.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0088.402] lstrlenW (lpString=".dbf") returned 4 [0088.402] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0088.402] lstrlenW (lpString=".ckp") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0088.403] lstrlenW (lpString=".dacpac") returned 7 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0088.403] lstrlenW (lpString=".db3") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0088.403] lstrlenW (lpString=".dtxs") returned 5 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0088.403] lstrlenW (lpString=".mdt") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0088.403] lstrlenW (lpString=".sdf") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0088.403] lstrlenW (lpString=".MDF") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0088.403] lstrlenW (lpString=".DBF") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0088.403] lstrlenW (lpString=".DB") returned 3 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0088.403] lstrlenW (lpString=".db") returned 3 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0088.403] lstrlenW (lpString=".ndf") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0088.403] lstrlenW (lpString=".NDF") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0088.403] lstrlenW (lpString=".Mdf") returned 4 [0088.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0088.403] lstrlenW (lpString=".dat") returned 4 [0088.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0088.404] lstrlenW (lpString=".DAT") returned 4 [0088.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0088.404] lstrlenW (lpString=".ldf") returned 4 [0088.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.404] lstrlenW (lpString=".LDF") returned 4 [0088.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0088.404] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.404] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.404] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.405] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.405] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.405] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.405] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.405] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20840677975) returned 1 [0088.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc382bbb0, dwHighDateTime=0x1d585b4)) [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e1d0 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e1d0 | out: hHeap=0x260000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.406] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.406] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.407] GetLastError () returned 0x0 [0088.407] GetLastError () returned 0x0 [0088.407] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.407] GetLastError () returned 0x0 [0088.407] GetLastError () returned 0x0 [0088.408] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.408] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0088.408] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.408] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.409] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.409] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.409] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.409] CloseHandle (hObject=0x11c) returned 1 [0088.409] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0088.411] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.411] GetLastError () returned 0x0 [0088.411] RtlWakeConditionVariable () returned 0x27e828 [0088.411] GetCurrentThreadId () returned 0x9ac [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.411] lstrlenW (lpString=".vhd") returned 4 [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0088.411] lstrlenW (lpString=".vhdx") returned 5 [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0088.411] lstrlenW (lpString=".pst") returned 4 [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0088.411] lstrlenW (lpString=".ost") returned 4 [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0088.411] lstrlenW (lpString=".bak") returned 4 [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0088.411] lstrlenW (lpString=".bac") returned 4 [0088.411] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0088.412] lstrlenW (lpString=".sys") returned 4 [0088.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0088.412] lstrlenW (lpString=".v2i") returned 4 [0088.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0088.412] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.412] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.413] lstrlenW (lpString=".sql") returned 4 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0088.413] lstrlenW (lpString=".mdf") returned 4 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0088.413] lstrlenW (lpString=".txt") returned 4 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0088.413] lstrlenW (lpString=".dbf") returned 4 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0088.413] lstrlenW (lpString=".ckp") returned 4 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0088.413] lstrlenW (lpString=".dacpac") returned 7 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0088.413] lstrlenW (lpString=".db3") returned 4 [0088.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0088.414] lstrlenW (lpString=".dtxs") returned 5 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0088.414] lstrlenW (lpString=".mdt") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0088.414] lstrlenW (lpString=".sdf") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0088.414] lstrlenW (lpString=".MDF") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0088.414] lstrlenW (lpString=".DBF") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0088.414] lstrlenW (lpString=".DB") returned 3 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0088.414] lstrlenW (lpString=".db") returned 3 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0088.414] lstrlenW (lpString=".ndf") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0088.414] lstrlenW (lpString=".NDF") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0088.414] lstrlenW (lpString=".Mdf") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0088.414] lstrlenW (lpString=".dat") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0088.414] lstrlenW (lpString=".DAT") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0088.414] lstrlenW (lpString=".ldf") returned 4 [0088.414] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.415] lstrlenW (lpString=".LDF") returned 4 [0088.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0088.415] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.415] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.415] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.416] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.416] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.416] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20841688273) returned 1 [0088.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc382bbb0, dwHighDateTime=0x1d585b4)) [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x33e208 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33e208 | out: hHeap=0x260000) returned 1 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.416] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.416] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.417] GetLastError () returned 0x0 [0088.417] GetLastError () returned 0x0 [0088.417] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.417] GetLastError () returned 0x0 [0088.417] GetLastError () returned 0x0 [0088.418] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.418] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0088.419] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.419] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.419] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.419] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.419] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.419] CloseHandle (hObject=0x11c) returned 1 [0088.419] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0088.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29221d0 | out: hHeap=0x260000) returned 1 [0088.422] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.422] GetLastError () returned 0x0 [0088.422] RtlWakeConditionVariable () returned 0x0 [0088.422] GetCurrentThreadId () returned 0x9ac [0088.422] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.422] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.423] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0088.423] WriteFile (in: hFile=0x11c, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0088.425] CloseHandle (hObject=0x11c) returned 1 [0088.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f750 | out: hHeap=0x260000) returned 1 [0088.425] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291fa98 | out: hHeap=0x260000) returned 1 [0088.425] RtlWakeConditionVariable () returned 0x27e828 [0088.425] GetCurrentThreadId () returned 0x9ac [0088.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".ldf") returned 0x0 [0088.425] lstrlenW (lpString=".vhd") returned 4 [0088.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".vhd") returned 0x0 [0088.425] lstrlenW (lpString=".vhdx") returned 5 [0088.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".vhdx") returned 0x0 [0088.425] lstrlenW (lpString=".pst") returned 4 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".pst") returned 0x0 [0088.426] lstrlenW (lpString=".ost") returned 4 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".ost") returned 0x0 [0088.426] lstrlenW (lpString=".bak") returned 4 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".bak") returned 0x0 [0088.426] lstrlenW (lpString=".bac") returned 4 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".bac") returned 0x0 [0088.426] lstrlenW (lpString=".sys") returned 4 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".sys") returned 0x0 [0088.426] lstrlenW (lpString=".v2i") returned 4 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".v2i") returned 0x0 [0088.426] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.426] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0088.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.427] lstrlenW (lpString=".sql") returned 4 [0088.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".sql") returned 0x0 [0088.428] lstrlenW (lpString=".mdf") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".mdf") returned 0x0 [0088.428] lstrlenW (lpString=".txt") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".txt") returned 0x0 [0088.428] lstrlenW (lpString=".dbf") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".dbf") returned 0x0 [0088.428] lstrlenW (lpString=".ckp") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".ckp") returned 0x0 [0088.428] lstrlenW (lpString=".dacpac") returned 7 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".dacpac") returned 0x0 [0088.428] lstrlenW (lpString=".db3") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".db3") returned 0x0 [0088.428] lstrlenW (lpString=".dtxs") returned 5 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".dtxs") returned 0x0 [0088.428] lstrlenW (lpString=".mdt") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".mdt") returned 0x0 [0088.428] lstrlenW (lpString=".sdf") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".sdf") returned 0x0 [0088.428] lstrlenW (lpString=".MDF") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".MDF") returned 0x0 [0088.428] lstrlenW (lpString=".DBF") returned 4 [0088.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".DBF") returned 0x0 [0088.429] lstrlenW (lpString=".DB") returned 3 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".DB") returned 0x0 [0088.429] lstrlenW (lpString=".db") returned 3 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".db") returned 0x0 [0088.429] lstrlenW (lpString=".ndf") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".ndf") returned 0x0 [0088.429] lstrlenW (lpString=".NDF") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".NDF") returned 0x0 [0088.429] lstrlenW (lpString=".Mdf") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".Mdf") returned 0x0 [0088.429] lstrlenW (lpString=".dat") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".dat") returned 0x0 [0088.429] lstrlenW (lpString=".DAT") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".DAT") returned 0x0 [0088.429] lstrlenW (lpString=".ldf") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".ldf") returned 0x0 [0088.429] lstrlenW (lpString=".LDF") returned 4 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch=".LDF") returned 0x0 [0088.429] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.429] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.430] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.430] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.430] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.431] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20843184775) returned 1 [0088.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3851d10, dwHighDateTime=0x1d585b4)) [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763f38 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763f38 | out: hHeap=0x260000) returned 1 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.431] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.431] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.432] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.432] GetLastError () returned 0x0 [0088.432] GetLastError () returned 0x0 [0088.432] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.432] GetLastError () returned 0x0 [0088.432] GetLastError () returned 0x0 [0088.434] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff3b1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.435] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xc4f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xc4f, lpOverlapped=0x0) returned 1 [0088.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.435] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.435] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.435] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.435] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.435] CloseHandle (hObject=0x11c) returned 1 [0088.435] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css.[deadmin@cock.li].deadmin")) returned 1 [0088.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.438] GetLastError () returned 0x0 [0088.438] RtlWakeConditionVariable () returned 0x0 [0088.438] GetCurrentThreadId () returned 0x9ac [0088.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.438] lstrlenW (lpString=".vhd") returned 4 [0088.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0088.438] lstrlenW (lpString=".vhdx") returned 5 [0088.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0088.438] lstrlenW (lpString=".pst") returned 4 [0088.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0088.438] lstrlenW (lpString=".ost") returned 4 [0088.438] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0088.439] lstrlenW (lpString=".bak") returned 4 [0088.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0088.439] lstrlenW (lpString=".bac") returned 4 [0088.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0088.439] lstrlenW (lpString=".sys") returned 4 [0088.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0088.439] lstrlenW (lpString=".v2i") returned 4 [0088.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0088.439] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.439] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.440] lstrlenW (lpString=".sql") returned 4 [0088.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0088.441] lstrlenW (lpString=".mdf") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0088.441] lstrlenW (lpString=".txt") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0088.441] lstrlenW (lpString=".dbf") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0088.441] lstrlenW (lpString=".ckp") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0088.441] lstrlenW (lpString=".dacpac") returned 7 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0088.441] lstrlenW (lpString=".db3") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0088.441] lstrlenW (lpString=".dtxs") returned 5 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0088.441] lstrlenW (lpString=".mdt") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0088.441] lstrlenW (lpString=".sdf") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0088.441] lstrlenW (lpString=".MDF") returned 4 [0088.441] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0088.441] lstrlenW (lpString=".DBF") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0088.442] lstrlenW (lpString=".DB") returned 3 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0088.442] lstrlenW (lpString=".db") returned 3 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0088.442] lstrlenW (lpString=".ndf") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0088.442] lstrlenW (lpString=".NDF") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0088.442] lstrlenW (lpString=".Mdf") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0088.442] lstrlenW (lpString=".dat") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0088.442] lstrlenW (lpString=".DAT") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0088.442] lstrlenW (lpString=".ldf") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.442] lstrlenW (lpString=".LDF") returned 4 [0088.442] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0088.442] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.443] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0088.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.443] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.444] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.444] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.444] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20844499140) returned 1 [0088.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3877e70, dwHighDateTime=0x1d585b4)) [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ec48 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ec48 | out: hHeap=0x260000) returned 1 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.444] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.445] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0088.445] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.445] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.445] GetLastError () returned 0x0 [0088.445] GetLastError () returned 0x0 [0088.445] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.445] GetLastError () returned 0x0 [0088.446] GetLastError () returned 0x0 [0088.447] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.447] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0088.447] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0088.447] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.448] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.448] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.448] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.448] CloseHandle (hObject=0x11c) returned 1 [0088.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.450] GetLastError () returned 0x0 [0088.450] RtlWakeConditionVariable () returned 0x27e828 [0088.450] GetCurrentThreadId () returned 0x9ac [0088.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.450] lstrlenW (lpString=".vhd") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0088.451] lstrlenW (lpString=".vhdx") returned 5 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0088.451] lstrlenW (lpString=".pst") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0088.451] lstrlenW (lpString=".ost") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0088.451] lstrlenW (lpString=".bak") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0088.451] lstrlenW (lpString=".bac") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0088.451] lstrlenW (lpString=".sys") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0088.451] lstrlenW (lpString=".v2i") returned 4 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0088.451] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0088.535] lstrlenW (lpString=".sql") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0088.535] lstrlenW (lpString=".mdf") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0088.535] lstrlenW (lpString=".txt") returned 4 [0088.535] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0088.535] lstrlenW (lpString=".dbf") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0088.536] lstrlenW (lpString=".ckp") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0088.536] lstrlenW (lpString=".dacpac") returned 7 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0088.536] lstrlenW (lpString=".db3") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0088.536] lstrlenW (lpString=".dtxs") returned 5 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0088.536] lstrlenW (lpString=".mdt") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0088.536] lstrlenW (lpString=".sdf") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0088.536] lstrlenW (lpString=".MDF") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0088.536] lstrlenW (lpString=".DBF") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0088.536] lstrlenW (lpString=".DB") returned 3 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0088.536] lstrlenW (lpString=".db") returned 3 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0088.536] lstrlenW (lpString=".ndf") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0088.536] lstrlenW (lpString=".NDF") returned 4 [0088.536] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0088.536] lstrlenW (lpString=".Mdf") returned 4 [0088.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0088.537] lstrlenW (lpString=".dat") returned 4 [0088.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0088.537] lstrlenW (lpString=".DAT") returned 4 [0088.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0088.537] lstrlenW (lpString=".ldf") returned 4 [0088.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0088.537] lstrlenW (lpString=".LDF") returned 4 [0088.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0088.537] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.537] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0088.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.537] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.538] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.538] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0088.538] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20853915218) returned 1 [0088.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc395c6b0, dwHighDateTime=0x1d585b4)) [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32ee78 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32ee78 | out: hHeap=0x260000) returned 1 [0088.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.538] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.539] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.539] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.539] GetLastError () returned 0x0 [0088.539] GetLastError () returned 0x0 [0088.539] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.539] GetLastError () returned 0x0 [0088.539] GetLastError () returned 0x0 [0088.540] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.540] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0088.541] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.541] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.541] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.541] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.541] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.541] CloseHandle (hObject=0x11c) returned 1 [0088.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0088.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0088.557] GetLastError () returned 0x0 [0088.557] RtlWakeConditionVariable () returned 0x0 [0088.557] GetCurrentThreadId () returned 0x9ac [0088.653] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.653] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0088.653] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0088.654] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0088.656] CloseHandle (hObject=0xf0) returned 1 [0088.685] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dd088 | out: hHeap=0x260000) returned 1 [0088.687] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0088.687] RtlWakeConditionVariable () returned 0x0 [0088.697] GetCurrentThreadId () returned 0x9ac [0088.701] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.703] lstrlenW (lpString=".vhd") returned 4 [0088.704] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0088.707] lstrlenW (lpString=".vhdx") returned 5 [0088.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0088.710] lstrlenW (lpString=".pst") returned 4 [0088.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0088.712] lstrlenW (lpString=".ost") returned 4 [0088.714] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0088.714] lstrlenW (lpString=".bak") returned 4 [0088.715] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0088.715] lstrlenW (lpString=".bac") returned 4 [0088.716] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0088.717] lstrlenW (lpString=".sys") returned 4 [0088.727] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0088.735] lstrlenW (lpString=".v2i") returned 4 [0088.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0088.744] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.750] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.770] lstrlenW (lpString=".sql") returned 4 [0088.773] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0088.777] lstrlenW (lpString=".mdf") returned 4 [0088.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0088.782] lstrlenW (lpString=".txt") returned 4 [0088.785] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0088.786] lstrlenW (lpString=".dbf") returned 4 [0088.788] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0088.791] lstrlenW (lpString=".ckp") returned 4 [0088.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0088.792] lstrlenW (lpString=".dacpac") returned 7 [0088.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0088.795] lstrlenW (lpString=".db3") returned 4 [0088.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0088.795] lstrlenW (lpString=".dtxs") returned 5 [0088.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0088.795] lstrlenW (lpString=".mdt") returned 4 [0088.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0088.795] lstrlenW (lpString=".sdf") returned 4 [0088.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0088.795] lstrlenW (lpString=".MDF") returned 4 [0088.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0088.795] lstrlenW (lpString=".DBF") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0088.796] lstrlenW (lpString=".DB") returned 3 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0088.796] lstrlenW (lpString=".db") returned 3 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".db") returned 0x0 [0088.796] lstrlenW (lpString=".ndf") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0088.796] lstrlenW (lpString=".NDF") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0088.796] lstrlenW (lpString=".Mdf") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0088.796] lstrlenW (lpString=".dat") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0088.796] lstrlenW (lpString=".DAT") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0088.796] lstrlenW (lpString=".ldf") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0088.796] lstrlenW (lpString=".LDF") returned 4 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0088.796] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.796] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.796] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.797] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.797] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.799] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20880104716) returned 1 [0088.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3be3e10, dwHighDateTime=0x1d585b4)) [0088.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0088.805] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0088.806] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0088.810] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32f1c0 [0088.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f1c0 | out: hHeap=0x260000) returned 1 [0088.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.862] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.862] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.862] GetLastError () returned 0x0 [0088.862] GetLastError () returned 0x0 [0088.862] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.862] GetLastError () returned 0x0 [0088.862] GetLastError () returned 0x0 [0088.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.864] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1b8, lpOverlapped=0x0) returned 1 [0088.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0088.877] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.879] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.881] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.881] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.893] CloseHandle (hObject=0xf0) returned 1 [0088.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0088.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0088.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0088.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0088.907] GetLastError () returned 0x0 [0088.907] RtlWakeConditionVariable () returned 0x0 [0088.907] GetCurrentThreadId () returned 0x9ac [0088.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.909] lstrlenW (lpString=".vhd") returned 4 [0088.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0088.909] lstrlenW (lpString=".vhdx") returned 5 [0088.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0088.909] lstrlenW (lpString=".pst") returned 4 [0088.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0088.909] lstrlenW (lpString=".ost") returned 4 [0088.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0088.909] lstrlenW (lpString=".bak") returned 4 [0088.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0088.909] lstrlenW (lpString=".bac") returned 4 [0088.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0088.911] lstrlenW (lpString=".sys") returned 4 [0088.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0088.913] lstrlenW (lpString=".v2i") returned 4 [0088.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0088.913] lstrlenW (lpString="s\r\n.v2i") returned 7 [0088.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0088.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0088.917] lstrlenW (lpString=".sql") returned 4 [0088.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0088.917] lstrlenW (lpString=".mdf") returned 4 [0088.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0088.917] lstrlenW (lpString=".txt") returned 4 [0088.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0088.917] lstrlenW (lpString=".dbf") returned 4 [0088.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0088.918] lstrlenW (lpString=".ckp") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0088.918] lstrlenW (lpString=".dacpac") returned 7 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0088.918] lstrlenW (lpString=".db3") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0088.918] lstrlenW (lpString=".dtxs") returned 5 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0088.918] lstrlenW (lpString=".mdt") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0088.918] lstrlenW (lpString=".sdf") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0088.918] lstrlenW (lpString=".MDF") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0088.918] lstrlenW (lpString=".DBF") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0088.918] lstrlenW (lpString=".DB") returned 3 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0088.918] lstrlenW (lpString=".db") returned 3 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0088.918] lstrlenW (lpString=".ndf") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0088.918] lstrlenW (lpString=".NDF") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0088.918] lstrlenW (lpString=".Mdf") returned 4 [0088.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0088.919] lstrlenW (lpString=".dat") returned 4 [0088.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0088.919] lstrlenW (lpString=".DAT") returned 4 [0088.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0088.919] lstrlenW (lpString=".ldf") returned 4 [0088.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0088.919] lstrlenW (lpString=".LDF") returned 4 [0088.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0088.919] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0088.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0088.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0088.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0088.919] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0088.920] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0088.920] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0088.920] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0088.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0088.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0088.920] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20892136502) returned 1 [0088.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc3dace90, dwHighDateTime=0x1d585b4)) [0088.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0088.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0088.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0088.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x32eaf8 [0088.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0088.993] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32eaf8 | out: hHeap=0x260000) returned 1 [0088.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0088.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0088.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0088.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0088.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0088.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0088.994] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0088.994] GetLastError () returned 0x0 [0088.994] GetLastError () returned 0x0 [0088.994] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0088.994] GetLastError () returned 0x0 [0088.994] GetLastError () returned 0x0 [0088.995] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.995] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0088.996] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0088.996] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.996] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0088.996] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0088.996] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0088.996] CloseHandle (hObject=0xf0) returned 1 [0089.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0089.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922578 | out: hHeap=0x260000) returned 1 [0089.091] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.091] GetLastError () returned 0x0 [0089.091] RtlWakeConditionVariable () returned 0x0 [0089.091] GetCurrentThreadId () returned 0x9ac [0089.245] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.245] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.245] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.245] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.246] CloseHandle (hObject=0xf0) returned 1 [0089.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a418 | out: hHeap=0x260000) returned 1 [0089.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.246] RtlWakeConditionVariable () returned 0x0 [0089.247] GetCurrentThreadId () returned 0x9ac [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".ldf") returned 0x0 [0089.247] lstrlenW (lpString=".vhd") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".vhd") returned 0x0 [0089.247] lstrlenW (lpString=".vhdx") returned 5 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".vhdx") returned 0x0 [0089.247] lstrlenW (lpString=".pst") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".pst") returned 0x0 [0089.247] lstrlenW (lpString=".ost") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".ost") returned 0x0 [0089.247] lstrlenW (lpString=".bak") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".bak") returned 0x0 [0089.247] lstrlenW (lpString=".bac") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".bac") returned 0x0 [0089.247] lstrlenW (lpString=".sys") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".sys") returned 0x0 [0089.247] lstrlenW (lpString=".v2i") returned 4 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".v2i") returned 0x0 [0089.247] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.247] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.249] lstrlenW (lpString=".sql") returned 4 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".sql") returned 0x0 [0089.249] lstrlenW (lpString=".mdf") returned 4 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".mdf") returned 0x0 [0089.249] lstrlenW (lpString=".txt") returned 4 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".txt") returned 0x0 [0089.249] lstrlenW (lpString=".dbf") returned 4 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".dbf") returned 0x0 [0089.249] lstrlenW (lpString=".ckp") returned 4 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".ckp") returned 0x0 [0089.249] lstrlenW (lpString=".dacpac") returned 7 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".dacpac") returned 0x0 [0089.249] lstrlenW (lpString=".db3") returned 4 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".db3") returned 0x0 [0089.249] lstrlenW (lpString=".dtxs") returned 5 [0089.249] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".dtxs") returned 0x0 [0089.249] lstrlenW (lpString=".mdt") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".mdt") returned 0x0 [0089.250] lstrlenW (lpString=".sdf") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".sdf") returned 0x0 [0089.250] lstrlenW (lpString=".MDF") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".MDF") returned 0x0 [0089.250] lstrlenW (lpString=".DBF") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".DBF") returned 0x0 [0089.250] lstrlenW (lpString=".DB") returned 3 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".DB") returned 0x0 [0089.250] lstrlenW (lpString=".db") returned 3 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".db") returned 0x0 [0089.250] lstrlenW (lpString=".ndf") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".ndf") returned 0x0 [0089.250] lstrlenW (lpString=".NDF") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".NDF") returned 0x0 [0089.250] lstrlenW (lpString=".Mdf") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".Mdf") returned 0x0 [0089.250] lstrlenW (lpString=".dat") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".dat") returned 0x0 [0089.250] lstrlenW (lpString=".DAT") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".DAT") returned 0x0 [0089.250] lstrlenW (lpString=".ldf") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".ldf") returned 0x0 [0089.250] lstrlenW (lpString=".LDF") returned 4 [0089.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch=".LDF") returned 0x0 [0089.250] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.251] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.251] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.251] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.252] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20925368498) returned 1 [0089.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc40345f0, dwHighDateTime=0x1d585b4)) [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x295348 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295348 | out: hHeap=0x260000) returned 1 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.253] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.253] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.253] GetLastError () returned 0x0 [0089.254] GetLastError () returned 0x0 [0089.254] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.254] GetLastError () returned 0x0 [0089.254] GetLastError () returned 0x0 [0089.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc74, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.355] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x38c, lpOverlapped=0x0) returned 1 [0089.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.355] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.355] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.355] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.355] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.355] CloseHandle (hObject=0xf0) returned 1 [0089.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css.[deadmin@cock.li].deadmin")) returned 1 [0089.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.357] GetLastError () returned 0x0 [0089.357] RtlWakeConditionVariable () returned 0x0 [0089.357] GetCurrentThreadId () returned 0x9ac [0089.357] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".ldf") returned 0x0 [0089.358] lstrlenW (lpString=".vhd") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".vhd") returned 0x0 [0089.358] lstrlenW (lpString=".vhdx") returned 5 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".vhdx") returned 0x0 [0089.358] lstrlenW (lpString=".pst") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".pst") returned 0x0 [0089.358] lstrlenW (lpString=".ost") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".ost") returned 0x0 [0089.358] lstrlenW (lpString=".bak") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".bak") returned 0x0 [0089.358] lstrlenW (lpString=".bac") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".bac") returned 0x0 [0089.358] lstrlenW (lpString=".sys") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".sys") returned 0x0 [0089.358] lstrlenW (lpString=".v2i") returned 4 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".v2i") returned 0x0 [0089.358] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.359] lstrlenW (lpString=".sql") returned 4 [0089.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".sql") returned 0x0 [0089.359] lstrlenW (lpString=".mdf") returned 4 [0089.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".mdf") returned 0x0 [0089.359] lstrlenW (lpString=".txt") returned 4 [0089.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".txt") returned 0x0 [0089.359] lstrlenW (lpString=".dbf") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".dbf") returned 0x0 [0089.360] lstrlenW (lpString=".ckp") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".ckp") returned 0x0 [0089.360] lstrlenW (lpString=".dacpac") returned 7 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".dacpac") returned 0x0 [0089.360] lstrlenW (lpString=".db3") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".db3") returned 0x0 [0089.360] lstrlenW (lpString=".dtxs") returned 5 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".dtxs") returned 0x0 [0089.360] lstrlenW (lpString=".mdt") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".mdt") returned 0x0 [0089.360] lstrlenW (lpString=".sdf") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".sdf") returned 0x0 [0089.360] lstrlenW (lpString=".MDF") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".MDF") returned 0x0 [0089.360] lstrlenW (lpString=".DBF") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".DBF") returned 0x0 [0089.360] lstrlenW (lpString=".DB") returned 3 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".DB") returned 0x0 [0089.360] lstrlenW (lpString=".db") returned 3 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".db") returned 0x0 [0089.360] lstrlenW (lpString=".ndf") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".ndf") returned 0x0 [0089.360] lstrlenW (lpString=".NDF") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".NDF") returned 0x0 [0089.360] lstrlenW (lpString=".Mdf") returned 4 [0089.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".Mdf") returned 0x0 [0089.361] lstrlenW (lpString=".dat") returned 4 [0089.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".dat") returned 0x0 [0089.361] lstrlenW (lpString=".DAT") returned 4 [0089.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".DAT") returned 0x0 [0089.361] lstrlenW (lpString=".ldf") returned 4 [0089.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".ldf") returned 0x0 [0089.361] lstrlenW (lpString=".LDF") returned 4 [0089.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch=".LDF") returned 0x0 [0089.361] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.361] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.362] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.362] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.362] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20936308651) returned 1 [0089.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc413ef90, dwHighDateTime=0x1d585b4)) [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294988 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294988 | out: hHeap=0x260000) returned 1 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.362] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.363] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.363] GetLastError () returned 0x0 [0089.363] GetLastError () returned 0x0 [0089.363] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.363] GetLastError () returned 0x0 [0089.363] GetLastError () returned 0x0 [0089.364] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.365] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xe9, lpOverlapped=0x0) returned 1 [0089.365] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.365] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.365] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.365] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.365] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.365] CloseHandle (hObject=0xf0) returned 1 [0089.365] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0089.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29227e8 | out: hHeap=0x260000) returned 1 [0089.366] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.367] GetLastError () returned 0x0 [0089.367] RtlWakeConditionVariable () returned 0x27e828 [0089.367] GetCurrentThreadId () returned 0x9ac [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".ldf") returned 0x0 [0089.367] lstrlenW (lpString=".vhd") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".vhd") returned 0x0 [0089.367] lstrlenW (lpString=".vhdx") returned 5 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".vhdx") returned 0x0 [0089.367] lstrlenW (lpString=".pst") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".pst") returned 0x0 [0089.367] lstrlenW (lpString=".ost") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".ost") returned 0x0 [0089.367] lstrlenW (lpString=".bak") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".bak") returned 0x0 [0089.367] lstrlenW (lpString=".bac") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".bac") returned 0x0 [0089.367] lstrlenW (lpString=".sys") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".sys") returned 0x0 [0089.367] lstrlenW (lpString=".v2i") returned 4 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".v2i") returned 0x0 [0089.367] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0089.368] lstrlenW (lpString=".sql") returned 4 [0089.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".sql") returned 0x0 [0089.368] lstrlenW (lpString=".mdf") returned 4 [0089.368] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".mdf") returned 0x0 [0089.369] lstrlenW (lpString=".txt") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".txt") returned 0x0 [0089.369] lstrlenW (lpString=".dbf") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".dbf") returned 0x0 [0089.369] lstrlenW (lpString=".ckp") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".ckp") returned 0x0 [0089.369] lstrlenW (lpString=".dacpac") returned 7 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".dacpac") returned 0x0 [0089.369] lstrlenW (lpString=".db3") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".db3") returned 0x0 [0089.369] lstrlenW (lpString=".dtxs") returned 5 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".dtxs") returned 0x0 [0089.369] lstrlenW (lpString=".mdt") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".mdt") returned 0x0 [0089.369] lstrlenW (lpString=".sdf") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".sdf") returned 0x0 [0089.369] lstrlenW (lpString=".MDF") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".MDF") returned 0x0 [0089.369] lstrlenW (lpString=".DBF") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".DBF") returned 0x0 [0089.369] lstrlenW (lpString=".DB") returned 3 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".DB") returned 0x0 [0089.369] lstrlenW (lpString=".db") returned 3 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".db") returned 0x0 [0089.369] lstrlenW (lpString=".ndf") returned 4 [0089.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".ndf") returned 0x0 [0089.370] lstrlenW (lpString=".NDF") returned 4 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".NDF") returned 0x0 [0089.370] lstrlenW (lpString=".Mdf") returned 4 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".Mdf") returned 0x0 [0089.370] lstrlenW (lpString=".dat") returned 4 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".dat") returned 0x0 [0089.370] lstrlenW (lpString=".DAT") returned 4 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".DAT") returned 0x0 [0089.370] lstrlenW (lpString=".ldf") returned 4 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".ldf") returned 0x0 [0089.370] lstrlenW (lpString=".LDF") returned 4 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch=".LDF") returned 0x0 [0089.370] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.370] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.371] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.371] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.371] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20937220983) returned 1 [0089.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc413ef90, dwHighDateTime=0x1d585b4)) [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294d08 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x294d08 | out: hHeap=0x260000) returned 1 [0089.371] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.372] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.372] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.372] GetLastError () returned 0x0 [0089.372] GetLastError () returned 0x0 [0089.372] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.372] GetLastError () returned 0x0 [0089.373] GetLastError () returned 0x0 [0089.387] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff343, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.387] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xcbd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xcbd, lpOverlapped=0x0) returned 1 [0089.387] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0089.389] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.389] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.395] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.396] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.396] CloseHandle (hObject=0xf0) returned 1 [0089.415] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x2776188 [0089.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0089.436] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2776188 | out: hHeap=0x260000) returned 1 [0089.438] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.438] GetLastError () returned 0x0 [0089.469] RtlWakeConditionVariable () returned 0x0 [0089.479] GetCurrentThreadId () returned 0x9ac [0089.479] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".ldf") returned 0x0 [0089.479] lstrlenW (lpString=".vhd") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".vhd") returned 0x0 [0089.482] lstrlenW (lpString=".vhdx") returned 5 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".vhdx") returned 0x0 [0089.482] lstrlenW (lpString=".pst") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".pst") returned 0x0 [0089.482] lstrlenW (lpString=".ost") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".ost") returned 0x0 [0089.482] lstrlenW (lpString=".bak") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".bak") returned 0x0 [0089.482] lstrlenW (lpString=".bac") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".bac") returned 0x0 [0089.482] lstrlenW (lpString=".sys") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".sys") returned 0x0 [0089.482] lstrlenW (lpString=".v2i") returned 4 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".v2i") returned 0x0 [0089.482] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.483] lstrlenW (lpString=".sql") returned 4 [0089.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".sql") returned 0x0 [0089.483] lstrlenW (lpString=".mdf") returned 4 [0089.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".mdf") returned 0x0 [0089.483] lstrlenW (lpString=".txt") returned 4 [0089.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".txt") returned 0x0 [0089.484] lstrlenW (lpString=".dbf") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".dbf") returned 0x0 [0089.484] lstrlenW (lpString=".ckp") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".ckp") returned 0x0 [0089.484] lstrlenW (lpString=".dacpac") returned 7 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".dacpac") returned 0x0 [0089.484] lstrlenW (lpString=".db3") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".db3") returned 0x0 [0089.484] lstrlenW (lpString=".dtxs") returned 5 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".dtxs") returned 0x0 [0089.484] lstrlenW (lpString=".mdt") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".mdt") returned 0x0 [0089.484] lstrlenW (lpString=".sdf") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".sdf") returned 0x0 [0089.484] lstrlenW (lpString=".MDF") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".MDF") returned 0x0 [0089.484] lstrlenW (lpString=".DBF") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".DBF") returned 0x0 [0089.484] lstrlenW (lpString=".DB") returned 3 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".DB") returned 0x0 [0089.484] lstrlenW (lpString=".db") returned 3 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".db") returned 0x0 [0089.484] lstrlenW (lpString=".ndf") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".ndf") returned 0x0 [0089.484] lstrlenW (lpString=".NDF") returned 4 [0089.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".NDF") returned 0x0 [0089.485] lstrlenW (lpString=".Mdf") returned 4 [0089.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".Mdf") returned 0x0 [0089.485] lstrlenW (lpString=".dat") returned 4 [0089.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".dat") returned 0x0 [0089.485] lstrlenW (lpString=".DAT") returned 4 [0089.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".DAT") returned 0x0 [0089.485] lstrlenW (lpString=".ldf") returned 4 [0089.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".ldf") returned 0x0 [0089.485] lstrlenW (lpString=".LDF") returned 4 [0089.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch=".LDF") returned 0x0 [0089.485] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.485] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.486] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.486] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20948714419) returned 1 [0089.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc426fa90, dwHighDateTime=0x1d585b4)) [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299670 | out: hHeap=0x260000) returned 1 [0089.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.487] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.487] GetLastError () returned 0x0 [0089.487] GetLastError () returned 0x0 [0089.487] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.487] GetLastError () returned 0x0 [0089.487] GetLastError () returned 0x0 [0089.490] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc85, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.490] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x37b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x37b, lpOverlapped=0x0) returned 1 [0089.490] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.490] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.490] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.490] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.490] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.490] CloseHandle (hObject=0xd8) returned 1 [0089.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css.[deadmin@cock.li].deadmin")) returned 1 [0089.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.491] GetLastError () returned 0x0 [0089.492] RtlWakeConditionVariable () returned 0x0 [0089.492] GetCurrentThreadId () returned 0x9ac [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".ldf") returned 0x0 [0089.492] lstrlenW (lpString=".vhd") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".vhd") returned 0x0 [0089.492] lstrlenW (lpString=".vhdx") returned 5 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".vhdx") returned 0x0 [0089.492] lstrlenW (lpString=".pst") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".pst") returned 0x0 [0089.492] lstrlenW (lpString=".ost") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".ost") returned 0x0 [0089.492] lstrlenW (lpString=".bak") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".bak") returned 0x0 [0089.492] lstrlenW (lpString=".bac") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".bac") returned 0x0 [0089.492] lstrlenW (lpString=".sys") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".sys") returned 0x0 [0089.492] lstrlenW (lpString=".v2i") returned 4 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".v2i") returned 0x0 [0089.492] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch="s\r\n.v2i") returned 0x0 [0089.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.493] lstrlenW (lpString=".sql") returned 4 [0089.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".sql") returned 0x0 [0089.493] lstrlenW (lpString=".mdf") returned 4 [0089.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".mdf") returned 0x0 [0089.493] lstrlenW (lpString=".txt") returned 4 [0089.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".txt") returned 0x0 [0089.494] lstrlenW (lpString=".dbf") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".dbf") returned 0x0 [0089.494] lstrlenW (lpString=".ckp") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".ckp") returned 0x0 [0089.494] lstrlenW (lpString=".dacpac") returned 7 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".dacpac") returned 0x0 [0089.494] lstrlenW (lpString=".db3") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".db3") returned 0x0 [0089.494] lstrlenW (lpString=".dtxs") returned 5 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".dtxs") returned 0x0 [0089.494] lstrlenW (lpString=".mdt") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".mdt") returned 0x0 [0089.494] lstrlenW (lpString=".sdf") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".sdf") returned 0x0 [0089.494] lstrlenW (lpString=".MDF") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".MDF") returned 0x0 [0089.494] lstrlenW (lpString=".DBF") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".DBF") returned 0x0 [0089.494] lstrlenW (lpString=".DB") returned 3 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".DB") returned 0x0 [0089.494] lstrlenW (lpString=".db") returned 3 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".db") returned 0x0 [0089.494] lstrlenW (lpString=".ndf") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".ndf") returned 0x0 [0089.494] lstrlenW (lpString=".NDF") returned 4 [0089.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".NDF") returned 0x0 [0089.495] lstrlenW (lpString=".Mdf") returned 4 [0089.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".Mdf") returned 0x0 [0089.495] lstrlenW (lpString=".dat") returned 4 [0089.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".dat") returned 0x0 [0089.495] lstrlenW (lpString=".DAT") returned 4 [0089.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".DAT") returned 0x0 [0089.495] lstrlenW (lpString=".ldf") returned 4 [0089.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".ldf") returned 0x0 [0089.495] lstrlenW (lpString=".LDF") returned 4 [0089.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch=".LDF") returned 0x0 [0089.495] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.495] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.496] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.496] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.496] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20949716615) returned 1 [0089.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc426fa90, dwHighDateTime=0x1d585b4)) [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299478 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x299478 | out: hHeap=0x260000) returned 1 [0089.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.497] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.497] GetLastError () returned 0x0 [0089.497] GetLastError () returned 0x0 [0089.497] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.498] GetLastError () returned 0x0 [0089.498] GetLastError () returned 0x0 [0089.500] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffffc8b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.500] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x375, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x375, lpOverlapped=0x0) returned 1 [0089.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.500] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.500] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.500] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.500] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.501] CloseHandle (hObject=0xd8) returned 1 [0089.501] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css.[deadmin@cock.li].deadmin")) returned 1 [0089.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.502] GetLastError () returned 0x0 [0089.502] RtlWakeConditionVariable () returned 0x0 [0089.502] GetCurrentThreadId () returned 0x9ac [0089.503] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.503] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0089.503] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0089.503] WriteFile (in: hFile=0xd8, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0089.505] CloseHandle (hObject=0xd8) returned 1 [0089.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0089.505] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0089.505] RtlWakeConditionVariable () returned 0x0 [0089.505] GetCurrentThreadId () returned 0x9ac [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".ldf") returned 0x0 [0089.505] lstrlenW (lpString=".vhd") returned 4 [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".vhd") returned 0x0 [0089.505] lstrlenW (lpString=".vhdx") returned 5 [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".vhdx") returned 0x0 [0089.505] lstrlenW (lpString=".pst") returned 4 [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".pst") returned 0x0 [0089.505] lstrlenW (lpString=".ost") returned 4 [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".ost") returned 0x0 [0089.505] lstrlenW (lpString=".bak") returned 4 [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".bak") returned 0x0 [0089.505] lstrlenW (lpString=".bac") returned 4 [0089.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".bac") returned 0x0 [0089.506] lstrlenW (lpString=".sys") returned 4 [0089.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".sys") returned 0x0 [0089.506] lstrlenW (lpString=".v2i") returned 4 [0089.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".v2i") returned 0x0 [0089.506] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch="s\r\n.v2i") returned 0x0 [0089.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.507] lstrlenW (lpString=".sql") returned 4 [0089.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".sql") returned 0x0 [0089.507] lstrlenW (lpString=".mdf") returned 4 [0089.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".mdf") returned 0x0 [0089.507] lstrlenW (lpString=".txt") returned 4 [0089.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".txt") returned 0x0 [0089.507] lstrlenW (lpString=".dbf") returned 4 [0089.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".dbf") returned 0x0 [0089.508] lstrlenW (lpString=".ckp") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".ckp") returned 0x0 [0089.508] lstrlenW (lpString=".dacpac") returned 7 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".dacpac") returned 0x0 [0089.508] lstrlenW (lpString=".db3") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".db3") returned 0x0 [0089.508] lstrlenW (lpString=".dtxs") returned 5 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".dtxs") returned 0x0 [0089.508] lstrlenW (lpString=".mdt") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".mdt") returned 0x0 [0089.508] lstrlenW (lpString=".sdf") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".sdf") returned 0x0 [0089.508] lstrlenW (lpString=".MDF") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".MDF") returned 0x0 [0089.508] lstrlenW (lpString=".DBF") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".DBF") returned 0x0 [0089.508] lstrlenW (lpString=".DB") returned 3 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".DB") returned 0x0 [0089.508] lstrlenW (lpString=".db") returned 3 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".db") returned 0x0 [0089.508] lstrlenW (lpString=".ndf") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".ndf") returned 0x0 [0089.508] lstrlenW (lpString=".NDF") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".NDF") returned 0x0 [0089.508] lstrlenW (lpString=".Mdf") returned 4 [0089.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".Mdf") returned 0x0 [0089.508] lstrlenW (lpString=".dat") returned 4 [0089.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".dat") returned 0x0 [0089.509] lstrlenW (lpString=".DAT") returned 4 [0089.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".DAT") returned 0x0 [0089.509] lstrlenW (lpString=".ldf") returned 4 [0089.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".ldf") returned 0x0 [0089.509] lstrlenW (lpString=".LDF") returned 4 [0089.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch=".LDF") returned 0x0 [0089.509] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.509] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.509] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.510] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.510] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.510] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20951106735) returned 1 [0089.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4295bf0, dwHighDateTime=0x1d585b4)) [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997f8 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2997f8 | out: hHeap=0x260000) returned 1 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.511] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.511] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.511] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.511] GetLastError () returned 0x0 [0089.511] GetLastError () returned 0x0 [0089.511] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.511] GetLastError () returned 0x0 [0089.511] GetLastError () returned 0x0 [0089.514] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffff70a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.514] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8f6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x8f6, lpOverlapped=0x0) returned 1 [0089.514] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.514] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.514] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.514] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.514] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.514] CloseHandle (hObject=0xd8) returned 1 [0089.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x27762b0 [0089.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.[deadmin@cock.li].deadmin")) returned 1 [0089.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27762b0 | out: hHeap=0x260000) returned 1 [0089.516] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.516] GetLastError () returned 0x0 [0089.516] RtlWakeConditionVariable () returned 0x0 [0089.516] GetCurrentThreadId () returned 0x9ac [0089.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0089.516] lstrlenW (lpString=".vhd") returned 4 [0089.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".vhd") returned 0x0 [0089.516] lstrlenW (lpString=".vhdx") returned 5 [0089.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".vhdx") returned 0x0 [0089.516] lstrlenW (lpString=".pst") returned 4 [0089.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".pst") returned 0x0 [0089.516] lstrlenW (lpString=".ost") returned 4 [0089.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".ost") returned 0x0 [0089.516] lstrlenW (lpString=".bak") returned 4 [0089.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".bak") returned 0x0 [0089.517] lstrlenW (lpString=".bac") returned 4 [0089.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".bac") returned 0x0 [0089.517] lstrlenW (lpString=".sys") returned 4 [0089.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".sys") returned 0x0 [0089.517] lstrlenW (lpString=".v2i") returned 4 [0089.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".v2i") returned 0x0 [0089.517] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.517] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0089.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0089.518] lstrlenW (lpString=".sql") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".sql") returned 0x0 [0089.518] lstrlenW (lpString=".mdf") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".mdf") returned 0x0 [0089.518] lstrlenW (lpString=".txt") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".txt") returned 0x0 [0089.518] lstrlenW (lpString=".dbf") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".dbf") returned 0x0 [0089.518] lstrlenW (lpString=".ckp") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".ckp") returned 0x0 [0089.518] lstrlenW (lpString=".dacpac") returned 7 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".dacpac") returned 0x0 [0089.518] lstrlenW (lpString=".db3") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".db3") returned 0x0 [0089.518] lstrlenW (lpString=".dtxs") returned 5 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".dtxs") returned 0x0 [0089.518] lstrlenW (lpString=".mdt") returned 4 [0089.518] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".mdt") returned 0x0 [0089.519] lstrlenW (lpString=".sdf") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".sdf") returned 0x0 [0089.519] lstrlenW (lpString=".MDF") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".MDF") returned 0x0 [0089.519] lstrlenW (lpString=".DBF") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".DBF") returned 0x0 [0089.519] lstrlenW (lpString=".DB") returned 3 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".DB") returned 0x0 [0089.519] lstrlenW (lpString=".db") returned 3 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".db") returned 0x0 [0089.519] lstrlenW (lpString=".ndf") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".ndf") returned 0x0 [0089.519] lstrlenW (lpString=".NDF") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".NDF") returned 0x0 [0089.519] lstrlenW (lpString=".Mdf") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".Mdf") returned 0x0 [0089.519] lstrlenW (lpString=".dat") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".dat") returned 0x0 [0089.519] lstrlenW (lpString=".DAT") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".DAT") returned 0x0 [0089.519] lstrlenW (lpString=".ldf") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0089.519] lstrlenW (lpString=".LDF") returned 4 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch=".LDF") returned 0x0 [0089.519] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.519] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0089.520] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.520] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.520] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.521] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0089.521] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20952183711) returned 1 [0089.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc42bbd50, dwHighDateTime=0x1d585b4)) [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2763fe0 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2763fe0 | out: hHeap=0x260000) returned 1 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.521] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.521] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.521] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.522] GetLastError () returned 0x0 [0089.522] GetLastError () returned 0x0 [0089.522] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.522] GetLastError () returned 0x0 [0089.522] GetLastError () returned 0x0 [0089.588] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xffffd11d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.613] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2ee3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2ee3, lpOverlapped=0x0) returned 1 [0089.614] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.614] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.614] WriteFile (in: hFile=0xd8, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.614] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.614] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.615] CloseHandle (hObject=0xd8) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0089.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0089.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0089.618] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0089.618] GetLastError () returned 0x0 [0089.618] RtlWakeConditionVariable () returned 0x0 [0089.619] GetCurrentThreadId () returned 0x9ac [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".ldf") returned 0x0 [0089.619] lstrlenW (lpString=".vhd") returned 4 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".vhd") returned 0x0 [0089.619] lstrlenW (lpString=".vhdx") returned 5 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".vhdx") returned 0x0 [0089.619] lstrlenW (lpString=".pst") returned 4 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".pst") returned 0x0 [0089.619] lstrlenW (lpString=".ost") returned 4 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".ost") returned 0x0 [0089.619] lstrlenW (lpString=".bak") returned 4 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".bak") returned 0x0 [0089.619] lstrlenW (lpString=".bac") returned 4 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".bac") returned 0x0 [0089.619] lstrlenW (lpString=".sys") returned 4 [0089.619] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".sys") returned 0x0 [0089.619] lstrlenW (lpString=".v2i") returned 4 [0089.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".v2i") returned 0x0 [0089.620] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.620] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0089.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.907] lstrlenW (lpString=".sql") returned 4 [0089.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".sql") returned 0x0 [0089.907] lstrlenW (lpString=".mdf") returned 4 [0089.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".mdf") returned 0x0 [0089.907] lstrlenW (lpString=".txt") returned 4 [0089.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".txt") returned 0x0 [0089.907] lstrlenW (lpString=".dbf") returned 4 [0089.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".dbf") returned 0x0 [0089.907] lstrlenW (lpString=".ckp") returned 4 [0089.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".ckp") returned 0x0 [0089.907] lstrlenW (lpString=".dacpac") returned 7 [0089.907] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".dacpac") returned 0x0 [0089.908] lstrlenW (lpString=".db3") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".db3") returned 0x0 [0089.908] lstrlenW (lpString=".dtxs") returned 5 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".dtxs") returned 0x0 [0089.908] lstrlenW (lpString=".mdt") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".mdt") returned 0x0 [0089.908] lstrlenW (lpString=".sdf") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".sdf") returned 0x0 [0089.908] lstrlenW (lpString=".MDF") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".MDF") returned 0x0 [0089.908] lstrlenW (lpString=".DBF") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".DBF") returned 0x0 [0089.908] lstrlenW (lpString=".DB") returned 3 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".DB") returned 0x0 [0089.908] lstrlenW (lpString=".db") returned 3 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".db") returned 0x0 [0089.908] lstrlenW (lpString=".ndf") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".ndf") returned 0x0 [0089.908] lstrlenW (lpString=".NDF") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".NDF") returned 0x0 [0089.908] lstrlenW (lpString=".Mdf") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".Mdf") returned 0x0 [0089.908] lstrlenW (lpString=".dat") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".dat") returned 0x0 [0089.908] lstrlenW (lpString=".DAT") returned 4 [0089.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".DAT") returned 0x0 [0089.909] lstrlenW (lpString=".ldf") returned 4 [0089.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".ldf") returned 0x0 [0089.909] lstrlenW (lpString=".LDF") returned 4 [0089.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch=".LDF") returned 0x0 [0089.909] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.909] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.910] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.910] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20991100371) returned 1 [0089.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4673fb0, dwHighDateTime=0x1d585b4)) [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2d77b8 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d77b8 | out: hHeap=0x260000) returned 1 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.911] GetLastError () returned 0x0 [0089.911] GetLastError () returned 0x0 [0089.911] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.911] GetLastError () returned 0x0 [0089.911] GetLastError () returned 0x0 [0089.913] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffefe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.913] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1018, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1018, lpOverlapped=0x0) returned 1 [0089.913] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.913] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.913] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.913] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.913] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.913] CloseHandle (hObject=0xe4) returned 1 [0089.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0089.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0089.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0089.916] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0089.916] GetLastError () returned 0x0 [0089.916] RtlWakeConditionVariable () returned 0x0 [0089.916] GetCurrentThreadId () returned 0x9ac [0089.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".ldf") returned 0x0 [0089.916] lstrlenW (lpString=".vhd") returned 4 [0089.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".vhd") returned 0x0 [0089.916] lstrlenW (lpString=".vhdx") returned 5 [0089.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".vhdx") returned 0x0 [0089.916] lstrlenW (lpString=".pst") returned 4 [0089.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".pst") returned 0x0 [0089.917] lstrlenW (lpString=".ost") returned 4 [0089.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".ost") returned 0x0 [0089.917] lstrlenW (lpString=".bak") returned 4 [0089.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".bak") returned 0x0 [0089.917] lstrlenW (lpString=".bac") returned 4 [0089.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".bac") returned 0x0 [0089.917] lstrlenW (lpString=".sys") returned 4 [0089.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".sys") returned 0x0 [0089.917] lstrlenW (lpString=".v2i") returned 4 [0089.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".v2i") returned 0x0 [0089.917] lstrlenW (lpString="s\r\n.v2i") returned 7 [0089.917] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch="s\r\n.v2i") returned 0x0 [0089.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.918] lstrlenW (lpString=".sql") returned 4 [0089.918] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".sql") returned 0x0 [0089.919] lstrlenW (lpString=".mdf") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".mdf") returned 0x0 [0089.919] lstrlenW (lpString=".txt") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".txt") returned 0x0 [0089.919] lstrlenW (lpString=".dbf") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".dbf") returned 0x0 [0089.919] lstrlenW (lpString=".ckp") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".ckp") returned 0x0 [0089.919] lstrlenW (lpString=".dacpac") returned 7 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".dacpac") returned 0x0 [0089.919] lstrlenW (lpString=".db3") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".db3") returned 0x0 [0089.919] lstrlenW (lpString=".dtxs") returned 5 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".dtxs") returned 0x0 [0089.919] lstrlenW (lpString=".mdt") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".mdt") returned 0x0 [0089.919] lstrlenW (lpString=".sdf") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".sdf") returned 0x0 [0089.919] lstrlenW (lpString=".MDF") returned 4 [0089.919] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".MDF") returned 0x0 [0089.919] lstrlenW (lpString=".DBF") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".DBF") returned 0x0 [0089.920] lstrlenW (lpString=".DB") returned 3 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".DB") returned 0x0 [0089.920] lstrlenW (lpString=".db") returned 3 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".db") returned 0x0 [0089.920] lstrlenW (lpString=".ndf") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".ndf") returned 0x0 [0089.920] lstrlenW (lpString=".NDF") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".NDF") returned 0x0 [0089.920] lstrlenW (lpString=".Mdf") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".Mdf") returned 0x0 [0089.920] lstrlenW (lpString=".dat") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".dat") returned 0x0 [0089.920] lstrlenW (lpString=".DAT") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".DAT") returned 0x0 [0089.920] lstrlenW (lpString=".ldf") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".ldf") returned 0x0 [0089.920] lstrlenW (lpString=".LDF") returned 4 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch=".LDF") returned 0x0 [0089.920] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0089.920] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0089.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0089.920] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0089.920] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0089.921] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0089.921] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0089.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0089.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0089.921] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0089.921] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=20992253183) returned 1 [0089.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc469a110, dwHighDateTime=0x1d585b4)) [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2f0380 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0089.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0380 | out: hHeap=0x260000) returned 1 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0089.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0089.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0089.931] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0089.931] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0089.931] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0089.931] GetLastError () returned 0x0 [0089.932] GetLastError () returned 0x0 [0089.932] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0089.932] GetLastError () returned 0x0 [0089.932] GetLastError () returned 0x0 [0089.934] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffca1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.934] WriteFile (in: hFile=0xe4, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x35f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x35f, lpOverlapped=0x0) returned 1 [0089.934] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0089.934] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.934] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0089.934] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0089.934] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0089.934] CloseHandle (hObject=0xe4) returned 1 [0089.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0089.935] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.022] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.022] GetLastError () returned 0x0 [0090.022] RtlWakeConditionVariable () returned 0x0 [0090.022] GetCurrentThreadId () returned 0x9ac [0090.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0090.022] lstrlenW (lpString=".vhd") returned 4 [0090.022] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".vhd") returned 0x0 [0090.022] lstrlenW (lpString=".vhdx") returned 5 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".vhdx") returned 0x0 [0090.023] lstrlenW (lpString=".pst") returned 4 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".pst") returned 0x0 [0090.023] lstrlenW (lpString=".ost") returned 4 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".ost") returned 0x0 [0090.023] lstrlenW (lpString=".bak") returned 4 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".bak") returned 0x0 [0090.023] lstrlenW (lpString=".bac") returned 4 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".bac") returned 0x0 [0090.023] lstrlenW (lpString=".sys") returned 4 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".sys") returned 0x0 [0090.023] lstrlenW (lpString=".v2i") returned 4 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".v2i") returned 0x0 [0090.023] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.023] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0090.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.024] lstrlenW (lpString=".sql") returned 4 [0090.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".sql") returned 0x0 [0090.024] lstrlenW (lpString=".mdf") returned 4 [0090.024] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".mdf") returned 0x0 [0090.025] lstrlenW (lpString=".txt") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".txt") returned 0x0 [0090.025] lstrlenW (lpString=".dbf") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".dbf") returned 0x0 [0090.025] lstrlenW (lpString=".ckp") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".ckp") returned 0x0 [0090.025] lstrlenW (lpString=".dacpac") returned 7 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".dacpac") returned 0x0 [0090.025] lstrlenW (lpString=".db3") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".db3") returned 0x0 [0090.025] lstrlenW (lpString=".dtxs") returned 5 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".dtxs") returned 0x0 [0090.025] lstrlenW (lpString=".mdt") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".mdt") returned 0x0 [0090.025] lstrlenW (lpString=".sdf") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".sdf") returned 0x0 [0090.025] lstrlenW (lpString=".MDF") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".MDF") returned 0x0 [0090.025] lstrlenW (lpString=".DBF") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".DBF") returned 0x0 [0090.025] lstrlenW (lpString=".DB") returned 3 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".DB") returned 0x0 [0090.025] lstrlenW (lpString=".db") returned 3 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".db") returned 0x0 [0090.025] lstrlenW (lpString=".ndf") returned 4 [0090.025] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".ndf") returned 0x0 [0090.026] lstrlenW (lpString=".NDF") returned 4 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".NDF") returned 0x0 [0090.026] lstrlenW (lpString=".Mdf") returned 4 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".Mdf") returned 0x0 [0090.026] lstrlenW (lpString=".dat") returned 4 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".dat") returned 0x0 [0090.026] lstrlenW (lpString=".DAT") returned 4 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".DAT") returned 0x0 [0090.026] lstrlenW (lpString=".ldf") returned 4 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0090.026] lstrlenW (lpString=".LDF") returned 4 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch=".LDF") returned 0x0 [0090.026] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.026] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.027] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.027] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.027] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21002824756) returned 1 [0090.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc477e950, dwHighDateTime=0x1d585b4)) [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b43d8 [0090.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b43d8 | out: hHeap=0x260000) returned 1 [0090.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.028] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.116] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.126] GetLastError () returned 0x0 [0090.126] GetLastError () returned 0x0 [0090.126] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.126] GetLastError () returned 0x0 [0090.126] GetLastError () returned 0x0 [0090.142] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffff91a9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.142] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x6e57, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6e57, lpOverlapped=0x0) returned 1 [0090.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.142] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.142] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.142] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.142] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.142] CloseHandle (hObject=0xe4) returned 1 [0090.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0090.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.144] GetLastError () returned 0x0 [0090.144] RtlWakeConditionVariable () returned 0x0 [0090.144] GetCurrentThreadId () returned 0x9ac [0090.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".ldf") returned 0x0 [0090.144] lstrlenW (lpString=".vhd") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".vhd") returned 0x0 [0090.145] lstrlenW (lpString=".vhdx") returned 5 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".vhdx") returned 0x0 [0090.145] lstrlenW (lpString=".pst") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".pst") returned 0x0 [0090.145] lstrlenW (lpString=".ost") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".ost") returned 0x0 [0090.145] lstrlenW (lpString=".bak") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".bak") returned 0x0 [0090.145] lstrlenW (lpString=".bac") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".bac") returned 0x0 [0090.145] lstrlenW (lpString=".sys") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".sys") returned 0x0 [0090.145] lstrlenW (lpString=".v2i") returned 4 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".v2i") returned 0x0 [0090.145] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.146] lstrlenW (lpString=".sql") returned 4 [0090.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".sql") returned 0x0 [0090.146] lstrlenW (lpString=".mdf") returned 4 [0090.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".mdf") returned 0x0 [0090.146] lstrlenW (lpString=".txt") returned 4 [0090.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".txt") returned 0x0 [0090.146] lstrlenW (lpString=".dbf") returned 4 [0090.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".dbf") returned 0x0 [0090.147] lstrlenW (lpString=".ckp") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".ckp") returned 0x0 [0090.147] lstrlenW (lpString=".dacpac") returned 7 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".dacpac") returned 0x0 [0090.147] lstrlenW (lpString=".db3") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".db3") returned 0x0 [0090.147] lstrlenW (lpString=".dtxs") returned 5 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".dtxs") returned 0x0 [0090.147] lstrlenW (lpString=".mdt") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".mdt") returned 0x0 [0090.147] lstrlenW (lpString=".sdf") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".sdf") returned 0x0 [0090.147] lstrlenW (lpString=".MDF") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".MDF") returned 0x0 [0090.147] lstrlenW (lpString=".DBF") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".DBF") returned 0x0 [0090.147] lstrlenW (lpString=".DB") returned 3 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".DB") returned 0x0 [0090.147] lstrlenW (lpString=".db") returned 3 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".db") returned 0x0 [0090.147] lstrlenW (lpString=".ndf") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".ndf") returned 0x0 [0090.147] lstrlenW (lpString=".NDF") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".NDF") returned 0x0 [0090.147] lstrlenW (lpString=".Mdf") returned 4 [0090.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".Mdf") returned 0x0 [0090.148] lstrlenW (lpString=".dat") returned 4 [0090.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".dat") returned 0x0 [0090.148] lstrlenW (lpString=".DAT") returned 4 [0090.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".DAT") returned 0x0 [0090.148] lstrlenW (lpString=".ldf") returned 4 [0090.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".ldf") returned 0x0 [0090.148] lstrlenW (lpString=".LDF") returned 4 [0090.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch=".LDF") returned 0x0 [0090.148] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.148] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.148] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.149] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.149] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.149] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21015011938) returned 1 [0090.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc48af450, dwHighDateTime=0x1d585b4)) [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b46b0 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b46b0 | out: hHeap=0x260000) returned 1 [0090.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.150] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.150] GetLastError () returned 0x0 [0090.150] GetLastError () returned 0x0 [0090.150] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.150] GetLastError () returned 0x0 [0090.150] GetLastError () returned 0x0 [0090.172] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffecd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.172] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x132a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x132a, lpOverlapped=0x0) returned 1 [0090.172] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.173] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.173] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.173] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.173] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.173] CloseHandle (hObject=0xe4) returned 1 [0090.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x313338 [0090.173] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x313338 | out: hHeap=0x260000) returned 1 [0090.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.174] GetLastError () returned 0x0 [0090.175] RtlWakeConditionVariable () returned 0x0 [0090.175] GetCurrentThreadId () returned 0x9ac [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".ldf") returned 0x0 [0090.175] lstrlenW (lpString=".vhd") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".vhd") returned 0x0 [0090.175] lstrlenW (lpString=".vhdx") returned 5 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".vhdx") returned 0x0 [0090.175] lstrlenW (lpString=".pst") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".pst") returned 0x0 [0090.175] lstrlenW (lpString=".ost") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".ost") returned 0x0 [0090.175] lstrlenW (lpString=".bak") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".bak") returned 0x0 [0090.175] lstrlenW (lpString=".bac") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".bac") returned 0x0 [0090.175] lstrlenW (lpString=".sys") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".sys") returned 0x0 [0090.175] lstrlenW (lpString=".v2i") returned 4 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".v2i") returned 0x0 [0090.175] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.176] lstrlenW (lpString=".sql") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".sql") returned 0x0 [0090.177] lstrlenW (lpString=".mdf") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".mdf") returned 0x0 [0090.177] lstrlenW (lpString=".txt") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".txt") returned 0x0 [0090.177] lstrlenW (lpString=".dbf") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".dbf") returned 0x0 [0090.177] lstrlenW (lpString=".ckp") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".ckp") returned 0x0 [0090.177] lstrlenW (lpString=".dacpac") returned 7 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".dacpac") returned 0x0 [0090.177] lstrlenW (lpString=".db3") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".db3") returned 0x0 [0090.177] lstrlenW (lpString=".dtxs") returned 5 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".dtxs") returned 0x0 [0090.177] lstrlenW (lpString=".mdt") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".mdt") returned 0x0 [0090.177] lstrlenW (lpString=".sdf") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".sdf") returned 0x0 [0090.177] lstrlenW (lpString=".MDF") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".MDF") returned 0x0 [0090.177] lstrlenW (lpString=".DBF") returned 4 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".DBF") returned 0x0 [0090.177] lstrlenW (lpString=".DB") returned 3 [0090.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".DB") returned 0x0 [0090.178] lstrlenW (lpString=".db") returned 3 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".db") returned 0x0 [0090.178] lstrlenW (lpString=".ndf") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".ndf") returned 0x0 [0090.178] lstrlenW (lpString=".NDF") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".NDF") returned 0x0 [0090.178] lstrlenW (lpString=".Mdf") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".Mdf") returned 0x0 [0090.178] lstrlenW (lpString=".dat") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".dat") returned 0x0 [0090.178] lstrlenW (lpString=".DAT") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".DAT") returned 0x0 [0090.178] lstrlenW (lpString=".ldf") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".ldf") returned 0x0 [0090.178] lstrlenW (lpString=".LDF") returned 4 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch=".LDF") returned 0x0 [0090.178] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.178] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.179] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.179] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.179] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21018047715) returned 1 [0090.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc48fb710, dwHighDateTime=0x1d585b4)) [0090.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4758 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4758 | out: hHeap=0x260000) returned 1 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.180] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.180] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.180] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.180] GetLastError () returned 0x0 [0090.181] GetLastError () returned 0x0 [0090.181] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.181] GetLastError () returned 0x0 [0090.181] GetLastError () returned 0x0 [0090.206] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffbf1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.207] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x40f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x40f, lpOverlapped=0x0) returned 1 [0090.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.207] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.207] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.207] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.207] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.208] CloseHandle (hObject=0xe4) returned 1 [0090.208] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.211] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.211] GetLastError () returned 0x0 [0090.211] RtlWakeConditionVariable () returned 0x0 [0090.211] GetCurrentThreadId () returned 0x9ac [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".ldf") returned 0x0 [0090.212] lstrlenW (lpString=".vhd") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".vhd") returned 0x0 [0090.212] lstrlenW (lpString=".vhdx") returned 5 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".vhdx") returned 0x0 [0090.212] lstrlenW (lpString=".pst") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".pst") returned 0x0 [0090.212] lstrlenW (lpString=".ost") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".ost") returned 0x0 [0090.212] lstrlenW (lpString=".bak") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".bak") returned 0x0 [0090.212] lstrlenW (lpString=".bac") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".bac") returned 0x0 [0090.212] lstrlenW (lpString=".sys") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".sys") returned 0x0 [0090.212] lstrlenW (lpString=".v2i") returned 4 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".v2i") returned 0x0 [0090.212] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.214] lstrlenW (lpString=".sql") returned 4 [0090.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".sql") returned 0x0 [0090.214] lstrlenW (lpString=".mdf") returned 4 [0090.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".mdf") returned 0x0 [0090.214] lstrlenW (lpString=".txt") returned 4 [0090.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".txt") returned 0x0 [0090.215] lstrlenW (lpString=".dbf") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".dbf") returned 0x0 [0090.215] lstrlenW (lpString=".ckp") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".ckp") returned 0x0 [0090.215] lstrlenW (lpString=".dacpac") returned 7 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".dacpac") returned 0x0 [0090.215] lstrlenW (lpString=".db3") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".db3") returned 0x0 [0090.215] lstrlenW (lpString=".dtxs") returned 5 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".dtxs") returned 0x0 [0090.215] lstrlenW (lpString=".mdt") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".mdt") returned 0x0 [0090.215] lstrlenW (lpString=".sdf") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".sdf") returned 0x0 [0090.215] lstrlenW (lpString=".MDF") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".MDF") returned 0x0 [0090.215] lstrlenW (lpString=".DBF") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".DBF") returned 0x0 [0090.215] lstrlenW (lpString=".DB") returned 3 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".DB") returned 0x0 [0090.215] lstrlenW (lpString=".db") returned 3 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".db") returned 0x0 [0090.215] lstrlenW (lpString=".ndf") returned 4 [0090.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".ndf") returned 0x0 [0090.215] lstrlenW (lpString=".NDF") returned 4 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".NDF") returned 0x0 [0090.216] lstrlenW (lpString=".Mdf") returned 4 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".Mdf") returned 0x0 [0090.216] lstrlenW (lpString=".dat") returned 4 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".dat") returned 0x0 [0090.216] lstrlenW (lpString=".DAT") returned 4 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".DAT") returned 0x0 [0090.216] lstrlenW (lpString=".ldf") returned 4 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".ldf") returned 0x0 [0090.216] lstrlenW (lpString=".LDF") returned 4 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch=".LDF") returned 0x0 [0090.216] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.216] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.217] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.217] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21021827135) returned 1 [0090.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc496db30, dwHighDateTime=0x1d585b4)) [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4800 [0090.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4800 | out: hHeap=0x260000) returned 1 [0090.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.218] GetLastError () returned 0x0 [0090.218] GetLastError () returned 0x0 [0090.218] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.218] GetLastError () returned 0x0 [0090.219] GetLastError () returned 0x0 [0090.373] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffde5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.373] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x21a6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x21a6, lpOverlapped=0x0) returned 1 [0090.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.373] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.373] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.373] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.373] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.374] CloseHandle (hObject=0xe4) returned 1 [0090.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.446] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.447] GetLastError () returned 0x0 [0090.447] RtlWakeConditionVariable () returned 0x0 [0090.447] GetCurrentThreadId () returned 0x9ac [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".ldf") returned 0x0 [0090.447] lstrlenW (lpString=".vhd") returned 4 [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".vhd") returned 0x0 [0090.447] lstrlenW (lpString=".vhdx") returned 5 [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".vhdx") returned 0x0 [0090.447] lstrlenW (lpString=".pst") returned 4 [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".pst") returned 0x0 [0090.447] lstrlenW (lpString=".ost") returned 4 [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".ost") returned 0x0 [0090.447] lstrlenW (lpString=".bak") returned 4 [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".bak") returned 0x0 [0090.447] lstrlenW (lpString=".bac") returned 4 [0090.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".bac") returned 0x0 [0090.447] lstrlenW (lpString=".sys") returned 4 [0090.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".sys") returned 0x0 [0090.448] lstrlenW (lpString=".v2i") returned 4 [0090.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".v2i") returned 0x0 [0090.448] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch="s\r\n.v2i") returned 0x0 [0090.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.449] lstrlenW (lpString=".sql") returned 4 [0090.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".sql") returned 0x0 [0090.449] lstrlenW (lpString=".mdf") returned 4 [0090.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".mdf") returned 0x0 [0090.449] lstrlenW (lpString=".txt") returned 4 [0090.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".txt") returned 0x0 [0090.449] lstrlenW (lpString=".dbf") returned 4 [0090.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".dbf") returned 0x0 [0090.449] lstrlenW (lpString=".ckp") returned 4 [0090.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".ckp") returned 0x0 [0090.449] lstrlenW (lpString=".dacpac") returned 7 [0090.449] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".dacpac") returned 0x0 [0090.449] lstrlenW (lpString=".db3") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".db3") returned 0x0 [0090.450] lstrlenW (lpString=".dtxs") returned 5 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".dtxs") returned 0x0 [0090.450] lstrlenW (lpString=".mdt") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".mdt") returned 0x0 [0090.450] lstrlenW (lpString=".sdf") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".sdf") returned 0x0 [0090.450] lstrlenW (lpString=".MDF") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".MDF") returned 0x0 [0090.450] lstrlenW (lpString=".DBF") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".DBF") returned 0x0 [0090.450] lstrlenW (lpString=".DB") returned 3 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".DB") returned 0x0 [0090.450] lstrlenW (lpString=".db") returned 3 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".db") returned 0x0 [0090.450] lstrlenW (lpString=".ndf") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".ndf") returned 0x0 [0090.450] lstrlenW (lpString=".NDF") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".NDF") returned 0x0 [0090.450] lstrlenW (lpString=".Mdf") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".Mdf") returned 0x0 [0090.450] lstrlenW (lpString=".dat") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".dat") returned 0x0 [0090.450] lstrlenW (lpString=".DAT") returned 4 [0090.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".DAT") returned 0x0 [0090.450] lstrlenW (lpString=".ldf") returned 4 [0090.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".ldf") returned 0x0 [0090.451] lstrlenW (lpString=".LDF") returned 4 [0090.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch=".LDF") returned 0x0 [0090.451] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.451] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.451] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.452] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.452] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.452] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21045291373) returned 1 [0090.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4ba8fd0, dwHighDateTime=0x1d585b4)) [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4c98 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4c98 | out: hHeap=0x260000) returned 1 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.452] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.452] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.453] GetLastError () returned 0x0 [0090.453] GetLastError () returned 0x0 [0090.453] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.453] GetLastError () returned 0x0 [0090.453] GetLastError () returned 0x0 [0090.456] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff264, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.456] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd9c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd9c, lpOverlapped=0x0) returned 1 [0090.456] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.456] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.456] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.457] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.457] CloseHandle (hObject=0xe4) returned 1 [0090.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.[deadmin@cock.li].deadmin")) returned 1 [0090.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.458] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.458] GetLastError () returned 0x0 [0090.458] RtlWakeConditionVariable () returned 0x0 [0090.459] GetCurrentThreadId () returned 0x9ac [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".ldf") returned 0x0 [0090.459] lstrlenW (lpString=".vhd") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".vhd") returned 0x0 [0090.459] lstrlenW (lpString=".vhdx") returned 5 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".vhdx") returned 0x0 [0090.459] lstrlenW (lpString=".pst") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".pst") returned 0x0 [0090.459] lstrlenW (lpString=".ost") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".ost") returned 0x0 [0090.459] lstrlenW (lpString=".bak") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".bak") returned 0x0 [0090.459] lstrlenW (lpString=".bac") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".bac") returned 0x0 [0090.459] lstrlenW (lpString=".sys") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".sys") returned 0x0 [0090.459] lstrlenW (lpString=".v2i") returned 4 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".v2i") returned 0x0 [0090.459] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch="s\r\n.v2i") returned 0x0 [0090.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.460] lstrlenW (lpString=".sql") returned 4 [0090.460] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".sql") returned 0x0 [0090.461] lstrlenW (lpString=".mdf") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".mdf") returned 0x0 [0090.461] lstrlenW (lpString=".txt") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".txt") returned 0x0 [0090.461] lstrlenW (lpString=".dbf") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".dbf") returned 0x0 [0090.461] lstrlenW (lpString=".ckp") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".ckp") returned 0x0 [0090.461] lstrlenW (lpString=".dacpac") returned 7 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".dacpac") returned 0x0 [0090.461] lstrlenW (lpString=".db3") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".db3") returned 0x0 [0090.461] lstrlenW (lpString=".dtxs") returned 5 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".dtxs") returned 0x0 [0090.461] lstrlenW (lpString=".mdt") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".mdt") returned 0x0 [0090.461] lstrlenW (lpString=".sdf") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".sdf") returned 0x0 [0090.461] lstrlenW (lpString=".MDF") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".MDF") returned 0x0 [0090.461] lstrlenW (lpString=".DBF") returned 4 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".DBF") returned 0x0 [0090.461] lstrlenW (lpString=".DB") returned 3 [0090.461] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".DB") returned 0x0 [0090.461] lstrlenW (lpString=".db") returned 3 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".db") returned 0x0 [0090.462] lstrlenW (lpString=".ndf") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".ndf") returned 0x0 [0090.462] lstrlenW (lpString=".NDF") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".NDF") returned 0x0 [0090.462] lstrlenW (lpString=".Mdf") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".Mdf") returned 0x0 [0090.462] lstrlenW (lpString=".dat") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".dat") returned 0x0 [0090.462] lstrlenW (lpString=".DAT") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".DAT") returned 0x0 [0090.462] lstrlenW (lpString=".ldf") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".ldf") returned 0x0 [0090.462] lstrlenW (lpString=".LDF") returned 4 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch=".LDF") returned 0x0 [0090.462] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.462] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.462] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.463] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.463] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.463] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.463] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21046439536) returned 1 [0090.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4ba8fd0, dwHighDateTime=0x1d585b4)) [0090.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4cd0 [0090.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4cd0 | out: hHeap=0x260000) returned 1 [0090.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.464] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.464] GetLastError () returned 0x0 [0090.464] GetLastError () returned 0x0 [0090.464] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.465] GetLastError () returned 0x0 [0090.465] GetLastError () returned 0x0 [0090.466] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xffffe179, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.466] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x1e87, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1e87, lpOverlapped=0x0) returned 1 [0090.467] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.467] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.467] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.467] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.467] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.467] CloseHandle (hObject=0xe4) returned 1 [0090.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js.[deadmin@cock.li].deadmin")) returned 1 [0090.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.469] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.469] GetLastError () returned 0x0 [0090.469] RtlWakeConditionVariable () returned 0x0 [0090.469] GetCurrentThreadId () returned 0x9ac [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".ldf") returned 0x0 [0090.469] lstrlenW (lpString=".vhd") returned 4 [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".vhd") returned 0x0 [0090.469] lstrlenW (lpString=".vhdx") returned 5 [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".vhdx") returned 0x0 [0090.469] lstrlenW (lpString=".pst") returned 4 [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".pst") returned 0x0 [0090.469] lstrlenW (lpString=".ost") returned 4 [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".ost") returned 0x0 [0090.469] lstrlenW (lpString=".bak") returned 4 [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".bak") returned 0x0 [0090.469] lstrlenW (lpString=".bac") returned 4 [0090.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".bac") returned 0x0 [0090.470] lstrlenW (lpString=".sys") returned 4 [0090.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".sys") returned 0x0 [0090.470] lstrlenW (lpString=".v2i") returned 4 [0090.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".v2i") returned 0x0 [0090.470] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.471] lstrlenW (lpString=".sql") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".sql") returned 0x0 [0090.471] lstrlenW (lpString=".mdf") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".mdf") returned 0x0 [0090.471] lstrlenW (lpString=".txt") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".txt") returned 0x0 [0090.471] lstrlenW (lpString=".dbf") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".dbf") returned 0x0 [0090.471] lstrlenW (lpString=".ckp") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".ckp") returned 0x0 [0090.471] lstrlenW (lpString=".dacpac") returned 7 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".dacpac") returned 0x0 [0090.471] lstrlenW (lpString=".db3") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".db3") returned 0x0 [0090.471] lstrlenW (lpString=".dtxs") returned 5 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".dtxs") returned 0x0 [0090.471] lstrlenW (lpString=".mdt") returned 4 [0090.471] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".mdt") returned 0x0 [0090.472] lstrlenW (lpString=".sdf") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".sdf") returned 0x0 [0090.472] lstrlenW (lpString=".MDF") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".MDF") returned 0x0 [0090.472] lstrlenW (lpString=".DBF") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".DBF") returned 0x0 [0090.472] lstrlenW (lpString=".DB") returned 3 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".DB") returned 0x0 [0090.472] lstrlenW (lpString=".db") returned 3 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".db") returned 0x0 [0090.472] lstrlenW (lpString=".ndf") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".ndf") returned 0x0 [0090.472] lstrlenW (lpString=".NDF") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".NDF") returned 0x0 [0090.472] lstrlenW (lpString=".Mdf") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".Mdf") returned 0x0 [0090.472] lstrlenW (lpString=".dat") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".dat") returned 0x0 [0090.472] lstrlenW (lpString=".DAT") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".DAT") returned 0x0 [0090.472] lstrlenW (lpString=".ldf") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".ldf") returned 0x0 [0090.472] lstrlenW (lpString=".LDF") returned 4 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch=".LDF") returned 0x0 [0090.472] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.472] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.473] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.473] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.473] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.473] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.474] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21047473300) returned 1 [0090.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4bcf130, dwHighDateTime=0x1d585b4)) [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4d08 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4d08 | out: hHeap=0x260000) returned 1 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.474] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.474] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.474] GetLastError () returned 0x0 [0090.475] GetLastError () returned 0x0 [0090.475] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.475] GetLastError () returned 0x0 [0090.475] GetLastError () returned 0x0 [0090.478] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffffcec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.478] WriteFile (in: hFile=0xe4, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x314, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x314, lpOverlapped=0x0) returned 1 [0090.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0090.478] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.478] WriteFile (in: hFile=0xe4, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.478] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.478] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.478] CloseHandle (hObject=0xe4) returned 1 [0090.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x291f980 [0090.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css.[deadmin@cock.li].deadmin")) returned 1 [0090.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291f980 | out: hHeap=0x260000) returned 1 [0090.480] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.480] GetLastError () returned 0x0 [0090.480] RtlWakeConditionVariable () returned 0x0 [0090.480] GetCurrentThreadId () returned 0x9ac [0090.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".ldf") returned 0x0 [0090.565] lstrlenW (lpString=".vhd") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".vhd") returned 0x0 [0090.565] lstrlenW (lpString=".vhdx") returned 5 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".vhdx") returned 0x0 [0090.565] lstrlenW (lpString=".pst") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".pst") returned 0x0 [0090.565] lstrlenW (lpString=".ost") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".ost") returned 0x0 [0090.565] lstrlenW (lpString=".bak") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".bak") returned 0x0 [0090.565] lstrlenW (lpString=".bac") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".bac") returned 0x0 [0090.565] lstrlenW (lpString=".sys") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".sys") returned 0x0 [0090.565] lstrlenW (lpString=".v2i") returned 4 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".v2i") returned 0x0 [0090.565] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.567] lstrlenW (lpString=".sql") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".sql") returned 0x0 [0090.567] lstrlenW (lpString=".mdf") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".mdf") returned 0x0 [0090.567] lstrlenW (lpString=".txt") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".txt") returned 0x0 [0090.567] lstrlenW (lpString=".dbf") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".dbf") returned 0x0 [0090.567] lstrlenW (lpString=".ckp") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".ckp") returned 0x0 [0090.567] lstrlenW (lpString=".dacpac") returned 7 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".dacpac") returned 0x0 [0090.567] lstrlenW (lpString=".db3") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".db3") returned 0x0 [0090.567] lstrlenW (lpString=".dtxs") returned 5 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".dtxs") returned 0x0 [0090.567] lstrlenW (lpString=".mdt") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".mdt") returned 0x0 [0090.567] lstrlenW (lpString=".sdf") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".sdf") returned 0x0 [0090.567] lstrlenW (lpString=".MDF") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".MDF") returned 0x0 [0090.567] lstrlenW (lpString=".DBF") returned 4 [0090.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".DBF") returned 0x0 [0090.567] lstrlenW (lpString=".DB") returned 3 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".DB") returned 0x0 [0090.568] lstrlenW (lpString=".db") returned 3 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".db") returned 0x0 [0090.568] lstrlenW (lpString=".ndf") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".ndf") returned 0x0 [0090.568] lstrlenW (lpString=".NDF") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".NDF") returned 0x0 [0090.568] lstrlenW (lpString=".Mdf") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".Mdf") returned 0x0 [0090.568] lstrlenW (lpString=".dat") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".dat") returned 0x0 [0090.568] lstrlenW (lpString=".DAT") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".DAT") returned 0x0 [0090.568] lstrlenW (lpString=".ldf") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".ldf") returned 0x0 [0090.568] lstrlenW (lpString=".LDF") returned 4 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch=".LDF") returned 0x0 [0090.568] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.568] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.568] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.568] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.569] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.569] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.569] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.569] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21057045313) returned 1 [0090.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4cb3970, dwHighDateTime=0x1d585b4)) [0090.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4f00 [0090.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4f00 | out: hHeap=0x260000) returned 1 [0090.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.570] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.570] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.570] GetLastError () returned 0x0 [0090.570] GetLastError () returned 0x0 [0090.571] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.571] GetLastError () returned 0x0 [0090.571] GetLastError () returned 0x0 [0090.573] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff210, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.573] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xdf0, lpOverlapped=0x0) returned 1 [0090.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.573] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.573] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.573] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.573] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.573] CloseHandle (hObject=0x11c) returned 1 [0090.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0090.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css.[deadmin@cock.li].deadmin")) returned 1 [0090.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0090.575] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.575] GetLastError () returned 0x0 [0090.576] RtlWakeConditionVariable () returned 0x0 [0090.576] GetCurrentThreadId () returned 0x9ac [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0090.576] lstrlenW (lpString=".vhd") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".vhd") returned 0x0 [0090.576] lstrlenW (lpString=".vhdx") returned 5 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".vhdx") returned 0x0 [0090.576] lstrlenW (lpString=".pst") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".pst") returned 0x0 [0090.576] lstrlenW (lpString=".ost") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ost") returned 0x0 [0090.576] lstrlenW (lpString=".bak") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".bak") returned 0x0 [0090.576] lstrlenW (lpString=".bac") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".bac") returned 0x0 [0090.576] lstrlenW (lpString=".sys") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".sys") returned 0x0 [0090.576] lstrlenW (lpString=".v2i") returned 4 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".v2i") returned 0x0 [0090.576] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.576] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.578] lstrlenW (lpString=".sql") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".sql") returned 0x0 [0090.578] lstrlenW (lpString=".mdf") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".mdf") returned 0x0 [0090.578] lstrlenW (lpString=".txt") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".txt") returned 0x0 [0090.578] lstrlenW (lpString=".dbf") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dbf") returned 0x0 [0090.578] lstrlenW (lpString=".ckp") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ckp") returned 0x0 [0090.578] lstrlenW (lpString=".dacpac") returned 7 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dacpac") returned 0x0 [0090.578] lstrlenW (lpString=".db3") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".db3") returned 0x0 [0090.578] lstrlenW (lpString=".dtxs") returned 5 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dtxs") returned 0x0 [0090.578] lstrlenW (lpString=".mdt") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".mdt") returned 0x0 [0090.578] lstrlenW (lpString=".sdf") returned 4 [0090.578] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".sdf") returned 0x0 [0090.579] lstrlenW (lpString=".MDF") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".MDF") returned 0x0 [0090.579] lstrlenW (lpString=".DBF") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".DBF") returned 0x0 [0090.579] lstrlenW (lpString=".DB") returned 3 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".DB") returned 0x0 [0090.579] lstrlenW (lpString=".db") returned 3 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".db") returned 0x0 [0090.579] lstrlenW (lpString=".ndf") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ndf") returned 0x0 [0090.579] lstrlenW (lpString=".NDF") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".NDF") returned 0x0 [0090.579] lstrlenW (lpString=".Mdf") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".Mdf") returned 0x0 [0090.579] lstrlenW (lpString=".dat") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".dat") returned 0x0 [0090.579] lstrlenW (lpString=".DAT") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".DAT") returned 0x0 [0090.579] lstrlenW (lpString=".ldf") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0090.579] lstrlenW (lpString=".LDF") returned 4 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch=".LDF") returned 0x0 [0090.579] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.580] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.580] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.580] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.580] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.580] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.581] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21058167463) returned 1 [0090.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4cd9ad0, dwHighDateTime=0x1d585b4)) [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4f38 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4f38 | out: hHeap=0x260000) returned 1 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.581] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.581] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.581] GetLastError () returned 0x0 [0090.582] GetLastError () returned 0x0 [0090.582] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.582] GetLastError () returned 0x0 [0090.582] GetLastError () returned 0x0 [0090.583] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.583] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb9, lpOverlapped=0x0) returned 1 [0090.583] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.583] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.583] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.583] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.583] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.584] CloseHandle (hObject=0x11c) returned 1 [0090.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0090.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.586] GetLastError () returned 0x0 [0090.586] RtlWakeConditionVariable () returned 0x0 [0090.586] GetCurrentThreadId () returned 0x9ac [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.587] lstrlenW (lpString=".vhd") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".vhd") returned 0x0 [0090.587] lstrlenW (lpString=".vhdx") returned 5 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".vhdx") returned 0x0 [0090.587] lstrlenW (lpString=".pst") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".pst") returned 0x0 [0090.587] lstrlenW (lpString=".ost") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ost") returned 0x0 [0090.587] lstrlenW (lpString=".bak") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".bak") returned 0x0 [0090.587] lstrlenW (lpString=".bac") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".bac") returned 0x0 [0090.587] lstrlenW (lpString=".sys") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".sys") returned 0x0 [0090.587] lstrlenW (lpString=".v2i") returned 4 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".v2i") returned 0x0 [0090.587] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.588] lstrlenW (lpString=".sql") returned 4 [0090.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".sql") returned 0x0 [0090.588] lstrlenW (lpString=".mdf") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".mdf") returned 0x0 [0090.589] lstrlenW (lpString=".txt") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".txt") returned 0x0 [0090.589] lstrlenW (lpString=".dbf") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dbf") returned 0x0 [0090.589] lstrlenW (lpString=".ckp") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ckp") returned 0x0 [0090.589] lstrlenW (lpString=".dacpac") returned 7 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dacpac") returned 0x0 [0090.589] lstrlenW (lpString=".db3") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".db3") returned 0x0 [0090.589] lstrlenW (lpString=".dtxs") returned 5 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dtxs") returned 0x0 [0090.589] lstrlenW (lpString=".mdt") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".mdt") returned 0x0 [0090.589] lstrlenW (lpString=".sdf") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".sdf") returned 0x0 [0090.589] lstrlenW (lpString=".MDF") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".MDF") returned 0x0 [0090.589] lstrlenW (lpString=".DBF") returned 4 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".DBF") returned 0x0 [0090.589] lstrlenW (lpString=".DB") returned 3 [0090.589] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".DB") returned 0x0 [0090.589] lstrlenW (lpString=".db") returned 3 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".db") returned 0x0 [0090.590] lstrlenW (lpString=".ndf") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ndf") returned 0x0 [0090.590] lstrlenW (lpString=".NDF") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".NDF") returned 0x0 [0090.590] lstrlenW (lpString=".Mdf") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".Mdf") returned 0x0 [0090.590] lstrlenW (lpString=".dat") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".dat") returned 0x0 [0090.590] lstrlenW (lpString=".DAT") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".DAT") returned 0x0 [0090.590] lstrlenW (lpString=".ldf") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".ldf") returned 0x0 [0090.590] lstrlenW (lpString=".LDF") returned 4 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch=".LDF") returned 0x0 [0090.590] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.590] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.590] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.591] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.591] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.591] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0090.591] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21059236169) returned 1 [0090.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4cffc30, dwHighDateTime=0x1d585b4)) [0090.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.591] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b4f70 [0090.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4f70 | out: hHeap=0x260000) returned 1 [0090.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.592] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.592] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.592] GetLastError () returned 0x0 [0090.592] GetLastError () returned 0x0 [0090.592] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.592] GetLastError () returned 0x0 [0090.593] GetLastError () returned 0x0 [0090.594] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.594] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xff, lpOverlapped=0x0) returned 1 [0090.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.594] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.594] WriteFile (in: hFile=0x11c, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.594] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.594] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.594] CloseHandle (hObject=0x11c) returned 1 [0090.594] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29226b0 | out: hHeap=0x260000) returned 1 [0090.597] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.598] GetLastError () returned 0x0 [0090.598] RtlWakeConditionVariable () returned 0x0 [0090.598] GetCurrentThreadId () returned 0x9ac [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.598] lstrlenW (lpString=".vhd") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.598] lstrlenW (lpString=".vhdx") returned 5 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.598] lstrlenW (lpString=".pst") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.598] lstrlenW (lpString=".ost") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.598] lstrlenW (lpString=".bak") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.598] lstrlenW (lpString=".bac") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.598] lstrlenW (lpString=".sys") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.598] lstrlenW (lpString=".v2i") returned 4 [0090.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.598] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.599] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.653] lstrlenW (lpString=".sql") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.653] lstrlenW (lpString=".mdf") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.653] lstrlenW (lpString=".txt") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.653] lstrlenW (lpString=".dbf") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.653] lstrlenW (lpString=".ckp") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.653] lstrlenW (lpString=".dacpac") returned 7 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.653] lstrlenW (lpString=".db3") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.653] lstrlenW (lpString=".dtxs") returned 5 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.653] lstrlenW (lpString=".mdt") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.653] lstrlenW (lpString=".sdf") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.653] lstrlenW (lpString=".MDF") returned 4 [0090.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.653] lstrlenW (lpString=".DBF") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.654] lstrlenW (lpString=".DB") returned 3 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.654] lstrlenW (lpString=".db") returned 3 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.654] lstrlenW (lpString=".ndf") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.654] lstrlenW (lpString=".NDF") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.654] lstrlenW (lpString=".Mdf") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.654] lstrlenW (lpString=".dat") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.654] lstrlenW (lpString=".DAT") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.654] lstrlenW (lpString=".ldf") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.654] lstrlenW (lpString=".LDF") returned 4 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.654] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.654] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.655] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.655] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21065652543) returned 1 [0090.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4d981b0, dwHighDateTime=0x1d585b4)) [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5130 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5130 | out: hHeap=0x260000) returned 1 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.656] GetLastError () returned 0x0 [0090.656] GetLastError () returned 0x0 [0090.657] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.657] GetLastError () returned 0x0 [0090.657] GetLastError () returned 0x0 [0090.658] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.658] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0090.658] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.658] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.658] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.658] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.658] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.659] CloseHandle (hObject=0x11c) returned 1 [0090.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0090.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0090.660] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.660] GetLastError () returned 0x0 [0090.660] RtlWakeConditionVariable () returned 0x0 [0090.660] GetCurrentThreadId () returned 0x9ac [0090.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ldf") returned 0x0 [0090.660] lstrlenW (lpString=".vhd") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".vhd") returned 0x0 [0090.661] lstrlenW (lpString=".vhdx") returned 5 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".vhdx") returned 0x0 [0090.661] lstrlenW (lpString=".pst") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".pst") returned 0x0 [0090.661] lstrlenW (lpString=".ost") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ost") returned 0x0 [0090.661] lstrlenW (lpString=".bak") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".bak") returned 0x0 [0090.661] lstrlenW (lpString=".bac") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".bac") returned 0x0 [0090.661] lstrlenW (lpString=".sys") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".sys") returned 0x0 [0090.661] lstrlenW (lpString=".v2i") returned 4 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".v2i") returned 0x0 [0090.661] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.661] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0090.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0090.662] lstrlenW (lpString=".sql") returned 4 [0090.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".sql") returned 0x0 [0090.662] lstrlenW (lpString=".mdf") returned 4 [0090.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".mdf") returned 0x0 [0090.662] lstrlenW (lpString=".txt") returned 4 [0090.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".txt") returned 0x0 [0090.662] lstrlenW (lpString=".dbf") returned 4 [0090.662] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dbf") returned 0x0 [0090.662] lstrlenW (lpString=".ckp") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ckp") returned 0x0 [0090.663] lstrlenW (lpString=".dacpac") returned 7 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dacpac") returned 0x0 [0090.663] lstrlenW (lpString=".db3") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".db3") returned 0x0 [0090.663] lstrlenW (lpString=".dtxs") returned 5 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dtxs") returned 0x0 [0090.663] lstrlenW (lpString=".mdt") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".mdt") returned 0x0 [0090.663] lstrlenW (lpString=".sdf") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".sdf") returned 0x0 [0090.663] lstrlenW (lpString=".MDF") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".MDF") returned 0x0 [0090.663] lstrlenW (lpString=".DBF") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".DBF") returned 0x0 [0090.663] lstrlenW (lpString=".DB") returned 3 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".DB") returned 0x0 [0090.663] lstrlenW (lpString=".db") returned 3 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".db") returned 0x0 [0090.663] lstrlenW (lpString=".ndf") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ndf") returned 0x0 [0090.663] lstrlenW (lpString=".NDF") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".NDF") returned 0x0 [0090.663] lstrlenW (lpString=".Mdf") returned 4 [0090.663] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".Mdf") returned 0x0 [0090.664] lstrlenW (lpString=".dat") returned 4 [0090.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".dat") returned 0x0 [0090.664] lstrlenW (lpString=".DAT") returned 4 [0090.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".DAT") returned 0x0 [0090.664] lstrlenW (lpString=".ldf") returned 4 [0090.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".ldf") returned 0x0 [0090.664] lstrlenW (lpString=".LDF") returned 4 [0090.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch=".LDF") returned 0x0 [0090.664] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.664] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29221d0 [0090.664] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.664] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.665] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.665] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0090.665] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21066612263) returned 1 [0090.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4d981b0, dwHighDateTime=0x1d585b4)) [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5168 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5168 | out: hHeap=0x260000) returned 1 [0090.665] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.665] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.666] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.666] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.666] GetLastError () returned 0x0 [0090.666] GetLastError () returned 0x0 [0090.666] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.666] GetLastError () returned 0x0 [0090.666] GetLastError () returned 0x0 [0090.668] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffffebd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.669] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x143, lpOverlapped=0x0) returned 1 [0090.669] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0090.669] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.669] WriteFile (in: hFile=0x11c, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.669] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.669] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.669] CloseHandle (hObject=0x11c) returned 1 [0090.669] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x140) returned 0x27d070 [0090.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0090.833] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0090.834] GetLastError () returned 0x0 [0090.834] RtlWakeConditionVariable () returned 0x0 [0090.834] GetCurrentThreadId () returned 0x9ac [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.834] lstrlenW (lpString=".vhd") returned 4 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0090.834] lstrlenW (lpString=".vhdx") returned 5 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0090.834] lstrlenW (lpString=".pst") returned 4 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0090.834] lstrlenW (lpString=".ost") returned 4 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0090.834] lstrlenW (lpString=".bak") returned 4 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0090.834] lstrlenW (lpString=".bac") returned 4 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0090.834] lstrlenW (lpString=".sys") returned 4 [0090.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0090.835] lstrlenW (lpString=".v2i") returned 4 [0090.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0090.835] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0090.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.845] lstrlenW (lpString=".sql") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0090.845] lstrlenW (lpString=".mdf") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0090.845] lstrlenW (lpString=".txt") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0090.845] lstrlenW (lpString=".dbf") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0090.845] lstrlenW (lpString=".ckp") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0090.845] lstrlenW (lpString=".dacpac") returned 7 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0090.845] lstrlenW (lpString=".db3") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0090.845] lstrlenW (lpString=".dtxs") returned 5 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0090.845] lstrlenW (lpString=".mdt") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0090.845] lstrlenW (lpString=".sdf") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0090.845] lstrlenW (lpString=".MDF") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0090.845] lstrlenW (lpString=".DBF") returned 4 [0090.845] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0090.845] lstrlenW (lpString=".DB") returned 3 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0090.846] lstrlenW (lpString=".db") returned 3 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0090.846] lstrlenW (lpString=".ndf") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0090.846] lstrlenW (lpString=".NDF") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0090.846] lstrlenW (lpString=".Mdf") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0090.846] lstrlenW (lpString=".dat") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0090.846] lstrlenW (lpString=".DAT") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0090.846] lstrlenW (lpString=".ldf") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0090.846] lstrlenW (lpString=".LDF") returned 4 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0090.846] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.846] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.846] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.847] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.847] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.847] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.847] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21084854127) returned 1 [0090.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4f61230, dwHighDateTime=0x1d585b4)) [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b54e8 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b54e8 | out: hHeap=0x260000) returned 1 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.848] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.848] GetLastError () returned 0x0 [0090.848] GetLastError () returned 0x0 [0090.849] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.849] GetLastError () returned 0x0 [0090.849] GetLastError () returned 0x0 [0090.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe10, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.850] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1f0, lpOverlapped=0x0) returned 1 [0090.850] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0090.850] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.850] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0090.850] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0090.850] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0090.851] CloseHandle (hObject=0xf0) returned 1 [0090.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0090.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0090.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0090.852] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0090.852] GetLastError () returned 0x0 [0090.852] RtlWakeConditionVariable () returned 0x0 [0090.852] GetCurrentThreadId () returned 0x9ac [0090.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".ldf") returned 0x0 [0090.852] lstrlenW (lpString=".vhd") returned 4 [0090.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".vhd") returned 0x0 [0090.852] lstrlenW (lpString=".vhdx") returned 5 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".vhdx") returned 0x0 [0090.853] lstrlenW (lpString=".pst") returned 4 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".pst") returned 0x0 [0090.853] lstrlenW (lpString=".ost") returned 4 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".ost") returned 0x0 [0090.853] lstrlenW (lpString=".bak") returned 4 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".bak") returned 0x0 [0090.853] lstrlenW (lpString=".bac") returned 4 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".bac") returned 0x0 [0090.853] lstrlenW (lpString=".sys") returned 4 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".sys") returned 0x0 [0090.853] lstrlenW (lpString=".v2i") returned 4 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".v2i") returned 0x0 [0090.853] lstrlenW (lpString="s\r\n.v2i") returned 7 [0090.853] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch="s\r\n.v2i") returned 0x0 [0090.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0090.854] lstrlenW (lpString=".sql") returned 4 [0090.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".sql") returned 0x0 [0090.854] lstrlenW (lpString=".mdf") returned 4 [0090.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".mdf") returned 0x0 [0090.854] lstrlenW (lpString=".txt") returned 4 [0090.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".txt") returned 0x0 [0090.855] lstrlenW (lpString=".dbf") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".dbf") returned 0x0 [0090.855] lstrlenW (lpString=".ckp") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".ckp") returned 0x0 [0090.855] lstrlenW (lpString=".dacpac") returned 7 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".dacpac") returned 0x0 [0090.855] lstrlenW (lpString=".db3") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".db3") returned 0x0 [0090.855] lstrlenW (lpString=".dtxs") returned 5 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".dtxs") returned 0x0 [0090.855] lstrlenW (lpString=".mdt") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".mdt") returned 0x0 [0090.855] lstrlenW (lpString=".sdf") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".sdf") returned 0x0 [0090.855] lstrlenW (lpString=".MDF") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".MDF") returned 0x0 [0090.855] lstrlenW (lpString=".DBF") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".DBF") returned 0x0 [0090.855] lstrlenW (lpString=".DB") returned 3 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".DB") returned 0x0 [0090.855] lstrlenW (lpString=".db") returned 3 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".db") returned 0x0 [0090.855] lstrlenW (lpString=".ndf") returned 4 [0090.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".ndf") returned 0x0 [0090.855] lstrlenW (lpString=".NDF") returned 4 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".NDF") returned 0x0 [0090.856] lstrlenW (lpString=".Mdf") returned 4 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".Mdf") returned 0x0 [0090.856] lstrlenW (lpString=".dat") returned 4 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".dat") returned 0x0 [0090.856] lstrlenW (lpString=".DAT") returned 4 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".DAT") returned 0x0 [0090.856] lstrlenW (lpString=".ldf") returned 4 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".ldf") returned 0x0 [0090.856] lstrlenW (lpString=".LDF") returned 4 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch=".LDF") returned 0x0 [0090.856] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0090.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0090.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0090.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0090.856] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0090.857] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0090.857] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0090.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0090.857] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21085820709) returned 1 [0090.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc4f87390, dwHighDateTime=0x1d585b4)) [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5520 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0090.857] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5520 | out: hHeap=0x260000) returned 1 [0090.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0090.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0090.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0090.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0090.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0090.858] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0090.858] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0090.858] GetLastError () returned 0x0 [0090.858] GetLastError () returned 0x0 [0090.858] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0090.858] GetLastError () returned 0x0 [0090.858] GetLastError () returned 0x0 [0091.014] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff2cb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.026] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xd35, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd35, lpOverlapped=0x0) returned 1 [0091.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.027] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.027] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.027] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.027] CloseHandle (hObject=0xf0) returned 1 [0091.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css.[deadmin@cock.li].deadmin")) returned 1 [0091.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.029] GetLastError () returned 0x0 [0091.029] RtlWakeConditionVariable () returned 0x0 [0091.029] GetCurrentThreadId () returned 0x9ac [0091.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.030] lstrlenW (lpString=".vhd") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0091.030] lstrlenW (lpString=".vhdx") returned 5 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0091.030] lstrlenW (lpString=".pst") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0091.030] lstrlenW (lpString=".ost") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0091.030] lstrlenW (lpString=".bak") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0091.030] lstrlenW (lpString=".bac") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0091.030] lstrlenW (lpString=".sys") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0091.030] lstrlenW (lpString=".v2i") returned 4 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0091.030] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.031] lstrlenW (lpString=".sql") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0091.032] lstrlenW (lpString=".mdf") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0091.032] lstrlenW (lpString=".txt") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0091.032] lstrlenW (lpString=".dbf") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0091.032] lstrlenW (lpString=".ckp") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0091.032] lstrlenW (lpString=".dacpac") returned 7 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0091.032] lstrlenW (lpString=".db3") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0091.032] lstrlenW (lpString=".dtxs") returned 5 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0091.032] lstrlenW (lpString=".mdt") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0091.032] lstrlenW (lpString=".sdf") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0091.032] lstrlenW (lpString=".MDF") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0091.032] lstrlenW (lpString=".DBF") returned 4 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0091.032] lstrlenW (lpString=".DB") returned 3 [0091.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0091.033] lstrlenW (lpString=".db") returned 3 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0091.033] lstrlenW (lpString=".ndf") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0091.033] lstrlenW (lpString=".NDF") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0091.033] lstrlenW (lpString=".Mdf") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0091.033] lstrlenW (lpString=".dat") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0091.033] lstrlenW (lpString=".DAT") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0091.033] lstrlenW (lpString=".ldf") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.033] lstrlenW (lpString=".LDF") returned 4 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0091.033] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.033] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.034] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.034] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21103543214) returned 1 [0091.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc512a2b0, dwHighDateTime=0x1d585b4)) [0091.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b58a0 [0091.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b58a0 | out: hHeap=0x260000) returned 1 [0091.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.035] GetLastError () returned 0x0 [0091.035] GetLastError () returned 0x0 [0091.035] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.036] GetLastError () returned 0x0 [0091.036] GetLastError () returned 0x0 [0091.038] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.039] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x401, lpOverlapped=0x0) returned 1 [0091.039] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.039] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.039] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.039] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.039] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.039] CloseHandle (hObject=0xf0) returned 1 [0091.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.041] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.041] GetLastError () returned 0x0 [0091.041] RtlWakeConditionVariable () returned 0x0 [0091.041] GetCurrentThreadId () returned 0x9ac [0091.043] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.043] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.043] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.043] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.045] CloseHandle (hObject=0xf0) returned 1 [0091.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b020 | out: hHeap=0x260000) returned 1 [0091.045] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.046] RtlWakeConditionVariable () returned 0x0 [0091.046] GetCurrentThreadId () returned 0x9ac [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".ldf") returned 0x0 [0091.046] lstrlenW (lpString=".vhd") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".vhd") returned 0x0 [0091.046] lstrlenW (lpString=".vhdx") returned 5 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".vhdx") returned 0x0 [0091.046] lstrlenW (lpString=".pst") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".pst") returned 0x0 [0091.046] lstrlenW (lpString=".ost") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".ost") returned 0x0 [0091.046] lstrlenW (lpString=".bak") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".bak") returned 0x0 [0091.046] lstrlenW (lpString=".bac") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".bac") returned 0x0 [0091.046] lstrlenW (lpString=".sys") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".sys") returned 0x0 [0091.046] lstrlenW (lpString=".v2i") returned 4 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".v2i") returned 0x0 [0091.046] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.048] lstrlenW (lpString=".sql") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".sql") returned 0x0 [0091.048] lstrlenW (lpString=".mdf") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".mdf") returned 0x0 [0091.048] lstrlenW (lpString=".txt") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".txt") returned 0x0 [0091.048] lstrlenW (lpString=".dbf") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".dbf") returned 0x0 [0091.048] lstrlenW (lpString=".ckp") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".ckp") returned 0x0 [0091.048] lstrlenW (lpString=".dacpac") returned 7 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".dacpac") returned 0x0 [0091.048] lstrlenW (lpString=".db3") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".db3") returned 0x0 [0091.048] lstrlenW (lpString=".dtxs") returned 5 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".dtxs") returned 0x0 [0091.048] lstrlenW (lpString=".mdt") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".mdt") returned 0x0 [0091.048] lstrlenW (lpString=".sdf") returned 4 [0091.048] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".sdf") returned 0x0 [0091.049] lstrlenW (lpString=".MDF") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".MDF") returned 0x0 [0091.049] lstrlenW (lpString=".DBF") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".DBF") returned 0x0 [0091.049] lstrlenW (lpString=".DB") returned 3 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".DB") returned 0x0 [0091.049] lstrlenW (lpString=".db") returned 3 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".db") returned 0x0 [0091.049] lstrlenW (lpString=".ndf") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".ndf") returned 0x0 [0091.049] lstrlenW (lpString=".NDF") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".NDF") returned 0x0 [0091.049] lstrlenW (lpString=".Mdf") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".Mdf") returned 0x0 [0091.049] lstrlenW (lpString=".dat") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".dat") returned 0x0 [0091.049] lstrlenW (lpString=".DAT") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".DAT") returned 0x0 [0091.049] lstrlenW (lpString=".ldf") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".ldf") returned 0x0 [0091.049] lstrlenW (lpString=".LDF") returned 4 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch=".LDF") returned 0x0 [0091.049] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.049] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.050] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.050] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.050] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.051] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21105167722) returned 1 [0091.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5150410, dwHighDateTime=0x1d585b4)) [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5910 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5910 | out: hHeap=0x260000) returned 1 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.051] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.051] GetLastError () returned 0x0 [0091.052] GetLastError () returned 0x0 [0091.052] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.052] GetLastError () returned 0x0 [0091.052] GetLastError () returned 0x0 [0091.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff050, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.055] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xfb0, lpOverlapped=0x0) returned 1 [0091.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.055] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.056] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.056] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.056] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.056] CloseHandle (hObject=0xf0) returned 1 [0091.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css.[deadmin@cock.li].deadmin")) returned 1 [0091.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.059] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.059] GetLastError () returned 0x0 [0091.059] RtlWakeConditionVariable () returned 0x0 [0091.059] GetCurrentThreadId () returned 0x9ac [0091.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".ldf") returned 0x0 [0091.059] lstrlenW (lpString=".vhd") returned 4 [0091.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".vhd") returned 0x0 [0091.059] lstrlenW (lpString=".vhdx") returned 5 [0091.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".vhdx") returned 0x0 [0091.059] lstrlenW (lpString=".pst") returned 4 [0091.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".pst") returned 0x0 [0091.059] lstrlenW (lpString=".ost") returned 4 [0091.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".ost") returned 0x0 [0091.060] lstrlenW (lpString=".bak") returned 4 [0091.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".bak") returned 0x0 [0091.060] lstrlenW (lpString=".bac") returned 4 [0091.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".bac") returned 0x0 [0091.060] lstrlenW (lpString=".sys") returned 4 [0091.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".sys") returned 0x0 [0091.060] lstrlenW (lpString=".v2i") returned 4 [0091.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".v2i") returned 0x0 [0091.060] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.060] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.061] lstrlenW (lpString=".sql") returned 4 [0091.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".sql") returned 0x0 [0091.061] lstrlenW (lpString=".mdf") returned 4 [0091.061] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".mdf") returned 0x0 [0091.061] lstrlenW (lpString=".txt") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".txt") returned 0x0 [0091.062] lstrlenW (lpString=".dbf") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".dbf") returned 0x0 [0091.062] lstrlenW (lpString=".ckp") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".ckp") returned 0x0 [0091.062] lstrlenW (lpString=".dacpac") returned 7 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".dacpac") returned 0x0 [0091.062] lstrlenW (lpString=".db3") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".db3") returned 0x0 [0091.062] lstrlenW (lpString=".dtxs") returned 5 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".dtxs") returned 0x0 [0091.062] lstrlenW (lpString=".mdt") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".mdt") returned 0x0 [0091.062] lstrlenW (lpString=".sdf") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".sdf") returned 0x0 [0091.062] lstrlenW (lpString=".MDF") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".MDF") returned 0x0 [0091.062] lstrlenW (lpString=".DBF") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".DBF") returned 0x0 [0091.062] lstrlenW (lpString=".DB") returned 3 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".DB") returned 0x0 [0091.062] lstrlenW (lpString=".db") returned 3 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".db") returned 0x0 [0091.062] lstrlenW (lpString=".ndf") returned 4 [0091.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".ndf") returned 0x0 [0091.062] lstrlenW (lpString=".NDF") returned 4 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".NDF") returned 0x0 [0091.063] lstrlenW (lpString=".Mdf") returned 4 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".Mdf") returned 0x0 [0091.063] lstrlenW (lpString=".dat") returned 4 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".dat") returned 0x0 [0091.063] lstrlenW (lpString=".DAT") returned 4 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".DAT") returned 0x0 [0091.063] lstrlenW (lpString=".ldf") returned 4 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".ldf") returned 0x0 [0091.063] lstrlenW (lpString=".LDF") returned 4 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch=".LDF") returned 0x0 [0091.063] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.063] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.064] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.064] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.064] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21106522730) returned 1 [0091.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5176570, dwHighDateTime=0x1d585b4)) [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5948 [0091.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.064] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5948 | out: hHeap=0x260000) returned 1 [0091.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.065] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.065] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.065] GetLastError () returned 0x0 [0091.065] GetLastError () returned 0x0 [0091.065] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.065] GetLastError () returned 0x0 [0091.066] GetLastError () returned 0x0 [0091.082] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8b5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.082] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x74b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x74b, lpOverlapped=0x0) returned 1 [0091.082] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.084] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.084] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.084] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.084] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.084] CloseHandle (hObject=0xf0) returned 1 [0091.219] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x345558 [0091.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css.[deadmin@cock.li].deadmin")) returned 1 [0091.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x345558 | out: hHeap=0x260000) returned 1 [0091.222] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.222] GetLastError () returned 0x0 [0091.222] RtlWakeConditionVariable () returned 0x0 [0091.222] GetCurrentThreadId () returned 0x9ac [0091.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.222] lstrlenW (lpString=".vhd") returned 4 [0091.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0091.222] lstrlenW (lpString=".vhdx") returned 5 [0091.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0091.222] lstrlenW (lpString=".pst") returned 4 [0091.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0091.222] lstrlenW (lpString=".ost") returned 4 [0091.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0091.222] lstrlenW (lpString=".bak") returned 4 [0091.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0091.223] lstrlenW (lpString=".bac") returned 4 [0091.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0091.223] lstrlenW (lpString=".sys") returned 4 [0091.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0091.223] lstrlenW (lpString=".v2i") returned 4 [0091.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0091.223] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.223] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.225] lstrlenW (lpString=".sql") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0091.225] lstrlenW (lpString=".mdf") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0091.225] lstrlenW (lpString=".txt") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0091.225] lstrlenW (lpString=".dbf") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0091.225] lstrlenW (lpString=".ckp") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0091.225] lstrlenW (lpString=".dacpac") returned 7 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0091.225] lstrlenW (lpString=".db3") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0091.225] lstrlenW (lpString=".dtxs") returned 5 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0091.225] lstrlenW (lpString=".mdt") returned 4 [0091.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0091.226] lstrlenW (lpString=".sdf") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0091.226] lstrlenW (lpString=".MDF") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0091.226] lstrlenW (lpString=".DBF") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0091.226] lstrlenW (lpString=".DB") returned 3 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0091.226] lstrlenW (lpString=".db") returned 3 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0091.226] lstrlenW (lpString=".ndf") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0091.226] lstrlenW (lpString=".NDF") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0091.226] lstrlenW (lpString=".Mdf") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0091.226] lstrlenW (lpString=".dat") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0091.226] lstrlenW (lpString=".DAT") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0091.226] lstrlenW (lpString=".ldf") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.226] lstrlenW (lpString=".LDF") returned 4 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0091.226] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.226] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.227] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.227] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.227] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.227] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.228] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21122875579) returned 1 [0091.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc52f3330, dwHighDateTime=0x1d585b4)) [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b59b8 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b59b8 | out: hHeap=0x260000) returned 1 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.228] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.228] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.228] GetLastError () returned 0x0 [0091.229] GetLastError () returned 0x0 [0091.229] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.229] GetLastError () returned 0x0 [0091.229] GetLastError () returned 0x0 [0091.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.232] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x16c, lpOverlapped=0x0) returned 1 [0091.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.232] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.232] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.232] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.232] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.232] CloseHandle (hObject=0xf0) returned 1 [0091.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x345558 [0091.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x345558 | out: hHeap=0x260000) returned 1 [0091.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.235] GetLastError () returned 0x0 [0091.235] RtlWakeConditionVariable () returned 0x27e828 [0091.235] GetCurrentThreadId () returned 0x9ac [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.235] lstrlenW (lpString=".vhd") returned 4 [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0091.235] lstrlenW (lpString=".vhdx") returned 5 [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0091.235] lstrlenW (lpString=".pst") returned 4 [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0091.235] lstrlenW (lpString=".ost") returned 4 [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0091.235] lstrlenW (lpString=".bak") returned 4 [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0091.235] lstrlenW (lpString=".bac") returned 4 [0091.235] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0091.235] lstrlenW (lpString=".sys") returned 4 [0091.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0091.236] lstrlenW (lpString=".v2i") returned 4 [0091.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0091.236] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.236] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.237] lstrlenW (lpString=".sql") returned 4 [0091.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0091.237] lstrlenW (lpString=".mdf") returned 4 [0091.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0091.237] lstrlenW (lpString=".txt") returned 4 [0091.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0091.237] lstrlenW (lpString=".dbf") returned 4 [0091.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0091.237] lstrlenW (lpString=".ckp") returned 4 [0091.237] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0091.237] lstrlenW (lpString=".dacpac") returned 7 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0091.238] lstrlenW (lpString=".db3") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0091.238] lstrlenW (lpString=".dtxs") returned 5 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0091.238] lstrlenW (lpString=".mdt") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0091.238] lstrlenW (lpString=".sdf") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0091.238] lstrlenW (lpString=".MDF") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0091.238] lstrlenW (lpString=".DBF") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0091.238] lstrlenW (lpString=".DB") returned 3 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0091.238] lstrlenW (lpString=".db") returned 3 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0091.238] lstrlenW (lpString=".ndf") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0091.238] lstrlenW (lpString=".NDF") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0091.238] lstrlenW (lpString=".Mdf") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0091.238] lstrlenW (lpString=".dat") returned 4 [0091.238] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0091.238] lstrlenW (lpString=".DAT") returned 4 [0091.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0091.239] lstrlenW (lpString=".ldf") returned 4 [0091.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.239] lstrlenW (lpString=".LDF") returned 4 [0091.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0091.239] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.239] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.239] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.240] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.240] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.240] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21124103060) returned 1 [0091.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5319490, dwHighDateTime=0x1d585b4)) [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b59f0 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b59f0 | out: hHeap=0x260000) returned 1 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.241] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.241] GetLastError () returned 0x0 [0091.241] GetLastError () returned 0x0 [0091.241] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.241] GetLastError () returned 0x0 [0091.241] GetLastError () returned 0x0 [0091.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.242] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x16c, lpOverlapped=0x0) returned 1 [0091.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.243] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.243] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.243] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.243] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.243] CloseHandle (hObject=0xf0) returned 1 [0091.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x345558 [0091.243] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x345558 | out: hHeap=0x260000) returned 1 [0091.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.245] GetLastError () returned 0x0 [0091.245] RtlWakeConditionVariable () returned 0x27e828 [0091.245] GetCurrentThreadId () returned 0x9ac [0091.247] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.247] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.247] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.247] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.249] CloseHandle (hObject=0xf0) returned 1 [0091.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b138 | out: hHeap=0x260000) returned 1 [0091.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35af08 | out: hHeap=0x260000) returned 1 [0091.250] RtlWakeConditionVariable () returned 0x0 [0091.250] GetCurrentThreadId () returned 0x9ac [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".ldf") returned 0x0 [0091.250] lstrlenW (lpString=".vhd") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".vhd") returned 0x0 [0091.250] lstrlenW (lpString=".vhdx") returned 5 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".vhdx") returned 0x0 [0091.250] lstrlenW (lpString=".pst") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".pst") returned 0x0 [0091.250] lstrlenW (lpString=".ost") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".ost") returned 0x0 [0091.250] lstrlenW (lpString=".bak") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".bak") returned 0x0 [0091.250] lstrlenW (lpString=".bac") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".bac") returned 0x0 [0091.250] lstrlenW (lpString=".sys") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".sys") returned 0x0 [0091.250] lstrlenW (lpString=".v2i") returned 4 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".v2i") returned 0x0 [0091.250] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.250] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.252] lstrlenW (lpString=".sql") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".sql") returned 0x0 [0091.252] lstrlenW (lpString=".mdf") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".mdf") returned 0x0 [0091.252] lstrlenW (lpString=".txt") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".txt") returned 0x0 [0091.252] lstrlenW (lpString=".dbf") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".dbf") returned 0x0 [0091.252] lstrlenW (lpString=".ckp") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".ckp") returned 0x0 [0091.252] lstrlenW (lpString=".dacpac") returned 7 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".dacpac") returned 0x0 [0091.252] lstrlenW (lpString=".db3") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".db3") returned 0x0 [0091.252] lstrlenW (lpString=".dtxs") returned 5 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".dtxs") returned 0x0 [0091.252] lstrlenW (lpString=".mdt") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".mdt") returned 0x0 [0091.252] lstrlenW (lpString=".sdf") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".sdf") returned 0x0 [0091.252] lstrlenW (lpString=".MDF") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".MDF") returned 0x0 [0091.252] lstrlenW (lpString=".DBF") returned 4 [0091.252] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".DBF") returned 0x0 [0091.252] lstrlenW (lpString=".DB") returned 3 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".DB") returned 0x0 [0091.253] lstrlenW (lpString=".db") returned 3 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".db") returned 0x0 [0091.253] lstrlenW (lpString=".ndf") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".ndf") returned 0x0 [0091.253] lstrlenW (lpString=".NDF") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".NDF") returned 0x0 [0091.253] lstrlenW (lpString=".Mdf") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".Mdf") returned 0x0 [0091.253] lstrlenW (lpString=".dat") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".dat") returned 0x0 [0091.253] lstrlenW (lpString=".DAT") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".DAT") returned 0x0 [0091.253] lstrlenW (lpString=".ldf") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".ldf") returned 0x0 [0091.253] lstrlenW (lpString=".LDF") returned 4 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch=".LDF") returned 0x0 [0091.253] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.253] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.253] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.254] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.254] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.254] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.254] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21125552490) returned 1 [0091.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc533f5f0, dwHighDateTime=0x1d585b4)) [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5a60 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5a60 | out: hHeap=0x260000) returned 1 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.255] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.255] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.255] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.255] GetLastError () returned 0x0 [0091.255] GetLastError () returned 0x0 [0091.256] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.256] GetLastError () returned 0x0 [0091.256] GetLastError () returned 0x0 [0091.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffef29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.349] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x10d7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x10d7, lpOverlapped=0x0) returned 1 [0091.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.350] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.350] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.350] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.350] CloseHandle (hObject=0xf0) returned 1 [0091.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35af08 [0091.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css.[deadmin@cock.li].deadmin")) returned 1 [0091.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35af08 | out: hHeap=0x260000) returned 1 [0091.352] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.352] GetLastError () returned 0x0 [0091.352] RtlWakeConditionVariable () returned 0x0 [0091.352] GetCurrentThreadId () returned 0x9ac [0091.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".ldf") returned 0x0 [0091.352] lstrlenW (lpString=".vhd") returned 4 [0091.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".vhd") returned 0x0 [0091.353] lstrlenW (lpString=".vhdx") returned 5 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".vhdx") returned 0x0 [0091.353] lstrlenW (lpString=".pst") returned 4 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".pst") returned 0x0 [0091.353] lstrlenW (lpString=".ost") returned 4 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".ost") returned 0x0 [0091.353] lstrlenW (lpString=".bak") returned 4 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".bak") returned 0x0 [0091.353] lstrlenW (lpString=".bac") returned 4 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".bac") returned 0x0 [0091.353] lstrlenW (lpString=".sys") returned 4 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".sys") returned 0x0 [0091.353] lstrlenW (lpString=".v2i") returned 4 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".v2i") returned 0x0 [0091.353] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.355] lstrlenW (lpString=".sql") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".sql") returned 0x0 [0091.355] lstrlenW (lpString=".mdf") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".mdf") returned 0x0 [0091.355] lstrlenW (lpString=".txt") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".txt") returned 0x0 [0091.355] lstrlenW (lpString=".dbf") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".dbf") returned 0x0 [0091.355] lstrlenW (lpString=".ckp") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".ckp") returned 0x0 [0091.355] lstrlenW (lpString=".dacpac") returned 7 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".dacpac") returned 0x0 [0091.355] lstrlenW (lpString=".db3") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".db3") returned 0x0 [0091.355] lstrlenW (lpString=".dtxs") returned 5 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".dtxs") returned 0x0 [0091.355] lstrlenW (lpString=".mdt") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".mdt") returned 0x0 [0091.355] lstrlenW (lpString=".sdf") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".sdf") returned 0x0 [0091.355] lstrlenW (lpString=".MDF") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".MDF") returned 0x0 [0091.355] lstrlenW (lpString=".DBF") returned 4 [0091.355] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".DBF") returned 0x0 [0091.355] lstrlenW (lpString=".DB") returned 3 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".DB") returned 0x0 [0091.356] lstrlenW (lpString=".db") returned 3 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".db") returned 0x0 [0091.356] lstrlenW (lpString=".ndf") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".ndf") returned 0x0 [0091.356] lstrlenW (lpString=".NDF") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".NDF") returned 0x0 [0091.356] lstrlenW (lpString=".Mdf") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".Mdf") returned 0x0 [0091.356] lstrlenW (lpString=".dat") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".dat") returned 0x0 [0091.356] lstrlenW (lpString=".DAT") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".DAT") returned 0x0 [0091.356] lstrlenW (lpString=".ldf") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".ldf") returned 0x0 [0091.356] lstrlenW (lpString=".LDF") returned 4 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch=".LDF") returned 0x0 [0091.356] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.356] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.357] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.357] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.357] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.357] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21135850445) returned 1 [0091.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5449f90, dwHighDateTime=0x1d585b4)) [0091.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5bb0 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5bb0 | out: hHeap=0x260000) returned 1 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.358] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.358] GetLastError () returned 0x0 [0091.358] GetLastError () returned 0x0 [0091.359] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.359] GetLastError () returned 0x0 [0091.359] GetLastError () returned 0x0 [0091.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffee36, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.361] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x11ca, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x11ca, lpOverlapped=0x0) returned 1 [0091.361] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.361] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.361] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.361] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.361] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.361] CloseHandle (hObject=0xf0) returned 1 [0091.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css.[deadmin@cock.li].deadmin")) returned 1 [0091.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.363] GetLastError () returned 0x0 [0091.363] RtlWakeConditionVariable () returned 0x0 [0091.363] GetCurrentThreadId () returned 0x9ac [0091.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0091.363] lstrlenW (lpString=".vhd") returned 4 [0091.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".vhd") returned 0x0 [0091.363] lstrlenW (lpString=".vhdx") returned 5 [0091.363] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".vhdx") returned 0x0 [0091.363] lstrlenW (lpString=".pst") returned 4 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".pst") returned 0x0 [0091.364] lstrlenW (lpString=".ost") returned 4 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ost") returned 0x0 [0091.364] lstrlenW (lpString=".bak") returned 4 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".bak") returned 0x0 [0091.364] lstrlenW (lpString=".bac") returned 4 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".bac") returned 0x0 [0091.364] lstrlenW (lpString=".sys") returned 4 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".sys") returned 0x0 [0091.364] lstrlenW (lpString=".v2i") returned 4 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".v2i") returned 0x0 [0091.364] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.364] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.365] lstrlenW (lpString=".sql") returned 4 [0091.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".sql") returned 0x0 [0091.365] lstrlenW (lpString=".mdf") returned 4 [0091.365] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".mdf") returned 0x0 [0091.366] lstrlenW (lpString=".txt") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".txt") returned 0x0 [0091.366] lstrlenW (lpString=".dbf") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dbf") returned 0x0 [0091.366] lstrlenW (lpString=".ckp") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ckp") returned 0x0 [0091.366] lstrlenW (lpString=".dacpac") returned 7 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dacpac") returned 0x0 [0091.366] lstrlenW (lpString=".db3") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".db3") returned 0x0 [0091.366] lstrlenW (lpString=".dtxs") returned 5 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dtxs") returned 0x0 [0091.366] lstrlenW (lpString=".mdt") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".mdt") returned 0x0 [0091.366] lstrlenW (lpString=".sdf") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".sdf") returned 0x0 [0091.366] lstrlenW (lpString=".MDF") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".MDF") returned 0x0 [0091.366] lstrlenW (lpString=".DBF") returned 4 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".DBF") returned 0x0 [0091.366] lstrlenW (lpString=".DB") returned 3 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".DB") returned 0x0 [0091.366] lstrlenW (lpString=".db") returned 3 [0091.366] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".db") returned 0x0 [0091.366] lstrlenW (lpString=".ndf") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ndf") returned 0x0 [0091.367] lstrlenW (lpString=".NDF") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".NDF") returned 0x0 [0091.367] lstrlenW (lpString=".Mdf") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".Mdf") returned 0x0 [0091.367] lstrlenW (lpString=".dat") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".dat") returned 0x0 [0091.367] lstrlenW (lpString=".DAT") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".DAT") returned 0x0 [0091.367] lstrlenW (lpString=".ldf") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".ldf") returned 0x0 [0091.367] lstrlenW (lpString=".LDF") returned 4 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch=".LDF") returned 0x0 [0091.367] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.367] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.368] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.368] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.368] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21136932215) returned 1 [0091.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5449f90, dwHighDateTime=0x1d585b4)) [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5be8 [0091.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5be8 | out: hHeap=0x260000) returned 1 [0091.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.369] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.369] GetLastError () returned 0x0 [0091.369] GetLastError () returned 0x0 [0091.369] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.370] GetLastError () returned 0x0 [0091.370] GetLastError () returned 0x0 [0091.371] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.371] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1ac, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ac, lpOverlapped=0x0) returned 1 [0091.371] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.371] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.371] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.371] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.371] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.371] CloseHandle (hObject=0xf0) returned 1 [0091.372] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922098 | out: hHeap=0x260000) returned 1 [0091.373] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.373] GetLastError () returned 0x0 [0091.373] RtlWakeConditionVariable () returned 0x27e828 [0091.374] GetCurrentThreadId () returned 0x9ac [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.374] lstrlenW (lpString=".vhd") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0091.374] lstrlenW (lpString=".vhdx") returned 5 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0091.374] lstrlenW (lpString=".pst") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0091.374] lstrlenW (lpString=".ost") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0091.374] lstrlenW (lpString=".bak") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0091.374] lstrlenW (lpString=".bac") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0091.374] lstrlenW (lpString=".sys") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0091.374] lstrlenW (lpString=".v2i") returned 4 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0091.374] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.376] lstrlenW (lpString=".sql") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0091.376] lstrlenW (lpString=".mdf") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0091.376] lstrlenW (lpString=".txt") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0091.376] lstrlenW (lpString=".dbf") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0091.376] lstrlenW (lpString=".ckp") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0091.376] lstrlenW (lpString=".dacpac") returned 7 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0091.376] lstrlenW (lpString=".db3") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0091.376] lstrlenW (lpString=".dtxs") returned 5 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0091.376] lstrlenW (lpString=".mdt") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0091.376] lstrlenW (lpString=".sdf") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0091.376] lstrlenW (lpString=".MDF") returned 4 [0091.376] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0091.377] lstrlenW (lpString=".DBF") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0091.377] lstrlenW (lpString=".DB") returned 3 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0091.377] lstrlenW (lpString=".db") returned 3 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0091.377] lstrlenW (lpString=".ndf") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0091.377] lstrlenW (lpString=".NDF") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0091.377] lstrlenW (lpString=".Mdf") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0091.377] lstrlenW (lpString=".dat") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0091.377] lstrlenW (lpString=".DAT") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0091.377] lstrlenW (lpString=".ldf") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.377] lstrlenW (lpString=".LDF") returned 4 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0091.377] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.377] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.378] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.378] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.378] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21137961311) returned 1 [0091.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc54700f0, dwHighDateTime=0x1d585b4)) [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5c20 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5c20 | out: hHeap=0x260000) returned 1 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.379] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.379] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.379] GetLastError () returned 0x0 [0091.380] GetLastError () returned 0x0 [0091.380] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.380] GetLastError () returned 0x0 [0091.380] GetLastError () returned 0x0 [0091.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeab, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.381] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x155, lpOverlapped=0x0) returned 1 [0091.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.381] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.381] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.381] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.382] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.382] CloseHandle (hObject=0xf0) returned 1 [0091.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922098 | out: hHeap=0x260000) returned 1 [0091.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.522] GetLastError () returned 0x0 [0091.522] RtlWakeConditionVariable () returned 0x0 [0091.523] GetCurrentThreadId () returned 0x9ac [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.523] lstrlenW (lpString=".vhd") returned 4 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0091.523] lstrlenW (lpString=".vhdx") returned 5 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0091.523] lstrlenW (lpString=".pst") returned 4 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0091.523] lstrlenW (lpString=".ost") returned 4 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0091.523] lstrlenW (lpString=".bak") returned 4 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0091.523] lstrlenW (lpString=".bac") returned 4 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0091.523] lstrlenW (lpString=".sys") returned 4 [0091.523] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0091.523] lstrlenW (lpString=".v2i") returned 4 [0091.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0091.525] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.527] lstrlenW (lpString=".sql") returned 4 [0091.527] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0091.528] lstrlenW (lpString=".mdf") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0091.528] lstrlenW (lpString=".txt") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0091.528] lstrlenW (lpString=".dbf") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0091.528] lstrlenW (lpString=".ckp") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0091.528] lstrlenW (lpString=".dacpac") returned 7 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0091.528] lstrlenW (lpString=".db3") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0091.528] lstrlenW (lpString=".dtxs") returned 5 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0091.528] lstrlenW (lpString=".mdt") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0091.528] lstrlenW (lpString=".sdf") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0091.528] lstrlenW (lpString=".MDF") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0091.528] lstrlenW (lpString=".DBF") returned 4 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0091.528] lstrlenW (lpString=".DB") returned 3 [0091.528] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0091.528] lstrlenW (lpString=".db") returned 3 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0091.529] lstrlenW (lpString=".ndf") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0091.529] lstrlenW (lpString=".NDF") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0091.529] lstrlenW (lpString=".Mdf") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0091.529] lstrlenW (lpString=".dat") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0091.529] lstrlenW (lpString=".DAT") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0091.529] lstrlenW (lpString=".ldf") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.529] lstrlenW (lpString=".LDF") returned 4 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0091.529] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.529] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.529] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.529] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.530] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.530] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.530] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.530] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21153146199) returned 1 [0091.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc55eceb0, dwHighDateTime=0x1d585b4)) [0091.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5c58 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5c58 | out: hHeap=0x260000) returned 1 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.531] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.531] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.531] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.531] GetLastError () returned 0x0 [0091.532] GetLastError () returned 0x0 [0091.532] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.532] GetLastError () returned 0x0 [0091.532] GetLastError () returned 0x0 [0091.533] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.533] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xde, lpOverlapped=0x0) returned 1 [0091.533] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.533] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.533] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.534] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.534] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.534] CloseHandle (hObject=0xf0) returned 1 [0091.534] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0091.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922098 | out: hHeap=0x260000) returned 1 [0091.536] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.536] GetLastError () returned 0x0 [0091.537] RtlWakeConditionVariable () returned 0x0 [0091.537] GetCurrentThreadId () returned 0x9ac [0091.537] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.537] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.537] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.537] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.540] CloseHandle (hObject=0xf0) returned 1 [0091.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x345308 | out: hHeap=0x260000) returned 1 [0091.540] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.540] RtlWakeConditionVariable () returned 0x0 [0091.540] GetCurrentThreadId () returned 0x9ac [0091.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".ldf") returned 0x0 [0091.540] lstrlenW (lpString=".vhd") returned 4 [0091.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".vhd") returned 0x0 [0091.541] lstrlenW (lpString=".vhdx") returned 5 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".vhdx") returned 0x0 [0091.541] lstrlenW (lpString=".pst") returned 4 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".pst") returned 0x0 [0091.541] lstrlenW (lpString=".ost") returned 4 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".ost") returned 0x0 [0091.541] lstrlenW (lpString=".bak") returned 4 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".bak") returned 0x0 [0091.541] lstrlenW (lpString=".bac") returned 4 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".bac") returned 0x0 [0091.541] lstrlenW (lpString=".sys") returned 4 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".sys") returned 0x0 [0091.541] lstrlenW (lpString=".v2i") returned 4 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".v2i") returned 0x0 [0091.541] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.542] lstrlenW (lpString=".sql") returned 4 [0091.542] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".sql") returned 0x0 [0091.543] lstrlenW (lpString=".mdf") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".mdf") returned 0x0 [0091.543] lstrlenW (lpString=".txt") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".txt") returned 0x0 [0091.543] lstrlenW (lpString=".dbf") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".dbf") returned 0x0 [0091.543] lstrlenW (lpString=".ckp") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".ckp") returned 0x0 [0091.543] lstrlenW (lpString=".dacpac") returned 7 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".dacpac") returned 0x0 [0091.543] lstrlenW (lpString=".db3") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".db3") returned 0x0 [0091.543] lstrlenW (lpString=".dtxs") returned 5 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".dtxs") returned 0x0 [0091.543] lstrlenW (lpString=".mdt") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".mdt") returned 0x0 [0091.543] lstrlenW (lpString=".sdf") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".sdf") returned 0x0 [0091.543] lstrlenW (lpString=".MDF") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".MDF") returned 0x0 [0091.543] lstrlenW (lpString=".DBF") returned 4 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".DBF") returned 0x0 [0091.543] lstrlenW (lpString=".DB") returned 3 [0091.543] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".DB") returned 0x0 [0091.543] lstrlenW (lpString=".db") returned 3 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".db") returned 0x0 [0091.544] lstrlenW (lpString=".ndf") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".ndf") returned 0x0 [0091.544] lstrlenW (lpString=".NDF") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".NDF") returned 0x0 [0091.544] lstrlenW (lpString=".Mdf") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".Mdf") returned 0x0 [0091.544] lstrlenW (lpString=".dat") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".dat") returned 0x0 [0091.544] lstrlenW (lpString=".DAT") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".DAT") returned 0x0 [0091.544] lstrlenW (lpString=".ldf") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".ldf") returned 0x0 [0091.544] lstrlenW (lpString=".LDF") returned 4 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch=".LDF") returned 0x0 [0091.544] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.544] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.544] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.545] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.545] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.545] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.545] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21154642470) returned 1 [0091.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5613010, dwHighDateTime=0x1d585b4)) [0091.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.545] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5cc8 [0091.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5cc8 | out: hHeap=0x260000) returned 1 [0091.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.546] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.546] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.546] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.546] GetLastError () returned 0x0 [0091.546] GetLastError () returned 0x0 [0091.546] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.547] GetLastError () returned 0x0 [0091.547] GetLastError () returned 0x0 [0091.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff030, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.558] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xfd0, lpOverlapped=0x0) returned 1 [0091.558] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.558] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.558] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.558] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.558] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.558] CloseHandle (hObject=0xf0) returned 1 [0091.558] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css.[deadmin@cock.li].deadmin")) returned 1 [0091.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.560] GetLastError () returned 0x0 [0091.560] RtlWakeConditionVariable () returned 0x27e828 [0091.560] GetCurrentThreadId () returned 0x9ac [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".ldf") returned 0x0 [0091.561] lstrlenW (lpString=".vhd") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".vhd") returned 0x0 [0091.561] lstrlenW (lpString=".vhdx") returned 5 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".vhdx") returned 0x0 [0091.561] lstrlenW (lpString=".pst") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".pst") returned 0x0 [0091.561] lstrlenW (lpString=".ost") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".ost") returned 0x0 [0091.561] lstrlenW (lpString=".bak") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".bak") returned 0x0 [0091.561] lstrlenW (lpString=".bac") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".bac") returned 0x0 [0091.561] lstrlenW (lpString=".sys") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".sys") returned 0x0 [0091.561] lstrlenW (lpString=".v2i") returned 4 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".v2i") returned 0x0 [0091.561] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.562] lstrlenW (lpString=".sql") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".sql") returned 0x0 [0091.563] lstrlenW (lpString=".mdf") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".mdf") returned 0x0 [0091.563] lstrlenW (lpString=".txt") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".txt") returned 0x0 [0091.563] lstrlenW (lpString=".dbf") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".dbf") returned 0x0 [0091.563] lstrlenW (lpString=".ckp") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".ckp") returned 0x0 [0091.563] lstrlenW (lpString=".dacpac") returned 7 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".dacpac") returned 0x0 [0091.563] lstrlenW (lpString=".db3") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".db3") returned 0x0 [0091.563] lstrlenW (lpString=".dtxs") returned 5 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".dtxs") returned 0x0 [0091.563] lstrlenW (lpString=".mdt") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".mdt") returned 0x0 [0091.563] lstrlenW (lpString=".sdf") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".sdf") returned 0x0 [0091.563] lstrlenW (lpString=".MDF") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".MDF") returned 0x0 [0091.563] lstrlenW (lpString=".DBF") returned 4 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".DBF") returned 0x0 [0091.563] lstrlenW (lpString=".DB") returned 3 [0091.563] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".DB") returned 0x0 [0091.563] lstrlenW (lpString=".db") returned 3 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".db") returned 0x0 [0091.564] lstrlenW (lpString=".ndf") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".ndf") returned 0x0 [0091.564] lstrlenW (lpString=".NDF") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".NDF") returned 0x0 [0091.564] lstrlenW (lpString=".Mdf") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".Mdf") returned 0x0 [0091.564] lstrlenW (lpString=".dat") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".dat") returned 0x0 [0091.564] lstrlenW (lpString=".DAT") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".DAT") returned 0x0 [0091.564] lstrlenW (lpString=".ldf") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".ldf") returned 0x0 [0091.564] lstrlenW (lpString=".LDF") returned 4 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch=".LDF") returned 0x0 [0091.564] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.564] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.565] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.565] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.565] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.565] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21156641980) returned 1 [0091.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5639170, dwHighDateTime=0x1d585b4)) [0091.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5d38 [0091.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5d38 | out: hHeap=0x260000) returned 1 [0091.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.566] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.566] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.566] GetLastError () returned 0x0 [0091.566] GetLastError () returned 0x0 [0091.566] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.567] GetLastError () returned 0x0 [0091.567] GetLastError () returned 0x0 [0091.578] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.578] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xe9, lpOverlapped=0x0) returned 1 [0091.579] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.579] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.579] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.579] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.579] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.579] CloseHandle (hObject=0xf0) returned 1 [0091.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0091.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0091.581] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.581] GetLastError () returned 0x0 [0091.581] RtlWakeConditionVariable () returned 0x27e828 [0091.581] GetCurrentThreadId () returned 0x9ac [0091.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.581] lstrlenW (lpString=".vhd") returned 4 [0091.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".vhd") returned 0x0 [0091.581] lstrlenW (lpString=".vhdx") returned 5 [0091.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".vhdx") returned 0x0 [0091.581] lstrlenW (lpString=".pst") returned 4 [0091.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".pst") returned 0x0 [0091.581] lstrlenW (lpString=".ost") returned 4 [0091.581] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".ost") returned 0x0 [0091.582] lstrlenW (lpString=".bak") returned 4 [0091.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".bak") returned 0x0 [0091.582] lstrlenW (lpString=".bac") returned 4 [0091.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".bac") returned 0x0 [0091.582] lstrlenW (lpString=".sys") returned 4 [0091.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".sys") returned 0x0 [0091.582] lstrlenW (lpString=".v2i") returned 4 [0091.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".v2i") returned 0x0 [0091.582] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.582] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.583] lstrlenW (lpString=".sql") returned 4 [0091.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".sql") returned 0x0 [0091.583] lstrlenW (lpString=".mdf") returned 4 [0091.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".mdf") returned 0x0 [0091.583] lstrlenW (lpString=".txt") returned 4 [0091.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".txt") returned 0x0 [0091.583] lstrlenW (lpString=".dbf") returned 4 [0091.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".dbf") returned 0x0 [0091.583] lstrlenW (lpString=".ckp") returned 4 [0091.583] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".ckp") returned 0x0 [0091.584] lstrlenW (lpString=".dacpac") returned 7 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".dacpac") returned 0x0 [0091.584] lstrlenW (lpString=".db3") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".db3") returned 0x0 [0091.584] lstrlenW (lpString=".dtxs") returned 5 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".dtxs") returned 0x0 [0091.584] lstrlenW (lpString=".mdt") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".mdt") returned 0x0 [0091.584] lstrlenW (lpString=".sdf") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".sdf") returned 0x0 [0091.584] lstrlenW (lpString=".MDF") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".MDF") returned 0x0 [0091.584] lstrlenW (lpString=".DBF") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".DBF") returned 0x0 [0091.584] lstrlenW (lpString=".DB") returned 3 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".DB") returned 0x0 [0091.584] lstrlenW (lpString=".db") returned 3 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".db") returned 0x0 [0091.584] lstrlenW (lpString=".ndf") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".ndf") returned 0x0 [0091.584] lstrlenW (lpString=".NDF") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".NDF") returned 0x0 [0091.584] lstrlenW (lpString=".Mdf") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".Mdf") returned 0x0 [0091.584] lstrlenW (lpString=".dat") returned 4 [0091.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".dat") returned 0x0 [0091.585] lstrlenW (lpString=".DAT") returned 4 [0091.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".DAT") returned 0x0 [0091.585] lstrlenW (lpString=".ldf") returned 4 [0091.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".ldf") returned 0x0 [0091.585] lstrlenW (lpString=".LDF") returned 4 [0091.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch=".LDF") returned 0x0 [0091.585] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.585] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.586] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.586] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.586] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21158705779) returned 1 [0091.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc565f2d0, dwHighDateTime=0x1d585b4)) [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5da8 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5da8 | out: hHeap=0x260000) returned 1 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.586] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.587] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.587] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.587] GetLastError () returned 0x0 [0091.587] GetLastError () returned 0x0 [0091.587] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.587] GetLastError () returned 0x0 [0091.587] GetLastError () returned 0x0 [0091.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffe32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.588] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1ce, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1ce, lpOverlapped=0x0) returned 1 [0091.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.589] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.589] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.589] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.589] CloseHandle (hObject=0xf0) returned 1 [0091.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.593] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.593] GetLastError () returned 0x0 [0091.593] RtlWakeConditionVariable () returned 0x0 [0091.593] GetCurrentThreadId () returned 0x9ac [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.594] lstrlenW (lpString=".vhd") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".vhd") returned 0x0 [0091.594] lstrlenW (lpString=".vhdx") returned 5 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".vhdx") returned 0x0 [0091.594] lstrlenW (lpString=".pst") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".pst") returned 0x0 [0091.594] lstrlenW (lpString=".ost") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".ost") returned 0x0 [0091.594] lstrlenW (lpString=".bak") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".bak") returned 0x0 [0091.594] lstrlenW (lpString=".bac") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".bac") returned 0x0 [0091.594] lstrlenW (lpString=".sys") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".sys") returned 0x0 [0091.594] lstrlenW (lpString=".v2i") returned 4 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".v2i") returned 0x0 [0091.594] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch="s\r\n.v2i") returned 0x0 [0091.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.596] lstrlenW (lpString=".sql") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".sql") returned 0x0 [0091.596] lstrlenW (lpString=".mdf") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".mdf") returned 0x0 [0091.596] lstrlenW (lpString=".txt") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".txt") returned 0x0 [0091.596] lstrlenW (lpString=".dbf") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".dbf") returned 0x0 [0091.596] lstrlenW (lpString=".ckp") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".ckp") returned 0x0 [0091.596] lstrlenW (lpString=".dacpac") returned 7 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".dacpac") returned 0x0 [0091.596] lstrlenW (lpString=".db3") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".db3") returned 0x0 [0091.596] lstrlenW (lpString=".dtxs") returned 5 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".dtxs") returned 0x0 [0091.596] lstrlenW (lpString=".mdt") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".mdt") returned 0x0 [0091.596] lstrlenW (lpString=".sdf") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".sdf") returned 0x0 [0091.596] lstrlenW (lpString=".MDF") returned 4 [0091.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".MDF") returned 0x0 [0091.596] lstrlenW (lpString=".DBF") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".DBF") returned 0x0 [0091.597] lstrlenW (lpString=".DB") returned 3 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".DB") returned 0x0 [0091.597] lstrlenW (lpString=".db") returned 3 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".db") returned 0x0 [0091.597] lstrlenW (lpString=".ndf") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".ndf") returned 0x0 [0091.597] lstrlenW (lpString=".NDF") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".NDF") returned 0x0 [0091.597] lstrlenW (lpString=".Mdf") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".Mdf") returned 0x0 [0091.597] lstrlenW (lpString=".dat") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".dat") returned 0x0 [0091.597] lstrlenW (lpString=".DAT") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".DAT") returned 0x0 [0091.597] lstrlenW (lpString=".ldf") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".ldf") returned 0x0 [0091.597] lstrlenW (lpString=".LDF") returned 4 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch=".LDF") returned 0x0 [0091.597] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.597] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.597] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.598] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.598] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.598] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.598] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21159956484) returned 1 [0091.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5685430, dwHighDateTime=0x1d585b4)) [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5de0 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5de0 | out: hHeap=0x260000) returned 1 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.599] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.599] GetLastError () returned 0x0 [0091.600] GetLastError () returned 0x0 [0091.600] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.600] GetLastError () returned 0x0 [0091.600] GetLastError () returned 0x0 [0091.601] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.601] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x108, lpOverlapped=0x0) returned 1 [0091.601] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.601] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.601] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.601] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.601] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.602] CloseHandle (hObject=0xf0) returned 1 [0091.602] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.603] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.603] GetLastError () returned 0x0 [0091.604] RtlWakeConditionVariable () returned 0x27e828 [0091.604] GetCurrentThreadId () returned 0x9ac [0091.604] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.604] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.604] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.604] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.606] CloseHandle (hObject=0xf0) returned 1 [0091.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b368 | out: hHeap=0x260000) returned 1 [0091.606] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35af08 | out: hHeap=0x260000) returned 1 [0091.606] RtlWakeConditionVariable () returned 0x27e828 [0091.606] GetCurrentThreadId () returned 0x9ac [0091.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".ldf") returned 0x0 [0091.606] lstrlenW (lpString=".vhd") returned 4 [0091.606] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".vhd") returned 0x0 [0091.606] lstrlenW (lpString=".vhdx") returned 5 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".vhdx") returned 0x0 [0091.607] lstrlenW (lpString=".pst") returned 4 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".pst") returned 0x0 [0091.607] lstrlenW (lpString=".ost") returned 4 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".ost") returned 0x0 [0091.607] lstrlenW (lpString=".bak") returned 4 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".bak") returned 0x0 [0091.607] lstrlenW (lpString=".bac") returned 4 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".bac") returned 0x0 [0091.607] lstrlenW (lpString=".sys") returned 4 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".sys") returned 0x0 [0091.607] lstrlenW (lpString=".v2i") returned 4 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".v2i") returned 0x0 [0091.607] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.607] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.608] lstrlenW (lpString=".sql") returned 4 [0091.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".sql") returned 0x0 [0091.608] lstrlenW (lpString=".mdf") returned 4 [0091.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".mdf") returned 0x0 [0091.608] lstrlenW (lpString=".txt") returned 4 [0091.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".txt") returned 0x0 [0091.608] lstrlenW (lpString=".dbf") returned 4 [0091.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".dbf") returned 0x0 [0091.608] lstrlenW (lpString=".ckp") returned 4 [0091.608] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".ckp") returned 0x0 [0091.609] lstrlenW (lpString=".dacpac") returned 7 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".dacpac") returned 0x0 [0091.609] lstrlenW (lpString=".db3") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".db3") returned 0x0 [0091.609] lstrlenW (lpString=".dtxs") returned 5 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".dtxs") returned 0x0 [0091.609] lstrlenW (lpString=".mdt") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".mdt") returned 0x0 [0091.609] lstrlenW (lpString=".sdf") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".sdf") returned 0x0 [0091.609] lstrlenW (lpString=".MDF") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".MDF") returned 0x0 [0091.609] lstrlenW (lpString=".DBF") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".DBF") returned 0x0 [0091.609] lstrlenW (lpString=".DB") returned 3 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".DB") returned 0x0 [0091.609] lstrlenW (lpString=".db") returned 3 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".db") returned 0x0 [0091.609] lstrlenW (lpString=".ndf") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".ndf") returned 0x0 [0091.609] lstrlenW (lpString=".NDF") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".NDF") returned 0x0 [0091.609] lstrlenW (lpString=".Mdf") returned 4 [0091.609] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".Mdf") returned 0x0 [0091.609] lstrlenW (lpString=".dat") returned 4 [0091.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".dat") returned 0x0 [0091.610] lstrlenW (lpString=".DAT") returned 4 [0091.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".DAT") returned 0x0 [0091.610] lstrlenW (lpString=".ldf") returned 4 [0091.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".ldf") returned 0x0 [0091.610] lstrlenW (lpString=".LDF") returned 4 [0091.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch=".LDF") returned 0x0 [0091.610] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.610] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.610] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.611] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.611] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.611] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21161206981) returned 1 [0091.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc56ab590, dwHighDateTime=0x1d585b4)) [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b5e50 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b5e50 | out: hHeap=0x260000) returned 1 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.612] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.612] GetLastError () returned 0x0 [0091.612] GetLastError () returned 0x0 [0091.612] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.612] GetLastError () returned 0x0 [0091.612] GetLastError () returned 0x0 [0091.701] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffef82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.701] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x107e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x107e, lpOverlapped=0x0) returned 1 [0091.701] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.702] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.702] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.702] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.702] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.702] CloseHandle (hObject=0xf0) returned 1 [0091.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0091.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css.[deadmin@cock.li].deadmin")) returned 1 [0091.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0091.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.704] GetLastError () returned 0x0 [0091.704] RtlWakeConditionVariable () returned 0x0 [0091.704] GetCurrentThreadId () returned 0x9ac [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".ldf") returned 0x0 [0091.705] lstrlenW (lpString=".vhd") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".vhd") returned 0x0 [0091.705] lstrlenW (lpString=".vhdx") returned 5 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".vhdx") returned 0x0 [0091.705] lstrlenW (lpString=".pst") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".pst") returned 0x0 [0091.705] lstrlenW (lpString=".ost") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".ost") returned 0x0 [0091.705] lstrlenW (lpString=".bak") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".bak") returned 0x0 [0091.705] lstrlenW (lpString=".bac") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".bac") returned 0x0 [0091.705] lstrlenW (lpString=".sys") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".sys") returned 0x0 [0091.705] lstrlenW (lpString=".v2i") returned 4 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".v2i") returned 0x0 [0091.705] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.705] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch="s\r\n.v2i") returned 0x0 [0091.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.707] lstrlenW (lpString=".sql") returned 4 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".sql") returned 0x0 [0091.707] lstrlenW (lpString=".mdf") returned 4 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".mdf") returned 0x0 [0091.707] lstrlenW (lpString=".txt") returned 4 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".txt") returned 0x0 [0091.707] lstrlenW (lpString=".dbf") returned 4 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".dbf") returned 0x0 [0091.707] lstrlenW (lpString=".ckp") returned 4 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".ckp") returned 0x0 [0091.707] lstrlenW (lpString=".dacpac") returned 7 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".dacpac") returned 0x0 [0091.707] lstrlenW (lpString=".db3") returned 4 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".db3") returned 0x0 [0091.707] lstrlenW (lpString=".dtxs") returned 5 [0091.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".dtxs") returned 0x0 [0091.708] lstrlenW (lpString=".mdt") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".mdt") returned 0x0 [0091.708] lstrlenW (lpString=".sdf") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".sdf") returned 0x0 [0091.708] lstrlenW (lpString=".MDF") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".MDF") returned 0x0 [0091.708] lstrlenW (lpString=".DBF") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".DBF") returned 0x0 [0091.708] lstrlenW (lpString=".DB") returned 3 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".DB") returned 0x0 [0091.708] lstrlenW (lpString=".db") returned 3 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".db") returned 0x0 [0091.708] lstrlenW (lpString=".ndf") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".ndf") returned 0x0 [0091.708] lstrlenW (lpString=".NDF") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".NDF") returned 0x0 [0091.708] lstrlenW (lpString=".Mdf") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".Mdf") returned 0x0 [0091.708] lstrlenW (lpString=".dat") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".dat") returned 0x0 [0091.708] lstrlenW (lpString=".DAT") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".DAT") returned 0x0 [0091.708] lstrlenW (lpString=".ldf") returned 4 [0091.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".ldf") returned 0x0 [0091.708] lstrlenW (lpString=".LDF") returned 4 [0091.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch=".LDF") returned 0x0 [0091.709] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.709] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.709] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.710] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.710] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21171085216) returned 1 [0091.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc578fdd0, dwHighDateTime=0x1d585b4)) [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6048 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6048 | out: hHeap=0x260000) returned 1 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.710] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.710] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.711] GetLastError () returned 0x0 [0091.711] GetLastError () returned 0x0 [0091.711] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.711] GetLastError () returned 0x0 [0091.711] GetLastError () returned 0x0 [0091.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff8cd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.721] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x733, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x733, lpOverlapped=0x0) returned 1 [0091.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.721] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.721] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.722] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.722] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.722] CloseHandle (hObject=0xf0) returned 1 [0091.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css.[deadmin@cock.li].deadmin")) returned 1 [0091.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.724] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.724] GetLastError () returned 0x0 [0091.724] RtlWakeConditionVariable () returned 0x0 [0091.724] GetCurrentThreadId () returned 0x9ac [0091.725] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.725] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0091.725] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0091.725] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0091.727] CloseHandle (hObject=0xf0) returned 1 [0091.727] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d79d0 | out: hHeap=0x260000) returned 1 [0091.728] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0091.728] RtlWakeConditionVariable () returned 0x27e828 [0091.728] GetCurrentThreadId () returned 0x9ac [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".ldf") returned 0x0 [0091.728] lstrlenW (lpString=".vhd") returned 4 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".vhd") returned 0x0 [0091.728] lstrlenW (lpString=".vhdx") returned 5 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".vhdx") returned 0x0 [0091.728] lstrlenW (lpString=".pst") returned 4 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".pst") returned 0x0 [0091.728] lstrlenW (lpString=".ost") returned 4 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".ost") returned 0x0 [0091.728] lstrlenW (lpString=".bak") returned 4 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".bak") returned 0x0 [0091.728] lstrlenW (lpString=".bac") returned 4 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".bac") returned 0x0 [0091.728] lstrlenW (lpString=".sys") returned 4 [0091.728] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".sys") returned 0x0 [0091.729] lstrlenW (lpString=".v2i") returned 4 [0091.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".v2i") returned 0x0 [0091.729] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.729] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch="s\r\n.v2i") returned 0x0 [0091.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.730] lstrlenW (lpString=".sql") returned 4 [0091.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".sql") returned 0x0 [0091.730] lstrlenW (lpString=".mdf") returned 4 [0091.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".mdf") returned 0x0 [0091.730] lstrlenW (lpString=".txt") returned 4 [0091.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".txt") returned 0x0 [0091.730] lstrlenW (lpString=".dbf") returned 4 [0091.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".dbf") returned 0x0 [0091.730] lstrlenW (lpString=".ckp") returned 4 [0091.730] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".ckp") returned 0x0 [0091.730] lstrlenW (lpString=".dacpac") returned 7 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".dacpac") returned 0x0 [0091.731] lstrlenW (lpString=".db3") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".db3") returned 0x0 [0091.731] lstrlenW (lpString=".dtxs") returned 5 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".dtxs") returned 0x0 [0091.731] lstrlenW (lpString=".mdt") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".mdt") returned 0x0 [0091.731] lstrlenW (lpString=".sdf") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".sdf") returned 0x0 [0091.731] lstrlenW (lpString=".MDF") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".MDF") returned 0x0 [0091.731] lstrlenW (lpString=".DBF") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".DBF") returned 0x0 [0091.731] lstrlenW (lpString=".DB") returned 3 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".DB") returned 0x0 [0091.731] lstrlenW (lpString=".db") returned 3 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".db") returned 0x0 [0091.731] lstrlenW (lpString=".ndf") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".ndf") returned 0x0 [0091.731] lstrlenW (lpString=".NDF") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".NDF") returned 0x0 [0091.731] lstrlenW (lpString=".Mdf") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".Mdf") returned 0x0 [0091.731] lstrlenW (lpString=".dat") returned 4 [0091.731] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".dat") returned 0x0 [0091.731] lstrlenW (lpString=".DAT") returned 4 [0091.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".DAT") returned 0x0 [0091.732] lstrlenW (lpString=".ldf") returned 4 [0091.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".ldf") returned 0x0 [0091.732] lstrlenW (lpString=".LDF") returned 4 [0091.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch=".LDF") returned 0x0 [0091.732] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.732] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.733] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.733] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0091.733] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21173404608) returned 1 [0091.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc57dc090, dwHighDateTime=0x1d585b4)) [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b60b8 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b60b8 | out: hHeap=0x260000) returned 1 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.733] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.734] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.734] GetLastError () returned 0x0 [0091.734] GetLastError () returned 0x0 [0091.734] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.734] GetLastError () returned 0x0 [0091.734] GetLastError () returned 0x0 [0091.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.736] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0091.736] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0091.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.736] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.736] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.736] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.737] CloseHandle (hObject=0xf0) returned 1 [0091.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.[deadmin@cock.li].deadmin")) returned 1 [0091.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.738] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0091.738] GetLastError () returned 0x0 [0091.739] RtlWakeConditionVariable () returned 0x0 [0091.739] GetCurrentThreadId () returned 0x9ac [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0091.739] lstrlenW (lpString=".vhd") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".vhd") returned 0x0 [0091.739] lstrlenW (lpString=".vhdx") returned 5 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".vhdx") returned 0x0 [0091.739] lstrlenW (lpString=".pst") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".pst") returned 0x0 [0091.739] lstrlenW (lpString=".ost") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".ost") returned 0x0 [0091.739] lstrlenW (lpString=".bak") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".bak") returned 0x0 [0091.739] lstrlenW (lpString=".bac") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".bac") returned 0x0 [0091.739] lstrlenW (lpString=".sys") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".sys") returned 0x0 [0091.739] lstrlenW (lpString=".v2i") returned 4 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".v2i") returned 0x0 [0091.739] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.739] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0091.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.741] lstrlenW (lpString=".sql") returned 4 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".sql") returned 0x0 [0091.741] lstrlenW (lpString=".mdf") returned 4 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".mdf") returned 0x0 [0091.741] lstrlenW (lpString=".txt") returned 4 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".txt") returned 0x0 [0091.741] lstrlenW (lpString=".dbf") returned 4 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".dbf") returned 0x0 [0091.741] lstrlenW (lpString=".ckp") returned 4 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".ckp") returned 0x0 [0091.741] lstrlenW (lpString=".dacpac") returned 7 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".dacpac") returned 0x0 [0091.741] lstrlenW (lpString=".db3") returned 4 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".db3") returned 0x0 [0091.741] lstrlenW (lpString=".dtxs") returned 5 [0091.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".dtxs") returned 0x0 [0091.741] lstrlenW (lpString=".mdt") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".mdt") returned 0x0 [0091.742] lstrlenW (lpString=".sdf") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".sdf") returned 0x0 [0091.742] lstrlenW (lpString=".MDF") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".MDF") returned 0x0 [0091.742] lstrlenW (lpString=".DBF") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".DBF") returned 0x0 [0091.742] lstrlenW (lpString=".DB") returned 3 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".DB") returned 0x0 [0091.742] lstrlenW (lpString=".db") returned 3 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".db") returned 0x0 [0091.742] lstrlenW (lpString=".ndf") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".ndf") returned 0x0 [0091.742] lstrlenW (lpString=".NDF") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".NDF") returned 0x0 [0091.742] lstrlenW (lpString=".Mdf") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".Mdf") returned 0x0 [0091.742] lstrlenW (lpString=".dat") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".dat") returned 0x0 [0091.742] lstrlenW (lpString=".DAT") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".DAT") returned 0x0 [0091.742] lstrlenW (lpString=".ldf") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".ldf") returned 0x0 [0091.742] lstrlenW (lpString=".LDF") returned 4 [0091.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch=".LDF") returned 0x0 [0091.742] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.743] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.743] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.743] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.885] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21188655489) returned 1 [0091.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5958e50, dwHighDateTime=0x1d585b4)) [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b63c8 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b63c8 | out: hHeap=0x260000) returned 1 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.886] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.886] GetLastError () returned 0x0 [0091.887] GetLastError () returned 0x0 [0091.887] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.887] GetLastError () returned 0x0 [0091.887] GetLastError () returned 0x0 [0091.888] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffeb67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.889] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x1499, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x1499, lpOverlapped=0x0) returned 1 [0091.889] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.889] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.889] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.889] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.889] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.889] CloseHandle (hObject=0xf0) returned 1 [0091.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0091.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0091.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0091.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.892] GetLastError () returned 0x0 [0091.892] RtlWakeConditionVariable () returned 0x0 [0091.892] GetCurrentThreadId () returned 0x9ac [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".ldf") returned 0x0 [0091.892] lstrlenW (lpString=".vhd") returned 4 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".vhd") returned 0x0 [0091.892] lstrlenW (lpString=".vhdx") returned 5 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".vhdx") returned 0x0 [0091.892] lstrlenW (lpString=".pst") returned 4 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".pst") returned 0x0 [0091.892] lstrlenW (lpString=".ost") returned 4 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".ost") returned 0x0 [0091.892] lstrlenW (lpString=".bak") returned 4 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".bak") returned 0x0 [0091.892] lstrlenW (lpString=".bac") returned 4 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".bac") returned 0x0 [0091.892] lstrlenW (lpString=".sys") returned 4 [0091.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".sys") returned 0x0 [0091.892] lstrlenW (lpString=".v2i") returned 4 [0091.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".v2i") returned 0x0 [0091.893] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.893] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.894] lstrlenW (lpString=".sql") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".sql") returned 0x0 [0091.894] lstrlenW (lpString=".mdf") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".mdf") returned 0x0 [0091.894] lstrlenW (lpString=".txt") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".txt") returned 0x0 [0091.894] lstrlenW (lpString=".dbf") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".dbf") returned 0x0 [0091.894] lstrlenW (lpString=".ckp") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".ckp") returned 0x0 [0091.894] lstrlenW (lpString=".dacpac") returned 7 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".dacpac") returned 0x0 [0091.894] lstrlenW (lpString=".db3") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".db3") returned 0x0 [0091.894] lstrlenW (lpString=".dtxs") returned 5 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".dtxs") returned 0x0 [0091.894] lstrlenW (lpString=".mdt") returned 4 [0091.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".mdt") returned 0x0 [0091.894] lstrlenW (lpString=".sdf") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".sdf") returned 0x0 [0091.895] lstrlenW (lpString=".MDF") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".MDF") returned 0x0 [0091.895] lstrlenW (lpString=".DBF") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".DBF") returned 0x0 [0091.895] lstrlenW (lpString=".DB") returned 3 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".DB") returned 0x0 [0091.895] lstrlenW (lpString=".db") returned 3 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".db") returned 0x0 [0091.895] lstrlenW (lpString=".ndf") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".ndf") returned 0x0 [0091.895] lstrlenW (lpString=".NDF") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".NDF") returned 0x0 [0091.895] lstrlenW (lpString=".Mdf") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".Mdf") returned 0x0 [0091.895] lstrlenW (lpString=".dat") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".dat") returned 0x0 [0091.895] lstrlenW (lpString=".DAT") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".DAT") returned 0x0 [0091.895] lstrlenW (lpString=".ldf") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".ldf") returned 0x0 [0091.895] lstrlenW (lpString=".LDF") returned 4 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch=".LDF") returned 0x0 [0091.895] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.896] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.896] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.896] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.896] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.897] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21189770967) returned 1 [0091.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5958e50, dwHighDateTime=0x1d585b4)) [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6400 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6400 | out: hHeap=0x260000) returned 1 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.897] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.897] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.897] GetLastError () returned 0x0 [0091.898] GetLastError () returned 0x0 [0091.898] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.898] GetLastError () returned 0x0 [0091.898] GetLastError () returned 0x0 [0091.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.900] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x3ec, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x3ec, lpOverlapped=0x0) returned 1 [0091.900] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.900] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.900] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.900] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.900] CloseHandle (hObject=0xf0) returned 1 [0091.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.902] GetLastError () returned 0x0 [0091.902] RtlWakeConditionVariable () returned 0x0 [0091.902] GetCurrentThreadId () returned 0x9ac [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".ldf") returned 0x0 [0091.902] lstrlenW (lpString=".vhd") returned 4 [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".vhd") returned 0x0 [0091.902] lstrlenW (lpString=".vhdx") returned 5 [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".vhdx") returned 0x0 [0091.902] lstrlenW (lpString=".pst") returned 4 [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".pst") returned 0x0 [0091.902] lstrlenW (lpString=".ost") returned 4 [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".ost") returned 0x0 [0091.902] lstrlenW (lpString=".bak") returned 4 [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".bak") returned 0x0 [0091.902] lstrlenW (lpString=".bac") returned 4 [0091.902] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".bac") returned 0x0 [0091.903] lstrlenW (lpString=".sys") returned 4 [0091.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".sys") returned 0x0 [0091.903] lstrlenW (lpString=".v2i") returned 4 [0091.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".v2i") returned 0x0 [0091.903] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.904] lstrlenW (lpString=".sql") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".sql") returned 0x0 [0091.904] lstrlenW (lpString=".mdf") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".mdf") returned 0x0 [0091.904] lstrlenW (lpString=".txt") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".txt") returned 0x0 [0091.904] lstrlenW (lpString=".dbf") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".dbf") returned 0x0 [0091.904] lstrlenW (lpString=".ckp") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".ckp") returned 0x0 [0091.904] lstrlenW (lpString=".dacpac") returned 7 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".dacpac") returned 0x0 [0091.904] lstrlenW (lpString=".db3") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".db3") returned 0x0 [0091.904] lstrlenW (lpString=".dtxs") returned 5 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".dtxs") returned 0x0 [0091.904] lstrlenW (lpString=".mdt") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".mdt") returned 0x0 [0091.904] lstrlenW (lpString=".sdf") returned 4 [0091.904] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".sdf") returned 0x0 [0091.905] lstrlenW (lpString=".MDF") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".MDF") returned 0x0 [0091.905] lstrlenW (lpString=".DBF") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".DBF") returned 0x0 [0091.905] lstrlenW (lpString=".DB") returned 3 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".DB") returned 0x0 [0091.905] lstrlenW (lpString=".db") returned 3 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".db") returned 0x0 [0091.905] lstrlenW (lpString=".ndf") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".ndf") returned 0x0 [0091.905] lstrlenW (lpString=".NDF") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".NDF") returned 0x0 [0091.905] lstrlenW (lpString=".Mdf") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".Mdf") returned 0x0 [0091.905] lstrlenW (lpString=".dat") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".dat") returned 0x0 [0091.905] lstrlenW (lpString=".DAT") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".DAT") returned 0x0 [0091.905] lstrlenW (lpString=".ldf") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".ldf") returned 0x0 [0091.905] lstrlenW (lpString=".LDF") returned 4 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch=".LDF") returned 0x0 [0091.905] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.906] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.906] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.906] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.906] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.907] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21190768806) returned 1 [0091.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc597efb0, dwHighDateTime=0x1d585b4)) [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6438 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6438 | out: hHeap=0x260000) returned 1 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.907] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.907] GetLastError () returned 0x0 [0091.908] GetLastError () returned 0x0 [0091.908] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.908] GetLastError () returned 0x0 [0091.908] GetLastError () returned 0x0 [0091.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffc86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.910] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x37a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x37a, lpOverlapped=0x0) returned 1 [0091.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0091.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.910] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0091.910] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0091.910] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0091.910] CloseHandle (hObject=0xf0) returned 1 [0091.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b480 [0091.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.[deadmin@cock.li].deadmin")) returned 1 [0091.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b480 | out: hHeap=0x260000) returned 1 [0091.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0091.912] GetLastError () returned 0x0 [0091.912] RtlWakeConditionVariable () returned 0x0 [0091.912] GetCurrentThreadId () returned 0x9ac [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".ldf") returned 0x0 [0091.912] lstrlenW (lpString=".vhd") returned 4 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".vhd") returned 0x0 [0091.912] lstrlenW (lpString=".vhdx") returned 5 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".vhdx") returned 0x0 [0091.912] lstrlenW (lpString=".pst") returned 4 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".pst") returned 0x0 [0091.912] lstrlenW (lpString=".ost") returned 4 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".ost") returned 0x0 [0091.912] lstrlenW (lpString=".bak") returned 4 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".bak") returned 0x0 [0091.912] lstrlenW (lpString=".bac") returned 4 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".bac") returned 0x0 [0091.912] lstrlenW (lpString=".sys") returned 4 [0091.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".sys") returned 0x0 [0091.913] lstrlenW (lpString=".v2i") returned 4 [0091.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".v2i") returned 0x0 [0091.913] lstrlenW (lpString="s\r\n.v2i") returned 7 [0091.913] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch="s\r\n.v2i") returned 0x0 [0091.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.914] lstrlenW (lpString=".sql") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".sql") returned 0x0 [0091.914] lstrlenW (lpString=".mdf") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".mdf") returned 0x0 [0091.914] lstrlenW (lpString=".txt") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".txt") returned 0x0 [0091.914] lstrlenW (lpString=".dbf") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".dbf") returned 0x0 [0091.914] lstrlenW (lpString=".ckp") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".ckp") returned 0x0 [0091.914] lstrlenW (lpString=".dacpac") returned 7 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".dacpac") returned 0x0 [0091.914] lstrlenW (lpString=".db3") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".db3") returned 0x0 [0091.914] lstrlenW (lpString=".dtxs") returned 5 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".dtxs") returned 0x0 [0091.914] lstrlenW (lpString=".mdt") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".mdt") returned 0x0 [0091.914] lstrlenW (lpString=".sdf") returned 4 [0091.914] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".sdf") returned 0x0 [0091.915] lstrlenW (lpString=".MDF") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".MDF") returned 0x0 [0091.915] lstrlenW (lpString=".DBF") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".DBF") returned 0x0 [0091.915] lstrlenW (lpString=".DB") returned 3 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".DB") returned 0x0 [0091.915] lstrlenW (lpString=".db") returned 3 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".db") returned 0x0 [0091.915] lstrlenW (lpString=".ndf") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".ndf") returned 0x0 [0091.915] lstrlenW (lpString=".NDF") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".NDF") returned 0x0 [0091.915] lstrlenW (lpString=".Mdf") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".Mdf") returned 0x0 [0091.915] lstrlenW (lpString=".dat") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".dat") returned 0x0 [0091.915] lstrlenW (lpString=".DAT") returned 4 [0091.915] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".DAT") returned 0x0 [0091.916] lstrlenW (lpString=".ldf") returned 4 [0091.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".ldf") returned 0x0 [0091.916] lstrlenW (lpString=".LDF") returned 4 [0091.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch=".LDF") returned 0x0 [0091.916] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0091.916] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0091.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0091.916] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0091.916] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0091.917] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0091.917] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0091.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0091.917] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21191798705) returned 1 [0091.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc59a5110, dwHighDateTime=0x1d585b4)) [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6470 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0091.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6470 | out: hHeap=0x260000) returned 1 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0091.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0091.917] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0091.917] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0091.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0091.918] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0091.918] GetLastError () returned 0x0 [0091.918] GetLastError () returned 0x0 [0091.918] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0091.918] GetLastError () returned 0x0 [0091.918] GetLastError () returned 0x0 [0092.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffca1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.049] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x35f, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x35f, lpOverlapped=0x0) returned 1 [0092.049] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.049] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.049] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.049] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.049] CloseHandle (hObject=0xf0) returned 1 [0092.049] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.051] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.051] GetLastError () returned 0x0 [0092.051] RtlWakeConditionVariable () returned 0x0 [0092.051] GetCurrentThreadId () returned 0x9ac [0092.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".ldf") returned 0x0 [0092.051] lstrlenW (lpString=".vhd") returned 4 [0092.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".vhd") returned 0x0 [0092.051] lstrlenW (lpString=".vhdx") returned 5 [0092.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".vhdx") returned 0x0 [0092.051] lstrlenW (lpString=".pst") returned 4 [0092.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".pst") returned 0x0 [0092.051] lstrlenW (lpString=".ost") returned 4 [0092.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".ost") returned 0x0 [0092.051] lstrlenW (lpString=".bak") returned 4 [0092.051] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".bak") returned 0x0 [0092.052] lstrlenW (lpString=".bac") returned 4 [0092.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".bac") returned 0x0 [0092.052] lstrlenW (lpString=".sys") returned 4 [0092.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".sys") returned 0x0 [0092.052] lstrlenW (lpString=".v2i") returned 4 [0092.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".v2i") returned 0x0 [0092.052] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.052] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.053] lstrlenW (lpString=".sql") returned 4 [0092.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".sql") returned 0x0 [0092.053] lstrlenW (lpString=".mdf") returned 4 [0092.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".mdf") returned 0x0 [0092.053] lstrlenW (lpString=".txt") returned 4 [0092.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".txt") returned 0x0 [0092.053] lstrlenW (lpString=".dbf") returned 4 [0092.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".dbf") returned 0x0 [0092.053] lstrlenW (lpString=".ckp") returned 4 [0092.053] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".ckp") returned 0x0 [0092.054] lstrlenW (lpString=".dacpac") returned 7 [0092.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".dacpac") returned 0x0 [0092.054] lstrlenW (lpString=".db3") returned 4 [0092.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".db3") returned 0x0 [0092.054] lstrlenW (lpString=".dtxs") returned 5 [0092.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".dtxs") returned 0x0 [0092.054] lstrlenW (lpString=".mdt") returned 4 [0092.054] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".mdt") returned 0x0 [0092.054] lstrlenW (lpString=".sdf") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".sdf") returned 0x0 [0092.055] lstrlenW (lpString=".MDF") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".MDF") returned 0x0 [0092.055] lstrlenW (lpString=".DBF") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".DBF") returned 0x0 [0092.055] lstrlenW (lpString=".DB") returned 3 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".DB") returned 0x0 [0092.055] lstrlenW (lpString=".db") returned 3 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".db") returned 0x0 [0092.055] lstrlenW (lpString=".ndf") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".ndf") returned 0x0 [0092.055] lstrlenW (lpString=".NDF") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".NDF") returned 0x0 [0092.055] lstrlenW (lpString=".Mdf") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".Mdf") returned 0x0 [0092.055] lstrlenW (lpString=".dat") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".dat") returned 0x0 [0092.055] lstrlenW (lpString=".DAT") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".DAT") returned 0x0 [0092.055] lstrlenW (lpString=".ldf") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".ldf") returned 0x0 [0092.055] lstrlenW (lpString=".LDF") returned 4 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch=".LDF") returned 0x0 [0092.055] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.056] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.056] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.056] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.057] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21205779047) returned 1 [0092.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5afbd70, dwHighDateTime=0x1d585b4)) [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b66d8 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b66d8 | out: hHeap=0x260000) returned 1 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.057] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.057] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.058] GetLastError () returned 0x0 [0092.058] GetLastError () returned 0x0 [0092.058] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.058] GetLastError () returned 0x0 [0092.058] GetLastError () returned 0x0 [0092.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff9b4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.060] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x64b3, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x64b3, lpOverlapped=0x0) returned 1 [0092.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.060] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.060] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.060] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.060] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.060] CloseHandle (hObject=0xf0) returned 1 [0092.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js.[deadmin@cock.li].deadmin")) returned 1 [0092.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.062] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.062] GetLastError () returned 0x0 [0092.062] RtlWakeConditionVariable () returned 0x0 [0092.062] GetCurrentThreadId () returned 0x9ac [0092.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".ldf") returned 0x0 [0092.062] lstrlenW (lpString=".vhd") returned 4 [0092.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".vhd") returned 0x0 [0092.062] lstrlenW (lpString=".vhdx") returned 5 [0092.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".vhdx") returned 0x0 [0092.062] lstrlenW (lpString=".pst") returned 4 [0092.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".pst") returned 0x0 [0092.062] lstrlenW (lpString=".ost") returned 4 [0092.062] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".ost") returned 0x0 [0092.063] lstrlenW (lpString=".bak") returned 4 [0092.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".bak") returned 0x0 [0092.063] lstrlenW (lpString=".bac") returned 4 [0092.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".bac") returned 0x0 [0092.063] lstrlenW (lpString=".sys") returned 4 [0092.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".sys") returned 0x0 [0092.063] lstrlenW (lpString=".v2i") returned 4 [0092.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".v2i") returned 0x0 [0092.063] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.063] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.064] lstrlenW (lpString=".sql") returned 4 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".sql") returned 0x0 [0092.064] lstrlenW (lpString=".mdf") returned 4 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".mdf") returned 0x0 [0092.064] lstrlenW (lpString=".txt") returned 4 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".txt") returned 0x0 [0092.064] lstrlenW (lpString=".dbf") returned 4 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".dbf") returned 0x0 [0092.064] lstrlenW (lpString=".ckp") returned 4 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".ckp") returned 0x0 [0092.064] lstrlenW (lpString=".dacpac") returned 7 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".dacpac") returned 0x0 [0092.064] lstrlenW (lpString=".db3") returned 4 [0092.064] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".db3") returned 0x0 [0092.064] lstrlenW (lpString=".dtxs") returned 5 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".dtxs") returned 0x0 [0092.065] lstrlenW (lpString=".mdt") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".mdt") returned 0x0 [0092.065] lstrlenW (lpString=".sdf") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".sdf") returned 0x0 [0092.065] lstrlenW (lpString=".MDF") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".MDF") returned 0x0 [0092.065] lstrlenW (lpString=".DBF") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".DBF") returned 0x0 [0092.065] lstrlenW (lpString=".DB") returned 3 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".DB") returned 0x0 [0092.065] lstrlenW (lpString=".db") returned 3 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".db") returned 0x0 [0092.065] lstrlenW (lpString=".ndf") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".ndf") returned 0x0 [0092.065] lstrlenW (lpString=".NDF") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".NDF") returned 0x0 [0092.065] lstrlenW (lpString=".Mdf") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".Mdf") returned 0x0 [0092.065] lstrlenW (lpString=".dat") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".dat") returned 0x0 [0092.065] lstrlenW (lpString=".DAT") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".DAT") returned 0x0 [0092.065] lstrlenW (lpString=".ldf") returned 4 [0092.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".ldf") returned 0x0 [0092.065] lstrlenW (lpString=".LDF") returned 4 [0092.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch=".LDF") returned 0x0 [0092.066] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.066] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.066] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.066] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.067] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21206779999) returned 1 [0092.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5afbd70, dwHighDateTime=0x1d585b4)) [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6710 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6710 | out: hHeap=0x260000) returned 1 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.067] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.068] GetLastError () returned 0x0 [0092.068] GetLastError () returned 0x0 [0092.068] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.068] GetLastError () returned 0x0 [0092.068] GetLastError () returned 0x0 [0092.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.069] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13e, lpOverlapped=0x0) returned 1 [0092.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.069] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.069] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.069] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.070] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.070] CloseHandle (hObject=0xf0) returned 1 [0092.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.071] GetLastError () returned 0x0 [0092.072] RtlWakeConditionVariable () returned 0x27e828 [0092.072] GetCurrentThreadId () returned 0x9ac [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".ldf") returned 0x0 [0092.072] lstrlenW (lpString=".vhd") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".vhd") returned 0x0 [0092.072] lstrlenW (lpString=".vhdx") returned 5 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".vhdx") returned 0x0 [0092.072] lstrlenW (lpString=".pst") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".pst") returned 0x0 [0092.072] lstrlenW (lpString=".ost") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".ost") returned 0x0 [0092.072] lstrlenW (lpString=".bak") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".bak") returned 0x0 [0092.072] lstrlenW (lpString=".bac") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".bac") returned 0x0 [0092.072] lstrlenW (lpString=".sys") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".sys") returned 0x0 [0092.072] lstrlenW (lpString=".v2i") returned 4 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".v2i") returned 0x0 [0092.072] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.072] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch="s\r\n.v2i") returned 0x0 [0092.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.073] lstrlenW (lpString=".sql") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".sql") returned 0x0 [0092.074] lstrlenW (lpString=".mdf") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".mdf") returned 0x0 [0092.074] lstrlenW (lpString=".txt") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".txt") returned 0x0 [0092.074] lstrlenW (lpString=".dbf") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".dbf") returned 0x0 [0092.074] lstrlenW (lpString=".ckp") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".ckp") returned 0x0 [0092.074] lstrlenW (lpString=".dacpac") returned 7 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".dacpac") returned 0x0 [0092.074] lstrlenW (lpString=".db3") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".db3") returned 0x0 [0092.074] lstrlenW (lpString=".dtxs") returned 5 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".dtxs") returned 0x0 [0092.074] lstrlenW (lpString=".mdt") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".mdt") returned 0x0 [0092.074] lstrlenW (lpString=".sdf") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".sdf") returned 0x0 [0092.074] lstrlenW (lpString=".MDF") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".MDF") returned 0x0 [0092.074] lstrlenW (lpString=".DBF") returned 4 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".DBF") returned 0x0 [0092.074] lstrlenW (lpString=".DB") returned 3 [0092.074] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".DB") returned 0x0 [0092.074] lstrlenW (lpString=".db") returned 3 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".db") returned 0x0 [0092.075] lstrlenW (lpString=".ndf") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".ndf") returned 0x0 [0092.075] lstrlenW (lpString=".NDF") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".NDF") returned 0x0 [0092.075] lstrlenW (lpString=".Mdf") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".Mdf") returned 0x0 [0092.075] lstrlenW (lpString=".dat") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".dat") returned 0x0 [0092.075] lstrlenW (lpString=".DAT") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".DAT") returned 0x0 [0092.075] lstrlenW (lpString=".ldf") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".ldf") returned 0x0 [0092.075] lstrlenW (lpString=".LDF") returned 4 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch=".LDF") returned 0x0 [0092.075] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.075] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.075] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.075] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.076] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.076] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.076] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.076] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21207742271) returned 1 [0092.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5b21ed0, dwHighDateTime=0x1d585b4)) [0092.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.076] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6748 [0092.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6748 | out: hHeap=0x260000) returned 1 [0092.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.077] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.077] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.077] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.077] GetLastError () returned 0x0 [0092.077] GetLastError () returned 0x0 [0092.077] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.078] GetLastError () returned 0x0 [0092.078] GetLastError () returned 0x0 [0092.079] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdf6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.080] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2095, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2095, lpOverlapped=0x0) returned 1 [0092.080] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.080] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.080] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.080] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.080] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.080] CloseHandle (hObject=0xf0) returned 1 [0092.080] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0092.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js.[deadmin@cock.li].deadmin")) returned 1 [0092.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0092.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.081] GetLastError () returned 0x0 [0092.082] RtlWakeConditionVariable () returned 0x0 [0092.082] GetCurrentThreadId () returned 0x9ac [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".ldf") returned 0x0 [0092.082] lstrlenW (lpString=".vhd") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".vhd") returned 0x0 [0092.082] lstrlenW (lpString=".vhdx") returned 5 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".vhdx") returned 0x0 [0092.082] lstrlenW (lpString=".pst") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".pst") returned 0x0 [0092.082] lstrlenW (lpString=".ost") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".ost") returned 0x0 [0092.082] lstrlenW (lpString=".bak") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".bak") returned 0x0 [0092.082] lstrlenW (lpString=".bac") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".bac") returned 0x0 [0092.082] lstrlenW (lpString=".sys") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".sys") returned 0x0 [0092.082] lstrlenW (lpString=".v2i") returned 4 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".v2i") returned 0x0 [0092.082] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.082] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.083] lstrlenW (lpString=".sql") returned 4 [0092.083] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".sql") returned 0x0 [0092.083] lstrlenW (lpString=".mdf") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".mdf") returned 0x0 [0092.084] lstrlenW (lpString=".txt") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".txt") returned 0x0 [0092.084] lstrlenW (lpString=".dbf") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".dbf") returned 0x0 [0092.084] lstrlenW (lpString=".ckp") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".ckp") returned 0x0 [0092.084] lstrlenW (lpString=".dacpac") returned 7 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".dacpac") returned 0x0 [0092.084] lstrlenW (lpString=".db3") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".db3") returned 0x0 [0092.084] lstrlenW (lpString=".dtxs") returned 5 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".dtxs") returned 0x0 [0092.084] lstrlenW (lpString=".mdt") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".mdt") returned 0x0 [0092.084] lstrlenW (lpString=".sdf") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".sdf") returned 0x0 [0092.084] lstrlenW (lpString=".MDF") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".MDF") returned 0x0 [0092.084] lstrlenW (lpString=".DBF") returned 4 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".DBF") returned 0x0 [0092.084] lstrlenW (lpString=".DB") returned 3 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".DB") returned 0x0 [0092.084] lstrlenW (lpString=".db") returned 3 [0092.084] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".db") returned 0x0 [0092.084] lstrlenW (lpString=".ndf") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".ndf") returned 0x0 [0092.085] lstrlenW (lpString=".NDF") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".NDF") returned 0x0 [0092.085] lstrlenW (lpString=".Mdf") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".Mdf") returned 0x0 [0092.085] lstrlenW (lpString=".dat") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".dat") returned 0x0 [0092.085] lstrlenW (lpString=".DAT") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".DAT") returned 0x0 [0092.085] lstrlenW (lpString=".ldf") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".ldf") returned 0x0 [0092.085] lstrlenW (lpString=".LDF") returned 4 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch=".LDF") returned 0x0 [0092.085] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.085] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.085] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.086] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.086] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.086] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21208728118) returned 1 [0092.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5b21ed0, dwHighDateTime=0x1d585b4)) [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6780 [0092.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x27790c0 [0092.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6780 | out: hHeap=0x260000) returned 1 [0092.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27790c0 | out: hHeap=0x260000) returned 1 [0092.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.128] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.128] GetLastError () returned 0x0 [0092.128] GetLastError () returned 0x0 [0092.128] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.128] GetLastError () returned 0x0 [0092.129] GetLastError () returned 0x0 [0092.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff288, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.130] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xd78, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xd78, lpOverlapped=0x0) returned 1 [0092.130] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0092.130] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.130] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.131] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.131] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.131] CloseHandle (hObject=0xf0) returned 1 [0092.165] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b250 [0092.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b250 | out: hHeap=0x260000) returned 1 [0092.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.177] GetLastError () returned 0x0 [0092.177] RtlWakeConditionVariable () returned 0x0 [0092.177] GetCurrentThreadId () returned 0x9ac [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0092.178] lstrlenW (lpString=".vhd") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".vhd") returned 0x0 [0092.178] lstrlenW (lpString=".vhdx") returned 5 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".vhdx") returned 0x0 [0092.178] lstrlenW (lpString=".pst") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".pst") returned 0x0 [0092.178] lstrlenW (lpString=".ost") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".ost") returned 0x0 [0092.178] lstrlenW (lpString=".bak") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".bak") returned 0x0 [0092.178] lstrlenW (lpString=".bac") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".bac") returned 0x0 [0092.178] lstrlenW (lpString=".sys") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".sys") returned 0x0 [0092.178] lstrlenW (lpString=".v2i") returned 4 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".v2i") returned 0x0 [0092.178] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.178] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.179] lstrlenW (lpString=".sql") returned 4 [0092.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".sql") returned 0x0 [0092.179] lstrlenW (lpString=".mdf") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".mdf") returned 0x0 [0092.180] lstrlenW (lpString=".txt") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".txt") returned 0x0 [0092.180] lstrlenW (lpString=".dbf") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".dbf") returned 0x0 [0092.180] lstrlenW (lpString=".ckp") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".ckp") returned 0x0 [0092.180] lstrlenW (lpString=".dacpac") returned 7 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".dacpac") returned 0x0 [0092.180] lstrlenW (lpString=".db3") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".db3") returned 0x0 [0092.180] lstrlenW (lpString=".dtxs") returned 5 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".dtxs") returned 0x0 [0092.180] lstrlenW (lpString=".mdt") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".mdt") returned 0x0 [0092.180] lstrlenW (lpString=".sdf") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".sdf") returned 0x0 [0092.180] lstrlenW (lpString=".MDF") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".MDF") returned 0x0 [0092.180] lstrlenW (lpString=".DBF") returned 4 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".DBF") returned 0x0 [0092.180] lstrlenW (lpString=".DB") returned 3 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".DB") returned 0x0 [0092.180] lstrlenW (lpString=".db") returned 3 [0092.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".db") returned 0x0 [0092.180] lstrlenW (lpString=".ndf") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".ndf") returned 0x0 [0092.181] lstrlenW (lpString=".NDF") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".NDF") returned 0x0 [0092.181] lstrlenW (lpString=".Mdf") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".Mdf") returned 0x0 [0092.181] lstrlenW (lpString=".dat") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".dat") returned 0x0 [0092.181] lstrlenW (lpString=".DAT") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".DAT") returned 0x0 [0092.181] lstrlenW (lpString=".ldf") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".ldf") returned 0x0 [0092.181] lstrlenW (lpString=".LDF") returned 4 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch=".LDF") returned 0x0 [0092.181] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.181] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.182] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.182] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.182] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21218334099) returned 1 [0092.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5c2c870, dwHighDateTime=0x1d585b4)) [0092.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6978 [0092.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6978 | out: hHeap=0x260000) returned 1 [0092.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.183] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.183] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.183] GetLastError () returned 0x0 [0092.183] GetLastError () returned 0x0 [0092.183] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.183] GetLastError () returned 0x0 [0092.184] GetLastError () returned 0x0 [0092.186] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff7d7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.186] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x829, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x829, lpOverlapped=0x0) returned 1 [0092.187] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.187] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.187] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.187] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.187] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.187] CloseHandle (hObject=0xf0) returned 1 [0092.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28380a0 [0092.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.[deadmin@cock.li].deadmin")) returned 1 [0092.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28380a0 | out: hHeap=0x260000) returned 1 [0092.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.189] GetLastError () returned 0x0 [0092.189] RtlWakeConditionVariable () returned 0x0 [0092.189] GetCurrentThreadId () returned 0x9ac [0092.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".ldf") returned 0x0 [0092.189] lstrlenW (lpString=".vhd") returned 4 [0092.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".vhd") returned 0x0 [0092.189] lstrlenW (lpString=".vhdx") returned 5 [0092.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".vhdx") returned 0x0 [0092.189] lstrlenW (lpString=".pst") returned 4 [0092.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".pst") returned 0x0 [0092.189] lstrlenW (lpString=".ost") returned 4 [0092.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".ost") returned 0x0 [0092.189] lstrlenW (lpString=".bak") returned 4 [0092.189] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".bak") returned 0x0 [0092.190] lstrlenW (lpString=".bac") returned 4 [0092.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".bac") returned 0x0 [0092.190] lstrlenW (lpString=".sys") returned 4 [0092.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".sys") returned 0x0 [0092.190] lstrlenW (lpString=".v2i") returned 4 [0092.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".v2i") returned 0x0 [0092.190] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.190] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.191] lstrlenW (lpString=".sql") returned 4 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".sql") returned 0x0 [0092.191] lstrlenW (lpString=".mdf") returned 4 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".mdf") returned 0x0 [0092.191] lstrlenW (lpString=".txt") returned 4 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".txt") returned 0x0 [0092.191] lstrlenW (lpString=".dbf") returned 4 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".dbf") returned 0x0 [0092.191] lstrlenW (lpString=".ckp") returned 4 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".ckp") returned 0x0 [0092.191] lstrlenW (lpString=".dacpac") returned 7 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".dacpac") returned 0x0 [0092.191] lstrlenW (lpString=".db3") returned 4 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".db3") returned 0x0 [0092.191] lstrlenW (lpString=".dtxs") returned 5 [0092.191] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".dtxs") returned 0x0 [0092.191] lstrlenW (lpString=".mdt") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".mdt") returned 0x0 [0092.192] lstrlenW (lpString=".sdf") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".sdf") returned 0x0 [0092.192] lstrlenW (lpString=".MDF") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".MDF") returned 0x0 [0092.192] lstrlenW (lpString=".DBF") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".DBF") returned 0x0 [0092.192] lstrlenW (lpString=".DB") returned 3 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".DB") returned 0x0 [0092.192] lstrlenW (lpString=".db") returned 3 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".db") returned 0x0 [0092.192] lstrlenW (lpString=".ndf") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".ndf") returned 0x0 [0092.192] lstrlenW (lpString=".NDF") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".NDF") returned 0x0 [0092.192] lstrlenW (lpString=".Mdf") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".Mdf") returned 0x0 [0092.192] lstrlenW (lpString=".dat") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".dat") returned 0x0 [0092.192] lstrlenW (lpString=".DAT") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".DAT") returned 0x0 [0092.192] lstrlenW (lpString=".ldf") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".ldf") returned 0x0 [0092.192] lstrlenW (lpString=".LDF") returned 4 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch=".LDF") returned 0x0 [0092.192] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.193] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.193] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.193] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.194] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21219472816) returned 1 [0092.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5c2c870, dwHighDateTime=0x1d585b4)) [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b69b0 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b69b0 | out: hHeap=0x260000) returned 1 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.194] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.194] GetLastError () returned 0x0 [0092.195] GetLastError () returned 0x0 [0092.195] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.195] GetLastError () returned 0x0 [0092.195] GetLastError () returned 0x0 [0092.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffd11, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.197] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x2ef, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x2ef, lpOverlapped=0x0) returned 1 [0092.197] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.197] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.197] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.197] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.197] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.197] CloseHandle (hObject=0xf0) returned 1 [0092.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b250 [0092.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.[deadmin@cock.li].deadmin")) returned 1 [0092.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b250 | out: hHeap=0x260000) returned 1 [0092.199] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.199] GetLastError () returned 0x0 [0092.199] RtlWakeConditionVariable () returned 0x0 [0092.199] GetCurrentThreadId () returned 0x9ac [0092.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".ldf") returned 0x0 [0092.199] lstrlenW (lpString=".vhd") returned 4 [0092.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".vhd") returned 0x0 [0092.199] lstrlenW (lpString=".vhdx") returned 5 [0092.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".vhdx") returned 0x0 [0092.199] lstrlenW (lpString=".pst") returned 4 [0092.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".pst") returned 0x0 [0092.199] lstrlenW (lpString=".ost") returned 4 [0092.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".ost") returned 0x0 [0092.199] lstrlenW (lpString=".bak") returned 4 [0092.199] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".bak") returned 0x0 [0092.200] lstrlenW (lpString=".bac") returned 4 [0092.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".bac") returned 0x0 [0092.200] lstrlenW (lpString=".sys") returned 4 [0092.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".sys") returned 0x0 [0092.200] lstrlenW (lpString=".v2i") returned 4 [0092.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".v2i") returned 0x0 [0092.200] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.201] lstrlenW (lpString=".sql") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".sql") returned 0x0 [0092.201] lstrlenW (lpString=".mdf") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".mdf") returned 0x0 [0092.201] lstrlenW (lpString=".txt") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".txt") returned 0x0 [0092.201] lstrlenW (lpString=".dbf") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".dbf") returned 0x0 [0092.201] lstrlenW (lpString=".ckp") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".ckp") returned 0x0 [0092.201] lstrlenW (lpString=".dacpac") returned 7 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".dacpac") returned 0x0 [0092.201] lstrlenW (lpString=".db3") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".db3") returned 0x0 [0092.201] lstrlenW (lpString=".dtxs") returned 5 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".dtxs") returned 0x0 [0092.201] lstrlenW (lpString=".mdt") returned 4 [0092.201] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".mdt") returned 0x0 [0092.202] lstrlenW (lpString=".sdf") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".sdf") returned 0x0 [0092.202] lstrlenW (lpString=".MDF") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".MDF") returned 0x0 [0092.202] lstrlenW (lpString=".DBF") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".DBF") returned 0x0 [0092.202] lstrlenW (lpString=".DB") returned 3 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".DB") returned 0x0 [0092.202] lstrlenW (lpString=".db") returned 3 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".db") returned 0x0 [0092.202] lstrlenW (lpString=".ndf") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".ndf") returned 0x0 [0092.202] lstrlenW (lpString=".NDF") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".NDF") returned 0x0 [0092.202] lstrlenW (lpString=".Mdf") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".Mdf") returned 0x0 [0092.202] lstrlenW (lpString=".dat") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".dat") returned 0x0 [0092.202] lstrlenW (lpString=".DAT") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".DAT") returned 0x0 [0092.202] lstrlenW (lpString=".ldf") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".ldf") returned 0x0 [0092.202] lstrlenW (lpString=".LDF") returned 4 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch=".LDF") returned 0x0 [0092.202] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.202] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0092.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.203] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.203] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.203] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.203] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0092.204] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21220470147) returned 1 [0092.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5c529d0, dwHighDateTime=0x1d585b4)) [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b69e8 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b69e8 | out: hHeap=0x260000) returned 1 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.204] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.204] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.204] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.204] GetLastError () returned 0x0 [0092.205] GetLastError () returned 0x0 [0092.205] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.205] GetLastError () returned 0x0 [0092.205] GetLastError () returned 0x0 [0092.206] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffec45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.207] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x13bb, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13bb, lpOverlapped=0x0) returned 1 [0092.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0092.207] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.207] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.207] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.207] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.207] CloseHandle (hObject=0xf0) returned 1 [0092.207] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35b250 [0092.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.[deadmin@cock.li].deadmin")) returned 1 [0092.208] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b250 | out: hHeap=0x260000) returned 1 [0092.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0092.209] GetLastError () returned 0x0 [0092.209] RtlWakeConditionVariable () returned 0x0 [0092.209] GetCurrentThreadId () returned 0x9ac [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".ldf") returned 0x0 [0092.209] lstrlenW (lpString=".vhd") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".vhd") returned 0x0 [0092.209] lstrlenW (lpString=".vhdx") returned 5 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".vhdx") returned 0x0 [0092.209] lstrlenW (lpString=".pst") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".pst") returned 0x0 [0092.209] lstrlenW (lpString=".ost") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".ost") returned 0x0 [0092.209] lstrlenW (lpString=".bak") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".bak") returned 0x0 [0092.209] lstrlenW (lpString=".bac") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".bac") returned 0x0 [0092.209] lstrlenW (lpString=".sys") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".sys") returned 0x0 [0092.209] lstrlenW (lpString=".v2i") returned 4 [0092.209] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".v2i") returned 0x0 [0092.209] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.210] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch="s\r\n.v2i") returned 0x0 [0092.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.211] lstrlenW (lpString=".sql") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".sql") returned 0x0 [0092.211] lstrlenW (lpString=".mdf") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".mdf") returned 0x0 [0092.211] lstrlenW (lpString=".txt") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".txt") returned 0x0 [0092.211] lstrlenW (lpString=".dbf") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".dbf") returned 0x0 [0092.211] lstrlenW (lpString=".ckp") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".ckp") returned 0x0 [0092.211] lstrlenW (lpString=".dacpac") returned 7 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".dacpac") returned 0x0 [0092.211] lstrlenW (lpString=".db3") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".db3") returned 0x0 [0092.211] lstrlenW (lpString=".dtxs") returned 5 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".dtxs") returned 0x0 [0092.211] lstrlenW (lpString=".mdt") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".mdt") returned 0x0 [0092.211] lstrlenW (lpString=".sdf") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".sdf") returned 0x0 [0092.211] lstrlenW (lpString=".MDF") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".MDF") returned 0x0 [0092.211] lstrlenW (lpString=".DBF") returned 4 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".DBF") returned 0x0 [0092.211] lstrlenW (lpString=".DB") returned 3 [0092.211] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".DB") returned 0x0 [0092.212] lstrlenW (lpString=".db") returned 3 [0092.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".db") returned 0x0 [0092.293] lstrlenW (lpString=".ndf") returned 4 [0092.293] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".ndf") returned 0x0 [0092.315] lstrlenW (lpString=".NDF") returned 4 [0092.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".NDF") returned 0x0 [0092.315] lstrlenW (lpString=".Mdf") returned 4 [0092.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".Mdf") returned 0x0 [0092.315] lstrlenW (lpString=".dat") returned 4 [0092.315] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".dat") returned 0x0 [0092.321] lstrlenW (lpString=".DAT") returned 4 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".DAT") returned 0x0 [0092.321] lstrlenW (lpString=".ldf") returned 4 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".ldf") returned 0x0 [0092.321] lstrlenW (lpString=".LDF") returned 4 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch=".LDF") returned 0x0 [0092.321] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.321] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.321] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.322] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.322] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.322] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.322] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.322] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.323] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21232366905) returned 1 [0092.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5d834d0, dwHighDateTime=0x1d585b4)) [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6c88 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6c88 | out: hHeap=0x260000) returned 1 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.323] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.323] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.323] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.323] GetLastError () returned 0x0 [0092.324] GetLastError () returned 0x0 [0092.324] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.324] GetLastError () returned 0x0 [0092.324] GetLastError () returned 0x0 [0092.325] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffec3b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.326] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x13c5, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x13c5, lpOverlapped=0x0) returned 1 [0092.326] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.326] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.326] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.326] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.326] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.326] CloseHandle (hObject=0xf0) returned 1 [0092.326] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.[deadmin@cock.li].deadmin")) returned 1 [0092.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.328] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.328] GetLastError () returned 0x0 [0092.328] RtlWakeConditionVariable () returned 0x0 [0092.328] GetCurrentThreadId () returned 0x9ac [0092.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".ldf") returned 0x0 [0092.328] lstrlenW (lpString=".vhd") returned 4 [0092.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".vhd") returned 0x0 [0092.328] lstrlenW (lpString=".vhdx") returned 5 [0092.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".vhdx") returned 0x0 [0092.328] lstrlenW (lpString=".pst") returned 4 [0092.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".pst") returned 0x0 [0092.328] lstrlenW (lpString=".ost") returned 4 [0092.328] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".ost") returned 0x0 [0092.328] lstrlenW (lpString=".bak") returned 4 [0092.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".bak") returned 0x0 [0092.329] lstrlenW (lpString=".bac") returned 4 [0092.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".bac") returned 0x0 [0092.329] lstrlenW (lpString=".sys") returned 4 [0092.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".sys") returned 0x0 [0092.329] lstrlenW (lpString=".v2i") returned 4 [0092.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".v2i") returned 0x0 [0092.329] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.329] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.330] lstrlenW (lpString=".sql") returned 4 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".sql") returned 0x0 [0092.330] lstrlenW (lpString=".mdf") returned 4 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".mdf") returned 0x0 [0092.330] lstrlenW (lpString=".txt") returned 4 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".txt") returned 0x0 [0092.330] lstrlenW (lpString=".dbf") returned 4 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".dbf") returned 0x0 [0092.330] lstrlenW (lpString=".ckp") returned 4 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".ckp") returned 0x0 [0092.330] lstrlenW (lpString=".dacpac") returned 7 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".dacpac") returned 0x0 [0092.330] lstrlenW (lpString=".db3") returned 4 [0092.330] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".db3") returned 0x0 [0092.331] lstrlenW (lpString=".dtxs") returned 5 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".dtxs") returned 0x0 [0092.331] lstrlenW (lpString=".mdt") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".mdt") returned 0x0 [0092.331] lstrlenW (lpString=".sdf") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".sdf") returned 0x0 [0092.331] lstrlenW (lpString=".MDF") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".MDF") returned 0x0 [0092.331] lstrlenW (lpString=".DBF") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".DBF") returned 0x0 [0092.331] lstrlenW (lpString=".DB") returned 3 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".DB") returned 0x0 [0092.331] lstrlenW (lpString=".db") returned 3 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".db") returned 0x0 [0092.331] lstrlenW (lpString=".ndf") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".ndf") returned 0x0 [0092.331] lstrlenW (lpString=".NDF") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".NDF") returned 0x0 [0092.331] lstrlenW (lpString=".Mdf") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".Mdf") returned 0x0 [0092.331] lstrlenW (lpString=".dat") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".dat") returned 0x0 [0092.331] lstrlenW (lpString=".DAT") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".DAT") returned 0x0 [0092.331] lstrlenW (lpString=".ldf") returned 4 [0092.331] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".ldf") returned 0x0 [0092.331] lstrlenW (lpString=".LDF") returned 4 [0092.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch=".LDF") returned 0x0 [0092.332] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.332] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.332] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.332] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.332] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.332] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.333] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21233380215) returned 1 [0092.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5d834d0, dwHighDateTime=0x1d585b4)) [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6cc0 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6cc0 | out: hHeap=0x260000) returned 1 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.333] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.333] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.333] GetLastError () returned 0x0 [0092.334] GetLastError () returned 0x0 [0092.334] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.334] GetLastError () returned 0x0 [0092.334] GetLastError () returned 0x0 [0092.337] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.337] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0092.338] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.338] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.338] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.338] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.338] CloseHandle (hObject=0xf0) returned 1 [0092.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.340] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.340] GetLastError () returned 0x0 [0092.340] RtlWakeConditionVariable () returned 0x0 [0092.340] GetCurrentThreadId () returned 0x9ac [0092.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".ldf") returned 0x0 [0092.340] lstrlenW (lpString=".vhd") returned 4 [0092.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".vhd") returned 0x0 [0092.340] lstrlenW (lpString=".vhdx") returned 5 [0092.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".vhdx") returned 0x0 [0092.340] lstrlenW (lpString=".pst") returned 4 [0092.340] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".pst") returned 0x0 [0092.341] lstrlenW (lpString=".ost") returned 4 [0092.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".ost") returned 0x0 [0092.341] lstrlenW (lpString=".bak") returned 4 [0092.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".bak") returned 0x0 [0092.341] lstrlenW (lpString=".bac") returned 4 [0092.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".bac") returned 0x0 [0092.341] lstrlenW (lpString=".sys") returned 4 [0092.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".sys") returned 0x0 [0092.341] lstrlenW (lpString=".v2i") returned 4 [0092.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".v2i") returned 0x0 [0092.341] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.341] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.343] lstrlenW (lpString=".sql") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".sql") returned 0x0 [0092.343] lstrlenW (lpString=".mdf") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".mdf") returned 0x0 [0092.343] lstrlenW (lpString=".txt") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".txt") returned 0x0 [0092.343] lstrlenW (lpString=".dbf") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".dbf") returned 0x0 [0092.343] lstrlenW (lpString=".ckp") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".ckp") returned 0x0 [0092.343] lstrlenW (lpString=".dacpac") returned 7 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".dacpac") returned 0x0 [0092.343] lstrlenW (lpString=".db3") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".db3") returned 0x0 [0092.343] lstrlenW (lpString=".dtxs") returned 5 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".dtxs") returned 0x0 [0092.343] lstrlenW (lpString=".mdt") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".mdt") returned 0x0 [0092.343] lstrlenW (lpString=".sdf") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".sdf") returned 0x0 [0092.343] lstrlenW (lpString=".MDF") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".MDF") returned 0x0 [0092.343] lstrlenW (lpString=".DBF") returned 4 [0092.343] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".DBF") returned 0x0 [0092.343] lstrlenW (lpString=".DB") returned 3 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".DB") returned 0x0 [0092.344] lstrlenW (lpString=".db") returned 3 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".db") returned 0x0 [0092.344] lstrlenW (lpString=".ndf") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".ndf") returned 0x0 [0092.344] lstrlenW (lpString=".NDF") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".NDF") returned 0x0 [0092.344] lstrlenW (lpString=".Mdf") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".Mdf") returned 0x0 [0092.344] lstrlenW (lpString=".dat") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".dat") returned 0x0 [0092.344] lstrlenW (lpString=".DAT") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".DAT") returned 0x0 [0092.344] lstrlenW (lpString=".ldf") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".ldf") returned 0x0 [0092.344] lstrlenW (lpString=".LDF") returned 4 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch=".LDF") returned 0x0 [0092.344] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.344] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.344] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.344] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.345] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.345] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.345] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.345] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21234642761) returned 1 [0092.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5da9630, dwHighDateTime=0x1d585b4)) [0092.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.345] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6cf8 [0092.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6cf8 | out: hHeap=0x260000) returned 1 [0092.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.346] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.346] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.346] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.346] GetLastError () returned 0x0 [0092.346] GetLastError () returned 0x0 [0092.346] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.346] GetLastError () returned 0x0 [0092.347] GetLastError () returned 0x0 [0092.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffd8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.348] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x275e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x275e, lpOverlapped=0x0) returned 1 [0092.348] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.348] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.349] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.349] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.349] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.349] CloseHandle (hObject=0xf0) returned 1 [0092.349] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0092.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.350] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.350] GetLastError () returned 0x0 [0092.350] RtlWakeConditionVariable () returned 0x0 [0092.350] GetCurrentThreadId () returned 0x9ac [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".ldf") returned 0x0 [0092.351] lstrlenW (lpString=".vhd") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".vhd") returned 0x0 [0092.351] lstrlenW (lpString=".vhdx") returned 5 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".vhdx") returned 0x0 [0092.351] lstrlenW (lpString=".pst") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".pst") returned 0x0 [0092.351] lstrlenW (lpString=".ost") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".ost") returned 0x0 [0092.351] lstrlenW (lpString=".bak") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".bak") returned 0x0 [0092.351] lstrlenW (lpString=".bac") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".bac") returned 0x0 [0092.351] lstrlenW (lpString=".sys") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".sys") returned 0x0 [0092.351] lstrlenW (lpString=".v2i") returned 4 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".v2i") returned 0x0 [0092.351] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch="s\r\n.v2i") returned 0x0 [0092.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.352] lstrlenW (lpString=".sql") returned 4 [0092.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".sql") returned 0x0 [0092.352] lstrlenW (lpString=".mdf") returned 4 [0092.352] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".mdf") returned 0x0 [0092.352] lstrlenW (lpString=".txt") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".txt") returned 0x0 [0092.353] lstrlenW (lpString=".dbf") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".dbf") returned 0x0 [0092.353] lstrlenW (lpString=".ckp") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".ckp") returned 0x0 [0092.353] lstrlenW (lpString=".dacpac") returned 7 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".dacpac") returned 0x0 [0092.353] lstrlenW (lpString=".db3") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".db3") returned 0x0 [0092.353] lstrlenW (lpString=".dtxs") returned 5 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".dtxs") returned 0x0 [0092.353] lstrlenW (lpString=".mdt") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".mdt") returned 0x0 [0092.353] lstrlenW (lpString=".sdf") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".sdf") returned 0x0 [0092.353] lstrlenW (lpString=".MDF") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".MDF") returned 0x0 [0092.353] lstrlenW (lpString=".DBF") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".DBF") returned 0x0 [0092.353] lstrlenW (lpString=".DB") returned 3 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".DB") returned 0x0 [0092.353] lstrlenW (lpString=".db") returned 3 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".db") returned 0x0 [0092.353] lstrlenW (lpString=".ndf") returned 4 [0092.353] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".ndf") returned 0x0 [0092.353] lstrlenW (lpString=".NDF") returned 4 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".NDF") returned 0x0 [0092.354] lstrlenW (lpString=".Mdf") returned 4 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".Mdf") returned 0x0 [0092.354] lstrlenW (lpString=".dat") returned 4 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".dat") returned 0x0 [0092.354] lstrlenW (lpString=".DAT") returned 4 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".DAT") returned 0x0 [0092.354] lstrlenW (lpString=".ldf") returned 4 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".ldf") returned 0x0 [0092.354] lstrlenW (lpString=".LDF") returned 4 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch=".LDF") returned 0x0 [0092.354] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.354] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.354] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.355] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.355] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.355] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21235617948) returned 1 [0092.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5dcf790, dwHighDateTime=0x1d585b4)) [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6d30 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6d30 | out: hHeap=0x260000) returned 1 [0092.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.355] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.356] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.356] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.356] GetLastError () returned 0x0 [0092.356] GetLastError () returned 0x0 [0092.356] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.356] GetLastError () returned 0x0 [0092.356] GetLastError () returned 0x0 [0092.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffcb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.479] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x350, lpOverlapped=0x0) returned 1 [0092.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.479] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.479] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.479] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.479] CloseHandle (hObject=0xf0) returned 1 [0092.479] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.[deadmin@cock.li].deadmin")) returned 1 [0092.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.481] GetLastError () returned 0x0 [0092.481] RtlWakeConditionVariable () returned 0x0 [0092.481] GetCurrentThreadId () returned 0x9ac [0092.481] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0092.482] lstrlenW (lpString=".vhd") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".vhd") returned 0x0 [0092.482] lstrlenW (lpString=".vhdx") returned 5 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".vhdx") returned 0x0 [0092.482] lstrlenW (lpString=".pst") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".pst") returned 0x0 [0092.482] lstrlenW (lpString=".ost") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".ost") returned 0x0 [0092.482] lstrlenW (lpString=".bak") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".bak") returned 0x0 [0092.482] lstrlenW (lpString=".bac") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".bac") returned 0x0 [0092.482] lstrlenW (lpString=".sys") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".sys") returned 0x0 [0092.482] lstrlenW (lpString=".v2i") returned 4 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".v2i") returned 0x0 [0092.482] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.482] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch="s\r\n.v2i") returned 0x0 [0092.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.483] lstrlenW (lpString=".sql") returned 4 [0092.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".sql") returned 0x0 [0092.483] lstrlenW (lpString=".mdf") returned 4 [0092.483] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".mdf") returned 0x0 [0092.483] lstrlenW (lpString=".txt") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".txt") returned 0x0 [0092.484] lstrlenW (lpString=".dbf") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".dbf") returned 0x0 [0092.484] lstrlenW (lpString=".ckp") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".ckp") returned 0x0 [0092.484] lstrlenW (lpString=".dacpac") returned 7 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".dacpac") returned 0x0 [0092.484] lstrlenW (lpString=".db3") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".db3") returned 0x0 [0092.484] lstrlenW (lpString=".dtxs") returned 5 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".dtxs") returned 0x0 [0092.484] lstrlenW (lpString=".mdt") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".mdt") returned 0x0 [0092.484] lstrlenW (lpString=".sdf") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".sdf") returned 0x0 [0092.484] lstrlenW (lpString=".MDF") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".MDF") returned 0x0 [0092.484] lstrlenW (lpString=".DBF") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".DBF") returned 0x0 [0092.484] lstrlenW (lpString=".DB") returned 3 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".DB") returned 0x0 [0092.484] lstrlenW (lpString=".db") returned 3 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".db") returned 0x0 [0092.484] lstrlenW (lpString=".ndf") returned 4 [0092.484] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".ndf") returned 0x0 [0092.484] lstrlenW (lpString=".NDF") returned 4 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".NDF") returned 0x0 [0092.485] lstrlenW (lpString=".Mdf") returned 4 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".Mdf") returned 0x0 [0092.485] lstrlenW (lpString=".dat") returned 4 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".dat") returned 0x0 [0092.485] lstrlenW (lpString=".DAT") returned 4 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".DAT") returned 0x0 [0092.485] lstrlenW (lpString=".ldf") returned 4 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".ldf") returned 0x0 [0092.485] lstrlenW (lpString=".LDF") returned 4 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch=".LDF") returned 0x0 [0092.485] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.485] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.485] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.485] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.486] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.486] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.486] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21248721940) returned 1 [0092.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5f00290, dwHighDateTime=0x1d585b4)) [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b6fd0 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.486] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b6fd0 | out: hHeap=0x260000) returned 1 [0092.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.487] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.487] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.487] GetLastError () returned 0x0 [0092.487] GetLastError () returned 0x0 [0092.487] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.487] GetLastError () returned 0x0 [0092.487] GetLastError () returned 0x0 [0092.499] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff1019, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.500] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xefe7, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xefe7, lpOverlapped=0x0) returned 1 [0092.500] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.500] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.500] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.500] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.500] CloseHandle (hObject=0xf0) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x110) returned 0x35a760 [0092.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js.[deadmin@cock.li].deadmin")) returned 1 [0092.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.502] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.502] GetLastError () returned 0x0 [0092.502] RtlWakeConditionVariable () returned 0x27e828 [0092.502] GetCurrentThreadId () returned 0x9ac [0092.502] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.502] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.503] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.503] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.504] CloseHandle (hObject=0xf0) returned 1 [0092.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0092.504] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9848 | out: hHeap=0x260000) returned 1 [0092.504] RtlWakeConditionVariable () returned 0x27e828 [0092.504] GetCurrentThreadId () returned 0x9ac [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".ldf") returned 0x0 [0092.505] lstrlenW (lpString=".vhd") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".vhd") returned 0x0 [0092.505] lstrlenW (lpString=".vhdx") returned 5 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".vhdx") returned 0x0 [0092.505] lstrlenW (lpString=".pst") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".pst") returned 0x0 [0092.505] lstrlenW (lpString=".ost") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".ost") returned 0x0 [0092.505] lstrlenW (lpString=".bak") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".bak") returned 0x0 [0092.505] lstrlenW (lpString=".bac") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".bac") returned 0x0 [0092.505] lstrlenW (lpString=".sys") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".sys") returned 0x0 [0092.505] lstrlenW (lpString=".v2i") returned 4 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".v2i") returned 0x0 [0092.505] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.505] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.506] lstrlenW (lpString=".sql") returned 4 [0092.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".sql") returned 0x0 [0092.506] lstrlenW (lpString=".mdf") returned 4 [0092.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".mdf") returned 0x0 [0092.506] lstrlenW (lpString=".txt") returned 4 [0092.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".txt") returned 0x0 [0092.506] lstrlenW (lpString=".dbf") returned 4 [0092.506] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".dbf") returned 0x0 [0092.506] lstrlenW (lpString=".ckp") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".ckp") returned 0x0 [0092.507] lstrlenW (lpString=".dacpac") returned 7 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".dacpac") returned 0x0 [0092.507] lstrlenW (lpString=".db3") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".db3") returned 0x0 [0092.507] lstrlenW (lpString=".dtxs") returned 5 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".dtxs") returned 0x0 [0092.507] lstrlenW (lpString=".mdt") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".mdt") returned 0x0 [0092.507] lstrlenW (lpString=".sdf") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".sdf") returned 0x0 [0092.507] lstrlenW (lpString=".MDF") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".MDF") returned 0x0 [0092.507] lstrlenW (lpString=".DBF") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".DBF") returned 0x0 [0092.507] lstrlenW (lpString=".DB") returned 3 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".DB") returned 0x0 [0092.507] lstrlenW (lpString=".db") returned 3 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".db") returned 0x0 [0092.507] lstrlenW (lpString=".ndf") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".ndf") returned 0x0 [0092.507] lstrlenW (lpString=".NDF") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".NDF") returned 0x0 [0092.507] lstrlenW (lpString=".Mdf") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".Mdf") returned 0x0 [0092.507] lstrlenW (lpString=".dat") returned 4 [0092.507] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".dat") returned 0x0 [0092.508] lstrlenW (lpString=".DAT") returned 4 [0092.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".DAT") returned 0x0 [0092.508] lstrlenW (lpString=".ldf") returned 4 [0092.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".ldf") returned 0x0 [0092.508] lstrlenW (lpString=".LDF") returned 4 [0092.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch=".LDF") returned 0x0 [0092.508] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.508] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.509] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.509] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.509] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21251021968) returned 1 [0092.509] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5f4c550, dwHighDateTime=0x1d585b4)) [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7078 [0092.509] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.509] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7078 | out: hHeap=0x260000) returned 1 [0092.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.510] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.510] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.510] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.510] GetLastError () returned 0x0 [0092.510] GetLastError () returned 0x0 [0092.510] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.510] GetLastError () returned 0x0 [0092.510] GetLastError () returned 0x0 [0092.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffebf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.522] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x140b, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x140b, lpOverlapped=0x0) returned 1 [0092.522] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.522] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.522] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.522] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.523] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.523] CloseHandle (hObject=0xf0) returned 1 [0092.523] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.525] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.525] GetLastError () returned 0x0 [0092.525] RtlWakeConditionVariable () returned 0x27e828 [0092.525] GetCurrentThreadId () returned 0x9ac [0092.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.525] lstrlenW (lpString=".vhd") returned 4 [0092.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".vhd") returned 0x0 [0092.525] lstrlenW (lpString=".vhdx") returned 5 [0092.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".vhdx") returned 0x0 [0092.525] lstrlenW (lpString=".pst") returned 4 [0092.525] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".pst") returned 0x0 [0092.526] lstrlenW (lpString=".ost") returned 4 [0092.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".ost") returned 0x0 [0092.526] lstrlenW (lpString=".bak") returned 4 [0092.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".bak") returned 0x0 [0092.526] lstrlenW (lpString=".bac") returned 4 [0092.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".bac") returned 0x0 [0092.526] lstrlenW (lpString=".sys") returned 4 [0092.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".sys") returned 0x0 [0092.526] lstrlenW (lpString=".v2i") returned 4 [0092.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".v2i") returned 0x0 [0092.526] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.526] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.548] lstrlenW (lpString=".sql") returned 4 [0092.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".sql") returned 0x0 [0092.548] lstrlenW (lpString=".mdf") returned 4 [0092.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".mdf") returned 0x0 [0092.548] lstrlenW (lpString=".txt") returned 4 [0092.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".txt") returned 0x0 [0092.548] lstrlenW (lpString=".dbf") returned 4 [0092.548] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".dbf") returned 0x0 [0092.549] lstrlenW (lpString=".ckp") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".ckp") returned 0x0 [0092.549] lstrlenW (lpString=".dacpac") returned 7 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".dacpac") returned 0x0 [0092.549] lstrlenW (lpString=".db3") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".db3") returned 0x0 [0092.549] lstrlenW (lpString=".dtxs") returned 5 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".dtxs") returned 0x0 [0092.549] lstrlenW (lpString=".mdt") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".mdt") returned 0x0 [0092.549] lstrlenW (lpString=".sdf") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".sdf") returned 0x0 [0092.549] lstrlenW (lpString=".MDF") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".MDF") returned 0x0 [0092.549] lstrlenW (lpString=".DBF") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".DBF") returned 0x0 [0092.549] lstrlenW (lpString=".DB") returned 3 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".DB") returned 0x0 [0092.549] lstrlenW (lpString=".db") returned 3 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".db") returned 0x0 [0092.549] lstrlenW (lpString=".ndf") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".ndf") returned 0x0 [0092.549] lstrlenW (lpString=".NDF") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".NDF") returned 0x0 [0092.549] lstrlenW (lpString=".Mdf") returned 4 [0092.549] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".Mdf") returned 0x0 [0092.550] lstrlenW (lpString=".dat") returned 4 [0092.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".dat") returned 0x0 [0092.550] lstrlenW (lpString=".DAT") returned 4 [0092.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".DAT") returned 0x0 [0092.550] lstrlenW (lpString=".ldf") returned 4 [0092.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".ldf") returned 0x0 [0092.550] lstrlenW (lpString=".LDF") returned 4 [0092.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch=".LDF") returned 0x0 [0092.550] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.550] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.551] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.551] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.551] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21255210815) returned 1 [0092.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc5f98810, dwHighDateTime=0x1d585b4)) [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7158 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7158 | out: hHeap=0x260000) returned 1 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.551] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.551] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.552] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0092.552] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.552] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.552] GetLastError () returned 0x0 [0092.552] GetLastError () returned 0x0 [0092.552] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.552] GetLastError () returned 0x0 [0092.552] GetLastError () returned 0x0 [0092.643] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffcd33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.653] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x32cd, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x32cd, lpOverlapped=0x0) returned 1 [0092.663] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.663] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.674] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.674] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.674] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.674] CloseHandle (hObject=0xf0) returned 1 [0092.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x35c428 [0092.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35c428 | out: hHeap=0x260000) returned 1 [0092.676] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.676] GetLastError () returned 0x0 [0092.676] RtlWakeConditionVariable () returned 0x0 [0092.676] GetCurrentThreadId () returned 0x9ac [0092.677] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.677] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.677] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.677] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.678] CloseHandle (hObject=0xf0) returned 1 [0092.678] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d51d0 | out: hHeap=0x260000) returned 1 [0092.679] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d5088 | out: hHeap=0x260000) returned 1 [0092.679] RtlWakeConditionVariable () returned 0x0 [0092.679] GetCurrentThreadId () returned 0x9ac [0092.679] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.679] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.679] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.679] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.681] CloseHandle (hObject=0xf0) returned 1 [0092.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d51d0 | out: hHeap=0x260000) returned 1 [0092.681] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d5088 | out: hHeap=0x260000) returned 1 [0092.681] RtlWakeConditionVariable () returned 0x0 [0092.681] GetCurrentThreadId () returned 0x9ac [0092.682] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.682] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.682] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.682] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.683] CloseHandle (hObject=0xf0) returned 1 [0092.683] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35b598 | out: hHeap=0x260000) returned 1 [0092.684] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x35a760 | out: hHeap=0x260000) returned 1 [0092.684] RtlWakeConditionVariable () returned 0x0 [0092.684] GetCurrentThreadId () returned 0x9ac [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".ldf") returned 0x0 [0092.684] lstrlenW (lpString=".vhd") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".vhd") returned 0x0 [0092.684] lstrlenW (lpString=".vhdx") returned 5 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".vhdx") returned 0x0 [0092.684] lstrlenW (lpString=".pst") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".pst") returned 0x0 [0092.684] lstrlenW (lpString=".ost") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".ost") returned 0x0 [0092.684] lstrlenW (lpString=".bak") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".bak") returned 0x0 [0092.684] lstrlenW (lpString=".bac") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".bac") returned 0x0 [0092.684] lstrlenW (lpString=".sys") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".sys") returned 0x0 [0092.684] lstrlenW (lpString=".v2i") returned 4 [0092.684] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".v2i") returned 0x0 [0092.685] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.685] lstrlenW (lpString=".sql") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".sql") returned 0x0 [0092.686] lstrlenW (lpString=".mdf") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".mdf") returned 0x0 [0092.686] lstrlenW (lpString=".txt") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".txt") returned 0x0 [0092.686] lstrlenW (lpString=".dbf") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".dbf") returned 0x0 [0092.686] lstrlenW (lpString=".ckp") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".ckp") returned 0x0 [0092.686] lstrlenW (lpString=".dacpac") returned 7 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".dacpac") returned 0x0 [0092.686] lstrlenW (lpString=".db3") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".db3") returned 0x0 [0092.686] lstrlenW (lpString=".dtxs") returned 5 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".dtxs") returned 0x0 [0092.686] lstrlenW (lpString=".mdt") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".mdt") returned 0x0 [0092.686] lstrlenW (lpString=".sdf") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".sdf") returned 0x0 [0092.686] lstrlenW (lpString=".MDF") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".MDF") returned 0x0 [0092.686] lstrlenW (lpString=".DBF") returned 4 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".DBF") returned 0x0 [0092.686] lstrlenW (lpString=".DB") returned 3 [0092.686] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".DB") returned 0x0 [0092.686] lstrlenW (lpString=".db") returned 3 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".db") returned 0x0 [0092.687] lstrlenW (lpString=".ndf") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".ndf") returned 0x0 [0092.687] lstrlenW (lpString=".NDF") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".NDF") returned 0x0 [0092.687] lstrlenW (lpString=".Mdf") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".Mdf") returned 0x0 [0092.687] lstrlenW (lpString=".dat") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".dat") returned 0x0 [0092.687] lstrlenW (lpString=".DAT") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".DAT") returned 0x0 [0092.687] lstrlenW (lpString=".ldf") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".ldf") returned 0x0 [0092.687] lstrlenW (lpString=".LDF") returned 4 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch=".LDF") returned 0x0 [0092.687] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.687] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.688] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.688] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.688] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.688] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21268937947) returned 1 [0092.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc60ef470, dwHighDateTime=0x1d585b4)) [0092.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b74d8 [0092.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b74d8 | out: hHeap=0x260000) returned 1 [0092.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.689] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.689] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.689] GetLastError () returned 0x0 [0092.689] GetLastError () returned 0x0 [0092.689] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.689] GetLastError () returned 0x0 [0092.690] GetLastError () returned 0x0 [0092.691] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb0f6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.691] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x4f0a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x4f0a, lpOverlapped=0x0) returned 1 [0092.692] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.692] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.692] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.692] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.692] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.692] CloseHandle (hObject=0xf0) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922308 [0092.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2922308 | out: hHeap=0x260000) returned 1 [0092.694] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.694] GetLastError () returned 0x0 [0092.694] RtlWakeConditionVariable () returned 0x0 [0092.694] GetCurrentThreadId () returned 0x9ac [0092.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0092.694] lstrlenW (lpString=".vhd") returned 4 [0092.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".vhd") returned 0x0 [0092.694] lstrlenW (lpString=".vhdx") returned 5 [0092.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".vhdx") returned 0x0 [0092.694] lstrlenW (lpString=".pst") returned 4 [0092.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".pst") returned 0x0 [0092.694] lstrlenW (lpString=".ost") returned 4 [0092.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".ost") returned 0x0 [0092.695] lstrlenW (lpString=".bak") returned 4 [0092.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".bak") returned 0x0 [0092.695] lstrlenW (lpString=".bac") returned 4 [0092.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".bac") returned 0x0 [0092.695] lstrlenW (lpString=".sys") returned 4 [0092.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".sys") returned 0x0 [0092.695] lstrlenW (lpString=".v2i") returned 4 [0092.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".v2i") returned 0x0 [0092.695] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch="s\r\n.v2i") returned 0x0 [0092.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.696] lstrlenW (lpString=".sql") returned 4 [0092.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".sql") returned 0x0 [0092.696] lstrlenW (lpString=".mdf") returned 4 [0092.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".mdf") returned 0x0 [0092.696] lstrlenW (lpString=".txt") returned 4 [0092.696] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".txt") returned 0x0 [0092.697] lstrlenW (lpString=".dbf") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".dbf") returned 0x0 [0092.697] lstrlenW (lpString=".ckp") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".ckp") returned 0x0 [0092.697] lstrlenW (lpString=".dacpac") returned 7 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".dacpac") returned 0x0 [0092.697] lstrlenW (lpString=".db3") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".db3") returned 0x0 [0092.697] lstrlenW (lpString=".dtxs") returned 5 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".dtxs") returned 0x0 [0092.697] lstrlenW (lpString=".mdt") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".mdt") returned 0x0 [0092.697] lstrlenW (lpString=".sdf") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".sdf") returned 0x0 [0092.697] lstrlenW (lpString=".MDF") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".MDF") returned 0x0 [0092.697] lstrlenW (lpString=".DBF") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".DBF") returned 0x0 [0092.697] lstrlenW (lpString=".DB") returned 3 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".DB") returned 0x0 [0092.697] lstrlenW (lpString=".db") returned 3 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".db") returned 0x0 [0092.697] lstrlenW (lpString=".ndf") returned 4 [0092.697] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".ndf") returned 0x0 [0092.697] lstrlenW (lpString=".NDF") returned 4 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".NDF") returned 0x0 [0092.698] lstrlenW (lpString=".Mdf") returned 4 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".Mdf") returned 0x0 [0092.698] lstrlenW (lpString=".dat") returned 4 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".dat") returned 0x0 [0092.698] lstrlenW (lpString=".DAT") returned 4 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".DAT") returned 0x0 [0092.698] lstrlenW (lpString=".ldf") returned 4 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".ldf") returned 0x0 [0092.698] lstrlenW (lpString=".LDF") returned 4 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch=".LDF") returned 0x0 [0092.698] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.698] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.699] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.699] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.699] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21270021690) returned 1 [0092.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc61155d0, dwHighDateTime=0x1d585b4)) [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7510 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7510 | out: hHeap=0x260000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.700] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.700] GetLastError () returned 0x0 [0092.700] GetLastError () returned 0x0 [0092.700] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.700] GetLastError () returned 0x0 [0092.701] GetLastError () returned 0x0 [0092.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffdcc8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.704] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x2338, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x2338, lpOverlapped=0x0) returned 1 [0092.704] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0092.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.704] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.704] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.704] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.705] CloseHandle (hObject=0xf0) returned 1 [0092.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x140) returned 0x27d5088 [0092.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.[deadmin@cock.li].deadmin")) returned 1 [0092.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d5088 | out: hHeap=0x260000) returned 1 [0092.707] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.707] GetLastError () returned 0x0 [0092.707] RtlWakeConditionVariable () returned 0x0 [0092.707] GetCurrentThreadId () returned 0x9ac [0092.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".ldf") returned 0x0 [0092.707] lstrlenW (lpString=".vhd") returned 4 [0092.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".vhd") returned 0x0 [0092.707] lstrlenW (lpString=".vhdx") returned 5 [0092.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".vhdx") returned 0x0 [0092.707] lstrlenW (lpString=".pst") returned 4 [0092.707] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".pst") returned 0x0 [0092.707] lstrlenW (lpString=".ost") returned 4 [0092.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".ost") returned 0x0 [0092.708] lstrlenW (lpString=".bak") returned 4 [0092.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".bak") returned 0x0 [0092.708] lstrlenW (lpString=".bac") returned 4 [0092.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".bac") returned 0x0 [0092.708] lstrlenW (lpString=".sys") returned 4 [0092.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".sys") returned 0x0 [0092.708] lstrlenW (lpString=".v2i") returned 4 [0092.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".v2i") returned 0x0 [0092.708] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.708] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch="s\r\n.v2i") returned 0x0 [0092.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.709] lstrlenW (lpString=".sql") returned 4 [0092.709] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".sql") returned 0x0 [0092.710] lstrlenW (lpString=".mdf") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".mdf") returned 0x0 [0092.710] lstrlenW (lpString=".txt") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".txt") returned 0x0 [0092.710] lstrlenW (lpString=".dbf") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".dbf") returned 0x0 [0092.710] lstrlenW (lpString=".ckp") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".ckp") returned 0x0 [0092.710] lstrlenW (lpString=".dacpac") returned 7 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".dacpac") returned 0x0 [0092.710] lstrlenW (lpString=".db3") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".db3") returned 0x0 [0092.710] lstrlenW (lpString=".dtxs") returned 5 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".dtxs") returned 0x0 [0092.710] lstrlenW (lpString=".mdt") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".mdt") returned 0x0 [0092.710] lstrlenW (lpString=".sdf") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".sdf") returned 0x0 [0092.710] lstrlenW (lpString=".MDF") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".MDF") returned 0x0 [0092.710] lstrlenW (lpString=".DBF") returned 4 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".DBF") returned 0x0 [0092.710] lstrlenW (lpString=".DB") returned 3 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".DB") returned 0x0 [0092.710] lstrlenW (lpString=".db") returned 3 [0092.710] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".db") returned 0x0 [0092.711] lstrlenW (lpString=".ndf") returned 4 [0092.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".ndf") returned 0x0 [0092.711] lstrlenW (lpString=".NDF") returned 4 [0092.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".NDF") returned 0x0 [0092.711] lstrlenW (lpString=".Mdf") returned 4 [0092.711] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".Mdf") returned 0x0 [0092.711] lstrlenW (lpString=".dat") returned 4 [0092.807] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".dat") returned 0x0 [0092.807] lstrlenW (lpString=".DAT") returned 4 [0092.834] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".DAT") returned 0x0 [0092.834] lstrlenW (lpString=".ldf") returned 4 [0092.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".ldf") returned 0x0 [0092.835] lstrlenW (lpString=".LDF") returned 4 [0092.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch=".LDF") returned 0x0 [0092.835] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.835] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.835] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.835] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.836] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.836] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.836] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21283697846) returned 1 [0092.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc626c230, dwHighDateTime=0x1d585b4)) [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b77b0 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b77b0 | out: hHeap=0x260000) returned 1 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.836] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.837] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.837] GetLastError () returned 0x0 [0092.837] GetLastError () returned 0x0 [0092.837] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.837] GetLastError () returned 0x0 [0092.837] GetLastError () returned 0x0 [0092.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffa100, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.839] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5f00, lpOverlapped=0x0) returned 1 [0092.839] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.839] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.840] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.840] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.840] CloseHandle (hObject=0xf0) returned 1 [0092.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120) returned 0x28c0088 [0092.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.[deadmin@cock.li].deadmin")) returned 1 [0092.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x28c0088 | out: hHeap=0x260000) returned 1 [0092.843] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.843] GetLastError () returned 0x0 [0092.843] RtlWakeConditionVariable () returned 0x0 [0092.843] GetCurrentThreadId () returned 0x9ac [0092.845] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.845] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.845] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.845] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.848] CloseHandle (hObject=0xf0) returned 1 [0092.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27da6d0 | out: hHeap=0x260000) returned 1 [0092.848] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0092.848] RtlWakeConditionVariable () returned 0x0 [0092.848] GetCurrentThreadId () returned 0x9ac [0092.848] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.848] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.848] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.849] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.851] CloseHandle (hObject=0xf0) returned 1 [0092.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc090 | out: hHeap=0x260000) returned 1 [0092.851] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.851] RtlWakeConditionVariable () returned 0x27e828 [0092.851] GetCurrentThreadId () returned 0x9ac [0092.852] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.852] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0092.852] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0092.852] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0092.854] CloseHandle (hObject=0xf0) returned 1 [0092.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342a68 | out: hHeap=0x260000) returned 1 [0092.854] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x34d050 | out: hHeap=0x260000) returned 1 [0092.854] RtlWakeConditionVariable () returned 0x27e828 [0092.854] GetCurrentThreadId () returned 0x9ac [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".ldf") returned 0x0 [0092.854] lstrlenW (lpString=".vhd") returned 4 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".vhd") returned 0x0 [0092.854] lstrlenW (lpString=".vhdx") returned 5 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".vhdx") returned 0x0 [0092.854] lstrlenW (lpString=".pst") returned 4 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".pst") returned 0x0 [0092.854] lstrlenW (lpString=".ost") returned 4 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".ost") returned 0x0 [0092.854] lstrlenW (lpString=".bak") returned 4 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".bak") returned 0x0 [0092.854] lstrlenW (lpString=".bac") returned 4 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".bac") returned 0x0 [0092.854] lstrlenW (lpString=".sys") returned 4 [0092.854] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".sys") returned 0x0 [0092.855] lstrlenW (lpString=".v2i") returned 4 [0092.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".v2i") returned 0x0 [0092.855] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.856] lstrlenW (lpString=".sql") returned 4 [0092.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".sql") returned 0x0 [0092.856] lstrlenW (lpString=".mdf") returned 4 [0092.856] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".mdf") returned 0x0 [0092.856] lstrlenW (lpString=".txt") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".txt") returned 0x0 [0092.857] lstrlenW (lpString=".dbf") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".dbf") returned 0x0 [0092.857] lstrlenW (lpString=".ckp") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".ckp") returned 0x0 [0092.857] lstrlenW (lpString=".dacpac") returned 7 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".dacpac") returned 0x0 [0092.857] lstrlenW (lpString=".db3") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".db3") returned 0x0 [0092.857] lstrlenW (lpString=".dtxs") returned 5 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".dtxs") returned 0x0 [0092.857] lstrlenW (lpString=".mdt") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".mdt") returned 0x0 [0092.857] lstrlenW (lpString=".sdf") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".sdf") returned 0x0 [0092.857] lstrlenW (lpString=".MDF") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".MDF") returned 0x0 [0092.857] lstrlenW (lpString=".DBF") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".DBF") returned 0x0 [0092.857] lstrlenW (lpString=".DB") returned 3 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".DB") returned 0x0 [0092.857] lstrlenW (lpString=".db") returned 3 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".db") returned 0x0 [0092.857] lstrlenW (lpString=".ndf") returned 4 [0092.857] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".ndf") returned 0x0 [0092.857] lstrlenW (lpString=".NDF") returned 4 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".NDF") returned 0x0 [0092.858] lstrlenW (lpString=".Mdf") returned 4 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".Mdf") returned 0x0 [0092.858] lstrlenW (lpString=".dat") returned 4 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".dat") returned 0x0 [0092.858] lstrlenW (lpString=".DAT") returned 4 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".DAT") returned 0x0 [0092.858] lstrlenW (lpString=".ldf") returned 4 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".ldf") returned 0x0 [0092.858] lstrlenW (lpString=".LDF") returned 4 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch=".LDF") returned 0x0 [0092.858] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.858] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.858] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.859] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.859] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.859] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21286025582) returned 1 [0092.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6292390, dwHighDateTime=0x1d585b4)) [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7890 [0092.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.859] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7890 | out: hHeap=0x260000) returned 1 [0092.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b408 [0092.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b408 | out: hHeap=0x260000) returned 1 [0092.860] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.860] GetLastError () returned 0x0 [0092.860] GetLastError () returned 0x0 [0092.860] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.860] GetLastError () returned 0x0 [0092.861] GetLastError () returned 0x0 [0092.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff5d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.863] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xa2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0xa2e, lpOverlapped=0x0) returned 1 [0092.863] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.863] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.863] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.863] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.863] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.863] CloseHandle (hObject=0xf0) returned 1 [0092.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0092.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.865] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.865] GetLastError () returned 0x0 [0092.865] RtlWakeConditionVariable () returned 0x0 [0092.865] GetCurrentThreadId () returned 0x9ac [0092.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".ldf") returned 0x0 [0092.865] lstrlenW (lpString=".vhd") returned 4 [0092.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".vhd") returned 0x0 [0092.865] lstrlenW (lpString=".vhdx") returned 5 [0092.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".vhdx") returned 0x0 [0092.865] lstrlenW (lpString=".pst") returned 4 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".pst") returned 0x0 [0092.866] lstrlenW (lpString=".ost") returned 4 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".ost") returned 0x0 [0092.866] lstrlenW (lpString=".bak") returned 4 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".bak") returned 0x0 [0092.866] lstrlenW (lpString=".bac") returned 4 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".bac") returned 0x0 [0092.866] lstrlenW (lpString=".sys") returned 4 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".sys") returned 0x0 [0092.866] lstrlenW (lpString=".v2i") returned 4 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".v2i") returned 0x0 [0092.866] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.866] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.867] lstrlenW (lpString=".sql") returned 4 [0092.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".sql") returned 0x0 [0092.867] lstrlenW (lpString=".mdf") returned 4 [0092.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".mdf") returned 0x0 [0092.867] lstrlenW (lpString=".txt") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".txt") returned 0x0 [0092.868] lstrlenW (lpString=".dbf") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".dbf") returned 0x0 [0092.868] lstrlenW (lpString=".ckp") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".ckp") returned 0x0 [0092.868] lstrlenW (lpString=".dacpac") returned 7 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".dacpac") returned 0x0 [0092.868] lstrlenW (lpString=".db3") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".db3") returned 0x0 [0092.868] lstrlenW (lpString=".dtxs") returned 5 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".dtxs") returned 0x0 [0092.868] lstrlenW (lpString=".mdt") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".mdt") returned 0x0 [0092.868] lstrlenW (lpString=".sdf") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".sdf") returned 0x0 [0092.868] lstrlenW (lpString=".MDF") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".MDF") returned 0x0 [0092.868] lstrlenW (lpString=".DBF") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".DBF") returned 0x0 [0092.868] lstrlenW (lpString=".DB") returned 3 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".DB") returned 0x0 [0092.868] lstrlenW (lpString=".db") returned 3 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".db") returned 0x0 [0092.868] lstrlenW (lpString=".ndf") returned 4 [0092.868] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".ndf") returned 0x0 [0092.868] lstrlenW (lpString=".NDF") returned 4 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".NDF") returned 0x0 [0092.869] lstrlenW (lpString=".Mdf") returned 4 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".Mdf") returned 0x0 [0092.869] lstrlenW (lpString=".dat") returned 4 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".dat") returned 0x0 [0092.869] lstrlenW (lpString=".DAT") returned 4 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".DAT") returned 0x0 [0092.869] lstrlenW (lpString=".ldf") returned 4 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".ldf") returned 0x0 [0092.869] lstrlenW (lpString=".LDF") returned 4 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch=".LDF") returned 0x0 [0092.869] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.869] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.869] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.870] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.870] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.870] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21287124564) returned 1 [0092.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc62b84f0, dwHighDateTime=0x1d585b4)) [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b78c8 [0092.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.870] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b78c8 | out: hHeap=0x260000) returned 1 [0092.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b558 [0092.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0092.871] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b558 | out: hHeap=0x260000) returned 1 [0092.871] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.871] GetLastError () returned 0x0 [0092.871] GetLastError () returned 0x0 [0092.871] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.871] GetLastError () returned 0x0 [0092.872] GetLastError () returned 0x0 [0092.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.974] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0092.974] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.974] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.974] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.974] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.974] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.974] CloseHandle (hObject=0xf0) returned 1 [0092.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0092.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.976] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.976] GetLastError () returned 0x0 [0092.976] RtlWakeConditionVariable () returned 0x0 [0092.976] GetCurrentThreadId () returned 0x9ac [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".ldf") returned 0x0 [0092.977] lstrlenW (lpString=".vhd") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".vhd") returned 0x0 [0092.977] lstrlenW (lpString=".vhdx") returned 5 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".vhdx") returned 0x0 [0092.977] lstrlenW (lpString=".pst") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".pst") returned 0x0 [0092.977] lstrlenW (lpString=".ost") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".ost") returned 0x0 [0092.977] lstrlenW (lpString=".bak") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".bak") returned 0x0 [0092.977] lstrlenW (lpString=".bac") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".bac") returned 0x0 [0092.977] lstrlenW (lpString=".sys") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".sys") returned 0x0 [0092.977] lstrlenW (lpString=".v2i") returned 4 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".v2i") returned 0x0 [0092.977] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.977] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0092.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.979] lstrlenW (lpString=".sql") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".sql") returned 0x0 [0092.979] lstrlenW (lpString=".mdf") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".mdf") returned 0x0 [0092.979] lstrlenW (lpString=".txt") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".txt") returned 0x0 [0092.979] lstrlenW (lpString=".dbf") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".dbf") returned 0x0 [0092.979] lstrlenW (lpString=".ckp") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".ckp") returned 0x0 [0092.979] lstrlenW (lpString=".dacpac") returned 7 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".dacpac") returned 0x0 [0092.979] lstrlenW (lpString=".db3") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".db3") returned 0x0 [0092.979] lstrlenW (lpString=".dtxs") returned 5 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".dtxs") returned 0x0 [0092.979] lstrlenW (lpString=".mdt") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".mdt") returned 0x0 [0092.979] lstrlenW (lpString=".sdf") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".sdf") returned 0x0 [0092.979] lstrlenW (lpString=".MDF") returned 4 [0092.979] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".MDF") returned 0x0 [0092.980] lstrlenW (lpString=".DBF") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".DBF") returned 0x0 [0092.980] lstrlenW (lpString=".DB") returned 3 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".DB") returned 0x0 [0092.980] lstrlenW (lpString=".db") returned 3 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".db") returned 0x0 [0092.980] lstrlenW (lpString=".ndf") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".ndf") returned 0x0 [0092.980] lstrlenW (lpString=".NDF") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".NDF") returned 0x0 [0092.980] lstrlenW (lpString=".Mdf") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".Mdf") returned 0x0 [0092.980] lstrlenW (lpString=".dat") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".dat") returned 0x0 [0092.980] lstrlenW (lpString=".DAT") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".DAT") returned 0x0 [0092.980] lstrlenW (lpString=".ldf") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".ldf") returned 0x0 [0092.980] lstrlenW (lpString=".LDF") returned 4 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch=".LDF") returned 0x0 [0092.980] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.980] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.980] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.980] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.981] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.981] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.981] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.981] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.981] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21298263316) returned 1 [0092.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc63c2e90, dwHighDateTime=0x1d585b4)) [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7ac0 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7ac0 | out: hHeap=0x260000) returned 1 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b600 [0092.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.982] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0092.982] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b600 | out: hHeap=0x260000) returned 1 [0092.982] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.982] GetLastError () returned 0x0 [0092.983] GetLastError () returned 0x0 [0092.983] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.983] GetLastError () returned 0x0 [0092.983] GetLastError () returned 0x0 [0092.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.984] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13e, lpOverlapped=0x0) returned 1 [0092.984] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.984] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.984] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.985] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.985] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.985] CloseHandle (hObject=0xf0) returned 1 [0092.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0092.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.[deadmin@cock.li].deadmin")) returned 1 [0092.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0092.987] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0092.987] GetLastError () returned 0x0 [0092.987] RtlWakeConditionVariable () returned 0x0 [0092.987] GetCurrentThreadId () returned 0x9ac [0092.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".ldf") returned 0x0 [0092.987] lstrlenW (lpString=".vhd") returned 4 [0092.987] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".vhd") returned 0x0 [0092.988] lstrlenW (lpString=".vhdx") returned 5 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".vhdx") returned 0x0 [0092.988] lstrlenW (lpString=".pst") returned 4 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".pst") returned 0x0 [0092.988] lstrlenW (lpString=".ost") returned 4 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".ost") returned 0x0 [0092.988] lstrlenW (lpString=".bak") returned 4 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".bak") returned 0x0 [0092.988] lstrlenW (lpString=".bac") returned 4 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".bac") returned 0x0 [0092.988] lstrlenW (lpString=".sys") returned 4 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".sys") returned 0x0 [0092.988] lstrlenW (lpString=".v2i") returned 4 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".v2i") returned 0x0 [0092.988] lstrlenW (lpString="s\r\n.v2i") returned 7 [0092.988] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch="s\r\n.v2i") returned 0x0 [0092.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0092.990] lstrlenW (lpString=".sql") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".sql") returned 0x0 [0092.990] lstrlenW (lpString=".mdf") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".mdf") returned 0x0 [0092.990] lstrlenW (lpString=".txt") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".txt") returned 0x0 [0092.990] lstrlenW (lpString=".dbf") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".dbf") returned 0x0 [0092.990] lstrlenW (lpString=".ckp") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".ckp") returned 0x0 [0092.990] lstrlenW (lpString=".dacpac") returned 7 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".dacpac") returned 0x0 [0092.990] lstrlenW (lpString=".db3") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".db3") returned 0x0 [0092.990] lstrlenW (lpString=".dtxs") returned 5 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".dtxs") returned 0x0 [0092.990] lstrlenW (lpString=".mdt") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".mdt") returned 0x0 [0092.990] lstrlenW (lpString=".sdf") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".sdf") returned 0x0 [0092.990] lstrlenW (lpString=".MDF") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".MDF") returned 0x0 [0092.990] lstrlenW (lpString=".DBF") returned 4 [0092.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".DBF") returned 0x0 [0092.991] lstrlenW (lpString=".DB") returned 3 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".DB") returned 0x0 [0092.991] lstrlenW (lpString=".db") returned 3 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".db") returned 0x0 [0092.991] lstrlenW (lpString=".ndf") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".ndf") returned 0x0 [0092.991] lstrlenW (lpString=".NDF") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".NDF") returned 0x0 [0092.991] lstrlenW (lpString=".Mdf") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".Mdf") returned 0x0 [0092.991] lstrlenW (lpString=".dat") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".dat") returned 0x0 [0092.991] lstrlenW (lpString=".DAT") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".DAT") returned 0x0 [0092.991] lstrlenW (lpString=".ldf") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".ldf") returned 0x0 [0092.991] lstrlenW (lpString=".LDF") returned 4 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch=".LDF") returned 0x0 [0092.991] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0092.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0092.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0092.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0092.991] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0092.994] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0092.994] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0092.994] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0092.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0092.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0092.994] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21299560916) returned 1 [0092.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc63e8ff0, dwHighDateTime=0x1d585b4)) [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7af8 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0092.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7af8 | out: hHeap=0x260000) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0092.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0092.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0092.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0092.995] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0092.995] GetLastError () returned 0x0 [0092.996] GetLastError () returned 0x0 [0092.996] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0092.996] GetLastError () returned 0x0 [0092.996] GetLastError () returned 0x0 [0092.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.998] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0092.998] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0092.998] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.998] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0092.998] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0092.998] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0092.998] CloseHandle (hObject=0xf0) returned 1 [0092.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755620 [0092.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755620 | out: hHeap=0x260000) returned 1 [0093.000] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.000] GetLastError () returned 0x0 [0093.001] RtlWakeConditionVariable () returned 0x0 [0093.001] GetCurrentThreadId () returned 0x9ac [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".ldf") returned 0x0 [0093.001] lstrlenW (lpString=".vhd") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".vhd") returned 0x0 [0093.001] lstrlenW (lpString=".vhdx") returned 5 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".vhdx") returned 0x0 [0093.001] lstrlenW (lpString=".pst") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".pst") returned 0x0 [0093.001] lstrlenW (lpString=".ost") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".ost") returned 0x0 [0093.001] lstrlenW (lpString=".bak") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".bak") returned 0x0 [0093.001] lstrlenW (lpString=".bac") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".bac") returned 0x0 [0093.001] lstrlenW (lpString=".sys") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".sys") returned 0x0 [0093.001] lstrlenW (lpString=".v2i") returned 4 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".v2i") returned 0x0 [0093.001] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.003] lstrlenW (lpString=".sql") returned 4 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".sql") returned 0x0 [0093.003] lstrlenW (lpString=".mdf") returned 4 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".mdf") returned 0x0 [0093.003] lstrlenW (lpString=".txt") returned 4 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".txt") returned 0x0 [0093.003] lstrlenW (lpString=".dbf") returned 4 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".dbf") returned 0x0 [0093.003] lstrlenW (lpString=".ckp") returned 4 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".ckp") returned 0x0 [0093.003] lstrlenW (lpString=".dacpac") returned 7 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".dacpac") returned 0x0 [0093.003] lstrlenW (lpString=".db3") returned 4 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".db3") returned 0x0 [0093.003] lstrlenW (lpString=".dtxs") returned 5 [0093.003] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".dtxs") returned 0x0 [0093.003] lstrlenW (lpString=".mdt") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".mdt") returned 0x0 [0093.004] lstrlenW (lpString=".sdf") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".sdf") returned 0x0 [0093.004] lstrlenW (lpString=".MDF") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".MDF") returned 0x0 [0093.004] lstrlenW (lpString=".DBF") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".DBF") returned 0x0 [0093.004] lstrlenW (lpString=".DB") returned 3 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".DB") returned 0x0 [0093.004] lstrlenW (lpString=".db") returned 3 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".db") returned 0x0 [0093.004] lstrlenW (lpString=".ndf") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".ndf") returned 0x0 [0093.004] lstrlenW (lpString=".NDF") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".NDF") returned 0x0 [0093.004] lstrlenW (lpString=".Mdf") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".Mdf") returned 0x0 [0093.004] lstrlenW (lpString=".dat") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".dat") returned 0x0 [0093.004] lstrlenW (lpString=".DAT") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".DAT") returned 0x0 [0093.004] lstrlenW (lpString=".ldf") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".ldf") returned 0x0 [0093.004] lstrlenW (lpString=".LDF") returned 4 [0093.004] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch=".LDF") returned 0x0 [0093.005] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.005] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.005] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.006] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.006] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21300688143) returned 1 [0093.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc63e8ff0, dwHighDateTime=0x1d585b4)) [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7b30 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7b30 | out: hHeap=0x260000) returned 1 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b018 [0093.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b018 | out: hHeap=0x260000) returned 1 [0093.006] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.007] GetLastError () returned 0x0 [0093.007] GetLastError () returned 0x0 [0093.007] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.007] GetLastError () returned 0x0 [0093.008] GetLastError () returned 0x0 [0093.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.139] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0093.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.139] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.139] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.139] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.140] CloseHandle (hObject=0xf0) returned 1 [0093.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755620 [0093.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755620 | out: hHeap=0x260000) returned 1 [0093.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.141] GetLastError () returned 0x0 [0093.141] RtlWakeConditionVariable () returned 0x0 [0093.142] GetCurrentThreadId () returned 0x9ac [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".ldf") returned 0x0 [0093.142] lstrlenW (lpString=".vhd") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".vhd") returned 0x0 [0093.142] lstrlenW (lpString=".vhdx") returned 5 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".vhdx") returned 0x0 [0093.142] lstrlenW (lpString=".pst") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".pst") returned 0x0 [0093.142] lstrlenW (lpString=".ost") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".ost") returned 0x0 [0093.142] lstrlenW (lpString=".bak") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".bak") returned 0x0 [0093.142] lstrlenW (lpString=".bac") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".bac") returned 0x0 [0093.142] lstrlenW (lpString=".sys") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".sys") returned 0x0 [0093.142] lstrlenW (lpString=".v2i") returned 4 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".v2i") returned 0x0 [0093.142] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.142] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.144] lstrlenW (lpString=".sql") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".sql") returned 0x0 [0093.144] lstrlenW (lpString=".mdf") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".mdf") returned 0x0 [0093.144] lstrlenW (lpString=".txt") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".txt") returned 0x0 [0093.144] lstrlenW (lpString=".dbf") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".dbf") returned 0x0 [0093.144] lstrlenW (lpString=".ckp") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".ckp") returned 0x0 [0093.144] lstrlenW (lpString=".dacpac") returned 7 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".dacpac") returned 0x0 [0093.144] lstrlenW (lpString=".db3") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".db3") returned 0x0 [0093.144] lstrlenW (lpString=".dtxs") returned 5 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".dtxs") returned 0x0 [0093.144] lstrlenW (lpString=".mdt") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".mdt") returned 0x0 [0093.144] lstrlenW (lpString=".sdf") returned 4 [0093.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".sdf") returned 0x0 [0093.144] lstrlenW (lpString=".MDF") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".MDF") returned 0x0 [0093.145] lstrlenW (lpString=".DBF") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".DBF") returned 0x0 [0093.145] lstrlenW (lpString=".DB") returned 3 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".DB") returned 0x0 [0093.145] lstrlenW (lpString=".db") returned 3 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".db") returned 0x0 [0093.145] lstrlenW (lpString=".ndf") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".ndf") returned 0x0 [0093.145] lstrlenW (lpString=".NDF") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".NDF") returned 0x0 [0093.145] lstrlenW (lpString=".Mdf") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".Mdf") returned 0x0 [0093.145] lstrlenW (lpString=".dat") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".dat") returned 0x0 [0093.145] lstrlenW (lpString=".DAT") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".DAT") returned 0x0 [0093.145] lstrlenW (lpString=".ldf") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".ldf") returned 0x0 [0093.145] lstrlenW (lpString=".LDF") returned 4 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch=".LDF") returned 0x0 [0093.145] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.145] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.146] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.146] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.146] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21314760466) returned 1 [0093.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc653fc50, dwHighDateTime=0x1d585b4)) [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7cb8 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7cb8 | out: hHeap=0x260000) returned 1 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33ba98 [0093.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2760538 [0093.147] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33ba98 | out: hHeap=0x260000) returned 1 [0093.147] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.147] GetLastError () returned 0x0 [0093.148] GetLastError () returned 0x0 [0093.148] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.148] GetLastError () returned 0x0 [0093.148] GetLastError () returned 0x0 [0093.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.149] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x13e, lpOverlapped=0x0) returned 1 [0093.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.149] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.149] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.149] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.149] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.150] CloseHandle (hObject=0xf0) returned 1 [0093.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0093.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.358] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.358] GetLastError () returned 0x0 [0093.358] RtlWakeConditionVariable () returned 0x0 [0093.358] GetCurrentThreadId () returned 0x9ac [0093.358] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".ldf") returned 0x0 [0093.358] lstrlenW (lpString=".vhd") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".vhd") returned 0x0 [0093.359] lstrlenW (lpString=".vhdx") returned 5 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".vhdx") returned 0x0 [0093.359] lstrlenW (lpString=".pst") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".pst") returned 0x0 [0093.359] lstrlenW (lpString=".ost") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".ost") returned 0x0 [0093.359] lstrlenW (lpString=".bak") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".bak") returned 0x0 [0093.359] lstrlenW (lpString=".bac") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".bac") returned 0x0 [0093.359] lstrlenW (lpString=".sys") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".sys") returned 0x0 [0093.359] lstrlenW (lpString=".v2i") returned 4 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".v2i") returned 0x0 [0093.359] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.359] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.360] lstrlenW (lpString=".sql") returned 4 [0093.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".sql") returned 0x0 [0093.360] lstrlenW (lpString=".mdf") returned 4 [0093.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".mdf") returned 0x0 [0093.360] lstrlenW (lpString=".txt") returned 4 [0093.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".txt") returned 0x0 [0093.360] lstrlenW (lpString=".dbf") returned 4 [0093.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".dbf") returned 0x0 [0093.360] lstrlenW (lpString=".ckp") returned 4 [0093.360] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".ckp") returned 0x0 [0093.360] lstrlenW (lpString=".dacpac") returned 7 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".dacpac") returned 0x0 [0093.361] lstrlenW (lpString=".db3") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".db3") returned 0x0 [0093.361] lstrlenW (lpString=".dtxs") returned 5 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".dtxs") returned 0x0 [0093.361] lstrlenW (lpString=".mdt") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".mdt") returned 0x0 [0093.361] lstrlenW (lpString=".sdf") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".sdf") returned 0x0 [0093.361] lstrlenW (lpString=".MDF") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".MDF") returned 0x0 [0093.361] lstrlenW (lpString=".DBF") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".DBF") returned 0x0 [0093.361] lstrlenW (lpString=".DB") returned 3 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".DB") returned 0x0 [0093.361] lstrlenW (lpString=".db") returned 3 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".db") returned 0x0 [0093.361] lstrlenW (lpString=".ndf") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".ndf") returned 0x0 [0093.361] lstrlenW (lpString=".NDF") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".NDF") returned 0x0 [0093.361] lstrlenW (lpString=".Mdf") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".Mdf") returned 0x0 [0093.361] lstrlenW (lpString=".dat") returned 4 [0093.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".dat") returned 0x0 [0093.362] lstrlenW (lpString=".DAT") returned 4 [0093.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".DAT") returned 0x0 [0093.362] lstrlenW (lpString=".ldf") returned 4 [0093.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".ldf") returned 0x0 [0093.362] lstrlenW (lpString=".LDF") returned 4 [0093.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch=".LDF") returned 0x0 [0093.362] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.362] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.362] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.362] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.363] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.363] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.363] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21336400292) returned 1 [0093.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6754f90, dwHighDateTime=0x1d585b4)) [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7e40 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7e40 | out: hHeap=0x260000) returned 1 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bc90 [0093.363] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.364] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bc90 | out: hHeap=0x260000) returned 1 [0093.364] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.364] GetLastError () returned 0x0 [0093.364] GetLastError () returned 0x0 [0093.364] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.364] GetLastError () returned 0x0 [0093.364] GetLastError () returned 0x0 [0093.368] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.368] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.368] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.368] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.368] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.369] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.369] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.369] CloseHandle (hObject=0xf0) returned 1 [0093.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2755620 [0093.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755620 | out: hHeap=0x260000) returned 1 [0093.370] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.370] GetLastError () returned 0x0 [0093.370] RtlWakeConditionVariable () returned 0x0 [0093.370] GetCurrentThreadId () returned 0x9ac [0093.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".ldf") returned 0x0 [0093.370] lstrlenW (lpString=".vhd") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".vhd") returned 0x0 [0093.371] lstrlenW (lpString=".vhdx") returned 5 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".vhdx") returned 0x0 [0093.371] lstrlenW (lpString=".pst") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".pst") returned 0x0 [0093.371] lstrlenW (lpString=".ost") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".ost") returned 0x0 [0093.371] lstrlenW (lpString=".bak") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".bak") returned 0x0 [0093.371] lstrlenW (lpString=".bac") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".bac") returned 0x0 [0093.371] lstrlenW (lpString=".sys") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".sys") returned 0x0 [0093.371] lstrlenW (lpString=".v2i") returned 4 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".v2i") returned 0x0 [0093.371] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.371] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.372] lstrlenW (lpString=".sql") returned 4 [0093.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".sql") returned 0x0 [0093.372] lstrlenW (lpString=".mdf") returned 4 [0093.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".mdf") returned 0x0 [0093.372] lstrlenW (lpString=".txt") returned 4 [0093.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".txt") returned 0x0 [0093.372] lstrlenW (lpString=".dbf") returned 4 [0093.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".dbf") returned 0x0 [0093.372] lstrlenW (lpString=".ckp") returned 4 [0093.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".ckp") returned 0x0 [0093.372] lstrlenW (lpString=".dacpac") returned 7 [0093.372] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".dacpac") returned 0x0 [0093.373] lstrlenW (lpString=".db3") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".db3") returned 0x0 [0093.373] lstrlenW (lpString=".dtxs") returned 5 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".dtxs") returned 0x0 [0093.373] lstrlenW (lpString=".mdt") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".mdt") returned 0x0 [0093.373] lstrlenW (lpString=".sdf") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".sdf") returned 0x0 [0093.373] lstrlenW (lpString=".MDF") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".MDF") returned 0x0 [0093.373] lstrlenW (lpString=".DBF") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".DBF") returned 0x0 [0093.373] lstrlenW (lpString=".DB") returned 3 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".DB") returned 0x0 [0093.373] lstrlenW (lpString=".db") returned 3 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".db") returned 0x0 [0093.373] lstrlenW (lpString=".ndf") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".ndf") returned 0x0 [0093.373] lstrlenW (lpString=".NDF") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".NDF") returned 0x0 [0093.373] lstrlenW (lpString=".Mdf") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".Mdf") returned 0x0 [0093.373] lstrlenW (lpString=".dat") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".dat") returned 0x0 [0093.373] lstrlenW (lpString=".DAT") returned 4 [0093.373] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".DAT") returned 0x0 [0093.374] lstrlenW (lpString=".ldf") returned 4 [0093.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".ldf") returned 0x0 [0093.374] lstrlenW (lpString=".LDF") returned 4 [0093.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch=".LDF") returned 0x0 [0093.374] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.374] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922578 [0093.374] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.374] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.375] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.375] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a58 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.375] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21337597053) returned 1 [0093.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc677b0f0, dwHighDateTime=0x1d585b4)) [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279388 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792e8 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b7e78 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b7e78 | out: hHeap=0x260000) returned 1 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bb40 [0093.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.375] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.375] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bb40 | out: hHeap=0x260000) returned 1 [0093.376] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.376] GetLastError () returned 0x0 [0093.376] GetLastError () returned 0x0 [0093.376] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.376] GetLastError () returned 0x0 [0093.376] GetLastError () returned 0x0 [0093.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.378] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.378] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0093.378] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.378] WriteFile (in: hFile=0xf0, lpBuffer=0x280a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a58*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.378] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.378] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.379] CloseHandle (hObject=0xf0) returned 1 [0093.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0093.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0093.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0093.381] GetLastError () returned 0x0 [0093.381] RtlWakeConditionVariable () returned 0x0 [0093.381] GetCurrentThreadId () returned 0x9ac [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".ldf") returned 0x0 [0093.381] lstrlenW (lpString=".vhd") returned 4 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".vhd") returned 0x0 [0093.381] lstrlenW (lpString=".vhdx") returned 5 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".vhdx") returned 0x0 [0093.381] lstrlenW (lpString=".pst") returned 4 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".pst") returned 0x0 [0093.381] lstrlenW (lpString=".ost") returned 4 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".ost") returned 0x0 [0093.381] lstrlenW (lpString=".bak") returned 4 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".bak") returned 0x0 [0093.381] lstrlenW (lpString=".bac") returned 4 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".bac") returned 0x0 [0093.381] lstrlenW (lpString=".sys") returned 4 [0093.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".sys") returned 0x0 [0093.382] lstrlenW (lpString=".v2i") returned 4 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".v2i") returned 0x0 [0093.425] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.425] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch="s\r\n.v2i") returned 0x0 [0093.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.426] lstrlenW (lpString=".sql") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".sql") returned 0x0 [0093.427] lstrlenW (lpString=".mdf") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".mdf") returned 0x0 [0093.427] lstrlenW (lpString=".txt") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".txt") returned 0x0 [0093.427] lstrlenW (lpString=".dbf") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".dbf") returned 0x0 [0093.427] lstrlenW (lpString=".ckp") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".ckp") returned 0x0 [0093.427] lstrlenW (lpString=".dacpac") returned 7 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".dacpac") returned 0x0 [0093.427] lstrlenW (lpString=".db3") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".db3") returned 0x0 [0093.427] lstrlenW (lpString=".dtxs") returned 5 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".dtxs") returned 0x0 [0093.427] lstrlenW (lpString=".mdt") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".mdt") returned 0x0 [0093.427] lstrlenW (lpString=".sdf") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".sdf") returned 0x0 [0093.427] lstrlenW (lpString=".MDF") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".MDF") returned 0x0 [0093.427] lstrlenW (lpString=".DBF") returned 4 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".DBF") returned 0x0 [0093.427] lstrlenW (lpString=".DB") returned 3 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".DB") returned 0x0 [0093.427] lstrlenW (lpString=".db") returned 3 [0093.427] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".db") returned 0x0 [0093.428] lstrlenW (lpString=".ndf") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".ndf") returned 0x0 [0093.428] lstrlenW (lpString=".NDF") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".NDF") returned 0x0 [0093.428] lstrlenW (lpString=".Mdf") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".Mdf") returned 0x0 [0093.428] lstrlenW (lpString=".dat") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".dat") returned 0x0 [0093.428] lstrlenW (lpString=".DAT") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".DAT") returned 0x0 [0093.428] lstrlenW (lpString=".ldf") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".ldf") returned 0x0 [0093.428] lstrlenW (lpString=".LDF") returned 4 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch=".LDF") returned 0x0 [0093.428] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.428] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x2922098 [0093.428] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.428] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.429] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.429] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.429] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.429] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21343032628) returned 1 [0093.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6813670, dwHighDateTime=0x1d585b4)) [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279268 [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8000 [0093.429] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8000 | out: hHeap=0x260000) returned 1 [0093.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b8a0 [0093.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.430] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.430] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b8a0 | out: hHeap=0x260000) returned 1 [0093.430] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.430] GetLastError () returned 0x0 [0093.430] GetLastError () returned 0x0 [0093.430] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.430] GetLastError () returned 0x0 [0093.431] GetLastError () returned 0x0 [0093.433] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffff4d2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.433] WriteFile (in: hFile=0xe4, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0xb2e, lpOverlapped=0x0) returned 1 [0093.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0093.433] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.434] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.434] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.434] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.434] CloseHandle (hObject=0xe4) returned 1 [0093.434] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x27557f0 [0093.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.[deadmin@cock.li].deadmin")) returned 1 [0093.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27557f0 | out: hHeap=0x260000) returned 1 [0093.435] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0093.435] GetLastError () returned 0x0 [0093.435] RtlWakeConditionVariable () returned 0x0 [0093.435] GetCurrentThreadId () returned 0x9ac [0093.435] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".ldf") returned 0x0 [0093.436] lstrlenW (lpString=".vhd") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".vhd") returned 0x0 [0093.436] lstrlenW (lpString=".vhdx") returned 5 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".vhdx") returned 0x0 [0093.436] lstrlenW (lpString=".pst") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".pst") returned 0x0 [0093.436] lstrlenW (lpString=".ost") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".ost") returned 0x0 [0093.436] lstrlenW (lpString=".bak") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".bak") returned 0x0 [0093.436] lstrlenW (lpString=".bac") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".bac") returned 0x0 [0093.436] lstrlenW (lpString=".sys") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".sys") returned 0x0 [0093.436] lstrlenW (lpString=".v2i") returned 4 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".v2i") returned 0x0 [0093.436] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.436] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.447] lstrlenW (lpString=".sql") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".sql") returned 0x0 [0093.447] lstrlenW (lpString=".mdf") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".mdf") returned 0x0 [0093.447] lstrlenW (lpString=".txt") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".txt") returned 0x0 [0093.447] lstrlenW (lpString=".dbf") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".dbf") returned 0x0 [0093.447] lstrlenW (lpString=".ckp") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".ckp") returned 0x0 [0093.447] lstrlenW (lpString=".dacpac") returned 7 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".dacpac") returned 0x0 [0093.447] lstrlenW (lpString=".db3") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".db3") returned 0x0 [0093.447] lstrlenW (lpString=".dtxs") returned 5 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".dtxs") returned 0x0 [0093.447] lstrlenW (lpString=".mdt") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".mdt") returned 0x0 [0093.447] lstrlenW (lpString=".sdf") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".sdf") returned 0x0 [0093.447] lstrlenW (lpString=".MDF") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".MDF") returned 0x0 [0093.447] lstrlenW (lpString=".DBF") returned 4 [0093.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".DBF") returned 0x0 [0093.448] lstrlenW (lpString=".DB") returned 3 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".DB") returned 0x0 [0093.448] lstrlenW (lpString=".db") returned 3 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".db") returned 0x0 [0093.448] lstrlenW (lpString=".ndf") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".ndf") returned 0x0 [0093.448] lstrlenW (lpString=".NDF") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".NDF") returned 0x0 [0093.448] lstrlenW (lpString=".Mdf") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".Mdf") returned 0x0 [0093.448] lstrlenW (lpString=".dat") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".dat") returned 0x0 [0093.448] lstrlenW (lpString=".DAT") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".DAT") returned 0x0 [0093.448] lstrlenW (lpString=".ldf") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".ldf") returned 0x0 [0093.448] lstrlenW (lpString=".LDF") returned 4 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch=".LDF") returned 0x0 [0093.448] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.448] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.448] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.449] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.449] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.449] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21345044943) returned 1 [0093.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc68397d0, dwHighDateTime=0x1d585b4)) [0093.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b80a8 [0093.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b80a8 | out: hHeap=0x260000) returned 1 [0093.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bb40 [0093.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.450] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bb40 | out: hHeap=0x260000) returned 1 [0093.450] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.450] GetLastError () returned 0x0 [0093.450] GetLastError () returned 0x0 [0093.450] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.451] GetLastError () returned 0x0 [0093.451] GetLastError () returned 0x0 [0093.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffffeb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.453] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x14a, lpOverlapped=0x0) returned 1 [0093.453] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.453] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.453] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.453] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.453] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.454] CloseHandle (hObject=0xf0) returned 1 [0093.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x27dc090 [0093.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc090 | out: hHeap=0x260000) returned 1 [0093.455] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.455] GetLastError () returned 0x0 [0093.455] RtlWakeConditionVariable () returned 0x27e828 [0093.455] GetCurrentThreadId () returned 0x9ac [0093.455] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".ldf") returned 0x0 [0093.455] lstrlenW (lpString=".vhd") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".vhd") returned 0x0 [0093.456] lstrlenW (lpString=".vhdx") returned 5 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".vhdx") returned 0x0 [0093.456] lstrlenW (lpString=".pst") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".pst") returned 0x0 [0093.456] lstrlenW (lpString=".ost") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".ost") returned 0x0 [0093.456] lstrlenW (lpString=".bak") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".bak") returned 0x0 [0093.456] lstrlenW (lpString=".bac") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".bac") returned 0x0 [0093.456] lstrlenW (lpString=".sys") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".sys") returned 0x0 [0093.456] lstrlenW (lpString=".v2i") returned 4 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".v2i") returned 0x0 [0093.456] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.456] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.457] lstrlenW (lpString=".sql") returned 4 [0093.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".sql") returned 0x0 [0093.457] lstrlenW (lpString=".mdf") returned 4 [0093.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".mdf") returned 0x0 [0093.457] lstrlenW (lpString=".txt") returned 4 [0093.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".txt") returned 0x0 [0093.457] lstrlenW (lpString=".dbf") returned 4 [0093.457] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".dbf") returned 0x0 [0093.458] lstrlenW (lpString=".ckp") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".ckp") returned 0x0 [0093.458] lstrlenW (lpString=".dacpac") returned 7 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".dacpac") returned 0x0 [0093.458] lstrlenW (lpString=".db3") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".db3") returned 0x0 [0093.458] lstrlenW (lpString=".dtxs") returned 5 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".dtxs") returned 0x0 [0093.458] lstrlenW (lpString=".mdt") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".mdt") returned 0x0 [0093.458] lstrlenW (lpString=".sdf") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".sdf") returned 0x0 [0093.458] lstrlenW (lpString=".MDF") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".MDF") returned 0x0 [0093.458] lstrlenW (lpString=".DBF") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".DBF") returned 0x0 [0093.458] lstrlenW (lpString=".DB") returned 3 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".DB") returned 0x0 [0093.458] lstrlenW (lpString=".db") returned 3 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".db") returned 0x0 [0093.458] lstrlenW (lpString=".ndf") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".ndf") returned 0x0 [0093.458] lstrlenW (lpString=".NDF") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".NDF") returned 0x0 [0093.458] lstrlenW (lpString=".Mdf") returned 4 [0093.458] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".Mdf") returned 0x0 [0093.459] lstrlenW (lpString=".dat") returned 4 [0093.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".dat") returned 0x0 [0093.459] lstrlenW (lpString=".DAT") returned 4 [0093.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".DAT") returned 0x0 [0093.459] lstrlenW (lpString=".ldf") returned 4 [0093.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".ldf") returned 0x0 [0093.459] lstrlenW (lpString=".LDF") returned 4 [0093.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch=".LDF") returned 0x0 [0093.459] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.459] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.459] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.459] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.460] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.460] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.460] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21346115219) returned 1 [0093.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc685f930, dwHighDateTime=0x1d585b4)) [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b80e0 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b80e0 | out: hHeap=0x260000) returned 1 [0093.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.460] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b8a0 [0093.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.461] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b8a0 | out: hHeap=0x260000) returned 1 [0093.461] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.461] GetLastError () returned 0x0 [0093.461] GetLastError () returned 0x0 [0093.461] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.461] GetLastError () returned 0x0 [0093.461] GetLastError () returned 0x0 [0093.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.464] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.464] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.464] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.464] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.464] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.464] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.465] CloseHandle (hObject=0xf0) returned 1 [0093.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0093.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0093.466] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.466] GetLastError () returned 0x0 [0093.466] RtlWakeConditionVariable () returned 0x27e828 [0093.466] GetCurrentThreadId () returned 0x9ac [0093.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".ldf") returned 0x0 [0093.466] lstrlenW (lpString=".vhd") returned 4 [0093.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".vhd") returned 0x0 [0093.466] lstrlenW (lpString=".vhdx") returned 5 [0093.466] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".vhdx") returned 0x0 [0093.466] lstrlenW (lpString=".pst") returned 4 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".pst") returned 0x0 [0093.467] lstrlenW (lpString=".ost") returned 4 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".ost") returned 0x0 [0093.467] lstrlenW (lpString=".bak") returned 4 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".bak") returned 0x0 [0093.467] lstrlenW (lpString=".bac") returned 4 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".bac") returned 0x0 [0093.467] lstrlenW (lpString=".sys") returned 4 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".sys") returned 0x0 [0093.467] lstrlenW (lpString=".v2i") returned 4 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".v2i") returned 0x0 [0093.467] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.468] lstrlenW (lpString=".sql") returned 4 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".sql") returned 0x0 [0093.468] lstrlenW (lpString=".mdf") returned 4 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".mdf") returned 0x0 [0093.468] lstrlenW (lpString=".txt") returned 4 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".txt") returned 0x0 [0093.468] lstrlenW (lpString=".dbf") returned 4 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".dbf") returned 0x0 [0093.468] lstrlenW (lpString=".ckp") returned 4 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".ckp") returned 0x0 [0093.468] lstrlenW (lpString=".dacpac") returned 7 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".dacpac") returned 0x0 [0093.468] lstrlenW (lpString=".db3") returned 4 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".db3") returned 0x0 [0093.468] lstrlenW (lpString=".dtxs") returned 5 [0093.468] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".dtxs") returned 0x0 [0093.469] lstrlenW (lpString=".mdt") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".mdt") returned 0x0 [0093.469] lstrlenW (lpString=".sdf") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".sdf") returned 0x0 [0093.469] lstrlenW (lpString=".MDF") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".MDF") returned 0x0 [0093.469] lstrlenW (lpString=".DBF") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".DBF") returned 0x0 [0093.469] lstrlenW (lpString=".DB") returned 3 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".DB") returned 0x0 [0093.469] lstrlenW (lpString=".db") returned 3 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".db") returned 0x0 [0093.469] lstrlenW (lpString=".ndf") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".ndf") returned 0x0 [0093.469] lstrlenW (lpString=".NDF") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".NDF") returned 0x0 [0093.469] lstrlenW (lpString=".Mdf") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".Mdf") returned 0x0 [0093.469] lstrlenW (lpString=".dat") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".dat") returned 0x0 [0093.469] lstrlenW (lpString=".DAT") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".DAT") returned 0x0 [0093.469] lstrlenW (lpString=".ldf") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".ldf") returned 0x0 [0093.469] lstrlenW (lpString=".LDF") returned 4 [0093.469] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch=".LDF") returned 0x0 [0093.469] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.470] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.470] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e380) returned 1 [0093.470] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.470] CryptReleaseContext (hProv=0x33e380, dwFlags=0x0) returned 1 [0093.470] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.471] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21347174859) returned 1 [0093.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc685f930, dwHighDateTime=0x1d585b4)) [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2b8118 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b8118 | out: hHeap=0x260000) returned 1 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33b8a0 [0093.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.471] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33b8a0 | out: hHeap=0x260000) returned 1 [0093.471] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.471] GetLastError () returned 0x0 [0093.472] GetLastError () returned 0x0 [0093.472] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.472] GetLastError () returned 0x0 [0093.472] GetLastError () returned 0x0 [0093.543] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.544] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.556] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.556] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.557] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.557] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.557] CloseHandle (hObject=0xf0) returned 1 [0093.557] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0093.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0093.560] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.560] GetLastError () returned 0x0 [0093.560] RtlWakeConditionVariable () returned 0x0 [0093.561] GetCurrentThreadId () returned 0x9ac [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".ldf") returned 0x0 [0093.561] lstrlenW (lpString=".vhd") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".vhd") returned 0x0 [0093.561] lstrlenW (lpString=".vhdx") returned 5 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".vhdx") returned 0x0 [0093.561] lstrlenW (lpString=".pst") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".pst") returned 0x0 [0093.561] lstrlenW (lpString=".ost") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".ost") returned 0x0 [0093.561] lstrlenW (lpString=".bak") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".bak") returned 0x0 [0093.561] lstrlenW (lpString=".bac") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".bac") returned 0x0 [0093.561] lstrlenW (lpString=".sys") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".sys") returned 0x0 [0093.561] lstrlenW (lpString=".v2i") returned 4 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".v2i") returned 0x0 [0093.561] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.561] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch="s\r\n.v2i") returned 0x0 [0093.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.569] lstrlenW (lpString=".sql") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".sql") returned 0x0 [0093.569] lstrlenW (lpString=".mdf") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".mdf") returned 0x0 [0093.569] lstrlenW (lpString=".txt") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".txt") returned 0x0 [0093.569] lstrlenW (lpString=".dbf") returned 4 [0093.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".dbf") returned 0x0 [0093.570] lstrlenW (lpString=".ckp") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".ckp") returned 0x0 [0093.570] lstrlenW (lpString=".dacpac") returned 7 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".dacpac") returned 0x0 [0093.570] lstrlenW (lpString=".db3") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".db3") returned 0x0 [0093.570] lstrlenW (lpString=".dtxs") returned 5 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".dtxs") returned 0x0 [0093.570] lstrlenW (lpString=".mdt") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".mdt") returned 0x0 [0093.570] lstrlenW (lpString=".sdf") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".sdf") returned 0x0 [0093.570] lstrlenW (lpString=".MDF") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".MDF") returned 0x0 [0093.570] lstrlenW (lpString=".DBF") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".DBF") returned 0x0 [0093.570] lstrlenW (lpString=".DB") returned 3 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".DB") returned 0x0 [0093.570] lstrlenW (lpString=".db") returned 3 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".db") returned 0x0 [0093.570] lstrlenW (lpString=".ndf") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".ndf") returned 0x0 [0093.570] lstrlenW (lpString=".NDF") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".NDF") returned 0x0 [0093.570] lstrlenW (lpString=".Mdf") returned 4 [0093.570] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".Mdf") returned 0x0 [0093.571] lstrlenW (lpString=".dat") returned 4 [0093.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".dat") returned 0x0 [0093.571] lstrlenW (lpString=".DAT") returned 4 [0093.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".DAT") returned 0x0 [0093.571] lstrlenW (lpString=".ldf") returned 4 [0093.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".ldf") returned 0x0 [0093.571] lstrlenW (lpString=".LDF") returned 4 [0093.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch=".LDF") returned 0x0 [0093.571] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.571] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.571] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.571] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e738) returned 1 [0093.572] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.572] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0093.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.572] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21357302322) returned 1 [0093.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc696a2d0, dwHighDateTime=0x1d585b4)) [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df168 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df168 | out: hHeap=0x260000) returned 1 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.572] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.573] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.573] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.573] GetLastError () returned 0x0 [0093.573] GetLastError () returned 0x0 [0093.573] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.573] GetLastError () returned 0x0 [0093.573] GetLastError () returned 0x0 [0093.576] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.576] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.577] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.577] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.577] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.578] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.578] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.578] CloseHandle (hObject=0xf0) returned 1 [0093.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0093.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.[deadmin@cock.li].deadmin")) returned 1 [0093.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0093.584] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.584] GetLastError () returned 0x0 [0093.584] RtlWakeConditionVariable () returned 0x0 [0093.584] GetCurrentThreadId () returned 0x9ac [0093.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".ldf") returned 0x0 [0093.584] lstrlenW (lpString=".vhd") returned 4 [0093.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".vhd") returned 0x0 [0093.584] lstrlenW (lpString=".vhdx") returned 5 [0093.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".vhdx") returned 0x0 [0093.584] lstrlenW (lpString=".pst") returned 4 [0093.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".pst") returned 0x0 [0093.584] lstrlenW (lpString=".ost") returned 4 [0093.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".ost") returned 0x0 [0093.584] lstrlenW (lpString=".bak") returned 4 [0093.584] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".bak") returned 0x0 [0093.584] lstrlenW (lpString=".bac") returned 4 [0093.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".bac") returned 0x0 [0093.585] lstrlenW (lpString=".sys") returned 4 [0093.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".sys") returned 0x0 [0093.585] lstrlenW (lpString=".v2i") returned 4 [0093.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".v2i") returned 0x0 [0093.585] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.585] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch="s\r\n.v2i") returned 0x0 [0093.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.586] lstrlenW (lpString=".sql") returned 4 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".sql") returned 0x0 [0093.586] lstrlenW (lpString=".mdf") returned 4 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".mdf") returned 0x0 [0093.586] lstrlenW (lpString=".txt") returned 4 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".txt") returned 0x0 [0093.586] lstrlenW (lpString=".dbf") returned 4 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".dbf") returned 0x0 [0093.586] lstrlenW (lpString=".ckp") returned 4 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".ckp") returned 0x0 [0093.586] lstrlenW (lpString=".dacpac") returned 7 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".dacpac") returned 0x0 [0093.586] lstrlenW (lpString=".db3") returned 4 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".db3") returned 0x0 [0093.586] lstrlenW (lpString=".dtxs") returned 5 [0093.586] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".dtxs") returned 0x0 [0093.587] lstrlenW (lpString=".mdt") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".mdt") returned 0x0 [0093.587] lstrlenW (lpString=".sdf") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".sdf") returned 0x0 [0093.587] lstrlenW (lpString=".MDF") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".MDF") returned 0x0 [0093.587] lstrlenW (lpString=".DBF") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".DBF") returned 0x0 [0093.587] lstrlenW (lpString=".DB") returned 3 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".DB") returned 0x0 [0093.587] lstrlenW (lpString=".db") returned 3 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".db") returned 0x0 [0093.587] lstrlenW (lpString=".ndf") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".ndf") returned 0x0 [0093.587] lstrlenW (lpString=".NDF") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".NDF") returned 0x0 [0093.587] lstrlenW (lpString=".Mdf") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".Mdf") returned 0x0 [0093.587] lstrlenW (lpString=".dat") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".dat") returned 0x0 [0093.587] lstrlenW (lpString=".DAT") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".DAT") returned 0x0 [0093.587] lstrlenW (lpString=".ldf") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".ldf") returned 0x0 [0093.587] lstrlenW (lpString=".LDF") returned 4 [0093.587] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch=".LDF") returned 0x0 [0093.587] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.588] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.588] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e6b0) returned 1 [0093.588] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.588] CryptReleaseContext (hProv=0x33e6b0, dwFlags=0x0) returned 1 [0093.588] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.589] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21358973612) returned 1 [0093.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6990430, dwHighDateTime=0x1d585b4)) [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df1a0 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df1a0 | out: hHeap=0x260000) returned 1 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0093.589] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.589] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.589] GetLastError () returned 0x0 [0093.590] GetLastError () returned 0x0 [0093.590] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.590] GetLastError () returned 0x0 [0093.590] GetLastError () returned 0x0 [0093.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff8c38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.592] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x73c8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x73c8, lpOverlapped=0x0) returned 1 [0093.592] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.592] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.592] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.592] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.592] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.592] CloseHandle (hObject=0xf0) returned 1 [0093.593] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.[deadmin@cock.li].deadmin")) returned 1 [0093.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.594] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.594] GetLastError () returned 0x0 [0093.594] RtlWakeConditionVariable () returned 0x0 [0093.594] GetCurrentThreadId () returned 0x9ac [0093.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".ldf") returned 0x0 [0093.594] lstrlenW (lpString=".vhd") returned 4 [0093.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".vhd") returned 0x0 [0093.594] lstrlenW (lpString=".vhdx") returned 5 [0093.594] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".vhdx") returned 0x0 [0093.595] lstrlenW (lpString=".pst") returned 4 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".pst") returned 0x0 [0093.595] lstrlenW (lpString=".ost") returned 4 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".ost") returned 0x0 [0093.595] lstrlenW (lpString=".bak") returned 4 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".bak") returned 0x0 [0093.595] lstrlenW (lpString=".bac") returned 4 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".bac") returned 0x0 [0093.595] lstrlenW (lpString=".sys") returned 4 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".sys") returned 0x0 [0093.595] lstrlenW (lpString=".v2i") returned 4 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".v2i") returned 0x0 [0093.595] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.595] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.596] lstrlenW (lpString=".sql") returned 4 [0093.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".sql") returned 0x0 [0093.596] lstrlenW (lpString=".mdf") returned 4 [0093.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".mdf") returned 0x0 [0093.596] lstrlenW (lpString=".txt") returned 4 [0093.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".txt") returned 0x0 [0093.596] lstrlenW (lpString=".dbf") returned 4 [0093.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".dbf") returned 0x0 [0093.596] lstrlenW (lpString=".ckp") returned 4 [0093.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".ckp") returned 0x0 [0093.597] lstrlenW (lpString=".dacpac") returned 7 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".dacpac") returned 0x0 [0093.597] lstrlenW (lpString=".db3") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".db3") returned 0x0 [0093.597] lstrlenW (lpString=".dtxs") returned 5 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".dtxs") returned 0x0 [0093.597] lstrlenW (lpString=".mdt") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".mdt") returned 0x0 [0093.597] lstrlenW (lpString=".sdf") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".sdf") returned 0x0 [0093.597] lstrlenW (lpString=".MDF") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".MDF") returned 0x0 [0093.597] lstrlenW (lpString=".DBF") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".DBF") returned 0x0 [0093.597] lstrlenW (lpString=".DB") returned 3 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".DB") returned 0x0 [0093.597] lstrlenW (lpString=".db") returned 3 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".db") returned 0x0 [0093.597] lstrlenW (lpString=".ndf") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".ndf") returned 0x0 [0093.597] lstrlenW (lpString=".NDF") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".NDF") returned 0x0 [0093.597] lstrlenW (lpString=".Mdf") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".Mdf") returned 0x0 [0093.597] lstrlenW (lpString=".dat") returned 4 [0093.597] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".dat") returned 0x0 [0093.598] lstrlenW (lpString=".DAT") returned 4 [0093.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".DAT") returned 0x0 [0093.598] lstrlenW (lpString=".ldf") returned 4 [0093.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".ldf") returned 0x0 [0093.598] lstrlenW (lpString=".LDF") returned 4 [0093.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch=".LDF") returned 0x0 [0093.598] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.598] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.598] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.598] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e848) returned 1 [0093.599] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.599] CryptReleaseContext (hProv=0x33e848, dwFlags=0x0) returned 1 [0093.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.599] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21359998606) returned 1 [0093.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6990430, dwHighDateTime=0x1d585b4)) [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df1d8 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df1d8 | out: hHeap=0x260000) returned 1 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f460 [0093.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.599] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f460 | out: hHeap=0x260000) returned 1 [0093.599] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0093.600] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.600] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.600] GetLastError () returned 0x0 [0093.600] GetLastError () returned 0x0 [0093.600] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.600] GetLastError () returned 0x0 [0093.600] GetLastError () returned 0x0 [0093.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.629] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.629] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0093.629] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.629] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.734] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.735] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.735] CloseHandle (hObject=0xf0) returned 1 [0093.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.751] GetLastError () returned 0x0 [0093.751] RtlWakeConditionVariable () returned 0x0 [0093.751] GetCurrentThreadId () returned 0x9ac [0093.751] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.752] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.752] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.752] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.754] CloseHandle (hObject=0xf0) returned 1 [0093.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2755b90 | out: hHeap=0x260000) returned 1 [0093.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27559c0 | out: hHeap=0x260000) returned 1 [0093.754] RtlWakeConditionVariable () returned 0x0 [0093.754] GetCurrentThreadId () returned 0x9ac [0093.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.754] lstrlenW (lpString=".vhd") returned 4 [0093.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".vhd") returned 0x0 [0093.754] lstrlenW (lpString=".vhdx") returned 5 [0093.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".vhdx") returned 0x0 [0093.754] lstrlenW (lpString=".pst") returned 4 [0093.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".pst") returned 0x0 [0093.754] lstrlenW (lpString=".ost") returned 4 [0093.754] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".ost") returned 0x0 [0093.755] lstrlenW (lpString=".bak") returned 4 [0093.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".bak") returned 0x0 [0093.755] lstrlenW (lpString=".bac") returned 4 [0093.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".bac") returned 0x0 [0093.755] lstrlenW (lpString=".sys") returned 4 [0093.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".sys") returned 0x0 [0093.755] lstrlenW (lpString=".v2i") returned 4 [0093.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".v2i") returned 0x0 [0093.755] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch="s\r\n.v2i") returned 0x0 [0093.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.756] lstrlenW (lpString=".sql") returned 4 [0093.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".sql") returned 0x0 [0093.756] lstrlenW (lpString=".mdf") returned 4 [0093.756] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".mdf") returned 0x0 [0093.756] lstrlenW (lpString=".txt") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".txt") returned 0x0 [0093.757] lstrlenW (lpString=".dbf") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".dbf") returned 0x0 [0093.757] lstrlenW (lpString=".ckp") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".ckp") returned 0x0 [0093.757] lstrlenW (lpString=".dacpac") returned 7 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".dacpac") returned 0x0 [0093.757] lstrlenW (lpString=".db3") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".db3") returned 0x0 [0093.757] lstrlenW (lpString=".dtxs") returned 5 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".dtxs") returned 0x0 [0093.757] lstrlenW (lpString=".mdt") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".mdt") returned 0x0 [0093.757] lstrlenW (lpString=".sdf") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".sdf") returned 0x0 [0093.757] lstrlenW (lpString=".MDF") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".MDF") returned 0x0 [0093.757] lstrlenW (lpString=".DBF") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".DBF") returned 0x0 [0093.757] lstrlenW (lpString=".DB") returned 3 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".DB") returned 0x0 [0093.757] lstrlenW (lpString=".db") returned 3 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".db") returned 0x0 [0093.757] lstrlenW (lpString=".ndf") returned 4 [0093.757] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".ndf") returned 0x0 [0093.758] lstrlenW (lpString=".NDF") returned 4 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".NDF") returned 0x0 [0093.758] lstrlenW (lpString=".Mdf") returned 4 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".Mdf") returned 0x0 [0093.758] lstrlenW (lpString=".dat") returned 4 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".dat") returned 0x0 [0093.758] lstrlenW (lpString=".DAT") returned 4 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".DAT") returned 0x0 [0093.758] lstrlenW (lpString=".ldf") returned 4 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".ldf") returned 0x0 [0093.758] lstrlenW (lpString=".LDF") returned 4 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch=".LDF") returned 0x0 [0093.758] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.758] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.758] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e738) returned 1 [0093.759] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.759] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0093.759] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.759] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21376029964) returned 1 [0093.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6b33350, dwHighDateTime=0x1d585b4)) [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df440 [0093.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df440 | out: hHeap=0x260000) returned 1 [0093.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.760] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.760] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.760] GetLastError () returned 0x0 [0093.760] GetLastError () returned 0x0 [0093.760] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.760] GetLastError () returned 0x0 [0093.761] GetLastError () returned 0x0 [0093.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffff2890, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.764] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xd770, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xd770, lpOverlapped=0x0) returned 1 [0093.764] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.764] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.764] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.765] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.765] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.765] CloseHandle (hObject=0xf0) returned 1 [0093.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0093.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0093.771] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.771] GetLastError () returned 0x0 [0093.771] RtlWakeConditionVariable () returned 0x0 [0093.771] GetCurrentThreadId () returned 0x9ac [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.771] lstrlenW (lpString=".vhd") returned 4 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".vhd") returned 0x0 [0093.771] lstrlenW (lpString=".vhdx") returned 5 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".vhdx") returned 0x0 [0093.771] lstrlenW (lpString=".pst") returned 4 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".pst") returned 0x0 [0093.771] lstrlenW (lpString=".ost") returned 4 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ost") returned 0x0 [0093.771] lstrlenW (lpString=".bak") returned 4 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".bak") returned 0x0 [0093.771] lstrlenW (lpString=".bac") returned 4 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".bac") returned 0x0 [0093.771] lstrlenW (lpString=".sys") returned 4 [0093.771] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".sys") returned 0x0 [0093.772] lstrlenW (lpString=".v2i") returned 4 [0093.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".v2i") returned 0x0 [0093.772] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.772] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch="s\r\n.v2i") returned 0x0 [0093.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.774] lstrlenW (lpString=".sql") returned 4 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".sql") returned 0x0 [0093.774] lstrlenW (lpString=".mdf") returned 4 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".mdf") returned 0x0 [0093.774] lstrlenW (lpString=".txt") returned 4 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".txt") returned 0x0 [0093.774] lstrlenW (lpString=".dbf") returned 4 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dbf") returned 0x0 [0093.774] lstrlenW (lpString=".ckp") returned 4 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ckp") returned 0x0 [0093.774] lstrlenW (lpString=".dacpac") returned 7 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dacpac") returned 0x0 [0093.774] lstrlenW (lpString=".db3") returned 4 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".db3") returned 0x0 [0093.774] lstrlenW (lpString=".dtxs") returned 5 [0093.774] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dtxs") returned 0x0 [0093.775] lstrlenW (lpString=".mdt") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".mdt") returned 0x0 [0093.775] lstrlenW (lpString=".sdf") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".sdf") returned 0x0 [0093.775] lstrlenW (lpString=".MDF") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".MDF") returned 0x0 [0093.775] lstrlenW (lpString=".DBF") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".DBF") returned 0x0 [0093.775] lstrlenW (lpString=".DB") returned 3 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".DB") returned 0x0 [0093.775] lstrlenW (lpString=".db") returned 3 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".db") returned 0x0 [0093.775] lstrlenW (lpString=".ndf") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ndf") returned 0x0 [0093.775] lstrlenW (lpString=".NDF") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".NDF") returned 0x0 [0093.775] lstrlenW (lpString=".Mdf") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".Mdf") returned 0x0 [0093.775] lstrlenW (lpString=".dat") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".dat") returned 0x0 [0093.775] lstrlenW (lpString=".DAT") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".DAT") returned 0x0 [0093.775] lstrlenW (lpString=".ldf") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".ldf") returned 0x0 [0093.775] lstrlenW (lpString=".LDF") returned 4 [0093.775] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch=".LDF") returned 0x0 [0093.775] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.776] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29226b0 [0093.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.776] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e738) returned 1 [0093.776] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.777] CryptReleaseContext (hProv=0x33e738, dwFlags=0x0) returned 1 [0093.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a28 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277e680 [0093.777] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21377786383) returned 1 [0093.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6b594b0, dwHighDateTime=0x1d585b4)) [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279328 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2793a8 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x2787b0 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df478 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df478 | out: hHeap=0x260000) returned 1 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x33bf30 [0093.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0093.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x33bf30 | out: hHeap=0x260000) returned 1 [0093.777] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.778] GetLastError () returned 0x0 [0093.778] GetLastError () returned 0x0 [0093.778] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.778] GetLastError () returned 0x0 [0093.778] GetLastError () returned 0x0 [0093.781] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.782] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.783] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0093.783] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.783] WriteFile (in: hFile=0xf0, lpBuffer=0x280a28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a28*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.783] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.783] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.783] CloseHandle (hObject=0xf0) returned 1 [0093.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0093.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.[deadmin@cock.li].deadmin")) returned 1 [0093.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0093.785] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2787b0 | out: hHeap=0x260000) returned 1 [0093.785] GetLastError () returned 0x0 [0093.785] RtlWakeConditionVariable () returned 0x0 [0093.785] GetCurrentThreadId () returned 0x9ac [0093.786] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.786] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0093.786] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0093.786] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0093.878] CloseHandle (hObject=0xf0) returned 1 [0093.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dc4c8 | out: hHeap=0x260000) returned 1 [0093.878] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0093.878] RtlWakeConditionVariable () returned 0x0 [0093.890] GetCurrentThreadId () returned 0x9ac [0093.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".ldf") returned 0x0 [0093.891] lstrlenW (lpString=".vhd") returned 4 [0093.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".vhd") returned 0x0 [0093.891] lstrlenW (lpString=".vhdx") returned 5 [0093.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".vhdx") returned 0x0 [0093.891] lstrlenW (lpString=".pst") returned 4 [0093.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".pst") returned 0x0 [0093.894] lstrlenW (lpString=".ost") returned 4 [0093.894] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".ost") returned 0x0 [0093.894] lstrlenW (lpString=".bak") returned 4 [0093.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".bak") returned 0x0 [0093.895] lstrlenW (lpString=".bac") returned 4 [0093.895] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".bac") returned 0x0 [0093.905] lstrlenW (lpString=".sys") returned 4 [0093.905] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".sys") returned 0x0 [0093.906] lstrlenW (lpString=".v2i") returned 4 [0093.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".v2i") returned 0x0 [0093.906] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.906] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0093.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.908] lstrlenW (lpString=".sql") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".sql") returned 0x0 [0093.908] lstrlenW (lpString=".mdf") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".mdf") returned 0x0 [0093.908] lstrlenW (lpString=".txt") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".txt") returned 0x0 [0093.908] lstrlenW (lpString=".dbf") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".dbf") returned 0x0 [0093.908] lstrlenW (lpString=".ckp") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".ckp") returned 0x0 [0093.908] lstrlenW (lpString=".dacpac") returned 7 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".dacpac") returned 0x0 [0093.908] lstrlenW (lpString=".db3") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".db3") returned 0x0 [0093.908] lstrlenW (lpString=".dtxs") returned 5 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".dtxs") returned 0x0 [0093.908] lstrlenW (lpString=".mdt") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".mdt") returned 0x0 [0093.908] lstrlenW (lpString=".sdf") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".sdf") returned 0x0 [0093.908] lstrlenW (lpString=".MDF") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".MDF") returned 0x0 [0093.908] lstrlenW (lpString=".DBF") returned 4 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".DBF") returned 0x0 [0093.908] lstrlenW (lpString=".DB") returned 3 [0093.908] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".DB") returned 0x0 [0093.908] lstrlenW (lpString=".db") returned 3 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".db") returned 0x0 [0093.909] lstrlenW (lpString=".ndf") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".ndf") returned 0x0 [0093.909] lstrlenW (lpString=".NDF") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".NDF") returned 0x0 [0093.909] lstrlenW (lpString=".Mdf") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".Mdf") returned 0x0 [0093.909] lstrlenW (lpString=".dat") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".dat") returned 0x0 [0093.909] lstrlenW (lpString=".DAT") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".DAT") returned 0x0 [0093.909] lstrlenW (lpString=".ldf") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".ldf") returned 0x0 [0093.909] lstrlenW (lpString=".LDF") returned 4 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch=".LDF") returned 0x0 [0093.909] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.909] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ec88) returned 1 [0093.910] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.910] CryptReleaseContext (hProv=0x33ec88, dwFlags=0x0) returned 1 [0093.910] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.910] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21391140099) returned 1 [0093.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6c89fb0, dwHighDateTime=0x1d585b4)) [0093.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df6e0 [0093.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df6e0 | out: hHeap=0x260000) returned 1 [0093.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.911] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.911] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.911] GetLastError () returned 0x0 [0093.911] GetLastError () returned 0x0 [0093.911] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.912] GetLastError () returned 0x0 [0093.912] GetLastError () returned 0x0 [0093.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.916] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0093.918] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0093.918] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.918] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0093.919] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0093.919] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0093.919] CloseHandle (hObject=0xf0) returned 1 [0093.919] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0093.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.[deadmin@cock.li].deadmin")) returned 1 [0093.921] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0093.922] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0093.922] GetLastError () returned 0x0 [0093.922] RtlWakeConditionVariable () returned 0x0 [0093.922] GetCurrentThreadId () returned 0x9ac [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".ldf") returned 0x0 [0093.922] lstrlenW (lpString=".vhd") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".vhd") returned 0x0 [0093.922] lstrlenW (lpString=".vhdx") returned 5 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".vhdx") returned 0x0 [0093.922] lstrlenW (lpString=".pst") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".pst") returned 0x0 [0093.922] lstrlenW (lpString=".ost") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".ost") returned 0x0 [0093.922] lstrlenW (lpString=".bak") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".bak") returned 0x0 [0093.922] lstrlenW (lpString=".bac") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".bac") returned 0x0 [0093.922] lstrlenW (lpString=".sys") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".sys") returned 0x0 [0093.922] lstrlenW (lpString=".v2i") returned 4 [0093.922] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".v2i") returned 0x0 [0093.922] lstrlenW (lpString="s\r\n.v2i") returned 7 [0093.923] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch="s\r\n.v2i") returned 0x0 [0093.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0093.925] lstrlenW (lpString=".sql") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".sql") returned 0x0 [0093.925] lstrlenW (lpString=".mdf") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".mdf") returned 0x0 [0093.925] lstrlenW (lpString=".txt") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".txt") returned 0x0 [0093.925] lstrlenW (lpString=".dbf") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".dbf") returned 0x0 [0093.925] lstrlenW (lpString=".ckp") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".ckp") returned 0x0 [0093.925] lstrlenW (lpString=".dacpac") returned 7 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".dacpac") returned 0x0 [0093.925] lstrlenW (lpString=".db3") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".db3") returned 0x0 [0093.925] lstrlenW (lpString=".dtxs") returned 5 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".dtxs") returned 0x0 [0093.925] lstrlenW (lpString=".mdt") returned 4 [0093.925] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".mdt") returned 0x0 [0093.925] lstrlenW (lpString=".sdf") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".sdf") returned 0x0 [0093.926] lstrlenW (lpString=".MDF") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".MDF") returned 0x0 [0093.926] lstrlenW (lpString=".DBF") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".DBF") returned 0x0 [0093.926] lstrlenW (lpString=".DB") returned 3 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".DB") returned 0x0 [0093.926] lstrlenW (lpString=".db") returned 3 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".db") returned 0x0 [0093.926] lstrlenW (lpString=".ndf") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".ndf") returned 0x0 [0093.926] lstrlenW (lpString=".NDF") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".NDF") returned 0x0 [0093.926] lstrlenW (lpString=".Mdf") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".Mdf") returned 0x0 [0093.926] lstrlenW (lpString=".dat") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".dat") returned 0x0 [0093.926] lstrlenW (lpString=".DAT") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".DAT") returned 0x0 [0093.926] lstrlenW (lpString=".ldf") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".ldf") returned 0x0 [0093.926] lstrlenW (lpString=".LDF") returned 4 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch=".LDF") returned 0x0 [0093.926] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0093.926] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0093.926] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0093.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0093.927] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ed10) returned 1 [0093.927] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0093.927] CryptReleaseContext (hProv=0x33ed10, dwFlags=0x0) returned 1 [0093.927] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0093.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0093.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0093.928] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21392874287) returned 1 [0093.940] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6cd6270, dwHighDateTime=0x1d585b4)) [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df718 [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0093.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df718 | out: hHeap=0x260000) returned 1 [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0093.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0093.940] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0093.940] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0093.941] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dff0 [0093.941] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0093.941] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0093.941] GetLastError () returned 0x0 [0093.941] GetLastError () returned 0x0 [0093.941] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0093.941] GetLastError () returned 0x0 [0093.941] GetLastError () returned 0x0 [0094.011] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffeca5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.011] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x135a4, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x135a4, lpOverlapped=0x0) returned 1 [0094.023] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.023] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.024] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.024] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.024] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.024] CloseHandle (hObject=0xf0) returned 1 [0094.024] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.[deadmin@cock.li].deadmin")) returned 1 [0094.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.026] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.026] GetLastError () returned 0x0 [0094.026] RtlWakeConditionVariable () returned 0x0 [0094.026] GetCurrentThreadId () returned 0x9ac [0094.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".ldf") returned 0x0 [0094.026] lstrlenW (lpString=".vhd") returned 4 [0094.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".vhd") returned 0x0 [0094.026] lstrlenW (lpString=".vhdx") returned 5 [0094.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".vhdx") returned 0x0 [0094.026] lstrlenW (lpString=".pst") returned 4 [0094.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".pst") returned 0x0 [0094.026] lstrlenW (lpString=".ost") returned 4 [0094.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".ost") returned 0x0 [0094.026] lstrlenW (lpString=".bak") returned 4 [0094.026] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".bak") returned 0x0 [0094.027] lstrlenW (lpString=".bac") returned 4 [0094.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".bac") returned 0x0 [0094.027] lstrlenW (lpString=".sys") returned 4 [0094.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".sys") returned 0x0 [0094.027] lstrlenW (lpString=".v2i") returned 4 [0094.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".v2i") returned 0x0 [0094.027] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.027] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch="s\r\n.v2i") returned 0x0 [0094.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.028] lstrlenW (lpString=".sql") returned 4 [0094.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".sql") returned 0x0 [0094.028] lstrlenW (lpString=".mdf") returned 4 [0094.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".mdf") returned 0x0 [0094.028] lstrlenW (lpString=".txt") returned 4 [0094.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".txt") returned 0x0 [0094.028] lstrlenW (lpString=".dbf") returned 4 [0094.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".dbf") returned 0x0 [0094.028] lstrlenW (lpString=".ckp") returned 4 [0094.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".ckp") returned 0x0 [0094.029] lstrlenW (lpString=".dacpac") returned 7 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".dacpac") returned 0x0 [0094.029] lstrlenW (lpString=".db3") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".db3") returned 0x0 [0094.029] lstrlenW (lpString=".dtxs") returned 5 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".dtxs") returned 0x0 [0094.029] lstrlenW (lpString=".mdt") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".mdt") returned 0x0 [0094.029] lstrlenW (lpString=".sdf") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".sdf") returned 0x0 [0094.029] lstrlenW (lpString=".MDF") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".MDF") returned 0x0 [0094.029] lstrlenW (lpString=".DBF") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".DBF") returned 0x0 [0094.029] lstrlenW (lpString=".DB") returned 3 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".DB") returned 0x0 [0094.029] lstrlenW (lpString=".db") returned 3 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".db") returned 0x0 [0094.029] lstrlenW (lpString=".ndf") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".ndf") returned 0x0 [0094.029] lstrlenW (lpString=".NDF") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".NDF") returned 0x0 [0094.029] lstrlenW (lpString=".Mdf") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".Mdf") returned 0x0 [0094.029] lstrlenW (lpString=".dat") returned 4 [0094.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".dat") returned 0x0 [0094.030] lstrlenW (lpString=".DAT") returned 4 [0094.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".DAT") returned 0x0 [0094.030] lstrlenW (lpString=".ldf") returned 4 [0094.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".ldf") returned 0x0 [0094.030] lstrlenW (lpString=".LDF") returned 4 [0094.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch=".LDF") returned 0x0 [0094.030] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.030] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ee20) returned 1 [0094.031] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.031] CryptReleaseContext (hProv=0x33ee20, dwFlags=0x0) returned 1 [0094.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.031] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21403204836) returned 1 [0094.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6dbaab0, dwHighDateTime=0x1d585b4)) [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df8a0 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df8a0 | out: hHeap=0x260000) returned 1 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.031] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.032] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.032] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.032] GetLastError () returned 0x0 [0094.032] GetLastError () returned 0x0 [0094.032] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.032] GetLastError () returned 0x0 [0094.032] GetLastError () returned 0x0 [0094.035] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.035] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.036] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.036] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.036] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.036] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.036] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.036] CloseHandle (hObject=0xf0) returned 1 [0094.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.[deadmin@cock.li].deadmin")) returned 1 [0094.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.038] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.039] GetLastError () returned 0x0 [0094.039] RtlWakeConditionVariable () returned 0x0 [0094.039] GetCurrentThreadId () returned 0x9ac [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".ldf") returned 0x0 [0094.039] lstrlenW (lpString=".vhd") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".vhd") returned 0x0 [0094.039] lstrlenW (lpString=".vhdx") returned 5 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".vhdx") returned 0x0 [0094.039] lstrlenW (lpString=".pst") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".pst") returned 0x0 [0094.039] lstrlenW (lpString=".ost") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".ost") returned 0x0 [0094.039] lstrlenW (lpString=".bak") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".bak") returned 0x0 [0094.039] lstrlenW (lpString=".bac") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".bac") returned 0x0 [0094.039] lstrlenW (lpString=".sys") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".sys") returned 0x0 [0094.039] lstrlenW (lpString=".v2i") returned 4 [0094.039] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".v2i") returned 0x0 [0094.039] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.040] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.041] lstrlenW (lpString=".sql") returned 4 [0094.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".sql") returned 0x0 [0094.041] lstrlenW (lpString=".mdf") returned 4 [0094.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".mdf") returned 0x0 [0094.041] lstrlenW (lpString=".txt") returned 4 [0094.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".txt") returned 0x0 [0094.041] lstrlenW (lpString=".dbf") returned 4 [0094.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".dbf") returned 0x0 [0094.041] lstrlenW (lpString=".ckp") returned 4 [0094.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".ckp") returned 0x0 [0094.041] lstrlenW (lpString=".dacpac") returned 7 [0094.041] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".dacpac") returned 0x0 [0094.041] lstrlenW (lpString=".db3") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".db3") returned 0x0 [0094.042] lstrlenW (lpString=".dtxs") returned 5 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".dtxs") returned 0x0 [0094.042] lstrlenW (lpString=".mdt") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".mdt") returned 0x0 [0094.042] lstrlenW (lpString=".sdf") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".sdf") returned 0x0 [0094.042] lstrlenW (lpString=".MDF") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".MDF") returned 0x0 [0094.042] lstrlenW (lpString=".DBF") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".DBF") returned 0x0 [0094.042] lstrlenW (lpString=".DB") returned 3 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".DB") returned 0x0 [0094.042] lstrlenW (lpString=".db") returned 3 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".db") returned 0x0 [0094.042] lstrlenW (lpString=".ndf") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".ndf") returned 0x0 [0094.042] lstrlenW (lpString=".NDF") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".NDF") returned 0x0 [0094.042] lstrlenW (lpString=".Mdf") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".Mdf") returned 0x0 [0094.042] lstrlenW (lpString=".dat") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".dat") returned 0x0 [0094.042] lstrlenW (lpString=".DAT") returned 4 [0094.042] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".DAT") returned 0x0 [0094.042] lstrlenW (lpString=".ldf") returned 4 [0094.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".ldf") returned 0x0 [0094.043] lstrlenW (lpString=".LDF") returned 4 [0094.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch=".LDF") returned 0x0 [0094.043] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.043] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.043] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33f1d8) returned 1 [0094.044] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.044] CryptReleaseContext (hProv=0x33f1d8, dwFlags=0x0) returned 1 [0094.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.044] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21404491771) returned 1 [0094.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6de0c10, dwHighDateTime=0x1d585b4)) [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df8d8 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df8d8 | out: hHeap=0x260000) returned 1 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.044] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.044] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.045] GetLastError () returned 0x0 [0094.045] GetLastError () returned 0x0 [0094.045] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.045] GetLastError () returned 0x0 [0094.045] GetLastError () returned 0x0 [0094.049] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.049] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.050] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.050] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.051] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.051] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.051] CloseHandle (hObject=0xf0) returned 1 [0094.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0094.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0094.054] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.054] GetLastError () returned 0x0 [0094.055] RtlWakeConditionVariable () returned 0x0 [0094.055] GetCurrentThreadId () returned 0x9ac [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".ldf") returned 0x0 [0094.055] lstrlenW (lpString=".vhd") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".vhd") returned 0x0 [0094.055] lstrlenW (lpString=".vhdx") returned 5 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".vhdx") returned 0x0 [0094.055] lstrlenW (lpString=".pst") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".pst") returned 0x0 [0094.055] lstrlenW (lpString=".ost") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".ost") returned 0x0 [0094.055] lstrlenW (lpString=".bak") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".bak") returned 0x0 [0094.055] lstrlenW (lpString=".bac") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".bac") returned 0x0 [0094.055] lstrlenW (lpString=".sys") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".sys") returned 0x0 [0094.055] lstrlenW (lpString=".v2i") returned 4 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".v2i") returned 0x0 [0094.055] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.055] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch="s\r\n.v2i") returned 0x0 [0094.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.058] lstrlenW (lpString=".sql") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".sql") returned 0x0 [0094.058] lstrlenW (lpString=".mdf") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".mdf") returned 0x0 [0094.058] lstrlenW (lpString=".txt") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".txt") returned 0x0 [0094.058] lstrlenW (lpString=".dbf") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".dbf") returned 0x0 [0094.058] lstrlenW (lpString=".ckp") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".ckp") returned 0x0 [0094.058] lstrlenW (lpString=".dacpac") returned 7 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".dacpac") returned 0x0 [0094.058] lstrlenW (lpString=".db3") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".db3") returned 0x0 [0094.058] lstrlenW (lpString=".dtxs") returned 5 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".dtxs") returned 0x0 [0094.058] lstrlenW (lpString=".mdt") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".mdt") returned 0x0 [0094.058] lstrlenW (lpString=".sdf") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".sdf") returned 0x0 [0094.058] lstrlenW (lpString=".MDF") returned 4 [0094.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".MDF") returned 0x0 [0094.059] lstrlenW (lpString=".DBF") returned 4 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".DBF") returned 0x0 [0094.059] lstrlenW (lpString=".DB") returned 3 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".DB") returned 0x0 [0094.059] lstrlenW (lpString=".db") returned 3 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".db") returned 0x0 [0094.059] lstrlenW (lpString=".ndf") returned 4 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".ndf") returned 0x0 [0094.059] lstrlenW (lpString=".NDF") returned 4 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".NDF") returned 0x0 [0094.059] lstrlenW (lpString=".Mdf") returned 4 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".Mdf") returned 0x0 [0094.059] lstrlenW (lpString=".dat") returned 4 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".dat") returned 0x0 [0094.059] lstrlenW (lpString=".DAT") returned 4 [0094.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpSrch=".DAT") returned=".DAT" [0094.059] lstrlenW (lpString=".DAT") returned 4 [0094.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.059] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33f260) returned 1 [0094.060] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.060] CryptReleaseContext (hProv=0x33f260, dwFlags=0x0) returned 1 [0094.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.060] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21406141886) returned 1 [0094.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6e06d70, dwHighDateTime=0x1d585b4)) [0094.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27df910 [0094.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27df910 | out: hHeap=0x260000) returned 1 [0094.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x2812438 [0094.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27653f8 [0094.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2812438 | out: hHeap=0x260000) returned 1 [0094.061] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.061] GetLastError () returned 0x0 [0094.061] GetLastError () returned 0x0 [0094.061] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.062] GetLastError () returned 0x0 [0094.062] GetLastError () returned 0x0 [0094.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffb664, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.139] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x499c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x499c, lpOverlapped=0x0) returned 1 [0094.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.139] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.140] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.140] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.140] CloseHandle (hObject=0xf0) returned 1 [0094.140] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4308 [0094.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.[deadmin@cock.li].deadmin")) returned 1 [0094.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4308 | out: hHeap=0x260000) returned 1 [0094.142] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.142] GetLastError () returned 0x0 [0094.142] RtlWakeConditionVariable () returned 0x0 [0094.142] GetCurrentThreadId () returned 0x9ac [0094.143] lstrcpyW (in: lpString1=0x24cedbc, lpString2=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" | out: lpString1=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.143] StrStrW (lpFirst=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-io{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n", lpSrch="{KEY11111}") returned="{KEY11111}\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n" [0094.143] lstrlenW (lpString=" >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n\r\n HELLO, DEAR DEADMIN!\r\n\r\n 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]\r\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\r\n The only 1 way to decrypt your files is to receive the decryption program.\r\n\r\n 2. [ HOW TO RECOVERY FILES? ]\r\n To receive the decryption program write to email: deadmin@cock.li\r\n And in subject write your ID: ID-ioaf1bb1d6b4\r\n We send you full instruction how to decrypt all your files.\r\n If we do not respond within 24 hours, write to the email: deadmin@420blaze.it\r\n\r\n 3. [ FREE DECRYPTION! ]\r\n Free decryption as guarantee.\r\n We guarantee the receipt of the decryption program after payment.\r\n To believe, you can give us up to 3 files that we decrypt for free.\r\n Files should not be important to you! (databases, backups, large excel sheets, etc.)\r\n\r\n >>>>>>>>>>>>>>>>>>>>>>>>>>>> DEADMIN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n") returned 1023 [0094.143] WriteFile (in: hFile=0xf0, lpBuffer=0x24cedbc*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x24cedb8, lpOverlapped=0x0 | out: lpBuffer=0x24cedbc*, lpNumberOfBytesWritten=0x24cedb8*=0x7fe, lpOverlapped=0x0) returned 1 [0094.145] CloseHandle (hObject=0xf0) returned 1 [0094.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342e50 | out: hHeap=0x260000) returned 1 [0094.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.145] RtlWakeConditionVariable () returned 0x0 [0094.145] GetCurrentThreadId () returned 0x9ac [0094.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".ldf") returned 0x0 [0094.145] lstrlenW (lpString=".vhd") returned 4 [0094.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".vhd") returned 0x0 [0094.146] lstrlenW (lpString=".vhdx") returned 5 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".vhdx") returned 0x0 [0094.146] lstrlenW (lpString=".pst") returned 4 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".pst") returned 0x0 [0094.146] lstrlenW (lpString=".ost") returned 4 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".ost") returned 0x0 [0094.146] lstrlenW (lpString=".bak") returned 4 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".bak") returned 0x0 [0094.146] lstrlenW (lpString=".bac") returned 4 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".bac") returned 0x0 [0094.146] lstrlenW (lpString=".sys") returned 4 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".sys") returned 0x0 [0094.146] lstrlenW (lpString=".v2i") returned 4 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".v2i") returned 0x0 [0094.146] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.146] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch="s\r\n.v2i") returned 0x0 [0094.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.147] lstrlenW (lpString=".sql") returned 4 [0094.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".sql") returned 0x0 [0094.147] lstrlenW (lpString=".mdf") returned 4 [0094.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".mdf") returned 0x0 [0094.147] lstrlenW (lpString=".txt") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".txt") returned 0x0 [0094.148] lstrlenW (lpString=".dbf") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".dbf") returned 0x0 [0094.148] lstrlenW (lpString=".ckp") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".ckp") returned 0x0 [0094.148] lstrlenW (lpString=".dacpac") returned 7 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".dacpac") returned 0x0 [0094.148] lstrlenW (lpString=".db3") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".db3") returned 0x0 [0094.148] lstrlenW (lpString=".dtxs") returned 5 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".dtxs") returned 0x0 [0094.148] lstrlenW (lpString=".mdt") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".mdt") returned 0x0 [0094.148] lstrlenW (lpString=".sdf") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".sdf") returned 0x0 [0094.148] lstrlenW (lpString=".MDF") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".MDF") returned 0x0 [0094.148] lstrlenW (lpString=".DBF") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".DBF") returned 0x0 [0094.148] lstrlenW (lpString=".DB") returned 3 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".DB") returned 0x0 [0094.148] lstrlenW (lpString=".db") returned 3 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".db") returned 0x0 [0094.148] lstrlenW (lpString=".ndf") returned 4 [0094.148] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".ndf") returned 0x0 [0094.148] lstrlenW (lpString=".NDF") returned 4 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".NDF") returned 0x0 [0094.149] lstrlenW (lpString=".Mdf") returned 4 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".Mdf") returned 0x0 [0094.149] lstrlenW (lpString=".dat") returned 4 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".dat") returned 0x0 [0094.149] lstrlenW (lpString=".DAT") returned 4 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".DAT") returned 0x0 [0094.149] lstrlenW (lpString=".ldf") returned 4 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".ldf") returned 0x0 [0094.149] lstrlenW (lpString=".LDF") returned 4 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch=".LDF") returned 0x0 [0094.149] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.149] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.149] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.149] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ec00) returned 1 [0094.150] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.150] CryptReleaseContext (hProv=0x33ec00, dwFlags=0x0) returned 1 [0094.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.150] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21415124239) returned 1 [0094.150] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6eeb5b0, dwHighDateTime=0x1d585b4)) [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfad0 [0094.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.150] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfad0 | out: hHeap=0x260000) returned 1 [0094.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dd90 [0094.151] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.151] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.151] GetLastError () returned 0x0 [0094.151] GetLastError () returned 0x0 [0094.151] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.151] GetLastError () returned 0x0 [0094.152] GetLastError () returned 0x0 [0094.155] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.155] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.156] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.156] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.159] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.159] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.159] CloseHandle (hObject=0xf0) returned 1 [0094.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.161] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.[deadmin@cock.li].deadmin")) returned 1 [0094.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.164] GetLastError () returned 0x0 [0094.164] RtlWakeConditionVariable () returned 0x0 [0094.164] GetCurrentThreadId () returned 0x9ac [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".ldf") returned 0x0 [0094.164] lstrlenW (lpString=".vhd") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".vhd") returned 0x0 [0094.164] lstrlenW (lpString=".vhdx") returned 5 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".vhdx") returned 0x0 [0094.164] lstrlenW (lpString=".pst") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".pst") returned 0x0 [0094.164] lstrlenW (lpString=".ost") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".ost") returned 0x0 [0094.164] lstrlenW (lpString=".bak") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".bak") returned 0x0 [0094.164] lstrlenW (lpString=".bac") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".bac") returned 0x0 [0094.164] lstrlenW (lpString=".sys") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".sys") returned 0x0 [0094.164] lstrlenW (lpString=".v2i") returned 4 [0094.164] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".v2i") returned 0x0 [0094.165] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.165] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch="s\r\n.v2i") returned 0x0 [0094.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.166] lstrlenW (lpString=".sql") returned 4 [0094.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".sql") returned 0x0 [0094.166] lstrlenW (lpString=".mdf") returned 4 [0094.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".mdf") returned 0x0 [0094.166] lstrlenW (lpString=".txt") returned 4 [0094.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".txt") returned 0x0 [0094.166] lstrlenW (lpString=".dbf") returned 4 [0094.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".dbf") returned 0x0 [0094.167] lstrlenW (lpString=".ckp") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".ckp") returned 0x0 [0094.167] lstrlenW (lpString=".dacpac") returned 7 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".dacpac") returned 0x0 [0094.167] lstrlenW (lpString=".db3") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".db3") returned 0x0 [0094.167] lstrlenW (lpString=".dtxs") returned 5 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".dtxs") returned 0x0 [0094.167] lstrlenW (lpString=".mdt") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".mdt") returned 0x0 [0094.167] lstrlenW (lpString=".sdf") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".sdf") returned 0x0 [0094.167] lstrlenW (lpString=".MDF") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".MDF") returned 0x0 [0094.167] lstrlenW (lpString=".DBF") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".DBF") returned 0x0 [0094.167] lstrlenW (lpString=".DB") returned 3 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".DB") returned 0x0 [0094.167] lstrlenW (lpString=".db") returned 3 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".db") returned 0x0 [0094.167] lstrlenW (lpString=".ndf") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".ndf") returned 0x0 [0094.167] lstrlenW (lpString=".NDF") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".NDF") returned 0x0 [0094.167] lstrlenW (lpString=".Mdf") returned 4 [0094.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".Mdf") returned 0x0 [0094.168] lstrlenW (lpString=".dat") returned 4 [0094.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".dat") returned 0x0 [0094.168] lstrlenW (lpString=".DAT") returned 4 [0094.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".DAT") returned 0x0 [0094.168] lstrlenW (lpString=".ldf") returned 4 [0094.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".ldf") returned 0x0 [0094.168] lstrlenW (lpString=".LDF") returned 4 [0094.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch=".LDF") returned 0x0 [0094.168] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.168] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.168] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ec00) returned 1 [0094.169] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.169] CryptReleaseContext (hProv=0x33ec00, dwFlags=0x0) returned 1 [0094.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.169] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21417011071) returned 1 [0094.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6f11710, dwHighDateTime=0x1d585b4)) [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfb08 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfb08 | out: hHeap=0x260000) returned 1 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.169] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317ba0 [0094.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317ba0 | out: hHeap=0x260000) returned 1 [0094.170] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.170] GetLastError () returned 0x0 [0094.170] GetLastError () returned 0x0 [0094.170] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.170] GetLastError () returned 0x0 [0094.170] GetLastError () returned 0x0 [0094.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.173] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.175] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.175] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.176] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.176] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.177] CloseHandle (hObject=0xf0) returned 1 [0094.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281df08 [0094.177] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam.[deadmin@cock.li].deadmin")) returned 1 [0094.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281df08 | out: hHeap=0x260000) returned 1 [0094.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.179] GetLastError () returned 0x0 [0094.179] RtlWakeConditionVariable () returned 0x0 [0094.179] GetCurrentThreadId () returned 0x9ac [0094.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".ldf") returned 0x0 [0094.179] lstrlenW (lpString=".vhd") returned 4 [0094.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".vhd") returned 0x0 [0094.179] lstrlenW (lpString=".vhdx") returned 5 [0094.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".vhdx") returned 0x0 [0094.179] lstrlenW (lpString=".pst") returned 4 [0094.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".pst") returned 0x0 [0094.179] lstrlenW (lpString=".ost") returned 4 [0094.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".ost") returned 0x0 [0094.179] lstrlenW (lpString=".bak") returned 4 [0094.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".bak") returned 0x0 [0094.180] lstrlenW (lpString=".bac") returned 4 [0094.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".bac") returned 0x0 [0094.180] lstrlenW (lpString=".sys") returned 4 [0094.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".sys") returned 0x0 [0094.180] lstrlenW (lpString=".v2i") returned 4 [0094.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".v2i") returned 0x0 [0094.180] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.180] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.181] lstrlenW (lpString=".sql") returned 4 [0094.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".sql") returned 0x0 [0094.181] lstrlenW (lpString=".mdf") returned 4 [0094.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".mdf") returned 0x0 [0094.181] lstrlenW (lpString=".txt") returned 4 [0094.181] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".txt") returned 0x0 [0094.182] lstrlenW (lpString=".dbf") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".dbf") returned 0x0 [0094.182] lstrlenW (lpString=".ckp") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".ckp") returned 0x0 [0094.182] lstrlenW (lpString=".dacpac") returned 7 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".dacpac") returned 0x0 [0094.182] lstrlenW (lpString=".db3") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".db3") returned 0x0 [0094.182] lstrlenW (lpString=".dtxs") returned 5 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".dtxs") returned 0x0 [0094.182] lstrlenW (lpString=".mdt") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".mdt") returned 0x0 [0094.182] lstrlenW (lpString=".sdf") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".sdf") returned 0x0 [0094.182] lstrlenW (lpString=".MDF") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".MDF") returned 0x0 [0094.182] lstrlenW (lpString=".DBF") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".DBF") returned 0x0 [0094.182] lstrlenW (lpString=".DB") returned 3 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".DB") returned 0x0 [0094.182] lstrlenW (lpString=".db") returned 3 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".db") returned 0x0 [0094.182] lstrlenW (lpString=".ndf") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".ndf") returned 0x0 [0094.182] lstrlenW (lpString=".NDF") returned 4 [0094.182] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".NDF") returned 0x0 [0094.183] lstrlenW (lpString=".Mdf") returned 4 [0094.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".Mdf") returned 0x0 [0094.183] lstrlenW (lpString=".dat") returned 4 [0094.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".dat") returned 0x0 [0094.183] lstrlenW (lpString=".DAT") returned 4 [0094.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".DAT") returned 0x0 [0094.183] lstrlenW (lpString=".ldf") returned 4 [0094.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".ldf") returned 0x0 [0094.183] lstrlenW (lpString=".LDF") returned 4 [0094.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch=".LDF") returned 0x0 [0094.183] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.183] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ec00) returned 1 [0094.184] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.184] CryptReleaseContext (hProv=0x33ec00, dwFlags=0x0) returned 1 [0094.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.184] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21418514627) returned 1 [0094.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc6f37870, dwHighDateTime=0x1d585b4)) [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfb40 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfb40 | out: hHeap=0x260000) returned 1 [0094.184] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317d98 [0094.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.185] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27640f8 [0094.185] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317d98 | out: hHeap=0x260000) returned 1 [0094.185] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.185] GetLastError () returned 0x0 [0094.185] GetLastError () returned 0x0 [0094.185] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.185] GetLastError () returned 0x0 [0094.185] GetLastError () returned 0x0 [0094.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.222] WriteFile (in: hFile=0xf0, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.236] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0094.236] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.236] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.236] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.236] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.236] CloseHandle (hObject=0xf0) returned 1 [0094.236] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x281dd58 [0094.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x281dd58 | out: hHeap=0x260000) returned 1 [0094.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.250] GetLastError () returned 0x0 [0094.250] RtlWakeConditionVariable () returned 0x0 [0094.251] GetCurrentThreadId () returned 0x9ac [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".ldf") returned 0x0 [0094.251] lstrlenW (lpString=".vhd") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".vhd") returned 0x0 [0094.251] lstrlenW (lpString=".vhdx") returned 5 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".vhdx") returned 0x0 [0094.251] lstrlenW (lpString=".pst") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".pst") returned 0x0 [0094.251] lstrlenW (lpString=".ost") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".ost") returned 0x0 [0094.251] lstrlenW (lpString=".bak") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".bak") returned 0x0 [0094.251] lstrlenW (lpString=".bac") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".bac") returned 0x0 [0094.251] lstrlenW (lpString=".sys") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".sys") returned 0x0 [0094.251] lstrlenW (lpString=".v2i") returned 4 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".v2i") returned 0x0 [0094.251] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.251] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0094.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.309] lstrlenW (lpString=".sql") returned 4 [0094.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".sql") returned 0x0 [0094.309] lstrlenW (lpString=".mdf") returned 4 [0094.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".mdf") returned 0x0 [0094.309] lstrlenW (lpString=".txt") returned 4 [0094.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".txt") returned 0x0 [0094.309] lstrlenW (lpString=".dbf") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".dbf") returned 0x0 [0094.310] lstrlenW (lpString=".ckp") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".ckp") returned 0x0 [0094.310] lstrlenW (lpString=".dacpac") returned 7 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".dacpac") returned 0x0 [0094.310] lstrlenW (lpString=".db3") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".db3") returned 0x0 [0094.310] lstrlenW (lpString=".dtxs") returned 5 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".dtxs") returned 0x0 [0094.310] lstrlenW (lpString=".mdt") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".mdt") returned 0x0 [0094.310] lstrlenW (lpString=".sdf") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".sdf") returned 0x0 [0094.310] lstrlenW (lpString=".MDF") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".MDF") returned 0x0 [0094.310] lstrlenW (lpString=".DBF") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".DBF") returned 0x0 [0094.310] lstrlenW (lpString=".DB") returned 3 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".DB") returned 0x0 [0094.310] lstrlenW (lpString=".db") returned 3 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".db") returned 0x0 [0094.310] lstrlenW (lpString=".ndf") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".ndf") returned 0x0 [0094.310] lstrlenW (lpString=".NDF") returned 4 [0094.310] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".NDF") returned 0x0 [0094.310] lstrlenW (lpString=".Mdf") returned 4 [0094.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".Mdf") returned 0x0 [0094.311] lstrlenW (lpString=".dat") returned 4 [0094.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".dat") returned 0x0 [0094.311] lstrlenW (lpString=".DAT") returned 4 [0094.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".DAT") returned 0x0 [0094.311] lstrlenW (lpString=".ldf") returned 4 [0094.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".ldf") returned 0x0 [0094.311] lstrlenW (lpString=".LDF") returned 4 [0094.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch=".LDF") returned 0x0 [0094.311] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.311] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.311] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.311] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33e8d0) returned 1 [0094.312] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.312] CryptReleaseContext (hProv=0x33e8d0, dwFlags=0x0) returned 1 [0094.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.312] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21431314447) returned 1 [0094.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7068370, dwHighDateTime=0x1d585b4)) [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27dfde0 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27dfde0 | out: hHeap=0x260000) returned 1 [0094.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.313] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.313] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.313] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.313] GetLastError () returned 0x0 [0094.313] GetLastError () returned 0x0 [0094.313] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.313] GetLastError () returned 0x0 [0094.313] GetLastError () returned 0x0 [0094.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.607] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.607] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.607] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.623] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.623] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.623] CloseHandle (hObject=0xf0) returned 1 [0094.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.626] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.626] GetLastError () returned 0x0 [0094.626] RtlWakeConditionVariable () returned 0x27e828 [0094.626] GetCurrentThreadId () returned 0x9ac [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".ldf") returned 0x0 [0094.626] lstrlenW (lpString=".vhd") returned 4 [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".vhd") returned 0x0 [0094.626] lstrlenW (lpString=".vhdx") returned 5 [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".vhdx") returned 0x0 [0094.626] lstrlenW (lpString=".pst") returned 4 [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".pst") returned 0x0 [0094.626] lstrlenW (lpString=".ost") returned 4 [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".ost") returned 0x0 [0094.626] lstrlenW (lpString=".bak") returned 4 [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".bak") returned 0x0 [0094.626] lstrlenW (lpString=".bac") returned 4 [0094.626] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".bac") returned 0x0 [0094.626] lstrlenW (lpString=".sys") returned 4 [0094.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".sys") returned 0x0 [0094.627] lstrlenW (lpString=".v2i") returned 4 [0094.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".v2i") returned 0x0 [0094.627] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.627] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.628] lstrlenW (lpString=".sql") returned 4 [0094.628] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".sql") returned 0x0 [0094.628] lstrlenW (lpString=".mdf") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".mdf") returned 0x0 [0094.629] lstrlenW (lpString=".txt") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".txt") returned 0x0 [0094.629] lstrlenW (lpString=".dbf") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".dbf") returned 0x0 [0094.629] lstrlenW (lpString=".ckp") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".ckp") returned 0x0 [0094.629] lstrlenW (lpString=".dacpac") returned 7 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".dacpac") returned 0x0 [0094.629] lstrlenW (lpString=".db3") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".db3") returned 0x0 [0094.629] lstrlenW (lpString=".dtxs") returned 5 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".dtxs") returned 0x0 [0094.629] lstrlenW (lpString=".mdt") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".mdt") returned 0x0 [0094.629] lstrlenW (lpString=".sdf") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".sdf") returned 0x0 [0094.629] lstrlenW (lpString=".MDF") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".MDF") returned 0x0 [0094.629] lstrlenW (lpString=".DBF") returned 4 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".DBF") returned 0x0 [0094.629] lstrlenW (lpString=".DB") returned 3 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".DB") returned 0x0 [0094.629] lstrlenW (lpString=".db") returned 3 [0094.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".db") returned 0x0 [0094.629] lstrlenW (lpString=".ndf") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".ndf") returned 0x0 [0094.630] lstrlenW (lpString=".NDF") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".NDF") returned 0x0 [0094.630] lstrlenW (lpString=".Mdf") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".Mdf") returned 0x0 [0094.630] lstrlenW (lpString=".dat") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".dat") returned 0x0 [0094.630] lstrlenW (lpString=".DAT") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".DAT") returned 0x0 [0094.630] lstrlenW (lpString=".ldf") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".ldf") returned 0x0 [0094.630] lstrlenW (lpString=".LDF") returned 4 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch=".LDF") returned 0x0 [0094.630] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.630] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33f618) returned 1 [0094.631] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.631] CryptReleaseContext (hProv=0x33f618, dwFlags=0x0) returned 1 [0094.631] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.631] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21463254545) returned 1 [0094.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7388050, dwHighDateTime=0x1d585b4)) [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e00f0 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e00f0 | out: hHeap=0x260000) returned 1 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.632] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.632] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.632] GetLastError () returned 0x0 [0094.632] GetLastError () returned 0x0 [0094.633] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.633] GetLastError () returned 0x0 [0094.633] GetLastError () returned 0x0 [0094.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffede4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.637] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x121c, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x121c, lpOverlapped=0x0) returned 1 [0094.637] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.637] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.637] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.637] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.637] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.638] CloseHandle (hObject=0xf0) returned 1 [0094.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0094.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0094.639] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.639] GetLastError () returned 0x0 [0094.640] RtlWakeConditionVariable () returned 0x0 [0094.640] GetCurrentThreadId () returned 0x9ac [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".ldf") returned 0x0 [0094.640] lstrlenW (lpString=".vhd") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".vhd") returned 0x0 [0094.640] lstrlenW (lpString=".vhdx") returned 5 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".vhdx") returned 0x0 [0094.640] lstrlenW (lpString=".pst") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".pst") returned 0x0 [0094.640] lstrlenW (lpString=".ost") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".ost") returned 0x0 [0094.640] lstrlenW (lpString=".bak") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".bak") returned 0x0 [0094.640] lstrlenW (lpString=".bac") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".bac") returned 0x0 [0094.640] lstrlenW (lpString=".sys") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".sys") returned 0x0 [0094.640] lstrlenW (lpString=".v2i") returned 4 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".v2i") returned 0x0 [0094.640] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.640] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.642] lstrlenW (lpString=".sql") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".sql") returned 0x0 [0094.642] lstrlenW (lpString=".mdf") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".mdf") returned 0x0 [0094.642] lstrlenW (lpString=".txt") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".txt") returned 0x0 [0094.642] lstrlenW (lpString=".dbf") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".dbf") returned 0x0 [0094.642] lstrlenW (lpString=".ckp") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".ckp") returned 0x0 [0094.642] lstrlenW (lpString=".dacpac") returned 7 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".dacpac") returned 0x0 [0094.642] lstrlenW (lpString=".db3") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".db3") returned 0x0 [0094.642] lstrlenW (lpString=".dtxs") returned 5 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".dtxs") returned 0x0 [0094.642] lstrlenW (lpString=".mdt") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".mdt") returned 0x0 [0094.642] lstrlenW (lpString=".sdf") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".sdf") returned 0x0 [0094.642] lstrlenW (lpString=".MDF") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".MDF") returned 0x0 [0094.642] lstrlenW (lpString=".DBF") returned 4 [0094.642] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".DBF") returned 0x0 [0094.643] lstrlenW (lpString=".DB") returned 3 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".DB") returned 0x0 [0094.643] lstrlenW (lpString=".db") returned 3 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".db") returned 0x0 [0094.643] lstrlenW (lpString=".ndf") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".ndf") returned 0x0 [0094.643] lstrlenW (lpString=".NDF") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".NDF") returned 0x0 [0094.643] lstrlenW (lpString=".Mdf") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".Mdf") returned 0x0 [0094.643] lstrlenW (lpString=".dat") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".dat") returned 0x0 [0094.643] lstrlenW (lpString=".DAT") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".DAT") returned 0x0 [0094.643] lstrlenW (lpString=".ldf") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".ldf") returned 0x0 [0094.643] lstrlenW (lpString=".LDF") returned 4 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch=".LDF") returned 0x0 [0094.643] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.643] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33f3f8) returned 1 [0094.644] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.644] CryptReleaseContext (hProv=0x33f3f8, dwFlags=0x0) returned 1 [0094.644] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.644] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21464545273) returned 1 [0094.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7388050, dwHighDateTime=0x1d585b4)) [0094.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0128 [0094.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0128 | out: hHeap=0x260000) returned 1 [0094.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dc60 [0094.645] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.645] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.645] GetLastError () returned 0x0 [0094.645] GetLastError () returned 0x0 [0094.646] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.646] GetLastError () returned 0x0 [0094.646] GetLastError () returned 0x0 [0094.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xffffca3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.649] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x35c6, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x35c6, lpOverlapped=0x0) returned 1 [0094.649] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.649] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.649] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.649] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.649] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.649] CloseHandle (hObject=0xf0) returned 1 [0094.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342e50 [0094.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342e50 | out: hHeap=0x260000) returned 1 [0094.651] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.651] GetLastError () returned 0x0 [0094.651] RtlWakeConditionVariable () returned 0x0 [0094.651] GetCurrentThreadId () returned 0x9ac [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".ldf") returned 0x0 [0094.651] lstrlenW (lpString=".vhd") returned 4 [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".vhd") returned 0x0 [0094.651] lstrlenW (lpString=".vhdx") returned 5 [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".vhdx") returned 0x0 [0094.651] lstrlenW (lpString=".pst") returned 4 [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".pst") returned 0x0 [0094.651] lstrlenW (lpString=".ost") returned 4 [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".ost") returned 0x0 [0094.651] lstrlenW (lpString=".bak") returned 4 [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".bak") returned 0x0 [0094.651] lstrlenW (lpString=".bac") returned 4 [0094.651] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".bac") returned 0x0 [0094.652] lstrlenW (lpString=".sys") returned 4 [0094.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".sys") returned 0x0 [0094.652] lstrlenW (lpString=".v2i") returned 4 [0094.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".v2i") returned 0x0 [0094.652] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.652] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch="s\r\n.v2i") returned 0x0 [0094.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.653] lstrlenW (lpString=".sql") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".sql") returned 0x0 [0094.653] lstrlenW (lpString=".mdf") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".mdf") returned 0x0 [0094.653] lstrlenW (lpString=".txt") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".txt") returned 0x0 [0094.653] lstrlenW (lpString=".dbf") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".dbf") returned 0x0 [0094.653] lstrlenW (lpString=".ckp") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".ckp") returned 0x0 [0094.653] lstrlenW (lpString=".dacpac") returned 7 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".dacpac") returned 0x0 [0094.653] lstrlenW (lpString=".db3") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".db3") returned 0x0 [0094.653] lstrlenW (lpString=".dtxs") returned 5 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".dtxs") returned 0x0 [0094.653] lstrlenW (lpString=".mdt") returned 4 [0094.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".mdt") returned 0x0 [0094.654] lstrlenW (lpString=".sdf") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".sdf") returned 0x0 [0094.654] lstrlenW (lpString=".MDF") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".MDF") returned 0x0 [0094.654] lstrlenW (lpString=".DBF") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".DBF") returned 0x0 [0094.654] lstrlenW (lpString=".DB") returned 3 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".DB") returned 0x0 [0094.654] lstrlenW (lpString=".db") returned 3 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".db") returned 0x0 [0094.654] lstrlenW (lpString=".ndf") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".ndf") returned 0x0 [0094.654] lstrlenW (lpString=".NDF") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".NDF") returned 0x0 [0094.654] lstrlenW (lpString=".Mdf") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".Mdf") returned 0x0 [0094.654] lstrlenW (lpString=".dat") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".dat") returned 0x0 [0094.654] lstrlenW (lpString=".DAT") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".DAT") returned 0x0 [0094.654] lstrlenW (lpString=".ldf") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".ldf") returned 0x0 [0094.654] lstrlenW (lpString=".LDF") returned 4 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch=".LDF") returned 0x0 [0094.654] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.654] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.655] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33f618) returned 1 [0094.655] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.655] CryptReleaseContext (hProv=0x33f618, dwFlags=0x0) returned 1 [0094.655] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.656] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21465671997) returned 1 [0094.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc73ae1b0, dwHighDateTime=0x1d585b4)) [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0160 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0160 | out: hHeap=0x260000) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29ceb8 [0094.656] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.656] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.656] GetLastError () returned 0x0 [0094.657] GetLastError () returned 0x0 [0094.657] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.657] GetLastError () returned 0x0 [0094.657] GetLastError () returned 0x0 [0094.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffff922, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.732] WriteFile (in: hFile=0xf0, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x6de, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x6de, lpOverlapped=0x0) returned 1 [0094.732] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0094.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.732] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.732] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.732] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.732] CloseHandle (hObject=0xf0) returned 1 [0094.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x342b30 [0094.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.[deadmin@cock.li].deadmin")) returned 1 [0094.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x342b30 | out: hHeap=0x260000) returned 1 [0094.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.734] GetLastError () returned 0x0 [0094.734] RtlWakeConditionVariable () returned 0x0 [0094.734] GetCurrentThreadId () returned 0x9ac [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".ldf") returned 0x0 [0094.735] lstrlenW (lpString=".vhd") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".vhd") returned 0x0 [0094.735] lstrlenW (lpString=".vhdx") returned 5 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".vhdx") returned 0x0 [0094.735] lstrlenW (lpString=".pst") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".pst") returned 0x0 [0094.735] lstrlenW (lpString=".ost") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".ost") returned 0x0 [0094.735] lstrlenW (lpString=".bak") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".bak") returned 0x0 [0094.735] lstrlenW (lpString=".bac") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".bac") returned 0x0 [0094.735] lstrlenW (lpString=".sys") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".sys") returned 0x0 [0094.735] lstrlenW (lpString=".v2i") returned 4 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".v2i") returned 0x0 [0094.735] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.735] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.741] lstrlenW (lpString=".sql") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".sql") returned 0x0 [0094.741] lstrlenW (lpString=".mdf") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".mdf") returned 0x0 [0094.741] lstrlenW (lpString=".txt") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".txt") returned 0x0 [0094.741] lstrlenW (lpString=".dbf") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".dbf") returned 0x0 [0094.741] lstrlenW (lpString=".ckp") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".ckp") returned 0x0 [0094.741] lstrlenW (lpString=".dacpac") returned 7 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".dacpac") returned 0x0 [0094.741] lstrlenW (lpString=".db3") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".db3") returned 0x0 [0094.741] lstrlenW (lpString=".dtxs") returned 5 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".dtxs") returned 0x0 [0094.741] lstrlenW (lpString=".mdt") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".mdt") returned 0x0 [0094.741] lstrlenW (lpString=".sdf") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".sdf") returned 0x0 [0094.741] lstrlenW (lpString=".MDF") returned 4 [0094.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".MDF") returned 0x0 [0094.742] lstrlenW (lpString=".DBF") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".DBF") returned 0x0 [0094.742] lstrlenW (lpString=".DB") returned 3 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".DB") returned 0x0 [0094.742] lstrlenW (lpString=".db") returned 3 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".db") returned 0x0 [0094.742] lstrlenW (lpString=".ndf") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".ndf") returned 0x0 [0094.742] lstrlenW (lpString=".NDF") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".NDF") returned 0x0 [0094.742] lstrlenW (lpString=".Mdf") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".Mdf") returned 0x0 [0094.742] lstrlenW (lpString=".dat") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".dat") returned 0x0 [0094.742] lstrlenW (lpString=".DAT") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".DAT") returned 0x0 [0094.742] lstrlenW (lpString=".ldf") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".ldf") returned 0x0 [0094.742] lstrlenW (lpString=".LDF") returned 4 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch=".LDF") returned 0x0 [0094.742] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.742] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.742] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.742] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33fd00) returned 1 [0094.744] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.744] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.744] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21474528197) returned 1 [0094.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc74929f0, dwHighDateTime=0x1d585b4)) [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e02e8 [0094.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e02e8 | out: hHeap=0x260000) returned 1 [0094.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317f90 [0094.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317f90 | out: hHeap=0x260000) returned 1 [0094.745] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.745] GetLastError () returned 0x0 [0094.745] GetLastError () returned 0x0 [0094.745] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.745] GetLastError () returned 0x0 [0094.745] GetLastError () returned 0x0 [0094.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.751] WriteFile (in: hFile=0xf0, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0094.752] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.752] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.827] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.827] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.827] CloseHandle (hObject=0xf0) returned 1 [0094.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x3144c0 [0094.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x3144c0 | out: hHeap=0x260000) returned 1 [0094.829] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.829] GetLastError () returned 0x0 [0094.829] RtlWakeConditionVariable () returned 0x0 [0094.829] GetCurrentThreadId () returned 0x9ac [0094.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".ldf") returned 0x0 [0094.829] lstrlenW (lpString=".vhd") returned 4 [0094.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".vhd") returned 0x0 [0094.829] lstrlenW (lpString=".vhdx") returned 5 [0094.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".vhdx") returned 0x0 [0094.829] lstrlenW (lpString=".pst") returned 4 [0094.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".pst") returned 0x0 [0094.829] lstrlenW (lpString=".ost") returned 4 [0094.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".ost") returned 0x0 [0094.829] lstrlenW (lpString=".bak") returned 4 [0094.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".bak") returned 0x0 [0094.829] lstrlenW (lpString=".bac") returned 4 [0094.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".bac") returned 0x0 [0094.830] lstrlenW (lpString=".sys") returned 4 [0094.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".sys") returned 0x0 [0094.830] lstrlenW (lpString=".v2i") returned 4 [0094.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".v2i") returned 0x0 [0094.830] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.830] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0094.831] lstrlenW (lpString=".sql") returned 4 [0094.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".sql") returned 0x0 [0094.831] lstrlenW (lpString=".mdf") returned 4 [0094.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".mdf") returned 0x0 [0094.831] lstrlenW (lpString=".txt") returned 4 [0094.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".txt") returned 0x0 [0094.831] lstrlenW (lpString=".dbf") returned 4 [0094.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".dbf") returned 0x0 [0094.831] lstrlenW (lpString=".ckp") returned 4 [0094.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".ckp") returned 0x0 [0094.831] lstrlenW (lpString=".dacpac") returned 7 [0094.831] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".dacpac") returned 0x0 [0094.832] lstrlenW (lpString=".db3") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".db3") returned 0x0 [0094.832] lstrlenW (lpString=".dtxs") returned 5 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".dtxs") returned 0x0 [0094.832] lstrlenW (lpString=".mdt") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".mdt") returned 0x0 [0094.832] lstrlenW (lpString=".sdf") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".sdf") returned 0x0 [0094.832] lstrlenW (lpString=".MDF") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".MDF") returned 0x0 [0094.832] lstrlenW (lpString=".DBF") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".DBF") returned 0x0 [0094.832] lstrlenW (lpString=".DB") returned 3 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".DB") returned 0x0 [0094.832] lstrlenW (lpString=".db") returned 3 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".db") returned 0x0 [0094.832] lstrlenW (lpString=".ndf") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".ndf") returned 0x0 [0094.832] lstrlenW (lpString=".NDF") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".NDF") returned 0x0 [0094.832] lstrlenW (lpString=".Mdf") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".Mdf") returned 0x0 [0094.832] lstrlenW (lpString=".dat") returned 4 [0094.832] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".dat") returned 0x0 [0094.832] lstrlenW (lpString=".DAT") returned 4 [0094.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".DAT") returned 0x0 [0094.833] lstrlenW (lpString=".ldf") returned 4 [0094.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".ldf") returned 0x0 [0094.833] lstrlenW (lpString=".LDF") returned 4 [0094.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch=".LDF") returned 0x0 [0094.833] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.833] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.833] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33fd00) returned 1 [0094.834] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.834] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.834] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21483500060) returned 1 [0094.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7577230, dwHighDateTime=0x1d585b4)) [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e04a8 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e04a8 | out: hHeap=0x260000) returned 1 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.834] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.834] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.835] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.835] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.835] GetLastError () returned 0x0 [0094.835] GetLastError () returned 0x0 [0094.835] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.835] GetLastError () returned 0x0 [0094.835] GetLastError () returned 0x0 [0094.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xfffea880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.921] WriteFile (in: hFile=0xf0, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x15780, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x15780, lpOverlapped=0x0) returned 1 [0094.942] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.942] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.942] WriteFile (in: hFile=0xf0, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0094.943] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0094.943] WriteFile (in: hFile=0xf0, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0094.943] CloseHandle (hObject=0xf0) returned 1 [0094.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0094.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll.[deadmin@cock.li].deadmin")) returned 1 [0094.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0094.948] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0094.948] GetLastError () returned 0x0 [0094.948] RtlWakeConditionVariable () returned 0x27e828 [0094.948] GetCurrentThreadId () returned 0x9ac [0094.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".ldf") returned 0x0 [0094.948] lstrlenW (lpString=".vhd") returned 4 [0094.948] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".vhd") returned 0x0 [0094.949] lstrlenW (lpString=".vhdx") returned 5 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".vhdx") returned 0x0 [0094.949] lstrlenW (lpString=".pst") returned 4 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".pst") returned 0x0 [0094.949] lstrlenW (lpString=".ost") returned 4 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".ost") returned 0x0 [0094.949] lstrlenW (lpString=".bak") returned 4 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".bak") returned 0x0 [0094.949] lstrlenW (lpString=".bac") returned 4 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".bac") returned 0x0 [0094.949] lstrlenW (lpString=".sys") returned 4 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".sys") returned 0x0 [0094.949] lstrlenW (lpString=".v2i") returned 4 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".v2i") returned 0x0 [0094.949] lstrlenW (lpString="s\r\n.v2i") returned 7 [0094.949] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch="s\r\n.v2i") returned 0x0 [0094.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0094.951] lstrlenW (lpString=".sql") returned 4 [0094.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".sql") returned 0x0 [0094.951] lstrlenW (lpString=".mdf") returned 4 [0094.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".mdf") returned 0x0 [0094.951] lstrlenW (lpString=".txt") returned 4 [0094.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".txt") returned 0x0 [0094.951] lstrlenW (lpString=".dbf") returned 4 [0094.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".dbf") returned 0x0 [0094.951] lstrlenW (lpString=".ckp") returned 4 [0094.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".ckp") returned 0x0 [0094.951] lstrlenW (lpString=".dacpac") returned 7 [0094.951] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".dacpac") returned 0x0 [0094.952] lstrlenW (lpString=".db3") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".db3") returned 0x0 [0094.952] lstrlenW (lpString=".dtxs") returned 5 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".dtxs") returned 0x0 [0094.952] lstrlenW (lpString=".mdt") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".mdt") returned 0x0 [0094.952] lstrlenW (lpString=".sdf") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".sdf") returned 0x0 [0094.952] lstrlenW (lpString=".MDF") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".MDF") returned 0x0 [0094.952] lstrlenW (lpString=".DBF") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".DBF") returned 0x0 [0094.952] lstrlenW (lpString=".DB") returned 3 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".DB") returned 0x0 [0094.952] lstrlenW (lpString=".db") returned 3 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".db") returned 0x0 [0094.952] lstrlenW (lpString=".ndf") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".ndf") returned 0x0 [0094.952] lstrlenW (lpString=".NDF") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".NDF") returned 0x0 [0094.952] lstrlenW (lpString=".Mdf") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".Mdf") returned 0x0 [0094.952] lstrlenW (lpString=".dat") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".dat") returned 0x0 [0094.952] lstrlenW (lpString=".DAT") returned 4 [0094.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".DAT") returned 0x0 [0094.952] lstrlenW (lpString=".ldf") returned 4 [0094.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".ldf") returned 0x0 [0094.953] lstrlenW (lpString=".LDF") returned 4 [0094.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch=".LDF") returned 0x0 [0094.953] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0094.953] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0094.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0094.953] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0094.953] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33fd00) returned 1 [0094.954] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0094.954] CryptReleaseContext (hProv=0x33fd00, dwFlags=0x0) returned 1 [0094.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0094.954] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21495493510) returned 1 [0094.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7681bd0, dwHighDateTime=0x1d585b4)) [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e05f8 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0094.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e05f8 | out: hHeap=0x260000) returned 1 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0094.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0094.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0094.954] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0094.954] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0094.954] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0094.955] GetLastError () returned 0x0 [0094.955] GetLastError () returned 0x0 [0094.955] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0094.955] GetLastError () returned 0x0 [0094.955] GetLastError () returned 0x0 [0094.985] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.985] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0094.986] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0094.986] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.002] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.004] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.004] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.004] CloseHandle (hObject=0x11c) returned 1 [0095.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x27d9d20 [0095.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d9d20 | out: hHeap=0x260000) returned 1 [0095.007] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.007] GetLastError () returned 0x0 [0095.007] RtlWakeConditionVariable () returned 0x0 [0095.007] GetCurrentThreadId () returned 0x9ac [0095.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".ldf") returned 0x0 [0095.007] lstrlenW (lpString=".vhd") returned 4 [0095.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".vhd") returned 0x0 [0095.007] lstrlenW (lpString=".vhdx") returned 5 [0095.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".vhdx") returned 0x0 [0095.007] lstrlenW (lpString=".pst") returned 4 [0095.007] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".pst") returned 0x0 [0095.007] lstrlenW (lpString=".ost") returned 4 [0095.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".ost") returned 0x0 [0095.008] lstrlenW (lpString=".bak") returned 4 [0095.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".bak") returned 0x0 [0095.008] lstrlenW (lpString=".bac") returned 4 [0095.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".bac") returned 0x0 [0095.008] lstrlenW (lpString=".sys") returned 4 [0095.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".sys") returned 0x0 [0095.008] lstrlenW (lpString=".v2i") returned 4 [0095.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".v2i") returned 0x0 [0095.008] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.008] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.010] lstrlenW (lpString=".sql") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".sql") returned 0x0 [0095.010] lstrlenW (lpString=".mdf") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".mdf") returned 0x0 [0095.010] lstrlenW (lpString=".txt") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".txt") returned 0x0 [0095.010] lstrlenW (lpString=".dbf") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".dbf") returned 0x0 [0095.010] lstrlenW (lpString=".ckp") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".ckp") returned 0x0 [0095.010] lstrlenW (lpString=".dacpac") returned 7 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".dacpac") returned 0x0 [0095.010] lstrlenW (lpString=".db3") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".db3") returned 0x0 [0095.010] lstrlenW (lpString=".dtxs") returned 5 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".dtxs") returned 0x0 [0095.010] lstrlenW (lpString=".mdt") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".mdt") returned 0x0 [0095.010] lstrlenW (lpString=".sdf") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".sdf") returned 0x0 [0095.010] lstrlenW (lpString=".MDF") returned 4 [0095.010] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".MDF") returned 0x0 [0095.011] lstrlenW (lpString=".DBF") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".DBF") returned 0x0 [0095.011] lstrlenW (lpString=".DB") returned 3 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".DB") returned 0x0 [0095.011] lstrlenW (lpString=".db") returned 3 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".db") returned 0x0 [0095.011] lstrlenW (lpString=".ndf") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".ndf") returned 0x0 [0095.011] lstrlenW (lpString=".NDF") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".NDF") returned 0x0 [0095.011] lstrlenW (lpString=".Mdf") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".Mdf") returned 0x0 [0095.011] lstrlenW (lpString=".dat") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".dat") returned 0x0 [0095.011] lstrlenW (lpString=".DAT") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".DAT") returned 0x0 [0095.011] lstrlenW (lpString=".ldf") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".ldf") returned 0x0 [0095.011] lstrlenW (lpString=".LDF") returned 4 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch=".LDF") returned 0x0 [0095.011] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.011] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33fe10) returned 1 [0095.012] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.012] CryptReleaseContext (hProv=0x33fe10, dwFlags=0x0) returned 1 [0095.012] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.012] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21501356559) returned 1 [0095.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc771a150, dwHighDateTime=0x1d585b4)) [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e06d8 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e06d8 | out: hHeap=0x260000) returned 1 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.013] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.013] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.013] GetLastError () returned 0x0 [0095.013] GetLastError () returned 0x0 [0095.014] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.014] GetLastError () returned 0x0 [0095.014] GetLastError () returned 0x0 [0095.017] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffa680, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.027] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x5980, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x5980, lpOverlapped=0x0) returned 1 [0095.027] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.027] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.027] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.027] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.027] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.028] CloseHandle (hObject=0x11c) returned 1 [0095.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.029] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.029] GetLastError () returned 0x0 [0095.029] RtlWakeConditionVariable () returned 0x27e828 [0095.029] GetCurrentThreadId () returned 0x9ac [0095.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".ldf") returned 0x0 [0095.029] lstrlenW (lpString=".vhd") returned 4 [0095.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".vhd") returned 0x0 [0095.029] lstrlenW (lpString=".vhdx") returned 5 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".vhdx") returned 0x0 [0095.030] lstrlenW (lpString=".pst") returned 4 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".pst") returned 0x0 [0095.030] lstrlenW (lpString=".ost") returned 4 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".ost") returned 0x0 [0095.030] lstrlenW (lpString=".bak") returned 4 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".bak") returned 0x0 [0095.030] lstrlenW (lpString=".bac") returned 4 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".bac") returned 0x0 [0095.030] lstrlenW (lpString=".sys") returned 4 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".sys") returned 0x0 [0095.030] lstrlenW (lpString=".v2i") returned 4 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".v2i") returned 0x0 [0095.030] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.030] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.031] lstrlenW (lpString=".sql") returned 4 [0095.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".sql") returned 0x0 [0095.031] lstrlenW (lpString=".mdf") returned 4 [0095.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".mdf") returned 0x0 [0095.031] lstrlenW (lpString=".txt") returned 4 [0095.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".txt") returned 0x0 [0095.031] lstrlenW (lpString=".dbf") returned 4 [0095.031] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".dbf") returned 0x0 [0095.031] lstrlenW (lpString=".ckp") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".ckp") returned 0x0 [0095.032] lstrlenW (lpString=".dacpac") returned 7 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".dacpac") returned 0x0 [0095.032] lstrlenW (lpString=".db3") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".db3") returned 0x0 [0095.032] lstrlenW (lpString=".dtxs") returned 5 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".dtxs") returned 0x0 [0095.032] lstrlenW (lpString=".mdt") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".mdt") returned 0x0 [0095.032] lstrlenW (lpString=".sdf") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".sdf") returned 0x0 [0095.032] lstrlenW (lpString=".MDF") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".MDF") returned 0x0 [0095.032] lstrlenW (lpString=".DBF") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".DBF") returned 0x0 [0095.032] lstrlenW (lpString=".DB") returned 3 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".DB") returned 0x0 [0095.032] lstrlenW (lpString=".db") returned 3 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".db") returned 0x0 [0095.032] lstrlenW (lpString=".ndf") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".ndf") returned 0x0 [0095.032] lstrlenW (lpString=".NDF") returned 4 [0095.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".NDF") returned 0x0 [0095.033] lstrlenW (lpString=".Mdf") returned 4 [0095.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".Mdf") returned 0x0 [0095.033] lstrlenW (lpString=".dat") returned 4 [0095.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".dat") returned 0x0 [0095.033] lstrlenW (lpString=".DAT") returned 4 [0095.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".DAT") returned 0x0 [0095.033] lstrlenW (lpString=".ldf") returned 4 [0095.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".ldf") returned 0x0 [0095.033] lstrlenW (lpString=".LDF") returned 4 [0095.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch=".LDF") returned 0x0 [0095.033] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.033] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33ffa8) returned 1 [0095.034] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.034] CryptReleaseContext (hProv=0x33ffa8, dwFlags=0x0) returned 1 [0095.034] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.034] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21503540380) returned 1 [0095.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc77402b0, dwHighDateTime=0x1d585b4)) [0095.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0748 [0095.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0748 | out: hHeap=0x260000) returned 1 [0095.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.035] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.035] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.035] GetLastError () returned 0x0 [0095.109] GetLastError () returned 0x0 [0095.109] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.109] GetLastError () returned 0x0 [0095.109] GetLastError () returned 0x0 [0095.122] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.122] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.122] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0095.122] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.123] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.124] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.124] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.124] CloseHandle (hObject=0x11c) returned 1 [0095.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.127] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.127] GetLastError () returned 0x0 [0095.127] RtlWakeConditionVariable () returned 0x0 [0095.127] GetCurrentThreadId () returned 0x9ac [0095.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".ldf") returned 0x0 [0095.127] lstrlenW (lpString=".vhd") returned 4 [0095.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".vhd") returned 0x0 [0095.127] lstrlenW (lpString=".vhdx") returned 5 [0095.127] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".vhdx") returned 0x0 [0095.127] lstrlenW (lpString=".pst") returned 4 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".pst") returned 0x0 [0095.128] lstrlenW (lpString=".ost") returned 4 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".ost") returned 0x0 [0095.128] lstrlenW (lpString=".bak") returned 4 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".bak") returned 0x0 [0095.128] lstrlenW (lpString=".bac") returned 4 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".bac") returned 0x0 [0095.128] lstrlenW (lpString=".sys") returned 4 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".sys") returned 0x0 [0095.128] lstrlenW (lpString=".v2i") returned 4 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".v2i") returned 0x0 [0095.128] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.128] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0095.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.130] lstrlenW (lpString=".sql") returned 4 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".sql") returned 0x0 [0095.130] lstrlenW (lpString=".mdf") returned 4 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".mdf") returned 0x0 [0095.130] lstrlenW (lpString=".txt") returned 4 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".txt") returned 0x0 [0095.130] lstrlenW (lpString=".dbf") returned 4 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".dbf") returned 0x0 [0095.130] lstrlenW (lpString=".ckp") returned 4 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".ckp") returned 0x0 [0095.130] lstrlenW (lpString=".dacpac") returned 7 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".dacpac") returned 0x0 [0095.130] lstrlenW (lpString=".db3") returned 4 [0095.130] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".db3") returned 0x0 [0095.131] lstrlenW (lpString=".dtxs") returned 5 [0095.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".dtxs") returned 0x0 [0095.131] lstrlenW (lpString=".mdt") returned 4 [0095.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".mdt") returned 0x0 [0095.131] lstrlenW (lpString=".sdf") returned 4 [0095.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".sdf") returned 0x0 [0095.131] lstrlenW (lpString=".MDF") returned 4 [0095.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".MDF") returned 0x0 [0095.131] lstrlenW (lpString=".DBF") returned 4 [0095.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".DBF") returned 0x0 [0095.131] lstrlenW (lpString=".DB") returned 3 [0095.131] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".DB") returned 0x0 [0095.131] lstrlenW (lpString=".db") returned 3 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".db") returned 0x0 [0095.132] lstrlenW (lpString=".ndf") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".ndf") returned 0x0 [0095.132] lstrlenW (lpString=".NDF") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".NDF") returned 0x0 [0095.132] lstrlenW (lpString=".Mdf") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".Mdf") returned 0x0 [0095.132] lstrlenW (lpString=".dat") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".dat") returned 0x0 [0095.132] lstrlenW (lpString=".DAT") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".DAT") returned 0x0 [0095.132] lstrlenW (lpString=".ldf") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".ldf") returned 0x0 [0095.132] lstrlenW (lpString=".LDF") returned 4 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch=".LDF") returned 0x0 [0095.132] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.132] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.132] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x3400b8) returned 1 [0095.133] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.133] CryptReleaseContext (hProv=0x3400b8, dwFlags=0x0) returned 1 [0095.133] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.133] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21513435295) returned 1 [0095.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc784ac50, dwHighDateTime=0x1d585b4)) [0095.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0828 [0095.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0828 | out: hHeap=0x260000) returned 1 [0095.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.134] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.134] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.134] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.134] GetLastError () returned 0x0 [0095.134] GetLastError () returned 0x0 [0095.134] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.134] GetLastError () returned 0x0 [0095.135] GetLastError () returned 0x0 [0095.139] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.139] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.139] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0095.141] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.141] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.155] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.155] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.155] CloseHandle (hObject=0x11c) returned 1 [0095.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.[deadmin@cock.li].deadmin")) returned 1 [0095.156] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.157] GetLastError () returned 0x0 [0095.157] RtlWakeConditionVariable () returned 0x27e828 [0095.157] GetCurrentThreadId () returned 0x9ac [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".ldf") returned 0x0 [0095.157] lstrlenW (lpString=".vhd") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".vhd") returned 0x0 [0095.157] lstrlenW (lpString=".vhdx") returned 5 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".vhdx") returned 0x0 [0095.157] lstrlenW (lpString=".pst") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".pst") returned 0x0 [0095.157] lstrlenW (lpString=".ost") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".ost") returned 0x0 [0095.157] lstrlenW (lpString=".bak") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".bak") returned 0x0 [0095.157] lstrlenW (lpString=".bac") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".bac") returned 0x0 [0095.157] lstrlenW (lpString=".sys") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".sys") returned 0x0 [0095.157] lstrlenW (lpString=".v2i") returned 4 [0095.157] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".v2i") returned 0x0 [0095.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.159] lstrlenW (lpString=".sql") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".sql") returned 0x0 [0095.159] lstrlenW (lpString=".mdf") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".mdf") returned 0x0 [0095.159] lstrlenW (lpString=".txt") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".txt") returned 0x0 [0095.159] lstrlenW (lpString=".dbf") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".dbf") returned 0x0 [0095.159] lstrlenW (lpString=".ckp") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".ckp") returned 0x0 [0095.159] lstrlenW (lpString=".dacpac") returned 7 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".dacpac") returned 0x0 [0095.159] lstrlenW (lpString=".db3") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".db3") returned 0x0 [0095.159] lstrlenW (lpString=".dtxs") returned 5 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".dtxs") returned 0x0 [0095.159] lstrlenW (lpString=".mdt") returned 4 [0095.159] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".mdt") returned 0x0 [0095.159] lstrlenW (lpString=".sdf") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".sdf") returned 0x0 [0095.160] lstrlenW (lpString=".MDF") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".MDF") returned 0x0 [0095.160] lstrlenW (lpString=".DBF") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".DBF") returned 0x0 [0095.160] lstrlenW (lpString=".DB") returned 3 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".DB") returned 0x0 [0095.160] lstrlenW (lpString=".db") returned 3 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".db") returned 0x0 [0095.160] lstrlenW (lpString=".ndf") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".ndf") returned 0x0 [0095.160] lstrlenW (lpString=".NDF") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".NDF") returned 0x0 [0095.160] lstrlenW (lpString=".Mdf") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".Mdf") returned 0x0 [0095.160] lstrlenW (lpString=".dat") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".dat") returned 0x0 [0095.160] lstrlenW (lpString=".DAT") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".DAT") returned 0x0 [0095.160] lstrlenW (lpString=".ldf") returned 4 [0095.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".ldf") returned 0x0 [0095.160] lstrlenW (lpString=".LDF") returned 4 [0095.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch=".LDF") returned 0x0 [0095.161] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.161] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5088) returned 1 [0095.161] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.162] CryptReleaseContext (hProv=0x27e5088, dwFlags=0x0) returned 1 [0095.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.162] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21516284740) returned 1 [0095.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7896f10, dwHighDateTime=0x1d585b4)) [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0898 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0898 | out: hHeap=0x260000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29da00 [0095.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.162] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.163] GetLastError () returned 0x0 [0095.163] GetLastError () returned 0x0 [0095.163] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.163] GetLastError () returned 0x0 [0095.163] GetLastError () returned 0x0 [0095.171] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffebe78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.171] WriteFile (in: hFile=0x11c, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x14188, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x14188, lpOverlapped=0x0) returned 1 [0095.171] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.171] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.171] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.171] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.171] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.172] CloseHandle (hObject=0x11c) returned 1 [0095.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.174] GetLastError () returned 0x0 [0095.174] RtlWakeConditionVariable () returned 0x0 [0095.174] GetCurrentThreadId () returned 0x9ac [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".ldf") returned 0x0 [0095.174] lstrlenW (lpString=".vhd") returned 4 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".vhd") returned 0x0 [0095.174] lstrlenW (lpString=".vhdx") returned 5 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".vhdx") returned 0x0 [0095.174] lstrlenW (lpString=".pst") returned 4 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".pst") returned 0x0 [0095.174] lstrlenW (lpString=".ost") returned 4 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".ost") returned 0x0 [0095.174] lstrlenW (lpString=".bak") returned 4 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".bak") returned 0x0 [0095.174] lstrlenW (lpString=".bac") returned 4 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".bac") returned 0x0 [0095.174] lstrlenW (lpString=".sys") returned 4 [0095.174] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".sys") returned 0x0 [0095.174] lstrlenW (lpString=".v2i") returned 4 [0095.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".v2i") returned 0x0 [0095.175] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.175] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch="s\r\n.v2i") returned 0x0 [0095.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.176] lstrlenW (lpString=".sql") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".sql") returned 0x0 [0095.176] lstrlenW (lpString=".mdf") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".mdf") returned 0x0 [0095.176] lstrlenW (lpString=".txt") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".txt") returned 0x0 [0095.176] lstrlenW (lpString=".dbf") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".dbf") returned 0x0 [0095.176] lstrlenW (lpString=".ckp") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".ckp") returned 0x0 [0095.176] lstrlenW (lpString=".dacpac") returned 7 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".dacpac") returned 0x0 [0095.176] lstrlenW (lpString=".db3") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".db3") returned 0x0 [0095.176] lstrlenW (lpString=".dtxs") returned 5 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".dtxs") returned 0x0 [0095.176] lstrlenW (lpString=".mdt") returned 4 [0095.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".mdt") returned 0x0 [0095.176] lstrlenW (lpString=".sdf") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".sdf") returned 0x0 [0095.177] lstrlenW (lpString=".MDF") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".MDF") returned 0x0 [0095.177] lstrlenW (lpString=".DBF") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".DBF") returned 0x0 [0095.177] lstrlenW (lpString=".DB") returned 3 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".DB") returned 0x0 [0095.177] lstrlenW (lpString=".db") returned 3 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".db") returned 0x0 [0095.177] lstrlenW (lpString=".ndf") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".ndf") returned 0x0 [0095.177] lstrlenW (lpString=".NDF") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".NDF") returned 0x0 [0095.177] lstrlenW (lpString=".Mdf") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".Mdf") returned 0x0 [0095.177] lstrlenW (lpString=".dat") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".dat") returned 0x0 [0095.177] lstrlenW (lpString=".DAT") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".DAT") returned 0x0 [0095.177] lstrlenW (lpString=".ldf") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".ldf") returned 0x0 [0095.177] lstrlenW (lpString=".LDF") returned 4 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch=".LDF") returned 0x0 [0095.177] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.178] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5110) returned 1 [0095.178] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.178] CryptReleaseContext (hProv=0x27e5110, dwFlags=0x0) returned 1 [0095.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.179] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21517969209) returned 1 [0095.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc78bd070, dwHighDateTime=0x1d585b4)) [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0908 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0908 | out: hHeap=0x260000) returned 1 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.179] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.179] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.179] GetLastError () returned 0x0 [0095.180] GetLastError () returned 0x0 [0095.180] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.180] GetLastError () returned 0x0 [0095.180] GetLastError () returned 0x0 [0095.182] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xffffe553, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.182] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x1aad, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x1aad, lpOverlapped=0x0) returned 1 [0095.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.182] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.183] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.183] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.183] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.183] CloseHandle (hObject=0x11c) returned 1 [0095.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.[deadmin@cock.li].deadmin")) returned 1 [0095.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.184] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.184] GetLastError () returned 0x0 [0095.184] RtlWakeConditionVariable () returned 0x27e828 [0095.184] GetCurrentThreadId () returned 0x9ac [0095.184] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".ldf") returned 0x0 [0095.185] lstrlenW (lpString=".vhd") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".vhd") returned 0x0 [0095.185] lstrlenW (lpString=".vhdx") returned 5 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".vhdx") returned 0x0 [0095.185] lstrlenW (lpString=".pst") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".pst") returned 0x0 [0095.185] lstrlenW (lpString=".ost") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".ost") returned 0x0 [0095.185] lstrlenW (lpString=".bak") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".bak") returned 0x0 [0095.185] lstrlenW (lpString=".bac") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".bac") returned 0x0 [0095.185] lstrlenW (lpString=".sys") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".sys") returned 0x0 [0095.185] lstrlenW (lpString=".v2i") returned 4 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".v2i") returned 0x0 [0095.185] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.185] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch="s\r\n.v2i") returned 0x0 [0095.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.186] lstrlenW (lpString=".sql") returned 4 [0095.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".sql") returned 0x0 [0095.186] lstrlenW (lpString=".mdf") returned 4 [0095.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".mdf") returned 0x0 [0095.186] lstrlenW (lpString=".txt") returned 4 [0095.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".txt") returned 0x0 [0095.186] lstrlenW (lpString=".dbf") returned 4 [0095.186] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".dbf") returned 0x0 [0095.186] lstrlenW (lpString=".ckp") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".ckp") returned 0x0 [0095.187] lstrlenW (lpString=".dacpac") returned 7 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".dacpac") returned 0x0 [0095.187] lstrlenW (lpString=".db3") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".db3") returned 0x0 [0095.187] lstrlenW (lpString=".dtxs") returned 5 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".dtxs") returned 0x0 [0095.187] lstrlenW (lpString=".mdt") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".mdt") returned 0x0 [0095.187] lstrlenW (lpString=".sdf") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".sdf") returned 0x0 [0095.187] lstrlenW (lpString=".MDF") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".MDF") returned 0x0 [0095.187] lstrlenW (lpString=".DBF") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".DBF") returned 0x0 [0095.187] lstrlenW (lpString=".DB") returned 3 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".DB") returned 0x0 [0095.187] lstrlenW (lpString=".db") returned 3 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".db") returned 0x0 [0095.187] lstrlenW (lpString=".ndf") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".ndf") returned 0x0 [0095.187] lstrlenW (lpString=".NDF") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".NDF") returned 0x0 [0095.187] lstrlenW (lpString=".Mdf") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".Mdf") returned 0x0 [0095.187] lstrlenW (lpString=".dat") returned 4 [0095.187] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".dat") returned 0x0 [0095.188] lstrlenW (lpString=".DAT") returned 4 [0095.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".DAT") returned 0x0 [0095.188] lstrlenW (lpString=".ldf") returned 4 [0095.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".ldf") returned 0x0 [0095.188] lstrlenW (lpString=".LDF") returned 4 [0095.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch=".LDF") returned 0x0 [0095.188] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.188] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.188] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.188] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5220) returned 1 [0095.189] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.189] CryptReleaseContext (hProv=0x27e5220, dwFlags=0x0) returned 1 [0095.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.189] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21519003215) returned 1 [0095.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc78bd070, dwHighDateTime=0x1d585b4)) [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0940 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0940 | out: hHeap=0x260000) returned 1 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.189] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.189] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.190] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.190] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.190] GetLastError () returned 0x0 [0095.190] GetLastError () returned 0x0 [0095.190] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.190] GetLastError () returned 0x0 [0095.190] GetLastError () returned 0x0 [0095.209] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.209] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xe00, lpOverlapped=0x0) returned 1 [0095.209] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.209] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.210] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.210] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.210] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.210] CloseHandle (hObject=0x11c) returned 1 [0095.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.[deadmin@cock.li].deadmin")) returned 1 [0095.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.212] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.212] GetLastError () returned 0x0 [0095.212] RtlWakeConditionVariable () returned 0x0 [0095.212] GetCurrentThreadId () returned 0x9ac [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".ldf") returned 0x0 [0095.212] lstrlenW (lpString=".vhd") returned 4 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".vhd") returned 0x0 [0095.212] lstrlenW (lpString=".vhdx") returned 5 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".vhdx") returned 0x0 [0095.212] lstrlenW (lpString=".pst") returned 4 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".pst") returned 0x0 [0095.212] lstrlenW (lpString=".ost") returned 4 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".ost") returned 0x0 [0095.212] lstrlenW (lpString=".bak") returned 4 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".bak") returned 0x0 [0095.212] lstrlenW (lpString=".bac") returned 4 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".bac") returned 0x0 [0095.212] lstrlenW (lpString=".sys") returned 4 [0095.212] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".sys") returned 0x0 [0095.212] lstrlenW (lpString=".v2i") returned 4 [0095.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".v2i") returned 0x0 [0095.213] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch="s\r\n.v2i") returned 0x0 [0095.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.214] lstrlenW (lpString=".sql") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".sql") returned 0x0 [0095.215] lstrlenW (lpString=".mdf") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".mdf") returned 0x0 [0095.215] lstrlenW (lpString=".txt") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".txt") returned 0x0 [0095.215] lstrlenW (lpString=".dbf") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".dbf") returned 0x0 [0095.215] lstrlenW (lpString=".ckp") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".ckp") returned 0x0 [0095.215] lstrlenW (lpString=".dacpac") returned 7 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".dacpac") returned 0x0 [0095.215] lstrlenW (lpString=".db3") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".db3") returned 0x0 [0095.215] lstrlenW (lpString=".dtxs") returned 5 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".dtxs") returned 0x0 [0095.215] lstrlenW (lpString=".mdt") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".mdt") returned 0x0 [0095.215] lstrlenW (lpString=".sdf") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".sdf") returned 0x0 [0095.215] lstrlenW (lpString=".MDF") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".MDF") returned 0x0 [0095.215] lstrlenW (lpString=".DBF") returned 4 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".DBF") returned 0x0 [0095.215] lstrlenW (lpString=".DB") returned 3 [0095.215] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".DB") returned 0x0 [0095.215] lstrlenW (lpString=".db") returned 3 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".db") returned 0x0 [0095.216] lstrlenW (lpString=".ndf") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".ndf") returned 0x0 [0095.216] lstrlenW (lpString=".NDF") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".NDF") returned 0x0 [0095.216] lstrlenW (lpString=".Mdf") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".Mdf") returned 0x0 [0095.216] lstrlenW (lpString=".dat") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".dat") returned 0x0 [0095.216] lstrlenW (lpString=".DAT") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".DAT") returned 0x0 [0095.216] lstrlenW (lpString=".ldf") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".ldf") returned 0x0 [0095.216] lstrlenW (lpString=".LDF") returned 4 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch=".LDF") returned 0x0 [0095.216] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.216] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.216] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.216] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e52a8) returned 1 [0095.217] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.217] CryptReleaseContext (hProv=0x27e52a8, dwFlags=0x0) returned 1 [0095.217] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.217] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21521835064) returned 1 [0095.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7909330, dwHighDateTime=0x1d585b4)) [0095.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e09b0 [0095.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e09b0 | out: hHeap=0x260000) returned 1 [0095.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.218] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.218] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.218] GetLastError () returned 0x0 [0095.218] GetLastError () returned 0x0 [0095.218] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.218] GetLastError () returned 0x0 [0095.219] GetLastError () returned 0x0 [0095.220] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffff600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.220] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0xa00, lpOverlapped=0x0) returned 1 [0095.220] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.220] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.220] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.221] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.221] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.221] CloseHandle (hObject=0x11c) returned 1 [0095.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0095.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.[deadmin@cock.li].deadmin")) returned 1 [0095.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0095.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.224] GetLastError () returned 0x0 [0095.224] RtlWakeConditionVariable () returned 0x27e828 [0095.224] GetCurrentThreadId () returned 0x9ac [0095.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".ldf") returned 0x0 [0095.224] lstrlenW (lpString=".vhd") returned 4 [0095.224] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".vhd") returned 0x0 [0095.225] lstrlenW (lpString=".vhdx") returned 5 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".vhdx") returned 0x0 [0095.225] lstrlenW (lpString=".pst") returned 4 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".pst") returned 0x0 [0095.225] lstrlenW (lpString=".ost") returned 4 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".ost") returned 0x0 [0095.225] lstrlenW (lpString=".bak") returned 4 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".bak") returned 0x0 [0095.225] lstrlenW (lpString=".bac") returned 4 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".bac") returned 0x0 [0095.225] lstrlenW (lpString=".sys") returned 4 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".sys") returned 0x0 [0095.225] lstrlenW (lpString=".v2i") returned 4 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".v2i") returned 0x0 [0095.225] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.225] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.285] lstrlenW (lpString=".sql") returned 4 [0095.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".sql") returned 0x0 [0095.285] lstrlenW (lpString=".mdf") returned 4 [0095.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".mdf") returned 0x0 [0095.285] lstrlenW (lpString=".txt") returned 4 [0095.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".txt") returned 0x0 [0095.285] lstrlenW (lpString=".dbf") returned 4 [0095.285] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".dbf") returned 0x0 [0095.286] lstrlenW (lpString=".ckp") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".ckp") returned 0x0 [0095.286] lstrlenW (lpString=".dacpac") returned 7 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".dacpac") returned 0x0 [0095.286] lstrlenW (lpString=".db3") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".db3") returned 0x0 [0095.286] lstrlenW (lpString=".dtxs") returned 5 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".dtxs") returned 0x0 [0095.286] lstrlenW (lpString=".mdt") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".mdt") returned 0x0 [0095.286] lstrlenW (lpString=".sdf") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".sdf") returned 0x0 [0095.286] lstrlenW (lpString=".MDF") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".MDF") returned 0x0 [0095.286] lstrlenW (lpString=".DBF") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".DBF") returned 0x0 [0095.286] lstrlenW (lpString=".DB") returned 3 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".DB") returned 0x0 [0095.286] lstrlenW (lpString=".db") returned 3 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".db") returned 0x0 [0095.286] lstrlenW (lpString=".ndf") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".ndf") returned 0x0 [0095.286] lstrlenW (lpString=".NDF") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".NDF") returned 0x0 [0095.286] lstrlenW (lpString=".Mdf") returned 4 [0095.286] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".Mdf") returned 0x0 [0095.286] lstrlenW (lpString=".dat") returned 4 [0095.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".dat") returned 0x0 [0095.287] lstrlenW (lpString=".DAT") returned 4 [0095.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".DAT") returned 0x0 [0095.287] lstrlenW (lpString=".ldf") returned 4 [0095.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".ldf") returned 0x0 [0095.287] lstrlenW (lpString=".LDF") returned 4 [0095.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch=".LDF") returned 0x0 [0095.287] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.287] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.287] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5330) returned 1 [0095.288] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.288] CryptReleaseContext (hProv=0x27e5330, dwFlags=0x0) returned 1 [0095.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.288] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21528909428) returned 1 [0095.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc79c7a10, dwHighDateTime=0x1d585b4)) [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0a90 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0a90 | out: hHeap=0x260000) returned 1 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.288] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.289] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.289] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.289] GetLastError () returned 0x0 [0095.289] GetLastError () returned 0x0 [0095.289] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.289] GetLastError () returned 0x0 [0095.289] GetLastError () returned 0x0 [0095.359] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.359] WriteFile (in: hFile=0x11c, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.359] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0095.362] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.362] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.363] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.363] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.363] CloseHandle (hObject=0x11c) returned 1 [0095.363] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.369] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.369] GetLastError () returned 0x0 [0095.369] RtlWakeConditionVariable () returned 0x0 [0095.369] GetCurrentThreadId () returned 0x9ac [0095.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".ldf") returned 0x0 [0095.369] lstrlenW (lpString=".vhd") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".vhd") returned 0x0 [0095.370] lstrlenW (lpString=".vhdx") returned 5 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".vhdx") returned 0x0 [0095.370] lstrlenW (lpString=".pst") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".pst") returned 0x0 [0095.370] lstrlenW (lpString=".ost") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".ost") returned 0x0 [0095.370] lstrlenW (lpString=".bak") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".bak") returned 0x0 [0095.370] lstrlenW (lpString=".bac") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".bac") returned 0x0 [0095.370] lstrlenW (lpString=".sys") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".sys") returned 0x0 [0095.370] lstrlenW (lpString=".v2i") returned 4 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".v2i") returned 0x0 [0095.370] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch="s\r\n.v2i") returned 0x0 [0095.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0095.377] lstrlenW (lpString=".sql") returned 4 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".sql") returned 0x0 [0095.377] lstrlenW (lpString=".mdf") returned 4 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".mdf") returned 0x0 [0095.377] lstrlenW (lpString=".txt") returned 4 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".txt") returned 0x0 [0095.377] lstrlenW (lpString=".dbf") returned 4 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".dbf") returned 0x0 [0095.377] lstrlenW (lpString=".ckp") returned 4 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".ckp") returned 0x0 [0095.377] lstrlenW (lpString=".dacpac") returned 7 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".dacpac") returned 0x0 [0095.377] lstrlenW (lpString=".db3") returned 4 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".db3") returned 0x0 [0095.377] lstrlenW (lpString=".dtxs") returned 5 [0095.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".dtxs") returned 0x0 [0095.378] lstrlenW (lpString=".mdt") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".mdt") returned 0x0 [0095.378] lstrlenW (lpString=".sdf") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".sdf") returned 0x0 [0095.378] lstrlenW (lpString=".MDF") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".MDF") returned 0x0 [0095.378] lstrlenW (lpString=".DBF") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".DBF") returned 0x0 [0095.378] lstrlenW (lpString=".DB") returned 3 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".DB") returned 0x0 [0095.378] lstrlenW (lpString=".db") returned 3 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".db") returned 0x0 [0095.378] lstrlenW (lpString=".ndf") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".ndf") returned 0x0 [0095.378] lstrlenW (lpString=".NDF") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".NDF") returned 0x0 [0095.378] lstrlenW (lpString=".Mdf") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".Mdf") returned 0x0 [0095.378] lstrlenW (lpString=".dat") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".dat") returned 0x0 [0095.378] lstrlenW (lpString=".DAT") returned 4 [0095.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".DAT") returned 0x0 [0095.379] lstrlenW (lpString=".ldf") returned 4 [0095.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".ldf") returned 0x0 [0095.379] lstrlenW (lpString=".LDF") returned 4 [0095.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch=".LDF") returned 0x0 [0095.379] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.379] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27eef8 [0095.379] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5440) returned 1 [0095.380] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27eef8 | out: pbBuffer=0x27eef8) returned 1 [0095.380] CryptReleaseContext (hProv=0x27e5440, dwFlags=0x0) returned 1 [0095.380] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27eef8 | out: hHeap=0x260000) returned 1 [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a48 [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277c070 [0095.380] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21538127508) returned 1 [0095.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7aac250, dwHighDateTime=0x1d585b4)) [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279348 [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x278138 [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0ba8 [0095.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0ba8 | out: hHeap=0x260000) returned 1 [0095.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.381] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.381] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.381] GetLastError () returned 0x0 [0095.381] GetLastError () returned 0x0 [0095.382] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.382] GetLastError () returned 0x0 [0095.382] GetLastError () returned 0x0 [0095.417] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.417] WriteFile (in: hFile=0x11c, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.418] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0095.418] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.418] WriteFile (in: hFile=0x11c, lpBuffer=0x280a48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a48*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.424] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.425] WriteFile (in: hFile=0x11c, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.425] CloseHandle (hObject=0x11c) returned 1 [0095.425] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.[deadmin@cock.li].deadmin")) returned 1 [0095.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.433] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278138 | out: hHeap=0x260000) returned 1 [0095.433] GetLastError () returned 0x0 [0095.433] RtlWakeConditionVariable () returned 0x27e828 [0095.433] GetCurrentThreadId () returned 0x9ac [0095.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".ldf") returned 0x0 [0095.433] lstrlenW (lpString=".vhd") returned 4 [0095.433] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".vhd") returned 0x0 [0095.433] lstrlenW (lpString=".vhdx") returned 5 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".vhdx") returned 0x0 [0095.434] lstrlenW (lpString=".pst") returned 4 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".pst") returned 0x0 [0095.434] lstrlenW (lpString=".ost") returned 4 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".ost") returned 0x0 [0095.434] lstrlenW (lpString=".bak") returned 4 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".bak") returned 0x0 [0095.434] lstrlenW (lpString=".bac") returned 4 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".bac") returned 0x0 [0095.434] lstrlenW (lpString=".sys") returned 4 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".sys") returned 0x0 [0095.434] lstrlenW (lpString=".v2i") returned 4 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".v2i") returned 0x0 [0095.434] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.434] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch="s\r\n.v2i") returned 0x0 [0095.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.445] lstrlenW (lpString=".sql") returned 4 [0095.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".sql") returned 0x0 [0095.445] lstrlenW (lpString=".mdf") returned 4 [0095.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".mdf") returned 0x0 [0095.445] lstrlenW (lpString=".txt") returned 4 [0095.445] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".txt") returned 0x0 [0095.446] lstrlenW (lpString=".dbf") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".dbf") returned 0x0 [0095.446] lstrlenW (lpString=".ckp") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".ckp") returned 0x0 [0095.446] lstrlenW (lpString=".dacpac") returned 7 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".dacpac") returned 0x0 [0095.446] lstrlenW (lpString=".db3") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".db3") returned 0x0 [0095.446] lstrlenW (lpString=".dtxs") returned 5 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".dtxs") returned 0x0 [0095.446] lstrlenW (lpString=".mdt") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".mdt") returned 0x0 [0095.446] lstrlenW (lpString=".sdf") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".sdf") returned 0x0 [0095.446] lstrlenW (lpString=".MDF") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".MDF") returned 0x0 [0095.446] lstrlenW (lpString=".DBF") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".DBF") returned 0x0 [0095.446] lstrlenW (lpString=".DB") returned 3 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".DB") returned 0x0 [0095.446] lstrlenW (lpString=".db") returned 3 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".db") returned 0x0 [0095.446] lstrlenW (lpString=".ndf") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".ndf") returned 0x0 [0095.446] lstrlenW (lpString=".NDF") returned 4 [0095.446] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".NDF") returned 0x0 [0095.447] lstrlenW (lpString=".Mdf") returned 4 [0095.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".Mdf") returned 0x0 [0095.447] lstrlenW (lpString=".dat") returned 4 [0095.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".dat") returned 0x0 [0095.447] lstrlenW (lpString=".DAT") returned 4 [0095.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".DAT") returned 0x0 [0095.447] lstrlenW (lpString=".ldf") returned 4 [0095.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".ldf") returned 0x0 [0095.447] lstrlenW (lpString=".LDF") returned 4 [0095.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch=".LDF") returned 0x0 [0095.447] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.447] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.447] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.447] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e56e8) returned 1 [0095.448] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.448] CryptReleaseContext (hProv=0x27e56e8, dwFlags=0x0) returned 1 [0095.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.448] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21544923065) returned 1 [0095.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7b447d0, dwHighDateTime=0x1d585b4)) [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0b70 [0095.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.448] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0b70 | out: hHeap=0x260000) returned 1 [0095.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.449] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.449] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.449] GetLastError () returned 0x0 [0095.449] GetLastError () returned 0x0 [0095.449] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.449] GetLastError () returned 0x0 [0095.450] GetLastError () returned 0x0 [0095.454] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.454] WriteFile (in: hFile=0xe4, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.454] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.454] SetFilePointerEx (in: hFile=0xe4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.455] WriteFile (in: hFile=0xe4, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.457] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.457] WriteFile (in: hFile=0xe4, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.457] CloseHandle (hObject=0xe4) returned 1 [0095.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.[deadmin@cock.li].deadmin")) returned 1 [0095.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.472] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.472] GetLastError () returned 0x0 [0095.472] RtlWakeConditionVariable () returned 0x0 [0095.472] GetCurrentThreadId () returned 0x9ac [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".ldf") returned 0x0 [0095.473] lstrlenW (lpString=".vhd") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".vhd") returned 0x0 [0095.473] lstrlenW (lpString=".vhdx") returned 5 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".vhdx") returned 0x0 [0095.473] lstrlenW (lpString=".pst") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".pst") returned 0x0 [0095.473] lstrlenW (lpString=".ost") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".ost") returned 0x0 [0095.473] lstrlenW (lpString=".bak") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".bak") returned 0x0 [0095.473] lstrlenW (lpString=".bac") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".bac") returned 0x0 [0095.473] lstrlenW (lpString=".sys") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".sys") returned 0x0 [0095.473] lstrlenW (lpString=".v2i") returned 4 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".v2i") returned 0x0 [0095.473] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.473] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0095.475] lstrlenW (lpString=".sql") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".sql") returned 0x0 [0095.475] lstrlenW (lpString=".mdf") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".mdf") returned 0x0 [0095.475] lstrlenW (lpString=".txt") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".txt") returned 0x0 [0095.475] lstrlenW (lpString=".dbf") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".dbf") returned 0x0 [0095.475] lstrlenW (lpString=".ckp") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".ckp") returned 0x0 [0095.475] lstrlenW (lpString=".dacpac") returned 7 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".dacpac") returned 0x0 [0095.475] lstrlenW (lpString=".db3") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".db3") returned 0x0 [0095.475] lstrlenW (lpString=".dtxs") returned 5 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".dtxs") returned 0x0 [0095.475] lstrlenW (lpString=".mdt") returned 4 [0095.475] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".mdt") returned 0x0 [0095.475] lstrlenW (lpString=".sdf") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".sdf") returned 0x0 [0095.476] lstrlenW (lpString=".MDF") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".MDF") returned 0x0 [0095.476] lstrlenW (lpString=".DBF") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".DBF") returned 0x0 [0095.476] lstrlenW (lpString=".DB") returned 3 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".DB") returned 0x0 [0095.476] lstrlenW (lpString=".db") returned 3 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".db") returned 0x0 [0095.476] lstrlenW (lpString=".ndf") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".ndf") returned 0x0 [0095.476] lstrlenW (lpString=".NDF") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".NDF") returned 0x0 [0095.476] lstrlenW (lpString=".Mdf") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".Mdf") returned 0x0 [0095.476] lstrlenW (lpString=".dat") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".dat") returned 0x0 [0095.476] lstrlenW (lpString=".DAT") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".DAT") returned 0x0 [0095.476] lstrlenW (lpString=".ldf") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".ldf") returned 0x0 [0095.476] lstrlenW (lpString=".LDF") returned 4 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch=".LDF") returned 0x0 [0095.476] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.476] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.477] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5aa0) returned 1 [0095.477] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.477] CryptReleaseContext (hProv=0x27e5aa0, dwFlags=0x0) returned 1 [0095.477] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.478] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21547869612) returned 1 [0095.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7b90a90, dwHighDateTime=0x1d585b4)) [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0cf8 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0cf8 | out: hHeap=0x260000) returned 1 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.478] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.478] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.478] GetLastError () returned 0x0 [0095.479] GetLastError () returned 0x0 [0095.479] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.479] GetLastError () returned 0x0 [0095.479] GetLastError () returned 0x0 [0095.482] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.482] WriteFile (in: hFile=0x108, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.482] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.482] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.482] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.488] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.488] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.488] CloseHandle (hObject=0x108) returned 1 [0095.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.491] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.492] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.492] GetLastError () returned 0x0 [0095.492] RtlWakeConditionVariable () returned 0x0 [0095.492] GetCurrentThreadId () returned 0x9ac [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".ldf") returned 0x0 [0095.492] lstrlenW (lpString=".vhd") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".vhd") returned 0x0 [0095.492] lstrlenW (lpString=".vhdx") returned 5 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".vhdx") returned 0x0 [0095.492] lstrlenW (lpString=".pst") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".pst") returned 0x0 [0095.492] lstrlenW (lpString=".ost") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".ost") returned 0x0 [0095.492] lstrlenW (lpString=".bak") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".bak") returned 0x0 [0095.492] lstrlenW (lpString=".bac") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".bac") returned 0x0 [0095.492] lstrlenW (lpString=".sys") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".sys") returned 0x0 [0095.492] lstrlenW (lpString=".v2i") returned 4 [0095.492] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".v2i") returned 0x0 [0095.493] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.493] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch="s\r\n.v2i") returned 0x0 [0095.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0095.494] lstrlenW (lpString=".sql") returned 4 [0095.494] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".sql") returned 0x0 [0095.495] lstrlenW (lpString=".mdf") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".mdf") returned 0x0 [0095.495] lstrlenW (lpString=".txt") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".txt") returned 0x0 [0095.495] lstrlenW (lpString=".dbf") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".dbf") returned 0x0 [0095.495] lstrlenW (lpString=".ckp") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".ckp") returned 0x0 [0095.495] lstrlenW (lpString=".dacpac") returned 7 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".dacpac") returned 0x0 [0095.495] lstrlenW (lpString=".db3") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".db3") returned 0x0 [0095.495] lstrlenW (lpString=".dtxs") returned 5 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".dtxs") returned 0x0 [0095.495] lstrlenW (lpString=".mdt") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".mdt") returned 0x0 [0095.495] lstrlenW (lpString=".sdf") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".sdf") returned 0x0 [0095.495] lstrlenW (lpString=".MDF") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".MDF") returned 0x0 [0095.495] lstrlenW (lpString=".DBF") returned 4 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".DBF") returned 0x0 [0095.495] lstrlenW (lpString=".DB") returned 3 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".DB") returned 0x0 [0095.495] lstrlenW (lpString=".db") returned 3 [0095.495] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".db") returned 0x0 [0095.495] lstrlenW (lpString=".ndf") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".ndf") returned 0x0 [0095.496] lstrlenW (lpString=".NDF") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".NDF") returned 0x0 [0095.496] lstrlenW (lpString=".Mdf") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".Mdf") returned 0x0 [0095.496] lstrlenW (lpString=".dat") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".dat") returned 0x0 [0095.496] lstrlenW (lpString=".DAT") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".DAT") returned 0x0 [0095.496] lstrlenW (lpString=".ldf") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".ldf") returned 0x0 [0095.496] lstrlenW (lpString=".LDF") returned 4 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch=".LDF") returned 0x0 [0095.496] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.496] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.496] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x33f150) returned 1 [0095.497] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.497] CryptReleaseContext (hProv=0x33f150, dwFlags=0x0) returned 1 [0095.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.497] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21549853748) returned 1 [0095.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7bb6bf0, dwHighDateTime=0x1d585b4)) [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0d30 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0d30 | out: hHeap=0x260000) returned 1 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f640 [0095.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f640 | out: hHeap=0x260000) returned 1 [0095.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.498] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.498] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.498] GetLastError () returned 0x0 [0095.498] GetLastError () returned 0x0 [0095.499] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.499] GetLastError () returned 0x0 [0095.499] GetLastError () returned 0x0 [0095.624] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0xfffff1ca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.624] WriteFile (in: hFile=0x108, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0xe36, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0xe36, lpOverlapped=0x0) returned 1 [0095.624] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.624] SetFilePointerEx (in: hFile=0x108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.624] WriteFile (in: hFile=0x108, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.624] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.624] WriteFile (in: hFile=0x108, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.625] CloseHandle (hObject=0x108) returned 1 [0095.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.[deadmin@cock.li].deadmin")) returned 1 [0095.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.628] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.628] GetLastError () returned 0x0 [0095.628] RtlWakeConditionVariable () returned 0x0 [0095.628] GetCurrentThreadId () returned 0x9ac [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".ldf") returned 0x0 [0095.629] lstrlenW (lpString=".vhd") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".vhd") returned 0x0 [0095.629] lstrlenW (lpString=".vhdx") returned 5 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".vhdx") returned 0x0 [0095.629] lstrlenW (lpString=".pst") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".pst") returned 0x0 [0095.629] lstrlenW (lpString=".ost") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".ost") returned 0x0 [0095.629] lstrlenW (lpString=".bak") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".bak") returned 0x0 [0095.629] lstrlenW (lpString=".bac") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".bac") returned 0x0 [0095.629] lstrlenW (lpString=".sys") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".sys") returned 0x0 [0095.629] lstrlenW (lpString=".v2i") returned 4 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".v2i") returned 0x0 [0095.629] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.629] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0095.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.692] lstrlenW (lpString=".sql") returned 4 [0095.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".sql") returned 0x0 [0095.692] lstrlenW (lpString=".mdf") returned 4 [0095.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".mdf") returned 0x0 [0095.692] lstrlenW (lpString=".txt") returned 4 [0095.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".txt") returned 0x0 [0095.692] lstrlenW (lpString=".dbf") returned 4 [0095.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".dbf") returned 0x0 [0095.692] lstrlenW (lpString=".ckp") returned 4 [0095.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".ckp") returned 0x0 [0095.692] lstrlenW (lpString=".dacpac") returned 7 [0095.692] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".dacpac") returned 0x0 [0095.692] lstrlenW (lpString=".db3") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".db3") returned 0x0 [0095.693] lstrlenW (lpString=".dtxs") returned 5 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".dtxs") returned 0x0 [0095.693] lstrlenW (lpString=".mdt") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".mdt") returned 0x0 [0095.693] lstrlenW (lpString=".sdf") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".sdf") returned 0x0 [0095.693] lstrlenW (lpString=".MDF") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".MDF") returned 0x0 [0095.693] lstrlenW (lpString=".DBF") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".DBF") returned 0x0 [0095.693] lstrlenW (lpString=".DB") returned 3 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".DB") returned 0x0 [0095.693] lstrlenW (lpString=".db") returned 3 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".db") returned 0x0 [0095.693] lstrlenW (lpString=".ndf") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".ndf") returned 0x0 [0095.693] lstrlenW (lpString=".NDF") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".NDF") returned 0x0 [0095.693] lstrlenW (lpString=".Mdf") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".Mdf") returned 0x0 [0095.693] lstrlenW (lpString=".dat") returned 4 [0095.693] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".dat") returned 0x0 [0095.693] lstrlenW (lpString=".DAT") returned 4 [0095.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".DAT") returned 0x0 [0095.694] lstrlenW (lpString=".ldf") returned 4 [0095.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".ldf") returned 0x0 [0095.694] lstrlenW (lpString=".LDF") returned 4 [0095.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch=".LDF") returned 0x0 [0095.694] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.694] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.694] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.694] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5ee0) returned 1 [0095.695] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.695] CryptReleaseContext (hProv=0x27e5ee0, dwFlags=0x0) returned 1 [0095.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.695] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21569597615) returned 1 [0095.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7da5dd0, dwHighDateTime=0x1d585b4)) [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0ef0 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0ef0 | out: hHeap=0x260000) returned 1 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.695] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.696] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.696] GetLastError () returned 0x0 [0095.696] GetLastError () returned 0x0 [0095.696] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.696] GetLastError () returned 0x0 [0095.696] GetLastError () returned 0x0 [0095.734] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe8480, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.734] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x17b80, lpOverlapped=0x0) returned 1 [0095.734] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.734] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.734] WriteFile (in: hFile=0x104, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.735] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.735] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.737] CloseHandle (hObject=0x104) returned 1 [0095.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4810 [0095.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4810 | out: hHeap=0x260000) returned 1 [0095.740] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.740] GetLastError () returned 0x0 [0095.740] RtlWakeConditionVariable () returned 0x0 [0095.740] GetCurrentThreadId () returned 0x9ac [0095.740] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".ldf") returned 0x0 [0095.740] lstrlenW (lpString=".vhd") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".vhd") returned 0x0 [0095.741] lstrlenW (lpString=".vhdx") returned 5 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".vhdx") returned 0x0 [0095.741] lstrlenW (lpString=".pst") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".pst") returned 0x0 [0095.741] lstrlenW (lpString=".ost") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".ost") returned 0x0 [0095.741] lstrlenW (lpString=".bak") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".bak") returned 0x0 [0095.741] lstrlenW (lpString=".bac") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".bac") returned 0x0 [0095.741] lstrlenW (lpString=".sys") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".sys") returned 0x0 [0095.741] lstrlenW (lpString=".v2i") returned 4 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".v2i") returned 0x0 [0095.741] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.741] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0095.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.743] lstrlenW (lpString=".sql") returned 4 [0095.743] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".sql") returned 0x0 [0095.744] lstrlenW (lpString=".mdf") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".mdf") returned 0x0 [0095.744] lstrlenW (lpString=".txt") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".txt") returned 0x0 [0095.744] lstrlenW (lpString=".dbf") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".dbf") returned 0x0 [0095.744] lstrlenW (lpString=".ckp") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".ckp") returned 0x0 [0095.744] lstrlenW (lpString=".dacpac") returned 7 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".dacpac") returned 0x0 [0095.744] lstrlenW (lpString=".db3") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".db3") returned 0x0 [0095.744] lstrlenW (lpString=".dtxs") returned 5 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".dtxs") returned 0x0 [0095.744] lstrlenW (lpString=".mdt") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".mdt") returned 0x0 [0095.744] lstrlenW (lpString=".sdf") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".sdf") returned 0x0 [0095.744] lstrlenW (lpString=".MDF") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".MDF") returned 0x0 [0095.744] lstrlenW (lpString=".DBF") returned 4 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".DBF") returned 0x0 [0095.744] lstrlenW (lpString=".DB") returned 3 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".DB") returned 0x0 [0095.744] lstrlenW (lpString=".db") returned 3 [0095.744] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".db") returned 0x0 [0095.745] lstrlenW (lpString=".ndf") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".ndf") returned 0x0 [0095.745] lstrlenW (lpString=".NDF") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".NDF") returned 0x0 [0095.745] lstrlenW (lpString=".Mdf") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".Mdf") returned 0x0 [0095.745] lstrlenW (lpString=".dat") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".dat") returned 0x0 [0095.745] lstrlenW (lpString=".DAT") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".DAT") returned 0x0 [0095.745] lstrlenW (lpString=".ldf") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".ldf") returned 0x0 [0095.745] lstrlenW (lpString=".LDF") returned 4 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch=".LDF") returned 0x0 [0095.745] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.745] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.745] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5e58) returned 1 [0095.746] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.746] CryptReleaseContext (hProv=0x27e5e58, dwFlags=0x0) returned 1 [0095.746] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.746] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21574736608) returned 1 [0095.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7e181f0, dwHighDateTime=0x1d585b4)) [0095.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.746] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0f98 [0095.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f98 | out: hHeap=0x260000) returned 1 [0095.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.747] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.747] GetLastError () returned 0x0 [0095.747] GetLastError () returned 0x0 [0095.747] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.748] GetLastError () returned 0x0 [0095.748] GetLastError () returned 0x0 [0095.824] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.824] WriteFile (in: hFile=0x104, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.824] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.826] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.826] WriteFile (in: hFile=0x104, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.868] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.868] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.868] CloseHandle (hObject=0x104) returned 1 [0095.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.[deadmin@cock.li].deadmin")) returned 1 [0095.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.873] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.873] GetLastError () returned 0x0 [0095.873] RtlWakeConditionVariable () returned 0x0 [0095.873] GetCurrentThreadId () returned 0x9ac [0095.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".ldf") returned 0x0 [0095.873] lstrlenW (lpString=".vhd") returned 4 [0095.873] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".vhd") returned 0x0 [0095.874] lstrlenW (lpString=".vhdx") returned 5 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".vhdx") returned 0x0 [0095.874] lstrlenW (lpString=".pst") returned 4 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".pst") returned 0x0 [0095.874] lstrlenW (lpString=".ost") returned 4 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".ost") returned 0x0 [0095.874] lstrlenW (lpString=".bak") returned 4 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".bak") returned 0x0 [0095.874] lstrlenW (lpString=".bac") returned 4 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".bac") returned 0x0 [0095.874] lstrlenW (lpString=".sys") returned 4 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".sys") returned 0x0 [0095.874] lstrlenW (lpString=".v2i") returned 4 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".v2i") returned 0x0 [0095.874] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch="s\r\n.v2i") returned 0x0 [0095.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0095.876] lstrlenW (lpString=".sql") returned 4 [0095.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".sql") returned 0x0 [0095.876] lstrlenW (lpString=".mdf") returned 4 [0095.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".mdf") returned 0x0 [0095.876] lstrlenW (lpString=".txt") returned 4 [0095.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".txt") returned 0x0 [0095.876] lstrlenW (lpString=".dbf") returned 4 [0095.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".dbf") returned 0x0 [0095.876] lstrlenW (lpString=".ckp") returned 4 [0095.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".ckp") returned 0x0 [0095.876] lstrlenW (lpString=".dacpac") returned 7 [0095.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".dacpac") returned 0x0 [0095.876] lstrlenW (lpString=".db3") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".db3") returned 0x0 [0095.877] lstrlenW (lpString=".dtxs") returned 5 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".dtxs") returned 0x0 [0095.877] lstrlenW (lpString=".mdt") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".mdt") returned 0x0 [0095.877] lstrlenW (lpString=".sdf") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".sdf") returned 0x0 [0095.877] lstrlenW (lpString=".MDF") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".MDF") returned 0x0 [0095.877] lstrlenW (lpString=".DBF") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".DBF") returned 0x0 [0095.877] lstrlenW (lpString=".DB") returned 3 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".DB") returned 0x0 [0095.877] lstrlenW (lpString=".db") returned 3 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".db") returned 0x0 [0095.877] lstrlenW (lpString=".ndf") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".ndf") returned 0x0 [0095.877] lstrlenW (lpString=".NDF") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".NDF") returned 0x0 [0095.877] lstrlenW (lpString=".Mdf") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".Mdf") returned 0x0 [0095.877] lstrlenW (lpString=".dat") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".dat") returned 0x0 [0095.877] lstrlenW (lpString=".DAT") returned 4 [0095.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".DAT") returned 0x0 [0095.877] lstrlenW (lpString=".ldf") returned 4 [0095.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".ldf") returned 0x0 [0095.878] lstrlenW (lpString=".LDF") returned 4 [0095.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch=".LDF") returned 0x0 [0095.878] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.878] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e6100) returned 1 [0095.879] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.879] CryptReleaseContext (hProv=0x27e6100, dwFlags=0x0) returned 1 [0095.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.879] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21588015262) returned 1 [0095.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc7f6ee50, dwHighDateTime=0x1d585b4)) [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e10e8 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e10e8 | out: hHeap=0x260000) returned 1 [0095.879] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.880] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.880] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.880] GetLastError () returned 0x0 [0095.880] GetLastError () returned 0x0 [0095.880] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.880] GetLastError () returned 0x0 [0095.880] GetLastError () returned 0x0 [0095.891] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.891] WriteFile (in: hFile=0x104, lpBuffer=0x29230a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29230a8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.891] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29230a8 | out: hHeap=0x260000) returned 1 [0095.891] SetFilePointerEx (in: hFile=0x104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.891] WriteFile (in: hFile=0x104, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.893] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.893] WriteFile (in: hFile=0x104, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.893] CloseHandle (hObject=0x104) returned 1 [0095.947] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0095.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll.[deadmin@cock.li].deadmin")) returned 1 [0095.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0095.951] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0095.951] GetLastError () returned 0x0 [0095.951] RtlWakeConditionVariable () returned 0x0 [0095.951] GetCurrentThreadId () returned 0x9ac [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".ldf") returned 0x0 [0095.952] lstrlenW (lpString=".vhd") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".vhd") returned 0x0 [0095.952] lstrlenW (lpString=".vhdx") returned 5 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".vhdx") returned 0x0 [0095.952] lstrlenW (lpString=".pst") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".pst") returned 0x0 [0095.952] lstrlenW (lpString=".ost") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".ost") returned 0x0 [0095.952] lstrlenW (lpString=".bak") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".bak") returned 0x0 [0095.952] lstrlenW (lpString=".bac") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".bac") returned 0x0 [0095.952] lstrlenW (lpString=".sys") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".sys") returned 0x0 [0095.952] lstrlenW (lpString=".v2i") returned 4 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".v2i") returned 0x0 [0095.952] lstrlenW (lpString="s\r\n.v2i") returned 7 [0095.952] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0095.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0095.955] lstrlenW (lpString=".sql") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".sql") returned 0x0 [0095.955] lstrlenW (lpString=".mdf") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".mdf") returned 0x0 [0095.955] lstrlenW (lpString=".txt") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".txt") returned 0x0 [0095.955] lstrlenW (lpString=".dbf") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".dbf") returned 0x0 [0095.955] lstrlenW (lpString=".ckp") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".ckp") returned 0x0 [0095.955] lstrlenW (lpString=".dacpac") returned 7 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".dacpac") returned 0x0 [0095.955] lstrlenW (lpString=".db3") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".db3") returned 0x0 [0095.955] lstrlenW (lpString=".dtxs") returned 5 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".dtxs") returned 0x0 [0095.955] lstrlenW (lpString=".mdt") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".mdt") returned 0x0 [0095.955] lstrlenW (lpString=".sdf") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".sdf") returned 0x0 [0095.955] lstrlenW (lpString=".MDF") returned 4 [0095.955] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".MDF") returned 0x0 [0095.956] lstrlenW (lpString=".DBF") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".DBF") returned 0x0 [0095.956] lstrlenW (lpString=".DB") returned 3 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".DB") returned 0x0 [0095.956] lstrlenW (lpString=".db") returned 3 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".db") returned 0x0 [0095.956] lstrlenW (lpString=".ndf") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".ndf") returned 0x0 [0095.956] lstrlenW (lpString=".NDF") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".NDF") returned 0x0 [0095.956] lstrlenW (lpString=".Mdf") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".Mdf") returned 0x0 [0095.956] lstrlenW (lpString=".dat") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".dat") returned 0x0 [0095.956] lstrlenW (lpString=".DAT") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".DAT") returned 0x0 [0095.956] lstrlenW (lpString=".ldf") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".ldf") returned 0x0 [0095.956] lstrlenW (lpString=".LDF") returned 4 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch=".LDF") returned 0x0 [0095.956] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0095.956] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0095.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0095.956] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0095.957] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e6430) returned 1 [0095.957] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0095.957] CryptReleaseContext (hProv=0x27e6430, dwFlags=0x0) returned 1 [0095.957] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0095.957] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0095.958] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21595869978) returned 1 [0095.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc802d530, dwHighDateTime=0x1d585b4)) [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1158 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0095.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1158 | out: hHeap=0x260000) returned 1 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0095.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0095.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0095.958] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0095.958] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0095.958] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0095.958] GetLastError () returned 0x0 [0095.959] GetLastError () returned 0x0 [0095.959] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0095.959] GetLastError () returned 0x0 [0095.959] GetLastError () returned 0x0 [0095.972] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.972] WriteFile (in: hFile=0xd8, lpBuffer=0x297f0c0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x297f0c0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0095.972] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x297f0c0 | out: hHeap=0x260000) returned 1 [0095.972] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.972] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0095.985] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0095.985] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0095.985] CloseHandle (hObject=0xd8) returned 1 [0096.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d45e8 [0096.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.[deadmin@cock.li].deadmin")) returned 1 [0096.055] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d45e8 | out: hHeap=0x260000) returned 1 [0096.056] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0096.056] GetLastError () returned 0x0 [0096.056] RtlWakeConditionVariable () returned 0x0 [0096.056] GetCurrentThreadId () returned 0x9ac [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".ldf") returned 0x0 [0096.056] lstrlenW (lpString=".vhd") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".vhd") returned 0x0 [0096.056] lstrlenW (lpString=".vhdx") returned 5 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".vhdx") returned 0x0 [0096.056] lstrlenW (lpString=".pst") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".pst") returned 0x0 [0096.056] lstrlenW (lpString=".ost") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".ost") returned 0x0 [0096.056] lstrlenW (lpString=".bak") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".bak") returned 0x0 [0096.056] lstrlenW (lpString=".bac") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".bac") returned 0x0 [0096.056] lstrlenW (lpString=".sys") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".sys") returned 0x0 [0096.056] lstrlenW (lpString=".v2i") returned 4 [0096.056] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".v2i") returned 0x0 [0096.056] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.057] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0096.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0096.058] lstrlenW (lpString=".sql") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".sql") returned 0x0 [0096.058] lstrlenW (lpString=".mdf") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".mdf") returned 0x0 [0096.058] lstrlenW (lpString=".txt") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".txt") returned 0x0 [0096.058] lstrlenW (lpString=".dbf") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".dbf") returned 0x0 [0096.058] lstrlenW (lpString=".ckp") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".ckp") returned 0x0 [0096.058] lstrlenW (lpString=".dacpac") returned 7 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".dacpac") returned 0x0 [0096.058] lstrlenW (lpString=".db3") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".db3") returned 0x0 [0096.058] lstrlenW (lpString=".dtxs") returned 5 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".dtxs") returned 0x0 [0096.058] lstrlenW (lpString=".mdt") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".mdt") returned 0x0 [0096.058] lstrlenW (lpString=".sdf") returned 4 [0096.058] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".sdf") returned 0x0 [0096.059] lstrlenW (lpString=".MDF") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".MDF") returned 0x0 [0096.059] lstrlenW (lpString=".DBF") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".DBF") returned 0x0 [0096.059] lstrlenW (lpString=".DB") returned 3 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".DB") returned 0x0 [0096.059] lstrlenW (lpString=".db") returned 3 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".db") returned 0x0 [0096.059] lstrlenW (lpString=".ndf") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".ndf") returned 0x0 [0096.059] lstrlenW (lpString=".NDF") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".NDF") returned 0x0 [0096.059] lstrlenW (lpString=".Mdf") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".Mdf") returned 0x0 [0096.059] lstrlenW (lpString=".dat") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".dat") returned 0x0 [0096.059] lstrlenW (lpString=".DAT") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".DAT") returned 0x0 [0096.059] lstrlenW (lpString=".ldf") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".ldf") returned 0x0 [0096.059] lstrlenW (lpString=".LDF") returned 4 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch=".LDF") returned 0x0 [0096.059] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.059] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0096.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.060] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e6540) returned 1 [0096.060] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.060] CryptReleaseContext (hProv=0x27e6540, dwFlags=0x0) returned 1 [0096.060] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0096.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0096.060] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21606161929) returned 1 [0096.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc8111d70, dwHighDateTime=0x1d585b4)) [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e12a8 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e12a8 | out: hHeap=0x260000) returned 1 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f2f8 [0096.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f2f8 | out: hHeap=0x260000) returned 1 [0096.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29dcf8 [0096.061] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.061] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0096.061] GetLastError () returned 0x0 [0096.062] GetLastError () returned 0x0 [0096.062] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0096.062] GetLastError () returned 0x0 [0096.062] GetLastError () returned 0x0 [0096.083] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.083] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.084] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.084] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.156] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.156] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.156] CloseHandle (hObject=0xd8) returned 1 [0096.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.156] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.[deadmin@cock.li].deadmin")) returned 1 [0096.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0096.157] GetLastError () returned 0x0 [0096.157] RtlWakeConditionVariable () returned 0x0 [0096.157] GetCurrentThreadId () returned 0x9ac [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".ldf") returned 0x0 [0096.158] lstrlenW (lpString=".vhd") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".vhd") returned 0x0 [0096.158] lstrlenW (lpString=".vhdx") returned 5 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".vhdx") returned 0x0 [0096.158] lstrlenW (lpString=".pst") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".pst") returned 0x0 [0096.158] lstrlenW (lpString=".ost") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".ost") returned 0x0 [0096.158] lstrlenW (lpString=".bak") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".bak") returned 0x0 [0096.158] lstrlenW (lpString=".bac") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".bac") returned 0x0 [0096.158] lstrlenW (lpString=".sys") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".sys") returned 0x0 [0096.158] lstrlenW (lpString=".v2i") returned 4 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".v2i") returned 0x0 [0096.158] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.158] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0096.160] lstrlenW (lpString=".sql") returned 4 [0096.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".sql") returned 0x0 [0096.160] lstrlenW (lpString=".mdf") returned 4 [0096.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".mdf") returned 0x0 [0096.160] lstrlenW (lpString=".txt") returned 4 [0096.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".txt") returned 0x0 [0096.160] lstrlenW (lpString=".dbf") returned 4 [0096.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".dbf") returned 0x0 [0096.161] lstrlenW (lpString=".ckp") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".ckp") returned 0x0 [0096.161] lstrlenW (lpString=".dacpac") returned 7 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".dacpac") returned 0x0 [0096.161] lstrlenW (lpString=".db3") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".db3") returned 0x0 [0096.161] lstrlenW (lpString=".dtxs") returned 5 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".dtxs") returned 0x0 [0096.161] lstrlenW (lpString=".mdt") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".mdt") returned 0x0 [0096.161] lstrlenW (lpString=".sdf") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".sdf") returned 0x0 [0096.161] lstrlenW (lpString=".MDF") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".MDF") returned 0x0 [0096.161] lstrlenW (lpString=".DBF") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".DBF") returned 0x0 [0096.161] lstrlenW (lpString=".DB") returned 3 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".DB") returned 0x0 [0096.161] lstrlenW (lpString=".db") returned 3 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".db") returned 0x0 [0096.161] lstrlenW (lpString=".ndf") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".ndf") returned 0x0 [0096.161] lstrlenW (lpString=".NDF") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".NDF") returned 0x0 [0096.161] lstrlenW (lpString=".Mdf") returned 4 [0096.161] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".Mdf") returned 0x0 [0096.161] lstrlenW (lpString=".dat") returned 4 [0096.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".dat") returned 0x0 [0096.162] lstrlenW (lpString=".DAT") returned 4 [0096.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".DAT") returned 0x0 [0096.162] lstrlenW (lpString=".ldf") returned 4 [0096.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".ldf") returned 0x0 [0096.162] lstrlenW (lpString=".LDF") returned 4 [0096.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch=".LDF") returned 0x0 [0096.162] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.162] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0096.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.162] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e67e8) returned 1 [0096.163] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.163] CryptReleaseContext (hProv=0x27e67e8, dwFlags=0x0) returned 1 [0096.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0096.163] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21616397624) returned 1 [0096.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc821c710, dwHighDateTime=0x1d585b4)) [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e14a0 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e14a0 | out: hHeap=0x260000) returned 1 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f6b8 [0096.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f6b8 | out: hHeap=0x260000) returned 1 [0096.163] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d708 [0096.163] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.164] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0096.164] GetLastError () returned 0x0 [0096.164] GetLastError () returned 0x0 [0096.164] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0096.164] GetLastError () returned 0x0 [0096.164] GetLastError () returned 0x0 [0096.304] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.314] WriteFile (in: hFile=0xd8, lpBuffer=0x293c0b0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x293c0b0*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.315] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x293c0b0 | out: hHeap=0x260000) returned 1 [0096.315] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.315] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.363] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.363] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.363] CloseHandle (hObject=0xd8) returned 1 [0096.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x29f558 [0096.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29f558 | out: hHeap=0x260000) returned 1 [0096.376] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0096.376] GetLastError () returned 0x0 [0096.376] RtlWakeConditionVariable () returned 0x0 [0096.377] GetCurrentThreadId () returned 0x9ac [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".ldf") returned 0x0 [0096.377] lstrlenW (lpString=".vhd") returned 4 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".vhd") returned 0x0 [0096.377] lstrlenW (lpString=".vhdx") returned 5 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".vhdx") returned 0x0 [0096.377] lstrlenW (lpString=".pst") returned 4 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".pst") returned 0x0 [0096.377] lstrlenW (lpString=".ost") returned 4 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".ost") returned 0x0 [0096.377] lstrlenW (lpString=".bak") returned 4 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".bak") returned 0x0 [0096.377] lstrlenW (lpString=".bac") returned 4 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".bac") returned 0x0 [0096.377] lstrlenW (lpString=".sys") returned 4 [0096.377] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".sys") returned 0x0 [0096.377] lstrlenW (lpString=".v2i") returned 4 [0096.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".v2i") returned 0x0 [0096.378] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.378] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch="s\r\n.v2i") returned 0x0 [0096.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0096.379] lstrlenW (lpString=".sql") returned 4 [0096.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".sql") returned 0x0 [0096.379] lstrlenW (lpString=".mdf") returned 4 [0096.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".mdf") returned 0x0 [0096.379] lstrlenW (lpString=".txt") returned 4 [0096.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".txt") returned 0x0 [0096.379] lstrlenW (lpString=".dbf") returned 4 [0096.379] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".dbf") returned 0x0 [0096.380] lstrlenW (lpString=".ckp") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".ckp") returned 0x0 [0096.380] lstrlenW (lpString=".dacpac") returned 7 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".dacpac") returned 0x0 [0096.380] lstrlenW (lpString=".db3") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".db3") returned 0x0 [0096.380] lstrlenW (lpString=".dtxs") returned 5 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".dtxs") returned 0x0 [0096.380] lstrlenW (lpString=".mdt") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".mdt") returned 0x0 [0096.380] lstrlenW (lpString=".sdf") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".sdf") returned 0x0 [0096.380] lstrlenW (lpString=".MDF") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".MDF") returned 0x0 [0096.380] lstrlenW (lpString=".DBF") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".DBF") returned 0x0 [0096.380] lstrlenW (lpString=".DB") returned 3 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".DB") returned 0x0 [0096.380] lstrlenW (lpString=".db") returned 3 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".db") returned 0x0 [0096.380] lstrlenW (lpString=".ndf") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".ndf") returned 0x0 [0096.380] lstrlenW (lpString=".NDF") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".NDF") returned 0x0 [0096.380] lstrlenW (lpString=".Mdf") returned 4 [0096.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".Mdf") returned 0x0 [0096.380] lstrlenW (lpString=".dat") returned 4 [0096.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".dat") returned 0x0 [0096.381] lstrlenW (lpString=".DAT") returned 4 [0096.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".DAT") returned 0x0 [0096.381] lstrlenW (lpString=".ldf") returned 4 [0096.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".ldf") returned 0x0 [0096.381] lstrlenW (lpString=".LDF") returned 4 [0096.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch=".LDF") returned 0x0 [0096.381] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.381] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0096.381] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.381] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e5a18) returned 1 [0096.382] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.382] CryptReleaseContext (hProv=0x27e5a18, dwFlags=0x0) returned 1 [0096.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0096.382] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21638311741) returned 1 [0096.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc8431a50, dwHighDateTime=0x1d585b4)) [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1858 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1858 | out: hHeap=0x260000) returned 1 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f6b8 [0096.382] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.382] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f6b8 | out: hHeap=0x260000) returned 1 [0096.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.383] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.383] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0096.383] GetLastError () returned 0x0 [0096.383] GetLastError () returned 0x0 [0096.383] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0096.383] GetLastError () returned 0x0 [0096.383] GetLastError () returned 0x0 [0096.389] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.389] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.390] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.390] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.390] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.392] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.392] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.392] CloseHandle (hObject=0xd8) returned 1 [0096.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4810 [0096.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.[deadmin@cock.li].deadmin")) returned 1 [0096.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4810 | out: hHeap=0x260000) returned 1 [0096.394] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0096.394] GetLastError () returned 0x0 [0096.394] RtlWakeConditionVariable () returned 0x27e828 [0096.394] GetCurrentThreadId () returned 0x9ac [0096.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".ldf") returned 0x0 [0096.394] lstrlenW (lpString=".vhd") returned 4 [0096.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".vhd") returned 0x0 [0096.394] lstrlenW (lpString=".vhdx") returned 5 [0096.394] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".vhdx") returned 0x0 [0096.395] lstrlenW (lpString=".pst") returned 4 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".pst") returned 0x0 [0096.395] lstrlenW (lpString=".ost") returned 4 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".ost") returned 0x0 [0096.395] lstrlenW (lpString=".bak") returned 4 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".bak") returned 0x0 [0096.395] lstrlenW (lpString=".bac") returned 4 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".bac") returned 0x0 [0096.395] lstrlenW (lpString=".sys") returned 4 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".sys") returned 0x0 [0096.395] lstrlenW (lpString=".v2i") returned 4 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".v2i") returned 0x0 [0096.395] lstrlenW (lpString="s\r\n.v2i") returned 7 [0096.395] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch="s\r\n.v2i") returned 0x0 [0096.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0096.397] lstrlenW (lpString=".sql") returned 4 [0096.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".sql") returned 0x0 [0096.397] lstrlenW (lpString=".mdf") returned 4 [0096.397] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".mdf") returned 0x0 [0096.397] lstrlenW (lpString=".txt") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".txt") returned 0x0 [0096.398] lstrlenW (lpString=".dbf") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".dbf") returned 0x0 [0096.398] lstrlenW (lpString=".ckp") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".ckp") returned 0x0 [0096.398] lstrlenW (lpString=".dacpac") returned 7 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".dacpac") returned 0x0 [0096.398] lstrlenW (lpString=".db3") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".db3") returned 0x0 [0096.398] lstrlenW (lpString=".dtxs") returned 5 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".dtxs") returned 0x0 [0096.398] lstrlenW (lpString=".mdt") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".mdt") returned 0x0 [0096.398] lstrlenW (lpString=".sdf") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".sdf") returned 0x0 [0096.398] lstrlenW (lpString=".MDF") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".MDF") returned 0x0 [0096.398] lstrlenW (lpString=".DBF") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".DBF") returned 0x0 [0096.398] lstrlenW (lpString=".DB") returned 3 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".DB") returned 0x0 [0096.398] lstrlenW (lpString=".db") returned 3 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".db") returned 0x0 [0096.398] lstrlenW (lpString=".ndf") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".ndf") returned 0x0 [0096.398] lstrlenW (lpString=".NDF") returned 4 [0096.398] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".NDF") returned 0x0 [0096.399] lstrlenW (lpString=".Mdf") returned 4 [0096.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".Mdf") returned 0x0 [0096.399] lstrlenW (lpString=".dat") returned 4 [0096.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".dat") returned 0x0 [0096.399] lstrlenW (lpString=".DAT") returned 4 [0096.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".DAT") returned 0x0 [0096.399] lstrlenW (lpString=".ldf") returned 4 [0096.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".ldf") returned 0x0 [0096.399] lstrlenW (lpString=".LDF") returned 4 [0096.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch=".LDF") returned 0x0 [0096.399] lstrlenW (lpString="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 19 [0096.399] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", lpSrch="t\r\n.DAT\r\n.ldf\r\n.LDF") returned 0x0 [0096.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x130) returned 0x29227e8 [0096.399] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27f0d8 [0096.399] CryptAcquireContextA (in: phProv=0x24cfb80, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x24cfb80*=0x27e6a90) returned 1 [0096.400] CryptGenRandom (in: hProv=0x27e5b8, dwLen=0x20, pbBuffer=0x27f0d8 | out: pbBuffer=0x27f0d8) returned 1 [0096.400] CryptReleaseContext (hProv=0x27e6a90, dwFlags=0x0) returned 1 [0096.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f0d8 | out: hHeap=0x260000) returned 1 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x8) returned 0x280a18 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x120c) returned 0x277d378 [0096.400] QueryPerformanceCounter (in: lpPerformanceCount=0x24cfb10 | out: lpPerformanceCount=0x24cfb10*=21640118599) returned 1 [0096.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24cfb50 | out: lpSystemTimeAsFileTime=0x24cfb50*(dwLowDateTime=0xc8457bb0, dwHighDateTime=0x1d585b4)) [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x2792c8 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x279368 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e1890 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x47) returned 0x2779070 [0096.400] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e1890 | out: hHeap=0x260000) returned 1 [0096.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x6a) returned 0x32f730 [0096.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2779070 | out: hHeap=0x260000) returned 1 [0096.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x9e) returned 0x317c48 [0096.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x32f730 | out: hHeap=0x260000) returned 1 [0096.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x29d7a0 [0096.401] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x317c48 | out: hHeap=0x260000) returned 1 [0096.401] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x24cf9f0) [0096.401] GetLastError () returned 0x0 [0096.401] GetLastError () returned 0x0 [0096.401] RtlUnwind (TargetFrame=0x24cfae8, TargetIp=0x42ae4e, ExceptionRecord=0x24cf4b4, ReturnValue=0x0) [0096.401] GetLastError () returned 0x0 [0096.402] GetLastError () returned 0x0 [0096.404] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0xfffe7000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.404] WriteFile (in: hFile=0xd8, lpBuffer=0x29660b8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x29660b8*, lpNumberOfBytesWritten=0x24cfdb0*=0x19000, lpOverlapped=0x0) returned 1 [0096.406] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29660b8 | out: hHeap=0x260000) returned 1 [0096.406] SetFilePointerEx (in: hFile=0xd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.406] WriteFile (in: hFile=0xd8, lpBuffer=0x280a18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x280a18*, lpNumberOfBytesWritten=0x24cfdb0*=0x8, lpOverlapped=0x0) returned 1 [0096.407] lstrlenA (lpString="af1bb1d6b4940803cfa2b4a34804bb65dd551dd10e1fc2587d4520c9734af6928f8c211edd02f2b82e88d5871241dd62c9394b1a3abf8950ca6ff0ff89e328b630aec0a61a67e56010b4b46bbd7fa781814d9d350d6b457de1c4cb41003040f8b0920c416aa3c4eb88ce0144b9d0311cb6e1e7c8a58a54e79d03091a76c2f2f40817e26b289dfa2713ab3d0c85e060e8009eb94ce19bcc94e1d85870c2536b7c355b5a04154c283bae8ec98ba3a39ac551d5b3410a92c59bef554e67cbc6e366fe5db79ede529a2710e49854153c5def5e809a4dd47d7d1b8d81fc86e2cee5e5f02dad92919df72d8a94a0cf96461981d43a66ffb608c18b2f873bd7fd4aa18e") returned 512 [0096.407] WriteFile (in: hFile=0xd8, lpBuffer=0x482b00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x24cfdb0, lpOverlapped=0x0 | out: lpBuffer=0x482b00*, lpNumberOfBytesWritten=0x24cfdb0*=0x200, lpOverlapped=0x0) returned 1 [0096.407] CloseHandle (hObject=0xd8) returned 1 [0096.407] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d4530 [0096.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.[DeAdmin@cock.li].DEADMIN" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll.[deadmin@cock.li].deadmin")) returned 1 [0096.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d4530 | out: hHeap=0x260000) returned 1 [0096.479] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0096.479] GetLastError () returned 0x0 [0096.479] RtlWakeConditionVariable () returned 0x0 [0096.490] GetCurrentThreadId () returned 0x9ac [0096.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL", lpSrch=".ldf") returned 0x0 [0096.490] lstrlenW (lpString=".vhd") returned 4 [0096.490] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL", lpSrch=".vhd") returned 0x0 [0096.490] lstrlenW (lpString=".vhdx") returned 5 [0096.524] GetLastError () returned 0x0 [0096.541] GetLastError () returned 0x0 [0096.541] GetLastError () returned 0x0 [0096.541] GetLastError () returned 0x0 [0096.541] GetLastError () returned 0x0 Thread: id = 9 os_tid = 0x9b0 [0029.764] StrStrW (lpFirst="\\\\?\\C:", lpSrch="AppData") returned 0x0 [0029.764] lstrcmpiW (lpString1="C:", lpString2="C:\\Windows") returned -1 [0029.764] lstrlenW (lpString="C:\\Windows") returned 10 [0029.764] lstrcmpiW (lpString1="C:", lpString2="C:\\System Volume Information") returned -1 [0029.764] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.764] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x281570 [0029.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x27ba70 [0029.764] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Windows") returned -1 [0029.764] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0029.764] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0029.764] lstrcmpW (lpString1="$Recycle.Bin", lpString2="AppData") returned -1 [0029.764] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin", lpSrch="AppData") returned 0x0 [0029.764] lstrcmpiW (lpString1="C:\\$Recycle.Bin", lpString2="C:\\Windows") returned -1 [0029.764] lstrlenW (lpString="C:\\Windows") returned 10 [0029.765] lstrcmpiW (lpString1="C:\\$Recycle.Bin", lpString2="C:\\System Volume Information") returned -1 [0029.765] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.765] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x291578 [0029.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27bab0 [0029.766] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.766] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.766] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.766] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.766] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0c0 [0029.766] GetCurrentThreadId () returned 0x9b0 [0029.766] GetCurrentThreadId () returned 0x9b0 [0029.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x27e0f8 [0029.766] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.766] RtlWakeConditionVariable () returned 0x1 [0029.768] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.768] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.768] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.768] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.768] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.768] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a15d0 [0029.768] GetCurrentThreadId () returned 0x9b0 [0029.768] GetCurrentThreadId () returned 0x9b0 [0029.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.768] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0029.768] RtlWakeConditionVariable () returned 0x1 [0029.770] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a15d0 | out: hHeap=0x260000) returned 1 [0029.770] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0029.770] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="Windows") returned -1 [0029.770] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2=".") returned 1 [0029.770] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="..") returned 1 [0029.770] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="AppData") returned 1 [0029.770] StrStrW (lpFirst="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpSrch="AppData") returned 0x0 [0029.770] lstrcmpiW (lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="C:\\Windows") returned -1 [0029.770] lstrlenW (lpString="C:\\Windows") returned 10 [0029.770] lstrcmpiW (lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="C:\\System Volume Information") returned -1 [0029.770] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.770] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a2d88 [0029.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0c0 [0029.771] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.771] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.771] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.771] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.771] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d070 [0029.771] GetCurrentThreadId () returned 0x9b0 [0029.771] GetCurrentThreadId () returned 0x9b0 [0029.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a15d0 [0029.771] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0029.772] RtlWakeConditionVariable () returned 0x1 [0029.773] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.773] FindNextFileW (in: hFindFile=0x27e0c0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.773] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.773] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.773] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.773] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.773] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.773] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d070 [0029.773] GetCurrentThreadId () returned 0x9b0 [0029.773] GetCurrentThreadId () returned 0x9b0 [0029.773] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a15d0 [0029.774] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0029.774] RtlWakeConditionVariable () returned 0x1 [0029.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.775] FindNextFileW (in: hFindFile=0x27e0c0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x38, dwReserved1=0x260000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0029.775] lstrcmpiW (lpString1="desktop.ini", lpString2="Windows") returned -1 [0029.775] lstrcmpW (lpString1="desktop.ini", lpString2="32.EXE.exe") returned 1 [0029.775] StrStrW (lpFirst="desktop.ini", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.775] lstrcmpW (lpString1="desktop.ini", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0029.775] GetCurrentThreadId () returned 0x9b0 [0029.775] GetCurrentThreadId () returned 0x9b0 [0029.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a15d0 [0029.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3d98 [0029.775] RtlWakeConditionVariable () returned 0x1 [0029.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.792] FindNextFileW (in: hFindFile=0x27e0c0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x38, dwReserved1=0x260000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0029.812] FindClose (in: hFindFile=0x27e0c0 | out: hFindFile=0x27e0c0) returned 1 [0029.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27d070 [0029.813] GetCurrentThreadId () returned 0x9b0 [0029.813] GetCurrentThreadId () returned 0x9b0 [0029.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.813] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b2d90 [0029.813] RtlWakeConditionVariable () returned 0x1 [0029.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.816] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a2d88 | out: hHeap=0x260000) returned 1 [0029.816] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0029.816] FindClose (in: hFindFile=0x27bab0 | out: hFindFile=0x27bab0) returned 1 [0029.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0c0 [0029.817] GetCurrentThreadId () returned 0x9b0 [0029.817] GetCurrentThreadId () returned 0x9b0 [0029.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.817] RtlWakeConditionVariable () returned 0x1 [0029.817] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0c0 | out: hHeap=0x260000) returned 1 [0029.820] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x291578 | out: hHeap=0x260000) returned 1 [0029.820] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0029.820] lstrcmpiW (lpString1="Boot", lpString2="Windows") returned -1 [0029.820] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0029.820] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0029.820] lstrcmpW (lpString1="Boot", lpString2="AppData") returned 1 [0029.821] StrStrW (lpFirst="\\\\?\\C:\\Boot", lpSrch="AppData") returned 0x0 [0029.821] lstrcmpiW (lpString1="C:\\Boot", lpString2="C:\\Windows") returned -1 [0029.821] lstrlenW (lpString="C:\\Windows") returned 10 [0029.821] lstrcmpiW (lpString1="C:\\Boot", lpString2="C:\\System Volume Information") returned -1 [0029.821] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a1d80 [0029.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27bab0 [0029.821] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.821] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.821] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.821] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.821] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0029.821] GetCurrentThreadId () returned 0x9b0 [0029.821] GetCurrentThreadId () returned 0x9b0 [0029.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.821] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0029.821] RtlWakeConditionVariable () returned 0x1 [0029.826] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0029.826] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.826] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.826] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.826] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.826] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.826] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.826] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0029.826] GetCurrentThreadId () returned 0x9b0 [0029.826] GetCurrentThreadId () returned 0x9b0 [0029.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.826] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efe8 [0029.826] RtlWakeConditionVariable () returned 0x1 [0029.828] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0029.828] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0029.828] lstrcmpiW (lpString1="BCD", lpString2="Windows") returned -1 [0029.828] lstrcmpW (lpString1="BCD", lpString2="32.EXE.exe") returned 1 [0029.828] StrStrW (lpFirst="BCD", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.828] lstrcmpW (lpString1="BCD", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0029.828] GetCurrentThreadId () returned 0x9b0 [0029.829] GetCurrentThreadId () returned 0x9b0 [0029.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efc0 [0029.829] RtlWakeConditionVariable () returned 0x1 [0029.830] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0029.830] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0029.830] lstrcmpiW (lpString1="BCD.LOG", lpString2="Windows") returned -1 [0029.830] lstrcmpW (lpString1="BCD.LOG", lpString2="32.EXE.exe") returned 1 [0029.830] StrStrW (lpFirst="BCD.LOG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.830] lstrcmpW (lpString1="BCD.LOG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.831] GetCurrentThreadId () returned 0x9b0 [0029.831] GetCurrentThreadId () returned 0x9b0 [0029.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.831] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0029.831] RtlWakeConditionVariable () returned 0x1 [0029.832] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.832] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0029.832] lstrcmpiW (lpString1="BCD.LOG1", lpString2="Windows") returned -1 [0029.832] lstrcmpW (lpString1="BCD.LOG1", lpString2="32.EXE.exe") returned 1 [0029.832] StrStrW (lpFirst="BCD.LOG1", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.832] lstrcmpW (lpString1="BCD.LOG1", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.832] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.832] GetCurrentThreadId () returned 0x9b0 [0029.832] GetCurrentThreadId () returned 0x9b0 [0029.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0029.833] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0029.833] RtlWakeConditionVariable () returned 0x1 [0029.845] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.845] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0029.845] lstrcmpiW (lpString1="BCD.LOG2", lpString2="Windows") returned -1 [0029.845] lstrcmpW (lpString1="BCD.LOG2", lpString2="32.EXE.exe") returned 1 [0029.845] StrStrW (lpFirst="BCD.LOG2", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.845] lstrcmpW (lpString1="BCD.LOG2", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.845] GetCurrentThreadId () returned 0x9b0 [0029.845] GetCurrentThreadId () returned 0x9b0 [0029.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0029.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0029.845] RtlWakeConditionVariable () returned 0x1 [0029.856] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0029.856] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0029.856] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="Windows") returned -1 [0029.856] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="32.EXE.exe") returned 1 [0029.856] StrStrW (lpFirst="BOOTSTAT.DAT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.856] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0029.856] GetCurrentThreadId () returned 0x9b0 [0029.856] GetCurrentThreadId () returned 0x9b0 [0029.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0029.857] RtlWakeConditionVariable () returned 0x1 [0029.867] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277dd8 | out: hHeap=0x260000) returned 1 [0029.867] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0029.873] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows") returned -1 [0029.873] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0029.873] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0029.873] lstrcmpW (lpString1="cs-CZ", lpString2="AppData") returned 1 [0029.873] StrStrW (lpFirst="\\\\?\\C:\\Boot\\cs-CZ", lpSrch="AppData") returned 0x0 [0029.873] lstrcmpiW (lpString1="C:\\Boot\\cs-CZ", lpString2="C:\\Windows") returned -1 [0029.873] lstrlenW (lpString="C:\\Windows") returned 10 [0029.873] lstrcmpiW (lpString1="C:\\Boot\\cs-CZ", lpString2="C:\\System Volume Information") returned -1 [0029.873] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.873] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.873] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.873] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.874] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.874] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.874] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.874] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.874] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.874] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.874] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.874] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.874] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.874] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.874] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.874] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.874] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.874] GetCurrentThreadId () returned 0x9b0 [0029.874] GetCurrentThreadId () returned 0x9b0 [0029.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.875] RtlWakeConditionVariable () returned 0x1 [0029.876] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.876] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0029.876] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.876] GetCurrentThreadId () returned 0x9b0 [0029.876] GetCurrentThreadId () returned 0x9b0 [0029.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.877] RtlWakeConditionVariable () returned 0x1 [0029.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.879] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.879] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0029.879] lstrcmpiW (lpString1="da-DK", lpString2="Windows") returned -1 [0029.879] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0029.879] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0029.879] lstrcmpW (lpString1="da-DK", lpString2="AppData") returned 1 [0029.879] StrStrW (lpFirst="\\\\?\\C:\\Boot\\da-DK", lpSrch="AppData") returned 0x0 [0029.879] lstrcmpiW (lpString1="C:\\Boot\\da-DK", lpString2="C:\\Windows") returned -1 [0029.879] lstrlenW (lpString="C:\\Windows") returned 10 [0029.880] lstrcmpiW (lpString1="C:\\Boot\\da-DK", lpString2="C:\\System Volume Information") returned -1 [0029.880] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.880] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.880] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.880] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.880] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.880] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.880] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.880] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.880] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.880] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.880] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.880] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.880] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.880] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.880] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.881] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.881] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.881] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.881] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.881] GetCurrentThreadId () returned 0x9b0 [0029.881] GetCurrentThreadId () returned 0x9b0 [0029.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.881] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.881] RtlWakeConditionVariable () returned 0x1 [0029.883] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.883] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0029.883] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.883] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.884] GetCurrentThreadId () returned 0x9b0 [0029.884] GetCurrentThreadId () returned 0x9b0 [0029.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.884] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.884] RtlWakeConditionVariable () returned 0x1 [0029.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.886] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.886] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0029.886] lstrcmpiW (lpString1="de-DE", lpString2="Windows") returned -1 [0029.886] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0029.886] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0029.886] lstrcmpW (lpString1="de-DE", lpString2="AppData") returned 1 [0029.886] StrStrW (lpFirst="\\\\?\\C:\\Boot\\de-DE", lpSrch="AppData") returned 0x0 [0029.887] lstrcmpiW (lpString1="C:\\Boot\\de-DE", lpString2="C:\\Windows") returned -1 [0029.887] lstrlenW (lpString="C:\\Windows") returned 10 [0029.887] lstrcmpiW (lpString1="C:\\Boot\\de-DE", lpString2="C:\\System Volume Information") returned -1 [0029.887] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.889] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.889] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.889] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.890] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.890] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.890] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.890] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.890] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.890] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.890] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.890] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.890] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.890] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.890] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.890] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.890] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.890] GetCurrentThreadId () returned 0x9b0 [0029.890] GetCurrentThreadId () returned 0x9b0 [0029.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.891] RtlWakeConditionVariable () returned 0x1 [0029.892] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.892] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0029.892] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.892] GetCurrentThreadId () returned 0x9b0 [0029.892] GetCurrentThreadId () returned 0x9b0 [0029.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.892] RtlWakeConditionVariable () returned 0x1 [0029.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.895] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.895] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0029.895] lstrcmpiW (lpString1="el-GR", lpString2="Windows") returned -1 [0029.895] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0029.895] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0029.895] lstrcmpW (lpString1="el-GR", lpString2="AppData") returned 1 [0029.895] StrStrW (lpFirst="\\\\?\\C:\\Boot\\el-GR", lpSrch="AppData") returned 0x0 [0029.895] lstrcmpiW (lpString1="C:\\Boot\\el-GR", lpString2="C:\\Windows") returned -1 [0029.895] lstrlenW (lpString="C:\\Windows") returned 10 [0029.895] lstrcmpiW (lpString1="C:\\Boot\\el-GR", lpString2="C:\\System Volume Information") returned -1 [0029.896] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.896] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.896] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.896] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.896] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.896] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.896] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.896] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.896] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.896] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.896] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.896] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.896] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.896] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.897] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.897] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.897] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.897] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.897] GetCurrentThreadId () returned 0x9b0 [0029.897] GetCurrentThreadId () returned 0x9b0 [0029.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.897] RtlWakeConditionVariable () returned 0x1 [0029.899] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.899] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0029.899] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.899] GetCurrentThreadId () returned 0x9b0 [0029.899] GetCurrentThreadId () returned 0x9b0 [0029.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.899] RtlWakeConditionVariable () returned 0x1 [0029.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.902] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.902] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.902] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0029.902] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0029.902] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0029.902] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0029.902] StrStrW (lpFirst="\\\\?\\C:\\Boot\\en-US", lpSrch="AppData") returned 0x0 [0029.902] lstrcmpiW (lpString1="C:\\Boot\\en-US", lpString2="C:\\Windows") returned -1 [0029.902] lstrlenW (lpString="C:\\Windows") returned 10 [0029.902] lstrcmpiW (lpString1="C:\\Boot\\en-US", lpString2="C:\\System Volume Information") returned -1 [0029.902] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.903] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.903] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.903] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.903] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.903] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.903] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.903] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.903] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.903] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.903] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.903] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.903] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.903] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.903] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.903] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.903] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.903] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.903] GetCurrentThreadId () returned 0x9b0 [0029.904] GetCurrentThreadId () returned 0x9b0 [0029.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.904] RtlWakeConditionVariable () returned 0x1 [0029.905] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.905] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x48, dwReserved1=0x260000, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0029.906] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="Windows") returned -1 [0029.906] lstrcmpW (lpString1="memtest.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.906] StrStrW (lpFirst="memtest.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.906] lstrcmpW (lpString1="memtest.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.906] GetCurrentThreadId () returned 0x9b0 [0029.906] GetCurrentThreadId () returned 0x9b0 [0029.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.906] RtlWakeConditionVariable () returned 0x1 [0029.907] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.907] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x48, dwReserved1=0x260000, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0029.907] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.907] GetCurrentThreadId () returned 0x9b0 [0029.908] GetCurrentThreadId () returned 0x9b0 [0029.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.908] RtlWakeConditionVariable () returned 0x1 [0029.908] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.909] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.909] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0029.909] lstrcmpiW (lpString1="es-ES", lpString2="Windows") returned -1 [0029.909] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0029.909] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0029.909] lstrcmpW (lpString1="es-ES", lpString2="AppData") returned 1 [0029.909] StrStrW (lpFirst="\\\\?\\C:\\Boot\\es-ES", lpSrch="AppData") returned 0x0 [0029.909] lstrcmpiW (lpString1="C:\\Boot\\es-ES", lpString2="C:\\Windows") returned -1 [0029.912] lstrlenW (lpString="C:\\Windows") returned 10 [0029.912] lstrcmpiW (lpString1="C:\\Boot\\es-ES", lpString2="C:\\System Volume Information") returned -1 [0029.912] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.926] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.926] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.926] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.926] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.926] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.926] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.926] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.926] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.926] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.926] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.926] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.926] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.926] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.927] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.927] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.927] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.927] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.927] GetCurrentThreadId () returned 0x9b0 [0029.927] GetCurrentThreadId () returned 0x9b0 [0029.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.927] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.927] RtlWakeConditionVariable () returned 0x1 [0029.985] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.985] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0029.986] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.986] GetCurrentThreadId () returned 0x9b0 [0029.986] GetCurrentThreadId () returned 0x9b0 [0029.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.986] RtlWakeConditionVariable () returned 0x1 [0029.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.989] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.989] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0029.989] lstrcmpiW (lpString1="fi-FI", lpString2="Windows") returned -1 [0029.989] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0029.989] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0029.989] lstrcmpW (lpString1="fi-FI", lpString2="AppData") returned 1 [0029.989] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fi-FI", lpSrch="AppData") returned 0x0 [0029.989] lstrcmpiW (lpString1="C:\\Boot\\fi-FI", lpString2="C:\\Windows") returned -1 [0029.989] lstrlenW (lpString="C:\\Windows") returned 10 [0029.989] lstrcmpiW (lpString1="C:\\Boot\\fi-FI", lpString2="C:\\System Volume Information") returned -1 [0029.989] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.989] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.989] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.990] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.990] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.990] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.990] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.990] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.990] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.990] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.990] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.990] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.990] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.990] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0029.990] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0029.990] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0029.990] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.990] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0029.990] GetCurrentThreadId () returned 0x9b0 [0029.990] GetCurrentThreadId () returned 0x9b0 [0029.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0029.990] RtlWakeConditionVariable () returned 0x1 [0029.992] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0029.992] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0029.992] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0029.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0029.992] GetCurrentThreadId () returned 0x9b0 [0029.992] GetCurrentThreadId () returned 0x9b0 [0029.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0029.992] RtlWakeConditionVariable () returned 0x1 [0029.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0029.995] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0029.995] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0029.995] lstrcmpiW (lpString1="Fonts", lpString2="Windows") returned -1 [0029.995] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0029.995] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0029.995] lstrcmpW (lpString1="Fonts", lpString2="AppData") returned 1 [0029.995] StrStrW (lpFirst="\\\\?\\C:\\Boot\\Fonts", lpSrch="AppData") returned 0x0 [0029.995] lstrcmpiW (lpString1="C:\\Boot\\Fonts", lpString2="C:\\Windows") returned -1 [0029.995] lstrlenW (lpString="C:\\Windows") returned 10 [0029.995] lstrcmpiW (lpString1="C:\\Boot\\Fonts", lpString2="C:\\System Volume Information") returned -1 [0029.995] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0029.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0029.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0029.998] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0029.998] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0029.998] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0029.998] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.998] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.998] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0029.998] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0029.998] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0029.998] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0029.998] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0029.998] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.998] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.998] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0029.998] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="Windows") returned -1 [0029.998] lstrcmpW (lpString1="chs_boot.ttf", lpString2="32.EXE.exe") returned 1 [0029.998] StrStrW (lpFirst="chs_boot.ttf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0029.998] lstrcmpW (lpString1="chs_boot.ttf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0029.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0029.998] GetCurrentThreadId () returned 0x9b0 [0029.999] GetCurrentThreadId () returned 0x9b0 [0029.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0029.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0029.999] RtlWakeConditionVariable () returned 0x1 [0030.001] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0030.001] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x48, dwReserved1=0x260000, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0030.001] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="Windows") returned -1 [0030.001] lstrcmpW (lpString1="cht_boot.ttf", lpString2="32.EXE.exe") returned 1 [0030.001] StrStrW (lpFirst="cht_boot.ttf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.001] lstrcmpW (lpString1="cht_boot.ttf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e68 [0030.002] GetCurrentThreadId () returned 0x9b0 [0030.002] GetCurrentThreadId () returned 0x9b0 [0030.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.002] RtlWakeConditionVariable () returned 0x1 [0030.003] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e68 | out: hHeap=0x260000) returned 1 [0030.003] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x48, dwReserved1=0x260000, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0030.003] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="Windows") returned -1 [0030.003] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="32.EXE.exe") returned 1 [0030.004] StrStrW (lpFirst="jpn_boot.ttf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.004] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.004] GetCurrentThreadId () returned 0x9b0 [0030.004] GetCurrentThreadId () returned 0x9b0 [0030.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.004] RtlWakeConditionVariable () returned 0x1 [0030.005] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.005] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x48, dwReserved1=0x260000, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0030.005] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="Windows") returned -1 [0030.005] lstrcmpW (lpString1="kor_boot.ttf", lpString2="32.EXE.exe") returned 1 [0030.005] StrStrW (lpFirst="kor_boot.ttf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.005] lstrcmpW (lpString1="kor_boot.ttf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.005] GetCurrentThreadId () returned 0x9b0 [0030.005] GetCurrentThreadId () returned 0x9b0 [0030.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.005] RtlWakeConditionVariable () returned 0x1 [0030.006] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.006] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0030.006] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="Windows") returned -1 [0030.006] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="32.EXE.exe") returned 1 [0030.006] StrStrW (lpFirst="wgl4_boot.ttf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.007] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.007] GetCurrentThreadId () returned 0x9b0 [0030.007] GetCurrentThreadId () returned 0x9b0 [0030.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.007] RtlWakeConditionVariable () returned 0x1 [0030.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.008] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0030.008] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.008] GetCurrentThreadId () returned 0x9b0 [0030.008] GetCurrentThreadId () returned 0x9b0 [0030.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.008] RtlWakeConditionVariable () returned 0x1 [0030.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.009] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.012] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0030.012] lstrcmpiW (lpString1="fr-FR", lpString2="Windows") returned -1 [0030.012] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0030.012] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0030.012] lstrcmpW (lpString1="fr-FR", lpString2="AppData") returned 1 [0030.012] StrStrW (lpFirst="\\\\?\\C:\\Boot\\fr-FR", lpSrch="AppData") returned 0x0 [0030.012] lstrcmpiW (lpString1="C:\\Boot\\fr-FR", lpString2="C:\\Windows") returned -1 [0030.012] lstrlenW (lpString="C:\\Windows") returned 10 [0030.012] lstrcmpiW (lpString1="C:\\Boot\\fr-FR", lpString2="C:\\System Volume Information") returned -1 [0030.012] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.012] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.065] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.065] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.065] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.065] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.065] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.065] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.065] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.065] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.065] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.065] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.065] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.065] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.065] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.065] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.065] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.065] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.065] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.065] GetCurrentThreadId () returned 0x9b0 [0030.065] GetCurrentThreadId () returned 0x9b0 [0030.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.065] RtlWakeConditionVariable () returned 0x1 [0030.067] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.067] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.067] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.067] GetCurrentThreadId () returned 0x9b0 [0030.067] GetCurrentThreadId () returned 0x9b0 [0030.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.067] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.067] RtlWakeConditionVariable () returned 0x1 [0030.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.069] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.069] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0030.069] lstrcmpiW (lpString1="hu-HU", lpString2="Windows") returned -1 [0030.069] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0030.069] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0030.069] lstrcmpW (lpString1="hu-HU", lpString2="AppData") returned 1 [0030.069] StrStrW (lpFirst="\\\\?\\C:\\Boot\\hu-HU", lpSrch="AppData") returned 0x0 [0030.069] lstrcmpiW (lpString1="C:\\Boot\\hu-HU", lpString2="C:\\Windows") returned -1 [0030.069] lstrlenW (lpString="C:\\Windows") returned 10 [0030.069] lstrcmpiW (lpString1="C:\\Boot\\hu-HU", lpString2="C:\\System Volume Information") returned -1 [0030.069] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.070] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.070] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.070] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.070] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.070] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.070] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.070] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.070] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.070] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.070] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.070] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.070] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.070] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.070] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.070] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.070] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.070] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.070] GetCurrentThreadId () returned 0x9b0 [0030.070] GetCurrentThreadId () returned 0x9b0 [0030.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.070] RtlWakeConditionVariable () returned 0x1 [0030.071] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.071] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.071] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.072] GetCurrentThreadId () returned 0x9b0 [0030.072] GetCurrentThreadId () returned 0x9b0 [0030.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.072] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.072] RtlWakeConditionVariable () returned 0x1 [0030.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.074] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.074] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0030.074] lstrcmpiW (lpString1="it-IT", lpString2="Windows") returned -1 [0030.074] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0030.074] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0030.074] lstrcmpW (lpString1="it-IT", lpString2="AppData") returned 1 [0030.074] StrStrW (lpFirst="\\\\?\\C:\\Boot\\it-IT", lpSrch="AppData") returned 0x0 [0030.074] lstrcmpiW (lpString1="C:\\Boot\\it-IT", lpString2="C:\\Windows") returned -1 [0030.074] lstrlenW (lpString="C:\\Windows") returned 10 [0030.074] lstrcmpiW (lpString1="C:\\Boot\\it-IT", lpString2="C:\\System Volume Information") returned -1 [0030.074] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.074] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.077] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.077] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.077] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.077] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.077] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.077] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.077] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.077] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.077] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.077] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.077] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.077] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.078] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.078] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.078] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.078] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.078] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.078] GetCurrentThreadId () returned 0x9b0 [0030.078] GetCurrentThreadId () returned 0x9b0 [0030.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.078] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.078] RtlWakeConditionVariable () returned 0x1 [0030.079] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.079] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.079] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.079] GetCurrentThreadId () returned 0x9b0 [0030.079] GetCurrentThreadId () returned 0x9b0 [0030.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.079] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.079] RtlWakeConditionVariable () returned 0x1 [0030.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.081] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.081] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0030.081] lstrcmpiW (lpString1="ja-JP", lpString2="Windows") returned -1 [0030.081] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0030.081] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0030.081] lstrcmpW (lpString1="ja-JP", lpString2="AppData") returned 1 [0030.081] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ja-JP", lpSrch="AppData") returned 0x0 [0030.081] lstrcmpiW (lpString1="C:\\Boot\\ja-JP", lpString2="C:\\Windows") returned -1 [0030.082] lstrlenW (lpString="C:\\Windows") returned 10 [0030.082] lstrcmpiW (lpString1="C:\\Boot\\ja-JP", lpString2="C:\\System Volume Information") returned -1 [0030.082] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.082] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.084] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.084] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.084] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.084] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.084] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.084] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.085] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.085] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.085] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.085] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.085] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.085] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.085] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.085] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.085] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.085] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.085] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.085] GetCurrentThreadId () returned 0x9b0 [0030.085] GetCurrentThreadId () returned 0x9b0 [0030.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.085] RtlWakeConditionVariable () returned 0x1 [0030.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.087] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.087] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.087] GetCurrentThreadId () returned 0x9b0 [0030.087] GetCurrentThreadId () returned 0x9b0 [0030.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.087] RtlWakeConditionVariable () returned 0x1 [0030.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.089] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0030.089] lstrcmpiW (lpString1="ko-KR", lpString2="Windows") returned -1 [0030.089] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0030.089] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0030.089] lstrcmpW (lpString1="ko-KR", lpString2="AppData") returned 1 [0030.089] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ko-KR", lpSrch="AppData") returned 0x0 [0030.089] lstrcmpiW (lpString1="C:\\Boot\\ko-KR", lpString2="C:\\Windows") returned -1 [0030.089] lstrlenW (lpString="C:\\Windows") returned 10 [0030.089] lstrcmpiW (lpString1="C:\\Boot\\ko-KR", lpString2="C:\\System Volume Information") returned -1 [0030.089] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.098] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.098] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.098] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.098] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.098] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.098] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.098] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.098] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.098] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.098] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.098] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.098] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.098] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.098] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.099] GetCurrentThreadId () returned 0x9b0 [0030.099] GetCurrentThreadId () returned 0x9b0 [0030.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.099] RtlWakeConditionVariable () returned 0x1 [0030.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.100] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x48, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.100] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.100] GetCurrentThreadId () returned 0x9b0 [0030.100] GetCurrentThreadId () returned 0x9b0 [0030.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.100] RtlWakeConditionVariable () returned 0x1 [0030.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.102] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.102] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0030.102] lstrcmpiW (lpString1="memtest.exe", lpString2="Windows") returned -1 [0030.102] lstrcmpW (lpString1="memtest.exe", lpString2="32.EXE.exe") returned 1 [0030.102] StrStrW (lpFirst="memtest.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.102] lstrcmpW (lpString1="memtest.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.102] GetCurrentThreadId () returned 0x9b0 [0030.102] GetCurrentThreadId () returned 0x9b0 [0030.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.102] RtlWakeConditionVariable () returned 0x1 [0030.104] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.104] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0030.104] lstrcmpiW (lpString1="nb-NO", lpString2="Windows") returned -1 [0030.104] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0030.104] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0030.104] lstrcmpW (lpString1="nb-NO", lpString2="AppData") returned 1 [0030.104] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nb-NO", lpSrch="AppData") returned 0x0 [0030.104] lstrcmpiW (lpString1="C:\\Boot\\nb-NO", lpString2="C:\\Windows") returned -1 [0030.104] lstrlenW (lpString="C:\\Windows") returned 10 [0030.104] lstrcmpiW (lpString1="C:\\Boot\\nb-NO", lpString2="C:\\System Volume Information") returned -1 [0030.104] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.104] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.104] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.104] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.104] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.104] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.104] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.104] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.104] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.104] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.105] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.105] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.105] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.105] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.105] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.105] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.105] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.105] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.105] GetCurrentThreadId () returned 0x9b0 [0030.105] GetCurrentThreadId () returned 0x9b0 [0030.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.105] RtlWakeConditionVariable () returned 0x1 [0030.107] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.107] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.107] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.107] GetCurrentThreadId () returned 0x9b0 [0030.107] GetCurrentThreadId () returned 0x9b0 [0030.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.107] RtlWakeConditionVariable () returned 0x1 [0030.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.109] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.109] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0030.109] lstrcmpiW (lpString1="nl-NL", lpString2="Windows") returned -1 [0030.109] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0030.109] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0030.109] lstrcmpW (lpString1="nl-NL", lpString2="AppData") returned 1 [0030.109] StrStrW (lpFirst="\\\\?\\C:\\Boot\\nl-NL", lpSrch="AppData") returned 0x0 [0030.109] lstrcmpiW (lpString1="C:\\Boot\\nl-NL", lpString2="C:\\Windows") returned -1 [0030.109] lstrlenW (lpString="C:\\Windows") returned 10 [0030.109] lstrcmpiW (lpString1="C:\\Boot\\nl-NL", lpString2="C:\\System Volume Information") returned -1 [0030.109] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.110] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.110] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.110] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.110] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.110] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.110] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.110] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.110] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.110] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.110] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.110] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.110] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.110] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.110] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.110] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.110] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.110] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.110] GetCurrentThreadId () returned 0x9b0 [0030.110] GetCurrentThreadId () returned 0x9b0 [0030.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.110] RtlWakeConditionVariable () returned 0x1 [0030.111] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.111] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.112] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.112] GetCurrentThreadId () returned 0x9b0 [0030.112] GetCurrentThreadId () returned 0x9b0 [0030.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.112] RtlWakeConditionVariable () returned 0x1 [0030.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.116] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.116] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0030.116] lstrcmpiW (lpString1="pl-PL", lpString2="Windows") returned -1 [0030.116] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0030.116] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0030.116] lstrcmpW (lpString1="pl-PL", lpString2="AppData") returned 1 [0030.116] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pl-PL", lpSrch="AppData") returned 0x0 [0030.116] lstrcmpiW (lpString1="C:\\Boot\\pl-PL", lpString2="C:\\Windows") returned -1 [0030.116] lstrlenW (lpString="C:\\Windows") returned 10 [0030.116] lstrcmpiW (lpString1="C:\\Boot\\pl-PL", lpString2="C:\\System Volume Information") returned -1 [0030.116] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.116] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.117] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.117] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.117] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.117] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.117] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.117] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.117] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.117] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.117] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.117] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.117] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.117] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.117] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.117] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.117] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.117] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.117] GetCurrentThreadId () returned 0x9b0 [0030.117] GetCurrentThreadId () returned 0x9b0 [0030.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.117] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.117] RtlWakeConditionVariable () returned 0x1 [0030.119] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.119] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.119] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.119] GetCurrentThreadId () returned 0x9b0 [0030.119] GetCurrentThreadId () returned 0x9b0 [0030.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.119] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.119] RtlWakeConditionVariable () returned 0x1 [0030.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.121] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.121] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0030.121] lstrcmpiW (lpString1="pt-BR", lpString2="Windows") returned -1 [0030.122] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0030.122] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0030.122] lstrcmpW (lpString1="pt-BR", lpString2="AppData") returned 1 [0030.122] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-BR", lpSrch="AppData") returned 0x0 [0030.122] lstrcmpiW (lpString1="C:\\Boot\\pt-BR", lpString2="C:\\Windows") returned -1 [0030.122] lstrlenW (lpString="C:\\Windows") returned 10 [0030.122] lstrcmpiW (lpString1="C:\\Boot\\pt-BR", lpString2="C:\\System Volume Information") returned -1 [0030.122] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.122] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.122] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.122] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.122] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.122] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.122] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.122] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.122] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.122] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.122] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.122] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.122] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.122] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.122] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.122] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.123] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.123] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.123] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.123] GetCurrentThreadId () returned 0x9b0 [0030.123] GetCurrentThreadId () returned 0x9b0 [0030.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.123] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.123] RtlWakeConditionVariable () returned 0x1 [0030.124] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.124] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.124] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.124] GetCurrentThreadId () returned 0x9b0 [0030.124] GetCurrentThreadId () returned 0x9b0 [0030.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.124] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.124] RtlWakeConditionVariable () returned 0x1 [0030.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.126] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.126] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0030.126] lstrcmpiW (lpString1="pt-PT", lpString2="Windows") returned -1 [0030.126] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0030.126] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0030.126] lstrcmpW (lpString1="pt-PT", lpString2="AppData") returned 1 [0030.126] StrStrW (lpFirst="\\\\?\\C:\\Boot\\pt-PT", lpSrch="AppData") returned 0x0 [0030.126] lstrcmpiW (lpString1="C:\\Boot\\pt-PT", lpString2="C:\\Windows") returned -1 [0030.127] lstrlenW (lpString="C:\\Windows") returned 10 [0030.127] lstrcmpiW (lpString1="C:\\Boot\\pt-PT", lpString2="C:\\System Volume Information") returned -1 [0030.127] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.127] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.127] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.127] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.127] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.127] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.127] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.127] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.127] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.127] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.127] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.127] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.127] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.127] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.127] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.127] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.127] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.127] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.127] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.127] GetCurrentThreadId () returned 0x9b0 [0030.127] GetCurrentThreadId () returned 0x9b0 [0030.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.128] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.128] RtlWakeConditionVariable () returned 0x1 [0030.129] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.129] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.129] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.129] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.129] GetCurrentThreadId () returned 0x9b0 [0030.129] GetCurrentThreadId () returned 0x9b0 [0030.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.130] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.130] RtlWakeConditionVariable () returned 0x1 [0030.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.131] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.131] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0030.132] lstrcmpiW (lpString1="ru-RU", lpString2="Windows") returned -1 [0030.132] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0030.132] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0030.132] lstrcmpW (lpString1="ru-RU", lpString2="AppData") returned 1 [0030.132] StrStrW (lpFirst="\\\\?\\C:\\Boot\\ru-RU", lpSrch="AppData") returned 0x0 [0030.132] lstrcmpiW (lpString1="C:\\Boot\\ru-RU", lpString2="C:\\Windows") returned -1 [0030.132] lstrlenW (lpString="C:\\Windows") returned 10 [0030.132] lstrcmpiW (lpString1="C:\\Boot\\ru-RU", lpString2="C:\\System Volume Information") returned -1 [0030.132] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.132] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.132] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.132] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.132] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.132] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.132] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.132] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.132] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.132] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.132] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.132] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.132] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.132] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.132] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.133] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.133] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.133] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.133] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.133] GetCurrentThreadId () returned 0x9b0 [0030.133] GetCurrentThreadId () returned 0x9b0 [0030.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.133] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.133] RtlWakeConditionVariable () returned 0x1 [0030.135] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.135] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.135] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.135] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.136] GetCurrentThreadId () returned 0x9b0 [0030.136] GetCurrentThreadId () returned 0x9b0 [0030.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.136] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.136] RtlWakeConditionVariable () returned 0x1 [0030.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.138] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.138] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0030.138] lstrcmpiW (lpString1="sv-SE", lpString2="Windows") returned -1 [0030.138] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0030.138] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0030.138] lstrcmpW (lpString1="sv-SE", lpString2="AppData") returned 1 [0030.138] StrStrW (lpFirst="\\\\?\\C:\\Boot\\sv-SE", lpSrch="AppData") returned 0x0 [0030.138] lstrcmpiW (lpString1="C:\\Boot\\sv-SE", lpString2="C:\\Windows") returned -1 [0030.138] lstrlenW (lpString="C:\\Windows") returned 10 [0030.138] lstrcmpiW (lpString1="C:\\Boot\\sv-SE", lpString2="C:\\System Volume Information") returned -1 [0030.138] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.138] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.138] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.138] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.138] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.138] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.138] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.138] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.138] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.139] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.139] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.139] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.139] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.139] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.139] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.139] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.139] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.139] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.139] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.139] GetCurrentThreadId () returned 0x9b0 [0030.139] GetCurrentThreadId () returned 0x9b0 [0030.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.139] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.139] RtlWakeConditionVariable () returned 0x1 [0030.141] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.141] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.141] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.141] GetCurrentThreadId () returned 0x9b0 [0030.141] GetCurrentThreadId () returned 0x9b0 [0030.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.141] RtlWakeConditionVariable () returned 0x1 [0030.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.143] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.143] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0030.143] lstrcmpiW (lpString1="tr-TR", lpString2="Windows") returned -1 [0030.143] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0030.143] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0030.143] lstrcmpW (lpString1="tr-TR", lpString2="AppData") returned 1 [0030.143] StrStrW (lpFirst="\\\\?\\C:\\Boot\\tr-TR", lpSrch="AppData") returned 0x0 [0030.143] lstrcmpiW (lpString1="C:\\Boot\\tr-TR", lpString2="C:\\Windows") returned -1 [0030.143] lstrlenW (lpString="C:\\Windows") returned 10 [0030.144] lstrcmpiW (lpString1="C:\\Boot\\tr-TR", lpString2="C:\\System Volume Information") returned -1 [0030.144] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.144] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.144] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.144] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.144] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.144] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.144] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.144] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.144] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.144] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.144] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.144] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.144] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.144] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.144] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.144] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.144] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.144] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.144] GetCurrentThreadId () returned 0x9b0 [0030.144] GetCurrentThreadId () returned 0x9b0 [0030.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.145] RtlWakeConditionVariable () returned 0x1 [0030.146] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.146] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.146] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.146] GetCurrentThreadId () returned 0x9b0 [0030.146] GetCurrentThreadId () returned 0x9b0 [0030.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.146] RtlWakeConditionVariable () returned 0x1 [0030.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.149] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.149] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0030.149] lstrcmpiW (lpString1="zh-CN", lpString2="Windows") returned 1 [0030.149] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0030.149] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0030.149] lstrcmpW (lpString1="zh-CN", lpString2="AppData") returned 1 [0030.149] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-CN", lpSrch="AppData") returned 0x0 [0030.149] lstrcmpiW (lpString1="C:\\Boot\\zh-CN", lpString2="C:\\Windows") returned -1 [0030.149] lstrlenW (lpString="C:\\Windows") returned 10 [0030.149] lstrcmpiW (lpString1="C:\\Boot\\zh-CN", lpString2="C:\\System Volume Information") returned -1 [0030.150] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.150] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.150] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.150] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.150] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.150] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.150] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.150] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.150] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.150] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.150] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.150] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.150] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.150] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.150] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.150] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.150] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.150] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.150] GetCurrentThreadId () returned 0x9b0 [0030.150] GetCurrentThreadId () returned 0x9b0 [0030.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.151] RtlWakeConditionVariable () returned 0x1 [0030.152] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.152] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.152] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.152] GetCurrentThreadId () returned 0x9b0 [0030.152] GetCurrentThreadId () returned 0x9b0 [0030.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.152] RtlWakeConditionVariable () returned 0x1 [0030.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.154] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.155] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0030.155] lstrcmpiW (lpString1="zh-HK", lpString2="Windows") returned 1 [0030.155] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0030.155] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0030.155] lstrcmpW (lpString1="zh-HK", lpString2="AppData") returned 1 [0030.155] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-HK", lpSrch="AppData") returned 0x0 [0030.155] lstrcmpiW (lpString1="C:\\Boot\\zh-HK", lpString2="C:\\Windows") returned -1 [0030.155] lstrlenW (lpString="C:\\Windows") returned 10 [0030.155] lstrcmpiW (lpString1="C:\\Boot\\zh-HK", lpString2="C:\\System Volume Information") returned -1 [0030.155] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.155] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.155] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.155] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.155] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.155] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.155] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.155] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.156] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.156] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.156] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.156] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.156] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.156] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.156] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.156] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.156] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.156] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.156] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.156] GetCurrentThreadId () returned 0x9b0 [0030.156] GetCurrentThreadId () returned 0x9b0 [0030.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.156] RtlWakeConditionVariable () returned 0x1 [0030.157] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.157] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.157] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.157] GetCurrentThreadId () returned 0x9b0 [0030.157] GetCurrentThreadId () returned 0x9b0 [0030.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.157] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.157] RtlWakeConditionVariable () returned 0x1 [0030.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.159] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.159] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0030.159] lstrcmpiW (lpString1="zh-TW", lpString2="Windows") returned 1 [0030.159] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0030.160] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0030.160] lstrcmpW (lpString1="zh-TW", lpString2="AppData") returned 1 [0030.160] StrStrW (lpFirst="\\\\?\\C:\\Boot\\zh-TW", lpSrch="AppData") returned 0x0 [0030.160] lstrcmpiW (lpString1="C:\\Boot\\zh-TW", lpString2="C:\\Windows") returned -1 [0030.160] lstrlenW (lpString="C:\\Windows") returned 10 [0030.160] lstrcmpiW (lpString1="C:\\Boot\\zh-TW", lpString2="C:\\System Volume Information") returned -1 [0030.160] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.160] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.160] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.160] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.160] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.160] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.160] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.160] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.160] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.160] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.160] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.160] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.160] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.160] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0030.160] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0030.160] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="32.EXE.exe") returned 1 [0030.160] StrStrW (lpFirst="bootmgr.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.161] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.161] GetCurrentThreadId () returned 0x9b0 [0030.161] GetCurrentThreadId () returned 0x9b0 [0030.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.161] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d0c8 [0030.161] RtlWakeConditionVariable () returned 0x1 [0030.162] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.162] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x38, dwReserved1=0x260000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0030.162] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0030.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.162] GetCurrentThreadId () returned 0x9b0 [0030.162] GetCurrentThreadId () returned 0x9b0 [0030.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.162] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.162] RtlWakeConditionVariable () returned 0x1 [0030.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.164] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b4238 | out: hHeap=0x260000) returned 1 [0030.164] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0030.164] FindClose (in: hFindFile=0x27bab0 | out: hFindFile=0x27bab0) returned 1 [0030.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27e0f0 [0030.164] GetCurrentThreadId () returned 0x9b0 [0030.164] GetCurrentThreadId () returned 0x9b0 [0030.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.164] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x27d070 [0030.164] RtlWakeConditionVariable () returned 0x1 [0030.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.166] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d80 | out: hHeap=0x260000) returned 1 [0030.166] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0030.166] lstrcmpiW (lpString1="bootmgr", lpString2="Windows") returned -1 [0030.166] lstrcmpW (lpString1="bootmgr", lpString2="32.EXE.exe") returned 1 [0030.166] StrStrW (lpFirst="bootmgr", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.167] lstrcmpW (lpString1="bootmgr", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27ef70 [0030.167] GetCurrentThreadId () returned 0x9b0 [0030.167] GetCurrentThreadId () returned 0x9b0 [0030.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20) returned 0x27efe8 [0030.167] RtlWakeConditionVariable () returned 0x1 [0030.168] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ef70 | out: hHeap=0x260000) returned 1 [0030.168] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0030.168] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="Windows") returned -1 [0030.168] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="32.EXE.exe") returned 1 [0030.168] StrStrW (lpFirst="BOOTSECT.BAK", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.168] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.168] GetCurrentThreadId () returned 0x9b0 [0030.168] GetCurrentThreadId () returned 0x9b0 [0030.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.168] RtlWakeConditionVariable () returned 0x1 [0030.170] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.170] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0030.170] lstrcmpiW (lpString1="Config.Msi", lpString2="Windows") returned -1 [0030.170] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0030.170] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0030.170] lstrcmpW (lpString1="Config.Msi", lpString2="AppData") returned 1 [0030.170] StrStrW (lpFirst="\\\\?\\C:\\Config.Msi", lpSrch="AppData") returned 0x0 [0030.170] lstrcmpiW (lpString1="C:\\Config.Msi", lpString2="C:\\Windows") returned -1 [0030.170] lstrlenW (lpString="C:\\Windows") returned 10 [0030.170] lstrcmpiW (lpString1="C:\\Config.Msi", lpString2="C:\\System Volume Information") returned -1 [0030.170] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a1d80 [0030.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27bab0 [0030.171] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.171] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.171] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.171] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.171] GetCurrentThreadId () returned 0x9b0 [0030.171] GetCurrentThreadId () returned 0x9b0 [0030.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.171] RtlWakeConditionVariable () returned 0x1 [0030.173] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.173] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.173] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.173] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.173] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.173] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.173] GetCurrentThreadId () returned 0x9b0 [0030.173] GetCurrentThreadId () returned 0x9b0 [0030.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.173] RtlWakeConditionVariable () returned 0x1 [0030.174] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.174] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 0 [0030.174] FindClose (in: hFindFile=0x27bab0 | out: hFindFile=0x27bab0) returned 1 [0030.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27e0f0 [0030.174] GetCurrentThreadId () returned 0x9b0 [0030.174] GetCurrentThreadId () returned 0x9b0 [0030.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x27d070 [0030.174] RtlWakeConditionVariable () returned 0x1 [0030.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e0f0 | out: hHeap=0x260000) returned 1 [0030.176] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d80 | out: hHeap=0x260000) returned 1 [0030.176] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0030.176] lstrcmpiW (lpString1="Documents and Settings", lpString2="Windows") returned -1 [0030.176] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0030.177] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0030.177] lstrcmpW (lpString1="Documents and Settings", lpString2="AppData") returned 1 [0030.177] StrStrW (lpFirst="\\\\?\\C:\\Documents and Settings", lpSrch="AppData") returned 0x0 [0030.177] lstrcmpiW (lpString1="C:\\Documents and Settings", lpString2="C:\\Windows") returned -1 [0030.177] lstrlenW (lpString="C:\\Windows") returned 10 [0030.177] lstrcmpiW (lpString1="C:\\Documents and Settings", lpString2="C:\\System Volume Information") returned -1 [0030.177] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a1d80 [0030.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="ﲤɠꎨ疖Ѐ")) returned 0xffffffff [0030.177] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1d80 | out: hHeap=0x260000) returned 1 [0030.177] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0030.177] lstrcmpiW (lpString1="hiberfil.sys", lpString2="Windows") returned -1 [0030.177] lstrcmpW (lpString1="hiberfil.sys", lpString2="32.EXE.exe") returned 1 [0030.177] StrStrW (lpFirst="hiberfil.sys", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.177] lstrcmpW (lpString1="hiberfil.sys", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.177] GetCurrentThreadId () returned 0x9b0 [0030.177] GetCurrentThreadId () returned 0x9b0 [0030.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.177] RtlWakeConditionVariable () returned 0x1 [0030.178] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.179] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0030.179] lstrcmpiW (lpString1="MSOCache", lpString2="Windows") returned -1 [0030.179] lstrcmpW (lpString1="MSOCache", lpString2=".") returned 1 [0030.179] lstrcmpW (lpString1="MSOCache", lpString2="..") returned 1 [0030.179] lstrcmpW (lpString1="MSOCache", lpString2="AppData") returned 1 [0030.179] StrStrW (lpFirst="\\\\?\\C:\\MSOCache", lpSrch="AppData") returned 0x0 [0030.179] lstrcmpiW (lpString1="C:\\MSOCache", lpString2="C:\\Windows") returned -1 [0030.179] lstrlenW (lpString="C:\\Windows") returned 10 [0030.179] lstrcmpiW (lpString1="C:\\MSOCache", lpString2="C:\\System Volume Information") returned -1 [0030.179] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a1d80 [0030.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27bab0 [0030.179] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.179] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.179] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.179] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.179] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.179] GetCurrentThreadId () returned 0x9b0 [0030.179] GetCurrentThreadId () returned 0x9b0 [0030.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0030.179] RtlWakeConditionVariable () returned 0x1 [0030.181] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.181] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.181] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.181] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.181] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.181] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.181] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.181] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.181] GetCurrentThreadId () returned 0x9b0 [0030.181] GetCurrentThreadId () returned 0x9b0 [0030.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0030.181] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0030.181] RtlWakeConditionVariable () returned 0x1 [0030.182] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2a1640 | out: hHeap=0x260000) returned 1 [0030.182] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0030.182] lstrcmpiW (lpString1="All Users", lpString2="Windows") returned -1 [0030.182] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0030.182] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0030.182] lstrcmpW (lpString1="All Users", lpString2="AppData") returned -1 [0030.182] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users", lpSrch="AppData") returned 0x0 [0030.182] lstrcmpiW (lpString1="C:\\MSOCache\\All Users", lpString2="C:\\Windows") returned -1 [0030.182] lstrlenW (lpString="C:\\Windows") returned 10 [0030.182] lstrcmpiW (lpString1="C:\\MSOCache\\All Users", lpString2="C:\\System Volume Information") returned -1 [0030.182] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0030.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0030.187] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.187] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.187] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.187] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.187] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.187] GetCurrentThreadId () returned 0x9b0 [0030.187] GetCurrentThreadId () returned 0x9b0 [0030.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.187] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277dd8 [0030.187] RtlWakeConditionVariable () returned 0x1 [0030.188] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.188] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.191] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.191] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.191] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.191] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.191] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277e20 [0030.192] GetCurrentThreadId () returned 0x9b0 [0030.192] GetCurrentThreadId () returned 0x9b0 [0030.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x40) returned 0x277eb0 [0030.192] RtlWakeConditionVariable () returned 0x1 [0030.193] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x277e20 | out: hHeap=0x260000) returned 1 [0030.193] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0030.193] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0030.193] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0030.193] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0030.193] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0030.193] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0030.193] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0030.193] lstrlenW (lpString="C:\\Windows") returned 10 [0030.193] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0030.193] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0030.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0030.195] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.195] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.195] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.195] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.195] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d070 [0030.195] GetCurrentThreadId () returned 0x9b0 [0030.195] GetCurrentThreadId () returned 0x9b0 [0030.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.195] RtlWakeConditionVariable () returned 0x1 [0030.196] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.196] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.196] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.197] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.197] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.197] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.197] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.197] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d070 [0030.197] GetCurrentThreadId () returned 0x9b0 [0030.197] GetCurrentThreadId () returned 0x9b0 [0030.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.197] RtlWakeConditionVariable () returned 0x1 [0030.198] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.198] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0030.198] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="Windows") returned -1 [0030.198] lstrcmpW (lpString1="ExcelLR.cab", lpString2="32.EXE.exe") returned 1 [0030.198] StrStrW (lpFirst="ExcelLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.198] lstrcmpW (lpString1="ExcelLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0030.198] GetCurrentThreadId () returned 0x9b0 [0030.198] GetCurrentThreadId () returned 0x9b0 [0030.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b2d90 [0030.198] RtlWakeConditionVariable () returned 0x1 [0030.207] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.207] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0030.207] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="Windows") returned -1 [0030.208] lstrcmpW (lpString1="ExcelMUI.msi", lpString2="32.EXE.exe") returned 1 [0030.208] StrStrW (lpFirst="ExcelMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.208] lstrcmpW (lpString1="ExcelMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0030.217] GetCurrentThreadId () returned 0x9b0 [0030.217] GetCurrentThreadId () returned 0x9b0 [0030.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3970 [0030.218] RtlWakeConditionVariable () returned 0x1 [0030.224] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.224] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0030.283] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="Windows") returned -1 [0030.283] lstrcmpW (lpString1="ExcelMUI.xml", lpString2="32.EXE.exe") returned 1 [0030.283] StrStrW (lpFirst="ExcelMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.283] lstrcmpW (lpString1="ExcelMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0030.283] GetCurrentThreadId () returned 0x9b0 [0030.283] GetCurrentThreadId () returned 0x9b0 [0030.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3bf8 [0030.283] RtlWakeConditionVariable () returned 0x1 [0030.293] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.293] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0030.296] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0030.296] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0030.296] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.296] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0030.296] GetCurrentThreadId () returned 0x9b0 [0030.296] GetCurrentThreadId () returned 0x9b0 [0030.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3bf8 [0030.297] RtlWakeConditionVariable () returned 0x1 [0030.305] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.305] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0030.309] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0030.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27d070 [0030.310] GetCurrentThreadId () returned 0x9b0 [0030.310] GetCurrentThreadId () returned 0x9b0 [0030.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.310] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3bf8 [0030.310] RtlWakeConditionVariable () returned 0x1 [0030.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.312] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0030.312] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0030.312] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0030.312] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0030.312] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0030.312] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0030.312] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0030.312] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0030.312] lstrlenW (lpString="C:\\Windows") returned 10 [0030.312] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0030.312] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0030.312] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0030.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0030.717] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0030.717] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.717] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0030.717] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.717] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d070 [0030.717] GetCurrentThreadId () returned 0x9b0 [0030.717] GetCurrentThreadId () returned 0x9b0 [0030.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.717] RtlWakeConditionVariable () returned 0x1 [0030.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.719] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0030.719] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0030.719] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.719] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.719] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0030.719] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.719] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d070 [0030.719] GetCurrentThreadId () returned 0x9b0 [0030.719] GetCurrentThreadId () returned 0x9b0 [0030.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d108 [0030.719] RtlWakeConditionVariable () returned 0x1 [0030.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.720] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0030.720] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="Windows") returned -1 [0030.720] lstrcmpW (lpString1="PowerPointMUI.msi", lpString2="32.EXE.exe") returned 1 [0030.720] StrStrW (lpFirst="PowerPointMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.720] lstrcmpW (lpString1="PowerPointMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x27d070 [0030.720] GetCurrentThreadId () returned 0x9b0 [0030.720] GetCurrentThreadId () returned 0x9b0 [0030.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3e10 [0030.720] RtlWakeConditionVariable () returned 0x1 [0030.729] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d070 | out: hHeap=0x260000) returned 1 [0030.729] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0030.729] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="Windows") returned -1 [0030.729] lstrcmpW (lpString1="PowerPointMUI.xml", lpString2="32.EXE.exe") returned 1 [0030.729] StrStrW (lpFirst="PowerPointMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.729] lstrcmpW (lpString1="PowerPointMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b40b8 [0030.730] GetCurrentThreadId () returned 0x9b0 [0030.730] GetCurrentThreadId () returned 0x9b0 [0030.730] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.788] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x27d070 [0030.788] RtlWakeConditionVariable () returned 0x1 [0030.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40b8 | out: hHeap=0x260000) returned 1 [0030.802] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0030.802] lstrcmpiW (lpString1="PptLR.cab", lpString2="Windows") returned -1 [0030.802] lstrcmpW (lpString1="PptLR.cab", lpString2="32.EXE.exe") returned 1 [0030.802] StrStrW (lpFirst="PptLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.802] lstrcmpW (lpString1="PptLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b40b8 [0030.802] GetCurrentThreadId () returned 0x9b0 [0030.802] GetCurrentThreadId () returned 0x9b0 [0030.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.802] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x27d070 [0030.802] RtlWakeConditionVariable () returned 0x1 [0030.997] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40b8 | out: hHeap=0x260000) returned 1 [0030.997] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0030.997] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0030.998] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0030.998] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0030.998] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3b50 [0030.998] GetCurrentThreadId () returned 0x9b0 [0030.998] GetCurrentThreadId () returned 0x9b0 [0030.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0030.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3bf8 [0030.998] RtlWakeConditionVariable () returned 0x1 [0031.008] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.013] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0031.014] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0031.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3b50 [0031.014] GetCurrentThreadId () returned 0x9b0 [0031.014] GetCurrentThreadId () returned 0x9b0 [0031.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0031.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3c18 [0031.014] RtlWakeConditionVariable () returned 0x1 [0031.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3b50 | out: hHeap=0x260000) returned 1 [0031.017] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0031.017] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0031.017] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0031.017] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0031.017] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0031.017] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0031.017] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0031.017] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0031.017] lstrlenW (lpString="C:\\Windows") returned 10 [0031.017] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0031.017] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.017] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0031.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0031.610] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.610] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.610] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.610] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.611] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0031.611] GetCurrentThreadId () returned 0x9b0 [0031.611] GetCurrentThreadId () returned 0x9b0 [0031.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0031.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3b50 [0031.611] RtlWakeConditionVariable () returned 0x1 [0031.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.611] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.611] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.611] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.611] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.611] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.611] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.611] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0031.611] GetCurrentThreadId () returned 0x9b0 [0031.611] GetCurrentThreadId () returned 0x9b0 [0031.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0031.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3be8 [0031.611] RtlWakeConditionVariable () returned 0x1 [0031.611] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.611] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0031.612] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="Windows") returned -1 [0031.612] lstrcmpW (lpString1="PublisherMUI.msi", lpString2="32.EXE.exe") returned 1 [0031.612] StrStrW (lpFirst="PublisherMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.612] lstrcmpW (lpString1="PublisherMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3c80 [0031.612] GetCurrentThreadId () returned 0x9b0 [0031.612] GetCurrentThreadId () returned 0x9b0 [0031.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0031.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3e10 [0031.612] RtlWakeConditionVariable () returned 0x27e800 [0031.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c80 | out: hHeap=0x260000) returned 1 [0031.612] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0031.612] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="Windows") returned -1 [0031.612] lstrcmpW (lpString1="PublisherMUI.xml", lpString2="32.EXE.exe") returned 1 [0031.612] StrStrW (lpFirst="PublisherMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.612] lstrcmpW (lpString1="PublisherMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3c80 [0031.612] GetCurrentThreadId () returned 0x9b0 [0031.612] GetCurrentThreadId () returned 0x9b0 [0031.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0031.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2b3ec8 [0031.612] RtlWakeConditionVariable () returned 0x27e800 [0031.612] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c80 | out: hHeap=0x260000) returned 1 [0031.612] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0031.612] lstrcmpiW (lpString1="PubLR.cab", lpString2="Windows") returned -1 [0031.613] lstrcmpW (lpString1="PubLR.cab", lpString2="32.EXE.exe") returned 1 [0031.613] StrStrW (lpFirst="PubLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.613] lstrcmpW (lpString1="PubLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3c80 [0031.613] GetCurrentThreadId () returned 0x9b0 [0031.613] GetCurrentThreadId () returned 0x9b0 [0031.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0031.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3f80 [0031.613] RtlWakeConditionVariable () returned 0x27e800 [0031.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c80 | out: hHeap=0x260000) returned 1 [0031.613] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0031.613] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0031.613] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0031.613] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.613] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b3c80 [0031.613] GetCurrentThreadId () returned 0x9b0 [0031.613] GetCurrentThreadId () returned 0x9b0 [0031.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0031.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2b4028 [0031.613] RtlWakeConditionVariable () returned 0x27e800 [0031.613] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b3c80 | out: hHeap=0x260000) returned 1 [0031.613] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0031.613] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0031.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b40d0 [0031.614] GetCurrentThreadId () returned 0x9b0 [0031.615] GetCurrentThreadId () returned 0x9b0 [0031.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1720 [0031.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3c80 [0031.615] RtlWakeConditionVariable () returned 0x27e800 [0031.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2b40d0 | out: hHeap=0x260000) returned 1 [0031.615] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0031.615] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0031.615] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0031.615] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0031.615] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0031.615] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0031.615] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0031.615] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0031.615] lstrlenW (lpString="C:\\Windows") returned 10 [0031.615] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0031.615] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0031.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0031.743] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.743] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.743] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.743] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.743] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0031.743] GetCurrentThreadId () returned 0x9b0 [0031.743] GetCurrentThreadId () returned 0x9b0 [0031.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0031.743] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2d5308 [0031.743] RtlWakeConditionVariable () returned 0x27e800 [0031.743] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.743] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.744] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.744] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.744] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.744] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.744] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.744] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x27d118 [0031.744] GetCurrentThreadId () returned 0x9b0 [0031.744] GetCurrentThreadId () returned 0x9b0 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2b3b50 [0031.744] RtlWakeConditionVariable () returned 0x27e800 [0031.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27d118 | out: hHeap=0x260000) returned 1 [0031.744] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0031.744] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="Windows") returned -1 [0031.744] lstrcmpW (lpString1="OutlkLR.cab", lpString2="32.EXE.exe") returned 1 [0031.744] StrStrW (lpFirst="OutlkLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.744] lstrcmpW (lpString1="OutlkLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5628 [0031.744] GetCurrentThreadId () returned 0x9b0 [0031.744] GetCurrentThreadId () returned 0x9b0 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d56d0 [0031.744] RtlWakeConditionVariable () returned 0x27e800 [0031.744] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5628 | out: hHeap=0x260000) returned 1 [0031.744] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0031.744] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="Windows") returned -1 [0031.744] lstrcmpW (lpString1="OutlookMUI.msi", lpString2="32.EXE.exe") returned 1 [0031.744] StrStrW (lpFirst="OutlookMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.744] lstrcmpW (lpString1="OutlookMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.744] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5778 [0031.744] GetCurrentThreadId () returned 0x9b0 [0031.745] GetCurrentThreadId () returned 0x9b0 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5830 [0031.745] RtlWakeConditionVariable () returned 0x27e800 [0031.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5778 | out: hHeap=0x260000) returned 1 [0031.745] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0031.745] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="Windows") returned -1 [0031.745] lstrcmpW (lpString1="OutlookMUI.xml", lpString2="32.EXE.exe") returned 1 [0031.745] StrStrW (lpFirst="OutlookMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.745] lstrcmpW (lpString1="OutlookMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5778 [0031.745] GetCurrentThreadId () returned 0x9b0 [0031.745] GetCurrentThreadId () returned 0x9b0 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1758 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d58e8 [0031.745] RtlWakeConditionVariable () returned 0x27e800 [0031.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5778 | out: hHeap=0x260000) returned 1 [0031.745] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0031.745] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0031.745] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0031.745] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.745] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5628 [0031.745] GetCurrentThreadId () returned 0x9b0 [0031.745] GetCurrentThreadId () returned 0x9b0 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1790 [0031.745] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5778 [0031.745] RtlWakeConditionVariable () returned 0x27e800 [0031.745] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5628 | out: hHeap=0x260000) returned 1 [0031.745] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0031.745] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0031.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d59a0 [0031.747] GetCurrentThreadId () returned 0x9b0 [0031.747] GetCurrentThreadId () returned 0x9b0 [0031.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a17c8 [0031.747] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5a68 [0031.747] RtlWakeConditionVariable () returned 0x27e800 [0031.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d59a0 | out: hHeap=0x260000) returned 1 [0031.747] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0031.748] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0031.748] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0031.748] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0031.748] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0031.748] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0031.748] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0031.748] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0031.748] lstrlenW (lpString="C:\\Windows") returned 10 [0031.748] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0031.748] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.748] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0031.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0031.774] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.774] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.775] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.775] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.775] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0031.775] GetCurrentThreadId () returned 0x9b0 [0031.775] GetCurrentThreadId () returned 0x9b0 [0031.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0031.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0031.775] RtlWakeConditionVariable () returned 0x27e800 [0031.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0031.775] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.775] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.775] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.775] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.775] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.775] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.775] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0031.775] GetCurrentThreadId () returned 0x9b0 [0031.775] GetCurrentThreadId () returned 0x9b0 [0031.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1800 [0031.775] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0031.775] RtlWakeConditionVariable () returned 0x27e800 [0031.775] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0031.775] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0031.776] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0031.776] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0031.776] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.776] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d54f0 [0031.776] GetCurrentThreadId () returned 0x9b0 [0031.776] GetCurrentThreadId () returned 0x9b0 [0031.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1838 [0031.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5598 [0031.776] RtlWakeConditionVariable () returned 0x27e800 [0031.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.776] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x48, dwReserved1=0x260000, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0031.776] lstrcmpiW (lpString1="WordLR.cab", lpString2="Windows") returned 1 [0031.776] lstrcmpW (lpString1="WordLR.cab", lpString2="32.EXE.exe") returned 1 [0031.776] StrStrW (lpFirst="WordLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.776] lstrcmpW (lpString1="WordLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d54f0 [0031.776] GetCurrentThreadId () returned 0x9b0 [0031.776] GetCurrentThreadId () returned 0x9b0 [0031.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0031.776] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5b30 [0031.776] RtlWakeConditionVariable () returned 0x27e800 [0031.776] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.776] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0031.776] lstrcmpiW (lpString1="WordMUI.msi", lpString2="Windows") returned 1 [0031.776] lstrcmpW (lpString1="WordMUI.msi", lpString2="32.EXE.exe") returned 1 [0031.776] StrStrW (lpFirst="WordMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.777] lstrcmpW (lpString1="WordMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d54f0 [0031.777] GetCurrentThreadId () returned 0x9b0 [0031.777] GetCurrentThreadId () returned 0x9b0 [0031.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18a8 [0031.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5bd8 [0031.777] RtlWakeConditionVariable () returned 0x27e800 [0031.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.777] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x48, dwReserved1=0x260000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0031.777] lstrcmpiW (lpString1="WordMUI.xml", lpString2="Windows") returned 1 [0031.777] lstrcmpW (lpString1="WordMUI.xml", lpString2="32.EXE.exe") returned 1 [0031.777] StrStrW (lpFirst="WordMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.777] lstrcmpW (lpString1="WordMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d54f0 [0031.777] GetCurrentThreadId () returned 0x9b0 [0031.777] GetCurrentThreadId () returned 0x9b0 [0031.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0031.777] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d5c80 [0031.777] RtlWakeConditionVariable () returned 0x27e800 [0031.777] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.777] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x48, dwReserved1=0x260000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0031.777] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0031.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5d28 [0031.778] GetCurrentThreadId () returned 0x9b0 [0031.778] GetCurrentThreadId () returned 0x9b0 [0031.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1918 [0031.778] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5df0 [0031.778] RtlWakeConditionVariable () returned 0x27e800 [0031.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5d28 | out: hHeap=0x260000) returned 1 [0031.778] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0031.779] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0031.779] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0031.779] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0031.779] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0031.779] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0031.779] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0031.779] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0031.779] lstrlenW (lpString="C:\\Windows") returned 10 [0031.779] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0031.779] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0031.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0031.786] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.786] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.786] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.786] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.786] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0031.786] GetCurrentThreadId () returned 0x9b0 [0031.786] GetCurrentThreadId () returned 0x9b0 [0031.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1950 [0031.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295da8 [0031.786] RtlWakeConditionVariable () returned 0x27e800 [0031.786] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0031.786] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.786] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.786] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.786] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.787] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.787] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.787] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0031.787] GetCurrentThreadId () returned 0x9b0 [0031.787] GetCurrentThreadId () returned 0x9b0 [0031.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1988 [0031.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295e40 [0031.787] RtlWakeConditionVariable () returned 0x27e800 [0031.787] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0031.787] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0031.787] lstrcmpiW (lpString1="Proof.en", lpString2="Windows") returned -1 [0031.787] lstrcmpW (lpString1="Proof.en", lpString2=".") returned 1 [0031.787] lstrcmpW (lpString1="Proof.en", lpString2="..") returned 1 [0031.787] lstrcmpW (lpString1="Proof.en", lpString2="AppData") returned 1 [0031.787] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpSrch="AppData") returned 0x0 [0031.787] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpString2="C:\\Windows") returned -1 [0031.787] lstrlenW (lpString="C:\\Windows") returned 10 [0031.787] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpString2="C:\\System Volume Information") returned -1 [0031.787] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.787] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f0478 [0031.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5640 [0031.788] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.788] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.788] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.788] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.788] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.788] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.788] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.788] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.788] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.788] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.788] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.789] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.789] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0031.789] lstrcmpiW (lpString1="Proof.cab", lpString2="Windows") returned -1 [0031.789] lstrcmpW (lpString1="Proof.cab", lpString2="32.EXE.exe") returned 1 [0031.789] StrStrW (lpFirst="Proof.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.789] lstrcmpW (lpString1="Proof.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5d28 [0031.789] GetCurrentThreadId () returned 0x9b0 [0031.789] GetCurrentThreadId () returned 0x9b0 [0031.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19c0 [0031.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5eb8 [0031.789] RtlWakeConditionVariable () returned 0x27e800 [0031.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5d28 | out: hHeap=0x260000) returned 1 [0031.789] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0031.789] lstrcmpiW (lpString1="Proof.msi", lpString2="Windows") returned -1 [0031.789] lstrcmpW (lpString1="Proof.msi", lpString2="32.EXE.exe") returned 1 [0031.789] StrStrW (lpFirst="Proof.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.789] lstrcmpW (lpString1="Proof.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5d28 [0031.789] GetCurrentThreadId () returned 0x9b0 [0031.789] GetCurrentThreadId () returned 0x9b0 [0031.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19f8 [0031.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5f70 [0031.789] RtlWakeConditionVariable () returned 0x27e800 [0031.789] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5d28 | out: hHeap=0x260000) returned 1 [0031.789] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0031.789] lstrcmpiW (lpString1="Proof.xml", lpString2="Windows") returned -1 [0031.789] lstrcmpW (lpString1="Proof.xml", lpString2="32.EXE.exe") returned 1 [0031.789] StrStrW (lpFirst="Proof.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.790] lstrcmpW (lpString1="Proof.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5d28 [0031.790] GetCurrentThreadId () returned 0x9b0 [0031.790] GetCurrentThreadId () returned 0x9b0 [0031.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0031.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d6028 [0031.790] RtlWakeConditionVariable () returned 0x27e800 [0031.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5d28 | out: hHeap=0x260000) returned 1 [0031.790] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0031.790] FindClose (in: hFindFile=0x2d5640 | out: hFindFile=0x2d5640) returned 1 [0031.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2d60e0 [0031.790] GetCurrentThreadId () returned 0x9b0 [0031.790] GetCurrentThreadId () returned 0x9b0 [0031.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0031.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x298bd0 [0031.790] RtlWakeConditionVariable () returned 0x27e800 [0031.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d60e0 | out: hHeap=0x260000) returned 1 [0031.790] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0478 | out: hHeap=0x260000) returned 1 [0031.790] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0031.790] lstrcmpiW (lpString1="Proof.es", lpString2="Windows") returned -1 [0031.790] lstrcmpW (lpString1="Proof.es", lpString2=".") returned 1 [0031.790] lstrcmpW (lpString1="Proof.es", lpString2="..") returned 1 [0031.790] lstrcmpW (lpString1="Proof.es", lpString2="AppData") returned 1 [0031.790] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpSrch="AppData") returned 0x0 [0031.790] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpString2="C:\\Windows") returned -1 [0031.790] lstrlenW (lpString="C:\\Windows") returned 10 [0031.790] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpString2="C:\\System Volume Information") returned -1 [0031.791] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f0478 [0031.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5640 [0031.791] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.791] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.792] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.792] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.792] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.792] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.792] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.792] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.792] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.792] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.792] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.792] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.792] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0031.792] lstrcmpiW (lpString1="Proof.cab", lpString2="Windows") returned -1 [0031.792] lstrcmpW (lpString1="Proof.cab", lpString2="32.EXE.exe") returned 1 [0031.792] StrStrW (lpFirst="Proof.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.792] lstrcmpW (lpString1="Proof.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5d28 [0031.792] GetCurrentThreadId () returned 0x9b0 [0031.792] GetCurrentThreadId () returned 0x9b0 [0031.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1aa0 [0031.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d60e0 [0031.792] RtlWakeConditionVariable () returned 0x27e800 [0031.792] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5d28 | out: hHeap=0x260000) returned 1 [0031.792] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0031.792] lstrcmpiW (lpString1="Proof.msi", lpString2="Windows") returned -1 [0031.792] lstrcmpW (lpString1="Proof.msi", lpString2="32.EXE.exe") returned 1 [0031.792] StrStrW (lpFirst="Proof.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.792] lstrcmpW (lpString1="Proof.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d6198 [0031.792] GetCurrentThreadId () returned 0x9b0 [0031.793] GetCurrentThreadId () returned 0x9b0 [0031.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0031.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d5d28 [0031.793] RtlWakeConditionVariable () returned 0x27e800 [0031.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6198 | out: hHeap=0x260000) returned 1 [0031.793] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0031.793] lstrcmpiW (lpString1="Proof.xml", lpString2="Windows") returned -1 [0031.793] lstrcmpW (lpString1="Proof.xml", lpString2="32.EXE.exe") returned 1 [0031.793] StrStrW (lpFirst="Proof.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.793] lstrcmpW (lpString1="Proof.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d6198 [0031.793] GetCurrentThreadId () returned 0x9b0 [0031.793] GetCurrentThreadId () returned 0x9b0 [0031.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b10 [0031.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x299cb0 [0031.793] RtlWakeConditionVariable () returned 0x27e800 [0031.793] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6198 | out: hHeap=0x260000) returned 1 [0031.793] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0031.793] FindClose (in: hFindFile=0x2d5640 | out: hFindFile=0x2d5640) returned 1 [0031.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x298ca8 [0031.793] GetCurrentThreadId () returned 0x9b0 [0031.794] GetCurrentThreadId () returned 0x9b0 [0031.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b48 [0031.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x298d80 [0031.794] RtlWakeConditionVariable () returned 0x27e800 [0031.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298ca8 | out: hHeap=0x260000) returned 1 [0031.794] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0478 | out: hHeap=0x260000) returned 1 [0031.794] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0031.794] lstrcmpiW (lpString1="Proof.fr", lpString2="Windows") returned -1 [0031.794] lstrcmpW (lpString1="Proof.fr", lpString2=".") returned 1 [0031.794] lstrcmpW (lpString1="Proof.fr", lpString2="..") returned 1 [0031.794] lstrcmpW (lpString1="Proof.fr", lpString2="AppData") returned 1 [0031.794] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpSrch="AppData") returned 0x0 [0031.794] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpString2="C:\\Windows") returned -1 [0031.794] lstrlenW (lpString="C:\\Windows") returned 10 [0031.794] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpString2="C:\\System Volume Information") returned -1 [0031.794] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f0478 [0031.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5640 [0031.794] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0031.794] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0031.794] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0031.794] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.794] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.794] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0031.795] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0031.795] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0031.795] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0031.795] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0031.795] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.795] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.795] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0031.795] lstrcmpiW (lpString1="Proof.cab", lpString2="Windows") returned -1 [0031.795] lstrcmpW (lpString1="Proof.cab", lpString2="32.EXE.exe") returned 1 [0031.795] StrStrW (lpFirst="Proof.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.795] lstrcmpW (lpString1="Proof.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d6198 [0031.795] GetCurrentThreadId () returned 0x9b0 [0031.795] GetCurrentThreadId () returned 0x9b0 [0031.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b80 [0031.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x298ca8 [0031.795] RtlWakeConditionVariable () returned 0x27e800 [0031.795] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6198 | out: hHeap=0x260000) returned 1 [0031.795] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0031.795] lstrcmpiW (lpString1="Proof.msi", lpString2="Windows") returned -1 [0031.795] lstrcmpW (lpString1="Proof.msi", lpString2="32.EXE.exe") returned 1 [0031.795] StrStrW (lpFirst="Proof.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.795] lstrcmpW (lpString1="Proof.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d6198 [0031.795] GetCurrentThreadId () returned 0x9b0 [0031.795] GetCurrentThreadId () returned 0x9b0 [0031.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bb8 [0031.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x298e58 [0031.795] RtlWakeConditionVariable () returned 0x27e800 [0031.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6198 | out: hHeap=0x260000) returned 1 [0031.796] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0031.796] lstrcmpiW (lpString1="Proof.xml", lpString2="Windows") returned -1 [0031.796] lstrcmpW (lpString1="Proof.xml", lpString2="32.EXE.exe") returned 1 [0031.796] StrStrW (lpFirst="Proof.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.796] lstrcmpW (lpString1="Proof.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2d6198 [0031.796] GetCurrentThreadId () returned 0x9b0 [0031.796] GetCurrentThreadId () returned 0x9b0 [0031.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1bf0 [0031.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0031.796] RtlWakeConditionVariable () returned 0x27e800 [0031.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d6198 | out: hHeap=0x260000) returned 1 [0031.796] FindNextFileW (in: hFindFile=0x2d5640, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0031.796] FindClose (in: hFindFile=0x2d5640 | out: hFindFile=0x2d5640) returned 1 [0031.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x298f10 [0031.796] GetCurrentThreadId () returned 0x9b0 [0031.796] GetCurrentThreadId () returned 0x9b0 [0031.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c28 [0031.796] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x298fe8 [0031.796] RtlWakeConditionVariable () returned 0x27e800 [0031.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298f10 | out: hHeap=0x260000) returned 1 [0031.796] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f0478 | out: hHeap=0x260000) returned 1 [0031.796] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0031.796] lstrcmpiW (lpString1="Proofing.msi", lpString2="Windows") returned -1 [0031.797] lstrcmpW (lpString1="Proofing.msi", lpString2="32.EXE.exe") returned 1 [0031.797] StrStrW (lpFirst="Proofing.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.797] lstrcmpW (lpString1="Proofing.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d54f0 [0031.797] GetCurrentThreadId () returned 0x9b0 [0031.797] GetCurrentThreadId () returned 0x9b0 [0031.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c60 [0031.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2d6198 [0031.797] RtlWakeConditionVariable () returned 0x27e800 [0031.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d54f0 | out: hHeap=0x260000) returned 1 [0031.797] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0031.797] lstrcmpiW (lpString1="Proofing.xml", lpString2="Windows") returned -1 [0031.797] lstrcmpW (lpString1="Proofing.xml", lpString2="32.EXE.exe") returned 1 [0031.797] StrStrW (lpFirst="Proofing.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.797] lstrcmpW (lpString1="Proofing.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0031.797] GetCurrentThreadId () returned 0x9b0 [0031.797] GetCurrentThreadId () returned 0x9b0 [0031.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1c98 [0031.797] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0031.797] RtlWakeConditionVariable () returned 0x27e800 [0031.797] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0031.797] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0031.797] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0031.797] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0031.797] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0031.798] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0031.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0031.798] GetCurrentThreadId () returned 0x9b0 [0031.798] GetCurrentThreadId () returned 0x9b0 [0031.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1cd0 [0031.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ced8 [0031.798] RtlWakeConditionVariable () returned 0x27e800 [0031.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0031.798] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0031.798] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0031.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x298f10 [0031.798] GetCurrentThreadId () returned 0x9b0 [0031.798] GetCurrentThreadId () returned 0x9b0 [0031.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d08 [0031.798] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2990c0 [0031.798] RtlWakeConditionVariable () returned 0x27e800 [0031.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x298f10 | out: hHeap=0x260000) returned 1 [0031.798] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0031.799] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0031.799] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0031.799] lstrcmpW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0031.799] lstrcmpW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0031.799] lstrcmpW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0031.799] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0031.799] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0031.799] lstrlenW (lpString="C:\\Windows") returned 10 [0031.799] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0031.799] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0031.799] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0031.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.230] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.230] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.230] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.230] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.230] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.230] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.230] GetCurrentThreadId () returned 0x9b0 [0032.231] GetCurrentThreadId () returned 0x9b0 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1640 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295ed8 [0032.231] RtlWakeConditionVariable () returned 0x27e800 [0032.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.231] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.231] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.231] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.231] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.231] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.231] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.231] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.231] GetCurrentThreadId () returned 0x9b0 [0032.231] GetCurrentThreadId () returned 0x9b0 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1678 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295f70 [0032.231] RtlWakeConditionVariable () returned 0x27e800 [0032.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.231] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0032.231] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="Windows") returned -1 [0032.231] lstrcmpW (lpString1="Office32MUI.msi", lpString2="32.EXE.exe") returned 1 [0032.231] StrStrW (lpFirst="Office32MUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.231] lstrcmpW (lpString1="Office32MUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.231] GetCurrentThreadId () returned 0x9b0 [0032.231] GetCurrentThreadId () returned 0x9b0 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1598 [0032.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b068 [0032.231] RtlWakeConditionVariable () returned 0x27e800 [0032.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.232] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0032.232] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="Windows") returned -1 [0032.232] lstrcmpW (lpString1="Office32MUI.xml", lpString2="32.EXE.exe") returned 1 [0032.232] StrStrW (lpFirst="Office32MUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.232] lstrcmpW (lpString1="Office32MUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.232] GetCurrentThreadId () returned 0x9b0 [0032.232] GetCurrentThreadId () returned 0x9b0 [0032.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1608 [0032.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b120 [0032.232] RtlWakeConditionVariable () returned 0x27e800 [0032.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.232] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0032.232] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="Windows") returned -1 [0032.232] lstrcmpW (lpString1="OWOW32LR.cab", lpString2="32.EXE.exe") returned 1 [0032.232] StrStrW (lpFirst="OWOW32LR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.232] lstrcmpW (lpString1="OWOW32LR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.232] GetCurrentThreadId () returned 0x9b0 [0032.232] GetCurrentThreadId () returned 0x9b0 [0032.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1720 [0032.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0032.232] RtlWakeConditionVariable () returned 0x27e800 [0032.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.232] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.232] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.232] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.232] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.232] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.233] GetCurrentThreadId () returned 0x9b0 [0032.233] GetCurrentThreadId () returned 0x9b0 [0032.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16e8 [0032.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0032.233] RtlWakeConditionVariable () returned 0x27e800 [0032.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.233] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0032.233] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5820 [0032.234] GetCurrentThreadId () returned 0x9b0 [0032.234] GetCurrentThreadId () returned 0x9b0 [0032.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1d40 [0032.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x298f10 [0032.234] RtlWakeConditionVariable () returned 0x27e800 [0032.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.234] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0032.234] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.234] lstrcmpW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.234] lstrcmpW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.234] lstrcmpW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.234] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.234] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.234] lstrlenW (lpString="C:\\Windows") returned 10 [0032.234] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.234] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.237] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.237] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.237] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.237] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.237] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.237] GetCurrentThreadId () returned 0x9b0 [0032.237] GetCurrentThreadId () returned 0x9b0 [0032.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0d88 [0032.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296008 [0032.237] RtlWakeConditionVariable () returned 0x27e800 [0032.237] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.237] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.237] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.237] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.237] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.237] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.237] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.237] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.237] GetCurrentThreadId () returned 0x9b0 [0032.237] GetCurrentThreadId () returned 0x9b0 [0032.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0dc0 [0032.237] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0032.238] RtlWakeConditionVariable () returned 0x27e800 [0032.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.238] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x48, dwReserved1=0x260000, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0032.238] lstrcmpiW (lpString1="InfLR.cab", lpString2="Windows") returned -1 [0032.238] lstrcmpW (lpString1="InfLR.cab", lpString2="32.EXE.exe") returned 1 [0032.238] StrStrW (lpFirst="InfLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.238] lstrcmpW (lpString1="InfLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.238] GetCurrentThreadId () returned 0x9b0 [0032.238] GetCurrentThreadId () returned 0x9b0 [0032.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0df8 [0032.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d2c8 [0032.238] RtlWakeConditionVariable () returned 0x27e800 [0032.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.238] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0032.238] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="Windows") returned -1 [0032.238] lstrcmpW (lpString1="InfoPathMUI.msi", lpString2="32.EXE.exe") returned 1 [0032.238] StrStrW (lpFirst="InfoPathMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.238] lstrcmpW (lpString1="InfoPathMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.238] GetCurrentThreadId () returned 0x9b0 [0032.238] GetCurrentThreadId () returned 0x9b0 [0032.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e30 [0032.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b1d8 [0032.238] RtlWakeConditionVariable () returned 0x27e800 [0032.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.238] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x48, dwReserved1=0x260000, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0032.238] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="Windows") returned -1 [0032.238] lstrcmpW (lpString1="InfoPathMUI.xml", lpString2="32.EXE.exe") returned 1 [0032.238] StrStrW (lpFirst="InfoPathMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.239] lstrcmpW (lpString1="InfoPathMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.239] GetCurrentThreadId () returned 0x9b0 [0032.239] GetCurrentThreadId () returned 0x9b0 [0032.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0e68 [0032.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b290 [0032.239] RtlWakeConditionVariable () returned 0x27e800 [0032.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.239] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.239] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.239] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.239] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.239] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.239] GetCurrentThreadId () returned 0x9b0 [0032.239] GetCurrentThreadId () returned 0x9b0 [0032.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ea0 [0032.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0032.239] RtlWakeConditionVariable () returned 0x27e800 [0032.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.239] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0032.239] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5820 [0032.240] GetCurrentThreadId () returned 0x9b0 [0032.240] GetCurrentThreadId () returned 0x9b0 [0032.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ed8 [0032.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5640 [0032.240] RtlWakeConditionVariable () returned 0x27e800 [0032.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.240] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0032.240] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.240] lstrcmpW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.240] lstrcmpW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.240] lstrcmpW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.240] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.240] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.240] lstrlenW (lpString="C:\\Windows") returned 10 [0032.240] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.240] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.241] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.241] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.241] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.241] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.241] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.241] GetCurrentThreadId () returned 0x9b0 [0032.241] GetCurrentThreadId () returned 0x9b0 [0032.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f10 [0032.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0032.241] RtlWakeConditionVariable () returned 0x27e800 [0032.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.241] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.241] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.241] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.241] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.241] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.241] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.241] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.242] GetCurrentThreadId () returned 0x9b0 [0032.242] GetCurrentThreadId () returned 0x9b0 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f48 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2961d0 [0032.242] RtlWakeConditionVariable () returned 0x27e800 [0032.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.242] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.242] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.242] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.242] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.242] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.242] GetCurrentThreadId () returned 0x9b0 [0032.242] GetCurrentThreadId () returned 0x9b0 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0f80 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d418 [0032.242] RtlWakeConditionVariable () returned 0x27e800 [0032.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.242] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0032.242] lstrcmpiW (lpString1="VisioLR.cab", lpString2="Windows") returned -1 [0032.242] lstrcmpW (lpString1="VisioLR.cab", lpString2="32.EXE.exe") returned 1 [0032.242] StrStrW (lpFirst="VisioLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.242] lstrcmpW (lpString1="VisioLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.242] GetCurrentThreadId () returned 0x9b0 [0032.242] GetCurrentThreadId () returned 0x9b0 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0fb8 [0032.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d4c0 [0032.242] RtlWakeConditionVariable () returned 0x27e800 [0032.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.243] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0032.243] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="Windows") returned -1 [0032.243] lstrcmpW (lpString1="VisioMUI.msi", lpString2="32.EXE.exe") returned 1 [0032.243] StrStrW (lpFirst="VisioMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.243] lstrcmpW (lpString1="VisioMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.243] GetCurrentThreadId () returned 0x9b0 [0032.243] GetCurrentThreadId () returned 0x9b0 [0032.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a0ff0 [0032.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0032.243] RtlWakeConditionVariable () returned 0x27e800 [0032.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.243] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0032.243] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="Windows") returned -1 [0032.243] lstrcmpW (lpString1="VisioMUI.xml", lpString2="32.EXE.exe") returned 1 [0032.243] StrStrW (lpFirst="VisioMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.243] lstrcmpW (lpString1="VisioMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.243] GetCurrentThreadId () returned 0x9b0 [0032.243] GetCurrentThreadId () returned 0x9b0 [0032.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1028 [0032.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d610 [0032.243] RtlWakeConditionVariable () returned 0x27e800 [0032.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.243] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0032.243] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5820 [0032.244] GetCurrentThreadId () returned 0x9b0 [0032.244] GetCurrentThreadId () returned 0x9b0 [0032.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1060 [0032.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x27d070 [0032.244] RtlWakeConditionVariable () returned 0x27e800 [0032.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.244] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0032.244] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.244] lstrcmpW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.244] lstrcmpW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.244] lstrcmpW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.244] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.244] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.244] lstrlenW (lpString="C:\\Windows") returned 10 [0032.244] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.244] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.248] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.248] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.248] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.248] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.248] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.248] GetCurrentThreadId () returned 0x9b0 [0032.248] GetCurrentThreadId () returned 0x9b0 [0032.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1098 [0032.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0032.248] RtlWakeConditionVariable () returned 0x27e800 [0032.248] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.248] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.248] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.248] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.248] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.248] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.248] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.248] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.248] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.248] GetCurrentThreadId () returned 0x9b0 [0032.249] GetCurrentThreadId () returned 0x9b0 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a10d0 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296300 [0032.249] RtlWakeConditionVariable () returned 0x27e800 [0032.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.249] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0032.249] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="Windows") returned -1 [0032.249] lstrcmpW (lpString1="OneNoteMUI.msi", lpString2="32.EXE.exe") returned 1 [0032.249] StrStrW (lpFirst="OneNoteMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.249] lstrcmpW (lpString1="OneNoteMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.249] GetCurrentThreadId () returned 0x9b0 [0032.249] GetCurrentThreadId () returned 0x9b0 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1108 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b348 [0032.249] RtlWakeConditionVariable () returned 0x27e800 [0032.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.249] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0032.249] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="Windows") returned -1 [0032.249] lstrcmpW (lpString1="OneNoteMUI.xml", lpString2="32.EXE.exe") returned 1 [0032.249] StrStrW (lpFirst="OneNoteMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.249] lstrcmpW (lpString1="OneNoteMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.249] GetCurrentThreadId () returned 0x9b0 [0032.249] GetCurrentThreadId () returned 0x9b0 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1140 [0032.249] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b400 [0032.249] RtlWakeConditionVariable () returned 0x27e800 [0032.249] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.249] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0032.250] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="Windows") returned -1 [0032.250] lstrcmpW (lpString1="OnoteLR.cab", lpString2="32.EXE.exe") returned 1 [0032.250] StrStrW (lpFirst="OnoteLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.250] lstrcmpW (lpString1="OnoteLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.250] GetCurrentThreadId () returned 0x9b0 [0032.250] GetCurrentThreadId () returned 0x9b0 [0032.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1178 [0032.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d6b8 [0032.250] RtlWakeConditionVariable () returned 0x27e800 [0032.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.250] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.250] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.250] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.250] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.250] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.250] GetCurrentThreadId () returned 0x9b0 [0032.250] GetCurrentThreadId () returned 0x9b0 [0032.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11b0 [0032.250] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d760 [0032.250] RtlWakeConditionVariable () returned 0x27e800 [0032.250] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.250] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0032.250] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5820 [0032.251] GetCurrentThreadId () returned 0x9b0 [0032.251] GetCurrentThreadId () returned 0x9b0 [0032.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a11e8 [0032.251] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b4000 [0032.251] RtlWakeConditionVariable () returned 0x27e800 [0032.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.251] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.251] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0032.251] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.251] lstrcmpW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.251] lstrcmpW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.251] lstrcmpW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.251] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.251] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.251] lstrlenW (lpString="C:\\Windows") returned 10 [0032.252] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.252] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.252] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.258] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.258] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.258] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.258] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.258] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.258] GetCurrentThreadId () returned 0x9b0 [0032.258] GetCurrentThreadId () returned 0x9b0 [0032.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1220 [0032.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296398 [0032.258] RtlWakeConditionVariable () returned 0x27e800 [0032.258] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.258] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.258] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.258] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.258] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.258] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.259] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.259] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.259] GetCurrentThreadId () returned 0x9b0 [0032.259] GetCurrentThreadId () returned 0x9b0 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1258 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296430 [0032.259] RtlWakeConditionVariable () returned 0x27e800 [0032.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.259] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0032.259] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="Windows") returned -1 [0032.259] lstrcmpW (lpString1="ProjectMUI.msi", lpString2="32.EXE.exe") returned 1 [0032.259] StrStrW (lpFirst="ProjectMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.259] lstrcmpW (lpString1="ProjectMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.259] GetCurrentThreadId () returned 0x9b0 [0032.259] GetCurrentThreadId () returned 0x9b0 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1290 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0032.259] RtlWakeConditionVariable () returned 0x27e800 [0032.259] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.259] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0032.259] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="Windows") returned -1 [0032.259] lstrcmpW (lpString1="ProjectMUI.xml", lpString2="32.EXE.exe") returned 1 [0032.259] StrStrW (lpFirst="ProjectMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.259] lstrcmpW (lpString1="ProjectMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.259] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.260] GetCurrentThreadId () returned 0x9b0 [0032.260] GetCurrentThreadId () returned 0x9b0 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a12c8 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b570 [0032.260] RtlWakeConditionVariable () returned 0x27e800 [0032.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.260] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0032.260] lstrcmpiW (lpString1="ProjLR.cab", lpString2="Windows") returned -1 [0032.260] lstrcmpW (lpString1="ProjLR.cab", lpString2="32.EXE.exe") returned 1 [0032.260] StrStrW (lpFirst="ProjLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.260] lstrcmpW (lpString1="ProjLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.260] GetCurrentThreadId () returned 0x9b0 [0032.260] GetCurrentThreadId () returned 0x9b0 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1300 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0032.260] RtlWakeConditionVariable () returned 0x27e800 [0032.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.260] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.260] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.260] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.260] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.260] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.260] GetCurrentThreadId () returned 0x9b0 [0032.260] GetCurrentThreadId () returned 0x9b0 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1338 [0032.260] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d8b0 [0032.260] RtlWakeConditionVariable () returned 0x27e800 [0032.260] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.261] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0032.261] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5820 [0032.262] GetCurrentThreadId () returned 0x9b0 [0032.262] GetCurrentThreadId () returned 0x9b0 [0032.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1370 [0032.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b40c8 [0032.262] RtlWakeConditionVariable () returned 0x27e800 [0032.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.262] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.262] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0032.262] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.262] lstrcmpW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.262] lstrcmpW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.262] lstrcmpW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.262] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.262] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.262] lstrlenW (lpString="C:\\Windows") returned 10 [0032.262] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.262] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.264] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.264] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.264] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.264] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.264] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.264] GetCurrentThreadId () returned 0x9b0 [0032.264] GetCurrentThreadId () returned 0x9b0 [0032.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13a8 [0032.264] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2964c8 [0032.264] RtlWakeConditionVariable () returned 0x27e800 [0032.264] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.264] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.264] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.265] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.265] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.265] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.265] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.265] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.265] GetCurrentThreadId () returned 0x9b0 [0032.265] GetCurrentThreadId () returned 0x9b0 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a13e0 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296560 [0032.265] RtlWakeConditionVariable () returned 0x27e800 [0032.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.265] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x48, dwReserved1=0x260000, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0032.265] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="Windows") returned -1 [0032.265] lstrcmpW (lpString1="GrooveLR.cab", lpString2="32.EXE.exe") returned 1 [0032.265] StrStrW (lpFirst="GrooveLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.265] lstrcmpW (lpString1="GrooveLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.265] GetCurrentThreadId () returned 0x9b0 [0032.265] GetCurrentThreadId () returned 0x9b0 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1418 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d958 [0032.265] RtlWakeConditionVariable () returned 0x27e800 [0032.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.265] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x48, dwReserved1=0x260000, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0032.265] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="Windows") returned -1 [0032.265] lstrcmpW (lpString1="GrooveMUI.msi", lpString2="32.EXE.exe") returned 1 [0032.265] StrStrW (lpFirst="GrooveMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.265] lstrcmpW (lpString1="GrooveMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.266] GetCurrentThreadId () returned 0x9b0 [0032.266] GetCurrentThreadId () returned 0x9b0 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1450 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b628 [0032.266] RtlWakeConditionVariable () returned 0x27e800 [0032.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.266] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x48, dwReserved1=0x260000, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0032.266] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="Windows") returned -1 [0032.266] lstrcmpW (lpString1="GrooveMUI.xml", lpString2="32.EXE.exe") returned 1 [0032.266] StrStrW (lpFirst="GrooveMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.266] lstrcmpW (lpString1="GrooveMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.266] GetCurrentThreadId () returned 0x9b0 [0032.266] GetCurrentThreadId () returned 0x9b0 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1488 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b6e0 [0032.266] RtlWakeConditionVariable () returned 0x27e800 [0032.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29afb0 | out: hHeap=0x260000) returned 1 [0032.266] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.266] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.266] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.266] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.266] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0032.266] GetCurrentThreadId () returned 0x9b0 [0032.266] GetCurrentThreadId () returned 0x9b0 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14c0 [0032.266] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29da00 [0032.266] RtlWakeConditionVariable () returned 0x27e800 [0032.266] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d0d0 | out: hHeap=0x260000) returned 1 [0032.266] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0032.267] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5820 [0032.267] GetCurrentThreadId () returned 0x9b0 [0032.267] GetCurrentThreadId () returned 0x9b0 [0032.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a14f8 [0032.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d52f8 [0032.267] RtlWakeConditionVariable () returned 0x27e800 [0032.267] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5820 | out: hHeap=0x260000) returned 1 [0032.268] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.268] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0032.268] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.268] lstrcmpW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.268] lstrcmpW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.268] lstrcmpW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.268] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.268] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.268] lstrlenW (lpString="C:\\Windows") returned 10 [0032.268] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.268] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0032.480] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.480] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.481] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.481] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.481] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.481] GetCurrentThreadId () returned 0x9b0 [0032.481] GetCurrentThreadId () returned 0x9b0 [0032.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1838 [0032.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2965f8 [0032.481] RtlWakeConditionVariable () returned 0x27e800 [0032.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.481] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.481] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.481] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.481] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.481] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.481] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.481] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0032.481] GetCurrentThreadId () returned 0x9b0 [0032.481] GetCurrentThreadId () returned 0x9b0 [0032.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1800 [0032.481] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295d10 [0032.481] RtlWakeConditionVariable () returned 0x27e800 [0032.481] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0032.481] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="1033", cAlternateFileName="")) returned 1 [0032.481] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0032.481] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0032.481] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0032.482] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0032.482] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpSrch="AppData") returned 0x0 [0032.482] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpString2="C:\\Windows") returned -1 [0032.482] lstrlenW (lpString="C:\\Windows") returned 10 [0032.482] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpString2="C:\\System Volume Information") returned -1 [0032.482] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.482] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f28a8 [0032.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2b2ec8 [0032.749] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0032.749] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.749] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0032.749] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.749] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.749] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0032.749] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0032.749] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.749] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.749] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0032.749] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.749] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.749] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x98, dwReserved1=0x260000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0032.749] lstrcmpiW (lpString1="dwintl20.dll", lpString2="Windows") returned -1 [0032.749] lstrcmpW (lpString1="dwintl20.dll", lpString2="32.EXE.exe") returned 1 [0032.749] StrStrW (lpFirst="dwintl20.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.749] lstrcmpW (lpString1="dwintl20.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0032.749] GetCurrentThreadId () returned 0x9b0 [0032.749] GetCurrentThreadId () returned 0x9b0 [0032.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1870 [0032.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29aef8 [0032.749] RtlWakeConditionVariable () returned 0x27e800 [0032.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0032.750] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x98, dwReserved1=0x260000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0032.750] FindClose (in: hFindFile=0x2b2ec8 | out: hFindFile=0x2b2ec8) returned 1 [0032.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ef38 [0032.750] GetCurrentThreadId () returned 0x9b0 [0032.750] GetCurrentThreadId () returned 0x9b0 [0032.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a16b0 [0032.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f010 [0032.750] RtlWakeConditionVariable () returned 0x27e800 [0032.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ef38 | out: hHeap=0x260000) returned 1 [0032.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2f28a8 | out: hHeap=0x260000) returned 1 [0032.750] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x48, dwReserved1=0x260000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0032.750] lstrcmpiW (lpString1="branding.xml", lpString2="Windows") returned -1 [0032.750] lstrcmpW (lpString1="branding.xml", lpString2="32.EXE.exe") returned 1 [0032.750] StrStrW (lpFirst="branding.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.750] lstrcmpW (lpString1="branding.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.750] GetCurrentThreadId () returned 0x9b0 [0032.750] GetCurrentThreadId () returned 0x9b0 [0032.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a17c8 [0032.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dd48 [0032.750] RtlWakeConditionVariable () returned 0x27e800 [0032.750] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.750] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x48, dwReserved1=0x260000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0032.750] lstrcmpiW (lpString1="DW20.EXE", lpString2="Windows") returned -1 [0032.751] lstrcmpW (lpString1="DW20.EXE", lpString2="32.EXE.exe") returned 1 [0032.751] StrStrW (lpFirst="DW20.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.751] lstrcmpW (lpString1="DW20.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.751] GetCurrentThreadId () returned 0x9b0 [0032.751] GetCurrentThreadId () returned 0x9b0 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1790 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ddf0 [0032.751] RtlWakeConditionVariable () returned 0x27e800 [0032.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.751] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x48, dwReserved1=0x260000, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0032.751] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="Windows") returned -1 [0032.751] lstrcmpW (lpString1="dwdcw20.dll", lpString2="32.EXE.exe") returned 1 [0032.751] StrStrW (lpFirst="dwdcw20.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.751] lstrcmpW (lpString1="dwdcw20.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.751] GetCurrentThreadId () returned 0x9b0 [0032.751] GetCurrentThreadId () returned 0x9b0 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1758 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29de98 [0032.751] RtlWakeConditionVariable () returned 0x27e800 [0032.751] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.751] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0032.751] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="Windows") returned -1 [0032.751] lstrcmpW (lpString1="dwtrig20.exe", lpString2="32.EXE.exe") returned 1 [0032.751] StrStrW (lpFirst="dwtrig20.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.751] lstrcmpW (lpString1="dwtrig20.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.751] GetCurrentThreadId () returned 0x9b0 [0032.751] GetCurrentThreadId () returned 0x9b0 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1530 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29df40 [0032.752] RtlWakeConditionVariable () returned 0x27e800 [0032.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.752] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0032.752] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="Windows") returned -1 [0032.752] lstrcmpW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="32.EXE.exe") returned 1 [0032.752] StrStrW (lpFirst="Microsoft.VC90.CRT.manifest", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.752] lstrcmpW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0032.752] GetCurrentThreadId () returned 0x9b0 [0032.752] GetCurrentThreadId () returned 0x9b0 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991a0 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5488 [0032.752] RtlWakeConditionVariable () returned 0x27e800 [0032.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0032.752] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x48, dwReserved1=0x260000, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0032.752] lstrcmpiW (lpString1="msvcr90.dll", lpString2="Windows") returned -1 [0032.752] lstrcmpW (lpString1="msvcr90.dll", lpString2="32.EXE.exe") returned 1 [0032.752] StrStrW (lpFirst="msvcr90.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.752] lstrcmpW (lpString1="msvcr90.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.752] GetCurrentThreadId () returned 0x9b0 [0032.752] GetCurrentThreadId () returned 0x9b0 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2991d8 [0032.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dfe8 [0032.752] RtlWakeConditionVariable () returned 0x27e800 [0032.752] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.752] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0032.752] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="Windows") returned -1 [0032.753] lstrcmpW (lpString1="OfficeLR.cab", lpString2="32.EXE.exe") returned 1 [0032.753] StrStrW (lpFirst="OfficeLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.753] lstrcmpW (lpString1="OfficeLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.753] GetCurrentThreadId () returned 0x9b0 [0032.753] GetCurrentThreadId () returned 0x9b0 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299210 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e090 [0032.753] RtlWakeConditionVariable () returned 0x27e800 [0032.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.753] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0032.753] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="Windows") returned -1 [0032.753] lstrcmpW (lpString1="OfficeMUI.msi", lpString2="32.EXE.exe") returned 1 [0032.753] StrStrW (lpFirst="OfficeMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.753] lstrcmpW (lpString1="OfficeMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0032.753] GetCurrentThreadId () returned 0x9b0 [0032.753] GetCurrentThreadId () returned 0x9b0 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299248 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29afb0 [0032.753] RtlWakeConditionVariable () returned 0x27e800 [0032.753] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0032.753] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0032.753] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="Windows") returned -1 [0032.753] lstrcmpW (lpString1="OfficeMUI.xml", lpString2="32.EXE.exe") returned 1 [0032.753] StrStrW (lpFirst="OfficeMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.753] lstrcmpW (lpString1="OfficeMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0032.753] GetCurrentThreadId () returned 0x9b0 [0032.753] GetCurrentThreadId () returned 0x9b0 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299280 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b798 [0032.754] RtlWakeConditionVariable () returned 0x27e800 [0032.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0032.754] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0032.754] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="Windows") returned -1 [0032.754] lstrcmpW (lpString1="OfficeMUISet.msi", lpString2="32.EXE.exe") returned 1 [0032.754] StrStrW (lpFirst="OfficeMUISet.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.754] lstrcmpW (lpString1="OfficeMUISet.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0032.754] GetCurrentThreadId () returned 0x9b0 [0032.754] GetCurrentThreadId () returned 0x9b0 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992b8 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b850 [0032.754] RtlWakeConditionVariable () returned 0x27e800 [0032.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0032.754] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0032.754] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="Windows") returned -1 [0032.754] lstrcmpW (lpString1="OfficeMUISet.xml", lpString2="32.EXE.exe") returned 1 [0032.754] StrStrW (lpFirst="OfficeMUISet.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.754] lstrcmpW (lpString1="OfficeMUISet.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0032.754] GetCurrentThreadId () returned 0x9b0 [0032.754] GetCurrentThreadId () returned 0x9b0 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2992f0 [0032.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b908 [0032.754] RtlWakeConditionVariable () returned 0x27e800 [0032.754] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29ae40 | out: hHeap=0x260000) returned 1 [0032.754] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x48, dwReserved1=0x260000, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0032.754] lstrcmpiW (lpString1="osetupui.dll", lpString2="Windows") returned -1 [0032.754] lstrcmpW (lpString1="osetupui.dll", lpString2="32.EXE.exe") returned 1 [0032.755] StrStrW (lpFirst="osetupui.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.755] lstrcmpW (lpString1="osetupui.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.755] GetCurrentThreadId () returned 0x9b0 [0032.755] GetCurrentThreadId () returned 0x9b0 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299328 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e138 [0032.755] RtlWakeConditionVariable () returned 0x27e800 [0032.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.755] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x48, dwReserved1=0x260000, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0032.755] lstrcmpiW (lpString1="pss10r.chm", lpString2="Windows") returned -1 [0032.755] lstrcmpW (lpString1="pss10r.chm", lpString2="32.EXE.exe") returned 1 [0032.755] StrStrW (lpFirst="pss10r.chm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.755] lstrcmpW (lpString1="pss10r.chm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.755] GetCurrentThreadId () returned 0x9b0 [0032.755] GetCurrentThreadId () returned 0x9b0 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299360 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e1e0 [0032.755] RtlWakeConditionVariable () returned 0x27e800 [0032.755] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.755] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x48, dwReserved1=0x260000, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0032.755] lstrcmpiW (lpString1="setup.chm", lpString2="Windows") returned -1 [0032.755] lstrcmpW (lpString1="setup.chm", lpString2="32.EXE.exe") returned 1 [0032.755] StrStrW (lpFirst="setup.chm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.755] lstrcmpW (lpString1="setup.chm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.755] GetCurrentThreadId () returned 0x9b0 [0032.755] GetCurrentThreadId () returned 0x9b0 [0032.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299398 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0032.756] RtlWakeConditionVariable () returned 0x27e800 [0032.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.756] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0032.756] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0032.756] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0032.756] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.756] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.756] GetCurrentThreadId () returned 0x9b0 [0032.756] GetCurrentThreadId () returned 0x9b0 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2993d0 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0032.756] RtlWakeConditionVariable () returned 0x27e800 [0032.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.756] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0032.756] lstrcmpiW (lpString1="ShellUI.MST", lpString2="Windows") returned -1 [0032.756] lstrcmpW (lpString1="ShellUI.MST", lpString2="32.EXE.exe") returned 1 [0032.756] StrStrW (lpFirst="ShellUI.MST", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0032.756] lstrcmpW (lpString1="ShellUI.MST", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0032.756] GetCurrentThreadId () returned 0x9b0 [0032.756] GetCurrentThreadId () returned 0x9b0 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299408 [0032.756] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e3d8 [0032.756] RtlWakeConditionVariable () returned 0x27e800 [0032.756] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29dca0 | out: hHeap=0x260000) returned 1 [0032.756] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0032.757] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0032.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0032.757] GetCurrentThreadId () returned 0x9b0 [0032.757] GetCurrentThreadId () returned 0x9b0 [0032.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299440 [0032.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5550 [0032.757] RtlWakeConditionVariable () returned 0x27e800 [0032.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0032.757] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0032.757] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0032.757] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0032.757] lstrcmpW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0032.757] lstrcmpW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0032.757] lstrcmpW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0032.757] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0032.757] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0032.757] lstrlenW (lpString="C:\\Windows") returned 10 [0032.757] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0032.757] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0032.757] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0032.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0033.194] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0033.194] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.194] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0033.194] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.194] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0033.194] GetCurrentThreadId () returned 0x9b0 [0033.194] GetCurrentThreadId () returned 0x9b0 [0033.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19f8 [0033.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295c78 [0033.194] RtlWakeConditionVariable () returned 0x27e800 [0033.194] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0033.194] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0033.194] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0033.195] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.195] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.195] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0033.195] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.195] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0033.195] GetCurrentThreadId () returned 0x9b0 [0033.195] GetCurrentThreadId () returned 0x9b0 [0033.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a19c0 [0033.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295e40 [0033.195] RtlWakeConditionVariable () returned 0x27e800 [0033.195] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0033.195] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0033.195] lstrcmpiW (lpString1="Access.en-us", lpString2="Windows") returned -1 [0033.195] lstrcmpW (lpString1="Access.en-us", lpString2=".") returned 1 [0033.195] lstrcmpW (lpString1="Access.en-us", lpString2="..") returned 1 [0033.195] lstrcmpW (lpString1="Access.en-us", lpString2="AppData") returned -1 [0033.195] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpSrch="AppData") returned 0x0 [0033.195] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpString2="C:\\Windows") returned -1 [0033.195] lstrlenW (lpString="C:\\Windows") returned 10 [0033.195] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpString2="C:\\System Volume Information") returned -1 [0033.195] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0033.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2d98a0 [0033.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2b2ec8 [0033.230] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0033.230] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.230] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0033.230] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.230] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.230] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0033.230] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0033.230] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.230] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.230] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0033.230] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.230] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.230] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0033.230] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="Windows") returned -1 [0033.230] lstrcmpW (lpString1="AccessMUI.msi", lpString2="32.EXE.exe") returned 1 [0033.230] StrStrW (lpFirst="AccessMUI.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.230] lstrcmpW (lpString1="AccessMUI.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0033.231] GetCurrentThreadId () returned 0x9b0 [0033.231] GetCurrentThreadId () returned 0x9b0 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1988 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3838 [0033.231] RtlWakeConditionVariable () returned 0x27e800 [0033.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0033.231] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x98, dwReserved1=0x260000, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0033.231] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="Windows") returned -1 [0033.231] lstrcmpW (lpString1="AccessMUI.xml", lpString2="32.EXE.exe") returned 1 [0033.231] StrStrW (lpFirst="AccessMUI.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.231] lstrcmpW (lpString1="AccessMUI.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0033.231] GetCurrentThreadId () returned 0x9b0 [0033.231] GetCurrentThreadId () returned 0x9b0 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1950 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3e10 [0033.231] RtlWakeConditionVariable () returned 0x27e800 [0033.231] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0033.231] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x98, dwReserved1=0x260000, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0033.231] lstrcmpiW (lpString1="AccLR.cab", lpString2="Windows") returned -1 [0033.231] lstrcmpW (lpString1="AccLR.cab", lpString2="32.EXE.exe") returned 1 [0033.231] StrStrW (lpFirst="AccLR.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.231] lstrcmpW (lpString1="AccLR.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0033.231] GetCurrentThreadId () returned 0x9b0 [0033.231] GetCurrentThreadId () returned 0x9b0 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1918 [0033.231] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2b3ed8 [0033.231] RtlWakeConditionVariable () returned 0x27e800 [0033.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0033.232] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x98, dwReserved1=0x260000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0033.232] lstrcmpiW (lpString1="branding.xml", lpString2="Windows") returned -1 [0033.232] lstrcmpW (lpString1="branding.xml", lpString2="32.EXE.exe") returned 1 [0033.232] StrStrW (lpFirst="branding.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.232] lstrcmpW (lpString1="branding.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0033.232] GetCurrentThreadId () returned 0x9b0 [0033.232] GetCurrentThreadId () returned 0x9b0 [0033.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18e0 [0033.232] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5de0 [0033.232] RtlWakeConditionVariable () returned 0x27e800 [0033.232] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0033.232] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x98, dwReserved1=0x260000, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0033.232] FindClose (in: hFindFile=0x2b2ec8 | out: hFindFile=0x2b2ec8) returned 1 [0033.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2d5ea8 [0033.233] GetCurrentThreadId () returned 0x9b0 [0033.233] GetCurrentThreadId () returned 0x9b0 [0033.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a18a8 [0033.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2b3aa8 [0033.233] RtlWakeConditionVariable () returned 0x27e800 [0033.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d5ea8 | out: hHeap=0x260000) returned 1 [0033.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x260000) returned 1 [0033.233] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x48, dwReserved1=0x260000, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0033.233] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="Windows") returned -1 [0033.233] lstrcmpW (lpString1="AccessMUISet.msi", lpString2="32.EXE.exe") returned 1 [0033.233] StrStrW (lpFirst="AccessMUISet.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.233] lstrcmpW (lpString1="AccessMUISet.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.233] GetCurrentThreadId () returned 0x9b0 [0033.233] GetCurrentThreadId () returned 0x9b0 [0033.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299478 [0033.233] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29be10 [0033.233] RtlWakeConditionVariable () returned 0x27e800 [0033.233] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0033.233] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x48, dwReserved1=0x260000, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0033.234] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="Windows") returned -1 [0033.234] lstrcmpW (lpString1="AccessMUISet.xml", lpString2="32.EXE.exe") returned 1 [0033.234] StrStrW (lpFirst="AccessMUISet.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.234] lstrcmpW (lpString1="AccessMUISet.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.234] GetCurrentThreadId () returned 0x9b0 [0033.234] GetCurrentThreadId () returned 0x9b0 [0033.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994b0 [0033.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bec8 [0033.234] RtlWakeConditionVariable () returned 0x27e800 [0033.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0033.234] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0033.234] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0033.234] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0033.234] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.234] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.234] GetCurrentThreadId () returned 0x9b0 [0033.234] GetCurrentThreadId () returned 0x9b0 [0033.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2994e8 [0033.234] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d0d0 [0033.234] RtlWakeConditionVariable () returned 0x27e800 [0033.234] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.234] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0033.234] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0033.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d53c0 [0033.235] GetCurrentThreadId () returned 0x9b0 [0033.235] GetCurrentThreadId () returned 0x9b0 [0033.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299520 [0033.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d5ea8 [0033.235] RtlWakeConditionVariable () returned 0x27e800 [0033.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d53c0 | out: hHeap=0x260000) returned 1 [0033.235] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0033.235] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0033.235] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0033.235] lstrcmpW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0033.235] lstrcmpW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0033.235] lstrcmpW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0033.235] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0033.235] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0033.235] lstrlenW (lpString="C:\\Windows") returned 10 [0033.235] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0033.235] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0033.235] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0033.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0033.238] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0033.238] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.238] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0033.238] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.238] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0033.238] GetCurrentThreadId () returned 0x9b0 [0033.238] GetCurrentThreadId () returned 0x9b0 [0033.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299558 [0033.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295da8 [0033.238] RtlWakeConditionVariable () returned 0x27e800 [0033.238] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0033.238] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0033.238] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0033.238] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.238] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.238] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0033.238] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.238] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.238] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0033.238] GetCurrentThreadId () returned 0x9b0 [0033.238] GetCurrentThreadId () returned 0x9b0 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299590 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296690 [0033.239] RtlWakeConditionVariable () returned 0x27e800 [0033.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0033.239] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0033.239] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Windows") returned -1 [0033.239] lstrcmpW (lpString1="Office32WW.msi", lpString2="32.EXE.exe") returned 1 [0033.239] StrStrW (lpFirst="Office32WW.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.239] lstrcmpW (lpString1="Office32WW.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.239] GetCurrentThreadId () returned 0x9b0 [0033.239] GetCurrentThreadId () returned 0x9b0 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2995c8 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bf80 [0033.239] RtlWakeConditionVariable () returned 0x27e800 [0033.239] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0033.239] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0033.239] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Windows") returned -1 [0033.239] lstrcmpW (lpString1="Office32WW.xml", lpString2="32.EXE.exe") returned 1 [0033.239] StrStrW (lpFirst="Office32WW.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.239] lstrcmpW (lpString1="Office32WW.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.239] GetCurrentThreadId () returned 0x9b0 [0033.239] GetCurrentThreadId () returned 0x9b0 [0033.239] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299600 [0033.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c038 [0033.240] RtlWakeConditionVariable () returned 0x27e800 [0033.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0033.240] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0033.240] lstrcmpiW (lpString1="ose.exe", lpString2="Windows") returned -1 [0033.240] lstrcmpW (lpString1="ose.exe", lpString2="32.EXE.exe") returned 1 [0033.240] StrStrW (lpFirst="ose.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.240] lstrcmpW (lpString1="ose.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.240] GetCurrentThreadId () returned 0x9b0 [0033.240] GetCurrentThreadId () returned 0x9b0 [0033.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299638 [0033.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dbf8 [0033.240] RtlWakeConditionVariable () returned 0x27e800 [0033.240] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.240] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x48, dwReserved1=0x260000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0033.240] lstrcmpiW (lpString1="osetup.dll", lpString2="Windows") returned -1 [0033.240] lstrcmpW (lpString1="osetup.dll", lpString2="32.EXE.exe") returned 1 [0033.240] StrStrW (lpFirst="osetup.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.240] lstrcmpW (lpString1="osetup.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.240] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.240] GetCurrentThreadId () returned 0x9b0 [0033.240] GetCurrentThreadId () returned 0x9b0 [0033.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299670 [0033.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dca0 [0033.241] RtlWakeConditionVariable () returned 0x27e800 [0033.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.241] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0033.241] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Windows") returned -1 [0033.241] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="32.EXE.exe") returned 1 [0033.241] StrStrW (lpFirst="OWOW32WW.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.241] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.241] GetCurrentThreadId () returned 0x9b0 [0033.241] GetCurrentThreadId () returned 0x9b0 [0033.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996a8 [0033.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e480 [0033.241] RtlWakeConditionVariable () returned 0x27e800 [0033.241] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.241] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0033.241] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Windows") returned -1 [0033.241] lstrcmpW (lpString1="PidGenX.dll", lpString2="32.EXE.exe") returned 1 [0033.241] StrStrW (lpFirst="PidGenX.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.241] lstrcmpW (lpString1="PidGenX.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.241] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.241] GetCurrentThreadId () returned 0x9b0 [0033.241] GetCurrentThreadId () returned 0x9b0 [0033.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2996e0 [0033.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e528 [0033.242] RtlWakeConditionVariable () returned 0x27e800 [0033.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.242] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x48, dwReserved1=0x260000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0033.242] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0033.242] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="32.EXE.exe") returned 1 [0033.242] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.242] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0033.242] GetCurrentThreadId () returned 0x9b0 [0033.242] GetCurrentThreadId () returned 0x9b0 [0033.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299718 [0033.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9980 [0033.242] RtlWakeConditionVariable () returned 0x27e800 [0033.242] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0033.242] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0033.242] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="Windows") returned -1 [0033.242] lstrcmpW (lpString1="ProPlusrWW.msi", lpString2="32.EXE.exe") returned 1 [0033.242] StrStrW (lpFirst="ProPlusrWW.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.242] lstrcmpW (lpString1="ProPlusrWW.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.242] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.242] GetCurrentThreadId () returned 0x9b0 [0033.242] GetCurrentThreadId () returned 0x9b0 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299750 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c0f0 [0033.243] RtlWakeConditionVariable () returned 0x27e800 [0033.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0033.243] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0033.243] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="Windows") returned -1 [0033.243] lstrcmpW (lpString1="ProPlusrWW.xml", lpString2="32.EXE.exe") returned 1 [0033.243] StrStrW (lpFirst="ProPlusrWW.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.243] lstrcmpW (lpString1="ProPlusrWW.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.243] GetCurrentThreadId () returned 0x9b0 [0033.243] GetCurrentThreadId () returned 0x9b0 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299788 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c1a8 [0033.243] RtlWakeConditionVariable () returned 0x27e800 [0033.243] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bd58 | out: hHeap=0x260000) returned 1 [0033.243] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0033.243] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="Windows") returned -1 [0033.243] lstrcmpW (lpString1="ProPrWW.cab", lpString2="32.EXE.exe") returned 1 [0033.243] StrStrW (lpFirst="ProPrWW.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.243] lstrcmpW (lpString1="ProPrWW.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.243] GetCurrentThreadId () returned 0x9b0 [0033.243] GetCurrentThreadId () returned 0x9b0 [0033.243] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997c0 [0033.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e5d0 [0033.244] RtlWakeConditionVariable () returned 0x27e800 [0033.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.244] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0033.244] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="Windows") returned -1 [0033.244] lstrcmpW (lpString1="ProPrWW2.cab", lpString2="32.EXE.exe") returned 1 [0033.244] StrStrW (lpFirst="ProPrWW2.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.244] lstrcmpW (lpString1="ProPrWW2.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.244] GetCurrentThreadId () returned 0x9b0 [0033.244] GetCurrentThreadId () returned 0x9b0 [0033.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2997f8 [0033.244] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e678 [0033.244] RtlWakeConditionVariable () returned 0x27e800 [0033.244] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.244] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x48, dwReserved1=0x260000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0033.244] lstrcmpiW (lpString1="setup.exe", lpString2="Windows") returned -1 [0033.244] lstrcmpW (lpString1="setup.exe", lpString2="32.EXE.exe") returned 1 [0033.245] StrStrW (lpFirst="setup.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.245] lstrcmpW (lpString1="setup.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.245] GetCurrentThreadId () returned 0x9b0 [0033.245] GetCurrentThreadId () returned 0x9b0 [0033.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299830 [0033.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e720 [0033.245] RtlWakeConditionVariable () returned 0x27e800 [0033.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.245] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0033.245] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0033.245] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0033.245] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.245] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.245] GetCurrentThreadId () returned 0x9b0 [0033.245] GetCurrentThreadId () returned 0x9b0 [0033.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299868 [0033.245] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0033.245] RtlWakeConditionVariable () returned 0x27e800 [0033.245] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.245] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0033.245] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0033.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0033.246] GetCurrentThreadId () returned 0x9b0 [0033.246] GetCurrentThreadId () returned 0x9b0 [0033.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998a0 [0033.246] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9a48 [0033.246] RtlWakeConditionVariable () returned 0x27e800 [0033.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0033.246] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0033.246] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0033.246] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0033.246] lstrcmpW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0033.246] lstrcmpW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0033.246] lstrcmpW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0033.246] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0033.246] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0033.247] lstrlenW (lpString="C:\\Windows") returned 10 [0033.247] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0033.247] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0033.247] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0033.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0033.714] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0033.714] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.714] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0033.714] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.714] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0033.715] GetCurrentThreadId () returned 0x9b0 [0033.715] GetCurrentThreadId () returned 0x9b0 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1aa0 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296728 [0033.715] RtlWakeConditionVariable () returned 0x27e800 [0033.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0033.715] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0033.715] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0033.715] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.715] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.715] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0033.715] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.715] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0033.715] GetCurrentThreadId () returned 0x9b0 [0033.715] GetCurrentThreadId () returned 0x9b0 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a68 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2967c0 [0033.715] RtlWakeConditionVariable () returned 0x27e800 [0033.715] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0033.715] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0033.715] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Windows") returned -1 [0033.715] lstrcmpW (lpString1="Office32WW.msi", lpString2="32.EXE.exe") returned 1 [0033.715] StrStrW (lpFirst="Office32WW.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.715] lstrcmpW (lpString1="Office32WW.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.715] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0033.715] GetCurrentThreadId () returned 0x9b0 [0033.716] GetCurrentThreadId () returned 0x9b0 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1a30 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bd58 [0033.716] RtlWakeConditionVariable () returned 0x27e800 [0033.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0033.716] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0033.716] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Windows") returned -1 [0033.716] lstrcmpW (lpString1="Office32WW.xml", lpString2="32.EXE.exe") returned 1 [0033.716] StrStrW (lpFirst="Office32WW.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.716] lstrcmpW (lpString1="Office32WW.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0033.716] GetCurrentThreadId () returned 0x9b0 [0033.716] GetCurrentThreadId () returned 0x9b0 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2998d8 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c260 [0033.716] RtlWakeConditionVariable () returned 0x27e800 [0033.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0033.716] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0033.716] lstrcmpiW (lpString1="ose.exe", lpString2="Windows") returned -1 [0033.716] lstrcmpW (lpString1="ose.exe", lpString2="32.EXE.exe") returned 1 [0033.716] StrStrW (lpFirst="ose.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.716] lstrcmpW (lpString1="ose.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.716] GetCurrentThreadId () returned 0x9b0 [0033.716] GetCurrentThreadId () returned 0x9b0 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299910 [0033.716] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e870 [0033.716] RtlWakeConditionVariable () returned 0x27e800 [0033.716] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.717] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x48, dwReserved1=0x260000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0033.717] lstrcmpiW (lpString1="osetup.dll", lpString2="Windows") returned -1 [0033.717] lstrcmpW (lpString1="osetup.dll", lpString2="32.EXE.exe") returned 1 [0033.717] StrStrW (lpFirst="osetup.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.717] lstrcmpW (lpString1="osetup.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.717] GetCurrentThreadId () returned 0x9b0 [0033.717] GetCurrentThreadId () returned 0x9b0 [0033.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x299948 [0033.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e918 [0033.717] RtlWakeConditionVariable () returned 0x27e800 [0033.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.717] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0033.717] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Windows") returned -1 [0033.717] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="32.EXE.exe") returned 1 [0033.717] StrStrW (lpFirst="OWOW32WW.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.717] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.717] GetCurrentThreadId () returned 0x9b0 [0033.717] GetCurrentThreadId () returned 0x9b0 [0033.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294598 [0033.717] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e9c0 [0033.717] RtlWakeConditionVariable () returned 0x27e800 [0033.717] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.717] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0033.717] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Windows") returned -1 [0033.717] lstrcmpW (lpString1="PidGenX.dll", lpString2="32.EXE.exe") returned 1 [0033.717] StrStrW (lpFirst="PidGenX.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.717] lstrcmpW (lpString1="PidGenX.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.718] GetCurrentThreadId () returned 0x9b0 [0033.718] GetCurrentThreadId () returned 0x9b0 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2945d0 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ea68 [0033.718] RtlWakeConditionVariable () returned 0x27e800 [0033.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.718] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x48, dwReserved1=0x260000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0033.718] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0033.718] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="32.EXE.exe") returned 1 [0033.718] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.718] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0033.718] GetCurrentThreadId () returned 0x9b0 [0033.718] GetCurrentThreadId () returned 0x9b0 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294608 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9b10 [0033.718] RtlWakeConditionVariable () returned 0x27e800 [0033.718] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0033.718] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0033.718] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="Windows") returned -1 [0033.718] lstrcmpW (lpString1="PrjProrWW.msi", lpString2="32.EXE.exe") returned 1 [0033.718] StrStrW (lpFirst="PrjProrWW.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.718] lstrcmpW (lpString1="PrjProrWW.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0033.718] GetCurrentThreadId () returned 0x9b0 [0033.718] GetCurrentThreadId () returned 0x9b0 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294640 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c318 [0033.719] RtlWakeConditionVariable () returned 0x27e800 [0033.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0033.719] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0033.719] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="Windows") returned -1 [0033.719] lstrcmpW (lpString1="PrjProrWW.xml", lpString2="32.EXE.exe") returned 1 [0033.719] StrStrW (lpFirst="PrjProrWW.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.719] lstrcmpW (lpString1="PrjProrWW.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0033.719] GetCurrentThreadId () returned 0x9b0 [0033.719] GetCurrentThreadId () returned 0x9b0 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294678 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c3d0 [0033.719] RtlWakeConditionVariable () returned 0x27e800 [0033.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29bca0 | out: hHeap=0x260000) returned 1 [0033.719] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0033.719] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="Windows") returned -1 [0033.719] lstrcmpW (lpString1="PrjPrrWW.cab", lpString2="32.EXE.exe") returned 1 [0033.719] StrStrW (lpFirst="PrjPrrWW.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.719] lstrcmpW (lpString1="PrjPrrWW.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.719] GetCurrentThreadId () returned 0x9b0 [0033.719] GetCurrentThreadId () returned 0x9b0 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946b0 [0033.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29eb10 [0033.719] RtlWakeConditionVariable () returned 0x27e800 [0033.719] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.719] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x48, dwReserved1=0x260000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0033.720] lstrcmpiW (lpString1="setup.exe", lpString2="Windows") returned -1 [0033.720] lstrcmpW (lpString1="setup.exe", lpString2="32.EXE.exe") returned 1 [0033.720] StrStrW (lpFirst="setup.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.720] lstrcmpW (lpString1="setup.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.720] GetCurrentThreadId () returned 0x9b0 [0033.720] GetCurrentThreadId () returned 0x9b0 [0033.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2946e8 [0033.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ebb8 [0033.720] RtlWakeConditionVariable () returned 0x27e800 [0033.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.720] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0033.720] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0033.720] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0033.720] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0033.720] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0033.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0033.720] GetCurrentThreadId () returned 0x9b0 [0033.720] GetCurrentThreadId () returned 0x9b0 [0033.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294720 [0033.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ec60 [0033.720] RtlWakeConditionVariable () returned 0x27e800 [0033.720] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d028 | out: hHeap=0x260000) returned 1 [0033.720] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0033.720] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0033.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0033.721] GetCurrentThreadId () returned 0x9b0 [0033.721] GetCurrentThreadId () returned 0x9b0 [0033.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294758 [0033.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9bd8 [0033.721] RtlWakeConditionVariable () returned 0x27e800 [0033.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0033.721] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2c5248 | out: hHeap=0x260000) returned 1 [0033.721] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0033.722] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0033.722] lstrcmpW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0033.722] lstrcmpW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0033.722] lstrcmpW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="AppData") returned -1 [0033.722] StrStrW (lpFirst="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpSrch="AppData") returned 0x0 [0033.722] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="C:\\Windows") returned -1 [0033.722] lstrlenW (lpString="C:\\Windows") returned 10 [0033.722] lstrcmpiW (lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="C:\\System Volume Information") returned -1 [0033.722] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0033.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0033.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0034.083] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.083] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.083] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.083] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.083] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.083] GetCurrentThreadId () returned 0x9b0 [0034.083] GetCurrentThreadId () returned 0x9b0 [0034.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1b10 [0034.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296858 [0034.083] RtlWakeConditionVariable () returned 0x27e800 [0034.083] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0034.083] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.083] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.083] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.083] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.083] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.083] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.083] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.083] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.083] GetCurrentThreadId () returned 0x9b0 [0034.084] GetCurrentThreadId () returned 0x9b0 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1ad8 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0034.084] RtlWakeConditionVariable () returned 0x27e800 [0034.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x295be0 | out: hHeap=0x260000) returned 1 [0034.084] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0034.084] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Windows") returned -1 [0034.084] lstrcmpW (lpString1="Office32WW.msi", lpString2="32.EXE.exe") returned 1 [0034.084] StrStrW (lpFirst="Office32WW.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.084] lstrcmpW (lpString1="Office32WW.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0034.084] GetCurrentThreadId () returned 0x9b0 [0034.084] GetCurrentThreadId () returned 0x9b0 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294790 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0034.084] RtlWakeConditionVariable () returned 0x27e800 [0034.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0034.084] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0034.084] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Windows") returned -1 [0034.084] lstrcmpW (lpString1="Office32WW.xml", lpString2="32.EXE.exe") returned 1 [0034.084] StrStrW (lpFirst="Office32WW.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.084] lstrcmpW (lpString1="Office32WW.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0034.084] GetCurrentThreadId () returned 0x9b0 [0034.084] GetCurrentThreadId () returned 0x9b0 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2947c8 [0034.084] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c5f8 [0034.084] RtlWakeConditionVariable () returned 0x27e800 [0034.084] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c540 | out: hHeap=0x260000) returned 1 [0034.084] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x48, dwReserved1=0x260000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0034.085] lstrcmpiW (lpString1="ose.exe", lpString2="Windows") returned -1 [0034.085] lstrcmpW (lpString1="ose.exe", lpString2="32.EXE.exe") returned 1 [0034.085] StrStrW (lpFirst="ose.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.085] lstrcmpW (lpString1="ose.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.085] GetCurrentThreadId () returned 0x9b0 [0034.085] GetCurrentThreadId () returned 0x9b0 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294800 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cf80 [0034.085] RtlWakeConditionVariable () returned 0x27e800 [0034.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.085] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x48, dwReserved1=0x260000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0034.085] lstrcmpiW (lpString1="osetup.dll", lpString2="Windows") returned -1 [0034.085] lstrcmpW (lpString1="osetup.dll", lpString2="32.EXE.exe") returned 1 [0034.085] StrStrW (lpFirst="osetup.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.085] lstrcmpW (lpString1="osetup.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.085] GetCurrentThreadId () returned 0x9b0 [0034.085] GetCurrentThreadId () returned 0x9b0 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294838 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d028 [0034.085] RtlWakeConditionVariable () returned 0x27e800 [0034.085] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.085] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x48, dwReserved1=0x260000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0034.085] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Windows") returned -1 [0034.085] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="32.EXE.exe") returned 1 [0034.085] StrStrW (lpFirst="OWOW32WW.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.085] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.086] GetCurrentThreadId () returned 0x9b0 [0034.086] GetCurrentThreadId () returned 0x9b0 [0034.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294870 [0034.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5ad8 [0034.086] RtlWakeConditionVariable () returned 0x27e800 [0034.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.086] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x48, dwReserved1=0x260000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0034.086] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Windows") returned -1 [0034.086] lstrcmpW (lpString1="PidGenX.dll", lpString2="32.EXE.exe") returned 1 [0034.086] StrStrW (lpFirst="PidGenX.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.086] lstrcmpW (lpString1="PidGenX.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.086] GetCurrentThreadId () returned 0x9b0 [0034.086] GetCurrentThreadId () returned 0x9b0 [0034.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948a8 [0034.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5b80 [0034.086] RtlWakeConditionVariable () returned 0x27e800 [0034.086] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.086] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x48, dwReserved1=0x260000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0034.086] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0034.087] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="32.EXE.exe") returned 1 [0034.087] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.087] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0034.087] GetCurrentThreadId () returned 0x9b0 [0034.087] GetCurrentThreadId () returned 0x9b0 [0034.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2948e0 [0034.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9ca0 [0034.087] RtlWakeConditionVariable () returned 0x27e800 [0034.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2d98b8 | out: hHeap=0x260000) returned 1 [0034.087] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x48, dwReserved1=0x260000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0034.087] lstrcmpiW (lpString1="setup.exe", lpString2="Windows") returned -1 [0034.087] lstrcmpW (lpString1="setup.exe", lpString2="32.EXE.exe") returned 1 [0034.087] StrStrW (lpFirst="setup.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.087] lstrcmpW (lpString1="setup.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.087] GetCurrentThreadId () returned 0x9b0 [0034.087] GetCurrentThreadId () returned 0x9b0 [0034.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294918 [0034.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5c28 [0034.087] RtlWakeConditionVariable () returned 0x27e800 [0034.087] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.087] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x48, dwReserved1=0x260000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0034.087] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0034.088] lstrcmpW (lpString1="Setup.xml", lpString2="32.EXE.exe") returned 1 [0034.088] StrStrW (lpFirst="Setup.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.088] lstrcmpW (lpString1="Setup.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.088] GetCurrentThreadId () returned 0x9b0 [0034.088] GetCurrentThreadId () returned 0x9b0 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294950 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5cd0 [0034.088] RtlWakeConditionVariable () returned 0x27e800 [0034.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.088] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0034.088] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="Windows") returned -1 [0034.088] lstrcmpW (lpString1="VisiorWW.cab", lpString2="32.EXE.exe") returned 1 [0034.088] StrStrW (lpFirst="VisiorWW.cab", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.088] lstrcmpW (lpString1="VisiorWW.cab", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.088] GetCurrentThreadId () returned 0x9b0 [0034.088] GetCurrentThreadId () returned 0x9b0 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294988 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5d78 [0034.088] RtlWakeConditionVariable () returned 0x27e800 [0034.088] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.088] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0034.088] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="Windows") returned -1 [0034.088] lstrcmpW (lpString1="VisiorWW.msi", lpString2="32.EXE.exe") returned 1 [0034.088] StrStrW (lpFirst="VisiorWW.msi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.088] lstrcmpW (lpString1="VisiorWW.msi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.088] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.088] GetCurrentThreadId () returned 0x9b0 [0034.088] GetCurrentThreadId () returned 0x9b0 [0034.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949c0 [0034.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5e20 [0034.089] RtlWakeConditionVariable () returned 0x27e800 [0034.089] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29cd88 | out: hHeap=0x260000) returned 1 [0034.089] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0034.089] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="Windows") returned -1 [0034.089] lstrcmpW (lpString1="VisiorWW.xml", lpString2="32.EXE.exe") returned 1 [0034.089] StrStrW (lpFirst="VisiorWW.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.089] lstrcmpW (lpString1="VisiorWW.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29cd88 [0034.089] GetCurrentThreadId () returned 0x9b0 [0034.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2949f8 [0034.089] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f5ec8 [0034.089] RtlWakeConditionVariable () returned 0x27e800 [0034.089] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x48, dwReserved1=0x260000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0034.089] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0034.090] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0034.090] GetCurrentThreadId () returned 0x9b0 [0034.090] RtlWakeConditionVariable () returned 0x27e800 [0034.091] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0034.091] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x27d138 [0034.092] GetCurrentThreadId () returned 0x9b0 [0034.092] RtlWakeConditionVariable () returned 0x27e800 [0034.092] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0034.092] FindClose (in: hFindFile=0x27bab0 | out: hFindFile=0x27bab0) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2b3a38 [0034.092] GetCurrentThreadId () returned 0x9b0 [0034.092] RtlWakeConditionVariable () returned 0x27e800 [0034.092] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0034.092] lstrcmpiW (lpString1="pagefile.sys", lpString2="Windows") returned -1 [0034.092] lstrcmpW (lpString1="pagefile.sys", lpString2="32.EXE.exe") returned 1 [0034.092] StrStrW (lpFirst="pagefile.sys", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.092] lstrcmpW (lpString1="pagefile.sys", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294ad8 [0034.092] GetCurrentThreadId () returned 0x9b0 [0034.092] RtlWakeConditionVariable () returned 0x27e800 [0034.092] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0034.092] lstrcmpiW (lpString1="PerfLogs", lpString2="Windows") returned -1 [0034.092] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0034.092] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0034.092] lstrcmpW (lpString1="PerfLogs", lpString2="AppData") returned 1 [0034.093] StrStrW (lpFirst="\\\\?\\C:\\PerfLogs", lpSrch="AppData") returned 0x0 [0034.093] lstrcmpiW (lpString1="C:\\PerfLogs", lpString2="C:\\Windows") returned -1 [0034.093] lstrlenW (lpString="C:\\Windows") returned 10 [0034.093] lstrcmpiW (lpString1="C:\\PerfLogs", lpString2="C:\\System Volume Information") returned -1 [0034.093] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a1d80 [0034.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27bab0 [0034.093] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.093] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.093] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.093] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.093] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.093] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.093] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.093] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.093] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.093] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.093] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.093] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.093] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="Admin", cAlternateFileName="")) returned 1 [0034.094] lstrcmpiW (lpString1="Admin", lpString2="Windows") returned -1 [0034.094] lstrcmpW (lpString1="Admin", lpString2=".") returned 1 [0034.094] lstrcmpW (lpString1="Admin", lpString2="..") returned 1 [0034.094] lstrcmpW (lpString1="Admin", lpString2="AppData") returned -1 [0034.094] StrStrW (lpFirst="\\\\?\\C:\\PerfLogs\\Admin", lpSrch="AppData") returned 0x0 [0034.094] lstrcmpiW (lpString1="C:\\PerfLogs\\Admin", lpString2="C:\\Windows") returned -1 [0034.094] lstrlenW (lpString="C:\\Windows") returned 10 [0034.094] lstrcmpiW (lpString1="C:\\PerfLogs\\Admin", lpString2="C:\\System Volume Information") returned -1 [0034.094] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0034.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2ec8 [0034.094] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.094] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.094] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.094] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.094] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.094] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.094] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.094] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.094] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.094] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.094] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.094] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.094] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.095] FindClose (in: hFindFile=0x2b2ec8 | out: hFindFile=0x2b2ec8) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0034.095] GetCurrentThreadId () returned 0x9b0 [0034.095] RtlWakeConditionVariable () returned 0x27e800 [0034.095] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="Admin", cAlternateFileName="")) returned 0 [0034.095] FindClose (in: hFindFile=0x27bab0 | out: hFindFile=0x27bab0) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2b3a38 [0034.095] GetCurrentThreadId () returned 0x9b0 [0034.095] RtlWakeConditionVariable () returned 0x27e800 [0034.095] FindNextFileW (in: hFindFile=0x27ba70, lpFindFileData=0x260fd28 | out: lpFindFileData=0x260fd28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9af080b0, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x9af080b0, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0034.095] lstrcmpiW (lpString1="Program Files", lpString2="Windows") returned -1 [0034.095] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0034.095] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0034.095] lstrcmpW (lpString1="Program Files", lpString2="AppData") returned 1 [0034.095] StrStrW (lpFirst="\\\\?\\C:\\Program Files", lpSrch="AppData") returned 0x0 [0034.095] lstrcmpiW (lpString1="C:\\Program Files", lpString2="C:\\Windows") returned -1 [0034.095] lstrlenW (lpString="C:\\Windows") returned 10 [0034.095] lstrcmpiW (lpString1="C:\\Program Files", lpString2="C:\\System Volume Information") returned -1 [0034.095] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2a1d80 [0034.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9af080b0, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x9af080b0, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27bab0 [0034.095] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.096] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.096] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.096] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.096] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0034.096] GetCurrentThreadId () returned 0x9b0 [0034.096] RtlWakeConditionVariable () returned 0x27e800 [0034.096] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9af080b0, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x9af080b0, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.096] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.096] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.096] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.096] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.096] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.096] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x294bb8 [0034.096] GetCurrentThreadId () returned 0x9b0 [0034.096] RtlWakeConditionVariable () returned 0x27e800 [0034.096] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0034.096] lstrcmpiW (lpString1="Common Files", lpString2="Windows") returned -1 [0034.096] lstrcmpW (lpString1="Common Files", lpString2=".") returned 1 [0034.096] lstrcmpW (lpString1="Common Files", lpString2="..") returned 1 [0034.096] lstrcmpW (lpString1="Common Files", lpString2="AppData") returned 1 [0034.096] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files", lpSrch="AppData") returned 0x0 [0034.096] lstrcmpiW (lpString1="C:\\Program Files\\Common Files", lpString2="C:\\Windows") returned -1 [0034.096] lstrlenW (lpString="C:\\Windows") returned 10 [0034.096] lstrcmpiW (lpString1="C:\\Program Files\\Common Files", lpString2="C:\\System Volume Information") returned -1 [0034.096] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0034.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2b2ec8 [0034.097] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.097] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.097] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.097] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.097] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.097] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.097] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.097] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.097] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.097] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.097] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0034.097] lstrcmpiW (lpString1="DESIGNER", lpString2="Windows") returned -1 [0034.097] lstrcmpW (lpString1="DESIGNER", lpString2=".") returned 1 [0034.097] lstrcmpW (lpString1="DESIGNER", lpString2="..") returned 1 [0034.097] lstrcmpW (lpString1="DESIGNER", lpString2="AppData") returned 1 [0034.097] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER", lpSrch="AppData") returned 0x0 [0034.097] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\DESIGNER", lpString2="C:\\Windows") returned -1 [0034.097] lstrlenW (lpString="C:\\Windows") returned 10 [0034.097] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\DESIGNER", lpString2="C:\\System Volume Information") returned -1 [0034.097] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0034.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3fa0 [0034.098] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.098] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.098] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.098] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.098] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.098] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.099] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.099] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.099] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.099] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0034.099] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="Windows") returned -1 [0034.099] lstrcmpW (lpString1="MSADDNDR.DLL", lpString2="32.EXE.exe") returned 1 [0034.099] StrStrW (lpFirst="MSADDNDR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.099] lstrcmpW (lpString1="MSADDNDR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0034.099] GetCurrentThreadId () returned 0x9b0 [0034.099] RtlWakeConditionVariable () returned 0x27e800 [0034.099] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0034.099] FindClose (in: hFindFile=0x2b3fa0 | out: hFindFile=0x2b3fa0) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.099] GetCurrentThreadId () returned 0x9b0 [0034.099] RtlWakeConditionVariable () returned 0x27e800 [0034.100] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0034.100] lstrcmpiW (lpString1="Microsoft Shared", lpString2="Windows") returned -1 [0034.100] lstrcmpW (lpString1="Microsoft Shared", lpString2=".") returned 1 [0034.100] lstrcmpW (lpString1="Microsoft Shared", lpString2="..") returned 1 [0034.100] lstrcmpW (lpString1="Microsoft Shared", lpString2="AppData") returned 1 [0034.100] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared", lpSrch="AppData") returned 0x0 [0034.100] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared", lpString2="C:\\Windows") returned -1 [0034.100] lstrlenW (lpString="C:\\Windows") returned 10 [0034.100] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared", lpString2="C:\\System Volume Information") returned -1 [0034.100] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0034.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3fa0 [0034.100] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.100] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.100] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.101] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.101] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.101] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.101] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.101] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.101] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.101] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.101] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.101] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0034.101] lstrcmpiW (lpString1="DW", lpString2="Windows") returned -1 [0034.101] lstrcmpW (lpString1="DW", lpString2=".") returned 1 [0034.101] lstrcmpW (lpString1="DW", lpString2="..") returned 1 [0034.101] lstrcmpW (lpString1="DW", lpString2="AppData") returned 1 [0034.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW", lpSrch="AppData") returned 0x0 [0034.102] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", lpString2="C:\\Windows") returned -1 [0034.102] lstrlenW (lpString="C:\\Windows") returned 10 [0034.102] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", lpString2="C:\\System Volume Information") returned -1 [0034.102] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f8ac8 [0034.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.225] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.226] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.226] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.226] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.226] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.226] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.226] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.226] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.226] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.226] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0034.226] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="Windows") returned -1 [0034.226] lstrcmpW (lpString1="DBGHELP.DLL", lpString2="32.EXE.exe") returned 1 [0034.226] StrStrW (lpFirst="DBGHELP.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.226] lstrcmpW (lpString1="DBGHELP.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.226] GetCurrentThreadId () returned 0x9b0 [0034.226] RtlWakeConditionVariable () returned 0x27e800 [0034.226] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0034.226] lstrcmpiW (lpString1="DW20.EXE", lpString2="Windows") returned -1 [0034.226] lstrcmpW (lpString1="DW20.EXE", lpString2="32.EXE.exe") returned 1 [0034.366] StrStrW (lpFirst="DW20.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.366] lstrcmpW (lpString1="DW20.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.366] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x2d5250 [0034.366] GetCurrentThreadId () returned 0x9b0 [0034.366] RtlWakeConditionVariable () returned 0x27e800 [0034.366] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0034.366] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="Windows") returned -1 [0034.367] lstrcmpW (lpString1="DWTRIG20.EXE", lpString2="32.EXE.exe") returned 1 [0034.367] StrStrW (lpFirst="DWTRIG20.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.367] lstrcmpW (lpString1="DWTRIG20.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.367] GetCurrentThreadId () returned 0x9b0 [0034.367] RtlWakeConditionVariable () returned 0x27e800 [0034.367] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0034.367] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0034.367] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c540 [0034.367] GetCurrentThreadId () returned 0x9b0 [0034.367] RtlWakeConditionVariable () returned 0x27e800 [0034.367] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0034.367] lstrcmpiW (lpString1="EQUATION", lpString2="Windows") returned -1 [0034.367] lstrcmpW (lpString1="EQUATION", lpString2=".") returned 1 [0034.367] lstrcmpW (lpString1="EQUATION", lpString2="..") returned 1 [0034.367] lstrcmpW (lpString1="EQUATION", lpString2="AppData") returned 1 [0034.367] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", lpSrch="AppData") returned 0x0 [0034.368] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", lpString2="C:\\Windows") returned -1 [0034.368] lstrlenW (lpString="C:\\Windows") returned 10 [0034.368] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", lpString2="C:\\System Volume Information") returned -1 [0034.368] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2dcab8 [0034.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.369] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.369] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.369] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.369] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.369] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.369] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.369] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.369] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.369] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.369] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.369] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.369] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.369] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.369] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0034.369] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0034.369] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0034.369] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0034.369] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", lpSrch="AppData") returned 0x0 [0034.369] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", lpString2="C:\\Windows") returned -1 [0034.369] lstrlenW (lpString="C:\\Windows") returned 10 [0034.369] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", lpString2="C:\\System Volume Information") returned -1 [0034.369] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f8ac8 [0034.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0034.637] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.637] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.637] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.637] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.637] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.637] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.637] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.637] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.637] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.637] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.637] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.637] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.637] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0034.637] lstrcmpiW (lpString1="EEINTL.DLL", lpString2="Windows") returned -1 [0034.637] lstrcmpW (lpString1="EEINTL.DLL", lpString2="32.EXE.exe") returned 1 [0034.637] StrStrW (lpFirst="EEINTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.637] lstrcmpW (lpString1="EEINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.637] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.637] GetCurrentThreadId () returned 0x9b0 [0034.637] RtlWakeConditionVariable () returned 0x27e800 [0034.637] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0034.637] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0034.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0034.638] GetCurrentThreadId () returned 0x9b0 [0034.638] RtlWakeConditionVariable () returned 0x27e800 [0034.638] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0034.638] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="Windows") returned -1 [0034.638] lstrcmpW (lpString1="EQNEDT32.CNT", lpString2="32.EXE.exe") returned 1 [0034.638] StrStrW (lpFirst="EQNEDT32.CNT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.638] lstrcmpW (lpString1="EQNEDT32.CNT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.638] GetCurrentThreadId () returned 0x9b0 [0034.638] RtlWakeConditionVariable () returned 0x27e800 [0034.638] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0034.638] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="Windows") returned -1 [0034.638] lstrcmpW (lpString1="EQNEDT32.EXE", lpString2="32.EXE.exe") returned 1 [0034.638] StrStrW (lpFirst="EQNEDT32.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.638] lstrcmpW (lpString1="EQNEDT32.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.638] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.638] GetCurrentThreadId () returned 0x9b0 [0034.638] RtlWakeConditionVariable () returned 0x27e800 [0034.638] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0034.638] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="Windows") returned -1 [0034.638] lstrcmpW (lpString1="eqnedt32.exe.manifest", lpString2="32.EXE.exe") returned 1 [0034.638] StrStrW (lpFirst="eqnedt32.exe.manifest", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.639] lstrcmpW (lpString1="eqnedt32.exe.manifest", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c8d8 [0034.639] GetCurrentThreadId () returned 0x9b0 [0034.639] RtlWakeConditionVariable () returned 0x27e800 [0034.639] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0034.639] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="Windows") returned -1 [0034.639] lstrcmpW (lpString1="EQNEDT32.HLP", lpString2="32.EXE.exe") returned 1 [0034.639] StrStrW (lpFirst="EQNEDT32.HLP", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.639] lstrcmpW (lpString1="EQNEDT32.HLP", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.639] GetCurrentThreadId () returned 0x9b0 [0034.639] RtlWakeConditionVariable () returned 0x27e800 [0034.639] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0034.639] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="Windows") returned -1 [0034.639] lstrcmpW (lpString1="MTEXTRA.TTF", lpString2="32.EXE.exe") returned 1 [0034.639] StrStrW (lpFirst="MTEXTRA.TTF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.639] lstrcmpW (lpString1="MTEXTRA.TTF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.639] GetCurrentThreadId () returned 0x9b0 [0034.639] RtlWakeConditionVariable () returned 0x27e800 [0034.639] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0034.639] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0034.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c8d8 [0034.639] GetCurrentThreadId () returned 0x9b0 [0034.639] RtlWakeConditionVariable () returned 0x27e800 [0034.641] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0034.641] lstrcmpiW (lpString1="EURO", lpString2="Windows") returned -1 [0034.641] lstrcmpW (lpString1="EURO", lpString2=".") returned 1 [0034.641] lstrcmpW (lpString1="EURO", lpString2="..") returned 1 [0034.641] lstrcmpW (lpString1="EURO", lpString2="AppData") returned 1 [0034.641] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", lpSrch="AppData") returned 0x0 [0034.641] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", lpString2="C:\\Windows") returned -1 [0034.641] lstrlenW (lpString="C:\\Windows") returned 10 [0034.641] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", lpString2="C:\\System Volume Information") returned -1 [0034.641] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0034.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.652] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.652] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.652] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.652] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.652] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.652] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.652] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.652] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.652] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.652] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.652] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.652] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.652] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0034.652] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="Windows") returned -1 [0034.652] lstrcmpW (lpString1="MSOEURO.DLL", lpString2="32.EXE.exe") returned 1 [0034.652] StrStrW (lpFirst="MSOEURO.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.652] lstrcmpW (lpString1="MSOEURO.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.652] GetCurrentThreadId () returned 0x9b0 [0034.652] RtlWakeConditionVariable () returned 0x27e800 [0034.652] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0034.653] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0034.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c820 [0034.653] GetCurrentThreadId () returned 0x9b0 [0034.653] RtlWakeConditionVariable () returned 0x27e800 [0034.653] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0034.653] lstrcmpiW (lpString1="Filters", lpString2="Windows") returned -1 [0034.653] lstrcmpW (lpString1="Filters", lpString2=".") returned 1 [0034.653] lstrcmpW (lpString1="Filters", lpString2="..") returned 1 [0034.653] lstrcmpW (lpString1="Filters", lpString2="AppData") returned 1 [0034.653] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpSrch="AppData") returned 0x0 [0034.653] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpString2="C:\\Windows") returned -1 [0034.653] lstrlenW (lpString="C:\\Windows") returned 10 [0034.653] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpString2="C:\\System Volume Information") returned -1 [0034.653] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0034.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.657] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.657] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.657] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.657] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.657] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.658] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.658] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.658] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.658] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.658] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.658] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.658] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0034.658] lstrcmpiW (lpString1="msgfilt.dll", lpString2="Windows") returned -1 [0034.658] lstrcmpW (lpString1="msgfilt.dll", lpString2="32.EXE.exe") returned 1 [0034.658] StrStrW (lpFirst="msgfilt.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.658] lstrcmpW (lpString1="msgfilt.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.658] GetCurrentThreadId () returned 0x9b0 [0034.658] RtlWakeConditionVariable () returned 0x27e800 [0034.658] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0034.658] lstrcmpiW (lpString1="odffilt.dll", lpString2="Windows") returned -1 [0034.658] lstrcmpW (lpString1="odffilt.dll", lpString2="32.EXE.exe") returned 1 [0034.658] StrStrW (lpFirst="odffilt.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.658] lstrcmpW (lpString1="odffilt.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.658] GetCurrentThreadId () returned 0x9b0 [0034.658] RtlWakeConditionVariable () returned 0x27e800 [0034.658] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0034.658] lstrcmpiW (lpString1="offfiltx.dll", lpString2="Windows") returned -1 [0034.658] lstrcmpW (lpString1="offfiltx.dll", lpString2="32.EXE.exe") returned 1 [0034.658] StrStrW (lpFirst="offfiltx.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.658] lstrcmpW (lpString1="offfiltx.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.659] GetCurrentThreadId () returned 0x9b0 [0034.659] RtlWakeConditionVariable () returned 0x27e800 [0034.659] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0034.659] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="Windows") returned -1 [0034.659] lstrcmpW (lpString1="VISFILT.DLL", lpString2="32.EXE.exe") returned 1 [0034.659] StrStrW (lpFirst="VISFILT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.659] lstrcmpW (lpString1="VISFILT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.659] GetCurrentThreadId () returned 0x9b0 [0034.659] RtlWakeConditionVariable () returned 0x27e800 [0034.659] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0034.659] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c820 [0034.659] GetCurrentThreadId () returned 0x9b0 [0034.659] RtlWakeConditionVariable () returned 0x27e800 [0034.660] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0034.660] lstrcmpiW (lpString1="GRPHFLT", lpString2="Windows") returned -1 [0034.660] lstrcmpW (lpString1="GRPHFLT", lpString2=".") returned 1 [0034.660] lstrcmpW (lpString1="GRPHFLT", lpString2="..") returned 1 [0034.660] lstrcmpW (lpString1="GRPHFLT", lpString2="AppData") returned 1 [0034.660] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", lpSrch="AppData") returned 0x0 [0034.660] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", lpString2="C:\\Windows") returned -1 [0034.660] lstrlenW (lpString="C:\\Windows") returned 10 [0034.660] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", lpString2="C:\\System Volume Information") returned -1 [0034.660] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.660] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0034.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.687] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.687] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.687] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.687] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.687] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.687] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.687] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.687] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.687] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.687] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.688] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.688] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.688] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0034.688] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="Windows") returned -1 [0034.688] lstrcmpW (lpString1="CGMIMP32.CFG", lpString2="32.EXE.exe") returned 1 [0034.688] StrStrW (lpFirst="CGMIMP32.CFG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.688] lstrcmpW (lpString1="CGMIMP32.CFG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.688] GetCurrentThreadId () returned 0x9b0 [0034.688] RtlWakeConditionVariable () returned 0x27e800 [0034.688] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0034.688] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="Windows") returned -1 [0034.688] lstrcmpW (lpString1="CGMIMP32.FLT", lpString2="32.EXE.exe") returned 1 [0034.688] StrStrW (lpFirst="CGMIMP32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.688] lstrcmpW (lpString1="CGMIMP32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.688] GetCurrentThreadId () returned 0x9b0 [0034.688] RtlWakeConditionVariable () returned 0x27e800 [0034.688] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0034.688] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="Windows") returned -1 [0034.688] lstrcmpW (lpString1="CGMIMP32.FNT", lpString2="32.EXE.exe") returned 1 [0034.688] StrStrW (lpFirst="CGMIMP32.FNT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.688] lstrcmpW (lpString1="CGMIMP32.FNT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.688] GetCurrentThreadId () returned 0x9b0 [0034.688] RtlWakeConditionVariable () returned 0x27e800 [0034.688] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0034.688] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="Windows") returned -1 [0034.688] lstrcmpW (lpString1="EPSIMP32.FLT", lpString2="32.EXE.exe") returned 1 [0034.689] StrStrW (lpFirst="EPSIMP32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.689] lstrcmpW (lpString1="EPSIMP32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.689] GetCurrentThreadId () returned 0x9b0 [0034.689] RtlWakeConditionVariable () returned 0x27e800 [0034.689] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0034.689] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="Windows") returned -1 [0034.689] lstrcmpW (lpString1="GIFIMP32.FLT", lpString2="32.EXE.exe") returned 1 [0034.689] StrStrW (lpFirst="GIFIMP32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.689] lstrcmpW (lpString1="GIFIMP32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.689] GetCurrentThreadId () returned 0x9b0 [0034.689] RtlWakeConditionVariable () returned 0x27e800 [0034.689] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0034.689] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="Windows") returned -1 [0034.689] lstrcmpW (lpString1="JPEGIM32.FLT", lpString2="32.EXE.exe") returned 1 [0034.689] StrStrW (lpFirst="JPEGIM32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.689] lstrcmpW (lpString1="JPEGIM32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.689] GetCurrentThreadId () returned 0x9b0 [0034.689] RtlWakeConditionVariable () returned 0x27e800 [0034.689] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0034.689] lstrcmpiW (lpString1="MS.CGM", lpString2="Windows") returned -1 [0034.689] lstrcmpW (lpString1="MS.CGM", lpString2="32.EXE.exe") returned 1 [0034.689] StrStrW (lpFirst="MS.CGM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.689] lstrcmpW (lpString1="MS.CGM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.689] GetCurrentThreadId () returned 0x9b0 [0034.689] RtlWakeConditionVariable () returned 0x27e800 [0034.690] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0034.690] lstrcmpiW (lpString1="MS.EPS", lpString2="Windows") returned -1 [0034.690] lstrcmpW (lpString1="MS.EPS", lpString2="32.EXE.exe") returned 1 [0034.690] StrStrW (lpFirst="MS.EPS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.690] lstrcmpW (lpString1="MS.EPS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.690] GetCurrentThreadId () returned 0x9b0 [0034.690] RtlWakeConditionVariable () returned 0x27e800 [0034.690] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0034.690] lstrcmpiW (lpString1="MS.GIF", lpString2="Windows") returned -1 [0034.690] lstrcmpW (lpString1="MS.GIF", lpString2="32.EXE.exe") returned 1 [0034.690] StrStrW (lpFirst="MS.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.690] lstrcmpW (lpString1="MS.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.690] GetCurrentThreadId () returned 0x9b0 [0034.690] RtlWakeConditionVariable () returned 0x27e800 [0034.690] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0034.690] lstrcmpiW (lpString1="MS.JPG", lpString2="Windows") returned -1 [0034.690] lstrcmpW (lpString1="MS.JPG", lpString2="32.EXE.exe") returned 1 [0034.690] StrStrW (lpFirst="MS.JPG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.690] lstrcmpW (lpString1="MS.JPG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.690] GetCurrentThreadId () returned 0x9b0 [0034.690] RtlWakeConditionVariable () returned 0x27e800 [0034.691] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0034.691] lstrcmpiW (lpString1="MS.PNG", lpString2="Windows") returned -1 [0034.691] lstrcmpW (lpString1="MS.PNG", lpString2="32.EXE.exe") returned 1 [0034.691] StrStrW (lpFirst="MS.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.691] lstrcmpW (lpString1="MS.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.691] GetCurrentThreadId () returned 0x9b0 [0034.691] RtlWakeConditionVariable () returned 0x27e800 [0034.691] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0034.691] lstrcmpiW (lpString1="MS.WPG", lpString2="Windows") returned -1 [0034.691] lstrcmpW (lpString1="MS.WPG", lpString2="32.EXE.exe") returned 1 [0034.691] StrStrW (lpFirst="MS.WPG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.691] lstrcmpW (lpString1="MS.WPG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.691] GetCurrentThreadId () returned 0x9b0 [0034.691] RtlWakeConditionVariable () returned 0x27e800 [0034.691] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0034.691] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="Windows") returned -1 [0034.691] lstrcmpW (lpString1="PICTIM32.FLT", lpString2="32.EXE.exe") returned 1 [0034.691] StrStrW (lpFirst="PICTIM32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.691] lstrcmpW (lpString1="PICTIM32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.691] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.691] GetCurrentThreadId () returned 0x9b0 [0034.692] RtlWakeConditionVariable () returned 0x27e800 [0034.692] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0034.692] lstrcmpiW (lpString1="PNG32.FLT", lpString2="Windows") returned -1 [0034.692] lstrcmpW (lpString1="PNG32.FLT", lpString2="32.EXE.exe") returned 1 [0034.692] StrStrW (lpFirst="PNG32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.692] lstrcmpW (lpString1="PNG32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.692] GetCurrentThreadId () returned 0x9b0 [0034.692] RtlWakeConditionVariable () returned 0x27e800 [0034.692] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0034.692] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="Windows") returned 1 [0034.692] lstrcmpW (lpString1="WPGIMP32.FLT", lpString2="32.EXE.exe") returned 1 [0034.692] StrStrW (lpFirst="WPGIMP32.FLT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.692] lstrcmpW (lpString1="WPGIMP32.FLT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.692] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.692] GetCurrentThreadId () returned 0x9b0 [0034.692] RtlWakeConditionVariable () returned 0x27e800 [0034.692] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0034.692] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0034.693] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.693] GetCurrentThreadId () returned 0x9b0 [0034.693] RtlWakeConditionVariable () returned 0x27e800 [0034.694] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0034.695] lstrcmpiW (lpString1="Help", lpString2="Windows") returned -1 [0034.695] lstrcmpW (lpString1="Help", lpString2=".") returned 1 [0034.695] lstrcmpW (lpString1="Help", lpString2="..") returned 1 [0034.695] lstrcmpW (lpString1="Help", lpString2="AppData") returned 1 [0034.695] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help", lpSrch="AppData") returned 0x0 [0034.695] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", lpString2="C:\\Windows") returned -1 [0034.695] lstrlenW (lpString="C:\\Windows") returned 10 [0034.695] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", lpString2="C:\\System Volume Information") returned -1 [0034.695] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.695] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0034.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.696] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.696] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.696] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.696] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.696] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.696] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.696] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.696] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.696] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.696] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.696] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.696] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.696] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0034.696] lstrcmpiW (lpString1="hxds.dll", lpString2="Windows") returned -1 [0034.696] lstrcmpW (lpString1="hxds.dll", lpString2="32.EXE.exe") returned 1 [0034.697] StrStrW (lpFirst="hxds.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.697] lstrcmpW (lpString1="hxds.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.697] GetCurrentThreadId () returned 0x9b0 [0034.697] RtlWakeConditionVariable () returned 0x27e800 [0034.697] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0034.697] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="Windows") returned -1 [0034.697] lstrcmpW (lpString1="ITIRCL55.DLL", lpString2="32.EXE.exe") returned 1 [0034.697] StrStrW (lpFirst="ITIRCL55.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.697] lstrcmpW (lpString1="ITIRCL55.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.697] GetCurrentThreadId () returned 0x9b0 [0034.697] RtlWakeConditionVariable () returned 0x27e800 [0034.697] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0034.697] lstrcmpiW (lpString1="msitss55.dll", lpString2="Windows") returned -1 [0034.697] lstrcmpW (lpString1="msitss55.dll", lpString2="32.EXE.exe") returned 1 [0034.697] StrStrW (lpFirst="msitss55.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.697] lstrcmpW (lpString1="msitss55.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.697] GetCurrentThreadId () returned 0x9b0 [0034.697] RtlWakeConditionVariable () returned 0x27e800 [0034.697] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0034.697] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0034.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.698] GetCurrentThreadId () returned 0x9b0 [0034.698] RtlWakeConditionVariable () returned 0x27e800 [0034.698] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0034.698] lstrcmpiW (lpString1="ink", lpString2="Windows") returned -1 [0034.698] lstrcmpW (lpString1="ink", lpString2=".") returned 1 [0034.698] lstrcmpW (lpString1="ink", lpString2="..") returned 1 [0034.698] lstrcmpW (lpString1="ink", lpString2="AppData") returned 1 [0034.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpSrch="AppData") returned 0x0 [0034.698] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpString2="C:\\Windows") returned -1 [0034.698] lstrlenW (lpString="C:\\Windows") returned 10 [0034.698] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpString2="C:\\System Volume Information") returned -1 [0034.698] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0034.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3a38 [0034.698] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.698] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.698] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.698] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.699] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.699] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.699] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.699] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.699] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.699] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.699] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.699] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.699] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0034.699] lstrcmpiW (lpString1="Alphabet.xml", lpString2="Windows") returned -1 [0034.699] lstrcmpW (lpString1="Alphabet.xml", lpString2="32.EXE.exe") returned 1 [0034.699] StrStrW (lpFirst="Alphabet.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.699] lstrcmpW (lpString1="Alphabet.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.699] GetCurrentThreadId () returned 0x9b0 [0034.699] RtlWakeConditionVariable () returned 0x27e800 [0034.699] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0034.699] lstrcmpiW (lpString1="ar-SA", lpString2="Windows") returned -1 [0034.699] lstrcmpW (lpString1="ar-SA", lpString2=".") returned 1 [0034.699] lstrcmpW (lpString1="ar-SA", lpString2="..") returned 1 [0034.699] lstrcmpW (lpString1="ar-SA", lpString2="AppData") returned 1 [0034.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpSrch="AppData") returned 0x0 [0034.699] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpString2="C:\\Windows") returned -1 [0034.700] lstrlenW (lpString="C:\\Windows") returned 10 [0034.700] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpString2="C:\\System Volume Information") returned -1 [0034.700] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f8ac8 [0034.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0034.702] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.702] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.702] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.702] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.702] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.702] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.702] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.702] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.702] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.702] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.702] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.702] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0034.702] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0034.702] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.702] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.702] GetCurrentThreadId () returned 0x9b0 [0034.702] RtlWakeConditionVariable () returned 0x27e800 [0034.702] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0034.703] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0034.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.703] GetCurrentThreadId () returned 0x9b0 [0034.703] RtlWakeConditionVariable () returned 0x27e800 [0034.703] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0034.703] lstrcmpiW (lpString1="bg-BG", lpString2="Windows") returned -1 [0034.703] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0034.703] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0034.703] lstrcmpW (lpString1="bg-BG", lpString2="AppData") returned 1 [0034.703] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpSrch="AppData") returned 0x0 [0034.703] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpString2="C:\\Windows") returned -1 [0034.703] lstrlenW (lpString="C:\\Windows") returned 10 [0034.703] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpString2="C:\\System Volume Information") returned -1 [0034.703] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.703] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f8ac8 [0034.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0034.704] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.704] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.704] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.704] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.704] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.704] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.704] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.704] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.704] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.704] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.704] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.704] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.704] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.704] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0034.704] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0034.704] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.704] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.704] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.704] GetCurrentThreadId () returned 0x9b0 [0034.704] RtlWakeConditionVariable () returned 0x27e800 [0034.704] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0034.705] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0034.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.705] GetCurrentThreadId () returned 0x9b0 [0034.705] RtlWakeConditionVariable () returned 0x27e800 [0034.705] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0034.705] lstrcmpiW (lpString1="Content.xml", lpString2="Windows") returned -1 [0034.705] lstrcmpW (lpString1="Content.xml", lpString2="32.EXE.exe") returned 1 [0034.705] StrStrW (lpFirst="Content.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.705] lstrcmpW (lpString1="Content.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0034.705] GetCurrentThreadId () returned 0x9b0 [0034.705] RtlWakeConditionVariable () returned 0x27e800 [0034.705] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0034.705] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="Windows") returned -1 [0034.705] lstrcmpW (lpString1="ConvertInkStore.exe", lpString2="32.EXE.exe") returned 1 [0034.705] StrStrW (lpFirst="ConvertInkStore.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.705] lstrcmpW (lpString1="ConvertInkStore.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.705] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.705] GetCurrentThreadId () returned 0x9b0 [0034.705] RtlWakeConditionVariable () returned 0x27e800 [0034.705] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0034.706] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows") returned -1 [0034.706] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0034.706] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0034.706] lstrcmpW (lpString1="cs-CZ", lpString2="AppData") returned 1 [0034.706] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpSrch="AppData") returned 0x0 [0034.706] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpString2="C:\\Windows") returned -1 [0034.706] lstrlenW (lpString="C:\\Windows") returned 10 [0034.706] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpString2="C:\\System Volume Information") returned -1 [0034.706] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2f8ac8 [0034.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0034.708] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.708] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.708] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.708] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.708] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.708] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.708] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.708] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.708] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.709] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.709] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.709] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0034.709] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0034.709] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.709] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.709] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0034.709] GetCurrentThreadId () returned 0x9b0 [0034.709] RtlWakeConditionVariable () returned 0x27e800 [0034.709] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0034.709] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0034.710] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0034.710] GetCurrentThreadId () returned 0x9b0 [0034.710] RtlWakeConditionVariable () returned 0x27e800 [0034.876] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0034.876] lstrcmpiW (lpString1="da-DK", lpString2="Windows") returned -1 [0034.876] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0034.876] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0034.876] lstrcmpW (lpString1="da-DK", lpString2="AppData") returned 1 [0034.876] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpSrch="AppData") returned 0x0 [0034.876] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpString2="C:\\Windows") returned -1 [0034.876] lstrlenW (lpString="C:\\Windows") returned 10 [0034.876] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpString2="C:\\System Volume Information") returned -1 [0034.876] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x311ad0 [0034.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0034.877] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0034.877] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.877] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0034.877] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.877] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.877] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0034.877] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0034.877] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.877] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.877] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0034.877] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.877] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.877] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0034.877] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0034.877] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0034.877] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0034.877] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0034.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6408 [0034.877] GetCurrentThreadId () returned 0x9b0 [0034.877] RtlWakeConditionVariable () returned 0x27e800 [0034.877] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0034.877] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0034.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0034.878] GetCurrentThreadId () returned 0x9b0 [0034.878] RtlWakeConditionVariable () returned 0x27e800 [0034.878] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0034.878] lstrcmpiW (lpString1="de-DE", lpString2="Windows") returned -1 [0034.878] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0034.878] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0034.878] lstrcmpW (lpString1="de-DE", lpString2="AppData") returned 1 [0034.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpSrch="AppData") returned 0x0 [0034.878] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpString2="C:\\Windows") returned -1 [0034.878] lstrlenW (lpString="C:\\Windows") returned 10 [0034.878] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpString2="C:\\System Volume Information") returned -1 [0034.878] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x311ad0 [0034.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0035.084] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.084] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.084] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.084] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.085] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.085] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.085] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.085] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.085] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.085] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.085] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.085] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.085] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.085] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.085] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.085] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.085] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6558 [0035.085] GetCurrentThreadId () returned 0x9b0 [0035.085] RtlWakeConditionVariable () returned 0x27e800 [0035.085] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.085] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0035.085] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.085] GetCurrentThreadId () returned 0x9b0 [0035.085] RtlWakeConditionVariable () returned 0x27e800 [0035.085] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0035.085] lstrcmpiW (lpString1="el-GR", lpString2="Windows") returned -1 [0035.086] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0035.086] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0035.086] lstrcmpW (lpString1="el-GR", lpString2="AppData") returned 1 [0035.086] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpSrch="AppData") returned 0x0 [0035.086] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpString2="C:\\Windows") returned -1 [0035.086] lstrlenW (lpString="C:\\Windows") returned 10 [0035.086] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpString2="C:\\System Volume Information") returned -1 [0035.086] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.086] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x311ad0 [0035.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0035.086] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.086] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.086] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.086] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.086] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.086] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.086] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.086] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.086] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.086] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.087] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.087] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.087] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.087] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.087] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.087] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.087] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f6558 [0035.087] GetCurrentThreadId () returned 0x9b0 [0035.087] RtlWakeConditionVariable () returned 0x27e800 [0035.087] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.087] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0035.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.087] GetCurrentThreadId () returned 0x9b0 [0035.087] RtlWakeConditionVariable () returned 0x27e800 [0035.087] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0035.087] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0035.087] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0035.087] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0035.087] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0035.087] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpSrch="AppData") returned 0x0 [0035.087] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpString2="C:\\Windows") returned -1 [0035.087] lstrlenW (lpString="C:\\Windows") returned 10 [0035.087] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpString2="C:\\System Volume Information") returned -1 [0035.087] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.087] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x311ad0 [0035.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0035.104] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.104] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.104] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.104] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.104] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.104] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.104] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.104] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.104] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.104] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.104] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.104] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.104] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0035.104] lstrcmpiW (lpString1="boxed-correct.avi", lpString2="Windows") returned -1 [0035.104] lstrcmpW (lpString1="boxed-correct.avi", lpString2="32.EXE.exe") returned 1 [0035.104] StrStrW (lpFirst="boxed-correct.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.104] lstrcmpW (lpString1="boxed-correct.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.104] GetCurrentThreadId () returned 0x9b0 [0035.105] RtlWakeConditionVariable () returned 0x27e800 [0035.105] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0035.105] lstrcmpiW (lpString1="boxed-delete.avi", lpString2="Windows") returned -1 [0035.105] lstrcmpW (lpString1="boxed-delete.avi", lpString2="32.EXE.exe") returned 1 [0035.105] StrStrW (lpFirst="boxed-delete.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.105] lstrcmpW (lpString1="boxed-delete.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.105] GetCurrentThreadId () returned 0x9b0 [0035.105] RtlWakeConditionVariable () returned 0x27e800 [0035.105] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0035.105] lstrcmpiW (lpString1="boxed-join.avi", lpString2="Windows") returned -1 [0035.105] lstrcmpW (lpString1="boxed-join.avi", lpString2="32.EXE.exe") returned 1 [0035.105] StrStrW (lpFirst="boxed-join.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.105] lstrcmpW (lpString1="boxed-join.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.105] GetCurrentThreadId () returned 0x9b0 [0035.105] RtlWakeConditionVariable () returned 0x27e800 [0035.105] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0035.105] lstrcmpiW (lpString1="boxed-split.avi", lpString2="Windows") returned -1 [0035.105] lstrcmpW (lpString1="boxed-split.avi", lpString2="32.EXE.exe") returned 1 [0035.105] StrStrW (lpFirst="boxed-split.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.105] lstrcmpW (lpString1="boxed-split.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.105] GetCurrentThreadId () returned 0x9b0 [0035.105] RtlWakeConditionVariable () returned 0x27e800 [0035.105] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0035.105] lstrcmpiW (lpString1="correct.avi", lpString2="Windows") returned -1 [0035.105] lstrcmpW (lpString1="correct.avi", lpString2="32.EXE.exe") returned 1 [0035.106] StrStrW (lpFirst="correct.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.106] lstrcmpW (lpString1="correct.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.106] GetCurrentThreadId () returned 0x9b0 [0035.106] RtlWakeConditionVariable () returned 0x27e800 [0035.106] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0035.106] lstrcmpiW (lpString1="delete.avi", lpString2="Windows") returned -1 [0035.106] lstrcmpW (lpString1="delete.avi", lpString2="32.EXE.exe") returned 1 [0035.106] StrStrW (lpFirst="delete.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.106] lstrcmpW (lpString1="delete.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.106] GetCurrentThreadId () returned 0x9b0 [0035.106] RtlWakeConditionVariable () returned 0x27e800 [0035.106] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0035.106] lstrcmpiW (lpString1="FlickLearningWizard.exe.mui", lpString2="Windows") returned -1 [0035.106] lstrcmpW (lpString1="FlickLearningWizard.exe.mui", lpString2="32.EXE.exe") returned 1 [0035.106] StrStrW (lpFirst="FlickLearningWizard.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.106] lstrcmpW (lpString1="FlickLearningWizard.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.106] GetCurrentThreadId () returned 0x9b0 [0035.106] RtlWakeConditionVariable () returned 0x27e800 [0035.106] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0035.106] lstrcmpiW (lpString1="InkObj.dll.mui", lpString2="Windows") returned -1 [0035.106] lstrcmpW (lpString1="InkObj.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.106] StrStrW (lpFirst="InkObj.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.106] lstrcmpW (lpString1="InkObj.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.106] GetCurrentThreadId () returned 0x9b0 [0035.106] RtlWakeConditionVariable () returned 0x27e800 [0035.107] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0035.107] lstrcmpiW (lpString1="InkWatson.exe.mui", lpString2="Windows") returned -1 [0035.107] lstrcmpW (lpString1="InkWatson.exe.mui", lpString2="32.EXE.exe") returned 1 [0035.107] StrStrW (lpFirst="InkWatson.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.107] lstrcmpW (lpString1="InkWatson.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.107] GetCurrentThreadId () returned 0x9b0 [0035.107] RtlWakeConditionVariable () returned 0x27e800 [0035.107] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0035.107] lstrcmpiW (lpString1="InputPersonalization.exe.mui", lpString2="Windows") returned -1 [0035.107] lstrcmpW (lpString1="InputPersonalization.exe.mui", lpString2="32.EXE.exe") returned 1 [0035.107] StrStrW (lpFirst="InputPersonalization.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.107] lstrcmpW (lpString1="InputPersonalization.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.107] GetCurrentThreadId () returned 0x9b0 [0035.107] RtlWakeConditionVariable () returned 0x27e800 [0035.107] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0035.107] lstrcmpiW (lpString1="IPSEventLogMsg.dll.mui", lpString2="Windows") returned -1 [0035.107] lstrcmpW (lpString1="IPSEventLogMsg.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.107] StrStrW (lpFirst="IPSEventLogMsg.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.107] lstrcmpW (lpString1="IPSEventLogMsg.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.107] GetCurrentThreadId () returned 0x9b0 [0035.107] RtlWakeConditionVariable () returned 0x27e800 [0035.107] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0035.107] lstrcmpiW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="Windows") returned -1 [0035.107] lstrcmpW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.107] StrStrW (lpFirst="IpsMigrationPlugin.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.107] lstrcmpW (lpString1="IpsMigrationPlugin.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.108] GetCurrentThreadId () returned 0x9b0 [0035.108] RtlWakeConditionVariable () returned 0x27e800 [0035.108] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="join.avi", cAlternateFileName="")) returned 1 [0035.108] lstrcmpiW (lpString1="join.avi", lpString2="Windows") returned -1 [0035.108] lstrcmpW (lpString1="join.avi", lpString2="32.EXE.exe") returned 1 [0035.108] StrStrW (lpFirst="join.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.108] lstrcmpW (lpString1="join.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.108] GetCurrentThreadId () returned 0x9b0 [0035.108] RtlWakeConditionVariable () returned 0x27e800 [0035.108] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0035.108] lstrcmpiW (lpString1="micaut.dll.mui", lpString2="Windows") returned -1 [0035.108] lstrcmpW (lpString1="micaut.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.108] StrStrW (lpFirst="micaut.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.108] lstrcmpW (lpString1="micaut.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.108] GetCurrentThreadId () returned 0x9b0 [0035.108] RtlWakeConditionVariable () returned 0x27e800 [0035.108] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0035.108] lstrcmpiW (lpString1="mip.exe.mui", lpString2="Windows") returned -1 [0035.108] lstrcmpW (lpString1="mip.exe.mui", lpString2="32.EXE.exe") returned 1 [0035.108] StrStrW (lpFirst="mip.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.108] lstrcmpW (lpString1="mip.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.108] GetCurrentThreadId () returned 0x9b0 [0035.108] RtlWakeConditionVariable () returned 0x27e800 [0035.108] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0035.108] lstrcmpiW (lpString1="mshwLatin.dll.mui", lpString2="Windows") returned -1 [0035.109] lstrcmpW (lpString1="mshwLatin.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.109] StrStrW (lpFirst="mshwLatin.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.109] lstrcmpW (lpString1="mshwLatin.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.109] GetCurrentThreadId () returned 0x9b0 [0035.109] RtlWakeConditionVariable () returned 0x27e800 [0035.109] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0035.109] lstrcmpiW (lpString1="rtscom.dll.mui", lpString2="Windows") returned -1 [0035.109] lstrcmpW (lpString1="rtscom.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.109] StrStrW (lpFirst="rtscom.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.109] lstrcmpW (lpString1="rtscom.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.109] GetCurrentThreadId () returned 0x9b0 [0035.109] RtlWakeConditionVariable () returned 0x27e800 [0035.109] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0035.109] lstrcmpiW (lpString1="ShapeCollector.exe.mui", lpString2="Windows") returned -1 [0035.109] lstrcmpW (lpString1="ShapeCollector.exe.mui", lpString2="32.EXE.exe") returned 1 [0035.109] StrStrW (lpFirst="ShapeCollector.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.109] lstrcmpW (lpString1="ShapeCollector.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.109] GetCurrentThreadId () returned 0x9b0 [0035.109] RtlWakeConditionVariable () returned 0x27e800 [0035.109] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="split.avi", cAlternateFileName="")) returned 1 [0035.109] lstrcmpiW (lpString1="split.avi", lpString2="Windows") returned -1 [0035.109] lstrcmpW (lpString1="split.avi", lpString2="32.EXE.exe") returned 1 [0035.109] StrStrW (lpFirst="split.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.109] lstrcmpW (lpString1="split.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.109] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.109] GetCurrentThreadId () returned 0x9b0 [0035.110] RtlWakeConditionVariable () returned 0x27e800 [0035.110] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0035.110] lstrcmpiW (lpString1="tabskb.dll.mui", lpString2="Windows") returned -1 [0035.110] lstrcmpW (lpString1="tabskb.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.110] StrStrW (lpFirst="tabskb.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.110] lstrcmpW (lpString1="tabskb.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.110] GetCurrentThreadId () returned 0x9b0 [0035.110] RtlWakeConditionVariable () returned 0x27e800 [0035.110] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0035.110] lstrcmpiW (lpString1="TipBand.dll.mui", lpString2="Windows") returned -1 [0035.110] lstrcmpW (lpString1="TipBand.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.110] StrStrW (lpFirst="TipBand.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.110] lstrcmpW (lpString1="TipBand.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.110] GetCurrentThreadId () returned 0x9b0 [0035.110] RtlWakeConditionVariable () returned 0x27e800 [0035.110] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0035.110] lstrcmpiW (lpString1="TipRes.dll.mui", lpString2="Windows") returned -1 [0035.110] lstrcmpW (lpString1="TipRes.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.110] StrStrW (lpFirst="TipRes.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.110] lstrcmpW (lpString1="TipRes.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.110] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.110] GetCurrentThreadId () returned 0x9b0 [0035.110] RtlWakeConditionVariable () returned 0x27e800 [0035.110] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.110] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.110] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.111] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.111] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.111] GetCurrentThreadId () returned 0x9b0 [0035.111] RtlWakeConditionVariable () returned 0x27e800 [0035.111] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0035.111] lstrcmpiW (lpString1="TipTsf.dll.mui", lpString2="Windows") returned -1 [0035.111] lstrcmpW (lpString1="TipTsf.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.111] StrStrW (lpFirst="TipTsf.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.111] lstrcmpW (lpString1="TipTsf.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.111] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.111] GetCurrentThreadId () returned 0x9b0 [0035.111] RtlWakeConditionVariable () returned 0x27e800 [0035.111] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0035.111] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0035.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.112] GetCurrentThreadId () returned 0x9b0 [0035.112] RtlWakeConditionVariable () returned 0x27e800 [0035.112] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0035.112] lstrcmpiW (lpString1="es-ES", lpString2="Windows") returned -1 [0035.112] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0035.112] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0035.112] lstrcmpW (lpString1="es-ES", lpString2="AppData") returned 1 [0035.112] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpSrch="AppData") returned 0x0 [0035.112] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpString2="C:\\Windows") returned -1 [0035.112] lstrlenW (lpString="C:\\Windows") returned 10 [0035.112] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpString2="C:\\System Volume Information") returned -1 [0035.112] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.112] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0035.113] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.113] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.113] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.113] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.113] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.113] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.113] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.113] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.113] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.113] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.113] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.113] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.113] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.113] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.113] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.113] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.113] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29ce30 [0035.113] GetCurrentThreadId () returned 0x9b0 [0035.113] RtlWakeConditionVariable () returned 0x27e800 [0035.113] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.113] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0035.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.113] GetCurrentThreadId () returned 0x9b0 [0035.114] RtlWakeConditionVariable () returned 0x27e800 [0035.114] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0035.114] lstrcmpiW (lpString1="et-EE", lpString2="Windows") returned -1 [0035.114] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0035.114] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0035.114] lstrcmpW (lpString1="et-EE", lpString2="AppData") returned 1 [0035.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpSrch="AppData") returned 0x0 [0035.114] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpString2="C:\\Windows") returned -1 [0035.114] lstrlenW (lpString="C:\\Windows") returned 10 [0035.114] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpString2="C:\\System Volume Information") returned -1 [0035.114] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0035.141] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.141] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.141] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.141] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.141] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.141] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.141] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.141] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.141] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.141] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.141] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.141] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.141] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.141] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.141] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.141] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.141] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.142] GetCurrentThreadId () returned 0x9b0 [0035.142] RtlWakeConditionVariable () returned 0x27e800 [0035.142] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.142] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0035.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.142] GetCurrentThreadId () returned 0x9b0 [0035.142] RtlWakeConditionVariable () returned 0x27e800 [0035.143] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0035.143] lstrcmpiW (lpString1="fi-FI", lpString2="Windows") returned -1 [0035.143] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0035.143] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0035.143] lstrcmpW (lpString1="fi-FI", lpString2="AppData") returned 1 [0035.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpSrch="AppData") returned 0x0 [0035.143] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpString2="C:\\Windows") returned -1 [0035.143] lstrlenW (lpString="C:\\Windows") returned 10 [0035.143] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpString2="C:\\System Volume Information") returned -1 [0035.143] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0035.144] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.144] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.144] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.144] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.144] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.144] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.144] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.144] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.144] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.144] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.144] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.144] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.144] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.144] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.144] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.144] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.144] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.144] GetCurrentThreadId () returned 0x9b0 [0035.144] RtlWakeConditionVariable () returned 0x27e800 [0035.144] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.145] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0035.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.145] GetCurrentThreadId () returned 0x9b0 [0035.145] RtlWakeConditionVariable () returned 0x27e800 [0035.145] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0035.145] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="Windows") returned -1 [0035.145] lstrcmpW (lpString1="FlickAnimation.avi", lpString2="32.EXE.exe") returned 1 [0035.145] StrStrW (lpFirst="FlickAnimation.avi", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.145] lstrcmpW (lpString1="FlickAnimation.avi", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.145] GetCurrentThreadId () returned 0x9b0 [0035.145] RtlWakeConditionVariable () returned 0x27e800 [0035.145] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0035.145] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="Windows") returned -1 [0035.145] lstrcmpW (lpString1="FlickLearningWizard.exe", lpString2="32.EXE.exe") returned 1 [0035.145] StrStrW (lpFirst="FlickLearningWizard.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.145] lstrcmpW (lpString1="FlickLearningWizard.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.145] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.145] GetCurrentThreadId () returned 0x9b0 [0035.145] RtlWakeConditionVariable () returned 0x27e800 [0035.145] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0035.145] lstrcmpiW (lpString1="fr-FR", lpString2="Windows") returned -1 [0035.145] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0035.145] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0035.145] lstrcmpW (lpString1="fr-FR", lpString2="AppData") returned 1 [0035.145] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpSrch="AppData") returned 0x0 [0035.145] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpString2="C:\\Windows") returned -1 [0035.146] lstrlenW (lpString="C:\\Windows") returned 10 [0035.146] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpString2="C:\\System Volume Information") returned -1 [0035.146] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.146] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0035.146] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.146] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.146] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.146] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.146] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.146] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.146] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.146] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.146] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.146] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.146] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.146] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.146] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.146] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.146] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.146] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.147] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.147] GetCurrentThreadId () returned 0x9b0 [0035.147] RtlWakeConditionVariable () returned 0x27e800 [0035.147] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.147] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0035.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.147] GetCurrentThreadId () returned 0x9b0 [0035.147] RtlWakeConditionVariable () returned 0x27e800 [0035.147] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0035.147] lstrcmpiW (lpString1="fsdefinitions", lpString2="Windows") returned -1 [0035.147] lstrcmpW (lpString1="fsdefinitions", lpString2=".") returned 1 [0035.147] lstrcmpW (lpString1="fsdefinitions", lpString2="..") returned 1 [0035.147] lstrcmpW (lpString1="fsdefinitions", lpString2="AppData") returned 1 [0035.147] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpSrch="AppData") returned 0x0 [0035.147] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpString2="C:\\Windows") returned -1 [0035.147] lstrlenW (lpString="C:\\Windows") returned 10 [0035.147] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpString2="C:\\System Volume Information") returned -1 [0035.147] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.147] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0035.153] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.153] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.153] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.153] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.153] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.153] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.153] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.153] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.153] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.153] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.153] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="auxpad", cAlternateFileName="")) returned 1 [0035.153] lstrcmpiW (lpString1="auxpad", lpString2="Windows") returned -1 [0035.153] lstrcmpW (lpString1="auxpad", lpString2=".") returned 1 [0035.153] lstrcmpW (lpString1="auxpad", lpString2="..") returned 1 [0035.153] lstrcmpW (lpString1="auxpad", lpString2="AppData") returned 1 [0035.153] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpSrch="AppData") returned 0x0 [0035.153] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpString2="C:\\Windows") returned -1 [0035.153] lstrlenW (lpString="C:\\Windows") returned 10 [0035.153] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpString2="C:\\System Volume Information") returned -1 [0035.153] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0035.166] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.166] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.166] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.166] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.166] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.166] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.166] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.166] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.166] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.166] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.166] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.166] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.166] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0035.167] lstrcmpiW (lpString1="auxbase.xml", lpString2="Windows") returned -1 [0035.167] lstrcmpW (lpString1="auxbase.xml", lpString2="32.EXE.exe") returned 1 [0035.167] StrStrW (lpFirst="auxbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.167] lstrcmpW (lpString1="auxbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.167] GetCurrentThreadId () returned 0x9b0 [0035.167] RtlWakeConditionVariable () returned 0x27e800 [0035.167] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0035.167] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.167] GetCurrentThreadId () returned 0x9b0 [0035.167] RtlWakeConditionVariable () returned 0x27e800 [0035.167] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0035.167] lstrcmpiW (lpString1="auxpad.xml", lpString2="Windows") returned -1 [0035.167] lstrcmpW (lpString1="auxpad.xml", lpString2="32.EXE.exe") returned 1 [0035.167] StrStrW (lpFirst="auxpad.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.167] lstrcmpW (lpString1="auxpad.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.167] GetCurrentThreadId () returned 0x9b0 [0035.167] RtlWakeConditionVariable () returned 0x27e800 [0035.167] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="keypad", cAlternateFileName="")) returned 1 [0035.167] lstrcmpiW (lpString1="keypad", lpString2="Windows") returned -1 [0035.167] lstrcmpW (lpString1="keypad", lpString2=".") returned 1 [0035.167] lstrcmpW (lpString1="keypad", lpString2="..") returned 1 [0035.167] lstrcmpW (lpString1="keypad", lpString2="AppData") returned 1 [0035.167] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpSrch="AppData") returned 0x0 [0035.168] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpString2="C:\\Windows") returned -1 [0035.168] lstrlenW (lpString="C:\\Windows") returned 10 [0035.168] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpString2="C:\\System Volume Information") returned -1 [0035.168] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0035.168] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.168] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.168] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.168] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.168] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.168] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.168] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.168] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.168] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.168] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.168] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0035.168] lstrcmpiW (lpString1="ea.xml", lpString2="Windows") returned -1 [0035.168] lstrcmpW (lpString1="ea.xml", lpString2="32.EXE.exe") returned 1 [0035.168] StrStrW (lpFirst="ea.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.168] lstrcmpW (lpString1="ea.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.168] GetCurrentThreadId () returned 0x9b0 [0035.169] RtlWakeConditionVariable () returned 0x27e800 [0035.169] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0035.169] lstrcmpiW (lpString1="keypadbase.xml", lpString2="Windows") returned -1 [0035.169] lstrcmpW (lpString1="keypadbase.xml", lpString2="32.EXE.exe") returned 1 [0035.169] StrStrW (lpFirst="keypadbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.169] lstrcmpW (lpString1="keypadbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.169] GetCurrentThreadId () returned 0x9b0 [0035.169] RtlWakeConditionVariable () returned 0x27e800 [0035.169] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0035.169] lstrcmpiW (lpString1="kor-kor.xml", lpString2="Windows") returned -1 [0035.169] lstrcmpW (lpString1="kor-kor.xml", lpString2="32.EXE.exe") returned 1 [0035.169] StrStrW (lpFirst="kor-kor.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.169] lstrcmpW (lpString1="kor-kor.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.169] GetCurrentThreadId () returned 0x9b0 [0035.169] RtlWakeConditionVariable () returned 0x27e800 [0035.169] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0035.169] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.169] GetCurrentThreadId () returned 0x9b0 [0035.169] RtlWakeConditionVariable () returned 0x27e800 [0035.169] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0035.169] lstrcmpiW (lpString1="keypad.xml", lpString2="Windows") returned -1 [0035.169] lstrcmpW (lpString1="keypad.xml", lpString2="32.EXE.exe") returned 1 [0035.169] StrStrW (lpFirst="keypad.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.170] lstrcmpW (lpString1="keypad.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.170] GetCurrentThreadId () returned 0x9b0 [0035.170] RtlWakeConditionVariable () returned 0x27e800 [0035.170] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="main", cAlternateFileName="")) returned 1 [0035.170] lstrcmpiW (lpString1="main", lpString2="Windows") returned -1 [0035.170] lstrcmpW (lpString1="main", lpString2=".") returned 1 [0035.170] lstrcmpW (lpString1="main", lpString2="..") returned 1 [0035.170] lstrcmpW (lpString1="main", lpString2="AppData") returned 1 [0035.170] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpSrch="AppData") returned 0x0 [0035.170] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpString2="C:\\Windows") returned -1 [0035.170] lstrlenW (lpString="C:\\Windows") returned 10 [0035.170] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpString2="C:\\System Volume Information") returned -1 [0035.170] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0035.171] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.171] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.171] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.172] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.172] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.172] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.172] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.172] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.172] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.172] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.172] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.172] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base.xml", cAlternateFileName="")) returned 1 [0035.172] lstrcmpiW (lpString1="base.xml", lpString2="Windows") returned -1 [0035.172] lstrcmpW (lpString1="base.xml", lpString2="32.EXE.exe") returned 1 [0035.172] StrStrW (lpFirst="base.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.172] lstrcmpW (lpString1="base.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.172] GetCurrentThreadId () returned 0x9b0 [0035.172] RtlWakeConditionVariable () returned 0x27e800 [0035.172] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0035.172] lstrcmpiW (lpString1="baseAltGr_rtl.xml", lpString2="Windows") returned -1 [0035.172] lstrcmpW (lpString1="baseAltGr_rtl.xml", lpString2="32.EXE.exe") returned 1 [0035.172] StrStrW (lpFirst="baseAltGr_rtl.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.172] lstrcmpW (lpString1="baseAltGr_rtl.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.172] GetCurrentThreadId () returned 0x9b0 [0035.172] RtlWakeConditionVariable () returned 0x27e800 [0035.172] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0035.172] lstrcmpiW (lpString1="base_altgr.xml", lpString2="Windows") returned -1 [0035.172] lstrcmpW (lpString1="base_altgr.xml", lpString2="32.EXE.exe") returned 1 [0035.172] StrStrW (lpFirst="base_altgr.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.172] lstrcmpW (lpString1="base_altgr.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.173] GetCurrentThreadId () returned 0x9b0 [0035.173] RtlWakeConditionVariable () returned 0x27e800 [0035.173] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0035.173] lstrcmpiW (lpString1="base_ca.xml", lpString2="Windows") returned -1 [0035.173] lstrcmpW (lpString1="base_ca.xml", lpString2="32.EXE.exe") returned 1 [0035.173] StrStrW (lpFirst="base_ca.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.173] lstrcmpW (lpString1="base_ca.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.173] GetCurrentThreadId () returned 0x9b0 [0035.173] RtlWakeConditionVariable () returned 0x27e800 [0035.173] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0035.173] lstrcmpiW (lpString1="base_heb.xml", lpString2="Windows") returned -1 [0035.173] lstrcmpW (lpString1="base_heb.xml", lpString2="32.EXE.exe") returned 1 [0035.173] StrStrW (lpFirst="base_heb.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.173] lstrcmpW (lpString1="base_heb.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.173] GetCurrentThreadId () returned 0x9b0 [0035.173] RtlWakeConditionVariable () returned 0x27e800 [0035.173] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0035.173] lstrcmpiW (lpString1="base_jpn.xml", lpString2="Windows") returned -1 [0035.173] lstrcmpW (lpString1="base_jpn.xml", lpString2="32.EXE.exe") returned 1 [0035.173] StrStrW (lpFirst="base_jpn.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.173] lstrcmpW (lpString1="base_jpn.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.173] GetCurrentThreadId () returned 0x9b0 [0035.173] RtlWakeConditionVariable () returned 0x27e800 [0035.173] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0035.173] lstrcmpiW (lpString1="base_kor.xml", lpString2="Windows") returned -1 [0035.173] lstrcmpW (lpString1="base_kor.xml", lpString2="32.EXE.exe") returned 1 [0035.174] StrStrW (lpFirst="base_kor.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.174] lstrcmpW (lpString1="base_kor.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.174] GetCurrentThreadId () returned 0x9b0 [0035.174] RtlWakeConditionVariable () returned 0x27e800 [0035.174] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0035.174] lstrcmpiW (lpString1="base_rtl.xml", lpString2="Windows") returned -1 [0035.174] lstrcmpW (lpString1="base_rtl.xml", lpString2="32.EXE.exe") returned 1 [0035.174] StrStrW (lpFirst="base_rtl.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.174] lstrcmpW (lpString1="base_rtl.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.174] GetCurrentThreadId () returned 0x9b0 [0035.174] RtlWakeConditionVariable () returned 0x27e800 [0035.174] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0035.174] lstrcmpiW (lpString1="ja-jp.xml", lpString2="Windows") returned -1 [0035.174] lstrcmpW (lpString1="ja-jp.xml", lpString2="32.EXE.exe") returned 1 [0035.174] StrStrW (lpFirst="ja-jp.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.174] lstrcmpW (lpString1="ja-jp.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.174] GetCurrentThreadId () returned 0x9b0 [0035.174] RtlWakeConditionVariable () returned 0x27e800 [0035.174] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0035.174] lstrcmpiW (lpString1="ko-kr.xml", lpString2="Windows") returned -1 [0035.174] lstrcmpW (lpString1="ko-kr.xml", lpString2="32.EXE.exe") returned 1 [0035.174] StrStrW (lpFirst="ko-kr.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.174] lstrcmpW (lpString1="ko-kr.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.174] GetCurrentThreadId () returned 0x9b0 [0035.174] RtlWakeConditionVariable () returned 0x27e800 [0035.174] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0035.175] lstrcmpiW (lpString1="zh-changjei.xml", lpString2="Windows") returned 1 [0035.175] lstrcmpW (lpString1="zh-changjei.xml", lpString2="32.EXE.exe") returned 1 [0035.175] StrStrW (lpFirst="zh-changjei.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.175] lstrcmpW (lpString1="zh-changjei.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.175] GetCurrentThreadId () returned 0x9b0 [0035.175] RtlWakeConditionVariable () returned 0x27e800 [0035.175] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0035.175] lstrcmpiW (lpString1="zh-dayi.xml", lpString2="Windows") returned 1 [0035.175] lstrcmpW (lpString1="zh-dayi.xml", lpString2="32.EXE.exe") returned 1 [0035.175] StrStrW (lpFirst="zh-dayi.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.175] lstrcmpW (lpString1="zh-dayi.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2570 [0035.175] GetCurrentThreadId () returned 0x9b0 [0035.175] RtlWakeConditionVariable () returned 0x27e800 [0035.175] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0035.175] lstrcmpiW (lpString1="zh-phonetic.xml", lpString2="Windows") returned 1 [0035.175] lstrcmpW (lpString1="zh-phonetic.xml", lpString2="32.EXE.exe") returned 1 [0035.175] StrStrW (lpFirst="zh-phonetic.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.175] lstrcmpW (lpString1="zh-phonetic.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.175] GetCurrentThreadId () returned 0x9b0 [0035.175] RtlWakeConditionVariable () returned 0x27e800 [0035.175] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0035.175] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0035.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.176] GetCurrentThreadId () returned 0x9b0 [0035.176] RtlWakeConditionVariable () returned 0x27e800 [0035.177] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0035.177] lstrcmpiW (lpString1="main.xml", lpString2="Windows") returned -1 [0035.177] lstrcmpW (lpString1="main.xml", lpString2="32.EXE.exe") returned 1 [0035.177] StrStrW (lpFirst="main.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.177] lstrcmpW (lpString1="main.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0035.177] GetCurrentThreadId () returned 0x9b0 [0035.177] RtlWakeConditionVariable () returned 0x27e800 [0035.177] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="numbers", cAlternateFileName="")) returned 1 [0035.177] lstrcmpiW (lpString1="numbers", lpString2="Windows") returned -1 [0035.177] lstrcmpW (lpString1="numbers", lpString2=".") returned 1 [0035.177] lstrcmpW (lpString1="numbers", lpString2="..") returned 1 [0035.177] lstrcmpW (lpString1="numbers", lpString2="AppData") returned 1 [0035.177] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpSrch="AppData") returned 0x0 [0035.177] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpString2="C:\\Windows") returned -1 [0035.177] lstrlenW (lpString="C:\\Windows") returned 10 [0035.177] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpString2="C:\\System Volume Information") returned -1 [0035.177] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.436] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.436] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.436] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.436] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.436] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.436] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.436] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.436] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.436] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.436] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.436] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.436] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.436] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0035.436] lstrcmpiW (lpString1="numbase.xml", lpString2="Windows") returned -1 [0035.436] lstrcmpW (lpString1="numbase.xml", lpString2="32.EXE.exe") returned 1 [0035.436] StrStrW (lpFirst="numbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.436] lstrcmpW (lpString1="numbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.436] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.436] GetCurrentThreadId () returned 0x9b0 [0035.436] RtlWakeConditionVariable () returned 0x27e800 [0035.437] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0035.437] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.437] GetCurrentThreadId () returned 0x9b0 [0035.437] RtlWakeConditionVariable () returned 0x27e800 [0035.437] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0035.437] lstrcmpiW (lpString1="numbers.xml", lpString2="Windows") returned -1 [0035.437] lstrcmpW (lpString1="numbers.xml", lpString2="32.EXE.exe") returned 1 [0035.437] StrStrW (lpFirst="numbers.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.437] lstrcmpW (lpString1="numbers.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ae40 [0035.437] GetCurrentThreadId () returned 0x9b0 [0035.437] RtlWakeConditionVariable () returned 0x27e800 [0035.437] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0035.437] lstrcmpiW (lpString1="oskmenu", lpString2="Windows") returned -1 [0035.437] lstrcmpW (lpString1="oskmenu", lpString2=".") returned 1 [0035.437] lstrcmpW (lpString1="oskmenu", lpString2="..") returned 1 [0035.437] lstrcmpW (lpString1="oskmenu", lpString2="AppData") returned 1 [0035.437] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpSrch="AppData") returned 0x0 [0035.437] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpString2="C:\\Windows") returned -1 [0035.437] lstrlenW (lpString="C:\\Windows") returned 10 [0035.437] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpString2="C:\\System Volume Information") returned -1 [0035.437] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.437] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.778] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.778] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.778] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.778] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.778] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.778] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.778] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.778] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.778] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.778] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.778] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.778] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.778] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0035.778] lstrcmpiW (lpString1="oskmenubase.xml", lpString2="Windows") returned -1 [0035.778] lstrcmpW (lpString1="oskmenubase.xml", lpString2="32.EXE.exe") returned 1 [0035.779] StrStrW (lpFirst="oskmenubase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.779] lstrcmpW (lpString1="oskmenubase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0035.779] GetCurrentThreadId () returned 0x9b0 [0035.779] RtlWakeConditionVariable () returned 0x27e800 [0035.779] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0035.779] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.779] GetCurrentThreadId () returned 0x9b0 [0035.779] RtlWakeConditionVariable () returned 0x27e800 [0035.779] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0035.779] lstrcmpiW (lpString1="oskmenu.xml", lpString2="Windows") returned -1 [0035.779] lstrcmpW (lpString1="oskmenu.xml", lpString2="32.EXE.exe") returned 1 [0035.779] StrStrW (lpFirst="oskmenu.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.779] lstrcmpW (lpString1="oskmenu.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.779] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0035.779] GetCurrentThreadId () returned 0x9b0 [0035.779] RtlWakeConditionVariable () returned 0x27e800 [0035.779] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0035.779] lstrcmpiW (lpString1="osknumpad", lpString2="Windows") returned -1 [0035.779] lstrcmpW (lpString1="osknumpad", lpString2=".") returned 1 [0035.779] lstrcmpW (lpString1="osknumpad", lpString2="..") returned 1 [0035.779] lstrcmpW (lpString1="osknumpad", lpString2="AppData") returned 1 [0035.779] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpSrch="AppData") returned 0x0 [0035.780] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpString2="C:\\Windows") returned -1 [0035.780] lstrlenW (lpString="C:\\Windows") returned 10 [0035.780] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpString2="C:\\System Volume Information") returned -1 [0035.780] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.780] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.780] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.780] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.780] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.780] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.780] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.780] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.780] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.780] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.780] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.780] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.780] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.780] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0035.780] lstrcmpiW (lpString1="osknumpadbase.xml", lpString2="Windows") returned -1 [0035.780] lstrcmpW (lpString1="osknumpadbase.xml", lpString2="32.EXE.exe") returned 1 [0035.780] StrStrW (lpFirst="osknumpadbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.780] lstrcmpW (lpString1="osknumpadbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.780] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.780] GetCurrentThreadId () returned 0x9b0 [0035.781] RtlWakeConditionVariable () returned 0x27e800 [0035.781] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0035.781] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0035.781] GetCurrentThreadId () returned 0x9b0 [0035.781] RtlWakeConditionVariable () returned 0x27e800 [0035.781] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0035.781] lstrcmpiW (lpString1="osknumpad.xml", lpString2="Windows") returned -1 [0035.781] lstrcmpW (lpString1="osknumpad.xml", lpString2="32.EXE.exe") returned 1 [0035.781] StrStrW (lpFirst="osknumpad.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.781] lstrcmpW (lpString1="osknumpad.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0035.781] GetCurrentThreadId () returned 0x9b0 [0035.781] RtlWakeConditionVariable () returned 0x27e800 [0035.781] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="oskpred", cAlternateFileName="")) returned 1 [0035.781] lstrcmpiW (lpString1="oskpred", lpString2="Windows") returned -1 [0035.781] lstrcmpW (lpString1="oskpred", lpString2=".") returned 1 [0035.781] lstrcmpW (lpString1="oskpred", lpString2="..") returned 1 [0035.781] lstrcmpW (lpString1="oskpred", lpString2="AppData") returned 1 [0035.781] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpSrch="AppData") returned 0x0 [0035.781] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpString2="C:\\Windows") returned -1 [0035.781] lstrlenW (lpString="C:\\Windows") returned 10 [0035.781] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpString2="C:\\System Volume Information") returned -1 [0035.781] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.781] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.782] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.782] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.782] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.782] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.782] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.782] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.782] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.782] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.782] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.782] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.782] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.782] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.782] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0035.783] lstrcmpiW (lpString1="oskpredbase.xml", lpString2="Windows") returned -1 [0035.783] lstrcmpW (lpString1="oskpredbase.xml", lpString2="32.EXE.exe") returned 1 [0035.783] StrStrW (lpFirst="oskpredbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.783] lstrcmpW (lpString1="oskpredbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0035.783] GetCurrentThreadId () returned 0x9b0 [0035.783] RtlWakeConditionVariable () returned 0x27e800 [0035.783] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0035.783] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.783] GetCurrentThreadId () returned 0x9b0 [0035.783] RtlWakeConditionVariable () returned 0x27e800 [0035.783] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0035.783] lstrcmpiW (lpString1="oskpred.xml", lpString2="Windows") returned -1 [0035.783] lstrcmpW (lpString1="oskpred.xml", lpString2="32.EXE.exe") returned 1 [0035.783] StrStrW (lpFirst="oskpred.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.783] lstrcmpW (lpString1="oskpred.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.783] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0035.783] GetCurrentThreadId () returned 0x9b0 [0035.783] RtlWakeConditionVariable () returned 0x27e800 [0035.783] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="symbols", cAlternateFileName="")) returned 1 [0035.783] lstrcmpiW (lpString1="symbols", lpString2="Windows") returned -1 [0035.783] lstrcmpW (lpString1="symbols", lpString2=".") returned 1 [0035.783] lstrcmpW (lpString1="symbols", lpString2="..") returned 1 [0035.783] lstrcmpW (lpString1="symbols", lpString2="AppData") returned 1 [0035.783] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpSrch="AppData") returned 0x0 [0035.784] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpString2="C:\\Windows") returned -1 [0035.784] lstrlenW (lpString="C:\\Windows") returned 10 [0035.784] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpString2="C:\\System Volume Information") returned -1 [0035.784] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.784] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.784] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.784] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.784] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.784] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.784] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.784] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.784] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.784] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.784] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.784] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.784] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.784] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0035.784] lstrcmpiW (lpString1="ea-sym.xml", lpString2="Windows") returned -1 [0035.784] lstrcmpW (lpString1="ea-sym.xml", lpString2="32.EXE.exe") returned 1 [0035.784] StrStrW (lpFirst="ea-sym.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.784] lstrcmpW (lpString1="ea-sym.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.784] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0035.784] GetCurrentThreadId () returned 0x9b0 [0035.784] RtlWakeConditionVariable () returned 0x27e800 [0035.785] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0035.785] lstrcmpiW (lpString1="ja-jp-sym.xml", lpString2="Windows") returned -1 [0035.785] lstrcmpW (lpString1="ja-jp-sym.xml", lpString2="32.EXE.exe") returned 1 [0035.785] StrStrW (lpFirst="ja-jp-sym.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.785] lstrcmpW (lpString1="ja-jp-sym.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0035.785] GetCurrentThreadId () returned 0x9b0 [0035.785] RtlWakeConditionVariable () returned 0x27e800 [0035.785] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0035.785] lstrcmpiW (lpString1="symbase.xml", lpString2="Windows") returned -1 [0035.785] lstrcmpW (lpString1="symbase.xml", lpString2="32.EXE.exe") returned 1 [0035.785] StrStrW (lpFirst="symbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.785] lstrcmpW (lpString1="symbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da600 [0035.785] GetCurrentThreadId () returned 0x9b0 [0035.785] RtlWakeConditionVariable () returned 0x27e800 [0035.785] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0035.785] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.785] GetCurrentThreadId () returned 0x9b0 [0035.785] RtlWakeConditionVariable () returned 0x27e800 [0035.785] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0035.785] lstrcmpiW (lpString1="symbols.xml", lpString2="Windows") returned -1 [0035.785] lstrcmpW (lpString1="symbols.xml", lpString2="32.EXE.exe") returned 1 [0035.785] StrStrW (lpFirst="symbols.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.785] lstrcmpW (lpString1="symbols.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.785] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0035.786] GetCurrentThreadId () returned 0x9b0 [0035.786] RtlWakeConditionVariable () returned 0x27e800 [0035.786] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="web", cAlternateFileName="")) returned 1 [0035.786] lstrcmpiW (lpString1="web", lpString2="Windows") returned -1 [0035.786] lstrcmpW (lpString1="web", lpString2=".") returned 1 [0035.786] lstrcmpW (lpString1="web", lpString2="..") returned 1 [0035.786] lstrcmpW (lpString1="web", lpString2="AppData") returned 1 [0035.786] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpSrch="AppData") returned 0x0 [0035.786] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpString2="C:\\Windows") returned -1 [0035.786] lstrlenW (lpString="C:\\Windows") returned 10 [0035.786] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpString2="C:\\System Volume Information") returned -1 [0035.786] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.786] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x30cad0 [0035.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.844] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.845] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.845] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.845] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.845] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.845] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.845] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.845] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.845] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.845] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.845] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.845] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.845] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0035.845] lstrcmpiW (lpString1="webbase.xml", lpString2="Windows") returned -1 [0035.845] lstrcmpW (lpString1="webbase.xml", lpString2="32.EXE.exe") returned 1 [0035.845] StrStrW (lpFirst="webbase.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.845] lstrcmpW (lpString1="webbase.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.845] GetCurrentThreadId () returned 0x9b0 [0035.845] RtlWakeConditionVariable () returned 0x27e800 [0035.845] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0035.845] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.845] GetCurrentThreadId () returned 0x9b0 [0035.846] RtlWakeConditionVariable () returned 0x27e800 [0035.846] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="web.xml", cAlternateFileName="")) returned 1 [0035.846] lstrcmpiW (lpString1="web.xml", lpString2="Windows") returned -1 [0035.846] lstrcmpW (lpString1="web.xml", lpString2="32.EXE.exe") returned 1 [0035.846] StrStrW (lpFirst="web.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.846] lstrcmpW (lpString1="web.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.846] GetCurrentThreadId () returned 0x9b0 [0035.846] RtlWakeConditionVariable () returned 0x27e800 [0035.846] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="web.xml", cAlternateFileName="")) returned 0 [0035.846] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0035.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0035.846] GetCurrentThreadId () returned 0x9b0 [0035.846] RtlWakeConditionVariable () returned 0x27e800 [0035.846] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0035.846] lstrcmpiW (lpString1="he-IL", lpString2="Windows") returned -1 [0035.847] lstrcmpW (lpString1="he-IL", lpString2=".") returned 1 [0035.847] lstrcmpW (lpString1="he-IL", lpString2="..") returned 1 [0035.847] lstrcmpW (lpString1="he-IL", lpString2="AppData") returned 1 [0035.847] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpSrch="AppData") returned 0x0 [0035.847] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpString2="C:\\Windows") returned -1 [0035.847] lstrlenW (lpString="C:\\Windows") returned 10 [0035.847] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpString2="C:\\System Volume Information") returned -1 [0035.847] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.847] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.847] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.847] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.847] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.848] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.848] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.848] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.848] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.848] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.848] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.848] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.848] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.848] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.848] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.848] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.848] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.848] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.848] GetCurrentThreadId () returned 0x9b0 [0035.848] RtlWakeConditionVariable () returned 0x27e800 [0035.848] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.848] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.848] GetCurrentThreadId () returned 0x9b0 [0035.848] RtlWakeConditionVariable () returned 0x27e800 [0035.848] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0035.848] lstrcmpiW (lpString1="hr-HR", lpString2="Windows") returned -1 [0035.848] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0035.848] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0035.848] lstrcmpW (lpString1="hr-HR", lpString2="AppData") returned 1 [0035.848] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpSrch="AppData") returned 0x0 [0035.849] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpString2="C:\\Windows") returned -1 [0035.849] lstrlenW (lpString="C:\\Windows") returned 10 [0035.849] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpString2="C:\\System Volume Information") returned -1 [0035.849] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.849] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.849] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.849] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.849] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.849] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.849] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.849] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.849] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.849] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.849] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.850] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.850] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.850] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.850] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.850] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.850] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.850] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.850] GetCurrentThreadId () returned 0x9b0 [0035.850] RtlWakeConditionVariable () returned 0x27e800 [0035.850] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.850] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.850] GetCurrentThreadId () returned 0x9b0 [0035.850] RtlWakeConditionVariable () returned 0x27e800 [0035.850] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0035.850] lstrcmpiW (lpString1="hu-HU", lpString2="Windows") returned -1 [0035.850] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0035.850] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0035.850] lstrcmpW (lpString1="hu-HU", lpString2="AppData") returned 1 [0035.850] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpSrch="AppData") returned 0x0 [0035.850] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpString2="C:\\Windows") returned -1 [0035.850] lstrlenW (lpString="C:\\Windows") returned 10 [0035.850] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpString2="C:\\System Volume Information") returned -1 [0035.850] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.851] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.851] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.851] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.851] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.851] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.851] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.851] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.851] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.851] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.851] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.851] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.851] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.851] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.851] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.851] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.851] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.851] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.851] GetCurrentThreadId () returned 0x9b0 [0035.851] RtlWakeConditionVariable () returned 0x27e800 [0035.851] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.851] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.852] GetCurrentThreadId () returned 0x9b0 [0035.852] RtlWakeConditionVariable () returned 0x27e800 [0035.852] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0035.852] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="Windows") returned -1 [0035.852] lstrcmpW (lpString1="hwrcommonlm.dat", lpString2="32.EXE.exe") returned 1 [0035.852] StrStrW (lpFirst="hwrcommonlm.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.852] lstrcmpW (lpString1="hwrcommonlm.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.852] GetCurrentThreadId () returned 0x9b0 [0035.852] RtlWakeConditionVariable () returned 0x27e800 [0035.852] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0035.852] lstrcmpiW (lpString1="HWRCustomization", lpString2="Windows") returned -1 [0035.852] lstrcmpW (lpString1="HWRCustomization", lpString2=".") returned 1 [0035.852] lstrcmpW (lpString1="HWRCustomization", lpString2="..") returned 1 [0035.852] lstrcmpW (lpString1="HWRCustomization", lpString2="AppData") returned 1 [0035.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpSrch="AppData") returned 0x0 [0035.852] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpString2="C:\\Windows") returned -1 [0035.852] lstrlenW (lpString="C:\\Windows") returned 10 [0035.852] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpString2="C:\\System Volume Information") returned -1 [0035.852] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.852] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.859] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.859] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.859] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.859] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.859] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.859] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.860] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.860] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.860] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.860] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.860] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.860] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.860] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 0 [0035.860] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0035.860] GetCurrentThreadId () returned 0x9b0 [0035.860] RtlWakeConditionVariable () returned 0x27e800 [0035.861] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0035.861] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="Windows") returned -1 [0035.861] lstrcmpW (lpString1="hwrenalm.dat", lpString2="32.EXE.exe") returned 1 [0035.861] StrStrW (lpFirst="hwrenalm.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.861] lstrcmpW (lpString1="hwrenalm.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.861] GetCurrentThreadId () returned 0x9b0 [0035.861] RtlWakeConditionVariable () returned 0x27e800 [0035.861] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0035.861] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="Windows") returned -1 [0035.861] lstrcmpW (lpString1="hwrenclm.dat", lpString2="32.EXE.exe") returned 1 [0035.861] StrStrW (lpFirst="hwrenclm.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.861] lstrcmpW (lpString1="hwrenclm.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.862] GetCurrentThreadId () returned 0x9b0 [0035.862] RtlWakeConditionVariable () returned 0x27e800 [0035.862] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0035.862] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="Windows") returned -1 [0035.862] lstrcmpW (lpString1="hwrlatinlm.dat", lpString2="32.EXE.exe") returned 1 [0035.862] StrStrW (lpFirst="hwrlatinlm.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.862] lstrcmpW (lpString1="hwrlatinlm.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.862] GetCurrentThreadId () returned 0x9b0 [0035.862] RtlWakeConditionVariable () returned 0x27e800 [0035.862] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0035.862] lstrcmpiW (lpString1="hwruklm.dat", lpString2="Windows") returned -1 [0035.862] lstrcmpW (lpString1="hwruklm.dat", lpString2="32.EXE.exe") returned 1 [0035.862] StrStrW (lpFirst="hwruklm.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.862] lstrcmpW (lpString1="hwruklm.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.862] GetCurrentThreadId () returned 0x9b0 [0035.862] RtlWakeConditionVariable () returned 0x27e800 [0035.862] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0035.862] lstrcmpiW (lpString1="hwruksh.dat", lpString2="Windows") returned -1 [0035.862] lstrcmpW (lpString1="hwruksh.dat", lpString2="32.EXE.exe") returned 1 [0035.862] StrStrW (lpFirst="hwruksh.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.862] lstrcmpW (lpString1="hwruksh.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.862] GetCurrentThreadId () returned 0x9b0 [0035.862] RtlWakeConditionVariable () returned 0x27e800 [0035.862] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0035.862] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="Windows") returned -1 [0035.862] lstrcmpW (lpString1="hwrusalm.dat", lpString2="32.EXE.exe") returned 1 [0035.862] StrStrW (lpFirst="hwrusalm.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.863] lstrcmpW (lpString1="hwrusalm.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.863] GetCurrentThreadId () returned 0x9b0 [0035.863] RtlWakeConditionVariable () returned 0x27e800 [0035.863] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0035.863] lstrcmpiW (lpString1="hwrusash.dat", lpString2="Windows") returned -1 [0035.863] lstrcmpW (lpString1="hwrusash.dat", lpString2="32.EXE.exe") returned 1 [0035.863] StrStrW (lpFirst="hwrusash.dat", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.863] lstrcmpW (lpString1="hwrusash.dat", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.863] GetCurrentThreadId () returned 0x9b0 [0035.863] RtlWakeConditionVariable () returned 0x27e800 [0035.863] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0035.863] lstrcmpiW (lpString1="InkDiv.dll", lpString2="Windows") returned -1 [0035.863] lstrcmpW (lpString1="InkDiv.dll", lpString2="32.EXE.exe") returned 1 [0035.863] StrStrW (lpFirst="InkDiv.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.863] lstrcmpW (lpString1="InkDiv.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.863] GetCurrentThreadId () returned 0x9b0 [0035.863] RtlWakeConditionVariable () returned 0x27e800 [0035.863] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0035.863] lstrcmpiW (lpString1="InkObj.dll", lpString2="Windows") returned -1 [0035.863] lstrcmpW (lpString1="InkObj.dll", lpString2="32.EXE.exe") returned 1 [0035.863] StrStrW (lpFirst="InkObj.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.863] lstrcmpW (lpString1="InkObj.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.863] GetCurrentThreadId () returned 0x9b0 [0035.863] RtlWakeConditionVariable () returned 0x27e800 [0035.863] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0035.863] lstrcmpiW (lpString1="InkWatson.exe", lpString2="Windows") returned -1 [0035.864] lstrcmpW (lpString1="InkWatson.exe", lpString2="32.EXE.exe") returned 1 [0035.864] StrStrW (lpFirst="InkWatson.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.864] lstrcmpW (lpString1="InkWatson.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.864] GetCurrentThreadId () returned 0x9b0 [0035.864] RtlWakeConditionVariable () returned 0x27e800 [0035.864] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0035.864] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="Windows") returned -1 [0035.864] lstrcmpW (lpString1="InputPersonalization.exe", lpString2="32.EXE.exe") returned 1 [0035.864] StrStrW (lpFirst="InputPersonalization.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.864] lstrcmpW (lpString1="InputPersonalization.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.864] GetCurrentThreadId () returned 0x9b0 [0035.864] RtlWakeConditionVariable () returned 0x27e800 [0035.864] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0035.864] lstrcmpiW (lpString1="ipscat.xml", lpString2="Windows") returned -1 [0035.864] lstrcmpW (lpString1="ipscat.xml", lpString2="32.EXE.exe") returned 1 [0035.864] StrStrW (lpFirst="ipscat.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.864] lstrcmpW (lpString1="ipscat.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.864] GetCurrentThreadId () returned 0x9b0 [0035.864] RtlWakeConditionVariable () returned 0x27e800 [0035.864] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0035.865] lstrcmpiW (lpString1="ipschs.xml", lpString2="Windows") returned -1 [0035.865] lstrcmpW (lpString1="ipschs.xml", lpString2="32.EXE.exe") returned 1 [0035.865] StrStrW (lpFirst="ipschs.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.865] lstrcmpW (lpString1="ipschs.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.865] GetCurrentThreadId () returned 0x9b0 [0035.865] RtlWakeConditionVariable () returned 0x27e800 [0035.865] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0035.865] lstrcmpiW (lpString1="ipscht.xml", lpString2="Windows") returned -1 [0035.865] lstrcmpW (lpString1="ipscht.xml", lpString2="32.EXE.exe") returned 1 [0035.865] StrStrW (lpFirst="ipscht.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.865] lstrcmpW (lpString1="ipscht.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.865] GetCurrentThreadId () returned 0x9b0 [0035.865] RtlWakeConditionVariable () returned 0x27e800 [0035.865] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0035.865] lstrcmpiW (lpString1="ipscsy.xml", lpString2="Windows") returned -1 [0035.865] lstrcmpW (lpString1="ipscsy.xml", lpString2="32.EXE.exe") returned 1 [0035.865] StrStrW (lpFirst="ipscsy.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.865] lstrcmpW (lpString1="ipscsy.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.865] GetCurrentThreadId () returned 0x9b0 [0035.865] RtlWakeConditionVariable () returned 0x27e800 [0035.866] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0035.866] lstrcmpiW (lpString1="ipsdan.xml", lpString2="Windows") returned -1 [0035.866] lstrcmpW (lpString1="ipsdan.xml", lpString2="32.EXE.exe") returned 1 [0035.866] StrStrW (lpFirst="ipsdan.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.866] lstrcmpW (lpString1="ipsdan.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.866] GetCurrentThreadId () returned 0x9b0 [0035.866] RtlWakeConditionVariable () returned 0x27e800 [0035.866] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0035.866] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="Windows") returned -1 [0035.866] lstrcmpW (lpString1="ipsdeu.xml", lpString2="32.EXE.exe") returned 1 [0035.866] StrStrW (lpFirst="ipsdeu.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.866] lstrcmpW (lpString1="ipsdeu.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.866] GetCurrentThreadId () returned 0x9b0 [0035.866] RtlWakeConditionVariable () returned 0x27e800 [0035.866] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0035.866] lstrcmpiW (lpString1="ipsen.xml", lpString2="Windows") returned -1 [0035.866] lstrcmpW (lpString1="ipsen.xml", lpString2="32.EXE.exe") returned 1 [0035.866] StrStrW (lpFirst="ipsen.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.866] lstrcmpW (lpString1="ipsen.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.866] GetCurrentThreadId () returned 0x9b0 [0035.866] RtlWakeConditionVariable () returned 0x27e800 [0035.866] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0035.866] lstrcmpiW (lpString1="ipsesp.xml", lpString2="Windows") returned -1 [0035.866] lstrcmpW (lpString1="ipsesp.xml", lpString2="32.EXE.exe") returned 1 [0035.866] StrStrW (lpFirst="ipsesp.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.866] lstrcmpW (lpString1="ipsesp.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.866] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.866] GetCurrentThreadId () returned 0x9b0 [0035.867] RtlWakeConditionVariable () returned 0x27e800 [0035.867] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0035.867] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="Windows") returned -1 [0035.867] lstrcmpW (lpString1="IPSEventLogMsg.dll", lpString2="32.EXE.exe") returned 1 [0035.867] StrStrW (lpFirst="IPSEventLogMsg.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.867] lstrcmpW (lpString1="IPSEventLogMsg.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.867] GetCurrentThreadId () returned 0x9b0 [0035.867] RtlWakeConditionVariable () returned 0x27e800 [0035.867] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0035.867] lstrcmpiW (lpString1="ipsfin.xml", lpString2="Windows") returned -1 [0035.867] lstrcmpW (lpString1="ipsfin.xml", lpString2="32.EXE.exe") returned 1 [0035.867] StrStrW (lpFirst="ipsfin.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.867] lstrcmpW (lpString1="ipsfin.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.867] GetCurrentThreadId () returned 0x9b0 [0035.867] RtlWakeConditionVariable () returned 0x27e800 [0035.867] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0035.867] lstrcmpiW (lpString1="ipsfra.xml", lpString2="Windows") returned -1 [0035.867] lstrcmpW (lpString1="ipsfra.xml", lpString2="32.EXE.exe") returned 1 [0035.867] StrStrW (lpFirst="ipsfra.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.867] lstrcmpW (lpString1="ipsfra.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.867] GetCurrentThreadId () returned 0x9b0 [0035.867] RtlWakeConditionVariable () returned 0x27e800 [0035.867] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0035.867] lstrcmpiW (lpString1="ipshrv.xml", lpString2="Windows") returned -1 [0035.867] lstrcmpW (lpString1="ipshrv.xml", lpString2="32.EXE.exe") returned 1 [0035.867] StrStrW (lpFirst="ipshrv.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.867] lstrcmpW (lpString1="ipshrv.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.868] GetCurrentThreadId () returned 0x9b0 [0035.868] RtlWakeConditionVariable () returned 0x27e800 [0035.868] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0035.868] lstrcmpiW (lpString1="ipsita.xml", lpString2="Windows") returned -1 [0035.868] lstrcmpW (lpString1="ipsita.xml", lpString2="32.EXE.exe") returned 1 [0035.868] StrStrW (lpFirst="ipsita.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.868] lstrcmpW (lpString1="ipsita.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.868] GetCurrentThreadId () returned 0x9b0 [0035.868] RtlWakeConditionVariable () returned 0x27e800 [0035.868] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0035.868] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="Windows") returned -1 [0035.868] lstrcmpW (lpString1="ipsjpn.xml", lpString2="32.EXE.exe") returned 1 [0035.868] StrStrW (lpFirst="ipsjpn.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.868] lstrcmpW (lpString1="ipsjpn.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.868] GetCurrentThreadId () returned 0x9b0 [0035.868] RtlWakeConditionVariable () returned 0x27e800 [0035.868] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0035.868] lstrcmpiW (lpString1="ipskor.xml", lpString2="Windows") returned -1 [0035.868] lstrcmpW (lpString1="ipskor.xml", lpString2="32.EXE.exe") returned 1 [0035.868] StrStrW (lpFirst="ipskor.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.868] lstrcmpW (lpString1="ipskor.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.868] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.868] GetCurrentThreadId () returned 0x9b0 [0035.868] RtlWakeConditionVariable () returned 0x27e800 [0035.868] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0035.868] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="Windows") returned -1 [0035.868] lstrcmpW (lpString1="IpsMigrationPlugin.dll", lpString2="32.EXE.exe") returned 1 [0035.869] StrStrW (lpFirst="IpsMigrationPlugin.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.869] lstrcmpW (lpString1="IpsMigrationPlugin.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.869] GetCurrentThreadId () returned 0x9b0 [0035.869] RtlWakeConditionVariable () returned 0x27e800 [0035.869] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0035.869] lstrcmpiW (lpString1="ipsnld.xml", lpString2="Windows") returned -1 [0035.869] lstrcmpW (lpString1="ipsnld.xml", lpString2="32.EXE.exe") returned 1 [0035.869] StrStrW (lpFirst="ipsnld.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.869] lstrcmpW (lpString1="ipsnld.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.869] GetCurrentThreadId () returned 0x9b0 [0035.869] RtlWakeConditionVariable () returned 0x27e800 [0035.869] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0035.869] lstrcmpiW (lpString1="ipsnor.xml", lpString2="Windows") returned -1 [0035.869] lstrcmpW (lpString1="ipsnor.xml", lpString2="32.EXE.exe") returned 1 [0035.869] StrStrW (lpFirst="ipsnor.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.869] lstrcmpW (lpString1="ipsnor.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.869] GetCurrentThreadId () returned 0x9b0 [0035.869] RtlWakeConditionVariable () returned 0x27e800 [0035.869] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0035.869] lstrcmpiW (lpString1="ipsplk.xml", lpString2="Windows") returned -1 [0035.869] lstrcmpW (lpString1="ipsplk.xml", lpString2="32.EXE.exe") returned 1 [0035.869] StrStrW (lpFirst="ipsplk.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.869] lstrcmpW (lpString1="ipsplk.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.869] GetCurrentThreadId () returned 0x9b0 [0035.869] RtlWakeConditionVariable () returned 0x27e800 [0035.869] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0035.870] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="Windows") returned -1 [0035.870] lstrcmpW (lpString1="IpsPlugin.dll", lpString2="32.EXE.exe") returned 1 [0035.870] StrStrW (lpFirst="IpsPlugin.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.870] lstrcmpW (lpString1="IpsPlugin.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.870] GetCurrentThreadId () returned 0x9b0 [0035.870] RtlWakeConditionVariable () returned 0x27e800 [0035.870] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0035.870] lstrcmpiW (lpString1="ipsptb.xml", lpString2="Windows") returned -1 [0035.870] lstrcmpW (lpString1="ipsptb.xml", lpString2="32.EXE.exe") returned 1 [0035.870] StrStrW (lpFirst="ipsptb.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.870] lstrcmpW (lpString1="ipsptb.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.870] GetCurrentThreadId () returned 0x9b0 [0035.870] RtlWakeConditionVariable () returned 0x27e800 [0035.870] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0035.870] lstrcmpiW (lpString1="ipsptg.xml", lpString2="Windows") returned -1 [0035.870] lstrcmpW (lpString1="ipsptg.xml", lpString2="32.EXE.exe") returned 1 [0035.870] StrStrW (lpFirst="ipsptg.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.870] lstrcmpW (lpString1="ipsptg.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.870] GetCurrentThreadId () returned 0x9b0 [0035.870] RtlWakeConditionVariable () returned 0x27e800 [0035.870] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0035.870] lstrcmpiW (lpString1="ipsrom.xml", lpString2="Windows") returned -1 [0035.870] lstrcmpW (lpString1="ipsrom.xml", lpString2="32.EXE.exe") returned 1 [0035.870] StrStrW (lpFirst="ipsrom.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.870] lstrcmpW (lpString1="ipsrom.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.870] GetCurrentThreadId () returned 0x9b0 [0035.871] RtlWakeConditionVariable () returned 0x27e800 [0035.871] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0035.871] lstrcmpiW (lpString1="ipsrus.xml", lpString2="Windows") returned -1 [0035.871] lstrcmpW (lpString1="ipsrus.xml", lpString2="32.EXE.exe") returned 1 [0035.871] StrStrW (lpFirst="ipsrus.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.871] lstrcmpW (lpString1="ipsrus.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.871] GetCurrentThreadId () returned 0x9b0 [0035.871] RtlWakeConditionVariable () returned 0x27e800 [0035.871] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0035.871] lstrcmpiW (lpString1="ipssrb.xml", lpString2="Windows") returned -1 [0035.871] lstrcmpW (lpString1="ipssrb.xml", lpString2="32.EXE.exe") returned 1 [0035.871] StrStrW (lpFirst="ipssrb.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.871] lstrcmpW (lpString1="ipssrb.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.871] GetCurrentThreadId () returned 0x9b0 [0035.871] RtlWakeConditionVariable () returned 0x27e800 [0035.871] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0035.871] lstrcmpiW (lpString1="ipssrl.xml", lpString2="Windows") returned -1 [0035.871] lstrcmpW (lpString1="ipssrl.xml", lpString2="32.EXE.exe") returned 1 [0035.871] StrStrW (lpFirst="ipssrl.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.871] lstrcmpW (lpString1="ipssrl.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.871] GetCurrentThreadId () returned 0x9b0 [0035.871] RtlWakeConditionVariable () returned 0x27e800 [0035.871] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0035.871] lstrcmpiW (lpString1="ipssve.xml", lpString2="Windows") returned -1 [0035.871] lstrcmpW (lpString1="ipssve.xml", lpString2="32.EXE.exe") returned 1 [0035.871] StrStrW (lpFirst="ipssve.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.871] lstrcmpW (lpString1="ipssve.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.872] GetCurrentThreadId () returned 0x9b0 [0035.872] RtlWakeConditionVariable () returned 0x27e800 [0035.872] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0035.872] lstrcmpiW (lpString1="it-IT", lpString2="Windows") returned -1 [0035.872] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0035.872] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0035.872] lstrcmpW (lpString1="it-IT", lpString2="AppData") returned 1 [0035.872] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpSrch="AppData") returned 0x0 [0035.872] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpString2="C:\\Windows") returned -1 [0035.872] lstrlenW (lpString="C:\\Windows") returned 10 [0035.872] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpString2="C:\\System Volume Information") returned -1 [0035.872] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.873] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.873] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.873] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.873] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.873] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.873] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.873] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.873] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.873] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.873] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.873] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.873] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.873] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.873] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.873] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.873] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.873] GetCurrentThreadId () returned 0x9b0 [0035.874] RtlWakeConditionVariable () returned 0x27e800 [0035.874] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.874] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.874] GetCurrentThreadId () returned 0x9b0 [0035.874] RtlWakeConditionVariable () returned 0x27e800 [0035.874] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0035.874] lstrcmpiW (lpString1="ja-JP", lpString2="Windows") returned -1 [0035.874] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0035.874] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0035.874] lstrcmpW (lpString1="ja-JP", lpString2="AppData") returned 1 [0035.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpSrch="AppData") returned 0x0 [0035.874] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpString2="C:\\Windows") returned -1 [0035.874] lstrlenW (lpString="C:\\Windows") returned 10 [0035.874] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpString2="C:\\System Volume Information") returned -1 [0035.874] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.875] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.875] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.875] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.875] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.875] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.875] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.875] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.876] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.876] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.876] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.876] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.876] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.876] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.876] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.876] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.876] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.876] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.876] GetCurrentThreadId () returned 0x9b0 [0035.876] RtlWakeConditionVariable () returned 0x27e800 [0035.876] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.876] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.876] GetCurrentThreadId () returned 0x9b0 [0035.876] RtlWakeConditionVariable () returned 0x27e800 [0035.876] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0035.876] lstrcmpiW (lpString1="journal.dll", lpString2="Windows") returned -1 [0035.876] lstrcmpW (lpString1="journal.dll", lpString2="32.EXE.exe") returned 1 [0035.876] StrStrW (lpFirst="journal.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.876] lstrcmpW (lpString1="journal.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.876] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0035.876] GetCurrentThreadId () returned 0x9b0 [0035.877] RtlWakeConditionVariable () returned 0x27e800 [0035.877] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0035.877] lstrcmpiW (lpString1="ko-KR", lpString2="Windows") returned -1 [0035.877] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0035.877] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0035.877] lstrcmpW (lpString1="ko-KR", lpString2="AppData") returned 1 [0035.877] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpSrch="AppData") returned 0x0 [0035.877] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpString2="C:\\Windows") returned -1 [0035.877] lstrlenW (lpString="C:\\Windows") returned 10 [0035.877] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpString2="C:\\System Volume Information") returned -1 [0035.877] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.877] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299110 [0035.877] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0035.877] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.877] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0035.877] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.877] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.877] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0035.877] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0035.877] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.877] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.878] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0035.878] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.878] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.878] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.878] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0035.878] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0035.878] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0035.878] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0035.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d220 [0035.878] GetCurrentThreadId () returned 0x9b0 [0035.878] RtlWakeConditionVariable () returned 0x27e800 [0035.878] FindNextFileW (in: hFindFile=0x299110, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0035.878] FindClose (in: hFindFile=0x299110 | out: hFindFile=0x299110) returned 1 [0035.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0035.878] GetCurrentThreadId () returned 0x9b0 [0035.878] RtlWakeConditionVariable () returned 0x27e800 [0035.878] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0035.878] lstrcmpiW (lpString1="lt-LT", lpString2="Windows") returned -1 [0035.878] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0035.878] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0035.878] lstrcmpW (lpString1="lt-LT", lpString2="AppData") returned 1 [0035.878] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpSrch="AppData") returned 0x0 [0035.878] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpString2="C:\\Windows") returned -1 [0035.878] lstrlenW (lpString="C:\\Windows") returned 10 [0035.878] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpString2="C:\\System Volume Information") returned -1 [0035.878] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0035.878] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0035.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0036.100] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.100] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.100] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.100] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.101] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.101] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.101] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.101] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.101] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.101] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.101] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.101] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.101] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.101] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.101] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.101] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.101] GetCurrentThreadId () returned 0x9b0 [0036.101] RtlWakeConditionVariable () returned 0x27e800 [0036.101] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.101] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0036.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0036.101] GetCurrentThreadId () returned 0x9b0 [0036.101] RtlWakeConditionVariable () returned 0x27e800 [0036.101] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0036.101] lstrcmpiW (lpString1="lv-LV", lpString2="Windows") returned -1 [0036.101] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0036.102] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0036.102] lstrcmpW (lpString1="lv-LV", lpString2="AppData") returned 1 [0036.102] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpSrch="AppData") returned 0x0 [0036.102] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpString2="C:\\Windows") returned -1 [0036.102] lstrlenW (lpString="C:\\Windows") returned 10 [0036.102] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpString2="C:\\System Volume Information") returned -1 [0036.102] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.102] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5250 [0036.102] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.102] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.102] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.102] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.102] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.102] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.102] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.102] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.102] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.102] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.102] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.103] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.103] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.103] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.103] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.103] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.103] GetCurrentThreadId () returned 0x9b0 [0036.103] RtlWakeConditionVariable () returned 0x27e800 [0036.103] FindNextFileW (in: hFindFile=0x2d5250, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.103] FindClose (in: hFindFile=0x2d5250 | out: hFindFile=0x2d5250) returned 1 [0036.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0036.103] GetCurrentThreadId () returned 0x9b0 [0036.103] RtlWakeConditionVariable () returned 0x27e800 [0036.103] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0036.103] lstrcmpiW (lpString1="micaut.dll", lpString2="Windows") returned -1 [0036.103] lstrcmpW (lpString1="micaut.dll", lpString2="32.EXE.exe") returned 1 [0036.103] StrStrW (lpFirst="micaut.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.103] lstrcmpW (lpString1="micaut.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.103] GetCurrentThreadId () returned 0x9b0 [0036.103] RtlWakeConditionVariable () returned 0x27e800 [0036.103] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0036.103] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="Windows") returned -1 [0036.103] lstrcmpW (lpString1="Microsoft.Ink.dll", lpString2="32.EXE.exe") returned 1 [0036.103] StrStrW (lpFirst="Microsoft.Ink.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.103] lstrcmpW (lpString1="Microsoft.Ink.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.104] GetCurrentThreadId () returned 0x9b0 [0036.104] RtlWakeConditionVariable () returned 0x27e800 [0036.104] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0036.104] lstrcmpiW (lpString1="mip.exe", lpString2="Windows") returned -1 [0036.104] lstrcmpW (lpString1="mip.exe", lpString2="32.EXE.exe") returned 1 [0036.104] StrStrW (lpFirst="mip.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.104] lstrcmpW (lpString1="mip.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x2d5250 [0036.104] GetCurrentThreadId () returned 0x9b0 [0036.104] RtlWakeConditionVariable () returned 0x27e800 [0036.104] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0036.104] lstrcmpiW (lpString1="mraut.dll", lpString2="Windows") returned -1 [0036.104] lstrcmpW (lpString1="mraut.dll", lpString2="32.EXE.exe") returned 1 [0036.104] StrStrW (lpFirst="mraut.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.104] lstrcmpW (lpString1="mraut.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.104] GetCurrentThreadId () returned 0x9b0 [0036.104] RtlWakeConditionVariable () returned 0x27e800 [0036.104] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0036.104] lstrcmpiW (lpString1="mshwgst.dll", lpString2="Windows") returned -1 [0036.104] lstrcmpW (lpString1="mshwgst.dll", lpString2="32.EXE.exe") returned 1 [0036.104] StrStrW (lpFirst="mshwgst.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.104] lstrcmpW (lpString1="mshwgst.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.104] GetCurrentThreadId () returned 0x9b0 [0036.104] RtlWakeConditionVariable () returned 0x27e800 [0036.104] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0036.105] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="Windows") returned -1 [0036.105] lstrcmpW (lpString1="mshwLatin.dll", lpString2="32.EXE.exe") returned 1 [0036.105] StrStrW (lpFirst="mshwLatin.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.105] lstrcmpW (lpString1="mshwLatin.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.105] GetCurrentThreadId () returned 0x9b0 [0036.105] RtlWakeConditionVariable () returned 0x27e800 [0036.105] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0036.105] lstrcmpiW (lpString1="nb-NO", lpString2="Windows") returned -1 [0036.105] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0036.105] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0036.105] lstrcmpW (lpString1="nb-NO", lpString2="AppData") returned 1 [0036.105] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpSrch="AppData") returned 0x0 [0036.105] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpString2="C:\\Windows") returned -1 [0036.105] lstrlenW (lpString="C:\\Windows") returned 10 [0036.105] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpString2="C:\\System Volume Information") returned -1 [0036.105] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.105] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.105] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.105] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.105] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.106] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.106] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.106] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.106] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.106] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.106] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.106] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.106] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.106] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.106] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.106] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.106] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.106] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.106] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.106] GetCurrentThreadId () returned 0x9b0 [0036.106] RtlWakeConditionVariable () returned 0x27e800 [0036.106] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.106] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.106] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0036.106] GetCurrentThreadId () returned 0x9b0 [0036.106] RtlWakeConditionVariable () returned 0x27e800 [0036.106] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0036.106] lstrcmpiW (lpString1="nl-NL", lpString2="Windows") returned -1 [0036.106] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0036.106] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0036.106] lstrcmpW (lpString1="nl-NL", lpString2="AppData") returned 1 [0036.107] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpSrch="AppData") returned 0x0 [0036.107] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpString2="C:\\Windows") returned -1 [0036.107] lstrlenW (lpString="C:\\Windows") returned 10 [0036.107] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpString2="C:\\System Volume Information") returned -1 [0036.107] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.107] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.107] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.107] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.107] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.107] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.107] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.107] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.107] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.107] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.107] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.107] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.107] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.107] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.107] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.107] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.107] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.108] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.108] GetCurrentThreadId () returned 0x9b0 [0036.108] RtlWakeConditionVariable () returned 0x27e800 [0036.108] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.108] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f31a8 [0036.108] GetCurrentThreadId () returned 0x9b0 [0036.108] RtlWakeConditionVariable () returned 0x27e800 [0036.108] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0036.108] lstrcmpiW (lpString1="pl-PL", lpString2="Windows") returned -1 [0036.108] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0036.108] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0036.108] lstrcmpW (lpString1="pl-PL", lpString2="AppData") returned 1 [0036.108] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpSrch="AppData") returned 0x0 [0036.108] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpString2="C:\\Windows") returned -1 [0036.108] lstrlenW (lpString="C:\\Windows") returned 10 [0036.108] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpString2="C:\\System Volume Information") returned -1 [0036.108] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.108] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.295] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.295] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.295] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.295] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.295] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.295] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.295] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.295] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.295] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.295] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.295] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.295] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.295] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.295] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.295] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.295] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.295] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0036.296] GetCurrentThreadId () returned 0x9b0 [0036.296] RtlWakeConditionVariable () returned 0x27e800 [0036.296] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.296] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0036.296] GetCurrentThreadId () returned 0x9b0 [0036.296] RtlWakeConditionVariable () returned 0x27e800 [0036.297] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0036.297] lstrcmpiW (lpString1="pt-BR", lpString2="Windows") returned -1 [0036.297] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0036.297] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0036.297] lstrcmpW (lpString1="pt-BR", lpString2="AppData") returned 1 [0036.297] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpSrch="AppData") returned 0x0 [0036.297] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpString2="C:\\Windows") returned -1 [0036.297] lstrlenW (lpString="C:\\Windows") returned 10 [0036.297] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpString2="C:\\System Volume Information") returned -1 [0036.297] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.297] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.298] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.298] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.298] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.298] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.298] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.298] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.298] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.298] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.298] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.298] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.298] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.298] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.298] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.298] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.298] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.299] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0036.299] GetCurrentThreadId () returned 0x9b0 [0036.299] RtlWakeConditionVariable () returned 0x27e800 [0036.299] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.299] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0036.299] GetCurrentThreadId () returned 0x9b0 [0036.299] RtlWakeConditionVariable () returned 0x27e800 [0036.299] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0036.299] lstrcmpiW (lpString1="pt-PT", lpString2="Windows") returned -1 [0036.299] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0036.299] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0036.299] lstrcmpW (lpString1="pt-PT", lpString2="AppData") returned 1 [0036.299] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpSrch="AppData") returned 0x0 [0036.299] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpString2="C:\\Windows") returned -1 [0036.299] lstrlenW (lpString="C:\\Windows") returned 10 [0036.299] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpString2="C:\\System Volume Information") returned -1 [0036.299] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.299] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.300] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.300] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.300] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.300] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.300] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.300] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.300] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.300] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.300] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.300] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.300] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.300] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.300] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.300] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.300] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.301] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.301] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0036.301] GetCurrentThreadId () returned 0x9b0 [0036.301] RtlWakeConditionVariable () returned 0x27e800 [0036.301] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.301] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0036.301] GetCurrentThreadId () returned 0x9b0 [0036.301] RtlWakeConditionVariable () returned 0x27e800 [0036.301] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0036.301] lstrcmpiW (lpString1="ro-RO", lpString2="Windows") returned -1 [0036.301] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0036.301] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0036.301] lstrcmpW (lpString1="ro-RO", lpString2="AppData") returned 1 [0036.301] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpSrch="AppData") returned 0x0 [0036.301] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpString2="C:\\Windows") returned -1 [0036.301] lstrlenW (lpString="C:\\Windows") returned 10 [0036.301] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpString2="C:\\System Volume Information") returned -1 [0036.301] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.302] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.302] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.302] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.302] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.302] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.302] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.302] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.302] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.302] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.302] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.302] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.302] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.302] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.302] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.302] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.302] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.302] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0036.302] GetCurrentThreadId () returned 0x9b0 [0036.303] RtlWakeConditionVariable () returned 0x27e800 [0036.303] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.303] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0036.303] GetCurrentThreadId () returned 0x9b0 [0036.303] RtlWakeConditionVariable () returned 0x27e800 [0036.303] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0036.303] lstrcmpiW (lpString1="rtscom.dll", lpString2="Windows") returned -1 [0036.303] lstrcmpW (lpString1="rtscom.dll", lpString2="32.EXE.exe") returned 1 [0036.303] StrStrW (lpFirst="rtscom.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.303] lstrcmpW (lpString1="rtscom.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.303] GetCurrentThreadId () returned 0x9b0 [0036.303] RtlWakeConditionVariable () returned 0x27e800 [0036.303] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0036.303] lstrcmpiW (lpString1="ru-RU", lpString2="Windows") returned -1 [0036.303] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0036.303] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0036.303] lstrcmpW (lpString1="ru-RU", lpString2="AppData") returned 1 [0036.303] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpSrch="AppData") returned 0x0 [0036.303] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpString2="C:\\Windows") returned -1 [0036.303] lstrlenW (lpString="C:\\Windows") returned 10 [0036.303] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpString2="C:\\System Volume Information") returned -1 [0036.303] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.552] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.552] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.552] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.552] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.552] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.552] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.553] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.553] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.553] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.553] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.553] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.553] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.553] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.553] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.553] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.553] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.553] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.553] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0036.553] GetCurrentThreadId () returned 0x9b0 [0036.553] RtlWakeConditionVariable () returned 0x27e800 [0036.553] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.553] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bb30 [0036.554] GetCurrentThreadId () returned 0x9b0 [0036.554] RtlWakeConditionVariable () returned 0x27e800 [0036.554] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0036.554] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="Windows") returned -1 [0036.554] lstrcmpW (lpString1="ShapeCollector.exe", lpString2="32.EXE.exe") returned 1 [0036.554] StrStrW (lpFirst="ShapeCollector.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.554] lstrcmpW (lpString1="ShapeCollector.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.554] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0036.554] GetCurrentThreadId () returned 0x9b0 [0036.554] RtlWakeConditionVariable () returned 0x27e800 [0036.554] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0036.554] lstrcmpiW (lpString1="sk-SK", lpString2="Windows") returned -1 [0036.555] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0036.555] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0036.555] lstrcmpW (lpString1="sk-SK", lpString2="AppData") returned 1 [0036.555] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpSrch="AppData") returned 0x0 [0036.555] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpString2="C:\\Windows") returned -1 [0036.555] lstrlenW (lpString="C:\\Windows") returned 10 [0036.555] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpString2="C:\\System Volume Information") returned -1 [0036.555] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.555] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.555] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.555] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.555] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.555] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.555] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.555] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.556] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.556] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.556] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.556] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.556] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.556] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.556] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.556] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.556] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.556] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.556] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.556] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d370 [0036.556] GetCurrentThreadId () returned 0x9b0 [0036.556] RtlWakeConditionVariable () returned 0x27e800 [0036.556] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.556] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0036.679] GetCurrentThreadId () returned 0x9b0 [0036.697] RtlWakeConditionVariable () returned 0x27e800 [0036.698] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0036.698] lstrcmpiW (lpString1="sl-SI", lpString2="Windows") returned -1 [0036.698] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0036.698] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0036.698] lstrcmpW (lpString1="sl-SI", lpString2="AppData") returned 1 [0036.698] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpSrch="AppData") returned 0x0 [0036.698] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpString2="C:\\Windows") returned -1 [0036.699] lstrlenW (lpString="C:\\Windows") returned 10 [0036.699] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpString2="C:\\System Volume Information") returned -1 [0036.699] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.699] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.699] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.699] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.699] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.699] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.699] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.699] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.700] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.700] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.700] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.700] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.700] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.700] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.700] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.700] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.700] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.700] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.700] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d418 [0036.700] GetCurrentThreadId () returned 0x9b0 [0036.700] RtlWakeConditionVariable () returned 0x27e800 [0036.700] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.700] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0036.700] GetCurrentThreadId () returned 0x9b0 [0036.700] RtlWakeConditionVariable () returned 0x27e800 [0036.700] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0036.700] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="Windows") returned -1 [0036.700] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0036.700] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0036.700] lstrcmpW (lpString1="sr-Latn-CS", lpString2="AppData") returned 1 [0036.700] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpSrch="AppData") returned 0x0 [0036.700] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpString2="C:\\Windows") returned -1 [0036.700] lstrlenW (lpString="C:\\Windows") returned 10 [0036.700] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpString2="C:\\System Volume Information") returned -1 [0036.701] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.701] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.701] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.701] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.701] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.701] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.701] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.701] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.701] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.701] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.701] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.701] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.701] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.701] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.701] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.701] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.701] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.701] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.701] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0036.702] GetCurrentThreadId () returned 0x9b0 [0036.702] RtlWakeConditionVariable () returned 0x27e800 [0036.702] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.702] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0036.702] GetCurrentThreadId () returned 0x9b0 [0036.702] RtlWakeConditionVariable () returned 0x27e800 [0036.702] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0036.702] lstrcmpiW (lpString1="sv-SE", lpString2="Windows") returned -1 [0036.702] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0036.702] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0036.702] lstrcmpW (lpString1="sv-SE", lpString2="AppData") returned 1 [0036.702] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpSrch="AppData") returned 0x0 [0036.702] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpString2="C:\\Windows") returned -1 [0036.702] lstrlenW (lpString="C:\\Windows") returned 10 [0036.702] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpString2="C:\\System Volume Information") returned -1 [0036.702] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.702] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.853] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.853] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.853] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.853] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.853] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.853] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.854] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.854] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.854] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.854] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.854] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.854] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.854] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.854] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.854] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.854] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.854] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.854] GetCurrentThreadId () returned 0x9b0 [0036.854] RtlWakeConditionVariable () returned 0x27e800 [0036.854] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.854] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.854] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0036.854] GetCurrentThreadId () returned 0x9b0 [0036.854] RtlWakeConditionVariable () returned 0x27e800 [0036.854] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0036.854] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="Windows") returned -1 [0036.855] lstrcmpW (lpString1="TabIpsps.dll", lpString2="32.EXE.exe") returned 1 [0036.855] StrStrW (lpFirst="TabIpsps.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.855] lstrcmpW (lpString1="TabIpsps.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.855] GetCurrentThreadId () returned 0x9b0 [0036.855] RtlWakeConditionVariable () returned 0x27e800 [0036.855] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0036.855] lstrcmpiW (lpString1="tabskb.dll", lpString2="Windows") returned -1 [0036.855] lstrcmpW (lpString1="tabskb.dll", lpString2="32.EXE.exe") returned 1 [0036.855] StrStrW (lpFirst="tabskb.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.855] lstrcmpW (lpString1="tabskb.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.855] GetCurrentThreadId () returned 0x9b0 [0036.855] RtlWakeConditionVariable () returned 0x27e800 [0036.855] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0036.855] lstrcmpiW (lpString1="TabTip.exe", lpString2="Windows") returned -1 [0036.855] lstrcmpW (lpString1="TabTip.exe", lpString2="32.EXE.exe") returned 1 [0036.855] StrStrW (lpFirst="TabTip.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.855] lstrcmpW (lpString1="TabTip.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.855] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.855] GetCurrentThreadId () returned 0x9b0 [0036.855] RtlWakeConditionVariable () returned 0x27e800 [0036.855] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0036.855] lstrcmpiW (lpString1="th-TH", lpString2="Windows") returned -1 [0036.855] lstrcmpW (lpString1="th-TH", lpString2=".") returned 1 [0036.855] lstrcmpW (lpString1="th-TH", lpString2="..") returned 1 [0036.855] lstrcmpW (lpString1="th-TH", lpString2="AppData") returned 1 [0036.855] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpSrch="AppData") returned 0x0 [0036.855] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpString2="C:\\Windows") returned -1 [0036.855] lstrlenW (lpString="C:\\Windows") returned 10 [0036.856] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpString2="C:\\System Volume Information") returned -1 [0036.856] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.856] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.856] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.856] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.856] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.856] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.856] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.856] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.856] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.856] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.856] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.856] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.856] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.856] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.856] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.856] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.856] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.856] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.856] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.857] GetCurrentThreadId () returned 0x9b0 [0036.857] RtlWakeConditionVariable () returned 0x27e800 [0036.857] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.857] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0036.857] GetCurrentThreadId () returned 0x9b0 [0036.857] RtlWakeConditionVariable () returned 0x27e800 [0036.857] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0036.857] lstrcmpiW (lpString1="TipBand.dll", lpString2="Windows") returned -1 [0036.857] lstrcmpW (lpString1="TipBand.dll", lpString2="32.EXE.exe") returned 1 [0036.857] StrStrW (lpFirst="TipBand.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.857] lstrcmpW (lpString1="TipBand.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.857] GetCurrentThreadId () returned 0x9b0 [0036.857] RtlWakeConditionVariable () returned 0x27e800 [0036.857] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0036.857] lstrcmpiW (lpString1="TipRes.dll", lpString2="Windows") returned -1 [0036.857] lstrcmpW (lpString1="TipRes.dll", lpString2="32.EXE.exe") returned 1 [0036.857] StrStrW (lpFirst="TipRes.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.857] lstrcmpW (lpString1="TipRes.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.857] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.857] GetCurrentThreadId () returned 0x9b0 [0036.857] RtlWakeConditionVariable () returned 0x27e800 [0036.857] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0036.857] lstrcmpiW (lpString1="tipresx.dll", lpString2="Windows") returned -1 [0036.857] lstrcmpW (lpString1="tipresx.dll", lpString2="32.EXE.exe") returned 1 [0036.858] StrStrW (lpFirst="tipresx.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.858] lstrcmpW (lpString1="tipresx.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.858] GetCurrentThreadId () returned 0x9b0 [0036.858] RtlWakeConditionVariable () returned 0x27e800 [0036.858] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0036.858] lstrcmpiW (lpString1="tipskins.dll", lpString2="Windows") returned -1 [0036.858] lstrcmpW (lpString1="tipskins.dll", lpString2="32.EXE.exe") returned 1 [0036.858] StrStrW (lpFirst="tipskins.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.858] lstrcmpW (lpString1="tipskins.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.858] GetCurrentThreadId () returned 0x9b0 [0036.858] RtlWakeConditionVariable () returned 0x27e800 [0036.858] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0036.858] lstrcmpiW (lpString1="tiptsf.dll", lpString2="Windows") returned -1 [0036.858] lstrcmpW (lpString1="tiptsf.dll", lpString2="32.EXE.exe") returned 1 [0036.858] StrStrW (lpFirst="tiptsf.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.858] lstrcmpW (lpString1="tiptsf.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.858] GetCurrentThreadId () returned 0x9b0 [0036.858] RtlWakeConditionVariable () returned 0x27e800 [0036.858] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0036.858] lstrcmpiW (lpString1="tpcps.dll", lpString2="Windows") returned -1 [0036.858] lstrcmpW (lpString1="tpcps.dll", lpString2="32.EXE.exe") returned 1 [0036.858] StrStrW (lpFirst="tpcps.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.858] lstrcmpW (lpString1="tpcps.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.858] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0036.858] GetCurrentThreadId () returned 0x9b0 [0036.858] RtlWakeConditionVariable () returned 0x27e800 [0036.859] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0036.859] lstrcmpiW (lpString1="tr-TR", lpString2="Windows") returned -1 [0036.859] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0036.859] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0036.859] lstrcmpW (lpString1="tr-TR", lpString2="AppData") returned 1 [0036.859] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpSrch="AppData") returned 0x0 [0036.859] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpString2="C:\\Windows") returned -1 [0036.859] lstrlenW (lpString="C:\\Windows") returned 10 [0036.859] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpString2="C:\\System Volume Information") returned -1 [0036.859] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.859] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.859] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.859] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.859] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.859] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.859] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.859] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.859] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.860] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.860] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.860] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.860] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.860] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.860] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.860] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.860] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.860] GetCurrentThreadId () returned 0x9b0 [0036.860] RtlWakeConditionVariable () returned 0x27e800 [0036.860] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.860] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0036.860] GetCurrentThreadId () returned 0x9b0 [0036.860] RtlWakeConditionVariable () returned 0x27e800 [0036.860] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0036.860] lstrcmpiW (lpString1="uk-UA", lpString2="Windows") returned -1 [0036.860] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0036.860] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0036.860] lstrcmpW (lpString1="uk-UA", lpString2="AppData") returned 1 [0036.860] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpSrch="AppData") returned 0x0 [0036.860] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpString2="C:\\Windows") returned -1 [0036.860] lstrlenW (lpString="C:\\Windows") returned 10 [0036.860] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpString2="C:\\System Volume Information") returned -1 [0036.860] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0036.861] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0036.861] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.861] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0036.861] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.861] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.861] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0036.861] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0036.861] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.861] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.861] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0036.861] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.861] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.861] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0036.861] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0036.861] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0036.861] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0036.861] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0036.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0036.861] GetCurrentThreadId () returned 0x9b0 [0036.861] RtlWakeConditionVariable () returned 0x27e800 [0036.862] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0036.862] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0036.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0036.862] GetCurrentThreadId () returned 0x9b0 [0036.862] RtlWakeConditionVariable () returned 0x27e800 [0036.862] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0036.862] lstrcmpiW (lpString1="zh-CN", lpString2="Windows") returned 1 [0036.862] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0036.862] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0036.862] lstrcmpW (lpString1="zh-CN", lpString2="AppData") returned 1 [0036.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpSrch="AppData") returned 0x0 [0036.862] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpString2="C:\\Windows") returned -1 [0036.862] lstrlenW (lpString="C:\\Windows") returned 10 [0036.862] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpString2="C:\\System Volume Information") returned -1 [0036.862] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0036.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0036.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0038.859] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0038.859] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0038.859] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0038.859] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0038.859] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0038.859] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0038.860] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0038.860] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0038.860] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0038.860] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0038.860] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0038.860] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0038.860] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0038.860] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0038.860] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0038.860] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0038.860] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0038.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0038.860] GetCurrentThreadId () returned 0x9b0 [0038.860] GetCurrentThreadId () returned 0x9b0 [0038.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1370 [0038.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d6b8 [0038.860] RtlWakeConditionVariable () returned 0x27e800 [0038.860] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0038.860] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0038.860] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0038.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0038.860] GetCurrentThreadId () returned 0x9b0 [0038.860] GetCurrentThreadId () returned 0x9b0 [0038.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1338 [0038.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b570 [0038.861] RtlWakeConditionVariable () returned 0x27e800 [0038.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c768 | out: hHeap=0x260000) returned 1 [0038.861] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2faac8 | out: hHeap=0x260000) returned 1 [0038.862] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0038.862] lstrcmpiW (lpString1="zh-TW", lpString2="Windows") returned 1 [0038.862] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0038.862] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0038.862] lstrcmpW (lpString1="zh-TW", lpString2="AppData") returned 1 [0038.862] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpSrch="AppData") returned 0x0 [0038.862] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpString2="C:\\Windows") returned -1 [0038.862] lstrlenW (lpString="C:\\Windows") returned 10 [0038.862] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpString2="C:\\System Volume Information") returned -1 [0038.862] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0038.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0038.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0038.863] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0038.863] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0038.863] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0038.863] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0038.863] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0038.863] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0038.863] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0038.863] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0038.863] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0038.863] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0038.863] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0038.863] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0038.863] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0038.863] lstrcmpiW (lpString1="tipresx.dll.mui", lpString2="Windows") returned -1 [0038.863] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="32.EXE.exe") returned 1 [0038.863] StrStrW (lpFirst="tipresx.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0038.863] lstrcmpW (lpString1="tipresx.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0038.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0038.863] GetCurrentThreadId () returned 0x9b0 [0038.863] GetCurrentThreadId () returned 0x9b0 [0038.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x2a1300 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0038.864] RtlWakeConditionVariable () returned 0x27e800 [0038.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29d568 | out: hHeap=0x260000) returned 1 [0038.864] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x98, dwReserved1=0x260000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0038.864] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0038.864] GetCurrentThreadId () returned 0x9b0 [0038.864] GetCurrentThreadId () returned 0x9b0 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdc0 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b4b8 [0038.864] RtlWakeConditionVariable () returned 0x27e800 [0038.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c768 | out: hHeap=0x260000) returned 1 [0038.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2faac8 | out: hHeap=0x260000) returned 1 [0038.864] FindNextFileW (in: hFindFile=0x2b3a38, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0038.864] FindClose (in: hFindFile=0x2b3a38 | out: hFindFile=0x2b3a38) returned 1 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c768 [0038.864] GetCurrentThreadId () returned 0x9b0 [0038.864] GetCurrentThreadId () returned 0x9b0 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x30) returned 0x30cdf8 [0038.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3de0 [0038.864] RtlWakeConditionVariable () returned 0x27e800 [0038.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x29c768 | out: hHeap=0x260000) returned 1 [0038.864] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2db8a0 | out: hHeap=0x260000) returned 1 [0038.865] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0038.865] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="Windows") returned -1 [0038.865] lstrcmpW (lpString1="MSClientDataMgr", lpString2=".") returned 1 [0038.865] lstrcmpW (lpString1="MSClientDataMgr", lpString2="..") returned 1 [0038.865] lstrcmpW (lpString1="MSClientDataMgr", lpString2="AppData") returned 1 [0038.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", lpSrch="AppData") returned 0x0 [0038.865] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", lpString2="C:\\Windows") returned -1 [0038.865] lstrlenW (lpString="C:\\Windows") returned 10 [0038.865] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", lpString2="C:\\System Volume Information") returned -1 [0038.865] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0038.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0038.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0039.025] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.025] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.026] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.026] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.026] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.026] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.026] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.026] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.026] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.026] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.026] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.026] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.026] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0039.026] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="Windows") returned -1 [0039.026] lstrcmpW (lpString1="MSCDM.DLL", lpString2="32.EXE.exe") returned 1 [0039.026] StrStrW (lpFirst="MSCDM.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.026] lstrcmpW (lpString1="MSCDM.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.026] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.026] GetCurrentThreadId () returned 0x9b0 [0039.026] RtlWakeConditionVariable () returned 0x27e800 [0039.026] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0039.027] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0039.027] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.028] GetCurrentThreadId () returned 0x9b0 [0039.028] RtlWakeConditionVariable () returned 0x27e800 [0039.028] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0039.028] lstrcmpiW (lpString1="MSInfo", lpString2="Windows") returned -1 [0039.028] lstrcmpW (lpString1="MSInfo", lpString2=".") returned 1 [0039.028] lstrcmpW (lpString1="MSInfo", lpString2="..") returned 1 [0039.028] lstrcmpW (lpString1="MSInfo", lpString2="AppData") returned 1 [0039.028] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpSrch="AppData") returned 0x0 [0039.028] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpString2="C:\\Windows") returned -1 [0039.028] lstrlenW (lpString="C:\\Windows") returned 10 [0039.028] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpString2="C:\\System Volume Information") returned -1 [0039.028] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.028] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0039.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0039.028] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.028] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.028] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.028] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.028] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.028] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.029] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.029] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.029] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.029] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.029] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.029] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.029] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0039.029] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0039.029] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0039.029] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0039.029] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0039.029] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpSrch="AppData") returned 0x0 [0039.029] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpString2="C:\\Windows") returned -1 [0039.029] lstrlenW (lpString="C:\\Windows") returned 10 [0039.029] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpString2="C:\\System Volume Information") returned -1 [0039.029] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.029] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0039.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0039.030] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.030] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.030] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.030] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.030] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.030] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.030] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.030] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.030] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.030] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.030] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.030] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.030] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0039.030] lstrcmpiW (lpString1="msinfo32.exe.mui", lpString2="Windows") returned -1 [0039.030] lstrcmpW (lpString1="msinfo32.exe.mui", lpString2="32.EXE.exe") returned 1 [0039.030] StrStrW (lpFirst="msinfo32.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.030] lstrcmpW (lpString1="msinfo32.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.030] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3e98 [0039.030] GetCurrentThreadId () returned 0x9b0 [0039.030] RtlWakeConditionVariable () returned 0x27e800 [0039.031] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0039.031] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0039.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.031] GetCurrentThreadId () returned 0x9b0 [0039.031] RtlWakeConditionVariable () returned 0x27e800 [0039.031] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0039.031] lstrcmpiW (lpString1="msinfo32.exe", lpString2="Windows") returned -1 [0039.031] lstrcmpW (lpString1="msinfo32.exe", lpString2="32.EXE.exe") returned 1 [0039.031] StrStrW (lpFirst="msinfo32.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.031] lstrcmpW (lpString1="msinfo32.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.031] GetCurrentThreadId () returned 0x9b0 [0039.031] RtlWakeConditionVariable () returned 0x27e800 [0039.031] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0039.031] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0039.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3e98 [0039.031] GetCurrentThreadId () returned 0x9b0 [0039.031] RtlWakeConditionVariable () returned 0x27e800 [0039.032] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0039.032] lstrcmpiW (lpString1="OFFICE14", lpString2="Windows") returned -1 [0039.032] lstrcmpW (lpString1="OFFICE14", lpString2=".") returned 1 [0039.032] lstrcmpW (lpString1="OFFICE14", lpString2="..") returned 1 [0039.032] lstrcmpW (lpString1="OFFICE14", lpString2="AppData") returned 1 [0039.032] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", lpSrch="AppData") returned 0x0 [0039.032] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", lpString2="C:\\Windows") returned -1 [0039.032] lstrlenW (lpString="C:\\Windows") returned 10 [0039.032] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", lpString2="C:\\System Volume Information") returned -1 [0039.032] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0039.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d5448 [0039.033] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.033] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.033] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.033] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.033] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.033] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.033] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.033] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.033] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.033] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.033] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.033] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.033] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0039.033] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0039.033] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0039.033] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0039.034] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0039.034] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", lpSrch="AppData") returned 0x0 [0039.034] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", lpString2="C:\\Windows") returned -1 [0039.034] lstrlenW (lpString="C:\\Windows") returned 10 [0039.034] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", lpString2="C:\\System Volume Information") returned -1 [0039.034] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.034] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0039.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0039.035] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.035] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.035] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.035] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.035] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.035] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.035] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.035] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.035] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.035] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.035] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.035] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.035] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0039.035] lstrcmpiW (lpString1="ACEINTL.DLL", lpString2="Windows") returned -1 [0039.035] lstrcmpW (lpString1="ACEINTL.DLL", lpString2="32.EXE.exe") returned 1 [0039.035] StrStrW (lpFirst="ACEINTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.035] lstrcmpW (lpString1="ACEINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.035] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.036] GetCurrentThreadId () returned 0x9b0 [0039.036] RtlWakeConditionVariable () returned 0x27e800 [0039.036] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0039.036] lstrcmpiW (lpString1="ACEODBCI.DLL", lpString2="Windows") returned -1 [0039.036] lstrcmpW (lpString1="ACEODBCI.DLL", lpString2="32.EXE.exe") returned 1 [0039.036] StrStrW (lpFirst="ACEODBCI.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.036] lstrcmpW (lpString1="ACEODBCI.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.036] GetCurrentThreadId () returned 0x9b0 [0039.036] RtlWakeConditionVariable () returned 0x27e800 [0039.036] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0039.036] lstrcmpiW (lpString1="ACERECR.DLL", lpString2="Windows") returned -1 [0039.036] lstrcmpW (lpString1="ACERECR.DLL", lpString2="32.EXE.exe") returned 1 [0039.036] StrStrW (lpFirst="ACERECR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.036] lstrcmpW (lpString1="ACERECR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.036] GetCurrentThreadId () returned 0x9b0 [0039.036] RtlWakeConditionVariable () returned 0x27e800 [0039.036] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0039.036] lstrcmpiW (lpString1="ACEWSTR.DLL", lpString2="Windows") returned -1 [0039.036] lstrcmpW (lpString1="ACEWSTR.DLL", lpString2="32.EXE.exe") returned 1 [0039.036] StrStrW (lpFirst="ACEWSTR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.036] lstrcmpW (lpString1="ACEWSTR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.036] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.036] GetCurrentThreadId () returned 0x9b0 [0039.036] RtlWakeConditionVariable () returned 0x27e800 [0039.036] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0039.036] lstrcmpiW (lpString1="ADO210.CHM", lpString2="Windows") returned -1 [0039.036] lstrcmpW (lpString1="ADO210.CHM", lpString2="32.EXE.exe") returned 1 [0039.037] StrStrW (lpFirst="ADO210.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.037] lstrcmpW (lpString1="ADO210.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.037] GetCurrentThreadId () returned 0x9b0 [0039.037] RtlWakeConditionVariable () returned 0x27e800 [0039.037] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0039.037] lstrcmpiW (lpString1="ALRTINTL.DLL", lpString2="Windows") returned -1 [0039.037] lstrcmpW (lpString1="ALRTINTL.DLL", lpString2="32.EXE.exe") returned 1 [0039.037] StrStrW (lpFirst="ALRTINTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.037] lstrcmpW (lpString1="ALRTINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.037] GetCurrentThreadId () returned 0x9b0 [0039.037] RtlWakeConditionVariable () returned 0x27e800 [0039.037] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0039.037] lstrcmpiW (lpString1="MSOINTL.DLL", lpString2="Windows") returned -1 [0039.037] lstrcmpW (lpString1="MSOINTL.DLL", lpString2="32.EXE.exe") returned 1 [0039.037] StrStrW (lpFirst="MSOINTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.037] lstrcmpW (lpString1="MSOINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.037] GetCurrentThreadId () returned 0x9b0 [0039.037] RtlWakeConditionVariable () returned 0x27e800 [0039.037] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0039.037] lstrcmpiW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="Windows") returned -1 [0039.037] lstrcmpW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="32.EXE.exe") returned 1 [0039.037] StrStrW (lpFirst="MSOINTL.DLL.IDX_DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.037] lstrcmpW (lpString1="MSOINTL.DLL.IDX_DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.037] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3e98 [0039.037] GetCurrentThreadId () returned 0x9b0 [0039.038] RtlWakeConditionVariable () returned 0x27e800 [0039.038] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0039.038] lstrcmpiW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="Windows") returned -1 [0039.038] lstrcmpW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="32.EXE.exe") returned 1 [0039.038] StrStrW (lpFirst="MSOINTL.REST.IDX_DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.038] lstrcmpW (lpString1="MSOINTL.REST.IDX_DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3e98 [0039.038] GetCurrentThreadId () returned 0x9b0 [0039.038] RtlWakeConditionVariable () returned 0x27e800 [0039.038] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0039.038] lstrcmpiW (lpString1="MSSOAPR3.DLL", lpString2="Windows") returned -1 [0039.038] lstrcmpW (lpString1="MSSOAPR3.DLL", lpString2="32.EXE.exe") returned 1 [0039.038] StrStrW (lpFirst="MSSOAPR3.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.038] lstrcmpW (lpString1="MSSOAPR3.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.038] GetCurrentThreadId () returned 0x9b0 [0039.038] RtlWakeConditionVariable () returned 0x27e800 [0039.038] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0039.038] lstrcmpiW (lpString1="OARPMANR.DLL", lpString2="Windows") returned -1 [0039.038] lstrcmpW (lpString1="OARPMANR.DLL", lpString2="32.EXE.exe") returned 1 [0039.038] StrStrW (lpFirst="OARPMANR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.038] lstrcmpW (lpString1="OARPMANR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.038] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.038] GetCurrentThreadId () returned 0x9b0 [0039.038] RtlWakeConditionVariable () returned 0x27e800 [0039.038] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0039.038] lstrcmpiW (lpString1="README.HTM", lpString2="Windows") returned -1 [0039.038] lstrcmpW (lpString1="README.HTM", lpString2="32.EXE.exe") returned 1 [0039.039] StrStrW (lpFirst="README.HTM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.039] lstrcmpW (lpString1="README.HTM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.039] GetCurrentThreadId () returned 0x9b0 [0039.039] RtlWakeConditionVariable () returned 0x27e800 [0039.039] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0039.039] lstrcmpiW (lpString1="xlsrvintl.dll", lpString2="Windows") returned 1 [0039.039] lstrcmpW (lpString1="xlsrvintl.dll", lpString2="32.EXE.exe") returned 1 [0039.039] StrStrW (lpFirst="xlsrvintl.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.039] lstrcmpW (lpString1="xlsrvintl.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.039] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.039] GetCurrentThreadId () returned 0x9b0 [0039.039] RtlWakeConditionVariable () returned 0x27e800 [0039.039] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0039.039] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0039.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.040] GetCurrentThreadId () returned 0x9b0 [0039.040] RtlWakeConditionVariable () returned 0x27e800 [0039.040] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0039.040] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="Windows") returned -1 [0039.040] lstrcmpW (lpString1="ACECORE.DLL", lpString2="32.EXE.exe") returned 1 [0039.040] StrStrW (lpFirst="ACECORE.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.040] lstrcmpW (lpString1="ACECORE.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.040] GetCurrentThreadId () returned 0x9b0 [0039.040] RtlWakeConditionVariable () returned 0x27e800 [0039.040] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0039.040] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="Windows") returned -1 [0039.040] lstrcmpW (lpString1="ACEDAO.DLL", lpString2="32.EXE.exe") returned 1 [0039.040] StrStrW (lpFirst="ACEDAO.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.040] lstrcmpW (lpString1="ACEDAO.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.040] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.040] GetCurrentThreadId () returned 0x9b0 [0039.040] RtlWakeConditionVariable () returned 0x27e800 [0039.040] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0039.040] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="Windows") returned -1 [0039.040] lstrcmpW (lpString1="ACEERR.DLL", lpString2="32.EXE.exe") returned 1 [0039.040] StrStrW (lpFirst="ACEERR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.041] lstrcmpW (lpString1="ACEERR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.041] GetCurrentThreadId () returned 0x9b0 [0039.041] RtlWakeConditionVariable () returned 0x27e800 [0039.041] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0039.041] lstrcmpiW (lpString1="ACEES.DLL", lpString2="Windows") returned -1 [0039.041] lstrcmpW (lpString1="ACEES.DLL", lpString2="32.EXE.exe") returned 1 [0039.041] StrStrW (lpFirst="ACEES.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.041] lstrcmpW (lpString1="ACEES.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.041] GetCurrentThreadId () returned 0x9b0 [0039.041] RtlWakeConditionVariable () returned 0x27e800 [0039.041] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0039.041] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="Windows") returned -1 [0039.041] lstrcmpW (lpString1="ACEEXCH.DLL", lpString2="32.EXE.exe") returned 1 [0039.041] StrStrW (lpFirst="ACEEXCH.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.041] lstrcmpW (lpString1="ACEEXCH.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.041] GetCurrentThreadId () returned 0x9b0 [0039.041] RtlWakeConditionVariable () returned 0x27e800 [0039.041] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0039.041] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="Windows") returned -1 [0039.041] lstrcmpW (lpString1="ACEEXCL.DLL", lpString2="32.EXE.exe") returned 1 [0039.041] StrStrW (lpFirst="ACEEXCL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.041] lstrcmpW (lpString1="ACEEXCL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.041] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.041] GetCurrentThreadId () returned 0x9b0 [0039.041] RtlWakeConditionVariable () returned 0x27e800 [0039.041] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0039.042] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="Windows") returned -1 [0039.042] lstrcmpW (lpString1="ACEODBC.DLL", lpString2="32.EXE.exe") returned 1 [0039.042] StrStrW (lpFirst="ACEODBC.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.042] lstrcmpW (lpString1="ACEODBC.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.042] GetCurrentThreadId () returned 0x9b0 [0039.042] RtlWakeConditionVariable () returned 0x27e800 [0039.042] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0039.042] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="Windows") returned -1 [0039.042] lstrcmpW (lpString1="ACEODDBS.DLL", lpString2="32.EXE.exe") returned 1 [0039.042] StrStrW (lpFirst="ACEODDBS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.042] lstrcmpW (lpString1="ACEODDBS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.042] GetCurrentThreadId () returned 0x9b0 [0039.042] RtlWakeConditionVariable () returned 0x27e800 [0039.042] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0039.042] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="Windows") returned -1 [0039.042] lstrcmpW (lpString1="ACEODEXL.DLL", lpString2="32.EXE.exe") returned 1 [0039.042] StrStrW (lpFirst="ACEODEXL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.042] lstrcmpW (lpString1="ACEODEXL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.042] GetCurrentThreadId () returned 0x9b0 [0039.042] RtlWakeConditionVariable () returned 0x27e800 [0039.042] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0039.042] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="Windows") returned -1 [0039.042] lstrcmpW (lpString1="ACEODTXT.DLL", lpString2="32.EXE.exe") returned 1 [0039.042] StrStrW (lpFirst="ACEODTXT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.042] lstrcmpW (lpString1="ACEODTXT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.042] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.042] GetCurrentThreadId () returned 0x9b0 [0039.043] RtlWakeConditionVariable () returned 0x27e800 [0039.043] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0039.043] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="Windows") returned -1 [0039.043] lstrcmpW (lpString1="ACEOLEDB.DLL", lpString2="32.EXE.exe") returned 1 [0039.043] StrStrW (lpFirst="ACEOLEDB.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.043] lstrcmpW (lpString1="ACEOLEDB.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d178 [0039.043] GetCurrentThreadId () returned 0x9b0 [0039.043] RtlWakeConditionVariable () returned 0x27e800 [0039.043] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0039.043] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="Windows") returned -1 [0039.043] lstrcmpW (lpString1="ACER3X.DLL", lpString2="32.EXE.exe") returned 1 [0039.043] StrStrW (lpFirst="ACER3X.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.043] lstrcmpW (lpString1="ACER3X.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.043] GetCurrentThreadId () returned 0x9b0 [0039.043] RtlWakeConditionVariable () returned 0x27e800 [0039.043] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0039.043] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="Windows") returned -1 [0039.043] lstrcmpW (lpString1="ACERCLR.DLL", lpString2="32.EXE.exe") returned 1 [0039.043] StrStrW (lpFirst="ACERCLR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.043] lstrcmpW (lpString1="ACERCLR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.043] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.043] GetCurrentThreadId () returned 0x9b0 [0039.043] RtlWakeConditionVariable () returned 0x27e800 [0039.043] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0039.043] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="Windows") returned -1 [0039.043] lstrcmpW (lpString1="ACEREP.DLL", lpString2="32.EXE.exe") returned 1 [0039.044] StrStrW (lpFirst="ACEREP.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.044] lstrcmpW (lpString1="ACEREP.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.044] GetCurrentThreadId () returned 0x9b0 [0039.044] RtlWakeConditionVariable () returned 0x27e800 [0039.044] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0039.044] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="Windows") returned -1 [0039.044] lstrcmpW (lpString1="ACETXT.DLL", lpString2="32.EXE.exe") returned 1 [0039.044] StrStrW (lpFirst="ACETXT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.044] lstrcmpW (lpString1="ACETXT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.044] GetCurrentThreadId () returned 0x9b0 [0039.044] RtlWakeConditionVariable () returned 0x27e800 [0039.044] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0039.044] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="Windows") returned -1 [0039.044] lstrcmpW (lpString1="ACEWDAT.DLL", lpString2="32.EXE.exe") returned 1 [0039.044] StrStrW (lpFirst="ACEWDAT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.044] lstrcmpW (lpString1="ACEWDAT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.044] GetCurrentThreadId () returned 0x9b0 [0039.044] RtlWakeConditionVariable () returned 0x27e800 [0039.044] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0039.044] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="Windows") returned -1 [0039.044] lstrcmpW (lpString1="ACEWSS.DLL", lpString2="32.EXE.exe") returned 1 [0039.044] StrStrW (lpFirst="ACEWSS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.044] lstrcmpW (lpString1="ACEWSS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.044] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.044] GetCurrentThreadId () returned 0x9b0 [0039.044] RtlWakeConditionVariable () returned 0x27e800 [0039.045] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0039.045] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="Windows") returned -1 [0039.045] lstrcmpW (lpString1="ACEXBE.DLL", lpString2="32.EXE.exe") returned 1 [0039.045] StrStrW (lpFirst="ACEXBE.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.045] lstrcmpW (lpString1="ACEXBE.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.045] GetCurrentThreadId () returned 0x9b0 [0039.045] RtlWakeConditionVariable () returned 0x27e800 [0039.045] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0039.045] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="Windows") returned -1 [0039.045] lstrcmpW (lpString1="ATLCONV.DLL", lpString2="32.EXE.exe") returned 1 [0039.045] StrStrW (lpFirst="ATLCONV.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.045] lstrcmpW (lpString1="ATLCONV.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.045] GetCurrentThreadId () returned 0x9b0 [0039.045] RtlWakeConditionVariable () returned 0x27e800 [0039.045] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0039.045] lstrcmpiW (lpString1="Csi.dll", lpString2="Windows") returned -1 [0039.045] lstrcmpW (lpString1="Csi.dll", lpString2="32.EXE.exe") returned 1 [0039.045] StrStrW (lpFirst="Csi.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.045] lstrcmpW (lpString1="Csi.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.045] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.045] GetCurrentThreadId () returned 0x9b0 [0039.045] RtlWakeConditionVariable () returned 0x27e800 [0039.045] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0039.045] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="Windows") returned -1 [0039.045] lstrcmpW (lpString1="CsiSoap.dll", lpString2="32.EXE.exe") returned 1 [0039.045] StrStrW (lpFirst="CsiSoap.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.046] lstrcmpW (lpString1="CsiSoap.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.046] GetCurrentThreadId () returned 0x9b0 [0039.046] RtlWakeConditionVariable () returned 0x27e800 [0039.046] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0039.046] lstrcmpiW (lpString1="Cultures", lpString2="Windows") returned -1 [0039.046] lstrcmpW (lpString1="Cultures", lpString2=".") returned 1 [0039.046] lstrcmpW (lpString1="Cultures", lpString2="..") returned 1 [0039.046] lstrcmpW (lpString1="Cultures", lpString2="AppData") returned 1 [0039.046] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", lpSrch="AppData") returned 0x0 [0039.046] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", lpString2="C:\\Windows") returned -1 [0039.046] lstrlenW (lpString="C:\\Windows") returned 10 [0039.046] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", lpString2="C:\\System Volume Information") returned -1 [0039.046] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.046] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0039.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0039.303] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.303] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.303] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.303] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.303] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0039.303] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.303] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.303] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.303] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.303] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.303] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.303] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x98, dwReserved1=0x260000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0039.303] lstrcmpiW (lpString1="OFFICE.ODF", lpString2="Windows") returned -1 [0039.303] lstrcmpW (lpString1="OFFICE.ODF", lpString2="32.EXE.exe") returned 1 [0039.303] StrStrW (lpFirst="OFFICE.ODF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.303] lstrcmpW (lpString1="OFFICE.ODF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.303] GetCurrentThreadId () returned 0x9b0 [0039.303] RtlWakeConditionVariable () returned 0x27e800 [0039.304] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x98, dwReserved1=0x260000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0039.304] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0039.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0039.304] GetCurrentThreadId () returned 0x9b0 [0039.304] RtlWakeConditionVariable () returned 0x27e800 [0039.304] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0039.304] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="Windows") returned -1 [0039.304] lstrcmpW (lpString1="EXPSRV.DLL", lpString2="32.EXE.exe") returned 1 [0039.304] StrStrW (lpFirst="EXPSRV.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.304] lstrcmpW (lpString1="EXPSRV.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.304] GetCurrentThreadId () returned 0x9b0 [0039.304] RtlWakeConditionVariable () returned 0x27e800 [0039.304] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0039.304] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="Windows") returned -1 [0039.304] lstrcmpW (lpString1="EXP_PDF.DLL", lpString2="32.EXE.exe") returned 1 [0039.304] StrStrW (lpFirst="EXP_PDF.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.304] lstrcmpW (lpString1="EXP_PDF.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.304] GetCurrentThreadId () returned 0x9b0 [0039.304] RtlWakeConditionVariable () returned 0x27e800 [0039.304] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0039.304] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="Windows") returned -1 [0039.304] lstrcmpW (lpString1="EXP_XPS.DLL", lpString2="32.EXE.exe") returned 1 [0039.304] StrStrW (lpFirst="EXP_XPS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.304] lstrcmpW (lpString1="EXP_XPS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.305] GetCurrentThreadId () returned 0x9b0 [0039.305] RtlWakeConditionVariable () returned 0x27e800 [0039.305] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0039.305] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="Windows") returned -1 [0039.305] lstrcmpW (lpString1="FLTLDR.EXE", lpString2="32.EXE.exe") returned 1 [0039.305] StrStrW (lpFirst="FLTLDR.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.305] lstrcmpW (lpString1="FLTLDR.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.305] GetCurrentThreadId () returned 0x9b0 [0039.305] RtlWakeConditionVariable () returned 0x27e800 [0039.305] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0039.305] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="Windows") returned -1 [0039.305] lstrcmpW (lpString1="IACOM2.DLL", lpString2="32.EXE.exe") returned 1 [0039.305] StrStrW (lpFirst="IACOM2.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.305] lstrcmpW (lpString1="IACOM2.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.305] GetCurrentThreadId () returned 0x9b0 [0039.305] RtlWakeConditionVariable () returned 0x27e800 [0039.305] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0039.305] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="Windows") returned -1 [0039.305] lstrcmpW (lpString1="LICLUA.EXE", lpString2="32.EXE.exe") returned 1 [0039.305] StrStrW (lpFirst="LICLUA.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.305] lstrcmpW (lpString1="LICLUA.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.305] GetCurrentThreadId () returned 0x9b0 [0039.305] RtlWakeConditionVariable () returned 0x27e800 [0039.305] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0039.305] lstrcmpiW (lpString1="MSO.DLL", lpString2="Windows") returned -1 [0039.306] lstrcmpW (lpString1="MSO.DLL", lpString2="32.EXE.exe") returned 1 [0039.306] StrStrW (lpFirst="MSO.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.306] lstrcmpW (lpString1="MSO.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.306] GetCurrentThreadId () returned 0x9b0 [0039.306] RtlWakeConditionVariable () returned 0x27e800 [0039.306] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0039.306] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="Windows") returned -1 [0039.306] lstrcmpW (lpString1="MSOICONS.EXE", lpString2="32.EXE.exe") returned 1 [0039.306] StrStrW (lpFirst="MSOICONS.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.306] lstrcmpW (lpString1="MSOICONS.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.306] GetCurrentThreadId () returned 0x9b0 [0039.306] RtlWakeConditionVariable () returned 0x27e800 [0039.306] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0039.306] lstrcmpiW (lpString1="MSORES.DLL", lpString2="Windows") returned -1 [0039.306] lstrcmpW (lpString1="MSORES.DLL", lpString2="32.EXE.exe") returned 1 [0039.306] StrStrW (lpFirst="MSORES.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.306] lstrcmpW (lpString1="MSORES.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.306] GetCurrentThreadId () returned 0x9b0 [0039.306] RtlWakeConditionVariable () returned 0x27e800 [0039.306] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0039.306] lstrcmpiW (lpString1="msoshext.dll", lpString2="Windows") returned -1 [0039.306] lstrcmpW (lpString1="msoshext.dll", lpString2="32.EXE.exe") returned 1 [0039.306] StrStrW (lpFirst="msoshext.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.306] lstrcmpW (lpString1="msoshext.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.306] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.306] GetCurrentThreadId () returned 0x9b0 [0039.306] RtlWakeConditionVariable () returned 0x27e800 [0039.307] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0039.307] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="Windows") returned -1 [0039.307] lstrcmpW (lpString1="MSOXEV.DLL", lpString2="32.EXE.exe") returned 1 [0039.307] StrStrW (lpFirst="MSOXEV.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.307] lstrcmpW (lpString1="MSOXEV.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.307] GetCurrentThreadId () returned 0x9b0 [0039.307] RtlWakeConditionVariable () returned 0x27e800 [0039.307] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0039.307] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="Windows") returned -1 [0039.307] lstrcmpW (lpString1="MSOXMLED.EXE", lpString2="32.EXE.exe") returned 1 [0039.307] StrStrW (lpFirst="MSOXMLED.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.307] lstrcmpW (lpString1="MSOXMLED.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.307] GetCurrentThreadId () returned 0x9b0 [0039.307] RtlWakeConditionVariable () returned 0x27e800 [0039.307] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0039.307] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="Windows") returned -1 [0039.307] lstrcmpW (lpString1="MSOXMLMF.DLL", lpString2="32.EXE.exe") returned 1 [0039.307] StrStrW (lpFirst="MSOXMLMF.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.307] lstrcmpW (lpString1="MSOXMLMF.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.307] GetCurrentThreadId () returned 0x9b0 [0039.307] RtlWakeConditionVariable () returned 0x27e800 [0039.307] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0039.307] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="Windows") returned -1 [0039.307] lstrcmpW (lpString1="MSPTLS.DLL", lpString2="32.EXE.exe") returned 1 [0039.307] StrStrW (lpFirst="MSPTLS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.308] lstrcmpW (lpString1="MSPTLS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.308] GetCurrentThreadId () returned 0x9b0 [0039.308] RtlWakeConditionVariable () returned 0x27e800 [0039.308] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0039.308] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="Windows") returned -1 [0039.308] lstrcmpW (lpString1="MSSOAP30.DLL", lpString2="32.EXE.exe") returned 1 [0039.308] StrStrW (lpFirst="MSSOAP30.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.308] lstrcmpW (lpString1="MSSOAP30.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.308] GetCurrentThreadId () returned 0x9b0 [0039.308] RtlWakeConditionVariable () returned 0x27e800 [0039.308] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0039.308] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="Windows") returned -1 [0039.308] lstrcmpW (lpString1="MUAUTH.CAB", lpString2="32.EXE.exe") returned 1 [0039.308] StrStrW (lpFirst="MUAUTH.CAB", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.308] lstrcmpW (lpString1="MUAUTH.CAB", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.308] GetCurrentThreadId () returned 0x9b0 [0039.308] RtlWakeConditionVariable () returned 0x27e800 [0039.308] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0039.308] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="Windows") returned -1 [0039.308] lstrcmpW (lpString1="MUOPTIN.DLL", lpString2="32.EXE.exe") returned 1 [0039.308] StrStrW (lpFirst="MUOPTIN.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.308] lstrcmpW (lpString1="MUOPTIN.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.308] GetCurrentThreadId () returned 0x9b0 [0039.308] RtlWakeConditionVariable () returned 0x27e800 [0039.308] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0039.309] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="Windows") returned -1 [0039.309] lstrcmpW (lpString1="Oarpmany.exe", lpString2="32.EXE.exe") returned 1 [0039.309] StrStrW (lpFirst="Oarpmany.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.309] lstrcmpW (lpString1="Oarpmany.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ed50 [0039.309] GetCurrentThreadId () returned 0x9b0 [0039.309] RtlWakeConditionVariable () returned 0x27e800 [0039.309] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0039.309] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="Windows") returned -1 [0039.309] lstrcmpW (lpString1="ODBCMON.DLL", lpString2="32.EXE.exe") returned 1 [0039.309] StrStrW (lpFirst="ODBCMON.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.309] lstrcmpW (lpString1="ODBCMON.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x295be0 [0039.309] GetCurrentThreadId () returned 0x9b0 [0039.309] RtlWakeConditionVariable () returned 0x27e800 [0039.309] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0039.309] lstrcmpiW (lpString1="Office Setup Controller", lpString2="Windows") returned -1 [0039.309] lstrcmpW (lpString1="Office Setup Controller", lpString2=".") returned 1 [0039.309] lstrcmpW (lpString1="Office Setup Controller", lpString2="..") returned 1 [0039.309] lstrcmpW (lpString1="Office Setup Controller", lpString2="AppData") returned 1 [0039.309] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", lpSrch="AppData") returned 0x0 [0039.309] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", lpString2="C:\\Windows") returned -1 [0039.309] lstrlenW (lpString="C:\\Windows") returned 10 [0039.309] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", lpString2="C:\\System Volume Information") returned -1 [0039.309] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.309] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0039.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0039.405] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.406] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.406] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.406] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.406] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.406] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0039.529] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.529] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.529] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.529] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.529] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.529] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.529] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0039.530] lstrcmpiW (lpString1="Access.en-us", lpString2="Windows") returned -1 [0039.530] lstrcmpW (lpString1="Access.en-us", lpString2=".") returned 1 [0039.530] lstrcmpW (lpString1="Access.en-us", lpString2="..") returned 1 [0039.530] lstrcmpW (lpString1="Access.en-us", lpString2="AppData") returned -1 [0039.530] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpSrch="AppData") returned 0x0 [0039.530] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpString2="C:\\Windows") returned -1 [0039.530] lstrlenW (lpString="C:\\Windows") returned 10 [0039.530] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpString2="C:\\System Volume Information") returned -1 [0039.530] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.530] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2750048 [0039.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d0b0 [0039.714] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.714] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.715] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.715] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.715] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.715] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.732] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.732] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.732] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.732] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.732] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.732] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.732] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0039.732] lstrcmpiW (lpString1="AccessMUI.XML", lpString2="Windows") returned -1 [0039.732] lstrcmpW (lpString1="AccessMUI.XML", lpString2="32.EXE.exe") returned 1 [0039.732] StrStrW (lpFirst="AccessMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.732] lstrcmpW (lpString1="AccessMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.732] GetCurrentThreadId () returned 0x9b0 [0039.732] RtlWakeConditionVariable () returned 0x27e800 [0039.732] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0039.733] lstrcmpiW (lpString1="AccessMUISet.XML", lpString2="Windows") returned -1 [0039.733] lstrcmpW (lpString1="AccessMUISet.XML", lpString2="32.EXE.exe") returned 1 [0039.733] StrStrW (lpFirst="AccessMUISet.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.733] lstrcmpW (lpString1="AccessMUISet.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2b3e10 [0039.733] GetCurrentThreadId () returned 0x9b0 [0039.733] RtlWakeConditionVariable () returned 0x27e800 [0039.733] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0039.733] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0039.733] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0039.733] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.733] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.733] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.733] GetCurrentThreadId () returned 0x9b0 [0039.733] RtlWakeConditionVariable () returned 0x27e800 [0039.733] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0039.733] FindClose (in: hFindFile=0x27d0b0 | out: hFindFile=0x27d0b0) returned 1 [0039.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2b3e10 [0039.734] GetCurrentThreadId () returned 0x9b0 [0039.734] RtlWakeConditionVariable () returned 0x27e800 [0039.734] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0039.734] lstrcmpiW (lpString1="Excel.en-us", lpString2="Windows") returned -1 [0039.734] lstrcmpW (lpString1="Excel.en-us", lpString2=".") returned 1 [0039.734] lstrcmpW (lpString1="Excel.en-us", lpString2="..") returned 1 [0039.734] lstrcmpW (lpString1="Excel.en-us", lpString2="AppData") returned 1 [0039.734] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpSrch="AppData") returned 0x0 [0039.734] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpString2="C:\\Windows") returned -1 [0039.734] lstrlenW (lpString="C:\\Windows") returned 10 [0039.734] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpString2="C:\\System Volume Information") returned -1 [0039.734] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.734] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2750048 [0039.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d0b0 [0039.735] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.735] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.735] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.735] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.735] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.735] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.735] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.735] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.735] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.735] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.735] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.735] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.735] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0039.735] lstrcmpiW (lpString1="ExcelMUI.XML", lpString2="Windows") returned -1 [0039.735] lstrcmpW (lpString1="ExcelMUI.XML", lpString2="32.EXE.exe") returned 1 [0039.735] StrStrW (lpFirst="ExcelMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.735] lstrcmpW (lpString1="ExcelMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.735] GetCurrentThreadId () returned 0x9b0 [0039.735] RtlWakeConditionVariable () returned 0x27e800 [0039.735] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0039.735] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0039.735] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0039.735] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.735] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.735] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.735] GetCurrentThreadId () returned 0x9b0 [0039.735] RtlWakeConditionVariable () returned 0x27e800 [0039.735] FindNextFileW (in: hFindFile=0x27d0b0, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0039.736] FindClose (in: hFindFile=0x27d0b0 | out: hFindFile=0x27d0b0) returned 1 [0039.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2b3e10 [0039.736] GetCurrentThreadId () returned 0x9b0 [0039.736] RtlWakeConditionVariable () returned 0x27e800 [0039.736] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0039.736] lstrcmpiW (lpString1="Groove.en-us", lpString2="Windows") returned -1 [0039.736] lstrcmpW (lpString1="Groove.en-us", lpString2=".") returned 1 [0039.736] lstrcmpW (lpString1="Groove.en-us", lpString2="..") returned 1 [0039.736] lstrcmpW (lpString1="Groove.en-us", lpString2="AppData") returned 1 [0039.736] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpSrch="AppData") returned 0x0 [0039.736] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpString2="C:\\Windows") returned -1 [0039.736] lstrlenW (lpString="C:\\Windows") returned 10 [0039.736] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpString2="C:\\System Volume Information") returned -1 [0039.736] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.736] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2750048 [0039.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0039.827] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.827] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.827] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.827] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.827] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.827] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.827] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.827] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.827] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.827] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.827] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.827] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.827] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0039.827] lstrcmpiW (lpString1="GrooveMUI.XML", lpString2="Windows") returned -1 [0039.827] lstrcmpW (lpString1="GrooveMUI.XML", lpString2="32.EXE.exe") returned 1 [0039.827] StrStrW (lpFirst="GrooveMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.827] lstrcmpW (lpString1="GrooveMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.827] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.827] GetCurrentThreadId () returned 0x9b0 [0039.827] RtlWakeConditionVariable () returned 0x27e800 [0039.827] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0039.828] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0039.828] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0039.828] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.828] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.828] GetCurrentThreadId () returned 0x9b0 [0039.828] RtlWakeConditionVariable () returned 0x27e800 [0039.828] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0039.828] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0039.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d9568 [0039.828] GetCurrentThreadId () returned 0x9b0 [0039.828] RtlWakeConditionVariable () returned 0x27e800 [0039.828] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0039.828] lstrcmpiW (lpString1="InfoPath.en-us", lpString2="Windows") returned -1 [0039.828] lstrcmpW (lpString1="InfoPath.en-us", lpString2=".") returned 1 [0039.828] lstrcmpW (lpString1="InfoPath.en-us", lpString2="..") returned 1 [0039.828] lstrcmpW (lpString1="InfoPath.en-us", lpString2="AppData") returned 1 [0039.828] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpSrch="AppData") returned 0x0 [0039.828] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpString2="C:\\Windows") returned -1 [0039.828] lstrlenW (lpString="C:\\Windows") returned 10 [0039.828] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpString2="C:\\System Volume Information") returned -1 [0039.828] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.828] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0039.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0039.943] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.943] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.943] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.943] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.943] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.944] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.944] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.944] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.944] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.944] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.944] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.944] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.944] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0039.944] lstrcmpiW (lpString1="InfoPathMUI.XML", lpString2="Windows") returned -1 [0039.944] lstrcmpW (lpString1="InfoPathMUI.XML", lpString2="32.EXE.exe") returned 1 [0039.944] StrStrW (lpFirst="InfoPathMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.944] lstrcmpW (lpString1="InfoPathMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d9568 [0039.944] GetCurrentThreadId () returned 0x9b0 [0039.944] RtlWakeConditionVariable () returned 0x27e800 [0039.944] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0039.944] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0039.944] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0039.944] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.944] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2ee260 [0039.944] GetCurrentThreadId () returned 0x9b0 [0039.944] RtlWakeConditionVariable () returned 0x27e800 [0039.944] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0039.944] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0039.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d9568 [0039.944] GetCurrentThreadId () returned 0x9b0 [0039.945] RtlWakeConditionVariable () returned 0x27e800 [0039.945] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x98, dwReserved1=0x260000, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0039.945] lstrcmpiW (lpString1="ODeploy.exe", lpString2="Windows") returned -1 [0039.946] lstrcmpW (lpString1="ODeploy.exe", lpString2="32.EXE.exe") returned 1 [0039.946] StrStrW (lpFirst="ODeploy.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.946] lstrcmpW (lpString1="ODeploy.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dad08 [0039.946] GetCurrentThreadId () returned 0x9b0 [0039.946] RtlWakeConditionVariable () returned 0x27e800 [0039.946] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0039.946] lstrcmpiW (lpString1="Office.en-us", lpString2="Windows") returned -1 [0039.946] lstrcmpW (lpString1="Office.en-us", lpString2=".") returned 1 [0039.946] lstrcmpW (lpString1="Office.en-us", lpString2="..") returned 1 [0039.946] lstrcmpW (lpString1="Office.en-us", lpString2="AppData") returned 1 [0039.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpSrch="AppData") returned 0x0 [0039.946] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpString2="C:\\Windows") returned -1 [0039.946] lstrlenW (lpString="C:\\Windows") returned 10 [0039.946] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpString2="C:\\System Volume Information") returned -1 [0039.946] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0039.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d9618 [0039.965] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0039.965] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.965] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0039.965] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.965] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.965] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0039.965] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0039.965] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.965] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.966] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0039.966] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.966] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.966] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0039.966] lstrcmpiW (lpString1="BRANDING.DLL", lpString2="Windows") returned -1 [0039.966] lstrcmpW (lpString1="BRANDING.DLL", lpString2="32.EXE.exe") returned 1 [0039.966] StrStrW (lpFirst="BRANDING.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.966] lstrcmpW (lpString1="BRANDING.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.966] GetCurrentThreadId () returned 0x9b0 [0039.966] RtlWakeConditionVariable () returned 0x27e800 [0039.966] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0039.966] lstrcmpiW (lpString1="BRANDING.XML", lpString2="Windows") returned -1 [0039.966] lstrcmpW (lpString1="BRANDING.XML", lpString2="32.EXE.exe") returned 1 [0039.966] StrStrW (lpFirst="BRANDING.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.966] lstrcmpW (lpString1="BRANDING.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.966] GetCurrentThreadId () returned 0x9b0 [0039.966] RtlWakeConditionVariable () returned 0x27e800 [0039.966] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0039.966] lstrcmpiW (lpString1="OCT.CHM", lpString2="Windows") returned -1 [0039.966] lstrcmpW (lpString1="OCT.CHM", lpString2="32.EXE.exe") returned 1 [0039.966] StrStrW (lpFirst="OCT.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.966] lstrcmpW (lpString1="OCT.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.966] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.966] GetCurrentThreadId () returned 0x9b0 [0039.966] RtlWakeConditionVariable () returned 0x27e800 [0039.966] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0039.966] lstrcmpiW (lpString1="OfficeMUI.XML", lpString2="Windows") returned -1 [0039.966] lstrcmpW (lpString1="OfficeMUI.XML", lpString2="32.EXE.exe") returned 1 [0039.967] StrStrW (lpFirst="OfficeMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.967] lstrcmpW (lpString1="OfficeMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.967] GetCurrentThreadId () returned 0x9b0 [0039.967] RtlWakeConditionVariable () returned 0x27e800 [0039.967] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0039.967] lstrcmpiW (lpString1="OfficeMUISet.XML", lpString2="Windows") returned -1 [0039.967] lstrcmpW (lpString1="OfficeMUISet.XML", lpString2="32.EXE.exe") returned 1 [0039.967] StrStrW (lpFirst="OfficeMUISet.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.967] lstrcmpW (lpString1="OfficeMUISet.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x299988 [0039.967] GetCurrentThreadId () returned 0x9b0 [0039.967] RtlWakeConditionVariable () returned 0x27e800 [0039.967] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0039.967] lstrcmpiW (lpString1="OSETUPUI.DLL", lpString2="Windows") returned -1 [0039.967] lstrcmpW (lpString1="OSETUPUI.DLL", lpString2="32.EXE.exe") returned 1 [0039.967] StrStrW (lpFirst="OSETUPUI.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.967] lstrcmpW (lpString1="OSETUPUI.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.967] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.967] GetCurrentThreadId () returned 0x9b0 [0039.971] RtlWakeConditionVariable () returned 0x27e800 [0039.971] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0039.971] lstrcmpiW (lpString1="promointl.dll", lpString2="Windows") returned -1 [0039.971] lstrcmpW (lpString1="promointl.dll", lpString2="32.EXE.exe") returned 1 [0039.971] StrStrW (lpFirst="promointl.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.971] lstrcmpW (lpString1="promointl.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.971] GetCurrentThreadId () returned 0x9b0 [0039.971] RtlWakeConditionVariable () returned 0x27e800 [0039.971] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0039.971] lstrcmpiW (lpString1="PSCONFIG.CHM", lpString2="Windows") returned -1 [0039.971] lstrcmpW (lpString1="PSCONFIG.CHM", lpString2="32.EXE.exe") returned 1 [0039.971] StrStrW (lpFirst="PSCONFIG.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.971] lstrcmpW (lpString1="PSCONFIG.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.971] GetCurrentThreadId () returned 0x9b0 [0039.971] RtlWakeConditionVariable () returned 0x27e800 [0039.971] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0039.971] lstrcmpiW (lpString1="PSS10O.CHM", lpString2="Windows") returned -1 [0039.971] lstrcmpW (lpString1="PSS10O.CHM", lpString2="32.EXE.exe") returned 1 [0039.971] StrStrW (lpFirst="PSS10O.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.971] lstrcmpW (lpString1="PSS10O.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.971] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.971] GetCurrentThreadId () returned 0x9b0 [0039.971] RtlWakeConditionVariable () returned 0x27e800 [0039.972] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0039.972] lstrcmpiW (lpString1="PSS10R.CHM", lpString2="Windows") returned -1 [0039.972] lstrcmpW (lpString1="PSS10R.CHM", lpString2="32.EXE.exe") returned 1 [0039.972] StrStrW (lpFirst="PSS10R.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.972] lstrcmpW (lpString1="PSS10R.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.972] GetCurrentThreadId () returned 0x9b0 [0039.972] RtlWakeConditionVariable () returned 0x27e800 [0039.972] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0039.972] lstrcmpiW (lpString1="SETUP.CHM", lpString2="Windows") returned -1 [0039.972] lstrcmpW (lpString1="SETUP.CHM", lpString2="32.EXE.exe") returned 1 [0039.972] StrStrW (lpFirst="SETUP.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.972] lstrcmpW (lpString1="SETUP.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.972] GetCurrentThreadId () returned 0x9b0 [0039.972] RtlWakeConditionVariable () returned 0x27e800 [0039.972] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0039.972] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0039.972] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0039.972] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0039.972] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0039.972] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0039.972] GetCurrentThreadId () returned 0x9b0 [0039.972] RtlWakeConditionVariable () returned 0x27e800 [0039.972] FindNextFileW (in: hFindFile=0x2d9618, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0039.972] FindClose (in: hFindFile=0x2d9618 | out: hFindFile=0x2d9618) returned 1 [0039.973] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x299988 [0039.973] GetCurrentThreadId () returned 0x9b0 [0039.973] RtlWakeConditionVariable () returned 0x27e800 [0039.973] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0039.973] lstrcmpiW (lpString1="Office32.en-us", lpString2="Windows") returned -1 [0039.973] lstrcmpW (lpString1="Office32.en-us", lpString2=".") returned 1 [0039.973] lstrcmpW (lpString1="Office32.en-us", lpString2="..") returned 1 [0039.973] lstrcmpW (lpString1="Office32.en-us", lpString2="AppData") returned 1 [0039.973] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", lpSrch="AppData") returned 0x0 [0039.973] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", lpString2="C:\\Windows") returned -1 [0039.974] lstrlenW (lpString="C:\\Windows") returned 10 [0039.974] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", lpString2="C:\\System Volume Information") returned -1 [0039.974] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0039.974] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0039.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.100] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.113] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.113] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.113] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.113] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.113] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.113] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.113] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.113] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.113] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.113] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.113] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0040.113] lstrcmpiW (lpString1="Office32MUI.XML", lpString2="Windows") returned -1 [0040.113] lstrcmpW (lpString1="Office32MUI.XML", lpString2="32.EXE.exe") returned 1 [0040.113] StrStrW (lpFirst="Office32MUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.113] lstrcmpW (lpString1="Office32MUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.113] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2d9568 [0040.113] GetCurrentThreadId () returned 0x9b0 [0040.113] RtlWakeConditionVariable () returned 0x27e800 [0040.113] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.113] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.113] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.114] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.114] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.114] GetCurrentThreadId () returned 0x9b0 [0040.114] RtlWakeConditionVariable () returned 0x27e800 [0040.114] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.114] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d9568 [0040.114] GetCurrentThreadId () returned 0x9b0 [0040.114] RtlWakeConditionVariable () returned 0x27e800 [0040.114] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0040.114] lstrcmpiW (lpString1="Office32.WW", lpString2="Windows") returned -1 [0040.114] lstrcmpW (lpString1="Office32.WW", lpString2=".") returned 1 [0040.114] lstrcmpW (lpString1="Office32.WW", lpString2="..") returned 1 [0040.114] lstrcmpW (lpString1="Office32.WW", lpString2="AppData") returned 1 [0040.114] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", lpSrch="AppData") returned 0x0 [0040.114] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", lpString2="C:\\Windows") returned -1 [0040.114] lstrlenW (lpString="C:\\Windows") returned 10 [0040.114] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", lpString2="C:\\System Volume Information") returned -1 [0040.114] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.114] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.281] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.281] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.281] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.281] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.281] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.281] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.282] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.282] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.282] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.282] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.282] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.282] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.282] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0040.282] lstrcmpiW (lpString1="Office32WW.XML", lpString2="Windows") returned -1 [0040.282] lstrcmpW (lpString1="Office32WW.XML", lpString2="32.EXE.exe") returned 1 [0040.282] StrStrW (lpFirst="Office32WW.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.282] lstrcmpW (lpString1="Office32WW.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.282] GetCurrentThreadId () returned 0x9b0 [0040.282] RtlWakeConditionVariable () returned 0x27e800 [0040.282] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0040.282] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.282] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d9568 [0040.282] GetCurrentThreadId () returned 0x9b0 [0040.282] RtlWakeConditionVariable () returned 0x27e800 [0040.282] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0040.282] lstrcmpiW (lpString1="OneNote.en-us", lpString2="Windows") returned -1 [0040.282] lstrcmpW (lpString1="OneNote.en-us", lpString2=".") returned 1 [0040.283] lstrcmpW (lpString1="OneNote.en-us", lpString2="..") returned 1 [0040.283] lstrcmpW (lpString1="OneNote.en-us", lpString2="AppData") returned 1 [0040.283] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpSrch="AppData") returned 0x0 [0040.283] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpString2="C:\\Windows") returned -1 [0040.283] lstrlenW (lpString="C:\\Windows") returned 10 [0040.283] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.283] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.283] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0040.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.336] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.336] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.336] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.336] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.336] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.336] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.336] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.336] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.336] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.336] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.336] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.336] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.336] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0040.336] lstrcmpiW (lpString1="OneNoteMUI.XML", lpString2="Windows") returned -1 [0040.337] lstrcmpW (lpString1="OneNoteMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.337] StrStrW (lpFirst="OneNoteMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.337] lstrcmpW (lpString1="OneNoteMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.337] GetCurrentThreadId () returned 0x9b0 [0040.337] RtlWakeConditionVariable () returned 0x27e800 [0040.337] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.337] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.337] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.337] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.337] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.337] GetCurrentThreadId () returned 0x9b0 [0040.337] RtlWakeConditionVariable () returned 0x27e800 [0040.337] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.337] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.337] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d9568 [0040.337] GetCurrentThreadId () returned 0x9b0 [0040.337] RtlWakeConditionVariable () returned 0x27e800 [0040.337] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x98, dwReserved1=0x260000, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0040.337] lstrcmpiW (lpString1="OSETUP.DLL", lpString2="Windows") returned -1 [0040.338] lstrcmpW (lpString1="OSETUP.DLL", lpString2="32.EXE.exe") returned 1 [0040.338] StrStrW (lpFirst="OSETUP.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.338] lstrcmpW (lpString1="OSETUP.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.338] GetCurrentThreadId () returned 0x9b0 [0040.338] RtlWakeConditionVariable () returned 0x27e800 [0040.338] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0040.338] lstrcmpiW (lpString1="OSetupPS.dll", lpString2="Windows") returned -1 [0040.338] lstrcmpW (lpString1="OSetupPS.dll", lpString2="32.EXE.exe") returned 1 [0040.338] StrStrW (lpFirst="OSetupPS.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.338] lstrcmpW (lpString1="OSetupPS.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.338] GetCurrentThreadId () returned 0x9b0 [0040.338] RtlWakeConditionVariable () returned 0x27e800 [0040.338] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0040.338] lstrcmpiW (lpString1="Outlook.en-us", lpString2="Windows") returned -1 [0040.338] lstrcmpW (lpString1="Outlook.en-us", lpString2=".") returned 1 [0040.338] lstrcmpW (lpString1="Outlook.en-us", lpString2="..") returned 1 [0040.338] lstrcmpW (lpString1="Outlook.en-us", lpString2="AppData") returned 1 [0040.338] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpSrch="AppData") returned 0x0 [0040.338] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpString2="C:\\Windows") returned -1 [0040.338] lstrlenW (lpString="C:\\Windows") returned 10 [0040.338] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.338] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.338] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x277a058 [0040.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.349] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.349] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.349] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.349] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.349] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.349] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.349] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.349] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.349] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.349] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.349] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.349] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0xd8, dwReserved1=0x260000, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0040.349] lstrcmpiW (lpString1="OutlookMUI.XML", lpString2="Windows") returned -1 [0040.349] lstrcmpW (lpString1="OutlookMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.350] StrStrW (lpFirst="OutlookMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.350] lstrcmpW (lpString1="OutlookMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.350] GetCurrentThreadId () returned 0x9b0 [0040.350] RtlWakeConditionVariable () returned 0x27e800 [0040.350] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xd8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.350] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.350] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.350] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.350] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.350] GetCurrentThreadId () returned 0x9b0 [0040.350] RtlWakeConditionVariable () returned 0x27e800 [0040.350] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xd8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.350] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2b3970 [0040.350] GetCurrentThreadId () returned 0x9b0 [0040.350] RtlWakeConditionVariable () returned 0x27e800 [0040.350] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x98, dwReserved1=0x260000, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0040.350] lstrcmpiW (lpString1="pidgenx.dll", lpString2="Windows") returned -1 [0040.350] lstrcmpW (lpString1="pidgenx.dll", lpString2="32.EXE.exe") returned 1 [0040.350] StrStrW (lpFirst="pidgenx.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.350] lstrcmpW (lpString1="pidgenx.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.350] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.350] GetCurrentThreadId () returned 0x9b0 [0040.350] RtlWakeConditionVariable () returned 0x27e800 [0040.350] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x98, dwReserved1=0x260000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0040.350] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0040.351] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="32.EXE.exe") returned 1 [0040.351] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.351] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.351] GetCurrentThreadId () returned 0x9b0 [0040.351] RtlWakeConditionVariable () returned 0x27e800 [0040.351] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x98, dwReserved1=0x260000, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0040.351] lstrcmpiW (lpString1="pkeyconfig.companion.dll", lpString2="Windows") returned -1 [0040.351] lstrcmpW (lpString1="pkeyconfig.companion.dll", lpString2="32.EXE.exe") returned 1 [0040.351] StrStrW (lpFirst="pkeyconfig.companion.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.351] lstrcmpW (lpString1="pkeyconfig.companion.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.351] GetCurrentThreadId () returned 0x9b0 [0040.351] RtlWakeConditionVariable () returned 0x27e800 [0040.351] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0040.351] lstrcmpiW (lpString1="PowerPoint.en-us", lpString2="Windows") returned -1 [0040.351] lstrcmpW (lpString1="PowerPoint.en-us", lpString2=".") returned 1 [0040.351] lstrcmpW (lpString1="PowerPoint.en-us", lpString2="..") returned 1 [0040.351] lstrcmpW (lpString1="PowerPoint.en-us", lpString2="AppData") returned 1 [0040.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpSrch="AppData") returned 0x0 [0040.351] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpString2="C:\\Windows") returned -1 [0040.351] lstrlenW (lpString="C:\\Windows") returned 10 [0040.351] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.351] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.449] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.449] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.449] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.449] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.449] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.449] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.449] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.449] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.449] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.449] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.449] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.449] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.449] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0040.449] lstrcmpiW (lpString1="PowerPointMUI.XML", lpString2="Windows") returned -1 [0040.449] lstrcmpW (lpString1="PowerPointMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.449] StrStrW (lpFirst="PowerPointMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.449] lstrcmpW (lpString1="PowerPointMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.449] GetCurrentThreadId () returned 0x9b0 [0040.449] RtlWakeConditionVariable () returned 0x27e800 [0040.450] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.450] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.450] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.450] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.450] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.450] GetCurrentThreadId () returned 0x9b0 [0040.450] RtlWakeConditionVariable () returned 0x27e800 [0040.450] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.450] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x295580 [0040.450] GetCurrentThreadId () returned 0x9b0 [0040.450] RtlWakeConditionVariable () returned 0x27e800 [0040.450] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0040.450] lstrcmpiW (lpString1="PRJPROR", lpString2="Windows") returned -1 [0040.450] lstrcmpW (lpString1="PRJPROR", lpString2=".") returned 1 [0040.450] lstrcmpW (lpString1="PRJPROR", lpString2="..") returned 1 [0040.450] lstrcmpW (lpString1="PRJPROR", lpString2="AppData") returned 1 [0040.450] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpSrch="AppData") returned 0x0 [0040.450] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpString2="C:\\Windows") returned -1 [0040.450] lstrlenW (lpString="C:\\Windows") returned 10 [0040.450] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpString2="C:\\System Volume Information") returned -1 [0040.450] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2b3930 [0040.513] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.513] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.513] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.513] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.513] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.514] FindNextFileW (in: hFindFile=0x2b3930, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.514] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.514] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.514] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.514] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.514] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.514] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.514] FindNextFileW (in: hFindFile=0x2b3930, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0040.514] lstrcmpiW (lpString1="PrjProrWW.XML", lpString2="Windows") returned -1 [0040.514] lstrcmpW (lpString1="PrjProrWW.XML", lpString2="32.EXE.exe") returned 1 [0040.514] StrStrW (lpFirst="PrjProrWW.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.514] lstrcmpW (lpString1="PrjProrWW.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.514] GetCurrentThreadId () returned 0x9b0 [0040.514] RtlWakeConditionVariable () returned 0x27e800 [0040.514] FindNextFileW (in: hFindFile=0x2b3930, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.514] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.514] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.514] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.514] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.514] GetCurrentThreadId () returned 0x9b0 [0040.514] RtlWakeConditionVariable () returned 0x27e800 [0040.514] FindNextFileW (in: hFindFile=0x2b3930, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.514] FindClose (in: hFindFile=0x2b3930 | out: hFindFile=0x2b3930) returned 1 [0040.514] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.515] GetCurrentThreadId () returned 0x9b0 [0040.515] RtlWakeConditionVariable () returned 0x27e800 [0040.515] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0040.515] lstrcmpiW (lpString1="Project.en-us", lpString2="Windows") returned -1 [0040.515] lstrcmpW (lpString1="Project.en-us", lpString2=".") returned 1 [0040.516] lstrcmpW (lpString1="Project.en-us", lpString2="..") returned 1 [0040.516] lstrcmpW (lpString1="Project.en-us", lpString2="AppData") returned 1 [0040.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpSrch="AppData") returned 0x0 [0040.516] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpString2="C:\\Windows") returned -1 [0040.516] lstrlenW (lpString="C:\\Windows") returned 10 [0040.516] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.516] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.594] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.594] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.594] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.594] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.594] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.594] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.594] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.594] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.594] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.594] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.594] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.595] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.595] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0040.595] lstrcmpiW (lpString1="ProjectMUI.XML", lpString2="Windows") returned -1 [0040.595] lstrcmpW (lpString1="ProjectMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.595] StrStrW (lpFirst="ProjectMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.595] lstrcmpW (lpString1="ProjectMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.595] GetCurrentThreadId () returned 0x9b0 [0040.595] RtlWakeConditionVariable () returned 0x27e800 [0040.595] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.595] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.595] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.595] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.595] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.595] GetCurrentThreadId () returned 0x9b0 [0040.595] RtlWakeConditionVariable () returned 0x27e800 [0040.595] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.595] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.595] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x295790 [0040.595] GetCurrentThreadId () returned 0x9b0 [0040.595] RtlWakeConditionVariable () returned 0x27e800 [0040.595] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0040.596] lstrcmpiW (lpString1="Proof.en", lpString2="Windows") returned -1 [0040.596] lstrcmpW (lpString1="Proof.en", lpString2=".") returned 1 [0040.596] lstrcmpW (lpString1="Proof.en", lpString2="..") returned 1 [0040.596] lstrcmpW (lpString1="Proof.en", lpString2="AppData") returned 1 [0040.596] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpSrch="AppData") returned 0x0 [0040.596] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpString2="C:\\Windows") returned -1 [0040.596] lstrlenW (lpString="C:\\Windows") returned 10 [0040.596] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpString2="C:\\System Volume Information") returned -1 [0040.596] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.596] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.665] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.665] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.665] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.665] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.665] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.665] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.665] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.665] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.665] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.665] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.665] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.665] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.665] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0040.665] lstrcmpiW (lpString1="Proof.XML", lpString2="Windows") returned -1 [0040.665] lstrcmpW (lpString1="Proof.XML", lpString2="32.EXE.exe") returned 1 [0040.665] StrStrW (lpFirst="Proof.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.665] lstrcmpW (lpString1="Proof.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.666] GetCurrentThreadId () returned 0x9b0 [0040.666] RtlWakeConditionVariable () returned 0x27e800 [0040.666] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0040.666] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.666] GetCurrentThreadId () returned 0x9b0 [0040.666] RtlWakeConditionVariable () returned 0x27e800 [0040.666] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0040.666] lstrcmpiW (lpString1="Proof.es", lpString2="Windows") returned -1 [0040.666] lstrcmpW (lpString1="Proof.es", lpString2=".") returned 1 [0040.666] lstrcmpW (lpString1="Proof.es", lpString2="..") returned 1 [0040.666] lstrcmpW (lpString1="Proof.es", lpString2="AppData") returned 1 [0040.666] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpSrch="AppData") returned 0x0 [0040.666] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpString2="C:\\Windows") returned -1 [0040.666] lstrlenW (lpString="C:\\Windows") returned 10 [0040.666] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpString2="C:\\System Volume Information") returned -1 [0040.666] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.666] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.673] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.673] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.673] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.673] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.673] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.673] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.673] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.673] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.673] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.673] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.673] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.673] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.673] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0040.673] lstrcmpiW (lpString1="Proof.XML", lpString2="Windows") returned -1 [0040.673] lstrcmpW (lpString1="Proof.XML", lpString2="32.EXE.exe") returned 1 [0040.673] StrStrW (lpFirst="Proof.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.673] lstrcmpW (lpString1="Proof.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0040.673] GetCurrentThreadId () returned 0x9b0 [0040.673] RtlWakeConditionVariable () returned 0x27e800 [0040.673] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0040.673] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.673] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.673] GetCurrentThreadId () returned 0x9b0 [0040.673] RtlWakeConditionVariable () returned 0x27e800 [0040.674] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0040.674] lstrcmpiW (lpString1="Proof.fr", lpString2="Windows") returned -1 [0040.674] lstrcmpW (lpString1="Proof.fr", lpString2=".") returned 1 [0040.674] lstrcmpW (lpString1="Proof.fr", lpString2="..") returned 1 [0040.674] lstrcmpW (lpString1="Proof.fr", lpString2="AppData") returned 1 [0040.674] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpSrch="AppData") returned 0x0 [0040.674] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpString2="C:\\Windows") returned -1 [0040.674] lstrlenW (lpString="C:\\Windows") returned 10 [0040.674] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpString2="C:\\System Volume Information") returned -1 [0040.674] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.674] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.675] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.675] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.675] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.675] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.675] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.675] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.675] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.675] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.675] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.675] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.675] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.675] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.675] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0040.675] lstrcmpiW (lpString1="Proof.XML", lpString2="Windows") returned -1 [0040.675] lstrcmpW (lpString1="Proof.XML", lpString2="32.EXE.exe") returned 1 [0040.675] StrStrW (lpFirst="Proof.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.675] lstrcmpW (lpString1="Proof.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0040.675] GetCurrentThreadId () returned 0x9b0 [0040.675] RtlWakeConditionVariable () returned 0x27e800 [0040.675] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0040.675] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.676] GetCurrentThreadId () returned 0x9b0 [0040.676] RtlWakeConditionVariable () returned 0x27e800 [0040.676] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0040.676] lstrcmpiW (lpString1="Proofing.en-us", lpString2="Windows") returned -1 [0040.676] lstrcmpW (lpString1="Proofing.en-us", lpString2=".") returned 1 [0040.676] lstrcmpW (lpString1="Proofing.en-us", lpString2="..") returned 1 [0040.676] lstrcmpW (lpString1="Proofing.en-us", lpString2="AppData") returned 1 [0040.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpSrch="AppData") returned 0x0 [0040.676] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpString2="C:\\Windows") returned -1 [0040.676] lstrlenW (lpString="C:\\Windows") returned 10 [0040.676] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.676] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.676] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.676] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.676] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.676] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.676] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.676] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.677] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.677] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.677] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.677] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0040.677] lstrcmpiW (lpString1="Proofing.XML", lpString2="Windows") returned -1 [0040.677] lstrcmpW (lpString1="Proofing.XML", lpString2="32.EXE.exe") returned 1 [0040.677] StrStrW (lpFirst="Proofing.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.677] lstrcmpW (lpString1="Proofing.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.677] GetCurrentThreadId () returned 0x9b0 [0040.677] RtlWakeConditionVariable () returned 0x27e800 [0040.677] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.677] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.677] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.677] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.677] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.677] GetCurrentThreadId () returned 0x9b0 [0040.677] RtlWakeConditionVariable () returned 0x27e800 [0040.677] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.677] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2f5458 [0040.677] GetCurrentThreadId () returned 0x9b0 [0040.677] RtlWakeConditionVariable () returned 0x27e800 [0040.677] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0040.677] lstrcmpiW (lpString1="PROPLUSR", lpString2="Windows") returned -1 [0040.677] lstrcmpW (lpString1="PROPLUSR", lpString2=".") returned 1 [0040.677] lstrcmpW (lpString1="PROPLUSR", lpString2="..") returned 1 [0040.678] lstrcmpW (lpString1="PROPLUSR", lpString2="AppData") returned 1 [0040.678] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpSrch="AppData") returned 0x0 [0040.678] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpString2="C:\\Windows") returned -1 [0040.678] lstrlenW (lpString="C:\\Windows") returned 10 [0040.678] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpString2="C:\\System Volume Information") returned -1 [0040.678] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.731] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.731] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.731] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.731] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.731] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.731] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.731] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.731] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.731] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.731] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.731] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.731] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.731] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0040.731] lstrcmpiW (lpString1="ProPlusrWW.XML", lpString2="Windows") returned -1 [0040.731] lstrcmpW (lpString1="ProPlusrWW.XML", lpString2="32.EXE.exe") returned 1 [0040.731] StrStrW (lpFirst="ProPlusrWW.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.731] lstrcmpW (lpString1="ProPlusrWW.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.731] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.731] GetCurrentThreadId () returned 0x9b0 [0040.731] RtlWakeConditionVariable () returned 0x27e800 [0040.731] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.731] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.731] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.732] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.732] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0040.732] GetCurrentThreadId () returned 0x9b0 [0040.732] RtlWakeConditionVariable () returned 0x27e800 [0040.732] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.732] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.732] GetCurrentThreadId () returned 0x9b0 [0040.732] RtlWakeConditionVariable () returned 0x27e800 [0040.732] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0040.732] lstrcmpiW (lpString1="Publisher.en-us", lpString2="Windows") returned -1 [0040.732] lstrcmpW (lpString1="Publisher.en-us", lpString2=".") returned 1 [0040.732] lstrcmpW (lpString1="Publisher.en-us", lpString2="..") returned 1 [0040.732] lstrcmpW (lpString1="Publisher.en-us", lpString2="AppData") returned 1 [0040.732] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpSrch="AppData") returned 0x0 [0040.732] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpString2="C:\\Windows") returned -1 [0040.732] lstrlenW (lpString="C:\\Windows") returned 10 [0040.732] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.732] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.732] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0040.736] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.736] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.736] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.737] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.737] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.737] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.737] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.737] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.737] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.737] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.737] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.737] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.737] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0040.737] lstrcmpiW (lpString1="PublisherMUI.XML", lpString2="Windows") returned -1 [0040.737] lstrcmpW (lpString1="PublisherMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.737] StrStrW (lpFirst="PublisherMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.737] lstrcmpW (lpString1="PublisherMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.737] GetCurrentThreadId () returned 0x9b0 [0040.737] RtlWakeConditionVariable () returned 0x27e800 [0040.737] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.737] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.737] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.737] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.737] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.737] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.737] GetCurrentThreadId () returned 0x9b0 [0040.737] RtlWakeConditionVariable () returned 0x27e800 [0040.737] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xe8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0040.738] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0040.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2f5858 [0040.738] GetCurrentThreadId () returned 0x9b0 [0040.738] RtlWakeConditionVariable () returned 0x27e800 [0040.738] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0040.738] lstrcmpiW (lpString1="Setup.exe", lpString2="Windows") returned -1 [0040.738] lstrcmpW (lpString1="Setup.exe", lpString2="32.EXE.exe") returned 1 [0040.738] StrStrW (lpFirst="Setup.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.738] lstrcmpW (lpString1="Setup.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.738] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.738] GetCurrentThreadId () returned 0x9b0 [0040.738] RtlWakeConditionVariable () returned 0x27e800 [0040.738] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0040.738] lstrcmpiW (lpString1="Visio.en-us", lpString2="Windows") returned -1 [0040.738] lstrcmpW (lpString1="Visio.en-us", lpString2=".") returned 1 [0040.738] lstrcmpW (lpString1="Visio.en-us", lpString2="..") returned 1 [0040.738] lstrcmpW (lpString1="Visio.en-us", lpString2="AppData") returned 1 [0040.738] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpSrch="AppData") returned 0x0 [0040.738] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpString2="C:\\Windows") returned -1 [0040.738] lstrlenW (lpString="C:\\Windows") returned 10 [0040.739] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.739] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.739] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0040.789] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.789] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.789] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.789] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.789] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.789] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.789] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.789] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.789] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.789] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.789] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.789] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.789] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.789] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.789] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.789] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.789] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.789] GetCurrentThreadId () returned 0x9b0 [0040.789] RtlWakeConditionVariable () returned 0x27e800 [0040.790] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0040.790] lstrcmpiW (lpString1="VisioMUI.XML", lpString2="Windows") returned -1 [0040.790] lstrcmpW (lpString1="VisioMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.790] StrStrW (lpFirst="VisioMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.790] lstrcmpW (lpString1="VisioMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.790] GetCurrentThreadId () returned 0x9b0 [0040.790] RtlWakeConditionVariable () returned 0x27e800 [0040.790] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0040.790] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0040.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2f5858 [0040.790] GetCurrentThreadId () returned 0x9b0 [0040.790] RtlWakeConditionVariable () returned 0x27e800 [0040.791] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0040.791] lstrcmpiW (lpString1="VISIOR", lpString2="Windows") returned -1 [0040.791] lstrcmpW (lpString1="VISIOR", lpString2=".") returned 1 [0040.791] lstrcmpW (lpString1="VISIOR", lpString2="..") returned 1 [0040.791] lstrcmpW (lpString1="VISIOR", lpString2="AppData") returned 1 [0040.791] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpSrch="AppData") returned 0x0 [0040.791] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpString2="C:\\Windows") returned -1 [0040.791] lstrlenW (lpString="C:\\Windows") returned 10 [0040.791] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpString2="C:\\System Volume Information") returned -1 [0040.791] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0040.792] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.792] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.792] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.792] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.792] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.792] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.792] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.792] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.792] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.792] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.792] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.792] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.792] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.792] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.792] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.792] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.792] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.792] GetCurrentThreadId () returned 0x9b0 [0040.792] RtlWakeConditionVariable () returned 0x27e800 [0040.792] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0040.792] lstrcmpiW (lpString1="VisiorWW.XML", lpString2="Windows") returned -1 [0040.793] lstrcmpW (lpString1="VisiorWW.XML", lpString2="32.EXE.exe") returned 1 [0040.793] StrStrW (lpFirst="VisiorWW.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.793] lstrcmpW (lpString1="VisiorWW.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.793] GetCurrentThreadId () returned 0x9b0 [0040.793] RtlWakeConditionVariable () returned 0x27e800 [0040.793] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0040.793] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0040.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xf0) returned 0x2edbe0 [0040.793] GetCurrentThreadId () returned 0x9b0 [0040.793] RtlWakeConditionVariable () returned 0x27e800 [0040.793] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0040.793] lstrcmpiW (lpString1="Word.en-us", lpString2="Windows") returned 1 [0040.793] lstrcmpW (lpString1="Word.en-us", lpString2=".") returned 1 [0040.793] lstrcmpW (lpString1="Word.en-us", lpString2="..") returned 1 [0040.793] lstrcmpW (lpString1="Word.en-us", lpString2="AppData") returned 1 [0040.793] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpSrch="AppData") returned 0x0 [0040.793] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpString2="C:\\Windows") returned -1 [0040.793] lstrlenW (lpString="C:\\Windows") returned 10 [0040.793] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpString2="C:\\System Volume Information") returned -1 [0040.793] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0040.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0040.892] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.892] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.892] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.892] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.892] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.892] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.893] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.893] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.893] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.893] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.893] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.893] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.893] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0040.893] lstrcmpiW (lpString1="SETUP.XML", lpString2="Windows") returned -1 [0040.893] lstrcmpW (lpString1="SETUP.XML", lpString2="32.EXE.exe") returned 1 [0040.893] StrStrW (lpFirst="SETUP.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.893] lstrcmpW (lpString1="SETUP.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.893] GetCurrentThreadId () returned 0x9b0 [0040.893] RtlWakeConditionVariable () returned 0x27e800 [0040.893] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0040.893] lstrcmpiW (lpString1="WordMUI.XML", lpString2="Windows") returned 1 [0040.893] lstrcmpW (lpString1="WordMUI.XML", lpString2="32.EXE.exe") returned 1 [0040.893] StrStrW (lpFirst="WordMUI.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.893] lstrcmpW (lpString1="WordMUI.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.893] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.893] GetCurrentThreadId () returned 0x9b0 [0040.893] RtlWakeConditionVariable () returned 0x27e800 [0040.893] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xc8, dwReserved1=0x260000, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0040.893] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0040.894] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d5488 [0040.894] GetCurrentThreadId () returned 0x9b0 [0040.894] RtlWakeConditionVariable () returned 0x27e800 [0040.894] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0040.894] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0040.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.895] GetCurrentThreadId () returned 0x9b0 [0040.895] RtlWakeConditionVariable () returned 0x27e800 [0040.895] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0040.895] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="Windows") returned -1 [0040.895] lstrcmpW (lpString1="OFFREL.DLL", lpString2="32.EXE.exe") returned 1 [0040.895] StrStrW (lpFirst="OFFREL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.895] lstrcmpW (lpString1="OFFREL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.895] GetCurrentThreadId () returned 0x9b0 [0040.895] RtlWakeConditionVariable () returned 0x27e800 [0040.895] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0040.895] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="Windows") returned -1 [0040.895] lstrcmpW (lpString1="OPHPROXY.DLL", lpString2="32.EXE.exe") returned 1 [0040.895] StrStrW (lpFirst="OPHPROXY.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.895] lstrcmpW (lpString1="OPHPROXY.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.895] GetCurrentThreadId () returned 0x9b0 [0040.895] RtlWakeConditionVariable () returned 0x27e800 [0040.895] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0040.895] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="Windows") returned -1 [0040.895] lstrcmpW (lpString1="OPTINPS.DLL", lpString2="32.EXE.exe") returned 1 [0040.895] StrStrW (lpFirst="OPTINPS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.895] lstrcmpW (lpString1="OPTINPS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.895] GetCurrentThreadId () returned 0x9b0 [0040.895] RtlWakeConditionVariable () returned 0x27e800 [0040.895] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0040.895] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="Windows") returned -1 [0040.895] lstrcmpW (lpString1="PJ11OD11.DLL", lpString2="32.EXE.exe") returned 1 [0040.895] StrStrW (lpFirst="PJ11OD11.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.896] lstrcmpW (lpString1="PJ11OD11.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.896] GetCurrentThreadId () returned 0x9b0 [0040.896] RtlWakeConditionVariable () returned 0x27e800 [0040.896] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0040.896] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="Windows") returned -1 [0040.896] lstrcmpW (lpString1="PJRESC.DLL", lpString2="32.EXE.exe") returned 1 [0040.896] StrStrW (lpFirst="PJRESC.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.896] lstrcmpW (lpString1="PJRESC.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.896] GetCurrentThreadId () returned 0x9b0 [0040.896] RtlWakeConditionVariable () returned 0x27e800 [0040.896] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0040.896] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="Windows") returned -1 [0040.896] lstrcmpW (lpString1="PRJRES.DLL", lpString2="32.EXE.exe") returned 1 [0040.896] StrStrW (lpFirst="PRJRES.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.896] lstrcmpW (lpString1="PRJRES.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.896] GetCurrentThreadId () returned 0x9b0 [0040.896] RtlWakeConditionVariable () returned 0x27e800 [0040.896] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0040.896] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="Windows") returned -1 [0040.896] lstrcmpW (lpString1="RICHED20.DLL", lpString2="32.EXE.exe") returned 1 [0040.896] StrStrW (lpFirst="RICHED20.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.896] lstrcmpW (lpString1="RICHED20.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.896] GetCurrentThreadId () returned 0x9b0 [0040.896] RtlWakeConditionVariable () returned 0x27e800 [0040.896] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0040.896] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="Windows") returned -1 [0040.896] lstrcmpW (lpString1="SERCONV.DLL", lpString2="32.EXE.exe") returned 1 [0040.897] StrStrW (lpFirst="SERCONV.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.897] lstrcmpW (lpString1="SERCONV.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.897] GetCurrentThreadId () returned 0x9b0 [0040.897] RtlWakeConditionVariable () returned 0x27e800 [0040.897] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0040.897] lstrcmpiW (lpString1="USP10.DLL", lpString2="Windows") returned -1 [0040.897] lstrcmpW (lpString1="USP10.DLL", lpString2="32.EXE.exe") returned 1 [0040.897] StrStrW (lpFirst="USP10.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.897] lstrcmpW (lpString1="USP10.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.897] GetCurrentThreadId () returned 0x9b0 [0040.897] RtlWakeConditionVariable () returned 0x27e800 [0040.897] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0040.897] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="Windows") returned -1 [0040.897] lstrcmpW (lpString1="VBAJET32.DLL", lpString2="32.EXE.exe") returned 1 [0040.897] StrStrW (lpFirst="VBAJET32.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.897] lstrcmpW (lpString1="VBAJET32.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f62b8 [0040.897] GetCurrentThreadId () returned 0x9b0 [0040.897] RtlWakeConditionVariable () returned 0x27e800 [0040.897] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0040.897] lstrcmpiW (lpString1="WISC30.DLL", lpString2="Windows") returned 1 [0040.897] lstrcmpW (lpString1="WISC30.DLL", lpString2="32.EXE.exe") returned 1 [0040.897] StrStrW (lpFirst="WISC30.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.897] lstrcmpW (lpString1="WISC30.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.897] GetCurrentThreadId () returned 0x9b0 [0040.897] RtlWakeConditionVariable () returned 0x27e800 [0040.897] FindNextFileW (in: hFindFile=0x2d5448, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0040.898] FindClose (in: hFindFile=0x2d5448 | out: hFindFile=0x2d5448) returned 1 [0040.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f21d8 [0040.898] GetCurrentThreadId () returned 0x9b0 [0040.898] RtlWakeConditionVariable () returned 0x27e800 [0040.898] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0040.898] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Windows") returned -1 [0040.898] lstrcmpW (lpString1="OfficeSoftwareProtectionPlatform", lpString2=".") returned 1 [0040.898] lstrcmpW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="..") returned 1 [0040.898] lstrcmpW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="AppData") returned 1 [0040.898] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", lpSrch="AppData") returned 0x0 [0040.898] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", lpString2="C:\\Windows") returned -1 [0040.898] lstrlenW (lpString="C:\\Windows") returned 10 [0040.898] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", lpString2="C:\\System Volume Information") returned -1 [0040.898] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0040.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0040.899] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.900] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.900] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.900] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.900] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.900] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.900] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.900] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.900] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.900] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.900] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.900] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.900] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0040.900] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="Windows") returned -1 [0040.900] lstrcmpW (lpString1="OSPPC.DLL", lpString2="32.EXE.exe") returned 1 [0040.900] StrStrW (lpFirst="OSPPC.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.900] lstrcmpW (lpString1="OSPPC.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.900] GetCurrentThreadId () returned 0x9b0 [0040.900] RtlWakeConditionVariable () returned 0x27e800 [0040.900] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0040.900] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="Windows") returned -1 [0040.900] lstrcmpW (lpString1="OSPPCEXT.DLL", lpString2="32.EXE.exe") returned 1 [0040.900] StrStrW (lpFirst="OSPPCEXT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.900] lstrcmpW (lpString1="OSPPCEXT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.900] GetCurrentThreadId () returned 0x9b0 [0040.900] RtlWakeConditionVariable () returned 0x27e800 [0040.900] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0040.900] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="Windows") returned -1 [0040.900] lstrcmpW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="32.EXE.exe") returned 1 [0040.900] StrStrW (lpFirst="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.901] lstrcmpW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x100) returned 0x2d5448 [0040.901] GetCurrentThreadId () returned 0x9b0 [0040.901] RtlWakeConditionVariable () returned 0x27e800 [0040.901] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0040.901] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="Windows") returned -1 [0040.901] lstrcmpW (lpString1="OSPPOBJS.DLL", lpString2="32.EXE.exe") returned 1 [0040.901] StrStrW (lpFirst="OSPPOBJS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.901] lstrcmpW (lpString1="OSPPOBJS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.901] GetCurrentThreadId () returned 0x9b0 [0040.901] RtlWakeConditionVariable () returned 0x27e800 [0040.901] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0040.901] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="Windows") returned -1 [0040.901] lstrcmpW (lpString1="OSPPREARM.EXE", lpString2="32.EXE.exe") returned 1 [0040.901] StrStrW (lpFirst="OSPPREARM.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.901] lstrcmpW (lpString1="OSPPREARM.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0040.901] GetCurrentThreadId () returned 0x9b0 [0040.901] RtlWakeConditionVariable () returned 0x27e800 [0040.901] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0040.901] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="Windows") returned -1 [0040.901] lstrcmpW (lpString1="OSPPSVC.EXE", lpString2="32.EXE.exe") returned 1 [0040.901] StrStrW (lpFirst="OSPPSVC.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.901] lstrcmpW (lpString1="OSPPSVC.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.901] GetCurrentThreadId () returned 0x9b0 [0040.901] RtlWakeConditionVariable () returned 0x27e800 [0040.901] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0040.901] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="Windows") returned -1 [0040.902] lstrcmpW (lpString1="OSPPWMI.DLL", lpString2="32.EXE.exe") returned 1 [0040.902] StrStrW (lpFirst="OSPPWMI.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.902] lstrcmpW (lpString1="OSPPWMI.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.902] GetCurrentThreadId () returned 0x9b0 [0040.902] RtlWakeConditionVariable () returned 0x27e800 [0040.902] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0040.902] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="Windows") returned -1 [0040.902] lstrcmpW (lpString1="OSPPWMI.MOF", lpString2="32.EXE.exe") returned 1 [0040.902] StrStrW (lpFirst="OSPPWMI.MOF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.902] lstrcmpW (lpString1="OSPPWMI.MOF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.902] GetCurrentThreadId () returned 0x9b0 [0040.902] RtlWakeConditionVariable () returned 0x27e800 [0040.902] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0040.902] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0040.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x2edcf0 [0040.903] GetCurrentThreadId () returned 0x9b0 [0040.903] RtlWakeConditionVariable () returned 0x27e800 [0040.903] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0040.903] lstrcmpiW (lpString1="PROOF", lpString2="Windows") returned -1 [0040.903] lstrcmpW (lpString1="PROOF", lpString2=".") returned 1 [0040.903] lstrcmpW (lpString1="PROOF", lpString2="..") returned 1 [0040.903] lstrcmpW (lpString1="PROOF", lpString2="AppData") returned 1 [0040.903] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", lpSrch="AppData") returned 0x0 [0040.903] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", lpString2="C:\\Windows") returned -1 [0040.903] lstrlenW (lpString="C:\\Windows") returned 10 [0040.903] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", lpString2="C:\\System Volume Information") returned -1 [0040.903] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0040.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0040.909] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.909] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.909] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.909] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.909] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.909] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.909] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.909] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.909] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.909] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.909] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.909] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.909] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0040.909] lstrcmpiW (lpString1="MSLID.DLL", lpString2="Windows") returned -1 [0040.909] lstrcmpW (lpString1="MSLID.DLL", lpString2="32.EXE.exe") returned 1 [0040.909] StrStrW (lpFirst="MSLID.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.909] lstrcmpW (lpString1="MSLID.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.909] GetCurrentThreadId () returned 0x9b0 [0040.909] RtlWakeConditionVariable () returned 0x27e800 [0040.909] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0040.909] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="Windows") returned -1 [0040.909] lstrcmpW (lpString1="MSWDS_EN.LEX", lpString2="32.EXE.exe") returned 1 [0040.909] StrStrW (lpFirst="MSWDS_EN.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.909] lstrcmpW (lpString1="MSWDS_EN.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.909] GetCurrentThreadId () returned 0x9b0 [0040.909] RtlWakeConditionVariable () returned 0x27e800 [0040.909] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0040.909] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="Windows") returned -1 [0040.910] lstrcmpW (lpString1="MSWDS_ES.LEX", lpString2="32.EXE.exe") returned 1 [0040.910] StrStrW (lpFirst="MSWDS_ES.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.910] lstrcmpW (lpString1="MSWDS_ES.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.910] GetCurrentThreadId () returned 0x9b0 [0040.910] RtlWakeConditionVariable () returned 0x27e800 [0040.910] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0040.910] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="Windows") returned -1 [0040.910] lstrcmpW (lpString1="MSWDS_FR.LEX", lpString2="32.EXE.exe") returned 1 [0040.910] StrStrW (lpFirst="MSWDS_FR.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.910] lstrcmpW (lpString1="MSWDS_FR.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.910] GetCurrentThreadId () returned 0x9b0 [0040.910] RtlWakeConditionVariable () returned 0x27e800 [0040.910] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0040.910] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0040.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f24b8 [0040.910] GetCurrentThreadId () returned 0x9b0 [0040.910] RtlWakeConditionVariable () returned 0x27e800 [0040.910] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0040.910] lstrcmpiW (lpString1="Smart Tag", lpString2="Windows") returned -1 [0040.910] lstrcmpW (lpString1="Smart Tag", lpString2=".") returned 1 [0040.910] lstrcmpW (lpString1="Smart Tag", lpString2="..") returned 1 [0040.910] lstrcmpW (lpString1="Smart Tag", lpString2="AppData") returned 1 [0040.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", lpSrch="AppData") returned 0x0 [0040.910] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", lpString2="C:\\Windows") returned -1 [0040.910] lstrlenW (lpString="C:\\Windows") returned 10 [0040.910] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", lpString2="C:\\System Volume Information") returned -1 [0040.910] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0040.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0040.941] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.941] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.941] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.941] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.941] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.941] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.941] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.941] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.941] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.941] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.942] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.942] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0040.942] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0040.942] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0040.942] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0040.942] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0040.942] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", lpSrch="AppData") returned 0x0 [0040.942] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", lpString2="C:\\Windows") returned -1 [0040.942] lstrlenW (lpString="C:\\Windows") returned 10 [0040.942] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", lpString2="C:\\System Volume Information") returned -1 [0040.942] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.942] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0040.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0040.986] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.986] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.986] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.986] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.986] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.986] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.986] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.986] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.986] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.987] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.987] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.987] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.987] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0040.987] lstrcmpiW (lpString1="MCABOUT.HTM", lpString2="Windows") returned -1 [0040.987] lstrcmpW (lpString1="MCABOUT.HTM", lpString2="32.EXE.exe") returned 1 [0040.987] StrStrW (lpFirst="MCABOUT.HTM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.987] lstrcmpW (lpString1="MCABOUT.HTM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.987] GetCurrentThreadId () returned 0x9b0 [0040.987] RtlWakeConditionVariable () returned 0x27e800 [0040.987] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0040.987] lstrcmpiW (lpString1="STINTL.DLL", lpString2="Windows") returned -1 [0040.987] lstrcmpW (lpString1="STINTL.DLL", lpString2="32.EXE.exe") returned 1 [0040.987] StrStrW (lpFirst="STINTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.987] lstrcmpW (lpString1="STINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.987] GetCurrentThreadId () returned 0x9b0 [0040.987] RtlWakeConditionVariable () returned 0x27e800 [0040.987] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0040.987] lstrcmpiW (lpString1="STINTL.DLL.IDX_DLL", lpString2="Windows") returned -1 [0040.987] lstrcmpW (lpString1="STINTL.DLL.IDX_DLL", lpString2="32.EXE.exe") returned 1 [0040.987] StrStrW (lpFirst="STINTL.DLL.IDX_DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.987] lstrcmpW (lpString1="STINTL.DLL.IDX_DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.987] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29bca0 [0040.987] GetCurrentThreadId () returned 0x9b0 [0040.987] RtlWakeConditionVariable () returned 0x27e800 [0040.987] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0040.987] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0040.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d98b8 [0040.988] GetCurrentThreadId () returned 0x9b0 [0040.988] RtlWakeConditionVariable () returned 0x27e800 [0040.988] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0040.988] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="Windows") returned -1 [0040.988] lstrcmpW (lpString1="FBIBLIO.DLL", lpString2="32.EXE.exe") returned 1 [0040.988] StrStrW (lpFirst="FBIBLIO.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.988] lstrcmpW (lpString1="FBIBLIO.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.988] GetCurrentThreadId () returned 0x9b0 [0040.988] RtlWakeConditionVariable () returned 0x27e800 [0040.988] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0040.988] lstrcmpiW (lpString1="FDATE.DLL", lpString2="Windows") returned -1 [0040.988] lstrcmpW (lpString1="FDATE.DLL", lpString2="32.EXE.exe") returned 1 [0040.988] StrStrW (lpFirst="FDATE.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.988] lstrcmpW (lpString1="FDATE.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.988] GetCurrentThreadId () returned 0x9b0 [0040.988] RtlWakeConditionVariable () returned 0x27e800 [0040.988] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0040.988] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="Windows") returned -1 [0040.988] lstrcmpW (lpString1="FPERSON.DLL", lpString2="32.EXE.exe") returned 1 [0040.988] StrStrW (lpFirst="FPERSON.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.988] lstrcmpW (lpString1="FPERSON.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.988] GetCurrentThreadId () returned 0x9b0 [0040.989] RtlWakeConditionVariable () returned 0x27e800 [0040.989] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0040.989] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="Windows") returned -1 [0040.989] lstrcmpW (lpString1="FPLACE.DLL", lpString2="32.EXE.exe") returned 1 [0040.989] StrStrW (lpFirst="FPLACE.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.989] lstrcmpW (lpString1="FPLACE.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.989] GetCurrentThreadId () returned 0x9b0 [0040.989] RtlWakeConditionVariable () returned 0x27e800 [0040.989] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0040.989] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="Windows") returned -1 [0040.989] lstrcmpW (lpString1="FSTOCK.DLL", lpString2="32.EXE.exe") returned 1 [0040.989] StrStrW (lpFirst="FSTOCK.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.989] lstrcmpW (lpString1="FSTOCK.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.989] GetCurrentThreadId () returned 0x9b0 [0040.989] RtlWakeConditionVariable () returned 0x27e800 [0040.989] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0040.989] lstrcmpiW (lpString1="IETAG.DLL", lpString2="Windows") returned -1 [0040.989] lstrcmpW (lpString1="IETAG.DLL", lpString2="32.EXE.exe") returned 1 [0040.989] StrStrW (lpFirst="IETAG.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.989] lstrcmpW (lpString1="IETAG.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0040.989] GetCurrentThreadId () returned 0x9b0 [0040.989] RtlWakeConditionVariable () returned 0x27e800 [0040.989] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0040.989] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="Windows") returned -1 [0040.989] lstrcmpW (lpString1="IMCONTACT.DLL", lpString2="32.EXE.exe") returned 1 [0040.989] StrStrW (lpFirst="IMCONTACT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.989] lstrcmpW (lpString1="IMCONTACT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.989] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0040.990] GetCurrentThreadId () returned 0x9b0 [0040.990] RtlWakeConditionVariable () returned 0x27e800 [0040.990] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0040.990] lstrcmpiW (lpString1="LISTS", lpString2="Windows") returned -1 [0040.990] lstrcmpW (lpString1="LISTS", lpString2=".") returned 1 [0040.990] lstrcmpW (lpString1="LISTS", lpString2="..") returned 1 [0040.990] lstrcmpW (lpString1="LISTS", lpString2="AppData") returned 1 [0040.990] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", lpSrch="AppData") returned 0x0 [0040.990] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", lpString2="C:\\Windows") returned -1 [0040.990] lstrlenW (lpString="C:\\Windows") returned 10 [0040.990] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", lpString2="C:\\System Volume Information") returned -1 [0040.990] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0040.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0040.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0040.999] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0040.999] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.999] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0040.999] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.999] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.999] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0040.999] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0040.999] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.999] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.999] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0040.999] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0040.999] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0040.999] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="1033", cAlternateFileName="")) returned 1 [0040.999] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0040.999] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0040.999] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0040.999] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0041.000] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", lpSrch="AppData") returned 0x0 [0041.000] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", lpString2="C:\\Windows") returned -1 [0041.000] lstrlenW (lpString="C:\\Windows") returned 10 [0041.000] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", lpString2="C:\\System Volume Information") returned -1 [0041.000] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0041.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d5348 [0041.000] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.000] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.000] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.000] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.001] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.001] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.001] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.001] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.001] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.001] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.001] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.001] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0041.001] lstrcmpiW (lpString1="DATES.XML", lpString2="Windows") returned -1 [0041.001] lstrcmpW (lpString1="DATES.XML", lpString2="32.EXE.exe") returned 1 [0041.001] StrStrW (lpFirst="DATES.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.001] lstrcmpW (lpString1="DATES.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.001] GetCurrentThreadId () returned 0x9b0 [0041.001] RtlWakeConditionVariable () returned 0x27e800 [0041.001] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0041.001] lstrcmpiW (lpString1="PHONE.XML", lpString2="Windows") returned -1 [0041.001] lstrcmpW (lpString1="PHONE.XML", lpString2="32.EXE.exe") returned 1 [0041.001] StrStrW (lpFirst="PHONE.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.001] lstrcmpW (lpString1="PHONE.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.001] GetCurrentThreadId () returned 0x9b0 [0041.001] RtlWakeConditionVariable () returned 0x27e800 [0041.001] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0041.001] lstrcmpiW (lpString1="STOCKS.DAT", lpString2="Windows") returned -1 [0041.001] lstrcmpW (lpString1="STOCKS.DAT", lpString2="32.EXE.exe") returned 1 [0041.001] StrStrW (lpFirst="STOCKS.DAT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.001] lstrcmpW (lpString1="STOCKS.DAT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.002] GetCurrentThreadId () returned 0x9b0 [0041.002] RtlWakeConditionVariable () returned 0x27e800 [0041.002] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0041.002] lstrcmpiW (lpString1="STOCKS.XML", lpString2="Windows") returned -1 [0041.002] lstrcmpW (lpString1="STOCKS.XML", lpString2="32.EXE.exe") returned 1 [0041.002] StrStrW (lpFirst="STOCKS.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.002] lstrcmpW (lpString1="STOCKS.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.002] GetCurrentThreadId () returned 0x9b0 [0041.002] RtlWakeConditionVariable () returned 0x27e800 [0041.002] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0041.002] lstrcmpiW (lpString1="TIME.XML", lpString2="Windows") returned -1 [0041.002] lstrcmpW (lpString1="TIME.XML", lpString2="32.EXE.exe") returned 1 [0041.002] StrStrW (lpFirst="TIME.XML", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.002] lstrcmpW (lpString1="TIME.XML", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.002] GetCurrentThreadId () returned 0x9b0 [0041.002] RtlWakeConditionVariable () returned 0x27e800 [0041.002] FindNextFileW (in: hFindFile=0x2d5348, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0041.002] FindClose (in: hFindFile=0x2d5348 | out: hFindFile=0x2d5348) returned 1 [0041.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0041.002] GetCurrentThreadId () returned 0x9b0 [0041.002] RtlWakeConditionVariable () returned 0x27e800 [0041.002] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0041.002] lstrcmpiW (lpString1="BASMLA.XSL", lpString2="Windows") returned -1 [0041.002] lstrcmpW (lpString1="BASMLA.XSL", lpString2="32.EXE.exe") returned 1 [0041.003] StrStrW (lpFirst="BASMLA.XSL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.003] lstrcmpW (lpString1="BASMLA.XSL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.003] GetCurrentThreadId () returned 0x9b0 [0041.003] RtlWakeConditionVariable () returned 0x27e800 [0041.003] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0041.003] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da470 [0041.003] GetCurrentThreadId () returned 0x9b0 [0041.003] RtlWakeConditionVariable () returned 0x27e800 [0041.003] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0041.003] lstrcmpiW (lpString1="METCONV.DLL", lpString2="Windows") returned -1 [0041.003] lstrcmpW (lpString1="METCONV.DLL", lpString2="32.EXE.exe") returned 1 [0041.003] StrStrW (lpFirst="METCONV.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.003] lstrcmpW (lpString1="METCONV.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.003] GetCurrentThreadId () returned 0x9b0 [0041.004] RtlWakeConditionVariable () returned 0x27e800 [0041.004] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0041.004] lstrcmpiW (lpString1="METCONV.TXT", lpString2="Windows") returned -1 [0041.004] lstrcmpW (lpString1="METCONV.TXT", lpString2="32.EXE.exe") returned 1 [0041.004] StrStrW (lpFirst="METCONV.TXT", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.004] lstrcmpW (lpString1="METCONV.TXT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.004] GetCurrentThreadId () returned 0x9b0 [0041.004] RtlWakeConditionVariable () returned 0x27e800 [0041.004] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0041.004] lstrcmpiW (lpString1="MOFL.DLL", lpString2="Windows") returned -1 [0041.004] lstrcmpW (lpString1="MOFL.DLL", lpString2="32.EXE.exe") returned 1 [0041.004] StrStrW (lpFirst="MOFL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.004] lstrcmpW (lpString1="MOFL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.004] GetCurrentThreadId () returned 0x9b0 [0041.004] RtlWakeConditionVariable () returned 0x27e800 [0041.004] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0041.004] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="Windows") returned -1 [0041.004] lstrcmpW (lpString1="MSTAG.TLB", lpString2="32.EXE.exe") returned 1 [0041.004] StrStrW (lpFirst="MSTAG.TLB", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.004] lstrcmpW (lpString1="MSTAG.TLB", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2968f0 [0041.004] GetCurrentThreadId () returned 0x9b0 [0041.004] RtlWakeConditionVariable () returned 0x27e800 [0041.004] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0041.004] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="Windows") returned -1 [0041.004] lstrcmpW (lpString1="SmartTagInstall.exe", lpString2="32.EXE.exe") returned 1 [0041.004] StrStrW (lpFirst="SmartTagInstall.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.004] lstrcmpW (lpString1="SmartTagInstall.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.005] GetCurrentThreadId () returned 0x9b0 [0041.005] RtlWakeConditionVariable () returned 0x27e800 [0041.005] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0041.005] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0041.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2290 [0041.005] GetCurrentThreadId () returned 0x9b0 [0041.005] RtlWakeConditionVariable () returned 0x27e800 [0041.005] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0041.005] lstrcmpiW (lpString1="Source Engine", lpString2="Windows") returned -1 [0041.005] lstrcmpW (lpString1="Source Engine", lpString2=".") returned 1 [0041.005] lstrcmpW (lpString1="Source Engine", lpString2="..") returned 1 [0041.005] lstrcmpW (lpString1="Source Engine", lpString2="AppData") returned 1 [0041.005] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", lpSrch="AppData") returned 0x0 [0041.005] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", lpString2="C:\\Windows") returned -1 [0041.005] lstrlenW (lpString="C:\\Windows") returned 10 [0041.005] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", lpString2="C:\\System Volume Information") returned -1 [0041.005] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0041.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0041.019] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.019] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.019] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.019] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.019] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.019] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.019] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.019] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.019] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.019] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.019] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.019] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0041.019] lstrcmpiW (lpString1="OSE.EXE", lpString2="Windows") returned -1 [0041.019] lstrcmpW (lpString1="OSE.EXE", lpString2="32.EXE.exe") returned 1 [0041.019] StrStrW (lpFirst="OSE.EXE", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.019] lstrcmpW (lpString1="OSE.EXE", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.020] GetCurrentThreadId () returned 0x9b0 [0041.020] RtlWakeConditionVariable () returned 0x27e800 [0041.020] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0041.020] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0041.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.020] GetCurrentThreadId () returned 0x9b0 [0041.020] RtlWakeConditionVariable () returned 0x27e800 [0041.020] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0041.020] lstrcmpiW (lpString1="Stationery", lpString2="Windows") returned -1 [0041.020] lstrcmpW (lpString1="Stationery", lpString2=".") returned 1 [0041.020] lstrcmpW (lpString1="Stationery", lpString2="..") returned 1 [0041.020] lstrcmpW (lpString1="Stationery", lpString2="AppData") returned 1 [0041.020] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpSrch="AppData") returned 0x0 [0041.020] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpString2="C:\\Windows") returned -1 [0041.020] lstrlenW (lpString="C:\\Windows") returned 10 [0041.020] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpString2="C:\\System Volume Information") returned -1 [0041.020] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.020] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0041.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0041.039] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.039] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.039] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.039] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.039] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.039] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.050] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.050] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.050] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.050] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.050] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.050] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.050] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0041.050] lstrcmpiW (lpString1="Bears.htm", lpString2="Windows") returned -1 [0041.050] lstrcmpW (lpString1="Bears.htm", lpString2="32.EXE.exe") returned 1 [0041.050] StrStrW (lpFirst="Bears.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.050] lstrcmpW (lpString1="Bears.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.050] GetCurrentThreadId () returned 0x9b0 [0041.050] RtlWakeConditionVariable () returned 0x27e800 [0041.050] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0041.050] lstrcmpiW (lpString1="Bears.jpg", lpString2="Windows") returned -1 [0041.050] lstrcmpW (lpString1="Bears.jpg", lpString2="32.EXE.exe") returned 1 [0041.050] StrStrW (lpFirst="Bears.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.050] lstrcmpW (lpString1="Bears.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.050] GetCurrentThreadId () returned 0x9b0 [0041.050] RtlWakeConditionVariable () returned 0x27e800 [0041.050] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0041.050] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="Windows") returned -1 [0041.050] lstrcmpW (lpString1="Blue_Gradient.jpg", lpString2="32.EXE.exe") returned 1 [0041.050] StrStrW (lpFirst="Blue_Gradient.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.050] lstrcmpW (lpString1="Blue_Gradient.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.051] GetCurrentThreadId () returned 0x9b0 [0041.051] RtlWakeConditionVariable () returned 0x27e800 [0041.051] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0041.051] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="Windows") returned -1 [0041.051] lstrcmpW (lpString1="Cave_Drawings.gif", lpString2="32.EXE.exe") returned 1 [0041.051] StrStrW (lpFirst="Cave_Drawings.gif", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.051] lstrcmpW (lpString1="Cave_Drawings.gif", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.051] GetCurrentThreadId () returned 0x9b0 [0041.051] RtlWakeConditionVariable () returned 0x27e800 [0041.051] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0041.051] lstrcmpiW (lpString1="Connectivity.gif", lpString2="Windows") returned -1 [0041.051] lstrcmpW (lpString1="Connectivity.gif", lpString2="32.EXE.exe") returned 1 [0041.051] StrStrW (lpFirst="Connectivity.gif", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.051] lstrcmpW (lpString1="Connectivity.gif", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.051] GetCurrentThreadId () returned 0x9b0 [0041.051] RtlWakeConditionVariable () returned 0x27e800 [0041.051] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0041.051] lstrcmpiW (lpString1="Desktop.ini", lpString2="Windows") returned -1 [0041.051] lstrcmpW (lpString1="Desktop.ini", lpString2="32.EXE.exe") returned 1 [0041.051] StrStrW (lpFirst="Desktop.ini", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.051] lstrcmpW (lpString1="Desktop.ini", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.051] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.051] GetCurrentThreadId () returned 0x9b0 [0041.051] RtlWakeConditionVariable () returned 0x27e800 [0041.051] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0041.051] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="Windows") returned -1 [0041.051] lstrcmpW (lpString1="Dotted_Lines.emf", lpString2="32.EXE.exe") returned 1 [0041.051] StrStrW (lpFirst="Dotted_Lines.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.052] lstrcmpW (lpString1="Dotted_Lines.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.052] GetCurrentThreadId () returned 0x9b0 [0041.052] RtlWakeConditionVariable () returned 0x27e800 [0041.052] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0041.052] lstrcmpiW (lpString1="Garden.htm", lpString2="Windows") returned -1 [0041.052] lstrcmpW (lpString1="Garden.htm", lpString2="32.EXE.exe") returned 1 [0041.052] StrStrW (lpFirst="Garden.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.052] lstrcmpW (lpString1="Garden.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.052] GetCurrentThreadId () returned 0x9b0 [0041.052] RtlWakeConditionVariable () returned 0x27e800 [0041.052] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0041.052] lstrcmpiW (lpString1="Garden.jpg", lpString2="Windows") returned -1 [0041.052] lstrcmpW (lpString1="Garden.jpg", lpString2="32.EXE.exe") returned 1 [0041.052] StrStrW (lpFirst="Garden.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.052] lstrcmpW (lpString1="Garden.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.052] GetCurrentThreadId () returned 0x9b0 [0041.052] RtlWakeConditionVariable () returned 0x27e800 [0041.052] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0041.052] lstrcmpiW (lpString1="Genko_1.emf", lpString2="Windows") returned -1 [0041.052] lstrcmpW (lpString1="Genko_1.emf", lpString2="32.EXE.exe") returned 1 [0041.052] StrStrW (lpFirst="Genko_1.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.052] lstrcmpW (lpString1="Genko_1.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.052] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.052] GetCurrentThreadId () returned 0x9b0 [0041.052] RtlWakeConditionVariable () returned 0x27e800 [0041.052] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0041.052] lstrcmpiW (lpString1="Genko_2.emf", lpString2="Windows") returned -1 [0041.052] lstrcmpW (lpString1="Genko_2.emf", lpString2="32.EXE.exe") returned 1 [0041.053] StrStrW (lpFirst="Genko_2.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.053] lstrcmpW (lpString1="Genko_2.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.053] GetCurrentThreadId () returned 0x9b0 [0041.053] RtlWakeConditionVariable () returned 0x27e800 [0041.053] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0041.053] lstrcmpiW (lpString1="Graph.emf", lpString2="Windows") returned -1 [0041.053] lstrcmpW (lpString1="Graph.emf", lpString2="32.EXE.exe") returned 1 [0041.053] StrStrW (lpFirst="Graph.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.053] lstrcmpW (lpString1="Graph.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.053] GetCurrentThreadId () returned 0x9b0 [0041.053] RtlWakeConditionVariable () returned 0x27e800 [0041.053] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0041.053] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="Windows") returned -1 [0041.053] lstrcmpW (lpString1="Green Bubbles.htm", lpString2="32.EXE.exe") returned 1 [0041.053] StrStrW (lpFirst="Green Bubbles.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.053] lstrcmpW (lpString1="Green Bubbles.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.053] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.053] GetCurrentThreadId () returned 0x9b0 [0041.053] RtlWakeConditionVariable () returned 0x27e800 [0041.053] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0041.054] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="Windows") returned -1 [0041.054] lstrcmpW (lpString1="GreenBubbles.jpg", lpString2="32.EXE.exe") returned 1 [0041.054] StrStrW (lpFirst="GreenBubbles.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.054] lstrcmpW (lpString1="GreenBubbles.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.055] GetCurrentThreadId () returned 0x9b0 [0041.055] RtlWakeConditionVariable () returned 0x27e800 [0041.055] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0041.055] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="Windows") returned -1 [0041.055] lstrcmpW (lpString1="grid_(cm).wmf", lpString2="32.EXE.exe") returned 1 [0041.055] StrStrW (lpFirst="grid_(cm).wmf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.055] lstrcmpW (lpString1="grid_(cm).wmf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.055] GetCurrentThreadId () returned 0x9b0 [0041.055] RtlWakeConditionVariable () returned 0x27e800 [0041.055] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0041.055] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="Windows") returned -1 [0041.055] lstrcmpW (lpString1="grid_(inch).wmf", lpString2="32.EXE.exe") returned 1 [0041.055] StrStrW (lpFirst="grid_(inch).wmf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.055] lstrcmpW (lpString1="grid_(inch).wmf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.055] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.055] GetCurrentThreadId () returned 0x9b0 [0041.055] RtlWakeConditionVariable () returned 0x27e800 [0041.056] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0041.056] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="Windows") returned -1 [0041.056] lstrcmpW (lpString1="Hand Prints.htm", lpString2="32.EXE.exe") returned 1 [0041.056] StrStrW (lpFirst="Hand Prints.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.056] lstrcmpW (lpString1="Hand Prints.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.056] GetCurrentThreadId () returned 0x9b0 [0041.056] RtlWakeConditionVariable () returned 0x27e800 [0041.056] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0041.056] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="Windows") returned -1 [0041.056] lstrcmpW (lpString1="HandPrints.jpg", lpString2="32.EXE.exe") returned 1 [0041.056] StrStrW (lpFirst="HandPrints.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.056] lstrcmpW (lpString1="HandPrints.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.056] GetCurrentThreadId () returned 0x9b0 [0041.056] RtlWakeConditionVariable () returned 0x27e800 [0041.056] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0041.056] lstrcmpiW (lpString1="Memo.emf", lpString2="Windows") returned -1 [0041.056] lstrcmpW (lpString1="Memo.emf", lpString2="32.EXE.exe") returned 1 [0041.056] StrStrW (lpFirst="Memo.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.056] lstrcmpW (lpString1="Memo.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.056] GetCurrentThreadId () returned 0x9b0 [0041.056] RtlWakeConditionVariable () returned 0x27e800 [0041.056] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0041.056] lstrcmpiW (lpString1="Monet.jpg", lpString2="Windows") returned -1 [0041.056] lstrcmpW (lpString1="Monet.jpg", lpString2="32.EXE.exe") returned 1 [0041.056] StrStrW (lpFirst="Monet.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.056] lstrcmpW (lpString1="Monet.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.056] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.056] GetCurrentThreadId () returned 0x9b0 [0041.057] RtlWakeConditionVariable () returned 0x27e800 [0041.057] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0041.057] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="Windows") returned -1 [0041.057] lstrcmpW (lpString1="Month_Calendar.emf", lpString2="32.EXE.exe") returned 1 [0041.057] StrStrW (lpFirst="Month_Calendar.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.057] lstrcmpW (lpString1="Month_Calendar.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.057] GetCurrentThreadId () returned 0x9b0 [0041.057] RtlWakeConditionVariable () returned 0x27e800 [0041.057] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0041.057] lstrcmpiW (lpString1="Music.emf", lpString2="Windows") returned -1 [0041.057] lstrcmpW (lpString1="Music.emf", lpString2="32.EXE.exe") returned 1 [0041.057] StrStrW (lpFirst="Music.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.057] lstrcmpW (lpString1="Music.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.057] GetCurrentThreadId () returned 0x9b0 [0041.057] RtlWakeConditionVariable () returned 0x27e800 [0041.057] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0041.057] lstrcmpiW (lpString1="Notebook.jpg", lpString2="Windows") returned -1 [0041.057] lstrcmpW (lpString1="Notebook.jpg", lpString2="32.EXE.exe") returned 1 [0041.057] StrStrW (lpFirst="Notebook.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.057] lstrcmpW (lpString1="Notebook.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.057] GetCurrentThreadId () returned 0x9b0 [0041.057] RtlWakeConditionVariable () returned 0x27e800 [0041.057] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0041.057] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="Windows") returned -1 [0041.057] lstrcmpW (lpString1="Orange Circles.htm", lpString2="32.EXE.exe") returned 1 [0041.057] StrStrW (lpFirst="Orange Circles.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.057] lstrcmpW (lpString1="Orange Circles.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.057] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.058] GetCurrentThreadId () returned 0x9b0 [0041.058] RtlWakeConditionVariable () returned 0x27e800 [0041.058] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0041.058] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="Windows") returned -1 [0041.058] lstrcmpW (lpString1="OrangeCircles.jpg", lpString2="32.EXE.exe") returned 1 [0041.058] StrStrW (lpFirst="OrangeCircles.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.058] lstrcmpW (lpString1="OrangeCircles.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.058] GetCurrentThreadId () returned 0x9b0 [0041.058] RtlWakeConditionVariable () returned 0x27e800 [0041.058] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0041.058] lstrcmpiW (lpString1="Peacock.htm", lpString2="Windows") returned -1 [0041.058] lstrcmpW (lpString1="Peacock.htm", lpString2="32.EXE.exe") returned 1 [0041.058] StrStrW (lpFirst="Peacock.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.058] lstrcmpW (lpString1="Peacock.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.058] GetCurrentThreadId () returned 0x9b0 [0041.058] RtlWakeConditionVariable () returned 0x27e800 [0041.058] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0041.058] lstrcmpiW (lpString1="Peacock.jpg", lpString2="Windows") returned -1 [0041.058] lstrcmpW (lpString1="Peacock.jpg", lpString2="32.EXE.exe") returned 1 [0041.058] StrStrW (lpFirst="Peacock.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.058] lstrcmpW (lpString1="Peacock.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.058] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.058] GetCurrentThreadId () returned 0x9b0 [0041.058] RtlWakeConditionVariable () returned 0x27e800 [0041.058] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0041.058] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="Windows") returned -1 [0041.058] lstrcmpW (lpString1="Pine_Lumber.jpg", lpString2="32.EXE.exe") returned 1 [0041.058] StrStrW (lpFirst="Pine_Lumber.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.059] lstrcmpW (lpString1="Pine_Lumber.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.059] GetCurrentThreadId () returned 0x9b0 [0041.059] RtlWakeConditionVariable () returned 0x27e800 [0041.059] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0041.059] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="Windows") returned -1 [0041.059] lstrcmpW (lpString1="Pretty_Peacock.jpg", lpString2="32.EXE.exe") returned 1 [0041.059] StrStrW (lpFirst="Pretty_Peacock.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.059] lstrcmpW (lpString1="Pretty_Peacock.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.059] GetCurrentThreadId () returned 0x9b0 [0041.059] RtlWakeConditionVariable () returned 0x27e800 [0041.059] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0041.059] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="Windows") returned -1 [0041.059] lstrcmpW (lpString1="Psychedelic.jpg", lpString2="32.EXE.exe") returned 1 [0041.059] StrStrW (lpFirst="Psychedelic.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.059] lstrcmpW (lpString1="Psychedelic.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.059] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.059] GetCurrentThreadId () returned 0x9b0 [0041.059] RtlWakeConditionVariable () returned 0x27e800 [0041.059] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0041.059] lstrcmpiW (lpString1="Roses.htm", lpString2="Windows") returned -1 [0041.059] lstrcmpW (lpString1="Roses.htm", lpString2="32.EXE.exe") returned 1 [0041.060] StrStrW (lpFirst="Roses.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.060] lstrcmpW (lpString1="Roses.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.060] GetCurrentThreadId () returned 0x9b0 [0041.060] RtlWakeConditionVariable () returned 0x27e800 [0041.060] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0041.060] lstrcmpiW (lpString1="Roses.jpg", lpString2="Windows") returned -1 [0041.060] lstrcmpW (lpString1="Roses.jpg", lpString2="32.EXE.exe") returned 1 [0041.060] StrStrW (lpFirst="Roses.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.060] lstrcmpW (lpString1="Roses.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.060] GetCurrentThreadId () returned 0x9b0 [0041.060] RtlWakeConditionVariable () returned 0x27e800 [0041.060] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0041.060] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="Windows") returned -1 [0041.060] lstrcmpW (lpString1="Sand_Paper.jpg", lpString2="32.EXE.exe") returned 1 [0041.060] StrStrW (lpFirst="Sand_Paper.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.060] lstrcmpW (lpString1="Sand_Paper.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.060] GetCurrentThreadId () returned 0x9b0 [0041.060] RtlWakeConditionVariable () returned 0x27e800 [0041.060] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0041.060] lstrcmpiW (lpString1="Seyes.emf", lpString2="Windows") returned -1 [0041.060] lstrcmpW (lpString1="Seyes.emf", lpString2="32.EXE.exe") returned 1 [0041.060] StrStrW (lpFirst="Seyes.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.060] lstrcmpW (lpString1="Seyes.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.060] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.060] GetCurrentThreadId () returned 0x9b0 [0041.060] RtlWakeConditionVariable () returned 0x27e800 [0041.060] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0041.061] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="Windows") returned -1 [0041.061] lstrcmpW (lpString1="Shades of Blue.htm", lpString2="32.EXE.exe") returned 1 [0041.061] StrStrW (lpFirst="Shades of Blue.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.061] lstrcmpW (lpString1="Shades of Blue.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.061] GetCurrentThreadId () returned 0x9b0 [0041.061] RtlWakeConditionVariable () returned 0x27e800 [0041.061] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0041.061] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="Windows") returned -1 [0041.061] lstrcmpW (lpString1="ShadesOfBlue.jpg", lpString2="32.EXE.exe") returned 1 [0041.061] StrStrW (lpFirst="ShadesOfBlue.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.061] lstrcmpW (lpString1="ShadesOfBlue.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.061] GetCurrentThreadId () returned 0x9b0 [0041.061] RtlWakeConditionVariable () returned 0x27e800 [0041.061] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0041.061] lstrcmpiW (lpString1="Shorthand.emf", lpString2="Windows") returned -1 [0041.061] lstrcmpW (lpString1="Shorthand.emf", lpString2="32.EXE.exe") returned 1 [0041.061] StrStrW (lpFirst="Shorthand.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.061] lstrcmpW (lpString1="Shorthand.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.061] GetCurrentThreadId () returned 0x9b0 [0041.061] RtlWakeConditionVariable () returned 0x27e800 [0041.061] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0041.061] lstrcmpiW (lpString1="Small_News.jpg", lpString2="Windows") returned -1 [0041.061] lstrcmpW (lpString1="Small_News.jpg", lpString2="32.EXE.exe") returned 1 [0041.061] StrStrW (lpFirst="Small_News.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.061] lstrcmpW (lpString1="Small_News.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.061] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.061] GetCurrentThreadId () returned 0x9b0 [0041.061] RtlWakeConditionVariable () returned 0x27e800 [0041.062] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0041.062] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="Windows") returned -1 [0041.062] lstrcmpW (lpString1="Soft Blue.htm", lpString2="32.EXE.exe") returned 1 [0041.062] StrStrW (lpFirst="Soft Blue.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.062] lstrcmpW (lpString1="Soft Blue.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.062] GetCurrentThreadId () returned 0x9b0 [0041.062] RtlWakeConditionVariable () returned 0x27e800 [0041.062] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0041.062] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="Windows") returned -1 [0041.062] lstrcmpW (lpString1="SoftBlue.jpg", lpString2="32.EXE.exe") returned 1 [0041.062] StrStrW (lpFirst="SoftBlue.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.062] lstrcmpW (lpString1="SoftBlue.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.062] GetCurrentThreadId () returned 0x9b0 [0041.062] RtlWakeConditionVariable () returned 0x27e800 [0041.062] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0041.062] lstrcmpiW (lpString1="Stars.htm", lpString2="Windows") returned -1 [0041.062] lstrcmpW (lpString1="Stars.htm", lpString2="32.EXE.exe") returned 1 [0041.062] StrStrW (lpFirst="Stars.htm", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.062] lstrcmpW (lpString1="Stars.htm", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.062] GetCurrentThreadId () returned 0x9b0 [0041.062] RtlWakeConditionVariable () returned 0x27e800 [0041.062] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0041.062] lstrcmpiW (lpString1="Stars.jpg", lpString2="Windows") returned -1 [0041.062] lstrcmpW (lpString1="Stars.jpg", lpString2="32.EXE.exe") returned 1 [0041.062] StrStrW (lpFirst="Stars.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.062] lstrcmpW (lpString1="Stars.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.062] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.062] GetCurrentThreadId () returned 0x9b0 [0041.063] RtlWakeConditionVariable () returned 0x27e800 [0041.063] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0041.063] lstrcmpiW (lpString1="Stucco.gif", lpString2="Windows") returned -1 [0041.063] lstrcmpW (lpString1="Stucco.gif", lpString2="32.EXE.exe") returned 1 [0041.063] StrStrW (lpFirst="Stucco.gif", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.063] lstrcmpW (lpString1="Stucco.gif", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.063] GetCurrentThreadId () returned 0x9b0 [0041.063] RtlWakeConditionVariable () returned 0x27e800 [0041.063] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0041.063] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="Windows") returned -1 [0041.063] lstrcmpW (lpString1="Tanspecks.jpg", lpString2="32.EXE.exe") returned 1 [0041.063] StrStrW (lpFirst="Tanspecks.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.063] lstrcmpW (lpString1="Tanspecks.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.063] GetCurrentThreadId () returned 0x9b0 [0041.063] RtlWakeConditionVariable () returned 0x27e800 [0041.063] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0041.063] lstrcmpiW (lpString1="Tiki.gif", lpString2="Windows") returned -1 [0041.063] lstrcmpW (lpString1="Tiki.gif", lpString2="32.EXE.exe") returned 1 [0041.063] StrStrW (lpFirst="Tiki.gif", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.063] lstrcmpW (lpString1="Tiki.gif", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.063] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.063] GetCurrentThreadId () returned 0x9b0 [0041.063] RtlWakeConditionVariable () returned 0x27e800 [0041.063] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0041.063] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="Windows") returned -1 [0041.063] lstrcmpW (lpString1="To_Do_List.emf", lpString2="32.EXE.exe") returned 1 [0041.063] StrStrW (lpFirst="To_Do_List.emf", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.063] lstrcmpW (lpString1="To_Do_List.emf", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.064] GetCurrentThreadId () returned 0x9b0 [0041.064] RtlWakeConditionVariable () returned 0x27e800 [0041.064] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0041.064] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="Windows") returned -1 [0041.064] lstrcmpW (lpString1="White_Chocolate.jpg", lpString2="32.EXE.exe") returned 1 [0041.064] StrStrW (lpFirst="White_Chocolate.jpg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.064] lstrcmpW (lpString1="White_Chocolate.jpg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.064] GetCurrentThreadId () returned 0x9b0 [0041.064] RtlWakeConditionVariable () returned 0x27e800 [0041.064] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0041.064] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="Windows") returned 1 [0041.064] lstrcmpW (lpString1="Wrinkled_Paper.gif", lpString2="32.EXE.exe") returned 1 [0041.064] StrStrW (lpFirst="Wrinkled_Paper.gif", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.064] lstrcmpW (lpString1="Wrinkled_Paper.gif", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.064] GetCurrentThreadId () returned 0x9b0 [0041.064] RtlWakeConditionVariable () returned 0x27e800 [0041.064] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0041.064] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.065] GetCurrentThreadId () returned 0x9b0 [0041.065] RtlWakeConditionVariable () returned 0x27e800 [0041.065] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0041.065] lstrcmpiW (lpString1="TextConv", lpString2="Windows") returned -1 [0041.065] lstrcmpW (lpString1="TextConv", lpString2=".") returned 1 [0041.065] lstrcmpW (lpString1="TextConv", lpString2="..") returned 1 [0041.065] lstrcmpW (lpString1="TextConv", lpString2="AppData") returned 1 [0041.065] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpSrch="AppData") returned 0x0 [0041.065] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpString2="C:\\Windows") returned -1 [0041.065] lstrlenW (lpString="C:\\Windows") returned 10 [0041.065] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpString2="C:\\System Volume Information") returned -1 [0041.065] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.065] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0041.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0041.066] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.066] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.066] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.066] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.066] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.066] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.066] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.066] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.066] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.066] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.066] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.066] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.066] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0041.066] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0041.066] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0041.066] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0041.066] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0041.066] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpSrch="AppData") returned 0x0 [0041.066] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpString2="C:\\Windows") returned -1 [0041.066] lstrlenW (lpString="C:\\Windows") returned 10 [0041.066] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpString2="C:\\System Volume Information") returned -1 [0041.066] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.066] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.067] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.067] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.067] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.067] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.067] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.067] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.067] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.067] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.067] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.067] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.067] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.067] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.067] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.068] GetCurrentThreadId () returned 0x9b0 [0041.068] RtlWakeConditionVariable () returned 0x27e800 [0041.068] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0041.068] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="Windows") returned -1 [0041.068] lstrcmpW (lpString1="MSCONV97.DLL", lpString2="32.EXE.exe") returned 1 [0041.068] StrStrW (lpFirst="MSCONV97.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.068] lstrcmpW (lpString1="MSCONV97.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.068] GetCurrentThreadId () returned 0x9b0 [0041.068] RtlWakeConditionVariable () returned 0x27e800 [0041.068] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0041.068] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="Windows") returned -1 [0041.068] lstrcmpW (lpString1="RECOVR32.CNV", lpString2="32.EXE.exe") returned 1 [0041.068] StrStrW (lpFirst="RECOVR32.CNV", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.068] lstrcmpW (lpString1="RECOVR32.CNV", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f75c0 [0041.068] GetCurrentThreadId () returned 0x9b0 [0041.068] RtlWakeConditionVariable () returned 0x27e800 [0041.068] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0041.068] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="Windows") returned 1 [0041.068] lstrcmpW (lpString1="Wks9Pxy.cnv", lpString2="32.EXE.exe") returned 1 [0041.068] StrStrW (lpFirst="Wks9Pxy.cnv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.068] lstrcmpW (lpString1="Wks9Pxy.cnv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.068] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.068] GetCurrentThreadId () returned 0x9b0 [0041.068] RtlWakeConditionVariable () returned 0x27e800 [0041.068] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0041.068] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="Windows") returned 1 [0041.069] lstrcmpW (lpString1="WPFT532.CNV", lpString2="32.EXE.exe") returned 1 [0041.069] StrStrW (lpFirst="WPFT532.CNV", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.069] lstrcmpW (lpString1="WPFT532.CNV", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.069] GetCurrentThreadId () returned 0x9b0 [0041.069] RtlWakeConditionVariable () returned 0x27e800 [0041.069] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0041.069] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="Windows") returned 1 [0041.069] lstrcmpW (lpString1="WPFT632.CNV", lpString2="32.EXE.exe") returned 1 [0041.069] StrStrW (lpFirst="WPFT632.CNV", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.069] lstrcmpW (lpString1="WPFT632.CNV", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2960a0 [0041.069] GetCurrentThreadId () returned 0x9b0 [0041.069] RtlWakeConditionVariable () returned 0x27e800 [0041.069] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0041.069] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0041.069] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.069] GetCurrentThreadId () returned 0x9b0 [0041.069] RtlWakeConditionVariable () returned 0x27e800 [0041.070] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0041.070] lstrcmpiW (lpString1="THEMES14", lpString2="Windows") returned -1 [0041.070] lstrcmpW (lpString1="THEMES14", lpString2=".") returned 1 [0041.070] lstrcmpW (lpString1="THEMES14", lpString2="..") returned 1 [0041.070] lstrcmpW (lpString1="THEMES14", lpString2="AppData") returned 1 [0041.070] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14", lpSrch="AppData") returned 0x0 [0041.070] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14", lpString2="C:\\Windows") returned -1 [0041.070] lstrlenW (lpString="C:\\Windows") returned 10 [0041.070] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14", lpString2="C:\\System Volume Information") returned -1 [0041.070] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.070] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0041.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0041.128] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.128] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.128] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.128] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.128] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.128] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.140] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.140] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.140] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.140] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.140] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.141] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.141] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0041.141] lstrcmpiW (lpString1="AFTRNOON", lpString2="Windows") returned -1 [0041.141] lstrcmpW (lpString1="AFTRNOON", lpString2=".") returned 1 [0041.141] lstrcmpW (lpString1="AFTRNOON", lpString2="..") returned 1 [0041.141] lstrcmpW (lpString1="AFTRNOON", lpString2="AppData") returned -1 [0041.141] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON", lpSrch="AppData") returned 0x0 [0041.141] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON", lpString2="C:\\Windows") returned -1 [0041.141] lstrlenW (lpString="C:\\Windows") returned 10 [0041.141] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON", lpString2="C:\\System Volume Information") returned -1 [0041.141] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.141] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.141] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.141] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.141] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.142] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.142] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.142] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.142] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.142] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.142] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.142] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.142] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.142] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.142] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0041.142] lstrcmpiW (lpString1="AFTRNOON.ELM", lpString2="Windows") returned -1 [0041.142] lstrcmpW (lpString1="AFTRNOON.ELM", lpString2="32.EXE.exe") returned 1 [0041.142] StrStrW (lpFirst="AFTRNOON.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.142] lstrcmpW (lpString1="AFTRNOON.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.142] GetCurrentThreadId () returned 0x9b0 [0041.142] RtlWakeConditionVariable () returned 0x27e800 [0041.142] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0041.142] lstrcmpiW (lpString1="AFTRNOON.INF", lpString2="Windows") returned -1 [0041.142] lstrcmpW (lpString1="AFTRNOON.INF", lpString2="32.EXE.exe") returned 1 [0041.142] StrStrW (lpFirst="AFTRNOON.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.142] lstrcmpW (lpString1="AFTRNOON.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.142] GetCurrentThreadId () returned 0x9b0 [0041.142] RtlWakeConditionVariable () returned 0x27e800 [0041.142] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.142] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.142] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.142] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.142] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.142] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.143] GetCurrentThreadId () returned 0x9b0 [0041.143] RtlWakeConditionVariable () returned 0x27e800 [0041.143] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.143] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.143] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.143] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.143] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.143] GetCurrentThreadId () returned 0x9b0 [0041.143] RtlWakeConditionVariable () returned 0x27e800 [0041.143] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.143] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.143] GetCurrentThreadId () returned 0x9b0 [0041.143] RtlWakeConditionVariable () returned 0x27e800 [0041.143] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0041.143] lstrcmpiW (lpString1="ARCTIC", lpString2="Windows") returned -1 [0041.143] lstrcmpW (lpString1="ARCTIC", lpString2=".") returned 1 [0041.143] lstrcmpW (lpString1="ARCTIC", lpString2="..") returned 1 [0041.143] lstrcmpW (lpString1="ARCTIC", lpString2="AppData") returned 1 [0041.143] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC", lpSrch="AppData") returned 0x0 [0041.143] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC", lpString2="C:\\Windows") returned -1 [0041.143] lstrlenW (lpString="C:\\Windows") returned 10 [0041.143] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC", lpString2="C:\\System Volume Information") returned -1 [0041.143] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.181] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.181] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.181] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.181] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.181] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.181] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.181] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.181] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.181] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.181] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.181] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.181] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.181] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0041.181] lstrcmpiW (lpString1="ARCTIC.ELM", lpString2="Windows") returned -1 [0041.181] lstrcmpW (lpString1="ARCTIC.ELM", lpString2="32.EXE.exe") returned 1 [0041.182] StrStrW (lpFirst="ARCTIC.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.182] lstrcmpW (lpString1="ARCTIC.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.182] GetCurrentThreadId () returned 0x9b0 [0041.182] RtlWakeConditionVariable () returned 0x27e800 [0041.182] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0041.182] lstrcmpiW (lpString1="ARCTIC.INF", lpString2="Windows") returned -1 [0041.182] lstrcmpW (lpString1="ARCTIC.INF", lpString2="32.EXE.exe") returned 1 [0041.182] StrStrW (lpFirst="ARCTIC.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.182] lstrcmpW (lpString1="ARCTIC.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.182] GetCurrentThreadId () returned 0x9b0 [0041.182] RtlWakeConditionVariable () returned 0x27e800 [0041.182] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.182] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.182] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.182] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.182] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.182] GetCurrentThreadId () returned 0x9b0 [0041.182] RtlWakeConditionVariable () returned 0x27e800 [0041.182] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.182] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.182] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.182] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.182] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.182] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e288 [0041.182] GetCurrentThreadId () returned 0x9b0 [0041.182] RtlWakeConditionVariable () returned 0x27e800 [0041.183] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.183] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.183] GetCurrentThreadId () returned 0x9b0 [0041.183] RtlWakeConditionVariable () returned 0x27e800 [0041.183] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0041.183] lstrcmpiW (lpString1="AXIS", lpString2="Windows") returned -1 [0041.183] lstrcmpW (lpString1="AXIS", lpString2=".") returned 1 [0041.183] lstrcmpW (lpString1="AXIS", lpString2="..") returned 1 [0041.183] lstrcmpW (lpString1="AXIS", lpString2="AppData") returned 1 [0041.183] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS", lpSrch="AppData") returned 0x0 [0041.183] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS", lpString2="C:\\Windows") returned -1 [0041.183] lstrlenW (lpString="C:\\Windows") returned 10 [0041.183] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS", lpString2="C:\\System Volume Information") returned -1 [0041.183] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.183] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.226] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.226] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.226] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.226] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.226] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.226] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.226] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.226] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.226] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.226] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0041.226] lstrcmpiW (lpString1="AXIS.ELM", lpString2="Windows") returned -1 [0041.226] lstrcmpW (lpString1="AXIS.ELM", lpString2="32.EXE.exe") returned 1 [0041.226] StrStrW (lpFirst="AXIS.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.226] lstrcmpW (lpString1="AXIS.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.226] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.226] GetCurrentThreadId () returned 0x9b0 [0041.226] RtlWakeConditionVariable () returned 0x27e800 [0041.227] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0041.227] lstrcmpiW (lpString1="AXIS.INF", lpString2="Windows") returned -1 [0041.227] lstrcmpW (lpString1="AXIS.INF", lpString2="32.EXE.exe") returned 1 [0041.227] StrStrW (lpFirst="AXIS.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.227] lstrcmpW (lpString1="AXIS.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.227] GetCurrentThreadId () returned 0x9b0 [0041.227] RtlWakeConditionVariable () returned 0x27e800 [0041.227] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.227] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.227] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.227] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.227] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.227] GetCurrentThreadId () returned 0x9b0 [0041.227] RtlWakeConditionVariable () returned 0x27e800 [0041.227] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.227] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.227] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.227] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.227] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.227] GetCurrentThreadId () returned 0x9b0 [0041.227] RtlWakeConditionVariable () returned 0x27e800 [0041.227] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.227] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.227] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.227] GetCurrentThreadId () returned 0x9b0 [0041.228] RtlWakeConditionVariable () returned 0x27e800 [0041.228] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0041.228] lstrcmpiW (lpString1="BLENDS", lpString2="Windows") returned -1 [0041.228] lstrcmpW (lpString1="BLENDS", lpString2=".") returned 1 [0041.228] lstrcmpW (lpString1="BLENDS", lpString2="..") returned 1 [0041.228] lstrcmpW (lpString1="BLENDS", lpString2="AppData") returned 1 [0041.228] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS", lpSrch="AppData") returned 0x0 [0041.228] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS", lpString2="C:\\Windows") returned -1 [0041.228] lstrlenW (lpString="C:\\Windows") returned 10 [0041.228] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS", lpString2="C:\\System Volume Information") returned -1 [0041.228] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.228] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.285] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.286] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.286] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.286] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.286] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.286] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.286] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.286] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.286] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.286] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.286] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.286] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0041.286] lstrcmpiW (lpString1="BLENDS.ELM", lpString2="Windows") returned -1 [0041.286] lstrcmpW (lpString1="BLENDS.ELM", lpString2="32.EXE.exe") returned 1 [0041.286] StrStrW (lpFirst="BLENDS.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.286] lstrcmpW (lpString1="BLENDS.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0041.286] GetCurrentThreadId () returned 0x9b0 [0041.286] RtlWakeConditionVariable () returned 0x27e800 [0041.286] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0041.286] lstrcmpiW (lpString1="BLENDS.INF", lpString2="Windows") returned -1 [0041.286] lstrcmpW (lpString1="BLENDS.INF", lpString2="32.EXE.exe") returned 1 [0041.286] StrStrW (lpFirst="BLENDS.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.286] lstrcmpW (lpString1="BLENDS.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.286] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0041.286] GetCurrentThreadId () returned 0x9b0 [0041.287] RtlWakeConditionVariable () returned 0x27e800 [0041.287] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.287] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.287] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.287] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.287] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0041.287] GetCurrentThreadId () returned 0x9b0 [0041.287] RtlWakeConditionVariable () returned 0x27e800 [0041.287] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.287] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.287] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.287] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.287] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d568 [0041.287] GetCurrentThreadId () returned 0x9b0 [0041.287] RtlWakeConditionVariable () returned 0x27e800 [0041.287] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.287] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.287] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0041.287] GetCurrentThreadId () returned 0x9b0 [0041.288] RtlWakeConditionVariable () returned 0x27e800 [0041.288] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0041.288] lstrcmpiW (lpString1="BLUECALM", lpString2="Windows") returned -1 [0041.288] lstrcmpW (lpString1="BLUECALM", lpString2=".") returned 1 [0041.288] lstrcmpW (lpString1="BLUECALM", lpString2="..") returned 1 [0041.288] lstrcmpW (lpString1="BLUECALM", lpString2="AppData") returned 1 [0041.288] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM", lpSrch="AppData") returned 0x0 [0041.288] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM", lpString2="C:\\Windows") returned -1 [0041.288] lstrlenW (lpString="C:\\Windows") returned 10 [0041.288] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM", lpString2="C:\\System Volume Information") returned -1 [0041.288] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.288] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.288] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.288] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.288] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.288] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.288] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.288] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.289] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.289] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.289] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.289] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.289] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0041.289] lstrcmpiW (lpString1="BLUECALM.ELM", lpString2="Windows") returned -1 [0041.289] lstrcmpW (lpString1="BLUECALM.ELM", lpString2="32.EXE.exe") returned 1 [0041.289] StrStrW (lpFirst="BLUECALM.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.289] lstrcmpW (lpString1="BLUECALM.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.289] GetCurrentThreadId () returned 0x9b0 [0041.289] RtlWakeConditionVariable () returned 0x27e800 [0041.289] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0041.289] lstrcmpiW (lpString1="BLUECALM.INF", lpString2="Windows") returned -1 [0041.289] lstrcmpW (lpString1="BLUECALM.INF", lpString2="32.EXE.exe") returned 1 [0041.289] StrStrW (lpFirst="BLUECALM.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.289] lstrcmpW (lpString1="BLUECALM.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.289] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.289] GetCurrentThreadId () returned 0x9b0 [0041.289] RtlWakeConditionVariable () returned 0x27e800 [0041.289] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.290] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.290] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.290] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.290] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.290] GetCurrentThreadId () returned 0x9b0 [0041.290] RtlWakeConditionVariable () returned 0x27e800 [0041.290] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.290] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.290] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.290] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.290] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.290] GetCurrentThreadId () returned 0x9b0 [0041.290] RtlWakeConditionVariable () returned 0x27e800 [0041.290] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.290] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da9e8 [0041.290] GetCurrentThreadId () returned 0x9b0 [0041.290] RtlWakeConditionVariable () returned 0x27e800 [0041.290] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0041.290] lstrcmpiW (lpString1="BLUEPRNT", lpString2="Windows") returned -1 [0041.291] lstrcmpW (lpString1="BLUEPRNT", lpString2=".") returned 1 [0041.291] lstrcmpW (lpString1="BLUEPRNT", lpString2="..") returned 1 [0041.291] lstrcmpW (lpString1="BLUEPRNT", lpString2="AppData") returned 1 [0041.291] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT", lpSrch="AppData") returned 0x0 [0041.291] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT", lpString2="C:\\Windows") returned -1 [0041.291] lstrlenW (lpString="C:\\Windows") returned 10 [0041.291] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT", lpString2="C:\\System Volume Information") returned -1 [0041.291] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.367] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.367] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.367] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.367] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.367] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.368] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.368] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.368] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.368] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.368] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.368] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.368] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.368] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0041.368] lstrcmpiW (lpString1="BLUEPRNT.ELM", lpString2="Windows") returned -1 [0041.368] lstrcmpW (lpString1="BLUEPRNT.ELM", lpString2="32.EXE.exe") returned 1 [0041.368] StrStrW (lpFirst="BLUEPRNT.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.368] lstrcmpW (lpString1="BLUEPRNT.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.368] GetCurrentThreadId () returned 0x9b0 [0041.368] RtlWakeConditionVariable () returned 0x27e800 [0041.368] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0041.368] lstrcmpiW (lpString1="BLUEPRNT.INF", lpString2="Windows") returned -1 [0041.368] lstrcmpW (lpString1="BLUEPRNT.INF", lpString2="32.EXE.exe") returned 1 [0041.368] StrStrW (lpFirst="BLUEPRNT.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.368] lstrcmpW (lpString1="BLUEPRNT.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.368] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.368] GetCurrentThreadId () returned 0x9b0 [0041.368] RtlWakeConditionVariable () returned 0x27e800 [0041.368] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.369] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.369] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.369] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.369] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.369] GetCurrentThreadId () returned 0x9b0 [0041.369] RtlWakeConditionVariable () returned 0x27e800 [0041.369] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.369] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.369] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.369] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.369] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.369] GetCurrentThreadId () returned 0x9b0 [0041.369] RtlWakeConditionVariable () returned 0x27e800 [0041.369] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.369] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.369] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.369] GetCurrentThreadId () returned 0x9b0 [0041.370] RtlWakeConditionVariable () returned 0x27e800 [0041.370] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0041.370] lstrcmpiW (lpString1="BOLDSTRI", lpString2="Windows") returned -1 [0041.370] lstrcmpW (lpString1="BOLDSTRI", lpString2=".") returned 1 [0041.370] lstrcmpW (lpString1="BOLDSTRI", lpString2="..") returned 1 [0041.370] lstrcmpW (lpString1="BOLDSTRI", lpString2="AppData") returned 1 [0041.370] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI", lpSrch="AppData") returned 0x0 [0041.370] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI", lpString2="C:\\Windows") returned -1 [0041.370] lstrlenW (lpString="C:\\Windows") returned 10 [0041.370] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI", lpString2="C:\\System Volume Information") returned -1 [0041.370] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.370] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.376] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.376] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.376] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.376] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.377] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.377] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.377] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.377] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.377] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.377] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.377] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.377] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0041.377] lstrcmpiW (lpString1="BOLDSTRI.ELM", lpString2="Windows") returned -1 [0041.377] lstrcmpW (lpString1="BOLDSTRI.ELM", lpString2="32.EXE.exe") returned 1 [0041.377] StrStrW (lpFirst="BOLDSTRI.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.377] lstrcmpW (lpString1="BOLDSTRI.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.377] GetCurrentThreadId () returned 0x9b0 [0041.377] RtlWakeConditionVariable () returned 0x27e800 [0041.377] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0041.377] lstrcmpiW (lpString1="BOLDSTRI.INF", lpString2="Windows") returned -1 [0041.377] lstrcmpW (lpString1="BOLDSTRI.INF", lpString2="32.EXE.exe") returned 1 [0041.377] StrStrW (lpFirst="BOLDSTRI.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.377] lstrcmpW (lpString1="BOLDSTRI.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.377] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.377] GetCurrentThreadId () returned 0x9b0 [0041.378] RtlWakeConditionVariable () returned 0x27e800 [0041.378] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.378] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.378] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.378] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.378] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.378] GetCurrentThreadId () returned 0x9b0 [0041.378] RtlWakeConditionVariable () returned 0x27e800 [0041.378] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.378] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.378] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.378] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.378] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3488 [0041.378] GetCurrentThreadId () returned 0x9b0 [0041.378] RtlWakeConditionVariable () returned 0x27e800 [0041.378] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.378] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.378] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.378] GetCurrentThreadId () returned 0x9b0 [0041.379] RtlWakeConditionVariable () returned 0x27e800 [0041.379] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0041.379] lstrcmpiW (lpString1="BREEZE", lpString2="Windows") returned -1 [0041.379] lstrcmpW (lpString1="BREEZE", lpString2=".") returned 1 [0041.379] lstrcmpW (lpString1="BREEZE", lpString2="..") returned 1 [0041.380] lstrcmpW (lpString1="BREEZE", lpString2="AppData") returned 1 [0041.380] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE", lpSrch="AppData") returned 0x0 [0041.380] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE", lpString2="C:\\Windows") returned -1 [0041.380] lstrlenW (lpString="C:\\Windows") returned 10 [0041.380] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE", lpString2="C:\\System Volume Information") returned -1 [0041.380] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.380] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.382] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.382] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.382] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.382] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.382] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.382] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.383] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.383] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.383] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.383] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.383] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.383] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.383] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0041.383] lstrcmpiW (lpString1="BREEZE.ELM", lpString2="Windows") returned -1 [0041.383] lstrcmpW (lpString1="BREEZE.ELM", lpString2="32.EXE.exe") returned 1 [0041.383] StrStrW (lpFirst="BREEZE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.383] lstrcmpW (lpString1="BREEZE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e420 [0041.383] GetCurrentThreadId () returned 0x9b0 [0041.383] RtlWakeConditionVariable () returned 0x27e800 [0041.383] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0041.383] lstrcmpiW (lpString1="BREEZE.INF", lpString2="Windows") returned -1 [0041.383] lstrcmpW (lpString1="BREEZE.INF", lpString2="32.EXE.exe") returned 1 [0041.383] StrStrW (lpFirst="BREEZE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.383] lstrcmpW (lpString1="BREEZE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.383] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e420 [0041.383] GetCurrentThreadId () returned 0x9b0 [0041.383] RtlWakeConditionVariable () returned 0x27e800 [0041.383] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.384] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.384] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.384] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.384] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e420 [0041.384] GetCurrentThreadId () returned 0x9b0 [0041.384] RtlWakeConditionVariable () returned 0x27e800 [0041.384] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.384] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.384] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.384] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.384] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e420 [0041.384] GetCurrentThreadId () returned 0x9b0 [0041.384] RtlWakeConditionVariable () returned 0x27e800 [0041.384] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.384] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.384] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.384] GetCurrentThreadId () returned 0x9b0 [0041.384] RtlWakeConditionVariable () returned 0x27e800 [0041.385] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0041.385] lstrcmpiW (lpString1="CANYON", lpString2="Windows") returned -1 [0041.385] lstrcmpW (lpString1="CANYON", lpString2=".") returned 1 [0041.385] lstrcmpW (lpString1="CANYON", lpString2="..") returned 1 [0041.385] lstrcmpW (lpString1="CANYON", lpString2="AppData") returned 1 [0041.385] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON", lpSrch="AppData") returned 0x0 [0041.385] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON", lpString2="C:\\Windows") returned -1 [0041.385] lstrlenW (lpString="C:\\Windows") returned 10 [0041.385] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON", lpString2="C:\\System Volume Information") returned -1 [0041.385] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.385] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.410] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.410] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.410] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.410] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.410] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.410] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.410] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.410] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.410] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.410] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.410] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.410] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.410] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0041.410] lstrcmpiW (lpString1="CANYON.ELM", lpString2="Windows") returned -1 [0041.410] lstrcmpW (lpString1="CANYON.ELM", lpString2="32.EXE.exe") returned 1 [0041.410] StrStrW (lpFirst="CANYON.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.410] lstrcmpW (lpString1="CANYON.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.410] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e618 [0041.410] GetCurrentThreadId () returned 0x9b0 [0041.410] RtlWakeConditionVariable () returned 0x27e800 [0041.410] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0041.410] lstrcmpiW (lpString1="CANYON.INF", lpString2="Windows") returned -1 [0041.410] lstrcmpW (lpString1="CANYON.INF", lpString2="32.EXE.exe") returned 1 [0041.410] StrStrW (lpFirst="CANYON.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.410] lstrcmpW (lpString1="CANYON.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e618 [0041.411] GetCurrentThreadId () returned 0x9b0 [0041.411] RtlWakeConditionVariable () returned 0x27e800 [0041.411] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.411] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.411] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.411] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.411] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e618 [0041.411] GetCurrentThreadId () returned 0x9b0 [0041.411] RtlWakeConditionVariable () returned 0x27e800 [0041.411] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.411] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.411] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.411] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.411] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.411] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e618 [0041.411] GetCurrentThreadId () returned 0x9b0 [0041.411] RtlWakeConditionVariable () returned 0x27e800 [0041.411] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.411] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.412] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.412] GetCurrentThreadId () returned 0x9b0 [0041.412] RtlWakeConditionVariable () returned 0x27e800 [0041.412] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0041.412] lstrcmpiW (lpString1="CAPSULES", lpString2="Windows") returned -1 [0041.413] lstrcmpW (lpString1="CAPSULES", lpString2=".") returned 1 [0041.413] lstrcmpW (lpString1="CAPSULES", lpString2="..") returned 1 [0041.413] lstrcmpW (lpString1="CAPSULES", lpString2="AppData") returned 1 [0041.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES", lpSrch="AppData") returned 0x0 [0041.413] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES", lpString2="C:\\Windows") returned -1 [0041.413] lstrlenW (lpString="C:\\Windows") returned 10 [0041.413] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES", lpString2="C:\\System Volume Information") returned -1 [0041.413] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.441] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.441] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.441] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.441] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.441] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.441] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.441] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.441] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.441] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.441] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.441] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.441] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.441] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0041.441] lstrcmpiW (lpString1="CAPSULES.ELM", lpString2="Windows") returned -1 [0041.442] lstrcmpW (lpString1="CAPSULES.ELM", lpString2="32.EXE.exe") returned 1 [0041.442] StrStrW (lpFirst="CAPSULES.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.442] lstrcmpW (lpString1="CAPSULES.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3768 [0041.442] GetCurrentThreadId () returned 0x9b0 [0041.442] RtlWakeConditionVariable () returned 0x27e800 [0041.442] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0041.442] lstrcmpiW (lpString1="CAPSULES.INF", lpString2="Windows") returned -1 [0041.442] lstrcmpW (lpString1="CAPSULES.INF", lpString2="32.EXE.exe") returned 1 [0041.442] StrStrW (lpFirst="CAPSULES.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.442] lstrcmpW (lpString1="CAPSULES.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3768 [0041.442] GetCurrentThreadId () returned 0x9b0 [0041.442] RtlWakeConditionVariable () returned 0x27e800 [0041.442] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.442] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.442] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.442] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.442] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.442] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3768 [0041.442] GetCurrentThreadId () returned 0x9b0 [0041.442] RtlWakeConditionVariable () returned 0x27e800 [0041.442] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.442] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.443] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.443] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.443] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3768 [0041.443] GetCurrentThreadId () returned 0x9b0 [0041.443] RtlWakeConditionVariable () returned 0x27e800 [0041.443] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.443] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.443] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.443] GetCurrentThreadId () returned 0x9b0 [0041.443] RtlWakeConditionVariable () returned 0x27e800 [0041.444] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0041.444] lstrcmpiW (lpString1="CASCADE", lpString2="Windows") returned -1 [0041.444] lstrcmpW (lpString1="CASCADE", lpString2=".") returned 1 [0041.444] lstrcmpW (lpString1="CASCADE", lpString2="..") returned 1 [0041.444] lstrcmpW (lpString1="CASCADE", lpString2="AppData") returned 1 [0041.444] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE", lpSrch="AppData") returned 0x0 [0041.444] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE", lpString2="C:\\Windows") returned -1 [0041.444] lstrlenW (lpString="C:\\Windows") returned 10 [0041.444] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE", lpString2="C:\\System Volume Information") returned -1 [0041.444] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.444] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.538] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.538] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.538] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.538] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.538] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.538] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.538] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.538] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.539] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.539] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.539] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.539] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.539] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0041.539] lstrcmpiW (lpString1="CASCADE.ELM", lpString2="Windows") returned -1 [0041.539] lstrcmpW (lpString1="CASCADE.ELM", lpString2="32.EXE.exe") returned 1 [0041.539] StrStrW (lpFirst="CASCADE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.539] lstrcmpW (lpString1="CASCADE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e768 [0041.539] GetCurrentThreadId () returned 0x9b0 [0041.539] RtlWakeConditionVariable () returned 0x27e800 [0041.539] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0041.539] lstrcmpiW (lpString1="CASCADE.INF", lpString2="Windows") returned -1 [0041.539] lstrcmpW (lpString1="CASCADE.INF", lpString2="32.EXE.exe") returned 1 [0041.539] StrStrW (lpFirst="CASCADE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.539] lstrcmpW (lpString1="CASCADE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e768 [0041.539] GetCurrentThreadId () returned 0x9b0 [0041.539] RtlWakeConditionVariable () returned 0x27e800 [0041.539] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.539] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.539] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.539] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.539] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e768 [0041.540] GetCurrentThreadId () returned 0x9b0 [0041.540] RtlWakeConditionVariable () returned 0x27e800 [0041.540] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.540] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.540] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.540] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.540] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.540] GetCurrentThreadId () returned 0x9b0 [0041.540] RtlWakeConditionVariable () returned 0x27e800 [0041.540] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.540] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.540] GetCurrentThreadId () returned 0x9b0 [0041.540] RtlWakeConditionVariable () returned 0x27e800 [0041.540] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0041.540] lstrcmpiW (lpString1="COMPASS", lpString2="Windows") returned -1 [0041.540] lstrcmpW (lpString1="COMPASS", lpString2=".") returned 1 [0041.540] lstrcmpW (lpString1="COMPASS", lpString2="..") returned 1 [0041.541] lstrcmpW (lpString1="COMPASS", lpString2="AppData") returned 1 [0041.541] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS", lpSrch="AppData") returned 0x0 [0041.541] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS", lpString2="C:\\Windows") returned -1 [0041.541] lstrlenW (lpString="C:\\Windows") returned 10 [0041.541] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS", lpString2="C:\\System Volume Information") returned -1 [0041.541] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.562] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.562] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.562] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.562] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.562] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.562] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.562] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.562] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.562] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.562] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.562] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.562] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.562] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0041.562] lstrcmpiW (lpString1="COMPASS.ELM", lpString2="Windows") returned -1 [0041.562] lstrcmpW (lpString1="COMPASS.ELM", lpString2="32.EXE.exe") returned 1 [0041.562] StrStrW (lpFirst="COMPASS.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.562] lstrcmpW (lpString1="COMPASS.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.562] GetCurrentThreadId () returned 0x9b0 [0041.562] RtlWakeConditionVariable () returned 0x27e800 [0041.562] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0041.562] lstrcmpiW (lpString1="COMPASS.INF", lpString2="Windows") returned -1 [0041.562] lstrcmpW (lpString1="COMPASS.INF", lpString2="32.EXE.exe") returned 1 [0041.562] StrStrW (lpFirst="COMPASS.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.562] lstrcmpW (lpString1="COMPASS.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.562] GetCurrentThreadId () returned 0x9b0 [0041.562] RtlWakeConditionVariable () returned 0x27e800 [0041.562] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.563] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.563] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.563] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.563] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.563] GetCurrentThreadId () returned 0x9b0 [0041.563] RtlWakeConditionVariable () returned 0x27e800 [0041.563] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.563] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.563] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.563] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.563] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.563] GetCurrentThreadId () returned 0x9b0 [0041.563] RtlWakeConditionVariable () returned 0x27e800 [0041.563] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.563] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dadd0 [0041.563] GetCurrentThreadId () returned 0x9b0 [0041.563] RtlWakeConditionVariable () returned 0x27e800 [0041.564] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0041.564] lstrcmpiW (lpString1="CONCRETE", lpString2="Windows") returned -1 [0041.564] lstrcmpW (lpString1="CONCRETE", lpString2=".") returned 1 [0041.564] lstrcmpW (lpString1="CONCRETE", lpString2="..") returned 1 [0041.564] lstrcmpW (lpString1="CONCRETE", lpString2="AppData") returned 1 [0041.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE", lpSrch="AppData") returned 0x0 [0041.564] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE", lpString2="C:\\Windows") returned -1 [0041.565] lstrlenW (lpString="C:\\Windows") returned 10 [0041.565] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE", lpString2="C:\\System Volume Information") returned -1 [0041.565] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.565] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.565] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.566] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.566] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.566] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.566] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.566] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.566] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.566] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.566] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.566] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.566] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0041.566] lstrcmpiW (lpString1="CONCRETE.ELM", lpString2="Windows") returned -1 [0041.566] lstrcmpW (lpString1="CONCRETE.ELM", lpString2="32.EXE.exe") returned 1 [0041.566] StrStrW (lpFirst="CONCRETE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.566] lstrcmpW (lpString1="CONCRETE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.566] GetCurrentThreadId () returned 0x9b0 [0041.566] RtlWakeConditionVariable () returned 0x27e800 [0041.566] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0041.566] lstrcmpiW (lpString1="CONCRETE.INF", lpString2="Windows") returned -1 [0041.566] lstrcmpW (lpString1="CONCRETE.INF", lpString2="32.EXE.exe") returned 1 [0041.566] StrStrW (lpFirst="CONCRETE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.566] lstrcmpW (lpString1="CONCRETE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.566] GetCurrentThreadId () returned 0x9b0 [0041.567] RtlWakeConditionVariable () returned 0x27e800 [0041.567] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.567] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.567] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.567] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.567] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.567] GetCurrentThreadId () returned 0x9b0 [0041.567] RtlWakeConditionVariable () returned 0x27e800 [0041.567] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.567] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.567] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.567] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.567] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.567] GetCurrentThreadId () returned 0x9b0 [0041.567] RtlWakeConditionVariable () returned 0x27e800 [0041.567] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.567] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.569] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dadd0 [0041.569] GetCurrentThreadId () returned 0x9b0 [0041.569] RtlWakeConditionVariable () returned 0x27e800 [0041.569] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0041.569] lstrcmpiW (lpString1="DEEPBLUE", lpString2="Windows") returned -1 [0041.569] lstrcmpW (lpString1="DEEPBLUE", lpString2=".") returned 1 [0041.569] lstrcmpW (lpString1="DEEPBLUE", lpString2="..") returned 1 [0041.569] lstrcmpW (lpString1="DEEPBLUE", lpString2="AppData") returned 1 [0041.569] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE", lpSrch="AppData") returned 0x0 [0041.570] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE", lpString2="C:\\Windows") returned -1 [0041.570] lstrlenW (lpString="C:\\Windows") returned 10 [0041.570] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE", lpString2="C:\\System Volume Information") returned -1 [0041.570] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.570] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.572] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.572] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.572] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.572] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.572] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.572] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.573] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.573] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.573] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.573] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.573] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.573] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.573] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0041.573] lstrcmpiW (lpString1="DEEPBLUE.ELM", lpString2="Windows") returned -1 [0041.573] lstrcmpW (lpString1="DEEPBLUE.ELM", lpString2="32.EXE.exe") returned 1 [0041.573] StrStrW (lpFirst="DEEPBLUE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.573] lstrcmpW (lpString1="DEEPBLUE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.573] GetCurrentThreadId () returned 0x9b0 [0041.573] RtlWakeConditionVariable () returned 0x27e800 [0041.573] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0041.573] lstrcmpiW (lpString1="DEEPBLUE.INF", lpString2="Windows") returned -1 [0041.573] lstrcmpW (lpString1="DEEPBLUE.INF", lpString2="32.EXE.exe") returned 1 [0041.573] StrStrW (lpFirst="DEEPBLUE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.573] lstrcmpW (lpString1="DEEPBLUE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.573] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.573] GetCurrentThreadId () returned 0x9b0 [0041.573] RtlWakeConditionVariable () returned 0x27e800 [0041.573] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.574] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.574] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.574] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.574] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.574] GetCurrentThreadId () returned 0x9b0 [0041.574] RtlWakeConditionVariable () returned 0x27e800 [0041.574] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.574] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.574] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.574] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.574] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.574] GetCurrentThreadId () returned 0x9b0 [0041.574] RtlWakeConditionVariable () returned 0x27e800 [0041.574] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.574] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.574] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dadd0 [0041.574] GetCurrentThreadId () returned 0x9b0 [0041.575] RtlWakeConditionVariable () returned 0x27e800 [0041.575] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0041.575] lstrcmpiW (lpString1="ECHO", lpString2="Windows") returned -1 [0041.575] lstrcmpW (lpString1="ECHO", lpString2=".") returned 1 [0041.575] lstrcmpW (lpString1="ECHO", lpString2="..") returned 1 [0041.575] lstrcmpW (lpString1="ECHO", lpString2="AppData") returned 1 [0041.575] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO", lpSrch="AppData") returned 0x0 [0041.575] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO", lpString2="C:\\Windows") returned -1 [0041.575] lstrlenW (lpString="C:\\Windows") returned 10 [0041.575] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO", lpString2="C:\\System Volume Information") returned -1 [0041.575] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.575] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.576] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.576] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.576] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.576] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.577] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.577] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.577] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.577] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.577] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.577] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.577] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.577] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.577] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0041.577] lstrcmpiW (lpString1="ECHO.ELM", lpString2="Windows") returned -1 [0041.577] lstrcmpW (lpString1="ECHO.ELM", lpString2="32.EXE.exe") returned 1 [0041.577] StrStrW (lpFirst="ECHO.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.577] lstrcmpW (lpString1="ECHO.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.577] GetCurrentThreadId () returned 0x9b0 [0041.577] RtlWakeConditionVariable () returned 0x27e800 [0041.577] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0041.577] lstrcmpiW (lpString1="ECHO.INF", lpString2="Windows") returned -1 [0041.577] lstrcmpW (lpString1="ECHO.INF", lpString2="32.EXE.exe") returned 1 [0041.577] StrStrW (lpFirst="ECHO.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.577] lstrcmpW (lpString1="ECHO.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.577] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.577] GetCurrentThreadId () returned 0x9b0 [0041.577] RtlWakeConditionVariable () returned 0x27e800 [0041.578] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.578] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.578] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.578] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.578] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.578] GetCurrentThreadId () returned 0x9b0 [0041.578] RtlWakeConditionVariable () returned 0x27e800 [0041.578] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.578] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.578] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.578] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.578] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e6c0 [0041.578] GetCurrentThreadId () returned 0x9b0 [0041.578] RtlWakeConditionVariable () returned 0x27e800 [0041.578] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.578] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.578] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2dadd0 [0041.578] GetCurrentThreadId () returned 0x9b0 [0041.578] RtlWakeConditionVariable () returned 0x27e800 [0041.579] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0041.579] lstrcmpiW (lpString1="ECLIPSE", lpString2="Windows") returned -1 [0041.579] lstrcmpW (lpString1="ECLIPSE", lpString2=".") returned 1 [0041.579] lstrcmpW (lpString1="ECLIPSE", lpString2="..") returned 1 [0041.579] lstrcmpW (lpString1="ECLIPSE", lpString2="AppData") returned 1 [0041.579] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE", lpSrch="AppData") returned 0x0 [0041.579] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE", lpString2="C:\\Windows") returned -1 [0041.579] lstrlenW (lpString="C:\\Windows") returned 10 [0041.579] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE", lpString2="C:\\System Volume Information") returned -1 [0041.579] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.579] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.684] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.684] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.684] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.684] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.684] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.684] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.684] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.684] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.684] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.684] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.684] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0041.684] lstrcmpiW (lpString1="ECLIPSE.ELM", lpString2="Windows") returned -1 [0041.684] lstrcmpW (lpString1="ECLIPSE.ELM", lpString2="32.EXE.exe") returned 1 [0041.685] StrStrW (lpFirst="ECLIPSE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.685] lstrcmpW (lpString1="ECLIPSE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.685] GetCurrentThreadId () returned 0x9b0 [0041.685] RtlWakeConditionVariable () returned 0x27e800 [0041.685] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0041.685] lstrcmpiW (lpString1="ECLIPSE.INF", lpString2="Windows") returned -1 [0041.685] lstrcmpW (lpString1="ECLIPSE.INF", lpString2="32.EXE.exe") returned 1 [0041.685] StrStrW (lpFirst="ECLIPSE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.685] lstrcmpW (lpString1="ECLIPSE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.685] GetCurrentThreadId () returned 0x9b0 [0041.685] RtlWakeConditionVariable () returned 0x27e800 [0041.685] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.685] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.685] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.685] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.685] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.685] GetCurrentThreadId () returned 0x9b0 [0041.685] RtlWakeConditionVariable () returned 0x27e800 [0041.685] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.686] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.686] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.686] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.686] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.686] GetCurrentThreadId () returned 0x9b0 [0041.686] RtlWakeConditionVariable () returned 0x27e800 [0041.686] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.686] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.686] GetCurrentThreadId () returned 0x9b0 [0041.686] RtlWakeConditionVariable () returned 0x27e800 [0041.687] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0041.687] lstrcmpiW (lpString1="EDGE", lpString2="Windows") returned -1 [0041.687] lstrcmpW (lpString1="EDGE", lpString2=".") returned 1 [0041.687] lstrcmpW (lpString1="EDGE", lpString2="..") returned 1 [0041.687] lstrcmpW (lpString1="EDGE", lpString2="AppData") returned 1 [0041.687] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE", lpSrch="AppData") returned 0x0 [0041.687] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE", lpString2="C:\\Windows") returned -1 [0041.687] lstrlenW (lpString="C:\\Windows") returned 10 [0041.687] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE", lpString2="C:\\System Volume Information") returned -1 [0041.687] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.696] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.696] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.696] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.696] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.696] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.696] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.696] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.697] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.697] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.697] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.697] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.697] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.697] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0041.697] lstrcmpiW (lpString1="EDGE.ELM", lpString2="Windows") returned -1 [0041.697] lstrcmpW (lpString1="EDGE.ELM", lpString2="32.EXE.exe") returned 1 [0041.697] StrStrW (lpFirst="EDGE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.697] lstrcmpW (lpString1="EDGE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.697] GetCurrentThreadId () returned 0x9b0 [0041.697] RtlWakeConditionVariable () returned 0x27e800 [0041.697] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0041.697] lstrcmpiW (lpString1="EDGE.INF", lpString2="Windows") returned -1 [0041.697] lstrcmpW (lpString1="EDGE.INF", lpString2="32.EXE.exe") returned 1 [0041.697] StrStrW (lpFirst="EDGE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.697] lstrcmpW (lpString1="EDGE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.697] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.697] GetCurrentThreadId () returned 0x9b0 [0041.697] RtlWakeConditionVariable () returned 0x27e800 [0041.697] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.697] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.697] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.698] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.698] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.698] GetCurrentThreadId () returned 0x9b0 [0041.698] RtlWakeConditionVariable () returned 0x27e800 [0041.698] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.698] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.698] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.698] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.698] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30df88 [0041.698] GetCurrentThreadId () returned 0x9b0 [0041.698] RtlWakeConditionVariable () returned 0x27e800 [0041.698] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.698] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.698] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.698] GetCurrentThreadId () returned 0x9b0 [0041.698] RtlWakeConditionVariable () returned 0x27e800 [0041.699] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0041.699] lstrcmpiW (lpString1="EVRGREEN", lpString2="Windows") returned -1 [0041.699] lstrcmpW (lpString1="EVRGREEN", lpString2=".") returned 1 [0041.699] lstrcmpW (lpString1="EVRGREEN", lpString2="..") returned 1 [0041.699] lstrcmpW (lpString1="EVRGREEN", lpString2="AppData") returned 1 [0041.699] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN", lpSrch="AppData") returned 0x0 [0041.700] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN", lpString2="C:\\Windows") returned -1 [0041.700] lstrlenW (lpString="C:\\Windows") returned 10 [0041.700] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN", lpString2="C:\\System Volume Information") returned -1 [0041.700] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.700] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.748] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.748] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.748] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.748] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.749] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.749] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.749] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.749] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.749] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.749] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.749] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.749] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.749] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0041.749] lstrcmpiW (lpString1="EVRGREEN.ELM", lpString2="Windows") returned -1 [0041.749] lstrcmpW (lpString1="EVRGREEN.ELM", lpString2="32.EXE.exe") returned 1 [0041.749] StrStrW (lpFirst="EVRGREEN.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.749] lstrcmpW (lpString1="EVRGREEN.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.749] GetCurrentThreadId () returned 0x9b0 [0041.749] RtlWakeConditionVariable () returned 0x27e800 [0041.749] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0041.749] lstrcmpiW (lpString1="EVRGREEN.INF", lpString2="Windows") returned -1 [0041.749] lstrcmpW (lpString1="EVRGREEN.INF", lpString2="32.EXE.exe") returned 1 [0041.749] StrStrW (lpFirst="EVRGREEN.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.749] lstrcmpW (lpString1="EVRGREEN.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.749] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.749] GetCurrentThreadId () returned 0x9b0 [0041.750] RtlWakeConditionVariable () returned 0x27e800 [0041.750] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.750] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.750] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.750] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.750] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.750] GetCurrentThreadId () returned 0x9b0 [0041.750] RtlWakeConditionVariable () returned 0x27e800 [0041.750] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.750] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.750] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.750] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.750] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.750] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.750] GetCurrentThreadId () returned 0x9b0 [0041.750] RtlWakeConditionVariable () returned 0x27e800 [0041.750] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.750] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.751] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.751] GetCurrentThreadId () returned 0x9b0 [0041.751] RtlWakeConditionVariable () returned 0x27e800 [0041.751] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0041.751] lstrcmpiW (lpString1="EXPEDITN", lpString2="Windows") returned -1 [0041.752] lstrcmpW (lpString1="EXPEDITN", lpString2=".") returned 1 [0041.752] lstrcmpW (lpString1="EXPEDITN", lpString2="..") returned 1 [0041.752] lstrcmpW (lpString1="EXPEDITN", lpString2="AppData") returned 1 [0041.752] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN", lpSrch="AppData") returned 0x0 [0041.752] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN", lpString2="C:\\Windows") returned -1 [0041.752] lstrlenW (lpString="C:\\Windows") returned 10 [0041.752] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN", lpString2="C:\\System Volume Information") returned -1 [0041.752] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.752] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.753] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.753] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.753] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.753] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.753] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.753] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.753] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.753] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.753] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.753] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.753] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.753] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0041.753] lstrcmpiW (lpString1="EXPEDITN.ELM", lpString2="Windows") returned -1 [0041.753] lstrcmpW (lpString1="EXPEDITN.ELM", lpString2="32.EXE.exe") returned 1 [0041.753] StrStrW (lpFirst="EXPEDITN.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.753] lstrcmpW (lpString1="EXPEDITN.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.753] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.753] GetCurrentThreadId () returned 0x9b0 [0041.753] RtlWakeConditionVariable () returned 0x27e800 [0041.753] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0041.753] lstrcmpiW (lpString1="EXPEDITN.INF", lpString2="Windows") returned -1 [0041.754] lstrcmpW (lpString1="EXPEDITN.INF", lpString2="32.EXE.exe") returned 1 [0041.754] StrStrW (lpFirst="EXPEDITN.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.754] lstrcmpW (lpString1="EXPEDITN.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.754] GetCurrentThreadId () returned 0x9b0 [0041.754] RtlWakeConditionVariable () returned 0x27e800 [0041.754] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.754] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.754] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.754] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.754] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.754] GetCurrentThreadId () returned 0x9b0 [0041.754] RtlWakeConditionVariable () returned 0x27e800 [0041.754] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.754] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.754] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.754] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.754] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.754] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.754] GetCurrentThreadId () returned 0x9b0 [0041.754] RtlWakeConditionVariable () returned 0x27e800 [0041.754] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.755] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.755] GetCurrentThreadId () returned 0x9b0 [0041.755] RtlWakeConditionVariable () returned 0x27e800 [0041.755] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0041.755] lstrcmpiW (lpString1="ICE", lpString2="Windows") returned -1 [0041.755] lstrcmpW (lpString1="ICE", lpString2=".") returned 1 [0041.755] lstrcmpW (lpString1="ICE", lpString2="..") returned 1 [0041.755] lstrcmpW (lpString1="ICE", lpString2="AppData") returned 1 [0041.755] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE", lpSrch="AppData") returned 0x0 [0041.755] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE", lpString2="C:\\Windows") returned -1 [0041.755] lstrlenW (lpString="C:\\Windows") returned 10 [0041.755] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE", lpString2="C:\\System Volume Information") returned -1 [0041.755] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.755] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.757] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.757] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.757] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.757] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.757] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.757] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.757] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.757] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.757] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.757] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.757] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.757] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.758] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0041.758] lstrcmpiW (lpString1="ICE.ELM", lpString2="Windows") returned -1 [0041.758] lstrcmpW (lpString1="ICE.ELM", lpString2="32.EXE.exe") returned 1 [0041.758] StrStrW (lpFirst="ICE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.758] lstrcmpW (lpString1="ICE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.758] GetCurrentThreadId () returned 0x9b0 [0041.758] RtlWakeConditionVariable () returned 0x27e800 [0041.758] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0041.758] lstrcmpiW (lpString1="ICE.INF", lpString2="Windows") returned -1 [0041.758] lstrcmpW (lpString1="ICE.INF", lpString2="32.EXE.exe") returned 1 [0041.758] StrStrW (lpFirst="ICE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.758] lstrcmpW (lpString1="ICE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296268 [0041.758] GetCurrentThreadId () returned 0x9b0 [0041.758] RtlWakeConditionVariable () returned 0x27e800 [0041.758] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.758] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.758] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.758] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.758] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.758] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.758] GetCurrentThreadId () returned 0x9b0 [0041.758] RtlWakeConditionVariable () returned 0x27e800 [0041.759] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.759] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.759] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.759] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.759] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.759] GetCurrentThreadId () returned 0x9b0 [0041.759] RtlWakeConditionVariable () returned 0x27e800 [0041.759] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.759] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.759] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.759] GetCurrentThreadId () returned 0x9b0 [0041.759] RtlWakeConditionVariable () returned 0x27e800 [0041.759] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0041.759] lstrcmpiW (lpString1="INDUST", lpString2="Windows") returned -1 [0041.759] lstrcmpW (lpString1="INDUST", lpString2=".") returned 1 [0041.759] lstrcmpW (lpString1="INDUST", lpString2="..") returned 1 [0041.759] lstrcmpW (lpString1="INDUST", lpString2="AppData") returned 1 [0041.759] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST", lpSrch="AppData") returned 0x0 [0041.759] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST", lpString2="C:\\Windows") returned -1 [0041.759] lstrlenW (lpString="C:\\Windows") returned 10 [0041.760] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST", lpString2="C:\\System Volume Information") returned -1 [0041.760] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.760] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.884] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.884] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.884] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.885] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.885] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.885] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.885] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.885] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.885] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.885] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.885] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.885] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.885] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0041.885] lstrcmpiW (lpString1="INDUST.ELM", lpString2="Windows") returned -1 [0041.885] lstrcmpW (lpString1="INDUST.ELM", lpString2="32.EXE.exe") returned 1 [0041.885] StrStrW (lpFirst="INDUST.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.885] lstrcmpW (lpString1="INDUST.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.885] GetCurrentThreadId () returned 0x9b0 [0041.885] RtlWakeConditionVariable () returned 0x27e800 [0041.885] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0041.885] lstrcmpiW (lpString1="INDUST.INF", lpString2="Windows") returned -1 [0041.885] lstrcmpW (lpString1="INDUST.INF", lpString2="32.EXE.exe") returned 1 [0041.885] StrStrW (lpFirst="INDUST.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.885] lstrcmpW (lpString1="INDUST.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.886] GetCurrentThreadId () returned 0x9b0 [0041.886] RtlWakeConditionVariable () returned 0x27e800 [0041.886] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.886] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.886] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.886] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.886] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.886] GetCurrentThreadId () returned 0x9b0 [0041.886] RtlWakeConditionVariable () returned 0x27e800 [0041.886] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.886] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.886] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.886] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.886] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.886] GetCurrentThreadId () returned 0x9b0 [0041.886] RtlWakeConditionVariable () returned 0x27e800 [0041.886] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.886] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.887] GetCurrentThreadId () returned 0x9b0 [0041.887] RtlWakeConditionVariable () returned 0x27e800 [0041.887] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0041.887] lstrcmpiW (lpString1="IRIS", lpString2="Windows") returned -1 [0041.887] lstrcmpW (lpString1="IRIS", lpString2=".") returned 1 [0041.887] lstrcmpW (lpString1="IRIS", lpString2="..") returned 1 [0041.887] lstrcmpW (lpString1="IRIS", lpString2="AppData") returned 1 [0041.887] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS", lpSrch="AppData") returned 0x0 [0041.887] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS", lpString2="C:\\Windows") returned -1 [0041.887] lstrlenW (lpString="C:\\Windows") returned 10 [0041.887] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS", lpString2="C:\\System Volume Information") returned -1 [0041.887] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.887] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.888] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.888] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.888] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.888] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.888] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.888] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.888] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.888] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.888] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.888] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.888] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.888] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0041.888] lstrcmpiW (lpString1="IRIS.ELM", lpString2="Windows") returned -1 [0041.888] lstrcmpW (lpString1="IRIS.ELM", lpString2="32.EXE.exe") returned 1 [0041.888] StrStrW (lpFirst="IRIS.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.888] lstrcmpW (lpString1="IRIS.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.888] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.888] GetCurrentThreadId () returned 0x9b0 [0041.888] RtlWakeConditionVariable () returned 0x27e800 [0041.888] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0041.888] lstrcmpiW (lpString1="IRIS.INF", lpString2="Windows") returned -1 [0041.888] lstrcmpW (lpString1="IRIS.INF", lpString2="32.EXE.exe") returned 1 [0041.888] StrStrW (lpFirst="IRIS.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.888] lstrcmpW (lpString1="IRIS.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.889] GetCurrentThreadId () returned 0x9b0 [0041.889] RtlWakeConditionVariable () returned 0x27e800 [0041.889] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.889] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.889] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.889] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.889] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.889] GetCurrentThreadId () returned 0x9b0 [0041.889] RtlWakeConditionVariable () returned 0x27e800 [0041.889] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.889] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.889] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.889] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.889] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0041.889] GetCurrentThreadId () returned 0x9b0 [0041.889] RtlWakeConditionVariable () returned 0x27e800 [0041.889] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.889] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.890] GetCurrentThreadId () returned 0x9b0 [0041.890] RtlWakeConditionVariable () returned 0x27e800 [0041.890] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0041.890] lstrcmpiW (lpString1="JOURNAL", lpString2="Windows") returned -1 [0041.890] lstrcmpW (lpString1="JOURNAL", lpString2=".") returned 1 [0041.890] lstrcmpW (lpString1="JOURNAL", lpString2="..") returned 1 [0041.890] lstrcmpW (lpString1="JOURNAL", lpString2="AppData") returned 1 [0041.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL", lpSrch="AppData") returned 0x0 [0041.890] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL", lpString2="C:\\Windows") returned -1 [0041.890] lstrlenW (lpString="C:\\Windows") returned 10 [0041.890] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL", lpString2="C:\\System Volume Information") returned -1 [0041.890] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.933] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.933] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.933] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.933] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.933] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.933] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.934] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.934] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.934] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.934] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.934] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0041.934] lstrcmpiW (lpString1="JOURNAL.ELM", lpString2="Windows") returned -1 [0041.934] lstrcmpW (lpString1="JOURNAL.ELM", lpString2="32.EXE.exe") returned 1 [0041.934] StrStrW (lpFirst="JOURNAL.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.934] lstrcmpW (lpString1="JOURNAL.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.934] GetCurrentThreadId () returned 0x9b0 [0041.934] RtlWakeConditionVariable () returned 0x27e800 [0041.934] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0041.934] lstrcmpiW (lpString1="JOURNAL.INF", lpString2="Windows") returned -1 [0041.934] lstrcmpW (lpString1="JOURNAL.INF", lpString2="32.EXE.exe") returned 1 [0041.934] StrStrW (lpFirst="JOURNAL.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.934] lstrcmpW (lpString1="JOURNAL.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.934] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.934] GetCurrentThreadId () returned 0x9b0 [0041.934] RtlWakeConditionVariable () returned 0x27e800 [0041.934] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.935] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.935] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.935] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.935] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.935] GetCurrentThreadId () returned 0x9b0 [0041.935] RtlWakeConditionVariable () returned 0x27e800 [0041.935] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.935] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.935] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.935] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.935] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.935] GetCurrentThreadId () returned 0x9b0 [0041.935] RtlWakeConditionVariable () returned 0x27e800 [0041.935] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.935] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.935] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.935] GetCurrentThreadId () returned 0x9b0 [0041.935] RtlWakeConditionVariable () returned 0x27e800 [0041.937] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0041.937] lstrcmpiW (lpString1="LAYERS", lpString2="Windows") returned -1 [0041.937] lstrcmpW (lpString1="LAYERS", lpString2=".") returned 1 [0041.937] lstrcmpW (lpString1="LAYERS", lpString2="..") returned 1 [0041.937] lstrcmpW (lpString1="LAYERS", lpString2="AppData") returned 1 [0041.937] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS", lpSrch="AppData") returned 0x0 [0041.937] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS", lpString2="C:\\Windows") returned -1 [0041.937] lstrlenW (lpString="C:\\Windows") returned 10 [0041.937] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS", lpString2="C:\\System Volume Information") returned -1 [0041.937] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.937] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.942] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.942] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.942] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.942] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.942] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.942] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.943] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.943] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.943] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.943] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.943] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.943] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.943] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0041.943] lstrcmpiW (lpString1="LAYERS.ELM", lpString2="Windows") returned -1 [0041.943] lstrcmpW (lpString1="LAYERS.ELM", lpString2="32.EXE.exe") returned 1 [0041.943] StrStrW (lpFirst="LAYERS.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.943] lstrcmpW (lpString1="LAYERS.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.943] GetCurrentThreadId () returned 0x9b0 [0041.943] RtlWakeConditionVariable () returned 0x27e800 [0041.943] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0041.943] lstrcmpiW (lpString1="LAYERS.INF", lpString2="Windows") returned -1 [0041.943] lstrcmpW (lpString1="LAYERS.INF", lpString2="32.EXE.exe") returned 1 [0041.943] StrStrW (lpFirst="LAYERS.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.943] lstrcmpW (lpString1="LAYERS.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.943] GetCurrentThreadId () returned 0x9b0 [0041.943] RtlWakeConditionVariable () returned 0x27e800 [0041.944] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.944] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.944] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.944] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.944] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.944] GetCurrentThreadId () returned 0x9b0 [0041.944] RtlWakeConditionVariable () returned 0x27e800 [0041.944] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.944] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.944] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.944] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.944] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.944] GetCurrentThreadId () returned 0x9b0 [0041.944] RtlWakeConditionVariable () returned 0x27e800 [0041.944] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.944] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.944] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.945] GetCurrentThreadId () returned 0x9b0 [0041.945] RtlWakeConditionVariable () returned 0x27e800 [0041.945] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0041.945] lstrcmpiW (lpString1="LEVEL", lpString2="Windows") returned -1 [0041.945] lstrcmpW (lpString1="LEVEL", lpString2=".") returned 1 [0041.945] lstrcmpW (lpString1="LEVEL", lpString2="..") returned 1 [0041.945] lstrcmpW (lpString1="LEVEL", lpString2="AppData") returned 1 [0041.945] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL", lpSrch="AppData") returned 0x0 [0041.945] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL", lpString2="C:\\Windows") returned -1 [0041.945] lstrlenW (lpString="C:\\Windows") returned 10 [0041.945] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL", lpString2="C:\\System Volume Information") returned -1 [0041.945] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.947] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.947] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.947] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.947] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.947] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.947] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.947] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.947] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.947] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.947] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.947] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.947] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.947] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0041.947] lstrcmpiW (lpString1="LEVEL.ELM", lpString2="Windows") returned -1 [0041.948] lstrcmpW (lpString1="LEVEL.ELM", lpString2="32.EXE.exe") returned 1 [0041.948] StrStrW (lpFirst="LEVEL.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.948] lstrcmpW (lpString1="LEVEL.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.948] GetCurrentThreadId () returned 0x9b0 [0041.948] RtlWakeConditionVariable () returned 0x27e800 [0041.948] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0041.948] lstrcmpiW (lpString1="LEVEL.INF", lpString2="Windows") returned -1 [0041.948] lstrcmpW (lpString1="LEVEL.INF", lpString2="32.EXE.exe") returned 1 [0041.948] StrStrW (lpFirst="LEVEL.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.948] lstrcmpW (lpString1="LEVEL.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0041.948] GetCurrentThreadId () returned 0x9b0 [0041.948] RtlWakeConditionVariable () returned 0x27e800 [0041.948] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.948] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.948] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.948] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.948] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.948] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.990] GetCurrentThreadId () returned 0x9b0 [0041.990] RtlWakeConditionVariable () returned 0x27e800 [0041.990] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.990] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.990] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.990] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.990] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.990] GetCurrentThreadId () returned 0x9b0 [0041.990] RtlWakeConditionVariable () returned 0x27e800 [0041.990] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.990] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.990] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.990] GetCurrentThreadId () returned 0x9b0 [0041.990] RtlWakeConditionVariable () returned 0x27e800 [0041.990] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0041.991] lstrcmpiW (lpString1="NETWORK", lpString2="Windows") returned -1 [0041.991] lstrcmpW (lpString1="NETWORK", lpString2=".") returned 1 [0041.991] lstrcmpW (lpString1="NETWORK", lpString2="..") returned 1 [0041.991] lstrcmpW (lpString1="NETWORK", lpString2="AppData") returned 1 [0041.991] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK", lpSrch="AppData") returned 0x0 [0041.991] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK", lpString2="C:\\Windows") returned -1 [0041.991] lstrlenW (lpString="C:\\Windows") returned 10 [0041.991] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK", lpString2="C:\\System Volume Information") returned -1 [0041.991] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.991] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.991] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.991] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.991] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.991] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.991] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.991] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.991] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.991] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.991] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.991] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.991] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.992] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0041.992] lstrcmpiW (lpString1="NETWORK.ELM", lpString2="Windows") returned -1 [0041.992] lstrcmpW (lpString1="NETWORK.ELM", lpString2="32.EXE.exe") returned 1 [0041.992] StrStrW (lpFirst="NETWORK.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.992] lstrcmpW (lpString1="NETWORK.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.992] GetCurrentThreadId () returned 0x9b0 [0041.992] RtlWakeConditionVariable () returned 0x27e800 [0041.992] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0041.992] lstrcmpiW (lpString1="NETWORK.INF", lpString2="Windows") returned -1 [0041.992] lstrcmpW (lpString1="NETWORK.INF", lpString2="32.EXE.exe") returned 1 [0041.992] StrStrW (lpFirst="NETWORK.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.992] lstrcmpW (lpString1="NETWORK.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.992] GetCurrentThreadId () returned 0x9b0 [0041.992] RtlWakeConditionVariable () returned 0x27e800 [0041.992] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.992] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.992] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.992] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.992] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.992] GetCurrentThreadId () returned 0x9b0 [0041.992] RtlWakeConditionVariable () returned 0x27e800 [0041.992] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.992] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.992] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.992] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.993] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.993] GetCurrentThreadId () returned 0x9b0 [0041.993] RtlWakeConditionVariable () returned 0x27e800 [0041.993] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.993] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.993] GetCurrentThreadId () returned 0x9b0 [0041.993] RtlWakeConditionVariable () returned 0x27e800 [0041.993] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0041.993] lstrcmpiW (lpString1="PAPYRUS", lpString2="Windows") returned -1 [0041.993] lstrcmpW (lpString1="PAPYRUS", lpString2=".") returned 1 [0041.993] lstrcmpW (lpString1="PAPYRUS", lpString2="..") returned 1 [0041.993] lstrcmpW (lpString1="PAPYRUS", lpString2="AppData") returned 1 [0041.993] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS", lpSrch="AppData") returned 0x0 [0041.993] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS", lpString2="C:\\Windows") returned -1 [0041.993] lstrlenW (lpString="C:\\Windows") returned 10 [0041.993] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS", lpString2="C:\\System Volume Information") returned -1 [0041.993] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0041.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0041.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0041.997] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0041.997] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0041.997] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0041.997] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.997] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.998] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.998] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0041.998] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0041.998] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0041.998] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0041.998] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.998] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.998] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0041.998] lstrcmpiW (lpString1="PAPYRUS.ELM", lpString2="Windows") returned -1 [0041.998] lstrcmpW (lpString1="PAPYRUS.ELM", lpString2="32.EXE.exe") returned 1 [0041.998] StrStrW (lpFirst="PAPYRUS.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.998] lstrcmpW (lpString1="PAPYRUS.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.998] GetCurrentThreadId () returned 0x9b0 [0041.998] RtlWakeConditionVariable () returned 0x27e800 [0041.998] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0041.998] lstrcmpiW (lpString1="PAPYRUS.INF", lpString2="Windows") returned -1 [0041.998] lstrcmpW (lpString1="PAPYRUS.INF", lpString2="32.EXE.exe") returned 1 [0041.998] StrStrW (lpFirst="PAPYRUS.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.998] lstrcmpW (lpString1="PAPYRUS.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.998] GetCurrentThreadId () returned 0x9b0 [0041.998] RtlWakeConditionVariable () returned 0x27e800 [0041.998] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0041.998] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0041.998] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0041.998] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.999] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0041.999] GetCurrentThreadId () returned 0x9b0 [0041.999] RtlWakeConditionVariable () returned 0x27e800 [0041.999] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0041.999] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0041.999] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0041.999] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0041.999] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0041.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0041.999] GetCurrentThreadId () returned 0x9b0 [0041.999] RtlWakeConditionVariable () returned 0x27e800 [0041.999] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0041.999] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0041.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0041.999] GetCurrentThreadId () returned 0x9b0 [0041.999] RtlWakeConditionVariable () returned 0x27e800 [0041.999] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0041.999] lstrcmpiW (lpString1="PIXEL", lpString2="Windows") returned -1 [0041.999] lstrcmpW (lpString1="PIXEL", lpString2=".") returned 1 [0041.999] lstrcmpW (lpString1="PIXEL", lpString2="..") returned 1 [0041.999] lstrcmpW (lpString1="PIXEL", lpString2="AppData") returned 1 [0041.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL", lpSrch="AppData") returned 0x0 [0041.999] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL", lpString2="C:\\Windows") returned -1 [0041.999] lstrlenW (lpString="C:\\Windows") returned 10 [0041.999] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL", lpString2="C:\\System Volume Information") returned -1 [0042.000] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.000] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.000] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.000] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.000] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.000] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.000] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.000] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.000] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.000] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.000] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0042.000] lstrcmpiW (lpString1="PIXEL.ELM", lpString2="Windows") returned -1 [0042.000] lstrcmpW (lpString1="PIXEL.ELM", lpString2="32.EXE.exe") returned 1 [0042.000] StrStrW (lpFirst="PIXEL.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.000] lstrcmpW (lpString1="PIXEL.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.000] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.000] GetCurrentThreadId () returned 0x9b0 [0042.001] RtlWakeConditionVariable () returned 0x27e800 [0042.001] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0042.001] lstrcmpiW (lpString1="PIXEL.INF", lpString2="Windows") returned -1 [0042.001] lstrcmpW (lpString1="PIXEL.INF", lpString2="32.EXE.exe") returned 1 [0042.001] StrStrW (lpFirst="PIXEL.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.001] lstrcmpW (lpString1="PIXEL.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.001] GetCurrentThreadId () returned 0x9b0 [0042.001] RtlWakeConditionVariable () returned 0x27e800 [0042.001] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.001] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.001] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.001] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.001] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.001] GetCurrentThreadId () returned 0x9b0 [0042.001] RtlWakeConditionVariable () returned 0x27e800 [0042.001] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.001] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.001] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.001] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.001] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.001] GetCurrentThreadId () returned 0x9b0 [0042.001] RtlWakeConditionVariable () returned 0x27e800 [0042.001] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.001] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.002] GetCurrentThreadId () returned 0x9b0 [0042.002] RtlWakeConditionVariable () returned 0x27e800 [0042.002] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0042.002] lstrcmpiW (lpString1="PROFILE", lpString2="Windows") returned -1 [0042.002] lstrcmpW (lpString1="PROFILE", lpString2=".") returned 1 [0042.002] lstrcmpW (lpString1="PROFILE", lpString2="..") returned 1 [0042.002] lstrcmpW (lpString1="PROFILE", lpString2="AppData") returned 1 [0042.002] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE", lpSrch="AppData") returned 0x0 [0042.002] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE", lpString2="C:\\Windows") returned -1 [0042.002] lstrlenW (lpString="C:\\Windows") returned 10 [0042.002] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE", lpString2="C:\\System Volume Information") returned -1 [0042.002] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.030] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.030] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.030] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.031] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.031] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.031] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.031] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.031] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.031] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.031] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.031] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.031] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.031] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.031] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.031] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.031] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.031] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.031] GetCurrentThreadId () returned 0x9b0 [0042.031] RtlWakeConditionVariable () returned 0x27e800 [0042.031] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0042.031] lstrcmpiW (lpString1="PROFILE.ELM", lpString2="Windows") returned -1 [0042.031] lstrcmpW (lpString1="PROFILE.ELM", lpString2="32.EXE.exe") returned 1 [0042.031] StrStrW (lpFirst="PROFILE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.031] lstrcmpW (lpString1="PROFILE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.031] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.031] GetCurrentThreadId () returned 0x9b0 [0042.031] RtlWakeConditionVariable () returned 0x27e800 [0042.031] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0042.031] lstrcmpiW (lpString1="PROFILE.INF", lpString2="Windows") returned -1 [0042.032] lstrcmpW (lpString1="PROFILE.INF", lpString2="32.EXE.exe") returned 1 [0042.032] StrStrW (lpFirst="PROFILE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.032] lstrcmpW (lpString1="PROFILE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.032] GetCurrentThreadId () returned 0x9b0 [0042.032] RtlWakeConditionVariable () returned 0x27e800 [0042.032] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.032] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.032] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.032] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.032] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.032] GetCurrentThreadId () returned 0x9b0 [0042.032] RtlWakeConditionVariable () returned 0x27e800 [0042.032] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.032] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.032] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.032] GetCurrentThreadId () returned 0x9b0 [0042.032] RtlWakeConditionVariable () returned 0x27e800 [0042.033] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0042.033] lstrcmpiW (lpString1="QUAD", lpString2="Windows") returned -1 [0042.033] lstrcmpW (lpString1="QUAD", lpString2=".") returned 1 [0042.033] lstrcmpW (lpString1="QUAD", lpString2="..") returned 1 [0042.033] lstrcmpW (lpString1="QUAD", lpString2="AppData") returned 1 [0042.033] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD", lpSrch="AppData") returned 0x0 [0042.033] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD", lpString2="C:\\Windows") returned -1 [0042.033] lstrlenW (lpString="C:\\Windows") returned 10 [0042.033] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD", lpString2="C:\\System Volume Information") returned -1 [0042.033] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.033] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.123] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.123] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.123] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.123] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.123] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.123] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.134] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.143] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.143] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.143] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.143] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.143] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.143] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.143] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.143] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.143] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.143] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.143] GetCurrentThreadId () returned 0x9b0 [0042.143] RtlWakeConditionVariable () returned 0x27e800 [0042.143] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0042.143] lstrcmpiW (lpString1="QUAD.ELM", lpString2="Windows") returned -1 [0042.143] lstrcmpW (lpString1="QUAD.ELM", lpString2="32.EXE.exe") returned 1 [0042.143] StrStrW (lpFirst="QUAD.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.143] lstrcmpW (lpString1="QUAD.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.143] GetCurrentThreadId () returned 0x9b0 [0042.143] RtlWakeConditionVariable () returned 0x27e800 [0042.143] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0042.143] lstrcmpiW (lpString1="QUAD.INF", lpString2="Windows") returned -1 [0042.143] lstrcmpW (lpString1="QUAD.INF", lpString2="32.EXE.exe") returned 1 [0042.143] StrStrW (lpFirst="QUAD.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.143] lstrcmpW (lpString1="QUAD.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.143] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.143] GetCurrentThreadId () returned 0x9b0 [0042.144] RtlWakeConditionVariable () returned 0x27e800 [0042.144] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.144] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.144] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.144] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.144] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30ef48 [0042.144] GetCurrentThreadId () returned 0x9b0 [0042.144] RtlWakeConditionVariable () returned 0x27e800 [0042.144] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.144] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.144] GetCurrentThreadId () returned 0x9b0 [0042.144] RtlWakeConditionVariable () returned 0x27e800 [0042.144] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0042.144] lstrcmpiW (lpString1="RADIAL", lpString2="Windows") returned -1 [0042.144] lstrcmpW (lpString1="RADIAL", lpString2=".") returned 1 [0042.144] lstrcmpW (lpString1="RADIAL", lpString2="..") returned 1 [0042.144] lstrcmpW (lpString1="RADIAL", lpString2="AppData") returned 1 [0042.144] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL", lpSrch="AppData") returned 0x0 [0042.144] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL", lpString2="C:\\Windows") returned -1 [0042.144] lstrlenW (lpString="C:\\Windows") returned 10 [0042.144] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL", lpString2="C:\\System Volume Information") returned -1 [0042.144] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.144] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e88 [0042.189] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.189] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.189] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.189] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.189] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.189] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.189] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.190] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.190] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.190] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.190] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.190] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.190] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.190] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.190] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.190] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.190] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.190] GetCurrentThreadId () returned 0x9b0 [0042.190] RtlWakeConditionVariable () returned 0x27e800 [0042.190] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0042.190] lstrcmpiW (lpString1="RADIAL.ELM", lpString2="Windows") returned -1 [0042.190] lstrcmpW (lpString1="RADIAL.ELM", lpString2="32.EXE.exe") returned 1 [0042.190] StrStrW (lpFirst="RADIAL.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.190] lstrcmpW (lpString1="RADIAL.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.190] GetCurrentThreadId () returned 0x9b0 [0042.190] RtlWakeConditionVariable () returned 0x27e800 [0042.190] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0042.190] lstrcmpiW (lpString1="RADIAL.INF", lpString2="Windows") returned -1 [0042.190] lstrcmpW (lpString1="RADIAL.INF", lpString2="32.EXE.exe") returned 1 [0042.190] StrStrW (lpFirst="RADIAL.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.190] lstrcmpW (lpString1="RADIAL.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.190] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.190] GetCurrentThreadId () returned 0x9b0 [0042.190] RtlWakeConditionVariable () returned 0x27e800 [0042.191] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.191] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.191] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.191] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.191] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.191] GetCurrentThreadId () returned 0x9b0 [0042.191] RtlWakeConditionVariable () returned 0x27e800 [0042.191] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.191] FindClose (in: hFindFile=0x2b2e88 | out: hFindFile=0x2b2e88) returned 1 [0042.191] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.191] GetCurrentThreadId () returned 0x9b0 [0042.191] RtlWakeConditionVariable () returned 0x27e800 [0042.192] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0042.192] lstrcmpiW (lpString1="REFINED", lpString2="Windows") returned -1 [0042.192] lstrcmpW (lpString1="REFINED", lpString2=".") returned 1 [0042.192] lstrcmpW (lpString1="REFINED", lpString2="..") returned 1 [0042.192] lstrcmpW (lpString1="REFINED", lpString2="AppData") returned 1 [0042.192] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED", lpSrch="AppData") returned 0x0 [0042.192] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED", lpString2="C:\\Windows") returned -1 [0042.192] lstrlenW (lpString="C:\\Windows") returned 10 [0042.192] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED", lpString2="C:\\System Volume Information") returned -1 [0042.192] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.192] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e88 [0042.193] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.193] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.193] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.193] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.193] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.193] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.193] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.193] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.193] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.193] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.193] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.193] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.193] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.193] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.193] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.193] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.193] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.193] GetCurrentThreadId () returned 0x9b0 [0042.193] RtlWakeConditionVariable () returned 0x27e800 [0042.193] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0042.193] lstrcmpiW (lpString1="REFINED.ELM", lpString2="Windows") returned -1 [0042.193] lstrcmpW (lpString1="REFINED.ELM", lpString2="32.EXE.exe") returned 1 [0042.193] StrStrW (lpFirst="REFINED.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.193] lstrcmpW (lpString1="REFINED.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.193] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.193] GetCurrentThreadId () returned 0x9b0 [0042.194] RtlWakeConditionVariable () returned 0x27e800 [0042.194] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0042.194] lstrcmpiW (lpString1="REFINED.INF", lpString2="Windows") returned -1 [0042.194] lstrcmpW (lpString1="REFINED.INF", lpString2="32.EXE.exe") returned 1 [0042.194] StrStrW (lpFirst="REFINED.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.194] lstrcmpW (lpString1="REFINED.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.194] GetCurrentThreadId () returned 0x9b0 [0042.194] RtlWakeConditionVariable () returned 0x27e800 [0042.194] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.194] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.194] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.194] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.194] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.194] GetCurrentThreadId () returned 0x9b0 [0042.194] RtlWakeConditionVariable () returned 0x27e800 [0042.194] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.194] FindClose (in: hFindFile=0x2b2e88 | out: hFindFile=0x2b2e88) returned 1 [0042.194] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.194] GetCurrentThreadId () returned 0x9b0 [0042.194] RtlWakeConditionVariable () returned 0x27e800 [0042.194] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0042.194] lstrcmpiW (lpString1="RICEPAPR", lpString2="Windows") returned -1 [0042.194] lstrcmpW (lpString1="RICEPAPR", lpString2=".") returned 1 [0042.194] lstrcmpW (lpString1="RICEPAPR", lpString2="..") returned 1 [0042.194] lstrcmpW (lpString1="RICEPAPR", lpString2="AppData") returned 1 [0042.195] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR", lpSrch="AppData") returned 0x0 [0042.195] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR", lpString2="C:\\Windows") returned -1 [0042.195] lstrlenW (lpString="C:\\Windows") returned 10 [0042.195] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR", lpString2="C:\\System Volume Information") returned -1 [0042.195] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.195] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e88 [0042.196] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.196] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.196] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.196] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.196] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.196] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.196] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.196] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.196] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.196] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.196] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.196] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.196] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.196] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.196] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.196] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.196] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.197] GetCurrentThreadId () returned 0x9b0 [0042.197] RtlWakeConditionVariable () returned 0x27e800 [0042.197] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0042.197] lstrcmpiW (lpString1="RICEPAPR.ELM", lpString2="Windows") returned -1 [0042.197] lstrcmpW (lpString1="RICEPAPR.ELM", lpString2="32.EXE.exe") returned 1 [0042.197] StrStrW (lpFirst="RICEPAPR.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.197] lstrcmpW (lpString1="RICEPAPR.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.197] GetCurrentThreadId () returned 0x9b0 [0042.197] RtlWakeConditionVariable () returned 0x27e800 [0042.197] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0042.197] lstrcmpiW (lpString1="RICEPAPR.INF", lpString2="Windows") returned -1 [0042.197] lstrcmpW (lpString1="RICEPAPR.INF", lpString2="32.EXE.exe") returned 1 [0042.197] StrStrW (lpFirst="RICEPAPR.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.197] lstrcmpW (lpString1="RICEPAPR.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.197] GetCurrentThreadId () returned 0x9b0 [0042.197] RtlWakeConditionVariable () returned 0x27e800 [0042.197] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.197] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.197] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.197] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.197] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.197] GetCurrentThreadId () returned 0x9b0 [0042.197] RtlWakeConditionVariable () returned 0x27e800 [0042.197] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.198] FindClose (in: hFindFile=0x2b2e88 | out: hFindFile=0x2b2e88) returned 1 [0042.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.198] GetCurrentThreadId () returned 0x9b0 [0042.198] RtlWakeConditionVariable () returned 0x27e800 [0042.198] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0042.198] lstrcmpiW (lpString1="RIPPLE", lpString2="Windows") returned -1 [0042.198] lstrcmpW (lpString1="RIPPLE", lpString2=".") returned 1 [0042.198] lstrcmpW (lpString1="RIPPLE", lpString2="..") returned 1 [0042.198] lstrcmpW (lpString1="RIPPLE", lpString2="AppData") returned 1 [0042.198] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE", lpSrch="AppData") returned 0x0 [0042.198] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE", lpString2="C:\\Windows") returned -1 [0042.198] lstrlenW (lpString="C:\\Windows") returned 10 [0042.198] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE", lpString2="C:\\System Volume Information") returned -1 [0042.198] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.198] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e88 [0042.198] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.198] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.198] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.198] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.198] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.198] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.199] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.199] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.199] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.199] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.199] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.199] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.199] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.199] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.199] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.199] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.199] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.199] GetCurrentThreadId () returned 0x9b0 [0042.199] RtlWakeConditionVariable () returned 0x27e800 [0042.199] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0042.199] lstrcmpiW (lpString1="RIPPLE.ELM", lpString2="Windows") returned -1 [0042.199] lstrcmpW (lpString1="RIPPLE.ELM", lpString2="32.EXE.exe") returned 1 [0042.199] StrStrW (lpFirst="RIPPLE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.199] lstrcmpW (lpString1="RIPPLE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.199] GetCurrentThreadId () returned 0x9b0 [0042.199] RtlWakeConditionVariable () returned 0x27e800 [0042.199] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0042.199] lstrcmpiW (lpString1="RIPPLE.INF", lpString2="Windows") returned -1 [0042.199] lstrcmpW (lpString1="RIPPLE.INF", lpString2="32.EXE.exe") returned 1 [0042.199] StrStrW (lpFirst="RIPPLE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.199] lstrcmpW (lpString1="RIPPLE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.199] GetCurrentThreadId () returned 0x9b0 [0042.200] RtlWakeConditionVariable () returned 0x27e800 [0042.200] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.200] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.200] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.200] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.200] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.200] GetCurrentThreadId () returned 0x9b0 [0042.200] RtlWakeConditionVariable () returned 0x27e800 [0042.200] FindNextFileW (in: hFindFile=0x2b2e88, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.200] FindClose (in: hFindFile=0x2b2e88 | out: hFindFile=0x2b2e88) returned 1 [0042.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.200] GetCurrentThreadId () returned 0x9b0 [0042.200] RtlWakeConditionVariable () returned 0x27e800 [0042.200] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0042.200] lstrcmpiW (lpString1="RMNSQUE", lpString2="Windows") returned -1 [0042.200] lstrcmpW (lpString1="RMNSQUE", lpString2=".") returned 1 [0042.200] lstrcmpW (lpString1="RMNSQUE", lpString2="..") returned 1 [0042.200] lstrcmpW (lpString1="RMNSQUE", lpString2="AppData") returned 1 [0042.200] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE", lpSrch="AppData") returned 0x0 [0042.200] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE", lpString2="C:\\Windows") returned -1 [0042.200] lstrlenW (lpString="C:\\Windows") returned 10 [0042.200] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE", lpString2="C:\\System Volume Information") returned -1 [0042.201] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.293] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.300] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.300] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.300] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.300] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.301] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.301] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.301] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.301] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.301] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.301] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.301] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.301] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.301] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.301] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.301] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.301] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.301] GetCurrentThreadId () returned 0x9b0 [0042.301] RtlWakeConditionVariable () returned 0x27e800 [0042.301] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0042.301] lstrcmpiW (lpString1="RMNSQUE.ELM", lpString2="Windows") returned -1 [0042.301] lstrcmpW (lpString1="RMNSQUE.ELM", lpString2="32.EXE.exe") returned 1 [0042.301] StrStrW (lpFirst="RMNSQUE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.301] lstrcmpW (lpString1="RMNSQUE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.301] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.301] GetCurrentThreadId () returned 0x9b0 [0042.301] RtlWakeConditionVariable () returned 0x27e800 [0042.301] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0042.301] lstrcmpiW (lpString1="RMNSQUE.INF", lpString2="Windows") returned -1 [0042.301] lstrcmpW (lpString1="RMNSQUE.INF", lpString2="32.EXE.exe") returned 1 [0042.302] StrStrW (lpFirst="RMNSQUE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.302] lstrcmpW (lpString1="RMNSQUE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.302] GetCurrentThreadId () returned 0x9b0 [0042.302] RtlWakeConditionVariable () returned 0x27e800 [0042.302] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.302] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.302] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.302] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.302] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.302] GetCurrentThreadId () returned 0x9b0 [0042.302] RtlWakeConditionVariable () returned 0x27e800 [0042.302] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.302] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.302] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.302] GetCurrentThreadId () returned 0x9b0 [0042.302] RtlWakeConditionVariable () returned 0x27e800 [0042.302] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0042.302] lstrcmpiW (lpString1="SATIN", lpString2="Windows") returned -1 [0042.302] lstrcmpW (lpString1="SATIN", lpString2=".") returned 1 [0042.302] lstrcmpW (lpString1="SATIN", lpString2="..") returned 1 [0042.302] lstrcmpW (lpString1="SATIN", lpString2="AppData") returned 1 [0042.302] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN", lpSrch="AppData") returned 0x0 [0042.302] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN", lpString2="C:\\Windows") returned -1 [0042.302] lstrlenW (lpString="C:\\Windows") returned 10 [0042.302] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN", lpString2="C:\\System Volume Information") returned -1 [0042.303] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.303] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.303] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.303] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.303] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.303] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.303] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.303] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.303] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.303] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.303] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.303] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.303] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.303] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.303] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.303] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.303] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.303] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.303] GetCurrentThreadId () returned 0x9b0 [0042.303] RtlWakeConditionVariable () returned 0x27e800 [0042.303] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0042.304] lstrcmpiW (lpString1="SATIN.ELM", lpString2="Windows") returned -1 [0042.304] lstrcmpW (lpString1="SATIN.ELM", lpString2="32.EXE.exe") returned 1 [0042.304] StrStrW (lpFirst="SATIN.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.304] lstrcmpW (lpString1="SATIN.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.304] GetCurrentThreadId () returned 0x9b0 [0042.304] RtlWakeConditionVariable () returned 0x27e800 [0042.304] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0042.304] lstrcmpiW (lpString1="SATIN.INF", lpString2="Windows") returned -1 [0042.304] lstrcmpW (lpString1="SATIN.INF", lpString2="32.EXE.exe") returned 1 [0042.304] StrStrW (lpFirst="SATIN.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.304] lstrcmpW (lpString1="SATIN.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.304] GetCurrentThreadId () returned 0x9b0 [0042.304] RtlWakeConditionVariable () returned 0x27e800 [0042.304] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.304] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.304] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.304] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.304] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.304] GetCurrentThreadId () returned 0x9b0 [0042.304] RtlWakeConditionVariable () returned 0x27e800 [0042.304] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.304] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.304] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.304] GetCurrentThreadId () returned 0x9b0 [0042.305] RtlWakeConditionVariable () returned 0x27e800 [0042.305] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0042.305] lstrcmpiW (lpString1="SKY", lpString2="Windows") returned -1 [0042.305] lstrcmpW (lpString1="SKY", lpString2=".") returned 1 [0042.305] lstrcmpW (lpString1="SKY", lpString2="..") returned 1 [0042.305] lstrcmpW (lpString1="SKY", lpString2="AppData") returned 1 [0042.305] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY", lpSrch="AppData") returned 0x0 [0042.305] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY", lpString2="C:\\Windows") returned -1 [0042.305] lstrlenW (lpString="C:\\Windows") returned 10 [0042.305] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY", lpString2="C:\\System Volume Information") returned -1 [0042.305] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.305] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.353] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.353] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.354] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.354] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.354] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.354] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.354] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.354] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.354] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.354] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.354] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.354] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.354] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.354] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.354] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.354] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.354] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.354] GetCurrentThreadId () returned 0x9b0 [0042.354] RtlWakeConditionVariable () returned 0x27e800 [0042.354] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0042.354] lstrcmpiW (lpString1="SKY.ELM", lpString2="Windows") returned -1 [0042.354] lstrcmpW (lpString1="SKY.ELM", lpString2="32.EXE.exe") returned 1 [0042.354] StrStrW (lpFirst="SKY.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.354] lstrcmpW (lpString1="SKY.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.354] GetCurrentThreadId () returned 0x9b0 [0042.354] RtlWakeConditionVariable () returned 0x27e800 [0042.355] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0042.355] lstrcmpiW (lpString1="SKY.INF", lpString2="Windows") returned -1 [0042.355] lstrcmpW (lpString1="SKY.INF", lpString2="32.EXE.exe") returned 1 [0042.355] StrStrW (lpFirst="SKY.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.355] lstrcmpW (lpString1="SKY.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.355] GetCurrentThreadId () returned 0x9b0 [0042.355] RtlWakeConditionVariable () returned 0x27e800 [0042.355] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.355] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.355] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.355] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.355] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.355] GetCurrentThreadId () returned 0x9b0 [0042.355] RtlWakeConditionVariable () returned 0x27e800 [0042.355] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.355] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f92b0 [0042.355] GetCurrentThreadId () returned 0x9b0 [0042.355] RtlWakeConditionVariable () returned 0x27e800 [0042.355] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0042.355] lstrcmpiW (lpString1="SLATE", lpString2="Windows") returned -1 [0042.355] lstrcmpW (lpString1="SLATE", lpString2=".") returned 1 [0042.355] lstrcmpW (lpString1="SLATE", lpString2="..") returned 1 [0042.356] lstrcmpW (lpString1="SLATE", lpString2="AppData") returned 1 [0042.356] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE", lpSrch="AppData") returned 0x0 [0042.356] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE", lpString2="C:\\Windows") returned -1 [0042.356] lstrlenW (lpString="C:\\Windows") returned 10 [0042.356] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE", lpString2="C:\\System Volume Information") returned -1 [0042.356] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.390] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.390] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.390] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.390] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.390] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.390] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.390] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.390] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.390] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.390] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.390] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.390] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.390] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.390] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.390] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.390] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.390] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.390] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.390] GetCurrentThreadId () returned 0x9b0 [0042.391] RtlWakeConditionVariable () returned 0x27e800 [0042.391] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0042.391] lstrcmpiW (lpString1="SLATE.ELM", lpString2="Windows") returned -1 [0042.391] lstrcmpW (lpString1="SLATE.ELM", lpString2="32.EXE.exe") returned 1 [0042.391] StrStrW (lpFirst="SLATE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.391] lstrcmpW (lpString1="SLATE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.391] GetCurrentThreadId () returned 0x9b0 [0042.391] RtlWakeConditionVariable () returned 0x27e800 [0042.391] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0042.391] lstrcmpiW (lpString1="SLATE.INF", lpString2="Windows") returned -1 [0042.391] lstrcmpW (lpString1="SLATE.INF", lpString2="32.EXE.exe") returned 1 [0042.391] StrStrW (lpFirst="SLATE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.391] lstrcmpW (lpString1="SLATE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.391] GetCurrentThreadId () returned 0x9b0 [0042.391] RtlWakeConditionVariable () returned 0x27e800 [0042.391] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.391] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.391] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.391] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.391] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.391] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.391] GetCurrentThreadId () returned 0x9b0 [0042.391] RtlWakeConditionVariable () returned 0x27e800 [0042.392] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.392] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.392] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9508 [0042.392] GetCurrentThreadId () returned 0x9b0 [0042.392] RtlWakeConditionVariable () returned 0x27e800 [0042.392] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0042.392] lstrcmpiW (lpString1="SONORA", lpString2="Windows") returned -1 [0042.392] lstrcmpW (lpString1="SONORA", lpString2=".") returned 1 [0042.392] lstrcmpW (lpString1="SONORA", lpString2="..") returned 1 [0042.392] lstrcmpW (lpString1="SONORA", lpString2="AppData") returned 1 [0042.393] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA", lpSrch="AppData") returned 0x0 [0042.393] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA", lpString2="C:\\Windows") returned -1 [0042.393] lstrlenW (lpString="C:\\Windows") returned 10 [0042.393] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA", lpString2="C:\\System Volume Information") returned -1 [0042.393] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.393] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.438] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.438] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.438] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.438] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.438] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.438] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.438] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.438] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.438] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.438] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.438] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.438] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.438] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.438] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.438] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.438] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.438] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.438] GetCurrentThreadId () returned 0x9b0 [0042.438] RtlWakeConditionVariable () returned 0x27e800 [0042.438] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0042.438] lstrcmpiW (lpString1="SONORA.ELM", lpString2="Windows") returned -1 [0042.438] lstrcmpW (lpString1="SONORA.ELM", lpString2="32.EXE.exe") returned 1 [0042.438] StrStrW (lpFirst="SONORA.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.438] lstrcmpW (lpString1="SONORA.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.438] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.438] GetCurrentThreadId () returned 0x9b0 [0042.439] RtlWakeConditionVariable () returned 0x27e800 [0042.439] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0042.439] lstrcmpiW (lpString1="SONORA.INF", lpString2="Windows") returned -1 [0042.439] lstrcmpW (lpString1="SONORA.INF", lpString2="32.EXE.exe") returned 1 [0042.439] StrStrW (lpFirst="SONORA.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.439] lstrcmpW (lpString1="SONORA.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.439] GetCurrentThreadId () returned 0x9b0 [0042.439] RtlWakeConditionVariable () returned 0x27e800 [0042.439] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.439] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.439] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.439] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.439] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.439] GetCurrentThreadId () returned 0x9b0 [0042.439] RtlWakeConditionVariable () returned 0x27e800 [0042.439] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.439] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.439] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f92b0 [0042.439] GetCurrentThreadId () returned 0x9b0 [0042.439] RtlWakeConditionVariable () returned 0x27e800 [0042.440] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0042.440] lstrcmpiW (lpString1="SPRING", lpString2="Windows") returned -1 [0042.440] lstrcmpW (lpString1="SPRING", lpString2=".") returned 1 [0042.440] lstrcmpW (lpString1="SPRING", lpString2="..") returned 1 [0042.440] lstrcmpW (lpString1="SPRING", lpString2="AppData") returned 1 [0042.440] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING", lpSrch="AppData") returned 0x0 [0042.440] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING", lpString2="C:\\Windows") returned -1 [0042.440] lstrlenW (lpString="C:\\Windows") returned 10 [0042.440] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING", lpString2="C:\\System Volume Information") returned -1 [0042.440] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.440] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f5a68 [0042.547] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.547] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.547] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.548] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.548] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.548] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.548] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.548] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.548] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.548] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.548] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.548] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.548] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.548] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.548] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.548] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.548] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.548] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.548] GetCurrentThreadId () returned 0x9b0 [0042.548] RtlWakeConditionVariable () returned 0x27e800 [0042.548] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0042.548] lstrcmpiW (lpString1="SPRING.ELM", lpString2="Windows") returned -1 [0042.548] lstrcmpW (lpString1="SPRING.ELM", lpString2="32.EXE.exe") returned 1 [0042.548] StrStrW (lpFirst="SPRING.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.549] lstrcmpW (lpString1="SPRING.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.549] GetCurrentThreadId () returned 0x9b0 [0042.549] RtlWakeConditionVariable () returned 0x27e800 [0042.549] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0042.549] lstrcmpiW (lpString1="SPRING.INF", lpString2="Windows") returned -1 [0042.549] lstrcmpW (lpString1="SPRING.INF", lpString2="32.EXE.exe") returned 1 [0042.549] StrStrW (lpFirst="SPRING.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.549] lstrcmpW (lpString1="SPRING.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.549] GetCurrentThreadId () returned 0x9b0 [0042.549] RtlWakeConditionVariable () returned 0x27e800 [0042.549] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.549] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.549] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.549] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.549] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.549] GetCurrentThreadId () returned 0x9b0 [0042.549] RtlWakeConditionVariable () returned 0x27e800 [0042.549] FindNextFileW (in: hFindFile=0x2f5a68, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.549] FindClose (in: hFindFile=0x2f5a68 | out: hFindFile=0x2f5a68) returned 1 [0042.549] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.549] GetCurrentThreadId () returned 0x9b0 [0042.549] RtlWakeConditionVariable () returned 0x27e800 [0042.549] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0042.549] lstrcmpiW (lpString1="STRTEDGE", lpString2="Windows") returned -1 [0042.550] lstrcmpW (lpString1="STRTEDGE", lpString2=".") returned 1 [0042.550] lstrcmpW (lpString1="STRTEDGE", lpString2="..") returned 1 [0042.550] lstrcmpW (lpString1="STRTEDGE", lpString2="AppData") returned 1 [0042.550] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE", lpSrch="AppData") returned 0x0 [0042.550] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE", lpString2="C:\\Windows") returned -1 [0042.550] lstrlenW (lpString="C:\\Windows") returned 10 [0042.550] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE", lpString2="C:\\System Volume Information") returned -1 [0042.550] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.550] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0042.628] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.628] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.628] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.628] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.628] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.628] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.628] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.628] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.628] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.628] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.628] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.628] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.628] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.628] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.628] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.628] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.628] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.628] GetCurrentThreadId () returned 0x9b0 [0042.628] RtlWakeConditionVariable () returned 0x27e800 [0042.628] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0042.629] lstrcmpiW (lpString1="STRTEDGE.ELM", lpString2="Windows") returned -1 [0042.629] lstrcmpW (lpString1="STRTEDGE.ELM", lpString2="32.EXE.exe") returned 1 [0042.629] StrStrW (lpFirst="STRTEDGE.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.629] lstrcmpW (lpString1="STRTEDGE.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.629] GetCurrentThreadId () returned 0x9b0 [0042.629] RtlWakeConditionVariable () returned 0x27e800 [0042.629] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0042.629] lstrcmpiW (lpString1="STRTEDGE.INF", lpString2="Windows") returned -1 [0042.629] lstrcmpW (lpString1="STRTEDGE.INF", lpString2="32.EXE.exe") returned 1 [0042.629] StrStrW (lpFirst="STRTEDGE.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.629] lstrcmpW (lpString1="STRTEDGE.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.629] GetCurrentThreadId () returned 0x9b0 [0042.629] RtlWakeConditionVariable () returned 0x27e800 [0042.629] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.629] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.629] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.629] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.629] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.629] GetCurrentThreadId () returned 0x9b0 [0042.629] RtlWakeConditionVariable () returned 0x27e800 [0042.629] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.629] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0042.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.630] GetCurrentThreadId () returned 0x9b0 [0042.630] RtlWakeConditionVariable () returned 0x27e800 [0042.630] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0042.630] lstrcmpiW (lpString1="STUDIO", lpString2="Windows") returned -1 [0042.630] lstrcmpW (lpString1="STUDIO", lpString2=".") returned 1 [0042.630] lstrcmpW (lpString1="STUDIO", lpString2="..") returned 1 [0042.630] lstrcmpW (lpString1="STUDIO", lpString2="AppData") returned 1 [0042.630] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO", lpSrch="AppData") returned 0x0 [0042.630] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO", lpString2="C:\\Windows") returned -1 [0042.630] lstrlenW (lpString="C:\\Windows") returned 10 [0042.630] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO", lpString2="C:\\System Volume Information") returned -1 [0042.630] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0042.630] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.630] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.630] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.630] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.630] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.630] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.630] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.631] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.631] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.631] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.631] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.631] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.631] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.631] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.631] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.631] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.631] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.631] GetCurrentThreadId () returned 0x9b0 [0042.631] RtlWakeConditionVariable () returned 0x27e800 [0042.631] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0042.631] lstrcmpiW (lpString1="STUDIO.ELM", lpString2="Windows") returned -1 [0042.631] lstrcmpW (lpString1="STUDIO.ELM", lpString2="32.EXE.exe") returned 1 [0042.631] StrStrW (lpFirst="STUDIO.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.631] lstrcmpW (lpString1="STUDIO.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.631] GetCurrentThreadId () returned 0x9b0 [0042.631] RtlWakeConditionVariable () returned 0x27e800 [0042.631] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0042.631] lstrcmpiW (lpString1="STUDIO.INF", lpString2="Windows") returned -1 [0042.631] lstrcmpW (lpString1="STUDIO.INF", lpString2="32.EXE.exe") returned 1 [0042.631] StrStrW (lpFirst="STUDIO.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.631] lstrcmpW (lpString1="STUDIO.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.631] GetCurrentThreadId () returned 0x9b0 [0042.632] RtlWakeConditionVariable () returned 0x27e800 [0042.632] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.632] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.632] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.632] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.632] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.632] GetCurrentThreadId () returned 0x9b0 [0042.632] RtlWakeConditionVariable () returned 0x27e800 [0042.632] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.632] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0042.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.632] GetCurrentThreadId () returned 0x9b0 [0042.632] RtlWakeConditionVariable () returned 0x27e800 [0042.632] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0042.632] lstrcmpiW (lpString1="SUMIPNTG", lpString2="Windows") returned -1 [0042.632] lstrcmpW (lpString1="SUMIPNTG", lpString2=".") returned 1 [0042.632] lstrcmpW (lpString1="SUMIPNTG", lpString2="..") returned 1 [0042.632] lstrcmpW (lpString1="SUMIPNTG", lpString2="AppData") returned 1 [0042.632] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG", lpSrch="AppData") returned 0x0 [0042.632] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG", lpString2="C:\\Windows") returned -1 [0042.632] lstrlenW (lpString="C:\\Windows") returned 10 [0042.632] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG", lpString2="C:\\System Volume Information") returned -1 [0042.632] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0042.641] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.641] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.641] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.641] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.641] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.641] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.641] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.641] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.641] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.641] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.641] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.641] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.641] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.641] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.641] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.641] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.641] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.642] GetCurrentThreadId () returned 0x9b0 [0042.642] RtlWakeConditionVariable () returned 0x27e800 [0042.642] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0042.642] lstrcmpiW (lpString1="SUMIPNTG.ELM", lpString2="Windows") returned -1 [0042.642] lstrcmpW (lpString1="SUMIPNTG.ELM", lpString2="32.EXE.exe") returned 1 [0042.642] StrStrW (lpFirst="SUMIPNTG.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.642] lstrcmpW (lpString1="SUMIPNTG.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.642] GetCurrentThreadId () returned 0x9b0 [0042.642] RtlWakeConditionVariable () returned 0x27e800 [0042.642] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0042.642] lstrcmpiW (lpString1="SUMIPNTG.INF", lpString2="Windows") returned -1 [0042.642] lstrcmpW (lpString1="SUMIPNTG.INF", lpString2="32.EXE.exe") returned 1 [0042.642] StrStrW (lpFirst="SUMIPNTG.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.642] lstrcmpW (lpString1="SUMIPNTG.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.642] GetCurrentThreadId () returned 0x9b0 [0042.642] RtlWakeConditionVariable () returned 0x27e800 [0042.642] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.642] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.642] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.642] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.642] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.642] GetCurrentThreadId () returned 0x9b0 [0042.642] RtlWakeConditionVariable () returned 0x27e800 [0042.642] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0042.643] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0042.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.643] GetCurrentThreadId () returned 0x9b0 [0042.643] RtlWakeConditionVariable () returned 0x27e800 [0042.643] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0042.643] lstrcmpiW (lpString1="THEMES.INF", lpString2="Windows") returned -1 [0042.643] lstrcmpW (lpString1="THEMES.INF", lpString2="32.EXE.exe") returned 1 [0042.643] StrStrW (lpFirst="THEMES.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.644] lstrcmpW (lpString1="THEMES.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296138 [0042.644] GetCurrentThreadId () returned 0x9b0 [0042.644] RtlWakeConditionVariable () returned 0x27e800 [0042.644] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0042.644] lstrcmpiW (lpString1="WATER", lpString2="Windows") returned -1 [0042.644] lstrcmpW (lpString1="WATER", lpString2=".") returned 1 [0042.644] lstrcmpW (lpString1="WATER", lpString2="..") returned 1 [0042.644] lstrcmpW (lpString1="WATER", lpString2="AppData") returned 1 [0042.644] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER", lpSrch="AppData") returned 0x0 [0042.644] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER", lpString2="C:\\Windows") returned -1 [0042.644] lstrlenW (lpString="C:\\Windows") returned 10 [0042.644] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER", lpString2="C:\\System Volume Information") returned -1 [0042.644] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0042.683] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.684] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.684] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.684] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.684] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.684] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0042.684] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.684] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.684] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.684] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.684] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x98, dwReserved1=0x260000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.684] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.684] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.684] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.684] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.684] GetCurrentThreadId () returned 0x9b0 [0042.684] RtlWakeConditionVariable () returned 0x27e800 [0042.684] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x98, dwReserved1=0x260000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.684] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.684] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.684] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.684] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.684] GetCurrentThreadId () returned 0x9b0 [0042.684] RtlWakeConditionVariable () returned 0x27e800 [0042.685] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x98, dwReserved1=0x260000, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0042.685] lstrcmpiW (lpString1="WATER.ELM", lpString2="Windows") returned -1 [0042.685] lstrcmpW (lpString1="WATER.ELM", lpString2="32.EXE.exe") returned 1 [0042.685] StrStrW (lpFirst="WATER.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.685] lstrcmpW (lpString1="WATER.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.685] GetCurrentThreadId () returned 0x9b0 [0042.685] RtlWakeConditionVariable () returned 0x27e800 [0042.685] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x98, dwReserved1=0x260000, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0042.685] lstrcmpiW (lpString1="WATER.INF", lpString2="Windows") returned -1 [0042.685] lstrcmpW (lpString1="WATER.INF", lpString2="32.EXE.exe") returned 1 [0042.685] StrStrW (lpFirst="WATER.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.685] lstrcmpW (lpString1="WATER.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0042.685] GetCurrentThreadId () returned 0x9b0 [0042.685] RtlWakeConditionVariable () returned 0x27e800 [0042.685] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x98, dwReserved1=0x260000, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0042.685] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0042.685] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.685] GetCurrentThreadId () returned 0x9b0 [0042.685] RtlWakeConditionVariable () returned 0x27e800 [0042.685] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0042.685] lstrcmpiW (lpString1="WATERMAR", lpString2="Windows") returned -1 [0042.685] lstrcmpW (lpString1="WATERMAR", lpString2=".") returned 1 [0042.685] lstrcmpW (lpString1="WATERMAR", lpString2="..") returned 1 [0042.685] lstrcmpW (lpString1="WATERMAR", lpString2="AppData") returned 1 [0042.685] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR", lpSrch="AppData") returned 0x0 [0042.686] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR", lpString2="C:\\Windows") returned -1 [0042.686] lstrlenW (lpString="C:\\Windows") returned 10 [0042.686] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR", lpString2="C:\\System Volume Information") returned -1 [0042.686] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0042.686] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.686] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.686] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.686] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.686] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.686] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0042.686] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.686] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.686] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.686] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.686] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.686] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.686] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x98, dwReserved1=0x260000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.686] lstrcmpiW (lpString1="PREVIEW.GIF", lpString2="Windows") returned -1 [0042.686] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="32.EXE.exe") returned 1 [0042.686] StrStrW (lpFirst="PREVIEW.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.686] lstrcmpW (lpString1="PREVIEW.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.687] GetCurrentThreadId () returned 0x9b0 [0042.687] RtlWakeConditionVariable () returned 0x27e800 [0042.687] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x98, dwReserved1=0x260000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0042.687] lstrcmpiW (lpString1="THMBNAIL.PNG", lpString2="Windows") returned -1 [0042.687] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="32.EXE.exe") returned 1 [0042.687] StrStrW (lpFirst="THMBNAIL.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.687] lstrcmpW (lpString1="THMBNAIL.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.687] GetCurrentThreadId () returned 0x9b0 [0042.687] RtlWakeConditionVariable () returned 0x27e800 [0042.687] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x98, dwReserved1=0x260000, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0042.687] lstrcmpiW (lpString1="WATERMAR.ELM", lpString2="Windows") returned -1 [0042.687] lstrcmpW (lpString1="WATERMAR.ELM", lpString2="32.EXE.exe") returned 1 [0042.687] StrStrW (lpFirst="WATERMAR.ELM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.687] lstrcmpW (lpString1="WATERMAR.ELM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.687] GetCurrentThreadId () returned 0x9b0 [0042.687] RtlWakeConditionVariable () returned 0x27e800 [0042.687] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x98, dwReserved1=0x260000, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0042.687] lstrcmpiW (lpString1="WATERMAR.INF", lpString2="Windows") returned -1 [0042.687] lstrcmpW (lpString1="WATERMAR.INF", lpString2="32.EXE.exe") returned 1 [0042.687] StrStrW (lpFirst="WATERMAR.INF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.687] lstrcmpW (lpString1="WATERMAR.INF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.687] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.687] GetCurrentThreadId () returned 0x9b0 [0042.687] RtlWakeConditionVariable () returned 0x27e800 [0042.687] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x98, dwReserved1=0x260000, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0042.688] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0042.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.688] GetCurrentThreadId () returned 0x9b0 [0042.688] RtlWakeConditionVariable () returned 0x27e800 [0042.688] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0042.688] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0042.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.688] GetCurrentThreadId () returned 0x9b0 [0042.688] RtlWakeConditionVariable () returned 0x27e800 [0042.688] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0042.688] lstrcmpiW (lpString1="TRANSLAT", lpString2="Windows") returned -1 [0042.688] lstrcmpW (lpString1="TRANSLAT", lpString2=".") returned 1 [0042.688] lstrcmpW (lpString1="TRANSLAT", lpString2="..") returned 1 [0042.688] lstrcmpW (lpString1="TRANSLAT", lpString2="AppData") returned 1 [0042.688] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT", lpSrch="AppData") returned 0x0 [0042.688] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT", lpString2="C:\\Windows") returned -1 [0042.688] lstrlenW (lpString="C:\\Windows") returned 10 [0042.688] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT", lpString2="C:\\System Volume Information") returned -1 [0042.688] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27d070 [0042.791] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.791] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.791] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.791] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.791] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.791] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.791] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.791] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.791] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.791] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.792] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.792] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.792] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0042.792] lstrcmpiW (lpString1="ARFR", lpString2="Windows") returned -1 [0042.792] lstrcmpW (lpString1="ARFR", lpString2=".") returned 1 [0042.792] lstrcmpW (lpString1="ARFR", lpString2="..") returned 1 [0042.792] lstrcmpW (lpString1="ARFR", lpString2="AppData") returned 1 [0042.792] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR", lpSrch="AppData") returned 0x0 [0042.792] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR", lpString2="C:\\Windows") returned -1 [0042.792] lstrlenW (lpString="C:\\Windows") returned 10 [0042.792] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR", lpString2="C:\\System Volume Information") returned -1 [0042.792] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.828] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.828] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.828] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.828] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.828] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.828] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.829] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.829] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.829] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.829] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.829] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.829] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0042.829] lstrcmpiW (lpString1="MSB1ARFR.ITS", lpString2="Windows") returned -1 [0042.829] lstrcmpW (lpString1="MSB1ARFR.ITS", lpString2="32.EXE.exe") returned 1 [0042.829] StrStrW (lpFirst="MSB1ARFR.ITS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.829] lstrcmpW (lpString1="MSB1ARFR.ITS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.829] GetCurrentThreadId () returned 0x9b0 [0042.829] RtlWakeConditionVariable () returned 0x27e800 [0042.829] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0042.829] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.829] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.829] GetCurrentThreadId () returned 0x9b0 [0042.829] RtlWakeConditionVariable () returned 0x27e800 [0042.829] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0042.829] lstrcmpiW (lpString1="ENES", lpString2="Windows") returned -1 [0042.829] lstrcmpW (lpString1="ENES", lpString2=".") returned 1 [0042.829] lstrcmpW (lpString1="ENES", lpString2="..") returned 1 [0042.829] lstrcmpW (lpString1="ENES", lpString2="AppData") returned 1 [0042.829] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES", lpSrch="AppData") returned 0x0 [0042.830] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES", lpString2="C:\\Windows") returned -1 [0042.830] lstrlenW (lpString="C:\\Windows") returned 10 [0042.830] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES", lpString2="C:\\System Volume Information") returned -1 [0042.830] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.830] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.835] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.835] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.835] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.835] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.835] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.835] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.835] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.835] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.835] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.835] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.835] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.835] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.835] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0042.836] lstrcmpiW (lpString1="MSB1ENES.ITS", lpString2="Windows") returned -1 [0042.836] lstrcmpW (lpString1="MSB1ENES.ITS", lpString2="32.EXE.exe") returned 1 [0042.836] StrStrW (lpFirst="MSB1ENES.ITS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.836] lstrcmpW (lpString1="MSB1ENES.ITS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.836] GetCurrentThreadId () returned 0x9b0 [0042.836] RtlWakeConditionVariable () returned 0x27e800 [0042.836] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0042.836] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.836] GetCurrentThreadId () returned 0x9b0 [0042.836] RtlWakeConditionVariable () returned 0x27e800 [0042.836] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0042.836] lstrcmpiW (lpString1="ENFR", lpString2="Windows") returned -1 [0042.836] lstrcmpW (lpString1="ENFR", lpString2=".") returned 1 [0042.836] lstrcmpW (lpString1="ENFR", lpString2="..") returned 1 [0042.836] lstrcmpW (lpString1="ENFR", lpString2="AppData") returned 1 [0042.836] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR", lpSrch="AppData") returned 0x0 [0042.836] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR", lpString2="C:\\Windows") returned -1 [0042.836] lstrlenW (lpString="C:\\Windows") returned 10 [0042.836] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR", lpString2="C:\\System Volume Information") returned -1 [0042.836] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.836] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.837] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.837] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.837] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.837] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.837] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.837] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.837] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.837] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.837] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.837] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.837] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.837] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.837] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0042.837] lstrcmpiW (lpString1="MSB1ENFR.ITS", lpString2="Windows") returned -1 [0042.837] lstrcmpW (lpString1="MSB1ENFR.ITS", lpString2="32.EXE.exe") returned 1 [0042.837] StrStrW (lpFirst="MSB1ENFR.ITS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.837] lstrcmpW (lpString1="MSB1ENFR.ITS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.837] GetCurrentThreadId () returned 0x9b0 [0042.837] RtlWakeConditionVariable () returned 0x27e800 [0042.837] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0042.837] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.837] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.837] GetCurrentThreadId () returned 0x9b0 [0042.837] RtlWakeConditionVariable () returned 0x27e800 [0042.838] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0042.838] lstrcmpiW (lpString1="ESEN", lpString2="Windows") returned -1 [0042.838] lstrcmpW (lpString1="ESEN", lpString2=".") returned 1 [0042.838] lstrcmpW (lpString1="ESEN", lpString2="..") returned 1 [0042.838] lstrcmpW (lpString1="ESEN", lpString2="AppData") returned 1 [0042.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN", lpSrch="AppData") returned 0x0 [0042.838] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN", lpString2="C:\\Windows") returned -1 [0042.838] lstrlenW (lpString="C:\\Windows") returned 10 [0042.838] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN", lpString2="C:\\System Volume Information") returned -1 [0042.838] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.838] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.838] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.838] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.838] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.838] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.838] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.838] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.839] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.839] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.839] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.839] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.839] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.839] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.839] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0042.839] lstrcmpiW (lpString1="MSB1ESEN.DLL", lpString2="Windows") returned -1 [0042.839] lstrcmpW (lpString1="MSB1ESEN.DLL", lpString2="32.EXE.exe") returned 1 [0042.839] StrStrW (lpFirst="MSB1ESEN.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.839] lstrcmpW (lpString1="MSB1ESEN.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.839] GetCurrentThreadId () returned 0x9b0 [0042.839] RtlWakeConditionVariable () returned 0x27e800 [0042.839] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0042.839] lstrcmpiW (lpString1="MSB1ESEN.ITS", lpString2="Windows") returned -1 [0042.839] lstrcmpW (lpString1="MSB1ESEN.ITS", lpString2="32.EXE.exe") returned 1 [0042.839] StrStrW (lpFirst="MSB1ESEN.ITS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.839] lstrcmpW (lpString1="MSB1ESEN.ITS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.839] GetCurrentThreadId () returned 0x9b0 [0042.839] RtlWakeConditionVariable () returned 0x27e800 [0042.839] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0042.839] lstrcmpiW (lpString1="WT61ES.LEX", lpString2="Windows") returned 1 [0042.839] lstrcmpW (lpString1="WT61ES.LEX", lpString2="32.EXE.exe") returned 1 [0042.839] StrStrW (lpFirst="WT61ES.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.839] lstrcmpW (lpString1="WT61ES.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.840] GetCurrentThreadId () returned 0x9b0 [0042.840] RtlWakeConditionVariable () returned 0x27e800 [0042.840] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0042.840] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.840] GetCurrentThreadId () returned 0x9b0 [0042.840] RtlWakeConditionVariable () returned 0x27e800 [0042.840] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0042.840] lstrcmpiW (lpString1="FRAR", lpString2="Windows") returned -1 [0042.840] lstrcmpW (lpString1="FRAR", lpString2=".") returned 1 [0042.840] lstrcmpW (lpString1="FRAR", lpString2="..") returned 1 [0042.840] lstrcmpW (lpString1="FRAR", lpString2="AppData") returned 1 [0042.840] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR", lpSrch="AppData") returned 0x0 [0042.840] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR", lpString2="C:\\Windows") returned -1 [0042.840] lstrlenW (lpString="C:\\Windows") returned 10 [0042.840] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR", lpString2="C:\\System Volume Information") returned -1 [0042.840] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.840] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.841] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.841] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.841] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.841] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.841] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.841] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.842] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.842] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.842] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.842] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.842] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.842] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.842] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0042.842] lstrcmpiW (lpString1="MSB1FRAR.ITS", lpString2="Windows") returned -1 [0042.842] lstrcmpW (lpString1="MSB1FRAR.ITS", lpString2="32.EXE.exe") returned 1 [0042.842] StrStrW (lpFirst="MSB1FRAR.ITS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.842] lstrcmpW (lpString1="MSB1FRAR.ITS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.842] GetCurrentThreadId () returned 0x9b0 [0042.842] RtlWakeConditionVariable () returned 0x27e800 [0042.842] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0042.842] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.842] GetCurrentThreadId () returned 0x9b0 [0042.842] RtlWakeConditionVariable () returned 0x27e800 [0042.842] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0042.842] lstrcmpiW (lpString1="FREN", lpString2="Windows") returned -1 [0042.842] lstrcmpW (lpString1="FREN", lpString2=".") returned 1 [0042.842] lstrcmpW (lpString1="FREN", lpString2="..") returned 1 [0042.842] lstrcmpW (lpString1="FREN", lpString2="AppData") returned 1 [0042.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN", lpSrch="AppData") returned 0x0 [0042.842] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN", lpString2="C:\\Windows") returned -1 [0042.842] lstrlenW (lpString="C:\\Windows") returned 10 [0042.843] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN", lpString2="C:\\System Volume Information") returned -1 [0042.843] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.846] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.846] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.846] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.846] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.846] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.846] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.847] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.847] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.847] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.847] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.847] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.847] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.847] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0042.847] lstrcmpiW (lpString1="MSB1FREN.DLL", lpString2="Windows") returned -1 [0042.847] lstrcmpW (lpString1="MSB1FREN.DLL", lpString2="32.EXE.exe") returned 1 [0042.847] StrStrW (lpFirst="MSB1FREN.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.847] lstrcmpW (lpString1="MSB1FREN.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.847] GetCurrentThreadId () returned 0x9b0 [0042.847] RtlWakeConditionVariable () returned 0x27e800 [0042.847] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0042.847] lstrcmpiW (lpString1="MSB1FREN.ITS", lpString2="Windows") returned -1 [0042.847] lstrcmpW (lpString1="MSB1FREN.ITS", lpString2="32.EXE.exe") returned 1 [0042.847] StrStrW (lpFirst="MSB1FREN.ITS", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.847] lstrcmpW (lpString1="MSB1FREN.ITS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.847] GetCurrentThreadId () returned 0x9b0 [0042.847] RtlWakeConditionVariable () returned 0x27e800 [0042.847] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0042.847] lstrcmpiW (lpString1="WT61FR.LEX", lpString2="Windows") returned 1 [0042.847] lstrcmpW (lpString1="WT61FR.LEX", lpString2="32.EXE.exe") returned 1 [0042.847] StrStrW (lpFirst="WT61FR.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.847] lstrcmpW (lpString1="WT61FR.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.848] GetCurrentThreadId () returned 0x9b0 [0042.848] RtlWakeConditionVariable () returned 0x27e800 [0042.848] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0042.848] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.848] GetCurrentThreadId () returned 0x9b0 [0042.848] RtlWakeConditionVariable () returned 0x27e800 [0042.848] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0042.848] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="Windows") returned -1 [0042.848] lstrcmpW (lpString1="MSB1AR.LEX", lpString2="32.EXE.exe") returned 1 [0042.848] StrStrW (lpFirst="MSB1AR.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.848] lstrcmpW (lpString1="MSB1AR.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x296b50 [0042.848] GetCurrentThreadId () returned 0x9b0 [0042.848] RtlWakeConditionVariable () returned 0x27e800 [0042.848] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0042.848] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="Windows") returned -1 [0042.848] lstrcmpW (lpString1="MSB1CACH.LEX", lpString2="32.EXE.exe") returned 1 [0042.848] StrStrW (lpFirst="MSB1CACH.LEX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.848] lstrcmpW (lpString1="MSB1CACH.LEX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.848] GetCurrentThreadId () returned 0x9b0 [0042.848] RtlWakeConditionVariable () returned 0x27e800 [0042.848] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0042.848] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="Windows") returned -1 [0042.849] lstrcmpW (lpString1="MSB1CORE.DLL", lpString2="32.EXE.exe") returned 1 [0042.849] StrStrW (lpFirst="MSB1CORE.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.849] lstrcmpW (lpString1="MSB1CORE.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.849] GetCurrentThreadId () returned 0x9b0 [0042.849] RtlWakeConditionVariable () returned 0x27e800 [0042.849] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0042.849] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="Windows") returned -1 [0042.849] lstrcmpW (lpString1="MSB1STAR.DLL", lpString2="32.EXE.exe") returned 1 [0042.849] StrStrW (lpFirst="MSB1STAR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.849] lstrcmpW (lpString1="MSB1STAR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.849] GetCurrentThreadId () returned 0x9b0 [0042.849] RtlWakeConditionVariable () returned 0x27e800 [0042.849] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0042.849] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="Windows") returned -1 [0042.849] lstrcmpW (lpString1="MSB1XTOR.DLL", lpString2="32.EXE.exe") returned 1 [0042.849] StrStrW (lpFirst="MSB1XTOR.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.849] lstrcmpW (lpString1="MSB1XTOR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.849] GetCurrentThreadId () returned 0x9b0 [0042.849] RtlWakeConditionVariable () returned 0x27e800 [0042.849] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0042.849] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="Windows") returned 1 [0042.849] lstrcmpW (lpString1="WTSP61MS.DLL", lpString2="32.EXE.exe") returned 1 [0042.849] StrStrW (lpFirst="WTSP61MS.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.849] lstrcmpW (lpString1="WTSP61MS.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.850] GetCurrentThreadId () returned 0x9b0 [0042.850] RtlWakeConditionVariable () returned 0x27e800 [0042.850] FindNextFileW (in: hFindFile=0x27d070, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0042.850] FindClose (in: hFindFile=0x27d070 | out: hFindFile=0x27d070) returned 1 [0042.850] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.850] GetCurrentThreadId () returned 0x9b0 [0042.850] RtlWakeConditionVariable () returned 0x27e800 [0042.851] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0042.851] lstrcmpiW (lpString1="Triedit", lpString2="Windows") returned -1 [0042.851] lstrcmpW (lpString1="Triedit", lpString2=".") returned 1 [0042.851] lstrcmpW (lpString1="Triedit", lpString2="..") returned 1 [0042.851] lstrcmpW (lpString1="Triedit", lpString2="AppData") returned 1 [0042.851] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpSrch="AppData") returned 0x0 [0042.851] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpString2="C:\\Windows") returned -1 [0042.851] lstrlenW (lpString="C:\\Windows") returned 10 [0042.851] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpString2="C:\\System Volume Information") returned -1 [0042.851] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.852] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.852] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.852] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.852] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.852] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.852] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.852] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.852] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.852] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.852] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.852] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.852] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.852] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.852] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0042.852] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0042.852] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0042.852] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0042.852] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpSrch="AppData") returned 0x0 [0042.852] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpString2="C:\\Windows") returned -1 [0042.852] lstrlenW (lpString="C:\\Windows") returned 10 [0042.852] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpString2="C:\\System Volume Information") returned -1 [0042.852] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.853] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b4118 [0042.862] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.862] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.862] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.862] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.862] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.862] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.862] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.862] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.862] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.862] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.862] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.863] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.863] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0042.863] FindClose (in: hFindFile=0x2b4118 | out: hFindFile=0x2b4118) returned 1 [0042.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.863] GetCurrentThreadId () returned 0x9b0 [0042.863] RtlWakeConditionVariable () returned 0x27e800 [0042.863] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0042.863] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.863] GetCurrentThreadId () returned 0x9b0 [0042.863] RtlWakeConditionVariable () returned 0x27e800 [0042.863] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0042.863] lstrcmpiW (lpString1="VBA", lpString2="Windows") returned -1 [0042.864] lstrcmpW (lpString1="VBA", lpString2=".") returned 1 [0042.864] lstrcmpW (lpString1="VBA", lpString2="..") returned 1 [0042.864] lstrcmpW (lpString1="VBA", lpString2="AppData") returned 1 [0042.864] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA", lpSrch="AppData") returned 0x0 [0042.864] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA", lpString2="C:\\Windows") returned -1 [0042.864] lstrlenW (lpString="C:\\Windows") returned 10 [0042.864] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA", lpString2="C:\\System Volume Information") returned -1 [0042.864] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.864] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.865] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.865] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.865] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.865] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.865] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.865] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.865] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.865] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.865] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.865] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.865] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.865] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.865] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0042.865] lstrcmpiW (lpString1="VBA7", lpString2="Windows") returned -1 [0042.865] lstrcmpW (lpString1="VBA7", lpString2=".") returned 1 [0042.865] lstrcmpW (lpString1="VBA7", lpString2="..") returned 1 [0042.865] lstrcmpW (lpString1="VBA7", lpString2="AppData") returned 1 [0042.865] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7", lpSrch="AppData") returned 0x0 [0042.865] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7", lpString2="C:\\Windows") returned -1 [0042.865] lstrlenW (lpString="C:\\Windows") returned 10 [0042.865] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7", lpString2="C:\\System Volume Information") returned -1 [0042.865] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.865] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b4118 [0042.866] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.866] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.866] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.866] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.866] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.866] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.866] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.866] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.867] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.867] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.867] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.867] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.867] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0042.867] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0042.867] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0042.867] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0042.867] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0042.867] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033", lpSrch="AppData") returned 0x0 [0042.867] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033", lpString2="C:\\Windows") returned -1 [0042.867] lstrlenW (lpString="C:\\Windows") returned 10 [0042.867] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033", lpString2="C:\\System Volume Information") returned -1 [0042.867] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.867] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0042.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b4158 [0042.869] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.869] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.869] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.869] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.869] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.869] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.869] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.869] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.869] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.869] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.869] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.869] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.869] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0042.869] lstrcmpiW (lpString1="FM20.CHM", lpString2="Windows") returned -1 [0042.869] lstrcmpW (lpString1="FM20.CHM", lpString2="32.EXE.exe") returned 1 [0042.869] StrStrW (lpFirst="FM20.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.870] lstrcmpW (lpString1="FM20.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.870] GetCurrentThreadId () returned 0x9b0 [0042.870] RtlWakeConditionVariable () returned 0x27e800 [0042.870] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0042.870] lstrcmpiW (lpString1="VBCN6.CHM", lpString2="Windows") returned -1 [0042.870] lstrcmpW (lpString1="VBCN6.CHM", lpString2="32.EXE.exe") returned 1 [0042.870] StrStrW (lpFirst="VBCN6.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.870] lstrcmpW (lpString1="VBCN6.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.870] GetCurrentThreadId () returned 0x9b0 [0042.870] RtlWakeConditionVariable () returned 0x27e800 [0042.870] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0042.870] lstrcmpiW (lpString1="VBE7INTL.DLL", lpString2="Windows") returned -1 [0042.870] lstrcmpW (lpString1="VBE7INTL.DLL", lpString2="32.EXE.exe") returned 1 [0042.870] StrStrW (lpFirst="VBE7INTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.870] lstrcmpW (lpString1="VBE7INTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.870] GetCurrentThreadId () returned 0x9b0 [0042.870] RtlWakeConditionVariable () returned 0x27e800 [0042.870] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0042.870] lstrcmpiW (lpString1="VBENDF98.CHM", lpString2="Windows") returned -1 [0042.870] lstrcmpW (lpString1="VBENDF98.CHM", lpString2="32.EXE.exe") returned 1 [0042.870] StrStrW (lpFirst="VBENDF98.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.870] lstrcmpW (lpString1="VBENDF98.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.871] GetCurrentThreadId () returned 0x9b0 [0042.871] RtlWakeConditionVariable () returned 0x27e800 [0042.871] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0042.871] lstrcmpiW (lpString1="VBHW6.CHM", lpString2="Windows") returned -1 [0042.871] lstrcmpW (lpString1="VBHW6.CHM", lpString2="32.EXE.exe") returned 1 [0042.871] StrStrW (lpFirst="VBHW6.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.871] lstrcmpW (lpString1="VBHW6.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.871] GetCurrentThreadId () returned 0x9b0 [0042.871] RtlWakeConditionVariable () returned 0x27e800 [0042.871] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0042.871] lstrcmpiW (lpString1="VBLR6.CHM", lpString2="Windows") returned -1 [0042.871] lstrcmpW (lpString1="VBLR6.CHM", lpString2="32.EXE.exe") returned 1 [0042.871] StrStrW (lpFirst="VBLR6.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.871] lstrcmpW (lpString1="VBLR6.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.871] GetCurrentThreadId () returned 0x9b0 [0042.871] RtlWakeConditionVariable () returned 0x27e800 [0042.871] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0042.871] lstrcmpiW (lpString1="VBOB6.CHM", lpString2="Windows") returned -1 [0042.871] lstrcmpW (lpString1="VBOB6.CHM", lpString2="32.EXE.exe") returned 1 [0042.871] StrStrW (lpFirst="VBOB6.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.871] lstrcmpW (lpString1="VBOB6.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.871] GetCurrentThreadId () returned 0x9b0 [0042.871] RtlWakeConditionVariable () returned 0x27e800 [0042.871] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0042.872] lstrcmpiW (lpString1="VBUI6.CHM", lpString2="Windows") returned -1 [0042.872] lstrcmpW (lpString1="VBUI6.CHM", lpString2="32.EXE.exe") returned 1 [0042.872] StrStrW (lpFirst="VBUI6.CHM", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.872] lstrcmpW (lpString1="VBUI6.CHM", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.872] GetCurrentThreadId () returned 0x9b0 [0042.872] RtlWakeConditionVariable () returned 0x27e800 [0042.872] FindNextFileW (in: hFindFile=0x2b4158, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0042.872] FindClose (in: hFindFile=0x2b4158 | out: hFindFile=0x2b4158) returned 1 [0042.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.873] GetCurrentThreadId () returned 0x9b0 [0042.873] RtlWakeConditionVariable () returned 0x27e800 [0042.873] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0042.873] lstrcmpiW (lpString1="VBE7.DLL", lpString2="Windows") returned -1 [0042.873] lstrcmpW (lpString1="VBE7.DLL", lpString2="32.EXE.exe") returned 1 [0042.873] StrStrW (lpFirst="VBE7.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.873] lstrcmpW (lpString1="VBE7.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.873] GetCurrentThreadId () returned 0x9b0 [0042.873] RtlWakeConditionVariable () returned 0x27e800 [0042.873] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0042.873] FindClose (in: hFindFile=0x2b4118 | out: hFindFile=0x2b4118) returned 1 [0042.885] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.885] GetCurrentThreadId () returned 0x9b0 [0042.885] RtlWakeConditionVariable () returned 0x27e800 [0042.886] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0042.886] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.886] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.886] GetCurrentThreadId () returned 0x9b0 [0042.886] RtlWakeConditionVariable () returned 0x27e800 [0042.886] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0042.886] lstrcmpiW (lpString1="VC", lpString2="Windows") returned -1 [0042.886] lstrcmpW (lpString1="VC", lpString2=".") returned 1 [0042.886] lstrcmpW (lpString1="VC", lpString2="..") returned 1 [0042.886] lstrcmpW (lpString1="VC", lpString2="AppData") returned 1 [0042.886] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpSrch="AppData") returned 0x0 [0042.886] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpString2="C:\\Windows") returned -1 [0042.886] lstrlenW (lpString="C:\\Windows") returned 10 [0042.886] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpString2="C:\\System Volume Information") returned -1 [0042.887] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.887] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.888] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.888] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.888] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.888] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.888] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.888] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.888] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.888] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.888] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.888] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.888] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.888] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.888] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0042.889] lstrcmpiW (lpString1="msdia100.dll", lpString2="Windows") returned -1 [0042.889] lstrcmpW (lpString1="msdia100.dll", lpString2="32.EXE.exe") returned 1 [0042.889] StrStrW (lpFirst="msdia100.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.889] lstrcmpW (lpString1="msdia100.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.889] GetCurrentThreadId () returned 0x9b0 [0042.889] RtlWakeConditionVariable () returned 0x27e800 [0042.889] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0042.889] lstrcmpiW (lpString1="msdia90.dll", lpString2="Windows") returned -1 [0042.889] lstrcmpW (lpString1="msdia90.dll", lpString2="32.EXE.exe") returned 1 [0042.889] StrStrW (lpFirst="msdia90.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.889] lstrcmpW (lpString1="msdia90.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297a28 [0042.889] GetCurrentThreadId () returned 0x9b0 [0042.889] RtlWakeConditionVariable () returned 0x27e800 [0042.889] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0042.889] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.889] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.889] GetCurrentThreadId () returned 0x9b0 [0042.889] RtlWakeConditionVariable () returned 0x27e800 [0042.889] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0042.889] lstrcmpiW (lpString1="VGX", lpString2="Windows") returned -1 [0042.889] lstrcmpW (lpString1="VGX", lpString2=".") returned 1 [0042.889] lstrcmpW (lpString1="VGX", lpString2="..") returned 1 [0042.889] lstrcmpW (lpString1="VGX", lpString2="AppData") returned 1 [0042.890] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpSrch="AppData") returned 0x0 [0042.890] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpString2="C:\\Windows") returned -1 [0042.890] lstrlenW (lpString="C:\\Windows") returned 10 [0042.890] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpString2="C:\\System Volume Information") returned -1 [0042.890] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.890] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.890] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.890] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.890] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.890] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.890] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.890] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.890] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.890] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.890] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.890] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.890] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.890] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0042.890] lstrcmpiW (lpString1="VGX.dll", lpString2="Windows") returned -1 [0042.891] lstrcmpW (lpString1="VGX.dll", lpString2="32.EXE.exe") returned 1 [0042.891] StrStrW (lpFirst="VGX.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.891] lstrcmpW (lpString1="VGX.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0042.891] GetCurrentThreadId () returned 0x9b0 [0042.891] RtlWakeConditionVariable () returned 0x27e800 [0042.891] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0042.891] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.891] GetCurrentThreadId () returned 0x9b0 [0042.891] RtlWakeConditionVariable () returned 0x27e800 [0042.891] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0042.891] lstrcmpiW (lpString1="Visio Shared", lpString2="Windows") returned -1 [0042.891] lstrcmpW (lpString1="Visio Shared", lpString2=".") returned 1 [0042.891] lstrcmpW (lpString1="Visio Shared", lpString2="..") returned 1 [0042.891] lstrcmpW (lpString1="Visio Shared", lpString2="AppData") returned 1 [0042.891] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared", lpSrch="AppData") returned 0x0 [0042.891] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared", lpString2="C:\\Windows") returned -1 [0042.891] lstrlenW (lpString="C:\\Windows") returned 10 [0042.891] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared", lpString2="C:\\System Volume Information") returned -1 [0042.891] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.891] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.892] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.892] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.892] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.892] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.892] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.892] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.892] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.892] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.892] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.892] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.892] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.892] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.892] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0042.892] lstrcmpiW (lpString1="Fonts", lpString2="Windows") returned -1 [0042.892] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0042.892] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0042.892] lstrcmpW (lpString1="Fonts", lpString2="AppData") returned 1 [0042.892] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts", lpSrch="AppData") returned 0x0 [0042.892] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts", lpString2="C:\\Windows") returned -1 [0042.892] lstrlenW (lpString="C:\\Windows") returned 10 [0042.892] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts", lpString2="C:\\System Volume Information") returned -1 [0042.892] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.892] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b4118 [0042.894] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.894] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.894] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.894] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.894] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.895] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.895] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.895] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.895] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.895] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.895] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.895] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.895] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0042.895] lstrcmpiW (lpString1="BIGFONT.SHX", lpString2="Windows") returned -1 [0042.895] lstrcmpW (lpString1="BIGFONT.SHX", lpString2="32.EXE.exe") returned 1 [0042.895] StrStrW (lpFirst="BIGFONT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.895] lstrcmpW (lpString1="BIGFONT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.895] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.895] GetCurrentThreadId () returned 0x9b0 [0042.895] RtlWakeConditionVariable () returned 0x27e800 [0042.895] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0042.895] lstrcmpiW (lpString1="CHINESET.SHX", lpString2="Windows") returned -1 [0042.895] lstrcmpW (lpString1="CHINESET.SHX", lpString2="32.EXE.exe") returned 1 [0042.895] StrStrW (lpFirst="CHINESET.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.895] lstrcmpW (lpString1="CHINESET.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.896] GetCurrentThreadId () returned 0x9b0 [0042.896] RtlWakeConditionVariable () returned 0x27e800 [0042.896] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0042.896] lstrcmpiW (lpString1="EXTFONT.SHX", lpString2="Windows") returned -1 [0042.896] lstrcmpW (lpString1="EXTFONT.SHX", lpString2="32.EXE.exe") returned 1 [0042.896] StrStrW (lpFirst="EXTFONT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.896] lstrcmpW (lpString1="EXTFONT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.896] GetCurrentThreadId () returned 0x9b0 [0042.896] RtlWakeConditionVariable () returned 0x27e800 [0042.896] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0042.896] lstrcmpiW (lpString1="GBCBIG.SHX", lpString2="Windows") returned -1 [0042.896] lstrcmpW (lpString1="GBCBIG.SHX", lpString2="32.EXE.exe") returned 1 [0042.896] StrStrW (lpFirst="GBCBIG.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.896] lstrcmpW (lpString1="GBCBIG.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.896] GetCurrentThreadId () returned 0x9b0 [0042.896] RtlWakeConditionVariable () returned 0x27e800 [0042.896] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0042.896] lstrcmpiW (lpString1="IC-TXT.SHX", lpString2="Windows") returned -1 [0042.896] lstrcmpW (lpString1="IC-TXT.SHX", lpString2="32.EXE.exe") returned 1 [0042.896] StrStrW (lpFirst="IC-TXT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.896] lstrcmpW (lpString1="IC-TXT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.896] GetCurrentThreadId () returned 0x9b0 [0042.896] RtlWakeConditionVariable () returned 0x27e800 [0042.896] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0042.897] lstrcmpiW (lpString1="ICAD.FMP", lpString2="Windows") returned -1 [0042.897] lstrcmpW (lpString1="ICAD.FMP", lpString2="32.EXE.exe") returned 1 [0042.897] StrStrW (lpFirst="ICAD.FMP", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.897] lstrcmpW (lpString1="ICAD.FMP", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a620 [0042.897] GetCurrentThreadId () returned 0x9b0 [0042.897] RtlWakeConditionVariable () returned 0x27e800 [0042.897] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0042.897] lstrcmpiW (lpString1="WHGDTXT.SHX", lpString2="Windows") returned -1 [0042.897] lstrcmpW (lpString1="WHGDTXT.SHX", lpString2="32.EXE.exe") returned 1 [0042.897] StrStrW (lpFirst="WHGDTXT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.897] lstrcmpW (lpString1="WHGDTXT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.907] GetCurrentThreadId () returned 0x9b0 [0042.907] RtlWakeConditionVariable () returned 0x27e800 [0042.907] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0042.907] lstrcmpiW (lpString1="WHGTXT.SHX", lpString2="Windows") returned -1 [0042.907] lstrcmpW (lpString1="WHGTXT.SHX", lpString2="32.EXE.exe") returned 1 [0042.907] StrStrW (lpFirst="WHGTXT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.907] lstrcmpW (lpString1="WHGTXT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.907] GetCurrentThreadId () returned 0x9b0 [0042.908] RtlWakeConditionVariable () returned 0x27e800 [0042.908] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0042.908] lstrcmpiW (lpString1="WHTGTXT.SHX", lpString2="Windows") returned -1 [0042.908] lstrcmpW (lpString1="WHTGTXT.SHX", lpString2="32.EXE.exe") returned 1 [0042.908] StrStrW (lpFirst="WHTGTXT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.908] lstrcmpW (lpString1="WHTGTXT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.908] GetCurrentThreadId () returned 0x9b0 [0042.908] RtlWakeConditionVariable () returned 0x27e800 [0042.908] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0042.908] lstrcmpiW (lpString1="WHTMTXT.SHX", lpString2="Windows") returned -1 [0042.908] lstrcmpW (lpString1="WHTMTXT.SHX", lpString2="32.EXE.exe") returned 1 [0042.908] StrStrW (lpFirst="WHTMTXT.SHX", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.908] lstrcmpW (lpString1="WHTMTXT.SHX", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0042.908] GetCurrentThreadId () returned 0x9b0 [0042.908] RtlWakeConditionVariable () returned 0x27e800 [0042.908] FindNextFileW (in: hFindFile=0x2b4118, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0042.908] FindClose (in: hFindFile=0x2b4118 | out: hFindFile=0x2b4118) returned 1 [0042.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ed88 [0042.909] GetCurrentThreadId () returned 0x9b0 [0042.909] RtlWakeConditionVariable () returned 0x27e800 [0042.910] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0042.910] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0042.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0042.910] GetCurrentThreadId () returned 0x9b0 [0042.910] RtlWakeConditionVariable () returned 0x27e800 [0042.910] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0042.910] lstrcmpiW (lpString1="VSTO", lpString2="Windows") returned -1 [0042.910] lstrcmpW (lpString1="VSTO", lpString2=".") returned 1 [0042.910] lstrcmpW (lpString1="VSTO", lpString2="..") returned 1 [0042.910] lstrcmpW (lpString1="VSTO", lpString2="AppData") returned 1 [0042.910] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO", lpSrch="AppData") returned 0x0 [0042.910] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO", lpString2="C:\\Windows") returned -1 [0042.910] lstrlenW (lpString="C:\\Windows") returned 10 [0042.910] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO", lpString2="C:\\System Volume Information") returned -1 [0042.910] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0042.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0042.924] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0042.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0042.934] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0042.934] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.943] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.943] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.943] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0042.943] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0042.943] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0042.943] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0042.943] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0042.943] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0042.943] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0042.943] lstrcmpiW (lpString1="10.0", lpString2="Windows") returned -1 [0042.943] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0042.943] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0042.943] lstrcmpW (lpString1="10.0", lpString2="AppData") returned -1 [0042.943] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0", lpSrch="AppData") returned 0x0 [0042.943] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0", lpString2="C:\\Windows") returned -1 [0042.943] lstrlenW (lpString="C:\\Windows") returned 10 [0042.943] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0", lpString2="C:\\System Volume Information") returned -1 [0042.943] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0042.943] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0042.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299108 [0043.124] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.124] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.124] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.124] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.125] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.125] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.125] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.125] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.125] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.125] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.125] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.125] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.125] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0043.125] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0043.125] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0043.125] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0043.125] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033", lpSrch="AppData") returned 0x0 [0043.125] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033", lpString2="C:\\Windows") returned -1 [0043.125] lstrlenW (lpString="C:\\Windows") returned 10 [0043.125] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033", lpString2="C:\\System Volume Information") returned -1 [0043.125] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.125] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0043.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299148 [0043.149] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.149] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.149] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.149] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.149] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.149] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.149] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.149] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.149] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.149] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.149] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.149] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.149] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0043.149] lstrcmpiW (lpString1="VSTOInstallerUI.dll", lpString2="Windows") returned -1 [0043.149] lstrcmpW (lpString1="VSTOInstallerUI.dll", lpString2="32.EXE.exe") returned 1 [0043.149] StrStrW (lpFirst="VSTOInstallerUI.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.150] lstrcmpW (lpString1="VSTOInstallerUI.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee2b0 [0043.150] GetCurrentThreadId () returned 0x9b0 [0043.150] RtlWakeConditionVariable () returned 0x27e800 [0043.150] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0043.150] lstrcmpiW (lpString1="VSTOLoaderUI.dll", lpString2="Windows") returned -1 [0043.150] lstrcmpW (lpString1="VSTOLoaderUI.dll", lpString2="32.EXE.exe") returned 1 [0043.150] StrStrW (lpFirst="VSTOLoaderUI.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.150] lstrcmpW (lpString1="VSTOLoaderUI.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee2b0 [0043.150] GetCurrentThreadId () returned 0x9b0 [0043.150] RtlWakeConditionVariable () returned 0x27e800 [0043.150] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0043.150] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0043.150] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2d9fc0 [0043.150] GetCurrentThreadId () returned 0x9b0 [0043.150] RtlWakeConditionVariable () returned 0x27e800 [0043.151] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0043.151] lstrcmpiW (lpString1="VSTOInstaller.config", lpString2="Windows") returned -1 [0043.151] lstrcmpW (lpString1="VSTOInstaller.config", lpString2="32.EXE.exe") returned 1 [0043.151] StrStrW (lpFirst="VSTOInstaller.config", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.151] lstrcmpW (lpString1="VSTOInstaller.config", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.151] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee2b0 [0043.151] GetCurrentThreadId () returned 0x9b0 [0043.151] RtlWakeConditionVariable () returned 0x27e800 [0043.151] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0043.151] lstrcmpiW (lpString1="VSTOInstaller.exe", lpString2="Windows") returned -1 [0043.152] lstrcmpW (lpString1="VSTOInstaller.exe", lpString2="32.EXE.exe") returned 1 [0043.152] StrStrW (lpFirst="VSTOInstaller.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.152] lstrcmpW (lpString1="VSTOInstaller.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b688 [0043.152] GetCurrentThreadId () returned 0x9b0 [0043.152] RtlWakeConditionVariable () returned 0x27e800 [0043.152] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0043.152] lstrcmpiW (lpString1="VSTOLoader.dll", lpString2="Windows") returned -1 [0043.152] lstrcmpW (lpString1="VSTOLoader.dll", lpString2="32.EXE.exe") returned 1 [0043.152] StrStrW (lpFirst="VSTOLoader.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.152] lstrcmpW (lpString1="VSTOLoader.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b688 [0043.152] GetCurrentThreadId () returned 0x9b0 [0043.152] RtlWakeConditionVariable () returned 0x27e800 [0043.152] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0043.152] lstrcmpiW (lpString1="VSTOMessageProvider.dll", lpString2="Windows") returned -1 [0043.152] lstrcmpW (lpString1="VSTOMessageProvider.dll", lpString2="32.EXE.exe") returned 1 [0043.152] StrStrW (lpFirst="VSTOMessageProvider.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.152] lstrcmpW (lpString1="VSTOMessageProvider.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee2b0 [0043.152] GetCurrentThreadId () returned 0x9b0 [0043.152] RtlWakeConditionVariable () returned 0x27e800 [0043.152] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0043.152] FindClose (in: hFindFile=0x299108 | out: hFindFile=0x299108) returned 1 [0043.152] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee2b0 [0043.152] GetCurrentThreadId () returned 0x9b0 [0043.153] RtlWakeConditionVariable () returned 0x27e800 [0043.153] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0043.153] lstrcmpiW (lpString1="vstoee.dll", lpString2="Windows") returned -1 [0043.153] lstrcmpW (lpString1="vstoee.dll", lpString2="32.EXE.exe") returned 1 [0043.153] StrStrW (lpFirst="vstoee.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.153] lstrcmpW (lpString1="vstoee.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.153] GetCurrentThreadId () returned 0x9b0 [0043.153] RtlWakeConditionVariable () returned 0x27e800 [0043.153] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0043.153] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="Windows") returned -1 [0043.153] lstrcmpW (lpString1="vstoee100.tlb", lpString2="32.EXE.exe") returned 1 [0043.153] StrStrW (lpFirst="vstoee100.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.153] lstrcmpW (lpString1="vstoee100.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.153] GetCurrentThreadId () returned 0x9b0 [0043.153] RtlWakeConditionVariable () returned 0x27e800 [0043.153] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0043.153] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="Windows") returned -1 [0043.153] lstrcmpW (lpString1="vstoee90.tlb", lpString2="32.EXE.exe") returned 1 [0043.153] StrStrW (lpFirst="vstoee90.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.153] lstrcmpW (lpString1="vstoee90.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.153] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297ac0 [0043.153] GetCurrentThreadId () returned 0x9b0 [0043.153] RtlWakeConditionVariable () returned 0x27e800 [0043.153] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0043.153] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0043.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2ee2b0 [0043.154] GetCurrentThreadId () returned 0x9b0 [0043.154] RtlWakeConditionVariable () returned 0x27e800 [0043.154] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0043.154] lstrcmpiW (lpString1="Web Folders", lpString2="Windows") returned -1 [0043.154] lstrcmpW (lpString1="Web Folders", lpString2=".") returned 1 [0043.154] lstrcmpW (lpString1="Web Folders", lpString2="..") returned 1 [0043.154] lstrcmpW (lpString1="Web Folders", lpString2="AppData") returned 1 [0043.154] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders", lpSrch="AppData") returned 0x0 [0043.154] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders", lpString2="C:\\Windows") returned -1 [0043.154] lstrlenW (lpString="C:\\Windows") returned 10 [0043.154] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders", lpString2="C:\\System Volume Information") returned -1 [0043.154] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.154] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0043.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0043.412] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.412] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.412] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.412] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.412] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.413] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.413] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.413] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.413] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.413] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.413] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.413] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.413] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.413] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0043.413] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0043.413] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0043.413] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0043.413] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033", lpSrch="AppData") returned 0x0 [0043.413] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033", lpString2="C:\\Windows") returned -1 [0043.413] lstrlenW (lpString="C:\\Windows") returned 10 [0043.413] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033", lpString2="C:\\System Volume Information") returned -1 [0043.413] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.413] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0043.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0043.414] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.414] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.414] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.414] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.414] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.414] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.415] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.415] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.415] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.415] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.415] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.415] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.416] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0043.416] lstrcmpiW (lpString1="MSOSVINT.DLL", lpString2="Windows") returned -1 [0043.416] lstrcmpW (lpString1="MSOSVINT.DLL", lpString2="32.EXE.exe") returned 1 [0043.416] StrStrW (lpFirst="MSOSVINT.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.416] lstrcmpW (lpString1="MSOSVINT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.416] GetCurrentThreadId () returned 0x9b0 [0043.416] RtlWakeConditionVariable () returned 0x27e800 [0043.416] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0043.416] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0043.416] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.416] GetCurrentThreadId () returned 0x9b0 [0043.416] RtlWakeConditionVariable () returned 0x27e800 [0043.416] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0043.416] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="Windows") returned -1 [0043.416] lstrcmpW (lpString1="MSOSV.DLL", lpString2="32.EXE.exe") returned 1 [0043.416] StrStrW (lpFirst="MSOSV.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.416] lstrcmpW (lpString1="MSOSV.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b688 [0043.417] GetCurrentThreadId () returned 0x9b0 [0043.417] RtlWakeConditionVariable () returned 0x27e800 [0043.417] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0043.417] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0043.417] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.417] GetCurrentThreadId () returned 0x9b0 [0043.417] RtlWakeConditionVariable () returned 0x27e800 [0043.418] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0043.418] lstrcmpiW (lpString1="Web Server Extensions", lpString2="Windows") returned -1 [0043.418] lstrcmpW (lpString1="Web Server Extensions", lpString2=".") returned 1 [0043.418] lstrcmpW (lpString1="Web Server Extensions", lpString2="..") returned 1 [0043.418] lstrcmpW (lpString1="Web Server Extensions", lpString2="AppData") returned 1 [0043.418] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions", lpSrch="AppData") returned 0x0 [0043.418] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions", lpString2="C:\\Windows") returned -1 [0043.418] lstrlenW (lpString="C:\\Windows") returned 10 [0043.418] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions", lpString2="C:\\System Volume Information") returned -1 [0043.418] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.418] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0043.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b3f48 [0043.502] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.502] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.502] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.502] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.502] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.502] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.502] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.502] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.502] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.502] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.502] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.502] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.502] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0043.502] lstrcmpiW (lpString1="14", lpString2="Windows") returned -1 [0043.502] lstrcmpW (lpString1="14", lpString2=".") returned 1 [0043.502] lstrcmpW (lpString1="14", lpString2="..") returned 1 [0043.502] lstrcmpW (lpString1="14", lpString2="AppData") returned -1 [0043.502] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14", lpSrch="AppData") returned 0x0 [0043.502] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14", lpString2="C:\\Windows") returned -1 [0043.502] lstrlenW (lpString="C:\\Windows") returned 10 [0043.502] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14", lpString2="C:\\System Volume Information") returned -1 [0043.503] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0043.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299108 [0043.503] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.503] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.503] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.503] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.503] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.503] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.503] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.503] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.503] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.503] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.503] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.503] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0043.504] lstrcmpiW (lpString1="BIN", lpString2="Windows") returned -1 [0043.504] lstrcmpW (lpString1="BIN", lpString2=".") returned 1 [0043.504] lstrcmpW (lpString1="BIN", lpString2="..") returned 1 [0043.504] lstrcmpW (lpString1="BIN", lpString2="AppData") returned 1 [0043.504] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN", lpSrch="AppData") returned 0x0 [0043.504] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN", lpString2="C:\\Windows") returned -1 [0043.504] lstrlenW (lpString="C:\\Windows") returned 10 [0043.504] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN", lpString2="C:\\System Volume Information") returned -1 [0043.504] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0043.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299148 [0043.515] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.516] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.516] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.516] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.516] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.516] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.516] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.516] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.516] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.516] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.516] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.516] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0043.516] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0043.516] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0043.516] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0043.516] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033", lpSrch="AppData") returned 0x0 [0043.516] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033", lpString2="C:\\Windows") returned -1 [0043.516] lstrlenW (lpString="C:\\Windows") returned 10 [0043.516] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033", lpString2="C:\\System Volume Information") returned -1 [0043.516] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.516] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2751050 [0043.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0043.517] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.517] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.517] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.517] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.517] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.517] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.517] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.517] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.517] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.517] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.517] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.517] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.517] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0043.517] lstrcmpiW (lpString1="FPEXT.MSG", lpString2="Windows") returned -1 [0043.517] lstrcmpW (lpString1="FPEXT.MSG", lpString2="32.EXE.exe") returned 1 [0043.517] StrStrW (lpFirst="FPEXT.MSG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.517] lstrcmpW (lpString1="FPEXT.MSG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.517] GetCurrentThreadId () returned 0x9b0 [0043.517] RtlWakeConditionVariable () returned 0x27e800 [0043.517] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0043.517] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0043.517] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315db0 [0043.517] GetCurrentThreadId () returned 0x9b0 [0043.517] RtlWakeConditionVariable () returned 0x27e800 [0043.518] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0043.518] lstrcmpiW (lpString1="FPSRVUTL.DLL", lpString2="Windows") returned -1 [0043.518] lstrcmpW (lpString1="FPSRVUTL.DLL", lpString2="32.EXE.exe") returned 1 [0043.518] StrStrW (lpFirst="FPSRVUTL.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.518] lstrcmpW (lpString1="FPSRVUTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.518] GetCurrentThreadId () returned 0x9b0 [0043.518] RtlWakeConditionVariable () returned 0x27e800 [0043.518] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0043.518] lstrcmpiW (lpString1="FPWEC.DLL", lpString2="Windows") returned -1 [0043.518] lstrcmpW (lpString1="FPWEC.DLL", lpString2="32.EXE.exe") returned 1 [0043.518] StrStrW (lpFirst="FPWEC.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.518] lstrcmpW (lpString1="FPWEC.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da150 [0043.518] GetCurrentThreadId () returned 0x9b0 [0043.518] RtlWakeConditionVariable () returned 0x27e800 [0043.518] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0043.518] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0043.518] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315db0 [0043.518] GetCurrentThreadId () returned 0x9b0 [0043.518] RtlWakeConditionVariable () returned 0x27e800 [0043.519] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0043.519] FindClose (in: hFindFile=0x299108 | out: hFindFile=0x299108) returned 1 [0043.519] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29ff40 [0043.519] GetCurrentThreadId () returned 0x9b0 [0043.519] RtlWakeConditionVariable () returned 0x27e800 [0043.519] FindNextFileW (in: hFindFile=0x2b3f48, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0043.519] FindClose (in: hFindFile=0x2b3f48 | out: hFindFile=0x2b3f48) returned 1 [0043.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29fd90 [0043.562] GetCurrentThreadId () returned 0x9b0 [0043.562] RtlWakeConditionVariable () returned 0x27e800 [0043.563] FindNextFileW (in: hFindFile=0x2b3fa0, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0043.563] FindClose (in: hFindFile=0x2b3fa0 | out: hFindFile=0x2b3fa0) returned 1 [0043.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e7c8 [0043.563] GetCurrentThreadId () returned 0x9b0 [0043.563] RtlWakeConditionVariable () returned 0x27e800 [0043.564] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="Services", cAlternateFileName="")) returned 1 [0043.564] lstrcmpiW (lpString1="Services", lpString2="Windows") returned -1 [0043.564] lstrcmpW (lpString1="Services", lpString2=".") returned 1 [0043.564] lstrcmpW (lpString1="Services", lpString2="..") returned 1 [0043.564] lstrcmpW (lpString1="Services", lpString2="AppData") returned 1 [0043.564] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\Services", lpSrch="AppData") returned 0x0 [0043.564] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Services", lpString2="C:\\Windows") returned -1 [0043.564] lstrlenW (lpString="C:\\Windows") returned 10 [0043.564] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\Services", lpString2="C:\\System Volume Information") returned -1 [0043.564] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0043.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e40 [0043.565] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.565] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.565] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.565] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.565] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.565] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.565] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.565] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.565] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.565] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0043.565] lstrcmpiW (lpString1="verisign.bmp", lpString2="Windows") returned -1 [0043.565] lstrcmpW (lpString1="verisign.bmp", lpString2="32.EXE.exe") returned 1 [0043.565] StrStrW (lpFirst="verisign.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.565] lstrcmpW (lpString1="verisign.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0043.565] GetCurrentThreadId () returned 0x9b0 [0043.565] RtlWakeConditionVariable () returned 0x27e800 [0043.565] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0043.565] FindClose (in: hFindFile=0x2b2e40 | out: hFindFile=0x2b2e40) returned 1 [0043.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0043.565] GetCurrentThreadId () returned 0x9b0 [0043.565] RtlWakeConditionVariable () returned 0x27e800 [0043.566] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0043.566] lstrcmpiW (lpString1="SpeechEngines", lpString2="Windows") returned -1 [0043.566] lstrcmpW (lpString1="SpeechEngines", lpString2=".") returned 1 [0043.566] lstrcmpW (lpString1="SpeechEngines", lpString2="..") returned 1 [0043.566] lstrcmpW (lpString1="SpeechEngines", lpString2="AppData") returned 1 [0043.566] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines", lpSrch="AppData") returned 0x0 [0043.566] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines", lpString2="C:\\Windows") returned -1 [0043.566] lstrlenW (lpString="C:\\Windows") returned 10 [0043.566] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines", lpString2="C:\\System Volume Information") returned -1 [0043.566] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.566] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0043.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e40 [0043.566] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.566] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.566] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.566] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.566] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.566] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.566] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.566] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.566] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.567] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.567] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.567] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.567] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.567] lstrcmpiW (lpString1="Microsoft", lpString2="Windows") returned -1 [0043.567] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0043.567] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0043.567] lstrcmpW (lpString1="Microsoft", lpString2="AppData") returned 1 [0043.567] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", lpSrch="AppData") returned 0x0 [0043.567] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", lpString2="C:\\Windows") returned -1 [0043.567] lstrlenW (lpString="C:\\Windows") returned 10 [0043.567] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", lpString2="C:\\System Volume Information") returned -1 [0043.567] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.567] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0043.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e80 [0043.674] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.674] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.674] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.675] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.675] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.675] FindNextFileW (in: hFindFile=0x2b2e80, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.675] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.675] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.675] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.675] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.675] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.675] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.675] FindNextFileW (in: hFindFile=0x2b2e80, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0043.675] lstrcmpiW (lpString1="TTS20", lpString2="Windows") returned -1 [0043.675] lstrcmpW (lpString1="TTS20", lpString2=".") returned 1 [0043.675] lstrcmpW (lpString1="TTS20", lpString2="..") returned 1 [0043.675] lstrcmpW (lpString1="TTS20", lpString2="AppData") returned 1 [0043.675] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", lpSrch="AppData") returned 0x0 [0043.675] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", lpString2="C:\\Windows") returned -1 [0043.675] lstrlenW (lpString="C:\\Windows") returned 10 [0043.675] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", lpString2="C:\\System Volume Information") returned -1 [0043.675] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0043.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0043.676] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.676] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.676] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.676] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.676] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.676] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.676] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.676] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.676] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.676] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.676] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0043.676] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0043.676] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0043.676] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0043.676] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", lpSrch="AppData") returned 0x0 [0043.676] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", lpString2="C:\\Windows") returned -1 [0043.676] lstrlenW (lpString="C:\\Windows") returned 10 [0043.676] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", lpString2="C:\\System Volume Information") returned -1 [0043.676] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0043.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0043.677] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.677] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.677] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.677] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.677] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.677] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.677] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.677] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.677] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.677] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.677] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.677] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.677] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0043.677] lstrcmpiW (lpString1="enu-dsk", lpString2="Windows") returned -1 [0043.677] lstrcmpW (lpString1="enu-dsk", lpString2=".") returned 1 [0043.677] lstrcmpW (lpString1="enu-dsk", lpString2="..") returned 1 [0043.677] lstrcmpW (lpString1="enu-dsk", lpString2="AppData") returned 1 [0043.677] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", lpSrch="AppData") returned 0x0 [0043.677] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", lpString2="C:\\Windows") returned -1 [0043.678] lstrlenW (lpString="C:\\Windows") returned 10 [0043.678] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", lpString2="C:\\System Volume Information") returned -1 [0043.678] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x3382e0 [0043.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2d90 [0043.678] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.678] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.678] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.678] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.678] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.679] FindNextFileW (in: hFindFile=0x2b2d90, lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.679] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.679] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.679] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.679] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.679] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.679] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.679] FindNextFileW (in: hFindFile=0x2b2d90, lpFindFileData=0x260e908 | out: lpFindFileData=0x260e908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.679] FindClose (in: hFindFile=0x2b2d90 | out: hFindFile=0x2b2d90) returned 1 [0043.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315be0 [0043.679] GetCurrentThreadId () returned 0x9b0 [0043.679] RtlWakeConditionVariable () returned 0x27e800 [0043.679] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="Windows") returned -1 [0043.679] lstrcmpW (lpString1="MSTTSFrontendENU.dll", lpString2="32.EXE.exe") returned 1 [0043.679] StrStrW (lpFirst="MSTTSFrontendENU.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.679] lstrcmpW (lpString1="MSTTSFrontendENU.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2da790 [0043.679] GetCurrentThreadId () returned 0x9b0 [0043.679] RtlWakeConditionVariable () returned 0x27e800 [0043.679] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="Windows") returned -1 [0043.679] lstrcmpW (lpString1="MSTTSLoc.dll.mui", lpString2="32.EXE.exe") returned 1 [0043.679] StrStrW (lpFirst="MSTTSLoc.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.679] lstrcmpW (lpString1="MSTTSLoc.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2b30 [0043.680] GetCurrentThreadId () returned 0x9b0 [0043.680] RtlWakeConditionVariable () returned 0x27e800 [0043.680] RtlWakeConditionVariable () returned 0x27e800 [0043.681] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="Windows") returned -1 [0043.681] lstrcmpW (lpString1="MSTTSCommon.dll", lpString2="32.EXE.exe") returned 1 [0043.681] StrStrW (lpFirst="MSTTSCommon.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.681] lstrcmpW (lpString1="MSTTSCommon.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.681] GetCurrentThreadId () returned 0x9b0 [0043.681] RtlWakeConditionVariable () returned 0x27e800 [0043.681] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="Windows") returned -1 [0043.681] lstrcmpW (lpString1="MSTTSEngine.dll", lpString2="32.EXE.exe") returned 1 [0043.681] StrStrW (lpFirst="MSTTSEngine.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.681] lstrcmpW (lpString1="MSTTSEngine.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.681] GetCurrentThreadId () returned 0x9b0 [0043.681] RtlWakeConditionVariable () returned 0x27e800 [0043.681] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="Windows") returned -1 [0043.681] lstrcmpW (lpString1="MSTTSLoc.dll", lpString2="32.EXE.exe") returned 1 [0043.681] StrStrW (lpFirst="MSTTSLoc.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.681] lstrcmpW (lpString1="MSTTSLoc.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29db50 [0043.682] GetCurrentThreadId () returned 0x9b0 [0043.682] RtlWakeConditionVariable () returned 0x27e800 [0043.682] RtlWakeConditionVariable () returned 0x27e800 [0043.682] RtlWakeConditionVariable () returned 0x27e800 [0043.682] RtlWakeConditionVariable () returned 0x27e800 [0043.682] lstrcmpiW (lpString1="System", lpString2="Windows") returned -1 [0043.682] lstrcmpW (lpString1="System", lpString2=".") returned 1 [0043.682] lstrcmpW (lpString1="System", lpString2="..") returned 1 [0043.682] lstrcmpW (lpString1="System", lpString2="AppData") returned 1 [0043.682] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System", lpSrch="AppData") returned 0x0 [0043.682] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System", lpString2="C:\\Windows") returned -1 [0043.682] lstrlenW (lpString="C:\\Windows") returned 10 [0043.682] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System", lpString2="C:\\System Volume Information") returned -1 [0043.682] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0043.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299108 [0043.838] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.838] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.838] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.838] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.838] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.838] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.838] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.838] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.838] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.838] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.838] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.838] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.838] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0043.838] lstrcmpiW (lpString1="ado", lpString2="Windows") returned -1 [0043.838] lstrcmpW (lpString1="ado", lpString2=".") returned 1 [0043.838] lstrcmpW (lpString1="ado", lpString2="..") returned 1 [0043.838] lstrcmpW (lpString1="ado", lpString2="AppData") returned -1 [0043.838] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado", lpSrch="AppData") returned 0x0 [0043.839] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\ado", lpString2="C:\\Windows") returned -1 [0043.839] lstrlenW (lpString="C:\\Windows") returned 10 [0043.839] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\ado", lpString2="C:\\System Volume Information") returned -1 [0043.839] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.839] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0043.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299148 [0043.841] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.841] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.841] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.841] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.841] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.841] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.841] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.841] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.841] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.841] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.841] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.841] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.841] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0043.841] lstrcmpiW (lpString1="adojavas.inc", lpString2="Windows") returned -1 [0043.841] lstrcmpW (lpString1="adojavas.inc", lpString2="32.EXE.exe") returned 1 [0043.841] StrStrW (lpFirst="adojavas.inc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.841] lstrcmpW (lpString1="adojavas.inc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.841] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.841] GetCurrentThreadId () returned 0x9b0 [0043.841] RtlWakeConditionVariable () returned 0x27e800 [0043.842] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0043.842] lstrcmpiW (lpString1="adovbs.inc", lpString2="Windows") returned -1 [0043.842] lstrcmpW (lpString1="adovbs.inc", lpString2="32.EXE.exe") returned 1 [0043.842] StrStrW (lpFirst="adovbs.inc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.842] lstrcmpW (lpString1="adovbs.inc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0043.842] GetCurrentThreadId () returned 0x9b0 [0043.842] RtlWakeConditionVariable () returned 0x27e800 [0043.842] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.842] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0043.842] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0043.842] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0043.842] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0043.842] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US", lpSrch="AppData") returned 0x0 [0043.842] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US", lpString2="C:\\Windows") returned -1 [0043.842] lstrlenW (lpString="C:\\Windows") returned 10 [0043.842] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US", lpString2="C:\\System Volume Information") returned -1 [0043.842] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.842] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0043.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0043.843] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.843] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.843] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.843] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.843] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.843] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0043.843] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.843] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.843] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.843] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.843] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.843] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.843] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0043.843] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="Windows") returned -1 [0043.843] lstrcmpW (lpString1="msader15.dll.mui", lpString2="32.EXE.exe") returned 1 [0043.843] StrStrW (lpFirst="msader15.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.843] lstrcmpW (lpString1="msader15.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.843] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.843] GetCurrentThreadId () returned 0x9b0 [0043.843] RtlWakeConditionVariable () returned 0x27e800 [0043.843] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0043.844] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0043.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b688 [0043.844] GetCurrentThreadId () returned 0x9b0 [0043.844] RtlWakeConditionVariable () returned 0x27e800 [0043.844] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0043.844] lstrcmpiW (lpString1="msader15.dll", lpString2="Windows") returned -1 [0043.844] lstrcmpW (lpString1="msader15.dll", lpString2="32.EXE.exe") returned 1 [0043.844] StrStrW (lpFirst="msader15.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.844] lstrcmpW (lpString1="msader15.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.844] GetCurrentThreadId () returned 0x9b0 [0043.844] RtlWakeConditionVariable () returned 0x27e800 [0043.844] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0043.844] lstrcmpiW (lpString1="msado15.dll", lpString2="Windows") returned -1 [0043.844] lstrcmpW (lpString1="msado15.dll", lpString2="32.EXE.exe") returned 1 [0043.844] StrStrW (lpFirst="msado15.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.844] lstrcmpW (lpString1="msado15.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.844] GetCurrentThreadId () returned 0x9b0 [0043.844] RtlWakeConditionVariable () returned 0x27e800 [0043.844] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0043.844] lstrcmpiW (lpString1="msado20.tlb", lpString2="Windows") returned -1 [0043.844] lstrcmpW (lpString1="msado20.tlb", lpString2="32.EXE.exe") returned 1 [0043.844] StrStrW (lpFirst="msado20.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.844] lstrcmpW (lpString1="msado20.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.844] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.845] GetCurrentThreadId () returned 0x9b0 [0043.845] RtlWakeConditionVariable () returned 0x27e800 [0043.845] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0043.845] lstrcmpiW (lpString1="msado21.tlb", lpString2="Windows") returned -1 [0043.845] lstrcmpW (lpString1="msado21.tlb", lpString2="32.EXE.exe") returned 1 [0043.845] StrStrW (lpFirst="msado21.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.845] lstrcmpW (lpString1="msado21.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.845] GetCurrentThreadId () returned 0x9b0 [0043.845] RtlWakeConditionVariable () returned 0x27e800 [0043.845] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0043.845] lstrcmpiW (lpString1="msado25.tlb", lpString2="Windows") returned -1 [0043.845] lstrcmpW (lpString1="msado25.tlb", lpString2="32.EXE.exe") returned 1 [0043.845] StrStrW (lpFirst="msado25.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.845] lstrcmpW (lpString1="msado25.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.845] GetCurrentThreadId () returned 0x9b0 [0043.845] RtlWakeConditionVariable () returned 0x27e800 [0043.845] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0043.845] lstrcmpiW (lpString1="msado26.tlb", lpString2="Windows") returned -1 [0043.845] lstrcmpW (lpString1="msado26.tlb", lpString2="32.EXE.exe") returned 1 [0043.845] StrStrW (lpFirst="msado26.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.845] lstrcmpW (lpString1="msado26.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.845] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.845] GetCurrentThreadId () returned 0x9b0 [0043.845] RtlWakeConditionVariable () returned 0x27e800 [0043.845] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0043.846] lstrcmpiW (lpString1="msado27.tlb", lpString2="Windows") returned -1 [0043.846] lstrcmpW (lpString1="msado27.tlb", lpString2="32.EXE.exe") returned 1 [0043.846] StrStrW (lpFirst="msado27.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.846] lstrcmpW (lpString1="msado27.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.846] GetCurrentThreadId () returned 0x9b0 [0043.846] RtlWakeConditionVariable () returned 0x27e800 [0043.846] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0043.846] lstrcmpiW (lpString1="msado28.tlb", lpString2="Windows") returned -1 [0043.846] lstrcmpW (lpString1="msado28.tlb", lpString2="32.EXE.exe") returned 1 [0043.846] StrStrW (lpFirst="msado28.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.846] lstrcmpW (lpString1="msado28.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.846] GetCurrentThreadId () returned 0x9b0 [0043.846] RtlWakeConditionVariable () returned 0x27e800 [0043.846] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0043.846] lstrcmpiW (lpString1="msadomd.dll", lpString2="Windows") returned -1 [0043.846] lstrcmpW (lpString1="msadomd.dll", lpString2="32.EXE.exe") returned 1 [0043.846] StrStrW (lpFirst="msadomd.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.846] lstrcmpW (lpString1="msadomd.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.846] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.846] GetCurrentThreadId () returned 0x9b0 [0043.846] RtlWakeConditionVariable () returned 0x27e800 [0043.846] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0043.846] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="Windows") returned -1 [0043.846] lstrcmpW (lpString1="msadomd28.tlb", lpString2="32.EXE.exe") returned 1 [0043.846] StrStrW (lpFirst="msadomd28.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.847] lstrcmpW (lpString1="msadomd28.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.847] GetCurrentThreadId () returned 0x9b0 [0043.847] RtlWakeConditionVariable () returned 0x27e800 [0043.847] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0043.847] lstrcmpiW (lpString1="msador15.dll", lpString2="Windows") returned -1 [0043.847] lstrcmpW (lpString1="msador15.dll", lpString2="32.EXE.exe") returned 1 [0043.847] StrStrW (lpFirst="msador15.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.847] lstrcmpW (lpString1="msador15.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.847] GetCurrentThreadId () returned 0x9b0 [0043.847] RtlWakeConditionVariable () returned 0x27e800 [0043.847] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0043.847] lstrcmpiW (lpString1="msadox.dll", lpString2="Windows") returned -1 [0043.847] lstrcmpW (lpString1="msadox.dll", lpString2="32.EXE.exe") returned 1 [0043.847] StrStrW (lpFirst="msadox.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.847] lstrcmpW (lpString1="msadox.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0043.847] GetCurrentThreadId () returned 0x9b0 [0043.847] RtlWakeConditionVariable () returned 0x27e800 [0043.847] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0043.847] lstrcmpiW (lpString1="msadox28.tlb", lpString2="Windows") returned -1 [0043.847] lstrcmpW (lpString1="msadox28.tlb", lpString2="32.EXE.exe") returned 1 [0043.847] StrStrW (lpFirst="msadox28.tlb", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.847] lstrcmpW (lpString1="msadox28.tlb", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.847] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.847] GetCurrentThreadId () returned 0x9b0 [0043.847] RtlWakeConditionVariable () returned 0x27e800 [0043.848] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0043.848] lstrcmpiW (lpString1="msadrh15.dll", lpString2="Windows") returned -1 [0043.848] lstrcmpW (lpString1="msadrh15.dll", lpString2="32.EXE.exe") returned 1 [0043.848] StrStrW (lpFirst="msadrh15.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.848] lstrcmpW (lpString1="msadrh15.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.848] GetCurrentThreadId () returned 0x9b0 [0043.848] RtlWakeConditionVariable () returned 0x27e800 [0043.848] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0043.848] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0043.848] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0043.848] GetCurrentThreadId () returned 0x9b0 [0043.848] RtlWakeConditionVariable () returned 0x27e800 [0043.849] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0043.849] lstrcmpiW (lpString1="DirectDB.dll", lpString2="Windows") returned -1 [0043.849] lstrcmpW (lpString1="DirectDB.dll", lpString2="32.EXE.exe") returned 1 [0043.849] StrStrW (lpFirst="DirectDB.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.849] lstrcmpW (lpString1="DirectDB.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0043.849] GetCurrentThreadId () returned 0x9b0 [0043.849] RtlWakeConditionVariable () returned 0x27e800 [0043.849] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.849] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0043.849] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0043.849] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0043.849] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0043.849] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US", lpSrch="AppData") returned 0x0 [0043.849] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\en-US", lpString2="C:\\Windows") returned -1 [0043.849] lstrlenW (lpString="C:\\Windows") returned 10 [0043.849] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\en-US", lpString2="C:\\System Volume Information") returned -1 [0043.849] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.849] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0043.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0043.850] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.850] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.850] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.850] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.850] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.850] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0043.850] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.850] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.850] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.850] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.850] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.850] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.850] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x78, dwReserved1=0x260000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0043.850] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="Windows") returned -1 [0043.850] lstrcmpW (lpString1="wab32res.dll.mui", lpString2="32.EXE.exe") returned 1 [0043.850] StrStrW (lpFirst="wab32res.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.850] lstrcmpW (lpString1="wab32res.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.851] GetCurrentThreadId () returned 0x9b0 [0043.851] RtlWakeConditionVariable () returned 0x27e800 [0043.851] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x78, dwReserved1=0x260000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0043.851] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0043.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31b688 [0043.851] GetCurrentThreadId () returned 0x9b0 [0043.851] RtlWakeConditionVariable () returned 0x27e800 [0043.851] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0043.851] lstrcmpiW (lpString1="msadc", lpString2="Windows") returned -1 [0043.851] lstrcmpW (lpString1="msadc", lpString2=".") returned 1 [0043.851] lstrcmpW (lpString1="msadc", lpString2="..") returned 1 [0043.851] lstrcmpW (lpString1="msadc", lpString2="AppData") returned 1 [0043.851] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc", lpSrch="AppData") returned 0x0 [0043.851] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\msadc", lpString2="C:\\Windows") returned -1 [0043.851] lstrlenW (lpString="C:\\Windows") returned 10 [0043.851] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\msadc", lpString2="C:\\System Volume Information") returned -1 [0043.851] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.851] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0043.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0043.919] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0043.919] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.919] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0043.919] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.919] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.919] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0043.919] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0043.919] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.919] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.919] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0043.928] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.928] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.928] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x78, dwReserved1=0x260000, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0043.928] lstrcmpiW (lpString1="adcjavas.inc", lpString2="Windows") returned -1 [0043.928] lstrcmpW (lpString1="adcjavas.inc", lpString2="32.EXE.exe") returned 1 [0043.929] StrStrW (lpFirst="adcjavas.inc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.929] lstrcmpW (lpString1="adcjavas.inc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.938] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.938] GetCurrentThreadId () returned 0x9b0 [0043.945] RtlWakeConditionVariable () returned 0x27e800 [0043.945] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x78, dwReserved1=0x260000, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0043.945] lstrcmpiW (lpString1="adcvbs.inc", lpString2="Windows") returned -1 [0043.945] lstrcmpW (lpString1="adcvbs.inc", lpString2="32.EXE.exe") returned 1 [0043.945] StrStrW (lpFirst="adcvbs.inc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0043.945] lstrcmpW (lpString1="adcvbs.inc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0043.945] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0043.946] GetCurrentThreadId () returned 0x9b0 [0043.946] RtlWakeConditionVariable () returned 0x27e800 [0043.946] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.946] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0043.946] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0043.946] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0043.946] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0043.946] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US", lpSrch="AppData") returned 0x0 [0043.946] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US", lpString2="C:\\Windows") returned -1 [0043.946] lstrlenW (lpString="C:\\Windows") returned 10 [0043.946] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US", lpString2="C:\\System Volume Information") returned -1 [0043.946] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0043.946] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0043.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0044.067] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.067] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.067] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.067] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.067] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.067] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.072] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.079] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.091] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.091] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.091] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0044.091] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="Windows") returned -1 [0044.091] lstrcmpW (lpString1="msadcer.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.091] StrStrW (lpFirst="msadcer.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.091] lstrcmpW (lpString1="msadcer.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.091] GetCurrentThreadId () returned 0x9b0 [0044.091] RtlWakeConditionVariable () returned 0x27e800 [0044.091] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0044.091] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="Windows") returned -1 [0044.091] lstrcmpW (lpString1="msadcfr.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.091] StrStrW (lpFirst="msadcfr.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.091] lstrcmpW (lpString1="msadcfr.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.091] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.091] GetCurrentThreadId () returned 0x9b0 [0044.092] RtlWakeConditionVariable () returned 0x27e800 [0044.092] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0044.092] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="Windows") returned -1 [0044.092] lstrcmpW (lpString1="msadcor.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.092] StrStrW (lpFirst="msadcor.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.092] lstrcmpW (lpString1="msadcor.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.092] GetCurrentThreadId () returned 0x9b0 [0044.092] RtlWakeConditionVariable () returned 0x27e800 [0044.092] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0044.092] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="Windows") returned -1 [0044.092] lstrcmpW (lpString1="msaddsr.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.092] StrStrW (lpFirst="msaddsr.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.092] lstrcmpW (lpString1="msaddsr.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.092] GetCurrentThreadId () returned 0x9b0 [0044.092] RtlWakeConditionVariable () returned 0x27e800 [0044.092] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0044.092] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="Windows") returned -1 [0044.092] lstrcmpW (lpString1="msdaprsr.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.092] StrStrW (lpFirst="msdaprsr.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.092] lstrcmpW (lpString1="msdaprsr.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.092] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.093] GetCurrentThreadId () returned 0x9b0 [0044.093] RtlWakeConditionVariable () returned 0x27e800 [0044.093] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0044.093] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="Windows") returned -1 [0044.093] lstrcmpW (lpString1="msdaremr.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.093] StrStrW (lpFirst="msdaremr.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.093] lstrcmpW (lpString1="msdaremr.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.093] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.093] GetCurrentThreadId () returned 0x9b0 [0044.093] RtlWakeConditionVariable () returned 0x27e800 [0044.093] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x88, dwReserved1=0x260000, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0044.093] FindClose (in: hFindFile=0x27e0f0 | out: hFindFile=0x27e0f0) returned 1 [0044.094] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.094] GetCurrentThreadId () returned 0x9b0 [0044.094] RtlWakeConditionVariable () returned 0x27e800 [0044.095] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x78, dwReserved1=0x260000, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0044.095] lstrcmpiW (lpString1="handler.reg", lpString2="Windows") returned -1 [0044.095] lstrcmpW (lpString1="handler.reg", lpString2="32.EXE.exe") returned 1 [0044.095] StrStrW (lpFirst="handler.reg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.095] lstrcmpW (lpString1="handler.reg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.095] GetCurrentThreadId () returned 0x9b0 [0044.095] RtlWakeConditionVariable () returned 0x27e800 [0044.095] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x78, dwReserved1=0x260000, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0044.095] lstrcmpiW (lpString1="handsafe.reg", lpString2="Windows") returned -1 [0044.095] lstrcmpW (lpString1="handsafe.reg", lpString2="32.EXE.exe") returned 1 [0044.095] StrStrW (lpFirst="handsafe.reg", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.095] lstrcmpW (lpString1="handsafe.reg", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.095] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.095] GetCurrentThreadId () returned 0x9b0 [0044.095] RtlWakeConditionVariable () returned 0x27e800 [0044.095] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0044.095] lstrcmpiW (lpString1="msadce.dll", lpString2="Windows") returned -1 [0044.095] lstrcmpW (lpString1="msadce.dll", lpString2="32.EXE.exe") returned 1 [0044.095] StrStrW (lpFirst="msadce.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.096] lstrcmpW (lpString1="msadce.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.096] GetCurrentThreadId () returned 0x9b0 [0044.096] RtlWakeConditionVariable () returned 0x27e800 [0044.096] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0044.096] lstrcmpiW (lpString1="msadcer.dll", lpString2="Windows") returned -1 [0044.096] lstrcmpW (lpString1="msadcer.dll", lpString2="32.EXE.exe") returned 1 [0044.096] StrStrW (lpFirst="msadcer.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.096] lstrcmpW (lpString1="msadcer.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.096] GetCurrentThreadId () returned 0x9b0 [0044.096] RtlWakeConditionVariable () returned 0x27e800 [0044.096] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0044.096] lstrcmpiW (lpString1="msadcf.dll", lpString2="Windows") returned -1 [0044.096] lstrcmpW (lpString1="msadcf.dll", lpString2="32.EXE.exe") returned 1 [0044.096] StrStrW (lpFirst="msadcf.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.096] lstrcmpW (lpString1="msadcf.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.096] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.096] GetCurrentThreadId () returned 0x9b0 [0044.096] RtlWakeConditionVariable () returned 0x27e800 [0044.096] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0044.096] lstrcmpiW (lpString1="msadcfr.dll", lpString2="Windows") returned -1 [0044.096] lstrcmpW (lpString1="msadcfr.dll", lpString2="32.EXE.exe") returned 1 [0044.096] StrStrW (lpFirst="msadcfr.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.097] lstrcmpW (lpString1="msadcfr.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.097] GetCurrentThreadId () returned 0x9b0 [0044.097] RtlWakeConditionVariable () returned 0x27e800 [0044.097] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0044.097] lstrcmpiW (lpString1="msadco.dll", lpString2="Windows") returned -1 [0044.097] lstrcmpW (lpString1="msadco.dll", lpString2="32.EXE.exe") returned 1 [0044.097] StrStrW (lpFirst="msadco.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.097] lstrcmpW (lpString1="msadco.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.097] GetCurrentThreadId () returned 0x9b0 [0044.097] RtlWakeConditionVariable () returned 0x27e800 [0044.097] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0044.097] lstrcmpiW (lpString1="msadcor.dll", lpString2="Windows") returned -1 [0044.097] lstrcmpW (lpString1="msadcor.dll", lpString2="32.EXE.exe") returned 1 [0044.097] StrStrW (lpFirst="msadcor.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.097] lstrcmpW (lpString1="msadcor.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.097] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.097] GetCurrentThreadId () returned 0x9b0 [0044.097] RtlWakeConditionVariable () returned 0x27e800 [0044.097] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0044.097] lstrcmpiW (lpString1="msadcs.dll", lpString2="Windows") returned -1 [0044.097] lstrcmpW (lpString1="msadcs.dll", lpString2="32.EXE.exe") returned 1 [0044.098] StrStrW (lpFirst="msadcs.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.098] lstrcmpW (lpString1="msadcs.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.098] GetCurrentThreadId () returned 0x9b0 [0044.098] RtlWakeConditionVariable () returned 0x27e800 [0044.098] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0044.098] lstrcmpiW (lpString1="msadds.dll", lpString2="Windows") returned -1 [0044.098] lstrcmpW (lpString1="msadds.dll", lpString2="32.EXE.exe") returned 1 [0044.098] StrStrW (lpFirst="msadds.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.098] lstrcmpW (lpString1="msadds.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.098] GetCurrentThreadId () returned 0x9b0 [0044.098] RtlWakeConditionVariable () returned 0x27e800 [0044.098] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0044.098] lstrcmpiW (lpString1="msaddsr.dll", lpString2="Windows") returned -1 [0044.098] lstrcmpW (lpString1="msaddsr.dll", lpString2="32.EXE.exe") returned 1 [0044.098] StrStrW (lpFirst="msaddsr.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.098] lstrcmpW (lpString1="msaddsr.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.098] GetCurrentThreadId () returned 0x9b0 [0044.098] RtlWakeConditionVariable () returned 0x27e800 [0044.098] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0044.098] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="Windows") returned -1 [0044.098] lstrcmpW (lpString1="msdaprsr.dll", lpString2="32.EXE.exe") returned 1 [0044.099] StrStrW (lpFirst="msdaprsr.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.099] lstrcmpW (lpString1="msdaprsr.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.099] GetCurrentThreadId () returned 0x9b0 [0044.099] RtlWakeConditionVariable () returned 0x27e800 [0044.099] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0044.099] lstrcmpiW (lpString1="msdaprst.dll", lpString2="Windows") returned -1 [0044.099] lstrcmpW (lpString1="msdaprst.dll", lpString2="32.EXE.exe") returned 1 [0044.099] StrStrW (lpFirst="msdaprst.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.099] lstrcmpW (lpString1="msdaprst.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.099] GetCurrentThreadId () returned 0x9b0 [0044.099] RtlWakeConditionVariable () returned 0x27e800 [0044.099] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0044.099] lstrcmpiW (lpString1="msdarem.dll", lpString2="Windows") returned -1 [0044.099] lstrcmpW (lpString1="msdarem.dll", lpString2="32.EXE.exe") returned 1 [0044.099] StrStrW (lpFirst="msdarem.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.099] lstrcmpW (lpString1="msdarem.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.099] GetCurrentThreadId () returned 0x9b0 [0044.099] RtlWakeConditionVariable () returned 0x27e800 [0044.099] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0044.099] lstrcmpiW (lpString1="msdaremr.dll", lpString2="Windows") returned -1 [0044.099] lstrcmpW (lpString1="msdaremr.dll", lpString2="32.EXE.exe") returned 1 [0044.100] StrStrW (lpFirst="msdaremr.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.100] lstrcmpW (lpString1="msdaremr.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.100] GetCurrentThreadId () returned 0x9b0 [0044.100] RtlWakeConditionVariable () returned 0x27e800 [0044.100] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0044.100] lstrcmpiW (lpString1="msdfmap.dll", lpString2="Windows") returned -1 [0044.100] lstrcmpW (lpString1="msdfmap.dll", lpString2="32.EXE.exe") returned 1 [0044.100] StrStrW (lpFirst="msdfmap.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.100] lstrcmpW (lpString1="msdfmap.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.100] GetCurrentThreadId () returned 0x9b0 [0044.100] RtlWakeConditionVariable () returned 0x27e800 [0044.100] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0044.100] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.100] GetCurrentThreadId () returned 0x9b0 [0044.100] RtlWakeConditionVariable () returned 0x27e800 [0044.100] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0044.100] lstrcmpiW (lpString1="MSMAPI", lpString2="Windows") returned -1 [0044.100] lstrcmpW (lpString1="MSMAPI", lpString2=".") returned 1 [0044.100] lstrcmpW (lpString1="MSMAPI", lpString2="..") returned 1 [0044.100] lstrcmpW (lpString1="MSMAPI", lpString2="AppData") returned 1 [0044.101] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI", lpSrch="AppData") returned 0x0 [0044.101] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI", lpString2="C:\\Windows") returned -1 [0044.101] lstrlenW (lpString="C:\\Windows") returned 10 [0044.101] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI", lpString2="C:\\System Volume Information") returned -1 [0044.101] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0044.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0044.156] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.156] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.156] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.156] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.156] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.156] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.156] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.156] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.156] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.156] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.156] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.156] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.156] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="1033", cAlternateFileName="")) returned 1 [0044.156] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0044.156] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0044.156] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0044.156] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0044.156] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", lpSrch="AppData") returned 0x0 [0044.156] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", lpString2="C:\\Windows") returned -1 [0044.156] lstrlenW (lpString="C:\\Windows") returned 10 [0044.156] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", lpString2="C:\\System Volume Information") returned -1 [0044.156] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.156] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0044.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2e40 [0044.157] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.157] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.157] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.157] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.157] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.157] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.157] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.157] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.157] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.157] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.157] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.157] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.158] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0044.158] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="Windows") returned -1 [0044.158] lstrcmpW (lpString1="MSMAPI32.DLL", lpString2="32.EXE.exe") returned 1 [0044.158] StrStrW (lpFirst="MSMAPI32.DLL", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.158] lstrcmpW (lpString1="MSMAPI32.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.158] GetCurrentThreadId () returned 0x9b0 [0044.158] RtlWakeConditionVariable () returned 0x27e800 [0044.158] FindNextFileW (in: hFindFile=0x2b2e40, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0044.158] FindClose (in: hFindFile=0x2b2e40 | out: hFindFile=0x2b2e40) returned 1 [0044.158] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.158] GetCurrentThreadId () returned 0x9b0 [0044.158] RtlWakeConditionVariable () returned 0x27e800 [0044.159] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="1033", cAlternateFileName="")) returned 0 [0044.159] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.159] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.159] GetCurrentThreadId () returned 0x9b0 [0044.159] RtlWakeConditionVariable () returned 0x27e800 [0044.160] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0044.160] lstrcmpiW (lpString1="Ole DB", lpString2="Windows") returned -1 [0044.160] lstrcmpW (lpString1="Ole DB", lpString2=".") returned 1 [0044.160] lstrcmpW (lpString1="Ole DB", lpString2="..") returned 1 [0044.160] lstrcmpW (lpString1="Ole DB", lpString2="AppData") returned 1 [0044.160] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB", lpSrch="AppData") returned 0x0 [0044.160] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\Ole DB", lpString2="C:\\Windows") returned -1 [0044.160] lstrlenW (lpString="C:\\Windows") returned 10 [0044.160] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\Ole DB", lpString2="C:\\System Volume Information") returned -1 [0044.160] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.160] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0044.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0044.166] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.166] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.166] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.166] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.166] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.166] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.166] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.166] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.166] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.166] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.166] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.166] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.166] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.166] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0044.166] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0044.166] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0044.166] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0044.166] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", lpSrch="AppData") returned 0x0 [0044.166] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", lpString2="C:\\Windows") returned -1 [0044.166] lstrlenW (lpString="C:\\Windows") returned 10 [0044.166] lstrcmpiW (lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", lpString2="C:\\System Volume Information") returned -1 [0044.166] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.167] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c5248 [0044.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299080 [0044.167] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.167] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.167] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.167] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.167] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.167] FindNextFileW (in: hFindFile=0x299080, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.167] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.167] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.167] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.167] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.167] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.167] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.168] FindNextFileW (in: hFindFile=0x299080, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0044.168] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="Windows") returned -1 [0044.168] lstrcmpW (lpString1="msdasqlr.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.168] StrStrW (lpFirst="msdasqlr.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.168] lstrcmpW (lpString1="msdasqlr.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.168] GetCurrentThreadId () returned 0x9b0 [0044.168] RtlWakeConditionVariable () returned 0x27e800 [0044.168] FindNextFileW (in: hFindFile=0x299080, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0044.168] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="Windows") returned -1 [0044.168] lstrcmpW (lpString1="oledb32r.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.168] StrStrW (lpFirst="oledb32r.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.168] lstrcmpW (lpString1="oledb32r.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.168] GetCurrentThreadId () returned 0x9b0 [0044.168] RtlWakeConditionVariable () returned 0x27e800 [0044.168] FindNextFileW (in: hFindFile=0x299080, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0044.168] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="Windows") returned -1 [0044.168] lstrcmpW (lpString1="sqloledb.rll.mui", lpString2="32.EXE.exe") returned 1 [0044.168] StrStrW (lpFirst="sqloledb.rll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.168] lstrcmpW (lpString1="sqloledb.rll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.168] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.168] GetCurrentThreadId () returned 0x9b0 [0044.168] RtlWakeConditionVariable () returned 0x27e800 [0044.168] FindNextFileW (in: hFindFile=0x299080, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0044.168] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="Windows") returned -1 [0044.168] lstrcmpW (lpString1="sqlxmlx.rll.mui", lpString2="32.EXE.exe") returned 1 [0044.169] StrStrW (lpFirst="sqlxmlx.rll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.169] lstrcmpW (lpString1="sqlxmlx.rll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.169] GetCurrentThreadId () returned 0x9b0 [0044.169] RtlWakeConditionVariable () returned 0x27e800 [0044.169] FindNextFileW (in: hFindFile=0x299080, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0044.169] FindClose (in: hFindFile=0x299080 | out: hFindFile=0x299080) returned 1 [0044.169] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2908 [0044.169] GetCurrentThreadId () returned 0x9b0 [0044.169] RtlWakeConditionVariable () returned 0x27e800 [0044.170] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0044.170] lstrcmpiW (lpString1="msdaosp.dll", lpString2="Windows") returned -1 [0044.170] lstrcmpW (lpString1="msdaosp.dll", lpString2="32.EXE.exe") returned 1 [0044.170] StrStrW (lpFirst="msdaosp.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.170] lstrcmpW (lpString1="msdaosp.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.170] GetCurrentThreadId () returned 0x9b0 [0044.170] RtlWakeConditionVariable () returned 0x27e800 [0044.170] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0044.170] lstrcmpiW (lpString1="msdaps.dll", lpString2="Windows") returned -1 [0044.170] lstrcmpW (lpString1="msdaps.dll", lpString2="32.EXE.exe") returned 1 [0044.170] StrStrW (lpFirst="msdaps.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.170] lstrcmpW (lpString1="msdaps.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.170] GetCurrentThreadId () returned 0x9b0 [0044.170] RtlWakeConditionVariable () returned 0x27e800 [0044.170] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0044.170] lstrcmpiW (lpString1="msdasql.dll", lpString2="Windows") returned -1 [0044.170] lstrcmpW (lpString1="msdasql.dll", lpString2="32.EXE.exe") returned 1 [0044.170] StrStrW (lpFirst="msdasql.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.170] lstrcmpW (lpString1="msdasql.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.170] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.170] GetCurrentThreadId () returned 0x9b0 [0044.170] RtlWakeConditionVariable () returned 0x27e800 [0044.170] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0044.170] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="Windows") returned -1 [0044.170] lstrcmpW (lpString1="msdasqlr.dll", lpString2="32.EXE.exe") returned 1 [0044.170] StrStrW (lpFirst="msdasqlr.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.171] lstrcmpW (lpString1="msdasqlr.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.171] GetCurrentThreadId () returned 0x9b0 [0044.171] RtlWakeConditionVariable () returned 0x27e800 [0044.171] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0044.171] lstrcmpiW (lpString1="msdatl3.dll", lpString2="Windows") returned -1 [0044.171] lstrcmpW (lpString1="msdatl3.dll", lpString2="32.EXE.exe") returned 1 [0044.171] StrStrW (lpFirst="msdatl3.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.171] lstrcmpW (lpString1="msdatl3.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.171] GetCurrentThreadId () returned 0x9b0 [0044.171] RtlWakeConditionVariable () returned 0x27e800 [0044.171] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0044.171] lstrcmpiW (lpString1="msxactps.dll", lpString2="Windows") returned -1 [0044.171] lstrcmpW (lpString1="msxactps.dll", lpString2="32.EXE.exe") returned 1 [0044.171] StrStrW (lpFirst="msxactps.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.171] lstrcmpW (lpString1="msxactps.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.171] GetCurrentThreadId () returned 0x9b0 [0044.171] RtlWakeConditionVariable () returned 0x27e800 [0044.171] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0044.171] lstrcmpiW (lpString1="oledb32.dll", lpString2="Windows") returned -1 [0044.171] lstrcmpW (lpString1="oledb32.dll", lpString2="32.EXE.exe") returned 1 [0044.171] StrStrW (lpFirst="oledb32.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.171] lstrcmpW (lpString1="oledb32.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.171] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.171] GetCurrentThreadId () returned 0x9b0 [0044.172] RtlWakeConditionVariable () returned 0x27e800 [0044.172] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0044.172] lstrcmpiW (lpString1="oledb32r.dll", lpString2="Windows") returned -1 [0044.172] lstrcmpW (lpString1="oledb32r.dll", lpString2="32.EXE.exe") returned 1 [0044.172] StrStrW (lpFirst="oledb32r.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.172] lstrcmpW (lpString1="oledb32r.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.172] GetCurrentThreadId () returned 0x9b0 [0044.172] RtlWakeConditionVariable () returned 0x27e800 [0044.172] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x78, dwReserved1=0x260000, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0044.172] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="Windows") returned -1 [0044.172] lstrcmpW (lpString1="oledbjvs.inc", lpString2="32.EXE.exe") returned 1 [0044.172] StrStrW (lpFirst="oledbjvs.inc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.172] lstrcmpW (lpString1="oledbjvs.inc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.172] GetCurrentThreadId () returned 0x9b0 [0044.172] RtlWakeConditionVariable () returned 0x27e800 [0044.172] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x78, dwReserved1=0x260000, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0044.172] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="Windows") returned -1 [0044.172] lstrcmpW (lpString1="oledbvbs.inc", lpString2="32.EXE.exe") returned 1 [0044.172] StrStrW (lpFirst="oledbvbs.inc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.172] lstrcmpW (lpString1="oledbvbs.inc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.172] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.172] GetCurrentThreadId () returned 0x9b0 [0044.172] RtlWakeConditionVariable () returned 0x27e800 [0044.172] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0044.172] lstrcmpiW (lpString1="sqloledb.dll", lpString2="Windows") returned -1 [0044.172] lstrcmpW (lpString1="sqloledb.dll", lpString2="32.EXE.exe") returned 1 [0044.173] StrStrW (lpFirst="sqloledb.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.173] lstrcmpW (lpString1="sqloledb.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.173] GetCurrentThreadId () returned 0x9b0 [0044.173] RtlWakeConditionVariable () returned 0x27e800 [0044.173] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0044.173] lstrcmpiW (lpString1="sqloledb.rll", lpString2="Windows") returned -1 [0044.173] lstrcmpW (lpString1="sqloledb.rll", lpString2="32.EXE.exe") returned 1 [0044.173] StrStrW (lpFirst="sqloledb.rll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.173] lstrcmpW (lpString1="sqloledb.rll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.173] GetCurrentThreadId () returned 0x9b0 [0044.173] RtlWakeConditionVariable () returned 0x27e800 [0044.173] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0044.173] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="Windows") returned -1 [0044.173] lstrcmpW (lpString1="sqlxmlx.dll", lpString2="32.EXE.exe") returned 1 [0044.173] StrStrW (lpFirst="sqlxmlx.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.173] lstrcmpW (lpString1="sqlxmlx.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.173] GetCurrentThreadId () returned 0x9b0 [0044.173] RtlWakeConditionVariable () returned 0x27e800 [0044.173] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x78, dwReserved1=0x260000, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0044.173] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="Windows") returned -1 [0044.173] lstrcmpW (lpString1="sqlxmlx.rll", lpString2="32.EXE.exe") returned 1 [0044.173] StrStrW (lpFirst="sqlxmlx.rll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.173] lstrcmpW (lpString1="sqlxmlx.rll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.173] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.174] GetCurrentThreadId () returned 0x9b0 [0044.174] RtlWakeConditionVariable () returned 0x27e800 [0044.174] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x78, dwReserved1=0x260000, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0044.174] lstrcmpiW (lpString1="xmlrw.dll", lpString2="Windows") returned 1 [0044.174] lstrcmpW (lpString1="xmlrw.dll", lpString2="32.EXE.exe") returned 1 [0044.174] StrStrW (lpFirst="xmlrw.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.174] lstrcmpW (lpString1="xmlrw.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.174] GetCurrentThreadId () returned 0x9b0 [0044.174] RtlWakeConditionVariable () returned 0x27e800 [0044.174] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x78, dwReserved1=0x260000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0044.174] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="Windows") returned 1 [0044.174] lstrcmpW (lpString1="xmlrwbin.dll", lpString2="32.EXE.exe") returned 1 [0044.174] StrStrW (lpFirst="xmlrwbin.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.174] lstrcmpW (lpString1="xmlrwbin.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.174] GetCurrentThreadId () returned 0x9b0 [0044.174] RtlWakeConditionVariable () returned 0x27e800 [0044.174] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x78, dwReserved1=0x260000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0044.174] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.174] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e4c8 [0044.174] GetCurrentThreadId () returned 0x9b0 [0044.174] RtlWakeConditionVariable () returned 0x27e800 [0044.174] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0044.174] lstrcmpiW (lpString1="wab32.dll", lpString2="Windows") returned -1 [0044.174] lstrcmpW (lpString1="wab32.dll", lpString2="32.EXE.exe") returned 1 [0044.175] StrStrW (lpFirst="wab32.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.175] lstrcmpW (lpString1="wab32.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.175] GetCurrentThreadId () returned 0x9b0 [0044.175] RtlWakeConditionVariable () returned 0x27e800 [0044.175] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0044.175] lstrcmpiW (lpString1="wab32res.dll", lpString2="Windows") returned -1 [0044.175] lstrcmpW (lpString1="wab32res.dll", lpString2="32.EXE.exe") returned 1 [0044.175] StrStrW (lpFirst="wab32res.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.175] lstrcmpW (lpString1="wab32res.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.175] GetCurrentThreadId () returned 0x9b0 [0044.175] RtlWakeConditionVariable () returned 0x27e800 [0044.175] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0044.175] FindClose (in: hFindFile=0x299108 | out: hFindFile=0x299108) returned 1 [0044.175] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.175] GetCurrentThreadId () returned 0x9b0 [0044.175] RtlWakeConditionVariable () returned 0x27e800 [0044.175] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="System", cAlternateFileName="")) returned 0 [0044.176] FindClose (in: hFindFile=0x2b2ec8 | out: hFindFile=0x2b2ec8) returned 1 [0044.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.176] GetCurrentThreadId () returned 0x9b0 [0044.176] RtlWakeConditionVariable () returned 0x27e800 [0044.176] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x38, dwReserved1=0x260000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.176] lstrcmpiW (lpString1="desktop.ini", lpString2="Windows") returned -1 [0044.176] lstrcmpW (lpString1="desktop.ini", lpString2="32.EXE.exe") returned 1 [0044.176] StrStrW (lpFirst="desktop.ini", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.176] lstrcmpW (lpString1="desktop.ini", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.176] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x299d80 [0044.176] GetCurrentThreadId () returned 0x9b0 [0044.176] RtlWakeConditionVariable () returned 0x27e800 [0044.176] FindNextFileW (in: hFindFile=0x27bab0, lpFindFileData=0x260fa48 | out: lpFindFileData=0x260fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96706730, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x96706730, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x260000, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0044.176] lstrcmpiW (lpString1="DVD Maker", lpString2="Windows") returned -1 [0044.176] lstrcmpW (lpString1="DVD Maker", lpString2=".") returned 1 [0044.176] lstrcmpW (lpString1="DVD Maker", lpString2="..") returned 1 [0044.176] lstrcmpW (lpString1="DVD Maker", lpString2="AppData") returned 1 [0044.176] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker", lpSrch="AppData") returned 0x0 [0044.177] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker", lpString2="C:\\Windows") returned -1 [0044.177] lstrlenW (lpString="C:\\Windows") returned 10 [0044.177] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker", lpString2="C:\\System Volume Information") returned -1 [0044.177] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.177] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0044.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96706730, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x96706730, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0044.177] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.177] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.177] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.177] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.177] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.177] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96706730, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x96706730, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.177] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.177] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.177] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.177] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.177] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.177] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.177] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x58, dwReserved1=0x260000, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0044.178] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="Windows") returned -1 [0044.178] lstrcmpW (lpString1="audiodepthconverter.ax", lpString2="32.EXE.exe") returned 1 [0044.178] StrStrW (lpFirst="audiodepthconverter.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.178] lstrcmpW (lpString1="audiodepthconverter.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.178] GetCurrentThreadId () returned 0x9b0 [0044.178] RtlWakeConditionVariable () returned 0x27e800 [0044.178] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x58, dwReserved1=0x260000, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0044.178] lstrcmpiW (lpString1="bod_r.TTF", lpString2="Windows") returned -1 [0044.178] lstrcmpW (lpString1="bod_r.TTF", lpString2="32.EXE.exe") returned 1 [0044.178] StrStrW (lpFirst="bod_r.TTF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.178] lstrcmpW (lpString1="bod_r.TTF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.178] GetCurrentThreadId () returned 0x9b0 [0044.178] RtlWakeConditionVariable () returned 0x27e800 [0044.178] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce92c590, ftCreationTime.dwHighDateTime=0x1d52cd1, ftLastAccessTime.dwLowDateTime=0x7a2c4960, ftLastAccessTime.dwHighDateTime=0x1d55dee, ftLastWriteTime.dwLowDateTime=0x7a2c4960, ftLastWriteTime.dwHighDateTime=0x1d55dee, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x58, dwReserved1=0x260000, cFileName="calendars-wooden.exe", cAlternateFileName="CALEND~1.EXE")) returned 1 [0044.178] lstrcmpiW (lpString1="calendars-wooden.exe", lpString2="Windows") returned -1 [0044.178] lstrcmpW (lpString1="calendars-wooden.exe", lpString2="32.EXE.exe") returned 1 [0044.178] StrStrW (lpFirst="calendars-wooden.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.178] lstrcmpW (lpString1="calendars-wooden.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.178] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.178] GetCurrentThreadId () returned 0x9b0 [0044.178] RtlWakeConditionVariable () returned 0x27e800 [0044.178] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x58, dwReserved1=0x260000, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0044.178] lstrcmpiW (lpString1="directshowtap.ax", lpString2="Windows") returned -1 [0044.178] lstrcmpW (lpString1="directshowtap.ax", lpString2="32.EXE.exe") returned 1 [0044.178] StrStrW (lpFirst="directshowtap.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.179] lstrcmpW (lpString1="directshowtap.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.179] GetCurrentThreadId () returned 0x9b0 [0044.179] RtlWakeConditionVariable () returned 0x27e800 [0044.179] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x58, dwReserved1=0x260000, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0044.179] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="Windows") returned -1 [0044.179] lstrcmpW (lpString1="DVDMaker.exe", lpString2="32.EXE.exe") returned 1 [0044.179] StrStrW (lpFirst="DVDMaker.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.179] lstrcmpW (lpString1="DVDMaker.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.179] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.179] GetCurrentThreadId () returned 0x9b0 [0044.179] RtlWakeConditionVariable () returned 0x27e800 [0044.179] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.179] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0044.179] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0044.179] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0044.179] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0044.179] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\en-US", lpSrch="AppData") returned 0x0 [0044.290] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\en-US", lpString2="C:\\Windows") returned -1 [0044.290] lstrlenW (lpString="C:\\Windows") returned 10 [0044.290] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\en-US", lpString2="C:\\System Volume Information") returned -1 [0044.290] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.290] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0044.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0044.290] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.290] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.290] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.290] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.290] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.290] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.291] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.291] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.291] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.291] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.291] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.291] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.291] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x68, dwReserved1=0x260000, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0044.291] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="Windows") returned -1 [0044.291] lstrcmpW (lpString1="DVDMaker.exe.mui", lpString2="32.EXE.exe") returned 1 [0044.291] StrStrW (lpFirst="DVDMaker.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.291] lstrcmpW (lpString1="DVDMaker.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.291] GetCurrentThreadId () returned 0x9b0 [0044.291] RtlWakeConditionVariable () returned 0x27e800 [0044.291] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x68, dwReserved1=0x260000, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0044.291] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="Windows") returned -1 [0044.291] lstrcmpW (lpString1="OmdProject.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.291] StrStrW (lpFirst="OmdProject.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.291] lstrcmpW (lpString1="OmdProject.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.291] GetCurrentThreadId () returned 0x9b0 [0044.291] RtlWakeConditionVariable () returned 0x27e800 [0044.291] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x68, dwReserved1=0x260000, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0044.291] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="Windows") returned 1 [0044.291] lstrcmpW (lpString1="WMM2CLIP.dll.mui", lpString2="32.EXE.exe") returned 1 [0044.291] StrStrW (lpFirst="WMM2CLIP.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.291] lstrcmpW (lpString1="WMM2CLIP.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.291] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.292] GetCurrentThreadId () returned 0x9b0 [0044.292] RtlWakeConditionVariable () returned 0x27e800 [0044.292] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x68, dwReserved1=0x260000, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0044.292] FindClose (in: hFindFile=0x27e130 | out: hFindFile=0x27e130) returned 1 [0044.292] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.292] GetCurrentThreadId () returned 0x9b0 [0044.292] RtlWakeConditionVariable () returned 0x27e800 [0044.293] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x58, dwReserved1=0x260000, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0044.293] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="Windows") returned -1 [0044.293] lstrcmpW (lpString1="Eurosti.TTF", lpString2="32.EXE.exe") returned 1 [0044.293] StrStrW (lpFirst="Eurosti.TTF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.293] lstrcmpW (lpString1="Eurosti.TTF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.293] GetCurrentThreadId () returned 0x9b0 [0044.293] RtlWakeConditionVariable () returned 0x27e800 [0044.293] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x58, dwReserved1=0x260000, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0044.293] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="Windows") returned -1 [0044.293] lstrcmpW (lpString1="fieldswitch.ax", lpString2="32.EXE.exe") returned 1 [0044.293] StrStrW (lpFirst="fieldswitch.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.293] lstrcmpW (lpString1="fieldswitch.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.293] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.293] GetCurrentThreadId () returned 0x9b0 [0044.293] RtlWakeConditionVariable () returned 0x27e800 [0044.293] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x58, dwReserved1=0x260000, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0044.294] lstrcmpiW (lpString1="offset.ax", lpString2="Windows") returned -1 [0044.294] lstrcmpW (lpString1="offset.ax", lpString2="32.EXE.exe") returned 1 [0044.294] StrStrW (lpFirst="offset.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.294] lstrcmpW (lpString1="offset.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.294] GetCurrentThreadId () returned 0x9b0 [0044.294] RtlWakeConditionVariable () returned 0x27e800 [0044.294] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x58, dwReserved1=0x260000, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0044.294] lstrcmpiW (lpString1="OmdBase.dll", lpString2="Windows") returned -1 [0044.294] lstrcmpW (lpString1="OmdBase.dll", lpString2="32.EXE.exe") returned 1 [0044.294] StrStrW (lpFirst="OmdBase.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.294] lstrcmpW (lpString1="OmdBase.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.294] GetCurrentThreadId () returned 0x9b0 [0044.294] RtlWakeConditionVariable () returned 0x27e800 [0044.294] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x58, dwReserved1=0x260000, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0044.294] lstrcmpiW (lpString1="OmdProject.dll", lpString2="Windows") returned -1 [0044.294] lstrcmpW (lpString1="OmdProject.dll", lpString2="32.EXE.exe") returned 1 [0044.294] StrStrW (lpFirst="OmdProject.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.294] lstrcmpW (lpString1="OmdProject.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.294] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.294] GetCurrentThreadId () returned 0x9b0 [0044.294] RtlWakeConditionVariable () returned 0x27e800 [0044.294] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x58, dwReserved1=0x260000, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0044.294] lstrcmpiW (lpString1="Pipeline.dll", lpString2="Windows") returned -1 [0044.294] lstrcmpW (lpString1="Pipeline.dll", lpString2="32.EXE.exe") returned 1 [0044.294] StrStrW (lpFirst="Pipeline.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.295] lstrcmpW (lpString1="Pipeline.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.295] GetCurrentThreadId () returned 0x9b0 [0044.295] RtlWakeConditionVariable () returned 0x27e800 [0044.295] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x58, dwReserved1=0x260000, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0044.295] lstrcmpiW (lpString1="PipeTran.dll", lpString2="Windows") returned -1 [0044.295] lstrcmpW (lpString1="PipeTran.dll", lpString2="32.EXE.exe") returned 1 [0044.295] StrStrW (lpFirst="PipeTran.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.295] lstrcmpW (lpString1="PipeTran.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.295] GetCurrentThreadId () returned 0x9b0 [0044.295] RtlWakeConditionVariable () returned 0x27e800 [0044.295] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x58, dwReserved1=0x260000, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0044.295] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="Windows") returned -1 [0044.295] lstrcmpW (lpString1="rtstreamsink.ax", lpString2="32.EXE.exe") returned 1 [0044.295] StrStrW (lpFirst="rtstreamsink.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.295] lstrcmpW (lpString1="rtstreamsink.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.295] GetCurrentThreadId () returned 0x9b0 [0044.295] RtlWakeConditionVariable () returned 0x27e800 [0044.295] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x58, dwReserved1=0x260000, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0044.295] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="Windows") returned -1 [0044.295] lstrcmpW (lpString1="rtstreamsource.ax", lpString2="32.EXE.exe") returned 1 [0044.295] StrStrW (lpFirst="rtstreamsource.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.295] lstrcmpW (lpString1="rtstreamsource.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.295] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.295] GetCurrentThreadId () returned 0x9b0 [0044.295] RtlWakeConditionVariable () returned 0x27e800 [0044.296] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x58, dwReserved1=0x260000, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0044.296] lstrcmpiW (lpString1="SecretST.TTF", lpString2="Windows") returned -1 [0044.296] lstrcmpW (lpString1="SecretST.TTF", lpString2="32.EXE.exe") returned 1 [0044.296] StrStrW (lpFirst="SecretST.TTF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.296] lstrcmpW (lpString1="SecretST.TTF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0044.296] GetCurrentThreadId () returned 0x9b0 [0044.296] RtlWakeConditionVariable () returned 0x27e800 [0044.296] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="Shared", cAlternateFileName="")) returned 1 [0044.296] lstrcmpiW (lpString1="Shared", lpString2="Windows") returned -1 [0044.296] lstrcmpW (lpString1="Shared", lpString2=".") returned 1 [0044.296] lstrcmpW (lpString1="Shared", lpString2="..") returned 1 [0044.296] lstrcmpW (lpString1="Shared", lpString2="AppData") returned 1 [0044.296] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared", lpSrch="AppData") returned 0x0 [0044.296] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared", lpString2="C:\\Windows") returned -1 [0044.296] lstrlenW (lpString="C:\\Windows") returned 10 [0044.296] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared", lpString2="C:\\System Volume Information") returned -1 [0044.296] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.296] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0044.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0044.307] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.307] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.307] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.307] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.307] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.307] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.307] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.307] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.307] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.307] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.307] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.307] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.307] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x68, dwReserved1=0x260000, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0044.307] lstrcmpiW (lpString1="Common.fxh", lpString2="Windows") returned -1 [0044.307] lstrcmpW (lpString1="Common.fxh", lpString2="32.EXE.exe") returned 1 [0044.307] StrStrW (lpFirst="Common.fxh", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.307] lstrcmpW (lpString1="Common.fxh", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.307] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.307] GetCurrentThreadId () returned 0x9b0 [0044.307] RtlWakeConditionVariable () returned 0x27e800 [0044.308] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x68, dwReserved1=0x260000, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0044.308] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="Windows") returned -1 [0044.308] lstrcmpW (lpString1="DissolveAnother.png", lpString2="32.EXE.exe") returned 1 [0044.308] StrStrW (lpFirst="DissolveAnother.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.308] lstrcmpW (lpString1="DissolveAnother.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.308] GetCurrentThreadId () returned 0x9b0 [0044.308] RtlWakeConditionVariable () returned 0x27e800 [0044.308] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x68, dwReserved1=0x260000, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0044.308] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="Windows") returned -1 [0044.308] lstrcmpW (lpString1="DissolveNoise.png", lpString2="32.EXE.exe") returned 1 [0044.308] StrStrW (lpFirst="DissolveNoise.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.308] lstrcmpW (lpString1="DissolveNoise.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.308] GetCurrentThreadId () returned 0x9b0 [0044.308] RtlWakeConditionVariable () returned 0x27e800 [0044.308] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0044.308] lstrcmpiW (lpString1="DvdStyles", lpString2="Windows") returned -1 [0044.308] lstrcmpW (lpString1="DvdStyles", lpString2=".") returned 1 [0044.308] lstrcmpW (lpString1="DvdStyles", lpString2="..") returned 1 [0044.308] lstrcmpW (lpString1="DvdStyles", lpString2="AppData") returned 1 [0044.308] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles", lpSrch="AppData") returned 0x0 [0044.308] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles", lpString2="C:\\Windows") returned -1 [0044.308] lstrlenW (lpString="C:\\Windows") returned 10 [0044.308] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles", lpString2="C:\\System Volume Information") returned -1 [0044.308] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.308] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0044.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299108 [0044.429] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.429] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.429] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.429] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.429] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.429] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.513] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.513] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.513] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.514] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.514] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.514] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.514] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x78, dwReserved1=0x260000, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0044.514] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="Windows") returned -1 [0044.514] lstrcmpW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="32.EXE.exe") returned -1 [0044.514] StrStrW (lpFirst="16to9Squareframe_Buttongraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.514] lstrcmpW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.524] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0044.524] GetCurrentThreadId () returned 0x9b0 [0044.538] RtlWakeConditionVariable () returned 0x27e800 [0044.538] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x78, dwReserved1=0x260000, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.538] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.538] lstrcmpW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="32.EXE.exe") returned -1 [0044.538] StrStrW (lpFirst="16to9Squareframe_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.538] lstrcmpW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2db348 [0044.538] GetCurrentThreadId () returned 0x9b0 [0044.538] RtlWakeConditionVariable () returned 0x27e800 [0044.538] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x78, dwReserved1=0x260000, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0044.538] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="Windows") returned -1 [0044.538] lstrcmpW (lpString1="16to9Squareframe_VideoInset.png", lpString2="32.EXE.exe") returned -1 [0044.539] StrStrW (lpFirst="16to9Squareframe_VideoInset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.539] lstrcmpW (lpString1="16to9Squareframe_VideoInset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.539] GetCurrentThreadId () returned 0x9b0 [0044.539] RtlWakeConditionVariable () returned 0x27e800 [0044.539] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x78, dwReserved1=0x260000, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0044.539] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="Windows") returned -1 [0044.539] lstrcmpW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="32.EXE.exe") returned 1 [0044.539] StrStrW (lpFirst="4to3Squareframe_Buttongraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.539] lstrcmpW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0044.539] GetCurrentThreadId () returned 0x9b0 [0044.539] RtlWakeConditionVariable () returned 0x27e800 [0044.539] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x78, dwReserved1=0x260000, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.539] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.539] lstrcmpW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.539] StrStrW (lpFirst="4to3Squareframe_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.539] lstrcmpW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ba78 [0044.539] GetCurrentThreadId () returned 0x9b0 [0044.539] RtlWakeConditionVariable () returned 0x27e800 [0044.539] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x78, dwReserved1=0x260000, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0044.539] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="Windows") returned -1 [0044.539] lstrcmpW (lpString1="4to3Squareframe_VideoInset.png", lpString2="32.EXE.exe") returned 1 [0044.539] StrStrW (lpFirst="4to3Squareframe_VideoInset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.539] lstrcmpW (lpString1="4to3Squareframe_VideoInset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e960 [0044.540] GetCurrentThreadId () returned 0x9b0 [0044.540] RtlWakeConditionVariable () returned 0x27e800 [0044.540] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0044.540] lstrcmpiW (lpString1="BabyBoy", lpString2="Windows") returned -1 [0044.540] lstrcmpW (lpString1="BabyBoy", lpString2=".") returned 1 [0044.540] lstrcmpW (lpString1="BabyBoy", lpString2="..") returned 1 [0044.540] lstrcmpW (lpString1="BabyBoy", lpString2="AppData") returned 1 [0044.540] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy", lpSrch="AppData") returned 0x0 [0044.540] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy", lpString2="C:\\Windows") returned -1 [0044.540] lstrlenW (lpString="C:\\Windows") returned 10 [0044.540] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy", lpString2="C:\\System Volume Information") returned -1 [0044.540] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0044.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0044.558] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.558] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.558] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.558] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.558] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.558] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.559] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.559] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.559] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.559] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.559] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.559] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.559] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0044.559] lstrcmpiW (lpString1="babyblue.png", lpString2="Windows") returned -1 [0044.559] lstrcmpW (lpString1="babyblue.png", lpString2="32.EXE.exe") returned 1 [0044.559] StrStrW (lpFirst="babyblue.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.559] lstrcmpW (lpString1="babyblue.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0044.559] GetCurrentThreadId () returned 0x9b0 [0044.559] RtlWakeConditionVariable () returned 0x27e800 [0044.559] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0044.559] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="Windows") returned -1 [0044.559] lstrcmpW (lpString1="BabyBoyMainBackground.wmv", lpString2="32.EXE.exe") returned 1 [0044.559] StrStrW (lpFirst="BabyBoyMainBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.559] lstrcmpW (lpString1="BabyBoyMainBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.559] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.559] GetCurrentThreadId () returned 0x9b0 [0044.559] RtlWakeConditionVariable () returned 0x27e800 [0044.559] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0044.559] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="Windows") returned -1 [0044.559] lstrcmpW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.559] StrStrW (lpFirst="BabyBoyMainBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.560] lstrcmpW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.560] GetCurrentThreadId () returned 0x9b0 [0044.560] RtlWakeConditionVariable () returned 0x27e800 [0044.560] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0044.560] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="Windows") returned -1 [0044.560] lstrcmpW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0044.560] StrStrW (lpFirst="BabyBoyMainToNotesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.560] lstrcmpW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.560] GetCurrentThreadId () returned 0x9b0 [0044.560] RtlWakeConditionVariable () returned 0x27e800 [0044.560] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0044.560] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="Windows") returned -1 [0044.560] lstrcmpW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.560] StrStrW (lpFirst="BabyBoyMainToNotesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.560] lstrcmpW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.560] GetCurrentThreadId () returned 0x9b0 [0044.560] RtlWakeConditionVariable () returned 0x27e800 [0044.560] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0044.560] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="Windows") returned -1 [0044.560] lstrcmpW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0044.560] StrStrW (lpFirst="BabyBoyMainToScenesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.560] lstrcmpW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.560] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.560] GetCurrentThreadId () returned 0x9b0 [0044.561] RtlWakeConditionVariable () returned 0x27e800 [0044.561] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0044.561] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="Windows") returned -1 [0044.561] lstrcmpW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.561] StrStrW (lpFirst="BabyBoyMainToScenesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.561] lstrcmpW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0044.561] GetCurrentThreadId () returned 0x9b0 [0044.561] RtlWakeConditionVariable () returned 0x27e800 [0044.561] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0044.561] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="Windows") returned -1 [0044.561] lstrcmpW (lpString1="BabyBoyNotesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0044.561] StrStrW (lpFirst="BabyBoyNotesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.561] lstrcmpW (lpString1="BabyBoyNotesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.561] GetCurrentThreadId () returned 0x9b0 [0044.561] RtlWakeConditionVariable () returned 0x27e800 [0044.561] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0044.561] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="Windows") returned -1 [0044.561] lstrcmpW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.561] StrStrW (lpFirst="BabyBoyNotesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.561] lstrcmpW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.561] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.561] GetCurrentThreadId () returned 0x9b0 [0044.561] RtlWakeConditionVariable () returned 0x27e800 [0044.562] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0044.562] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="Windows") returned -1 [0044.562] lstrcmpW (lpString1="BabyBoyScenesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0044.562] StrStrW (lpFirst="BabyBoyScenesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.562] lstrcmpW (lpString1="BabyBoyScenesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.562] GetCurrentThreadId () returned 0x9b0 [0044.562] RtlWakeConditionVariable () returned 0x27e800 [0044.562] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0044.562] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="Windows") returned -1 [0044.562] lstrcmpW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.562] StrStrW (lpFirst="BabyBoyScenesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.562] lstrcmpW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.562] GetCurrentThreadId () returned 0x9b0 [0044.562] RtlWakeConditionVariable () returned 0x27e800 [0044.562] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0044.562] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="Windows") returned -1 [0044.562] lstrcmpW (lpString1="LightBlueRectangle.PNG", lpString2="32.EXE.exe") returned 1 [0044.562] StrStrW (lpFirst="LightBlueRectangle.PNG", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.562] lstrcmpW (lpString1="LightBlueRectangle.PNG", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.562] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.562] GetCurrentThreadId () returned 0x9b0 [0044.562] RtlWakeConditionVariable () returned 0x27e800 [0044.562] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0044.562] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="Windows") returned -1 [0044.562] lstrcmpW (lpString1="MainMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0044.563] StrStrW (lpFirst="MainMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.563] lstrcmpW (lpString1="MainMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.563] GetCurrentThreadId () returned 0x9b0 [0044.563] RtlWakeConditionVariable () returned 0x27e800 [0044.563] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0044.563] lstrcmpiW (lpString1="navSubpicture.png", lpString2="Windows") returned -1 [0044.563] lstrcmpW (lpString1="navSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.563] StrStrW (lpFirst="navSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.563] lstrcmpW (lpString1="navSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.563] GetCurrentThreadId () returned 0x9b0 [0044.563] RtlWakeConditionVariable () returned 0x27e800 [0044.563] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0044.563] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="Windows") returned -1 [0044.563] lstrcmpW (lpString1="nav_leftarrow.png", lpString2="32.EXE.exe") returned 1 [0044.563] StrStrW (lpFirst="nav_leftarrow.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.563] lstrcmpW (lpString1="nav_leftarrow.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.563] GetCurrentThreadId () returned 0x9b0 [0044.563] RtlWakeConditionVariable () returned 0x27e800 [0044.563] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0044.563] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="Windows") returned -1 [0044.563] lstrcmpW (lpString1="nav_rightarrow.png", lpString2="32.EXE.exe") returned 1 [0044.563] StrStrW (lpFirst="nav_rightarrow.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.563] lstrcmpW (lpString1="nav_rightarrow.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.563] GetCurrentThreadId () returned 0x9b0 [0044.564] RtlWakeConditionVariable () returned 0x27e800 [0044.564] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0044.564] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="Windows") returned -1 [0044.564] lstrcmpW (lpString1="nav_uparrow.png", lpString2="32.EXE.exe") returned 1 [0044.564] StrStrW (lpFirst="nav_uparrow.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.564] lstrcmpW (lpString1="nav_uparrow.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.564] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x2977c8 [0044.564] GetCurrentThreadId () returned 0x9b0 [0044.564] RtlWakeConditionVariable () returned 0x27e800 [0044.564] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0044.564] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.565] GetCurrentThreadId () returned 0x9b0 [0044.565] RtlWakeConditionVariable () returned 0x27e800 [0044.565] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0044.565] lstrcmpiW (lpString1="BabyGirl", lpString2="Windows") returned -1 [0044.565] lstrcmpW (lpString1="BabyGirl", lpString2=".") returned 1 [0044.565] lstrcmpW (lpString1="BabyGirl", lpString2="..") returned 1 [0044.565] lstrcmpW (lpString1="BabyGirl", lpString2="AppData") returned 1 [0044.565] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl", lpSrch="AppData") returned 0x0 [0044.565] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl", lpString2="C:\\Windows") returned -1 [0044.565] lstrlenW (lpString="C:\\Windows") returned 10 [0044.565] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl", lpString2="C:\\System Volume Information") returned -1 [0044.565] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.565] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0044.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0044.609] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.609] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.609] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.609] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.609] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.610] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.610] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.610] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.610] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.610] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.610] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.610] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.610] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0044.610] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="Windows") returned -1 [0044.610] lstrcmpW (lpString1="16_9-frame-background.png", lpString2="32.EXE.exe") returned -1 [0044.610] StrStrW (lpFirst="16_9-frame-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.610] lstrcmpW (lpString1="16_9-frame-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.610] GetCurrentThreadId () returned 0x9b0 [0044.610] RtlWakeConditionVariable () returned 0x27e800 [0044.610] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0044.610] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="Windows") returned -1 [0044.610] lstrcmpW (lpString1="16_9-frame-highlight.png", lpString2="32.EXE.exe") returned -1 [0044.610] StrStrW (lpFirst="16_9-frame-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.610] lstrcmpW (lpString1="16_9-frame-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.610] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.610] GetCurrentThreadId () returned 0x9b0 [0044.610] RtlWakeConditionVariable () returned 0x27e800 [0044.610] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0044.610] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="Windows") returned -1 [0044.611] lstrcmpW (lpString1="16_9-frame-image-mask.png", lpString2="32.EXE.exe") returned -1 [0044.611] StrStrW (lpFirst="16_9-frame-image-mask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.611] lstrcmpW (lpString1="16_9-frame-image-mask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.611] GetCurrentThreadId () returned 0x9b0 [0044.611] RtlWakeConditionVariable () returned 0x27e800 [0044.611] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0044.611] lstrcmpiW (lpString1="babypink.png", lpString2="Windows") returned -1 [0044.611] lstrcmpW (lpString1="babypink.png", lpString2="32.EXE.exe") returned 1 [0044.611] StrStrW (lpFirst="babypink.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.611] lstrcmpW (lpString1="babypink.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.611] GetCurrentThreadId () returned 0x9b0 [0044.611] RtlWakeConditionVariable () returned 0x27e800 [0044.611] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="background.png", cAlternateFileName="")) returned 1 [0044.611] lstrcmpiW (lpString1="background.png", lpString2="Windows") returned -1 [0044.611] lstrcmpW (lpString1="background.png", lpString2="32.EXE.exe") returned 1 [0044.611] StrStrW (lpFirst="background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.611] lstrcmpW (lpString1="background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.611] GetCurrentThreadId () returned 0x9b0 [0044.611] RtlWakeConditionVariable () returned 0x27e800 [0044.611] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0044.611] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="Windows") returned -1 [0044.611] lstrcmpW (lpString1="bear_formatted_matte2.wmv", lpString2="32.EXE.exe") returned 1 [0044.611] StrStrW (lpFirst="bear_formatted_matte2.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.611] lstrcmpW (lpString1="bear_formatted_matte2.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.611] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.612] GetCurrentThreadId () returned 0x9b0 [0044.612] RtlWakeConditionVariable () returned 0x27e800 [0044.612] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0044.612] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="Windows") returned -1 [0044.612] lstrcmpW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.612] StrStrW (lpFirst="Bear_Formatted_MATTE2_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.612] lstrcmpW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.612] GetCurrentThreadId () returned 0x9b0 [0044.612] RtlWakeConditionVariable () returned 0x27e800 [0044.612] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0044.612] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="Windows") returned -1 [0044.612] lstrcmpW (lpString1="bear_formatted_rgb6.wmv", lpString2="32.EXE.exe") returned 1 [0044.612] StrStrW (lpFirst="bear_formatted_rgb6.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.612] lstrcmpW (lpString1="bear_formatted_rgb6.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.612] GetCurrentThreadId () returned 0x9b0 [0044.612] RtlWakeConditionVariable () returned 0x27e800 [0044.612] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0044.612] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="Windows") returned -1 [0044.612] lstrcmpW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.612] StrStrW (lpFirst="Bear_Formatted_RGB6_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.612] lstrcmpW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.612] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.612] GetCurrentThreadId () returned 0x9b0 [0044.612] RtlWakeConditionVariable () returned 0x27e800 [0044.613] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0044.613] lstrcmpiW (lpString1="btn-back-static.png", lpString2="Windows") returned -1 [0044.613] lstrcmpW (lpString1="btn-back-static.png", lpString2="32.EXE.exe") returned 1 [0044.613] StrStrW (lpFirst="btn-back-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.613] lstrcmpW (lpString1="btn-back-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.613] GetCurrentThreadId () returned 0x9b0 [0044.613] RtlWakeConditionVariable () returned 0x27e800 [0044.613] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0044.613] lstrcmpiW (lpString1="btn-next-static.png", lpString2="Windows") returned -1 [0044.613] lstrcmpW (lpString1="btn-next-static.png", lpString2="32.EXE.exe") returned 1 [0044.613] StrStrW (lpFirst="btn-next-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.613] lstrcmpW (lpString1="btn-next-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.613] GetCurrentThreadId () returned 0x9b0 [0044.613] RtlWakeConditionVariable () returned 0x27e800 [0044.613] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0044.613] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="Windows") returned -1 [0044.613] lstrcmpW (lpString1="btn-previous-static.png", lpString2="32.EXE.exe") returned 1 [0044.613] StrStrW (lpFirst="btn-previous-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.613] lstrcmpW (lpString1="btn-previous-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.613] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.613] GetCurrentThreadId () returned 0x9b0 [0044.613] RtlWakeConditionVariable () returned 0x27e800 [0044.613] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0044.613] lstrcmpiW (lpString1="button-highlight.png", lpString2="Windows") returned -1 [0044.614] lstrcmpW (lpString1="button-highlight.png", lpString2="32.EXE.exe") returned 1 [0044.614] StrStrW (lpFirst="button-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.614] lstrcmpW (lpString1="button-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.614] GetCurrentThreadId () returned 0x9b0 [0044.614] RtlWakeConditionVariable () returned 0x27e800 [0044.614] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0044.614] lstrcmpiW (lpString1="chapters-static.png", lpString2="Windows") returned -1 [0044.614] lstrcmpW (lpString1="chapters-static.png", lpString2="32.EXE.exe") returned 1 [0044.614] StrStrW (lpFirst="chapters-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.614] lstrcmpW (lpString1="chapters-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.614] GetCurrentThreadId () returned 0x9b0 [0044.614] RtlWakeConditionVariable () returned 0x27e800 [0044.614] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0044.614] lstrcmpiW (lpString1="content-background.png", lpString2="Windows") returned -1 [0044.614] lstrcmpW (lpString1="content-background.png", lpString2="32.EXE.exe") returned 1 [0044.614] StrStrW (lpFirst="content-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.614] lstrcmpW (lpString1="content-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.614] GetCurrentThreadId () returned 0x9b0 [0044.614] RtlWakeConditionVariable () returned 0x27e800 [0044.614] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0044.614] lstrcmpiW (lpString1="content-foreground.png", lpString2="Windows") returned -1 [0044.614] lstrcmpW (lpString1="content-foreground.png", lpString2="32.EXE.exe") returned 1 [0044.614] StrStrW (lpFirst="content-foreground.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.614] lstrcmpW (lpString1="content-foreground.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.614] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.615] GetCurrentThreadId () returned 0x9b0 [0044.615] RtlWakeConditionVariable () returned 0x27e800 [0044.615] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0044.615] lstrcmpiW (lpString1="curtains.png", lpString2="Windows") returned -1 [0044.615] lstrcmpW (lpString1="curtains.png", lpString2="32.EXE.exe") returned 1 [0044.615] StrStrW (lpFirst="curtains.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.615] lstrcmpW (lpString1="curtains.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.615] GetCurrentThreadId () returned 0x9b0 [0044.615] RtlWakeConditionVariable () returned 0x27e800 [0044.615] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0044.615] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="Windows") returned -1 [0044.615] lstrcmpW (lpString1="flower_precomp_matte.wmv", lpString2="32.EXE.exe") returned 1 [0044.615] StrStrW (lpFirst="flower_precomp_matte.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.615] lstrcmpW (lpString1="flower_precomp_matte.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.615] GetCurrentThreadId () returned 0x9b0 [0044.615] RtlWakeConditionVariable () returned 0x27e800 [0044.615] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0044.615] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="Windows") returned -1 [0044.615] lstrcmpW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.615] StrStrW (lpFirst="flower_PreComp_MATTE_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.615] lstrcmpW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.615] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.615] GetCurrentThreadId () returned 0x9b0 [0044.615] RtlWakeConditionVariable () returned 0x27e800 [0044.616] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0044.616] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="Windows") returned -1 [0044.616] lstrcmpW (lpString1="flower_trans_matte.wmv", lpString2="32.EXE.exe") returned 1 [0044.616] StrStrW (lpFirst="flower_trans_matte.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.616] lstrcmpW (lpString1="flower_trans_matte.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.616] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.616] GetCurrentThreadId () returned 0x9b0 [0044.616] RtlWakeConditionVariable () returned 0x27e800 [0044.616] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0044.616] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="Windows") returned -1 [0044.616] lstrcmpW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.624] StrStrW (lpFirst="flower_trans_MATTE_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.624] lstrcmpW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.624] GetCurrentThreadId () returned 0x9b0 [0044.624] RtlWakeConditionVariable () returned 0x27e800 [0044.624] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0044.624] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="Windows") returned -1 [0044.624] lstrcmpW (lpString1="flower_trans_rgb.wmv", lpString2="32.EXE.exe") returned 1 [0044.624] StrStrW (lpFirst="flower_trans_rgb.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.625] lstrcmpW (lpString1="flower_trans_rgb.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.625] GetCurrentThreadId () returned 0x9b0 [0044.625] RtlWakeConditionVariable () returned 0x27e800 [0044.625] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0044.625] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="Windows") returned -1 [0044.625] lstrcmpW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0044.625] StrStrW (lpFirst="flower_trans_RGB_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.625] lstrcmpW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.625] GetCurrentThreadId () returned 0x9b0 [0044.625] RtlWakeConditionVariable () returned 0x27e800 [0044.625] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0044.625] lstrcmpiW (lpString1="highlight.png", lpString2="Windows") returned -1 [0044.625] lstrcmpW (lpString1="highlight.png", lpString2="32.EXE.exe") returned 1 [0044.625] StrStrW (lpFirst="highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.625] lstrcmpW (lpString1="highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.625] GetCurrentThreadId () returned 0x9b0 [0044.625] RtlWakeConditionVariable () returned 0x27e800 [0044.625] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0044.625] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="Windows") returned -1 [0044.625] lstrcmpW (lpString1="mainimage-mask.png", lpString2="32.EXE.exe") returned 1 [0044.625] StrStrW (lpFirst="mainimage-mask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.625] lstrcmpW (lpString1="mainimage-mask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.625] GetCurrentThreadId () returned 0x9b0 [0044.626] RtlWakeConditionVariable () returned 0x27e800 [0044.626] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0044.626] lstrcmpiW (lpString1="notes-static.png", lpString2="Windows") returned -1 [0044.626] lstrcmpW (lpString1="notes-static.png", lpString2="32.EXE.exe") returned 1 [0044.626] StrStrW (lpFirst="notes-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.626] lstrcmpW (lpString1="notes-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.626] GetCurrentThreadId () returned 0x9b0 [0044.626] RtlWakeConditionVariable () returned 0x27e800 [0044.626] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0044.626] lstrcmpiW (lpString1="play-static.png", lpString2="Windows") returned -1 [0044.626] lstrcmpW (lpString1="play-static.png", lpString2="32.EXE.exe") returned 1 [0044.626] StrStrW (lpFirst="play-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.626] lstrcmpW (lpString1="play-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.626] GetCurrentThreadId () returned 0x9b0 [0044.626] RtlWakeConditionVariable () returned 0x27e800 [0044.626] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0044.626] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.627] GetCurrentThreadId () returned 0x9b0 [0044.627] RtlWakeConditionVariable () returned 0x27e800 [0044.627] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x78, dwReserved1=0x260000, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0044.627] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="Windows") returned -1 [0044.627] lstrcmpW (lpString1="BlackRectangle.bmp", lpString2="32.EXE.exe") returned 1 [0044.627] StrStrW (lpFirst="BlackRectangle.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.627] lstrcmpW (lpString1="BlackRectangle.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.627] GetCurrentThreadId () returned 0x9b0 [0044.627] RtlWakeConditionVariable () returned 0x27e800 [0044.627] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x78, dwReserved1=0x260000, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0044.627] lstrcmpiW (lpString1="circleround_glass.png", lpString2="Windows") returned -1 [0044.627] lstrcmpW (lpString1="circleround_glass.png", lpString2="32.EXE.exe") returned 1 [0044.627] StrStrW (lpFirst="circleround_glass.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.628] lstrcmpW (lpString1="circleround_glass.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.628] GetCurrentThreadId () returned 0x9b0 [0044.628] RtlWakeConditionVariable () returned 0x27e800 [0044.628] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x78, dwReserved1=0x260000, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0044.628] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="Windows") returned -1 [0044.628] lstrcmpW (lpString1="circleround_selectionsubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.628] StrStrW (lpFirst="circleround_selectionsubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.628] lstrcmpW (lpString1="circleround_selectionsubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.628] GetCurrentThreadId () returned 0x9b0 [0044.628] RtlWakeConditionVariable () returned 0x27e800 [0044.628] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x78, dwReserved1=0x260000, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0044.628] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="Windows") returned -1 [0044.628] lstrcmpW (lpString1="circleround_videoinset.png", lpString2="32.EXE.exe") returned 1 [0044.628] StrStrW (lpFirst="circleround_videoinset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.628] lstrcmpW (lpString1="circleround_videoinset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.628] GetCurrentThreadId () returned 0x9b0 [0044.628] RtlWakeConditionVariable () returned 0x27e800 [0044.628] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.628] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.628] lstrcmpW (lpString1="Circle_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.628] StrStrW (lpFirst="Circle_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.628] lstrcmpW (lpString1="Circle_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.628] GetCurrentThreadId () returned 0x9b0 [0044.629] RtlWakeConditionVariable () returned 0x27e800 [0044.629] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0044.629] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="Windows") returned -1 [0044.629] lstrcmpW (lpString1="circle_glass_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0044.629] StrStrW (lpFirst="circle_glass_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.629] lstrcmpW (lpString1="circle_glass_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.629] GetCurrentThreadId () returned 0x9b0 [0044.629] RtlWakeConditionVariable () returned 0x27e800 [0044.629] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0044.629] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="Windows") returned -1 [0044.629] lstrcmpW (lpString1="Circle_SelectionSubpictureA.png", lpString2="32.EXE.exe") returned 1 [0044.629] StrStrW (lpFirst="Circle_SelectionSubpictureA.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.629] lstrcmpW (lpString1="Circle_SelectionSubpictureA.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.629] GetCurrentThreadId () returned 0x9b0 [0044.629] RtlWakeConditionVariable () returned 0x27e800 [0044.629] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0044.629] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="Windows") returned -1 [0044.629] lstrcmpW (lpString1="Circle_SelectionSubpictureB.png", lpString2="32.EXE.exe") returned 1 [0044.629] StrStrW (lpFirst="Circle_SelectionSubpictureB.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.629] lstrcmpW (lpString1="Circle_SelectionSubpictureB.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29daa8 [0044.629] GetCurrentThreadId () returned 0x9b0 [0044.629] RtlWakeConditionVariable () returned 0x27e800 [0044.629] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0044.630] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="Windows") returned -1 [0044.630] lstrcmpW (lpString1="Circle_VideoInset.png", lpString2="32.EXE.exe") returned 1 [0044.630] StrStrW (lpFirst="Circle_VideoInset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.630] lstrcmpW (lpString1="Circle_VideoInset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.630] GetCurrentThreadId () returned 0x9b0 [0044.630] RtlWakeConditionVariable () returned 0x27e800 [0044.630] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0044.630] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="Windows") returned -1 [0044.630] lstrcmpW (lpString1="cloud_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0044.630] StrStrW (lpFirst="cloud_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.630] lstrcmpW (lpString1="cloud_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297308 [0044.630] GetCurrentThreadId () returned 0x9b0 [0044.630] RtlWakeConditionVariable () returned 0x27e800 [0044.630] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0044.630] lstrcmpiW (lpString1="Dot.png", lpString2="Windows") returned -1 [0044.630] lstrcmpW (lpString1="Dot.png", lpString2="32.EXE.exe") returned 1 [0044.630] StrStrW (lpFirst="Dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.630] lstrcmpW (lpString1="Dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0044.630] GetCurrentThreadId () returned 0x9b0 [0044.630] RtlWakeConditionVariable () returned 0x27e800 [0044.630] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x78, dwReserved1=0x260000, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0044.630] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="Windows") returned -1 [0044.630] lstrcmpW (lpString1="DvdTransform.fx", lpString2="32.EXE.exe") returned 1 [0044.630] StrStrW (lpFirst="DvdTransform.fx", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.631] lstrcmpW (lpString1="DvdTransform.fx", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.631] GetCurrentThreadId () returned 0x9b0 [0044.631] RtlWakeConditionVariable () returned 0x27e800 [0044.631] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0044.631] lstrcmpiW (lpString1="FlipPage", lpString2="Windows") returned -1 [0044.631] lstrcmpW (lpString1="FlipPage", lpString2=".") returned 1 [0044.631] lstrcmpW (lpString1="FlipPage", lpString2="..") returned 1 [0044.631] lstrcmpW (lpString1="FlipPage", lpString2="AppData") returned 1 [0044.631] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage", lpSrch="AppData") returned 0x0 [0044.631] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage", lpString2="C:\\Windows") returned -1 [0044.631] lstrlenW (lpString="C:\\Windows") returned 10 [0044.631] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage", lpString2="C:\\System Volume Information") returned -1 [0044.631] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0044.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0044.859] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.859] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.859] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.859] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.859] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.859] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.859] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.859] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.859] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.859] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.859] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.859] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.859] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x88, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0044.859] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0044.859] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0044.859] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.859] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.859] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.859] GetCurrentThreadId () returned 0x9b0 [0044.859] RtlWakeConditionVariable () returned 0x27e800 [0044.860] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x88, dwReserved1=0x260000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0044.860] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="Windows") returned -1 [0044.860] lstrcmpW (lpString1="203x8subpicture.png", lpString2="32.EXE.exe") returned -1 [0044.860] StrStrW (lpFirst="203x8subpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.860] lstrcmpW (lpString1="203x8subpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29d808 [0044.860] GetCurrentThreadId () returned 0x9b0 [0044.860] RtlWakeConditionVariable () returned 0x27e800 [0044.860] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.860] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.860] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.860] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.860] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.860] GetCurrentThreadId () returned 0x9b0 [0044.860] RtlWakeConditionVariable () returned 0x27e800 [0044.860] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.860] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.860] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.860] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.860] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.860] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.860] GetCurrentThreadId () returned 0x9b0 [0044.860] RtlWakeConditionVariable () returned 0x27e800 [0044.860] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.860] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.860] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.860] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.860] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.861] GetCurrentThreadId () returned 0x9b0 [0044.861] RtlWakeConditionVariable () returned 0x27e800 [0044.861] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.861] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.861] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.861] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.861] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0044.861] GetCurrentThreadId () returned 0x9b0 [0044.861] RtlWakeConditionVariable () returned 0x27e800 [0044.861] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.861] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.861] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.861] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.861] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.861] GetCurrentThreadId () returned 0x9b0 [0044.861] RtlWakeConditionVariable () returned 0x27e800 [0044.861] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.861] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.861] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.861] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.861] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.861] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.861] GetCurrentThreadId () returned 0x9b0 [0044.861] RtlWakeConditionVariable () returned 0x27e800 [0044.861] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x88, dwReserved1=0x260000, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0044.862] lstrcmpiW (lpString1="pagecurl.png", lpString2="Windows") returned -1 [0044.862] lstrcmpW (lpString1="pagecurl.png", lpString2="32.EXE.exe") returned 1 [0044.862] StrStrW (lpFirst="pagecurl.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.862] lstrcmpW (lpString1="pagecurl.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.862] GetCurrentThreadId () returned 0x9b0 [0044.862] RtlWakeConditionVariable () returned 0x27e800 [0044.862] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x88, dwReserved1=0x260000, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0044.862] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.862] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.863] GetCurrentThreadId () returned 0x9b0 [0044.863] RtlWakeConditionVariable () returned 0x27e800 [0044.863] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Full", cAlternateFileName="")) returned 1 [0044.863] lstrcmpiW (lpString1="Full", lpString2="Windows") returned -1 [0044.863] lstrcmpW (lpString1="Full", lpString2=".") returned 1 [0044.863] lstrcmpW (lpString1="Full", lpString2="..") returned 1 [0044.863] lstrcmpW (lpString1="Full", lpString2="AppData") returned 1 [0044.863] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full", lpSrch="AppData") returned 0x0 [0044.863] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full", lpString2="C:\\Windows") returned -1 [0044.863] lstrlenW (lpString="C:\\Windows") returned 10 [0044.863] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full", lpString2="C:\\System Volume Information") returned -1 [0044.863] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.863] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0044.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0044.869] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0044.869] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0044.869] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0044.869] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.869] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.869] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0044.869] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0044.869] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0044.869] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0044.869] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0044.869] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.869] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.869] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x88, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0044.869] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0044.869] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0044.869] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.869] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.869] GetCurrentThreadId () returned 0x9b0 [0044.869] RtlWakeConditionVariable () returned 0x27e800 [0044.869] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x88, dwReserved1=0x260000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0044.869] lstrcmpiW (lpString1="15x15dot.png", lpString2="Windows") returned -1 [0044.869] lstrcmpW (lpString1="15x15dot.png", lpString2="32.EXE.exe") returned -1 [0044.869] StrStrW (lpFirst="15x15dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.869] lstrcmpW (lpString1="15x15dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.869] GetCurrentThreadId () returned 0x9b0 [0044.870] RtlWakeConditionVariable () returned 0x27e800 [0044.870] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x88, dwReserved1=0x260000, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0044.870] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="Windows") returned -1 [0044.870] lstrcmpW (lpString1="dotsdarkoverlay.png", lpString2="32.EXE.exe") returned 1 [0044.870] StrStrW (lpFirst="dotsdarkoverlay.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.870] lstrcmpW (lpString1="dotsdarkoverlay.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f290 [0044.870] GetCurrentThreadId () returned 0x9b0 [0044.870] RtlWakeConditionVariable () returned 0x27e800 [0044.870] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x88, dwReserved1=0x260000, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0044.870] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="Windows") returned -1 [0044.870] lstrcmpW (lpString1="dotslightoverlay.png", lpString2="32.EXE.exe") returned 1 [0044.870] StrStrW (lpFirst="dotslightoverlay.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.870] lstrcmpW (lpString1="dotslightoverlay.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f290 [0044.870] GetCurrentThreadId () returned 0x9b0 [0044.870] RtlWakeConditionVariable () returned 0x27e800 [0044.870] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x88, dwReserved1=0x260000, cFileName="full.png", cAlternateFileName="")) returned 1 [0044.870] lstrcmpiW (lpString1="full.png", lpString2="Windows") returned -1 [0044.870] lstrcmpW (lpString1="full.png", lpString2="32.EXE.exe") returned 1 [0044.870] StrStrW (lpFirst="full.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.870] lstrcmpW (lpString1="full.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0044.870] GetCurrentThreadId () returned 0x9b0 [0044.870] RtlWakeConditionVariable () returned 0x27e800 [0044.870] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.870] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.870] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.871] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.871] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.871] GetCurrentThreadId () returned 0x9b0 [0044.871] RtlWakeConditionVariable () returned 0x27e800 [0044.871] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.871] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.871] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.871] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.871] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.871] GetCurrentThreadId () returned 0x9b0 [0044.871] RtlWakeConditionVariable () returned 0x27e800 [0044.871] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.871] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.871] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.871] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.871] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.871] GetCurrentThreadId () returned 0x9b0 [0044.871] RtlWakeConditionVariable () returned 0x27e800 [0044.871] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.871] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.871] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.871] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.871] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.871] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.871] GetCurrentThreadId () returned 0x9b0 [0044.871] RtlWakeConditionVariable () returned 0x27e800 [0044.872] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.872] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.872] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.872] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.872] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0044.872] GetCurrentThreadId () returned 0x9b0 [0044.872] RtlWakeConditionVariable () returned 0x27e800 [0044.872] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x88, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.872] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.872] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.872] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.872] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daf60 [0044.872] GetCurrentThreadId () returned 0x9b0 [0044.872] RtlWakeConditionVariable () returned 0x27e800 [0044.872] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x88, dwReserved1=0x260000, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0044.872] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="Windows") returned -1 [0044.872] lstrcmpW (lpString1="pushplaysubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.872] StrStrW (lpFirst="pushplaysubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.872] lstrcmpW (lpString1="pushplaysubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.872] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f290 [0044.872] GetCurrentThreadId () returned 0x9b0 [0044.872] RtlWakeConditionVariable () returned 0x27e800 [0044.872] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x88, dwReserved1=0x260000, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0 [0044.872] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0044.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f290 [0044.873] GetCurrentThreadId () returned 0x9b0 [0044.873] RtlWakeConditionVariable () returned 0x27e800 [0044.873] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0044.873] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="Windows") returned -1 [0044.873] lstrcmpW (lpString1="Heart_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0044.873] StrStrW (lpFirst="Heart_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.873] lstrcmpW (lpString1="Heart_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.873] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.873] GetCurrentThreadId () returned 0x9b0 [0044.873] RtlWakeConditionVariable () returned 0x27e800 [0044.873] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0044.874] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="Windows") returned -1 [0044.874] lstrcmpW (lpString1="heart_glass_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0044.874] StrStrW (lpFirst="heart_glass_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.874] lstrcmpW (lpString1="heart_glass_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f290 [0044.874] GetCurrentThreadId () returned 0x9b0 [0044.874] RtlWakeConditionVariable () returned 0x27e800 [0044.874] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0044.874] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="Windows") returned -1 [0044.874] lstrcmpW (lpString1="Heart_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0044.874] StrStrW (lpFirst="Heart_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.874] lstrcmpW (lpString1="Heart_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f290 [0044.874] GetCurrentThreadId () returned 0x9b0 [0044.874] RtlWakeConditionVariable () returned 0x27e800 [0044.874] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0044.874] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="Windows") returned -1 [0044.874] lstrcmpW (lpString1="Heart_VideoInset.png", lpString2="32.EXE.exe") returned 1 [0044.874] StrStrW (lpFirst="Heart_VideoInset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0044.874] lstrcmpW (lpString1="Heart_VideoInset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0044.874] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0044.874] GetCurrentThreadId () returned 0x9b0 [0044.874] RtlWakeConditionVariable () returned 0x27e800 [0044.874] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0044.874] lstrcmpiW (lpString1="HueCycle", lpString2="Windows") returned -1 [0044.874] lstrcmpW (lpString1="HueCycle", lpString2=".") returned 1 [0044.874] lstrcmpW (lpString1="HueCycle", lpString2="..") returned 1 [0044.874] lstrcmpW (lpString1="HueCycle", lpString2="AppData") returned 1 [0044.874] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle", lpSrch="AppData") returned 0x0 [0044.875] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle", lpString2="C:\\Windows") returned -1 [0044.875] lstrlenW (lpString="C:\\Windows") returned 10 [0044.875] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle", lpString2="C:\\System Volume Information") returned -1 [0044.875] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0044.875] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0044.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.005] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.005] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.005] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.005] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.005] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.005] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.005] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.005] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.005] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.005] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.005] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.005] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.005] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x98, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.005] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.005] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.005] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.005] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0045.005] GetCurrentThreadId () returned 0x9b0 [0045.005] RtlWakeConditionVariable () returned 0x27e800 [0045.005] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x98, dwReserved1=0x260000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0045.005] lstrcmpiW (lpString1="15x15dot.png", lpString2="Windows") returned -1 [0045.005] lstrcmpW (lpString1="15x15dot.png", lpString2="32.EXE.exe") returned -1 [0045.005] StrStrW (lpFirst="15x15dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.006] lstrcmpW (lpString1="15x15dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.006] GetCurrentThreadId () returned 0x9b0 [0045.006] RtlWakeConditionVariable () returned 0x27e800 [0045.006] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x98, dwReserved1=0x260000, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0045.006] lstrcmpiW (lpString1="colorcycle.png", lpString2="Windows") returned -1 [0045.006] lstrcmpW (lpString1="colorcycle.png", lpString2="32.EXE.exe") returned 1 [0045.006] StrStrW (lpFirst="colorcycle.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.006] lstrcmpW (lpString1="colorcycle.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.006] GetCurrentThreadId () returned 0x9b0 [0045.006] RtlWakeConditionVariable () returned 0x27e800 [0045.006] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x98, dwReserved1=0x260000, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0045.006] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="Windows") returned -1 [0045.006] lstrcmpW (lpString1="huemainsubpicture2.png", lpString2="32.EXE.exe") returned 1 [0045.006] StrStrW (lpFirst="huemainsubpicture2.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.006] lstrcmpW (lpString1="huemainsubpicture2.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0045.006] GetCurrentThreadId () returned 0x9b0 [0045.006] RtlWakeConditionVariable () returned 0x27e800 [0045.006] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.006] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.006] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.006] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.006] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.006] GetCurrentThreadId () returned 0x9b0 [0045.007] RtlWakeConditionVariable () returned 0x27e800 [0045.007] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.007] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.007] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.007] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.007] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.007] GetCurrentThreadId () returned 0x9b0 [0045.007] RtlWakeConditionVariable () returned 0x27e800 [0045.007] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.007] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.007] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.007] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.007] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.007] GetCurrentThreadId () returned 0x9b0 [0045.007] RtlWakeConditionVariable () returned 0x27e800 [0045.007] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.007] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.007] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.007] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.007] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.007] GetCurrentThreadId () returned 0x9b0 [0045.007] RtlWakeConditionVariable () returned 0x27e800 [0045.007] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.007] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.007] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.008] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.008] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b068 [0045.008] GetCurrentThreadId () returned 0x9b0 [0045.008] RtlWakeConditionVariable () returned 0x27e800 [0045.008] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.008] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.008] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.008] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.008] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.008] GetCurrentThreadId () returned 0x9b0 [0045.008] RtlWakeConditionVariable () returned 0x27e800 [0045.008] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x98, dwReserved1=0x260000, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0045.008] lstrcmpiW (lpString1="title_stripe.png", lpString2="Windows") returned -1 [0045.008] lstrcmpW (lpString1="title_stripe.png", lpString2="32.EXE.exe") returned 1 [0045.008] StrStrW (lpFirst="title_stripe.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.008] lstrcmpW (lpString1="title_stripe.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30eca8 [0045.008] GetCurrentThreadId () returned 0x9b0 [0045.008] RtlWakeConditionVariable () returned 0x27e800 [0045.008] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x98, dwReserved1=0x260000, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0045.008] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0045.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29b068 [0045.009] GetCurrentThreadId () returned 0x9b0 [0045.009] RtlWakeConditionVariable () returned 0x27e800 [0045.009] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0045.009] lstrcmpiW (lpString1="LayeredTitles", lpString2="Windows") returned -1 [0045.009] lstrcmpW (lpString1="LayeredTitles", lpString2=".") returned 1 [0045.009] lstrcmpW (lpString1="LayeredTitles", lpString2="..") returned 1 [0045.009] lstrcmpW (lpString1="LayeredTitles", lpString2="AppData") returned 1 [0045.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles", lpSrch="AppData") returned 0x0 [0045.009] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles", lpString2="C:\\Windows") returned -1 [0045.009] lstrlenW (lpString="C:\\Windows") returned 10 [0045.009] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles", lpString2="C:\\System Volume Information") returned -1 [0045.009] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.177] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.177] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.187] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.187] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.187] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.187] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.187] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.187] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.199] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.199] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.199] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.199] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x98, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.199] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.199] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.199] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.199] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f7d0 [0045.199] GetCurrentThreadId () returned 0x9b0 [0045.199] RtlWakeConditionVariable () returned 0x27e800 [0045.199] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x98, dwReserved1=0x260000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0045.199] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="Windows") returned -1 [0045.199] lstrcmpW (lpString1="203x8subpicture.png", lpString2="32.EXE.exe") returned -1 [0045.199] StrStrW (lpFirst="203x8subpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.199] lstrcmpW (lpString1="203x8subpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.199] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.200] GetCurrentThreadId () returned 0x9b0 [0045.200] RtlWakeConditionVariable () returned 0x27e800 [0045.200] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x98, dwReserved1=0x260000, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0045.200] lstrcmpiW (lpString1="blackbars60.png", lpString2="Windows") returned -1 [0045.200] lstrcmpW (lpString1="blackbars60.png", lpString2="32.EXE.exe") returned 1 [0045.200] StrStrW (lpFirst="blackbars60.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.200] lstrcmpW (lpString1="blackbars60.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f7d0 [0045.200] GetCurrentThreadId () returned 0x9b0 [0045.200] RtlWakeConditionVariable () returned 0x27e800 [0045.200] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x98, dwReserved1=0x260000, cFileName="layers.png", cAlternateFileName="")) returned 1 [0045.200] lstrcmpiW (lpString1="layers.png", lpString2="Windows") returned -1 [0045.200] lstrcmpW (lpString1="layers.png", lpString2="32.EXE.exe") returned 1 [0045.200] StrStrW (lpFirst="layers.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.200] lstrcmpW (lpString1="layers.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30f7d0 [0045.200] GetCurrentThreadId () returned 0x9b0 [0045.200] RtlWakeConditionVariable () returned 0x27e800 [0045.200] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.200] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.200] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.200] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.200] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.200] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.200] GetCurrentThreadId () returned 0x9b0 [0045.200] RtlWakeConditionVariable () returned 0x27e800 [0045.200] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.200] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.201] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.201] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.201] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f880 [0045.201] GetCurrentThreadId () returned 0x9b0 [0045.201] RtlWakeConditionVariable () returned 0x27e800 [0045.201] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.201] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.201] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.201] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.201] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.201] GetCurrentThreadId () returned 0x9b0 [0045.201] RtlWakeConditionVariable () returned 0x27e800 [0045.201] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.201] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.201] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.201] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.201] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f880 [0045.201] GetCurrentThreadId () returned 0x9b0 [0045.201] RtlWakeConditionVariable () returned 0x27e800 [0045.201] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.201] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.201] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.201] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.201] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.201] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.201] GetCurrentThreadId () returned 0x9b0 [0045.202] RtlWakeConditionVariable () returned 0x27e800 [0045.202] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.202] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.202] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.202] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.202] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.202] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f880 [0045.202] GetCurrentThreadId () returned 0x9b0 [0045.202] RtlWakeConditionVariable () returned 0x27e800 [0045.202] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x98, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0 [0045.202] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0045.203] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.203] GetCurrentThreadId () returned 0x9b0 [0045.203] RtlWakeConditionVariable () returned 0x27e800 [0045.203] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Memories", cAlternateFileName="")) returned 1 [0045.214] lstrcmpiW (lpString1="Memories", lpString2="Windows") returned -1 [0045.214] lstrcmpW (lpString1="Memories", lpString2=".") returned 1 [0045.214] lstrcmpW (lpString1="Memories", lpString2="..") returned 1 [0045.214] lstrcmpW (lpString1="Memories", lpString2="AppData") returned 1 [0045.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories", lpSrch="AppData") returned 0x0 [0045.214] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories", lpString2="C:\\Windows") returned -1 [0045.214] lstrlenW (lpString="C:\\Windows") returned 10 [0045.214] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories", lpString2="C:\\System Volume Information") returned -1 [0045.214] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.333] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.333] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.333] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.333] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.333] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.333] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.333] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.333] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.333] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.333] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.333] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.333] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.333] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x98, dwReserved1=0x260000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0045.333] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="Windows") returned -1 [0045.333] lstrcmpW (lpString1="16_9-frame-background.png", lpString2="32.EXE.exe") returned -1 [0045.333] StrStrW (lpFirst="16_9-frame-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.333] lstrcmpW (lpString1="16_9-frame-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.333] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.333] GetCurrentThreadId () returned 0x9b0 [0045.353] RtlWakeConditionVariable () returned 0x27e800 [0045.353] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x98, dwReserved1=0x260000, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0045.353] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="Windows") returned -1 [0045.353] lstrcmpW (lpString1="16_9-frame-highlight.png", lpString2="32.EXE.exe") returned -1 [0045.353] StrStrW (lpFirst="16_9-frame-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.353] lstrcmpW (lpString1="16_9-frame-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.353] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.353] GetCurrentThreadId () returned 0x9b0 [0045.353] RtlWakeConditionVariable () returned 0x27e800 [0045.353] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x98, dwReserved1=0x260000, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0045.354] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="Windows") returned -1 [0045.354] lstrcmpW (lpString1="16_9-frame-image-mask.png", lpString2="32.EXE.exe") returned -1 [0045.354] StrStrW (lpFirst="16_9-frame-image-mask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.354] lstrcmpW (lpString1="16_9-frame-image-mask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.354] GetCurrentThreadId () returned 0x9b0 [0045.354] RtlWakeConditionVariable () returned 0x27e800 [0045.354] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x98, dwReserved1=0x260000, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0045.354] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="Windows") returned -1 [0045.354] lstrcmpW (lpString1="16_9-frame-overlay.png", lpString2="32.EXE.exe") returned -1 [0045.354] StrStrW (lpFirst="16_9-frame-overlay.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.354] lstrcmpW (lpString1="16_9-frame-overlay.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.354] GetCurrentThreadId () returned 0x9b0 [0045.354] RtlWakeConditionVariable () returned 0x27e800 [0045.354] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x98, dwReserved1=0x260000, cFileName="background.png", cAlternateFileName="")) returned 1 [0045.354] lstrcmpiW (lpString1="background.png", lpString2="Windows") returned -1 [0045.354] lstrcmpW (lpString1="background.png", lpString2="32.EXE.exe") returned 1 [0045.354] StrStrW (lpFirst="background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.354] lstrcmpW (lpString1="background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.354] GetCurrentThreadId () returned 0x9b0 [0045.354] RtlWakeConditionVariable () returned 0x27e800 [0045.354] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x98, dwReserved1=0x260000, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0045.354] lstrcmpiW (lpString1="btn-back-static.png", lpString2="Windows") returned -1 [0045.354] lstrcmpW (lpString1="btn-back-static.png", lpString2="32.EXE.exe") returned 1 [0045.354] StrStrW (lpFirst="btn-back-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.354] lstrcmpW (lpString1="btn-back-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.354] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.355] GetCurrentThreadId () returned 0x9b0 [0045.355] RtlWakeConditionVariable () returned 0x27e800 [0045.355] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x98, dwReserved1=0x260000, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0045.355] lstrcmpiW (lpString1="btn-next-static.png", lpString2="Windows") returned -1 [0045.355] lstrcmpW (lpString1="btn-next-static.png", lpString2="32.EXE.exe") returned 1 [0045.355] StrStrW (lpFirst="btn-next-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.355] lstrcmpW (lpString1="btn-next-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.355] GetCurrentThreadId () returned 0x9b0 [0045.355] RtlWakeConditionVariable () returned 0x27e800 [0045.355] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x98, dwReserved1=0x260000, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0045.355] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="Windows") returned -1 [0045.355] lstrcmpW (lpString1="btn-previous-static.png", lpString2="32.EXE.exe") returned 1 [0045.355] StrStrW (lpFirst="btn-previous-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.355] lstrcmpW (lpString1="btn-previous-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.355] GetCurrentThreadId () returned 0x9b0 [0045.355] RtlWakeConditionVariable () returned 0x27e800 [0045.355] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x98, dwReserved1=0x260000, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0045.355] lstrcmpiW (lpString1="button-highlight.png", lpString2="Windows") returned -1 [0045.355] lstrcmpW (lpString1="button-highlight.png", lpString2="32.EXE.exe") returned 1 [0045.355] StrStrW (lpFirst="button-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.355] lstrcmpW (lpString1="button-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.355] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.355] GetCurrentThreadId () returned 0x9b0 [0045.355] RtlWakeConditionVariable () returned 0x27e800 [0045.355] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x98, dwReserved1=0x260000, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0045.355] lstrcmpiW (lpString1="button-overlay.png", lpString2="Windows") returned -1 [0045.356] lstrcmpW (lpString1="button-overlay.png", lpString2="32.EXE.exe") returned 1 [0045.356] StrStrW (lpFirst="button-overlay.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.356] lstrcmpW (lpString1="button-overlay.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.356] GetCurrentThreadId () returned 0x9b0 [0045.356] RtlWakeConditionVariable () returned 0x27e800 [0045.356] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0045.356] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="Windows") returned -1 [0045.356] lstrcmpW (lpString1="Memories_buttonClear.png", lpString2="32.EXE.exe") returned 1 [0045.356] StrStrW (lpFirst="Memories_buttonClear.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.356] lstrcmpW (lpString1="Memories_buttonClear.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.356] GetCurrentThreadId () returned 0x9b0 [0045.356] RtlWakeConditionVariable () returned 0x27e800 [0045.356] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0045.356] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="Windows") returned -1 [0045.356] lstrcmpW (lpString1="Notes_btn-back-static.png", lpString2="32.EXE.exe") returned 1 [0045.356] StrStrW (lpFirst="Notes_btn-back-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.356] lstrcmpW (lpString1="Notes_btn-back-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.356] GetCurrentThreadId () returned 0x9b0 [0045.356] RtlWakeConditionVariable () returned 0x27e800 [0045.356] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0045.356] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="Windows") returned -1 [0045.356] lstrcmpW (lpString1="Notes_content-background.png", lpString2="32.EXE.exe") returned 1 [0045.356] StrStrW (lpFirst="Notes_content-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.356] lstrcmpW (lpString1="Notes_content-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.356] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.357] GetCurrentThreadId () returned 0x9b0 [0045.357] RtlWakeConditionVariable () returned 0x27e800 [0045.357] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x98, dwReserved1=0x260000, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0045.357] lstrcmpiW (lpString1="scrapbook.png", lpString2="Windows") returned -1 [0045.357] lstrcmpW (lpString1="scrapbook.png", lpString2="32.EXE.exe") returned 1 [0045.357] StrStrW (lpFirst="scrapbook.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.357] lstrcmpW (lpString1="scrapbook.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.357] GetCurrentThreadId () returned 0x9b0 [0045.357] RtlWakeConditionVariable () returned 0x27e800 [0045.357] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0045.357] lstrcmpiW (lpString1="Title_content-background.png", lpString2="Windows") returned -1 [0045.357] lstrcmpW (lpString1="Title_content-background.png", lpString2="32.EXE.exe") returned 1 [0045.357] StrStrW (lpFirst="Title_content-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.357] lstrcmpW (lpString1="Title_content-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.357] GetCurrentThreadId () returned 0x9b0 [0045.357] RtlWakeConditionVariable () returned 0x27e800 [0045.357] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0045.357] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="Windows") returned -1 [0045.357] lstrcmpW (lpString1="Title_mainImage-mask.png", lpString2="32.EXE.exe") returned 1 [0045.357] StrStrW (lpFirst="Title_mainImage-mask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.357] lstrcmpW (lpString1="Title_mainImage-mask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.357] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.357] GetCurrentThreadId () returned 0x9b0 [0045.357] RtlWakeConditionVariable () returned 0x27e800 [0045.358] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0045.358] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="Windows") returned -1 [0045.358] lstrcmpW (lpString1="Title_select-highlight.png", lpString2="32.EXE.exe") returned 1 [0045.358] StrStrW (lpFirst="Title_select-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.358] lstrcmpW (lpString1="Title_select-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.358] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.358] GetCurrentThreadId () returned 0x9b0 [0045.358] RtlWakeConditionVariable () returned 0x27e800 [0045.358] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x98, dwReserved1=0x260000, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0045.358] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0045.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.359] GetCurrentThreadId () returned 0x9b0 [0045.359] RtlWakeConditionVariable () returned 0x27e800 [0045.359] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x78, dwReserved1=0x260000, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0045.359] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="Windows") returned -1 [0045.359] lstrcmpW (lpString1="menu_style_default_Thumbnail.png", lpString2="32.EXE.exe") returned 1 [0045.359] StrStrW (lpFirst="menu_style_default_Thumbnail.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.359] lstrcmpW (lpString1="menu_style_default_Thumbnail.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.359] GetCurrentThreadId () returned 0x9b0 [0045.359] RtlWakeConditionVariable () returned 0x27e800 [0045.359] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.359] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.359] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.359] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.359] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.359] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.359] GetCurrentThreadId () returned 0x9b0 [0045.359] RtlWakeConditionVariable () returned 0x27e800 [0045.359] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x78, dwReserved1=0x260000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.359] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.360] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.360] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.360] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.360] GetCurrentThreadId () returned 0x9b0 [0045.360] RtlWakeConditionVariable () returned 0x27e800 [0045.360] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x78, dwReserved1=0x260000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.360] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.360] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.360] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.360] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.360] GetCurrentThreadId () returned 0x9b0 [0045.360] RtlWakeConditionVariable () returned 0x27e800 [0045.360] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x78, dwReserved1=0x260000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.360] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.360] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.360] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.360] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.360] GetCurrentThreadId () returned 0x9b0 [0045.360] RtlWakeConditionVariable () returned 0x27e800 [0045.360] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x78, dwReserved1=0x260000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.360] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.360] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.360] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.360] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.360] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30e030 [0045.361] GetCurrentThreadId () returned 0x9b0 [0045.361] RtlWakeConditionVariable () returned 0x27e800 [0045.361] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x78, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.361] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.361] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.361] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.361] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f3bb8 [0045.361] GetCurrentThreadId () returned 0x9b0 [0045.361] RtlWakeConditionVariable () returned 0x27e800 [0045.361] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="OldAge", cAlternateFileName="")) returned 1 [0045.361] lstrcmpiW (lpString1="OldAge", lpString2="Windows") returned -1 [0045.361] lstrcmpW (lpString1="OldAge", lpString2=".") returned 1 [0045.361] lstrcmpW (lpString1="OldAge", lpString2="..") returned 1 [0045.361] lstrcmpW (lpString1="OldAge", lpString2="AppData") returned 1 [0045.361] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge", lpSrch="AppData") returned 0x0 [0045.361] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge", lpString2="C:\\Windows") returned -1 [0045.361] lstrlenW (lpString="C:\\Windows") returned 10 [0045.361] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge", lpString2="C:\\System Volume Information") returned -1 [0045.361] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.361] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.399] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.399] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.399] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.399] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.399] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.399] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.399] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.399] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.399] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.399] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.400] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.400] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.400] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.400] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.400] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.400] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.400] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f67f8 [0045.400] GetCurrentThreadId () returned 0x9b0 [0045.400] RtlWakeConditionVariable () returned 0x27e800 [0045.400] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0045.400] lstrcmpiW (lpString1="15x15dot.png", lpString2="Windows") returned -1 [0045.400] lstrcmpW (lpString1="15x15dot.png", lpString2="32.EXE.exe") returned -1 [0045.400] StrStrW (lpFirst="15x15dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.400] lstrcmpW (lpString1="15x15dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.400] GetCurrentThreadId () returned 0x9b0 [0045.400] RtlWakeConditionVariable () returned 0x27e800 [0045.400] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0045.400] lstrcmpiW (lpString1="decorative_rule.png", lpString2="Windows") returned -1 [0045.400] lstrcmpW (lpString1="decorative_rule.png", lpString2="32.EXE.exe") returned 1 [0045.400] StrStrW (lpFirst="decorative_rule.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.400] lstrcmpW (lpString1="decorative_rule.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.400] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f67f8 [0045.400] GetCurrentThreadId () returned 0x9b0 [0045.400] RtlWakeConditionVariable () returned 0x27e800 [0045.400] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.400] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.400] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.401] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.401] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0045.401] GetCurrentThreadId () returned 0x9b0 [0045.401] RtlWakeConditionVariable () returned 0x27e800 [0045.401] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.401] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.401] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.401] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.401] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.401] GetCurrentThreadId () returned 0x9b0 [0045.401] RtlWakeConditionVariable () returned 0x27e800 [0045.401] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.401] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.401] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.401] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.401] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.401] GetCurrentThreadId () returned 0x9b0 [0045.401] RtlWakeConditionVariable () returned 0x27e800 [0045.401] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.401] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.401] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.401] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.401] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.401] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.401] GetCurrentThreadId () returned 0x9b0 [0045.402] RtlWakeConditionVariable () returned 0x27e800 [0045.402] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0045.402] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.402] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.402] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.402] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0045.402] GetCurrentThreadId () returned 0x9b0 [0045.402] RtlWakeConditionVariable () returned 0x27e800 [0045.402] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0045.402] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.402] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.402] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.402] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.402] GetCurrentThreadId () returned 0x9b0 [0045.402] RtlWakeConditionVariable () returned 0x27e800 [0045.402] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0045.402] lstrcmpiW (lpString1="vintage.png", lpString2="Windows") returned -1 [0045.402] lstrcmpW (lpString1="vintage.png", lpString2="32.EXE.exe") returned 1 [0045.402] StrStrW (lpFirst="vintage.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.402] lstrcmpW (lpString1="vintage.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.402] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.402] GetCurrentThreadId () returned 0x9b0 [0045.402] RtlWakeConditionVariable () returned 0x27e800 [0045.402] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0045.402] FindClose (in: hFindFile=0x299148 | out: hFindFile=0x299148) returned 1 [0045.403] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29ad88 [0045.403] GetCurrentThreadId () returned 0x9b0 [0045.403] RtlWakeConditionVariable () returned 0x27e800 [0045.403] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x260000, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0045.403] lstrcmpiW (lpString1="Performance", lpString2="Windows") returned -1 [0045.403] lstrcmpW (lpString1="Performance", lpString2=".") returned 1 [0045.403] lstrcmpW (lpString1="Performance", lpString2="..") returned 1 [0045.403] lstrcmpW (lpString1="Performance", lpString2="AppData") returned 1 [0045.403] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance", lpSrch="AppData") returned 0x0 [0045.403] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance", lpString2="C:\\Windows") returned -1 [0045.403] lstrlenW (lpString="C:\\Windows") returned 10 [0045.403] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance", lpString2="C:\\System Volume Information") returned -1 [0045.403] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.404] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0045.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.459] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.459] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.459] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.459] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.459] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.459] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.459] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.459] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.459] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.459] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.459] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.459] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.459] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0045.459] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="Windows") returned -1 [0045.460] lstrcmpW (lpString1="720x480blacksquare.png", lpString2="32.EXE.exe") returned 1 [0045.460] StrStrW (lpFirst="720x480blacksquare.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.460] lstrcmpW (lpString1="720x480blacksquare.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.460] GetCurrentThreadId () returned 0x9b0 [0045.460] RtlWakeConditionVariable () returned 0x27e800 [0045.460] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="Windows") returned -1 [0045.460] lstrcmpW (lpString1="NextMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.460] StrStrW (lpFirst="NextMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.460] lstrcmpW (lpString1="NextMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.460] GetCurrentThreadId () returned 0x9b0 [0045.460] RtlWakeConditionVariable () returned 0x27e800 [0045.460] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="Windows") returned -1 [0045.460] lstrcmpW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="32.EXE.exe") returned 1 [0045.460] StrStrW (lpFirst="NextMenuButtonIconSubpictur.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.460] lstrcmpW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.460] GetCurrentThreadId () returned 0x9b0 [0045.460] RtlWakeConditionVariable () returned 0x27e800 [0045.460] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="Windows") returned -1 [0045.460] lstrcmpW (lpString1="Notes_loop.wmv", lpString2="32.EXE.exe") returned 1 [0045.460] StrStrW (lpFirst="Notes_loop.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.460] lstrcmpW (lpString1="Notes_loop.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.460] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.460] GetCurrentThreadId () returned 0x9b0 [0045.461] RtlWakeConditionVariable () returned 0x27e800 [0045.461] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="Windows") returned -1 [0045.461] lstrcmpW (lpString1="Notes_loop_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.461] StrStrW (lpFirst="Notes_loop_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.461] lstrcmpW (lpString1="Notes_loop_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.461] GetCurrentThreadId () returned 0x9b0 [0045.461] RtlWakeConditionVariable () returned 0x27e800 [0045.461] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="Windows") returned -1 [0045.461] lstrcmpW (lpString1="ParentMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.461] StrStrW (lpFirst="ParentMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.461] lstrcmpW (lpString1="ParentMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.461] GetCurrentThreadId () returned 0x9b0 [0045.461] RtlWakeConditionVariable () returned 0x27e800 [0045.461] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="Windows") returned -1 [0045.461] lstrcmpW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="32.EXE.exe") returned 1 [0045.461] StrStrW (lpFirst="ParentMenuButtonIconSubpict.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.461] lstrcmpW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.461] GetCurrentThreadId () returned 0x9b0 [0045.461] RtlWakeConditionVariable () returned 0x27e800 [0045.461] lstrcmpiW (lpString1="performance.png", lpString2="Windows") returned -1 [0045.461] lstrcmpW (lpString1="performance.png", lpString2="32.EXE.exe") returned 1 [0045.461] StrStrW (lpFirst="performance.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.461] lstrcmpW (lpString1="performance.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.461] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.462] GetCurrentThreadId () returned 0x9b0 [0045.462] RtlWakeConditionVariable () returned 0x27e800 [0045.462] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="Windows") returned -1 [0045.462] lstrcmpW (lpString1="Perf_Scenes_Mask1.png", lpString2="32.EXE.exe") returned 1 [0045.462] StrStrW (lpFirst="Perf_Scenes_Mask1.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.462] lstrcmpW (lpString1="Perf_Scenes_Mask1.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.462] GetCurrentThreadId () returned 0x9b0 [0045.462] RtlWakeConditionVariable () returned 0x27e800 [0045.462] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="Windows") returned -1 [0045.462] lstrcmpW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="32.EXE.exe") returned 1 [0045.462] StrStrW (lpFirst="Perf_Scenes_Subpicture1.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.462] lstrcmpW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.462] GetCurrentThreadId () returned 0x9b0 [0045.462] RtlWakeConditionVariable () returned 0x27e800 [0045.462] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="Windows") returned -1 [0045.462] lstrcmpW (lpString1="PreviousMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.462] StrStrW (lpFirst="PreviousMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.462] lstrcmpW (lpString1="PreviousMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.462] GetCurrentThreadId () returned 0x9b0 [0045.462] RtlWakeConditionVariable () returned 0x27e800 [0045.462] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="Windows") returned -1 [0045.462] lstrcmpW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="32.EXE.exe") returned 1 [0045.462] StrStrW (lpFirst="PreviousMenuButtonIconSubpi.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.462] lstrcmpW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.462] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.462] GetCurrentThreadId () returned 0x9b0 [0045.463] RtlWakeConditionVariable () returned 0x27e800 [0045.463] lstrcmpiW (lpString1="redmenu.png", lpString2="Windows") returned -1 [0045.463] lstrcmpW (lpString1="redmenu.png", lpString2="32.EXE.exe") returned 1 [0045.463] StrStrW (lpFirst="redmenu.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.463] lstrcmpW (lpString1="redmenu.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.463] GetCurrentThreadId () returned 0x9b0 [0045.463] RtlWakeConditionVariable () returned 0x27e800 [0045.463] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="Windows") returned -1 [0045.463] lstrcmpW (lpString1="Scene_loop.wmv", lpString2="32.EXE.exe") returned 1 [0045.463] StrStrW (lpFirst="Scene_loop.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.463] lstrcmpW (lpString1="Scene_loop.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.463] GetCurrentThreadId () returned 0x9b0 [0045.463] RtlWakeConditionVariable () returned 0x27e800 [0045.463] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="Windows") returned -1 [0045.463] lstrcmpW (lpString1="Scene_loop_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.463] StrStrW (lpFirst="Scene_loop_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.463] lstrcmpW (lpString1="Scene_loop_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.463] GetCurrentThreadId () returned 0x9b0 [0045.463] RtlWakeConditionVariable () returned 0x27e800 [0045.463] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="Windows") returned -1 [0045.463] lstrcmpW (lpString1="TitleButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.463] StrStrW (lpFirst="TitleButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.463] lstrcmpW (lpString1="TitleButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.463] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.463] GetCurrentThreadId () returned 0x9b0 [0045.464] RtlWakeConditionVariable () returned 0x27e800 [0045.464] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="Windows") returned -1 [0045.464] lstrcmpW (lpString1="TitleButtonSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.464] StrStrW (lpFirst="TitleButtonSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.464] lstrcmpW (lpString1="TitleButtonSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.464] GetCurrentThreadId () returned 0x9b0 [0045.464] RtlWakeConditionVariable () returned 0x27e800 [0045.464] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="Windows") returned -1 [0045.464] lstrcmpW (lpString1="Title_Page.wmv", lpString2="32.EXE.exe") returned 1 [0045.464] StrStrW (lpFirst="Title_Page.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.464] lstrcmpW (lpString1="Title_Page.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.464] GetCurrentThreadId () returned 0x9b0 [0045.464] RtlWakeConditionVariable () returned 0x27e800 [0045.464] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="Windows") returned -1 [0045.464] lstrcmpW (lpString1="Title_Page_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.464] StrStrW (lpFirst="Title_Page_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.464] lstrcmpW (lpString1="Title_Page_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.464] GetCurrentThreadId () returned 0x9b0 [0045.464] RtlWakeConditionVariable () returned 0x27e800 [0045.464] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="Windows") returned -1 [0045.464] lstrcmpW (lpString1="title_trans_notes.wmv", lpString2="32.EXE.exe") returned 1 [0045.464] StrStrW (lpFirst="title_trans_notes.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.464] lstrcmpW (lpString1="title_trans_notes.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.464] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.464] GetCurrentThreadId () returned 0x9b0 [0045.464] RtlWakeConditionVariable () returned 0x27e800 [0045.465] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="Windows") returned -1 [0045.465] lstrcmpW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.465] StrStrW (lpFirst="Title_Trans_Notes_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.465] lstrcmpW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.465] GetCurrentThreadId () returned 0x9b0 [0045.465] RtlWakeConditionVariable () returned 0x27e800 [0045.465] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="Windows") returned -1 [0045.465] lstrcmpW (lpString1="title_trans_scene.wmv", lpString2="32.EXE.exe") returned 1 [0045.465] StrStrW (lpFirst="title_trans_scene.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.465] lstrcmpW (lpString1="title_trans_scene.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.465] GetCurrentThreadId () returned 0x9b0 [0045.465] RtlWakeConditionVariable () returned 0x27e800 [0045.465] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="Windows") returned -1 [0045.465] lstrcmpW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.465] StrStrW (lpFirst="Title_Trans_Scene_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.465] lstrcmpW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.465] GetCurrentThreadId () returned 0x9b0 [0045.465] RtlWakeConditionVariable () returned 0x27e800 [0045.465] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="Windows") returned -1 [0045.465] lstrcmpW (lpString1="userContent_16x9_imagemask.png", lpString2="32.EXE.exe") returned 1 [0045.465] StrStrW (lpFirst="userContent_16x9_imagemask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.465] lstrcmpW (lpString1="userContent_16x9_imagemask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.465] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f8e00 [0045.465] GetCurrentThreadId () returned 0x9b0 [0045.466] RtlWakeConditionVariable () returned 0x27e800 [0045.466] lstrcmpiW (lpString1="whitemenu.png", lpString2="Windows") returned -1 [0045.466] lstrcmpW (lpString1="whitemenu.png", lpString2="32.EXE.exe") returned 1 [0045.466] StrStrW (lpFirst="whitemenu.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.466] lstrcmpW (lpString1="whitemenu.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.466] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.466] GetCurrentThreadId () returned 0x9b0 [0045.466] RtlWakeConditionVariable () returned 0x27e800 [0045.466] RtlWakeConditionVariable () returned 0x27e800 [0045.467] lstrcmpiW (lpString1="Pets", lpString2="Windows") returned -1 [0045.467] lstrcmpW (lpString1="Pets", lpString2=".") returned 1 [0045.467] lstrcmpW (lpString1="Pets", lpString2="..") returned 1 [0045.467] lstrcmpW (lpString1="Pets", lpString2="AppData") returned 1 [0045.467] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets", lpSrch="AppData") returned 0x0 [0045.467] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets", lpString2="C:\\Windows") returned -1 [0045.467] lstrlenW (lpString="C:\\Windows") returned 10 [0045.467] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets", lpString2="C:\\System Volume Information") returned -1 [0045.467] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.467] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0045.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.468] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.468] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.468] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.468] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.468] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.468] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.469] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.469] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.469] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.469] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.469] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.469] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.469] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0045.469] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="Windows") returned -1 [0045.469] lstrcmpW (lpString1="Notes_INTRO_BG.wmv", lpString2="32.EXE.exe") returned 1 [0045.469] StrStrW (lpFirst="Notes_INTRO_BG.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.469] lstrcmpW (lpString1="Notes_INTRO_BG.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.469] GetCurrentThreadId () returned 0x9b0 [0045.469] RtlWakeConditionVariable () returned 0x27e800 [0045.469] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="Windows") returned -1 [0045.469] lstrcmpW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.469] StrStrW (lpFirst="Notes_INTRO_BG_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.469] lstrcmpW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.469] GetCurrentThreadId () returned 0x9b0 [0045.469] RtlWakeConditionVariable () returned 0x27e800 [0045.469] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="Windows") returned -1 [0045.469] lstrcmpW (lpString1="Notes_LOOP_BG.wmv", lpString2="32.EXE.exe") returned 1 [0045.469] StrStrW (lpFirst="Notes_LOOP_BG.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.469] lstrcmpW (lpString1="Notes_LOOP_BG.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.469] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.469] GetCurrentThreadId () returned 0x9b0 [0045.469] RtlWakeConditionVariable () returned 0x27e800 [0045.470] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="Windows") returned -1 [0045.470] lstrcmpW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.470] StrStrW (lpFirst="Notes_LOOP_BG_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.470] lstrcmpW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.470] GetCurrentThreadId () returned 0x9b0 [0045.470] RtlWakeConditionVariable () returned 0x27e800 [0045.470] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="Windows") returned -1 [0045.470] lstrcmpW (lpString1="Pets_btn-back-over-select.png", lpString2="32.EXE.exe") returned 1 [0045.470] StrStrW (lpFirst="Pets_btn-back-over-select.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.470] lstrcmpW (lpString1="Pets_btn-back-over-select.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.470] GetCurrentThreadId () returned 0x9b0 [0045.470] RtlWakeConditionVariable () returned 0x27e800 [0045.470] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="Windows") returned -1 [0045.470] lstrcmpW (lpString1="Pets_btn-back-static.png", lpString2="32.EXE.exe") returned 1 [0045.470] StrStrW (lpFirst="Pets_btn-back-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.470] lstrcmpW (lpString1="Pets_btn-back-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.470] GetCurrentThreadId () returned 0x9b0 [0045.470] RtlWakeConditionVariable () returned 0x27e800 [0045.470] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="Windows") returned -1 [0045.470] lstrcmpW (lpString1="Pets_btn-next-over-select.png", lpString2="32.EXE.exe") returned 1 [0045.470] StrStrW (lpFirst="Pets_btn-next-over-select.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.470] lstrcmpW (lpString1="Pets_btn-next-over-select.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.470] GetCurrentThreadId () returned 0x9b0 [0045.470] RtlWakeConditionVariable () returned 0x27e800 [0045.471] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="Windows") returned -1 [0045.471] lstrcmpW (lpString1="Pets_btn-next-static.png", lpString2="32.EXE.exe") returned 1 [0045.471] StrStrW (lpFirst="Pets_btn-next-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.471] lstrcmpW (lpString1="Pets_btn-next-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.471] GetCurrentThreadId () returned 0x9b0 [0045.471] RtlWakeConditionVariable () returned 0x27e800 [0045.471] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="Windows") returned -1 [0045.471] lstrcmpW (lpString1="Pets_btn-over-DOT.png", lpString2="32.EXE.exe") returned 1 [0045.471] StrStrW (lpFirst="Pets_btn-over-DOT.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.471] lstrcmpW (lpString1="Pets_btn-over-DOT.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.471] GetCurrentThreadId () returned 0x9b0 [0045.471] RtlWakeConditionVariable () returned 0x27e800 [0045.471] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="Windows") returned -1 [0045.471] lstrcmpW (lpString1="Pets_btn-previous-over-select.png", lpString2="32.EXE.exe") returned 1 [0045.471] StrStrW (lpFirst="Pets_btn-previous-over-select.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.471] lstrcmpW (lpString1="Pets_btn-previous-over-select.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.471] GetCurrentThreadId () returned 0x9b0 [0045.471] RtlWakeConditionVariable () returned 0x27e800 [0045.471] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="Windows") returned -1 [0045.471] lstrcmpW (lpString1="Pets_btn-previous-static.png", lpString2="32.EXE.exe") returned 1 [0045.471] StrStrW (lpFirst="Pets_btn-previous-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.471] lstrcmpW (lpString1="Pets_btn-previous-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.471] GetCurrentThreadId () returned 0x9b0 [0045.471] RtlWakeConditionVariable () returned 0x27e800 [0045.472] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="Windows") returned -1 [0045.472] lstrcmpW (lpString1="Pets_frame-border.png", lpString2="32.EXE.exe") returned 1 [0045.472] StrStrW (lpFirst="Pets_frame-border.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.472] lstrcmpW (lpString1="Pets_frame-border.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.472] GetCurrentThreadId () returned 0x9b0 [0045.472] RtlWakeConditionVariable () returned 0x27e800 [0045.472] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="Windows") returned -1 [0045.472] lstrcmpW (lpString1="Pets_frame-highlight.png", lpString2="32.EXE.exe") returned 1 [0045.472] StrStrW (lpFirst="Pets_frame-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.472] lstrcmpW (lpString1="Pets_frame-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.472] GetCurrentThreadId () returned 0x9b0 [0045.472] RtlWakeConditionVariable () returned 0x27e800 [0045.472] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="Windows") returned -1 [0045.472] lstrcmpW (lpString1="Pets_frame-imageMask.png", lpString2="32.EXE.exe") returned 1 [0045.472] StrStrW (lpFirst="Pets_frame-imageMask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.472] lstrcmpW (lpString1="Pets_frame-imageMask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.472] GetCurrentThreadId () returned 0x9b0 [0045.472] RtlWakeConditionVariable () returned 0x27e800 [0045.472] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="Windows") returned -1 [0045.472] lstrcmpW (lpString1="Pets_frame-shadow.png", lpString2="32.EXE.exe") returned 1 [0045.472] StrStrW (lpFirst="Pets_frame-shadow.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.472] lstrcmpW (lpString1="Pets_frame-shadow.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.472] GetCurrentThreadId () returned 0x9b0 [0045.472] RtlWakeConditionVariable () returned 0x27e800 [0045.473] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="Windows") returned -1 [0045.473] lstrcmpW (lpString1="Pets_image-frame-backglow.png", lpString2="32.EXE.exe") returned 1 [0045.473] StrStrW (lpFirst="Pets_image-frame-backglow.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.473] lstrcmpW (lpString1="Pets_image-frame-backglow.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.473] GetCurrentThreadId () returned 0x9b0 [0045.473] RtlWakeConditionVariable () returned 0x27e800 [0045.473] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="Windows") returned -1 [0045.473] lstrcmpW (lpString1="Pets_image-frame-border.png", lpString2="32.EXE.exe") returned 1 [0045.473] StrStrW (lpFirst="Pets_image-frame-border.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.473] lstrcmpW (lpString1="Pets_image-frame-border.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.473] GetCurrentThreadId () returned 0x9b0 [0045.473] RtlWakeConditionVariable () returned 0x27e800 [0045.473] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="Windows") returned -1 [0045.473] lstrcmpW (lpString1="Pets_image-frame-ImageMask.png", lpString2="32.EXE.exe") returned 1 [0045.473] StrStrW (lpFirst="Pets_image-frame-ImageMask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.473] lstrcmpW (lpString1="Pets_image-frame-ImageMask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.473] GetCurrentThreadId () returned 0x9b0 [0045.473] RtlWakeConditionVariable () returned 0x27e800 [0045.473] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="Windows") returned -1 [0045.473] lstrcmpW (lpString1="Pets_notes-txt-background.png", lpString2="32.EXE.exe") returned 1 [0045.473] StrStrW (lpFirst="Pets_notes-txt-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.473] lstrcmpW (lpString1="Pets_notes-txt-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.473] GetCurrentThreadId () returned 0x9b0 [0045.473] RtlWakeConditionVariable () returned 0x27e800 [0045.474] lstrcmpiW (lpString1="rollinghills.png", lpString2="Windows") returned -1 [0045.474] lstrcmpW (lpString1="rollinghills.png", lpString2="32.EXE.exe") returned 1 [0045.474] StrStrW (lpFirst="rollinghills.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.474] lstrcmpW (lpString1="rollinghills.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.474] GetCurrentThreadId () returned 0x9b0 [0045.474] RtlWakeConditionVariable () returned 0x27e800 [0045.474] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="Windows") returned -1 [0045.474] lstrcmpW (lpString1="Scenes_INTRO_BG.wmv", lpString2="32.EXE.exe") returned 1 [0045.474] StrStrW (lpFirst="Scenes_INTRO_BG.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.474] lstrcmpW (lpString1="Scenes_INTRO_BG.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.474] GetCurrentThreadId () returned 0x9b0 [0045.486] RtlWakeConditionVariable () returned 0x27e800 [0045.486] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="Windows") returned -1 [0045.486] lstrcmpW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.486] StrStrW (lpFirst="Scenes_INTRO_BG_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.486] lstrcmpW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.486] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.487] GetCurrentThreadId () returned 0x9b0 [0045.487] RtlWakeConditionVariable () returned 0x27e800 [0045.487] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="Windows") returned -1 [0045.487] lstrcmpW (lpString1="Scenes_LOOP_BG.wmv", lpString2="32.EXE.exe") returned 1 [0045.487] StrStrW (lpFirst="Scenes_LOOP_BG.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.487] lstrcmpW (lpString1="Scenes_LOOP_BG.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.487] GetCurrentThreadId () returned 0x9b0 [0045.487] RtlWakeConditionVariable () returned 0x27e800 [0045.487] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="Windows") returned -1 [0045.487] lstrcmpW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.487] StrStrW (lpFirst="Scenes_LOOP_BG_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.487] lstrcmpW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.487] GetCurrentThreadId () returned 0x9b0 [0045.487] RtlWakeConditionVariable () returned 0x27e800 [0045.487] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="Windows") returned -1 [0045.487] lstrcmpW (lpString1="Title_Page_Ref.wmv", lpString2="32.EXE.exe") returned 1 [0045.487] StrStrW (lpFirst="Title_Page_Ref.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.487] lstrcmpW (lpString1="Title_Page_Ref.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.487] GetCurrentThreadId () returned 0x9b0 [0045.487] RtlWakeConditionVariable () returned 0x27e800 [0045.487] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="Windows") returned -1 [0045.487] lstrcmpW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.487] StrStrW (lpFirst="Title_Page_Ref_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.487] lstrcmpW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.487] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.488] GetCurrentThreadId () returned 0x9b0 [0045.488] RtlWakeConditionVariable () returned 0x27e800 [0045.489] RtlWakeConditionVariable () returned 0x27e800 [0045.489] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="Windows") returned -1 [0045.489] lstrcmpW (lpString1="photoedge_buttongraphic.png", lpString2="32.EXE.exe") returned 1 [0045.489] StrStrW (lpFirst="photoedge_buttongraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.489] lstrcmpW (lpString1="photoedge_buttongraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.489] GetCurrentThreadId () returned 0x9b0 [0045.489] RtlWakeConditionVariable () returned 0x27e800 [0045.489] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="Windows") returned -1 [0045.489] lstrcmpW (lpString1="photoedge_selectionsubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.489] StrStrW (lpFirst="photoedge_selectionsubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.489] lstrcmpW (lpString1="photoedge_selectionsubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.489] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.490] GetCurrentThreadId () returned 0x9b0 [0045.490] RtlWakeConditionVariable () returned 0x27e800 [0045.490] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="Windows") returned -1 [0045.490] lstrcmpW (lpString1="photoedge_videoinset.png", lpString2="32.EXE.exe") returned 1 [0045.490] StrStrW (lpFirst="photoedge_videoinset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.490] lstrcmpW (lpString1="photoedge_videoinset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.490] GetCurrentThreadId () returned 0x9b0 [0045.490] RtlWakeConditionVariable () returned 0x27e800 [0045.490] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.490] lstrcmpW (lpString1="Postage_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.490] StrStrW (lpFirst="Postage_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.490] lstrcmpW (lpString1="Postage_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.490] GetCurrentThreadId () returned 0x9b0 [0045.490] RtlWakeConditionVariable () returned 0x27e800 [0045.490] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.490] lstrcmpW (lpString1="Postage_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.490] StrStrW (lpFirst="Postage_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.490] lstrcmpW (lpString1="Postage_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.490] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.490] GetCurrentThreadId () returned 0x9b0 [0045.491] RtlWakeConditionVariable () returned 0x27e800 [0045.491] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="Windows") returned -1 [0045.491] lstrcmpW (lpString1="Postage_VideoInset.png", lpString2="32.EXE.exe") returned 1 [0045.491] StrStrW (lpFirst="Postage_VideoInset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.491] lstrcmpW (lpString1="Postage_VideoInset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.491] GetCurrentThreadId () returned 0x9b0 [0045.491] RtlWakeConditionVariable () returned 0x27e800 [0045.491] lstrcmpiW (lpString1="Push", lpString2="Windows") returned -1 [0045.491] lstrcmpW (lpString1="Push", lpString2=".") returned 1 [0045.491] lstrcmpW (lpString1="Push", lpString2="..") returned 1 [0045.491] lstrcmpW (lpString1="Push", lpString2="AppData") returned 1 [0045.491] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push", lpSrch="AppData") returned 0x0 [0045.491] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push", lpString2="C:\\Windows") returned -1 [0045.491] lstrlenW (lpString="C:\\Windows") returned 10 [0045.491] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push", lpString2="C:\\System Volume Information") returned -1 [0045.491] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.491] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.494] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.494] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.494] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.494] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.494] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.494] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.494] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.494] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.494] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.494] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.494] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.494] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.494] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x98, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.494] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.494] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.494] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.494] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.494] GetCurrentThreadId () returned 0x9b0 [0045.494] RtlWakeConditionVariable () returned 0x27e800 [0045.494] lstrcmpiW (lpString1="1047_576black.png", lpString2="Windows") returned -1 [0045.494] lstrcmpW (lpString1="1047_576black.png", lpString2="32.EXE.exe") returned -1 [0045.494] StrStrW (lpFirst="1047_576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.494] lstrcmpW (lpString1="1047_576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.494] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.494] GetCurrentThreadId () returned 0x9b0 [0045.494] RtlWakeConditionVariable () returned 0x27e800 [0045.495] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.495] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.495] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.495] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.495] GetCurrentThreadId () returned 0x9b0 [0045.495] RtlWakeConditionVariable () returned 0x27e800 [0045.495] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.495] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.495] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.495] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.495] GetCurrentThreadId () returned 0x9b0 [0045.495] RtlWakeConditionVariable () returned 0x27e800 [0045.495] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.495] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.495] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.495] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.495] GetCurrentThreadId () returned 0x9b0 [0045.495] RtlWakeConditionVariable () returned 0x27e800 [0045.495] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.495] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.495] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.495] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.495] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.495] GetCurrentThreadId () returned 0x9b0 [0045.495] RtlWakeConditionVariable () returned 0x27e800 [0045.496] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.496] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.496] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.496] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.496] GetCurrentThreadId () returned 0x9b0 [0045.496] RtlWakeConditionVariable () returned 0x27e800 [0045.496] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.496] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.496] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.496] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.496] GetCurrentThreadId () returned 0x9b0 [0045.496] RtlWakeConditionVariable () returned 0x27e800 [0045.496] lstrcmpiW (lpString1="push.png", lpString2="Windows") returned -1 [0045.496] lstrcmpW (lpString1="push.png", lpString2="32.EXE.exe") returned 1 [0045.496] StrStrW (lpFirst="push.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.496] lstrcmpW (lpString1="push.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0045.496] GetCurrentThreadId () returned 0x9b0 [0045.496] RtlWakeConditionVariable () returned 0x27e800 [0045.496] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="Windows") returned -1 [0045.496] lstrcmpW (lpString1="pushplaysubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.496] StrStrW (lpFirst="pushplaysubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.496] lstrcmpW (lpString1="pushplaysubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.496] GetCurrentThreadId () returned 0x9b0 [0045.496] RtlWakeConditionVariable () returned 0x27e800 [0045.497] lstrcmpiW (lpString1="push_item.png", lpString2="Windows") returned -1 [0045.497] lstrcmpW (lpString1="push_item.png", lpString2="32.EXE.exe") returned 1 [0045.497] StrStrW (lpFirst="push_item.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.497] lstrcmpW (lpString1="push_item.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.497] GetCurrentThreadId () returned 0x9b0 [0045.497] RtlWakeConditionVariable () returned 0x27e800 [0045.497] lstrcmpiW (lpString1="push_title.png", lpString2="Windows") returned -1 [0045.497] lstrcmpW (lpString1="push_title.png", lpString2="32.EXE.exe") returned 1 [0045.497] StrStrW (lpFirst="push_title.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.497] lstrcmpW (lpString1="push_title.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.497] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.497] GetCurrentThreadId () returned 0x9b0 [0045.497] RtlWakeConditionVariable () returned 0x27e800 [0045.498] RtlWakeConditionVariable () returned 0x27e800 [0045.498] lstrcmpiW (lpString1="Rectangles", lpString2="Windows") returned -1 [0045.498] lstrcmpW (lpString1="Rectangles", lpString2=".") returned 1 [0045.498] lstrcmpW (lpString1="Rectangles", lpString2="..") returned 1 [0045.498] lstrcmpW (lpString1="Rectangles", lpString2="AppData") returned 1 [0045.498] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles", lpSrch="AppData") returned 0x0 [0045.498] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles", lpString2="C:\\Windows") returned -1 [0045.498] lstrlenW (lpString="C:\\Windows") returned 10 [0045.498] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles", lpString2="C:\\System Volume Information") returned -1 [0045.498] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.498] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.501] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.501] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.501] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.501] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.501] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.501] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.501] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.501] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.501] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.501] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.501] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.501] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.501] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x98, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.502] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.502] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.502] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.502] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.502] GetCurrentThreadId () returned 0x9b0 [0045.502] RtlWakeConditionVariable () returned 0x27e800 [0045.502] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="Windows") returned -1 [0045.502] lstrcmpW (lpString1="1047x576_91n92.png", lpString2="32.EXE.exe") returned -1 [0045.502] StrStrW (lpFirst="1047x576_91n92.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.502] lstrcmpW (lpString1="1047x576_91n92.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.502] GetCurrentThreadId () returned 0x9b0 [0045.502] RtlWakeConditionVariable () returned 0x27e800 [0045.502] lstrcmpiW (lpString1="15x15dot.png", lpString2="Windows") returned -1 [0045.502] lstrcmpW (lpString1="15x15dot.png", lpString2="32.EXE.exe") returned -1 [0045.502] StrStrW (lpFirst="15x15dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.502] lstrcmpW (lpString1="15x15dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.502] GetCurrentThreadId () returned 0x9b0 [0045.502] RtlWakeConditionVariable () returned 0x27e800 [0045.502] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="Windows") returned -1 [0045.502] lstrcmpW (lpString1="720x480icongraphic.png", lpString2="32.EXE.exe") returned 1 [0045.502] StrStrW (lpFirst="720x480icongraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.502] lstrcmpW (lpString1="720x480icongraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.502] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.502] GetCurrentThreadId () returned 0x9b0 [0045.502] RtlWakeConditionVariable () returned 0x27e800 [0045.503] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.503] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.503] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.503] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.503] GetCurrentThreadId () returned 0x9b0 [0045.503] RtlWakeConditionVariable () returned 0x27e800 [0045.503] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.503] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.503] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.503] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.503] GetCurrentThreadId () returned 0x9b0 [0045.503] RtlWakeConditionVariable () returned 0x27e800 [0045.503] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.503] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.503] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.503] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.503] GetCurrentThreadId () returned 0x9b0 [0045.503] RtlWakeConditionVariable () returned 0x27e800 [0045.503] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.503] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.503] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.503] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.503] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.503] GetCurrentThreadId () returned 0x9b0 [0045.503] RtlWakeConditionVariable () returned 0x27e800 [0045.504] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.504] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.504] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.504] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.504] GetCurrentThreadId () returned 0x9b0 [0045.504] RtlWakeConditionVariable () returned 0x27e800 [0045.504] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.504] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.504] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.504] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2fa0c0 [0045.504] GetCurrentThreadId () returned 0x9b0 [0045.504] RtlWakeConditionVariable () returned 0x27e800 [0045.504] lstrcmpiW (lpString1="reflect.png", lpString2="Windows") returned -1 [0045.504] lstrcmpW (lpString1="reflect.png", lpString2="32.EXE.exe") returned 1 [0045.504] StrStrW (lpFirst="reflect.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.504] lstrcmpW (lpString1="reflect.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.504] GetCurrentThreadId () returned 0x9b0 [0045.504] RtlWakeConditionVariable () returned 0x27e800 [0045.504] lstrcmpiW (lpString1="vistabg.png", lpString2="Windows") returned -1 [0045.504] lstrcmpW (lpString1="vistabg.png", lpString2="32.EXE.exe") returned 1 [0045.504] StrStrW (lpFirst="vistabg.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.504] lstrcmpW (lpString1="vistabg.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.504] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.504] GetCurrentThreadId () returned 0x9b0 [0045.504] RtlWakeConditionVariable () returned 0x27e800 [0045.505] RtlWakeConditionVariable () returned 0x27e800 [0045.505] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.505] lstrcmpW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.505] StrStrW (lpFirst="rectangle_babypink_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.505] lstrcmpW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.505] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.505] GetCurrentThreadId () returned 0x9b0 [0045.505] RtlWakeConditionVariable () returned 0x27e800 [0045.506] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.506] lstrcmpW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.506] StrStrW (lpFirst="rectangle_glass_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.506] lstrcmpW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.506] GetCurrentThreadId () returned 0x9b0 [0045.506] RtlWakeConditionVariable () returned 0x27e800 [0045.506] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.506] lstrcmpW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.506] StrStrW (lpFirst="rectangle_highlights_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.506] lstrcmpW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.506] GetCurrentThreadId () returned 0x9b0 [0045.506] RtlWakeConditionVariable () returned 0x27e800 [0045.506] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.506] lstrcmpW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.506] StrStrW (lpFirst="rectangle_performance_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.506] lstrcmpW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.506] GetCurrentThreadId () returned 0x9b0 [0045.506] RtlWakeConditionVariable () returned 0x27e800 [0045.506] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.506] lstrcmpW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.506] StrStrW (lpFirst="rectangle_photo_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.506] lstrcmpW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.506] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.506] GetCurrentThreadId () returned 0x9b0 [0045.506] RtlWakeConditionVariable () returned 0x27e800 [0045.506] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.507] lstrcmpW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.507] StrStrW (lpFirst="rectangle_plain_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.507] lstrcmpW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.507] GetCurrentThreadId () returned 0x9b0 [0045.507] RtlWakeConditionVariable () returned 0x27e800 [0045.507] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.507] lstrcmpW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.507] StrStrW (lpFirst="rectangle_postage_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.507] lstrcmpW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.507] GetCurrentThreadId () returned 0x9b0 [0045.507] RtlWakeConditionVariable () returned 0x27e800 [0045.507] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.507] lstrcmpW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.507] StrStrW (lpFirst="rectangle_scrapbook_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.507] lstrcmpW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.507] GetCurrentThreadId () returned 0x9b0 [0045.507] RtlWakeConditionVariable () returned 0x27e800 [0045.507] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.507] lstrcmpW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.507] StrStrW (lpFirst="rectangle_specialocc_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.507] lstrcmpW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.507] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.507] GetCurrentThreadId () returned 0x9b0 [0045.507] RtlWakeConditionVariable () returned 0x27e800 [0045.507] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.508] lstrcmpW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.508] StrStrW (lpFirst="rectangle_travel_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.508] lstrcmpW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x2f7710 [0045.508] GetCurrentThreadId () returned 0x9b0 [0045.508] RtlWakeConditionVariable () returned 0x27e800 [0045.508] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.508] lstrcmpW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.508] StrStrW (lpFirst="rectangle_widescreen_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.508] lstrcmpW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c488 [0045.508] GetCurrentThreadId () returned 0x9b0 [0045.508] RtlWakeConditionVariable () returned 0x27e800 [0045.508] lstrcmpiW (lpString1="ResizingPanels", lpString2="Windows") returned -1 [0045.508] lstrcmpW (lpString1="ResizingPanels", lpString2=".") returned 1 [0045.508] lstrcmpW (lpString1="ResizingPanels", lpString2="..") returned 1 [0045.508] lstrcmpW (lpString1="ResizingPanels", lpString2="AppData") returned 1 [0045.508] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels", lpSrch="AppData") returned 0x0 [0045.508] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels", lpString2="C:\\Windows") returned -1 [0045.508] lstrlenW (lpString="C:\\Windows") returned 10 [0045.508] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels", lpString2="C:\\System Volume Information") returned -1 [0045.508] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.508] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.638] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.638] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.638] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.638] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.638] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.638] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.638] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.638] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.638] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.638] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.638] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.638] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.638] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xb8, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.638] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.638] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.638] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.639] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.639] GetCurrentThreadId () returned 0x9b0 [0045.639] RtlWakeConditionVariable () returned 0x27e800 [0045.639] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="Windows") returned -1 [0045.639] lstrcmpW (lpString1="203x8subpicture.png", lpString2="32.EXE.exe") returned -1 [0045.639] StrStrW (lpFirst="203x8subpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.639] lstrcmpW (lpString1="203x8subpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.639] GetCurrentThreadId () returned 0x9b0 [0045.639] RtlWakeConditionVariable () returned 0x27e800 [0045.639] lstrcmpiW (lpString1="bandwidth.png", lpString2="Windows") returned -1 [0045.639] lstrcmpW (lpString1="bandwidth.png", lpString2="32.EXE.exe") returned 1 [0045.639] StrStrW (lpFirst="bandwidth.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.639] lstrcmpW (lpString1="bandwidth.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0045.639] GetCurrentThreadId () returned 0x9b0 [0045.639] RtlWakeConditionVariable () returned 0x27e800 [0045.639] lstrcmpiW (lpString1="blackbars80.png", lpString2="Windows") returned -1 [0045.639] lstrcmpW (lpString1="blackbars80.png", lpString2="32.EXE.exe") returned 1 [0045.639] StrStrW (lpFirst="blackbars80.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.639] lstrcmpW (lpString1="blackbars80.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0045.639] GetCurrentThreadId () returned 0x9b0 [0045.639] RtlWakeConditionVariable () returned 0x27e800 [0045.639] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.639] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.639] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.640] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.640] GetCurrentThreadId () returned 0x9b0 [0045.640] RtlWakeConditionVariable () returned 0x27e800 [0045.640] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.640] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.640] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.640] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.640] GetCurrentThreadId () returned 0x9b0 [0045.640] RtlWakeConditionVariable () returned 0x27e800 [0045.640] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.640] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.640] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.640] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.640] GetCurrentThreadId () returned 0x9b0 [0045.640] RtlWakeConditionVariable () returned 0x27e800 [0045.640] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.640] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.640] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.640] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.640] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.640] GetCurrentThreadId () returned 0x9b0 [0045.640] RtlWakeConditionVariable () returned 0x27e800 [0045.640] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.640] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.640] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.640] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.641] GetCurrentThreadId () returned 0x9b0 [0045.641] RtlWakeConditionVariable () returned 0x27e800 [0045.641] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.641] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.641] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.641] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.641] GetCurrentThreadId () returned 0x9b0 [0045.641] RtlWakeConditionVariable () returned 0x27e800 [0045.641] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="Windows") returned -1 [0045.641] lstrcmpW (lpString1="Panel_Mask.wmv", lpString2="32.EXE.exe") returned 1 [0045.641] StrStrW (lpFirst="Panel_Mask.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.641] lstrcmpW (lpString1="Panel_Mask.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0045.641] GetCurrentThreadId () returned 0x9b0 [0045.641] RtlWakeConditionVariable () returned 0x27e800 [0045.641] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="Windows") returned -1 [0045.641] lstrcmpW (lpString1="Panel_Mask_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.641] StrStrW (lpFirst="Panel_Mask_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.641] lstrcmpW (lpString1="Panel_Mask_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.641] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.641] GetCurrentThreadId () returned 0x9b0 [0045.641] RtlWakeConditionVariable () returned 0x27e800 [0045.642] RtlWakeConditionVariable () returned 0x27e800 [0045.642] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="Windows") returned -1 [0045.642] lstrcmpW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="32.EXE.exe") returned 1 [0045.642] StrStrW (lpFirst="scene_button_style_default_Thumbnail.bmp", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.642] lstrcmpW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.642] GetCurrentThreadId () returned 0x9b0 [0045.642] RtlWakeConditionVariable () returned 0x27e800 [0045.642] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="Windows") returned -1 [0045.642] lstrcmpW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="32.EXE.exe") returned 1 [0045.642] StrStrW (lpFirst="shadowonlyframe_buttongraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.642] lstrcmpW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.642] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.642] GetCurrentThreadId () returned 0x9b0 [0045.642] RtlWakeConditionVariable () returned 0x27e800 [0045.643] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="Windows") returned -1 [0045.643] lstrcmpW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.643] StrStrW (lpFirst="shadowonlyframe_selectionsubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.643] lstrcmpW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.643] GetCurrentThreadId () returned 0x9b0 [0045.643] RtlWakeConditionVariable () returned 0x27e800 [0045.643] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="Windows") returned -1 [0045.643] lstrcmpW (lpString1="shadowonlyframe_videoinset.png", lpString2="32.EXE.exe") returned 1 [0045.643] StrStrW (lpFirst="shadowonlyframe_videoinset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.643] lstrcmpW (lpString1="shadowonlyframe_videoinset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29e330 [0045.643] GetCurrentThreadId () returned 0x9b0 [0045.643] RtlWakeConditionVariable () returned 0x27e800 [0045.643] lstrcmpiW (lpString1="Shatter", lpString2="Windows") returned -1 [0045.643] lstrcmpW (lpString1="Shatter", lpString2=".") returned 1 [0045.643] lstrcmpW (lpString1="Shatter", lpString2="..") returned 1 [0045.643] lstrcmpW (lpString1="Shatter", lpString2="AppData") returned 1 [0045.643] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter", lpSrch="AppData") returned 0x0 [0045.643] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter", lpString2="C:\\Windows") returned -1 [0045.643] lstrlenW (lpString="C:\\Windows") returned 10 [0045.643] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter", lpString2="C:\\System Volume Information") returned -1 [0045.643] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.645] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.645] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.645] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.645] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.645] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.645] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.645] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.646] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.646] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.646] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.646] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.646] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.646] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.646] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.646] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.646] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.646] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dbf8 [0045.646] GetCurrentThreadId () returned 0x9b0 [0045.646] RtlWakeConditionVariable () returned 0x27e800 [0045.646] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="Windows") returned -1 [0045.646] lstrcmpW (lpString1="203x8subpicture.png", lpString2="32.EXE.exe") returned -1 [0045.646] StrStrW (lpFirst="203x8subpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.646] lstrcmpW (lpString1="203x8subpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x29dbf8 [0045.646] GetCurrentThreadId () returned 0x9b0 [0045.646] RtlWakeConditionVariable () returned 0x27e800 [0045.646] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.646] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.646] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.646] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.647] GetCurrentThreadId () returned 0x9b0 [0045.647] RtlWakeConditionVariable () returned 0x27e800 [0045.647] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.647] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.647] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.647] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.647] GetCurrentThreadId () returned 0x9b0 [0045.647] RtlWakeConditionVariable () returned 0x27e800 [0045.647] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.647] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.647] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.647] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.647] GetCurrentThreadId () returned 0x9b0 [0045.647] RtlWakeConditionVariable () returned 0x27e800 [0045.647] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.647] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.647] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.647] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.647] GetCurrentThreadId () returned 0x9b0 [0045.647] RtlWakeConditionVariable () returned 0x27e800 [0045.647] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.647] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.647] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.647] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.647] GetCurrentThreadId () returned 0x9b0 [0045.648] RtlWakeConditionVariable () returned 0x27e800 [0045.648] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.648] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.648] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.648] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.648] GetCurrentThreadId () returned 0x9b0 [0045.648] RtlWakeConditionVariable () returned 0x27e800 [0045.648] lstrcmpiW (lpString1="shatter.png", lpString2="Windows") returned -1 [0045.648] lstrcmpW (lpString1="shatter.png", lpString2="32.EXE.exe") returned 1 [0045.648] StrStrW (lpFirst="shatter.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.648] lstrcmpW (lpString1="shatter.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.648] GetCurrentThreadId () returned 0x9b0 [0045.648] RtlWakeConditionVariable () returned 0x27e800 [0045.649] RtlWakeConditionVariable () returned 0x27e800 [0045.649] lstrcmpiW (lpString1="SpecialOccasion", lpString2="Windows") returned -1 [0045.649] lstrcmpW (lpString1="SpecialOccasion", lpString2=".") returned 1 [0045.649] lstrcmpW (lpString1="SpecialOccasion", lpString2="..") returned 1 [0045.649] lstrcmpW (lpString1="SpecialOccasion", lpString2="AppData") returned 1 [0045.649] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion", lpSrch="AppData") returned 0x0 [0045.649] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion", lpString2="C:\\Windows") returned -1 [0045.649] lstrlenW (lpString="C:\\Windows") returned 10 [0045.649] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion", lpString2="C:\\System Volume Information") returned -1 [0045.649] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.703] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.703] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.703] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.703] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.717] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.717] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.717] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.717] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.717] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.717] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.717] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.718] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.718] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.718] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.718] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.718] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.718] GetCurrentThreadId () returned 0x9b0 [0045.718] RtlWakeConditionVariable () returned 0x27e800 [0045.718] lstrcmpiW (lpString1="mainscroll.png", lpString2="Windows") returned -1 [0045.718] lstrcmpW (lpString1="mainscroll.png", lpString2="32.EXE.exe") returned 1 [0045.718] StrStrW (lpFirst="mainscroll.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.718] lstrcmpW (lpString1="mainscroll.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x30edf8 [0045.718] GetCurrentThreadId () returned 0x9b0 [0045.718] RtlWakeConditionVariable () returned 0x27e800 [0045.718] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.718] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.718] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.718] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.718] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.718] GetCurrentThreadId () returned 0x9b0 [0045.718] RtlWakeConditionVariable () returned 0x27e800 [0045.718] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.718] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.718] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.719] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.719] GetCurrentThreadId () returned 0x9b0 [0045.719] RtlWakeConditionVariable () returned 0x27e800 [0045.719] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.719] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.719] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.719] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.719] GetCurrentThreadId () returned 0x9b0 [0045.719] RtlWakeConditionVariable () returned 0x27e800 [0045.719] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.719] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.719] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.719] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.719] GetCurrentThreadId () returned 0x9b0 [0045.719] RtlWakeConditionVariable () returned 0x27e800 [0045.719] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.719] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.719] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.719] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.719] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9058 [0045.719] GetCurrentThreadId () returned 0x9b0 [0045.719] RtlWakeConditionVariable () returned 0x27e800 [0045.719] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.720] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.720] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.720] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.720] GetCurrentThreadId () returned 0x9b0 [0045.720] RtlWakeConditionVariable () returned 0x27e800 [0045.720] lstrcmpiW (lpString1="scenesscroll.png", lpString2="Windows") returned -1 [0045.720] lstrcmpW (lpString1="scenesscroll.png", lpString2="32.EXE.exe") returned 1 [0045.720] StrStrW (lpFirst="scenesscroll.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.720] lstrcmpW (lpString1="scenesscroll.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.720] GetCurrentThreadId () returned 0x9b0 [0045.720] RtlWakeConditionVariable () returned 0x27e800 [0045.720] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="Windows") returned -1 [0045.720] lstrcmpW (lpString1="specialmainsubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.720] StrStrW (lpFirst="specialmainsubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.720] lstrcmpW (lpString1="specialmainsubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9058 [0045.720] GetCurrentThreadId () returned 0x9b0 [0045.720] RtlWakeConditionVariable () returned 0x27e800 [0045.720] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.720] lstrcmpW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.720] StrStrW (lpFirst="SpecialNavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.720] lstrcmpW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.720] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.720] GetCurrentThreadId () returned 0x9b0 [0045.720] RtlWakeConditionVariable () returned 0x27e800 [0045.721] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.721] lstrcmpW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.721] StrStrW (lpFirst="SpecialNavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.721] lstrcmpW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.721] GetCurrentThreadId () returned 0x9b0 [0045.721] RtlWakeConditionVariable () returned 0x27e800 [0045.721] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.721] lstrcmpW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.721] StrStrW (lpFirst="SpecialNavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.721] lstrcmpW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.721] GetCurrentThreadId () returned 0x9b0 [0045.721] RtlWakeConditionVariable () returned 0x27e800 [0045.721] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.721] lstrcmpW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.721] StrStrW (lpFirst="SpecialNavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.721] lstrcmpW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.721] GetCurrentThreadId () returned 0x9b0 [0045.721] RtlWakeConditionVariable () returned 0x27e800 [0045.721] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.721] lstrcmpW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.721] StrStrW (lpFirst="SpecialNavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.721] lstrcmpW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.721] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.721] GetCurrentThreadId () returned 0x9b0 [0045.722] RtlWakeConditionVariable () returned 0x27e800 [0045.722] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.722] lstrcmpW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.722] StrStrW (lpFirst="SpecialNavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.722] lstrcmpW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xe0) returned 0x315f80 [0045.722] GetCurrentThreadId () returned 0x9b0 [0045.722] RtlWakeConditionVariable () returned 0x27e800 [0045.722] lstrcmpiW (lpString1="specialoccasion.png", lpString2="Windows") returned -1 [0045.722] lstrcmpW (lpString1="specialoccasion.png", lpString2="32.EXE.exe") returned 1 [0045.722] StrStrW (lpFirst="specialoccasion.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.722] lstrcmpW (lpString1="specialoccasion.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.722] GetCurrentThreadId () returned 0x9b0 [0045.722] RtlWakeConditionVariable () returned 0x27e800 [0045.722] lstrcmpiW (lpString1="whitemask1047.png", lpString2="Windows") returned -1 [0045.722] lstrcmpW (lpString1="whitemask1047.png", lpString2="32.EXE.exe") returned 1 [0045.722] StrStrW (lpFirst="whitemask1047.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.722] lstrcmpW (lpString1="whitemask1047.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.722] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.722] GetCurrentThreadId () returned 0x9b0 [0045.722] RtlWakeConditionVariable () returned 0x27e800 [0045.722] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="Windows") returned -1 [0045.722] lstrcmpW (lpString1="whitevignette1047.png", lpString2="32.EXE.exe") returned 1 [0045.723] StrStrW (lpFirst="whitevignette1047.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.723] lstrcmpW (lpString1="whitevignette1047.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.723] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.723] GetCurrentThreadId () returned 0x9b0 [0045.723] RtlWakeConditionVariable () returned 0x27e800 [0045.723] RtlWakeConditionVariable () returned 0x27e800 [0045.723] lstrcmpiW (lpString1="Sports", lpString2="Windows") returned -1 [0045.723] lstrcmpW (lpString1="Sports", lpString2=".") returned 1 [0045.723] lstrcmpW (lpString1="Sports", lpString2="..") returned 1 [0045.724] lstrcmpW (lpString1="Sports", lpString2="AppData") returned 1 [0045.724] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports", lpSrch="AppData") returned 0x0 [0045.724] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports", lpString2="C:\\Windows") returned -1 [0045.724] lstrlenW (lpString="C:\\Windows") returned 10 [0045.724] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports", lpString2="C:\\System Volume Information") returned -1 [0045.724] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.724] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.784] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.784] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.784] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.784] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.784] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.784] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.788] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.788] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.788] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.788] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.788] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.789] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.789] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0045.789] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="Windows") returned -1 [0045.789] lstrcmpW (lpString1="CircleSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.789] StrStrW (lpFirst="CircleSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.789] lstrcmpW (lpString1="CircleSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.789] GetCurrentThreadId () returned 0x9b0 [0045.789] RtlWakeConditionVariable () returned 0x27e800 [0045.789] lstrcmpiW (lpString1="GoldRing.png", lpString2="Windows") returned -1 [0045.789] lstrcmpW (lpString1="GoldRing.png", lpString2="32.EXE.exe") returned 1 [0045.789] StrStrW (lpFirst="GoldRing.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.789] lstrcmpW (lpString1="GoldRing.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.789] GetCurrentThreadId () returned 0x9b0 [0045.789] RtlWakeConditionVariable () returned 0x27e800 [0045.789] lstrcmpiW (lpString1="highlight.png", lpString2="Windows") returned -1 [0045.789] lstrcmpW (lpString1="highlight.png", lpString2="32.EXE.exe") returned 1 [0045.789] StrStrW (lpFirst="highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.789] lstrcmpW (lpString1="highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.789] GetCurrentThreadId () returned 0x9b0 [0045.789] RtlWakeConditionVariable () returned 0x27e800 [0045.789] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="Windows") returned -1 [0045.789] lstrcmpW (lpString1="NavigationButtonSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.789] StrStrW (lpFirst="NavigationButtonSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.789] lstrcmpW (lpString1="NavigationButtonSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.789] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.789] GetCurrentThreadId () returned 0x9b0 [0045.790] RtlWakeConditionVariable () returned 0x27e800 [0045.790] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="Windows") returned -1 [0045.790] lstrcmpW (lpString1="NextMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.790] StrStrW (lpFirst="NextMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.790] lstrcmpW (lpString1="NextMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.790] GetCurrentThreadId () returned 0x9b0 [0045.790] RtlWakeConditionVariable () returned 0x27e800 [0045.790] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="Windows") returned -1 [0045.790] lstrcmpW (lpString1="ParentMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.790] StrStrW (lpFirst="ParentMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.790] lstrcmpW (lpString1="ParentMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.790] GetCurrentThreadId () returned 0x9b0 [0045.790] RtlWakeConditionVariable () returned 0x27e800 [0045.790] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="Windows") returned -1 [0045.790] lstrcmpW (lpString1="PreviousMenuButtonIcon.png", lpString2="32.EXE.exe") returned 1 [0045.790] StrStrW (lpFirst="PreviousMenuButtonIcon.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.790] lstrcmpW (lpString1="PreviousMenuButtonIcon.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.790] GetCurrentThreadId () returned 0x9b0 [0045.790] RtlWakeConditionVariable () returned 0x27e800 [0045.790] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="Windows") returned -1 [0045.790] lstrcmpW (lpString1="SceneButtonInset_Alpha1.png", lpString2="32.EXE.exe") returned 1 [0045.790] StrStrW (lpFirst="SceneButtonInset_Alpha1.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.790] lstrcmpW (lpString1="SceneButtonInset_Alpha1.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.790] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.790] GetCurrentThreadId () returned 0x9b0 [0045.791] RtlWakeConditionVariable () returned 0x27e800 [0045.791] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="Windows") returned -1 [0045.791] lstrcmpW (lpString1="SceneButtonInset_Alpha2.png", lpString2="32.EXE.exe") returned 1 [0045.791] StrStrW (lpFirst="SceneButtonInset_Alpha2.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.791] lstrcmpW (lpString1="SceneButtonInset_Alpha2.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.791] GetCurrentThreadId () returned 0x9b0 [0045.791] RtlWakeConditionVariable () returned 0x27e800 [0045.791] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="Windows") returned -1 [0045.791] lstrcmpW (lpString1="SceneButtonSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.791] StrStrW (lpFirst="SceneButtonSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.791] lstrcmpW (lpString1="SceneButtonSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.791] GetCurrentThreadId () returned 0x9b0 [0045.791] RtlWakeConditionVariable () returned 0x27e800 [0045.791] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="Windows") returned -1 [0045.791] lstrcmpW (lpString1="SportsMainBackground.wmv", lpString2="32.EXE.exe") returned 1 [0045.791] StrStrW (lpFirst="SportsMainBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.791] lstrcmpW (lpString1="SportsMainBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.791] GetCurrentThreadId () returned 0x9b0 [0045.791] RtlWakeConditionVariable () returned 0x27e800 [0045.791] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="Windows") returned -1 [0045.791] lstrcmpW (lpString1="SportsMainBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.791] StrStrW (lpFirst="SportsMainBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.791] lstrcmpW (lpString1="SportsMainBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.791] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.791] GetCurrentThreadId () returned 0x9b0 [0045.791] RtlWakeConditionVariable () returned 0x27e800 [0045.792] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="Windows") returned -1 [0045.792] lstrcmpW (lpString1="SportsMainToNotesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0045.792] StrStrW (lpFirst="SportsMainToNotesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.792] lstrcmpW (lpString1="SportsMainToNotesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.792] GetCurrentThreadId () returned 0x9b0 [0045.792] RtlWakeConditionVariable () returned 0x27e800 [0045.792] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="Windows") returned -1 [0045.792] lstrcmpW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.792] StrStrW (lpFirst="SportsMainToNotesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.792] lstrcmpW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.792] GetCurrentThreadId () returned 0x9b0 [0045.792] RtlWakeConditionVariable () returned 0x27e800 [0045.792] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="Windows") returned -1 [0045.792] lstrcmpW (lpString1="SportsMainToScenesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0045.792] StrStrW (lpFirst="SportsMainToScenesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.792] lstrcmpW (lpString1="SportsMainToScenesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.792] GetCurrentThreadId () returned 0x9b0 [0045.792] RtlWakeConditionVariable () returned 0x27e800 [0045.792] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="Windows") returned -1 [0045.792] lstrcmpW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.792] StrStrW (lpFirst="SportsMainToScenesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.792] lstrcmpW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.792] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2daab0 [0045.792] GetCurrentThreadId () returned 0x9b0 [0045.792] RtlWakeConditionVariable () returned 0x27e800 [0045.793] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="Windows") returned -1 [0045.793] lstrcmpW (lpString1="SportsNotesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0045.793] StrStrW (lpFirst="SportsNotesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.793] lstrcmpW (lpString1="SportsNotesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.793] GetCurrentThreadId () returned 0x9b0 [0045.793] RtlWakeConditionVariable () returned 0x27e800 [0045.793] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="Windows") returned -1 [0045.793] lstrcmpW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.793] StrStrW (lpFirst="SportsNotesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.793] lstrcmpW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.793] GetCurrentThreadId () returned 0x9b0 [0045.793] RtlWakeConditionVariable () returned 0x27e800 [0045.793] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="Windows") returned -1 [0045.793] lstrcmpW (lpString1="SportsScenesBackground.wmv", lpString2="32.EXE.exe") returned 1 [0045.793] StrStrW (lpFirst="SportsScenesBackground.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.793] lstrcmpW (lpString1="SportsScenesBackground.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.793] GetCurrentThreadId () returned 0x9b0 [0045.793] RtlWakeConditionVariable () returned 0x27e800 [0045.793] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="Windows") returned -1 [0045.793] lstrcmpW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.793] StrStrW (lpFirst="SportsScenesBackground_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.793] lstrcmpW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.793] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x2f2ca0 [0045.793] GetCurrentThreadId () returned 0x9b0 [0045.793] RtlWakeConditionVariable () returned 0x27e800 [0045.794] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="Windows") returned -1 [0045.794] lstrcmpW (lpString1="sports_disc_mask.png", lpString2="32.EXE.exe") returned 1 [0045.794] StrStrW (lpFirst="sports_disc_mask.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.794] lstrcmpW (lpString1="sports_disc_mask.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.794] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.794] GetCurrentThreadId () returned 0x9b0 [0045.794] RtlWakeConditionVariable () returned 0x27e800 [0045.794] RtlWakeConditionVariable () returned 0x27e800 [0045.794] lstrcmpiW (lpString1="Stacking", lpString2="Windows") returned -1 [0045.794] lstrcmpW (lpString1="Stacking", lpString2=".") returned 1 [0045.795] lstrcmpW (lpString1="Stacking", lpString2="..") returned 1 [0045.795] lstrcmpW (lpString1="Stacking", lpString2="AppData") returned 1 [0045.795] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking", lpSrch="AppData") returned 0x0 [0045.795] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking", lpString2="C:\\Windows") returned -1 [0045.795] lstrlenW (lpString="C:\\Windows") returned 10 [0045.795] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking", lpString2="C:\\System Volume Information") returned -1 [0045.795] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.795] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0045.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.816] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.816] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.816] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.816] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.817] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.817] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.817] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.817] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.817] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.817] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.817] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.817] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.817] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.817] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.817] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.817] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.817] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.817] GetCurrentThreadId () returned 0x9b0 [0045.817] RtlWakeConditionVariable () returned 0x27e800 [0045.817] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="Windows") returned -1 [0045.817] lstrcmpW (lpString1="1047x576_91n92.png", lpString2="32.EXE.exe") returned -1 [0045.817] StrStrW (lpFirst="1047x576_91n92.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.817] lstrcmpW (lpString1="1047x576_91n92.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.817] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.817] GetCurrentThreadId () returned 0x9b0 [0045.818] RtlWakeConditionVariable () returned 0x27e800 [0045.818] lstrcmpiW (lpString1="15x15dot.png", lpString2="Windows") returned -1 [0045.818] lstrcmpW (lpString1="15x15dot.png", lpString2="32.EXE.exe") returned -1 [0045.818] StrStrW (lpFirst="15x15dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.818] lstrcmpW (lpString1="15x15dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.818] GetCurrentThreadId () returned 0x9b0 [0045.818] RtlWakeConditionVariable () returned 0x27e800 [0045.818] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="Windows") returned -1 [0045.818] lstrcmpW (lpString1="720x480icongraphic.png", lpString2="32.EXE.exe") returned 1 [0045.818] StrStrW (lpFirst="720x480icongraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.818] lstrcmpW (lpString1="720x480icongraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.818] GetCurrentThreadId () returned 0x9b0 [0045.818] RtlWakeConditionVariable () returned 0x27e800 [0045.818] lstrcmpiW (lpString1="720_480shadow.png", lpString2="Windows") returned -1 [0045.818] lstrcmpW (lpString1="720_480shadow.png", lpString2="32.EXE.exe") returned 1 [0045.818] StrStrW (lpFirst="720_480shadow.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.818] lstrcmpW (lpString1="720_480shadow.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.818] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319d98 [0045.818] GetCurrentThreadId () returned 0x9b0 [0045.818] RtlWakeConditionVariable () returned 0x27e800 [0045.818] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.818] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.818] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.819] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9440 [0045.819] GetCurrentThreadId () returned 0x9b0 [0045.819] RtlWakeConditionVariable () returned 0x27e800 [0045.819] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.819] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.819] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.819] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9440 [0045.819] GetCurrentThreadId () returned 0x9b0 [0045.819] RtlWakeConditionVariable () returned 0x27e800 [0045.819] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.819] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.819] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.819] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9440 [0045.819] GetCurrentThreadId () returned 0x9b0 [0045.819] RtlWakeConditionVariable () returned 0x27e800 [0045.819] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.819] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.819] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.819] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.819] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x2a01c8 [0045.819] GetCurrentThreadId () returned 0x9b0 [0045.819] RtlWakeConditionVariable () returned 0x27e800 [0045.819] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.820] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.820] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.820] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.820] GetCurrentThreadId () returned 0x9b0 [0045.820] RtlWakeConditionVariable () returned 0x27e800 [0045.820] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.820] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.820] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.820] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f9440 [0045.820] GetCurrentThreadId () returned 0x9b0 [0045.820] RtlWakeConditionVariable () returned 0x27e800 [0045.820] lstrcmpiW (lpString1="photograph.png", lpString2="Windows") returned -1 [0045.820] lstrcmpW (lpString1="photograph.png", lpString2="32.EXE.exe") returned 1 [0045.820] StrStrW (lpFirst="photograph.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.820] lstrcmpW (lpString1="photograph.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.820] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.820] GetCurrentThreadId () returned 0x9b0 [0045.820] RtlWakeConditionVariable () returned 0x27e800 [0045.821] RtlWakeConditionVariable () returned 0x27e800 [0045.821] lstrcmpiW (lpString1="Travel", lpString2="Windows") returned -1 [0045.821] lstrcmpW (lpString1="Travel", lpString2=".") returned 1 [0045.821] lstrcmpW (lpString1="Travel", lpString2="..") returned 1 [0045.821] lstrcmpW (lpString1="Travel", lpString2="AppData") returned 1 [0045.821] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel", lpSrch="AppData") returned 0x0 [0045.822] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel", lpString2="C:\\Windows") returned -1 [0045.822] lstrlenW (lpString="C:\\Windows") returned 10 [0045.822] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel", lpString2="C:\\System Volume Information") returned -1 [0045.822] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.822] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.902] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.902] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.902] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.902] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.902] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.902] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.902] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.902] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.902] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.902] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.902] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.902] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.902] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0045.902] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="Windows") returned -1 [0045.902] lstrcmpW (lpString1="16_9-frame-background.png", lpString2="32.EXE.exe") returned -1 [0045.902] StrStrW (lpFirst="16_9-frame-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.902] lstrcmpW (lpString1="16_9-frame-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.902] GetCurrentThreadId () returned 0x9b0 [0045.902] RtlWakeConditionVariable () returned 0x27e800 [0045.903] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="Windows") returned -1 [0045.903] lstrcmpW (lpString1="16_9-frame-highlight.png", lpString2="32.EXE.exe") returned -1 [0045.903] StrStrW (lpFirst="16_9-frame-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.903] lstrcmpW (lpString1="16_9-frame-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.903] GetCurrentThreadId () returned 0x9b0 [0045.903] RtlWakeConditionVariable () returned 0x27e800 [0045.903] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="Windows") returned -1 [0045.903] lstrcmpW (lpString1="16_9-frame-image-inset.png", lpString2="32.EXE.exe") returned -1 [0045.903] StrStrW (lpFirst="16_9-frame-image-inset.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.903] lstrcmpW (lpString1="16_9-frame-image-inset.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.903] GetCurrentThreadId () returned 0x9b0 [0045.903] RtlWakeConditionVariable () returned 0x27e800 [0045.903] lstrcmpiW (lpString1="btn-back-static.png", lpString2="Windows") returned -1 [0045.903] lstrcmpW (lpString1="btn-back-static.png", lpString2="32.EXE.exe") returned 1 [0045.903] StrStrW (lpFirst="btn-back-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.903] lstrcmpW (lpString1="btn-back-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.903] GetCurrentThreadId () returned 0x9b0 [0045.903] RtlWakeConditionVariable () returned 0x27e800 [0045.903] lstrcmpiW (lpString1="btn-next-static.png", lpString2="Windows") returned -1 [0045.903] lstrcmpW (lpString1="btn-next-static.png", lpString2="32.EXE.exe") returned 1 [0045.903] StrStrW (lpFirst="btn-next-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.903] lstrcmpW (lpString1="btn-next-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.903] GetCurrentThreadId () returned 0x9b0 [0045.903] RtlWakeConditionVariable () returned 0x27e800 [0045.904] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="Windows") returned -1 [0045.904] lstrcmpW (lpString1="btn-previous-static.png", lpString2="32.EXE.exe") returned 1 [0045.904] StrStrW (lpFirst="btn-previous-static.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.904] lstrcmpW (lpString1="btn-previous-static.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.904] GetCurrentThreadId () returned 0x9b0 [0045.904] RtlWakeConditionVariable () returned 0x27e800 [0045.904] lstrcmpiW (lpString1="button-bullet.png", lpString2="Windows") returned -1 [0045.904] lstrcmpW (lpString1="button-bullet.png", lpString2="32.EXE.exe") returned 1 [0045.904] StrStrW (lpFirst="button-bullet.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.904] lstrcmpW (lpString1="button-bullet.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.904] GetCurrentThreadId () returned 0x9b0 [0045.904] RtlWakeConditionVariable () returned 0x27e800 [0045.904] lstrcmpiW (lpString1="button-highlight.png", lpString2="Windows") returned -1 [0045.904] lstrcmpW (lpString1="button-highlight.png", lpString2="32.EXE.exe") returned 1 [0045.904] StrStrW (lpFirst="button-highlight.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.904] lstrcmpW (lpString1="button-highlight.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.904] GetCurrentThreadId () returned 0x9b0 [0045.904] RtlWakeConditionVariable () returned 0x27e800 [0045.904] lstrcmpiW (lpString1="content-background.png", lpString2="Windows") returned -1 [0045.904] lstrcmpW (lpString1="content-background.png", lpString2="32.EXE.exe") returned 1 [0045.904] StrStrW (lpFirst="content-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.904] lstrcmpW (lpString1="content-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.904] GetCurrentThreadId () returned 0x9b0 [0045.904] RtlWakeConditionVariable () returned 0x27e800 [0045.905] lstrcmpiW (lpString1="header-background.png", lpString2="Windows") returned -1 [0045.905] lstrcmpW (lpString1="header-background.png", lpString2="32.EXE.exe") returned 1 [0045.905] StrStrW (lpFirst="header-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.905] lstrcmpW (lpString1="header-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.905] GetCurrentThreadId () returned 0x9b0 [0045.905] RtlWakeConditionVariable () returned 0x27e800 [0045.905] lstrcmpiW (lpString1="passport.png", lpString2="Windows") returned -1 [0045.905] lstrcmpW (lpString1="passport.png", lpString2="32.EXE.exe") returned 1 [0045.905] StrStrW (lpFirst="passport.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.905] lstrcmpW (lpString1="passport.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.905] GetCurrentThreadId () returned 0x9b0 [0045.905] RtlWakeConditionVariable () returned 0x27e800 [0045.905] lstrcmpiW (lpString1="Passport.wmv", lpString2="Windows") returned -1 [0045.905] lstrcmpW (lpString1="Passport.wmv", lpString2="32.EXE.exe") returned 1 [0045.905] StrStrW (lpFirst="Passport.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.905] lstrcmpW (lpString1="Passport.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.905] GetCurrentThreadId () returned 0x9b0 [0045.905] RtlWakeConditionVariable () returned 0x27e800 [0045.905] lstrcmpiW (lpString1="passportcover.png", lpString2="Windows") returned -1 [0045.905] lstrcmpW (lpString1="passportcover.png", lpString2="32.EXE.exe") returned 1 [0045.905] StrStrW (lpFirst="passportcover.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.905] lstrcmpW (lpString1="passportcover.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.905] GetCurrentThreadId () returned 0x9b0 [0045.905] RtlWakeConditionVariable () returned 0x27e800 [0045.906] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="Windows") returned -1 [0045.906] lstrcmpW (lpString1="PassportMask.wmv", lpString2="32.EXE.exe") returned 1 [0045.906] StrStrW (lpFirst="PassportMask.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.906] lstrcmpW (lpString1="PassportMask.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.906] GetCurrentThreadId () returned 0x9b0 [0045.906] RtlWakeConditionVariable () returned 0x27e800 [0045.906] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="Windows") returned -1 [0045.906] lstrcmpW (lpString1="PassportMask_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.906] StrStrW (lpFirst="PassportMask_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.906] lstrcmpW (lpString1="PassportMask_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.906] GetCurrentThreadId () returned 0x9b0 [0045.906] RtlWakeConditionVariable () returned 0x27e800 [0045.906] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="Windows") returned -1 [0045.906] lstrcmpW (lpString1="passport_mask_left.png", lpString2="32.EXE.exe") returned 1 [0045.906] StrStrW (lpFirst="passport_mask_left.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.906] lstrcmpW (lpString1="passport_mask_left.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.906] GetCurrentThreadId () returned 0x9b0 [0045.906] RtlWakeConditionVariable () returned 0x27e800 [0045.906] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="Windows") returned -1 [0045.906] lstrcmpW (lpString1="passport_mask_right.png", lpString2="32.EXE.exe") returned 1 [0045.906] StrStrW (lpFirst="passport_mask_right.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.906] lstrcmpW (lpString1="passport_mask_right.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.906] GetCurrentThreadId () returned 0x9b0 [0045.906] RtlWakeConditionVariable () returned 0x27e800 [0045.907] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="Windows") returned -1 [0045.907] lstrcmpW (lpString1="Passport_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.907] StrStrW (lpFirst="Passport_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.907] lstrcmpW (lpString1="Passport_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.907] GetCurrentThreadId () returned 0x9b0 [0045.907] RtlWakeConditionVariable () returned 0x27e800 [0045.907] lstrcmpiW (lpString1="play-background.png", lpString2="Windows") returned -1 [0045.907] lstrcmpW (lpString1="play-background.png", lpString2="32.EXE.exe") returned 1 [0045.907] StrStrW (lpFirst="play-background.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.907] lstrcmpW (lpString1="play-background.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.907] GetCurrentThreadId () returned 0x9b0 [0045.907] RtlWakeConditionVariable () returned 0x27e800 [0045.907] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="Windows") returned -1 [0045.907] lstrcmpW (lpString1="selection_subpicture.png", lpString2="32.EXE.exe") returned 1 [0045.907] StrStrW (lpFirst="selection_subpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.907] lstrcmpW (lpString1="selection_subpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.907] GetCurrentThreadId () returned 0x9b0 [0045.907] RtlWakeConditionVariable () returned 0x27e800 [0045.907] lstrcmpiW (lpString1="travel.png", lpString2="Windows") returned -1 [0045.907] lstrcmpW (lpString1="travel.png", lpString2="32.EXE.exe") returned 1 [0045.907] StrStrW (lpFirst="travel.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.907] lstrcmpW (lpString1="travel.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.907] GetCurrentThreadId () returned 0x9b0 [0045.907] RtlWakeConditionVariable () returned 0x27e800 [0045.908] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="Windows") returned -1 [0045.908] lstrcmpW (lpString1="TravelIntroToMain.wmv", lpString2="32.EXE.exe") returned 1 [0045.908] StrStrW (lpFirst="TravelIntroToMain.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.908] lstrcmpW (lpString1="TravelIntroToMain.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.908] GetCurrentThreadId () returned 0x9b0 [0045.908] RtlWakeConditionVariable () returned 0x27e800 [0045.908] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="Windows") returned -1 [0045.908] lstrcmpW (lpString1="TravelIntroToMainMask.wmv", lpString2="32.EXE.exe") returned 1 [0045.908] StrStrW (lpFirst="TravelIntroToMainMask.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.908] lstrcmpW (lpString1="TravelIntroToMainMask.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.908] GetCurrentThreadId () returned 0x9b0 [0045.908] RtlWakeConditionVariable () returned 0x27e800 [0045.908] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="Windows") returned -1 [0045.908] lstrcmpW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.908] StrStrW (lpFirst="TravelIntroToMainMask_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.908] lstrcmpW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.908] GetCurrentThreadId () returned 0x9b0 [0045.908] RtlWakeConditionVariable () returned 0x27e800 [0045.908] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="Windows") returned -1 [0045.908] lstrcmpW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="32.EXE.exe") returned 1 [0045.908] StrStrW (lpFirst="TravelIntroToMain_PAL.wmv", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.908] lstrcmpW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.908] GetCurrentThreadId () returned 0x9b0 [0045.908] RtlWakeConditionVariable () returned 0x27e800 [0045.909] RtlWakeConditionVariable () returned 0x27e800 [0045.909] lstrcmpiW (lpString1="VideoWall", lpString2="Windows") returned -1 [0045.909] lstrcmpW (lpString1="VideoWall", lpString2=".") returned 1 [0045.909] lstrcmpW (lpString1="VideoWall", lpString2="..") returned 1 [0045.909] lstrcmpW (lpString1="VideoWall", lpString2="AppData") returned 1 [0045.909] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall", lpSrch="AppData") returned 0x0 [0045.909] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall", lpString2="C:\\Windows") returned -1 [0045.909] lstrlenW (lpString="C:\\Windows") returned 10 [0045.910] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall", lpString2="C:\\System Volume Information") returned -1 [0045.910] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.910] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.910] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.910] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.910] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.910] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.910] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.910] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.910] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.910] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.910] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.910] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.910] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.910] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0045.910] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="Windows") returned -1 [0045.910] lstrcmpW (lpString1="203x8subpicture.png", lpString2="32.EXE.exe") returned -1 [0045.910] StrStrW (lpFirst="203x8subpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.910] lstrcmpW (lpString1="203x8subpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a230 [0045.910] GetCurrentThreadId () returned 0x9b0 [0045.911] RtlWakeConditionVariable () returned 0x27e800 [0045.911] lstrcmpiW (lpString1="videowall.png", lpString2="Windows") returned -1 [0045.911] lstrcmpW (lpString1="videowall.png", lpString2="32.EXE.exe") returned 1 [0045.911] StrStrW (lpFirst="videowall.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.911] lstrcmpW (lpString1="videowall.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.911] GetCurrentThreadId () returned 0x9b0 [0045.911] RtlWakeConditionVariable () returned 0x27e800 [0045.911] RtlWakeConditionVariable () returned 0x27e800 [0045.911] lstrcmpiW (lpString1="Vignette", lpString2="Windows") returned -1 [0045.912] lstrcmpW (lpString1="Vignette", lpString2=".") returned 1 [0045.912] lstrcmpW (lpString1="Vignette", lpString2="..") returned 1 [0045.912] lstrcmpW (lpString1="Vignette", lpString2="AppData") returned 1 [0045.912] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette", lpSrch="AppData") returned 0x0 [0045.912] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette", lpString2="C:\\Windows") returned -1 [0045.912] lstrlenW (lpString="C:\\Windows") returned 10 [0045.912] lstrcmpiW (lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette", lpString2="C:\\System Volume Information") returned -1 [0045.912] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0045.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0045.980] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0045.980] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.980] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0045.980] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.980] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.980] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0045.980] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0045.980] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.983] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.983] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0045.983] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.983] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.992] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0045.992] lstrcmpiW (lpString1="1047x576black.png", lpString2="Windows") returned -1 [0045.992] lstrcmpW (lpString1="1047x576black.png", lpString2="32.EXE.exe") returned -1 [0045.992] StrStrW (lpFirst="1047x576black.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.992] lstrcmpW (lpString1="1047x576black.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a770 [0045.992] GetCurrentThreadId () returned 0x9b0 [0045.993] RtlWakeConditionVariable () returned 0x27e800 [0045.993] lstrcmpiW (lpString1="15x15dot.png", lpString2="Windows") returned -1 [0045.993] lstrcmpW (lpString1="15x15dot.png", lpString2="32.EXE.exe") returned -1 [0045.993] StrStrW (lpFirst="15x15dot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.993] lstrcmpW (lpString1="15x15dot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.993] GetCurrentThreadId () returned 0x9b0 [0045.993] RtlWakeConditionVariable () returned 0x27e800 [0045.993] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.993] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.993] StrStrW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.993] lstrcmpW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.993] GetCurrentThreadId () returned 0x9b0 [0045.993] RtlWakeConditionVariable () returned 0x27e800 [0045.993] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.993] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.993] StrStrW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.993] lstrcmpW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.993] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.993] GetCurrentThreadId () returned 0x9b0 [0045.994] RtlWakeConditionVariable () returned 0x27e800 [0045.994] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.994] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.994] StrStrW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.994] lstrcmpW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.994] GetCurrentThreadId () returned 0x9b0 [0045.994] RtlWakeConditionVariable () returned 0x27e800 [0045.994] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.994] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.994] StrStrW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.994] lstrcmpW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xd0) returned 0x29f958 [0045.994] GetCurrentThreadId () returned 0x9b0 [0045.994] RtlWakeConditionVariable () returned 0x27e800 [0045.994] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="Windows") returned -1 [0045.994] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="32.EXE.exe") returned 1 [0045.994] StrStrW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.994] lstrcmpW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0045.994] GetCurrentThreadId () returned 0x9b0 [0045.994] RtlWakeConditionVariable () returned 0x27e800 [0045.994] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="Windows") returned -1 [0045.994] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="32.EXE.exe") returned 1 [0045.994] StrStrW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.994] lstrcmpW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.994] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0045.994] GetCurrentThreadId () returned 0x9b0 [0045.995] RtlWakeConditionVariable () returned 0x27e800 [0045.995] lstrcmpiW (lpString1="softedges.png", lpString2="Windows") returned -1 [0045.995] lstrcmpW (lpString1="softedges.png", lpString2="32.EXE.exe") returned 1 [0045.995] StrStrW (lpFirst="softedges.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.995] lstrcmpW (lpString1="softedges.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.995] GetCurrentThreadId () returned 0x9b0 [0045.995] RtlWakeConditionVariable () returned 0x27e800 [0045.995] lstrcmpiW (lpString1="vignettemask25.png", lpString2="Windows") returned -1 [0045.995] lstrcmpW (lpString1="vignettemask25.png", lpString2="32.EXE.exe") returned 1 [0045.995] StrStrW (lpFirst="vignettemask25.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.995] lstrcmpW (lpString1="vignettemask25.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a770 [0045.995] GetCurrentThreadId () returned 0x9b0 [0045.995] RtlWakeConditionVariable () returned 0x27e800 [0045.995] lstrcmpiW (lpString1="whiteband.png", lpString2="Windows") returned -1 [0045.995] lstrcmpW (lpString1="whiteband.png", lpString2="32.EXE.exe") returned 1 [0045.995] StrStrW (lpFirst="whiteband.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.995] lstrcmpW (lpString1="whiteband.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.995] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0045.995] GetCurrentThreadId () returned 0x9b0 [0045.995] RtlWakeConditionVariable () returned 0x27e800 [0045.996] RtlWakeConditionVariable () returned 0x27e800 [0045.996] lstrcmpiW (lpString1="WhiteDot.png", lpString2="Windows") returned -1 [0045.996] lstrcmpW (lpString1="WhiteDot.png", lpString2="32.EXE.exe") returned 1 [0045.996] StrStrW (lpFirst="WhiteDot.png", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.996] lstrcmpW (lpString1="WhiteDot.png", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.996] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0045.996] GetCurrentThreadId () returned 0x9b0 [0045.996] RtlWakeConditionVariable () returned 0x27e800 [0045.996] RtlWakeConditionVariable () returned 0x27e800 [0045.998] lstrcmpiW (lpString1="Filters.xml", lpString2="Windows") returned -1 [0045.998] lstrcmpW (lpString1="Filters.xml", lpString2="32.EXE.exe") returned 1 [0045.998] StrStrW (lpFirst="Filters.xml", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.998] lstrcmpW (lpString1="Filters.xml", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0045.998] GetCurrentThreadId () returned 0x9b0 [0045.998] RtlWakeConditionVariable () returned 0x27e800 [0045.998] lstrcmpiW (lpString1="Parity.fx", lpString2="Windows") returned -1 [0045.998] lstrcmpW (lpString1="Parity.fx", lpString2="32.EXE.exe") returned 1 [0045.998] StrStrW (lpFirst="Parity.fx", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.998] lstrcmpW (lpString1="Parity.fx", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0045.998] GetCurrentThreadId () returned 0x9b0 [0045.998] RtlWakeConditionVariable () returned 0x27e800 [0045.998] RtlWakeConditionVariable () returned 0x27e800 [0045.998] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="Windows") returned -1 [0045.998] lstrcmpW (lpString1="soniccolorconverter.ax", lpString2="32.EXE.exe") returned 1 [0045.998] StrStrW (lpFirst="soniccolorconverter.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.998] lstrcmpW (lpString1="soniccolorconverter.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0045.998] GetCurrentThreadId () returned 0x9b0 [0045.998] RtlWakeConditionVariable () returned 0x27e800 [0045.998] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="Windows") returned -1 [0045.998] lstrcmpW (lpString1="sonicsptransform.ax", lpString2="32.EXE.exe") returned 1 [0045.998] StrStrW (lpFirst="sonicsptransform.ax", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.998] lstrcmpW (lpString1="sonicsptransform.ax", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.998] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0045.998] GetCurrentThreadId () returned 0x9b0 [0045.999] RtlWakeConditionVariable () returned 0x27e800 [0045.999] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="Windows") returned 1 [0045.999] lstrcmpW (lpString1="WMM2CLIP.dll", lpString2="32.EXE.exe") returned 1 [0045.999] StrStrW (lpFirst="WMM2CLIP.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0045.999] lstrcmpW (lpString1="WMM2CLIP.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0045.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0045.999] GetCurrentThreadId () returned 0x9b0 [0045.999] RtlWakeConditionVariable () returned 0x27e800 [0045.999] RtlWakeConditionVariable () returned 0x27e800 [0045.999] lstrcmpiW (lpString1="Internet Explorer", lpString2="Windows") returned -1 [0045.999] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0045.999] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0045.999] lstrcmpW (lpString1="Internet Explorer", lpString2="AppData") returned 1 [0045.999] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Internet Explorer", lpSrch="AppData") returned 0x0 [0045.999] lstrcmpiW (lpString1="C:\\Program Files\\Internet Explorer", lpString2="C:\\Windows") returned -1 [0045.999] lstrlenW (lpString="C:\\Windows") returned 10 [0045.999] lstrcmpiW (lpString1="C:\\Program Files\\Internet Explorer", lpString2="C:\\System Volume Information") returned -1 [0045.999] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0045.999] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0046.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96778b50, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x96778b50, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299108 [0046.000] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.000] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.000] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.000] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.000] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x96778b50, ftLastAccessTime.dwHighDateTime=0x1d585b4, ftLastWriteTime.dwLowDateTime=0x96778b50, ftLastWriteTime.dwHighDateTime=0x1d585b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0046.000] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.000] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.000] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.000] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.000] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="en-US", cAlternateFileName="")) returned 1 [0046.000] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0046.000] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0046.001] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0046.001] lstrcmpW (lpString1="en-US", lpString2="AppData") returned 1 [0046.001] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US", lpSrch="AppData") returned 0x0 [0046.001] lstrcmpiW (lpString1="C:\\Program Files\\Internet Explorer\\en-US", lpString2="C:\\Windows") returned -1 [0046.001] lstrlenW (lpString="C:\\Windows") returned 10 [0046.001] lstrcmpiW (lpString1="C:\\Program Files\\Internet Explorer\\en-US", lpString2="C:\\System Volume Information") returned -1 [0046.001] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.001] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0046.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299148 [0046.002] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.002] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.002] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.002] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.002] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.002] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.002] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.002] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.002] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.002] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.002] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.002] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.002] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0046.002] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="Windows") returned -1 [0046.002] lstrcmpW (lpString1="hmmapi.dll.mui", lpString2="32.EXE.exe") returned 1 [0046.002] StrStrW (lpFirst="hmmapi.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.002] lstrcmpW (lpString1="hmmapi.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.002] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.002] GetCurrentThreadId () returned 0x9b0 [0046.002] RtlWakeConditionVariable () returned 0x27e800 [0046.003] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="Windows") returned -1 [0046.003] lstrcmpW (lpString1="iedvtool.dll.mui", lpString2="32.EXE.exe") returned 1 [0046.003] StrStrW (lpFirst="iedvtool.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.003] lstrcmpW (lpString1="iedvtool.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.003] GetCurrentThreadId () returned 0x9b0 [0046.003] RtlWakeConditionVariable () returned 0x27e800 [0046.003] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="Windows") returned -1 [0046.003] lstrcmpW (lpString1="ieinstal.exe.mui", lpString2="32.EXE.exe") returned 1 [0046.003] StrStrW (lpFirst="ieinstal.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.003] lstrcmpW (lpString1="ieinstal.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.003] GetCurrentThreadId () returned 0x9b0 [0046.003] RtlWakeConditionVariable () returned 0x27e800 [0046.003] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="Windows") returned -1 [0046.003] lstrcmpW (lpString1="ielowutil.exe.mui", lpString2="32.EXE.exe") returned 1 [0046.003] StrStrW (lpFirst="ielowutil.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.003] lstrcmpW (lpString1="ielowutil.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.003] GetCurrentThreadId () returned 0x9b0 [0046.003] RtlWakeConditionVariable () returned 0x27e800 [0046.003] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="Windows") returned -1 [0046.003] lstrcmpW (lpString1="iexplore.exe.mui", lpString2="32.EXE.exe") returned 1 [0046.003] StrStrW (lpFirst="iexplore.exe.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.003] lstrcmpW (lpString1="iexplore.exe.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.003] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.003] GetCurrentThreadId () returned 0x9b0 [0046.004] RtlWakeConditionVariable () returned 0x27e800 [0046.004] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="Windows") returned -1 [0046.004] lstrcmpW (lpString1="jsdbgui.dll.mui", lpString2="32.EXE.exe") returned 1 [0046.004] StrStrW (lpFirst="jsdbgui.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.004] lstrcmpW (lpString1="jsdbgui.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.004] GetCurrentThreadId () returned 0x9b0 [0046.004] RtlWakeConditionVariable () returned 0x27e800 [0046.004] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="Windows") returned -1 [0046.004] lstrcmpW (lpString1="jsdebuggeride.dll.mui", lpString2="32.EXE.exe") returned 1 [0046.004] StrStrW (lpFirst="jsdebuggeride.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.004] lstrcmpW (lpString1="jsdebuggeride.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.004] GetCurrentThreadId () returned 0x9b0 [0046.004] RtlWakeConditionVariable () returned 0x27e800 [0046.004] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="Windows") returned -1 [0046.004] lstrcmpW (lpString1="JSProfilerCore.dll.mui", lpString2="32.EXE.exe") returned 1 [0046.004] StrStrW (lpFirst="JSProfilerCore.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.004] lstrcmpW (lpString1="JSProfilerCore.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.004] GetCurrentThreadId () returned 0x9b0 [0046.004] RtlWakeConditionVariable () returned 0x27e800 [0046.004] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="Windows") returned -1 [0046.004] lstrcmpW (lpString1="jsprofilerui.dll.mui", lpString2="32.EXE.exe") returned 1 [0046.004] StrStrW (lpFirst="jsprofilerui.dll.mui", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.004] lstrcmpW (lpString1="jsprofilerui.dll.mui", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.004] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.004] GetCurrentThreadId () returned 0x9b0 [0046.005] RtlWakeConditionVariable () returned 0x27e800 [0046.005] RtlWakeConditionVariable () returned 0x27e800 [0046.005] lstrcmpiW (lpString1="hmmapi.dll", lpString2="Windows") returned -1 [0046.005] lstrcmpW (lpString1="hmmapi.dll", lpString2="32.EXE.exe") returned 1 [0046.005] StrStrW (lpFirst="hmmapi.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.005] lstrcmpW (lpString1="hmmapi.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.005] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.005] GetCurrentThreadId () returned 0x9b0 [0046.005] RtlWakeConditionVariable () returned 0x27e800 [0046.006] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="Windows") returned -1 [0046.006] lstrcmpW (lpString1="ie8props.propdesc", lpString2="32.EXE.exe") returned 1 [0046.006] StrStrW (lpFirst="ie8props.propdesc", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.006] lstrcmpW (lpString1="ie8props.propdesc", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.006] GetCurrentThreadId () returned 0x9b0 [0046.006] RtlWakeConditionVariable () returned 0x27e800 [0046.006] lstrcmpiW (lpString1="iecompat.dll", lpString2="Windows") returned -1 [0046.006] lstrcmpW (lpString1="iecompat.dll", lpString2="32.EXE.exe") returned 1 [0046.006] StrStrW (lpFirst="iecompat.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.006] lstrcmpW (lpString1="iecompat.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.006] GetCurrentThreadId () returned 0x9b0 [0046.006] RtlWakeConditionVariable () returned 0x27e800 [0046.006] lstrcmpiW (lpString1="iedvtool.dll", lpString2="Windows") returned -1 [0046.006] lstrcmpW (lpString1="iedvtool.dll", lpString2="32.EXE.exe") returned 1 [0046.006] StrStrW (lpFirst="iedvtool.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.006] lstrcmpW (lpString1="iedvtool.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.006] GetCurrentThreadId () returned 0x9b0 [0046.006] RtlWakeConditionVariable () returned 0x27e800 [0046.006] lstrcmpiW (lpString1="ieinstal.exe", lpString2="Windows") returned -1 [0046.006] lstrcmpW (lpString1="ieinstal.exe", lpString2="32.EXE.exe") returned 1 [0046.006] StrStrW (lpFirst="ieinstal.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.006] lstrcmpW (lpString1="ieinstal.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.006] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.006] GetCurrentThreadId () returned 0x9b0 [0046.006] RtlWakeConditionVariable () returned 0x27e800 [0046.006] lstrcmpiW (lpString1="ielowutil.exe", lpString2="Windows") returned -1 [0046.007] lstrcmpW (lpString1="ielowutil.exe", lpString2="32.EXE.exe") returned 1 [0046.007] StrStrW (lpFirst="ielowutil.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.007] lstrcmpW (lpString1="ielowutil.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.007] GetCurrentThreadId () returned 0x9b0 [0046.007] RtlWakeConditionVariable () returned 0x27e800 [0046.007] lstrcmpiW (lpString1="ieproxy.dll", lpString2="Windows") returned -1 [0046.007] lstrcmpW (lpString1="ieproxy.dll", lpString2="32.EXE.exe") returned 1 [0046.007] StrStrW (lpFirst="ieproxy.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.007] lstrcmpW (lpString1="ieproxy.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.007] GetCurrentThreadId () returned 0x9b0 [0046.007] RtlWakeConditionVariable () returned 0x27e800 [0046.007] lstrcmpiW (lpString1="IEShims.dll", lpString2="Windows") returned -1 [0046.007] lstrcmpW (lpString1="IEShims.dll", lpString2="32.EXE.exe") returned 1 [0046.007] StrStrW (lpFirst="IEShims.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.007] lstrcmpW (lpString1="IEShims.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.007] GetCurrentThreadId () returned 0x9b0 [0046.007] RtlWakeConditionVariable () returned 0x27e800 [0046.007] lstrcmpiW (lpString1="iexplore.exe", lpString2="Windows") returned -1 [0046.007] lstrcmpW (lpString1="iexplore.exe", lpString2="32.EXE.exe") returned 1 [0046.007] StrStrW (lpFirst="iexplore.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.007] lstrcmpW (lpString1="iexplore.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.007] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.007] GetCurrentThreadId () returned 0x9b0 [0046.007] RtlWakeConditionVariable () returned 0x27e800 [0046.007] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="Windows") returned -1 [0046.007] lstrcmpW (lpString1="jsdbgui.dll", lpString2="32.EXE.exe") returned 1 [0046.008] StrStrW (lpFirst="jsdbgui.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.008] lstrcmpW (lpString1="jsdbgui.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.008] GetCurrentThreadId () returned 0x9b0 [0046.008] RtlWakeConditionVariable () returned 0x27e800 [0046.008] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="Windows") returned -1 [0046.008] lstrcmpW (lpString1="jsdebuggeride.dll", lpString2="32.EXE.exe") returned 1 [0046.008] StrStrW (lpFirst="jsdebuggeride.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.008] lstrcmpW (lpString1="jsdebuggeride.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.008] GetCurrentThreadId () returned 0x9b0 [0046.008] RtlWakeConditionVariable () returned 0x27e800 [0046.008] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="Windows") returned -1 [0046.008] lstrcmpW (lpString1="JSProfilerCore.dll", lpString2="32.EXE.exe") returned 1 [0046.008] StrStrW (lpFirst="JSProfilerCore.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.008] lstrcmpW (lpString1="JSProfilerCore.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.008] GetCurrentThreadId () returned 0x9b0 [0046.008] RtlWakeConditionVariable () returned 0x27e800 [0046.008] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="Windows") returned -1 [0046.008] lstrcmpW (lpString1="jsprofilerui.dll", lpString2="32.EXE.exe") returned 1 [0046.008] StrStrW (lpFirst="jsprofilerui.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.008] lstrcmpW (lpString1="jsprofilerui.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.008] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.008] GetCurrentThreadId () returned 0x9b0 [0046.008] RtlWakeConditionVariable () returned 0x27e800 [0046.008] lstrcmpiW (lpString1="msdbg2.dll", lpString2="Windows") returned -1 [0046.008] lstrcmpW (lpString1="msdbg2.dll", lpString2="32.EXE.exe") returned 1 [0046.008] StrStrW (lpFirst="msdbg2.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.009] lstrcmpW (lpString1="msdbg2.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.009] GetCurrentThreadId () returned 0x9b0 [0046.009] RtlWakeConditionVariable () returned 0x27e800 [0046.009] lstrcmpiW (lpString1="pdm.dll", lpString2="Windows") returned -1 [0046.009] lstrcmpW (lpString1="pdm.dll", lpString2="32.EXE.exe") returned 1 [0046.009] StrStrW (lpFirst="pdm.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.009] lstrcmpW (lpString1="pdm.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x60) returned 0x2d5f88 [0046.009] GetCurrentThreadId () returned 0x9b0 [0046.009] RtlWakeConditionVariable () returned 0x27e800 [0046.009] lstrcmpiW (lpString1="SIGNUP", lpString2="Windows") returned -1 [0046.009] lstrcmpW (lpString1="SIGNUP", lpString2=".") returned 1 [0046.009] lstrcmpW (lpString1="SIGNUP", lpString2="..") returned 1 [0046.009] lstrcmpW (lpString1="SIGNUP", lpString2="AppData") returned 1 [0046.009] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP", lpSrch="AppData") returned 0x0 [0046.009] lstrcmpiW (lpString1="C:\\Program Files\\Internet Explorer\\SIGNUP", lpString2="C:\\Windows") returned -1 [0046.009] lstrlenW (lpString="C:\\Windows") returned 10 [0046.009] lstrcmpiW (lpString1="C:\\Program Files\\Internet Explorer\\SIGNUP", lpString2="C:\\System Volume Information") returned -1 [0046.009] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.009] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0046.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299148 [0046.010] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.010] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.010] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.010] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.010] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.010] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0046.010] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.010] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.010] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.010] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.010] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.010] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.010] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x68, dwReserved1=0x260000, cFileName="install.ins", cAlternateFileName="")) returned 1 [0046.010] lstrcmpiW (lpString1="install.ins", lpString2="Windows") returned -1 [0046.010] lstrcmpW (lpString1="install.ins", lpString2="32.EXE.exe") returned 1 [0046.010] StrStrW (lpFirst="install.ins", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.010] lstrcmpW (lpString1="install.ins", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.010] GetCurrentThreadId () returned 0x9b0 [0046.010] RtlWakeConditionVariable () returned 0x27e800 [0046.010] RtlWakeConditionVariable () returned 0x27e800 [0046.010] lstrcmpiW (lpString1="sqmapi.dll", lpString2="Windows") returned -1 [0046.010] lstrcmpW (lpString1="sqmapi.dll", lpString2="32.EXE.exe") returned 1 [0046.010] StrStrW (lpFirst="sqmapi.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.010] lstrcmpW (lpString1="sqmapi.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.010] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x70) returned 0x297c58 [0046.010] GetCurrentThreadId () returned 0x9b0 [0046.010] RtlWakeConditionVariable () returned 0x27e800 [0046.011] lstrcmpiW (lpString1="thorough film passive.exe", lpString2="Windows") returned -1 [0046.011] lstrcmpW (lpString1="thorough film passive.exe", lpString2="32.EXE.exe") returned 1 [0046.011] StrStrW (lpFirst="thorough film passive.exe", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.011] lstrcmpW (lpString1="thorough film passive.exe", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.011] GetCurrentThreadId () returned 0x9b0 [0046.011] RtlWakeConditionVariable () returned 0x27e800 [0046.011] RtlWakeConditionVariable () returned 0x27e800 [0046.011] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="Windows") returned -1 [0046.011] lstrcmpW (lpString1="Microsoft Analysis Services", lpString2=".") returned 1 [0046.011] lstrcmpW (lpString1="Microsoft Analysis Services", lpString2="..") returned 1 [0046.011] lstrcmpW (lpString1="Microsoft Analysis Services", lpString2="AppData") returned 1 [0046.011] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Analysis Services", lpSrch="AppData") returned 0x0 [0046.011] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services", lpString2="C:\\Windows") returned -1 [0046.011] lstrlenW (lpString="C:\\Windows") returned 10 [0046.011] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services", lpString2="C:\\System Volume Information") returned -1 [0046.011] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.011] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0046.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x299108 [0046.012] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.012] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.012] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.012] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.012] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.012] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0046.012] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.012] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.012] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.012] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.012] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.012] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.012] FindNextFileW (in: hFindFile=0x299108, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0046.012] lstrcmpiW (lpString1="AS OLEDB", lpString2="Windows") returned -1 [0046.012] lstrcmpW (lpString1="AS OLEDB", lpString2=".") returned 1 [0046.012] lstrcmpW (lpString1="AS OLEDB", lpString2="..") returned 1 [0046.012] lstrcmpW (lpString1="AS OLEDB", lpString2="AppData") returned 1 [0046.012] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", lpSrch="AppData") returned 0x0 [0046.012] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", lpString2="C:\\Windows") returned -1 [0046.013] lstrlenW (lpString="C:\\Windows") returned 10 [0046.013] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", lpString2="C:\\System Volume Information") returned -1 [0046.013] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.013] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0046.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x299148 [0046.013] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.013] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.013] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.013] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.013] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.013] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.013] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.013] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.013] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.013] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.013] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.013] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.013] FindNextFileW (in: hFindFile=0x299148, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0046.014] lstrcmpiW (lpString1="10", lpString2="Windows") returned -1 [0046.014] lstrcmpW (lpString1="10", lpString2=".") returned 1 [0046.014] lstrcmpW (lpString1="10", lpString2="..") returned 1 [0046.014] lstrcmpW (lpString1="10", lpString2="AppData") returned -1 [0046.014] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", lpSrch="AppData") returned 0x0 [0046.014] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", lpString2="C:\\Windows") returned -1 [0046.014] lstrlenW (lpString="C:\\Windows") returned 10 [0046.014] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", lpString2="C:\\System Volume Information") returned -1 [0046.014] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.014] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x31ead8 [0046.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0046.197] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.197] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.197] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.197] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.197] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.197] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.197] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.197] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.197] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.197] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.197] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.197] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.197] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0046.197] lstrcmpiW (lpString1="Cartridges", lpString2="Windows") returned -1 [0046.197] lstrcmpW (lpString1="Cartridges", lpString2=".") returned 1 [0046.197] lstrcmpW (lpString1="Cartridges", lpString2="..") returned 1 [0046.197] lstrcmpW (lpString1="Cartridges", lpString2="AppData") returned 1 [0046.197] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", lpSrch="AppData") returned 0x0 [0046.197] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", lpString2="C:\\Windows") returned -1 [0046.197] lstrlenW (lpString="C:\\Windows") returned 10 [0046.197] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", lpString2="C:\\System Volume Information") returned -1 [0046.197] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.197] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x3382e0 [0046.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0046.209] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.209] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.209] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.209] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.209] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.209] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.209] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.209] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.209] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.209] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.209] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.209] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.209] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0046.209] lstrcmpiW (lpString1="as80.xsl", lpString2="Windows") returned -1 [0046.209] lstrcmpW (lpString1="as80.xsl", lpString2="32.EXE.exe") returned 1 [0046.209] StrStrW (lpFirst="as80.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.210] lstrcmpW (lpString1="as80.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.210] GetCurrentThreadId () returned 0x9b0 [0046.210] RtlWakeConditionVariable () returned 0x27e800 [0046.210] lstrcmpiW (lpString1="as90.xsl", lpString2="Windows") returned -1 [0046.210] lstrcmpW (lpString1="as90.xsl", lpString2="32.EXE.exe") returned 1 [0046.210] StrStrW (lpFirst="as90.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.210] lstrcmpW (lpString1="as90.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.210] GetCurrentThreadId () returned 0x9b0 [0046.210] RtlWakeConditionVariable () returned 0x27e800 [0046.210] lstrcmpiW (lpString1="Informix.xsl", lpString2="Windows") returned -1 [0046.210] lstrcmpW (lpString1="Informix.xsl", lpString2="32.EXE.exe") returned 1 [0046.210] StrStrW (lpFirst="Informix.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.210] lstrcmpW (lpString1="Informix.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.210] GetCurrentThreadId () returned 0x9b0 [0046.210] RtlWakeConditionVariable () returned 0x27e800 [0046.210] lstrcmpiW (lpString1="msjet.xsl", lpString2="Windows") returned -1 [0046.210] lstrcmpW (lpString1="msjet.xsl", lpString2="32.EXE.exe") returned 1 [0046.210] StrStrW (lpFirst="msjet.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.210] lstrcmpW (lpString1="msjet.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.210] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.210] GetCurrentThreadId () returned 0x9b0 [0046.210] RtlWakeConditionVariable () returned 0x27e800 [0046.210] lstrcmpiW (lpString1="sql2000.xsl", lpString2="Windows") returned -1 [0046.210] lstrcmpW (lpString1="sql2000.xsl", lpString2="32.EXE.exe") returned 1 [0046.210] StrStrW (lpFirst="sql2000.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.211] lstrcmpW (lpString1="sql2000.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.211] GetCurrentThreadId () returned 0x9b0 [0046.211] RtlWakeConditionVariable () returned 0x27e800 [0046.211] lstrcmpiW (lpString1="sql70.xsl", lpString2="Windows") returned -1 [0046.211] lstrcmpW (lpString1="sql70.xsl", lpString2="32.EXE.exe") returned 1 [0046.211] StrStrW (lpFirst="sql70.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.211] lstrcmpW (lpString1="sql70.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.211] GetCurrentThreadId () returned 0x9b0 [0046.211] RtlWakeConditionVariable () returned 0x27e800 [0046.211] lstrcmpiW (lpString1="sql90.xsl", lpString2="Windows") returned -1 [0046.211] lstrcmpW (lpString1="sql90.xsl", lpString2="32.EXE.exe") returned 1 [0046.211] StrStrW (lpFirst="sql90.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.211] lstrcmpW (lpString1="sql90.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.211] GetCurrentThreadId () returned 0x9b0 [0046.211] RtlWakeConditionVariable () returned 0x27e800 [0046.211] lstrcmpiW (lpString1="Sybase.xsl", lpString2="Windows") returned -1 [0046.211] lstrcmpW (lpString1="Sybase.xsl", lpString2="32.EXE.exe") returned 1 [0046.211] StrStrW (lpFirst="Sybase.xsl", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.211] lstrcmpW (lpString1="Sybase.xsl", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.211] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.211] GetCurrentThreadId () returned 0x9b0 [0046.211] RtlWakeConditionVariable () returned 0x27e800 [0046.212] RtlWakeConditionVariable () returned 0x27e800 [0046.212] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="Windows") returned -1 [0046.212] lstrcmpW (lpString1="msmdlocal.dll", lpString2="32.EXE.exe") returned 1 [0046.212] StrStrW (lpFirst="msmdlocal.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.212] lstrcmpW (lpString1="msmdlocal.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a818 [0046.212] GetCurrentThreadId () returned 0x9b0 [0046.212] RtlWakeConditionVariable () returned 0x27e800 [0046.212] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="Windows") returned -1 [0046.212] lstrcmpW (lpString1="msmgdsrv.dll", lpString2="32.EXE.exe") returned 1 [0046.212] StrStrW (lpFirst="msmgdsrv.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.212] lstrcmpW (lpString1="msmgdsrv.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.212] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a818 [0046.212] GetCurrentThreadId () returned 0x9b0 [0046.213] RtlWakeConditionVariable () returned 0x27e800 [0046.213] lstrcmpiW (lpString1="msolap100.dll", lpString2="Windows") returned -1 [0046.213] lstrcmpW (lpString1="msolap100.dll", lpString2="32.EXE.exe") returned 1 [0046.213] StrStrW (lpFirst="msolap100.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.213] lstrcmpW (lpString1="msolap100.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a818 [0046.213] GetCurrentThreadId () returned 0x9b0 [0046.213] RtlWakeConditionVariable () returned 0x27e800 [0046.213] lstrcmpiW (lpString1="msolui100.dll", lpString2="Windows") returned -1 [0046.213] lstrcmpW (lpString1="msolui100.dll", lpString2="32.EXE.exe") returned 1 [0046.213] StrStrW (lpFirst="msolui100.dll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.213] lstrcmpW (lpString1="msolui100.dll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x31a818 [0046.213] GetCurrentThreadId () returned 0x9b0 [0046.213] RtlWakeConditionVariable () returned 0x27e800 [0046.213] lstrcmpiW (lpString1="Resources", lpString2="Windows") returned -1 [0046.213] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0046.213] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0046.213] lstrcmpW (lpString1="Resources", lpString2="AppData") returned 1 [0046.213] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", lpSrch="AppData") returned 0x0 [0046.213] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", lpString2="C:\\Windows") returned -1 [0046.213] lstrlenW (lpString="C:\\Windows") returned 10 [0046.213] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", lpString2="C:\\System Volume Information") returned -1 [0046.213] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.213] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2b4238 [0046.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0046.214] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.214] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.214] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.214] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.214] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.214] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0046.214] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.214] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.214] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.214] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.214] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.214] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.214] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260eec8 | out: lpFindFileData=0x260eec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x260000, cFileName="1033", cAlternateFileName="")) returned 1 [0046.214] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0046.214] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0046.214] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0046.214] lstrcmpW (lpString1="1033", lpString2="AppData") returned -1 [0046.214] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", lpSrch="AppData") returned 0x0 [0046.214] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", lpString2="C:\\Windows") returned -1 [0046.214] lstrlenW (lpString="C:\\Windows") returned 10 [0046.214] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", lpString2="C:\\System Volume Information") returned -1 [0046.214] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.214] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2c4240 [0046.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7370 [0046.217] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.217] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.217] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.217] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.217] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.217] FindNextFileW (in: hFindFile=0x2d7370, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.217] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.217] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.217] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.217] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.217] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.217] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.217] FindNextFileW (in: hFindFile=0x2d7370, lpFindFileData=0x260ebe8 | out: lpFindFileData=0x260ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0046.217] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="Windows") returned -1 [0046.217] lstrcmpW (lpString1="msmdsrv.rll", lpString2="32.EXE.exe") returned 1 [0046.217] StrStrW (lpFirst="msmdsrv.rll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.217] lstrcmpW (lpString1="msmdsrv.rll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.217] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x29c6b0 [0046.218] GetCurrentThreadId () returned 0x9b0 [0046.218] RtlWakeConditionVariable () returned 0x27e800 [0046.218] lstrcmpiW (lpString1="msolui100.rll", lpString2="Windows") returned -1 [0046.218] lstrcmpW (lpString1="msolui100.rll", lpString2="32.EXE.exe") returned 1 [0046.218] StrStrW (lpFirst="msolui100.rll", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.218] lstrcmpW (lpString1="msolui100.rll", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.218] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xc0) returned 0x2f91e8 [0046.218] GetCurrentThreadId () returned 0x9b0 [0046.218] RtlWakeConditionVariable () returned 0x27e800 [0046.218] RtlWakeConditionVariable () returned 0x27e800 [0046.219] RtlWakeConditionVariable () returned 0x27e800 [0046.219] RtlWakeConditionVariable () returned 0x27e800 [0046.220] RtlWakeConditionVariable () returned 0x27e800 [0046.220] RtlWakeConditionVariable () returned 0x27e800 [0046.220] lstrcmpiW (lpString1="Microsoft Office", lpString2="Windows") returned -1 [0046.220] lstrcmpW (lpString1="Microsoft Office", lpString2=".") returned 1 [0046.221] lstrcmpW (lpString1="Microsoft Office", lpString2="..") returned 1 [0046.221] lstrcmpW (lpString1="Microsoft Office", lpString2="AppData") returned 1 [0046.221] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office", lpSrch="AppData") returned 0x0 [0046.221] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Office", lpString2="C:\\Windows") returned -1 [0046.221] lstrlenW (lpString="C:\\Windows") returned 10 [0046.221] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Office", lpString2="C:\\System Volume Information") returned -1 [0046.221] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.221] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2faac8 [0046.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName=".", cAlternateFileName="")) returned 0x27e0f0 [0046.221] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.221] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.221] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.221] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.221] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.221] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="..", cAlternateFileName="")) returned 1 [0046.222] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.222] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.222] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.222] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.222] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.222] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.222] FindNextFileW (in: hFindFile=0x27e0f0, lpFindFileData=0x260f768 | out: lpFindFileData=0x260f768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58, dwReserved1=0x260000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0046.222] lstrcmpiW (lpString1="CLIPART", lpString2="Windows") returned -1 [0046.222] lstrcmpW (lpString1="CLIPART", lpString2=".") returned 1 [0046.222] lstrcmpW (lpString1="CLIPART", lpString2="..") returned 1 [0046.222] lstrcmpW (lpString1="CLIPART", lpString2="AppData") returned 1 [0046.222] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART", lpSrch="AppData") returned 0x0 [0046.222] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Office\\CLIPART", lpString2="C:\\Windows") returned -1 [0046.222] lstrlenW (lpString="C:\\Windows") returned 10 [0046.222] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Office\\CLIPART", lpString2="C:\\System Volume Information") returned -1 [0046.222] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.222] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2db8a0 [0046.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2b2ec8 [0046.350] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.350] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.350] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.350] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.350] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.350] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.351] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.351] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.351] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.351] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.351] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.351] FindNextFileW (in: hFindFile=0x2b2ec8, lpFindFileData=0x260f488 | out: lpFindFileData=0x260f488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0046.351] lstrcmpiW (lpString1="PUB60COR", lpString2="Windows") returned -1 [0046.351] lstrcmpW (lpString1="PUB60COR", lpString2=".") returned 1 [0046.351] lstrcmpW (lpString1="PUB60COR", lpString2="..") returned 1 [0046.351] lstrcmpW (lpString1="PUB60COR", lpString2="AppData") returned 1 [0046.351] StrStrW (lpFirst="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", lpSrch="AppData") returned 0x0 [0046.351] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", lpString2="C:\\Windows") returned -1 [0046.351] lstrlenW (lpString="C:\\Windows") returned 10 [0046.351] lstrcmpiW (lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", lpString2="C:\\System Volume Information") returned -1 [0046.351] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0046.351] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xfffe) returned 0x2769050 [0046.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x27e130 [0046.404] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0046.404] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.404] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 [0046.404] StrStrW (lpFirst=".", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.404] lstrcmpW (lpString1=".", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.404] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.448] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0046.448] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.448] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.448] lstrcmpW (lpString1="..", lpString2="32.EXE.exe") returned -1 [0046.448] StrStrW (lpFirst="..", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.448] lstrcmpW (lpString1="..", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.448] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0046.448] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="Windows") returned -1 [0046.448] lstrcmpW (lpString1="AG00004_.GIF", lpString2="32.EXE.exe") returned 1 [0046.448] StrStrW (lpFirst="AG00004_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.448] lstrcmpW (lpString1="AG00004_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.448] GetCurrentThreadId () returned 0x9b0 [0046.448] RtlWakeConditionVariable () returned 0x27e800 [0046.448] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="Windows") returned -1 [0046.448] lstrcmpW (lpString1="AG00011_.GIF", lpString2="32.EXE.exe") returned 1 [0046.448] StrStrW (lpFirst="AG00011_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.448] lstrcmpW (lpString1="AG00011_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.448] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.448] GetCurrentThreadId () returned 0x9b0 [0046.449] RtlWakeConditionVariable () returned 0x27e800 [0046.449] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="Windows") returned -1 [0046.449] lstrcmpW (lpString1="AG00021_.GIF", lpString2="32.EXE.exe") returned 1 [0046.449] StrStrW (lpFirst="AG00021_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.449] lstrcmpW (lpString1="AG00021_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.449] GetCurrentThreadId () returned 0x9b0 [0046.449] RtlWakeConditionVariable () returned 0x27e800 [0046.449] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="Windows") returned -1 [0046.449] lstrcmpW (lpString1="AG00037_.GIF", lpString2="32.EXE.exe") returned 1 [0046.449] StrStrW (lpFirst="AG00037_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.449] lstrcmpW (lpString1="AG00037_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.449] GetCurrentThreadId () returned 0x9b0 [0046.449] RtlWakeConditionVariable () returned 0x27e800 [0046.449] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="Windows") returned -1 [0046.449] lstrcmpW (lpString1="AG00038_.GIF", lpString2="32.EXE.exe") returned 1 [0046.449] StrStrW (lpFirst="AG00038_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.449] lstrcmpW (lpString1="AG00038_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.449] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.449] GetCurrentThreadId () returned 0x9b0 [0046.449] RtlWakeConditionVariable () returned 0x27e800 [0046.449] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="Windows") returned -1 [0046.449] lstrcmpW (lpString1="AG00040_.GIF", lpString2="32.EXE.exe") returned 1 [0046.449] StrStrW (lpFirst="AG00040_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.449] lstrcmpW (lpString1="AG00040_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.450] GetCurrentThreadId () returned 0x9b0 [0046.450] RtlWakeConditionVariable () returned 0x27e800 [0046.450] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="Windows") returned -1 [0046.450] lstrcmpW (lpString1="AG00052_.GIF", lpString2="32.EXE.exe") returned 1 [0046.450] StrStrW (lpFirst="AG00052_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.450] lstrcmpW (lpString1="AG00052_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.450] GetCurrentThreadId () returned 0x9b0 [0046.450] RtlWakeConditionVariable () returned 0x27e800 [0046.450] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="Windows") returned -1 [0046.450] lstrcmpW (lpString1="AG00057_.GIF", lpString2="32.EXE.exe") returned 1 [0046.450] StrStrW (lpFirst="AG00057_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.450] lstrcmpW (lpString1="AG00057_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.450] GetCurrentThreadId () returned 0x9b0 [0046.450] RtlWakeConditionVariable () returned 0x27e800 [0046.450] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="Windows") returned -1 [0046.450] lstrcmpW (lpString1="AG00090_.GIF", lpString2="32.EXE.exe") returned 1 [0046.450] StrStrW (lpFirst="AG00090_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.450] lstrcmpW (lpString1="AG00090_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.450] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.450] GetCurrentThreadId () returned 0x9b0 [0046.450] RtlWakeConditionVariable () returned 0x27e800 [0046.451] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="Windows") returned -1 [0046.451] lstrcmpW (lpString1="AG00092_.GIF", lpString2="32.EXE.exe") returned 1 [0046.451] StrStrW (lpFirst="AG00092_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.451] lstrcmpW (lpString1="AG00092_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.451] GetCurrentThreadId () returned 0x9b0 [0046.451] RtlWakeConditionVariable () returned 0x27e800 [0046.451] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="Windows") returned -1 [0046.451] lstrcmpW (lpString1="AG00103_.GIF", lpString2="32.EXE.exe") returned 1 [0046.451] StrStrW (lpFirst="AG00103_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.451] lstrcmpW (lpString1="AG00103_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.451] GetCurrentThreadId () returned 0x9b0 [0046.451] RtlWakeConditionVariable () returned 0x27e800 [0046.451] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="Windows") returned -1 [0046.451] lstrcmpW (lpString1="AG00120_.GIF", lpString2="32.EXE.exe") returned 1 [0046.451] StrStrW (lpFirst="AG00120_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.451] lstrcmpW (lpString1="AG00120_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.451] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.451] GetCurrentThreadId () returned 0x9b0 [0046.451] RtlWakeConditionVariable () returned 0x27e800 [0046.451] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="Windows") returned -1 [0046.451] lstrcmpW (lpString1="AG00126_.GIF", lpString2="32.EXE.exe") returned 1 [0046.451] StrStrW (lpFirst="AG00126_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.452] lstrcmpW (lpString1="AG00126_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.452] GetCurrentThreadId () returned 0x9b0 [0046.452] RtlWakeConditionVariable () returned 0x27e800 [0046.452] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="Windows") returned -1 [0046.452] lstrcmpW (lpString1="AG00129_.GIF", lpString2="32.EXE.exe") returned 1 [0046.452] StrStrW (lpFirst="AG00129_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.452] lstrcmpW (lpString1="AG00129_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.452] GetCurrentThreadId () returned 0x9b0 [0046.452] RtlWakeConditionVariable () returned 0x27e800 [0046.452] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="Windows") returned -1 [0046.452] lstrcmpW (lpString1="AG00130_.GIF", lpString2="32.EXE.exe") returned 1 [0046.452] StrStrW (lpFirst="AG00130_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.452] lstrcmpW (lpString1="AG00130_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.452] GetCurrentThreadId () returned 0x9b0 [0046.452] RtlWakeConditionVariable () returned 0x27e800 [0046.452] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="Windows") returned -1 [0046.452] lstrcmpW (lpString1="AG00135_.GIF", lpString2="32.EXE.exe") returned 1 [0046.452] StrStrW (lpFirst="AG00135_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.452] lstrcmpW (lpString1="AG00135_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.452] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.452] GetCurrentThreadId () returned 0x9b0 [0046.453] RtlWakeConditionVariable () returned 0x27e800 [0046.453] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="Windows") returned -1 [0046.453] lstrcmpW (lpString1="AG00139_.GIF", lpString2="32.EXE.exe") returned 1 [0046.453] StrStrW (lpFirst="AG00139_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.453] lstrcmpW (lpString1="AG00139_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.453] GetCurrentThreadId () returned 0x9b0 [0046.453] RtlWakeConditionVariable () returned 0x27e800 [0046.453] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="Windows") returned -1 [0046.453] lstrcmpW (lpString1="AG00142_.GIF", lpString2="32.EXE.exe") returned 1 [0046.453] StrStrW (lpFirst="AG00142_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.453] lstrcmpW (lpString1="AG00142_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.453] GetCurrentThreadId () returned 0x9b0 [0046.453] RtlWakeConditionVariable () returned 0x27e800 [0046.453] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="Windows") returned -1 [0046.453] lstrcmpW (lpString1="AG00154_.GIF", lpString2="32.EXE.exe") returned 1 [0046.453] StrStrW (lpFirst="AG00154_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.453] lstrcmpW (lpString1="AG00154_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.453] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.453] GetCurrentThreadId () returned 0x9b0 [0046.453] RtlWakeConditionVariable () returned 0x27e800 [0046.453] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="Windows") returned -1 [0046.453] lstrcmpW (lpString1="AG00157_.GIF", lpString2="32.EXE.exe") returned 1 [0046.453] StrStrW (lpFirst="AG00157_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.454] lstrcmpW (lpString1="AG00157_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.454] GetCurrentThreadId () returned 0x9b0 [0046.454] RtlWakeConditionVariable () returned 0x27e800 [0046.454] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="Windows") returned -1 [0046.454] lstrcmpW (lpString1="AG00158_.GIF", lpString2="32.EXE.exe") returned 1 [0046.454] StrStrW (lpFirst="AG00158_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.454] lstrcmpW (lpString1="AG00158_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.454] GetCurrentThreadId () returned 0x9b0 [0046.454] RtlWakeConditionVariable () returned 0x27e800 [0046.454] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="Windows") returned -1 [0046.454] lstrcmpW (lpString1="AG00160_.GIF", lpString2="32.EXE.exe") returned 1 [0046.454] StrStrW (lpFirst="AG00160_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.454] lstrcmpW (lpString1="AG00160_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.454] GetCurrentThreadId () returned 0x9b0 [0046.454] RtlWakeConditionVariable () returned 0x27e800 [0046.454] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="Windows") returned -1 [0046.454] lstrcmpW (lpString1="AG00161_.GIF", lpString2="32.EXE.exe") returned 1 [0046.454] StrStrW (lpFirst="AG00161_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.454] lstrcmpW (lpString1="AG00161_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.454] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.454] GetCurrentThreadId () returned 0x9b0 [0046.454] RtlWakeConditionVariable () returned 0x27e800 [0046.454] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="Windows") returned -1 [0046.454] lstrcmpW (lpString1="AG00163_.GIF", lpString2="32.EXE.exe") returned 1 [0046.454] StrStrW (lpFirst="AG00163_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.454] lstrcmpW (lpString1="AG00163_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.455] GetCurrentThreadId () returned 0x9b0 [0046.455] RtlWakeConditionVariable () returned 0x27e800 [0046.455] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="Windows") returned -1 [0046.455] lstrcmpW (lpString1="AG00164_.GIF", lpString2="32.EXE.exe") returned 1 [0046.455] StrStrW (lpFirst="AG00164_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.455] lstrcmpW (lpString1="AG00164_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.455] GetCurrentThreadId () returned 0x9b0 [0046.455] RtlWakeConditionVariable () returned 0x27e800 [0046.455] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="Windows") returned -1 [0046.455] lstrcmpW (lpString1="AG00165_.GIF", lpString2="32.EXE.exe") returned 1 [0046.455] StrStrW (lpFirst="AG00165_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.455] lstrcmpW (lpString1="AG00165_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.455] GetCurrentThreadId () returned 0x9b0 [0046.455] RtlWakeConditionVariable () returned 0x27e800 [0046.455] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="Windows") returned -1 [0046.455] lstrcmpW (lpString1="AG00167_.GIF", lpString2="32.EXE.exe") returned 1 [0046.455] StrStrW (lpFirst="AG00167_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.455] lstrcmpW (lpString1="AG00167_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.455] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.455] GetCurrentThreadId () returned 0x9b0 [0046.455] RtlWakeConditionVariable () returned 0x27e800 [0046.455] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="Windows") returned -1 [0046.455] lstrcmpW (lpString1="AG00169_.GIF", lpString2="32.EXE.exe") returned 1 [0046.455] StrStrW (lpFirst="AG00169_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.455] lstrcmpW (lpString1="AG00169_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.456] GetCurrentThreadId () returned 0x9b0 [0046.456] RtlWakeConditionVariable () returned 0x27e800 [0046.456] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="Windows") returned -1 [0046.456] lstrcmpW (lpString1="AG00170_.GIF", lpString2="32.EXE.exe") returned 1 [0046.456] StrStrW (lpFirst="AG00170_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.456] lstrcmpW (lpString1="AG00170_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.456] GetCurrentThreadId () returned 0x9b0 [0046.456] RtlWakeConditionVariable () returned 0x27e800 [0046.456] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="Windows") returned -1 [0046.456] lstrcmpW (lpString1="AG00171_.GIF", lpString2="32.EXE.exe") returned 1 [0046.456] StrStrW (lpFirst="AG00171_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.456] lstrcmpW (lpString1="AG00171_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.456] GetCurrentThreadId () returned 0x9b0 [0046.456] RtlWakeConditionVariable () returned 0x27e800 [0046.456] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="Windows") returned -1 [0046.456] lstrcmpW (lpString1="AG00172_.GIF", lpString2="32.EXE.exe") returned 1 [0046.456] StrStrW (lpFirst="AG00172_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.456] lstrcmpW (lpString1="AG00172_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.456] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.456] GetCurrentThreadId () returned 0x9b0 [0046.457] RtlWakeConditionVariable () returned 0x27e800 [0046.457] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="Windows") returned -1 [0046.457] lstrcmpW (lpString1="AG00174_.GIF", lpString2="32.EXE.exe") returned 1 [0046.457] StrStrW (lpFirst="AG00174_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.457] lstrcmpW (lpString1="AG00174_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.457] GetCurrentThreadId () returned 0x9b0 [0046.457] RtlWakeConditionVariable () returned 0x27e800 [0046.457] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="Windows") returned -1 [0046.457] lstrcmpW (lpString1="AG00175_.GIF", lpString2="32.EXE.exe") returned 1 [0046.457] StrStrW (lpFirst="AG00175_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.457] lstrcmpW (lpString1="AG00175_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.457] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297860 [0046.457] GetCurrentThreadId () returned 0x9b0 [0046.458] RtlWakeConditionVariable () returned 0x27e800 [0046.468] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="Windows") returned -1 [0046.470] lstrcmpW (lpString1="AG00176_.GIF", lpString2="32.EXE.exe") returned 1 [0046.470] StrStrW (lpFirst="AG00176_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.470] lstrcmpW (lpString1="AG00176_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.470] GetCurrentThreadId () returned 0x9b0 [0046.470] RtlWakeConditionVariable () returned 0x27e800 [0046.470] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="Windows") returned -1 [0046.470] lstrcmpW (lpString1="AN00010_.WMF", lpString2="32.EXE.exe") returned 1 [0046.470] StrStrW (lpFirst="AN00010_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.470] lstrcmpW (lpString1="AN00010_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.470] GetCurrentThreadId () returned 0x9b0 [0046.470] RtlWakeConditionVariable () returned 0x27e800 [0046.470] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="Windows") returned -1 [0046.470] lstrcmpW (lpString1="AN00015_.WMF", lpString2="32.EXE.exe") returned 1 [0046.470] StrStrW (lpFirst="AN00015_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.470] lstrcmpW (lpString1="AN00015_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.470] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.471] GetCurrentThreadId () returned 0x9b0 [0046.471] RtlWakeConditionVariable () returned 0x27e800 [0046.471] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="Windows") returned -1 [0046.471] lstrcmpW (lpString1="AN00790_.WMF", lpString2="32.EXE.exe") returned 1 [0046.471] StrStrW (lpFirst="AN00790_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.471] lstrcmpW (lpString1="AN00790_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.471] GetCurrentThreadId () returned 0x9b0 [0046.471] RtlWakeConditionVariable () returned 0x27e800 [0046.471] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="Windows") returned -1 [0046.471] lstrcmpW (lpString1="AN00853_.WMF", lpString2="32.EXE.exe") returned 1 [0046.471] StrStrW (lpFirst="AN00853_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.471] lstrcmpW (lpString1="AN00853_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.471] GetCurrentThreadId () returned 0x9b0 [0046.471] RtlWakeConditionVariable () returned 0x27e800 [0046.471] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="Windows") returned -1 [0046.471] lstrcmpW (lpString1="AN00914_.WMF", lpString2="32.EXE.exe") returned 1 [0046.471] StrStrW (lpFirst="AN00914_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.471] lstrcmpW (lpString1="AN00914_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.471] GetCurrentThreadId () returned 0x9b0 [0046.471] RtlWakeConditionVariable () returned 0x27e800 [0046.471] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="Windows") returned -1 [0046.471] lstrcmpW (lpString1="AN00932_.WMF", lpString2="32.EXE.exe") returned 1 [0046.471] StrStrW (lpFirst="AN00932_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.471] lstrcmpW (lpString1="AN00932_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.471] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.472] GetCurrentThreadId () returned 0x9b0 [0046.472] RtlWakeConditionVariable () returned 0x27e800 [0046.472] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="Windows") returned -1 [0046.472] lstrcmpW (lpString1="AN00965_.WMF", lpString2="32.EXE.exe") returned 1 [0046.472] StrStrW (lpFirst="AN00965_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.472] lstrcmpW (lpString1="AN00965_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.472] GetCurrentThreadId () returned 0x9b0 [0046.472] RtlWakeConditionVariable () returned 0x27e800 [0046.472] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="Windows") returned -1 [0046.472] lstrcmpW (lpString1="AN01039_.WMF", lpString2="32.EXE.exe") returned 1 [0046.472] StrStrW (lpFirst="AN01039_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.472] lstrcmpW (lpString1="AN01039_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.472] GetCurrentThreadId () returned 0x9b0 [0046.472] RtlWakeConditionVariable () returned 0x27e800 [0046.472] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="Windows") returned -1 [0046.472] lstrcmpW (lpString1="AN01044_.WMF", lpString2="32.EXE.exe") returned 1 [0046.472] StrStrW (lpFirst="AN01044_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.472] lstrcmpW (lpString1="AN01044_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.472] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.472] GetCurrentThreadId () returned 0x9b0 [0046.472] RtlWakeConditionVariable () returned 0x27e800 [0046.473] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="Windows") returned -1 [0046.473] lstrcmpW (lpString1="AN01060_.WMF", lpString2="32.EXE.exe") returned 1 [0046.473] StrStrW (lpFirst="AN01060_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.473] lstrcmpW (lpString1="AN01060_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.473] GetCurrentThreadId () returned 0x9b0 [0046.473] RtlWakeConditionVariable () returned 0x27e800 [0046.473] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="Windows") returned -1 [0046.473] lstrcmpW (lpString1="AN01084_.WMF", lpString2="32.EXE.exe") returned 1 [0046.473] StrStrW (lpFirst="AN01084_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.473] lstrcmpW (lpString1="AN01084_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.473] GetCurrentThreadId () returned 0x9b0 [0046.473] RtlWakeConditionVariable () returned 0x27e800 [0046.473] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="Windows") returned -1 [0046.473] lstrcmpW (lpString1="AN01173_.WMF", lpString2="32.EXE.exe") returned 1 [0046.473] StrStrW (lpFirst="AN01173_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.473] lstrcmpW (lpString1="AN01173_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.473] GetCurrentThreadId () returned 0x9b0 [0046.473] RtlWakeConditionVariable () returned 0x27e800 [0046.473] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="Windows") returned -1 [0046.473] lstrcmpW (lpString1="AN01174_.WMF", lpString2="32.EXE.exe") returned 1 [0046.473] StrStrW (lpFirst="AN01174_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.473] lstrcmpW (lpString1="AN01174_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.473] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.473] GetCurrentThreadId () returned 0x9b0 [0046.473] RtlWakeConditionVariable () returned 0x27e800 [0046.474] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="Windows") returned -1 [0046.474] lstrcmpW (lpString1="AN01184_.WMF", lpString2="32.EXE.exe") returned 1 [0046.474] StrStrW (lpFirst="AN01184_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.474] lstrcmpW (lpString1="AN01184_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.474] GetCurrentThreadId () returned 0x9b0 [0046.474] RtlWakeConditionVariable () returned 0x27e800 [0046.474] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="Windows") returned -1 [0046.474] lstrcmpW (lpString1="AN01216_.WMF", lpString2="32.EXE.exe") returned 1 [0046.474] StrStrW (lpFirst="AN01216_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.474] lstrcmpW (lpString1="AN01216_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.474] GetCurrentThreadId () returned 0x9b0 [0046.474] RtlWakeConditionVariable () returned 0x27e800 [0046.474] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="Windows") returned -1 [0046.474] lstrcmpW (lpString1="AN01218_.WMF", lpString2="32.EXE.exe") returned 1 [0046.474] StrStrW (lpFirst="AN01218_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.474] lstrcmpW (lpString1="AN01218_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.474] GetCurrentThreadId () returned 0x9b0 [0046.474] RtlWakeConditionVariable () returned 0x27e800 [0046.474] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="Windows") returned -1 [0046.474] lstrcmpW (lpString1="AN01251_.WMF", lpString2="32.EXE.exe") returned 1 [0046.474] StrStrW (lpFirst="AN01251_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.474] lstrcmpW (lpString1="AN01251_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.474] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.474] GetCurrentThreadId () returned 0x9b0 [0046.474] RtlWakeConditionVariable () returned 0x27e800 [0046.475] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="Windows") returned -1 [0046.475] lstrcmpW (lpString1="AN01545_.WMF", lpString2="32.EXE.exe") returned 1 [0046.475] StrStrW (lpFirst="AN01545_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.475] lstrcmpW (lpString1="AN01545_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.475] GetCurrentThreadId () returned 0x9b0 [0046.475] RtlWakeConditionVariable () returned 0x27e800 [0046.475] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="Windows") returned -1 [0046.475] lstrcmpW (lpString1="AN02122_.WMF", lpString2="32.EXE.exe") returned 1 [0046.475] StrStrW (lpFirst="AN02122_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.475] lstrcmpW (lpString1="AN02122_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.475] GetCurrentThreadId () returned 0x9b0 [0046.475] RtlWakeConditionVariable () returned 0x27e800 [0046.475] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="Windows") returned -1 [0046.475] lstrcmpW (lpString1="AN02559_.WMF", lpString2="32.EXE.exe") returned 1 [0046.475] StrStrW (lpFirst="AN02559_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.475] lstrcmpW (lpString1="AN02559_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.475] GetCurrentThreadId () returned 0x9b0 [0046.475] RtlWakeConditionVariable () returned 0x27e800 [0046.475] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="Windows") returned -1 [0046.475] lstrcmpW (lpString1="AN02724_.WMF", lpString2="32.EXE.exe") returned 1 [0046.475] StrStrW (lpFirst="AN02724_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.475] lstrcmpW (lpString1="AN02724_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.475] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.475] GetCurrentThreadId () returned 0x9b0 [0046.475] RtlWakeConditionVariable () returned 0x27e800 [0046.476] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="Windows") returned -1 [0046.476] lstrcmpW (lpString1="AN03500_.WMF", lpString2="32.EXE.exe") returned 1 [0046.476] StrStrW (lpFirst="AN03500_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.476] lstrcmpW (lpString1="AN03500_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.476] GetCurrentThreadId () returned 0x9b0 [0046.476] RtlWakeConditionVariable () returned 0x27e800 [0046.476] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="Windows") returned -1 [0046.476] lstrcmpW (lpString1="AN04108_.WMF", lpString2="32.EXE.exe") returned 1 [0046.476] StrStrW (lpFirst="AN04108_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.476] lstrcmpW (lpString1="AN04108_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.476] GetCurrentThreadId () returned 0x9b0 [0046.476] RtlWakeConditionVariable () returned 0x27e800 [0046.476] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="Windows") returned -1 [0046.476] lstrcmpW (lpString1="AN04117_.WMF", lpString2="32.EXE.exe") returned 1 [0046.476] StrStrW (lpFirst="AN04117_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.476] lstrcmpW (lpString1="AN04117_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.476] GetCurrentThreadId () returned 0x9b0 [0046.476] RtlWakeConditionVariable () returned 0x27e800 [0046.476] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="Windows") returned -1 [0046.476] lstrcmpW (lpString1="AN04134_.WMF", lpString2="32.EXE.exe") returned 1 [0046.476] StrStrW (lpFirst="AN04134_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.476] lstrcmpW (lpString1="AN04134_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.476] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.476] GetCurrentThreadId () returned 0x9b0 [0046.477] RtlWakeConditionVariable () returned 0x27e800 [0046.477] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="Windows") returned -1 [0046.477] lstrcmpW (lpString1="AN04174_.WMF", lpString2="32.EXE.exe") returned 1 [0046.477] StrStrW (lpFirst="AN04174_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.477] lstrcmpW (lpString1="AN04174_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.477] GetCurrentThreadId () returned 0x9b0 [0046.477] RtlWakeConditionVariable () returned 0x27e800 [0046.477] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="Windows") returned -1 [0046.477] lstrcmpW (lpString1="AN04191_.WMF", lpString2="32.EXE.exe") returned 1 [0046.477] StrStrW (lpFirst="AN04191_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.477] lstrcmpW (lpString1="AN04191_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.477] GetCurrentThreadId () returned 0x9b0 [0046.477] RtlWakeConditionVariable () returned 0x27e800 [0046.477] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="Windows") returned -1 [0046.477] lstrcmpW (lpString1="AN04195_.WMF", lpString2="32.EXE.exe") returned 1 [0046.477] StrStrW (lpFirst="AN04195_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.477] lstrcmpW (lpString1="AN04195_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.477] GetCurrentThreadId () returned 0x9b0 [0046.477] RtlWakeConditionVariable () returned 0x27e800 [0046.477] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="Windows") returned -1 [0046.477] lstrcmpW (lpString1="AN04196_.WMF", lpString2="32.EXE.exe") returned 1 [0046.477] StrStrW (lpFirst="AN04196_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.477] lstrcmpW (lpString1="AN04196_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.477] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.477] GetCurrentThreadId () returned 0x9b0 [0046.478] RtlWakeConditionVariable () returned 0x27e800 [0046.478] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="Windows") returned -1 [0046.478] lstrcmpW (lpString1="AN04206_.WMF", lpString2="32.EXE.exe") returned 1 [0046.478] StrStrW (lpFirst="AN04206_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.478] lstrcmpW (lpString1="AN04206_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.478] GetCurrentThreadId () returned 0x9b0 [0046.478] RtlWakeConditionVariable () returned 0x27e800 [0046.478] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="Windows") returned -1 [0046.478] lstrcmpW (lpString1="AN04225_.WMF", lpString2="32.EXE.exe") returned 1 [0046.478] StrStrW (lpFirst="AN04225_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.478] lstrcmpW (lpString1="AN04225_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.478] GetCurrentThreadId () returned 0x9b0 [0046.478] RtlWakeConditionVariable () returned 0x27e800 [0046.478] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="Windows") returned -1 [0046.478] lstrcmpW (lpString1="AN04235_.WMF", lpString2="32.EXE.exe") returned 1 [0046.478] StrStrW (lpFirst="AN04235_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.478] lstrcmpW (lpString1="AN04235_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.478] GetCurrentThreadId () returned 0x9b0 [0046.478] RtlWakeConditionVariable () returned 0x27e800 [0046.478] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="Windows") returned -1 [0046.478] lstrcmpW (lpString1="AN04267_.WMF", lpString2="32.EXE.exe") returned 1 [0046.478] StrStrW (lpFirst="AN04267_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.478] lstrcmpW (lpString1="AN04267_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.478] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.478] GetCurrentThreadId () returned 0x9b0 [0046.479] RtlWakeConditionVariable () returned 0x27e800 [0046.536] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="Windows") returned -1 [0046.536] lstrcmpW (lpString1="AN04269_.WMF", lpString2="32.EXE.exe") returned 1 [0046.536] StrStrW (lpFirst="AN04269_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.536] lstrcmpW (lpString1="AN04269_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.536] GetCurrentThreadId () returned 0x9b0 [0046.536] RtlWakeConditionVariable () returned 0x27e800 [0046.536] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="Windows") returned -1 [0046.536] lstrcmpW (lpString1="AN04323_.WMF", lpString2="32.EXE.exe") returned 1 [0046.536] StrStrW (lpFirst="AN04323_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.536] lstrcmpW (lpString1="AN04323_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.536] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.536] GetCurrentThreadId () returned 0x9b0 [0046.536] RtlWakeConditionVariable () returned 0x27e800 [0046.536] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="Windows") returned -1 [0046.536] lstrcmpW (lpString1="AN04326_.WMF", lpString2="32.EXE.exe") returned 1 [0046.537] StrStrW (lpFirst="AN04326_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.537] lstrcmpW (lpString1="AN04326_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.537] GetCurrentThreadId () returned 0x9b0 [0046.537] RtlWakeConditionVariable () returned 0x27e800 [0046.537] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="Windows") returned -1 [0046.537] lstrcmpW (lpString1="AN04332_.WMF", lpString2="32.EXE.exe") returned 1 [0046.537] StrStrW (lpFirst="AN04332_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.537] lstrcmpW (lpString1="AN04332_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.537] GetCurrentThreadId () returned 0x9b0 [0046.537] RtlWakeConditionVariable () returned 0x27e800 [0046.537] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="Windows") returned -1 [0046.537] lstrcmpW (lpString1="AN04355_.WMF", lpString2="32.EXE.exe") returned 1 [0046.537] StrStrW (lpFirst="AN04355_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.537] lstrcmpW (lpString1="AN04355_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.537] GetCurrentThreadId () returned 0x9b0 [0046.537] RtlWakeConditionVariable () returned 0x27e800 [0046.537] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="Windows") returned -1 [0046.537] lstrcmpW (lpString1="AN04369_.WMF", lpString2="32.EXE.exe") returned 1 [0046.537] StrStrW (lpFirst="AN04369_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.537] lstrcmpW (lpString1="AN04369_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.537] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.537] GetCurrentThreadId () returned 0x9b0 [0046.537] RtlWakeConditionVariable () returned 0x27e800 [0046.537] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="Windows") returned -1 [0046.537] lstrcmpW (lpString1="AN04384_.WMF", lpString2="32.EXE.exe") returned 1 [0046.538] StrStrW (lpFirst="AN04384_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.538] lstrcmpW (lpString1="AN04384_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.538] GetCurrentThreadId () returned 0x9b0 [0046.538] RtlWakeConditionVariable () returned 0x27e800 [0046.538] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="Windows") returned -1 [0046.538] lstrcmpW (lpString1="AN04385_.WMF", lpString2="32.EXE.exe") returned 1 [0046.538] StrStrW (lpFirst="AN04385_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.538] lstrcmpW (lpString1="AN04385_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.538] GetCurrentThreadId () returned 0x9b0 [0046.538] RtlWakeConditionVariable () returned 0x27e800 [0046.538] lstrcmpiW (lpString1="BABY_01.MID", lpString2="Windows") returned -1 [0046.538] lstrcmpW (lpString1="BABY_01.MID", lpString2="32.EXE.exe") returned 1 [0046.538] StrStrW (lpFirst="BABY_01.MID", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.538] lstrcmpW (lpString1="BABY_01.MID", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.538] GetCurrentThreadId () returned 0x9b0 [0046.538] RtlWakeConditionVariable () returned 0x27e800 [0046.538] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="Windows") returned -1 [0046.538] lstrcmpW (lpString1="BD00116_.WMF", lpString2="32.EXE.exe") returned 1 [0046.538] StrStrW (lpFirst="BD00116_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.538] lstrcmpW (lpString1="BD00116_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.538] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.538] GetCurrentThreadId () returned 0x9b0 [0046.538] RtlWakeConditionVariable () returned 0x27e800 [0046.538] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="Windows") returned -1 [0046.538] lstrcmpW (lpString1="BD00141_.WMF", lpString2="32.EXE.exe") returned 1 [0046.538] StrStrW (lpFirst="BD00141_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.539] lstrcmpW (lpString1="BD00141_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.539] GetCurrentThreadId () returned 0x9b0 [0046.539] RtlWakeConditionVariable () returned 0x27e800 [0046.539] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="Windows") returned -1 [0046.539] lstrcmpW (lpString1="BD00146_.WMF", lpString2="32.EXE.exe") returned 1 [0046.539] StrStrW (lpFirst="BD00146_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.539] lstrcmpW (lpString1="BD00146_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.539] GetCurrentThreadId () returned 0x9b0 [0046.539] RtlWakeConditionVariable () returned 0x27e800 [0046.539] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="Windows") returned -1 [0046.539] lstrcmpW (lpString1="BD00155_.WMF", lpString2="32.EXE.exe") returned 1 [0046.539] StrStrW (lpFirst="BD00155_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.539] lstrcmpW (lpString1="BD00155_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.539] GetCurrentThreadId () returned 0x9b0 [0046.539] RtlWakeConditionVariable () returned 0x27e800 [0046.539] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="Windows") returned -1 [0046.539] lstrcmpW (lpString1="BD00160_.WMF", lpString2="32.EXE.exe") returned 1 [0046.539] StrStrW (lpFirst="BD00160_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.539] lstrcmpW (lpString1="BD00160_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.539] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.539] GetCurrentThreadId () returned 0x9b0 [0046.539] RtlWakeConditionVariable () returned 0x27e800 [0046.539] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="Windows") returned -1 [0046.539] lstrcmpW (lpString1="BD00173_.WMF", lpString2="32.EXE.exe") returned 1 [0046.539] StrStrW (lpFirst="BD00173_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.539] lstrcmpW (lpString1="BD00173_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.540] GetCurrentThreadId () returned 0x9b0 [0046.540] RtlWakeConditionVariable () returned 0x27e800 [0046.540] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="Windows") returned -1 [0046.540] lstrcmpW (lpString1="BD05119_.WMF", lpString2="32.EXE.exe") returned 1 [0046.540] StrStrW (lpFirst="BD05119_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.540] lstrcmpW (lpString1="BD05119_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.540] GetCurrentThreadId () returned 0x9b0 [0046.540] RtlWakeConditionVariable () returned 0x27e800 [0046.540] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="Windows") returned -1 [0046.540] lstrcmpW (lpString1="BD06102_.WMF", lpString2="32.EXE.exe") returned 1 [0046.540] StrStrW (lpFirst="BD06102_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.540] lstrcmpW (lpString1="BD06102_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.540] GetCurrentThreadId () returned 0x9b0 [0046.540] RtlWakeConditionVariable () returned 0x27e800 [0046.540] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="Windows") returned -1 [0046.540] lstrcmpW (lpString1="BD06200_.WMF", lpString2="32.EXE.exe") returned 1 [0046.540] StrStrW (lpFirst="BD06200_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.540] lstrcmpW (lpString1="BD06200_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.540] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.540] GetCurrentThreadId () returned 0x9b0 [0046.540] RtlWakeConditionVariable () returned 0x27e800 [0046.540] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="Windows") returned -1 [0046.540] lstrcmpW (lpString1="BD07761_.WMF", lpString2="32.EXE.exe") returned 1 [0046.541] StrStrW (lpFirst="BD07761_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.541] lstrcmpW (lpString1="BD07761_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.541] GetCurrentThreadId () returned 0x9b0 [0046.541] RtlWakeConditionVariable () returned 0x27e800 [0046.541] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="Windows") returned -1 [0046.541] lstrcmpW (lpString1="BD07804_.WMF", lpString2="32.EXE.exe") returned 1 [0046.541] StrStrW (lpFirst="BD07804_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.541] lstrcmpW (lpString1="BD07804_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.541] GetCurrentThreadId () returned 0x9b0 [0046.541] RtlWakeConditionVariable () returned 0x27e800 [0046.541] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="Windows") returned -1 [0046.541] lstrcmpW (lpString1="BD07831_.WMF", lpString2="32.EXE.exe") returned 1 [0046.541] StrStrW (lpFirst="BD07831_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.541] lstrcmpW (lpString1="BD07831_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.541] GetCurrentThreadId () returned 0x9b0 [0046.541] RtlWakeConditionVariable () returned 0x27e800 [0046.541] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="Windows") returned -1 [0046.541] lstrcmpW (lpString1="BD08758_.WMF", lpString2="32.EXE.exe") returned 1 [0046.541] StrStrW (lpFirst="BD08758_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.541] lstrcmpW (lpString1="BD08758_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.541] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.541] GetCurrentThreadId () returned 0x9b0 [0046.541] RtlWakeConditionVariable () returned 0x27e800 [0046.541] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="Windows") returned -1 [0046.541] lstrcmpW (lpString1="BD08773_.WMF", lpString2="32.EXE.exe") returned 1 [0046.542] StrStrW (lpFirst="BD08773_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.542] lstrcmpW (lpString1="BD08773_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.542] GetCurrentThreadId () returned 0x9b0 [0046.542] RtlWakeConditionVariable () returned 0x27e800 [0046.542] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="Windows") returned -1 [0046.542] lstrcmpW (lpString1="BD08808_.WMF", lpString2="32.EXE.exe") returned 1 [0046.542] StrStrW (lpFirst="BD08808_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.542] lstrcmpW (lpString1="BD08808_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.542] GetCurrentThreadId () returned 0x9b0 [0046.542] RtlWakeConditionVariable () returned 0x27e800 [0046.542] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="Windows") returned -1 [0046.542] lstrcmpW (lpString1="BD08868_.WMF", lpString2="32.EXE.exe") returned 1 [0046.542] StrStrW (lpFirst="BD08868_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.542] lstrcmpW (lpString1="BD08868_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.542] GetCurrentThreadId () returned 0x9b0 [0046.542] RtlWakeConditionVariable () returned 0x27e800 [0046.542] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="Windows") returned -1 [0046.542] lstrcmpW (lpString1="BD09031_.WMF", lpString2="32.EXE.exe") returned 1 [0046.542] StrStrW (lpFirst="BD09031_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.542] lstrcmpW (lpString1="BD09031_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.542] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.542] GetCurrentThreadId () returned 0x9b0 [0046.542] RtlWakeConditionVariable () returned 0x27e800 [0046.542] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="Windows") returned -1 [0046.542] lstrcmpW (lpString1="BD09194_.WMF", lpString2="32.EXE.exe") returned 1 [0046.542] StrStrW (lpFirst="BD09194_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.543] lstrcmpW (lpString1="BD09194_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.543] GetCurrentThreadId () returned 0x9b0 [0046.543] RtlWakeConditionVariable () returned 0x27e800 [0046.543] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="Windows") returned -1 [0046.543] lstrcmpW (lpString1="BD09662_.WMF", lpString2="32.EXE.exe") returned 1 [0046.543] StrStrW (lpFirst="BD09662_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.543] lstrcmpW (lpString1="BD09662_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.543] GetCurrentThreadId () returned 0x9b0 [0046.543] RtlWakeConditionVariable () returned 0x27e800 [0046.543] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="Windows") returned -1 [0046.543] lstrcmpW (lpString1="BD09664_.WMF", lpString2="32.EXE.exe") returned 1 [0046.543] StrStrW (lpFirst="BD09664_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.543] lstrcmpW (lpString1="BD09664_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.543] GetCurrentThreadId () returned 0x9b0 [0046.543] RtlWakeConditionVariable () returned 0x27e800 [0046.543] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="Windows") returned -1 [0046.543] lstrcmpW (lpString1="BD10890_.GIF", lpString2="32.EXE.exe") returned 1 [0046.543] StrStrW (lpFirst="BD10890_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.543] lstrcmpW (lpString1="BD10890_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.543] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.543] GetCurrentThreadId () returned 0x9b0 [0046.543] RtlWakeConditionVariable () returned 0x27e800 [0046.543] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="Windows") returned -1 [0046.543] lstrcmpW (lpString1="BD10972_.GIF", lpString2="32.EXE.exe") returned 1 [0046.543] StrStrW (lpFirst="BD10972_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.543] lstrcmpW (lpString1="BD10972_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.544] GetCurrentThreadId () returned 0x9b0 [0046.544] RtlWakeConditionVariable () returned 0x27e800 [0046.544] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="Windows") returned -1 [0046.544] lstrcmpW (lpString1="BD19563_.GIF", lpString2="32.EXE.exe") returned 1 [0046.544] StrStrW (lpFirst="BD19563_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.544] lstrcmpW (lpString1="BD19563_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.544] GetCurrentThreadId () returned 0x9b0 [0046.544] RtlWakeConditionVariable () returned 0x27e800 [0046.544] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="Windows") returned -1 [0046.544] lstrcmpW (lpString1="BD19582_.GIF", lpString2="32.EXE.exe") returned 1 [0046.544] StrStrW (lpFirst="BD19582_.GIF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.544] lstrcmpW (lpString1="BD19582_.GIF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.544] GetCurrentThreadId () returned 0x9b0 [0046.544] RtlWakeConditionVariable () returned 0x27e800 [0046.544] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="Windows") returned -1 [0046.544] lstrcmpW (lpString1="BD19695_.WMF", lpString2="32.EXE.exe") returned 1 [0046.544] StrStrW (lpFirst="BD19695_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.544] lstrcmpW (lpString1="BD19695_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.544] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.544] GetCurrentThreadId () returned 0x9b0 [0046.544] RtlWakeConditionVariable () returned 0x27e800 [0046.562] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="Windows") returned -1 [0046.562] lstrcmpW (lpString1="BD19827_.WMF", lpString2="32.EXE.exe") returned 1 [0046.562] StrStrW (lpFirst="BD19827_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.563] lstrcmpW (lpString1="BD19827_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.563] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.563] GetCurrentThreadId () returned 0x9b0 [0046.572] RtlWakeConditionVariable () returned 0x27e800 [0046.572] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="Windows") returned -1 [0046.572] lstrcmpW (lpString1="BD19828_.WMF", lpString2="32.EXE.exe") returned 1 [0046.572] StrStrW (lpFirst="BD19828_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.572] lstrcmpW (lpString1="BD19828_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.572] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.572] GetCurrentThreadId () returned 0x9b0 [0046.572] RtlWakeConditionVariable () returned 0x27e800 [0046.572] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="Windows") returned -1 [0046.574] lstrcmpW (lpString1="BD19986_.WMF", lpString2="32.EXE.exe") returned 1 [0046.574] StrStrW (lpFirst="BD19986_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.582] lstrcmpW (lpString1="BD19986_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.582] GetCurrentThreadId () returned 0x9b0 [0046.582] RtlWakeConditionVariable () returned 0x27e800 [0046.582] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="Windows") returned -1 [0046.582] lstrcmpW (lpString1="BD19988_.WMF", lpString2="32.EXE.exe") returned 1 [0046.582] StrStrW (lpFirst="BD19988_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.582] lstrcmpW (lpString1="BD19988_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.582] GetCurrentThreadId () returned 0x9b0 [0046.582] RtlWakeConditionVariable () returned 0x27e800 [0046.582] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="Windows") returned -1 [0046.582] lstrcmpW (lpString1="BD20013_.WMF", lpString2="32.EXE.exe") returned 1 [0046.582] StrStrW (lpFirst="BD20013_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.582] lstrcmpW (lpString1="BD20013_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.582] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.582] GetCurrentThreadId () returned 0x9b0 [0046.583] RtlWakeConditionVariable () returned 0x27e800 [0046.583] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="Windows") returned -1 [0046.583] lstrcmpW (lpString1="BL00008_.WMF", lpString2="32.EXE.exe") returned 1 [0046.583] StrStrW (lpFirst="BL00008_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.583] lstrcmpW (lpString1="BL00008_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.583] GetCurrentThreadId () returned 0x9b0 [0046.583] RtlWakeConditionVariable () returned 0x27e800 [0046.583] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="Windows") returned -1 [0046.583] lstrcmpW (lpString1="BL00012_.WMF", lpString2="32.EXE.exe") returned 1 [0046.583] StrStrW (lpFirst="BL00012_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.583] lstrcmpW (lpString1="BL00012_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.583] GetCurrentThreadId () returned 0x9b0 [0046.583] RtlWakeConditionVariable () returned 0x27e800 [0046.583] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="Windows") returned -1 [0046.583] lstrcmpW (lpString1="BL00045_.WMF", lpString2="32.EXE.exe") returned 1 [0046.583] StrStrW (lpFirst="BL00045_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.583] lstrcmpW (lpString1="BL00045_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.583] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.583] GetCurrentThreadId () returned 0x9b0 [0046.583] RtlWakeConditionVariable () returned 0x27e800 [0046.583] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="Windows") returned -1 [0046.583] lstrcmpW (lpString1="BL00098_.WMF", lpString2="32.EXE.exe") returned 1 [0046.584] StrStrW (lpFirst="BL00098_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.584] lstrcmpW (lpString1="BL00098_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.584] GetCurrentThreadId () returned 0x9b0 [0046.584] RtlWakeConditionVariable () returned 0x27e800 [0046.584] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="Windows") returned -1 [0046.584] lstrcmpW (lpString1="BL00105_.WMF", lpString2="32.EXE.exe") returned 1 [0046.584] StrStrW (lpFirst="BL00105_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.584] lstrcmpW (lpString1="BL00105_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.584] GetCurrentThreadId () returned 0x9b0 [0046.584] RtlWakeConditionVariable () returned 0x27e800 [0046.584] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="Windows") returned -1 [0046.584] lstrcmpW (lpString1="BL00122_.WMF", lpString2="32.EXE.exe") returned 1 [0046.584] StrStrW (lpFirst="BL00122_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.584] lstrcmpW (lpString1="BL00122_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.584] GetCurrentThreadId () returned 0x9b0 [0046.584] RtlWakeConditionVariable () returned 0x27e800 [0046.584] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="Windows") returned -1 [0046.584] lstrcmpW (lpString1="BL00130_.WMF", lpString2="32.EXE.exe") returned 1 [0046.584] StrStrW (lpFirst="BL00130_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.584] lstrcmpW (lpString1="BL00130_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.584] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.584] GetCurrentThreadId () returned 0x9b0 [0046.584] RtlWakeConditionVariable () returned 0x27e800 [0046.584] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="Windows") returned -1 [0046.584] lstrcmpW (lpString1="BL00148_.WMF", lpString2="32.EXE.exe") returned 1 [0046.585] StrStrW (lpFirst="BL00148_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.585] lstrcmpW (lpString1="BL00148_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.585] GetCurrentThreadId () returned 0x9b0 [0046.585] RtlWakeConditionVariable () returned 0x27e800 [0046.585] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="Windows") returned -1 [0046.585] lstrcmpW (lpString1="BL00152_.WMF", lpString2="32.EXE.exe") returned 1 [0046.585] StrStrW (lpFirst="BL00152_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.585] lstrcmpW (lpString1="BL00152_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.585] GetCurrentThreadId () returned 0x9b0 [0046.585] RtlWakeConditionVariable () returned 0x27e800 [0046.585] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="Windows") returned -1 [0046.585] lstrcmpW (lpString1="BL00194_.WMF", lpString2="32.EXE.exe") returned 1 [0046.585] StrStrW (lpFirst="BL00194_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.585] lstrcmpW (lpString1="BL00194_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.585] GetCurrentThreadId () returned 0x9b0 [0046.585] RtlWakeConditionVariable () returned 0x27e800 [0046.585] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="Windows") returned -1 [0046.585] lstrcmpW (lpString1="BL00195_.WMF", lpString2="32.EXE.exe") returned 1 [0046.585] StrStrW (lpFirst="BL00195_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.585] lstrcmpW (lpString1="BL00195_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.585] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.585] GetCurrentThreadId () returned 0x9b0 [0046.585] RtlWakeConditionVariable () returned 0x27e800 [0046.585] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="Windows") returned -1 [0046.586] lstrcmpW (lpString1="BL00234_.WMF", lpString2="32.EXE.exe") returned 1 [0046.586] StrStrW (lpFirst="BL00234_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.586] lstrcmpW (lpString1="BL00234_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.586] GetCurrentThreadId () returned 0x9b0 [0046.586] RtlWakeConditionVariable () returned 0x27e800 [0046.586] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="Windows") returned -1 [0046.586] lstrcmpW (lpString1="BL00242_.WMF", lpString2="32.EXE.exe") returned 1 [0046.586] StrStrW (lpFirst="BL00242_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.586] lstrcmpW (lpString1="BL00242_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.586] GetCurrentThreadId () returned 0x9b0 [0046.586] RtlWakeConditionVariable () returned 0x27e800 [0046.586] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="Windows") returned -1 [0046.586] lstrcmpW (lpString1="BL00247_.WMF", lpString2="32.EXE.exe") returned 1 [0046.586] StrStrW (lpFirst="BL00247_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.586] lstrcmpW (lpString1="BL00247_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.586] GetCurrentThreadId () returned 0x9b0 [0046.586] RtlWakeConditionVariable () returned 0x27e800 [0046.586] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="Windows") returned -1 [0046.586] lstrcmpW (lpString1="BL00248_.WMF", lpString2="32.EXE.exe") returned 1 [0046.586] StrStrW (lpFirst="BL00248_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.586] lstrcmpW (lpString1="BL00248_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.586] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.586] GetCurrentThreadId () returned 0x9b0 [0046.586] RtlWakeConditionVariable () returned 0x27e800 [0046.586] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="Windows") returned -1 [0046.587] lstrcmpW (lpString1="BL00252_.WMF", lpString2="32.EXE.exe") returned 1 [0046.587] StrStrW (lpFirst="BL00252_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.587] lstrcmpW (lpString1="BL00252_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.587] GetCurrentThreadId () returned 0x9b0 [0046.587] RtlWakeConditionVariable () returned 0x27e800 [0046.587] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="Windows") returned -1 [0046.587] lstrcmpW (lpString1="BL00254_.WMF", lpString2="32.EXE.exe") returned 1 [0046.587] StrStrW (lpFirst="BL00254_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.587] lstrcmpW (lpString1="BL00254_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.587] GetCurrentThreadId () returned 0x9b0 [0046.587] RtlWakeConditionVariable () returned 0x27e800 [0046.587] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="Windows") returned -1 [0046.587] lstrcmpW (lpString1="BL00261_.WMF", lpString2="32.EXE.exe") returned 1 [0046.587] StrStrW (lpFirst="BL00261_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.587] lstrcmpW (lpString1="BL00261_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.587] GetCurrentThreadId () returned 0x9b0 [0046.587] RtlWakeConditionVariable () returned 0x27e800 [0046.587] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="Windows") returned -1 [0046.587] lstrcmpW (lpString1="BL00262_.WMF", lpString2="32.EXE.exe") returned 1 [0046.587] StrStrW (lpFirst="BL00262_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.587] lstrcmpW (lpString1="BL00262_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.587] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.587] GetCurrentThreadId () returned 0x9b0 [0046.587] RtlWakeConditionVariable () returned 0x27e800 [0046.587] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="Windows") returned -1 [0046.588] lstrcmpW (lpString1="BL00265_.WMF", lpString2="32.EXE.exe") returned 1 [0046.588] StrStrW (lpFirst="BL00265_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.588] lstrcmpW (lpString1="BL00265_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.588] GetCurrentThreadId () returned 0x9b0 [0046.588] RtlWakeConditionVariable () returned 0x27e800 [0046.588] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="Windows") returned -1 [0046.588] lstrcmpW (lpString1="BL00267_.WMF", lpString2="32.EXE.exe") returned 1 [0046.588] StrStrW (lpFirst="BL00267_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.588] lstrcmpW (lpString1="BL00267_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.588] GetCurrentThreadId () returned 0x9b0 [0046.588] RtlWakeConditionVariable () returned 0x27e800 [0046.588] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="Windows") returned -1 [0046.588] lstrcmpW (lpString1="BL00269_.WMF", lpString2="32.EXE.exe") returned 1 [0046.588] StrStrW (lpFirst="BL00269_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.588] lstrcmpW (lpString1="BL00269_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.588] GetCurrentThreadId () returned 0x9b0 [0046.588] RtlWakeConditionVariable () returned 0x27e800 [0046.588] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="Windows") returned -1 [0046.588] lstrcmpW (lpString1="BL00270_.WMF", lpString2="32.EXE.exe") returned 1 [0046.588] StrStrW (lpFirst="BL00270_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.588] lstrcmpW (lpString1="BL00270_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.588] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.588] GetCurrentThreadId () returned 0x9b0 [0046.588] RtlWakeConditionVariable () returned 0x27e800 [0046.588] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="Windows") returned -1 [0046.589] lstrcmpW (lpString1="BL00273_.WMF", lpString2="32.EXE.exe") returned 1 [0046.589] StrStrW (lpFirst="BL00273_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.589] lstrcmpW (lpString1="BL00273_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.589] GetCurrentThreadId () returned 0x9b0 [0046.589] RtlWakeConditionVariable () returned 0x27e800 [0046.589] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="Windows") returned -1 [0046.589] lstrcmpW (lpString1="BL00274_.WMF", lpString2="32.EXE.exe") returned 1 [0046.589] StrStrW (lpFirst="BL00274_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.589] lstrcmpW (lpString1="BL00274_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.589] GetCurrentThreadId () returned 0x9b0 [0046.589] RtlWakeConditionVariable () returned 0x27e800 [0046.589] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="Windows") returned -1 [0046.589] lstrcmpW (lpString1="BL00296_.WMF", lpString2="32.EXE.exe") returned 1 [0046.589] StrStrW (lpFirst="BL00296_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.589] lstrcmpW (lpString1="BL00296_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.589] GetCurrentThreadId () returned 0x9b0 [0046.589] RtlWakeConditionVariable () returned 0x27e800 [0046.589] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="Windows") returned -1 [0046.589] lstrcmpW (lpString1="BL00390_.WMF", lpString2="32.EXE.exe") returned 1 [0046.589] StrStrW (lpFirst="BL00390_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.589] lstrcmpW (lpString1="BL00390_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.589] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.589] GetCurrentThreadId () returned 0x9b0 [0046.589] RtlWakeConditionVariable () returned 0x27e800 [0046.589] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="Windows") returned -1 [0046.590] lstrcmpW (lpString1="BL00392_.WMF", lpString2="32.EXE.exe") returned 1 [0046.590] StrStrW (lpFirst="BL00392_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.590] lstrcmpW (lpString1="BL00392_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.590] GetCurrentThreadId () returned 0x9b0 [0046.590] RtlWakeConditionVariable () returned 0x27e800 [0046.590] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="Windows") returned -1 [0046.590] lstrcmpW (lpString1="BL00524_.WMF", lpString2="32.EXE.exe") returned 1 [0046.590] StrStrW (lpFirst="BL00524_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.590] lstrcmpW (lpString1="BL00524_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.590] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x3200e8 [0046.590] GetCurrentThreadId () returned 0x9b0 [0046.590] RtlWakeConditionVariable () returned 0x27e800 [0046.623] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="Windows") returned -1 [0046.623] lstrcmpW (lpString1="BL00525_.WMF", lpString2="32.EXE.exe") returned 1 [0046.623] StrStrW (lpFirst="BL00525_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.623] lstrcmpW (lpString1="BL00525_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.623] GetCurrentThreadId () returned 0x9b0 [0046.623] RtlWakeConditionVariable () returned 0x27e800 [0046.623] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="Windows") returned -1 [0046.623] lstrcmpW (lpString1="BL00526_.WMF", lpString2="32.EXE.exe") returned 1 [0046.623] StrStrW (lpFirst="BL00526_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.623] lstrcmpW (lpString1="BL00526_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.623] GetCurrentThreadId () returned 0x9b0 [0046.623] RtlWakeConditionVariable () returned 0x27e800 [0046.623] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="Windows") returned -1 [0046.623] lstrcmpW (lpString1="BL00648_.WMF", lpString2="32.EXE.exe") returned 1 [0046.623] StrStrW (lpFirst="BL00648_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.623] lstrcmpW (lpString1="BL00648_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.623] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.623] GetCurrentThreadId () returned 0x9b0 [0046.623] RtlWakeConditionVariable () returned 0x27e800 [0046.623] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="Windows") returned -1 [0046.624] lstrcmpW (lpString1="BL00921_.WMF", lpString2="32.EXE.exe") returned 1 [0046.624] StrStrW (lpFirst="BL00921_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.624] lstrcmpW (lpString1="BL00921_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.624] GetCurrentThreadId () returned 0x9b0 [0046.624] RtlWakeConditionVariable () returned 0x27e800 [0046.624] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="Windows") returned -1 [0046.624] lstrcmpW (lpString1="BL00923_.WMF", lpString2="32.EXE.exe") returned 1 [0046.624] StrStrW (lpFirst="BL00923_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.624] lstrcmpW (lpString1="BL00923_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.624] GetCurrentThreadId () returned 0x9b0 [0046.624] RtlWakeConditionVariable () returned 0x27e800 [0046.624] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="Windows") returned -1 [0046.624] lstrcmpW (lpString1="BL00932_.WMF", lpString2="32.EXE.exe") returned 1 [0046.624] StrStrW (lpFirst="BL00932_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.624] lstrcmpW (lpString1="BL00932_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.624] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.624] GetCurrentThreadId () returned 0x9b0 [0046.624] RtlWakeConditionVariable () returned 0x27e800 [0046.624] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="Windows") returned -1 [0046.624] lstrcmpW (lpString1="BL00985_.WMF", lpString2="32.EXE.exe") returned 1 [0046.624] StrStrW (lpFirst="BL00985_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.624] lstrcmpW (lpString1="BL00985_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.625] GetCurrentThreadId () returned 0x9b0 [0046.625] RtlWakeConditionVariable () returned 0x27e800 [0046.625] lstrcmpiW (lpString1="BOAT.WMF", lpString2="Windows") returned -1 [0046.625] lstrcmpW (lpString1="BOAT.WMF", lpString2="32.EXE.exe") returned 1 [0046.625] StrStrW (lpFirst="BOAT.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.625] lstrcmpW (lpString1="BOAT.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.625] GetCurrentThreadId () returned 0x9b0 [0046.625] RtlWakeConditionVariable () returned 0x27e800 [0046.625] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="Windows") returned -1 [0046.625] lstrcmpW (lpString1="BOATINST.WMF", lpString2="32.EXE.exe") returned 1 [0046.625] StrStrW (lpFirst="BOATINST.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.625] lstrcmpW (lpString1="BOATINST.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.625] GetCurrentThreadId () returned 0x9b0 [0046.625] RtlWakeConditionVariable () returned 0x27e800 [0046.625] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="Windows") returned -1 [0046.625] lstrcmpW (lpString1="BS00076_.WMF", lpString2="32.EXE.exe") returned 1 [0046.625] StrStrW (lpFirst="BS00076_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.625] lstrcmpW (lpString1="BS00076_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.625] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.625] GetCurrentThreadId () returned 0x9b0 [0046.625] RtlWakeConditionVariable () returned 0x27e800 [0046.625] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="Windows") returned -1 [0046.625] lstrcmpW (lpString1="BS00078_.WMF", lpString2="32.EXE.exe") returned 1 [0046.625] StrStrW (lpFirst="BS00078_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.626] lstrcmpW (lpString1="BS00078_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.626] GetCurrentThreadId () returned 0x9b0 [0046.626] RtlWakeConditionVariable () returned 0x27e800 [0046.626] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="Windows") returned -1 [0046.626] lstrcmpW (lpString1="BS00092_.WMF", lpString2="32.EXE.exe") returned 1 [0046.626] StrStrW (lpFirst="BS00092_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.626] lstrcmpW (lpString1="BS00092_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.626] GetCurrentThreadId () returned 0x9b0 [0046.626] RtlWakeConditionVariable () returned 0x27e800 [0046.626] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="Windows") returned -1 [0046.626] lstrcmpW (lpString1="BS00100_.WMF", lpString2="32.EXE.exe") returned 1 [0046.626] StrStrW (lpFirst="BS00100_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.626] lstrcmpW (lpString1="BS00100_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.626] GetCurrentThreadId () returned 0x9b0 [0046.626] RtlWakeConditionVariable () returned 0x27e800 [0046.626] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="Windows") returned -1 [0046.626] lstrcmpW (lpString1="BS00135_.WMF", lpString2="32.EXE.exe") returned 1 [0046.626] StrStrW (lpFirst="BS00135_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.626] lstrcmpW (lpString1="BS00135_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.626] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.626] GetCurrentThreadId () returned 0x9b0 [0046.626] RtlWakeConditionVariable () returned 0x27e800 [0046.626] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="Windows") returned -1 [0046.626] lstrcmpW (lpString1="BS00136_.WMF", lpString2="32.EXE.exe") returned 1 [0046.626] StrStrW (lpFirst="BS00136_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.627] lstrcmpW (lpString1="BS00136_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.627] GetCurrentThreadId () returned 0x9b0 [0046.627] RtlWakeConditionVariable () returned 0x27e800 [0046.627] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="Windows") returned -1 [0046.627] lstrcmpW (lpString1="BS00145_.WMF", lpString2="32.EXE.exe") returned 1 [0046.627] StrStrW (lpFirst="BS00145_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.627] lstrcmpW (lpString1="BS00145_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.627] GetCurrentThreadId () returned 0x9b0 [0046.627] RtlWakeConditionVariable () returned 0x27e800 [0046.627] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="Windows") returned -1 [0046.627] lstrcmpW (lpString1="BS00174_.WMF", lpString2="32.EXE.exe") returned 1 [0046.627] StrStrW (lpFirst="BS00174_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.627] lstrcmpW (lpString1="BS00174_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.627] GetCurrentThreadId () returned 0x9b0 [0046.627] RtlWakeConditionVariable () returned 0x27e800 [0046.627] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="Windows") returned -1 [0046.627] lstrcmpW (lpString1="BS00184_.WMF", lpString2="32.EXE.exe") returned 1 [0046.627] StrStrW (lpFirst="BS00184_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.627] lstrcmpW (lpString1="BS00184_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.627] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.627] GetCurrentThreadId () returned 0x9b0 [0046.627] RtlWakeConditionVariable () returned 0x27e800 [0046.627] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="Windows") returned -1 [0046.627] lstrcmpW (lpString1="BS00186_.WMF", lpString2="32.EXE.exe") returned 1 [0046.627] StrStrW (lpFirst="BS00186_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.628] lstrcmpW (lpString1="BS00186_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.628] GetCurrentThreadId () returned 0x9b0 [0046.628] RtlWakeConditionVariable () returned 0x27e800 [0046.628] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="Windows") returned -1 [0046.628] lstrcmpW (lpString1="BS00200_.WMF", lpString2="32.EXE.exe") returned 1 [0046.628] StrStrW (lpFirst="BS00200_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.628] lstrcmpW (lpString1="BS00200_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.628] GetCurrentThreadId () returned 0x9b0 [0046.628] RtlWakeConditionVariable () returned 0x27e800 [0046.628] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="Windows") returned -1 [0046.628] lstrcmpW (lpString1="BS00224_.WMF", lpString2="32.EXE.exe") returned 1 [0046.628] StrStrW (lpFirst="BS00224_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.628] lstrcmpW (lpString1="BS00224_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.628] GetCurrentThreadId () returned 0x9b0 [0046.628] RtlWakeConditionVariable () returned 0x27e800 [0046.628] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="Windows") returned -1 [0046.628] lstrcmpW (lpString1="BS00438_.WMF", lpString2="32.EXE.exe") returned 1 [0046.628] StrStrW (lpFirst="BS00438_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.628] lstrcmpW (lpString1="BS00438_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.628] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.628] GetCurrentThreadId () returned 0x9b0 [0046.629] RtlWakeConditionVariable () returned 0x27e800 [0046.629] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="Windows") returned -1 [0046.629] lstrcmpW (lpString1="BS00439_.WMF", lpString2="32.EXE.exe") returned 1 [0046.629] StrStrW (lpFirst="BS00439_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.629] lstrcmpW (lpString1="BS00439_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.629] GetCurrentThreadId () returned 0x9b0 [0046.629] RtlWakeConditionVariable () returned 0x27e800 [0046.629] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="Windows") returned -1 [0046.629] lstrcmpW (lpString1="BS00440_.WMF", lpString2="32.EXE.exe") returned 1 [0046.629] StrStrW (lpFirst="BS00440_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.629] lstrcmpW (lpString1="BS00440_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.629] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.629] GetCurrentThreadId () returned 0x9b0 [0046.629] RtlWakeConditionVariable () returned 0x27e800 [0046.630] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="Windows") returned -1 [0046.630] lstrcmpW (lpString1="BS00441_.WMF", lpString2="32.EXE.exe") returned 1 [0046.630] StrStrW (lpFirst="BS00441_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.630] lstrcmpW (lpString1="BS00441_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.630] GetCurrentThreadId () returned 0x9b0 [0046.630] RtlWakeConditionVariable () returned 0x27e800 [0046.630] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="Windows") returned -1 [0046.630] lstrcmpW (lpString1="BS00442_.WMF", lpString2="32.EXE.exe") returned 1 [0046.630] StrStrW (lpFirst="BS00442_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.630] lstrcmpW (lpString1="BS00442_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.630] GetCurrentThreadId () returned 0x9b0 [0046.630] RtlWakeConditionVariable () returned 0x27e800 [0046.630] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="Windows") returned -1 [0046.630] lstrcmpW (lpString1="BS00443_.WMF", lpString2="32.EXE.exe") returned 1 [0046.630] StrStrW (lpFirst="BS00443_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.630] lstrcmpW (lpString1="BS00443_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.630] GetCurrentThreadId () returned 0x9b0 [0046.630] RtlWakeConditionVariable () returned 0x27e800 [0046.630] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="Windows") returned -1 [0046.630] lstrcmpW (lpString1="BS00444_.WMF", lpString2="32.EXE.exe") returned 1 [0046.630] StrStrW (lpFirst="BS00444_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.630] lstrcmpW (lpString1="BS00444_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.630] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.630] GetCurrentThreadId () returned 0x9b0 [0046.630] RtlWakeConditionVariable () returned 0x27e800 [0046.631] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="Windows") returned -1 [0046.631] lstrcmpW (lpString1="BS00445_.WMF", lpString2="32.EXE.exe") returned 1 [0046.631] StrStrW (lpFirst="BS00445_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.631] lstrcmpW (lpString1="BS00445_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.631] GetCurrentThreadId () returned 0x9b0 [0046.631] RtlWakeConditionVariable () returned 0x27e800 [0046.631] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="Windows") returned -1 [0046.631] lstrcmpW (lpString1="BS00453_.WMF", lpString2="32.EXE.exe") returned 1 [0046.631] StrStrW (lpFirst="BS00453_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.631] lstrcmpW (lpString1="BS00453_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.631] GetCurrentThreadId () returned 0x9b0 [0046.631] RtlWakeConditionVariable () returned 0x27e800 [0046.631] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="Windows") returned -1 [0046.631] lstrcmpW (lpString1="BS01080_.WMF", lpString2="32.EXE.exe") returned 1 [0046.631] StrStrW (lpFirst="BS01080_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.631] lstrcmpW (lpString1="BS01080_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.631] GetCurrentThreadId () returned 0x9b0 [0046.631] RtlWakeConditionVariable () returned 0x27e800 [0046.631] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="Windows") returned -1 [0046.631] lstrcmpW (lpString1="BS01603_.WMF", lpString2="32.EXE.exe") returned 1 [0046.631] StrStrW (lpFirst="BS01603_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.631] lstrcmpW (lpString1="BS01603_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.631] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.631] GetCurrentThreadId () returned 0x9b0 [0046.631] RtlWakeConditionVariable () returned 0x27e800 [0046.632] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="Windows") returned -1 [0046.632] lstrcmpW (lpString1="BS01634_.WMF", lpString2="32.EXE.exe") returned 1 [0046.632] StrStrW (lpFirst="BS01634_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.632] lstrcmpW (lpString1="BS01634_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.632] GetCurrentThreadId () returned 0x9b0 [0046.632] RtlWakeConditionVariable () returned 0x27e800 [0046.632] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="Windows") returned -1 [0046.632] lstrcmpW (lpString1="BS01635_.WMF", lpString2="32.EXE.exe") returned 1 [0046.632] StrStrW (lpFirst="BS01635_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.632] lstrcmpW (lpString1="BS01635_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.632] GetCurrentThreadId () returned 0x9b0 [0046.632] RtlWakeConditionVariable () returned 0x27e800 [0046.647] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="Windows") returned -1 [0046.647] lstrcmpW (lpString1="BS01636_.WMF", lpString2="32.EXE.exe") returned 1 [0046.648] StrStrW (lpFirst="BS01636_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.648] lstrcmpW (lpString1="BS01636_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.648] GetCurrentThreadId () returned 0x9b0 [0046.648] RtlWakeConditionVariable () returned 0x27e800 [0046.648] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="Windows") returned -1 [0046.648] lstrcmpW (lpString1="BS01637_.WMF", lpString2="32.EXE.exe") returned 1 [0046.648] StrStrW (lpFirst="BS01637_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.648] lstrcmpW (lpString1="BS01637_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.648] GetCurrentThreadId () returned 0x9b0 [0046.648] RtlWakeConditionVariable () returned 0x27e800 [0046.648] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="Windows") returned -1 [0046.648] lstrcmpW (lpString1="BS01638_.WMF", lpString2="32.EXE.exe") returned 1 [0046.648] StrStrW (lpFirst="BS01638_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.648] lstrcmpW (lpString1="BS01638_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.648] GetCurrentThreadId () returned 0x9b0 [0046.648] RtlWakeConditionVariable () returned 0x27e800 [0046.648] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="Windows") returned -1 [0046.648] lstrcmpW (lpString1="BS01639_.WMF", lpString2="32.EXE.exe") returned 1 [0046.648] StrStrW (lpFirst="BS01639_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.648] lstrcmpW (lpString1="BS01639_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.648] GetCurrentThreadId () returned 0x9b0 [0046.648] RtlWakeConditionVariable () returned 0x27e800 [0046.648] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="Windows") returned -1 [0046.649] lstrcmpW (lpString1="CARBN_01.MID", lpString2="32.EXE.exe") returned 1 [0046.649] StrStrW (lpFirst="CARBN_01.MID", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.649] lstrcmpW (lpString1="CARBN_01.MID", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.649] GetCurrentThreadId () returned 0x9b0 [0046.649] RtlWakeConditionVariable () returned 0x27e800 [0046.649] lstrcmpiW (lpString1="CG1606.WMF", lpString2="Windows") returned -1 [0046.649] lstrcmpW (lpString1="CG1606.WMF", lpString2="32.EXE.exe") returned 1 [0046.649] StrStrW (lpFirst="CG1606.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.649] lstrcmpW (lpString1="CG1606.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.649] GetCurrentThreadId () returned 0x9b0 [0046.649] RtlWakeConditionVariable () returned 0x27e800 [0046.649] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="Windows") returned -1 [0046.649] lstrcmpW (lpString1="CLASSIC1.WMF", lpString2="32.EXE.exe") returned 1 [0046.649] StrStrW (lpFirst="CLASSIC1.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.649] lstrcmpW (lpString1="CLASSIC1.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.649] GetCurrentThreadId () returned 0x9b0 [0046.649] RtlWakeConditionVariable () returned 0x27e800 [0046.649] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="Windows") returned -1 [0046.649] lstrcmpW (lpString1="CLASSIC2.WMF", lpString2="32.EXE.exe") returned 1 [0046.649] StrStrW (lpFirst="CLASSIC2.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.649] lstrcmpW (lpString1="CLASSIC2.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.649] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.649] GetCurrentThreadId () returned 0x9b0 [0046.649] RtlWakeConditionVariable () returned 0x27e800 [0046.649] lstrcmpiW (lpString1="CLIP.WMF", lpString2="Windows") returned -1 [0046.650] lstrcmpW (lpString1="CLIP.WMF", lpString2="32.EXE.exe") returned 1 [0046.650] StrStrW (lpFirst="CLIP.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.650] lstrcmpW (lpString1="CLIP.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.650] GetCurrentThreadId () returned 0x9b0 [0046.650] RtlWakeConditionVariable () returned 0x27e800 [0046.650] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="Windows") returned -1 [0046.650] lstrcmpW (lpString1="CMNTY_01.MID", lpString2="32.EXE.exe") returned 1 [0046.650] StrStrW (lpFirst="CMNTY_01.MID", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.650] lstrcmpW (lpString1="CMNTY_01.MID", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.650] GetCurrentThreadId () returned 0x9b0 [0046.650] RtlWakeConditionVariable () returned 0x27e800 [0046.650] lstrcmpiW (lpString1="CRANE.WMF", lpString2="Windows") returned -1 [0046.650] lstrcmpW (lpString1="CRANE.WMF", lpString2="32.EXE.exe") returned 1 [0046.650] StrStrW (lpFirst="CRANE.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.650] lstrcmpW (lpString1="CRANE.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.650] GetCurrentThreadId () returned 0x9b0 [0046.650] RtlWakeConditionVariable () returned 0x27e800 [0046.650] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="Windows") returned -1 [0046.650] lstrcmpW (lpString1="CRANINST.WMF", lpString2="32.EXE.exe") returned 1 [0046.650] StrStrW (lpFirst="CRANINST.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.650] lstrcmpW (lpString1="CRANINST.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.650] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.650] GetCurrentThreadId () returned 0x9b0 [0046.650] RtlWakeConditionVariable () returned 0x27e800 [0046.650] lstrcmpiW (lpString1="CUP.WMF", lpString2="Windows") returned -1 [0046.650] lstrcmpW (lpString1="CUP.WMF", lpString2="32.EXE.exe") returned 1 [0046.651] StrStrW (lpFirst="CUP.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.651] lstrcmpW (lpString1="CUP.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x310af8 [0046.651] GetCurrentThreadId () returned 0x9b0 [0046.651] RtlWakeConditionVariable () returned 0x27e800 [0046.651] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="Windows") returned -1 [0046.651] lstrcmpW (lpString1="CUPINST.WMF", lpString2="32.EXE.exe") returned 1 [0046.651] StrStrW (lpFirst="CUPINST.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.651] lstrcmpW (lpString1="CUPINST.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.651] GetCurrentThreadId () returned 0x9b0 [0046.651] RtlWakeConditionVariable () returned 0x27e800 [0046.651] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="Windows") returned -1 [0046.651] lstrcmpW (lpString1="DD00117_.WMF", lpString2="32.EXE.exe") returned 1 [0046.651] StrStrW (lpFirst="DD00117_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.651] lstrcmpW (lpString1="DD00117_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.651] GetCurrentThreadId () returned 0x9b0 [0046.651] RtlWakeConditionVariable () returned 0x27e800 [0046.651] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="Windows") returned -1 [0046.651] lstrcmpW (lpString1="DD00121_.WMF", lpString2="32.EXE.exe") returned 1 [0046.651] StrStrW (lpFirst="DD00121_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.651] lstrcmpW (lpString1="DD00121_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.651] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.651] GetCurrentThreadId () returned 0x9b0 [0046.651] RtlWakeConditionVariable () returned 0x27e800 [0046.651] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="Windows") returned -1 [0046.651] lstrcmpW (lpString1="DD00234_.WMF", lpString2="32.EXE.exe") returned 1 [0046.652] StrStrW (lpFirst="DD00234_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.652] lstrcmpW (lpString1="DD00234_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.652] GetCurrentThreadId () returned 0x9b0 [0046.652] RtlWakeConditionVariable () returned 0x27e800 [0046.652] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="Windows") returned -1 [0046.652] lstrcmpW (lpString1="DD00255_.WMF", lpString2="32.EXE.exe") returned 1 [0046.652] StrStrW (lpFirst="DD00255_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.652] lstrcmpW (lpString1="DD00255_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.652] GetCurrentThreadId () returned 0x9b0 [0046.652] RtlWakeConditionVariable () returned 0x27e800 [0046.652] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="Windows") returned -1 [0046.652] lstrcmpW (lpString1="DD00256_.WMF", lpString2="32.EXE.exe") returned 1 [0046.652] StrStrW (lpFirst="DD00256_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.652] lstrcmpW (lpString1="DD00256_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.652] GetCurrentThreadId () returned 0x9b0 [0046.652] RtlWakeConditionVariable () returned 0x27e800 [0046.652] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="Windows") returned -1 [0046.652] lstrcmpW (lpString1="DD00261_.WMF", lpString2="32.EXE.exe") returned 1 [0046.652] StrStrW (lpFirst="DD00261_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.652] lstrcmpW (lpString1="DD00261_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.652] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.652] GetCurrentThreadId () returned 0x9b0 [0046.652] RtlWakeConditionVariable () returned 0x27e800 [0046.652] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="Windows") returned -1 [0046.652] lstrcmpW (lpString1="DD00297_.WMF", lpString2="32.EXE.exe") returned 1 [0046.653] StrStrW (lpFirst="DD00297_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.653] lstrcmpW (lpString1="DD00297_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.653] GetCurrentThreadId () returned 0x9b0 [0046.653] RtlWakeConditionVariable () returned 0x27e800 [0046.653] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="Windows") returned -1 [0046.653] lstrcmpW (lpString1="DD00372_.WMF", lpString2="32.EXE.exe") returned 1 [0046.653] StrStrW (lpFirst="DD00372_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.653] lstrcmpW (lpString1="DD00372_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.653] GetCurrentThreadId () returned 0x9b0 [0046.653] RtlWakeConditionVariable () returned 0x27e800 [0046.653] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="Windows") returned -1 [0046.653] lstrcmpW (lpString1="DD00405_.WMF", lpString2="32.EXE.exe") returned 1 [0046.653] StrStrW (lpFirst="DD00405_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.653] lstrcmpW (lpString1="DD00405_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.653] GetCurrentThreadId () returned 0x9b0 [0046.653] RtlWakeConditionVariable () returned 0x27e800 [0046.653] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="Windows") returned -1 [0046.653] lstrcmpW (lpString1="DD00407_.WMF", lpString2="32.EXE.exe") returned 1 [0046.653] StrStrW (lpFirst="DD00407_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.653] lstrcmpW (lpString1="DD00407_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.653] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.653] GetCurrentThreadId () returned 0x9b0 [0046.653] RtlWakeConditionVariable () returned 0x27e800 [0046.653] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="Windows") returned -1 [0046.653] lstrcmpW (lpString1="DD00413_.WMF", lpString2="32.EXE.exe") returned 1 [0046.654] StrStrW (lpFirst="DD00413_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.654] lstrcmpW (lpString1="DD00413_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.654] GetCurrentThreadId () returned 0x9b0 [0046.654] RtlWakeConditionVariable () returned 0x27e800 [0046.654] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="Windows") returned -1 [0046.654] lstrcmpW (lpString1="DD00414_.WMF", lpString2="32.EXE.exe") returned 1 [0046.654] StrStrW (lpFirst="DD00414_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.654] lstrcmpW (lpString1="DD00414_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.654] GetCurrentThreadId () returned 0x9b0 [0046.654] RtlWakeConditionVariable () returned 0x27e800 [0046.654] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="Windows") returned -1 [0046.654] lstrcmpW (lpString1="DD00419_.WMF", lpString2="32.EXE.exe") returned 1 [0046.654] StrStrW (lpFirst="DD00419_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.654] lstrcmpW (lpString1="DD00419_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.654] GetCurrentThreadId () returned 0x9b0 [0046.654] RtlWakeConditionVariable () returned 0x27e800 [0046.654] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="Windows") returned -1 [0046.654] lstrcmpW (lpString1="DD00437_.WMF", lpString2="32.EXE.exe") returned 1 [0046.654] StrStrW (lpFirst="DD00437_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.654] lstrcmpW (lpString1="DD00437_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.654] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.654] GetCurrentThreadId () returned 0x9b0 [0046.654] RtlWakeConditionVariable () returned 0x27e800 [0046.654] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="Windows") returned -1 [0046.654] lstrcmpW (lpString1="DD00448_.WMF", lpString2="32.EXE.exe") returned 1 [0046.654] StrStrW (lpFirst="DD00448_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.655] lstrcmpW (lpString1="DD00448_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.655] GetCurrentThreadId () returned 0x9b0 [0046.655] RtlWakeConditionVariable () returned 0x27e800 [0046.655] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="Windows") returned -1 [0046.655] lstrcmpW (lpString1="DD00449_.WMF", lpString2="32.EXE.exe") returned 1 [0046.655] StrStrW (lpFirst="DD00449_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.655] lstrcmpW (lpString1="DD00449_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.655] GetCurrentThreadId () returned 0x9b0 [0046.655] RtlWakeConditionVariable () returned 0x27e800 [0046.655] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="Windows") returned -1 [0046.655] lstrcmpW (lpString1="DD00687_.WMF", lpString2="32.EXE.exe") returned 1 [0046.655] StrStrW (lpFirst="DD00687_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.655] lstrcmpW (lpString1="DD00687_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.655] GetCurrentThreadId () returned 0x9b0 [0046.655] RtlWakeConditionVariable () returned 0x27e800 [0046.655] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="Windows") returned -1 [0046.655] lstrcmpW (lpString1="DD00705_.WMF", lpString2="32.EXE.exe") returned 1 [0046.655] StrStrW (lpFirst="DD00705_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.655] lstrcmpW (lpString1="DD00705_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.655] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.655] GetCurrentThreadId () returned 0x9b0 [0046.655] RtlWakeConditionVariable () returned 0x27e800 [0046.655] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="Windows") returned -1 [0046.656] lstrcmpW (lpString1="DD01015_.WMF", lpString2="32.EXE.exe") returned 1 [0046.656] StrStrW (lpFirst="DD01015_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.656] lstrcmpW (lpString1="DD01015_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.656] GetCurrentThreadId () returned 0x9b0 [0046.656] RtlWakeConditionVariable () returned 0x27e800 [0046.656] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="Windows") returned -1 [0046.656] lstrcmpW (lpString1="DD01039_.WMF", lpString2="32.EXE.exe") returned 1 [0046.656] StrStrW (lpFirst="DD01039_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.656] lstrcmpW (lpString1="DD01039_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.656] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.656] GetCurrentThreadId () returned 0x9b0 [0046.656] RtlWakeConditionVariable () returned 0x27e800 [0046.675] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="Windows") returned -1 [0046.675] lstrcmpW (lpString1="DD01138_.WMF", lpString2="32.EXE.exe") returned 1 [0046.675] StrStrW (lpFirst="DD01138_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.675] lstrcmpW (lpString1="DD01138_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.675] GetCurrentThreadId () returned 0x9b0 [0046.675] RtlWakeConditionVariable () returned 0x27e800 [0046.675] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="Windows") returned -1 [0046.675] lstrcmpW (lpString1="DD01139_.WMF", lpString2="32.EXE.exe") returned 1 [0046.675] StrStrW (lpFirst="DD01139_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.675] lstrcmpW (lpString1="DD01139_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.675] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.676] GetCurrentThreadId () returned 0x9b0 [0046.676] RtlWakeConditionVariable () returned 0x27e800 [0046.676] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="Windows") returned -1 [0046.676] lstrcmpW (lpString1="DD01140_.WMF", lpString2="32.EXE.exe") returned 1 [0046.676] StrStrW (lpFirst="DD01140_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.676] lstrcmpW (lpString1="DD01140_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.676] GetCurrentThreadId () returned 0x9b0 [0046.676] RtlWakeConditionVariable () returned 0x27e800 [0046.676] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="Windows") returned -1 [0046.676] lstrcmpW (lpString1="DD01143_.WMF", lpString2="32.EXE.exe") returned 1 [0046.676] StrStrW (lpFirst="DD01143_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.676] lstrcmpW (lpString1="DD01143_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.676] GetCurrentThreadId () returned 0x9b0 [0046.676] RtlWakeConditionVariable () returned 0x27e800 [0046.676] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="Windows") returned -1 [0046.676] lstrcmpW (lpString1="DD01145_.WMF", lpString2="32.EXE.exe") returned 1 [0046.676] StrStrW (lpFirst="DD01145_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.676] lstrcmpW (lpString1="DD01145_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.676] GetCurrentThreadId () returned 0x9b0 [0046.676] RtlWakeConditionVariable () returned 0x27e800 [0046.676] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="Windows") returned -1 [0046.676] lstrcmpW (lpString1="DD01146_.WMF", lpString2="32.EXE.exe") returned 1 [0046.676] StrStrW (lpFirst="DD01146_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.676] lstrcmpW (lpString1="DD01146_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.676] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.677] GetCurrentThreadId () returned 0x9b0 [0046.677] RtlWakeConditionVariable () returned 0x27e800 [0046.677] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="Windows") returned -1 [0046.677] lstrcmpW (lpString1="DD01151_.WMF", lpString2="32.EXE.exe") returned 1 [0046.677] StrStrW (lpFirst="DD01151_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.677] lstrcmpW (lpString1="DD01151_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.677] GetCurrentThreadId () returned 0x9b0 [0046.677] RtlWakeConditionVariable () returned 0x27e800 [0046.677] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="Windows") returned -1 [0046.677] lstrcmpW (lpString1="DD01152_.WMF", lpString2="32.EXE.exe") returned 1 [0046.677] StrStrW (lpFirst="DD01152_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.677] lstrcmpW (lpString1="DD01152_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.677] GetCurrentThreadId () returned 0x9b0 [0046.677] RtlWakeConditionVariable () returned 0x27e800 [0046.677] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="Windows") returned -1 [0046.677] lstrcmpW (lpString1="DD01157_.WMF", lpString2="32.EXE.exe") returned 1 [0046.677] StrStrW (lpFirst="DD01157_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.677] lstrcmpW (lpString1="DD01157_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.677] GetCurrentThreadId () returned 0x9b0 [0046.677] RtlWakeConditionVariable () returned 0x27e800 [0046.677] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="Windows") returned -1 [0046.677] lstrcmpW (lpString1="DD01160_.WMF", lpString2="32.EXE.exe") returned 1 [0046.677] StrStrW (lpFirst="DD01160_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.677] lstrcmpW (lpString1="DD01160_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.677] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.677] GetCurrentThreadId () returned 0x9b0 [0046.678] RtlWakeConditionVariable () returned 0x27e800 [0046.678] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="Windows") returned -1 [0046.678] lstrcmpW (lpString1="DD01162_.WMF", lpString2="32.EXE.exe") returned 1 [0046.678] StrStrW (lpFirst="DD01162_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.678] lstrcmpW (lpString1="DD01162_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.678] GetCurrentThreadId () returned 0x9b0 [0046.678] RtlWakeConditionVariable () returned 0x27e800 [0046.678] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="Windows") returned -1 [0046.678] lstrcmpW (lpString1="DD01163_.WMF", lpString2="32.EXE.exe") returned 1 [0046.678] StrStrW (lpFirst="DD01163_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.678] lstrcmpW (lpString1="DD01163_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.678] GetCurrentThreadId () returned 0x9b0 [0046.678] RtlWakeConditionVariable () returned 0x27e800 [0046.678] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="Windows") returned -1 [0046.678] lstrcmpW (lpString1="DD01166_.WMF", lpString2="32.EXE.exe") returned 1 [0046.678] StrStrW (lpFirst="DD01166_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.678] lstrcmpW (lpString1="DD01166_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.678] GetCurrentThreadId () returned 0x9b0 [0046.678] RtlWakeConditionVariable () returned 0x27e800 [0046.678] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="Windows") returned -1 [0046.678] lstrcmpW (lpString1="DD01167_.WMF", lpString2="32.EXE.exe") returned 1 [0046.678] StrStrW (lpFirst="DD01167_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.678] lstrcmpW (lpString1="DD01167_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.678] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.678] GetCurrentThreadId () returned 0x9b0 [0046.679] RtlWakeConditionVariable () returned 0x27e800 [0046.679] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="Windows") returned -1 [0046.679] lstrcmpW (lpString1="DD01168_.WMF", lpString2="32.EXE.exe") returned 1 [0046.679] StrStrW (lpFirst="DD01168_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.679] lstrcmpW (lpString1="DD01168_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.679] GetCurrentThreadId () returned 0x9b0 [0046.679] RtlWakeConditionVariable () returned 0x27e800 [0046.679] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="Windows") returned -1 [0046.679] lstrcmpW (lpString1="DD01169_.WMF", lpString2="32.EXE.exe") returned 1 [0046.679] StrStrW (lpFirst="DD01169_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.679] lstrcmpW (lpString1="DD01169_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.679] GetCurrentThreadId () returned 0x9b0 [0046.679] RtlWakeConditionVariable () returned 0x27e800 [0046.679] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="Windows") returned -1 [0046.679] lstrcmpW (lpString1="DD01170_.WMF", lpString2="32.EXE.exe") returned 1 [0046.679] StrStrW (lpFirst="DD01170_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.679] lstrcmpW (lpString1="DD01170_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.679] GetCurrentThreadId () returned 0x9b0 [0046.679] RtlWakeConditionVariable () returned 0x27e800 [0046.679] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="Windows") returned -1 [0046.679] lstrcmpW (lpString1="DD01171_.WMF", lpString2="32.EXE.exe") returned 1 [0046.679] StrStrW (lpFirst="DD01171_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.679] lstrcmpW (lpString1="DD01171_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.679] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.679] GetCurrentThreadId () returned 0x9b0 [0046.680] RtlWakeConditionVariable () returned 0x27e800 [0046.680] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="Windows") returned -1 [0046.680] lstrcmpW (lpString1="DD01172_.WMF", lpString2="32.EXE.exe") returned 1 [0046.680] StrStrW (lpFirst="DD01172_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.680] lstrcmpW (lpString1="DD01172_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.680] GetCurrentThreadId () returned 0x9b0 [0046.680] RtlWakeConditionVariable () returned 0x27e800 [0046.680] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="Windows") returned -1 [0046.680] lstrcmpW (lpString1="DD01173_.WMF", lpString2="32.EXE.exe") returned 1 [0046.680] StrStrW (lpFirst="DD01173_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.680] lstrcmpW (lpString1="DD01173_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.680] GetCurrentThreadId () returned 0x9b0 [0046.680] RtlWakeConditionVariable () returned 0x27e800 [0046.680] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="Windows") returned -1 [0046.680] lstrcmpW (lpString1="DD01176_.WMF", lpString2="32.EXE.exe") returned 1 [0046.680] StrStrW (lpFirst="DD01176_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.680] lstrcmpW (lpString1="DD01176_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.680] GetCurrentThreadId () returned 0x9b0 [0046.680] RtlWakeConditionVariable () returned 0x27e800 [0046.680] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="Windows") returned -1 [0046.680] lstrcmpW (lpString1="DD01178_.WMF", lpString2="32.EXE.exe") returned 1 [0046.680] StrStrW (lpFirst="DD01178_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.680] lstrcmpW (lpString1="DD01178_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.680] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.680] GetCurrentThreadId () returned 0x9b0 [0046.681] RtlWakeConditionVariable () returned 0x27e800 [0046.681] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="Windows") returned -1 [0046.681] lstrcmpW (lpString1="DD01179_.WMF", lpString2="32.EXE.exe") returned 1 [0046.681] StrStrW (lpFirst="DD01179_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.681] lstrcmpW (lpString1="DD01179_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.681] GetCurrentThreadId () returned 0x9b0 [0046.681] RtlWakeConditionVariable () returned 0x27e800 [0046.681] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="Windows") returned -1 [0046.681] lstrcmpW (lpString1="DD01180_.WMF", lpString2="32.EXE.exe") returned 1 [0046.681] StrStrW (lpFirst="DD01180_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.681] lstrcmpW (lpString1="DD01180_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.681] GetCurrentThreadId () returned 0x9b0 [0046.681] RtlWakeConditionVariable () returned 0x27e800 [0046.681] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="Windows") returned -1 [0046.681] lstrcmpW (lpString1="DD01181_.WMF", lpString2="32.EXE.exe") returned 1 [0046.681] StrStrW (lpFirst="DD01181_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.681] lstrcmpW (lpString1="DD01181_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.681] GetCurrentThreadId () returned 0x9b0 [0046.681] RtlWakeConditionVariable () returned 0x27e800 [0046.681] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="Windows") returned -1 [0046.681] lstrcmpW (lpString1="DD01182_.WMF", lpString2="32.EXE.exe") returned 1 [0046.681] StrStrW (lpFirst="DD01182_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.681] lstrcmpW (lpString1="DD01182_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.681] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.681] GetCurrentThreadId () returned 0x9b0 [0046.682] RtlWakeConditionVariable () returned 0x27e800 [0046.682] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="Windows") returned -1 [0046.682] lstrcmpW (lpString1="DD01183_.WMF", lpString2="32.EXE.exe") returned 1 [0046.682] StrStrW (lpFirst="DD01183_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.682] lstrcmpW (lpString1="DD01183_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.682] GetCurrentThreadId () returned 0x9b0 [0046.682] RtlWakeConditionVariable () returned 0x27e800 [0046.682] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="Windows") returned -1 [0046.682] lstrcmpW (lpString1="DD01186_.WMF", lpString2="32.EXE.exe") returned 1 [0046.682] StrStrW (lpFirst="DD01186_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.682] lstrcmpW (lpString1="DD01186_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.682] GetCurrentThreadId () returned 0x9b0 [0046.682] RtlWakeConditionVariable () returned 0x27e800 [0046.682] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="Windows") returned -1 [0046.682] lstrcmpW (lpString1="DD01366_.WMF", lpString2="32.EXE.exe") returned 1 [0046.682] StrStrW (lpFirst="DD01366_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.682] lstrcmpW (lpString1="DD01366_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.682] GetCurrentThreadId () returned 0x9b0 [0046.682] RtlWakeConditionVariable () returned 0x27e800 [0046.682] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="Windows") returned -1 [0046.682] lstrcmpW (lpString1="DD01434_.WMF", lpString2="32.EXE.exe") returned 1 [0046.682] StrStrW (lpFirst="DD01434_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.682] lstrcmpW (lpString1="DD01434_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.682] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.682] GetCurrentThreadId () returned 0x9b0 [0046.683] RtlWakeConditionVariable () returned 0x27e800 [0046.683] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="Windows") returned -1 [0046.683] lstrcmpW (lpString1="DD01585_.WMF", lpString2="32.EXE.exe") returned 1 [0046.683] StrStrW (lpFirst="DD01585_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.683] lstrcmpW (lpString1="DD01585_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.683] GetCurrentThreadId () returned 0x9b0 [0046.683] RtlWakeConditionVariable () returned 0x27e800 [0046.683] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="Windows") returned -1 [0046.683] lstrcmpW (lpString1="DD01586_.WMF", lpString2="32.EXE.exe") returned 1 [0046.683] StrStrW (lpFirst="DD01586_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.683] lstrcmpW (lpString1="DD01586_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.683] GetCurrentThreadId () returned 0x9b0 [0046.683] RtlWakeConditionVariable () returned 0x27e800 [0046.683] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="Windows") returned -1 [0046.683] lstrcmpW (lpString1="DD01628_.WMF", lpString2="32.EXE.exe") returned 1 [0046.683] StrStrW (lpFirst="DD01628_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.683] lstrcmpW (lpString1="DD01628_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.683] GetCurrentThreadId () returned 0x9b0 [0046.683] RtlWakeConditionVariable () returned 0x27e800 [0046.683] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="Windows") returned -1 [0046.683] lstrcmpW (lpString1="DD01629_.WMF", lpString2="32.EXE.exe") returned 1 [0046.683] StrStrW (lpFirst="DD01629_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.683] lstrcmpW (lpString1="DD01629_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.683] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.683] GetCurrentThreadId () returned 0x9b0 [0046.684] RtlWakeConditionVariable () returned 0x27e800 [0046.687] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="Windows") returned -1 [0046.687] lstrcmpW (lpString1="DD01630_.WMF", lpString2="32.EXE.exe") returned 1 [0046.687] StrStrW (lpFirst="DD01630_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.687] lstrcmpW (lpString1="DD01630_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.688] GetCurrentThreadId () returned 0x9b0 [0046.688] RtlWakeConditionVariable () returned 0x27e800 [0046.688] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="Windows") returned -1 [0046.688] lstrcmpW (lpString1="DD01631_.WMF", lpString2="32.EXE.exe") returned 1 [0046.688] StrStrW (lpFirst="DD01631_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.688] lstrcmpW (lpString1="DD01631_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.688] GetCurrentThreadId () returned 0x9b0 [0046.688] RtlWakeConditionVariable () returned 0x27e800 [0046.688] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="Windows") returned -1 [0046.688] lstrcmpW (lpString1="DD01761_.WMF", lpString2="32.EXE.exe") returned 1 [0046.688] StrStrW (lpFirst="DD01761_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.688] lstrcmpW (lpString1="DD01761_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.688] GetCurrentThreadId () returned 0x9b0 [0046.688] RtlWakeConditionVariable () returned 0x27e800 [0046.688] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="Windows") returned -1 [0046.688] lstrcmpW (lpString1="DD01772_.WMF", lpString2="32.EXE.exe") returned 1 [0046.688] StrStrW (lpFirst="DD01772_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.688] lstrcmpW (lpString1="DD01772_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.688] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.688] GetCurrentThreadId () returned 0x9b0 [0046.688] RtlWakeConditionVariable () returned 0x27e800 [0046.688] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="Windows") returned -1 [0046.688] lstrcmpW (lpString1="DD01793_.WMF", lpString2="32.EXE.exe") returned 1 [0046.688] StrStrW (lpFirst="DD01793_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.688] lstrcmpW (lpString1="DD01793_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.689] GetCurrentThreadId () returned 0x9b0 [0046.689] RtlWakeConditionVariable () returned 0x27e800 [0046.689] lstrcmpiW (lpString1="EAST_01.MID", lpString2="Windows") returned -1 [0046.689] lstrcmpW (lpString1="EAST_01.MID", lpString2="32.EXE.exe") returned 1 [0046.689] StrStrW (lpFirst="EAST_01.MID", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.689] lstrcmpW (lpString1="EAST_01.MID", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.689] GetCurrentThreadId () returned 0x9b0 [0046.689] RtlWakeConditionVariable () returned 0x27e800 [0046.689] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="Windows") returned -1 [0046.689] lstrcmpW (lpString1="ED00010_.WMF", lpString2="32.EXE.exe") returned 1 [0046.689] StrStrW (lpFirst="ED00010_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.689] lstrcmpW (lpString1="ED00010_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.689] GetCurrentThreadId () returned 0x9b0 [0046.689] RtlWakeConditionVariable () returned 0x27e800 [0046.689] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="Windows") returned -1 [0046.689] lstrcmpW (lpString1="ED00019_.WMF", lpString2="32.EXE.exe") returned 1 [0046.689] StrStrW (lpFirst="ED00019_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.689] lstrcmpW (lpString1="ED00019_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.689] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.689] GetCurrentThreadId () returned 0x9b0 [0046.689] RtlWakeConditionVariable () returned 0x27e800 [0046.689] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="Windows") returned -1 [0046.689] lstrcmpW (lpString1="ED00172_.WMF", lpString2="32.EXE.exe") returned 1 [0046.689] StrStrW (lpFirst="ED00172_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.689] lstrcmpW (lpString1="ED00172_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.690] GetCurrentThreadId () returned 0x9b0 [0046.690] RtlWakeConditionVariable () returned 0x27e800 [0046.690] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="Windows") returned -1 [0046.690] lstrcmpW (lpString1="ED00184_.WMF", lpString2="32.EXE.exe") returned 1 [0046.690] StrStrW (lpFirst="ED00184_.WMF", lpSrch=".[DeAdmin@cock.li].DEADMIN") returned 0x0 [0046.690] lstrcmpW (lpString1="ED00184_.WMF", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0046.690] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x297990 [0046.690] GetCurrentThreadId () returned 0x9b0 [0046.690] RtlWakeConditionVariable () returned 0x27e800 [0046.690] RtlWakeConditionVariable () returned 0x27e800 [0046.690] RtlWakeConditionVariable () returned 0x27e800 [0051.632] lstrcmpW (lpString1="Invite or Link.one", lpString2="32.EXE.exe") returned 1 [0051.632] lstrcmpW (lpString1="Invite or Link.one", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.632] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.632] GetCurrentThreadId () returned 0x9b0 [0051.632] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x22a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDSINTL.DLL", cAlternateFileName="")) returned 1 [0051.632] lstrcmpW (lpString1="IPDSINTL.DLL", lpString2="32.EXE.exe") returned 1 [0051.633] lstrcmpW (lpString1="IPDSINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.633] GetCurrentThreadId () returned 0x9b0 [0051.633] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xd7b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDINTL.DLL", cAlternateFileName="")) returned 1 [0051.633] lstrcmpW (lpString1="IPEDINTL.DLL", lpString2="32.EXE.exe") returned 1 [0051.633] lstrcmpW (lpString1="IPEDINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.633] GetCurrentThreadId () returned 0x9b0 [0051.633] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLKINTL.DLL", cAlternateFileName="IPOLKI~1.DLL")) returned 1 [0051.633] lstrcmpW (lpString1="IPOLKINTL.DLL", lpString2="32.EXE.exe") returned 1 [0051.633] lstrcmpW (lpString1="IPOLKINTL.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.633] GetCurrentThreadId () returned 0x9b0 [0051.633] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x3cebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issue Tracking.gta", cAlternateFileName="ISSUET~1.GTA")) returned 1 [0051.633] lstrcmpW (lpString1="Issue Tracking.gta", lpString2="32.EXE.exe") returned 1 [0051.633] lstrcmpW (lpString1="Issue Tracking.gta", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.633] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.633] GetCurrentThreadId () returned 0x9b0 [0051.633] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JADE.CSS", cAlternateFileName="")) returned 1 [0051.633] lstrcmpW (lpString1="JADE.CSS", lpString2="32.EXE.exe") returned 1 [0051.634] lstrcmpW (lpString1="JADE.CSS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.634] GetCurrentThreadId () returned 0x9b0 [0051.634] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xafe69b00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9980, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.VSL", cAlternateFileName="")) returned 1 [0051.634] lstrcmpW (lpString1="LGND.VSL", lpString2="32.EXE.exe") returned 1 [0051.634] lstrcmpW (lpString1="LGND.VSL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.634] GetCurrentThreadId () returned 0x9b0 [0051.634] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x112970, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL", cAlternateFileName="")) returned 1 [0051.634] lstrcmpW (lpString1="MAPIR.DLL", lpString2="32.EXE.exe") returned 1 [0051.634] lstrcmpW (lpString1="MAPIR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.634] GetCurrentThreadId () returned 0x9b0 [0051.634] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.IDX_DLL", cAlternateFileName="MAPIRD~1.IDX")) returned 1 [0051.634] lstrcmpW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="32.EXE.exe") returned 1 [0051.634] lstrcmpW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.634] GetCurrentThreadId () returned 0x9b0 [0051.634] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0051.634] lstrcmpW (lpString1="MAPISHELLR.DLL", lpString2="32.EXE.exe") returned 1 [0051.634] lstrcmpW (lpString1="MAPISHELLR.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.634] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.635] GetCurrentThreadId () returned 0x9b0 [0051.635] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x100fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MERES.DLL", cAlternateFileName="")) returned 1 [0051.635] lstrcmpW (lpString1="MERES.DLL", lpString2="32.EXE.exe") returned 1 [0051.635] lstrcmpW (lpString1="MERES.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.635] GetCurrentThreadId () returned 0x9b0 [0051.635] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6cf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.DLL", cAlternateFileName="")) returned 1 [0051.635] lstrcmpW (lpString1="MOR6INT.DLL", lpString2="32.EXE.exe") returned 1 [0051.635] lstrcmpW (lpString1="MOR6INT.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.635] GetCurrentThreadId () returned 0x9b0 [0051.635] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x9b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.IDX_DLL", cAlternateFileName="MOR6IN~1.IDX")) returned 1 [0051.635] lstrcmpW (lpString1="MOR6INT.REST.IDX_DLL", lpString2="32.EXE.exe") returned 1 [0051.635] lstrcmpW (lpString1="MOR6INT.REST.IDX_DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319af8 [0051.635] GetCurrentThreadId () returned 0x9b0 [0051.635] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00b00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b00b00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOVE.VRD", cAlternateFileName="")) returned 1 [0051.635] lstrcmpW (lpString1="MOVE.VRD", lpString2="32.EXE.exe") returned 1 [0051.635] lstrcmpW (lpString1="MOVE.VRD", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.635] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.635] GetCurrentThreadId () returned 0x9b0 [0051.636] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x3178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXRES.DLL", cAlternateFileName="")) returned 1 [0051.636] lstrcmpW (lpString1="MPXRES.DLL", lpString2="32.EXE.exe") returned 1 [0051.636] lstrcmpW (lpString1="MPXRES.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.636] GetCurrentThreadId () returned 0x9b0 [0051.636] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0xa3f874, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV.HXS", cAlternateFileName="MSACCE~1.HXS")) returned 1 [0051.636] lstrcmpW (lpString1="MSACCESS.DEV.HXS", lpString2="32.EXE.exe") returned 1 [0051.636] lstrcmpW (lpString1="MSACCESS.DEV.HXS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.636] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.636] GetCurrentThreadId () returned 0x9b0 [0051.643] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXC", cAlternateFileName="MSACCE~1.HXC")) returned 1 [0051.643] lstrcmpW (lpString1="MSACCESS.DEV_COL.HXC", lpString2="32.EXE.exe") returned 1 [0051.643] lstrcmpW (lpString1="MSACCESS.DEV_COL.HXC", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.643] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319af8 [0051.644] GetCurrentThreadId () returned 0x9b0 [0051.644] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXT", cAlternateFileName="MSACCE~1.HXT")) returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.DEV_COL.HXT", lpString2="32.EXE.exe") returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.DEV_COL.HXT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319af8 [0051.644] GetCurrentThreadId () returned 0x9b0 [0051.644] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_F_COL.HXK", cAlternateFileName="MSACCE~1.HXK")) returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.DEV_F_COL.HXK", lpString2="32.EXE.exe") returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.DEV_F_COL.HXK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319af8 [0051.644] GetCurrentThreadId () returned 0x9b0 [0051.644] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_K_COL.HXK", cAlternateFileName="MSACCE~2.HXK")) returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.DEV_K_COL.HXK", lpString2="32.EXE.exe") returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.DEV_K_COL.HXK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa0) returned 0x319af8 [0051.644] GetCurrentThreadId () returned 0x9b0 [0051.644] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS", cAlternateFileName="")) returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.HXS", lpString2="32.EXE.exe") returned 1 [0051.644] lstrcmpW (lpString1="MSACCESS.HXS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.644] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.644] GetCurrentThreadId () returned 0x9b0 [0051.645] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC", cAlternateFileName="MSACCE~2.HXC")) returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_COL.HXC", lpString2="32.EXE.exe") returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_COL.HXC", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.645] GetCurrentThreadId () returned 0x9b0 [0051.645] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT", cAlternateFileName="MSACCE~2.HXT")) returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_COL.HXT", lpString2="32.EXE.exe") returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_COL.HXT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.645] GetCurrentThreadId () returned 0x9b0 [0051.645] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK", cAlternateFileName="MSACCE~3.HXK")) returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_F_COL.HXK", lpString2="32.EXE.exe") returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_F_COL.HXK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.645] GetCurrentThreadId () returned 0x9b0 [0051.645] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK", cAlternateFileName="MSACCE~4.HXK")) returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_K_COL.HXK", lpString2="32.EXE.exe") returned 1 [0051.645] lstrcmpW (lpString1="MSACCESS_K_COL.HXK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.645] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.645] GetCurrentThreadId () returned 0x9b0 [0051.645] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x127f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAIN.DLL", cAlternateFileName="")) returned 1 [0051.646] lstrcmpW (lpString1="MSAIN.DLL", lpString2="32.EXE.exe") returned 1 [0051.646] lstrcmpW (lpString1="MSAIN.DLL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.646] GetCurrentThreadId () returned 0x9b0 [0051.646] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589e0a00, ftCreationTime.dwHighDateTime=0x1c99224, ftLastAccessTime.dwLowDateTime=0x980ce30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x589e0a00, ftLastWriteTime.dwHighDateTime=0x1c99224, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0051.646] lstrcmpW (lpString1="MSO.ACL", lpString2="32.EXE.exe") returned 1 [0051.646] lstrcmpW (lpString1="MSO.ACL", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.646] GetCurrentThreadId () returned 0x9b0 [0051.646] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15bf200, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe15bf200, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x69560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS", cAlternateFileName="")) returned 1 [0051.646] lstrcmpW (lpString1="MSOUC.HXS", lpString2="32.EXE.exe") returned 1 [0051.646] lstrcmpW (lpString1="MSOUC.HXS", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x80) returned 0x311488 [0051.646] GetCurrentThreadId () returned 0x9b0 [0051.646] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC", cAlternateFileName="MSOUC_~1.HXC")) returned 1 [0051.646] lstrcmpW (lpString1="MSOUC_COL.HXC", lpString2="32.EXE.exe") returned 1 [0051.646] lstrcmpW (lpString1="MSOUC_COL.HXC", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.646] GetCurrentThreadId () returned 0x9b0 [0051.646] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT", cAlternateFileName="MSOUC_~1.HXT")) returned 1 [0051.646] lstrcmpW (lpString1="MSOUC_COL.HXT", lpString2="32.EXE.exe") returned 1 [0051.647] lstrcmpW (lpString1="MSOUC_COL.HXT", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.647] GetCurrentThreadId () returned 0x9b0 [0051.647] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK", cAlternateFileName="MSOUC_~1.HXK")) returned 1 [0051.647] lstrcmpW (lpString1="MSOUC_F_COL.HXK", lpString2="32.EXE.exe") returned 1 [0051.647] lstrcmpW (lpString1="MSOUC_F_COL.HXK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.647] GetCurrentThreadId () returned 0x9b0 [0051.647] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK", cAlternateFileName="MSOUC_~2.HXK")) returned 1 [0051.647] lstrcmpW (lpString1="MSOUC_K_COL.HXK", lpString2="32.EXE.exe") returned 1 [0051.647] lstrcmpW (lpString1="MSOUC_K_COL.HXK", lpString2="!_HOW_RECOVERY_FILES_!.txt") returned 1 [0051.647] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x90) returned 0x277b960 [0051.647] GetCurrentThreadId () returned 0x9b0 [0051.647] FindNextFileW (in: hFindFile=0x27e130, lpFindFileData=0x260f1a8 | out: lpFindFileData=0x260f1a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x487dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV.HXS", cAlternateFileName="MSPUBD~1.HXS")) returned 1 [0074.425] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.425] lstrcmpW (lpString1=".", lpString2="32.EXE.exe") returned -1 Thread: id = 14 os_tid = 0xa1c Thread: id = 38 os_tid = 0xafc Thread: id = 39 os_tid = 0xb00 Process: id = "2" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x50070000" os_pid = "0x990" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x97c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x994 Thread: id = 10 os_tid = 0x9c0 Thread: id = 11 os_tid = 0x9cc Thread: id = 12 os_tid = 0x9dc Thread: id = 13 os_tid = 0x9e0 Process: id = "3" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4bf81000" os_pid = "0x9f4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x990" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00052e41" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 15 os_tid = 0xab0 Thread: id = 16 os_tid = 0xa14 Thread: id = 17 os_tid = 0xa0c Thread: id = 18 os_tid = 0xa08 [0039.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xebd600 | out: lpSystemTimeAsFileTime=0xebd600*(dwLowDateTime=0xa671b170, dwHighDateTime=0x1d585b4)) [0039.652] GetCurrentProcessId () returned 0x9f4 [0039.652] GetCurrentThreadId () returned 0xa08 [0039.652] GetTickCount () returned 0x1144579 [0039.652] QueryPerformanceCounter (in: lpPerformanceCount=0xebd608 | out: lpPerformanceCount=0xebd608*=15965349311) returned 1 [0039.653] malloc (_Size=0x100) returned 0x478e80 Thread: id = 19 os_tid = 0xa04 Thread: id = 20 os_tid = 0xa00 Thread: id = 21 os_tid = 0x9f8 Thread: id = 22 os_tid = 0xab4 Thread: id = 37 os_tid = 0xabc Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x9f4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 23 os_tid = 0xa88 Thread: id = 24 os_tid = 0x7e4 Thread: id = 25 os_tid = 0x76c Thread: id = 26 os_tid = 0x758 Thread: id = 27 os_tid = 0x74c Thread: id = 28 os_tid = 0x72c Thread: id = 29 os_tid = 0x71c Thread: id = 30 os_tid = 0x718 Thread: id = 31 os_tid = 0x638 Thread: id = 32 os_tid = 0x154 Thread: id = 33 os_tid = 0x150 Thread: id = 34 os_tid = 0x12c Thread: id = 35 os_tid = 0x120 Thread: id = 36 os_tid = 0x3fc